diff --git a/app/src/main/kotlin/com/youcoded/app/runtime/SessionService.kt b/app/src/main/kotlin/com/youcoded/app/runtime/SessionService.kt
index 97d46f981..aa34b255e 100644
--- a/app/src/main/kotlin/com/youcoded/app/runtime/SessionService.kt
+++ b/app/src/main/kotlin/com/youcoded/app/runtime/SessionService.kt
@@ -4234,6 +4234,9 @@ class SessionService : Service() {
             // native:set-binding below — has a msg.id, so this replies
             // not-implemented-on-mobile rather than no-op'ing.
             "native:queue-remove",
+            // "Send now" on a waiting message — request/response like
+            // native:queue-remove, so it replies not-implemented-on-mobile.
+            "native:queue-send-now",
             "native:interrupt",
             // Stalled-turn Retry. Fire-and-forget (no msg.id) exactly like
             // native:send / native:interrupt, so this is a correct no-op here:
diff --git a/desktop/line-budgets.json b/desktop/line-budgets.json
index 024dbcd6a..324a1fee6 100644
--- a/desktop/line-budgets.json
+++ b/desktop/line-budgets.json
@@ -7,22 +7,22 @@
     "renderer/dev/workbench/fixtures/marketplace/registry.ts": "generated sample of the marketplace registries (regenerated by a script, not hand-edited)"
   },
   "budgets": {
-    "main/ipc-handlers.ts": 5728,
-    "main/harness/native-session-host.ts": 5296,
-    "renderer/App.tsx": 4966,
-    "main/remote-server.ts": 4217,
+    "main/ipc-handlers.ts": 5731,
+    "main/harness/native-session-host.ts": 5311,
+    "renderer/App.tsx": 4981,
+    "main/remote-server.ts": 4223,
     "main/harness/harness-session.ts": 4229,
     "renderer/components/SettingsPanel.tsx": 3256,
-    "renderer/remote-shim.ts": 3176,
+    "renderer/remote-shim.ts": 3177,
     "renderer/state/chat-reducer.ts": 3397,
     "renderer/styles/globals.css": 2960,
     "renderer/components/SessionStrip.tsx": 2784,
     "main/main.ts": 2604,
-    "shared/types.ts": 2391,
+    "shared/types.ts": 2394,
     "renderer/components/SyncPanel.tsx": 2060,
     "main/engine/engine-manager.ts": 2035,
     "renderer/components/ResumeBrowser.tsx": 2069,
-    "main/preload.ts": 1961,
+    "main/preload.ts": 1963,
     "renderer/components/StatusBar.tsx": 1809,
     "renderer/components/ToolCard.tsx": 1636
   }
diff --git a/desktop/package.json b/desktop/package.json
index 096bb30a8..07e79b5ff 100644
--- a/desktop/package.json
+++ b/desktop/package.json
@@ -17,7 +17,7 @@
     "lint": "oxlint --type-aware",
     "postinstall": "node scripts/patch-node-pty.js && node scripts/patch-xterm-webgl-mipmap.js",
     "typecheck": "tsgo --noEmit -p tsconfig.json && tsgo --noEmit -p tsconfig.tests.json",
-    "lint:design": "oxlint -c .oxlintrc.design.json --format default --max-warnings 542"
+    "lint:design": "oxlint -c .oxlintrc.design.json --format default --max-warnings 537"
   },
   "keywords": [],
   "author": "itsdestin",
diff --git a/desktop/src/main/harness/busy-message-boundary.ts b/desktop/src/main/harness/busy-message-boundary.ts
new file mode 100644
index 000000000..614d62bca
--- /dev/null
+++ b/desktop/src/main/harness/busy-message-boundary.ts
@@ -0,0 +1,66 @@
+import type { ModelMessage } from 'ai';
+import { finalizeRemainingCalls } from './tool-group-finalization';
+
+export interface BusyMessage {
+  id: string;
+  text: string;
+  attachments: string[];
+  restore?: () => void;
+}
+
+/** WHY: the claim and acceptance are one synchronous boundary. An exception
+ * returns the unaccepted head to its host, rather than losing a queued send. */
+export function claimBusyMessage(
+  take: (() => BusyMessage | undefined) | undefined,
+  accept: (item: BusyMessage) => void,
+  beforeAccept?: () => void,
+): boolean {
+  const item = take?.();
+  if (!item) return false;
+  try {
+    beforeAccept?.();
+    accept(item);
+  } catch (err) {
+    item.restore?.();
+    throw err;
+  }
+  return true;
+}
+
+/** WHY: the emitted event is the authority for both live and rebuilt history;
+ * no synthetic steer or app-generated marker is used for human input. */
+export function appendUserHistory(
+  text: string, attachments: string[], emit: () => string, appGenerated: boolean,
+  imageParts: (paths: string[]) => Array<{ type: 'file'; mediaType: string; data: Buffer }>,
+  markAppGenerated: (message: ModelMessage) => ModelMessage,
+  history: ModelMessage[], origins: Array<string[] | null>, record: (uuid: string) => void,
+): void {
+  const images = imageParts(attachments);
+  const uuid = emit();
+  const message = (images.length
+    ? { role: 'user', content: [{ type: 'text', text }, ...images] } as ModelMessage
+    : { role: 'user', content: text } as ModelMessage);
+  history.push(appGenerated ? markAppGenerated(message) : message);
+  origins.push([uuid]);
+  record(uuid);
+}
+
+/** Pair every unstarted call before adding new human input. Already completed
+ * results stay at the front of the same tool message. */
+export function supersedeToolGroup<TCall extends { toolCallId: string; toolName: string }, TPart>(
+  calls: readonly TCall[], from: number, completed: TPart[], completedOrigins: string[],
+  emit: (data: { toolUseId: string; toolName: string; toolResult: string; isError: true }) => string,
+  part: (call: TCall, text: string) => TPart,
+  record: (uuid: string) => void, commit: (parts: TPart[], origins: string[]) => void,
+  injectCompleted: (calls: TCall[]) => void,
+  reason = 'Not run: new user input arrived before this action started.',
+  afterCompleted?: () => void,
+): void {
+  const remaining = finalizeRemainingCalls(calls, from,
+    () => reason,
+    (call, text) => emit({ toolUseId: call.toolCallId, toolName: call.toolName, toolResult: text, isError: true }), part);
+  remaining.origins.forEach(record);
+  commit([...completed, ...remaining.parts], [...completedOrigins, ...remaining.origins]);
+  injectCompleted(calls.slice(0, from));
+  afterCompleted?.();
+}
diff --git a/desktop/src/main/harness/eval/run-case.ts b/desktop/src/main/harness/eval/run-case.ts
index fea8c4f68..085709833 100644
--- a/desktop/src/main/harness/eval/run-case.ts
+++ b/desktop/src/main/harness/eval/run-case.ts
@@ -9,6 +9,7 @@ import { ASSISTANT_PRESET } from '../../../shared/harness-manifest';
 import { CORE_TOOLS } from '../tools';
 import { seedFixtureWorkspace } from './fixture-workspace';
 import { assembleSystemPrompt } from '../prompt-assembly';
+import { prepareProjectInstructions } from '../injection/project-instructions';
 import { resolvePreset } from '../preset-registry';
 import { BATTERY_PROMPT } from './battery';
 import type { TranscriptEvent } from '../../../shared/types';
@@ -411,6 +412,9 @@ export async function runCase(opts: RunCaseOpts): Promise<CaseRun> {
   const wrapUpPrompt = opts.wrapUpPrompt ?? WRAP_UP_PROMPT;
 
   const fixtureRoot = seedFixtureWorkspace(opts.instructions);
+  // WHY: evaluator uses the production async inventory, but fixture experiments
+  // cannot silently inherit real instructions above their disposable root.
+  const projectInstructionFiles = await prepareProjectInstructions(fixtureRoot, 20_000, fixtureRoot);
   const events: TranscriptEvent[] = [];
   let toolCalls = 0;
   let asks = 0;
@@ -486,6 +490,7 @@ export async function runCase(opts: RunCaseOpts): Promise<CaseRun> {
         presetBody: resolvePreset('assistant').body,
         cwd: fixtureRoot,
         appVersion: 'eval',
+        projectInstructionFiles,
       }),
       // Load-bearing (2026-08-11): omitted, HarnessSession takes fitToContext's
       // own 32_768 default, which against this harness's output ceiling left a
diff --git a/desktop/src/main/harness/harness-session.ts b/desktop/src/main/harness/harness-session.ts
index d19f01fe7..a3bcd6a54 100644
--- a/desktop/src/main/harness/harness-session.ts
+++ b/desktop/src/main/harness/harness-session.ts
@@ -172,6 +172,9 @@ export function rememberedRuleFor(
 }
 import { formatAnswers } from './tools/ask-user-question';
 import { formatArgErrors } from './tools/arg-errors';
+import { parseToolArgs } from './tool-args';
+import { PermissionCallbackFailure, permissionCallback, finalizeRemainingCalls } from './tool-group-finalization';
+import { appendUserHistory, claimBusyMessage, supersedeToolGroup } from './busy-message-boundary';
 import type { AskRequest, AskDecision } from './permission-broker';
 import { CLOUD_DEFAULT, type CapabilityProfile } from './capability-profile';
 import { adaptForWire } from './wire-adapter';
@@ -187,7 +190,10 @@ import type { RunningCalls } from './askpass/running-calls';
 import type { AdminPasswordServiceLike } from './admin-password-service';
 import { createSkillCatalog, type SkillCatalog } from './skills/skill-catalog';
 import { fitInjection } from './injection/injection-budget';
+import { pendingRules, deliverRules } from './injection/rule-delivery';
+import type { PathTrigger } from './injection/path-triggers';
 import type { TriggerIndex } from './injection/path-triggers';
+import { retainedRuleMessages } from './injection/retained-rule-visibility';
 import { mcpToolsFor, estimateToolSchemaTokens } from './mcp/mcp-tools';
 import type { ReadyServer } from './mcp/mcp-manager';
 import {
@@ -220,6 +226,9 @@ export interface HarnessSessionOpts {
   /** The tool set this session may call. Absent/[] = v0 chat behavior (the
    *  Chat-preset path: plain text, no tool plumbing invoked). */
   tools?: NativeTool[];
+  /** Root-only synchronous FIFO claim. restore returns an unaccepted claim to the host
+   * if an event append fails; no second turn or await occurs during a claim. */
+  takeReadyBusyMessage?: () => ({ id: string; text: string; attachments: string[]; restore?: () => void } | undefined);
   /** Pure permission decision for (tool, subject) — the configured layers
    *  (preset/mode/deny-list/remembered). Absent → every gated tool asks. */
   decide?: (tool: string, subject: string | undefined) => Promise<PermissionDecision>;
@@ -812,8 +821,8 @@ export class HarnessSession extends EventEmitter {
   private toolByName: Map<string, NativeTool>;
   private readRegistry = new Map<string, string>();  // canonical path → content fingerprint at last Read (tools/file-fingerprint.ts)
   /** G-11 (2026-08-26 tools investigation) — what Read has already served this
-   *  session (`path|offset|limit` → mtime + which call). Read answers a repeat
-   *  of an unchanged slice with "the content you already have is current"
+   *  session (`path|offset|limit` → fingerprint + which call). Only after
+   *  verifying current bytes does Read say "the content you already have is current"
    *  instead of the content. That sentence is only true while the earlier
    *  result is still in the model's view, so this is cleared at EVERY site that
    *  discards or shrinks history: seedHistory (resume), clearHistory (/clear),
@@ -847,9 +856,14 @@ export class HarnessSession extends EventEmitter {
   // Resolved capability profile (Task 5). Drives the doom-loop window + tool
   // attachment; re-assigned by setBinding on a mid-session model swap.
   private profile: CapabilityProfile;
-  /** Trigger ids already injected in this session. Survives across turns on
-   *  purpose — a rule is a standing instruction, not a per-turn reminder. */
+  /** Rule dedupe survives turns, but is reconciled after history rewrites. */
   private readonly injectedTriggerIds = new Set<string>();
+  private retainedTriggerMessages = new Set<string>();
+
+  private reconcileTriggerVisibility(): void {
+    this.injectedTriggerIds.clear();
+    this.retainedTriggerMessages = retainedRuleMessages(this.history);
+  }
   /** Delivered-image dedupe: canonical path → { mtimeMs at delivery, the tool
    *  call whose result carried the image }. A model that
    *  re-Reads the SAME unchanged file gets "already visible" text, not a second
@@ -997,9 +1011,8 @@ export class HarnessSession extends EventEmitter {
     continuationBinding?: string; messageOrigins?: Array<string[] | null>;
   }): void {
     this.history = messages;
-    // WHY: a flat accepted seed cannot locate a tail cut. Only the event-by-
-    // event rebuild supplies aligned origins; reject a mismatched or invented
-    // map instead of guessing a portable resume point.
+    this.reconcileTriggerVisibility();
+    // WHY: only event-by-event origins prove a portable resume cut.
     const known = new Set(seed?.eventUuids ?? []);
     this.historyOrigins = seed?.messageOrigins?.length === messages.length &&
       seed.messageOrigins.every(part => part === null || part.every(uuid => known.has(uuid)))
@@ -1371,49 +1384,29 @@ export class HarnessSession extends EventEmitter {
     }
   }
 
-  /** Append any project rules / nested project instructions that the paths this
-   *  step touched activate (M3 item 3).
-   *
-   *  As a MESSAGE, never a system-prompt edit. prompt-assembly.ts is byte-stable
-   *  by construction and a mid-session change would discard the KV cache prefix
-   *  every local model reuses, turning a cheap follow-up turn into a full
-   *  re-prefill of the entire conversation.
-   *
-   *  ONCE per trigger per session. A rule re-sent after every Read of a matching
-   *  file would dominate the conversation and blow the window it was sized
-   *  against — and repetition does not make a model follow a rule harder.
-   *
-   *  Bash is skipped: its permission subject is a command string, not a path,
-   *  so feeding it to a path matcher would be a category error.
-   */
-  private injectPathTriggers(calls: ToolCall[]): void {
-    const index = this.opts.triggers;
-    if (!index) return;
-    for (const call of calls) {
-      // Same reasoning as the path guard: matching a rule glob against a bash
-      // command or a skill id is a category error, not a near-miss.
-      if (NON_PATH_SUBJECT_TOOLS.has(call.toolName)) continue;
-      const tool = this.toolByName.get(call.toolName);
-      const subject = tool?.permissionSubject(call.input as any);
-      if (!subject) continue;
-      for (const t of index.match(subject)) {
-        if (this.injectedTriggerIds.has(t.id)) continue;
-        this.injectedTriggerIds.add(t.id);
-        // t.source is the rule's path relative to cwd — inside the project, so the
-        // model can actually read it when the notice tells it to.
-        const fitted = fitInjection(t.body, this.profile.injectionBudgetTokens, t.source);
+  /** Project guidance is history, never a system-prompt edit (KV-cache prefix).
+   * Selection, fit and retained-context dedupe are shared with the pre-write
+   * barrier in rule-delivery.ts; Bash/Task/Skill/web have no file subjects. */
+  private pendingPathTriggers(calls: ToolCall[]): PathTrigger[] {
+    return pendingRules(calls, this.opts.triggers, this.toolByName,
+      this.profile.injectionBudgetTokens, NON_PATH_SUBJECT_TOOLS,
+      this.injectedTriggerIds, this.retainedTriggerMessages);
+  }
+
+  private appendPathTriggers(triggers: readonly PathTrigger[], bounded = false): void {
+    deliverRules(triggers, this.profile.injectionBudgetTokens, bounded,
+      this.injectedTriggerIds, this.retainedTriggerMessages, content => {
         this.historyOrigins.push(null);
-        this.history.push(markAppGenerated({
-          role: 'user',
-          content: `<project-rule source="${t.source}">\n${fitted.text}\n</project-rule>`,
-        }));
-        this.capture.mutated();   // injected rule text, backed by no event
-      }
-    }
+        this.history.push(markAppGenerated({ role: 'user', content }));
+        this.capture.mutated();
+      });
+  }
+
+  private injectPathTriggers(calls: ToolCall[]): void {
+    this.appendPathTriggers(this.pendingPathTriggers(calls));
   }
 
   /** Add or remove the Skill tool to match the CURRENT profile (M3 item 1).
-   *
    *  Skill is the one conditional tool: its description lists every offered
    *  skill's id and one-liner, and that rides the schema on every turn, so a
    *  small window cannot afford it. Those sessions still reach skills through
@@ -1950,6 +1943,7 @@ export class HarnessSession extends EventEmitter {
     // automatically at the trigger instead of only on an explicit /clear.
     this.shownImages.clear();
     this.history = replacement;
+    this.reconcileTriggerVisibility();
     this.historyOrigins = [null, ...this.historyOrigins.slice(cut)];
     this.reprojectContextUsed(estimateBefore);
     // Existing frozen event (no new type). `summary` is the canonical field the
@@ -1977,9 +1971,7 @@ export class HarnessSession extends EventEmitter {
     return true;
   }
 
-  /** Make a pruned copy of the history the live history, with every
-   *  bookkeeping consequence a prune has. Shared by the 'prune' decision and
-   *  the summary commit above. */
+  /** Adopt a pruned history and its bookkeeping consequences. */
   private commitPrune(pruned: ModelMessage[]): void {
     const before = this.history;
     // Prune can collapse an image 'content' output to text (compaction.ts)
@@ -1998,7 +1990,10 @@ export class HarnessSession extends EventEmitter {
     // tagging those as a transformation would bump the revision and invalidate a
     // published checkpoint for a history that never moved. Only a changed
     // message means "tool output no longer equals its event's text".
-    if (pruned.some((m, i) => m !== before[i])) { this.capture.markPruned(); this.prefixMoved = true; }
+    if (pruned.some((m, i) => m !== before[i]) || pruned.length !== before.length) {
+      this.reconcileTriggerVisibility();
+      this.capture.markPruned(); this.prefixMoved = true;
+    }
     if (countImageOutputs(pruned) < imagesBefore) this.shownImages.clear();
     // G-11: prune may have sliced an old Read result down to 2,000 chars (and
     // a summary discards it outright) — forget what was served so Read never
@@ -2180,6 +2175,7 @@ export class HarnessSession extends EventEmitter {
       this.shownImages.clear();
       this.servedReads.clear(); this.servedSkills.clear(); // same reason as maybeCompact
       this.history = replacement;
+      this.reconcileTriggerVisibility();
       this.historyOrigins = [null, ...this.historyOrigins.slice(cut)];
       this.reprojectContextUsed(estimateBeforeSummary);
       this.emit('transcript-event', committed);
@@ -2211,6 +2207,7 @@ export class HarnessSession extends EventEmitter {
     if (this.abort) return { ok: false, reason: 'turn-in-flight' };
     const estimateBefore = this.rewriteBaseline();
     this.history = [];
+    this.reconcileTriggerVisibility();
     this.historyOrigins = [];
     // What the model still holds after the barrier: the system prompt and the
     // tool schemas, not the conversation. Without this the status bar kept
@@ -2407,22 +2404,10 @@ export class HarnessSession extends EventEmitter {
     }), [], true);
   }
 
-  /** `attachments` are absolute paths to files the user attached in the composer.
-   *  Image ones become image parts on the user message when the model can see
-   *  them; everything else is ignored here and reaches the model as the path
-   *  text the composer already put in `text`.
-   *
-   *  WHY images ride ALONGSIDE the text rather than replacing it: `text` is the
-   *  dedup key. The renderer's optimistic bubble is confirmed by an EXACT match
-   *  against the `user-message` event's text (see native-send.ts), so the string
-   *  must stay byte-identical to what the composer built. The paths therefore
-   *  remain in the text AND the pixels are attached — the model gets both, and
-   *  the bubble still resolves. */
+  /** WHY: keep composer text byte-identical for optimistic bubble dedup;
+   * image parts ride alongside it, and paths persist for replay. */
   async send(text: string, attachments: string[] = []): Promise<void> {
-    // Attachments ride the persisted event (paths only — events carry no binary)
-    // so rebuildHistory can restore the pixels on resume. Emitted only when
-    // present to keep the no-attachment event byte-identical to before (#290
-    // follow-up fix 2).
+    // Persist paths for image replay; keep no-attachment event shape unchanged.
     return this.beginTurn(text, () => this.emitEvent('user-message', attachments.length ? { text, attachments } : { text }), attachments);
   }
 
@@ -2566,34 +2551,29 @@ export class HarnessSession extends EventEmitter {
     return { text, images };
   }
 
-  /** The turn driver. `emit` names how this turn ENTERED the conversation — a
-   *  typed message, or a skill invocation — which is the only thing that differs
-   *  between send() and runSkill(). Everything downstream is identical. */
+  /** WHY: busy input shares the opening send's durable event/image/capture path. */
+  private acceptUserMessage(text: string, attachments: string[], emit: () => string, appGenerated = false): void {
+    appendUserHistory(text, attachments, emit, appGenerated, paths => this.imagePartsFor(paths),
+      markAppGenerated, this.history, this.historyOrigins, uuid => this.capture.recordEvent(uuid));
+  }
+
+  /** Restore an unaccepted ready head before the host's next drain. */
+  private acceptReadyBusyMessage(): boolean {
+    return claimBusyMessage(this.opts.takeReadyBusyMessage, item => this.acceptUserMessage(
+      item.text, item.attachments, () => this.emitEvent('user-message',
+        item.attachments.length ? { text: item.text, attachments: item.attachments } : { text: item.text })));
+  }
+
+  /** `emit` distinguishes user sends from skill invocation; the driver is shared. */
   private async beginTurn(text: string, emit: () => string, attachments: string[] = [], appGenerated = false): Promise<void> {
-    // Re-entrancy guard: a non-null abort means a turn is already streaming.
-    // Throw loudly rather than corrupt the single-slot turn state (see the
-    // class-level CONCURRENCY PRECONDITION note).
+    // Never overwrite the active turn's single-slot state.
     if (this.abort) {
       throw new Error('HarnessSession: a turn is already in flight — callers must serialize send()/runSkill() per session.');
     }
     this.interrupted = false;
     this._currentUsageProgress = null;
     this.bashOutputReadsThisTurn = 0;   // G-1 (D7): the cap is per TURN, notice turns included
-    // The uuid of the user-message / skill-invoked event this turn entered on —
-    // recorded at the history push below, which is the mutation it accounts for.
-    const enteringEventUuid = emit();
-    // A plain string when there are no image parts — that is the byte-identical
-    // shape every existing test and rebuildHistory() already assert on, so the
-    // no-attachment path must not become a one-element parts array.
-    const imageParts = this.imagePartsFor(attachments);
-    const enteringMessage = (imageParts.length
-      ? { role: 'user', content: [{ type: 'text', text }, ...imageParts] } as ModelMessage
-      : { role: 'user', content: text } as ModelMessage);
-    this.history.push(appGenerated ? markAppGenerated(enteringMessage) : enteringMessage);
-    this.historyOrigins.push([enteringEventUuid]);
-    // Both shapes descend from the SAME event — its text, and (for the image
-    // parts) the attachment paths it carries.
-    this.capture.recordEvent(enteringEventUuid);
+    this.acceptUserMessage(text, attachments, emit, appGenerated);
     this.abort = new AbortController();
     this.turnEverParked = false;   // cleared at the start of every turn — see field WHY
     this.lastStepPromptTokens = 0;   // a new turn always begins with a full prefill
@@ -2682,6 +2662,14 @@ export class HarnessSession extends EventEmitter {
       ? undefined
       : this.opts.harness.limits?.maxSteps;
     let stepsSinceApproval = 0;
+    // WHY (Destin, 2026-09-28 PR-review deck Q-2): a message you send mid-task
+    // is you taking part, so the "keep going?" count starts over whenever one
+    // joins the running turn — as it did when every message began a new turn.
+    const absorbReadyMessage = (): boolean => {
+      if (!this.acceptReadyBusyMessage()) return false;
+      stepsSinceApproval = 0;
+      return true;
+    };
     // Consecutive contentless steps (empty-step recovery, spec 2026-08-21).
     // The single silent retry is allowed only at count 1; any real step resets
     // it, so an all-empty turn costs exactly two provider calls.
@@ -2774,8 +2762,8 @@ export class HarnessSession extends EventEmitter {
         this.overflowOutputStarted = false;
         while (true) {
           try {
-            step = await withChatGptRequest(this.opts.sessionId, this.opts.isSpecialistChild ? 'specialist' : 'chat', () => this.withRetry(() =>
-              this.consumeStep(model, aiTools, (t) => { partialAssistantText = t; }),
+            step = await withChatGptRequest(this.opts.sessionId, this.opts.isSpecialistChild ? 'specialist' : 'chat', () => this.withRetry((registerRetraction) =>
+              this.consumeStep(model, aiTools, (t) => { partialAssistantText = t; }, registerRetraction),
             ));
             break;
           } catch (err) {
@@ -2969,18 +2957,20 @@ export class HarnessSession extends EventEmitter {
             });
             continue turnLoop;
           }
-          // Second consecutive empty step: an orderly completion with an honest
-          // reason. Set HERE, not in mapStopReason — 'empty_response' is a
-          // loop-level judgment about two steps, not a mapping of one
-          // provider finishReason.
+          // WHY: second empty is a final boundary; new input re-arms recovery.
+          if (absorbReadyMessage()) {
+            consecutiveEmptySteps = 0;
+            continue turnLoop;
+          }
           stopReason = 'empty_response';
           break;
         }
         consecutiveEmptySteps = 0;   // any real step re-arms the single retry
 
         if (step.toolCalls.length === 0) {
-          // Natural stop. finishReason 'length' (truncated output, including a
-          // truncated tool-call) collapses to 'max_tokens' via mapStopReason.
+          // WHY: no await before completion; late heads use the host drain.
+          if (absorbReadyMessage()) continue turnLoop;
+          // Natural stop; mapStopReason handles truncated output as max_tokens.
           stopReason = mapStopReason(step.finishReason);
           break;
         }
@@ -3022,50 +3012,78 @@ export class HarnessSession extends EventEmitter {
         const recordResult = (uuid: string): void => { this.capture.recordEvent(uuid); resultOrigins.push(uuid); };
         for (let i = 0; i < step.toolCalls.length; i++) {
           const call = step.toolCalls[i];
-          const payload = await this.runOneTool(call, recentCalls);   // NEVER throws
-          if (payload === 'interrupted') {
-            // Interrupt during a permission ask. Back-fill canceled tool-results
-            // for THIS call AND every remaining un-executed call in the step
-            // (earlier calls already have real results in resultParts + emitted
-            // events). Every call's tool-use event was already emitted up front,
-            // so each still gets a matching tool-result event here. Without this,
-            // the assistant(tool-call) message has no matching tool message — a
-            // dangling tool_call that provider APIs hard-reject (HTTP 400) on the
-            // NEXT send, bricking the session (the bad message persists in history
-            // across sends). CC does the same canceled back-fill. The synthesized
-            // tool-result events keep the persisted transcript in agreement with
-            // the model-facing history.
-            for (let j = i; j < step.toolCalls.length; j++) {
-              const rem = step.toolCalls[j];
-              recordResult(
-                this.emitEvent('tool-result', { toolUseId: rem.toolCallId, toolName: rem.toolName, toolResult: CANCELED_TOOL_TEXT, isError: true }));
-              resultParts.push(this.toolResultPart(rem, CANCELED_TOOL_TEXT));
+          if ((call.toolName === 'Write' || call.toolName === 'Edit') &&
+              !this.interrupted && !this.abort.signal.aborted) {
+            const newlyRelevant = this.pendingPathTriggers([call]);
+            if (newlyRelevant.length) {
+              // WHY (Destin, 2026-09-28 PR-review deck Q-5): show the new rules
+              // ONCE, then let the model decide again — even on a small model
+              // whose window only fits a shortened version. A shortened rule
+              // ends with "Read <file> for the rest", so the model can fetch the
+              // remainder itself. The earlier design refused the change outright
+              // when rules could not fit, which silently ended the turn and left
+              // small models unable to edit files in rule-heavy projects.
+              supersedeToolGroup(step.toolCalls, i, resultParts, resultOrigins,
+                data => this.emitEvent('tool-result', data), (rem, text) => this.toolResultPart(rem, text),
+                uuid => this.capture.recordEvent(uuid), (parts, origins) => {
+                  this.history.push({ role: 'tool', content: parts });
+                  this.historyOrigins.push(origins);
+                }, calls => this.injectPathTriggers(calls),
+                'Not run: newly applicable project instructions need review before changing this file.',
+                () => {
+                  if (!this.interrupted && !this.abort?.signal.aborted)
+                    this.appendPathTriggers(newlyRelevant.filter(t => !this.injectedTriggerIds.has(t.id)), true);
+                });
+              if (this.interrupted || this.abort.signal.aborted) {
+                this.emitEvent('user-interrupt', abandonedTurnUsage());
+                return;
+              }
+              absorbReadyMessage(); // ready human correction precedes replan
+              continue turnLoop;
             }
+          }
+          let payload: ToolResultPayload | 'interrupted' | EndTurnResult;
+          try {
+            payload = await this.runOneTool(call, recentCalls);
+          } catch (err) {
+            if (!(err instanceof PermissionCallbackFailure)) throw err;
+            // WHY: the assistant already announced every call. A failed permission
+            // lookup is neither approval nor a human refusal; complete the accepted
+            // group before the outer error path settles the turn.
+            const failure = `Permission check failed: ${describeProviderError(err.cause)}`;
+            const remaining = finalizeRemainingCalls(step.toolCalls, i,
+              j => j === i ? failure : 'Not run: an earlier permission check failed.',
+              (rem, text) => this.emitEvent('tool-result', {
+                toolUseId: rem.toolCallId, toolName: rem.toolName, toolResult: text, isError: true,
+              }), (rem, text) => this.toolResultPart(rem, text));
+            for (const origin of remaining.origins) recordResult(origin);
+            resultParts.push(...remaining.parts);
+            this.history.push({ role: 'tool', content: resultParts });
+            this.historyOrigins.push([...resultOrigins]);
+            throw err;
+          }
+          if (payload === 'interrupted') {
+            // WHY: uses were emitted up front; back-fill canceled results for
+            // this and all unstarted siblings or the next send gets a provider 400.
+            const canceled = finalizeRemainingCalls(step.toolCalls, i, () => CANCELED_TOOL_TEXT,
+              (rem, text) => this.emitEvent('tool-result', { toolUseId: rem.toolCallId, toolName: rem.toolName, toolResult: text, isError: true }),
+              (rem, text) => this.toolResultPart(rem, text));
+            canceled.origins.forEach(recordResult);
+            resultParts.push(...canceled.parts);
             this.history.push({ role: 'tool', content: resultParts });
             this.historyOrigins.push([...resultOrigins]);
             this.emitEvent('user-interrupt', abandonedTurnUsage());
             return;
           }
-          // The user dismissed a question → end the turn ORDERLY. Record THIS
-          // call's real result, then mark every remaining un-executed call in the
-          // step as not-run (same dangling-tool_call hazard the interrupt branch
-          // above guards against). `turn-complete` rather than `user-interrupt`
-          // on purpose: usage should be reported, and anything the user queued
-          // while the turn ran should drain — typing during the turn IS taking
-          // over. The max_steps gate below is the existing precedent for a
-          // driver-decided orderly stop.
+          // WHY: a dismissed question ends the turn orderly with its real result
+          // and not-run siblings; turn-complete reports usage and drains the queue.
           if ('kind' in payload) {
-            recordResult(this.emitEvent('tool-result', {
-              toolUseId: call.toolCallId, toolName: call.toolName,
-              toolResult: payload.payload.text, isError: true,
-            }));
-            resultParts.push(this.toolResultPart(call, payload.payload.text));
-            for (let j = i + 1; j < step.toolCalls.length; j++) {
-              const rem = step.toolCalls[j];
-              recordResult(
-                this.emitEvent('tool-result', { toolUseId: rem.toolCallId, toolName: rem.toolName, toolResult: NOT_RUN_TOOL_TEXT, isError: true }));
-              resultParts.push(this.toolResultPart(rem, NOT_RUN_TOOL_TEXT));
-            }
+            const dismissed = finalizeRemainingCalls(step.toolCalls, i,
+              j => j === i ? payload.payload.text : NOT_RUN_TOOL_TEXT,
+              (rem, text) => this.emitEvent('tool-result', { toolUseId: rem.toolCallId, toolName: rem.toolName, toolResult: text, isError: true }),
+              (rem, text) => this.toolResultPart(rem, text));
+            dismissed.origins.forEach(recordResult);
+            resultParts.push(...dismissed.parts);
             this.history.push({ role: 'tool', content: resultParts });
             this.historyOrigins.push([...resultOrigins]);
             stopReason = DISMISSED_STOP_REASON;
@@ -3095,7 +3113,10 @@ export class HarnessSession extends EventEmitter {
         // just learned, and before it decides the next step.
         this.injectPathTriggers(step.toolCalls);
 
-        stepsSinceApproval++;
+        // WHY (Destin, 2026-09-28 PR-review deck Q-1): a message sent mid-task is
+        // read once the whole batch of actions the assistant already chose has
+        // run — never by discarding planned actions — then it replans with it.
+        if (this.interrupted || this.abort.signal.aborted || !absorbReadyMessage()) stepsSinceApproval++;
         // Budget gate (spec §2.4) — surfaces as a permission ASK, not a new
         // event. Allow resets the counter and continues; anything else ends the
         // turn with stopReason 'max_steps'; canceled is an interrupt.
@@ -3237,9 +3258,7 @@ export class HarnessSession extends EventEmitter {
         },
       });
     } catch (err: any) {
-      // v0's catch, unchanged: push any in-flight partial, then split
-      // interrupt vs error. withRetry has already exhausted retries for a
-      // transient provider error before it lands here.
+      // Push in-flight partials; provider retries have already exhausted.
       // The attempt that produced this partial threw, so the loop never saw its
       // StepResult — this is the one acceptance decision made outside it.
       // trim(): the same emptiness rule as every other assistant push (and as
@@ -3252,12 +3271,14 @@ export class HarnessSession extends EventEmitter {
       } else if (this.lastAttempt !== undefined) {
         this.capture.abandonAttempt(this.lastAttempt);
       }
-      if (this.interrupted || err?.name === 'AbortError' || this.abort?.signal.aborted) {
+      // WHY: a permission callback's own AbortError is not proof the user stopped
+      // the turn. Keep the tag until here while reporting its original detail.
+      const failure = err instanceof PermissionCallbackFailure ? err.cause : err;
+      if (this.interrupted || this.abort?.signal.aborted || (!(err instanceof PermissionCallbackFailure) && err?.name === 'AbortError')) {
         this.emitEvent('user-interrupt', abandonedTurnUsage());
       } else {
-        // An errored turn spent the same real tokens an interrupted one did.
-        const errorCode = classifyProviderError(err);
-        this.emitEvent('session-error', { text: describeProviderError(err), ...(errorCode ? { errorCode } : {}), ...abandonedTurnUsage() });
+        const errorCode = classifyProviderError(failure);
+        this.emitEvent('session-error', { text: describeProviderError(failure), ...(errorCode ? { errorCode } : {}), ...abandonedTurnUsage() });
       }
     } finally {
       this._currentUsageProgress = null;
@@ -3274,6 +3295,7 @@ export class HarnessSession extends EventEmitter {
     model: LanguageModel,
     aiTools: Record<string, any>,
     reportPartial: (text: string) => void,
+    registerRetraction: (retract: () => void) => void,
   ): Promise<StepResult> {
     // Attempt 0 stalls with nothing streamed → runStreamOnce returns
     // STALL_RETRY → we re-run. That AUTOMATIC retry is available once per step:
@@ -3290,7 +3312,7 @@ export class HarnessSession extends EventEmitter {
     // The loop is no longer bounded at two iterations — a MANUAL Retry also
     // returns STALL_RETRY, and the user may press it as often as they like.
     for (let attempt = 0; ; attempt++) {
-      const outcome = await this.runStreamOnce(model, aiTools, reportPartial, attempt === 0);
+      const outcome = await this.runStreamOnce(model, aiTools, reportPartial, attempt === 0, registerRetraction);
       if (outcome !== STALL_RETRY) return outcome;
       // Re-running after EITHER a silent stall (nothing streamed) or a manual
       // Retry (content streamed, then erased via dropPart): clear the on-screen
@@ -3309,6 +3331,7 @@ export class HarnessSession extends EventEmitter {
     aiTools: Record<string, any>,
     reportPartial: (text: string) => void,
     isFirstAttempt: boolean,
+    registerRetraction: (retract: () => void) => void,
   ): Promise<StepResult | typeof STALL_RETRY> {
     // One capture attempt per stream attempt. Its delta uuids stay provisional
     // until the turn loop (or send()'s catch) says what became of the step.
@@ -3545,6 +3568,22 @@ export class HarnessSession extends EventEmitter {
     // rather than appended to.
     const emittedPartIds = new Set<string>();
     const textPartIds = new Set<string>();
+    // WHY: only the retry decision may erase an attempt. Register its LOCAL
+    // output before consuming; an exhausted/non-transient error keeps its honest
+    // partial, while a replay withdraws all four surfaces before the next request.
+    const retractAttempt = () => {
+      reportPartial('');
+      for (const [prepId, entry] of preparing) {
+        this.emitEvent('assistant-thinking', {
+          toolPreparing: { toolCallId: prepId, toolName: entry.toolName, chars: entry.chars, cleared: true },
+        });
+      }
+      if (emittedPartIds.size > 0) {
+        this.emitEvent('assistant-thinking', { dropPart: { partIds: [...emittedPartIds] } });
+      }
+      this.capture.abandonAttempt(attempt);
+    };
+    registerRetraction(retractAttempt);
 
     try {
       while (true) {
@@ -3568,28 +3607,7 @@ export class HarnessSession extends EventEmitter {
           void Promise.resolve(result.usage).catch(() => {});
           void Promise.resolve(result.finishReason).catch(() => {});
           this.resolveRetry = null;
-          // Retract the erased text from the model's own memory, not just the
-          // screen: partialAssistantText is reset per STEP (not per attempt), so
-          // without this, a re-run that throws before emitting anything would
-          // leave send()'s catch pushing the ABANDONED half-sentence — text the
-          // user just watched get erased via dropPart — silently back into
-          // this.history as an assistant message.
-          reportPartial('');
-          // Withdraw any preparing card: the step re-runs INSIDE the same turn,
-          // so endTurn's reaping never fires and the card would spin forever
-          // beside the one the re-run mints. (Same reason as the auto-retry path.)
-          for (const [prepId, entry] of preparing) {
-            this.emitEvent('assistant-thinking', {
-              toolPreparing: { toolCallId: prepId, toolName: entry.toolName, chars: entry.chars, cleared: true },
-            });
-          }
-          // Erase what the abandoned attempt put on screen BEFORE re-running.
-          if (emittedPartIds.size > 0) {
-            this.emitEvent('assistant-thinking', { dropPart: { partIds: [...emittedPartIds] } });
-          }
-          // The fourth place Retry erases: the model's memory, the screen and
-          // the store already forget this text, so its provenance must too.
-          this.capture.abandonAttempt(attempt);
+          retractAttempt();
           return STALL_RETRY;
         }
         if (chunk === 'stall') {
@@ -3602,15 +3620,7 @@ export class HarnessSession extends EventEmitter {
           void Promise.resolve(result.usage).catch(() => {});
           void Promise.resolve(result.finishReason).catch(() => {});
           if (!emittedAny && isFirstAttempt) {
-            // The step re-runs INSIDE the same turn, so endTurn's reaping never
-            // fires. Withdraw any preparing card explicitly or it spins for the
-            // rest of the turn while the retry mints a second card beside it.
-            for (const [prepId, entry] of preparing) {
-              this.emitEvent('assistant-thinking', {
-                toolPreparing: { toolCallId: prepId, toolName: entry.toolName, chars: entry.chars, cleared: true },
-              });
-            }
-            this.capture.abandonAttempt(attempt);   // the re-run starts this step over
+            retractAttempt();   // the re-run starts this step over
             return STALL_RETRY;
           }
           // Name the phase honestly: a model that never STARTED (prefill) has not
@@ -3871,8 +3881,9 @@ export class HarnessSession extends EventEmitter {
   }
 
   /** Run one tool call through the EXACT permission sequence (spec §2.1/§2.4):
-   *  validate → doom-loop → guards → decide → (ask) → execute. NEVER throws —
-   *  every failure mode is a tool RESULT the model can repair from, except a
+   *  validate → doom-loop → guards → decide → (ask) → execute. Permission
+   *  callbacks throw a tagged failure for the driver to finalize the group;
+   *  ordinary tool failures are RESULTS the model can repair from, except a
    *  user cancel which returns the 'interrupted' sentinel, and a dismissed
    *  question which returns EndTurnResult — both let the loop unwind. */
   private async runOneTool(call: ToolCall, recentCalls: string[]): Promise<ToolResultPayload | 'interrupted' | EndTurnResult> {
@@ -3881,24 +3892,7 @@ export class HarnessSession extends EventEmitter {
 
     // 1. Validate (zod) — invalid args are a RESULT the model repairs from, not
     //    a crash, and precede permissions (never ask about garbage).
-    let parsed = tool.inputSchema.safeParse(call.input);
-    if (!parsed.success && typeof call.input === 'string') {
-      // Weak-model hardening (Task 12, spec §3): the ai@7 SDK already parses a
-      // provider tool-call's stringified args into an object for us (see
-      // harness-sdk-toolcall-contract.test.ts), but a weak local model
-      // sometimes puts its WHOLE args object as a STRING one level further in
-      // — e.g. it emits `"{\"prompt\": ...}"` where a real object belongs. If
-      // the raw string itself JSON.parses to an object, give it ONE recovery
-      // attempt before falling back to the normal arg error — never a general
-      // coercion layer (YAGNI: one attempt, then the ordinary failure path).
-      try {
-        const recovered: unknown = JSON.parse(call.input);
-        if (recovered && typeof recovered === 'object') {
-          const reparsed = tool.inputSchema.safeParse(recovered);
-          if (reparsed.success) parsed = reparsed;
-        }
-      } catch { /* not JSON — fall through to the normal arg error below */ }
-    }
+    const parsed = parseToolArgs(tool, call.input);
     if (!parsed.success) {
       // Worded in arg-errors.ts (ledger D-2): names the unknown / missing /
       // mistyped parameter and, for an unknown one, the parameters that exist —
@@ -3930,7 +3924,7 @@ export class HarnessSession extends EventEmitter {
       recentCalls.push(sig);
       if (recentCalls.length > threshold) recentCalls.shift();
       if (recentCalls.length === threshold && recentCalls.every((s) => s === sig)) {
-        const d = await this.opts.askUser?.({ sessionId: this.opts.sessionId, toolName: 'doom_loop', toolInput: { repeated: call.toolName }, denyListed: false });
+        const d = this.opts.askUser ? await permissionCallback(() => this.opts.askUser!({ sessionId: this.opts.sessionId, toolName: 'doom_loop', toolInput: { repeated: call.toolName }, denyListed: false })) : undefined;
         if (d?.behavior === 'canceled') return 'interrupted';
         // Threshold-accurate: the doom-loop window length varies by profile (2 for
         // small local models, 3 for cloud), so quote the ACTUAL threshold, not a
@@ -3948,7 +3942,7 @@ export class HarnessSession extends EventEmitter {
     //     three times IS a doom loop and should still trip.
     if (tool.interactive) {
       if (!this.opts.askUser) return { text: `No user-interaction handler is wired for this session; ${call.toolName} cannot run. This is a configuration error.`, isError: true };
-      const d = await this.opts.askUser({ sessionId: this.opts.sessionId, toolName: call.toolName, toolInput: call.input as any, denyListed: false });
+      const d = await permissionCallback(() => this.opts.askUser!({ sessionId: this.opts.sessionId, toolName: call.toolName, toolInput: call.input as any, denyListed: false }));
       if (d.behavior === 'canceled') return 'interrupted';
       // A HUMAN dismissal ENDS THE TURN: closing the card is the user taking the
       // turn back, not permission to guess. Still a real tool result so
@@ -4044,7 +4038,7 @@ export class HarnessSession extends EventEmitter {
     //    of rules; otherwise consult decide() (default: ask — never silent-allow).
     const configured: PermissionDecision = externalAsk
       ? { action: 'ask', denyListed: false }
-      : await (this.opts.decide?.(call.toolName, subject) ?? Promise.resolve<PermissionDecision>({ action: 'ask', denyListed: false }));
+      : await permissionCallback(() => this.opts.decide?.(call.toolName, subject) ?? Promise.resolve<PermissionDecision>({ action: 'ask', denyListed: false }));
     // denyListed: true so Full auto shows its stop band (worded per floorStop —
     // deny-list-copy.ts) like any deny-list stop, instead of silently running.
     const decision: PermissionDecision = floorStop && configured.action !== 'deny'
@@ -4071,7 +4065,7 @@ export class HarnessSession extends EventEmitter {
       // as `pattern` — threaded through so a routed CHILD ask (child-ask-
       // router.ts, which has no other way to reach it) can persist the exact
       // same rule a root session's own remember-rule listener would.
-      const d = await this.opts.askUser({ sessionId: this.opts.sessionId, toolName: call.toolName, toolInput: call.input as any, denyListed: decision.denyListed, external: externalAsk, ...(floorStop ? { floorStop } : {}), subject });
+      const d = await permissionCallback(() => this.opts.askUser!({ sessionId: this.opts.sessionId, toolName: call.toolName, toolInput: call.input as any, denyListed: decision.denyListed, external: externalAsk, ...(floorStop ? { floorStop } : {}), subject }));
       if (d.behavior === 'canceled') return 'interrupted';
       // Task 8: d.message carries specific copy for a deny that ISN'T a real
       // user decline — e.g. child-ask-router's outside-the-folder refusal for
@@ -4166,15 +4160,19 @@ export class HarnessSession extends EventEmitter {
   /** Exponential backoff for transient provider errors (429/5xx/network),
    *  honoring retry-after. Layers ON TOP of the SDK's internal retry (this is
    *  step-level resilience). Exhaustion rethrows → the session-error path. */
-  private async withRetry<T>(fn: () => Promise<T>): Promise<T> {
+  private async withRetry<T>(fn: (registerRetraction: (retract: () => void) => void) => Promise<T>): Promise<T> {
     const delays = this.retryDelays;
     for (let attempt = 0; ; attempt++) {
+      let retractAttempt: (() => void) | undefined;
       try {
-        return await fn();
+        return await fn((retract) => { retractAttempt = retract; });
       } catch (err: any) {
         const status = err?.statusCode ?? err?.status;
         const retryable = status === 429 || (status >= 500 && status < 600) || err?.code === 'ECONNRESET';
         if (!retryable || attempt >= delays.length || this.abort?.signal.aborted) throw err;
+        // WHY: retrying the whole step must first erase ONLY its failed attempt;
+        // previously a late provider error left streamed text on disk and screen.
+        retractAttempt?.();
         const ra = Number(err?.responseHeaders?.['retry-after']) * 1000;
         await new Promise((r) => setTimeout(r, Number.isFinite(ra) && ra > 0 ? ra : delays[attempt]));
       }
diff --git a/desktop/src/main/harness/injection/fit-rule-group.ts b/desktop/src/main/harness/injection/fit-rule-group.ts
new file mode 100644
index 000000000..d06bfffbd
--- /dev/null
+++ b/desktop/src/main/harness/injection/fit-rule-group.ts
@@ -0,0 +1,38 @@
+import { fitInjection } from './injection-budget';
+import type { PathTrigger } from './path-triggers';
+
+/** WHY: one pre-write boundary can activate many rules; granting each the
+ * entire injection budget would silently multiply the model's context cost. */
+export function fitRuleGroupDelivery(rules: readonly PathTrigger[], budgetTokens: number): { contents: string[]; omitted: string[] } {
+  const budget = Math.max(0, Math.floor(budgetTokens * 4));
+  const wrap = (source: string, body: string) => `<project-rule source="${source}">\n${body}\n</project-rule>`;
+  const floor = rules.map(r => `[Read ${r.source}: rule shortened or omitted.]`);
+  const overhead = rules.reduce((n, r) => n + wrap(r.source, '').length, 0);
+  const separators = Math.max(0, rules.length - 1) * 2;
+  if (overhead + floor.reduce((n, text) => n + text.length, 0) + separators > budget) {
+    // Every source must remain identifiable when space permits. Never claim a
+    // body was supplied if the budget cannot even hold its labelled wrapper.
+    const sources = rules.map(r => r.source).join(', ');
+    const notice = `[Project rules omitted to fit context. Read: ${sources}]`;
+    return { contents: [notice.length <= budget ? notice : '[Project rules omitted.]'.slice(0, budget)], omitted: rules.map(r => r.id) };
+  }
+  let remaining = budget - overhead - separators;
+  const omitted: string[] = [];
+  const contents = rules.map((rule, i) => {
+    const reserve = floor.slice(i + 1).reduce((n, s) => n + s.length, 0);
+    const room = Math.max(floor[i].length, Math.floor((remaining - reserve) / (rules.length - i)));
+    const fitted = fitInjection(rule.body, Math.floor(room / 4), rule.source);
+    const body = fitted.text.length <= room ? fitted.text : floor[i];
+    // fitInjection can itself return only a truncation notice. A label plus a
+    // notice is NOT delivered guidance, even if its wrapper technically fits.
+    if (body === floor[i] || (fitted.truncated && body.trimStart().startsWith('[...truncated'))) omitted.push(rule.id);
+    remaining -= body.length;
+    return wrap(rule.source, body);
+  });
+  return { contents, omitted };
+}
+
+/** The fitted text alone, for callers that only display it. */
+export function fitRuleGroup(rules: readonly PathTrigger[], budgetTokens: number): string[] {
+  return fitRuleGroupDelivery(rules, budgetTokens).contents;
+}
diff --git a/desktop/src/main/harness/injection/path-triggers.ts b/desktop/src/main/harness/injection/path-triggers.ts
index 60bd74f2d..6c3732672 100644
Binary files a/desktop/src/main/harness/injection/path-triggers.ts and b/desktop/src/main/harness/injection/path-triggers.ts differ
diff --git a/desktop/src/main/harness/injection/project-instructions.ts b/desktop/src/main/harness/injection/project-instructions.ts
new file mode 100644
index 000000000..5f4e58267
--- /dev/null
+++ b/desktop/src/main/harness/injection/project-instructions.ts
@@ -0,0 +1,116 @@
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import { fitProjectInstructions } from './injection-budget';
+
+export interface ProjectInstructionFile {
+  path: string;
+  name: string;
+  full: string;
+  text: string;
+  truncated: boolean;
+  note?: string;
+  /** A chain-wide omission notice is plain text, not a pretend file body. */
+  unwrapped?: boolean;
+  /** A second instructions file in the SAME folder that was not used (AGENTS.md
+   *  wins over CLAUDE.md). Shown in the panel so a dropped file is never silent. */
+  notUsed?: string;
+}
+
+// WHY plain words here: `note` is shown to the PERSON in the "What the assistant
+// was given" panel. The bracketed notices the fitter writes are addressed to the
+// model ("Read X for the rest"), so they are summarized, never copied.
+const LEFT_OUT = 'Left out — too long for this model';
+const SHORTENED = 'Shortened to fit this model';
+function shortenedNote(fittedText: string): string {
+  const outline = /(\d+) of (\d+) sections above are shown as/.exec(fittedText);
+  return outline ? `${SHORTENED} · ${outline[1]} of ${outline[2]} sections shortened` : SHORTENED;
+}
+
+export function renderProjectInstructionFiles(files: readonly ProjectInstructionFile[]): string | null {
+  const parts = files.filter(f => f.text).map(f => f.unwrapped
+    ? f.text
+    : `<project-instructions source="${files.length === 1 ? f.name : f.path}">\n${f.text}\n</project-instructions>`);
+  return parts.length ? parts.join('\n\n') : null;
+}
+
+/** WHY: discovery belongs to session startup, not synchronous prompt assembly or
+ * context-panel retrieval. Git boundaries do not stop instruction-file ancestry. */
+export async function prepareProjectInstructions(cwd: string, budgetTokens: number, fixtureBoundary?: string): Promise<ProjectInstructionFile[]> {
+  const dirs: string[] = [];
+  let dir = path.resolve(cwd);
+  for (;;) {
+    dirs.unshift(dir);
+    // Evaluator-only boundary: disposable A/B fixtures must not inherit real
+    // machine instructions; production always leaves this unset.
+    if (fixtureBoundary && dir === path.resolve(fixtureBoundary)) break;
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  const sources: Array<{ path: string; name: string; full: string; notUsed?: string }> = [];
+  const seen = new Set<string>();
+  for (const folder of dirs) {
+    for (const name of ['AGENTS.md', 'CLAUDE.md']) {
+      const file = path.join(folder, name);
+      let full: string;
+      try { full = await fs.readFile(file, 'utf8'); }
+      catch (error) {
+        if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue;
+        // An unreadable preferred file is not permission to silently switch sources.
+        break;
+      }
+      // WHY: aliases through a symlink can expose the same instruction twice.
+      // Canonicalize only identity, never the displayed path or the session cwd.
+      let identity: string;
+      try { identity = await fs.realpath(file); }
+      catch { identity = file; } // If it disappeared after reading, preserve the captured text.
+      if (!seen.has(identity)) {
+        // WHY record it: only one file per folder is used, so a CLAUDE.md next
+        // to an AGENTS.md is silently ignored unless we say so.
+        const other = name === 'AGENTS.md' ? path.join(folder, 'CLAUDE.md') : null;
+        const otherExists = other ? await fs.access(other).then(() => true, () => false) : false;
+        sources.push({ path: file, name, full, ...(otherExists ? { notUsed: 'CLAUDE.md' } : {}) });
+        seen.add(identity);
+      }
+      break;
+    }
+  }
+  // WHY: account for every byte in the final part (including labels, wrappers,
+  // separators and omission notices). Never print empty per-file wrappers when
+  // there is no room to tell the model which sources it missed.
+  const budget = Math.max(0, Math.floor(budgetTokens * 4));
+  const wrappers = sources.reduce((n, s) => n + `<project-instructions source="${sources.length === 1 ? s.name : s.path}">\n\n</project-instructions>`.length, 0)
+    + Math.max(0, sources.length - 1) * 2;
+  const notices = sources.map(s => `[Read ${s.path}: shortened.]`);
+  const omitted = (text: string | null): ProjectInstructionFile[] => sources.map((source, i) => ({
+    ...source, text: i === 0 ? (text ?? '') : '', truncated: true,
+    note: LEFT_OUT,
+    ...(i === 0 && text ? { unwrapped: true } : {}),
+  }));
+  if (wrappers + notices.reduce((n, s) => n + s.length, 0) > budget) {
+    const detailed = `[Project instructions omitted. Read ${sources.map(s => s.path).join(', ')}.]`;
+    const brief = '[Project instructions omitted.]';
+    return omitted(detailed.length <= budget ? detailed : brief.length <= budget ? brief : null);
+  }
+  // WHY nearest first (Destin, 2026-09-28 PR-review deck Q-4): the file in the
+  // session's own folder is the most specific and usually the most relevant, so
+  // it takes the room it needs before any broader parent file. Each broader file
+  // then gets what is left, outward toward the root. Only the one-line "Read
+  // <path>" notices of the files still waiting are held back, so a parent that
+  // is squeezed out is still named to the model, never silently lost. The
+  // result keeps broad-to-narrow ORDER; only who gets space first changes.
+  let remaining = budget - wrappers;
+  const fittedFiles: ProjectInstructionFile[] = new Array(sources.length);
+  for (let index = sources.length - 1; index >= 0; index--) {
+    const source = sources[index];
+    const reserved = notices.slice(0, index).reduce((n, s) => n + s.length, 0);
+    const share = Math.max(notices[index].length, remaining - reserved);
+    const fitted = fitProjectInstructions(source.full, Math.floor(share / 4), source.path);
+    const text = fitted.text.length <= share ? fitted.text : notices[index];
+    const truncated = fitted.truncated || text !== source.full;
+    remaining -= text.length;
+    fittedFiles[index] = { ...source, text, truncated,
+      ...(truncated ? { note: text === notices[index] ? LEFT_OUT : shortenedNote(text) } : {}) };
+  }
+  return fittedFiles;
+}
diff --git a/desktop/src/main/harness/injection/retained-rule-visibility.ts b/desktop/src/main/harness/injection/retained-rule-visibility.ts
new file mode 100644
index 000000000..3683a669e
--- /dev/null
+++ b/desktop/src/main/harness/injection/retained-rule-visibility.ts
@@ -0,0 +1,16 @@
+import type { ModelMessage } from 'ai';
+import { isAppGenerated } from '../compaction';
+
+/** WHY: a session-lifetime ID cannot vouch for guidance discarded by clear or
+ * summary. Inspect only at history replacement boundaries, never per token.
+ * Literal source labels are accepted only on app-authored, complete rule blocks;
+ * a human quotation or a summary mentioning a rule does not mean it is loaded. */
+export function retainedRuleMessages(history: readonly ModelMessage[]): Set<string> {
+  const messages = new Set<string>();
+  for (const message of history) {
+    if (!isAppGenerated(message) || typeof message.content !== 'string') continue;
+    const match = /^<project-rule source="([^\r\n]*)">\n[\s\S]*\n<\/project-rule>$/.exec(message.content);
+    if (match) messages.add(message.content);
+  }
+  return messages;
+}
diff --git a/desktop/src/main/harness/injection/rule-delivery.ts b/desktop/src/main/harness/injection/rule-delivery.ts
new file mode 100644
index 000000000..3f658c4a7
--- /dev/null
+++ b/desktop/src/main/harness/injection/rule-delivery.ts
@@ -0,0 +1,72 @@
+import type { NativeTool } from '../tools/types';
+import { parseToolArgs } from '../tool-args';
+import { fitInjection } from './injection-budget';
+import { fitRuleGroupDelivery } from './fit-rule-group';
+import type { PathTrigger, TriggerIndex } from './path-triggers';
+
+export interface PathCall { toolName: string; input: unknown }
+const fullContent = (t: PathTrigger, budget: number) =>
+  `<project-rule source="${t.source}">\n${fitInjection(t.body, budget, t.source).text}\n</project-rule>`;
+// fitInjection may fit *only* a notice; that is not guidance for a later write.
+const noticeOnly = (content: string) => /<project-rule source="[^"]*">\n\s*\[\.\.\.truncated/.test(content);
+
+/** WHY: both post-read and pre-write selection use the same validated subject
+ * and exact retained-body dedupe. Non-path tool subjects are never file paths. */
+export function pendingRules(calls: readonly PathCall[], index: TriggerIndex | undefined,
+  byName: ReadonlyMap<string, NativeTool>, budget: number, nonPath: ReadonlySet<string>,
+  injected: Set<string>, retained: Set<string>): PathTrigger[] {
+  if (!index) return [];
+  const pending: PathTrigger[] = [];
+  const seen = new Set<string>();
+  for (const call of calls) {
+    if (nonPath.has(call.toolName)) continue;
+    const tool = byName.get(call.toolName);
+    if (!tool) continue;
+    const parsed = parseToolArgs(tool, call.input);
+    if (!parsed.success) continue;
+    const subject = tool.permissionSubject(parsed.data);
+    if (!subject) continue;
+    for (const rule of index.match(subject)) {
+      if (seen.has(rule.id) || injected.has(rule.id)) continue;
+      seen.add(rule.id);
+      const full = fullContent(rule, budget);
+      if (retained.has(full) && !noticeOnly(full)) { injected.add(rule.id); continue; }
+      pending.push(rule);
+    }
+  }
+  // A resumed pre-write group may retain its *bounded* body rather than the
+  // per-file full-budget fit. Compare exact app-generated content, not source
+  // alone; a changed body must still be delivered again.
+  const bounded = fitRuleGroupDelivery(pending, budget);
+  return pending.filter((rule, i) => {
+    const content = bounded.contents[pending.length > 1 && bounded.contents.length === 1 ? 0 : i];
+    if (!bounded.omitted.includes(rule.id) && content?.startsWith('<project-rule source=') && retained.has(content)) {
+      injected.add(rule.id);
+      return false;
+    }
+    return true;
+  });
+}
+
+/** Once a complete paired tool result has been committed, publish guidance as
+ * app-generated history. A partial rule counts as delivered; do not replan it forever.
+ * WHY the pre-write (bounded) group always counts as delivered, even when a
+ * rule only fit as a "Read <file>" notice (Destin, 2026-09-28, Q-5): the model
+ * has been told the rule exists and where it is, and gets exactly one replan.
+ * Holding it back would re-trigger the pre-write stop on every retry. */
+export function deliverRules(rules: readonly PathTrigger[], budget: number, bounded: boolean,
+  injected: Set<string>, retained: Set<string>, append: (text: string) => void): void {
+  const fitted = bounded ? fitRuleGroupDelivery(rules, budget) : null;
+  const contents = fitted?.contents ?? rules.map(r => fullContent(r, budget));
+  rules.forEach((rule, i) => {
+    const content = contents[bounded && contents.length === 1 && rules.length > 1 ? 0 : i];
+    if (!bounded && noticeOnly(content)) {
+      if (content && !retained.has(content)) { retained.add(content); append(content); }
+      return; // a notice-only Read leaves the one pre-write replan to happen
+    }
+    injected.add(rule.id);
+    if (!content || retained.has(content)) return;
+    retained.add(content);
+    append(content);
+  });
+}
diff --git a/desktop/src/main/harness/mcp/mcp-manager.ts b/desktop/src/main/harness/mcp/mcp-manager.ts
index 8caa0ee3f..96d650c68 100644
--- a/desktop/src/main/harness/mcp/mcp-manager.ts
+++ b/desktop/src/main/harness/mcp/mcp-manager.ts
@@ -1,7 +1,7 @@
 // MCP connection manager (spec: native MCP phase 1, Task 4). Sits between the
 // registry (Task 2, WHICH servers exist) and the single-server client (Task 3,
 // HOW to talk to one) — its whole job is POOLING: one live connection per
-// server, shared and refcounted across every session that wants it. Two chat
+// effective server configuration, shared and refcounted across sessions. Two chat
 // sessions both using the Gmail server must share one subprocess, not spawn
 // two. Task 5 turns the tools acquire() hands back into app tools; Task 6
 // attaches them to a session.
@@ -81,6 +81,9 @@ export interface McpLease {
 // premature close.
 interface PooledEntry {
   server: ResolvedMcpServer;
+  /** Private in-memory comparison only: includes resolved credentials, NEVER log it. */
+  configKey: string;
+  closing?: Promise<void>;
   conn: McpConnectionLike;
   /** LEASE ids (see McpLease), not session ids. One acquire() call = one id,
    *  never reused, so two generations of a resumed session hold two separate
@@ -94,12 +97,77 @@ interface PooledEntry {
   connecting?: Promise<void>;
 }
 
+// WHY: only connection-effective values belong in the key. Credentials are
+// compared in process memory, never hashed into an identifier, persisted or logged.
+// Sort record keys so registry object ordering and label edits cannot reconnect.
+function effectiveConfig(server: ResolvedMcpServer): string {
+  const sorted = (record?: Record<string, string>) => Object.entries(record ?? {}).sort(([a], [b]) => a.localeCompare(b));
+  const t = server.transport;
+  return JSON.stringify({ transport: t.type === 'stdio'
+    ? ['stdio', t.command, t.args ?? [], t.cwd ?? null]
+    : ['http', t.url],
+    env: sorted(server.env), headers: sorted(server.headers),
+    missing: [...server.missingSecrets].sort(), credentialError: server.credentialError ?? null });
+}
+
+/** WHY (PR #585 review, 2026-09-28): env/header values are not the only place a
+ *  credential lives. Users paste keys straight into a launch command
+ *  (`--api-key sk-…`, `--token=…`) or a server address (`…?api_key=…`,
+ *  `https://user:pass@host`), and a failing server's error often echoes its
+ *  own command line or URL. Those values are collected here so the log line
+ *  blanks them too. Only values tied to a secret-sounding name are taken from
+ *  the command, so ordinary arguments like a file path stay readable. */
+const SECRET_NAME = /(key|token|secret|pass(word)?|auth|bearer|credential|session|cookie|sig(nature)?)/i;
+function transportSecrets(transport: ResolvedMcpServer['transport'] | undefined): string[] {
+  if (!transport) return [];
+  const out: string[] = [];
+  if (transport.type === 'http') {
+    try {
+      const url = new URL(transport.url);
+      if (url.password) out.push(url.password, decodeURIComponent(url.password));
+      if (url.username) out.push(url.username, decodeURIComponent(url.username));
+      // Every query value, not just secret-named ones: a URL's query is where
+      // hosted servers put their access key, under names we cannot predict.
+      for (const value of url.searchParams.values()) out.push(value, encodeURIComponent(value));
+    } catch { /* an unparseable URL fails to connect before it can echo anything */ }
+    return out;
+  }
+  const args = transport.args ?? [];
+  args.forEach((arg, i) => {
+    const eq = arg.match(/^-{1,2}([^=]+)=(.+)$/);
+    if (eq) { if (SECRET_NAME.test(eq[1])) out.push(eq[2]); return; }
+    if (/^-{1,2}\S/.test(arg) && SECRET_NAME.test(arg) && i + 1 < args.length && !args[i + 1].startsWith('-')) out.push(args[i + 1]);
+  });
+  return out;
+}
+
+/** The error text with every env/header value this server was given — plus
+ *  credentials in its launch arguments or address (see transportSecrets) —
+ *  replaced by [redacted]. Values under 4 characters are left alone: blanking
+ *  "1" or "true" everywhere would mangle the message while protecting nothing. */
+export function redactSecrets(text: string | null, server: Pick<ResolvedMcpServer, 'env' | 'headers'> & { transport?: ResolvedMcpServer['transport'] }): string | null {
+  if (!text) return text;
+  const values = [...Object.values(server.env ?? {}), ...Object.values(server.headers ?? {}), ...transportSecrets(server.transport)]
+    .filter(v => typeof v === 'string' && v.length >= 4)
+    // "Bearer abc…" headers: an error may quote only the token part.
+    .flatMap(v => [v, ...v.split(/\s+/).filter(part => part.length >= 8 && part !== v)])
+    // Longest first, so a secret that contains a shorter one is removed whole.
+    .sort((a, b) => b.length - a.length);
+  let out = text;
+  for (const v of values) out = out.split(v).join('[redacted]');
+  return out;
+}
+
 export class McpManager {
   private readonly registry: McpRegistryLike;
   private readonly connectionFactory: McpConnectionFactory;
-  // serverId -> pooled entry. Absence means "never touched yet" — NOT the
-  // same as a connected-but-errored server, which stays present (see acquire).
+  // serverId -> CURRENT pooled entry. Retired generations remain in entries
+  // until their holders release; an errored current entry stays reportable.
   private pool = new Map<string, PooledEntry>();
+  /** Retired entries stay alive until THEIR holders release, even if ID reused. */
+  private entries = new Set<PooledEntry>();
+  /** Exact entries held by a lease, including retired generations. */
+  private leaseEntries = new Map<string, PooledEntry[]>();
   // Monotonic, process-lifetime counter behind every lease id. Its ONLY job is
   // uniqueness — no ordering is read off it — so wraparound/overflow concerns
   // don't apply at any realistic session count.
@@ -156,20 +224,18 @@ export class McpManager {
         if (entry.conn.state === 'ready') {
           ready.push({
             id: entry.server.id,
-            label: entry.server.label,
+            label: servers.find(s => s.id === entry.server.id)?.label ?? entry.server.label,
             tools: entry.conn.listTools(),
             call: (tool, args, signal) => entry.conn.callTool(tool, args, signal),
           });
         } else {
-          // Fix (Finding 5): status()/lastError have always been correct —
-          // nothing has ever LOGGED them. A developer with a typo'd command
-          // got no tool, no error dialog, and (until now) no log line either:
-          // the exact silent failure this whole design exists to prevent, and
-          // the reason the dogfood checklist's "confirm the server drops and
-          // is reported" step could never actually pass. One line per
-          // excluded server, naming it and its real (never reworded) error.
+          // WHY: a server that fails to start must leave its REAL reason in
+          // the log (a typo'd command was otherwise invisible), but a provider
+          // error can echo a resolved credential. Log the error with every
+          // secret value this server was given blanked out.
           log('WARN', 'McpManager', 'MCP server excluded from this session — not ready', {
-            sessionId, serverId: entry.server.id, state: entry.conn.state, error: entry.conn.lastError,
+            sessionId, serverId: entry.server.id, state: entry.conn.state,
+            error: redactSecrets(entry.conn.lastError, entry.server),
           });
         }
       }
@@ -209,22 +275,17 @@ export class McpManager {
   // awaits), so only one connect() ever runs no matter how many sessions ask
   // at once.
   //
-  // Except for a credential-error placeholder whose secrets now resolve (below),
-  // WHY no retry: if `entry` already exists — even in `error` or
-  // `needs-setup` state — it is returned as-is; connect() is never retried
-  // while the entry stays pooled (i.e. while any holder remains). This is
-  // deliberate, not an oversight: retry/backoff was out of scope for this
-  // manager. The user-visible effect is that fixing a broken server's config
-  // has no effect until every current holder releases (or the app
-  // restarts) — see status(), which surfaces the real lastError so this
-  // isn't silent.
+  // WHY no retry for unchanged settings: an error/needs-setup entry stays
+  // pooled until its holders release. A changed effective configuration gets
+  // a fresh generation immediately, without disturbing those older holders;
+  // retrying an unchanged broken connection on each acquire remains out of scope.
   private ensureConnected(server: ResolvedMcpServer, leaseId: string): PooledEntry {
+    const key = effectiveConfig(server);
     let entry = this.pool.get(server.id);
-    let recoveredHolders: Set<string> | undefined;
-    if (entry?.server.credentialError && !server.credentialError) {
-      // WHY: this entry was a resource-free error placeholder, never a live
-      // connection. Retry after wallet recovery without discarding older leases.
-      recoveredHolders = entry.holders;
+    if (entry && entry.configKey !== key) {
+      // WHY: old leases retain their exact connection. Never move holders into
+      // the replacement (even an error placeholder): release of OLD must not
+      // close NEW, and A→B→A must not resurrect the retired A connection.
       this.pool.delete(server.id);
       entry = undefined;
     }
@@ -244,6 +305,13 @@ export class McpManager {
       // case in mcp-client.ts); this reuses that same state value rather than
       // inventing a parallel one, so acquire()'s ready-check and status()
       // both treat it exactly like any other not-ready server.
+      // Snapshot before connectionFactory: a mutable registry object must not
+      // change the settings that an already-acquired connection actually uses.
+      const snapshot: ResolvedMcpServer = { ...server, transport: server.transport.type === 'stdio'
+        ? { ...server.transport, args: server.transport.args?.slice() } : { ...server.transport },
+        env: server.env ? { ...server.env } : undefined,
+        headers: server.headers ? { ...server.headers } : undefined,
+        missingSecrets: [...server.missingSecrets] };
       const credentialFailure = server.credentialError || (server.missingSecrets.length > 0
         ? `${server.label} needs setup — missing secret(s): ${server.missingSecrets.join(', ')}.` : null);
       const conn: McpConnectionLike = credentialFailure
@@ -261,9 +329,10 @@ export class McpManager {
             }),
             close: async () => {},
           }
-        : this.connectionFactory(server);
-      entry = { server, conn, holders: recoveredHolders ?? new Set() };
+        : this.connectionFactory(snapshot);
+      entry = { server: snapshot, configKey: key, conn, holders: new Set() };
       this.pool.set(server.id, entry);
+      this.entries.add(entry);
       if (!credentialFailure) {
         entry.connecting = conn.connect().finally(() => {
           entry!.connecting = undefined;
@@ -271,6 +340,9 @@ export class McpManager {
       }
     }
     entry.holders.add(leaseId);
+    const held = this.leaseEntries.get(leaseId) ?? [];
+    held.push(entry);
+    this.leaseEntries.set(leaseId, held);
     return entry;
   }
 
@@ -292,42 +364,54 @@ export class McpManager {
    * server" check; no separate `has()` is needed.
    */
   private async releaseLease(leaseId: string): Promise<void> {
-    for (const [id, entry] of [...this.pool.entries()]) {
-      if (!entry.holders.delete(leaseId)) continue;
-      if (entry.holders.size > 0) continue;
-      // Remove from the pool BEFORE awaiting close(): an acquire() that lands
-      // during the await must build a fresh entry rather than hand out this
-      // one, which is already on its way down.
-      this.pool.delete(id);
-      // Unguarded close() would throw out of this loop and strand every
-      // remaining entry this lease still holds. The connection is being
-      // discarded either way, so a close() failure isn't actionable for the
-      // caller — log the REAL error rather than swallow it
-      // (error-message-standards.md), matching McpConnection.close()'s own
-      // best-effort teardown policy.
+    const held = this.leaseEntries.get(leaseId) ?? [];
+    this.leaseEntries.delete(leaseId);
+    for (const entry of held) {
+      if (!entry.holders.delete(leaseId) || entry.holders.size > 0) continue;
+      // WHY: only delete an ID when this EXACT generation is still current.
+      // Remove before awaiting close so an acquire during teardown connects anew.
+      if (this.pool.get(entry.server.id) === entry) this.pool.delete(entry.server.id);
       try {
-        await entry.conn.close();
+        // WHY: keep the generation discoverable to destroyAll until close
+        // settles; removing it before this await let app teardown return while
+        // an older released transport was still closing.
+        await this.closeEntry(entry);
       } catch (err) {
         log('ERROR', 'McpManager', 'closing a released MCP connection failed', {
-          serverId: id, error: String(err),
+          serverId: entry.server.id, errorType: err instanceof Error ? err.name : 'unknown',
         });
+      } finally {
+        this.entries.delete(entry);
       }
     }
   }
 
-  /** App-quit teardown: close every pooled connection regardless of
-   *  refcount. A leaked MCP subprocess would otherwise outlive the app. */
-  async destroyAll(): Promise<void> {
-    const entries = [...this.pool.values()];
-    this.pool.clear();
-    for (const entry of entries) {
+  private closeEntry(entry: PooledEntry): Promise<void> {
+    // WHY: release and destroyAll may overlap; close exactly once and wait for
+    // a pending connect before closing its transport. Never reuse while closing.
+    if (!entry.closing) entry.closing = (async () => {
+      if (entry.connecting) { try { await entry.connecting; } catch { /* close failed connect too */ } }
       await entry.conn.close();
-    }
+    })();
+    return entry.closing;
+  }
+
+  /** App-quit teardown: close current AND retired/closing generations. */
+  async destroyAll(): Promise<void> {
+    const entries = [...this.entries];
+    this.pool.clear(); // no acquisition may reuse a closing connection
+    this.leaseEntries.clear();
+    // WHY: a second destroyAll must also await pending closes. Retain each
+    // generation in entries until its close settles, even across concurrent
+    // destroy/release calls. closeEntry ensures the transport closes only once.
+    await Promise.all(entries.map(async entry => {
+      try { await this.closeEntry(entry); }
+      finally { this.entries.delete(entry); }
+    }));
   }
 
-  /** Every server this manager has ever touched, including ones that failed
-   *  to connect — their REAL error (McpConnection.lastError, never reworded)
-   *  so a session picker can show why a server is unavailable. */
+  /** One current entry per server ID, including failed connections. Retired
+   *  generations remain usable through leases but never duplicate status rows. */
   status(): Array<{ id: string; state: string; error: string | null }> {
     return [...this.pool.values()].map((entry) => ({
       id: entry.server.id,
diff --git a/desktop/src/main/harness/native-session-host.ts b/desktop/src/main/harness/native-session-host.ts
index 0ec5dd2c3..587999065 100644
--- a/desktop/src/main/harness/native-session-host.ts
+++ b/desktop/src/main/harness/native-session-host.ts
@@ -34,7 +34,8 @@ import { resolvePreset, type ResolvedPreset } from './preset-registry';
 import { decidePermission } from './permission-engine';
 import { getShell } from './tools/bash';
 import { rulesForMode, sameRule, isCrossProjectRule, CROSS_PROJECT_SLUG, DESTRUCTIVE_DENY_LIST, type NativePermissionMode, type PermissionRule } from '../../shared/permission-types';
-import { assembleSystemPrompt, assembleSystemPromptParts, findProjectInstructions, gitSnapshotAsync } from './prompt-assembly';
+import { assembleSystemPrompt, assembleSystemPromptParts, gitSnapshotAsync } from './prompt-assembly';
+import { prepareProjectInstructions, type ProjectInstructionFile } from './injection/project-instructions';
 import { resolveProfile, effectiveContextForModel, type CapabilityProfile, type ProfileProviderType } from './capability-profile';
 import { CORE_TOOLS } from './tools';
 import type { ToolServices, SpecialistReservation, SpecialistSpawnOpts, SpecialistManageOutcome, SpecialistResumeOutcome } from './tools/types';
@@ -54,7 +55,7 @@ import { PermissionModeStore } from './permission-mode-store';
 import { computeReportBudget } from './specialists/report-budget';
 import { truncateOutput, composeNotice } from './tools/truncate';
 import { APPROX_CHARS_PER_TOKEN } from './message-size';
-import { fitInjection, fitProjectInstructions } from './injection/injection-budget';
+import { fitInjection } from './injection/injection-budget';
 import { frameSkillInvocation } from './skills/skill-invocation';
 import { buildTriggerIndex, type TriggerIndex } from './injection/path-triggers';
 import { costForUsage, isFreePricing, type ModelPricing } from './pricing';
@@ -305,6 +306,7 @@ interface LiveEntry {
   // The "What the assistant was given" record last pushed for this session, so a
   // model swap can re-push it with the new model's window (republishWindow).
   sessionContext?: SessionContext;
+  projectInstructionFiles?: readonly ProjectInstructionFile[];
   // Per-session append serialization: each transcript event extends this chain
   // (append(prev).then(next)) so the SessionStore contract (serialized appends)
   // holds. Starts resolved; a failed append is logged but never breaks the
@@ -329,7 +331,7 @@ interface LiveEntry {
   // `attachments` are absolute composer file paths; image ones become image
   // parts on the user message. Carried through the QUEUE too, or a message sent
   // while a turn was in flight would silently lose its pictures.
-  queue: { id: string; text: string; attachments: string[] }[];
+  queue: { id: string; text: string; attachments: string[]; ready?: boolean }[];
   // True from dispatch until runTurns finishes the last queued turn. Host-owned
   // (HarnessSession's in-flight state is private); safe because Node is single-threaded.
   inFlight: boolean;
@@ -383,16 +385,6 @@ function persistedUuidsAfterLastClear(events: TranscriptEvent[]): string[] {
 // pass" (a typed message, a queued message, a skill) from "the host did".
 const IDLE_PASS = async (): Promise<void> => {};
 
-/** The bracketed sentence a fitter appends to say what it cut. Read back rather
- *  than re-described here: a second wording would eventually disagree with the
- *  one the model was actually given, and this panel exists to be trusted.
- *  Null when the text carries no such notice. */
-function truncationNote(fittedText: string): string | null {
-  const at = fittedText.lastIndexOf('\n\n[');
-  if (at === -1 || !fittedText.trimEnd().endsWith(']')) return null;
-  return fittedText.slice(at + 3).trimEnd().slice(0, -1);
-}
-
 /** The name a person recognises out of a skill id. Ids are `plugin:skill` or a
  *  bare name; the part after the colon is what the user typed to install it. */
 function skillLabel(id: string): string {
@@ -999,9 +991,9 @@ export class NativeSessionHost extends EventEmitter {
     const { contextLength, profile, pricing, free } = await this.resolveContextAndProfile(binding);
     const title = header.title ?? record.title;
 
-    const [gitSnapshot, triggers] = await Promise.all([gitSnapshotAsync(workDir), buildTriggerIndex(workDir)]);
+    const [gitSnapshot, triggers, projectInstructionFiles] = await Promise.all([gitSnapshotAsync(workDir), buildTriggerIndex(workDir), prepareProjectInstructions(workDir, profile.injectionBudgetTokens)]);
     const session = this.buildSpecialistSession(
-      parentId, opts.childId, workDir, title, specialist, binding, contextLength, profile, pricing, free, opts.parentToolCallId, preset, parent, gitSnapshot, triggers,
+      parentId, opts.childId, workDir, title, specialist, binding, contextLength, profile, pricing, free, opts.parentToolCallId, preset, parent, gitSnapshot, triggers, projectInstructionFiles,
     );
     // Cold state rebuilt from the child's OWN transcript — seedHistory resets
     // readRegistry + todos too (the same reset-on-resume contract root
@@ -2734,7 +2726,7 @@ export class NativeSessionHost extends EventEmitter {
    *  `profile` is accepted here so Task 6 can add a prompt variant without another
    *  signature change; this task doesn't use it yet (the session itself carries it
    *  via opts.profile). */
-  private toolWiring(sessionId: string, cwd: string, preset: ResolvedPreset, profile: CapabilityProfile, gitSnapshot: string, triggers: TriggerIndex): Pick<HarnessSessionOpts, 'tools' | 'decide' | 'askUser' | 'systemPrompt' | 'promptParts' | 'toolServices' | 'skillCatalog' | 'triggers' | 'internalReadRoots' | 'specialistRoster' | 'shells' | 'runningCalls' | 'adminPasswordEnv' | 'adminPasswordService'> {
+  private toolWiring(sessionId: string, cwd: string, preset: ResolvedPreset, profile: CapabilityProfile, gitSnapshot: string, triggers: TriggerIndex, projectInstructionFiles: readonly ProjectInstructionFile[]): Pick<HarnessSessionOpts, 'tools' | 'decide' | 'askUser' | 'systemPrompt' | 'promptParts' | 'toolServices' | 'skillCatalog' | 'triggers' | 'internalReadRoots' | 'specialistRoster' | 'shells' | 'runningCalls' | 'adminPasswordEnv' | 'adminPasswordService'> {
     return {
       // G-1: this session's background-command registry, host-owned.
       shells: this.shellsFor(sessionId),
@@ -2873,7 +2865,7 @@ export class NativeSessionHost extends EventEmitter {
       // timeouts) and could land on a different date or branch than the prompt the
       // model actually got. presetName is label-only and reaches no model.
       ...(() => {
-        const promptParts = assembleSystemPromptParts({ presetBody: preset.body, cwd, appVersion: this.appVersion, promptVariant: profile.promptVariant, hasTools: profile.supportsTools, instructionBudgetTokens: profile.injectionBudgetTokens, supportsParallelToolCalls: profile.supportsParallelToolCalls, audience: 'user', presetName: preset.manifest.name, gitSnapshot });
+        const promptParts = assembleSystemPromptParts({ presetBody: preset.body, cwd, appVersion: this.appVersion, promptVariant: profile.promptVariant, hasTools: profile.supportsTools, instructionBudgetTokens: profile.injectionBudgetTokens, supportsParallelToolCalls: profile.supportsParallelToolCalls, audience: 'user', presetName: preset.manifest.name, gitSnapshot, projectInstructionFiles });
         return { promptParts, systemPrompt: promptParts.map((p) => p.text).join('\n\n') };
       })(),
     };
@@ -3285,8 +3277,8 @@ export class NativeSessionHost extends EventEmitter {
 
   /** Subscribe a freshly-built HarnessSession: forward its events to the
    *  renderer immediately, and enqueue each on the session's append chain. */
-  private wire(sessionId: string, cwd: string, session: HarnessSession, mcpLease?: McpLease): void {
-    const entry: LiveEntry = { session, cwd, appendChain: Promise.resolve(), compactionGeneration: this.restoredCompactionGeneration.get(session) ?? 0, queue: [], inFlight: false, mcpLease };
+  private wire(sessionId: string, cwd: string, session: HarnessSession, mcpLease?: McpLease, projectInstructionFiles: readonly ProjectInstructionFile[] = []): void {
+    const entry: LiveEntry = { session, cwd, appendChain: Promise.resolve(), compactionGeneration: this.restoredCompactionGeneration.get(session) ?? 0, queue: [], inFlight: false, mcpLease, projectInstructionFiles };
     this.live.set(sessionId, entry);
     this.retainModel(sessionId, session.binding.modelId); // ref-count this model
     // Persist "Always allow" decisions for THIS session's project. The session
@@ -3322,11 +3314,10 @@ export class NativeSessionHost extends EventEmitter {
     // AFTER the listeners above and BEFORE the held-message drain, so the line is
     // on screen before the first turn's output starts arriving.
     //
-    // Never fatal: this reads the instruction file and syncs the tool set, and a
-    // session must still open if either fails. A missing line is a missing
-    // explanation; a thrown one is a chat that never starts.
+    // Never fatal: this describes the already-captured instructions and tool
+    // set; a missing explanation must not stop a chat from opening.
     try {
-      entry.sessionContext = this.buildSessionContext(cwd, session);
+      entry.sessionContext = this.buildSessionContext(entry);
       this.emit('session-context', { sessionId, context: entry.sessionContext });
     } catch (err) {
       log('ERROR', 'NativeSessionHost', 'could not describe the session context', { sessionId, error: String(err) });
@@ -3354,8 +3345,8 @@ export class NativeSessionHost extends EventEmitter {
   /** What this session was given, for the line above the conversation and the
    *  "What the assistant was given" panel.
    *
-   *  Built ONCE per session, at wire() — root sessions only, so a specialist
-   *  child (which is never wired) never grows a line of its own.
+   *  Built ONCE per session from its prompt's captured inventory, at wire() —
+   *  root sessions only; children have no context-panel record.
    *
    *  NO FILE BODIES. The only text here is the system prompt, which is already
    *  assembled and in memory; every file the panel can show is fetched by
@@ -3367,10 +3358,10 @@ export class NativeSessionHost extends EventEmitter {
    *  a small model — the skill catalog itself, which the model is simply never
    *  told about. A skill being too long to fit is a thing that has not happened
    *  yet, so it is reported on the skill's own row and never in this summary. */
-  private buildSessionContext(cwd: string, session: HarnessSession): SessionContext {
+  private buildSessionContext(entry: LiveEntry): SessionContext {
+    const session = entry.session;
     const inv = session.contextInventory();
-    const found = findProjectInstructions(cwd);
-    const fitted = found ? fitProjectInstructions(found.text, inv.injectionBudgetTokens, found.name) : null;
+    const files = entry.projectInstructionFiles ?? [];
     return {
       modelLabel: session.binding.modelId,
       contextWindowTokens: session.contextWindowTokens,
@@ -3379,9 +3370,10 @@ export class NativeSessionHost extends EventEmitter {
       // The project-instructions part is filtered out: it has its own tab, and
       // showing it under System too would say the same thing twice.
       systemPromptSections: inv.promptParts.filter((p) => p.id !== 'project'),
-      projectInstructions: found && fitted
-        ? { path: found.path, truncated: fitted.truncated, note: truncationNote(fitted.text) }
+      projectInstructions: files.length
+        ? { path: files[files.length - 1].path, truncated: files[files.length - 1].truncated, note: files[files.length - 1].note ?? null }
         : null,
+      projectInstructionFiles: files.map(f => ({ path: f.path, truncated: f.truncated, note: f.note ?? null, ...(f.notUsed ? { notUsed: f.notUsed } : {}) })),
       skills: inv.skills.map((s) => ({ id: s.id, label: skillLabel(s.id), description: s.description })),
       skillsOffered: inv.skillsOffered,
       tools: inv.toolNames,
@@ -3422,10 +3414,11 @@ export class NativeSessionHost extends EventEmitter {
     if (!entry) return { error: 'not-live' };
     const budget = entry.session.profileSnapshot.injectionBudgetTokens;
     if (kind === 'project') {
-      const found = findProjectInstructions(entry.cwd);
+      const files = entry.projectInstructionFiles ?? [];
+      // WHY: id is only a selector into the captured inventory, never a path read.
+      const found = id ? files.find(f => f.path === id) : files[files.length - 1];
       if (!found) return { error: 'not-found' };
-      const fitted = fitProjectInstructions(found.text, budget, found.name);
-      return { path: found.path, text: fitted.text, full: found.text, truncated: fitted.truncated };
+      return { path: found.path, text: found.text, full: found.full, truncated: found.truncated };
     }
     if (!id) return { error: 'not-found' };
     try {
@@ -3490,7 +3483,7 @@ export class NativeSessionHost extends EventEmitter {
     await this.specialistCatalog.ensureFresh(opts.cwd);
     // The <env> git line, read off the main thread before anything is built
     // (2026-09-16 C3). Never throws (a non-repo answers a fixed string).
-    const [gitSnapshot, triggers] = await Promise.all([gitSnapshotAsync(opts.cwd), buildTriggerIndex(opts.cwd)]);
+    const [gitSnapshot, triggers, projectInstructionFiles] = await Promise.all([gitSnapshotAsync(opts.cwd), buildTriggerIndex(opts.cwd), prepareProjectInstructions(opts.cwd, profile.injectionBudgetTokens)]);
     // Acquire this session's MCP servers (Task 6) BEFORE constructing the
     // session, so mcpServers is available for the very first buildAiTools().
     const mcpLease = await this.acquireMcp(opts.sessionId);
@@ -3508,8 +3501,9 @@ export class NativeSessionHost extends EventEmitter {
       session = new HarnessSession(
         { sessionId: opts.sessionId, cwd: opts.cwd, harness, binding: opts.binding, contextLength, profile, pricing, free,
           commitCompaction: proposal => this.commitCompaction(opts.sessionId, session, proposal),
+          takeReadyBusyMessage: () => this.takeReadyBusyMessage(opts.sessionId, session),
           ...(mcpServers ? { mcpServers } : {}),
-          ...this.toolWiring(opts.sessionId, opts.cwd, preset, profile, gitSnapshot, triggers) },
+          ...this.toolWiring(opts.sessionId, opts.cwd, preset, profile, gitSnapshot, triggers, projectInstructionFiles) },
         this.modelFactory,
       );
     } catch (err) {
@@ -3517,7 +3511,7 @@ export class NativeSessionHost extends EventEmitter {
       throw err;
     }
     this.presetIdFor.set(opts.sessionId, preset.manifest.id);
-    this.wire(opts.sessionId, opts.cwd, session, mcpLease);
+    this.wire(opts.sessionId, opts.cwd, session, mcpLease, projectInstructionFiles);
     if (slotsUnknown) this.live.get(opts.sessionId)!.refreshSlotsAfterTurn = true;
   }
 
@@ -3590,9 +3584,9 @@ export class NativeSessionHost extends EventEmitter {
     // buildSpecialistSession is fallible synchronous work, and a throw after
     // the header write would leave a session file on disk for a child that
     // never existed. The git line (C3) and trigger walk (B8) are awaited first.
-    const [gitSnapshot, triggers] = await Promise.all([gitSnapshotAsync(workDir), buildTriggerIndex(workDir)]);
+    const [gitSnapshot, triggers, projectInstructionFiles] = await Promise.all([gitSnapshotAsync(workDir), buildTriggerIndex(workDir), prepareProjectInstructions(workDir, profile.injectionBudgetTokens)]);
     const session = this.buildSpecialistSession(
-      parentId, childId, workDir, title, opts.specialist, binding, contextLength, profile, pricing, free, opts.parentToolCallId, preset, parent, gitSnapshot, triggers,
+      parentId, childId, workDir, title, opts.specialist, binding, contextLength, profile, pricing, free, opts.parentToolCallId, preset, parent, gitSnapshot, triggers, projectInstructionFiles,
     );
 
     // `title` was drawn earlier (before this session was built — see that
@@ -3642,9 +3636,15 @@ export class NativeSessionHost extends EventEmitter {
     pricing: ModelPricing | null, free: boolean,
     parentToolCallId: string, preset: ResolvedPreset, parent: LiveEntry,
     // The child's <env> git line and trigger index, awaited by the caller off the main thread (C3, B8).
-    gitSnapshot: string, triggers: TriggerIndex,
+    gitSnapshot: string, triggers: TriggerIndex, projectInstructionFiles: readonly ProjectInstructionFile[],
   ): HarnessSession {
-    const allowed = new Set(specialist.allowedTools);
+    // WHY: the spawn-time Bash capability already advertises these helpers;
+    // hand the SAME derived list to tool exposure and the permission cap so a
+    // child can manage only its own background runs without editing the definition.
+    const effectiveAllowedTools = specialist.allowedTools.includes('Bash')
+      ? [...new Set([...specialist.allowedTools, 'BashOutput', 'KillShell'])]
+      : [...specialist.allowedTools];
+    const allowed = new Set(effectiveAllowedTools);
     let session: HarnessSession;
     session = new HarnessSession(
       {
@@ -3654,12 +3654,10 @@ export class NativeSessionHost extends EventEmitter {
         // lifecycle controls, and the delegation spawn backstop—not an arbitrary
         // per-child action count, so root limits never flow into a child.
         harness: preset.manifest,
-        // TOOLS: the definition's allowlist, filtered out of the same CORE_TOOLS
-        // set every session is built from. The Task tool is structurally absent
-        // because no definition lists it — that omission IS the depth-1 rule.
-        // G-1: a helper allowed Bash gets the companions too — its own
-        // background command would otherwise be unreadable and unstoppable.
-        tools: CORE_TOOLS.filter((t) => allowed.has(t.name) || (allowed.has('Bash') && (t.name === 'BashOutput' || t.name === 'KillShell'))),
+        // TOOLS: the spawn-time effective list, filtered from CORE_TOOLS.
+        // Task stays absent by definition (depth 1); Bash companions are usable
+        // only when Bash is in that definition, never through an unrelated grant.
+        tools: CORE_TOOLS.filter((t) => allowed.has(t.name)),
         // G-1: children get their OWN registry; their runs die with the child
         // under 'conversation-closed' when destroyChildrenOf tears them down.
         shells: this.shellsFor(childId),
@@ -3676,7 +3674,7 @@ export class NativeSessionHost extends EventEmitter {
         // parent's conversation crosses over — the brief in the first user turn
         // is the entire context the child gets.
         systemPrompt: assembleSystemPrompt({
-          presetBody: specialist.systemPrompt, cwd: workDir, appVersion: this.appVersion, gitSnapshot,
+          presetBody: specialist.systemPrompt, cwd: workDir, appVersion: this.appVersion, gitSnapshot, projectInstructionFiles,
           promptVariant: profile.promptVariant, hasTools: profile.supportsTools,
           instructionBudgetTokens: profile.injectionBudgetTokens,
           // audience 'parent': the shared doctrine's writing-for-the-user block is
@@ -3709,7 +3707,7 @@ export class NativeSessionHost extends EventEmitter {
         decide: buildChildDecide({
           parentDecide: this.buildDecide(parentId, parent.cwd, preset.presetRules, { specialistScope: specialist.id }),
           charter: specialist.charter,
-          allowedTools: specialist.allowedTools,
+          allowedTools: effectiveAllowedTools,
           // envelopeGranted: true means the hire was PERMITTED, not that the user was necessarily
           // asked. Two ways that happens: (1) a Task-tool ask card (new spawn) or the original
           // spawn's ask card (resume) was answered — real consent; or (2) the active permission
@@ -3995,7 +3993,7 @@ export class NativeSessionHost extends EventEmitter {
     // destroy() can only release the lease on the LiveEntry it captured. See
     // McpLease in mcp-manager.ts.
     // The <env> git line + trigger index, off the main thread, before the session is built (C3, B8).
-    const [gitSnapshot, triggers] = await Promise.all([gitSnapshotAsync(cwd), buildTriggerIndex(cwd)]);
+    const [gitSnapshot, triggers, projectInstructionFiles] = await Promise.all([gitSnapshotAsync(cwd), buildTriggerIndex(cwd), prepareProjectInstructions(cwd, profile.injectionBudgetTokens)]);
     const mcpLease = await this.acquireMcp(sessionId);
     const mcpServers = mcpLease?.servers;
     const harness = header.stepGuard === undefined
@@ -4014,8 +4012,9 @@ export class NativeSessionHost extends EventEmitter {
         // `binding` (not header.binding) — same override reason as above.
         { sessionId, cwd, harness, binding, contextLength, profile, pricing, free,
           commitCompaction: proposal => this.commitCompaction(sessionId, session, proposal),
+          takeReadyBusyMessage: () => this.takeReadyBusyMessage(sessionId, session),
           ...(mcpServers ? { mcpServers } : {}),
-          ...this.toolWiring(sessionId, cwd, preset, profile, gitSnapshot, triggers) },
+          ...this.toolWiring(sessionId, cwd, preset, profile, gitSnapshot, triggers, projectInstructionFiles) },
         this.modelFactory,
       );
       // Full history rebuild (spec §2.5): rebuildHistory reconstructs the assistant
@@ -4030,7 +4029,7 @@ export class NativeSessionHost extends EventEmitter {
       throw err;
     }
     this.presetIdFor.set(sessionId, preset.manifest.id);
-    this.wire(sessionId, cwd, session, mcpLease);
+    this.wire(sessionId, cwd, session, mcpLease, projectInstructionFiles);
     if (slotsUnknown) this.live.get(sessionId)!.refreshSlotsAfterTurn = true;
     // Task 9 — AFTER wire(), not before: reconcileDelegations's own
     // queueDelivery() call needs this.live.get(sessionId) to already resolve
@@ -4095,7 +4094,16 @@ export class NativeSessionHost extends EventEmitter {
       // Task 11: mint a stable id per queued entry so the renderer can target
       // this exact message later with removeQueued() (Cancel/Edit before send).
       const queueId = randomUUID();
-      entry.queue.push({ id: queueId, text, attachments });
+      // WHY: both the host drainer and a future in-turn claimant must leave this
+      // head untouched until the IPC acknowledgement has had a macrotask to flush.
+      const queued = { id: queueId, text, attachments, ready: false };
+      entry.queue.push(queued);
+      setImmediate(() => {
+        queued.ready = true;
+        // The turn may have settled while this head was unready. Readiness is
+        // itself a progress signal, not something the next send must discover.
+        if (this.live.get(sessionId) === entry) this.kickReadyQueue(sessionId, entry);
+      });
       return { status: 'queued', queueId };
     }
     entry.inFlight = true;
@@ -4146,97 +4154,104 @@ export class NativeSessionHost extends EventEmitter {
     return true;
   }
 
-  // Runs the dispatched turn, then drains the queue turn-by-turn. send() settling
-  // is the ONLY drain trigger — it settles strictly after turn-complete /
-  // session-error / user-interrupt, and stays unsettled across a permission ask
-  // (an ask pauses the turn; draining on it would hard-throw re-entrancy).
+  /** "Send now" (Destin, 2026-09-28): Stop, then send THIS waiting message
+   *  next, ahead of the others. WHY: ordinary mid-task messages wait for the
+   *  current batch; this is for not waiting at all. Move + stop are sync, so
+   *  the drain after the stop finds it first. Contract as removeQueued. */
+  sendQueuedNow(sessionId: string, queueId: string): boolean {
+    const held = this.startingSends.get(sessionId); // still starting: reorder only
+    if (held) {
+      const i = held.findIndex((q) => q.id === queueId);
+      if (i !== -1) { held.unshift(...held.splice(i, 1)); return true; }
+    }
+    const entry = this.live.get(sessionId);
+    if (!entry) return false;
+    const idx = entry.queue.findIndex((q) => q.id === queueId);
+    if (idx === -1) return false;
+    const [item] = entry.queue.splice(idx, 1);
+    item.ready = true; // its IPC ack flushed long before a button could be pressed
+    entry.queue.unshift(item);
+    this.interrupt(sessionId);
+    return true;
+  }
+
+  /** WHY: only the live root driver may remove an acknowledged FIFO head.
+   * No awaits between checking generation/readiness/quiesce and the shift. */
+  private takeReadyBusyMessage(sessionId: string, session: HarnessSession):
+    { id: string; text: string; attachments: string[]; restore: () => void } | undefined {
+    const entry = this.live.get(sessionId);
+    if (!entry || entry.session !== session || entry.parentSessionId || !entry.inFlight ||
+        entry.quiescing || entry.compacting || entry.queue[0]?.ready === false) return;
+    const item = entry.queue.shift();
+    if (!item) return;
+    return { ...item, restore: () => {
+      if (this.live.get(sessionId) === entry && !entry.quiescing) entry.queue.unshift(item);
+      else log('ERROR', 'NativeSessionHost', 'claimed message could not be restored after delivery failure', { sessionId, queueId: item.id });
+    } };
+  }
+
+  /** Claim an idle slot for a head whose acknowledgement fence just opened.
+   *  Never bypass an unready FIFO head; runTurns does the actual shift. */
+  private kickReadyQueue(sessionId: string, entry: LiveEntry): void {
+    if (entry.inFlight || entry.quiescing || entry.compacting || !entry.queue[0] || entry.queue[0].ready === false) return;
+    entry.inFlight = true;
+    entry.running = new Promise<void>((resolve) => {
+      setImmediate(() => { void this.runTurns(sessionId, entry, IDLE_PASS).then(resolve, resolve); });
+    });
+  }
+
+  // Run turns serially. A settled send, the notice tail and a queued head's
+  // readiness transition are drain triggers. An ask pauses the current turn;
+  // no other send runs until it settles (the driver rejects re-entrancy).
   /** `first` is a plain string for an ordinary send, or a THUNK when the turn
    *  starts some other way — today only /skill-name, whose opener is
    *  `session.runSkill` (same turn machinery, different transcript event).
    *  Queued follow-ups are always plain sends, so queue semantics are unchanged. */
   private async runTurns(sessionId: string, entry: LiveEntry, first: SendUnit | (() => Promise<void>)): Promise<void> {
-    // Fix (Task 4 fix pass 3): the WHOLE body is now wrapped in a single
-    // try/finally so "every runTurns exit clears entry.inFlight" is true by
-    // CONSTRUCTION — one statement, not a comment asserting a property the
-    // code has to remember to uphold at every return/break/throw site. Before
-    // this, `entry.inFlight = false` was a bare statement at the tail: a
-    // throw from ANY of the unguarded `await this.ledger.*` calls inside the
-    // delivery loop below (claimUndelivered at the top of the loop,
-    // releaseClaim on either liveness-mismatch branch) propagated straight
-    // out of this function, so that tail statement was never reached and the
-    // session was permanently stuck "in flight" — the exact bug the loop
-    // unification was meant to prevent, arriving by exception instead of by
-    // `return`. The early `return` in the queue-drain loop below (destroy()
-    // raced this turn) still runs this finally too, which is harmless: by
-    // definition `this.live.get(sessionId) !== entry` there, so `entry` is
-    // already a discarded object and setting its `inFlight` flag touches
-    // nothing live.
+    // WHY: even a failed ledger claim or a replaced generation must release
+    // this pass's slot; the finally covers every exit.
     try {
-      // Task 4 (plan 1c) — re-read this project folder's specialist catalog
-      // before dispatching this pass's turn(s): a file dropped into a
-      // specialists folder since the last turn is offered starting on THIS
-      // turn, without a session restart. ONE call per runTurns invocation
-      // (not per queued follow-up) — every turn drained in this same pass
-      // shares the roster this one read resolved. ensureFresh()'s own
-      // fingerprint check makes an unchanged folder cheap (a handful of
-      // stat() calls, never a re-parse); it never throws (every fallible fs
-      // call inside it is already individually guarded — see catalog.ts's
-      // own WHY comments), so this is not wrapped in its own try/catch.
-      // Fix (Task 4 review): gated on `!entry.parentSessionId` — ROOT sessions
-      // ONLY. A specialist child DOES reach this function: runSpecialist's
-      // runTurn() closure calls this.send(childId, ...), and send() dispatches
-      // unconditionally into this.runTurns() for whatever id it's given, so
-      // every child turn (the opening turn AND the empty-report nudge) used to
-      // run this call too — an earlier comment here claimed otherwise, which
-      // was simply wrong. The real reason to skip it for a child: its roster
-      // is fixed at spawn (R12) and never read again — createChild builds a
-      // child's tools by hand and never calls toolWiring(), so no child ever
-      // consults this.specialistCatalog.roster(cwd) for ITS OWN cwd. Without
-      // this gate, every child turn wrote a fresh entry into the catalog's
-      // per-cwd cache (a Map with no eviction) for a cwd nothing will ever
-      // read a roster for — often a work_dir narrowed to a subfolder nothing
-      // else touches — so the cache grew forever across the process's life.
+      // WHY: refresh the root's roster once per pass, not per queued turn.
+      // Children use their fixed spawn roster; refreshing each child's cwd
+      // would grow the catalog cache without a consumer.
       if (!entry.parentSessionId) await this.specialistCatalog.ensureFresh(entry.cwd);
       let next: SendUnit | (() => Promise<void>) | undefined = first;
-      while (next !== undefined) {
-        // A user-started turn lifts the post-Stop hold: everything parked since
-        // the Stop is spliced into history NOW, silently, so the model reads it
-        // as context for this message rather than getting a turn of its own.
-        // Checked per turn, not once per pass, because a message queued before
-        // the Stop still runs after it (pinned: "the queue still drains").
-        if (entry.holdDeliveries && next !== IDLE_PASS) {
-          entry.holdDeliveries = false;
-          await this.drainDeliveries(sessionId, entry, 'splice');
+      // WHY: notices may await the model after the last queued shift. Alternate
+      // delivery and FIFO dispatch until BOTH lanes are quiet at the same boundary.
+      for (;;) {
+        while (next !== undefined) {
           if (this.live.get(sessionId) !== entry) return;
-        }
-        try {
-          if (typeof next === 'function') await next();
-          else await entry.session.send(next.text, next.attachments);
-        } catch (err) {
-          log('ERROR', 'NativeSessionHost', 'send failed', { sessionId, error: String(err) });
-        }
-        // Destroy() may have removed/replaced the entry mid-turn — stop draining then.
-        if (this.live.get(sessionId) !== entry) return;
-        // A local model is loaded by now (a real turn just ran): re-read the
-        // helper cap the engine could not answer at create/resume/swap. INSIDE
-        // the drain loop, before the shift below, on purpose — a message
-        // queued while this await is in the air is picked up by that shift,
-        // whereas an await placed after the loop (first cut, 2026-09-16)
-        // stranded such a message until the next send, since inFlight was
-        // still true and nothing re-read the queue. Root sessions only (a
-        // child's roster is fixed at spawn); never after a delivery-only pass,
-        // which loads nothing.
-        if (entry.refreshSlotsAfterTurn && !entry.parentSessionId && typeof next !== 'function') {
-          await this.refreshLocalSlots(sessionId, entry);
+          // A user-started turn lifts the post-Stop hold so the model reads
+          // parked reports as context, not as a new turn of their own.
+          if (entry.holdDeliveries && next !== IDLE_PASS) {
+            entry.holdDeliveries = false;
+            await this.drainDeliveries(sessionId, entry, 'splice');
+            if (this.live.get(sessionId) !== entry) return;
+          }
+          try {
+            if (typeof next === 'function') await next();
+            else await entry.session.send(next.text, next.attachments);
+          } catch (err) {
+            log('ERROR', 'NativeSessionHost', 'send failed', { sessionId, error: String(err) });
+          }
           if (this.live.get(sessionId) !== entry) return;
+          // A local model can answer its slot count only after a real turn.
+          // Refresh inside the loop so sends accepted during the await are seen.
+          if (entry.refreshSlotsAfterTurn && !entry.parentSessionId && typeof next !== 'function') {
+            await this.refreshLocalSlots(sessionId, entry);
+            if (this.live.get(sessionId) !== entry) return;
+          }
+          // The atomic shift owns the queue ID; an unready FIFO head blocks
+          // dispatch, and its scheduled readiness transition restarts the pass.
+          next = entry.quiescing || entry.queue[0]?.ready === false ? undefined : entry.queue.shift();
         }
-        // .text: queue entries are {id, text} (Task 11) — the id only matters to
-        // removeQueued(); shift() here is what makes a removed entry unreachable.
-        next = entry.queue.shift();
+        // Stop pressed during this pass: leave reports parked, but never park
+        // submitted user messages. A notice pass can receive sends while awaiting.
+        if (!entry.holdDeliveries && !entry.quiescing) await this.drainDeliveries(sessionId, entry, 'turn');
+        if (this.live.get(sessionId) !== entry || entry.quiescing) return;
+        next = entry.queue[0]?.ready === false ? undefined : entry.queue.shift();
+        if (next === undefined) break;
       }
-      // Stop pressed during this pass: leave everything parked (holdDeliveries'
-      // own WHY). The next user message drains it via the splice above.
-      if (!entry.holdDeliveries) await this.drainDeliveries(sessionId, entry, 'turn');
     } finally {
       entry.inFlight = false;
     }
diff --git a/desktop/src/main/harness/prompt-assembly.ts b/desktop/src/main/harness/prompt-assembly.ts
index 45f73bdc1..8200d1a67 100644
--- a/desktop/src/main/harness/prompt-assembly.ts
+++ b/desktop/src/main/harness/prompt-assembly.ts
@@ -4,8 +4,9 @@
 //
 // WHY not reuse project-context.ts / context-discovery.ts: the former is a pure
 // mapper over pre-computed basenames and the latter only scans the exact project
-// dir + .claude (async, for the context UI). Neither does the session-start
-// walk-up-to-git-root that the assembled prompt needs, so this owns its own IO.
+// dir + .claude (async, for the context UI). Production now supplies the
+// asynchronously captured ancestor inventory; the sync reader remains for
+// legacy single-file callers and Claude Code context compatibility.
 import * as fs from 'fs';
 import * as path from 'path';
 import { execFile, execFileSync } from 'child_process';
@@ -14,6 +15,7 @@ import type { PromptVariant } from './capability-profile';
 import { variantOverlay } from './prompts/variants';
 import { fitProjectInstructions } from './injection/injection-budget';
 import { sharedDoctrine } from './prompts/shared-doctrine';
+import { renderProjectInstructionFiles, type ProjectInstructionFile } from './injection/project-instructions';
 
 // promptVariant is the capability-profile steering overlay (see prompts/variants.ts).
 // Optional so pre-variant callers assemble byte-identically; only local-small adds text.
@@ -38,7 +40,7 @@ const DEFAULT_INSTRUCTION_BUDGET_TOKENS = 20_000;
 // gitSnapshot: the <env> git line, computed AHEAD by the caller with
 // gitSnapshotAsync (2026-09-16 C3). When absent the sync shell-out below runs,
 // which only the evaluator and tests should reach — see the WHY on gitSnapshotAsync.
-export interface PromptInputs { presetBody: string; cwd: string; appVersion: string; promptVariant?: PromptVariant; hasTools?: boolean; instructionBudgetTokens?: number; supportsParallelToolCalls?: boolean; audience?: 'user' | 'parent'; presetName?: string; gitSnapshot?: string }
+export interface PromptInputs { presetBody: string; cwd: string; appVersion: string; promptVariant?: PromptVariant; hasTools?: boolean; instructionBudgetTokens?: number; supportsParallelToolCalls?: boolean; audience?: 'user' | 'parent'; presetName?: string; gitSnapshot?: string; projectInstructionFiles?: readonly ProjectInstructionFile[] }
 
 const GIT_TIMEOUT_MS = 3000;
 
@@ -107,7 +109,10 @@ export function findProjectInstructions(cwd: string): { path: string; name: stri
   return null;
 }
 
-function projectInstructions(cwd: string, budgetTokens: number): string | null {
+function projectInstructions(cwd: string, budgetTokens: number, files?: readonly ProjectInstructionFile[]): string | null {
+  // WHY: the host supplies one captured startup snapshot; neither the prompt nor
+  // the panel may repeat discovery after disk contents have changed.
+  if (files) return renderProjectInstructionFiles(files);
   const found = findProjectInstructions(cwd);
   if (!found) return null;
   // The budget bounds the FILE BODY only — the wrapping tag is added after,
@@ -159,7 +164,7 @@ export function assembleSystemPromptParts(i: PromptInputs): PromptPart[] {
       text: 'You are the YouCoded assistant, an agentic AI running inside the YouCoded app. You may be running on any model the user chose, cloud or local — Claude, GPT, Grok, Gemini, Qwen, Gemma and others.',
     },
     { id: 'preset', label: i.presetName ? `Its preset — ${i.presetName}` : 'Its preset', text: i.presetBody },
-    partOrNull('project', 'Your project instructions', projectInstructions(i.cwd, i.instructionBudgetTokens ?? DEFAULT_INSTRUCTION_BUDGET_TOKENS)),
+    partOrNull('project', 'Your project instructions', projectInstructions(i.cwd, i.instructionBudgetTokens ?? DEFAULT_INSTRUCTION_BUDGET_TOKENS, i.projectInstructionFiles)),
     {
       id: 'doctrine',
       label: 'How it works',
diff --git a/desktop/src/main/harness/shell-registry.ts b/desktop/src/main/harness/shell-registry.ts
index 855e62208..517254e9a 100644
--- a/desktop/src/main/harness/shell-registry.ts
+++ b/desktop/src/main/harness/shell-registry.ts
@@ -305,11 +305,19 @@ export class ShellRegistry extends EventEmitter {
     } catch (e: any) {
       return { ok: false, reason: 'spawn-failed', detail: e?.message ?? String(e) };
     }
-    const run = this.register({
-      toolUseId: spec.toolUseId, command: spec.command, cwd: spec.cwd, child,
-      startedAt: Date.now(), seedLog: null, recent: '', logPath: null, logStream: null, captureEnv: false,
-    }, { detached: false, explicit: true });
-    return { ok: true, run, runningExplicit: running.length + 1 };
+    try {
+      const run = this.register({
+        toolUseId: spec.toolUseId, command: spec.command, cwd: spec.cwd, child,
+        startedAt: Date.now(), seedLog: null, recent: '', logPath: null, logStream: null, captureEnv: false,
+      }, { detached: false, explicit: true });
+      return { ok: true, run, runningExplicit: running.length + 1 };
+    } catch (e: any) {
+      // WHY: a spawned but unregistered child is still ours to stop; give the
+      // caller a real setup failure, never an id for a run no registry owns.
+      child.on('error', () => {}); // late spawn errors cannot crash main
+      if (child.exitCode === null && child.signalCode === null) killTree(child, { graceMs: 0 });
+      return { ok: false, reason: 'spawn-failed', detail: e?.message ?? String(e) };
+    }
   }
 
   /** Hand-off (spec §5.5): the same process bash.ts already spawned, adopted
@@ -331,6 +339,9 @@ export class ShellRegistry extends EventEmitter {
       fs.mkdirSync(dir, { recursive: true });
       logPath = path.join(dir, `bash-${Date.now()}-${shellId}.txt`);
       logStream = fs.createWriteStream(logPath);
+      // WHY: opening is asynchronous; an EACCES can arrive before the sweep or
+      // the registry's run listeners. Keep the tail as the fallback, not a crash.
+      logStream.on('error', () => {});
       // The 7-day sweep used to fire only from bash.ts's foreground spill; a
       // user whose long commands all run in the background would never have
       // triggered it, and these logs would pile up forever (2026-08-28 review).
diff --git a/desktop/src/main/harness/tool-args.ts b/desktop/src/main/harness/tool-args.ts
new file mode 100644
index 000000000..0ecbde166
--- /dev/null
+++ b/desktop/src/main/harness/tool-args.ts
@@ -0,0 +1,17 @@
+import type { NativeTool } from './tools/types';
+
+/** WHY: the pre-write guidance gate must see exactly the same validated,
+ * normalized path as execution; invalid args remain ordinary tool errors. */
+export function parseToolArgs(tool: NativeTool, input: unknown): ReturnType<NativeTool['inputSchema']['safeParse']> {
+  let parsed = tool.inputSchema.safeParse(input);
+  if (!parsed.success && typeof input === 'string') {
+    try {
+      const recovered: unknown = JSON.parse(input);
+      if (recovered && typeof recovered === 'object') {
+        const reparsed = tool.inputSchema.safeParse(recovered);
+        if (reparsed.success) parsed = reparsed;
+      }
+    } catch { /* Let the normal argument-error result explain the invalid input. */ }
+  }
+  return parsed;
+}
diff --git a/desktop/src/main/harness/tool-group-finalization.ts b/desktop/src/main/harness/tool-group-finalization.ts
new file mode 100644
index 000000000..ebe5dc414
--- /dev/null
+++ b/desktop/src/main/harness/tool-group-finalization.ts
@@ -0,0 +1,27 @@
+// WHY: a permission callback may fail after the assistant has announced an entire
+// group. Tag only pre-execution callback failures; a started action is not retried
+// or silently reclassified as an approval/denial.
+export class PermissionCallbackFailure {
+  constructor(readonly cause: unknown) {}
+}
+
+export async function permissionCallback<T>(call: () => Promise<T>): Promise<T> {
+  try { return await call(); }
+  catch (err) { throw new PermissionCallbackFailure(err); }
+}
+
+/** Emit exactly one result for each not-yet-recorded call; the caller retains
+ * completed results and commits the complete tool message and event origins. */
+export function finalizeRemainingCalls<TCall, TPart>(
+  calls: readonly TCall[], start: number, textFor: (index: number) => string,
+  emit: (call: TCall, text: string) => string, part: (call: TCall, text: string) => TPart,
+): { parts: TPart[]; origins: string[] } {
+  const parts: TPart[] = [];
+  const origins: string[] = [];
+  for (let i = start; i < calls.length; i++) {
+    const text = textFor(i);
+    origins.push(emit(calls[i], text));
+    parts.push(part(calls[i], text));
+  }
+  return { parts, origins };
+}
diff --git a/desktop/src/main/harness/tools/ask-user-question.ts b/desktop/src/main/harness/tools/ask-user-question.ts
index 06ef4ad60..7e1bc38a0 100644
--- a/desktop/src/main/harness/tools/ask-user-question.ts
+++ b/desktop/src/main/harness/tools/ask-user-question.ts
@@ -48,15 +48,25 @@ export function formatAnswers(args: AskUserQuestionInput, updatedInput: Record<s
   // rules as `answers` — anything that isn't a non-empty string is no note.
   const rawNotes = updatedInput?.notes;
   const notes = (rawNotes && typeof rawNotes === 'object' && !Array.isArray(rawNotes) ? rawNotes : {}) as Record<string, unknown>;
-  const lines = args.questions.map((qq) => {
-    const answer = renderAnswer(answers[qq.question]);
+  // WHY: the legacy text-keyed map cannot distinguish identical wording. Only
+  // accept a COMPLETE, well-typed ordered response; malformed remote clients
+  // fall back to the old map without ever creating a dangling tool result.
+  const rawOrdered = updatedInput?.orderedAnswers;
+  const ordered = Array.isArray(rawOrdered) && rawOrdered.length === args.questions.length
+    && rawOrdered.every((item) => item && typeof item === 'object' && !Array.isArray(item)
+      && (typeof item.answer === 'string' || (Array.isArray(item.answer) && item.answer.every((v: unknown) => typeof v === 'string')))
+      && (item.note === undefined || typeof item.note === 'string'))
+    ? rawOrdered as Array<{ answer: string | string[]; note?: string }> : null;
+  const lines = args.questions.map((qq, index) => {
+    const answer = renderAnswer(ordered ? ordered[index].answer : answers[qq.question]);
     // A typed "Other" answer arrives as plain text in the answer slot. Tell the
     // model when what came back was NOT one of its options, so it reads the
     // text as the user's own answer instead of hunting for a matching label.
     const labels = new Set(qq.options.map((o) => o.label));
     const parts = answer === NO_SELECTION ? [] : answer.split(', ');
     const ownAnswer = parts.length > 0 && parts.some((p) => !labels.has(p));
-    const note = typeof notes[qq.question] === 'string' ? (notes[qq.question] as string).trim() : '';
+    const note = ordered ? (ordered[index].note ?? '').trim()
+      : typeof notes[qq.question] === 'string' ? (notes[qq.question] as string).trim() : '';
     let out = `Q: ${qq.question}\nA${ownAnswer ? ' (the user typed their own answer)' : ''}: ${answer}`;
     if (note) out += `\nNote from the user: ${note}`;
     return out;
diff --git a/desktop/src/main/harness/tools/bash.ts b/desktop/src/main/harness/tools/bash.ts
index 8ee0fabc3..2161c49ac 100644
--- a/desktop/src/main/harness/tools/bash.ts
+++ b/desktop/src/main/harness/tools/bash.ts
@@ -654,10 +654,11 @@ export const BashTool = defineTool({
         return;
       }
       // admin-password design §2.3/§11 task 5: registered for the foreground
-      // path here — a hand-off (the timeout branch below) removes the
-      // close/error listeners BEFORE ctx.shells.adopt() re-registers the
-      // SAME pid into the SAME RunningCalls, so registration correctly
-      // survives the hand-off rather than needing a separate carry-over.
+      // path here — a hand-off (the timeout branch below) lets
+      // ctx.shells.adopt() re-register the SAME pid into the SAME RunningCalls,
+      // then removes this call's close/error listeners without firing them, so
+      // registration survives the hand-off. A FAILED adopt keeps them attached:
+      // the kill that follows reaches onCallExit and unregisters normally.
       if (ctx.runningCalls && child.pid) {
         void ctx.runningCalls.registerPid(child.pid, { sessionId: ctx.sessionId, toolCallId: ctx.toolCallId ?? 'unknown' });
       }
@@ -753,8 +754,10 @@ export const BashTool = defineTool({
         tailBuf = (tailBuf + s).slice(-TAIL_RETAIN_CHARS);
         if (probe) probeTail = (probeTail + s).slice(-4096);
       };
-      child.stdout.on('data', (d) => cap(String(d)));
-      child.stderr.on('data', (d) => cap(String(d)));
+      const onStdout = (d: Buffer) => cap(String(d));
+      const onStderr = (d: Buffer) => cap(String(d));
+      child.stdout.on('data', onStdout);
+      child.stderr.on('data', onStderr);
       let done = false;
       /** G-1: set by the timeout timer once the registry adopted this process. */
       let handedOffTo: string | null = null;
@@ -1046,6 +1049,7 @@ export const BashTool = defineTool({
         // restarted — and this call resolves with the output so far. Two
         // cases keep the old kill: no registry in this context (tests,
         // one-off tools), and a leading `sleep` (backgrounding a sleep is churn).
+        if (done) return; // A close/abort that won the deadline retains its result.
         if (!ctx.shells || LEADING_SLEEP.test(args.command)) {
           killTree(child, { graceMs: 0 });
           finish(
@@ -1056,24 +1060,37 @@ export const BashTool = defineTool({
           );
           return;
         }
-        // From here the registry reads the pipes; this call must stop
-        // listening or every byte would be counted twice.
-        child.stdout.removeAllListeners('data');
-        child.stderr.removeAllListeners('data');
-        child.removeAllListeners('close');
-        child.removeAllListeners('error');
+        // WHY: registration can throw before ownership transfers. Keep foreground
+        // listeners until it succeeds, then remove only OUR listeners (not the
+        // registry's) so no output or close/error is lost during a failed setup.
+        let run;
+        try {
+          run = ctx.shells.adopt({
+            toolUseId: ctx.toolCallId ?? 'unknown', command: args.command, cwd: startCwd, child, startedAt,
+            seedLog: spillStream ? null : headBuf,
+            recent: tailBuf, logPath: spillPath, logStream: spillStream, captureEnv,
+          });
+        } catch (e: any) {
+          // A failed handoff must neither strand the Bash promise nor leave an
+          // untracked command running. C2's deferred descendant guarantees do
+          // not follow from this best-effort stop of our freshly spawned child.
+          if (child.exitCode === null && child.signalCode === null) killTree(child, { graceMs: 0 });
+          finish(`Failed to hand off background command: ${e?.message ?? e}. Cleanup was attempted; process exit was not confirmed.\n`, true);
+          return;
+        }
+        child.stdout.off('data', onStdout);
+        child.stderr.off('data', onStderr);
+        child.off('close', onClose);
+        child.off('error', onError);
+        if (done) {
+          // An abort/close can settle during a re-entrant adoption callback.
+          // The registry now owns this run; stop it there, never report success.
+          void ctx.shells.kill(run.shellId, 'user').catch(() => {});
+          return;
+        }
         // D4: a handed-off command can no longer be answered — close stdin so
         // a prompt fails fast with its own error instead of hanging forever.
         try { child.stdin?.end(); } catch { /* already closed */ }
-        const run = ctx.shells.adopt({
-          toolUseId: ctx.toolCallId ?? 'unknown', command: args.command, cwd: startCwd, child, startedAt,
-          // headBuf is complete when no spill has started (nothing dropped yet);
-          // otherwise the spill stream already holds everything.
-          seedLog: spillStream ? null : headBuf,
-          recent: tailBuf,
-          logPath: spillPath, logStream: spillStream,
-          captureEnv,
-        });
         handedOffTo = run.shellId;
         spillPath = run.logPath;
         finish(
@@ -1102,9 +1119,9 @@ export const BashTool = defineTool({
       if (ctx.signal.aborted) onAbort();
       // admin-password design §2.3/§5/§6/§11 task 5: the ONLY two listeners
       // that mean "this foreground call's own root pid is truly done" —
-      // removed wholesale by the hand-off branch above BEFORE adopt(), so
-      // this unregister/forget/wipe never double-fires once ownership moves
-      // to ShellRegistry (its own onExit does the equivalent there).
+      // removed by the hand-off branch above once adopt() succeeds, so this
+      // unregister/forget/wipe never double-fires once ownership moves to
+      // ShellRegistry (its own onExit does the equivalent there).
       const onCallExit = () => {
         if (ctx.runningCalls && child.pid) {
           ctx.runningCalls.unregister(child.pid);
@@ -1120,18 +1137,20 @@ export const BashTool = defineTool({
       // Async spawn failure (the path Windows takes for a bad cwd): name the
       // shell + cwd actually used, not just Node's bare `spawn <cmd> <CODE>` —
       // same diagnosability contract as the sync catch above.
-      child.on('error', (err) => {
+      const onError = (err: Error) => {
         onCallExit();
         finish(`Failed to start shell: ${err.message} (shell=${shell.cmd}; cwd=${startCwd})\n`, true);
-      });
+      };
+      child.on('error', onError);
       // WHY no exit-code prefix here anymore: the metadata line above now states
       // `exit N` for every result, so a leading "(exit code N)" duplicated the
       // same fact in two places. The timeout/abort handlers keep their prefixes —
       // those are messages, not exit codes.
-      child.on('close', (code) => {
+      const onClose = (code: number | null) => {
         onCallExit();
         finish('', code !== 0, code);
-      });
+      };
+      child.on('close', onClose);
     });
   },
 });
diff --git a/desktop/src/main/harness/tools/file-fingerprint.ts b/desktop/src/main/harness/tools/file-fingerprint.ts
index 369875be3..26b324af7 100644
--- a/desktop/src/main/harness/tools/file-fingerprint.ts
+++ b/desktop/src/main/harness/tools/file-fingerprint.ts
@@ -31,3 +31,25 @@ export function fingerprintOf(buf: Buffer | string): string {
 export async function fingerprintFile(absPath: string): Promise<string> {
   return fingerprintOf(await fs.promises.readFile(absPath));
 }
+
+/** The same fingerprint as fingerprintOf, computed in small pieces as the file
+ *  streams in. WHY (Destin, 2026-09-28: no new stutters): the app's main
+ *  process serves every window, and hashing a large file in one go holds it for
+ *  tens of milliseconds (~36 ms at 50 MB). Between pieces the process is free to
+ *  handle other work, so even the largest readable file causes no visible hitch.
+ *  Used by Read's repeat check, where most answers are "unchanged" and the
+ *  whole-file decode and line split can then be skipped entirely. */
+export function fingerprintFileInPieces(absPath: string): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const hash = createHash('sha256');
+    let length = 0;
+    fs.createReadStream(absPath, { highWaterMark: 256 * 1024 })
+      .on('data', (chunk: Buffer | string) => {
+        const b = typeof chunk === 'string' ? Buffer.from(chunk, 'utf8') : chunk;
+        length += b.length;
+        hash.update(b);
+      })
+      .on('error', reject)
+      .on('end', () => resolve(`${length}:${hash.digest('hex')}`));
+  });
+}
diff --git a/desktop/src/main/harness/tools/net-guard.ts b/desktop/src/main/harness/tools/net-guard.ts
index f27ba56d3..6947a908b 100644
--- a/desktop/src/main/harness/tools/net-guard.ts
+++ b/desktop/src/main/harness/tools/net-guard.ts
@@ -53,7 +53,8 @@ export function isPrivateIp(ip: string): boolean {
 
 /** Scheme + address validation for ONE URL. Throws NetGuardError with an honest,
  *  specific message (docs/error-message-standards.md). Returns the parsed URL. */
-export async function assertPublicHttpUrl(raw: string, lookup: LookupFn = defaultLookup): Promise<URL> {
+export async function assertPublicHttpUrl(raw: string, lookup: LookupFn = defaultLookup, signal?: AbortSignal): Promise<URL> {
+  signal?.throwIfAborted();
   let url: URL;
   try { url = new URL(raw); } catch { throw new NetGuardError(`"${raw}" is not a valid URL.`); }
   if (url.protocol !== 'http:' && url.protocol !== 'https:') {
@@ -69,10 +70,32 @@ export async function assertPublicHttpUrl(raw: string, lookup: LookupFn = defaul
   if (host === 'localhost' || host.endsWith('.localhost') || host.endsWith('.local')) {
     throw new NetGuardError(`${host} is a local address — fetching it is blocked.`);
   }
+  // WHY: DNS promises do not accept a portable cancellation signal. Settle our
+  // wait on abort while consuming any late lookup result/rejection. The listener
+  // is scoped to this hop; the same signal/deadline is shared by every hop.
+  const resolveHost = () => Promise.resolve().then(() => {
+    signal?.throwIfAborted();
+    try {
+      return Promise.resolve(lookup(host)).catch(() => {
+        throw new NetGuardError(`Could not resolve ${host} — check the URL or the network connection.`);
+      });
+    } catch {
+      throw new NetGuardError(`Could not resolve ${host} — check the URL or the network connection.`);
+    }
+  });
   let addrs: Array<{ address: string }>;
-  try { addrs = await lookup(host); } catch {
-    throw new NetGuardError(`Could not resolve ${host} — check the URL or the network connection.`);
-  }
+  if (signal) {
+    let onAbort!: () => void;
+    const aborted = new Promise<never>((_resolve, reject) => {
+      onAbort = () => reject(signal.reason);
+      signal.addEventListener('abort', onAbort, { once: true });
+    });
+    try {
+      signal.throwIfAborted();
+      addrs = await Promise.race([resolveHost(), aborted]);
+    } finally { signal.removeEventListener('abort', onAbort); }
+  } else addrs = await resolveHost();
+  signal?.throwIfAborted();
   if (addrs.length === 0) throw new NetGuardError(`Could not resolve ${host}.`);
   const bad = addrs.find((a) => isPrivateIp(a.address));
   if (bad) throw new NetGuardError(`${host} resolves to the private/internal address ${bad.address} — fetching it is blocked.`);
@@ -122,8 +145,8 @@ export interface GuardedFetchOpts {
 }
 
 /** Fetch with MANUAL redirect following: every hop re-runs assertPublicHttpUrl.
- *  Timeout/abort surfaces as a DOMException (AbortError) from fetch — NOT a
- *  NetGuardError — which the tool layer translates for the user (spec §3.1). */
+ *  Caller abort / deadline (AbortError / TimeoutError) also ends DNS waiting;
+ *  neither is a NetGuardError or proof that OS resolution was canceled. */
 export async function guardedFetch(rawUrl: string, opts: GuardedFetchOpts): Promise<{ res: Response; finalUrl: string }> {
   const fetchImpl = opts.fetchImpl ?? fetch;
   const lookup = opts.lookup ?? defaultLookup;
@@ -136,7 +159,7 @@ export async function guardedFetch(rawUrl: string, opts: GuardedFetchOpts): Prom
   let method = (opts.method ?? 'GET').toUpperCase();
   let body = opts.body;
   for (let hop = 0; ; hop++) {
-    const url = await assertPublicHttpUrl(current, lookup);
+    const url = await assertPublicHttpUrl(current, lookup, deadline);
     const host = url.hostname.toLowerCase();
     if (originHost === null) originHost = host;
     const decision = opts.allowHost?.(url.hostname, hop);
@@ -147,6 +170,7 @@ export async function guardedFetch(rawUrl: string, opts: GuardedFetchOpts): Prom
     const onOrigin = host === originHost;
     if (!onOrigin) for (const p of opts.credentialQueryParams ?? []) url.searchParams.delete(p);
     const target = url.toString();
+    deadline.throwIfAborted(); // no dispatch after DNS or allowHost used the remaining budget
     const res = await fetchImpl(target, {
       redirect: 'manual',
       method,
diff --git a/desktop/src/main/harness/tools/read.ts b/desktop/src/main/harness/tools/read.ts
index 604ef7a30..34d88aa75 100644
--- a/desktop/src/main/harness/tools/read.ts
+++ b/desktop/src/main/harness/tools/read.ts
@@ -5,7 +5,7 @@ import { defineTool } from './registry';
 import { canonicalize, resolveP, shellCwdMissHint, lunaPathRefused } from './guards';
 import { deliverableImageMediaType, UNDELIVERABLE_IMAGE_EXTENSIONS, MAX_ATTACHMENT_BYTES } from '../image-support';
 import { readPdfAsToolResult } from '../pdf-text';
-import { fingerprintFile, fingerprintOf } from './file-fingerprint';
+import { fingerprintFile, fingerprintFileInPieces, fingerprintOf } from './file-fingerprint';
 
 const BINARY_SNIFF_BYTES = 8000;
 
@@ -203,30 +203,29 @@ export const ReadTool = defineTool({
     const offset = args.offset ?? 1;
     const limit = Math.min(args.limit ?? 2000, 2000);
     const canonical = canonicalize(args.file_path, ctx.cwd);
-    // G-11 (2026-08-26 tools investigation): the same slice of an UNCHANGED file
-    // was already served this session — the model still has it (the session
-    // forgets these marks whenever history is discarded or shrunk, so this is
-    // never claimed across a compaction or resume). A short notice beats a
-    // second copy: Claude Code and Hermes both do this. Checked BEFORE the file
-    // is read so the repeat costs a stat and nothing else. Still counts as a
-    // Read for the edit gate — the registry stamp happens here as well as on the
-    // full path below (a binary file is only stamped AFTER it passes the binary
-    // refusal, so a refused Read never satisfies the gate; a dedupe hit can
-    // only be for a file that already passed it).
     const servedKey = `${canonical}|${offset}|${limit}`;
     const prior = ctx.servedReads?.get(servedKey);
-    if (prior && prior.mtimeMs === st.mtimeMs) {
-      ctx.readRegistry.set(canonical, prior.fingerprint);
-      const ago = ctx.toolCallIndex !== undefined ? ctx.toolCallIndex - prior.callIndex : undefined;
-      const when = ago !== undefined ? `(${ago} call${ago === 1 ? '' : 's'} ago)` : '(earlier this session)';
-      return {
-        text: `Read ${args.file_path}: lines ${prior.from}–${prior.to} — `
-          + `Unchanged since your earlier Read this session ${when} — the content you already have is current. `
-          + 'Use a different offset/limit to see another part of the file.',
-      };
-    }
     // fs.promises (2026-09-16 C4): up to MAX_READ_BYTES used to be read
     // synchronously on the main thread, several times per turn.
+    // WHY check a repeat BEFORE loading the file: an unchanged repeat is the
+    // common case, and answering it from a piecewise fingerprint skips the
+    // whole-file decode + line split (~100 ms of main-process time at 50 MB)
+    // that would stall every window. A size mismatch skips even the hash. The
+    // bytes, not the mtime, decide: a replacement can keep mtime and size.
+    if (prior && prior.fingerprint.startsWith(`${st.size}:`)) {
+      let current: string | null = null;
+      try { current = await fingerprintFileInPieces(abs); } catch { /* fall through to the normal read and its error */ }
+      if (current === prior.fingerprint) {
+        ctx.readRegistry.set(canonical, current);
+        const ago = ctx.toolCallIndex !== undefined ? ctx.toolCallIndex - prior.callIndex : undefined;
+        const when = ago !== undefined ? `(${ago} call${ago === 1 ? '' : 's'} ago)` : '(earlier this session)';
+        return {
+          text: `Read ${args.file_path}: lines ${prior.from}–${prior.to} — `
+            + `Unchanged since your earlier Read this session ${when} — the content you already have is current. `
+            + 'Use a different offset/limit to see another part of the file.',
+        };
+      }
+    }
     const buf = await fs.promises.readFile(abs);
     if (looksBinary(buf)) return { text: `Read rejected: ${args.file_path}: it is a binary file.`, isError: true };
     const raw = buf.toString('utf8');
@@ -235,15 +234,13 @@ export const ReadTool = defineTool({
     // 4) — drop it so line counts and the paging trailer are honest.
     if (raw.endsWith('\n')) all.pop();
     const totalLines = all.length;
-    // Record for the read-before-edit gate (a content fingerprint, so a later
-    // external change invalidates it and a mere touch does not) — the file
-    // exists and was readable, so it counts as read even if the requested page
-    // is past EOF.
-    const fingerprint = fingerprintOf(buf);
-    ctx.readRegistry.set(canonical, fingerprint);
     if (offset > totalLines) {
       return { text: `Read failed: ${args.file_path}: offset ${offset} is past the end of the file (${totalLines} lines).`, isError: true };
     }
+    // The file changed (or was never served): stamp the read-before-edit gate
+    // from the SAME buffer that passed the binary/offset checks above.
+    const fingerprint = fingerprintOf(buf);
+    ctx.readRegistry.set(canonical, fingerprint);
     const slice = all.slice(offset - 1, offset - 1 + limit);
     const MAX_LINE = 2000;
     // G-5: a second, per-call cap in CHARS on top of the line cap — 2,000 lines
diff --git a/desktop/src/main/harness/tools/types.ts b/desktop/src/main/harness/tools/types.ts
index b1aaa876d..0e49f2ad0 100644
--- a/desktop/src/main/harness/tools/types.ts
+++ b/desktop/src/main/harness/tools/types.ts
@@ -214,13 +214,10 @@ export interface ToolServices {
   };
 }
 
-/** What an earlier Read served (G-11): the file's mtime at that moment, which
- *  tool call did it, and the line range it showed. */
+/** What an earlier text Read served: verified byte identity, call and slice. */
 export interface ServedRead {
   mtimeMs: number;
-  /** The content fingerprint recorded for the read gate at that Read, so a
-   *  dedupe hit (mtime unchanged) can re-stamp the registry without reading
-   *  the file again (2026-09-16). */
+  /** Compare against freshly read, validated bytes before claiming unchanged. */
   fingerprint: string;
   callIndex: number;
   from: number;
diff --git a/desktop/src/main/ipc-handlers.ts b/desktop/src/main/ipc-handlers.ts
index 0f466e498..334619925 100644
--- a/desktop/src/main/ipc-handlers.ts
+++ b/desktop/src/main/ipc-handlers.ts
@@ -3622,6 +3622,9 @@ export function registerIpcHandlers(
   // too late / unknown), so this is a thin pass-through like NATIVE_SEND above.
   ipcMain.handle(IPC.NATIVE_QUEUE_REMOVE, (_e, { sessionId, queueId }: { sessionId: string; queueId: string }) =>
     nativeHost.removeQueued(sessionId, queueId));
+  // "Send now" on a waiting message — same sync, never-throws boolean contract.
+  ipcMain.handle(IPC.NATIVE_QUEUE_SEND_NOW, (_e, { sessionId, queueId }: { sessionId: string; queueId: string }) =>
+    nativeHost.sendQueuedNow(sessionId, queueId));
   // Fire-and-forget I/O (no response): interrupt only. The host never throws for unknown ids.
   ipcMain.on(IPC.NATIVE_INTERRUPT, (_e, { sessionId }: { sessionId: string }) => {
     nativeHost.interrupt(sessionId);
diff --git a/desktop/src/main/preload.ts b/desktop/src/main/preload.ts
index 9155285ee..6e19dc8d4 100644
--- a/desktop/src/main/preload.ts
+++ b/desktop/src/main/preload.ts
@@ -392,6 +392,7 @@ const IPC = {
   NATIVE_SEND: 'native:send',
   // Task 11: cancel/edit a queued-but-not-yet-sent message.
   NATIVE_QUEUE_REMOVE: 'native:queue-remove',
+  NATIVE_QUEUE_SEND_NOW: 'native:queue-send-now',
   NATIVE_INTERRUPT: 'native:interrupt',
   // Stalled-turn Retry — fire-and-forget, same shape as interrupt above.
   NATIVE_RETRY: 'native:retry',
@@ -1522,6 +1523,7 @@ contextBridge.exposeInMainWorld('claude', {
     // (unlike interrupt below) — the renderer needs the true/false result to
     // decide between "removed, proceed" and a "too late" toast.
     queueRemove: (sessionId: string, queueId: string) => ipcRenderer.invoke(IPC.NATIVE_QUEUE_REMOVE, { sessionId, queueId }),
+    queueSendNow: (sessionId: string, queueId: string) => ipcRenderer.invoke(IPC.NATIVE_QUEUE_SEND_NOW, { sessionId, queueId }),
     // Fire-and-forget: match ipcMain.on handler that destructures { sessionId }.
     interrupt: (sessionId: string) => ipcRenderer.send(IPC.NATIVE_INTERRUPT, { sessionId }),
     // Fire-and-forget like interrupt: the stalled card needs no answer — either
diff --git a/desktop/src/main/remote-server.ts b/desktop/src/main/remote-server.ts
index 672f0451a..c882db713 100644
--- a/desktop/src/main/remote-server.ts
+++ b/desktop/src/main/remote-server.ts
@@ -1994,6 +1994,12 @@ export class RemoteServer {
         this.respond(client.ws, type, id, removed);
         break;
       }
+      // "Send now" — same sync boolean contract as queue-remove above.
+      case 'native:queue-send-now': {
+        const sent = this.nativeRuntime ? this.nativeRuntime.nativeHost.sendQueuedNow(payload.sessionId, payload.queueId) : false;
+        this.respond(client.ws, type, id, sent);
+        break;
+      }
       case 'native:sessions-list': {
         this.respond(client.ws, type, id, this.nativeRuntime ? await this.nativeRuntime.nativeHost.listAsync() : []);
         break;
diff --git a/desktop/src/renderer/App.tsx b/desktop/src/renderer/App.tsx
index 6a139871b..50799c2a6 100644
--- a/desktop/src/renderer/App.tsx
+++ b/desktop/src/renderer/App.tsx
@@ -851,6 +851,20 @@ function AppInner() {
     inputBarRef.current?.fillDraft(text);
   }, [dispatch]);
 
+  // "Send now": the row stays until the drain sends it (TRANSCRIPT_USER_MESSAGE
+  // removes it); false = already on its way, handled like Cancel's too-late.
+  const handleSendQueuedNow = useCallback(async (sid: string, queueId: string) => {
+    // WHY catch (PR #585 review): over remote access the request can fail (e.g. the
+    // connection drops) and a click that silently does nothing reads as broken.
+    // The cause is unknown here, so the words stay general and the row stays put.
+    const moved = await window.claude.native.queueSendNow(sid, queueId).catch(() => null);
+    if (moved === null) { setToast("Send now didn't go through — try again."); return; }
+    if (!moved) {
+      setToast('Already sending.');
+      dispatch({ type: 'QUEUED_MESSAGE_REMOVED', sessionId: sid, queueId });
+    }
+  }, [dispatch]);
+
   // Compaction watchdog: activity-aware — resets on any reducer update for a
   // session with compactionPending set. Any transcript event bumps the timer
   // forward, so long compactions (large sessions) don't trigger a false "may
@@ -3887,6 +3901,7 @@ function AppInner() {
                       onAddCredit={chatViewHandlers.addCredit}
                       onCancelQueued={handleCancelQueued}
                       onEditQueued={handleEditQueued}
+                      onSendQueuedNow={handleSendQueuedNow}
                       conversationStatus={conversationStatus}
                       onRefreshConversation={handleRefreshConversation}
                       modelLoadingDemo={s.id === sessionId && new URLSearchParams(location.search).get('mode') === 'workbench' && new URLSearchParams(location.search).get('modelLoading') === '1'}
diff --git a/desktop/src/renderer/components/ChatView.tsx b/desktop/src/renderer/components/ChatView.tsx
index 970280fb2..7d60075fa 100644
--- a/desktop/src/renderer/components/ChatView.tsx
+++ b/desktop/src/renderer/components/ChatView.tsx
@@ -89,6 +89,7 @@ interface Props {
   // session's ChatView instance.
   onCancelQueued?: (sessionId: string, queueId: string) => void;
   onEditQueued?: (sessionId: string, queueId: string, text: string) => void;
+  onSendQueuedNow?: (sessionId: string, queueId: string) => void;
   /** Remote access batch 2 (questions deck 2026-09-10, Q-3 "keep it, say so"):
    *  where a PHONE's copy of this conversation stands. `reconnecting` and
    *  `restoring` show a quiet busy strip; `incomplete` says the copy may be
@@ -102,7 +103,7 @@ interface Props {
 }
 
 // Memoised at the bottom of the file — see the WHY there.
-function ChatView({ sessionId, visible, sessionActive, cwd, gamePane, provider, onOpenProviderSettings, onSwitchProviders, onUpgradePlan, onAddCredit, onCancelQueued, onEditQueued, conversationStatus, onRefreshConversation, modelLoadingDemo }: Props) {
+function ChatView({ sessionId, visible, sessionActive, cwd, gamePane, provider, onOpenProviderSettings, onSwitchProviders, onUpgradePlan, onAddCredit, onCancelQueued, onEditQueued, onSendQueuedNow, conversationStatus, onRefreshConversation, modelLoadingDemo }: Props) {
   const state = useChatState(sessionId, { paused: !visible }); // WHY paused: hidden, it redrew per streamed word; live again on show (see useChatState)
   const dispatch = useChatDispatch();
 
@@ -1360,6 +1361,7 @@ function ChatView({ sessionId, visible, sessionActive, cwd, gamePane, provider,
             queuedMessages={state.queuedMessages}
             onCancel={onCancelQueued ? (queueId) => onCancelQueued(sessionId, queueId) : undefined}
             onEdit={onEditQueued ? (queueId, text) => onEditQueued(sessionId, queueId, text) : undefined}
+            onSendNow={onSendQueuedNow ? (queueId) => onSendQueuedNow(sessionId, queueId) : undefined}
           />
           {/* WHY mount the actual model floater in the chat column: when Files or
               Games opens, outer-root centering would span the drawer as well. */}
diff --git a/desktop/src/renderer/components/EditPencilButton.tsx b/desktop/src/renderer/components/EditPencilButton.tsx
new file mode 100644
index 000000000..259efb9ce
--- /dev/null
+++ b/desktop/src/renderer/components/EditPencilButton.tsx
@@ -0,0 +1,39 @@
+import React from 'react';
+import { isAndroid } from '../platform';
+import { Tooltip } from './ui';
+
+// Pencil SVG icon — matches the one used in StatusBar.tsx
+export function PencilIcon({ size = 10 }: { size?: number }) {
+  return (
+    <svg width={size} height={size} viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
+      <path d="M12.146.854a.5.5 0 0 1 .708 0l2.292 2.292a.5.5 0 0 1 0 .708l-9.5 9.5a.5.5 0 0 1-.168.11l-4 1.5a.5.5 0 0 1-.638-.638l1.5-4a.5.5 0 0 1 .11-.168l9.5-9.5zM11.207 2.5 13.5 4.793 14.793 3.5 12.5 1.207 11.207 2.5zm1.586 3L10.5 3.207 4 9.707V10h.5a.5.5 0 0 1 .5.5v.5h.5a.5.5 0 0 1 .5.5v.5h.293l6.5-6.5z"/>
+    </svg>
+  );
+}
+
+/** The small square pencil button the quick-chips row uses to open its editor.
+ *  WHY shared (Destin, 2026-09-28 Send now review: "re-use the edit element
+ *  used for the status bar, quick chips menu"): one component, so the waiting-
+ *  message strip's Edit and the quick chips' edit cannot drift apart.
+ *  `className` adds hooks only (QuickChips passes `quick-chip-edit`, which float
+ *  chrome uses to give it the chips' own surface); the look lives here. */
+export function EditPencilButton({ label, onClick, className = '', plain = false }: { label: string; onClick: () => void; className?: string; plain?: boolean }) {
+  const android = isAndroid();
+  // `plain` (Destin, 2026-09-28: "no background on the edit button" in the
+  // waiting-message strip): the same pencil and size with no box, so it sits
+  // like the plain trash icon beside it. The quick chips keep their box.
+  const surface = plain ? 'rounded-md text-fg-dim hover:text-fg' : 'rounded-md bg-well border border-edge-dim text-fg-muted hover:bg-inset hover:text-fg';
+  return (
+    <Tooltip text={label}>
+      <button
+        type="button"
+        aria-label={label}
+        onClick={onClick}
+        className={`${className} shrink-0 ${android ? 'w-8 h-8' : 'w-6 h-6'} ${surface} transition-colors flex items-center justify-center`}
+      >
+        {/* Plain: the trash icon's size beside it (14px), per Destin's "bigger". */}
+        <PencilIcon size={plain ? (android ? 16 : 14) : (android ? 12 : 10)} />
+      </button>
+    </Tooltip>
+  );
+}
diff --git a/desktop/src/renderer/components/InputBar.test.tsx b/desktop/src/renderer/components/InputBar.test.tsx
index 74b211230..031ed9574 100644
--- a/desktop/src/renderer/components/InputBar.test.tsx
+++ b/desktop/src/renderer/components/InputBar.test.tsx
@@ -3,9 +3,10 @@ import '@testing-library/jest-dom/vitest';
 import React from 'react';
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { render, screen, cleanup, fireEvent, waitFor, act } from '@testing-library/react';
-import { ChatProvider, useChatDispatch, useChatStore } from '../state/chat-context';
+import { ChatProvider, useChatDispatch, useChatStore, useChatState } from '../state/chat-context';
 import { SkillProvider } from '../state/skill-context';
 import InputBar, { InputBarHandle } from './InputBar';
+import QueuedMessagesStrip from './QueuedMessagesStrip';
 import { buildContextMenu } from './context-menu/build-menu';
 import type { VoiceEvent, VoiceReadiness } from '../../shared/voice-types';
 
@@ -472,6 +473,56 @@ describe('InputBar — stop button (Task 10 placement)', () => {
     expect(screen.queryByRole('button', { name: 'Stop generating' })).not.toBeInTheDocument();
   });
 
+  it('keeps Stop beside native busy queued input, with only Edit and Cancel on its queued row', () => {
+    const onEdit = vi.fn();
+    const onCancel = vi.fn();
+    function QueuedFromStore() {
+      const state = useChatState('sess-1');
+      return <QueuedMessagesStrip queuedMessages={state.queuedMessages} onEdit={onEdit} onCancel={onCancel} />;
+    }
+    render(
+      <ChatProvider>
+        <SkillProvider>
+          <DispatchCapture />
+          <InputBar sessionId="sess-1" provider="native" />
+          <QueuedFromStore />
+        </SkillProvider>
+      </ChatProvider>,
+    );
+    act(() => {
+      capturedDispatch!({ type: 'SESSION_INIT', sessionId: 'sess-1' });
+      capturedDispatch!({ type: 'USER_PROMPT', sessionId: 'sess-1', content: 'first action', timestamp: 1 });
+      capturedDispatch!({ type: 'QUEUED_MESSAGE_ADDED', sessionId: 'sess-1', queueId: 'q-1', content: 'follow up', timestamp: 2 });
+    });
+    const stop = screen.getByRole('button', { name: 'Stop generating' });
+    expect(stop).toBeEnabled();
+    expect(screen.getByRole('button', { name: 'Send message' })).toBeInTheDocument();
+    const strip = screen.getByLabelText('Queued messages');
+    const queuedActions = () => [...strip.querySelectorAll('button')].map(button => button.getAttribute('aria-label'));
+    // An exact DOM inventory detects any extra urgent-send control, regardless
+    // of its label. The separate forbidden-name check catches one elsewhere.
+    const expected = ['Edit queued message', 'Cancel queued message'];
+    expect(queuedActions()).toEqual(expected);
+    const injected = document.createElement('button');
+    injected.setAttribute('aria-label', 'Send now');
+    strip.append(injected);
+    expect(() => expect(queuedActions()).toEqual(expected)).toThrow();
+    injected.remove();
+    expect(screen.queryByRole('button', { name: /send now|after this finishes|stop and send|steer|urgent|priority/i })).not.toBeInTheDocument();
+    fireEvent.click(stop);
+    expect((window as any).claude.native.interrupt).toHaveBeenCalledWith('sess-1');
+    expect((window as any).claude.session.sendInput).not.toHaveBeenCalled();
+    fireEvent.click(screen.getByRole('button', { name: 'Edit queued message' }));
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel queued message' }));
+    expect(onEdit).toHaveBeenCalledWith('q-1', 'follow up');
+    expect(onCancel).toHaveBeenCalledWith('q-1');
+    act(() => {
+      capturedDispatch!({ type: 'PERMISSION_REQUEST', sessionId: 'sess-1', toolName: 'Bash', input: { command: 'build' }, requestId: 'req-1' });
+    });
+    expect(screen.getByRole('button', { name: 'Stop generating' })).toBeEnabled();
+    expect(queuedActions()).toEqual(expected);
+  });
+
   it('provider="native": click calls native.interrupt, never session.sendInput', () => {
     renderInputBar('native');
     act(() => { capturedDispatch!({ type: 'SESSION_INIT', sessionId: 'sess-1' }); });
diff --git a/desktop/src/renderer/components/MarkdownContent.test.tsx b/desktop/src/renderer/components/MarkdownContent.test.tsx
index 52b8d5425..ee1b1072b 100644
--- a/desktop/src/renderer/components/MarkdownContent.test.tsx
+++ b/desktop/src/renderer/components/MarkdownContent.test.tsx
@@ -555,6 +555,12 @@ describe('MarkdownContent while a reply streams in', () => {
     live.unmount();
   });
 
+  // WHY a named budget (measured 2026-09-28): these fixed-count streaming
+  // checks take 1.5–7 s alone, but in verify.sh's full run — every suite and the
+  // screenshot checks at once — two of them passed 30 s and timed out while
+  // correct. They count work, never clock time, so more time tests nothing less.
+  const STREAMING_SWEEP_BUDGET_MS = 120_000;
+
   // Review F4: seeded random replies, streamed word by word into a bubble that
   // sometimes mounts mid-reply, compared as DRAWN PAGES (not parse trees) with
   // the whole-message render after every word. Mixes in the constructs that act
@@ -605,7 +611,7 @@ describe('MarkdownContent while a reply streams in', () => {
       live.unmount();
       today.unmount();
     }
-  });
+  }, STREAMING_SWEEP_BUDGET_MS);
 
   // What each streamed update costs, in characters: everything the splitter
   // parsed plus everything handed to react-markdown. Today's whole-message
@@ -643,7 +649,7 @@ describe('MarkdownContent while a reply streams in', () => {
     expectNoMoreThanToday(costs);
     // A definition only re-draws the blocks that use its label.
     for (const c of costs) expect(c.drawn.length, `after ${JSON.stringify(c.md.slice(-40))}`).toBeLessThanOrEqual(2);
-  });
+  }, STREAMING_SWEEP_BUDGET_MS);
 
   // A reply that ends in one big block with no blank line in it: the splitter
   // must not parse that block again on top of drawing it.
@@ -922,5 +928,5 @@ describe('MarkdownContent while a reply streams in', () => {
       live.unmount();
       today.unmount();
     }
-  });
+  }, STREAMING_SWEEP_BUDGET_MS);
 });
diff --git a/desktop/src/renderer/components/QueuedMessagesStrip.tsx b/desktop/src/renderer/components/QueuedMessagesStrip.tsx
index d46167801..7a6ca4a09 100644
--- a/desktop/src/renderer/components/QueuedMessagesStrip.tsx
+++ b/desktop/src/renderer/components/QueuedMessagesStrip.tsx
@@ -1,5 +1,6 @@
 import React from 'react';
 import { Button } from './ui';
+import { EditPencilButton } from './EditPencilButton';
 
 // Task 12: renders messages the native host FIFO'd behind an in-flight turn
 // (SessionChatState.queuedMessages) docked at the bottom of the chat area —
@@ -23,6 +24,62 @@ import { Button } from './ui';
 // enqueue the message also never see it in their own strip — same
 // renderer-local scope.
 
+/** Same trash glyph as the doc-comments delete action (comments/CommentActions
+ *  .tsx on its branch, Destin 2026-09-28: "matching ... delete a comment") —
+ *  24×24 viewBox, stroke currentColor, the app's inline-icon convention. */
+function TrashGlyph() {
+  return (
+    <svg className="w-3.5 h-3.5" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth={2} strokeLinecap="round" strokeLinejoin="round" aria-hidden>
+      <path d="M3 6h18" />
+      <path d="M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2" />
+      <path d="M19 6l-1 14a2 2 0 0 1-2 2H8a2 2 0 0 1-2-2L5 6" />
+    </svg>
+  );
+}
+
+/** "Send now" (Destin, 2026-09-28 review decks): rightmost in the row, styled
+ *  like the message box's own send button — the same primary <Button> (theme
+ *  accent fill, the same arrow glyph) rather than a hand-styled look, so it
+ *  reads as "send" wherever the theme puts its accent. On hover or keyboard
+ *  focus the words "Interrupt and Send Now" roll out to the left of the
+ *  arrow inside the button; the trash beside it is the next item in the row,
+ *  so it slides left with a fixed gap.
+ *  WHY the reveal is on an inner span: the primitive owns the button's own
+ *  colours, size and effects (design lint `no-restyle`); only the label's
+ *  max-width animates, with the session pills' sanctioned motion tokens
+ *  (pill-label-style.ts, ast-grep `pill-label-reveals-with-motion-tokens`).
+ *  WHY one inner wrapper: the Button's own gap would otherwise leave a space
+ *  beside the arrow while the label is hidden.
+ *  Touch has no hover, so on a phone it stays the arrow alone; its meaning is
+ *  in the accessible name for screen readers. */
+function SendNowButton({ onClick }: { onClick: () => void }) {
+  return (
+    <Button variant="primary" size="sm" aria-label="Interrupt and send now" onClick={onClick} className="group">
+      <span className="flex items-center">
+        <span
+          aria-hidden
+          className="max-w-0 overflow-x-clip overflow-y-visible whitespace-nowrap opacity-0 group-hover:max-w-48 group-hover:opacity-100 group-hover:pr-1.5 group-focus-visible:max-w-48 group-focus-visible:opacity-100 group-focus-visible:pr-1.5"
+          // WHY textBox (Destin, round 3: "text looks too high"): a font's line
+          // box includes its own ascender/descender space, which is lopsided in
+          // some theme fonts (Meadow Mist's), so centring the LINE put the letters
+          // ~1px high. Trimming to cap height and baseline centres the letters
+          // themselves, in any theme font, without a per-font pixel nudge.
+          // overflow-x-clip (not overflow-hidden): the reveal only needs a
+          // sideways clip, and a vertical one would cut the trimmed descenders.
+          style={{ textBox: 'trim-both cap alphabetic', transition: 'max-width var(--dur-reveal) var(--ease-reveal), opacity var(--dur-reveal) var(--ease-reveal), padding var(--dur-reveal) var(--ease-reveal)' } as React.CSSProperties}
+        >
+          Interrupt and Send Now
+        </span>
+        {/* The message box's send arrow, turned to point UP (Destin, round 3:
+            "i want an up arrow") — same stroke and caps as InputBar's. */}
+        <svg className="w-3.5 h-3.5 shrink-0" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2} aria-hidden>
+          <path strokeLinecap="round" strokeLinejoin="round" d="M12 19V5M5 12l7-7 7 7" />
+        </svg>
+      </span>
+    </Button>
+  );
+}
+
 interface QueuedMessage {
   queueId: string;
   content: string;
@@ -39,6 +96,8 @@ interface Props {
   // sessionId + queueId through, no IPC/dispatch happens here).
   onCancel?: (queueId: string) => void;
   onEdit?: (queueId: string, text: string) => void;
+  // "Send now" — App stops the current task and sends this message next.
+  onSendNow?: (queueId: string) => void;
 }
 
 // forwardRef (review fix, post-approval): ChatView needs the strip's OWN
@@ -51,7 +110,7 @@ interface Props {
 // itself to the absolutely-positioned child's content, so measuring a
 // wrapper instead of this element would always read 0.
 const QueuedMessagesStrip = React.forwardRef<HTMLDivElement, Props>(function QueuedMessagesStrip(
-  { queuedMessages, onCancel, onEdit },
+  { queuedMessages, onCancel, onEdit, onSendNow },
   ref,
 ) {
   if (queuedMessages.length === 0) return null;
@@ -71,19 +130,10 @@ const QueuedMessagesStrip = React.forwardRef<HTMLDivElement, Props>(function Que
             Queued
           </div>
           <div className="flex-1 min-w-0 truncate text-sm text-fg-2">{q.content}</div>
-          {(onEdit || onCancel) && (
+          {(onEdit || onCancel || onSendNow) && (
             <div className="flex items-center gap-0.5 shrink-0">
-              {onEdit && (
-                <Button
-                  variant="ghost"
-                  size="icon"
-                  aria-label="Edit queued message"
-                  onClick={() => onEdit(q.queueId, q.content)}
-                  className="w-6 h-6 rounded-full text-fg-dim hover:text-fg text-xs leading-none"
-                >
-                  ✎
-                </Button>
-              )}
+              {/* The quick chips' own edit button (Destin, 2026-09-28). */}
+              {onEdit && <EditPencilButton plain label="Edit queued message" onClick={() => onEdit(q.queueId, q.content)} />}
               {onCancel && (
                 <Button
                   variant="ghost"
@@ -92,9 +142,10 @@ const QueuedMessagesStrip = React.forwardRef<HTMLDivElement, Props>(function Que
                   onClick={() => onCancel(q.queueId)}
                   className="w-6 h-6 rounded-full text-fg-dim hover:text-fg text-xs leading-none"
                 >
-                  ✕
+                  <TrashGlyph />
                 </Button>
               )}
+              {onSendNow && <SendNowButton onClick={() => onSendNow(q.queueId)} />}
             </div>
           )}
         </div>
diff --git a/desktop/src/renderer/components/QuickChips.tsx b/desktop/src/renderer/components/QuickChips.tsx
index cf04c7d16..4a745b18a 100644
--- a/desktop/src/renderer/components/QuickChips.tsx
+++ b/desktop/src/renderer/components/QuickChips.tsx
@@ -7,15 +7,7 @@ import { Button, Dialog, TextInput, Textarea, Tooltip } from './ui';
 import { useScrollFade } from '../hooks/useScrollFade';
 import { useEscClose } from '../hooks/use-esc-close';
 import { useScreenOpen } from '../shoot-mode';
-
-// Pencil SVG icon — matches the one used in StatusBar.tsx
-function PencilIcon({ size = 10 }: { size?: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
-      <path d="M12.146.854a.5.5 0 0 1 .708 0l2.292 2.292a.5.5 0 0 1 0 .708l-9.5 9.5a.5.5 0 0 1-.168.11l-4 1.5a.5.5 0 0 1-.638-.638l1.5-4a.5.5 0 0 1 .11-.168l9.5-9.5zM11.207 2.5 13.5 4.793 14.793 3.5 12.5 1.207 11.207 2.5zm1.586 3L10.5 3.207 4 9.707V10h.5a.5.5 0 0 1 .5.5v.5h.5a.5.5 0 0 1 .5.5v.5h.293l6.5-6.5z"/>
-    </svg>
-  );
-}
+import { EditPencilButton, PencilIcon } from './EditPencilButton';
 
 // Drag grip (6-dot braille) — mirrors SessionStrip's DragGrip
 function DragGrip() {
@@ -64,7 +56,6 @@ export default function QuickChips({ onChipTap }: Props) {
 
   const android = isAndroid();
   const chipHeight = android ? 'h-8' : 'h-6';
-  const pencilSize = android ? 'w-8 h-8' : 'w-6 h-6';
 
   return (
     // select-none: quick chips are chrome, not highlightable or copyable
@@ -84,17 +75,10 @@ export default function QuickChips({ onChipTap }: Props) {
           </button>
         ))}
 
-        {/* Pencil button — opens chip editor */}
-        <Tooltip text="Edit quick chips">
-        <button
-          onClick={() => setEditorOpen(!editorOpen)}
-          // `quick-chip-edit`: float chrome gives it the chips' own surface, as
-          // the status bar's edit button shares its chips' surface.
-          className={`quick-chip-edit shrink-0 ${pencilSize} rounded-md bg-well border border-edge-dim text-fg-muted hover:bg-inset hover:text-fg transition-colors flex items-center justify-center`}
-        >
-          <PencilIcon size={android ? 12 : 10} />
-        </button>
-        </Tooltip>
+        {/* Pencil button — opens chip editor. `quick-chip-edit`: float chrome
+            gives it the chips' own surface, as the status bar's edit button
+            shares its chips' surface. */}
+        <EditPencilButton label="Edit quick chips" onClick={() => setEditorOpen(!editorOpen)} className="quick-chip-edit" />
       </div>
 
       {/* Chip editor popup — centered L2 modal (Scrim + OverlayPanel) to match
diff --git a/desktop/src/renderer/components/SessionContextPopup.tsx b/desktop/src/renderer/components/SessionContextPopup.tsx
index 8ce3c5556..82e40c17f 100644
--- a/desktop/src/renderer/components/SessionContextPopup.tsx
+++ b/desktop/src/renderer/components/SessionContextPopup.tsx
@@ -67,7 +67,21 @@ function windowLabel(tokens?: number | null): string {
   return tokens >= 1000 ? `${Math.round(tokens / 1000)}k` : String(tokens);
 }
 
-const basename = (p: string) => p.split('/').slice(-1)[0];
+// Both separators: a native chat on Windows reports `C:\\Users\\…` paths.
+const basename = (p: string) => p.split(/[\\/]/).slice(-1)[0];
+/** WHY a folder name, not the full path: ancestor instruction files have long
+ *  absolute paths that overflow the card on a phone. The nearest file is "This
+ *  project"; each broader one is named by the folder it lives in. */
+function instructionLabel(filePath: string, isNearest: boolean): string {
+  if (isNearest) return 'This project';
+  const folder = filePath.split(/[\\/]/).slice(-2, -1)[0];
+  return folder && !/^[A-Za-z]:$/.test(folder) ? `From the “${folder}” folder` : 'From the top-level folder';
+}
+/** "Shortened · CLAUDE.md" for one file; "2 files shortened · AGENTS.md, CLAUDE.md" for more. */
+function shortenedSummary(files: ReadonlyArray<{ path: string; truncated: boolean }>): string {
+  const cut = files.filter(f => f.truncated).map(f => basename(f.path));
+  return cut.length === 1 ? `Shortened · ${cut[0]}` : `${cut.length} files shortened · ${cut.join(', ')}`;
+}
 const countLines = (s: string) => s.split('\n').filter((l) => l.trim() !== '').length;
 /** "1 lines" is the kind of small wrongness that makes a panel look unfinished. */
 const linesLabel = (n: number) => `${n} line${n === 1 ? '' : 's'}`;
@@ -215,16 +229,17 @@ function FileText({ sessionId, kind, id, what }: { sessionId?: string; kind: 'pr
  *  Claude Code chat it means only that WE did not cut it — Claude Code manages
  *  its own window and we cannot see what it did. Saying "read in full" there
  *  would be a claim about someone else's work. */
-function RulesCard({ file, kind, label, sessionId, openFile, assembledByClaudeCode }: {
-  file: { path: string; truncated: boolean };
+function RulesCard({ file, kind, label, sessionId, openFile, assembledByClaudeCode, id }: {
+  file: { path: string; truncated: boolean; note?: string | null; notUsed?: string | null };
   kind: 'project' | 'user';
+  id?: string;
   label: string;
   sessionId?: string;
   openFile: (p: string) => void | Promise<void>;
   assembledByClaudeCode: boolean;
 }) {
   const description = file.truncated
-    ? 'Shortened to headings only'
+    ? (file.note ?? 'Shortened to fit')
     : assembledByClaudeCode
       ? 'YouCoded didn’t shorten it'
       : 'Read in full';
@@ -236,12 +251,13 @@ function RulesCard({ file, kind, label, sessionId, openFile, assembledByClaudeCo
           className="rounded-none bg-transparent"
           icon={<Dot ok={!file.truncated} />}
           title={basename(file.path)}
-          description={`${label} · ${description}`}
+          // Only one file per folder is used; name the one that was not.
+          description={`${label} · ${description}${file.notUsed ? ` · ${file.notUsed} here not used` : ''}`}
           accessory={<Button variant="secondary" size="sm" onClick={() => { void openFile(file.path); }}>Open</Button>}
         />
       )}
     >
-      <FileText sessionId={sessionId} kind={kind} what={label} />
+      <FileText sessionId={sessionId} kind={kind} id={id} what={label} />
     </DetailCard>
   );
 }
@@ -352,7 +368,10 @@ function SessionContextPanel({ open, onClose, context, sessionId }: Props & { co
   const [tab, setTab] = useState('overview');
   const openFile = useOpenFilepath(sessionId);
 
-  const rules = context.projectInstructions ?? null;
+  // WHY: older native/Claude Code records still have one file; captured native
+  // sessions list the actual broad-to-narrow chain without a second selection.
+  const projectFiles = context.projectInstructionFiles ?? (context.projectInstructions ? [context.projectInstructions] : []);
+  const rules = projectFiles[projectFiles.length - 1] ?? null;
   const skills = context.skills ?? [];
   const tools = context.tools ?? [];
   const dropped = context.droppedMcpServers ?? [];
@@ -435,12 +454,12 @@ function SessionContextPanel({ open, onClose, context, sessionId }: Props & { co
               <section>
                 <h3 className={EYEBROW}>What was left out</h3>
                 <div className="space-y-1.5">
-                  {rules?.truncated && (
+                  {projectFiles.some(f => f.truncated) && (
                     <SettingRow
                       variant="item"
                       icon={<Dot ok={false} />}
                       title="This project’s rules"
-                      description={`Shortened to headings only · ${basename(rules.path)}`}
+                      description={shortenedSummary(projectFiles)}
                       onClick={() => setTab('project')}
                     />
                   )}
@@ -480,7 +499,7 @@ function SessionContextPanel({ open, onClose, context, sessionId }: Props & { co
                 <SettingRow
                   variant="item"
                   title="Given"
-                  value={[rules ? '1 rules file' : null, skillsWord, tools.length > 0 ? toolsWord : null].filter(Boolean).join(' · ')}
+                  value={[projectFiles.length ? `${projectFiles.length} rules file${projectFiles.length === 1 ? '' : 's'}` : null, skillsWord, tools.length > 0 ? toolsWord : null].filter(Boolean).join(' · ')}
                 />
               </div>
             </section>
@@ -534,16 +553,18 @@ function SessionContextPanel({ open, onClose, context, sessionId }: Props & { co
               <p className="text-2xs text-fg-muted">There is no rules file for this project, and none of your own.</p>
             ) : (
               <div className="space-y-2">
-                {rules && (
+                {projectFiles.map((file, i) => (
                   <RulesCard
-                    file={rules}
+                    key={file.path}
+                    file={file}
                     kind="project"
-                    label="This project"
+                    id={context.projectInstructionFiles ? file.path : undefined}
+                    label={instructionLabel(file.path, i === projectFiles.length - 1)}
                     sessionId={sessionId}
                     openFile={openFile}
                     assembledByClaudeCode={cc}
                   />
-                )}
+                ))}
                 {/* Your own rules, the ones that apply everywhere. Claude Code
                     reads this file; the native harness does not, so this card
                     appears on a Claude Code chat and not on a native one — the
diff --git a/desktop/src/renderer/components/ToolCard.tsx b/desktop/src/renderer/components/ToolCard.tsx
index 7a9e8fc78..c59746d1e 100644
--- a/desktop/src/renderer/components/ToolCard.tsx
+++ b/desktop/src/renderer/components/ToolCard.tsx
@@ -17,6 +17,7 @@ import { useExpandAllToggle, getInitialExpanded } from '../hooks/useExpandAllTog
 import { isTypingTarget } from '../utils/is-typing-target';
 import { useCardKeysLive } from '../state/card-keys-context';
 import { asString } from '../utils/tool-input';
+import { normalizeQuestions, isValidQuestions } from './ask-question-normalize';
 // Full-auto safety stop (spec 2026-08-12, M5 2b): per-family copy + the
 // status-bar chip colors, so the footer band can never drift from the chip.
 import { FullAutoStops, BROAD_ALLOW_COLORS } from './permissions/FullAutoStops';
@@ -930,45 +931,6 @@ export function PermissionButtons({ requestId, suggestions, denyListed, command,
 // Unlike regular tools (allow/deny), we must collect the user's selections
 // and return them via updatedInput.answers so Claude gets the actual answer.
 
-interface AskQuestion {
-  question: string;
-  header: string;
-  options: Array<{ label: string; description?: string }>;
-  multiSelect: boolean;
-}
-
-// Fix: isValidQuestions only checked questions[0].question, so an object-valued
-// header/label/description DEEPER in the array still reached React children in
-// the expanded card ("Objects are not valid as a React child" crashes the whole
-// Chat pane via its ErrorBoundary). Normalize the whole array up front with the
-// same asString idiom as friendlyToolDisplay: coerce every rendered field, and
-// drop members that can't render or be answered (no question text, no labeled
-// options) so one malformed member degrades gracefully instead of crashing or
-// invalidating the rest of the card.
-function normalizeQuestions(input: Record<string, unknown>): AskQuestion[] {
-  const raw = input.questions;
-  if (!Array.isArray(raw)) return [];
-  const out: AskQuestion[] = [];
-  for (const q of raw as Array<Record<string, unknown> | null | undefined>) {
-    const question = asString(q?.question);
-    if (!question) continue; // no question text — nothing to render or key answers by
-    const rawOptions = Array.isArray(q?.options) ? (q.options as Array<Record<string, unknown> | null | undefined>) : [];
-    const options: AskQuestion['options'] = [];
-    for (const o of rawOptions) {
-      const label = asString(o?.label);
-      if (!label) continue; // an unlabeled option can't be selected or echoed back
-      options.push({ label, description: asString(o?.description) || undefined });
-    }
-    if (options.length === 0) continue; // nothing selectable
-    out.push({ question, header: asString(q?.header), multiSelect: q?.multiSelect === true, options });
-  }
-  return out;
-}
-
-function isValidQuestions(input: Record<string, unknown>): boolean {
-  return normalizeQuestions(input).length > 0;
-}
-
 // Ledger G-2 (2026-08-26 harness comparison): every other harness lets the user
 // type their own answer; ours only offered the listed choices, and Dismiss ended
 // the turn. The card now adds an "Other" row per question plus one text box
@@ -998,11 +960,12 @@ function AskUserQuestionCard({ tool, requestId, onResponded, onFailed }: {
   // see normalizeQuestions above. Memoized so the array identity is stable for
   // the hook deps below.
   const questions = useMemo(() => normalizeQuestions(tool.input), [tool.input]);
-  // answers: map from question text → selected label(s)
+  const isNative = requestId.startsWith('native-');
+  // WHY: native asks have independent request-local positions; Claude Code's
+  // legacy answer map and card state were keyed by question wording. Q22 keeps
+  // that CC behavior, including duplicates, without inventing CC transport IDs.
+  const keyFor = (question: string, index: number) => isNative ? String(index) : question;
   const [answers, setAnswers] = useState<Record<string, Set<string>>>({});
-  // text: question text → what the user typed in that question's box. One
-  // state serves both roles (Other's answer, or a note on a listed choice);
-  // which role it plays is decided at submit from the selection.
   const [text, setText] = useState<Record<string, string>>({});
   const textRefs = useRef<Record<string, HTMLTextAreaElement | null>>({});
   const [responding, setResponding] = useState(false);
@@ -1012,18 +975,18 @@ function AskUserQuestionCard({ tool, requestId, onResponded, onFailed }: {
   // Track which question is "active" for keyboard nav, and which option is focused
   const [focusedOption, setFocusedOption] = useState(0);
 
-  const allAnswered = questions.every(q => {
-    const sel = answers[q.question];
+  const allAnswered = questions.every((q, qi) => {
+    const sel = answers[keyFor(q.question, qi)];
     if (!sel || sel.size === 0) return false;
     // "Other" with nothing typed is not an answer yet — Submit stays off until
     // the user explains, so the model never receives an empty "own answer".
-    if (sel.has(OTHER) && !(text[q.question] ?? '').trim()) return false;
+    if (sel.has(OTHER) && !(text[keyFor(q.question, qi)] ?? '').trim()) return false;
     return true;
   });
 
-  const handleSelect = useCallback((question: string, label: string, multiSelect: boolean) => {
+  const handleSelect = useCallback((key: string, label: string, multiSelect: boolean) => {
     setAnswers(prev => {
-      const current = prev[question] || new Set<string>();
+      const current = prev[key] || new Set<string>();
       const next = new Set(current);
       if (multiSelect) {
         // Toggle for multi-select
@@ -1034,12 +997,12 @@ function AskUserQuestionCard({ tool, requestId, onResponded, onFailed }: {
         next.clear();
         next.add(label);
       }
-      return { ...prev, [question]: next };
+      return { ...prev, [key]: next };
     });
     // Picking Other is an invitation to type — put the cursor in the box so the
     // user doesn't have to click twice. (Deselecting Other leaves focus alone.)
     if (label === OTHER) {
-      requestAnimationFrame(() => textRefs.current[question]?.focus());
+      requestAnimationFrame(() => textRefs.current[key]?.focus());
     }
   }, []);
 
@@ -1058,12 +1021,15 @@ function AskUserQuestionCard({ tool, requestId, onResponded, onFailed }: {
     // `annotations[question].notes` — send that shape too so a CC session
     // receives the note through the same contract its CLI uses.
     const annotationsObj: Record<string, { notes: string }> = {};
-    for (const q of questions) {
-      const sel = answers[q.question] ?? new Set<string>();
-      const typed = (text[q.question] ?? '').trim();
+    const orderedAnswers: Array<{ answer: string; note?: string }> = [];
+    for (const [qi, q] of questions.entries()) {
+      const key = keyFor(q.question, qi);
+      const sel = answers[key] ?? new Set<string>();
+      const typed = (text[key] ?? '').trim();
       const labels = Array.from(sel).filter((l) => l !== OTHER);
       if (sel.has(OTHER) && typed) labels.push(typed);
       answersObj[q.question] = labels.join(', ');
+      orderedAnswers.push({ answer: labels.join(', '), ...(!sel.has(OTHER) && typed ? { note: typed } : {}) });
       if (!sel.has(OTHER) && typed) {
         notesObj[q.question] = typed;
         annotationsObj[q.question] = { notes: typed };
@@ -1078,6 +1044,9 @@ function AskUserQuestionCard({ tool, requestId, onResponded, onFailed }: {
             questions,       // Echo back the (normalized) questions array
             answers: answersObj,
             ...(hasNotes ? { notes: notesObj, annotations: annotationsObj } : {}),
+            // Native broker alone understands this field. Never add it to CC's
+            // documented question-text-keyed response envelope.
+            ...(isNative ? { orderedAnswers } : {}),
           },
         },
       });
@@ -1095,7 +1064,7 @@ function AskUserQuestionCard({ tool, requestId, onResponded, onFailed }: {
       // The card stays answerable and says the answer could not be confirmed.
       setUnconfirmed(true);
     }
-  }, [allAnswered, responding, questions, answers, text, requestId, onResponded, onFailed]);
+  }, [allAnswered, responding, questions, answers, text, requestId, isNative, onResponded, onFailed]);
 
   const handleDeny = useCallback(async () => {
     setResponding(true);
@@ -1120,9 +1089,9 @@ function AskUserQuestionCard({ tool, requestId, onResponded, onFailed }: {
   // Total flat list of all options across questions (for keyboard nav). The
   // synthetic Other row is a real stop in the list, after each question's own
   // options, so arrow keys reach it like any other choice.
-  const allOptions = questions.flatMap(q => [
-    ...q.options.map(o => ({ q, o })),
-    { q, o: { label: OTHER, description: OTHER_DESCRIPTION } },
+  const allOptions = questions.flatMap((q, qi) => [
+    ...q.options.map(o => ({ q, qi, o })),
+    { q, qi, o: { label: OTHER, description: OTHER_DESCRIPTION } },
   ]);
   const optionCount = allOptions.length;
 
@@ -1145,8 +1114,8 @@ function AskUserQuestionCard({ tool, requestId, onResponded, onFailed }: {
         e.preventDefault();
         // Select the focused option
         if (optionCount > 0) {
-          const { q, o } = allOptions[focusedOption];
-          handleSelect(q.question, o.label, q.multiSelect);
+          const { q, qi, o } = allOptions[focusedOption];
+          handleSelect(keyFor(q.question, qi), o.label, q.multiSelect);
         }
       } else if (e.key === 'Enter' && (e.ctrlKey || e.metaKey)) {
         // Ctrl/Cmd+Enter to submit
@@ -1172,7 +1141,7 @@ function AskUserQuestionCard({ tool, requestId, onResponded, onFailed }: {
           <div className="space-y-1">
             {[...q.options, { label: OTHER, description: OTHER_DESCRIPTION }].map((opt, oi) => {
               const idx = flatIdx++;
-              const selected = answers[q.question]?.has(opt.label) ?? false;
+              const selected = answers[keyFor(q.question, qi)]?.has(opt.label) ?? false;
               const focused = idx === focusedOption;
               const isOther = opt.label === OTHER;
               return (
@@ -1180,7 +1149,7 @@ function AskUserQuestionCard({ tool, requestId, onResponded, onFailed }: {
                   key={oi}
                   aria-label={isOther ? `${OTHER_LABEL} — ${OTHER_DESCRIPTION}` : undefined}
                   disabled={responding}
-                  onClick={() => handleSelect(q.question, opt.label, q.multiSelect)}
+                  onClick={() => handleSelect(keyFor(q.question, qi), opt.label, q.multiSelect)}
                   // P-18: one row shape for both states — a visible dim border
                   // when unselected, the accent border when selected — so rows
                   // don't jump between "flat" and "outlined" as the user picks.
@@ -1212,16 +1181,16 @@ function AskUserQuestionCard({ tool, requestId, onResponded, onFailed }: {
                 inside the box, matching the card-wide shortcut — the window
                 handler skips typing targets, so the box handles it itself. */}
             <Textarea
-              ref={(el) => { textRefs.current[q.question] = el; }}
+              ref={(el) => { textRefs.current[keyFor(q.question, qi)] = el; }}
               size="sm"
               rows={1}
               disabled={responding}
-              value={text[q.question] ?? ''}
-              placeholder={textPlaceholder(answers[q.question])}
-              aria-label={textPlaceholder(answers[q.question])}
+              value={text[keyFor(q.question, qi)] ?? ''}
+              placeholder={textPlaceholder(answers[keyFor(q.question, qi)])}
+              aria-label={textPlaceholder(answers[keyFor(q.question, qi)])}
               onChange={(e) => {
                 const value = e.target.value;
-                setText(prev => ({ ...prev, [q.question]: value }));
+                setText(prev => ({ ...prev, [keyFor(q.question, qi)]: value }));
                 // Grow with the text instead of scrolling inside a one-line box.
                 e.target.style.height = 'auto';
                 e.target.style.height = `${e.target.scrollHeight}px`;
@@ -1495,6 +1464,7 @@ export default React.memo(function ToolCard({ tool, sessionId, inGroup = false }
         };
         return isAskUser ? (
           <AskUserQuestionCard
+            key={tool.requestId} // WHY: indexes belong to this pending request, never the next one.
             tool={tool}
             requestId={tool.requestId}
             onResponded={onRespondedCb}
diff --git a/desktop/src/renderer/components/ask-question-normalize.ts b/desktop/src/renderer/components/ask-question-normalize.ts
new file mode 100644
index 000000000..b7ae2e312
--- /dev/null
+++ b/desktop/src/renderer/components/ask-question-normalize.ts
@@ -0,0 +1,34 @@
+import { asString } from '../utils/tool-input';
+
+export interface AskQuestion {
+  question: string;
+  header: string;
+  options: Array<{ label: string; description?: string }>;
+  multiSelect: boolean;
+}
+
+// WHY: normalize every rendered field before passing untrusted provider input
+// to React. A malformed later option must not crash the whole chat pane.
+export function normalizeQuestions(input: Record<string, unknown>): AskQuestion[] {
+  const raw = input.questions;
+  if (!Array.isArray(raw)) return [];
+  const out: AskQuestion[] = [];
+  for (const q of raw as Array<Record<string, unknown> | null | undefined>) {
+    const question = asString(q?.question);
+    if (!question) continue;
+    const rawOptions = Array.isArray(q?.options) ? (q.options as Array<Record<string, unknown> | null | undefined>) : [];
+    const options: AskQuestion['options'] = [];
+    for (const o of rawOptions) {
+      const label = asString(o?.label);
+      if (!label) continue;
+      options.push({ label, description: asString(o?.description) || undefined });
+    }
+    if (options.length === 0) continue;
+    out.push({ question, header: asString(q?.header), multiSelect: q?.multiSelect === true, options });
+  }
+  return out;
+}
+
+export function isValidQuestions(input: Record<string, unknown>): boolean {
+  return normalizeQuestions(input).length > 0;
+}
diff --git a/desktop/src/renderer/components/session-context-facts.ts b/desktop/src/renderer/components/session-context-facts.ts
index 73cfb7528..bea79851c 100644
--- a/desktop/src/renderer/components/session-context-facts.ts
+++ b/desktop/src/renderer/components/session-context-facts.ts
@@ -23,6 +23,7 @@ import type { SessionContext, SessionContextText } from '../state/chat-types';
 export function wasTrimmed(ctx: SessionContext): boolean {
   return !!(
     ctx.projectInstructions?.truncated
+    || ctx.projectInstructionFiles?.some(f => f.truncated)
     || ctx.skillsOffered === false
     || (ctx.droppedMcpServers && ctx.droppedMcpServers.length > 0)
   );
diff --git a/desktop/src/renderer/dev/workbench/fixture-loader.test.ts b/desktop/src/renderer/dev/workbench/fixture-loader.test.ts
index 001ee81d9..606e09ebf 100644
--- a/desktop/src/renderer/dev/workbench/fixture-loader.test.ts
+++ b/desktop/src/renderer/dev/workbench/fixture-loader.test.ts
@@ -2,6 +2,16 @@ import { describe, it, expect } from 'vitest';
 import { loadFixture } from './fixture-loader';
 
 describe('loadFixture', () => {
+  it('keeps ancestor panel data opt-in and confined to native practice sessions', () => {
+    const raw = JSON.stringify({ type: 'session_context', context: { projectInstructions: { path: '/old', truncated: false } } });
+    const original = loadFixture('native', raw).actions.find(a => a.type === 'SESSION_CONTEXT');
+    const chain = loadFixture('native', raw, 'sandbox', { includeContextChain: true }).actions.find(a => a.type === 'SESSION_CONTEXT');
+    const other = loadFixture('claude-code', raw, 'sandbox', { includeContextChain: true }).actions.find(a => a.type === 'SESSION_CONTEXT');
+    expect(original).toMatchObject({ context: { projectInstructions: { path: '/old' } } });
+    expect(original?.type === 'SESSION_CONTEXT' && original.context?.projectInstructionFiles).toBeUndefined();
+    expect(chain?.type === 'SESSION_CONTEXT' && chain.context?.projectInstructionFiles?.map(f => f.path)).toEqual(['/workspace/AGENTS.md', '/workspace/repo/CLAUDE.md']);
+    expect(other?.type === 'SESSION_CONTEXT' && other.context?.projectInstructionFiles).toBeUndefined();
+  });
   it('parses a Skill tool_use + tool_result pair into a single tool block', () => {
     const raw = [
       '{"type":"tool_use","id":"toolu_01ABC","name":"Skill","input":{"skill":"superpowers:brainstorming"}}',
diff --git a/desktop/src/renderer/dev/workbench/fixture-loader.ts b/desktop/src/renderer/dev/workbench/fixture-loader.ts
index 24b13a1ea..a5bb3a2b7 100644
--- a/desktop/src/renderer/dev/workbench/fixture-loader.ts
+++ b/desktop/src/renderer/dev/workbench/fixture-loader.ts
@@ -70,6 +70,8 @@ export interface LoadOptions {
    *  "case": <name>}` line whose case matches — the OpenRouter failure cards
    *  (connection-trust review, 2026-09-18). `?providerError=<case>`. */
   providerError?: string | null;
+  /** Photo-only practice state: the same native session with captured ancestors. */
+  includeContextChain?: boolean;
 }
 
 // Fixed base timestamp, not Date.now(): fixtures must replay identically on
@@ -241,7 +243,12 @@ export function loadFixture(
         const action: ChatAction = {
           type: 'SESSION_CONTEXT',
           sessionId,
-          context: parsed.context ?? null,
+          context: opts.includeContextChain && name === 'native' && parsed.context
+            ? { ...parsed.context, projectInstructionFiles: [
+                { path: '/workspace/AGENTS.md', truncated: true, note: 'Outlined to fit' },
+                { path: '/workspace/repo/CLAUDE.md', truncated: false },
+              ] }
+            : parsed.context ?? null,
         };
         state = chatReducer(state, action);
         actions.push(action);
diff --git a/desktop/src/renderer/dev/workbench/fixtures/bubbles/questions-cc.jsonl b/desktop/src/renderer/dev/workbench/fixtures/bubbles/questions-cc.jsonl
new file mode 100644
index 000000000..32ca055ac
--- /dev/null
+++ b/desktop/src/renderer/dev/workbench/fixtures/bubbles/questions-cc.jsonl
@@ -0,0 +1,4 @@
+{"type":"user_message","text":"Help me make two choices for the room."}
+{"type":"assistant_text","text":"Which look should I use?"}
+{"type":"tool_use","id":"d4-cc-ask","name":"AskUserQuestion","input":{"questions":[{"question":"What color for the walls?","header":"Walls","multiSelect":false,"options":[{"label":"Blue","description":"Calm and bright"},{"label":"Red","description":"Warm and bold"}]},{"question":"What color for the trim?","header":"Trim","multiSelect":false,"options":[{"label":"Green","description":"Natural contrast"},{"label":"Yellow","description":"Sunny accent"}]}]}}
+{"type":"permission_request","tool_use_id":"d4-cc-ask","requestId":"cc-d4-visual"}
diff --git a/desktop/src/renderer/dev/workbench/fixtures/bubbles/questions-native.jsonl b/desktop/src/renderer/dev/workbench/fixtures/bubbles/questions-native.jsonl
new file mode 100644
index 000000000..49430a275
--- /dev/null
+++ b/desktop/src/renderer/dev/workbench/fixtures/bubbles/questions-native.jsonl
@@ -0,0 +1,4 @@
+{"type":"user_message","text":"Help me choose colors for my room."}
+{"type":"assistant_text","text":"I have two quick choices for you."}
+{"type":"tool_use","id":"d4-native-ask","name":"AskUserQuestion","input":{"questions":[{"question":"Which color?","header":"Walls","multiSelect":false,"options":[{"label":"Blue","description":"Calm and bright"},{"label":"Red","description":"Warm and bold"}]},{"question":"Which color?","header":"Trim","multiSelect":false,"options":[{"label":"Green","description":"Natural contrast"},{"label":"Yellow","description":"Sunny accent"}]}]}}
+{"type":"permission_request","tool_use_id":"d4-native-ask","requestId":"native-d4-visual"}
diff --git a/desktop/src/renderer/dev/workbench/mock-shim.ts b/desktop/src/renderer/dev/workbench/mock-shim.ts
index 3133d2cb8..8993fa34c 100644
--- a/desktop/src/renderer/dev/workbench/mock-shim.ts
+++ b/desktop/src/renderer/dev/workbench/mock-shim.ts
@@ -835,6 +835,12 @@ function handWritten(store: MockStore): Record<string, Record<string, unknown>>
     ? 'default'
     : new URLSearchParams(location.search).get('scenario') ?? 'default';
 
+  // WHY: conversation JSONL is replayed as reducer state, not a live scripted
+  // turn (reply-script.pending). This single native review ask needs a mock
+  // response so a successful Submit is not falsely reported as expired.
+  let visualNativeAskOpen = typeof location !== 'undefined'
+    && new URLSearchParams(location.search).get('seed') === 'bubbles-questions-native';
+
   // `?arcade=<state>` overrides the mapping. WHY it needs its own switch: the
   // app's `empty` scenario has NO SESSIONS, so the header — and with it the
   // games button — never renders, making the brand-new-arcade state
@@ -1068,7 +1074,32 @@ function handWritten(store: MockStore): Record<string, Record<string, unknown>>
     sendInput: (sessionId: string, text: string) => startReply(sessionId, text, true),
     // Real signature is Promise<boolean> (useIpc.ts/preload.ts), not {ok} —
     // resolvePermission already returns a boolean (false = stale/unknown id).
-    respondToPermission: async (requestId: string, _decision: object) => resolvePermission(requestId),
+    respondToPermission: async (requestId: string, decision: any) => {
+      if (requestId !== 'native-d4-visual' || !visualNativeAskOpen) return resolvePermission(requestId);
+      const behavior = decision?.decision?.behavior;
+      const ordered = decision?.decision?.updatedInput?.orderedAnswers;
+      // Never claim delivery for malformed/non-answer submissions. This is a
+      // dev fixture only; the production broker still validates real request IDs.
+      if (behavior !== 'deny' && (behavior !== 'allow' || !Array.isArray(ordered)
+          || ordered.length !== 2 || ordered.some((item: any) => !item || typeof item.answer !== 'string'
+            || (item.note !== undefined && typeof item.note !== 'string')))) return false;
+      visualNativeAskOpen = false;
+      const dismissed = behavior === 'deny';
+      const lines = dismissed ? [] : ordered.map((item: { answer: string; note?: string }) =>
+        `Q: Which color?\nA: ${item.answer}${item.note ? `\nNote from the user: ${item.note}` : ''}`);
+      subs.transcript.forEach(f => f({ type: 'tool-result', sessionId: 'wb-2',
+        uuid: 'wb-d4-native-result', timestamp: Date.now(),
+        data: { toolUseId: 'd4-native-ask',
+          toolResult: dismissed
+            ? 'The user closed this question without answering and took over. Stop here and wait for their next message.'
+            : `The user answered:\n\n${lines.join('\n\n')}`, isError: dismissed } }));
+      // This canned answer has no model continuation; settle its fixture turn
+      // rather than leaving a never-ending Thinking chip after the real result.
+      subs.transcript.forEach(f => f({ type: 'turn-complete', sessionId: 'wb-2',
+        uuid: 'wb-d4-native-end', timestamp: Date.now(),
+        data: { stopReason: dismissed ? 'question_dismissed' : 'end_turn', model: null } }));
+      return true;
+    },
 
     // Reads the live-session meta slice, falling back to a `past` row of the
     // same id, then to empty. `supported: true` always — the desktop refuses
@@ -1790,6 +1821,7 @@ function handWritten(store: MockStore): Record<string, Record<string, unknown>>
       return mode;
     },
   };
+  let queuedSends = 0;
   const native: Ns<'native'> = {
     supported: true,
     getContextPreferences: async () => ({ ...contextPreferences }),
@@ -1820,9 +1852,19 @@ function handWritten(store: MockStore): Record<string, Record<string, unknown>>
     // Shares startReply with session.sendInput — see that helper's WHY.
     send: async (sessionId: string, text: string, _attachments?: string[]) => {
       if (store.refuseWrites) return { status: 'failed', reason: 'not-live' };
+      // `?queueSends=1`: answer as if the assistant were busy, so typed messages
+      // wait in the strip above the message box (Send now / Edit / Cancel).
+      // WHY a switch: the strip is renderer-local and a restored chat copy
+      // deliberately drops it, so it can only be shown by sending while busy.
+      if (typeof location !== 'undefined' && new URLSearchParams(location.search).get('queueSends') === '1') {
+        return { status: 'queued', queueId: `wb-queued-${++queuedSends}` };
+      }
       startReply(sessionId, text);
       return { status: 'sent' };
     },
+    // Pretend the waiting message was found; the real host decides in main.
+    queueRemove: async () => true,
+    queueSendNow: async () => true,
     // Model picker (ModelPickerPopup.tsx:304). Real backend rebinds the
     // provider/model on the live session; here it updates the row the status
     // bar and picker read from, so the chip changes on screen. No `subs.*`
@@ -1867,7 +1909,11 @@ function handWritten(store: MockStore): Record<string, Record<string, unknown>>
     // shortened one, because the got/cut comparison is most of what this panel
     // is for and a workbench that only ever shows whole files never renders it.
     sessionContextText: async (_sessionId: string, kind: 'project' | 'user' | 'skill', id?: string) => {
-      const fixture = kind === 'project' ? CONTEXT_TEXT.project
+      const fixture = kind === 'project' && id === '/workspace/AGENTS.md'
+        ? { path: id, text: '# Workspace\n\n…\n\n[Outlined to fit]', full: '# Workspace\n\nAlways check your work.', truncated: true }
+        : kind === 'project' && id === '/workspace/repo/CLAUDE.md'
+          ? { path: id, text: '# Project\n\nFollow the task.', full: '# Project\n\nFollow the task.', truncated: false }
+          : kind === 'project' ? CONTEXT_TEXT.project
         : kind === 'user' ? CONTEXT_TEXT.user
           : CONTEXT_TEXT.skills[id ?? ''];
       if (!fixture) return { error: 'unreadable' };
diff --git a/desktop/src/renderer/dev/workbench/screens/chat.ts b/desktop/src/renderer/dev/workbench/screens/chat.ts
index 2b90b8eb4..09bee56c7 100644
--- a/desktop/src/renderer/dev/workbench/screens/chat.ts
+++ b/desktop/src/renderer/dev/workbench/screens/chat.ts
@@ -33,6 +33,7 @@ export const CHAT: readonly ScreenEntry[] = [
   { ...chat('chat/announcement', 'dialog'), params: { announcement: '1' } },
   chat('chat/quick-chips', 'dialog'),
   chat('chat/session-context', 'dialog'),
+  { ...chat('chat/session-context#ancestors', 'dialog'), session: 'wb-2', params: { contextChain: '1' } },
   chat('chat/quit-sessions', 'dialog'),
   // Each first-run warning, once per kind (localStorage is unwritten on a fresh
   // photo-only tab, so every kind is still un-acknowledged).
@@ -58,6 +59,10 @@ export const CHAT: readonly ScreenEntry[] = [
   // Conversations on the practice sessions. wb-2 is the native-runtime session that the
   // seeded conversations, OpenRouter error cards and the stalled replay play into.
   { ...chat('chat#native', 'view'), session: 'wb-2' },
+  // Dev-only fixture: real shared question card with duplicate wording, selected
+  // and typed via explore rather than drawing a stand-in or changing the app.
+  { ...chat('chat#questions-native', 'view'), session: 'wb-2', params: { seed: 'bubbles-questions-native' } },
+  { ...chat('chat#questions-cc', 'view'), session: 'wb-1', params: { seed: 'bubbles-questions-cc' } },
   { ...chat('chat#chatgpt', 'view'), session: 'wb-3' },
   { ...chat('chat#chatgpt-plan-limit', 'view', 'error-state'), session: 'wb-3', params: { planLimit: '1' } },
   { ...chat('chat#stalled', 'view', 'error-state'), session: 'wb-2', params: { stalled: '1' } },
diff --git a/desktop/src/renderer/dev/workbench/seed-chat.ts b/desktop/src/renderer/dev/workbench/seed-chat.ts
index cacffb851..c6e1f100c 100644
--- a/desktop/src/renderer/dev/workbench/seed-chat.ts
+++ b/desktop/src/renderer/dev/workbench/seed-chat.ts
@@ -167,8 +167,13 @@ export function buildHydratePayload(): SerializedChatState {
   if (bubbleName) {
     const raw = bubbleConvos[`./fixtures/bubbles/${bubbleName}.jsonl`];
     if (raw) {
-      const i = sources.findIndex(([name]) => name === 'native');
-      sources.splice(i >= 0 ? i : sources.length, i >= 0 ? 1 : 0, [`bubbles-${bubbleName}`, raw, 'wb-2']);
+      // WHY: the question review needs the same shared card on both transport
+      // lanes; the CC fixture replaces wb-1, never masquerades as wb-2 native.
+      const isCcQuestion = bubbleName === 'questions-cc';
+      const target = isCcQuestion ? 'claude-code' : 'native';
+      const targetIndex = sources.findIndex(([name]) => name === target);
+      sources.splice(targetIndex >= 0 ? targetIndex : sources.length, targetIndex >= 0 ? 1 : 0,
+        [`bubbles-${bubbleName}`, raw, isCcQuestion ? 'wb-1' : 'wb-2']);
     } else {
       console.warn(`[workbench] no bubble-grouping fixture named "${bubbleName}"`);
     }
@@ -185,7 +190,7 @@ export function buildHydratePayload(): SerializedChatState {
       continue;
     }
 
-    const { actions, error } = loadFixture(name, raw, sessionId, { includeStalled: stalledRequested(), includePlanLimit: planLimitRequested(), providerError: providerErrorRequested() });
+    const { actions, error } = loadFixture(name, raw, sessionId, { includeStalled: stalledRequested(), includePlanLimit: planLimitRequested(), providerError: providerErrorRequested(), includeContextChain: typeof location !== 'undefined' && new URLSearchParams(location.search).get('contextChain') === '1' });
     if (error) { console.warn(`[workbench] ${error}`); continue; }
 
     state = chatReducer(state, { type: 'SESSION_INIT', sessionId });
diff --git a/desktop/src/renderer/hooks/useIpc.ts b/desktop/src/renderer/hooks/useIpc.ts
index 6bd74b728..b640888c6 100644
--- a/desktop/src/renderer/hooks/useIpc.ts
+++ b/desktop/src/renderer/hooks/useIpc.ts
@@ -346,6 +346,8 @@ declare global {
         // (caller may now safely refill the composer); false = too late (already
         // draining/sent) or the session isn't live — never throws.
         queueRemove: (sessionId: string, queueId: string) => Promise<boolean>;
+        /** Stop the current task and send this waiting message next. false = already sending. */
+        queueSendNow: (sessionId: string, queueId: string) => Promise<boolean>;
         interrupt: (sessionId: string) => void;
         // Stalled-turn Retry — fire-and-forget, same shape as interrupt above.
         retry: (sessionId: string) => void;
diff --git a/desktop/src/renderer/remote-shim.ts b/desktop/src/renderer/remote-shim.ts
index ae0cddea2..262540645 100644
--- a/desktop/src/renderer/remote-shim.ts
+++ b/desktop/src/renderer/remote-shim.ts
@@ -2952,6 +2952,7 @@ export function installShim(): void {
       send: (sessionId: string, text: string, attachments?: string[]) => invoke('native:send', { sessionId, text, attachments }),
       // Task 11: cancel/edit a queued message — request/response (mirrors preload.ts).
       queueRemove: (sessionId: string, queueId: string) => invoke('native:queue-remove', { sessionId, queueId }),
+      queueSendNow: (sessionId: string, queueId: string) => invoke('native:queue-send-now', { sessionId, queueId }),
       // Fire-and-forget: no response expected
       interrupt: (sessionId: string) => fire('native:interrupt', { sessionId }),
       // Fire-and-forget like interrupt above — the stalled card needs no answer.
diff --git a/desktop/src/shared/project-instruction-summary.ts b/desktop/src/shared/project-instruction-summary.ts
new file mode 100644
index 000000000..e6cf8c75c
--- /dev/null
+++ b/desktop/src/shared/project-instruction-summary.ts
@@ -0,0 +1,9 @@
+// WHY: context records transmit only source summaries; fitted and full bodies
+// stay in the host's startup inventory until one captured row is requested.
+export interface ProjectInstructionSummary {
+  path: string;
+  truncated: boolean;
+  note?: string | null;
+  /** Same-folder instructions file that was not used (only one per folder is). */
+  notUsed?: string | null;
+}
diff --git a/desktop/src/shared/types.ts b/desktop/src/shared/types.ts
index 395dee34e..3d5ec214a 100644
--- a/desktop/src/shared/types.ts
+++ b/desktop/src/shared/types.ts
@@ -1,4 +1,5 @@
 import type { CatalogMeta } from './catalog-types';
+import type { ProjectInstructionSummary } from './project-instruction-summary';
 
 // 'auto' is Claude Code's classifier-backed mode (CC v2.1.83+, March 2026).
 // Sits between 'auto-accept' (only file edits + 7 safe bash) and 'bypass'
@@ -1041,9 +1042,7 @@ export interface SessionContext {
   /** The whole assembled prompt. Kept as the fallback the panel shows when a host
    *  cannot split it — showing it whole beats showing nothing. */
   systemPrompt?: string | null;
-  /** The root instruction file (CLAUDE.md / AGENTS.md) baked into the system
-   *  prompt. This is the ONE thing genuinely cut at session start. Its text is
-   *  fetched on demand. */
+  /** Legacy single-file summary (also present on Claude Code records). */
   projectInstructions?: {
     path: string;
     /** True when the file was outlined to fit the window. */
@@ -1051,6 +1050,7 @@ export interface SessionContext {
     /** Human line when truncated — "3 of 12 sections shown as headings". */
     note?: string | null;
   } | null;
+  projectInstructionFiles?: ProjectInstructionSummary[]; // Captured chain; bodies on demand.
   /** Your own instructions, the ones that apply in every project
    *  (`~/.claude/CLAUDE.md`). Claude Code reads this file; the native harness
    *  does NOT — it only walks up from the working folder — which is a real
@@ -2150,6 +2150,9 @@ export const IPC = {
   // Task 11: cancel/edit a queued-but-not-yet-sent message. invoke →
   // NativeSessionHost.removeQueued(sessionId, queueId): boolean.
   NATIVE_QUEUE_REMOVE: 'native:queue-remove',
+  // "Send now" on a waiting message: invoke → NativeSessionHost.sendQueuedNow
+  // (sessionId, queueId): boolean — stops the current task, sends this next.
+  NATIVE_QUEUE_SEND_NOW: 'native:queue-send-now',
   NATIVE_INTERRUPT: 'native:interrupt',
   // Stalled-turn Retry (fire-and-forget like interrupt above). Re-runs the ONE
   // parked step; unlike interrupt it never cascades to specialist children or
diff --git a/desktop/tests/LocalModelsSection.test.tsx b/desktop/tests/LocalModelsSection.test.tsx
index ea34543e1..308609de1 100644
--- a/desktop/tests/LocalModelsSection.test.tsx
+++ b/desktop/tests/LocalModelsSection.test.tsx
@@ -680,8 +680,11 @@ describe('fields main computes', () => {
     it('a load error that arrives while the dialog is open reaches the user', async () => {
       // Same staleness, other field: a model fails on its next request, and a
       // dialog that read main once would never say so.
-      await openSettings(SETTINGS, { ...SETTINGS, lastLoadError: 'error: out of memory' });
+      // Held until reveal(): under load the fast test poll could otherwise land
+      // before the "not shown yet" check and fail a correct dialog.
+      const { reveal } = await openSettings(SETTINGS, { ...SETTINGS, lastLoadError: 'error: out of memory' }, { holdLater: true });
       expect(screen.queryByText(LOAD_ERROR_TITLE)).toBeNull();
+      reveal();
       await waitFor(
         () => expect(screen.getByText('error: out of memory')).toBeTruthy(),
         POLLED,
diff --git a/desktop/tests/QueuedMessagesStrip.test.tsx b/desktop/tests/QueuedMessagesStrip.test.tsx
new file mode 100644
index 000000000..02feacd8f
--- /dev/null
+++ b/desktop/tests/QueuedMessagesStrip.test.tsx
@@ -0,0 +1,28 @@
+// @vitest-environment jsdom
+import React from 'react';
+import { describe, it, expect, vi } from 'vitest';
+import { render, screen, fireEvent } from '@testing-library/react';
+import QueuedMessagesStrip from '../src/renderer/components/QueuedMessagesStrip';
+
+describe('QueuedMessagesStrip', () => {
+  it('Send now sends the message it sits on, and is last in the row after the trash button', () => {
+    const onSendNow = vi.fn();
+    render(<QueuedMessagesStrip
+      queuedMessages={[{ queueId: 'a', content: 'first', timestamp: 0 }, { queueId: 'b', content: 'second', timestamp: 0 }]}
+      onSendNow={onSendNow} onCancel={() => {}} onEdit={() => {}} />);
+    const buttons = screen.getAllByRole('button', { name: 'Interrupt and send now' });
+    expect(buttons).toHaveLength(2);
+    // Its hover words say what it does, including that it interrupts.
+    expect(buttons[1].textContent).toBe('Interrupt and Send Now');
+    // Rightmost: the trash (Cancel) sits immediately to its left.
+    expect(buttons[1].previousElementSibling?.getAttribute('aria-label')).toBe('Cancel queued message');
+    expect(buttons[1].nextElementSibling).toBeNull();
+    fireEvent.click(buttons[1]);
+    expect(onSendNow).toHaveBeenCalledWith('b');
+  });
+
+  it('shows no Send now button where the host cannot offer one', () => {
+    render(<QueuedMessagesStrip queuedMessages={[{ queueId: 'a', content: 'first', timestamp: 0 }]} onCancel={() => {}} />);
+    expect(screen.queryByRole('button', { name: 'Interrupt and send now' })).toBeNull();
+  });
+});
diff --git a/desktop/tests/ask-user-question-card-other.test.tsx b/desktop/tests/ask-user-question-card-other.test.tsx
index 8e8f49bb7..35466a6fa 100644
--- a/desktop/tests/ask-user-question-card-other.test.tsx
+++ b/desktop/tests/ask-user-question-card-other.test.tsx
@@ -37,6 +37,100 @@ const box = () => screen.getByRole('textbox') as HTMLTextAreaElement;
 const sentInput = () => respond.mock.calls[0][1].decision.updatedInput;
 
 describe('AskUserQuestion card — Other + note', () => {
+  it('keeps duplicate-worded native choices and notes independent through keyboard and submit', async () => {
+    const tool = askTool();
+    tool.input = { questions: [
+      { question: 'Which color?', header: 'Walls', multiSelect: false, options: [{ label: 'Blue' }, { label: 'Red' }] },
+      { question: 'Which color?', header: 'Trim', multiSelect: false, options: [{ label: 'Green' }, { label: 'Yellow' }] },
+    ] };
+    renderCard(tool);
+    const boxes = screen.getAllByRole('textbox') as HTMLTextAreaElement[];
+    const blue = screen.getByRole('button', { name: /^Blue/ });
+    fireEvent.click(blue);
+    fireEvent.change(boxes[0], { target: { value: 'lighter shade' } });
+    // Keyboard navigation crosses the repeated text into the second question.
+    for (let i = 0; i < 3; i++) fireEvent.keyDown(window, { key: 'ArrowDown' });
+    fireEvent.keyDown(window, { key: 'Enter' });
+    expect(screen.getByRole('button', { name: /^Green/ }).className).toContain('border-accent');
+    expect(blue.className).toContain('border-accent');
+    const others = screen.getAllByRole('button', { name: /^Other/ });
+    const frame = vi.spyOn(window, 'requestAnimationFrame').mockImplementation(cb => { cb(0); return 0; });
+    try { fireEvent.click(others[1]); } finally { frame.mockRestore(); }
+    fireEvent.change(boxes[1], { target: { value: 'teal trim' } });
+    expect(boxes[0].value).toBe('lighter shade');
+    expect(boxes[1].value).toBe('teal trim');
+    expect(document.activeElement).toBe(boxes[1]);
+    fireEvent.click(submit());
+    await vi.waitFor(() => expect(respond).toHaveBeenCalledTimes(1));
+    expect(sentInput().orderedAnswers).toEqual([{ answer: 'Blue', note: 'lighter shade' }, { answer: 'teal trim' }]);
+  });
+
+  it('resets answers when the same tool card receives a new pending request ID', () => {
+    const tool = askTool();
+    const mounted = renderCard(tool);
+    fireEvent.click(screen.getByRole('button', { name: /^Blue/ }));
+    expect(submit().disabled).toBe(false);
+    mounted.rerender(<ChatProvider><ToolCard tool={{ ...tool, requestId: 'native-q2' }} sessionId="s1" /></ChatProvider>);
+    expect(submit().disabled).toBe(true);
+    expect(screen.getByRole('button', { name: /^Blue/ }).className).not.toContain('border-accent');
+  });
+
+  it('preserves legacy wording-keyed CC duplicate choices and submission without ordered answers', async () => {
+    const tool = askTool();
+    tool.requestId = 'cc-question-duplicate';
+    tool.input = { questions: [
+      { question: 'Same?', header: 'First', multiSelect: false, options: [{ label: 'Yes' }, { label: 'No' }] },
+      { question: 'Same?', header: 'Second', multiSelect: false, options: [{ label: 'Go' }, { label: 'Stop' }] },
+    ] };
+    renderCard(tool);
+    fireEvent.click(screen.getByRole('button', { name: /^Yes/ }));
+    fireEvent.click(screen.getByRole('button', { name: /^Go/ }));
+    // Baseline CC state is keyed by wording: the second pick replaces the
+    // first in BOTH displayed selections and the one legacy payload key.
+    expect(screen.getByRole('button', { name: /^Yes/ }).className).not.toContain('border-accent');
+    expect(screen.getByRole('button', { name: /^Go/ }).className).toContain('border-accent');
+    const boxes = screen.getAllByRole('textbox') as HTMLTextAreaElement[];
+    fireEvent.change(boxes[0], { target: { value: 'shared note' } });
+    expect(boxes[1].value).toBe('shared note');
+    expect(submit().disabled).toBe(false);
+    fireEvent.click(submit());
+    await vi.waitFor(() => expect(respond).toHaveBeenCalledTimes(1));
+    expect(sentInput()).toEqual({ questions: tool.input.questions, answers: { 'Same?': 'Go' },
+      notes: { 'Same?': 'shared note' }, annotations: { 'Same?': { notes: 'shared note' } } });
+  });
+
+  it('retains independent native selections after an unconfirmed response and resends the same order', async () => {
+    respond.mockRejectedValueOnce(new Error('transport unavailable')).mockResolvedValueOnce(true);
+    const tool = askTool();
+    tool.input = { questions: [
+      { question: 'Same?', header: 'One', multiSelect: false, options: [{ label: 'Blue' }, { label: 'Red' }] },
+      { question: 'Same?', header: 'Two', multiSelect: false, options: [{ label: 'Green' }, { label: 'Yellow' }] },
+    ] };
+    renderCard(tool);
+    fireEvent.click(screen.getByRole('button', { name: /^Blue/ }));
+    fireEvent.click(screen.getByRole('button', { name: /^Green/ }));
+    fireEvent.click(submit());
+    await vi.waitFor(() => expect(screen.getByRole('alert').textContent).toMatch(/couldn.t confirm/));
+    expect(submit().disabled).toBe(false);
+    fireEvent.click(submit());
+    await vi.waitFor(() => expect(respond).toHaveBeenCalledTimes(2));
+    expect(respond.mock.calls[0][1].decision.updatedInput.orderedAnswers).toEqual([{ answer: 'Blue' }, { answer: 'Green' }]);
+    expect(respond.mock.calls[1][1].decision.updatedInput.orderedAnswers).toEqual([{ answer: 'Blue' }, { answer: 'Green' }]);
+  });
+
+  it('keeps the Claude Code unique-wording payload exactly legacy-shaped', async () => {
+    const tool = askTool();
+    tool.requestId = 'cc-question-1';
+    renderCard(tool);
+    fireEvent.click(screen.getByRole('button', { name: /^Blue/ }));
+    fireEvent.change(box(), { target: { value: 'lighter shade' } });
+    fireEvent.click(submit());
+    await vi.waitFor(() => expect(respond).toHaveBeenCalledTimes(1));
+    expect(sentInput()).toEqual({ questions: tool.input.questions,
+      answers: { 'Which color?': 'Blue' }, notes: { 'Which color?': 'lighter shade' },
+      annotations: { 'Which color?': { notes: 'lighter shade' } } });
+    expect(respond.mock.calls[0][0]).toBe('cc-question-1');
+  });
   it('offers an Other row after the listed options, and the box reads "Add a note…" until Other is picked', () => {
     renderCard(askTool());
     expect(screen.getByRole('button', { name: /^Other — Type your own answer$/ })).toBeTruthy();
diff --git a/desktop/tests/ask-user-question-tool.test.ts b/desktop/tests/ask-user-question-tool.test.ts
index 54eb053bc..08150bdbf 100644
--- a/desktop/tests/ask-user-question-tool.test.ts
+++ b/desktop/tests/ask-user-question-tool.test.ts
@@ -22,6 +22,26 @@ describe('AskUserQuestion schema', () => {
 });
 
 describe('formatAnswers', () => {
+  it('uses ordered native answers for repeated wording and the original question order', () => {
+    const questions = [q({ header: 'First' }), q({ header: 'Second', options: [{ label: 'Green' }, { label: 'Yellow' }] })];
+    const text = formatAnswers({ questions } as any, { questions: [q({ question: 'FAKE' })],
+      answers: { 'Which color?': 'WRONG' }, orderedAnswers: [
+        { answer: 'Blue', note: 'lighter' }, { answer: 'teal', note: '' },
+      ] });
+    expect(text).toBe('The user answered:\n\nQ: Which color?\nA: Blue\nNote from the user: lighter\n\nQ: Which color?\nA (the user typed their own answer): teal');
+    expect(text).not.toContain('FAKE');
+  });
+
+  it('falls back to the legacy answer map for malformed ordered arrays', () => {
+    const questions = [q(), q({ question: 'Size?', header: 'Size' })];
+    for (const orderedAnswers of [[{ answer: 'Blue' }], [{ answer: 42 }, { answer: 'Large' }],
+      [{ answer: 'Blue', note: 12 }, { answer: 'Large' }],
+      [{ answer: ['Blue', 4] }, { answer: 'Large' }], 'bad', null]) {
+      expect(formatAnswers({ questions } as any, { answers: { 'Which color?': 'Red', 'Size?': 'Small' }, orderedAnswers }))
+        .toBe('The user answered:\n\nQ: Which color?\nA: Red\n\nQ: Size?\nA (the user typed their own answer): Small');
+    }
+    expect(() => formatAnswers({ questions } as any, { orderedAnswers: [{ answer: 'Blue' }, { answer: 'Large' }] })).not.toThrow();
+  });
   it('pairs each question with its answer', () => {
     const text = formatAnswers({ questions: [q(), q({ question: 'Size?', header: 'Size' })] } as any,
       { questions: [], answers: { 'Which color?': 'Blue', 'Size?': 'Large, Medium' } });
diff --git a/desktop/tests/bash-background.test.ts b/desktop/tests/bash-background.test.ts
index e4eb29e3c..eebabe77c 100644
--- a/desktop/tests/bash-background.test.ts
+++ b/desktop/tests/bash-background.test.ts
@@ -1,6 +1,6 @@
 // G-1 background Bash — the Bash tool's half: foreground family kill (Task 2),
 // run_in_background (Task 3), hand-off at the time limit (Task 4).
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -149,6 +149,70 @@ describe.skipIf(!posix)('run_in_background', () => {
   });
 });
 
+describe.skipIf(!posix)('hand-off registration failure', () => {
+  it('settles with the registration error after output without claiming a background run', async () => {
+    const error = Object.assign(new Error('mkdir denied'), { code: 'EACCES' });
+    const adopt = vi.spyOn(reg, 'adopt').mockImplementation(() => { throw error; });
+    const r = await BashTool.execute({ command: 'echo early; node -e "setTimeout(()=>{}, 4000)"', timeout: 200 }, ctx());
+    expect(adopt).toHaveBeenCalledOnce();
+    expect(r.isError).toBe(true);
+    expect(r.text).toContain('mkdir denied');
+    expect(r.text).toContain('early');
+    expect(r.text).not.toContain('handed off to the background');
+    expect(reg.list()).toHaveLength(0);
+    adopt.mockRestore();
+  });
+
+  it.each(['close', 'error'] as const)('a child %s racing failed setup keeps its first settled result', async (event) => {
+    const adopt = vi.spyOn(reg, 'adopt').mockImplementation((spec) => {
+      if (event === 'close') spec.child.emit('close', 7);
+      else spec.child.emit('error', new Error('child failed during setup'));
+      throw new Error('registration failed after child event');
+    });
+    try {
+      const result = await BashTool.execute({ command: 'echo early; node -e "setTimeout(()=>{}, 4000)"', timeout: 200 }, ctx());
+      expect(adopt).toHaveBeenCalledOnce();
+      expect(result.isError).toBe(true);
+      expect(result.text).toContain(event === 'error' ? 'child failed during setup' : 'exit 7');
+      expect(result.text).not.toContain('handed off to the background');
+      expect(reg.list()).toEqual([]);
+    } finally { adopt.mockRestore(); }
+  });
+
+  it('an abort during successful adoption leaves the registry owning cleanup but reports cancellation', async () => {
+    const ac = new AbortController();
+    const original = reg.adopt.bind(reg);
+    const adopt = vi.spyOn(reg, 'adopt').mockImplementation((spec) => {
+      ac.abort();
+      return original(spec);
+    });
+    try {
+      const result = await BashTool.execute({ command: 'echo early; node -e "setTimeout(()=>{}, 4000)"', timeout: 200 }, ctx({ signal: ac.signal }));
+      expect(adopt).toHaveBeenCalledOnce();
+      expect(result.text).toContain('Canceled: the user interrupted this operation.');
+      expect(result.text).not.toContain('handed off to the background');
+      expect(reg.list()).toHaveLength(1);
+      await reg.list()[0].exited;
+    } finally { adopt.mockRestore(); }
+  });
+
+  it('an abort racing a failed adoption settles once as canceled without a phantom run', async () => {
+    const ac = new AbortController();
+    const adopt = vi.spyOn(reg, 'adopt').mockImplementation(() => {
+      ac.abort();
+      throw new Error('registration failed after abort');
+    });
+    try {
+      const result = await BashTool.execute({ command: 'echo early; node -e "setTimeout(()=>{}, 4000)"', timeout: 200 }, ctx({ signal: ac.signal }));
+      expect(adopt).toHaveBeenCalledOnce();
+      expect(result.isError).toBe(true);
+      expect(result.text).toContain('Canceled: the user interrupted this operation.');
+      expect(result.text).not.toContain('handed off to the background');
+      expect(reg.list()).toEqual([]);
+    } finally { adopt.mockRestore(); }
+  });
+});
+
 describe.skipIf(!posix)('hand-off at the time limit', () => {
   it('a foreground command at its limit is adopted — no SIGKILL, no exit 124, text names the id', async () => {
     const r: any = await BashTool.execute({ command: 'echo early; node -e "setTimeout(()=>{}, 4000)"', timeout: 400 }, ctx());
diff --git a/desktop/tests/buddy-helper-states.test.tsx b/desktop/tests/buddy-helper-states.test.tsx
index 91c655f7c..d41c8afa4 100644
--- a/desktop/tests/buddy-helper-states.test.tsx
+++ b/desktop/tests/buddy-helper-states.test.tsx
@@ -187,7 +187,9 @@ describe('row 3 — a helper is needed and cannot work here', () => {
 
     // Twice over: the collapsed settings row reads it too, which is how a user
     // sees it without opening anything.
-    expect(screen.getAllByText(UNSUPPORTED_ROW)).toHaveLength(2);
+    // WHY: the popup heading appears before the async helper-status response;
+    // wait for the actual unsupported state, not just the popup shell.
+    await waitFor(() => expect(screen.getAllByText(UNSUPPORTED_ROW)).toHaveLength(2));
     expect(screen.getByText(/other desktops do not let apps place their own windows/))
       .toBeInTheDocument();
     // No switch to flip: offering one would be an action that does nothing.
diff --git a/desktop/tests/float-chrome-pops.test.ts b/desktop/tests/float-chrome-pops.test.ts
index 5a2ee4ad0..57cc3d08f 100644
--- a/desktop/tests/float-chrome-pops.test.ts
+++ b/desktop/tests/float-chrome-pops.test.ts
@@ -105,7 +105,10 @@ describe('float chrome never reaches another chrome style', () => {
   it('the component hooks are class names and data attributes only', () => {
     // WHY: these components render for every theme; a hook must not change what
     // any other chrome style paints.
-    expect(readSource(join(RENDERER, 'components/QuickChips.tsx'))).toContain('quick-chip-edit shrink-0');
+    // The chips' edit button is the shared EditPencilButton; QuickChips hands it
+    // the hook as a class, and the button puts it ahead of its own classes.
+    expect(readSource(join(RENDERER, 'components/QuickChips.tsx'))).toContain('className="quick-chip-edit"');
+    expect(readSource(join(RENDERER, 'components/EditPencilButton.tsx'))).toContain('className} shrink-0');
     expect(readSource(join(RENDERER, 'components/tags/SessionTagsChip.tsx'))).toContain('className="status-chip flex');
     expect(readSource(join(RENDERER, 'components/HeaderBar.tsx'))).toContain('className="caption-buttons flex bg-inset');
     expect(readSource(join(RENDERER, 'components/SessionStrip.tsx'))).toContain('data-status={color} className={`session-dot ');
diff --git a/desktop/tests/harness-accepted-history.test.ts b/desktop/tests/harness-accepted-history.test.ts
index f46ef79ce..44ef767f4 100644
--- a/desktop/tests/harness-accepted-history.test.ts
+++ b/desktop/tests/harness-accepted-history.test.ts
@@ -69,6 +69,25 @@ const uuidOfText = (events: TranscriptEvent[], text: string) =>
   events.find((e) => e.type === 'assistant-text' && e.data.text === text)!.uuid;
 
 describe('HarnessSession accepted history', () => {
+  it('excludes abandoned transient retry UUIDs after a completed tool step', async () => {
+    const tool = fakeTool('Read');
+    const failure = Object.assign(new Error('temporary'), { statusCode: 503 });
+    const model = scriptedModel([
+      stream(toolCallChunk('read-once', 'Read', { file_path: 'a' }), finishChunk('tool-calls')),
+      stream(...textChunks('old', 'abandoned text'), ...reasoningChunks('old-reasoning', 'abandoned thought'), { type: 'error', error: failure }),
+      stream(...textChunks('new', 'replacement'), finishChunk('stop')),
+    ]);
+    const session = new HarnessSession(makeOpts({ tools: [tool], retryDelays: [1], decide: async () => ({ action: 'allow', denyListed: false }) }), async () => model as any);
+    const events = collect(session);
+    await session.send('go');
+    const accepted = session.acceptedHistory();
+    expect((tool as any).calls).toHaveLength(1);
+    expect(accepted.eventUuids).not.toContain(uuidOfText(events, 'abandoned text'));
+    expect(accepted.eventUuids).toContain(uuidOfText(events, 'replacement'));
+    expect(JSON.stringify(accepted.messages)).not.toContain('abandoned text');
+    expect(accepted.messages).toEqual((session as any).history);
+    expect(events.find(e => e.data.dropPart)!.data.dropPart!.partIds).toEqual(['old', 'old-reasoning']);
+  });
   it('a text + tool-call turn accepts exactly the emitted user/text/tool uuids, in emit order', async () => {
     const events: TranscriptEvent[] = [];
     const session = makeSession({
@@ -278,6 +297,24 @@ describe('HarnessSession accepted history', () => {
     expect(cleared.revision).toBe(before.revision + 1);
   });
 
+  it('restored accepted rule literal is kept once with its source provenance', async () => {
+    const { markAppGenerated, isAppGenerated } = await import('../src/main/harness/compaction');
+    const text = '<project-rule source="rules/one.md">\nCAPTURED-RULE\n</project-rule>';
+    const rule = markAppGenerated({ role: 'user', content: text } as any);
+    const seen: any[] = [];
+    const model = scriptedModel([stream(toolCallChunk('c1', 'Read', { file_path: 'a.ts' }), finishChunk('tool-calls')),
+      stream(...textChunks('done', 'done'), finishChunk('stop'))], seen);
+    const session = new HarnessSession(makeOpts({ tools: [fakeTool('Read', { permissionSubject: (args: any) => args.file_path })],
+      decide: async () => ({ action: 'allow', denyListed: false }),
+      triggers: { match: () => [{ id: 'rule:/project/one.md', source: 'rules/one.md', body: 'CAPTURED-RULE' }] },
+    }), async () => model as any);
+    session.seedHistory([{ role: 'user', content: 'old' }, rule] as any,
+      { eventUuids: ['old'], revision: 2, messageOrigins: [['old'], null] });
+    await session.send('touch');
+    expect(JSON.stringify(seen.at(-1)).split('CAPTURED-RULE').length - 1).toBe(1);
+    expect(session.acceptedHistory().messages.filter(m => isAppGenerated(m) && m.content === text)).toHaveLength(1);
+  });
+
   it('seedHistory restores the accepted list, revision and transformation from a checkpoint', () => {
     const session = makeSession({});
     session.seedHistory([{ role: 'user', content: 'earlier' }] as any, {
diff --git a/desktop/tests/harness-compaction.test.ts b/desktop/tests/harness-compaction.test.ts
index 958a79252..84455215c 100644
--- a/desktop/tests/harness-compaction.test.ts
+++ b/desktop/tests/harness-compaction.test.ts
@@ -20,6 +20,19 @@ it('compaction prompt carries handoff structure, provenance rules, and active Go
 });
 
 describe('driver compaction', () => {
+  it('successful automatic summary stops vouching for a retired rule, but its prose mention is not loaded guidance', async () => {
+    const text = '<project-rule source="rules/old.md">\nRULE-OLD\n</project-rule>';
+    const model = scriptModel([{ text: 'Summary mentions RULE-OLD' }]);
+    const session = makeSession({ contextLength: 8192, model });
+    session.seedHistory([{ role: 'user', content: 'old ' + 'x'.repeat(9000) },
+      markAppGenerated({ role: 'user', content: text } as any), { role: 'assistant', content: 'ack' },
+      { role: 'user', content: 'next' }, { role: 'assistant', content: 'ack' }, { role: 'user', content: 'latest' }] as any);
+    (session as any).abort = new AbortController();
+    try { expect(await (session as any).maybeCompact(model, {}, true)).toBe(true); }
+    finally { (session as any).abort = null; }
+    expect((session as any).retainedTriggerMessages.has(text)).toBe(false);
+    expect((session as any).history[0].content).toContain('RULE-OLD');
+  });
   it('checks fresh input even after a low-usage completed turn, without front trimming', async () => {
     const calls: any[] = [];
     const inner = scriptModel([{ text: 'handoff', usage: { inputTokens: 3800 } }, { text: 'done' }]);
diff --git a/desktop/tests/harness-history-rebuild.test.ts b/desktop/tests/harness-history-rebuild.test.ts
index 9c9a456d1..5fecae60d 100644
--- a/desktop/tests/harness-history-rebuild.test.ts
+++ b/desktop/tests/harness-history-rebuild.test.ts
@@ -189,6 +189,23 @@ describe('portable compaction restore', () => {
 });
 
 describe('rebuildHistory — the resume deep-equal contract', () => {
+  it('replays a busy correction after paired unstarted calls through the persisted store', async () => {
+    const queue = [{ id: 'correction', text: 'use the other file', attachments: [] }];
+    const model = scriptedModel([
+      stream(toolCallChunk('c1', 'Read', { file_path: 'a' }), toolCallChunk('c2', 'Read', { file_path: 'b' }), finishChunk('tool-calls')),
+      stream(...textChunks('done', 'revised'), finishChunk('stop')),
+    ]);
+    const session = new HarnessSession(makeOpts({ tools: [fakeTool('Read')], decide: async () => ALLOW,
+      takeReadyBusyMessage: () => queue.shift(),
+    }), async () => model as any);
+    const events = collect(session);
+    await session.send('original');
+    const persisted = await throughStore(events);
+    expect(rebuildHistory(persisted)).toEqual((session as any).history);
+    expect(events.filter(e => e.type === 'tool-result')).toHaveLength(2);
+    expect(persisted.filter(e => e.type === 'user-message').map(e => e.data.text)).toEqual(['original', 'use the other file']);
+    expect(session.acceptedHistory().eventUuids).toContain(events.find(e => e.type === 'user-message' && e.data.text === 'use the other file')!.uuid);
+  });
   it('two-step tool turn: rebuild(emitted) deep-equals the live history', async () => {
     const read = fakeTool('Read');
     const model = scriptedModel([
@@ -335,6 +352,39 @@ describe('rebuildHistory — the resume deep-equal contract', () => {
     for (const id of callIds) expect(resultIds.has(id)).toBe(true);
   });
 
+  it('rebuilds completed and unstarted results after a later permission callback fails', async () => {
+    const executed: string[] = [];
+    const read = fakeTool('Read', { onExecute: (args: { file_path: string }) => {
+      executed.push(args.file_path); return { text: `read ${args.file_path}` };
+    } });
+    const seen: any[] = [];
+    const model = scriptedModel([
+      stream(toolCallChunk('c1', 'Read', { file_path: 'a.ts' }),
+        toolCallChunk('c2', 'Read', { file_path: 'b.ts' }),
+        toolCallChunk('c3', 'Read', { file_path: 'c.ts' }), finishChunk('tool-calls')),
+      stream(...textChunks('next', 'recovered'), finishChunk('stop')),
+    ], seen);
+    let decisions = 0;
+    const session = new HarnessSession(makeOpts({ tools: [read], decide: async () => {
+      if (++decisions === 2) throw new Error('permission store EACCES');
+      return ALLOW;
+    } }), async () => model as any);
+    const events = collect(session);
+    await session.send('first');
+    const persisted = await throughStore(events);
+    expect(rebuildHistory(persisted)).toEqual((session as any).history);
+    const results = (session as any).history.findLast((m: any) => m.role === 'tool')?.content;
+    expect(results.map((p: any) => p.toolCallId)).toEqual(['c1', 'c2', 'c3']);
+    expect(results[0].output.value).toBe('read a.ts');
+    expect(results[1].output.value).toContain('permission store EACCES');
+    expect(results[2].output.value).toMatch(/not run/i);
+    expect(executed).toEqual(['a.ts']);
+    await session.send('next');
+    expect(seen).toHaveLength(2);
+    expect(executed).toEqual(['a.ts']);
+    expect(rebuildHistory(await throughStore(events))).toEqual((session as any).history);
+  });
+
   it('text-only turn rebuilds exactly like v0 (plain user/assistant exchange)', async () => {
     const model = scriptedModel([stream(...textChunks('a', 'Hi there'), finishChunk('stop'))]);
     const session = new HarnessSession(makeOpts({}), async () => model as any); // no tools → v0 path
diff --git a/desktop/tests/harness-session-loop.test.ts b/desktop/tests/harness-session-loop.test.ts
index fe24ec842..455ce510c 100644
--- a/desktop/tests/harness-session-loop.test.ts
+++ b/desktop/tests/harness-session-loop.test.ts
@@ -163,6 +163,194 @@ describe('HarnessSession — multi-step turn driver', () => {
     expect(events.some(e => e.type === 'session-error')).toBe(true);
   });
 
+  it.each(['before calls', 'during first call', 'after final text'] as const)('accepts queued human input %s inside the same turn, after the whole batch runs', async (arrival) => {
+    const read = fakeTool('Read', { onExecute: () => {
+      if (arrival === 'during first call' && !(read as any).calls.slice(1).length) queue.push({ id: 'follow', text: 'correct this', attachments: [] });
+      return { text: 'done' };
+    } });
+    const queue: Array<{ id: string; text: string; attachments: string[] }> = [];
+    const prompts: any[] = [];
+    const model = scriptedModel(arrival === 'after final text'
+      ? [stream(...textChunks('a', 'first answer'), finishChunk('stop')), stream(...textChunks('b', 'updated'), finishChunk('stop'))]
+      : [stream(toolCallChunk('c1', 'Read', { file_path: 'a' }), toolCallChunk('c2', 'Read', { file_path: 'b' }), finishChunk('tool-calls')),
+        stream(...textChunks('b', 'updated'), finishChunk('stop'))], prompts);
+    const session = new HarnessSession(makeOpts({ tools: [read], decide: async () => ALLOW,
+      takeReadyBusyMessage: () => queue.shift(),
+    }), async () => model as any);
+    const events = collect(session);
+    if (arrival !== 'during first call') session.on('transcript-event', (e: TranscriptEvent) => {
+      if (arrival === 'before calls' && e.type === 'tool-use' && e.data.toolUseId === 'c2') queue.push({ id: 'follow', text: 'correct this', attachments: [] });
+      if (arrival === 'after final text' && e.type === 'assistant-text' && !events.some(event => event.type === 'user-message' && event.data.text === 'correct this') && queue.length === 0) queue.push({ id: 'follow', text: 'correct this', attachments: [] });
+    });
+    await session.send('original');
+    expect(prompts).toHaveLength(2);
+    expect(events.filter(e => e.type === 'user-message').map(e => e.data.text)).toEqual(['original', 'correct this']);
+    // The batch the assistant already chose runs in full; nothing is discarded.
+    expect((read as any).calls).toHaveLength(arrival === 'after final text' ? 0 : 2);
+    if (arrival !== 'after final text') {
+      const results = events.filter(e => e.type === 'tool-result');
+      expect(results).toHaveLength(2);
+      expect(results.every(e => !/not run/i.test(e.data.toolResult ?? ''))).toBe(true);
+      expect(events.indexOf(results[1])).toBeLessThan(events.findIndex(e => e.type === 'user-message' && e.data.text === 'correct this'));
+    }
+    expect(JSON.stringify(prompts[1])).toContain('correct this');
+    expect(session.acceptedHistory().eventUuids).toContain(events.find(e => e.type === 'user-message' && e.data.text === 'correct this')!.uuid);
+  });
+
+  it('consumes several ready duplicate messages in FIFO order without starting another turn', async () => {
+    const queue = ['same', 'same', 'last'].map((text, n) => ({ id: String(n), text, attachments: [] as string[] }));
+    const prompts: any[] = [];
+    const model = scriptedModel(Array.from({ length: 4 }, (_, n) =>
+      stream(...textChunks(`reply-${n}`, `answer-${n}`), finishChunk('stop'))), prompts);
+    const session = new HarnessSession(makeOpts({ takeReadyBusyMessage: () => queue.shift() }), async () => model as any);
+    const events = collect(session);
+    await session.send('first');
+    expect(events.filter(e => e.type === 'user-message').map(e => e.data.text)).toEqual(['first', 'same', 'same', 'last']);
+    expect(events.filter(e => e.type === 'turn-complete')).toHaveLength(1);
+    expect(prompts).toHaveLength(4);
+    expect(queue).toHaveLength(0);
+  });
+
+  it.each(['allow', 'deny'] as const)('leaves a pending approval open for busy input until the human answers %s', async (behavior) => {
+    let answer!: (decision: AskDecision) => void;
+    let asked!: () => void;
+    const open = new Promise<void>(resolve => { asked = resolve; });
+    const decision = new Promise<AskDecision>(resolve => { answer = resolve; });
+    const queue: Array<{ id: string; text: string; attachments: string[] }> = [];
+    const read = fakeTool('Read');
+    const seen: any[] = [];
+    const model = scriptedModel([
+      stream(toolCallChunk('c1', 'Read', { file_path: 'a' }), toolCallChunk('c2', 'Read', { file_path: 'b' }), finishChunk('tool-calls')),
+      stream(...textChunks('b', 'updated'), finishChunk('stop')),
+    ], seen);
+    const session = new HarnessSession(makeOpts({ tools: [read], decide: async () => ({ action: 'ask', denyListed: false }),
+      askUser: () => { asked(); return decision; }, takeReadyBusyMessage: () => queue.shift(),
+    }), async () => model as any);
+    const events = collect(session);
+    const turn = session.send('first');
+    await open;
+    queue.push({ id: 'follow', text: 'new instructions', attachments: [] });
+    expect(events.filter(e => e.type === 'user-message')).toHaveLength(1);
+    expect((read as any).calls).toHaveLength(0);
+    answer({ behavior } as AskDecision);
+    await turn;
+    expect((read as any).calls).toHaveLength(behavior === 'allow' ? 2 : 0);
+    expect(events.filter(e => e.type === 'tool-result')).toHaveLength(2);
+    expect(events.filter(e => e.type === 'user-message').map(e => e.data.text)).toEqual(['first', 'new instructions']);
+    expect(JSON.stringify(seen[1])).toContain('new instructions');
+  });
+
+  it('restores a claimed message when accepting its event throws', async () => {
+    const queue = [{ id: 'follow', text: 'survive', attachments: [] as string[] }];
+    const restored: string[] = [];
+    const model = scriptedModel([stream(...textChunks('a', 'first'), finishChunk('stop'))]);
+    const session = new HarnessSession(makeOpts({ tools: [], takeReadyBusyMessage: () => {
+      const item = queue.shift();
+      return item && { ...item, restore: () => { restored.push(item.id); queue.unshift(item); } };
+    } }), async () => model as any);
+    session.on('transcript-event', (e: TranscriptEvent) => {
+      if (e.type === 'user-message' && e.data.text === 'survive') throw new Error('append refused');
+    });
+    await session.send('first');
+    expect(restored).toEqual(['follow']);
+    expect(queue.map(item => item.text)).toEqual(['survive']);
+  });
+
+  it.each(['decision', 'approval broker'] as const)('pairs permission %s failure without executing announced calls and permits the next send', async (failure) => {
+    const read = fakeTool('Read');
+    const seen: any[] = [];
+    const model = scriptedModel([
+      stream(toolCallChunk('c1', 'Read', { file_path: 'a.ts' }), toolCallChunk('c2', 'Read', { file_path: 'b.ts' }), finishChunk('tool-calls')),
+      stream(...textChunks('next', 'next reply'), finishChunk('stop')),
+    ], seen);
+    const error = new Error('permission store EACCES');
+    const session = new HarnessSession(makeOpts({ tools: [read],
+      decide: async () => { if (failure === 'decision') throw error; return { action: 'ask', denyListed: false }; },
+      askUser: async () => { throw error; },
+    }), async () => model as any);
+    const events = collect(session);
+    await session.send('first');
+    expect(events.filter(e => e.type === 'tool-use').map(e => e.data.toolUseId)).toEqual(['c1', 'c2']);
+    const results = events.filter(e => e.type === 'tool-result');
+    expect(results.map(e => e.data.toolUseId)).toEqual(['c1', 'c2']);
+    expect(results.every(e => e.data.isError && !/user declined|user interrupted/i.test(e.data.toolResult))).toBe(true);
+    expect(results[0].data.toolResult).toContain('permission store EACCES');
+    expect(events.find(e => e.type === 'session-error')?.data.text).toContain('permission store EACCES');
+    expect((read as any).calls).toHaveLength(0);
+    await session.send('next');
+    expect(seen).toHaveLength(2);
+    expect(events.filter(e => e.type === 'session-error')).toHaveLength(1);
+  });
+
+  it.each(['decision', 'approval broker'] as const)('preserves a completed call when a later permission %s fails', async (failure) => {
+    const read = fakeTool('Read');
+    const model = scriptedModel([stream(
+      toolCallChunk('c1', 'Read', { file_path: 'a.ts' }),
+      toolCallChunk('c2', 'Read', { file_path: 'b.ts' }),
+      toolCallChunk('c3', 'Read', { file_path: 'c.ts' }), finishChunk('tool-calls'))]);
+    let decisions = 0;
+    const session = new HarnessSession(makeOpts({ tools: [read], decide: async () => {
+      if (++decisions === 2) {
+        if (failure === 'decision') throw new Error('permission lookup unavailable');
+        return { action: 'ask', denyListed: false };
+      }
+      return ALLOW;
+    }, askUser: async () => { throw new Error('permission lookup unavailable'); } }), async () => model as any);
+    const events = collect(session);
+    await session.send('go');
+    const results = events.filter(e => e.type === 'tool-result');
+    expect(results.map(e => e.data.toolUseId)).toEqual(['c1', 'c2', 'c3']);
+    expect(results[0].data.toolResult).toBe('Read ran');
+    expect(results[0].data.isError).toBe(false);
+    expect(results[1].data.toolResult).toContain('permission lookup unavailable');
+    expect(results[2].data.toolResult).toMatch(/not run/i);
+    expect((read as any).calls).toHaveLength(1);
+    expect(events.find(e => e.type === 'session-error')?.data.text).toContain('permission lookup unavailable');
+  });
+
+  it.each(['decision', 'approval broker'] as const)('reports a permission %s AbortError as a session error while the turn is live', async (failure) => {
+    const read = fakeTool('Read');
+    const seen: any[] = [];
+    const model = scriptedModel([
+      stream(toolCallChunk('c1', 'Read', { file_path: 'a.ts' }), toolCallChunk('c2', 'Read', { file_path: 'b.ts' }), finishChunk('tool-calls')),
+      stream(...textChunks('next', 'usable'), finishChunk('stop')),
+    ], seen);
+    const error = Object.assign(new Error('permission storage aborted independently'), { name: 'AbortError' });
+    const session = new HarnessSession(makeOpts({ tools: [read],
+      decide: async () => { if (failure === 'decision') throw error; return { action: 'ask', denyListed: false }; },
+      askUser: async () => { throw error; },
+    }), async () => model as any);
+    const events = collect(session);
+    await session.send('first');
+    expect(events.filter(e => e.type === 'tool-result').map(e => [e.data.toolUseId, e.data.isError])).toEqual([['c1', true], ['c2', true]]);
+    expect(events.find(e => e.type === 'tool-result')?.data.toolResult).toContain('permission storage aborted independently');
+    expect(events.find(e => e.type === 'session-error')?.data.text).toContain('permission storage aborted independently');
+    expect(events.some(e => e.type === 'user-interrupt')).toBe(false);
+    expect((read as any).calls).toHaveLength(0);
+    await session.send('next');
+    expect(seen).toHaveLength(2);
+    expect(events.filter(e => e.type === 'session-error')).toHaveLength(1);
+  });
+
+  it.each(['decision', 'approval broker'] as const)('keeps a genuinely interrupted turn interrupted after a permission %s AbortError', async (failure) => {
+    const read = fakeTool('Read');
+    const model = scriptedModel([stream(
+      toolCallChunk('c1', 'Read', { file_path: 'a.ts' }), toolCallChunk('c2', 'Read', { file_path: 'b.ts' }), finishChunk('tool-calls'))]);
+    const error = Object.assign(new Error('approval callback aborted'), { name: 'AbortError' });
+    let session: HarnessSession;
+    session = new HarnessSession(makeOpts({ tools: [read],
+      decide: async () => { if (failure === 'decision') { session.interrupt(); throw error; } return { action: 'ask', denyListed: false }; },
+      askUser: async () => { session.interrupt(); throw error; },
+    }), async () => model as any);
+    const events = collect(session);
+    await session.send('first');
+    expect(events.filter(e => e.type === 'tool-result').map(e => e.data.toolUseId)).toEqual(['c1', 'c2']);
+    expect(events.find(e => e.type === 'tool-result')?.data.toolResult).toContain('approval callback aborted');
+    expect(events.filter(e => e.type === 'user-interrupt')).toHaveLength(1);
+    expect(events.some(e => e.type === 'session-error')).toBe(false);
+    expect((read as any).calls).toHaveLength(0);
+  });
+
   it('happy path: emits user-message → text → tool-use → tool-result → text → turn-complete IN ORDER', async () => {
     const read = fakeTool('Read');
     const model = scriptedModel([
@@ -683,6 +871,26 @@ describe('HarnessSession — multi-step turn driver', () => {
     expect(events.find((event) => event.type === 'turn-complete')?.data.stopReason).toBe('end_turn');
   });
 
+  it('a message that joins the running turn starts the keep-going count over', async () => {
+    const twoStepHarness: HarnessManifest = { ...HARNESS, limits: { maxSteps: 2, maxTokens: 256 } };
+    const queue: Array<{ id: string; text: string; attachments: string[] }> = [];
+    const write = fakeTool('Write', { onExecute: () => {
+      // Arrives during the SECOND step: without a reset that step would reach
+      // the two-step limit and ask "keep going?".
+      if ((write as any).calls.length === 2) queue.push({ id: 'f', text: 'also do this', attachments: [] });
+      return { text: 'ok' };
+    } });
+    const askUser = vi.fn(async (_r: AskRequest): Promise<AskDecision> => ({ behavior: 'deny' }));
+    const tc = () => stream(toolCallChunk('c', 'Write', { file_path: 'x.ts' }), finishChunk('tool-calls'));
+    const model = scriptedModel([tc(), tc(), tc(), stream(...textChunks('z', 'done'), finishChunk('stop'))]);
+    const session = new HarnessSession(makeOpts({ harness: twoStepHarness, tools: [write], decide: async () => ALLOW, askUser,
+      takeReadyBusyMessage: () => queue.shift() }), async () => model as any);
+    const events = collect(session);
+    await session.send('go');
+    expect(askUser.mock.calls.some((c) => c[0].toolName === 'max_steps')).toBe(false);
+    expect(events.find((e) => e.type === 'turn-complete')!.data.stopReason).toBe('end_turn');
+  });
+
   it('maxSteps: allow → loop continues (counter resets); deny → turn-complete stopReason max_steps', async () => {
     const twoStepHarness: HarnessManifest = { ...HARNESS, limits: { maxSteps: 2, maxTokens: 256 } };
     // deny path: two tool-calls hit the budget, ask denies → stopReason max_steps.
@@ -766,6 +974,60 @@ describe('HarnessSession — multi-step turn driver', () => {
     expect(events.some((e) => e.type === 'session-error')).toBe(false);
   });
 
+  it.each([503, 429, 'ECONNRESET'] as const)('retracts abandoned text and reasoning before transient retry %s', async (failureKind) => {
+    const failure = Object.assign(new Error('transient failure'), typeof failureKind === 'number'
+      ? { statusCode: failureKind } : { code: failureKind });
+    const seen: any[] = [];
+    const model = scriptedModel([
+      stream(...textChunks('abandoned', 'ABANDONED_ATTEMPT'), ...reasoningChunks('thought', 'old reasoning'),
+        ...toolInputChunks('pending', 'Read', { file_path: 'pending' }), { type: 'error', error: failure }),
+      stream(...textChunks('replacement', 'SUCCESSFUL_ATTEMPT'), finishChunk('stop')),
+    ], seen);
+    const session = new HarnessSession(makeOpts({ retryDelays: [1], tools: [fakeTool('Read')] }), async () => model as any);
+    const events = collect(session);
+    await session.send('go');
+    const dropIndex = events.findIndex(e => e.data.dropPart);
+    const replacementIndex = events.findIndex(e => e.type === 'assistant-text' && e.data.text === 'SUCCESSFUL_ATTEMPT');
+    expect(dropIndex).toBeGreaterThanOrEqual(0);
+    expect(dropIndex).toBeLessThan(replacementIndex);
+    expect(events[dropIndex].data.dropPart.partIds).toEqual(expect.arrayContaining(['abandoned', 'thought']));
+    expect(events.some(e => e.data.toolPreparing?.toolCallId === 'pending' && e.data.toolPreparing.cleared)).toBe(true);
+    expect(JSON.stringify(session.acceptedHistory())).not.toContain('ABANDONED_ATTEMPT');
+    expect(JSON.stringify((session as any).history)).not.toContain('ABANDONED_ATTEMPT');
+    expect(events.some(e => e.type === 'turn-complete')).toBe(true);
+    expect(seen).toHaveLength(2);
+  });
+
+  it('does not restore abandoned retry text if its replacement fails before text', async () => {
+    const failure = Object.assign(new Error('temporary'), { statusCode: 503 });
+    const model = scriptedModel([
+      stream(...textChunks('old', 'ABANDONED_ATTEMPT'), { type: 'error', error: failure }),
+      stream({ type: 'error', error: new Error('replacement failed') }),
+    ]);
+    const session = new HarnessSession(makeOpts({ retryDelays: [1] }), async () => model as any);
+    const events = collect(session);
+    await session.send('go');
+    expect(events.some(e => e.data.dropPart?.partIds.includes('old'))).toBe(true);
+    expect(events.some(e => e.type === 'session-error')).toBe(true);
+    expect(JSON.stringify((session as any).history)).not.toContain('ABANDONED_ATTEMPT');
+    expect(JSON.stringify(session.acceptedHistory())).not.toContain('ABANDONED_ATTEMPT');
+  });
+
+  it('keeps the final failed attempt partial when the transient retry budget is exhausted', async () => {
+    const failure = Object.assign(new Error('temporary'), { statusCode: 503 });
+    const model = scriptedModel([
+      stream(...textChunks('old', 'abandoned'), { type: 'error', error: failure }),
+      stream(...textChunks('new', 'final partial'), { type: 'error', error: failure }),
+    ]);
+    const session = new HarnessSession(makeOpts({ retryDelays: [1] }), async () => model as any);
+    const events = collect(session);
+    await session.send('go');
+    expect(events.filter(e => e.data.dropPart)).toHaveLength(1);
+    expect(JSON.stringify((session as any).history)).toContain('final partial');
+    expect(JSON.stringify((session as any).history)).not.toContain('abandoned');
+    expect(events.some(e => e.type === 'session-error')).toBe(true);
+  });
+
   it('tool-layer guard: path OUTSIDE cwd forces an ask even when decide() allows (external_directory)', async () => {
     // permissionSubject returns an absolute path outside the session cwd (C:/x)
     // → checkPathGuard verdict 'external' → forced ask, short-circuiting decide().
@@ -2439,6 +2701,29 @@ describe('HarnessSession — empty final step recovery', () => {
     expect(JSON.stringify(history.at(-1))).toContain('recovered');
   });
 
+  it('accepts ready busy input after a second empty response within the same turn', async () => {
+    const queue: Array<{ id: string; text: string; attachments: string[] }> = [];
+    const prompts: any[] = [];
+    const scripts = [stream(finishChunk('stop')), stream(finishChunk('stop')),
+      stream(finishChunk('stop')), stream(...textChunks('reply', 'answer to correction'), finishChunk('stop'))];
+    let requests = 0;
+    const model = new MockLanguageModelV4({ doStream: async (request: any) => {
+      prompts.push(request.prompt);
+      const index = requests++;
+      if (index === 1) queue.push({ id: 'correction', text: 'please correct that', attachments: [] });
+      return { stream: simulateReadableStream({ chunks: scripts[index] ?? scripts.at(-1)! }) };
+    } });
+    const session = new HarnessSession(makeOpts({ takeReadyBusyMessage: () => queue.shift() }), async () => model as any);
+    const events = collect(session);
+    await session.send('original');
+    expect(prompts).toHaveLength(4); // two empty attempts before AND one permitted retry after the new input
+    expect(JSON.stringify(prompts[2])).toContain('please correct that');
+    expect(queue).toHaveLength(0);
+    expect(events.filter(e => e.type === 'user-message').map(e => e.data.text)).toEqual(['original', 'please correct that']);
+    expect(events.filter(e => e.type === 'turn-complete').map(e => e.data.stopReason)).toEqual(['end_turn']);
+    expect(session.acceptedHistory().eventUuids).toContain(events.find(e => e.type === 'user-message' && e.data.text === 'please correct that')!.uuid);
+  });
+
   it('case 2: empty twice consecutively → empty_response; usage sums BOTH attempts; no empty history', async () => {
     const seen: any[] = [];
     const model = scriptedModel([
diff --git a/desktop/tests/ipc-channels.test.ts b/desktop/tests/ipc-channels.test.ts
index c6565c8b7..c410172a2 100644
--- a/desktop/tests/ipc-channels.test.ts
+++ b/desktop/tests/ipc-channels.test.ts
@@ -995,6 +995,7 @@ describe('native:*/provider:* channel parity', () => {
     'native:set-step-guard': 'IPC.NATIVE_SET_STEP_GUARD',
     'native:sessions-list': 'IPC.NATIVE_SESSIONS_LIST',
     'native:queue-remove': 'IPC.NATIVE_QUEUE_REMOVE',
+    'native:queue-send-now': 'IPC.NATIVE_QUEUE_SEND_NOW',
     'native:compact': 'IPC.NATIVE_COMPACT',
     'native:clear': 'IPC.NATIVE_CLEAR',
     'provider:list': 'IPC.PROVIDER_LIST', 'provider:upsert': 'IPC.PROVIDER_UPSERT',
diff --git a/desktop/tests/item-list-authority.test.ts b/desktop/tests/item-list-authority.test.ts
deleted file mode 100644
index d77aafb8d..000000000
--- a/desktop/tests/item-list-authority.test.ts
+++ /dev/null
@@ -1,45 +0,0 @@
-// desktop/tests/item-list-authority.test.ts
-import { describe, it, expect } from 'vitest';
-import { inScopeFiles, readStripped } from './helpers/guard-scope';
-
-// "No bare glyph survives..." and "no in-menu copy tells the user to press a
-// control that was removed" converted to ast-grep rules —
-// scripts/ast-grep/rules/no-bare-glyph-item-action.yml and
-// -stale-copy.yml (Plan B, 2026-09-16). Those rules' `ignores:` exempt
-// QueuedMessagesStrip.tsx WHOLESALE, weaker than what this test used to
-// check: the retired test asserted the exemption's count is EXACTLY 1 (not
-// "0 or more"). A whole-file `ignores:` cannot express "at most 1 here", so
-// per global.md's "at most N matches" guidance this ONE case stays.
-//
-// Dropped, not converted: "this guard can see what it claims to cover"
-// (assertScopeIsPopulated) — a pure scan-count non-vacuity check with
-// nothing left to guard once the shape check is an ast-grep rule; the
-// fixture pass in scripts/ast-grep/check.sh is the non-vacuity check now.
-const GLYPH_EXEMPT: Record<string, { count: number; why: string }> = {
-  'QueuedMessagesStrip.tsx': {
-    count: 1,
-    why: 'already a <Button variant="ghost" size="icon"> with a real aria-label and focus ring — '
-      + 'the glyph is its visible label, not a hand-rolled button. Compact composer strip, not a settings list.',
-  },
-};
-
-// FIX (review of batch B, 2026-09-16): restored to readStripped (comment-
-// stripped), as the original did — a bare readSource would trip on a WHY
-// comment quoting this exact glyph pattern.
-function bareGlyphs(src: string): number {
-  return [...src.matchAll(/>\s*✕\s*</g)].length;
-}
-
-describe('item list actions', () => {
-  it('every exemption still exists and still applies', () => {
-    const byName = new Map(inScopeFiles().map((p) => [p.split(/[\\/]/).pop()!, p]));
-    for (const [file, { count, why }] of Object.entries(GLYPH_EXEMPT)) {
-      const abs = byName.get(file);
-      expect(abs, `${file} is exempted but no longer in scope — drop it`).toBeTruthy();
-      expect(
-        bareGlyphs(readStripped(abs!)),
-        `${file} (${why}) no longer has ${count} — update or drop the exemption`,
-      ).toBe(count);
-    }
-  });
-});
diff --git a/desktop/tests/mcp-manager.test.ts b/desktop/tests/mcp-manager.test.ts
index c33bf1d8f..b3c173b12 100644
--- a/desktop/tests/mcp-manager.test.ts
+++ b/desktop/tests/mcp-manager.test.ts
@@ -1,5 +1,6 @@
 import { describe, it, expect, vi } from 'vitest';
-import { McpManager } from '../src/main/harness/mcp/mcp-manager';
+import { McpManager, redactSecrets } from '../src/main/harness/mcp/mcp-manager';
+import type { ResolvedMcpServer } from '../src/main/harness/mcp/types';
 
 function deps(connectSpy = vi.fn(), closeSpy = vi.fn()) {
   const registry = {
@@ -19,6 +20,230 @@ function deps(connectSpy = vi.fn(), closeSpy = vi.fn()) {
 }
 
 describe('McpManager', () => {
+  function generationHarness() {
+    let current: ResolvedMcpServer[] = [{ id: 'demo', label: 'Demo', enabled: true,
+      transport: { type: 'stdio', command: 'old', args: ['a'] }, origin: { kind: 'user' }, missingSecrets: [], env: { TOKEN: 'OLD' } }];
+    const connections: Array<{ config: ResolvedMcpServer; close: ReturnType<typeof vi.fn>; get closed(): boolean }> = [];
+    const manager = new McpManager({ registry: { resolveAllEnabled: async () => current },
+      connectionFactory: (config) => {
+        let closed = false;
+        const entry = { config, close: vi.fn(async () => { closed = true; }), get closed() { return closed; } };
+        connections.push(entry);
+        return { get state() { return closed ? 'idle' as const : 'ready' as const; }, lastError: null,
+          connect: async () => {}, listTools: () => [{ name: 'search', inputSchema: { type: 'object' } }],
+          callTool: async () => ({ text: config.env?.TOKEN ?? '', isError: closed }), close: entry.close };
+      } });
+    return { manager, connections, get current() { return current; }, set current(value: ResolvedMcpServer[]) { current = value; } };
+  }
+
+  it('keeps existing holders on old config while command and resolved credential changes create a new connection', async () => {
+    const h = generationHarness();
+    const old = await h.manager.acquire('old');
+    h.current[0].transport = { type: 'stdio', command: 'new', args: ['b'] }; // mutate SAME registry object
+    h.current[0].env!.TOKEN = 'NEW';
+    const fresh = await h.manager.acquire('fresh');
+    expect(h.connections).toHaveLength(2);
+    expect((await old.servers[0].call('search', {}, new AbortController().signal)).text).toBe('OLD');
+    expect((await fresh.servers[0].call('search', {}, new AbortController().signal)).text).toBe('NEW');
+    expect(h.manager.status().map(s => s.id)).toEqual(['demo']);
+    await old.release();
+    expect(h.connections[0].close).toHaveBeenCalledTimes(1);
+    expect(h.connections[1].close).not.toHaveBeenCalled();
+    await fresh.release();
+    expect(h.connections[1].close).toHaveBeenCalledTimes(1);
+  });
+
+  it('reuses unchanged config despite label changes and creates new generations for A to B to A', async () => {
+    const h = generationHarness();
+    const a1 = await h.manager.acquire('a1');
+    h.current = [{ ...h.current[0], label: 'Renamed' }];
+    const a2 = await h.manager.acquire('a2');
+    expect(h.connections).toHaveLength(1);
+    expect(a2.servers[0].label).toBe('Renamed');
+    h.current = [{ ...h.current[0], env: { TOKEN: 'B' } }];
+    const b = await h.manager.acquire('b');
+    h.current = [{ ...h.current[0], env: { TOKEN: 'OLD' } }];
+    const a3 = await h.manager.acquire('a3');
+    expect(h.connections).toHaveLength(3);
+    await a1.release(); await a2.release(); await b.release();
+    expect(h.connections[2].close).not.toHaveBeenCalled();
+    await a3.release();
+    expect(h.connections.map(c => c.close.mock.calls.length)).toEqual([1, 1, 1]);
+  });
+
+  it('compares HTTP url and headers, stdio cwd and args, and setup state without leaking old holders', async () => {
+    const h = generationHarness();
+    const leases = [await h.manager.acquire('a')];
+    for (const transport of [
+      { type: 'stdio' as const, command: 'old', args: ['a'], cwd: '/work' },
+      { type: 'http' as const, url: 'https://one.invalid' },
+      { type: 'http' as const, url: 'https://two.invalid' },
+    ]) {
+      h.current = [{ ...h.current[0], transport }];
+      leases.push(await h.manager.acquire('next'));
+    }
+    h.current = [{ ...h.current[0], headers: { Authorization: 'BEARER' } }];
+    leases.push(await h.manager.acquire('header'));
+    h.current = [{ ...h.current[0], missingSecrets: ['AUTH'], headers: {} }];
+    leases.push(await h.manager.acquire('missing'));
+    expect(leases.at(-1)!.servers).toEqual([]);
+    h.current = [{ ...h.current[0], missingSecrets: [], headers: { Authorization: 'BEARER' } }];
+    leases.push(await h.manager.acquire('restored'));
+    expect(h.connections).toHaveLength(6);
+    expect(leases.at(-1)!.servers).toHaveLength(1);
+    expect(h.manager.status()).toHaveLength(1);
+    for (const lease of leases) await lease.release();
+    expect(h.connections.every(c => c.close.mock.calls.length === 1)).toBe(true);
+  });
+
+  it('does not attach a disabled server to a new lease while an older snapshot works', async () => {
+    const h = generationHarness();
+    const old = await h.manager.acquire('old');
+    h.current = [];
+    const next = await h.manager.acquire('next');
+    expect(next.servers).toEqual([]);
+    expect((await old.servers[0].call('search', {}, new AbortController().signal)).text).toBe('OLD');
+    await next.release(); await old.release();
+    expect(h.connections[0].close).toHaveBeenCalledTimes(1);
+  });
+
+  it('closes retired and current generations in destroyAll without double closing after release', async () => {
+    const h = generationHarness();
+    const a = await h.manager.acquire('a');
+    h.current = [{ ...h.current[0], env: { TOKEN: 'B' } }];
+    const b = await h.manager.acquire('b');
+    await h.manager.destroyAll();
+    expect(h.connections.map(c => c.close.mock.calls.length)).toEqual([1, 1]);
+    expect(h.manager.status()).toEqual([]);
+    await a.release(); await b.release();
+    expect(h.connections.map(c => c.close.mock.calls.length)).toEqual([1, 1]);
+  });
+  it('destroyAll waits for a released generation already closing, including repeated teardown', async () => {
+    let finishClose!: () => void;
+    const closeBlocked = new Promise<void>(resolve => { finishClose = resolve; });
+    let closeStarted!: () => void;
+    const started = new Promise<void>(resolve => { closeStarted = resolve; });
+    const close = vi.fn(async () => { closeStarted(); await closeBlocked; });
+    const mgr = new McpManager({ registry: deps().registry, connectionFactory: () => ({
+      state: 'ready' as const, lastError: null, connect: async () => {}, listTools: () => [],
+      callTool: async () => ({ text: 'ok', isError: false }), close,
+    }) });
+    const lease = await mgr.acquire('old');
+    const releasing = lease.release();
+    await started; // deterministic: close has begun; no timer or sleep
+    let firstSettled = false;
+    let secondSettled = false;
+    const first = mgr.destroyAll().then(() => { firstSettled = true; });
+    const second = mgr.destroyAll().then(() => { secondSettled = true; });
+    try {
+      // Let every already-resolved close and teardown continuation run; the
+      // blocked close alone must keep destroyAll pending.
+      await new Promise<void>(resolve => setImmediate(resolve));
+      expect(firstSettled).toBe(false);
+      expect(secondSettled).toBe(false);
+      expect(close).toHaveBeenCalledTimes(1);
+    } finally {
+      finishClose();
+      await Promise.all([releasing, first, second]);
+    }
+    expect(close).toHaveBeenCalledTimes(1);
+    expect(mgr.status()).toEqual([]);
+  });
+
+  it('destroyAll waits for retiring generations and does not clobber a newly current ID', async () => {
+    let command = 'A';
+    let finishOld!: () => void;
+    const oldBlocked = new Promise<void>(resolve => { finishOld = resolve; });
+    let oldStarted!: () => void;
+    const started = new Promise<void>(resolve => { oldStarted = resolve; });
+    const closes = new Map<string, ReturnType<typeof vi.fn>>();
+    const factory = vi.fn((server: ResolvedMcpServer) => {
+      const name = server.transport.type === 'stdio' ? server.transport.command : '';
+      const close = vi.fn(async () => { if (name === 'A') { oldStarted(); await oldBlocked; } });
+      closes.set(name, close);
+      return { state: 'ready' as const, lastError: null, connect: async () => {}, listTools: () => [],
+        callTool: async () => ({ text: name, isError: false }), close };
+    });
+    const mgr = new McpManager({ registry: { resolveAllEnabled: async (): Promise<ResolvedMcpServer[]> => [
+      { id: 'demo', label: 'Demo', enabled: true, origin: { kind: 'user' }, missingSecrets: [],
+        transport: { type: 'stdio', command } },
+    ] }, connectionFactory: factory });
+    const a = await mgr.acquire('a');
+    command = 'B';
+    const b = await mgr.acquire('b');
+    const releaseA = a.release();
+    await started;
+    let settled = false;
+    const destroying = mgr.destroyAll().then(() => { settled = true; });
+    try {
+      await new Promise<void>(resolve => setImmediate(resolve));
+      expect(settled).toBe(false); // B closed; released A still pending
+      expect(closes.get('B')).toHaveBeenCalledTimes(1);
+      // A post-destroy acquisition gets C, not a stale entry or a hold on A/B.
+      command = 'C';
+      const c = await mgr.acquire('c');
+      try {
+        expect(factory).toHaveBeenCalledTimes(3);
+        expect(mgr.status()).toHaveLength(1);
+        await b.release(); // old lease cannot remove current C
+        expect(mgr.status()).toHaveLength(1);
+      } finally {
+        await c.release();
+      }
+    } finally {
+      finishOld();
+      await Promise.all([releaseA, destroying]);
+    }
+    expect(closes.get('A')).toHaveBeenCalledTimes(1);
+    expect(closes.get('B')).toHaveBeenCalledTimes(1);
+    expect(closes.get('C')).toHaveBeenCalledTimes(1);
+  });
+
+  it('a new acquisition during an old generation close cannot inherit the closing connection', async () => {
+    let command = 'A';
+    let finishClose!: () => void;
+    const closing = new Promise<void>(resolve => { finishClose = resolve; });
+    const close = vi.fn();
+    const factory = vi.fn((s: ResolvedMcpServer) => ({ state: 'ready' as const, lastError: null,
+      connect: async () => {}, listTools: () => [],
+      callTool: async () => ({ text: (s.transport as { command: string }).command, isError: false }),
+      close: async () => { close(s.transport); if ((s.transport as { command: string }).command === 'A') await closing; } }));
+    const mgr = new McpManager({ registry: { resolveAllEnabled: async () => [{ id: 'demo', label: 'Demo', enabled: true,
+      origin: { kind: 'user' as const }, missingSecrets: [], transport: { type: 'stdio' as const, command } }] }, connectionFactory: factory });
+    const a = await mgr.acquire('a');
+    command = 'B';
+    const b = await mgr.acquire('b');
+    const releaseA = a.release();
+    expect(close).toHaveBeenCalledTimes(1);
+    command = 'A';
+    const next = await mgr.acquire('next');
+    expect(factory).toHaveBeenCalledTimes(3);
+    expect((await next.servers[0].call('tool', {}, new AbortController().signal)).text).toBe('A');
+    finishClose(); await releaseA;
+    expect(mgr.status()).toHaveLength(1);
+    await b.release(); await next.release();
+    expect(close).toHaveBeenCalledTimes(3);
+  });
+
+  it('keeps a failed connect generation for existing holders but replaces it after settings change', async () => {
+    let command = 'broken';
+    const factory = vi.fn((s: ResolvedMcpServer) => ({
+      state: s.transport.type === 'stdio' && s.transport.command === 'broken' ? 'error' as const : 'ready' as const,
+      lastError: s.transport.type === 'stdio' && s.transport.command === 'broken' ? 'spawn failed' : null,
+      connect: async () => {}, listTools: () => [], callTool: async () => ({ text: 'ok', isError: false }), close: async () => {},
+    }));
+    const mgr = new McpManager({ registry: { resolveAllEnabled: async () => [{ id: 'demo', label: 'Demo', enabled: true,
+      origin: { kind: 'user' as const }, missingSecrets: [], transport: { type: 'stdio' as const, command } }] }, connectionFactory: factory });
+    const failed = await mgr.acquire('failed');
+    expect(failed.servers).toEqual([]);
+    command = 'fixed';
+    const good = await mgr.acquire('good');
+    expect(good.servers).toHaveLength(1);
+    expect(mgr.status()).toEqual([{ id: 'demo', state: 'ready', error: null }]);
+    expect(factory).toHaveBeenCalledTimes(2);
+    await failed.release(); await good.release();
+  });
+
   it('connects a server once for two sessions', async () => {
     const connect = vi.fn();
     const mgr = new McpManager(deps(connect));
@@ -333,3 +558,23 @@ describe('McpManager', () => {
     expect(mgr.status().find(s => s.id === 'bad')?.error).toContain('ENOENT');
   });
 });
+
+describe('redactSecrets', () => {
+  it('keeps the real failure reason but blanks every credential the server was given', () => {
+    const server = { env: { API_KEY: 'sk-live-123456', DEBUG: '1' }, headers: { Authorization: 'Bearer tok_abcdefgh' } };
+    const text = 'spawn node ENOENT; key sk-live-123456 rejected; token tok_abcdefgh expired; DEBUG=1';
+    expect(redactSecrets(text, server)).toBe('spawn node ENOENT; key [redacted] rejected; token [redacted] expired; DEBUG=1');
+    expect(redactSecrets(null, server)).toBeNull();
+  });
+
+  it('also blanks credentials written into the launch command or the server address', () => {
+    const stdio = { env: {}, headers: {}, transport: { type: 'stdio' as const, command: 'npx',
+      args: ['-y', 'some-server', '--api-key', 'sk-cmd-9876', '--token=tok-inline-5432', '--root', '/home/me/notes'] } };
+    expect(redactSecrets('spawn failed: npx -y some-server --api-key sk-cmd-9876 --token=tok-inline-5432 --root /home/me/notes', stdio))
+      .toBe('spawn failed: npx -y some-server --api-key [redacted] --token=[redacted] --root /home/me/notes');
+
+    const http = { env: {}, headers: {}, transport: { type: 'http' as const, url: 'https://bobby:hunter22@mcp.example.com/sse?api_key=live%2Fabc123&region=eu-west' } };
+    expect(redactSecrets('GET https://bobby:hunter22@mcp.example.com/sse?api_key=live%2Fabc123&region=eu-west -> 401 for live/abc123', http))
+      .toBe('GET https://[redacted]:[redacted]@mcp.example.com/sse?api_key=[redacted]&region=[redacted] -> 401 for [redacted]');
+  });
+});
diff --git a/desktop/tests/mock-shim.test.ts b/desktop/tests/mock-shim.test.ts
index 844e37430..d1acf5429 100644
--- a/desktop/tests/mock-shim.test.ts
+++ b/desktop/tests/mock-shim.test.ts
@@ -23,6 +23,38 @@ describe('channels', () => {
     createMockShim(createStore(scenario)) as any;
 
   describe('workbench channels', () => {
+    it('answers the seeded native question request once and emits its distinct tool result', async () => {
+      vi.stubGlobal('location', { search: '?seed=bubbles-questions-native' });
+      try {
+        const c = shim();
+        const events: any[] = [];
+        c.on.transcriptEvent((e: any) => events.push(e));
+        const updatedInput = { orderedAnswers: [{ answer: 'Blue', note: 'lighter' }, { answer: 'teal trim' }] };
+        expect(await c.session.respondToPermission('native-d4-visual', { decision: { behavior: 'allow', updatedInput } })).toBe(true);
+        expect(events.filter(e => e.type === 'tool-result')).toEqual([expect.objectContaining({
+          sessionId: 'wb-2', data: expect.objectContaining({ toolUseId: 'd4-native-ask', isError: false,
+            toolResult: expect.stringContaining('teal trim') }),
+        })]);
+        expect(events[0].data.toolResult).toContain('Blue');
+        expect(events[0].data.toolResult).toContain('lighter');
+        expect(events.map(e => e.type)).toEqual(['tool-result', 'turn-complete']);
+        expect(await c.session.respondToPermission('native-d4-visual', { decision: { behavior: 'allow', updatedInput } })).toBe(false);
+      } finally { vi.unstubAllGlobals(); }
+    });
+
+    it('dismisses the seeded native question once through the same fixture response', async () => {
+      vi.stubGlobal('location', { search: '?seed=bubbles-questions-native' });
+      try {
+        const c = shim();
+        const events: any[] = [];
+        c.on.transcriptEvent((e: any) => events.push(e));
+        expect(await c.session.respondToPermission('native-d4-visual', { decision: { behavior: 'deny' } })).toBe(true);
+        expect(events.map(e => e.type)).toEqual(['tool-result', 'turn-complete']);
+        expect(events[0].data.isError).toBe(true);
+        expect(events[1].data.stopReason).toBe('question_dismissed');
+      } finally { vi.unstubAllGlobals(); }
+    });
+
     it('session.browse returns the seeded past sessions', async () => {
       expect((await shim().session.browse()).length).toBeGreaterThan(0);
     });
diff --git a/desktop/tests/native-clear-barrier.test.ts b/desktop/tests/native-clear-barrier.test.ts
index 33368cea5..e39da3805 100644
--- a/desktop/tests/native-clear-barrier.test.ts
+++ b/desktop/tests/native-clear-barrier.test.ts
@@ -88,6 +88,16 @@ describe('rebuildHistory — context-clear barrier', () => {
 });
 
 describe('HarnessSession.clearHistory', () => {
+  it('forgets source-labelled rule visibility at the successful clear barrier', () => {
+    const s = new HarnessSession({ skillCatalog: EMPTY_SKILL_CATALOG, sessionId: 'rule-clear', cwd: '/tmp/x',
+      harness: ASSISTANT_PRESET, binding: { providerId: 'openrouter', modelId: 'm' } } as any,
+    async () => new MockLanguageModelV4({ doStream: async () => ({ stream: new ReadableStream({ start(c) { c.close(); } }) as any }) }) as any);
+    (s as any).injectedTriggerIds.add('rule:id');
+    (s as any).retainedTriggerMessages.add('<project-rule source="r">\nRule\n</project-rule>');
+    expect(s.clearHistory()).toEqual({ ok: true });
+    expect((s as any).injectedTriggerIds.size).toBe(0);
+    expect((s as any).retainedTriggerMessages.size).toBe(0);
+  });
   const OPTS = { skillCatalog: EMPTY_SKILL_CATALOG, sessionId: 's-1', cwd: '/tmp/x', harness: ASSISTANT_PRESET, binding: { providerId: 'openrouter', modelId: 'm' } };
 
   function session() {
diff --git a/desktop/tests/native-compact.test.ts b/desktop/tests/native-compact.test.ts
index 193ba438d..b1a43309f 100644
--- a/desktop/tests/native-compact.test.ts
+++ b/desktop/tests/native-compact.test.ts
@@ -53,6 +53,20 @@ function collect(session: HarnessSession): TranscriptEvent[] {
 }
 
 describe('HarnessSession.compactNow — user-initiated /compact', () => {
+  it('retains only source-labelled rule messages outside the committed summary span', async () => {
+    const { markAppGenerated } = await import('../src/main/harness/compaction');
+    const oldRule = '<project-rule source="rules/old.md">\nOld\n</project-rule>';
+    const keptRule = '<project-rule source="rules/new.md">\nNew\n</project-rule>';
+    const session = new HarnessSession(OPTS as any, async () => textModel('Summary mentions Old'));
+    session.seedHistory([
+      { role: 'user', content: 'old request' }, markAppGenerated({ role: 'user', content: oldRule } as any),
+      { role: 'assistant', content: 'old answer' }, { role: 'user', content: 'recent request' },
+      { role: 'user', content: 'latest request' }, markAppGenerated({ role: 'user', content: keptRule } as any),
+    ] as any);
+    expect(await session.compactNow()).toEqual({ ok: true });
+    expect((session as any).retainedTriggerMessages.has(oldRule)).toBe(false);
+    expect((session as any).retainedTriggerMessages.has(keptRule)).toBe(true);
+  });
   it('summarizes, emits compact-summary, and replaces history with summary + recent turns', async () => {
     const session = seeded(4, textModel('Earlier: user asked about X; we did Y.'));
     const events = collect(session);
diff --git a/desktop/tests/native-image-attachments.test.ts b/desktop/tests/native-image-attachments.test.ts
index 28d80c0cc..9d2f0c187 100644
--- a/desktop/tests/native-image-attachments.test.ts
+++ b/desktop/tests/native-image-attachments.test.ts
@@ -190,6 +190,43 @@ describe('HarnessSession.send — attachments become image parts', () => {
     return seen.find((m: any) => m.role === 'user');
   }
 
+  it.each([true, false])('keeps a busy image message as a real human event (vision %s)', async (supportsVision) => {
+    const { HarnessSession } = await import('../src/main/harness/harness-session');
+    const { ASSISTANT_PRESET } = await import('../src/shared/harness-manifest');
+    const { EMPTY_SKILL_CATALOG } = await import('./helpers/harness-fakes');
+    const { MockLanguageModelV4, simulateReadableStream } = await import('ai/test');
+    const p = path.join(dir, 'shot.png');
+    fs.writeFileSync(p, PNG);
+    const prompts: any[] = [];
+    const model = new MockLanguageModelV4({ doStream: async (req: any) => {
+      prompts.push(req.prompt);
+      return { stream: simulateReadableStream({ chunks: [
+        { type: 'stream-start', warnings: [] },
+        { type: 'text-start', id: 'reply' }, { type: 'text-delta', id: 'reply', delta: 'ok' }, { type: 'text-end', id: 'reply' },
+        { type: 'finish', finishReason: { unified: 'stop' }, usage: { inputTokens: { total: 1 }, outputTokens: { total: 1 } } },
+      ] }) };
+    } });
+    const events: any[] = [];
+    let queued = true;
+    const session = new HarnessSession({ sessionId: 'busy-img', cwd: dir, harness: ASSISTANT_PRESET,
+      binding: { providerId: 'openrouter', modelId: 'm' }, skillCatalog: EMPTY_SKILL_CATALOG,
+      profile: { ...CLOUD_DEFAULT, supportsVision },
+      takeReadyBusyMessage: () => {
+        if (!queued) return;
+        queued = false;
+        return { id: 'image', text: '', attachments: [p] };
+      },
+    }, async () => model as any);
+    session.on('transcript-event', event => events.push(event));
+    await session.send('first');
+    expect(prompts).toHaveLength(2);
+    const input = prompts[1].filter((m: any) => m.role === 'user').at(-1);
+    expect(input.content.some((part: any) => part.type === 'file')).toBe(supportsVision);
+    const event = events.find(e => e.type === 'user-message' && e.data.attachments?.[0] === p);
+    expect(event.data.text).toBe('');
+    expect(session.acceptedHistory().eventUuids).toContain(event.uuid);
+  });
+
   it('attaches the pixels for a vision-capable model', async () => {
     const p = path.join(dir, 'shot.png');
     fs.writeFileSync(p, PNG);
diff --git a/desktop/tests/native-permission-broker.test.ts b/desktop/tests/native-permission-broker.test.ts
index 78cd65464..91e1dce84 100644
--- a/desktop/tests/native-permission-broker.test.ts
+++ b/desktop/tests/native-permission-broker.test.ts
@@ -121,6 +121,18 @@ describe('PermissionBroker', () => {
     expect(d.dismissed).toBeFalsy();
   });
 
+  it('passes native ordered answers through the existing decision envelope without remapping', async () => {
+    const broker = new PermissionBroker();
+    const emitted: any[] = [];
+    broker.on('hook-event', e => emitted.push(e));
+    const questions = [{ question: 'Same?' }, { question: 'Same?' }];
+    const pending = broker.ask({ sessionId: 's1', toolName: 'AskUserQuestion', toolInput: { questions }, denyListed: false });
+    const updatedInput = { questions, answers: { 'Same?': 'second' },
+      orderedAnswers: [{ answer: 'first', note: 'a' }, { answer: 'second' }] };
+    broker.respond(emitted[0].payload._requestId, { decision: { behavior: 'allow', updatedInput } });
+    expect((await pending).updatedInput).toEqual(updatedInput);
+  });
+
   it('passes decision.updatedInput through to the resolver (AskUserQuestion answers)', async () => {
     const broker = new PermissionBroker();
     const emitted: any[] = [];
diff --git a/desktop/tests/native-session-host.test.ts b/desktop/tests/native-session-host.test.ts
index 037b1c399..e7c046573 100644
--- a/desktop/tests/native-session-host.test.ts
+++ b/desktop/tests/native-session-host.test.ts
@@ -638,7 +638,7 @@ describe('NativeSessionHost', () => {
     expect(host.send('s-warmup2', 'first').status).toBe('queued');
     expect(host.send('s-warmup2', 'second').status).toBe('queued');
     await creating;
-    await waitForTurnComplete(host, 2);
+    await waitForTurnComplete(host, 1);
     await host.drain('s-warmup2');
     const typed = host.getHistory('s-warmup2')!.filter((e) => e.type === 'user-message').map((e) => e.data.text);
     expect(typed).toEqual(['first', 'second']);
@@ -1990,10 +1990,212 @@ describe('NativeSessionHost', () => {
       expect(r2.status).toBe('queued');
       expect(typeof (r2 as { queueId: string }).queueId).toBe('string');
       expect((r2 as { queueId: string }).queueId.length).toBeGreaterThan(0);
-      await waitForTurnComplete(host, 2);
+      await waitForTurnComplete(host, 1);
       expect(events).toEqual(['first', 'second']); // user-message for 'second' fires only when drained
     });
 
+    it.each(['idle notice pass', 'user turn tail'])('delivers FIFO sends accepted during an %s before stable idle', async (start) => {
+      const h = new NativeSessionHost(new SessionStore(new NativeHome(root)), factory, NO_CONTEXT, async () => null, async () => null);
+      const sid = `tail-${start}`;
+      await h.create({ sessionId: sid, cwd: root, binding: { providerId: 'openrouter', modelId: 'm' } });
+      try {
+        const entry = (h as any).live.get(sid);
+        let entered!: () => void;
+        let release!: () => void;
+        const started = new Promise<void>((r) => { entered = r; });
+        const gate = new Promise<void>((r) => { release = r; });
+        const notice = vi.spyOn(entry.session, 'runNotice').mockImplementation(async () => { entered(); await gate; });
+        const seen: string[] = [];
+        h.on('transcript-event', (e: any) => { if (e.type === 'user-message') seen.push(e.data.text); });
+        if (start === 'user turn tail') h.send(sid, 'opening');
+        (h as any).queueHostNotice(sid, 'notice', { kind: 'shell', runs: [] }, 'test');
+        await started;
+        const receipts = ['one', 'two', 'three'].map((text) => h.send(sid, text));
+        expect(receipts.every((r) => r.status === 'queued')).toBe(true);
+        expect(new Set(receipts.map((r: any) => r.queueId)).size).toBe(3);
+        release();
+        await vi.waitFor(() => expect(seen.slice(-3)).toEqual(['one', 'two', 'three']));
+        await entry.running;
+        expect(entry.queue).toHaveLength(0);
+        expect(h.isIdle(sid)).toBe(true);
+        expect(notice).toHaveBeenCalledTimes(1);
+      } finally { await h.destroyAll(); }
+    });
+
+    it('delivers an acknowledged busy send inside the active turn without a second completion', async () => {
+      const seen: string[] = [];
+      let started!: () => void;
+      const firstEvent = new Promise<void>(resolve => { started = resolve; });
+      let completions = 0;
+      host.on('transcript-event', (event: any) => {
+        if (event.type === 'user-message') { seen.push(event.data.text); if (event.data.text === 'opening') started(); }
+        if (event.type === 'turn-complete') completions++;
+      });
+      expect(host.send(id, 'opening').status).toBe('sent');
+      await firstEvent;
+      const receipt = host.send(id, 'correction') as { status: 'queued'; queueId: string };
+      expect(receipt.status).toBe('queued');
+      await vi.waitFor(() => expect(seen).toEqual(['opening', 'correction']));
+      await (host as any).live.get(id).running;
+      expect(completions).toBe(1);
+      expect(host.removeQueued(id, receipt.queueId)).toBe(false);
+    });
+
+    it('consumes ready input at a second empty response without host-draining another turn', async () => {
+      let requests = 0;
+      const prompts: any[] = [];
+      const empty = [{ type: 'stream-start', warnings: [] },
+        { type: 'finish', finishReason: { unified: 'stop' }, usage: { inputTokens: { total: 1 }, outputTokens: { total: 1 } } }];
+      const modelFactory = async () => new MockLanguageModelV4({ doStream: async (req: any) => {
+        const index = requests++;
+        prompts.push(req.prompt);
+        // WHY: the host's setImmediate readiness fence must open before the
+        // second empty response settles; text alone never bypasses that fence.
+        if (index === 1) await new Promise<void>(resolve => setImmediate(resolve));
+        return { stream: simulateReadableStream({ chunks: index < 2 ? empty : CHUNKS }) };
+      } }) as any;
+      const h = new NativeSessionHost(new SessionStore(new NativeHome(root)), modelFactory, NO_CONTEXT, async () => null, async () => null);
+      const sid = 'empty-ready';
+      await h.create({ sessionId: sid, cwd: root, binding: { providerId: 'openrouter', modelId: 'm' } });
+      try {
+        const events: any[] = [];
+        h.on('transcript-event', e => {
+          events.push(e);
+          if (e.type === 'user-message' && e.data.text === 'opening') {
+            expect(h.send(sid, 'correction').status).toBe('queued');
+          }
+        });
+        expect(h.send(sid, 'opening').status).toBe('sent');
+        await (h as any).live.get(sid).running;
+        expect(events.filter(e => e.type === 'user-message').map(e => e.data.text)).toEqual(['opening', 'correction']);
+        expect(events.filter(e => e.type === 'turn-complete')).toHaveLength(1);
+        expect(requests).toBe(3);
+        expect(JSON.stringify(prompts[2])).toContain('correction');
+        expect((h as any).live.get(sid).queue).toHaveLength(0);
+      } finally { await h.destroyAll(); }
+    });
+
+    it('dispatches input arriving at final completion through the host without losing it', async () => {
+      const seen: string[] = [];
+      let receipt: ReturnType<typeof host.send> | undefined;
+      let completions = 0;
+      host.on('transcript-event', (e: any) => {
+        if (e.type === 'user-message') seen.push(e.data.text);
+        if (e.type === 'turn-complete' && ++completions === 1) receipt = host.send(id, 'late');
+      });
+      expect(host.send(id, 'first').status).toBe('sent');
+      await vi.waitFor(() => expect(seen).toEqual(['first', 'late']));
+      await vi.waitFor(() => expect(completions).toBe(2));
+      expect(receipt?.status).toBe('queued');
+    });
+
+    it('claims only an acknowledged live FIFO head and preserves cancel IDs', async () => {
+      const entry = (host as any).live.get(id);
+      const first = host.send(id, 'opening');
+      const canceled = host.send(id, 'cancel') as { queueId: string };
+      const kept = host.send(id, 'kept') as { queueId: string };
+      expect(first.status).toBe('sent');
+      expect((host as any).takeReadyBusyMessage(id, entry.session)).toBeUndefined();
+      expect(host.removeQueued(id, canceled.queueId)).toBe(true);
+      await new Promise<void>(resolve => setImmediate(resolve));
+      const claim = (host as any).takeReadyBusyMessage(id, entry.session);
+      expect(claim?.id).toBe(kept.queueId);
+      expect(host.removeQueued(id, kept.queueId)).toBe(false);
+      claim.restore();
+      expect(host.removeQueued(id, kept.queueId)).toBe(true);
+      expect((host as any).takeReadyBusyMessage(id, {})).toBeUndefined();
+    });
+
+    it('Send now stops the running task and sends that waiting message ahead of the others', async () => {
+      const order: string[] = [];
+      let sendNow: boolean | undefined;
+      let later!: { queueId: string };
+      host.on('transcript-event', (e: any) => {
+        if (e.type === 'user-message') order.push(e.data.text);
+        if (e.type === 'user-interrupt') order.push('stopped');
+        // Pressed while the first task is genuinely running.
+        if (e.type === 'user-message' && e.data.text === 'first') sendNow = host.sendQueuedNow(id, later.queueId);
+      });
+      expect(host.send(id, 'first').status).toBe('sent');
+      expect(host.send(id, 'waiting').status).toBe('queued');
+      later = host.send(id, 'urgent') as { queueId: string };
+      await vi.waitFor(() => expect(order.filter(t => t !== 'stopped')).toEqual(['first', 'urgent', 'waiting']));
+      expect(sendNow).toBe(true);
+      expect(order.indexOf('stopped')).toBeGreaterThan(order.indexOf('first'));
+      expect(order.indexOf('stopped')).toBeLessThan(order.indexOf('urgent'));
+      // Already on its way: the same honest false as Cancel.
+      expect(host.sendQueuedNow(id, later.queueId)).toBe(false);
+    });
+
+    it('keeps the ack ahead of idle and busy user-message events, including queued edits', async () => {
+      const order: string[] = [];
+      host.on('transcript-event', (e: any) => { if (e.type === 'user-message') order.push(`event:${e.data.text}`); });
+      order.push(`ack:${host.send(id, 'first').status}`);
+      const canceled = host.send(id, 'cancel me') as { status: 'queued'; queueId: string };
+      order.push(`ack:${canceled.status}`);
+      expect(host.removeQueued(id, canceled.queueId)).toBe(true);
+      const edited = host.send(id, 'edited') as { status: 'queued'; queueId: string };
+      order.push(`ack:${edited.status}`);
+      await waitForTurnComplete(host, 1);
+      expect(order).toEqual(['ack:sent', 'ack:queued', 'ack:queued', 'event:first', 'event:edited']);
+      expect(host.removeQueued(id, edited.queueId)).toBe(false);
+    });
+
+    it('does not skip an unready head and kicks it after a final idle check', async () => {
+      const entry = (host as any).live.get(id);
+      let entered!: () => void;
+      let release!: () => void;
+      const started = new Promise<void>((r) => { entered = r; });
+      const gate = new Promise<void>((r) => { release = r; });
+      vi.spyOn(entry.session, 'runNotice').mockImplementation(async () => { entered(); await gate; });
+      const seen: string[] = [];
+      host.on('transcript-event', (e: any) => { if (e.type === 'user-message') seen.push(e.data.text); });
+      (host as any).queueHostNotice(id, 'notice', { kind: 'shell', runs: [] }, 'test');
+      await started;
+      const head = host.send(id, 'head') as { status: 'queued'; queueId: string };
+      const follower = host.send(id, 'follower') as { status: 'queued'; queueId: string };
+      expect(entry.queue[0].ready).toBe(false);
+      // The real readiness transition is setImmediate; the pass settles before
+      // that callback, proving it cannot skip head OR require another send.
+      release();
+      await entry.running;
+      expect(seen).toEqual([]);
+      expect(entry.queue.map((q: any) => q.id)).toEqual([head.queueId, follower.queueId]);
+      await vi.waitFor(() => expect(seen).toEqual(['head', 'follower']));
+      expect(entry.queue).toHaveLength(0);
+      expect(host.removeQueued(id, head.queueId)).toBe(false);
+    });
+
+    it('continues queued user dispatch when a host notice fails and leaves that notice for retry', async () => {
+      const entry = (host as any).live.get(id);
+      let entered!: () => void;
+      let release!: () => void;
+      const started = new Promise<void>((r) => { entered = r; });
+      const gate = new Promise<void>((r) => { release = r; });
+      vi.spyOn(entry.session, 'runNotice').mockImplementation(async () => { entered(); await gate; throw new Error('notice failed'); });
+      (host as any).queueHostNotice(id, 'notice', { kind: 'shell', runs: [] }, 'test');
+      await started;
+      const sent = host.send(id, 'survivor');
+      release();
+      expect(sent.status).toBe('queued');
+      await waitForTurnComplete(host, 1);
+      expect((host as any).pendingHostNotices.get(id)).toHaveLength(1);
+      expect(host.removeQueued(id, (sent as { queueId: string }).queueId)).toBe(false);
+    });
+
+    it('cancels an unready head without letting its readiness callback revive it', async () => {
+      host.send(id, 'first');
+      const canceled = host.send(id, 'old') as { status: 'queued'; queueId: string };
+      expect((host as any).live.get(id).queue[0].ready).toBe(false);
+      expect(host.removeQueued(id, canceled.queueId)).toBe(true);
+      const replacement = host.send(id, 'new') as { status: 'queued'; queueId: string };
+      const seen: string[] = [];
+      host.on('transcript-event', (e: any) => { if (e.type === 'user-message') seen.push(e.data.text); });
+      await waitForTurnComplete(host, 1);
+      expect(seen).toEqual(['first', 'new']);
+      expect(replacement.queueId).not.toBe(canceled.queueId);
+    });
+
     it('refuses honestly past the queue cap', () => {
       host.send(id, 'turn'); // in flight
       for (let i = 0; i < 10; i++) expect(host.send(id, `q${i}`).status).toBe('queued');
@@ -2009,7 +2211,7 @@ describe('NativeSessionHost', () => {
         const rA = host.send(id, 'a') as { status: 'queued'; queueId: string };
         const rB = host.send(id, 'b') as { status: 'queued'; queueId: string };
         expect(host.removeQueued(id, rA.queueId)).toBe(true);
-        await waitForTurnComplete(host, 2);                      // 'first' + 'b' — 'a' was cut
+        await waitForTurnComplete(host, 1);                      // 'first' + 'b' — 'a' was cut
         expect(events).toEqual(['first', 'b']);
         expect(rB.queueId).not.toBe(rA.queueId);
       });
@@ -2017,7 +2219,7 @@ describe('NativeSessionHost', () => {
       it('returns false for an id that already drained (shift() beat the removal)', async () => {
         host.send(id, 'first');
         const rA = host.send(id, 'a') as { status: 'queued'; queueId: string };
-        await waitForTurnComplete(host, 2); // both turns finish — 'a' has been shift()'d and sent
+        await waitForTurnComplete(host, 1); // both turns finish — 'a' has been shift()'d and sent
         expect(host.removeQueued(id, rA.queueId)).toBe(false);
       });
 
@@ -2335,6 +2537,75 @@ describe('NativeSessionHost', () => {
       await h.destroyAll();
     });
 
+    it('Bash-enabled Worker advertises and authorizes its own background companions without widening its definition', async () => {
+      const { h } = await withParent();
+      try {
+        const worker = resolveSpecialist('worker')!;
+        const original = [...worker.allowedTools];
+        const { childId } = await h.createChild('root-1', {
+          specialist: worker, prompt: 'p', workDir: root, parentToolCallId: 'tc-1',
+        });
+        const child = childSession(h, childId);
+        const names = toolNames(h, childId);
+        expect(names.sort()).toEqual([...worker.allowedTools, 'BashOutput', 'KillShell'].sort());
+        for (const name of ['Bash', 'BashOutput', 'KillShell']) {
+          expect((await child.opts.decide(name, undefined)).action).toBe('allow');
+        }
+        expect(worker.allowedTools).toEqual(original);
+        expect(worker.allowedTools).not.toContain('BashOutput');
+        expect(worker.allowedTools).not.toContain('KillShell');
+        expect(child.opts.shells).not.toBe((childSession(h, 'root-1') as any).opts.shells);
+        const { childId: otherId } = await h.createChild('root-1', {
+          specialist: worker, prompt: 'p', workDir: root, parentToolCallId: 'tc-2',
+        });
+        expect(child.opts.shells).not.toBe(childSession(h, otherId).opts.shells);
+        // Exercise the advertised real tool implementations against the session's
+        // own registry, without starting an OS subprocess or signaling a process.
+        const owned = child.opts.shells;
+        const foreignId = 'sh-parent-only';
+        const peerId = 'sh-other-child';
+        const childShellId = 'sh-child-owned';
+        const entry = (shellId: string) => ({ shellId, command: 'test', status: 'exited', startedAt: 1, endedAt: 2 });
+        (childSession(h, 'root-1') as any).opts.shells.runs.set(foreignId, entry(foreignId));
+        childSession(h, otherId).opts.shells.runs.set(peerId, entry(peerId));
+        owned.runs.set(childShellId, entry(childShellId));
+        const output = child.opts.tools.find((t: any) => t.name === 'BashOutput');
+        const kill = child.opts.tools.find((t: any) => t.name === 'KillShell');
+        const ctx = { sessionId: childId, cwd: root, signal: new AbortController().signal, shells: owned } as any;
+        expect((await output.execute({}, ctx)).text).toContain(childShellId);
+        expect((await output.execute({}, ctx)).text).not.toContain(foreignId);
+        for (const id of [foreignId, peerId]) {
+          expect((await output.execute({ shell_id: id }, ctx)).isError).toBe(true);
+          expect((await kill.execute({ shell_id: id }, ctx)).isError).toBe(true);
+        }
+        expect((await kill.execute({ shell_id: childShellId }, ctx)).text).toContain('not running');
+        for (const id of ['root-1', otherId]) {
+          const foreign = childSession(h, id).opts;
+          const foreignCtx = { ...ctx, sessionId: id, shells: foreign.shells };
+          const foreignOutput = foreign.tools.find((t: any) => t.name === 'BashOutput');
+          const foreignKill = foreign.tools.find((t: any) => t.name === 'KillShell');
+          expect((await foreignOutput.execute({ shell_id: childShellId }, foreignCtx)).isError).toBe(true);
+          expect((await foreignKill.execute({ shell_id: childShellId }, foreignCtx)).isError).toBe(true);
+        }
+      } finally { await h.destroyAll(); }
+    });
+
+    it('a read-write definition without Bash does not inherit Bash or background companions', async () => {
+      const { h } = await withParent();
+      try {
+        const worker = resolveSpecialist('worker')!;
+        const noBash = { ...worker, allowedTools: worker.allowedTools.filter(name => name !== 'Bash') };
+        const { childId } = await h.createChild('root-1', {
+          specialist: noBash, prompt: 'p', workDir: root, parentToolCallId: 'tc-1',
+        });
+        expect(toolNames(h, childId).sort()).toEqual([...noBash.allowedTools].sort());
+        for (const name of ['Bash', 'BashOutput', 'KillShell']) {
+          expect((await childSession(h, childId).opts.decide(name, undefined)).action).toBe('deny');
+        }
+        expect(worker.allowedTools).toContain('Bash');
+      } finally { await h.destroyAll(); }
+    });
+
     // Task 14: opts.binding, when tools/task.ts already resolved an override
     // (a designated tier or a validated specific id), is what the CHILD
     // actually launches on — not the parent's own binding. Every field that
diff --git a/desktop/tests/native-tools-polish.test.ts b/desktop/tests/native-tools-polish.test.ts
index a6a142338..7f14b94c3 100644
--- a/desktop/tests/native-tools-polish.test.ts
+++ b/desktop/tests/native-tools-polish.test.ts
@@ -2,7 +2,7 @@
 // (batches A + B). Each `describe` names the ledger id it pins. Wording pins
 // assert the NEW sentence is present and the OLD one absent — the description
 // is the only place a model learns a tool's rules before it trips one.
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -289,7 +289,7 @@ describe('G-11: a repeat Read of an unchanged slice returns a short notice', ()
     expect(second.text).toMatch(/the content you already have is current/);
   });
 
-  it('serves the content again once the file changed on disk', async () => {
+  it('deduplicates unchanged bytes even when the mtime changed', async () => {
     const p = path.join(dir, 'a.txt');
     fs.writeFileSync(p, 'alpha\n');
     const shared = new Map();
@@ -297,7 +297,97 @@ describe('G-11: a repeat Read of an unchanged slice returns a short notice', ()
     const future = new Date(Date.now() + 2000);
     fs.utimesSync(p, future, future);
     const r = await ReadTool.execute({ file_path: 'a.txt' }, { ...ctx, servedReads: shared, toolCallIndex: 2 });
-    expect(r.text).toContain('alpha');
+    expect(r.text).toMatch(/Unchanged since your earlier Read/);
+    expect(r.text).not.toContain('     1\talpha');
+  });
+
+  it('answers an unchanged repeat without loading the whole file again', async () => {
+    // WHY: loading + splitting a big file holds the main process that serves
+    // every window; an unchanged repeat is checked in pieces instead.
+    const p = path.join(dir, 'a.txt');
+    fs.writeFileSync(p, 'alpha\n');
+    const shared = new Map();
+    const original = fs.promises.readFile;
+    const read = vi.spyOn(fs.promises, 'readFile');
+    try {
+      await ReadTool.execute({ file_path: 'a.txt' }, { ...ctx, servedReads: shared, toolCallIndex: 1 });
+      const repeat = await ReadTool.execute({ file_path: 'a.txt' }, { ...ctx, servedReads: shared, toolCallIndex: 2 });
+      expect(repeat.text).toMatch(/content you already have is current/);
+      expect(read.mock.calls.filter(([name]) => name === p)).toHaveLength(1);
+      expect(read.mock.results.every(r => r.type === 'return')).toBe(true);
+    } finally {
+      read.mockRestore();
+      expect(fs.promises.readFile).toBe(original);
+    }
+  });
+
+  it('changed bytes with the same size and mtime are returned, not called current', async () => {
+    const p = path.join(dir, 'a.txt');
+    const stamp = new Date('2025-01-01T00:00:00Z');
+    fs.writeFileSync(p, 'OLD_CONTENT');
+    fs.utimesSync(p, stamp, stamp);
+    const shared = new Map();
+    await ReadTool.execute({ file_path: 'a.txt' }, { ...ctx, servedReads: shared, toolCallIndex: 1 });
+    const oldFingerprint = ctx.readRegistry.get(p);
+    fs.writeFileSync(p, 'NEW_CONTENT');
+    fs.utimesSync(p, stamp, stamp);
+    const second = await ReadTool.execute({ file_path: 'a.txt' }, { ...ctx, servedReads: shared, toolCallIndex: 2 });
+    expect(second.text).toContain('NEW_CONTENT');
+    expect(second.text).not.toContain('the content you already have is current');
+    expect(ctx.readRegistry.get(p)).not.toBe(oldFingerprint);
+    const edit = await EditTool.execute({ file_path: 'a.txt', old_string: 'NEW_CONTENT', new_string: 'EDITED_TEXT' }, ctx);
+    expect(edit.isError).toBeFalsy();
+  });
+
+  it('a binary or missing replacement cannot reuse an old read or restore its write grant', async () => {
+    const p = path.join(dir, 'a.txt');
+    const stamp = new Date('2025-01-01T00:00:00Z');
+    fs.writeFileSync(p, 'OLD_CONTENT');
+    fs.utimesSync(p, stamp, stamp);
+    const shared = new Map();
+    await ReadTool.execute({ file_path: 'a.txt' }, { ...ctx, servedReads: shared, toolCallIndex: 1 });
+    const oldFingerprint = ctx.readRegistry.get(p);
+    fs.writeFileSync(p, Buffer.from('NEW\0CONTENT'));
+    fs.utimesSync(p, stamp, stamp);
+    const binary = await ReadTool.execute({ file_path: 'a.txt' }, { ...ctx, servedReads: shared, toolCallIndex: 2 });
+    expect(binary.isError).toBe(true);
+    expect(binary.text).toContain('binary file');
+    expect(ctx.readRegistry.get(p)).toBe(oldFingerprint);
+    const edit = await EditTool.execute({ file_path: 'a.txt', old_string: 'OLD_CONTENT', new_string: 'bad' }, ctx);
+    expect(edit.isError).toBe(true);
+    const write = await WriteTool.execute({ file_path: 'a.txt', content: 'bad' }, ctx);
+    expect(write.isError).toBe(true);
+    expect(fs.readFileSync(p).includes(0)).toBe(true);
+    fs.rmSync(p);
+    const missing = await ReadTool.execute({ file_path: 'a.txt' }, { ...ctx, servedReads: shared, toolCallIndex: 3 });
+    expect(missing.isError).toBe(true);
+    expect(missing.text).not.toContain('content you already have is current');
+    expect(ctx.readRegistry.get(p)).toBe(oldFingerprint);
+  });
+
+  it('an invalid page never stamps a changed file or reuses its old notice', async () => {
+    const p = path.join(dir, 'a.txt');
+    const stamp = new Date('2025-01-01T00:00:00Z');
+    fs.writeFileSync(p, 'old\n'); fs.utimesSync(p, stamp, stamp);
+    const shared = new Map();
+    await ReadTool.execute({ file_path: 'a.txt', offset: 1 }, { ...ctx, servedReads: shared, toolCallIndex: 1 });
+    const oldFingerprint = ctx.readRegistry.get(p);
+    fs.writeFileSync(p, 'new\n'); fs.utimesSync(p, stamp, stamp);
+    const rejected = await ReadTool.execute({ file_path: 'a.txt', offset: 9 }, { ...ctx, servedReads: shared, toolCallIndex: 2 });
+    expect(rejected.isError).toBe(true);
+    expect(rejected.text).toContain('past the end');
+    expect(ctx.readRegistry.get(p)).toBe(oldFingerprint);
+    const blocked = await EditTool.execute({ file_path: 'a.txt', old_string: 'new', new_string: 'bad' }, ctx);
+    expect(blocked.isError).toBe(true);
+  });
+
+  it('clearing served slice history serves the full text again', async () => {
+    fs.writeFileSync(path.join(dir, 'a.txt'), 'alpha\n');
+    const shared = new Map();
+    await ReadTool.execute({ file_path: 'a.txt' }, { ...ctx, servedReads: shared, toolCallIndex: 1 });
+    shared.clear(); // HarnessSession clears this on /clear, successful compaction and resume.
+    const again = await ReadTool.execute({ file_path: 'a.txt' }, { ...ctx, servedReads: shared, toolCallIndex: 2 });
+    expect(again.text).toContain('     1\talpha');
   });
 
   it('a different slice (offset/limit) is not a repeat', async () => {
diff --git a/desktop/tests/net-guard.test.ts b/desktop/tests/net-guard.test.ts
index fbf59ee08..60d9b3704 100644
--- a/desktop/tests/net-guard.test.ts
+++ b/desktop/tests/net-guard.test.ts
@@ -39,6 +39,40 @@ describe('assertPublicHttpUrl', () => {
     const url = await assertPublicHttpUrl('https://example.com/page', resolves(['93.184.216.34']));
     expect(url.hostname).toBe('example.com');
   });
+  it('preserves actual DNS failure as a guard error and removes the hop listener when it settles', async () => {
+    const controller = new AbortController();
+    const added = vi.spyOn(controller.signal, 'addEventListener');
+    const removed = vi.spyOn(controller.signal, 'removeEventListener');
+    const lookup = vi.fn(async () => { throw new Error('DNS server failed'); });
+    await expect(assertPublicHttpUrl('https://missing.example/', lookup, controller.signal))
+      .rejects.toThrow(NetGuardError);
+    expect(added).toHaveBeenCalledWith('abort', expect.any(Function), { once: true });
+    expect(removed).toHaveBeenCalledWith('abort', added.mock.calls.find(c => c[0] === 'abort')?.[1]);
+    expect(lookup).toHaveBeenCalledTimes(1);
+    added.mockRestore(); removed.mockRestore();
+  });
+  it('removes the pending DNS abort listener when canceled', async () => {
+    const controller = new AbortController();
+    const lookupGate = new Promise<Array<{ address: string; family: number }>>(() => {});
+    const added = vi.spyOn(controller.signal, 'addEventListener');
+    const removed = vi.spyOn(controller.signal, 'removeEventListener');
+    const pending = assertPublicHttpUrl('https://pending.example/', () => lookupGate, controller.signal)
+      .then(() => null, error => error);
+    await Promise.resolve();
+    controller.abort();
+    expect(await pending).toMatchObject({ name: 'AbortError' });
+    expect(removed).toHaveBeenCalledWith('abort', added.mock.calls.find(c => c[0] === 'abort')?.[1]);
+    added.mockRestore(); removed.mockRestore();
+  });
+  it('retains private-address checks when a public redirect host resolves privately', async () => {
+    const fetchMock = vi.fn().mockResolvedValue(new Response(null, { status: 302, headers: { location: 'https://internal.example/' } }));
+    await expect(guardedFetch('https://public.example/', {
+      signal: new AbortController().signal,
+      lookup: async host => [{ address: host === 'internal.example' ? '10.1.2.3' : '93.184.216.34', family: 4 }],
+      fetchImpl: fetchMock,
+    })).rejects.toThrow(/private|internal/i);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
   it('rejects v4-mapped IPv6 literals in the HEX form new URL emits (C1)', async () => {
     // new URL('http://[::ffff:127.0.0.1]/').hostname === '[::ffff:7f00:1]' — the
     // dotted form NEVER reaches us in production, so these must be caught in hex.
@@ -61,6 +95,95 @@ describe('assertPublicHttpUrl', () => {
 describe('guardedFetch', () => {
   afterEach(() => vi.restoreAllMocks());
   const publicLookup = async () => [{ address: '93.184.216.34', family: 4 }];
+  const publicAnswers = [{ address: '93.184.216.34', family: 4 }];
+  const deferredLookup = () => {
+    let resolve!: (addresses: typeof publicAnswers) => void;
+    let reject!: (error: Error) => void;
+    const promise = new Promise<typeof publicAnswers>((yes, no) => { resolve = yes; reject = no; });
+    return { promise, resolve, reject };
+  };
+  const nextTurn = () => new Promise<void>(resolve => setImmediate(resolve));
+
+  it.each(['resolve', 'reject'] as const)('caller abort settles pending DNS before late %s and never dispatches HTTP', async late => {
+    const gate = deferredLookup();
+    const controller = new AbortController();
+    let entered!: () => void;
+    const started = new Promise<void>(resolve => { entered = resolve; });
+    const fetchMock = vi.fn();
+    let settled = false;
+    const pending = guardedFetch('https://pending.example/', {
+      signal: controller.signal, lookup: () => { entered(); return gate.promise; }, fetchImpl: fetchMock,
+    }).then(() => { settled = true; return null; }, error => { settled = true; return error; });
+    try {
+      await started;
+      controller.abort();
+      await nextTurn();
+      expect(settled).toBe(true);
+      const error = await pending;
+      expect(error).toMatchObject({ name: 'AbortError' });
+      expect(error).not.toBeInstanceOf(NetGuardError);
+      if (late === 'resolve') gate.resolve(publicAnswers);
+      else gate.reject(new Error('late DNS failure'));
+      await nextTurn();
+      expect(fetchMock).not.toHaveBeenCalled();
+    } finally { gate.resolve(publicAnswers); await pending; }
+  });
+
+  it('one deadline ends a pending first-hop DNS without dispatching HTTP', async () => {
+    const timer = new AbortController();
+    const deadline = vi.spyOn(AbortSignal, 'timeout').mockImplementation(ms => { expect(ms).toBe(25); return timer.signal; });
+    const gate = deferredLookup();
+    const fetchMock = vi.fn();
+    const pending = guardedFetch('https://pending.example/', {
+      signal: new AbortController().signal, timeoutMs: 25, lookup: () => gate.promise, fetchImpl: fetchMock,
+    }).then(() => null, error => error);
+    try {
+      await nextTurn();
+      timer.abort(new DOMException('deadline reached', 'TimeoutError'));
+      await nextTurn();
+      // WHY: the race keeps the RED test finite while the DNS gate stays shut.
+      const verdict = await Promise.race([pending, Promise.resolve('still-pending')]);
+      expect(verdict).toMatchObject({ name: 'TimeoutError' });
+      gate.resolve(publicAnswers);
+      await pending;
+      expect(fetchMock).not.toHaveBeenCalled();
+    } finally { gate.resolve(publicAnswers); deadline.mockRestore(); }
+  });
+
+  it('an already-aborted signal does not start DNS or HTTP', async () => {
+    const controller = new AbortController();
+    controller.abort();
+    const lookup = vi.fn(async () => publicAnswers);
+    const fetchMock = vi.fn();
+    await expect(guardedFetch('https://pending.example/', {
+      signal: controller.signal, lookup, fetchImpl: fetchMock,
+    })).rejects.toMatchObject({ name: 'AbortError' });
+    expect(lookup).not.toHaveBeenCalled();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('redirect DNS shares the original deadline and late public answer cannot start the second request', async () => {
+    const timer = new AbortController();
+    const deadline = vi.spyOn(AbortSignal, 'timeout').mockImplementation(ms => { expect(ms).toBe(25); return timer.signal; });
+    const gate = deferredLookup();
+    const fetchMock = vi.fn().mockResolvedValue(new Response(null, {
+      status: 302, headers: { location: 'https://other.example/next' },
+    }));
+    const lookup = vi.fn((host: string) => host === 'other.example' ? gate.promise : Promise.resolve(publicAnswers));
+    const pending = guardedFetch('https://first.example/', {
+      signal: new AbortController().signal, timeoutMs: 25, lookup, fetchImpl: fetchMock,
+    }).then(() => null, error => error);
+    try {
+      await nextTurn();
+      timer.abort(new DOMException('deadline reached', 'TimeoutError'));
+      await nextTurn();
+      expect(await Promise.race([pending, Promise.resolve('still-pending')])).toMatchObject({ name: 'TimeoutError' });
+      gate.resolve(publicAnswers);
+      await pending;
+      expect(lookup).toHaveBeenCalledWith('other.example');
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+    } finally { gate.resolve(publicAnswers); deadline.mockRestore(); }
+  });
 
   it('follows redirects manually and validates EVERY hop', async () => {
     // Public URL 302s to a private target — the classic SSRF bypass. Must throw.
diff --git a/desktop/tests/path-triggers.test.ts b/desktop/tests/path-triggers.test.ts
index 06f6571b8..52ebe25ad 100644
--- a/desktop/tests/path-triggers.test.ts
+++ b/desktop/tests/path-triggers.test.ts
@@ -166,6 +166,33 @@ describe('path-scoped rules', () => {
     expect(nested).toContain('Any depth.');
   });
 
+  it('brace alternatives match each listed extension, quoted or not', async () => {
+    const root = tmpRepo();
+    write(root, '.claude/rules/quoted.md', '---\npaths:\n  - "src/**/*.{ts,tsx}"\n---\nQuoted braces.');
+    write(root, '.claude/rules/plain.md', '---\npaths:\n  - src/{api,db}/*.ts\n---\nPlain braces.');
+    const idx = await buildTriggerIndex(root);
+    expect(idx.match(path.join(root, 'src', 'ui', 'Button.tsx')).map(h => h.body)).toEqual(['Quoted braces.']);
+    expect(idx.match(path.join(root, 'src', 'db', 'x.ts')).map(h => h.body).sort()).toEqual(['Plain braces.', 'Quoted braces.']);
+    expect(idx.match(path.join(root, 'src', 'ui', 'x.js'))).toEqual([]);
+  });
+
+  it('square brackets are a character class and never a silent non-match', async () => {
+    const root = tmpRepo();
+    write(root, '.claude/rules/cls.md', '---\npaths:\n  - "logs/day[0-9].txt"\n  - "app/[[]id]/*.tsx"\n---\nBrackets.');
+    const idx = await buildTriggerIndex(root);
+    expect(idx.match(path.join(root, 'logs', 'day7.txt')).length).toBe(1);
+    expect(idx.match(path.join(root, 'logs', 'dayX.txt'))).toEqual([]);
+    expect(idx.match(path.join(root, 'app', '[id]', 'page.tsx')).length).toBe(1);
+  });
+
+  it('a leading slash or ./ anchors at the rule owner instead of disabling the rule', async () => {
+    const root = tmpRepo();
+    write(root, '.claude/rules/abs.md', '---\npaths:\n  - "/src/**"\n  - "./docs/*.md"\n---\nAnchored.');
+    const idx = await buildTriggerIndex(root);
+    expect(idx.match(path.join(root, 'src', 'a.ts')).length).toBe(1);
+    expect(idx.match(path.join(root, 'docs', 'x.md')).length).toBe(1);
+  });
+
   it('the rule BODY is injected, never its frontmatter', async () => {
     const root = tmpRepo();
     write(root, '.claude/rules/api.md', '---\npaths:\n  - "src/**"\nlast_verified: 2026-07-28\n---\nThe actual rule.');
@@ -184,6 +211,96 @@ describe('path-scoped rules', () => {
     expect(bodies).toContain('Nested text.');
   });
 
+  it.each(['directory', 'worktree-file'] as const)('inherits owner-relative rules up to the nearest Git %s root', async (gitKind) => {
+    const outer = tmpRepo();
+    const root = path.join(outer, 'project');
+    fs.mkdirSync(root);
+    if (gitKind === 'directory') fs.mkdirSync(path.join(root, '.git'));
+    else write(root, '.git', 'gitdir: /elsewhere/worktrees/test\n');
+    const parent = outer;
+    write(root, '.claude/rules/root.md', '---\npaths:\n  - "**/src/**"\n---\nRoot rule.');
+    write(root, 'packages/.claude/rules/package.md', '---\npaths:\n  - "api/*.ts"\n---\nPackage rule.');
+    write(parent, '.claude/rules/outside.md', '---\npaths:\n  - "**"\n---\nOutside rule.');
+    try {
+      const idx = await buildTriggerIndex(path.join(root, 'packages', 'api'));
+      const hits = idx.match(path.join(root, 'packages', 'src', 'a.ts'));
+      expect(hits.map(h => h.body)).toEqual(['Root rule.']);
+      const ownerHits = idx.match(path.join(root, 'packages', 'api', 'a.ts'));
+      expect(ownerHits.map(h => h.body)).toEqual(['Package rule.']);
+      expect(ownerHits[0].id).toContain(path.join('packages', '.claude', 'rules', 'package.md'));
+      expect(ownerHits[0].source).toBe(path.join('..', '.claude', 'rules', 'package.md'));
+      expect(idx.match(path.join(parent, 'unrelated.ts'))).toEqual([]);
+    } finally {
+      fs.rmSync(path.join(parent, '.claude', 'rules', 'outside.md'), { force: true });
+    }
+  });
+
+  it('does not inject the same physical rule twice through two owned names', async () => {
+    const root = tmpRepo();
+    const original = path.join(root, '.claude', 'rules', 'original.md');
+    write(root, '.claude/rules/original.md', '---\npaths:\n  - "**/src/**"\n---\nShared rule.');
+    const alias = path.join(root, 'pkg', '.claude', 'rules', 'alias.md');
+    fs.mkdirSync(path.dirname(alias), { recursive: true });
+    fs.linkSync(original, alias);
+    const hits = (await buildTriggerIndex(path.join(root, 'pkg'))).match(path.join(root, 'pkg', 'src', 'a.ts'));
+    expect(hits.map(h => h.body)).toEqual(['Shared rule.']);
+  });
+
+  it('stacks root and child rules once for a narrowed specialist and excludes external files', async () => {
+    const root = tmpRepo();
+    write(root, '.claude/rules/root.md', '---\npaths:\n  - "**/src/**"\n---\nRoot rule.');
+    write(root, 'packages/.claude/rules/package.md', '---\npaths:\n  - "**/src/**"\n---\nPackage rule.');
+    const idx = await buildTriggerIndex(path.join(root, 'packages', 'api'));
+    const file = path.join(root, 'packages', 'api', 'src', 'a.ts');
+    expect(idx.match(file).map(h => h.body)).toEqual(['Root rule.', 'Package rule.']);
+    expect(new Set(idx.match(file).map(h => h.id)).size).toBe(2);
+    expect(idx.match(path.join(path.dirname(root), 'src', 'a.ts'))).toEqual([]);
+  });
+
+  it('parses quoted YAML with comments and matches globstar on segment boundaries', async () => {
+    const root = tmpRepo();
+    write(root, '.claude/rules/comment.md', '---\npaths:\n  - "src/**" # source files\n---\nCOMMENT_RULE');
+    write(root, '.claude/rules/glob.md', '---\npaths:\n  - "**/src/**"\n---\nGLOB_RULE');
+    const idx = await buildTriggerIndex(root);
+    expect(idx.match('src/a.ts').map(h => h.body)).toEqual(['COMMENT_RULE', 'GLOB_RULE']);
+    expect(idx.match('pkg/src/a.ts').map(h => h.body)).toEqual(['GLOB_RULE']);
+    expect(idx.match('notsrc/a.ts')).toEqual([]);
+  });
+
+  it('matches question marks, zero or multiple globstar folders, and ignores malformed patterns', async () => {
+    const root = tmpRepo();
+    write(root, '.claude/rules/pattern.md', '---\npaths:\n  - "src/**/file?.ts"\n  - "[unclosed"\n---\nMATCH');
+    write(root, '.claude/rules/malformed.md', '---\npaths: [bad\n---\nMALFORMED');
+    const idx = await buildTriggerIndex(root);
+    for (const rel of ['src/file1.ts', 'src/a/file2.ts', 'src/a/b/file3.ts']) {
+      expect(idx.match(rel).map(h => h.body)).toEqual(['MATCH']);
+    }
+    expect(idx.match('src/file12.ts')).toEqual([]);
+  });
+
+  it.each([
+    ['nested mapping', 'paths:\n  nested:\n    - "src/**"', []],
+    ['nested sequence', 'paths:\n  - nested:\n      - "src/**"', []],
+    ['nested sibling list', 'paths:\n  - "safe/**"\n  nested:\n    - "src/**"\n  - "other/**"', ['safe/**']],
+    ['malformed sibling indentation', 'paths:\n  - "safe/**"\n   - "src/**"\n  - "other/**"', ['safe/**']],
+  ] as const)('does not treat %s as paths list entries', async (_case, front, expected) => {
+    const root = tmpRepo();
+    write(root, '.claude/rules/shape.md', `---\n${front}\n---\nRule body.`);
+    const idx = await buildTriggerIndex(root);
+    expect(idx.match('src/a.ts')).toEqual([]);
+    expect(idx.match('nested:')).toEqual([]);
+    expect(idx.match('safe/a.ts').map(h => h.body)).toEqual(expected.length ? ['Rule body.'] : []);
+    expect(idx.match('other/a.ts')).toEqual([]);
+  });
+
+  it('preserves valid quoted comments and literal dashes inside paths entries', async () => {
+    const root = tmpRepo();
+    write(root, '.claude/rules/dashes.md', '---\npaths:\n  - "src/my-file.ts" # a comment\n  - "src/-draft.ts"\n---\nDashes.');
+    const idx = await buildTriggerIndex(root);
+    expect(idx.match('src/my-file.ts').map(h => h.body)).toEqual(['Dashes.']);
+    expect(idx.match('src/-draft.ts').map(h => h.body)).toEqual(['Dashes.']);
+  });
+
   it('a repo with no .claude/rules directory is fine', async () => {
     const root = tmpRepo();
     expect((await buildTriggerIndex(root)).match(path.join(root, 'x.ts'))).toEqual([]);
diff --git a/desktop/tests/prompt-assembly.test.ts b/desktop/tests/prompt-assembly.test.ts
index 82605fa60..e37cebc51 100644
--- a/desktop/tests/prompt-assembly.test.ts
+++ b/desktop/tests/prompt-assembly.test.ts
@@ -126,6 +126,131 @@ describe('assembleSystemPrompt — fixture .git containment', () => {
   });
 });
 
+describe('captured ancestor instruction inventory', () => {
+  it('loads broad to narrow across git directory and worktree file, selecting one per folder', async () => {
+    const { prepareProjectInstructions } = await import('../src/main/harness/injection/project-instructions');
+    fs.writeFileSync(path.join(dir, 'AGENTS.md'), 'OUTSIDE_GIT');
+    const repo = path.join(dir, 'repo');
+    const nested = path.join(repo, 'nested');
+    fs.mkdirSync(nested, { recursive: true });
+    fs.writeFileSync(path.join(repo, '.git'), 'gitdir: elsewhere');
+    fs.writeFileSync(path.join(repo, 'CLAUDE.md'), 'REPO_RULE');
+    fs.writeFileSync(path.join(nested, 'AGENTS.md'), 'CHILD_RULE');
+    fs.writeFileSync(path.join(nested, 'CLAUDE.md'), 'IGNORED_RULE');
+    const inventory = await prepareProjectInstructions(nested, 1000);
+    const selected = inventory.filter(f => f.path.startsWith(dir));
+    expect(selected.map(f => f.name)).toEqual(['AGENTS.md', 'CLAUDE.md', 'AGENTS.md']);
+    // The ignored same-folder CLAUDE.md is recorded for the panel, never silent.
+    expect(selected.map(f => f.notUsed ?? null)).toEqual([null, null, 'CLAUDE.md']);
+    const out = assembleSystemPrompt({ presetBody: PRESET, cwd: nested, appVersion: '1', projectInstructionFiles: inventory });
+    expect(out.indexOf('OUTSIDE_GIT')).toBeLessThan(out.indexOf('REPO_RULE'));
+    expect(out.indexOf('REPO_RULE')).toBeLessThan(out.indexOf('CHILD_RULE'));
+    expect(out).not.toContain('IGNORED_RULE');
+    expect(out).toContain(`source="${path.join(dir, 'AGENTS.md')}"`);
+  });
+
+  it('gives the session folder\'s own file first claim on space, and still names a squeezed parent', async () => {
+    const { prepareProjectInstructions } = await import('../src/main/harness/injection/project-instructions');
+    const child = path.join(dir, 'project'); fs.mkdirSync(child);
+    const big = (tag: string) => Array.from({ length: 10 }, (_, i) => `## ${tag} ${i}\n${'Detail line. '.repeat(40)}`).join('\n\n');
+    fs.writeFileSync(path.join(dir, 'CLAUDE.md'), big('Parent'));
+    fs.writeFileSync(path.join(child, 'CLAUDE.md'), big('Project'));
+    // Room for about one whole file: the project's own file must be the one kept.
+    const files = (await prepareProjectInstructions(child, 1700)).filter(f => f.path.startsWith(dir));
+    expect(files.map(f => f.path)).toEqual([path.join(dir, 'CLAUDE.md'), path.join(child, 'CLAUDE.md')]);
+    expect(files[1].truncated).toBe(false);
+    expect(files[0].truncated).toBe(true);
+    expect(files[0].text).toContain(path.join(dir, 'CLAUDE.md'));
+  });
+
+  it('describes a shortened file to the person in plain words, never the model-facing notice', async () => {
+    const { prepareProjectInstructions } = await import('../src/main/harness/injection/project-instructions');
+    const body = Array.from({ length: 12 }, (_, i) => `## Section ${i}\n${'Detail line. '.repeat(80)}`).join('\n\n');
+    fs.writeFileSync(path.join(dir, 'CLAUDE.md'), body);
+    const [file] = (await prepareProjectInstructions(dir, 600)).filter(f => f.path.startsWith(dir));
+    expect(file.truncated).toBe(true);
+    expect(file.note).toMatch(/^Shortened to fit this model/);
+    expect(file.note).not.toMatch(/[[\]]|Read /);
+  });
+
+  it('includes ancestors outside a git directory without looking up a dedicated global file or repeating one source', async () => {
+    const { prepareProjectInstructions } = await import('../src/main/harness/injection/project-instructions');
+    const repo = path.join(dir, 'repo'); const child = path.join(repo, 'child');
+    fs.mkdirSync(child, { recursive: true });
+    fs.mkdirSync(path.join(repo, '.git'));
+    fs.writeFileSync(path.join(dir, 'CLAUDE.md'), 'ABOVE_REPO');
+    fs.writeFileSync(path.join(repo, 'AGENTS.md'), 'IN_REPO');
+    fs.writeFileSync(path.join(child, 'CLAUDE.md'), 'IN_CHILD');
+    fs.mkdirSync(path.join(dir, '.claude'));
+    fs.writeFileSync(path.join(dir, '.claude', 'CLAUDE.md'), 'DEDICATED_GLOBAL_NOT_SELECTED');
+    const files = (await prepareProjectInstructions(child, 1000)).filter(f => f.path.startsWith(dir));
+    expect(files.map(f => f.full)).toEqual(['ABOVE_REPO', 'IN_REPO', 'IN_CHILD']);
+    expect(new Set(files.map(f => f.path)).size).toBe(files.length);
+    expect(files.some(f => f.path.includes(path.join('.claude', 'CLAUDE.md')))).toBe(false);
+  });
+
+  it('deduplicates a symlinked ancestor file by physical identity while retaining first source spelling', async () => {
+    const { prepareProjectInstructions } = await import('../src/main/harness/injection/project-instructions');
+    const child = path.join(dir, 'child'); fs.mkdirSync(child);
+    const parent = path.join(dir, 'AGENTS.md');
+    fs.writeFileSync(parent, 'PHYSICAL_INSTRUCTION');
+    try { fs.symlinkSync(parent, path.join(child, 'AGENTS.md')); }
+    catch (error) { if (process.platform === 'win32' && (error as NodeJS.ErrnoException).code === 'EPERM') return; throw error; }
+    const files = (await prepareProjectInstructions(child, 1000)).filter(f => f.path.startsWith(dir));
+    expect(files.map(f => f.path)).toEqual([parent]);
+    expect(assembleSystemPromptParts({ presetBody: PRESET, cwd: child, appVersion: '1', projectInstructionFiles: files })
+      .find(p => p.id === 'project')?.text.match(/PHYSICAL_INSTRUCTION/g)).toHaveLength(1);
+  });
+
+  it.each([0, 1, 5, 30, 80, 400])('bounds final labelled project part and records omissions at %i tokens', async (tokens) => {
+    const { prepareProjectInstructions } = await import('../src/main/harness/injection/project-instructions');
+    const child = path.join(dir, 'child'); fs.mkdirSync(child);
+    fs.writeFileSync(path.join(dir, 'AGENTS.md'), '# Parent\n' + 'a'.repeat(3000));
+    fs.writeFileSync(path.join(child, 'CLAUDE.md'), '# Child\n' + 'b'.repeat(3000));
+    const files = (await prepareProjectInstructions(child, tokens)).filter(f => f.path.startsWith(dir));
+    const part = assembleSystemPromptParts({ presetBody: PRESET, cwd: child, appVersion: '1', projectInstructionFiles: files }).find(p => p.id === 'project');
+    expect(files).toHaveLength(2);
+    expect(part?.text.length ?? 0).toBeLessThanOrEqual(tokens * 4);
+    expect(files.every(f => f.truncated && !!f.note)).toBe(true);
+    if (tokens === 0) expect(part).toBeUndefined();
+    if (tokens === 80) {
+      expect(part?.text).toContain('Read');
+      expect(part?.text).toContain('AGENTS.md');
+      expect(part?.text).toContain('CLAUDE.md');
+    }
+    for (const file of files) if (file.text) expect(part?.text).toContain(file.text);
+  });
+
+  it('compares legacy nearest-only selection with the captured full ancestor chain', async () => {
+    const { prepareProjectInstructions } = await import('../src/main/harness/injection/project-instructions');
+    const child = path.join(dir, 'child'); fs.mkdirSync(child);
+    fs.mkdirSync(path.join(dir, '.git'));
+    fs.writeFileSync(path.join(dir, 'AGENTS.md'), 'PARENT_RULE');
+    fs.writeFileSync(path.join(child, 'CLAUDE.md'), 'CHILD_RULE');
+    expect(findProjectInstructions(child)?.text).toBe('CHILD_RULE');
+    const files = (await prepareProjectInstructions(child, 1000)).filter(f => f.path.startsWith(dir));
+    expect(files.map(f => f.full)).toEqual(['PARENT_RULE', 'CHILD_RULE']);
+  });
+
+  it('fits the entire chain to one budget with honest per-source cuts and no fresh reads', async () => {
+    const { prepareProjectInstructions } = await import('../src/main/harness/injection/project-instructions');
+    const child = path.join(dir, 'child'); fs.mkdirSync(child);
+    fs.writeFileSync(path.join(dir, 'AGENTS.md'), '# Parent\n' + 'a'.repeat(3000));
+    fs.writeFileSync(path.join(child, 'CLAUDE.md'), '# Child\n' + 'b'.repeat(3000));
+    const inventory = await prepareProjectInstructions(child, 400);
+    expect(inventory.filter(f => f.path.startsWith(dir))).toHaveLength(2);
+    expect(inventory.reduce((n, f) => n + f.text.length, 0)).toBeLessThanOrEqual(1600);
+    expect(inventory.filter(f => f.path.startsWith(dir)).every(f => f.truncated && f.text.includes(f.path))).toBe(true);
+    const inputs = { presetBody: PRESET, cwd: child, appVersion: '1', projectInstructionFiles: inventory };
+    const projectPart = assembleSystemPromptParts(inputs).find(p => p.id === 'project');
+    expect(projectPart?.text.length).toBeLessThanOrEqual(1600);
+    const first = assembleSystemPrompt(inputs);
+    fs.writeFileSync(path.join(child, 'CLAUDE.md'), 'CHANGED_ON_DISK');
+    expect(assembleSystemPrompt({ presetBody: PRESET, cwd: child, appVersion: '1', projectInstructionFiles: inventory })).toBe(first);
+    expect(first).not.toContain('CHANGED_ON_DISK');
+  });
+});
+
 describe('assembleSystemPrompt — byte stability (KV-cache pin)', () => {
   it('is byte-identical across two calls with the same inputs (non-git dir)', () => {
     // Non-git tmp dir → gitSnapshot returns the stable "not a repository" line,
diff --git a/desktop/tests/rule-injection.test.ts b/desktop/tests/rule-injection.test.ts
index 7c56f527d..744345cd4 100644
--- a/desktop/tests/rule-injection.test.ts
+++ b/desktop/tests/rule-injection.test.ts
@@ -17,6 +17,11 @@ import type { TriggerIndex, PathTrigger } from '../src/main/harness/injection/pa
 import { textChunks, toolCallChunk, finishChunk, stream, scriptedModel } from './helpers/scripted-model';
 import { makeOpts, fakeTool } from './helpers/harness-fakes';
 import { CLOUD_DEFAULT } from '../src/main/harness/capability-profile';
+import { buildTriggerIndex } from '../src/main/harness/injection/path-triggers';
+import { rebuildHistoryWithOrigins } from '../src/main/harness/history-rebuild';
+import * as fs from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
 
 const ALLOW: PermissionDecision = { action: 'allow', denyListed: false };
 
@@ -45,7 +50,286 @@ const TWO_STEP = [
   stream(...textChunks('b', 'done'), finishChunk('stop')),
 ];
 
+describe('pre-write guidance boundary', () => {
+  it.each(['Write', 'Edit'])('does not execute an already-issued %s before the model replans', async (name) => {
+    const file = path.join(process.cwd(), 'src/api/a.ts');
+    const tool = fakeTool(name, { permissionSubject: (a: any) => a.file_path });
+    const seen: any[] = [];
+    const model = scriptedModel([
+      stream(toolCallChunk('old', name, { file_path: file }), finishChunk('tool-calls')),
+      stream(...textChunks('new', 'reconsidered'), toolCallChunk('new', name, { file_path: file }), finishChunk('tool-calls')),
+      stream(...textChunks('end', 'done'), finishChunk('stop')),
+    ], seen);
+    const events: TranscriptEvent[] = [];
+    const session = new HarnessSession(makeOpts({ cwd: process.cwd(), tools: [tool], decide: async () => ALLOW,
+      triggers: always({ id: 'rule:write', source: 'rules/write.md', body: 'CHANGE_WRITING_BEHAVIOR' }) }), async () => model as any);
+    session.on('transcript-event', (e: TranscriptEvent) => events.push(e));
+    const original = (session as any).systemText;
+    await session.send('write');
+    expect((tool as any).calls).toHaveLength(1);
+    expect(JSON.stringify(seen[1])).toContain('CHANGE_WRITING_BEHAVIOR');
+    expect((session as any).systemText).toBe(original);
+    expect(events.filter(e => e.type === 'tool-result')).toHaveLength(2);
+    expect(JSON.stringify(events.filter(e => e.type === 'tool-result')[0])).toContain('Not run');
+    expect((session as any).history.filter((m: any) => m.role === 'tool')).toHaveLength(2);
+  });
+
+  it('a retained bounded rule body avoids another pre-write replan on resume', async () => {
+    const { fitRuleGroup } = await import('../src/main/harness/injection/fit-rule-group');
+    const { markAppGenerated } = await import('../src/main/harness/compaction');
+    const rule = { id: 'r', source: 'rules/r.md', body: 'LONG-RULE '.repeat(400) };
+    const content = fitRuleGroup([rule], 200)[0];
+    const write = fakeTool('Write', { permissionSubject: (a: any) => a.file_path });
+    const seen: any[] = [];
+    const model = scriptedModel([stream(toolCallChunk('w', 'Write', { file_path: path.join(process.cwd(), 'a.ts') }), finishChunk('tool-calls')),
+      stream(...textChunks('end', 'ok'), finishChunk('stop'))], seen);
+    const session = new HarnessSession(makeOpts({ cwd: process.cwd(), tools: [write], decide: async () => ALLOW,
+      triggers: always(rule), profile: { ...CLOUD_DEFAULT, injectionBudgetTokens: 200 } }), async () => model as any);
+    session.seedHistory([markAppGenerated({ role: 'user', content } as any)] as any);
+    await session.send('go');
+    expect((write as any).calls).toHaveLength(1);
+    expect(seen).toHaveLength(2);
+  });
+
+  it('a Write without new rules follows the normal fast path', async () => {
+    const write = fakeTool('Write', { permissionSubject: (a: any) => a.file_path });
+    const seen: any[] = [];
+    const model = scriptedModel([stream(toolCallChunk('w', 'Write', { file_path: path.join(process.cwd(), 'a.ts') }), finishChunk('tool-calls')),
+      stream(...textChunks('end', 'ok'), finishChunk('stop'))], seen);
+    const session = new HarnessSession(makeOpts({ cwd: process.cwd(), tools: [write], decide: async () => ALLOW,
+      triggers: never }), async () => model as any);
+    await session.send('go');
+    expect((write as any).calls).toHaveLength(1);
+    expect(JSON.stringify(seen)).not.toContain('Not run');
+  });
+
+  it('a refused re-issued write remains refused: guidance is not approval', async () => {
+    const file = path.join(process.cwd(), 'a.ts');
+    const write = fakeTool('Write', { permissionSubject: (a: any) => a.file_path });
+    let decisions = 0; const seen: any[] = [];
+    const model = scriptedModel([stream(toolCallChunk('old', 'Write', { file_path: file }), finishChunk('tool-calls')),
+      stream(toolCallChunk('new', 'Write', { file_path: file }), finishChunk('tool-calls')),
+      stream(...textChunks('end', 'ok'), finishChunk('stop'))], seen);
+    const session = new HarnessSession(makeOpts({ cwd: process.cwd(), tools: [write],
+      triggers: always({ id: 'r', source: 'r.md', body: 'STOP_AND_CHECK' }),
+      decide: async () => { decisions++; return { action: 'deny', denyListed: false }; } }), async () => model as any);
+    await session.send('go');
+    expect(JSON.stringify(seen[1])).toContain('STOP_AND_CHECK');
+    expect((write as any).calls).toHaveLength(0);
+    expect(decisions).toBe(1);
+  });
+
+  it('invalid Write arguments remain an argument error, not a replan', async () => {
+    const write = fakeTool('Write', { permissionSubject: (a: any) => a.file_path });
+    const seen: any[] = []; const events: TranscriptEvent[] = [];
+    const model = scriptedModel([stream(toolCallChunk('bad', 'Write', { wrong_path: 'a.ts' }), finishChunk('tool-calls')),
+      stream(...textChunks('end', 'ok'), finishChunk('stop'))], seen);
+    const session = new HarnessSession(makeOpts({ tools: [write], triggers: always({ id: 'r', source: 'r.md', body: 'SHOULD_NOT_REPLAN' }), decide: async () => ALLOW }), async () => model as any);
+    session.on('transcript-event', (e: TranscriptEvent) => events.push(e));
+    await session.send('go');
+    expect(JSON.stringify(seen)).not.toContain('SHOULD_NOT_REPLAN');
+    expect(JSON.stringify(events.filter(e => e.type === 'tool-result'))).toContain('file_path');
+    expect((write as any).calls).toHaveLength(0);
+  });
+
+  it('does not mark a fitted notice-only body as delivered guidance', async () => {
+    const { fitRuleGroupDelivery } = await import('../src/main/harness/injection/fit-rule-group');
+    const rule = { id: 'r', source: 'rules/r.md', body: 'ACTUAL_RULE '.repeat(400) };
+    const shapes = Array.from({ length: 90 }, (_, i) => fitRuleGroupDelivery([rule], i + 1));
+    const noticeOnly = shapes.filter(s => s.contents[0]?.includes('<project-rule source=')
+      && /<project-rule source="[^"]*">\n\s*\[(?:\.\.\.truncated|Read rules\/r.md: rule shortened or omitted)/.test(s.contents[0]));
+    expect(noticeOnly.length).toBeGreaterThan(0);
+    expect(noticeOnly.every(s => s.omitted.includes(rule.id))).toBe(true);
+  });
+
+  it.each(['Write', 'Edit'])('shows rules that cannot fit once, shortened, then lets the reissued %s run', async (name) => {
+    // A small model in a rule-heavy project must still be able to edit: it is
+    // told which rules apply (and where to read them) once, then decides again.
+    const tool = fakeTool(name, { permissionSubject: (a: any) => a.file_path });
+    const seen: any[] = []; const events: TranscriptEvent[] = [];
+    const file = path.join(process.cwd(), 'a.ts');
+    const scripts = [stream(toolCallChunk('first', name, { file_path: file }), finishChunk('tool-calls')),
+      stream(toolCallChunk('retry', name, { file_path: file }), finishChunk('tool-calls')),
+      stream(...textChunks('end', 'done'), finishChunk('stop'))];
+    const model = scriptedModel(scripts, seen);
+    const rules = Array.from({ length: 12 }, (_, i) => ({ id: `r${i}`, source: `rules/long-source-${i}.md`, body: `RULE_BODY_${i} ` + 'x'.repeat(1000) }));
+    const session = new HarnessSession(makeOpts({ cwd: process.cwd(), tools: [tool], triggers: always(...rules), decide: async () => ALLOW,
+      profile: { ...CLOUD_DEFAULT, injectionBudgetTokens: 20 } }), async () => model as any);
+    session.on('transcript-event', (e: TranscriptEvent) => events.push(e));
+    await session.send('first');
+    expect((tool as any).calls).toHaveLength(1);
+    expect(seen).toHaveLength(3);
+    const results = events.filter(e => e.type === 'tool-result');
+    expect(results[0].data.toolResult).toMatch(/Not run: newly applicable project instructions/);
+    expect(JSON.stringify(seen[1])).toMatch(/omitted|shortened|truncated/i);
+    expect(events.find(e => e.type === 'turn-complete')!.data.stopReason).toBe('end_turn');
+  });
+
+  it('a rule stop inside a batch keeps the earlier Write and pauses the rest for one replan', async () => {
+    const write = fakeTool('Write', { permissionSubject: (a: any) => a.file_path });
+    const seen: any[] = []; const events: TranscriptEvent[] = [];
+    const first = path.join(process.cwd(), 'first.ts');
+    const blocked = path.join(process.cwd(), 'blocked.ts');
+    const later = path.join(process.cwd(), 'later.ts');
+    const scripts = [stream(
+      toolCallChunk('first', 'Write', { file_path: first }),
+      toolCallChunk('blocked', 'Write', { file_path: blocked }),
+      toolCallChunk('later', 'Write', { file_path: later }), finishChunk('tool-calls')),
+      stream(...textChunks('end', 'replanned'), finishChunk('stop'))];
+    const model = scriptedModel(scripts, seen);
+    const rules = Array.from({ length: 12 }, (_, i) => ({ id: `r${i}`, source: `rules/long-source-${i}.md`, body: 'x'.repeat(1000) }));
+    const session = new HarnessSession(makeOpts({ cwd: process.cwd(), tools: [write], decide: async () => ALLOW,
+      triggers: { match: p => p === blocked ? rules : [] },
+      profile: { ...CLOUD_DEFAULT, injectionBudgetTokens: 20 } }), async () => model as any);
+    session.on('transcript-event', (e: TranscriptEvent) => events.push(e));
+    await session.send('go');
+    expect((write as any).calls.map((c: any) => c.file_path)).toEqual([first]);
+    const results = events.filter(e => e.type === 'tool-result');
+    expect(results).toHaveLength(3);
+    expect(results[0].data.toolResult).toContain('Write ran');
+    expect(results[1].data.toolResult).toMatch(/Not run: newly applicable project instructions/);
+    expect(results[2].data.toolResult).toMatch(/Not run/);
+    expect((session as any).history.filter((m: any) => m.role === 'tool')).toHaveLength(1);
+    expect(seen).toHaveLength(2);
+  });
+
+  it('a post-Read notice without any body does not unlock a following Write', async () => {
+    const read = fakeTool('Read', { permissionSubject: (a: any) => a.file_path });
+    const write = fakeTool('Write', { permissionSubject: (a: any) => a.file_path });
+    const seen: any[] = []; const events: TranscriptEvent[] = [];
+    const model = scriptedModel([
+      stream(toolCallChunk('r', 'Read', { file_path: 'a.ts' }), finishChunk('tool-calls')),
+      stream(toolCallChunk('w', 'Write', { file_path: 'a.ts' }), finishChunk('tool-calls')),
+      stream(...textChunks('end', 'done'), finishChunk('stop')),
+    ], seen);
+    const session = new HarnessSession(makeOpts({ tools: [read, write], decide: async () => ALLOW,
+      triggers: always({ id: 'r', source: 'rules/r.md', body: 'IMPORTANT_BODY '.repeat(200) }),
+      profile: { ...CLOUD_DEFAULT, injectionBudgetTokens: 10 } }), async () => model as any);
+    session.on('transcript-event', (e: TranscriptEvent) => events.push(e));
+    await session.send('go');
+    expect(JSON.stringify(seen[1])).toContain('truncated');
+    // The Read's notice alone does not skip the pre-write stop: the Write is
+    // paused once for a replan, and the scripted model then ends the turn.
+    expect((write as any).calls).toHaveLength(0);
+    expect(JSON.stringify(events.filter(e => e.type === 'tool-result'))).toMatch(/Not run: newly applicable project instructions/);
+    expect(seen).toHaveLength(3);
+  });
+
+  it('fits multiple new rules as one source-labelled group and does not replan a partial twice', async () => {
+    const write = fakeTool('Write', { permissionSubject: (a: any) => a.file_path });
+    const seen: any[] = [];
+    const model = scriptedModel([stream(toolCallChunk('old', 'Write', { file_path: 'a.ts' }), finishChunk('tool-calls')),
+      stream(toolCallChunk('new', 'Write', { file_path: 'a.ts' }), finishChunk('tool-calls')),
+      stream(...textChunks('end', 'ok'), finishChunk('stop'))], seen);
+    const rules = [{ id: 'r1', source: 'first.md', body: 'A'.repeat(2000) },
+      { id: 'r2', source: 'second.md', body: 'B'.repeat(2000) }];
+    const session = new HarnessSession(makeOpts({ tools: [write], triggers: always(...rules), decide: async () => ALLOW,
+      profile: { ...CLOUD_DEFAULT, injectionBudgetTokens: 200 } }), async () => model as any);
+    await session.send('go');
+    const messages = ((session as any).history as any[]).filter(m => m.role === 'user' && typeof m.content === 'string' && m.content.includes('project-rule'));
+    expect(messages.reduce((n, m) => n + m.content.length, 0)).toBeLessThanOrEqual(800);
+    expect(JSON.stringify(messages)).toContain('first.md');
+    expect(JSON.stringify(messages)).toContain('second.md');
+    expect(JSON.stringify(messages)).toMatch(/truncated|shortened|omitted/);
+    expect(seen).toHaveLength(3);
+  });
+
+  it('includes a ready human correction and guidance in the next request, not the old write', async () => {
+    const write = fakeTool('Write', { permissionSubject: (a: any) => a.file_path });
+    const seen: any[] = []; let ready = false; let delivered = false;
+    const model = scriptedModel([stream(toolCallChunk('old', 'Write', { file_path: 'a.ts' }), finishChunk('tool-calls')),
+      stream(...textChunks('end', 'no write'), finishChunk('stop'))], seen);
+    const session = new HarnessSession(makeOpts({ tools: [write], decide: async () => ALLOW,
+      triggers: always({ id: 'r', source: 'r.md', body: 'HUMAN_AND_RULE' }),
+      takeReadyBusyMessage: () => {
+        if (!ready || delivered) return undefined;
+        delivered = true;
+        return { id: 'u', text: 'Change the target', attachments: [] };
+      } }), async () => model as any);
+    session.on('transcript-event', (e: TranscriptEvent) => {
+      if (e.type === 'tool-result' && JSON.stringify(e).includes('Not run')) ready = true;
+    });
+    await session.send('go');
+    expect((write as any).calls).toHaveLength(0);
+    expect(JSON.stringify(seen[1])).toContain('HUMAN_AND_RULE');
+    expect(JSON.stringify(seen[1])).toContain('Change the target');
+  });
+
+  it('an interrupt during deferral leaves the first write unexecuted and every call paired', async () => {
+    const write = fakeTool('Write', { permissionSubject: (a: any) => a.file_path });
+    const events: TranscriptEvent[] = []; const seen: any[] = [];
+    const model = scriptedModel([stream(toolCallChunk('old', 'Write', { file_path: 'a.ts' }),
+      toolCallChunk('sibling', 'Write', { file_path: 'b.ts' }), finishChunk('tool-calls')),
+      stream(...textChunks('unexpected', 'should not execute'), finishChunk('stop'))], seen);
+    const session = new HarnessSession(makeOpts({ tools: [write], decide: async () => ALLOW,
+      triggers: always({ id: 'r', source: 'r.md', body: 'RECONSIDER' }) }), async () => model as any);
+    session.on('transcript-event', (e: TranscriptEvent) => {
+      events.push(e);
+      if (e.type === 'tool-result' && JSON.stringify(e).includes('Not run')) session.interrupt();
+    });
+    await session.send('go');
+    expect((write as any).calls).toHaveLength(0);
+    expect(events.filter(e => e.type === 'tool-result')).toHaveLength(2);
+    expect(events.some(e => e.type === 'user-interrupt')).toBe(true);
+    expect(seen).toHaveLength(1);
+  });
+
+  it('keeps an earlier Read result and pairs unstarted Write siblings before guidance', async () => {
+    const read = fakeTool('Read', { permissionSubject: (a: any) => a.file_path });
+    const write = fakeTool('Write', { permissionSubject: (a: any) => a.file_path });
+    const seen: any[] = []; const events: TranscriptEvent[] = [];
+    const model = scriptedModel([stream(toolCallChunk('r', 'Read', { file_path: 'other.ts' }),
+      toolCallChunk('w', 'Write', { file_path: 'a.ts' }), toolCallChunk('s', 'Write', { file_path: 'b.ts' }), finishChunk('tool-calls')),
+      stream(...textChunks('end', 'no write'), finishChunk('stop'))], seen);
+    const session = new HarnessSession(makeOpts({ tools: [read, write], decide: async () => ALLOW,
+      triggers: { match: p => p === 'a.ts' ? [{ id: 'r', source: 'r.md', body: 'BEFORE_WRITE' }] : [] } }), async () => model as any);
+    session.on('transcript-event', (e: TranscriptEvent) => events.push(e));
+    await session.send('go');
+    expect((read as any).calls).toHaveLength(1);
+    expect((write as any).calls).toHaveLength(0);
+    expect(JSON.stringify(seen[1])).toContain('BEFORE_WRITE');
+    const results = events.filter(e => e.type === 'tool-result');
+    expect(results).toHaveLength(3);
+    expect(JSON.stringify(results[0])).toContain('Read ran');
+    expect(JSON.stringify(results.slice(1))).toContain('Not run');
+    expect((session as any).history.filter((m: any) => m.role === 'tool')).toHaveLength(1);
+    const rebuilt = rebuildHistoryWithOrigins(events);
+    const live = (session as any).history as any[];
+    expect(rebuilt.messages).toEqual(live.filter(m => !(m.role === 'user' && typeof m.content === 'string' && m.content.startsWith('<project-rule'))));
+    const accepted = session.acceptedHistory();
+    expect(accepted.messages).toEqual(live);
+    const resultsInHistory = accepted.eventUuids.filter(u => events.some(e => e.uuid === u && e.type === 'tool-result'));
+    expect(resultsInHistory).toHaveLength(3);
+  });
+});
+
 describe('path-triggered injection', () => {
+  it('passes inherited owner-relative rules to a narrowed session on the next read', async () => {
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), 'yc-rules-owner-'));
+    try {
+      await fs.mkdir(path.join(root, '.git'));
+      const owner = path.join(root, 'pkg');
+      const cwd = path.join(owner, 'child');
+      await fs.mkdir(path.join(root, '.claude', 'rules'), { recursive: true });
+      await fs.mkdir(path.join(owner, '.claude', 'rules'), { recursive: true });
+      await fs.mkdir(path.join(cwd, 'src'), { recursive: true });
+      await fs.writeFile(path.join(root, '.claude', 'rules', 'root.md'), '---\npaths:\n  - "**/src/**"\n---\nROOT_RULE');
+      await fs.writeFile(path.join(owner, '.claude', 'rules', 'child.md'), '---\npaths:\n  - "child/src/**"\n---\nOWNER_RULE');
+      const file = path.join(cwd, 'src', 'a.ts');
+      const scripts = [stream(toolCallChunk('c1', 'Read', { file_path: file }), finishChunk('tool-calls')),
+        stream(...textChunks('answer', 'done'), finishChunk('stop'))];
+      const seen: any[] = [];
+      const model = scriptedModel(scripts, seen);
+      const session = new HarnessSession(makeOpts({ cwd, tools: [fakeTool('Read', { permissionSubject: (a: any) => a.file_path })],
+        decide: async () => ALLOW, triggers: await buildTriggerIndex(cwd) }), async () => model as any);
+      await session.send('read');
+      const prompt = JSON.stringify(seen[1]);
+      expect(prompt.indexOf('ROOT_RULE')).toBeGreaterThanOrEqual(0);
+      expect(prompt.indexOf('OWNER_RULE')).toBeGreaterThan(prompt.indexOf('ROOT_RULE'));
+    } finally {
+      await fs.rm(root, { recursive: true, force: true, maxRetries: 10 });
+    }
+  });
   it('a matched trigger reaches the model as a MESSAGE', async () => {
     const { session, seen } = run(always({ id: 'r1', source: '.claude/rules/api.md', body: 'Always validate input.' }), TWO_STEP);
     await session.send('go');
@@ -80,6 +364,21 @@ describe('path-triggered injection', () => {
     expect(lastPrompt.split('RULE-TEXT-MARKER').length - 1).toBe(1);
   });
 
+  it('reinjects a rule after clear, but not on another ordinary turn', async () => {
+    const rule = { id: 'rule:one', source: '.claude/rules/one.md', body: 'RULE-AFTER-CLEAR' };
+    const scripts = Array.from({ length: 6 }, (_, i) => i % 2 === 0
+      ? stream(toolCallChunk(`c${i}`, 'Read', { file_path: 'a.ts' }), finishChunk('tool-calls'))
+      : stream(...textChunks(`t${i}`, 'done'), finishChunk('stop')));
+    const { session, seen } = run(always(rule), scripts);
+    await session.send('first');
+    await session.send('second');
+    expect(JSON.stringify(seen[3]).split(rule.body)).toHaveLength(2);
+    expect(session.clearHistory()).toEqual({ ok: true });
+    await session.send('third');
+    expect(JSON.stringify(seen[5]).split(rule.body)).toHaveLength(2);
+    expect(JSON.stringify(seen[4])).not.toContain(rule.body);
+  });
+
   it('stays injected-once across TURNS, not just steps', async () => {
     const perTurn = [
       stream(toolCallChunk('c1', 'Read', { file_path: 'a.ts' }), finishChunk('tool-calls')),
@@ -94,6 +393,89 @@ describe('path-triggered injection', () => {
     expect(lastPrompt.split('RULE-TEXT-MARKER').length - 1).toBe(1);
   });
 
+  it.each([true, false])('seeded %s source-labelled rule controls repeat delivery', async (retained) => {
+    const rule = { id: 'rule:/project/a.md', source: '.claude/rules/a.md', body: 'RESTORED-RULE' };
+    const { session, seen } = run(always(rule), TWO_STEP);
+    const text = `<project-rule source="${rule.source}">\n${rule.body}\n</project-rule>`;
+    const { markAppGenerated } = await import('../src/main/harness/compaction');
+    session.seedHistory([{ role: 'user', content: 'earlier' },
+      ...(retained ? [markAppGenerated({ role: 'user', content: text } as any)] : [{ role: 'user', content: text }])] as any);
+    await session.send('touch file');
+    expect(JSON.stringify(seen.at(-1)).split(rule.body).length - 1).toBe(retained ? 1 : 2);
+  });
+
+  it.each(['retired', 'retained', 'failed'] as const)('manual summary %s rule keeps loaded state truthful', async (outcome) => {
+    const rule = { id: 'rule:/project/r.md', source: 'rules/r.md', body: 'MANUAL-RULE-MARKER' };
+    const { markAppGenerated } = await import('../src/main/harness/compaction');
+    const ruleMessage = () => markAppGenerated({ role: 'user', content: `<project-rule source="${rule.source}">\n${rule.body}\n</project-rule>` } as any);
+    const scripts = [stream(...textChunks('summary', outcome === 'failed' ? ' ' : `Summary mentions ${rule.body}`), finishChunk('stop')),
+      stream(toolCallChunk('c1', 'Read', { file_path: 'a.ts' }), finishChunk('tool-calls')),
+      stream(...textChunks('reply', 'done'), finishChunk('stop'))];
+    const { session, seen } = run(always(rule), scripts);
+    session.seedHistory([{ role: 'user', content: 'old turn' }, ruleMessage(), { role: 'assistant', content: 'ack' },
+      { role: 'user', content: 'recent turn' }, { role: 'assistant', content: 'ack' },
+      ...(outcome === 'retained' ? [ruleMessage()] : []), { role: 'user', content: 'latest turn' }] as any);
+    const result = await session.compactNow();
+    expect(result.ok).toBe(outcome !== 'failed');
+    await session.send('touch a.ts');
+    const history = (session as any).history as any[];
+    expect(history.filter(m => m.role === 'user' && typeof m.content === 'string' && m.content.startsWith('<project-rule source='))).toHaveLength(1);
+    expect(JSON.stringify(seen.at(-1))).toContain(rule.body);
+  });
+
+  it('does not mistake a stale same-source rule body for the currently loaded guidance', async () => {
+    const rule = { id: 'rule:/project/a.md', source: 'rules/a.md', body: 'CURRENT-RULE' };
+    const { session, seen } = run(always(rule), TWO_STEP);
+    const { markAppGenerated } = await import('../src/main/harness/compaction');
+    session.seedHistory([markAppGenerated({ role: 'user', content: '<project-rule source="rules/a.md">\nOLD-RULE\n</project-rule>' } as any)]);
+    await session.send('touch file');
+    expect(JSON.stringify(seen.at(-1))).toContain(rule.body);
+  });
+
+  it('successful automatic summary rearms a retired rule without treating its summary mention as the rule', async () => {
+    const rule = { id: 'rule:/project/r.md', source: 'rules/r.md', body: 'AUTO-RULE-MARKER' };
+    const { markAppGenerated } = await import('../src/main/harness/compaction');
+    const model = scriptedModel([stream(...textChunks('sum', `Summary mentions ${rule.body}`), finishChunk('stop')),
+      stream(toolCallChunk('c1', 'Read', { file_path: 'a.ts' }), finishChunk('tool-calls')),
+      stream(...textChunks('done', 'done'), finishChunk('stop'))]);
+    const session = new HarnessSession(makeOpts({ contextLength: 8192, triggers: always(rule),
+      tools: [fakeTool('Read', { permissionSubject: (a: any) => a.file_path })], decide: async () => ALLOW,
+    }), async () => model as any);
+    session.seedHistory([{ role: 'user', content: 'old task ' + 'x'.repeat(9000) },
+      markAppGenerated({ role: 'user', content: `<project-rule source="${rule.source}">\n${rule.body}\n</project-rule>` } as any),
+      { role: 'assistant', content: 'done' }, { role: 'user', content: 'newer task' }, { role: 'assistant', content: 'done' },
+      { role: 'user', content: 'latest task' }] as any);
+    (session as any).abort = new AbortController();
+    try { expect(await (session as any).maybeCompact(model, {}, true)).toBe(true); }
+    finally { (session as any).abort = null; }
+    expect((session as any).retainedTriggerMessages.size).toBe(0);
+    expect((session as any).history[0].content).toContain(rule.body);
+    await session.send('touch a.ts');
+    expect((session as any).history.filter((m: any) => typeof m.content === 'string' && m.content.startsWith('<project-rule source='))).toHaveLength(1);
+  });
+
+  it('a prune that drops the rule rearms its path on the next touch', async () => {
+    const rule = { id: 'rule:/project/r.md', source: 'rules/r.md', body: 'DROPPED-RULE-MARKER' };
+    const { markAppGenerated } = await import('../src/main/harness/compaction');
+    const { session, seen } = run(always(rule), TWO_STEP);
+    session.seedHistory([{ role: 'user', content: 'earlier' },
+      markAppGenerated({ role: 'user', content: `<project-rule source="${rule.source}">\n${rule.body}\n</project-rule>` } as any)] as any);
+    (session as any).commitPrune([(session as any).history[0]]);
+    await session.send('touch');
+    expect(JSON.stringify(seen.at(-1)).split(rule.body).length - 1).toBe(1);
+  });
+
+  it('a prune that retains the rule does not rearm it', async () => {
+    const rule = { id: 'rule:/project/r.md', source: 'rules/r.md', body: 'PRUNE-RULE-MARKER' };
+    const { markAppGenerated } = await import('../src/main/harness/compaction');
+    const { session, seen } = run(always(rule), TWO_STEP);
+    session.seedHistory([{ role: 'user', content: 'earlier' },
+      markAppGenerated({ role: 'user', content: `<project-rule source="${rule.source}">\n${rule.body}\n</project-rule>` } as any)] as any);
+    (session as any).commitPrune([...(session as any).history]);
+    await session.send('touch');
+    expect(JSON.stringify(seen.at(-1)).split(rule.body).length - 1).toBe(1);
+  });
+
   it('no trigger, no injection — an ordinary turn is untouched', async () => {
     const { session, seen } = run(never, TWO_STEP);
     await session.send('go');
diff --git a/desktop/tests/session-context-panel.test.tsx b/desktop/tests/session-context-panel.test.tsx
index f47c216d6..cc7076415 100644
--- a/desktop/tests/session-context-panel.test.tsx
+++ b/desktop/tests/session-context-panel.test.tsx
@@ -48,6 +48,38 @@ describe('the Project tab is named for what it holds', () => {
     userInstructions: { path: '/home/me/.claude/CLAUDE.md', truncated: false },
   };
 
+  it('reuses file rows for every captured ancestor and marks a shortened parent', () => {
+    show({ assembledBy: 'youcoded', projectInstructionFiles: [
+      { path: '/workspace/AGENTS.md', truncated: true, note: 'Outlined parent', notUsed: 'CLAUDE.md' },
+      { path: '/workspace/repo/CLAUDE.md', truncated: false },
+    ], skills: [], tools: [] });
+    expect(screen.getByText('Not everything fit')).toBeInTheDocument();
+    // Short, named summary — never "file(s)" or a bare count.
+    expect(screen.getByText('Shortened · AGENTS.md')).toBeInTheDocument();
+    fireEvent.click(screen.getByRole('tab', { name: 'Project' }));
+    // Folder names, not long absolute paths; a same-folder file that was not used is named.
+    expect(screen.getByText('From the “workspace” folder · Outlined parent · CLAUDE.md here not used')).toBeInTheDocument();
+    expect(screen.getByText('This project · Read in full')).toBeInTheDocument();
+  });
+
+  it('counts the captured chain on Overview and keeps the same rows on Project', () => {
+    show({ assembledBy: 'youcoded', projectInstructionFiles: [
+      { path: '/workspace/AGENTS.md', truncated: false },
+      { path: '/workspace/repo/CLAUDE.md', truncated: false },
+    ], skills: [], tools: ['Read'] });
+    expect(screen.getByText(/2 rules files/)).toBeInTheDocument();
+    fireEvent.click(screen.getByRole('tab', { name: 'Project' }));
+    expect(screen.getByText('From the “workspace” folder · Read in full')).toBeInTheDocument();
+    expect(screen.getByText('This project · Read in full')).toBeInTheDocument();
+  });
+
+  it('counts the legacy Claude Code single-file record on Overview and Project', () => {
+    show(withUser);
+    expect(screen.getByText(/1 rules file/)).toBeInTheDocument();
+    fireEvent.click(screen.getByRole('tab', { name: 'Project' }));
+    expect(screen.getByText(/This project ·/)).toBeInTheDocument();
+  });
+
   it('shows both files, and neither card claims to be the other', () => {
     show(withUser);
     fireEvent.click(screen.getByRole('tab', { name: 'Project' }));
diff --git a/desktop/tests/session-context.test.ts b/desktop/tests/session-context.test.ts
index 2e82aa3ba..03a76d38b 100644
--- a/desktop/tests/session-context.test.ts
+++ b/desktop/tests/session-context.test.ts
@@ -111,6 +111,21 @@ describe('what the assistant was given', () => {
     expect(res.truncated).toBe(false);
   });
 
+  it('reports captured ancestors and serves only captured bodies after disk changes', async () => {
+    const child = path.join(root, 'child'); fs.mkdirSync(child);
+    fs.writeFileSync(path.join(root, 'AGENTS.md'), 'PARENT_SNAPSHOT');
+    fs.writeFileSync(path.join(child, 'CLAUDE.md'), 'CHILD_SNAPSHOT');
+    const ctx = await contextFor(host, 's-chain', child);
+    const files = ctx.projectInstructionFiles.filter((f: any) => f.path.startsWith(root));
+    expect(files.map((f: any) => f.path)).toEqual([path.join(root, 'AGENTS.md'), path.join(child, 'CLAUDE.md')]);
+    expect(Object.keys(files[0]).sort()).toEqual(['note', 'path', 'truncated']);
+    fs.writeFileSync(path.join(root, 'AGENTS.md'), 'CHANGED');
+    const selected: any = host.sessionContextText('s-chain', 'project', files[0].path);
+    expect(selected.full).toBe('PARENT_SNAPSHOT');
+    expect(ctx.systemPrompt).toContain('PARENT_SNAPSHOT');
+    expect(host.sessionContextText('s-chain', 'project', path.join(root, 'other.md'))).toEqual({ error: 'not-found' });
+  });
+
   it('refuses honestly rather than inventing a file', async () => {
     await contextFor(host, 's-none', root);
     expect(host.sessionContextText('s-none', 'project')).toEqual({ error: 'not-found' });
diff --git a/desktop/tests/session-store.test.ts b/desktop/tests/session-store.test.ts
index f1e4f9b27..865f70aaf 100644
--- a/desktop/tests/session-store.test.ts
+++ b/desktop/tests/session-store.test.ts
@@ -219,6 +219,23 @@ describe('SessionStore', () => {
     expect((events[0] as any).data).toMatchObject({ text: 'Hello!', partId: 'p1' });
   });
 
+  it('a retry drop tombstones abandoned text and reasoning before replay, including reused part ids', async () => {
+    await store.create(HEADER);
+    await store.append(HEADER.cwd, ev('assistant-text', { text: 'abandoned', partId: 'text-0' }, 'a1') as any);
+    await store.append(HEADER.cwd, ev('assistant-thinking', { text: 'old thought', partId: 'reasoning-0' }, 'r1') as any);
+    await store.append(HEADER.cwd, ev('assistant-thinking', { dropPart: { partIds: ['text-0', 'reasoning-0'] } }, 'd1') as any);
+    await store.append(HEADER.cwd, ev('assistant-text', { text: 'replacement', partId: 'text-0' }, 'a2') as any);
+    await store.append(HEADER.cwd, ev('turn-complete', { stopReason: 'end_turn' }, 't1') as any);
+    const replay = store.readEvents('s-1', HEADER.cwd);
+    // WHY: a reasoning event can flush the earlier text to JSONL; the durable
+    // tombstone must still precede replacement so replay removes that part.
+    const drop = replay.findIndex(e => e.data.dropPart);
+    expect(drop).toBeGreaterThan(0);
+    expect(replay[drop].data.dropPart!.partIds).toEqual(['text-0', 'reasoning-0']);
+    expect(replay.slice(drop + 1).filter(e => e.type === 'assistant-text').map(e => e.data.text)).toEqual(['replacement']);
+    expect(replay.slice(drop + 1).some(e => e.data.text === 'old thought')).toBe(false);
+  });
+
   it('dropPart discards the buffered open part instead of writing it', async () => {
     // Manual Retry: the abandoned half-sentence must never reach the JSONL, or
     // a resume would replay text the user watched disappear.
diff --git a/desktop/tests/shell-registry.test.ts b/desktop/tests/shell-registry.test.ts
index bc82b80ef..04d214dc1 100644
--- a/desktop/tests/shell-registry.test.ts
+++ b/desktop/tests/shell-registry.test.ts
@@ -10,7 +10,7 @@ import {
   formatElapsed, formatFinishedNotice, formatLongRunningNotice, stateText, spawnDetached,
 } from '../src/main/harness/shell-registry';
 import { RunningCalls } from '../src/main/harness/askpass/running-calls';
-import { spillRoot, sweepOldSpillFiles } from '../src/main/harness/tools/spill-paths';
+import { spillRoot, spillDirFor, sweepOldSpillFiles } from '../src/main/harness/tools/spill-paths';
 import { CWD_SENTINEL, ENV_SENTINEL, stripSentinelLines, normalizeNewlines } from '../src/main/harness/tools/shell-text';
 
 const posix = process.platform !== 'win32';
@@ -71,6 +71,19 @@ describe.skipIf(!posix)('ShellRegistry (POSIX processes)', () => {
   beforeEach(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), 'shell-reg-')); reg = new ShellRegistry(`t-${path.basename(dir)}`); });
   afterEach(async () => { await reg.killAll('app-quit', { graceMs: 0 }); fs.rmSync(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 25 }); });
 
+  it('a background registration failure returns a specific error without publishing a run', () => {
+    // A file occupying this session's log-directory slot makes mkdir fail
+    // without touching any active integration or requiring elevated permissions.
+    const slot = spillDirFor((reg as any).sessionId);
+    fs.mkdirSync(path.dirname(slot), { recursive: true });
+    fs.writeFileSync(slot, 'block directory');
+    try {
+      const result = reg.start(startSpec('sleep 30', dir));
+      expect(result).toMatchObject({ ok: false, reason: 'spawn-failed', detail: expect.stringMatching(/EEXIST|file already exists/) });
+      expect(reg.list()).toEqual([]);
+    } finally { fs.rmSync(slot, { force: true }); }
+  });
+
   it('start: mints an sh- id, logs from the first byte, exits with the real code, emits exit once', async () => {
     const exits: any[] = [];
     reg.on('exit', (r) => exits.push(r));
@@ -90,6 +103,17 @@ describe.skipIf(!posix)('ShellRegistry (POSIX processes)', () => {
     expect(reg.list().map((x) => x.shellId)).toEqual([r.run.shellId]);
   });
 
+  it('a registered log stream error leaves the in-memory tail available and settles once', async () => {
+    const exits: any[] = [];
+    reg.on('exit', (r) => exits.push(r));
+    const result = reg.start(startSpec('echo retained', dir));
+    if (!result.ok) throw new Error('start failed');
+    result.run.logStream.emit('error', new Error('log stream unavailable'));
+    await result.run.exited;
+    expect(reg.tailText(result.run, 10)).toContain('retained');
+    expect(exits).toHaveLength(1);
+  });
+
   it('read: returns only what arrived since the last read', async () => {
     const r = reg.start(startSpec('echo one; sleep 0.5; echo two', dir));
     if (!r.ok) throw new Error('start failed');
diff --git a/desktop/tests/specialist-child-permissions.test.ts b/desktop/tests/specialist-child-permissions.test.ts
index 926fd151d..d037c9e40 100644
--- a/desktop/tests/specialist-child-permissions.test.ts
+++ b/desktop/tests/specialist-child-permissions.test.ts
@@ -5,6 +5,7 @@
 // Strictest wins: a cap can only ever narrow what the parent would have allowed.
 import { describe, it, expect, vi } from 'vitest';
 import { buildChildDecide } from '../src/main/harness/specialists/child-permissions';
+import { resolveSpecialist } from '../src/main/harness/specialists/registry';
 import type { PermissionDecision } from '../src/shared/permission-types';
 
 const allow: PermissionDecision = { action: 'allow', denyListed: false };
@@ -88,6 +89,31 @@ describe('buildChildDecide', () => {
     }
   });
 
+  it('the built-in Worker effective toolset permits Bash companions but never overrides a parent deny or floor ask', async () => {
+    const worker = resolveSpecialist('worker')!;
+    const effective = [...worker.allowedTools, 'BashOutput', 'KillShell'];
+    const parentDecide = vi.fn(async (tool: string): Promise<PermissionDecision> =>
+      tool === 'KillShell' ? deny : tool === 'Bash' ? { action: 'ask', denyListed: true } : allow);
+    const decide = buildChildDecide({ parentDecide, charter: worker.charter, allowedTools: effective, envelopeGranted: true });
+    expect((await decide('BashOutput', undefined)).action).toBe('allow');
+    expect(await decide('KillShell', undefined)).toEqual(deny);
+    expect(await decide('Bash', 'rm -rf /')).toEqual({ action: 'ask', denyListed: true });
+    const allAllowed = buildChildDecide({ parentDecide: async () => allow, charter: worker.charter, allowedTools: effective, envelopeGranted: true });
+    for (const name of ['Bash', 'BashOutput', 'KillShell']) expect((await allAllowed(name, undefined)).action).toBe('allow');
+    expect(worker.allowedTools).not.toContain('BashOutput');
+  });
+
+  it('without Bash, read-only definitions never receive its background companions', async () => {
+    const explorer = resolveSpecialist('explorer')!;
+    const parentDecide = vi.fn(async () => allow);
+    const decide = buildChildDecide({ parentDecide, charter: explorer.charter, allowedTools: explorer.allowedTools, envelopeGranted: true });
+    for (const name of ['Bash', 'BashOutput', 'KillShell']) expect((await decide(name, undefined)).action).toBe('deny');
+    expect(parentDecide).not.toHaveBeenCalled();
+    // Even a malformed read-only definition explicitly listing Bash cannot use it.
+    const capped = buildChildDecide({ parentDecide: async () => allow, charter: 'read-only', allowedTools: ['Bash'], envelopeGranted: true });
+    expect((await capped('Bash', 'pwd')).action).toBe('deny');
+  });
+
   it('the two caps short-circuit BEFORE the parent is consulted — a refused tool costs no parent lookup', async () => {
     // WHY this matters beyond tidiness: parentDecide reads the remembered-rule
     // store (disk I/O). A tool the child may never call must not touch it.
diff --git a/desktop/tests/web-fetch-tool.test.ts b/desktop/tests/web-fetch-tool.test.ts
index fa0cdf4cd..98e85a65b 100644
--- a/desktop/tests/web-fetch-tool.test.ts
+++ b/desktop/tests/web-fetch-tool.test.ts
@@ -65,6 +65,25 @@ describe('WebFetch', () => {
       expect({ name: WebFetchTool.name, description: WebFetchTool.description }).toEqual(metadata);
     } finally { vi.unstubAllEnvs(); }
   });
+  it('settles a user Stop during pending DNS without dispatching HTTP', async () => {
+    const controller = new AbortController();
+    let entered!: () => void;
+    let release!: (value: Awaited<ReturnType<typeof publicLookup>>) => void;
+    const started = new Promise<void>(resolve => { entered = resolve; });
+    const dns = new Promise<Awaited<ReturnType<typeof publicLookup>>>(resolve => { release = resolve; });
+    const fetchMock = vi.fn(async () => html('not reached'));
+    __setWebFetchTestHooks({ lookup: () => { entered(); return dns; }, fetchImpl: fetchMock });
+    const work = WebFetchTool.execute({ url: 'https://pending.example/' } as any, { ...ctx(), signal: controller.signal });
+    try {
+      await started;
+      controller.abort();
+      await new Promise<void>(resolve => setImmediate(resolve));
+      const result = await Promise.race([work, Promise.resolve(null)]);
+      expect(result).toMatchObject({ isError: true });
+      expect(result?.text).toMatch(/canceled/i);
+      expect(fetchMock).not.toHaveBeenCalled();
+    } finally { release(await publicLookup()); await work; }
+  });
   it('extracts an article to markdown', async () => {
     __setWebFetchTestHooks({ lookup: publicLookup, fetchImpl: async () => html(
       '<html><head><title>Docs</title></head><body><nav>junk nav</nav><article><h1>API Guide</h1><p>' + 'Real content. '.repeat(40) + '</p></article></body></html>',
diff --git a/docs/native-runtime.md b/docs/native-runtime.md
index 6913a8425..0e6fad944 100644
--- a/docs/native-runtime.md
+++ b/docs/native-runtime.md
@@ -262,11 +262,11 @@ Providers discount the repeated part of a request only while its opening bytes m
 - **`Skill` is allowed at the permission baseline, alongside the other reads.** It opens exactly one file, in a directory the app discovered, chosen from a list the app itself advertised — strictly narrower than `Read`, which is already free. Every action a skill INSTRUCTS is performed by some other tool that is gated on its own terms, so prompting here would add friction with no safety gained and train the user to click through prompts that never matter. A remembered deny still wins: the baseline is a default posture, never a hard grant.
 - **`/skill-name` is the path that works on every model**, because the Skill tool is withheld from small windows. The dispatcher does NOT hold a list of installed skills: an unrecognized slash command rides the EXISTING `handled: false` branch (so a Claude Code session forwards it to the PTY exactly as before) while naming an `invoke-skill` intent for native sessions, whose harness owns the catalog. That avoids plumbing the skill list into two renderer components with no other use for it — at the cost that the dispatcher cannot distinguish "skill not installed" from "a Claude Code command with no native equivalent", so the refusal copy covers both in one sentence rather than guessing. Skills resolve LAST, after every built-in, so a marketplace skill named `clear` can never shadow the `/clear` barrier.
 - **`routeSlashResult` owns the ordering, because two callers got it wrong.** InputBar and `App.runSlashResult` each decided independently where a dispatcher result goes, and both checked `handled` BEFORE `nativeAction` — correct while every native action was also a recognized command, and a silent bug the moment `/skill-name` started riding the unhandled branch. It also names the case that used to vanish: `none-native-no-pty` carries the command, so a native session can say WHICH command was unavailable instead of returning into the void (`guardedPtySend` refuses natively and its return value was discarded at three call sites — the dead "Build New Theme with Claude" button was the most visible instance).
-- **Nested project instructions and path-scoped rules are ONE mechanism**, which is why they share `harness/injection/path-triggers.ts`: content discovered from a path, delivered as a message, bounded by the profile. The index is built ONCE per session — it is filesystem state, and re-statting the tree per tool call would be a real cost on a large repo. The ROOT `AGENTS.md`/`CLAUDE.md` is deliberately excluded because `prompt-assembly.ts` already puts it in the byte-stable system prompt. Rules come from `<cwd>/.claude/rules/*.md` with `paths:` frontmatter — the convention this workspace already uses on Claude Code, so a repo set up for CC works natively with no new configuration. A rule with **no `paths:` is skipped, never treated as global**: an eager rule rides every turn, the exact cost item 5 exists to control, and the rules README already calls omitting it a mistake — honoring it as "applies everywhere" would reward the error with the most expensive behavior.
+- **Nested project instructions and path-scoped rules are ONE mechanism**, which is why they share `harness/injection/path-triggers.ts`: content discovered from a path, delivered as a message, bounded by the profile. The index is built ONCE per session — it is filesystem state, and re-statting the tree per tool call would be a real cost on a large repo. The ROOT `AGENTS.md`/`CLAUDE.md` is deliberately excluded because `prompt-assembly.ts` already puts it in the byte-stable system prompt. Rules come from each `.claude/rules/*.md` folder between the nearest Git root (`.git` directory or worktree file) and cwd, with `paths:` frontmatter matched relative to the rule's owning folder. This does not discover personal/global rules or inherit rules outside the Git project. A rule with **no `paths:` is skipped, never treated as global**: an eager rule rides every turn, the exact cost item 5 exists to control, and the rules README already calls omitting it a mistake — honoring it as "applies everywhere" would reward the error with the most expensive behavior.
 - **The glob is deliberately not `shared/subject-glob.ts`.** That matcher exists for bash command strings and lets `*` cross path separators ("git push*" must match "git push origin x"). For a file glob that is wrong: `src/*.ts` would match `src/deep/nested.ts` and inject a rule into work it does not govern. Here `**` crosses separators and `*` does not. That distinction went untested until a mutation survived — every test had used `**` — so it is now pinned explicitly.
-- **Injection is messages, once per trigger per session, bounded by the profile.** A mid-session system-prompt edit would discard the KV cache prefix every local model reuses, turning a cheap follow-up turn into a full re-prefill of the whole conversation. Re-sending a rule after every `Read` of a matching file would dominate the conversation and blow the window it was sized against — and repetition does not make a model follow a rule harder. `Bash` is skipped when collecting touched paths: its permission subject is a command string, not a path. `fitInjection` always announces a cut, because a silently truncated procedure is worse than none — the model follows the fragment believing it is whole.
+- **Injection is messages, once per rule while its exact source-labelled message remains in model history, bounded by the profile.** A successful clear, summary, prune or resume reconciles loaded rules against retained messages; a failed rewrite leaves them alone. Summary prose mentioning a rule does not count as the rule itself. This reconciliation runs at history-replacement boundaries, never per streamed token. A mid-session system-prompt edit would discard the KV cache prefix every local model reuses, turning a cheap follow-up turn into a full re-prefill of the whole conversation. Re-sending a rule after every `Read` of a matching file would dominate the conversation and blow the window it was sized against — and repetition does not make a model follow a rule harder. `Bash` is skipped when collecting touched paths: its permission subject is a command string, not a path. For a first validated `Write`/`Edit` with new rules, the driver pairs every announced call (completed results remain real, unstarted calls say not run), appends the bounded source-labelled rules, and asks the model again **before** any file change; only a newly issued call can execute through the usual guards and permission policy. Post-step injection still applies to reads. `fitInjection` announces cuts, because a silently truncated procedure is worse than none — the model follows the fragment believing it is whole.
 - **Sizing is a function of the WINDOW, not the provider.** `injectionBudgetTokens` and `exposeSkillCatalog` derive from the effective context window (so an 8k model loaded at `-c 128000` is judged on its real ceiling), and an unmeasured window is treated as small. Frontier hosted providers (anthropic/openai/google/openrouter) are exempt: we never DISCOVER their window, so `null` there means "not measured", not "small", and sizing them down would strip the catalog from every cloud session. `openai-compatible` is deliberately NOT exempt — `provider-registry` documents it as the Ollama / LM Studio shape, so an unmeasured one is a local model in disguise.
-- **The ROOT project-instruction file is OUTLINED to fit, never tail-cut — `fitProjectInstructions`, never a raw `.slice()`** (migrated 2026-08-12 from the path-scoped rule) — EVERY heading survives at every budget; the budget buys body text (full from the top, then heading + ~200-char elided first lines marked `…`). *Why:* a section the model can't SEE is one it can't know to Read, so its rules silently stop existing — and the elision cap is load-bearing, since uncapped previews of the youcoded-dev workspace's own paragraph-opening sections fit at NO depth and collapsed the outline to bare headings. It sits in the byte-stable prompt, not a message, so it has its own fitter, but shares `injection-budget.ts` (one chars-per-token constant) and `profile.injectionBudgetTokens`. Was `.slice(0, 20_000)` until 2026-08-10 — chars not tokens, same for frontier and 8k, byte-offset, silent (§7 item 3). Guard: `injection-budget.test.ts`.
+- **Startup instruction files are selected in every ancestor folder through filesystem root, broad to narrow** — one per folder (`AGENTS.md` preferred over `CLAUDE.md`), including folders above a Git boundary. `prepareProjectInstructions` reads them asynchronously before construction, fitting the entire source-labelled chain to one `profile.injectionBudgetTokens` allotment; `fitProjectInstructions` preserves headings where space allows and announces cuts or omitted headings where it cannot. The captured content is held for the session's prompt and on-demand context-panel text, not re-read after a disk edit. There is no dedicated personal-global location or import expansion. Guard: `prompt-assembly.test.ts`, `session-context.test.ts`, `injection-budget.test.ts`.
 - **The outline notice says only what actually happened** — "outlined", never "omitted", once every heading survives; it branches on preview depth (depth 0 has no first lines to claim); "headings omitted entirely" is reserved for the ONE path where they truly are. **Sizing is fixed at session start — `setBinding` does NOT re-apply it** (the prompt is never reassembled; that freeze IS the KV-cache prefix), so a mid-session swap leaves instructions sized for the STARTING model. Guard: `injection-budget.test.ts` (notice-accuracy block).
 - **`native:*` four-surface parity was only pinned on 2026-07-28.** `ipc-channels.test.ts` covers `remote-shim.ts` and `SessionService.kt` per-PREFIX — `dev:*` and `account:*` each had a block, `native:*` never did. Verified by deleting `native:invoke-skill` from the shim: the whole file still went green. A native command that works on desktop and dies on the remote web client is exactly what program §9 exit criterion (c) forbids, and nothing would have said so.