From 4fdaa3b1dc9375a18f6750bdc48a54409b1fac6e Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 9 Sep 2026 21:20:16 -0700
Subject: [PATCH 01/11] Parameterize the shared restore path and add alertSeed

One Window has to plan a resume or a cold restore per Workspace off one boot
payload, so the pieces `resumeOrRestore` did in one pass are now separable:
`collectLivePtys` runs the single `requestInit` wait for the whole window, and
`resumeOrRestoreFrom` plans over a slice of that list against an explicitly
supplied record. `restoreSession` takes the same two sources. The wrapper
`resumeOrRestore(platform)` is unchanged, so VS Code, Pocket, and the website
keep their existing behavior.

`claimUnowned` mirrors the unowned-PTY claim in message-router.ts: a live PTY
that no saved Workspace names joins the plan that asks for it, and because such
an id has no saved layout slot the plan degrades to the flat live list exactly
as a single Wall already does.

`PlatformAdapter.alertSeed` is the standalone twin of the seed the VS Code
extension host does while answering a cold boot: standalone's AlertManager lives
in the webview, so the restore path is the only thing that can hand a fresh PTY
the TODO its saved pane carried.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QBf4rQbwuxV6n6v7E3twYe
---
 lib/src/lib/platform/types.ts       |  13 ++
 lib/src/lib/reconnect.test.ts       | 120 +++++++++++++++++-
 lib/src/lib/reconnect.ts            | 187 +++++++++++++++++-----------
 lib/src/lib/session-restore.test.ts |  60 +++++++++
 lib/src/lib/session-restore.ts      |  23 +++-
 5 files changed, 329 insertions(+), 74 deletions(-)

diff --git a/lib/src/lib/platform/types.ts b/lib/src/lib/platform/types.ts
index 9476be67e..85ef6f804 100644
--- a/lib/src/lib/platform/types.ts
+++ b/lib/src/lib/platform/types.ts
@@ -7,6 +7,7 @@ import type { ShellEntry } from '../shell-defaults';
 // share it without pulling this browser-typed module into a Node tsconfig.
 import type { IframeProxyResult } from './iframe-proxy-types';
 import type { NotepadArchivePort } from '../notepad/types';
+import type { PersistedAlertState } from '../session-types';
 
 export interface PtyInfo {
   helper?: HelperIdentity;
@@ -240,6 +241,18 @@ export interface PlatformAdapter {
    */
   getRecoveryCommands?(): Record<string, string>;
 
+  /**
+   * Seed a cold-restored Surface's persisted TODO/alert into the host's
+   * `AlertManager`, so the freshly spawned PTY inherits the state its saved pane
+   * carried (`docs/specs/alert.md` -> "Persist only").
+   *
+   * Present only where the adapter owns the manager: standalone runs it in the
+   * webview, so the restore path is the only thing that can seed it. VS Code
+   * omits it — its extension host seeds its own manager while answering the
+   * webview's boot (`vscode-ext/src/message-router.ts`).
+   */
+  alertSeed?(id: string, state: PersistedAlertState): void;
+
   // PTY queries
   getCwd(id: string): Promise<string | null>;
   /** TCP listening ports opened by this terminal's process tree (shell + descendants). */
diff --git a/lib/src/lib/reconnect.test.ts b/lib/src/lib/reconnect.test.ts
index 99b5db82a..388f828cf 100644
--- a/lib/src/lib/reconnect.test.ts
+++ b/lib/src/lib/reconnect.test.ts
@@ -16,10 +16,11 @@ vi.mock('./terminal-registry', () => ({
   getDefaultShellOpts: terminalRegistryMocks.getDefaultShellOpts,
 }));
 
-import { resumeOrRestore } from './reconnect';
+import { collectLivePtys, resumeOrRestore, resumeOrRestoreFrom } from './reconnect';
 import { addPlainNote, buildVolatileSnapshot, clearAllNotepads, getNotes } from './notepad/notepad-store';
 import type { VolatileNotepadSnapshot } from './notepad/types';
 import { getHelper, forgetHelper } from './helper-terminal';
+import { setPlatform } from './platform';
 import type { LathNode } from './lath/model';
 
 /** A native Lath persisted layout over `ids` (row split; empty tree for none) —
@@ -569,3 +570,120 @@ describe('browser-only notepad resume', () => {
     expect(platform.spawnPty).not.toHaveBeenCalled();
   });
 });
+
+describe('resumeOrRestoreFrom', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  const savedFor = (...ids: string[]): PersistedSession => ({
+    version: 3,
+    lathLayout: lathLayoutFor(...ids),
+    panes: ids.map((id) => ({ id, title: id, cwd: null, untouched: false })),
+  });
+
+  /** One `collectLivePtys` for the whole Window, exactly as `main.tsx` boots. */
+  async function live(ptys: PtyInfo[], savedState: PersistedSession | null = null) {
+    const platform = createPlatform(ptys, savedState);
+    return { platform, live: await collectLivePtys(platform) };
+  }
+
+  it('gives each Workspace only the live PTYs its own saved record names', async () => {
+    const { platform, live: collected } = await live([
+      { id: 'a1', alive: true },
+      { id: 'b1', alive: true },
+    ]);
+
+    const a = resumeOrRestoreFrom(platform, collected, {
+      savedSession: savedFor('a1'),
+      ptyIds: new Set(['a1']),
+    });
+    const b = resumeOrRestoreFrom(platform, collected, {
+      savedSession: savedFor('b1'),
+      ptyIds: new Set(['b1']),
+    });
+
+    expect(a.paneIds).toEqual(['a1']);
+    expect(b.paneIds).toEqual(['b1']);
+    expect(terminalRegistryMocks.resumeTerminal).toHaveBeenCalledWith('a1', 'a1-replay', expect.anything());
+    expect(terminalRegistryMocks.resumeTerminal).toHaveBeenCalledWith('b1', 'b1-replay', expect.anything());
+  });
+
+  it('keeps a helper with the Workspace that holds its source', async () => {
+    const helper = { parentId: 'a1', command: 'git status' };
+    const { platform, live: collected } = await live([
+      { id: 'a1', alive: true },
+      { id: 'a-helper', alive: true, helper },
+      { id: 'b1', alive: true },
+    ]);
+
+    const a = resumeOrRestoreFrom(platform, collected, {
+      savedSession: savedFor('a1'),
+      ptyIds: new Set(['a1', 'a-helper']),
+    });
+    expect(a.paneIds).toEqual(['a1']);
+    expect(getHelper('a1')?.status).toBe('preserved');
+    forgetHelper('a1');
+
+    // The same helper handed to a Workspace WITHOUT its source is an ordinary
+    // pane there: `ptyById` is the slice, so the parent lookup misses and the
+    // orphan is adopted rather than restored as a helper.
+    vi.clearAllMocks();
+    setPlatform(platform);
+    const b = resumeOrRestoreFrom(platform, collected, {
+      savedSession: null,
+      ptyIds: new Set(['b1', 'a-helper']),
+    });
+    expect(b.paneIds).toEqual(['a-helper', 'b1']);
+    expect(getHelper('a1')).toBeUndefined();
+  });
+
+  it('claims a live PTY no saved Workspace names for the plan that asks', async () => {
+    const { platform, live: collected } = await live([
+      { id: 'a1', alive: true },
+      { id: 'stray', alive: true },
+    ]);
+
+    const inactive = resumeOrRestoreFrom(platform, collected, {
+      savedSession: savedFor('b1'),
+      ptyIds: new Set(['b1']),
+    });
+    // No live PTY of its own: a cold restore of its saved panes.
+    expect(inactive.paneIds).toEqual(['b1']);
+
+    const active = resumeOrRestoreFrom(platform, collected, {
+      savedSession: savedFor('a1'),
+      ptyIds: new Set(['a1']),
+      claimUnowned: new Set(['stray']),
+    });
+    // An adopted id has no saved layout slot, so the plan degrades to the flat
+    // live list rather than restoring a layout that cannot hold it.
+    expect(active.paneIds).toEqual(['a1', 'stray']);
+    expect(active.lathLayout).toBeUndefined();
+  });
+
+  it('plans against the record it is handed, not the platform slot', async () => {
+    const { platform, live: collected } = await live([], savedFor('slot-pane'));
+
+    expect(resumeOrRestoreFrom(platform, collected, { savedSession: savedFor('given') }).paneIds)
+      .toEqual(['given']);
+    // `null` is "this Workspace has no record", never "read the slot".
+    expect(resumeOrRestoreFrom(platform, collected, { savedSession: null }).paneIds).toEqual([]);
+    // Omitted still reads the slot, which is what the single-Wall hosts take.
+    expect(resumeOrRestoreFrom(platform, collected, {}).paneIds).toEqual(['slot-pane']);
+  });
+
+  it('hands each plan its own recovery commands', async () => {
+    const { platform, live: collected } = await live([]);
+    platform.getRecoveryCommands = vi.fn(() => ({ 'a1': 'whole-window' }));
+
+    resumeOrRestoreFrom(platform, collected, {
+      savedSession: savedFor('a1'),
+      recoveryCommands: { 'a1': 'claude --resume abc' },
+    });
+    expect(terminalRegistryMocks.restoreTerminal).toHaveBeenCalledWith(
+      'a1', expect.objectContaining({ resumeCommand: 'claude --resume abc' }),
+    );
+    expect(platform.getRecoveryCommands).not.toHaveBeenCalled();
+  });
+});
diff --git a/lib/src/lib/reconnect.ts b/lib/src/lib/reconnect.ts
index efb55e4e7..cbe27ac6b 100644
--- a/lib/src/lib/reconnect.ts
+++ b/lib/src/lib/reconnect.ts
@@ -3,7 +3,7 @@ import type { LathPersistedLayout } from './lath/persistence';
 import type { PlatformAdapter, PtyInfo } from './platform/types';
 import { hydrateNotepadFromVolatile } from './notepad/notepad-store';
 import { restoreBrowserSurfaceTodo, resumeTerminal } from './terminal-registry';
-import { carrySurfaceRefs, readPersistedSession, type PersistedDoor, type PersistedSurfaceRefs } from './session-types';
+import { carrySurfaceRefs, readPersistedSession, type PersistedDoor, type PersistedSession, type PersistedSurfaceRefs } from './session-types';
 import { persistedLathLayout, restoreSession } from './session-restore';
 
 export interface ReconnectResult {
@@ -19,6 +19,34 @@ export interface ReconnectResult {
   surfaceRefsNext?: number;
 }
 
+/** Every PTY the host still holds, with whatever replay each one sent. Collected
+ *  ONCE per Window: the wait below is a single `requestInit` round trip, and the
+ *  host answers it for the whole webview, not per Workspace. */
+export interface LivePtys {
+  ptys: PtyInfo[];
+  replay: Map<string, string>;
+}
+
+/**
+ * What one plan may claim out of `LivePtys`, and what it plans against. Every
+ * field defaults to the whole-window answer, so the single-Wall hosts reach the
+ * same behavior through `resumeOrRestore`.
+ */
+export interface ResumePlanOptions {
+  /** The record to plan from; `undefined` reads the platform slot, `null` is "none". */
+  savedSession?: PersistedSession | null;
+  /** Live ids this plan owns by name. Omitted claims every live PTY. */
+  ptyIds?: ReadonlySet<string>;
+  /** Live ids no saved Workspace named, adopted by this plan — the active
+   *  Workspace's, mirroring the unowned claim in
+   *  `vscode-ext/src/message-router.ts`. An adopted id has no saved layout
+   *  position, so a plan that takes one falls back to the flat live list, exactly
+   *  as a single Wall does when a live PTY outruns its last save. */
+  claimUnowned?: ReadonlySet<string>;
+  /** Single-use resume invocations already claimed for this plan's panes. */
+  recoveryCommands?: Record<string, string>;
+}
+
 /**
  * Resume over live PTYs, or cold-restore from saved session.
  *
@@ -29,27 +57,19 @@ export interface ReconnectResult {
  * 3. Neither → return empty (Wall creates a fresh terminal)
  */
 export async function resumeOrRestore(platform: PlatformAdapter): Promise<ReconnectResult> {
-  const liveResult = await resumeLiveSessions(platform);
-  if (liveResult) return liveResult;
-
-  const restored = await restoreSession(platform);
-  if (restored) {
-    const saved = readPersistedSession(platform.getState());
-    // Browser-only views have no PTY with which to prove a live resume. Their
-    // host-memory mirror is that proof; an extension restart supplies null.
-    // Rebuild their layout first, then hydrate only those surviving Surfaces.
-    if (saved?.panes.length && saved.panes.every((pane) => pane.surfaceType === 'browser')) {
-      return hydrateNotepad(platform, restored);
-    }
-    return restored;
-  }
-
-  return { paneIds: [] };
+  return resumeOrRestoreFrom(platform, await collectLivePtys(platform));
 }
 
-function resumeLiveSessions(platform: PlatformAdapter): Promise<ReconnectResult | null> {
-  return new Promise<ReconnectResult | null>((resolve) => {
-    const replayBuffer = new Map<string, string>();
+/**
+ * Ask the host for its PTYs and gather the replay each one sends back.
+ *
+ * Bounded rather than counted-to-completion: a host that lists PTYs but never
+ * replays one of them must not hold up boot, so 500 ms is the ceiling and a
+ * short list resolves as soon as every replay has arrived.
+ */
+export function collectLivePtys(platform: PlatformAdapter): Promise<LivePtys> {
+  return new Promise<LivePtys>((resolve) => {
+    const replay = new Map<string, string>();
     let ptyList: PtyInfo[] | null = null;
 
     const timeout = setTimeout(() => finish(), 500);
@@ -62,8 +82,8 @@ function resumeLiveSessions(platform: PlatformAdapter): Promise<ReconnectResult
     };
 
     const handleReplay = (detail: { id: string; data: string }) => {
-      replayBuffer.set(detail.id, detail.data);
-      if (ptyList && replayBuffer.size >= ptyList.length) {
+      replay.set(detail.id, detail.data);
+      if (ptyList && replay.size >= ptyList.length) {
         finish();
       }
     };
@@ -75,50 +95,7 @@ function resumeLiveSessions(platform: PlatformAdapter): Promise<ReconnectResult
       clearTimeout(timeout);
       platform.offPtyList(handleList);
       platform.offPtyReplay(handleReplay);
-
-      if (!ptyList || ptyList.length === 0) {
-        resolve(null);
-        return;
-      }
-
-      const savedState = platform.getState();
-      const savedResumeInfo = getSavedPaneResumeInfo(savedState, ptyList.map((pty) => pty.id));
-      const ids: string[] = [];
-      const ptyById = new Map(ptyList.map((pty) => [pty.id, pty]));
-      for (const pty of ptyList) {
-        const resumeInfo: { alive: boolean; exitCode?: number; shell?: string; title?: string; untouched?: boolean; helper?: PtyInfo['helper'] } = {
-          alive: pty.alive,
-          exitCode: pty.exitCode,
-        };
-        if (pty.shell !== undefined) resumeInfo.shell = pty.shell;
-        const savedInfo = savedResumeInfo.get(pty.id);
-        if (savedInfo?.title !== undefined) resumeInfo.title = savedInfo.title;
-        if (savedInfo?.untouched) resumeInfo.untouched = true;
-        // A helper stays one only while its source is also live; helpers cannot
-        // have helpers.
-        const parent = pty.helper && ptyById.get(pty.helper.parentId);
-        const helper = parent && !parent.helper ? pty.helper : undefined;
-        if (helper) resumeInfo.helper = helper;
-        resumeTerminal(pty.id, replayBuffer.get(pty.id) ?? null, resumeInfo);
-        if (helper) { restoreHelper(pty.id, helper); continue; }
-        ids.push(pty.id);
-        if (pty.helper) adoptOrphanedHelper(pty.id);
-      }
-      // Pull saved visible/doors state so a resume (e.g. after panel
-      // close/reopen) restores splits and doors instead of stacking every live
-      // PTY into one tab group.
-      const savedPlan = getSavedResumePlan(savedState, ids);
-      if (savedPlan) {
-        resolve(hydrateNotepad(platform, savedPlan));
-        return;
-      }
-
-      const saved = readPersistedSession(savedState);
-      resolve(hydrateNotepad(platform, {
-        paneIds: ids,
-        doors: [],
-        ...carrySurfaceRefs(saved),
-      }));
+      resolve({ ptys: ptyList ?? [], replay });
     }
 
     platform.onPtyList(handleList);
@@ -127,6 +104,78 @@ function resumeLiveSessions(platform: PlatformAdapter): Promise<ReconnectResult
   });
 }
 
+/** The planning half of a resume/restore, over PTYs someone else collected. One
+ *  call per Workspace, each taking its own slice of the one live list. */
+export function resumeOrRestoreFrom(
+  platform: PlatformAdapter,
+  live: LivePtys,
+  opts: ResumePlanOptions = {},
+): ReconnectResult {
+  const saved = opts.savedSession !== undefined
+    ? opts.savedSession
+    : readPersistedSession(platform.getState());
+
+  const mine = live.ptys.filter((pty) =>
+    opts.ptyIds === undefined || opts.ptyIds.has(pty.id) || opts.claimUnowned?.has(pty.id));
+  const resumed = mine.length > 0 ? resumeLivePtys(mine, live.replay, saved) : null;
+  if (resumed) return hydrateNotepad(platform, resumed);
+
+  const restored = restoreSession(platform, {
+    savedSession: saved,
+    ...(opts.recoveryCommands !== undefined ? { recoveryCommands: opts.recoveryCommands } : {}),
+  });
+  if (restored) {
+    // Browser-only views have no PTY with which to prove a live resume. Their
+    // host-memory mirror is that proof; an extension restart supplies null.
+    // Rebuild their layout first, then hydrate only those surviving Surfaces.
+    if (saved?.panes.length && saved.panes.every((pane) => pane.surfaceType === 'browser')) {
+      return hydrateNotepad(platform, restored);
+    }
+    return restored;
+  }
+
+  return { paneIds: [] };
+}
+
+function resumeLivePtys(
+  ptyList: PtyInfo[],
+  replayBuffer: Map<string, string>,
+  saved: PersistedSession | null,
+): ReconnectResult {
+  const savedResumeInfo = getSavedPaneResumeInfo(saved, ptyList.map((pty) => pty.id));
+  const ids: string[] = [];
+  const ptyById = new Map(ptyList.map((pty) => [pty.id, pty]));
+  for (const pty of ptyList) {
+    const resumeInfo: { alive: boolean; exitCode?: number; shell?: string; title?: string; untouched?: boolean; helper?: PtyInfo['helper'] } = {
+      alive: pty.alive,
+      exitCode: pty.exitCode,
+    };
+    if (pty.shell !== undefined) resumeInfo.shell = pty.shell;
+    const savedInfo = savedResumeInfo.get(pty.id);
+    if (savedInfo?.title !== undefined) resumeInfo.title = savedInfo.title;
+    if (savedInfo?.untouched) resumeInfo.untouched = true;
+    // A helper stays one only while its source is also live; helpers cannot
+    // have helpers. `ptyById` is this plan's slice, so a helper whose parent
+    // went to another Workspace is resumed as an ordinary pane rather than
+    // restored into a Wall that does not hold its source.
+    const parent = pty.helper && ptyById.get(pty.helper.parentId);
+    const helper = parent && !parent.helper ? pty.helper : undefined;
+    if (helper) resumeInfo.helper = helper;
+    resumeTerminal(pty.id, replayBuffer.get(pty.id) ?? null, resumeInfo);
+    if (helper) { restoreHelper(pty.id, helper); continue; }
+    ids.push(pty.id);
+    if (pty.helper) adoptOrphanedHelper(pty.id);
+  }
+  // Pull saved visible/doors state so a resume (e.g. after panel
+  // close/reopen) restores splits and doors instead of stacking every live
+  // PTY into one tab group.
+  return getSavedResumePlan(saved, ids) ?? {
+    paneIds: ids,
+    doors: [],
+    ...carrySurfaceRefs(saved),
+  };
+}
+
 /**
  * Give a resumed webview back the notes the host mirrored for it
  * (docs/specs/notepad.md → "Live resume"). Only reachable from the live-PTY
@@ -143,8 +192,7 @@ function hydrateNotepad(platform: PlatformAdapter, result: ReconnectResult): Rec
   return result;
 }
 
-function getSavedPaneResumeInfo(savedState: unknown, liveIds: string[]): Map<string, { title: string; untouched: boolean }> {
-  const saved = readPersistedSession(savedState);
+function getSavedPaneResumeInfo(saved: PersistedSession | null, liveIds: string[]): Map<string, { title: string; untouched: boolean }> {
   if (!saved || !Array.isArray(saved.panes)) return new Map();
 
   const liveSet = new Set(liveIds);
@@ -157,8 +205,7 @@ function getSavedPaneResumeInfo(savedState: unknown, liveIds: string[]): Map<str
   return result;
 }
 
-function getSavedResumePlan(savedState: unknown, liveIds: string[]): ReconnectResult | null {
-  const saved = readPersistedSession(savedState);
+function getSavedResumePlan(saved: PersistedSession | null, liveIds: string[]): ReconnectResult | null {
   if (!saved || !Array.isArray(saved.panes)) return null;
 
   // Reuse persisted visible/doors state only when every live PTY is covered
diff --git a/lib/src/lib/session-restore.test.ts b/lib/src/lib/session-restore.test.ts
index 13e7acd98..aa8919b1e 100644
--- a/lib/src/lib/session-restore.test.ts
+++ b/lib/src/lib/session-restore.test.ts
@@ -314,3 +314,63 @@ describe('restoreSession', () => {
     );
   });
 });
+
+describe('restoreSession alert seeding', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  const alert = { status: 'WATCHING_DISABLED' as const, todo: true, notification: null };
+
+  it('seeds a terminal pane\'s persisted TODO and leaves browser panes to the todo restore', () => {
+    const saved: PersistedSession = {
+      version: 3,
+      panes: [
+        { id: 'shell', title: 'Shell', cwd: '/tmp', untouched: false, alert },
+        { id: 'quiet', title: 'Quiet', cwd: '/tmp', untouched: false },
+        { id: 'web', title: 'Web', cwd: null, untouched: false, surfaceType: 'browser', alert },
+      ],
+    };
+    const platform = createPlatform(saved);
+    const alertSeed = vi.fn();
+    platform.alertSeed = alertSeed;
+
+    restoreSession(platform);
+
+    // Only the terminal pane that carried one, and only that pane's blob.
+    expect(alertSeed.mock.calls).toEqual([['shell', alert]]);
+  });
+
+  it('restores without a seeding host', () => {
+    const saved: PersistedSession = {
+      version: 3,
+      panes: [{ id: 'shell', title: 'Shell', cwd: '/tmp', untouched: false, alert }],
+    };
+    // VS Code omits `alertSeed`; its extension host seeds its own manager.
+    expect(restoreSession(createPlatform(saved))?.paneIds).toEqual(['shell']);
+  });
+
+  it('restores the record it is handed with the commands it is handed', () => {
+    const given: PersistedSession = {
+      version: 3,
+      panes: [{ id: 'given', title: 'Given', cwd: '/w', untouched: false }],
+    };
+    const platform = createPlatform(
+      { version: 3, panes: [{ id: 'slot', title: 'Slot', cwd: null, untouched: false }] },
+      { given: 'from-the-window' },
+    );
+
+    const result = restoreSession(platform, {
+      savedSession: given,
+      recoveryCommands: { given: 'claude --resume xyz' },
+    });
+
+    expect(result?.paneIds).toEqual(['given']);
+    expect(terminalRegistryMocks.restoreTerminal).toHaveBeenCalledWith(
+      'given', expect.objectContaining({ cwd: '/w', resumeCommand: 'claude --resume xyz' }),
+    );
+    expect(platform.getRecoveryCommands).not.toHaveBeenCalled();
+    // An explicit `null` is "no record", never a fallback to the slot.
+    expect(restoreSession(platform, { savedSession: null })).toBeNull();
+  });
+});
diff --git a/lib/src/lib/session-restore.ts b/lib/src/lib/session-restore.ts
index 283b3730a..fc3eb318c 100644
--- a/lib/src/lib/session-restore.ts
+++ b/lib/src/lib/session-restore.ts
@@ -21,8 +21,20 @@ export function persistedLathLayout(saved: PersistedSession): LathPersistedLayou
   return isLathPersistedLayout(saved.lathLayout) ? saved.lathLayout : undefined;
 }
 
-export function restoreSession(platform: PlatformAdapter): RestoredSession | null {
-  const saved = readPersistedSession(platform.getState());
+/** What a restore reads instead of the platform slot, so one Window can plan a
+ *  cold restore per Workspace off one boot payload. Both default to the
+ *  platform's own answer, which is what the single-Wall hosts still take. */
+export interface RestoreSources {
+  /** The record to restore; `undefined` reads the platform slot, `null` is "none". */
+  savedSession?: PersistedSession | null;
+  /** Host-captured single-use resume invocations, already claimed for this plan. */
+  recoveryCommands?: Record<string, string>;
+}
+
+export function restoreSession(platform: PlatformAdapter, sources: RestoreSources = {}): RestoredSession | null {
+  const saved = sources.savedSession !== undefined
+    ? sources.savedSession
+    : readPersistedSession(platform.getState());
   if (!saved || !saved.panes || saved.panes.length === 0) return null;
   const doors = saved.doors ?? [];
   const doorIds = new Set(doors.map((item) => item.id));
@@ -38,7 +50,7 @@ export function restoreSession(platform: PlatformAdapter): RestoredSession | nul
   // would replay it (docs/specs/transport.md -> "Consuming it"). Restore-only —
   // the live-resume path in reconnect.ts never reaches here, because there the
   // agent is still Live and has nothing to resume.
-  const recoveryCommands = platform.getRecoveryCommands?.() ?? {};
+  const recoveryCommands = sources.recoveryCommands ?? platform.getRecoveryCommands?.() ?? {};
 
   for (const pane of saved.panes) {
     // Browser surfaces have no PTY or xterm; the persisted layout recreates them
@@ -56,6 +68,11 @@ export function restoreSession(platform: PlatformAdapter): RestoredSession | nul
       untouched: pane.untouched,
       resumeCommand: recoveryCommands[pane.id] ?? null,
     });
+    // The fresh PTY inherits the pane's persisted TODO/alert, on the hosts whose
+    // AlertManager lives in the webview. Seeded after `restoreTerminal` so the
+    // state change lands on a registered pane. Restore-only: a live resume still
+    // has the manager's own state (docs/specs/alert.md -> "Persist only").
+    if (pane.alert) platform.alertSeed?.(pane.id, pane.alert);
   }
 
   return {

From 2b6e88824681b111d7145f7d5dfb91462a8be2e1 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 9 Sep 2026 21:27:59 -0700
Subject: [PATCH 02/11] Complete the Window aggregator and retire the
 workspaces flag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The aggregator now owns the whole Window blob: `seedWindowSession` installs what
the last run left on disk before any Wall mounts, `previousWorkspaceSession`
answers a Workspace's save with its own record (seed until its Wall publishes,
which is what keeps a dead PTY's retained cwd and alert from being dropped on
the first save after a restore), and one 500 ms debounced writer collapses N
Workspaces reacting to one event into a single host write. Installing the writer
also subscribes to the Workspace store, because a reorder, rename, or active
switch changes the blob with no Session changing. `flushWindowSession` is the
quit step between the last Wall flush and the host's drain.

`window-persistence.ts` loses its flag branches for `loadWindowState` /
`saveWindowState`; a pre-Window blob is wrapped as the one Workspace, the only
migration. `dormouse.flags.workspaces` is gone with them.

Both stores that feed the dirty tracker now name the Surface that changed, so a
Workspace only rebuilds its record for its own Surfaces — unkeyed stays a
store-wide reset every Wall takes. Without this every idle Workspace would run a
`getCwd` per pane on every heartbeat while any Workspace was busy.

Both adapters are rewired onto the Window helpers; they still persist nothing
until the flip.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QBf4rQbwuxV6n6v7E3twYe
---
 lib/src/components/Wall.test.tsx              |  37 ++++
 .../wall/use-session-persistence.ts           |  30 +--
 lib/src/lib/feature-flags.test.ts             |  39 ----
 lib/src/lib/feature-flags.ts                  |  24 ---
 lib/src/lib/notepad/never-persisted.test.ts   |  15 +-
 lib/src/lib/session-activity-store.ts         |  19 +-
 lib/src/lib/terminal-lifecycle.ts             |   2 +-
 lib/src/lib/terminal-state-store.ts           |  22 ++-
 lib/src/lib/window-persistence.test.ts        | 178 ++++++------------
 lib/src/lib/window-persistence.ts             |  88 +++------
 lib/src/lib/window-session-aggregator.test.ts | 168 ++++++++++++++---
 lib/src/lib/window-session-aggregator.ts      | 143 +++++++++++---
 standalone/src/browser-sidecar-adapter.ts     |  18 +-
 standalone/src/tauri-adapter.ts               |  18 +-
 14 files changed, 461 insertions(+), 340 deletions(-)
 delete mode 100644 lib/src/lib/feature-flags.test.ts

diff --git a/lib/src/components/Wall.test.tsx b/lib/src/components/Wall.test.tsx
index 7d876077c..b3a8e724f 100644
--- a/lib/src/components/Wall.test.tsx
+++ b/lib/src/components/Wall.test.tsx
@@ -26,6 +26,8 @@ import { createTerminalPaneState, type TerminalPaneState } from '../lib/terminal
 import { getWallHandle, listWallHandles } from './wall/wall-handles';
 import { mountWallHarness, type WallHarness } from './wall/wall-test-utils';
 import { DEFAULT_WORKSPACE_ID } from '../lib/session-types';
+import { clearTerminalActivity, setTerminalActivity } from '../lib/session-activity-store';
+import { resetTerminalPaneState } from '../lib/terminal-state-store';
 
 globalThis.IS_REACT_ACT_ENVIRONMENT = true;
 
@@ -2100,4 +2102,39 @@ describe('Wall session persistence: ownership filtering', () => {
       vi.useRealTimers();
     }
   });
+
+  it('ignores an activity or pane-state change belonging to another Workspace', async () => {
+    vi.useFakeTimers();
+    try {
+      const saveState = vi.spyOn(fake, 'saveState');
+      const settle = (ms: number) => act(async () => { await vi.advanceTimersByTimeAsync(ms); });
+
+      await act(async () => {
+        root.render(<Wall initialPaneIds={['pane-a']} showBaseboard />);
+      });
+      // Past a heartbeat, so the mount's own dirty state has been written off.
+      await settle(31_000);
+      saveState.mockClear();
+
+      // Both stores are Window-global. A change keyed to a foreign Surface must
+      // not make this Wall rebuild its record — that is a `getCwd` per pane, on
+      // every idle Workspace, every heartbeat.
+      await act(async () => { setTerminalActivity('pane-elsewhere', { todo: true }); });
+      await act(async () => { resetTerminalPaneState('pane-elsewhere'); });
+      await settle(31_000);
+      expect(saveState, 'foreign Surface').not.toHaveBeenCalled();
+
+      await act(async () => { setTerminalActivity('pane-a', { todo: true }); });
+      await settle(31_000);
+      expect(saveState, 'own Surface').toHaveBeenCalled();
+      saveState.mockClear();
+
+      // An unkeyed notification is a store-wide reset, which every Wall takes.
+      await act(async () => { clearTerminalActivity(); });
+      await settle(31_000);
+      expect(saveState, 'store-wide reset').toHaveBeenCalled();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
 });
diff --git a/lib/src/components/wall/use-session-persistence.ts b/lib/src/components/wall/use-session-persistence.ts
index 9272071fc..6b5f4d9be 100644
--- a/lib/src/components/wall/use-session-persistence.ts
+++ b/lib/src/components/wall/use-session-persistence.ts
@@ -3,7 +3,7 @@ import { pasteFilePaths } from '../../lib/clipboard';
 import { getPlatform } from '../../lib/platform';
 import { saveSession, type SaveSink } from '../../lib/session-save';
 import { createSessionDirtyTracker } from '../../lib/session-dirty';
-import { publishWorkspaceSession } from '../../lib/window-session-aggregator';
+import { previousWorkspaceSession, publishWorkspaceSession } from '../../lib/window-session-aggregator';
 import {
   subscribeToActivity,
   subscribeToTerminalPaneState,
@@ -12,7 +12,7 @@ import {
 import { surfaceKindFromParams } from './browser-surface';
 import type { LathWallEngine } from './lath-wall-engine';
 import type { DooredItem, WallSelectionKind } from './wall-types';
-import type { PersistedDoor, PersistedSession, PersistedSurfaceRefs, WorkspaceId } from '../../lib/session-types';
+import type { PersistedDoor, PersistedSurfaceRefs, WorkspaceId } from '../../lib/session-types';
 
 export interface SessionPersistenceHandle {
   /** Persist immediately, awaiting the whole queued pipeline. */
@@ -61,19 +61,15 @@ export function useSessionPersistence({
   const pendingSaveNeededRef = useRef(false);
   // See session-dirty.ts for the conservative-under-races generation model.
   const trackerRef = useRef(createSessionDirtyTracker());
-  // This Workspace's last published record: `getPreviousPaneMap`'s source, which
-  // must be this Workspace's own (a dead PTY's cwd is retained there), not the
-  // Window's active Workspace.
-  const publishedRef = useRef<PersistedSession | null>(null);
-
+  // This Workspace's own previous record, which is where a dead PTY's retained
+  // cwd and alert live. The aggregator holds it because the first save after a
+  // restore has to read the record BOOT seeded, not the (still empty) one this
+  // Wall has published.
   const sink = useMemo<SaveSink | undefined>(() => {
     if (workspaceId === undefined) return undefined;
     return {
-      previous: () => publishedRef.current,
-      publish: (session) => {
-        publishedRef.current = session;
-        publishWorkspaceSession(workspaceId, session);
-      },
+      previous: () => previousWorkspaceSession(workspaceId),
+      publish: (session) => publishWorkspaceSession(workspaceId, session),
     };
   }, [workspaceId]);
 
@@ -204,8 +200,14 @@ export function useSessionPersistence({
     // store of its own to report it (the registry mutates silently), which is
     // why the pty echo above is what marks it.
     platform.onPtyData(handlePtyData);
-    const unsubActivity = subscribeToActivity(markDirty);
-    const unsubPaneState = subscribeToTerminalPaneState(markDirty);
+    // Keyed like the PTY triggers: both stores are Window-global, so an
+    // unfiltered listener would rebuild every idle Workspace's record — a
+    // `getCwd` per pane — whenever any Workspace changed. A notification with no
+    // id is a store-wide reset, which every Wall must take.
+    const ownsChange = (id?: string) => id === undefined || ownsSurface(id);
+    const markDirtyFor = (id?: string) => { if (ownsChange(id)) markDirty(); };
+    const unsubActivity = subscribeToActivity(markDirtyFor);
+    const unsubPaneState = subscribeToTerminalPaneState(markDirtyFor);
 
     // Heartbeat: idle sessions no longer write (only when something marked dirty).
     const interval = setInterval(() => {
diff --git a/lib/src/lib/feature-flags.test.ts b/lib/src/lib/feature-flags.test.ts
deleted file mode 100644
index 4704f47d9..000000000
--- a/lib/src/lib/feature-flags.test.ts
+++ /dev/null
@@ -1,39 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { isWorkspacesEnabled, setWorkspacesEnabled, WORKSPACES_FLAG_KEY } from './feature-flags';
-
-function stubLocalStorage(): Map<string, string> {
-  const store = new Map<string, string>();
-  vi.stubGlobal('localStorage', {
-    getItem: (k: string) => (store.has(k) ? store.get(k)! : null),
-    setItem: (k: string, v: string) => store.set(k, v),
-    removeItem: (k: string) => store.delete(k),
-  });
-  return store;
-}
-
-describe('feature-flags: workspaces', () => {
-  afterEach(() => vi.unstubAllGlobals());
-
-  it('is off by default (dormant)', () => {
-    stubLocalStorage();
-    expect(isWorkspacesEnabled()).toBe(false);
-  });
-
-  it('round-trips via localStorage', () => {
-    const store = stubLocalStorage();
-    setWorkspacesEnabled(true);
-    expect(store.get(WORKSPACES_FLAG_KEY)).toBe('true');
-    expect(isWorkspacesEnabled()).toBe(true);
-    setWorkspacesEnabled(false);
-    expect(store.has(WORKSPACES_FLAG_KEY)).toBe(false);
-    expect(isWorkspacesEnabled()).toBe(false);
-  });
-
-  describe('without localStorage', () => {
-    beforeEach(() => vi.stubGlobal('localStorage', undefined));
-    it('treats the flag as disabled and never throws', () => {
-      expect(isWorkspacesEnabled()).toBe(false);
-      expect(() => setWorkspacesEnabled(true)).not.toThrow();
-    });
-  });
-});
diff --git a/lib/src/lib/feature-flags.ts b/lib/src/lib/feature-flags.ts
index 639c1c5c7..42fd30338 100644
--- a/lib/src/lib/feature-flags.ts
+++ b/lib/src/lib/feature-flags.ts
@@ -1,17 +1,8 @@
 /**
  * Runtime feature flags, toggled via `localStorage` so they work uniformly
  * across standalone, the VS Code webview, the website, Storybook, and tests.
- *
- * The **workspaces** flag gates the Workspace/Window container (stage 2b) and
- * everything built on it — the switching UI (stage 3) and real multi-Workspace
- * support (stage 4). It is **off by default**: with the flag off, the app
- * persists and restores a single bare `PersistedSession` exactly as before, so
- * the container code is dormant. See `docs/specs/glossary.md` → Implementation
- * status.
  */
 
-export const WORKSPACES_FLAG_KEY = 'dormouse.flags.workspaces';
-
 function readBoolFlag(key: string): boolean {
   try {
     return globalThis.localStorage?.getItem(key) === 'true';
@@ -21,21 +12,6 @@ function readBoolFlag(key: string): boolean {
   }
 }
 
-/** Whether the Workspace/Window container is enabled. Off by default (dormant). */
-export function isWorkspacesEnabled(): boolean {
-  return readBoolFlag(WORKSPACES_FLAG_KEY);
-}
-
-/** Toggle the workspaces flag (used by dev tooling / the stage-3 Storybook UI). */
-export function setWorkspacesEnabled(enabled: boolean): void {
-  try {
-    if (enabled) globalThis.localStorage?.setItem(WORKSPACES_FLAG_KEY, 'true');
-    else globalThis.localStorage?.removeItem(WORKSPACES_FLAG_KEY);
-  } catch {
-    // No localStorage: nothing to persist.
-  }
-}
-
 export const AB_DEBUG_LOGS_FLAG_KEY = 'dormouse.flags.abDebugLogs';
 
 /** Whether the agent-browser high-rate `[ab-panel]`/`[agent-browser]` stream and
diff --git a/lib/src/lib/notepad/never-persisted.test.ts b/lib/src/lib/notepad/never-persisted.test.ts
index bcfd23905..ce2272471 100644
--- a/lib/src/lib/notepad/never-persisted.test.ts
+++ b/lib/src/lib/notepad/never-persisted.test.ts
@@ -11,10 +11,9 @@
  */
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 import { FakePtyAdapter, setPlatform } from '../platform';
-import { setWorkspacesEnabled } from '../feature-flags';
 import { saveSession } from '../session-save';
-import { readPersistedSession, type PersistedDoor } from '../session-types';
-import { saveSessionState, storedValueForSession } from '../window-persistence';
+import { readPersistedSession, wrapSessionInWindow, type PersistedDoor } from '../session-types';
+import { saveWindowState } from '../window-persistence';
 import { addPlainNote, addTerminalNote, buildVolatileSnapshot, clearAllNotepads } from './notepad-store';
 
 /** Distinctive enough that a substring hit anywhere is a real leak. */
@@ -41,7 +40,6 @@ beforeEach(() => {
 
 afterEach(() => {
   clearAllNotepads();
-  setWorkspacesEnabled(false);
 });
 
 describe('live notes are never persisted', () => {
@@ -71,14 +69,11 @@ describe('live notes are never persisted', () => {
       getItem: (key: string) => store.get(key) ?? null,
       setItem: (key: string, value: string) => void store.set(key, value),
     };
-    saveSessionState(storage, 'dormouse.session', saved);
+    // The standalone Window wrapper re-nests the same Session, so it inherits
+    // the property rather than reintroducing notes.
+    saveWindowState(storage, 'dormouse.session', wrapSessionInWindow(saved!));
     expect(store.get('dormouse.session')).not.toContain(SECRET);
 
-    // The standalone Window wrapper (workspaces flag on) re-nests the same
-    // Session, so it inherits the property rather than reintroducing notes.
-    setWorkspacesEnabled(true);
-    expect(JSON.stringify(storedValueForSession(null, saved))).not.toContain(SECRET);
-
     // The one place the notes do live outside the store: host memory, cleared on
     // restart and never written to disk.
     expect(JSON.stringify(buildVolatileSnapshot())).toContain(SECRET);
diff --git a/lib/src/lib/session-activity-store.ts b/lib/src/lib/session-activity-store.ts
index 5b1a8d865..d0a11f039 100644
--- a/lib/src/lib/session-activity-store.ts
+++ b/lib/src/lib/session-activity-store.ts
@@ -30,7 +30,7 @@ export const DEFAULT_ACTIVITY_STATE: ActivityState = {
   ringSeq: 0,
 };
 
-const activityListeners = new Set<() => void>();
+const activityListeners = new Set<(changedId?: string) => void>();
 let cachedSnapshot: Map<string, ActivityState> | null = null;
 
 // Terminal activity keeps the same home before and after xterm initialization.
@@ -42,12 +42,15 @@ const terminalActivity = new Map<string, { state: ActivityState; attentionDismis
 // terminal activity never removes a browser TODO.
 const localSurfaceActivity = new Map<string, ActivityState>();
 
-export function notifyActivityListeners(): void {
+/** `changedId` names the one Surface whose activity moved, so a listener scoped
+ *  to a subset of the Window can ignore the rest. Omitting it means a store-wide
+ *  change every listener must take. */
+export function notifyActivityListeners(changedId?: string): void {
   cachedSnapshot = null;
-  activityListeners.forEach((listener) => listener());
+  activityListeners.forEach((listener) => listener(changedId));
 }
 
-export function subscribeToActivity(listener: () => void): () => void {
+export function subscribeToActivity(listener: (changedId?: string) => void): () => void {
   activityListeners.add(listener);
   return () => activityListeners.delete(listener);
 }
@@ -87,7 +90,7 @@ export function setTerminalActivity(id: string, state: Partial<AlertState>): voi
     state: { ...DEFAULT_ACTIVITY_STATE, ...activity },
     attentionDismissedRing,
   });
-  notifyActivityListeners();
+  notifyActivityListeners(id);
 }
 
 /** Called after registry removal, or without an id to reset the terminal cache. */
@@ -98,7 +101,7 @@ export function clearTerminalActivity(id?: string): void {
   } else {
     terminalActivity.delete(id);
   }
-  notifyActivityListeners();
+  notifyActivityListeners(id);
 }
 
 /**
@@ -108,7 +111,7 @@ export function clearTerminalActivity(id?: string): void {
  */
 export function clearLocalSurfaceActivity(id: string): void {
   if (!localSurfaceActivity.delete(id)) return;
-  notifyActivityListeners();
+  notifyActivityListeners(id);
 }
 
 function setLocalSurfaceTodo(id: string, todo: boolean): void {
@@ -118,7 +121,7 @@ function setLocalSurfaceTodo(id: string, todo: boolean): void {
   }
 
   localSurfaceActivity.set(id, { ...DEFAULT_ACTIVITY_STATE, todo: true });
-  notifyActivityListeners();
+  notifyActivityListeners(id);
 }
 
 /**
diff --git a/lib/src/lib/terminal-lifecycle.ts b/lib/src/lib/terminal-lifecycle.ts
index f61e55091..ffe115a8e 100644
--- a/lib/src/lib/terminal-lifecycle.ts
+++ b/lib/src/lib/terminal-lifecycle.ts
@@ -387,7 +387,7 @@ function setupTerminalEntry(id: string, options: { shell?: string; untouched?: b
 
   registry.set(id, entry);
   ensureTerminalPaneState(id);
-  notifyActivityListeners();
+  notifyActivityListeners(id);
   startThemeObserver();
   return entry;
 }
diff --git a/lib/src/lib/terminal-state-store.ts b/lib/src/lib/terminal-state-store.ts
index 6b4fa8ba0..5836582d2 100644
--- a/lib/src/lib/terminal-state-store.ts
+++ b/lib/src/lib/terminal-state-store.ts
@@ -28,7 +28,7 @@ const promptAltScreenFilters = new Map<string, PromptAltScreenFilter>();
 // Panes with authentic OSC 633/133 boundaries; the keystroke fallback stands
 // down for each id here until the pane is reset or removed.
 const oscDrivenPanes = new Set<string>();
-const listeners = new Set<() => void>();
+const listeners = new Set<(changedId?: string) => void>();
 
 // Authentic shell boundaries; heuristic-synthesized prompt markers are excluded.
 function isOscDrivenBoundary(event: TerminalSemanticEvent): boolean {
@@ -45,7 +45,9 @@ function isOscDrivenBoundary(event: TerminalSemanticEvent): boolean {
 }
 let cachedSnapshot: Map<string, TerminalPaneState> | null = null;
 
-export function subscribeToTerminalPaneState(listener: () => void): () => void {
+/** `changedId` names the one pane whose state moved; omitting it means a
+ *  store-wide change every listener must take. */
+export function subscribeToTerminalPaneState(listener: (changedId?: string) => void): () => void {
   listeners.add(listener);
   return () => {
     listeners.delete(listener);
@@ -105,7 +107,7 @@ export function ensureTerminalPaneState(id: string, initial?: Partial<TerminalPa
   if (existing) return existing;
   const next = createTerminalPaneState(initial);
   paneStates.set(id, next);
-  notifyTerminalPaneStateListeners();
+  notifyTerminalPaneStateListeners(id);
   return next;
 }
 
@@ -122,13 +124,13 @@ function clearPaneScratch(id: string): void {
 export function resetTerminalPaneState(id: string, initial?: Partial<TerminalPaneState>): void {
   clearPaneScratch(id);
   paneStates.set(id, createTerminalPaneState(initial));
-  notifyTerminalPaneStateListeners();
+  notifyTerminalPaneStateListeners(id);
 }
 
 export function removeTerminalPaneState(id: string): void {
   clearPaneScratch(id);
   if (!paneStates.delete(id)) return;
-  notifyTerminalPaneStateListeners();
+  notifyTerminalPaneStateListeners(id);
 }
 
 export function applyTerminalSemanticEvents(
@@ -155,7 +157,7 @@ export function applyTerminalSemanticEvents(
   }
   if (next === prev && paneStates.has(id)) return;
   paneStates.set(id, next);
-  notifyTerminalPaneStateListeners();
+  notifyTerminalPaneStateListeners(id);
 }
 
 // Reads the cursor's full rendered logical line (`prompt + command`) from the
@@ -307,7 +309,7 @@ export function seedTerminalManualCwd(id: string, path: string | null | undefine
   }
   if (current.cwd) return;
   paneStates.set(id, { ...current, cwd });
-  notifyTerminalPaneStateListeners();
+  notifyTerminalPaneStateListeners(id);
 }
 
 export function fillTerminalProcessCwd(id: string, path: string | null | undefined): void {
@@ -322,7 +324,7 @@ function updateCwdIfAllowed(id: string, cwd: CwdState): void {
   if (!current) return;
   if (!processCwdMayReplace(current.cwd?.source)) return;
   paneStates.set(id, { ...current, cwd });
-  notifyTerminalPaneStateListeners();
+  notifyTerminalPaneStateListeners(id);
 }
 
 // Detect a returned/idle shell prompt for shells without OSC 133/633
@@ -475,7 +477,7 @@ class PromptAltScreenFilter {
   }
 }
 
-function notifyTerminalPaneStateListeners(): void {
+function notifyTerminalPaneStateListeners(changedId?: string): void {
   cachedSnapshot = null;
-  listeners.forEach((listener) => listener());
+  listeners.forEach((listener) => listener(changedId));
 }
diff --git a/lib/src/lib/window-persistence.test.ts b/lib/src/lib/window-persistence.test.ts
index 965aa70ea..3e53c0fc4 100644
--- a/lib/src/lib/window-persistence.test.ts
+++ b/lib/src/lib/window-persistence.test.ts
@@ -1,147 +1,81 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { activeSessionFromStored, loadSessionState, saveSessionState, storedValueForSession } from './window-persistence';
+import { describe, expect, it, vi } from 'vitest';
+import { loadWindowState, saveWindowState, type SessionKeyValueStore } from './window-persistence';
 import {
   DEFAULT_WORKSPACE_ID,
+  DEFAULT_WORKSPACE_NAME,
   wrapSessionInWindow,
   type PersistedSession,
   type PersistedWindow,
 } from './session-types';
-import { setWorkspacesEnabled } from './feature-flags';
 
-function stubLocalStorage(): void {
-  const store = new Map<string, string>();
-  vi.stubGlobal('localStorage', {
-    getItem: (k: string) => (store.has(k) ? store.get(k)! : null),
-    setItem: (k: string, v: string) => store.set(k, v),
-    removeItem: (k: string) => store.delete(k),
-  });
+function memoryStore(seed?: string): SessionKeyValueStore & { value: () => string | null } {
+  let stored: string | null = seed ?? null;
+  return {
+    getItem: () => stored,
+    setItem: (_key, value) => { stored = value; },
+    value: () => stored,
+  };
 }
 
 const sessionA: PersistedSession = {
   version: 3,
-  panes: [{ id: 'pane-a', title: 'A', cwd: null, untouched: false }],
+  panes: [{ id: 'pane-a', title: 'A', cwd: '/a', untouched: false }],
 };
 const sessionB: PersistedSession = {
   version: 3,
-  panes: [{ id: 'pane-b', title: 'B', cwd: null, untouched: false }],
+  panes: [{ id: 'pane-b', title: 'B', cwd: '/b', untouched: false }],
 };
 
-describe('window-persistence', () => {
-  beforeEach(stubLocalStorage);
-  afterEach(() => vi.unstubAllGlobals());
-
-  describe('flag off (passthrough — identical to today)', () => {
-    beforeEach(() => setWorkspacesEnabled(false));
-
-    it('load returns the stored value unchanged', () => {
-      expect(activeSessionFromStored(sessionA)).toBe(sessionA);
-    });
+const twoWorkspaces: PersistedWindow = {
+  version: 1,
+  workspaces: [
+    { id: 'ws-1', name: 'One', session: sessionA },
+    { id: 'ws-2', name: 'Two', session: sessionB },
+  ],
+  activeWorkspaceId: 'ws-2',
+};
 
-    it('save returns the session unchanged (bare, not wrapped)', () => {
-      expect(storedValueForSession(null, sessionA)).toBe(sessionA);
-    });
+describe('window-persistence', () => {
+  it('round-trips a Window through the slot', () => {
+    const store = memoryStore();
+    saveWindowState(store, 'k', twoWorkspaces);
+    expect(loadWindowState(store, 'k')).toEqual(twoWorkspaces);
   });
 
-  describe('flag on (Window container)', () => {
-    beforeEach(() => setWorkspacesEnabled(true));
-
-    it('save wraps a fresh session into a single-Workspace Window', () => {
-      const stored = storedValueForSession(null, sessionA) as PersistedWindow;
-      expect(stored.version).toBe(1);
-      expect(stored.workspaces).toHaveLength(1);
-      expect(stored.activeWorkspaceId).toBe(DEFAULT_WORKSPACE_ID);
-      expect(stored.workspaces[0].session.panes[0].id).toBe('pane-a');
-    });
-
-    it('round-trips: save then load yields the same active session', () => {
-      const stored = storedValueForSession(null, sessionA);
-      expect(activeSessionFromStored(stored)).toEqual(sessionA);
-    });
-
-    it('save replaces only the active Workspace, preserving the others', () => {
-      const existing: PersistedWindow = {
-        version: 1,
-        activeWorkspaceId: 'ws-b',
-        workspaces: [
-          { id: 'ws-a', name: 'A', session: sessionA },
-          { id: 'ws-b', name: 'B', session: sessionA },
-        ],
-      };
-      const stored = storedValueForSession(existing, sessionB) as PersistedWindow;
-      expect(stored.workspaces.find((w) => w.id === 'ws-a')!.session).toEqual(sessionA);
-      expect(stored.workspaces.find((w) => w.id === 'ws-b')!.session).toEqual(sessionB);
-    });
-
-    it('load returns the active Workspace session from a multi-Workspace Window', () => {
-      const win = wrapSessionInWindow(sessionA);
-      const multi: PersistedWindow = {
-        version: 1,
-        activeWorkspaceId: 'ws-b',
-        workspaces: [...win.workspaces, { id: 'ws-b', name: 'B', session: sessionB }],
-      };
-      expect(activeSessionFromStored(multi)).toEqual(sessionB);
-    });
-
-    it('load returns null for unusable stored input', () => {
-      expect(activeSessionFromStored(null)).toBeNull();
-      expect(activeSessionFromStored({ junk: true })).toBeNull();
+  it('wraps a pre-Window blob as this Window\'s one Workspace', () => {
+    const store = memoryStore(JSON.stringify(sessionA));
+    expect(loadWindowState(store, 'k')).toEqual({
+      version: 1,
+      workspaces: [{ id: DEFAULT_WORKSPACE_ID, name: DEFAULT_WORKSPACE_NAME, session: sessionA }],
+      activeWorkspaceId: DEFAULT_WORKSPACE_ID,
     });
+    expect(loadWindowState(store, 'k')).toEqual(wrapSessionInWindow(sessionA));
   });
 
-  describe('storage round trip (loadSessionState / saveSessionState)', () => {
-    function spyStorage(initial: string | null = null) {
-      let value = initial;
-      const getItem = vi.fn((_key: string) => value);
-      const setItem = vi.fn((_key: string, next: string) => { value = next; });
-      const storage = { getItem, setItem, removeItem: vi.fn() } as unknown as Storage;
-      return { storage, getItem, setItem };
-    }
-
-    it('flag off: saves the bare session WITHOUT reading the existing blob', () => {
-      setWorkspacesEnabled(false);
-      const { storage, getItem, setItem } = spyStorage(JSON.stringify(sessionB));
-      saveSessionState(storage, 'k', sessionA);
-      // The efficiency win: no wasted read/parse of the (scrollback-bearing) blob.
-      expect(getItem).not.toHaveBeenCalled();
-      expect(JSON.parse(setItem.mock.calls[0]![1])).toEqual(sessionA);
-    });
-
-    it('flag off: load returns the bare stored session', () => {
-      setWorkspacesEnabled(false);
-      const { storage } = spyStorage(JSON.stringify(sessionA));
-      expect(loadSessionState(storage, 'k')).toEqual(sessionA);
-    });
-
-    it('flag on: save wraps into a Window and load round-trips the active session', () => {
-      setWorkspacesEnabled(true);
-      const { storage } = spyStorage();
-      saveSessionState(storage, 'k', sessionA);
-      const stored = JSON.parse((storage.getItem('k'))!) as PersistedWindow;
-      expect(stored.version).toBe(1);
-      expect(stored.activeWorkspaceId).toBe(DEFAULT_WORKSPACE_ID);
-      expect(loadSessionState(storage, 'k')).toEqual(sessionA);
-    });
-
-    it('flag on: save preserves other Workspaces by reading the existing Window', () => {
-      setWorkspacesEnabled(true);
-      const existing: PersistedWindow = {
-        version: 1,
-        activeWorkspaceId: 'ws-b',
-        workspaces: [
-          { id: 'ws-a', name: 'A', session: sessionA },
-          { id: 'ws-b', name: 'B', session: sessionA },
-        ],
-      };
-      const { storage } = spyStorage(JSON.stringify(existing));
-      saveSessionState(storage, 'k', sessionB);
-      const stored = JSON.parse((storage.getItem('k'))!) as PersistedWindow;
-      expect(stored.workspaces.find((w) => w.id === 'ws-a')!.session).toEqual(sessionA);
-      expect(stored.workspaces.find((w) => w.id === 'ws-b')!.session).toEqual(sessionB);
-    });
+  it('starts fresh on an absent, corrupt, or unrecognizable blob', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    expect(loadWindowState(memoryStore(), 'k')).toBeNull();
+    expect(loadWindowState(memoryStore('{not json'), 'k')).toBeNull();
+    expect(loadWindowState(memoryStore('{"version":99}'), 'k')).toBeNull();
+    // A v3 blob that fails its own guard is not retried as a Window.
+    expect(loadWindowState(memoryStore('{"version":3,"panes":"nope"}'), 'k')).toBeNull();
+    warn.mockRestore();
+  });
 
-    it('load returns null when storage is empty', () => {
-      const { storage } = spyStorage(null);
-      expect(loadSessionState(storage, 'k')).toBeNull();
-    });
+  it('drops an unreadable Workspace instead of the whole Window', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const store = memoryStore(JSON.stringify({
+      version: 1,
+      workspaces: [
+        { id: 'ws-1', name: 'One', session: sessionA },
+        { id: 'ws-2', name: 'Two', session: { version: 3, panes: 'nope' } },
+      ],
+      activeWorkspaceId: 'ws-2',
+    }));
+    const loaded = loadWindowState(store, 'k');
+    expect(loaded?.workspaces.map((ws) => ws.id)).toEqual(['ws-1']);
+    // The dangling active id is repaired to a Workspace that survived.
+    expect(loaded?.activeWorkspaceId).toBe('ws-1');
+    warn.mockRestore();
   });
 });
diff --git a/lib/src/lib/window-persistence.ts b/lib/src/lib/window-persistence.ts
index c064a7432..7b11c97ee 100644
--- a/lib/src/lib/window-persistence.ts
+++ b/lib/src/lib/window-persistence.ts
@@ -1,86 +1,60 @@
-import { isWorkspacesEnabled } from './feature-flags';
+import { isRecord } from './is-record';
 import {
-  activeWorkspaceSession,
   readPersistedSession,
   readPersistedWindow,
-  replaceActiveSession,
   wrapSessionInWindow,
+  type PersistedWindow,
 } from './session-types';
 
 /**
- * Translate between the standalone host's stored top-level blob and the bare
- * `PersistedSession` the shared persistence code (`reconnect.ts`,
- * `session-save.ts`) operates on (stage 2b).
+ * The standalone host's stored top-level blob is a `PersistedWindow`
+ * (`docs/specs/transport.md` → "Persisted session"). These two functions own the
+ * JSON and the storage slot; the Workspace-level composition is the aggregator's
+ * (`lib/src/lib/window-session-aggregator.ts`).
  *
- * With the workspaces flag **off** these are identity passthroughs, so the host
- * stores and restores a bare `PersistedSession` exactly as before. With the flag
- * **on**, the stored blob is a `PersistedWindow`; load returns the active
- * Workspace's session, and save merges the new session back into the active
- * Workspace slot while preserving every other Workspace.
- *
- * The flag is read per call, so toggling it mid-run is consistent within a save
- * or load. (Turning the flag off while a Window is stored makes that blob look
- * unparseable to the bare-session reader — acceptable for a dev-only flag.)
- *
- * Source of truth: `docs/specs/transport.md`. VS Code does not use this — it
- * persists one bare `PersistedSession` per webview.
+ * VS Code does not use this — it persists one bare `PersistedSession` per
+ * webview through the extension host's own state APIs.
  */
 
-/** Parsed stored blob → the `PersistedSession` to restore (or null). */
-export function activeSessionFromStored(stored: unknown): unknown {
-  if (!isWorkspacesEnabled()) return stored;
-  const window = readPersistedWindow(stored);
-  return window ? activeWorkspaceSession(window) : null;
-}
-
-/** Existing stored blob + new active session → the blob to store. */
-export function storedValueForSession(existingStored: unknown, session: unknown): unknown {
-  if (!isWorkspacesEnabled()) return session;
-  const next = readPersistedSession(session);
-  if (!next) return session;
-  const existingWindow = readPersistedWindow(existingStored);
-  return existingWindow ? replaceActiveSession(existingWindow, next) : wrapSessionInWindow(next);
-}
-
 /**
  * The seam below the shared save/restore code: a single synchronous key/value
  * slot the host persists natively. `localStorage` (browser-dev sidecar) and the
  * standalone `TauriSessionStore` (a Rust-backed, boot-seeded cache) both satisfy
  * it — the same interface, two host-native backings (`docs/specs/standalone.md`
  * §Persistence). `Storage` is a structural superset, so passing `localStorage`
- * still type-checks. VS Code does not go through here; it persists one bare
- * `PersistedSession` per webview through the extension host's own state APIs.
+ * still type-checks.
  */
 export interface SessionKeyValueStore {
   getItem(key: string): string | null;
   setItem(key: string, value: string): void;
 }
 
-// Storage-level round trip shared by the standalone adapters (Tauri + the
-// browser-dev sidecar). Owns the JSON parse/stringify and the store access
-// so each adapter's get/save collapses to one call instead of re-implementing
-// the read-merge-write dance.
-
-/** Read the stored blob and return the `PersistedSession` to restore (or null). A
- *  corrupt (unparseable) blob is discarded, so a bad save can never block startup. */
-export function loadSessionState(storage: SessionKeyValueStore, key: string): unknown {
+/**
+ * Read the stored Window, or null when nothing readable is there. A corrupt blob
+ * is discarded so a bad save can never block startup.
+ *
+ * A blob written before standalone persisted Windows is a bare
+ * `PersistedSession`; it is wrapped as this Window's one Workspace. That is the
+ * only migration — every write since is a Window.
+ */
+export function loadWindowState(storage: SessionKeyValueStore, key: string): PersistedWindow | null {
   const raw = storage.getItem(key);
   if (raw === null) return null;
-  return activeSessionFromStored(parseStoredJson(raw));
+  const parsed = parseStoredJson(raw);
+  if (parsed === null) return null;
+  // Dispatch on the version discriminator rather than trying both readers: each
+  // one warns on a shape it does not recognize, and a Window handed to the
+  // Session reader would warn on every boot.
+  if (isRecord(parsed) && parsed.version === 3) {
+    const legacy = readPersistedSession(parsed);
+    return legacy ? wrapSessionInWindow(legacy) : null;
+  }
+  return readPersistedWindow(parsed);
 }
 
-/** Persist `session` under `key`, merging into the active Workspace when the flag is on. */
-export function saveSessionState(storage: SessionKeyValueStore, key: string, session: unknown): void {
-  // Flag off (the default): store the bare session without reading the existing
-  // blob — its previous value is irrelevant, so skip parsing the (potentially
-  // large, scrollback-bearing) stored snapshot.
-  if (!isWorkspacesEnabled()) {
-    storage.setItem(key, JSON.stringify(session));
-    return;
-  }
-  const raw = storage.getItem(key);
-  const existing = raw === null ? null : parseStoredJson(raw);
-  storage.setItem(key, JSON.stringify(storedValueForSession(existing, session)));
+/** Persist `window` under `key`. */
+export function saveWindowState(storage: SessionKeyValueStore, key: string, window: PersistedWindow): void {
+  storage.setItem(key, JSON.stringify(window));
 }
 
 /** Parse a stored JSON blob, or null when it is corrupt — a bad blob degrades to a
diff --git a/lib/src/lib/window-session-aggregator.test.ts b/lib/src/lib/window-session-aggregator.test.ts
index 16956110f..5aba57732 100644
--- a/lib/src/lib/window-session-aggregator.test.ts
+++ b/lib/src/lib/window-session-aggregator.test.ts
@@ -1,15 +1,20 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import {
+  adoptWorkspaceSession,
+  flushWindowSession,
   forgetWorkspaceSession,
   getWindowSnapshot,
   installWindowSessionWriter,
+  previousWorkspaceSession,
   publishWorkspaceSession,
   resetWindowSessionAggregator,
+  seedWindowSession,
 } from './window-session-aggregator';
-import type { PersistedSession } from './session-types';
+import type { PersistedSession, PersistedWindow } from './session-types';
 import {
   createWorkspace,
   moveWorkspace,
+  renameWorkspace,
   resetWorkspaces,
   setActiveWorkspace,
   getWorkspacesSnapshot,
@@ -19,11 +24,21 @@ function session(paneId: string): PersistedSession {
   return { version: 3, panes: [{ id: paneId, title: paneId, cwd: null, untouched: true, alert: null }], doors: [] };
 }
 
+/** Run the debounce out and let the writer's own promise settle. */
+async function settle(): Promise<void> {
+  await vi.advanceTimersByTimeAsync(500);
+}
+
 beforeEach(() => {
+  vi.useFakeTimers();
   resetWindowSessionAggregator();
   resetWorkspaces();
 });
 
+afterEach(() => {
+  vi.useRealTimers();
+});
+
 describe('window session aggregator', () => {
   it('orders Workspaces by the store and carries the active id', () => {
     const first = getWorkspacesSnapshot().workspaces[0].id;
@@ -43,38 +58,149 @@ describe('window session aggregator', () => {
     expect(getWindowSnapshot().activeWorkspaceId).toBe(first);
   });
 
-  it('drops a Workspace that has published nothing rather than writing it empty', () => {
+  it('drops a Workspace with neither a published nor a seeded session', () => {
     const first = getWorkspacesSnapshot().workspaces[0].id;
     createWorkspace({ name: 'Second' });
     publishWorkspaceSession(first, session('a'));
     expect(getWindowSnapshot().workspaces.map((ws) => ws.id)).toEqual([first]);
   });
 
-  it('forgets a Workspace session', () => {
+  it('forgets a Workspace session and its seed', () => {
     const first = getWorkspacesSnapshot().workspaces[0].id;
+    seedWindowSession({ version: 1, workspaces: [{ id: first, name: 'One', session: session('seed') }], activeWorkspaceId: first });
     publishWorkspaceSession(first, session('a'));
     forgetWorkspaceSession(first);
     expect(getWindowSnapshot().workspaces).toEqual([]);
+    expect(previousWorkspaceSession(first)).toBeNull();
   });
 
-  it('hands each snapshot to the installed writer until it is uninstalled', () => {
-    const write = vi.fn();
-    const uninstall = installWindowSessionWriter(write);
-    const first = getWorkspacesSnapshot().workspaces[0].id;
-    publishWorkspaceSession(first, session('a'));
-    expect(write).toHaveBeenCalledTimes(1);
-    expect(write.mock.calls[0][0].workspaces).toHaveLength(1);
-    forgetWorkspaceSession(first);
-    expect(write).toHaveBeenCalledTimes(2);
-    forgetWorkspaceSession(first);
-    expect(write).toHaveBeenCalledTimes(2);
-    uninstall();
-    publishWorkspaceSession(first, session('a'));
-    expect(write).toHaveBeenCalledTimes(2);
+  describe('seed', () => {
+    const first = () => getWorkspacesSnapshot().workspaces[0].id;
+
+    it('answers for a Workspace whose Wall has not published yet', () => {
+      const second = createWorkspace({ id: 'ws-2', name: 'Second' }).id;
+      const seeded: PersistedWindow = {
+        version: 1,
+        workspaces: [
+          { id: first(), name: 'One', session: session('a-seed') },
+          { id: second, name: 'Second', session: session('b-seed') },
+        ],
+        activeWorkspaceId: second,
+      };
+      seedWindowSession(seeded);
+
+      // Both Workspaces are in the snapshot before any Wall mounts, so a write
+      // taken mid-boot cannot replace a restored Workspace with a blank one.
+      expect(getWindowSnapshot().workspaces.map((ws) => ws.session.panes[0].id))
+        .toEqual(['a-seed', 'b-seed']);
+      expect(previousWorkspaceSession(second)?.panes[0].id).toBe('b-seed');
+
+      // A publish takes over for that Workspace only.
+      publishWorkspaceSession(second, session('b-live'));
+      expect(previousWorkspaceSession(second)?.panes[0].id).toBe('b-live');
+      expect(previousWorkspaceSession(first())?.panes[0].id).toBe('a-seed');
+    });
+
+    it('replaces the previous seed, and null clears it', () => {
+      seedWindowSession({ version: 1, workspaces: [{ id: first(), name: 'One', session: session('old') }], activeWorkspaceId: first() });
+      seedWindowSession(null);
+      expect(previousWorkspaceSession(first())).toBeNull();
+      expect(getWindowSnapshot().workspaces).toEqual([]);
+    });
+
+    it('adopts a record from elsewhere as that Workspace\'s previous', () => {
+      const second = createWorkspace({ id: 'ws-2', name: 'Second' }).id;
+      publishWorkspaceSession(second, session('stale'));
+      adoptWorkspaceSession(second, session('moved-in'));
+      expect(previousWorkspaceSession(second)?.panes[0].id).toBe('moved-in');
+    });
   });
 
-  it('ships with no writer installed', () => {
-    const first = getWorkspacesSnapshot().workspaces[0].id;
-    expect(() => publishWorkspaceSession(first, session('a'))).not.toThrow();
+  describe('writer', () => {
+    it('debounces publishes into one write and flushes on demand', async () => {
+      const write = vi.fn();
+      installWindowSessionWriter(write);
+      const first = getWorkspacesSnapshot().workspaces[0].id;
+      const second = createWorkspace({ name: 'Second' }).id;
+
+      publishWorkspaceSession(first, session('a'));
+      publishWorkspaceSession(second, session('b'));
+      expect(write).not.toHaveBeenCalled();
+
+      await settle();
+      expect(write).toHaveBeenCalledTimes(1);
+      expect(write.mock.calls[0][0].workspaces).toHaveLength(2);
+
+      // Flush writes immediately and leaves nothing pending behind it.
+      publishWorkspaceSession(first, session('a2'));
+      await flushWindowSession();
+      expect(write).toHaveBeenCalledTimes(2);
+      await settle();
+      expect(write).toHaveBeenCalledTimes(2);
+    });
+
+    it('awaits the host write a flush starts', async () => {
+      let resolveWrite = () => {};
+      const write = vi.fn(() => new Promise<void>((resolve) => { resolveWrite = resolve; }));
+      installWindowSessionWriter(write);
+      publishWorkspaceSession(getWorkspacesSnapshot().workspaces[0].id, session('a'));
+
+      let done = false;
+      const flushed = flushWindowSession().then(() => { done = true; });
+      await vi.advanceTimersByTimeAsync(0);
+      expect(done).toBe(false);
+      resolveWrite();
+      await flushed;
+      expect(done).toBe(true);
+    });
+
+    it('writes on a Workspace-store change with no session change', async () => {
+      const write = vi.fn();
+      const first = getWorkspacesSnapshot().workspaces[0].id;
+      publishWorkspaceSession(first, session('a'));
+      installWindowSessionWriter(write);
+
+      renameWorkspace(first, 'Renamed');
+      await settle();
+      expect(write).toHaveBeenCalledTimes(1);
+      expect(write.mock.calls[0][0].workspaces[0].name).toBe('Renamed');
+
+      const second = createWorkspace({ name: 'Second' }).id;
+      setActiveWorkspace(second);
+      await settle();
+      expect(write.mock.calls.at(-1)?.[0].activeWorkspaceId).toBe(second);
+    });
+
+    it('stops writing once uninstalled, pending timer included', async () => {
+      const write = vi.fn();
+      const uninstall = installWindowSessionWriter(write);
+      const first = getWorkspacesSnapshot().workspaces[0].id;
+
+      publishWorkspaceSession(first, session('a'));
+      uninstall();
+      await settle();
+      expect(write).not.toHaveBeenCalled();
+
+      publishWorkspaceSession(first, session('b'));
+      await settle();
+      expect(write).not.toHaveBeenCalled();
+      // The store subscription goes with it.
+      renameWorkspace(first, 'Renamed');
+      await settle();
+      expect(write).not.toHaveBeenCalled();
+    });
+
+    it('ships with no writer installed', async () => {
+      const first = getWorkspacesSnapshot().workspaces[0].id;
+      expect(() => publishWorkspaceSession(first, session('a'))).not.toThrow();
+      await expect(flushWindowSession()).resolves.toBeUndefined();
+    });
+
+    it('survives a rejecting host write', async () => {
+      const write = vi.fn(() => Promise.reject(new Error('disk full')));
+      installWindowSessionWriter(write);
+      publishWorkspaceSession(getWorkspacesSnapshot().workspaces[0].id, session('a'));
+      await expect(flushWindowSession()).resolves.toBeUndefined();
+    });
   });
 });
diff --git a/lib/src/lib/window-session-aggregator.ts b/lib/src/lib/window-session-aggregator.ts
index 14dd4ac39..f367b2c2f 100644
--- a/lib/src/lib/window-session-aggregator.ts
+++ b/lib/src/lib/window-session-aggregator.ts
@@ -1,60 +1,153 @@
-import { getWorkspacesSnapshot } from './workspace-store';
+import { getWorkspacesSnapshot, subscribeToWorkspaces } from './workspace-store';
 import type { PersistedSession, PersistedWindow, PersistedWorkspace, WorkspaceId } from './session-types';
 
 /**
  * Collects each Workspace's latest `PersistedSession` into one `PersistedWindow`
- * (`docs/specs/transport.md` → "Persisted session"). The Wall's persistence hook
- * publishes here instead of writing the platform slot when it runs under a
- * Workspace; the writer that turns snapshots into a host write is installed
- * separately, and standalone installs none yet. The push path is deliberately
- * complete ahead of its consumer: standalone persistence installs the writer and
- * retires `window-persistence.ts`'s flag-gated merge (`docs/specs/layout.md` →
- * "Future").
+ * and hands it to the host (`docs/specs/transport.md` → "Persisted session").
+ * The Wall's persistence hook publishes here instead of writing the platform
+ * slot when it runs under a Workspace; the standalone boot installs the writer.
+ *
+ * Two maps, because a Workspace's record has two possible ages. `published` is
+ * what its Wall has saved this run. `seeded` is what the last run left on disk,
+ * which is the answer until that Wall has saved anything — it is what keeps a
+ * Window snapshot taken mid-boot from replacing a restored Workspace with a
+ * blank one, and it is what a save reads its retained `cwd` out of
+ * (`previousWorkspaceSession`).
  */
 
-const sessions = new Map<WorkspaceId, PersistedSession>();
-let writer: ((snapshot: PersistedWindow) => void) | null = null;
+const published = new Map<WorkspaceId, PersistedSession>();
+const seeded = new Map<WorkspaceId, PersistedSession>();
+let writer: ((snapshot: PersistedWindow) => void | Promise<void>) | null = null;
+let unsubscribeWorkspaces: (() => void) | null = null;
+let timer: ReturnType<typeof setTimeout> | null = null;
+let inFlight: Promise<void> | null = null;
 
-/** Record a Workspace's latest session and hand the whole Window to the writer. */
+/** How long the Window blob waits for its Workspaces to settle. Each Wall
+ *  already debounces its own record, so this is what collapses N Workspaces
+ *  reacting to one event into a single host write. */
+const WRITE_DEBOUNCE_MS = 500;
+
+/**
+ * The record on disk for every Workspace this Window is restoring, installed at
+ * boot before any Wall mounts. Replaces whatever was seeded before; `null`
+ * clears it (a fresh Window).
+ */
+export function seedWindowSession(window: PersistedWindow | null): void {
+  seeded.clear();
+  for (const workspace of window?.workspaces ?? []) seeded.set(workspace.id, workspace.session);
+}
+
+/** Record a Workspace's latest session and schedule the Window write. */
 export function publishWorkspaceSession(workspaceId: WorkspaceId, session: PersistedSession): void {
-  sessions.set(workspaceId, session);
-  writer?.(getWindowSnapshot());
+  published.set(workspaceId, session);
+  scheduleWrite();
+}
+
+/**
+ * Install a record for a Workspace whose Wall is not the one that built it — a
+ * Workspace moving in from another Window. It stands as that Workspace's
+ * previous record until its new Wall publishes, exactly as a seed does.
+ */
+export function adoptWorkspaceSession(workspaceId: WorkspaceId, session: PersistedSession): void {
+  seeded.set(workspaceId, session);
+  published.delete(workspaceId);
+  scheduleWrite();
 }
 
 /** Drop a Workspace's session (its Workspace was closed or moved away). */
 export function forgetWorkspaceSession(workspaceId: WorkspaceId): void {
-  if (!sessions.delete(workspaceId)) return;
-  writer?.(getWindowSnapshot());
+  const had = published.delete(workspaceId);
+  if (!seeded.delete(workspaceId) && !had) return;
+  scheduleWrite();
+}
+
+/**
+ * This Workspace's last persisted record — what its Wall published, or what boot
+ * seeded until then. A save's previous-pane map reads a dead PTY's retained
+ * `cwd` and `alert` out of it, so answering with the Window's active Workspace
+ * (or with nothing) would drop them on the first save after a restore.
+ */
+export function previousWorkspaceSession(workspaceId: WorkspaceId): PersistedSession | null {
+  return published.get(workspaceId) ?? seeded.get(workspaceId) ?? null;
 }
 
 /**
  * The Window as it stands: Workspaces in strip order carrying the id, name, and
- * latest published session of each. A Workspace whose Wall has published nothing
- * yet is omitted rather than written empty, so a crash mid-boot cannot replace a
- * restored layout with a blank one.
+ * latest session of each. A Workspace with neither a published nor a seeded
+ * session is omitted rather than written empty.
  */
 export function getWindowSnapshot(): PersistedWindow {
   const { workspaces, activeId } = getWorkspacesSnapshot();
   const collected: PersistedWorkspace[] = [];
   for (const workspace of workspaces) {
-    const session = sessions.get(workspace.id);
+    const session = previousWorkspaceSession(workspace.id);
     if (!session) continue;
     collected.push({ id: workspace.id, name: workspace.name, session });
   }
   return { version: 1, workspaces: collected, activeWorkspaceId: activeId };
 }
 
-/** Install the sink that persists a Window snapshot; returns its uninstaller.
- *  Replace-on-repeat: only one writer is live, so a re-install cannot double-write. */
-export function installWindowSessionWriter(write: (snapshot: PersistedWindow) => void): () => void {
+/**
+ * Install the sink that persists a Window snapshot; returns its uninstaller.
+ * Replace-on-repeat: only one writer is live, so a re-install cannot double-write.
+ *
+ * Installing also subscribes to the Workspace store, because reordering,
+ * renaming, and switching the active Workspace all change the blob without any
+ * Session changing.
+ */
+export function installWindowSessionWriter(write: (snapshot: PersistedWindow) => void | Promise<void>): () => void {
   writer = write;
+  unsubscribeWorkspaces?.();
+  unsubscribeWorkspaces = subscribeToWorkspaces(scheduleWrite);
   return () => {
-    if (writer === write) writer = null;
+    if (writer !== write) return;
+    writer = null;
+    unsubscribeWorkspaces?.();
+    unsubscribeWorkspaces = null;
+    cancelPending();
   };
 }
 
-/** Forget every published session and any installed writer (tests). */
+/**
+ * Write now and resolve when the host has taken the snapshot. The quit teardown's
+ * step between the last Wall flush and the host's own drain — a debounce timer
+ * still pending at exit would otherwise lose the final save.
+ */
+export async function flushWindowSession(): Promise<void> {
+  cancelPending();
+  writeNow();
+  // Not a loop: `writeNow` is synchronous up to the writer's own promise, and
+  // nothing schedules behind it once the timer is cancelled.
+  await inFlight;
+}
+
+function scheduleWrite(): void {
+  if (!writer || timer) return;
+  timer = setTimeout(() => {
+    timer = null;
+    writeNow();
+  }, WRITE_DEBOUNCE_MS);
+}
+
+function writeNow(): void {
+  if (!writer) return;
+  const result = writer(getWindowSnapshot());
+  inFlight = result ? Promise.resolve(result).catch(() => undefined) : null;
+}
+
+function cancelPending(): void {
+  if (!timer) return;
+  clearTimeout(timer);
+  timer = null;
+}
+
+/** Forget every session, seed, and installed writer (tests). */
 export function resetWindowSessionAggregator(): void {
-  sessions.clear();
+  published.clear();
+  seeded.clear();
   writer = null;
+  unsubscribeWorkspaces?.();
+  unsubscribeWorkspaces = null;
+  cancelPending();
+  inFlight = null;
 }
diff --git a/standalone/src/browser-sidecar-adapter.ts b/standalone/src/browser-sidecar-adapter.ts
index 4384f3238..163043c12 100644
--- a/standalone/src/browser-sidecar-adapter.ts
+++ b/standalone/src/browser-sidecar-adapter.ts
@@ -34,7 +34,8 @@ import type { AwaitHandle, AwaitOptions } from "dormouse-lib/lib/alert-manager";
 import type { AlertSettings } from "dormouse-lib/lib/alert-settings";
 import { normalizeExternalUri } from "dormouse-lib/lib/external-links";
 import { createMemoryNotepadArchivePort } from "dormouse-lib/lib/notepad/memory-archive-port";
-import { loadSessionState, saveSessionState } from "dormouse-lib/lib/window-persistence";
+import { loadWindowState, saveWindowState } from "dormouse-lib/lib/window-persistence";
+import type { PersistedWindow } from "dormouse-lib/lib/session-types";
 import {
   applyTerminalProtocolEvents,
   collectTerminalSemanticEvents,
@@ -278,19 +279,24 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
 
   readonly persistsSession = BrowserSidecarAdapter.PERSIST_SESSION;
 
-  // See TauriAdapter: PersistedWindow when the workspaces flag is on, bare
-  // PersistedSession when off; the helpers own the translation + JSON/storage
-  // plumbing (docs/specs/transport.md).
+  // See TauriAdapter: one `PersistedWindow` per window, in `localStorage` rather
+  // than the Rust file store (docs/specs/transport.md).
   saveState(state: unknown): void {
     if (!BrowserSidecarAdapter.PERSIST_SESSION) return;
-    try { saveSessionState(localStorage, BrowserSidecarAdapter.STATE_KEY, state); }
+    try { saveWindowState(localStorage, BrowserSidecarAdapter.STATE_KEY, state as PersistedWindow); }
     catch { console.error('[browser-sidecar] Failed to save session state'); }
   }
 
+  /** See TauriAdapter.getState: the blob here is a Window, and the boot reads it
+   *  through `getWindowState`. */
   getState(): unknown {
+    return null;
+  }
+
+  getWindowState(): PersistedWindow | null {
     if (!BrowserSidecarAdapter.PERSIST_SESSION) return null;
     try {
-      return loadSessionState(localStorage, BrowserSidecarAdapter.STATE_KEY);
+      return loadWindowState(localStorage, BrowserSidecarAdapter.STATE_KEY);
     } catch {
       return null;
     }
diff --git a/standalone/src/tauri-adapter.ts b/standalone/src/tauri-adapter.ts
index 0a051c231..fd61fe0c2 100644
--- a/standalone/src/tauri-adapter.ts
+++ b/standalone/src/tauri-adapter.ts
@@ -41,7 +41,8 @@ import { AlertManager } from "dormouse-lib/lib/alert-manager";
 import type { AwaitHandle, AwaitOptions } from "dormouse-lib/lib/alert-manager";
 import type { AlertSettings } from "dormouse-lib/lib/alert-settings";
 import { normalizeExternalUri } from "dormouse-lib/lib/external-links";
-import { loadSessionState, saveSessionState } from "dormouse-lib/lib/window-persistence";
+import { loadWindowState, saveWindowState } from "dormouse-lib/lib/window-persistence";
+import type { PersistedWindow } from "dormouse-lib/lib/session-types";
 import { TauriSessionStore } from "./tauri-session-store";
 import { withTimeout } from "./with-timeout";
 import {
@@ -611,19 +612,30 @@ export class TauriAdapter implements PlatformAdapter {
    */
   readonly persistsSession = TauriAdapter.PERSIST_SESSION;
 
+  /** The aggregator's writer: one `PersistedWindow` per window
+   *  (`docs/specs/transport.md` -> "Persisted session"). */
   saveState(state: unknown): void {
     if (!TauriAdapter.PERSIST_SESSION) return;
     try {
-      saveSessionState(this.sessionStore, TauriAdapter.STATE_KEY, state);
+      saveWindowState(this.sessionStore, TauriAdapter.STATE_KEY, state as PersistedWindow);
     } catch {
       console.error('[tauri-adapter] Failed to save session state');
     }
   }
 
+  /** The stored blob here is a Window, and the shared readers of `getState` want a
+   *  bare Session — so this answers nothing and `getWindowState` is the reader.
+   *  Standalone boots per Workspace, handing each plan its own record, so no
+   *  shared caller reaches this (`standalone/src/main.tsx`). */
   getState(): unknown {
+    return null;
+  }
+
+  /** The persisted Window, read from the boot-seeded cache. */
+  getWindowState(): PersistedWindow | null {
     if (!TauriAdapter.PERSIST_SESSION) return null;
     try {
-      return loadSessionState(this.sessionStore, TauriAdapter.STATE_KEY);
+      return loadWindowState(this.sessionStore, TauriAdapter.STATE_KEY);
     } catch {
       return null;
     }

From de947749e05fb6710f6a8d78ceb3c53283549d7f Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 9 Sep 2026 21:33:10 -0700
Subject: [PATCH 03/11] Lift the agent-recovery capture machine into
 lib/src/host
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The press-wait-press machine never needed anything host-specific: interrupt, a
monotonic received count, the output since a mark, and the live id set. It now
lives in `lib/src/host/recovery-capture.ts` over that four-method port, with
every rule and constant carried across, and reports each detected invocation the
moment it is found rather than owning a file.

`lib/src/host/recovery-store.ts` is the record half for a Node-resident host:
begin-capture clears once per process and merges after (a second window must not
wipe the first), writes are owner-only and temp-then-rename, and `take` is a
single-use destructive read with a 7-day expiry, a shape guard, and
null-prototype maps. No directory means memory-only with one warning.
`recovery.ts` is the pair, for the sidecar bundle.

VS Code's `captureAgentRecoveryCommands` becomes an adapter over the lifted
machine and keeps only what is its own: where the record lives and how it is
written. Its behavior is unchanged.

The capture is now pinned by `recovery-capture.test.ts` on a virtual clock —
`session-state.test.ts` covers alert persistence only and never exercised the
machine, so this is its first real net.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QBf4rQbwuxV6n6v7E3twYe
---
 lib/src/host/recovery-capture.test.ts | 195 ++++++++++++++++++++++
 lib/src/host/recovery-capture.ts      | 225 ++++++++++++++++++++++++++
 lib/src/host/recovery-store.test.ts   | 131 +++++++++++++++
 lib/src/host/recovery-store.ts        | 176 ++++++++++++++++++++
 lib/src/host/recovery.ts              |  15 ++
 vscode-ext/src/session-state.ts       | 188 ++++-----------------
 6 files changed, 770 insertions(+), 160 deletions(-)
 create mode 100644 lib/src/host/recovery-capture.test.ts
 create mode 100644 lib/src/host/recovery-capture.ts
 create mode 100644 lib/src/host/recovery-store.test.ts
 create mode 100644 lib/src/host/recovery-store.ts
 create mode 100644 lib/src/host/recovery.ts

diff --git a/lib/src/host/recovery-capture.test.ts b/lib/src/host/recovery-capture.test.ts
new file mode 100644
index 000000000..8a7e6e7af
--- /dev/null
+++ b/lib/src/host/recovery-capture.test.ts
@@ -0,0 +1,195 @@
+import { describe, expect, it } from 'vitest';
+import {
+  BLIND_SECOND_PRESS_MS,
+  QUIET_BEFORE_RETRY_MS,
+  captureAgentRecovery,
+  type RecoveryHost,
+} from './recovery-capture';
+
+/**
+ * A PTY host on a virtual clock. `sleep` is the only thing that moves time, so
+ * the whole capture runs synchronously-fast while the second-press rules see
+ * exactly the delays a real agent would produce.
+ */
+class FakePtys implements RecoveryHost {
+  time = 0;
+  /** Every `^C` batch, in order. */
+  readonly presses: string[][] = [];
+  readonly found: Record<string, string> = {};
+  private readonly text = new Map<string, string>();
+  private readonly count = new Map<string, number>();
+  private queue: Array<{ due: number; id: string; data: string }> = [];
+  private reactions = new Map<string, Array<(press: number) => void>>();
+
+  constructor(private live: string[]) {
+    for (const id of live) { this.text.set(id, ''); this.count.set(id, 0); }
+  }
+
+  /** Pre-existing output, received before the capture takes its mark. */
+  seed(id: string, data: string): this {
+    this.emitNow(id, data);
+    return this;
+  }
+
+  /** `data` arrives `delay` ms after the pane's `press`-th `^C`. */
+  onPress(id: string, press: number, delay: number, data: string): this {
+    const list = this.reactions.get(id) ?? [];
+    list.push((n) => { if (n === press) this.queue.push({ due: this.time + delay, id, data }); });
+    this.reactions.set(id, list);
+    return this;
+  }
+
+  exit(id: string): this {
+    this.live = this.live.filter((other) => other !== id);
+    return this;
+  }
+
+  liveIds(): string[] { return [...this.live]; }
+
+  async interrupt(ids: string[]): Promise<void> {
+    this.presses.push([...ids]);
+    for (const id of ids) {
+      const n = this.presses.filter((batch) => batch.includes(id)).length;
+      for (const react of this.reactions.get(id) ?? []) react(n);
+    }
+  }
+
+  receivedChars(id: string): number { return this.count.get(id) ?? 0; }
+
+  outputSince(id: string, mark: number): string {
+    // No eviction in the fake: the buffer holds everything, so a mark always
+    // resolves exactly.
+    const received = this.count.get(id) ?? 0;
+    if (mark >= received) return '';
+    return (this.text.get(id) ?? '').slice(mark);
+  }
+
+  onCommand(id: string, command: string): void { this.found[id] = command; }
+
+  now(): number { return this.time; }
+
+  async sleep(ms: number): Promise<void> {
+    this.time += ms;
+    const due = this.queue.filter((item) => item.due <= this.time);
+    this.queue = this.queue.filter((item) => item.due > this.time);
+    for (const item of due) this.emitNow(item.id, item.data);
+  }
+
+  private emitNow(id: string, data: string): void {
+    this.text.set(id, (this.text.get(id) ?? '') + data);
+    this.count.set(id, (this.count.get(id) ?? 0) + data.length);
+  }
+}
+
+const CLAUDE_HINT = 'claude --resume 01JABCDEF';
+const CODEX_HINT = 'codex resume 01HXYZ';
+
+describe('captureAgentRecovery', () => {
+  it('presses every live pane once and reports each hint as it arrives', async () => {
+    const host = new FakePtys(['a', 'b'])
+      .onPress('a', 1, 80, `\r\nResume with \`${CLAUDE_HINT}\`.\r\n`)
+      .onPress('b', 1, 240, `\r\nRun ${CODEX_HINT} to continue\r\n`);
+
+    const found = await captureAgentRecovery(host);
+
+    expect(host.presses[0].sort()).toEqual(['a', 'b']);
+    expect(found).toBe(2);
+    expect(host.found).toEqual({ a: CLAUDE_HINT, b: CODEX_HINT });
+  });
+
+  it('presses again as soon as a pane asks, through its TUI escapes', async () => {
+    // claude renders the prompt inside its TUI, so the raw bytes carry escapes
+    // through the phrase — the ask gate strips before it matches.
+    const ask = 'Press Ctrl-C again to exit';
+    const host = new FakePtys(['a'])
+      .onPress('a', 1, 40, ask)
+      .onPress('a', 2, 40, `\r\n${CLAUDE_HINT}\r\n`);
+
+    await captureAgentRecovery(host);
+
+    // Second press well inside the blind window, so the ask is what triggered it.
+    expect(host.presses).toHaveLength(2);
+    expect(host.presses[1]).toEqual(['a']);
+    expect(host.found.a).toBe(CLAUDE_HINT);
+  });
+
+  it('waits for both fallback clocks before pressing a silent pane again', async () => {
+    const host = new FakePtys(['a']);
+    // Chatty right up to just before the blind window closes, so `quietFor` is
+    // what holds the second press back after `elapsed` has passed.
+    for (let at = 40; at <= BLIND_SECOND_PRESS_MS; at += 40) host.onPress('a', 1, at, '.');
+    host.onPress('a', 2, 40, `\r\n${CLAUDE_HINT}\r\n`);
+
+    await captureAgentRecovery(host);
+
+    expect(host.presses).toHaveLength(2);
+    // Not at BLIND_SECOND_PRESS_MS: the pane was still printing, and a press
+    // landing mid-print destroys the hint.
+    const secondPressAt = host.time;
+    expect(secondPressAt).toBeGreaterThanOrEqual(BLIND_SECOND_PRESS_MS + QUIET_BEFORE_RETRY_MS);
+  });
+
+  it('never presses a pane that already yielded, and presses each pane at most twice', async () => {
+    const host = new FakePtys(['quick', 'silent'])
+      .onPress('quick', 1, 40, `\r\n${CLAUDE_HINT}\r\n`);
+
+    await captureAgentRecovery(host);
+
+    expect(host.presses[0].sort()).toEqual(['quick', 'silent']);
+    // Every later press is the silent pane's alone, and there is only one.
+    expect(host.presses.slice(1)).toEqual([['silent']]);
+  });
+
+  it('never presses an exited pane', async () => {
+    const host = new FakePtys(['alive', 'gone']).exit('gone');
+    await captureAgentRecovery(host);
+    expect(host.presses.every((batch) => !batch.includes('gone'))).toBe(true);
+  });
+
+  it('does nothing at all when no pane is live', async () => {
+    const host = new FakePtys([]);
+    expect(await captureAgentRecovery(host)).toBe(0);
+    expect(host.presses).toEqual([]);
+  });
+
+  it('reads only bytes received after its own mark', async () => {
+    // A hint from a PREVIOUS run, sitting in the buffer before the capture starts.
+    const host = new FakePtys(['a']).seed('a', `\r\nold: claude --resume STALE0000\r\n`);
+    await captureAgentRecovery(host);
+    expect(host.found).toEqual({});
+  });
+
+  it('does not finish early on quiet — a pane that speaks late is still caught', async () => {
+    // codex says nothing for ~250ms after the interrupt and then prints its whole
+    // shutdown at once; settling on the gap loses it.
+    const host = new FakePtys(['a']).onPress('a', 1, 1_000, `\r\n${CODEX_HINT}\r\n`);
+    expect(await captureAgentRecovery(host)).toBe(1);
+    expect(host.found.a).toBe(CODEX_HINT);
+  });
+
+  it('stops at the ceiling and reports what it has', async () => {
+    const host = new FakePtys(['a', 'b'])
+      .onPress('a', 1, 40, `\r\n${CLAUDE_HINT}\r\n`);
+    // 'b' never answers at all.
+    expect(await captureAgentRecovery(host, { maxWaitMs: 300 })).toBe(1);
+    expect(host.time).toBeLessThan(600);
+    expect(host.found).toEqual({ a: CLAUDE_HINT });
+  });
+
+  it('exits as soon as every pane has yielded', async () => {
+    const host = new FakePtys(['a']).onPress('a', 1, 40, `\r\n${CLAUDE_HINT}\r\n`);
+    await captureAgentRecovery(host, { maxWaitMs: 10_000 });
+    expect(host.time).toBeLessThanOrEqual(80);
+  });
+
+  it('restricts the capture to the ids it is given', async () => {
+    const host = new FakePtys(['a', 'b'])
+      .onPress('a', 1, 40, `\r\n${CLAUDE_HINT}\r\n`)
+      .onPress('b', 1, 40, `\r\n${CODEX_HINT}\r\n`);
+
+    await captureAgentRecovery(host, { ids: ['a'] });
+
+    expect(host.presses.flat()).toEqual(['a']);
+    expect(host.found).toEqual({ a: CLAUDE_HINT });
+  });
+});
diff --git a/lib/src/host/recovery-capture.ts b/lib/src/host/recovery-capture.ts
new file mode 100644
index 000000000..121ef7f2e
--- /dev/null
+++ b/lib/src/host/recovery-capture.ts
@@ -0,0 +1,225 @@
+/**
+ * Interrupt the live PTYs, then detect each pane's agent resume invocation.
+ *
+ * The press-wait-press machine, host-agnostic: the VS Code extension host runs it
+ * over `vscode-ext/src/pty-manager.ts`, the Tauri sidecar over `pty-core.js`.
+ * Both reach it through the same four primitives — interrupt, a monotonic
+ * received count, the output since a mark, and the live id set — because that is
+ * all the detection ever needed (docs/specs/vscode.md -> "Capturing agent
+ * recovery", docs/specs/standalone.md -> "Agent recovery").
+ *
+ * The scrollback read here never leaves this module: only the detected
+ * invocation reaches `onCommand`, so no transcript can reach persisted state.
+ */
+
+import { detectResumeCommand } from '../lib/resume-patterns';
+import { stripTerminalControls } from '../lib/terminal-controls';
+
+// Claude's explicit request permits an immediate second press. Other panes
+// without a recovery hint must pass both fallback clocks below before retrying.
+const ASKS_FOR_SECOND_PRESS = /Press Ctrl-C again/i;
+
+// When to press a silent pane again without having been asked.
+//
+// Both agents' response to `^C` turns out to be state-dependent. Observed in a
+// real pane: codex answered the first press by repainting its TUI (+256 bytes of
+// cursor positioning, ending on its footer hint) and simply carried on running.
+// It never printed a hint and never asked for another press, so an ask-only gate
+// left it stuck there for the whole poll.
+export const BLIND_SECOND_PRESS_MS = 600;
+
+// ...but a second press that lands while an agent is mid-shutdown destroys its
+// hint, so require the pane to have been silent for this long first. Note this is
+// quiet used *correctly*: not as evidence that the pane is finished (that mistake
+// cost two rounds), but as evidence that pressing again cannot interrupt a print
+// already in flight.
+export const QUIET_BEFORE_RETRY_MS = 200;
+
+// `Press Ctrl-C again` is a live TUI footer, so it is always within a few hundred
+// bytes of the tail. Bounding the strip matters: the buffer runs to ~1MB, and
+// stripping all of it costs ~3.5ms per pane on every 40ms tick — stolen from the
+// same thread that has to deliver the hints being polled for.
+const ASK_TAIL_CHARS = 8192;
+
+/** How long the whole capture may take by default. */
+export const DEFAULT_RECOVERY_WAIT_MS = 1300;
+
+const POLL_STEP_MS = 40;
+
+export interface RecoveryLog {
+  info(message: string): void;
+  error(message: string): void;
+}
+
+/** Everything the machine needs from whichever host owns the PTYs. */
+export interface RecoveryHost {
+  /** Ids that can still take a `^C`. An exited PTY can neither receive one nor
+   *  ever yield a hint, so it must not appear here. */
+  liveIds(): string[];
+  /** Send exactly ONE `^C` to each id and resolve when the host has acked it.
+   *  The second press is this module's decision, never the host's. */
+  interrupt(ids: string[]): Promise<void>;
+  /** Chars ever received for a pane, never decremented by a buffer trim. */
+  receivedChars(id: string): number;
+  /** Output received after a `receivedChars` mark, clamped to what is still held. */
+  outputSince(id: string, mark: number): string;
+  /** A detected invocation, handed over the moment it is found. */
+  onCommand(id: string, command: string): void;
+  now?(): number;
+  sleep?(ms: number): Promise<void>;
+  log?: RecoveryLog;
+}
+
+export interface RecoveryCaptureOptions {
+  /** Restrict the capture to these ids (intersected with the live set). Omitted
+   *  takes every live PTY. */
+  ids?: readonly string[];
+  maxWaitMs?: number;
+}
+
+/** Null-prototype: surface ids are arbitrary strings, and on a plain literal an
+ *  id of `constructor` or `toString` reads back as an inherited function while
+ *  `__proto__` refuses to be stored at all. */
+export const noCommands = (): Record<string, string> => Object.create(null);
+
+const silent: RecoveryLog = { info: () => {}, error: () => {} };
+
+/**
+ * Press, wait, press again where it helps, and report what each pane printed.
+ * Resolves with the number of commands detected.
+ *
+ * Two properties earn the complexity:
+ *
+ * 1. **It runs first in a teardown.** The budget has never once been generous
+ *    enough to reach the end, so the one step whose data cannot be reconstructed
+ *    goes before the ones whose data can (cwd re-reads, alert merges).
+ * 2. **It reports eagerly.** `onCommand` fires the moment a pane yields, so being
+ *    killed mid-poll costs at most a late agent's command, never everything found
+ *    so far.
+ */
+export async function captureAgentRecovery(
+  host: RecoveryHost,
+  options: RecoveryCaptureOptions = {},
+): Promise<number> {
+  const log = host.log ?? silent;
+  // Called through `host` rather than pulled off it: a class-based host loses
+  // `this` the moment one of these is captured as a bare function.
+  const now = (): number => host.now?.() ?? Date.now();
+  const sleep = (ms: number): Promise<void> =>
+    host.sleep?.(ms) ?? new Promise<void>((resolve) => { setTimeout(resolve, ms); });
+  const maxWaitMs = options.maxWaitMs ?? DEFAULT_RECOVERY_WAIT_MS;
+  const started = now();
+
+  const wanted = options.ids ? new Set(options.ids) : null;
+  const liveIds = host.liveIds().filter((id) => wanted === null || wanted.has(id));
+  if (liveIds.length === 0) {
+    log.info('[recovery] no live PTYs to interrupt');
+    return 0;
+  }
+
+  const commands: Record<string, string> = noCommands();
+  // Marks come from the exact monotonic counter the buffer already maintains, not
+  // from its *length*: a pane at the buffer cap holds its length pinned while
+  // output keeps flowing, so a length is neither a usable growth signal nor a
+  // usable offset — and that pane is exactly the long-running agent this exists
+  // for.
+  const startMark = new Map(liveIds.map((id) => [id, host.receivedChars(id)]));
+  const lastMark = new Map(startMark);
+  // Seeded once the interrupt is acked, not here — see `interruptedAt`.
+  const lastGrewAt = new Map<string, number>();
+
+  const pending = () => liveIds.filter((id) => !commands[id]);
+  // Panes that asked for a second press during the most recent scan.
+  const asked = new Set<string>();
+  // One buffer read per pending pane per tick, shared by both things a tick needs
+  // to know about that pane: joining the chunks is the expensive part, so asking
+  // twice would double the cost of the poll for no new information.
+  const scanPending = () => {
+    asked.clear();
+    for (const id of pending()) {
+      // Recovery commands are executable state, so only trust bytes that arrived
+      // after this teardown started interrupting the pane. Scanning the existing
+      // buffer would let an old launch echo or a previous agent hint run on the
+      // next restore. If bounded scrollback evicted bytes past the mark in the
+      // meantime, this can only return less than the pane printed; it cannot
+      // expose stale output as fresh.
+      const outputSinceInterrupt = host.outputSince(id, startMark.get(id) ?? Infinity);
+      if (!outputSinceInterrupt) continue;
+      const detected = detectResumeCommand(outputSinceInterrupt);
+      if (detected) {
+        commands[id] = detected;
+        log.info(`[recovery]   ${id} -> ${detected} (+${now() - started}ms)`);
+        host.onCommand(id, detected);
+        continue;
+      }
+      // Strip presentation controls first — claude renders that prompt inside its
+      // TUI, so the raw buffer can carry escapes through the phrase.
+      if (ASKS_FOR_SECOND_PRESS.test(stripTerminalControls(outputSinceInterrupt.slice(-ASK_TAIL_CHARS)))) {
+        asked.add(id);
+      }
+    }
+  };
+
+  // One press to everything, then retry through the ask or quiet fallback gate.
+  // `interrupt` is already bounded and always settles within its own timeout.
+  await host.interrupt(liveIds);
+  // The clock the second-press rules run on, taken *after* the ack rather than at
+  // entry. `BLIND_SECOND_PRESS_MS` is a statement about the agent ("long enough
+  // that a one-press agent would already have spoken"), and the agent's clock
+  // starts when the `^C` lands. Measuring from `started` folds the interrupt's own
+  // round trip into the window, which at worst leaves a claude 200ms to answer in
+  // and fires the blind press while codex is still on its first ~255ms of silence.
+  // The wall-clock `deadline` below stays anchored to `started`, because *that* is
+  // a shutdown budget rather than an agent timing.
+  const interruptedAt = now();
+  for (const id of liveIds) lastGrewAt.set(id, interruptedAt);
+  const pressedTwice = new Set<string>();
+
+  // Poll to the ceiling. Do NOT try to finish early on quiet: codex says nothing
+  // for ~250ms after the interrupt and then prints its whole shutdown at once, so
+  // silence is what it looks like *before* it speaks, not after. Two heuristics
+  // died on that — settling when detections stopped arriving and settling when
+  // output stopped arriving — both mistaking the gap for completion.
+  //
+  // Waiting is close to free now that every command is reported the moment it is
+  // found: the only cost is budget taken from the later teardown steps, and those
+  // are precisely the ones whose data can be reconstructed. The one early exit
+  // that is safe is having nothing left to wait for.
+  const deadline = started + maxWaitMs;
+  while (now() < deadline) {
+    await sleep(POLL_STEP_MS);
+    scanPending();
+    if (pending().length === 0) break;
+
+    // Retry an uncaptured pane when it asks, or after both fallback clocks pass.
+    const elapsed = now() - interruptedAt;
+    for (const id of pending()) {
+      const mark = host.receivedChars(id);
+      if (mark !== lastMark.get(id)) { lastMark.set(id, mark); lastGrewAt.set(id, now()); }
+    }
+    const quietFor = (id: string) => now() - (lastGrewAt.get(id) ?? interruptedAt);
+    const retry = pending().filter((id) => !pressedTwice.has(id)
+      && (asked.has(id)
+        || (elapsed >= BLIND_SECOND_PRESS_MS && quietFor(id) >= QUIET_BEFORE_RETRY_MS)));
+    if (retry.length > 0) {
+      const why = retry.some((id) => asked.has(id)) ? 'asked' : `silent past ${BLIND_SECOND_PRESS_MS}ms`;
+      retry.forEach((id) => pressedTwice.add(id));
+      log.info(`[recovery] second press for ${retry.length} pane(s) at +${elapsed}ms after ^C (${why})`);
+      await host.interrupt(retry);
+    }
+  }
+
+  const found = Object.keys(commands).length;
+  log.info(`[recovery] settled with ${found} command(s) across ${liveIds.length} live PTY(s) at +${now() - started}ms`);
+  // A pane that yielded nothing is worth a line, but only its shape — never its
+  // output. Whether the interrupt produced *any* bytes separates "the ^C never
+  // landed" from "it ran and kept going", which is the fork that matters, and it
+  // is the one piece of this that can be logged forever: dumping the actual tail
+  // would write terminal output into a log file, which is precisely the
+  // disclosure this whole scope exists to remove.
+  for (const id of pending()) {
+    const after = host.receivedChars(id) - (startMark.get(id) ?? 0);
+    log.info(`[recovery]   no hint from ${id}: +${after} bytes since interrupt, asked=${asked.has(id)}, pressedTwice=${pressedTwice.has(id)}`);
+  }
+  return found;
+}
diff --git a/lib/src/host/recovery-store.test.ts b/lib/src/host/recovery-store.test.ts
new file mode 100644
index 000000000..d67f3e7af
--- /dev/null
+++ b/lib/src/host/recovery-store.test.ts
@@ -0,0 +1,131 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import * as fs from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createRecoveryStore, RECOVERY_MAX_AGE_MS } from './recovery-store';
+
+let dir: string;
+const messages: string[] = [];
+const log = {
+  info: (message: string) => messages.push(`info ${message}`),
+  error: (message: string) => messages.push(`error ${message}`),
+};
+
+const file = () => join(dir, 'recovery.json');
+const read = () => JSON.parse(fs.readFileSync(file(), 'utf8')) as { createdAt: number; commands: Record<string, string> };
+const write = (payload: unknown) => fs.writeFileSync(file(), JSON.stringify(payload), 'utf8');
+
+beforeEach(() => {
+  dir = fs.mkdtempSync(join(tmpdir(), 'dormouse-recovery-'));
+  messages.length = 0;
+});
+
+afterEach(() => {
+  fs.rmSync(dir, { recursive: true, force: true });
+});
+
+describe('recovery store', () => {
+  describe('capture', () => {
+    it('replaces the previous record on the first beginCapture and merges after', () => {
+      write({ createdAt: Date.now(), commands: { old: 'claude --continue' } });
+
+      const store = createRecoveryStore(dir, { log });
+      store.beginCapture();
+      // The stale record is gone before anything can be detected, so a teardown
+      // that captures nothing cannot carry it forward.
+      expect(fs.existsSync(file())).toBe(false);
+
+      store.record('a', 'claude --resume A');
+      expect(read().commands).toEqual({ a: 'claude --resume A' });
+
+      // A second capture in the same process (another window) merges.
+      store.beginCapture();
+      store.record('b', 'codex resume B');
+      expect(read().commands).toEqual({ a: 'claude --resume A', b: 'codex resume B' });
+    });
+
+    it('writes the record and its directory owner-only', () => {
+      const store = createRecoveryStore(dir, { log });
+      store.beginCapture();
+      store.record('a', 'claude --continue');
+      const mode = (path: string) => fs.statSync(path).mode & 0o777;
+      expect(mode(file())).toBe(0o600);
+      // The temp sibling is renamed over the target, so nothing torn is left.
+      expect(fs.readdirSync(dir)).toEqual(['recovery.json']);
+    });
+
+    it('does not throw when the record cannot be written', () => {
+      // A file where the state directory should be: `mkdirSync` cannot make it.
+      const blocked = join(dir, 'blocked');
+      fs.writeFileSync(blocked, 'not a directory', 'utf8');
+      const store = createRecoveryStore(blocked, { log });
+      store.beginCapture();
+      expect(() => store.record('a', 'claude --continue')).not.toThrow();
+      expect(messages.some((message) => message.startsWith('error [recovery] write failed'))).toBe(true);
+      // Nothing was captured, so nothing can be claimed either.
+      expect(store.take(['a'])).toEqual({});
+    });
+  });
+
+  describe('take', () => {
+    it('unlinks on the first call and hands out each id exactly once', () => {
+      write({ createdAt: Date.now(), commands: { a: 'claude --resume A', b: 'codex resume B' } });
+      const store = createRecoveryStore(dir, { log });
+
+      expect(store.take(['a'])).toEqual({ a: 'claude --resume A' });
+      // The durable copy is gone before anything can act on it, so a failed start
+      // cannot replay it.
+      expect(fs.existsSync(file())).toBe(false);
+
+      // A second container claims its share of the same read; the first id is
+      // spent.
+      expect(store.take(['a', 'b'])).toEqual({ b: 'codex resume B' });
+      expect(store.take(['b'])).toEqual({});
+    });
+
+    it('returns nothing when there is no record', () => {
+      expect(createRecoveryStore(dir, { log }).take(['a'])).toEqual({});
+    });
+
+    it('is destructive even on a record it cannot parse', () => {
+      fs.writeFileSync(file(), '{ torn', 'utf8');
+      const store = createRecoveryStore(dir, { log });
+      expect(store.take(['a'])).toEqual({});
+      expect(fs.existsSync(file())).toBe(false);
+    });
+
+    it('discards a record past its expiry, having removed it', () => {
+      write({ createdAt: Date.now() - RECOVERY_MAX_AGE_MS - 1, commands: { a: 'claude --continue' } });
+      const store = createRecoveryStore(dir, { log });
+      expect(store.take(['a'])).toEqual({});
+      expect(fs.existsSync(file())).toBe(false);
+    });
+
+    it('drops a non-string entry rather than handing it on', () => {
+      write({ createdAt: Date.now(), commands: { a: 'claude --continue', b: { evil: true } } });
+      const store = createRecoveryStore(dir, { log });
+      expect(store.take(['a', 'b'])).toEqual({ a: 'claude --continue' });
+    });
+
+    it('cannot be tricked by an id that names an Object prototype member', () => {
+      write({ createdAt: Date.now(), commands: { constructor: 'claude --continue' } });
+      const store = createRecoveryStore(dir, { log });
+      // A plain literal would answer `toString` with an inherited function.
+      expect(store.take(['toString'])).toEqual({});
+      expect(store.take(['constructor'])).toEqual({ constructor: 'claude --continue' });
+    });
+  });
+
+  describe('without a state directory', () => {
+    it('keeps the record in memory and says so once', () => {
+      const store = createRecoveryStore(undefined, { log });
+      expect(store.persistent).toBe(false);
+      expect(messages.filter((message) => message.includes('no state directory'))).toHaveLength(1);
+
+      store.beginCapture();
+      store.record('a', 'claude --continue');
+      expect(store.take(['a'])).toEqual({ a: 'claude --continue' });
+      expect(store.take(['a'])).toEqual({});
+    });
+  });
+});
diff --git a/lib/src/host/recovery-store.ts b/lib/src/host/recovery-store.ts
new file mode 100644
index 000000000..942bedd24
--- /dev/null
+++ b/lib/src/host/recovery-store.ts
@@ -0,0 +1,176 @@
+/**
+ * Where a Node-resident host keeps the agent resume invocations it captured
+ * while tearing down, and how a cold start claims them exactly once
+ * (docs/specs/standalone.md -> "Agent recovery").
+ *
+ * The record is single-use, rebuilt-invocation-only, and never a buffer: only
+ * what `detectResumeCommand` recognized is written, so no transcript reaches
+ * disk. It is deliberately NOT part of the persisted session — a webview that
+ * could save it back would replay a stale invocation on a later restore
+ * (docs/specs/transport.md -> "Consuming it").
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { noCommands, type RecoveryLog } from './recovery-capture';
+
+const FILE_NAME = 'recovery.json';
+
+/** How long a record stays offerable. One cold start consumes it; this only
+ *  bounds a host that never comes back. */
+export const RECOVERY_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+
+interface PersistedRecovery {
+  createdAt: number;
+  /** Surface id -> canonical agent resume invocation. */
+  commands: Record<string, string>;
+}
+
+export interface RecoveryStore {
+  /**
+   * A teardown is about to capture. The FIRST call of a process replaces
+   * whatever the last run left; later calls merge, because a Window captures
+   * separately and the second must not wipe the first.
+   */
+  beginCapture(): void;
+  /** Merge one detected invocation and persist immediately. */
+  record(id: string, command: string): void;
+  /** Claim the commands belonging to `paneIds`, removing each as it is handed out. */
+  take(paneIds: Iterable<string>): Record<string, string>;
+  /** Whether a write survives this process. `false` is the no-directory store. */
+  readonly persistent: boolean;
+}
+
+const silent: RecoveryLog = { info: () => {}, error: () => {} };
+
+/**
+ * The record under `dir`, or a memory-only store when no directory was given.
+ *
+ * Owner-only and temp-then-rename, because a kill during the write must not
+ * leave a torn record for the next start to parse — the same durability shape as
+ * the standalone session snapshot.
+ */
+export function createRecoveryStore(dir?: string, opts: { log?: RecoveryLog } = {}): RecoveryStore {
+  const log = opts.log ?? silent;
+  const file = dir ? path.join(dir, FILE_NAME) : null;
+  if (!file) {
+    log.error('[recovery] no state directory; agent recovery will not survive this process');
+  }
+
+  // What this process has captured. Also the memory-only store's whole content.
+  let captured: Record<string, string> = noCommands();
+  let clearedThisProcess = false;
+  // What is left of the record on disk, once read. `null` until the first `take`.
+  let unclaimed: Record<string, string> | null = null;
+
+  const persist = (): void => {
+    if (!file) return;
+    const payload: PersistedRecovery = { createdAt: Date.now(), commands: captured };
+    try {
+      fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+      const tmp = `${file}.tmp`;
+      // Mode on create, so the bytes are never briefly world-readable; the rename
+      // preserves it.
+      fs.writeFileSync(tmp, JSON.stringify(payload), { encoding: 'utf8', mode: 0o600 });
+      fs.renameSync(tmp, file);
+    } catch (err) {
+      log.error(`[recovery] write failed: ${String(err)}`);
+    }
+  };
+
+  return {
+    persistent: file !== null,
+
+    beginCapture(): void {
+      if (clearedThisProcess) return;
+      clearedThisProcess = true;
+      // Clear before anything can return early. A record is only ever consumed by
+      // a cold start that actually restores, so a teardown that captures nothing
+      // must not leave the last one sitting there — otherwise a run that restores
+      // nothing carries the record forward and a much later restore auto-runs a
+      // week-old invocation unprompted. `record` re-creates it the moment
+      // anything is detected.
+      captured = noCommands();
+      if (!file) return;
+      try {
+        fs.rmSync(file, { force: true });
+      } catch (err) {
+        log.error(`[recovery] could not clear the previous record: ${String(err)}`);
+      }
+    },
+
+    record(id: string, command: string): void {
+      captured[id] = command;
+      // Persist on every change rather than once at the end. The write is a few
+      // hundred bytes and costs well under a millisecond, and the shutdown budget
+      // can end the capture at any instant.
+      persist();
+    },
+
+    take(paneIds: Iterable<string>): Record<string, string> {
+      unclaimed ??= file ? readAndClearRecord(file, log) : captured;
+      const claimed: Record<string, string> = noCommands();
+      for (const id of paneIds) {
+        const command = unclaimed[id];
+        if (command === undefined) continue;
+        claimed[id] = command;
+        // Entries leave the map as they are claimed, so no id is ever handed out
+        // twice — a second container claiming its share sees only the remainder.
+        delete unclaimed[id];
+      }
+      log.info(`[recovery] handing ${Object.keys(claimed).length} command(s) to a cold restore`
+        + ` (${Object.keys(unclaimed).length} unclaimed)`);
+      return claimed;
+    },
+  };
+}
+
+/**
+ * Read the record and remove it. Destructive on the first call of a process, so
+ * the durable copy is gone before anything can act on it and a failed start
+ * cannot replay it.
+ */
+function readAndClearRecord(file: string, log: RecoveryLog): Record<string, string> {
+  if (!fs.existsSync(file)) return noCommands();
+
+  let recovery: PersistedRecovery | null = null;
+  try {
+    recovery = JSON.parse(fs.readFileSync(file, 'utf8')) as PersistedRecovery;
+  } catch (err) {
+    log.error(`[recovery] unreadable record; discarding: ${String(err)}`);
+  }
+  // Destructive even on a parse failure: a record that cannot be understood must
+  // not sit on disk waiting to be retried forever.
+  try {
+    fs.unlinkSync(file);
+  } catch {
+    // If it cannot be removed, do not use it — better to lose one recovery than
+    // to re-run an agent on every start from a record we cannot clear.
+    log.error('[recovery] could not clear record; ignoring it');
+    return noCommands();
+  }
+  if (!recovery) return noCommands();
+
+  const age = Date.now() - (recovery.createdAt ?? 0);
+  if (age > RECOVERY_MAX_AGE_MS) {
+    log.info(`[recovery] discarding record ${Math.round(age / 86_400_000)}d old`);
+    return noCommands();
+  }
+
+  // Shape-guard every entry. This file is plain JSON on disk and its values end up
+  // typed into a shell, so a torn or hand-edited record must fail as one dropped
+  // entry rather than as something later code has to survive.
+  const raw: unknown = recovery.commands;
+  const commands: Record<string, string> = noCommands();
+  if (raw && typeof raw === 'object') {
+    for (const [id, command] of Object.entries(raw)) {
+      if (typeof command !== 'string') {
+        log.error(`[recovery] dropping ${id}: expected a string, got ${typeof command}`);
+        continue;
+      }
+      commands[id] = command;
+    }
+  }
+  log.info(`[recovery] read ${Object.keys(commands).length} command(s) from the record`);
+  return commands;
+}
diff --git a/lib/src/host/recovery.ts b/lib/src/host/recovery.ts
new file mode 100644
index 000000000..36e6aa4b5
--- /dev/null
+++ b/lib/src/host/recovery.ts
@@ -0,0 +1,15 @@
+/**
+ * The sidecar's entry into agent recovery: the capture machine plus the record
+ * store, bundled together as `sidecar/recovery.cjs` by
+ * `standalone/scripts/build-sidecar-proxy.mjs`. `detectResumeCommand` and
+ * `stripTerminalControls` come along transitively.
+ *
+ * The VS Code extension host imports `recovery-capture.ts` directly and keeps its
+ * own record in extension storage (docs/specs/vscode.md -> "Capturing agent
+ * recovery").
+ */
+
+export { captureAgentRecovery, DEFAULT_RECOVERY_WAIT_MS, noCommands } from './recovery-capture';
+export type { RecoveryCaptureOptions, RecoveryHost, RecoveryLog } from './recovery-capture';
+export { createRecoveryStore, RECOVERY_MAX_AGE_MS } from './recovery-store';
+export type { RecoveryStore } from './recovery-store';
diff --git a/vscode-ext/src/session-state.ts b/vscode-ext/src/session-state.ts
index f69157594..905750378 100644
--- a/vscode-ext/src/session-state.ts
+++ b/vscode-ext/src/session-state.ts
@@ -4,8 +4,11 @@ import * as path from 'path';
 import * as ptyManager from './pty-manager';
 import type { AlertState } from '../../lib/src/lib/alert-manager';
 import { browserPersistedPane, readPersistedSession, toPersistedAlertState, type PersistedAlertState, type PersistedPane, type PersistedSession } from '../../lib/src/lib/session-types';
-import { detectResumeCommand } from '../../lib/src/lib/resume-patterns';
-import { stripTerminalControls } from '../../lib/src/lib/terminal-controls';
+import {
+  captureAgentRecovery,
+  DEFAULT_RECOVERY_WAIT_MS,
+  noCommands,
+} from '../../lib/src/host/recovery-capture';
 import { log } from './log';
 
 const SESSION_STATE_KEY = 'dormouse.session';
@@ -105,37 +108,15 @@ interface PersistedRecovery {
   commands: Record<string, string>;
 }
 
-// Claude's explicit request permits an immediate second press. Other panes
-// without a recovery hint must pass both fallback clocks below before retrying.
-const ASKS_FOR_SECOND_PRESS = /Press Ctrl-C again/i;
-
-// When to press a silent pane again without having been asked.
-//
-// Both agents' response to `^C` turns out to be state-dependent. Observed in a
-// real pane: codex answered the first press by repainting its TUI (+256 bytes of
-// cursor positioning, ending on its footer hint) and simply carried on running.
-// It never printed a hint and never asked for another press, so an ask-only gate
-// left it stuck there for the whole poll.
-const BLIND_SECOND_PRESS_MS = 600;
-
-// ...but a second press that lands while an agent is mid-shutdown destroys its
-// hint, so require the pane to have been silent for this long first. Note this is
-// quiet used *correctly*: not as evidence that the pane is finished (that mistake
-// cost two rounds), but as evidence that pressing again cannot interrupt a print
-// already in flight.
-const QUIET_BEFORE_RETRY_MS = 200;
-
-// `Press Ctrl-C again` is a live TUI footer, so it is always within a few hundred
-// bytes of the tail. Bounding the strip matters: the scrollback buffer runs to
-// 1MB, and stripping all of it costs ~3.5ms per pane on every 40ms tick — stolen
-// from the same thread that has to deliver the hints being polled for.
-const ASK_TAIL_CHARS = 8192;
-
 /**
  * Interrupt the live PTYs, then record each pane's agent resume invocation.
  *
  * The only writer of recovery state (docs/specs/vscode.md -> "Capturing agent
- * recovery"). Two properties earn their complexity:
+ * recovery"). The press-wait-press machine itself is shared with the Tauri
+ * sidecar (`lib/src/host/recovery-capture.ts`); what stays here is the extension
+ * host's half — where the record lives and how it is written.
+ *
+ * Two properties earn their complexity:
  *
  * 1. **Runs first in `deactivate()`.** The extension host is killed on a budget
  *    that has never once been generous enough to reach `[deactivate] done`, so
@@ -146,14 +127,13 @@ const ASK_TAIL_CHARS = 8192;
  *    webview's copy, whose `resumeCommand` is always the stale `null` it last
  *    saw. A separate record makes the write order stop mattering.
  *
- * The scrollback read here never leaves this function — only the detected
+ * The scrollback the capture reads never leaves it — only the detected
  * invocation is stored, so no transcript reaches persisted state.
  */
 export async function captureAgentRecoveryCommands(
   context: vscode.ExtensionContext,
-  maxWaitMs = 1300,
+  maxWaitMs = DEFAULT_RECOVERY_WAIT_MS,
 ): Promise<void> {
-  const started = Date.now();
   const file = recoveryFilePath(context);
   if (!file) {
     log.error('[recovery] no storage path available; cannot persist');
@@ -169,38 +149,17 @@ export async function captureAgentRecoveryCommands(
   try {
     fs.rmSync(file, { force: true });
   } catch (err) {
-    log.error('[recovery] could not clear the previous record:', String(err));
+    log.error('[recovery] could not clear the previous record: ' + String(err));
   }
 
-  // Exited PTYs are kept in the buffer map until `kill()`, and one can neither
-  // receive a `^C` nor ever yield a hint — including them would scan them on every
-  // tick and permanently defeat the `pending().length === 0` early exit.
-  const liveIds = [...ptyManager.getBufferedPtys()].filter(([, e]) => e.alive).map(([id]) => id);
-  if (liveIds.length === 0) {
-    log.info('[recovery] no live PTYs to interrupt');
-    return;
-  }
-
-  // Null-prototype: surface ids are arbitrary strings, and on a plain literal an
-  // id of `constructor` or `toString` reads back as an inherited function — the
-  // pane would test as already-captured on the very first tick and never be
-  // scanned, interrupted again, or waited for.
   const commands: Record<string, string> = noCommands();
-  // Marks come from the exact monotonic counter the buffer already maintains, not
-  // from its *length*: a pane at the 1MB cap holds its length pinned while output
-  // keeps flowing, so a length is neither a usable growth signal nor a usable
-  // offset — and that pane is exactly the long-running agent this exists for.
-  const startMark = new Map(liveIds.map((id) => [id, ptyManager.getScrollbackReceived(id)]));
-  const lastMark = new Map(startMark);
-  // Seeded once the interrupt is acked, not here — see `interruptedAt`.
-  const lastGrewAt = new Map<string, number>();
 
   // Persist on every change rather than once at the end. The write is a few
   // hundred bytes and costs well under a millisecond, so there is no reason for
   // it to wait behind a slow agent — and the shutdown budget can end this
-  // function at any instant. Writing eagerly makes the settle loop below a pure
-  // optimisation for *completeness*: being killed mid-poll now costs at most a
-  // late agent's command, never everything detected so far.
+  // function at any instant. Writing eagerly makes the capture's settle loop a
+  // pure optimisation for *completeness*: being killed mid-poll now costs at most
+  // a late agent's command, never everything detected so far.
   //
   // Temp-then-rename so a kill during the write cannot leave a torn record for
   // the next activation to parse (same durability trick as the standalone store,
@@ -213,106 +172,21 @@ export async function captureAgentRecoveryCommands(
       fs.writeFileSync(tmp, JSON.stringify(payload), 'utf8');
       fs.renameSync(tmp, file);
     } catch (err) {
-      log.error('[recovery] write failed:', String(err));
-    }
-  };
-  const pending = () => liveIds.filter((id) => !commands[id]);
-  // Panes that asked for a second press during the most recent scan.
-  const asked = new Set<string>();
-  // One buffer read per pending pane per tick, shared by both things a tick needs
-  // to know about that pane: joining the chunks is the expensive part, so asking
-  // twice would double the cost of the poll for no new information.
-  const scanPending = () => {
-    asked.clear();
-    let changed = false;
-    for (const id of pending()) {
-      // Recovery commands are executable state, so only trust bytes that arrived
-      // after this teardown started interrupting the pane. Scanning the existing
-      // buffer would let an old launch echo or a previous agent hint run on the
-      // next restore. If bounded scrollback evicted bytes past the mark in the
-      // meantime, this can only return less than the pane printed; it cannot
-      // expose stale output as fresh.
-      const outputSinceInterrupt = ptyManager.getScrollbackSince(id, startMark.get(id) ?? Infinity);
-      if (!outputSinceInterrupt) continue;
-      const detected = detectResumeCommand(outputSinceInterrupt);
-      if (detected) {
-        commands[id] = detected;
-        log.info(`[recovery]   ${id} -> ${detected} (+${Date.now() - started}ms)`);
-        changed = true;
-        continue;
-      }
-      // Strip presentation controls first — claude renders that prompt inside its
-      // TUI, so the raw buffer can carry escapes through the phrase.
-      if (ASKS_FOR_SECOND_PRESS.test(stripTerminalControls(outputSinceInterrupt.slice(-ASK_TAIL_CHARS)))) {
-        asked.add(id);
-      }
+      log.error('[recovery] write failed: ' + String(err));
     }
-    if (changed) persist();
   };
-  const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
-
-  // One press to everything, then retry through the ask or quiet fallback gate.
-  // `interrupt` is already bounded and always settles within its own timeout.
-  await ptyManager.interrupt(liveIds);
-  // The clock the second-press rules run on, taken *after* the ack rather than at
-  // entry. `BLIND_SECOND_PRESS_MS` is a statement about the agent ("long enough
-  // that a one-press agent would already have spoken"), and the agent's clock
-  // starts when the `^C` lands. Measuring from `started` folds the interrupt's own
-  // round trip — up to its 400ms timeout — into the window, which at worst leaves
-  // a claude 200ms to answer in and fires the blind press while codex is still on
-  // its first ~255ms of silence. The wall-clock `deadline` below stays anchored to
-  // `started`, because *that* is a shutdown budget rather than an agent timing.
-  const interruptedAt = Date.now();
-  for (const id of liveIds) lastGrewAt.set(id, interruptedAt);
-  const pressedTwice = new Set<string>();
 
-  // Poll to the ceiling. Do NOT try to finish early on quiet: codex says nothing
-  // for ~250ms after the interrupt and then prints its whole shutdown at once, so
-  // silence is what it looks like *before* it speaks, not after. Two heuristics
-  // died on that — settling when detections stopped arriving (exited +219ms) and
-  // settling when output stopped arriving (exited +160ms) — both mistaking the
-  // gap for completion.
-  //
-  // Waiting is close to free now that every command is persisted the moment it is
-  // found: the only cost is budget taken from the later teardown steps, and those
-  // are precisely the ones whose data can be reconstructed. The one early exit
-  // that is safe is having nothing left to wait for.
-  const deadline = started + maxWaitMs;
-  while (Date.now() < deadline) {
-    await sleep(40);
-    scanPending();
-    if (pending().length === 0) break;
-
-    // Retry an uncaptured pane when it asks, or after both fallback clocks pass.
-    const elapsed = Date.now() - interruptedAt;
-    for (const id of pending()) {
-      const mark = ptyManager.getScrollbackReceived(id);
-      if (mark !== lastMark.get(id)) { lastMark.set(id, mark); lastGrewAt.set(id, Date.now()); }
-    }
-    const quietFor = (id: string) => Date.now() - (lastGrewAt.get(id) ?? interruptedAt);
-    const retry = pending().filter((id) => !pressedTwice.has(id)
-      && (asked.has(id)
-        || (elapsed >= BLIND_SECOND_PRESS_MS && quietFor(id) >= QUIET_BEFORE_RETRY_MS)));
-    if (retry.length > 0) {
-      const why = retry.some((id) => asked.has(id)) ? 'asked' : `silent past ${BLIND_SECOND_PRESS_MS}ms`;
-      retry.forEach((id) => pressedTwice.add(id));
-      log.info(`[recovery] second press for ${retry.length} pane(s) at +${elapsed}ms after ^C (${why})`);
-      await ptyManager.interrupt(retry);
-    }
-  }
-
-  const found = Object.keys(commands).length;
-  log.info(`[recovery] settled with ${found} command(s) across ${liveIds.length} live PTY(s) at +${Date.now() - started}ms`);
-  // A pane that yielded nothing is worth a line, but only its shape — never its
-  // output. Whether the interrupt produced *any* bytes separates "the ^C never
-  // landed" from "it ran and kept going", which is the fork that matters, and it
-  // is the one piece of this that can be logged forever: dumping the actual tail
-  // would write terminal output into a log file, which is precisely the
-  // disclosure this whole scope exists to remove.
-  for (const id of pending()) {
-    const after = ptyManager.getScrollbackReceived(id) - (startMark.get(id) ?? 0);
-    log.info(`[recovery]   no hint from ${id}: +${after} bytes since interrupt, asked=${asked.has(id)}, pressedTwice=${pressedTwice.has(id)}`);
-  }
+  await captureAgentRecovery({
+    // Exited PTYs are kept in the buffer map until `kill()`, and one can neither
+    // receive a `^C` nor ever yield a hint — including them would scan them on
+    // every tick and permanently defeat the capture's early exit.
+    liveIds: () => [...ptyManager.getBufferedPtys()].filter(([, e]) => e.alive).map(([id]) => id),
+    interrupt: (ids) => ptyManager.interrupt(ids),
+    receivedChars: (id) => ptyManager.getScrollbackReceived(id),
+    outputSince: (id, mark) => ptyManager.getScrollbackSince(id, mark),
+    onCommand: (id, command) => { commands[id] = command; persist(); },
+    log: { info: (message) => log.info(message), error: (message) => log.error(message) },
+  }, { maxWaitMs });
   // Nothing to write here: every command was persisted the moment it was found.
 }
 
@@ -333,12 +207,6 @@ const RECOVERY_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
  */
 let unclaimedRecovery: Record<string, string> | null = null;
 
-/** Null-prototype throughout, for the same reason the capture side is: these are
- *  keyed by arbitrary surface id, and on a plain literal an id of `constructor` or
- *  `toString` reads back as an inherited function while `__proto__` refuses to be
- *  stored at all. */
-const noCommands = (): Record<string, string> => Object.create(null);
-
 /**
  * Claim the recovery commands belonging to `paneIds` — `surfaceId -> invocation`
  * for the boot payload of one cold-starting webview.

From 13d9a0ab706b8b7b08dd93dc5d9870705cc13edb Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 9 Sep 2026 21:35:25 -0700
Subject: [PATCH 04/11] Give the sidecar an output mark, a recovery record, and
 its two messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`pty-core` gains the three primitives the shared capture machine needs:
`received`, a monotonic per-pane counter a replay trim never decrements (the
buffer's own `chars` is pinned at the cap on exactly the long-running agent pane
recovery exists for, so it is not a usable coordinate), `outputSince` clamped to
what the buffer still holds, and `liveIds`.

`recovery.cjs` joins the three bundles the sidecar requires, and `main.js`
answers `pty:captureRecovery` (begin, capture, report the count) and
`recovery:take` (claim, once). The record lives under `DORMOUSE_RECOVERY_DIR`.
The sidecar owns this rather than Rust because the replay buffers the detection
reads are here, its lifetime is exactly one activation so read-and-unlink has
one home, and the browser-dev harness gets the feature for free — which is why
the harness now passes its own per-run temp dir.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QBf4rQbwuxV6n6v7E3twYe
---
 .gitignore                                 |  1 +
 standalone/scripts/build-sidecar-proxy.mjs |  5 +-
 standalone/scripts/dev-agent-browser.mjs   |  6 +-
 standalone/sidecar/main.js                 | 45 ++++++++++++--
 standalone/sidecar/pty-core.js             | 47 +++++++++++++-
 standalone/sidecar/pty-core.test.js        | 71 ++++++++++++++++++++++
 6 files changed, 166 insertions(+), 9 deletions(-)

diff --git a/.gitignore b/.gitignore
index fbc49a524..082f78933 100644
--- a/.gitignore
+++ b/.gitignore
@@ -33,6 +33,7 @@ standalone/src-tauri/gen/
 standalone/dist/
 standalone/sidecar/dor-cli/
 standalone/sidecar/iframe-proxy.cjs
+standalone/sidecar/recovery.cjs
 standalone/sidecar/agent-browser-host.cjs
 standalone/sidecar/burrow.cjs
 # Kept beside it: a checkout that built before the Burrow rename still holds
diff --git a/standalone/scripts/build-sidecar-proxy.mjs b/standalone/scripts/build-sidecar-proxy.mjs
index 8b86f2b4e..bfe44813c 100644
--- a/standalone/scripts/build-sidecar-proxy.mjs
+++ b/standalone/scripts/build-sidecar-proxy.mjs
@@ -4,7 +4,9 @@
 //   - lib/src/host/iframe-proxy.ts        → sidecar/iframe-proxy.cjs
 //   - lib/src/host/agent-browser-host.ts  → sidecar/agent-browser-host.cjs
 //   - lib/src/host/remote/sidecar-entry.ts → sidecar/burrow.cjs
-// See docs/specs/dor-browser.md and docs/specs/remote-api.md.
+//   - lib/src/host/recovery.ts             → sidecar/recovery.cjs
+// See docs/specs/dor-browser.md, docs/specs/remote-api.md, and
+// docs/specs/standalone.md -> "Agent recovery".
 import { build } from 'esbuild';
 import { rm } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
@@ -26,6 +28,7 @@ const remoteSrc = resolveRemoteConnectSrc(process.env, 'sidecar');
 const bundles = [
   { entry: 'iframe-proxy.ts', out: 'iframe-proxy.cjs' },
   { entry: 'agent-browser-host.ts', out: 'agent-browser-host.cjs' },
+  { entry: 'recovery.ts', out: 'recovery.cjs' },
   {
     entry: 'remote/sidecar-entry.ts',
     out: 'burrow.cjs',
diff --git a/standalone/scripts/dev-agent-browser.mjs b/standalone/scripts/dev-agent-browser.mjs
index 2f32f3d27..0d651a7f8 100644
--- a/standalone/scripts/dev-agent-browser.mjs
+++ b/standalone/scripts/dev-agent-browser.mjs
@@ -241,10 +241,14 @@ function startSidecar() {
       DORMOUSE_CLI_JS: dorEntrypoint,
       DORMOUSE_CONTROL_TOKEN: controlToken,
       DORMOUSE_STATE_DIR: stateDir,
+      // The harness mirrors the persistence answer, so a reload here exercises
+      // the same agent-recovery record the app writes — under this run's own
+      // temp state, never the installed app's.
+      DORMOUSE_RECOVERY_DIR: stateDir,
     },
   });
   log(`sidecar pid=${sidecar.pid}`);
-  log(`burrow state dir: ${stateDir}`);
+  log(`burrow + recovery state dir: ${stateDir}`);
 
   createInterface({ input: sidecar.stdout }).on('line', (line) => {
     let msg;
diff --git a/standalone/sidecar/main.js b/standalone/sidecar/main.js
index 3fa735078..de43ace00 100644
--- a/standalone/sidecar/main.js
+++ b/standalone/sidecar/main.js
@@ -22,6 +22,10 @@ const { createAgentBrowserHost } = require('./agent-browser-host.cjs');
 // the relay socket, the enrollment, the ACL, and remote-api v1 — running next to
 // the PTYs it serves. See docs/specs/remote-api.md.
 const { createSidecarBurrow } = require('./burrow.cjs');
+// Same pattern again: lib/src/host/recovery.ts is the agent-recovery capture
+// machine (shared with the VS Code extension host) plus the single-use record
+// store. See docs/specs/standalone.md -> "Agent recovery".
+const { captureAgentRecovery, createRecoveryStore } = require('./recovery.cjs');
 
 const agentBrowser = createAgentBrowserHost({
   writeClipboardText: (text) => clipboard.writeClipboardText(text),
@@ -32,6 +36,14 @@ function send(event, data) {
   process.stdout.write(JSON.stringify({ event, data }) + '\n');
 }
 
+// stdout is the JSON-lines protocol channel, so every log line goes to stderr.
+const recoveryLog = { info: (m) => console.error(m), error: (m) => console.error(m) };
+
+// The record lives beside the session snapshots, under the state root Rust
+// picks (dev and the installed app get different ones). Without a directory the
+// store is memory-only and says so once.
+const recovery = createRecoveryStore(process.env.DORMOUSE_RECOVERY_DIR || undefined, { log: recoveryLog });
+
 const mgr = create((event, data) => {
   // Output goes through the host's parser — one per PTY, feeding the webview
   // and every attached Client from the same pass (docs/specs/terminal-escapes.md
@@ -128,11 +140,36 @@ function handleLine(line) {
       case 'pty:getCwd':  mgr.getCwd(data.id, data.requestId); break;
       case 'pty:getOpenPorts': mgr.getOpenPorts(data.id, data.requestId); break;
       case 'pty:getShells':  mgr.getShells(data.requestId); break;
-      // Reserved: no standalone caller yet — recovery capture ships for VS Code
-      // only, which reaches the same `pty-core` through its own `pty-host.js`
-      // rather than this route (docs/specs/vscode.md -> "Capturing agent
-      // recovery").
       case 'pty:interrupt': mgr.interrupt(data.ids, data.requestId); break;
+      // Quit teardown, first step: press ^C, detect each agent's resume
+      // invocation, and write the single-use record. Runs here rather than in
+      // Rust because the replay buffers the detection reads are here, this
+      // process's lifetime is exactly one activation, and the browser-dev
+      // harness gets the same answer for free.
+      case 'pty:captureRecovery':
+        respondAsync('recoveryDone', data.requestId, async () => {
+          recovery.beginCapture();
+          const count = await captureAgentRecovery({
+            liveIds: () => mgr.liveIds(),
+            // One press, and the caller decides about a second: `mgr.interrupt`
+            // writes synchronously, so the ack is immediate.
+            interrupt: async (ids) => { mgr.interrupt(ids); },
+            receivedChars: (id) => mgr.receivedChars(id),
+            outputSince: (id, mark) => mgr.outputSince(id, mark),
+            onCommand: (id, command) => recovery.record(id, command),
+            log: recoveryLog,
+          }, { ids: data.ids, maxWaitMs: data.timeout });
+          return { count };
+        });
+        break;
+      // Cold start: claim the invocations belonging to these panes. Destructive
+      // on the first call, so nothing can replay them.
+      case 'recovery:take':
+        send('recovery:commands', {
+          requestId: data.requestId,
+          commands: recovery.take(Array.isArray(data.paneIds) ? data.paneIds : []),
+        });
+        break;
       case 'pty:gracefulKillAll': mgr.gracefulKillAll(data.timeout, data.requestId); break;
       // The webview's resolved terminal theme, so the parser here can answer
       // OSC 10/11/12 (docs/specs/terminal-escapes.md → Supported OSCs).
diff --git a/standalone/sidecar/pty-core.js b/standalone/sidecar/pty-core.js
index fa762660b..209fabc96 100644
--- a/standalone/sidecar/pty-core.js
+++ b/standalone/sidecar/pty-core.js
@@ -1071,7 +1071,11 @@ module.exports.create = function create(send, ptyModule, { replay = false } = {}
   const helpers = new Map(); // id -> { parentId, command } for helper PTYs
   // Every spawned, unkilled PTY (exited ones included). Only the standalone host
   // asks for `replay`; VS Code's extension host keeps its own buffers.
-  const sessions = new Map(); // id -> { chunks: string[], chars: number }
+  // `chars` is what the buffer currently holds (a trim decrements it);
+  // `received` is everything ever received and is never decremented, so it is the
+  // only stable coordinate for marking a position in a pane's output
+  // (docs/specs/transport.md -> "Persisted session").
+  const sessions = new Map(); // id -> { chunks: string[], chars: number, received: number }
   const REPLAY_CHARS = 200000;
   const ptyShells = new Map(); // id -> resolved shell executable
   // Repaint restoration belongs to the PTY owner, where every local and remote
@@ -1133,7 +1137,7 @@ module.exports.create = function create(send, ptyModule, { replay = false } = {}
 
     cancelRepaint(id);
     ptys.set(id, p);
-    const session = { chunks: [], chars: 0 };
+    const session = { chunks: [], chars: 0, received: 0 };
     sessions.set(id, session);
     ptyShells.set(id, config.shell);
 
@@ -1141,6 +1145,7 @@ module.exports.create = function create(send, ptyModule, { replay = false } = {}
       if (replay && ptys.get(id) === p) {
         session.chunks.push(data);
         session.chars += data.length;
+        session.received += data.length;
         // Drop whole chunks off the front, then trim the head: O(chunk) per write.
         while (session.chunks.length > 1 && session.chars - session.chunks[0].length >= REPLAY_CHARS) session.chars -= session.chunks.shift().length;
         if (session.chars > REPLAY_CHARS) { session.chunks[0] = session.chunks[0].slice(session.chars - REPLAY_CHARS); session.chars = REPLAY_CHARS; }
@@ -1193,6 +1198,41 @@ module.exports.create = function create(send, ptyModule, { replay = false } = {}
     repaintTimers.set(id, timer);
   }
 
+  /** Ids that can still take input. An exited PTY leaves `ptys` in its `onExit`,
+   *  so this is exactly the live set the recovery capture must interrupt. */
+  function liveIds() {
+    return [...ptys.keys()];
+  }
+
+  /** A mark in the pane's output stream, cheap enough to take on every poll tick:
+   *  `received` is maintained exactly by the data handler, so a caller watching a
+   *  pane for growth pays nothing instead of a full `join()`. */
+  function receivedChars(id) {
+    const session = sessions.get(id);
+    return session ? session.received : 0;
+  }
+
+  /** The output received after a `receivedChars` mark, clamped to what the bounded
+   *  buffer still holds. Joins only the chunks that span the mark, so repeatedly
+   *  reading a pane's recent tail costs the tail, not the buffer. Eviction can have
+   *  carried the mark off the front; the oldest char still held is the furthest
+   *  back this can honestly answer. */
+  function outputSince(id, mark) {
+    const session = sessions.get(id);
+    if (!session) return '';
+    const oldestHeld = session.received - session.chars;
+    const wanted = session.received - Math.max(mark, oldestHeld);
+    if (wanted <= 0) return '';
+    const tail = [];
+    let held = 0;
+    for (let i = session.chunks.length - 1; i >= 0 && held < wanted; i--) {
+      tail.push(session.chunks[i]);
+      held += session.chunks[i].length;
+    }
+    const joined = tail.reverse().join('');
+    return held > wanted ? joined.slice(held - wanted) : joined;
+  }
+
   // Synchronous lifetime observation for the Burrow's atomic
   // subscribe-then-check. Natural exits delete the generation from `ptys`, and
   // a spawn under the same id installs the new generation before it can emit.
@@ -1351,5 +1391,6 @@ module.exports.create = function create(send, ptyModule, { replay = false } = {}
   }
 
   return { spawn, write, resize, hasPty, kill, killAll, list, context,
-    getCwd, getOpenPorts, interrupt, gracefulKillAll, getShells };
+    getCwd, getOpenPorts, interrupt, gracefulKillAll, getShells,
+    liveIds, receivedChars, outputSince };
 };
diff --git a/standalone/sidecar/pty-core.test.js b/standalone/sidecar/pty-core.test.js
index 1376acc79..fce5e44df 100644
--- a/standalone/sidecar/pty-core.test.js
+++ b/standalone/sidecar/pty-core.test.js
@@ -1480,3 +1480,74 @@ test('getOpenPortsForPid de-duplicates and sorts by port', () => {
 test('getOpenPortsForPid returns [] for a non-integer pid', () => {
   assert.deepEqual(getOpenPortsForPid(undefined, { platform: 'linux' }), []);
 });
+
+test('receivedChars counts everything ever received, past a replay-buffer trim', () => {
+  const listeners = {};
+  const writes = [];
+  const fakePty = {
+    pid: 1,
+    onData(handler) { listeners.data = handler; },
+    onExit(handler) { listeners.exit = handler; },
+    resize() {}, write(data) { writes.push(data); }, kill() {},
+  };
+  const mgr = create(() => {}, { spawn() { return fakePty; } }, { replay: true });
+  mgr.spawn('pane-1');
+
+  assert.equal(mgr.receivedChars('pane-1'), 0);
+  const mark = mgr.receivedChars('pane-1');
+  listeners.data('hello');
+  assert.equal(mgr.receivedChars('pane-1'), 5);
+  assert.equal(mgr.outputSince('pane-1', mark), 'hello');
+
+  // Overflow the 200k replay cap: the buffer trims, but the counter is the mark
+  // space and must not move backwards.
+  const before = mgr.receivedChars('pane-1');
+  for (let i = 0; i < 30; i++) listeners.data('x'.repeat(10_000));
+  const after = mgr.receivedChars('pane-1');
+  assert.equal(after, before + 300_000);
+  // What the trimmed buffer can honestly answer is clamped to what it holds; it
+  // can only be less than the pane printed, never stale bytes offered as fresh.
+  const since = mgr.outputSince('pane-1', before);
+  assert.ok(since.length <= 200_000, `held ${since.length}`);
+  assert.ok(since.length > 0);
+  assert.equal(since, 'x'.repeat(since.length));
+
+  // A mark at or past the head answers empty rather than replaying the tail.
+  assert.equal(mgr.outputSince('pane-1', after), '');
+  assert.equal(mgr.outputSince('pane-1', after + 10), '');
+  assert.equal(mgr.outputSince('unknown-pane', 0), '');
+  assert.equal(mgr.receivedChars('unknown-pane'), 0);
+});
+
+test('liveIds names every unexited PTY, and nothing after it exits', () => {
+  const listeners = {};
+  const fakePty = (id) => ({
+    pid: 1,
+    onData() {}, onExit(handler) { listeners[id] = handler; },
+    resize() {}, write() {}, kill() {},
+  });
+  let next = 'a';
+  const mgr = create(() => {}, { spawn() { return fakePty(next); } }, { replay: true });
+  next = 'a'; mgr.spawn('a');
+  next = 'b'; mgr.spawn('b');
+  assert.deepEqual(mgr.liveIds().sort(), ['a', 'b']);
+
+  listeners.a({ exitCode: 0, signal: undefined });
+  assert.deepEqual(mgr.liveIds(), ['b']);
+});
+
+test('outputSince returns nothing without a replay buffer', () => {
+  const listeners = {};
+  const fakePty = {
+    pid: 1,
+    onData(handler) { listeners.data = handler; },
+    onExit() {}, resize() {}, write() {}, kill() {},
+  };
+  // VS Code's host keeps its own buffers, so `replay` is off there and these
+  // readers have nothing to answer from.
+  const mgr = create(() => {}, { spawn() { return fakePty; } });
+  mgr.spawn('pane-1');
+  listeners.data('hello');
+  assert.equal(mgr.receivedChars('pane-1'), 0);
+  assert.equal(mgr.outputSince('pane-1', 0), '');
+});

From 030615e40e9ada9e4f3920ae58333a8bbccbb075 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 9 Sep 2026 21:38:19 -0700
Subject: [PATCH 05/11] Split the dev state root, sweep orphan temps, bridge
 agent recovery
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`capture_agent_recovery` and `take_recovery_commands` forward the two new
sidecar messages. Both are `#[tauri::command(async)]` because they reach the
blocking helper, which `sidecar_commands_are_async` now covers.

The boot-time `clear_session` is replaced by `sweep_orphan_session_temps`: once
standalone persists, deleting the snapshot at every launch is exactly wrong, but
a crash between the temp write and the rename still leaves a file nothing will
ever read or overwrite — and one written before Dormouse stopped storing
transcripts carries a transcript. The sweep derives its suffix through the real
writer so the two cannot drift.

`state_root` gives a debug build `app_data_dir/dev`. Dev and the installed app
resolve to the same `app_data_dir()` (it is keyed by the Tauri identifier), so
without the split a dev launch would restore the installed app's Workspaces and
the two would clobber one snapshot. The notepad archive and the Burrow state
directory stay shared — they are machine-local stores, not this build's copy of
the user's window. The sidecar gets the root as `DORMOUSE_RECOVERY_DIR`.

The quit phase budget goes to 14 s, staying clear of the webview's new 10 s
teardown ceiling.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QBf4rQbwuxV6n6v7E3twYe
---
 standalone/src-tauri/src/lib.rs | 263 ++++++++++++++++++++++++++------
 1 file changed, 213 insertions(+), 50 deletions(-)

diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index 83a4e2ee4..3c1f06bbe 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -81,9 +81,9 @@ struct QuitState {
 const QUIT_ACK_TIMEOUT_MS: u64 = 2_000;
 // Phase 3: per-phase budget once teardown is running. Each reported phase
 // (teardown, install) refreshes it, so it bounds a single stalled phase, not the
-// sum of all teardown work. Comfortably exceeds the webview's own 8 s teardown
+// sum of all teardown work. Comfortably exceeds the webview's own 10 s teardown
 // ceiling (docs/specs/standalone.md §Quit flow).
-const QUIT_PHASE_TIMEOUT_MS: u64 = 12_000;
+const QUIT_PHASE_TIMEOUT_MS: u64 = 14_000;
 const QUIT_POLL_STEP_MS: u64 = 500;
 
 fn quit_approved(app: &AppHandle) -> bool {
@@ -499,6 +499,52 @@ async fn pty_graceful_kill_all(
     Ok(())
 }
 
+// --- Agent recovery (docs/specs/standalone.md -> "Agent recovery") ------------
+//
+// Both commands are thin: the sidecar owns the capture machine and the record,
+// because the replay buffers the detection reads live there and its lifetime is
+// exactly one activation. Both are `(async)` because they reach the blocking
+// sidecar helper (see the INVARIANT above `request_from_sidecar_timeout`;
+// `sidecar_commands_are_async` enforces it).
+
+/// Interrupt the live PTYs and let the sidecar detect and record each agent's
+/// resume invocation. First step of the quit teardown: the hint exists only
+/// between the interrupt and the kill.
+#[tauri::command(async)]
+fn capture_agent_recovery(
+    state: tauri::State<'_, SidecarState>,
+    ids: Option<Vec<String>>,
+    timeout: u64,
+) -> Result<(), String> {
+    request_from_sidecar_timeout(
+        &state,
+        "pty:captureRecovery",
+        serde_json::json!({ "ids": ids, "timeout": timeout }),
+        // Margin for the round trip beyond the sidecar's own ceiling.
+        Duration::from_millis(timeout + 1500),
+    )?;
+    Ok(())
+}
+
+/// Claim the resume invocations belonging to `pane_ids`. Destructive on the
+/// sidecar's first call, so nothing can replay them.
+#[tauri::command(async)]
+fn take_recovery_commands(
+    state: tauri::State<'_, SidecarState>,
+    pane_ids: Vec<String>,
+) -> Result<JsonValue, String> {
+    let response = request_from_sidecar_timeout(
+        &state,
+        "recovery:take",
+        serde_json::json!({ "paneIds": pane_ids }),
+        Duration::from_secs(5),
+    )?;
+    Ok(response
+        .get("commands")
+        .cloned()
+        .unwrap_or_else(|| JsonValue::Object(JsonMap::new())))
+}
+
 // Stands up the loopback iframe proxy in the sidecar and returns the
 // IframeProxyResult JSON the webview's IframePanel expects. The proxy server is
 // the shared lib/src/host/iframe-proxy.ts; this only bridges the request.
@@ -753,8 +799,28 @@ fn app_data_dir(app: &AppHandle) -> Result<PathBuf, String> {
         .map_err(|e| format!("app_data_dir unavailable: {e}"))
 }
 
+/// Everything this build's own state lives under.
+///
+/// `app_data_dir()` is keyed by the Tauri identifier, so a `pnpm dev:standalone`
+/// run and the installed app resolve to the same directory: without this split a
+/// dev launch would restore the installed app's Workspaces and the two would
+/// clobber one another's snapshot. The notepad archive and the Burrow state
+/// directory stay shared — they are machine-local stores, not this build's copy
+/// of the user's window.
+fn state_root_from(app_data: PathBuf) -> PathBuf {
+    if cfg!(debug_assertions) {
+        app_data.join("dev")
+    } else {
+        app_data
+    }
+}
+
+fn state_root(app: &AppHandle) -> Result<PathBuf, String> {
+    Ok(state_root_from(app_data_dir(app)?))
+}
+
 fn sessions_dir(app: &AppHandle) -> Result<PathBuf, String> {
-    Ok(app_data_dir(app)?.join("sessions"))
+    Ok(state_root(app)?.join("sessions"))
 }
 
 // Window labels are app-controlled (e.g. "main"), but sanitize defensively so a
@@ -1009,20 +1075,50 @@ async fn save_session(window: tauri::Window, state: String) -> Result<(), String
     write_session_to(&sessions_dir(window.app_handle())?, window.label(), &state)
 }
 
-fn remove_session_from(dir: &Path, label: &str) -> Result<(), String> {
-    let snapshot = dir.join(session_file_name(label));
-    // The temp name comes from the writer, so changing the convention can never
-    // leave this sweep looking for a file `write_file_atomically` stopped making.
-    let tmp = temp_write_path(&snapshot);
-    let paths = [snapshot, tmp];
+/// The suffix `write_file_atomically` leaves on a session snapshot's temp
+/// sibling, derived through the real writer so changing the convention can never
+/// leave the sweep below looking for a name nothing makes any more.
+fn session_temp_suffix() -> String {
+    let name = session_file_name("probe");
+    temp_write_path(Path::new(&name))
+        .file_name()
+        .and_then(|n| n.to_str())
+        .and_then(|n| n.strip_prefix("probe"))
+        .map(str::to_owned)
+        .unwrap_or_else(|| ".json.tmp".to_string())
+}
+
+/// Delete every orphaned temp write in the sessions directory, at boot.
+///
+/// A crash between the temp write and the rename leaves a file `load_session`
+/// cannot see and nothing else will ever overwrite — and a snapshot written
+/// before Dormouse stopped storing transcripts carries one. Deleting is the
+/// point: those bytes have to leave the disk
+/// (docs/specs/transport.md -> "Retiring the transcripts already on disk").
+/// Never touches a live snapshot; the window that owns one rewrites it itself.
+fn sweep_orphan_session_temps(dir: &Path) -> Result<(), String> {
+    let suffix = session_temp_suffix();
+    let entries = match std::fs::read_dir(dir) {
+        Ok(entries) => entries,
+        // No sessions directory yet (a first launch) is the desired end state.
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(()),
+        Err(e) => return Err(format!("read sessions dir {}: {e}", dir.display())),
+    };
     let mut first_error = None;
-    for path in paths {
-        match std::fs::remove_file(&path) {
+    for entry in entries.flatten() {
+        let name = entry.file_name();
+        let Some(name) = name.to_str() else { continue };
+        if !name.ends_with(&suffix) {
+            continue;
+        }
+        match std::fs::remove_file(entry.path()) {
             Ok(()) => {}
-            // Already gone is the desired end state, not a failure.
             Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
             Err(e) if first_error.is_none() => {
-                first_error = Some(format!("remove session artifact {}: {e}", path.display()));
+                first_error = Some(format!(
+                    "remove orphaned session temp {}: {e}",
+                    entry.path().display()
+                ));
             }
             Err(_) => {}
         }
@@ -1030,18 +1126,6 @@ fn remove_session_from(dir: &Path, label: &str) -> Result<(), String> {
     first_error.map_or(Ok(()), Err)
 }
 
-/// Delete this window's snapshot and any orphaned temp write outright.
-///
-/// Deleting rather than blanking matters: a pre-upgrade snapshot carries a
-/// transcript, and the point of clearing it is that those bytes stop being on
-/// disk (docs/specs/transport.md -> "Retiring the transcripts already on disk").
-/// Overwriting with an empty string would also leave every reader of the store
-/// obliged to treat `""` as a distinct third state alongside present and absent.
-#[tauri::command]
-async fn clear_session(window: tauri::Window) -> Result<(), String> {
-    remove_session_from(&sessions_dir(window.app_handle())?, window.label())
-}
-
 // --- Notepad archive (docs/specs/notepad.md) ---------------------------------
 //
 // One machine-local archive per host, kept as `<app_data_dir>/notepad-archive-v1.json`
@@ -1608,6 +1692,32 @@ fn burrow_state_dir(app: &AppHandle) -> Option<String> {
     Some(dir.to_string_lossy().into_owned())
 }
 
+/// Where the sidecar writes the single-use agent-recovery record. Under the
+/// state root, so a dev run never consumes the installed app's. Created here so
+/// a first launch hands the sidecar a directory that exists; owner-only for the
+/// same reason the Burrow's is — the record holds command lines the user typed,
+/// and a unix mode is a silent no-op on Windows.
+fn recovery_state_dir(app: &AppHandle) -> Option<String> {
+    let dir = match state_root(app) {
+        Ok(dir) => dir,
+        Err(e) => {
+            append_log(format!("[recovery] state root unavailable: {e}"));
+            return None;
+        }
+    };
+    if let Err(e) = create_dir_all(&dir) {
+        append_log(format!("[recovery] create state dir: {e}"));
+        return None;
+    }
+    if let Err(e) = restrict_to_owner(&dir, 0o700) {
+        append_log(format!(
+            "[recovery] WARNING could not restrict state dir {}: {e}",
+            dir.display()
+        ));
+    }
+    Some(dir.to_string_lossy().into_owned())
+}
+
 fn start_sidecar(app: &AppHandle) -> Result<SidecarState, String> {
     let manifest_dir = Path::new(env!("CARGO_MANIFEST_DIR"));
     let sidecar_path = resolve_sidecar_path(app.path().resource_dir().ok(), manifest_dir);
@@ -1616,6 +1726,7 @@ fn start_sidecar(app: &AppHandle) -> Result<SidecarState, String> {
     let dor_node_path = resolve_dor_node_path(&node_path, app);
     let dor_control_token = dor_control_token();
     let state_dir = burrow_state_dir(app);
+    let recovery_dir = recovery_state_dir(app);
     append_log(format!(
         "[sidecar] resolved script: {}",
         sidecar_path.display()
@@ -1634,6 +1745,10 @@ fn start_sidecar(app: &AppHandle) -> Result<SidecarState, String> {
         "[burrow] state dir: {}",
         state_dir.as_deref().unwrap_or("(none)")
     ));
+    append_log(format!(
+        "[recovery] state dir: {}",
+        recovery_dir.as_deref().unwrap_or("(none)")
+    ));
 
     let mut wrap = CommandWrap::with_new(&node_path, |c| {
         c.arg(&sidecar_path)
@@ -1643,6 +1758,10 @@ fn start_sidecar(app: &AppHandle) -> Result<SidecarState, String> {
             .env("DORMOUSE_CLI_JS", &dor_cli_paths.entrypoint)
             .env("DORMOUSE_CONTROL_TOKEN", &dor_control_token)
             .env("DORMOUSE_STATE_DIR", state_dir.as_deref().unwrap_or(""))
+            .env(
+                "DORMOUSE_RECOVERY_DIR",
+                recovery_dir.as_deref().unwrap_or(""),
+            )
             .stdin(Stdio::piped())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
@@ -1865,6 +1984,19 @@ pub fn run() {
             // Quit-interception state (docs/specs/standalone.md §Quit flow).
             app.manage(QuitState::default());
 
+            // A crash between a snapshot's temp write and its rename leaves a
+            // file nothing will ever read or overwrite; one written before
+            // Dormouse stopped storing transcripts carries one
+            // (docs/specs/standalone.md §Persistence). Never fatal.
+            match sessions_dir(app.handle()) {
+                Ok(dir) => {
+                    if let Err(e) = sweep_orphan_session_temps(&dir) {
+                        append_log(format!("[session] {e}"));
+                    }
+                }
+                Err(e) => append_log(format!("[session] {e}")),
+            }
+
             // Serializes this process's notepad-archive access (§Notepad
             // archive); the revision itself is read off the stored bytes and
             // the cross-process exclusion is a lock file, so there is no
@@ -1893,6 +2025,8 @@ pub fn run() {
             pty_context,
             pty_get_open_ports,
             pty_graceful_kill_all,
+            capture_agent_recovery,
+            take_recovery_commands,
             iframe_create_proxy_url,
             pty_request_init,
             dor_control_response,
@@ -1909,7 +2043,6 @@ pub fn run() {
             read_update_log,
             load_session,
             save_session,
-            clear_session,
             load_notepad_archive,
             save_notepad_archive,
             reset_notepad_archive,
@@ -1951,9 +2084,10 @@ pub fn run() {
 mod tests {
     use super::{
         find_node_binary, notepad_archive_lock_path, read_notepad_archive_from, read_session_from,
-        remove_session_from, reset_notepad_archive_at, resolve_dor_cli_paths, resolve_sidecar_path,
-        session_file_name, strip_windows_verbatim_prefix, write_notepad_archive_to,
-        write_session_to, NOTEPAD_ARCHIVE_FILE,
+        reset_notepad_archive_at, resolve_dor_cli_paths, resolve_sidecar_path, session_file_name,
+        session_temp_suffix, state_root_from, strip_windows_verbatim_prefix,
+        sweep_orphan_session_temps, temp_write_path, write_notepad_archive_to, write_session_to,
+        NOTEPAD_ARCHIVE_FILE,
     };
     use std::fs;
     use std::path::{Path, PathBuf};
@@ -2416,43 +2550,72 @@ mod tests {
     }
 
     #[test]
-    fn clearing_a_session_removes_the_file_and_leaves_other_windows_alone() {
-        let dir = TempDir::new("sessions-clear");
+    fn sweep_orphan_session_temps_removes_only_temps() {
+        let dir = TempDir::new("sessions-sweep");
         write_session_to(dir.path(), "main", r#"{"v":1,"who":"main"}"#).unwrap();
         write_session_to(dir.path(), "win-2", r#"{"v":1,"who":"win-2"}"#).unwrap();
-        fs::write(dir.path().join("main.json.tmp"), b"main transcript").unwrap();
-        fs::write(dir.path().join("win-2.json.tmp"), b"win-2 transcript").unwrap();
+        // What a crash between the temp write and the rename leaves behind. A
+        // pre-persistence one carries a transcript, and the point of the sweep is
+        // that those bytes leave the disk.
+        fs::write(dir.path().join("main.json.tmp"), b"legacy transcript").unwrap();
+        fs::write(dir.path().join("win-2.json.tmp"), b"legacy transcript").unwrap();
+        // Not ours: a sibling store's file must survive untouched.
+        fs::write(dir.path().join("notes.txt"), b"keep me").unwrap();
 
-        remove_session_from(dir.path(), "main").unwrap();
+        sweep_orphan_session_temps(dir.path()).unwrap();
 
-        // Absent, not blank: a pre-upgrade snapshot carries a transcript, and the
-        // point of clearing is that those bytes leave the disk.
-        assert_eq!(read_session_from(dir.path(), "main").unwrap(), None);
-        assert!(!dir.path().join("main.json").exists());
         assert!(!dir.path().join("main.json.tmp").exists());
+        assert!(!dir.path().join("win-2.json.tmp").exists());
+        // Every live snapshot is left exactly as it was — the window that owns
+        // one rewrites it itself.
+        assert_eq!(
+            read_session_from(dir.path(), "main").unwrap().as_deref(),
+            Some(r#"{"v":1,"who":"main"}"#),
+        );
         assert_eq!(
             read_session_from(dir.path(), "win-2").unwrap().as_deref(),
             Some(r#"{"v":1,"who":"win-2"}"#),
         );
-        assert!(dir.path().join("win-2.json.tmp").exists());
+        assert!(dir.path().join("notes.txt").exists());
     }
 
     #[test]
-    fn clearing_an_orphaned_temp_session_removes_it() {
-        let dir = TempDir::new("sessions-clear-orphaned-temp");
-        let tmp = dir.path().join("main.json.tmp");
-        fs::write(&tmp, b"legacy transcript").unwrap();
-
-        remove_session_from(dir.path(), "main").unwrap();
+    fn sweeping_an_absent_sessions_directory_succeeds() {
+        // A first launch has no sessions directory yet; that is the desired end
+        // state, not an error.
+        let dir = TempDir::new("sessions-sweep-missing");
+        assert!(sweep_orphan_session_temps(&dir.path().join("nope")).is_ok());
+    }
 
-        assert!(!tmp.exists());
+    /// The sweep's suffix comes from the writer, so the two can never drift.
+    #[test]
+    fn session_temp_suffix_matches_what_the_writer_leaves() {
+        assert_eq!(session_temp_suffix(), ".json.tmp");
+        assert_eq!(
+            temp_write_path(Path::new(&session_file_name("main")))
+                .file_name()
+                .unwrap()
+                .to_str()
+                .unwrap(),
+            format!("main{}", session_temp_suffix()),
+        );
     }
 
+    /// A dev build and the installed app share one `app_data_dir()`, so this
+    /// split is what keeps a `pnpm dev:standalone` run from restoring the
+    /// installed app's Workspaces and clobbering its snapshot.
     #[test]
-    fn clearing_an_absent_session_succeeds() {
-        // Already gone is the desired end state; a first launch must not error.
-        let dir = TempDir::new("sessions-clear-missing");
-        assert!(remove_session_from(dir.path(), "main").is_ok());
+    fn dev_and_installed_state_roots_are_separate() {
+        let app_data = PathBuf::from("/app-data");
+        let root = state_root_from(app_data.clone());
+        if cfg!(debug_assertions) {
+            assert_eq!(root, app_data.join("dev"));
+        } else {
+            assert_eq!(root, app_data);
+        }
+        // The notepad archive is a sibling of app_data, never under the root, so
+        // dev and the installed app keep sharing it.
+        assert_ne!(root.join("sessions"), app_data.join(NOTEPAD_ARCHIVE_FILE));
     }
 
     #[test]

From a0f72f513700e5921fb6486dff3560b7de4f30f8 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 9 Sep 2026 21:45:05 -0700
Subject: [PATCH 06/11] Persist standalone window state and restore per
 Workspace
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both adapters persist: `PERSIST_SESSION` is gone, the boot-time blob deletion
with it (Rust's orphan-temp sweep is what retires the transcripts already on
disk). `getWindowState` is the boot reader; `getState` answers nothing, because
the blob is a Window and every shared reader of `getState` wants a bare Session.
`init()` also claims the agent-recovery record for the panes it is about to
restore, so `getRecoveryCommands` is a synchronous answer by the time the cold
restore asks.

`main.tsx` rebuilds the Window: seed the aggregator, install the Workspaces,
install the writer, then plan each Workspace off one `collectLivePtys`. Reload
and relaunch are the same path with a different live list — on a reload the PTYs
partition by saved pane id and every Workspace resumes over its own; on a
relaunch the list is empty and every Workspace cold-restores into fresh shells
at its saved cwds, with nothing replayed. A live PTY no Workspace names goes to
the active one.

The quit teardown captures agent recovery first (the hint exists only between
the interrupt and the kill) and flushes the Window blob after the final
per-Workspace save; the ceiling goes to 10 s. A failed capture cannot abort the
save behind it.

Deviation from the plan: `gracefulKillPtys(ids?)` is not introduced. Nothing in
this stage kills a subset, and neither Rust nor the sidecar can honor an id
list yet, so the argument would be silently ignored. Multi-window adds it with
its own half.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QBf4rQbwuxV6n6v7E3twYe
---
 lib/src/App.tsx                               | 10 +-
 lib/src/components/WorkspaceWindow.tsx        | 20 ++--
 lib/src/components/wall/wall-types.ts         | 13 ++-
 standalone/scripts/dev-agent-browser.mjs      |  9 +-
 .../src/browser-sidecar-adapter.test.ts       | 47 +++++----
 standalone/src/browser-sidecar-adapter.ts     | 56 +++++++----
 standalone/src/main.tsx                       | 80 +++++++++++++--
 standalone/src/quit.test.ts                   | 35 ++++++-
 standalone/src/quit.ts                        | 19 ++--
 standalone/src/tauri-adapter.test.ts          | 75 ++++++++++++--
 standalone/src/tauri-adapter.ts               | 97 +++++++++++--------
 11 files changed, 344 insertions(+), 117 deletions(-)

diff --git a/lib/src/App.tsx b/lib/src/App.tsx
index 068c493fa..e523e9568 100644
--- a/lib/src/App.tsx
+++ b/lib/src/App.tsx
@@ -2,7 +2,7 @@ import { Component, type ReactNode } from "react";
 import { Wall } from "./components/Wall";
 import { WorkspaceWindow } from "./components/WorkspaceWindow";
 import { ThemeDebuggerGlobal } from "./components/ThemeDebugger";
-import type { WallBootProps } from "./components/wall/wall-types";
+import type { WallBootPlans, WallBootProps } from "./components/wall/wall-types";
 
 class ErrorBoundary extends Component<{ children: ReactNode }, { error: Error | null }> {
   state: { error: Error | null } = { error: null };
@@ -28,6 +28,7 @@ export default function App({
   dialogHost,
   enableBurrow,
   multiWorkspace = false,
+  initialPlans,
   ...boot
 }: WallBootProps & {
   baseboardNotice?: ReactNode;
@@ -37,11 +38,14 @@ export default function App({
    *  standalone host sets it; VS Code and the website playground mount a bare
    *  Wall (docs/specs/layout.md → "Workspaces"). */
   multiWorkspace?: boolean;
+  /** One boot record per Workspace; `multiWorkspace` only. */
+  initialPlans?: WallBootPlans;
 }) {
-  const Shell = multiWorkspace ? WorkspaceWindow : Wall;
   return (
     <ErrorBoundary>
-      <Shell {...boot} baseboardNotice={baseboardNotice} dialogHost={dialogHost} enableBurrow={enableBurrow} />
+      {multiWorkspace
+        ? <WorkspaceWindow {...boot} initialPlans={initialPlans} baseboardNotice={baseboardNotice} dialogHost={dialogHost} enableBurrow={enableBurrow} />
+        : <Wall {...boot} baseboardNotice={baseboardNotice} dialogHost={dialogHost} enableBurrow={enableBurrow} />}
 
       <ThemeDebuggerGlobal />
     </ErrorBoundary>
diff --git a/lib/src/components/WorkspaceWindow.tsx b/lib/src/components/WorkspaceWindow.tsx
index 3a1ca96ac..4461d023a 100644
--- a/lib/src/components/WorkspaceWindow.tsx
+++ b/lib/src/components/WorkspaceWindow.tsx
@@ -4,7 +4,7 @@ import { Wall } from './Wall';
 import { listWallHandles } from './wall/wall-handles';
 import { getPlatform } from '../lib/platform';
 import { getWorkspacesSnapshot, subscribeToWorkspaces } from '../lib/workspace-store';
-import type { WallBootProps } from './wall/wall-types';
+import type { WallBootPlans, WallBootProps } from './wall/wall-types';
 
 /**
  * One Window's Workspaces: a mounted `<Wall>` each, all in the same grid cell so
@@ -16,17 +16,23 @@ export function WorkspaceWindow({
   baseboardNotice,
   dialogHost,
   enableBurrow,
+  initialPlans,
   ...boot
 }: WallBootProps & {
   baseboardNotice?: ReactNode;
   dialogHost?: ReactNode;
   enableBurrow?: boolean;
+  /** One record per Workspace, from the restored Window. Takes precedence over
+   *  the single-record props, which stay for the compositions that restore one
+   *  Session (stories, the website playground). */
+  initialPlans?: WallBootPlans;
 }) {
   const { workspaces, activeId } = useSyncExternalStore(subscribeToWorkspaces, getWorkspacesSnapshot);
-  // The boot record belongs to the Workspace that was active at first render.
-  // Every Workspace created later gets no boot props, so its Wall takes Lath's
-  // fresh branch and spawns exactly one default-shell pane.
+  // Without per-Workspace plans the single boot record belongs to the Workspace
+  // that was active at first render. Either way a Workspace with no record takes
+  // Lath's fresh branch and spawns exactly one default-shell pane.
   const bootWorkspaceIdRef = useRef(activeId);
+  const plansRef = useRef(initialPlans);
 
   // The Window, not each Wall, answers the host's flush request: the adapter
   // completes on the FIRST notification, so a per-Wall answer would let a quit
@@ -50,7 +56,9 @@ export function WorkspaceWindow({
     >
       {workspaces.map((workspace) => {
         const isActive = workspace.id === activeId;
-        const isBoot = workspace.id === bootWorkspaceIdRef.current;
+        const plan = plansRef.current
+          ? plansRef.current[workspace.id] ?? {}
+          : workspace.id === bootWorkspaceIdRef.current ? boot : {};
         return (
           <div
             key={workspace.id}
@@ -66,7 +74,7 @@ export function WorkspaceWindow({
             )}
           >
             <Wall
-              {...(isBoot ? boot : {})}
+              {...plan}
               workspaceId={workspace.id}
               active={isActive}
               baseboardNotice={isActive ? baseboardNotice : undefined}
diff --git a/lib/src/components/wall/wall-types.ts b/lib/src/components/wall/wall-types.ts
index b7834404d..bcabd8af5 100644
--- a/lib/src/components/wall/wall-types.ts
+++ b/lib/src/components/wall/wall-types.ts
@@ -1,6 +1,6 @@
 import type { SurfaceKind } from 'dor/commands/types';
 import type { BrowserDisplayMode } from './agent-browser-screen';
-import type { PersistedDoor, PersistedSurfaceRefs } from '../../lib/session-types';
+import type { PersistedDoor, PersistedSurfaceRefs, WorkspaceId } from '../../lib/session-types';
 
 /** A minimized Surface's baseboard chip, at RUNTIME: an identity plus the Lath
  *  restore `token` that says where it goes back. Deliberately carries no
@@ -48,9 +48,8 @@ export type DoorAfterRestoreAction =
 
 /**
  * The restored record a Wall boots from, passed through unchanged by every
- * composition above it. Only the Workspace whose id was captured at first render
- * receives one; every other Wall takes Lath's fresh branch
- * (docs/specs/layout.md → "Workspaces").
+ * composition above it. A Wall with none takes Lath's fresh branch and spawns
+ * one default-shell pane (docs/specs/layout.md → "Workspaces").
  */
 export interface WallBootProps {
   initialPaneIds?: string[];
@@ -60,6 +59,12 @@ export interface WallBootProps {
   initialSurfaceRefsNext?: number;
 }
 
+/** One boot record per Workspace, keyed by Workspace id — what a Window restores
+ *  from, since every Workspace comes back over its own Session
+ *  (docs/specs/layout.md → "Session persistence"). A Workspace with no entry
+ *  boots fresh. */
+export type WallBootPlans = Record<WorkspaceId, WallBootProps>;
+
 export type WallEvent =
   | { type: 'modeChange'; mode: WallMode }
   | { type: 'zoomChange'; zoomed: boolean }
diff --git a/standalone/scripts/dev-agent-browser.mjs b/standalone/scripts/dev-agent-browser.mjs
index 0d651a7f8..92c621124 100644
--- a/standalone/scripts/dev-agent-browser.mjs
+++ b/standalone/scripts/dev-agent-browser.mjs
@@ -143,6 +143,12 @@ const invokeMap = {
   agent_browser_open: ({ url, headed, binaryPath }) => requestSidecar('agentBrowser:open', { url, headed, binaryPath }, 'agentBrowser:result', (data) => data.result, 30000),
   agent_browser_pop_out: ({ session, url, rect, binaryPath }) => requestSidecar('agentBrowser:popOut', { session, url, rect, binaryPath }, 'agentBrowser:result', (data) => data.result, 30000),
   agent_browser_pop_in: ({ session, url, binaryPath }) => requestSidecar('agentBrowser:popIn', { session, url, binaryPath }, 'agentBrowser:result', (data) => data.result, 30000),
+  // Agent recovery (docs/specs/standalone.md -> "Agent recovery"). The harness
+  // mirrors the persistence answer, so it captures and claims exactly as Rust
+  // does; the sidecar half is identical.
+  capture_agent_recovery: ({ ids, timeout }) =>
+    requestSidecar('pty:captureRecovery', { ids, timeout }, 'recoveryDone', (data) => data, (timeout ?? 1300) + 1500),
+  recovery_take: ({ paneIds }) => requestSidecar('recovery:take', { paneIds }, 'recovery:commands', (data) => data),
 };
 
 async function readJson(req) {
@@ -248,7 +254,8 @@ function startSidecar() {
     },
   });
   log(`sidecar pid=${sidecar.pid}`);
-  log(`burrow + recovery state dir: ${stateDir}`);
+  log(`burrow state dir: ${stateDir}`);
+  log(`recovery state dir: ${stateDir}`);
 
   createInterface({ input: sidecar.stdout }).on('line', (line) => {
     let msg;
diff --git a/standalone/src/browser-sidecar-adapter.test.ts b/standalone/src/browser-sidecar-adapter.test.ts
index 9f94551b5..1dd0367c7 100644
--- a/standalone/src/browser-sidecar-adapter.test.ts
+++ b/standalone/src/browser-sidecar-adapter.test.ts
@@ -38,10 +38,16 @@ describe("BrowserSidecarAdapter capability surface", () => {
   });
 });
 
-// The harness must not persist Session state that production standalone drops
-// (docs/specs/standalone.md -> "Standalone persists no Session state").
+// The harness mirrors the shipped persistence answer, so a reload there
+// exercises what the app does (docs/specs/transport.md -> "The governing rule").
 describe("BrowserSidecarAdapter session persistence", () => {
   const KEY = "dormouse.browser-sidecar.session";
+  const session = { version: 3 as const, panes: [{ id: "pane-a", title: "A", cwd: "/a", untouched: false }] };
+  const windowBlob = {
+    version: 1 as const,
+    workspaces: [{ id: "ws-1", name: "One", session }],
+    activeWorkspaceId: "ws-1",
+  };
 
   it("reports the same persistsSession as TauriAdapter", () => {
     const harness: PlatformAdapter = new BrowserSidecarAdapter(
@@ -49,39 +55,44 @@ describe("BrowserSidecarAdapter session persistence", () => {
     );
     const tauri: PlatformAdapter = new TauriAdapter();
     expect(harness.persistsSession).toBe(tauri.persistsSession);
-    expect(harness.persistsSession).toBe(false);
+    expect(harness.persistsSession).toBe(true);
   });
 
-  it("does not write session state to localStorage", () => {
+  it("round-trips a Window through localStorage", () => {
+    localStorage.removeItem(KEY);
+    const adapter = new BrowserSidecarAdapter(new BrowserSidecarHost("http://localhost:1234"));
+    adapter.saveState(windowBlob);
+    expect(adapter.getWindowState()).toEqual(windowBlob);
+    // The shared `getState` readers want a bare Session and the blob is a Window,
+    // so it answers nothing; the boot reads `getWindowState`.
+    expect((adapter as PlatformAdapter).getState()).toBeNull();
     localStorage.removeItem(KEY);
-    const adapter: PlatformAdapter = new BrowserSidecarAdapter(
-      new BrowserSidecarHost("http://localhost:1234"),
-    );
-    adapter.saveState({ version: 3, panes: [], lathLayout: null });
-    expect(localStorage.getItem(KEY)).toBeNull();
   });
 
-  it("does not restore a stale blob left by an earlier run", () => {
-    localStorage.setItem(KEY, JSON.stringify({ version: 3, panes: [], lathLayout: null }));
-    const adapter: PlatformAdapter = new BrowserSidecarAdapter(
-      new BrowserSidecarHost("http://localhost:1234"),
-    );
-    expect(adapter.getState()).toBeNull();
+  it("wraps a pre-Window blob rather than dropping it", () => {
+    localStorage.setItem(KEY, JSON.stringify(session));
+    const adapter = new BrowserSidecarAdapter(new BrowserSidecarHost("http://localhost:1234"));
+    expect(adapter.getWindowState()?.workspaces.map((ws) => ws.session)).toEqual([session]);
     localStorage.removeItem(KEY);
   });
 
-  it("deletes a pre-gate blob on init", async () => {
-    localStorage.setItem(KEY, JSON.stringify({ version: 3, panes: [], lathLayout: null }));
+  it("claims the recovery commands for its saved panes during init", async () => {
+    localStorage.setItem(KEY, JSON.stringify(windowBlob));
     const host = new BrowserSidecarHost("http://localhost:1234");
     vi.spyOn(host, "init").mockResolvedValue(undefined);
     vi.spyOn(host, "onEvent").mockReturnValue(() => {});
+    const invoke = vi.spyOn(host, "invoke").mockResolvedValue({ commands: { "pane-a": "claude --continue" } });
     // Claim the console-forwarder flag so init() doesn't patch console.* on the
     // shared jsdom window for every later test in this file.
     (window as typeof window & { __DORMOUSE_BROWSER_CONSOLE_PATCHED__?: boolean })
       .__DORMOUSE_BROWSER_CONSOLE_PATCHED__ = true;
+
     const adapter = new BrowserSidecarAdapter(host);
     await adapter.init();
-    expect(localStorage.getItem(KEY)).toBeNull();
+
+    expect(invoke).toHaveBeenCalledWith("recovery_take", { paneIds: ["pane-a"] });
+    expect(adapter.getRecoveryCommands()).toEqual({ "pane-a": "claude --continue" });
+    localStorage.removeItem(KEY);
   });
 });
 
diff --git a/standalone/src/browser-sidecar-adapter.ts b/standalone/src/browser-sidecar-adapter.ts
index 163043c12..2918f9302 100644
--- a/standalone/src/browser-sidecar-adapter.ts
+++ b/standalone/src/browser-sidecar-adapter.ts
@@ -35,7 +35,7 @@ import type { AlertSettings } from "dormouse-lib/lib/alert-settings";
 import { normalizeExternalUri } from "dormouse-lib/lib/external-links";
 import { createMemoryNotepadArchivePort } from "dormouse-lib/lib/notepad/memory-archive-port";
 import { loadWindowState, saveWindowState } from "dormouse-lib/lib/window-persistence";
-import type { PersistedWindow } from "dormouse-lib/lib/session-types";
+import type { PersistedAlertState, PersistedWindow } from "dormouse-lib/lib/session-types";
 import {
   applyTerminalProtocolEvents,
   collectTerminalSemanticEvents,
@@ -103,10 +103,12 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
   }
 
   async init(): Promise<void> {
-    this.clearPersistedState();
     await this.host.init();
     this.unlistenHost = this.host.onEvent(({ event, data }) => this.handleHostEvent(event, data));
     this.installConsoleForwarder();
+    // Before `resumeOrRestore` runs, so the cold restore's synchronous read has
+    // an answer (see TauriAdapter.takeRecoveryCommands).
+    await this.takeRecoveryCommands();
   }
 
   shutdown(): void {
@@ -157,6 +159,38 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
     try { return await this.host.invoke("pty_get_cwd", { id }); } catch { return null; }
   }
 
+  /** See TauriAdapter: claimed once during `init()`, read synchronously by the
+   *  cold restore. */
+  private recoveryCommands: Record<string, string> = {};
+
+  getRecoveryCommands(): Record<string, string> {
+    return this.recoveryCommands;
+  }
+
+  private async takeRecoveryCommands(): Promise<void> {
+    const saved = this.getWindowState();
+    const paneIds = saved?.workspaces.flatMap((workspace) => workspace.session.panes.map((pane) => pane.id)) ?? [];
+    if (paneIds.length === 0) return;
+    try {
+      const result = await this.host.invoke<{ commands?: Record<string, string> }>("recovery_take", { paneIds });
+      this.recoveryCommands = result?.commands ?? {};
+    } catch (err) {
+      console.error("[browser-sidecar] recovery take failed:", err);
+    }
+  }
+
+  alertSeed(id: string, state: PersistedAlertState): void {
+    this.alertManager.seed(id, state);
+  }
+
+  async captureAgentRecovery(timeoutMs: number, ids?: string[]): Promise<void> {
+    try {
+      await this.host.invoke("capture_agent_recovery", { ids: ids ?? null, timeout: timeoutMs });
+    } catch (err) {
+      console.warn("[browser-sidecar] captureAgentRecovery failed; proceeding", err);
+    }
+  }
+
   async getOpenPorts(id: string): Promise<OpenPort[]> {
     try { return await this.host.invoke("pty_get_open_ports", { id }); } catch { return []; }
   }
@@ -273,16 +307,13 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
 
   private static STATE_KEY = 'dormouse.browser-sidecar.session';
 
-  // Mirrors TauriAdapter's gate (docs/specs/standalone.md -> "Standalone persists
-  // no Session state"); flip both flags together.
-  private static PERSIST_SESSION = false;
-
-  readonly persistsSession = BrowserSidecarAdapter.PERSIST_SESSION;
+  // The harness mirrors the shipped persistence answer, so a reload here
+  // exercises what the app does (docs/specs/transport.md -> "The governing rule").
+  readonly persistsSession = true;
 
   // See TauriAdapter: one `PersistedWindow` per window, in `localStorage` rather
   // than the Rust file store (docs/specs/transport.md).
   saveState(state: unknown): void {
-    if (!BrowserSidecarAdapter.PERSIST_SESSION) return;
     try { saveWindowState(localStorage, BrowserSidecarAdapter.STATE_KEY, state as PersistedWindow); }
     catch { console.error('[browser-sidecar] Failed to save session state'); }
   }
@@ -294,7 +325,6 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
   }
 
   getWindowState(): PersistedWindow | null {
-    if (!BrowserSidecarAdapter.PERSIST_SESSION) return null;
     try {
       return loadWindowState(localStorage, BrowserSidecarAdapter.STATE_KEY);
     } catch {
@@ -313,14 +343,6 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
   // adapter sets this. The shipped Tauri build owns its keyboard and does not.
   readonly browserReservesNotepadChord = true;
 
-  // Delete (not just ignore) pre-gate blobs: they carry transcripts and localStorage
-  // outlives the harness's per-run temp state dir.
-  private clearPersistedState(): void {
-    if (BrowserSidecarAdapter.PERSIST_SESSION) return;
-    try { localStorage.removeItem(BrowserSidecarAdapter.STATE_KEY); }
-    catch { /* private-mode storage: nothing to clear */ }
-  }
-
   private handleHostEvent(event: string, data: unknown): void {
     if (event === "pty:data") {
       // Already parsed by the sidecar, which owns the PTY; its events arrive as
diff --git a/standalone/src/main.tsx b/standalone/src/main.tsx
index 466843882..eb05010c0 100644
--- a/standalone/src/main.tsx
+++ b/standalone/src/main.tsx
@@ -3,7 +3,15 @@ import { createRoot } from "react-dom/client";
 import { setPlatform } from "dormouse-lib/lib/platform";
 import { installPeerSurfaceResponder } from "dormouse-lib/remote/burrow/peer-surfaces";
 import type { PlatformAdapter } from "dormouse-lib/lib/platform/types";
-import { resumeOrRestore } from "dormouse-lib/lib/reconnect";
+import { collectLivePtys, resumeOrRestoreFrom } from "dormouse-lib/lib/reconnect";
+import {
+  installWindowSessionWriter,
+  seedWindowSession,
+} from "dormouse-lib/lib/window-session-aggregator";
+import { setWorkspaces } from "dormouse-lib/lib/workspace-store";
+import { DEFAULT_WORKSPACE_ID } from "dormouse-lib/lib/session-types";
+import type { PersistedSession, PersistedWindow, WorkspaceId } from "dormouse-lib/lib/session-types";
+import type { WallBootPlans } from "dormouse-lib/components/wall/wall-types";
 import { seedShellStore } from "dormouse-lib/lib/shell-store";
 import { restoreActiveTheme } from "dormouse-lib/lib/themes";
 import App from "dormouse-lib/App";
@@ -124,7 +132,7 @@ async function bootstrap() {
   // omits `shell` and the sidecar resolves the OS default itself.
   seedShellStore(await shellsPromise);
 
-  const result = await resumeOrRestore(platform);
+  const initialPlans = await restoreWindow(platform);
 
   startUpdateCheck();
 
@@ -132,11 +140,7 @@ async function bootstrap() {
     <StrictMode>
       <AppBar />
       <App
-        initialPaneIds={result.paneIds}
-        restoredLathLayout={result.lathLayout}
-        initialDoors={result.doors}
-        initialSurfaceRefs={result.surfaceRefs}
-        initialSurfaceRefsNext={result.surfaceRefsNext}
+        initialPlans={initialPlans}
         baseboardNotice={<ConnectedUpdateBanner />}
         dialogHost={<QuitConfirmModalHost />}
         enableBurrow
@@ -145,4 +149,66 @@ async function bootstrap() {
     </StrictMode>,
   );
 }
+
+/** The adapters that persist a Window. Both standalone adapters answer this; the
+ *  shared `PlatformAdapter.getState` cannot, because the blob it stores is a
+ *  Window and every shared reader of `getState` wants a bare Session. */
+type WindowPersistingAdapter = PlatformAdapter & { getWindowState?(): PersistedWindow | null };
+
+/**
+ * Rebuild the Window: install its Workspaces, then plan each one's Session off a
+ * single view of the host's live PTYs (docs/specs/layout.md → "Session
+ * persistence").
+ *
+ * Reload and relaunch are the same code path with a different live list. On a
+ * reload the PTYs are still there and partition by saved pane id, so every
+ * Workspace resumes over its own; on a relaunch the list is empty and every
+ * Workspace cold-restores into fresh shells at its saved cwds, with nothing
+ * replayed because scrollback is never persisted.
+ */
+async function restoreWindow(platform: WindowPersistingAdapter): Promise<WallBootPlans> {
+  const saved = platform.getWindowState?.() ?? null;
+  // Before any Wall mounts: a Workspace's first save compares against its own
+  // record, and a snapshot taken mid-boot must not replace a restored Workspace
+  // with a blank one.
+  seedWindowSession(saved);
+  if (saved) {
+    setWorkspaces({
+      workspaces: saved.workspaces.map(({ id, name }) => ({ id, name })),
+      activeId: saved.activeWorkspaceId,
+    });
+  }
+  // After `setWorkspaces`, so installing does not immediately write back what was
+  // just read.
+  installWindowSessionWriter((window) => platform.saveState(window));
+
+  const live = await collectLivePtys(platform);
+  const restoring: Array<{ id: WorkspaceId; session: PersistedSession | null }> = saved
+    ? saved.workspaces.map((workspace) => ({ id: workspace.id, session: workspace.session }))
+    : [{ id: DEFAULT_WORKSPACE_ID, session: null }];
+  const activeId = saved?.activeWorkspaceId ?? DEFAULT_WORKSPACE_ID;
+
+  // A live PTY no saved Workspace names — a pane created inside the last save's
+  // debounce, or one left by a Workspace that is gone — goes to the active
+  // Workspace rather than being stranded with no Wall.
+  const named = new Set(restoring.flatMap(({ session }) => session?.panes.map((pane) => pane.id) ?? []));
+  const unowned = new Set(live.ptys.map((pty) => pty.id).filter((id) => !named.has(id)));
+
+  const plans: WallBootPlans = {};
+  for (const { id, session } of restoring) {
+    const result = resumeOrRestoreFrom(platform, live, {
+      savedSession: session,
+      ptyIds: new Set(session?.panes.map((pane) => pane.id) ?? []),
+      ...(id === activeId ? { claimUnowned: unowned } : {}),
+    });
+    plans[id] = {
+      initialPaneIds: result.paneIds,
+      restoredLathLayout: result.lathLayout,
+      initialDoors: result.doors,
+      initialSurfaceRefs: result.surfaceRefs,
+      initialSurfaceRefsNext: result.surfaceRefsNext,
+    };
+  }
+  return plans;
+}
 bootstrap();
diff --git a/standalone/src/quit.test.ts b/standalone/src/quit.test.ts
index a16ef2286..7ed5d3462 100644
--- a/standalone/src/quit.test.ts
+++ b/standalone/src/quit.test.ts
@@ -16,6 +16,7 @@ const mocks = vi.hoisted(() => ({
   archiveSurfaceNotes: vi.fn(async (_ids: readonly string[], _opts?: { signal?: AbortSignal }) => {}),
   notepadSurfaceIds: vi.fn(() => [] as string[]),
   removeSurface: vi.fn(),
+  flushWindowSession: vi.fn(async () => {}),
 }));
 
 vi.mock("@tauri-apps/api/core", () => ({ invoke: mocks.invoke }));
@@ -33,6 +34,11 @@ vi.mock("dormouse-lib/lib/notepad/notepad-store", () => ({
   notepadSurfaceIds: mocks.notepadSurfaceIds,
   removeSurface: mocks.removeSurface,
 }));
+// The aggregator's write step. Mocked for the same reason as the registry: what
+// this file tests is where it sits in the order.
+vi.mock("dormouse-lib/lib/window-session-aggregator", () => ({
+  flushWindowSession: mocks.flushWindowSession,
+}));
 vi.mock("./updater", () => ({
   hasPendingUpdate: mocks.hasPendingUpdate,
   installPendingUpdate: mocks.installPendingUpdate,
@@ -57,7 +63,7 @@ const oneNotedSurface = () => ["pane-a"];
 let quitRequested: (() => void) | null = null;
 
 // Drain the microtask-driven teardown chain (no real timers on the happy path —
-// withTimeout's 8s guard is cleared when the work wins).
+// withTimeout's 10s guard is cleared when the work wins).
 const settle = () => new Promise((r) => setTimeout(r, 0));
 
 // A fake adapter whose teardown steps append their name to `order` so the call
@@ -69,6 +75,7 @@ function fakeAdapter(order: string[] = [], overrides: Partial<Record<string, ()
       order.push(name);
     });
   return {
+    captureAgentRecovery: step("captureRecovery"),
     requestSessionFlush: step("flush"),
     gracefulKillAllPtys: step("gracefulKill"),
     drainSessionSaves: step("drain"),
@@ -116,12 +123,15 @@ describe("quit orchestrator", () => {
     expect(mocks.invoke).toHaveBeenCalledWith("quit_proceed");
   });
 
-  it("runs teardown steps flush → kill → flush → drain → install → proceed in order", async () => {
+  it("runs teardown steps capture → flush → kill → flush → window → drain → install → proceed in order", async () => {
     const order: string[] = [];
     mocks.invoke.mockImplementation(async (cmd: string) => {
       order.push(cmd);
       return undefined;
     });
+    mocks.flushWindowSession.mockImplementation(async () => {
+      order.push("flushWindow");
+    });
     mocks.hasPendingUpdate.mockReturnValue(true);
     mocks.installPendingUpdate.mockImplementation(async () => {
       order.push("install");
@@ -129,14 +139,17 @@ describe("quit orchestrator", () => {
 
     await triggerQuit(fakeAdapter(order));
 
-    // `quit_progress` marks each phase boundary (teardown start, install start)
-    // so Rust's watchdog budgets teardown and install separately.
+    // The capture is first: an agent's resume invocation exists only between the
+    // interrupt and the kill. `quit_progress` marks each phase boundary (teardown
+    // start, install start) so Rust's watchdog budgets them separately.
     expect(order).toEqual([
       "quit_ack",
       "quit_progress",
+      "captureRecovery",
       "flush",
       "gracefulKill",
       "flush",
+      "flushWindow",
       "drain",
       "quit_progress",
       "install",
@@ -144,6 +157,20 @@ describe("quit orchestrator", () => {
     ]);
   });
 
+  it("still saves and exits when the recovery capture rejects", async () => {
+    // Recovery is the one step whose data cannot be reconstructed, but losing it
+    // must never cost the save behind it.
+    const order: string[] = [];
+    const adapter = fakeAdapter(order, {
+      captureRecovery: () => Promise.reject(new Error("sidecar gone")),
+    });
+    await triggerQuit(adapter);
+
+    expect(order).toEqual(["flush", "gracefulKill", "flush", "drain"]);
+    expect(mocks.flushWindowSession).toHaveBeenCalled();
+    expect(mocks.invoke).toHaveBeenCalledWith("quit_proceed");
+  });
+
   it("skips install and its phase signal when no update is pending", async () => {
     mocks.hasPendingUpdate.mockReturnValue(false);
     await triggerQuit(fakeAdapter());
diff --git a/standalone/src/quit.ts b/standalone/src/quit.ts
index 2c6930b41..673da009e 100644
--- a/standalone/src/quit.ts
+++ b/standalone/src/quit.ts
@@ -3,6 +3,7 @@ import { listen } from "@tauri-apps/api/event";
 import { countRunningSessions } from "dormouse-lib/lib/terminal-registry";
 import { archiveSurfaceNotes } from "dormouse-lib/lib/notepad/close-coordinator";
 import { notepadSurfaceIds, removeSurface } from "dormouse-lib/lib/notepad/notepad-store";
+import { flushWindowSession } from "dormouse-lib/lib/window-session-aggregator";
 import type { TauriAdapter } from "./tauri-adapter";
 import { openQuitArchiveFailure } from "./quit-confirm-store";
 import { hasPendingUpdate, installPendingUpdate } from "./updater";
@@ -125,7 +126,7 @@ async function archiveThenTeardown(): Promise<void> {
 }
 
 // Ordering and rationale: docs/specs/standalone.md §Quit flow (Teardown
-// ordering). The 8s ceiling is belt-and-suspenders over the per-step bounds.
+// ordering). The 10s ceiling is belt-and-suspenders over the per-step bounds.
 // `quit_progress` tells Rust teardown has begun (ending the confirmation-wait
 // suspension) and marks each phase boundary so its watchdog gives teardown and
 // install separate budgets rather than one shared clock.
@@ -137,18 +138,20 @@ async function runQuitTeardown(): Promise<void> {
     if (adapter) {
       await withTimeout(
         (async () => {
-          // The two flushes are near-free while standalone persists nothing —
-          // `saveSession` returns immediately on `persistsSession: false`, so
-          // neither one runs a `getCwd` round trip. The shape is kept because
-          // the ordering is the load-bearing part and the workspaces-rollout
-          // scope turns persistence back on (docs/specs/layout.md -> `## Future`).
+          // Capture FIRST: an agent's resume invocation exists only between the
+          // interrupt and the kill, and it is the one thing here that cannot be
+          // reconstructed afterwards. Losing it must never cost the save behind
+          // it, so this step alone cannot abort the rest.
+          await adapter.captureAgentRecovery(1300).catch((err) =>
+            console.warn("[quit] agent recovery capture failed; proceeding", err));
           await adapter.requestSessionFlush(1500); // save while PTYs are alive
           await adapter.gracefulKillAllPtys(2000); // SIGTERM; wait for exits and final output
           await adapter.requestSessionFlush(1500); // final post-exit save
+          await flushWindowSession(); // the Walls' records become one Window blob
           await adapter.drainSessionSaves(2000); // last write reaches disk
         })(),
-        8000,
-        "[quit] teardown exceeded 8000ms; proceeding to exit",
+        10000,
+        "[quit] teardown exceeded 10000ms; proceeding to exit",
       );
     }
     // Install strictly after the completed final save. A fresh `quit_progress`
diff --git a/standalone/src/tauri-adapter.test.ts b/standalone/src/tauri-adapter.test.ts
index 09f63a061..3cc10e321 100644
--- a/standalone/src/tauri-adapter.test.ts
+++ b/standalone/src/tauri-adapter.test.ts
@@ -87,17 +87,80 @@ describe("TauriAdapter session-flush handshake", () => {
   });
 });
 
-describe("TauriAdapter legacy session cleanup", () => {
-  it("asks Rust to clear orphaned temp state when no main snapshot exists", async () => {
+// docs/specs/transport.md -> "The governing rule": standalone restores window
+// state, so nothing is deleted at boot and the record is claimed once.
+describe("TauriAdapter window persistence", () => {
+  const session = { version: 3 as const, panes: [{ id: "pane-a", title: "A", cwd: "/a", untouched: false }] };
+  const windowBlob = {
+    version: 1 as const,
+    workspaces: [{ id: "ws-1", name: "One", session }],
+    activeWorkspaceId: "ws-1",
+  };
+
+  /** Stub Rust with a per-command implementation and boot the adapter. */
+  async function booted(impl: (cmd: string, args?: Record<string, unknown>) => unknown) {
     const invoke = vi.mocked(rawInvoke);
     invoke.mockClear();
-    invoke.mockResolvedValue(undefined);
+    invoke.mockImplementation((async (cmd: string, args?: Record<string, unknown>) =>
+      impl(cmd, args)) as unknown as typeof rawInvoke);
     const adapter = new TauriAdapter();
-
     await adapter.init();
+    return { adapter, invoke };
+  }
+
+  it("persists, and never clears the snapshot at boot", async () => {
+    const { adapter, invoke } = await booted((cmd) => (cmd === "load_session" ? JSON.stringify(windowBlob) : undefined));
 
-    expect(invoke).toHaveBeenNthCalledWith(1, "load_session");
-    expect(invoke).toHaveBeenNthCalledWith(2, "clear_session");
+    expect(adapter.persistsSession).toBe(true);
+    expect(adapter.getWindowState()).toEqual(windowBlob);
+    expect(invoke.mock.calls.map(([cmd]) => cmd)).not.toContain("clear_session");
+    adapter.shutdown();
+  });
+
+  it("wraps a pre-Window blob as the one Workspace", async () => {
+    const { adapter } = await booted((cmd) => (cmd === "load_session" ? JSON.stringify(session) : undefined));
+    expect(adapter.getWindowState()?.workspaces.map((ws) => ws.session)).toEqual([session]);
+    adapter.shutdown();
+  });
+
+  it("claims the recovery commands for every saved pane, before restore reads them", async () => {
+    const { adapter, invoke } = await booted((cmd) => {
+      if (cmd === "load_session") return JSON.stringify(windowBlob);
+      if (cmd === "take_recovery_commands") return { "pane-a": "claude --continue" };
+      return undefined;
+    });
+
+    expect(invoke).toHaveBeenCalledWith("take_recovery_commands", { paneIds: ["pane-a"] });
+    // Synchronous by the time the cold restore asks, which is what `init()`
+    // completing before `resumeOrRestore` buys.
+    expect(adapter.getRecoveryCommands()).toEqual({ "pane-a": "claude --continue" });
+    adapter.shutdown();
+  });
+
+  it("restores without recovery when the record cannot be read", async () => {
+    const { adapter } = await booted((cmd) => {
+      if (cmd === "load_session") return JSON.stringify(windowBlob);
+      if (cmd === "take_recovery_commands") throw new Error("sidecar gone");
+      return undefined;
+    });
+    expect(adapter.getRecoveryCommands()).toEqual({});
+    adapter.shutdown();
+  });
+
+  it("asks for nothing when there are no saved panes", async () => {
+    const { adapter, invoke } = await booted(() => undefined);
+    expect(invoke.mock.calls.map(([cmd]) => cmd)).not.toContain("take_recovery_commands");
+    expect(adapter.getRecoveryCommands()).toEqual({});
+    adapter.shutdown();
+  });
+
+  it("captures agent recovery and proceeds when the capture fails", async () => {
+    const { adapter, invoke } = await booted((cmd) => {
+      if (cmd === "capture_agent_recovery") throw new Error("sidecar gone");
+      return undefined;
+    });
+    await expect(adapter.captureAgentRecovery(1300)).resolves.toBeUndefined();
+    expect(invoke).toHaveBeenCalledWith("capture_agent_recovery", { ids: null, timeout: 1300 });
     adapter.shutdown();
   });
 });
diff --git a/standalone/src/tauri-adapter.ts b/standalone/src/tauri-adapter.ts
index fd61fe0c2..99c671dd4 100644
--- a/standalone/src/tauri-adapter.ts
+++ b/standalone/src/tauri-adapter.ts
@@ -42,7 +42,7 @@ import type { AwaitHandle, AwaitOptions } from "dormouse-lib/lib/alert-manager";
 import type { AlertSettings } from "dormouse-lib/lib/alert-settings";
 import { normalizeExternalUri } from "dormouse-lib/lib/external-links";
 import { loadWindowState, saveWindowState } from "dormouse-lib/lib/window-persistence";
-import type { PersistedWindow } from "dormouse-lib/lib/session-types";
+import type { PersistedAlertState, PersistedWindow } from "dormouse-lib/lib/session-types";
 import { TauriSessionStore } from "./tauri-session-store";
 import { withTimeout } from "./with-timeout";
 import {
@@ -243,7 +243,29 @@ export class TauriAdapter implements PlatformAdapter {
       console.error("[tauri-adapter] load_session failed:", err);
     }
     this.sessionStore.hydrate(seed);
-    await this.clearLegacySessionState();
+    // The agent-recovery record is read here, at the same boot boundary and for
+    // the same reason as the session blob: `getRecoveryCommands` is synchronous
+    // because the cold restore reads it before React mounts.
+    await this.takeRecoveryCommands();
+  }
+
+  /**
+   * Claim the resume invocations the last teardown captured for the panes this
+   * Window is about to restore. Destructive in the sidecar on the first call, so
+   * a relaunch that gets this far can never replay them
+   * (docs/specs/transport.md -> "Consuming it").
+   */
+  private async takeRecoveryCommands(): Promise<void> {
+    const saved = this.getWindowState();
+    const paneIds = saved?.workspaces.flatMap((workspace) => workspace.session.panes.map((pane) => pane.id)) ?? [];
+    if (paneIds.length === 0) return;
+    try {
+      this.recoveryCommands = await rawInvoke<Record<string, string>>("take_recovery_commands", { paneIds }) ?? {};
+    } catch (err) {
+      // A record we could not read is one restore without auto-resume, never a
+      // failed boot.
+      console.error("[tauri-adapter] take_recovery_commands failed:", err);
+    }
   }
 
   shutdown(): void {
@@ -287,6 +309,33 @@ export class TauriAdapter implements PlatformAdapter {
     invoke("pty_kill", { id });
   }
 
+  /** Agent resume invocations captured at the last teardown, claimed once during
+   *  `init()` and read synchronously by the cold restore. */
+  private recoveryCommands: Record<string, string> = {};
+
+  getRecoveryCommands(): Record<string, string> {
+    return this.recoveryCommands;
+  }
+
+  /** Seed a cold-restored Surface's persisted TODO/alert; the manager lives here,
+   *  so the restore path is the only thing that can. */
+  alertSeed(id: string, state: PersistedAlertState): void {
+    this.alertManager.seed(id, state);
+  }
+
+  /**
+   * Interrupt the live PTYs so each agent prints its resume invocation, and let
+   * the sidecar record what it detects. Warn-and-proceed: a quit must never wedge
+   * on this (docs/specs/standalone.md -> "Agent recovery").
+   */
+  async captureAgentRecovery(timeoutMs: number, ids?: string[]): Promise<void> {
+    try {
+      await rawInvoke("capture_agent_recovery", { ids: ids ?? null, timeout: timeoutMs });
+    } catch (err) {
+      console.warn("[tauri-adapter] captureAgentRecovery failed; proceeding", err);
+    }
+  }
+
   async getCwd(id: string): Promise<string | null> {
     try {
       return await rawInvoke<string | null>("pty_get_cwd", { id });
@@ -593,29 +642,17 @@ export class TauriAdapter implements PlatformAdapter {
 
   private static STATE_KEY = 'dormouse.session';
 
-  // Standalone persists no Session state: quitting the app is a deliberate
-  // ending, and a crash captured nothing, so every launch starts fresh
-  // (docs/specs/transport.md -> "The governing rule").
-  //
-  // This is a gate at the adapter boundary, not a removal of the store. The
-  // plumbing below it — TauriSessionStore, the Rust temp-then-rename file store,
-  // the quit flush/drain ordering — is intact and still needed by the
-  // workspaces-rollout scope (docs/specs/layout.md -> `## Future`). Bringing
-  // VS Code-style restoration to standalone later also needs to reconcile
-  // the unconditional boot deletion in clearLegacySessionState and add capture
-  // to the existing quit teardown (flush -> kill -> flush -> drain).
-  private static PERSIST_SESSION = false;
-
   /**
    * Read by `saveSession`, which skips the whole record build — not just the
    * write — when a host persists nothing (`PlatformAdapter.persistsSession`).
+   * Standalone persists window state (`docs/specs/transport.md` ->
+   * "The governing rule").
    */
-  readonly persistsSession = TauriAdapter.PERSIST_SESSION;
+  readonly persistsSession = true;
 
   /** The aggregator's writer: one `PersistedWindow` per window
    *  (`docs/specs/transport.md` -> "Persisted session"). */
   saveState(state: unknown): void {
-    if (!TauriAdapter.PERSIST_SESSION) return;
     try {
       saveWindowState(this.sessionStore, TauriAdapter.STATE_KEY, state as PersistedWindow);
     } catch {
@@ -633,7 +670,6 @@ export class TauriAdapter implements PlatformAdapter {
 
   /** The persisted Window, read from the boot-seeded cache. */
   getWindowState(): PersistedWindow | null {
-    if (!TauriAdapter.PERSIST_SESSION) return null;
     try {
       return loadWindowState(this.sessionStore, TauriAdapter.STATE_KEY);
     } catch {
@@ -668,29 +704,4 @@ export class TauriAdapter implements PlatformAdapter {
     resetUnreadable: () => rawInvoke<void>("reset_notepad_archive"),
   };
 
-  /**
-   * Delete any pre-upgrade snapshot or orphaned temp write. Those carry
-   * transcripts, so ignoring the slot is not enough — the bytes have to leave the
-   * disk (docs/specs/transport.md -> "Retiring the transcripts already on disk").
-   * Called from init() after the store hydrates.
-   *
-   * Deletes the file through the Rust store that owns it rather than blanking the
-   * slot: a sentinel would leave the bytes in place until some later write, and
-   * would oblige every reader to treat `''` as a third state alongside present
-   * and absent.
-   */
-  private async clearLegacySessionState(): Promise<void> {
-    const hadReadableSnapshot = this.sessionStore.getItem(TauriAdapter.STATE_KEY) !== null;
-    try {
-      // Always ask Rust to clear: load_session cannot see a .json.tmp left by a
-      // crash before rename, but that file still contains the legacy transcript.
-      await rawInvoke<void>("clear_session");
-      this.sessionStore.hydrate(null);
-      if (hadReadableSnapshot) {
-        console.info('[tauri-adapter] Cleared legacy persisted session (transcripts are no longer stored)');
-      }
-    } catch (err) {
-      console.error('[tauri-adapter] Failed to clear legacy session state:', err);
-    }
-  }
 }

From da0aadaf14e30d990a9f0bac3d5dbd4c40392550 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 9 Sep 2026 22:00:10 -0700
Subject: [PATCH 07/11] Promote standalone persistence and agent recovery into
 the specs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

transport.md's governing rule reverses for standalone: window state is the app's
contract, so quit restores structure and auto-resumes agents, and the rationale
records why — the two objections to the old store were both about content
(transcripts, a WKWebView WAL) and both were already fixed. The persisted-session
types describe the aggregator as it now is: seeded at boot, one debounced writer,
a Workspace compared against its own record, a store change writing too. The
transcript-retirement bullet becomes the orphan-temp sweep.

standalone.md rewrites Persistence around the per-Workspace boot and the dev
state root, gains an Agent recovery subsection for the sidecar-owned record, and
its quit teardown puts the capture first with the new 10 s / 14 s budgets.

layout.md promotes standalone persistence out of the rollout ledger and states
the two rules it owns: publish to the aggregator, and mark dirty only for
Surfaces this Wall owns. vscode.md records that the capture machine is shared and
drops the workspaces-flag Future item. security-local.md, notepad.md, and
glossary.md follow.

Budgets ratcheted: layout 8400, notepad 3800, security-local 2600, standalone
4650, transport 4650, vscode 7400.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QBf4rQbwuxV6n6v7E3twYe
---
 docs/specs/auto-update.rationale.md    |   2 +-
 docs/specs/glossary.md                 |   2 +-
 docs/specs/layout.md                   |  13 +--
 docs/specs/notepad.md                  |   4 +-
 docs/specs/notepad.rationale.md        |   2 +-
 docs/specs/security-local.md           |  26 +++--
 docs/specs/security-local.rationale.md |   6 +-
 docs/specs/standalone.md               | 132 +++++++++++++++----------
 docs/specs/standalone.rationale.md     |  12 +--
 docs/specs/transport.md                |  37 ++++---
 docs/specs/transport.rationale.md      |  10 +-
 docs/specs/vscode.md                   |  20 ++--
 scripts/spec-word-budgets.json         |  12 +--
 standalone/src-tauri/src/lib.rs        |   6 +-
 14 files changed, 165 insertions(+), 119 deletions(-)

diff --git a/docs/specs/auto-update.rationale.md b/docs/specs/auto-update.rationale.md
index 6f1bb963f..2fd8b4b01 100644
--- a/docs/specs/auto-update.rationale.md
+++ b/docs/specs/auto-update.rationale.md
@@ -4,7 +4,7 @@
 
 ## Quit-time install
 
-**Why install runs last.** A Windows NSIS install force-kills the app the moment it starts, so starting it early interrupts teardown. This ordering originally protected persisted scrollback; standalone now persists no Session state. The retained save/drain hooks and their completion semantics are explained in `docs/specs/standalone.rationale.md` → Quit flow.
+**Why install runs last.** A Windows NSIS install force-kills the app the moment it starts, so starting it early interrupts teardown. This ordering originally protected persisted scrollback; what it protects now is the window's structure, which standalone does persist. The retained save/drain hooks and their completion semantics are explained in `docs/specs/standalone.rationale.md` → Quit flow.
 
 **Why Vite dev mode skips `install()`.** The updater resolves its replacement target from the current executable path, which in dev is the dev executable's directory, not a packaged bundle.
 
diff --git a/docs/specs/glossary.md b/docs/specs/glossary.md
index 10f7d78ca..06094a6b1 100644
--- a/docs/specs/glossary.md
+++ b/docs/specs/glossary.md
@@ -88,7 +88,7 @@ A Workspace's **union status** is its display projection of member Surfaces' Act
 
 ### Implementation status
 
-The Pane / Surface model, surface kinds, and the Workspace model are live; a Window still means one OS window, and `dormouse.flags.workspaces` still controls the stored Window wrapper (`docs/specs/layout.md` → Workspaces). Ledger: `docs/specs/layout.md` `## Future` (**Scope: workspaces-rollout**); this glossary does not track it.
+The Pane / Surface model, surface kinds, the Workspace model, and per-Workspace persistence are live; a Window still means one OS window (`docs/specs/layout.md` → Workspaces). Ledger: `docs/specs/layout.md` `## Future` (**Scope: workspaces-rollout**); this glossary does not track it.
 
 ## Roles
 
diff --git a/docs/specs/layout.md b/docs/specs/layout.md
index 2379d5f73..332f1304b 100644
--- a/docs/specs/layout.md
+++ b/docs/specs/layout.md
@@ -155,9 +155,9 @@ Each Wall renders one Workspace's Content (Lath layout) and Baseboard (doors). S
 
 **Create** adds a Workspace named `Workspace N`, makes it active, and gives its Wall no restored record, so Lath's fresh branch spawns one default-shell pane. **Close** confirms first when the Workspace holds touched Surfaces or running work, reusing the kill-confirm letter and key rule over the Window's content area, then routes every member Surface through the closure coordinator; **the last remaining Workspace cannot be closed** — there is always one active Workspace, as there is always one visible pane (corner case #5). **One close runs at a time for the whole Window**, with the count re-checked after the confirmation, so two of them cannot empty two Walls between them; **a close the store then refuses hands the Wall back its auto-spawn** rather than leaving it mounted and empty. **Rename** edits the Workspace `name` only — no Surface title, and not the per-pane inline rename. **Reorder** moves a tab in the strip and renumbers the positional `workspace:<n>` refs with it. **Every Workspace verb runs outside the strip**, which renders the rename editor and confirmation from a store, so a tab gesture and a command-mode key take one path.
 
-The union projection and its indicators are owned by `docs/specs/alert.md` → Workspace union; the strip that renders them by `docs/specs/standalone.md` → AppBar. Persisted containers are owned by `docs/specs/transport.md`; `dormouse.flags.workspaces` still selects the bare `PersistedSession` versus `PersistedWindow` stored format, and **both standalone adapters still disable session persistence**, so a relaunch restores one Workspace.
+The union projection and its indicators are owned by `docs/specs/alert.md` → Workspace union; the strip that renders them by `docs/specs/standalone.md` → AppBar. Persisted containers are owned by `docs/specs/transport.md`: standalone stores one `PersistedWindow` per window, so a relaunch restores every Workspace ([Session persistence](#session-persistence)).
 
-Source of truth: `WorkspaceWindow` in `lib/src/components/WorkspaceWindow.tsx`; `registerWallHandle` in `lib/src/components/wall/wall-handles.ts`; `closeAll` in `lib/src/components/Wall.tsx`; `requestWorkspaceClose` in `lib/src/components/wall/workspace-lifecycle.ts`; `createWorkspace` / `closeWorkspace` / `renameWorkspace` / `moveWorkspace` / `setActiveWorkspace` in `lib/src/lib/workspace-store.ts`; `getWorkspaceUiSnapshot` in `lib/src/lib/workspace-ui-store.ts`; `setWorkspaceSurfaces` in `lib/src/lib/workspace-surfaces.ts`; `PERSIST_SESSION` in `standalone/src/tauri-adapter.ts` and `standalone/src/browser-sidecar-adapter.ts`.
+Source of truth: `WorkspaceWindow` in `lib/src/components/WorkspaceWindow.tsx`; `registerWallHandle` in `lib/src/components/wall/wall-handles.ts`; `closeAll` in `lib/src/components/Wall.tsx`; `requestWorkspaceClose` in `lib/src/components/wall/workspace-lifecycle.ts`; `createWorkspace` / `closeWorkspace` / `renameWorkspace` / `moveWorkspace` / `setActiveWorkspace` in `lib/src/lib/workspace-store.ts`; `getWorkspaceUiSnapshot` in `lib/src/lib/workspace-ui-store.ts`; `setWorkspaceSurfaces` in `lib/src/lib/workspace-surfaces.ts`.
 
 What multi-window, per-Workspace persistence, and the `dor workspace` verbs still owe is staged in [Future](#future) — this spec's `## Future` is the single rollout ledger; other specs link here.
 
@@ -358,19 +358,21 @@ Three save triggers, in ascending urgency:
 
 `docs/specs/standalone.md` §Persistence owns the dirty-gating mechanism and the store-level identical-value backstop.
 
-Container shapes and the `dormouse.flags.workspaces` wrapping are `docs/specs/transport.md` → "Persisted session types" ([Workspaces](#workspaces)); VS Code persists one Workspace per webview (`WebviewView` / `WebviewPanel`).
+**Under a Workspace, a Wall publishes its record to the Window aggregator instead of the platform slot**, and compares each save against its own Workspace's previous record — container shapes and the aggregator's rules are `docs/specs/transport.md` → "Persisted session types" ([Workspaces](#workspaces)). **A Wall marks itself dirty only for Surfaces it owns**: both content stores are Window-global and name the Surface that changed, so an idle Workspace does not rebuild its record — a `getCwd` per pane — whenever another Workspace moves. VS Code persists one Workspace per webview (`WebviewView` / `WebviewPanel`).
 
 Snapshots are read through `readPersistedSession()`, which tolerates a stringified blob and logs-and-discards an unreadable one so malformed storage starts fresh rather than blocking startup (`docs/specs/transport.md` → "Persisted session types").
 
 Startup recovery is priority-based:
+**A Window plans once per Workspace off one live-PTY list**: `collectLivePtys` runs the single PTY-list round trip for the whole webview, and each Workspace takes the slice its own saved panes name, so one host answer restores N Workspaces (`docs/specs/standalone.md` → Persistence). A single-Wall host reaches the same behavior through `resumeOrRestore`.
+
 1. **Resume** (webview recreated, retained Live or Exited PTYs): request PTY list + replay data from the platform, `resumeTerminal()` each (500ms timeout). **Saved pane and door titles are seeded back via `setTerminalUserTitle()`** (`docs/specs/transport.md`), so persisted placeholder labels never replay as user pins. If the saved session covers every retained PTY, restore the saved Lath layout when its leaf set matches and reattach saved minimized items as doors. **Never fall through to cold restore just because the visible `paneIds` list is empty** — a wall whose retained sessions are all minimized is still a resume.
-2. **Restore** (app restart, cold start): the Wall's `seed` hydrates from the restored Lath layout, else falls to (3); `restoreTerminal()` per pane with its saved cwd and title. Browser surfaces are rebuilt from their persisted params instead.
+2. **Restore** (app restart, cold start): the Wall's `seed` hydrates from the restored Lath layout, else falls to (3); `restoreTerminal()` per pane with its saved cwd and title, plus the single-use agent resume invocation the host captured (`docs/specs/transport.md` → "Consuming it") and, on a host whose AlertManager lives in the webview, the pane's persisted TODO through `PlatformAdapter.alertSeed`. Browser surfaces are rebuilt from their persisted params instead.
 3. **Fallback/manual pane creation**: with no saved layout safely applicable, add panes as splits from the previous pane.
 4. **Empty state**: one new pane.
 
 Every PTY spawned by (2)–(4) uses the current default shell selection.
 
-Source of truth: `lib/src/components/wall/use-session-persistence.ts` (save triggers and flushes), `lib/src/lib/session-save.ts` (serialization), `lib/src/lib/reconnect.ts` (recovery priority).
+Source of truth: `lib/src/components/wall/use-session-persistence.ts` (save triggers and flushes), `lib/src/lib/session-save.ts` (serialization), `collectLivePtys` / `resumeOrRestoreFrom` in `lib/src/lib/reconnect.ts` (recovery priority), `restoreWindow` in `standalone/src/main.tsx` (the per-Workspace boot).
 
 ### Activity state
 
@@ -427,7 +429,6 @@ A store commit that empties the tree (last pane killed or minimized) triggers th
 
 **Scope: workspaces-rollout** — what the multi-Workspace feature still owes. Current implementation: [Workspaces](#workspaces). Persisted containers are owned by `docs/specs/transport.md`; union projection by `docs/specs/alert.md`. This ledger is the single home for what remains; other specs link here rather than restating it.
 
-- **Standalone persistence and agent recovery.** Every Workspace's record already reaches the Window collector, which has no writer, so nothing is stored and a relaunch restores one Workspace. Turning it on means seeding the collector at boot, debouncing and flushing its writes, adopting a restored `PersistedWindow` into the Workspace store, and lifting VS Code's agent-recovery capture into a host-agnostic module the sidecar bundles.
 - **Multiple OS windows.** PTY ownership routing in Rust, window lifecycle, tearing a Workspace out into its own window, dropping one onto another window, and restoring N windows. `WorkspaceStrip`'s `onDragOutsideWindow` / `onDropOnOtherWindow` and the router's `window:<n>` rejection are the seams; `WINDOW_REF` names the only Window this build addresses.
 - **`dor workspace` verbs.** `new` / `rename` / `close` / `switch`, plus `dor list --all` for cross-Workspace targeting and `workspace:<name>` as the stable handle beside today's positional `workspace:<n>`.
 
diff --git a/docs/specs/notepad.md b/docs/specs/notepad.md
index b035a4410..ae0ce3758 100644
--- a/docs/specs/notepad.md
+++ b/docs/specs/notepad.md
@@ -140,12 +140,14 @@ Source of truth: `archiveSurfaceNotes` in `lib/src/lib/notepad/close-coordinator
 
 **Archiving is a gate step before teardown**: after the running-work confirmation, or immediately on an all-idle quit, and **before the first `quit_progress`** (`docs/specs/standalone.md` → "Quit flow"; rationale). **It is bounded at 3 s.**
 
+**Standalone still archives at quit even though it now restores its windows** (`docs/specs/transport.md` → "The governing rule"): VS Code's live notes survive a Reload only through the extension host's in-memory mirror ([Live resume](#live-resume)), and quitting standalone leaves no such survivor.
+
 - **A failure or timeout leaves the quit pending in Rust**, whose phase-2 wait is unbounded for exactly this (`docs/specs/standalone.md` → "Quit flow"), and the dialog shows the error with **Cancel** (default) and **Quit anyway**, which discards the notes. **Only Cancel calls `quit_cancel`**: Quit anyway must reach teardown with the watchdog still armed.
 - **A timeout aborts the archive it stopped waiting for** ([Closure](#closure)).
 - **Must include Surfaces with pending batch IDs even after their last note is deleted**, both when archiving and discarding on Quit anyway; pinned by `standalone/src/quit-notepad.test.ts`.
 - **Teardown's own rule is untouched**: once teardown begins, no failing step prevents exit.
 
-The store is `<app_data_dir>/notepad-archive-v1.json`, **a sibling of `sessions/`, never inside it** — a Surface's notes outlive the window whose closure archived them, so they must not ride the per-window session blob or be swept by `clear_session`. **It is written owner-only and atomically through the same `write_file_atomically` the session snapshot uses** (`docs/specs/security-local.md` → "Persisted state"). **The revision is a hash of the stored bytes, and every load, save and reset holds an exclusive lock on the sidecar `notepad-archive-v1.lock`** — a second Dormouse sharing `app_data_dir()`, a dev build beside the installed app, then conflicts instead of overwriting batches it never read. **Recovery renames it to `notepad-archive-v1.unreadable-<unix-millis>.json` beside the original**, disambiguating rather than overwriting an earlier quarantine; only a temp file a crash left behind is dropped.
+The store is `<app_data_dir>/notepad-archive-v1.json`, **outside `sessions/` and outside the state root**, so every build shares one — a Surface's notes outlive the window whose closure archived them, so they must not ride the per-window session blob or the sweep over its directory. **It is written owner-only and atomically through the same `write_file_atomically` the session snapshot uses** (`docs/specs/security-local.md` → "Persisted state"). **The revision is a hash of the stored bytes, and every load, save and reset holds an exclusive lock on the sidecar `notepad-archive-v1.lock`** — a second Dormouse sharing `app_data_dir()`, a dev build beside the installed app, then conflicts instead of overwriting batches it never read. **Recovery renames it to `notepad-archive-v1.unreadable-<unix-millis>.json` beside the original**, disambiguating rather than overwriting an earlier quarantine; only a temp file a crash left behind is dropped.
 
 Source of truth: `archiveNotesBeforeQuit` in `standalone/src/quit.ts`, the `'archive-failed'` phase in `standalone/src/quit-confirm-store.ts`; `write_notepad_archive_to`, `lock_notepad_archive` and `reset_notepad_archive_at` in `standalone/src-tauri/src/lib.rs`; the port in `standalone/src/tauri-adapter.ts`.
 
diff --git a/docs/specs/notepad.rationale.md b/docs/specs/notepad.rationale.md
index 603af843f..b1f5e84d1 100644
--- a/docs/specs/notepad.rationale.md
+++ b/docs/specs/notepad.rationale.md
@@ -203,7 +203,7 @@ who had just been told the notes were not stored and had chosen Cancel.
 quit they already asked for; a slower answer is a failure worth surfacing.
 
 The file is a sibling of `sessions/` rather than a member of it because the two have
-different lifetimes: session snapshots are per window and swept by `clear_session`,
+different lifetimes: session snapshots are per window and swept with it,
 while archived notes outlive the window that produced them and must survive that
 sweep. They share `write_file_atomically` because both carry user text and both
 must survive a crash mid-write; that is one implementation, not two.
diff --git a/docs/specs/security-local.md b/docs/specs/security-local.md
index 58407e0bd..b36f4feee 100644
--- a/docs/specs/security-local.md
+++ b/docs/specs/security-local.md
@@ -135,22 +135,30 @@ Source of truth: the shared rule and predicates — `isLoopbackHost`, `isOwnOrig
 The attacker is another local account reading disk; what the remote stack leaves
 behind is `docs/specs/security-remote.md` -> "Credentials at rest".
 
-**Session snapshots are owner-only before any bytes are written.**
-`restrict_to_owner` locks `<app_data_dir>/sessions/` and, *first*, the temp file
-renamed into it, applying a protected single-ACE DACL on Windows where a unix
-mode is a silent no-op (`docs/specs/standalone.md` -> "Persistence"). The same
-helper locks the whole standalone app-data directory before the sidecar spawns.
+**Session snapshots are owner-only before any bytes are written.** Standalone
+persists one window's structure per file as `<state root>/sessions/<label>.json`
+— panes, cwds, titles, doors, layout, TODO flags, never terminal text
+(`docs/specs/standalone.md` -> "Persistence"). `restrict_to_owner` locks the
+directory and, *first*, the temp file renamed into it, applying a protected
+single-ACE DACL on Windows where a unix mode is a silent no-op. The same helper
+locks the whole standalone app-data directory before the sidecar spawns.
 
 **No writer persists scrollback** (`docs/specs/transport.md` -> "What is
-persisted"): `normalizeSessionV3` strips it on read, and the standalone store is
-switched off today, clearing any legacy snapshot at boot. Snapshots older
-versions left behind do carry transcripts (rationale).
+persisted"): `normalizeSessionV3` strips it on read, so the first save after an
+upgrade rewrites the snapshot without it, and a boot sweep deletes orphaned
+`*.json.tmp` files no save would ever overwrite. Snapshots older versions left
+behind do carry transcripts (rationale).
+
+**Standalone writes `recovery.json` beside its sessions directory**, under the
+state root, owner-only: one rebuilt agent-resume invocation per Surface, never a
+buffer, unlinked as it is read (`docs/specs/standalone.md` -> "Agent recovery").
 
 **The notepad archive is the one store holding terminal text on purpose** —
 excerpts the user explicitly captured, their colors, the Surface title and kind,
 and the CWD at closure, appended only by a Surface closing
 (`docs/specs/notepad.md` -> "Archive"). Standalone keeps it as
-`<app_data_dir>/notepad-archive-v1.json`, owner-only; VS Code keeps it in
+`<app_data_dir>/notepad-archive-v1.json`, owner-only and shared by every build
+so notes are not stranded in a dev subtree; VS Code keeps it in
 `<globalStorageUri>/notepad-archive.json`, mode `0600` on Unix and inheriting VS Code's directory ACL on Windows. Migration and Settings Sync follow `docs/specs/notepad.md` -> "VS Code lifecycle". Its live half never reaches disk.
 
 **VS Code persists pane structure in VS Code's own storage** — `workspaceState`
diff --git a/docs/specs/security-local.rationale.md b/docs/specs/security-local.rationale.md
index 3c74b798f..9fd66ea8f 100644
--- a/docs/specs/security-local.rationale.md
+++ b/docs/specs/security-local.rationale.md
@@ -146,9 +146,9 @@ the rename would leave a window where the transcript is world-readable.
 
 What the current writers actually store. `normalizeSessionV3` in
 `lib/src/lib/session-types.ts` destructures `scrollback` out of every pane on
-read, `saveSession` never emits it, and standalone's `PERSIST_SESSION` is
-`false`, so the shipped app writes no snapshot at all and clears a legacy one at
-boot.
+read and `saveSession` never emits it, so a snapshot standalone writes today
+carries structure only. What a pre-upgrade one carries is retired by the first
+save over it, or — for a `.json.tmp` no save will ever reach — by the boot sweep.
 
 Why the peer-link token is listed here. It is a `randomUUID()` in the VS Code
 extension's global storage, and its own comment says it is the only thing between
diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index 0c5087c8a..d283eaf23 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -73,7 +73,7 @@ are *not* forwarded:
 
 | Not forwarded | Handled | Why |
 |---|---|---|
-| `load_session` / `save_session` / `clear_session` | Rust | the per-window session file is Rust's store (§Persistence) |
+| `load_session` / `save_session` | Rust | the per-window session file is Rust's store (§Persistence) |
 | the `clipboard` readers (Windows only) | Rust (`clipboard_win.rs`) | native Win32 reads (`docs/specs/mouse-and-clipboard.md` §8.6) |
 | `agent_browser_screenshot` | Rust reads the bytes from a sidecar-supplied temp-file *path* | images must never ride the JSON-lines pipe shared with PTY traffic (`docs/specs/dor-browser.md`) |
 
@@ -296,39 +296,27 @@ chord the webview already handles.**
 
 ## Persistence
 
-**Standalone persists no Session state**: every launch starts fresh
-(`docs/specs/transport.md` → "The governing rule"). One `PERSIST_SESSION` gate
-drives all of it — `TauriAdapter.getState` returns null, `saveState` is a no-op,
-and the adapter reports `persistsSession: false` so `saveSession` skips building a
-record at all. **That last part is what keeps the gate from being cosmetic**,
-since the record build costs a `getCwd` round trip per terminal pane regardless
-(rationale). `init()` also **deletes** any pre-upgrade snapshot via
-`clear_session`, unconditionally and including an orphaned
-`<label>.json.tmp` (`docs/specs/transport.md` → "Retiring the transcripts already
-on disk"), deleting rather than blanking (rationale). The store beneath the gate
-is intact and still needed by the workspaces-rollout scope
-(`docs/specs/layout.md` → `## Future`). The Tauri boot cleanup runs regardless
-of the flag; future recovery must also reconcile that deletion and add capture
-to the quit teardown.
-
-**Flip both `PERSIST_SESSION` flags together** — a harness that restored panes
-across a reload would be debugging a path the shipped app never takes; the rest
-of the mirroring rule is `docs/specs/transport.md` → Standalone browser-dev
-harness. `BrowserSidecarAdapter` **deletes** the
-`dormouse.browser-sidecar.session` key on `init()` rather than ignoring it
-(rationale).
-
-**What the gate costs on reload is the *layout*, not the Sessions.** Nothing wires
-`shutdown()` to `beforeunload`, so the sidecar's PTYs outlive a page reload and
-`lib/src/lib/reconnect.ts` resumes over them — but with no `getState()` resume plan
-every live PTY lands in one tab group, doors and saved titles dropped. Real
-standalone has always done this across a WebView reload (rationale).
-
-**Must keep the implemented store plumbing dormant while persistence is disabled.**
-Below the gate, `TauriAdapter.saveState` / `getState` route the session blob through
-`lib/src/lib/window-persistence.ts` (`loadSessionState` / `saveSessionState`) —
-the standalone adapter boundary where the `PersistedWindow` wrapping lives
-(`docs/specs/transport.md`, Workspace/Window containers).
+**Standalone persists one `PersistedWindow` per window** and restores every
+Workspace in it on the next launch (`docs/specs/transport.md` → "The governing
+rule"). The webview owns the composition: each Workspace's Wall publishes its
+`PersistedSession` to the Window aggregator, whose one debounced writer is
+`TauriAdapter.saveState` (`docs/specs/transport.md` → "Persisted session types").
+`getWindowState` is the boot reader; `getState` answers nothing, because the
+stored blob is a Window and every shared reader of `getState` wants a Session.
+
+**Boot restores per Workspace off one live-PTY list.** `restoreWindow`
+(`standalone/src/main.tsx`) seeds the aggregator, installs the Workspaces and the
+writer, then runs one `collectLivePtys` and plans each Workspace from its own saved
+record. Reload and relaunch are the same path with a different list: nothing wires
+`shutdown()` to `beforeunload`, so a reload's PTYs are still there and partition by
+saved pane id, while a relaunch's list is empty and every Workspace cold-restores
+into fresh shells at its saved cwds. **A live PTY no saved Workspace names goes to
+the active Workspace**, which is the only one that can hold it.
+
+**Nothing is deleted at boot but orphaned session temp files**
+(`docs/specs/transport.md` → "Retiring the transcripts already on disk"). **The
+harness mirrors this answer** (`docs/specs/transport.md` → Standalone browser-dev
+harness), in `localStorage` and a per-run temp state directory.
 
 **Never back the session blob with WebKit `localStorage`** — a WAL that grows
 without bound (rationale). The blob rides the `SessionKeyValueStore` seam instead,
@@ -336,9 +324,9 @@ over the Rust-backed `standalone/src/tauri-session-store.ts`. Theme selection
 still persists on `localStorage` (`docs/specs/theme.md`) — tiny and rarely
 written.
 
-**Rust file store.** `save_session(window, state)` / `load_session(window)` /
-`clear_session(window)` (`lib.rs`) persist the blob as one atomic file per Tauri
-window, `<app_data_dir>/sessions/<label>.json`:
+**Rust file store.** `save_session(window, state)` / `load_session(window)`
+(`lib.rs`) persist the blob as one atomic file per Tauri window,
+`<state root>/sessions/<label>.json`:
 
 - **The label is sanitized** so it cannot escape the directory.
 - **Temp-then-rename**, so a crash cannot truncate the previous snapshot. The temp
@@ -350,10 +338,46 @@ window, `<app_data_dir>/sessions/<label>.json`:
   window's. The store is multi-window even though the app ships one window today.
 - No WAL to grow, and rewriting the same path bounds the on-disk size to one
   blob (rationale).
-
-**The notepad archive is a sibling of `sessions/`, not a member of it** —
+- **`sweep_orphan_session_temps` runs once in `setup()`** and deletes every
+  `<label>.json.tmp`, deriving the suffix through the writer so the two cannot
+  drift. It **never touches a live snapshot**.
+
+**The state root is `<app_data_dir>`, or `<app_data_dir>/dev` under
+`cfg(debug_assertions)`.** `app_data_dir()` is keyed by the Tauri identifier, so a
+`pnpm dev:standalone` run and the installed app resolve to the same directory:
+without the split a dev launch would restore the installed app's Workspaces and the
+two would clobber one snapshot. **The notepad archive and the Burrow state directory
+stay under `app_data_dir` itself** — machine-local stores, not this build's copy of
+the user's window. `state_root_from` in `standalone/src-tauri/src/lib.rs`.
+
+### Agent recovery
+
+**The sidecar owns the capture and the record** (`docs/specs/transport.md` →
+"Consuming it"): it holds the replay buffers the detection reads, and its lifetime is
+exactly one activation, so read-and-unlink has one home. Rust only bridges —
+`capture_agent_recovery` and `take_recovery_commands`, both
+`#[tauri::command(async)]` like every command reaching the blocking sidecar helper.
+
+- **The record is `<state root>/recovery.json`**, owner-only, temp-then-rename,
+  written on every detection rather than once at the end, because the quit budget
+  can end the capture at any instant.
+- **`beginCapture` clears the previous record once per sidecar process and merges
+  after**, so a teardown that captures nothing cannot carry a stale record forward
+  and a second window's capture cannot wipe the first's.
+- **`take` is claimed once**, during `TauriAdapter.init()` and before the restore
+  reads it, for every pane id across the saved Window's Workspaces.
+- **Without a state directory the store is memory-only**, warning once.
+
+The detection is `lib/src/host/recovery-capture.ts`, shared with the VS Code
+extension host (`docs/specs/vscode.md` → "Capturing agent recovery"); the primitives
+it runs on — `liveIds`, `receivedChars`, `outputSince` — are
+`standalone/sidecar/pty-core.js`'s. Source of truth: `createRecoveryStore` in
+`lib/src/host/recovery-store.ts`; `pty:captureRecovery` / `recovery:take` in
+`standalone/sidecar/main.js`.
+
+**The notepad archive is outside `sessions/`, and outside the state root** —
 `<app_data_dir>/notepad-archive-v1.json`, its own compare-and-swap commands and
-its own lifetime, so `clear_session` never sweeps it
+its own lifetime, so the session sweep never reaches it
 (`docs/specs/notepad.md` -> "Standalone quit"). Both stores write through the one
 `write_file_atomically`.
 
@@ -439,9 +463,9 @@ wedged webview, in three phases:
 |---|---|---|
 | 1 — ack | no `quit_ack` yet | ~2 s; the listener is dead ⇒ log and `app.exit(0)` |
 | 2 — awaiting teardown | acked, `tearing_down` unset | **none** — the webview may be parked on the confirmation dialog waiting on a human, who must never be force-quit out from under it. Only `quit_proceed` (`approved`) or `quit_cancel`/repeat-trigger (`seq` bump) ends the wait |
-| 3 — teardown running | `tearing_down` set | **per phase**, ~12 s, refreshed by every `quit_progress` bump, so teardown and update install get separate budgets rather than one total; a phase making no progress for the budget ⇒ log and exit |
+| 3 — teardown running | `tearing_down` set | **per phase**, ~14 s, refreshed by every `quit_progress` bump, so teardown and update install get separate budgets rather than one total; a phase making no progress for the budget ⇒ log and exit |
 
-Phase 3's budget comfortably exceeds the webview's own 8 s teardown ceiling. Each
+Phase 3's budget comfortably exceeds the webview's own 10 s teardown ceiling. Each
 watchdog captures the `seq` it was spawned for, so a **repeated quit trigger** —
 which bumps `seq`, spawns a fresh watchdog and re-emits — leaves the stale one to
 exit without acting: the user's escape hatch if the webview acked then wedged.
@@ -477,25 +501,31 @@ irrelevant — the gate is read only at quit time.
 Source of truth: `standalone/src/quit-confirm-store.ts` (the module store + gate),
 `standalone/src/QuitConfirmModal.tsx` (the modal).
 
-**Teardown ordering (`runQuitTeardown`), and why.** Wrapped in an 8 s ceiling, with
+**Teardown ordering (`runQuitTeardown`), and why.** Wrapped in a 10 s ceiling, with
 **every step individually bounded** so a stall cannot wedge quit. The notepad
 archive is **not** a step here: it runs ahead of `quit_progress` precisely because
 teardown's rule below holds — no failing step prevents exit — and archiving must be
 able to stop the quit (`docs/specs/notepad.md` -> "Standalone quit"):
 
-1. `requestSessionFlush` — save while PTYs are alive, so CWDs are fresh.
-2. `gracefulKillAllPtys` — SIGTERM every PTY, resolving early once all exit and
+1. `captureAgentRecovery` — **first**, because an agent's resume invocation exists
+   only between the interrupt and the kill and is the one thing here that cannot be
+   reconstructed afterwards (§Agent recovery). **A failed capture must not abort the
+   steps behind it.**
+2. `requestSessionFlush` — save while PTYs are alive, so CWDs are fresh.
+3. `gracefulKillAllPtys` — SIGTERM every PTY, resolving early once all exit and
    their final output has had a grace tick to reach the webview (§Rust ↔ sidecar
    bridge).
-3. `requestSessionFlush` — flush the post-exit Session state. **Must retain the
-   previously persisted CWD when `getCwd` returns null for a dead PTY.** Both
-   flushes are no-ops while `persistsSession: false` (§Persistence).
-4. `drainSessionSaves` — await the store pipeline becoming idle or its timeout
+4. `requestSessionFlush` — flush the post-exit Session state. **Must retain the
+   previously persisted CWD when `getCwd` returns null for a dead PTY.**
+5. `flushWindowSession` — the Workspaces' records become one Window blob
+   (`docs/specs/transport.md` → "Persisted session types"); a debounce timer still
+   pending at exit would otherwise lose the final save.
+6. `drainSessionSaves` — await the store pipeline becoming idle or its timeout
    (§Persistence).
-5. If an update is pending, a fresh `quit_progress` then `installPendingUpdate()`
+7. If an update is pending, a fresh `quit_progress` then `installPendingUpdate()`
    — strictly *after* the completed save (`docs/specs/auto-update.md`); Rust's
    phase-3 watchdog backstops a hung installer.
-6. **Always** `quit_proceed` (in `finally`, even on throw/timeout).
+8. **Always** `quit_proceed` (in `finally`, even on throw/timeout).
 
 **Windows note.** node-pty's `kill('SIGTERM')` is an immediate kill under ConPTY,
 so step 2 terminates promptly there, retaining the same final-output grace tick.
diff --git a/docs/specs/standalone.rationale.md b/docs/specs/standalone.rationale.md
index 98ec18041..13194bfd6 100644
--- a/docs/specs/standalone.rationale.md
+++ b/docs/specs/standalone.rationale.md
@@ -36,14 +36,14 @@
 
 **What the teardown flush lost.** The pre-Rust path flushed the session on teardown into WebKit `localStorage` and lost the final debounce/heartbeat window; awaiting the write pipeline to disk (`drainSessionSaves`) recovers it, which a last fire-and-forget save would not.
 
-**What a dropped blob would still cost.** `getCwd` is a synchronous `execFileSync('lsof', …)` in the sidecar on macOS (`getCwdForPid` in `standalone/sidecar/pty-core.js`), one round trip per terminal pane. Without `persistsSession: false` the record build runs anyway, so every debounced save, every 30 s heartbeat, and both quit-time flushes pay that per pane to produce a blob discarded on the next line.
+**What a record build costs.** `getCwd` is a synchronous `execFileSync('lsof', …)` in the sidecar on macOS (`getCwdForPid` in `standalone/sidecar/pty-core.js`), one round trip per terminal pane, on every debounced save and every 30 s heartbeat. That price is why the dirty triggers are keyed to the owning Workspace: an unkeyed trigger would make every idle Workspace pay it whenever any Workspace moved.
 
-**Why the pre-upgrade snapshot is deleted, not blanked.** A `''` write leaves the old bytes on disk until some later save that may never come, and forces every reader to treat empty as a third state alongside present and absent.
+**Why the aggregator debounces on top of the Wall's own debounce.** Each Wall already coalesces its own record; the second stage coalesces *across* Walls, so one window-wide event (a store change, a theme push, a burst of output in two Workspaces) becomes one host write rather than one per Workspace.
 
-**Why the harness deletes its `localStorage` key.** Its snapshots carry transcripts, and `localStorage` is keyed by browser profile rather than by the per-run temp state directory the harness gives every other slot, so a blob written before the gate existed outlives every run.
-
-**Why the reload cost is more visible in the harness.** A developer rarely reloads real standalone; in the browser-dev harness, turning on `abDebugLogs` means reloading the page (`.claude/skills/debug-standalone-agent-browser/SKILL.md`), so long-standing behavior shows up every session.
+**Why the dev state root is a subtree rather than a separate identifier.** `app_data_dir()` is derived from the Tauri identifier, and changing the identifier for debug builds would move the notepad archive and the Burrow enrollment too — stranding a developer's notes and forcing a re-pair on every switch between the dev and installed app. A subtree splits exactly the state that is a copy of the user's window and shares the rest.
 
 ## Quit flow
 
-**Why the teardown ordering outlived its original purpose.** Flush → graceful kill → flush → drain was built to capture the final scrollback of dying terminals into the persisted session. Standalone now persists nothing, so both flushes return immediately on `persistsSession: false`; the shape is kept for the workspaces-rollout scope's Session persistence. The flushes no longer read transcripts; final PTY output is forwarded to the webview during the grace tick without a sidecar scrollback buffer.
+**Why the teardown ordering survived the transcript removal.** Flush → graceful kill → flush → drain was built to capture the final scrollback of dying terminals into the persisted session. The transcripts are gone, but the shape is still what makes the *structure* correct: the first flush reads cwds while the shells are alive, and the second catches whatever changed as they died, retaining the earlier cwd for a PTY `getCwd` can no longer answer.
+
+**Why the capture goes first and cannot abort the rest.** The resume hint exists only in the window between the interrupt and the kill, so no later step can reconstruct it — but it is also the step most likely to be slow or to fail, and losing an agent's resume is much cheaper than losing the layout, cwds, and notes behind it.
diff --git a/docs/specs/transport.md b/docs/specs/transport.md
index 7b920fb7f..42bce7f89 100644
--- a/docs/specs/transport.md
+++ b/docs/specs/transport.md
@@ -20,7 +20,7 @@ Optional booleans:
 
 | Member | Absent reads | Set by | Effect when set |
 |---|---|---|---|
-| `persistsSession?` | `true` | `TauriAdapter`, `BrowserSidecarAdapter` → `false` | `saveSession` skips the whole record build, not just the write ("The governing rule"; rationale) |
+| `persistsSession?` | `true` | Every shipped adapter | `saveSession` skips the whole record build, not just the write, on a host that answers `false` (rationale) |
 | `hostOwnsTheme?` | `false` | `VSCodeAdapter` → `true` | Settings hides its theme picker (`docs/specs/theme.md` → "Where the user picks a theme") |
 | `hostOwnsShells?` | `false` | `VSCodeAdapter` → `true` | Settings hides its Shell row for the native QuickPick (`docs/specs/vscode.md` → "Shell selection") |
 
@@ -46,7 +46,7 @@ The bridge is a transport shim over the same sidecar protocol, not a second PTY
 
 **An unauthorized caller gets the same `404 not found` as an unknown path**, so the port does not identify itself. The harness prints the token and a ready-made `curl` on startup.
 
-The harness **may omit** native-only desktop chrome (window controls, update checks) but **must preserve** every `PlatformAdapter` contract the app uses — PTY, control-request, clipboard, iframe-proxy, Burrow, agent-browser. It **must mirror** standalone's Session-persistence answer ("The governing rule"): the same `PERSIST_SESSION = false` gate as `TauriAdapter`, `persistsSession: false`, and any pre-gate `localStorage` blob deleted on `init()` (rationale). **Tauri APIs must not be required at static module-evaluation time** when `VITE_DORMOUSE_BROWSER_DEV_HOST` is set — a normal browser loads the page, not the Tauri WebView.
+The harness **may omit** native-only desktop chrome (window controls, update checks) but **must preserve** every `PlatformAdapter` contract the app uses — PTY, control-request, clipboard, iframe-proxy, Burrow, agent-browser. It **must mirror** standalone's Session-persistence answer ("The governing rule"): the same `persistsSession`, one `PersistedWindow` per window (in `localStorage` rather than the Rust file store), and the same agent-recovery capture against a per-run temp state directory. **Tauri APIs must not be required at static module-evaluation time** when `VITE_DORMOUSE_BROWSER_DEV_HOST` is set — a normal browser loads the page, not the Tauri WebView.
 
 Source of truth: `standalone/scripts/dev-agent-browser.mjs`, `standalone/scripts/dev-host-guard.mjs`, `standalone/src/browser-sidecar-host.ts`, `standalone/src/browser-sidecar-adapter.ts`; `stepBurrow` in `scripts/pairing-walkthrough/steps.mjs`.
 
@@ -153,9 +153,11 @@ OSC parsing/stripping rules for those rows, and the rule that **only the process
 
 **Surface kinds in the snapshot.** Each `PersistedPane` records a `surfaceType` (`docs/specs/glossary.md`): `'terminal'` — the default, **omitted from the row** so terminal snapshots stay byte-identical — or `'browser'`. It routes restore/resume, and **a pane lacking it reads as `'terminal'`**. `restoreSession` skips terminal restoration for a browser pane rather than minting a stray PTY + xterm per browser pane id, and the resume plan keeps browser panes and minimized browser doors despite their having no live PTY, so the saved layout's leaf set still matches and is not discarded. A browser pane rebuilds from the persisted layout (visible) or `PersistedDoor.params` (minimized) — its render params (`renderMode`, `url`, agent-browser `session`) live there, not in `PersistedPane`. **Must reject a layout whose leaves differ from the visible pane set during restore or resume, and omit visible browser ids from the terminal fallback.** Browser doors retain their independent render params; pinned by `lib/src/lib/session-restore.test.ts` and `lib/src/lib/reconnect.test.ts`.
 
-**Each mounted Workspace publishes its `PersistedSession` to a Window collector**, which orders them by the Workspace store and drops any Workspace that has published nothing rather than writing it empty. **The collector ships with no writer**, so standalone still stores nothing and a relaunch restores one Workspace (rollout ledger in `docs/specs/layout.md` `## Future`). A Workspace's save compares against its own previous record, never the Window's active one, or a dead PTY's retained cwd would come from the wrong Workspace. A `PersistedWorkspace` is a `WorkspaceId`, a user-facing `name`, and that Workspace's `PersistedSession`. Source of truth: `getWindowSnapshot` / `installWindowSessionWriter` in `lib/src/lib/window-session-aggregator.ts`; `SaveSink` in `lib/src/lib/session-save.ts`. The helper's top-level snapshot is a `PersistedWindow` (its own `version: 1`) wrapping v3 sessions: the ordered `PersistedWorkspace` list plus the active `WorkspaceId`. **VS Code does not use it** — each webview persists one bare `PersistedSession`, its single Workspace, through its own per-surface state API (`docs/specs/vscode.md`).
+**Each mounted Workspace publishes its `PersistedSession` to a Window collector**, which orders them by the Workspace store and writes the whole Window through one debounced writer the host installs at boot. **A Workspace with neither a published nor a boot-seeded session is dropped rather than written empty**, so a snapshot taken mid-boot cannot replace a restored Workspace with a blank one. **A Workspace's save compares against its own previous record** — seeded from disk until its Wall publishes — never the Window's active one, or a dead PTY's retained cwd and alert would come from the wrong Workspace. **Reordering, renaming, or switching the active Workspace writes too**: each changes the blob with no Session changing. A `PersistedWorkspace` is a `WorkspaceId`, a user-facing `name`, and that Workspace's `PersistedSession`. The top-level snapshot is a `PersistedWindow` (its own `version: 1`) wrapping v3 sessions: the ordered `PersistedWorkspace` list plus the active `WorkspaceId`. **VS Code does not use it** — each webview persists one bare `PersistedSession`, its single Workspace, through its own per-surface state API (`docs/specs/vscode.md`).
 
-**The wrapping lives at the standalone adapter boundary, never in the shared save/restore code.** `window-persistence.ts` translates between the host's stored top-level blob and the bare `PersistedSession` that `reconnect.ts` / `session-save.ts` operate on; both standalone adapters gate `getState` / `saveState` before reaching its `loadSessionState` / `saveSessionState`. The helpers accept a `SessionKeyValueStore` synchronous slot (`docs/specs/standalone.md` → Persistence). When called directly, flag **off** (the default) passes bare sessions through; flag **on** loads the active Workspace's session and merges saves while preserving the others.
+**The Window wrapping lives at the standalone adapter boundary, never in the shared save/restore code.** `window-persistence.ts` owns the JSON and the storage slot over a `SessionKeyValueStore` synchronous slot (`docs/specs/standalone.md` → Persistence); the shared save/restore code still operates on a bare `PersistedSession`, which the boot hands it per Workspace. **`getState` answers nothing on a Window-persisting adapter** — its blob is a Window and every shared reader of `getState` wants a Session — so the boot reads `getWindowState` instead. **A blob written before standalone persisted Windows is wrapped as the window's one Workspace**; that is the only migration.
+
+Source of truth: `getWindowSnapshot` / `seedWindowSession` / `installWindowSessionWriter` / `flushWindowSession` in `lib/src/lib/window-session-aggregator.ts`; `SaveSink` in `lib/src/lib/session-save.ts`; `loadWindowState` / `saveWindowState` in `lib/src/lib/window-persistence.ts`; `restoreWindow` in `standalone/src/main.tsx`.
 
 **A corrupt save must never block startup.** Every read goes through `readPersistedSession()` / `readPersistedWindow()`, which accept the canonical parsed object *or* a JSON-stringified blob (host state APIs may hand back the inner serialized string) and log-and-discard anything present but unreadable. `readPersistedWindow` additionally drops Workspaces whose inner session is unreadable and repairs a dangling `activeWorkspaceId` to the first Workspace.
 
@@ -163,7 +165,7 @@ OSC parsing/stripping rules for those rows, and the rule that **only the process
 
 *It is not part of the persisted session.* `PersistedPane` carries no `resumeCommand`, and `normalizeSessionV3` strips one out of a pre-upgrade blob as it strips a transcript. **Host-owned and single-use, it travels out of band**: the host puts `surfaceId -> invocation` on the webview's boot payload, the renderer reads it through `PlatformAdapter.getRecoveryCommands()`, and an adapter whose host captures nothing omits the method (rationale).
 
-*Exactly one writer, exactly one read.* The writer is the VS Code host's teardown (`docs/specs/vscode.md` → "Capturing agent recovery"); the renderer save path never derives it and standalone writes it never. **Cold restore is the one reader — resume never reads it**, the agent there still being Live. `takeRecoveryCommands` reads and unlinks on the first call of an activation, **destructively even on a parse failure**, so the durable copy is gone before any webview is served; within that activation **each webview claims only the entries matching its own saved pane ids** (rationale). **A record older than 7 days is discarded unread.**
+*One writer per host, exactly one read.* The writer is that host's teardown — the VS Code extension host's `deactivate()` (`docs/specs/vscode.md` → "Capturing agent recovery") and the Tauri sidecar's quit capture (`docs/specs/standalone.md` → "Agent recovery"); the renderer save path never derives one. Both run the same detection machine, `captureAgentRecovery` in `lib/src/host/recovery-capture.ts`, over their own PTY buffers. **Cold restore is the one reader — resume never reads it**, the agent there still being Live. The record is read and unlinked on the first claim of a host process, **destructively even on a parse failure**, so the durable copy is gone before any webview is served; within that process **each container claims only the entries matching its own saved pane ids** (rationale). **A record older than 7 days is discarded unread.**
 
 *Detection.* Executable-string constraints:
 
@@ -172,7 +174,7 @@ OSC parsing/stripping rules for those rows, and the rule that **only the process
 - **Stripping runs in boundary mode, whose rule is inverted**: *every* control becomes a newline rather than vanishing, except SGR and charset designators, the two classes that neither move the cursor nor erase. Cursor moves outside CSI count — `ESC M`, `ESC 7`/`ESC 8`, `ESC c`, VT/FF/backspace (rationale).
 - **Rightmost match in the last 50 lines wins.** No pattern spans the newline a boundary leaves, so the stripped window is scanned whole; rightmost is newest *by position*, never by pattern order (rationale). **Restore revalidates through `normalizeResumeCommand` before typing**, against a snapshot written by an older detector.
 
-Source of truth: `PersistedSession` in `lib/src/lib/session-types.ts`; `surfaceRefs` in `lib/src/components/Wall.tsx`; `saveSession` in `lib/src/lib/session-save.ts`; `restoreSession` in `lib/src/lib/session-restore.ts`; the resume plan in `lib/src/lib/reconnect.ts`; `loadSessionState` / `saveSessionState` in `lib/src/lib/window-persistence.ts`; `takeRecoveryCommands` in `vscode-ext/src/session-state.ts`; `getRecoveryCommands` in `lib/src/lib/platform/vscode-adapter.ts`; `detectResumeCommand` / `normalizeResumeCommand` in `lib/src/lib/resume-patterns.ts`; `stripTerminalControls` in `lib/src/lib/terminal-controls.ts`.
+Source of truth: `PersistedSession` in `lib/src/lib/session-types.ts`; `surfaceRefs` in `lib/src/components/Wall.tsx`; `saveSession` in `lib/src/lib/session-save.ts`; `restoreSession` in `lib/src/lib/session-restore.ts`; the resume plan in `lib/src/lib/reconnect.ts`; `captureAgentRecovery` in `lib/src/host/recovery-capture.ts`; `createRecoveryStore` in `lib/src/host/recovery-store.ts`; `takeRecoveryCommands` in `vscode-ext/src/session-state.ts`; `getRecoveryCommands` in `lib/src/lib/platform/vscode-adapter.ts`; `detectResumeCommand` / `normalizeResumeCommand` in `lib/src/lib/resume-patterns.ts`; `stripTerminalControls` in `lib/src/lib/terminal-controls.ts`.
 
 ## Persistence policy
 
@@ -185,7 +187,8 @@ Structure only: panes (id, cwd, title, `untouched`, `surfaceType`, TODO/alert bl
 **Must remove legacy transcript bytes from disk** (rationale).
 
 - **`readPersistedSession` drops `scrollback` when present**, along with any `resumeCommand`, and does not *require* it, so a snapshot written without it stays readable. A transcript can be read out of a legacy blob but never survives into a parsed Session, so nothing downstream can persist it forward.
-- **The first save after upgrade rewrites each store without transcripts.** Standalone, which stops reading its store entirely, **clears the slot outright at boot** rather than waiting for a save that may never come — including an orphaned sibling temp file from a crash before atomic rename, invisible to `load_session` but still holding the bytes.
+- **The first save after upgrade rewrites each store without transcripts**, standalone included: it reads its store again, and `readPersistedSession` is what strips them on the way in.
+- **Standalone sweeps orphaned session temp files at boot.** A crash between the temp write and the atomic rename leaves a file `load_session` cannot see and no later save will overwrite, so the sweep is the only thing that can retire a transcript sitting in one. It **never touches a live snapshot** — the window that owns one rewrites it itself. `sweep_orphan_session_temps` in `standalone/src-tauri/src/lib.rs`.
 - **No writer accepts a transcript-bearing Session shape.**
 
 ### The governing rule
@@ -195,8 +198,9 @@ something ends it:
 
 | Boundary | Deliberate? | Outcome |
 | --- | --- | --- |
-| Standalone quit — idle, confirmed, or update-install | Yes | Fresh: one default terminal |
-| Standalone crash / force-kill | No, but nothing was captured | Fresh |
+| Standalone quit — idle, confirmed, or update-install | No — window state is the app's contract | Restore structure + auto-resume agents |
+| Standalone window reload | No | Live resume over sidecar PTYs, per Workspace |
+| Standalone crash / force-kill | No, and the last save stands | Restore structure, no agent resume |
 | VS Code panel hide/show | No | Live resume over host PTYs, unchanged |
 | VS Code Reload Window | No — an editor operation, not an ending | Restore structure + auto-resume agents |
 | VS Code window close / application quit | No — window state is the host's contract | Restore structure + auto-resume agents |
@@ -205,16 +209,11 @@ something ends it:
 
 Ending something deliberately is also what *keeps* its notes: **a deliberate closure archives the Surface's notepad before teardown** (`docs/specs/notepad.md` → "Closure"), so the one thing a user asked to hold on to survives the boundary that discards everything else.
 
-**Standalone therefore persists no Session state at all**, and the write path itself
-is removed rather than written-then-ignored (rationale). Sessions still survive a
-reload — resume reads the sidecar's live PTY list, not disk — but the layout does
-not: `reconnect.ts` reads `getState()` for the saved resume plan, so every live PTY
-lands in one tab group, doors and saved titles dropped. **A legacy blob found at boot
-is deleted, not read.**
-
-> Reserved: the workspaces-rollout scope (`docs/specs/layout.md` → `## Future`)
-> assumes a persisted `PersistedWindow` in standalone. Reconciling multi-Workspace
-> persistence with this rule is part of that scope, not this one.
+**Standalone persists one `PersistedWindow` per window**, every Workspace in it, and
+restores them on the next launch (rationale). Quitting ends the processes, not the
+window: the layout, cwds, titles, doors, and TODO/alert blobs come back, and the
+agents that were running come back with them ("Consuming it"). Nothing else does —
+scrollback is never persisted, so a cold-restored pane opens empty.
 
 ### Consuming it
 
diff --git a/docs/specs/transport.rationale.md b/docs/specs/transport.rationale.md
index bf0451de1..6d2640f8f 100644
--- a/docs/specs/transport.rationale.md
+++ b/docs/specs/transport.rationale.md
@@ -4,7 +4,7 @@
 
 ## Adapter model
 
-**What `persistsSession: false` actually saves.** The expensive half of a save is the record build, not the write: one `getCwd` round trip per pane (`docs/specs/standalone.md` → "Standalone persists no Session state", whose rationale prices it).
+**What `persistsSession: false` actually saves.** The expensive half of a save is the record build, not the write: one `getCwd` round trip per pane (`docs/specs/standalone.md` → "Persistence", whose rationale prices it). No shipped adapter answers `false` today; the gate stays because a host that persists nothing must not pay for a record it discards.
 
 ## Standalone browser-dev harness
 
@@ -58,13 +58,15 @@
 
 ## Retiring the transcripts already on disk
 
-**The legacy blobs are real, not hypothetical.** Every pre-upgrade installation had a transcript-bearing snapshot in `workspaceState` or the standalone file store, so the drop-on-read in `readPersistedSession` and standalone's boot-time clear are live migration paths, not dead defensive code.
+**The legacy blobs are real, not hypothetical.** Every pre-upgrade installation had a transcript-bearing snapshot in `workspaceState` or the standalone file store, so the drop-on-read in `readPersistedSession` and the orphan-temp sweep are live migration paths, not dead defensive code.
+
+**Why standalone stopped deleting its snapshot at boot.** Deleting was right only while nothing read the store: once the app restores its windows, an unconditional boot delete is a data-loss bug, not a migration. What the delete uniquely covered — a `.json.tmp` no reader can see and no writer will ever overwrite — is exactly what the sweep still covers, and nothing else.
 
 ## The governing rule
 
-**Why standalone persists nothing.** A clean quit has nothing to clear and a crash has nothing to recover, so the store earns no keep.
+**Why the rule reversed for standalone.** The old reading — a quit is a deliberate ending, so end everything — was a claim about the *processes*, and users do not experience a window that way. The product call is that window state is the app's contract, as it is in VS Code: the layout comes back, the agents come back, and the transcripts never do. Dropping persisted scrollback is what made that affordable — a resumed agent renders the real conversation, which is more context than the transcript it replaces ("Consuming it").
 
-**Why standalone's write path was removed rather than written-then-ignored.** The blob it wrote was the transcript-bearing one, so leaving the writer in place would have kept minting exactly the bytes "Retiring the transcripts already on disk" exists to retire.
+**What made it safe to persist again.** The two objections to the old store were both about content, not about persistence: it wrote transcripts, and it wrote them into a WKWebView `localStorage` WAL that grew without bound (`docs/specs/standalone.md` → "Persistence", rationale). Both were already fixed — no writer accepts a transcript-bearing shape, and the blob rides a Rust file store — before the rule changed.
 
 ## Consuming it
 
diff --git a/docs/specs/vscode.md b/docs/specs/vscode.md
index 28a7d0527..baabe0b8e 100644
--- a/docs/specs/vscode.md
+++ b/docs/specs/vscode.md
@@ -77,7 +77,7 @@ Consequences:
 
 > See `docs/specs/glossary.md` for the Workspace / Window containers and `docs/specs/alert.md` for the union status.
 >
-> Union reflection onto native chrome is always-on — the extension host has no `localStorage` for the standalone workspaces flag ([Future](#future)). The Window persistence container is standalone-only; VS Code keeps one bare `PersistedSession` per webview.
+> Union reflection onto native chrome is always-on. The Window persistence container is standalone-only; VS Code keeps one bare `PersistedSession` per webview.
 
 **One webview is one Workspace.** The bottom-panel `WebviewView` ("Dormouse") is the default Workspace; each `dormouse.open` editor-tab `WebviewPanel` is an independent Workspace. Several are visible at once, and VS Code — not Dormouse — owns their tabs, creation, and closing, so **Dormouse adds no create/rename/close affordances here**: the webview mounts a bare `<Wall>`, which leaves the Workspace strip and its shortcuts to standalone (`docs/specs/layout.md` → Workspaces). A Workspace's Surfaces are the terminal Sessions whose PTYs its router tracks (`ownedPtyIds`, `docs/specs/transport.md`) plus the browser Surfaces rendered in it.
 
@@ -205,9 +205,17 @@ never opened would otherwise auto-run a week-old invocation on some much later
 restore. A missing hint is ordinary: `CLAUDE_CODE_CHILD_SESSION` in a pane's env
 disables transcript saving in claude, which then prints none (rationale).
 
-Source of truth: `captureAgentRecoveryCommands` in
-`vscode-ext/src/session-state.ts`, `interrupt` in
-`vscode-ext/src/pty-manager.ts`.
+**The machine is shared, the record is not.** Every rule above lives in
+`captureAgentRecovery` (`lib/src/host/recovery-capture.ts`), over four primitives
+each host supplies — the live id set, interrupt, a monotonic received count, and the
+output since a mark — so the Tauri sidecar runs the same detection
+(`docs/specs/standalone.md` → "Agent recovery"). What stays here is where the record
+lives and how it is written; VS Code's is a plain file, written synchronously,
+because `workspaceState` batches its flush and `deactivate()` outruns it (rationale).
+
+Source of truth: `captureAgentRecoveryCommands` and `takeRecoveryCommands` in
+`vscode-ext/src/session-state.ts`, `captureAgentRecovery` in
+`lib/src/host/recovery-capture.ts`, `interrupt` in `vscode-ext/src/pty-manager.ts`.
 
 ### Theme integration
 
@@ -448,10 +456,6 @@ Source of truth: `terminalContext` in `lib/src/lib/platform/vscode-adapter.ts`;
 
 A webview→host Surface-state message would let the native-chrome union count browser-Surface TODOs, which the PTY-keyed `alert:state` cannot carry (`docs/specs/alert.md`, `docs/specs/transport.md`).
 
-### Host-side workspaces flag gate
-
-Whether to gate the always-on union reflection on a host-side equivalent of the standalone `dormouse.flags.workspaces` localStorage flag is decided when the workspaces rollout reaches VS Code (`docs/specs/layout.md` `## Future`, workspaces-rollout).
-
 ### Context keys
 
 Context keys so menus and extensions can target Dormouse state:
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 4ac17439b..c3968f3ef 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -9,30 +9,30 @@
   "docs/specs/dor-cli.md": 4950,
   "docs/specs/dor-tool.md": 2100,
   "docs/specs/glossary.md": 2850,
-  "docs/specs/layout.md": 8350,
+  "docs/specs/layout.md": 8400,
   "docs/specs/mobile-terminal-ui.md": 1950,
   "docs/specs/mouse-and-clipboard.md": 3750,
-  "docs/specs/notepad.md": 3750,
+  "docs/specs/notepad.md": 3800,
   "docs/specs/pocket-app.md": 4050,
   "docs/specs/relay.md": 9950,
   "docs/specs/remote-api.md": 3600,
   "docs/specs/remote-security-model.md": 4200,
   "docs/specs/security-audit.md": 1750,
   "docs/specs/security-ci.md": 2500,
-  "docs/specs/security-local.md": 2550,
+  "docs/specs/security-local.md": 2600,
   "docs/specs/security-remote.md": 4900,
   "docs/specs/security-supply-chain.md": 1150,
   "docs/specs/security.md": 1900,
   "docs/specs/shortcuts.md": 1050,
-  "docs/specs/standalone.md": 4400,
+  "docs/specs/standalone.md": 4650,
   "docs/specs/terminal-context.md": 900,
   "docs/specs/terminal-escapes.md": 3750,
   "docs/specs/terminal-state.md": 2350,
   "docs/specs/theme.md": 2150,
   "docs/specs/tiling-engine.md": 4500,
-  "docs/specs/transport.md": 4500,
+  "docs/specs/transport.md": 4650,
   "docs/specs/tutorial.md": 1900,
-  "docs/specs/vscode.md": 7350,
+  "docs/specs/vscode.md": 7400,
   "docs/specs/webgl-text.md": 1200,
   "docs/specs/website-docs.md": 5050
 }
diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index 3c1f06bbe..d6748366d 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -1129,9 +1129,9 @@ fn sweep_orphan_session_temps(dir: &Path) -> Result<(), String> {
 // --- Notepad archive (docs/specs/notepad.md) ---------------------------------
 //
 // One machine-local archive per host, kept as `<app_data_dir>/notepad-archive-v1.json`
-// — a *sibling* of `sessions/`, never inside it. A Surface's notes outlive the
-// window whose closure archived them, so they must not ride the per-window
-// session blob or be swept by `clear_session`.
+// — outside `sessions/`, and outside the state root, so dev and the installed app
+// share it. A Surface's notes outlive the window whose closure archived them, so
+// they must not ride the per-window session blob or be swept with that directory.
 //
 // The port is compare-and-swap (`NotepadArchivePort` in
 // lib/src/lib/notepad/types.ts): the webview reads the bytes plus an opaque

From 3ea11e91098dba78ce865ae8399bd2f51683fc52 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 9 Sep 2026 22:40:07 -0700
Subject: [PATCH 08/11] Simplify standalone persistence and recovery after
 review

Quality pass over Stage B, behavior unchanged.

Shared code:
- Lift `sliceSince` into `lib/src/host/replay-buffer.ts`, the one replay-buffer
  clamp for both hosts; `pty-core.js` takes it as an injected option so its
  `node --test` suite still needs no build artifact.
- VS Code drops its duplicate record half and uses `createRecoveryStore`, gaining
  the store's owner-only modes.
- `windowPaneIds`, `wallBootFromResult`, `SESSION_SAVE_DEBOUNCE_MS`, and an
  exported `silent` log replace their copies.
- `PlatformAdapter` gains `getWindowState` / `saveWindowState`, so `main.tsx`
  needs no local adapter type and neither adapter casts `unknown`.
- `standalone/src/window-recovery.ts` holds what both standalone adapters do
  identically with the Window slot and the recovery claim.

Removed: the dead `activeWorkspaceSession` / `replaceActiveSession` helpers, the
aggregator's second map and `adoptWorkspaceSession`, the unused
`recoveryCommands` option on `resumeOrRestoreFrom` / `restoreSession`, the
harness's `captureAgentRecovery` (a reload there is a live resume, so pressing
`^C` would interrupt running work), and Rust's `session_temp_suffix` probe.

Cost:
- Batch the cwd probe: `getCwds` on the adapter, `pty:getCwds` in the sidecar
  (one `lsof` for every pid), `pty_get_cwds` in Rust.
- Skip it entirely on the post-kill quit flush, where every probe answers null.
- Start the recovery claim in `init()` without awaiting, and await it in
  `restoreWindow` only when a Workspace can actually cold-restore.
- Scan the recovery buffer incrementally, a bounded overlap per tick.

Correctness-adjacent: the session writer now removes its own temp file on every
error path, `recovery:take` answers through `respondAsync`, and the capture's
in-process interrupts no longer emit a stray `interruptDone`.

Specs: standalone.md, transport.md, vscode.md updated; two budgets ratcheted.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QBf4rQbwuxV6n6v7E3twYe
---
 docs/specs/standalone.md                      |  46 +++--
 docs/specs/transport.md                       |  10 +-
 docs/specs/vscode.md                          |  24 ++-
 lib/src/App.tsx                               |   6 +-
 lib/src/components/Wall.tsx                   |   2 +-
 lib/src/components/WorkspaceWindow.tsx        |  21 ++-
 .../wall/use-session-persistence.ts           |  28 +--
 lib/src/components/wall/wall-handles.ts       |   4 +-
 lib/src/components/wall/wall-types.ts         |  13 ++
 lib/src/host/recovery-capture.ts              |  37 +++-
 lib/src/host/recovery-store.ts                |   4 +-
 lib/src/host/recovery.ts                      |   3 +
 lib/src/host/replay-buffer.test.ts            |  68 +++++++
 lib/src/host/replay-buffer.ts                 |  45 +++++
 lib/src/lib/feature-flags.test.ts             |  45 +++++
 lib/src/lib/platform/types.ts                 |  43 ++++-
 lib/src/lib/reconnect.test.ts                 |  10 +-
 lib/src/lib/reconnect.ts                      |   7 +-
 lib/src/lib/session-restore.test.ts           |   8 +-
 lib/src/lib/session-restore.ts                |   8 +-
 lib/src/lib/session-save.test.ts              |  52 ++++++
 lib/src/lib/session-save.ts                   |  83 ++++++---
 lib/src/lib/session-types.ts                  |  17 +-
 lib/src/lib/session-window.test.ts            |  20 +-
 lib/src/lib/window-persistence.ts             |   6 +-
 lib/src/lib/window-session-aggregator.test.ts |   9 +-
 lib/src/lib/window-session-aggregator.ts      |  63 +++----
 lib/src/main.tsx                              |   3 +-
 scripts/spec-word-budgets.json                |   4 +-
 standalone/scripts/dev-agent-browser.mjs      |  17 +-
 standalone/sidecar/main.js                    |  13 +-
 standalone/sidecar/pty-core.js                | 126 +++++++++----
 standalone/sidecar/pty-core.test.js           |  96 ++++++++--
 standalone/src-tauri/src/lib.rs               |  84 ++++++---
 .../src/browser-sidecar-adapter.test.ts       |   7 +-
 standalone/src/browser-sidecar-adapter.ts     |  66 +++----
 standalone/src/main.tsx                       |  40 ++--
 standalone/src/quit.ts                        |   9 +-
 standalone/src/tauri-adapter.test.ts          |   7 +-
 standalone/src/tauri-adapter.ts               |  91 ++++-----
 standalone/src/window-recovery.ts             |  83 +++++++++
 vscode-ext/src/pty-manager.ts                 |  16 +-
 vscode-ext/src/session-state.ts               | 175 ++++--------------
 43 files changed, 948 insertions(+), 571 deletions(-)
 create mode 100644 lib/src/host/replay-buffer.test.ts
 create mode 100644 lib/src/host/replay-buffer.ts
 create mode 100644 lib/src/lib/feature-flags.test.ts
 create mode 100644 standalone/src/window-recovery.ts

diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index d283eaf23..ad13b98ba 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -300,9 +300,13 @@ chord the webview already handles.**
 Workspace in it on the next launch (`docs/specs/transport.md` → "The governing
 rule"). The webview owns the composition: each Workspace's Wall publishes its
 `PersistedSession` to the Window aggregator, whose one debounced writer is
-`TauriAdapter.saveState` (`docs/specs/transport.md` → "Persisted session types").
-`getWindowState` is the boot reader; `getState` answers nothing, because the
-stored blob is a Window and every shared reader of `getState` wants a Session.
+`TauriAdapter.saveWindowState` (`docs/specs/transport.md` → "Persisted session
+types"). `getWindowState` is the boot reader, and it **parses the blob once** —
+the store behind it is a boot-seeded cache and every later write comes through
+`saveWindowState`. The bare-Session `saveState` / `getState` pair answers nothing
+on either standalone adapter, because the stored blob is a Window and every
+shared reader of `getState` wants a Session. Source of truth: `windowStateSlot` in
+`standalone/src/window-recovery.ts`.
 
 **Boot restores per Workspace off one live-PTY list.** `restoreWindow`
 (`standalone/src/main.tsx`) seeds the aggregator, installs the Workspaces and the
@@ -338,9 +342,13 @@ written.
   window's. The store is multi-window even though the app ships one window today.
 - No WAL to grow, and rewriting the same path bounds the on-disk size to one
   blob (rationale).
+- **The writer removes its own temp file on every error path**, so only a crash
+  can leave one behind.
 - **`sweep_orphan_session_temps` runs once in `setup()`** and deletes every
-  `<label>.json.tmp`, deriving the suffix through the writer so the two cannot
-  drift. It **never touches a live snapshot**.
+  `<label>.json.tmp` — the legacy and hard-crash migration, given the rule above.
+  `SESSION_TEMP_SUFFIX` is pinned against the writer by
+  `session_temp_suffix_matches_what_the_writer_leaves`, so the two cannot drift.
+  It **never touches a live snapshot**.
 
 **The state root is `<app_data_dir>`, or `<app_data_dir>/dev` under
 `cfg(debug_assertions)`.** `app_data_dir()` is keyed by the Tauri identifier, so a
@@ -357,6 +365,8 @@ the user's window. `state_root_from` in `standalone/src-tauri/src/lib.rs`.
 exactly one activation, so read-and-unlink has one home. Rust only bridges —
 `capture_agent_recovery` and `take_recovery_commands`, both
 `#[tauri::command(async)]` like every command reaching the blocking sidecar helper.
+**Every sidecar answer rides `respondAsync`**, so a throw comes back as `{ error }`
+rather than stranding the Rust invoke to its timeout.
 
 - **The record is `<state root>/recovery.json`**, owner-only, temp-then-rename,
   written on every detection rather than once at the end, because the quit budget
@@ -364,16 +374,20 @@ exactly one activation, so read-and-unlink has one home. Rust only bridges —
 - **`beginCapture` clears the previous record once per sidecar process and merges
   after**, so a teardown that captures nothing cannot carry a stale record forward
   and a second window's capture cannot wipe the first's.
-- **`take` is claimed once**, during `TauriAdapter.init()` and before the restore
-  reads it, for every pane id across the saved Window's Workspaces.
+- **`take` is claimed once**, started by `TauriAdapter.init()` for every pane id
+  across the saved Window's Workspaces. `init()` does not await it: the boot
+  awaits `recoveryReady` before planning, and only on the branch that can
+  cold-restore, so the round trip overlaps the rest of boot.
 - **Without a state directory the store is memory-only**, warning once.
 
-The detection is `lib/src/host/recovery-capture.ts`, shared with the VS Code
-extension host (`docs/specs/vscode.md` → "Capturing agent recovery"); the primitives
-it runs on — `liveIds`, `receivedChars`, `outputSince` — are
-`standalone/sidecar/pty-core.js`'s. Source of truth: `createRecoveryStore` in
-`lib/src/host/recovery-store.ts`; `pty:captureRecovery` / `recovery:take` in
-`standalone/sidecar/main.js`.
+Both the detection (`lib/src/host/recovery-capture.ts`) and the record store
+(`lib/src/host/recovery-store.ts`) are shared with the VS Code extension host
+(`docs/specs/vscode.md` → "Capturing agent recovery"); the primitives the detection
+runs on — `liveIds`, `receivedChars`, `outputSince` — are
+`standalone/sidecar/pty-core.js`'s. **The browser-dev harness claims but never
+captures**: a reload there is a live resume over PTYs that survive it, so pressing
+`^C` would interrupt work that is still running. Source of truth:
+`pty:captureRecovery` / `recovery:take` in `standalone/sidecar/main.js`.
 
 **The notepad archive is outside `sessions/`, and outside the state root** —
 `<app_data_dir>/notepad-archive-v1.json`, its own compare-and-swap commands and
@@ -515,8 +529,10 @@ able to stop the quit (`docs/specs/notepad.md` -> "Standalone quit"):
 3. `gracefulKillAllPtys` — SIGTERM every PTY, resolving early once all exit and
    their final output has had a grace tick to reach the webview (§Rust ↔ sidecar
    bridge).
-4. `requestSessionFlush` — flush the post-exit Session state. **Must retain the
-   previously persisted CWD when `getCwd` returns null for a dead PTY.**
+4. `requestSessionFlush({ probeCwd: false })` — flush the post-exit Session state.
+   **Must skip the cwd probe and retain the previously persisted CWD**: every
+   probe against a dead PTY answers null and is discarded for that value anyway
+   (`docs/specs/transport.md` → "Persisted session types").
 5. `flushWindowSession` — the Workspaces' records become one Window blob
    (`docs/specs/transport.md` → "Persisted session types"); a debounce timer still
    pending at exit would otherwise lose the final save.
diff --git a/docs/specs/transport.md b/docs/specs/transport.md
index 42bce7f89..929ed3c9e 100644
--- a/docs/specs/transport.md
+++ b/docs/specs/transport.md
@@ -46,7 +46,7 @@ The bridge is a transport shim over the same sidecar protocol, not a second PTY
 
 **An unauthorized caller gets the same `404 not found` as an unknown path**, so the port does not identify itself. The harness prints the token and a ready-made `curl` on startup.
 
-The harness **may omit** native-only desktop chrome (window controls, update checks) but **must preserve** every `PlatformAdapter` contract the app uses — PTY, control-request, clipboard, iframe-proxy, Burrow, agent-browser. It **must mirror** standalone's Session-persistence answer ("The governing rule"): the same `persistsSession`, one `PersistedWindow` per window (in `localStorage` rather than the Rust file store), and the same agent-recovery capture against a per-run temp state directory. **Tauri APIs must not be required at static module-evaluation time** when `VITE_DORMOUSE_BROWSER_DEV_HOST` is set — a normal browser loads the page, not the Tauri WebView.
+The harness **may omit** native-only desktop chrome (window controls, update checks) but **must preserve** every `PlatformAdapter` contract the app uses — PTY, control-request, clipboard, iframe-proxy, Burrow, agent-browser. It **must mirror** standalone's Session-persistence answer ("The governing rule"): the same `persistsSession`, one `PersistedWindow` per window (in `localStorage` rather than the Rust file store), and the same agent-recovery *claim* against a per-run temp state directory. **The harness must never capture**: a reload there is a live resume over PTYs that survive it, and capture is a quit-only step (`docs/specs/standalone.md` → "Agent recovery"). **Tauri APIs must not be required at static module-evaluation time** when `VITE_DORMOUSE_BROWSER_DEV_HOST` is set — a normal browser loads the page, not the Tauri WebView.
 
 Source of truth: `standalone/scripts/dev-agent-browser.mjs`, `standalone/scripts/dev-host-guard.mjs`, `standalone/src/browser-sidecar-host.ts`, `standalone/src/browser-sidecar-adapter.ts`; `stepBurrow` in `scripts/pairing-walkthrough/steps.mjs`.
 
@@ -155,9 +155,11 @@ OSC parsing/stripping rules for those rows, and the rule that **only the process
 
 **Each mounted Workspace publishes its `PersistedSession` to a Window collector**, which orders them by the Workspace store and writes the whole Window through one debounced writer the host installs at boot. **A Workspace with neither a published nor a boot-seeded session is dropped rather than written empty**, so a snapshot taken mid-boot cannot replace a restored Workspace with a blank one. **A Workspace's save compares against its own previous record** — seeded from disk until its Wall publishes — never the Window's active one, or a dead PTY's retained cwd and alert would come from the wrong Workspace. **Reordering, renaming, or switching the active Workspace writes too**: each changes the blob with no Session changing. A `PersistedWorkspace` is a `WorkspaceId`, a user-facing `name`, and that Workspace's `PersistedSession`. The top-level snapshot is a `PersistedWindow` (its own `version: 1`) wrapping v3 sessions: the ordered `PersistedWorkspace` list plus the active `WorkspaceId`. **VS Code does not use it** — each webview persists one bare `PersistedSession`, its single Workspace, through its own per-surface state API (`docs/specs/vscode.md`).
 
-**The Window wrapping lives at the standalone adapter boundary, never in the shared save/restore code.** `window-persistence.ts` owns the JSON and the storage slot over a `SessionKeyValueStore` synchronous slot (`docs/specs/standalone.md` → Persistence); the shared save/restore code still operates on a bare `PersistedSession`, which the boot hands it per Workspace. **`getState` answers nothing on a Window-persisting adapter** — its blob is a Window and every shared reader of `getState` wants a Session — so the boot reads `getWindowState` instead. **A blob written before standalone persisted Windows is wrapped as the window's one Workspace**; that is the only migration.
+**The Window wrapping lives at the standalone adapter boundary, never in the shared save/restore code.** `window-persistence.ts` owns the JSON and the storage slot over a `SessionKeyValueStore` synchronous slot (`docs/specs/standalone.md` → Persistence); the shared save/restore code still operates on a bare `PersistedSession`, which the boot hands it per Workspace. **A Window-persisting adapter answers through `getWindowState` / `saveWindowState`, and answers nothing on the bare-Session `getState` / `saveState` pair** — its blob is a Window and every shared reader of `getState` wants a Session. **A blob written before standalone persisted Windows is wrapped as the window's one Workspace**; that is the only migration.
 
-Source of truth: `getWindowSnapshot` / `seedWindowSession` / `installWindowSessionWriter` / `flushWindowSession` in `lib/src/lib/window-session-aggregator.ts`; `SaveSink` in `lib/src/lib/session-save.ts`; `loadWindowState` / `saveWindowState` in `lib/src/lib/window-persistence.ts`; `restoreWindow` in `standalone/src/main.tsx`.
+**A save probes every terminal pane's cwd in one host round trip where the adapter offers `getCwds`**, falling back to one `getCwd` per id: standalone resolves them with a synchronous process scan on the sidecar's only event loop, so N panes must cost one scan rather than N. **A flush may say `probeCwd: false`** and keep each pane's previously persisted cwd — the post-kill quit flush, where every probe answers null and is discarded for that value anyway (`docs/specs/standalone.md` → "Quit flow"). Pinned by `lib/src/lib/session-save.test.ts`.
+
+Source of truth: `getWindowSnapshot` / `seedWindowSession` / `installWindowSessionWriter` / `flushWindowSession` in `lib/src/lib/window-session-aggregator.ts`; `SaveSink` / `SaveOptions` in `lib/src/lib/session-save.ts`; `loadWindowState` / `saveWindowState` in `lib/src/lib/window-persistence.ts`; `restoreWindow` in `standalone/src/main.tsx`.
 
 **A corrupt save must never block startup.** Every read goes through `readPersistedSession()` / `readPersistedWindow()`, which accept the canonical parsed object *or* a JSON-stringified blob (host state APIs may hand back the inner serialized string) and log-and-discard anything present but unreadable. `readPersistedWindow` additionally drops Workspaces whose inner session is unreadable and repairs a dangling `activeWorkspaceId` to the first Workspace.
 
@@ -165,7 +167,7 @@ Source of truth: `getWindowSnapshot` / `seedWindowSession` / `installWindowSessi
 
 *It is not part of the persisted session.* `PersistedPane` carries no `resumeCommand`, and `normalizeSessionV3` strips one out of a pre-upgrade blob as it strips a transcript. **Host-owned and single-use, it travels out of band**: the host puts `surfaceId -> invocation` on the webview's boot payload, the renderer reads it through `PlatformAdapter.getRecoveryCommands()`, and an adapter whose host captures nothing omits the method (rationale).
 
-*One writer per host, exactly one read.* The writer is that host's teardown — the VS Code extension host's `deactivate()` (`docs/specs/vscode.md` → "Capturing agent recovery") and the Tauri sidecar's quit capture (`docs/specs/standalone.md` → "Agent recovery"); the renderer save path never derives one. Both run the same detection machine, `captureAgentRecovery` in `lib/src/host/recovery-capture.ts`, over their own PTY buffers. **Cold restore is the one reader — resume never reads it**, the agent there still being Live. The record is read and unlinked on the first claim of a host process, **destructively even on a parse failure**, so the durable copy is gone before any webview is served; within that process **each container claims only the entries matching its own saved pane ids** (rationale). **A record older than 7 days is discarded unread.**
+*One writer per host, exactly one read.* The writer is that host's teardown — the VS Code extension host's `deactivate()` (`docs/specs/vscode.md` → "Capturing agent recovery") and the Tauri sidecar's quit capture (`docs/specs/standalone.md` → "Agent recovery"); the renderer save path never derives one. Both run the same detection machine, `captureAgentRecovery` in `lib/src/host/recovery-capture.ts`, over their own PTY buffers, and keep the record through the same `createRecoveryStore`. **Cold restore is the one reader — resume never reads it**, the agent there still being Live. The record is read and unlinked on the first claim of a host process, **destructively even on a parse failure**, so the durable copy is gone before any webview is served; within that process **each container claims only the entries matching its own saved pane ids** (rationale). **A record older than 7 days is discarded unread.**
 
 *Detection.* Executable-string constraints:
 
diff --git a/docs/specs/vscode.md b/docs/specs/vscode.md
index baabe0b8e..73783692e 100644
--- a/docs/specs/vscode.md
+++ b/docs/specs/vscode.md
@@ -139,8 +139,8 @@ the kill, and the shutdown budget is not ours (rationale), so the one step whose
 data cannot be reconstructed afterwards runs before the ones that can (cwd
 re-reads, alert merges). `captureAgentRecoveryCommands` writes `^C` into every
 live PTY, waits bounded, scans those buffers, and records the invocation to
-`recovery.json` under `context.storageUri`, **written synchronously and replaced
-temp-then-rename**. **Never `workspaceState`**, whose SQLite flush is already
+`recovery.json` under `context.storageUri`, **written synchronously, owner-only,
+and replaced temp-then-rename**. **Never `workspaceState`**, whose SQLite flush is already
 tearing down (rationale), and **never `PersistedPane.resumeCommand`**, which the
 step-4 flush would overwrite with the webview's stale copy. **The record is
 rewritten the moment each command is found and every wait is bounded**, so being
@@ -205,17 +205,21 @@ never opened would otherwise auto-run a week-old invocation on some much later
 restore. A missing hint is ordinary: `CLAUDE_CODE_CHILD_SESSION` in a pane's env
 disables transcript saving in claude, which then prints none (rationale).
 
-**The machine is shared, the record is not.** Every rule above lives in
-`captureAgentRecovery` (`lib/src/host/recovery-capture.ts`), over four primitives
-each host supplies — the live id set, interrupt, a monotonic received count, and the
-output since a mark — so the Tauri sidecar runs the same detection
-(`docs/specs/standalone.md` → "Agent recovery"). What stays here is where the record
-lives and how it is written; VS Code's is a plain file, written synchronously,
-because `workspaceState` batches its flush and `deactivate()` outruns it (rationale).
+**Both halves are shared with the Tauri sidecar.** Every detection rule above
+lives in `captureAgentRecovery` (`lib/src/host/recovery-capture.ts`), over four
+primitives each host supplies — the live id set, interrupt, a monotonic received
+count, and the output since a mark — and the record itself is
+`createRecoveryStore` (`docs/specs/standalone.md` → "Agent recovery"), so one
+format, one destructive read, and one set of file modes serve both. What stays
+here is which PTYs the extension host offers them and which directory the store
+writes into: `storageUri`, falling back to `globalStorageUri`. It is a plain file
+written synchronously because `workspaceState` batches its flush and
+`deactivate()` outruns it (rationale).
 
 Source of truth: `captureAgentRecoveryCommands` and `takeRecoveryCommands` in
 `vscode-ext/src/session-state.ts`, `captureAgentRecovery` in
-`lib/src/host/recovery-capture.ts`, `interrupt` in `vscode-ext/src/pty-manager.ts`.
+`lib/src/host/recovery-capture.ts`, `createRecoveryStore` in
+`lib/src/host/recovery-store.ts`, `interrupt` in `vscode-ext/src/pty-manager.ts`.
 
 ### Theme integration
 
diff --git a/lib/src/App.tsx b/lib/src/App.tsx
index e523e9568..7cf3940e0 100644
--- a/lib/src/App.tsx
+++ b/lib/src/App.tsx
@@ -41,11 +41,13 @@ export default function App({
   /** One boot record per Workspace; `multiWorkspace` only. */
   initialPlans?: WallBootPlans;
 }) {
+  // The chrome both branches take; only the boot record differs between them.
+  const shell = { baseboardNotice, dialogHost, enableBurrow };
   return (
     <ErrorBoundary>
       {multiWorkspace
-        ? <WorkspaceWindow {...boot} initialPlans={initialPlans} baseboardNotice={baseboardNotice} dialogHost={dialogHost} enableBurrow={enableBurrow} />
-        : <Wall {...boot} baseboardNotice={baseboardNotice} dialogHost={dialogHost} enableBurrow={enableBurrow} />}
+        ? <WorkspaceWindow {...boot} {...shell} initialPlans={initialPlans} />
+        : <Wall {...boot} {...shell} />}
 
       <ThemeDebuggerGlobal />
     </ErrorBoundary>
diff --git a/lib/src/components/Wall.tsx b/lib/src/components/Wall.tsx
index b01412e81..0f66934c2 100644
--- a/lib/src/components/Wall.tsx
+++ b/lib/src/components/Wall.tsx
@@ -1551,7 +1551,7 @@ export function Wall({
       return getTerminalInstance(id) !== null && !isReplaceableShell(id);
     }),
     runningCount: () => countRunningSessionsIn(memberSurfaceIds()),
-    flushPersistence: () => persistence.flush(),
+    flushPersistence: (options) => persistence.flush(options),
     closeAll,
     cancelClose,
     handleDorControl,
diff --git a/lib/src/components/WorkspaceWindow.tsx b/lib/src/components/WorkspaceWindow.tsx
index 4461d023a..ba2151358 100644
--- a/lib/src/components/WorkspaceWindow.tsx
+++ b/lib/src/components/WorkspaceWindow.tsx
@@ -4,6 +4,7 @@ import { Wall } from './Wall';
 import { listWallHandles } from './wall/wall-handles';
 import { getPlatform } from '../lib/platform';
 import { getWorkspacesSnapshot, subscribeToWorkspaces } from '../lib/workspace-store';
+import type { SessionFlushRequest } from '../lib/platform/types';
 import type { WallBootPlans, WallBootProps } from './wall/wall-types';
 
 /**
@@ -28,19 +29,21 @@ export function WorkspaceWindow({
   initialPlans?: WallBootPlans;
 }) {
   const { workspaces, activeId } = useSyncExternalStore(subscribeToWorkspaces, getWorkspacesSnapshot);
-  // Without per-Workspace plans the single boot record belongs to the Workspace
-  // that was active at first render. Either way a Workspace with no record takes
-  // Lath's fresh branch and spawns exactly one default-shell pane.
-  const bootWorkspaceIdRef = useRef(activeId);
-  const plansRef = useRef(initialPlans);
+  // One shape for both callers, fixed at first render: without per-Workspace
+  // plans the single boot record belongs to the Workspace that was active then.
+  // Either way a Workspace with no entry takes Lath's fresh branch and spawns
+  // exactly one default-shell pane.
+  const plansRef = useRef<WallBootPlans | null>(null);
+  const plans = (plansRef.current ??= initialPlans ?? { [activeId]: boot });
 
   // The Window, not each Wall, answers the host's flush request: the adapter
   // completes on the FIRST notification, so a per-Wall answer would let a quit
   // proceed once one Workspace had written.
   useEffect(() => {
     const platform = getPlatform();
-    const handleFlushRequest = (detail: { requestId: string }) => {
-      void Promise.all(listWallHandles().map((handle) => handle.flushPersistence().catch(() => undefined)))
+    const handleFlushRequest = (detail: SessionFlushRequest) => {
+      const options = { probeCwd: detail.probeCwd };
+      void Promise.all(listWallHandles().map((handle) => handle.flushPersistence(options).catch(() => undefined)))
         .finally(() => platform.notifySessionFlushComplete(detail.requestId));
     };
     platform.onRequestSessionFlush(handleFlushRequest);
@@ -56,9 +59,7 @@ export function WorkspaceWindow({
     >
       {workspaces.map((workspace) => {
         const isActive = workspace.id === activeId;
-        const plan = plansRef.current
-          ? plansRef.current[workspace.id] ?? {}
-          : workspace.id === bootWorkspaceIdRef.current ? boot : {};
+        const plan = plans[workspace.id] ?? {};
         return (
           <div
             key={workspace.id}
diff --git a/lib/src/components/wall/use-session-persistence.ts b/lib/src/components/wall/use-session-persistence.ts
index 6b5f4d9be..22370109f 100644
--- a/lib/src/components/wall/use-session-persistence.ts
+++ b/lib/src/components/wall/use-session-persistence.ts
@@ -1,9 +1,9 @@
 import { useCallback, useEffect, useMemo, useRef, type RefObject } from 'react';
 import { pasteFilePaths } from '../../lib/clipboard';
 import { getPlatform } from '../../lib/platform';
-import { saveSession, type SaveSink } from '../../lib/session-save';
+import { saveSession, type SaveOptions, type SaveSink } from '../../lib/session-save';
 import { createSessionDirtyTracker } from '../../lib/session-dirty';
-import { previousWorkspaceSession, publishWorkspaceSession } from '../../lib/window-session-aggregator';
+import { previousWorkspaceSession, publishWorkspaceSession, SESSION_SAVE_DEBOUNCE_MS } from '../../lib/window-session-aggregator';
 import {
   subscribeToActivity,
   subscribeToTerminalPaneState,
@@ -13,10 +13,11 @@ import { surfaceKindFromParams } from './browser-surface';
 import type { LathWallEngine } from './lath-wall-engine';
 import type { DooredItem, WallSelectionKind } from './wall-types';
 import type { PersistedDoor, PersistedSurfaceRefs, WorkspaceId } from '../../lib/session-types';
+import type { SessionFlushRequest } from '../../lib/platform/types';
 
 export interface SessionPersistenceHandle {
   /** Persist immediately, awaiting the whole queued pipeline. */
-  flush: () => Promise<void>;
+  flush: (options?: SaveOptions) => Promise<void>;
 }
 
 export function useSessionPersistence({
@@ -99,17 +100,17 @@ export function useSessionPersistence({
     return { panes, doors, lathLayout: lath.serializeLayout(), surfaceRefs };
   }, [lath, doorsRef, surfaceRefsForSave]);
 
-  const doSave = useCallback((): Promise<void> => {
+  const doSave = useCallback((options?: SaveOptions): Promise<void> => {
     const { panes, doors, lathLayout, surfaceRefs } = collect();
-    return saveSession(getPlatform(), panes, doors, lathLayout, surfaceRefs?.refs, surfaceRefs?.next, sink);
+    return saveSession(getPlatform(), panes, doors, lathLayout, surfaceRefs?.refs, surfaceRefs?.next, sink, options);
   }, [collect, sink]);
 
-  const persistSessionNow = useCallback(async (): Promise<void> => {
+  const persistSessionNow = useCallback(async (options?: SaveOptions): Promise<void> => {
     const runSave = (): Promise<void> => {
       pendingSaveNeededRef.current = false;
       // Clear dirty only on a fulfilled write (.then, not .finally).
       const token = trackerRef.current.beginSave();
-      const savePromise = doSave()
+      const savePromise = doSave(options)
         .then(() => {
           trackerRef.current.completeSave(token);
         })
@@ -146,12 +147,12 @@ export function useSessionPersistence({
 
   // Never gated on the dirty tracker — the correctness net for dirty-trigger
   // gaps (e.g. a program calling chdir() silently produces no event).
-  const flushSessionSave = useCallback((): Promise<void> => {
+  const flushSessionSave = useCallback((options?: SaveOptions): Promise<void> => {
     if (sessionSaveTimerRef.current) {
       clearTimeout(sessionSaveTimerRef.current);
       sessionSaveTimerRef.current = null;
     }
-    return persistSessionNow();
+    return persistSessionNow(options);
   }, [persistSessionNow]);
 
   const scheduleSessionSave = useCallback(() => {
@@ -160,7 +161,7 @@ export function useSessionPersistence({
     sessionSaveTimerRef.current = setTimeout(() => {
       sessionSaveTimerRef.current = null;
       void persistSessionNow().catch(() => undefined);
-    }, 500);
+    }, SESSION_SAVE_DEBOUNCE_MS);
   }, [persistSessionNow]);
 
   useEffect(() => {
@@ -180,8 +181,8 @@ export function useSessionPersistence({
     // Only a bare Wall answers the host directly; a Workspace Wall's answer is
     // `WorkspaceWindow`'s, which flushes every Workspace before notifying (the
     // adapter completes on the first notification).
-    const handleSessionFlushRequest = (detail: { requestId: string }) => {
-      void flushSessionSave()
+    const handleSessionFlushRequest = (detail: SessionFlushRequest) => {
+      void flushSessionSave({ probeCwd: detail.probeCwd })
         .catch(() => undefined)
         .finally(() => {
           platform.notifySessionFlushComplete(detail.requestId);
@@ -204,8 +205,7 @@ export function useSessionPersistence({
     // unfiltered listener would rebuild every idle Workspace's record — a
     // `getCwd` per pane — whenever any Workspace changed. A notification with no
     // id is a store-wide reset, which every Wall must take.
-    const ownsChange = (id?: string) => id === undefined || ownsSurface(id);
-    const markDirtyFor = (id?: string) => { if (ownsChange(id)) markDirty(); };
+    const markDirtyFor = (id?: string) => { if (id === undefined || ownsSurface(id)) markDirty(); };
     const unsubActivity = subscribeToActivity(markDirtyFor);
     const unsubPaneState = subscribeToTerminalPaneState(markDirtyFor);
 
diff --git a/lib/src/components/wall/wall-handles.ts b/lib/src/components/wall/wall-handles.ts
index 87aa395dd..17b1f1f89 100644
--- a/lib/src/components/wall/wall-handles.ts
+++ b/lib/src/components/wall/wall-handles.ts
@@ -1,4 +1,5 @@
 import type { WorkspaceId } from '../../lib/session-types';
+import type { SaveOptions } from '../../lib/session-save';
 import type { CloseSurfaceMode } from './wall-types';
 import type { DorControlRequest } from './use-dor-control';
 
@@ -18,7 +19,8 @@ export interface WallHandle {
    *  gate, alongside `runningCount`). */
   hasTouchedSurfaces(): boolean;
   runningCount(): number;
-  flushPersistence(): Promise<void>;
+  /** Persist now. `probeCwd: false` skips the cwd re-read (`SessionFlushRequest`). */
+  flushPersistence(options?: SaveOptions): Promise<void>;
   /** Close every member Surface through the closure coordinator. Resolves null
    *  once the Wall is empty, else the first refusal's message with the Workspace
    *  left as it was. */
diff --git a/lib/src/components/wall/wall-types.ts b/lib/src/components/wall/wall-types.ts
index bcabd8af5..2bdc3505a 100644
--- a/lib/src/components/wall/wall-types.ts
+++ b/lib/src/components/wall/wall-types.ts
@@ -1,5 +1,6 @@
 import type { SurfaceKind } from 'dor/commands/types';
 import type { BrowserDisplayMode } from './agent-browser-screen';
+import type { ReconnectResult } from '../../lib/reconnect';
 import type { PersistedDoor, PersistedSurfaceRefs, WorkspaceId } from '../../lib/session-types';
 
 /** A minimized Surface's baseboard chip, at RUNTIME: an identity plus the Lath
@@ -65,6 +66,18 @@ export interface WallBootProps {
  *  boots fresh. */
 export type WallBootPlans = Record<WorkspaceId, WallBootProps>;
 
+/** A resume/restore plan as the boot props that carry it, so every host builds
+ *  the same record from `resumeOrRestoreFrom` (`lib/src/lib/reconnect.ts`). */
+export function wallBootFromResult(result: ReconnectResult): WallBootProps {
+  return {
+    initialPaneIds: result.paneIds,
+    restoredLathLayout: result.lathLayout,
+    initialDoors: result.doors,
+    initialSurfaceRefs: result.surfaceRefs,
+    initialSurfaceRefsNext: result.surfaceRefsNext,
+  };
+}
+
 export type WallEvent =
   | { type: 'modeChange'; mode: WallMode }
   | { type: 'zoomChange'; zoomed: boolean }
diff --git a/lib/src/host/recovery-capture.ts b/lib/src/host/recovery-capture.ts
index 121ef7f2e..753e2aeaa 100644
--- a/lib/src/host/recovery-capture.ts
+++ b/lib/src/host/recovery-capture.ts
@@ -41,6 +41,13 @@ export const QUIET_BEFORE_RETRY_MS = 200;
 // same thread that has to deliver the hints being polled for.
 const ASK_TAIL_CHARS = 8192;
 
+// How far back of already-scanned output each tick re-reads, so a scan window is
+// bounded by what arrived since the last tick rather than by everything since the
+// interrupt. It has to cover both things a scan looks for across a tick boundary:
+// the longest recognizable invocation, and the ask phrase's tail window. The ask
+// window is by far the larger of the two, so it sets the overlap.
+const SCAN_OVERLAP_CHARS = ASK_TAIL_CHARS;
+
 /** How long the whole capture may take by default. */
 export const DEFAULT_RECOVERY_WAIT_MS = 1300;
 
@@ -82,7 +89,9 @@ export interface RecoveryCaptureOptions {
  *  `__proto__` refuses to be stored at all. */
 export const noCommands = (): Record<string, string> => Object.create(null);
 
-const silent: RecoveryLog = { info: () => {}, error: () => {} };
+/** The default log for every module in this scope: recovery must never require
+ *  one to run. */
+export const silent: RecoveryLog = { info: () => {}, error: () => {} };
 
 /**
  * Press, wait, press again where it helps, and report what each pane printed.
@@ -125,6 +134,10 @@ export async function captureAgentRecovery(
   // for.
   const startMark = new Map(liveIds.map((id) => [id, host.receivedChars(id)]));
   const lastMark = new Map(startMark);
+  // How far each pane has already been scanned. A tick re-reads only
+  // `SCAN_OVERLAP_CHARS` behind it, so scanning costs what arrived since the last
+  // tick instead of re-joining and re-stripping everything since the interrupt.
+  const scannedTo = new Map(startMark);
   // Seeded once the interrupt is acked, not here — see `interruptedAt`.
   const lastGrewAt = new Map<string, number>();
 
@@ -138,14 +151,18 @@ export async function captureAgentRecovery(
     asked.clear();
     for (const id of pending()) {
       // Recovery commands are executable state, so only trust bytes that arrived
-      // after this teardown started interrupting the pane. Scanning the existing
-      // buffer would let an old launch echo or a previous agent hint run on the
-      // next restore. If bounded scrollback evicted bytes past the mark in the
-      // meantime, this can only return less than the pane printed; it cannot
-      // expose stale output as fresh.
-      const outputSinceInterrupt = host.outputSince(id, startMark.get(id) ?? Infinity);
-      if (!outputSinceInterrupt) continue;
-      const detected = detectResumeCommand(outputSinceInterrupt);
+      // after this teardown started interrupting the pane: the window never
+      // reaches back past `startMark`. Scanning the existing buffer would let an
+      // old launch echo or a previous agent hint run on the next restore. If
+      // bounded scrollback evicted bytes past the mark in the meantime, this can
+      // only return less than the pane printed; it cannot expose stale output as
+      // fresh.
+      const start = startMark.get(id) ?? Infinity;
+      const from = Math.max(start, (scannedTo.get(id) ?? start) - SCAN_OVERLAP_CHARS);
+      const scanned = host.outputSince(id, from);
+      scannedTo.set(id, host.receivedChars(id));
+      if (!scanned) continue;
+      const detected = detectResumeCommand(scanned);
       if (detected) {
         commands[id] = detected;
         log.info(`[recovery]   ${id} -> ${detected} (+${now() - started}ms)`);
@@ -154,7 +171,7 @@ export async function captureAgentRecovery(
       }
       // Strip presentation controls first — claude renders that prompt inside its
       // TUI, so the raw buffer can carry escapes through the phrase.
-      if (ASKS_FOR_SECOND_PRESS.test(stripTerminalControls(outputSinceInterrupt.slice(-ASK_TAIL_CHARS)))) {
+      if (ASKS_FOR_SECOND_PRESS.test(stripTerminalControls(scanned.slice(-ASK_TAIL_CHARS)))) {
         asked.add(id);
       }
     }
diff --git a/lib/src/host/recovery-store.ts b/lib/src/host/recovery-store.ts
index 942bedd24..7b9fd3d44 100644
--- a/lib/src/host/recovery-store.ts
+++ b/lib/src/host/recovery-store.ts
@@ -12,7 +12,7 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { noCommands, type RecoveryLog } from './recovery-capture';
+import { noCommands, silent, type RecoveryLog } from './recovery-capture';
 
 const FILE_NAME = 'recovery.json';
 
@@ -41,8 +41,6 @@ export interface RecoveryStore {
   readonly persistent: boolean;
 }
 
-const silent: RecoveryLog = { info: () => {}, error: () => {} };
-
 /**
  * The record under `dir`, or a memory-only store when no directory was given.
  *
diff --git a/lib/src/host/recovery.ts b/lib/src/host/recovery.ts
index 36e6aa4b5..87b709bf3 100644
--- a/lib/src/host/recovery.ts
+++ b/lib/src/host/recovery.ts
@@ -13,3 +13,6 @@ export { captureAgentRecovery, DEFAULT_RECOVERY_WAIT_MS, noCommands } from './re
 export type { RecoveryCaptureOptions, RecoveryHost, RecoveryLog } from './recovery-capture';
 export { createRecoveryStore, RECOVERY_MAX_AGE_MS } from './recovery-store';
 export type { RecoveryStore } from './recovery-store';
+// Not recovery's own, but the sidecar's only route to a lib module: `pty-core.js`
+// takes it as an injected option so its `node --test` suite needs no bundle.
+export { sliceSince } from './replay-buffer';
diff --git a/lib/src/host/replay-buffer.test.ts b/lib/src/host/replay-buffer.test.ts
new file mode 100644
index 000000000..acfab3bc5
--- /dev/null
+++ b/lib/src/host/replay-buffer.test.ts
@@ -0,0 +1,68 @@
+import { describe, expect, it } from 'vitest';
+import { sliceSince } from './replay-buffer';
+
+/** A buffer that trims off the front at `cap`, exactly as both hosts do. */
+function buffer(cap: number) {
+  const chunks: string[] = [];
+  let held = 0;
+  let received = 0;
+  return {
+    write(data: string) {
+      chunks.push(data);
+      held += data.length;
+      received += data.length;
+      while (chunks.length > 1 && held - chunks[0].length >= cap) held -= chunks.shift()!.length;
+      if (held > cap) { chunks[0] = chunks[0].slice(held - cap); held = cap; }
+    },
+    get received() { return received; },
+    since(mark: number) { return sliceSince(chunks, held, received, mark); },
+  };
+}
+
+describe('sliceSince', () => {
+  it('answers everything after the mark', () => {
+    const buf = buffer(200_000);
+    const mark = buf.received;
+    buf.write('hello');
+    expect(buf.since(mark)).toBe('hello');
+  });
+
+  it('joins only the chunks that span the mark', () => {
+    const buf = buffer(200_000);
+    buf.write('before ');
+    const mark = buf.received;
+    buf.write('one ');
+    buf.write('two');
+    expect(buf.since(mark)).toBe('one two');
+  });
+
+  it('slices into the chunk the mark falls inside', () => {
+    const buf = buffer(200_000);
+    buf.write('abcdef');
+    expect(buf.since(2)).toBe('cdef');
+  });
+
+  it('clamps a mark evicted off the front to what is still held', () => {
+    const buf = buffer(200_000);
+    const before = buf.received;
+    for (let i = 0; i < 30; i++) buf.write('x'.repeat(10_000));
+    expect(buf.received).toBe(before + 300_000);
+
+    // Less than the pane printed, never stale bytes offered as fresh.
+    const since = buf.since(before);
+    expect(since.length).toBeLessThanOrEqual(200_000);
+    expect(since.length).toBeGreaterThan(0);
+    expect(since).toBe('x'.repeat(since.length));
+  });
+
+  it('answers empty for a mark at or past the head', () => {
+    const buf = buffer(200_000);
+    buf.write('hello');
+    expect(buf.since(buf.received)).toBe('');
+    expect(buf.since(buf.received + 10)).toBe('');
+  });
+
+  it('answers empty for an empty buffer', () => {
+    expect(sliceSince([], 0, 0, 0)).toBe('');
+  });
+});
diff --git a/lib/src/host/replay-buffer.ts b/lib/src/host/replay-buffer.ts
new file mode 100644
index 000000000..19e7c41a0
--- /dev/null
+++ b/lib/src/host/replay-buffer.ts
@@ -0,0 +1,45 @@
+/**
+ * The chunked replay buffer both Node-resident hosts keep per PTY, and the one
+ * read the agent-recovery capture makes of it (docs/specs/transport.md ->
+ * "Persisted session").
+ *
+ * Each host owns its own buffer record — `ptyBuffers` in
+ * `vscode-ext/src/pty-manager.ts`, `sessions` in
+ * `standalone/sidecar/pty-core.js` — and keeps only the lookup; the slicing
+ * arithmetic below is shared, because getting the eviction clamp wrong in one of
+ * them would silently hand the capture stale output.
+ */
+
+/**
+ * The output received after a `receivedChars` mark, clamped to what the bounded
+ * buffer still holds.
+ *
+ * Joins only the chunks that span the mark, so repeatedly reading a pane's
+ * recent tail costs the tail, not the buffer.
+ *
+ * @param chunks        the buffer, oldest first
+ * @param heldChars     total length of `chunks` (a trim decrements it)
+ * @param receivedChars everything ever received, never decremented
+ * @param mark          a previous `receivedChars` value
+ */
+export function sliceSince(
+  chunks: readonly string[],
+  heldChars: number,
+  receivedChars: number,
+  mark: number,
+): string {
+  // Chunk eviction can have carried the mark off the front; the oldest char the
+  // buffer still holds is the furthest back this can honestly answer.
+  const oldestHeld = receivedChars - heldChars;
+  const wanted = receivedChars - Math.max(mark, oldestHeld);
+  if (wanted <= 0) return '';
+  const tail: string[] = [];
+  let held = 0;
+  for (let i = chunks.length - 1; i >= 0 && held < wanted; i--) {
+    const chunk = chunks[i];
+    tail.push(chunk);
+    held += chunk.length;
+  }
+  const joined = tail.reverse().join('');
+  return held > wanted ? joined.slice(held - wanted) : joined;
+}
diff --git a/lib/src/lib/feature-flags.test.ts b/lib/src/lib/feature-flags.test.ts
new file mode 100644
index 000000000..b662ec61a
--- /dev/null
+++ b/lib/src/lib/feature-flags.test.ts
@@ -0,0 +1,45 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { AB_DEBUG_LOGS_FLAG_KEY, isAbDebugLogsEnabled } from './feature-flags';
+
+function stubLocalStorage(): Map<string, string> {
+  const store = new Map<string, string>();
+  vi.stubGlobal('localStorage', {
+    getItem: (k: string) => (store.has(k) ? store.get(k)! : null),
+    setItem: (k: string, v: string) => store.set(k, v),
+    removeItem: (k: string) => store.delete(k),
+  });
+  return store;
+}
+
+describe('feature-flags: agent-browser debug logs', () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  it('is off by default', () => {
+    stubLocalStorage();
+    expect(isAbDebugLogsEnabled()).toBe(false);
+  });
+
+  it('reads the flag out of localStorage', () => {
+    const store = stubLocalStorage();
+    store.set(AB_DEBUG_LOGS_FLAG_KEY, 'true');
+    expect(isAbDebugLogsEnabled()).toBe(true);
+    store.set(AB_DEBUG_LOGS_FLAG_KEY, 'yes');
+    expect(isAbDebugLogsEnabled()).toBe(false);
+  });
+
+  describe('without localStorage', () => {
+    beforeEach(() => vi.stubGlobal('localStorage', undefined));
+    it('treats the flag as disabled and never throws', () => {
+      expect(isAbDebugLogsEnabled()).toBe(false);
+    });
+  });
+
+  describe('with a throwing localStorage', () => {
+    beforeEach(() => vi.stubGlobal('localStorage', {
+      get getItem(): never { throw new Error('blocked by site settings'); },
+    }));
+    it('treats the flag as disabled and never throws', () => {
+      expect(isAbDebugLogsEnabled()).toBe(false);
+    });
+  });
+});
diff --git a/lib/src/lib/platform/types.ts b/lib/src/lib/platform/types.ts
index 85ef6f804..f8ab94c55 100644
--- a/lib/src/lib/platform/types.ts
+++ b/lib/src/lib/platform/types.ts
@@ -7,7 +7,7 @@ import type { ShellEntry } from '../shell-defaults';
 // share it without pulling this browser-typed module into a Node tsconfig.
 import type { IframeProxyResult } from './iframe-proxy-types';
 import type { NotepadArchivePort } from '../notepad/types';
-import type { PersistedAlertState } from '../session-types';
+import type { PersistedAlertState, PersistedWindow } from '../session-types';
 
 export interface PtyInfo {
   helper?: HelperIdentity;
@@ -174,6 +174,17 @@ export interface PtyDataDetail {
   textData?: string;
 }
 
+/**
+ * One host request for an immediate session save. `probeCwd: false` says the
+ * answer must not re-read any cwd: after the PTYs are killed every probe answers
+ * null and the record keeps its previous value anyway, so the round trips are
+ * pure teardown budget (`docs/specs/standalone.md` → "Quit flow"). Absent probes.
+ */
+export interface SessionFlushRequest {
+  requestId: string;
+  probeCwd?: boolean;
+}
+
 export interface PlatformAdapter {
   // Lifecycle
   init(): Promise<void>;
@@ -241,6 +252,14 @@ export interface PlatformAdapter {
    */
   getRecoveryCommands?(): Record<string, string>;
 
+  /**
+   * Resolves once `getRecoveryCommands` can be read. The claim is a host round
+   * trip, so an adapter starts it during `init()` and the boot awaits it only on
+   * the branch that cold-restores (`standalone/src/main.tsx`). Absent means
+   * `getRecoveryCommands` is already answerable.
+   */
+  recoveryReady?: Promise<void>;
+
   /**
    * Seed a cold-restored Surface's persisted TODO/alert into the host's
    * `AlertManager`, so the freshly spawned PTY inherits the state its saved pane
@@ -255,6 +274,14 @@ export interface PlatformAdapter {
 
   // PTY queries
   getCwd(id: string): Promise<string | null>;
+  /**
+   * One answer per id, for the whole set a save is about to persist. Present
+   * where a host can resolve many at once: standalone probes cwds with a
+   * synchronous process scan on the sidecar's only event loop, so N panes must
+   * cost one scan rather than N (`docs/specs/transport.md` -> "Persisted
+   * session"). Absent falls back to `getCwd` per id.
+   */
+  getCwds?(ids: string[]): Promise<Record<string, string | null>>;
   /** TCP listening ports opened by this terminal's process tree (shell + descendants). */
   getOpenPorts(id: string): Promise<OpenPort[]>;
 
@@ -346,8 +373,8 @@ export interface PlatformAdapter {
   offPtyReplay(handler: (detail: { id: string; data: string }) => void): void;
 
   // Host-initiated session persistence
-  onRequestSessionFlush(handler: (detail: { requestId: string }) => void): void;
-  offRequestSessionFlush(handler: (detail: { requestId: string }) => void): void;
+  onRequestSessionFlush(handler: (detail: SessionFlushRequest) => void): void;
+  offRequestSessionFlush(handler: (detail: SessionFlushRequest) => void): void;
   notifySessionFlushComplete(requestId: string): void;
 
   // Alert management
@@ -392,6 +419,16 @@ export interface PlatformAdapter {
   saveState(state: unknown): void;
   getState(): unknown;
 
+  /**
+   * The Window slot, for the hosts that persist one (`docs/specs/transport.md` ->
+   * "Persisted session"). Separate from `saveState`/`getState` because the blob
+   * is a `PersistedWindow` and every shared reader of `getState` wants a bare
+   * `PersistedSession`. Both standalone adapters answer these; VS Code, which
+   * persists one Session per webview, omits them.
+   */
+  getWindowState?(): PersistedWindow | null;
+  saveWindowState?(snapshot: PersistedWindow): void;
+
   /**
    * The Surface notepad's archive store (docs/specs/notepad.md). Present on
    * every host that has a notepad — standalone (owner-only JSON under app
diff --git a/lib/src/lib/reconnect.test.ts b/lib/src/lib/reconnect.test.ts
index 388f828cf..ef70a9fdd 100644
--- a/lib/src/lib/reconnect.test.ts
+++ b/lib/src/lib/reconnect.test.ts
@@ -673,17 +673,13 @@ describe('resumeOrRestoreFrom', () => {
     expect(resumeOrRestoreFrom(platform, collected, {}).paneIds).toEqual(['slot-pane']);
   });
 
-  it('hands each plan its own recovery commands', async () => {
+  it('takes the host record on the cold-restore branch', async () => {
     const { platform, live: collected } = await live([]);
-    platform.getRecoveryCommands = vi.fn(() => ({ 'a1': 'whole-window' }));
+    platform.getRecoveryCommands = vi.fn(() => ({ 'a1': 'claude --resume abc' }));
 
-    resumeOrRestoreFrom(platform, collected, {
-      savedSession: savedFor('a1'),
-      recoveryCommands: { 'a1': 'claude --resume abc' },
-    });
+    resumeOrRestoreFrom(platform, collected, { savedSession: savedFor('a1') });
     expect(terminalRegistryMocks.restoreTerminal).toHaveBeenCalledWith(
       'a1', expect.objectContaining({ resumeCommand: 'claude --resume abc' }),
     );
-    expect(platform.getRecoveryCommands).not.toHaveBeenCalled();
   });
 });
diff --git a/lib/src/lib/reconnect.ts b/lib/src/lib/reconnect.ts
index cbe27ac6b..ecf99f9f0 100644
--- a/lib/src/lib/reconnect.ts
+++ b/lib/src/lib/reconnect.ts
@@ -43,8 +43,6 @@ export interface ResumePlanOptions {
    *  position, so a plan that takes one falls back to the flat live list, exactly
    *  as a single Wall does when a live PTY outruns its last save. */
   claimUnowned?: ReadonlySet<string>;
-  /** Single-use resume invocations already claimed for this plan's panes. */
-  recoveryCommands?: Record<string, string>;
 }
 
 /**
@@ -120,10 +118,7 @@ export function resumeOrRestoreFrom(
   const resumed = mine.length > 0 ? resumeLivePtys(mine, live.replay, saved) : null;
   if (resumed) return hydrateNotepad(platform, resumed);
 
-  const restored = restoreSession(platform, {
-    savedSession: saved,
-    ...(opts.recoveryCommands !== undefined ? { recoveryCommands: opts.recoveryCommands } : {}),
-  });
+  const restored = restoreSession(platform, { savedSession: saved });
   if (restored) {
     // Browser-only views have no PTY with which to prove a live resume. Their
     // host-memory mirror is that proof; an extension restart supplies null.
diff --git a/lib/src/lib/session-restore.test.ts b/lib/src/lib/session-restore.test.ts
index aa8919b1e..e23b43e4b 100644
--- a/lib/src/lib/session-restore.test.ts
+++ b/lib/src/lib/session-restore.test.ts
@@ -357,19 +357,15 @@ describe('restoreSession alert seeding', () => {
     };
     const platform = createPlatform(
       { version: 3, panes: [{ id: 'slot', title: 'Slot', cwd: null, untouched: false }] },
-      { given: 'from-the-window' },
+      { given: 'claude --resume xyz' },
     );
 
-    const result = restoreSession(platform, {
-      savedSession: given,
-      recoveryCommands: { given: 'claude --resume xyz' },
-    });
+    const result = restoreSession(platform, { savedSession: given });
 
     expect(result?.paneIds).toEqual(['given']);
     expect(terminalRegistryMocks.restoreTerminal).toHaveBeenCalledWith(
       'given', expect.objectContaining({ cwd: '/w', resumeCommand: 'claude --resume xyz' }),
     );
-    expect(platform.getRecoveryCommands).not.toHaveBeenCalled();
     // An explicit `null` is "no record", never a fallback to the slot.
     expect(restoreSession(platform, { savedSession: null })).toBeNull();
   });
diff --git a/lib/src/lib/session-restore.ts b/lib/src/lib/session-restore.ts
index fc3eb318c..a423e7ae9 100644
--- a/lib/src/lib/session-restore.ts
+++ b/lib/src/lib/session-restore.ts
@@ -22,13 +22,11 @@ export function persistedLathLayout(saved: PersistedSession): LathPersistedLayou
 }
 
 /** What a restore reads instead of the platform slot, so one Window can plan a
- *  cold restore per Workspace off one boot payload. Both default to the
- *  platform's own answer, which is what the single-Wall hosts still take. */
+ *  cold restore per Workspace off one boot payload. Defaults to the platform's
+ *  own answer, which is what the single-Wall hosts still take. */
 export interface RestoreSources {
   /** The record to restore; `undefined` reads the platform slot, `null` is "none". */
   savedSession?: PersistedSession | null;
-  /** Host-captured single-use resume invocations, already claimed for this plan. */
-  recoveryCommands?: Record<string, string>;
 }
 
 export function restoreSession(platform: PlatformAdapter, sources: RestoreSources = {}): RestoredSession | null {
@@ -50,7 +48,7 @@ export function restoreSession(platform: PlatformAdapter, sources: RestoreSource
   // would replay it (docs/specs/transport.md -> "Consuming it"). Restore-only —
   // the live-resume path in reconnect.ts never reaches here, because there the
   // agent is still Live and has nothing to resume.
-  const recoveryCommands = sources.recoveryCommands ?? platform.getRecoveryCommands?.() ?? {};
+  const recoveryCommands = platform.getRecoveryCommands?.() ?? {};
 
   for (const pane of saved.panes) {
     // Browser surfaces have no PTY or xterm; the persisted layout recreates them
diff --git a/lib/src/lib/session-save.test.ts b/lib/src/lib/session-save.test.ts
index 063ae5733..d1ed95c5a 100644
--- a/lib/src/lib/session-save.test.ts
+++ b/lib/src/lib/session-save.test.ts
@@ -344,4 +344,56 @@ describe('saveSession', () => {
 
     expect(platform.saveState).toHaveBeenCalled();
   });
+
+  describe('cwd probe', () => {
+    it('prefers the batch, in one call for every terminal pane', async () => {
+      const platform = createPlatform(null);
+      platform.getCwds = vi.fn(async () => ({ 'pane-a': '/a', 'pane-b': '/b' }));
+
+      await saveSession(platform, [
+        { id: 'pane-a', title: 'Pane A' },
+        { id: 'pane-b', title: 'Pane B' },
+        // A browser Surface has no PTY, so it is never probed.
+        { id: 'pane-web', title: 'localhost', surfaceType: 'browser' },
+      ]);
+
+      expect(platform.getCwds).toHaveBeenCalledTimes(1);
+      expect(platform.getCwds).toHaveBeenCalledWith(['pane-a', 'pane-b']);
+      expect(platform.getCwd).not.toHaveBeenCalled();
+      const saved = vi.mocked(platform.saveState).mock.calls[0]![0] as PersistedSession;
+      expect(saved.panes.map((pane) => [pane.id, pane.cwd])).toEqual([
+        ['pane-a', '/a'], ['pane-b', '/b'], ['pane-web', null],
+      ]);
+    });
+
+    it('falls back to one getCwd per pane where the host has no batch', async () => {
+      const platform = createPlatform(null);
+
+      await saveSession(platform, [
+        { id: 'pane-a', title: 'Pane A' },
+        { id: 'pane-b', title: 'Pane B' },
+      ]);
+
+      expect(platform.getCwd).toHaveBeenCalledTimes(2);
+      const saved = vi.mocked(platform.saveState).mock.calls[0]![0] as PersistedSession;
+      expect(saved.panes.map((pane) => pane.cwd)).toEqual(['/tmp/live', '/tmp/live']);
+    });
+
+    it('probes nothing and keeps the previous cwd when the flush says not to', async () => {
+      // The post-kill flush: every probe would answer null and be discarded for
+      // the previous record's value anyway.
+      const platform = createPlatform({
+        version: 3,
+        panes: [{ id: 'pane-a', title: 'Pane A', cwd: '/before-the-kill', untouched: false }],
+      });
+      platform.getCwds = vi.fn(async () => ({}));
+
+      await saveSession(platform, [{ id: 'pane-a', title: 'Pane A' }], [], undefined, undefined, undefined, undefined, { probeCwd: false });
+
+      expect(platform.getCwds).not.toHaveBeenCalled();
+      expect(platform.getCwd).not.toHaveBeenCalled();
+      const saved = vi.mocked(platform.saveState).mock.calls[0]![0] as PersistedSession;
+      expect(saved.panes[0].cwd).toBe('/before-the-kill');
+    });
+  });
 });
diff --git a/lib/src/lib/session-save.ts b/lib/src/lib/session-save.ts
index ada679e5a..ec59aa505 100644
--- a/lib/src/lib/session-save.ts
+++ b/lib/src/lib/session-save.ts
@@ -28,6 +28,31 @@ export interface SavePaneInput {
   surfaceType?: PersistedSurfaceType;
 }
 
+/** What one save may skip. See `SessionFlushRequest.probeCwd`. */
+export interface SaveOptions {
+  /** Re-read each terminal pane's cwd from the host. Defaults to true; `false`
+   *  keeps whatever the previous record held. */
+  probeCwd?: boolean;
+}
+
+/**
+ * Every terminal pane's cwd, in one host round trip where the adapter can do
+ * that. `null` means the caller asked not to probe at all, so each pane keeps
+ * its previous value.
+ */
+async function probeCwds(
+  platform: PlatformAdapter,
+  ids: string[],
+  probe: boolean,
+): Promise<Record<string, string | null> | null> {
+  if (!probe || ids.length === 0) return null;
+  if (platform.getCwds) return platform.getCwds(ids);
+  const answers = await Promise.all(ids.map((id) => platform.getCwd(id)));
+  const cwds: Record<string, string | null> = {};
+  ids.forEach((id, index) => { cwds[id] = answers[index]; });
+  return cwds;
+}
+
 /** Build one Workspace's `PersistedSession` from its live panes and Doors. */
 async function buildPersistedSession(
   platform: PlatformAdapter,
@@ -41,6 +66,7 @@ async function buildPersistedSession(
   // `surfaceRefs` so pruned (killed) entries never cause a number to be reused.
   surfaceRefsNext?: number,
   previous?: PersistedSession | null,
+  options: SaveOptions = {},
 ): Promise<PersistedSession> {
   const previousPanes = previousPaneMap(previous ?? null);
   const allPanes = new Map<string, { id: string; title: string; surfaceType: PersistedSurfaceType }>();
@@ -55,27 +81,32 @@ async function buildPersistedSession(
     allPanes.set(item.id, { id: item.id, title: item.title, surfaceType: item.component === 'browser' ? 'browser' : 'terminal' });
   }
 
-  const persisted: PersistedPane[] = await Promise.all(
-    [...allPanes.values()].map(async (pane) => {
-      const previousPane = previousPanes.get(pane.id);
-      if (pane.surfaceType === 'browser') {
-        // The activity store already holds this surface's TODO; persist it as the
-        // alert blob, projected to the persisted fields.
-        const activity = getActivity(pane.id);
-        return browserPersistedPane(pane, activity.todo ? toPersistedAlertState(activity) : null);
-      }
-
-      const liveAlert = getLivePersistedAlertState(pane.id);
-      const cwd = await platform.getCwd(pane.id);
-      return {
-        id: pane.id,
-        title: pane.title,
-        cwd: cwd ?? previousPane?.cwd ?? null,
-        untouched: isUntouched(pane.id),
-        alert: liveAlert ?? previousPane?.alert ?? null,
-      };
-    }),
+  // One probe for the whole set, before the per-pane build: a terminal pane's cwd
+  // is the only field here that costs a host round trip.
+  const cwds = await probeCwds(
+    platform,
+    [...allPanes.values()].filter((pane) => pane.surfaceType !== 'browser').map((pane) => pane.id),
+    options.probeCwd !== false,
   );
+
+  const persisted: PersistedPane[] = [...allPanes.values()].map((pane) => {
+    const previousPane = previousPanes.get(pane.id);
+    if (pane.surfaceType === 'browser') {
+      // The activity store already holds this surface's TODO; persist it as the
+      // alert blob, projected to the persisted fields.
+      const activity = getActivity(pane.id);
+      return browserPersistedPane(pane, activity.todo ? toPersistedAlertState(activity) : null);
+    }
+
+    const liveAlert = getLivePersistedAlertState(pane.id);
+    return {
+      id: pane.id,
+      title: pane.title,
+      cwd: cwds?.[pane.id] ?? previousPane?.cwd ?? null,
+      untouched: isUntouched(pane.id),
+      alert: liveAlert ?? previousPane?.alert ?? null,
+    };
+  });
   return {
     version: 3,
     panes: persisted,
@@ -97,15 +128,15 @@ export async function saveSession(
   surfaceRefsNext?: number,
   /** Defaults to the platform's own slot; a Workspace substitutes its own. */
   sink?: SaveSink,
+  options: SaveOptions = {},
 ): Promise<void> {
-  // Gate the work, not just the write. Building the record costs a `getCwd`
-  // round trip per terminal pane — on standalone that lands on a synchronous
-  // `lsof` in the sidecar — and a host that persists nothing would spend all of
-  // it on every debounced save, every 30s heartbeat, and twice more per quit,
-  // only for `saveState` to drop the result.
+  // Gate the work, not just the write. Building the record costs a cwd probe —
+  // on standalone a synchronous process scan in the sidecar — and a host that
+  // persists nothing would spend it on every debounced save, every 30s
+  // heartbeat, and twice more per quit, only for `saveState` to drop the result.
   if (platform.persistsSession === false) return;
   const previous = sink ? sink.previous() : readPersistedSession(platform.getState());
-  const session = await buildPersistedSession(platform, panes, doors, lathLayout, surfaceRefs, surfaceRefsNext, previous);
+  const session = await buildPersistedSession(platform, panes, doors, lathLayout, surfaceRefs, surfaceRefsNext, previous, options);
   if (sink) sink.publish(session);
   else platform.saveState(session);
 }
diff --git a/lib/src/lib/session-types.ts b/lib/src/lib/session-types.ts
index 83e28dcf2..e28644b23 100644
--- a/lib/src/lib/session-types.ts
+++ b/lib/src/lib/session-types.ts
@@ -288,17 +288,8 @@ export function readPersistedWindow(raw: unknown): PersistedWindow | null {
   return { version: 1, workspaces, activeWorkspaceId };
 }
 
-/** The active Workspace's session, or the first Workspace's as a fallback. */
-export function activeWorkspaceSession(window: PersistedWindow): PersistedSession {
-  const active = window.workspaces.find((ws) => ws.id === window.activeWorkspaceId);
-  return (active ?? window.workspaces[0]).session;
-}
-
-/** Return a copy of the Window with the active Workspace's session replaced,
- *  preserving every other Workspace. */
-export function replaceActiveSession(window: PersistedWindow, session: PersistedSession): PersistedWindow {
-  return {
-    ...window,
-    workspaces: window.workspaces.map((ws) => (ws.id === window.activeWorkspaceId ? { ...ws, session } : ws)),
-  };
+/** Every pane id the Window's Workspaces name, across all of them — what a boot
+ *  claims its recovery record against. */
+export function windowPaneIds(window: PersistedWindow | null): string[] {
+  return window?.workspaces.flatMap((workspace) => workspace.session.panes.map((pane) => pane.id)) ?? [];
 }
diff --git a/lib/src/lib/session-window.test.ts b/lib/src/lib/session-window.test.ts
index 0efef54c8..d30984c14 100644
--- a/lib/src/lib/session-window.test.ts
+++ b/lib/src/lib/session-window.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vitest';
 import {
-  activeWorkspaceSession,
   readPersistedWindow,
+  windowPaneIds,
   wrapSessionInWindow,
   type PersistedSession,
   type PersistedWindow,
@@ -65,25 +65,17 @@ describe('readPersistedWindow', () => {
   });
 });
 
-describe('activeWorkspaceSession', () => {
-  it('returns the active Workspace session', () => {
+describe('windowPaneIds', () => {
+  it('names every pane across every Workspace, and nothing without a Window', () => {
     const win: PersistedWindow = {
       version: 1,
-      activeWorkspaceId: 'ws-b',
+      activeWorkspaceId: 'ws-a',
       workspaces: [
         { id: 'ws-a', name: 'A', session: sessionA },
         { id: 'ws-b', name: 'B', session: sessionB },
       ],
     };
-    expect(activeWorkspaceSession(win)).toBe(sessionB);
-  });
-
-  it('falls back to the first Workspace when the active id is missing', () => {
-    const win: PersistedWindow = {
-      version: 1,
-      activeWorkspaceId: 'gone',
-      workspaces: [{ id: 'ws-a', name: 'A', session: sessionA }],
-    };
-    expect(activeWorkspaceSession(win)).toBe(sessionA);
+    expect(windowPaneIds(win)).toEqual(['pane-a', 'pane-b']);
+    expect(windowPaneIds(null)).toEqual([]);
   });
 });
diff --git a/lib/src/lib/window-persistence.ts b/lib/src/lib/window-persistence.ts
index 7b11c97ee..3d3c3ef0c 100644
--- a/lib/src/lib/window-persistence.ts
+++ b/lib/src/lib/window-persistence.ts
@@ -52,9 +52,9 @@ export function loadWindowState(storage: SessionKeyValueStore, key: string): Per
   return readPersistedWindow(parsed);
 }
 
-/** Persist `window` under `key`. */
-export function saveWindowState(storage: SessionKeyValueStore, key: string, window: PersistedWindow): void {
-  storage.setItem(key, JSON.stringify(window));
+/** Persist `snapshot` under `key`. */
+export function saveWindowState(storage: SessionKeyValueStore, key: string, snapshot: PersistedWindow): void {
+  storage.setItem(key, JSON.stringify(snapshot));
 }
 
 /** Parse a stored JSON blob, or null when it is corrupt — a bad blob degrades to a
diff --git a/lib/src/lib/window-session-aggregator.test.ts b/lib/src/lib/window-session-aggregator.test.ts
index 5aba57732..e5604bfe6 100644
--- a/lib/src/lib/window-session-aggregator.test.ts
+++ b/lib/src/lib/window-session-aggregator.test.ts
@@ -1,6 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import {
-  adoptWorkspaceSession,
   flushWindowSession,
   forgetWorkspaceSession,
   getWindowSnapshot,
@@ -58,14 +57,14 @@ describe('window session aggregator', () => {
     expect(getWindowSnapshot().activeWorkspaceId).toBe(first);
   });
 
-  it('drops a Workspace with neither a published nor a seeded session', () => {
+  it('drops a Workspace with no record at all', () => {
     const first = getWorkspacesSnapshot().workspaces[0].id;
     createWorkspace({ name: 'Second' });
     publishWorkspaceSession(first, session('a'));
     expect(getWindowSnapshot().workspaces.map((ws) => ws.id)).toEqual([first]);
   });
 
-  it('forgets a Workspace session and its seed', () => {
+  it('forgets a Workspace session, seeded or published', () => {
     const first = getWorkspacesSnapshot().workspaces[0].id;
     seedWindowSession({ version: 1, workspaces: [{ id: first, name: 'One', session: session('seed') }], activeWorkspaceId: first });
     publishWorkspaceSession(first, session('a'));
@@ -108,10 +107,10 @@ describe('window session aggregator', () => {
       expect(getWindowSnapshot().workspaces).toEqual([]);
     });
 
-    it('adopts a record from elsewhere as that Workspace\'s previous', () => {
+    it('takes the record a Workspace arriving from elsewhere brings', () => {
       const second = createWorkspace({ id: 'ws-2', name: 'Second' }).id;
       publishWorkspaceSession(second, session('stale'));
-      adoptWorkspaceSession(second, session('moved-in'));
+      publishWorkspaceSession(second, session('moved-in'));
       expect(previousWorkspaceSession(second)?.panes[0].id).toBe('moved-in');
     });
   });
diff --git a/lib/src/lib/window-session-aggregator.ts b/lib/src/lib/window-session-aggregator.ts
index f367b2c2f..7d45266b6 100644
--- a/lib/src/lib/window-session-aggregator.ts
+++ b/lib/src/lib/window-session-aggregator.ts
@@ -7,57 +7,49 @@ import type { PersistedSession, PersistedWindow, PersistedWorkspace, WorkspaceId
  * The Wall's persistence hook publishes here instead of writing the platform
  * slot when it runs under a Workspace; the standalone boot installs the writer.
  *
- * Two maps, because a Workspace's record has two possible ages. `published` is
- * what its Wall has saved this run. `seeded` is what the last run left on disk,
- * which is the answer until that Wall has saved anything — it is what keeps a
- * Window snapshot taken mid-boot from replacing a restored Workspace with a
- * blank one, and it is what a save reads its retained `cwd` out of
- * (`previousWorkspaceSession`).
+ * One record per Workspace, whatever its age: boot seeds it from what the last
+ * run left on disk, and that Workspace's Wall replaces it on its first save. The
+ * seed is what keeps a Window snapshot taken mid-boot from replacing a restored
+ * Workspace with a blank one, and it is what that first save reads its retained
+ * `cwd` out of (`previousWorkspaceSession`).
  */
 
-const published = new Map<WorkspaceId, PersistedSession>();
-const seeded = new Map<WorkspaceId, PersistedSession>();
+const records = new Map<WorkspaceId, PersistedSession>();
 let writer: ((snapshot: PersistedWindow) => void | Promise<void>) | null = null;
 let unsubscribeWorkspaces: (() => void) | null = null;
 let timer: ReturnType<typeof setTimeout> | null = null;
 let inFlight: Promise<void> | null = null;
 
-/** How long the Window blob waits for its Workspaces to settle. Each Wall
- *  already debounces its own record, so this is what collapses N Workspaces
- *  reacting to one event into a single host write. */
-const WRITE_DEBOUNCE_MS = 500;
+/**
+ * How long a debounced save waits. One value for both levels: a Wall's own
+ * record and the Window blob its publish schedules. The Window's wait is what
+ * collapses N Workspaces reacting to one event into a single host write.
+ *
+ * Source of truth for the Wall's timer: `useSessionPersistence` in
+ * `lib/src/components/wall/use-session-persistence.ts`.
+ */
+export const SESSION_SAVE_DEBOUNCE_MS = 500;
 
 /**
  * The record on disk for every Workspace this Window is restoring, installed at
  * boot before any Wall mounts. Replaces whatever was seeded before; `null`
  * clears it (a fresh Window).
  */
-export function seedWindowSession(window: PersistedWindow | null): void {
-  seeded.clear();
-  for (const workspace of window?.workspaces ?? []) seeded.set(workspace.id, workspace.session);
+export function seedWindowSession(snapshot: PersistedWindow | null): void {
+  records.clear();
+  for (const workspace of snapshot?.workspaces ?? []) records.set(workspace.id, workspace.session);
 }
 
-/** Record a Workspace's latest session and schedule the Window write. */
+/** Record a Workspace's latest session and schedule the Window write. Also how a
+ *  Workspace arriving from another Window installs the record it brought. */
 export function publishWorkspaceSession(workspaceId: WorkspaceId, session: PersistedSession): void {
-  published.set(workspaceId, session);
-  scheduleWrite();
-}
-
-/**
- * Install a record for a Workspace whose Wall is not the one that built it — a
- * Workspace moving in from another Window. It stands as that Workspace's
- * previous record until its new Wall publishes, exactly as a seed does.
- */
-export function adoptWorkspaceSession(workspaceId: WorkspaceId, session: PersistedSession): void {
-  seeded.set(workspaceId, session);
-  published.delete(workspaceId);
+  records.set(workspaceId, session);
   scheduleWrite();
 }
 
 /** Drop a Workspace's session (its Workspace was closed or moved away). */
 export function forgetWorkspaceSession(workspaceId: WorkspaceId): void {
-  const had = published.delete(workspaceId);
-  if (!seeded.delete(workspaceId) && !had) return;
+  if (!records.delete(workspaceId)) return;
   scheduleWrite();
 }
 
@@ -68,13 +60,13 @@ export function forgetWorkspaceSession(workspaceId: WorkspaceId): void {
  * (or with nothing) would drop them on the first save after a restore.
  */
 export function previousWorkspaceSession(workspaceId: WorkspaceId): PersistedSession | null {
-  return published.get(workspaceId) ?? seeded.get(workspaceId) ?? null;
+  return records.get(workspaceId) ?? null;
 }
 
 /**
  * The Window as it stands: Workspaces in strip order carrying the id, name, and
- * latest session of each. A Workspace with neither a published nor a seeded
- * session is omitted rather than written empty.
+ * latest session of each. A Workspace with no record at all is omitted rather
+ * than written empty.
  */
 export function getWindowSnapshot(): PersistedWindow {
   const { workspaces, activeId } = getWorkspacesSnapshot();
@@ -126,7 +118,7 @@ function scheduleWrite(): void {
   timer = setTimeout(() => {
     timer = null;
     writeNow();
-  }, WRITE_DEBOUNCE_MS);
+  }, SESSION_SAVE_DEBOUNCE_MS);
 }
 
 function writeNow(): void {
@@ -143,8 +135,7 @@ function cancelPending(): void {
 
 /** Forget every session, seed, and installed writer (tests). */
 export function resetWindowSessionAggregator(): void {
-  published.clear();
-  seeded.clear();
+  records.clear();
   writer = null;
   unsubscribeWorkspaces?.();
   unsubscribeWorkspaces = null;
diff --git a/lib/src/main.tsx b/lib/src/main.tsx
index 58b8c5193..111df30d3 100644
--- a/lib/src/main.tsx
+++ b/lib/src/main.tsx
@@ -5,6 +5,7 @@ import { resumeOrRestore } from "./lib/reconnect";
 import { initAlertStateReceiver } from "./lib/terminal-registry";
 import { installVscodeThemeVarResolver } from "./lib/themes/vscode-color-observer";
 import { installPeerSurfaceResponder } from "./remote/burrow/peer-surfaces";
+import { wallBootFromResult } from "./components/wall/wall-types";
 import App from "./App";
 import "./index.css";
 
@@ -30,7 +31,7 @@ initAlertStateReceiver();
 resumeOrRestore(platform).then((result) => {
   createRoot(document.getElementById("root")!).render(
     <StrictMode>
-      <App initialPaneIds={result.paneIds} restoredLathLayout={result.lathLayout} initialDoors={result.doors} initialSurfaceRefs={result.surfaceRefs} initialSurfaceRefsNext={result.surfaceRefsNext} enableBurrow={isVscode} />
+      <App {...wallBootFromResult(result)} enableBurrow={isVscode} />
     </StrictMode>,
   );
 });
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index c3968f3ef..ccb0c9d0c 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -24,13 +24,13 @@
   "docs/specs/security-supply-chain.md": 1150,
   "docs/specs/security.md": 1900,
   "docs/specs/shortcuts.md": 1050,
-  "docs/specs/standalone.md": 4650,
+  "docs/specs/standalone.md": 4850,
   "docs/specs/terminal-context.md": 900,
   "docs/specs/terminal-escapes.md": 3750,
   "docs/specs/terminal-state.md": 2350,
   "docs/specs/theme.md": 2150,
   "docs/specs/tiling-engine.md": 4500,
-  "docs/specs/transport.md": 4650,
+  "docs/specs/transport.md": 4750,
   "docs/specs/tutorial.md": 1900,
   "docs/specs/vscode.md": 7400,
   "docs/specs/webgl-text.md": 1200,
diff --git a/standalone/scripts/dev-agent-browser.mjs b/standalone/scripts/dev-agent-browser.mjs
index 92c621124..69feddf9f 100644
--- a/standalone/scripts/dev-agent-browser.mjs
+++ b/standalone/scripts/dev-agent-browser.mjs
@@ -119,6 +119,7 @@ const fireAndForget = {
 const invokeMap = {
   get_available_shells: (_args) => requestSidecar('pty:getShells', {}, 'pty:shells', (data) => data.shells ?? []),
   pty_get_cwd: ({ id }) => requestSidecar('pty:getCwd', { id }, 'pty:cwd', (data) => data.cwd ?? null),
+  pty_get_cwds: ({ ids }) => requestSidecar('pty:getCwds', { ids }, 'pty:cwds', (data) => data.cwds ?? {}),
   pty_context: ({ request }) => requestSidecar('pty:context', request, 'pty:context', data => data),
   pty_get_open_ports: ({ id }) => requestSidecar('pty:getOpenPorts', { id }, 'pty:openPorts', (data) => data.ports ?? []),
   read_clipboard_file_paths: () => requestSidecar('clipboard:readFiles', {}, 'clipboard:files', (data) => data.paths ?? null),
@@ -144,11 +145,11 @@ const invokeMap = {
   agent_browser_pop_out: ({ session, url, rect, binaryPath }) => requestSidecar('agentBrowser:popOut', { session, url, rect, binaryPath }, 'agentBrowser:result', (data) => data.result, 30000),
   agent_browser_pop_in: ({ session, url, binaryPath }) => requestSidecar('agentBrowser:popIn', { session, url, binaryPath }, 'agentBrowser:result', (data) => data.result, 30000),
   // Agent recovery (docs/specs/standalone.md -> "Agent recovery"). The harness
-  // mirrors the persistence answer, so it captures and claims exactly as Rust
-  // does; the sidecar half is identical.
-  capture_agent_recovery: ({ ids, timeout }) =>
-    requestSidecar('pty:captureRecovery', { ids, timeout }, 'recoveryDone', (data) => data, (timeout ?? 1300) + 1500),
-  recovery_take: ({ paneIds }) => requestSidecar('recovery:take', { paneIds }, 'recovery:commands', (data) => data),
+  // mirrors the persistence answer, so it claims exactly as Rust does, over the
+  // identical sidecar half. There is no `capture_agent_recovery` here: capture
+  // is a quit-only step and the harness has no quit.
+  take_recovery_commands: ({ paneIds }) =>
+    requestSidecar('recovery:take', { paneIds }, 'recovery:commands', (data) => data.commands ?? {}),
 };
 
 async function readJson(req) {
@@ -247,9 +248,9 @@ function startSidecar() {
       DORMOUSE_CLI_JS: dorEntrypoint,
       DORMOUSE_CONTROL_TOKEN: controlToken,
       DORMOUSE_STATE_DIR: stateDir,
-      // The harness mirrors the persistence answer, so a reload here exercises
-      // the same agent-recovery record the app writes — under this run's own
-      // temp state, never the installed app's.
+      // The harness mirrors the persistence answer, so a reload here claims from
+      // the same agent-recovery record the app's quit writes — under this run's
+      // own temp state, never the installed app's.
       DORMOUSE_RECOVERY_DIR: stateDir,
     },
   });
diff --git a/standalone/sidecar/main.js b/standalone/sidecar/main.js
index de43ace00..0cbf13994 100644
--- a/standalone/sidecar/main.js
+++ b/standalone/sidecar/main.js
@@ -25,7 +25,7 @@ const { createSidecarBurrow } = require('./burrow.cjs');
 // Same pattern again: lib/src/host/recovery.ts is the agent-recovery capture
 // machine (shared with the VS Code extension host) plus the single-use record
 // store. See docs/specs/standalone.md -> "Agent recovery".
-const { captureAgentRecovery, createRecoveryStore } = require('./recovery.cjs');
+const { captureAgentRecovery, createRecoveryStore, sliceSince } = require('./recovery.cjs');
 
 const agentBrowser = createAgentBrowserHost({
   writeClipboardText: (text) => clipboard.writeClipboardText(text),
@@ -56,7 +56,10 @@ const mgr = create((event, data) => {
     console.error(`[sidecar] burrow ${event} tap failed:`, err && err.message || err);
   }
   if (event !== 'data') send(`pty:${event}`, data);
-}, nodePty, { replay: true });
+  // `sliceSince` comes from the shared bundle above rather than living in
+  // pty-core, so this host and the VS Code extension host read their replay
+  // buffers through one implementation.
+}, nodePty, { replay: true, sliceSince });
 
 const burrow = createSidecarBurrow({
   send,
@@ -138,6 +141,7 @@ function handleLine(line) {
       case 'pty:requestInit': mgr.list(); break;
       case 'pty:context': mgr.context(data, data.requestId); break;
       case 'pty:getCwd':  mgr.getCwd(data.id, data.requestId); break;
+      case 'pty:getCwds': mgr.getCwds(data.ids, data.requestId); break;
       case 'pty:getOpenPorts': mgr.getOpenPorts(data.id, data.requestId); break;
       case 'pty:getShells':  mgr.getShells(data.requestId); break;
       case 'pty:interrupt': mgr.interrupt(data.ids, data.requestId); break;
@@ -165,10 +169,9 @@ function handleLine(line) {
       // Cold start: claim the invocations belonging to these panes. Destructive
       // on the first call, so nothing can replay them.
       case 'recovery:take':
-        send('recovery:commands', {
-          requestId: data.requestId,
+        respondAsync('recovery:commands', data.requestId, async () => ({
           commands: recovery.take(Array.isArray(data.paneIds) ? data.paneIds : []),
-        });
+        }));
         break;
       case 'pty:gracefulKillAll': mgr.gracefulKillAll(data.timeout, data.requestId); break;
       // The webview's resolved terminal theme, so the parser here can answer
diff --git a/standalone/sidecar/pty-core.js b/standalone/sidecar/pty-core.js
index 209fabc96..05b39d081 100644
--- a/standalone/sidecar/pty-core.js
+++ b/standalone/sidecar/pty-core.js
@@ -503,19 +503,22 @@ function detectAvailableShells(runtime = {}) {
 
 module.exports.detectAvailableShells = detectAvailableShells;
 
-function parseCwdFromLsof(output, pid) {
-  const lines = output.split(/\r?\n/);
-  let inTargetProcess = false;
+/** Every `pid -> cwd` in `lsof -Fn` field output. Records are `p<pid>` blocks;
+ *  within one, the `n` line after `fcwd` is that process's cwd. */
+function parseCwdsFromLsof(output) {
+  const cwds = new Map();
+  let pid = null;
   let sawCwdFd = false;
 
-  for (const line of lines) {
+  for (const line of output.split(/\r?\n/)) {
     if (line.startsWith('p')) {
-      inTargetProcess = line === `p${pid}`;
+      const parsed = Number(line.slice(1));
+      pid = Number.isInteger(parsed) ? parsed : null;
       sawCwdFd = false;
       continue;
     }
 
-    if (!inTargetProcess) continue;
+    if (pid === null) continue;
 
     if (line === 'fcwd') {
       sawCwdFd = true;
@@ -523,39 +526,68 @@ function parseCwdFromLsof(output, pid) {
     }
 
     if (sawCwdFd && line.startsWith('n')) {
-      return line.slice(1) || null;
+      if (!cwds.has(pid)) cwds.set(pid, line.slice(1) || null);
+      sawCwdFd = false;
     }
   }
 
-  return null;
+  return cwds;
+}
+
+module.exports.parseCwdsFromLsof = parseCwdsFromLsof;
+
+function parseCwdFromLsof(output, pid) {
+  return parseCwdsFromLsof(output).get(Number(pid)) ?? null;
 }
 
 module.exports.parseCwdFromLsof = parseCwdFromLsof;
 
 function getCwdForPid(pid, runtime = {}) {
+  return getCwdsForPids([pid], runtime).get(pid) ?? null;
+}
+
+module.exports.getCwdForPid = getCwdForPid;
+
+/**
+ * `pid -> cwd` for every pid that could be resolved, in ONE pass.
+ *
+ * Batched at this layer because a save probes every terminal pane at once and
+ * the macOS branch is a synchronous subprocess on the sidecar's only event loop:
+ * one `lsof` for N pids instead of N spawns is the whole point
+ * (docs/specs/transport.md -> "Persisted session"). Linux is a readlink per pid
+ * with no subprocess to batch, and Windows resolves nothing either way.
+ */
+function getCwdsForPids(pids, runtime = {}) {
   const fsModule = runtime.fsModule || fs;
   const execFileSyncFn = runtime.execFileSync || execFileSync;
+  const found = new Map();
+  const unresolved = [];
 
-  // Linux: /proc/<pid>/cwd symlink
-  try {
-    return fsModule.readlinkSync(`/proc/${pid}/cwd`);
-  } catch { /* not Linux or proc unavailable */ }
+  // Linux: /proc/<pid>/cwd symlink.
+  for (const pid of pids) {
+    try {
+      found.set(pid, fsModule.readlinkSync(`/proc/${pid}/cwd`));
+    } catch { unresolved.push(pid); /* not Linux or proc unavailable */ }
+  }
+  if (unresolved.length === 0) return found;
 
   // macOS: lsof. `-a` is required so `-p` and `-d cwd` are combined instead
   // of OR'ed, which otherwise returns unrelated processes and often `/`.
   try {
-    const out = execFileSyncFn('lsof', ['-a', '-d', 'cwd', '-p', String(pid), '-Fn'], {
+    const out = execFileSyncFn('lsof', ['-a', '-d', 'cwd', '-p', unresolved.join(','), '-Fn'], {
       encoding: 'utf-8',
       stdio: ['ignore', 'pipe', 'ignore'],
       windowsHide: true, // see runPowerShell: avoid the console-allocation deadlock
     });
-    return parseCwdFromLsof(out, pid);
-  } catch { /* fallback */ }
+    for (const [pid, cwd] of parseCwdsFromLsof(out)) {
+      if (cwd) found.set(pid, cwd);
+    }
+  } catch { /* fallback: every unresolved pid stays absent */ }
 
-  return null;
+  return found;
 }
 
-module.exports.getCwdForPid = getCwdForPid;
+module.exports.getCwdsForPids = getCwdsForPids;
 
 // ── Open-port discovery ──────────────────────────────────────────────────────
 //
@@ -1061,7 +1093,12 @@ module.exports.openNativeDirectory = openNativeDirectory;
  *   send('openPorts', { id, ports: [{ protocol, family, address, port, pid, processName }], requestId })
  */
 
-module.exports.create = function create(send, ptyModule, { replay = false } = {}) {
+// `sliceSince` is injected rather than imported: its implementation is shared
+// with the VS Code extension host and lives in `lib/src/host/replay-buffer.ts`,
+// which reaches this process only as the generated `recovery.cjs` bundle. Taking
+// it as an option keeps this file — and its `node --test` suite — free of any
+// build artifact. `main.js` supplies the real one.
+module.exports.create = function create(send, ptyModule, { replay = false, sliceSince = null } = {}) {
   if (!ptyModule || typeof ptyModule.spawn !== 'function') {
     throw new TypeError('create() requires a node-pty compatible module');
   }
@@ -1212,25 +1249,13 @@ module.exports.create = function create(send, ptyModule, { replay = false } = {}
     return session ? session.received : 0;
   }
 
-  /** The output received after a `receivedChars` mark, clamped to what the bounded
-   *  buffer still holds. Joins only the chunks that span the mark, so repeatedly
-   *  reading a pane's recent tail costs the tail, not the buffer. Eviction can have
-   *  carried the mark off the front; the oldest char still held is the furthest
-   *  back this can honestly answer. */
+  /** The output received after a `receivedChars` mark. This is the buffer lookup;
+   *  the clamping arithmetic is the injected `sliceSince` (see `create`). Without
+   *  one there is no recovery capture in this process either, so nothing to read. */
   function outputSince(id, mark) {
     const session = sessions.get(id);
-    if (!session) return '';
-    const oldestHeld = session.received - session.chars;
-    const wanted = session.received - Math.max(mark, oldestHeld);
-    if (wanted <= 0) return '';
-    const tail = [];
-    let held = 0;
-    for (let i = session.chunks.length - 1; i >= 0 && held < wanted; i--) {
-      tail.push(session.chunks[i]);
-      held += session.chunks[i].length;
-    }
-    const joined = tail.reverse().join('');
-    return held > wanted ? joined.slice(held - wanted) : joined;
+    if (!session || !sliceSince) return '';
+    return sliceSince(session.chunks, session.chars, session.received, mark);
   }
 
   // Synchronous lifetime observation for the Burrow's atomic
@@ -1327,6 +1352,29 @@ module.exports.create = function create(send, ptyModule, { replay = false } = {}
     send('cwd', { id, cwd: getCwdForPid(p.pid), requestId });
   }
 
+  /** One answer for every id a save asks about, so N panes cost one process
+   *  scan rather than N (docs/specs/transport.md -> "Persisted session"). An id
+   *  with no live PTY answers null, exactly as `getCwd` does. */
+  function getCwds(ids, requestId) {
+    const targets = Array.isArray(ids) ? ids : [];
+    const cwds = {};
+    const idsByPid = new Map();
+    for (const id of targets) {
+      cwds[id] = null;
+      const p = ptys.get(id);
+      if (!p) continue;
+      const sharing = idsByPid.get(p.pid);
+      if (sharing) sharing.push(id);
+      else idsByPid.set(p.pid, [id]);
+    }
+    const resolved = getCwdsForPids([...idsByPid.keys()]);
+    for (const [pid, sharing] of idsByPid) {
+      const cwd = resolved.get(pid) ?? null;
+      for (const id of sharing) cwds[id] = cwd;
+    }
+    send('cwds', { cwds, requestId });
+  }
+
   function getOpenPorts(id, requestId) {
     const p = ptys.get(id);
     // getOpenPortsForPid is fail-soft (returns [] on any platform error).
@@ -1361,7 +1409,11 @@ module.exports.create = function create(send, ptyModule, { replay = false } = {}
       // Guarded per id: one already-dead pty must not abort the rest.
       try { write(id, '\x03'); } catch { /* already dead */ }
     }
-    send('interruptDone', { requestId });
+    // Only an actual request is acked. The recovery capture presses in-process
+    // and has nothing to correlate, so a blanket ack would put a stray
+    // `interruptDone {requestId: undefined}` on the protocol channel for every
+    // press it makes.
+    if (requestId !== undefined) send('interruptDone', { requestId });
   }
 
   function gracefulKillAll(timeout = 2000, requestId) {
@@ -1391,6 +1443,6 @@ module.exports.create = function create(send, ptyModule, { replay = false } = {}
   }
 
   return { spawn, write, resize, hasPty, kill, killAll, list, context,
-    getCwd, getOpenPorts, interrupt, gracefulKillAll, getShells,
+    getCwd, getCwds, getOpenPorts, interrupt, gracefulKillAll, getShells,
     liveIds, receivedChars, outputSince };
 };
diff --git a/standalone/sidecar/pty-core.test.js b/standalone/sidecar/pty-core.test.js
index fce5e44df..6d4b0d8b9 100644
--- a/standalone/sidecar/pty-core.test.js
+++ b/standalone/sidecar/pty-core.test.js
@@ -7,6 +7,8 @@ const {
   detectAvailableShells,
   getCwdForPid,
   parseCwdFromLsof,
+  parseCwdsFromLsof,
+  getCwdsForPids,
   resolveSpawnConfig,
   withPrependedPath,
   canonicalizeWindowsCwd,
@@ -1481,42 +1483,49 @@ test('getOpenPortsForPid returns [] for a non-integer pid', () => {
   assert.deepEqual(getOpenPortsForPid(undefined, { platform: 'linux' }), []);
 });
 
+// The clamping arithmetic itself lives in lib/src/host/replay-buffer.ts and is
+// tested there; what belongs here is the buffer accounting this file owns and
+// hands it.
 test('receivedChars counts everything ever received, past a replay-buffer trim', () => {
   const listeners = {};
-  const writes = [];
+  const reads = [];
   const fakePty = {
     pid: 1,
     onData(handler) { listeners.data = handler; },
     onExit(handler) { listeners.exit = handler; },
-    resize() {}, write(data) { writes.push(data); }, kill() {},
+    resize() {}, write() {}, kill() {},
   };
-  const mgr = create(() => {}, { spawn() { return fakePty; } }, { replay: true });
+  const sliceSince = (chunks, held, received, mark) => {
+    reads.push({ buffered: chunks.join(''), held, received, mark });
+    return 'sliced';
+  };
+  const mgr = create(() => {}, { spawn() { return fakePty; } }, { replay: true, sliceSince });
   mgr.spawn('pane-1');
 
   assert.equal(mgr.receivedChars('pane-1'), 0);
   const mark = mgr.receivedChars('pane-1');
   listeners.data('hello');
   assert.equal(mgr.receivedChars('pane-1'), 5);
-  assert.equal(mgr.outputSince('pane-1', mark), 'hello');
+  assert.equal(mgr.outputSince('pane-1', mark), 'sliced');
+  assert.deepEqual(reads.at(-1), { buffered: 'hello', held: 5, received: 5, mark: 0 });
 
   // Overflow the 200k replay cap: the buffer trims, but the counter is the mark
-  // space and must not move backwards.
+  // space and must not move backwards — so what the slicer is handed is a held
+  // length capped at 200k beside a received count that keeps climbing.
   const before = mgr.receivedChars('pane-1');
   for (let i = 0; i < 30; i++) listeners.data('x'.repeat(10_000));
   const after = mgr.receivedChars('pane-1');
   assert.equal(after, before + 300_000);
-  // What the trimmed buffer can honestly answer is clamped to what it holds; it
-  // can only be less than the pane printed, never stale bytes offered as fresh.
-  const since = mgr.outputSince('pane-1', before);
-  assert.ok(since.length <= 200_000, `held ${since.length}`);
-  assert.ok(since.length > 0);
-  assert.equal(since, 'x'.repeat(since.length));
-
-  // A mark at or past the head answers empty rather than replaying the tail.
-  assert.equal(mgr.outputSince('pane-1', after), '');
-  assert.equal(mgr.outputSince('pane-1', after + 10), '');
+  mgr.outputSince('pane-1', before);
+  assert.equal(reads.at(-1).held, 200_000);
+  assert.equal(reads.at(-1).received, after);
+  assert.equal(reads.at(-1).buffered.length, 200_000);
+
+  // An unknown pane never reaches the slicer at all.
+  const seen = reads.length;
   assert.equal(mgr.outputSince('unknown-pane', 0), '');
   assert.equal(mgr.receivedChars('unknown-pane'), 0);
+  assert.equal(reads.length, seen);
 });
 
 test('liveIds names every unexited PTY, and nothing after it exits', () => {
@@ -1543,11 +1552,64 @@ test('outputSince returns nothing without a replay buffer', () => {
     onData(handler) { listeners.data = handler; },
     onExit() {}, resize() {}, write() {}, kill() {},
   };
-  // VS Code's host keeps its own buffers, so `replay` is off there and these
-  // readers have nothing to answer from.
+  // No `replay`, and so no slicer either: nothing is buffered to answer from.
   const mgr = create(() => {}, { spawn() { return fakePty; } });
   mgr.spawn('pane-1');
   listeners.data('hello');
   assert.equal(mgr.receivedChars('pane-1'), 0);
   assert.equal(mgr.outputSince('pane-1', 0), '');
 });
+
+test('parseCwdsFromLsof keys every process block by its pid', () => {
+  const output = ['p100', 'fcwd', 'n/', 'p4242', 'fcwd', 'n/home/tester/project', ''].join('\n');
+  assert.deepEqual([...parseCwdsFromLsof(output)], [[100, '/'], [4242, '/home/tester/project']]);
+});
+
+test('getCwdsForPids resolves every pid in ONE lsof call', () => {
+  const calls = [];
+  const cwds = getCwdsForPids([4242, 4243], {
+    fsModule: { readlinkSync: () => { throw new Error('ENOENT'); } },
+    execFileSync(file, args, options) {
+      calls.push({ file, args, options });
+      return [
+        'p4242', 'fcwd', 'n/home/tester/one',
+        'p4243', 'fcwd', 'n/home/tester/two',
+        '',
+      ].join('\n');
+    },
+  });
+
+  assert.equal(calls.length, 1);
+  assert.deepEqual(calls[0].args, ['-a', '-d', 'cwd', '-p', '4242,4243', '-Fn']);
+  assert.deepEqual([...cwds], [[4242, '/home/tester/one'], [4243, '/home/tester/two']]);
+});
+
+test('getCwdsForPids reads /proc where it can and never spawns for those pids', () => {
+  let spawned = false;
+  const cwds = getCwdsForPids([7, 8], {
+    fsModule: { readlinkSync: (p) => `/proc-cwd-for${p}` },
+    execFileSync() { spawned = true; return ''; },
+  });
+  assert.equal(spawned, false);
+  assert.deepEqual([...cwds], [[7, '/proc-cwd-for/proc/7/cwd'], [8, '/proc-cwd-for/proc/8/cwd']]);
+});
+
+test('getCwds answers a key for every requested id, null for one with no PTY', () => {
+  const events = [];
+  const fakePty = () => ({
+    pid: 999_001,
+    onData() {}, onExit() {}, resize() {}, write() {}, kill() {},
+  });
+  const mgr = create((event, data) => events.push({ event, data }), {
+    spawn() { return fakePty(); },
+  }, { replay: true });
+  mgr.spawn('pane-a');
+
+  mgr.getCwds(['pane-a', 'pane-gone'], 'req-1');
+
+  const answer = events.find((e) => e.event === 'cwds');
+  assert.equal(answer.data.requestId, 'req-1');
+  assert.deepEqual(Object.keys(answer.data.cwds).sort(), ['pane-a', 'pane-gone']);
+  // A pane with no live PTY is never scanned for.
+  assert.equal(answer.data.cwds['pane-gone'], null);
+});
diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index d6748366d..28c8baa08 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -461,6 +461,27 @@ fn pty_get_cwd(
         .and_then(|cwd| cwd.as_str().map(String::from)))
 }
 
+/// Every id's cwd in one sidecar round trip. A save probes each terminal pane,
+/// and the sidecar resolves them with a synchronous process scan on its only
+/// event loop, so N panes must cost one scan rather than N
+/// (docs/specs/transport.md -> "Persisted session").
+#[tauri::command(async)]
+fn pty_get_cwds(
+    state: tauri::State<'_, SidecarState>,
+    ids: Vec<String>,
+) -> Result<JsonValue, String> {
+    let response = request_from_sidecar_timeout(
+        &state,
+        "pty:getCwds",
+        serde_json::json!({ "ids": ids }),
+        Duration::from_secs(2),
+    )?;
+    Ok(response
+        .get("cwds")
+        .cloned()
+        .unwrap_or_else(|| JsonValue::Object(JsonMap::new())))
+}
+
 // Mirrors `OPEN_PORT_TIMEOUT_MS` in `lib/src/lib/platform/types.ts` — pinned by
 // `lib/src/lib/mirrored-constants.test.ts`.
 const OPEN_PORT_TIMEOUT_MS: u64 = 3000;
@@ -1034,16 +1055,25 @@ fn write_file_with_permissions(
     let tmp = temp_write_path(path);
     // Atomic replace: write a sibling temp file, fsync it, then rename over the
     // target so a crash mid-write can never truncate the previous good copy.
-    {
+    // Every failure below takes the temp file with it, so only a crash — never a
+    // returned error — can leave one behind for the boot sweep to find.
+    let written = (|| -> Result<(), String> {
         let mut f = File::create(&tmp).map_err(|e| format!("open temp: {e}"))?;
         // Before any bytes land: the rename below preserves the temp file's
         // mode, so tightening here is what makes the final snapshot 0600.
         restrict(&tmp, 0o600)?;
         f.write_all(contents.as_bytes())
             .map_err(|e| format!("write temp: {e}"))?;
-        f.sync_all().map_err(|e| format!("fsync temp: {e}"))?;
+        f.sync_all().map_err(|e| format!("fsync temp: {e}"))
+    })();
+    if let Err(e) = written {
+        let _ = std::fs::remove_file(&tmp);
+        return Err(e);
+    }
+    if let Err(e) = std::fs::rename(&tmp, path) {
+        let _ = std::fs::remove_file(&tmp);
+        return Err(format!("rename {}: {e}", path.display()));
     }
-    std::fs::rename(&tmp, path).map_err(|e| format!("rename {}: {e}", path.display()))?;
     // The temp file's own fsync doesn't make the rename durable — on unix the
     // directory entry that now points at the new inode must be fsynced too, or a
     // crash right after quit could leave the rename unrecorded. Best-effort: a
@@ -1076,28 +1106,22 @@ async fn save_session(window: tauri::Window, state: String) -> Result<(), String
 }
 
 /// The suffix `write_file_atomically` leaves on a session snapshot's temp
-/// sibling, derived through the real writer so changing the convention can never
-/// leave the sweep below looking for a name nothing makes any more.
-fn session_temp_suffix() -> String {
-    let name = session_file_name("probe");
-    temp_write_path(Path::new(&name))
-        .file_name()
-        .and_then(|n| n.to_str())
-        .and_then(|n| n.strip_prefix("probe"))
-        .map(str::to_owned)
-        .unwrap_or_else(|| ".json.tmp".to_string())
-}
+/// sibling. Pinned against the real writer by
+/// `session_temp_suffix_matches_what_the_writer_leaves`, so changing the
+/// convention cannot leave the sweep below looking for a name nothing makes.
+const SESSION_TEMP_SUFFIX: &str = ".json.tmp";
 
 /// Delete every orphaned temp write in the sessions directory, at boot.
 ///
-/// A crash between the temp write and the rename leaves a file `load_session`
-/// cannot see and nothing else will ever overwrite — and a snapshot written
-/// before Dormouse stopped storing transcripts carries one. Deleting is the
-/// point: those bytes have to leave the disk
-/// (docs/specs/transport.md -> "Retiring the transcripts already on disk").
+/// The writer removes its own temp on every error path, so what remains here is
+/// the legacy and hard-crash migration: a kill between the temp write and the
+/// rename leaves a file `load_session` cannot see and nothing else will ever
+/// overwrite — and a snapshot written before Dormouse stopped storing
+/// transcripts carries one. Deleting is the point: those bytes have to leave the
+/// disk (docs/specs/transport.md -> "Retiring the transcripts already on disk").
 /// Never touches a live snapshot; the window that owns one rewrites it itself.
 fn sweep_orphan_session_temps(dir: &Path) -> Result<(), String> {
-    let suffix = session_temp_suffix();
+    let suffix = SESSION_TEMP_SUFFIX;
     let entries = match std::fs::read_dir(dir) {
         Ok(entries) => entries,
         // No sessions directory yet (a first launch) is the desired end state.
@@ -1108,7 +1132,7 @@ fn sweep_orphan_session_temps(dir: &Path) -> Result<(), String> {
     for entry in entries.flatten() {
         let name = entry.file_name();
         let Some(name) = name.to_str() else { continue };
-        if !name.ends_with(&suffix) {
+        if !name.ends_with(suffix) {
             continue;
         }
         match std::fs::remove_file(entry.path()) {
@@ -2022,6 +2046,7 @@ pub fn run() {
             pty_theme_colors,
             pty_kill,
             pty_get_cwd,
+            pty_get_cwds,
             pty_context,
             pty_get_open_ports,
             pty_graceful_kill_all,
@@ -2085,8 +2110,8 @@ mod tests {
     use super::{
         find_node_binary, notepad_archive_lock_path, read_notepad_archive_from, read_session_from,
         reset_notepad_archive_at, resolve_dor_cli_paths, resolve_sidecar_path, session_file_name,
-        session_temp_suffix, state_root_from, strip_windows_verbatim_prefix,
-        sweep_orphan_session_temps, temp_write_path, write_notepad_archive_to, write_session_to,
+        state_root_from, strip_windows_verbatim_prefix, sweep_orphan_session_temps,
+        temp_write_path, write_notepad_archive_to, write_session_to, SESSION_TEMP_SUFFIX,
         NOTEPAD_ARCHIVE_FILE,
     };
     use std::fs;
@@ -2518,10 +2543,9 @@ mod tests {
                 read_session_from(dir.path(), "main").unwrap().as_deref(),
                 Some("previous")
             );
-            let tmp = dir.path().join("main.json.tmp");
-            if tmp.exists() {
-                assert_eq!(fs::metadata(tmp).unwrap().len(), 0);
-            }
+            // The writer cleans up after itself, so a returned error never
+            // leaves the boot sweep anything to find.
+            assert!(!dir.path().join("main.json.tmp").exists());
         }
     }
 
@@ -2587,17 +2611,17 @@ mod tests {
         assert!(sweep_orphan_session_temps(&dir.path().join("nope")).is_ok());
     }
 
-    /// The sweep's suffix comes from the writer, so the two can never drift.
+    /// The sweep's constant against the name the writer actually leaves, so the
+    /// two can never drift.
     #[test]
     fn session_temp_suffix_matches_what_the_writer_leaves() {
-        assert_eq!(session_temp_suffix(), ".json.tmp");
         assert_eq!(
             temp_write_path(Path::new(&session_file_name("main")))
                 .file_name()
                 .unwrap()
                 .to_str()
                 .unwrap(),
-            format!("main{}", session_temp_suffix()),
+            format!("main{SESSION_TEMP_SUFFIX}"),
         );
     }
 
diff --git a/standalone/src/browser-sidecar-adapter.test.ts b/standalone/src/browser-sidecar-adapter.test.ts
index 1dd0367c7..c29d064cd 100644
--- a/standalone/src/browser-sidecar-adapter.test.ts
+++ b/standalone/src/browser-sidecar-adapter.test.ts
@@ -61,7 +61,7 @@ describe("BrowserSidecarAdapter session persistence", () => {
   it("round-trips a Window through localStorage", () => {
     localStorage.removeItem(KEY);
     const adapter = new BrowserSidecarAdapter(new BrowserSidecarHost("http://localhost:1234"));
-    adapter.saveState(windowBlob);
+    adapter.saveWindowState(windowBlob);
     expect(adapter.getWindowState()).toEqual(windowBlob);
     // The shared `getState` readers want a bare Session and the blob is a Window,
     // so it answers nothing; the boot reads `getWindowState`.
@@ -81,7 +81,7 @@ describe("BrowserSidecarAdapter session persistence", () => {
     const host = new BrowserSidecarHost("http://localhost:1234");
     vi.spyOn(host, "init").mockResolvedValue(undefined);
     vi.spyOn(host, "onEvent").mockReturnValue(() => {});
-    const invoke = vi.spyOn(host, "invoke").mockResolvedValue({ commands: { "pane-a": "claude --continue" } });
+    const invoke = vi.spyOn(host, "invoke").mockResolvedValue({ "pane-a": "claude --continue" });
     // Claim the console-forwarder flag so init() doesn't patch console.* on the
     // shared jsdom window for every later test in this file.
     (window as typeof window & { __DORMOUSE_BROWSER_CONSOLE_PATCHED__?: boolean })
@@ -89,8 +89,9 @@ describe("BrowserSidecarAdapter session persistence", () => {
 
     const adapter = new BrowserSidecarAdapter(host);
     await adapter.init();
+    await adapter.recoveryReady;
 
-    expect(invoke).toHaveBeenCalledWith("recovery_take", { paneIds: ["pane-a"] });
+    expect(invoke).toHaveBeenCalledWith("take_recovery_commands", { paneIds: ["pane-a"] });
     expect(adapter.getRecoveryCommands()).toEqual({ "pane-a": "claude --continue" });
     localStorage.removeItem(KEY);
   });
diff --git a/standalone/src/browser-sidecar-adapter.ts b/standalone/src/browser-sidecar-adapter.ts
index 2918f9302..ba0f653ca 100644
--- a/standalone/src/browser-sidecar-adapter.ts
+++ b/standalone/src/browser-sidecar-adapter.ts
@@ -34,8 +34,8 @@ import type { AwaitHandle, AwaitOptions } from "dormouse-lib/lib/alert-manager";
 import type { AlertSettings } from "dormouse-lib/lib/alert-settings";
 import { normalizeExternalUri } from "dormouse-lib/lib/external-links";
 import { createMemoryNotepadArchivePort } from "dormouse-lib/lib/notepad/memory-archive-port";
-import { loadWindowState, saveWindowState } from "dormouse-lib/lib/window-persistence";
 import type { PersistedAlertState, PersistedWindow } from "dormouse-lib/lib/session-types";
+import { claimRecoveryCommands, windowStateSlot } from "./window-recovery";
 import {
   applyTerminalProtocolEvents,
   collectTerminalSemanticEvents,
@@ -69,6 +69,8 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
   private alertStateHandlers = new Set<(detail: AlertStateDetail) => void>();
   private alertManager = new AlertManager();
   private unlistenHost: (() => void) | null = null;
+  private static STATE_KEY = 'dormouse.browser-sidecar.session';
+  private windowSlot = windowStateSlot(localStorage, BrowserSidecarAdapter.STATE_KEY, 'browser-sidecar');
   // Remote-host bridge, identical in shape to TauriAdapter's — the dev harness
   // forwards the same `burrow:*` messages over its own transport.
   private readonly burrowClient = createBurrowLinkClient({
@@ -106,9 +108,12 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
     await this.host.init();
     this.unlistenHost = this.host.onEvent(({ event, data }) => this.handleHostEvent(event, data));
     this.installConsoleForwarder();
-    // Before `resumeOrRestore` runs, so the cold restore's synchronous read has
-    // an answer (see TauriAdapter.takeRecoveryCommands).
-    await this.takeRecoveryCommands();
+    // Started, not awaited — see TauriAdapter.
+    this.recoveryReady = claimRecoveryCommands(
+      (paneIds) => this.host.invoke<Record<string, string>>("take_recovery_commands", { paneIds }),
+      this.windowSlot.read(),
+      'browser-sidecar',
+    ).then((commands) => { this.recoveryCommands = commands; });
   }
 
   shutdown(): void {
@@ -159,38 +164,30 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
     try { return await this.host.invoke("pty_get_cwd", { id }); } catch { return null; }
   }
 
+  /** See TauriAdapter: one round trip, one process scan, for the whole save. */
+  async getCwds(ids: string[]): Promise<Record<string, string | null>> {
+    try { return await this.host.invoke("pty_get_cwds", { ids }); } catch { return {}; }
+  }
+
   /** See TauriAdapter: claimed once during `init()`, read synchronously by the
    *  cold restore. */
   private recoveryCommands: Record<string, string> = {};
+  recoveryReady: Promise<void> = Promise.resolve();
 
   getRecoveryCommands(): Record<string, string> {
     return this.recoveryCommands;
   }
 
-  private async takeRecoveryCommands(): Promise<void> {
-    const saved = this.getWindowState();
-    const paneIds = saved?.workspaces.flatMap((workspace) => workspace.session.panes.map((pane) => pane.id)) ?? [];
-    if (paneIds.length === 0) return;
-    try {
-      const result = await this.host.invoke<{ commands?: Record<string, string> }>("recovery_take", { paneIds });
-      this.recoveryCommands = result?.commands ?? {};
-    } catch (err) {
-      console.error("[browser-sidecar] recovery take failed:", err);
-    }
-  }
+  // No `captureAgentRecovery` here. Capture is a quit-only step, and this
+  // harness has no quit: a reload is a live resume over PTYs that survive it, so
+  // sending `^C` to every agent would interrupt work that is still running. What
+  // a reload does exercise is the claim above, against whatever the app's own
+  // quit last wrote (docs/specs/standalone.md -> "Agent recovery").
 
   alertSeed(id: string, state: PersistedAlertState): void {
     this.alertManager.seed(id, state);
   }
 
-  async captureAgentRecovery(timeoutMs: number, ids?: string[]): Promise<void> {
-    try {
-      await this.host.invoke("capture_agent_recovery", { ids: ids ?? null, timeout: timeoutMs });
-    } catch (err) {
-      console.warn("[browser-sidecar] captureAgentRecovery failed; proceeding", err);
-    }
-  }
-
   async getOpenPorts(id: string): Promise<OpenPort[]> {
     try { return await this.host.invoke("pty_get_open_ports", { id }); } catch { return []; }
   }
@@ -305,31 +302,22 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
   onWatchedCommands(_handler: (names: string[]) => void): void {}
   onAlertSettings(_handler: (settings: AlertSettings) => void): void {}
 
-  private static STATE_KEY = 'dormouse.browser-sidecar.session';
-
   // The harness mirrors the shipped persistence answer, so a reload here
   // exercises what the app does (docs/specs/transport.md -> "The governing rule").
   readonly persistsSession = true;
 
+  // See TauriAdapter: no bare-Session slot on this host.
+  saveState(_state: unknown): void {}
+  getState(): unknown { return null; }
+
   // See TauriAdapter: one `PersistedWindow` per window, in `localStorage` rather
   // than the Rust file store (docs/specs/transport.md).
-  saveState(state: unknown): void {
-    try { saveWindowState(localStorage, BrowserSidecarAdapter.STATE_KEY, state as PersistedWindow); }
-    catch { console.error('[browser-sidecar] Failed to save session state'); }
-  }
-
-  /** See TauriAdapter.getState: the blob here is a Window, and the boot reads it
-   *  through `getWindowState`. */
-  getState(): unknown {
-    return null;
+  saveWindowState(snapshot: PersistedWindow): void {
+    this.windowSlot.write(snapshot);
   }
 
   getWindowState(): PersistedWindow | null {
-    try {
-      return loadWindowState(localStorage, BrowserSidecarAdapter.STATE_KEY);
-    } catch {
-      return null;
-    }
+    return this.windowSlot.read();
   }
 
   // The notepad archive as memory, not the Tauri file: this harness is a browser
diff --git a/standalone/src/main.tsx b/standalone/src/main.tsx
index eb05010c0..fb5300f80 100644
--- a/standalone/src/main.tsx
+++ b/standalone/src/main.tsx
@@ -9,9 +9,9 @@ import {
   seedWindowSession,
 } from "dormouse-lib/lib/window-session-aggregator";
 import { setWorkspaces } from "dormouse-lib/lib/workspace-store";
-import { DEFAULT_WORKSPACE_ID } from "dormouse-lib/lib/session-types";
-import type { PersistedSession, PersistedWindow, WorkspaceId } from "dormouse-lib/lib/session-types";
-import type { WallBootPlans } from "dormouse-lib/components/wall/wall-types";
+import { DEFAULT_WORKSPACE_ID, windowPaneIds } from "dormouse-lib/lib/session-types";
+import type { PersistedSession, WorkspaceId } from "dormouse-lib/lib/session-types";
+import { wallBootFromResult, type WallBootPlans } from "dormouse-lib/components/wall/wall-types";
 import { seedShellStore } from "dormouse-lib/lib/shell-store";
 import { restoreActiveTheme } from "dormouse-lib/lib/themes";
 import App from "dormouse-lib/App";
@@ -150,11 +150,6 @@ async function bootstrap() {
   );
 }
 
-/** The adapters that persist a Window. Both standalone adapters answer this; the
- *  shared `PlatformAdapter.getState` cannot, because the blob it stores is a
- *  Window and every shared reader of `getState` wants a bare Session. */
-type WindowPersistingAdapter = PlatformAdapter & { getWindowState?(): PersistedWindow | null };
-
 /**
  * Rebuild the Window: install its Workspaces, then plan each one's Session off a
  * single view of the host's live PTYs (docs/specs/layout.md → "Session
@@ -166,7 +161,7 @@ type WindowPersistingAdapter = PlatformAdapter & { getWindowState?(): PersistedW
  * Workspace cold-restores into fresh shells at its saved cwds, with nothing
  * replayed because scrollback is never persisted.
  */
-async function restoreWindow(platform: WindowPersistingAdapter): Promise<WallBootPlans> {
+async function restoreWindow(platform: PlatformAdapter): Promise<WallBootPlans> {
   const saved = platform.getWindowState?.() ?? null;
   // Before any Wall mounts: a Workspace's first save compares against its own
   // record, and a snapshot taken mid-boot must not replace a restored Workspace
@@ -180,19 +175,26 @@ async function restoreWindow(platform: WindowPersistingAdapter): Promise<WallBoo
   }
   // After `setWorkspaces`, so installing does not immediately write back what was
   // just read.
-  installWindowSessionWriter((window) => platform.saveState(window));
+  installWindowSessionWriter((snapshot) => platform.saveWindowState?.(snapshot));
 
   const live = await collectLivePtys(platform);
-  const restoring: Array<{ id: WorkspaceId; session: PersistedSession | null }> = saved
-    ? saved.workspaces.map((workspace) => ({ id: workspace.id, session: workspace.session }))
-    : [{ id: DEFAULT_WORKSPACE_ID, session: null }];
+  const restoring: Array<{ id: WorkspaceId; session: PersistedSession | null }> =
+    saved?.workspaces ?? [{ id: DEFAULT_WORKSPACE_ID, session: null }];
   const activeId = saved?.activeWorkspaceId ?? DEFAULT_WORKSPACE_ID;
 
   // A live PTY no saved Workspace names — a pane created inside the last save's
   // debounce, or one left by a Workspace that is gone — goes to the active
   // Workspace rather than being stranded with no Wall.
-  const named = new Set(restoring.flatMap(({ session }) => session?.panes.map((pane) => pane.id) ?? []));
-  const unowned = new Set(live.ptys.map((pty) => pty.id).filter((id) => !named.has(id)));
+  const liveIds = live.ptys.map((pty) => pty.id);
+  const named = windowPaneIds(saved);
+  const namedSet = new Set(named);
+  const unowned = new Set(liveIds.filter((id) => !namedSet.has(id)));
+
+  // The recovery claim is a host round trip started back in `init()`. Await it
+  // only when something here can actually cold-restore: a Window whose every
+  // saved pane is live resumes over those PTYs and never reads the record.
+  const liveSet = new Set(liveIds);
+  if (!named.every((id) => liveSet.has(id))) await platform.recoveryReady;
 
   const plans: WallBootPlans = {};
   for (const { id, session } of restoring) {
@@ -201,13 +203,7 @@ async function restoreWindow(platform: WindowPersistingAdapter): Promise<WallBoo
       ptyIds: new Set(session?.panes.map((pane) => pane.id) ?? []),
       ...(id === activeId ? { claimUnowned: unowned } : {}),
     });
-    plans[id] = {
-      initialPaneIds: result.paneIds,
-      restoredLathLayout: result.lathLayout,
-      initialDoors: result.doors,
-      initialSurfaceRefs: result.surfaceRefs,
-      initialSurfaceRefsNext: result.surfaceRefsNext,
-    };
+    plans[id] = wallBootFromResult(result);
   }
   return plans;
 }
diff --git a/standalone/src/quit.ts b/standalone/src/quit.ts
index 673da009e..f3574fd3e 100644
--- a/standalone/src/quit.ts
+++ b/standalone/src/quit.ts
@@ -4,6 +4,7 @@ import { countRunningSessions } from "dormouse-lib/lib/terminal-registry";
 import { archiveSurfaceNotes } from "dormouse-lib/lib/notepad/close-coordinator";
 import { notepadSurfaceIds, removeSurface } from "dormouse-lib/lib/notepad/notepad-store";
 import { flushWindowSession } from "dormouse-lib/lib/window-session-aggregator";
+import { DEFAULT_RECOVERY_WAIT_MS } from "dormouse-lib/host/recovery-capture";
 import type { TauriAdapter } from "./tauri-adapter";
 import { openQuitArchiveFailure } from "./quit-confirm-store";
 import { hasPendingUpdate, installPendingUpdate } from "./updater";
@@ -142,11 +143,15 @@ async function runQuitTeardown(): Promise<void> {
           // interrupt and the kill, and it is the one thing here that cannot be
           // reconstructed afterwards. Losing it must never cost the save behind
           // it, so this step alone cannot abort the rest.
-          await adapter.captureAgentRecovery(1300).catch((err) =>
+          // No `ids`: a quit tears down the whole Window, so the capture takes
+          // every live PTY.
+          await adapter.captureAgentRecovery(DEFAULT_RECOVERY_WAIT_MS).catch((err) =>
             console.warn("[quit] agent recovery capture failed; proceeding", err));
           await adapter.requestSessionFlush(1500); // save while PTYs are alive
           await adapter.gracefulKillAllPtys(2000); // SIGTERM; wait for exits and final output
-          await adapter.requestSessionFlush(1500); // final post-exit save
+          // Final post-exit save. Nothing left to probe a cwd from, and each pane
+          // keeps the one the save above recorded.
+          await adapter.requestSessionFlush(1500, { probeCwd: false });
           await flushWindowSession(); // the Walls' records become one Window blob
           await adapter.drainSessionSaves(2000); // last write reaches disk
         })(),
diff --git a/standalone/src/tauri-adapter.test.ts b/standalone/src/tauri-adapter.test.ts
index 3cc10e321..b06376cfa 100644
--- a/standalone/src/tauri-adapter.test.ts
+++ b/standalone/src/tauri-adapter.test.ts
@@ -105,6 +105,9 @@ describe("TauriAdapter window persistence", () => {
       impl(cmd, args)) as unknown as typeof rawInvoke);
     const adapter = new TauriAdapter();
     await adapter.init();
+    // `init()` starts the recovery claim without awaiting it; the boot awaits it
+    // before planning (`standalone/src/main.tsx`), so do the same here.
+    await adapter.recoveryReady;
     return { adapter, invoke };
   }
 
@@ -131,8 +134,8 @@ describe("TauriAdapter window persistence", () => {
     });
 
     expect(invoke).toHaveBeenCalledWith("take_recovery_commands", { paneIds: ["pane-a"] });
-    // Synchronous by the time the cold restore asks, which is what `init()`
-    // completing before `resumeOrRestore` buys.
+    // Synchronous by the time the cold restore asks, which is what awaiting
+    // `recoveryReady` before planning buys.
     expect(adapter.getRecoveryCommands()).toEqual({ "pane-a": "claude --continue" });
     adapter.shutdown();
   });
diff --git a/standalone/src/tauri-adapter.ts b/standalone/src/tauri-adapter.ts
index 99c671dd4..b464af1a8 100644
--- a/standalone/src/tauri-adapter.ts
+++ b/standalone/src/tauri-adapter.ts
@@ -17,6 +17,7 @@ import type {
   PtyDataDetail,
   PtyInfo,
   BurrowLink,
+  SessionFlushRequest,
 } from "dormouse-lib/lib/platform/types";
 import type {
   NotepadArchiveLoadResult,
@@ -41,9 +42,9 @@ import { AlertManager } from "dormouse-lib/lib/alert-manager";
 import type { AwaitHandle, AwaitOptions } from "dormouse-lib/lib/alert-manager";
 import type { AlertSettings } from "dormouse-lib/lib/alert-settings";
 import { normalizeExternalUri } from "dormouse-lib/lib/external-links";
-import { loadWindowState, saveWindowState } from "dormouse-lib/lib/window-persistence";
 import type { PersistedAlertState, PersistedWindow } from "dormouse-lib/lib/session-types";
 import { TauriSessionStore } from "./tauri-session-store";
+import { claimRecoveryCommands, windowStateSlot } from "./window-recovery";
 import { withTimeout } from "./with-timeout";
 import {
   applyTerminalProtocolEvents,
@@ -92,12 +93,14 @@ export class TauriAdapter implements PlatformAdapter {
   private alertStateHandlers = new Set<(detail: AlertStateDetail) => void>();
   private unlistenFns: Array<() => void> = [];
   private alertManager = new AlertManager();
+  private static STATE_KEY = 'dormouse.session';
   private sessionStore = new TauriSessionStore();
+  private windowSlot = windowStateSlot(this.sessionStore, TauriAdapter.STATE_KEY, 'tauri-adapter');
   // In-process session-flush handshake (mirrors the VS Code message-router flow
   // in vscode-ext/src/message-router.ts, but without postMessage — the Wall runs
   // in the same webview). Handlers are the frontend flush listeners; a request
   // fans out one requestId and resolves when a handler reports completion.
-  private flushHandlers = new Set<(detail: { requestId: string }) => void>();
+  private flushHandlers = new Set<(detail: SessionFlushRequest) => void>();
   private pendingFlushRequests = new Map<string, () => void>();
   private nextFlushRequestId = 0;
   // --- Remote host bridge (docs/specs/remote-api.md) ---
@@ -243,29 +246,15 @@ export class TauriAdapter implements PlatformAdapter {
       console.error("[tauri-adapter] load_session failed:", err);
     }
     this.sessionStore.hydrate(seed);
-    // The agent-recovery record is read here, at the same boot boundary and for
-    // the same reason as the session blob: `getRecoveryCommands` is synchronous
-    // because the cold restore reads it before React mounts.
-    await this.takeRecoveryCommands();
-  }
-
-  /**
-   * Claim the resume invocations the last teardown captured for the panes this
-   * Window is about to restore. Destructive in the sidecar on the first call, so
-   * a relaunch that gets this far can never replay them
-   * (docs/specs/transport.md -> "Consuming it").
-   */
-  private async takeRecoveryCommands(): Promise<void> {
-    const saved = this.getWindowState();
-    const paneIds = saved?.workspaces.flatMap((workspace) => workspace.session.panes.map((pane) => pane.id)) ?? [];
-    if (paneIds.length === 0) return;
-    try {
-      this.recoveryCommands = await rawInvoke<Record<string, string>>("take_recovery_commands", { paneIds }) ?? {};
-    } catch (err) {
-      // A record we could not read is one restore without auto-resume, never a
-      // failed boot.
-      console.error("[tauri-adapter] take_recovery_commands failed:", err);
-    }
+    // Started here, at the same boot boundary as the session blob, but NOT
+    // awaited: the claim is another sidecar round trip and `restoreWindow` is
+    // the only reader (`standalone/src/main.tsx`). `getRecoveryCommands` stays
+    // synchronous because the cold restore reads it before React mounts.
+    this.recoveryReady = claimRecoveryCommands(
+      (paneIds) => rawInvoke<Record<string, string>>("take_recovery_commands", { paneIds }),
+      this.windowSlot.read(),
+      'tauri-adapter',
+    ).then((commands) => { this.recoveryCommands = commands; });
   }
 
   shutdown(): void {
@@ -312,6 +301,7 @@ export class TauriAdapter implements PlatformAdapter {
   /** Agent resume invocations captured at the last teardown, claimed once during
    *  `init()` and read synchronously by the cold restore. */
   private recoveryCommands: Record<string, string> = {};
+  recoveryReady: Promise<void> = Promise.resolve();
 
   getRecoveryCommands(): Record<string, string> {
     return this.recoveryCommands;
@@ -329,6 +319,10 @@ export class TauriAdapter implements PlatformAdapter {
    * on this (docs/specs/standalone.md -> "Agent recovery").
    */
   async captureAgentRecovery(timeoutMs: number, ids?: string[]): Promise<void> {
+    // `ids` has no caller yet — a whole-Window quit interrupts everything — and
+    // is plumbed to the sidecar anyway, because closing one Window of several has
+    // to capture only that Window's panes (docs/specs/layout.md -> "Future",
+    // Scope: workspaces-rollout).
     try {
       await rawInvoke("capture_agent_recovery", { ids: ids ?? null, timeout: timeoutMs });
     } catch (err) {
@@ -342,6 +336,14 @@ export class TauriAdapter implements PlatformAdapter {
     } catch { return null; }
   }
 
+  /** One sidecar round trip, and one process scan inside it, for every pane a
+   *  save is about to persist. */
+  async getCwds(ids: string[]): Promise<Record<string, string | null>> {
+    try {
+      return await rawInvoke<Record<string, string | null>>("pty_get_cwds", { ids });
+    } catch { return {}; }
+  }
+
   // Warn-and-proceed: a stalled graceful kill must not wedge a quit teardown.
   // Callers own the timeout — the teardown bounds live in one place, quit.ts.
   async gracefulKillAllPtys(timeoutMs: number): Promise<void> {
@@ -529,11 +531,11 @@ export class TauriAdapter implements PlatformAdapter {
     this.replayHandlers.delete(handler);
   }
 
-  onRequestSessionFlush(handler: (detail: { requestId: string }) => void): void {
+  onRequestSessionFlush(handler: (detail: SessionFlushRequest) => void): void {
     this.flushHandlers.add(handler);
   }
 
-  offRequestSessionFlush(handler: (detail: { requestId: string }) => void): void {
+  offRequestSessionFlush(handler: (detail: SessionFlushRequest) => void): void {
     this.flushHandlers.delete(handler);
   }
 
@@ -550,7 +552,7 @@ export class TauriAdapter implements PlatformAdapter {
   // handler is registered (quit during boot, before the Wall mounts), resolve
   // immediately: there is nothing queued to flush. Called by the quit
   // orchestrator; pairs with drainSessionSaves to await the resulting Rust write.
-  requestSessionFlush(timeoutMs: number): Promise<void> {
+  requestSessionFlush(timeoutMs: number, options: { probeCwd?: boolean } = {}): Promise<void> {
     if (this.flushHandlers.size === 0) return Promise.resolve();
     const requestId = `flush-${++this.nextFlushRequestId}`;
     return new Promise<void>((resolve) => {
@@ -559,7 +561,7 @@ export class TauriAdapter implements PlatformAdapter {
       // hits notify's map-miss guard. Fan out after registering so a synchronous
       // completion still finds the entry (first notify wins — one Wall ships).
       setTimeout(() => this.notifySessionFlushComplete(requestId), timeoutMs);
-      for (const handler of this.flushHandlers) handler({ requestId });
+      for (const handler of this.flushHandlers) handler({ requestId, ...options });
     });
   }
 
@@ -640,8 +642,6 @@ export class TauriAdapter implements PlatformAdapter {
 
   // --- State persistence ---
 
-  private static STATE_KEY = 'dormouse.session';
-
   /**
    * Read by `saveSession`, which skips the whole record build — not just the
    * write — when a host persists nothing (`PlatformAdapter.persistsSession`).
@@ -650,31 +650,20 @@ export class TauriAdapter implements PlatformAdapter {
    */
   readonly persistsSession = true;
 
+  // No bare-Session slot on this host: the stored blob is a Window, and
+  // standalone boots per Workspace so nothing shared ever reaches these
+  // (`standalone/src/main.tsx`). The pair below is the real one.
+  saveState(_state: unknown): void {}
+  getState(): unknown { return null; }
+
   /** The aggregator's writer: one `PersistedWindow` per window
    *  (`docs/specs/transport.md` -> "Persisted session"). */
-  saveState(state: unknown): void {
-    try {
-      saveWindowState(this.sessionStore, TauriAdapter.STATE_KEY, state as PersistedWindow);
-    } catch {
-      console.error('[tauri-adapter] Failed to save session state');
-    }
-  }
-
-  /** The stored blob here is a Window, and the shared readers of `getState` want a
-   *  bare Session — so this answers nothing and `getWindowState` is the reader.
-   *  Standalone boots per Workspace, handing each plan its own record, so no
-   *  shared caller reaches this (`standalone/src/main.tsx`). */
-  getState(): unknown {
-    return null;
+  saveWindowState(snapshot: PersistedWindow): void {
+    this.windowSlot.write(snapshot);
   }
 
-  /** The persisted Window, read from the boot-seeded cache. */
   getWindowState(): PersistedWindow | null {
-    try {
-      return loadWindowState(this.sessionStore, TauriAdapter.STATE_KEY);
-    } catch {
-      return null;
-    }
+    return this.windowSlot.read();
   }
 
   // --- Notepad archive (docs/specs/notepad.md) ---
diff --git a/standalone/src/window-recovery.ts b/standalone/src/window-recovery.ts
new file mode 100644
index 000000000..8eb9b4cc6
--- /dev/null
+++ b/standalone/src/window-recovery.ts
@@ -0,0 +1,83 @@
+/**
+ * What both standalone adapters do identically with the Window: read it out of
+ * their key/value slot, write it back, and claim the agent-recovery record for
+ * the panes it names.
+ *
+ * The two differ only in their transport (Tauri `invoke` vs the harness's HTTP
+ * bridge) and their store (the Rust-backed `TauriSessionStore` vs
+ * `localStorage`), so each supplies those and nothing else
+ * (docs/specs/transport.md -> "Persisted session", "Consuming it").
+ */
+
+import {
+  loadWindowState,
+  saveWindowState,
+  type SessionKeyValueStore,
+} from "dormouse-lib/lib/window-persistence";
+import { windowPaneIds, type PersistedWindow } from "dormouse-lib/lib/session-types";
+
+export interface WindowStateSlot {
+  /** The stored Window. Parsed once — the store behind it is a boot-seeded
+   *  cache, and every write after that comes through `write` below. */
+  read(): PersistedWindow | null;
+  write(snapshot: PersistedWindow): void;
+}
+
+/**
+ * The Window slot over `store`. Both halves degrade rather than throw: an
+ * unreadable blob is a fresh start, and a failed write is one lost save, never a
+ * failed boot or a failed quit.
+ */
+export function windowStateSlot(
+  store: SessionKeyValueStore,
+  key: string,
+  logPrefix: string,
+): WindowStateSlot {
+  let current: PersistedWindow | null = null;
+  let known = false;
+  return {
+    read: () => {
+      if (!known) {
+        known = true;
+        try {
+          current = loadWindowState(store, key);
+        } catch {
+          current = null;
+        }
+      }
+      return current;
+    },
+    write: (snapshot) => {
+      known = true;
+      current = snapshot;
+      try {
+        saveWindowState(store, key, snapshot);
+      } catch {
+        console.error(`[${logPrefix}] Failed to save session state`);
+      }
+    },
+  };
+}
+
+/**
+ * Claim the resume invocations the last teardown captured for the panes `saved`
+ * names. Destructive in the sidecar on the first call, so a relaunch that gets
+ * this far can never replay them.
+ *
+ * A record that could not be read is one restore without auto-resume, never a
+ * failed boot.
+ */
+export async function claimRecoveryCommands(
+  take: (paneIds: string[]) => Promise<Record<string, string> | null | undefined>,
+  saved: PersistedWindow | null,
+  logPrefix: string,
+): Promise<Record<string, string>> {
+  const paneIds = windowPaneIds(saved);
+  if (paneIds.length === 0) return {};
+  try {
+    return (await take(paneIds)) ?? {};
+  } catch (err) {
+    console.error(`[${logPrefix}] take_recovery_commands failed:`, err);
+    return {};
+  }
+}
diff --git a/vscode-ext/src/pty-manager.ts b/vscode-ext/src/pty-manager.ts
index d7f3ae950..fdc6ad2e1 100644
--- a/vscode-ext/src/pty-manager.ts
+++ b/vscode-ext/src/pty-manager.ts
@@ -7,6 +7,7 @@ import { log } from './log';
 import type { DorControlCancelPayload, DorControlRequestPayload, DorControlResponsePayload } from '../../dor/src/protocol';
 import type { OpenPort } from '../../lib/src/lib/platform/types';
 import { OPEN_PORT_TIMEOUT_MS } from '../../lib/src/lib/platform/types';
+import { sliceSince } from '../../lib/src/host/replay-buffer';
 
 export interface PtyCallbacks {
   onData(id: string, data: string): void;
@@ -167,20 +168,7 @@ export function getScrollbackReceived(id: string): number {
 export function getScrollbackSince(id: string, mark: number): string {
   const entry = ptyBuffers.get(id);
   if (!entry) return '';
-  // Chunk eviction can have carried the mark off the front; the oldest char the
-  // buffer still holds is the furthest back this can honestly answer.
-  const oldestHeld = entry.receivedChars - entry.scrollbackChars;
-  const wanted = entry.receivedChars - Math.max(mark, oldestHeld);
-  if (wanted <= 0) return '';
-  const tail: string[] = [];
-  let held = 0;
-  for (let i = entry.scrollbackChunks.length - 1; i >= 0 && held < wanted; i--) {
-    const chunk = entry.scrollbackChunks[i];
-    tail.push(chunk);
-    held += chunk.length;
-  }
-  const joined = tail.reverse().join('');
-  return held > wanted ? joined.slice(held - wanted) : joined;
+  return sliceSince(entry.scrollbackChunks, entry.scrollbackChars, entry.receivedChars, mark);
 }
 
 let child: ChildProcess | null = null;
diff --git a/vscode-ext/src/session-state.ts b/vscode-ext/src/session-state.ts
index 905750378..a826c6f63 100644
--- a/vscode-ext/src/session-state.ts
+++ b/vscode-ext/src/session-state.ts
@@ -1,14 +1,12 @@
 import * as vscode from 'vscode';
-import * as fs from 'fs';
-import * as path from 'path';
 import * as ptyManager from './pty-manager';
 import type { AlertState } from '../../lib/src/lib/alert-manager';
 import { browserPersistedPane, readPersistedSession, toPersistedAlertState, type PersistedAlertState, type PersistedPane, type PersistedSession } from '../../lib/src/lib/session-types';
 import {
   captureAgentRecovery,
   DEFAULT_RECOVERY_WAIT_MS,
-  noCommands,
 } from '../../lib/src/host/recovery-capture';
+import { createRecoveryStore, type RecoveryStore } from '../../lib/src/host/recovery-store';
 import { log } from './log';
 
 const SESSION_STATE_KEY = 'dormouse.session';
@@ -88,33 +86,39 @@ export async function refreshSavedSessionStateFromPtys(
 }
 
 /**
- * Recovery is written to a plain file, synchronously — NOT to `workspaceState`.
+ * This activation's recovery record, in extension storage.
  *
+ * A plain file, written synchronously — NOT `workspaceState`.
  * `workspaceState.update()` hands the value to VS Code's storage service, which
  * batches its SQLite flush on its own schedule. By the time `deactivate()` runs
  * that service is already tearing down, so the write never reaches disk however
  * early it is issued: measured on a real machine, detection completed at +276ms
  * and the record still never appeared. A synchronous `writeFileSync` is durable
  * the instant it returns and needs no budget at all.
+ *
+ * The store itself is the Tauri sidecar's (`lib/src/host/recovery-store.ts`) —
+ * one record format, one destructive read, one set of file modes for both hosts.
+ * Created once per activation, because the remainder of a claimed record lives in
+ * it: `captureAgentRecoveryCommands` interrupts every live PTY, and those panes
+ * are spread across the Dormouse view and any number of editor panels, each
+ * restoring its own pane ids from its own saved state.
  */
-function recoveryFilePath(context: vscode.ExtensionContext): string | null {
-  const dir = context.storageUri?.fsPath ?? context.globalStorageUri?.fsPath;
-  return dir ? path.join(dir, 'recovery.json') : null;
-}
-
-interface PersistedRecovery {
-  createdAt: number;
-  /** Surface id -> canonical agent resume invocation. */
-  commands: Record<string, string>;
+let store: RecoveryStore | null = null;
+function recoveryStore(context: vscode.ExtensionContext): RecoveryStore {
+  store ??= createRecoveryStore(
+    context.storageUri?.fsPath ?? context.globalStorageUri?.fsPath,
+    { log: { info: (message) => log.info(message), error: (message) => log.error(message) } },
+  );
+  return store;
 }
 
 /**
  * Interrupt the live PTYs, then record each pane's agent resume invocation.
  *
  * The only writer of recovery state (docs/specs/vscode.md -> "Capturing agent
- * recovery"). The press-wait-press machine itself is shared with the Tauri
- * sidecar (`lib/src/host/recovery-capture.ts`); what stays here is the extension
- * host's half — where the record lives and how it is written.
+ * recovery"). Both halves are shared with the Tauri sidecar — the press-wait-press
+ * machine and the record store — so what stays here is which PTYs the extension
+ * host offers them.
  *
  * Two properties earn their complexity:
  *
@@ -134,47 +138,10 @@ export async function captureAgentRecoveryCommands(
   context: vscode.ExtensionContext,
   maxWaitMs = DEFAULT_RECOVERY_WAIT_MS,
 ): Promise<void> {
-  const file = recoveryFilePath(context);
-  if (!file) {
-    log.error('[recovery] no storage path available; cannot persist');
-    return;
-  }
-
-  // Clear the previous record before anything below can return early. A record is
-  // only ever consumed by a cold activation that actually opens the Dormouse view,
-  // so a teardown that captures nothing must not leave the last one sitting there:
-  // otherwise a session where the view is never opened carries the record forward,
-  // and a much later restore auto-runs a week-old invocation unprompted. The write
-  // path below re-creates it the moment anything is detected.
-  try {
-    fs.rmSync(file, { force: true });
-  } catch (err) {
-    log.error('[recovery] could not clear the previous record: ' + String(err));
-  }
-
-  const commands: Record<string, string> = noCommands();
-
-  // Persist on every change rather than once at the end. The write is a few
-  // hundred bytes and costs well under a millisecond, so there is no reason for
-  // it to wait behind a slow agent — and the shutdown budget can end this
-  // function at any instant. Writing eagerly makes the capture's settle loop a
-  // pure optimisation for *completeness*: being killed mid-poll now costs at most
-  // a late agent's command, never everything detected so far.
-  //
-  // Temp-then-rename so a kill during the write cannot leave a torn record for
-  // the next activation to parse (same durability trick as the standalone store,
-  // docs/specs/standalone.md).
-  const persist = (): void => {
-    const payload: PersistedRecovery = { createdAt: Date.now(), commands };
-    try {
-      fs.mkdirSync(path.dirname(file), { recursive: true });
-      const tmp = `${file}.tmp`;
-      fs.writeFileSync(tmp, JSON.stringify(payload), 'utf8');
-      fs.renameSync(tmp, file);
-    } catch (err) {
-      log.error('[recovery] write failed: ' + String(err));
-    }
-  };
+  const recovery = recoveryStore(context);
+  // The store logs the reason; nothing here can persist without a directory.
+  if (!recovery.persistent) return;
+  recovery.beginCapture();
 
   await captureAgentRecovery({
     // Exited PTYs are kept in the buffer map until `kill()`, and one can neither
@@ -184,38 +151,20 @@ export async function captureAgentRecoveryCommands(
     interrupt: (ids) => ptyManager.interrupt(ids),
     receivedChars: (id) => ptyManager.getScrollbackReceived(id),
     outputSince: (id, mark) => ptyManager.getScrollbackSince(id, mark),
-    onCommand: (id, command) => { commands[id] = command; persist(); },
+    onCommand: (id, command) => recovery.record(id, command),
     log: { info: (message) => log.info(message), error: (message) => log.error(message) },
   }, { maxWaitMs });
-  // Nothing to write here: every command was persisted the moment it was found.
+  // Nothing to write here: the store persisted every command as it was found.
 }
 
-/** How long a recovery record stays offerable. One cold activation consumes it;
- *  this only bounds a host that never comes back. */
-const RECOVERY_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
-
-/**
- * What is left of this activation's record, once the file has been read and
- * removed. `null` until the first `takeRecoveryCommands` call.
- *
- * The record is not the property of any one webview: `captureAgentRecoveryCommands`
- * interrupts every live PTY, and those panes are spread across the Dormouse view
- * and any number of editor panels, each restoring its own pane ids from its own
- * saved state. Holding the remainder here lets every container claim its share of
- * one file read, while entries leave the map as they are claimed so no id is ever
- * handed out twice.
- */
-let unclaimedRecovery: Record<string, string> | null = null;
-
 /**
  * Claim the recovery commands belonging to `paneIds` — `surfaceId -> invocation`
  * for the boot payload of one cold-starting webview.
  *
- * Exactly-once holds on two levels. The file is read and unlinked on the first
- * call of an activation, so the durable copy is gone before any webview can act
- * on it and a failed activation cannot replay it. Within the activation each
- * entry is removed as it is claimed, so a view that is disposed and re-resolved
- * (moving the panel container, say) restores without re-running the agent.
+ * Exactly-once holds on two levels, both the store's: the file is read and
+ * unlinked on the first call of an activation, and each entry leaves the
+ * remainder as it is claimed, so a view that is disposed and re-resolved (moving
+ * the panel container, say) restores without re-running the agent.
  *
  * The result never joins the persisted session — it rides its own boot global, so
  * the webview has nothing to write back and no save/restore cycle can resurrect it
@@ -225,67 +174,5 @@ export function takeRecoveryCommands(
   context: vscode.ExtensionContext,
   paneIds: Iterable<string>,
 ): Record<string, string> {
-  unclaimedRecovery ??= readAndClearRecoveryRecord(context);
-  const claimed: Record<string, string> = noCommands();
-  for (const id of paneIds) {
-    const command = unclaimedRecovery[id];
-    if (command === undefined) continue;
-    claimed[id] = command;
-    delete unclaimedRecovery[id];
-    log.info(`[recovery]   ${id} -> ${command}`);
-  }
-  log.info(`[recovery] handing ${Object.keys(claimed).length} command(s) to a cold restore`
-    + ` (${Object.keys(unclaimedRecovery).length} unclaimed)`);
-  return claimed;
-}
-
-function readAndClearRecoveryRecord(
-  context: vscode.ExtensionContext,
-): Record<string, string> {
-  const file = recoveryFilePath(context);
-  if (!file || !fs.existsSync(file)) return noCommands();
-
-  let recovery: PersistedRecovery | null = null;
-  try {
-    recovery = JSON.parse(fs.readFileSync(file, 'utf8')) as PersistedRecovery;
-  } catch (err) {
-    log.error('[recovery] unreadable record; discarding:', String(err));
-  }
-  // Destructive read, and destructive even on a parse failure: a record that
-  // cannot be understood must not sit on disk waiting to be retried forever.
-  try {
-    fs.unlinkSync(file);
-  } catch {
-    // If it cannot be removed, do not use it — better to lose one recovery than
-    // to re-run an agent on every activation from a record we cannot clear.
-    log.error('[recovery] could not clear record; ignoring it');
-    return noCommands();
-  }
-  if (!recovery) return noCommands();
-
-  const age = Date.now() - (recovery.createdAt ?? 0);
-  if (age > RECOVERY_MAX_AGE_MS) {
-    log.info(`[recovery] discarding record ${Math.round(age / 86_400_000)}d old`);
-    return noCommands();
-  }
-
-  // Shape-guard every entry, the way every other persisted blob here is guarded.
-  // This file is plain JSON on disk and its values end up typed into a shell, so
-  // a torn or hand-edited record must fail as one dropped entry rather than as
-  // something later code has to survive. `readInjectedRecoveryCommands` guards
-  // again on the webview side — this one keeps the bad value out of the boot
-  // payload in the first place, and says so in the log where it can be seen.
-  const raw: unknown = recovery.commands;
-  const commands: Record<string, string> = noCommands();
-  if (raw && typeof raw === 'object') {
-    for (const [id, command] of Object.entries(raw)) {
-      if (typeof command !== 'string') {
-        log.error(`[recovery] dropping ${id}: expected a string, got ${typeof command}`);
-        continue;
-      }
-      commands[id] = command;
-    }
-  }
-  log.info(`[recovery] read ${Object.keys(commands).length} command(s) from the record`);
-  return commands;
+  return recoveryStore(context).take(paneIds);
 }

From 586207bf23ed51963f9794c5d1f0c28bda966de4 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 9 Sep 2026 23:22:48 -0700
Subject: [PATCH 09/11] Fix the persistence and recovery gaps found in review
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Ten confirmed findings on Stage B, each with a test that fails without it:

- `getCwdsForPids` parses `err.stdout` when `lsof` exits non-zero over a dead
  pid, so one gone process no longer costs every pane its cwd for that save.
- Live helper PTYs are routed to the Workspace holding their source instead of
  all landing on the active one, where they were promoted to top-level panes and
  voided that Workspace's saved layout. `routeUnownedPtys` resolves parents
  across the whole live list before any slicing.
- The quit teardown ceiling is derived from the summed step budgets — including
  the round-trip margin Rust adds to the two sidecar steps — instead of a 10s
  literal below that sum, which aborted the final flush and drain.
- `readPersistedWindow` drops a duplicate Workspace id, and `restoreWindowOrFresh`
  degrades a throwing restore to a fresh Window and overwrites the blob, so a bad
  blob cannot leave the app rendering nothing on every launch.
- A Workspace with no record yet gets an empty-but-valid one at creation, so the
  blob's `activeWorkspaceId` always names a Workspace the blob contains.
- The aggregator writes synchronously on `pagehide` and stops debouncing from
  there, instead of arming a timer that never fires.
- A Wall unmounting because its Workspace was closed no longer publishes on the
  way out, which had undone `forgetWorkspaceSession`.
- The recovery store writes through a per-write temp name and removes it in a
  `finally`, so a failed write leaves nothing behind and two hosts sharing a
  storage directory cannot rename over each other.
- Both standalone adapters put `getCwds` behind `coalesceCwds`, folding the
  Walls' concurrent probes into one invoke.

The per-Workspace boot moves out of `main.tsx` into `standalone/src/window-restore.ts`
so it can be tested. `resumeOrRestore` is unchanged for single-Wall hosts.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QBf4rQbwuxV6n6v7E3twYe
---
 lib/src/components/WorkspaceWindow.test.tsx   |  20 +-
 .../wall/use-session-persistence.ts           |  10 +-
 lib/src/host/recovery-store.test.ts           |  15 ++
 lib/src/host/recovery-store.ts                |   8 +-
 lib/src/lib/reconnect.ts                      |   8 +-
 lib/src/lib/session-types.ts                  |  11 +-
 lib/src/lib/session-window.test.ts            |  17 ++
 lib/src/lib/window-session-aggregator.test.ts |  41 ++++
 lib/src/lib/window-session-aggregator.ts      |  62 +++++-
 lib/src/lib/workspace-store.ts                |   6 +
 standalone/sidecar/pty-core.js                |  17 +-
 standalone/sidecar/pty-core.test.js           |  22 +++
 standalone/src/browser-sidecar-adapter.ts     |  12 +-
 standalone/src/coalesce-cwds.test.ts          |  40 ++++
 standalone/src/coalesce-cwds.ts               |  50 +++++
 standalone/src/main.tsx                       |  69 +------
 standalone/src/quit.test.ts                   |  37 ++++
 standalone/src/quit.ts                        |  41 +++-
 standalone/src/tauri-adapter.test.ts          |  21 +++
 standalone/src/tauri-adapter.ts               |  10 +-
 standalone/src/window-restore.test.ts         | 178 ++++++++++++++++++
 standalone/src/window-restore.ts              | 148 +++++++++++++++
 22 files changed, 745 insertions(+), 98 deletions(-)
 create mode 100644 standalone/src/coalesce-cwds.test.ts
 create mode 100644 standalone/src/coalesce-cwds.ts
 create mode 100644 standalone/src/window-restore.test.ts
 create mode 100644 standalone/src/window-restore.ts

diff --git a/lib/src/components/WorkspaceWindow.test.tsx b/lib/src/components/WorkspaceWindow.test.tsx
index d2a8edaea..395451b74 100644
--- a/lib/src/components/WorkspaceWindow.test.tsx
+++ b/lib/src/components/WorkspaceWindow.test.tsx
@@ -20,7 +20,7 @@ import { getActivitySnapshot, setTerminalActivity } from '../lib/terminal-regist
 import { getWallHandle, listWallHandles, resetWallHandles } from './wall/wall-handles';
 import { mountWallHarness, type WallHarness } from './wall/wall-test-utils';
 import { getWorkspaceSurfacesSnapshot, resetWorkspaceSurfaces } from '../lib/workspace-surfaces';
-import { resetWindowSessionAggregator } from '../lib/window-session-aggregator';
+import { previousWorkspaceSession, publishWorkspaceSession, resetWindowSessionAggregator } from '../lib/window-session-aggregator';
 import { resetWorkspaceUi } from '../lib/workspace-ui-store';
 import {
   closeWorkspace,
@@ -205,6 +205,24 @@ describe('WorkspaceWindow', () => {
     expect(handle.surfaceIds()).toEqual([]);
   });
 
+  it('leaves no persisted record behind a closed Workspace', async () => {
+    // The closing Wall's unmount used to publish one last time, putting the
+    // Workspace it had just forgotten back into the next Window blob — with its
+    // Surfaces gone — for the next launch to restore as an empty Workspace.
+    await render();
+    await act(async () => { createWorkspace({ id: 'ws-2' }); });
+    await flush();
+    // Its Wall has saved at least once, as one does the moment it auto-spawns.
+    publishWorkspaceSession('ws-2', { version: 3, panes: [] });
+    expect(previousWorkspaceSession('ws-2')).not.toBeNull();
+
+    await act(async () => { await closeWorkspaceWithSurfaces('ws-2'); });
+    await flush();
+
+    expect(getWorkspacesSnapshot().workspaces.map((ws) => ws.id)).not.toContain('ws-2');
+    expect(previousWorkspaceSession('ws-2')).toBeNull();
+  });
+
   it('serializes two closes started together, so the survivor keeps its Surfaces', async () => {
     const first = getWorkspacesSnapshot().workspaces[0].id;
     await render();
diff --git a/lib/src/components/wall/use-session-persistence.ts b/lib/src/components/wall/use-session-persistence.ts
index 22370109f..5990e8c7a 100644
--- a/lib/src/components/wall/use-session-persistence.ts
+++ b/lib/src/components/wall/use-session-persistence.ts
@@ -4,6 +4,7 @@ import { getPlatform } from '../../lib/platform';
 import { saveSession, type SaveOptions, type SaveSink } from '../../lib/session-save';
 import { createSessionDirtyTracker } from '../../lib/session-dirty';
 import { previousWorkspaceSession, publishWorkspaceSession, SESSION_SAVE_DEBOUNCE_MS } from '../../lib/window-session-aggregator';
+import { hasWorkspace } from '../../lib/workspace-store';
 import {
   subscribeToActivity,
   subscribeToTerminalPaneState,
@@ -240,9 +241,16 @@ export function useSessionPersistence({
       unsubPaneState();
       unsubscribeStore();
       clearInterval(interval);
-      void persistSessionNow().catch(() => undefined);
+      // A Wall unmounting because its Workspace was closed must not publish on
+      // the way out: `closeWorkspaceWithSurfaces` has already forgotten the
+      // record, and re-publishing would put the closed Workspace back in the next
+      // Window blob (with its Surfaces gone) for the next launch to restore.
+      if (workspaceId === undefined || hasWorkspace(workspaceId)) {
+        void persistSessionNow().catch(() => undefined);
+      }
     };
   }, [
+    workspaceId,
     lath,
     flushSessionSave,
     ownsSurface,
diff --git a/lib/src/host/recovery-store.test.ts b/lib/src/host/recovery-store.test.ts
index d67f3e7af..75b68a212 100644
--- a/lib/src/host/recovery-store.test.ts
+++ b/lib/src/host/recovery-store.test.ts
@@ -65,6 +65,21 @@ describe('recovery store', () => {
       // Nothing was captured, so nothing can be claimed either.
       expect(store.take(['a'])).toEqual({});
     });
+
+    it('leaves no temp behind when the rename onto the record fails', () => {
+      // A directory where the record should be: the temp is written, the rename
+      // over it cannot succeed. A fixed `recovery.json.tmp` would sit there for
+      // the next run — and for any other host sharing this directory — to rename
+      // over the record half-written.
+      fs.mkdirSync(file());
+
+      const store = createRecoveryStore(dir, { log });
+      store.beginCapture();
+      expect(() => store.record('a', 'claude --continue')).not.toThrow();
+
+      expect(messages.some((message) => message.startsWith('error [recovery] write failed'))).toBe(true);
+      expect(fs.readdirSync(dir).filter((name) => name.endsWith('.tmp'))).toEqual([]);
+    });
   });
 
   describe('take', () => {
diff --git a/lib/src/host/recovery-store.ts b/lib/src/host/recovery-store.ts
index 7b9fd3d44..68f1ceaea 100644
--- a/lib/src/host/recovery-store.ts
+++ b/lib/src/host/recovery-store.ts
@@ -10,6 +10,7 @@
  * (docs/specs/transport.md -> "Consuming it").
  */
 
+import { randomUUID } from 'node:crypto';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { noCommands, silent, type RecoveryLog } from './recovery-capture';
@@ -64,15 +65,20 @@ export function createRecoveryStore(dir?: string, opts: { log?: RecoveryLog } =
   const persist = (): void => {
     if (!file) return;
     const payload: PersistedRecovery = { createdAt: Date.now(), commands: captured };
+    // Per-write name, never a fixed `${file}.tmp`: two hosts sharing this
+    // directory would otherwise rename each other's half-written temp over the
+    // record. The `finally` is what keeps a failed write from leaving one behind.
+    const tmp = `${file}.${randomUUID()}.tmp`;
     try {
       fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-      const tmp = `${file}.tmp`;
       // Mode on create, so the bytes are never briefly world-readable; the rename
       // preserves it.
       fs.writeFileSync(tmp, JSON.stringify(payload), { encoding: 'utf8', mode: 0o600 });
       fs.renameSync(tmp, file);
     } catch (err) {
       log.error(`[recovery] write failed: ${String(err)}`);
+    } finally {
+      try { fs.rmSync(tmp, { force: true }); } catch { /* the rename already took it */ }
     }
   };
 
diff --git a/lib/src/lib/reconnect.ts b/lib/src/lib/reconnect.ts
index ecf99f9f0..c13058ff4 100644
--- a/lib/src/lib/reconnect.ts
+++ b/lib/src/lib/reconnect.ts
@@ -150,9 +150,11 @@ function resumeLivePtys(
     if (savedInfo?.title !== undefined) resumeInfo.title = savedInfo.title;
     if (savedInfo?.untouched) resumeInfo.untouched = true;
     // A helper stays one only while its source is also live; helpers cannot
-    // have helpers. `ptyById` is this plan's slice, so a helper whose parent
-    // went to another Workspace is resumed as an ordinary pane rather than
-    // restored into a Wall that does not hold its source.
+    // have helpers. `ptyById` is this plan's slice, so a helper reaching a Wall
+    // that does not hold its source is resumed as an ordinary pane instead — a
+    // fallback, not a route: the Window planner sends every helper to its
+    // source's Workspace (`routeUnownedPtys` in
+    // `standalone/src/window-restore.ts`).
     const parent = pty.helper && ptyById.get(pty.helper.parentId);
     const helper = parent && !parent.helper ? pty.helper : undefined;
     if (helper) resumeInfo.helper = helper;
diff --git a/lib/src/lib/session-types.ts b/lib/src/lib/session-types.ts
index e28644b23..1edf66e81 100644
--- a/lib/src/lib/session-types.ts
+++ b/lib/src/lib/session-types.ts
@@ -274,11 +274,20 @@ export function readPersistedWindow(raw: unknown): PersistedWindow | null {
     return null;
   }
 
+  const seen = new Set<WorkspaceId>();
   const workspaces = (value.workspaces as unknown[])
     .map((ws): PersistedWorkspace | null => {
       if (!isRecord(ws) || typeof ws.id !== 'string' || typeof ws.name !== 'string') return null;
+      // First wins. A duplicate id is rejected outright by `setWorkspaces`, and a
+      // blob that throws there would leave the app with nothing rendered at all.
+      if (seen.has(ws.id)) {
+        console.warn(`[dormouse] Ignoring a duplicate persisted Workspace id: ${ws.id}`);
+        return null;
+      }
       const session = readPersistedSession(ws.session);
-      return session ? { id: ws.id, name: ws.name, session } : null;
+      if (!session) return null;
+      seen.add(ws.id);
+      return { id: ws.id, name: ws.name, session };
     })
     .filter((ws): ws is PersistedWorkspace => ws !== null);
   if (workspaces.length === 0) return null;
diff --git a/lib/src/lib/session-window.test.ts b/lib/src/lib/session-window.test.ts
index d30984c14..c61f4f33c 100644
--- a/lib/src/lib/session-window.test.ts
+++ b/lib/src/lib/session-window.test.ts
@@ -58,6 +58,23 @@ describe('readPersistedWindow', () => {
     expect(read?.workspaces[0].id).toBe('ws-a');
   });
 
+  it('keeps only the first of a duplicated Workspace id', () => {
+    // `setWorkspaces` rejects a duplicate outright, so a blob carrying one would
+    // otherwise take the whole launch down before anything rendered.
+    const win = {
+      version: 1 as const,
+      activeWorkspaceId: 'ws-a',
+      workspaces: [
+        { id: 'ws-a', name: 'First', session: sessionA },
+        { id: 'ws-a', name: 'Second', session: sessionB },
+      ],
+    };
+    const read = readPersistedWindow(win);
+    expect(read?.workspaces).toHaveLength(1);
+    expect(read?.workspaces[0].name).toBe('First');
+    expect(read?.activeWorkspaceId).toBe('ws-a');
+  });
+
   it('returns null for unusable input', () => {
     expect(readPersistedWindow(null)).toBeNull();
     expect(readPersistedWindow({ random: 'junk' })).toBeNull();
diff --git a/lib/src/lib/window-session-aggregator.test.ts b/lib/src/lib/window-session-aggregator.test.ts
index e5604bfe6..305c066da 100644
--- a/lib/src/lib/window-session-aggregator.test.ts
+++ b/lib/src/lib/window-session-aggregator.test.ts
@@ -1,3 +1,7 @@
+// @vitest-environment jsdom
+//
+// jsdom for the `pagehide` hook: the aggregator writes synchronously on unload,
+// and there is no unload without a `window`.
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import {
   flushWindowSession,
@@ -170,6 +174,43 @@ describe('window session aggregator', () => {
       expect(write.mock.calls.at(-1)?.[0].activeWorkspaceId).toBe(second);
     });
 
+    it('never names an active Workspace the blob does not contain', async () => {
+      // Creating a Workspace makes it active immediately; its Wall's first save
+      // is a debounce (or a heartbeat) away. A crash inside that window used to
+      // lose the new Workspace AND land the user on a different one.
+      const write = vi.fn();
+      installWindowSessionWriter(write);
+
+      const second = createWorkspace({ name: 'Second' }).id;
+
+      const snapshot = getWindowSnapshot();
+      expect(snapshot.activeWorkspaceId).toBe(second);
+      expect(snapshot.workspaces.map((ws) => ws.id)).toContain(second);
+      // Empty, but valid — it round-trips as a Workspace whose Wall starts fresh.
+      expect(snapshot.workspaces.at(-1)?.session).toEqual({ version: 3, panes: [] });
+
+      await settle();
+      expect(write.mock.calls.at(-1)?.[0].activeWorkspaceId).toBe(second);
+    });
+
+    it('writes synchronously on pagehide instead of arming a timer', async () => {
+      // The Walls flush on pagehide too, and a 500ms timer armed during unload
+      // never fires: without this the last save is simply lost.
+      const write = vi.fn();
+      installWindowSessionWriter(write);
+      publishWorkspaceSession(getWorkspacesSnapshot().workspaces[0].id, session('a'));
+      expect(write).not.toHaveBeenCalled();
+
+      window.dispatchEvent(new Event('pagehide'));
+
+      expect(write).toHaveBeenCalledTimes(1);
+      expect(write.mock.calls[0][0].workspaces[0].session.panes[0].id).toBe('a');
+
+      // A publish landing after pagehide is written straight through, too.
+      publishWorkspaceSession(getWorkspacesSnapshot().workspaces[0].id, session('b'));
+      expect(write).toHaveBeenCalledTimes(2);
+    });
+
     it('stops writing once uninstalled, pending timer included', async () => {
       const write = vi.fn();
       const uninstall = installWindowSessionWriter(write);
diff --git a/lib/src/lib/window-session-aggregator.ts b/lib/src/lib/window-session-aggregator.ts
index 7d45266b6..04bd3f835 100644
--- a/lib/src/lib/window-session-aggregator.ts
+++ b/lib/src/lib/window-session-aggregator.ts
@@ -19,6 +19,13 @@ let writer: ((snapshot: PersistedWindow) => void | Promise<void>) | null = null;
 let unsubscribeWorkspaces: (() => void) | null = null;
 let timer: ReturnType<typeof setTimeout> | null = null;
 let inFlight: Promise<void> | null = null;
+// Set while the page is going away, cleared if it comes back from the bfcache.
+// Nothing debounces from here on: a timer armed during `pagehide` never fires.
+let unloading = false;
+// Bound once. The aggregator is imported by Node-side tooling that has no
+// `window`, where the unload hooks simply do not exist.
+const addEventListener = typeof window === 'undefined' ? null : window.addEventListener.bind(window);
+const removeEventListener = typeof window === 'undefined' ? null : window.removeEventListener.bind(window);
 
 /**
  * How long a debounced save waits. One value for both levels: a Wall's own
@@ -66,7 +73,10 @@ export function previousWorkspaceSession(workspaceId: WorkspaceId): PersistedSes
 /**
  * The Window as it stands: Workspaces in strip order carrying the id, name, and
  * latest session of each. A Workspace with no record at all is omitted rather
- * than written empty.
+ * than written empty, and the active id then falls back to the first Workspace
+ * that is in the blob — a blob naming an absent Workspace restores nothing as
+ * active (`readPersistedWindow` repairs it, but only after the user has already
+ * landed somewhere unexpected).
  */
 export function getWindowSnapshot(): PersistedWindow {
   const { workspaces, activeId } = getWorkspacesSnapshot();
@@ -76,7 +86,10 @@ export function getWindowSnapshot(): PersistedWindow {
     if (!session) continue;
     collected.push({ id: workspace.id, name: workspace.name, session });
   }
-  return { version: 1, workspaces: collected, activeWorkspaceId: activeId };
+  const activeWorkspaceId = collected.some((workspace) => workspace.id === activeId)
+    ? activeId
+    : collected[0]?.id ?? activeId;
+  return { version: 1, workspaces: collected, activeWorkspaceId };
 }
 
 /**
@@ -90,16 +103,46 @@ export function getWindowSnapshot(): PersistedWindow {
 export function installWindowSessionWriter(write: (snapshot: PersistedWindow) => void | Promise<void>): () => void {
   writer = write;
   unsubscribeWorkspaces?.();
-  unsubscribeWorkspaces = subscribeToWorkspaces(scheduleWrite);
+  unsubscribeWorkspaces = subscribeToWorkspaces(onWorkspacesChanged);
+  addEventListener?.('pagehide', handlePageHide);
+  addEventListener?.('pageshow', handlePageShow);
   return () => {
     if (writer !== write) return;
     writer = null;
     unsubscribeWorkspaces?.();
     unsubscribeWorkspaces = null;
+    removeEventListener?.('pagehide', handlePageHide);
+    removeEventListener?.('pageshow', handlePageShow);
     cancelPending();
   };
 }
 
+/** The Window is going away. Write what the records hold NOW: a debounced write
+ *  scheduled here never runs, so the alternative is losing the last save. */
+function handlePageHide(): void {
+  unloading = true;
+  cancelPending();
+  writeNow();
+}
+
+/** Restored from the bfcache — debouncing resumes. */
+function handlePageShow(): void {
+  unloading = false;
+}
+
+/**
+ * A Workspace the store holds but nothing has published for — a just-created one
+ * — gets an empty-but-valid record, so `activeWorkspaceId` always names a
+ * Workspace the blob contains. Without it, a crash between creating a Workspace
+ * and its Wall's first save drops the new Workspace and lands the user elsewhere.
+ */
+function onWorkspacesChanged(): void {
+  for (const workspace of getWorkspacesSnapshot().workspaces) {
+    if (!records.has(workspace.id)) records.set(workspace.id, { version: 3, panes: [] });
+  }
+  scheduleWrite();
+}
+
 /**
  * Write now and resolve when the host has taken the snapshot. The quit teardown's
  * step between the last Wall flush and the host's own drain — a debounce timer
@@ -114,7 +157,15 @@ export async function flushWindowSession(): Promise<void> {
 }
 
 function scheduleWrite(): void {
-  if (!writer || timer) return;
+  if (!writer) return;
+  // A publish that lands during `pagehide` — the Walls flush there too — has no
+  // later tick to be written on.
+  if (unloading) {
+    cancelPending();
+    writeNow();
+    return;
+  }
+  if (timer) return;
   timer = setTimeout(() => {
     timer = null;
     writeNow();
@@ -139,6 +190,9 @@ export function resetWindowSessionAggregator(): void {
   writer = null;
   unsubscribeWorkspaces?.();
   unsubscribeWorkspaces = null;
+  removeEventListener?.('pagehide', handlePageHide);
+  removeEventListener?.('pageshow', handlePageShow);
+  unloading = false;
   cancelPending();
   inFlight = null;
 }
diff --git a/lib/src/lib/workspace-store.ts b/lib/src/lib/workspace-store.ts
index 6749a107c..426921a4d 100644
--- a/lib/src/lib/workspace-store.ts
+++ b/lib/src/lib/workspace-store.ts
@@ -48,6 +48,12 @@ export function getActiveWorkspaceId(): WorkspaceId {
   return state.activeId;
 }
 
+/** Whether this Window still holds the Workspace. A Wall unmounting after its
+ *  Workspace was closed reads `false`, which is what stops its teardown save. */
+export function hasWorkspace(id: WorkspaceId): boolean {
+  return state.workspaces.some((workspace) => workspace.id === id);
+}
+
 let workspaceSequence = 0;
 
 /** A process-unique WorkspaceId, even when the random source repeats. */
diff --git a/standalone/sidecar/pty-core.js b/standalone/sidecar/pty-core.js
index 05b39d081..8d1f52c5a 100644
--- a/standalone/sidecar/pty-core.js
+++ b/standalone/sidecar/pty-core.js
@@ -573,16 +573,23 @@ function getCwdsForPids(pids, runtime = {}) {
 
   // macOS: lsof. `-a` is required so `-p` and `-d cwd` are combined instead
   // of OR'ed, which otherwise returns unrelated processes and often `/`.
+  let out = '';
   try {
-    const out = execFileSyncFn('lsof', ['-a', '-d', 'cwd', '-p', unresolved.join(','), '-Fn'], {
+    out = execFileSyncFn('lsof', ['-a', '-d', 'cwd', '-p', unresolved.join(','), '-Fn'], {
       encoding: 'utf-8',
       stdio: ['ignore', 'pipe', 'ignore'],
       windowsHide: true, // see runPowerShell: avoid the console-allocation deadlock
     });
-    for (const [pid, cwd] of parseCwdsFromLsof(out)) {
-      if (cwd) found.set(pid, cwd);
-    }
-  } catch { /* fallback: every unresolved pid stays absent */ }
+  } catch (err) {
+    // `lsof` exits non-zero when ANY requested pid is gone, and still prints the
+    // ones it did resolve. Throwing that stdout away is what turned one dead pid
+    // into every pane losing its cwd for that save — and a quit teardown, which
+    // kills and then flushes, is exactly when a pid goes missing mid-batch.
+    out = typeof err?.stdout === 'string' ? err.stdout : (err?.stdout?.toString('utf-8') ?? '');
+  }
+  for (const [pid, cwd] of parseCwdsFromLsof(out)) {
+    if (cwd) found.set(pid, cwd);
+  }
 
   return found;
 }
diff --git a/standalone/sidecar/pty-core.test.js b/standalone/sidecar/pty-core.test.js
index 6d4b0d8b9..feeb4ca4a 100644
--- a/standalone/sidecar/pty-core.test.js
+++ b/standalone/sidecar/pty-core.test.js
@@ -1584,6 +1584,28 @@ test('getCwdsForPids resolves every pid in ONE lsof call', () => {
   assert.deepEqual([...cwds], [[4242, '/home/tester/one'], [4243, '/home/tester/two']]);
 });
 
+test('getCwdsForPids keeps the live pids when lsof exits non-zero over a dead one', () => {
+  // `lsof -p live,dead` exits 1 and still prints the live block on stdout.
+  const err = new Error('Command failed: lsof');
+  err.status = 1;
+  err.stdout = ['p4242', 'fcwd', 'n/home/tester/one', ''].join('\n');
+  const cwds = getCwdsForPids([4242, 4243], {
+    fsModule: { readlinkSync: () => { throw new Error('ENOENT'); } },
+    execFileSync() { throw err; },
+  });
+
+  assert.deepEqual([...cwds], [[4242, '/home/tester/one']]);
+});
+
+test('getCwdsForPids survives an lsof failure with no stdout at all', () => {
+  const cwds = getCwdsForPids([4242], {
+    fsModule: { readlinkSync: () => { throw new Error('ENOENT'); } },
+    execFileSync() { throw new Error('spawn ENOENT'); },
+  });
+
+  assert.equal(cwds.size, 0);
+});
+
 test('getCwdsForPids reads /proc where it can and never spawns for those pids', () => {
   let spawned = false;
   const cwds = getCwdsForPids([7, 8], {
diff --git a/standalone/src/browser-sidecar-adapter.ts b/standalone/src/browser-sidecar-adapter.ts
index ba0f653ca..155fd4957 100644
--- a/standalone/src/browser-sidecar-adapter.ts
+++ b/standalone/src/browser-sidecar-adapter.ts
@@ -36,6 +36,7 @@ import { normalizeExternalUri } from "dormouse-lib/lib/external-links";
 import { createMemoryNotepadArchivePort } from "dormouse-lib/lib/notepad/memory-archive-port";
 import type { PersistedAlertState, PersistedWindow } from "dormouse-lib/lib/session-types";
 import { claimRecoveryCommands, windowStateSlot } from "./window-recovery";
+import { coalesceCwds } from "./coalesce-cwds";
 import {
   applyTerminalProtocolEvents,
   collectTerminalSemanticEvents,
@@ -164,9 +165,14 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
     try { return await this.host.invoke("pty_get_cwd", { id }); } catch { return null; }
   }
 
-  /** See TauriAdapter: one round trip, one process scan, for the whole save. */
-  async getCwds(ids: string[]): Promise<Record<string, string | null>> {
-    try { return await this.host.invoke("pty_get_cwds", { ids }); } catch { return {}; }
+  /** See TauriAdapter: one round trip, one process scan, for the whole save —
+   *  coalesced the same way, because the harness runs the same Walls. */
+  private readonly cwdBatch = coalesceCwds(async (ids) => {
+    try { return await this.host.invoke<Record<string, string | null>>("pty_get_cwds", { ids }); } catch { return {}; }
+  });
+
+  getCwds(ids: string[]): Promise<Record<string, string | null>> {
+    return this.cwdBatch(ids);
   }
 
   /** See TauriAdapter: claimed once during `init()`, read synchronously by the
diff --git a/standalone/src/coalesce-cwds.test.ts b/standalone/src/coalesce-cwds.test.ts
new file mode 100644
index 000000000..5bd6e971b
--- /dev/null
+++ b/standalone/src/coalesce-cwds.test.ts
@@ -0,0 +1,40 @@
+import { describe, expect, it } from "vitest";
+import { coalesceCwds } from "./coalesce-cwds";
+
+describe("coalesceCwds", () => {
+  it("turns the Walls' concurrent asks into one invoke", async () => {
+    // The quit flush fans out to every Wall at once; on macOS each uncoalesced
+    // request is another `lsof` on the sidecar's only event loop.
+    const calls: string[][] = [];
+    const getCwds = coalesceCwds(async (ids) => {
+      calls.push(ids);
+      return Object.fromEntries(ids.map((id) => [id, `/cwd/${id}`]));
+    });
+
+    const [a, b] = await Promise.all([getCwds(["p1", "p2"]), getCwds(["p3"])]);
+
+    expect(calls).toEqual([["p1", "p2", "p3"]]);
+    // Each caller still gets exactly the ids it asked for.
+    expect(a).toEqual({ p1: "/cwd/p1", p2: "/cwd/p2" });
+    expect(b).toEqual({ p3: "/cwd/p3" });
+  });
+
+  it("answers null for an id the host did not resolve", async () => {
+    const getCwds = coalesceCwds(async () => ({ p1: "/one" }));
+
+    await expect(getCwds(["p1", "p2"])).resolves.toEqual({ p1: "/one", p2: null });
+  });
+
+  it("does not fold a later save into a request already in flight", async () => {
+    const calls: string[][] = [];
+    const getCwds = coalesceCwds(async (ids) => {
+      calls.push(ids);
+      return {};
+    });
+
+    await getCwds(["p1"]);
+    await getCwds(["p2"]);
+
+    expect(calls).toEqual([["p1"], ["p2"]]);
+  });
+});
diff --git a/standalone/src/coalesce-cwds.ts b/standalone/src/coalesce-cwds.ts
new file mode 100644
index 000000000..124820eab
--- /dev/null
+++ b/standalone/src/coalesce-cwds.ts
@@ -0,0 +1,50 @@
+/**
+ * One `pty_get_cwds` for every Workspace asking at once.
+ *
+ * A quit flush fans out to every Wall concurrently and each answers with its own
+ * `getCwds`, so N Workspaces cost N sidecar round trips — and, on macOS, N `lsof`
+ * spawns on the sidecar's only event loop, serialized inside the shutdown budget.
+ * Batching is already the rule one layer down (`getCwdsForPids` in
+ * `standalone/sidecar/pty-core.js`); this extends it across the callers.
+ *
+ * Shared by both standalone adapters, which differ only in how they invoke.
+ */
+
+/** Ask the host for these ids' cwds. Answers a key per requested id. */
+export type CwdInvoke = (ids: string[]) => Promise<Record<string, string | null>>;
+
+/**
+ * Wrap `invoke` so calls arriving before the current microtask drains become one
+ * request. The window is a microtask, not a timer: a save must never wait on a
+ * clock, and the fan-out this exists for is synchronous — every Wall reacts to
+ * the same flush request.
+ */
+export function coalesceCwds(invoke: CwdInvoke): CwdInvoke {
+  // The batch being filled, if one is open. Cleared the moment it is sent, so a
+  // call arriving after that opens the next one instead of joining a request
+  // already in flight.
+  let pending: { ids: Set<string>; result: Promise<Record<string, string | null>> } | null = null;
+
+  return async (ids: string[]): Promise<Record<string, string | null>> => {
+    let batch = pending;
+    if (!batch) {
+      const opened: { ids: Set<string>; result?: Promise<Record<string, string | null>> } = {
+        ids: new Set(ids),
+      };
+      opened.result = Promise.resolve().then(() => {
+        pending = null;
+        return invoke([...opened.ids]);
+      });
+      batch = opened as { ids: Set<string>; result: Promise<Record<string, string | null>> };
+      pending = batch;
+    } else {
+      for (const id of ids) batch.ids.add(id);
+    }
+    const all = await batch.result;
+    // Each caller sees only what it asked for, keyed for every id it named — the
+    // shape a single `getCwds` answers with.
+    const mine: Record<string, string | null> = {};
+    for (const id of ids) mine[id] = all[id] ?? null;
+    return mine;
+  };
+}
diff --git a/standalone/src/main.tsx b/standalone/src/main.tsx
index fb5300f80..0de951acd 100644
--- a/standalone/src/main.tsx
+++ b/standalone/src/main.tsx
@@ -3,15 +3,7 @@ import { createRoot } from "react-dom/client";
 import { setPlatform } from "dormouse-lib/lib/platform";
 import { installPeerSurfaceResponder } from "dormouse-lib/remote/burrow/peer-surfaces";
 import type { PlatformAdapter } from "dormouse-lib/lib/platform/types";
-import { collectLivePtys, resumeOrRestoreFrom } from "dormouse-lib/lib/reconnect";
-import {
-  installWindowSessionWriter,
-  seedWindowSession,
-} from "dormouse-lib/lib/window-session-aggregator";
-import { setWorkspaces } from "dormouse-lib/lib/workspace-store";
-import { DEFAULT_WORKSPACE_ID, windowPaneIds } from "dormouse-lib/lib/session-types";
-import type { PersistedSession, WorkspaceId } from "dormouse-lib/lib/session-types";
-import { wallBootFromResult, type WallBootPlans } from "dormouse-lib/components/wall/wall-types";
+import { restoreWindowOrFresh } from "./window-restore";
 import { seedShellStore } from "dormouse-lib/lib/shell-store";
 import { restoreActiveTheme } from "dormouse-lib/lib/themes";
 import App from "dormouse-lib/App";
@@ -132,7 +124,7 @@ async function bootstrap() {
   // omits `shell` and the sidecar resolves the OS default itself.
   seedShellStore(await shellsPromise);
 
-  const initialPlans = await restoreWindow(platform);
+  const initialPlans = await restoreWindowOrFresh(platform);
 
   startUpdateCheck();
 
@@ -150,61 +142,4 @@ async function bootstrap() {
   );
 }
 
-/**
- * Rebuild the Window: install its Workspaces, then plan each one's Session off a
- * single view of the host's live PTYs (docs/specs/layout.md → "Session
- * persistence").
- *
- * Reload and relaunch are the same code path with a different live list. On a
- * reload the PTYs are still there and partition by saved pane id, so every
- * Workspace resumes over its own; on a relaunch the list is empty and every
- * Workspace cold-restores into fresh shells at its saved cwds, with nothing
- * replayed because scrollback is never persisted.
- */
-async function restoreWindow(platform: PlatformAdapter): Promise<WallBootPlans> {
-  const saved = platform.getWindowState?.() ?? null;
-  // Before any Wall mounts: a Workspace's first save compares against its own
-  // record, and a snapshot taken mid-boot must not replace a restored Workspace
-  // with a blank one.
-  seedWindowSession(saved);
-  if (saved) {
-    setWorkspaces({
-      workspaces: saved.workspaces.map(({ id, name }) => ({ id, name })),
-      activeId: saved.activeWorkspaceId,
-    });
-  }
-  // After `setWorkspaces`, so installing does not immediately write back what was
-  // just read.
-  installWindowSessionWriter((snapshot) => platform.saveWindowState?.(snapshot));
-
-  const live = await collectLivePtys(platform);
-  const restoring: Array<{ id: WorkspaceId; session: PersistedSession | null }> =
-    saved?.workspaces ?? [{ id: DEFAULT_WORKSPACE_ID, session: null }];
-  const activeId = saved?.activeWorkspaceId ?? DEFAULT_WORKSPACE_ID;
-
-  // A live PTY no saved Workspace names — a pane created inside the last save's
-  // debounce, or one left by a Workspace that is gone — goes to the active
-  // Workspace rather than being stranded with no Wall.
-  const liveIds = live.ptys.map((pty) => pty.id);
-  const named = windowPaneIds(saved);
-  const namedSet = new Set(named);
-  const unowned = new Set(liveIds.filter((id) => !namedSet.has(id)));
-
-  // The recovery claim is a host round trip started back in `init()`. Await it
-  // only when something here can actually cold-restore: a Window whose every
-  // saved pane is live resumes over those PTYs and never reads the record.
-  const liveSet = new Set(liveIds);
-  if (!named.every((id) => liveSet.has(id))) await platform.recoveryReady;
-
-  const plans: WallBootPlans = {};
-  for (const { id, session } of restoring) {
-    const result = resumeOrRestoreFrom(platform, live, {
-      savedSession: session,
-      ptyIds: new Set(session?.panes.map((pane) => pane.id) ?? []),
-      ...(id === activeId ? { claimUnowned: unowned } : {}),
-    });
-    plans[id] = wallBootFromResult(result);
-  }
-  return plans;
-}
 bootstrap();
diff --git a/standalone/src/quit.test.ts b/standalone/src/quit.test.ts
index 7ed5d3462..22c9dce3b 100644
--- a/standalone/src/quit.test.ts
+++ b/standalone/src/quit.test.ts
@@ -157,6 +157,43 @@ describe("quit orchestrator", () => {
     ]);
   });
 
+  it("finishes the final save when every step takes its worst-case time", async () => {
+    // The webview-observable worst case of each step: the two that reach the
+    // sidecar wait Rust's `timeout + 1500ms` round-trip margin on top of their own
+    // budget. A ceiling below the sum of these aborts exactly the last flush and
+    // the drain — the final save — so `drain` must still land before the exit.
+    vi.useFakeTimers();
+    try {
+      const order: string[] = [];
+      mocks.invoke.mockImplementation(async (cmd: string) => {
+        order.push(cmd);
+        return undefined;
+      });
+      const slow = (name: string, ms: number) => () =>
+        new Promise<void>((resolve) => {
+          setTimeout(() => {
+            order.push(name);
+            resolve();
+          }, ms);
+        });
+      const adapter = fakeAdapter(order, {
+        captureRecovery: slow("captureRecovery", 1300 + 1500),
+        flush: slow("flush", 1500),
+        gracefulKill: slow("gracefulKill", 2000 + 1500),
+        drain: slow("drain", 2000),
+      });
+
+      initQuitFlow(adapter);
+      quitRequested!();
+      await vi.advanceTimersByTimeAsync(30_000);
+
+      expect(order).toContain("drain");
+      expect(order.indexOf("drain")).toBeLessThan(order.indexOf("quit_proceed"));
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it("still saves and exits when the recovery capture rejects", async () => {
     // Recovery is the one step whose data cannot be reconstructed, but losing it
     // must never cost the save behind it.
diff --git a/standalone/src/quit.ts b/standalone/src/quit.ts
index f3574fd3e..5115fc1fc 100644
--- a/standalone/src/quit.ts
+++ b/standalone/src/quit.ts
@@ -126,11 +126,32 @@ async function archiveThenTeardown(): Promise<void> {
   await runQuitTeardown();
 }
 
+// Each teardown step's own bound, and the ceiling derived from them. The two
+// steps that reach the sidecar wait `timeout + SIDECAR_ROUND_TRIP_MARGIN_MS` —
+// the margin Rust adds in `standalone/src-tauri/src/lib.rs` — so the webview can
+// observe more than the number it passed in. A ceiling below the sum would abort
+// the last steps of a slow teardown instead of guarding a wedged one, and those
+// last steps are the final save.
+const SIDECAR_ROUND_TRIP_MARGIN_MS = 1500;
+const PRE_KILL_FLUSH_MS = 1500;
+const GRACEFUL_KILL_MS = 2000;
+const POST_KILL_FLUSH_MS = 1500;
+const DRAIN_MS = 2000;
+const STEP_BUDGET_TOTAL_MS =
+  (DEFAULT_RECOVERY_WAIT_MS + SIDECAR_ROUND_TRIP_MARGIN_MS) +
+  PRE_KILL_FLUSH_MS +
+  (GRACEFUL_KILL_MS + SIDECAR_ROUND_TRIP_MARGIN_MS) +
+  POST_KILL_FLUSH_MS +
+  DRAIN_MS;
+/** Belt-and-suspenders over the summed step budgets, with slack for scheduling.
+ *  Stays under Rust's `QUIT_PHASE_TIMEOUT_MS` (14 000 ms), which is what actually
+ *  forces the exit. Exported for the test that pins it above the sum. */
+export const QUIT_TEARDOWN_CEILING_MS = STEP_BUDGET_TOTAL_MS + 1000;
+
 // Ordering and rationale: docs/specs/standalone.md §Quit flow (Teardown
-// ordering). The 10s ceiling is belt-and-suspenders over the per-step bounds.
-// `quit_progress` tells Rust teardown has begun (ending the confirmation-wait
-// suspension) and marks each phase boundary so its watchdog gives teardown and
-// install separate budgets rather than one shared clock.
+// ordering). `quit_progress` tells Rust teardown has begun (ending the
+// confirmation-wait suspension) and marks each phase boundary so its watchdog
+// gives teardown and install separate budgets rather than one shared clock.
 async function runQuitTeardown(): Promise<void> {
   quitPhase = "tearing-down";
   const adapter = quitAdapter;
@@ -147,16 +168,16 @@ async function runQuitTeardown(): Promise<void> {
           // every live PTY.
           await adapter.captureAgentRecovery(DEFAULT_RECOVERY_WAIT_MS).catch((err) =>
             console.warn("[quit] agent recovery capture failed; proceeding", err));
-          await adapter.requestSessionFlush(1500); // save while PTYs are alive
-          await adapter.gracefulKillAllPtys(2000); // SIGTERM; wait for exits and final output
+          await adapter.requestSessionFlush(PRE_KILL_FLUSH_MS); // save while PTYs are alive
+          await adapter.gracefulKillAllPtys(GRACEFUL_KILL_MS); // SIGTERM; wait for exits and final output
           // Final post-exit save. Nothing left to probe a cwd from, and each pane
           // keeps the one the save above recorded.
-          await adapter.requestSessionFlush(1500, { probeCwd: false });
+          await adapter.requestSessionFlush(POST_KILL_FLUSH_MS, { probeCwd: false });
           await flushWindowSession(); // the Walls' records become one Window blob
-          await adapter.drainSessionSaves(2000); // last write reaches disk
+          await adapter.drainSessionSaves(DRAIN_MS); // last write reaches disk
         })(),
-        10000,
-        "[quit] teardown exceeded 10000ms; proceeding to exit",
+        QUIT_TEARDOWN_CEILING_MS,
+        `[quit] teardown exceeded ${QUIT_TEARDOWN_CEILING_MS}ms; proceeding to exit`,
       );
     }
     // Install strictly after the completed final save. A fresh `quit_progress`
diff --git a/standalone/src/tauri-adapter.test.ts b/standalone/src/tauri-adapter.test.ts
index b06376cfa..049265cce 100644
--- a/standalone/src/tauri-adapter.test.ts
+++ b/standalone/src/tauri-adapter.test.ts
@@ -87,6 +87,27 @@ describe("TauriAdapter session-flush handshake", () => {
   });
 });
 
+describe("TauriAdapter cwd probing", () => {
+  it("sends one pty_get_cwds for the Workspaces saving together", async () => {
+    // Every Wall answers the quit flush with its own `getCwds`; uncoalesced,
+    // N Workspaces cost N sidecar round trips and N `lsof` spawns inside them.
+    const adapter = new TauriAdapter();
+    vi.mocked(rawInvoke).mockImplementation(async (cmd: string, args?: unknown) => {
+      if (cmd !== "pty_get_cwds") return undefined;
+      const ids = (args as { ids: string[] }).ids;
+      return Object.fromEntries(ids.map((id) => [id, `/cwd/${id}`]));
+    });
+
+    const [a, b] = await Promise.all([adapter.getCwds(["pane-a"]), adapter.getCwds(["pane-b"])]);
+
+    const cwdCalls = vi.mocked(rawInvoke).mock.calls.filter(([cmd]) => cmd === "pty_get_cwds");
+    expect(cwdCalls).toHaveLength(1);
+    expect(cwdCalls[0][1]).toEqual({ ids: ["pane-a", "pane-b"] });
+    expect(a).toEqual({ "pane-a": "/cwd/pane-a" });
+    expect(b).toEqual({ "pane-b": "/cwd/pane-b" });
+  });
+});
+
 // docs/specs/transport.md -> "The governing rule": standalone restores window
 // state, so nothing is deleted at boot and the record is claimed once.
 describe("TauriAdapter window persistence", () => {
diff --git a/standalone/src/tauri-adapter.ts b/standalone/src/tauri-adapter.ts
index b464af1a8..d3000ec97 100644
--- a/standalone/src/tauri-adapter.ts
+++ b/standalone/src/tauri-adapter.ts
@@ -2,6 +2,7 @@ import type { HelperIdentity, TerminalContextRequest, TerminalContextInfo } from
 import { invoke as rawInvoke } from "@tauri-apps/api/core";
 import { listen } from "@tauri-apps/api/event";
 import { open } from "@tauri-apps/plugin-shell";
+import { coalesceCwds } from "./coalesce-cwds";
 import type {
   AgentBrowserCommandResult,
   AgentBrowserEditOp,
@@ -337,11 +338,16 @@ export class TauriAdapter implements PlatformAdapter {
   }
 
   /** One sidecar round trip, and one process scan inside it, for every pane a
-   *  save is about to persist. */
-  async getCwds(ids: string[]): Promise<Record<string, string | null>> {
+   *  save is about to persist — across every Workspace saving at the same
+   *  moment, not just one (`coalesceCwds`). */
+  private readonly cwdBatch = coalesceCwds(async (ids) => {
     try {
       return await rawInvoke<Record<string, string | null>>("pty_get_cwds", { ids });
     } catch { return {}; }
+  });
+
+  getCwds(ids: string[]): Promise<Record<string, string | null>> {
+    return this.cwdBatch(ids);
   }
 
   // Warn-and-proceed: a stalled graceful kill must not wedge a quit teardown.
diff --git a/standalone/src/window-restore.test.ts b/standalone/src/window-restore.test.ts
new file mode 100644
index 000000000..7c1b1db63
--- /dev/null
+++ b/standalone/src/window-restore.test.ts
@@ -0,0 +1,178 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+// The planner is pure routing over the live PTY list; standing up real xterm
+// hosts for it needs a browser. Mocked exactly as `lib/src/lib/reconnect.test.ts`
+// does, so what stays real is the slicing and the helper store.
+const registryMocks = vi.hoisted(() => ({
+  restoreBrowserSurfaceTodo: vi.fn(),
+  resumeTerminal: vi.fn(),
+  restoreTerminal: vi.fn(),
+  getDefaultShellOpts: vi.fn(() => null),
+}));
+vi.mock("dormouse-lib/lib/terminal-registry", () => registryMocks);
+
+import type { PlatformAdapter, PtyInfo } from "dormouse-lib/lib/platform/types";
+import type { PersistedSession, PersistedWindow } from "dormouse-lib/lib/session-types";
+import { forgetHelper, getHelper } from "dormouse-lib/lib/helper-terminal";
+import { setPlatform } from "dormouse-lib/lib/platform";
+import { getWorkspacesSnapshot, resetWorkspaces } from "dormouse-lib/lib/workspace-store";
+import { resetWindowSessionAggregator } from "dormouse-lib/lib/window-session-aggregator";
+import type { LathNode } from "dormouse-lib/lib/lath/model";
+import { restoreWindowOrFresh, routeUnownedPtys } from "./window-restore";
+
+/** A native Lath layout over `ids` — what every post-Lath save carries. */
+function lathLayoutFor(...ids: string[]) {
+  const nodes = ids.map((id): LathNode => ({ kind: "leaf", id }));
+  const root: LathNode | null =
+    nodes.length === 0
+      ? null
+      : nodes.length === 1
+        ? nodes[0]
+        : { kind: "split", dir: "row", children: nodes.map((node) => ({ node, weight: 1 / nodes.length })) };
+  return {
+    version: 1 as const,
+    tree: { root },
+    leafMeta: Object.fromEntries(
+      ids.map((id) => [id, { component: "terminal", tabComponent: "terminal", title: id }]),
+    ),
+  };
+}
+
+const sessionOver = (...ids: string[]): PersistedSession => ({
+  version: 3,
+  lathLayout: lathLayoutFor(...ids),
+  panes: ids.map((id) => ({ id, title: id, cwd: null, untouched: false })),
+});
+
+/** Enough adapter for the boot path: the PTY list handshake plus the Window slot. */
+function fakePlatform(ptys: PtyInfo[], saved: PersistedWindow | null) {
+  const listHandlers = new Set<(detail: { ptys: PtyInfo[] }) => void>();
+  const replayHandlers = new Set<(detail: { id: string; data: string }) => void>();
+  const saves: PersistedWindow[] = [];
+  const platform = {
+    recoveryReady: Promise.resolve(),
+    getRecoveryCommands: () => ({}),
+    getState: () => null,
+    saveState: vi.fn(),
+    getWindowState: () => saved,
+    saveWindowState: (snapshot: PersistedWindow) => { saves.push(snapshot); },
+    requestInit: () => {
+      for (const handler of listHandlers) handler({ ptys });
+      for (const pty of ptys) for (const handler of replayHandlers) handler({ id: pty.id, data: "" });
+    },
+    onPtyList: (handler: (detail: { ptys: PtyInfo[] }) => void) => { listHandlers.add(handler); },
+    offPtyList: (handler: (detail: { ptys: PtyInfo[] }) => void) => { listHandlers.delete(handler); },
+    onPtyReplay: (handler: (detail: { id: string; data: string }) => void) => { replayHandlers.add(handler); },
+    offPtyReplay: (handler: (detail: { id: string; data: string }) => void) => { replayHandlers.delete(handler); },
+    spawnPty: vi.fn(),
+    killPty: vi.fn(),
+    alertSeed: vi.fn(),
+  } as unknown as PlatformAdapter;
+  setPlatform(platform);
+  return { platform, saves };
+}
+
+beforeEach(() => {
+  resetWindowSessionAggregator();
+  resetWorkspaces();
+});
+
+describe("routeUnownedPtys", () => {
+  it("routes a helper to the Workspace holding its source, not the active one", () => {
+    const saved: PersistedWindow = {
+      version: 1,
+      workspaces: [
+        { id: "ws-a", name: "A", session: sessionOver("a1") },
+        { id: "ws-b", name: "B", session: sessionOver("b1") },
+      ],
+      activeWorkspaceId: "ws-a",
+    };
+    const ptys: PtyInfo[] = [
+      { id: "a1", alive: true },
+      { id: "b1", alive: true },
+      { id: "h1", alive: true, helper: { parentId: "b1", command: "git status" } },
+    ];
+
+    const { extra, unowned } = routeUnownedPtys(ptys, saved);
+
+    expect([...(extra.get("ws-b") ?? [])]).toEqual(["h1"]);
+    expect(extra.has("ws-a")).toBe(false);
+    expect([...unowned]).toEqual([]);
+  });
+
+  it("leaves a helper whose source is itself unowned to the active Workspace", () => {
+    const saved: PersistedWindow = {
+      version: 1,
+      workspaces: [{ id: "ws-a", name: "A", session: sessionOver("a1") }],
+      activeWorkspaceId: "ws-a",
+    };
+    const ptys: PtyInfo[] = [
+      { id: "fresh", alive: true },
+      { id: "h1", alive: true, helper: { parentId: "fresh", command: "git status" } },
+    ];
+
+    const { extra, unowned } = routeUnownedPtys(ptys, saved);
+
+    expect(extra.size).toBe(0);
+    expect([...unowned].sort()).toEqual(["fresh", "h1"]);
+  });
+});
+
+describe("restoreWindowOrFresh", () => {
+  it("keeps B's helper in B and leaves A's layout intact", async () => {
+    // The bug this pins: every helper is unowned by name, so routing them all to
+    // the active Workspace promoted B's helper to a top-level pane of A, and its
+    // stray id then voided A's whole saved layout.
+    const saved: PersistedWindow = {
+      version: 1,
+      workspaces: [
+        { id: "ws-a", name: "A", session: sessionOver("a1", "a2") },
+        { id: "ws-b", name: "B", session: sessionOver("b1") },
+      ],
+      activeWorkspaceId: "ws-a",
+    };
+    const helper = { parentId: "b1", command: "git status" };
+    const { platform } = fakePlatform(
+      [
+        { id: "a1", alive: true },
+        { id: "a2", alive: true },
+        { id: "b1", alive: true },
+        { id: "h1", alive: true, helper },
+      ],
+      saved,
+    );
+
+    const plans = await restoreWindowOrFresh(platform);
+
+    expect(plans["ws-a"].initialPaneIds).toEqual(["a1", "a2"]);
+    expect(plans["ws-a"].restoredLathLayout).toEqual(saved.workspaces[0].session.lathLayout);
+    expect(plans["ws-b"].initialPaneIds).toEqual(["b1"]);
+    expect(plans["ws-b"].restoredLathLayout).toEqual(saved.workspaces[1].session.lathLayout);
+    // The helper is restored as one — parked beside its source, not a pane.
+    expect(getHelper("b1")?.status).toBe("preserved");
+    forgetHelper("b1");
+  });
+
+  it("boots a fresh Window and rewrites the blob when the restore throws", async () => {
+    // A duplicate Workspace id is rejected outright by `setWorkspaces`; before,
+    // the throw escaped `bootstrap()` and nothing rendered at all — on this and
+    // every later launch.
+    const duplicated: PersistedWindow = {
+      version: 1,
+      workspaces: [
+        { id: "ws-a", name: "A", session: sessionOver("a1") },
+        { id: "ws-a", name: "A again", session: sessionOver("a2") },
+      ],
+      activeWorkspaceId: "ws-a",
+    };
+    const { platform, saves } = fakePlatform([], duplicated);
+
+    const plans = await restoreWindowOrFresh(platform);
+
+    // One default Workspace, planned and renderable.
+    expect(Object.keys(plans)).toEqual(["workspace-1"]);
+    expect(getWorkspacesSnapshot().workspaces).toHaveLength(1);
+    // And the blob that could not be restored is gone.
+    expect(saves[saves.length - 1]?.workspaces).toEqual([]);
+  });
+});
diff --git a/standalone/src/window-restore.ts b/standalone/src/window-restore.ts
new file mode 100644
index 000000000..46332ecc1
--- /dev/null
+++ b/standalone/src/window-restore.ts
@@ -0,0 +1,148 @@
+/**
+ * Rebuild the Window at boot: install its Workspaces, then plan each one's
+ * Session off a single view of the host's live PTYs (docs/specs/layout.md →
+ * "Session persistence").
+ *
+ * Reload and relaunch are the same code path with a different live list. On a
+ * reload the PTYs are still there and partition by saved pane id, so every
+ * Workspace resumes over its own; on a relaunch the list is empty and every
+ * Workspace cold-restores into fresh shells at its saved cwds, with nothing
+ * replayed because scrollback is never persisted.
+ */
+
+import type { PlatformAdapter, PtyInfo } from "dormouse-lib/lib/platform/types";
+import { collectLivePtys, resumeOrRestoreFrom, type LivePtys } from "dormouse-lib/lib/reconnect";
+import {
+  flushWindowSession,
+  installWindowSessionWriter,
+  seedWindowSession,
+} from "dormouse-lib/lib/window-session-aggregator";
+import { resetWorkspaces, setWorkspaces } from "dormouse-lib/lib/workspace-store";
+import { DEFAULT_WORKSPACE_ID, windowPaneIds } from "dormouse-lib/lib/session-types";
+import type { PersistedSession, PersistedWindow, WorkspaceId } from "dormouse-lib/lib/session-types";
+import { wallBootFromResult, type WallBootPlans } from "dormouse-lib/components/wall/wall-types";
+
+/**
+ * How a live PTY that no saved Workspace names is routed. Two kinds reach here:
+ * a helper, which belongs wherever its source does, and everything else — a pane
+ * created inside the last save's debounce, or one left by a Workspace that is
+ * gone — which goes to the active Workspace rather than being stranded with no
+ * Wall.
+ */
+export interface LivePtyRouting {
+  /** Extra ids each Workspace claims by name, beyond its saved panes. */
+  extra: Map<WorkspaceId, Set<string>>;
+  /** Ids the active Workspace adopts (`claimUnowned`). */
+  unowned: Set<string>;
+}
+
+/**
+ * Route the live PTYs no saved Workspace names.
+ *
+ * A helper PTY is never a persisted pane, so by name it is always unowned. It
+ * must still land in the Workspace holding its source: routed anywhere else it
+ * misses that plan's slice, is resumed as an ordinary top-level pane, and its id
+ * — absent from that Workspace's saved panes — makes the whole saved layout
+ * unusable, costing the Workspace its splits, Doors and refs. A helper whose
+ * source is itself unowned follows it into the active Workspace.
+ */
+export function routeUnownedPtys(
+  ptys: readonly PtyInfo[],
+  saved: PersistedWindow | null,
+): LivePtyRouting {
+  const ownerByPaneId = new Map<string, WorkspaceId>();
+  for (const workspace of saved?.workspaces ?? []) {
+    for (const pane of workspace.session.panes) ownerByPaneId.set(pane.id, workspace.id);
+  }
+
+  const extra = new Map<WorkspaceId, Set<string>>();
+  const unowned = new Set<string>();
+  for (const pty of ptys) {
+    if (ownerByPaneId.has(pty.id)) continue;
+    // Parents are resolved across the WHOLE saved Window, not one Workspace's
+    // slice — the point of the routing is that source and helper end up in the
+    // same slice afterwards.
+    const owner = pty.helper ? ownerByPaneId.get(pty.helper.parentId) : undefined;
+    if (owner === undefined) {
+      unowned.add(pty.id);
+      continue;
+    }
+    let ids = extra.get(owner);
+    if (!ids) extra.set(owner, (ids = new Set()));
+    ids.add(pty.id);
+  }
+  return { extra, unowned };
+}
+
+/**
+ * Restore the Window, degrading to a fresh one if anything in the restore throws.
+ * A blob the store cannot install — a duplicate Workspace id is the one that has
+ * bitten — would otherwise take the whole launch down before `render`, leaving a
+ * blank app that fails again on every start. The fresh Window overwrites it.
+ */
+export async function restoreWindowOrFresh(platform: PlatformAdapter): Promise<WallBootPlans> {
+  const saved = platform.getWindowState?.() ?? null;
+  try {
+    return await restoreWindow(platform, saved);
+  } catch (err) {
+    console.error("[dormouse] Could not restore the persisted Window; starting fresh", err);
+  }
+  try {
+    resetWorkspaces();
+    const plans = await restoreWindow(platform, null);
+    // Overwrite the blob that could not be restored, so the next launch does not
+    // meet it again.
+    await flushWindowSession();
+    return plans;
+  } catch (err) {
+    console.error("[dormouse] Could not start a fresh Window either; rendering with no plan", err);
+    return {};
+  }
+}
+
+async function restoreWindow(
+  platform: PlatformAdapter,
+  saved: PersistedWindow | null,
+): Promise<WallBootPlans> {
+  // Before any Wall mounts: a Workspace's first save compares against its own
+  // record, and a snapshot taken mid-boot must not replace a restored Workspace
+  // with a blank one.
+  seedWindowSession(saved);
+  if (saved) {
+    setWorkspaces({
+      workspaces: saved.workspaces.map(({ id, name }) => ({ id, name })),
+      activeId: saved.activeWorkspaceId,
+    });
+  }
+  // After `setWorkspaces`, so installing does not immediately write back what was
+  // just read.
+  installWindowSessionWriter((snapshot) => platform.saveWindowState?.(snapshot));
+
+  const live: LivePtys = await collectLivePtys(platform);
+  const restoring: Array<{ id: WorkspaceId; session: PersistedSession | null }> =
+    saved?.workspaces ?? [{ id: DEFAULT_WORKSPACE_ID, session: null }];
+  const activeId = saved?.activeWorkspaceId ?? DEFAULT_WORKSPACE_ID;
+
+  const { extra, unowned } = routeUnownedPtys(live.ptys, saved);
+
+  // The recovery claim is a host round trip started back in `init()`. Await it
+  // only when something here can actually cold-restore: a Window whose every
+  // saved pane is live resumes over those PTYs and never reads the record.
+  const named = windowPaneIds(saved);
+  const liveSet = new Set(live.ptys.map((pty) => pty.id));
+  if (!named.every((id) => liveSet.has(id))) await platform.recoveryReady;
+
+  const plans: WallBootPlans = {};
+  for (const { id, session } of restoring) {
+    const result = resumeOrRestoreFrom(platform, live, {
+      savedSession: session,
+      ptyIds: new Set([
+        ...(session?.panes.map((pane) => pane.id) ?? []),
+        ...(extra.get(id) ?? []),
+      ]),
+      ...(id === activeId ? { claimUnowned: unowned } : {}),
+    });
+    plans[id] = wallBootFromResult(result);
+  }
+  return plans;
+}

From 7f9ce53905b53f4188517234569fd7818f69f913 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 9 Sep 2026 23:22:55 -0700
Subject: [PATCH 10/11] Correct the specs the persistence review found drifting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- `security-local.md`: VS Code's `recovery.json` is owner-only and
  temp-then-rename, not "at the umask" — the nightly audit reads this file.
- `transport.md`: only the two standalone adapters declare `persistsSession`.
- `standalone.md`: document `DORMOUSE_STATE_DIR` / `DORMOUSE_RECOVERY_DIR`, the
  helper routing and fresh-Window degradation at boot, the coalesced cwd probe,
  and a quit ceiling derived from the step budgets rather than a literal.
- `layout.md` / `transport.md`: the per-Workspace boot now lives in
  `standalone/src/window-restore.ts`.

`standalone.md` re-baselined with `node scripts/spec-lint.mjs --ratchet`.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QBf4rQbwuxV6n6v7E3twYe
---
 docs/specs/layout.md           |  2 +-
 docs/specs/security-local.md   |  6 ++--
 docs/specs/standalone.md       | 55 ++++++++++++++++++++++++++--------
 docs/specs/transport.md        |  4 +--
 scripts/spec-word-budgets.json |  2 +-
 5 files changed, 50 insertions(+), 19 deletions(-)

diff --git a/docs/specs/layout.md b/docs/specs/layout.md
index 332f1304b..a3691c8b6 100644
--- a/docs/specs/layout.md
+++ b/docs/specs/layout.md
@@ -372,7 +372,7 @@ Startup recovery is priority-based:
 
 Every PTY spawned by (2)–(4) uses the current default shell selection.
 
-Source of truth: `lib/src/components/wall/use-session-persistence.ts` (save triggers and flushes), `lib/src/lib/session-save.ts` (serialization), `collectLivePtys` / `resumeOrRestoreFrom` in `lib/src/lib/reconnect.ts` (recovery priority), `restoreWindow` in `standalone/src/main.tsx` (the per-Workspace boot).
+Source of truth: `lib/src/components/wall/use-session-persistence.ts` (save triggers and flushes), `lib/src/lib/session-save.ts` (serialization), `collectLivePtys` / `resumeOrRestoreFrom` in `lib/src/lib/reconnect.ts` (recovery priority), `restoreWindowOrFresh` in `standalone/src/window-restore.ts` (the per-Workspace boot).
 
 ### Activity state
 
diff --git a/docs/specs/security-local.md b/docs/specs/security-local.md
index b36f4feee..4b0b0ba71 100644
--- a/docs/specs/security-local.md
+++ b/docs/specs/security-local.md
@@ -165,9 +165,9 @@ so notes are not stranded in a dev subtree; VS Code keeps it in
 under `dormouse.session`, and `vscode.setState()`, a WebviewPanel's only store —
 so the modes there are VS Code's, not ours, and no transcript reaches either
 (`docs/specs/vscode.md` -> "Serialization and restore"). Dormouse also writes
-`recovery.json` there, at the umask: one rebuilt agent-resume
-invocation per Surface, no buffer, unlinked as it is read
-(`docs/specs/vscode.md` -> "Capturing agent recovery").
+`recovery.json` under the extension's storage directory, owner-only and
+temp-then-rename: one rebuilt agent-resume invocation per Surface, no buffer,
+unlinked as it is read (`docs/specs/vscode.md` -> "Capturing agent recovery").
 
 **The VS Code peer-link token is a local credential at rest** —
 `burrow.peer-token` in the extension's global storage, written mode `0600`
diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index ad13b98ba..b1dd79efe 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -15,6 +15,7 @@ Start at the runtime boundary involved, then follow its imports and dispatch:
 | `standalone/src/tauri-adapter.ts` | Shared frontend's Tauri command/event bridge. |
 | `standalone/src-tauri/src/lib.rs` | Native app entry, sidecar supervision, and command registration. |
 | `standalone/sidecar/main.js` | JSON-lines command dispatch into PTY and shared host modules. |
+| `standalone/src/window-restore.ts` | Per-Workspace boot planning over one live-PTY list. |
 | `standalone/src/quit.ts` | Webview quit orchestration and updater handoff. |
 
 ## Architecture
@@ -31,9 +32,9 @@ Source of truth: `standalone/src/main.tsx` (`bootstrap()`).
 
 1. Pick the platform: `BrowserSidecarAdapter` when `VITE_DORMOUSE_BROWSER_DEV_HOST`
    is set (the browser-dev harness, `docs/specs/transport.md`), else `TauriAdapter`.
-2. `setPlatform(platform)`, then `await platform.init()` **before**
-   `resumeOrRestore` — init registers the listeners resume replay arrives on and
-   hydrates the session cache (§Persistence).
+2. `setPlatform(platform)`, then `await platform.init()` **before** the restore —
+   init registers the listeners resume replay arrives on and hydrates the session
+   cache (§Persistence).
 3. `installPeerSurfaceResponder()` **after `init()`, never before** (§Burrow
    service) — the responder seeds itself with a `status` command that the adapter
    must already have listeners for (rationale).
@@ -47,8 +48,8 @@ Source of truth: `standalone/src/main.tsx` (`bootstrap()`).
    default-shell slot for split/spawn/restore (`docs/specs/layout.md`).
    **Awaited**: seeding must finish before the Wall mounts, so the first restored
    pane already spawns with that shell.
-8. `resumeOrRestore(platform)` — the priority-based recovery from
-   `docs/specs/transport.md`.
+8. `restoreWindowOrFresh(platform)` — the per-Workspace boot (§Persistence) over
+   the priority-based recovery from `docs/specs/transport.md`.
 9. `startUpdateCheck()` (`docs/specs/auto-update.md`), then render `AppBar` +
    `App` with `multiWorkspace` — one Wall per Workspace (`docs/specs/layout.md`
    → Workspaces) — and `enableBurrow`, the mount gate for the lazily-imported
@@ -308,14 +309,32 @@ on either standalone adapter, because the stored blob is a Window and every
 shared reader of `getState` wants a Session. Source of truth: `windowStateSlot` in
 `standalone/src/window-recovery.ts`.
 
-**Boot restores per Workspace off one live-PTY list.** `restoreWindow`
-(`standalone/src/main.tsx`) seeds the aggregator, installs the Workspaces and the
+**Boot restores per Workspace off one live-PTY list.** `restoreWindowOrFresh`
+seeds the aggregator, installs the Workspaces and the
 writer, then runs one `collectLivePtys` and plans each Workspace from its own saved
 record. Reload and relaunch are the same path with a different list: nothing wires
 `shutdown()` to `beforeunload`, so a reload's PTYs are still there and partition by
 saved pane id, while a relaunch's list is empty and every Workspace cold-restores
-into fresh shells at its saved cwds. **A live PTY no saved Workspace names goes to
-the active Workspace**, which is the only one that can hold it.
+into fresh shells at its saved cwds.
+
+- **A live PTY no saved Workspace names goes to the active Workspace**, which is
+  the only one that can hold it — **except a helper**, which is never a persisted
+  pane and so is always unnamed. **A helper is routed to the Workspace holding its
+  source**, resolving parents across the whole live list before any slicing; one
+  landing anywhere else is resumed as an ordinary pane and its stray id voids that
+  Workspace's whole saved layout.
+- **A restore that throws degrades to a fresh Window and overwrites the blob.**
+  Installing the Workspaces is the step that can reject a stored blob outright, and
+  a throw at boot would leave nothing rendered, on this launch and every later one.
+
+Source of truth: `restoreWindowOrFresh` / `routeUnownedPtys` in
+`standalone/src/window-restore.ts`.
+
+**Every Workspace saving at the same moment costs one `pty_get_cwds`.** A flush
+fans out to every Wall at once, so both adapters put their cwd probe behind
+`coalesceCwds` (`standalone/src/coalesce-cwds.ts`), which folds the calls arriving
+in one microtask into a single invoke — the same batching `getCwdsForPids` already
+does one layer down, extended across the callers.
 
 **Nothing is deleted at boot but orphaned session temp files**
 (`docs/specs/transport.md` → "Retiring the transcripts already on disk"). **The
@@ -358,6 +377,14 @@ two would clobber one snapshot. **The notepad archive and the Burrow state direc
 stay under `app_data_dir` itself** — machine-local stores, not this build's copy of
 the user's window. `state_root_from` in `standalone/src-tauri/src/lib.rs`.
 
+**Rust passes the sidecar its two directories by environment**, each created
+owner-only first and each an empty string when it could not be:
+`DORMOUSE_STATE_DIR` (the Burrow store, `app_data_dir`) and
+`DORMOUSE_RECOVERY_DIR` (the recovery record, the state root — so a dev run's
+record cannot reach the installed app). The browser-dev harness sets both to its
+own per-run temp directory. Source of truth: `recovery_state_dir` in
+`standalone/src-tauri/src/lib.rs`.
+
 ### Agent recovery
 
 **The sidecar owns the capture and the record** (`docs/specs/transport.md` →
@@ -479,7 +506,7 @@ wedged webview, in three phases:
 | 2 — awaiting teardown | acked, `tearing_down` unset | **none** — the webview may be parked on the confirmation dialog waiting on a human, who must never be force-quit out from under it. Only `quit_proceed` (`approved`) or `quit_cancel`/repeat-trigger (`seq` bump) ends the wait |
 | 3 — teardown running | `tearing_down` set | **per phase**, ~14 s, refreshed by every `quit_progress` bump, so teardown and update install get separate budgets rather than one total; a phase making no progress for the budget ⇒ log and exit |
 
-Phase 3's budget comfortably exceeds the webview's own 10 s teardown ceiling. Each
+Phase 3's budget comfortably exceeds the webview's own teardown ceiling. Each
 watchdog captures the `seq` it was spawned for, so a **repeated quit trigger** —
 which bumps `seq`, spawns a fresh watchdog and re-emits — leaves the stale one to
 exit without acting: the user's escape hatch if the webview acked then wedged.
@@ -515,8 +542,12 @@ irrelevant — the gate is read only at quit time.
 Source of truth: `standalone/src/quit-confirm-store.ts` (the module store + gate),
 `standalone/src/QuitConfirmModal.tsx` (the modal).
 
-**Teardown ordering (`runQuitTeardown`), and why.** Wrapped in a 10 s ceiling, with
-**every step individually bounded** so a stall cannot wedge quit. The notepad
+**Teardown ordering (`runQuitTeardown`), and why.** **Every step is individually
+bounded** so a stall cannot wedge quit, and the whole is wrapped in a ceiling
+**derived from the sum of those bounds, never a literal** — one below the sum
+aborts the final save of a slow teardown instead of guarding a wedged one. The two
+steps that reach the sidecar cost their own budget *plus* Rust's round-trip margin,
+so both terms count (`QUIT_TEARDOWN_CEILING_MS` in `standalone/src/quit.ts`). The notepad
 archive is **not** a step here: it runs ahead of `quit_progress` precisely because
 teardown's rule below holds — no failing step prevents exit — and archiving must be
 able to stop the quit (`docs/specs/notepad.md` -> "Standalone quit"):
diff --git a/docs/specs/transport.md b/docs/specs/transport.md
index 929ed3c9e..778553a3f 100644
--- a/docs/specs/transport.md
+++ b/docs/specs/transport.md
@@ -20,7 +20,7 @@ Optional booleans:
 
 | Member | Absent reads | Set by | Effect when set |
 |---|---|---|---|
-| `persistsSession?` | `true` | Every shipped adapter | `saveSession` skips the whole record build, not just the write, on a host that answers `false` (rationale) |
+| `persistsSession?` | `true` | The two standalone adapters → `true` | `saveSession` skips the whole record build, not just the write, on a host that answers `false` (rationale) |
 | `hostOwnsTheme?` | `false` | `VSCodeAdapter` → `true` | Settings hides its theme picker (`docs/specs/theme.md` → "Where the user picks a theme") |
 | `hostOwnsShells?` | `false` | `VSCodeAdapter` → `true` | Settings hides its Shell row for the native QuickPick (`docs/specs/vscode.md` → "Shell selection") |
 
@@ -159,7 +159,7 @@ OSC parsing/stripping rules for those rows, and the rule that **only the process
 
 **A save probes every terminal pane's cwd in one host round trip where the adapter offers `getCwds`**, falling back to one `getCwd` per id: standalone resolves them with a synchronous process scan on the sidecar's only event loop, so N panes must cost one scan rather than N. **A flush may say `probeCwd: false`** and keep each pane's previously persisted cwd — the post-kill quit flush, where every probe answers null and is discarded for that value anyway (`docs/specs/standalone.md` → "Quit flow"). Pinned by `lib/src/lib/session-save.test.ts`.
 
-Source of truth: `getWindowSnapshot` / `seedWindowSession` / `installWindowSessionWriter` / `flushWindowSession` in `lib/src/lib/window-session-aggregator.ts`; `SaveSink` / `SaveOptions` in `lib/src/lib/session-save.ts`; `loadWindowState` / `saveWindowState` in `lib/src/lib/window-persistence.ts`; `restoreWindow` in `standalone/src/main.tsx`.
+Source of truth: `getWindowSnapshot` / `seedWindowSession` / `installWindowSessionWriter` / `flushWindowSession` in `lib/src/lib/window-session-aggregator.ts`; `SaveSink` / `SaveOptions` in `lib/src/lib/session-save.ts`; `loadWindowState` / `saveWindowState` in `lib/src/lib/window-persistence.ts`; `restoreWindowOrFresh` in `standalone/src/window-restore.ts`.
 
 **A corrupt save must never block startup.** Every read goes through `readPersistedSession()` / `readPersistedWindow()`, which accept the canonical parsed object *or* a JSON-stringified blob (host state APIs may hand back the inner serialized string) and log-and-discard anything present but unreadable. `readPersistedWindow` additionally drops Workspaces whose inner session is unreadable and repairs a dangling `activeWorkspaceId` to the first Workspace.
 
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index ccb0c9d0c..b55cf9f57 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -24,7 +24,7 @@
   "docs/specs/security-supply-chain.md": 1150,
   "docs/specs/security.md": 1900,
   "docs/specs/shortcuts.md": 1050,
-  "docs/specs/standalone.md": 4850,
+  "docs/specs/standalone.md": 5150,
   "docs/specs/terminal-context.md": 900,
   "docs/specs/terminal-escapes.md": 3750,
   "docs/specs/terminal-state.md": 2350,

From f8322f581611b0095f746fa321f1e576402fe469 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 10 Sep 2026 17:18:50 -0700
Subject: [PATCH 11/11] Pin the quit budget derivation and bound the Window
 write
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The teardown ceiling is derived arithmetic spread across quit.ts and
lib.rs, and nothing checked it: the ceiling had to stay under Rust's
QUIT_PHASE_TIMEOUT_MS, and SIDECAR_ROUND_TRIP_MARGIN_MS was a hand copy
of the `timeout + 1500` in the two sidecar commands. Both comments had
already drifted to a "10 s" ceiling that no longer existed.
mirrored-constants.test.ts now reads the derivation out of quit.ts term
by term and pins the ceiling under the Rust watchdog and the margin to
both Rust call sites; the stale literals are gone from the comments.

flushWindowSession was the one teardown step with no bound and no term
in the ceiling. Both standalone writers are synchronous today, but the
bound is on what the writer may return: a stalled one would have eaten
the ceiling's slack and then the drain — the final save the derivation
exists to protect. It is bounded like its neighbours, with its own term.

Also pins end to end that a restored Workspace's first save reads the
record boot seeded, so a pane whose PTY did not survive the relaunch
keeps its retained cwd and alert.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RChsJ5rMUMyfu22UZDfUus
---
 docs/specs/standalone.md                    |  6 ++-
 lib/src/components/WorkspaceWindow.test.tsx | 29 ++++++++++++-
 lib/src/lib/mirrored-constants.test.ts      | 48 +++++++++++++++++++++
 standalone/src-tauri/src/lib.rs             | 15 ++++---
 standalone/src/quit.test.ts                 | 36 ++++++++++++++--
 standalone/src/quit.ts                      | 20 +++++++--
 6 files changed, 138 insertions(+), 16 deletions(-)

diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index 38b5f942d..b2d48ae85 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -547,7 +547,8 @@ bounded** so a stall cannot wedge quit, and the whole is wrapped in a ceiling
 **derived from the sum of those bounds, never a literal** — one below the sum
 aborts the final save of a slow teardown instead of guarding a wedged one. The two
 steps that reach the sidecar cost their own budget *plus* Rust's round-trip margin,
-so both terms count (`QUIT_TEARDOWN_CEILING_MS` in `standalone/src/quit.ts`). The notepad
+so both terms count (`QUIT_TEARDOWN_CEILING_MS` in `standalone/src/quit.ts`; pinned by
+`lib/src/lib/mirrored-constants.test.ts`). The notepad
 archive is **not** a step here: it runs ahead of `quit_progress` precisely because
 teardown's rule below holds — no failing step prevents exit — and archiving must be
 able to stop the quit (`docs/specs/notepad.md` -> "Standalone quit"):
@@ -566,7 +567,8 @@ able to stop the quit (`docs/specs/notepad.md` -> "Standalone quit"):
    (`docs/specs/transport.md` → "Persisted session types").
 5. `flushWindowSession` — the Workspaces' records become one Window blob
    (`docs/specs/transport.md` → "Persisted session types"); a debounce timer still
-   pending at exit would otherwise lose the final save.
+   pending at exit would otherwise lose the final save. **Bounded like the rest,
+   its term in the ceiling**, though both writers are synchronous today.
 6. `drainSessionSaves` — await the store pipeline becoming idle or its timeout
    (§Persistence).
 7. If an update is pending, a fresh `quit_progress` then `installPendingUpdate()`
diff --git a/lib/src/components/WorkspaceWindow.test.tsx b/lib/src/components/WorkspaceWindow.test.tsx
index 395451b74..9fc9dcf48 100644
--- a/lib/src/components/WorkspaceWindow.test.tsx
+++ b/lib/src/components/WorkspaceWindow.test.tsx
@@ -20,7 +20,7 @@ import { getActivitySnapshot, setTerminalActivity } from '../lib/terminal-regist
 import { getWallHandle, listWallHandles, resetWallHandles } from './wall/wall-handles';
 import { mountWallHarness, type WallHarness } from './wall/wall-test-utils';
 import { getWorkspaceSurfacesSnapshot, resetWorkspaceSurfaces } from '../lib/workspace-surfaces';
-import { previousWorkspaceSession, publishWorkspaceSession, resetWindowSessionAggregator } from '../lib/window-session-aggregator';
+import { previousWorkspaceSession, publishWorkspaceSession, resetWindowSessionAggregator, seedWindowSession } from '../lib/window-session-aggregator';
 import { resetWorkspaceUi } from '../lib/workspace-ui-store';
 import {
   closeWorkspace,
@@ -205,6 +205,33 @@ describe('WorkspaceWindow', () => {
     expect(handle.surfaceIds()).toEqual([]);
   });
 
+  it('keeps a dead PTY\'s retained cwd and alert across a restored Workspace\'s first save', async () => {
+    // The first save after a restore has nothing of its own to compare against:
+    // it must read the record boot seeded, or a pane whose PTY did not survive
+    // the relaunch (its probe answers null) loses the cwd and alert the last
+    // run persisted for it — exactly the values a cold restore spawns it from.
+    const first = getWorkspacesSnapshot().workspaces[0].id;
+    seedWindowSession({
+      version: 1,
+      workspaces: [{
+        id: first,
+        name: 'One',
+        session: {
+          version: 3,
+          doors: [],
+          panes: [{ id: 'pane-a', title: 'Pane A', cwd: '/retained', untouched: false, alert: { status: 'NOTHING_TO_SHOW', todo: true } }],
+        },
+      }],
+      activeWorkspaceId: first,
+    });
+    await render();
+
+    await act(async () => { await getWallHandle(first)!.flushPersistence(); });
+
+    const saved = previousWorkspaceSession(first)!.panes.find((pane) => pane.id === 'pane-a');
+    expect(saved).toMatchObject({ cwd: '/retained', alert: { status: 'NOTHING_TO_SHOW', todo: true } });
+  });
+
   it('leaves no persisted record behind a closed Workspace', async () => {
     // The closing Wall's unmount used to publish one last time, putting the
     // Workspace it had just forgotten back into the next Window blob — with its
diff --git a/lib/src/lib/mirrored-constants.test.ts b/lib/src/lib/mirrored-constants.test.ts
index 37c3ad05a..f4f6283a3 100644
--- a/lib/src/lib/mirrored-constants.test.ts
+++ b/lib/src/lib/mirrored-constants.test.ts
@@ -13,6 +13,7 @@ import { SCAN_REJECTED_MESSAGE } from '../remote/pocket-app/ScanInvitation';
 import { SCAN_LABEL } from '../remote/setup-copy';
 import { ITERM2_COMPAT_VERSION } from './terminal-protocol';
 import { OPEN_PORT_TIMEOUT_MS } from './platform/types';
+import { DEFAULT_RECOVERY_WAIT_MS } from '../host/recovery-capture';
 
 // Pins for constants defined in more than one language/runtime, where an
 // import is impossible (the sidecar is plain CJS, the Tauri backend is Rust,
@@ -230,3 +231,50 @@ describe('OPEN_PORT_TIMEOUT_MS mirrors', () => {
     expect(Number(ms)).toBe(OPEN_PORT_TIMEOUT_MS);
   });
 });
+
+// docs/specs/standalone.md -> "Quit flow" (Teardown ordering). The webview's
+// teardown ceiling is derived from its step budgets, two of which carry the
+// margin Rust adds to a sidecar round trip; Rust's per-phase watchdog is what
+// actually forces the exit and has to sit above the whole derivation. Neither
+// side can import the other, so the derivation is read out of `quit.ts` as
+// written — every `NAME_MS` resolves to its own `const`, the one lib import to
+// the lib export — and summed here, so a budget raised on one side without the
+// other fails loudly instead of aborting the final save.
+describe('quit teardown budget mirrors', () => {
+  const ts = 'standalone/src/quit.ts';
+  const rs = 'standalone/src-tauri/src/lib.rs';
+  const tsSrc = readRepoFile(ts);
+  const rsSrc = readRepoFile(rs);
+
+  /** A `quit.ts` millisecond constant, following its derivation term by term. */
+  const valueOf = (name: string): number => {
+    if (name === 'DEFAULT_RECOVERY_WAIT_MS') return DEFAULT_RECOVERY_WAIT_MS;
+    const expr = extract(tsSrc, ts, new RegExp(`^(?:export )?const ${name} =\\s*([^;]+);`, 'm'));
+    return expr
+      .replace(/[()\s]/g, '')
+      .split('+')
+      .map((term) => {
+        if (/^\d+$/.test(term)) return Number(term);
+        if (/^[A-Z_]+_MS$/.test(term)) return valueOf(term);
+        throw new Error(`${name} in ${ts} is not a sum: unexpected term ${JSON.stringify(term)}`);
+      })
+      .reduce((sum, term) => sum + term, 0);
+  };
+  const rustMs = (name: string) =>
+    Number(extract(rsSrc, rs, new RegExp(`^const ${name}: u64 = ([\\d_]+);$`, 'm')).replace(/_/g, ''));
+
+  it('keeps the webview ceiling under the Rust per-phase watchdog', () => {
+    const ceiling = valueOf('QUIT_TEARDOWN_CEILING_MS');
+    expect(ceiling).toBeGreaterThan(valueOf('STEP_BUDGET_TOTAL_MS'));
+    expect(ceiling).toBeLessThan(rustMs('QUIT_PHASE_TIMEOUT_MS'));
+  });
+
+  it.each(['capture_agent_recovery', 'pty_graceful_kill_all'])(
+    'counts the round-trip margin Rust adds in %s',
+    (command) => {
+      const body = extract(rsSrc, rs, new RegExp(`\\n(?:async )?fn ${command}\\(([^]*?)\\n}`));
+      const margin = extract(body, `${rs} (${command})`, /Duration::from_millis\(timeout \+ (\d+)\)/);
+      expect(Number(margin)).toBe(valueOf('SIDECAR_ROUND_TRIP_MARGIN_MS'));
+    },
+  );
+});
diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index 8ccb48208..b7573383b 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -81,8 +81,10 @@ struct QuitState {
 const QUIT_ACK_TIMEOUT_MS: u64 = 2_000;
 // Phase 3: per-phase budget once teardown is running. Each reported phase
 // (teardown, install) refreshes it, so it bounds a single stalled phase, not the
-// sum of all teardown work. Comfortably exceeds the webview's own 10 s teardown
-// ceiling (docs/specs/standalone.md §Quit flow).
+// sum of all teardown work. Comfortably exceeds the webview's own teardown
+// ceiling (docs/specs/standalone.md §Quit flow) — `QUIT_TEARDOWN_CEILING_MS` in
+// `standalone/src/quit.ts`, pinned under this by
+// `lib/src/lib/mirrored-constants.test.ts`.
 const QUIT_PHASE_TIMEOUT_MS: u64 = 14_000;
 const QUIT_POLL_STEP_MS: u64 = 500;
 
@@ -504,8 +506,10 @@ fn pty_get_open_ports(
 }
 
 // Wait for PTY exits and their final output before shutdown. Async: waits up to
-// `timeout + 1500ms` (margin for the round trip beyond the sidecar's own kill
-// timer) and must not block the main thread for that long.
+// `timeout` plus a margin for the round trip beyond the sidecar's own kill
+// timer, and must not block the main thread for that long. The margin here and
+// in `capture_agent_recovery` is `SIDECAR_ROUND_TRIP_MARGIN_MS` in
+// `standalone/src/quit.ts` — pinned by `lib/src/lib/mirrored-constants.test.ts`.
 #[tauri::command]
 async fn pty_graceful_kill_all(
     state: tauri::State<'_, SidecarState>,
@@ -541,7 +545,8 @@ fn capture_agent_recovery(
         &state,
         "pty:captureRecovery",
         serde_json::json!({ "ids": ids, "timeout": timeout }),
-        // Margin for the round trip beyond the sidecar's own ceiling.
+        // Margin for the round trip beyond the sidecar's own ceiling; the same
+        // one `pty_graceful_kill_all` adds (see its comment for the pin).
         Duration::from_millis(timeout + 1500),
     )?;
     Ok(())
diff --git a/standalone/src/quit.test.ts b/standalone/src/quit.test.ts
index 22c9dce3b..03bda59af 100644
--- a/standalone/src/quit.test.ts
+++ b/standalone/src/quit.test.ts
@@ -63,7 +63,7 @@ const oneNotedSurface = () => ["pane-a"];
 let quitRequested: (() => void) | null = null;
 
 // Drain the microtask-driven teardown chain (no real timers on the happy path —
-// withTimeout's 10s guard is cleared when the work wins).
+// withTimeout's ceiling guard is cleared when the work wins).
 const settle = () => new Promise((r) => setTimeout(r, 0));
 
 // A fake adapter whose teardown steps append their name to `order` so the call
@@ -105,6 +105,7 @@ describe("quit orchestrator", () => {
     mocks.invoke.mockResolvedValue(undefined);
     mocks.archiveSurfaceNotes.mockResolvedValue(undefined);
     mocks.notepadSurfaceIds.mockReturnValue([]);
+    mocks.flushWindowSession.mockResolvedValue(undefined);
   });
 
   afterEach(() => setQuitConfirmGate(null));
@@ -159,9 +160,9 @@ describe("quit orchestrator", () => {
 
   it("finishes the final save when every step takes its worst-case time", async () => {
     // The webview-observable worst case of each step: the two that reach the
-    // sidecar wait Rust's `timeout + 1500ms` round-trip margin on top of their own
-    // budget. A ceiling below the sum of these aborts exactly the last flush and
-    // the drain — the final save — so `drain` must still land before the exit.
+    // sidecar wait Rust's round-trip margin on top of their own budget. A
+    // ceiling below the sum of these aborts exactly the last steps — the final
+    // save — so `drain` must still land before the exit.
     vi.useFakeTimers();
     try {
       const order: string[] = [];
@@ -182,11 +183,13 @@ describe("quit orchestrator", () => {
         gracefulKill: slow("gracefulKill", 2000 + 1500),
         drain: slow("drain", 2000),
       });
+      mocks.flushWindowSession.mockImplementation(slow("flushWindow", 1000));
 
       initQuitFlow(adapter);
       quitRequested!();
       await vi.advanceTimersByTimeAsync(30_000);
 
+      expect(order).toContain("flushWindow");
       expect(order).toContain("drain");
       expect(order.indexOf("drain")).toBeLessThan(order.indexOf("quit_proceed"));
     } finally {
@@ -194,6 +197,31 @@ describe("quit orchestrator", () => {
     }
   });
 
+  it("bounds a wedged Window write so the drain behind it still runs", async () => {
+    // Both standalone writers are synchronous today, so this step never waits;
+    // but it is bounded on what the writer may return, not on what it happens
+    // to be — a writer that never settles must cost its own budget, not the
+    // ceiling's slack and then the drain.
+    vi.useFakeTimers();
+    try {
+      const order: string[] = [];
+      mocks.invoke.mockImplementation(async (cmd: string) => {
+        order.push(cmd);
+        return undefined;
+      });
+      mocks.flushWindowSession.mockReturnValue(new Promise<void>(() => {})); // never settles
+      const adapter = fakeAdapter(order);
+
+      initQuitFlow(adapter);
+      quitRequested!();
+      await vi.advanceTimersByTimeAsync(1000);
+
+      expect(order.slice(-2)).toEqual(["drain", "quit_proceed"]);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it("still saves and exits when the recovery capture rejects", async () => {
     // Recovery is the one step whose data cannot be reconstructed, but losing it
     // must never cost the save behind it.
diff --git a/standalone/src/quit.ts b/standalone/src/quit.ts
index 5115fc1fc..19360c6b8 100644
--- a/standalone/src/quit.ts
+++ b/standalone/src/quit.ts
@@ -136,17 +136,23 @@ const SIDECAR_ROUND_TRIP_MARGIN_MS = 1500;
 const PRE_KILL_FLUSH_MS = 1500;
 const GRACEFUL_KILL_MS = 2000;
 const POST_KILL_FLUSH_MS = 1500;
+// The Window write is synchronous on both standalone adapters today, but the
+// step is bounded on what the writer may return, not on what it happens to be.
+const WINDOW_WRITE_MS = 1000;
 const DRAIN_MS = 2000;
 const STEP_BUDGET_TOTAL_MS =
   (DEFAULT_RECOVERY_WAIT_MS + SIDECAR_ROUND_TRIP_MARGIN_MS) +
   PRE_KILL_FLUSH_MS +
   (GRACEFUL_KILL_MS + SIDECAR_ROUND_TRIP_MARGIN_MS) +
   POST_KILL_FLUSH_MS +
+  WINDOW_WRITE_MS +
   DRAIN_MS;
 /** Belt-and-suspenders over the summed step budgets, with slack for scheduling.
- *  Stays under Rust's `QUIT_PHASE_TIMEOUT_MS` (14 000 ms), which is what actually
- *  forces the exit. Exported for the test that pins it above the sum. */
-export const QUIT_TEARDOWN_CEILING_MS = STEP_BUDGET_TOTAL_MS + 1000;
+ *  Stays under Rust's `QUIT_PHASE_TIMEOUT_MS`, which is what actually forces the
+ *  exit; `lib/src/lib/mirrored-constants.test.ts` reads this derivation out of
+ *  the source and pins it under the Rust constant, and pins the margin above to
+ *  the two Rust call sites that add it. */
+const QUIT_TEARDOWN_CEILING_MS = STEP_BUDGET_TOTAL_MS + 1000;
 
 // Ordering and rationale: docs/specs/standalone.md §Quit flow (Teardown
 // ordering). `quit_progress` tells Rust teardown has begun (ending the
@@ -173,7 +179,13 @@ async function runQuitTeardown(): Promise<void> {
           // Final post-exit save. Nothing left to probe a cwd from, and each pane
           // keeps the one the save above recorded.
           await adapter.requestSessionFlush(POST_KILL_FLUSH_MS, { probeCwd: false });
-          await flushWindowSession(); // the Walls' records become one Window blob
+          // The Walls' records become one Window blob. Bounded like the rest, so
+          // a writer that stalls cannot eat the drain's budget behind it.
+          await withTimeout(
+            flushWindowSession(),
+            WINDOW_WRITE_MS,
+            `[quit] Window write exceeded ${WINDOW_WRITE_MS}ms; proceeding to drain`,
+          );
           await adapter.drainSessionSaves(DRAIN_MS); // last write reaches disk
         })(),
         QUIT_TEARDOWN_CEILING_MS,