diff --git a/.agents/notes/archived/feature/2026-08-25-unified-task-list.i18n.yaml b/.agents/notes/archived/feature/2026-08-25-unified-task-list.i18n.yaml
new file mode 100644
index 0000000000..c5b051c49c
--- /dev/null
+++ b/.agents/notes/archived/feature/2026-08-25-unified-task-list.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/archived/feature/2026-08-25-unified-task-list.md
+2026-08-25-unified-task-list.md: f2f955e36a78eee8fa8ff8a804293bcc37a44acd
+2026-08-25-unified-task-list.zh.md: 5a4c51a6cc3d0f331d2559debb73dc02e9cf12c5
diff --git a/.agents/notes/archived/feature/2026-08-25-unified-task-list.md b/.agents/notes/archived/feature/2026-08-25-unified-task-list.md
new file mode 100644
index 0000000000..f2f955e36a
--- /dev/null
+++ b/.agents/notes/archived/feature/2026-08-25-unified-task-list.md
@@ -0,0 +1,49 @@
+# Agent Note: One session-header task list — jobs joined with activities in the UI projection only
+
+Status: implemented
+Archived: 2026-09-03
+
+English | [中文](2026-08-25-unified-task-list.zh.md)
+
+Superseded: the two-roster join described here was removed with the activity seam — the job rows are now the whole roster; see [jobs absorb the record](../architecture/2026-09-01-jobs-absorb-activity-record.md).
+
+## Problem
+
+The [activity observation seam](2026-08-24-activity-observation-seam.md) shipped its Web surface as a second session-header button beside the [background-job list](2026-08-08-web-background-job-display.md). A background bash run registers in both planes — `ctx.jobs` for control and `ctx.activities` for observation — so the same work rendered twice: once in "background jobs" with lifecycle and duration, once in "activities" with expandable live output. Two near-identical popovers with different names for overlapping row sets read as a product accident, and the flat activity rows (live and settled interleaved, single-line, no duration) had no visual hierarchy.
+
+## Decision
+
+The service planes stay orthogonal; the join happens once, per row, in the UI projection.
+
+- **`ctx.jobs` and `ctx.activities` remain separate services.** Jobs are the control plane: model-visible ids, a consuming `readOutput` cursor the model drains, `stopping`, `kill`, and the `reported` completion-notice contract. Activities are the transient observation plane: non-consuming absolute offsets, invisible to the model, gone on restart. Merging the services would force one registry to carry both a consuming and a non-consuming cursor and would blur the "model-visible ⟺ logged" line for a plane designed to stay off the session log.
+- **`dsh-client-ui-activity` renders the single merged list; `dsh-client-ui-jobs` is deleted** (pre-release, no compatibility shim), and the merged entry takes the job list's slot order. Each `jobsBySession` row is joined with the activity carrying its `correlation.jobId`: the job supplies identity, lifecycle (`stopping` exists only there), duration, and the model-visible `detail`; the activity supplies the expandable output panel. An activity without a job (a workflow run) keeps its own row; an activity whose job is not in the projection is not dropped. Without the activity registry, job rows still render — they just offer no panel, so the merged control degrades to exactly the old job list.
+- **User-facing vocabulary is "task" (任务)** — `N tasks running` / `N 个任务进行中` — because every row is running work to the user, while "background job" excludes workflow runs and "activity" names the internal plane, not the user concept. The dictionary namespace and package names stay `activity`: internal names follow the naming ledger, not display copy.
+- **Hierarchy**: live rows first (label over a kind-badge-and-status second line, ticking duration), then settled rows compacted to one de-emphasized line; each non-empty section carries its own heading (Running / Finished). Rows without an observable activity render as static rows with no expansion affordance.
+
+Deliberately not joined: subagent delegation rows stay bare job rows (the subagent panel is their surface), and foreground commands stay in their tool cards — neither gains an activity producer.
+
+## Alternatives considered
+
+- **Merge the services** — rejected for the cursor-semantics and model-visibility reasons above.
+- **Keep the job list and bolt output onto it** — leaves workflow runs (activities without jobs) homeless, forcing a second list to survive anyway.
+
+## Refinements from browser acceptance
+
+Driving the merged list in the real app produced four presentation decisions, all scoped to the expanded panel and the header band:
+
+- **The header band order is preset → tasks → subagent catalog.** The root-session descendant count moved out of the breadcrumb (`header.lineage`) into the actions band (order 30) and dropped its `/` separator — a root session has no hierarchy to breadcrumb; child sessions keep their `root / child` switcher where the `/` is real. `SubagentCatalogAction` owns the moved seat; the lineage renderer now renders nothing on roots.
+- **The panel's copy control copies the command** (`TerminalBlock.copyText`), not the output: a long command ellipsizes in the row, so the control is its only complete source, while output is selectable text below. Supplying `copyText` also keeps the control rendered before any output exists.
+- **The panel scrolls instead of folding**: commands and output lines wrap in full (`--dsl-terminal-command-whitespace` / `--dsl-terminal-line-whitespace: pre-wrap`, so the output region never scrolls sideways) and the output region caps at a fixed height (`--dsl-terminal-output-max-height`) with `maxLines: Infinity` disabling the head/tail fold.
+- **The panel draws no run-state dot** (`TerminalBlock.runStateDot: false`) — the row above it already carries the same state — and reclaims the dot gutter via `--dsl-terminal-gutter`. The panel's left spine was dropped with it.
+
+All four land as opt-ins on `TerminalBlock` (props or `--dsl-terminal-*` variables), so tool cards keep their shipped fold/ellipsis/dot behavior unchanged.
+
+## Testing
+
+Component suites cover the join (job lifecycle wins, activity supplies the panel, bare-job rows, standalone activities), sections, durations, and the panel options; `pnpm vitest run packages/client/ui-activity packages/client/ui-primitives packages/client/ui-subagent` runs them. The keyless web e2e pair (`background-job-list`, `live-activity-stream`) replays the merged list end to end against ARIA goldens; `agent-preset-selection` pins the header band order.
+
+## Consequences
+
+- The two web e2e scenarios (`background-job-list`, `live-activity-stream`) now assert one "Tasks" list; the job-list scenario's row gained a live-output panel, which is the join working end to end.
+- A human kill control on live rows is still blocked on the jobs `reported` contract question recorded in the job-display note.
+- The `job` locale namespace is gone with its package; `activity` owns the merged copy including the duration vocabulary.
diff --git a/.agents/notes/archived/feature/2026-08-25-unified-task-list.zh.md b/.agents/notes/archived/feature/2026-08-25-unified-task-list.zh.md
new file mode 100644
index 0000000000..5a4c51a6cc
--- /dev/null
+++ b/.agents/notes/archived/feature/2026-08-25-unified-task-list.zh.md
@@ -0,0 +1,49 @@
+# Agent Note: 会话头部单一任务列表——jobs 与 activity 只在 UI 投影层合并
+
+Status: implemented
+Archived: 2026-09-03
+
+[English](2026-08-25-unified-task-list.md) | 中文
+
+Superseded: 本文描述的双名册 join 已随 activity seam 一并移除——job 行现在就是完整名册；见 [jobs 吸收 record](../architecture/2026-09-01-jobs-absorb-activity-record.zh.md)。
+
+## 问题
+
+[activity 观察面](2026-08-24-activity-observation-seam.zh.md)的 Web 呈现落地为[后台任务列表](2026-08-08-web-background-job-display.zh.md)旁边的第二个会话头部按钮。一次后台 bash 会同时登记在两个面里——`ctx.jobs` 负责控制、`ctx.activities` 负责观察——于是同一份工作渲染了两次：一次在"后台任务"里带生命周期与时长，一次在"活动"里带可展开的实时输出。两个行集合高度重叠、名字却不同的近似弹层，读起来像产品事故；而活动列表的扁平行（live 与 settled 混排、单行、无时长）也缺乏视觉层次。
+
+## 决策
+
+服务面保持正交；合并只在 UI 投影层逐行发生一次。
+
+- **`ctx.jobs` 与 `ctx.activities` 仍是两个服务。** jobs 是控制面：模型可见的 id、模型消耗式的 `readOutput` 游标、`stopping`、`kill` 与 `reported` 完成通知契约。activity 是瞬态观察面：非消耗式绝对偏移、模型不可见、重启即无。合并服务会迫使一个注册表同时携带消耗式与非消耗式两种游标，并模糊这个刻意不进 session log 的面与"模型可见 ⟺ 已记录"不变量的边界。
+- **`dsh-client-ui-activity` 渲染唯一的合并列表；`dsh-client-ui-jobs` 删除**（预发布阶段，不留兼容层），合并入口占用原 job 列表的 slot 顺位。每个 `jobsBySession` 行与携带其 `correlation.jobId` 的 activity 逐行 join：job 提供身份、生命周期（`stopping` 只存在于此）、时长与模型可见 `detail`；activity 提供可展开的输出面板。没有 job 的 activity（workflow 运行）保留自己的行；job 不在投影里的 activity 也不会被丢弃。没有 activity 注册表时 job 行照常渲染——只是没有面板，合并控件退化为与旧 job 列表完全等价。
+- **用户可见词汇统一为"任务"（task）**——`N 个任务进行中` / `N tasks running`——因为对用户而言每一行都是在跑的工作，而"后台任务"排除了 workflow 运行、"活动"命名的是内部面而非用户概念。词典命名空间与包名保持 `activity`：内部名遵循命名台账，不跟随展示文案。
+- **层次**：进行中的行在前（命令为主行、kind 徽章加状态为副行、时长每秒跳动），已结束的行折为降权单行；每个非空分组带自己的标题（进行中 / 已结束）。没有可观察 activity 的行渲染为无展开交互的静态行。
+
+刻意不合并的：subagent 委托行保持裸 job 行（subagent 面板是它的呈现面），前台命令留在工具卡片里——两者都不接活动生产者。
+
+## 曾考虑的替代方案
+
+- **合并服务层**——因上述游标语义与模型可见性理由否决。
+- **保留 job 列表、把输出挂上去**——workflow 运行（无 job 的 activity）无处安放，第二个列表终究得活下来。
+
+## 浏览器验收带来的细化
+
+在真实应用里驱动合并列表得出四个呈现决策，全部限定在展开面板与头部条带：
+
+- **头部条带顺序为 preset → 任务 → subagent 目录。** 根会话的后代数量从面包屑（`header.lineage`）移入操作区（order 30）并去掉 `/` 分隔符——根会话没有可面包屑的层级；子会话保留 `根 / 子` 切换器，那里的 `/` 是真实层级。移位后的席位由 `SubagentCatalogAction` 拥有；谱系 renderer 在根会话上不再渲染任何东西。
+- **面板的复制控件复制命令**（`TerminalBlock.copyText`）而非输出：长命令在行内被省略号截断，控件是它唯一的完整来源，而输出本身就是下方可选中的文本。提供 `copyText` 还让控件在任何输出出现之前就保持渲染。
+- **面板以滚动取代折叠**：命令与输出行完整换行（`--dsl-terminal-command-whitespace` / `--dsl-terminal-line-whitespace: pre-wrap`，输出区因此永不横向滚动），输出区以固定高度封顶（`--dsl-terminal-output-max-height`），`maxLines: Infinity` 禁用头尾折叠。
+- **面板不画运行状态点**（`TerminalBlock.runStateDot: false`）——上方的行已携带同一状态——并通过 `--dsl-terminal-gutter` 收回状态点落区。面板左侧竖线随之移除。
+
+四项全部以 `TerminalBlock` 的可选项落地（prop 或 `--dsl-terminal-*` 变量），工具卡片保持既有的折叠/省略/状态点行为不变。
+
+## 测试
+
+组件套件覆盖 join（job 生命周期优先、activity 提供面板、裸 job 行、独立 activity）、分段、时长与面板选项；`pnpm vitest run packages/client/ui-activity packages/client/ui-primitives packages/client/ui-subagent` 运行它们。无密钥 web e2e 对（`background-job-list`、`live-activity-stream`）按 ARIA golden 端到端回放合并列表；`agent-preset-selection` 钉住头部条带顺序。
+
+## 后果
+
+- 两个 web e2e 场景（`background-job-list`、`live-activity-stream`）现在断言同一个"任务"列表；job 场景的行获得了实时输出面板，这正是 join 端到端生效的证据。
+- live 行上的人工 kill 控件仍被 job-display note 记录的 jobs `reported` 契约问题阻塞。
+- `job` 词典命名空间随包一起消失；`activity` 拥有合并后的全部文案，包括时长词汇。
diff --git a/.agents/notes/archived/manifest.json b/.agents/notes/archived/manifest.json
index 74d114c6bb..ca509c1070 100644
--- a/.agents/notes/archived/manifest.json
+++ b/.agents/notes/archived/manifest.json
@@ -1378,6 +1378,9 @@
     "feature/2026-08-25-loaded-turn-chat-navigation.i18n.yaml": "sha256:86bd02d56cf95ac465d0f6e326ccf75432ffb9c3db47373ae6a795195cff9ea7",
     "feature/2026-08-25-loaded-turn-chat-navigation.md": "sha256:0ee1cb6da76b93e467d747aa8ba07697ba648cb213ba52202c51ee1e85dff1a8",
     "feature/2026-08-25-loaded-turn-chat-navigation.zh.md": "sha256:5d3e567027fc65241856bf9f9cf0d73a20d53214c49bfbc884ab2ddd19503918",
+    "feature/2026-08-25-unified-task-list.i18n.yaml": "sha256:fec0d4a3ecf59aafd440bc801c686b14d63152c937f51bebe0da61ff615f6f33",
+    "feature/2026-08-25-unified-task-list.md": "sha256:30bd4e338a3de2f59af98d512c7878928c61846e6700d6012fc45e51c0bf94df",
+    "feature/2026-08-25-unified-task-list.zh.md": "sha256:88fce0a52b5387ea98c1f68742c03b2f475c5465c680befb32c587066e52cfce",
     "feature/2026-08-26-web-trigger-menu-presentation-polish.i18n.yaml": "sha256:69179f3056c6d5fc35119e83dd7a5af30213502dac3c1f2d4fd43eae96ee2ecf",
     "feature/2026-08-26-web-trigger-menu-presentation-polish.md": "sha256:c54e3bbe528d6be711541c61e777e6e4ed4fbc1374df97d846b015d3693679f4",
     "feature/2026-08-26-web-trigger-menu-presentation-polish.zh.md": "sha256:7db49018eebbba539838d734a80fbb330e2b73fea3b343900591a3605c6c03b5",
diff --git a/.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.i18n.yaml b/.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.i18n.yaml
index e7aa78354c..22bf3c01c4 100644
--- a/.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.md
-2026-06-20-generic-long-running-tool-runtime.md: c386d3b338c94e0e5bbf8e99c2c7a30971ba92b7
-2026-06-20-generic-long-running-tool-runtime.zh.md: 002514740a15c5961960d20976fc18f7fd8071ff
+2026-06-20-generic-long-running-tool-runtime.md: 5960eb268656d7e316c763631451db1c6d1c6e49
+2026-06-20-generic-long-running-tool-runtime.zh.md: ea63ae82962a735b3a96e1803708172a33f83e9d
diff --git a/.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.md b/.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.md
index c386d3b338..5960eb2686 100644
--- a/.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.md
+++ b/.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.md
@@ -27,7 +27,7 @@ The literal types live on the [tasks subsystem page](../../../../docs/subsystems
 
 The process-local provider also owns bounded admission, whose rationale is recorded in the [bounded background job admission decision](../../archived/bug-fix/2026-08-11-bounded-background-job-admission.md). Its positive-safe-integer `maxConcurrentJobsPerOwner` config defaults to `10`; `start()` derives each exact `Agent` object's active count from `running` and `stopping` records, while every unowned task shares one service bucket. Capacity rejection occurs before `run()` and id allocation, and producer `done` settlement is the only event that releases a stopping task's place. The provider does not queue, preempt, or retain a second mutable count.
 
-`outputLimitBytes` is producer-owned presentation policy, not a registry buffer. The registry validates and projects it unchanged into `JobSnapshot`; generic control APIs apply the cap to complete model-facing output after adding their own status or notice metadata. Omitting it preserves the existing controller behavior, so the runtime does not impose a hidden default on unrelated producer families.
+`outputLimitBytes` is producer-owned presentation policy, not a registry buffer. The registry validates and projects it unchanged into `JobView`; generic control APIs apply the cap to complete model-facing output after adding their own status or notice metadata. Omitting it preserves the existing controller behavior, so the runtime does not impose a hidden default on unrelated producer families.
 
 A model-facing producer exposes that committed id in its canonical success value, normally `{ kind: 'background', jobId }`; Native rendering may keep human-readable prose. A pre-aborted background call fails rather than returning a no-op because no task exists to satisfy the promised handle. Once registration publishes the id, cancellation belongs to the task's own controller and the job runtime: later cancellation of the producing tool call must not kill the published task. `job_kill`, owner disposal, and service teardown request cancellation; foreground execution remains coupled to the call's `exec.signal`.
 
@@ -62,7 +62,7 @@ For contract-compliant producers, `AgentHandle.dispose()` resolves only after ow
 - `read(id, caller?)` for a consuming stream delta or an idempotent final result.
 - `kill(id, caller?, reason?)` for cancellation.
 - `wait(id, timeoutMs, caller?, signal?)` for bounded terminal waiting.
-- `onJobDone(listener)` for effect-scoped observation with exact-owner delivery and listener containment.
+- `events.subscribe(filter, listener)` for effect-scoped observation of registration, progress, output, settlement, and removal, filtered by owner or owner scope, with listener containment.
 - `attachController(name)` for the task-controller availability fence.
 
 `wait` returns the terminal snapshot when the task settles or the live snapshot when its timeout expires. Aborting a wait cancels only that wait. If settlement has already assigned terminal delivery to the waiter, the terminal snapshot still wins. Waiters unregister synchronously on abort so a same-tick settlement cannot suppress a completion notice on behalf of a reader that receives nothing.
@@ -81,7 +81,7 @@ Stream reads share one task-scoped consuming cursor because the owning model is
 
 The system prompt tells the model to retain job ids, continue independent work instead of busy-polling or duplicating a running task, collect relevant tasks before its final answer, and kill work that no longer matters. Completion delivers a logged message to the exact owner's session. A busy owner is injected; an idle owner is woken, under the bounded policy the [idle-owner wake decision](../feature/2026-08-11-background-job-completion-wakes-an-idle-owner.md) owns.
 
-The runtime marks a terminal task `reported` when a read or wait delivers it, when a live waiter has claimed delivery at settlement, or when the model explicitly kills it. Reported tasks do not inject redundant completion notices. Listener failures are logged independently, do not stop later listeners, and are not awaited by waiters or teardown. When a snapshot carries `outputLimitBytes`, `dsh-tool-jobs` preserves UTF-8 boundaries and reuses an existing producer truncation marker rather than duplicating it. Reads reserve status suffixes and retain the output tail; completion notices reserve the stable `background job <id>` prefix and `job_output` instruction before truncating variable kind, label, status, detail, or the truncation marker itself, so the minimum PTY cap still identifies the task to collect. The job controller resolves the caller-visible producer cap in a prepended pre-execute listener before policy can deny or short-circuit dispatch, then applies it through the task definitions' last-mile `finalizeContent` callback so normalized tool errors, outer pipeline failures, and single-text policy results cannot escape the bound; deliberately structured multi-block policy results retain policy ownership of their shape and size.
+`dsh-tool-jobs` keeps the delivery ledger: a wait claims the task when it starts (and withdraws if the task outlives the wait) and a `job_kill` claims it when accepted, so a settlement the model already received through a tool result injects no redundant completion notice; teardown settlements and unowned tasks are never announced ([seam consolidation](2026-09-03-jobs-seam-consolidation.md)). Listener failures are logged independently, do not stop later listeners, and are not awaited by waiters or teardown. When a view carries `outputLimitBytes`, `dsh-tool-jobs` preserves UTF-8 boundaries and reuses an existing producer truncation marker rather than duplicating it. Reads reserve status suffixes and retain the output tail; completion notices reserve the stable `background job <id>` prefix and `job_output` instruction before truncating variable kind, label, status, detail, or the truncation marker itself, so the minimum PTY cap still identifies the task to collect. The job controller resolves the caller-visible producer cap in a prepended pre-execute listener before policy can deny or short-circuit dispatch, then applies it through the task definitions' last-mile `finalizeContent` callback so normalized tool errors, outer pipeline failures, and single-text policy results cannot escape the bound; deliberately structured multi-block policy results retain policy ownership of their shape and size.
 
 ## Producer opt-in
 
@@ -105,7 +105,7 @@ Separate bash and subagent output/stop tools duplicate ids, isolation, cleanup,
 
 ### An immediate abstract task-runtime backend
 
-The current `JobStart.run()` contract passes in-process callbacks and exact `Agent` objects. A durable backend changes identity, restart, ownership, and observation semantics, so at introduction time the registry stayed one concrete service rather than freezing the wrong boundary. The [task-registry contract Agent Note](../../archived/architecture/2026-07-26-job-registry-seam.md) later separated the contract from the process-local implementation without changing these in-process semantics.
+The current `JobSpec.run()` contract returns in-process hooks and pushes output through an in-process `JobHandle`, and owners resolve to live `Agent`s in-process. A durable backend changes identity, restart, ownership, and observation semantics, so at introduction time the registry stayed one concrete service rather than freezing the wrong boundary. The [task-registry contract Agent Note](../../archived/architecture/2026-07-26-job-registry-seam.md) later separated the contract from the process-local implementation without changing these in-process semantics.
 
 ### Consumer-owned authorization or cleanup events
 
diff --git a/.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.zh.md b/.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.zh.md
index 002514740a..ea63ae8296 100644
--- a/.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.zh.md
+++ b/.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.zh.md
@@ -27,7 +27,7 @@ Status: implemented
 
 进程内 Service Provider 还拥有有界准入，其理由记录在[有界后台任务准入决策](../../archived/bug-fix/2026-08-11-bounded-background-job-admission.md)中。它的 `maxConcurrentJobsPerOwner` 配置必须是正的安全整数，默认值为 `10`；`start()` 从 `running` 与 `stopping` 记录派生每个确切 `Agent` 对象的活动数量，而全部无 owner 任务共享一个服务级桶。容量拒绝发生在 `run()` 与 id 分配之前，处于 stopping 的任务只有在生产方 `done` 结算时才释放名额。Service Provider 不排队或抢占任务，也不保留第二份可变计数。
 
-`outputLimitBytes` 是生产方拥有的呈现策略，而非注册表缓冲区。注册表校验该值，并将其原样投影到 `JobSnapshot`；通用任务控制器添加自身的状态或通知元数据后，再将该上限应用于完整的面向模型输出。省略该值时保持现有控制器行为，因此运行时不会向无关的生产方类别施加隐式默认值。
+`outputLimitBytes` 是生产方拥有的呈现策略，而非注册表缓冲区。注册表校验该值，并将其原样投影到 `JobView`；通用任务控制器添加自身的状态或通知元数据后，再将该上限应用于完整的面向模型输出。省略该值时保持现有控制器行为，因此运行时不会向无关的生产方类别施加隐式默认值。
 
 面向模型的生产方会在规范成功值中暴露已提交的 id，通常为 `{ kind: 'background', jobId }`；Native 渲染仍可保留便于人类阅读的行文。预先被中止的后台调用会失败，而不是返回空操作，因为不存在可履行所承诺句柄的任务。一旦注册过程发布 id，取消就归任务自身的控制器与任务运行时所有：随后取消生产工具调用不得终止已发布的任务。`job_kill`、所有者资源释放和服务拆除会请求取消；前台执行仍与调用的 `exec.signal` 耦合。
 
@@ -62,7 +62,7 @@ job id 在运行时全局可见且可预测，因此注册表会授权每次访
 - `read(id, caller?)`：消费式流增量或幂等的最终结果。
 - `kill(id, caller?, reason?)`：取消。
 - `wait(id, timeoutMs, caller?, signal?)`：有界的终止等待。
-- `onJobDone(listener)`：effect 作用域内的观察，具有精确所有者投递和监听器隔离。
+- `events.subscribe(filter, listener)`：effect 作用域内对注册、进度、输出、结算与移除的观察，按所有者或所有者 scope 过滤，具有监听器隔离。
 - `attachController(name)`：任务控制器可用性防线。
 
 `wait` 在任务完成时返回终止快照，在等待超时时返回当前快照。中止一次等待只取消该次等待。如果结算已经将终止投递分配给该等待方，终止快照仍然优先。等待方在中止时同步注销，因此同一 tick 内发生结算时，不会代表一个实际未收到任何内容的读取方压制完成通知。
@@ -81,7 +81,7 @@ job id 在运行时全局可见且可预测，因此注册表会授权每次访
 
 系统提示词要求模型保留 job id、在后台工作运行时继续处理独立工作而非忙轮询或重复启动同一任务、在给出最终答案前收集相关任务，并终止不再重要的工作。完成时，系统会向确切所有者的会话交付一条已记录的消息：繁忙的所有者走注入，空闲的所有者会被唤醒，其有界策略由[空闲所有者唤醒决策](../feature/2026-08-11-background-job-completion-wakes-an-idle-owner.zh.md)负责。
 
-当读取或等待交付终止任务、尚在等待的等待方在结算时认领了投递，或模型显式终止任务时，运行时将终止任务标为 `reported`。已报告的任务不会注入冗余的完成通知。监听器失败会独立记录，不会阻止后续监听器，也不会被等待方或资源销毁过程等待。当快照携带 `outputLimitBytes` 时，`dsh-tool-jobs` 会保持 UTF-8 边界，并复用生产方已有的截断标记，而不会重复添加。读取会为状态后缀预留空间并保留输出尾部；完成通知会先为稳定的 `background job <id>` 前缀与 `job_output` 指令预留空间，再截断可变的 kind、label、status、detail，乃至截断标记本身，因此 PTY 的最小上限仍能标识需要收集的任务。任务控制器在策略有机会拒绝或短路分发之前，于最先执行的 pre-execute 监听器中解析调用方可见的生产方上限；随后通过任务定义最后一道的 `finalizeContent` 回调应用该上限，使规范化的工具错误、外层流水线失败与单文本策略结果都无法绕过该边界；经特意结构化的多块策略结果仍由策略拥有其形状与大小。
+`dsh-tool-jobs` 持有投递台账：等待在开始时认领任务（任务比等待活得更久则撤回），`job_kill` 被接受时也认领，因此模型已经通过工具结果收到的结算不会再注入冗余的完成通知；teardown 结算与无主任务从不播报（[seam 收敛](2026-09-03-jobs-seam-consolidation.zh.md)）。监听器失败会独立记录，不会阻止后续监听器，也不会被等待方或资源销毁过程等待。当视图携带 `outputLimitBytes` 时，`dsh-tool-jobs` 会保持 UTF-8 边界，并复用生产方已有的截断标记，而不会重复添加。读取会为状态后缀预留空间并保留输出尾部；完成通知会先为稳定的 `background job <id>` 前缀与 `job_output` 指令预留空间，再截断可变的 kind、label、status、detail，乃至截断标记本身，因此 PTY 的最小上限仍能标识需要收集的任务。任务控制器在策略有机会拒绝或短路分发之前，于最先执行的 pre-execute 监听器中解析调用方可见的生产方上限；随后通过任务定义最后一道的 `finalizeContent` 回调应用该上限，使规范化的工具错误、外层流水线失败与单文本策略结果都无法绕过该边界；经特意结构化的多块策略结果仍由策略拥有其形状与大小。
 
 ## 生产方显式启用
 
@@ -105,7 +105,7 @@ bash seam 暴露 `resolve`、`run` 和 `start`。`start(spec)` 返回一个 `She
 
 ### 立即抽象任务运行时后端
 
-当前 `JobStart.run()` 约定传入进程内回调与确切的 `Agent` 对象。持久化后端会改变身份、重启、所有权与观察语义，因此在引入之时注册表保持为单一具体服务，而非固化错误的边界。[任务注册表约定 Agent Note](../../archived/architecture/2026-07-26-job-registry-seam.md)后来在不改变这些进程内语义的前提下，将约定与进程内实现分离。
+当前 `JobSpec.run()` 约定返回进程内钩子并经进程内的 `JobHandle` 推送输出，所有者也在进程内解析为存活的 `Agent`。持久化后端会改变身份、重启、所有权与观察语义，因此在引入之时注册表保持为单一具体服务，而非固化错误的边界。[任务注册表约定 Agent Note](../../archived/architecture/2026-07-26-job-registry-seam.md)后来在不改变这些进程内语义的前提下，将约定与进程内实现分离。
 
 ### 由消费方负责授权或清理事件
 
diff --git a/.agents/notes/implemented/architecture/2026-09-01-jobs-absorb-activity-record.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-01-jobs-absorb-activity-record.i18n.yaml
new file mode 100644
index 0000000000..497481e7d2
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-01-jobs-absorb-activity-record.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-01-jobs-absorb-activity-record.md
+2026-09-01-jobs-absorb-activity-record.md: 508608f7eb694bf131bad9a25e856d32c7079559
+2026-09-01-jobs-absorb-activity-record.zh.md: 2c157d951042f1cd6f8a3a66129773bc99cd5b02
diff --git a/.agents/notes/implemented/architecture/2026-09-01-jobs-absorb-activity-record.md b/.agents/notes/implemented/architecture/2026-09-01-jobs-absorb-activity-record.md
new file mode 100644
index 0000000000..508608f7eb
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-01-jobs-absorb-activity-record.md
@@ -0,0 +1,48 @@
+# Agent Note: The job registry absorbs the observation record; the standalone activity seam is removed
+
+Status: implemented
+
+Superseded: the record declaration (`JobStart.record`, `RecordingJob`, `readRecord`, `pumpJobOutput`) and the split wire (`SessionJob.record` on the session control stream, `ctx.jobOutput`) described below were consolidated into one output ring and direct operations on `ctx.jobs` — see [the jobs seam consolidation](2026-09-03-jobs-seam-consolidation.md). The argument for absorbing the standalone activity seam into `ctx.jobs` still holds.
+
+English | [中文](2026-09-01-jobs-absorb-activity-record.zh.md)
+
+## Problem
+
+The [activity observation seam](../feature/2026-08-24-activity-observation-seam.md) shipped live output streaming as a second registry beside `ctx.jobs`: producers registered the same work twice (a job for lifecycle, an activity for observation), kept the two terminal states consistent by hand (`observeBackgroundActivity` waited for `proc.done` before mapping the outcome so a pump failure could not freeze a wrong terminal state), correlated the rows through `ActivityCorrelation.jobId`, and wrapped every observation call in registry-absent degradation branches. The Web client maintained two rosters (session-control `jobs` frames and the activity control stream) and joined them per row. Measured before the merge: eight pairing call sites, and one producer population — background bash/pwsh (both registries), PTY sends and subagent delegations (jobs only), foreground workflow (activity only).
+
+The one activity without a job was the foreground workflow mirror. Everything else the split enabled — independent observers, absolute-offset reads, bounded retention — is a property of the record, not of the registry split.
+
+## Decision
+
+`ctx.jobs` owns the observation record; `packages/activity/`, `packages/api/activity-controller`, and the correlation vocabulary are removed.
+
+- **`JobStart.record?: true`** declares an observable output record. `run(job)` now receives the job's producer face — `RecordingJob { id, append(text, {channel?, gapBefore?}), updateDetail(detail) }` for a `record: true` start, the plain `RunningJob { id, updateDetail(detail) }` otherwise — so the id is issued before the starter runs (a throwing starter still registers nothing; its ordinal is skipped). Writes staged inside the starter surface at the registration commit. `updateDetail` works for every job and gives `job_list` a live progress line; `append` without a record declaration logs and drops.
+- **There is no `end`.** Job settlement — the producer outcome, a kill, or teardown — is the record's only close: it trims retention to the settled cap and fires the final `onOutput` signal. The dual-settlement pairing (`ActivityHandle.end` first-wins against teardown force-ends) is deleted, not reimplemented.
+- **`readRecord(id, from, caller)`** is the non-consuming multi-reader view (absolute UTF-8 offsets, `lossy` below the retained window), fenced like every other job read; it never marks the job `reported`. The model-facing `readOutput` cursor is untouched — the two projections serve different readers and stay separate by design.
+- **`jobs-local`** absorbs the chunk ring (`retainBytes` 256 KiB live, `settledRetainBytes` 16 KiB settled), and `pumpJobOutput` replaces `pumpActivityOutput` beside the seam. Producers fold the pump's final drain into `hooks.done` so the record holds its last bytes before settlement closes it.
+- **The wire splits by role.** `SessionJob.record` (present exactly for record jobs) marks a row observable on the session control stream; `job.follow({sessionId?, jobId, from?})` on the `job` namespace of `api-job-controller` streams anchor/output/status frames with the fenced read resolved from the request's session. `api-activity-controller` is deleted; its roster stream is redundant (the jobs frames are the roster) and its observe machinery lives in `api-job-controller` (`observe.ts`, client `ctx.jobOutput`), which resolves its Remote faces in its own apply.
+- **`ui-activity` returns to its upstream name `ui-jobs`** and renders one roster: `jobsBySession` rows, expandable exactly when `record` is present. The two-roster join is deleted.
+- **Foreground workflow loses its live panel deliberately.** `tool-workflow`'s activity mirror is removed; a foreground run surfaces through its recorded run/member lifecycle events only, and the per-line `workflow/phase` / `workflow/log` narration has no observer until workflow gains `run_in_background` and registers a record job. Jobs stay a pure background registry — no `foreground` mode bit, no model-invisible rows, no run-less rows.
+
+## Alternatives considered
+
+- **A `foreground: true` job mode** to keep the foreground workflow panel: it needs two coupled enforcement points (reported-at-birth and a `job_list` filter) whose divergence double-delivers or leaks rows to the model, for one edge feature replaceable by `run_in_background`.
+- **Serving model reads from the record** (deleting `readOutput`): model reads are producer-formatted (truncation and spill notices, sandbox markers) and consuming; the record is raw, channel-labeled, and non-consuming. Unifying them moves producer-specific formatting into the registry or noise into the observer stream.
+- **Keeping the split with shared implementation** (a common registry library): it removes the duplicated skeleton but keeps the real costs — double registration, terminal-state pairing, correlation, a second wire roster, and a second package family.
+
+The [prior seam note](../feature/2026-08-24-activity-observation-seam.md)'s argument against durable session events and control-stream framing for live output still holds and carries over unchanged: the record is process-local observation state, never a session event, so "model-visible ⟺ logged" is untouched.
+
+## Review corrections
+
+Review of the merged design settled five points that the sections above leave implicit:
+
+- **The pump's wait holds constant resources.** `pumpJobOutput` subscribes to the producer's `done` once and keeps one pending timer; settlement clears the timer and wakes the current wait. Racing the same pending promise every poll round retained a reaction per round until the job ended — a day-long job at the default cadence accumulated over a million closures.
+- **Client disposal waits for carrier quiescence.** The `ctx.jobOutput` effect disposer is async and awaits every open `RemoteStream.dispose()`, because Cordis awaits async disposers and a fiber that reported unloaded while an old iterator was still closing could overlap the next plugin instance under HMR.
+- **The roster flags a record, it does not count bytes.** `SessionJob.record: true` replaced `outputTotal`: `append` commits no roster change (only lifecycle commits fire `onJobsChanged`), so a mirrored count went stale the moment output arrived, and broadcasting the roster per append was rejected as traffic for a number no row needed. The live offsets ride the observation stream's `opened` anchor.
+- **The record is a best-effort live preview.** Producers copy stdout and stderr per poll round, so writes inside one window land stdout first; pipe capture cannot recover the true interleaving (only a PTY or `2>&1` can), and the client concatenates chunks regardless of `channel`. `channel` stays on the wire because it is what makes that limit visible and what a distinct stderr rendering would need.
+- **The declaration types the face.** `JobStart` is a union discriminated by `record`: `RecordingJobStart.run` receives `RecordingJob`, `PlainJobStart.run` receives `RunningJob` without `append`, and the registry builds the plain face without the method — output the registry has nowhere to keep is unrepresentable instead of warned about and dropped.
+- **Web e2e keep-alive is a barrier, not a clock.** The background command holds on a file the test owns in the job's cwd and the scenario kills it explicitly, so no CI stall can settle the job first; each scenario is one test, never a chain of tests sharing a job id.
+
+## Consequences
+
+Every observable row is a killable job; a pure-observation surface with no lifecycle would need a new home (harness diagnostics belong to the inspector plane, not here). A future remote job provider must implement lifecycle and record together. The record's retention config lives on `jobs-local`; the observation wire's cadence config (`observeFlushMs`, `observeMaxFrameBytes`) lives on `api-job-controller`.
diff --git a/.agents/notes/implemented/architecture/2026-09-01-jobs-absorb-activity-record.zh.md b/.agents/notes/implemented/architecture/2026-09-01-jobs-absorb-activity-record.zh.md
new file mode 100644
index 0000000000..2c157d9510
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-01-jobs-absorb-activity-record.zh.md
@@ -0,0 +1,48 @@
+# Agent Note：job 注册表吸收观测 record；独立的 activity seam 被移除
+
+Status: implemented
+
+Superseded：下文描述的 record 声明（`JobStart.record`、`RecordingJob`、`readRecord`、`pumpJobOutput`）与拆分的线路（会话控制流上的 `SessionJob.record`、`ctx.jobOutput`）已收敛为一个输出环与 `ctx.jobs` 上的直接操作——见 [jobs seam 收敛](2026-09-03-jobs-seam-consolidation.zh.md)。把独立 activity seam 吸收进 `ctx.jobs` 的论证仍然成立。
+
+[English](2026-09-01-jobs-absorb-activity-record.md) | 中文
+
+## 问题
+
+[activity 观测 seam](../feature/2026-08-24-activity-observation-seam.zh.md) 把实时输出流做成了 `ctx.jobs` 旁边的第二个注册表：生产者要把同一份工作登记两次（job 管生命周期，activity 管观测），手工保持两个终态一致（`observeBackgroundActivity` 要等 `proc.done` 才映射 outcome，防止 pump 失败把错误终态冻上去），通过 `ActivityCorrelation.jobId` 关联两行，并给每个观测调用包上注册表缺失的降级分支。Web 客户端维护两份名册（session-control 的 `jobs` 帧与 activity control 流）并逐行做 join。合并前实测：八个配对调用点；生产者人口为——后台 bash/pwsh（双注册表）、PTY 发送与 subagent 委托（仅 jobs）、前台 workflow（仅 activity）。
+
+唯一没有 job 的 activity 是前台 workflow 镜像。拆分带来的其他一切——独立观察者、绝对偏移读取、有界保留——都是 record 的性质，不是注册表拆分的性质。
+
+## 决策
+
+`ctx.jobs` 拥有观测 record；`packages/activity/`、`packages/api/activity-controller` 与 correlation 词表被移除。
+
+- **`JobStart.record?: true`** 声明可观测输出 record。`run(job)` 现在收到 job 的生产者面——`record: true` 的 start 收到 `RecordingJob { id, append(text, {channel?, gapBefore?}), updateDetail(detail) }`，其余收到普通的 `RunningJob { id, updateDetail(detail) }`——因此 id 在 starter 运行前签发（starter 抛出仍然不登记任何东西；序号被跳过）。starter 内暂存的写入在登记提交时可见。`updateDetail` 对所有 job 可用，让 `job_list` 也能看到实时进度行；未声明 record 的 `append` 记日志并丢弃。
+- **没有 `end`。** job 结算——生产者 outcome、kill 或 teardown——是 record 唯一的关闭：裁剪到结算保留量并发出最后一个 `onOutput` 信号。双结算配对（`ActivityHandle.end` 与 teardown 强结的 first-wins 对账）被删除，而非重新实现。
+- **`readRecord(id, from, caller)`** 是非消耗多读者视图（绝对 UTF-8 偏移，低于保留窗口为 `lossy`），围栏与其他 job 读取一致；永不置 `reported`。模型面的 `readOutput` 游标原样保留——两个投影服务不同读者，刻意保持分离。
+- **`jobs-local`** 吸收块环（`retainBytes` 运行期 256 KiB，`settledRetainBytes` 结算后 16 KiB），`pumpJobOutput` 在 seam 旁替换 `pumpActivityOutput`。生产者把 pump 的末次排空折进 `hooks.done`，让 record 在结算关闭前握有最后的字节。
+- **wire 按角色拆分。** `SessionJob.record`（恰在 record job 上存在）在会话控制流上标记行可观测；`api-job-controller` 的 `job` 命名空间上的 `job.follow({sessionId?, jobId, from?})` 流式发送 anchor/output/status 帧，围栏读取者由请求的 session 解析。`api-activity-controller` 删除；其名册流是冗余的（jobs 帧就是名册），observe 机制位于 `api-job-controller`（`observe.ts`，客户端 `ctx.jobOutput`），它在自己的 apply 里解析所依赖的 Remote 面。
+- **`ui-activity` 改回上游名字 `ui-jobs`**，渲染单一名册：`jobsBySession` 行，恰在 `record` 存在时可展开。双名册 join 被删除。
+- **前台 workflow 有意失去实时面板。** `tool-workflow` 的 activity 镜像被移除；前台 run 只通过已记录的 run/member 生命周期事件呈现，逐行的 `workflow/phase` / `workflow/log` 叙述在 workflow 获得 `run_in_background` 并登记 record job 之前没有观察者。jobs 保持纯后台注册表——没有 `foreground` 模式位、没有模型不可见行、没有无 run 行。
+
+## 曾考虑的替代方案
+
+- **`foreground: true` job 模式**以保留前台 workflow 面板：它需要两个耦合的执行点（出生即 reported 与 `job_list` 过滤），两者一旦分叉就会双投递或向模型泄漏行，而它换来的只是一个可被 `run_in_background` 替代的边缘特性。
+- **用 record 服务模型读取**（删除 `readOutput`）：模型读取是生产者格式化的（截断与 spill 提示、sandbox 标记）且消耗型；record 是原始、带 channel 标签、非消耗的。统一二者要么把生产者特有格式化搬进注册表，要么把噪声混入观察者流。
+- **保留拆分但共享实现**（公共注册表库）：它消除重复骨架，但保留真正的成本——双重登记、终态配对、correlation、第二条 wire 名册与第二个包族。
+
+[先前 seam note](../feature/2026-08-24-activity-observation-seam.zh.md) 反对用持久会话事件或 control 流承载实时输出的论证仍然成立并原样沿用：record 是进程本地观测状态，从不是会话事件，「模型可见 ⟺ 已记录」不受影响。
+
+## 评审修正
+
+对已合并设计的评审确定了上文各节未言明的五点：
+
+- **泵的等待资源恒定。** `pumpJobOutput` 对生产者的 `done` 只订阅一次，同一时刻只保留一个待触发的 timer；结算清掉 timer 并唤醒当前等待。此前每个轮询轮次都对同一个 pending promise 赛跑，每轮留下一个 reaction 直到任务结束——默认节奏下跑一天的任务会累积上百万个闭包。
+- **客户端卸载等待载体静止。** `ctx.jobOutput` 的 effect disposer 是异步的，await 每条打开的 `RemoteStream.dispose()`：Cordis 会 await 异步 disposer，而一个在旧 iterator 仍在关闭时就宣告卸载完成的 fiber，在 HMR 下可能与下一个插件实例重叠。
+- **名册标记 record，不计字节。** `SessionJob.record: true` 取代了 `outputTotal`：`append` 不提交名册变更（只有生命周期提交触发 `onJobsChanged`），镜像的计数在输出到达的瞬间就陈旧了；而为一个没有任何行需要的数字按 append 广播整份名册被否决。实时偏移随观测流的 `opened` 锚帧到达。
+- **record 是尽力而为的实时预览。** 生产者按轮询轮次复制 stdout 与 stderr，同一窗口内的写入先 stdout 落地；pipe 捕获无法还原真实交错（只有 PTY 或 `2>&1` 可以），客户端拼接 chunk 时也不区分 `channel`。`channel` 留在 wire 上，因为它正是让这一限制可见、也是将来区分渲染 stderr 所需要的东西。
+- **声明决定生产者面的类型。** `JobStart` 是按 `record` 判别的联合类型：`RecordingJobStart.run` 收到 `RecordingJob`，`PlainJobStart.run` 收到没有 `append` 的 `RunningJob`，注册表给普通 job 构造的面根本没有这个方法——注册表无处存放的输出成为不可表达，而不是警告后丢弃。
+- **Web e2e 的保活是 barrier 而非时钟。** 后台命令守在测试拥有的、位于 job cwd 的文件上，由场景显式 kill，因此 CI 卡顿不可能先把任务结算掉；每个场景是一个测试，绝不是共享 job id 的测试链。
+
+## 后果
+
+每个可观测行都是可 kill 的 job；没有生命周期的纯观测面需要新的归属（harness 诊断属于 inspector 平面，不在这里）。未来的远端 job provider 必须同时实现生命周期与 record。record 的保留配置在 `jobs-local`；观测 wire 的节奏配置（`observeFlushMs`、`observeMaxFrameBytes`）在 `api-job-controller`。
diff --git a/.agents/notes/implemented/architecture/2026-09-03-jobs-seam-consolidation.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-03-jobs-seam-consolidation.i18n.yaml
new file mode 100644
index 0000000000..1d1a4bc731
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-03-jobs-seam-consolidation.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-03-jobs-seam-consolidation.md
+2026-09-03-jobs-seam-consolidation.md: 2742ff1a80ec4cc4d8e5948f63d306abb9753733
+2026-09-03-jobs-seam-consolidation.zh.md: 1fa61919a27362ce42419b57e0960e9be86ea07e
diff --git a/.agents/notes/implemented/architecture/2026-09-03-jobs-seam-consolidation.md b/.agents/notes/implemented/architecture/2026-09-03-jobs-seam-consolidation.md
new file mode 100644
index 0000000000..2742ff1a80
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-03-jobs-seam-consolidation.md
@@ -0,0 +1,35 @@
+# Agent Note: One output ring, one projection, one event stream for background jobs
+
+Status: implemented
+
+English | [中文](2026-09-03-jobs-seam-consolidation.zh.md)
+
+## Problem
+
+The job seam had grown by accretion. Producers declared their output twice — a consuming `readOutput` hook the model read and an optional `record: true` ring observers read — and the registry kept two vocabularies for one job (`JobSnapshot` for the model, `SessionJob` on the session control stream, `JobWireChunk` on the observation wire). Three listener families (`onJobDone`, `onJobsChanged`, `onOutput`) delivered overlapping facts with different owner filters, and the registry itself tracked `reported`, a bit that only the model-facing tool could interpret. Review of the merged design called the interface layer the weakest part: a reader could not tell which of `read`, `readRecord`, `JobStart`, `RecordingJob`, and `updateDetail` was the contract and which was an accident of history.
+
+## Decision
+
+- **One ring per job.** `JobSpec` replaces `JobStart`: a spec names optional pull `output` sources (`JobOutputSource`, the subprocess `readFrom` family) that the registry pumps at its own cadence (`pumpPollMs` on `dsh-jobs-local`), and every producer receives a `JobHandle` whose `append` pushes chunks into the same ring. The model's consuming read and every observer's absolute-offset read serve the same bytes; `readOutput` and the `record` discriminator are gone. Shell producers hand the registry their `observed` offset readers and fold sandbox facts into the terminal `detail`; the terminal producer adapts its consuming send reader through a byte-counting source; the subagent returns its answer as `JobOutcome.result`, which the first read after settlement carries once.
+- **Two cursors, one storage.** `JobRegistry.read(id)` is the stateful model cursor; `JobRegistry.readAt(id, from)` is the stateless observer read. Model reads exclude `log` chunks (producer narration for observers) and render stdout, then one `[stderr]` section, exactly as the shell tools always did.
+- **`updateProgress` replaces `updateDetail`.** `JobView.progress` is the live line and is cleared at settlement; `JobView.detail` is the terminal reason, with the model's `job_kill` reason merged in.
+- **One projection.** `JobView` (client-safe leaf `@deepseek-ai/dsh-jobs/view`) is what the model tools, the browser roster, and the observation frames consume; `owner` is the session id, never the `Agent`.
+- **Direct caller-scoped operations.** `JobRegistry.list`, `get`, `read`, `readAt`, `kill`, and `wait` accept the caller session on each call. Omitting the caller permits only unowned jobs. The output ring and browser streams do not require a separate caller-bound operation object.
+- **One event stream.** `events.subscribe(filter, listener)` with `{ owner }`, `{ owners: 'scope' }`, or `{ owners: 'all' }` replaces the three listener families. `settled` names its cause (`producer`, `kill`, `teardown`); `output` carries only the id and the new total.
+- **The notice ledger moves to `dsh-tool-jobs`.** The registry no longer tracks `reported`. The tool claims a job when a wait starts (and withdraws on timeout or abort) and when `job_kill` is accepted; the settlement event drops the entry, teardown settlements and unowned jobs are skipped, and the destination is the agent registered for the owner session at settlement.
+- **The roster leaves the session control stream.** `dsh-api-job-controller` owns `job.list({ sessionId })` — whole-set frames after each coalesced burst of lifecycle commits, never per append — beside `job.follow`, and its client installs `ctx.jobs` (`watchRows`, `observe`, one snapshot). `dsh-api-session-controller` carries queues and projections only; `ui-jobs` watches its session's roster while mounted, and a row is expandable while live or once it left retained output behind.
+
+`attachController` and the owner-relative `servesOwner` gate stay as they were; whether a producer may offer `run_in_background` without a mounted controller is deferred, since the gap predates this change.
+
+## Alternatives considered
+
+- **Keep three listeners with a shared owner filter.** It preserves the accreted names but not the property reviewers asked for — one place to learn what the registry announces — and `onJobDone`'s exact-owner delivery is what forced the registry to keep an `Agent` in every projection.
+- **Keep `reported` in the registry.** Only the tool knows which deliveries reach the model (a wait's tool result, a kill's acknowledgement); the registry could only approximate it, and the approximation was the source of the double-notice and missed-notice bugs the review listed.
+- **Keep the roster on the session control stream.** It saved one Remote stream but coupled the session controller to the job registry and mirrored a `record` flag the ring's byte count now answers directly (`output.total`).
+- **Serve `log` chunks to the model too.** Producer narration is for observers; the model already receives the same facts through `progress` and the terminal `detail`.
+
+## Consequences
+
+The model-visible text is unchanged: status lines, tool descriptions and schemas, and notice wording are byte-identical, and the only new model-visible fact is the kill reason a `killed` status line now carries. A producer that needs to stream output picks pull sources or `append`; it never formats a consuming delta. The Web client renders every live job as expandable, so a job that never writes shows an empty running panel instead of a static row. `JobKindMap` merges are host-side, so a browser program types `JobView.kind` as the kinds it knows and treats the rest as opaque strings, which is all the roster does with it.
+
+Review follow-ups after the master merge tightened four of these edges. A job's first event is always `registered`: the announcement precedes the pump, whose first drain runs synchronously and may announce output. A settled ring keeps every byte the model cursor has not consumed until the first terminal model read, so a job that finishes before its first `job_output` loses nothing the live cap retained. `dsh-tool-jobs` holds one claim per wait call with a `live` flag that the caller's abort clears synchronously from the abort event, so a settlement announced before the registry's rejection reaches the tool still delivers its notice, and a timed-out wait drops only its own claim while a concurrent wait keeps the settlement covered. The browser records an observation failure that precedes the anchor as an errored view, so the panel shows the notice instead of staying blank. The `@deepseek-ai/dsh-jobs/invariant` companion checks the announced event protocol per job (registered first, one settlement, removal last) and each announced projection against the registry's own read, which is the cross-observation the [companion rule](../simplification/2026-08-28-omit-unneeded-invariant-companions.md) requires; the earlier single-view field checks are gone. The spill file a pull source keeps is job metadata (`JobView.output.spillPaths`, reported by every pump read and withdrawn once a read stops naming it), not per-chunk metadata, and the model's read renders the shell tools' dropped-output notice for a producer-side gap as well as for ring eviction, naming those files even after the gap chunk itself was evicted — the `before this read` variant this change had introduced is gone. An observation generation that sees its job removed mid-stream (the owner's teardown) closes with the removed job's terminal projection instead of a failed read. A rejected background spawn produces no process output, so the shell providers now serve the `spawn failed: …` note as the whole observed stderr stream (the consuming read still folds it in once), and `ShellProcess.observed` with both readers is required: the model's first `job_output` after such a failure reads exactly what master's consuming read rendered.
diff --git a/.agents/notes/implemented/architecture/2026-09-03-jobs-seam-consolidation.zh.md b/.agents/notes/implemented/architecture/2026-09-03-jobs-seam-consolidation.zh.md
new file mode 100644
index 0000000000..1fa61919a2
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-03-jobs-seam-consolidation.zh.md
@@ -0,0 +1,35 @@
+# Agent Note：后台 job 的一个输出环、一个投影、一条事件流
+
+Status: implemented
+
+[English](2026-09-03-jobs-seam-consolidation.md) | 中文
+
+## 问题
+
+job seam 是逐步堆出来的。生产者要把输出声明两次——模型读取的消耗式 `readOutput` 钩子，以及观察者读取的可选 `record: true` 环——注册表也为同一个 job 保留了两套词汇（模型侧的 `JobSnapshot`、会话控制流上的 `SessionJob`、观测线路上的 `JobWireChunk`）。三个监听器家族（`onJobDone`、`onJobsChanged`、`onOutput`）用不同的拥有者过滤投递彼此重叠的事实，注册表自己还跟踪着只有模型侧工具才解释得了的 `reported` 位。合并后设计的评审把接口层称作最薄弱的部分：读者分不清 `read`、`readRecord`、`JobStart`、`RecordingJob` 与 `updateDetail` 里哪些是约定、哪些是历史遗留。
+
+## 决策
+
+- **每个 job 一个环。** `JobSpec` 取代 `JobStart`：spec 声明可选的拉取式 `output` 源（`JobOutputSource`，子进程的 `readFrom` 家族），由注册表按自己的节奏（`dsh-jobs-local` 的 `pumpPollMs`）泵送；每个生产者都收到一个 `JobHandle`，其 `append` 把块推进同一个环。模型的消耗式读取与每个观察者的绝对偏移读取服务同一批字节；`readOutput` 与 `record` 判别字段被移除。shell 生产者把它们的 `observed` 偏移读取器交给注册表，并把沙箱事实折进终态 `detail`；terminal 生产者通过一个计字节的源适配其消耗式发送读取器；subagent 把回答作为 `JobOutcome.result` 返回，结算后的第一次读取携带它一次。
+- **两个游标，一份存储。** `JobRegistry.read(id)` 是有状态的模型游标；`JobRegistry.readAt(id, from)` 是无状态的观察者读取。模型读取排除 `log` 块（给观察者的生产者叙述），并渲染 stdout，再接一段 `[stderr]`，与 shell 工具一贯的做法完全一致。
+- **`updateProgress` 取代 `updateDetail`。** `JobView.progress` 是实时行，结算时清除；`JobView.detail` 是终态原因，合并了模型 `job_kill` 给出的原因。
+- **一个投影。** `JobView`（客户端安全叶子 `@deepseek-ai/dsh-jobs/view`）是模型工具、浏览器名册与观测帧共同消费的形状；`owner` 是会话 id，从不是 `Agent`。
+- **直接传入调用方的操作。** `JobRegistry.list`、`get`、`read`、`readAt`、`kill` 与 `wait` 在每次调用时接收调用方会话。省略调用方时仅允许访问无主 job。输出环与浏览器流不需要独立的调用方操作对象。
+- **一条事件流。** 带 `{ owner }`、`{ owners: 'scope' }` 或 `{ owners: 'all' }` 过滤的 `events.subscribe(filter, listener)` 取代三个监听器家族。`settled` 标出原因（`producer`、`kill`、`teardown`）；`output` 只携带 id 与新的 total。
+- **播报台账移到 `dsh-tool-jobs`。** 注册表不再跟踪 `reported`。工具在等待开始时认领 job（超时或中止则撤回），在 `job_kill` 被接受时也认领；结算事件删除条目，teardown 结算与无主 job 被跳过，投递目标是结算时登记在拥有者会话下的 agent。
+- **名册离开会话控制流。** `dsh-api-job-controller` 在 `job.follow` 旁拥有 `job.list({ sessionId })`——每轮聚合过的生命周期提交之后发一次整集帧，从不按追加发——其客户端安装 `ctx.jobs`（`watchRows`、`observe`、一份快照）。`dsh-api-session-controller` 只承载队列与投影；`ui-jobs` 在挂载期间关注其会话的名册，行在 job 进行中或留有保留输出时可展开。
+
+`attachController` 与相对拥有者的 `servesOwner` 门保持原样；没有挂载控制器的生产者是否可以提供 `run_in_background`，因为这个缺口早于本次变更，暂不处理。
+
+## 考虑过的替代方案
+
+- **保留三个监听器并共享一个拥有者过滤。** 它保住了堆出来的名字，却保不住评审要的性质——一个地方就能学会注册表宣布什么——而且 `onJobDone` 的精确拥有者投递正是迫使注册表在每个投影里保留 `Agent` 的原因。
+- **把 `reported`留在注册表。** 只有工具知道哪些投递到达了模型（等待的工具结果、kill 的确认）；注册表只能近似，而这个近似正是评审列出的重复播报与漏播报 bug 的来源。
+- **把名册留在会话控制流上。** 省了一条 Remote 流，却把会话控制器耦合到 job 注册表，还镜像了一个环的字节数如今直接回答的 `record` 标志（`output.total`）。
+- **也把 `log` 块交给模型。** 生产者叙述是给观察者的；模型已经通过 `progress` 与终态 `detail` 收到同样的事实。
+
+## 后果
+
+模型可见文本保持不变：状态行、工具描述与 schema、播报措辞逐字节相同，唯一新增的模型可见事实是 `killed` 状态行现在携带的 kill 原因。需要流式输出的生产者选择拉取源或 `append`，从不格式化消耗式增量。Web 客户端把每个进行中的 job 渲染为可展开，因此从不写输出的 job 显示为空的运行中面板而非静态行。`JobKindMap` 的合并发生在宿主侧，浏览器程序把 `JobView.kind` 视为它认识的 kind 集合，其余当作不透明字符串——名册对它也只做这些。
+
+合并 master 之后的评审跟进收紧了其中四条边。job 的第一个事件永远是 `registered`：通告先于泵，而泵的首轮 drain 同步执行且可能通告输出。已结算的环在模型的首次终态读取之前保留模型游标尚未消费的全部字节，因此在首次 `job_output` 之前结束的 job 不会丢失运行期上限保留的任何内容。`dsh-tool-jobs` 为每次等待调用保存一条带 `live` 标记的认领，调用方 abort 时在 abort 事件里同步清掉该标记，因此注册表的拒绝尚未传回工具之前宣布的结算仍会投递通知；超时的等待只丢弃自己的认领，并发的另一个等待仍覆盖该结算。浏览器把先于锚点发生的观察失败记录为带错误的视图，面板显示提示而不是留白。`@deepseek-ai/dsh-jobs/invariant` 伴生插件校验每个 job 的事件协议（先 `registered`、恰一次结算、最后 `removed`）以及每个通告的投影与注册表自身读取的一致性，这正是[伴生插件规则](../simplification/2026-08-28-omit-unneeded-invariant-companions.zh.md)要求的交叉观察；先前只针对单个视图的字段校验已删除。拉取源保留的 spill 文件是 job 元数据（`JobView.output.spillPaths`，每次泵读取都会上报，读取不再点名时即撤回），不是逐块元数据；模型读取对生产者侧缺口与环淘汰都渲染 shell 工具的丢失输出提示并列出这些文件，即使缺口块本身已被淘汰——本次变更曾引入的 `before this read` 变体已删除。观察生成过程若在流中看到其 job 被移除（拥有者 teardown），以被移除 job 的终态投影收尾，而不是一次失败的读取。被拒绝的后台 spawn 不产生任何进程输出，因此 shell provider 现在把 `spawn failed: …` 提示作为 observed stderr 的整条流提供（消耗式读取仍只折入一次），且 `ShellProcess.observed` 及其两个读取器改为必填：这类失败之后模型的首次 `job_output` 读到的正是 master 的消耗式读取所渲染的内容。
diff --git a/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.i18n.yaml
new file mode 100644
index 0000000000..061872368c
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.md
+2026-09-20-sidebar-retained-tab-layout.md: 9579a0ba47c56f1d533f066fddd37e7ddf443346
+2026-09-20-sidebar-retained-tab-layout.zh.md: 365ad5682c8610cab5dc855984e58b4303bfae49
diff --git a/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.md b/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.md
new file mode 100644
index 0000000000..9579a0ba47
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.md
@@ -0,0 +1,82 @@
+# Agent Note: Stable Sidebar tab mounting and Session retention
+
+Status: implemented
+
+English | [中文](2026-09-20-sidebar-retained-tab-layout.zh.md)
+
+## Problem
+
+Restoring Session-specific tab records and URLs does not preserve a live browsing context. Unmounting a body or changing its DOM ancestors during tab, pane or Session transitions disconnects its page. Electron 44's `WebViewElement.disconnectedCallback` detaches and resets its guest, so preserving a React key or caching an element reference cannot compensate for disconnected ancestors. Content size, clipping and overlap must also follow the actual parent layout.
+
+## Decision
+
+Sidebar owns live-body retention, independently of Browser navigation and Workspace storage. A retained page's DOM ancestors remain connected and unchanged during Session switches, tab selection, pane moves, collapse, floating and docking back. Browser Presentation attaches directly inside its content container and performs no placeholder measurement or overlay positioning.
+
+### Layout ownership
+
+- `DockLayout` renders the Sidebar's one or two horizontal panes with stable tab siblings. The existing recursive `DockSurface` and separate `FloatLayer` remain available for general split-tree rendering; the layout engine and serialized format are unchanged.
+- Every tab has a stable Grid cell, frame, Header container and Body container. Explicit Grid columns determine docking placement; Flex assigns Header and Body height. Floating changes that same frame to `position: fixed` without changing its parent or replacing Body.
+- A floating frame's zero-sized Grid cell establishes a stacking context at the float layer. CSS `order` expresses float depth within that layer; DOM order stays sorted by tab identity. Raising many floats cannot increment their layer past menus. Selection and strip order never reorder the content-node list.
+- Common ancestors have no transform, clipping or enclosing stacking context. Docked cells own collapse transforms and visibility; each frame clips its content. Fullscreen changes the same root's width and docked layer. Existing window-drag region pulses remain, but no RAF copies content positions.
+- Split and float gestures retain their existing measurements and operation state. These update user-selected split fractions and float rectangles, not a second Browser rectangle. Browser resize and content sizing use normal CSS layout.
+
+### Session and tab lifetime
+
+`SidebarRightTabDefinition.keepMounted` enables lazy retention for a type. Desktop Browser enables it; other types keep visibility-based body mounting. A retained body is first created on display, then survives hiding until its occurrence or provider lifetime ends. The policy is not persisted and does not select a storage partition.
+
+`SidebarSessionView` acquires and releases one `SessionReference` using the independent `sidebarView` source, and owns its committed-mount count and retained-Body holds. `SidebarSessionViews` manages selection, retention policy and view indexes; it delegates lifetime operations to the view rather than mutating its counts or releasing its reference. `RightbarRoot` receives `SidebarSessionViewSnapshot` values and the existing injected callbacks, not resource-owner objects. It renders each through its own explicit `SessionProvider`, with a stable Session key; the renderer's general Session-remount semantics remain unchanged.
+
+Tabs contribute Body-retention holds rather than independent Session references. The View's stable `retainTab` callback reaches its seat through owner props, so replacing Session injection bindings does not release and reacquire those holds. Those holds follow the existing occurrence signal, including a new signal after close-and-undo; the view does not create a second tab lifetime. A retired view stays in the collection's reference index until its own disposal removes it, so plugin shutdown can also reach views whose React mounts have not finished.
+
+Only the selected Session reports frame occupancy or binds public Sidebar navigation. Background tab actions still address their own adopted store. `tab.visible` includes Session and global-panel visibility; floating does not make a background Session visible. A Session change or global panel hides its whole content tree, while Sidebar collapse hides only docked cells and leaves foreground floats visible. Hidden content is inaccessible to pointer and keyboard input, and hidden body focus is blurred.
+
+A background Session with no initialized retained body leaves the view list. Its reference releases after its committed React root unmounts, avoiding scope disposal underneath a mounted subtree. Plugin disposal releases all references, including retired views awaiting unmount. The Sidebar plugin depends on `sessions` and `uiSession`, so Cordis unloads it when either dependency ends; `ui-session` owns binding invalidation. Views do not register disposal callbacks on the shared Session Context. Catalog absence alone is not treated as deletion. Unvisited Browser tabs and unrelated Sessions are not eagerly opened.
+
+### Provider responsibilities
+
+`BrowserFrame` remains navigation and observable page state. Presentation creates and attaches the carrier DOM, without pane, clipping or stacking knowledge. Electron's provider receives physical attach/detach callbacks: hiding retained content emits neither, while an actual unmount cancels pending attachment and releases the guest. A subsequent physical mount recreates it from its known address. Disposal waits for pending creation and guest releases; an acquisition completing after cancellation is released rather than attached.
+
+The [Desktop Browser decision](../feature/2026-09-20-desktop-browser-webview.md) retains guest security, shared IPC declarations and Workspace partition ownership. Separate tabs and Sessions never share one page instance merely because they share a storage partition. Web remains disabled by default and retains its iframe carrier when explicitly enabled.
+
+### Retention versus recovery
+
+| Operation | Content handling |
+|---|---|
+| Switch tabs | Hide the old retained cell; display the target's existing body. |
+| Split, reorder or move to another pane | Change logical placement and Grid assignment, without moving Body. |
+| Float, dock back or raise | Change the same frame's CSS mode or cell paint order. |
+| Collapse Sidebar | Hide docked cells; foreground floats remain visible. |
+| Session A → B → A | Hide and reshow A's original tree instead of loading its saved URL. |
+| Close, provider unload or actual generation termination | Release the body and guest; undo creates a new occurrence. |
+| Application restart or window reload | Show the saved title and URL; load only after an explicit restore or address submission. |
+| Guest crash | Retry through the provider; page memory and native history are not durable. |
+
+[Layout and provider recovery](2026-09-14-sidebar-layout-provider-recovery.md) remains independent: persisted tab identity, placement and address support cold starts, not DOM serialization. A hidden page may continue scripts, media and networking.
+
+## Alternatives considered
+
+**Hide panes only.** Collapse works, but moving between panes or into another floating portal still changes content ancestors.
+
+**Retain bodies only in the foreground Session.** Session-slot remounting disconnects the page and loses its live state on Session switches.
+
+**Give each tab its own Session reference.** A view's tabs share one `SessionProvider`, whose reference must exist before their bodies render. Per-view ownership covers that parent and its children without an additional reference lifecycle for each tab.
+
+**Cache and reparent DOM.** Ordinary reparenting invokes Electron disconnection. Atomic-move dependencies, private attachment APIs and lifecycle monkey-patches are not used.
+
+**Position Browser content in a separate overlay.** Measurement or CSS anchors can align an overlay, but its content remains outside the parent Grid/Flex layout that must own its sizing and clipping.
+
+**Use native popovers.** Top-layer elements cannot be covered by ordinary Portal content through `z-index`. Migrating menus and dialogs into another stacking system expands the work beyond Sidebar; the implementation preserves the existing Portal and layer model.
+
+**Raise floats by increasing their root z-index.** An unbounded float count can cross menu and modal layers. Equal-layer Grid cells with CSS paint order retain both stacking and DOM identity.
+
+**Save the URL and rebuild when hidden.** This cannot preserve forms, script state, scroll position or native history. It is recovery after loss, not live retention.
+
+## Consequences
+
+Layout correctness belongs to Sidebar/DockKit rather than Browser. The cost is stable content containers and explicit Session-reference ownership: background retention holds Session scopes and subscriptions as well as page memory. There is no implicit LRU or idle timeout; future reclamation requires an explicit suspension/recovery policy. Other tab types do not automatically acquire these costs.
+
+Sidebar/DockKit own chrome, float stacking, focus and platform styles as well as retained content placement. The [docking infrastructure](../feature/2026-09-04-right-sidebar-docking-infrastructure.md) owns the layout engine, persistence and tab-type navigation; the [Desktop Browser decision](../feature/2026-09-20-desktop-browser-webview.md) owns guest navigation, storage and security.
+
+## Verification
+
+Focused tests cover retained bodies across Session-source registration and removal, persisted-layout validation, and existing Sidebar presentation. Host and Client TypeScript compilation passes. The user manually accepted a rebuilt Electron cold start; no GIF was recorded. Dedicated real-Electron evidence for guest identity, form and history retention, multi-float paint order, resizing, clipping, drop hints, focus and platform window controls remains separate from these unit tests.
diff --git a/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.zh.md b/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.zh.md
new file mode 100644
index 0000000000..365ad5682c
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-20-sidebar-retained-tab-layout.zh.md
@@ -0,0 +1,82 @@
+# Agent Note: Sidebar 的稳定 Tab 挂载与会话保活
+
+Status: implemented
+
+[English](2026-09-20-sidebar-retained-tab-layout.md) | 中文
+
+## Problem
+
+恢复各会话的 Tab 记录和 URL, 并不能保留活的浏览上下文. 在 Tab、Pane 或会话切换期间卸载 Body 或改变其 DOM 祖先, 都会断开页面. Electron 44 的 `WebViewElement.disconnectedCallback` 会 detach 并重置 guest, 因此保持 React key 或缓存元素引用不能抵消祖先断开. 内容尺寸、裁剪与重叠也必须遵循真实父节点布局.
+
+## Decision
+
+Sidebar 负责活 Body 的保留，不依赖 Browser 导航和 Workspace 存储。保活页面的 DOM 祖先在切会话、选 Tab、跨 Pane 移动、收起、浮动和回停靠时保持连接与身份不变。Browser Presentation 直接挂载到内容容器内，不做占位元素测量或浮层定位。
+
+### 布局所有权
+
+- `DockLayout` 用稳定的 Tab 兄弟节点渲染 Sidebar 的一个或两个水平 Pane。现有递归 `DockSurface` 和独立 `FloatLayer` 仍可用于通用分割树渲染；布局引擎和序列化格式不变。
+- 每个 Tab 都有稳定的 Grid cell、frame、Header 容器和 Body 容器。显式 Grid 列决定停靠归属，Flex 分配 Header 与 Body 的高度。浮动只把同一个 frame 改为 `position: fixed`，不改父节点或替换 Body。
+- 浮动 frame 的零尺寸 Grid cell 在浮窗层建立层叠上下文。CSS `order` 表达该层内的浮窗深度，DOM 顺序始终按 Tab 身份排序。大量浮窗置顶不会把层级递增到菜单之上；选中项和 Tab 条排序均不重排内容节点列表。
+- 共同祖先不设置 transform、裁剪或包住全部内容的层叠上下文。停靠 cell 负责收起 transform 和显隐，各 frame 裁剪自身内容。Fullscreen 修改同一个根的宽度和停靠层级。窗口拖动区域的既有脉冲仍保留，但没有 RAF 复制内容位置。
+- 分栏与浮窗手势沿用原有测量和操作状态，更新用户选择的分栏比例与浮窗矩形，而非维护第二份 Browser 矩形。窗口缩放和内容尺寸变化由普通 CSS 布局处理。
+
+### 会话与 Tab 生命周期
+
+`SidebarRightTabDefinition.keepMounted` 为类型启用懒保活。Desktop Browser 启用它，其他类型继续按可见性挂载 Body。保活 Body 在首次显示时创建，随后隐藏不卸载，直到 occurrence 或提供方生命周期结束。该策略不持久化，也不选择存储分区。
+
+`SidebarSessionView` 使用独立的 `sidebarView` 来源申请、释放一个 `SessionReference`，并管理自己的已提交挂载计数和 Body 保活持有。`SidebarSessionViews` 管理选中、保留策略和视图索引，将生命周期操作委托给视图，而不修改其计数或释放其引用。`RightbarRoot` 接收 `SidebarSessionViewSnapshot` 和已有注入回调，不接收资源所有者对象；它为各视图分别渲染显式 `SessionProvider`，保持会话 key 稳定，渲染器通用的会话重挂载语义不变。
+
+Tab 提供 Body 保活持有，而不独立申请会话引用。View 的稳定 `retainTab` 回调通过 owner props 传给席位，因此替换 Session injection binding 不会释放再重新获取这些持有。这些持有跟随已有 occurrence signal，包括关闭后撤销恢复得到的新 signal；视图不创建第二套 Tab 生命周期。退出视图列表的视图仍留在集合的引用索引中，直到自行释放时移除索引，因此插件关闭时也能清理尚未结束 React 挂载的视图。
+
+只有选中的会话向 frame 报告占位、绑定公共 Sidebar 导航。后台 Tab actions 仍指向自己的已接管存储。`tab.visible` 包含会话和全局面板的可见性，浮动不会让后台会话变成可见。切会话或打开全局面板隐藏整个内容树，收起 Sidebar 则只隐藏停靠 cell，前台浮窗仍可见。隐藏内容不可通过指针或键盘访问，隐藏 Body 内的焦点会被移除。
+
+后台会话没有已初始化的保活 Body 时，从视图列表移除；等已提交的 React 根卸载后再释放引用，避免仍挂载的子树下方先销毁会话 scope。插件释放会清理全部引用，包括等待卸载的已移除视图。Sidebar 插件依赖 `sessions` 和 `uiSession`，任一依赖结束时由 Cordis 卸载它，绑定失效由 `ui-session` 负责。视图不向共享会话 Context 注册销毁回调。仅在目录列表中缺项不视为删除。未访问的 Browser Tab 和无关会话不会提前打开。
+
+### 提供方职责
+
+`BrowserFrame` 仍只负责导航与可观察页面状态。Presentation 创建、挂载载体 DOM，不了解 Pane、裁剪或层叠。Electron 提供方接收物理 attach/detach 回调：隐藏保活内容不触发这些回调，真正卸载则取消未完成的挂载并释放 guest；之后再次物理挂载时从已知地址重建。dispose（资源释放）会等待未完成的创建和 guest 释放，取消后才完成的申请只释放、不挂载。
+
+[Desktop Browser 决策](../feature/2026-09-20-desktop-browser-webview.zh.md)继续负责 guest 安全、共享 IPC 声明和 Workspace 分区所有权。不同 Tab 和会话不能因为共享存储分区就共享一个页面实例。Web 默认仍关闭，显式启用时继续使用 iframe 载体。
+
+### 保活与恢复
+
+| 操作 | 内容处理 |
+|---|---|
+| 切换 Tab | 隐藏旧的保活 cell，显示目标已有 Body。 |
+| 分栏、排序或移到另一个 Pane | 改逻辑归属和 Grid 分配，不搬移 Body。 |
+| 浮动、回停靠或置顶 | 改同一个 frame 的 CSS 模式或 cell 绘制顺序。 |
+| 收起 Sidebar | 隐藏停靠 cell，前台浮窗保持可见。 |
+| 会话 A → B → A | 隐藏并重新显示 A 的原内容树，而非加载已保存 URL。 |
+| 关闭、提供方卸载或真实 generation 结束 | 释放 Body 和 guest；撤销关闭创建新 occurrence。 |
+| 应用重启或窗口刷新 | 展示保存的标题和 URL，显式恢复或提交地址后才加载。 |
+| guest 崩溃 | 通过提供方重试；页面内存和原生 history 不持久化。 |
+
+[布局与提供方恢复](2026-09-14-sidebar-layout-provider-recovery.zh.md)仍然独立：持久化的 Tab 身份、位置和地址支持冷启动，而不是序列化 DOM。隐藏页面可能继续执行脚本、播放媒体或联网。
+
+## Alternatives considered
+
+**只隐藏 Pane。** 可以覆盖收起，但跨 Pane 移动或进入独立浮动 Portal 仍会改变内容祖先。
+
+**只保留前台会话的 Body.** 会话 slot 重挂载会断开页面, 导致切会话时丢失页面运行状态.
+
+**每个 Tab 独立持有会话引用。** 同一视图的 Tab 共用一个 `SessionProvider`，它的引用必须先于这些 Body 渲染而存在。按视图持有即可覆盖父级及其子节点，无须再为每个 Tab 管理一份引用生命周期。
+
+**缓存并搬移 DOM。** 普通 reparent 会触发 Electron 断开处理；实现不依赖原子搬移、私有挂载 API 或生命周期补丁。
+
+**把 Browser 内容放在独立浮层中.** 测量或 CSS 锚点可以对齐浮层, 但内容仍处于负责其尺寸与裁剪的父级 Grid/Flex 布局之外.
+
+**使用原生 popover。** 普通 Portal 内容无法通过 `z-index` 覆盖 top layer 元素。把菜单、对话框迁移到另一套层叠体系会扩大 Sidebar 之外的改动；实现保留既有 Portal 和层级模型。
+
+**通过递增根 z-index 置顶浮窗。** 不设上限的浮窗数量可能越过菜单和模态层。同层 Grid cell 的 CSS 绘制顺序同时保留层叠与 DOM 身份。
+
+**隐藏时保存 URL 再重建。** 无法保留表单、脚本状态、滚动位置和原生 history。这是丢失实例后的恢复，不是活页面保留。
+
+## Consequences
+
+布局正确性由 Sidebar/DockKit 负责，而不是 Browser。代价是稳定的内容容器与显式会话引用所有权：后台保活不仅持有页面内存，也持有会话 scope 和订阅。没有隐式 LRU 或空闲超时，未来回收需要明确的暂停与恢复策略；其他 Tab 类型不会自动承担这些成本。
+
+Sidebar/DockKit 除了负责保活内容布局, 还负责控件、浮窗层级、焦点和平台样式. [停靠基础设施](../feature/2026-09-04-right-sidebar-docking-infrastructure.zh.md)负责布局引擎、持久化和 Tab 类型导航; [Desktop Browser 决策](../feature/2026-09-20-desktop-browser-webview.zh.md)负责 guest 导航、存储和安全.
+
+## Verification
+
+定向测试覆盖 Session 数据源注册与注销期间的正文保活、存档布局校验和既有 Sidebar 呈现。Host 与 Client TypeScript 编译通过。用户已手动验收重新构建后的 Electron 冷启动；未录制 GIF。guest 身份、表单与 history 保留、多浮窗绘制顺序、缩放、裁剪、放置提示、焦点和平台窗口控件仍需独立于这些单元测试的真实 Electron 证据。
diff --git a/.agents/notes/implemented/feature/2026-08-08-web-background-job-display.i18n.yaml b/.agents/notes/implemented/feature/2026-08-08-web-background-job-display.i18n.yaml
index 8cf2e53343..ed1df3a4fe 100644
--- a/.agents/notes/implemented/feature/2026-08-08-web-background-job-display.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-08-08-web-background-job-display.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-08-web-background-job-display.md
-2026-08-08-web-background-job-display.md: 4b8396c1c0504ddf8494a03c22b9af094c4eed17
-2026-08-08-web-background-job-display.zh.md: 03a43b87c47d0ef4d9c08d32facd91ceb76dda38
+2026-08-08-web-background-job-display.md: 049785e9cd5dea2d92d9fc5a14dfeddac9b64469
+2026-08-08-web-background-job-display.zh.md: 1dd7ee9215fa034a0a7abbe75bd5f6eb6907e9ee
diff --git a/.agents/notes/implemented/feature/2026-08-08-web-background-job-display.md b/.agents/notes/implemented/feature/2026-08-08-web-background-job-display.md
index 4b8396c1c0..049785e9cd 100644
--- a/.agents/notes/implemented/feature/2026-08-08-web-background-job-display.md
+++ b/.agents/notes/implemented/feature/2026-08-08-web-background-job-display.md
@@ -2,6 +2,10 @@
 
 Status: implemented
 
+Superseded: the roster this note put on the session control stream (`jobsBySession`, `onJobsChanged`) now streams from the job controller's `job.list` into `ctx.jobs` — see [the jobs seam consolidation](../architecture/2026-09-03-jobs-seam-consolidation.md). The display decisions below (one roster, sections, durations, no kill control) still hold.
+
+Update: the output phase this note deferred now ships as the per-job observation record on `ctx.jobs` — see [jobs absorb the record](../architecture/2026-09-01-jobs-absorb-activity-record.md).
+
 English | [中文](2026-08-08-web-background-job-display.zh.md)
 
 ## Problem
@@ -64,7 +68,7 @@ The listener is owner-granular rather than task-granular. The only consumer push
 
 `onJobDone` is not a subset of this. It delivers the terminal record with the exact owner `Agent` under first-wins semantics that `dsh-tool-jobs` couples to `reported`; `onJobsChanged` is pure observation with no delivery meaning and marks nothing reported. Listener throws are contained and never awaited, matching `onJobDone`, and each registration is an effect on the calling fiber.
 
-Service disposal deliberately announces nothing. Every `onJobsChanged` registration is an effect on the registry's own fiber, so the listeners are already gone by the time teardown clears the store; an observer learns the registry left through its own disposal, not through a final empty set.
+Service disposal announces each removal: after the registry has cancelled and awaited its jobs, it drops every record and emits one `removed` event per job, so a subscriber on a longer-lived fiber sees the roster empty out instead of keeping a stale set (a subscriber on the registry's own fiber is already gone by then).
 
 ### The Session Controller carrier
 
@@ -87,7 +91,7 @@ Two replacement points keep it honest. Each control-stream generation clears the
 
 ### The header action
 
-[`@deepseek-ai/dsh-client-ui-jobs`](../../../../packages/client/ui-jobs/README.md) registers one entry in `conversation.session.header.actions`, ordered after the subagent catalog. Its own README owns the presentation contract; the decisions worth recording here are that the control does not render at all until the session has a task, that the live badge is omitted at zero so a history-only session keeps a quiet entry point, and that settled rows stay visible because a failed task's `detail` is the only place its failure is legible.
+`@deepseek-ai/dsh-client-ui-jobs` registers one entry in `conversation.session.header.actions`, ordered between the preset label and the subagent catalog (`order: 20` against the catalog's 30). Its own README owns the presentation contract; the decisions worth recording here are that the control does not render at all until the session has a task, that the live badge is omitted at zero so a history-only session keeps a quiet entry point, and that settled rows stay visible because a failed task's `detail` is the only place its failure is legible.
 
 A running one-shot background subagent therefore appears both there and in the subagent catalog. The two answer different questions — the catalog navigates into the child's transcript, this list is the only handle a cancellation can ever attach to — and suppressing `kind: 'subagent'` here would leave the cancellation phase with no entry point for exactly those tasks.
 
@@ -117,7 +121,7 @@ A running one-shot background subagent therefore appears both there and in the s
 
 The [web e2e scenario](../../../../apps/web/tests/background-job-list.e2e.ts) is the end-to-end proof and runs keyless: a real `run_in_background` bash call registers with `ctx.jobs`, the header count and row appear with no user interaction, and killing the task through the registry flips the open list to its producer detail. It asserts the whole delivery path rather than any single layer.
 
-Below it, [`jobs-local`](../../../../packages/jobs/jobs-local/tests/jobs.spec.ts) pins the change feed at all four commit points, its containment of a throwing observer, and its removal on both explicit disposal and fiber teardown; [`control-jobs`](../../../../packages/api/session-controller/tests/control-jobs.host.spec.ts) pins the complete baseline, three change pushes, dropped internal fields, unowned fan-out, no-resume guarantee, registry-absent composition, and the prohibition on consuming model output; and the client suites pin baseline replacement, the last-wins fold, the absent-key representation, removal cleanup, and the component's ordering, duration, and dismissal behavior.
+Below it, [`jobs-local`](../../../../packages/jobs/jobs-local/tests/jobs.spec.ts) pins the change feed at all four commit points, its containment of a throwing observer, and its removal on both explicit disposal and fiber teardown; [`rows`](../../../../packages/api/job-controller/tests/rows.host.spec.ts) pins the roster stream that replaced the control-stream fan-out: the complete visible set on open, a refresh after each lifecycle commit and none per append, owner removal, and a clean abort; and the client suites pin baseline replacement, the last-wins fold, the absent-key representation, removal cleanup, and the component's ordering, duration, and dismissal behavior.
 
 ## Consequences
 
diff --git a/.agents/notes/implemented/feature/2026-08-08-web-background-job-display.zh.md b/.agents/notes/implemented/feature/2026-08-08-web-background-job-display.zh.md
index 03a43b87c4..1dd7ee9215 100644
--- a/.agents/notes/implemented/feature/2026-08-08-web-background-job-display.zh.md
+++ b/.agents/notes/implemented/feature/2026-08-08-web-background-job-display.zh.md
@@ -2,6 +2,10 @@
 
 Status: implemented
 
+Superseded：本文放在会话控制流上的名册（`jobsBySession`、`onJobsChanged`）现在从 job 控制器的 `job.list` 流入 `ctx.jobs`——见 [jobs seam 收敛](../architecture/2026-09-03-jobs-seam-consolidation.zh.md)。下文的展示决策（单一名册、分组、时长、没有 kill 控件）仍然成立。
+
+Update：本文推迟的输出阶段现已作为 `ctx.jobs` 上的逐 job 观测 record 交付——见 [jobs 吸收 record](../architecture/2026-09-01-jobs-absorb-activity-record.zh.md)。
+
 [English](2026-08-08-web-background-job-display.md) | 中文
 
 ## 问题
@@ -64,7 +68,7 @@ abstract onJobsChanged(listener: JobsChangedListener): () => void
 
 `onJobDone` 不是它的子集。后者按 first-wins 语义投递终态记录和确切的 owner `Agent`，`dsh-tool-jobs` 把这套语义与 `reported` 绑在一起；`onJobsChanged` 是纯观察，不含任何投递含义，也不把任何东西标为已上报。监听器抛错被包住且从不 await，与 `onJobDone` 一致，每次注册都是调用方 fiber 上的 effect。
 
-服务销毁刻意什么都不通告。每个 `onJobsChanged` 注册都是注册表自身 fiber 上的 effect，等到 teardown 清空 store 时监听器早已消失；观察者通过自己的销毁而不是一份最终空集来得知注册表离开了。
+服务销毁逐条通告移除：注册表取消并等完自己的 job 之后，丢弃每条记录并对每个 job 发出一个 `removed` 事件，因此注册在更长命 fiber 上的订阅者看到名册逐条清空而不是留着陈旧集合（注册在注册表自身 fiber 上的订阅者此时早已消失）。
 
 ### Session Controller 载体
 
@@ -87,7 +91,7 @@ abstract onJobsChanged(listener: JobsChangedListener): () => void
 
 ### header 入口
 
-[`@deepseek-ai/dsh-client-ui-jobs`](../../../../packages/client/ui-jobs/README.zh.md) 在 `conversation.session.header.actions` 注册一个条目，排在 subagent 目录之后。呈现契约归它自己的 README；值得记在这里的决策是：会话没有任务时控件根本不渲染；活跃角标为零时省略，让只剩历史的会话保留一个安静的入口；终态行保持可见，因为失败任务的 `detail` 是其失败唯一可读之处。
+`@deepseek-ai/dsh-client-ui-jobs` 在 `conversation.session.header.actions` 注册一个条目，排在 preset 标签与 subagent 目录之间（`order: 20`，目录为 30）。呈现契约归它自己的 README；值得记在这里的决策是：会话没有任务时控件根本不渲染；活跃角标为零时省略，让只剩历史的会话保留一个安静的入口；终态行保持可见，因为失败任务的 `detail` 是其失败唯一可读之处。
 
 因此一个运行中的一次性后台 subagent 会同时出现在那里和 subagent 目录里。两者回答不同的问题——目录负责进入子会话的 transcript，而这个列表是中断能力唯一可能附着的句柄——在这里屏蔽 `kind: 'subagent'` 会让中断那一期恰好对这批任务没有入口。
 
@@ -117,7 +121,7 @@ abstract onJobsChanged(listener: JobsChangedListener): () => void
 
 [web e2e 场景](../../../../apps/web/tests/background-job-list.e2e.ts)是端到端的证据，且无需密钥：一次真实的 `run_in_background` bash 调用注册进 `ctx.jobs`，header 的计数与行在没有任何用户操作的情况下出现，通过注册表杀掉该任务后打开着的列表翻到生产者给出的 detail。它断言的是整条投递链路，而不是其中某一层。
 
-在它之下，[`jobs-local`](../../../../packages/jobs/jobs-local/tests/jobs.spec.ts) 钉住变更订阅的全部四个提交点、对抛错观察者的包容，以及显式销毁与 fiber 拆除两条路径上的注销；[`control-jobs`](../../../../packages/api/session-controller/tests/control-jobs.host.spec.ts) 钉住完整 baseline、三次变更推送、被丢弃的内部字段、无主扇出、不 resume 的保证、没有注册表的组合，以及不得消费模型输出；客户端各套件钉住 baseline 替换、last-wins 折叠、缺失键表示、移除清理，以及组件的排序、时长与关闭行为。
+在它之下，[`jobs-local`](../../../../packages/jobs/jobs-local/tests/jobs.spec.ts) 钉住变更订阅的全部四个提交点、对抛错观察者的包容，以及显式销毁与 fiber 拆除两条路径上的注销；[`rows`](../../../../packages/api/job-controller/tests/rows.host.spec.ts) 钉住取代控制流扇出的名册流：打开时的完整可见集、每次生命周期提交后刷新一次且追加不刷新、拥有者移除，以及干净的中止；客户端各套件钉住 baseline 替换、last-wins 折叠、缺失键表示、移除清理，以及组件的排序、时长与关闭行为。
 
 ## 影响
 
diff --git a/.agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.i18n.yaml b/.agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.i18n.yaml
index 086b337437..0c51d4b42e 100644
--- a/.agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.md
-2026-08-11-background-job-completion-wakes-an-idle-owner.md: cb724d95f85900b3c55fdebfdc335e9da6439d29
-2026-08-11-background-job-completion-wakes-an-idle-owner.zh.md: 1107fa2c8fdd9d3e4e45031c54fb87f5aac8ea18
+2026-08-11-background-job-completion-wakes-an-idle-owner.md: b8a10a2150ead02036cb97506a25c3a51202adcf
+2026-08-11-background-job-completion-wakes-an-idle-owner.zh.md: adc0770cd00adeb3b13c95dcc386464493dcd943
diff --git a/.agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.md b/.agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.md
index cb724d95f8..b8a10a2150 100644
--- a/.agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.md
+++ b/.agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.md
@@ -2,6 +2,8 @@
 
 Status: implemented
 
+Update: the `reported` bit and `onJobDone` this note relies on left the registry with the [jobs seam consolidation](../architecture/2026-09-03-jobs-seam-consolidation.md): `dsh-tool-jobs` now keeps the delivery ledger (a wait or an accepted `job_kill` claims the task) and skips teardown settlements by their `settled` cause, so the wake-or-inject decision below stands while the mechanism it names is the tool's ledger, not a registry flag.
+
 English | [中文](2026-08-11-background-job-completion-wakes-an-idle-owner.zh.md)
 
 ## Problem
diff --git a/.agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.zh.md b/.agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.zh.md
index 1107fa2c8f..adc0770cd0 100644
--- a/.agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.zh.md
+++ b/.agents/notes/implemented/feature/2026-08-11-background-job-completion-wakes-an-idle-owner.zh.md
@@ -2,6 +2,8 @@
 
 Status: implemented
 
+Update：本文依赖的 `reported` 位与 `onJobDone` 已随 [jobs seam 收敛](../architecture/2026-09-03-jobs-seam-consolidation.zh.md)离开注册表：`dsh-tool-jobs` 现在持有投递台账（等待或被接受的 `job_kill` 认领任务），并按 `settled` 事件的 cause 跳过 teardown 结算，因此下文唤醒或注入的决策仍然成立，只是它提到的机制是工具的台账而非注册表标志。
+
 [English](2026-08-11-background-job-completion-wakes-an-idle-owner.md) | 中文
 
 ## 问题
diff --git a/.agents/notes/implemented/feature/2026-08-24-activity-observation-seam.i18n.yaml b/.agents/notes/implemented/feature/2026-08-24-activity-observation-seam.i18n.yaml
new file mode 100644
index 0000000000..548e9f5b36
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-08-24-activity-observation-seam.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-24-activity-observation-seam.md
+2026-08-24-activity-observation-seam.md: 21fe08fd21ad95eec7a83f6f29b9b94514358bb9
+2026-08-24-activity-observation-seam.zh.md: ffb6766b3e5d226d324ea2894a6e3f758cf1932a
diff --git a/.agents/notes/implemented/feature/2026-08-24-activity-observation-seam.md b/.agents/notes/implemented/feature/2026-08-24-activity-observation-seam.md
new file mode 100644
index 0000000000..21fe08fd21
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-08-24-activity-observation-seam.md
@@ -0,0 +1,53 @@
+# Agent Note: The activity observation seam (`ctx.activities`) and live output streaming to the Web client
+
+Status: implemented
+
+Superseded: the standalone seam described here was folded into `ctx.jobs` as the per-job observation record — see [jobs absorb the record](../architecture/2026-09-01-jobs-absorb-activity-record.md); the durable-vs-live analysis below still holds.
+
+English | [中文](2026-08-24-activity-observation-seam.zh.md)
+
+## Problem
+
+Every incremental reader in the shell, terminal, and jobs layers is single-consumer and consuming: `ShellProcess.readOutput()`, `TerminalSendOperation.readOutput()`, and `JobRegistry.read()` all destroy the delta they return, because the owning model is the intended reader. The [web background-job display](2026-08-08-web-background-job-display.md) shipped the roster on those terms — its carrier is test-pinned to never call `ctx.jobs.read()`, since a browser read would silently steal bytes the model's `job_output` would never see — and explicitly deferred the output phase to "a separate non-consuming observation API". So a human watching the Web client saw that a background build was running but never a line of its output, and the `workflow/log` / `workflow/phase` events scripts are told to narrate with had no consumer at all.
+
+The substrate below bash already had the right shape: `SubprocessOutputReader.readFrom(fromByte)` is offset-based and explicitly non-consuming, and `bash-local` narrows it to a single cursor pair at the shell seam.
+
+## Decision
+
+A new capability seam, `packages/activity/`, is the non-consuming observation plane. An **activity** is one observable unit of long-running work: an append-only bounded output stream plus live status. The seam is pure observation — it starts nothing, cancels nothing, and is invisible to the model. Model-visible facts stay exactly where they were (tool results, `ctx.jobs` cursors), so the "model-visible ⟺ logged" invariant is untouched and a composition without the seam loses only live observation.
+
+- **`@deepseek-ai/dsh-activity` (Service Definition)** — abstract `ActivityRegistry` on `ctx.activities`: `open(spec) → ActivityHandle { append, updateDetail, end }`, fenced `get`/`list`, non-consuming `read(id, from)` over absolute UTF-8 byte offsets, owner-relative `onActivitiesChanged` (roster) and `onOutput` (advancement signal, id only). `ActivityCorrelation { callId?, jobId? }` links a row to its tool call and job. `pumpActivityOutput` is the shared pull-substrate pump.
+- **`@deepseek-ai/dsh-activity-local` (Service Provider)** — in-memory chunk ring per activity. Offsets stay absolute across eviction (`outputEarliest` marks the oldest retained byte; a read below it is `lossy`, never an error); a single over-cap chunk keeps its UTF-8-safe tail with `gapBefore`. Config `retainBytes` (256 KiB) live, trimmed to `settledRetainBytes` (16 KiB) at settlement. Records outlive producer fibers; owner disposal force-ends and removes; `end` is first-wins and post-end writes log-and-drop so a producer's trailing flush cannot break its own teardown.
+- **`@deepseek-ai/dsh-api-activity-controller`** — the wire, in the workspace-controller shape: `activity.control` streams one roster baseline then whole-bucket replacement frames per owner session (the jobs-frame self-healing semantics), and `activity.observe({ activityId, from? })` streams one `opened` anchor, coalesced `output` frames (`flushMs` window, `maxFrameBytes` soft budget), then the terminal `status` on the same stream before closing — so settlement can never race a still-open output channel. Reconnects resume from the last frame's `next`. The client half installs `ctx.activityFeed` (roster mirror plus reference-counted observation streams with a bounded render tail).
+- **`@deepseek-ai/dsh-client-ui-activity`** — the session-header task list ([unified with the job rows](../../archived/feature/2026-08-25-unified-task-list.md)); expanding a row opens its observation stream into a `TerminalBlock` panel, collapsing closes it, so output only flows while someone is watching. `TerminalBlock` itself gained live rendering: a running block with supplied `output` shows the text under the running state instead of the historical prompt-only frame.
+
+Producers mirror best-effort behind `ctx.get('activities')`, never a declared inject, and every observation failure is logged and swallowed — the seam is strictly optional and can never break the work it observes:
+
+- `ShellProcess` gained optional `observed` — the substrate's non-consuming offset readers re-exposed (bash-local and pwsh-local return `handle.collected`; the e2b subprocess provider satisfies the same contract). `dsh-tool-bash` / `dsh-tool-pwsh` open a correlated activity after `jobs.start()` commits and pump `observed` at `activityPollMs` (default 150 ms).
+- `dsh-tool-workflow` mirrors each recorded top-level run as a push-mode `workflow` activity, giving the previously unconsumed `workflow/phase` / `workflow/log` events their consumer.
+
+### Why not durable session events, the control stream, or the jobs seam
+
+Peer products converge on the same split (Codex marks every exec-output delta "Transient, non-durable" in its rollout policy; Claude Code persists a file path, never deltas; Kimi's envelope has a first-class `volatile: true`; OpenCode's V2 corrected V1's per-chunk durable part updates to "stream fragments are live-only"). In this repository the durable route is also concretely bad: chunk-run packing is hardcoded to the three `assistant/chunk` shapes so a new output event gets zero compression, each event is one uncoalesced WebSocket frame, and reconnect gap-repair re-reads the window — and the job-display note already rejected it ("spill exists precisely so oversized tool output stays out of the log"). The session control stream's whole-snapshot frames are self-healing for rosters but quadratic for streams. Extending the jobs seam would cover only jobs — not workflow narration, not a future foreground stream — and would re-litigate the settled "producers own their buffers" decision; the activity plane instead recovers the substrate's existing offsets.
+
+### Two cursor regimes, kept separate
+
+The model keeps its consuming cursors (`job_output` semantics unchanged, zero prompt or tool changes anywhere in this work); observers get absolute offsets any number of readers can hold. This mirrors the strongest peer pattern (Codex: destructive drain for the model, seq-cursor reads for infrastructure) and is what makes the wire path provably non-stealing.
+
+## Alternatives considered
+
+**Durable `activity/output` session events with a conversation node.** Replay for free, but the log-growth math above, plus retention pressure on every follower, killed it; the transcript's durable story remains the producers' tool results.
+
+**Extending `SessionControlFrame` with output.** One fewer stream, but whole-snapshot semantics resend the accumulated buffer per chunk — O(n²) on exactly the data that grows.
+
+**A signal frame plus RPC pull.** The subagent-catalog shape; rejected for the split-authority apparatus the job-display note documents, and it fails worst at settlement (running row, dead stream).
+
+**Observation inside the jobs seam.** One integration point, but only for jobs; foreground runs, terminals, and workflow narration would each need another mechanism, and the registry would grow a second buffer beside the producers' own.
+
+## Testing
+
+Unit suites pin the registry (offsets, eviction, UTF-8-safe tail trims, lossy reads, first-wins settlement, owner cleanup, scoped delivery, listener containment, HMR disposal, Loader composition with row config), the pump (cadence, per-source cursors, lossy `gapBefore`, settlement drain, timer hygiene), the controller (baseline/bucket frames, anchor/output/status ordering, resume, frame splitting, fenced owned reads, abort), the client model and reference-counted streams, and both producer taps (real subprocess output for bash including the never-steals-the-model's-cursor assertion; scripted readers for pwsh; event-driven mirror for workflow, including the throwing-registry containment the optionality promise requires). The keyless web e2e drives a real `run_in_background` bash through the full composition and pins ARIA goldens for the streaming panel while the command still runs and for the settled panel after a registry kill.
+
+## Consequences
+
+The Web client now shows live output for background bash/pwsh and workflow narration with zero model-facing change, and any plugin can join with three calls (`open`/`append`/`end`) against an optional service. Bought at the cost of one more seam family and a per-producer tap; the initial two-header-list duplication was folded into [one task list](../../archived/feature/2026-08-25-unified-task-list.md). Deferred, recorded on the package READMEs: foreground streaming (needs a shell-seam run/observe variant), terminal `pty-send` observation (needs a non-consuming face on terminal buffers), a human kill control (blocked on the jobs `reported` contract), SDK/ACP consumers, and durable replay after restart.
diff --git a/.agents/notes/implemented/feature/2026-08-24-activity-observation-seam.zh.md b/.agents/notes/implemented/feature/2026-08-24-activity-observation-seam.zh.md
new file mode 100644
index 0000000000..ffb6766b3e
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-08-24-activity-observation-seam.zh.md
@@ -0,0 +1,53 @@
+# Agent Note：activity 观察 seam（`ctx.activities`）与 Web 客户端实时输出流
+
+状态：implemented
+
+Superseded：本文描述的独立 seam 已折入 `ctx.jobs`，成为逐 job 的观测 record——见 [jobs 吸收 record](../architecture/2026-09-01-jobs-absorb-activity-record.zh.md)；下文关于持久化与实时通道的分析仍然成立。
+
+[English](2026-08-24-activity-observation-seam.md) | 中文
+
+## 问题
+
+shell、terminal 与 jobs 各层的增量读取器全都是单读者且消费型的：`ShellProcess.readOutput()`、`TerminalSendOperation.readOutput()` 与 `JobRegistry.read()` 返回即销毁增量，因为预期读者就是持有模型。[Web 后台任务显示](2026-08-08-web-background-job-display.zh.md)在这一前提下交付了 roster——其载体被测试钉死绝不调用 `ctx.jobs.read()`，否则浏览器读取会无声偷走模型 `job_output` 永远看不到的字节——并把输出阶段明确推迟给"一个独立的非消费观察 API"。于是人在 Web 客户端只能看到后台构建"在跑"，看不到一行输出；脚本被告知用来叙述进度的 `workflow/log` / `workflow/phase` 事件更是全无消费者。
+
+bash 之下的底座其实早有正确形态：`SubprocessOutputReader.readFrom(fromByte)` 是按 offset、明确非消费的，`bash-local` 在 shell seam 把它窄化成了单游标对。
+
+## 决策
+
+新建能力 seam `packages/activity/`，作为非消费观察面。**activity** 是一个可观察的长时工作单元：一条 append-only 的有界输出流加实时状态。该 seam 是纯观察——不启动、不取消任何工作，对模型不可见。模型可见事实原地不动（工具结果、`ctx.jobs` 游标），"模型可见 ⟺ 已记录"不变量不受影响；不装该 seam 的组合只失去实时观察。
+
+- **`@deepseek-ai/dsh-activity`（Service Definition）**——`ctx.activities` 上的抽象 `ActivityRegistry`：`open(spec) → ActivityHandle { append, updateDetail, end }`、有栅栏的 `get`/`list`、按绝对 UTF-8 字节 offset 的非消费 `read(id, from)`、owner 相对投递的 `onActivitiesChanged`（roster）与 `onOutput`（推进信号，只带 id）。`ActivityCorrelation { callId?, jobId? }` 把行关联到工具调用与 job。`pumpActivityOutput` 是 pull 型底座的共享泵。
+- **`@deepseek-ai/dsh-activity-local`（Service Provider）**——每个 activity 一个内存 chunk 环。offset 跨淘汰稳定（`outputEarliest` 指明最老保留字节；低于它的读取是 `lossy` 而非错误）；单个超上限 chunk 保留 UTF-8 安全尾部并带 `gapBefore`。配置 `retainBytes`（256 KiB）存活，结算时裁到 `settledRetainBytes`（16 KiB）。记录存续期长于生产者 fiber；owner 销毁强制终结并移除；`end` first-wins，end 后写入记日志后丢弃，生产者的收尾 flush 砸不掉自己的 teardown。
+- **`@deepseek-ai/dsh-api-activity-controller`**——wire 层，取 workspace-controller 的形态：`activity.control` 流出一份 roster baseline 加按 owner 会话的整桶替换帧（jobs 帧的自愈语义）；`activity.observe({ activityId, from? })` 流出一帧 `opened` 锚点、合并的 `output` 帧（`flushMs` 窗口、`maxFrameBytes` 软预算）、再在同一条流上发终态 `status` 后关闭——结算永远不会与仍开着的输出通道竞态。重连以上一帧的 `next` 续传。客户端半区安装 `ctx.activityFeed`（roster 镜像 + 按引用计数的观察流与有界渲染尾巴）。
+- **`@deepseek-ai/dsh-client-ui-activity`**——会话头部任务列表（[与 job 行合并](../../archived/feature/2026-08-25-unified-task-list.md)）；展开某行即把其观察流打开进 `TerminalBlock` 面板，收起即关——只有有人在看时输出才流动。`TerminalBlock` 本身获得实时渲染能力：running 且提供了 `output` 的块在 running 状态下显示文本，而非历史上的仅提示行画面。
+
+生产者一律经 `ctx.get('activities')` 尽力镜像，绝不声明 inject，一切观察失败只记日志并吞掉——该 seam 严格可选，永远不能破坏它所观察的工作：
+
+- `ShellProcess` 新增可选 `observed`——底座的非消费 offset 读取器复出（bash-local 与 pwsh-local 返回 `handle.collected`；e2b subprocess provider 满足同一契约）。`dsh-tool-bash` / `dsh-tool-pwsh` 在 `jobs.start()` 提交后打开带关联的 activity，并以 `activityPollMs`（默认 150 ms）泵取 `observed`。
+- `dsh-tool-workflow` 把每个被记录的顶层运行镜像为 push 形态的 `workflow` activity，让此前无人消费的 `workflow/phase` / `workflow/log` 事件有了消费者。
+
+### 为何不用持久会话事件、control 流或 jobs seam
+
+同行产品收敛于同一切分（Codex 在 rollout policy 里把所有 exec 输出 delta 标为 "Transient, non-durable"；Claude Code 持久化文件路径而非 delta；Kimi 的信封有一等的 `volatile: true`；OpenCode V2 把 V1 逐 chunk 持久化 part 更新纠正为 "stream fragments are live-only"）。在本仓库持久路线还有具体的坏处：chunk-run 打包只认三种 `assistant/chunk` 形态，新输出事件零压缩；每事件一条未合并的 WebSocket 帧；重连缺口修复要重读窗口——且 job 显示 note 已否决过它（"spill 的存在就是为了让超大工具输出不进日志"）。session control 流的整值帧对 roster 自愈、对流则是二次方开销。扩 jobs seam 只覆盖 jobs——workflow 叙述与未来的前台流都覆盖不到——还要重翻已定案的"生产者拥有自己的缓冲"；activity 面转而复用底座既有的 offset。
+
+### 两套游标制，各归其位
+
+模型保留消费游标（`job_output` 语义不变，本次工作零 prompt/工具改动）；观察者拿任意多读者可共持的绝对 offset。这正是最强的同行范式（Codex：模型用破坏性 drain，基础设施用 seq 游标读取），也是 wire 路径可证明"不偷字节"的原因。
+
+## 曾考虑的替代方案
+
+**持久 `activity/output` 会话事件 + conversation node。** 回放免费，但上述日志膨胀账加上对每个 follower 的保留压力否掉了它；transcript 侧的持久故事仍是生产者的工具结果。
+
+**给 `SessionControlFrame` 加输出。** 少一条流，但整值语义会按 chunk 重发累计缓冲——恰好在会增长的数据上 O(n²)。
+
+**信号帧 + RPC 拉取。** subagent catalog 的形态；因 job 显示 note 记录的权威割裂机制而否决，且它在结算时刻失效得最难看（行还在跑、流已死）。
+
+**在 jobs seam 内做观察。** 一个集成点，但只对 jobs；前台运行、terminal 与 workflow 叙述各需另一套机制，注册表还得在生产者自己的缓冲旁再养一份。
+
+## 测试
+
+单测钉住注册表（offset、淘汰、UTF-8 安全裁尾、lossy 读取、first-wins 结算、owner 清理、scope 投递、监听容错、HMR 可逆、带行配置的 Loader 组合）、泵（节奏、每源游标、lossy `gapBefore`、结算排干、定时器卫生）、controller（baseline/桶帧、锚点/输出/状态排序、续传、帧切分、有栅栏的有主读取、abort）、客户端模型与引用计数流，以及两类生产者接入（bash 用真实子进程输出，含"绝不偷模型游标"断言；pwsh 用脚本化读取器；workflow 用事件驱动镜像，含可选性承诺要求的 throwing-registry 容错）。无钥 web e2e 经完整组合驱动真实 `run_in_background` bash，钉住命令仍在运行时流式面板与注册表 kill 后已结算面板的 ARIA golden。
+
+## 后果
+
+Web 客户端在零模型面改动下获得后台 bash/pwsh 实时输出与 workflow 叙述；任何插件对着一个可选服务用三个调用（`open`/`append`/`end`）即可接入。代价是多一个 seam 家族与每生产者一个接入点；最初的双头部列表重复已折并为[单一任务列表](../../archived/feature/2026-08-25-unified-task-list.md)。暂缓项记录在各包 README：前台流式（需 shell seam 的 run/observe 变体）、terminal `pty-send` 观察（需给 terminal 缓冲加非消费面）、人工 kill 控件（被 jobs `reported` 契约阻塞）、SDK/ACP 消费端、重启后的持久回放。
diff --git a/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.i18n.yaml b/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.i18n.yaml
index 5e501e5f46..137c5eba63 100644
--- a/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.md
-2026-09-04-right-sidebar-docking-infrastructure.md: 3ebfe4b3a95ab5820682098be2a4c43f172d1a02
-2026-09-04-right-sidebar-docking-infrastructure.zh.md: dc6516324a368dd86b3e01afb4051a4b20697363
+2026-09-04-right-sidebar-docking-infrastructure.md: c5bfb75730f2037826723bc7fd0aa2bb01005d1e
+2026-09-04-right-sidebar-docking-infrastructure.zh.md: 4959032b53f84654205a1973aee781acb356f999
diff --git a/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.md b/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.md
index 3ebfe4b3a9..c5bfb75730 100644
--- a/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.md
+++ b/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.md
@@ -16,6 +16,8 @@ The right column is a per-session docking surface — split panes, tabs, floatin
 
 ### Package topology
 
+The [stable Sidebar mounting decision](../architecture/2026-09-20-sidebar-retained-tab-layout.md) owns one retained tab-content tree for docking, floating and Session switches. The engine, layout state and gesture ownership in this note remain applicable.
+
 | Package | Kind | Owns |
 |---|---|---|
 | `packages/client/ui-dockkit` | static-linked library, zero DSH dependencies | the layout engine and the React components that render and drive it; consumers compile its sources, and it keeps exactly one stylesheet because a consumer de-duplicates injected sheets by file name |
@@ -33,7 +35,7 @@ Components render a snapshot and report settled intents, one per gesture: a drag
 
 [Responsive Sidebar and tab information](../architecture/2026-09-07-sidebar-responsive-tab-info.md) supersedes this note's no-concession layout, overlay presentation and product pane limit. `ui-layout` still owns three-column geometry and pixel width preferences; the Sidebar occupant reports presentation through `ctx.layout.openRightbar(track, fullscreen)` and `closeRightbar()`, without the frame injecting the Sidebar package. Exact width rules belong to [ui-layout](../../../../packages/client/ui-layout/README.md).
 
-The right Sidebar uses one mounted content tree in normal and fullscreen modes; hiding preserves tab state, and fullscreen covers the viewport while retaining underlying column reservation. Floats still use viewport coordinates through a portal and remain open when the Sidebar closes. The product limits docking to two horizontal panes and a 20–80% divider; the generic engine keeps its own defaults.
+The right Sidebar uses one mounted content tree in normal and fullscreen modes; hiding preserves retained tab state, and fullscreen covers the viewport while retaining underlying column reservation. `DockLayout` renders stable Grid cells with fixed-position floating frames in the same tree; foreground floats remain open when the Sidebar closes. The product limits docking to two horizontal panes and a 20–80% divider; the generic engine keeps its own defaults.
 
 ### State
 
@@ -86,7 +88,7 @@ The surface renders tabs whose bodies it does not know: each tab carries a `kind
 - The Detail panel and its duplicate card presentation are gone (a net removal of roughly 1,400 lines); cards are read in place, and `inspect` opens the trajectory view.
 - The frame has no centre floor: a viewport narrower than the two edge columns squeezes the conversation toward zero instead of closing a column.
 - The kit is compiled by its consumers, so a kit change requires a shell rebuild and a page reload; there is no HMR for it.
-- The panel, the float host, and the portalled tab menu use hard-coded z-index values; the client still has no z-index token layer.
+- Docked cells, floating cells and the portalled tab menu use fixed stacking levels; floating cells use CSS paint order within their level. The client still has no global z-index token layer.
 
 ## Testing
 
diff --git a/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.zh.md b/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.zh.md
index dc6516324a..4959032b53 100644
--- a/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.zh.md
+++ b/.agents/notes/implemented/feature/2026-09-04-right-sidebar-docking-infrastructure.zh.md
@@ -16,6 +16,8 @@ Agent 产出的文件是最尖锐的案例。产出文件 chip 或 `read` 行的
 
 ### 包拓扑
 
+[Sidebar 稳定挂载决策](../architecture/2026-09-20-sidebar-retained-tab-layout.zh.md)负责停靠、浮动与会话切换共用的一棵保活 Tab 内容树。本文的引擎、布局状态与手势所有权仍然适用。
+
 | 包 | 形态 | 所有物 |
 |---|---|---|
 | `packages/client/ui-dockkit` | 静态链接库，零 DSH 依赖 | 布局引擎与渲染/驱动它的 React 组件；消费方编译其源码，且它只保留一张样式表，因为消费方按文件名去重注入的样式表 |
@@ -33,7 +35,7 @@ Agent 产出的文件是最尖锐的案例。产出文件 chip 或 `read` 行的
 
 [响应式 Sidebar 与标签信息](../architecture/2026-09-07-sidebar-responsive-tab-info.zh.md)取代本记录中的无让步布局、覆盖模式与产品窗格上限。`ui-layout` 仍拥有三列几何与像素宽度偏好，Sidebar 占位项通过 `ctx.layout.openRightbar(track, fullscreen)` 和 `closeRightbar()` 报告呈现方式，框架不注入 Sidebar 包。具体宽度规则见 [ui-layout](../../../../packages/client/ui-layout/README.zh.md)。
 
-右栏在普通与全屏模式下使用同一棵已挂载内容树；隐藏保留标签状态，全屏覆盖视口并保留底层列占位。浮窗仍经 portal 使用视口坐标，不随右栏关闭。产品限制为两个水平窗格与 20–80% 分割比例，通用引擎保留自己的默认值。
+右栏在普通与全屏模式下使用同一棵已挂载内容树；隐藏保留已保活的标签状态，全屏覆盖视口并保留底层列占位。`DockLayout` 在同一棵树中渲染稳定 Grid cell 与 fixed 定位的浮动 frame，前台浮窗不随右栏关闭。产品限制为两个水平窗格与 20–80% 分割比例，通用引擎保留自己的默认值。
 
 ### 状态
 
@@ -86,7 +88,7 @@ Agent 产出的文件是最尖锐的案例。产出文件 chip 或 `read` 行的
 - Detail 面板及其重复的卡片展示消失（净删约 1,400 行）；卡片就地阅读，`inspect` 打开 trajectory 视图。
 - 框架没有中列下限：视口窄于两侧列之和时会话区被挤向零，而不是关掉某一列。
 - 库由消费方编译，改库须重建壳并刷新页面；它没有 HMR。
-- 面板、浮层宿主与 portal 出去的 tab 菜单使用硬编码 z-index；客户端仍没有 z-index token 层。
+- 停靠 cell、浮动 cell 和 portal 菜单使用固定层级，浮动 cell 在所属层内通过 CSS 绘制顺序排序；客户端仍没有全局 z-index token 层。
 
 ## Testing
 
diff --git a/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.i18n.yaml b/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.i18n.yaml
index b261e98e5b..fac9746b09 100644
--- a/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-16-sidebar-browser.md
-2026-09-16-sidebar-browser.md: 3fa4e1dbb70dee97dbe6052d925271d093f2877c
-2026-09-16-sidebar-browser.zh.md: 69d78dbf2b959d660c9397c7bf7634547a109a9e
+2026-09-16-sidebar-browser.md: eff143cc042da7c6455152f684ec83dfa654a1ec
+2026-09-16-sidebar-browser.zh.md: a037c2fb54be745a3a85f43561c0bd587873c008
diff --git a/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.md b/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.md
index 3fa4e1dbb7..eff143cc04 100644
--- a/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.md
+++ b/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.md
@@ -18,17 +18,21 @@ A parent page cannot inspect or drive a cross-origin iframe's internal history.
 
 The address parser accepts `http:` and `https:`, including loopback targets; a host name without a scheme becomes HTTPS. It rejects embedded credentials, the application's own origin, malformed addresses, `file:` URLs, and every other scheme. Document Preview remains the local-file surface.
 
-The current carrier is an iframe in both Web and Desktop. Its default Web policy is `sandbox="allow-scripts allow-forms allow-same-origin allow-popups allow-popups-to-escape-sandbox"`; the frame has no direct download or top-navigation flag. Popups escape the sandbox, and a Web popup retains its opener and can use that chain to navigate the top-level application. Same-origin lets the visited origin use its own cookies and Web storage; it does not make a cross-origin target same-origin with DSH. The iframe sends no referrer and adds no package-owned Permissions Policy, so browser defaults and user grants apply. A rightmost toolbar toggle removes the sandbox attribute for that tab occurrence; the mode is not persisted and renders a warning while active. An unsandboxed page can navigate the top-level application under browser activation rules and use downloads, modal dialogs, and input locks. The package performs no Host-side URL probe or proxy.
+The Web carrier is an iframe; Desktop uses the [retained webview carrier](2026-09-20-desktop-browser-webview.md). Its default Web policy is `sandbox="allow-scripts allow-forms allow-same-origin allow-popups allow-popups-to-escape-sandbox"`; the frame has no direct download or top-navigation flag. Popups escape the sandbox, and a Web popup retains its opener and can use that chain to navigate the top-level application. Same-origin lets the visited origin use its own cookies and Web storage; it does not make a cross-origin target same-origin with DSH. The iframe sends no referrer and adds no package-owned Permissions Policy, so browser defaults and user grants apply. A rightmost toolbar toggle removes the sandbox attribute for that tab occurrence; the mode is not persisted and renders a warning while active. An unsandboxed page can navigate the top-level application under browser activation rules and use downloads, modal dialogs, and input locks. The package performs no Host-side URL probe or proxy.
 
-Each tab receives one `BrowserController` class. Its command interface contains only `loadUrl`, `goBack`, `goForward`, and `reload`; it owns address validation and the `BrowserNavigation` state machine. The `BrowserFrame` interface owns transient sandbox and document state plus carrier operations, and `IframeImpl` implements it for the current iframe carrier. Slot injection exposes keyed frame state through `useBrowserFrame` and supplies plain callbacks, so the React body receives neither the controller nor an observable source; it owns only the editable draft and iframe DOM. A future `ElectronWebViewImpl` can implement the same interface without putting URL or carrier state in the component.
+Each tab receives one `BrowserController` for address validation and carrier-independent commands. `BrowserFrame` exposes navigation, observable address/loading/history/error state, and an optional sandbox control; `BrowserPresentation` owns DOM attachment. `pages.ts` composes these two objects into a `BrowserPage`. `IframeImpl` owns application-known `BrowserNavigation`, while `ElectronWebViewImpl` observes native history. Slot injection exposes keyed controller state through `useBrowserState` and plain callbacks; the React body owns its draft and content container, with no carrier branch, controller instance or observable source.
 
-`BrowserNavigation` keeps the canonical current URL, controlled-load revision, navigation state, and a bounded sequence with its index. A new address drops the forward branch; Back and Forward move the index; Reload recreates the last application-known URL without adding history. A remounted body reloads the latest application-known URL and consults its optional initial URL only before the first controlled target. The Session-scoped store only persists immutable snapshots from that class for title rendering and application reload. An occurrence abort removes its bucket; `TabDomain` uses that same abort for both tab removal and `ui-sidebar-right` unload, so unloading or hot-reloading the Sidebar clears Browser history even when DockKit later restores the tab record.
+For the iframe carrier, `BrowserNavigation` keeps the canonical current URL, controlled-load revision, navigation state, and a bounded sequence with its index. A new address drops the forward branch; Back and Forward move the index; Reload recreates the last application-known URL without adding history. Within a live controller, remounting a body reloads its last requested URL. The Session-scoped store persists immutable checkpoints for tab titles and cold-start recovery; it does not serialize a live page.
+
+A controller created from a saved checkpoint offers its last title and URL with a Restore page button. The provider starts idle: mounting the restored tab neither creates a browsing guest nor requests the saved site. Restore, toolbar Reload or address submission starts navigation; a fresh typed-open URL remains an explicit navigation request and loads directly. Before a page is requested, Back and Forward remain disabled, while Reload restores the saved address through the same controller action as Restore. Changing an idle iframe's sandbox does not restore it. This offer belongs to `BrowserControllerState`, not the live `BrowserFrame` interface or the persisted navigation status.
+
+Occurrence cancellation releases the controller. It removes the saved checkpoint only when the Sidebar's authoritative `openTabs` inventory no longer contains that tab. The inventory publishes layout removal before `TabDomain` aborts its occurrence; plugin unload also aborts occurrences but leaves saved tab membership intact. Cleanup therefore does not interpret plugin unload as a request to erase recovery data.
 
 Browser state is presentation state. It does not enter the Session log, model request, resource model, or DockKit layout operations. The existing [right Sidebar infrastructure](2026-09-04-right-sidebar-docking-infrastructure.md), [tab type contract](../architecture/2026-09-05-sidebar-tab-types-and-navigation.md), [resource model](../architecture/2026-09-05-client-resource-model.md), and [Document Preview operations](../architecture/2026-09-08-document-preview-operations.md) retain their existing responsibilities.
 
 ## Web navigation states
 
-The Web carrier treats only the first iframe `load` for a controlled revision as confirmation of the application-known URL. A later `load` for that revision proves that the document changed but cannot reveal the new cross-origin URL. Events carrying an older revision are ignored.
+The Web carrier treats only the first iframe `load` for a controlled revision as confirmation of the application-known URL. A later `load` for that revision proves that the document changed but cannot reveal the new cross-origin URL. Events carrying an older revision are ignored. These states describe active navigation; an unrequested saved checkpoint remains a separate restore offer.
 
 | State | Entry | Address and controls |
 |---|---|---|
@@ -37,22 +41,16 @@ The Web carrier treats only the first iframe `load` for a controlled revision as
 | `known` | The first iframe `load` arrives for the current revision. | The requested URL remains authoritative even when that first load includes an HTTP redirect. The controls follow the same known-target rules as `loading`. |
 | `unknown` | A second or later iframe `load` arrives for the current revision. | The last controlled URL is muted and marked `URL changed`. Back and Forward are disabled because iframe exposes no cross-origin `canGoBack` or `canGoForward`; external-open is disabled. Reload starts a new revision at the last controlled URL. |
 
-Address editing is available in every state. An invalid draft reports an address failure without changing the current navigation state. Focusing the unknown address hides its marker and reveals Go; Enter and Go both start a controlled load. Changing sandbox mode reloads the last controlled Web target under a new revision. An iframe `error` event marks only the current `BrowserFrame` revision with a transient load-failure notice; it does not change URL history, and the next controlled document clears it. Browsers do not reliably emit this event for DNS, TLS, mixed-content, CSP, or `X-Frame-Options` failures. `pushState`, `replaceState`, and fragment changes that emit no iframe `load` remain unobservable.
+Address editing is available in every state. An invalid draft reports an address failure without changing the current navigation state. Focusing the unknown address hides its marker and reveals Go; Enter and Go both start a controlled load. For an already requested page, changing sandbox mode reloads the last controlled Web target under a new revision. An iframe `error` event marks only the current `BrowserFrame` revision with a transient load-failure notice; it does not change URL history, and the next controlled document clears it. Browsers do not reliably emit this event for DNS, TLS, mixed-content, CSP, or `X-Frame-Options` failures. `pushState`, `replaceState`, and fragment changes that emit no iframe `load` remain unobservable.
 
-## Deferred Electron carrier
+## Electron carrier
 
-Electron `<webview>` support is designed but is not registered or tested. The controller keeps the same four commands, while a separate per-tab view object owns attachment, detachment, state observation, and target identity. This follows Playwright's Android WebView split: `AndroidWebView` is a target and lifecycle handle identified by package, process, and debugging socket, while `page()` returns the regular `Page` that owns Web navigation and DOM commands; device-level input remains on `AndroidDevice`.
-
-The Desktop design enables `webviewTag` only on the application window. Its isolated preload receives an unguessable per-window capability, and every Browser tab appends a fresh UUID to form a distinct non-persistent partition. The main process accepts only an initial `about:blank` guest carrying that capability, removes any preload, and forces sandbox, context isolation, disabled Node integration in all frames, Web security, secure-content checks, disabled nested webviews, and disabled plugins.
-
-The main process allows page-initiated main-frame navigation and redirects only to credential-free HTTP(S). Requests may use HTTP(S), WebSocket, data, and Blob URLs; direct file, custom-protocol, extension, and privileged requests are cancelled. Permission checks and requests, display capture, device grants, downloads, popup windows, and drag-and-drop navigation are denied.
-
-The view object keeps an inactive guest connected in an owned hidden DOM host and moves it back into the visible placeholder without recreation. This retains page and target identity across Sidebar body remounts. Because `<webview>` participates in renderer layout and compositing, ordinary DOM dialogs, menus, tooltips, and drag previews can cover it. `WebContentsView` remains unsuitable because it is a native child surface: CSS cannot cover it, and every overlay or animation would require main-process visibility and bounds synchronization.
-
-Each guest is a distinct WebContents and CDP target. Development may expose Electron's process-wide remote-debugging port and select the guest target explicitly. Production keeps that endpoint disabled; browser-use or computer-use requires an authenticated broker that binds one authorized tab to its WebContents and uses `webContents.debugger` or an equivalently scoped transport without publishing every application target.
+The [Desktop webview decision](2026-09-20-desktop-browser-webview.md) owns native page lifetime, Workspace storage sharing, guest policy, and runtime verification gaps. The iframe behavior in this note remains independently useful; its cross-origin limitations do not describe the Desktop carrier.
 
 ## Alternatives considered
 
+**Automatically reload saved pages when their tabs mount.** This resumes third-party requests and scripts merely by restoring the layout. An explicit restore action preserves the saved address without opening the site.
+
 **Add a Host embeddability probe and persist the sandbox preference.** Rejected because fetching arbitrary targets on the Host adds an SSRF path, the probe can disagree with later redirects, and a persistent global escape makes later tabs inherit an unsafe choice. Browser instead offers an explicit per-tab, non-persistent sandbox toggle with a visible warning.
 
 **Treat parent-owned history as the complete Web model.** Rejected because it silently leaves a stale address and enabled actions after an in-frame navigation. The bounded parent-owned history remains useful while the current controlled URL is known; the explicit `unknown` state removes claims that the iframe API cannot support.
@@ -67,8 +65,10 @@ Each guest is a distinct WebContents and CDP target. Development may expose Elec
 
 Unit tests cover protocol parsing, delegated Markdown links, controller commands and lifecycle, deterministic navigation-state transitions, bounded history, best-effort iframe errors, and plugin disposal. Keyless Web scenarios boot the shipped composition and exercise message-link routing, HTTP(S), Back, Forward, sandbox control, unknown navigation, and protocol refusal.
 
+Manual cold-start restoration and checkpoint retention across plugin unload have no runtime verification yet.
+
 ## Consequences
 
-The Browser adds no Electron privilege and behaves identically in current Web and Desktop builds. Many sites refuse iframe embedding or require downloads or top-level navigation withheld from the frame by the default sandbox. An HTTPS application can block public HTTP pages as mixed content or restrict private-network requests, and disabling the sandbox does not bypass those browser policies. Disabling the sandbox otherwise trades its protections for compatibility: the frame can navigate the top-level application under browser activation rules and use downloads, modal dialogs, and input locks. A Web popup that escapes the sandbox retains its opener and can navigate the top-level application through that chain. Neither path adds Electron or Node APIs. The URL gate cannot prevent an embedded page from choosing its own destination. A later iframe load exposes that navigation occurred but not its cross-origin URL; History API and fragment changes can remain completely invisible. The deferred Electron carrier requires real packaged-app verification before it can become current behavior.
+The iframe carrier exposes no Electron or Node APIs. Many sites refuse iframe embedding or require downloads or top-level navigation withheld from the frame by the default sandbox. An HTTPS application can block public HTTP pages as mixed content or restrict private-network requests, and disabling the sandbox does not bypass those browser policies. Disabling the sandbox otherwise trades its protections for compatibility: the frame can navigate the top-level application under browser activation rules and use downloads, modal dialogs, and input locks. A Web popup that escapes the sandbox retains its opener and can navigate the top-level application through that chain. Neither path adds Electron or Node APIs. The URL gate cannot prevent an embedded page from choosing its own destination. A later iframe load exposes that navigation occurred but not its cross-origin URL; History API and fragment changes can remain completely invisible.
 
-Site-cookie behavior follows the user's browser and is not isolated per Browser tab. Local files are rejected and remain owned by Document Preview. Persisted URLs can contain sensitive query or fragment values, so users must not enter credentials they do not want retained in application-local browser storage.
+Web site-cookie behavior follows the user's browser and is not isolated per Browser tab. Local files are rejected and remain owned by Document Preview. Persisted URLs can contain sensitive query or fragment values, so users must not enter credentials they do not want retained in application-local browser storage.
diff --git a/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.zh.md b/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.zh.md
index 69d78dbf2b..a037c2fb54 100644
--- a/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.zh.md
+++ b/.agents/notes/implemented/feature/2026-09-16-sidebar-browser.zh.md
@@ -18,17 +18,21 @@ Status: implemented
 
 地址解析器接受 `http:` 与 `https:`，包括 loopback 目标；不带 scheme 的主机名补为 HTTPS。它拒绝内嵌凭据、应用自身 origin、畸形地址、`file:` URL，以及所有其他 scheme。本地文件继续由 Document Preview 负责。
 
-当前 Web 与 Desktop 都使用 iframe 载体。它的默认 Web 策略是 `sandbox="allow-scripts allow-forms allow-same-origin allow-popups allow-popups-to-escape-sandbox"`；frame 没有直接的下载或顶层导航 flag。popup 会脱离 sandbox，Web popup 会保留 opener，并可以通过该链导航顶层应用。same-origin 允许被访问的 origin 使用自己的 Cookie 与 Web storage；它不会让跨域目标与 DSH 变成同源。iframe 不发送 referrer，也不添加包自有的 Permissions Policy，因此浏览器默认策略与用户授权生效。最右侧 toolbar 开关会为当前 tab occurrence 移除 sandbox attribute；该模式不持久化，启用期间持续显示警告。未受 sandbox 约束的页面可以按浏览器 activation 规则导航顶层应用，并使用下载、模态对话框和输入锁定。本包不执行 Host 侧 URL probe 或代理。
+Web 使用 iframe 载体；Desktop 使用[保持页面实例的 webview 载体](2026-09-20-desktop-browser-webview.zh.md)。它的默认 Web 策略是 `sandbox="allow-scripts allow-forms allow-same-origin allow-popups allow-popups-to-escape-sandbox"`；frame 没有直接的下载或顶层导航 flag。popup 会脱离 sandbox，Web popup 会保留 opener，并可以通过该链导航顶层应用。same-origin 允许被访问的 origin 使用自己的 Cookie 与 Web storage；它不会让跨域目标与 DSH 变成同源。iframe 不发送 referrer，也不添加包自有的 Permissions Policy，因此浏览器默认策略与用户授权生效。最右侧 toolbar 开关会为当前 tab occurrence 移除 sandbox attribute；该模式不持久化，启用期间持续显示警告。未受 sandbox 约束的页面可以按浏览器 activation 规则导航顶层应用，并使用下载、模态对话框和输入锁定。本包不执行 Host 侧 URL probe 或代理。
 
-每个 tab 获得一个 `BrowserController` class。它的命令接口只有 `loadUrl`、`goBack`、`goForward` 与 `reload`；它负责地址校验和 `BrowserNavigation` 状态机。`BrowserFrame` 接口负责临时 sandbox 与 document 状态以及载体操作，`IframeImpl` 为当前 iframe 载体实现该接口。Slot injection 通过 `useBrowserFrame` 提供按 key 索引的 frame 状态，并提供普通 callback，因此 React body 不接收 controller 或 observable source；它只负责可编辑草稿与 iframe DOM。未来的 `ElectronWebViewImpl` 可以实现相同接口，而不把 URL 或载体状态放进组件。
+每个 tab 获得一个 `BrowserController`，负责地址校验与载体无关的命令。`BrowserFrame` 提供导航、可观察的地址/加载/history/错误状态和可选 sandbox 控制，`BrowserPresentation` 负责 DOM 挂载。`pages.ts` 把两个对象组装成 `BrowserPage`。`IframeImpl` 持有应用已知的 `BrowserNavigation`，`ElectronWebViewImpl` 则观察原生 history。Slot injection 通过 `useBrowserState` 提供按 key 索引的控制器状态和普通回调；React body 只持有草稿与内容容器，没有载体分支、控制器实例或可观察源。
 
-`BrowserNavigation` 保存 canonical 当前 URL、受控加载 revision、导航状态，以及有上限的序列与当前位置。新地址丢弃 forward 分支；后退和前进移动 index；刷新重建应用最后已知的 URL 且不增加 history。body 重挂载时会重新加载应用最后已知的 URL，并且仅在尚无受控目标时使用可选初始 URL。Session-scoped store 只持久化该 class 的 immutable snapshot，供标题渲染与应用刷新恢复。occurrence abort 会删除其 bucket；`TabDomain` 对 tab 删除与 `ui-sidebar-right` 卸载使用同一个 abort，因此卸载或热重载 Sidebar 会清空 Browser history，即使 DockKit 随后恢复 tab record。
+对于 iframe 载体，`BrowserNavigation` 保存 canonical 当前 URL、受控加载 revision、导航状态，以及有上限的序列与当前位置。新地址丢弃 forward 分支；后退和前进移动 index；刷新重建应用最后已知的 URL 且不增加 history。在仍存活的控制器内，body 重挂载会重新加载最后请求的 URL。Session-scoped store 持久化不可变检查点，供 Tab 标题与冷启动恢复使用，不序列化活页面。
+
+从已保存检查点创建的控制器展示上次标题、URL 和“恢复页面”按钮。提供方初始为空闲状态：挂载恢复的 Tab 既不创建浏览 guest，也不请求保存的站点。恢复、工具栏刷新或提交地址才启动导航；新打开 Tab 时显式传入的 URL 仍是主动导航请求，会直接加载。页面尚未请求时，后退和前进仍禁用，刷新则通过与“恢复页面”相同的控制器操作加载保存的地址。切换空闲 iframe 的沙箱也不会恢复页面。恢复提示属于 `BrowserControllerState`，不进入活页面的 `BrowserFrame` 接口或持久化导航状态。
+
+occurrence 取消会释放控制器。只有 Sidebar 的权威 `openTabs` 清单已不再包含该 Tab 时，才删除保存的检查点。清单先发布布局中的 Tab 移除，再由 `TabDomain` abort 对应 occurrence；插件卸载也会 abort occurrence，但仍保留已保存的 Tab 成员信息。因此清理不会把插件卸载当成删除恢复数据的请求。
 
 Browser 状态只属于呈现层，不进入 Session log、模型请求、resource model 或 DockKit layout operation。现有的[右侧 Sidebar 基础设施](2026-09-04-right-sidebar-docking-infrastructure.zh.md)、[tab 类型契约](../architecture/2026-09-05-sidebar-tab-types-and-navigation.zh.md)、[resource model](../architecture/2026-09-05-client-resource-model.zh.md)和[文档预览操作](../architecture/2026-09-08-document-preview-operations.zh.md)继续负责各自现有职责。
 
 ## Web 导航状态
 
-对于一个受控 revision，Web 载体只把 iframe 的第一次 `load` 当作应用已知 URL 的确认。同一 revision 后续发生 `load`，只能证明文档已经变化，无法给出新的跨域 URL。携带旧 revision 的事件会被忽略。
+对于一个受控 revision，Web 载体只把 iframe 的第一次 `load` 当作应用已知 URL 的确认。同一 revision 后续发生 `load`，只能证明文档已经变化，无法给出新的跨域 URL。携带旧 revision 的事件会被忽略。这些状态描述活动导航；尚未请求的已保存检查点仍是独立的恢复提示。
 
 | 状态 | 进入条件 | 地址与控件 |
 |---|---|---|
@@ -37,22 +41,16 @@ Browser 状态只属于呈现层，不进入 Session log、模型请求、resour
 | `known` | 当前 revision 收到 iframe 的第一次 `load`。 | 即使第一次加载包含 HTTP redirect，请求 URL 仍是权威地址。控件规则与 `loading` 的已知目标规则相同。 |
 | `unknown` | 当前 revision 收到 iframe 的第二次或后续 `load`。 | 最后一个受控 URL 变灰，并标记 `URL 已变化`。iframe 不提供跨域 `canGoBack` 或 `canGoForward`，因此后退和前进禁用；外部打开禁用。刷新以最后一个受控 URL 启动新的 revision。 |
 
-每个状态都允许编辑地址。无效草稿只报告地址错误，不改变当前导航状态。聚焦 unknown 地址会隐藏标记并显示前往按钮；回车与前往都会启动受控加载。切换 sandbox 模式会使用新的 revision 重新加载最后一个受控 Web 目标。iframe `error` event 只会为当前 `BrowserFrame` revision 标记临时加载失败 notice；它不改变 URL history，下一个受控 document 会清除它。浏览器不会为 DNS、TLS、mixed-content、CSP 或 `X-Frame-Options` 失败可靠触发该 event。不产生 iframe `load` 的 `pushState`、`replaceState` 与 fragment 变化仍不可观察。
+每个状态都允许编辑地址。无效草稿只报告地址错误，不改变当前导航状态。聚焦 unknown 地址会隐藏标记并显示前往按钮；回车与前往都会启动受控加载。对于已经请求的页面，切换 sandbox 模式会使用新的 revision 重新加载最后一个受控 Web 目标。iframe `error` event 只会为当前 `BrowserFrame` revision 标记临时加载失败 notice；它不改变 URL history，下一个受控 document 会清除它。浏览器不会为 DNS、TLS、mixed-content、CSP 或 `X-Frame-Options` 失败可靠触发该 event。不产生 iframe `load` 的 `pushState`、`replaceState` 与 fragment 变化仍不可观察。
 
-## Deferred Electron carrier
+## Electron carrier
 
-Electron `<webview>` 支持已经完成设计，但当前不注册也不测试。controller 保持相同的四个命令，独立的 per-tab view 对象负责 attachment、detachment、状态观察与 target identity。这沿用 Playwright 的 Android WebView 划分：`AndroidWebView` 是由 package、process 与调试 socket 标识的 target 和生命周期 handle，`page()` 返回负责 Web 导航与 DOM 命令的普通 `Page`；设备级输入仍属于 `AndroidDevice`。
-
-Desktop 设计只在应用窗口启用 `webviewTag`。其隔离 preload 获得不可猜的 per-window capability，每个 Browser tab 再追加新的 UUID，形成独立非持久化 partition。主进程只接受携带该 capability 且初始地址为 `about:blank` 的 guest，删除任何 preload，并强制启用 sandbox 与 context isolation、在所有 frame 禁用 Node integration、启用 Web security 与安全内容检查、禁用嵌套 webview 和 plugin。
-
-主进程只允许页面发起的 main-frame 导航与重定向前往不含凭据的 HTTP(S)。请求可以使用 HTTP(S)、WebSocket、data 与 Blob URL；直接 file、自定义协议、extension 与特权请求都会被取消。permission 检查与请求、显示捕获、设备授权、下载、弹窗和拖放导航全部拒绝。
-
-view 对象把非活动 guest 保持连接并停放在自有隐藏 DOM host 中，再把它移回可见占位符而不重建。这会在 Sidebar body remount 后保留页面与 target identity。因为 `<webview>` 参与 renderer 布局与合成，普通 DOM dialog、menu、tooltip 与拖拽预览可以覆盖它。`WebContentsView` 仍不合适，因为它是原生 child surface：CSS 无法覆盖它，每个 overlay 或动画都需要主进程同步 visibility 与 bounds。
-
-每个 guest 都是独立 WebContents 和 CDP target。开发环境可以开放 Electron 的进程级 remote-debugging port，并明确选择 guest target。生产环境保持该 endpoint 关闭；browser-use 或 computer-use 需要一个经过认证的 broker，把一个已授权 tab 绑定到其 WebContents，并使用 `webContents.debugger` 或等价的 scoped transport，而不公开全部应用 target。
+[Desktop webview 决策](2026-09-20-desktop-browser-webview.zh.md)负责原生页面生命周期、Workspace 存储共享、guest 策略与运行时验证缺口。本文的 iframe 行为仍具有独立价值；其跨域限制不描述 Desktop 载体。
 
 ## Alternatives considered
 
+**Tab 挂载时自动重新加载已保存页面。** 这会仅因恢复布局就恢复第三方请求与脚本执行。显式恢复操作保留已保存地址，但不会自行打开站点。
+
 **增加 Host embeddability probe 并持久化 sandbox 偏好。** 不采用，因为由 Host 请求任意目标会新增 SSRF 路径，probe 可能与后续重定向结果不一致，而持久化的全局逃生开关会让后续 tab 继承不安全选择。Browser 改为提供显式、按 tab、非持久化的 sandbox 开关，并持续显示警告。
 
 **把 parent-owned history 当成完整 Web 模型。** 不采用，因为 iframe 内导航后，地址会悄然陈旧，而相关操作仍显示可用。当前受控 URL 已知时，有上限的 parent history 仍然有用；显式 `unknown` 状态会移除 iframe API 无法支持的能力声明。
@@ -67,8 +65,10 @@ view 对象把非活动 guest 保持连接并停放在自有隐藏 DOM host 中
 
 单元测试覆盖协议解析、Markdown 链接委托、controller 命令与生命周期、确定性导航状态转换、有界 history、best-effort iframe error 和插件 disposal。Keyless Web 场景启动随附 composition，并覆盖消息链接路由、HTTP(S)、后退、前进、sandbox 控制、unknown 导航和协议拒绝。
 
+手动冷启动恢复和跨插件卸载保留检查点尚无运行时验证。
+
 ## Consequences
 
-Browser 不增加 Electron 权限，并在当前 Web 与 Desktop 构建中保持相同行为。很多站点拒绝 iframe 嵌入，或者依赖默认 sandbox 不向 frame 提供的下载或顶层导航。HTTPS 应用可能按 mixed-content 策略阻止公共 HTTP 页面，或限制 private-network 请求；关闭 sandbox 也无法绕过这些浏览器策略。关闭 sandbox 在其他方面会用自身保护换取兼容性：frame 可以按浏览器 activation 规则导航顶层应用，并使用下载、模态对话框和输入锁定。逃逸出 sandbox 的 Web popup 会保留 opener，并可以通过该链导航顶层应用。这两条路径都不会增加 Electron 或 Node API。URL 检查无法阻止 iframe 内页面自行选择目标。后续 iframe load 能表明已经发生导航，但无法给出跨域 URL；History API 与 fragment 变化可能完全不可见。延期的 Electron 载体必须通过真实打包应用验证，才能成为当前行为。
+iframe 载体不暴露 Electron 或 Node API。很多站点拒绝 iframe 嵌入，或者依赖默认 sandbox 不向 frame 提供的下载或顶层导航。HTTPS 应用可能按 mixed-content 策略阻止公共 HTTP 页面，或限制 private-network 请求；关闭 sandbox 也无法绕过这些浏览器策略。关闭 sandbox 在其他方面会用自身保护换取兼容性：frame 可以按浏览器 activation 规则导航顶层应用，并使用下载、模态对话框和输入锁定。逃逸出 sandbox 的 Web popup 会保留 opener，并可以通过该链导航顶层应用。这两条路径都不会增加 Electron 或 Node API。URL 检查无法阻止 iframe 内页面自行选择目标。后续 iframe load 能表明已经发生导航，但无法给出跨域 URL；History API 与 fragment 变化可能完全不可见。
 
-站点 Cookie 行为遵循用户浏览器，并不按 Browser tab 隔离。本地文件会被拒绝，并继续由 Document Preview 负责。持久化 URL 可能含敏感 query 或 fragment，因此用户不应在地址栏输入不希望保留在应用本地浏览器存储中的凭据。
+Web 站点 Cookie 行为遵循用户浏览器，并不按 Browser tab 隔离。本地文件会被拒绝，并继续由 Document Preview 负责。持久化 URL 可能含敏感 query 或 fragment，因此用户不应在地址栏输入不希望保留在应用本地浏览器存储中的凭据。
diff --git a/.agents/notes/implemented/feature/2026-09-20-desktop-browser-webview.i18n.yaml b/.agents/notes/implemented/feature/2026-09-20-desktop-browser-webview.i18n.yaml
new file mode 100644
index 0000000000..254189ee9f
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-09-20-desktop-browser-webview.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-20-desktop-browser-webview.md
+2026-09-20-desktop-browser-webview.md: e69114a90f50d51542e9b6a0d40daef05a93001f
+2026-09-20-desktop-browser-webview.zh.md: b0ab8b1a7058ae9cbb1258977cb4c4e2d8c40614
diff --git a/.agents/notes/implemented/feature/2026-09-20-desktop-browser-webview.md b/.agents/notes/implemented/feature/2026-09-20-desktop-browser-webview.md
new file mode 100644
index 0000000000..e69114a90f
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-09-20-desktop-browser-webview.md
@@ -0,0 +1,59 @@
+# Agent Note: Retained Desktop browser webviews
+
+Status: implemented
+
+English | [中文](2026-09-20-desktop-browser-webview.zh.md)
+
+## Problem
+
+An iframe cannot expose cross-origin navigation or render sites that refuse embedding. An Electron guest loses forms, scroll position and native history if its tab body unmounts on selection or container changes. Page lifetime must therefore remain independent of visibility and layout changes.
+
+Independent per-tab storage also prevents related pages in one Workspace from sharing site login state. Page lifetime and storage ownership need different owners.
+
+## Decision
+
+Desktop uses `<webview>` through `ElectronWebViewImpl`; Web retains its opt-in iframe carrier. The [Sidebar Browser decision](2026-09-16-sidebar-browser.md) owns shared tab behavior and iframe limitations; this note owns the Desktop carrier and Workspace-keyed partitions.
+
+The [stable Sidebar mounting decision](../architecture/2026-09-20-sidebar-retained-tab-layout.md) owns retained Session and tab containers in real CSS layout. Workspace storage ownership and baseline guest security remain with this note.
+
+- `BrowserController` owns address commands and recoverable presentation state. Native history stays in the guest; actual URL and title observations update the persisted address.
+- Controller registries are keyed by DSH Session, independently of presentation bindings. Rebinding replaces the store writer without recreating the page.
+- `electron/pages.ts` composes the Electron navigation provider and presentation object. `ElectronWebViewImpl` owns guest leases and native navigation; `ElectronWebviewPresentation` creates the tag and attaches it inside the Sidebar-owned content container.
+- The Desktop Browser type declares `keepMounted`. Sidebar retains its DOM ancestors across hiding and docking; CSS owns layout and clipping. Docking gestures disable guest pointer input, and body-local drop hints use normal stacking. A physical unmount cancels pending attachment and releases the guest; a later mount recreates it from the known address.
+- Tab occurrence cancellation, plugin unload and window destruction release guests. Guest crashes leave a retryable failure; Reload creates a new guest. Application restart offers the saved title and URL for explicit restoration; it creates no guest until the user restores or submits an address. Page memory and native history are not restored.
+
+The standard `./types` subpath exports the shared lease, reservation, open-request and bridge declarations through a declaration-only `types` condition; Desktop consumers use `import type`. There is no runtime default, extra JavaScript artifact or early Host bundling for these declarations. Preload exposes scoped operations and callbacks, not raw IPC or Electron objects.
+
+Browser has separate Host and Client compiler programs. Desktop and the Host aggregate reference only `tsconfig.host.json`, which compiles the package root and shared bridge declarations; the Client aggregate references `tsconfig.client.json` for the browser implementation. The package root tsconfig is solution-only. This keeps Client consumers of generated `/remote` declarations out of the Host compilation that precedes Typert generation.
+
+### Storage ownership
+
+`DesktopBrowserGuests` assigns a random, non-persistent Electron partition to each canonical CWD account. The Client uses the Host-normalized `WorkspaceView.path`, not the Workspace record UUID, so recreating a Workspace at the same directory does not change its storage account key. Browser tabs whose DSH Sessions resolve to that CWD share the account; Sessions without a resolved Workspace remain separately isolated. Workspace membership is resolved after the Client receives its authoritative baseline and is fixed for a guest occurrence. The CWD key controls sharing, not disk persistence.
+
+Closing a tab releases its guest, not its account's cookies or storage. Cookies, localStorage, IndexedDB, Service Workers and cache remain partition-owned and subject to normal origin rules. DOM, native history and sessionStorage remain page-owned. Account partitions survive window recreation within the Electron process but do not persist across application exit.
+
+### Initial guest policy
+
+Only the primary application window enables `webviewTag`. The main process accepts guest reservations only from that window's application top frame and validates a one-use lease, partition and inert initial `about:blank` document before allowing the guest. The main process replaces renderer-supplied preferences: no Node integration, guest preload, nested webviews, plugins, insecure content, dialogs or drag navigation; sandbox, context isolation and Web security stay enabled.
+
+Guest Sessions do not register the application protocol or inherit the application's authenticated request forwarding. Permission requests and checks, device access, display capture, downloads, native popup windows and HTTP authentication prompts are denied. Approved direct HTTP(S) popup requests without a POST body are routed through their live lease to a new Sidebar tab; scripted blank-window and POST popup flows remain unsupported. Navigation accepts credential-free HTTP(S); request filtering rejects local-file and privileged schemes and the known DSH Host endpoint, including common loopback aliases. This is not a general private-network or DNS-rebinding firewall.
+
+The Desktop toolbar has no sandbox-disable switch. The implementation adds no remote-debugging endpoint or browser-use integration. A future automation provider requires an authenticated, target-scoped broker rather than access to every application target. The separation of a target/lifetime handle from navigation commands follows the same distinction as Playwright's Android WebView and Page objects; device-level input is a separate responsibility.
+
+## Alternatives considered
+
+**Render the guest in a visibility-mounted tab body.** Unmounting disconnects the guest. Direct mounting requires the Sidebar's retained body and stable ancestor mechanism.
+
+**Move the guest between visible and hidden DOM containers.** Electron 44's `WebViewElement.disconnectedCallback` detaches the guest and resets its internal instance. Retaining the element reference or React key does not preserve that instance; the parent stays fixed instead.
+
+**Use one partition per tab.** This isolates site accounts between related pages. Workspace ownership provides the requested sharing without sharing the application Session; a tab still owns its own guest.
+
+**Change the partition of an active webview.** Electron fixes the partition before first navigation. Selecting another isolation scope requires a replacement guest and an explicit policy for existing site data, not a live attribute toggle.
+
+## Consequences
+
+Sidebar-owned stable ancestors preserve the page without Browser-owned geometry or occlusion handling. Hidden guests retain page memory and may continue network activity; there is no idle eviction policy. Persistent storage, selectable isolation scopes and permission-grant UI remain separate work. Temporary Workspace partitions are the current policy, not a promise that Workspace isolation always implies temporary storage.
+
+Focused tests cover native navigation error recovery, preload listener scoping and migrated iframe behavior. They do not establish real Electron attachment timing, overlap, focus, platform styling or storage isolation; those remain runtime verification gaps. No GUI recording accompanies the change. This implementation is not evidence that the complete browser security policy is ready for release.
+
+The package's Electron provider, presentation, page factory and Workspace storage resolver live in `src/client/electron/`. That directory is temporarily excluded from per-file coverage until a native Electron harness covers guest behavior; its unit tests still run. Shared Browser controllers, restoration UI, iframe code and Sidebar retention remain subject to the existing coverage requirements.
diff --git a/.agents/notes/implemented/feature/2026-09-20-desktop-browser-webview.zh.md b/.agents/notes/implemented/feature/2026-09-20-desktop-browser-webview.zh.md
new file mode 100644
index 0000000000..b0ab8b1a70
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-09-20-desktop-browser-webview.zh.md
@@ -0,0 +1,59 @@
+# Agent Note: 保持页面实例的 Desktop 浏览器 webview
+
+Status: implemented
+
+[English](2026-09-20-desktop-browser-webview.md) | 中文
+
+## Problem
+
+iframe 无法提供跨域导航状态, 也无法显示拒绝嵌入的站点. 如果 Tab Body 因选中项或容器变化而卸载, Electron guest 就会丢失表单、滚动位置与原生 history. 页面生命周期因此必须独立于可见性和布局变化.
+
+独立的 per-tab 存储也会阻止同一 Workspace 内相关页面共享站点登录态。页面生命周期与存储需要不同的所有者。
+
+## Decision
+
+Desktop 通过 `ElectronWebViewImpl` 使用 `<webview>`; Web 保留显式启用的 iframe 载体. [Sidebar Browser 决策](2026-09-16-sidebar-browser.zh.md)负责共享 Tab 行为与 iframe 限制; 本文负责 Desktop 载体和按 Workspace 共享的分区.
+
+[Sidebar 稳定挂载决策](../architecture/2026-09-20-sidebar-retained-tab-layout.zh.md)负责真实 CSS 布局中的保活会话与 Tab 容器。Workspace 存储所有权与 guest 基础安全配置仍由本文负责。
+
+- `BrowserController` 负责地址命令与可恢复的展示状态。原生 history 留在 guest 内；真实 URL 与标题观察更新持久化地址。
+- 控制器注册表按 DSH Session 索引，不依赖呈现绑定的存活期。重新绑定只替换存储写入方，不重建页面。
+- `electron/pages.ts` 组装 Electron 导航提供方和呈现对象. `ElectronWebViewImpl` 负责 guest 租约与原生导航; `ElectronWebviewPresentation` 创建标签并挂载到 Sidebar 持有的内容容器内.
+- Desktop Browser 类型声明 `keepMounted`。Sidebar 在隐藏和停靠切换时保留其 DOM 祖先，CSS 负责布局与裁剪。停靠手势期间禁用 guest 指针输入，Body 内的放置提示使用普通层叠。物理卸载会取消未完成的挂载并释放 guest，之后重新挂载时从已知地址重建。
+- tab occurrence 取消、插件卸载与窗口销毁会释放 guest。guest 崩溃留下可重试的失败状态；刷新创建新 guest。应用重启展示保存的标题与 URL，等待显式恢复；用户恢复或提交地址之前不创建 guest。不恢复页面内存或原生 history。
+
+标准 `./types` 子路径通过仅指向声明文件的 `types` 条件导出共享的租约、申请结果、打开请求与桥接声明，Desktop 消费方使用 `import type`。这些声明没有运行时 default、额外 JavaScript 产物或提前进行的 Host 打包。preload 只暴露限定范围的操作与回调，不暴露原始 IPC 或 Electron 对象。
+
+Browser 分别拥有 Host 与 Client 编译程序。Desktop 和 Host 聚合配置只引用 `tsconfig.host.json`，编译包根与共享桥接声明；Client 聚合配置通过 `tsconfig.client.json` 编译浏览器实现。包根 tsconfig 只作为 solution。这样，依赖生成 `/remote` 声明的 Client 消费方不会进入 Typert 生成之前的 Host 编译阶段。
+
+### Storage ownership
+
+`DesktopBrowserGuests` 为每个规范化 CWD 存储账号分配随机、非持久化的 Electron partition。Client 使用 Host 规范化后的 `WorkspaceView.path`，不使用 Workspace 记录 UUID，因此在同一目录重建 Workspace 不改变存储账号 key。DSH Session 解析到同一 CWD 的 Browser Tab 共享账号；没有可解析 Workspace 的 Session 仍单独隔离。Workspace 归属在 Client 收到权威基线后解析，并在一次 guest occurrence 内保持不变。CWD key 控制共享关系，不决定是否落盘。
+
+关闭 tab 只释放它的 guest，不清空账号的 Cookie 或存储。Cookie、localStorage、IndexedDB、Service Worker 与缓存由 partition 持有，并继续遵循普通 origin 规则。DOM、原生 history 与 sessionStorage 仍由页面持有。账号 partition 在同一 Electron 进程内重建窗口后仍保留，但不跨应用退出持久化。
+
+### Initial guest policy
+
+只有主应用窗口启用 `webviewTag`。主进程只接受该窗口应用顶层 frame 发起的 guest 申请，并在放行前校验一次性租约、partition 与无活动内容的初始 `about:blank` 文档。主进程替换 renderer 提供的偏好：不启用 Node integration、guest preload、嵌套 webview、plugin、不安全内容、模态对话框或拖放导航；sandbox、context isolation 与 Web security 保持开启。
+
+guest Session 不注册应用协议，也不继承应用的认证请求转发。权限请求与检查、设备访问、屏幕捕获、下载、原生弹窗与 HTTP 认证提示全部拒绝。通过检查且不带 POST body 的直接 HTTP(S) 弹窗请求，通过活动租约路由为新 Sidebar Tab；脚本操作空白窗口和 POST 弹窗流程仍不支持。导航接受不带内嵌凭据的 HTTP(S)；请求过滤拒绝本地文件、特权协议与已知 DSH Host 地址，包括常见 loopback 别名。这不是通用的私有网络或 DNS rebinding 防火墙。
+
+Desktop toolbar 没有关闭 sandbox 的开关。实现不增加远程调试端口或 browser-use 集成。未来的自动化提供方需要经过认证、限定 target 的 broker，而不是访问全部应用 target。把 target/生命周期句柄与导航命令分开的方式，与 Playwright 的 Android WebView 和 Page 对象区分相同；设备级输入属于另一项职责。
+
+## Alternatives considered
+
+**在按可见性挂载的 tab body 内渲染 guest。** 卸载会断开 guest；直接挂载需要 Sidebar 提供 Body 保活与稳定祖先机制。
+
+**在可见与隐藏 DOM 容器之间搬移 guest。** Electron 44 的 `WebViewElement.disconnectedCallback` 会 detach guest 并重置内部实例。保留元素引用或 React key 不能保留该实例，因此父节点保持固定。
+
+**每个 tab 使用独立 partition。** 这会隔离相关页面的站点账号。Workspace 所有权提供所需的共享，同时不共享应用 Session；每个 tab 仍拥有独立 guest。
+
+**修改活动 webview 的 partition。** Electron 在首次导航前确定 partition。选择其他隔离粒度需要替换 guest，并明确已有站点数据的处置策略，而不是实时切换属性。
+
+## Consequences
+
+Sidebar 持有的稳定祖先保留页面，无需 Browser 自行处理几何或遮挡。隐藏 guest 保留页面内存，也可能继续联网；当前没有空闲回收策略。持久化存储、可选择的隔离级别与权限授权 UI 留作独立工作。临时 Workspace partition 是当前策略，并不意味着 Workspace 隔离必然要求临时存储。
+
+定向测试覆盖原生导航错误恢复、preload 监听范围和已迁移的 iframe 行为。这些测试不能确认真实 Electron 的挂载时序、遮挡、焦点、平台样式或存储隔离；这些仍是运行时验证缺口。本次变更不附带 GUI 录像。此实现不构成完整浏览器安全策略已经可以发布的证据。
+
+包内的 Electron 提供方、呈现适配器、页面工厂与 Workspace 存储解析集中在 `src/client/electron/`. 在原生 Electron 测试环境覆盖 guest 行为之前, 该目录暂时不参与逐文件覆盖率门禁; 其单元测试仍然运行. 共享 Browser 控制器、恢复 UI、iframe 代码和 Sidebar 保活仍遵循现有覆盖率要求.
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index ab890ca559..2ad45f06c7 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -126,6 +126,7 @@ External packages installed for runtime use or distributed inside the prebuilt b
 
 pnpm applies local patches to the following packages at install time, so shipped artifacts carry modified copies; each patch file is the complete record of the modification:
 
+- `@earendil-works/pi-ai@0.85.1` — [`patches/@earendil-works__pi-ai@0.85.1.patch`](patches/@earendil-works__pi-ai@0.85.1.patch)
 - `@electron/osx-sign@1.3.3` — [`patches/@electron__osx-sign@1.3.3.patch`](patches/@electron__osx-sign@1.3.3.patch)
 - `@yao-pkg/pkg@6.21.0` — [`patches/@yao-pkg__pkg@6.21.0.patch`](patches/@yao-pkg__pkg@6.21.0.patch)
 - `node-pty@1.2.0-beta.15` — [`patches/node-pty@1.2.0-beta.15.patch`](patches/node-pty@1.2.0-beta.15.patch)
diff --git a/apps/cli/tests/web-agent-presets.e2e.ts b/apps/cli/tests/web-agent-presets.e2e.ts
index 692cad3ebd..1122a1c36e 100644
--- a/apps/cli/tests/web-agent-presets.e2e.ts
+++ b/apps/cli/tests/web-agent-presets.e2e.ts
@@ -369,6 +369,23 @@ describe('the shipped Web composition', () => {
       expect(tools).not.toContain('str_replace_editor')
       expect(ctx.commands.find(handle.agent, 'goal')).toBeDefined()
 
+      // The persona is `standard`'s, pinned verbatim so the two composition
+      // files cannot drift apart: tool descriptions and the skill catalog
+      // carry every creation-mode instruction.
+      const standard = await ctx.agents.create({
+        sessionId: SessionId('preset-cordis-standard-persona'),
+        setup: agentCtx => ctx.agentPresets.mount(agentCtx, 'standard').then(() => undefined),
+      })
+      try {
+        const persona = async (agent: Agent) => (await ctx.systemPrompt.assemble({ scope: agent })).sections
+          .filter(section => section.name.startsWith('deployment:persona-'))
+        const cordisPersona = await persona(handle.agent)
+        expect(cordisPersona.map(section => section.name)).toEqual(['deployment:persona-prefix', 'deployment:persona-suffix'])
+        expect(cordisPersona).toEqual(await persona(standard.agent))
+      } finally {
+        await standard.dispose()
+      }
+
       // The preset's own authoring skill registers into ITS layer of the host
       // registry: the cordis agent's view carries it, the global view does not.
       const scoped = (await ctx.skills.list({ scope: handle.agent })).map(skill => skill.name)
diff --git a/apps/desktop-host/src/update-tasks.ts b/apps/desktop-host/src/update-tasks.ts
index 106869532f..2b2bbf4a33 100644
--- a/apps/desktop-host/src/update-tasks.ts
+++ b/apps/desktop-host/src/update-tasks.ts
@@ -45,7 +45,7 @@ export function installDesktopUpdateTaskControl(ctx: Context): (action: 'inspect
     const liveAgents = agents.list()
     return liveAgents.some(agent => agent.status === 'running'
       || agent.inbox.nextTurn.length > 0 || agent.inbox.nextStep.length > 0)
-      || [undefined, ...liveAgents].some(agent => jobs.list(agent)
+      || [undefined, ...liveAgents].some(agent => jobs.list(agent?.id)
         .some(job => job.status === 'running' || job.status === 'stopping'))
   }
 }
diff --git a/apps/desktop/README.i18n.yaml b/apps/desktop/README.i18n.yaml
index b536269a93..81f1df65f7 100644
--- a/apps/desktop/README.i18n.yaml
+++ b/apps/desktop/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write apps/desktop/README.md
-README.md: 48ad6bbcf515aac5734da1fd406ce70f0f4d6505
-README.zh.md: 795e62a0e119e40211387a12f9e4fa56fdde3e79
+README.md: 43cde4f41f2e82bf2d3ccce0a7e93d81234010c5
+README.zh.md: 9e300996cd7ed0428c7199e9f9bd43b6f9077e0a
diff --git a/apps/desktop/README.md b/apps/desktop/README.md
index 48ad6bbcf5..43cde4f41f 100644
--- a/apps/desktop/README.md
+++ b/apps/desktop/README.md
@@ -10,6 +10,8 @@ Desktop’s local native directory flow opens an Electron folder dialog attached
 
 Creator and the Web Plugin Manager use Desktop’s bundled pnpm under Electron Node mode without requiring pnpm on PATH. The private Node launcher environment applies only to package operations.
 
+Desktop microphone access is restricted to audio requests from the primary `dsh-app://app` frame. macOS uses system microphone authorization and a packaged usage description.
+
 ## Key technical decisions
 
 The original artwork lives in `resources/icon.png` and `resources/icon.svg`; platform adaptations retain the whale and gradients in `resources/icon-windows.*` and `resources/icon-macos.*`. Export each platform SVG as a transparent 1024×1024 PNG. Electron-builder generates the multi-size ICO for the Windows application, installer, and uninstaller ([Windows icon requirements](https://learn.microsoft.com/en-us/windows/apps/design/iconography/app-icon-construction)). The installation pages use matching artwork in both themes; the uninstaller's welcome and finish pages share `installer/assets/uninstaller-sidebar.png`, converted to a 164×314 BMP during preparation.
@@ -46,7 +48,9 @@ The [thin-wrapper decision](../../.agents/notes/implemented/architecture/2026-09
 
 Electron owns `$DSH_HOME/profiles/desktop`. Its `dependencies` contains packages installed by pnpm; `dsh.profile.bundles` contains the built-in bundles followed by enabled plugins. The signed application supplies dsh, the private Desktop Host, and their production packages from `resources/app.asar/dsh`. Packaged applications select runtime profile resolution without creating package links; development profiles use filesystem links. Both host and plugins execute in the same Electron Node-mode process; Desktop does not enable `--preserve-symlinks`. The CLI cannot boot or mutate this profile.
 
-The application preload exposes boot readiness, fatal startup reporting, and native directory selection. Product documents use the shared authenticated HTTP APIs and receive the Desktop marker, update presentation, and an action that opens native confirmation; they cannot choose artifacts or authorize installation. Plugin management uses the Web application's authenticated HTTP APIs. Electron serves update-dialog documents and assets locally at `dsh-app://shell/`, independently of Host readiness. Electron exposes no plugin-management IPC or separate management document. No renderer receives filesystem access, raw Electron IPC, a shell, or arbitrary pnpm arguments.
+The application preload exposes boot readiness, fatal startup reporting, native directory selection, the `__DSH_HOST_PATHS__` bridge for composer path references, and the lease-scoped Browser bridge only to `dsh-app://app` documents. Product documents use the shared authenticated HTTP APIs and receive the Desktop marker, update presentation, and an action that opens native confirmation; they cannot choose artifacts or authorize installation. Plugin management uses the Web application's authenticated HTTP APIs. Electron serves update-dialog documents and assets locally at `dsh-app://shell/`, independently of Host readiness. Electron exposes no plugin-management IPC or separate management document. No renderer receives filesystem access, raw Electron IPC, a shell, or arbitrary pnpm arguments.
+
+Only the main application window enables `<webview>`. Guest attachment must match a main-issued lease and partition; guests keep sandbox, context isolation and Web security without Node integration or guest preload. Browser IPC listeners are created only for the application document. [Sidebar Browser](../../packages/client/ui-sidebar-browser/README.md) describes storage grouping and guest limitations; Host authentication remains required independently of URL filtering.
 
 The `dsh-app://shell/` origin serves packaged update documents, scripts, and styles without contacting the Host. Static requests retain GET/HEAD, path-containment, and MIME handling; each update document keeps its isolated preload and owned-window IPC checks.
 
diff --git a/apps/desktop/README.zh.md b/apps/desktop/README.zh.md
index 795e62a0e1..9e300996cd 100644
--- a/apps/desktop/README.zh.md
+++ b/apps/desktop/README.zh.md
@@ -10,6 +10,8 @@ Desktop 的本地原生目录流程打开绑定应用窗口的 Electron 文件
 
 Creator 和 Web Plugin Manager 在 Electron Node 模式下使用 Desktop 内置 pnpm，无需 PATH 中存在 pnpm。私有 Node 启动器环境仅应用于包操作。
 
+桌面麦克风访问仅允许主 `dsh-app://app` 页面发起的音频请求。macOS 使用系统麦克风授权与随包用途说明。
+
 ## 关键技术决策
 
 设计师原稿位于 `resources/icon.png` 和 `resources/icon.svg`；平台适配保留鲸鱼与渐变，分别位于 `resources/icon-windows.*` 和 `resources/icon-macos.*`。将各平台 SVG 导出为透明的 1024×1024 PNG。electron-builder 为 Windows 应用、安装程序和卸载程序生成多尺寸 ICO（[Windows 图标要求](https://learn.microsoft.com/en-us/windows/apps/design/iconography/app-icon-construction)）。安装页面在两种主题下使用匹配的图案；卸载程序的欢迎和完成页共用 `installer/assets/uninstaller-sidebar.png`，准备阶段将其转换为 164×314 BMP。
@@ -46,7 +48,9 @@ Node 准备内置解释器和 Python 库，无需系统 Python 或 pip。[下载
 
 Electron 拥有 `$DSH_HOME/profiles/desktop`。其 `dependencies` 包含 pnpm 安装的包；`dsh.profile.bundles` 包含内置 bundle，后接已启用插件。签名应用从 `resources/app.asar/dsh` 提供 dsh、私有 Desktop Host 及其生产依赖。打包应用选择 runtime profile 解析，不创建包链接；开发 profile 使用文件系统链接。宿主与插件在同一个 Electron Node 模式进程中执行；Desktop 不启用 `--preserve-symlinks`。CLI 不能启动或修改此 profile。
 
-应用 preload 暴露启动就绪、致命启动失败上报和原生目录选择。产品页面还获得 Desktop 标记、更新展示数据和打开原生确认的操作，不能选择安装产物或授权安装。插件管理使用 Web 应用经过认证的 HTTP API；Electron 在 `dsh-app://shell/` 本地提供更新弹窗文档和资源，不依赖 Host 就绪。Electron 不提供插件管理 IPC 或独立管理页面。
+应用 preload 只向 `dsh-app://app` 文档暴露启动就绪、致命启动失败上报、原生目录选择、用于 composer 路径引用的 `__DSH_HOST_PATHS__` 桥接和租约范围内的 Browser 桥接。产品页面还获得 Desktop 标记、更新展示数据和打开原生确认的操作，不能选择安装产物或授权安装。插件管理使用 Web 应用经过认证的 HTTP API；Electron 在 `dsh-app://shell/` 本地提供更新弹窗文档和资源，不依赖 Host 就绪。Electron 不提供插件管理 IPC 或独立管理页面。
+
+只有主应用窗口启用 `<webview>`。guest 挂载必须匹配主进程签发的租约和分区；guest 保持 sandbox、context isolation 和 Web security，不启用 Node integration 或 guest preload。Browser IPC 监听只为应用文档创建。[Sidebar Browser](../../packages/client/ui-sidebar-browser/README.zh.md) 说明存储分组和 guest 限制；Host 鉴权仍独立于 URL 过滤而必需。
 
 `dsh-app://shell/` 无需联系 Host 即可提供打包的更新文档、脚本和样式。静态请求保留 GET/HEAD、路径范围和 MIME 处理；每个更新文档继续使用隔离 preload 和所属窗口的 IPC 校验。
 
diff --git a/apps/desktop/electron-builder.config.d.mts b/apps/desktop/electron-builder.config.d.mts
index f7cfd63f42..632250119b 100644
--- a/apps/desktop/electron-builder.config.d.mts
+++ b/apps/desktop/electron-builder.config.d.mts
@@ -21,6 +21,7 @@ export interface DesktopElectronBuilderConfig {
     { readonly from: string, readonly to: 'icon.png' },
   ]
   readonly mac: {
+    readonly extendInfo: { readonly NSMicrophoneUsageDescription: string }
     readonly identity: string | undefined
     readonly forceCodeSigning: boolean
     readonly notarize: boolean
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index b9cb4b3592..e9850c256e 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -41,6 +41,8 @@
   },
   "devDependencies": {
     "@deepseek-ai/dsh-app-boot": "workspace:^",
+    "@deepseek-ai/dsh-client-ui-settings-general": "workspace:^",
+    "@deepseek-ai/dsh-client-ui-sidebar-browser": "workspace:^",
     "@deepseek-ai/dsh-home-paths": "workspace:^",
     "@deepseek-ai/node-addon-system": "workspace:^",
     "@electron/get": "^5.1.0",
diff --git a/apps/desktop/scripts/electron-builder-config.mjs b/apps/desktop/scripts/electron-builder-config.mjs
index dd4b00d24c..3f469c3be2 100644
--- a/apps/desktop/scripts/electron-builder-config.mjs
+++ b/apps/desktop/scripts/electron-builder-config.mjs
@@ -131,6 +131,7 @@ export function createElectronBuilderConfig(
       identity: macOSSigning?.signingIdentity,
       forceCodeSigning: true,
       hardenedRuntime: true,
+      extendInfo: { NSMicrophoneUsageDescription: 'DeepSeek Harness uses your microphone to transcribe speech into message drafts.' },
       // ASAR-unpacked native runtime files are pre-signed; PAK resources are sealed by their enclosing bundle.
       signIgnore: ['/Contents/Resources/app\\.asar\\.unpacked/dsh(?:/|$)', '/Contents/Resources/runtime/primary-runtime(?:/|$)', '\\.pak$'],
       notarize: true,
diff --git a/apps/desktop/src/browser-guests.ts b/apps/desktop/src/browser-guests.ts
new file mode 100644
index 0000000000..027b7cee5b
--- /dev/null
+++ b/apps/desktop/src/browser-guests.ts
@@ -0,0 +1,166 @@
+/** Main-process ownership and fixed isolation policy for Sidebar webview guests. */
+import { randomUUID } from 'node:crypto'
+import { app, session, type BrowserWindow, type Session, type WebContents } from 'electron'
+import type { DesktopBrowserLeaseId, DesktopBrowserOpenRequest, DesktopBrowserReservation } from '@deepseek-ai/dsh-client-ui-sidebar-browser/types'
+import { DESKTOP_IPC } from './ipc.ts'
+
+interface GuestLease {
+  readonly owner: WebContents
+  readonly partition: string
+  attached: boolean
+  guest?: WebContents
+}
+
+/** Owns workspace storage partitions independently from individual tab guests. */
+export class DesktopBrowserGuests {
+  private readonly partitions = new Map<string, string>()
+  private readonly leases = new Map<DesktopBrowserLeaseId, GuestLease>()
+
+  /** @param hostUrl - current authenticated DSH Host, which guests cannot request. */
+  constructor(private readonly hostUrl: () => string | undefined) {}
+
+  /**
+   * Reserve one guest in a workspace's process-lifetime partition.
+   * @param owner - authenticated primary application WebContents.
+   * @param workspace - workspace identity received over IPC.
+   * @returns opaque lease and the partition approved for it.
+   */
+  acquire(owner: WebContents, workspace: unknown): DesktopBrowserReservation {
+    if (typeof workspace !== 'string' || workspace.length === 0 || workspace.length > 4096) {
+      throw new Error('desktop browser: a workspace storage identity is required')
+    }
+    let partition = this.partitions.get(workspace)
+    if (partition === undefined) {
+      partition = `dsh-sidebar-browser-${randomUUID()}`
+      this.configureSession(session.fromPartition(partition))
+      this.partitions.set(workspace, partition)
+    }
+    const lease = randomUUID() as DesktopBrowserLeaseId
+    this.leases.set(lease, { owner, partition, attached: false })
+    return { lease, partition }
+  }
+
+  /**
+   * Release only a lease issued to this application window; workspace storage survives.
+   * @param owner - authenticated IPC sender.
+   * @param id - lease received over IPC.
+   */
+  async release(owner: WebContents, id: unknown): Promise<void> {
+    if (typeof id !== 'string') throw new Error('desktop browser: invalid guest lease')
+    const key = id as DesktopBrowserLeaseId
+    const lease = this.leases.get(key)
+    if (lease === undefined) return
+    if (lease.owner !== owner) throw new Error('desktop browser: guest belongs to another window')
+    this.leases.delete(key)
+    const guest = lease.guest
+    if (guest !== undefined && !guest.isDestroyed()) {
+      const destroyed = new Promise<void>((resolve) => { guest.once('destroyed', resolve) })
+      guest.close({ waitForBeforeUnload: false })
+      await destroyed
+    }
+  }
+
+  /**
+   * Install attachment checks before the application document can create a webview.
+   * @param window - primary application window.
+   */
+  bind(window: BrowserWindow): void {
+    const owner = window.webContents
+    owner.on('will-attach-webview', (event, preferences, params) => {
+      const id = typeof params.src === 'string' && params.src.startsWith('about:blank#')
+        ? params.src.slice('about:blank#'.length) : ''
+      const lease = this.leases.get(id as DesktopBrowserLeaseId)
+      if (lease === undefined || lease.owner !== owner || lease.attached || params.partition !== lease.partition) {
+        event.preventDefault()
+        return
+      }
+      lease.attached = true
+      // Keep Electron's allowpopups dispatch flag; the guest handler still denies native windows.
+      for (const key of Object.keys(preferences)) {
+        if (key !== 'disablePopups') Reflect.deleteProperty(preferences, key)
+      }
+      Object.assign(preferences, {
+        partition: lease.partition,
+        nodeIntegration: false, nodeIntegrationInWorker: false, nodeIntegrationInSubFrames: false,
+        contextIsolation: true, sandbox: true, webSecurity: true, allowRunningInsecureContent: false,
+        webviewTag: false, plugins: false, navigateOnDragDrop: false, disableDialogs: true,
+        devTools: !app.isPackaged,
+      })
+      params.httpreferrer = ''
+    })
+    owner.on('did-attach-webview', (_event, guest) => {
+      let attachedLease: DesktopBrowserLeaseId | undefined
+      // The first document is an inert about:blank carrying the approved lease.
+      // Bind on the main-process event before the renderer can navigate the ready guest.
+      guest.once('dom-ready', () => {
+        const url = guest.getURL()
+        const id = (url.startsWith('about:blank#') ? url.slice('about:blank#'.length) : '') as DesktopBrowserLeaseId
+        const lease = this.leases.get(id)
+        if (lease === undefined || lease.owner !== owner || lease.guest !== undefined) {
+          guest.close({ waitForBeforeUnload: false })
+          return
+        }
+        lease.guest = guest
+        attachedLease = id
+        guest.once('destroyed', () => { this.leases.delete(id) })
+      })
+      guest.setWindowOpenHandler(({ url, postBody }) => {
+        const lease = attachedLease === undefined ? undefined : this.leases.get(attachedLease)
+        if (attachedLease !== undefined && lease?.guest === guest && lease.owner === owner && !owner.isDestroyed()
+          && postBody === undefined && this.allowedNavigation(url)) {
+          const request: DesktopBrowserOpenRequest = { lease: attachedLease, url: new URL(url).href }
+          owner.send(DESKTOP_IPC.browserOpenRequested, request)
+        }
+        return { action: 'deny' }
+      })
+      guest.on('will-frame-navigate', (event) => {
+        if (event.isMainFrame && !this.allowedNavigation(event.url)) event.preventDefault()
+      })
+      guest.on('will-redirect', (event, url, _inPlace, mainFrame) => {
+        if (mainFrame && !this.allowedNavigation(url)) event.preventDefault()
+      })
+      guest.on('will-attach-webview', (event) => { event.preventDefault() })
+      guest.on('login', (event, _details, _authInfo, callback) => { event.preventDefault(); callback() })
+    })
+    const releaseAll = (): void => {
+      for (const [id, lease] of this.leases) {
+        if (lease.owner === owner) void this.release(owner, id).catch((error: unknown) => { console.error(error) })
+      }
+    }
+    owner.on('did-start-navigation', (_event, _url, inPlace, mainFrame) => {
+      if (mainFrame && !inPlace) releaseAll()
+    })
+    owner.on('render-process-gone', releaseAll)
+    owner.once('destroyed', releaseAll)
+  }
+
+  private configureSession(browserSession: Session): void {
+    browserSession.setPermissionRequestHandler((_contents, _permission, callback) => { callback(false) })
+    browserSession.setPermissionCheckHandler(() => false)
+    browserSession.setDevicePermissionHandler(() => false)
+    browserSession.setDisplayMediaRequestHandler((_request, callback) => { callback({}) })
+    browserSession.on('will-download', (event) => { event.preventDefault() })
+    browserSession.webRequest.onBeforeRequest((details, callback) => {
+      const url = new URL(details.url)
+      const network = ['http:', 'https:', 'ws:', 'wss:'].includes(url.protocol)
+      callback({ cancel: network
+        ? url.username !== '' || url.password !== '' || this.isApplicationHost(url)
+        : !['about:', 'data:', 'blob:'].includes(url.protocol) })
+    })
+  }
+
+  private allowedNavigation(value: string): boolean {
+    if (!URL.canParse(value)) return false
+    const url = new URL(value)
+    return ['http:', 'https:'].includes(url.protocol) && url.username === '' && url.password === ''
+      && !this.isApplicationHost(url)
+  }
+
+  private isApplicationHost(url: URL): boolean {
+    const value = this.hostUrl()
+    if (value === undefined) return false
+    const host = new URL(value)
+    return url.port === host.port
+      && (url.hostname === host.hostname || ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))
+  }
+}
diff --git a/apps/desktop/src/ipc.ts b/apps/desktop/src/ipc.ts
index f5f1f6e82e..ea77749109 100644
--- a/apps/desktop/src/ipc.ts
+++ b/apps/desktop/src/ipc.ts
@@ -1,11 +1,15 @@
 /** Typed preload operations exposed only by the Electron shell. */
 
 import type { IpcMainInvokeEvent } from 'electron'
+import type { DesktopBrowserBridge } from '@deepseek-ai/dsh-client-ui-sidebar-browser/types'
 
 /** IPC channel names kept private to the desktop application bundle. */
 export const DESKTOP_IPC = {
   boot: 'dsh-desktop:boot',
   bootFailed: 'dsh-desktop:boot-failed',
+  browserAcquire: 'dsh-desktop:browser-acquire',
+  browserRelease: 'dsh-desktop:browser-release',
+  browserOpenRequested: 'dsh-desktop:browser-open-requested',
   directoryPick: 'dsh-desktop:directory-pick',
   updatesStatus: 'dsh-desktop:updates-status',
   updatesOpen: 'dsh-desktop:updates-open',
@@ -54,6 +58,7 @@ export interface DesktopUpdatePresentation {
 /** Product documents cannot supply update versions, package URLs, or installation authorization. */
 export interface DshDesktopProductApi {
   readonly protocolVersion: 1
+  readonly browser: DesktopBrowserBridge
   readonly updates: {
     status(): Promise<DesktopUpdatePresentation>
     open(): Promise<void>
diff --git a/apps/desktop/src/main.ts b/apps/desktop/src/main.ts
index 7531a7cfa9..b79df71ff2 100644
--- a/apps/desktop/src/main.ts
+++ b/apps/desktop/src/main.ts
@@ -22,6 +22,7 @@ import { resolveDesktopPaths } from './paths.ts'
 import { DesktopProjectManager } from './project-manager.ts'
 import { DesktopHostProcess, DesktopHostUncleanExitError } from './host-process.ts'
 import { installDesktopDirectoryPicker } from './directory-picker.ts'
+import { installMicrophonePermissions } from './microphone-permissions.ts'
 import { DesktopBackendController } from './backend-controller.ts'
 import { DESKTOP_IPC, SCHEME, assertDesktopSender, type DesktopUpdateState } from './ipc.ts'
 import { formatDesktopMessage, resolveDesktopLocale } from './locale.ts'
@@ -39,6 +40,7 @@ import { DesktopMandatoryUpdateWindow } from './mandatory-update-window.ts'
 import { DesktopPolicyTestAuth } from './policy-test-auth.ts'
 import { DesktopUpdateDialog, type UpdateDialogOptions } from './update-dialog.ts'
 import { readDesktopRuntime } from './runtime-tree.ts'
+import { DesktopBrowserGuests } from './browser-guests.ts'
 
 let focusPrimaryWindow = (): void => {}
 let stopForRecovery = async (): Promise<void> => {}
@@ -137,6 +139,7 @@ function createWindow(preload: string, show = false, primary = false): BrowserWi
       contextIsolation: true,
       sandbox: true,
       webSecurity: true,
+      webviewTag: primary,
     },
   })
   window.webContents.setWindowOpenHandler(({ url }) => {
@@ -234,6 +237,7 @@ async function main(): Promise<void> {
   const applicationUrl = `${SCHEME}://app/`
   let hostUrl: string | undefined
   let hostCookie: string | undefined
+  const browserGuests = new DesktopBrowserGuests(() => hostUrl)
   let injections: readonly unknown[] = []
   const assertProductSender = (event: IpcMainInvokeEvent): void => {
     assertDesktopSender(event, ['app'])
@@ -426,6 +430,7 @@ async function main(): Promise<void> {
   })
 
   installDesktopDirectoryPicker(() => mainWindow)
+  installMicrophonePermissions(session.defaultSession, () => mainWindow?.webContents)
 
   ipcMain.handle(DESKTOP_IPC.boot, async (event) => {
     assertDesktopSender(event, ['app'])
@@ -443,6 +448,15 @@ async function main(): Promise<void> {
     reportFatal(new Error(message))
   })
 
+  ipcMain.handle(DESKTOP_IPC.browserAcquire, (event, workspace: unknown) => {
+    assertProductSender(event)
+    return browserGuests.acquire(event.sender, workspace)
+  })
+  ipcMain.handle(DESKTOP_IPC.browserRelease, (event, lease: unknown) => {
+    assertProductSender(event)
+    return browserGuests.release(event.sender, lease)
+  })
+
   session.defaultSession.webRequest.onBeforeSendHeaders({ urls: ['ws://127.0.0.1/*'] }, (details, callback) => {
     if (hostUrl === undefined || hostCookie === undefined || details.webContentsId !== mainWindow?.webContents.id) {
       callback({})
@@ -684,6 +698,7 @@ async function main(): Promise<void> {
   const createMainWindow = (): BrowserWindow => {
     const window = createWindow(appPreload, true, true)
     mainWindow = window
+    browserGuests.bind(window)
     window.on('focus', automaticCheck)
     window.on('closed', () => { if (mainWindow === window) mainWindow = undefined })
     window.webContents.on('did-fail-load', (_event, code, description, url, isMainFrame) => {
diff --git a/apps/desktop/src/microphone-permissions.ts b/apps/desktop/src/microphone-permissions.ts
new file mode 100644
index 0000000000..4d41a8e390
--- /dev/null
+++ b/apps/desktop/src/microphone-permissions.ts
@@ -0,0 +1,31 @@
+/** Microphone access belongs to the primary application frame and the operating system. */
+import { systemPreferences, type Session, type WebContents } from 'electron'
+
+function applicationFrame(url: string): boolean {
+  try {
+    const parsed = new URL(url)
+    return parsed.protocol === 'dsh-app:' && parsed.hostname === 'app'
+  } catch (_error) { return false /* Invalid frame URLs cannot request microphone access. */ }
+}
+
+/**
+ * Handle microphone requests from the owned application window; other permissions retain Electron's defaults.
+ * @param session - application's browser session.
+ * @param primary - current primary window contents, absent while no window is open.
+ */
+export function installMicrophonePermissions(session: Pick<Session, 'setPermissionCheckHandler' | 'setPermissionRequestHandler'>, primary: () => WebContents | undefined): void {
+  session.setPermissionCheckHandler((contents, permission, origin, details) => {
+    if (permission !== 'media') return true
+    return contents != null && contents === primary() && details.isMainFrame
+      && applicationFrame(origin) && details.mediaType === 'audio'
+      && (process.platform !== 'darwin' || systemPreferences.getMediaAccessStatus('microphone') === 'granted')
+  })
+  session.setPermissionRequestHandler((contents, permission, callback, details) => {
+    if (permission !== 'media') { callback(true); return }
+    const allowed = contents === primary() && details.isMainFrame && applicationFrame(details.requestingUrl)
+      && 'mediaTypes' in details && details.mediaTypes.length === 1 && details.mediaTypes[0] === 'audio'
+    if (!allowed) { callback(false); return }
+    if (process.platform !== 'darwin') { callback(true); return }
+    void systemPreferences.askForMediaAccess('microphone').then(callback, () => { callback(false) })
+  })
+}
diff --git a/apps/desktop/src/preload-app.ts b/apps/desktop/src/preload-app.ts
index 3baf8dd2b9..8133c72a7c 100644
--- a/apps/desktop/src/preload-app.ts
+++ b/apps/desktop/src/preload-app.ts
@@ -1,23 +1,27 @@
-/** Origin-scoped boot, native directory selection, and update presentation with native confirmation actions. */
+/** Origin-scoped boot, native directory selection, host paths of picked files, and update presentation with native confirmation actions. */
 
-import { contextBridge, ipcRenderer } from 'electron'
+import { contextBridge, ipcRenderer, webUtils } from 'electron'
 import { DESKTOP_IPC, SCHEME, type DshDesktopProductApi, type DesktopUpdatePresentation } from './ipc.ts'
 import { markDocumentPlatform, syncWindowFullscreen } from './preload-platform.ts'
 import { syncNativeTheme } from './preload-theme.ts'
 import { syncWindowsAppearance } from './preload-windows.ts'
 import { installMandatoryUpdateOverlay } from './preload-mandatory-overlay.ts'
+import { createDesktopBrowserBridge } from './preload-browser.ts'
 
-const product: DshDesktopProductApi = {
-  protocolVersion: 1,
-  updates: {
-    status: () => ipcRenderer.invoke(DESKTOP_IPC.updatesStatus) as Promise<DesktopUpdatePresentation>,
-    open: () => ipcRenderer.invoke(DESKTOP_IPC.updatesOpen) as Promise<void>,
-    subscribe(listener) {
-      const handle = (_event: Electron.IpcRendererEvent, state: DesktopUpdatePresentation): void => { listener(state) }
-      ipcRenderer.on(DESKTOP_IPC.updatesPresentation, handle)
-      return () => { ipcRenderer.off(DESKTOP_IPC.updatesPresentation, handle) }
+function createProductApi(): DshDesktopProductApi {
+  return {
+    protocolVersion: 1,
+    browser: createDesktopBrowserBridge(),
+    updates: {
+      status: () => ipcRenderer.invoke(DESKTOP_IPC.updatesStatus) as Promise<DesktopUpdatePresentation>,
+      open: () => ipcRenderer.invoke(DESKTOP_IPC.updatesOpen) as Promise<void>,
+      subscribe(listener) {
+        const handle = (_event: Electron.IpcRendererEvent, state: DesktopUpdatePresentation): void => { listener(state) }
+        ipcRenderer.on(DESKTOP_IPC.updatesPresentation, handle)
+        return () => { ipcRenderer.off(DESKTOP_IPC.updatesPresentation, handle) }
+      },
     },
-  },
+  }
 }
 
 if (location.protocol === `${SCHEME}:` && location.hostname === 'app') {
@@ -26,6 +30,12 @@ if (location.protocol === `${SCHEME}:` && location.hostname === 'app') {
   contextBridge.exposeInMainWorld('__DSH_DIRECTORY_PICKER__', {
     pick: () => ipcRenderer.invoke(DESKTOP_IPC.directoryPick) as Promise<string | null>,
   })
+  // The composer cites dropped, picked, and pasted files and folders that
+  // have a real path as `@path` references instead of uploading them; a
+  // File without one (pasted bytes) answers '' and uploads as before.
+  contextBridge.exposeInMainWorld('__DSH_HOST_PATHS__', {
+    pathFor: (file: File) => webUtils.getPathForFile(file),
+  })
   contextBridge.exposeInMainWorld('dshDesktopBoot', {
     ready: () => ipcRenderer.invoke(DESKTOP_IPC.boot) as Promise<unknown>,
     failed: (message: string) => ipcRenderer.invoke(DESKTOP_IPC.bootFailed, message) as Promise<void>,
@@ -36,4 +46,4 @@ markDocumentPlatform()
 syncWindowFullscreen()
 syncNativeTheme()
 // Main-process IPC also verifies the owning window and top frame.
-contextBridge.exposeInMainWorld('dshDesktop', location.protocol === `${SCHEME}:` && location.hostname === 'app' ? product : { protocolVersion: 1 })
+contextBridge.exposeInMainWorld('dshDesktop', location.protocol === `${SCHEME}:` && location.hostname === 'app' ? createProductApi() : { protocolVersion: 1 })
diff --git a/apps/desktop/src/preload-browser.ts b/apps/desktop/src/preload-browser.ts
new file mode 100644
index 0000000000..fadf2f1ce1
--- /dev/null
+++ b/apps/desktop/src/preload-browser.ts
@@ -0,0 +1,32 @@
+/** Lease-scoped browser operations and one main-process event subscription per window. */
+import { ipcRenderer } from 'electron'
+import type { DesktopBrowserBridge, DesktopBrowserLeaseId } from '@deepseek-ai/dsh-client-ui-sidebar-browser/types'
+import { DESKTOP_IPC } from './ipc.ts'
+
+/** @returns browser operations that expose neither IPC nor Electron objects. */
+export function createDesktopBrowserBridge(): DesktopBrowserBridge {
+  const listeners = new Map<DesktopBrowserLeaseId, Set<(url: string) => void>>()
+  ipcRenderer.on(DESKTOP_IPC.browserOpenRequested, (_event, request: unknown) => {
+    if (typeof request !== 'object' || request === null || !('lease' in request) || !('url' in request)
+      || typeof request.lease !== 'string' || typeof request.url !== 'string') return
+    const callbacks = listeners.get(request.lease as DesktopBrowserLeaseId)
+    if (callbacks === undefined) return
+    for (const callback of [...callbacks]) {
+      try { callback(request.url) }
+      catch (error) { console.error('Desktop browser link handler failed', error) }
+    }
+  })
+  return {
+    acquire: workspace => ipcRenderer.invoke(DESKTOP_IPC.browserAcquire, workspace) as ReturnType<DesktopBrowserBridge['acquire']>,
+    release: lease => ipcRenderer.invoke(DESKTOP_IPC.browserRelease, lease) as Promise<void>,
+    onOpenRequested(lease, listener) {
+      let callbacks = listeners.get(lease)
+      if (callbacks === undefined) { callbacks = new Set(); listeners.set(lease, callbacks) }
+      callbacks.add(listener)
+      return () => {
+        callbacks.delete(listener)
+        if (callbacks.size === 0 && listeners.get(lease) === callbacks) listeners.delete(lease)
+      }
+    },
+  }
+}
diff --git a/apps/desktop/tests/host-update-tasks.spec.ts b/apps/desktop/tests/host-update-tasks.spec.ts
index 086aaa9a26..7e1ccc4663 100644
--- a/apps/desktop/tests/host-update-tasks.spec.ts
+++ b/apps/desktop/tests/host-update-tasks.spec.ts
@@ -1,16 +1,41 @@
 import { Context } from '@deepseek-ai/cordis'
+import { JobId, JobRegistry } from '@deepseek-ai/dsh-jobs'
+import type { JobStatus, JobView } from '@deepseek-ai/dsh-jobs'
+import { SessionId } from '@deepseek-ai/dsh-session/types'
 import { Readable } from 'node:stream'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { installDesktopUpdateTaskControl } from '../../desktop-host/src/update-tasks.ts'
 
-type AgentState = { status: 'idle' | 'running'; inbox: { nextTurn: object[]; nextStep: object[] } }
-type JobState = { status: 'running' | 'stopping' | 'finished' }
+type AgentState = { id: SessionId; status: 'idle' | 'running'; inbox: { nextTurn: object[]; nextStep: object[] } }
 
 let ctx: Context
 let inspect: ReturnType<typeof installDesktopUpdateTaskControl>
 const agents: AgentState[] = []
-const jobs = new Map<AgentState | undefined, JobState[]>()
+const jobs = new Map<SessionId | undefined, JobStatus[]>()
+
+/** A registry whose only served member is the per-owner roster the inspector reads. */
+class RosterOnlyJobRegistry extends JobRegistry {
+  readonly events = { subscribe: () => () => {} }
+  start(): never { throw new Error('unsupported') }
+  list(caller?: SessionId): JobView[] {
+    return (jobs.get(caller) ?? []).map((status, index) => ({
+      id: JobId(`bash-${index + 1}`),
+      kind: 'bash',
+      label: 'sleep 60',
+      ...caller === undefined ? {} : { owner: caller },
+      status,
+      startedAt: 0,
+      output: { total: 0, earliest: 0 },
+    }))
+  }
+  get(): never { throw new Error('unsupported') }
+  read(): never { throw new Error('unsupported') }
+  readAt(): never { throw new Error('unsupported') }
+  kill(): never { throw new Error('unsupported') }
+  wait(): never { throw new Error('unsupported') }
+  attachController(): () => void { return () => {} }
+}
 
 beforeEach(() => {
   agents.length = 0
@@ -18,13 +43,13 @@ beforeEach(() => {
   ctx = new Context()
   // Narrow service doubles exercise the inspector against a real Cordis event lifecycle.
   ctx.provide('agents', { list: () => agents } as unknown as Context['agents'])
-  ctx.provide('jobs', { list: (agent?: AgentState) => jobs.get(agent) ?? [] } as unknown as Context['jobs'])
+  new RosterOnlyJobRegistry(ctx)
   inspect = installDesktopUpdateTaskControl(ctx)
 })
 
 afterEach(async () => { await ctx.fiber.dispose() })
 
-function idleAgent(): AgentState { return { status: 'idle', inbox: { nextTurn: [], nextStep: [] } } }
+function idleAgent(): AgentState { return { id: SessionId('update-task-owner'), status: 'idle', inbox: { nextTurn: [], nextStep: [] } } }
 
 function request(next: () => Promise<void>) {
   const incoming = Readable.from([]) as IncomingMessage
@@ -48,10 +73,10 @@ describe('Desktop Host update task protection', () => {
   it.each(['running', 'stopping'] as const)('counts global and agent-owned %s jobs', async (status) => {
     const agent = idleAgent()
     agents.push(agent)
-    for (const owner of [undefined, agent]) {
-      jobs.set(owner, [{ status }])
+    for (const owner of [undefined, agent.id]) {
+      jobs.set(owner, [status])
       expect(await inspect('inspect')).toBe(true)
-      jobs.set(owner, [{ status: 'finished' }])
+      jobs.set(owner, ['completed'])
       expect(await inspect('inspect')).toBe(false)
     }
   })
diff --git a/apps/desktop/tests/macos-signature.spec.ts b/apps/desktop/tests/macos-signature.spec.ts
index 4d71d3048b..6cd8faeccc 100644
--- a/apps/desktop/tests/macos-signature.spec.ts
+++ b/apps/desktop/tests/macos-signature.spec.ts
@@ -42,6 +42,7 @@ describe('desktop macOS release signature', () => {
     const { createElectronBuilderConfig } = await import('../electron-builder.config.mjs')
     const config = createElectronBuilderConfig(RELEASE_ENVIRONMENT, 'darwin', 'arm64')
     expect(portablePath(config.directories.output)).toContain('/.desktop-build/targets/mac-arm64/artifacts')
+    expect(config.mac.extendInfo.NSMicrophoneUsageDescription).toContain('microphone')
     expect(config.extraResources).toHaveLength(2)
     expect(config.extraResources[0]?.to).toBe('runtime')
     expect(portablePath(config.extraResources[0]?.from ?? '')).toContain('/.desktop-build/targets/mac-arm64/runtime')
diff --git a/apps/desktop/tests/main-startup.spec.ts b/apps/desktop/tests/main-startup.spec.ts
index 8547bc28fe..9be17e5321 100644
--- a/apps/desktop/tests/main-startup.spec.ts
+++ b/apps/desktop/tests/main-startup.spec.ts
@@ -211,7 +211,9 @@ vi.mock('electron', () => ({
     removeHandler: (channel: string) => { harness.handlers.delete(channel) },
   },
   Menu: { setApplicationMenu: harness.menu.setApplicationMenu, buildFromTemplate: harness.menu },
-  session: { defaultSession: { webRequest: { onBeforeSendHeaders: harness.socketHeaders } } },
+  session: { defaultSession: {
+    setPermissionCheckHandler: vi.fn(), setPermissionRequestHandler: vi.fn(), webRequest: { onBeforeSendHeaders: harness.socketHeaders },
+  } },
   protocol: { registerSchemesAsPrivileged: vi.fn(), handle: harness.protocolHandle },
   powerMonitor: harness.powerMonitor,
 }))
diff --git a/apps/desktop/tests/microphone-permissions.spec.ts b/apps/desktop/tests/microphone-permissions.spec.ts
new file mode 100644
index 0000000000..200a980f20
--- /dev/null
+++ b/apps/desktop/tests/microphone-permissions.spec.ts
@@ -0,0 +1,69 @@
+/** Desktop media permissions exclude external pages, subframes and camera requests. */
+import type { Session, WebContents } from 'electron'
+import { afterEach, expect, it, vi } from 'vitest'
+import { installMicrophonePermissions } from '../src/microphone-permissions.ts'
+
+const access = vi.hoisted(() => ({ getMediaAccessStatus: vi.fn(() => 'granted'), askForMediaAccess: vi.fn(async () => true) }))
+vi.mock('electron', () => ({ systemPreferences: access }))
+afterEach(() => { vi.unstubAllGlobals(); vi.resetAllMocks() })
+function fixture(platform: NodeJS.Platform = 'darwin') {
+  vi.stubGlobal('process', { ...process, platform })
+  const setPermissionCheckHandler = vi.fn<Session['setPermissionCheckHandler']>()
+  const setPermissionRequestHandler = vi.fn<Session['setPermissionRequestHandler']>()
+  const primary = {} as WebContents
+  installMicrophonePermissions({ setPermissionCheckHandler, setPermissionRequestHandler }, () => primary)
+  return { primary, check: setPermissionCheckHandler.mock.calls[0]![0]!, request: setPermissionRequestHandler.mock.calls[0]![0]! }
+}
+it('allows only audio checks from the owned primary application frame', () => {
+  const f = fixture(), details = { isMainFrame: true, mediaType: 'audio' as const }
+  expect(f.check(f.primary, 'media', 'dsh-app://app', details)).toBe(true)
+  expect(f.check(null, 'media', 'dsh-app://app', details)).toBe(false)
+  expect(f.check({} as WebContents, 'media', 'dsh-app://app', details)).toBe(false)
+  expect(f.check(f.primary, 'media', 'https://example.com', details)).toBe(false)
+  expect(f.check(f.primary, 'media', 'invalid', details)).toBe(false)
+  expect(f.check(f.primary, 'media', 'dsh-app://app', { ...details, isMainFrame: false })).toBe(false)
+  expect(f.check(f.primary, 'media', 'dsh-app://app', { ...details, mediaType: 'video' })).toBe(false)
+  expect(f.check(f.primary, 'clipboard-sanitized-write', 'dsh-app://app', details)).toBe(true)
+})
+it.each(['not-determined', 'granted', 'denied', 'restricted', 'unknown'] as const)(
+  'reports existing macOS microphone authorization for %s', (status) => {
+    const f = fixture()
+    access.getMediaAccessStatus.mockReturnValueOnce(status)
+    expect(f.check(f.primary, 'media', 'dsh-app://app', { isMainFrame: true, mediaType: 'audio' })).toBe(status === 'granted')
+    expect(access.getMediaAccessStatus).toHaveBeenCalledExactlyOnceWith('microphone')
+    expect(access.askForMediaAccess).not.toHaveBeenCalled()
+  },
+)
+it.each([true, false])('waits for the first macOS authorization decision: %s', async (allowed) => {
+  const f = fixture(), decision = Promise.withResolvers<boolean>(), done = vi.fn()
+  access.getMediaAccessStatus.mockReturnValue('not-determined')
+  access.askForMediaAccess.mockReturnValueOnce(decision.promise)
+  try {
+    f.request(f.primary, 'media', done, { isMainFrame: true, requestingUrl: 'dsh-app://app/', mediaTypes: ['audio'] })
+    expect(access.askForMediaAccess).toHaveBeenCalledExactlyOnceWith('microphone')
+    expect(done).not.toHaveBeenCalled()
+  } finally { decision.resolve(allowed); await decision.promise }
+  expect(done).toHaveBeenCalledExactlyOnceWith(allowed)
+})
+it('requests macOS microphone access and reports operating-system rejection', async () => {
+  const f = fixture(), done = vi.fn(), details = { isMainFrame: true, requestingUrl: 'dsh-app://app/', mediaTypes: ['audio'] }
+  f.request(f.primary, 'media', done, details)
+  await vi.waitFor(() => { expect(done).toHaveBeenLastCalledWith(true) })
+  expect(access.askForMediaAccess).toHaveBeenCalledWith('microphone')
+  access.askForMediaAccess.mockRejectedValueOnce(new Error('permission denied'))
+  f.request(f.primary, 'media', done, details)
+  await vi.waitFor(() => { expect(done).toHaveBeenLastCalledWith(false) })
+  for (const denied of [{ ...details, mediaTypes: ['audio', 'video'] }, { ...details, mediaTypes: [] },
+    { ...details, isMainFrame: false }, { isMainFrame: true, requestingUrl: 'dsh-app://app/' }]) {
+    f.request(f.primary, 'media', done, denied); expect(done).toHaveBeenLastCalledWith(false)
+  }
+  f.request(f.primary, 'clipboard-sanitized-write', done, details)
+  expect(done).toHaveBeenLastCalledWith(true)
+})
+it.each(['win32', 'linux'] as const)('leaves system authorization to Chromium on %s', (platform) => {
+  const f = fixture(platform), done = vi.fn()
+  expect(f.check(f.primary, 'media', 'dsh-app://app', { isMainFrame: true, mediaType: 'audio' })).toBe(true)
+  f.request(f.primary, 'media', done, { isMainFrame: true, requestingUrl: 'dsh-app://app/', mediaTypes: ['audio'] })
+  expect(done).toHaveBeenCalledWith(true)
+  expect(access.askForMediaAccess).not.toHaveBeenCalled()
+})
diff --git a/apps/desktop/tests/preload-app.spec.ts b/apps/desktop/tests/preload-app.spec.ts
index fb633e8a4a..cdce12e6b4 100644
--- a/apps/desktop/tests/preload-app.spec.ts
+++ b/apps/desktop/tests/preload-app.spec.ts
@@ -6,6 +6,7 @@ import { DESKTOP_IPC, type DshDesktopProductApi } from '../src/ipc.ts'
 const electron = vi.hoisted(() => ({
   contextBridge: { exposeInMainWorld: vi.fn() },
   ipcRenderer: { invoke: vi.fn(), on: vi.fn(), off: vi.fn(), send: vi.fn() },
+  webUtils: { getPathForFile: vi.fn() },
 }))
 vi.mock('electron', () => electron)
 vi.mock('../src/preload-platform.ts', () => ({ markDocumentPlatform: vi.fn(), syncWindowFullscreen: vi.fn() }))
@@ -27,7 +28,8 @@ it('limits product documents to update status and a native confirmation action',
   expect(api.updates).not.toHaveProperty('install')
   const listener = vi.fn()
   const dispose = api.updates.subscribe(listener)
-  const handler = electron.ipcRenderer.on.mock.calls[0]?.[1] as (event: unknown, state: unknown) => void
+  const handler = electron.ipcRenderer.on.mock.calls.find(([channel]) => channel === DESKTOP_IPC.updatesPresentation)?.[1] as
+    (event: unknown, state: unknown) => void
   handler({}, { visible: false })
   expect(listener).toHaveBeenCalledWith({ visible: false })
   dispose()
@@ -38,6 +40,7 @@ it.each(['dsh-app://shell/plugin-manager.html', 'dsh-app://other/index.html', 'h
   vi.stubGlobal('location', new URL(url))
   await import('../src/preload-app.ts')
   expect(electron.contextBridge.exposeInMainWorld).toHaveBeenCalledWith('dshDesktop', { protocolVersion: 1 })
+  expect(electron.ipcRenderer.on.mock.calls.some(([channel]) => channel === DESKTOP_IPC.browserOpenRequested)).toBe(false)
 })
 
 it('exposes asynchronous boot only to the local application document', async () => {
@@ -71,6 +74,23 @@ it('exposes a directory picker only to the local application document', async ()
   }
 })
 
+it('reports host paths of picked files only to the local application document', async () => {
+  vi.stubGlobal('location', new URL('dsh-app://app/'))
+  await import('../src/preload-app.ts')
+  const api = electron.contextBridge.exposeInMainWorld.mock.calls.find(([name]) => name === '__DSH_HOST_PATHS__')?.[1] as { pathFor(file: File): string }
+  const picked = new File(['x'], 'notes.md')
+  electron.webUtils.getPathForFile.mockReturnValue('/Users/me/notes.md')
+  expect(api.pathFor(picked)).toBe('/Users/me/notes.md')
+  expect(electron.webUtils.getPathForFile).toHaveBeenCalledExactlyOnceWith(picked)
+  for (const url of ['dsh-app://shell/startup.html', 'https://example.com/']) {
+    vi.resetModules()
+    electron.contextBridge.exposeInMainWorld.mockClear()
+    vi.stubGlobal('location', new URL(url))
+    await import('../src/preload-app.ts')
+    expect(electron.contextBridge.exposeInMainWorld.mock.calls.some(([name]) => name === '__DSH_HOST_PATHS__')).toBe(false)
+  }
+})
+
 it.each(['dsh-app://app/', 'dsh-app://shell/plugin-manager.html', 'https://example.com/'])(
   'installs Windows appearance only for the application document (%s)', async (url) => {
     vi.stubGlobal('location', new URL(url))
diff --git a/apps/desktop/tests/update-presentation.spec.ts b/apps/desktop/tests/update-presentation.spec.ts
index 70ed16a168..9d3ce5009e 100644
--- a/apps/desktop/tests/update-presentation.spec.ts
+++ b/apps/desktop/tests/update-presentation.spec.ts
@@ -2,7 +2,7 @@ import { expect, it } from 'vitest'
 import { desktopUpdateErrorSummary, presentDesktopUpdate } from '../src/update-presentation.ts'
 import { en, zh } from '../src/locale.ts'
 import type { DesktopUpdateState, DshDesktopProductApi } from '../src/ipc.ts'
-import type { DesktopUpdateBridge } from '../../../packages/client/ui-settings-general/src/client/desktop-update-bridge.ts'
+import type { DesktopUpdateBridge } from '@deepseek-ai/dsh-client-ui-settings-general/types'
 
 it('keeps the Electron preload assignable to the product consumer', () => {
   const assign = (bridge: DshDesktopProductApi['updates']): DesktopUpdateBridge => bridge
diff --git a/apps/desktop/tsconfig.json b/apps/desktop/tsconfig.json
index 6811108afd..ad14bd9bb9 100644
--- a/apps/desktop/tsconfig.json
+++ b/apps/desktop/tsconfig.json
@@ -7,6 +7,7 @@
   "include": ["src"],
   "references": [
     { "path": "../../packages/boot/app-boot" },
+    { "path": "../../packages/client/ui-sidebar-browser/tsconfig.host.json" },
     { "path": "../../packages/util/home-paths" }
   ]
 }
diff --git a/apps/web/tests/agent-preset-selection.e2e.ts b/apps/web/tests/agent-preset-selection.e2e.ts
index 6f9a7d8044..c4198ae414 100644
--- a/apps/web/tests/agent-preset-selection.e2e.ts
+++ b/apps/web/tests/agent-preset-selection.e2e.ts
@@ -404,8 +404,9 @@ describe('web e2e: agent-preset selection', () => {
     await compareOrRefreshGolden(HEADER_EXPECTED, snapshot, MODE)
     expect(snapshot).toContain('Minimal mode')
     expect(snapshot).toContain('button "1 subagent"')
-    expect(snapshot.indexOf('button "1 subagent"')).toBeLessThan(snapshot.indexOf('Minimal mode'))
-    expect(snapshot.indexOf('Minimal mode')).toBeLessThan(snapshot.indexOf('button "More actions"'))
+    // The preset label leads the header band; delegation navigation follows it.
+    expect(snapshot.indexOf('Minimal mode')).toBeLessThan(snapshot.indexOf('button "1 subagent"'))
+    expect(snapshot.indexOf('button "1 subagent"')).toBeLessThan(snapshot.indexOf('button "More actions"'))
     // Static chrome, not a control: the header can only report a composition
     // the host would refuse to change.
     expect(snapshot).not.toContain('button "Minimal mode"')
diff --git a/apps/web/tests/assembled-remote.ts b/apps/web/tests/assembled-remote.ts
index 5d9b7f8a14..8d7502264b 100644
--- a/apps/web/tests/assembled-remote.ts
+++ b/apps/web/tests/assembled-remote.ts
@@ -60,7 +60,6 @@ interface ControlBaseline {
   readonly type: 'baseline'
   readonly value: {
     readonly queues: Readonly<Record<string, readonly unknown[]>>
-    readonly jobs: Readonly<Record<string, readonly unknown[]>>
     readonly approvals: readonly unknown[]
     readonly questions: readonly unknown[]
     readonly projections: Readonly<Record<string, {
@@ -179,6 +178,9 @@ export function createAssembledRemote(options: AssembledRemoteOptions = {}): Ass
   mock.stream('session/control', (_args, stream) => {
     stream.push(structuredClone(fixture.control))
   })
+  mock.stream('job/list', (_args, stream) => {
+    stream.push({ type: 'rows', jobs: [] })
+  })
   mock.stream('workspace/follow', (_args, stream) => {
     stream.push({
       type: 'baseline',
diff --git a/apps/web/tests/background-job-list.e2e.ts b/apps/web/tests/background-job-list.e2e.ts
index f4db98483a..44427ce945 100644
--- a/apps/web/tests/background-job-list.e2e.ts
+++ b/apps/web/tests/background-job-list.e2e.ts
@@ -1,6 +1,6 @@
 // Session-header background jobs driven by a real `ctx.jobs` entry. No model
 // call is involved.
-import { readFile } from 'node:fs/promises'
+import { readFile, writeFile } from 'node:fs/promises'
 import { fileURLToPath } from 'node:url'
 import { join } from 'node:path'
 import type { Browser, Page } from 'playwright'
@@ -22,9 +22,12 @@ const RUNNING_EXPECTED = join(SNAPSHOT_DIR, 'running.expected.md')
 const SETTLED_EXPECTED = join(SNAPSHOT_DIR, 'settled.expected.md')
 const MODE = webSnapshotMode()
 const SEED_ID = 'background-job-list-web-e2e'
-// Long enough that the running assertions never race the process exiting on
-// their own; the test kills it explicitly to reach the settled state.
-const COMMAND = 'sleep 45'
+// A hold on a barrier file the test owns in the job's cwd: the process never
+// exits on its own, so no CI stall can settle it before the scenario kills it.
+// The bounded loop only caps an orphan's lifetime if the runner dies before
+// `afterAll` releases the barrier.
+const RELEASE = '.background-job-list.release'
+const COMMAND = `for _ in $(seq 1 3000); do [ -e ${RELEASE} ] && break; sleep 0.2; done`
 
 /**
  * Wait for opening a session to publish its live Agent.
@@ -48,7 +51,6 @@ describe.skipIf(MODE === 'record')('web e2e: background job list', () => {
   let page: Page
   let tripwire: ReturnType<typeof watchConsole>
   let agent: Agent
-  let jobId: JobId
 
   beforeAll(async () => {
     scaffold = await launchWebScaffold({})
@@ -73,12 +75,14 @@ describe.skipIf(MODE === 'record')('web e2e: background job list', () => {
   }, 120_000)
 
   afterAll(async () => {
+    if (scaffold !== undefined) await writeFile(join(scaffold.workspaceCwd, RELEASE), '')
     await browser?.close()
     await scaffold?.close()
   })
 
-  it('shows a running background job in the session header without a refresh', async () => {
-    onTestFailed(() => saveFailureShot(page, 'web-e2e-background-job-running'))
+  it('shows a running background job in the header without a refresh, then flips it to cancelled on settlement', async () => {
+    let phase = 'running'
+    onTestFailed(() => saveFailureShot(page, `web-e2e-background-job-${phase}`))
     // Polling for zero would pass at t=0 before delivery and prove nothing.
     const trigger = page.getByRole('button', { name: '1 background job running' })
     expect(await trigger.count()).toBe(0)
@@ -93,7 +97,7 @@ describe.skipIf(MODE === 'record')('web e2e: background job list', () => {
     const reported = started.content.map(block => block.type === 'text' ? block.text : '').join('')
     const matched = /\bbash-\d+\b/.exec(reported)
     if (matched === null) throw new Error(`background bash reported no job id: ${reported}`)
-    jobId = JobId(matched[0])
+    const jobId = JobId(matched[0])
 
     await trigger.waitFor({ timeout: 15_000 })
     await trigger.click()
@@ -101,24 +105,22 @@ describe.skipIf(MODE === 'record')('web e2e: background job list', () => {
     await row.waitFor({ timeout: 10_000 })
     await expect.poll(() => row.textContent()).toContain(COMMAND)
 
-    const snapshot = await captureStableAria(page, '[class*="menu"]', scaffold.workspaceCwd)
-    await compareOrRefreshGolden(RUNNING_EXPECTED, snapshot, MODE)
+    const running = await captureStableAria(page, '[class*="menu"]', scaffold.workspaceCwd)
+    await compareOrRefreshGolden(RUNNING_EXPECTED, running, MODE)
     expect(tripwire.pageErrors).toEqual([])
     expect(tripwire.warnings).toEqual([])
-  }, 60_000)
 
-  it('flips the open list to the cancelled outcome when the registry settles it', async () => {
-    onTestFailed(() => saveFailureShot(page, 'web-e2e-background-job-settled'))
-    expect(scaffold.ctx.jobs.kill(jobId, agent, 'web e2e cancellation')).toBe('requested')
+    phase = 'settled'
+    expect(scaffold.ctx.jobs.kill(jobId, agent.id, 'web e2e cancellation')).toBe('requested')
 
     const idle = page.getByRole('button', { name: '1 background job', exact: true })
     await idle.waitFor({ timeout: 20_000 })
 
-    const snapshot = await captureStableAria(page, '[class*="menu"]', scaffold.workspaceCwd)
-    await compareOrRefreshGolden(SETTLED_EXPECTED, snapshot, MODE)
+    const settled = await captureStableAria(page, '[class*="menu"]', scaffold.workspaceCwd)
+    await compareOrRefreshGolden(SETTLED_EXPECTED, settled, MODE)
     expect(tripwire.pageErrors).toEqual([])
     expect(tripwire.warnings).toEqual([])
-  }, 60_000)
+  }, 90_000)
 
   it('keeps its snapshot inventory closed', async () => {
     await assertFixtureInventory(SNAPSHOT_DIR, ['running.expected.md', 'settled.expected.md'])
diff --git a/apps/web/tests/details-session-lifecycle.e2e.ts b/apps/web/tests/details-session-lifecycle.e2e.ts
index 924105c184..50088b05f7 100644
--- a/apps/web/tests/details-session-lifecycle.e2e.ts
+++ b/apps/web/tests/details-session-lifecycle.e2e.ts
@@ -71,15 +71,22 @@ async function columns(page: Page): Promise<number[]> {
     getComputedStyle(element).gridTemplateColumns.split(' ').map(value => Math.round(Number.parseFloat(value))))
 }
 
+/** Select panes by visual column rather than retained-host DOM order. */
+function paneAt(column: Locator, index: number): Locator {
+  return column.locator(`[data-dockkit-pane][data-dockkit-column="${index}"]`)
+}
+
 /** Tab order and selection inside each docked pane, independent of generated ids. */
 async function paneSnapshot(page: Page) {
-  return await page.locator('[data-rightbar-col] [data-dockkit-pane]').evaluateAll(panes => panes.map(pane => ({
-    active: pane.hasAttribute('data-dockkit-pane-active'),
-    tabs: [...pane.querySelectorAll('[data-dockkit-tab]')].map(tab => ({
-      title: tab.querySelector('[data-dockkit-tab-title]')?.textContent?.trim(),
-      selected: tab.getAttribute('aria-selected') === 'true',
-    })),
-  })))
+  return await page.locator('[data-rightbar-col] [data-dockkit-pane]').evaluateAll(panes => panes
+    .sort((left, right) => Number(left.getAttribute('data-dockkit-column')) - Number(right.getAttribute('data-dockkit-column')))
+    .map(pane => ({
+      active: pane.hasAttribute('data-dockkit-pane-active'),
+      tabs: [...pane.querySelectorAll('[data-dockkit-tab]')].map(tab => ({
+        title: tab.querySelector('[data-dockkit-tab-title]')?.textContent?.trim(),
+        selected: tab.getAttribute('aria-selected') === 'true',
+      })),
+    })))
 }
 
 /** Product-visible geometry, pane state, and expanded Files directories at a settled checkpoint. */
@@ -311,16 +318,15 @@ describe.skipIf(MODE === 'record')('web e2e: details panel follows the current S
         await Promise.allSettled(frame.getAnimations().map(animation => animation.finished))
       })
       await expect.poll(() => detailsTrack(page)).toBe(0)
-      await panel.waitFor({ state: 'hidden' })
+      await panel.locator('[data-dockkit-pane]').first().waitFor({ state: 'hidden' })
     }
 
     await select(original, 'LIGHTHOUSE')
     await open()
     await column.locator('[data-sidebar-right-guide-entry="files"]').click()
-    // The content-box panel adds its one rendered border pixel outside the
-    // CSS width assigned by the grid solver.
+    // Pane borders stay inside the grid width; the shared panel owns no border.
     await expect.poll(() => sidebarSnapshot(page), { timeout: 5_000 })
-      .toMatchObject({ mode: 'push', panelContentWidth: normalWidth, panelOuterWidth: normalWidth + 1, resizeHandleWidth: 8 })
+      .toMatchObject({ mode: 'push', panelContentWidth: normalWidth, panelOuterWidth: normalWidth, resizeHandleWidth: 8 })
     await expect.poll(async () => ({
       filesVisible: await column.locator('[data-files-state="tree"]').isVisible(),
       errors: tripwire.pageErrors,
@@ -330,9 +336,9 @@ describe.skipIf(MODE === 'record')('web e2e: details panel follows the current S
     await expect.poll(() => split.isDisabled()).toBe(false)
     await split.click()
     await expect.poll(() => panes.count()).toBe(2)
-    await panes.last().locator('[data-sidebar-right-guide-entry="files"]').click()
-    await panes.first().locator('[data-dockkit-tab]').filter({ hasText: 'Files' }).click()
-    await expect.poll(() => panes.first().locator('[data-files-state="tree"]').count()).toBe(1)
+    await paneAt(column, 1).locator('[data-sidebar-right-guide-entry="files"]').click()
+    await paneAt(column, 0).locator('[data-dockkit-tab]').filter({ hasText: 'Files' }).click()
+    await expect.poll(() => paneAt(column, 0).locator('[data-files-state="tree"]').count()).toBe(1)
     const retainedA = await paneSnapshot(page)
     expect(retainedA.map(pane => pane.tabs.map(tab => tab.title))).toEqual([['Files', 'Start'], ['Files']])
     await checkpoint('A normal: two panes')
diff --git a/apps/web/tests/document-preview.e2e.ts b/apps/web/tests/document-preview.e2e.ts
index d78cf7b464..603569a567 100644
--- a/apps/web/tests/document-preview.e2e.ts
+++ b/apps/web/tests/document-preview.e2e.ts
@@ -89,8 +89,8 @@ describe.skipIf(MODE === 'record')('web e2e: document preview through Files', ()
   let outsideRoot: string | undefined
   let nativeRoot: string | undefined
   let openLog = ''
-  const opened = async (): Promise<Array<{ path: string; action: 'open' | 'reveal' }>> =>
-    (await readFile(openLog, 'utf8')).split('\n').filter(Boolean).map(line => JSON.parse(line) as { path: string; action: 'open' | 'reveal' })
+  const opened = async (): Promise<Array<{ path: string; action: 'open' | 'reveal' | 'application' }>> =>
+    (await readFile(openLog, 'utf8')).split('\n').filter(Boolean).map(line => JSON.parse(line) as { path: string; action: 'open' | 'reveal' | 'application' })
 
   beforeAll(async () => {
     outsideRoot = await mkdtemp(join(tmpdir(), 'dsh-preview-outside-'))
@@ -102,10 +102,34 @@ describe.skipIf(MODE === 'record')('web e2e: document preview through Files', ()
       const command = process.platform === 'darwin' ? 'open' : 'xdg-open'
       await writeFile(join(nativeRoot, command), `#!/usr/bin/env node
 const fs = require('node:fs');
-const path = process.argv[2] === '-R' ? process.argv[3] : process.argv[2];
-const action = process.argv[2] === '-R' || fs.statSync(path).isDirectory() ? 'reveal' : 'open';
+const path = process.argv[2] === '-a' ? process.argv[4] : process.argv[2] === '-R' ? process.argv[3] : process.argv[2];
+const action = process.argv[2] === '-a' ? 'application' : process.argv[2] === '-R' || fs.statSync(path).isDirectory() ? 'reveal' : 'open';
 fs.appendFileSync(${JSON.stringify(openLog)}, JSON.stringify({ path, action }) + '\\n');
 `, { mode: 0o700 })
+      if (process.platform === 'darwin') {
+        const apps = [
+          { id: '/Applications/Test Player.app', name: 'Test Player', default: true, icon: `data:image/png;base64,${TINY_PNG.toString('base64')}` },
+          { id: '/Applications/Other Player.app', name: 'Other Player', default: false, icon: null },
+        ]
+        await writeFile(join(nativeRoot, 'osascript'), `#!/usr/bin/env node\nprocess.stdout.write(${JSON.stringify(JSON.stringify(apps))});\n`, { mode: 0o700 })
+      }
+      if (process.platform === 'linux') {
+        const data = join(nativeRoot, 'data')
+        await mkdir(join(data, 'applications'), { recursive: true })
+        const icon = join(nativeRoot, 'icon.png')
+        await writeFile(icon, TINY_PNG)
+        await writeFile(join(data, 'applications', 'test.desktop'), `[Desktop Entry]\nName=Test Player\nIcon=${icon}\n`)
+        await writeFile(join(data, 'applications', 'other.desktop'), '[Desktop Entry]\nName=Other Player\n')
+        await writeFile(join(nativeRoot, 'gio'), `#!/usr/bin/env node
+const fs = require('node:fs');
+if (process.argv[2] === 'info') process.stdout.write('standard::content-type: video/mp4');
+else if (process.argv[2] === 'mime') process.stdout.write('Default application for video/mp4: test.desktop\\nRegistered applications:\\n  test.desktop\\n  other.desktop\\n');
+else if (process.argv[2] === 'launch') fs.appendFileSync(${JSON.stringify(openLog)}, JSON.stringify({ path: process.argv[4], action: 'application' }) + '\\n');
+else process.exit(1);
+`, { mode: 0o700 })
+        vi.stubEnv('XDG_DATA_HOME', data)
+        vi.stubEnv('XDG_DATA_DIRS', '')
+      }
       vi.stubEnv('PATH', `${nativeRoot}${delimiter}${process.env.PATH ?? ''}`)
     }
     // The Open In rows carry the default-application controls; the SSH marker
@@ -747,13 +771,16 @@ fs.appendFileSync(${JSON.stringify(openLog)}, JSON.stringify({ path, action }) +
     await headerOpen.waitFor({ timeout: 15_000 })
     const emptyOpen = unsupported.locator('[data-textpreview-unsupported] [data-open-path-unpreviewable]')
     await emptyOpen.waitFor({ timeout: 15_000 })
+    const prominent = unsupported.locator('[data-open-target="file"][data-size="large"]')
+    expect((await prominent.boundingBox())?.height).toBe(40)
+    expect((await unsupported.locator('[data-open-path]').boundingBox())?.height).toBe(24)
     await successShot(page, 'unsupported')
     sections.push([
       '## Unviewable binary', '',
       '- State: unsupported',
       `- Line: ${unsupportedLine.trim()}`,
-      `- Header control: ${await headerOpen.innerText()}`,
-      `- Empty-state control: ${await emptyOpen.innerText()}`,
+      `- Header control has no text: ${String(await headerOpen.innerText() === '')}`,
+      `- Empty-state control has text: ${String((await emptyOpen.innerText()).length > 0)}`,
     ].join('\n'))
     if (STUB_OPENER) {
       // Real Host gestures against the stubbed opener: default application from the empty state, reveal from the header menu.
@@ -761,19 +788,32 @@ fs.appendFileSync(${JSON.stringify(openLog)}, JSON.stringify({ path, action }) +
       await emptyOpen.click()
       await expect.poll(async () => (await opened()).length, { timeout: 15_000 }).toBe(1)
       await unsupported.locator('[data-open-path-more]').click()
-      await page.getByRole('menuitem', { name: 'Show file location', exact: true }).click()
+      await page.getByRole('menuitem', { name: /^Show file location/ }).click()
       await expect.poll(async () => (await opened()).length, { timeout: 15_000 }).toBe(2)
       const gestures = await opened()
-      expect(gestures[0]).toEqual({ path: clip, action: 'open' })
+      expect(gestures[0]?.action).toBe('open')
+      expect([clip, cwd]).toContain(gestures[0]?.path)
       expect(gestures[1]?.action).toBe('reveal')
       expect([clip, cwd]).toContain(gestures[1]?.path)
+      if (STUB_OPENER) {
+        await expect.poll(() => headerOpen.locator('img').count()).toBe(1)
+        await prominent.getByRole('button', { name: 'More ways to open' }).click()
+        await page.getByRole('menuitem', { name: 'Test Player (default)', exact: true }).waitFor()
+        await compareOrRefreshGolden(join(SNAPSHOT_DIR, 'applications.expected.md'), await page.getByRole('menu').ariaSnapshot(), MODE)
+        await page.getByRole('menuitem', { name: 'Other Player', exact: true }).click()
+        await expect.poll(async () => (await opened()).length).toBe(3)
+        expect((await opened())[2]).toEqual({ path: clip, action: 'application' })
+        await headerOpen.click()
+        await expect.poll(async () => (await opened()).length).toBe(4)
+        expect((await opened())[3]).toEqual({ path: clip, action: 'open' })
+      }
       // Gesture facts stay out of the golden: the stub does not run on Windows.
       expect(await page.getByRole('alert').count()).toBe(0)
     }
     expect(tripwire.pageErrors).toEqual([])
     expect(tripwire.warnings).toEqual([])
     await compareOrRefreshGolden(EXPECTED, sections.join('\n\n'), MODE)
-    await assertFixtureInventory(SNAPSHOT_DIR, ['document.expected.md', 'paging.patch.yml'])
+    await assertFixtureInventory(SNAPSHOT_DIR, ['document.expected.md', 'applications.expected.md', 'paging.patch.yml'])
   })
 })
 
diff --git a/apps/web/tests/expected/agent-preset-selection/header.expected.md b/apps/web/tests/expected/agent-preset-selection/header.expected.md
index 32b0ea6a2a..2b87066124 100644
--- a/apps/web/tests/expected/agent-preset-selection/header.expected.md
+++ b/apps/web/tests/expected/agent-preset-selection/header.expected.md
@@ -1,6 +1,5 @@
-- navigation "Session hierarchy":
-  - text: Seeded turn /
-  - button "1 subagent"
+- navigation "Session hierarchy": Seeded turn
 - text: Minimal mode
+- button "1 subagent"
 - button "More actions"
 - button "Open right sidebar"
diff --git a/apps/web/tests/expected/input-plugin-extensions.expected.md b/apps/web/tests/expected/input-plugin-extensions.expected.md
new file mode 100644
index 0000000000..512b4d0884
--- /dev/null
+++ b/apps/web/tests/expected/input-plugin-extensions.expected.md
@@ -0,0 +1,5 @@
+- textbox "Describe what you want to build, / commands, @ files or sessions":
+  - paragraph: Draft
+- button "Cancel activity"
+- button "Insert result"
+- button "Send message"
diff --git a/apps/web/tests/fixtures/assembled-remote.fixture.json b/apps/web/tests/fixtures/assembled-remote.fixture.json
index 7a414d0a07..9d0d916a99 100644
--- a/apps/web/tests/fixtures/assembled-remote.fixture.json
+++ b/apps/web/tests/fixtures/assembled-remote.fixture.json
@@ -265,11 +265,6 @@
         "fx-beta": [],
         "fx-gamma": []
       },
-      "jobs": {
-        "fx-alpha": [],
-        "fx-beta": [],
-        "fx-gamma": []
-      },
       "approvals": [],
       "questions": [],
       "projections": {
diff --git a/apps/web/tests/fixtures/plugins/fixture-input-extension/client.js b/apps/web/tests/fixtures/plugins/fixture-input-extension/client.js
new file mode 100644
index 0000000000..6722f15db8
--- /dev/null
+++ b/apps/web/tests/fixtures/plugins/fixture-input-extension/client.js
@@ -0,0 +1,46 @@
+/** A published-protocol consumer of composer activities and bundle activation guidance. */
+window.__ModuleLoader__.load({
+  id: '@fixture/input-extension',
+  factory(require) {
+    const React = require('react')
+    const { Button, Modal, IconApiOutlineRegular } = require('@deepseek-ai/dsh-client-ui-primitives')
+    const h = React.createElement
+    return {
+      inject: ['slots', 'locale'],
+      apply(ctx) {
+        const labels = {
+          start: 'Input activity', cancel: 'Cancel activity', insert: 'Insert result', stale: 'Draft changed',
+          setup: 'Input plugin setup', details: 'Open setup', later: 'Later', config: 'Input plugin configuration',
+        }
+        ctx.effect(() => ctx.locale.register('fixtureInput', { en: labels, zh: labels }))
+        ctx.slots.inject('conversation.input.activity', () => ctx.slots.register({
+          name: 'conversation.input.activity', locale: 'fixtureInput',
+        }, ({ inputActions, onActiveChange, locked, t }) => {
+          const [span, setSpan] = React.useState(null)
+          const [stale, setStale] = React.useState(false)
+          React.useEffect(() => () => onActiveChange(false), [onActiveChange])
+          const close = () => { setSpan(null); setStale(false); onActiveChange(false) }
+          return span === null
+            ? h(Button, { disabled: locked, 'aria-label': t('start'), style: { width: 32, height: 32, padding: 0 }, onClick: () => {
+              setSpan(inputActions.captureInsertion()); onActiveChange(true)
+            } }, h(IconApiOutlineRegular, { size: 16 }))
+            : h('div', null,
+              h(Button, { onClick: close }, t('cancel')),
+              h(Button, { onClick: () => {
+                if (inputActions.insertText(' from plugin', span)) close()
+                else setStale(true)
+              } }, t('insert')),
+              stale ? h('span', { role: 'status' }, t('stale')) : null)
+        }))
+        ctx.slots.inject('plugins.bundle.config', () => ctx.slots.register({
+          name: 'plugins.bundle.config', key: '@fixture/input-extension', locale: 'fixtureInput',
+        }, ({ t }) => h('p', null, t('config'))))
+        ctx.slots.inject('plugins.bundle.activation', () => ctx.slots.register({
+          name: 'plugins.bundle.activation', key: '@fixture/input-extension', locale: 'fixtureInput',
+        }, ({ onDismiss, onOpenDetails, t }) => h(Modal, {
+          open: true, title: t('setup'), closeLabel: t('later'), onClose: onDismiss,
+        }, h(Button, { onClick: onDismiss }, t('later')), h(Button, { onClick: onOpenDetails }, t('details')))))
+      },
+    }
+  },
+})
diff --git a/apps/web/tests/fixtures/plugins/fixture-input-extension/cordis.patch.yml b/apps/web/tests/fixtures/plugins/fixture-input-extension/cordis.patch.yml
new file mode 100644
index 0000000000..b31d3a8fb7
--- /dev/null
+++ b/apps/web/tests/fixtures/plugins/fixture-input-extension/cordis.patch.yml
@@ -0,0 +1,3 @@
+- insert:
+    - id: fixture-input-extension
+      name: '@fixture/input-extension'
diff --git a/apps/web/tests/fixtures/plugins/fixture-input-extension/index.js b/apps/web/tests/fixtures/plugins/fixture-input-extension/index.js
new file mode 100644
index 0000000000..7f53b13ca2
--- /dev/null
+++ b/apps/web/tests/fixtures/plugins/fixture-input-extension/index.js
@@ -0,0 +1,2 @@
+/** Host companion for the optional input extension fixture. */
+export function apply() {}
diff --git a/apps/web/tests/fixtures/plugins/fixture-input-extension/package.json b/apps/web/tests/fixtures/plugins/fixture-input-extension/package.json
new file mode 100644
index 0000000000..5590f85115
--- /dev/null
+++ b/apps/web/tests/fixtures/plugins/fixture-input-extension/package.json
@@ -0,0 +1,12 @@
+{
+  "name": "@fixture/input-extension",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "main": "index.js",
+  "exports": { ".": "./index.js", "./client": "./client.js" },
+  "dsh": {
+    "bundle": { "patch": "./cordis.patch.yml" },
+    "client": { "platform": "web" }
+  }
+}
diff --git a/apps/web/tests/image-display.expected.e2e.ts b/apps/web/tests/image-display.expected.e2e.ts
index adbb742d0b..e3a98dc8f5 100644
--- a/apps/web/tests/image-display.expected.e2e.ts
+++ b/apps/web/tests/image-display.expected.e2e.ts
@@ -171,7 +171,10 @@ it('accepts a whole-page drop under the limits-labeled overlay and refuses an ov
   // desc line carries the projected limits — copy that can only render after
   // the imageLimits projection crossed the RemoteMock transport.
   const image = new File([new Uint8Array([137, 80, 78, 71])], 'dropped.png', { type: 'image/png' })
-  const dataTransfer = { types: ['Files'], files: [image], dropEffect: 'none' }
+  const dataTransfer = {
+    types: ['Files'], files: [image], dropEffect: 'none',
+    items: [{ kind: 'file', getAsFile: () => image, webkitGetAsEntry: () => ({ isDirectory: false }) }],
+  }
   fireEvent.dragEnter(document.body, { dataTransfer })
   const overlay = await screen.findByRole('status')
   expect(overlay.textContent).toContain('Drag files or images here to add them')
diff --git a/apps/web/tests/input-plugin-extensions.e2e.ts b/apps/web/tests/input-plugin-extensions.e2e.ts
new file mode 100644
index 0000000000..cd8548c6f3
--- /dev/null
+++ b/apps/web/tests/input-plugin-extensions.e2e.ts
@@ -0,0 +1,82 @@
+/** Optional input contributions mount through the real Loader and preserve editor ownership. */
+import { fileURLToPath } from 'node:url'
+import { chromium, type Browser } from 'playwright'
+import { expect, it, onTestFinished } from 'vitest'
+import {
+  captureStableAria, compareOrRefreshGolden, launchWebScaffold, watchConsole, webSnapshotMode, type WebScaffold,
+} from './scaffold.ts'
+import { connectFreshWorkspace, newEnglishPage } from './support.ts'
+
+const bundle = fileURLToPath(new URL('./fixtures/plugins/fixture-input-extension', import.meta.url))
+const expected = fileURLToPath(new URL('./expected/input-plugin-extensions.expected.md', import.meta.url))
+
+async function fixture(enabled: boolean) {
+  const resources: { scaffold?: WebScaffold; browser?: Browser } = {}
+  onTestFinished(async () => {
+    try { await resources.browser?.close() } finally { await resources.scaffold?.close() }
+  })
+  const scaffold = await launchWebScaffold({ profile: { packages: [{ dir: bundle, enabled }] } })
+  resources.scaffold = scaffold
+  const browser = await chromium.launch()
+  resources.browser = browser
+  const page = await newEnglishPage(browser), tripwire = watchConsole(page)
+  await page.goto(scaffold.authenticatedUrl)
+  return { scaffold, page, tripwire }
+}
+
+it('expands an input activity and inserts one undoable result without overwriting subsequent edits', async () => {
+  const { scaffold, page, tripwire } = await fixture(true)
+  await connectFreshWorkspace(page, scaffold.workspaceCwd)
+  const input = page.locator('[data-composer-input]')
+  const start = page.getByRole('button', { name: 'Input activity', exact: true })
+  const model = page.getByRole('button', { name: /^Select model, current/ })
+  const send = page.getByRole('button', { name: 'Send message', exact: true })
+  await input.fill('Draft')
+  await input.press('End')
+  for (const width of [1280, 420]) {
+    await page.setViewportSize({ width, height: 900 })
+    await expect.poll(async () => {
+      const activityBox = await start.boundingBox(), modelBox = await model.boundingBox(), sendBox = await send.boundingBox()
+      return activityBox !== null && modelBox !== null && sendBox !== null
+        && activityBox.x >= modelBox.x + modelBox.width && activityBox.x + activityBox.width <= sendBox.x
+    }).toBe(true)
+  }
+  await start.click()
+  expect(await model.isVisible()).toBe(false)
+  expect(await send.isVisible()).toBe(true)
+  await compareOrRefreshGolden(expected,
+    await captureStableAria(page, '[data-composer-card]', scaffold.workspaceCwd), webSnapshotMode())
+  await page.getByRole('button', { name: 'Insert result', exact: true }).click()
+  await expect.poll(() => input.innerText()).toBe('Draft from plugin')
+  await input.press('ControlOrMeta+z')
+  await expect.poll(() => input.innerText()).toBe('Draft')
+  await start.click()
+  await input.fill('Newer draft')
+  await page.getByRole('button', { name: 'Insert result', exact: true }).click()
+  await page.getByRole('status').filter({ hasText: 'Draft changed' }).waitFor()
+  expect(await input.innerText()).toBe('Newer draft')
+  await page.getByRole('button', { name: 'Cancel activity', exact: true }).click()
+  expect(await model.isVisible()).toBe(true)
+  expect(tripwire.pageErrors).toEqual([])
+})
+
+it('offers bundle guidance only after explicit activation and navigates to its configuration', async () => {
+  const { page, tripwire } = await fixture(false)
+  await page.getByRole('button', { name: 'Plugins', exact: true }).click()
+  const toggle = page.getByRole('switch', { name: 'Enable @fixture/input-extension', exact: true })
+  await toggle.waitFor()
+  const dialog = page.getByRole('dialog', { name: 'Input plugin setup', exact: true })
+  expect(await dialog.count()).toBe(0)
+  await toggle.click()
+  await dialog.waitFor()
+  await dialog.getByRole('button', { name: 'Later', exact: true }).last().click()
+  await dialog.waitFor({ state: 'hidden' })
+  expect(await toggle.getAttribute('aria-checked')).toBe('true')
+  await toggle.click()
+  await page.getByRole('switch', { name: 'Enable @fixture/input-extension', exact: true, checked: false }).waitFor()
+  await toggle.click()
+  await dialog.getByRole('button', { name: 'Open setup', exact: true }).click()
+  await page.getByText('Input plugin configuration', { exact: true }).waitFor()
+  expect(await dialog.count()).toBe(0)
+  expect(tripwire.pageErrors).toEqual([])
+})
diff --git a/apps/web/tests/live-job-stream.e2e.ts b/apps/web/tests/live-job-stream.e2e.ts
new file mode 100644
index 0000000000..9aa70ec2bd
--- /dev/null
+++ b/apps/web/tests/live-job-stream.e2e.ts
@@ -0,0 +1,136 @@
+// Session-header job list driven by a real background bash run: the job row
+// arrives over the job roster stream, expanding it opens the output
+// observation stream, and the panel shows the process's real output while it
+// is still running. No model call is involved.
+import { readFile, writeFile } from 'node:fs/promises'
+import { fileURLToPath } from 'node:url'
+import { join } from 'node:path'
+import type { Browser, Page } from 'playwright'
+import { chromium } from 'playwright'
+import { afterAll, beforeAll, describe, expect, it, onTestFailed } from 'vitest'
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import { ToolCallId } from '@deepseek-ai/dsh-llm'
+import { SessionId } from '@deepseek-ai/dsh-session'
+import { JobId } from '@deepseek-ai/dsh-jobs'
+import {
+  assertFixtureInventory, captureStableAria, compareOrRefreshGolden,
+  launchWebScaffold, seedSession, watchConsole, webSnapshotMode, type WebScaffold,
+} from './scaffold.ts'
+import { newEnglishPage, saveFailureShot } from './support.ts'
+
+const FIXTURE = fileURLToPath(new URL('../../../snapshots/web/fresh-round-trip/session.v2.jsonl', import.meta.url))
+const SNAPSHOT_DIR = fileURLToPath(new URL('./snapshots/live-job-stream', import.meta.url))
+const STREAMING_EXPECTED = join(SNAPSHOT_DIR, 'streaming.expected.md')
+const SETTLED_EXPECTED = join(SNAPSHOT_DIR, 'settled.expected.md')
+const MODE = webSnapshotMode()
+const SEED_ID = 'live-job-stream-web-e2e'
+// One fixed line of early output, then a hold on a barrier file the test owns
+// in the job's cwd: the process never exits on its own, so no CI stall can
+// settle it before the scenario kills it. The bounded loop only caps an
+// orphan's lifetime if the runner dies before `afterAll` releases the barrier.
+const RELEASE = '.live-job-stream.release'
+const COMMAND = `printf 'streamed-%s\\n' marker-line; for _ in $(seq 1 3000); do [ -e ${RELEASE} ] && break; sleep 0.2; done`
+
+/**
+ * Wait for opening a session to publish its live Agent.
+ * @param scaffold - the booted web scaffold.
+ * @param sessionId - the opened session's identity.
+ * @returns the registered Agent instance.
+ */
+async function liveAgent(scaffold: WebScaffold, sessionId: SessionId): Promise<Agent> {
+  const deadline = Date.now() + 30_000
+  for (;;) {
+    const found = scaffold.ctx.agents.get(sessionId)
+    if (found !== undefined) return found
+    if (Date.now() > deadline) throw new Error(`opening session "${sessionId}" published no live Agent`)
+    await new Promise(resolve => setTimeout(resolve, 100))
+  }
+}
+
+describe.skipIf(MODE === 'record')('web e2e: live job stream', () => {
+  let scaffold: WebScaffold
+  let browser: Browser
+  let page: Page
+  let tripwire: ReturnType<typeof watchConsole>
+  let agent: Agent
+
+  beforeAll(async () => {
+    scaffold = await launchWebScaffold({})
+    await seedSession(scaffold, await readFile(FIXTURE, 'utf8'), SEED_ID)
+    browser = await chromium.launch()
+    page = await newEnglishPage(browser)
+    tripwire = watchConsole(page)
+    await page.goto(scaffold.authenticatedUrl, { waitUntil: 'load' })
+    await page.waitForSelector('[class*="frame"]', { timeout: 30_000 })
+
+    const groupRow = page.locator('[role="treeitem"]').first()
+    await groupRow.waitFor({ timeout: 15_000 })
+    await groupRow.click()
+    const sessionRow = page.locator('[role="treeitem"]').nth(1)
+    await sessionRow.waitFor({ timeout: 10_000 })
+    await sessionRow.click()
+
+    // Opening the session drives the Host's ordinary Agent resolution; the
+    // job owner must be that exact live instance, never a second one.
+    agent = await liveAgent(scaffold, SessionId(SEED_ID))
+  }, 120_000)
+
+  afterAll(async () => {
+    if (scaffold !== undefined) await writeFile(join(scaffold.workspaceCwd, RELEASE), '')
+    await browser?.close()
+    await scaffold?.close()
+  })
+
+  it('streams a running job\'s real output into the expanded panel, then settles it in place on kill', async () => {
+    let phase = 'streaming'
+    onTestFailed(() => saveFailureShot(page, `web-e2e-live-job-${phase}`))
+    const trigger = page.getByRole('button', { name: '1 background job running' })
+    expect(await trigger.count()).toBe(0)
+
+    const started = await scaffold.ctx.tools.execute({
+      signal: new AbortController().signal,
+      callId: ToolCallId('live-job-stream-e2e'),
+      name: 'bash',
+      arguments: { command: COMMAND, description: 'Emit one live line then hold', run_in_background: true },
+      agent,
+    })
+    const reported = started.content.map(block => block.type === 'text' ? block.text : '').join('')
+    const matched = /\bbash-\d+\b/.exec(reported)
+    if (matched === null) throw new Error(`background bash reported no job id: ${reported}`)
+    const jobId = JobId(matched[0])
+
+    // The job row reaches the header over the job roster stream.
+    await trigger.waitFor({ timeout: 15_000 })
+    await trigger.click()
+
+    // Expanding the row opens the output observation stream; the panel then renders
+    // the command's real stdout while the process is still running.
+    const expand = page.getByRole('button', { name: /Show live output/ })
+    await expand.waitFor({ timeout: 10_000 })
+    await expand.click()
+    await page.getByText('streamed-marker-line').waitFor({ timeout: 15_000 })
+
+    const streaming = await captureStableAria(page, '[class*="menu"]', scaffold.workspaceCwd)
+    await compareOrRefreshGolden(STREAMING_EXPECTED, streaming, MODE)
+    expect(tripwire.pageErrors).toEqual([])
+    expect(tripwire.warnings).toEqual([])
+
+    phase = 'settled'
+    expect(scaffold.ctx.jobs.kill(jobId, agent.id, 'web e2e cancellation')).toBe('requested')
+
+    // Settlement arrives on the observation stream itself, so the open panel
+    // flips without any further interaction; the roster trigger follows.
+    const idle = page.getByRole('button', { name: '1 background job', exact: true })
+    await idle.waitFor({ timeout: 20_000 })
+    await page.getByText('streamed-marker-line').waitFor({ timeout: 10_000 })
+
+    const settled = await captureStableAria(page, '[class*="menu"]', scaffold.workspaceCwd)
+    await compareOrRefreshGolden(SETTLED_EXPECTED, settled, MODE)
+    expect(tripwire.pageErrors).toEqual([])
+    expect(tripwire.warnings).toEqual([])
+  }, 90_000)
+
+  it('keeps its snapshot inventory closed', async () => {
+    await assertFixtureInventory(SNAPSHOT_DIR, ['settled.expected.md', 'streaming.expected.md'])
+  })
+})
diff --git a/apps/web/tests/open-in-app-ssh.e2e.ts b/apps/web/tests/open-in-app-ssh.e2e.ts
index 7323495984..ff57285d88 100644
--- a/apps/web/tests/open-in-app-ssh.e2e.ts
+++ b/apps/web/tests/open-in-app-ssh.e2e.ts
@@ -60,8 +60,7 @@ describe.skipIf(MODE === 'record')('web e2e: Open In under SSH', () => {
     ])
     expect(response.status()).toBe(200)
     expect(await response.json()).toEqual({ apps: [] })
-    expect(await page.getByRole('button', { name: /^Open workspace in / }).count()).toBe(0)
-    expect(await page.getByRole('button', { name: 'Choose an app to open in', exact: true }).count()).toBe(0)
+    expect(await page.locator('[data-open-target="directory"]').count()).toBe(0)
     expect(await page.evaluate(() => localStorage.getItem('dsh.open-in-app.choice'))).toBe('"vscode"')
     const snapshot = (await captureStableAria(page, 'role=banner', scaffold.workspaceCwd))
       .split(SEED_ID).join('{{seededId}}')
diff --git a/apps/web/tests/present-svg.e2e.ts b/apps/web/tests/present-svg.e2e.ts
index 7c856df6f9..461b71e0e3 100644
--- a/apps/web/tests/present-svg.e2e.ts
+++ b/apps/web/tests/present-svg.e2e.ts
@@ -128,7 +128,7 @@ describe('web e2e: requested SVG is explicitly delivered', () => {
 
   it.skipIf(MODE === 'record')('replays the delivered file and Chinese conversation', async () => {
     await assertFinalWorkspaceSnapshot(DIR, cwd)
-    await expect.poll(() => page.getByRole('button', { name: `${FILE} 的更多文件操作`, exact: true }).isDisabled()).toBe(true)
+    expect(await page.locator('[data-presented-file] [data-open-target]').count()).toBe(0)
     // Delivery owns the transcript; navigation and composer chrome have separate scenarios.
     const aria = await captureExpandedTurnProcessAria(page, '[data-chat-flow]', scaffold.workspaceCwd)
     await compareOrRefreshGolden(join(DIR, 'ui.expected.md'), aria, MODE)
diff --git a/apps/web/tests/present.e2e.ts b/apps/web/tests/present.e2e.ts
index 1c4c5fe44f..36d237857a 100644
--- a/apps/web/tests/present.e2e.ts
+++ b/apps/web/tests/present.e2e.ts
@@ -6,6 +6,7 @@ import { chromium, type Browser, type Page } from 'playwright'
 import { unzipSync, strFromU8 } from 'fflate'
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
 import { tmpdir, release } from 'node:os'
+import { createLaunchEnvironmentSnapshot } from '@deepseek-ai/dsh-launch-environment'
 import type { SessionEvent, SessionId } from '@deepseek-ai/dsh-session'
 import type {} from '@deepseek-ai/dsh-tool-present/types'
 import {
@@ -53,10 +54,18 @@ fs.appendFileSync(${JSON.stringify(openLog)}, JSON.stringify({ path, action, con
     vi.stubEnv('PATH', `${nativeRoot}${delimiter}${process.env.PATH ?? ''}`)
     await mkdir(DIR, { recursive: true })
     scaffold = await launchWebScaffold({
+      openInAppEnvironment: createLaunchEnvironmentSnapshot([{ source: 'process', values: { SSH_CONNECTION: '10.0.0.2 55000 10.0.0.9 22' } }]),
       extraOverlayPath: fileURLToPath(new URL('./present.overlay.yml', import.meta.url)),
       agentPresets: { roots: [], default: 'ptc' }, compareReplaySession: true,
       ...(MODE === 'record' ? {} : { replayFixture: FIXTURE }),
     })
+    // File associations belong to the desktop rather than the recorded Session.
+    const controller = scaffold.ctx.get('sessionController')
+    if (controller === undefined) throw new Error('present requires Session Controller')
+    const nativeQuery: unknown = Reflect.get(controller, 'fileApplications')
+    if (typeof nativeQuery !== 'function') throw new Error('present requires native association discovery')
+    Reflect.set(controller, 'fileApplications', async () => [{ id: 'test-editor', name: 'Test Editor', default: true, icon: null }])
+    scaffold.ctx.effect(() => () => { Reflect.set(controller, 'fileApplications', nativeQuery) }, 'present: native association fixture')
     disposeApproval = scaffold.ctx.on('approval/request', () => Promise.resolve('allowed-once'), { prepend: true })
     scaffold.ctx.on('session/event', (_session, event) => { events.push(event) })
     browser = await chromium.launch()
@@ -121,8 +130,20 @@ fs.appendFileSync(${JSON.stringify(openLog)}, JSON.stringify({ path, action, con
       }
       const row = page.locator('[data-presented-files-row]')
       await row.waitFor()
-      expect(await row.getByRole('button', { name: /More file actions/ }).count()).toBe(2)
+      await expect.poll(() => row.getByRole('button', { name: 'More ways to open' }).count()).toBe(2)
       expect(await row.getByText('report.txt', { exact: true }).innerText()).toBe('report.txt')
+      const card = row.locator('[data-presented-file]').filter({ hasText: 'report.txt' })
+      await card.getByRole('button', { name: 'Open in Test Editor', exact: true }).hover()
+      await page.getByRole('tooltip', { name: 'Open in Test Editor', exact: true }).waitFor()
+      expect(await page.getByRole('tooltip').evaluate((tooltip) => {
+        const rect = tooltip.getBoundingClientRect()
+        const previous = tooltip.style.pointerEvents
+        tooltip.style.pointerEvents = 'auto'
+        const visible = document.elementFromPoint(rect.left + rect.width / 2, rect.bottom - 1) === tooltip
+        tooltip.style.pointerEvents = previous
+        return tooltip.parentElement === document.body && visible
+      })).toBe(true)
+      await page.mouse.move(0, 0)
       const beforePreview = (await opened()).length
       const column = page.locator('[data-rightbar-col]')
       for (const [name, content] of [['report.txt', 'EDITED_REPORT'], ['说明.txt', 'EDITED_NOTE']] as const) {
@@ -139,19 +160,16 @@ fs.appendFileSync(${JSON.stringify(openLog)}, JSON.stringify({ path, action, con
       expect(downloads).toEqual([])
       await page.getByRole('button', { name: 'Collapse right sidebar', exact: true }).click()
       const beforeReveal = (await opened()).length
-      await row.getByRole('button', { name: 'More file actions for report.txt', exact: true }).click()
+      await row.locator('[data-presented-file]').filter({ hasText: 'report.txt' }).getByRole('button', { name: 'More ways to open', exact: true }).click()
       const revealResponse = page.waitForResponse(response => response.url().includes('action=reveal') && response.request().method() === 'POST')
-      await page.getByRole('menuitem', { name: process.platform === 'darwin' ? /Show in Finder/ : /Open containing folder/ }).click()
+      await page.getByRole('menuitem', { name: 'Show file location', exact: true }).click()
       expect((await revealResponse).status()).toBe(204)
-      expect(await row.getByRole('button', { name: 'Open report.txt in sidebar', exact: true })
-        .evaluate(button => button === document.activeElement)).toBe(true)
       await expect.poll(opened).toHaveLength(beforeReveal + 1)
       expect((await opened()).at(-1)).toEqual({ action: 'reveal', content: null, path: await realpath(process.platform === 'darwin' ? join(cwd, 'report.txt') : cwd) })
       for (const [name, bytes] of [['report.txt', 'EDITED_REPORT\n'], ['说明.txt', 'EDITED_NOTE\n']] as const) {
         const count = (await opened()).length
         const response = page.waitForResponse(response => response.url().includes('/api/present.open?') && response.request().method() === 'POST')
-        await row.getByRole('button', { name: `More file actions for ${name}`, exact: true }).click()
-        await page.getByRole('menuitem', { name: 'Open in default app', exact: true }).click()
+        await row.locator('[data-presented-file]').filter({ hasText: name }).getByRole('button', { name: 'Open in Test Editor', exact: true }).click()
         expect((await response).status()).toBe(204)
         await page.waitForFunction(() => document.querySelector('[data-presented-files-row] button:disabled') === null)
         expect(await opened()).toHaveLength(count + 1)
@@ -174,6 +192,7 @@ fs.appendFileSync(${JSON.stringify(openLog)}, JSON.stringify({ path, action, con
     ])
     expect(exported).not.toContain('EDITED_REPORT')
     if (MODE !== 'record') {
+      await expect.poll(() => page.locator('[data-presented-file] [role="status"]').count(), { timeout: 10_000 }).toBe(0)
       const aria = await captureExpandedTurnProcessAria(page, '[class*="centerCol"]', scaffold.workspaceCwd)
       await compareOrRefreshGolden(join(DIR, 'ui.expected.md'), aria, MODE)
       await page.locator('[data-turn-process]').click()
@@ -215,9 +234,9 @@ fs.appendFileSync(${JSON.stringify(openLog)}, JSON.stringify({ path, action, con
               .find(element => element.textContent === 'report.txt'),
           'report title',
         )
-        const description = requiredElement(report.querySelector<HTMLElement>('span[role="status"]'), 'report status')
+        const description = requiredElement(report.querySelector<HTMLElement>('[data-presented-description]'), 'report description')
         const open = requiredElement(
-          report.querySelector<HTMLButtonElement>('button[aria-label="Open report.txt in sidebar"]'),
+          report.querySelector<HTMLButtonElement>('[data-open-target] button'),
           'report open action',
         )
         const icon = requiredElement(report.querySelector<SVGElement>('svg'), 'report icon')
@@ -250,7 +269,7 @@ fs.appendFileSync(${JSON.stringify(openLog)}, JSON.stringify({ path, action, con
       expect(geometry.iconWidth).toBe('20')
       expect(geometry.titleFontSize).toBe('13px')
       expect(geometry.descriptionFontSize).toBe('10px')
-      expect(geometry.openFontSize).toBe('12px')
+      expect(geometry.openFontSize).toBe('11px')
       await page.setViewportSize({ width: 480, height: 900 })
       const row = page.locator('[data-presented-files-row]')
       await row.scrollIntoViewIfNeeded()
@@ -263,9 +282,9 @@ fs.appendFileSync(${JSON.stringify(openLog)}, JSON.stringify({ path, action, con
     }
     const beforeDelete = (await opened()).length
     await unlink(join(cwd, 'report.txt'))
-    const missing = page.waitForResponse(response => response.url().includes('/api/present.open?'))
-    await page.locator('[data-presented-files-row]').getByRole('button', { name: 'More file actions for report.txt', exact: true }).click()
-    await page.getByRole('menuitem', { name: 'Open in default app', exact: true }).click()
+    const missing = page.waitForResponse(response => response.url().includes('/api/present.open?') && response.request().method() === 'POST')
+    await page.locator('[data-presented-file]').filter({ hasText: 'report.txt' })
+      .getByRole('button', { name: 'Open in Test Editor', exact: true }).click()
     expect((await missing).status()).toBe(404)
     await page.getByText('Could not open. Click to retry.', { exact: true }).waitFor()
     expect(await opened()).toHaveLength(beforeDelete)
diff --git a/apps/web/tests/scaffold.ts b/apps/web/tests/scaffold.ts
index 7cf05dd30a..90f6387c7d 100644
--- a/apps/web/tests/scaffold.ts
+++ b/apps/web/tests/scaffold.ts
@@ -305,8 +305,8 @@ export interface LaunchOptions {
   developerTools?: boolean
   /** Enable the real Open In rows with deterministic launch-environment facts. */
   openInAppEnvironment?: LaunchEnvironmentSnapshot
-  /** Compare the replayed root session with `replayFixture`; defaults on for a manifest-owned canonical recording. */
-  compareReplaySession?: boolean
+  /** Compare the replayed root Session; `read-only` also forbids refresh writes to a borrowed fixture. */
+  compareReplaySession?: boolean | 'read-only'
   /**
    * Optional product overlay applied after the shipped Web surface and before
    * the scaffold's hermetic test patches, matching the launcher's `--patch`
@@ -965,7 +965,7 @@ export async function launchWebScaffold(options: LaunchOptions = {}): Promise<We
           await assertReplaySession(
             [...observedSessions.values()],
             replayFixture,
-            mode,
+            compareReplaySession === 'read-only' ? 'replay' : mode,
             `http://${browserHost}:${port}`,
             harnessHome,
           )
diff --git a/apps/web/tests/seeded-history.e2e.ts b/apps/web/tests/seeded-history.e2e.ts
index e63471911d..969ade598a 100644
--- a/apps/web/tests/seeded-history.e2e.ts
+++ b/apps/web/tests/seeded-history.e2e.ts
@@ -228,6 +228,13 @@ describe('web e2e: seeded history renders through cold resume', () => {
       ],
       openInAppEnvironment: createLaunchEnvironmentSnapshot([{ source: 'process', values: { SSH_CONNECTION: '10.0.0.2 55000 10.0.0.9 22' } }]),
     })
+    // Application registrations belong to the host desktop, not to the recorded Session.
+    const controller = scaffold.ctx.get('sessionController')
+    if (controller === undefined) throw new Error('seeded-history requires Session Controller')
+    const nativeQuery: unknown = Reflect.get(controller, 'fileApplications')
+    if (typeof nativeQuery !== 'function') throw new Error('seeded-history requires the native file-association adapter')
+    Reflect.set(controller, 'fileApplications', async () => [])
+    scaffold.ctx.effect(() => () => { Reflect.set(controller, 'fileApplications', nativeQuery) }, 'seeded-history: native association fixture')
     // Composer recording uses a child workspace; seedSession owns the scaffold root.
     const sessionCwd = MODE === 'record' ? join(scaffold.workspaceCwd, 'workspace') : scaffold.workspaceCwd
     await mkdir(sessionCwd, { recursive: true })
@@ -518,7 +525,8 @@ describe('web e2e: seeded history renders through cold resume', () => {
       await expect.poll(() => path.textContent()).toBe(absolutePath)
       expect(await path.getAttribute('title')).toBe(absolutePath)
       await expect.poll(() => column.locator('[data-textpreview-line="1"]').textContent()).toBe('alpha\n')
-      await column.locator('[data-open-path-open]').waitFor({ timeout: 5_000 })
+      await column.getByRole('button', { name: 'Show file location', exact: true }).waitFor({ timeout: 5_000 })
+      await expect.poll(() => column.locator('[data-open-path-open]').isEnabled()).toBe(true)
       const preview = await captureStableAria(page, '[data-textpreview-state="text"]', scaffold.workspaceCwd)
       await compareOrRefreshGolden(FILE_PREVIEW_EXPECTED, preview, MODE)
     } finally {
diff --git a/apps/web/tests/sidebar-right.e2e.ts b/apps/web/tests/sidebar-right.e2e.ts
index 90571db3f4..af37b968e1 100644
--- a/apps/web/tests/sidebar-right.e2e.ts
+++ b/apps/web/tests/sidebar-right.e2e.ts
@@ -85,17 +85,24 @@ async function pointIn(locator: Locator, fx: number, fy: number): Promise<{ x: n
   return { x: box.x + box.width * fx, y: box.y + box.height * fy }
 }
 
-/** Pause the panel's next real transform transition after observing its initial frame geometry. */
+/** Select panes by CSS column; retained tab hosts keep their independent DOM order. */
+function paneAt(column: Locator, index: number): Locator {
+  return column.locator(`[data-dockkit-pane][data-dockkit-column="${index}"]`)
+}
+
+/** Pause a docked host's next real transform transition at its midpoint. */
 async function holdPanelSlide(panel: Locator) {
   return await panel.evaluateHandle((node) => {
     const controller = new AbortController()
     const state = { animation: null as Animation | null, columnsAtStart: '', dispose: () => { controller.abort() } }
     node.addEventListener('transitionrun', (event) => {
-      if (event.target !== node || (event as TransitionEvent).propertyName !== 'transform') return
+      const target = event.target
+      if (!(target instanceof Element) || !target.matches('[data-dockkit-host="dock"]')
+        || (event as TransitionEvent).propertyName !== 'transform') return
       const frame = node.closest('[style*="grid-template-columns"]')
       if (frame === null) throw new Error('panel frame is unavailable')
       state.columnsAtStart = getComputedStyle(frame).gridTemplateColumns
-      const slide = node.getAnimations().find(animation =>
+      const slide = target.getAnimations().find(animation =>
         'transitionProperty' in animation && animation.transitionProperty === 'transform')
       if (slide === undefined || slide.effect === null) throw new Error('panel transform transition is unavailable')
       slide.pause()
@@ -494,7 +501,9 @@ describe('web e2e: shipped right Sidebar', () => {
       await expect.poll(() => panel.boundingBox()).toEqual({ x: 0, y: 0, ...viewport })
       await column.locator('[data-sidebar-right-toggle]').click()
       await Promise.all([
-        panel.evaluate(async (node) => { await Promise.allSettled(node.getAnimations().map(animation => animation.finished)) }),
+        panel.evaluate(async (node) => {
+          await Promise.allSettled(node.getAnimations({ subtree: true }).map(animation => animation.finished))
+        }),
         frame.evaluate(async (node) => { await Promise.allSettled(node.getAnimations().map(animation => animation.finished)) }),
       ])
       const closedColumns = (await geometry()).columns
@@ -507,7 +516,7 @@ describe('web e2e: shipped right Sidebar', () => {
       try {
         await expandOf(page).click()
         await expect.poll(() => held.evaluate(state => state.animation?.playState)).toBe('paused')
-        const entering = await panel.boundingBox()
+        const entering = await paneAt(column, 0).boundingBox()
         if (entering === null) throw new Error('entering panel is not rendered')
         expect(entering.x).toBeGreaterThan(0)
         expect(entering.x).toBeLessThan(viewport.width)
@@ -525,7 +534,7 @@ describe('web e2e: shipped right Sidebar', () => {
           await column.locator('[data-sidebar-right-toggle]').click()
           await expect.poll(() => exit.evaluate(state => state.animation?.playState)).toBe('paused')
           expect(await exit.evaluate(state => state.columnsAtStart)).toBe(closedColumns)
-          const leaving = await panel.boundingBox()
+          const leaving = await paneAt(column, 0).boundingBox()
           if (leaving === null) throw new Error('leaving panel is not rendered')
           expect(leaving.x).toBeGreaterThan(0)
           expect(leaving.x).toBeLessThan(viewport.width)
@@ -719,7 +728,7 @@ describe('web e2e: shipped right Sidebar', () => {
       onTestFailed(() => saveFailureShot(page, 'web-e2e-sidebar-right-content'))
       const column = page.locator('[data-rightbar-col]')
       const panes = column.locator('[data-dockkit-pane]')
-      const floats = page.locator('[data-sidebar-right-float-host] [data-dockkit-float]')
+      const floats = page.locator('[data-sidebar-right-session]:not([hidden]) [data-dockkit-float]')
 
       // Observation before action: does the read ever leave the browser? The
       // assertion states the healthy answer so a failure prints the real one.
@@ -751,7 +760,7 @@ describe('web e2e: shipped right Sidebar', () => {
       await expect.poll(async () => await tabTitles(column)).toEqual(['Files', SAMPLE_NAME])
 
       // Opening the same content again focuses rather than duplicating.
-      await panes.first().locator('[data-dockkit-tab]').first().click()
+      await paneAt(column, 0).locator('[data-dockkit-tab]').first().click()
       await chip.click()
       await expect.poll(async () => await tabTitles(column)).toEqual(['Files', SAMPLE_NAME])
 
@@ -776,20 +785,20 @@ describe('web e2e: shipped right Sidebar', () => {
       expect(await folders.count()).toBe(await page.locator('[data-changed-files]').getByRole('button', { name: /folder/i }).count())
 
       // Split, then dock-drag: the kit's gestures drive the store's actions.
-      await panes.first().locator('[data-dockkit-split-button]').click()
+      await paneAt(column, 0).locator('[data-dockkit-split-button]').click()
       await expect.poll(async () => await panes.count()).toBe(2)
       await dragTo(
         page,
         column.locator('[data-dockkit-tab]').filter({ hasText: SAMPLE_NAME }).first(),
-        await pointIn(panes.nth(1), 0.5, 0.94),
+        await pointIn(paneAt(column, 1), 0.5, 0.94),
       )
       await expect.poll(async () => await panes.count()).toBe(2)
 
-      const splitGuide = panes.nth(1).locator('[data-dockkit-tab]').filter({ hasText: 'Start' })
+      const splitGuide = paneAt(column, 1).locator('[data-dockkit-tab]').filter({ hasText: 'Start' })
       expect(await splitGuide.locator('[data-dockkit-tab-close]').count()).toBe(1)
-      await dragTo(page, splitGuide, await pointIn(panes.first(), 0.5, 0.5))
-      await expect.poll(async () => await tabTitles(panes.nth(1))).toEqual([SAMPLE_NAME])
-      const movedGuide = panes.first().locator('[data-dockkit-tab]').filter({ hasText: 'Start' })
+      await dragTo(page, splitGuide, await pointIn(paneAt(column, 0), 0.5, 0.5))
+      await expect.poll(async () => await tabTitles(paneAt(column, 1))).toEqual([SAMPLE_NAME])
+      const movedGuide = paneAt(column, 0).locator('[data-dockkit-tab]').filter({ hasText: 'Start' })
       await movedGuide.hover()
       await movedGuide.locator('[data-dockkit-tab-close]').click()
 
@@ -798,12 +807,15 @@ describe('web e2e: shipped right Sidebar', () => {
       await expect.poll(async () => await filePane.locator('[data-dockkit-add-tab]').count()).toBe(1)
       expect(await column.locator('[data-dockkit-add-tab]').count()).toBe(2)
 
-      // Floating leaves the column entirely, and survives collapsing it. The
-      // pane the tab was alone in goes with it: an emptied pane never stays.
+      // A float stays in the DOM column but draws outside it and survives collapse.
       const tab = column.locator('[data-dockkit-tab]').filter({ hasText: SAMPLE_NAME }).first()
       await floatByDrag(page, tab)
       await expect.poll(async () => await floats.count()).toBe(1)
-      expect(await column.locator('[data-dockkit-float]').count()).toBe(0)
+      expect(await column.locator('[data-dockkit-float]').count()).toBe(1)
+      const floatBox = await floats.first().boundingBox()
+      const columnBox = await column.boundingBox()
+      if (floatBox === null || columnBox === null) throw new Error('float or column is not rendered')
+      expect(floatBox.x).toBeLessThan(columnBox.x)
       await expect.poll(async () => await panes.count()).toBe(1)
       await shot(page, '04-split-and-float')
 
@@ -891,7 +903,7 @@ describe('web e2e: shipped right Sidebar', () => {
       onTestFailed(() => saveFailureShot(page, 'web-e2e-sidebar-right-gestures'))
       const column = await resetSidebar(page)
       const panes = column.locator('[data-dockkit-pane]')
-      const floats = page.locator('[data-sidebar-right-float-host] [data-dockkit-float]')
+      const floats = page.locator('[data-sidebar-right-session]:not([hidden]) [data-dockkit-float]')
 
       // Chromium cancels pointer capture if a render replaces the pressed
       // element; jsdom cannot establish that the whole gesture survives.
@@ -899,7 +911,7 @@ describe('web e2e: shipped right Sidebar', () => {
       // 1. Reorder inside one strip: drop the last tab left of its neighbours.
       //    The first pane needs two tabs for this — and for the move below to
       //    leave it standing, since a pane emptied by a move is dropped.
-      const first = panes.first()
+      const first = paneAt(column, 0)
       const strip = first.locator('[data-dockkit-strip]')
       await proseChip(page).click()
       await expect.poll(async () => await tabTitles(first)).toEqual(['Files', SAMPLE_NAME])
@@ -918,8 +930,8 @@ describe('web e2e: shipped right Sidebar', () => {
       }
       const moving = first.locator('[data-dockkit-tab]').first()
       const title = await moving.locator('[data-dockkit-tab-title]').innerText()
-      await dragTo(page, moving, await pointIn(panes.nth(1), 0.5, 0.5))
-      await expect.poll(async () => await tabTitles(panes.nth(1))).toContain(title)
+      await dragTo(page, moving, await pointIn(paneAt(column, 1), 0.5, 0.5))
+      await expect.poll(async () => await tabTitles(paneAt(column, 1))).toContain(title)
 
       const splitButtons = column.locator('[data-dockkit-split-button]')
       await expect.poll(async () => await splitButtons.count()).toBe(0)
@@ -928,14 +940,14 @@ describe('web e2e: shipped right Sidebar', () => {
       await expect.poll(async () => await splitButtons.count()).toBe(0)
 
       const outer = column.locator('[data-dockkit-divider]').first()
-      const before = await width(panes.last())
+      const before = await width(paneAt(column, 1))
       const grip = await centre(outer)
       await dragElement(page, outer, { x: grip.x - 100, y: grip.y })
-      await expect.poll(async () => await width(panes.last())).toBeGreaterThan(before)
+      await expect.poll(async () => await width(paneAt(column, 1))).toBeGreaterThan(before)
       await dragElement(page, outer, { x: 0, y: grip.y })
       const ratio = async (): Promise<number> => {
-        const left = await width(panes.first())
-        const right = await width(panes.last())
+        const left = await width(paneAt(column, 0))
+        const right = await width(paneAt(column, 1))
         return left / (left + right)
       }
       await expect.poll(ratio).toBeCloseTo(0.2, 2)
@@ -947,7 +959,7 @@ describe('web e2e: shipped right Sidebar', () => {
       expect(await splitButtons.count()).toBe(0)
 
       // 5. The split's guide and the document float while Files stays docked.
-      const floatOne = panes.last().locator('[data-dockkit-tab]').filter({ hasText: SAMPLE_NAME })
+      const floatOne = paneAt(column, 1).locator('[data-dockkit-tab]').filter({ hasText: SAMPLE_NAME })
       await floatByDrag(page, floatOne)
       await expect.poll(async () => await floats.count()).toBe(1)
       const box = await floats.first().boundingBox()
@@ -955,8 +967,8 @@ describe('web e2e: shipped right Sidebar', () => {
       await dragElement(page, floats.first().locator('[data-dockkit-float-grip]'), { x: box.x + 140, y: box.y + 90 })
       await expect.poll(async () => (await floats.first().boundingBox())?.x ?? box.x).not.toBe(box.x)
 
-      await expect.poll(async () => await tabTitles(panes.last())).toEqual(['Start'])
-      const second = panes.last().locator('[data-dockkit-tab]').filter({ hasText: 'Start' })
+      await expect.poll(async () => await tabTitles(paneAt(column, 1))).toEqual(['Start'])
+      const second = paneAt(column, 1).locator('[data-dockkit-tab]').filter({ hasText: 'Start' })
       await floatByDrag(page, second)
       await expect.poll(async () => await floats.count()).toBe(2)
 
@@ -976,14 +988,14 @@ describe('web e2e: shipped right Sidebar', () => {
       const panes = column.locator('[data-dockkit-pane]')
       expect(await column.locator('[data-dockkit-tab-close]').count()).toBe(1)
       await proseChip(page).click()
-      await expect.poll(async () => await tabTitles(panes.first())).toEqual(['Files', SAMPLE_NAME])
-      await panes.first().locator('[data-dockkit-split-button]').click()
+      await expect.poll(async () => await tabTitles(paneAt(column, 0))).toEqual(['Files', SAMPLE_NAME])
+      await paneAt(column, 0).locator('[data-dockkit-split-button]').click()
       await expect.poll(async () => await panes.count()).toBe(2)
 
       // Closing a pane's last tab drops the pane: there is no separate
       // "close pane" gesture, and none is needed.
-      await panes.nth(1).locator('[data-dockkit-tab]').first().hover()
-      await panes.nth(1).locator('[data-dockkit-tab-close]').first().click()
+      await paneAt(column, 1).locator('[data-dockkit-tab]').first().hover()
+      await paneAt(column, 1).locator('[data-dockkit-tab-close]').first().click()
       await expect.poll(async () => await panes.count()).toBe(1)
       await expect.poll(async () => await tabTitles(column)).toEqual(['Files', SAMPLE_NAME])
 
diff --git a/apps/web/tests/skill-tool-row.e2e.ts b/apps/web/tests/skill-tool-row.e2e.ts
index 628803ad48..1b6a9e7f10 100644
--- a/apps/web/tests/skill-tool-row.e2e.ts
+++ b/apps/web/tests/skill-tool-row.e2e.ts
@@ -8,11 +8,12 @@ import { chromium } from 'playwright'
 import { afterAll, beforeAll, describe, expect, it, onTestFailed } from 'vitest'
 import {
   assertFixtureInventory, captureStableAria, compareOrRefreshGolden, fixtureUserPrompts,
-  launchWebScaffold, seedSession, watchConsole, webSnapshotMode, type WebScaffold,
+  launchWebScaffold, seedSession, selectedSessionFixture, watchConsole, webSnapshotMode, type WebScaffold,
 } from './scaffold.ts'
 import { expandOwningTurnProcess, newEnglishPage, saveFailureShot } from './support.ts'
 
-const FIXTURE = fileURLToPath(new URL('../../../snapshots/session/skill-load/session.v3.jsonl', import.meta.url))
+// Any generation path names the role; the owner's highest committed generation replays.
+const FIXTURE = fileURLToPath(new URL('../../../snapshots/session/skill-load/session.v4.jsonl', import.meta.url))
 const SNAPSHOT_DIR = fileURLToPath(new URL('../../../snapshots/web/skill-tool-row', import.meta.url))
 const UI_EXPECTED = fileURLToPath(new URL('../../../snapshots/web/skill-tool-row/ui.expected.md', import.meta.url))
 const MODE = webSnapshotMode()
@@ -26,7 +27,7 @@ describe.skipIf(MODE === 'record')('web e2e: dedicated Skill tool row', () => {
   let tripwire: ReturnType<typeof watchConsole>
 
   beforeAll(async () => {
-    const fixture = await readFile(FIXTURE, 'utf8')
+    const fixture = await readFile(await selectedSessionFixture(FIXTURE), 'utf8')
     expect(fixtureUserPrompts(fixture)).toEqual([PROMPT])
     scaffold = await launchWebScaffold({})
     await seedSession(scaffold, fixture, SEED_ID)
diff --git a/apps/web/tests/snapshots/live-job-stream/settled.expected.md b/apps/web/tests/snapshots/live-job-stream/settled.expected.md
new file mode 100644
index 0000000000..ada83b7f3e
--- /dev/null
+++ b/apps/web/tests/snapshots/live-job-stream/settled.expected.md
@@ -0,0 +1,6 @@
+- list "Background jobs":
+  - listitem:
+    - button "Hide live output of printf 'streamed-%s\\n' marker-line; for _ in $(seq 1 3000); do [ -e .live-job-stream.release ] && break; sleep 0.2; done" [expanded]: "bash printf 'streamed-%s\\n' marker-line; for _ in $(seq 1 3000); do [ -e .live-job-stream.release ] && break; sleep 0.2; done signal: SIGTERM; web e2e cancellation {{duration}}"
+    - text: $ printf 'streamed-%s\n' marker-line; for _ in $(seq 1 3000); do [ -e .live-job-stream.release ] && break; sleep 0.2; done
+    - button "Copy"
+    - text: streamed-marker-line
diff --git a/apps/web/tests/snapshots/live-job-stream/streaming.expected.md b/apps/web/tests/snapshots/live-job-stream/streaming.expected.md
new file mode 100644
index 0000000000..566aea30c0
--- /dev/null
+++ b/apps/web/tests/snapshots/live-job-stream/streaming.expected.md
@@ -0,0 +1,6 @@
+- list "Background jobs":
+  - listitem:
+    - button "Hide live output of printf 'streamed-%s\\n' marker-line; for _ in $(seq 1 3000); do [ -e .live-job-stream.release ] && break; sleep 0.2; done" [expanded]: printf 'streamed-%s\n' marker-line; for _ in $(seq 1 3000); do [ -e .live-job-stream.release ] && break; sleep 0.2; done {{duration}} bash running
+    - text: $ printf 'streamed-%s\n' marker-line; for _ in $(seq 1 3000); do [ -e .live-job-stream.release ] && break; sleep 0.2; done
+    - button "Copy"
+    - text: streamed-marker-line
diff --git a/apps/web/tsconfig.json b/apps/web/tsconfig.json
index 719f04f24d..30e2d212b5 100644
--- a/apps/web/tsconfig.json
+++ b/apps/web/tsconfig.json
@@ -51,6 +51,7 @@
     "tests/office-fixture.ts",
     "tests/sidebar-browser.e2e.ts",
     "tests/plugin-config.e2e.ts",
+    "tests/input-plugin-extensions.e2e.ts",
     "tests/plugin-manager.e2e.ts",
     "tests/plugin-install-cancel.e2e.ts",
     "tests/plugin-install-approve.e2e.ts",
@@ -135,6 +136,7 @@
     "tests/subagent-interrupt-ui.e2e.ts",
     "tests/sidebar-subagent-activity.e2e.ts",
     "tests/background-job-list.e2e.ts",
+    "tests/live-job-stream.e2e.ts",
     "tests/auto-review-denial.e2e.ts",
     "tests/bash-abort-row.e2e.ts",
     "tests/skill-tool-row.e2e.ts",
diff --git a/docs/architecture.i18n.yaml b/docs/architecture.i18n.yaml
index a63b916549..a31bcf99da 100644
--- a/docs/architecture.i18n.yaml
+++ b/docs/architecture.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/architecture.md
-architecture.md: 9b0daeef5ab95335d650ea987cd4588f28d3f870
-architecture.zh.md: 0d8581063d43723a8fdbf4190ec468f6de103a27
+architecture.md: 514bd52cfa8f50fe8cf73c391094d34942b3cca3
+architecture.zh.md: 848fa1b3810403e4a3906ac491c8552052e4ee4e
diff --git a/docs/architecture.md b/docs/architecture.md
index 9b0daeef5a..514bd52cfa 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -146,7 +146,7 @@ New behavior attaches to a documented extension point. Changing the loop itself
 | Add shell execution | register a `ctx.shell` backend; the local one spawns through `ctx.subprocess` |
 | Add persistent terminal execution | register a `ctx.terminals` backend plus `dsh-tool-terminal` |
 | Add a human command | register on `ctx.commands`; it dispatches without a model turn |
-| Add background work | register on `ctx.jobs`; `job_*` tools collect or stop it |
+| Manage background jobs | register on `ctx.jobs`; `job_*` tools read or stop jobs |
 | Start a Session from an external webhook | register a trusted rule on `ctx.webhookRuntime` and mount a provider adapter |
 | Add filesystem access or policy | register a `ctx.fs` provider or listen to `fs/*` events |
 | Confine spawned processes | use a `ctx.sandbox` backend; consumers wrap argv before spawning |
diff --git a/docs/architecture.zh.md b/docs/architecture.zh.md
index 0d8581063d..848fa1b381 100644
--- a/docs/architecture.zh.md
+++ b/docs/architecture.zh.md
@@ -150,7 +150,7 @@ seam 正是替换一个提供方就能改变整个产品的原因。文件系统
 | 添加 shell 执行 | 注册 `ctx.shell` 后端；本地后端通过 `ctx.subprocess` spawn 进程 |
 | 添加持久化终端执行 | 注册 `ctx.terminals` 后端和 `dsh-tool-terminal` |
 | 添加用户命令 | 在 `ctx.commands` 上注册；它无需模型轮次即可分派 |
-| 添加后台工作 | 在 `ctx.jobs` 上注册；`job_*` 工具负责收集或停止 |
+| 管理后台任务 | 在 `ctx.jobs` 上注册；`job_*` 工具读取或停止任务 |
 | 从外部 webhook 启动 Session | 在 `ctx.webhookRuntime` 上注册可信规则，并挂载提供方适配器 |
 | 添加文件系统访问或策略 | 注册 `ctx.fs` 提供方，或监听 `fs/*` 事件 |
 | 限制所启动的进程 | 使用 `ctx.sandbox` 后端；消费方在启动进程前包装 argv |
diff --git a/docs/capability-seams.i18n.yaml b/docs/capability-seams.i18n.yaml
index 8c28ee4357..b5c8b49223 100644
--- a/docs/capability-seams.i18n.yaml
+++ b/docs/capability-seams.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/capability-seams.md
-capability-seams.md: edb8cd688768ec49ee3699c3775409a66975129d
-capability-seams.zh.md: b06d9378616669407b79ffa1da205924ff6ad757
+capability-seams.md: eea821874c1932d7daa5f0a2aec3f18653757142
+capability-seams.zh.md: c7794eae7bfd6456b7878a5b98a27fdec9f2adab
diff --git a/docs/capability-seams.md b/docs/capability-seams.md
index edb8cd6887..eea821874c 100644
--- a/docs/capability-seams.md
+++ b/docs/capability-seams.md
@@ -67,6 +67,8 @@ flowchart LR
   svc_sessionController["ctx.sessionController<br/>Host Session Remote controller"]
   svc_sessionFileReferences["ctx.sessionFileReferences<br/>Session-addressed file-reference Remote adapter"]
   svc_sessionSkillCatalog["ctx.sessionSkillCatalog<br/>Session-addressed skill Remote adapter"]
+  pkg_api_job_controller["api-job-controller"]
+  svc_jobController["ctx.jobController<br/>Host job Remote controller"]
   pkg_api_settings_controller["api-settings-controller"]
   svc_credentialsController["ctx.credentialsController<br/>Host credential-surface Remote controller"]
   svc_settingsController["ctx.settingsController<br/>Host settings-surface Remote controller"]
@@ -259,6 +261,7 @@ flowchart LR
   pkg_agent_loop --> svc_agentLoop
   pkg_agent_presets --> svc_agentPresets
   pkg_api_gateway --> svc_typertGateway
+  pkg_api_job_controller --> svc_jobController
   pkg_api_session_controller --> svc_sessionController
   pkg_api_session_controller --> svc_sessionFileReferences
   pkg_api_session_controller --> svc_sessionSkillCatalog
@@ -432,8 +435,10 @@ flowchart LR
   svc_invariants --> pkg_agent_loop
   svc_invariants --> pkg_scope
   svc_invariants --> pkg_session
+  svc_jobs --> pkg_api_job_controller
   svc_jobs --> pkg_tool_bash
   svc_jobs --> pkg_tool_jobs
+  svc_jobs --> pkg_tool_pwsh
   svc_jobs --> pkg_tool_subagent
   svc_jobs --> pkg_tool_terminal
   svc_llm --> pkg_agent_loop
@@ -555,6 +560,7 @@ flowchart LR
 | `ctx.sessionController` | `core` | [`api-session-controller`](../packages/api/session-controller) | - | - | - | Owns Session commands, cold reads, durable-event following, live control state, model catalogs, workspace opening, and Agent activation policy. |
 | `ctx.sessionFileReferences` | `core` | [`api-session-controller`](../packages/api/session-controller) | - | - | - | Delegates file-reference discovery through the Session Controller's established Agent lookup policy. |
 | `ctx.sessionSkillCatalog` | `core` | [`api-session-controller`](../packages/api/session-controller) | - | - | - | Lists the Session composition's user-invocable skills without activating a cold Agent. |
+| `ctx.jobController` | `core` | [`api-job-controller`](../packages/api/job-controller) | - | - | - | Streams one background job's observation record over the generated Remote namespace; the roster stays on the session control stream. |
 | `ctx.credentialsController` | `core` | [`api-settings-controller`](../packages/api/settings-controller) | - | - | - | Projects the credential-reference seam onto the generated Remote namespace: batch fan-out, view projection, and refusal mapping live here, not on the seam Definition. |
 | `ctx.settingsController` | `core` | [`api-settings-controller`](../packages/api/settings-controller) | - | - | - | Projects the user-settings seam onto the generated Remote namespace: the read is always redacted and every refusal is classified here, not on the seam Definition. |
 | `ctx.workspaceFiles` | `core` | [`api-workspace-files`](../packages/api/workspace-files) | - | - | - | Serves stat, paged text, byte windows, directory listings, and the change feed for files inside a Session's workspace root, confined by lstat, containment, and a stat re-check. |
@@ -608,7 +614,7 @@ flowchart LR
 | `ctx.subagents` | `seam` | [`subagent`](../packages/subagent/subagent) | [`subagent-spawn-in-process`](../packages/subagent/subagent-spawn-in-process), [`subagent-fork-in-process`](../packages/subagent/subagent-fork-in-process), [`subagent-acp`](../packages/subagent/subagent-acp), [`subagent-codex`](../packages/subagent/subagent-codex), [`subagent-claude-code`](../packages/subagent/subagent-claude-code), [`subagent-dsh-sdk`](../packages/subagent/subagent-dsh-sdk) | [`tool-subagent`](../packages/subagent/tool-subagent), [`tool-subagent-control`](../packages/subagent/tool-subagent-control), [`tool-ralph`](../packages/workflow/tool-ralph) | - | Providers implement transports; the service also owns optional Activation-based continuation orchestration, tool-subagent selects one-shot or continuable delegation, tool-subagent-control delivers follow-ups, and tool-ralph requires one fresh structured-output route. |
 | `ctx.agentTeams` | `core` | [`experimental-agent-team`](../packages/experimental/agent-team) | - | [`experimental-tool-agent-team`](../packages/experimental/tool-agent-team), [`experimental-client-ui-agent-team`](../packages/experimental/client-ui-agent-team) | - | Owns the implicit-root roster, durable peer mailbox, shared task DAG, continuable-child lifecycle, and generated Team Remote methods; tool-agent-team contributes model controls and client-ui-agent-team mounts the browser contribution. |
 | `ctx.inspector` | `core` | `inspector` | - | - | - | Owns the Worker-hosted CDP target and the transport-independent Host and Client observation and Cordis-tree query API. |
-| `ctx.jobs` | `seam` | [`jobs`](../packages/jobs/jobs) | [`jobs-local`](../packages/jobs/jobs-local) | [`tool-bash`](../packages/shell/tool-bash), [`tool-terminal`](../packages/terminal/tool-terminal), [`tool-subagent`](../packages/subagent/tool-subagent), [`tool-jobs`](../packages/jobs/tool-jobs) | - | Producers (background bash, PTY sends, and subagent delegations) register running work; tool-jobs is the model-facing controller that reads, lists, and kills it; jobs-local is the process-local registry. |
+| `ctx.jobs` | `seam` | [`jobs`](../packages/jobs/jobs) | [`jobs-local`](../packages/jobs/jobs-local) | [`tool-bash`](../packages/shell/tool-bash), [`tool-pwsh`](../packages/shell/tool-pwsh), [`tool-terminal`](../packages/terminal/tool-terminal), [`tool-subagent`](../packages/subagent/tool-subagent), [`tool-jobs`](../packages/jobs/tool-jobs), [`api-job-controller`](../packages/api/job-controller) | - | Producers (background bash/pwsh, PTY sends, and subagent delegations) register running work; record-declaring jobs additionally stream raw output for non-consuming observers; tool-jobs is the model-facing controller that reads, lists, and kills it; jobs-local is the process-local registry. |
 | `ctx.web` | `seam` | [`web`](../packages/web/web) | [`web-search-exa`](../packages/web/web-search-exa), [`web-search-perplexity`](../packages/web/web-search-perplexity), [`web-search-deepseek`](../packages/web/web-search-deepseek), [`web-fetch-http`](../packages/web/web-fetch-http) | [`tool-web`](../packages/web/tool-web) | - | Search and fetch providers register into one ctx.web seam; tool-web owns the stable model-facing names. |
 | `ctx.spillStore` | `seam` | [`spill`](../packages/spill/spill) | [`spill-local`](../packages/spill/spill-local) | [`spill-policy`](../packages/spill/spill-policy) | - | The backend saves oversized tool text and returns a model-facing locator plus retrieval hint; spill-policy is the tools/post-execute consumer that decides when to spill. |
 | `ctx.directoryPicker` | `seam` | [`host-directory-picker`](../packages/host/directory-picker) | [`host-directory-picker-native`](../packages/host/directory-picker-native), [`host-directory-picker-browse`](../packages/host/directory-picker-browse) | [`api-workspace-controller`](../packages/api/workspace-controller) | - | Discriminated interaction capability: the native backend opens one OS chooser on the host display, the browse backend serves listing/creation primitives for the in-app browser; dual-face backends fill ui-workspace directory-flow slots from their browser halves (no wire advertisement). |
diff --git a/docs/capability-seams.zh.md b/docs/capability-seams.zh.md
index b06d937861..c7794eae7b 100644
--- a/docs/capability-seams.zh.md
+++ b/docs/capability-seams.zh.md
@@ -69,6 +69,8 @@ flowchart LR
   svc_sessionController["ctx.sessionController<br/>Host Session Remote controller"]
   svc_sessionFileReferences["ctx.sessionFileReferences<br/>Session-addressed file-reference Remote adapter"]
   svc_sessionSkillCatalog["ctx.sessionSkillCatalog<br/>Session-addressed skill Remote adapter"]
+  pkg_api_job_controller["api-job-controller"]
+  svc_jobController["ctx.jobController<br/>Host job Remote controller"]
   pkg_api_settings_controller["api-settings-controller"]
   svc_credentialsController["ctx.credentialsController<br/>Host credential-surface Remote controller"]
   svc_settingsController["ctx.settingsController<br/>Host settings-surface Remote controller"]
@@ -261,6 +263,7 @@ flowchart LR
   pkg_agent_loop --> svc_agentLoop
   pkg_agent_presets --> svc_agentPresets
   pkg_api_gateway --> svc_typertGateway
+  pkg_api_job_controller --> svc_jobController
   pkg_api_session_controller --> svc_sessionController
   pkg_api_session_controller --> svc_sessionFileReferences
   pkg_api_session_controller --> svc_sessionSkillCatalog
@@ -434,8 +437,10 @@ flowchart LR
   svc_invariants --> pkg_agent_loop
   svc_invariants --> pkg_scope
   svc_invariants --> pkg_session
+  svc_jobs --> pkg_api_job_controller
   svc_jobs --> pkg_tool_bash
   svc_jobs --> pkg_tool_jobs
+  svc_jobs --> pkg_tool_pwsh
   svc_jobs --> pkg_tool_subagent
   svc_jobs --> pkg_tool_terminal
   svc_llm --> pkg_agent_loop
@@ -557,6 +562,7 @@ flowchart LR
 | `ctx.sessionController` | `core` | [`api-session-controller`](../packages/api/session-controller) | - | - | - | 负责 Session 命令、冷读取、持久事件跟随、实时控制状态、模型目录、workspace 打开与 Agent 激活策略。 |
 | `ctx.sessionFileReferences` | `core` | [`api-session-controller`](../packages/api/session-controller) | - | - | - | 通过 Session Controller 的既有 Agent lookup 策略委托文件引用发现。 |
 | `ctx.sessionSkillCatalog` | `core` | [`api-session-controller`](../packages/api/session-controller) | - | - | - | 在不激活冷 Agent 的前提下列出 Session 组合中允许用户调用的 skill。 |
+| `ctx.jobController` | `core` | [`api-job-controller`](../packages/api/job-controller) | - | - | - | 经生成的 Remote namespace 流式发送一个后台任务的观测 record；名册仍在会话控制流上。 |
 | `ctx.credentialsController` | `core` | [`api-settings-controller`](../packages/api/settings-controller) | - | - | - | 把凭据引用 seam 投影到生成的 Remote namespace：批量扇出、视图投影与拒绝映射都在这里，而不在 seam Definition 上。 |
 | `ctx.settingsController` | `core` | [`api-settings-controller`](../packages/api/settings-controller) | - | - | - | 把用户设置 seam 投影到生成的 Remote namespace：读取一律脱敏，所有拒绝在这里分类，而不在 seam Definition 上。 |
 | `ctx.workspaceFiles` | `core` | [`api-workspace-files`](../packages/api/workspace-files) | - | - | - | 为会话工作区根内的文件提供 stat、分页文本、字节窗口、目录列举与变更流，经 lstat、包含关系与 stat 重检限定。 |
@@ -610,7 +616,7 @@ flowchart LR
 | `ctx.subagents` | `seam` | [`subagent`](../packages/subagent/subagent) | [`subagent-spawn-in-process`](../packages/subagent/subagent-spawn-in-process), [`subagent-fork-in-process`](../packages/subagent/subagent-fork-in-process), [`subagent-acp`](../packages/subagent/subagent-acp), [`subagent-codex`](../packages/subagent/subagent-codex), [`subagent-claude-code`](../packages/subagent/subagent-claude-code), [`subagent-dsh-sdk`](../packages/subagent/subagent-dsh-sdk) | [`tool-subagent`](../packages/subagent/tool-subagent), [`tool-subagent-control`](../packages/subagent/tool-subagent-control), [`tool-ralph`](../packages/workflow/tool-ralph) | - | 提供方实现传输；该服务还负责可选的、基于 Activation 的延续编排，tool-subagent 选择一次性或可延续委派，tool-subagent-control 传递后续消息，而 tool-ralph 要求一条全新的结构化输出路由。 |
 | `ctx.agentTeams` | `core` | [`experimental-agent-team`](../packages/experimental/agent-team) | - | [`experimental-tool-agent-team`](../packages/experimental/tool-agent-team), [`experimental-client-ui-agent-team`](../packages/experimental/client-ui-agent-team) | - | 负责隐式 Root roster、持久 peer mailbox、共享任务 DAG、continuable child 生命周期与生成式 Team Remote method；tool-agent-team 提供模型控制工具，client-ui-agent-team 挂载浏览器 contribution。 |
 | `ctx.inspector` | `core` | `inspector` | - | - | - | 负责 Worker 托管的 CDP target，以及独立于传输的 Host 和 Client observation 与 Cordis tree query API。 |
-| `ctx.jobs` | `seam` | [`jobs`](../packages/jobs/jobs) | [`jobs-local`](../packages/jobs/jobs-local) | [`tool-bash`](../packages/shell/tool-bash), [`tool-terminal`](../packages/terminal/tool-terminal), [`tool-subagent`](../packages/subagent/tool-subagent), [`tool-jobs`](../packages/jobs/tool-jobs) | - | 生产方（后台 bash、PTY 发送和 subagent 委派）登记正在运行的工作；tool-jobs 是面向模型的控制器，用于读取、列出和终止这些工作；jobs-local 是进程本地注册表。 |
+| `ctx.jobs` | `seam` | [`jobs`](../packages/jobs/jobs) | [`jobs-local`](../packages/jobs/jobs-local) | [`tool-bash`](../packages/shell/tool-bash), [`tool-pwsh`](../packages/shell/tool-pwsh), [`tool-terminal`](../packages/terminal/tool-terminal), [`tool-subagent`](../packages/subagent/tool-subagent), [`tool-jobs`](../packages/jobs/tool-jobs), [`api-job-controller`](../packages/api/job-controller) | - | 生产方（后台 bash/pwsh、PTY 发送和 subagent 委派）登记正在运行的工作；声明 record 的 job 还为非消费观察者流式提供原始输出；tool-jobs 是面向模型的控制器，用于读取、列出和终止这些工作；jobs-local 是进程本地注册表。 |
 | `ctx.web` | `seam` | [`web`](../packages/web/web) | [`web-search-exa`](../packages/web/web-search-exa), [`web-search-perplexity`](../packages/web/web-search-perplexity), [`web-search-deepseek`](../packages/web/web-search-deepseek), [`web-fetch-http`](../packages/web/web-fetch-http) | [`tool-web`](../packages/web/tool-web) | - | 搜索和抓取提供方注册到同一个 ctx.web seam；tool-web 负责稳定的面向模型名称。 |
 | `ctx.spillStore` | `seam` | [`spill`](../packages/spill/spill) | [`spill-local`](../packages/spill/spill-local) | [`spill-policy`](../packages/spill/spill-policy) | - | 后端保存过大的工具文本，并返回面向模型的定位信息和取回提示；spill-policy 是 tools/post-execute 消费方，负责决定何时 spill。 |
 | `ctx.directoryPicker` | `seam` | [`host-directory-picker`](../packages/host/directory-picker) | [`host-directory-picker-native`](../packages/host/directory-picker-native), [`host-directory-picker-browse`](../packages/host/directory-picker-browse) | [`api-workspace-controller`](../packages/api/workspace-controller) | - | 带判别标记的交互能力：原生后端在 Host 显示设备上打开一个操作系统选择器，浏览后端为应用内浏览器提供列表与创建原语；双端后端通过其浏览器侧填充 ui-workspace 目录流程的 slot（不通过协议发布）。 |
diff --git a/docs/config-catalog.i18n.yaml b/docs/config-catalog.i18n.yaml
index 578d94c8c8..2aa6cd3874 100644
--- a/docs/config-catalog.i18n.yaml
+++ b/docs/config-catalog.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/config-catalog.md
-config-catalog.md: 6bd14a5aa194de15463c0d63639c0f5095995f99
-config-catalog.zh.md: ed0a6cbcc7b28e3875b50ba90e427ca06e90a8dc
+config-catalog.md: bb95bd3794b0be4fd7688f77c2ac77efd4249ecf
+config-catalog.zh.md: b1297bf254db369d063a39395d1678f91f807550
diff --git a/docs/config-catalog.md b/docs/config-catalog.md
index 6bd14a5aa1..bb95bd3794 100644
--- a/docs/config-catalog.md
+++ b/docs/config-catalog.md
@@ -201,6 +201,24 @@ export interface Config {
 
 Source: [`packages/api/gateway/src/index.ts:140`](../packages/api/gateway/src/index.ts)
 
+<a id="deepseek-aidsh-api-job-controller"></a>
+
+## `@deepseek-ai/dsh-api-job-controller`
+
+Requires: `jobs` · `typert`
+
+```ts config-catalog
+/** Job Controller deployment policy. */
+export interface Config {
+  /** Coalescing window after a registry commit before the next rows or output read, in milliseconds (default 100). */
+  readonly observeFlushMs?: number
+  /** Soft byte budget per observation output frame (default 65536); one larger chunk ships whole. */
+  readonly observeMaxFrameBytes?: number
+}
+```
+
+Source: [`packages/api/job-controller/src/index.ts:33`](../packages/api/job-controller/src/index.ts)
+
 <a id="deepseek-aidsh-api-session-controller"></a>
 
 ## `@deepseek-ai/dsh-api-session-controller`
@@ -215,7 +233,7 @@ export interface Config {
 }
 ```
 
-Source: [`packages/api/session-controller/src/index.ts:77`](../packages/api/session-controller/src/index.ts)
+Source: [`packages/api/session-controller/src/index.ts:78`](../packages/api/session-controller/src/index.ts)
 
 <a id="deepseek-aidsh-api-settings-controller"></a>
 
@@ -1160,10 +1178,20 @@ export interface Config {
    * omission defaults to 10.
    */
   maxConcurrentJobsPerOwner?: number
+  /** Live ring retention per job in UTF-8 bytes; omission defaults to 262144. */
+  retainBytes?: number
+  /**
+   * Ring retention kept after a job settles, in UTF-8 bytes; omission defaults to 16384.
+   * Settlement keeps every byte the model cursor has not consumed on top of
+   * this cap; the first terminal model read then trims to it.
+   */
+  settledRetainBytes?: number
+  /** Poll interval for a job's pull sources, in milliseconds; omission defaults to 150. */
+  pumpPollMs?: number
 }
 ```
 
-Source: [`packages/jobs/jobs-local/src/index.ts:31`](../packages/jobs/jobs-local/src/index.ts)
+Source: [`packages/jobs/jobs-local/src/index.ts:45`](../packages/jobs/jobs-local/src/index.ts)
 
 <a id="deepseek-aidsh-llm-deepseek"></a>
 
@@ -2938,7 +2966,7 @@ export interface Config {
 }
 ```
 
-Source: [`packages/core/system-prompt/src/index.ts:248`](../packages/core/system-prompt/src/index.ts)
+Source: [`packages/core/system-prompt/src/index.ts:247`](../packages/core/system-prompt/src/index.ts)
 
 <a id="deepseek-aidsh-terminal-bash"></a>
 
@@ -3173,14 +3201,14 @@ export interface Config {
 }
 
 /**
- * How an unreported completion reaches an owner that is already idle: `wakeup`
+ * How an uncollected completion reaches an owner that is already idle: `wakeup`
  * opens a turn for it, `quiet` leaves it pending until something else wakes the
  * owner. A busy owner is injected either way.
  */
 export type CompletionDelivery = 'quiet' | 'wakeup'
 ```
 
-Source: [`packages/jobs/tool-jobs/src/index.ts:37`](../packages/jobs/tool-jobs/src/index.ts)
+Source: [`packages/jobs/tool-jobs/src/index.ts:52`](../packages/jobs/tool-jobs/src/index.ts)
 
 <a id="deepseek-aidsh-tool-lsp"></a>
 
@@ -3232,7 +3260,7 @@ export interface Config {
 }
 ```
 
-Source: [`packages/shell/tool-pwsh/src/index.ts:51`](../packages/shell/tool-pwsh/src/index.ts)
+Source: [`packages/shell/tool-pwsh/src/index.ts:52`](../packages/shell/tool-pwsh/src/index.ts)
 
 <a id="deepseek-aidsh-tool-pwsh-persistent"></a>
 
@@ -3417,7 +3445,7 @@ export interface Config {
 }
 ```
 
-Source: [`packages/terminal/tool-terminal/src/index.ts:35`](../packages/terminal/tool-terminal/src/index.ts)
+Source: [`packages/terminal/tool-terminal/src/index.ts:36`](../packages/terminal/tool-terminal/src/index.ts)
 
 <a id="deepseek-aidsh-tool-todo"></a>
 
@@ -3903,7 +3931,7 @@ These load from a `cordis.yml` entry with no `config:` block; they declare no co
 - `@deepseek-ai/dsh-terminal` ([`packages/terminal/terminal/src/index.ts`](../packages/terminal/terminal/src/index.ts))
 - `@deepseek-ai/dsh-tool-ask-user` — requires `tools` · `userQuestions` ([`packages/interaction/tool-ask-user/src/index.ts`](../packages/interaction/tool-ask-user/src/index.ts))
 - `@deepseek-ai/dsh-tool-call-timeout-policy` — requires `tools` ([`packages/guard/timeout-policy/src/index.ts`](../packages/guard/timeout-policy/src/index.ts))
-- `@deepseek-ai/dsh-tool-cordis` — requires `tools` · `systemPrompt` · `cordisInspect` ([`packages/extensions/tool-cordis/src/index.ts`](../packages/extensions/tool-cordis/src/index.ts))
+- `@deepseek-ai/dsh-tool-cordis` — requires `tools` · `cordisInspect` ([`packages/extensions/tool-cordis/src/index.ts`](../packages/extensions/tool-cordis/src/index.ts))
 - `@deepseek-ai/dsh-tool-subagent-control` — requires `tools` · `subagents` ([`packages/subagent/tool-subagent-control/src/index.ts`](../packages/subagent/tool-subagent-control/src/index.ts))
 - `@deepseek-ai/dsh-user-questions` ([`packages/interaction/user-questions/src/index.ts`](../packages/interaction/user-questions/src/index.ts))
 - `@deepseek-ai/dsh-webhook` — requires `agents` · `agentDefaultModel` · `agentPresets` · `permissionPresets` · `sessionTitle` · `workspaceRegistry` ([`packages/webhook/webhook/src/index.ts`](../packages/webhook/webhook/src/index.ts))
diff --git a/docs/config-catalog.zh.md b/docs/config-catalog.zh.md
index ed0a6cbcc7..b1297bf254 100644
--- a/docs/config-catalog.zh.md
+++ b/docs/config-catalog.zh.md
@@ -203,6 +203,26 @@ export interface Config {
 
 来源：[`packages/api/gateway/src/index.ts:140`](../packages/api/gateway/src/index.ts)
 
+<a id="deepseek-aidsh-api-job-controller"></a>
+
+## `@deepseek-ai/dsh-api-job-controller`
+
+需要：`jobs` · `typert`
+
+```ts config-catalog
+/** Job Controller deployment policy. */
+export interface Config {
+  /** Coalescing window after a registry commit before the next rows or output read, in milliseconds (default 100). */
+  readonly observeFlushMs?: number
+  /** Soft byte budget per observation output frame (default 65536); one larger chunk ships whole. */
+  readonly observeMaxFrameBytes?: number
+}
+```
+
+来源：[`packages/api/job-controller/src/index.ts:33`](../packages/api/job-controller/src/index.ts)
+
+<a id="deepseek-aidsh-api-session-controller"></a>
+
 <a id="deepseek-aidsh-api-session-controller"></a>
 
 ## `@deepseek-ai/dsh-api-session-controller`
@@ -217,7 +237,7 @@ export interface Config {
 }
 ```
 
-来源：[`packages/api/session-controller/src/index.ts:77`](../packages/api/session-controller/src/index.ts)
+来源：[`packages/api/session-controller/src/index.ts:78`](../packages/api/session-controller/src/index.ts)
 
 <a id="deepseek-aidsh-api-settings-controller"></a>
 
@@ -1162,10 +1182,20 @@ export interface Config {
    * omission defaults to 10.
    */
   maxConcurrentJobsPerOwner?: number
+  /** Live ring retention per job in UTF-8 bytes; omission defaults to 262144. */
+  retainBytes?: number
+  /**
+   * Ring retention kept after a job settles, in UTF-8 bytes; omission defaults to 16384.
+   * Settlement keeps every byte the model cursor has not consumed on top of
+   * this cap; the first terminal model read then trims to it.
+   */
+  settledRetainBytes?: number
+  /** Poll interval for a job's pull sources, in milliseconds; omission defaults to 150. */
+  pumpPollMs?: number
 }
 ```
 
-来源：[`packages/jobs/jobs-local/src/index.ts:31`](../packages/jobs/jobs-local/src/index.ts)
+来源：[`packages/jobs/jobs-local/src/index.ts:45`](../packages/jobs/jobs-local/src/index.ts)
 
 <a id="deepseek-aidsh-llm-deepseek"></a>
 
@@ -2940,7 +2970,7 @@ export interface Config {
 }
 ```
 
-来源：[`packages/core/system-prompt/src/index.ts:248`](../packages/core/system-prompt/src/index.ts)
+来源：[`packages/core/system-prompt/src/index.ts:247`](../packages/core/system-prompt/src/index.ts)
 
 <a id="deepseek-aidsh-terminal-bash"></a>
 
@@ -3175,7 +3205,7 @@ export interface Config {
 }
 
 /**
- * How an unreported completion reaches an owner that is already idle: `wakeup`
+ * How an uncollected completion reaches an owner that is already idle: `wakeup`
  * opens a turn for it, `quiet` leaves it pending until something else wakes the
  * owner. A busy owner is injected either way.
  */
@@ -3234,7 +3264,7 @@ export interface Config {
 }
 ```
 
-来源：[`packages/shell/tool-pwsh/src/index.ts:51`](../packages/shell/tool-pwsh/src/index.ts)
+来源：[`packages/shell/tool-pwsh/src/index.ts:52`](../packages/shell/tool-pwsh/src/index.ts)
 
 <a id="deepseek-aidsh-tool-pwsh-persistent"></a>
 
@@ -3419,7 +3449,7 @@ export interface Config {
 }
 ```
 
-来源：[`packages/terminal/tool-terminal/src/index.ts:35`](../packages/terminal/tool-terminal/src/index.ts)
+来源：[`packages/terminal/tool-terminal/src/index.ts:36`](../packages/terminal/tool-terminal/src/index.ts)
 
 <a id="deepseek-aidsh-tool-todo"></a>
 
diff --git a/docs/cookbook/adding-a-tool.i18n.yaml b/docs/cookbook/adding-a-tool.i18n.yaml
index cc1209ff9e..e6cf6f864d 100644
--- a/docs/cookbook/adding-a-tool.i18n.yaml
+++ b/docs/cookbook/adding-a-tool.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/cookbook/adding-a-tool.md
-adding-a-tool.md: 659f87bf88ac7fc4b8bc7dd65672c86e6b4326f6
-adding-a-tool.zh.md: 4804c22b22e5761e27c59392d76a322a7407af99
+adding-a-tool.md: 2deb608fb3f25cb3c816150ed678fa685892ef66
+adding-a-tool.zh.md: 5ad488c8b4c7f4678f11f31ea3669c425e3ea1b7
diff --git a/docs/cookbook/adding-a-tool.md b/docs/cookbook/adding-a-tool.md
index 659f87bf88..2deb608fb3 100644
--- a/docs/cookbook/adding-a-tool.md
+++ b/docs/cookbook/adding-a-tool.md
@@ -52,7 +52,7 @@ Registration is effect-based: disposing the plugin fiber unregisters the tool. S
 
 Gate `run_in_background` with producer config, then register through `ctx.jobs.start({ kind, label, owner: exec.agent, run })`. The registry rejects a pre-aborted invocation before the producer body; the runtime validates ownership and task-controller availability before `run()` starts work, then supplies the id, session fence, generic control tools, notices, and owner cleanup. A successful background branch returns a typed canonical handle such as `{ kind: 'background', jobId }`; its Native renderer may keep human prose such as `started background job bash-1`, but PTC mode must never parse that prose to recover the id.
 
-The producer supplies synchronous `cancel`, non-rejecting `done` that settles after resource cleanup, and optional consuming `readOutput` with bounded-output formatting. A pre-aborted call is a failure because no task exists whose id could satisfy the successful output schema. Once `ctx.jobs.start()` publishes the id, use a task-owned cancellation signal rather than `exec.signal`: later outer-call cancellation stops waiting for the call but does not kill published work; `job_kill`, owner disposal, and service teardown own that lifetime. Foreground work remains coupled to `exec.signal`. See the [background job runtime Agent Note](../../.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.md) and `dsh-tool-bash` for a stream producer.
+The spec supplies synchronous `cancel`, a non-rejecting `done` that settles after resource cleanup, and either pull `output` sources the registry pumps into the job's output ring or pushes through the `JobHandle` its starter receives; `dsh-tool-jobs` renders the model's consuming read from that ring. A pre-aborted call is a failure because no task exists whose id could satisfy the successful output schema. Once `ctx.jobs.start()` publishes the id, use a task-owned cancellation signal rather than `exec.signal`: later outer-call cancellation stops waiting for the call but does not kill published work; `job_kill`, owner disposal, and service teardown own that lifetime. Foreground work remains coupled to `exec.signal`. See the [background job runtime Agent Note](../../.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.md) and `dsh-tool-bash` for a stream producer.
 
 ## Execution policy and observation
 
diff --git a/docs/cookbook/adding-a-tool.zh.md b/docs/cookbook/adding-a-tool.zh.md
index 4804c22b22..5ad488c8b4 100644
--- a/docs/cookbook/adding-a-tool.zh.md
+++ b/docs/cookbook/adding-a-tool.zh.md
@@ -52,7 +52,7 @@ export function apply(ctx: Context) {
 
 通过 producer 配置控制 `run_in_background`，然后使用 `ctx.jobs.start({ kind, label, owner: exec.agent, run })` 注册任务。注册表会在进入 producer 主体前将已预先中止的调用判为失败；运行时会在 `run()` 启动工作前校验 owner 和任务控制器是否可用，随后提供 id、会话围栏、通用控制工具、通知和 owner cleanup。成功的后台分支会返回类型化的规范句柄，如 `{ kind: 'background', jobId }`；其 Native 渲染器可以保留 `started background job bash-1` 这类供人阅读的自然语言，但 PTC mode 绝不能通过解析该文本取得 id。
 
-producer 提供同步的 `cancel`、在资源清理后 settle 且不 reject 的 `done`，以及可选的消费式 `readOutput`（负责有界输出的格式化）。预先中止的调用属于失败，因为此时没有任务，其 id 无法满足成功输出 schema。`ctx.jobs.start()` 发布 id 后，应使用任务自有的取消信号，而不是 `exec.signal`：之后取消外层调用只会停止等待本次调用，不会终止已经发布的工作；该生命周期归 `job_kill`、owner dispose 和服务 teardown 所有。前台工作仍与 `exec.signal` 耦合。流式 producer 的示例和完整约定见[后台任务运行时 Agent Note](../../.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.zh.md)与 `dsh-tool-bash`。
+spec 提供同步的 `cancel`、在资源清理后 settle 且不 reject 的 `done`，以及由注册表泵入 job 输出环的拉取式 `output` 源或经 starter 收到的 `JobHandle` 推送的追加；模型的消费式读取由 `dsh-tool-jobs` 从该环渲染。预先中止的调用属于失败，因为此时没有任务，其 id 无法满足成功输出 schema。`ctx.jobs.start()` 发布 id 后，应使用任务自有的取消信号，而不是 `exec.signal`：之后取消外层调用只会停止等待本次调用，不会终止已经发布的工作；该生命周期归 `job_kill`、owner dispose 和服务 teardown 所有。前台工作仍与 `exec.signal` 耦合。流式 producer 的示例和完整约定见[后台任务运行时 Agent Note](../../.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.zh.md)与 `dsh-tool-bash`。
 
 <a id="execution-policy-and-observation"></a>
 
diff --git a/docs/event-producer-consumer.i18n.yaml b/docs/event-producer-consumer.i18n.yaml
index 88b786a588..33dfb05b8e 100644
--- a/docs/event-producer-consumer.i18n.yaml
+++ b/docs/event-producer-consumer.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/event-producer-consumer.md
-event-producer-consumer.md: 619103ab6f813fc9ea915cc4f6bf5b6ae585f8cb
-event-producer-consumer.zh.md: 00a13ca2aa785dd253263f154627e6dd8accacc6
+event-producer-consumer.md: 8101bb9aa3d6e3da1cca96a5593de5c52d6454cd
+event-producer-consumer.zh.md: a57e1b7e9447939e6a6586c4743dfd39345cc15c
diff --git a/docs/event-producer-consumer.md b/docs/event-producer-consumer.md
index 619103ab6f..8101bb9aa3 100644
--- a/docs/event-producer-consumer.md
+++ b/docs/event-producer-consumer.md
@@ -21,11 +21,11 @@ This matrix shows which packages dispatch each harness-owned event and which pac
 | `agent/request-error` | `waterfall` | [`packages/core/agent/src/runtime-types.ts:353`](../packages/core/agent/src/runtime-types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`compaction-basic`](../packages/compaction/compaction-basic), [`compaction-image-offload`](../packages/compaction/compaction-image-offload), [`llm-retry`](../packages/llm/llm-retry) |
 | `agent/status` | `emit` | [`packages/core/agent/src/runtime-types.ts:280`](../packages/core/agent/src/runtime-types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`agent`](../packages/core/agent), `agent-team`, [`compaction-basic`](../packages/compaction/compaction-basic), [`goal-round-driver`](../packages/goal/goal-round-driver), [`schedule`](../packages/schedule/schedule), `server`, `session-controller` |
 | `agent/turn-stopping` | `serial` | [`packages/core/agent/src/runtime-types.ts:381`](../packages/core/agent/src/runtime-types.ts) | [`agent-loop`](../packages/core/agent-loop) (`serial`) | [`hooks-claude-code`](../packages/hooks/hooks-claude-code), [`hooks-codex`](../packages/hooks/hooks-codex), [`workspace-changes`](../packages/deliverables/workspace-changes) |
-| `api-session/activity` | `emit` | [`packages/api/session-controller/src/types.ts:614`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
-| `api-session/added` | `emit` | [`packages/api/session-controller/src/types.ts:594`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
-| `api-session/error` | `emit` | [`packages/api/session-controller/src/types.ts:621`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
-| `api-session/removed` | `emit` | [`packages/api/session-controller/src/types.ts:600`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
-| `api-session/status` | `emit` | [`packages/api/session-controller/src/types.ts:607`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
+| `api-session/activity` | `emit` | [`packages/api/session-controller/src/types.ts:603`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
+| `api-session/added` | `emit` | [`packages/api/session-controller/src/types.ts:583`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
+| `api-session/error` | `emit` | [`packages/api/session-controller/src/types.ts:610`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
+| `api-session/removed` | `emit` | [`packages/api/session-controller/src/types.ts:589`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
+| `api-session/status` | `emit` | [`packages/api/session-controller/src/types.ts:596`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
 | `approval/request` | `waterfall` | [`packages/interaction/user-approval/src/types.ts:85`](../packages/interaction/user-approval/src/types.ts) | [`user-approval`](../packages/interaction/user-approval) (`waterfall`) | [`acp`](../packages/acp/acp), `remotes` |
 | `authorization/settled` | `emit` | [`packages/credentials/authorization/src/index.ts:57`](../packages/credentials/authorization/src/index.ts) | [`authorization`](../packages/credentials/authorization) (`events.dispatch`) | [`authorization`](../packages/credentials/authorization) |
 | `commands/change` | `emit` | [`packages/interaction/commands/src/types.ts:89`](../packages/interaction/commands/src/types.ts) | [`commands`](../packages/interaction/commands) (`events.dispatch`) | `remotes` |
diff --git a/docs/event-producer-consumer.zh.md b/docs/event-producer-consumer.zh.md
index 00a13ca2aa..a57e1b7e94 100644
--- a/docs/event-producer-consumer.zh.md
+++ b/docs/event-producer-consumer.zh.md
@@ -23,11 +23,11 @@
 | `agent/request-error` | `waterfall` | [`packages/core/agent/src/runtime-types.ts:353`](../packages/core/agent/src/runtime-types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`compaction-basic`](../packages/compaction/compaction-basic), [`compaction-image-offload`](../packages/compaction/compaction-image-offload), [`llm-retry`](../packages/llm/llm-retry) |
 | `agent/status` | `emit` | [`packages/core/agent/src/runtime-types.ts:280`](../packages/core/agent/src/runtime-types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`agent`](../packages/core/agent), `agent-team`, [`compaction-basic`](../packages/compaction/compaction-basic), [`goal-round-driver`](../packages/goal/goal-round-driver), [`schedule`](../packages/schedule/schedule), `server`, `session-controller` |
 | `agent/turn-stopping` | `serial` | [`packages/core/agent/src/runtime-types.ts:381`](../packages/core/agent/src/runtime-types.ts) | [`agent-loop`](../packages/core/agent-loop) (`serial`) | [`hooks-claude-code`](../packages/hooks/hooks-claude-code), [`hooks-codex`](../packages/hooks/hooks-codex), [`workspace-changes`](../packages/deliverables/workspace-changes) |
-| `api-session/activity` | `emit` | [`packages/api/session-controller/src/types.ts:614`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
-| `api-session/added` | `emit` | [`packages/api/session-controller/src/types.ts:594`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
-| `api-session/error` | `emit` | [`packages/api/session-controller/src/types.ts:621`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
-| `api-session/removed` | `emit` | [`packages/api/session-controller/src/types.ts:600`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
-| `api-session/status` | `emit` | [`packages/api/session-controller/src/types.ts:607`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
+| `api-session/activity` | `emit` | [`packages/api/session-controller/src/types.ts:617`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
+| `api-session/added` | `emit` | [`packages/api/session-controller/src/types.ts:597`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
+| `api-session/error` | `emit` | [`packages/api/session-controller/src/types.ts:624`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
+| `api-session/removed` | `emit` | [`packages/api/session-controller/src/types.ts:603`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
+| `api-session/status` | `emit` | [`packages/api/session-controller/src/types.ts:610`](../packages/api/session-controller/src/types.ts) | `session-controller` (`emit`) | `remotes` |
 | `approval/request` | `waterfall` | [`packages/interaction/user-approval/src/types.ts:85`](../packages/interaction/user-approval/src/types.ts) | [`user-approval`](../packages/interaction/user-approval) (`waterfall`) | [`acp`](../packages/acp/acp), `remotes` |
 | `authorization/settled` | `emit` | [`packages/credentials/authorization/src/index.ts:57`](../packages/credentials/authorization/src/index.ts) | [`authorization`](../packages/credentials/authorization) (`events.dispatch`) | [`authorization`](../packages/credentials/authorization) |
 | `commands/change` | `emit` | [`packages/interaction/commands/src/types.ts:89`](../packages/interaction/commands/src/types.ts) | [`commands`](../packages/interaction/commands) (`events.dispatch`) | `remotes` |
diff --git a/docs/module-graph.i18n.yaml b/docs/module-graph.i18n.yaml
index dcaee90607..e22d460cd0 100644
--- a/docs/module-graph.i18n.yaml
+++ b/docs/module-graph.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/module-graph.md
-module-graph.md: 684f82c87648bbd6fa8a1e7f45405a2c2d4d9885
-module-graph.zh.md: cf3bca4f97c840a052399bd3765e7cf11270c396
+module-graph.md: af297ec0b0d143ad8917eac00e2faf44f3477b5d
+module-graph.zh.md: f56bdc422d9e74d922cb015c9d35e020cbd69b89
diff --git a/docs/module-graph.md b/docs/module-graph.md
index 684f82c876..af297ec0b0 100644
--- a/docs/module-graph.md
+++ b/docs/module-graph.md
@@ -114,6 +114,7 @@ flowchart TD
   end
   subgraph group_api["packages/api"]
     pkg_api_gateway["api-gateway"]
+    pkg_api_job_controller["api-job-controller"]
     pkg_api_remotes["api-remotes"]
     pkg_api_session_controller["api-session-controller"]
     pkg_api_settings_controller["api-settings-controller"]
@@ -993,7 +994,6 @@ flowchart TD
   pkg_experimental_auto_review --> pkg_tools
   pkg_tool_cordis --> pkg_agent
   pkg_tool_cordis --> pkg_cordis_host_runner
-  pkg_tool_cordis --> pkg_system_prompt
   pkg_tool_cordis --> pkg_tools
   pkg_host_plugin_inventory --> pkg_agent_presets
   pkg_host_plugin_inventory --> pkg_brand
@@ -1180,7 +1180,6 @@ flowchart TD
   pkg_api_session_controller --> pkg_commands
   pkg_api_session_controller --> pkg_file_reference
   pkg_api_session_controller --> pkg_fs
-  pkg_api_session_controller --> pkg_jobs
   pkg_api_session_controller --> pkg_llm
   pkg_api_session_controller --> pkg_native_command
   pkg_api_session_controller --> pkg_scope
@@ -1325,6 +1324,7 @@ flowchart TD
 | [`util-workspace-path`](../packages/util/workspace-path) | `util` | — |
 | [`deepseek-llm-api-extensions`](../packages/llm/deepseek-llm-api-extensions) | `llm` | — |
 | [`llm`](../packages/llm/llm) | `llm` | — |
+| [`api-job-controller`](../packages/api/job-controller) | `api` | — |
 | [`api-workspace-files`](../packages/api/workspace-files) | `api` | — |
 | [`cmdline`](../packages/boot/cmdline) | `boot` | — |
 | [`acp-app`](../packages/bundle/acp-app) | `bundle` | — |
@@ -1556,7 +1556,7 @@ flowchart TD
 | [`api-settings-controller`](../packages/api/settings-controller) | `api` | [`agent-presets`](../packages/preset/agent-presets), [`credentials`](../packages/credentials/credentials), [`native-command`](../packages/util/native-command), [`session`](../packages/core/session), [`settings`](../packages/settings/settings), [`typert-protocol`](../packages/typert/protocol) |
 | [`web-app`](../packages/bundle/web-app) | `bundle` | [`shell-env`](../packages/shell/shell-env), [`system-prompt`](../packages/core/system-prompt) |
 | [`experimental-auto-review`](../packages/experimental/auto-review) | `experimental` | [`agent`](../packages/core/agent), [`agent-instructions`](../packages/context/agent-instructions), [`llm`](../packages/llm/llm), [`permission-presets`](../packages/interaction/permission-presets), [`session`](../packages/core/session), [`tools`](../packages/core/tools) |
-| [`tool-cordis`](../packages/extensions/tool-cordis) | `extensions` | [`agent`](../packages/core/agent), [`cordis-host-runner`](../packages/extensions/cordis-host-runner), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools) |
+| [`tool-cordis`](../packages/extensions/tool-cordis) | `extensions` | [`agent`](../packages/core/agent), [`cordis-host-runner`](../packages/extensions/cordis-host-runner), [`tools`](../packages/core/tools) |
 | [`host-plugin-inventory`](../packages/host/plugin-inventory) | `host` | [`agent-presets`](../packages/preset/agent-presets), [`brand`](../packages/util/brand), [`typert-protocol`](../packages/typert/protocol) |
 | [`mcp-client`](../packages/mcp/mcp-client) | `mcp` | [`attachment`](../packages/attachment/attachment), [`llm`](../packages/llm/llm), [`mcp-resources`](../packages/mcp/mcp-resources), [`scope`](../packages/core/scope), [`subprocess`](../packages/subprocess/subprocess), [`system-prompt`](../packages/core/system-prompt), [`timeout`](../packages/util/timeout), [`tools`](../packages/core/tools) |
 | [`session-telemetry-otel`](../packages/session/session-telemetry-otel) | `session` | [`anonymous-user-id`](../packages/identity/anonymous-user-id), [`command-feedback`](../packages/feedback/command-feedback), [`llm`](../packages/llm/llm), [`message-feedback`](../packages/feedback/message-feedback), [`session`](../packages/core/session), [`session-telemetry`](../packages/session/session-telemetry) |
@@ -1583,7 +1583,7 @@ flowchart TD
 | [`tool-subagent`](../packages/subagent/tool-subagent) | `subagent` | [`agent`](../packages/core/agent), [`invariants`](../packages/runtime-diagnostics/invariants), [`jobs`](../packages/jobs/jobs), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`session-projection`](../packages/session/session-projection), [`settings`](../packages/settings/settings), [`subagent`](../packages/subagent/subagent), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools) |
 | [`tool-subagent-control`](../packages/subagent/tool-subagent-control) | `subagent` | [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`subagent`](../packages/subagent/subagent), [`tools`](../packages/core/tools) |
 | [`hooks-claude-code`](../packages/hooks/hooks-claude-code) | `hooks` | [`agent`](../packages/core/agent), [`hook-protocol`](../packages/hooks/hook-protocol), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`session-projection`](../packages/session/session-projection), [`subagent`](../packages/subagent/subagent), [`tools`](../packages/core/tools) |
-| [`api-session-controller`](../packages/api/session-controller) | `api` | [`agent`](../packages/core/agent), [`agent-default-model`](../packages/core/agent-default-model), [`agent-presets`](../packages/preset/agent-presets), [`api-gateway`](../packages/api/gateway), [`attachment`](../packages/attachment/attachment), [`client-connection`](../packages/client/connection), [`client-file-upload`](../packages/client/file-upload), [`commands`](../packages/interaction/commands), [`file-reference`](../packages/context/file-reference), [`fs`](../packages/fs/fs), [`jobs`](../packages/jobs/jobs), [`llm`](../packages/llm/llm), [`native-command`](../packages/util/native-command), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`session-persistence`](../packages/session/session-persistence), [`session-projection`](../packages/session/session-projection), [`session-projection-cache`](../packages/session/session-projection-cache), [`session-query`](../packages/session-query/session-query), [`session-title`](../packages/session/session-title), [`skill`](../packages/skill/skill), [`subagent`](../packages/subagent/subagent), [`typert-protocol`](../packages/typert/protocol), [`typert-registry`](../packages/typert/registry), [`util-time`](../packages/util/time), [`util-values`](../packages/util/values), [`util-workspace-path`](../packages/util/workspace-path), [`workspace`](../packages/workspace/workspace) |
+| [`api-session-controller`](../packages/api/session-controller) | `api` | [`agent`](../packages/core/agent), [`agent-default-model`](../packages/core/agent-default-model), [`agent-presets`](../packages/preset/agent-presets), [`api-gateway`](../packages/api/gateway), [`attachment`](../packages/attachment/attachment), [`client-connection`](../packages/client/connection), [`client-file-upload`](../packages/client/file-upload), [`commands`](../packages/interaction/commands), [`file-reference`](../packages/context/file-reference), [`fs`](../packages/fs/fs), [`llm`](../packages/llm/llm), [`native-command`](../packages/util/native-command), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`session-persistence`](../packages/session/session-persistence), [`session-projection`](../packages/session/session-projection), [`session-projection-cache`](../packages/session/session-projection-cache), [`session-query`](../packages/session-query/session-query), [`session-title`](../packages/session/session-title), [`skill`](../packages/skill/skill), [`subagent`](../packages/subagent/subagent), [`typert-protocol`](../packages/typert/protocol), [`typert-registry`](../packages/typert/registry), [`util-time`](../packages/util/time), [`util-values`](../packages/util/values), [`util-workspace-path`](../packages/util/workspace-path), [`workspace`](../packages/workspace/workspace) |
 | [`compaction-basic`](../packages/compaction/compaction-basic) | `compaction` | [`agent`](../packages/core/agent), [`commands`](../packages/interaction/commands), [`compaction`](../packages/compaction/compaction), [`compaction-tool-result-pruner`](../packages/compaction/compaction-tool-result-pruner), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`token-meter`](../packages/llm/token-meter) |
 | [`session-reference`](../packages/context/session-reference) | `context` | [`agent`](../packages/core/agent), [`compaction`](../packages/compaction/compaction), [`llm`](../packages/llm/llm), [`output-retention`](../packages/util/output-retention), [`session`](../packages/core/session), [`session-projection`](../packages/session/session-projection), [`session-projection-cache`](../packages/session/session-projection-cache), [`session-query`](../packages/session-query/session-query), [`session-title`](../packages/session/session-title), [`spill`](../packages/spill/spill), [`subagent`](../packages/subagent/subagent), [`system-prompt`](../packages/core/system-prompt), [`typert-protocol`](../packages/typert/protocol) |
 | [`experimental-agent-team`](../packages/experimental/agent-team) | `experimental` | [`agent`](../packages/core/agent), [`invariants`](../packages/runtime-diagnostics/invariants), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`session-persistence`](../packages/session/session-persistence), [`session-projection`](../packages/session/session-projection), [`subagent`](../packages/subagent/subagent), [`typert-protocol`](../packages/typert/protocol) |
diff --git a/docs/module-graph.zh.md b/docs/module-graph.zh.md
index cf3bca4f97..f56bdc422d 100644
--- a/docs/module-graph.zh.md
+++ b/docs/module-graph.zh.md
@@ -116,6 +116,7 @@ flowchart TD
   end
   subgraph group_api["packages/api"]
     pkg_api_gateway["api-gateway"]
+    pkg_api_job_controller["api-job-controller"]
     pkg_api_remotes["api-remotes"]
     pkg_api_session_controller["api-session-controller"]
     pkg_api_settings_controller["api-settings-controller"]
@@ -995,7 +996,6 @@ flowchart TD
   pkg_experimental_auto_review --> pkg_tools
   pkg_tool_cordis --> pkg_agent
   pkg_tool_cordis --> pkg_cordis_host_runner
-  pkg_tool_cordis --> pkg_system_prompt
   pkg_tool_cordis --> pkg_tools
   pkg_host_plugin_inventory --> pkg_agent_presets
   pkg_host_plugin_inventory --> pkg_brand
@@ -1182,7 +1182,6 @@ flowchart TD
   pkg_api_session_controller --> pkg_commands
   pkg_api_session_controller --> pkg_file_reference
   pkg_api_session_controller --> pkg_fs
-  pkg_api_session_controller --> pkg_jobs
   pkg_api_session_controller --> pkg_llm
   pkg_api_session_controller --> pkg_native_command
   pkg_api_session_controller --> pkg_scope
@@ -1327,6 +1326,7 @@ flowchart TD
 | [`util-workspace-path`](../packages/util/workspace-path) | `util` | — |
 | [`deepseek-llm-api-extensions`](../packages/llm/deepseek-llm-api-extensions) | `llm` | — |
 | [`llm`](../packages/llm/llm) | `llm` | — |
+| [`api-job-controller`](../packages/api/job-controller) | `api` | — |
 | [`api-workspace-files`](../packages/api/workspace-files) | `api` | — |
 | [`cmdline`](../packages/boot/cmdline) | `boot` | — |
 | [`acp-app`](../packages/bundle/acp-app) | `bundle` | — |
@@ -1558,7 +1558,7 @@ flowchart TD
 | [`api-settings-controller`](../packages/api/settings-controller) | `api` | [`agent-presets`](../packages/preset/agent-presets), [`credentials`](../packages/credentials/credentials), [`native-command`](../packages/util/native-command), [`session`](../packages/core/session), [`settings`](../packages/settings/settings), [`typert-protocol`](../packages/typert/protocol) |
 | [`web-app`](../packages/bundle/web-app) | `bundle` | [`shell-env`](../packages/shell/shell-env), [`system-prompt`](../packages/core/system-prompt) |
 | [`experimental-auto-review`](../packages/experimental/auto-review) | `experimental` | [`agent`](../packages/core/agent), [`agent-instructions`](../packages/context/agent-instructions), [`llm`](../packages/llm/llm), [`permission-presets`](../packages/interaction/permission-presets), [`session`](../packages/core/session), [`tools`](../packages/core/tools) |
-| [`tool-cordis`](../packages/extensions/tool-cordis) | `extensions` | [`agent`](../packages/core/agent), [`cordis-host-runner`](../packages/extensions/cordis-host-runner), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools) |
+| [`tool-cordis`](../packages/extensions/tool-cordis) | `extensions` | [`agent`](../packages/core/agent), [`cordis-host-runner`](../packages/extensions/cordis-host-runner), [`tools`](../packages/core/tools) |
 | [`host-plugin-inventory`](../packages/host/plugin-inventory) | `host` | [`agent-presets`](../packages/preset/agent-presets), [`brand`](../packages/util/brand), [`typert-protocol`](../packages/typert/protocol) |
 | [`mcp-client`](../packages/mcp/mcp-client) | `mcp` | [`attachment`](../packages/attachment/attachment), [`llm`](../packages/llm/llm), [`mcp-resources`](../packages/mcp/mcp-resources), [`scope`](../packages/core/scope), [`subprocess`](../packages/subprocess/subprocess), [`system-prompt`](../packages/core/system-prompt), [`timeout`](../packages/util/timeout), [`tools`](../packages/core/tools) |
 | [`session-telemetry-otel`](../packages/session/session-telemetry-otel) | `session` | [`anonymous-user-id`](../packages/identity/anonymous-user-id), [`command-feedback`](../packages/feedback/command-feedback), [`llm`](../packages/llm/llm), [`message-feedback`](../packages/feedback/message-feedback), [`session`](../packages/core/session), [`session-telemetry`](../packages/session/session-telemetry) |
@@ -1585,7 +1585,7 @@ flowchart TD
 | [`tool-subagent`](../packages/subagent/tool-subagent) | `subagent` | [`agent`](../packages/core/agent), [`invariants`](../packages/runtime-diagnostics/invariants), [`jobs`](../packages/jobs/jobs), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`session-projection`](../packages/session/session-projection), [`settings`](../packages/settings/settings), [`subagent`](../packages/subagent/subagent), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools) |
 | [`tool-subagent-control`](../packages/subagent/tool-subagent-control) | `subagent` | [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`subagent`](../packages/subagent/subagent), [`tools`](../packages/core/tools) |
 | [`hooks-claude-code`](../packages/hooks/hooks-claude-code) | `hooks` | [`agent`](../packages/core/agent), [`hook-protocol`](../packages/hooks/hook-protocol), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`session-projection`](../packages/session/session-projection), [`subagent`](../packages/subagent/subagent), [`tools`](../packages/core/tools) |
-| [`api-session-controller`](../packages/api/session-controller) | `api` | [`agent`](../packages/core/agent), [`agent-default-model`](../packages/core/agent-default-model), [`agent-presets`](../packages/preset/agent-presets), [`api-gateway`](../packages/api/gateway), [`attachment`](../packages/attachment/attachment), [`client-connection`](../packages/client/connection), [`client-file-upload`](../packages/client/file-upload), [`commands`](../packages/interaction/commands), [`file-reference`](../packages/context/file-reference), [`fs`](../packages/fs/fs), [`jobs`](../packages/jobs/jobs), [`llm`](../packages/llm/llm), [`native-command`](../packages/util/native-command), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`session-persistence`](../packages/session/session-persistence), [`session-projection`](../packages/session/session-projection), [`session-projection-cache`](../packages/session/session-projection-cache), [`session-query`](../packages/session-query/session-query), [`session-title`](../packages/session/session-title), [`skill`](../packages/skill/skill), [`subagent`](../packages/subagent/subagent), [`typert-protocol`](../packages/typert/protocol), [`typert-registry`](../packages/typert/registry), [`util-time`](../packages/util/time), [`util-values`](../packages/util/values), [`util-workspace-path`](../packages/util/workspace-path), [`workspace`](../packages/workspace/workspace) |
+| [`api-session-controller`](../packages/api/session-controller) | `api` | [`agent`](../packages/core/agent), [`agent-default-model`](../packages/core/agent-default-model), [`agent-presets`](../packages/preset/agent-presets), [`api-gateway`](../packages/api/gateway), [`attachment`](../packages/attachment/attachment), [`client-connection`](../packages/client/connection), [`client-file-upload`](../packages/client/file-upload), [`commands`](../packages/interaction/commands), [`file-reference`](../packages/context/file-reference), [`fs`](../packages/fs/fs), [`llm`](../packages/llm/llm), [`native-command`](../packages/util/native-command), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`session-persistence`](../packages/session/session-persistence), [`session-projection`](../packages/session/session-projection), [`session-projection-cache`](../packages/session/session-projection-cache), [`session-query`](../packages/session-query/session-query), [`session-title`](../packages/session/session-title), [`skill`](../packages/skill/skill), [`subagent`](../packages/subagent/subagent), [`typert-protocol`](../packages/typert/protocol), [`typert-registry`](../packages/typert/registry), [`util-time`](../packages/util/time), [`util-values`](../packages/util/values), [`util-workspace-path`](../packages/util/workspace-path), [`workspace`](../packages/workspace/workspace) |
 | [`compaction-basic`](../packages/compaction/compaction-basic) | `compaction` | [`agent`](../packages/core/agent), [`commands`](../packages/interaction/commands), [`compaction`](../packages/compaction/compaction), [`compaction-tool-result-pruner`](../packages/compaction/compaction-tool-result-pruner), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`token-meter`](../packages/llm/token-meter) |
 | [`session-reference`](../packages/context/session-reference) | `context` | [`agent`](../packages/core/agent), [`compaction`](../packages/compaction/compaction), [`llm`](../packages/llm/llm), [`output-retention`](../packages/util/output-retention), [`session`](../packages/core/session), [`session-projection`](../packages/session/session-projection), [`session-projection-cache`](../packages/session/session-projection-cache), [`session-query`](../packages/session-query/session-query), [`session-title`](../packages/session/session-title), [`spill`](../packages/spill/spill), [`subagent`](../packages/subagent/subagent), [`system-prompt`](../packages/core/system-prompt), [`typert-protocol`](../packages/typert/protocol) |
 | [`experimental-agent-team`](../packages/experimental/agent-team) | `experimental` | [`agent`](../packages/core/agent), [`invariants`](../packages/runtime-diagnostics/invariants), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`session-persistence`](../packages/session/session-persistence), [`session-projection`](../packages/session/session-projection), [`subagent`](../packages/subagent/subagent), [`typert-protocol`](../packages/typert/protocol) |
diff --git a/docs/persistence-catalog.i18n.yaml b/docs/persistence-catalog.i18n.yaml
index 5f847038ca..60dba9fa9e 100644
--- a/docs/persistence-catalog.i18n.yaml
+++ b/docs/persistence-catalog.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/persistence-catalog.md
-persistence-catalog.md: 11cea4328db6e69c1ee08994a6d36fe26e308a7c
-persistence-catalog.zh.md: 6207dc17023e566f73cb1e0c7cba40533a4a96ff
+persistence-catalog.md: dd52352ecff33c833154a5aa933767f0b2544b4a
+persistence-catalog.zh.md: 71c0866cc2499ebaf573bc078ecb9f72a32ba128
diff --git a/docs/persistence-catalog.md b/docs/persistence-catalog.md
index 11cea4328d..dd52352ecf 100644
--- a/docs/persistence-catalog.md
+++ b/docs/persistence-catalog.md
@@ -5315,7 +5315,7 @@ Array of `number`.
 
 SHA-256: `4cd48f3e5108bd6ebedf7301c3638839b8b2b9db8dbd493974177fbdeb91a01b`
 
-Sources: [`packages/api/session-controller/src/types.ts:394`](../packages/api/session-controller/src/types.ts) · [`packages/attachment/attachment/src/brand.ts:6`](../packages/attachment/attachment/src/brand.ts) · [`packages/compaction/compaction/src/brand.ts:4`](../packages/compaction/compaction/src/brand.ts) · [`packages/core/session/src/types.ts:20`](../packages/core/session/src/types.ts) · [`packages/experimental/agent-team/src/types.ts:20`](../packages/experimental/agent-team/src/types.ts) · [`packages/experimental/agent-team/src/types.ts:32`](../packages/experimental/agent-team/src/types.ts) · [`packages/experimental/agent-team/src/types.ts:8`](../packages/experimental/agent-team/src/types.ts) · [`packages/feedback/message-feedback/src/types.ts:14`](../packages/feedback/message-feedback/src/types.ts) · [`packages/goal/goal/src/types.ts:17`](../packages/goal/goal/src/types.ts) · [`packages/interaction/commands/src/brand.ts:31`](../packages/interaction/commands/src/brand.ts) · [`packages/interaction/user-approval/src/types.ts:17`](../packages/interaction/user-approval/src/types.ts) · [`packages/llm/llm-retry/src/brand.ts:4`](../packages/llm/llm-retry/src/brand.ts) · [`packages/llm/llm/src/brand.ts:16`](../packages/llm/llm/src/brand.ts) · [`packages/llm/llm/src/brand.ts:31`](../packages/llm/llm/src/brand.ts) · [`packages/llm/llm/src/brand.ts:43`](../packages/llm/llm/src/brand.ts) · [`packages/llm/llm/src/brand.ts:67`](../packages/llm/llm/src/brand.ts) · [`packages/schedule/schedule/src/types.ts:10`](../packages/schedule/schedule/src/types.ts) · [`packages/session/session-title/src/index.ts:42`](../packages/session/session-title/src/index.ts) · [`packages/session/session-title/src/types.ts:17`](../packages/session/session-title/src/types.ts) · [`packages/webhook/webhook/src/brand.ts:12`](../packages/webhook/webhook/src/brand.ts) · [`packages/webhook/webhook/src/brand.ts:6`](../packages/webhook/webhook/src/brand.ts) · [`packages/webhook/webhook/src/brand.ts:9`](../packages/webhook/webhook/src/brand.ts) · [`packages/workflow/workflow/src/types.ts:13`](../packages/workflow/workflow/src/types.ts)
+Sources: [`packages/api/session-controller/src/types.ts:396`](../packages/api/session-controller/src/types.ts) · [`packages/attachment/attachment/src/brand.ts:6`](../packages/attachment/attachment/src/brand.ts) · [`packages/compaction/compaction/src/brand.ts:4`](../packages/compaction/compaction/src/brand.ts) · [`packages/core/session/src/types.ts:20`](../packages/core/session/src/types.ts) · [`packages/experimental/agent-team/src/types.ts:20`](../packages/experimental/agent-team/src/types.ts) · [`packages/experimental/agent-team/src/types.ts:32`](../packages/experimental/agent-team/src/types.ts) · [`packages/experimental/agent-team/src/types.ts:8`](../packages/experimental/agent-team/src/types.ts) · [`packages/feedback/message-feedback/src/types.ts:14`](../packages/feedback/message-feedback/src/types.ts) · [`packages/goal/goal/src/types.ts:17`](../packages/goal/goal/src/types.ts) · [`packages/interaction/commands/src/brand.ts:31`](../packages/interaction/commands/src/brand.ts) · [`packages/interaction/user-approval/src/types.ts:17`](../packages/interaction/user-approval/src/types.ts) · [`packages/llm/llm-retry/src/brand.ts:4`](../packages/llm/llm-retry/src/brand.ts) · [`packages/llm/llm/src/brand.ts:16`](../packages/llm/llm/src/brand.ts) · [`packages/llm/llm/src/brand.ts:31`](../packages/llm/llm/src/brand.ts) · [`packages/llm/llm/src/brand.ts:43`](../packages/llm/llm/src/brand.ts) · [`packages/llm/llm/src/brand.ts:67`](../packages/llm/llm/src/brand.ts) · [`packages/schedule/schedule/src/types.ts:10`](../packages/schedule/schedule/src/types.ts) · [`packages/session/session-title/src/index.ts:42`](../packages/session/session-title/src/index.ts) · [`packages/session/session-title/src/types.ts:17`](../packages/session/session-title/src/types.ts) · [`packages/webhook/webhook/src/brand.ts:12`](../packages/webhook/webhook/src/brand.ts) · [`packages/webhook/webhook/src/brand.ts:6`](../packages/webhook/webhook/src/brand.ts) · [`packages/webhook/webhook/src/brand.ts:9`](../packages/webhook/webhook/src/brand.ts) · [`packages/workflow/workflow/src/types.ts:13`](../packages/workflow/workflow/src/types.ts)
 
 `string`
 
@@ -7248,7 +7248,7 @@ Sources: [`packages/core/tools/src/index.ts:34`](../packages/core/tools/src/inde
 
 SHA-256: `6a4f72e2e179e17b922f2a9392c0e1c8f8c707f32494372454850a3eb184a6e7`
 
-Sources: [`packages/api/session-controller/src/types.ts:399`](../packages/api/session-controller/src/types.ts)
+Sources: [`packages/api/session-controller/src/types.ts:401`](../packages/api/session-controller/src/types.ts)
 
 | Property | Presence | Type |
 |---|---|---|
diff --git a/docs/persistence-catalog.zh.md b/docs/persistence-catalog.zh.md
index 6207dc1702..71c0866cc2 100644
--- a/docs/persistence-catalog.zh.md
+++ b/docs/persistence-catalog.zh.md
@@ -5317,7 +5317,7 @@ SHA-256: `5d03ba38734809bcbd2a55221bd938b3b3fc34b49bb686c6113e9e4931e3aa78`
 
 SHA-256: `4cd48f3e5108bd6ebedf7301c3638839b8b2b9db8dbd493974177fbdeb91a01b`
 
-来源：[`packages/api/session-controller/src/types.ts:394`](../packages/api/session-controller/src/types.ts) · [`packages/attachment/attachment/src/brand.ts:6`](../packages/attachment/attachment/src/brand.ts) · [`packages/compaction/compaction/src/brand.ts:4`](../packages/compaction/compaction/src/brand.ts) · [`packages/core/session/src/types.ts:20`](../packages/core/session/src/types.ts) · [`packages/experimental/agent-team/src/types.ts:20`](../packages/experimental/agent-team/src/types.ts) · [`packages/experimental/agent-team/src/types.ts:32`](../packages/experimental/agent-team/src/types.ts) · [`packages/experimental/agent-team/src/types.ts:8`](../packages/experimental/agent-team/src/types.ts) · [`packages/feedback/message-feedback/src/types.ts:14`](../packages/feedback/message-feedback/src/types.ts) · [`packages/goal/goal/src/types.ts:17`](../packages/goal/goal/src/types.ts) · [`packages/interaction/commands/src/brand.ts:31`](../packages/interaction/commands/src/brand.ts) · [`packages/interaction/user-approval/src/types.ts:17`](../packages/interaction/user-approval/src/types.ts) · [`packages/llm/llm-retry/src/brand.ts:4`](../packages/llm/llm-retry/src/brand.ts) · [`packages/llm/llm/src/brand.ts:16`](../packages/llm/llm/src/brand.ts) · [`packages/llm/llm/src/brand.ts:31`](../packages/llm/llm/src/brand.ts) · [`packages/llm/llm/src/brand.ts:43`](../packages/llm/llm/src/brand.ts) · [`packages/llm/llm/src/brand.ts:67`](../packages/llm/llm/src/brand.ts) · [`packages/schedule/schedule/src/types.ts:10`](../packages/schedule/schedule/src/types.ts) · [`packages/session/session-title/src/index.ts:42`](../packages/session/session-title/src/index.ts) · [`packages/session/session-title/src/types.ts:17`](../packages/session/session-title/src/types.ts) · [`packages/webhook/webhook/src/brand.ts:12`](../packages/webhook/webhook/src/brand.ts) · [`packages/webhook/webhook/src/brand.ts:6`](../packages/webhook/webhook/src/brand.ts) · [`packages/webhook/webhook/src/brand.ts:9`](../packages/webhook/webhook/src/brand.ts) · [`packages/workflow/workflow/src/types.ts:13`](../packages/workflow/workflow/src/types.ts)
+来源：[`packages/api/session-controller/src/types.ts:396`](../packages/api/session-controller/src/types.ts) · [`packages/attachment/attachment/src/brand.ts:6`](../packages/attachment/attachment/src/brand.ts) · [`packages/compaction/compaction/src/brand.ts:4`](../packages/compaction/compaction/src/brand.ts) · [`packages/core/session/src/types.ts:20`](../packages/core/session/src/types.ts) · [`packages/experimental/agent-team/src/types.ts:20`](../packages/experimental/agent-team/src/types.ts) · [`packages/experimental/agent-team/src/types.ts:32`](../packages/experimental/agent-team/src/types.ts) · [`packages/experimental/agent-team/src/types.ts:8`](../packages/experimental/agent-team/src/types.ts) · [`packages/feedback/message-feedback/src/types.ts:14`](../packages/feedback/message-feedback/src/types.ts) · [`packages/goal/goal/src/types.ts:17`](../packages/goal/goal/src/types.ts) · [`packages/interaction/commands/src/brand.ts:31`](../packages/interaction/commands/src/brand.ts) · [`packages/interaction/user-approval/src/types.ts:17`](../packages/interaction/user-approval/src/types.ts) · [`packages/llm/llm-retry/src/brand.ts:4`](../packages/llm/llm-retry/src/brand.ts) · [`packages/llm/llm/src/brand.ts:16`](../packages/llm/llm/src/brand.ts) · [`packages/llm/llm/src/brand.ts:31`](../packages/llm/llm/src/brand.ts) · [`packages/llm/llm/src/brand.ts:43`](../packages/llm/llm/src/brand.ts) · [`packages/llm/llm/src/brand.ts:67`](../packages/llm/llm/src/brand.ts) · [`packages/schedule/schedule/src/types.ts:10`](../packages/schedule/schedule/src/types.ts) · [`packages/session/session-title/src/index.ts:42`](../packages/session/session-title/src/index.ts) · [`packages/session/session-title/src/types.ts:17`](../packages/session/session-title/src/types.ts) · [`packages/webhook/webhook/src/brand.ts:12`](../packages/webhook/webhook/src/brand.ts) · [`packages/webhook/webhook/src/brand.ts:6`](../packages/webhook/webhook/src/brand.ts) · [`packages/webhook/webhook/src/brand.ts:9`](../packages/webhook/webhook/src/brand.ts) · [`packages/workflow/workflow/src/types.ts:13`](../packages/workflow/workflow/src/types.ts)
 
 `string`
 
@@ -7250,7 +7250,7 @@ SHA-256: `8fcb0b44a575e998665c053643d1ab04c82f39253ebd190ac0c975b78e40b543`
 
 SHA-256: `6a4f72e2e179e17b922f2a9392c0e1c8f8c707f32494372454850a3eb184a6e7`
 
-来源：[`packages/api/session-controller/src/types.ts:399`](../packages/api/session-controller/src/types.ts)
+来源：[`packages/api/session-controller/src/types.ts:401`](../packages/api/session-controller/src/types.ts)
 
 | 属性 | 存在性 | 类型 |
 |---|---|---|
diff --git a/docs/persistence-schema.json b/docs/persistence-schema.json
index 59b8a86b4a..c4e1c3b950 100644
--- a/docs/persistence-schema.json
+++ b/docs/persistence-schema.json
@@ -44608,7 +44608,7 @@
         "packages/workflow/workflow/src/types.ts#WorkflowRunId"
       ],
       "sources": [
-        "packages/api/session-controller/src/types.ts:394",
+        "packages/api/session-controller/src/types.ts:396",
         "packages/attachment/attachment/src/brand.ts:6",
         "packages/compaction/compaction/src/brand.ts:4",
         "packages/core/session/src/types.ts:20",
@@ -58191,7 +58191,7 @@
       },
       "names": [],
       "sources": [
-        "packages/api/session-controller/src/types.ts:399"
+        "packages/api/session-controller/src/types.ts:401"
       ]
     },
     {
diff --git a/docs/subsystems/jobs.i18n.yaml b/docs/subsystems/jobs.i18n.yaml
index 20d4e50962..f69e46f9a0 100644
--- a/docs/subsystems/jobs.i18n.yaml
+++ b/docs/subsystems/jobs.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/subsystems/jobs.md
-jobs.md: 4be335207b7dd94f08015ecda595a6b1cc301a7f
-jobs.zh.md: 9dc390eb30901664edb47c6727a54ddd83839fa7
+jobs.md: d54b1ecdd8957c162268c8abbc1df6d764695ac7
+jobs.zh.md: 3b0db7c654d02ace451e73203923d816e9262230
diff --git a/docs/subsystems/jobs.md b/docs/subsystems/jobs.md
index 4be335207b..d54b1ecdd8 100644
--- a/docs/subsystems/jobs.md
+++ b/docs/subsystems/jobs.md
@@ -2,7 +2,7 @@
 
 English | [中文](jobs.zh.md)
 
-Types shared by long-running producers, `ctx.jobs`, and job controls. The [runtime Agent Note](../../.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.md) owns the design; this page records the exact fields and variants from [`packages/jobs/jobs/src/types.ts`](../../packages/jobs/jobs/src/types.ts).
+Types shared by long-running producers, `ctx.jobs`, and job controls. The [seam consolidation Agent Note](../../.agents/notes/implemented/architecture/2026-09-03-jobs-seam-consolidation.md) owns the current design and the [runtime Agent Note](../../.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.md) its origin; this page records the exact fields and variants from [`packages/jobs/jobs/src/types.ts`](../../packages/jobs/jobs/src/types.ts) and the client-safe [`view.ts`](../../packages/jobs/jobs/src/view.ts) leaf.
 
 ## Ids and status
 
@@ -19,45 +19,83 @@ interface JobKindMap {
 }
 ```
 
-`JobStatus` is `'running' | 'stopping' | 'completed' | 'killed' | 'failed'`; producer-specific facts belong in `JobSnapshot.detail`.
+`JobStatus` is `'running' | 'stopping' | 'completed' | 'killed' | 'failed'`; producer-specific facts belong in `JobView.progress` while the job runs and in `JobView.detail` once it settled.
 
 ## Producer contract
 
-`JobStart` declares identity and a starter. The runtime finishes preflight before calling `run()` and commits without a later failable step. Producers own execution resources; the runtime owns identity, access, and lifecycle state.
+A `JobSpec` declares identity, the owning session, optional pull `output` sources, and a starter. The runtime finishes preflight before calling `run()` with the job's `JobHandle` and commits without a later failable step. Producers own execution resources; the runtime owns identity, access, lifecycle state, and the output ring.
 
 ```ts type-equiv
 /**
  * Producer declaration passed to {@link JobRegistry.start}. The runtime
  * preflights access and cleanup before invoking {@link run}; the producer owns
- * execution resources while the runtime owns identity and lifecycle state.
+ * execution resources while the runtime owns identity, lifecycle state, and
+ * the output ring.
  */
-interface JobStart {
+interface JobSpec {
   /** Producer kind — also the id prefix (`bash`, `subagent`, …). */
   kind: JobKind
   /** One-line model-facing label (the command; the delegation description). */
   label: string
+  /**
+   * Owning session. Access is fenced by it, and the owner's live Agent must be
+   * the one currently registered under that id: its disposal cancels and
+   * awaits the job. Omitting the owner creates an unowned job, open to any
+   * caller until service disposal.
+   */
+  owner?: SessionId
   /**
    * Optional UTF-8 byte cap for each complete model-facing completion notice or
-   * output read, including controller status metadata.
+   * output read, including controller status metadata. Independent of ring
+   * retention: it bounds the consuming model surface, never observers.
    */
   outputLimitBytes?: number
   /**
-   * Owning live agent. Access is fenced by its session id, and agent disposal
-   * cancels and awaits the job. The instance must be the one currently
-   * registered under its agent id. Omitting the owner creates an unowned job,
-   * open to any caller until service disposal.
+   * Pull sources the registry pumps into the ring at its own cadence.
+   * Producers that narrate their own progress use {@link JobHandle.append}
+   * instead; a job may use both.
    */
-  owner?: Agent
+  output?: readonly JobOutputSource[]
   /**
    * Start the work after preflight and synchronously return its hooks. Called
-   * once; a throw leaves nothing registered, and the producer must clean up any
-   * partially started resources.
+   * once with the job's producer face; a throw leaves nothing registered (the
+   * spent ordinal is skipped), and the producer must clean up any partially
+   * started resources.
+   * @param job - the issued id plus the ring append and progress writers.
    */
-  run(): JobHooks
+  run(job: JobHandle): JobHooks
 }
 ```
 
-`JobHooks.done` resolves after the producer releases its resources, not merely when work finishes. Optional `readOutput` distinguishes consuming stream jobs from final-output-only jobs.
+```ts type-equiv
+/**
+ * Producer face of one registered job, handed to {@link JobSpec.run} and
+ * valid for the job's whole life. All methods are synchronous. Writes staged
+ * inside the starter call are retained and become visible with the
+ * registration commit; after settlement — the producer's own outcome, a kill,
+ * or a registry-forced teardown end — writes log and drop instead of
+ * throwing, so a producer's trailing flush cannot break its own teardown path.
+ */
+interface JobHandle {
+  /** The registry-issued id (`<kind>-N`). */
+  readonly id: JobId
+  /**
+   * Append one chunk to the output ring. Offsets advance by the chunk's UTF-8
+   * byte length; an empty chunk is dropped without waking observers.
+   * @param text - the chunk text, exactly as produced.
+   * @param options - stream label and gap marker.
+   */
+  append(text: string, options?: JobAppendOptions): void
+  /**
+   * Replace the live progress line (`3/10`, the current phase). Settlement
+   * clears it; the terminal reason travels in {@link JobOutcome.detail}.
+   * @param line - the new progress line.
+   */
+  updateProgress(line: string): void
+}
+```
+
+`JobHooks.done` resolves after the producer releases its resources, not merely when work finishes. A job whose result is a value rather than a stream — a subagent's report, a workflow's rendered result — returns it as `JobOutcome.result`; the model's first read after settlement carries it once.
 
 ```ts type-equiv
 /** Hooks through which the runtime controls and observes producer work. */
@@ -74,12 +112,6 @@ interface JobHooks {
    * registry record without claiming that the work stopped.
    */
   done: Promise<JobOutcome>
-  /**
-   * Consume output produced since the previous call. The producer formats
-   * truncation and spill notices. Absence marks a final-output-only job; each
-   * job has one consuming cursor.
-   */
-  readOutput?(): string
 }
 ```
 
@@ -88,73 +120,207 @@ interface JobHooks {
 interface JobOutcome {
   /** How the job ended: finished (`completed`), cancelled (`killed`), or broke (`failed`). */
   status: 'completed' | 'killed' | 'failed'
-  /** Kind-specific detail rendered into status lines ('exit code: 3', 'max-tokens'). */
+  /**
+   * Terminal reason rendered into status lines (`exit code: 3`, `max-tokens`).
+   * When the job settles `killed` after a {@link JobRegistry.kill} with a
+   * reason, the registry appends that reason.
+   */
   detail?: string
-  /** Final output for jobs without `readOutput`; stream jobs leave it unset. */
-  output?: string
+  /**
+   * Return value for jobs whose result is a value rather than a stream (a
+   * workflow's rendered result, a subagent's report). The output ring carries
+   * the stream; this is handed out once by the model's next {@link JobRegistry.read}.
+   */
+  result?: string
+}
+```
+
+A pull source hands the registry a non-consuming offset reader — the subprocess `readFrom` family. The registry pumps every source at its own cadence (`pumpPollMs` on `dsh-jobs-local`) and drains it once more before settlement closes the ring, so producers fold nothing into `done`.
+
+```ts type-equiv
+/**
+ * A pull source the registry pumps into the job's output ring — the subprocess
+ * `readFrom` family. The registry owns the cadence and drains every source one
+ * last time before settlement closes the ring, so a producer folds nothing
+ * into its `done`.
+ */
+interface JobOutputSource {
+  /** Stream label attached to every chunk this source yields. */
+  channel?: JobChannel
+  /**
+   * Read everything captured since `fromByte` without consuming it.
+   * @param fromByte - whole-stream offset to resume from (a prior read's `nextOffset`; 0 first).
+   * @returns the delta text, the next offset, the lossy flag, and the spill path the source currently keeps.
+   */
+  read(fromByte: number): JobSourceRead
+}
+```
+
+```ts type-equiv
+/** One incremental read from a {@link JobOutputSource}. */
+interface JobSourceRead {
+  /** Text captured since the requested offset (the whole retained tail when lossy). */
+  text: string
+  /** Whole-stream offset to resume from on the next read. */
+  nextOffset: number
+  /** True when the requested offset slid out of the source's retained window. */
+  lossy: boolean
+  /**
+   * Host path of a file holding the complete stream, when the source
+   * currently keeps an intact one. Reported on every read, so the registry
+   * tracks it as source metadata: a later read without it withdraws the file.
+   */
+  spillPath?: string
+}
+```
+
+## The output ring
+
+Every job owns one bounded ring. Pull sources are pumped into it and `JobHandle.append` pushes land whole; the model consumes the ring through a registry-kept cursor (`JobRegistry.read`), any number of observers read it at absolute byte offsets (`JobRegistry.readAt`), and neither disturbs the other. `JobChannel` labels `stdout`, `stderr`, and `log`; `log` is producer narration that reaches observers only, never the model's consuming read. Settlement ends the stream and trims retention to the settled cap — the ring has no separate lifecycle. The spill file a pull source keeps is job metadata (`JobView.output.spillPaths`, refreshed by every pump read), not per-chunk metadata, so the model's dropped-output notice names it after the ring evicted the bytes and even after the gap chunk itself is gone. Browsers reach the roster and the ring through `job.list` and `job.follow`, the Remote streams of [`dsh-api-job-controller`](../../packages/api/job-controller/README.md), whose frames are listed under its Cordis API section below.
+
+```ts type-equiv
+/** One chunk of a job's output ring: absolute offset, text, channel, and loss marker. */
+interface JobChunk {
+  /** Absolute offset of the chunk's first byte; offsets never move once assigned. */
+  readonly at: number
+  /** Chunk text exactly as appended (possibly tail-trimmed by retention). */
+  readonly text: string
+  /** Stream label, when the producer supplied one. */
+  readonly channel?: JobChannel
+  /** Bytes immediately before this chunk were lost, at the producer or to retention. */
+  readonly gapBefore?: true
+}
+```
+
+```ts type-equiv
+/** Result of one non-consuming {@link JobRegistry.readAt}. */
+interface JobOutputRead {
+  /** Retained chunks overlapping `[from, total)`, in offset order. */
+  chunks: readonly JobChunk[]
+  /**
+   * Offset to resume from — the ring's current `total`. Always a chunk
+   * boundary: appends land whole and trimming only advances chunk starts, and
+   * consumers concatenate `chunks` under that assumption, so a provider
+   * serving partial chunks would silently duplicate text.
+   */
+  next: number
+  /** True when `from` fell below the oldest retained byte, so bytes are missing before `chunks`. */
+  lossy: boolean
 }
 ```
 
 ## Consumer views
 
-Snapshots are fresh read-only projections. `ownerSession` carries the shared `SessionId` used for authorization; completion listeners separately receive the exact owner object used for lifecycle cleanup. `reported` suppresses a completion notice after another reporter has delivered or committed to deliver the terminal state, including the teardown cancel that drains an owner or the service.
+`JobView` is the one projection every reader consumes: the model tools, the browser roster, and the observation stream. `owner` carries the session id that fences access; the registry resolves the live `Agent` behind it for lifecycle cleanup and never hands the object out. `progress` is the producer's live line and is cleared at settlement; `detail` is the terminal reason, with a recorded kill reason merged in.
 
 ```ts type-equiv
 /**
- * A read-only projection of one job, safe to hand to listeners and tools —
- * a fresh object per call, never live registry state.
+ * Read-only projection of one job — a fresh object per call, never live
+ * registry state. The model tools, the browser roster, and the observation
+ * stream all consume this one shape.
  */
-interface JobSnapshot {
+interface JobView {
   /** The registry-issued id (`<kind>-N`). */
-  id: JobId
-  /** The producer kind the job was registered with. */
-  kind: JobKind
+  readonly id: JobId
+  /**
+   * The producer kind the job was registered with: a Host-registered
+   * `JobKind`, carried as an open string because a browser bundle or a Remote
+   * codec sees only the `JobKindMap` merges its own program compiles.
+   */
+  readonly kind: string
   /** The producer-supplied one-line label. */
-  label: string
-  /** Producer-owned cap for complete model-facing notices and output reads. */
-  outputLimitBytes?: number
-  /**
-   * Owner session id used for authorization and correlation; absent for
-   * unowned jobs. Completion listeners receive the exact {@link Agent}
-   * separately through {@link JobDoneListener}.
-   */
-  ownerSession?: SessionId
+  readonly label: string
+  /** Owning session; absent for an unowned job, which every caller can see. */
+  readonly owner?: SessionId
+  /** Producer-owned cap for complete model-facing notices and reads, in UTF-8 bytes. */
+  readonly outputLimitBytes?: number
   /** Current lifecycle state. */
-  status: JobStatus
-  /** Kind-specific status detail, present once the producer supplied one (usually terminal). */
-  detail?: string
+  readonly status: JobStatus
+  /** The producer's live progress line (`3/10`, the current phase); cleared at settlement. */
+  readonly progress?: string
+  /** Terminal reason (`exit code: 3`); a recorded kill reason is merged in. */
+  readonly detail?: string
   /** Epoch ms when the job was registered. */
-  startedAt: number
-  /** Epoch ms when the job settled; absent while `running`/`stopping`. */
-  finishedAt?: number
+  readonly startedAt: number
+  /** Epoch ms when the job settled; absent while live. */
+  readonly finishedAt?: number
   /**
-   * True when a kill, read, wait, or teardown cancel has reported or committed
-   * to report the terminal state. Completion reporters suppress redundant
-   * notices when set. Teardown claims it because the owner or service being
-   * destroyed leaves no reader: a reporter that opens a turn on notice would
-   * otherwise spend a model request per teardown layer.
+   * The output ring's absolute coordinates and the complete-stream files
+   * behind it. `total` is the offset the next chunk starts at (0 while
+   * nothing was written); `earliest` is the oldest retained byte, greater
+   * than zero exactly when retention dropped the head. `spillPaths` lists the
+   * spill files the job's pull sources currently keep, in source order and
+   * deduplicated, and is absent while no source keeps one: it outlives any
+   * chunk, so a reader below `earliest` can still name where the bytes went.
    */
-  reported: boolean
+  readonly output: { readonly total: number; readonly earliest: number; readonly spillPaths?: readonly string[] }
 }
 ```
 
+`JobRegistry.list`, `get`, `read`, `readAt`, `kill`, and `wait` each accept the caller’s `SessionId`; omitting it permits only unowned jobs, while a session may also access its own jobs.
+
 ```ts type-equiv
-/** Output and post-read state returned by {@link JobRegistry.read}. */
+/** Output and post-read state returned by the consuming {@link JobRegistry.read}. */
 interface JobRead {
-  /**
-   * Stream kinds: the consuming delta since the previous read. Final-output
-   * kinds: empty while live, the terminal {@link JobOutcome.output} (or
-   * empty) once settled — idempotent, never consumed.
-   */
-  text: string
+  /** Ring chunks appended since the model cursor, in offset order; every channel included. */
+  chunks: readonly JobChunk[]
+  /** True when the cursor fell below the oldest retained byte, so bytes are missing before `chunks`. */
+  lossy: boolean
+  /** The producer's {@link JobOutcome.result}, handed out by the first read after settlement only. */
+  result?: string
   /** The job's state at read time. */
-  snapshot: JobSnapshot
+  job: JobView
 }
 ```
 
+## Events
+
+The registry announces every commit through one filtered stream. Lifecycle events carry the projection after the commit they announce; `settled` names its cause so a completion reporter can skip a teardown; `output` carries only the id and the new total, so observers read from their own cursor and the registry never pushes payloads.
+
+```ts type-equiv
+/**
+ * One lifecycle or output event. Lifecycle events carry the job's projection
+ * after the commit they announce; `output` carries only the id and the new
+ * total, so an observer schedules a {@link JobRegistry.readAt} from its own
+ * cursor and the registry never pushes payloads.
+ */
+type JobEvent =
+  | {
+    /** Registration commit, progress line change, stopping transition, or removal from the visible set. */
+    readonly type: 'registered' | 'progress' | 'stopping' | 'removed'
+    readonly job: JobView
+  }
+  | {
+    readonly type: 'settled'
+    readonly job: JobView
+    readonly cause: JobSettleCause
+  }
+  | {
+    readonly type: 'output'
+    readonly id: JobId
+    /** Owning session, absent for an unowned job. */
+    readonly owner?: SessionId
+    /** The ring's total after the append (or at settlement, which ends the stream). */
+    readonly total: number
+  }
+```
+
+```ts type-equiv
+/**
+ * Who a subscription hears about. `{ owner }` delivers that session's jobs
+ * plus every unowned job (the set that session can see). `{ owners: 'scope' }`
+ * delivers the owners composed under the subscribing context — one registry
+ * serves every composition in the process, and a mount under one preset must
+ * not hear another preset's agents. `{ owners: 'all' }` delivers everything.
+ */
+type JobEventFilter =
+  | { readonly owner: SessionId }
+  | { readonly owners: 'all' | 'scope' }
+```
+
 ## Service behavior
 
-The abstract [`JobRegistry`](../../packages/jobs/jobs/src/index.ts) Service Definition specifies atomic `start`, caller-scoped `get` and `list`, `read`, `kill`, bounded `wait`, failure-isolated `onJobDone` and `onJobsChanged` listeners, and `attachController`; [`LocalJobRegistry`](../../packages/jobs/jobs-local/src/index.ts) is the process-local Service Provider. Authorization compares owner sessions; owner cleanup and admission use the exact registered `Agent` instance. The local provider's positive-safe-integer `maxConcurrentJobsPerOwner` config defaults to `10` and counts `running` plus `stopping` records per exact owner, with one shared bucket for unowned jobs; terminal producer settlement releases capacity. See [`dsh-jobs`](../../packages/jobs/jobs/README.md) for the Service Definition contract, [`dsh-jobs-local`](../../packages/jobs/jobs-local/README.md) for the registry lifecycle and admission policy, and [`dsh-tool-jobs`](../../packages/jobs/tool-jobs/README.md) for the model-facing Consumer.
+The abstract [`JobRegistry`](../../packages/jobs/jobs/src/index.ts) Service Definition specifies atomic `start`, caller-scoped `list`, `get`, consuming `read`, non-consuming `readAt`, `kill`, and bounded `wait`, the filtered `events` stream, and `attachController`; [`LocalJobRegistry`](../../packages/jobs/jobs-local/src/index.ts) is the process-local Service Provider. Authorization compares owner sessions; owner cleanup and admission use the live `Agent` registered under the owner session when the job starts. The local provider's positive-safe-integer `maxConcurrentJobsPerOwner` config defaults to `10` and counts `running` plus `stopping` records per exact owner, with one shared bucket for unowned jobs; terminal producer settlement releases capacity; `retainBytes` (default 262144) and `settledRetainBytes` (default 16384) bound each ring's live and settled retention, and `pumpPollMs` (default 150) is the pull cadence. See [`dsh-jobs`](../../packages/jobs/jobs/README.md) for the Service Definition contract, [`dsh-jobs-local`](../../packages/jobs/jobs-local/README.md) for the registry lifecycle and admission policy, and [`dsh-tool-jobs`](../../packages/jobs/tool-jobs/README.md) for the model-facing Consumer.
 
 <!-- BEGIN GENERATED cordis-surface (gen-cordis-catalog.ts) — do not edit between markers -->
 
@@ -164,18 +330,52 @@ The abstract [`JobRegistry`](../../packages/jobs/jobs/src/index.ts) Service Defi
 
 Generated from source by `scripts/gen-cordis-catalog.ts` (verified fresh by `pnpm run verify-cordis-catalog` in doc-sync; regenerate with `pnpm run gen-cordis-catalog`) — the language sides differ only in locale-specific paired document paths. Signature blocks use a `ts cordis-catalog` fence and keep the original source JSDoc; dispatch modes are defined in the [primer](../cordis-primer.md#dispatch-modes), and the framework-inherited `ctx` API lives in [cordis-api/inherited.md](../cordis-api/inherited.md).
 
+<a id="ctxjobcontroller--jobcontroller"></a>
+
+### `ctx.jobController` — `JobController`
+
+Host service backing the generated `ctx.remote.job` namespace.
+
+```ts cordis-catalog
+/**
+ * Stream the jobs one session can see — its own plus every unowned job —
+ * as whole-set frames: one on open, then one after each coalesced burst of
+ * lifecycle commits. The stream has no natural end; the carrier closes it.
+ * @param request - the session whose visible set to mirror.
+ * @param signal - cancellation owned by the Remote stream carrier.
+ * @returns the roster frames.
+ */
+@Remote({ mode: 'stream' }) list(request: JobListRequest, signal: AbortSignal): AsyncIterable<JobListFrame>
+
+/**
+ * Stream one job's retained output from an absolute byte offset, then its
+ * terminal projection once settled and drained. Non-consuming: the
+ * model-facing cursor and notice state never observe these reads. The
+ * request's session is the fenced read's caller; the registry rejects a
+ * job the session cannot see and an unknown job.
+ * @param request - target job, owning session, and optional resume offset.
+ * @param signal - cancellation owned by the Remote stream carrier.
+ * @returns anchor, coalesced output frames, and the terminal status.
+ */
+@Remote({ mode: 'stream' }) follow(request: JobFollowRequest, signal: AbortSignal): AsyncIterable<JobFollowFrame>
+```
+
+Source: [`packages/api/job-controller/src/index.ts`](../../packages/api/job-controller/src/index.ts)
+
 <a id="ctxjobs--jobregistry-abstract-seam"></a>
 
 ### `ctx.jobs` — `JobRegistry` (abstract seam)
 
-Abstract background job registry. Subclass, implement the abstract methods, and load the subclass as a plugin — it registers as `ctx.jobs` (one implementation per context; loading a second throws, which is cordis' standard duplicate-service behavior).
+Abstract background job registry. Subclass, implement the abstract members, and load the subclass as a plugin — it registers as `ctx.jobs` (one implementation per context; loading a second throws, which is cordis' standard duplicate-service behavior).
 
 Implementations must honor these semantics:
 
-- Registrations outlive producer and controller fibers. Owner and service disposal cancel live work and await compliant producers; a throwing teardown cancel force-fails only the record. Teardown cancellation also marks the record reported, because a record its owner is being destroyed for has no reader left.
+- Registrations outlive producer and controller fibers. Owner and service disposal cancel live work and await compliant producers; a throwing teardown cancel force-fails only the record. Such settlements announce `cause: 'teardown'`, because a job whose owner is being destroyed has no reader left.
 - Owned-job access is fenced by the owner's session id. Ids are predictable, so authorization — not secrecy — is the boundary.
-- Settlement is first-wins: one terminal record, released waiters, and one round of contained listener notification, even against a late producer outcome. Completion is announced last, after the record is committed and every other observer of the settlement has seen it, because a reporter may open a model turn synchronously.
-- start refuses work while no attached job controller serves the spec's owner, so a producer cannot start work that owner cannot collect or stop. One registry serves every composition in the process, so this question — and completion-listener delivery — is owner-relative rather than process-wide: registrations made from an unscoped context serve every owner, and registrations made under an agent composition's scope serve exactly the agents composed under it.
+- Settlement is first-wins: one terminal record, released waiters, then one round of contained event delivery, even against a late producer outcome. The `settled` event follows every released waiter, so a consumer that claims a settlement while waiting always claims before the event.
+- start refuses work while no attached job controller serves the spec's owner, so a producer cannot start work that owner cannot collect or stop. One registry serves every composition in the process, so this question — and event delivery under `{ owners: 'scope' }` — is owner-relative rather than process-wide: registrations made from an unscoped context serve every owner, and registrations made under an agent composition's scope serve exactly the agents composed under it.
+- Every job owns one output ring. Pull sources named by the spec are pumped by the registry and drained once more before settlement; pushed appends land whole. The model's consuming cursor and observers' absolute offsets read the same bytes and never disturb each other.
+- Ring retention is bounded. Appends past the live cap drop the oldest retained bytes; a reader below the retained window gets a lossy read, never an error. Settlement trims retention to the settled cap and ends the stream; the ring has no separate lifecycle.
 
 ```ts cordis-catalog
 /**
@@ -183,96 +383,73 @@ Implementations must honor these semantics:
  * admission before starting and atomically registering work. Any preflight
  * rejection leaves no job id or execution resource. A throwing starter
  * leaves nothing registered; after it returns, registration cannot fail.
- * Settlement records the outcome, notifies listeners, and releases waiters.
- * @param spec - job identity, owner, and synchronous starter.
+ * @param spec - job identity, owner, output sources, and synchronous starter.
  * @returns the registry-issued `<kind>-N` id.
  */
-abstract start(spec: JobStart): JobId
+abstract start(spec: JobSpec): JobId
 
 /**
- * List caller-owned and unowned jobs in registration order without exposing
- * another session's labels.
- * @param caller - reading agent; a non-agent caller sees only unowned jobs.
- * @returns fresh snapshots.
+ * List caller-owned and unowned jobs in registration order.
+ * @param caller - reading session; omission sees only unowned jobs.
+ * @returns fresh projections.
  */
-abstract list(caller?: Agent): JobSnapshot[]
+abstract list(caller?: SessionId): JobView[]
 
 /**
- * Return a non-consuming snapshot without changing its read cursor or notice
- * state. Throws for an unknown or foreign job.
- * @param id - job to look up.
- * @param caller - reading agent checked against the owner.
- * @returns a fresh snapshot.
- */
-abstract get(id: JobId, caller?: Agent): JobSnapshot
-
-/**
- * Read the next stream delta, or the idempotent final output after settlement.
- * A terminal read marks the job reported. Throws for an unknown or foreign
- * job.
- * @param id - job to read.
- * @param caller - reading agent checked against the owner.
- * @returns output text and the post-read snapshot.
- */
-abstract read(id: JobId, caller?: Agent): JobRead
-
-/**
- * Request cancellation, then mark the job stopping and reported. A producer
- * throw propagates without changing job state. Throws for an unknown or
+ * Project one job without changing its cursor. Throws for an unknown or
  * foreign job.
+ * @param id - job to look up.
+ * @param caller - reading session checked against the owner.
+ * @returns a fresh projection.
+ */
+abstract get(id: JobId, caller?: SessionId): JobView
+
+/**
+ * Consume the ring from the model cursor and advance it to the current
+ * total. After settlement the first read also carries the producer's
+ * result. Throws for an unknown or foreign job.
+ * @param id - job to read.
+ * @param caller - reading session checked against the owner.
+ * @returns the chunks since the cursor, the lossy flag, the result once, and the post-read projection.
+ */
+abstract read(id: JobId, caller?: SessionId): JobRead
+
+/**
+ * Read retained ring output without moving the model cursor. Resume with
+ * a previous read's `next`; an offset inside a retained chunk returns the
+ * whole chunk (its `at` may precede `from`). Throws for a negative or
+ * non-integer offset, or an unknown or foreign job.
+ * @param id - job to read.
+ * @param from - absolute byte offset to read from (0 for the retained head).
+ * @param caller - reading session checked against the owner.
+ * @returns retained chunks overlapping `[from, total)`, the resume offset, and the lossy flag.
+ */
+abstract readAt(id: JobId, from: number, caller?: SessionId): JobOutputRead
+
+/**
+ * Request cancellation, then mark the job stopping. A producer throw
+ * propagates without changing job state. A supplied reason is merged into
+ * terminal `detail` when the job settles `killed`. Throws for an unknown
+ * or foreign job.
  * @param id - job to cancel.
- * @param caller - killing agent checked against the owner.
- * @param reason - logged reason forwarded to the producer.
+ * @param caller - killing session checked against the owner.
+ * @param reason - cancellation reason forwarded verbatim to the producer.
  * @returns `requested` for live work, otherwise `already-finished`.
  */
-abstract kill(id: JobId, caller?: Agent, reason?: string): 'requested' | 'already-finished'
+abstract kill(id: JobId, caller?: SessionId, reason?: string): 'requested' | 'already-finished'
 
 /**
  * Wait for settlement or timeout without cancelling the job. Caller abort
  * rejects only while the job is live; after settlement the terminal
- * snapshot wins so a notice suppressed for this waiter is still delivered.
- * Throws for invalid, unknown, or foreign input.
+ * projection wins. Rejects for an invalid timeout or an unknown or foreign
+ * job.
  * @param id - job to wait for.
  * @param timeoutMs - positive finite wait bound in milliseconds.
- * @param caller - waiting agent checked against the owner.
+ * @param caller - waiting session checked against the owner.
  * @param signal - optional cancellation of the wait itself.
- * @returns snapshot at settlement or timeout.
+ * @returns projection at settlement or timeout.
  */
-abstract wait(id: JobId, timeoutMs: number, caller?: Agent, signal?: AbortSignal): Promise<JobSnapshot>
-
-/**
- * Register an effect-scoped completion listener. It receives the settlements
- * of the owners its registering context's scope covers; each listener is
- * contained; returned promises are observed but not awaited. No listener runs
- * after service disposal.
- * @param listener - receives each terminal snapshot and its exact owner.
- * @returns disposer that unregisters the listener.
- */
-abstract onJobDone(listener: JobDoneListener): () => void
-
-/**
-/**
- * Register an effect-scoped observer of visible-set changes. It fires after
- * every commit that changes what {@link list} returns for that owner —
- * registration, every stopping transition (including the one teardown
- * performs before it awaits a slow producer), settlement, owner-disposal
- * removal, and the emptying that service disposal commits — so an observer
- * re-reads rather than accumulating deltas.
- *
- * Delivery is owner-relative on the same terms as {@link onJobDone}: an
- * observer registered from an unscoped context — a host composition's own
- * carrier — sees every owner, while one registered under an agent
- * composition's scope sees exactly the agents composed under it.
- *
- * This is not a superset of {@link onJobDone}: that one delivers the terminal
- * record under first-wins semantics a job controller couples to notice
- * delivery, while this one carries no delivery meaning and marks nothing
- * reported. Listeners are contained and never awaited.
- * @param listener - receives the owner whose visible set changed, or
- *   `undefined` when an unowned job changed and every caller's set did.
- * @returns disposer that unregisters the listener.
- */
-abstract onJobsChanged(listener: JobsChangedListener): () => void
+abstract wait(id: JobId, timeoutMs: number, caller?: SessionId, signal?: AbortSignal): Promise<JobView>
 
 /**
  * Attach an effect-scoped controller that can read and stop jobs. It serves the
@@ -284,7 +461,7 @@ abstract onJobsChanged(listener: JobsChangedListener): () => void
 abstract attachController(name: string): () => void
 ```
 
-Types: [Agent](core.md)
+Types: [SessionId](core.md)
 
 Source: [`packages/jobs/jobs/src/index.ts`](../../packages/jobs/jobs/src/index.ts)
 <!-- END GENERATED cordis-surface -->
diff --git a/docs/subsystems/jobs.zh.md b/docs/subsystems/jobs.zh.md
index 9dc390eb30..3b0db7c654 100644
--- a/docs/subsystems/jobs.zh.md
+++ b/docs/subsystems/jobs.zh.md
@@ -2,7 +2,7 @@
 
 [English](jobs.md) | 中文
 
-长时间运行的生产方、`ctx.jobs` 与任务控制命令共用的类型。[运行时 Agent Note](../../.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.zh.md) 负责设计；本页记录 [`packages/jobs/jobs/src/types.ts`](../../packages/jobs/jobs/src/types.ts) 中的确切字段和变体。
+长时间运行的生产方、`ctx.jobs` 与任务控制命令共用的类型。[seam 收敛 Agent Note](../../.agents/notes/implemented/architecture/2026-09-03-jobs-seam-consolidation.zh.md) 负责当前设计，[运行时 Agent Note](../../.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.zh.md) 记录其起源；本页记录 [`packages/jobs/jobs/src/types.ts`](../../packages/jobs/jobs/src/types.ts) 与客户端安全叶子 [`view.ts`](../../packages/jobs/jobs/src/view.ts) 中的确切字段与变体。
 
 ## ID 与状态
 
@@ -19,45 +19,83 @@ interface JobKindMap {
 }
 ```
 
-`JobStatus` 为 `'running' | 'stopping' | 'completed' | 'killed' | 'failed'`；生产方特有的事实归入 `JobSnapshot.detail`。
+`JobStatus` 为 `'running' | 'stopping' | 'completed' | 'killed' | 'failed'`；生产方特有的事实在运行期间归入 `JobView.progress`，结算后归入 `JobView.detail`。
 
 ## 生产方约定
 
-`JobStart` 声明身份和启动器。运行时会在调用 `run()` 前完成预检，随后提交注册，不再执行可能失败的步骤。生产方拥有执行资源；运行时拥有身份、访问权限和生命周期状态。
+`JobSpec` 声明身份、拥有者会话、可选的拉取式 `output` 源与启动器。运行时会在完成预检后携带该 job 的 `JobHandle` 调用 `run()`，随后提交注册，不再执行可能失败的步骤。生产方拥有执行资源；运行时拥有身份、访问、生命周期状态与输出环。
 
 ```ts type-equiv
 /**
  * Producer declaration passed to {@link JobRegistry.start}. The runtime
  * preflights access and cleanup before invoking {@link run}; the producer owns
- * execution resources while the runtime owns identity and lifecycle state.
+ * execution resources while the runtime owns identity, lifecycle state, and
+ * the output ring.
  */
-interface JobStart {
+interface JobSpec {
   /** Producer kind — also the id prefix (`bash`, `subagent`, …). */
   kind: JobKind
   /** One-line model-facing label (the command; the delegation description). */
   label: string
+  /**
+   * Owning session. Access is fenced by it, and the owner's live Agent must be
+   * the one currently registered under that id: its disposal cancels and
+   * awaits the job. Omitting the owner creates an unowned job, open to any
+   * caller until service disposal.
+   */
+  owner?: SessionId
   /**
    * Optional UTF-8 byte cap for each complete model-facing completion notice or
-   * output read, including controller status metadata.
+   * output read, including controller status metadata. Independent of ring
+   * retention: it bounds the consuming model surface, never observers.
    */
   outputLimitBytes?: number
   /**
-   * Owning live agent. Access is fenced by its session id, and agent disposal
-   * cancels and awaits the job. The instance must be the one currently
-   * registered under its agent id. Omitting the owner creates an unowned job,
-   * open to any caller until service disposal.
+   * Pull sources the registry pumps into the ring at its own cadence.
+   * Producers that narrate their own progress use {@link JobHandle.append}
+   * instead; a job may use both.
    */
-  owner?: Agent
+  output?: readonly JobOutputSource[]
   /**
    * Start the work after preflight and synchronously return its hooks. Called
-   * once; a throw leaves nothing registered, and the producer must clean up any
-   * partially started resources.
+   * once with the job's producer face; a throw leaves nothing registered (the
+   * spent ordinal is skipped), and the producer must clean up any partially
+   * started resources.
+   * @param job - the issued id plus the ring append and progress writers.
    */
-  run(): JobHooks
+  run(job: JobHandle): JobHooks
 }
 ```
 
-`JobHooks.done` 会在生产方释放其资源后 resolve，而不是仅在工作完成时 resolve。可选的 `readOutput` 用来区分会消费输出的流式任务和仅有最终输出的任务。
+```ts type-equiv
+/**
+ * Producer face of one registered job, handed to {@link JobSpec.run} and
+ * valid for the job's whole life. All methods are synchronous. Writes staged
+ * inside the starter call are retained and become visible with the
+ * registration commit; after settlement — the producer's own outcome, a kill,
+ * or a registry-forced teardown end — writes log and drop instead of
+ * throwing, so a producer's trailing flush cannot break its own teardown path.
+ */
+interface JobHandle {
+  /** The registry-issued id (`<kind>-N`). */
+  readonly id: JobId
+  /**
+   * Append one chunk to the output ring. Offsets advance by the chunk's UTF-8
+   * byte length; an empty chunk is dropped without waking observers.
+   * @param text - the chunk text, exactly as produced.
+   * @param options - stream label and gap marker.
+   */
+  append(text: string, options?: JobAppendOptions): void
+  /**
+   * Replace the live progress line (`3/10`, the current phase). Settlement
+   * clears it; the terminal reason travels in {@link JobOutcome.detail}.
+   * @param line - the new progress line.
+   */
+  updateProgress(line: string): void
+}
+```
+
+`JobHooks.done` 会在生产方释放其资源后 resolve，而不是仅在工作完成时 resolve。结果是一个值而非流的 job——subagent 的报告、workflow 渲染出的结果——把它作为 `JobOutcome.result` 返回；模型在结算后的第一次读取携带它一次。
 
 ```ts type-equiv
 /** Hooks through which the runtime controls and observes producer work. */
@@ -74,12 +112,6 @@ interface JobHooks {
    * registry record without claiming that the work stopped.
    */
   done: Promise<JobOutcome>
-  /**
-   * Consume output produced since the previous call. The producer formats
-   * truncation and spill notices. Absence marks a final-output-only job; each
-   * job has one consuming cursor.
-   */
-  readOutput?(): string
 }
 ```
 
@@ -88,73 +120,207 @@ interface JobHooks {
 interface JobOutcome {
   /** How the job ended: finished (`completed`), cancelled (`killed`), or broke (`failed`). */
   status: 'completed' | 'killed' | 'failed'
-  /** Kind-specific detail rendered into status lines ('exit code: 3', 'max-tokens'). */
+  /**
+   * Terminal reason rendered into status lines (`exit code: 3`, `max-tokens`).
+   * When the job settles `killed` after a {@link JobRegistry.kill} with a
+   * reason, the registry appends that reason.
+   */
   detail?: string
-  /** Final output for jobs without `readOutput`; stream jobs leave it unset. */
-  output?: string
+  /**
+   * Return value for jobs whose result is a value rather than a stream (a
+   * workflow's rendered result, a subagent's report). The output ring carries
+   * the stream; this is handed out once by the model's next {@link JobRegistry.read}.
+   */
+  result?: string
+}
+```
+
+拉取源把一个非消耗的偏移读取器——子进程的 `readFrom` 家族——交给注册表。注册表按自己的节奏（`dsh-jobs-local` 的 `pumpPollMs`）泵送每个源，并在结算封环之前再排干一次，因此生产方不需要把任何东西折进 `done`。
+
+```ts type-equiv
+/**
+ * A pull source the registry pumps into the job's output ring — the subprocess
+ * `readFrom` family. The registry owns the cadence and drains every source one
+ * last time before settlement closes the ring, so a producer folds nothing
+ * into its `done`.
+ */
+interface JobOutputSource {
+  /** Stream label attached to every chunk this source yields. */
+  channel?: JobChannel
+  /**
+   * Read everything captured since `fromByte` without consuming it.
+   * @param fromByte - whole-stream offset to resume from (a prior read's `nextOffset`; 0 first).
+   * @returns the delta text, the next offset, the lossy flag, and the spill path the source currently keeps.
+   */
+  read(fromByte: number): JobSourceRead
+}
+```
+
+```ts type-equiv
+/** One incremental read from a {@link JobOutputSource}. */
+interface JobSourceRead {
+  /** Text captured since the requested offset (the whole retained tail when lossy). */
+  text: string
+  /** Whole-stream offset to resume from on the next read. */
+  nextOffset: number
+  /** True when the requested offset slid out of the source's retained window. */
+  lossy: boolean
+  /**
+   * Host path of a file holding the complete stream, when the source
+   * currently keeps an intact one. Reported on every read, so the registry
+   * tracks it as source metadata: a later read without it withdraws the file.
+   */
+  spillPath?: string
+}
+```
+
+## 输出环
+
+每个 job 拥有一个有界的环。拉取源被泵入其中，`JobHandle.append` 的推送整块落地；模型通过注册表保管的游标（`JobRegistry.read`）消耗该环，任意数量的观察者按绝对字节偏移读取它（`JobRegistry.readAt`），二者互不干扰。`JobChannel` 标记 `stdout`、`stderr` 与 `log`；`log` 是只到达观察者、从不进入模型消耗式读取的生产方叙述。结算即封流并把保留量裁剪到结算上限——环没有独立的生命周期。拉取源保留的 spill 文件是 job 元数据（`JobView.output.spillPaths`，每次泵读取都会刷新），不是逐块元数据，所以环淘汰了字节之后、甚至缺口 chunk 本身也被淘汰之后，模型的丢失输出提示仍能点名该文件。浏览器通过 [`dsh-api-job-controller`](../../packages/api/job-controller/README.zh.md) 的 Remote 流 `job.list` 与 `job.follow` 触达名册与环，其帧列于下文的 Cordis API 一节。
+
+```ts type-equiv
+/** One chunk of a job's output ring: absolute offset, text, channel, and loss marker. */
+interface JobChunk {
+  /** Absolute offset of the chunk's first byte; offsets never move once assigned. */
+  readonly at: number
+  /** Chunk text exactly as appended (possibly tail-trimmed by retention). */
+  readonly text: string
+  /** Stream label, when the producer supplied one. */
+  readonly channel?: JobChannel
+  /** Bytes immediately before this chunk were lost, at the producer or to retention. */
+  readonly gapBefore?: true
+}
+```
+
+```ts type-equiv
+/** Result of one non-consuming {@link JobRegistry.readAt}. */
+interface JobOutputRead {
+  /** Retained chunks overlapping `[from, total)`, in offset order. */
+  chunks: readonly JobChunk[]
+  /**
+   * Offset to resume from — the ring's current `total`. Always a chunk
+   * boundary: appends land whole and trimming only advances chunk starts, and
+   * consumers concatenate `chunks` under that assumption, so a provider
+   * serving partial chunks would silently duplicate text.
+   */
+  next: number
+  /** True when `from` fell below the oldest retained byte, so bytes are missing before `chunks`. */
+  lossy: boolean
 }
 ```
 
 ## 消费方视图
 
-快照是每次新建的只读投影。`ownerSession` 携带用于授权的共享 `SessionId`；完成监听器则会另行收到用于生命周期清理的确切拥有者对象。另一个接口已经交付终止状态或承诺交付时，`reported` 会抑制完成通知；排空 owner 或服务的 teardown 取消同样计入。
+`JobView` 是每个读者都消费的唯一投影：模型工具、浏览器名册与观测流。`owner` 携带划定访问边界的会话 id；注册表为生命周期清理解析其背后的活体 `Agent`，从不把该对象交出去。`progress` 是生产方的实时行，结算时清除；`detail` 是终态原因，合并了记录下来的 kill 原因。
 
 ```ts type-equiv
 /**
- * A read-only projection of one job, safe to hand to listeners and tools —
- * a fresh object per call, never live registry state.
+ * Read-only projection of one job — a fresh object per call, never live
+ * registry state. The model tools, the browser roster, and the observation
+ * stream all consume this one shape.
  */
-interface JobSnapshot {
+interface JobView {
   /** The registry-issued id (`<kind>-N`). */
-  id: JobId
-  /** The producer kind the job was registered with. */
-  kind: JobKind
+  readonly id: JobId
+  /**
+   * The producer kind the job was registered with: a Host-registered
+   * `JobKind`, carried as an open string because a browser bundle or a Remote
+   * codec sees only the `JobKindMap` merges its own program compiles.
+   */
+  readonly kind: string
   /** The producer-supplied one-line label. */
-  label: string
-  /** Producer-owned cap for complete model-facing notices and output reads. */
-  outputLimitBytes?: number
-  /**
-   * Owner session id used for authorization and correlation; absent for
-   * unowned jobs. Completion listeners receive the exact {@link Agent}
-   * separately through {@link JobDoneListener}.
-   */
-  ownerSession?: SessionId
+  readonly label: string
+  /** Owning session; absent for an unowned job, which every caller can see. */
+  readonly owner?: SessionId
+  /** Producer-owned cap for complete model-facing notices and reads, in UTF-8 bytes. */
+  readonly outputLimitBytes?: number
   /** Current lifecycle state. */
-  status: JobStatus
-  /** Kind-specific status detail, present once the producer supplied one (usually terminal). */
-  detail?: string
+  readonly status: JobStatus
+  /** The producer's live progress line (`3/10`, the current phase); cleared at settlement. */
+  readonly progress?: string
+  /** Terminal reason (`exit code: 3`); a recorded kill reason is merged in. */
+  readonly detail?: string
   /** Epoch ms when the job was registered. */
-  startedAt: number
-  /** Epoch ms when the job settled; absent while `running`/`stopping`. */
-  finishedAt?: number
+  readonly startedAt: number
+  /** Epoch ms when the job settled; absent while live. */
+  readonly finishedAt?: number
   /**
-   * True when a kill, read, wait, or teardown cancel has reported or committed
-   * to report the terminal state. Completion reporters suppress redundant
-   * notices when set. Teardown claims it because the owner or service being
-   * destroyed leaves no reader: a reporter that opens a turn on notice would
-   * otherwise spend a model request per teardown layer.
+   * The output ring's absolute coordinates and the complete-stream files
+   * behind it. `total` is the offset the next chunk starts at (0 while
+   * nothing was written); `earliest` is the oldest retained byte, greater
+   * than zero exactly when retention dropped the head. `spillPaths` lists the
+   * spill files the job's pull sources currently keep, in source order and
+   * deduplicated, and is absent while no source keeps one: it outlives any
+   * chunk, so a reader below `earliest` can still name where the bytes went.
    */
-  reported: boolean
+  readonly output: { readonly total: number; readonly earliest: number; readonly spillPaths?: readonly string[] }
 }
 ```
 
+`JobRegistry` 的 `list`、`get`、`read`、`readAt`、`kill` 和 `wait` 各自接收调用方的 `SessionId`；省略调用方时仅可访问无主 job，传入会话时还可访问该会话拥有的 job。
+
 ```ts type-equiv
-/** Output and post-read state returned by {@link JobRegistry.read}. */
+/** Output and post-read state returned by the consuming {@link JobRegistry.read}. */
 interface JobRead {
-  /**
-   * Stream kinds: the consuming delta since the previous read. Final-output
-   * kinds: empty while live, the terminal {@link JobOutcome.output} (or
-   * empty) once settled — idempotent, never consumed.
-   */
-  text: string
+  /** Ring chunks appended since the model cursor, in offset order; every channel included. */
+  chunks: readonly JobChunk[]
+  /** True when the cursor fell below the oldest retained byte, so bytes are missing before `chunks`. */
+  lossy: boolean
+  /** The producer's {@link JobOutcome.result}, handed out by the first read after settlement only. */
+  result?: string
   /** The job's state at read time. */
-  snapshot: JobSnapshot
+  job: JobView
 }
 ```
 
+## 事件
+
+注册表通过一条带过滤的流宣布每次提交。生命周期事件携带其所宣布的提交之后的投影；`settled` 标出原因，完成播报方据此跳过 teardown；`output` 只携带 id 与新的 total，观察者从自己的游标读取，注册表从不推送负载。
+
+```ts type-equiv
+/**
+ * One lifecycle or output event. Lifecycle events carry the job's projection
+ * after the commit they announce; `output` carries only the id and the new
+ * total, so an observer schedules a {@link JobRegistry.readAt} from its own
+ * cursor and the registry never pushes payloads.
+ */
+type JobEvent =
+  | {
+    /** Registration commit, progress line change, stopping transition, or removal from the visible set. */
+    readonly type: 'registered' | 'progress' | 'stopping' | 'removed'
+    readonly job: JobView
+  }
+  | {
+    readonly type: 'settled'
+    readonly job: JobView
+    readonly cause: JobSettleCause
+  }
+  | {
+    readonly type: 'output'
+    readonly id: JobId
+    /** Owning session, absent for an unowned job. */
+    readonly owner?: SessionId
+    /** The ring's total after the append (or at settlement, which ends the stream). */
+    readonly total: number
+  }
+```
+
+```ts type-equiv
+/**
+ * Who a subscription hears about. `{ owner }` delivers that session's jobs
+ * plus every unowned job (the set that session can see). `{ owners: 'scope' }`
+ * delivers the owners composed under the subscribing context — one registry
+ * serves every composition in the process, and a mount under one preset must
+ * not hear another preset's agents. `{ owners: 'all' }` delivers everything.
+ */
+type JobEventFilter =
+  | { readonly owner: SessionId }
+  | { readonly owners: 'all' | 'scope' }
+```
+
 ## 服务行为
 
-抽象的 [`JobRegistry`](../../packages/jobs/jobs/src/index.ts) Service Definition 规定原子 `start`、限定调用方作用域的 `get` 和 `list`、`read`、`kill`、有界 `wait`、故障隔离的 `onJobDone` 与 `onJobsChanged` 监听器，以及 `attachController`；[`LocalJobRegistry`](../../packages/jobs/jobs-local/src/index.ts) 是其进程局部 Service Provider。授权会比较拥有者会话；拥有者清理与准入会使用确切的已注册 `Agent` 实例。本地 Service Provider 的 `maxConcurrentJobsPerOwner` 配置必须是正的安全整数，默认值为 `10`；它按确切 owner 统计 `running` 与 `stopping` 记录，所有无 owner 任务共享一个服务级桶，并在生产方终止结算后释放容量。Service Definition 约定见 [`dsh-jobs`](../../packages/jobs/jobs/README.zh.md)，注册表生命周期与准入策略见 [`dsh-jobs-local`](../../packages/jobs/jobs-local/README.zh.md)，面向模型的 Consumer 见 [`dsh-tool-jobs`](../../packages/jobs/tool-jobs/README.zh.md)。
+抽象的 [`JobRegistry`](../../packages/jobs/jobs/src/index.ts) Service Definition 规定了原子化的 `start`、各自接收调用方的 `list`、`get`、消耗式 `read`、非消耗的 `readAt`、`kill` 与有界的 `wait`、带过滤的 `events` 流，以及 `attachController`；[`LocalJobRegistry`](../../packages/jobs/jobs-local/src/index.ts) 是进程本地的 Service Provider。授权比较拥有者会话；拥有者清理与准入使用 job 启动时登记在该拥有者会话下的活体 `Agent`。本地提供方的正安全整数配置 `maxConcurrentJobsPerOwner` 默认为 `10`，按精确拥有者统计 `running` 加 `stopping` 记录，无主任务共享一个桶；生产方的终态结算释放容量；`retainBytes`（默认 262144）与 `settledRetainBytes`（默认 16384）约束每个环的运行期与结算后保留量，`pumpPollMs`（默认 150）是拉取节奏。参见 [`dsh-jobs`](../../packages/jobs/jobs/README.zh.md) 了解 Service Definition 约定，[`dsh-jobs-local`](../../packages/jobs/jobs-local/README.zh.md) 了解注册表生命周期与准入策略，[`dsh-tool-jobs`](../../packages/jobs/tool-jobs/README.zh.md) 了解面向模型的 Consumer。
 
 <!-- BEGIN GENERATED cordis-surface (gen-cordis-catalog.ts) — do not edit between markers -->
 
@@ -164,18 +330,52 @@ interface JobRead {
 
 Generated from source by `scripts/gen-cordis-catalog.ts` (verified fresh by `pnpm run verify-cordis-catalog` in doc-sync; regenerate with `pnpm run gen-cordis-catalog`) — the language sides differ only in locale-specific paired document paths. Signature blocks use a `ts cordis-catalog` fence and keep the original source JSDoc; dispatch modes are defined in the [primer](../cordis-primer.zh.md#dispatch-modes), and the framework-inherited `ctx` API lives in [cordis-api/inherited.md](../cordis-api/inherited.md).
 
+<a id="ctxjobcontroller--jobcontroller"></a>
+
+### `ctx.jobController` — `JobController`
+
+Host service backing the generated `ctx.remote.job` namespace.
+
+```ts cordis-catalog
+/**
+ * Stream the jobs one session can see — its own plus every unowned job —
+ * as whole-set frames: one on open, then one after each coalesced burst of
+ * lifecycle commits. The stream has no natural end; the carrier closes it.
+ * @param request - the session whose visible set to mirror.
+ * @param signal - cancellation owned by the Remote stream carrier.
+ * @returns the roster frames.
+ */
+@Remote({ mode: 'stream' }) list(request: JobListRequest, signal: AbortSignal): AsyncIterable<JobListFrame>
+
+/**
+ * Stream one job's retained output from an absolute byte offset, then its
+ * terminal projection once settled and drained. Non-consuming: the
+ * model-facing cursor and notice state never observe these reads. The
+ * request's session is the fenced read's caller; the registry rejects a
+ * job the session cannot see and an unknown job.
+ * @param request - target job, owning session, and optional resume offset.
+ * @param signal - cancellation owned by the Remote stream carrier.
+ * @returns anchor, coalesced output frames, and the terminal status.
+ */
+@Remote({ mode: 'stream' }) follow(request: JobFollowRequest, signal: AbortSignal): AsyncIterable<JobFollowFrame>
+```
+
+Source: [`packages/api/job-controller/src/index.ts`](../../packages/api/job-controller/src/index.ts)
+
 <a id="ctxjobs--jobregistry-abstract-seam"></a>
 
 ### `ctx.jobs` — `JobRegistry` (abstract seam)
 
-Abstract background job registry. Subclass, implement the abstract methods, and load the subclass as a plugin — it registers as `ctx.jobs` (one implementation per context; loading a second throws, which is cordis' standard duplicate-service behavior).
+Abstract background job registry. Subclass, implement the abstract members, and load the subclass as a plugin — it registers as `ctx.jobs` (one implementation per context; loading a second throws, which is cordis' standard duplicate-service behavior).
 
 Implementations must honor these semantics:
 
-- Registrations outlive producer and controller fibers. Owner and service disposal cancel live work and await compliant producers; a throwing teardown cancel force-fails only the record. Teardown cancellation also marks the record reported, because a record its owner is being destroyed for has no reader left.
+- Registrations outlive producer and controller fibers. Owner and service disposal cancel live work and await compliant producers; a throwing teardown cancel force-fails only the record. Such settlements announce `cause: 'teardown'`, because a job whose owner is being destroyed has no reader left.
 - Owned-job access is fenced by the owner's session id. Ids are predictable, so authorization — not secrecy — is the boundary.
-- Settlement is first-wins: one terminal record, released waiters, and one round of contained listener notification, even against a late producer outcome. Completion is announced last, after the record is committed and every other observer of the settlement has seen it, because a reporter may open a model turn synchronously.
-- start refuses work while no attached job controller serves the spec's owner, so a producer cannot start work that owner cannot collect or stop. One registry serves every composition in the process, so this question — and completion-listener delivery — is owner-relative rather than process-wide: registrations made from an unscoped context serve every owner, and registrations made under an agent composition's scope serve exactly the agents composed under it.
+- Settlement is first-wins: one terminal record, released waiters, then one round of contained event delivery, even against a late producer outcome. The `settled` event follows every released waiter, so a consumer that claims a settlement while waiting always claims before the event.
+- start refuses work while no attached job controller serves the spec's owner, so a producer cannot start work that owner cannot collect or stop. One registry serves every composition in the process, so this question — and event delivery under `{ owners: 'scope' }` — is owner-relative rather than process-wide: registrations made from an unscoped context serve every owner, and registrations made under an agent composition's scope serve exactly the agents composed under it.
+- Every job owns one output ring. Pull sources named by the spec are pumped by the registry and drained once more before settlement; pushed appends land whole. The model's consuming cursor and observers' absolute offsets read the same bytes and never disturb each other.
+- Ring retention is bounded. Appends past the live cap drop the oldest retained bytes; a reader below the retained window gets a lossy read, never an error. Settlement trims retention to the settled cap and ends the stream; the ring has no separate lifecycle.
 
 ```ts cordis-catalog
 /**
@@ -183,96 +383,73 @@ Implementations must honor these semantics:
  * admission before starting and atomically registering work. Any preflight
  * rejection leaves no job id or execution resource. A throwing starter
  * leaves nothing registered; after it returns, registration cannot fail.
- * Settlement records the outcome, notifies listeners, and releases waiters.
- * @param spec - job identity, owner, and synchronous starter.
+ * @param spec - job identity, owner, output sources, and synchronous starter.
  * @returns the registry-issued `<kind>-N` id.
  */
-abstract start(spec: JobStart): JobId
+abstract start(spec: JobSpec): JobId
 
 /**
- * List caller-owned and unowned jobs in registration order without exposing
- * another session's labels.
- * @param caller - reading agent; a non-agent caller sees only unowned jobs.
- * @returns fresh snapshots.
+ * List caller-owned and unowned jobs in registration order.
+ * @param caller - reading session; omission sees only unowned jobs.
+ * @returns fresh projections.
  */
-abstract list(caller?: Agent): JobSnapshot[]
+abstract list(caller?: SessionId): JobView[]
 
 /**
- * Return a non-consuming snapshot without changing its read cursor or notice
- * state. Throws for an unknown or foreign job.
- * @param id - job to look up.
- * @param caller - reading agent checked against the owner.
- * @returns a fresh snapshot.
- */
-abstract get(id: JobId, caller?: Agent): JobSnapshot
-
-/**
- * Read the next stream delta, or the idempotent final output after settlement.
- * A terminal read marks the job reported. Throws for an unknown or foreign
- * job.
- * @param id - job to read.
- * @param caller - reading agent checked against the owner.
- * @returns output text and the post-read snapshot.
- */
-abstract read(id: JobId, caller?: Agent): JobRead
-
-/**
- * Request cancellation, then mark the job stopping and reported. A producer
- * throw propagates without changing job state. Throws for an unknown or
+ * Project one job without changing its cursor. Throws for an unknown or
  * foreign job.
+ * @param id - job to look up.
+ * @param caller - reading session checked against the owner.
+ * @returns a fresh projection.
+ */
+abstract get(id: JobId, caller?: SessionId): JobView
+
+/**
+ * Consume the ring from the model cursor and advance it to the current
+ * total. After settlement the first read also carries the producer's
+ * result. Throws for an unknown or foreign job.
+ * @param id - job to read.
+ * @param caller - reading session checked against the owner.
+ * @returns the chunks since the cursor, the lossy flag, the result once, and the post-read projection.
+ */
+abstract read(id: JobId, caller?: SessionId): JobRead
+
+/**
+ * Read retained ring output without moving the model cursor. Resume with
+ * a previous read's `next`; an offset inside a retained chunk returns the
+ * whole chunk (its `at` may precede `from`). Throws for a negative or
+ * non-integer offset, or an unknown or foreign job.
+ * @param id - job to read.
+ * @param from - absolute byte offset to read from (0 for the retained head).
+ * @param caller - reading session checked against the owner.
+ * @returns retained chunks overlapping `[from, total)`, the resume offset, and the lossy flag.
+ */
+abstract readAt(id: JobId, from: number, caller?: SessionId): JobOutputRead
+
+/**
+ * Request cancellation, then mark the job stopping. A producer throw
+ * propagates without changing job state. A supplied reason is merged into
+ * terminal `detail` when the job settles `killed`. Throws for an unknown
+ * or foreign job.
  * @param id - job to cancel.
- * @param caller - killing agent checked against the owner.
- * @param reason - logged reason forwarded to the producer.
+ * @param caller - killing session checked against the owner.
+ * @param reason - cancellation reason forwarded verbatim to the producer.
  * @returns `requested` for live work, otherwise `already-finished`.
  */
-abstract kill(id: JobId, caller?: Agent, reason?: string): 'requested' | 'already-finished'
+abstract kill(id: JobId, caller?: SessionId, reason?: string): 'requested' | 'already-finished'
 
 /**
  * Wait for settlement or timeout without cancelling the job. Caller abort
  * rejects only while the job is live; after settlement the terminal
- * snapshot wins so a notice suppressed for this waiter is still delivered.
- * Throws for invalid, unknown, or foreign input.
+ * projection wins. Rejects for an invalid timeout or an unknown or foreign
+ * job.
  * @param id - job to wait for.
  * @param timeoutMs - positive finite wait bound in milliseconds.
- * @param caller - waiting agent checked against the owner.
+ * @param caller - waiting session checked against the owner.
  * @param signal - optional cancellation of the wait itself.
- * @returns snapshot at settlement or timeout.
+ * @returns projection at settlement or timeout.
  */
-abstract wait(id: JobId, timeoutMs: number, caller?: Agent, signal?: AbortSignal): Promise<JobSnapshot>
-
-/**
- * Register an effect-scoped completion listener. It receives the settlements
- * of the owners its registering context's scope covers; each listener is
- * contained; returned promises are observed but not awaited. No listener runs
- * after service disposal.
- * @param listener - receives each terminal snapshot and its exact owner.
- * @returns disposer that unregisters the listener.
- */
-abstract onJobDone(listener: JobDoneListener): () => void
-
-/**
-/**
- * Register an effect-scoped observer of visible-set changes. It fires after
- * every commit that changes what {@link list} returns for that owner —
- * registration, every stopping transition (including the one teardown
- * performs before it awaits a slow producer), settlement, owner-disposal
- * removal, and the emptying that service disposal commits — so an observer
- * re-reads rather than accumulating deltas.
- *
- * Delivery is owner-relative on the same terms as {@link onJobDone}: an
- * observer registered from an unscoped context — a host composition's own
- * carrier — sees every owner, while one registered under an agent
- * composition's scope sees exactly the agents composed under it.
- *
- * This is not a superset of {@link onJobDone}: that one delivers the terminal
- * record under first-wins semantics a job controller couples to notice
- * delivery, while this one carries no delivery meaning and marks nothing
- * reported. Listeners are contained and never awaited.
- * @param listener - receives the owner whose visible set changed, or
- *   `undefined` when an unowned job changed and every caller's set did.
- * @returns disposer that unregisters the listener.
- */
-abstract onJobsChanged(listener: JobsChangedListener): () => void
+abstract wait(id: JobId, timeoutMs: number, caller?: SessionId, signal?: AbortSignal): Promise<JobView>
 
 /**
  * Attach an effect-scoped controller that can read and stop jobs. It serves the
@@ -284,7 +461,7 @@ abstract onJobsChanged(listener: JobsChangedListener): () => void
 abstract attachController(name: string): () => void
 ```
 
-Types: [Agent](core.zh.md)
+Types: [SessionId](core.zh.md)
 
 Source: [`packages/jobs/jobs/src/index.ts`](../../packages/jobs/jobs/src/index.ts)
 <!-- END GENERATED cordis-surface -->
diff --git a/docs/subsystems/session.i18n.yaml b/docs/subsystems/session.i18n.yaml
index 83eecfd1c7..878b270089 100644
--- a/docs/subsystems/session.i18n.yaml
+++ b/docs/subsystems/session.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/subsystems/session.md
-session.md: 62f7785d4d1db9c30706a8b967e6f4073b810149
-session.zh.md: 7cd3c38162df209d245d3f1085ab1edce002531a
+session.md: be48d4833bacbac31f3765e0b4d9cdcf6da9f4d7
+session.zh.md: 093fc6d570e93dc5be42d8779fc4d5965085b7e0
diff --git a/docs/subsystems/session.md b/docs/subsystems/session.md
index 62f7785d4d..be48d4833b 100644
--- a/docs/subsystems/session.md
+++ b/docs/subsystems/session.md
@@ -758,6 +758,8 @@ The backends that consume this contract are on [persistence.md](persistence.md).
 
 `SessionOpenWorkspacePathRequest` carries an absolute or workspace-resolved `path`; optional `action: "reveal"` selects file-manager navigation instead of default-application opening. `SessionOpenWorkspacePathValue` confirms that the Host accepted the native handoff. A Session-aware Client resolves relative paths against its current Session cwd when known; the controller hands the path to the opener unchanged and reports invalid requests, cancellation, and opener failures through the Session Remote error vocabulary.
 
+The optional `application` selects a registered file handler without changing the system default; `workspacePathApplications({ path })` returns current handlers, names, icons, and default selection after Host path verification.
+
 <!-- BEGIN GENERATED cordis-surface (gen-cordis-catalog.ts) — do not edit between markers -->
 
 <a id="cordis-surface"></a>
@@ -845,6 +847,15 @@ workspaceDesktop(): { name: string; available: boolean; fileManager: 'finder' |
  */
 @Remote('openWorkspacePath') async openWorkspacePath( request: SessionOpenWorkspacePathRequest, signal: AbortSignal, ): Promise<SessionOpenWorkspacePathValue>
 
+/**
+ * Query current file handlers on the serving desktop without activating an Agent.
+ * @param request - file path in Host filesystem syntax.
+ * @param signal - caller lifetime, propagated to filesystem and desktop queries.
+ * @returns OS application names, icons, and default selection; empty when desktop opening is unavailable.
+ * @throws RemoteError when the path is invalid, the query is cancelled, or native discovery fails.
+ */
+@Remote('workspacePathApplications') async workspacePathApplications( request: { readonly path: string }, signal: AbortSignal, ): Promise<readonly SessionWorkspacePathApplication[]>
+
 /**
  * Rename one Session after explicitly resuming it.
  * @param request - Session identity and proposed title.
diff --git a/docs/subsystems/session.zh.md b/docs/subsystems/session.zh.md
index 7cd3c38162..093fc6d570 100644
--- a/docs/subsystems/session.zh.md
+++ b/docs/subsystems/session.zh.md
@@ -762,6 +762,8 @@ interface TurnEndReasonMap {
 
 `SessionOpenWorkspacePathRequest` 携带绝对路径或已按 workspace 解析的 `path`。`SessionOpenWorkspacePathValue` 确认 Host 已接受原生交接。Session-aware Client 会在已知当前 Session cwd 时据此解析相对路径；controller 将路径原样交给打开器，并通过 Session Remote 错误词汇表报告无效请求、取消与打开器失败。 可选的 `action: "reveal"` 选择文件管理器导航；省略时使用默认应用打开。
 
+可选的 `application` 指定文件关联应用，不修改系统默认值；`workspacePathApplications({ path })` 在校验 Host 路径后返回当前关联应用、名称、图标和默认项。
+
 <!-- BEGIN GENERATED cordis-surface (gen-cordis-catalog.ts) — do not edit between markers -->
 
 <a id="cordis-surface"></a>
@@ -849,6 +851,15 @@ workspaceDesktop(): { name: string; available: boolean; fileManager: 'finder' |
  */
 @Remote('openWorkspacePath') async openWorkspacePath( request: SessionOpenWorkspacePathRequest, signal: AbortSignal, ): Promise<SessionOpenWorkspacePathValue>
 
+/**
+ * Query current file handlers on the serving desktop without activating an Agent.
+ * @param request - file path in Host filesystem syntax.
+ * @param signal - caller lifetime, propagated to filesystem and desktop queries.
+ * @returns OS application names, icons, and default selection; empty when desktop opening is unavailable.
+ * @throws RemoteError when the path is invalid, the query is cancelled, or native discovery fails.
+ */
+@Remote('workspacePathApplications') async workspacePathApplications( request: { readonly path: string }, signal: AbortSignal, ): Promise<readonly SessionWorkspacePathApplication[]>
+
 /**
  * Rename one Session after explicitly resuming it.
  * @param request - Session identity and proposed title.
diff --git a/docs/subsystems/shell.i18n.yaml b/docs/subsystems/shell.i18n.yaml
index be9a099f49..9c6c29422c 100644
--- a/docs/subsystems/shell.i18n.yaml
+++ b/docs/subsystems/shell.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/subsystems/shell.md
-shell.md: de04083093a1e53aedd310f388f778638d858ce7
-shell.zh.md: d68b1b2cfba3214a23e9120f19fc9a029a181a18
+shell.md: 734b9e7c72948be23d2c6a2c82c6af27c1e2812b
+shell.zh.md: bfe455c2e5f680f743188e8accb70008a95ab8f9
diff --git a/docs/subsystems/shell.md b/docs/subsystems/shell.md
index de04083093..734b9e7c72 100644
--- a/docs/subsystems/shell.md
+++ b/docs/subsystems/shell.md
@@ -195,6 +195,13 @@ interface ShellProcess {
    * full-stream spill files when available.
    */
   readOutput(): ShellProcessRead
+  /**
+   * Non-consuming offset readers over the same captured streams the consuming
+   * {@link readOutput} cursor drains, including the provider-failure note a
+   * rejected spawn leaves on stderr. Independent observers read here at their
+   * own offsets without stealing bytes from `readOutput`.
+   */
+  observed: ShellObservedStreams
   /**
    * Terminate the provider-managed range. Returns false when it had already finished
    * (no-op); idempotent.
diff --git a/docs/subsystems/shell.zh.md b/docs/subsystems/shell.zh.md
index d68b1b2cfb..bfe455c2e5 100644
--- a/docs/subsystems/shell.zh.md
+++ b/docs/subsystems/shell.zh.md
@@ -195,6 +195,13 @@ interface ShellProcess {
    * full-stream spill files when available.
    */
   readOutput(): ShellProcessRead
+  /**
+   * Non-consuming offset readers over the same captured streams the consuming
+   * {@link readOutput} cursor drains, including the provider-failure note a
+   * rejected spawn leaves on stderr. Independent observers read here at their
+   * own offsets without stealing bytes from `readOutput`.
+   */
+  observed: ShellObservedStreams
   /**
    * Terminate the provider-managed range. Returns false when it had already finished
    * (no-op); idempotent.
diff --git a/docs/subsystems/sidebar-right.i18n.yaml b/docs/subsystems/sidebar-right.i18n.yaml
index 30b50d6a0a..091c70c940 100644
--- a/docs/subsystems/sidebar-right.i18n.yaml
+++ b/docs/subsystems/sidebar-right.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/subsystems/sidebar-right.md
-sidebar-right.md: 27e5219aec8997cf0d168ac9ea2665baaf943906
-sidebar-right.zh.md: 63f2c1081009778e191789038ffd1923312fc55b
+sidebar-right.md: e3a4ffcf4e4b17975c10c0358f6f53dc5eea6ec2
+sidebar-right.zh.md: a588dc99b92314c54ea1309e4a44d305e23b970f
diff --git a/docs/subsystems/sidebar-right.md b/docs/subsystems/sidebar-right.md
index 27e5219aec..e3a4ffcf4e 100644
--- a/docs/subsystems/sidebar-right.md
+++ b/docs/subsystems/sidebar-right.md
@@ -8,7 +8,7 @@ This page is the reference for the subsystem's contracts: addresses, tab-type re
 
 ## Position and ownership
 
-One docking surface exists per Session, held in a session-scoped slot store and drawn by `rightbar.session`. The root-scoped `rightbar` controller mounts that seat only while Conversation is selected; a reload returns every session to the collapsed default, and switching sessions keeps each surface where it was ([state](../../packages/client/ui-sidebar-right/README.md#state)). The surface's every change is one recorded history entry computed by the kit's pure planners; a docked pane never stays empty, and an empty root pane receives the default page selected from registered guide entries.
+One docking surface exists per Session, held in a session-scoped slot store and drawn by `rightbar.session`. The root-scoped `rightbar` controller retains separate seats for the selected Session and background Sessions with initialized `keepMounted` bodies; only the foreground Conversation is visible. Reload restores saved layouts ([state](../../packages/client/ui-sidebar-right/README.md#state)). The surface's every change is one recorded history entry computed by the kit's pure planners; a docked pane never stays empty, and an empty root pane receives the default page selected from registered guide entries.
 
 A tab type is two registrations that share the definition's `id`: a static definition in `ctx.sidebarRightTabs` saying which addresses its `kind` opens, and a keyed slot registration supplying its body. The framework injects `useTabInfo()` for live Sidebar, pane and tab information; each type keeps its own state in its slot store. Packages import each other's declarations only as types.
 
@@ -43,6 +43,7 @@ Tab identity is the pair `(kind, address)`: the registry's claim uses the addres
 | `priority` | One of three literal bands: `extension` (the default and the highest: a type from outside the product outranks every shipped viewer), `builtin` (types shipped with the product), `fallback` (plain-content viewers anything more specific should beat). |
 | `canOpen(address)` | Optional synchronous veto of a glob match; it runs on every routing decision. |
 | `title(address)` | The chip's text, captured into the layout record when the tab opens and never rewritten. |
+| `keepMounted` | Optional lazy retention of visited bodies across hiding, Session switches and docking; the owning View holds the Session reference. |
 | `guide` | Optional entry boxes for the guide page: `{ order, title(), description?(), icon? }`. Picking a box opens the contributing type as a page; omit to stay off the page. |
 
 Routing is a ranked claim. `candidates(address)` ranks the types whose patterns match and whose `canOpen` does not veto: by band, then by the length of the longest matched pattern, then by registration order. `claim(address, kind?)` picks the first candidate, or the named `kind` outright — its globs are skipped, its `canOpen` still applies — and returns `{ kind, contentId: address, title }`. An address no type claims throws: it is a wiring mistake, not a user error.
@@ -101,7 +102,7 @@ The Sidebar declares four extension slots; its document tab declares the additio
 | `sidebar.right.tab.menu.item` | list, Session scope | Content-level actions appended after the kit's own layout actions. An item that acts must call the owner's `dismiss()`. |
 | `sidebar.right.tab.document` | keyed by the document implementation's `id`, Session scope | The selected file renderer inside the document tab; the parent owns shared loading and toolbar controls. |
 
-A body, title and guide replacement receive the framework-injected `useTabInfo()`. It returns `{ sidebar, panel, tab }`: `sidebar` holds `expanded` and `fullscreen`, `panel.id` names the containing pane, and `tab` contains its record fields plus `visible`, `navigation`, `signal`, and `actions`. Docked bodies are visible only while expanded and active; docked titles need only expansion; floats stay visible. `signal` aborts when the record disappears or the plugin unloads, not on hiding or Session switching. `tab.actions` provides `openResource`, `openTab`, and `close`, bound to the tab's own Session. Open placement defaults to its current pane; `revealIfOpened` defaults to `true`, and `replaceTab: true` replaces this record in the same history entry. Menu entries retain plain `tab` and `dismiss` owner parameters.
+A body, title and guide replacement receive the framework-injected `useTabInfo()`. It returns `{ sidebar, panel, tab }`: `sidebar` holds `expanded` and `fullscreen`, `panel.id` names the containing pane, and `tab` contains its record fields plus `visible`, `navigation`, `signal`, and `actions`. All tabs require a foreground Session. Docked bodies also require expansion and selection; docked titles require expansion; foreground floats survive collapse. `signal` aborts when the record disappears or the plugin unloads, not on hiding or Session switching. `tab.actions` provides `openResource`, `openTab`, and `close`, bound to the tab's own Session. Open placement defaults to its current pane; `revealIfOpened` defaults to `true`, and `replaceTab: true` replaces this record in the same history entry. Menu entries retain plain `tab` and `dismiss` owner parameters.
 
 `navigation.revision` increments on every navigation to the tab whether or not `params` changed, so a body can act on "navigated again" alone; it is `1` for a tab opened by address and `0` for a record nobody opened by address — a seeded guide, or a tab restored by undo. The Tab domain holds one occurrence per open record: a record that appears is pinned in the resource model, so switching tabs unmounts a body without dropping its content; a record that vanishes is aborted and dropped; a record restored by undo is a new occurrence ([Tab domain](../../packages/client/ui-sidebar-right/README.md#the-tab-domain)).
 
diff --git a/docs/subsystems/sidebar-right.zh.md b/docs/subsystems/sidebar-right.zh.md
index 63f2c10810..a588dc99b9 100644
--- a/docs/subsystems/sidebar-right.zh.md
+++ b/docs/subsystems/sidebar-right.zh.md
@@ -8,7 +8,7 @@
 
 ## 定位与归属
 
-每个会话恰有一个停靠面，保存在会话作用域的 slot store 里、由 `rightbar.session` 绘制。root 作用域的 `rightbar` 控制器仅在选中 Conversation 时挂载该席位；刷新页面后每个会话回到折叠的默认态，切换会话时各自的面保持原状（[状态](../../packages/client/ui-sidebar-right/README.zh.md#state)）。面的每一次变化都是 kit 纯规划器算出的一条历史记录；停靠的 pane 从不空着，根 pane 为空时会加入根据已注册引导入口选出的默认页。
+每个会话恰有一个停靠面，保存在会话作用域的 slot store 里、由 `rightbar.session` 绘制。root 作用域的 `rightbar` 控制器为选中 Session 和拥有已初始化 `keepMounted` 正文的后台 Session 保留独立席位；只有前台 Conversation 可见。刷新会恢复已保存的布局（[状态](../../packages/client/ui-sidebar-right/README.zh.md#state)）。面的每一次变化都是 kit 纯规划器算出的一条历史记录；停靠的 pane 从不空着，根 pane 为空时会加入根据已注册引导入口选出的默认页。
 
 一个 tab 类型是共用定义 `id` 的两次注册：在 `ctx.sidebarRightTabs` 里的静态定义说明其 `kind` 打开哪些地址，一次 keyed slot 注册提供它的正文。框架注入 `useTabInfo()` 以读取 Sidebar、窗格和标签的实时信息；各类型把自身状态放在 slot store 里。各包之间只以类型形式引用彼此的声明。
 
@@ -43,6 +43,7 @@ tab 身份是 `(kind, address)` 二元组：注册表的认领把地址原文用
 | `priority` | 三档字面量之一：`extension`（缺省且最高：产品之外的类型压过所有内置查看器）、`builtin`（随产品发布的类型）、`fallback`（任何更具体的类型都应压过的纯内容查看器）。 |
 | `canOpen(address)` | 可选的同步否决，对 glob 命中生效；每次路由决策都会调用。 |
 | `title(address)` | chip 文本，在 tab 打开时捕获进布局记录，之后不再改写。 |
+| `keepMounted` | 可选的懒保活：已访问正文跨隐藏、Session 切换与停靠切换保留，由所属 View 持有 Session reference。 |
 | `guide` | 可选的引导页入口框：`{ order, title(), description?(), icon? }`。点一框即把贡献它的类型作为页面打开；省略即不上引导页。 |
 
 路由是一次排序认领。`candidates(address)` 对模式命中且未被 `canOpen` 否决的类型排序：先按档，再按最长命中模式的长度，最后按注册顺序。`claim(address, kind?)` 取第一个候选，或直接用点名的 `kind`——跳过它的 glob，但 `canOpen` 仍生效——返回 `{ kind, contentId: address, title }`。没有任何类型认领的地址会抛错：这是接线错误，不是用户错误。
@@ -101,7 +102,7 @@ Sidebar 声明四个扩展 slot；其文档 tab 另行声明下表中的 keyed 
 | `sidebar.right.tab.menu.item` | list，会话作用域 | 追加在 kit 自身布局动作之后的内容级动作。执行了动作的条目必须调用 owner 的 `dismiss()`。 |
 | `sidebar.right.tab.document` | 按文档实现的 `id` keyed，会话作用域 | 文档 tab 内选中的文件渲染器；父组件拥有共享加载与工具栏控件。 |
 
-正文、标题与引导页替换项接收框架注入的 `useTabInfo()`。它返回 `{ sidebar, panel, tab }`：`sidebar` 包含 `expanded` 与 `fullscreen`，`panel.id` 标识所属窗格，`tab` 包含记录字段以及 `visible`、`navigation`、`signal` 和 `actions`。停靠正文仅在展开且活跃时可见；停靠标题只要求展开；浮窗保持可见。`signal` 在记录消失或插件卸载时中止，不因隐藏或切换 Session 而中止。`tab.actions` 提供绑定到标签所属 Session 的 `openResource`、`openTab` 与 `close`。打开位置缺省为当前所属窗格；`revealIfOpened` 缺省为 `true`，`replaceTab: true` 在同一历史项中替换本记录。菜单项保留普通的 `tab` 与 `dismiss` owner 参数。
+正文、标题与引导页替换项接收框架注入的 `useTabInfo()`。它返回 `{ sidebar, panel, tab }`：`sidebar` 包含 `expanded` 与 `fullscreen`，`panel.id` 标识所属窗格，`tab` 包含记录字段以及 `visible`、`navigation`、`signal` 和 `actions`。所有 tab 都要求 Session 位于前台。停靠正文还要求展开且选中；停靠标题要求展开；前台浮窗不随整栏收起。`signal` 在记录消失或插件卸载时中止，不因隐藏或切换 Session 而中止。`tab.actions` 提供绑定到标签所属 Session 的 `openResource`、`openTab` 与 `close`。打开位置缺省为当前所属窗格；`revealIfOpened` 缺省为 `true`，`replaceTab: true` 在同一历史项中替换本记录。菜单项保留普通的 `tab` 与 `dismiss` owner 参数。
 
 `navigation.revision` 在每次导航到该 tab 时递增，`params` 不变也递增，正文可仅凭「又被导航了」行动；按地址打开的 tab 为 `1`，没有人按地址打开的记录——种入的引导、撤销恢复的 tab——为 `0`。Tab 域为每条打开的记录保有一个 occurrence：记录出现即在资源模型里钉住，因此切换 tab 卸载正文也不丢内容；记录消失即中止并丢弃；撤销恢复的记录是新的 occurrence（[Tab 域](../../packages/client/ui-sidebar-right/README.zh.md#the-tab-domain)）。
 
diff --git a/docs/subsystems/slots.i18n.yaml b/docs/subsystems/slots.i18n.yaml
index 50d7a12706..152904f4d3 100644
--- a/docs/subsystems/slots.i18n.yaml
+++ b/docs/subsystems/slots.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/subsystems/slots.md
-slots.md: 1e820fd880163d565a72733372fa4f2cc70a62b5
-slots.zh.md: c5bec8e752b9d9e1922f608449ca3249d0477062
+slots.md: 3a2eb7d0ff7297f6c80fa083134144cbb7a6864e
+slots.zh.md: 16a529aa46837af0aaa675271e765bd88f29e623
diff --git a/docs/subsystems/slots.md b/docs/subsystems/slots.md
index 1e820fd880..3a2eb7d0ff 100644
--- a/docs/subsystems/slots.md
+++ b/docs/subsystems/slots.md
@@ -6,6 +6,8 @@ Slots are the Web Client's typed React composition system. [`dsh-client-ui-slots
 
 This page documents slot ownership, component inputs, extension APIs, and the shipped hierarchy. The surrounding boot, Remote, Client model, and Conversation paths are in [Web Client architecture](web-client.md).
 
+`plugins.bundle.config` supplies bundle detail configuration, keyed by npm package name. `plugins.bundle.activation` renders optional guidance after user-requested enablement, with owner callbacks to dismiss or open that bundle’s details. `conversation.input.activity` supplies one action between the model selector and Send, with toolbar expansion released on unmount.
+
 ## Declaration and lifecycle
 
 `SlotMap` is the compile-time registry. A package declaration-merges the key, cardinality, scope, owner props, keyed props, and optional slot-level inject face. The runtime declaration is the matching `children` entry on the component that owns the render location.
diff --git a/docs/subsystems/slots.zh.md b/docs/subsystems/slots.zh.md
index c5bec8e752..16a529aa46 100644
--- a/docs/subsystems/slots.zh.md
+++ b/docs/subsystems/slots.zh.md
@@ -6,6 +6,8 @@ Slots 是 Web Client 的类型化 React 组合系统。[`dsh-client-ui-slots`](.
 
 本文记录 slot 的所有权、组件输入、扩展 API 与当前层级。外围的启动、Remote、Client model 与 Conversation 数据通路见 [Web Client 架构](web-client.zh.md)。
 
+`plugins.bundle.config` 以 npm 包名为 key，提供 Bundle 详情配置。`plugins.bundle.activation` 在用户显式启用后渲染可选引导，由拥有者提供关闭引导和打开该 Bundle 详情的回调。`conversation.input.activity` 提供模型选择器与发送按钮之间的单个活动控件，可展开工具栏并在卸载时释放展开状态。
+
 ## 声明与生命周期
 
 `SlotMap` 是编译期注册表。包通过声明合并写入 key、cardinality（基数）、scope、owner props、keyed props 与可选的 slot 级 inject face。运行时声明则是拥有该渲染位置的组件在 `children` 中给出的对应条目。
diff --git a/docs/subsystems/web-client.i18n.yaml b/docs/subsystems/web-client.i18n.yaml
index 0dfc4fa69c..0f1163393e 100644
--- a/docs/subsystems/web-client.i18n.yaml
+++ b/docs/subsystems/web-client.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/subsystems/web-client.md
-web-client.md: 6bcf9bf84ed0b049b801c38d2426074d784e8de6
-web-client.zh.md: 9c697964a0f92bc646f5ca305fc3372bebcdc902
+web-client.md: c43b7553d1a223b82fec73c7431e4655cf1cbee1
+web-client.zh.md: d98febb7494a2b2fe082f8544850dbf67ee75794
diff --git a/docs/subsystems/web-client.md b/docs/subsystems/web-client.md
index 6bcf9bf84e..c43b7553d1 100644
--- a/docs/subsystems/web-client.md
+++ b/docs/subsystems/web-client.md
@@ -40,10 +40,10 @@ Each API controller package owns a paired Host and Client face. The Host side ow
 [`api/session-controller`](../../packages/api/session-controller/README.md) exposes Host commands for list, search, creation, prompt, queue, cancellation, pagination, and follow/control streams. Its Client side is organized as `ClientSessions → SessionManager → Session`:
 
 - `ClientSessions` provides `ctx.sessions`, owns references, source counts, Session scopes, and stable `SessionBinding` objects, and projects catalog state without selecting a global current Session.
-- `SessionManager` owns the list baseline, live list/control updates, lazy Session instances, queues, projection stores, subagent catalogs, and conflict ordering between pulls and later updates.
+- `SessionManager` owns the list baseline, live list/control updates, lazy Session instances, projection stores, subagent catalogs, and conflict ordering between pulls and later updates.
 - Each `Session` owns one contiguous logical-event window represented by `SessionEventLikeEntry` values, paging, follow, prompt/control state, and the observable snapshot consumed by adapters.
 
-The durable event path opens `follow()`, whose first frame contains the current header, tail page, cursor, and complete projection baseline. History records have an explicit `event` or `chunks` discriminator and an aligned inner `event`; the journal validates each inclusive logical sequence range before the Client retains the records as `SessionEventLikeEntry` values without per-record conversion. Each physical generation atomically replaces the retained window from that snapshot; standard live events then append by sequence. `page()` is reserved for older history and gap repair. The transient control stream starts every generation with a complete baseline and then applies queue, job, and projection updates.
+The durable event path opens `follow()`, whose first frame contains the current header, tail page, cursor, and complete projection baseline. History records have an explicit `event` or `chunks` discriminator and an aligned inner `event`; the journal validates each inclusive logical sequence range before the Client retains the records as `SessionEventLikeEntry` values without per-record conversion. Each physical generation atomically replaces the retained window from that snapshot; standard live events then append by sequence. `page()` is reserved for older history and gap repair. The transient control stream starts every generation with a complete baseline and then applies projection updates.
 
 ### Workspaces
 
@@ -66,7 +66,8 @@ Web and desktop share the [developer-tool preference](../../packages/client/ui-s
 | Path | Sequence |
 |---|---|
 | durable Session display | Host Session log → packed Remote `follow`/`page` history → Client `SessionEventLikeEntry` window → Conversation Contexts → target snapshot (`chat`, `trajectory`, or another registered target) → Slot view → React |
-| transient Session control | Host control baseline → Remote snapshot stream → `SessionManager` queue/job/projection stores → Session and list snapshots → standard hooks → components |
+| transient Session control | Host control baseline → Remote snapshot stream → `SessionManager` projection stores → Session and list snapshots → standard hooks → components |
+| Background jobs | Host job registry → `job.list` / `job.follow` → [`ClientJobs`](../../packages/api/job-controller/README.md) roster and output views → job list and panels |
 | Workspace state | Host Workspace baseline and increments → `ClientWorkspaceModel` → `ctx.workspaces.list` → `useWorkspaces` → sidebar, hero, and navigation entries |
 | scoped interaction | Host Cordis waterfall → API Remotes `$events` → `ctx.remote.$on()` on the Session Context → owning UI package → result or `next()` |
 | user command | component callback → registration inject face or Slot owner → `ctx.sessions`, `ctx.workspaces`, or generated scoped Remote → Host Controller → authoritative update → stream or event projection back to the Client |
diff --git a/docs/subsystems/web-client.zh.md b/docs/subsystems/web-client.zh.md
index 9c697964a0..d98febb749 100644
--- a/docs/subsystems/web-client.zh.md
+++ b/docs/subsystems/web-client.zh.md
@@ -40,10 +40,10 @@ Connection 拥有 request correlation、`/api` carrier、trust check、精确 Fe
 [`api/session-controller`](../../packages/api/session-controller/README.zh.md)公开 Session list、search、creation、prompt、queue、cancellation、pagination 及 follow/control stream 等 Host command。其 Client 侧按 `ClientSessions → SessionManager → Session` 组织：
 
 - `ClientSessions` 提供 `ctx.sessions`，拥有 reference、source count、Session scope 与稳定的 `SessionBinding` object，并投影不含全局 current Session 选择的 catalog state。
-- `SessionManager` 拥有 list baseline、实时 list/control update、惰性 Session instance、queue、projection store、subagent catalog，以及 pull 与后到 update 之间的冲突顺序。
+- `SessionManager` 拥有 list baseline、实时 list/control update、惰性 Session instance、projection store、subagent catalog，以及 pull 与后到 update 之间的冲突顺序。
 - 每个 `Session` 拥有一段由 `SessionEventLikeEntry` value 表示的连续逻辑 event window、pagination、follow、prompt/control state 与供 adapter 消费的 observable snapshot。
 
-持久 event 路径打开 `follow()`，其首帧包含当前 header、tail page、cursor 与完整 projection baseline。历史 record 带有显式 `event` 或 `chunks` 判别字段和字段对齐的内部 `event`；journal 先校验每条 record 的逻辑 seq 闭区间，Client 再直接把这些 record 保留为 `SessionEventLikeEntry`，无需逐 record 转换。每个物理 generation 都根据该 snapshot 原子替换保留窗口，随后按 seq append 标准实时 event。`page()` 只用于更早历史与 gap repair。瞬态 control stream 每代以完整 baseline 开始，随后应用 queue、job 与 projection update。
+持久 event 路径打开 `follow()`，其首帧包含当前 header、tail page、cursor 与完整 projection baseline。历史 record 带有显式 `event` 或 `chunks` 判别字段和字段对齐的内部 `event`；journal 先校验每条 record 的逻辑 seq 闭区间，Client 再直接把这些 record 保留为 `SessionEventLikeEntry`，无需逐 record 转换。每个物理 generation 都根据该 snapshot 原子替换保留窗口，随后按 seq append 标准实时 event。`page()` 只用于更早历史与 gap repair。瞬态 control stream 每代以完整 baseline 开始，随后应用 projection update。
 
 ### Workspaces
 
@@ -66,7 +66,8 @@ Web 和桌面端共享[开发者工具偏好](../../packages/client/ui-settings/
 | 路径 | 顺序 |
 |---|---|
 | 持久 Session 展示 | Host Session log → packed Remote `follow`/`page` 历史 → Client `SessionEventLikeEntry` window → Conversation Context → target snapshot（`chat`、`trajectory` 或其他已注册 target）→ Slot view → React |
-| 瞬态 Session control | Host control baseline → Remote snapshot stream → `SessionManager` queue/job/projection store → Session 与 list snapshot → 标准 hook → component |
+| 瞬态 Session control | Host control baseline → Remote snapshot stream → `SessionManager` projection store → Session 与 list snapshot → 标准 hook → component |
+| 后台任务 | Host job 注册表 → `job.list` / `job.follow` → [`ClientJobs`](../../packages/api/job-controller/README.zh.md) 名册与输出视图 → 任务列表和面板 |
 | Workspace 状态 | Host Workspace baseline 与 increment → `ClientWorkspaceModel` → `ctx.workspaces.list` → `useWorkspaces` → sidebar、hero 与 navigation entry |
 | scoped interaction | Host Cordis waterfall → API Remotes `$events` → Session Context 上的 `ctx.remote.$on()` → 所属 UI 包 → result 或 `next()` |
 | 用户 command | component callback → 注册项 inject face 或 Slot owner → `ctx.sessions`、`ctx.workspaces` 或生成的 scoped Remote → Host Controller → 权威 update → stream 或 event projection 回到 Client |
diff --git a/docs/tool-catalog.i18n.yaml b/docs/tool-catalog.i18n.yaml
index 54934936dc..8cdff8b24e 100644
--- a/docs/tool-catalog.i18n.yaml
+++ b/docs/tool-catalog.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/tool-catalog.md
-tool-catalog.md: a4441a1b6bdbd0c2f7cedf506244a8a4a2a1ca97
-tool-catalog.zh.md: 0a82afad88f5362ca997f2e563f1b53c4bf633e8
+tool-catalog.md: c60d3979e65f3c5a2bc363fd082a3f63a446e8b5
+tool-catalog.zh.md: dc061b51681cc73f9d10059276bcdfa5b3268cff
diff --git a/docs/tool-catalog.md b/docs/tool-catalog.md
index a4441a1b6b..c60d3979e6 100644
--- a/docs/tool-catalog.md
+++ b/docs/tool-catalog.md
@@ -732,7 +732,7 @@ Source: [`packages/extensions/tool-cordis/src/index.ts`](../packages/extensions/
 
 ### `cordis_inspect_query`
 
-Run a read-only query explicitly declared by an Inspect Provider. platform, provider, and method must come from cordis_inspect_list, and input must satisfy that method's schema. Use this Tool before writing plugin code to read exact Service methods, Event modes, Builtin signatures, Tool schemas, theme tokens, or live Slot trees and props. Host queries run locally. A Client query waits for the first valid page response and remains pending until a page answers or the Tool is cancelled. This Tool cannot invoke business Service methods or modify the runtime. For Service.listService and Event.listEvents, query without input to navigate the compact signature directory, then query the exact service or event for its structured contract and referenced types. For Slots.listSubTree, query without root to navigate the compact tree, then query an exact Slot root for its complete registration contract and props; an exact Factory root returns its identity, scope, and registrant.
+Run a read-only query declared by an Inspect Provider. platform, provider, and method must come from cordis_inspect_list, and input must satisfy that method's schema. Use this Tool before writing plugin code to read exact Service methods, Event modes, Builtin signatures, Tool schemas, theme tokens, or live Slot trees and props. Host queries run locally. A Client query waits for the first valid page response and remains pending until a page answers or the Tool is cancelled. This Tool cannot invoke business Service methods or modify the runtime.
 
 ```json
 {
diff --git a/docs/tool-catalog.zh.md b/docs/tool-catalog.zh.md
index 0a82afad88..dc061b5168 100644
--- a/docs/tool-catalog.zh.md
+++ b/docs/tool-catalog.zh.md
@@ -736,7 +736,7 @@ pwsh 工具是 Windows 组合中 bash 执行器 seam 的 PowerShell 方言消费
 
 ### `cordis_inspect_query`
 
-执行 Inspect Provider 明确声明的只读查询。platform、provider 和 method 必须来自 cordis_inspect_list，input 必须符合该方法的 schema。编写插件代码前，用本工具读取准确的 Service 方法、Event 模式、Builtin 签名、Tool schema、主题 token，或实时 Slot 树与 props。Host 查询在本地运行。Client 查询等待页面首个有效响应，直到页面回应或工具取消。本工具不能调用业务 Service 方法或修改运行时。对于 Service.listService 和 Event.listEvents，不传 input 可浏览精简签名目录，再查询准确服务或事件以获得完整约定及引用类型。对于 Slots.listSubTree，不传 root 可浏览精简树；查询准确的 Slot root 可获得完整注册约定和 props，而查询准确的 Factory root 只返回 identity、scope 与 registrant。
+执行 Inspect Provider 声明的只读查询。platform、provider 和 method 必须来自 cordis_inspect_list，input 必须符合该方法的 schema。编写插件代码前，用本工具读取准确的 Service 方法、Event 模式、Builtin 签名、Tool schema、主题 token，或实时 Slot 树与 props。Host 查询在本地运行。Client 查询等待页面首个有效响应，直到页面回应或工具取消。本工具不能调用业务 Service 方法或修改运行时。
 
 ```json
 {
diff --git a/packages/api/README.i18n.yaml b/packages/api/README.i18n.yaml
index 0de9905f67..f2447b3546 100644
--- a/packages/api/README.i18n.yaml
+++ b/packages/api/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/api/README.md
-README.md: 79271f6f5f7a05ef4f6d5da63815dfe1ee5da3ef
-README.zh.md: d98a0ef73a1b14a5eea98084cfb4ef224a7747a9
+README.md: 691a56856d0fceb62d3b32c3d5af90dd0323983a
+README.zh.md: 9303fbaae7b0f9a10880c18a7af79f1dffb3bdeb
diff --git a/packages/api/README.md b/packages/api/README.md
index 79271f6f5f..691a56856d 100644
--- a/packages/api/README.md
+++ b/packages/api/README.md
@@ -28,6 +28,7 @@ The packages below provide the Remote layer; the package READMEs own the exhaust
 |---|---|---|
 | [`remotes/`](remotes/README.md) | Chooses which Host capabilities and events the Client can consume. | — |
 | [`gateway/`](gateway/README.md) | Carries typed unary calls, multiplexed streams with their Client uplinks, and forwarded Host events. | `ctx.typertGateway` / `ctx.remote` |
+| [`job-controller/`](job-controller/README.md) | Streams one background job's observation record to the Client. | `ctx.jobController` / `ctx.remote.job` |
 | [`session-controller/`](session-controller/README.md) | Owns Session commands, history streams, live control state, and Agent/Session identity policy. | `ctx.sessionController` / `ctx.remote.session` |
 | [`settings-controller/`](settings-controller/README.md) | Owns the configuration-surface reads and writes over the settings-domain seams. | `ctx.settingsController`, `ctx.credentialsController` / `ctx.remote.settings`, `ctx.remote.credentials` |
 | [`workspace-controller/`](workspace-controller/README.md) | Owns Workspace mutations and the complete Client Workspace projection. | `ctx.workspaceController` / `ctx.remote.workspace` |
diff --git a/packages/api/README.zh.md b/packages/api/README.zh.md
index d98a0ef73a..9303fbaae7 100644
--- a/packages/api/README.zh.md
+++ b/packages/api/README.zh.md
@@ -28,6 +28,7 @@ kind: "package-group"
 |---|---|---|
 | [`remotes/`](remotes/README.zh.md) | 决定 Client 可以消费哪些 Host 能力与事件。 | — |
 | [`gateway/`](gateway/README.zh.md) | 承载类型化一元调用、带 Client 上行的多路复用流，以及转发的 Host 事件。 | `ctx.typertGateway` / `ctx.remote` |
+| [`job-controller/`](job-controller/README.zh.md) | 把一个后台任务的观测 record 流式送到 Client。 | `ctx.jobController` / `ctx.remote.job` |
 | [`session-controller/`](session-controller/README.zh.md) | 拥有会话命令、历史记录流、实时控制状态与 Agent/Session 身份策略。 | `ctx.sessionController` / `ctx.remote.session` |
 | [`settings-controller/`](settings-controller/README.zh.md) | 拥有 settings 域各 seam 之上的配置界面读写。 | `ctx.settingsController`、`ctx.credentialsController` / `ctx.remote.settings`、`ctx.remote.credentials` |
 | [`workspace-controller/`](workspace-controller/README.zh.md) | 拥有 Workspace 变更与完整 Client Workspace 投影。 | `ctx.workspaceController` / `ctx.remote.workspace` |
diff --git a/packages/api/job-controller/README.i18n.yaml b/packages/api/job-controller/README.i18n.yaml
new file mode 100644
index 0000000000..31fcbbd285
--- /dev/null
+++ b/packages/api/job-controller/README.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/api/job-controller/README.md
+README.md: d3698758cc144c033037759a834944870948284d
+README.zh.md: d9744b4d19cfff6d73923d0d26e3e817bc54c1a3
diff --git a/packages/api/job-controller/README.md b/packages/api/job-controller/README.md
new file mode 100644
index 0000000000..d3698758cc
--- /dev/null
+++ b/packages/api/job-controller/README.md
@@ -0,0 +1,67 @@
+---
+description: "Host and Client job streams: the roster one session can see and one job's retained output, mirrored to the browser without touching the model's consuming cursor."
+kind: "package-reference"
+---
+# Job Controller
+
+English | [中文](README.zh.md)
+
+## Summary
+
+`@deepseek-ai/dsh-api-job-controller` owns the Host `ctx.jobController` service and the generated Client `ctx.remote.job` namespace. Its two Remote streams are projections of `ctx.jobs`: `job.list` mirrors the jobs one session can see as whole-set frames, and `job.follow` delivers one job's retained output from an absolute byte offset. The Client half installs `ctx.jobs`, the reference-counted service whose rosters and accumulated views the session-header job list renders. Neither stream touches the model's consuming cursor or the completion-notice ledger.
+
+## Table of Contents
+
+- [Use this package](#use-this-package)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+- [Dev Note](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## Use this package
+
+The Host controller requires the job registry (`dsh-jobs-local` in the shipped compositions) and fails to load without it. `job.list({ sessionId })` yields the session's visible set — its own jobs plus every unowned job — once on open and again after each coalesced burst of lifecycle commits (registration, progress, stopping, settlement, removal); output appends never refresh the roster, since a settled projection already carries the final byte count. `job.follow({ sessionId?, jobId, from? })` passes `sessionId` to registry `get` and `readAt` — an unowned job needs no session — and yields one `opened` anchor carrying the job projection, coalesced `output` frames, then one terminal `status` once the job has settled and its ring is drained, after which the stream closes normally; a removal announced mid-stream (the owner's teardown) closes it with the removed job's terminal projection. Both reads are non-consuming: the model's `job_output` cursor and notice state never observe them.
+
+The Client entry installs `ctx.jobs` (`IJobs`), backed by the package-internal `ClientJobsModel`. `watchRows(sessionId)` keeps one roster stream open per watched session however many viewers hold it and drops the rows after the last release; a reconnect's first frame is already the whole truth. `observe(sessionId, jobId)` opens one Gateway stream per job however many viewers expand it, keeps a bounded render tail per job with `gapBefore` marking eviction or resume gaps, closes the view on the terminal frame or records a stream failure on it, and drops the view after the last viewer releases. The plugin resolves the Gateway stream factory and the `job` namespace while its own context is current, because stream (re)opens run on caller stacks whose dynamic context has not declared `remote.job`.
+
+### Config
+
+| Field | Default | Meaning |
+|---|---:|---|
+| `observeFlushMs` | `100` | Coalescing window after a registry commit before the next rows or output read, in milliseconds |
+| `observeMaxFrameBytes` | `65,536` | Soft byte budget per observation output frame; one larger chunk ships whole |
+
+The generated [configuration catalog](../../../docs/config-catalog.md#deepseek-aidsh-api-job-controller) is the exhaustive source for accepted fields and their JSDoc.
+
+-----
+
+<a id="model-experience"></a>
+## Model Experience
+
+None, as job observation is browser and Host control state; it registers no prompt, tool, or session event. The model's own view of the same work stays with [`dsh-tool-jobs`](../../jobs/tool-jobs/README.md).
+
+#### KV Cache effect
+
+No direct effect; observation reads never touch model requests.
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- The ring is a best-effort live preview, not a terminal transcript: producers' pull sources are copied per poll round, so two streams' writes inside one poll window land stdout first, and the client concatenates chunks regardless of `channel`.
+- Both streams are process-local: a Host restart loses every ring and roster; a resumed observation then anchors on an empty registry, and a re-opened roster starts empty.
+- Per-session fencing is enforced by the caller argument of each registry read; the Remote layer itself serves any connected browser.
+
+<a id="dev-note"></a>
+### Dev Note
+
+<details>
+<summary>Working context for maintainers — click to expand</summary>
+
+None.
+
+</details>
+
+**Runtime invariant:** No companion is published. The controller is a stateless projection of `ctx.jobs` reads; the registry's own `@deepseek-ai/dsh-jobs/invariant` owns the event protocol and event-versus-read relations these streams forward.
diff --git a/packages/api/job-controller/README.zh.md b/packages/api/job-controller/README.zh.md
new file mode 100644
index 0000000000..d9744b4d19
--- /dev/null
+++ b/packages/api/job-controller/README.zh.md
@@ -0,0 +1,67 @@
+---
+description: "Host 与 Client 的 job 流：把一个会话看得到的名册与一个 job 的保留输出镜像到浏览器，不触碰模型的消耗型游标。"
+kind: "package-reference"
+---
+# Job Controller
+
+[English](README.md) | 中文
+
+## 概述
+
+`@deepseek-ai/dsh-api-job-controller` 拥有 Host 的 `ctx.jobController` 服务与生成的 Client `ctx.remote.job` namespace。它的两条 Remote 流都是 `ctx.jobs` 的投影：`job.list` 以整集帧镜像一个会话看得到的 job；`job.follow` 从绝对字节偏移发送一个 job 的保留输出。Client 半侧安装 `ctx.jobs`——按引用计数的服务，会话头部任务列表渲染其名册与累积视图。两条流都不触碰模型的消耗型游标与完成播报台账。
+
+## 目录
+
+- [使用本包](#use-this-package)
+- [模型体验](#model-experience)
+- [已知限制与延期工作](#known-limitations-and-deferred-work)
+- [开发备注](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## 使用本包
+
+Host 控制器要求 job 注册表（已发布组合里是 `dsh-jobs-local`），缺少则不加载。`job.list({ sessionId })` 产出该会话可见的集合——自己的 job 加上所有无主 job——打开时一次，之后每一轮聚合过的生命周期提交（注册、进度、停止中、结算、移除）后再一次；输出追加从不刷新名册，因为结算后的投影已经带着最终字节数。`job.follow({ sessionId?, jobId, from? })` 把 `sessionId` 传给注册表的 `get` 与 `readAt`——无主 job 不需要 session——先产出一个携带 job 投影的 `opened` 锚帧，再是聚合的 `output` 帧，job 结算且环排干后产出一个终态 `status`，随后流正常关闭；流中若通告了移除（拥有者 teardown），则以被移除 job 的终态投影收尾。两种读取都是非消耗的：模型侧 `job_output` 游标与完成播报状态永远观察不到它们。
+
+Client 入口安装 `ctx.jobs`（`IJobs`），由包内部的 `ClientJobsModel` 支撑。`watchRows(sessionId)` 不论多少查看器持有都只为每个被关注的会话开一条名册流，最后一个释放后丢弃行；重连后的首帧已经是完整事实。`observe(sessionId, jobId)` 不论多少查看器展开同一 job 都只开一条 Gateway 流，按 job 保留有界的渲染尾部并用 `gapBefore` 标记淘汰或续读缺口，在终态帧上关闭视图或把流失败记到视图上，最后一个查看器释放后丢弃视图。插件在自己的上下文仍是当前上下文时解析 Gateway 流工厂与 `job` namespace，因为流的（重）开启跑在未声明 `remote.job` 的调用栈上。
+
+### 配置
+
+| 字段 | 默认值 | 含义 |
+|---|---:|---|
+| `observeFlushMs` | `100` | 注册表提交到下一次名册或输出读取之间的聚合窗口，毫秒 |
+| `observeMaxFrameBytes` | `65,536` | 每个观测输出帧的软字节预算；更大的单块整块发送 |
+
+生成的[配置目录](../../../docs/config-catalog.zh.md#deepseek-aidsh-api-job-controller)是所有受支持字段及其 JSDoc 的完整来源。
+
+-----
+
+<a id="model-experience"></a>
+## 模型体验
+
+无。job 观测是浏览器与 Host 的控制状态；它不注册任何提示词、工具或会话事件。模型对同一工作的视图仍在 [`dsh-tool-jobs`](../../jobs/tool-jobs/README.zh.md)。
+
+#### KV 缓存影响
+
+无直接影响；观测读取从不触碰模型请求。
+
+## 已知限制与延期工作
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- 环是尽力而为的实时预览，不是终端转录：生产者的拉取源按轮询轮次复制，同一轮询窗口内两条流的写入先 stdout 落地，客户端拼接 chunk 时也不区分 `channel`。
+- 两条流都是进程本地的：Host 重启丢失全部环与名册，续读的观测随后锚定在空注册表上，重开的名册从空开始。
+- 按 session 的访问限制由注册表每次读取时的调用方参数强制；Remote 层本身服务任何已连接浏览器。
+
+<a id="dev-note"></a>
+### 开发备注
+
+<details>
+<summary>维护者的工作上下文——点击展开</summary>
+
+无。
+
+</details>
+
+**运行时不变式：** 不发布伴生入口。控制器是 `ctx.jobs` 读取的无状态投影；这些流转发的事件协议与事件对读取的关系由注册表自己的 `@deepseek-ai/dsh-jobs/invariant` 拥有。
diff --git a/packages/api/job-controller/package.json b/packages/api/job-controller/package.json
new file mode 100644
index 0000000000..30fcb07689
--- /dev/null
+++ b/packages/api/job-controller/package.json
@@ -0,0 +1,86 @@
+{
+  "name": "@deepseek-ai/dsh-api-job-controller",
+  "description": "Job Remote observation stream and the reference-counted client job-output service",
+  "version": "0.1.6-alpha.2",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/api/job-controller"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./types": {
+      "types": "./lib/types/types.d.ts",
+      "default": "./lib/types/types.js"
+    },
+    "./client": {
+      "types": "./lib/types/client/index.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./typert": {
+      "types": "./lib/typert.host.d.ts",
+      "default": "./lib/typert.host.js"
+    },
+    "./remote": {
+      "types": "./lib/typert.remote-client.d.ts",
+      "default": "./lib/typert.remote-client.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "dsh": {
+    "client": {
+      "external": [
+        "@deepseek-ai/dsh-api-gateway/client"
+      ],
+      "inject": [
+        "@deepseek-ai/dsh-api-gateway",
+        "@deepseek-ai/dsh-client-connection"
+      ],
+      "platform": "web"
+    }
+  },
+  "scripts": {
+    "bundle": "tsdown",
+    "watch": "tsdown --watch"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/client.js",
+    "lib/types/**/*.js",
+    "lib/types/**/*.d.ts",
+    "lib/typert.host.js",
+    "lib/typert.host.d.ts",
+    "lib/typert.remote-client.js",
+    "lib/typert.remote-client.d.ts"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "@deepseek-ai/dsh-typert-protocol": "workspace:^",
+    "@deepseek-ai/schemastery": "workspace:^",
+    "zod": "^4.4.3"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "workspace:^"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "workspace:^",
+    "@deepseek-ai/dsh-agent": "workspace:^",
+    "@deepseek-ai/dsh-api-gateway": "workspace:^",
+    "@deepseek-ai/dsh-client-connection": "workspace:^",
+    "@deepseek-ai/dsh-client-store": "workspace:^",
+    "@deepseek-ai/dsh-jobs": "workspace:^",
+    "@deepseek-ai/dsh-jobs-local": "workspace:^",
+    "@deepseek-ai/dsh-session": "workspace:^",
+    "@deepseek-ai/dsh-typert-registry": "workspace:^"
+  }
+}
diff --git a/packages/api/job-controller/src/client/index.ts b/packages/api/job-controller/src/client/index.ts
new file mode 100644
index 0000000000..8c4f161ea2
--- /dev/null
+++ b/packages/api/job-controller/src/client/index.ts
@@ -0,0 +1,36 @@
+/**
+ * Job Controller client half: installs `ctx.jobs` over the generated `job`
+ * Remote namespace. The plugin resolves both Remote faces it drives while its
+ * own context is current, because stream (re)opens run on caller stacks — a
+ * React event, a carrier retry — whose dynamic context has not declared
+ * `remote.job`.
+ * @module @deepseek-ai/dsh-api-job-controller/client
+ */
+
+import type { Context } from '@deepseek-ai/cordis'
+import type {} from '@deepseek-ai/dsh-api-job-controller/remote'
+import { ClientJobsModel } from './model.ts'
+import { ClientJobs } from './service.ts'
+
+export type { JobsSnapshot, ObservedJob } from './model.ts'
+// The `ctx.jobs` contract. Its module also carries the Context augmentation
+// that declares `ctx.jobs`, which reaches consumers only through this export:
+// declaration emit drops the value import above.
+export type { IJobs } from './service.ts'
+export type {
+  JobChunk, JobFollowFrame, JobFollowRequest, JobListFrame, JobListRequest, JobView,
+} from '../types.ts'
+
+/** Required Client Remote services. */
+export const inject = ['remote', 'remote.job']
+
+/**
+ * Install the client jobs service.
+ * @param ctx - Client root Context.
+ */
+export function apply(ctx: Context): void {
+  // Read the namespace now, not inside `open`: see the module JSDoc.
+  const { remote } = ctx
+  const { job } = remote
+  new ClientJobs(ctx, { $stream: options => remote.$stream(options), job }, new ClientJobsModel())
+}
diff --git a/packages/api/job-controller/src/client/model.ts b/packages/api/job-controller/src/client/model.ts
new file mode 100644
index 0000000000..6f87a5d39e
--- /dev/null
+++ b/packages/api/job-controller/src/client/model.ts
@@ -0,0 +1,216 @@
+/**
+ * React-free client job state: the roster each watched session can see, fed
+ * by `job.list` frames, and per-job accumulated output views fed by
+ * `job.follow` frames. Pure data plus subscriptions — transport wiring stays
+ * in the client service, UI stays in slot components.
+ * @module @deepseek-ai/dsh-api-job-controller/client/model
+ */
+
+import { notifySubscribers } from '@deepseek-ai/dsh-client-store'
+import type { JobId } from '@deepseek-ai/dsh-jobs/brand'
+import type { JobView } from '@deepseek-ai/dsh-jobs/view'
+import type { SessionId } from '@deepseek-ai/dsh-session/types'
+import type { JobFollowFrame } from '../types.ts'
+
+/** Bounded per-job render tail, in UTF-16 code units. */
+const RENDER_TAIL_LIMIT = 128 * 1024
+
+/** One observed job's live view state. */
+export interface ObservedJob {
+  readonly jobId: JobId
+  /** Accumulated output tail, bounded to the render limit. */
+  readonly text: string
+  /** True when bytes before {@link text} were dropped (eviction, resume gap, or the render bound). */
+  readonly gapBefore: boolean
+  /** True while the observation stream is open and the job has not settled. */
+  readonly streaming: boolean
+  /** Terminal observation failure, when the stream ended abnormally. */
+  readonly error?: string
+}
+
+/** Immutable client job state. */
+export interface JobsSnapshot {
+  /**
+   * The jobs each watched session can see, keyed by session id. A session
+   * nobody watches, or one that sees no job, has no key, so consumers read
+   * absence rather than a sentinel.
+   */
+  readonly rows: Readonly<Record<string, readonly JobView[]>>
+  /** Live observation state keyed by job id. */
+  readonly observed: Readonly<Record<string, ObservedJob>>
+}
+
+/** Bare observable source for the client job snapshot. */
+export interface JobsSource {
+  /** Read the identity-stable current snapshot. */
+  getSnapshot(): JobsSnapshot
+  /**
+   * Subscribe to snapshot changes.
+   * @param listener - invalidation callback.
+   * @returns unsubscribe function.
+   */
+  subscribe(listener: () => void): () => void
+}
+
+/** Mutable observation bookkeeping behind one {@link ObservedJob} view. */
+interface ObservedState {
+  view: ObservedJob
+  /** Resume offset for the next generation's `from`. */
+  cursor: number | undefined
+}
+
+/** Owns the per-session rosters and per-job observation state. */
+export class ClientJobsModel implements JobsSource {
+  private readonly rowsBySession = new Map<string, readonly JobView[]>()
+  private readonly observedStates = new Map<string, ObservedState>()
+  private readonly listeners = new Set<() => void>()
+  private snapshotCache: JobsSnapshot = { rows: {}, observed: {} }
+  private snapshotDirty = false
+
+  getSnapshot(): JobsSnapshot {
+    if (this.snapshotDirty) {
+      const rows: Record<string, readonly JobView[]> = {}
+      for (const [id, jobs] of this.rowsBySession) rows[id] = jobs
+      const observed: Record<string, ObservedJob> = {}
+      for (const [id, state] of this.observedStates) observed[id] = state.view
+      this.snapshotCache = { rows, observed }
+      this.snapshotDirty = false
+    }
+    return this.snapshotCache
+  }
+
+  subscribe(listener: () => void): () => void {
+    this.listeners.add(listener)
+    return () => { this.listeners.delete(listener) }
+  }
+
+  /**
+   * Replace one session's roster with a `rows` frame's whole set. An empty
+   * set is stored as an absent key.
+   * @param sessionId - the watched session.
+   * @param jobs - the complete visible set.
+   */
+  rowsReplaced(sessionId: SessionId, jobs: readonly JobView[]): void {
+    const key = String(sessionId)
+    if (jobs.length === 0) {
+      if (!this.rowsBySession.delete(key)) return
+    } else {
+      this.rowsBySession.set(key, jobs)
+    }
+    this.changed()
+  }
+
+  /**
+   * Drop one session's roster after its last watcher stops or its stream fails.
+   * @param sessionId - the no-longer-watched session.
+   */
+  rowsDropped(sessionId: SessionId): void {
+    if (!this.rowsBySession.delete(String(sessionId))) return
+    this.changed()
+  }
+
+  /**
+   * The resume offset for one job's next observation generation.
+   * @param id - observed job.
+   * @returns the last accepted `next`, or undefined for a fresh observation.
+   */
+  cursorOf(id: JobId): number | undefined {
+    return this.observedStates.get(String(id))?.cursor
+  }
+
+  /**
+   * Install or reset observation state when a generation's anchor arrives.
+   * @param id - observed job.
+   * @param frame - the generation's `opened` anchor.
+   */
+  observeOpened(id: JobId, frame: Extract<JobFollowFrame, { type: 'opened' }>): void {
+    const existing = this.observedStates.get(String(id))
+    // A fresh view anchored past offset zero starts after an evicted head
+    // (fresh observations anchor at the registry's earliest retained byte), so
+    // it owes the same gap mark a live observer earned from lossy reads. A
+    // resume that already accumulated text keeps its recorded gap state.
+    const freshPastHead = (existing === undefined || existing.view.text === '') && frame.from > 0
+    const view: ObservedJob = {
+      jobId: id,
+      text: existing?.view.text ?? '',
+      gapBefore: (existing?.view.gapBefore ?? false) || frame.from < frame.job.output.earliest || freshPastHead,
+      streaming: true,
+    }
+    this.observedStates.set(String(id), { view, cursor: frame.from })
+    this.changed()
+  }
+
+  /**
+   * Append one output frame's chunks to the bounded render tail.
+   * @param id - observed job.
+   * @param frame - a coalesced `output` frame.
+   */
+  observeOutput(id: JobId, frame: Extract<JobFollowFrame, { type: 'output' }>): void {
+    const state = this.observedStates.get(String(id))
+    /* v8 ignore next -- frames arrive only between opened and stop for a tracked id. */
+    if (state === undefined) return
+    let text = state.view.text + frame.chunks.map(chunk => chunk.text).join('')
+    let gapBefore = state.view.gapBefore || frame.lossy === true
+      || frame.chunks.some(chunk => chunk.gapBefore === true)
+    if (text.length > RENDER_TAIL_LIMIT) {
+      let cut = text.length - RENDER_TAIL_LIMIT
+      // Never split a surrogate pair at the render bound.
+      const unit = text.charCodeAt(cut)
+      if (unit >= 0xDC00 && unit <= 0xDFFF) cut += 1
+      text = text.slice(cut)
+      gapBefore = true
+    }
+    state.view = { ...state.view, text, gapBefore }
+    state.cursor = frame.next
+    this.changed()
+  }
+
+  /**
+   * Close the live view once the terminal `status` frame arrived: the ring is
+   * drained and the roster row carries the settled projection.
+   * @param id - observed job.
+   */
+  observeSettled(id: JobId): void {
+    const state = this.observedStates.get(String(id))
+    /* v8 ignore next -- frames arrive only between opened and stop for a tracked id. */
+    if (state === undefined) return
+    state.view = { ...state.view, streaming: false }
+    this.changed()
+  }
+
+  /**
+   * Record a terminal observation failure.
+   * @param id - observed job.
+   * @param error - the stream's terminal failure.
+   */
+  observeFailed(id: JobId, error: unknown): void {
+    const state = this.observedStates.get(String(id))
+    if (state === undefined) {
+      // A failure before the anchor — a rejected request, a job gone between
+      // the click and the open — still owes the panel its notice; a later
+      // successful anchor replaces this view and resumes from no cursor.
+      this.observedStates.set(String(id), {
+        view: { jobId: id, text: '', gapBefore: false, streaming: false, error: String(error) },
+        cursor: undefined,
+      })
+      this.changed()
+      return
+    }
+    state.view = { ...state.view, streaming: false, error: String(error) }
+    this.changed()
+  }
+
+  /**
+   * Drop observation state after the last observer stops.
+   * @param id - the no-longer-observed job.
+   */
+  observeStopped(id: JobId): void {
+    if (!this.observedStates.delete(String(id))) return
+    this.changed()
+  }
+
+  private changed(): void {
+    this.snapshotDirty = true
+    notifySubscribers(this.listeners, 'jobs')
+  }
+}
diff --git a/packages/api/job-controller/src/client/service.ts b/packages/api/job-controller/src/client/service.ts
new file mode 100644
index 0000000000..e3eb06a623
--- /dev/null
+++ b/packages/api/job-controller/src/client/service.ts
@@ -0,0 +1,257 @@
+/**
+ * The `ctx.jobs` client service: reference-counted streams over the `job`
+ * namespace — one `job.list` roster stream per watched session and one
+ * `job.follow` stream per observed job — so overlapping viewers share a
+ * stream, rosters resume whole after a reconnect, and observations resume
+ * from the model's cursor.
+ * @module @deepseek-ai/dsh-api-job-controller/client/service
+ */
+
+import { Service, type Context } from '@deepseek-ai/cordis'
+import { RemoteStreamCarrierError, type ClientRemote } from '@deepseek-ai/dsh-api-gateway/client'
+import type { JobId } from '@deepseek-ai/dsh-jobs/brand'
+import type { SessionId } from '@deepseek-ai/dsh-session/types'
+import type { JobFollowFrame, JobFollowRequest, JobListFrame, JobListRequest } from '../types.ts'
+import type { ClientJobsModel, JobsSource } from './model.ts'
+
+/** The generated `job` namespace face the stream runners drive. */
+export interface JobRemote {
+  /**
+   * Open one roster generation.
+   * @param request - the session whose visible set to mirror.
+   * @param signal - generation cancellation.
+   * @returns the whole-set frame sequence of one generation.
+   */
+  list(request: JobListRequest, signal?: AbortSignal): AsyncIterable<JobListFrame>
+  /**
+   * Open one observation generation.
+   * @param request - target job, owning session, and optional resume offset.
+   * @param signal - generation cancellation.
+   * @returns the frame sequence of one generation.
+   */
+  follow(request: JobFollowRequest, signal?: AbortSignal): AsyncIterable<JobFollowFrame>
+}
+
+/** Remote faces the runners drive: the Gateway stream factory and the `job` namespace. */
+export interface JobsRemote {
+  readonly $stream: ClientRemote['$stream']
+  readonly job: JobRemote
+}
+
+/** The client jobs service face. */
+export interface IJobs {
+  /** Rosters and per-job observation state. */
+  readonly state: JobsSource
+  /**
+   * Keep one session's roster current; reference-counted, so two watchers of
+   * the same session share one stream and the rows leave with the last.
+   * @param sessionId - the session whose visible jobs to mirror.
+   * @returns stop function releasing this watcher's reference.
+   */
+  watchRows(sessionId: SessionId): () => void
+  /**
+   * Start observing one job's live output; reference-counted, so two viewers
+   * of the same job share one stream.
+   * @param sessionId - owning session used for the fenced read; undefined for an unowned job.
+   * @param id - job to observe.
+   * @returns stop function releasing this observer's reference.
+   */
+  observe(sessionId: SessionId | undefined, id: JobId): () => void
+}
+
+/** One reference-counted stream. */
+interface StreamEntry {
+  refs: number
+  stopped: boolean
+  dispose: () => Promise<void>
+}
+
+declare module '@deepseek-ai/cordis' {
+  interface Context {
+    /** React-free client job rosters and observation control. */
+    jobs: IJobs
+  }
+}
+
+/** Owns the bare jobs snapshot and the per-session and per-job streams. */
+export class ClientJobs extends Service implements IJobs {
+  readonly state: JobsSource
+  private readonly rowsEntries = new Map<string, StreamEntry>()
+  private readonly observations = new Map<string, StreamEntry>()
+
+  /**
+   * @param ctx - client root Context.
+   * @param remote - the Gateway stream factory plus the generated `job` namespace, both resolved by the caller.
+   * @param model - shared client jobs model.
+   */
+  constructor(
+    ctx: Context,
+    private readonly remote: JobsRemote,
+    private readonly model: ClientJobsModel,
+  ) {
+    super(ctx, 'jobs')
+    this.state = model
+    ctx.effect(() => async () => {
+      const open = [...this.rowsEntries.values(), ...this.observations.values()]
+      this.rowsEntries.clear()
+      this.observations.clear()
+      for (const entry of open) entry.stopped = true
+      // Cordis awaits an async disposer, so the fiber stays unloading until
+      // every carrier iterator has closed and a successor plugin instance
+      // cannot overlap one. A carrier whose teardown fails is stopped all the
+      // same; its failure has no consumer here.
+      await Promise.allSettled(open.map(entry => entry.dispose()))
+    }, 'job-controller.client.streams')
+  }
+
+  watchRows(sessionId: SessionId): () => void {
+    return this.acquire(
+      this.rowsEntries,
+      String(sessionId),
+      () => this.startRows(sessionId),
+      () => { this.model.rowsDropped(sessionId) },
+    )
+  }
+
+  observe(sessionId: SessionId | undefined, id: JobId): () => void {
+    return this.acquire(
+      this.observations,
+      String(id),
+      () => this.startObservation(sessionId, id),
+      () => { this.model.observeStopped(id) },
+    )
+  }
+
+  /** Share the live entry under `key` or start one, and hand back its release. */
+  private acquire(
+    entries: Map<string, StreamEntry>,
+    key: string,
+    start: () => StreamEntry,
+    cleared: () => void,
+  ): () => void {
+    const existing = entries.get(key)
+    if (existing !== undefined && !existing.stopped) {
+      existing.refs += 1
+      return this.releaser(entries, key, existing, cleared)
+    }
+    const entry = start()
+    entries.set(key, entry)
+    return this.releaser(entries, key, entry, cleared)
+  }
+
+  /**
+   * Release closures bind the exact entry they were minted for, never the
+   * map's current occupant: a later acquire on the same key may have replaced
+   * a stopped entry, and decrementing or disposing through the key alone
+   * would tear down that newer stream's references.
+   */
+  private releaser(entries: Map<string, StreamEntry>, key: string, entry: StreamEntry, cleared: () => void): () => void {
+    let released = false
+    return () => {
+      if (released) return
+      released = true
+      entry.refs -= 1
+      if (entry.refs > 0) return
+      if (entries.get(key) === entry) entries.delete(key)
+      entry.stopped = true
+      void entry.dispose().then(() => {
+        // Clear the state only while no successor holds the key: a re-acquire
+        // inside the dispose round-trip already refilled the model, and a
+        // stale clear would blank it for good.
+        if (entries.has(key)) return
+        cleared()
+      })
+    }
+  }
+
+  private startRows(sessionId: SessionId): StreamEntry {
+    const name = `job rows ${String(sessionId)}`
+    const stream = this.remote.$stream<JobListFrame>({
+      name,
+      open: signal => this.remote.job.list({ sessionId }, signal),
+      // The roster has no natural end while it is watched: an end after the
+      // first frame is a carrier interruption (a Host reload closes the
+      // generation) and the next generation's whole set loses nothing. An end
+      // before the first frame is terminal.
+      ended: accepted => accepted
+        ? new RemoteStreamCarrierError(`${name} ended before release`)
+        : new Error(`${name} ended before its first frame`),
+    })
+    const entry: StreamEntry = {
+      refs: 1,
+      stopped: false,
+      dispose: () => stream.dispose(),
+    }
+    void (async () => {
+      try {
+        for await (const item of stream) {
+          this.model.rowsReplaced(sessionId, item.value.jobs)
+          item.accept()
+        }
+      } catch {
+        // A terminal stream failure leaves nothing current to show; the model
+        // drops the roster rather than keeping a stale set on screen.
+        if (!entry.stopped) this.model.rowsDropped(sessionId)
+      } finally {
+        entry.stopped = true
+        void entry.dispose()
+      }
+    })()
+    return entry
+  }
+
+  private startObservation(sessionId: SessionId | undefined, id: JobId): StreamEntry {
+    const name = `job observation ${String(id)}`
+    const stream = this.remote.$stream<JobFollowFrame>({
+      name,
+      open: (signal) => {
+        const from = this.model.cursorOf(id)
+        return this.remote.job.follow(
+          {
+            jobId: id,
+            ...sessionId !== undefined ? { sessionId } : {},
+            ...from !== undefined ? { from } : {},
+          },
+          signal,
+        )
+      },
+      // A premature end after the anchor is retryable (a Host reload closes the
+      // generation); resuming from the cursor loses nothing. An end before the
+      // anchor is terminal.
+      ended: accepted => accepted
+        ? new RemoteStreamCarrierError(`${name} ended before settlement`)
+        : new Error(`${name} ended before its anchor`),
+    })
+    const entry: StreamEntry = {
+      refs: 1,
+      stopped: false,
+      dispose: () => stream.dispose(),
+    }
+    void (async () => {
+      try {
+        for await (const item of stream) {
+          const frame = item.value
+          if (frame.type === 'opened') {
+            this.model.observeOpened(id, frame)
+            item.accept()
+            continue
+          }
+          if (frame.type === 'output') {
+            this.model.observeOutput(id, frame)
+            continue
+          }
+          // Terminal status: leave the loop before the generation end is
+          // classified, then close the stream for good.
+          this.model.observeSettled(id)
+          break
+        }
+      } catch (error) {
+        if (!entry.stopped) this.model.observeFailed(id, error)
+      } finally {
+        entry.stopped = true
+        void entry.dispose()
+      }
+    })()
+    return entry
+  }
+}
diff --git a/packages/api/job-controller/src/index.ts b/packages/api/job-controller/src/index.ts
new file mode 100644
index 0000000000..3c463dd85c
--- /dev/null
+++ b/packages/api/job-controller/src/index.ts
@@ -0,0 +1,97 @@
+/**
+ * Host job Remote owner: streams the background-job roster one session can
+ * see and one job's retained output to browsers over the generated `job`
+ * namespace. Both streams are projections of `ctx.jobs`; the model's
+ * consuming cursor and notice state never observe them.
+ * @module @deepseek-ai/dsh-api-job-controller
+ */
+
+import { Context } from '@deepseek-ai/cordis'
+import z from '@deepseek-ai/schemastery'
+import type {} from '@deepseek-ai/dsh-jobs'
+import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol'
+import { observeJobOutput } from './observe.ts'
+import { streamJobRows } from './rows.ts'
+import type { JobFollowFrame, JobFollowRequest, JobListFrame, JobListRequest } from './types.ts'
+
+export type * from './types.ts'
+
+declare module '@deepseek-ai/cordis' {
+  interface Context {
+    /** Host job Remote namespace owner. */
+    jobController: JobController
+  }
+}
+
+/** Default coalescing window between reads, in milliseconds. */
+const DEFAULT_OBSERVE_FLUSH_MS = 100
+
+/** Default soft byte budget per output frame. */
+const DEFAULT_OBSERVE_MAX_FRAME_BYTES = 64 * 1024
+
+/** Job Controller deployment policy. */
+export interface Config {
+  /** Coalescing window after a registry commit before the next rows or output read, in milliseconds (default 100). */
+  readonly observeFlushMs?: number
+  /** Soft byte budget per observation output frame (default 65536); one larger chunk ships whole. */
+  readonly observeMaxFrameBytes?: number
+}
+
+/** Host service backing the generated `ctx.remote.job` namespace. */
+export class JobController extends TypertRemoteService {
+  static inject = ['jobs', 'typert']
+
+  static Config: z<Config> = z.object({
+    observeFlushMs: z.natural().min(1).default(DEFAULT_OBSERVE_FLUSH_MS),
+    observeMaxFrameBytes: z.natural().min(1).default(DEFAULT_OBSERVE_MAX_FRAME_BYTES),
+  })
+
+  private readonly observeFlushMs: number
+  private readonly observeMaxFrameBytes: number
+
+  /**
+   * @param ctx - Host context carrying the job registry.
+   * @param config - observation cadence and framing policy.
+   */
+  constructor(ctx: Context, config: Config) {
+    super(ctx, 'jobController', { namespace: 'job' })
+    // schemastery (the exported Config schema) has already filled the defaulted
+    // fields; the assertion records that resolution, not a hidden fallback.
+    const resolved = config as Required<Config>
+    this.observeFlushMs = resolved.observeFlushMs
+    this.observeMaxFrameBytes = resolved.observeMaxFrameBytes
+  }
+
+  /**
+   * Stream the jobs one session can see — its own plus every unowned job —
+   * as whole-set frames: one on open, then one after each coalesced burst of
+   * lifecycle commits. The stream has no natural end; the carrier closes it.
+   * @param request - the session whose visible set to mirror.
+   * @param signal - cancellation owned by the Remote stream carrier.
+   * @returns the roster frames.
+   */
+  @Remote({ mode: 'stream' })
+  list(request: JobListRequest, signal: AbortSignal): AsyncIterable<JobListFrame> {
+    return streamJobRows(this.ctx.jobs, request, { flushMs: this.observeFlushMs }, signal)
+  }
+
+  /**
+   * Stream one job's retained output from an absolute byte offset, then its
+   * terminal projection once settled and drained. Non-consuming: the
+   * model-facing cursor and notice state never observe these reads. The
+   * request's session is the fenced read's caller; the registry rejects a
+   * job the session cannot see and an unknown job.
+   * @param request - target job, owning session, and optional resume offset.
+   * @param signal - cancellation owned by the Remote stream carrier.
+   * @returns anchor, coalesced output frames, and the terminal status.
+   */
+  @Remote({ mode: 'stream' })
+  follow(request: JobFollowRequest, signal: AbortSignal): AsyncIterable<JobFollowFrame> {
+    return observeJobOutput(this.ctx.jobs, request, {
+      flushMs: this.observeFlushMs,
+      maxFrameBytes: this.observeMaxFrameBytes,
+    }, signal)
+  }
+}
+
+export default JobController
diff --git a/packages/api/job-controller/src/observe.ts b/packages/api/job-controller/src/observe.ts
new file mode 100644
index 0000000000..31b4682bed
--- /dev/null
+++ b/packages/api/job-controller/src/observe.ts
@@ -0,0 +1,132 @@
+/** Per-job observation generations: anchor, coalesced output, terminal status. */
+
+import type { JobId } from '@deepseek-ai/dsh-jobs/brand'
+import type { JobChunk, JobRegistry, JobStatus, JobView } from '@deepseek-ai/dsh-jobs'
+import type { JobFollowFrame, JobFollowRequest } from './types.ts'
+import { OutputWaiter, sleep } from './wake.ts'
+
+/** Cadence and framing bounds for one observation generation. */
+export interface ObserveJobOptions {
+  /** Coalescing window after a wake before reading, in milliseconds. */
+  readonly flushMs: number
+  /**
+   * Soft byte budget per `output` frame. Accumulated chunks flush once the
+   * budget is met; one chunk larger than the budget ships whole (the
+   * registry's retention cap is the hard bound on any single chunk).
+   */
+  readonly maxFrameBytes: number
+}
+
+function isTerminal(status: JobStatus): boolean {
+  return status !== 'running' && status !== 'stopping'
+}
+
+/**
+ * Stream one job's retained output from an absolute offset: one `opened`
+ * anchor, coalesced `output` frames as the ring advances, then one terminal
+ * `status` after the settled job is drained, after which the generation
+ * closes normally. A removal announced mid-generation (the owner's teardown)
+ * closes it with the removed job's terminal projection instead of a failed
+ * read. Reads are non-consuming — the model-facing cursor and
+ * notice state never observe them; reconnecting callers resume by passing
+ * the last frame's `next` as `from`. The request's session is the fenced
+ * read's caller: the registry rejects a job the session cannot see and an
+ * unknown job.
+ * @param registry - the live job registry.
+ * @param request - target job, owning session, and optional resume offset.
+ * @param options - cadence and framing bounds.
+ * @param signal - generation cancellation owned by the Remote stream carrier.
+ * @returns the observation frame sequence for one generation.
+ */
+export async function* observeJobOutput(
+  registry: JobRegistry,
+  request: JobFollowRequest,
+  options: ObserveJobOptions,
+  signal: AbortSignal,
+): AsyncIterable<JobFollowFrame> {
+  if (request.from !== undefined && (!Number.isSafeInteger(request.from) || request.from < 0)) {
+    throw new Error(`invalid observe offset: expected a non-negative safe integer, got ${JSON.stringify(request.from)}`)
+  }
+  signal.throwIfAborted()
+  // The brand is nominal typing only; the wire boundary stamps it here rather
+  // than value-importing the registry package's constructor.
+  const id = String(request.jobId) as JobId
+  const waiter = new OutputWaiter()
+  // A removal announced during the generation: the owner's teardown settled
+  // and dropped the record, so the projection it announced is the last word
+  // and the read after the flush window would only find an unknown id.
+  let removed: JobView | undefined
+  // Subscribe before the first read so an append between the anchor read and
+  // the wait cannot be missed.
+  const unsubscribe = registry.events.subscribe({ owners: 'all' }, (event) => {
+    const changed = event.type === 'output' ? event.id : event.job.id
+    if (changed !== id) return
+    if (event.type === 'removed') removed = event.job
+    waiter.wake()
+  })
+  try {
+    let job = registry.get(id, request.sessionId)
+    let cursor = request.from ?? job.output.earliest
+    yield { type: 'opened', job, from: cursor }
+    while (!signal.aborted) {
+      if (removed !== undefined) {
+        yield { type: 'status', job: removed }
+        return
+      }
+      const read = registry.readAt(id, cursor, request.sessionId)
+      if (read.chunks.length > 0 || read.lossy) {
+        yield* outputFrames(read.chunks, read.next, read.lossy, options.maxFrameBytes)
+      }
+      cursor = read.next
+      job = registry.get(id, request.sessionId)
+      if (isTerminal(job.status) && cursor >= job.output.total) {
+        yield { type: 'status', job }
+        return
+      }
+      await waiter.wait(signal)
+      // Let a burst accumulate so producer chatter becomes bounded frames.
+      await sleep(options.flushMs, signal)
+    }
+  } finally {
+    unsubscribe()
+  }
+}
+
+/** Split one read into frames along the soft per-frame byte budget. */
+function* outputFrames(
+  chunks: readonly JobChunk[],
+  next: number,
+  lossy: boolean,
+  maxFrameBytes: number,
+): Iterable<JobFollowFrame> {
+  let batch: JobChunk[] = []
+  let batchBytes = 0
+  let flaggedLossy = lossy
+  for (const chunk of chunks) {
+    batch.push(chunk)
+    batchBytes += Buffer.byteLength(chunk.text, 'utf8')
+    if (batchBytes >= maxFrameBytes) {
+      const last = batch[batch.length - 1]
+      /* v8 ignore start -- a non-empty batch always has a last chunk; the arm only discharges noUncheckedIndexedAccess. */
+      const end = last === undefined ? next : last.at + Buffer.byteLength(last.text, 'utf8')
+      /* v8 ignore stop */
+      yield {
+        type: 'output',
+        chunks: batch,
+        next: end,
+        ...flaggedLossy ? { lossy: true as const } : {},
+      }
+      flaggedLossy = false
+      batch = []
+      batchBytes = 0
+    }
+  }
+  if (batch.length > 0 || flaggedLossy) {
+    yield {
+      type: 'output',
+      chunks: batch,
+      next,
+      ...flaggedLossy ? { lossy: true as const } : {},
+    }
+  }
+}
diff --git a/packages/api/job-controller/src/rows.ts b/packages/api/job-controller/src/rows.ts
new file mode 100644
index 0000000000..9ef6564979
--- /dev/null
+++ b/packages/api/job-controller/src/rows.ts
@@ -0,0 +1,53 @@
+/** Per-session roster generations: the caller-visible job set, replaced whole after every lifecycle change. */
+
+import type { JobRegistry } from '@deepseek-ai/dsh-jobs'
+import type { JobListFrame, JobListRequest } from './types.ts'
+import { OutputWaiter, sleep } from './wake.ts'
+
+/** Cadence bound for one roster generation. */
+export interface RowsOptions {
+  /** Coalescing window after a lifecycle event before the next rows read, in milliseconds. */
+  readonly flushMs: number
+}
+
+/**
+ * Stream the jobs one session can see: one frame on open, then one after
+ * every lifecycle commit that touches a visible job (registration, progress,
+ * stopping, settlement, removal), coalesced over `flushMs`. Output appends
+ * never refresh the roster — a settled projection already carries the final
+ * byte count — so the stream is quiet while a job merely writes. Reads are
+ * projections; the model's cursor and notice state never observe them.
+ * @param registry - the live job registry.
+ * @param request - the session whose visible set to mirror.
+ * @param options - the coalescing window.
+ * @param signal - generation cancellation owned by the Remote stream carrier.
+ * @returns the roster frame sequence for one generation.
+ */
+export async function* streamJobRows(
+  registry: JobRegistry,
+  request: JobListRequest,
+  options: RowsOptions,
+  signal: AbortSignal,
+): AsyncIterable<JobListFrame> {
+  signal.throwIfAborted()
+  const waiter = new OutputWaiter()
+  // Subscribe before the first read so a commit between the read and the
+  // wait cannot be missed.
+  const unsubscribe = registry.events.subscribe({ owners: 'all' }, (event) => {
+    if (event.type === 'output') return
+    const owner = event.job.owner
+    if (owner === undefined || owner === request.sessionId) waiter.wake()
+  })
+  try {
+    yield { type: 'rows', jobs: registry.list(request.sessionId) }
+    while (true) {
+      await waiter.wait(signal)
+      // Let a burst of commits settle into one frame.
+      await sleep(options.flushMs, signal)
+      if (signal.aborted) return
+      yield { type: 'rows', jobs: registry.list(request.sessionId) }
+    }
+  } finally {
+    unsubscribe()
+  }
+}
diff --git a/packages/api/job-controller/src/types.ts b/packages/api/job-controller/src/types.ts
new file mode 100644
index 0000000000..aa02d2061f
--- /dev/null
+++ b/packages/api/job-controller/src/types.ts
@@ -0,0 +1,70 @@
+/**
+ * Wire types of the generated `job` Remote namespace: the per-session roster
+ * stream and the per-job observation stream. Client-safe: no Host imports.
+ * @module @deepseek-ai/dsh-api-job-controller/types
+ */
+
+import type { JobId } from '@deepseek-ai/dsh-jobs/brand'
+import type { JobChunk, JobView } from '@deepseek-ai/dsh-jobs/view'
+import type { SessionId } from '@deepseek-ai/dsh-session/types'
+
+export type { JobChunk, JobView } from '@deepseek-ai/dsh-jobs/view'
+
+/** Target of one `job.list` stream: the session whose visible jobs the stream mirrors. */
+export interface JobListRequest {
+  readonly sessionId: SessionId
+}
+
+/**
+ * One `job.list` frame: the complete set the session can see — its own jobs
+ * plus every unowned job — after a lifecycle change. Whole-set replacement,
+ * so a reconnect's first frame is already the truth.
+ */
+export interface JobListFrame {
+  readonly type: 'rows'
+  readonly jobs: readonly JobView[]
+}
+
+/** Target of one `job.follow` stream: the job, its owning session, and an optional resume offset. */
+export interface JobFollowRequest {
+  /**
+   * Owning session for the fenced read. Omitted for an unowned job, which any
+   * caller may observe.
+   */
+  readonly sessionId?: SessionId
+  readonly jobId: JobId
+  /**
+   * Absolute byte offset to resume from (a prior frame's `next`). Omitted, the
+   * stream starts at the oldest retained byte.
+   */
+  readonly from?: number
+}
+
+/**
+ * Job observation stream frames: one `opened` anchor carrying the job's
+ * projection (its `output.earliest` and `output.total` at open time) and the
+ * offset the first `output` frame continues from, then coalesced `output`
+ * batches, then — once the job has settled and its ring is drained — one
+ * terminal `status` carrying the settled projection, after which the stream
+ * closes normally. Status rides the same stream as output so settlement can
+ * never race a still-open output channel.
+ */
+export type JobFollowFrame =
+  | {
+    readonly type: 'opened'
+    readonly job: JobView
+    /** Offset the first `output` frame continues from. */
+    readonly from: number
+  }
+  | {
+    readonly type: 'output'
+    readonly chunks: readonly JobChunk[]
+    /** Offset to resume from after this frame. */
+    readonly next: number
+    /** Bytes between the requested offset and `chunks` were already evicted. */
+    readonly lossy?: true
+  }
+  | {
+    readonly type: 'status'
+    readonly job: JobView
+  }
diff --git a/packages/api/job-controller/src/wake.ts b/packages/api/job-controller/src/wake.ts
new file mode 100644
index 0000000000..489699cb3c
--- /dev/null
+++ b/packages/api/job-controller/src/wake.ts
@@ -0,0 +1,60 @@
+/**
+ * Wake bookkeeping shared by the two observation generators: a wake-flag
+ * waiter that never loses a wake between waits, and an abortable sleep that
+ * coalesces bursts into bounded frames.
+ * @module @deepseek-ai/dsh-api-job-controller/wake
+ */
+
+/** Wake-flag waiter: a wake between waits is never lost. */
+export class OutputWaiter {
+  private dirty = false
+  private resolve: (() => void) | undefined
+
+  /** Record one wake; releases a pending wait or arms the next one. */
+  wake(): void {
+    this.dirty = true
+    this.resolve?.()
+  }
+
+  /**
+   * Resolve on the next wake, immediately when one already arrived, or on abort.
+   * @param signal - generation cancellation.
+   * @returns settles when woken or aborted.
+   */
+  wait(signal: AbortSignal): Promise<void> {
+    if (this.dirty || signal.aborted) {
+      this.dirty = false
+      return Promise.resolve()
+    }
+    return new Promise((resolve) => {
+      const finish = (): void => {
+        signal.removeEventListener('abort', finish)
+        /* v8 ignore next -- one wait owns the sole installed resolver. */
+        if (this.resolve === finish) this.resolve = undefined
+        this.dirty = false
+        resolve()
+      }
+      this.resolve = finish
+      signal.addEventListener('abort', finish, { once: true })
+    })
+  }
+}
+
+/**
+ * Sleep for the coalescing window, or return at once when aborted.
+ * @param ms - window in milliseconds.
+ * @param signal - generation cancellation.
+ * @returns settles after the window or on abort.
+ */
+export function sleep(ms: number, signal: AbortSignal): Promise<void> {
+  if (signal.aborted) return Promise.resolve()
+  return new Promise((resolve) => {
+    const timer = setTimeout(done, ms)
+    function done(): void {
+      clearTimeout(timer)
+      signal.removeEventListener('abort', done)
+      resolve()
+    }
+    signal.addEventListener('abort', done, { once: true })
+  })
+}
diff --git a/packages/api/job-controller/tests/built-lib.e2e.ts b/packages/api/job-controller/tests/built-lib.e2e.ts
new file mode 100644
index 0000000000..e0d45bdce3
--- /dev/null
+++ b/packages/api/job-controller/tests/built-lib.e2e.ts
@@ -0,0 +1,42 @@
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import { describe, expect, it } from 'vitest'
+
+/**
+ * Built-artifact smoke for the generated job Remote codecs. This package's
+ * program compiles only the `JobKindMap` merges it can see (`bash`,
+ * `subagent`), while the Host registers `pwsh`, `pty-send`, and every other
+ * producer kind, so the wire projection's `kind` must reach the codec as an
+ * open string rather than the literal union this program observes.
+ */
+
+const artifact = join(fileURLToPath(new URL('..', import.meta.url)), 'lib/typert.host.js')
+
+interface BuiltInvocation {
+  readonly method: string
+  readonly result: { create(): { safeParse(value: unknown): { success: boolean } } }
+}
+
+const row = {
+  id: 'pty-send-1',
+  kind: 'pty-send',
+  label: 'send',
+  status: 'running',
+  startedAt: 1,
+  output: { total: 0, earliest: 0 },
+}
+
+describe.skipIf(!existsSync(artifact))('job Remote built codecs', () => {
+  it('accept a row whose kind this program never compiled, and still reject a status outside the lifecycle', async () => {
+    const { TYPERT } = await import(pathToFileURL(artifact).href) as { TYPERT: { invocations: readonly BuiltInvocation[] } }
+    const schemaOf = (method: string): ReturnType<BuiltInvocation['result']['create']> => {
+      const invocation = TYPERT.invocations.find(candidate => candidate.method === method)
+      if (invocation === undefined) throw new Error(`no generated job.${method} invocation`)
+      return invocation.result.create()
+    }
+    expect(schemaOf('list').safeParse({ type: 'rows', jobs: [row] }).success).toBe(true)
+    expect(schemaOf('follow').safeParse({ type: 'opened', job: row, from: 0 }).success).toBe(true)
+    expect(schemaOf('follow').safeParse({ type: 'status', job: { ...row, status: 'paused' } }).success).toBe(false)
+  })
+})
diff --git a/packages/api/job-controller/tests/client-apply.client.spec.ts b/packages/api/job-controller/tests/client-apply.client.spec.ts
new file mode 100644
index 0000000000..0dd43b6f41
--- /dev/null
+++ b/packages/api/job-controller/tests/client-apply.client.spec.ts
@@ -0,0 +1,73 @@
+import { Context } from '@deepseek-ai/cordis'
+import type { ConnectionHandle } from '@deepseek-ai/dsh-client-connection/client'
+import { RemoteStream, type RemoteStreamOptions } from '@deepseek-ai/dsh-api-gateway/client'
+import type { SessionId } from '@deepseek-ai/dsh-session/types'
+import { afterEach, describe, expect, it } from 'vitest'
+import * as JobClient from '../src/client/index.ts'
+import type { JobFollowFrame, JobListFrame } from '../src/types.ts'
+
+const contexts = new Set<Context>()
+
+afterEach(async () => {
+  await Promise.all([...contexts].map(async (ctx) => { await ctx.fiber.dispose() }))
+  contexts.clear()
+})
+
+/** Mount the client half over a captured `remote.job` namespace and a real Gateway stream carrier. */
+async function mount(): Promise<{ ctx: Context; observeCalls: unknown[]; rowsCalls: unknown[] }> {
+  const ctx = new Context()
+  contexts.add(ctx)
+  const observeCalls: unknown[] = []
+  const rowsCalls: unknown[] = []
+  const connection: ConnectionHandle = {
+    isLoopback: true,
+    generation: { getSnapshot: () => ({ id: 1, host: { home: '/home/fixture' } }), subscribe: () => () => {} },
+    state: { getSnapshot: () => 'connected' as const, subscribe: () => () => {} },
+    rpc: { call: () => Promise.reject(new Error('unexpected generic RPC call')) },
+    reconnect: () => {},
+    registerGenerationSource: () => () => {},
+    start: () => ({ stop: () => {} }),
+  }
+  const job = {
+    // The fake streams never yield; opening and releasing must leave no state behind.
+    list: (request: unknown) => {
+      rowsCalls.push(request)
+      return (async function* (): AsyncGenerator<JobListFrame> {})()
+    },
+    follow: (request: unknown) => {
+      observeCalls.push(request)
+      return (async function* (): AsyncGenerator<JobFollowFrame> {})()
+    },
+  }
+  ctx.reflect.provide('remote', {
+    $stream: <Item>(options: RemoteStreamOptions<Item>) => new RemoteStream(connection, options),
+    job,
+  })
+  ctx.reflect.provide('remote.job', job)
+  await ctx.plugin(JobClient)
+  return { ctx, observeCalls, rowsCalls }
+}
+
+async function flush(): Promise<void> {
+  for (let index = 0; index < 12; index++) await Promise.resolve()
+}
+
+describe('Job Controller Client apply', () => {
+  it('declares the Remote services it binds', () => {
+    expect(JobClient.inject).toEqual(['remote', 'remote.job'])
+  })
+
+  it('installs ctx.jobs over the captured job namespace', async () => {
+    const { ctx, observeCalls, rowsCalls } = await mount()
+    expect(ctx.jobs).toBeDefined()
+    const stopRows = ctx.jobs.watchRows('session-1' as SessionId)
+    const stopObserve = ctx.jobs.observe('session-1' as SessionId, 'bash-1' as never)
+    await flush()
+    expect(rowsCalls).toEqual([{ sessionId: 'session-1' }])
+    expect(observeCalls).toEqual([{ sessionId: 'session-1', jobId: 'bash-1' }])
+    stopRows()
+    stopObserve()
+    await flush()
+    expect(ctx.jobs.state.getSnapshot()).toEqual({ rows: {}, observed: {} })
+  })
+})
diff --git a/packages/api/job-controller/tests/host-harness.ts b/packages/api/job-controller/tests/host-harness.ts
new file mode 100644
index 0000000000..85609166b0
--- /dev/null
+++ b/packages/api/job-controller/tests/host-harness.ts
@@ -0,0 +1,101 @@
+import { Context } from '@deepseek-ai/cordis'
+import AgentRegistry from '@deepseek-ai/dsh-agent'
+import { unsupportedInbox } from '@deepseek-ai/dsh-agent-loop-testkit'
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import type { JobAppendOptions, JobHandle, JobOutcome } from '@deepseek-ai/dsh-jobs'
+import LocalJobRegistry from '@deepseek-ai/dsh-jobs-local'
+import { Session, SessionId } from '@deepseek-ai/dsh-session'
+
+/** A registry with a tiny ring so eviction is cheap to reach. */
+export async function harness(): Promise<Context> {
+  const ctx = new Context()
+  await ctx.plugin(AgentRegistry)
+  await ctx.plugin(LocalJobRegistry, { retainBytes: 64, settledRetainBytes: 64 })
+  ctx.jobs.attachController('job-controller-test')
+  return ctx
+}
+
+/** Register a live agent for `rawId` under its own lifecycle scope. */
+export async function registerAgent(ctx: Context, rawId: string): Promise<Agent & { disposeScope: () => Promise<void> }> {
+  const scopeFiber = ctx.plugin(() => {})
+  const id = SessionId(rawId)
+  const session = Session.create(id)
+  const agent: Agent & { disposeScope: () => Promise<void> } = {
+    id,
+    options: {},
+    session,
+    inbox: unsupportedInbox(),
+    status: 'idle',
+    ctx: scopeFiber.ctx,
+    send: () => {},
+    followup: () => {},
+    steer: () => {},
+    inject: () => {},
+    cancel: () => {},
+    runMaintenance: task => task(new AbortController().signal),
+    whenIdle: () => Promise.resolve(),
+    disposeScope: () => scopeFiber.dispose(),
+  }
+  await ctx.agents.register(agent)
+  return agent
+}
+
+/**
+ * Start one push-producer job whose `done` settles on demand; expose the
+ * handle's writers. A cancel settles the job as killed unless `slowStop`
+ * keeps it stopping until the test settles it.
+ */
+export function startJob(ctx: Context, options: { label?: string; owner?: SessionId; slowStop?: boolean } = {}) {
+  let settle!: (outcome: JobOutcome) => void
+  let handle!: JobHandle
+  const id = ctx.jobs.start({
+    kind: 'bash',
+    label: options.label ?? 'echo',
+    ...options.owner !== undefined ? { owner: options.owner } : {},
+    run: (job) => {
+      handle = job
+      return {
+        cancel() { if (options.slowStop !== true) settle({ status: 'killed' }) },
+        done: new Promise<JobOutcome>((resolve) => { settle = resolve }),
+      }
+    },
+  })
+  return {
+    id,
+    append: (text: string, opts?: JobAppendOptions) => { handle.append(text, opts) },
+    progress: (line: string) => { handle.updateProgress(line) },
+    settle: async (outcome: JobOutcome) => {
+      settle(outcome)
+      await new Promise(resolve => setTimeout(resolve, 0))
+    },
+  }
+}
+
+/** Read frames until `count` arrive or the generator finishes, then abort. */
+export async function collect<Frame>(
+  iterable: AsyncIterable<Frame>,
+  count: number,
+  abort: AbortController,
+): Promise<Frame[]> {
+  const frames: Frame[] = []
+  const iterator = iterable[Symbol.asyncIterator]()
+  try {
+    while (frames.length < count) {
+      const step = await iterator.next()
+      if (step.done) return frames
+      frames.push(step.value)
+    }
+  } finally {
+    abort.abort()
+    await iterator.next().catch(() => undefined)
+  }
+  return frames
+}
+
+export const wait = (ms: number) => new Promise<void>(resolve => setTimeout(resolve, ms))
+
+/** The next yielded frame, or undefined once the generator finished. */
+export async function next<Frame>(iterator: AsyncIterator<Frame>): Promise<Frame | undefined> {
+  const step = await iterator.next()
+  return step.done === true ? undefined : step.value
+}
diff --git a/packages/api/job-controller/tests/model.client.spec.ts b/packages/api/job-controller/tests/model.client.spec.ts
new file mode 100644
index 0000000000..1c56724a26
--- /dev/null
+++ b/packages/api/job-controller/tests/model.client.spec.ts
@@ -0,0 +1,567 @@
+import { describe, expect, it, vi } from 'vitest'
+import { Context } from '@deepseek-ai/cordis'
+import type { JobId } from '@deepseek-ai/dsh-jobs/brand'
+import type { SessionId } from '@deepseek-ai/dsh-session/types'
+import { ClientJobsModel } from '../src/client/model.ts'
+import { ClientJobs } from '../src/client/service.ts'
+import type { JobFollowFrame, JobListFrame, JobView } from '../src/types.ts'
+
+const ID = 'bash-1' as JobId
+const S1 = 'alice' as SessionId
+const S2 = 'bob' as SessionId
+
+function view(over: Partial<JobView> = {}): JobView {
+  return {
+    id: ID, kind: 'bash', label: 'pnpm run build', status: 'running', startedAt: 5,
+    output: { total: 0, earliest: 0 },
+    ...over,
+  }
+}
+
+function opened(model: ClientJobsModel, over: Partial<{ from: number; earliest: number; total: number }> = {}): void {
+  model.observeOpened(ID, {
+    type: 'opened',
+    job: view({ output: { total: over.total ?? 0, earliest: over.earliest ?? 0 } }),
+    from: over.from ?? 0,
+  })
+}
+
+describe('ClientJobsModel rows', () => {
+  it('replaces a session roster whole, stores an empty set as absence, and drops on release', () => {
+    const model = new ClientJobsModel()
+    let notified = 0
+    model.subscribe(() => { notified += 1 })
+    model.rowsReplaced(S1, [view()])
+    model.rowsReplaced(S2, [view({ id: 'pwsh-1' as JobId, label: 'other' })])
+    expect(model.getSnapshot().rows[S1]).toEqual([view()])
+    expect(model.getSnapshot().rows[S2]?.[0]?.label).toBe('other')
+
+    // Last-wins: the newer whole set replaces, it does not merge.
+    model.rowsReplaced(S1, [view({ status: 'completed' })])
+    expect(model.getSnapshot().rows[S1]).toEqual([view({ status: 'completed' })])
+    expect(notified).toBe(3)
+
+    model.rowsReplaced(S1, [])
+    expect(S1 in model.getSnapshot().rows).toBe(false)
+    // An empty set over an absent key changes nothing.
+    model.rowsReplaced(S1, [])
+    expect(notified).toBe(4)
+
+    model.rowsDropped(S2)
+    expect(model.getSnapshot().rows).toEqual({})
+    model.rowsDropped(S2)
+    expect(notified).toBe(5)
+  })
+})
+
+describe('ClientJobsModel observation', () => {
+  it('accumulates output, advances the resume cursor, and closes on settlement', () => {
+    const model = new ClientJobsModel()
+    opened(model)
+    expect(model.cursorOf(ID)).toBe(0)
+    model.observeOutput(ID, { type: 'output', chunks: [{ at: 0, text: 'a' }, { at: 1, text: 'b' }], next: 2 })
+    model.observeOutput(ID, { type: 'output', chunks: [{ at: 2, text: 'c' }], next: 3 })
+    expect(model.cursorOf(ID)).toBe(3)
+    const live = model.getSnapshot().observed[String(ID)]
+    expect(live?.text).toBe('abc')
+    expect(live?.streaming).toBe(true)
+    model.observeSettled(ID)
+    expect(model.getSnapshot().observed[String(ID)]?.streaming).toBe(false)
+  })
+
+  it('keeps snapshot identity stable between changes and notifies subscribers', () => {
+    const model = new ClientJobsModel()
+    let notified = 0
+    const unsubscribe = model.subscribe(() => { notified += 1 })
+    const before = model.getSnapshot()
+    expect(model.getSnapshot()).toBe(before)
+    opened(model)
+    expect(notified).toBe(1)
+    expect(model.getSnapshot()).not.toBe(before)
+    unsubscribe()
+    model.observeStopped(ID)
+    expect(notified).toBe(1)
+  })
+
+  it('marks gaps from lossy frames, gap chunks, and a resume behind the retained head', () => {
+    const model = new ClientJobsModel()
+    opened(model, { from: 4, earliest: 8, total: 10 })
+    expect(model.getSnapshot().observed[String(ID)]?.gapBefore).toBe(true)
+
+    const clean = new ClientJobsModel()
+    opened(clean)
+    clean.observeOutput(ID, { type: 'output', chunks: [{ at: 0, text: 'x', gapBefore: true }], next: 1 })
+    expect(clean.getSnapshot().observed[String(ID)]?.gapBefore).toBe(true)
+
+    const lossy = new ClientJobsModel()
+    opened(lossy)
+    lossy.observeOutput(ID, { type: 'output', chunks: [], next: 5, lossy: true })
+    expect(lossy.getSnapshot().observed[String(ID)]?.gapBefore).toBe(true)
+  })
+
+  it('marks a fresh observation anchored past the evicted head', () => {
+    // Fresh observations anchor at the registry's earliest retained byte, so
+    // from === earliest > 0 means the head was already discarded.
+    const fresh = new ClientJobsModel()
+    opened(fresh, { from: 60_240, earliest: 60_240, total: 321_328 })
+    expect(fresh.getSnapshot().observed[String(ID)]?.gapBefore).toBe(true)
+
+    // A retry that accumulated no text yet earns the mark the same way.
+    const retried = new ClientJobsModel()
+    opened(retried)
+    expect(retried.getSnapshot().observed[String(ID)]?.gapBefore).toBe(false)
+    opened(retried, { from: 6, earliest: 6, total: 6 })
+    expect(retried.getSnapshot().observed[String(ID)]?.gapBefore).toBe(true)
+  })
+
+  it('bounds the render tail without splitting a surrogate pair', () => {
+    const model = new ClientJobsModel()
+    opened(model)
+    const emoji = '😀'.repeat((64 * 1024) + 8)
+    model.observeOutput(ID, { type: 'output', chunks: [{ at: 0, text: emoji }], next: emoji.length * 2 })
+    const live = model.getSnapshot().observed[String(ID)]
+    expect(live?.gapBefore).toBe(true)
+    expect(live!.text.length).toBeLessThanOrEqual(128 * 1024)
+    // The bound landed between pairs: the surviving text still round-trips.
+    expect(/^(?:😀)+$/u.test(live!.text)).toBe(true)
+  })
+
+  it('trims a plain-ASCII tail without a boundary shift', () => {
+    const model = new ClientJobsModel()
+    opened(model)
+    const long = 'x'.repeat((128 * 1024) + 5)
+    model.observeOutput(ID, { type: 'output', chunks: [{ at: 0, text: long }], next: long.length })
+    const live = model.getSnapshot().observed[String(ID)]
+    expect(live?.text.length).toBe(128 * 1024)
+    expect(live?.gapBefore).toBe(true)
+  })
+
+  it('advances the cut past a low surrogate landing exactly on the bound', () => {
+    const model = new ClientJobsModel()
+    opened(model)
+    // 'z' + one emoji + odd ASCII tail puts a low surrogate exactly at the cut index.
+    const text = 'z😀' + 'a'.repeat((128 * 1024) - 1)
+    model.observeOutput(ID, { type: 'output', chunks: [{ at: 0, text }], next: text.length })
+    const live = model.getSnapshot().observed[String(ID)]
+    expect(live?.text.length).toBe((128 * 1024) - 1)
+    expect(live?.text.startsWith('a')).toBe(true)
+  })
+
+  it('preserves accumulated text across a reconnect anchor and clears on stop', () => {
+    const model = new ClientJobsModel()
+    opened(model)
+    model.observeOutput(ID, { type: 'output', chunks: [{ at: 0, text: 'kept' }], next: 4 })
+    opened(model, { from: 4, earliest: 0, total: 4 })
+    expect(model.getSnapshot().observed[String(ID)]?.text).toBe('kept')
+    model.observeStopped(ID)
+    expect(model.getSnapshot().observed[String(ID)]).toBeUndefined()
+    expect(model.cursorOf(ID)).toBeUndefined()
+    // A second stop is inert.
+    model.observeStopped(ID)
+  })
+
+  it('records a terminal stream failure on the live view, or on a fresh view before the anchor', () => {
+    const model = new ClientJobsModel()
+    opened(model)
+    model.observeFailed(ID, new Error('carrier gone'))
+    const live = model.getSnapshot().observed[String(ID)]
+    expect(live?.streaming).toBe(false)
+    expect(live?.error).toContain('carrier gone')
+    // A failure before any anchor still surfaces: the panel gets the notice on
+    // an empty, non-streaming view, and a retry anchors from no cursor.
+    model.observeFailed('bash-9' as JobId, new Error('ended before its anchor'))
+    const early = model.getSnapshot().observed['bash-9']
+    expect(early).toMatchObject({ jobId: 'bash-9', text: '', gapBefore: false, streaming: false })
+    expect(early?.error).toContain('ended before its anchor')
+    expect(model.cursorOf('bash-9' as JobId)).toBeUndefined()
+  })
+})
+
+/** One scripted logical stream: frames are pushed by the test, never reopened. */
+class FakeStream<Frame> {
+  disposed = false
+  /** Model a carrier whose disposal surfaces as an iterator throw. */
+  throwOnDispose = false
+  /** Hold the dispose promise open until {@link releaseDispose}. */
+  deferDispose = false
+  private disposeRelease: (() => void) | undefined
+  private disposePending: Promise<void> | undefined
+  private readonly frames: Frame[] = []
+  private waiter: (() => void) | undefined
+  private failure: Error | undefined
+  readonly accepts: number[] = []
+
+  push(frame: Frame): void {
+    this.frames.push(frame)
+    this.waiter?.()
+  }
+
+  poison(error: Error): void {
+    this.failure = error
+    this.waiter?.()
+  }
+
+  dispose(): Promise<void> {
+    if (this.throwOnDispose && this.failure === undefined) {
+      this.failure = new Error('carrier tore down')
+    } else {
+      this.disposed = true
+    }
+    this.waiter?.()
+    if (this.deferDispose) {
+      // Repeat disposals (releaser plus the consumer's finally) share one
+      // deferred promise, so releaseDispose resumes every waiter.
+      this.disposePending ??= new Promise((resolve) => { this.disposeRelease = resolve })
+      return this.disposePending
+    }
+    return Promise.resolve()
+  }
+
+  releaseDispose(): void {
+    this.disposeRelease?.()
+  }
+
+  async *[Symbol.asyncIterator]() {
+    let generation = 1
+    while (!this.disposed) {
+      if (this.failure !== undefined) throw this.failure
+      const frame = this.frames.shift()
+      if (frame === undefined) {
+        await new Promise<void>((resolve) => { this.waiter = resolve })
+        continue
+      }
+      yield {
+        generation,
+        value: frame,
+        signal: new AbortController().signal,
+        accept: () => { this.accepts.push(generation) },
+      }
+      generation = 1
+    }
+  }
+}
+
+interface StreamOptions {
+  name: string
+  open: (signal: AbortSignal) => unknown
+  ended: (accepted: boolean) => Error
+}
+
+function bench() {
+  const ctx = new Context()
+  const model = new ClientJobsModel()
+  const streams: { options: StreamOptions; stream: FakeStream<JobFollowFrame> & FakeStream<JobListFrame> }[] = []
+  const observeCalls: unknown[] = []
+  const rowsCalls: unknown[] = []
+  const remote = {
+    $stream: (options: StreamOptions) => {
+      const stream = new FakeStream<never>()
+      streams.push({ options, stream })
+      return stream
+    },
+    job: {
+      follow: (request: unknown) => {
+        observeCalls.push(request)
+        return { [Symbol.asyncIterator]: async function* () { /* never yields */ } }
+      },
+      list: (request: unknown) => {
+        rowsCalls.push(request)
+        return { [Symbol.asyncIterator]: async function* () { /* never yields */ } }
+      },
+    },
+  }
+  const jobs = new ClientJobs(ctx, remote as never, model)
+  return { ctx, model, jobs, streams, observeCalls, rowsCalls }
+}
+
+const tick = () => new Promise<void>(resolve => setTimeout(resolve, 0))
+const anchor = (): JobFollowFrame => ({ type: 'opened', job: view(), from: 0 })
+
+describe('ClientJobs roster streams', () => {
+  it('shares one roster stream per session and drops the rows after the last release', async () => {
+    const { model, jobs, streams, rowsCalls } = bench()
+    const first = jobs.watchRows(S1)
+    const second = jobs.watchRows(S1)
+    jobs.watchRows(S2)
+    expect(streams.map(entry => entry.options.name)).toEqual(['job rows alice', 'job rows bob'])
+    streams[0]!.options.open(new AbortController().signal)
+    expect(rowsCalls.at(-1)).toEqual({ sessionId: 'alice' })
+
+    const { stream } = streams[0]!
+    stream.push({ type: 'rows', jobs: [view()] })
+    await tick()
+    expect(model.getSnapshot().rows[S1]).toEqual([view()])
+    expect(stream.accepts).toHaveLength(1)
+    stream.push({ type: 'rows', jobs: [view({ status: 'completed' })] })
+    await tick()
+    expect(model.getSnapshot().rows[S1]?.[0]?.status).toBe('completed')
+
+    first()
+    first()
+    expect(stream.disposed).toBe(false)
+    second()
+    await tick()
+    expect(stream.disposed).toBe(true)
+    expect(S1 in model.getSnapshot().rows).toBe(false)
+    expect(streams[1]!.stream.disposed).toBe(false)
+  })
+
+  it('classifies a roster end as retryable only after the first frame', () => {
+    const { jobs, streams } = bench()
+    jobs.watchRows(S1)
+    const { options } = streams[0]!
+    expect(options.ended(true).name).toBe('RemoteStreamCarrierError')
+    expect(options.ended(false).name).toBe('Error')
+  })
+
+  it('drops the roster on a terminal stream failure', async () => {
+    const { model, jobs, streams } = bench()
+    jobs.watchRows(S1)
+    const { stream } = streams[0]!
+    stream.push({ type: 'rows', jobs: [view()] })
+    await tick()
+    expect(model.getSnapshot().rows[S1]).toBeDefined()
+    stream.poison(new Error('frame decode broke'))
+    await tick()
+    expect(S1 in model.getSnapshot().rows).toBe(false)
+  })
+
+  it('stays silent when the carrier teardown itself throws after the last release', async () => {
+    const { model, jobs, streams } = bench()
+    const stop = jobs.watchRows(S1)
+    const { stream } = streams[0]!
+    stream.throwOnDispose = true
+    stream.push({ type: 'rows', jobs: [view()] })
+    await tick()
+    // The releaser drops the rows and marks the entry stopped, then its
+    // dispose surfaces as an iterator throw — which the consumer swallows for
+    // a stopped entry instead of dropping twice or failing loud.
+    stop()
+    await tick()
+    expect(model.getSnapshot().rows).toEqual({})
+  })
+
+  it('a re-watch inside the dispose round-trip keeps its fresh rows', async () => {
+    const { model, jobs, streams } = bench()
+    const stop = jobs.watchRows(S1)
+    const first = streams[0]!.stream
+    first.deferDispose = true
+    first.push({ type: 'rows', jobs: [view()] })
+    await tick()
+
+    stop()
+    // Re-watch while the previous generation's dispose is still in flight.
+    jobs.watchRows(S1)
+    const second = streams[1]!.stream
+    second.push({ type: 'rows', jobs: [view({ label: 'fresh' })] })
+    await tick()
+
+    first.releaseDispose()
+    await tick()
+    // The stale post-dispose clear must not blank the successor's rows.
+    expect(model.getSnapshot().rows[S1]?.[0]?.label).toBe('fresh')
+  })
+})
+
+describe('ClientJobs observation streams', () => {
+  it('feeds anchor, output, and terminal frames into the model, then closes', async () => {
+    const { model, jobs, streams } = bench()
+    jobs.observe(undefined, ID)
+    const { stream } = streams[0]!
+    expect(streams[0]!.options.name).toBe('job observation bash-1')
+    stream.push(anchor())
+    stream.push({ type: 'output', chunks: [{ at: 0, text: 'hi' }], next: 2 })
+    await tick()
+    expect(model.getSnapshot().observed[String(ID)]?.text).toBe('hi')
+    expect(stream.accepts).toHaveLength(1)
+
+    stream.push({ type: 'status', job: view({ status: 'completed' }) })
+    await tick()
+    expect(model.getSnapshot().observed[String(ID)]?.streaming).toBe(false)
+    expect(stream.disposed).toBe(true)
+  })
+
+  it('shares one stream across observers and stops after the last release', async () => {
+    const { model, jobs, streams } = bench()
+    const first = jobs.observe(undefined, ID)
+    const second = jobs.observe(undefined, ID)
+    expect(streams).toHaveLength(1)
+    streams[0]!.stream.push(anchor())
+    await tick()
+
+    first()
+    first()
+    expect(streams[0]!.stream.disposed).toBe(false)
+    second()
+    await tick()
+    expect(streams[0]!.stream.disposed).toBe(true)
+    expect(model.getSnapshot().observed[String(ID)]).toBeUndefined()
+  })
+
+  it('a late release of a superseded observation neither tears down nor clears its successor', async () => {
+    const { model, jobs, streams } = bench()
+    const firstStop = jobs.observe(undefined, ID)
+    const first = streams[0]!.stream
+    first.push(anchor())
+    first.push({ type: 'status', job: view({ status: 'completed' }) })
+    await tick()
+    // A successor observation replaces the settled entry while the first
+    // observer still holds its releaser.
+    const secondStop = jobs.observe(undefined, ID)
+    const second = streams[1]!.stream
+    second.push(anchor())
+    await tick()
+
+    firstStop()
+    await tick()
+    expect(second.disposed).toBe(false)
+    expect(model.getSnapshot().observed[String(ID)]).toBeDefined()
+
+    secondStop()
+    await tick()
+    expect(second.disposed).toBe(true)
+    expect(model.getSnapshot().observed[String(ID)]).toBeUndefined()
+  })
+
+  it('a re-observation inside the dispose round-trip keeps its fresh view', async () => {
+    const { model, jobs, streams } = bench()
+    const stop = jobs.observe(undefined, ID)
+    const first = streams[0]!.stream
+    first.deferDispose = true
+    first.push(anchor())
+    await tick()
+
+    stop()
+    // Re-expand while the previous generation's dispose is still in flight.
+    jobs.observe(undefined, ID)
+    const second = streams[1]!.stream
+    second.push(anchor())
+    await tick()
+
+    first.releaseDispose()
+    await tick()
+    // The stale post-dispose clear must not blank the successor's view.
+    expect(model.getSnapshot().observed[String(ID)]).toBeDefined()
+    second.push({ type: 'output', chunks: [{ at: 0, text: 'alive' }], next: 5 })
+    await tick()
+    expect(model.getSnapshot().observed[String(ID)]?.text).toBe('alive')
+  })
+
+  it('opens a fresh stream for a re-observed job and resumes from the model cursor', async () => {
+    const { jobs, streams, observeCalls, model } = bench()
+    const stop = jobs.observe(S1, ID)
+    streams[0]!.stream.push(anchor())
+    streams[0]!.stream.push({ type: 'output', chunks: [{ at: 0, text: 'abc' }], next: 3 })
+    await tick()
+    // The generation opener reads the live cursor at open time and carries the
+    // fenced-read session.
+    streams[0]!.options.open(new AbortController().signal)
+    expect(observeCalls.at(-1)).toEqual({ jobId: ID, sessionId: 'alice', from: 3 })
+
+    stop()
+    await tick()
+    jobs.observe(undefined, ID)
+    expect(streams).toHaveLength(2)
+    streams[1]!.options.open(new AbortController().signal)
+    // Stopped observation dropped the cursor: the fresh stream starts unanchored.
+    expect(observeCalls.at(-1)).toEqual({ jobId: ID })
+    expect(model.cursorOf(ID)).toBeUndefined()
+  })
+
+  it('classifies a premature end as retryable only after the anchor', () => {
+    const { jobs, streams } = bench()
+    jobs.observe(undefined, ID)
+    const { options } = streams[0]!
+    expect(options.ended(true).name).toBe('RemoteStreamCarrierError')
+    expect(options.ended(false).name).toBe('Error')
+  })
+
+  it('records a consumer failure on the live view', async () => {
+    const { model, jobs, streams } = bench()
+    jobs.observe(undefined, ID)
+    const { stream } = streams[0]!
+    stream.push(anchor())
+    await tick()
+    stream.poison(new Error('frame decode broke'))
+    await tick()
+    const live = model.getSnapshot().observed[String(ID)]
+    expect(live?.error).toContain('frame decode broke')
+    expect(live?.streaming).toBe(false)
+  })
+
+  it('treats a release after service disposal as inert and stays silent for post-stop failures', async () => {
+    const { ctx, model, jobs, streams } = bench()
+    const stop = jobs.observe(undefined, ID)
+    const { stream } = streams[0]!
+    stream.push(anchor())
+    await tick()
+    // Poison wakes the consumer, but the synchronous stop lands first, so the
+    // failure arrives on an already-stopped entry and stays silent.
+    stream.poison(new Error('after stop'))
+    stop()
+    await tick()
+    expect(model.getSnapshot().observed[String(ID)]).toBeUndefined()
+
+    const second = jobs.observe(undefined, ID)
+    await ctx.fiber.dispose()
+    // The disposal path already removed every entry; a live releaser whose
+    // entry is gone is inert.
+    second()
+  })
+
+  it('stays silent when the carrier teardown itself throws after a stop', async () => {
+    const { model, jobs, streams } = bench()
+    const stop = jobs.observe(undefined, ID)
+    const { stream } = streams[0]!
+    stream.throwOnDispose = true
+    stream.push(anchor())
+    await tick()
+    // The releaser marks the entry stopped, then its dispose surfaces as an
+    // iterator throw — which the consumer swallows for a stopped entry.
+    stop()
+    await tick()
+    expect(model.getSnapshot().observed[String(ID)]?.error).toBeUndefined()
+  })
+
+  it('holds service disposal until every open stream reports quiescence', async () => {
+    const { ctx, jobs, streams } = bench()
+    jobs.watchRows(S1)
+    jobs.observe(undefined, ID)
+    for (const { stream } of streams) stream.deferDispose = true
+    await tick()
+
+    let settled = false
+    const disposal = ctx.fiber.dispose().then(() => { settled = true })
+    await tick()
+    // Both carriers were told to stop, but neither iterator has closed yet:
+    // the fiber must still be unloading, or a successor plugin instance could
+    // overlap the old generation's iterator.
+    expect(streams.every(entry => entry.stream.disposed)).toBe(true)
+    expect(settled).toBe(false)
+
+    streams[0]!.stream.releaseDispose()
+    await tick()
+    expect(settled).toBe(false)
+    streams[1]!.stream.releaseDispose()
+    await disposal
+    expect(settled).toBe(true)
+  })
+
+  it('records a terminal stream failure and service disposal closes live streams', async () => {
+    const { ctx, model, jobs, streams } = bench()
+    jobs.observe(undefined, ID)
+    const failing = streams[0]!.stream
+    failing.push(anchor())
+    await tick()
+    // Simulate a terminal consumer failure by disposing the underlying stream:
+    // the consumer loop ends without a status frame and cleans up.
+    const spy = vi.spyOn(model, 'observeFailed')
+    await failing.dispose()
+    await tick()
+
+    jobs.observe(undefined, 'bash-2' as JobId)
+    await ctx.fiber.dispose()
+    expect(streams.every(entry => entry.stream.disposed)).toBe(true)
+    expect(spy).not.toHaveBeenCalled()
+  })
+})
diff --git a/packages/api/job-controller/tests/observe.host.spec.ts b/packages/api/job-controller/tests/observe.host.spec.ts
new file mode 100644
index 0000000000..583862eeac
--- /dev/null
+++ b/packages/api/job-controller/tests/observe.host.spec.ts
@@ -0,0 +1,305 @@
+import { describe, expect, it } from 'vitest'
+import { Context } from '@deepseek-ai/cordis'
+import AgentRegistry from '@deepseek-ai/dsh-agent'
+import { unsupportedInbox } from '@deepseek-ai/dsh-agent-loop-testkit'
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import { JobId } from '@deepseek-ai/dsh-jobs'
+import LocalJobRegistry from '@deepseek-ai/dsh-jobs-local'
+import SessionStore, { SessionId } from '@deepseek-ai/dsh-session'
+import TypertRegistry from '@deepseek-ai/dsh-typert-registry'
+import { JobController } from '../src/index.ts'
+import { observeJobOutput } from '../src/observe.ts'
+import type { ObserveJobOptions } from '../src/observe.ts'
+import type { JobFollowFrame } from '../src/types.ts'
+import { collect, harness, next, registerAgent, startJob, wait } from './host-harness.ts'
+
+const OBSERVE: ObserveJobOptions = { flushMs: 5, maxFrameBytes: 1024 }
+
+describe('observeJobOutput', () => {
+  function observed(ctx: Context, request: { jobId: JobId; sessionId?: SessionId; from?: number }) {
+    const abort = new AbortController()
+    const frames: JobFollowFrame[] = []
+    const stream = observeJobOutput(ctx.jobs, request, OBSERVE, abort.signal)
+    const done = (async () => {
+      for await (const frame of stream) frames.push(frame)
+    })()
+    return { abort, frames, done }
+  }
+
+  it('anchors, streams coalesced output, and closes with the terminal projection', async () => {
+    const ctx = await harness()
+    const job = startJob(ctx)
+    job.append('early ')
+    const { frames, done } = observed(ctx, { jobId: job.id })
+    await wait(20)
+    job.append('live', { channel: 'stderr' })
+    await wait(20)
+    await job.settle({ status: 'completed', detail: 'exit code: 0' })
+    await done
+
+    expect(frames[0]).toMatchObject({
+      type: 'opened',
+      from: 0,
+      job: { id: job.id, status: 'running', output: { earliest: 0, total: 6 } },
+    })
+    const outputs = frames.filter(frame => frame.type === 'output')
+    const text = outputs.flatMap(frame => frame.chunks.map(chunk => chunk.text)).join('')
+    expect(text).toBe('early live')
+    expect(outputs.at(-1)?.next).toBe(10)
+    expect(outputs.flatMap(frame => frame.chunks).find(chunk => chunk.text === 'live')?.channel).toBe('stderr')
+    expect(frames.at(-1)).toMatchObject({
+      type: 'status',
+      job: { status: 'completed', detail: 'exit code: 0', output: { total: 10 } },
+    })
+  })
+
+  it('resumes from an explicit offset and flags an evicted resume lossy', async () => {
+    const ctx = await harness()
+    const job = startJob(ctx, { label: 'spam' })
+    job.append('a'.repeat(60))
+    job.append('b'.repeat(60))
+    await job.settle({ status: 'completed' })
+
+    const fresh = observed(ctx, { jobId: job.id, from: 0 })
+    await fresh.done
+    const output = fresh.frames.find(frame => frame.type === 'output')
+    expect(output?.lossy).toBe(true)
+    expect(output?.chunks.map(chunk => chunk.text).join('')).toBe('b'.repeat(60))
+
+    const resumed = observed(ctx, { jobId: job.id, from: 120 })
+    await resumed.done
+    expect(resumed.frames.some(frame => frame.type === 'output')).toBe(false)
+    expect(resumed.frames.at(-1)?.type).toBe('status')
+  })
+
+  it('splits oversized reads along the frame budget', async () => {
+    const ctx = await harness()
+    const job = startJob(ctx, { label: 'wide' })
+    job.append('x'.repeat(30))
+    job.append('y'.repeat(30))
+    await job.settle({ status: 'completed' })
+    const abort = new AbortController()
+    const frames = await collect<JobFollowFrame>(
+      observeJobOutput(ctx.jobs, { jobId: job.id }, { flushMs: 5, maxFrameBytes: 30 }, abort.signal),
+      5,
+      abort,
+    )
+    const outputs = frames.filter(frame => frame.type === 'output')
+    expect(outputs).toHaveLength(2)
+    expect(outputs[0]?.next).toBe(30)
+    expect(outputs[1]?.next).toBe(60)
+  })
+
+  it('carries the lossy flag on the first frame of a split evicted read', async () => {
+    const ctx = await harness()
+    const job = startJob(ctx, { label: 'evicted split' })
+    job.append('a'.repeat(40))
+    job.append('b'.repeat(40))
+    job.append('c'.repeat(40))
+    await job.settle({ status: 'completed' })
+    const abort = new AbortController()
+    const frames = await collect<JobFollowFrame>(
+      observeJobOutput(ctx.jobs, { jobId: job.id, from: 0 }, { flushMs: 5, maxFrameBytes: 40 }, abort.signal),
+      5,
+      abort,
+    )
+    const outputs = frames.filter(frame => frame.type === 'output')
+    expect(outputs[0]?.lossy).toBe(true)
+    expect(outputs[1]?.lossy).toBeUndefined()
+  })
+
+  it('reads owned output through the request session and rejects foreign, bad, and unknown input', async () => {
+    const ctx = await harness()
+    const owner = await registerAgent(ctx, 'alice')
+    const job = startJob(ctx, { label: 'secret', owner: owner.id })
+    job.append('classified')
+    await job.settle({ status: 'completed' })
+
+    const { frames, done } = observed(ctx, { jobId: job.id, sessionId: owner.id })
+    await done
+    expect(frames.some(frame => frame.type === 'output'
+      && frame.chunks.some(chunk => chunk.text === 'classified'))).toBe(true)
+
+    const foreign = new AbortController()
+    await expect(collect(
+      observeJobOutput(ctx.jobs, { jobId: job.id }, OBSERVE, foreign.signal),
+      1,
+      foreign,
+    )).rejects.toThrow(/belongs to another session/)
+
+    const abort = new AbortController()
+    await expect(collect(
+      observeJobOutput(ctx.jobs, { jobId: job.id, sessionId: owner.id, from: -1 }, OBSERVE, abort.signal),
+      1,
+      abort,
+    )).rejects.toThrow(/invalid observe offset/)
+
+    const abortUnknown = new AbortController()
+    await expect(collect(
+      observeJobOutput(ctx.jobs, { jobId: JobId('bash-999') }, OBSERVE, abortUnknown.signal),
+      1,
+      abortUnknown,
+    )).rejects.toThrow(/unknown job/)
+  })
+
+  it('anchors with the live progress and takes the fast wait path for a wake that lands mid-yield', async () => {
+    const ctx = await harness()
+    const job = startJob(ctx)
+    job.progress('3/10')
+    const abort = new AbortController()
+    const iterator = observeJobOutput(ctx.jobs, { jobId: job.id }, OBSERVE, abort.signal)[Symbol.asyncIterator]()
+
+    const anchor = await iterator.next()
+    expect(anchor.value).toMatchObject({ type: 'opened', job: { progress: '3/10' } })
+    // Both chunks land while the generator is suspended on a yield, so each
+    // wake precedes the loop's wait(): draining the first chunk must pass
+    // through the already-woken fast path to read the second.
+    job.append('woken')
+    const first = await iterator.next()
+    expect(first.value).toMatchObject({ type: 'output' })
+    job.append('again')
+    const second = await iterator.next()
+    expect(second.value).toMatchObject({ type: 'output' })
+    const pending = iterator.next()
+    await job.settle({ status: 'completed' })
+    const status = await pending
+    expect(status.value).toMatchObject({ type: 'status', job: { status: 'completed' } })
+    expect((await iterator.next()).done).toBe(true)
+  })
+
+  it('ignores output signals for other jobs while waiting', async () => {
+    const ctx = await harness()
+    const watched = startJob(ctx, { label: 'watched' })
+    const noisy = startJob(ctx, { label: 'noisy' })
+    const { abort, frames, done } = observed(ctx, { jobId: watched.id })
+    await wait(15)
+    noisy.append('unrelated')
+    await wait(15)
+    await watched.settle({ status: 'completed' })
+    await done
+    abort.abort()
+    expect(frames.filter(frame => frame.type === 'output')).toEqual([])
+    await noisy.settle({ status: 'completed' })
+  })
+
+  it("closes with the removed job's terminal projection when the owner's teardown drops it mid-observation", async () => {
+    const ctx = await harness()
+    const owner = await registerAgent(ctx, 'observer-owner')
+    const job = startJob(ctx, { label: 'torn down', owner: owner.id })
+    job.append('partial')
+    const { frames, done } = observed(ctx, { jobId: job.id, sessionId: owner.id })
+    await wait(20)
+    // Teardown cancels, settles, and removes the record within one microtask
+    // chain; the generation wakes on the removal and closes without a read.
+    await owner.disposeScope()
+    await done
+    expect(frames.map(frame => frame.type)).toEqual(['opened', 'output', 'status'])
+    expect(frames.at(-1)).toMatchObject({ type: 'status', job: { id: job.id, status: 'killed' } })
+    expect(() => ctx.jobs.get(job.id, owner.id)).toThrow(/unknown job/)
+  })
+
+  it('stops cleanly on abort while waiting for output', async () => {
+    const ctx = await harness()
+    const job = startJob(ctx, { label: 'idle' })
+    const { abort, frames, done } = observed(ctx, { jobId: job.id })
+    await wait(20)
+    abort.abort()
+    await done
+    expect(frames[0]?.type).toBe('opened')
+    expect(frames.at(-1)?.type).not.toBe('status')
+    await job.settle({ status: 'completed' })
+  })
+})
+
+describe('JobController', () => {
+  async function controllerHarness() {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    await ctx.plugin(AgentRegistry)
+    await ctx.plugin(LocalJobRegistry)
+    await ctx.plugin(TypertRegistry)
+    ctx.jobs.attachController('job-controller-test')
+    await ctx.plugin(JobController, {})
+    return ctx
+  }
+
+  async function liveOwner(ctx: Context, rawId: string): Promise<Agent> {
+    const session = ctx.sessions.create(SessionId(rawId))
+    const owner: Agent = {
+      id: session.id,
+      options: {},
+      session,
+      inbox: unsupportedInbox(),
+      status: 'idle',
+      ctx,
+      send: () => {},
+      followup: () => {},
+      steer: () => {},
+      inject: () => {},
+      cancel: () => {},
+      runMaintenance: task => task(new AbortController().signal),
+      whenIdle: () => Promise.resolve(),
+    }
+    await ctx.agents.register(owner)
+    return owner
+  }
+
+  it('waits for the job registry instead of serving without one', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    await ctx.plugin(AgentRegistry)
+    await ctx.plugin(TypertRegistry)
+    ctx.plugin(JobController, {})
+    await new Promise(resolve => setTimeout(resolve, 0))
+    expect(ctx.get('jobController')).toBeUndefined()
+  })
+
+  it('observe reads an owned job through the request session', async () => {
+    const ctx = await controllerHarness()
+    const owner = await liveOwner(ctx, 'observing-session')
+    const job = startJob(ctx, { label: 'owned run', owner: owner.id })
+    job.append('hi')
+    await job.settle({ status: 'completed' })
+
+    const abort = new AbortController()
+    const frames = await collect<JobFollowFrame>(
+      ctx.jobController.follow({ sessionId: owner.id, jobId: job.id }, abort.signal),
+      3,
+      abort,
+    )
+    expect(frames.map(frame => frame.type)).toEqual(['opened', 'output', 'status'])
+  })
+
+  it('observes an unowned job without a request session', async () => {
+    const ctx = await controllerHarness()
+    const job = startJob(ctx, { label: 'unowned run' })
+    job.append('open access')
+    await job.settle({ status: 'completed' })
+
+    const abort = new AbortController()
+    const frames = await collect<JobFollowFrame>(
+      ctx.jobController.follow({ jobId: job.id }, abort.signal),
+      3,
+      abort,
+    )
+    expect(frames.map(frame => frame.type)).toEqual(['opened', 'output', 'status'])
+  })
+
+  it('rows mirrors the session-visible set and follows a settlement', async () => {
+    const ctx = await controllerHarness()
+    const owner = await liveOwner(ctx, 'listing-session')
+    const owned = startJob(ctx, { label: 'owned', owner: owner.id })
+    startJob(ctx, { label: 'shared' })
+
+    const abort = new AbortController()
+    const iterator = ctx.jobController.list({ sessionId: owner.id }, abort.signal)[Symbol.asyncIterator]()
+    const first = await next(iterator)
+    expect(first?.jobs.map(job => job.label)).toEqual(['owned', 'shared'])
+    const pending = next(iterator)
+    await owned.settle({ status: 'completed', detail: 'exit code: 0' })
+    const second = await pending
+    expect(second?.jobs.find(job => job.id === owned.id)).toMatchObject({ status: 'completed', detail: 'exit code: 0' })
+    abort.abort()
+    expect(await next(iterator)).toBeUndefined()
+  })
+})
diff --git a/packages/api/job-controller/tests/rows.host.spec.ts b/packages/api/job-controller/tests/rows.host.spec.ts
new file mode 100644
index 0000000000..48bb30aedc
--- /dev/null
+++ b/packages/api/job-controller/tests/rows.host.spec.ts
@@ -0,0 +1,89 @@
+import { describe, expect, it } from 'vitest'
+import { streamJobRows } from '../src/rows.ts'
+import { harness, next, registerAgent, startJob, wait } from './host-harness.ts'
+
+const ROWS = { flushMs: 5 }
+
+describe('streamJobRows', () => {
+  it('opens with the visible set and re-sends it after each coalesced lifecycle burst', async () => {
+    const ctx = await harness()
+    const alice = await registerAgent(ctx, 'alice')
+    const bob = await registerAgent(ctx, 'bob')
+    startJob(ctx, { label: 'shared' })
+    const mine = startJob(ctx, { label: 'mine', owner: alice.id })
+    startJob(ctx, { label: 'theirs', owner: bob.id })
+
+    const abort = new AbortController()
+    const iterator = streamJobRows(ctx.jobs, { sessionId: alice.id }, ROWS, abort.signal)[Symbol.asyncIterator]()
+    const first = await next(iterator)
+    expect(first?.jobs.map(job => job.label)).toEqual(['shared', 'mine'])
+
+    // Another owner's lifecycle and this job's own output never wake the roster;
+    // the next frame is the one the settlement earns, and it carries the final
+    // byte count without a frame per append.
+    startJob(ctx, { label: 'theirs too', owner: bob.id })
+    mine.append('progress bytes')
+    await wait(20)
+    const pending = next(iterator)
+    await mine.settle({ status: 'completed', detail: 'exit code: 0' })
+    const second = await pending
+    expect(second?.jobs.map(job => job.label)).toEqual(['shared', 'mine'])
+    expect(second?.jobs[1]).toMatchObject({ status: 'completed', detail: 'exit code: 0', output: { total: 14 } })
+    abort.abort()
+    expect(await next(iterator)).toBeUndefined()
+  })
+
+  it('follows progress, stopping, and registration commits', async () => {
+    const ctx = await harness()
+    const alice = await registerAgent(ctx, 'alice')
+    const job = startJob(ctx, { label: 'first', owner: alice.id, slowStop: true })
+    const abort = new AbortController()
+    const iterator = streamJobRows(ctx.jobs, { sessionId: alice.id }, ROWS, abort.signal)[Symbol.asyncIterator]()
+    await next(iterator)
+
+    job.progress('3/10')
+    expect((await next(iterator))?.jobs[0]).toMatchObject({ progress: '3/10' })
+    ctx.jobs.kill(job.id, alice.id, 'enough')
+    expect((await next(iterator))?.jobs[0]).toMatchObject({ status: 'stopping', progress: '3/10' })
+    startJob(ctx, { label: 'second', owner: alice.id })
+    expect((await next(iterator))?.jobs.map(entry => entry.label)).toEqual(['first', 'second'])
+    abort.abort()
+    expect(await next(iterator)).toBeUndefined()
+    await job.settle({ status: 'killed' })
+  })
+
+  it('drops an owner\'s rows when its lifecycle ends, keeping the unowned set', async () => {
+    const ctx = await harness()
+    const alice = await registerAgent(ctx, 'alice')
+    startJob(ctx, { label: 'shared' })
+    startJob(ctx, { label: 'mine', owner: alice.id })
+    const abort = new AbortController()
+    const iterator = streamJobRows(ctx.jobs, { sessionId: alice.id }, ROWS, abort.signal)[Symbol.asyncIterator]()
+    expect((await next(iterator))?.jobs).toHaveLength(2)
+
+    await alice.disposeScope()
+    // Teardown cancels, settles, and removes the owned job; the frames land in
+    // that order, and the last one holds the unowned job alone.
+    let frame = await next(iterator)
+    while (frame !== undefined && frame.jobs.length !== 1) frame = await next(iterator)
+    expect(frame?.jobs.map(job => job.label)).toEqual(['shared'])
+    abort.abort()
+    expect(await next(iterator)).toBeUndefined()
+  })
+
+  it('stops cleanly on abort while idle and refuses an already-aborted signal', async () => {
+    const ctx = await harness()
+    startJob(ctx, { label: 'idle' })
+    const abort = new AbortController()
+    const iterator = streamJobRows(ctx.jobs, { sessionId: 'nobody' as never }, ROWS, abort.signal)[Symbol.asyncIterator]()
+    expect((await next(iterator))?.jobs.map(job => job.label)).toEqual(['idle'])
+    await wait(10)
+    abort.abort()
+    expect(await next(iterator)).toBeUndefined()
+
+    const aborted = new AbortController()
+    aborted.abort()
+    const refused = streamJobRows(ctx.jobs, { sessionId: 'nobody' as never }, ROWS, aborted.signal)[Symbol.asyncIterator]()
+    await expect(refused.next()).rejects.toThrow()
+  })
+})
diff --git a/packages/api/job-controller/tsconfig.client.json b/packages/api/job-controller/tsconfig.client.json
new file mode 100644
index 0000000000..34a2202060
--- /dev/null
+++ b/packages/api/job-controller/tsconfig.client.json
@@ -0,0 +1,23 @@
+{
+  "extends": "../../../tsconfig.base.client.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "lib/types",
+    "tsBuildInfoFile": "lib/tsconfig.client.tsbuildinfo"
+  },
+  "files": [
+    "src/client/index.ts",
+    "src/client/model.ts",
+    "src/client/service.ts",
+    "src/types.ts"
+  ],
+  "references": [
+    { "path": "../../../vendor/cordis" },
+    { "path": "../gateway/tsconfig.client.json" },
+    { "path": "../../client/connection/tsconfig.client.json" },
+    { "path": "../../client/store" },
+    { "path": "../../core/session" },
+    { "path": "../../jobs/jobs" },
+    { "path": "../../typert/protocol" }
+  ]
+}
diff --git a/packages/api/job-controller/tsconfig.host.json b/packages/api/job-controller/tsconfig.host.json
new file mode 100644
index 0000000000..4e5c8c3f01
--- /dev/null
+++ b/packages/api/job-controller/tsconfig.host.json
@@ -0,0 +1,22 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "lib/types",
+    "tsBuildInfoFile": "lib/tsconfig.host.tsbuildinfo"
+  },
+  "files": [
+    "src/index.ts",
+    "src/observe.ts",
+    "src/rows.ts",
+    "src/types.ts",
+    "src/wake.ts"
+  ],
+  "references": [
+    { "path": "../../../vendor/cordis" },
+    { "path": "../../../vendor/schemastery" },
+    { "path": "../../core/session" },
+    { "path": "../../jobs/jobs" },
+    { "path": "../../typert/protocol" }
+  ]
+}
diff --git a/packages/api/job-controller/tsconfig.json b/packages/api/job-controller/tsconfig.json
new file mode 100644
index 0000000000..2a0b0e33f7
--- /dev/null
+++ b/packages/api/job-controller/tsconfig.json
@@ -0,0 +1,7 @@
+{
+  "files": [],
+  "references": [
+    { "path": "./tsconfig.host.json" },
+    { "path": "./tsconfig.client.json" }
+  ]
+}
diff --git a/packages/api/job-controller/tsdown.config.ts b/packages/api/job-controller/tsdown.config.ts
new file mode 100644
index 0000000000..0391bc61bf
--- /dev/null
+++ b/packages/api/job-controller/tsdown.config.ts
@@ -0,0 +1,7 @@
+import { clientBundle } from '../../client/tsdown.client.ts'
+
+export default clientBundle(
+  '@deepseek-ai/dsh-api-job-controller',
+  ['lib/types/index.js'],
+  { hostPhase: true },
+)
diff --git a/packages/api/remotes/package.json b/packages/api/remotes/package.json
index 8a20b05e13..005d3fbc19 100644
--- a/packages/api/remotes/package.json
+++ b/packages/api/remotes/package.json
@@ -63,8 +63,12 @@
     "@deepseek-ai/dsh-agent": "workspace:^",
     "@deepseek-ai/dsh-agent-presets": "workspace:^",
     "@deepseek-ai/dsh-api-gateway": "workspace:^",
+    "@deepseek-ai/dsh-api-job-controller": "workspace:^",
+    "@deepseek-ai/dsh-api-session-controller": "workspace:^",
     "@deepseek-ai/dsh-api-settings-controller": "workspace:^",
     "@deepseek-ai/dsh-api-workspace-controller": "workspace:^",
+    "@deepseek-ai/dsh-client-connection": "workspace:^",
+    "@deepseek-ai/dsh-client-file-upload": "workspace:^",
     "@deepseek-ai/dsh-commands": "workspace:^",
     "@deepseek-ai/dsh-cordis-host-runner": "workspace:^",
     "@deepseek-ai/dsh-credentials": "workspace:^",
@@ -73,10 +77,12 @@
     "@deepseek-ai/dsh-host-plugin-inventory": "workspace:^",
     "@deepseek-ai/dsh-llm": "workspace:^",
     "@deepseek-ai/dsh-message-feedback": "workspace:^",
+    "@deepseek-ai/dsh-scope": "workspace:^",
     "@deepseek-ai/dsh-permission-presets": "workspace:^",
     "@deepseek-ai/dsh-session-reference": "workspace:^",
     "@deepseek-ai/dsh-settings": "workspace:^",
     "@deepseek-ai/dsh-subagent": "workspace:^",
+    "@deepseek-ai/dsh-typert-protocol": "workspace:^",
     "@deepseek-ai/dsh-user-approval": "workspace:^",
     "@deepseek-ai/dsh-user-questions": "workspace:^",
     "@deepseek-ai/dsh-client-connection": "workspace:^",
diff --git a/packages/api/remotes/src/client/index.ts b/packages/api/remotes/src/client/index.ts
index 5ba2f791fc..d1220b9b93 100644
--- a/packages/api/remotes/src/client/index.ts
+++ b/packages/api/remotes/src/client/index.ts
@@ -17,6 +17,7 @@ import fileUploadsRemote from '@deepseek-ai/dsh-client-file-upload/remote'
 import sessionReferencesRemote from '@deepseek-ai/dsh-session-reference/remote'
 import subagentsRemote from '@deepseek-ai/dsh-subagent/remote'
 import sessionRemote from '@deepseek-ai/dsh-api-session-controller/remote'
+import jobRemote from '@deepseek-ai/dsh-api-job-controller/remote'
 import workspaceRemote from '@deepseek-ai/dsh-api-workspace-controller/remote'
 import terminalRemote from '@deepseek-ai/dsh-api-terminal-controller/remote'
 import workspaceFilesRemote from '@deepseek-ai/dsh-api-workspace-files/remote'
@@ -46,13 +47,14 @@ export type {} from '@deepseek-ai/dsh-subagent/remote'
 export type * from '@deepseek-ai/dsh-subagent/client'
 export type {} from '@deepseek-ai/dsh-api-session-controller/remote'
 export type * from '@deepseek-ai/dsh-api-session-controller/types'
+export type {} from '@deepseek-ai/dsh-api-job-controller/remote'
+export type * from '@deepseek-ai/dsh-api-job-controller/types'
 export type {} from '@deepseek-ai/dsh-api-workspace-controller/remote'
 export type * from '@deepseek-ai/dsh-api-workspace-controller/types'
 export type {} from '@deepseek-ai/dsh-api-workspace-files/remote'
 export type * from '@deepseek-ai/dsh-api-workspace-files/types'
 export type {} from '@deepseek-ai/dsh-api-terminal-controller/remote'
 export type * from '@deepseek-ai/dsh-api-terminal-controller/types'
-export type { SessionJob as JobView } from '@deepseek-ai/dsh-api-session-controller/types'
 // The forwarded-event allowlist's selection seat: without it in the consumer's
 // compilation face `TypertRemoteEvent` is `never` and every `$on` call fails.
 export type { ApiRemoteForwardedEvent } from '../types.ts'
@@ -168,7 +170,8 @@ export async function apply(ctx: Context): Promise<() => Promise<void>> {
     for (const contribution of [
       agentPresetsRemote, commandsRemote, settingsControllerRemote, goalsRemote, llmRemote, dynamicRemote,
       pluginInventoryRemote, pluginManagerRemote, messageFeedbackRemote, sessionFeedbackRemote, fileUploadsRemote, sessionReferencesRemote,
-      permissionPresetsRemote, subagentsRemote, sessionRemote, workspaceRemote, workspaceFilesRemote, terminalRemote, officeToPdfRemote,
+      permissionPresetsRemote, subagentsRemote, sessionRemote, jobRemote, workspaceRemote, workspaceFilesRemote, terminalRemote,
+      officeToPdfRemote,
     ]) {
       disposers.push(await ctx.remote.$mount(contribution))
     }
diff --git a/packages/api/remotes/tsconfig.client.json b/packages/api/remotes/tsconfig.client.json
index 301798c890..d7464526d3 100644
--- a/packages/api/remotes/tsconfig.client.json
+++ b/packages/api/remotes/tsconfig.client.json
@@ -68,6 +68,9 @@
     {
       "path": "../../interaction/user-questions"
     },
+    {
+      "path": "../job-controller/tsconfig.client.json"
+    },
     {
       "path": "../session-controller/tsconfig.client.json"
     },
diff --git a/packages/api/session-controller/README.i18n.yaml b/packages/api/session-controller/README.i18n.yaml
index e63c0b2a46..0e8bb05b38 100644
--- a/packages/api/session-controller/README.i18n.yaml
+++ b/packages/api/session-controller/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/api/session-controller/README.md
-README.md: 49f38e5af8f0939dd8f1ccafcd7928b10954ca33
-README.zh.md: 57112fc5ce88567ecfe415ed7ee4dd5ac9d34224
+README.md: 6d8479ea7a88a1a68df559b04cfd13c9f44421cd
+README.zh.md: 2591bbf86fba57deabc0a4282c868d84b24ec105
diff --git a/packages/api/session-controller/README.md b/packages/api/session-controller/README.md
index 49f38e5af8..6d8479ea7a 100644
--- a/packages/api/session-controller/README.md
+++ b/packages/api/session-controller/README.md
@@ -37,11 +37,13 @@ Explicit-id `session.create` adopts a live Session or resumes a persisted Sessio
 
 Client list refreshes retain unchanged row objects and reuse the items array when order and values match. Each row's `retainedBy` contains positive local reference-source counts; Host metadata refreshes cannot overwrite them. Cache membership checks use a per-refresh ID set, so reconciliation grows linearly with the current list and retained cache sizes. Host summary updates replace running and Agent availability; local create/fork responses only fill missing metadata on existing rows. Removed ordinary Sessions retain projection stores only when their catalogs contain children.
 
+Background-job rows and observation streams belong to [`dsh-api-job-controller`](../job-controller/README.md); the control stream carries projections only.
+
 Projection reads retain loading and failure state independently of their values. Reconnect cancels reads from the previous connection and reloads previously requested projections; live membership updates arrive through the control stream. Parent availability comes from Host summaries and remains unknown until a summary or a successful list baseline establishes it. Address lookup resolves projected children without selecting them or creating scopes.
 
 Accepted prompts and observed running keep their Client display conversion across list refresh, reconnect, and Session-object replacement. The Manager retains these observations by Session id; they do not establish durable history. Drafts, projection stores, and sidebar display rules retain their existing behavior. The [blank rollback decision](../../../.agents/notes/implemented/bug-fix/2026-09-15-client-session-blank-reconciliation.md) defines retention and late-response handling.
 
-The Client adapter exposes `SessionEventStream`, a Gateway `RemoteJournalStream` bound to one ordinary or direct-subagent address. It opens follow before the initial page, publishes only contiguous `replace`, `prepend`, `append`, and `settle-assistant` changes, and repairs reconnect or sequence gaps through a tail page. Backwards paging has two verbs: `loadOlder()` pulls one 50-message page, and `loadThrough(seq)` — the turn-jump loader — loops 200-message pages until the window covers the target seq, lowering a shared target on repeated calls, stopping on a page that makes no progress, and reporting busy through the same `loadingOlder` snapshot bit. The Web adapter explicitly opts into cursorless Assistant frames: each opening carries the active attempt's `startedAfterSeq`, `nextIndex`, and compact stream, and every stream member becomes a Client-only `assistant/live-chunk` entry ordered between durable cursors. The Host captures a follower-local arrival ordinal with that baseline and suppresses buffered frames at or before the cut; a replacement Agent may restart frame revision at one. A durable `assistant/message` or `assistant/attempt` arriving after an active opening stays staged only when its seq follows `startedAfterSeq` and its Turn and Step match; the matching end type, seq, and index publishes one named settlement delta that retires the attempt's transient rows and adds the durable entry while earlier same-step retries remain visible. Revision, dense-index, or settlement gaps for a known attempt reopen follow, while a controller that missed the start ignores unknown-attempt frames and publishes their durable settlement normally. An abandoned end publishes a settlement delta without a durable entry so its transient rows retire immediately. A durable gap-repair page has no Assistant baseline, so its held notification reopens follow once for a paired page and baseline. Every history record covers exactly its event seq. A business, persistence, or unresolved continuity failure terminates the stream, while only physical carrier loss selects automatic resumption. `SessionControlStream` is a Gateway `RemoteSnapshotStream`; every generation opens with a complete process-local baseline, so reconnect replaces jobs and projection state instead of treating transient values as durable events. At each ready Host generation, a synchronous Client subscription clears retained projection values and watermarks before refreshing queries and restarting the control stream, including Sessions absent from the control baseline. The first control stream waits for generation readiness, so its opening values cannot precede invalidation. Outstanding list responses from the previous generation cannot republish those values. Within a generation, a delayed control baseline cannot overwrite or clear newer sequenced values, whether they arrived through a live Session's list block, a history page, or a frame; a cached list block, viewed from the projection cache for a cold Session, yields to the connected Session's baseline whatever watermark it carries. The durable `inbox` projection carries both pending lists through the same cold-read and reconnect path as other projections. Client Agent contexts provide the identity used by the independent [`fileUpload`](../../client/file-upload/README.md) service; Session objects expose lifecycle, prompt, queue, and history operations rather than file transfer.
+The Client adapter exposes `SessionEventStream`, a Gateway `RemoteJournalStream` bound to one ordinary or direct-subagent address. It opens follow before the initial page, publishes only contiguous `replace`, `prepend`, `append`, and `settle-assistant` changes, and repairs reconnect or sequence gaps through a tail page. Backwards paging has two verbs: `loadOlder()` pulls one 50-message page, and `loadThrough(seq)` — the turn-jump loader — loops 200-message pages until the window covers the target seq, lowering a shared target on repeated calls, stopping on a page that makes no progress, and reporting busy through the same `loadingOlder` snapshot bit. The Web adapter explicitly opts into cursorless Assistant frames: each opening carries the active attempt's `startedAfterSeq`, `nextIndex`, and compact stream, and every stream member becomes a Client-only `assistant/live-chunk` entry ordered between durable cursors. The Host captures a follower-local arrival ordinal with that baseline and suppresses buffered frames at or before the cut; a replacement Agent may restart frame revision at one. A durable `assistant/message` or `assistant/attempt` arriving after an active opening stays staged only when its seq follows `startedAfterSeq` and its Turn and Step match; the matching end type, seq, and index publishes one named settlement delta that retires the attempt's transient rows and adds the durable entry while earlier same-step retries remain visible. Revision, dense-index, or settlement gaps for a known attempt reopen follow, while a controller that missed the start ignores unknown-attempt frames and publishes their durable settlement normally. An abandoned end publishes a settlement delta without a durable entry so its transient rows retire immediately. A durable gap-repair page has no Assistant baseline, so its held notification reopens follow once for a paired page and baseline. Every history record covers exactly its event seq. A business, persistence, or unresolved continuity failure terminates the stream, while only physical carrier loss selects automatic resumption. `SessionControlStream` is a Gateway `RemoteSnapshotStream`; every generation opens with a complete process-local baseline, so reconnect replaces projection state instead of treating transient values as durable events. At each ready Host generation, a synchronous Client subscription clears retained projection values and watermarks before refreshing queries and restarting the control stream, including Sessions absent from the control baseline. The first control stream waits for generation readiness, so its opening values cannot precede invalidation. Outstanding list responses from the previous generation cannot republish those values. Within a generation, a delayed control baseline cannot overwrite or clear newer sequenced values, whether they arrived through a live Session's list block, a history page, or a frame; a cached list block, viewed from the projection cache for a cold Session, yields to the connected Session's baseline whatever watermark it carries. The durable `inbox` projection carries both pending lists through the same cold-read and reconnect path as other projections. Client Agent contexts provide the identity used by the independent [`fileUpload`](../../client/file-upload/README.md) service; Session objects expose lifecycle, prompt, queue, and history operations rather than file transfer.
 
 The Session object also carries local submission echoes: `session.beginSubmission` inserts one into `SessionSnapshot.pendingSubmissions` synchronously, before the caller serializes and prompts, so a conversation UI can show the message on the submit click's own frame. The echo stores ordered image previews and durable file references. Session derives its `transcript`, `queued`, or `steering` placement from the current running state and requested delivery mode, then retains that placement while serialization is in flight. The prompt's `requestId` is the correlation identity: the Host echoes it as the durable user source's `rpcId`, including pending messages in the `inbox` projection. An echo retires one animation frame after its durable event or queue occurrence is observed, immediately when its identified prompt fails or is abandoned, and as failed on disposal. Each retirement fires `onRetire` exactly once; an observed retirement includes the ordered durable attachment references so the composer can release successful cards while preserving failed drafts. Echoes are Client memory only; reload and reconnect rebuild the conversation from durable events alone.
 
@@ -70,6 +72,8 @@ References keep local Session data, scoped Contexts, and history streams alive,
 
 `SessionMediaReferences` mounts `GET|HEAD /api/file?path=<absolute path>` on the authenticated `connection.fetch` channel when `connection`, `fs`, and `attachments` are composed. It reads ordinary files through `ctx.fs`, including temporary paths outside registered workspaces and files in remote providers. Neither directory containment nor MIME categories restrict access; `mime-types` supplies the response type, with `application/octet-stream` for unknown extensions. GET reuses `readBytes` for preflight and ongoing byte limits; HEAD reads metadata only. All files use `ctx.attachments.imageLimits.maxImageBytes` (normally 20 MiB); exceeding this limit returns 413. Responses contain the complete file, ignore Range, and carry `private, no-store`, `nosniff`, and a sandbox CSP so directly opened HTML/SVG cannot execute with the API origin. The Client rewrite lives in `ui-chat` (`AssistantMarkdown`); audio/video responses are available, while Markdown audio/video player nodes remain separate work.
 
+`workspacePathApplications({ path })` returns the serving desktop’s file handlers after the same filesystem mapping check used by `openWorkspacePath`. An optional `application` in the open request selects a currently registered handler without changing the system default. Application names, default selection, icons, and platform coverage come from [native-command](../../util/native-command/README.md). These operations do not activate an Agent or append Session events. Native failures return bounded messages; original command errors remain Host-side causes.
+
 -----
 
 <a id="configuration"></a>
@@ -97,7 +101,6 @@ No direct effect; model requests remain owned by the Agent and LLM packages.
 <a id="known-limitations-and-deferred-work"></a>
 
 - The image byte cap does not validate decoded dimensions or pixel count.
-- Control baselines represent process-local state and therefore cannot reconstruct jobs after a Host restart.
 - A failed follow resumption remains visible to the caller instead of retrying indefinitely.
 - The raw browser upload is one streaming HTTP request without resumable offsets; a retry sends the file again from byte zero.
 - File-reference completion uses the shared Agent lookup and can resume a cold Session; the `skills/list` catalog is the non-activating alternative for skill metadata.
diff --git a/packages/api/session-controller/README.zh.md b/packages/api/session-controller/README.zh.md
index 57112fc5ce..2591bbf86f 100644
--- a/packages/api/session-controller/README.zh.md
+++ b/packages/api/session-controller/README.zh.md
@@ -37,11 +37,13 @@ Client 列表行和驻留 Session 使用当前 `sessionListMetadata` 投影纠
 
 Client 列表刷新保留未变化的行对象，并在顺序和值均相同时复用条目数组。每行的 `retainedBy` 包含正数的本地引用来源计数，Host 元数据刷新不能覆盖它们。缓存成员检查使用每次刷新构建的 ID 集合，因此对账成本随当前列表和保留缓存的规模线性增长。 Host 摘要更新会替换运行状态与 Agent 可用性；本地 create/fork 响应只补充已有行缺失的元数据。普通 Session 被移除后，仅在目录仍有子项时保留其投影 store。
 
+后台 job 的名册行与观测流属于 [`dsh-api-job-controller`](../job-controller/README.zh.md)；控制流只承载投影。
+
 投影读取独立于其值保留加载与失败状态。重连会取消上一连接的读取，并重新加载已请求的投影；实时成员更新通过 control stream 到达。父 Agent 可用性来自 Host 摘要，在收到对应摘要或成功的列表 baseline 前保持未知。地址查找直接解析投影中的子项，不会选择它们或创建 scope。
 
 已受理的提示词与已观察到的运行，会使客户端展示转换跨列表刷新、重连及 Session 对象替换保留。Manager 按 Session id 保留这些观察；它们不证明持久历史已经产生。草稿、投影存储和侧边栏展示规则保留原有行为。[blank 回退修复决策](../../../.agents/notes/implemented/bug-fix/2026-09-15-client-session-blank-reconciliation.zh.md) 定义保留期限及迟到响应处理。
 
-Client 适配器提供 `SessionEventStream`，即绑定到一个普通 Session 或 direct subagent address 的 Gateway `RemoteJournalStream`。它在读取首个 page 前打开 follow，只发布连续的 `replace`、`prepend`、`append` 与 `settle-assistant` 变更，并通过 tail page 修复重连或 seq 缺口。向后分页有两个动词：`loadOlder()` 拉一页 50 条消息，而 `loadThrough(seq)`——轮次跳转加载器——按每页 200 条消息循环拉取直到窗口覆盖目标 seq，重复调用会下调共享目标，遇到无进展的页即停止，忙碌状态复用同一个 `loadingOlder` 快照位。Web 适配器显式选择接收无 cursor 的 Assistant frame：每个 opening 携带活跃 attempt 的 `startedAfterSeq`、`nextIndex` 与紧凑 stream，每个 stream member 都成为排在持久 cursor 之间的 Client-only `assistant/live-chunk` 条目。Host 会随该 baseline 捕获 follower 本地到达序号，并抑制该 cut 及之前的 buffered frame；replacement Agent 可以从 revision 一重新开始。活跃 opening 之后到达的持久 `assistant/message` 或 `assistant/attempt` 只有在其 seq 晚于 `startedAfterSeq` 且轮次与步骤匹配时才会保持暂存；匹配的 end type、seq 与 index 会发布一个具名 settlement delta，删除该 attempt 的瞬态 row、加入持久条目，并保留同一步骤中更早的 retry。已知 attempt 的 revision、密集 index 或 settlement 缺口会重新打开 follow；若 controller 错过 start，则忽略 unknown-attempt frame，并正常发布其持久 settlement。Abandoned end 会发布不含持久条目的 settlement delta，使瞬态 row 立即退出。持久缺口修复 page 不携带 Assistant baseline，因此 held notification 会重新打开 follow 一次，以取得配对的 page 与 baseline。每条历史 record 只覆盖自身的事件 seq。业务、persistence 或无法恢复的连续性错误会终止 stream，只有物理载体断开才触发自动恢复。`SessionControlStream` 是 Gateway `RemoteSnapshotStream`；每代都以完整的进程本地 baseline 开始，因此重连会替换 jobs 和 projection 状态，而不会把瞬态值当作 durable event。每次 Host generation 就绪时，同步的 Client 订阅会先清除保留的投影值及其水位，再刷新查询并重新打开 control stream，其中也包括 control baseline 中没有列出的 Session。首次 control stream 会等待 generation 就绪，确保其 opening 值不会先于旧状态清理到达。上一代尚未完成的 list 响应无法重新发布这些值。同一 generation 内，延迟到达的 control baseline 不能覆盖或清除较新的 sequenced 值，无论它们来自活 Session 的 list block、history page 还是 frame；冷 Session 从 projection cache 看出来的 cached list block 则不论水位都让位于建连 Session 的 baseline。持久 `inbox` 投影通过与其他投影相同的冷读取和重连路径传输两份待处理列表。Client Agent 上下文提供独立 [`fileUpload`](../../client/file-upload/README.zh.md) 服务使用的身份；Session 对象提供生命周期、prompt、queue 与历史操作，不提供文件传输。
+Client 适配器提供 `SessionEventStream`，即绑定到一个普通 Session 或 direct subagent address 的 Gateway `RemoteJournalStream`。它在读取首个 page 前打开 follow，只发布连续的 `replace`、`prepend`、`append` 与 `settle-assistant` 变更，并通过 tail page 修复重连或 seq 缺口。向后分页有两个动词：`loadOlder()` 拉一页 50 条消息，而 `loadThrough(seq)`——轮次跳转加载器——按每页 200 条消息循环拉取直到窗口覆盖目标 seq，重复调用会下调共享目标，遇到无进展的页即停止，忙碌状态复用同一个 `loadingOlder` 快照位。Web 适配器显式选择接收无 cursor 的 Assistant frame：每个 opening 携带活跃 attempt 的 `startedAfterSeq`、`nextIndex` 与紧凑 stream，每个 stream member 都成为排在持久 cursor 之间的 Client-only `assistant/live-chunk` 条目。Host 会随该 baseline 捕获 follower 本地到达序号，并抑制该 cut 及之前的 buffered frame；replacement Agent 可以从 revision 一重新开始。活跃 opening 之后到达的持久 `assistant/message` 或 `assistant/attempt` 只有在其 seq 晚于 `startedAfterSeq` 且轮次与步骤匹配时才会保持暂存；匹配的 end type、seq 与 index 会发布一个具名 settlement delta，删除该 attempt 的瞬态 row、加入持久条目，并保留同一步骤中更早的 retry。已知 attempt 的 revision、密集 index 或 settlement 缺口会重新打开 follow；若 controller 错过 start，则忽略 unknown-attempt frame，并正常发布其持久 settlement。Abandoned end 会发布不含持久条目的 settlement delta，使瞬态 row 立即退出。持久缺口修复 page 不携带 Assistant baseline，因此 held notification 会重新打开 follow 一次，以取得配对的 page 与 baseline。每条历史 record 只覆盖自身的事件 seq。业务、persistence 或无法恢复的连续性错误会终止 stream，只有物理载体断开才触发自动恢复。`SessionControlStream` 是 Gateway `RemoteSnapshotStream`；每代都以完整的进程本地 baseline 开始，因此重连会替换 projection 状态，而不会把瞬态值当作 durable event。每次 Host generation 就绪时，同步的 Client 订阅会先清除保留的投影值及其水位，再刷新查询并重新打开 control stream，其中也包括 control baseline 中没有列出的 Session。首次 control stream 会等待 generation 就绪，确保其 opening 值不会先于旧状态清理到达。上一代尚未完成的 list 响应无法重新发布这些值。同一 generation 内，延迟到达的 control baseline 不能覆盖或清除较新的 sequenced 值，无论它们来自活 Session 的 list block、history page 还是 frame；冷 Session 从 projection cache 看出来的 cached list block 则不论水位都让位于建连 Session 的 baseline。持久 `inbox` 投影通过与其他投影相同的冷读取和重连路径传输两份待处理列表。Client Agent 上下文提供独立 [`fileUpload`](../../client/file-upload/README.zh.md) 服务使用的身份；Session 对象提供生命周期、prompt、queue 与历史操作，不提供文件传输。
 
 Session 对象还承载本地提交回显：`session.beginSubmission` 在调用方序列化与提示词之前，同步把一条回显写入 `SessionSnapshot.pendingSubmissions`，会话 UI 因此能在点击提交的当帧显示消息。回显按顺序存放图片预览与持久文件引用。Session 根据当前运行状态与请求的投递模式推导其 `transcript`、`queued` 或 `steering` 位置，并在序列化期间保留该位置。提示词的 `requestId` 是关联标识：Host 把它回显为 durable user source 的 `rpcId`，`inbox` 投影中的待处理消息也保留同一 source。回显在观察到其 durable event 或 queue occurrence 后延迟一个动画帧退休，带标识的提示词失败或被放弃时立即退休，销毁时按 failed 退休。每次退休恰好触发一次 `onRetire`；observed 退休还会携带有序的持久附件引用，让 composer 释放成功卡片并保留失败草稿。回显只存在于 Client 内存；刷新与重连只从持久事件重建会话。
 
@@ -70,6 +72,8 @@ Fork 复制 `atSeq` 所选的精确事件前缀，包含切点事件，允许在
 
 当 `connection`、`fs` 与 `attachments` 均被组合时，`SessionMediaReferences` 在鉴权 `connection.fetch` 通道上挂载 `GET|HEAD /api/file?path=<绝对路径>`。它通过 `ctx.fs` 读取普通文件，包括已注册工作区之外的临时路径与远程提供方中的文件。目录包含关系与 MIME 类别均不限制访问；`mime-types` 提供响应类型，未知扩展名使用 `application/octet-stream`。GET 复用 `readBytes` 执行读取前及读取中的字节限制；HEAD 只读取元数据。所有文件均使用 `ctx.attachments.imageLimits.maxImageBytes`（通常为 20 MiB）；超过此上限返回 413。响应包含完整文件，忽略 Range，并携带 `private, no-store`、`nosniff` 与沙箱 CSP，使直接打开的 HTML/SVG 无法以 API 源身份执行脚本。客户端重写位于 `ui-chat`（`AssistantMarkdown`）；音视频文件响应已可用，Markdown 音视频播放器节点仍是独立工作。
 
+`workspacePathApplications({ path })` 使用与 `openWorkspacePath` 相同的文件系统映射校验，返回服务端桌面上该文件的关联应用。打开请求中的可选 `application` 指定当前关联的应用，不修改系统默认应用。应用名称、默认项、图标和平台支持范围由 [native-command](../../util/native-command/README.zh.md) 提供。这些操作不激活 Agent，也不追加会话事件。原生操作失败时返回简短消息，原始命令异常作为 Host 端原因保留。
+
 -----
 
 <a id="configuration"></a>
@@ -97,7 +101,6 @@ Fork 复制 `atSeq` 所选的精确事件前缀，包含切点事件，允许在
 <a id="known-limitations-and-deferred-work"></a>
 
 - 图片字节上限不校验解码后的尺寸或像素数。
-- Control baseline 表示进程本地状态，因此 Host 重启后无法重建 jobs。
 - follow 恢复失败会对调用方可见，而不会无限重试。
 - 浏览器原始字节上传使用一次不带断点续传偏移的流式 HTTP 请求；重试会从第零字节重新传输整个文件。
 - 文件引用补全使用共享 Agent lookup，因此可能恢复冷 Session；`skills/list` 目录是不激活 Agent 的 skill 元数据读取路径。
diff --git a/packages/api/session-controller/package.json b/packages/api/session-controller/package.json
index 643c553e0a..a391fefa37 100644
--- a/packages/api/session-controller/package.json
+++ b/packages/api/session-controller/package.json
@@ -87,7 +87,6 @@
     "@deepseek-ai/dsh-commands": "workspace:^",
     "@deepseek-ai/dsh-file-reference": "workspace:^",
     "@deepseek-ai/dsh-fs": "workspace:^",
-    "@deepseek-ai/dsh-jobs": "workspace:^",
     "@deepseek-ai/dsh-llm": "workspace:^",
     "@deepseek-ai/dsh-native-command": "workspace:^",
     "@deepseek-ai/dsh-scope": "workspace:^",
@@ -107,9 +106,6 @@
     "@deepseek-ai/dsh-workspace": "workspace:^"
   },
   "peerDependenciesMeta": {
-    "@deepseek-ai/dsh-jobs": {
-      "optional": true
-    },
     "@deepseek-ai/dsh-session-persistence": {
       "optional": true
     },
@@ -134,7 +130,6 @@
     "@deepseek-ai/dsh-file-reference": "workspace:^",
     "@deepseek-ai/dsh-fs": "workspace:^",
     "@deepseek-ai/dsh-fs-local": "workspace:^",
-    "@deepseek-ai/dsh-jobs": "workspace:^",
     "@deepseek-ai/dsh-llm": "workspace:^",
     "@deepseek-ai/dsh-native-command": "workspace:^",
     "@deepseek-ai/dsh-permission-presets": "workspace:^",
diff --git a/packages/api/session-controller/src/client/sessions/manager.ts b/packages/api/session-controller/src/client/sessions/manager.ts
index 9744bf3c75..50af09df13 100644
--- a/packages/api/session-controller/src/client/sessions/manager.ts
+++ b/packages/api/session-controller/src/client/sessions/manager.ts
@@ -10,7 +10,6 @@ import type {
   SessionProjectionHints,
   SessionRenameValue,
   SessionSummary,
-  SessionJob as JobView,
 } from '../../types.ts'
 import { mergeOrderedBaseline } from '../ordered-baseline.ts'
 import { isRemoteFailure } from '@deepseek-ai/dsh-api-gateway/client'
@@ -56,8 +55,7 @@ export interface SessionListSnapshot {
   phase: SessionListPhase
   error: RemoteFailure | null
   projectionsBySession: Readonly<Record<SessionId, SessionProjectionSnapshot>>
-  /** Background jobs per session; an absent key is an empty set. */
-  jobsBySession: Readonly<Record<SessionId, readonly JobView[]>>
+
 }
 
 /** Shared projection values and the lifecycle of their explicit baseline read. */
@@ -112,12 +110,7 @@ export class SessionManager {
   private readonly addresses = new Map<SessionId, SubagentAddress>()
   private readonly projectionLoads = new Map<SessionId, ProjectionLoad>()
   private readonly projectionInflight = new Map<SessionId, ProjectionInflight>()
-  /**
-   * Background jobs per session, last-wins from Session Controller's control
-   * stream. An empty set is stored as an absent key, so absence and `[]` are
-   * one representation.
-   */
-  private readonly jobsBySession = new Map<SessionId, readonly JobView[]>()
+
 
   private listSnapshotCache: SessionListSnapshot
   /** Entry-identity cache (reference stability): list rebuilds reuse the previous entry
@@ -628,21 +621,11 @@ export class SessionManager {
       this.replaceControlBaseline(frame.value)
       return
     }
-    if (frame.type === 'projection') {
-      this.projectionStore(frame.sessionId).apply(frame.key, frame.value, SessionSeq(frame.seq))
-      this.notifier.markDirty()
-      return
-    }
-    if (frame.jobs.length === 0) this.jobsBySession.delete(frame.sessionId)
-    else this.jobsBySession.set(frame.sessionId, frame.jobs)
+    this.projectionStore(frame.sessionId).apply(frame.key, frame.value, SessionSeq(frame.seq))
     this.notifier.markDirty()
   }
 
   private replaceControlBaseline(baseline: SessionControlBaseline): void {
-    this.jobsBySession.clear()
-    for (const [sessionId, jobs] of Object.entries(baseline.jobs)) {
-      if (jobs.length > 0) this.jobsBySession.set(sessionId as SessionId, jobs)
-    }
 
     for (const [sessionId, block] of Object.entries(baseline.projections)) {
       const store = this.projectionStore(sessionId as SessionId)
@@ -699,7 +682,6 @@ export class SessionManager {
       : { kind: 'remove', sessionId })
     if (durableSubagent) this.sessions.get(sessionId)?.handleRunning(false)
     else this.sessions.get(sessionId)?.handleRemoved()
-    this.jobsBySession.delete(sessionId)
     const catalog = this.projectionStores.get(sessionId)?.values().subagentCatalog
     if (!durableSubagent && (catalog === undefined || catalog.length === 0)) {
       this.projectionStores.delete(sessionId)
@@ -812,7 +794,6 @@ export class SessionManager {
         sessionId,
         { values: store.values(), state: 'idle', error: null, ...this.projectionLoads.get(sessionId) },
       ])),
-      jobsBySession: Object.fromEntries(this.jobsBySession),
     }
   }
 }
diff --git a/packages/api/session-controller/src/client/sessions/service.ts b/packages/api/session-controller/src/client/sessions/service.ts
index 2d5cea16f0..48d8f6a533 100644
--- a/packages/api/session-controller/src/client/sessions/service.ts
+++ b/packages/api/session-controller/src/client/sessions/service.ts
@@ -5,7 +5,6 @@ import { SessionSeq, type SessionId } from '@deepseek-ai/dsh-session/types'
 import { workspaceTitleOf } from '@deepseek-ai/dsh-util-workspace-path'
 import type { WorkspaceId } from '@deepseek-ai/dsh-workspace/types'
 import { SESSION_SEARCH_RESULT_LIMIT } from '../../types.ts'
-import type { SessionJob as JobView } from '../../types.ts'
 import type { SessionProjectionMap } from '@deepseek-ai/dsh-session-projection/types'
 import {
   createSnapshotStore, notifySubscribers, type ObservableSnapshot, type SnapshotStore,
@@ -61,12 +60,6 @@ export interface SessionListState {
   phase: SessionListPhase
   /** Shared projection values and explicit-read state, including unopened Sessions. */
   projectionsBySession: Readonly<Record<SessionId, SessionProjectionSnapshot>>
-  /**
-   * Background jobs each session can see, mirrored last-wins from Session
-   * Controller's control baseline and `jobs` frames. A missing key is an empty
-   * set, so consumers read absence rather than a sentinel.
-   */
-  jobsBySession: Readonly<Record<SessionId, readonly JobView[]>>
 }
 
 /** Structured session-create failure. */
@@ -263,7 +256,7 @@ export class ClientSessions implements ISessions {
   ) {
     this.manager = new SessionManager(remote)
     this.list = createSnapshotStore<SessionListState>({
-      ids: [], byId: {}, phase: 'pending', projectionsBySession: {}, jobsBySession: {},
+      ids: [], byId: {}, phase: 'pending', projectionsBySession: {},
     })
     const disposeManagerProjection = this.manager.subscribe(() => { this.projectList() })
     rootCtx.effect(() => async () => {
@@ -614,7 +607,7 @@ export class ClientSessions implements ISessions {
   private projectList(): void {
     const previousById = this.list.getSnapshot().byId
     const {
-      items, phase, projectionsBySession, jobsBySession,
+      items, phase, projectionsBySession,
     } = this.manager.getListSnapshot()
     const ids: SessionId[] = []
     const byId: Record<SessionId, SessionSummary> = {}
@@ -681,7 +674,7 @@ export class ClientSessions implements ISessions {
         ...(title === undefined ? {} : { title, displayTitle: title }),
       }
     }
-    this.list.set({ ids, byId, phase, projectionsBySession, jobsBySession })
+    this.list.set({ ids, byId, phase, projectionsBySession })
   }
 
   private startScopeDrop(
diff --git a/packages/api/session-controller/src/control.ts b/packages/api/session-controller/src/control.ts
index 3fb8d0032e..8d27396d29 100644
--- a/packages/api/session-controller/src/control.ts
+++ b/packages/api/session-controller/src/control.ts
@@ -1,9 +1,7 @@
-/** Live Session jobs and projection state with reconnect baselines. */
+/** Live Session projection state with reconnect baselines. */
 
 import type { Context } from '@deepseek-ai/cordis'
-import type { Agent } from '@deepseek-ai/dsh-agent'
 import { Deque } from '@deepseek-ai/dsh-deque'
-import type { JobSnapshot } from '@deepseek-ai/dsh-jobs'
 import type {
   Session, SessionId,
 } from '@deepseek-ai/dsh-session'
@@ -11,7 +9,6 @@ import type { JsonValue } from '@deepseek-ai/dsh-util-values'
 import type {
   SessionControlBaseline,
   SessionControlFrame,
-  SessionJob,
   SessionProjectionBaseline,
   SessionProjectionValues,
 } from './types.ts'
@@ -20,7 +17,7 @@ import type {
 export class SessionControlController {
   private readonly streams = new Set<ControlQueue>()
 
-  /** @param ctx - Host context carrying live Agent, projection, and jobs services. */
+  /** @param ctx - Host context carrying live Agent and projection services. */
   constructor(private readonly ctx: Context) {
     ctx.sessionProjections.onChanged((session, key, value, seq) => {
       this.broadcast({
@@ -31,13 +28,6 @@ export class SessionControlController {
         seq,
       })
     })
-    ctx.inject(['jobs'], (jobsCtx) => {
-      jobsCtx.jobs.onJobsChanged((owner) => { this.onJobsChanged(owner) })
-    })
-    ctx.on('session/created', (session) => {
-      const jobs = this.jobsFor(this.ctx.agents.get(session.id))
-      if (jobs.length > 0) this.broadcast({ type: 'jobs', sessionId: session.id, jobs })
-    })
     ctx.effect(() => () => {
       for (const stream of this.streams) stream.end()
       this.streams.clear()
@@ -64,13 +54,7 @@ export class SessionControlController {
 
   private baseline(): SessionControlBaseline {
     const sessions = this.ctx.sessions.list()
-    const jobs = Object.create(null) as Record<SessionId, readonly SessionJob[]>
-    for (const session of sessions) {
-      const agent = this.ctx.agents.get(session.id)
-      jobs[session.id] = this.jobsFor(agent)
-    }
     return {
-      jobs,
       projections: this.projectionBaseline(sessions),
     }
   }
@@ -90,25 +74,6 @@ export class SessionControlController {
     return blocks
   }
 
-  private onJobsChanged(owner: Agent | undefined): void {
-    if (owner !== undefined) {
-      this.broadcast({ type: 'jobs', sessionId: owner.id, jobs: this.jobsFor(owner) })
-      return
-    }
-    for (const session of this.ctx.sessions.list()) {
-      this.broadcast({
-        type: 'jobs',
-        sessionId: session.id,
-        jobs: this.jobsFor(this.ctx.agents.get(session.id)),
-      })
-    }
-  }
-
-  private jobsFor(agent: Agent | undefined): SessionJob[] {
-    const jobs = this.ctx.get('jobs')
-    return jobs === undefined ? [] : jobs.list(agent).map(jobView)
-  }
-
   private broadcast(frame: SessionControlFrame): void {
     for (const stream of this.streams) stream.push(frame)
   }
@@ -154,15 +119,3 @@ class ControlQueue {
     }
   }
 }
-
-function jobView(job: JobSnapshot): SessionJob {
-  return {
-    id: job.id,
-    kind: job.kind,
-    label: job.label,
-    status: job.status,
-    ...(job.detail === undefined ? {} : { detail: job.detail }),
-    startedAt: job.startedAt,
-    ...(job.finishedAt === undefined ? {} : { finishedAt: job.finishedAt }),
-  }
-}
diff --git a/packages/api/session-controller/src/index.ts b/packages/api/session-controller/src/index.ts
index b6f5f0dfa0..d830d2b661 100644
--- a/packages/api/session-controller/src/index.ts
+++ b/packages/api/session-controller/src/index.ts
@@ -8,7 +8,7 @@ import { Context } from '@deepseek-ai/cordis'
 import z from '@deepseek-ai/schemastery'
 import { errorChain } from '@deepseek-ai/dsh-llm'
 import type {} from '@deepseek-ai/dsh-client-file-upload'
-import { canOpenNativePath, nativeFileManager, openNativeAssociatedPath, revealNativePath } from '@deepseek-ai/dsh-native-command'
+import { canOpenNativePath, nativeFileManager, nativeFileApplications, openNativeFileApplication, openNativeAssociatedPath, revealNativePath } from '@deepseek-ai/dsh-native-command'
 import type { SessionId } from '@deepseek-ai/dsh-session'
 import type { SessionInspection } from '@deepseek-ai/dsh-session-persistence'
 import { SessionQueryError, type SessionObservation } from '@deepseek-ai/dsh-session-query'
@@ -29,6 +29,7 @@ import { SessionSkillCatalog } from './skill-catalog.ts'
 import { SessionMediaReferences } from './media-references.ts'
 import type {
   ModelCatalog,
+  SessionWorkspacePathApplication,
   SessionAttachmentRequest,
   SessionAttachmentValue,
   SessionCancelRequest,
@@ -83,6 +84,10 @@ export interface Config {
 export interface SessionControllerInternals {
   /** Native default-application handoff. */
   readonly openPath?: (path: string, signal: AbortSignal) => Promise<void>
+  /** Native file-association query. */
+  readonly fileApplications?: typeof nativeFileApplications
+  /** Explicit registered-application handoff. */
+  readonly openFileApplication?: typeof openNativeFileApplication
   /** Native file-manager handoff. */
   readonly revealPath?: (path: string, signal: AbortSignal) => Promise<void>
   /** Native handoff availability probe. */
@@ -115,6 +120,8 @@ export class SessionController extends TypertRemoteService {
   private readonly history: SessionHistoryController
   private readonly listState: ApiSessionList
   private readonly openPath: (path: string, signal: AbortSignal) => Promise<void>
+  private readonly fileApplications: typeof nativeFileApplications
+  private readonly openFileApplication: typeof openNativeFileApplication
   private readonly revealPath: (path: string, signal: AbortSignal) => Promise<void>
   private readonly canOpenPath: () => boolean
   private readonly promotions = new Set<Promise<void>>()
@@ -142,6 +149,8 @@ export class SessionController extends TypertRemoteService {
     }, 'session-controller.promotions')
     this.history = new SessionHistoryController(ctx, (observation) => { this.promote(observation) })
     this.listState = new ApiSessionList(ctx)
+    this.fileApplications = internals.fileApplications ?? nativeFileApplications
+    this.openFileApplication = internals.openFileApplication ?? openNativeFileApplication
     this.openPath = internals.openPath ?? openNativeAssociatedPath
     this.revealPath = internals.revealPath ?? revealNativePath
     this.canOpenPath = internals.canOpenPath
@@ -309,35 +318,59 @@ export class SessionController extends TypertRemoteService {
     request: SessionOpenWorkspacePathRequest,
     signal: AbortSignal,
   ): Promise<SessionOpenWorkspacePathValue> {
-    if (request.path.length === 0) {
-      throw new RemoteError(
-        'gateway/bad-request',
-        'session.openWorkspacePath requires a non-empty path',
-        {},
-      )
-    }
-    signal.throwIfAborted()
     try {
-      const hostPath = resolve(request.path)
-      const { fs } = this.ctx
-      const mapped = fs.processPathFromHostPath(hostPath)
-      if (mapped === undefined || fs.processPath(await fs.resolve(mapped, { signal })) !== hostPath) {
-        throw new Error('Path has no verified Host path')
-      }
-      signal.throwIfAborted()
-      if (request.action === 'reveal') await this.revealPath(request.path, signal)
-      else await this.openPath(request.path, signal)
+      const path = await this.verifyDesktopPath(request.path, signal)
+      if (request.action === 'reveal') await this.revealPath(path, signal)
+      else if (request.application !== undefined) await this.openFileApplication(path, request.application, signal)
+      else await this.openPath(path, signal)
       return { opened: true }
     } catch (error: unknown) {
       if (signal.aborted) throw new RemoteError('gateway/cancelled', 'path open was aborted', {})
+      if (error instanceof RemoteError) throw error
       throw new RemoteError(
         'gateway/internal',
-        `path open failed: ${error instanceof Error ? error.message : String(error)}`,
+        'path open failed',
         {},
+        { cause: error },
       )
     }
   }
 
+  /**
+   * Query current file handlers on the serving desktop without activating an Agent.
+   * @param request - file path in Host filesystem syntax.
+   * @param signal - caller lifetime, propagated to filesystem and desktop queries.
+   * @returns OS application names, icons, and default selection; empty when desktop opening is unavailable.
+   * @throws RemoteError when the path is invalid, the query is cancelled, or native discovery fails.
+   */
+  @Remote('workspacePathApplications')
+  async workspacePathApplications(
+    request: { readonly path: string }, signal: AbortSignal,
+  ): Promise<readonly SessionWorkspacePathApplication[]> {
+    if (!this.canOpenPath()) return []
+    try {
+      const path = await this.verifyDesktopPath(request.path, signal)
+      return await this.fileApplications(path, signal)
+    } catch (error: unknown) {
+      if (signal.aborted) throw new RemoteError('gateway/cancelled', 'application query was aborted', {})
+      if (error instanceof RemoteError) throw error
+      throw new RemoteError('gateway/internal', 'file application query failed', {}, { cause: error })
+    }
+  }
+
+  private async verifyDesktopPath(path: string, signal: AbortSignal): Promise<string> {
+    if (path.length === 0) throw new RemoteError('gateway/bad-request', 'A non-empty file path is required', {})
+    signal.throwIfAborted()
+    const hostPath = resolve(path)
+    const { fs } = this.ctx
+    const mapped = fs.processPathFromHostPath(hostPath)
+    if (mapped === undefined || fs.processPath(await fs.resolve(mapped, { signal })) !== hostPath) {
+      throw new RemoteError('gateway/bad-request', 'Path has no verified Host path', {})
+    }
+    signal.throwIfAborted()
+    return hostPath
+  }
+
   /**
    * Rename one Session after explicitly resuming it.
    * @param request - Session identity and proposed title.
@@ -465,6 +498,7 @@ export class SessionController extends TypertRemoteService {
     return this.controlState.control(signal)
   }
 
+
 }
 
 export { buildModelCatalog }
diff --git a/packages/api/session-controller/src/types.ts b/packages/api/session-controller/src/types.ts
index 728df9e55b..9e3da329ee 100644
--- a/packages/api/session-controller/src/types.ts
+++ b/packages/api/session-controller/src/types.ts
@@ -1,4 +1,5 @@
 /** Browser-safe request, result, and lifecycle vocabulary for the Session Remote service. */
+import type { NativeFileApplication } from '@deepseek-ai/dsh-native-command/types'
 
 import type {
   AttachmentIdType, ImageAttachmentLimits, ImageAttachmentRef, ImageMediaType,
@@ -8,7 +9,6 @@ import type { LlmAttemptId, MessageId } from '@deepseek-ai/dsh-llm/brand'
 import type { TextBlock } from '@deepseek-ai/dsh-llm'
 import type { SessionId, SessionSeqCursor } from '@deepseek-ai/dsh-session/types'
 import type { SessionProjectionMap } from '@deepseek-ai/dsh-session-projection/types'
-import type { JobId } from '@deepseek-ai/dsh-jobs/brand'
 import type { JsonValue } from '@deepseek-ai/dsh-util-values'
 import type { WorkspaceId } from '@deepseek-ai/dsh-workspace/types'
 
@@ -381,6 +381,8 @@ export interface SessionCancelValue {
 export interface SessionOpenWorkspacePathRequest {
   /** File-manager navigation when requested; omission uses the default application. */
   readonly action?: 'reveal'
+  /** Registered application identifier; ignored for reveal. Omission preserves the operating system default. */
+  readonly application?: string
   /** Path after best-effort Session workspace resolution, in Host filesystem syntax. */
   readonly path: string
 }
@@ -552,20 +554,8 @@ export type SessionFollowFrame =
   | SessionEventEntry
   | { readonly type: 'assistant-stream'; readonly frame: SessionAssistantStreamFrame }
 
-/** Browser-safe background-job row. */
-export interface SessionJob {
-  readonly id: JobId
-  readonly kind: string
-  readonly label: string
-  readonly status: 'running' | 'stopping' | 'completed' | 'killed' | 'failed'
-  readonly detail?: string
-  readonly startedAt: number
-  readonly finishedAt?: number
-}
-
 /** Complete live control baseline emitted once per control stream generation. */
 export interface SessionControlBaseline {
-  readonly jobs: Readonly<Record<SessionId, readonly SessionJob[]>>
   readonly projections: Readonly<Record<SessionId, SessionProjectionBaseline>>
 }
 
@@ -580,7 +570,6 @@ export interface SessionProjectionUpdate {
 /** Host-wide live state stream. Each generation starts with exactly one baseline. */
 export type SessionControlFrame =
   | { readonly type: 'baseline'; readonly value: SessionControlBaseline }
-  | { readonly type: 'jobs'; readonly sessionId: SessionId; readonly jobs: readonly SessionJob[] }
   | ({ readonly type: 'projection' } & SessionProjectionUpdate)
 
 declare module '@deepseek-ai/cordis' {
@@ -624,3 +613,6 @@ declare module '@deepseek-ai/cordis' {
 
 /** JSON-compatible projection value accepted by list consumers. */
 export type SessionProjectionValue = JsonValue
+
+/** Application metadata returned by the serving desktop for one file. */
+export type SessionWorkspacePathApplication = NativeFileApplication
diff --git a/packages/api/session-controller/tests/client-apply.client.spec.ts b/packages/api/session-controller/tests/client-apply.client.spec.ts
index 5323f64b17..11c98407eb 100644
--- a/packages/api/session-controller/tests/client-apply.client.spec.ts
+++ b/packages/api/session-controller/tests/client-apply.client.spec.ts
@@ -18,7 +18,7 @@ const ROSTER = webApp.closure([SELF])
 const it = createClientTest({ roster: ROSTER })
 const EVENTS = '$events'
 const CONTROL = 'session/control'
-const BASELINE = { type: 'baseline', value: { jobs: {}, projections: {} } }
+const BASELINE = { type: 'baseline', value: { projections: {} } }
 /** The first client boot pays the cold module transform of the cone. */
 const COLD_BOOT_TIMEOUT_MS = 60_000
 
@@ -88,7 +88,7 @@ describe('Session Controller Client apply', () => {
     }] }))
     let projection = { asOfSeq: 20, values: { title: 'Before restart' } }
     mock.stream(CONTROL, (_args, stream) => {
-      stream.push({ type: 'baseline', value: { jobs: {}, projections: { [sessionId]: projection } } })
+      stream.push({ type: 'baseline', value: { projections: { [sessionId]: projection } } })
     })
     const { client, sessions } = await bench(start)
     await vi.waitFor(() => {
diff --git a/packages/api/session-controller/tests/control-jobs.host.spec.ts b/packages/api/session-controller/tests/control-jobs.host.spec.ts
deleted file mode 100644
index 46b3dff031..0000000000
--- a/packages/api/session-controller/tests/control-jobs.host.spec.ts
+++ /dev/null
@@ -1,237 +0,0 @@
-import { Context } from '@deepseek-ai/cordis'
-import AgentRegistry from '@deepseek-ai/dsh-agent'
-import type { Agent } from '@deepseek-ai/dsh-agent'
-import type { JobOutcome } from '@deepseek-ai/dsh-jobs'
-import LocalJobRegistry from '@deepseek-ai/dsh-jobs-local'
-import SessionStore, { SESSION_FORMAT_VERSION, SessionId } from '@deepseek-ai/dsh-session'
-import type { Session } from '@deepseek-ai/dsh-session'
-import SessionProjectionRegistry from '@deepseek-ai/dsh-session-projection'
-import { describe, expect, it } from 'vitest'
-import { SessionControlController } from '../src/control.ts'
-import type { SessionControlFrame } from '../src/types.ts'
-import { unsupportedInbox } from '@deepseek-ai/dsh-agent-loop-testkit'
-
-type BaselineFrame = Extract<SessionControlFrame, { type: 'baseline' }>
-type JobFrame = Extract<SessionControlFrame, { type: 'jobs' }>
-
-function producer(label = 'sleep 60') {
-  let settle!: (outcome: JobOutcome) => void
-  const reads = { count: 0 }
-  const spec = {
-    kind: 'bash' as const,
-    label,
-    run: () => ({
-      cancel: () => {},
-      done: new Promise<JobOutcome>((resolve) => { settle = resolve }),
-      readOutput: () => { reads.count += 1; return 'stolen output' },
-    }),
-  }
-  return { spec, reads, settle: (outcome: JobOutcome) => { settle(outcome) } }
-}
-
-async function harness(withJobs: boolean): Promise<{
-  ctx: Context
-  session: Session
-  agent: Agent
-  control: SessionControlController
-}> {
-  const ctx = new Context()
-  await ctx.plugin(SessionStore)
-  await ctx.plugin(SessionProjectionRegistry)
-  await ctx.plugin(AgentRegistry)
-  if (withJobs) {
-    await ctx.plugin(LocalJobRegistry)
-    ctx.jobs.attachController('session-controller-test')
-  }
-  const session = ctx.sessions.create()
-  const agent: Agent = {
-    id: session.id,
-    options: {},
-    session,
-    inbox: unsupportedInbox(),
-    status: 'idle',
-    ctx,
-    send: () => {},
-    followup: () => {},
-    steer: () => {},
-    inject: () => {},
-    cancel: () => {},
-    runMaintenance: task => task(new AbortController().signal),
-    whenIdle: () => Promise.resolve(),
-  }
-  await ctx.agents.register(agent)
-  const control = new SessionControlController(ctx)
-  await new Promise(resolve => setTimeout(resolve, 0))
-  return { ctx, session, agent, control }
-}
-
-async function baseline(control: SessionControlController): Promise<BaselineFrame> {
-  const abort = new AbortController()
-  const iterator = control.control(abort.signal)[Symbol.asyncIterator]()
-  const first = await iterator.next()
-  abort.abort()
-  await iterator.next()
-  if (first.done || first.value.type !== 'baseline') throw new Error('missing control baseline')
-  return first.value
-}
-
-async function collectJobs(
-  iterable: AsyncIterable<SessionControlFrame>,
-  count: number,
-  abort: AbortController,
-): Promise<JobFrame[]> {
-  const jobs: JobFrame[] = []
-  for await (const frame of iterable) {
-    if (frame.type !== 'jobs') continue
-    jobs.push(frame)
-    if (jobs.length >= count) abort.abort()
-  }
-  return jobs
-}
-
-describe('Session control jobs baseline', () => {
-  it('represents an attached session with no jobs as an empty set', async () => {
-    const { session, control } = await harness(true)
-    const frame = await baseline(control)
-    expect(frame.value.jobs[session.id]).toEqual([])
-  })
-
-  it('carries the visible set when the stream opens', async () => {
-    const { ctx, session, agent, control } = await harness(true)
-    ctx.jobs.start({ ...producer('pnpm run build').spec, owner: agent })
-    const frame = await baseline(control)
-    const jobs = frame.value.jobs[session.id]
-    expect(jobs).toHaveLength(1)
-    const [job] = jobs ?? []
-    expect(job?.startedAt).toBeTypeOf('number')
-    expect({ ...job, startedAt: 0 }).toEqual({
-      id: 'bash-1',
-      kind: 'bash',
-      label: 'pnpm run build',
-      status: 'running',
-      startedAt: 0,
-    })
-  })
-})
-
-describe('Session control jobs updates', () => {
-  it('publishes existing unowned jobs when a Session attaches after the stream opens', async () => {
-    const { ctx, control } = await harness(true)
-    const abort = new AbortController()
-    const iterator = control.control(abort.signal)[Symbol.asyncIterator]()
-    await expect(iterator.next()).resolves.toMatchObject({ value: { type: 'baseline' } })
-    const task = producer('already running')
-    const id = ctx.jobs.start(task.spec)
-    await expect(iterator.next()).resolves.toMatchObject({ value: { type: 'jobs' } })
-
-    const created = ctx.sessions.create(SessionId('late-session'))
-    await expect(iterator.next()).resolves.toMatchObject({
-      value: {
-        type: 'jobs',
-        sessionId: created.id,
-        jobs: [expect.objectContaining({ id, label: 'already running' })],
-      },
-    })
-
-    task.settle({ status: 'completed' })
-    abort.abort()
-    await iterator.return?.()
-  })
-
-  it('pushes the owner whole set on registration, stopping, and settlement', async () => {
-    const { ctx, session, agent, control } = await harness(true)
-    const abort = new AbortController()
-    const collected = collectJobs(control.control(abort.signal), 3, abort)
-
-    const task = producer()
-    const id = ctx.jobs.start({ ...task.spec, owner: agent })
-    ctx.jobs.kill(id, agent, 'test')
-    task.settle({ status: 'killed', detail: 'signal: SIGTERM' })
-
-    const frames = await collected
-    expect(frames.map(frame => frame.sessionId)).toEqual([session.id, session.id, session.id])
-    expect(frames.map(frame => frame.jobs[0]?.status)).toEqual(['running', 'stopping', 'killed'])
-    expect(frames[2]?.jobs[0]?.detail).toBe('signal: SIGTERM')
-    expect(frames[2]?.jobs[0]?.finishedAt).toBeTypeOf('number')
-  })
-
-  it('drops internal registry fields from the browser view', async () => {
-    const { ctx, agent, control } = await harness(true)
-    const abort = new AbortController()
-    const collected = collectJobs(control.control(abort.signal), 1, abort)
-    ctx.jobs.start({ ...producer().spec, owner: agent, outputLimitBytes: 1_024 })
-
-    const [frame] = await collected
-    expect(Object.keys(frame?.jobs[0] ?? {}).sort()).toEqual([
-      'id',
-      'kind',
-      'label',
-      'startedAt',
-      'status',
-    ])
-  })
-
-  it('fans an unowned change out to every attached session', async () => {
-    const { ctx, control } = await harness(true)
-    const second = ctx.sessions.create()
-    const abort = new AbortController()
-    const collected = collectJobs(control.control(abort.signal), 2, abort)
-
-    ctx.jobs.start(producer('open to every caller').spec)
-
-    const frames = await collected
-    expect(new Set(frames.map(frame => frame.sessionId)).size).toBe(2)
-    expect(frames.some(frame => frame.sessionId === second.id)).toBe(true)
-    for (const frame of frames) expect(frame.jobs[0]?.label).toBe('open to every caller')
-  })
-
-  it('does not resume persisted sessions while projecting an unowned change', async () => {
-    const { ctx, control } = await harness(true)
-    const coldId = SessionId('session-cold-tasks')
-    let loaded = false
-    ctx.provide('sessionPersistence', {
-      list: async () => [{ version: SESSION_FORMAT_VERSION, id: coldId, createdAt: 5, cwd: '/tmp' }],
-      locate: () => undefined,
-      load: () => { loaded = true; throw new Error('job projection must not load a cold log') },
-    } as never)
-    const abort = new AbortController()
-    const collected = collectJobs(control.control(abort.signal), 1, abort)
-
-    ctx.jobs.start(producer().spec)
-    await collected
-    expect(loaded).toBe(false)
-    expect(ctx.agents.get(coldId)).toBeUndefined()
-  })
-
-  it('reports empty sets when no jobs registry is composed', async () => {
-    const { session, control } = await harness(false)
-    const frame = await baseline(control)
-    expect(frame.value.jobs[session.id]).toEqual([])
-  })
-
-  it('never consumes model output while projecting a lifecycle', async () => {
-    const { ctx, agent, control } = await harness(true)
-    const abort = new AbortController()
-    const collected = collectJobs(control.control(abort.signal), 3, abort)
-
-    const task = producer()
-    const id = ctx.jobs.start({ ...task.spec, owner: agent })
-    ctx.jobs.kill(id, agent, 'test')
-    task.settle({ status: 'killed', detail: 'signal: SIGTERM' })
-    await collected
-
-    expect(task.reads.count).toBe(0)
-  })
-
-  it('never consumes model output while producing a baseline', async () => {
-    const { ctx, agent, control } = await harness(true)
-    const task = producer()
-    ctx.jobs.start({ ...task.spec, owner: agent })
-
-    const frame = await baseline(control)
-
-    expect(frame.value.jobs[agent.id]).toHaveLength(1)
-    expect(task.reads.count).toBe(0)
-  })
-
-})
diff --git a/packages/api/session-controller/tests/control-queue.host.spec.ts b/packages/api/session-controller/tests/control-queue.host.spec.ts
index 0c635753ea..ad24ad94fb 100644
--- a/packages/api/session-controller/tests/control-queue.host.spec.ts
+++ b/packages/api/session-controller/tests/control-queue.host.spec.ts
@@ -118,6 +118,23 @@ describe('Session control Inbox projection', () => {
     await iterator.next()
   })
 
+  it('projects inbox state for live and cold sessions', async () => {
+    const { ctx, control, inbox } = await harness()
+    inbox.append('next-turn', message('queued'))
+    const cold = ctx.sessions.create(SessionId('cold-session'))
+
+    const abort = new AbortController()
+    const iterator = control.control(abort.signal)[Symbol.asyncIterator]()
+    const opened = await iterator.next()
+    if (opened.done || opened.value.type !== 'baseline') throw new Error('missing baseline')
+    expect(opened.value.value.projections[cold.id]?.values.inbox).toEqual({ 'next-turn': [], 'next-step': [] })
+    expect(opened.value.value.projections['queue-session' as SessionId]?.values.inbox).toMatchObject({
+      'next-turn': [expect.objectContaining({ content: [{ type: 'text', text: 'queued' }] })],
+    })
+    abort.abort()
+    await iterator.next()
+  })
+
   it('projects the prompt rpcId from a user-rpc source and omits it elsewhere', async () => {
     const { control, inbox } = await harness()
     const identified = createUserMessage({
diff --git a/packages/api/session-controller/tests/inbox-projection.client.spec.ts b/packages/api/session-controller/tests/inbox-projection.client.spec.ts
index 9ae17056e6..0522c8db35 100644
--- a/packages/api/session-controller/tests/inbox-projection.client.spec.ts
+++ b/packages/api/session-controller/tests/inbox-projection.client.spec.ts
@@ -79,7 +79,7 @@ describe('Inbox projection intake', () => {
 
         manager.handleControlFrame({
           type: 'baseline',
-          value: { jobs: {}, projections: { [SID]: {
+          value: { projections: { [SID]: {
             asOfSeq: 20, values: key === 'included' ? { inbox: stale } : {},
           } } },
         })
@@ -107,7 +107,7 @@ describe('Inbox projection intake', () => {
       manager.handleControlFrame({ ...inboxFrame({ ...empty, 'next-turn': [ghost] }), seq: 20 })
       manager.handleControlFrame({ ...inboxFrame(empty), sessionId: hiddenSessionId, seq: 20 })
       const face = manager.get(SID).projections.faceOf('inbox')
-      const baseline = { type: 'baseline', value: { jobs: {}, projections: {} } } as const
+      const baseline = { type: 'baseline', value: { projections: {} } } as const
       const result = ok({ items: [
         { sessionId: SID, updatedAt: 1, running: false, blank: false, agentAvailable: false,
           projections: { kind: 'cached' as const, asOfSeq: 1, values: { inbox: empty } } },
diff --git a/packages/api/session-controller/tests/manager.client.spec.ts b/packages/api/session-controller/tests/manager.client.spec.ts
index 55d182110a..4d91e0b77f 100644
--- a/packages/api/session-controller/tests/manager.client.spec.ts
+++ b/packages/api/session-controller/tests/manager.client.spec.ts
@@ -8,7 +8,6 @@ import type { SessionId } from '@deepseek-ai/dsh-api-remotes/client'
 import type { SubagentAddress } from '@deepseek-ai/dsh-subagent/client'
 import { SessionSeq } from '@deepseek-ai/dsh-session/types'
 import { RemoteError } from '@deepseek-ai/dsh-typert-protocol'
-import type { SessionControlFrame } from '@deepseek-ai/dsh-api-session-controller/types'
 import { ok, type RemoteMock } from '@deepseek-ai/dsh-remote-mock'
 import {
   createClientTest, type ClientTestFixtures, webApp,
@@ -526,10 +525,9 @@ describe('list lifecycle', () => {
       // The control baseline is the connected Session's own value: it replaces
       // the list-surface title even at the same cursor.
       manager.handleControlFrame({
-        type: 'baseline', value: { jobs: { [S1]: [] }, projections: { [S1]: { asOfSeq: -1, values: { title: 'cold baseline' } } } },
+        type: 'baseline', value: { projections: { [S1]: { asOfSeq: -1, values: { title: 'cold baseline' } } } },
       })
       expect(manager.getListSnapshot().items[0]?.title).toBe('cold baseline')
-      expect(manager.getListSnapshot().jobsBySession).toEqual({})
     } finally {
       await manager.dispose()
     }
@@ -666,7 +664,6 @@ describe('list lifecycle', () => {
       manager.handleControlFrame({
         type: 'baseline',
         value: {
-          jobs: {},
           projections: { [S1]: { asOfSeq: 2, values: { title: 'Durable' } } },
         },
       })
@@ -1422,64 +1419,3 @@ describe('running facts without UI reminders', () => {
     expect(manager.getListSnapshot()).not.toHaveProperty('current')
   })
 })
-
-describe('background-job mirror', () => {
-  const view = (over: Partial<{ id: string; status: string; label: string }> = {}) => ({
-    id: 'bash-1', kind: 'bash', label: 'pnpm run build', status: 'running', startedAt: 5, ...over,
-  })
-  const tasksFrame = (
-    sessionId: SessionId,
-    jobs: unknown[],
-  ): Extract<SessionControlFrame, { type: 'jobs' }> => ({
-    type: 'jobs', sessionId, jobs: jobs as never,
-  })
-
-  it('mirrors the whole set last-wins, keyed per session, with no Session instance needed', ({ mock, remote }) => {
-    const manager = makeManager(mock, remote)
-    manager.handleControlFrame(tasksFrame(S1, [view()]))
-    manager.handleControlFrame(tasksFrame(S2, [view({ id: 'pwsh-1', label: 'other' })]))
-    const first = manager.getListSnapshot().jobsBySession
-    expect(first[S1]).toEqual([view()])
-    expect(first[S2]?.[0]?.label).toBe('other')
-
-    // Last-wins: the newer whole set replaces, it does not merge.
-    manager.handleControlFrame(tasksFrame(S1, [view({ status: 'completed' })]))
-    expect(manager.getListSnapshot().jobsBySession[S1]).toEqual([view({ status: 'completed' })])
-  })
-
-  it('stores an emptied set as an absent key so absence and [] read alike', ({ mock, remote }) => {
-    const manager = makeManager(mock, remote)
-    manager.handleControlFrame(tasksFrame(S1, [view()]))
-    expect(S1 in manager.getListSnapshot().jobsBySession).toBe(true)
-    manager.handleControlFrame(tasksFrame(S1, []))
-    expect(S1 in manager.getListSnapshot().jobsBySession).toBe(false)
-  })
-
-  it('clears the mirror when the next control baseline has no jobs', ({ mock, remote }) => {
-    const manager = makeManager(mock, remote)
-    manager.handleControlFrame(tasksFrame(S1, [view()]))
-    manager.handleControlFrame({
-      type: 'baseline',
-      value: { jobs: {}, projections: {} },
-    })
-    expect(S1 in manager.getListSnapshot().jobsBySession).toBe(false)
-  })
-
-  it('drops the rows when the session is removed, whichever stream lands first', ({ mock, remote }) => {
-    const manager = makeManager(mock, remote)
-    manager.handleSessionAdded(summary(S1, { blank: true }))
-    manager.handleControlFrame(tasksFrame(S1, [view()]))
-    manager.handleSessionRemoved(S1)
-    expect(S1 in manager.getListSnapshot().jobsBySession).toBe(false)
-  })
-
-  it('notifies list subscribers so an open header re-renders without a poll', async ({ mock, remote }) => {
-    const manager = makeManager(mock, remote)
-    const seen = vi.fn()
-    manager.subscribe(seen)
-    manager.handleControlFrame(tasksFrame(S1, [view()]))
-    // The notifier batches on a microtask; the frame itself is already applied.
-    await Promise.resolve()
-    expect(seen).toHaveBeenCalled()
-  })
-})
diff --git a/packages/api/session-controller/tests/projection-store.client.spec.ts b/packages/api/session-controller/tests/projection-store.client.spec.ts
index 3ab6ab2de1..c3a14febf3 100644
--- a/packages/api/session-controller/tests/projection-store.client.spec.ts
+++ b/packages/api/session-controller/tests/projection-store.client.spec.ts
@@ -241,7 +241,6 @@ describe('manager frame routing', () => {
     manager.handleControlFrame({
       type: 'baseline',
       value: {
-        jobs: {},
         projections: { [sid('s1')]: { asOfSeq: 2, values: {} } },
       },
     })
@@ -267,7 +266,6 @@ describe('manager frame routing', () => {
     manager.handleControlFrame({
       type: 'baseline',
       value: {
-        jobs: {},
         projections: { [sid('s1')]: { asOfSeq: 2, values: { title: 'Connected title' } } },
       },
     })
@@ -299,7 +297,6 @@ describe('manager frame routing', () => {
     manager.handleControlFrame({
       type: 'baseline',
       value: {
-        jobs: {},
         projections: { [sid('s1')]: { asOfSeq: 2, values: { title: 'Delayed baseline' } } },
       },
     })
diff --git a/packages/api/session-controller/tests/session-open-workspace-path.host.spec.ts b/packages/api/session-controller/tests/session-open-workspace-path.host.spec.ts
index 6a14c7761d..e8216b5214 100644
--- a/packages/api/session-controller/tests/session-open-workspace-path.host.spec.ts
+++ b/packages/api/session-controller/tests/session-open-workspace-path.host.spec.ts
@@ -1,3 +1,4 @@
+import { resolve } from 'node:path'
 import * as nativeCommand from '@deepseek-ai/dsh-native-command'
 import { Context } from '@deepseek-ai/cordis'
 import AgentRegistry from '@deepseek-ai/dsh-agent'
@@ -65,11 +66,11 @@ describe('session/openWorkspacePath', () => {
 
     await expect(remote.openWorkspacePath({ path: '/workspace/project/src/a.ts' }, signal))
       .resolves.toEqual({ ok: true, value: { opened: true } })
-    expect(openPath).toHaveBeenCalledWith('/workspace/project/src/a.ts', signal)
+    expect(openPath).toHaveBeenCalledWith(resolve('/workspace/project/src/a.ts'), signal)
     expect(ctx.agents.list()).toEqual([])
   })
 
-  it('preserves relative and absolute Host-resolvable paths', async () => {
+  it('normalizes relative and absolute Host-resolvable paths', async () => {
     const ctx = await context()
     const openPath = vi.fn((_path: string, _signal: AbortSignal) => Promise.resolve())
     const remote = createSessionTestRemote(ctx, {
@@ -80,7 +81,7 @@ describe('session/openWorkspacePath', () => {
 
     await remote.openWorkspacePath({ path: '/workspace/result.html' })
     await remote.openWorkspacePath({ path: 'result.html' })
-    expect(openPath.mock.calls.map(call => call[0])).toEqual(['/workspace/result.html', 'result.html'])
+    expect(openPath.mock.calls.map(call => call[0])).toEqual([resolve('/workspace/result.html'), resolve('result.html')])
   })
 
   it('rejects empty paths before opening anything', async () => {
@@ -100,7 +101,7 @@ describe('session/openWorkspacePath', () => {
   it('preserves native opener failure and cancellation results', async () => {
     const ctx = await context()
     const openPath = vi.fn((_path: string, _signal: AbortSignal) =>
-      Promise.reject(new Error('desktop unavailable')))
+      Promise.reject(new Error('Command failed: powershell.exe -EncodedCommand private-script-text')))
     const remote = createSessionTestRemote(ctx, {
       defaultModelSelection: () => ({ provider: 'p', model: 'm' }),
       cwd: '/default',
@@ -110,7 +111,7 @@ describe('session/openWorkspacePath', () => {
     await expect(remote.openWorkspacePath({ path: 'result.html' }))
       .resolves.toMatchObject({
         ok: false,
-        error: { code: 'gateway/internal', message: 'path open failed: desktop unavailable' },
+        error: { code: 'gateway/internal', message: 'path open failed' },
       })
 
     const aborted = new AbortController()
@@ -139,7 +140,7 @@ describe('session/openWorkspacePath', () => {
     await expect(controller.openWorkspacePath({
       path: 'second.html',
     }, new AbortController().signal)).rejects.toMatchObject({
-      code: 'gateway/internal', message: 'path open failed: desktop unavailable',
+      code: 'gateway/internal', message: 'path open failed',
     })
   })
 })
@@ -156,7 +157,7 @@ it('reports Host file-manager metadata and dispatches reveal separately from def
     expect(controller.workspaceDesktop()).toMatchObject({ available: true, name: expect.any(String) as string })
     const signal = new AbortController().signal
     await controller.openWorkspacePath({ path: '/workspace/report.txt', action: 'reveal' }, signal)
-    expect(revealPath).toHaveBeenCalledWith('/workspace/report.txt', signal)
+    expect(revealPath).toHaveBeenCalledWith(resolve('/workspace/report.txt'), signal)
     expect(openPath).not.toHaveBeenCalled()
   } finally { await ctx.fiber.dispose() }
 })
@@ -186,7 +187,7 @@ it.each(['open', 'reveal'] as const)('rejects an unmapped remote path before nat
     defaultModelSelection: () => ({ provider: 'p', model: 'm' }), cwd: '/default', openPath, revealPath,
   })
   await expect(controller.openWorkspacePath({ path: '/remote/report.html', ...(action === 'reveal' ? { action } : {}) }, new AbortController().signal))
-    .rejects.toMatchObject({ code: 'gateway/internal', message: 'path open failed: Path has no verified Host path' })
+    .rejects.toMatchObject({ code: 'gateway/bad-request', message: 'Path has no verified Host path' })
   expect(openPath).not.toHaveBeenCalled()
   expect(revealPath).not.toHaveBeenCalled()
 })
@@ -200,7 +201,7 @@ it('rejects a filesystem mapping that resolves to another process path', async (
     defaultModelSelection: () => ({ provider: 'p', model: 'm' }), cwd: '/default', openPath,
   })
   await expect(controller.openWorkspacePath({ path: '/report.html' }, new AbortController().signal))
-    .rejects.toMatchObject({ code: 'gateway/internal', message: 'path open failed: Path has no verified Host path' })
+    .rejects.toMatchObject({ code: 'gateway/bad-request', message: 'Path has no verified Host path' })
   expect(openPath).not.toHaveBeenCalled()
 })
 
@@ -213,5 +214,61 @@ it('dispatches default-app opening to the association adapter', async () => {
   })
   const signal = new AbortController().signal
   await controller.openWorkspacePath({ path: '/report.html' }, signal)
-  expect(open).toHaveBeenCalledWith('/report.html', signal)
+  expect(open).toHaveBeenCalledWith(resolve('/report.html'), signal)
+})
+
+
+it('uses the same path verification for handler queries and explicit application opening', async () => {
+  const ctx = await context()
+  const applications = [{ id: '/Applications/Music.app', name: 'Music', default: true, icon: null }]
+  const fileApplications = vi.fn(async () => applications)
+  const openFileApplication = vi.fn(async () => {})
+  const controller = createSessionTestController(ctx, {
+    defaultModelSelection: () => ({ provider: 'p', model: 'm' }), cwd: '/default', nativeOpen: true,
+    fileApplications, openFileApplication,
+  })
+  const signal = new AbortController().signal
+  expect(await controller.workspacePathApplications({ path: '/file.mp3' }, signal)).toEqual(applications)
+  await controller.openWorkspacePath({ path: '/file.mp3', application: applications[0]!.id }, signal)
+  expect(openFileApplication).toHaveBeenCalledWith(expect.stringContaining('file.mp3'), applications[0]!.id, signal)
+  const mapping = vi.spyOn(ctx.fs, 'processPathFromHostPath').mockReturnValue(undefined)
+  onTestFinished(() => { mapping.mockRestore() })
+  await expect(controller.workspacePathApplications({ path: '/remote.mp3' }, signal)).rejects.toThrow('verified Host path')
+  await expect(controller.openWorkspacePath({ path: '/remote.mp3', application: applications[0]!.id }, signal)).rejects.toThrow('verified Host path')
+  expect(fileApplications).toHaveBeenCalledOnce()
+  expect(openFileApplication).toHaveBeenCalledOnce()
+})
+
+
+it('avoids desktop queries when unavailable and rejects an empty query path', async () => {
+  const fileApplications = vi.fn(async () => [])
+  const unavailable = createSessionTestController(await context(), {
+    defaultModelSelection: () => ({ provider: 'p', model: 'm' }), cwd: '/default', nativeOpen: false, fileApplications,
+  })
+  expect(await unavailable.workspacePathApplications({ path: '/file.mp3' }, new AbortController().signal)).toEqual([])
+  const available = createSessionTestController(await context(), {
+    defaultModelSelection: () => ({ provider: 'p', model: 'm' }), cwd: '/default', nativeOpen: true, fileApplications,
+  })
+  await expect(available.workspacePathApplications({ path: '' }, new AbortController().signal)).rejects.toMatchObject({ code: 'gateway/bad-request' })
+  expect(fileApplications).not.toHaveBeenCalled()
+})
+
+
+it('returns bounded query failures and classifies cancellation through the Remote', async () => {
+  const lifetime = new AbortController()
+  const fileApplications = vi.fn()
+    .mockRejectedValueOnce(new Error('Command failed: osascript -e private-script-text'))
+    .mockImplementationOnce(async () => {
+      lifetime.abort()
+      throw new Error('native query stopped')
+    })
+  const remote = createSessionTestRemote(await context(), {
+    defaultModelSelection: () => ({ provider: 'p', model: 'm' }), cwd: '/default', nativeOpen: true, fileApplications,
+  })
+  await expect(remote.workspacePathApplications({ path: '/file.mp3' })).resolves.toMatchObject({
+    ok: false, error: { code: 'gateway/internal', message: 'file application query failed' },
+  })
+  await expect(remote.workspacePathApplications({ path: '/file.mp3' }, lifetime.signal)).resolves.toMatchObject({
+    ok: false, error: { code: 'gateway/cancelled' },
+  })
 })
diff --git a/packages/api/session-controller/tests/sessions-service.client.spec.ts b/packages/api/session-controller/tests/sessions-service.client.spec.ts
index fc53358241..d4061def11 100644
--- a/packages/api/session-controller/tests/sessions-service.client.spec.ts
+++ b/packages/api/session-controller/tests/sessions-service.client.spec.ts
@@ -461,7 +461,7 @@ describe('scope tree', () => {
     using reference = b.svc.retainAgentScope(sid('s-early'))
     const scoped = reference.binding.ctx
     expect(scopeOf(scoped)).toBe('s-early')
-    b.svc.handleControlFrame({ type: 'baseline', value: { jobs: {}, projections: {} } })
+    b.svc.handleControlFrame({ type: 'baseline', value: { projections: {} } })
     await feedList(b, [])
     expect(b.svc.scope(sid('s-early'))).toBe(scoped)
     reference.release()
diff --git a/packages/api/session-controller/tests/test-remote.ts b/packages/api/session-controller/tests/test-remote.ts
index b4d3db8198..f0abf92ca0 100644
--- a/packages/api/session-controller/tests/test-remote.ts
+++ b/packages/api/session-controller/tests/test-remote.ts
@@ -1,4 +1,5 @@
 /** Test-only direct Remote face over the Session Controller's internal controllers. */
+import type { SessionControllerInternals } from '../src/index.ts'
 
 import { SessionLogOffset } from '@deepseek-ai/dsh-session'
 import type { Context } from '@deepseek-ai/cordis'
@@ -48,6 +49,7 @@ import type {
   SessionListValue,
   SessionOpenWorkspacePathRequest,
   SessionOpenWorkspacePathValue,
+  SessionWorkspacePathApplication,
   SessionPage,
   SessionPageRequest,
   SessionPromptRequest,
@@ -65,6 +67,9 @@ import type {
 
 /** Direct test face matching the generated `ctx.remote.session` unary methods. */
 export interface TestSessionRemote {
+  workspacePathApplications(
+    request: { readonly path: string }, signal?: AbortSignal,
+  ): Promise<RemoteResult<readonly SessionWorkspacePathApplication[]>>
   canOpenWorkspacePath(): Promise<RemoteResult<boolean>>
   list(request: SessionListRequest, signal?: AbortSignal): Promise<RemoteResult<SessionListValue>>
   search(request: SessionSearchRequest, signal?: AbortSignal): Promise<RemoteResult<SessionSearchValue>>
@@ -94,6 +99,8 @@ export interface TestSessionRemoteDefaults {
   readonly nativeOpen?: boolean
   readonly saveDefaultModelSelection?: (selection: AgentModelSelection) => void | Promise<void>
   readonly openPath?: (path: string, signal: AbortSignal) => Promise<void>
+  readonly fileApplications?: SessionControllerInternals['fileApplications']
+  readonly openFileApplication?: SessionControllerInternals['openFileApplication']
   readonly revealPath?: (path: string, signal: AbortSignal) => Promise<void>
   readonly canOpenPath?: () => boolean
 }
@@ -288,6 +295,8 @@ function installControllers(
       },
       {
         ...defaults.openPath === undefined ? {} : { openPath: defaults.openPath },
+        ...defaults.fileApplications === undefined ? {} : { fileApplications: defaults.fileApplications },
+        ...defaults.openFileApplication === undefined ? {} : { openFileApplication: defaults.openFileApplication },
         ...defaults.revealPath === undefined ? {} : { revealPath: defaults.revealPath },
         ...defaults.canOpenPath === undefined ? {} : { canOpenPath: defaults.canOpenPath },
       },
@@ -334,6 +343,9 @@ export function createSessionTestRemote(
 ): TestSessionRemote {
   const direct = createSessionTestController(ctx, defaults)
   return {
+    workspacePathApplications: (request, signal = new AbortController().signal) => remoteResult(
+      () => direct.workspacePathApplications(request, signal), signal,
+    ),
     canOpenWorkspacePath: () => remoteResult(() => direct.canOpenWorkspacePath()),
     list: (request, signal = new AbortController().signal) => remoteResult(
       () => direct.list(request, signal),
diff --git a/packages/api/session-controller/tests/transport.client.spec.ts b/packages/api/session-controller/tests/transport.client.spec.ts
index 45e6c2b039..b0efb1b9bb 100644
--- a/packages/api/session-controller/tests/transport.client.spec.ts
+++ b/packages/api/session-controller/tests/transport.client.spec.ts
@@ -666,10 +666,10 @@ describe('Session Client stream adapters', () => {
   it('maps the Host-wide control baseline and deltas into one snapshot stream', async () => {
     const baseline: SessionControlFrame = {
       type: 'baseline',
-      value: { jobs: {}, projections: {} },
+      value: { projections: {} },
     }
     const update: SessionControlFrame = {
-      type: 'jobs', sessionId: 'session-1' as never, jobs: [],
+      type: 'projection', sessionId: 'session-1' as never, key: 'title', value: 'updated', seq: 1,
     }
     const remote = new ScriptedSessionRemote([], [], [baseline, update])
     const accept = vi.fn<(frame: SessionControlFrame) => void>()
@@ -701,7 +701,7 @@ describe('Session Client stream adapters', () => {
 
     const baseline: SessionControlFrame = {
       type: 'baseline',
-      value: { jobs: {}, projections: {} },
+      value: { projections: {} },
     }
     const carrierFailed = vi.fn()
     const failed = vi.fn()
diff --git a/packages/api/session-controller/tsconfig.client.json b/packages/api/session-controller/tsconfig.client.json
index 3bb07893e2..a1375420ca 100644
--- a/packages/api/session-controller/tsconfig.client.json
+++ b/packages/api/session-controller/tsconfig.client.json
@@ -28,6 +28,7 @@
     { "path": "../../util/crypto" },
     { "path": "../../util/workspace-path" },
     { "path": "../../workspace/workspace" },
-    { "path": "../../typert/protocol" }
+    { "path": "../../typert/protocol" },
+    { "path": "../../util/native-command" }
   ]
 }
diff --git a/packages/bundle/web-app/cordis.patch.yml b/packages/bundle/web-app/cordis.patch.yml
index 72f81ef676..4a055c8fd5 100644
--- a/packages/bundle/web-app/cordis.patch.yml
+++ b/packages/bundle/web-app/cordis.patch.yml
@@ -102,6 +102,10 @@
     - id: session-controller
       name: '@deepseek-ai/dsh-api-session-controller'
 
+    # One background job's observation record streamed over Typert Remote;
+    # the roster rides the session control stream above.
+    - id: job-controller
+      name: '@deepseek-ai/dsh-api-job-controller'
     # Workspace file service: bounded read, directory listing, and the
     # agent-write change feed inside the session workspace root.
     - id: terminal-controller
@@ -324,6 +328,12 @@
     - id: ui-reference
       name: '@deepseek-ai/dsh-client-ui-reference'
 
+
+    # Background jobs: the session-header roster with on-demand streaming
+    # record panels over the session job-output service.
+    - id: ui-jobs
+      name: '@deepseek-ai/dsh-client-ui-jobs'
+
     # Read-only active Schedule catalog. The shipped Web graph resolves the
     # client package but leaves it disabled; the explicit Schedule overlay
     # enables this same row together with the host Schedule services.
@@ -331,10 +341,6 @@
       name: '@deepseek-ai/dsh-client-ui-schedule'
       disabled: true
 
-    # Background jobs: the session-header list over the jobsBySession mirror.
-    - id: ui-jobs
-      name: '@deepseek-ai/dsh-client-ui-jobs'
-
     # Goal surface: GoalBar in the input dock over the goal session projection.
     - id: ui-goal
       name: '@deepseek-ai/dsh-client-ui-goal'
diff --git a/packages/bundle/web-app/package.json b/packages/bundle/web-app/package.json
index cc00c61d15..f40797d498 100644
--- a/packages/bundle/web-app/package.json
+++ b/packages/bundle/web-app/package.json
@@ -40,6 +40,7 @@
   },
   "dependencies": {
     "@deepseek-ai/dsh-agent-presets": "workspace:^",
+    "@deepseek-ai/dsh-api-job-controller": "workspace:^",
     "@deepseek-ai/dsh-api-remotes": "workspace:^",
     "@deepseek-ai/dsh-api-session-controller": "workspace:^",
     "@deepseek-ai/dsh-api-settings-controller": "workspace:^",
diff --git a/packages/client/README.i18n.yaml b/packages/client/README.i18n.yaml
index f77acedd8d..f968140311 100644
--- a/packages/client/README.i18n.yaml
+++ b/packages/client/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/README.md
-README.md: 3d8e52fe6dfc3e517c09f772e63c073957e41cd9
-README.zh.md: 4a547889b9a12af7e65a671bef9176075d55ebc1
+README.md: a7e1397b4b62d883cbe02c4ec23afe35b9f7be9e
+README.zh.md: 01be68b480626aa77bfb361f4dda28c2d1cdfbd9
diff --git a/packages/client/README.md b/packages/client/README.md
index 3d8e52fe6d..a7e1397b4b 100644
--- a/packages/client/README.md
+++ b/packages/client/README.md
@@ -62,8 +62,8 @@ The kernel packages boot and serve the page; the UI feature packages present it.
 | [`ui-skill/`](ui-skill/README.md) | Adds skill references to inline suggestions | — |
 | [`ui-reference/`](ui-reference/README.md) | Unified Web `@file` / `@session` reference source | — |
 | [`ui-subagent/`](ui-subagent/README.md) | Provides subagent navigation, child transcript states, and inline references | — |
+| [`ui-jobs/`](ui-jobs/README.md) | Lists this session's background jobs with on-demand streaming record panels | — |
 | [`ui-schedule/`](ui-schedule/README.md) | Lists the current Session's active reminders in a read-only header catalog | — |
-| [`ui-jobs/`](ui-jobs/README.md) | Lists this session's background jobs in the conversation header | — |
 | [`ui-model-selection/`](ui-model-selection/README.md) | Provides model selection in conversation surfaces | — |
 | [`ui-permission-presets/`](ui-permission-presets/README.md) | Configures default permissions and switches the current session's access | — |
 | [`ui-plan/`](ui-plan/README.md) | Presents active plan-mode status and its exit control | — |
diff --git a/packages/client/README.zh.md b/packages/client/README.zh.md
index 4a547889b9..01be68b480 100644
--- a/packages/client/README.zh.md
+++ b/packages/client/README.zh.md
@@ -62,8 +62,8 @@ kind: "package-group"
 | [`ui-skill/`](ui-skill/README.zh.md) | 向内联建议添加 skill（技能）引用 | — |
 | [`ui-reference/`](ui-reference/README.zh.md) | 统一的 Web `@file` / `@session` 引用 source | — |
 | [`ui-subagent/`](ui-subagent/README.zh.md) | 提供 subagent 导航、子级 transcript（文本记录）状态与内联引用 | — |
+| [`ui-jobs/`](ui-jobs/README.zh.md) | 列出本会话的后台任务，并提供按需展开的流式输出面板 | — |
 | [`ui-schedule/`](ui-schedule/README.zh.md) | 在只读标题栏目录中列出当前会话中生效的提醒 | — |
-| [`ui-jobs/`](ui-jobs/README.zh.md) | 在会话标题栏列出当前会话的后台任务 | — |
 | [`ui-model-selection/`](ui-model-selection/README.zh.md) | 在对话界面中提供模型选择 | — |
 | [`ui-permission-presets/`](ui-permission-presets/README.zh.md) | 配置默认权限并切换当前会话的访问模式 | — |
 | [`ui-plan/`](ui-plan/README.zh.md) | 展示生效中的 plan mode 状态及其退出控件 | — |
diff --git a/packages/client/locale/tests/language-row.client.spec.tsx b/packages/client/locale/tests/language-row.client.spec.tsx
index 5068b90218..776542c0f2 100644
--- a/packages/client/locale/tests/language-row.client.spec.tsx
+++ b/packages/client/locale/tests/language-row.client.spec.tsx
@@ -20,7 +20,7 @@ const OPTIONS = [{ id: 'zh', label: '中文' }, { id: 'en', label: 'English' }]
 
 function emptySessions() {
   const store = createSnapshotStore<SessionListState>(
-    { ids: [], byId: {}, phase: 'ready', projectionsBySession: {}, jobsBySession: {} })
+    { ids: [], byId: {}, phase: 'ready', projectionsBySession: {} })
   return bindSnapshotSelector(store)
 }
 function emptyWorkspaces() {
diff --git a/packages/client/tsdown.client.ts b/packages/client/tsdown.client.ts
index b8468c0957..5e9592ba70 100644
--- a/packages/client/tsdown.client.ts
+++ b/packages/client/tsdown.client.ts
@@ -61,7 +61,7 @@ function styleInjectionModule(
  * Everything else under @deepseek-ai/* is either a module-table entry
  * (external) or a leak the purity gate rejects.
  */
-export const INLINE_SAFE = /^(?:@deepseek-ai\/dsh-(?:file-reference|session|llm|tools|brand|deque|output-retention|typert-protocol|util-crypto|util-values|util-workspace-path)(?:\/|$)|@deepseek-ai\/dsh-token-meter\/client$|@deepseek-ai\/dsh-host-open-in-app\/shared$|@deepseek-ai\/dsh-plugin-manager\/registry$|@deepseek-ai\/dsh-agent-presets\/display$|@deepseek-ai\/dsh-spill-policy\/notice$)/
+export const INLINE_SAFE = /^(?:@deepseek-ai\/dsh-(?:file-reference|session|llm|tools|brand|deque|output-retention|typert-protocol|util-crypto|util-values|util-workspace-path)(?:\/|$)|@deepseek-ai\/dsh-token-meter\/client$|@deepseek-ai\/dsh-native-command\/types$|@deepseek-ai\/dsh-host-open-in-app\/shared$|@deepseek-ai\/dsh-plugin-manager\/registry$|@deepseek-ai\/dsh-agent-presets\/display$|@deepseek-ai\/dsh-spill-policy\/notice$)/
 
 /**
  * Vendored framework libraries: rescoped into @deepseek-ai, so the gate below
diff --git a/packages/client/ui-approval/src/client/contract/slots.ts b/packages/client/ui-approval/src/client/contract/slots.ts
index 99296e0c92..875fe5ea36 100644
--- a/packages/client/ui-approval/src/client/contract/slots.ts
+++ b/packages/client/ui-approval/src/client/contract/slots.ts
@@ -65,6 +65,9 @@ export type ApprovalDecision = 'allowed-once' | 'rejected'
 
 let nextApprovalKey = 0
 
+/** Domain discriminator literal carried by {@link PendingApproval.kind}. */
+export type ApprovalInteractionKind = 'approval'
+
 /** One answerable Client presentation of a pending Host waterfall. */
 export class PendingApproval {
   /** Domain discriminator used by Session pending-interaction consumers. */
diff --git a/packages/client/ui-attachment/README.i18n.yaml b/packages/client/ui-attachment/README.i18n.yaml
index 5ce716a2ae..0fad5492e0 100644
--- a/packages/client/ui-attachment/README.i18n.yaml
+++ b/packages/client/ui-attachment/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-attachment/README.md
-README.md: 0765068c73c8ca3cf79b8b23a54629669625ca2e
-README.zh.md: 5976acfda5b605dd85ba3d43e18a83af4d9d58e0
+README.md: 5a3e697189936a79df19ff9b976f06e0dd6191fb
+README.zh.md: 4168650770f42e7b94146041f37ffc440a5ec52e
diff --git a/packages/client/ui-attachment/README.md b/packages/client/ui-attachment/README.md
index 0765068c73..5a3e697189 100644
--- a/packages/client/ui-attachment/README.md
+++ b/packages/client/ui-attachment/README.md
@@ -39,7 +39,7 @@ Trajectory attachment rows request 48px square thumbnails that contain the compl
 
 ### Drop overlay
 
-While a file drag is over the page, the full-viewport overlay announces the drop: illustration, title, and a limits line when drops are accepted. The overlay only shows state — the owner's document-level listeners decide accept or reject.
+While a file drag is over the page, the full-viewport overlay announces the drop: illustration, title, and a limits line when drops are accepted. The overlay only shows state — the owner's document-level listeners decide accept or reject, and the drop handler reports which dropped members are directories through the entry API so the owner can cite or refuse them.
 
 -----
 
diff --git a/packages/client/ui-attachment/README.zh.md b/packages/client/ui-attachment/README.zh.md
index 5976acfda5..4168650770 100644
--- a/packages/client/ui-attachment/README.zh.md
+++ b/packages/client/ui-attachment/README.zh.md
@@ -39,7 +39,7 @@ Trajectory 附件行使用 48px 方形缩略图，完整缩放图片而不裁剪
 
 ### 拖放遮罩
 
-文件拖到页面上方时，全视口遮罩显示拖放提示，包括插画和标题；接受拖放时还会显示一行限制说明。遮罩只呈现状态——是否接受由持有方的文档级监听器决定。
+文件拖到页面上方时，全视口遮罩显示拖放提示，包括插画和标题；接受拖放时还会显示一行限制说明。遮罩只呈现状态，是否接受由持有方的文档级监听器决定，拖放处理器通过 entry API 报告放下的成员中哪些是文件夹，以便持有方引用或拒绝它们。
 
 -----
 
diff --git a/packages/client/ui-attachment/src/client/drop-events.ts b/packages/client/ui-attachment/src/client/drop-events.ts
index e04cbd43d0..2f3da69372 100644
--- a/packages/client/ui-attachment/src/client/drop-events.ts
+++ b/packages/client/ui-attachment/src/client/drop-events.ts
@@ -1,6 +1,24 @@
 /** Document drag-and-drop listeners owned by one mounted attachment view. */
 import type { ComposerAttachmentsProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
 
+/**
+ * Members of a drop that are directories. The `File` a directory drop yields
+ * is indistinguishable from an empty file, so the entry API is the only
+ * source of that fact; browsers without it report no directories.
+ */
+function droppedDirectories(dataTransfer: DataTransfer, files: readonly File[]): ReadonlySet<File> {
+  const directories = new Set<File>()
+  let fileIndex = 0
+  for (const item of dataTransfer.items) {
+    if (item.kind !== 'file') continue
+    const file = files[fileIndex++]
+    if (typeof item.webkitGetAsEntry !== 'function') continue
+    if (item.webkitGetAsEntry()?.isDirectory !== true) continue
+    if (file !== undefined) directories.add(file)
+  }
+  return directories
+}
+
 /**
  * Install one attachment view's file-drop listeners.
  * @param canAcceptDrop - whether this view accepts the dropped files.
@@ -49,7 +67,10 @@ export function installDocumentDropEvents(
     if (dataTransfer === null) return
     event.preventDefault()
     reset()
-    if (canAcceptDrop) onAddFiles([...dataTransfer.files])
+    if (canAcceptDrop) {
+      const files = [...dataTransfer.files]
+      onAddFiles(files, droppedDirectories(dataTransfer, files))
+    }
   }
   document.addEventListener('dragenter', onDragEnter)
   document.addEventListener('dragover', onDragOver)
diff --git a/packages/client/ui-attachment/tests/composer-attachments.client.spec.tsx b/packages/client/ui-attachment/tests/composer-attachments.client.spec.tsx
index c0d0920c52..057e29dc9c 100644
--- a/packages/client/ui-attachment/tests/composer-attachments.client.spec.tsx
+++ b/packages/client/ui-attachment/tests/composer-attachments.client.spec.tsx
@@ -103,20 +103,49 @@ describe('ComposerAttachments', () => {
     expect(view.queryByRole('status')).toBeNull()
 
     const image = attachment('dropped').file
-    const dataTransfer = { types: ['Files'], files: [image], dropEffect: 'none' }
+    const dataTransfer = { types: ['Files'], files: [image], items: [], dropEffect: 'none' }
     expect(fireEvent.dragEnter(document.body, { dataTransfer })).toBe(false)
     expect(view.getByRole('status').textContent).toContain('文件或图片拖动到此处即可添加')
     expect(view.getByRole('status').textContent).toContain('图片限制：最多 20 张，每张 5MB')
     expect(fireEvent.dragOver(document.body, { dataTransfer })).toBe(false)
     expect(dataTransfer.dropEffect).toBe('copy')
     expect(fireEvent.drop(document.body, { dataTransfer })).toBe(false)
-    expect(onAddFiles).toHaveBeenCalledWith([image])
+    expect(onAddFiles).toHaveBeenCalledWith([image], new Set())
     expect(view.queryByRole('status')).toBeNull()
   })
 
+  it('reports dropped directories from the entry API beside the dropped files', () => {
+    const onAddFiles = vi.fn()
+    render(<ComposerAttachments {...props({ onAddFiles })} />)
+    const folder = new File([], 'project')
+    const note = new File([Uint8Array.of(1)], 'notes.md', { type: 'text/markdown' })
+    const entry = (isDirectory: boolean | null, file: File) => ({
+      kind: 'file', getAsFile: () => new File([], file.name), webkitGetAsEntry: () => (isDirectory === null ? null : { isDirectory }),
+    })
+    fireEvent.drop(document.body, {
+      dataTransfer: {
+        types: ['Files'],
+        files: [folder, note],
+        items: [entry(true, folder), entry(false, note), { kind: 'string', getAsFile: () => null }],
+        dropEffect: 'none',
+      },
+    })
+    expect(onAddFiles).toHaveBeenCalledWith([folder, note], new Set([folder]))
+    // An entry API that answers nothing, or a browser without it, reports no directories.
+    fireEvent.drop(document.body, {
+      dataTransfer: {
+        types: ['Files'],
+        files: [note],
+        items: [entry(null, note), { kind: 'file', getAsFile: () => note }, entry(true, folder)],
+        dropEffect: 'none',
+      },
+    })
+    expect(onAddFiles).toHaveBeenLastCalledWith([note], new Set())
+  })
+
   it('tracks nested file drags and clears an aborted drag', () => {
     const view = render(<ComposerAttachments {...props()} />)
-    const dataTransfer = { types: ['Files'], files: [], dropEffect: 'none' }
+    const dataTransfer = { types: ['Files'], files: [], items: [], dropEffect: 'none' }
     fireEvent.dragLeave(document.body, {
       dataTransfer: { types: ['text/plain'], files: [], dropEffect: 'none' },
     })
@@ -144,7 +173,7 @@ describe('ComposerAttachments', () => {
     const onAddFiles = vi.fn()
     const view = render(<ComposerAttachments {...props({ canAcceptDrop: false, onAddFiles })} />)
     const image = attachment('blocked').file
-    const dataTransfer = { types: ['Files'], files: [image], dropEffect: 'copy' }
+    const dataTransfer = { types: ['Files'], files: [image], items: [], dropEffect: 'copy' }
     fireEvent.dragEnter(document.body, { dataTransfer })
     expect(view.getByRole('status').textContent).toBe('当前无法添加文件或图片')
     fireEvent.dragOver(document.body, { dataTransfer })
diff --git a/packages/client/ui-attachment/tests/message-image.client.spec.tsx b/packages/client/ui-attachment/tests/message-image.client.spec.tsx
index ee14237ad5..21db2ee64e 100644
--- a/packages/client/ui-attachment/tests/message-image.client.spec.tsx
+++ b/packages/client/ui-attachment/tests/message-image.client.spec.tsx
@@ -327,6 +327,8 @@ describe('ImageGallery', () => {
       useTrajectory,
       useInput,
       inputActions: {
+        captureInsertion: () => ({ start: 0, end: 0, draftRev: 0 }),
+        insertText: () => false,
         setDraft: vi.fn(),
         addAttachments: vi.fn(() => true),
         removeAttachment: vi.fn(),
diff --git a/packages/client/ui-chat/tests/chat-view.client.spec.tsx b/packages/client/ui-chat/tests/chat-view.client.spec.tsx
index 1ee50e0265..db60f029a9 100644
--- a/packages/client/ui-chat/tests/chat-view.client.spec.tsx
+++ b/packages/client/ui-chat/tests/chat-view.client.spec.tsx
@@ -207,7 +207,7 @@ const compaction = (over: Partial<CompactionSummaryNode> = {}): CompactionSummar
 /** Empty sessions-list hook for the global standard-kit seat. */
 function emptySessions() {
   const store = createSnapshotStore<SessionListState>(
-    { ids: [], byId: {}, phase: 'ready', projectionsBySession: {}, jobsBySession: {} })
+    { ids: [], byId: {}, phase: 'ready', projectionsBySession: {} })
   return bindSnapshotSelector(store)
 }
 
@@ -395,6 +395,8 @@ function makeHarness(
     },
     useInput: (() => { throw new Error('unused') }),
     inputActions: {
+      captureInsertion: () => ({ start: 0, end: 0, draftRev: 0 }),
+      insertText: () => false,
       setDraft: () => {},
       addAttachments: () => true,
       removeAttachment: () => {},
diff --git a/packages/client/ui-chat/tests/transcript-view-row.client.spec.tsx b/packages/client/ui-chat/tests/transcript-view-row.client.spec.tsx
index 6d578cb38f..98154b74cc 100644
--- a/packages/client/ui-chat/tests/transcript-view-row.client.spec.tsx
+++ b/packages/client/ui-chat/tests/transcript-view-row.client.spec.tsx
@@ -17,7 +17,7 @@ afterEach(cleanup)
 
 function emptySessions() {
   return bindSnapshotSelector(createSnapshotStore<SessionListState>({
-    ids: [], byId: {}, phase: 'ready', projectionsBySession: {}, jobsBySession: {},
+    ids: [], byId: {}, phase: 'ready', projectionsBySession: {},
   }))
 }
 
diff --git a/packages/client/ui-chat/tsconfig.json b/packages/client/ui-chat/tsconfig.json
index a004571d35..92dffe85b0 100644
--- a/packages/client/ui-chat/tsconfig.json
+++ b/packages/client/ui-chat/tsconfig.json
@@ -90,7 +90,7 @@
       "path": "../ui-session"
     },
     {
-      "path": "../ui-sidebar-browser"
+      "path": "../ui-sidebar-browser/tsconfig.client.json"
     },
     {
       "path": "../ui-sidebar-right"
diff --git a/packages/client/ui-conversation/README.i18n.yaml b/packages/client/ui-conversation/README.i18n.yaml
index b871029e8d..2f52a3e505 100644
--- a/packages/client/ui-conversation/README.i18n.yaml
+++ b/packages/client/ui-conversation/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-conversation/README.md
-README.md: 16e821ed4caabae491d552a823bd69a2e976e2bd
-README.zh.md: 7316b00c69ca74284b81678082d93e870dee6bbe
+README.md: 31b35ef7460c9fecd119e32ae5f696f55585a726
+README.zh.md: 1fb648bf9539cebc307e094c2fe46b1d1749edab
diff --git a/packages/client/ui-conversation/README.md b/packages/client/ui-conversation/README.md
index 16e821ed4c..31b35ef746 100644
--- a/packages/client/ui-conversation/README.md
+++ b/packages/client/ui-conversation/README.md
@@ -62,7 +62,7 @@ Active transcripts in the main occurrence expose content-width drag handles in t
 
 The resident composer survives no-Session and Session transitions. Whitespace hides its placeholder; a whitespace-only draft without attachments cannot be sent. The no-Session state keeps the same composer surface mounted but inert while the Workspace picker connects a blank Session. The surface is a shell-owned Lexical editor: reference chips are atomic decorator nodes carrying the owner's serialization identity (submission expands them through the owner codec), claimed slash commands stay styled leading text, folder text references carry the folder glyph as an icon prefix, and the draft's clipboard projection is mirrored into the per-Session Conversation store. QueueDock reads `next-turn` directly from the Session `inbox` projection, including cold recovered messages. Queue operations address exact queue occurrences through the scoped `ctx.conversation` service; queue previews render sent text through the shared inline reference projection from `ui-primitives` (wire session forms fold to their label) and show local or durable images and files in original attachment order. Images use thumbnails; files use compact name-and-size cards. An edit exposes the literal sent text, and durable thumbnails resolve through the session image URL cache. Busy Enter behavior is stored in the Host-backed `ui-conversation` settings namespace. The composer keymap arbitrates the trigger menu's keys through the slash pipeline — Tab settles the highlighted completion (or drills a drillable one), Escape and Shift+Tab leave the menu without settling — and leaves every other key to the editor. An overlay that takes the keyboard hands it back through `SessionInput.focus()`, which rides Lexical's own focus so the caret returns where the draft left it rather than at the start.
 
-Default sends commit optimistically: Enter clears the draft, occurrence table, and undo history in the same transaction, keeps the composer in `plain`, and runs the send as a detached attempt, so typing and further sends continue during the flight. `sendSession` registers a Session submission echo (`session.beginSubmission`) with the delivery mode before serializing, preserving selected image and file order in `pendingSubmissions`; Session derives the placement from that mode and its current running state, so idle sends use the transcript, busy Queue sends use QueueDock, and busy Steer sends use the pending-steering surface. It then yields one paint, encodes images through the browser's native `FileReader` data-URL path, and cites staged file receipts. Command submissions use the same receipts for generic files, so sending `/goal` or `/plan` never reads those browser files again. The prompt reuses the submission `requestId`; queue and history observation by that `rpcId` retires the echo once. Concurrent failures are restored together in submission order until the user edits the restored content; command submissions keep the frozen `submitting` phase. Detached attempts retain their attachment ids through admission and Session scope disposal. An observed retirement immediately exposes each image preview through the durable cache, replaces it with the canonical URL after fetching the admitted attachment, revokes each URL after its use ends, and releases file cards. Selected generic files enter one FIFO background-upload queue; `maxConcurrentFileUploads` defaults to two active Worker transports, the Conversation service retains queued and active operations plus byte progress across Session navigation, and removing a draft skips its queued transfer or aborts its active transport. Continuable subagents disable attachment intake and skip local echoes because their transport does not preserve the browser request id.
+Default sends commit optimistically: Enter clears the draft, occurrence table, and undo history in the same transaction, keeps the composer in `plain`, and runs the send as a detached attempt, so typing and further sends continue during the flight. `sendSession` registers a Session submission echo (`session.beginSubmission`) with the delivery mode before serializing, preserving selected image and file order in `pendingSubmissions`; Session derives the placement from that mode and its current running state, so idle sends use the transcript, busy Queue sends use QueueDock, and busy Steer sends use the pending-steering surface. It then yields one paint, encodes images through the browser's native `FileReader` data-URL path, and cites staged file receipts. Command submissions use the same receipts for generic files, so sending `/goal` or `/plan` never reads those browser files again. The prompt reuses the submission `requestId`; queue and history observation by that `rpcId` retires the echo once. Concurrent failures are restored together in submission order until the user edits the restored content; command submissions keep the frozen `submitting` phase. Detached attempts retain their attachment ids through admission and Session scope disposal. An observed retirement immediately exposes each image preview through the durable cache, replaces it with the canonical URL after fetching the admitted attachment, revokes each URL after its use ends, and releases file cards. Selected generic files enter one FIFO background-upload queue; `maxConcurrentFileUploads` defaults to two active Worker transports, the Conversation service retains queued and active operations plus byte progress across Session navigation, and removing a draft skips its queued transfer or aborts its active transport. Where the browser shell exposes `__DSH_HOST_PATHS__` (the Desktop application), dropped or pasted folders and dropped, picked, or pasted non-image files with a real path become `@path` chips; images keep uploading. Drag-and-drop and paste identify directories through the browser entry API; when that API is absent or returns no entry, pasted items retain ordinary file handling. The file picker cannot select directories. References require the `ui-reference` plugin and the original paths to remain readable by the model's file tools. Paths inside the workspace are relative; others remain absolute. The whole batch is validated before insertion, retains source order and selected text, and uses whitespace-separated, closed-quote mentions. A browser without the bridge refuses dropped or pasted folders; a Desktop folder without a reported path is rejected separately. Continuable subagents disable attachment intake and skip local echoes because their transport does not preserve the browser request id.
 
 Queued submission echoes show “Sending…” beside disabled edit, remove, and steer buttons; a collapsed dock keeps the sending status in its header. A matching Host queue row replaces the echo and enables each action according to its normal text-content and running-state requirements. Prompt acknowledgement alone does not enable queue actions. A failed submission removes its echo and displays an error; the composer restores the failed draft when it is empty or still contains the previous automatic restoration, preserving subsequently typed text.
 
@@ -120,6 +120,10 @@ try {
 
 The selector must be a pure function of the owner currency. Its non-null return is delivered to the component as `matched`; `PropsRuntime<'conversation.composer'>` supplies the standard Session and global props. Chain order remains ascending `priority`, then registration order, and the first non-null selector wins. The shell keeps the default composer mounted beneath a takeover. Request state, listeners, response encoding, and any request-specific child slots belong to the business package; they are not carried by `SessionSnapshot` or declared by this core package.
 
+`InputActions.captureInsertion()` captures the draft selection and revision; `insertText(text, span)` inserts one undoable plain-text edit only while that revision is current and the editor permits editing. Asynchronous consumers retain rejected results for user action.
+
+`conversation.input.activity` hosts one control between the model selector and Send. Its `onActiveChange` callback expands that control across the toolbar and hides ordinary accessory controls and the context meter while preserving the editor and submit action. Closing the activity restores those controls with context details closed. The empty hero dock remains collapsed when it has no content. The occupant releases expansion on unmount and owns any activity-specific feedback.
+
 <a id="model-experience"></a>
 ## Model Experience
 
diff --git a/packages/client/ui-conversation/README.zh.md b/packages/client/ui-conversation/README.zh.md
index 7316b00c69..1fb648bf95 100644
--- a/packages/client/ui-conversation/README.zh.md
+++ b/packages/client/ui-conversation/README.zh.md
@@ -62,7 +62,7 @@ Session 首次绑定或缓存的 Session 成为 current 时，shell 会在渲染
 
 常驻 composer 在无 Session 与有 Session 之间保持挂载。输入空白字符会隐藏占位提示；没有附件的纯空白草稿无法发送。无 Session 时，同一个编辑器表面保持 inert，Workspace picker 连接 blank Session。该表面是 shell 所有的 Lexical 编辑器：引用 chip 是携带 owner 序列化身份的原子 decorator 节点（提交时经 owner codec 展开），已认领的 slash command 保持为带样式的行首文本，文件夹文本引用以图标前缀携带文件夹图形，草稿的剪贴板投影镜像到逐 Session Conversation store。QueueDock 直接从 Session 的 `inbox` 投影读取 `next-turn`，包含从冷状态恢复的消息。Queue 操作通过 scoped `ctx.conversation` service 寻址准确的 queue occurrence；queue 预览经 `ui-primitives` 的共享行内引用投影渲染已发送文本（wire 会话形式折叠为其标签），并按原始附件顺序展示本地或持久化的图片和文件。图片使用缩略图，文件使用紧凑的名称与大小卡片。编辑态展示字面发送文本，持久化缩略图通过会话图片 URL 缓存解析。繁忙时 Enter 行为保存在 Host-backed `ui-conversation` settings namespace。 composer 键盘映射经斜杠流水线裁决触发菜单的按键——Tab 确认高亮补全项（可下钻项则下钻），Escape 与 Shift+Tab 离开菜单且不选定——其余按键交给编辑器自身。 接管键盘的浮层通过 `SessionInput.focus()` 把键盘还回来，该路径走 Lexical 自己的 focus，因此光标回到草稿原来的位置而不是开头。
 
-默认发送采用乐观提交：Enter 在同一事务里清空草稿、occurrence 表和撤销历史，composer 保持 `plain`，发送作为 detached attempt 运行，发送期间可以继续输入和提交。`sendSession` 在序列化之前用投递模式注册 Session 提交回显（`session.beginSubmission`），并在 `pendingSubmissions` 中保留图片与文件的选择顺序；Session 根据该模式与当前运行状态推导位置，因此空闲发送进入 transcript（文本记录），繁忙时 Queue 进入 QueueDock，繁忙时 Steer 进入 pending-steering 区域。随后让出一帧，图片经浏览器原生 `FileReader` data-URL 路径编码，文件则引用已暂存凭证。命令提交也用同一凭证表示通用文件，因此发送 `/goal` 或 `/plan` 时不会再次读取这些浏览器文件。提示词复用提交 `requestId`；queue 或历史以同一 `rpcId` 被观察后，回显只退休一次。多个并发发送失败时，在用户编辑还原内容之前按提交顺序合并还原；命令提交保持冻结的 `submitting` 阶段。Detached attempt 持有附件 id，直到 admission 完成或 Session scope 销毁。回显以 observed 退休时，durable 图片缓存立即公开每个预览 URL，读取 admitted 附件后用规范化 URL 替换预览，并在各 URL 停止使用后撤销，同时释放文件卡。选中的通用文件进入同一个先进先出的后台上传队列；`maxConcurrentFileUploads` 默认允许两个 Worker transport 同时运行，Conversation 服务在切换 Session 时继续持有排队和运行中的传输操作及字节进度，移除草稿会跳过排队中的传输或中止正在运行的传输。continuable 子代理禁用附件入口，也不创建本地回显，因为其 transport 不保留浏览器 request id。
+默认发送采用乐观提交：Enter 在同一事务里清空草稿、occurrence 表和撤销历史，composer 保持 `plain`，发送作为 detached attempt 运行，发送期间可以继续输入和提交。`sendSession` 在序列化之前用投递模式注册 Session 提交回显（`session.beginSubmission`），并在 `pendingSubmissions` 中保留图片与文件的选择顺序；Session 根据该模式与当前运行状态推导位置，因此空闲发送进入 transcript（文本记录），繁忙时 Queue 进入 QueueDock，繁忙时 Steer 进入 pending-steering 区域。随后让出一帧，图片经浏览器原生 `FileReader` data-URL 路径编码，文件则引用已暂存凭证。命令提交也用同一凭证表示通用文件，因此发送 `/goal` 或 `/plan` 时不会再次读取这些浏览器文件。提示词复用提交 `requestId`；queue 或历史以同一 `rpcId` 被观察后，回显只退休一次。多个并发发送失败时，在用户编辑还原内容之前按提交顺序合并还原；命令提交保持冻结的 `submitting` 阶段。Detached attempt 持有附件 id，直到 admission 完成或 Session scope 销毁。回显以 observed 退休时，durable 图片缓存立即公开每个预览 URL，读取 admitted 附件后用规范化 URL 替换预览，并在各 URL 停止使用后撤销，同时释放文件卡。选中的通用文件进入同一个先进先出的后台上传队列；`maxConcurrentFileUploads` 默认允许两个 Worker transport 同时运行，Conversation 服务在切换 Session 时继续持有排队和运行中的传输操作及字节进度，移除草稿会跳过排队中的传输或中止正在运行的传输。浏览器 shell 暴露 `__DSH_HOST_PATHS__` 时（桌面应用），拖入或粘贴的文件夹以及拖入、选择或粘贴的带真实路径的非图片文件会成为 `@路径` chip；图片仍然上传。拖放和粘贴通过浏览器 entry API 识别目录；该 API 不可用或没有返回 entry 时，粘贴项沿用普通文件处理。文件选择器不能选择目录。引用需要启用 `ui-reference` 插件，原路径也必须仍可由模型的文件工具读取。工作区内的路径使用相对形式，其他路径保留绝对形式。整批文件先校验再插入，保留来源顺序和已选中的文字，引用之间有空白分隔，含空格的路径使用闭合引号。没有该桥的浏览器会拒绝拖入或粘贴的文件夹，桌面端无法获取文件夹路径时单独报错。continuable 子代理禁用附件入口，也不创建本地回显，因为其 transport 不保留浏览器 request id。
 
 排队提交的本地回显在禁用的编辑、删除、插话按钮旁显示“发送中…”；折叠后的队列在标题栏保留发送状态。匹配的 Host 队列行替换回显后，各操作按原有的纯文本内容和运行状态要求启用。仅收到提示词确认不会启用队列操作。提交失败会移除回显并显示错误；输入框为空或仍保留上一次自动恢复的内容时，composer 恢复失败草稿，保留用户随后输入的文字。
 
@@ -120,6 +120,10 @@ try {
 
 selector 必须是 owner currency 的纯函数。非 null 返回值作为 `matched` 传给组件；`PropsRuntime<'conversation.composer'>` 提供标准 Session 与 global props。Chain 顺序仍按 `priority` 升序，再按注册顺序；首个返回非 null 的 selector 获选。Shell 会在 takeover 下保持默认 composer 挂载。Request 状态、listener、response encoding 和任何 request-specific child slot 都属于业务 package，不进入 `SessionSnapshot`，也不由 core 包声明。
 
+`InputActions.captureInsertion()` 捕获草稿选区与版本；`insertText(text, span)` 仅在版本未变且编辑器允许编辑时，插入一次可撤销的纯文本编辑。异步消费者在插入被拒绝后负责保留结果，等待用户操作。
+
+`conversation.input.activity` 在模型选择器与发送按钮之间承载一个控件。其 `onActiveChange` 回调将控件展开至整条工具栏并隐藏普通辅助控件和上下文用量按钮，同时保留编辑器与提交按钮。关闭活动后恢复这些控件，上下文详情保持关闭。首页输入框下方没有内容时，该区域保持收起。占用者在卸载时释放展开状态，并拥有活动专属反馈。
+
 <a id="model-experience"></a>
 ## 模型体验
 
diff --git a/packages/client/ui-conversation/package.json b/packages/client/ui-conversation/package.json
index 8a92b63714..e5b6bcdf2b 100644
--- a/packages/client/ui-conversation/package.json
+++ b/packages/client/ui-conversation/package.json
@@ -80,6 +80,7 @@
     "@deepseek-ai/dsh-tool-todo": "workspace:^",
     "@deepseek-ai/dsh-util-crypto": "workspace:^",
     "@deepseek-ai/dsh-workspace": "workspace:^",
+    "@deepseek-ai/dsh-file-reference": "workspace:^",
     "@deepseek-ai/dsh-util-workspace-path": "workspace:^",
     "@types/react": "~18.3.1",
     "react": "^18.2.0",
diff --git a/packages/client/ui-conversation/src/client/apply.ts b/packages/client/ui-conversation/src/client/apply.ts
index 07d754d873..760f7ac07b 100644
--- a/packages/client/ui-conversation/src/client/apply.ts
+++ b/packages/client/ui-conversation/src/client/apply.ts
@@ -18,8 +18,11 @@ import type {
   ConversationSessionInjected, DraftFileUploads,
 } from './contract/slots.ts'
 import type { InputNotice } from './contract/input.ts'
+import type { ReferenceInsert } from './contract/draft-editor.ts'
 import { createConversationStore, readConversationViewPreference } from './stores.ts'
-import { ConversationController, UnsupportedImageMediaTypeError } from './service.ts'
+import { formatFileMention } from '@deepseek-ai/dsh-file-reference/grammar'
+import { relativizeToCwd, workspaceTitleOf } from '@deepseek-ai/dsh-util-workspace-path'
+import { ConversationController, UnsupportedImageMediaTypeError, isImageMediaType } from './service.ts'
 import type { IConversation } from './service.ts'
 import { ComposerBlockRegistry } from './input/blocks.ts'
 import type { ComposerBlock } from './contract/composer-blocks.ts'
@@ -87,6 +90,21 @@ const ABSENT_FILE_UPLOADS = {
   subscribe: () => () => {},
 }
 
+/**
+ * Browser-shell bridge reporting the harness-host path of a picked file. The
+ * Desktop preload exposes it on the application document; a served Web page
+ * has none, so every non-image file uploads there.
+ */
+interface HostPathBridge {
+  /** Absolute harness-host path of one picked file, or empty when the shell has none for it. */
+  pathFor(file: File): string
+}
+
+/** The shell-installed bridge, when this document runs inside the Desktop application. */
+function hostPathBridge(): HostPathBridge | undefined {
+  return (globalThis as { __DSH_HOST_PATHS__?: HostPathBridge }).__DSH_HOST_PATHS__
+}
+
 interface WorkspaceNavigation {
   openSession(sessionId: SessionId): void
   openWorkspace(
@@ -368,6 +386,7 @@ export function apply(ctx: Context, config: Config = Config({})): void {
       'conversation.input.plan': { kind: 'single', scope: 'session' },
       'conversation.input.right': { kind: 'list', scope: 'session' },
       'conversation.input.model': { kind: 'single', scope: 'session' },
+      'conversation.input.activity': { kind: 'single', scope: 'session' },
       'conversation.composer.dock': { kind: 'list', scope: 'session' },
     },
     inject: (sessionId: SessionId | undefined): ComposerBarInjected => {
@@ -392,14 +411,41 @@ export function apply(ctx: Context, config: Config = Config({})): void {
       const conversation = concreteConversation(ctx)
       const shell = inputHub.shell(sessionId)
       const inputTriggers = inputHub.inputTriggers(sessionId)
+      const bridge = hostPathBridge()
       return {
         keyboard: shell,
-        addFiles: (files) => {
+        addFiles: (files, directories = new Set()) => {
           if (sessions.binding(sessionId) === undefined) return t('file.sessionUnavailable')
+          if (shell.snapshot.phase === 'adjudicating' || shell.snapshot.phase === 'submitting') {
+            return t('attachment.dropBlocked')
+          }
+          const uploads: File[] = []
+          const references: ReferenceInsert[] = []
+          const cwd = sessions.list.getSnapshot().byId[sessionId]?.cwd
+          for (const file of files) {
+            const directory = directories.has(file)
+            if (bridge === undefined && directory) return t('attachment.directoryDesktopOnly')
+            const path = bridge?.pathFor(file) ?? ''
+            if (directory && path === '') return t('attachment.pathUnavailable')
+            if (path === '' || (!directory && isImageMediaType(file.type))) {
+              uploads.push(file)
+              continue
+            }
+            const relative = relativizeToCwd(path, cwd)
+            // A completed directory chip needs closed quotes; the directory grammar keeps them open for drill.
+            const mention = formatFileMention({ path: directory ? `${relative}/` : relative, kind: 'file' }, false)
+            if (mention === undefined) return t('attachment.pathUnsupported')
+            const label = workspaceTitleOf(path) || file.name
+            references.push({
+              source: 'reference', ref: mention, label: directory ? `${label}/` : label,
+              appearance: directory ? 'folder' : 'file', clipboardText: mention,
+            })
+          }
           try {
-            const drafts = conversation.createDrafts(sessionId, files)
-            if (!shell.addAttachments(drafts.map(draft => draft.id))) {
+            const drafts = conversation.createDrafts(sessionId, uploads)
+            if (!shell.addFiles(references, drafts.map(draft => draft.id))) {
               conversation.releaseDraftAttachments(drafts)
+              return t('attachment.dropBlocked')
             }
             return null
           } catch (error: unknown) {
diff --git a/packages/client/ui-conversation/src/client/contract/input.ts b/packages/client/ui-conversation/src/client/contract/input.ts
index b4cd6b9bdf..4036736374 100644
--- a/packages/client/ui-conversation/src/client/contract/input.ts
+++ b/packages/client/ui-conversation/src/client/contract/input.ts
@@ -220,6 +220,15 @@ export interface SessionInputResolver {
  * paste/…) stay InputBar-private and never ride this face.
  */
 export interface InputActions {
+  /** @returns a revision-guarded copy of the current editor selection. */
+  captureInsertion(): TokenSpan
+  /**
+   * Insert asynchronous text without replacing subsequent edits or reference chips.
+   * @param text - plain text to insert in one undo step.
+   * @param span - captured selection and draft revision.
+   * @returns false when the draft changed or submission locked the editor.
+   */
+  insertText(text: string, span: TokenSpan): boolean
   /** Replace the whole draft (persisted-draft seed and programmatic writes). */
   setDraft(text: string): void
   /** Append ordered browser-owned attachment ids; busy admission phases refuse. */
diff --git a/packages/client/ui-conversation/src/client/contract/slots.ts b/packages/client/ui-conversation/src/client/contract/slots.ts
index 023babf26e..00f8db03b8 100644
--- a/packages/client/ui-conversation/src/client/contract/slots.ts
+++ b/packages/client/ui-conversation/src/client/contract/slots.ts
@@ -60,8 +60,12 @@ export interface ComposerAttachmentsOwnerProps {
   attachments: readonly ComposerAttachment[]
   /** Whether a document-level file drop may add attachments now. */
   canAcceptDrop: boolean
-  /** Add one dropped batch through the composer's validation path. */
-  onAddFiles: (files: readonly File[]) => void
+  /**
+   * Add one dropped batch through the composer's validation path.
+   * @param files - dropped, pasted, or picked browser files in source order.
+   * @param directories - members of `files` the drop source identified as directories.
+   */
+  onAddFiles: (files: readonly File[], directories?: ReadonlySet<File>) => void
   /** Remove one draft attachment through the Conversation service. */
   onRemoveAttachment: (id: DraftAttachmentId) => void
   /** Current per-draft upload states for file-kind attachments. */
@@ -197,6 +201,8 @@ declare module '@deepseek-ai/dsh-client-ui-slots' {
     'conversation.input.left': { kind: 'list'; scope: 'session' }
     /** Compact controls before the composer submit action. */
     'conversation.input.right': { kind: 'list'; scope: 'session' }
+    /** Compact action after the model selector; it can expand across the toolbar while retaining the editor and submit action. */
+    'conversation.input.activity': { kind: 'single'; scope: 'session'; owner: InputActivityOwnerProps }
     /** Resident composer body, including the no-Session inert state. */
     'conversation.composer.bar': { kind: 'single'; scope: 'session-maybe'; owner: ComposerBarOwnerProps }
     /** Optional draft-attachment rail and drop target. */
@@ -366,7 +372,14 @@ export interface ComposerBarOwnerProps {
 /** Package-private operations injected into the resident composer bar. */
 export interface ComposerBarInjected {
   keyboard: ComposerKeyboard | undefined
-  addFiles: ((files: readonly File[]) => string | null) | undefined
+  /**
+   * Register one picked batch; resolves to the rejection copy or null. Where
+   * the browser shell reports host paths (the Desktop application), files
+   * and folders with a real path become `@path` references in the draft
+   * instead of uploads; `directories` names the members the drop source
+   * identified as directories.
+   */
+  addFiles: ((files: readonly File[], directories?: ReadonlySet<File>) => string | null) | undefined
   removeAttachment: ((id: DraftAttachmentId) => void) | undefined
   resolveDraftAttachments: ((ids: readonly DraftAttachmentId[]) => readonly ComposerAttachment[]) | undefined
   /** Restart one failed file upload; absent without a session. */
@@ -393,6 +406,12 @@ export interface InputControlOwnerProps {
   locked: boolean
 }
 
+/** A toolbar activity hides ordinary accessory controls while expanded; its occupant must release expansion on unmount. */
+export interface InputActivityOwnerProps extends InputControlOwnerProps {
+  /** @param active - whether the occupant needs the toolbar width before the submit action. */
+  onActiveChange: (active: boolean) => void
+}
+
 /** Full props of the resident composer bar. */
 export type ComposerBarProps =
   PropsRuntime<'conversation.composer.bar'>
@@ -400,7 +419,7 @@ export type ComposerBarProps =
     | 'conversation.input.attachments' | 'conversation.input.overlay'
     | 'conversation.input.permission'
     | 'conversation.input.left' | 'conversation.input.plan'
-    | 'conversation.input.right' | 'conversation.input.model'
+    | 'conversation.input.right' | 'conversation.input.model' | 'conversation.input.activity'
     | 'conversation.composer.dock'
   >
   & InjectFace<ComposerBarInjected>
diff --git a/packages/client/ui-conversation/src/client/input/editor/keymap.ts b/packages/client/ui-conversation/src/client/input/editor/keymap.ts
index 42c217caa0..7291f2c25a 100644
--- a/packages/client/ui-conversation/src/client/input/editor/keymap.ts
+++ b/packages/client/ui-conversation/src/client/input/editor/keymap.ts
@@ -34,8 +34,12 @@ export interface ComposerKeymapHandlers {
   canSubmit(): boolean
   /** The Enter gesture after every guard passed; `accelerated` = Ctrl/Cmd held. */
   submit(accelerated: boolean): void
-  /** Pasted files (image intake). */
-  intakeFiles(files: readonly File[]): void
+  /**
+   * Pasted files with directory metadata supplied by the clipboard entry API.
+   * @param files - browser files in clipboard order.
+   * @param directories - known directory members; absent when no entry identifies a directory.
+   */
+  intakeFiles(files: readonly File[], directories?: ReadonlySet<File>): void
   /** Pasted plain text (sanitized insertion through the shell). */
   pasteText(text: string): void
 }
@@ -154,11 +158,18 @@ export function registerComposerKeymap(editor: LexicalEditor, handlers: Composer
       // deliver clipboardData on plain events.
       const clipboardData = (event as ClipboardEvent).clipboardData ?? null
       if (clipboardData === null) return false
-      const files = Array.from(clipboardData.items)
-        .filter(item => item.kind === 'file')
-        .map(item => item.getAsFile())
-        .filter((file): file is File => file !== null)
-      if (files.length > 0) handlers.intakeFiles(files)
+      const files: File[] = []
+      const directories = new Set<File>()
+      for (const item of clipboardData.items) {
+        if (item.kind !== 'file') continue
+        const file = item.getAsFile()
+        if (file === null) continue
+        files.push(file)
+        if (typeof item.webkitGetAsEntry === 'function' && item.webkitGetAsEntry()?.isDirectory === true) {
+          directories.add(file)
+        }
+      }
+      if (files.length > 0) handlers.intakeFiles(files, directories.size === 0 ? undefined : directories)
       const text = clipboardData.getData('text/plain')
       if (text === '') {
         if (files.length === 0) return false
diff --git a/packages/client/ui-conversation/src/client/input/editor/runtime.ts b/packages/client/ui-conversation/src/client/input/editor/runtime.ts
index 2054624342..f59a6d947d 100644
--- a/packages/client/ui-conversation/src/client/input/editor/runtime.ts
+++ b/packages/client/ui-conversation/src/client/input/editor/runtime.ts
@@ -210,6 +210,19 @@ export class DraftEditorRuntime {
     return applied
   }
 
+  /**
+   * Insert an asynchronous text result as one independent undo operation.
+   * @param span - owner-validated insertion range.
+   * @param text - text sanitized with the same rules as paste.
+   * @returns whether the range mapped and the edit applied.
+   */
+  insertAsyncText(span: DetectSpan, text: string): boolean {
+    let applied = false
+    const clean = text.replace(REFERENCE_PLACEHOLDER_RE, '')
+    this.applyEdit(() => { applied = $replaceDetectSpanWithText(span, clean) }, PASTE_TAG)
+    return applied
+  }
+
   /**
    * Insert a reference chip with the existing trailing-space rule.
    * @param span - detect-coordinate range.
@@ -228,6 +241,25 @@ export class DraftEditorRuntime {
     return applied
   }
 
+  /**
+   * Insert an ordered file-reference batch after the live selection without deleting it.
+   * @param references - validated references in source order.
+   * @returns whether the live insertion position accepted the batch.
+   */
+  insertFileReferences(references: readonly ReferenceInsert[]): boolean {
+    if (references.length === 0) return true
+    let applied = false
+    this.applyEdit(() => {
+      const projection = $projectComposer(key => this.occurrenceIdOf(key))
+      const at = projection.selection?.end ?? projection.detectText.length
+      const before = projection.detectText.slice(0, at)
+      const nodes = references.flatMap(ref => [$createReferenceChipNode(ref), $createTextNode(' ')])
+      if (before !== '' && !/\s$/u.test(before)) nodes.unshift($createTextNode(' '))
+      applied = $replaceDetectSpanWithNodes({ start: at, end: at }, nodes)
+    }, PASTE_TAG)
+    return applied
+  }
+
   /** Refresh claim-token decoration after the model's claim changes. */
   refreshClaimDecoration(): void {
     refreshClaimDecoration(this.editor)
diff --git a/packages/client/ui-conversation/src/client/input/editor/view-binding.ts b/packages/client/ui-conversation/src/client/input/editor/view-binding.ts
index 8dcd3d8c63..89218a887c 100644
--- a/packages/client/ui-conversation/src/client/input/editor/view-binding.ts
+++ b/packages/client/ui-conversation/src/client/input/editor/view-binding.ts
@@ -14,7 +14,7 @@ interface DraftViewGate {
   running: boolean
   steeringAvailable: boolean
   busyEnter: BusyEnterBehavior
-  intakeFiles: (files: readonly File[]) => void
+  intakeFiles: (files: readonly File[], directories?: ReadonlySet<File>) => void
   uploadsPending: boolean
   showToast: (text: string) => void
   t: ComposerBarProps['t']
@@ -136,7 +136,7 @@ export function installDraftKeymap(
         g.steeringAvailable,
       ))
     },
-    intakeFiles: (files) => { gate.current.intakeFiles(files) },
+    intakeFiles: (files, directories) => { gate.current.intakeFiles(files, directories) },
     pasteText: (text) => {
       if (gate.current.machineBusy || gate.current.locked) return
       keyboard.paste(text)
diff --git a/packages/client/ui-conversation/src/client/input/facade.ts b/packages/client/ui-conversation/src/client/input/facade.ts
index 4f4d0aa300..3cd956bf76 100644
--- a/packages/client/ui-conversation/src/client/input/facade.ts
+++ b/packages/client/ui-conversation/src/client/input/facade.ts
@@ -117,6 +117,12 @@ export class SessionInputShell implements SessionInput {
   }
   /** The public provide-channel action face (one stable identity per session). */
   readonly actions: InputActions = {
+    captureInsertion: () => ({ ...this.caretSpan(), draftRev: this.rev }),
+    insertText: (text, span) => {
+      if (this.snapshot.phase === 'adjudicating' || this.snapshot.phase === 'submitting' || this.disposed) return false
+      if (span.draftRev !== this.rev) return false
+      return this.draftEditor.insertAsyncText(span, text)
+    },
     setDraft: (text) => { this.setDraft(text) },
     addAttachments: ids => this.addAttachments(ids),
     removeAttachment: (id) => { this.removeAttachment(id) },
@@ -215,6 +221,20 @@ export class SessionInputShell implements SessionInput {
     return true
   }
 
+  /**
+   * Add validated file references and attachment ids while admission is editable.
+   * @param references - reference chips in source order.
+   * @param ids - newly allocated attachment ids.
+   * @returns false when admission is locked or the editor refuses the insertion.
+   */
+  addFiles(references: readonly ReferenceInsert[], ids: readonly DraftAttachmentId[]): boolean {
+    if (this.snapshot.phase === 'adjudicating' || this.snapshot.phase === 'submitting') return false
+    if (!this.draftEditor.insertFileReferences(references)) return false
+    this.attachmentIds = [...this.attachmentIds, ...ids]
+    this.publish()
+    return true
+  }
+
   /**
    * Remove one attachment id from this draft. Busy admission phases refuse, like
    * {@link addAttachments}: a removal landing while a command submit serializes
diff --git a/packages/client/ui-conversation/src/client/locales.ts b/packages/client/ui-conversation/src/client/locales.ts
index c164dc8535..8ddad82052 100644
--- a/packages/client/ui-conversation/src/client/locales.ts
+++ b/packages/client/ui-conversation/src/client/locales.ts
@@ -31,6 +31,9 @@ export const zh = {
   'attachment.dropTitle': '文件或图片拖动到此处即可添加',
   'attachment.dropDesc': '图片限制：最多 {count} 张，每张 {size}',
   'attachment.dropBlocked': '当前无法添加文件或图片',
+  'attachment.directoryDesktopOnly': '只有桌面端支持添加文件夹，浏览器里请添加单个文件',
+  'attachment.pathUnavailable': '无法获取文件夹路径，请重新拖入',
+  'attachment.pathUnsupported': '路径含有无法引用的字符，请改名后再试',
   'image.pending': '待发送图片',
   'image.openOriginal': '查看原图',
   'image.openOriginalLabel': '{label}，点击查看原图',
@@ -382,6 +385,9 @@ export const en = {
   'attachment.dropTitle': 'Drag files or images here to add them',
   'attachment.dropDesc': 'Image limit: up to {count} images, {size} each',
   'attachment.dropBlocked': 'Files and images cannot be added right now',
+  'attachment.directoryDesktopOnly': 'Folders can only be added in the desktop app; add individual files in the browser',
+  'attachment.pathUnavailable': 'Could not obtain the folder path; drag it in again',
+  'attachment.pathUnsupported': 'The path contains characters a reference cannot carry; rename it and try again',
   'image.pending': 'Pending images',
   'image.openOriginal': 'View original',
   'image.openOriginalLabel': '{label}, click to view original',
diff --git a/packages/client/ui-conversation/src/client/service.ts b/packages/client/ui-conversation/src/client/service.ts
index 367647658e..2ef2309ccf 100644
--- a/packages/client/ui-conversation/src/client/service.ts
+++ b/packages/client/ui-conversation/src/client/service.ts
@@ -594,8 +594,12 @@ function imageMediaType(value: string): ImageMediaType {
   }
 }
 
-/** Whether a browser-declared MIME selects the image draft path (all other files upload verbatim). */
-function isImageMediaType(value: string): boolean {
+/**
+ * Whether a browser-declared MIME selects the image draft path (all other files upload verbatim).
+ * @param value - the browser's declared MIME type.
+ * @returns whether the file is an accepted raster image.
+ */
+export function isImageMediaType(value: string): boolean {
   return value === 'image/png' || value === 'image/jpeg' || value === 'image/webp' || value === 'image/gif'
 }
 
diff --git a/packages/client/ui-conversation/src/client/skeleton/InputBar.module.css b/packages/client/ui-conversation/src/client/skeleton/InputBar.module.css
index 6226a18ffa..fbd07f2810 100644
--- a/packages/client/ui-conversation/src/client/skeleton/InputBar.module.css
+++ b/packages/client/ui-conversation/src/client/skeleton/InputBar.module.css
@@ -407,3 +407,10 @@
   font-size: 12px;
   cursor: pointer;
 }
+
+.standardControls { display: flex; align-items: center; gap: 12px; min-width: 0; }
+.tools[hidden], .standardControls[hidden] { display: none; }
+.trailingActive { flex: 1; margin-left: 0; }
+.activity { display: flex; align-items: center; flex: none; }
+.activity:empty { display: none; }
+.activityExpanded { flex: 1; min-width: 0; }
diff --git a/packages/client/ui-conversation/src/client/skeleton/InputBar.tsx b/packages/client/ui-conversation/src/client/skeleton/InputBar.tsx
index 6a4ea12740..7016ea8f9d 100644
--- a/packages/client/ui-conversation/src/client/skeleton/InputBar.tsx
+++ b/packages/client/ui-conversation/src/client/skeleton/InputBar.tsx
@@ -55,6 +55,8 @@ export const InputBar = memo(function InputBar({
   const busyEnter = useBusyEnter(s => s)
   void useLexicon // hook seat stays bound by the inject compartment; text-ref decoration rides the shell's editor transforms
   const commandMenuOpen = useMenuLauncher(source => source === 'command')
+  const [activity, setActivity] = useState(false)
+  useEffect(() => { setActivity(false) }, [sessionId])
   const promptError = useSession(s => s.promptError) ?? null
   const running = useSession(s => s.running) ?? false
   const subagent = useSession(s => s.subagent) ?? null
@@ -198,7 +200,7 @@ export const InputBar = memo(function InputBar({
   // client-side size or count limit and upload as soon as they are picked.
   // The host enforces the same image limits at submit for callers that bypass
   // this composer.
-  const intakeFiles = useCallback((files: readonly File[]): void => {
+  const intakeFiles = useCallback((files: readonly File[], directories?: ReadonlySet<File>): void => {
     if (subagent !== null || addFiles === undefined || files.length === 0) return
     const rejected = ((): string | null => {
       if (imageLimits !== undefined) {
@@ -217,7 +219,7 @@ export const InputBar = memo(function InputBar({
           return t('image.totalTooLarge', { size: imageSizeText(imageLimits.maxMessageImageBytes) })
         }
       }
-      return addFiles(files)
+      return addFiles(files, directories)
     })()
     if (rejected !== null) showToast(rejected)
   }, [subagent, addFiles, attachments, imageLimits, showToast, t])
@@ -406,7 +408,7 @@ export const InputBar = memo(function InputBar({
           showPlaceholder={draft === '' && attachments.length === 0 && !claimActive}
         />
         <div className={css.row}>
-          <div className={css.tools}>
+          <div className={css.tools} hidden={activity}>
             <Tooltip label={t('input.commands')} side="top" delayMs={500}>
               <button
                 type="button"
@@ -437,11 +439,16 @@ export const InputBar = memo(function InputBar({
               ? null
               : renderSlot('conversation.input.left', {})}
           </div>
-          <div className={css.trailing}>
-            {input === undefined || sessionId === undefined
-              ? null
-              : renderSlot('conversation.input.right', {})}
-            {sessionId === undefined ? null : renderSlot('conversation.input.model', { locked: modelSeatLocked })}
+          <div className={clsx(css.trailing, activity && css.trailingActive)}>
+            <div className={css.standardControls} hidden={activity}>
+              {input === undefined || sessionId === undefined
+                ? null
+                : renderSlot('conversation.input.right', {})}
+              {sessionId === undefined ? null : renderSlot('conversation.input.model', { locked: modelSeatLocked })}
+            </div>
+            {input === undefined || sessionId === undefined ? null : <div className={activity ? css.activityExpanded : css.activity}>
+              {renderSlot('conversation.input.activity', { locked, onActiveChange: setActivity })}
+            </div>}
             {interruptible && (
               <Tooltip label={t('input.stop')} side="top" delayMs={500} disabled={stop === undefined}>
                 <button
@@ -485,7 +492,7 @@ export const InputBar = memo(function InputBar({
         {variant === 'composer' && input !== undefined && sessionId !== undefined
           ? renderSlot('conversation.composer.dock', {})
           : null}
-        <ContextMeter useProjection={useProjection} t={t} />
+        {activity ? null : <ContextMeter useProjection={useProjection} t={t} />}
       </div>
     </div>
   )
diff --git a/packages/client/ui-conversation/tests/apply-inject.client.spec.tsx b/packages/client/ui-conversation/tests/apply-inject.client.spec.tsx
index e90a11a163..db7eb068ba 100644
--- a/packages/client/ui-conversation/tests/apply-inject.client.spec.tsx
+++ b/packages/client/ui-conversation/tests/apply-inject.client.spec.tsx
@@ -1,4 +1,8 @@
 // @vitest-environment jsdom
+import { render, cleanup } from '@testing-library/react'
+import { $getRoot, $isTextNode, PASTE_COMMAND } from 'lexical'
+import { projectUserText } from '@deepseek-ai/dsh-client-ui-primitives'
+import { registerComposerKeymap } from '../src/client/input/editor/keymap.ts'
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
 import { describe, expect, it, onTestFinished, vi } from 'vitest'
 import type { CommandContribution, CommandUiContract } from '@deepseek-ai/dsh-client-ui-commands/client'
@@ -399,6 +403,90 @@ describe('Conversation inject API', () => {
     await b.runtime.dispose()
   })
 
+  it('cites shell-named files and folders as @ references and refuses folders without the shell bridge', async () => {
+    const browser = await bench()
+    const folder = new File([], 'project')
+    expect(browser.composerApi(ROOT).addFiles?.([folder], new Set([folder])))
+      .toBe('只有桌面端支持添加文件夹，浏览器里请添加单个文件')
+    expect(browser.inputApi(ROOT).state.getSnapshot().attachmentIds).toEqual([])
+    await browser.runtime.dispose()
+
+    const paths = new Map([['project', '/Users/me/my project'], ['notes.md', '/Users/me/notes.md'], ['shot.png', '/Users/me/shot.png']])
+    vi.stubGlobal('__DSH_HOST_PATHS__', { pathFor: (file: File) => paths.get(file.name) ?? '' })
+    try {
+      const desktop = await bench()
+      const composer = desktop.composerApi(ROOT)
+      const { state } = desktop.inputApi(ROOT)
+      const note = new File([Uint8Array.of(1)], 'notes.md', { type: 'text/markdown' })
+      const shot = new File([Uint8Array.of(2)], 'shot.png', { type: 'image/png' })
+      const pasted = new File([Uint8Array.of(3)], 'pasted.bin', { type: 'application/octet-stream' })
+      expect(composer.addFiles?.([folder, note, shot, pasted], new Set([folder]))).toBeNull()
+      // The folder and the file became references in the draft; the image and the pathless bytes stayed drafts.
+      expect(state.getSnapshot().draft).toBe('@"/Users/me/my project/" @/Users/me/notes.md ')
+      const drafts = composer.resolveDraftAttachments?.(state.getSnapshot().attachmentIds) ?? []
+      expect(drafts.map(draft => draft.kind)).toEqual(['image', 'file'])
+      await vi.waitFor(() => { expect(desktop.rootUpload).toHaveBeenCalledOnce() })
+      // A directory the shell cannot name is refused even with the bridge present.
+      const nameless = new File([], 'nameless')
+      expect(composer.addFiles?.([nameless], new Set([nameless])))
+        .toBe('无法获取文件夹路径，请重新拖入')
+      await desktop.runtime.dispose()
+    } finally {
+      vi.unstubAllGlobals()
+    }
+  })
+
+  it('preserves selected text and file order and restores pasted directory chips from the draft', async () => {
+    vi.stubGlobal('__DSH_HOST_PATHS__', { pathFor: (file: File) => `/proj/${file.name}` })
+    onTestFinished(() => { vi.unstubAllGlobals(); cleanup() })
+    const b = await bench()
+    onTestFinished(() => b.runtime.dispose())
+    const composer = b.composerApi(ROOT)
+    const editor = composer.keyboard!.editor
+    const { state, actions } = b.inputApi(ROOT)
+    actions.setDraft('读取')
+    editor.update(() => {
+      const text = $getRoot().getAllTextNodes()[0]
+      if (text === undefined || !$isTextNode(text)) throw new Error('expected text selection')
+      text.select(0, 2)
+    }, { discrete: true })
+    const off = registerComposerKeymap(editor, {
+      arbitrate: () => 'pass', space: () => false, dismissPopup: () => {},
+      canSubmit: () => true, submit: () => {}, pasteText: (text) => { composer.keyboard!.paste(text) },
+      intakeFiles: (files, directories) => { expect(composer.addFiles?.(files, directories)).toBeNull() },
+    })
+    onTestFinished(off)
+    const folder = new File([], 'my project')
+    const files = [new File([], 'a.txt'), folder, new File([], 'b.txt')]
+    const event = new KeyboardEvent('paste', { cancelable: true })
+    Object.defineProperty(event, 'clipboardData', { value: {
+      items: files.map(file => ({
+        kind: 'file', getAsFile: () => file, webkitGetAsEntry: () => ({ isDirectory: file === folder }),
+      })), getData: () => '',
+    } })
+    editor.update(() => { editor.dispatchCommand(PASTE_COMMAND, event) }, { discrete: true })
+    expect(state.getSnapshot().draft).toBe('读取 @a.txt @"my project/" @b.txt ')
+    const view = render(<div>{projectUserText(state.getSnapshot().draft, [])}</div>)
+    expect(view.container.querySelector('[data-ref-chip="folder"]')?.textContent).toBe('my project')
+    expect(view.container.querySelector('[data-ref-chip="folder"]')?.getAttribute('title')).toBe('@"my project/"')
+  })
+
+  it('rejects the whole file batch before changing the draft when a later path is unrepresentable', async () => {
+    vi.stubGlobal('__DSH_HOST_PATHS__', { pathFor: (file: File) => `/proj/${file.name}` })
+    onTestFinished(() => { vi.unstubAllGlobals() })
+    const b = await bench()
+    onTestFinished(() => b.runtime.dispose())
+    const { state, actions } = b.inputApi(ROOT)
+    actions.setDraft('keep this text')
+    for (const name of ['bad"name', 'bad\nname']) {
+      const files = [new File([], 'good.txt'), new File([], name)]
+      expect(b.composerApi(ROOT).addFiles?.(files)).toBe('路径含有无法引用的字符，请改名后再试')
+      expect(state.getSnapshot().draft).toBe('keep this text')
+      expect(state.getSnapshot().attachmentIds).toEqual([])
+      expect(b.rootUpload).not.toHaveBeenCalled()
+    }
+  })
+
   it('fails loud for an unknown binding or an unloaded scoped service', async () => {
     const b = await bench()
     const entry = b.entryOf('conversation.composer.bar')
diff --git a/packages/client/ui-conversation/tests/async-insertion.client.spec.ts b/packages/client/ui-conversation/tests/async-insertion.client.spec.ts
new file mode 100644
index 0000000000..ef7cf1fcb9
--- /dev/null
+++ b/packages/client/ui-conversation/tests/async-insertion.client.spec.ts
@@ -0,0 +1,38 @@
+/** Late input insertions preserve references, subsequent edits, and undo ownership. */
+import { Context } from '@deepseek-ai/cordis'
+import { UNDO_COMMAND } from 'lexical'
+import { expect, it, vi } from 'vitest'
+import { SessionInputShell } from '../src/client/input/facade.ts'
+
+function shell(): SessionInputShell {
+  return new SessionInputShell({ actx: new Context(), defaultSink: vi.fn(), commandAttachments: {
+    serialize: async () => [], release: () => {}, unsupportedNotice: () => '',
+  } })
+}
+
+it('inserts text beside an existing reference and undoes only that insertion', async () => {
+  const input = shell()
+  try {
+    input.setDraft('@ref')
+    input.insertReference({ source: 'file', ref: 'src/main.ts', label: 'main.ts', clipboardText: '@[main.ts](src/main.ts)' },
+      { start: 0, end: 4, draftRev: input.state.getSnapshot().draftRev })
+    const original = input.state.getSnapshot()
+    expect(input.actions.insertText(' check types', input.actions.captureInsertion())).toBe(true)
+    expect(input.state.getSnapshot().draft).toContain('check types')
+    expect(input.state.getSnapshot().occurrences).toEqual(original.occurrences)
+    input.editor.dispatchCommand(UNDO_COMMAND, undefined)
+    await vi.waitFor(() => { expect(input.state.getSnapshot().draft).toBe(original.draft) })
+  } finally { input.dispose() }
+})
+
+it('refuses results captured before a user edit or after editor disposal', () => {
+  const input = shell()
+  input.setDraft('before')
+  const span = input.actions.captureInsertion()
+  input.setDraft('my newer text')
+  expect(input.actions.insertText('late voice', span)).toBe(false)
+  expect(input.state.getSnapshot().draft).toBe('my newer text')
+  const latest = input.actions.captureInsertion()
+  input.dispose()
+  expect(input.actions.insertText('late voice', latest)).toBe(false)
+})
diff --git a/packages/client/ui-conversation/tests/conversation-registry.client.spec.ts b/packages/client/ui-conversation/tests/conversation-registry.client.spec.ts
index 8a919e624c..2f57b05f27 100644
--- a/packages/client/ui-conversation/tests/conversation-registry.client.spec.ts
+++ b/packages/client/ui-conversation/tests/conversation-registry.client.spec.ts
@@ -72,7 +72,6 @@ function fakeSessions(ctx: Context): { sessions: ISessions; binding: SessionBind
     byId: {},
     phase: 'ready',
     projectionsBySession: {},
-    jobsBySession: {},
   })
   const reference = {
     sessionId: SESSION_ID,
diff --git a/packages/client/ui-conversation/tests/enter-behavior-row.client.spec.tsx b/packages/client/ui-conversation/tests/enter-behavior-row.client.spec.tsx
index b5de7d3ade..3d1b833896 100644
--- a/packages/client/ui-conversation/tests/enter-behavior-row.client.spec.tsx
+++ b/packages/client/ui-conversation/tests/enter-behavior-row.client.spec.tsx
@@ -22,7 +22,7 @@ afterEach(() => {
 
 function emptySessions() {
   return bindSnapshotSelector(createSnapshotStore<SessionListState>({
-    ids: [], byId: {}, phase: 'ready', projectionsBySession: {}, jobsBySession: {},
+    ids: [], byId: {}, phase: 'ready', projectionsBySession: {},
   }))
 }
 
diff --git a/packages/client/ui-conversation/tests/input-bar.client.spec.tsx b/packages/client/ui-conversation/tests/input-bar.client.spec.tsx
index 9e0366952c..0e9349e51d 100644
--- a/packages/client/ui-conversation/tests/input-bar.client.spec.tsx
+++ b/packages/client/ui-conversation/tests/input-bar.client.spec.tsx
@@ -19,6 +19,7 @@ import {
 } from '@deepseek-ai/dsh-client-test-runtime'
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
 import type { SessionListState, SessionSnapshot } from '@deepseek-ai/dsh-api-session-controller/client'
+import type { ContextPressureProjection } from '@deepseek-ai/dsh-token-meter/client'
 import { zh as commonZh } from '@deepseek-ai/dsh-client-locale/src/locales/zh.ts'
 import type { Context } from '@deepseek-ai/cordis'
 import type { SessionId } from '@deepseek-ai/dsh-session/types'
@@ -26,7 +27,7 @@ import type { SubmitOutcome } from '../src/client/contract/input.ts'
 import { SessionInputShell } from '../src/client/input/facade.ts'
 import { $replaceDetectSpanWithText, $selectDetectSpan } from '../src/client/input/editor/span-map.ts'
 import type {
-  ComposerAttachment, ComposerAttachmentsOwnerProps, DraftFileUploads,
+  ComposerAttachment, ComposerAttachmentsOwnerProps, DraftFileUploads, InputActivityOwnerProps,
 } from '../src/client/contract/slots.ts'
 import type { DraftAttachmentId } from '../src/client/contract/input.ts'
 import { InputBar } from '../src/client/skeleton/InputBar.tsx'
@@ -92,11 +93,13 @@ interface BenchOptions {
   overlay?: React.ReactNode
   leftItems?: React.ReactNode
   rightItems?: React.ReactNode
+  activityEntry?: (owner: InputActivityOwnerProps) => React.ReactNode
+  contextPressure?: ContextPressureProjection
   footer?: React.ReactNode
   attachments?: readonly ComposerAttachment[]
   /** Upload states served for file-kind drafts (absent = every file is ready). */
   fileUploads?: DraftFileUploads
-  addFiles?: (files: readonly File[]) => string | null
+  addFiles?: (files: readonly File[], directories?: ReadonlySet<File>) => string | null
   commandMenuOpen?: boolean
   busyEnter?: 'queue' | 'steer'
   toggleCommandMenu?: (selection: { start: number; end: number }) => void
@@ -162,6 +165,7 @@ function bench(over?: BenchOptions) {
     if (key === 'conversation.input.plan') return over?.planEntry ?? null
     if (key === 'conversation.input.permission') return over?.permissionEntry ?? null
     if (key === 'conversation.input.model') return over?.modelEntry ?? null
+    if (key === 'conversation.input.activity') return over?.activityEntry?.(owner as InputActivityOwnerProps) ?? null
     return null
   }) as never
   const props: InputBarProps = {
@@ -175,7 +179,7 @@ function bench(over?: BenchOptions) {
     useResource,
     useSessions: bindSnapshotSelector(createSnapshotStore<SessionListState>({
       ids: [], byId: {}, phase: 'ready',
-      projectionsBySession: {}, jobsBySession: {},
+      projectionsBySession: {},
     })),
     useWorkspaces: bindSnapshotSelector(createSnapshotStore({
       items: [], archivedSessionIds: [], pinnedSessionIds: [], state: 'idle', phase: 'ready', error: null,
@@ -184,7 +188,8 @@ function bench(over?: BenchOptions) {
       (selector ?? (v => v))(key === 'plan'
         ? over?.plan
         : key === 'goal' ? over?.goal
-          : key === 'imageLimits' ? over?.imageLimits : undefined)),
+          : key === 'imageLimits' ? over?.imageLimits
+            : key === 'contextPressure' ? over?.contextPressure : undefined)),
     useInput: bindSnapshotSelector(shell.state),
     inputActions: shell.actions,
     keyboard: shell,
@@ -344,11 +349,34 @@ describe('image draft rail', () => {
         getData: () => '同时粘贴的文字',
       },
     })
-    expect(addFiles).toHaveBeenCalledWith([image])
+    expect(addFiles).toHaveBeenCalledWith([image], undefined)
     // The paste lands inside the PASTE_COMMAND update; its commit is a microtask away.
     await vi.waitFor(() => { expect(shell.snapshot.draft).toBe('同时粘贴的文字') })
   })
 
+  it('passes known clipboard directories and keeps files whose entry metadata is unavailable', () => {
+    const addFiles = vi.fn(() => null)
+    const { textarea } = bench({ addFiles })
+    const folder = new File([], 'folder with spaces')
+    const emptyFile = new File([], 'empty-file')
+    const withoutApi = new File([], 'without-api')
+    const withoutEntry = new File([], 'without-entry')
+    fireEvent.paste(textarea, {
+      clipboardData: {
+        items: [
+          { kind: 'string', getAsFile: () => null },
+          { kind: 'file', getAsFile: () => folder, webkitGetAsEntry: () => ({ isDirectory: true }) },
+          { kind: 'file', getAsFile: () => emptyFile, webkitGetAsEntry: () => ({ isDirectory: false }) },
+          { kind: 'file', getAsFile: () => withoutApi },
+          { kind: 'file', getAsFile: () => withoutEntry, webkitGetAsEntry: () => null },
+          { kind: 'file', getAsFile: () => null },
+        ],
+        getData: () => '',
+      },
+    })
+    expect(addFiles).toHaveBeenCalledWith([folder, emptyFile, withoutApi, withoutEntry], new Set([folder]))
+  })
+
   it('pre-checks projected limits at intake: whole-batch refusal with product copy, none added', () => {
     const limits = {
       maxImageBytes: 1024 * 1024,
@@ -386,7 +414,7 @@ describe('image draft rail', () => {
     const within = bench({ addFiles: vi.fn(() => null), imageLimits: limits })
     const fits = png(16, 'fits.png')
     intake(within, [fits])
-    expect(within.props.addFiles).toHaveBeenCalledWith([fits])
+    expect(within.props.addFiles).toHaveBeenCalledWith([fits], undefined)
     expect(within.view.queryByRole('alert')).toBeNull()
   })
 
@@ -409,7 +437,7 @@ describe('image draft rail', () => {
       new File([new ArrayBuffer(64)], 'b.pdf', { type: 'application/pdf' }),
     ]
     act(() => { attachmentOwner(result.slotCalls).onAddFiles(files) })
-    expect(addFiles).toHaveBeenCalledWith(files)
+    expect(addFiles).toHaveBeenCalledWith(files, undefined)
     expect(result.view.getByRole('alert').textContent).toContain('仅支持 PNG、JPG、WebP、GIF 格式的图片')
   })
 
@@ -428,6 +456,17 @@ describe('image draft rail', () => {
     expect(attachmentOwner(result.slotCalls).dropLimits).toEqual({ count: 20, size: '5MB' })
   })
 
+  it('forwards dropped directories to addFiles and announces its refusal', () => {
+    const addFiles = vi.fn((_files: readonly File[], directories?: ReadonlySet<File>) =>
+      directories !== undefined && directories.size > 0 ? '只有桌面端支持添加文件夹，浏览器里请添加单个文件' : null)
+    const result = bench({ addFiles })
+    const folder = new File([], 'project')
+    const note = new File([Uint8Array.of(1)], 'notes.md', { type: 'text/markdown' })
+    act(() => { attachmentOwner(result.slotCalls).onAddFiles([folder, note], new Set([folder])) })
+    expect(addFiles).toHaveBeenCalledWith([folder, note], new Set([folder]))
+    expect(result.view.getByRole('alert').textContent).toContain('只有桌面端支持添加文件夹')
+  })
+
   it('announces server attachment rejections as product copy, other codes as developer text', () => {
     const attachmentError = (reason: string): SessionSnapshot['promptError'] => ({
       op: 'send',
@@ -1610,7 +1649,7 @@ describe('command launcher chrome and control seats', () => {
     expect([...new Set(slotCalls.map(c => c.key))]).toEqual([
       'conversation.input.overlay', 'conversation.input.attachments',
       'conversation.input.permission', 'conversation.input.plan', 'conversation.input.left',
-      'conversation.input.right', 'conversation.input.model',
+      'conversation.input.right', 'conversation.input.model', 'conversation.input.activity',
       'conversation.composer.dock',
     ])
     expect(view.queryByLabelText('Plan mode')).toBeNull()
@@ -1673,3 +1712,42 @@ describe('command launcher chrome and control seats', () => {
     expect((live.view.getByLabelText('添加文件或调用指令') as HTMLButtonElement).disabled).toBe(false)
   })
 })
+
+it('lets a toolbar activity replace accessories without replacing the draft editor or send action', () => {
+  const { view } = bench({ draft: 'keep this draft', modelEntry: <button>model choice</button>,
+    activityEntry: owner => <>
+      <button onClick={() => { owner.onActiveChange(true) }}>expand activity</button>
+      <button onClick={() => { owner.onActiveChange(false) }}>close activity</button>
+    </>,
+  })
+  const editor = view.getByRole('textbox')
+  fireEvent.click(view.getByRole('button', { name: 'expand activity' }))
+  expect(view.queryByRole('button', { name: 'model choice' })).toBeNull()
+  expect(view.getByRole('textbox')).toBe(editor)
+  expect(editor.textContent).toBe('keep this draft')
+  expect(view.getByRole('button', { name: '发送消息' })).toBeTruthy()
+  fireEvent.click(view.getByRole('button', { name: 'close activity' }))
+  expect(view.getByRole('button', { name: 'model choice' })).toBeTruthy()
+})
+
+it('places context usage below the composer and hides it until the activity closes', () => {
+  const { view } = bench({ draft: 'draft', contextPressure: { pressureTokens: 32_000, contextWindow: 128_000 },
+    activityEntry: owner => <>
+      <button onClick={() => { owner.onActiveChange(true) }}>microphone</button>
+      <button onClick={() => { owner.onActiveChange(false) }}>close activity</button>
+    </>,
+  })
+  const meter = view.getByRole('button', { name: '上下文已用 25%' })
+  const microphone = view.getByRole('button', { name: 'microphone' })
+  expect(microphone.compareDocumentPosition(meter) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy()
+  fireEvent.click(meter)
+  expect(view.getByRole('dialog', { name: '上下文已用' })).toBeTruthy()
+  fireEvent.click(microphone)
+  expect(view.queryByRole('dialog', { name: '上下文已用' })).toBeNull()
+  expect(view.queryByRole('button', { name: '上下文已用 25%' })).toBeNull()
+  expect(view.getByRole('button', { name: '发送消息' })).toBeTruthy()
+  fireEvent.click(view.getByRole('button', { name: 'close activity' }))
+  fireEvent.click(view.getByRole('button', { name: '上下文已用 25%' }))
+  expect(view.getByRole('dialog', { name: '上下文已用' })).toBeTruthy()
+  expect(view.getByRole('button', { name: '发送消息' })).toBeTruthy()
+})
diff --git a/packages/client/ui-conversation/tests/input-matrix.client.spec.tsx b/packages/client/ui-conversation/tests/input-matrix.client.spec.tsx
index 15d87a0ca7..1dcbd65f9c 100644
--- a/packages/client/ui-conversation/tests/input-matrix.client.spec.tsx
+++ b/packages/client/ui-conversation/tests/input-matrix.client.spec.tsx
@@ -54,7 +54,7 @@ function mountBar(shell: SessionInputShell, over?: { running?: boolean; disabled
     useSession: bindSnapshotSelector(session),
     useSessions: bindSnapshotSelector(createSnapshotStore({
       ids: [], byId: {}, current: undefined, phase: 'ready',
-      projectionsBySession: {}, jobsBySession: {}, currentAddress: undefined,
+      projectionsBySession: {}, currentAddress: undefined,
     })),
     useSessionStatus: bindSnapshotSelector(
       createSnapshotStore<SessionStatusSnapshot>(new Map()),
@@ -283,6 +283,11 @@ describe('matrix row: claimed with attachments', () => {
     act(() => { shell.addAttachments([img]) })
     fireEvent.keyDown(textarea, { key: 'Enter' })
     expect(shell.snapshot.phase).toBe('submitting')
+    const draft = shell.snapshot.draft
+    expect(shell.addFiles([{
+      source: 'reference', ref: '@note.txt', label: 'note.txt', clipboardText: '@note.txt',
+    }], ['new-file' as DraftAttachmentId])).toBe(false)
+    expect(shell.snapshot.draft).toBe(draft)
     let removed = true
     act(() => { removed = shell.removeAttachment(img) })
     expect(removed).toBe(false)
diff --git a/packages/client/ui-conversation/tests/input-scenarios.client.spec.tsx b/packages/client/ui-conversation/tests/input-scenarios.client.spec.tsx
index 347b4d05c1..e119a8104d 100644
--- a/packages/client/ui-conversation/tests/input-scenarios.client.spec.tsx
+++ b/packages/client/ui-conversation/tests/input-scenarios.client.spec.tsx
@@ -148,7 +148,7 @@ async function scopedBench(register?: (inputTriggers: InputTriggerService) => vo
     useSession: bindSnapshotSelector(sessionStore),
     useSessions: bindSnapshotSelector(createSnapshotStore({
       ids: [], byId: {}, current: undefined, phase: 'ready',
-      projectionsBySession: {}, jobsBySession: {}, currentAddress: undefined,
+      projectionsBySession: {}, currentAddress: undefined,
     })),
     useSessionStatus: bindSnapshotSelector(
       createSnapshotStore<SessionStatusSnapshot>(new Map()),
diff --git a/packages/client/ui-conversation/tests/skeleton.client.spec.tsx b/packages/client/ui-conversation/tests/skeleton.client.spec.tsx
index 17aadfb056..911e331bc1 100644
--- a/packages/client/ui-conversation/tests/skeleton.client.spec.tsx
+++ b/packages/client/ui-conversation/tests/skeleton.client.spec.tsx
@@ -164,7 +164,7 @@ function mount(
       ...listed && options.nestedSubagent === true && { [parent]: parentRow },
       ...listed && { [SID]: childRow },
     },
-    phase: 'ready', projectionsBySession: {}, jobsBySession: {},
+    phase: 'ready', projectionsBySession: {},
   })
   const workspaces = createSnapshotStore<WorkspaceSnapshot>(workspaceState(workspaceRows))
   const session = createSnapshotStore<SessionSnapshot>(snapshot)
diff --git a/packages/client/ui-conversation/tsconfig.json b/packages/client/ui-conversation/tsconfig.json
index 1dbe8b1ce5..a4df996a41 100644
--- a/packages/client/ui-conversation/tsconfig.json
+++ b/packages/client/ui-conversation/tsconfig.json
@@ -92,6 +92,9 @@
     {
       "path": "../../util/values"
     },
+    {
+      "path": "../../context/file-reference"
+    },
     {
       "path": "../../util/workspace-path"
     }
diff --git a/packages/client/ui-deliverables/README.i18n.yaml b/packages/client/ui-deliverables/README.i18n.yaml
index 7ea790985c..c3c62898a1 100644
--- a/packages/client/ui-deliverables/README.i18n.yaml
+++ b/packages/client/ui-deliverables/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-deliverables/README.md
-README.md: 71f3545b8fb3fed3ecd678258e6c50bbfa4b580c
-README.zh.md: 3e59ed2b7d4ac7e9d64b7d1f2f3c477e3ca1c50e
+README.md: ce006783310c257957bc8cfddcfd18226972d18f
+README.zh.md: 82239ba169f4ada188e8a5ba8e1889c61b336f96
diff --git a/packages/client/ui-deliverables/README.md b/packages/client/ui-deliverables/README.md
index 71f3545b8f..ce00678331 100644
--- a/packages/client/ui-deliverables/README.md
+++ b/packages/client/ui-deliverables/README.md
@@ -30,9 +30,9 @@ Mount this plugin alongside `ui-conversation` and the Host [workspace-changes](.
 <a id="explicit-deliveries"></a>
 ### Explicit deliveries
 
-The Web `standard`, `ptc`, and `cordis` presets expose `present` for final files accessible through the Session filesystem, including files created through Bash. Call it with `files: [{ path, description? }]` after creating the files. The [present tool](../../deliverables/tool-present/README.md) owns file-count limits and Session declarations. The closing turn shows one delivery as a full-width card and multiple deliveries in a two-column grid with 10px gaps. A list longer than four files starts collapsed and provides a control that reveals or hides the complete list. Each 60px-high card uses 8px vertical and 10px horizontal inset spacing, a 20px shared `FileTypeIcon` in a 40px frame, 13px filename text, 10px secondary text, and a 12px Open action. It shows the basename and description, or the file type when no description exists; a trailing parenthesized suffix in the description is omitted, and hovering the card replaces that line with the Sidebar-preview action. Clicking the card or the left side of its split Open control previews the file in the right Sidebar. The chevron opens the standard menu for the Host default application plus Show in Finder on macOS, Show in File Explorer on Windows and WSL, or Open containing folder through the default Linux file manager. Matching inline-code references preview the same source files in the right Sidebar; native opening requires an explicit card-menu action. Repeated declaration of a path selects its latest description before the closing reply.
+The Web `standard`, `ptc`, and `cordis` presets expose `present` for final files accessible through the Session filesystem, including files created through Bash. Call it with `files: [{ path, description? }]` after creating the files. The [present tool](../../deliverables/tool-present/README.md) owns file-count limits and Session declarations. A single delivery fills the row; multiple deliveries form a two-column grid, collapsed after four files. Cards show the basename, description or file type, and a shared native opening control. Clicking the card previews the file in the right Sidebar. The control opens the default application and lists associated applications, with file reveal last. Matching inline-code references also open Sidebar previews. Duplicate declarations use the last description before the closing reply.
 
-The `present` tool row retains the delivery-document glyph while showing running, delivered, failed, or interrupted status; expanding a settled row reveals its recorded result. The collapsible card grid retains every delivered file. Both menu actions share pending state and show progress, acknowledgement, or an action-specific retryable error. Desktop information is read when delivery cards appear and invalidated on connection replacement; responses from a replaced connection cannot publish metadata. Selecting a native menu action returns keyboard focus to the available Sidebar Open button. Pending actions close the menu until another explicit gesture. A missing desktop disables the Open menu; a failed desktop-information read offers Retry. It requires a desktop and a suitable default application on the serving Host; a remote browser does not open applications on its own device.
+The `present` tool row retains its document icon and recorded result across progress, success, failure, and interruption. Native actions share pending state and publish progress or retryable errors on the card. Successful open or reveal feedback stays visible for five seconds, fades over 200ms, then restores the file description; failures remain visible until another attempt. Desktop metadata is loaded when cards mount and invalidated on connection replacement. Without a Host desktop, cards retain Sidebar preview but omit native controls; failed metadata reads offer Retry. Delivery cards and change review expose `deliverables.file.actions` and `deliverables.review.file.actions`, supplied by [ui-open-in-app](../ui-open-in-app/README.md). Association GET requests and native POST actions both validate the recorded file coordinates and Session filesystem mapping before using the Host desktop.
 
 ### The changed-files card
 
diff --git a/packages/client/ui-deliverables/README.zh.md b/packages/client/ui-deliverables/README.zh.md
index 3e59ed2b7d..82239ba169 100644
--- a/packages/client/ui-deliverables/README.zh.md
+++ b/packages/client/ui-deliverables/README.zh.md
@@ -30,9 +30,9 @@ kind: "package-reference"
 <a id="explicit-deliveries"></a>
 ### 显式交付
 
-Web 的 `standard`、`ptc` 与 `cordis` preset 提供 `present` 用于声明交付会话文件系统可访问的最终文件，包括通过 Bash 创建的文件。创建文件后，以 `files: [{ path, description? }]` 调用。[present 工具](../../deliverables/tool-present/README.zh.md)拥有文件数量限制和会话声明。收尾轮次把单个交付显示为横向占满内容区的卡片，把多个交付显示为间距 10px 的双列网格。文件超过四个时，列表默认收起，并提供显示或隐藏完整列表的控件。每张卡片高 60px，上下内边距为 8px、左右为 10px；40px 图标框内使用 20px 的共享 `FileTypeIcon`，文件名为 13px、次要文本为 10px，“打开”操作为 12px。卡片显示 basename 与说明；没有说明时显示文件类型，说明末尾的括号后缀会被省略，悬停卡片时该行切换为侧栏预览提示。点击卡片或分段“打开”控件的左侧会在右侧 Sidebar 中预览文件；右侧箭头打开标准菜单，其中提供 Host 默认应用，以及 macOS 上的“在 Finder 中显示”、Windows 和 WSL 上的“在文件资源管理器中显示”或 Linux 默认文件管理器的“打开所在文件夹”。匹配的行内代码引用在右侧 Sidebar 中预览相同源文件；原生打开需要显式选择卡片菜单中的操作。同一路径重复声明时，选择收尾回复之前最近一次的说明。
+Web 的 `standard`、`ptc` 与 `cordis` preset 提供 `present`，用于声明会话文件系统可访问的最终文件，包括通过 Bash 创建的文件。创建后以 `files: [{ path, description? }]` 调用。[present 工具](../../deliverables/tool-present/README.zh.md)拥有文件数量限制和会话声明。单个交付占满一行，多个交付使用双列网格，超过四个时默认收起。卡片显示文件名、说明或文件类型，以及共享的原生打开控件。点击卡片会在右侧 Sidebar 预览文件。控件打开默认应用，并列出关联应用，文件定位始终放在最后。匹配的行内代码引用也打开 Sidebar 预览。重复声明使用收尾回复之前最近一次的说明。
 
-`present` 工具行在正在交付、已交付、失败或中断状态下都保留交付文档图标；展开已结束的调用可查看其记录的结果。可折叠卡片网格保留全部交付文件。菜单中的两个操作共享等待状态，并显示进度、成功确认或各自可重试的错误。交付卡片出现时读取桌面信息，连接更换时清除缓存，旧连接的响应不能更新元数据。选择原生菜单操作后，键盘焦点回到仍可用的侧边栏“打开”按钮。等待操作完成时关闭菜单，用户再次点击才会打开。Host 没有桌面时禁用“打开”菜单；桌面信息读取失败时提供“重试”。服务 Host 必须具备桌面和合适的默认应用；远程浏览器不会打开其所在设备上的应用。
+`present` 工具行在执行、成功、失败和中断状态下保留文档图标及记录的结果。原生操作共享等待状态，并在卡片显示进度或可重试错误。打开或定位成功的反馈显示五秒后，在 200ms 内淡出并恢复文件说明；失败信息保留到下次尝试。卡片挂载时读取桌面信息，连接更换时清除缓存。Host 没有桌面时，卡片保留 Sidebar 预览并隐藏原生控件；元数据读取失败时提供重试。交付卡片和变更对比页通过 `deliverables.file.actions` 和 `deliverables.review.file.actions` 使用 [ui-open-in-app](../ui-open-in-app/README.zh.md) 提供的控件。关联应用 GET 查询与原生 POST 操作都会先校验记录中的文件坐标及会话文件系统映射，再调用 Host 桌面。
 
 ### 改动文件卡片
 
diff --git a/packages/client/ui-deliverables/src/client/Deliverables.module.css b/packages/client/ui-deliverables/src/client/Deliverables.module.css
index c772e6d01c..c59f619a02 100644
--- a/packages/client/ui-deliverables/src/client/Deliverables.module.css
+++ b/packages/client/ui-deliverables/src/client/Deliverables.module.css
@@ -18,18 +18,14 @@
 .description { overflow: hidden; color: var(--dsw-alias-label-tertiary); font-size: 10px; font-weight: 400; line-height: 16px; text-overflow: ellipsis; white-space: nowrap; }
 .description[data-error='true'] { color: var(--dsw-alias-state-error-primary); }
 .previewHint { display: none; }
-.file:hover .secondaryText { display: none; }
-.file:hover .previewHint { display: inline; }
-.split { display: inline-flex; flex: none; align-items: stretch; box-sizing: border-box; height: 28px; overflow: hidden; pointer-events: auto; border: 0.5px solid var(--dsw-alias-border-l3); border-radius: 10px; background: var(--dsw-alias-button-floating-fill); }
-.menuAnchor { align-self: stretch; }
-.open, .chevron { display: inline-flex; align-items: center; justify-content: center; border: 0; background: none; color: var(--dsw-alias-label-primary); cursor: pointer; font-family: var(--dsw-font-family); }
-.open { padding: 4px 8px; font-size: 12px; line-height: 18px; }
-.chevron { padding: 4px 5px; border-left: 0.5px solid var(--dsw-alias-border-l3); color: var(--dsw-alias-label-secondary); }
-.open:hover, .open:focus-visible, .chevron:hover:not(:disabled), .chevron:focus-visible { background: var(--dsw-alias-interactive-bg-hover); }
-.chevron:disabled { color: var(--dsw-alias-label-dimmed); cursor: not-allowed; }
-.menuActionIcon { display: block; width: 16px; height: 16px; }
+.file:hover .description:not([role='status']) .secondaryText { display: none; }
+.file:hover .description:not([role='status']) .previewHint { display: inline; }
 .toggle { align-self: center; display: inline-flex; align-items: center; gap: 4px; min-width: 0; padding: 1px 11px; border: 0; border-radius: 8px; background: transparent; color: var(--dsw-alias-label-tertiary); cursor: pointer; font: inherit; font-size: 12px; line-height: 18px; }
 .toggle:hover { background: var(--dsw-alias-interactive-bg-hover); }
 .toggle svg { flex: none; width: 14px; height: 14px; }
 @container (max-width: 620px) { .presented { grid-template-columns: minmax(0, 1fr); } }
-@media (pointer: coarse) { .split { min-height: 44px; } .open, .chevron { min-width: 44px; } }
+.actions { display: inline-flex; flex: none; pointer-events: auto; }
+
+.secondaryText[data-success] { animation-name: success-fade; animation-timing-function: ease-out; animation-fill-mode: forwards; }
+@keyframes success-fade { to { opacity: 0; } }
+@media (prefers-reduced-motion: reduce) { .secondaryText[data-success] { animation-name: none; } }
diff --git a/packages/client/ui-deliverables/src/client/Deliverables.tsx b/packages/client/ui-deliverables/src/client/Deliverables.tsx
index ed7c034941..3fae39bd01 100644
--- a/packages/client/ui-deliverables/src/client/Deliverables.tsx
+++ b/packages/client/ui-deliverables/src/client/Deliverables.tsx
@@ -2,7 +2,7 @@
 import { useEffect, useState } from 'react'
 import type { TurnTailOwnerProps } from '@deepseek-ai/dsh-client-ui-chat/client'
 import { Button, IconChevronDownOutlineRegular, IconChevronUpOutlineRegular } from '@deepseek-ai/dsh-client-ui-primitives'
-import type { GlobalStandardProps, InjectFace, PropsLocale, PropsRuntime, SessionStandardProps } from '@deepseek-ai/dsh-client-ui-slots'
+import type { GlobalStandardProps, InjectFace, PropsLocale, PropsRenderSlots, PropsRuntime, SessionStandardProps } from '@deepseek-ai/dsh-client-ui-slots'
 import type { ObservableSnapshot } from '@deepseek-ai/dsh-client-store'
 import type { PresentedOpenController } from './present-open.ts'
 import type { ChangesSummaryStore } from './changes-summary.ts'
@@ -50,24 +50,24 @@ export function selectDeliverables(owner: TurnTailOwnerProps): DeliverablesMatch
  * @param props - closing Turn, file actions, and localized copy.
  * @returns file rows, or null when the Turn declares none.
  */
-export function DeliverablesTail(props: PropsRuntime<'conversation.chat.turnTail'> & PropsLocale<typeof NS> & InjectFace<DeliverablesInjected>) {
+export function DeliverablesTail(props: PropsRuntime<'conversation.chat.turnTail'> & PropsLocale<typeof NS> & InjectFace<DeliverablesInjected> & PropsRenderSlots<'deliverables.file.actions'>) {
   const matched = selectDeliverables(props)
   return matched === null ? null : <Deliverables {...props} matched={matched} />
 }
 
 /**
  * Render the changed-files card, once the Host has served the announced
- * summary and it lists a file, and default-application buttons for declared
+ * summary and it lists a file, and shared native opening controls for declared
  * files. A summary the Host no longer serves leaves no card.
  * @param props - matched announcement and files, workspace opener, and localized copy.
  * @returns the closing turn's file rows.
  */
 export function Deliverables({
   matched, openFile, t, sessionId, useSessions, openPresented, openChangesReview, usePresentedOpen, usePresentedHost,
-  useChangesSummary, reloadPresentedHost, loadChangesSummary, useShowCodeDiff,
+  useChangesSummary, reloadPresentedHost, loadChangesSummary, useShowCodeDiff, renderSlot,
 }: Pick<TurnTailOwnerProps, 'openFile'> & {
   matched: DeliverablesMatch
-} & PropsLocale<typeof NS> & Pick<SessionStandardProps, 'sessionId'> & Pick<GlobalStandardProps, 'useSessions'> & InjectFace<DeliverablesInjected>) {
+} & PropsLocale<typeof NS> & Pick<SessionStandardProps, 'sessionId'> & Pick<GlobalStandardProps, 'useSessions'> & InjectFace<DeliverablesInjected> & PropsRenderSlots<'deliverables.file.actions'>) {
   const [expanded, setExpanded] = useState(false)
   const showCodeDiff = useShowCodeDiff(value => value)
   const cwd = useSessions(state => state.byId[sessionId]?.cwd)
@@ -105,7 +105,13 @@ export function Deliverables({
           phase={states[presentedFileUrl(sessionId, file.seq, file.index)]}
           host={host === 'error' ? null : host} t={t}
           onPreview={() => { openFile(file.path) }}
-          onAction={(action) => { void openPresented(sessionId, file.seq, file.index, action) }} />)}
+          actions={renderSlot('deliverables.file.actions', {
+            actionUrl: presentedFileUrl(sessionId, file.seq, file.index),
+            available: host !== null && host !== 'error' && host.available,
+            pending: states[presentedFileUrl(sessionId, file.seq, file.index)] === 'opening'
+              || states[presentedFileUrl(sessionId, file.seq, file.index)] === 'revealing',
+            onAction: (action, application) => openPresented(sessionId, file.seq, file.index, action, application),
+          })} />)}
       </div>
       {collapsible && <button type="button" className={css.toggle}
         aria-expanded={expanded}
diff --git a/packages/client/ui-deliverables/src/client/PresentedFileCard.tsx b/packages/client/ui-deliverables/src/client/PresentedFileCard.tsx
index 97fd431e32..f0dd26035b 100644
--- a/packages/client/ui-deliverables/src/client/PresentedFileCard.tsx
+++ b/packages/client/ui-deliverables/src/client/PresentedFileCard.tsx
@@ -1,13 +1,10 @@
-/** File identity and explicit default-app or file-manager actions for one delivery. */
-import { useRef, useState } from 'react'
+/** File identity, Sidebar preview, and contributed native actions for one delivery. */
+import type { ReactNode } from 'react'
 import { resolveWorkspacePath } from '@deepseek-ai/dsh-util-workspace-path'
-import {
-  Menu, FileTypeIcon, fileExtension, IconRightUpOutlineRegular,
-  IconChevronDownOutlineRegular, IconFolderOpenOutlineRegular,
-} from '@deepseek-ai/dsh-client-ui-primitives'
+import { FileTypeIcon, fileExtension } from '@deepseek-ai/dsh-client-ui-primitives'
 import type { PropsLocale } from '@deepseek-ai/dsh-client-ui-slots'
-import type { PresentedAction, PresentedHost } from '../presented.ts'
-import type { PresentedOpenPhase } from './present-open.ts'
+import type { PresentedHost } from '../presented.ts'
+import { PRESENTED_SUCCESS_HOLD_MS, PRESENTED_SUCCESS_FADE_MS, type PresentedOpenPhase } from './present-open.ts'
 import { basename, type PresentedPath } from './turn-deliverables.ts'
 import type { NS } from './locales.ts'
 import css from './Deliverables.module.css'
@@ -22,25 +19,16 @@ function cardDescription(description: string | undefined, fallback: string): str
  * @param props - durable file metadata, Sidebar preview, Host capabilities, gesture status, and localized copy.
  * @returns the file card and its anchored action menu.
  */
-export function PresentedFileCard({ file, cwd, phase, host, onPreview, onAction, t }: {
+export function PresentedFileCard({ file, cwd, phase, host, onPreview, actions, t }: {
   file: PresentedPath
   cwd: string | undefined
   phase: PresentedOpenPhase | undefined
   host: PresentedHost | null
   onPreview: () => void
-  onAction: (action: PresentedAction) => void
+  actions: ReactNode
 } & PropsLocale<typeof NS>) {
-  const [menuOpen, setMenuOpen] = useState(false)
-  const previewRef = useRef<HTMLButtonElement>(null)
-  const pending = phase === 'opening' || phase === 'revealing'
-  const menuDisabled = pending || host === null || !host.available
-  if (menuDisabled && menuOpen) setMenuOpen(false)
+  const succeeded = phase === 'opened' || phase === 'revealed'
   const reveal = host?.fileManager ?? 'directory'
-  const act = (action: PresentedAction) => {
-    setMenuOpen(false)
-    previewRef.current?.focus()
-    onAction(action)
-  }
   const name = basename(file.path)
   const metadata = fileExtension(name).toUpperCase() || t('presented.file')
   const status = phase === undefined
@@ -55,31 +43,16 @@ export function PresentedFileCard({ file, cwd, phase, host, onPreview, onAction,
     <div className={css.fileBody}>
       <div className={css.details}>
         <span className={css.fileName}>{name}</span>
-        <span className={css.description} role={phase === undefined ? undefined : 'status'}
+        <span className={css.description} data-presented-description role={phase === undefined ? undefined : 'status'}
           data-error={phase === 'error' || phase === 'revealError' || phase === 'nativeUnavailable' ? true : undefined}>
-          <span className={css.secondaryText}>{status}</span>
+          <span className={css.secondaryText} data-success={succeeded || undefined}
+            style={succeeded ? { animationDelay: `${PRESENTED_SUCCESS_HOLD_MS}ms`, animationDuration: `${PRESENTED_SUCCESS_FADE_MS}ms` } : undefined}>
+            {status}
+          </span>
           <span className={css.previewHint}>{t('presented.preview')}</span>
         </span>
       </div>
-      <div className={css.split}>
-        <button ref={previewRef} type="button" className={css.open}
-          aria-label={t('presented.previewButton', { name: file.path })}
-          onClick={onPreview}>{t('presented.action')}</button>
-        <Menu className={css.menuAnchor} open={menuOpen && !menuDisabled} autoFocus portal align="end" onClose={() => { setMenuOpen(false) }}
-          anchor={<button type="button" className={css.chevron} disabled={menuDisabled}
-            aria-haspopup="menu" aria-expanded={menuOpen && !menuDisabled}
-            aria-label={t('presented.more', { name: file.path })}
-            onClick={() => { setMenuOpen(value => !value) }}>
-            <IconChevronDownOutlineRegular size={11} />
-          </button>}
-          items={[
-            { id: 'open', icon: <IconRightUpOutlineRegular size={16} className={css.menuActionIcon} />,
-              label: t('presented.defaultApp') },
-            { id: 'reveal', icon: <IconFolderOpenOutlineRegular />,
-              label: t(`presented.${reveal}`) },
-          ]}
-          onSelect={(id) => { act(id === 'reveal' ? 'reveal' : 'open') }} />
-      </div>
+      <div className={css.actions}>{actions}</div>
     </div>
   </div>
 }
diff --git a/packages/client/ui-deliverables/src/client/ReviewTab.tsx b/packages/client/ui-deliverables/src/client/ReviewTab.tsx
index 01ac90f1fa..362f88ec9d 100644
--- a/packages/client/ui-deliverables/src/client/ReviewTab.tsx
+++ b/packages/client/ui-deliverables/src/client/ReviewTab.tsx
@@ -7,11 +7,11 @@ import { useEffect, useMemo, useRef, useState } from 'react'
 import type { ReactNode, UIEvent } from 'react'
 import {
   Button, IconChevronDownOutlineRegular, IconCompareSplitOutlineRegular, IconInspectOutlineRegular,
-  IconNowrapFillRegular, IconRightUpOutlineRegular, IconWrapFillRegular, Menu, Tooltip,
+  IconNowrapFillRegular, IconWrapFillRegular, Menu, Tooltip,
   languageForPath, useCodeHighlighter,
 } from '@deepseek-ai/dsh-client-ui-primitives'
 import type { CodeHighlighter, HighlightSpan } from '@deepseek-ai/dsh-client-ui-primitives'
-import type { InjectFace, PropsLocale, PropsRuntime, PropsStore } from '@deepseek-ai/dsh-client-ui-slots'
+import type { InjectFace, PropsLocale, PropsRenderSlots, PropsRuntime, PropsStore } from '@deepseek-ai/dsh-client-ui-slots'
 import type { ObservableSnapshot } from '@deepseek-ai/dsh-client-store'
 import { fileAddressFor } from '@deepseek-ai/dsh-util-workspace-path'
 import type { WorkspaceChangedFile, WorkspaceDiffHunk } from '@deepseek-ai/dsh-workspace-changes/types'
@@ -45,7 +45,7 @@ export interface ReviewInjected {
 
 /** The body's composed props: the tab it draws, its store, its injected face, and its copy. */
 export type ReviewTabProps = PropsRuntime<'sidebar.right.pane.tab'> & PropsStore<ReturnType<typeof createReviewStore>>
-  & InjectFace<ReviewInjected> & PropsLocale<typeof NS>
+  & InjectFace<ReviewInjected> & PropsLocale<typeof NS> & PropsRenderSlots<'deliverables.review.file.actions'>
 
 /** One drawn line of a hunk with its line numbers on each side. */
 export interface DiffRow {
@@ -189,7 +189,7 @@ function Counts({ file, t }: { file: WorkspaceChangedFile } & PropsLocale<typeof
  */
 export function ReviewTab({
   useTabInfo, sessionId, useSessions, useStore, actions, useChangesSummary, useChangesDiff, usePresentedOpen, usePresentedHost,
-  loadChangesSummary, loadChangesDiff, reloadPresentedHost, openChanged, t,
+  loadChangesSummary, loadChangesDiff, reloadPresentedHost, openChanged, t, renderSlot,
 }: ReviewTabProps): ReactNode {
   const { tab } = useTabInfo()
   const { navigation, signal } = tab
@@ -266,11 +266,11 @@ export function ReviewTab({
             <button type="button" className={css.tool} aria-label={t('review.openFileAria', { name: file.display })} data-review-tool="open-file"
               onClick={() => { tab.actions.openResource(fileAddressFor(sessionId, cwd, file.path)) }}><IconInspectOutlineRegular /></button>
           </Tooltip>}
-          {file !== undefined && native && <Tooltip label={t(phase === 'error' ? 'diff.openNativeError' : 'diff.openNative')} side="bottom" delayMs={500}>
-            <button type="button" className={css.tool} disabled={phase === 'opening'} data-review-tool="open-native"
-              aria-label={t('diff.openNativeAria', { name: file.display })} data-error={phase === 'error' || undefined}
-              onClick={() => { void openChanged(sessionId, seq, index) }}><IconRightUpOutlineRegular /></button>
-          </Tooltip>}
+          {file !== undefined && renderSlot('deliverables.review.file.actions', {
+            actionUrl: changedFileUrl(sessionId, seq, index), available: native,
+            pending: phase === 'opening' || phase === 'revealing',
+            onAction: (action, application) => openChanged(sessionId, seq, index, action, application),
+          })}
         </span>
       </div>
       {summaryState === 'loading' && <p className={css.status} role="status">{t('diff.loading')}</p>}
diff --git a/packages/client/ui-deliverables/src/client/file-actions.ts b/packages/client/ui-deliverables/src/client/file-actions.ts
new file mode 100644
index 0000000000..1326f80b76
--- /dev/null
+++ b/packages/client/ui-deliverables/src/client/file-actions.ts
@@ -0,0 +1,27 @@
+/** Native file-action contribution shared by delivery cards and change review. */
+import type { PresentedOpenFailure } from './present-open.ts'
+import type { PresentedAction } from '../presented.ts'
+
+declare module '@deepseek-ai/dsh-client-ui-slots' {
+  interface SlotMap {
+    /** Open one file through its authorized Session event coordinates. */
+    'deliverables.file.actions': {
+      kind: 'list'
+      scope: 'session'
+      owner: {
+        /** Authenticated document-relative action route carrying Session event coordinates. */
+        readonly actionUrl: string
+        readonly available: boolean
+        readonly pending: boolean
+        /** Execute the selected native action and publish status on the owning file surface. */
+        readonly onAction: (action: PresentedAction, application?: string) => Promise<PresentedOpenFailure>
+      }
+    }
+    /** The same file actions owned by a changed-file review tab. */
+    'deliverables.review.file.actions': {
+      kind: 'list'
+      scope: 'session'
+      owner: SlotMap['deliverables.file.actions']['owner']
+    }
+  }
+}
diff --git a/packages/client/ui-deliverables/src/client/index.ts b/packages/client/ui-deliverables/src/client/index.ts
index e61596ea4b..f000547756 100644
--- a/packages/client/ui-deliverables/src/client/index.ts
+++ b/packages/client/ui-deliverables/src/client/index.ts
@@ -8,6 +8,7 @@
  * cap, and copy — so composing this plugin out of cordis.yml removes every
  * surface; the owning view renders an empty list and inert prose at zero cost.
  */
+import './file-actions.ts'
 import type { Context as ClientContext } from '@deepseek-ai/cordis'
 import type {} from '@deepseek-ai/dsh-api-remotes/client'
 import type {} from '@deepseek-ai/dsh-client-connection/client'
@@ -63,13 +64,14 @@ export function apply(ctx: ClientContext): void {
       name: 'conversation.chat.turnTail',
       id: '@deepseek-ai/dsh-client-ui-deliverables',
       locale: NS,
+      children: { 'deliverables.file.actions': { kind: 'list', scope: 'session' } },
       inject: (): DeliverablesInjected => ({
         hooks: { presentedOpen: opener.state, presentedHost: opener.host, changesSummary: summaries.state,
           showCodeDiff: ctx.settingsScope.developerTools.enabled },
         reloadPresentedHost: () => opener.loadHost(),
         loadChangesSummary: (sessionId, seq) => summaries.load(sessionId, seq),
-        openPresented: (sessionId, seq, index, action) => opener.open(sessionId, seq, index, action),
-        openChanged: (sessionId, seq, index) => opener.openChanged(sessionId, seq, index),
+        openPresented: (sessionId, seq, index, action, application) => opener.open(sessionId, seq, index, action, application),
+        openChanged: (sessionId, seq, index, action, application) => opener.openChanged(sessionId, seq, index, action, application),
         openChangesReview: (coordinates, index) => {
           ctx.sidebarRight.openResource(changesReviewAddress(coordinates), { params: { index } })
         },
@@ -84,12 +86,13 @@ export function apply(ctx: ClientContext): void {
   ctx.effect(() => ctx.slots.inject('sidebar.right.pane.tab', () => ctx.slots.register(
     {
       name: 'sidebar.right.pane.tab', key: CHANGES_REVIEW_ID, locale: NS, store: createReviewStore(),
+      children: { 'deliverables.review.file.actions': { kind: 'list', scope: 'session' } },
       inject: (): ReviewInjected => ({
         hooks: { changesSummary: summaries.state, changesDiff: diffs.state, presentedOpen: opener.state, presentedHost: opener.host },
         loadChangesSummary: (sessionId, seq) => summaries.load(sessionId, seq),
         loadChangesDiff: (sessionId, seq, index) => diffs.load(sessionId, seq, index),
         reloadPresentedHost: () => opener.loadHost(),
-        openChanged: (sessionId, seq, index) => opener.openChanged(sessionId, seq, index),
+        openChanged: (sessionId, seq, index, action, application) => opener.openChanged(sessionId, seq, index, action, application),
       }),
     },
     ReviewTab,
diff --git a/packages/client/ui-deliverables/src/client/locales.ts b/packages/client/ui-deliverables/src/client/locales.ts
index 7eacc52c34..69e976fa06 100644
--- a/packages/client/ui-deliverables/src/client/locales.ts
+++ b/packages/client/ui-deliverables/src/client/locales.ts
@@ -15,12 +15,6 @@ export const zh = {
   'presented.unavailable': '此主机没有可用的桌面，无法使用外部程序打开文件或文件夹；文件仍可在侧边栏预览',
   'presented.retry': '重试',
   'presented.hostError': '无法读取主机桌面信息',
-  'presented.directory': '打开所在文件夹',
-  'presented.explorer': '在文件资源管理器中显示',
-  'presented.finder': '在 Finder 中显示',
-  'presented.defaultApp': '用默认应用打开',
-  'presented.more': '{name} 的更多文件操作',
-  'presented.action': '打开',
   'presented.preview': '在侧边栏预览',
   'presented.previewButton': '在侧边栏打开 {name}',
   'presented.previewCard': '在侧边栏预览 {name}',
@@ -29,7 +23,7 @@ export const zh = {
   'presented.collapse': '收起',
   'presented.collapseAria': '收起交付文件列表',
   'presented.opening': '正在打开…',
-  'presented.opened': '已在默认程序中打开',
+  'presented.opened': '已请求打开',
   'presented.error': '打开失败，点击重试',
   'presented.file': '文件',
   'row.title': '交付文件',
@@ -59,7 +53,6 @@ export const zh = {
   'review.wrapAria': '自动换行',
   'review.openFile': '在侧边栏打开整个文件',
   'review.openFileAria': '在侧边栏打开 {name}',
-  'diff.openNativeAria': '用默认应用打开 {name}',
   'diff.loading': '正在读取改动…',
   'diff.missing': '这轮改动的内容已不可用',
   'diff.error': '无法读取改动',
@@ -70,8 +63,6 @@ export const zh = {
   'diff.unchanged': '两侧内容相同',
   'diff.coarse': '逐行对比超时，按整个文件替换显示',
   'diff.truncated': '只显示前 {count} 行',
-  'diff.openNative': '用默认应用打开',
-  'diff.openNativeError': '打开失败，点击重试',
 }
 
 /** English dictionary (same key set). */
@@ -86,12 +77,6 @@ export const en: Record<DeliverablesKey, string> = {
   'presented.unavailable': 'This Host has no desktop available to open files or folders in external apps. Files can still be previewed in the sidebar.',
   'presented.retry': 'Retry',
   'presented.hostError': 'Could not read the Host desktop information',
-  'presented.directory': 'Open containing folder',
-  'presented.explorer': 'Show in File Explorer',
-  'presented.finder': 'Show in Finder',
-  'presented.defaultApp': 'Open in default app',
-  'presented.more': 'More file actions for {name}',
-  'presented.action': 'Open',
   'presented.preview': 'Preview in sidebar',
   'presented.previewButton': 'Open {name} in sidebar',
   'presented.previewCard': 'Preview {name} in sidebar',
@@ -100,7 +85,7 @@ export const en: Record<DeliverablesKey, string> = {
   'presented.collapse': 'Collapse',
   'presented.collapseAria': 'Collapse delivered files',
   'presented.opening': 'Opening…',
-  'presented.opened': 'Opened in default app',
+  'presented.opened': 'Open requested',
   'presented.error': 'Could not open. Click to retry.',
   'presented.file': 'File',
   'row.title': 'Present files',
@@ -130,7 +115,6 @@ export const en: Record<DeliverablesKey, string> = {
   'review.wrapAria': 'Line wrap',
   'review.openFile': 'Open the whole file in the sidebar',
   'review.openFileAria': 'Open {name} in sidebar',
-  'diff.openNativeAria': 'Open {name} in default app',
   'diff.loading': 'Reading changes…',
   'diff.missing': 'The contents of this turn’s changes are no longer available',
   'diff.error': 'Could not read the changes',
@@ -141,8 +125,6 @@ export const en: Record<DeliverablesKey, string> = {
   'diff.unchanged': 'Both sides hold the same lines',
   'diff.coarse': 'Line comparison timed out; shown as a whole-file replacement',
   'diff.truncated': 'Showing the first {count} lines',
-  'diff.openNative': 'Open in default app',
-  'diff.openNativeError': 'Could not open. Click to retry.',
 }
 
 /** Union of this namespace's dictionary keys. */
diff --git a/packages/client/ui-deliverables/src/client/present-open.ts b/packages/client/ui-deliverables/src/client/present-open.ts
index d724816d19..c116de3a44 100644
--- a/packages/client/ui-deliverables/src/client/present-open.ts
+++ b/packages/client/ui-deliverables/src/client/present-open.ts
@@ -4,7 +4,15 @@ import type { SessionId } from '@deepseek-ai/dsh-session/types'
 import { changedFileUrl } from '../changes.ts'
 import { presentedFileUrl, PRESENT_HOST_ROUTE, isPresentedHost, type PresentedAction, type PresentedHost } from '../presented.ts'
 
-/** State of the latest explicit open gesture for one saved file. */
+/** Success feedback remains fully visible for five seconds before fading. */
+export const PRESENTED_SUCCESS_HOLD_MS = 5000
+/** Fade interval shared by the card animation and status expiry. */
+export const PRESENTED_SUCCESS_FADE_MS = 200
+
+/** Failure feedback for the shared native opening control. */
+export type PresentedOpenFailure = 'openError' | 'revealError' | null
+
+/** State published on the owning file card. */
 export type PresentedOpenPhase = 'opening' | 'opened' | 'revealing' | 'revealed' | 'error' | 'revealError' | 'nativeUnavailable'
 
 /** One browser plugin's file-open requests, cancelled when that plugin is disposed. */
@@ -13,10 +21,11 @@ export class PresentedOpenController {
   readonly state = createSnapshotStore<Record<string, PresentedOpenPhase | undefined>>({})
   /** Native destination metadata, or a retryable read failure. */
   readonly host = createSnapshotStore<PresentedHost | 'error' | null>(null)
+  private readonly expiry = new Map<string, ReturnType<typeof setTimeout>>()
   private loading: Promise<void> | undefined
   private metadata = new AbortController()
   private readonly lifetime = new AbortController()
-  private readonly pending = new Set<Promise<void>>()
+  private readonly pending = new Set<Promise<void | PresentedOpenFailure>>()
 
   /**
    * Open a declared file once while a request for the same coordinates is pending.
@@ -25,10 +34,13 @@ export class PresentedOpenController {
    * @param seq - durable delivery event sequence.
    * @param index - original file index within that event.
    * @param action - default application open or file-manager reveal.
-   * @returns after the Host acknowledges opening or the error state is published.
+   * @param application - registered handler identifier for an explicit application choice.
+   * @returns null after a successful handoff, or the failure to announce after publishing card status.
    */
-  open(sessionId: SessionId, seq: number, index: number, action: PresentedAction = 'open'): Promise<void> {
-    return this.openUrl(presentedFileUrl(sessionId, seq, index), action)
+  open(
+    sessionId: SessionId, seq: number, index: number, action: PresentedAction = 'open', application?: string,
+  ): Promise<PresentedOpenFailure> {
+    return this.openUrl(presentedFileUrl(sessionId, seq, index), action, application)
   }
 
   /**
@@ -36,20 +48,25 @@ export class PresentedOpenController {
    * @param sessionId - viewed Session.
    * @param seq - durable workspace/changes event sequence.
    * @param index - original file index within that event.
-   * @returns after the Host acknowledges opening or the error state is published.
+   * @param action - application open or file-manager reveal.
+   * @param application - registered handler identifier for an explicit application choice.
+   * @returns null after a successful handoff, or the failure to announce after publishing card status.
    */
-  openChanged(sessionId: SessionId, seq: number, index: number): Promise<void> {
-    return this.openUrl(changedFileUrl(sessionId, seq, index), 'open')
+  openChanged(
+    sessionId: SessionId, seq: number, index: number, action: PresentedAction = 'open', application?: string,
+  ): Promise<PresentedOpenFailure> {
+    return this.openUrl(changedFileUrl(sessionId, seq, index), action, application)
   }
 
-  private async openUrl(url: string, action: PresentedAction): Promise<void> {
+  private async openUrl(url: string, action: PresentedAction, application?: string): Promise<PresentedOpenFailure> {
     const phase = this.state.getSnapshot()[url]
-    if (this.lifetime.signal.aborted || phase === 'opening' || phase === 'revealing') return
+    if (this.lifetime.signal.aborted || phase === 'opening' || phase === 'revealing') return null
+    this.clearExpiry(url)
     this.state.update((state) => { state[url] = action === 'open' ? 'opening' : 'revealing' })
-    const task = this.request(url, action)
+    const task = this.request(url, action, application)
     this.pending.add(task)
     try {
-      await task
+      return await task
     } finally {
       this.pending.delete(task)
     }
@@ -100,19 +117,36 @@ export class PresentedOpenController {
   /** Cancel outstanding requests and wait until no request can publish state. */
   async dispose(): Promise<void> {
     this.lifetime.abort()
+    for (const url of this.expiry.keys()) this.clearExpiry(url)
     await Promise.all(this.pending)
   }
 
-  private async request(url: string, action: PresentedAction): Promise<void> {
+  private clearExpiry(url: string): void {
+    clearTimeout(this.expiry.get(url))
+    this.expiry.delete(url)
+  }
+
+  private async request(url: string, action: PresentedAction, application?: string): Promise<PresentedOpenFailure> {
     const failure = action === 'open' ? 'error' : 'revealError'
     let phase: PresentedOpenPhase = action === 'open' ? 'opened' : 'revealed'
     try {
-      const response = await fetch(action === 'open' ? url : `${url}&action=reveal`, { method: 'POST', signal: this.lifetime.signal })
+      const target = action === 'reveal' ? `${url}&action=reveal`
+        : application === undefined ? url : `${url}&application=${encodeURIComponent(application)}`
+      const response = await fetch(target, { method: 'POST', signal: this.lifetime.signal })
       if (!response.ok) phase = response.status === 422 ? 'nativeUnavailable' : failure
     } catch {
       // Transport failures share the retryable card state with Host open failures.
       phase = failure
     }
-    if (!this.lifetime.signal.aborted) this.state.update((state) => { state[url] = phase })
+    if (!this.lifetime.signal.aborted) {
+      if (phase === 'opened' || phase === 'revealed') {
+        this.expiry.set(url, setTimeout(() => {
+          this.expiry.delete(url)
+          this.state.update((state) => { Reflect.deleteProperty(state, url) })
+        }, PRESENTED_SUCCESS_HOLD_MS + PRESENTED_SUCCESS_FADE_MS))
+      }
+      this.state.update((state) => { state[url] = phase })
+    }
+    return phase === 'opened' || phase === 'revealed' ? null : action === 'reveal' ? 'revealError' : 'openError'
   }
 }
diff --git a/packages/client/ui-deliverables/src/present-open.ts b/packages/client/ui-deliverables/src/present-open.ts
index 56b88f0651..6023625644 100644
--- a/packages/client/ui-deliverables/src/present-open.ts
+++ b/packages/client/ui-deliverables/src/present-open.ts
@@ -34,12 +34,12 @@ export function registerPresentOpen(ctx: Context): void {
     await Promise.allSettled(pending)
   })
   const routes = [
-    [PRESENT_OPEN_PATH, 'POST', handlePresentOpen], [CHANGES_OPEN_PATH, 'POST', handleChangesOpen], [CHANGES_DIFF_PATH, 'GET', handleChangesDiff],
+    [PRESENT_OPEN_PATH, ['GET', 'POST'], handlePresentOpen], [CHANGES_OPEN_PATH, ['GET', 'POST'], handleChangesOpen], [CHANGES_DIFF_PATH, ['GET'], handleChangesDiff],
   ] as const
-  for (const [path, method, handler] of routes) {
+  for (const [path, methods, handler] of routes) {
     ctx.connection.fetch.register({
       path,
-      methods: [method],
+      methods: [...methods],
       requestBody: 'buffered',
       fetch: (request) => {
         const task = handler(ctx, new Request(request, {
@@ -91,7 +91,13 @@ async function openVerified(ctx: Context, request: Request, path: string, action
     return new Response('Path has no verified Host path.', { status: 422 })
   }
   request.signal.throwIfAborted()
-  await ctx.sessionController.openWorkspacePath({ path, ...(action === 'reveal' ? { action } : {}) }, request.signal)
+  if (request.method === 'GET') {
+    return Response.json(await ctx.sessionController.workspacePathApplications({ path }, request.signal),
+      { headers: { 'cache-control': 'no-store' } })
+  }
+  const application = new URL(request.url).searchParams.get('application')
+  await ctx.sessionController.openWorkspacePath({ path, ...(action === 'reveal' ? { action }
+    : application === null ? {} : { application }) }, request.signal)
   return new Response(null, { status: 204, headers: { 'cache-control': 'no-store' } })
 }
 
@@ -159,6 +165,8 @@ async function handleChangesDiff(ctx: Context, request: Request): Promise<Respon
 }
 
 async function handleChangesOpen(ctx: Context, request: Request): Promise<Response> {
+  const action = new URL(request.url).searchParams.get('action') ?? 'open'
+  if (action !== 'open' && action !== 'reveal') return new Response('Invalid file action.', { status: 400 })
   const coordinates = changedFileCoordinates(request)
   if (coordinates instanceof Response) return coordinates
   const { id, seq, index } = coordinates
@@ -171,7 +179,7 @@ async function handleChangesOpen(ctx: Context, request: Request): Promise<Respon
     const file = changes.files[index]
     if (file === undefined) return new Response('Changed file not found in this summary.', { status: 404 })
     const { absolutePath: path } = await ctx.workspaceFiles.stat({ sessionId: id, workspaceRoot }, file.path, request.signal)
-    return await openVerified(ctx, request, path, 'open')
+    return await openVerified(ctx, request, path, action)
   } catch (error: unknown) {
     request.signal.throwIfAborted()
     return new Response('Changed file unavailable.', { status: failureStatus(error) })
diff --git a/packages/client/ui-deliverables/tests/changes-open.host.spec.ts b/packages/client/ui-deliverables/tests/changes-open.host.spec.ts
index b391263de5..6fda6fed4a 100644
--- a/packages/client/ui-deliverables/tests/changes-open.host.spec.ts
+++ b/packages/client/ui-deliverables/tests/changes-open.host.spec.ts
@@ -61,7 +61,8 @@ async function fixture() {
     sessionId === 'owner' && seq === 9 && index === 0 ? comparison : undefined)
   ctx.provide('workspaceChanges', { summary, diff })
   const opener = vi.fn(async (_request: { path: string; action?: 'reveal' }, _signal: AbortSignal) => ({ opened: true as const }))
-  ctx.provide('sessionController', { openWorkspacePath: opener, workspaceDesktop: () => ({ name: 'desktop', available: true, fileManager: 'finder' }) } as never)
+  const applications = vi.fn(async () => [{ id: 'player', name: 'Player', default: true, icon: null }])
+  ctx.provide('sessionController', { workspacePathApplications: applications, openWorkspacePath: opener, workspaceDesktop: () => ({ name: 'desktop', available: true, fileManager: 'finder' }) } as never)
   const connection = new HostConnectionService(ctx, [], {} as BrowserAuth)
   await ctx.plugin({
     inject: ['connection', 'sessionQuery', 'sessionController', 'workspaceFiles', 'fs', 'sandboxPolicy', 'workspaceChanges'],
@@ -71,7 +72,7 @@ async function fixture() {
   const open = (query = '?sessionId=owner&seq=9&index=0') => handler.fetch(new Request(`http://localhost${CHANGES_OPEN_PATH}${query}`, { method: 'POST' }))
   const read = (query = '?sessionId=owner&seq=9') => handler.fetch(new Request(`http://localhost${CHANGED_FILES_PATH}${query}`))
   const compare = (query = '?sessionId=owner&seq=9&index=0') => handler.fetch(new Request(`http://localhost${CHANGES_DIFF_PATH}${query}`))
-  return { root, cwd, ctx, data, readEvent, open, read, compare, comparison, diff, opener, outside, summary }
+  return { handler, applications, root, cwd, ctx, data, readEvent, open, read, compare, comparison, diff, opener, outside, summary }
 }
 
 describe('change summary route', () => {
@@ -199,3 +200,26 @@ describe('changed files native open route', () => {
     expect(isChangesEvent(null)).toBe(false)
   })
 })
+
+
+it('queries handlers only after file authorization and forwards explicit application choices', async () => {
+  const { handler, applications, opener, open, ctx } = await fixture()
+  const url = 'http://localhost/api/changes.open?sessionId=owner&seq=9&index=0'
+  const response = await handler.fetch(new Request(url))
+  expect(response.status).toBe(200)
+  expect(await response.json()).toEqual([{ id: 'player', name: 'Player', default: true, icon: null }])
+  expect(opener).not.toHaveBeenCalled()
+  expect((await open('?sessionId=owner&seq=9&index=0&application=player')).status).toBe(204)
+  expect(opener.mock.lastCall?.[0]).toMatchObject({ application: 'player' })
+  expect((await handler.fetch(new Request(url.replace('index=0', 'index=999')))).status).toBe(404)
+  vi.spyOn(ctx.fs, 'processPathFromHostPath').mockReturnValue(undefined)
+  expect((await handler.fetch(new Request(url))).status).toBe(422)
+  expect(applications).toHaveBeenCalledOnce()
+})
+
+
+it('rejects an unsupported changed-file action before invoking the desktop', async () => {
+  const { open, opener } = await fixture()
+  expect((await open('?sessionId=owner&seq=9&index=0&action=remove')).status).toBe(400)
+  expect(opener).not.toHaveBeenCalled()
+})
diff --git a/packages/client/ui-deliverables/tests/deliverables.client.spec.tsx b/packages/client/ui-deliverables/tests/deliverables.client.spec.tsx
index c6cb256373..831c32a74d 100644
--- a/packages/client/ui-deliverables/tests/deliverables.client.spec.tsx
+++ b/packages/client/ui-deliverables/tests/deliverables.client.spec.tsx
@@ -6,6 +6,7 @@
  * registrations' fiber-teardown removal (HMR safety) against the real
  * SlotRegistry.
  */
+import { renderFileActions } from './file-actions.tsx'
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
 import { Context } from '@deepseek-ai/cordis'
 import { cleanup, fireEvent, render, within } from '@testing-library/react'
@@ -39,8 +40,10 @@ import type { SessionEvent } from '@deepseek-ai/dsh-session/types'
 
 function openProps(controller = new PresentedOpenController(), summaries = new ChangesSummaryStore()) {
   controller.host.set({ name: 'desktop', available: true, fileManager: 'finder' })
-  const sessions: SessionListState = { ids: [], byId: {}, phase: 'ready', projectionsBySession: {}, jobsBySession: {} }
+  const sessions: SessionListState = { ids: [], byId: {}, phase: 'ready', projectionsBySession: {} }
   return {
+    SessionProvider: ({ children }: { children?: import('react').ReactNode }) => <>{children}</>,
+    renderSlot: renderFileActions,
     useShowCodeDiff: <T,>(select: (value: boolean) => T): T => select(true),
     useSessions: <T,>(select: (state: SessionListState) => T): T => select(sessions),
     reloadPresentedHost: vi.fn(() => controller.loadHost()),
@@ -494,7 +497,7 @@ describe('ChangedFiles card', () => {
     controller = new PresentedOpenController(), locale = en, matched = { changes, presented: [] as never[] }, summaries = servedStore(),
   ) {
     const props = openProps(controller, summaries)
-    props.openChanged.mockResolvedValue(undefined)
+    props.openChanged.mockResolvedValue(null)
     const openFile = vi.fn<(path: string) => void>()
     const view = render(<Deliverables {...props} matched={matched} openFile={openFile} sessionId={SessionId('child-session')} t={makeTranslate(locale)} />)
     return { props, openFile, view }
@@ -845,7 +848,7 @@ describe('presented files', () => {
     const owner = tailOwner(deliverablesOf(value), 3, preview)
     const matched = selectDeliverables(owner)!
     const props = openProps()
-    props.openPresented.mockResolvedValue(undefined)
+    props.openPresented.mockResolvedValue(null)
     const view = render(<Deliverables {...props} matched={matched} openFile={owner.openFile} sessionId={SessionId('child-session')} t={makeTranslate(en)} />)
     expect(view.container.querySelectorAll('[data-presented-file]')).toHaveLength(4)
     const expand = view.getByRole('button', { name: 'Show all 8 delivered files' })
@@ -855,12 +858,10 @@ describe('presented files', () => {
     expect(view.getByRole('button', { name: 'Collapse delivered files' }).getAttribute('aria-expanded')).toBe('true')
     expect(view.queryByRole('link')).toBeNull()
     fireEvent.click(view.getByRole('button', { name: 'Preview report-0.docx in sidebar' }))
-    fireEvent.click(view.getByRole('button', { name: 'Open report-0.docx in sidebar' }))
-    expect(preview).toHaveBeenCalledTimes(2)
+    expect(preview).toHaveBeenCalledTimes(1)
     expect(preview).toHaveBeenLastCalledWith('report-0.docx')
-    fireEvent.click(view.getByRole('button', { name: 'More file actions for report-0.docx' }))
-    fireEvent.click(view.getByRole('menuitem', { name: 'Open in default app' }))
-    expect(props.openPresented).toHaveBeenCalledWith('child-session', 2, 0, 'open')
+    fireEvent.click(view.getAllByRole('button', { name: 'Native file action' })[0]!)
+    expect(props.openPresented).toHaveBeenCalledWith('child-session', 2, 0, 'open', undefined)
     fireEvent.click(view.getByRole('button', { name: 'Collapse delivered files' }))
     expect(view.container.querySelectorAll('[data-presented-file]')).toHaveLength(4)
     expect(view.container.querySelector('[data-changed-files]')).toBeNull()
@@ -934,7 +935,7 @@ it.each(['opening', 'opened', 'error'] as const)('shows the %s state and permits
     { path: 'report.txt', seq: 2, index: 0 },
   ] }} openFile={() => {}} sessionId={SessionId('session')} t={makeTranslate(en)} />)
   expect(view.getByText(en[`presented.${phase}`])).toBeTruthy()
-  expect((view.getByRole('button', { name: 'More file actions for report.txt' }) as HTMLButtonElement).disabled).toBe(phase === 'opening')
+  expect((view.getByRole('button', { name: 'Native file action' }) as HTMLButtonElement).disabled).toBe(phase === 'opening')
 })
 
 
diff --git a/packages/client/ui-deliverables/tests/file-actions.tsx b/packages/client/ui-deliverables/tests/file-actions.tsx
new file mode 100644
index 0000000000..d1904bea6a
--- /dev/null
+++ b/packages/client/ui-deliverables/tests/file-actions.tsx
@@ -0,0 +1,10 @@
+/** Capture delivery action ownership without duplicating the opening-control implementation. */
+import type { PropsRenderSlots, SlotMap } from '@deepseek-ai/dsh-client-ui-slots'
+import type {} from '../src/client/index.ts'
+
+/** Slot renderer exposing the owning route and gesture for component tests. */
+export const renderFileActions: PropsRenderSlots<'deliverables.file.actions' | 'deliverables.review.file.actions'>['renderSlot'] = (_name: string, input: object) => {
+  const props = input as SlotMap['deliverables.file.actions']['owner']
+  return props.available ? <button type="button" data-action-url={props.actionUrl} disabled={props.pending}
+    onClick={() => { void props.onAction('open') }}>Native file action</button> : null
+}
diff --git a/packages/client/ui-deliverables/tests/present-open.client.spec.ts b/packages/client/ui-deliverables/tests/present-open.client.spec.ts
index 35fd278616..f6910df3f9 100644
--- a/packages/client/ui-deliverables/tests/present-open.client.spec.ts
+++ b/packages/client/ui-deliverables/tests/present-open.client.spec.ts
@@ -3,7 +3,7 @@ import { afterEach, expect, it, vi } from 'vitest'
 import { SessionId } from '@deepseek-ai/dsh-session/types'
 import { PresentedOpenController } from '../src/client/present-open.ts'
 
-afterEach(() => { vi.unstubAllGlobals() })
+afterEach(() => { vi.unstubAllGlobals(); vi.useRealTimers() })
 
 const id = SessionId('fork')
 const url = 'api/present.open?sessionId=fork&seq=2&index=1'
@@ -174,3 +174,68 @@ it.each(['open', 'reveal'] as const)('reports an unavailable Host path for %s wh
   expect(controller.state.getSnapshot()[url]).toBe('nativeUnavailable')
   await controller.dispose()
 })
+
+
+it('encodes an explicit application identifier without changing the file coordinates', async () => {
+  const fetcher = vi.fn(async () => new Response(null, { status: 204 }))
+  vi.stubGlobal('fetch', fetcher)
+  const controller = new PresentedOpenController()
+  expect(await controller.open(id, 2, 1, 'open', '/Apps/A&B.app')).toBeNull()
+  expect(fetcher).toHaveBeenCalledWith(`${url}&application=%2FApps%2FA%26B.app`, { method: 'POST', signal: expect.any(AbortSignal) as AbortSignal })
+  await controller.dispose()
+})
+
+
+it.each(['open', 'reveal'] as const)('expires successful %s feedback after five seconds and its fade', async (action) => {
+  vi.useFakeTimers()
+  vi.stubGlobal('fetch', vi.fn(async () => new Response(null, { status: 204 })))
+  const controller = new PresentedOpenController()
+  await controller.open(id, 2, 1, action)
+  await vi.advanceTimersByTimeAsync(5000)
+  expect(controller.state.getSnapshot()[url]).toBe(action === 'open' ? 'opened' : 'revealed')
+  await vi.advanceTimersByTimeAsync(200)
+  expect(controller.state.getSnapshot()[url]).toBeUndefined()
+  await controller.dispose()
+})
+
+it('cancels an earlier success expiry when the next action fails', async () => {
+  vi.useFakeTimers()
+  const fetcher = vi.fn().mockResolvedValueOnce(new Response(null, { status: 204 }))
+    .mockResolvedValueOnce(new Response(null, { status: 500 }))
+  vi.stubGlobal('fetch', fetcher)
+  const controller = new PresentedOpenController()
+  await controller.open(id, 2, 1)
+  await vi.advanceTimersByTimeAsync(4000)
+  await controller.open(id, 2, 1)
+  await vi.advanceTimersByTimeAsync(6000)
+  expect(controller.state.getSnapshot()[url]).toBe('error')
+  await controller.dispose()
+})
+
+it('cancels success expiry when its controller is disposed', async () => {
+  vi.useFakeTimers()
+  vi.stubGlobal('fetch', vi.fn(async () => new Response(null, { status: 204 })))
+  const controller = new PresentedOpenController()
+  await controller.open(id, 2, 1)
+  const state = controller.state.getSnapshot()
+  await controller.dispose()
+  await vi.advanceTimersByTimeAsync(6000)
+  expect(controller.state.getSnapshot()).toBe(state)
+})
+
+
+it('owns the expiry before notifying subscribers that can dispose the controller', async () => {
+  vi.useFakeTimers()
+  vi.stubGlobal('fetch', vi.fn(async () => new Response(null, { status: 204 })))
+  const controller = new PresentedOpenController()
+  let disposal: Promise<void> | undefined
+  const release = controller.state.subscribe(() => {
+    if (controller.state.getSnapshot()[url] === 'opened') disposal = controller.dispose()
+  })
+  await controller.open(id, 2, 1)
+  await disposal
+  const state = controller.state.getSnapshot()
+  await vi.advanceTimersByTimeAsync(6000)
+  expect(controller.state.getSnapshot()).toBe(state)
+  release()
+})
diff --git a/packages/client/ui-deliverables/tests/present-open.host.spec.ts b/packages/client/ui-deliverables/tests/present-open.host.spec.ts
index 072529cdde..b313ee0aa8 100644
--- a/packages/client/ui-deliverables/tests/present-open.host.spec.ts
+++ b/packages/client/ui-deliverables/tests/present-open.host.spec.ts
@@ -46,7 +46,8 @@ async function fixture() {
   })
   ctx.provide('sessionQuery', { readEvent } as never)
   const opener = vi.fn(async (_request: { path: string; action?: 'reveal' }, _signal: AbortSignal) => ({ opened: true as const }))
-  ctx.provide('sessionController', { resolveAgent, openWorkspacePath: opener, workspaceDesktop: () => ({ name: 'desktop', available: true, fileManager: 'finder' }) } as never)
+  const applications = vi.fn(async () => [{ id: 'player', name: 'Player', default: true, icon: null }])
+  ctx.provide('sessionController', { workspacePathApplications: applications, resolveAgent, openWorkspacePath: opener, workspaceDesktop: () => ({ name: 'desktop', available: true, fileManager: 'finder' }) } as never)
   const connection = new HostConnectionService(ctx, [], {} as BrowserAuth)
   const fiber = ctx.plugin({ inject: ['connection', 'sessionQuery', 'sessionController', 'workspaceFiles', 'fs', 'sandboxPolicy'], apply: registerPresentOpen })
   await fiber
@@ -54,7 +55,7 @@ async function fixture() {
   const open = (query = '?sessionId=owner&seq=7&index=0', signal?: AbortSignal) => handler.fetch(new Request(
     `http://localhost${PRESENT_OPEN_PATH}${query}`, { method: 'POST', signal: signal ?? null },
   ))
-  return { root, cwd, ctx, fiber, file, session, readEvent, open, opener, handler, resolveAgent }
+  return { applications, root, cwd, ctx, fiber, file, session, readEvent, open, opener, handler, resolveAgent }
 }
 
 describe('Presented workspace file native open route', () => {
@@ -62,7 +63,7 @@ describe('Presented workspace file native open route', () => {
     const { cwd, open, file, fiber, opener, handler, ctx } = await fixture()
     const source = await realpath(join(cwd, file.path))
     expect(presentedFileUrl(SessionId('owner'), 7, 0)).toBe('api/present.open?sessionId=owner&seq=7&index=0')
-    expect((await handler.fetch(new Request(`http://localhost${PRESENT_OPEN_PATH}`))).status).toBe(404)
+    expect((await handler.fetch(new Request(`http://localhost${PRESENT_OPEN_PATH}`))).status).toBe(400)
     expect((await handler.fetch(new Request('http://localhost/api/present.download?sessionId=owner&seq=7&index=0'))).status).toBe(404)
     for (const contents of ['current source', 'edited source']) {
       await writeFile(source, contents)
@@ -233,3 +234,19 @@ it('uses the deployment workspace root when the viewed Session has no cwd', asyn
   expect((await open()).status).toBe(204)
   expect(opener.mock.lastCall?.[0].path).toBe(await realpath(join(cwd, file.path)))
 })
+
+
+it('queries handlers only after file authorization and forwards explicit application choices', async () => {
+  const { handler, applications, opener, open, ctx } = await fixture()
+  const url = 'http://localhost/api/present.open?sessionId=owner&seq=7&index=0'
+  const response = await handler.fetch(new Request(url))
+  expect(response.status).toBe(200)
+  expect(await response.json()).toEqual([{ id: 'player', name: 'Player', default: true, icon: null }])
+  expect(opener).not.toHaveBeenCalled()
+  expect((await open('?sessionId=owner&seq=7&index=0&application=player')).status).toBe(204)
+  expect(opener.mock.lastCall?.[0]).toMatchObject({ application: 'player' })
+  expect((await handler.fetch(new Request(url.replace('index=0', 'index=999')))).status).toBe(404)
+  vi.spyOn(ctx.fs, 'processPathFromHostPath').mockReturnValue(undefined)
+  expect((await handler.fetch(new Request(url))).status).toBe(422)
+  expect(applications).toHaveBeenCalledOnce()
+})
diff --git a/packages/client/ui-deliverables/tests/presented-file-card.client.spec.tsx b/packages/client/ui-deliverables/tests/presented-file-card.client.spec.tsx
index 28207b5a29..62a017f33a 100644
--- a/packages/client/ui-deliverables/tests/presented-file-card.client.spec.tsx
+++ b/packages/client/ui-deliverables/tests/presented-file-card.client.spec.tsx
@@ -13,66 +13,9 @@ const props = () => ({
   host: { name: 'remote-desktop', available: true, fileManager: 'finder' as const },
   phase: undefined,
   onPreview: vi.fn(),
-  onAction: vi.fn(),
+  actions: <button type="button">Native file action</button>,
   t: makeTranslate(en),
 })
-
-it.each([
-  ['finder', 'Show in Finder'], ['explorer', 'Show in File Explorer'], ['directory', 'Open containing folder'],
-] as const)('uses the Host %s action and closes the menu after selection', (fileManager, label) => {
-  const p = props()
-  const view = render(<PresentedFileCard {...p} host={{ ...p.host, fileManager }} />)
-  fireEvent.click(view.getByRole('button', { name: 'More file actions for out/report.pdf' }))
-  fireEvent.click(view.getByRole('menuitem', { name: new RegExp(label) }))
-  expect(p.onAction).toHaveBeenCalledWith('reveal')
-  expect(view.queryByRole('menu')).toBeNull()
-  fireEvent.click(view.getByRole('button', { name: 'More file actions for out/report.pdf' }))
-  fireEvent.click(view.getByRole('menuitem', { name: /Open in default app/ }))
-  expect(p.onAction).toHaveBeenLastCalledWith('open')
-  expect(p.onAction).toHaveBeenCalledTimes(2)
-})
-
-it('dismisses the menu with Escape or an outside click without launching anything', () => {
-  const p = props()
-  const view = render(<PresentedFileCard {...p} />)
-  const trigger = view.getByRole('button', { name: 'More file actions for out/report.pdf' })
-  fireEvent.click(trigger)
-  fireEvent.keyDown(document, { key: 'Escape' })
-  expect(view.queryByRole('menu')).toBeNull()
-  fireEvent.click(trigger)
-  fireEvent.pointerDown(document.body)
-  expect(view.queryByRole('menu')).toBeNull()
-  expect(p.onAction).not.toHaveBeenCalled()
-})
-
-it.each(['opening', 'revealing'] as const)('keeps sidebar previews available while the native action is %s', (phase) => {
-  const p = props()
-  const view = render(<PresentedFileCard {...p} phase={phase} />)
-  expect((view.getByRole('button', { name: 'More file actions for out/report.pdf' }) as HTMLButtonElement).disabled).toBe(true)
-  fireEvent.click(view.getByRole('button', { name: 'Preview out/report.pdf in sidebar' }))
-  fireEvent.click(view.getByRole('button', { name: 'Open out/report.pdf in sidebar' }))
-  expect(p.onPreview).toHaveBeenCalledTimes(2)
-  expect(p.onAction).not.toHaveBeenCalled()
-})
-
-it('keeps the native menu disabled until a desktop is available', () => {
-  const p = props()
-  const view = render(<PresentedFileCard {...p} host={null} />)
-  expect((view.getByRole('button', { name: 'More file actions for out/report.pdf' }) as HTMLButtonElement).disabled).toBe(true)
-  expect((view.getByRole('button', { name: 'Open out/report.pdf in sidebar' }) as HTMLButtonElement).disabled).toBe(false)
-  view.rerender(<PresentedFileCard {...p} host={{ ...p.host, available: false, fileManager: null }} />)
-  expect((view.getByRole('button', { name: 'More file actions for out/report.pdf' }) as HTMLButtonElement).disabled).toBe(true)
-})
-
-it('opens the right sidebar from either the card or its primary button', () => {
-  const p = props()
-  const view = render(<PresentedFileCard {...p} />)
-  fireEvent.click(view.getByRole('button', { name: 'Preview out/report.pdf in sidebar' }))
-  fireEvent.click(view.getByRole('button', { name: 'Open out/report.pdf in sidebar' }))
-  expect(p.onPreview).toHaveBeenCalledTimes(2)
-  expect(p.onAction).not.toHaveBeenCalled()
-})
-
 it('localizes reveal failures and accurately reports a directory-only action', () => {
   const p = props()
   const view = render(<PresentedFileCard {...p} phase="revealError" t={makeTranslate(zh)} />)
@@ -84,36 +27,12 @@ it('localizes reveal failures and accurately reports a directory-only action', (
 })
 
 
-it('supports keyboard selection and returns focus to the trigger on Escape', () => {
-  const view = render(<PresentedFileCard {...props()} />)
-  const trigger = view.getByRole('button', { name: 'More file actions for out/report.pdf' })
-  fireEvent.click(trigger)
-  const items = view.getAllByRole('menuitem')
-  expect(document.activeElement).toBe(items[0])
-  fireEvent.keyDown(document.activeElement!, { key: 'ArrowDown' })
-  expect(document.activeElement).toBe(items[1])
-  fireEvent.keyDown(document.activeElement!, { key: 'ArrowDown' })
-  expect(document.activeElement).toBe(items[0])
-  fireEvent.keyDown(document.activeElement!, { key: 'End' })
-  expect(document.activeElement).toBe(items[1])
-  fireEvent.keyDown(document.activeElement!, { key: 'ArrowUp' })
-  expect(document.activeElement).toBe(items[0])
-  fireEvent.keyDown(document.activeElement!, { key: 'Home' })
-  expect(document.activeElement).toBe(items[0])
-  fireEvent.keyDown(document.activeElement!, { key: 'Escape' })
-  expect(document.activeElement).toBe(trigger)
-})
-
-
 it('shows the basename while retaining the full location for hover and actions', () => {
   const p = props()
   const path = '/work/reports/result.pdf'
   const view = render(<PresentedFileCard {...p} cwd="/work" file={{ ...p.file, path }} />)
   expect(view.getByTitle(path)).toBeTruthy()
   expect(view.getByText('result.pdf')).toBeTruthy()
-  fireEvent.click(view.getByRole('button', { name: `More file actions for ${path}` }))
-  fireEvent.click(view.getByRole('menuitem', { name: 'Open in default app' }))
-  expect(p.onAction).toHaveBeenCalledWith('open')
   view.rerender(<PresentedFileCard {...p} cwd="/work" />)
   expect(view.getByTitle('/work/out/report.pdf')).toBeTruthy()
   expect(view.getByText('report.pdf')).toBeTruthy()
@@ -130,31 +49,6 @@ it.each([
 })
 
 
-it('does not reopen a menu after a shared native request settles', () => {
-  const p = props()
-  const view = render(<PresentedFileCard {...p} />)
-  fireEvent.click(view.getByRole('button', { name: 'More file actions for out/report.pdf' }))
-  expect(view.getByRole('menu')).toBeTruthy()
-  view.rerender(<PresentedFileCard {...p} phase="opening" />)
-  expect(view.queryByRole('menu')).toBeNull()
-  view.rerender(<PresentedFileCard {...p} phase="opened" />)
-  expect(view.queryByRole('menu')).toBeNull()
-})
-
-it('keeps focus on the available preview button after selecting a native action', () => {
-  const p = props()
-  const view = render(<PresentedFileCard {...p} />)
-  fireEvent.click(view.getByRole('button', { name: 'More file actions for out/report.pdf' }))
-  const item = view.getByRole('menuitem', { name: 'Show in Finder' })
-  item.focus()
-  fireEvent.click(item)
-  view.rerender(<PresentedFileCard {...p} phase="revealing" />)
-  const preview = view.getByRole('button', { name: 'Open out/report.pdf in sidebar' })
-  expect(document.activeElement).toBe(preview)
-  view.rerender(<PresentedFileCard {...p} phase="revealed" />)
-  expect(document.activeElement).toBe(preview)
-})
-
 it.each([en, zh])('distinguishes directory-only progress and errors in each locale', (dictionary) => {
   const p = { ...props(), t: makeTranslate(dictionary) }
   const view = render(<PresentedFileCard {...p} phase="revealing" />)
@@ -164,3 +58,15 @@ it.each([en, zh])('distinguishes directory-only progress and errors in each loca
   view.rerender(<PresentedFileCard {...p} phase="revealError" host={{ ...p.host, fileManager: 'directory' }} />)
   expect(view.getByText(dictionary['presented.directoryError'])).toBeTruthy()
 })
+
+
+it('renders the supplied action independently from the card preview', () => {
+  const p = props()
+  const native = vi.fn()
+  const view = render(<PresentedFileCard {...p} actions={<button type="button" onClick={native}>Native file action</button>} />)
+  fireEvent.click(view.getByRole('button', { name: 'Native file action' }))
+  expect(native).toHaveBeenCalledOnce()
+  expect(p.onPreview).not.toHaveBeenCalled()
+  fireEvent.click(view.getByRole('button', { name: 'Preview out/report.pdf in sidebar' }))
+  expect(p.onPreview).toHaveBeenCalledOnce()
+})
diff --git a/packages/client/ui-deliverables/tests/review-tab.client.spec.tsx b/packages/client/ui-deliverables/tests/review-tab.client.spec.tsx
index 9cdc89ec65..2af2a12b4a 100644
--- a/packages/client/ui-deliverables/tests/review-tab.client.spec.tsx
+++ b/packages/client/ui-deliverables/tests/review-tab.client.spec.tsx
@@ -1,5 +1,6 @@
 // @vitest-environment jsdom
 /** The review tab type: its addresses, its store, the row pairing of the split view, and the states its body draws. */
+import { renderFileActions } from './file-actions.tsx'
 import { useSyncExternalStore } from 'react'
 import { act, cleanup, fireEvent, render } from '@testing-library/react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -158,11 +159,17 @@ describe('ReviewTab', () => {
       loadChangesSummary: vi.fn<ReviewInjected['loadChangesSummary']>(() => Promise.resolve()),
       loadChangesDiff: vi.fn<ReviewInjected['loadChangesDiff']>(() => Promise.resolve()),
       reloadPresentedHost: vi.fn<ReviewInjected['reloadPresentedHost']>(() => Promise.resolve()),
-      openChanged: vi.fn<ReviewInjected['openChanged']>(() => Promise.resolve()),
+      openChanged: vi.fn<ReviewInjected['openChanged']>(() => Promise.resolve(null)),
+    }
+    const sessions: SessionListState = {
+      ids: [SESSION],
+      byId: { [SESSION]: { id: SESSION, displayTitle: 'Workspace', cwd: options.cwd ?? '/work/app',
+        running: false, retainedBy: {}, blank: false, updatedAt: 0 } },
+      phase: 'ready', projectionsBySession: {},
     }
-    const sessions = { byId: { [SESSION]: { cwd: options.cwd ?? '/work/app' } } } as unknown as SessionListState
     const navigation = { address: options.address ?? ADDRESS, params: options.params, revision: options.revision ?? 1 }
     const runtime = {
+      renderSlot: renderFileActions,
       useTabInfo: () => ({
         sidebar: { expanded: true, fullscreen: false }, panel: { id: 'pane-1' },
         tab: { id: TAB, kind: 'changes-review', contentId: options.address ?? ADDRESS, title: 'Review', visible: true, navigation, signal: aborter.signal, actions: tabActions },
@@ -177,7 +184,7 @@ describe('ReviewTab', () => {
       usePresentedHost: hookOf(controller.host),
       t: makeTranslate(options.locale ?? en),
       ...injected,
-    } as unknown as ReviewTabProps
+    } as ReviewTabProps
     const view = render(<ReviewTab {...runtime} />)
     return {
       view, injected, tabActions, store, aborter, summaries, diffs, controller,
@@ -313,19 +320,18 @@ describe('ReviewTab', () => {
     expect(view.container.querySelector('[data-review-tool="open-file"] svg')?.getAttribute('width')).toBe('12')
     fireEvent.click(view.getByRole('button', { name: 'Open ~/out/big.bin in sidebar' }))
     expect(tabActions.openResource).toHaveBeenCalledWith(fileAddressFor(SESSION, '/work/app', '/tmp/out/big.bin'))
-    fireEvent.click(view.getByRole('button', { name: 'Open ~/out/big.bin in default app' }))
-    expect(injected.openChanged).toHaveBeenCalledWith('viewed', 5, 1)
+    fireEvent.click(view.getByRole('button', { name: 'Native file action' }))
+    expect(injected.openChanged).toHaveBeenCalledWith('viewed', 5, 1, 'open', undefined)
     act(() => { controller.state.set({ 'api/changes.open?sessionId=viewed&seq=5&index=1': 'opening' }) })
-    expect((view.getByRole('button', { name: 'Open ~/out/big.bin in default app' }) as HTMLButtonElement).disabled).toBe(true)
+    expect((view.getByRole('button', { name: 'Native file action' }) as HTMLButtonElement).disabled).toBe(true)
     act(() => { controller.state.set({ 'api/changes.open?sessionId=viewed&seq=5&index=1': 'error' }) })
-    expect(view.getByRole('button', { name: 'Open ~/out/big.bin in default app' }).hasAttribute('data-error')).toBe(true)
     act(() => { controller.state.set({ 'api/changes.open?sessionId=viewed&seq=5&index=1': 'nativeUnavailable' }) })
-    expect(view.queryByRole('button', { name: 'Open ~/out/big.bin in default app' })).toBeNull()
+    expect(view.queryByRole('button', { name: 'Native file action' })).toBeNull()
     act(() => {
       controller.state.set({})
       controller.host.set({ name: 'server', available: false, fileManager: null })
     })
-    expect(view.queryByRole('button', { name: 'Open ~/out/big.bin in default app' })).toBeNull()
+    expect(view.queryByRole('button', { name: 'Native file action' })).toBeNull()
     expect(view.getByText(en['changes.oversized'])).toBeTruthy()
   })
 
diff --git a/packages/client/ui-deliverables/tests/turn-tail-spacing.client.spec.ts b/packages/client/ui-deliverables/tests/turn-tail-spacing.client.spec.ts
index 6bd7af1bc5..9d9bb1cbc4 100644
--- a/packages/client/ui-deliverables/tests/turn-tail-spacing.client.spec.ts
+++ b/packages/client/ui-deliverables/tests/turn-tail-spacing.client.spec.ts
@@ -18,7 +18,6 @@ describe('deliverables layout', () => {
     expect(read('PresentedFileCard.tsx')).toMatch(/<FileTypeIcon path=\{file\.path\} size=\{20\} \/>/)
     expect(deliveries).toMatch(/\.fileName\s*\{[^}]*font-size:\s*13px;[^}]*line-height:\s*20px/s)
     expect(deliveries).toMatch(/\.description\s*\{[^}]*font-size:\s*10px;[^}]*line-height:\s*16px/s)
-    expect(deliveries).toMatch(/\.open\s*\{[^}]*padding:\s*4px 8px;[^}]*font-size:\s*12px;[^}]*line-height:\s*18px/s)
     expect(deliveries).toMatch(/\.presented\s*\{[^}]*gap:\s*10px/s)
   })
 
diff --git a/packages/client/ui-directory-picker-native/tests/client-flow.client.spec.tsx b/packages/client/ui-directory-picker-native/tests/client-flow.client.spec.tsx
index 2037b3edd7..ed033999aa 100644
--- a/packages/client/ui-directory-picker-native/tests/client-flow.client.spec.tsx
+++ b/packages/client/ui-directory-picker-native/tests/client-flow.client.spec.tsx
@@ -14,10 +14,10 @@ const desktopIpc = await vi.hoisted(async () => {
   const path = await import('node:path')
   // Electron belongs to the Desktop app; resolve its mock from that workspace.
   const electron = createRequire(path.resolve(import.meta.dirname, '../../../../apps/desktop/package.json')).resolve('electron')
-  return { invoke: vi.fn(), electron }
+  return { invoke: vi.fn(), on: vi.fn(), electron }
 })
 vi.mock(desktopIpc.electron, () => ({
-  ipcRenderer: { invoke: desktopIpc.invoke },
+  ipcRenderer: { invoke: desktopIpc.invoke, on: desktopIpc.on },
   contextBridge: { exposeInMainWorld: (name: string, value: unknown) => { vi.stubGlobal(name, value) } },
 }))
 vi.mock('../../../../apps/desktop/src/preload-platform.ts', () => ({ markDocumentPlatform: vi.fn(), syncWindowFullscreen: vi.fn() }))
@@ -25,7 +25,7 @@ vi.mock('../../../../apps/desktop/src/preload-theme.ts', () => ({ syncNativeThem
 vi.mock('../../../../apps/desktop/src/preload-windows.ts', () => ({ syncWindowsAppearance: vi.fn() }))
 vi.mock('../../../../apps/desktop/src/preload-mandatory-overlay.ts', () => ({ installMandatoryUpdateOverlay: vi.fn() }))
 
-afterEach(() => { cleanup(); vi.unstubAllGlobals(); vi.restoreAllMocks(); desktopIpc.invoke.mockReset() })
+afterEach(() => { cleanup(); vi.unstubAllGlobals(); vi.restoreAllMocks(); desktopIpc.invoke.mockReset(); desktopIpc.on.mockReset() })
 
 const HOLES = ['conversation.hero.workspace.directoryFlow', 'sidebar.workspaces.directoryFlow'] as const
 
diff --git a/packages/client/ui-dockkit/README.i18n.yaml b/packages/client/ui-dockkit/README.i18n.yaml
index bbf8417672..333cd57389 100644
--- a/packages/client/ui-dockkit/README.i18n.yaml
+++ b/packages/client/ui-dockkit/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-dockkit/README.md
-README.md: f41668ad2eb6c16e13deb5fcc554c8717811a468
-README.zh.md: 6a4c70a1ddb46b75b614e9e63eaddd89f3641ac3
+README.md: 613cdbcb105108eb848160f1cb6bc8ee28d39fac
+README.zh.md: 77b256f01dd46aea5144e9f8da644fd39330f187
diff --git a/packages/client/ui-dockkit/README.md b/packages/client/ui-dockkit/README.md
index f41668ad2e..613cdbcb10 100644
--- a/packages/client/ui-dockkit/README.md
+++ b/packages/client/ui-dockkit/README.md
@@ -50,13 +50,15 @@ Everything host-specific arrives through props:
 | `TabRenderer` | one tab's body (`renderTab`), drawn flush to the pane's edges and the unbordered strip's bottom edge with the insets it chooses, and optionally what its chip or panel header shows as a title (`renderTabTitle`, falling back to the record's `title`); the embedder dispatches on `tab.kind` |
 | `DockIntents` | the settled results of every gesture |
 
-`DockController` satisfies `DockIntents` as written, so the simplest embedding hands the controller straight to `DockSurface`. An embedder that routes through its own store implements the same method names instead. Three props carry control policy rather than gestures: `canSplit` (surface-wide, the pane budget; disables the split control with `splitPaneDisabled`), `canAddTab(paneId)` (per pane, omits the add control; leave it out to draw one in every pane), and `canCloseTab(tabId)` (per tab, withholds the chip's close control and the menu's close item together; leave it out to keep every tab closable). Hiding the add control moves nothing else in the strip, and a withheld close moves nothing in the chip — the close control paints over the title's end rather than beside it. A pane's lone chip whose close is withheld draws quiet — no capsule, no hover fill — since there is nothing to select against and nothing to do to it. The kit adds one policy of its own, the room rule below, which disables a pane's split control with `splitPaneNarrow`; `onRoom(fits)` reports its readings so an embedder splitting programmatically can honour the same rule.
+`DockController` satisfies `DockIntents` as written, so an embedding can pass it to `DockLayout` for retained Sidebar layouts or `DockSurface` for recursive split trees. An embedder that routes through its own store implements the same method names instead. Three props carry control policy rather than gestures: `canSplit` (surface-wide, the pane budget; disables the split control with `splitPaneDisabled`), `canAddTab(paneId)` (per pane, omits the add control; leave it out to draw one in every pane), and `canCloseTab(tabId)` (per tab, withholds the chip's close control and the menu's close item together; leave it out to keep every tab closable). Hiding the add control moves nothing else in the strip, and a withheld close moves nothing in the chip — the close control paints over the title's end rather than beside it. A pane's lone chip whose close is withheld draws quiet — no capsule, no hover fill — since there is nothing to select against and nothing to do to it. The kit adds one policy of its own, the room rule below, which disables a pane's split control with `splitPaneNarrow`; `onRoom(fits)` reports its readings so an embedder splitting programmatically can honour the same rule.
 
 `dropZones="horizontal"` offers two half-pane hints; once budget or width forbids another split, the whole body accepts a move. A hint is a dashed card inset 8px inside its region, showing the zone's glyph and `labels.dropZone[zone]`; the preview layer covers all tab-body content, while the card under the pointer takes the accent and its neighbour stays a quiet outline. `minPaneFraction` sets the preview minimum, and `planResizeSplit` accepts the same minimum for the committed operation. The Sidebar uses 0.2 and enforces two panes in its own store. The generic engine retains its tree and other split directions. `hideSplitWhenBlocked` hides a blocked split control — pane budget spent or pane too narrow — instead of rendering it disabled; its default is false.
 
 A tab's `kind` is an opaque string. Seeded tabs are factories (`DockControllerOptions`), so what a fresh pane contains is the embedder's decision, not this package's. Content identity is the pair (`kind`, `contentId`): `findContentTab(state, contentId, kind?)` finds the tab showing it anywhere and `findPaneContentTab(state, paneId, contentId, kind?)` within one pane, and `planOpenContent` focuses that tab instead of opening another unless told `revealIfOpened: false`; an explicit `index` seats a new tab at a strip slot rather than at the end.
 
-`DockSurface` is the docked area. Chrome around it — a rail, a collapsed presentation, any history controls — belongs to the embedder, which reads `state.expanded` and decides; the kit ships no undo/redo control of its own. Surface-wide controls the embedder does want on the surface go through the `chrome` prop, which the kit places at the far end of the top-right pane's tab strip (the last child of every row split, the first of every column split), so a surface needs no header row of its own. `FloatLayer` owns its own gestures and positions panels in viewport coordinates, so it may be mounted anywhere, including a portal.
+`DockLayout`, used by the Sidebar, keeps each tab in a stable DOM cell across selection, pane moves and floating. It accepts one docked pane or two horizontal panes; CSS Grid resolves their widths. `keepMounted(tab)` retains visited bodies and `active` controls Session visibility without reparenting content.
+
+`DockSurface` is the docked area for the separate recursive renderer. Chrome around it — a rail, a collapsed presentation, any history controls — belongs to the embedder, which reads `state.expanded` and decides; the kit ships no undo/redo control of its own. Surface-wide controls the embedder does want on the surface go through the `chrome` prop, which the kit places at the far end of the top-right pane's tab strip (the last child of every row split, the first of every column split), so a surface needs no header row of its own. `FloatLayer` owns its own gestures and positions panels in viewport coordinates, so it may be mounted anywhere, including a portal.
 
 <a id="interaction-rules-worth-keeping"></a>
 ## Interaction rules worth keeping
diff --git a/packages/client/ui-dockkit/README.zh.md b/packages/client/ui-dockkit/README.zh.md
index 6a4c70a1dd..77b256f01d 100644
--- a/packages/client/ui-dockkit/README.zh.md
+++ b/packages/client/ui-dockkit/README.zh.md
@@ -50,13 +50,15 @@ kind: "package-reference"
 | `TabRenderer` | 一个 tab 的正文（`renderTab`），贴着格的边缘和（不带边线的）tab 条底边绘制、自己决定留白，以及可选的 chip 或浮窗头部显示的标题（`renderTabTitle`，回退到记录的 `title`）；嵌入方按 `tab.kind` 分发 |
 | `DockIntents` | 每次手势落定的结果 |
 
-`DockController` 原样满足 `DockIntents`，所以最简单的嵌入就是把 controller 直接交给 `DockSurface`。经由自己 store 路由的嵌入方则实现同名方法。有三个 props 承载的是控制策略而非手势：`canSplit`（整面有效，即格预算；用 `splitPaneDisabled` 禁用分栏控件）、`canAddTab(paneId)`（按格，省略添加控件；不传则每格都画）与 `canCloseTab(tabId)`（按 tab，把 chip 的关闭控件和菜单的关闭项一并收起；不传则每个 tab 都可关闭）。隐藏添加控件不会移动 tab 条里的其它任何东西，收起关闭也不会移动 chip 里的任何东西——关闭控件压在标题末端之上而非并排。某格仅剩的一个 chip 在关闭被收起时画成安静样式——没有胶囊底色，没有悬停填充——因为既没有别的 tab 可供选择，也没有任何可对它做的事。套件自己再加一条策略，即下文的空间规则，它用 `splitPaneNarrow` 禁用某格的分栏控件；`onRoom(fits)` 上报其读数，让以编程方式分栏的嵌入方能遵守同一规则。
+`DockController` 原样满足 `DockIntents`，因此嵌入方可将它交给 `DockLayout` 来保活 Sidebar 布局，或交给 `DockSurface` 来渲染递归分割树。经由自己 store 路由的嵌入方则实现同名方法。有三个 props 承载的是控制策略而非手势：`canSplit`（整面有效，即格预算；用 `splitPaneDisabled` 禁用分栏控件）、`canAddTab(paneId)`（按格，省略添加控件；不传则每格都画）与 `canCloseTab(tabId)`（按 tab，把 chip 的关闭控件和菜单的关闭项一并收起；不传则每个 tab 都可关闭）。隐藏添加控件不会移动 tab 条里的其它任何东西，收起关闭也不会移动 chip 里的任何东西——关闭控件压在标题末端之上而非并排。某格仅剩的一个 chip 在关闭被收起时画成安静样式——没有胶囊底色，没有悬停填充——因为既没有别的 tab 可供选择，也没有任何可对它做的事。套件自己再加一条策略，即下文的空间规则，它用 `splitPaneNarrow` 禁用某格的分栏控件；`onRoom(fits)` 上报其读数，让以编程方式分栏的嵌入方能遵守同一规则。
 
 `dropZones="horizontal"` 提供左右两个半区提示；预算或宽度不允许再拆时，正文整格接收移动。提示是一张内缩 8px 的虚线卡片，显示该落区的图形和 `labels.dropZone[zone]`；预览层覆盖全部 tab 正文，指针所在的卡片取强调色，另一张保持安静的轮廓。`minPaneFraction` 控制预览的最小比例，`planResizeSplit` 接受相同最小值以约束提交；Sidebar使用0.2并在自己的store限制两格。通用引擎仍保留原有树与其它分割方向。 `hideSplitWhenBlocked` 在分栏被阻止时（窗格预算已满或格太窄）直接隐藏分栏控件而不是渲染禁用态，默认值为 false。
 
 tab 的 `kind` 是不透明字符串。种子 tab 是工厂（`DockControllerOptions`），因此新格里放什么由嵌入方决定，与本包无关。内容身份是二元组（`kind`、`contentId`）：`findContentTab(state, contentId, kind?)` 在任意位置找到展示它的 tab，`findPaneContentTab(state, paneId, contentId, kind?)` 在一个格内找；`planOpenContent` 会聚焦该 tab 而非再开一个，除非被告知 `revealIfOpened: false`；显式的 `index` 把新 tab 放到 tab 条的某个位置而非末尾。
 
-`DockSurface` 是停靠区。它周围的 chrome——轨道、折叠形态、任何历史控件——属于嵌入方，由嵌入方读取 `state.expanded` 后自行决定；套件不自带撤销/重做控件。嵌入方确实想放到面上的整面控件通过 `chrome` prop 传入，套件把它放在右上格 tab 条的最末端（每个横向分裂的最后一个子节点、每个纵向分裂的第一个子节点），因此停靠面不需要自己的标题行。`FloatLayer` 拥有自己的手势并以视口坐标定位浮窗，因此可以挂在任何位置，包括 portal 里。
+Sidebar 使用的 `DockLayout` 在选中项变化、跨格移动与浮动期间，把每个 tab 保留在稳定的 DOM 容器中。它接受一个停靠格或左右两个格，由 CSS Grid 计算宽度。`keepMounted(tab)` 保留已访问正文，`active` 控制 Session 可见性，不改变内容的父子关系。
+
+`DockSurface` 是独立递归渲染器的停靠区。它周围的 chrome——轨道、折叠形态、任何历史控件——属于嵌入方，由嵌入方读取 `state.expanded` 后自行决定；套件不自带撤销/重做控件。嵌入方确实想放到面上的整面控件通过 `chrome` prop 传入，套件把它放在右上格 tab 条的最末端（每个横向分裂的最后一个子节点、每个纵向分裂的第一个子节点），因此停靠面不需要自己的标题行。`FloatLayer` 拥有自己的手势并以视口坐标定位浮窗，因此可以挂在任何位置，包括 portal 里。
 
 <a id="interaction-rules-worth-keeping"></a>
 ## 值得保留的交互规则
diff --git a/packages/client/ui-dockkit/src/components/DockSurface.tsx b/packages/client/ui-dockkit/src/components/DockSurface.tsx
index 6c3e0ced4d..17ca70f0c9 100644
--- a/packages/client/ui-dockkit/src/components/DockSurface.tsx
+++ b/packages/client/ui-dockkit/src/components/DockSurface.tsx
@@ -21,6 +21,7 @@ import {
 import { fitOf, measurePaneFits, paneElements, sameFits } from './measure.ts'
 import { useGesture } from './pointer.ts'
 import { PaneTree, type SizePreview } from './PaneTree.tsx'
+import { TabLayout, type TabRetention } from './TabLayout.tsx'
 import type { PaneCallbacks, SplitBlock } from './render.ts'
 import css from './dockkit.module.css'
 
@@ -161,10 +162,11 @@ function sameSizes(a: readonly number[], b: readonly number[]): boolean {
 }
 
 /** The split tree and the gestures over it. */
-export function DockSurface({
+function Surface({
   state, canSplit, canAddTab, canCloseTab, intents, labels, renderTab, renderTabTitle, renderTabMenuItems, chrome, onRoom,
+  draw,
   dropZones = 'edges', minPaneFraction = MIN_PANE_FRACTION, hideSplitWhenBlocked = false,
-}: DockSurfaceProps): ReactNode {
+}: DockSurfaceProps & { readonly draw: (callbacks: PaneCallbacks, preview: SizePreview | undefined) => ReactNode }): ReactNode {
   const surface = useRef<HTMLDivElement | null>(null)
   const [preview, setPreview] = useState<Preview>(NO_PREVIEW)
   const [fits, setFits] = useState(NO_FITS)
@@ -289,7 +291,26 @@ export function DockSurface({
 
   return (
     <div className={css.surface} ref={surface} data-dockkit-surface data-dockkit-drop-zones={dropZones}>
-      <PaneTree state={state} nodeId={state.rootId} callbacks={callbacks} preview={preview.sizes} />
+      {draw(callbacks, preview.sizes)}
     </div>
   )
 }
+
+/** Recursive docked layout; floating content is rendered separately by FloatLayer. */
+export function DockSurface(props: DockSurfaceProps): ReactNode {
+  return <Surface {...props} draw={(callbacks, preview) =>
+    <PaneTree state={props.state} nodeId={props.state.rootId} callbacks={callbacks} preview={preview} />} />
+}
+
+/** Horizontal Sidebar layout with stable tab containers across docking and floating. */
+export type DockLayoutProps = DockSurfaceProps & TabRetention
+
+/**
+ * Render one pane or two horizontal panes, and their floats, in one stable content tree.
+ * @param props - layout, gestures and lazy body-retention policy.
+ * @returns the layout; the containing ancestors must not clip or establish a fixed-position containing block.
+ */
+export function DockLayout(props: DockLayoutProps): ReactNode {
+  return <Surface {...props} draw={(callbacks, preview) =>
+    <TabLayout {...props} callbacks={callbacks} preview={preview} />} />
+}
diff --git a/packages/client/ui-dockkit/src/components/FloatLayer.tsx b/packages/client/ui-dockkit/src/components/FloatLayer.tsx
index a1efe4ce40..5f512423bd 100644
--- a/packages/client/ui-dockkit/src/components/FloatLayer.tsx
+++ b/packages/client/ui-dockkit/src/components/FloatLayer.tsx
@@ -18,7 +18,7 @@ import type { PointerEvent as ReactPointerEvent, ReactNode } from 'react'
 import clsx from 'clsx'
 import { IconCloseOutlineRegular, IconPanelLeftOutlineRegular, Tooltip } from '@deepseek-ai/dsh-client-ui-primitives'
 import type { DockIntents, DockLabels, TabRenderer } from '../contract/adapter.ts'
-import type { FloatRect, LayoutState, PaneId, TabId } from '../contract/types.ts'
+import type { FloatRect, LayoutState, PaneId, TabId, TabRecord } from '../contract/types.ts'
 import { FLOAT_MIN_SIZE } from '../engine/constraints.ts'
 import { movedRect, resizedRect } from '../engine/geometry.ts'
 import { floatRect, getPane, getTab, onlyTabId } from '../engine/tree.ts'
@@ -65,8 +65,13 @@ function raised(state: LayoutState, paneId: PaneId): boolean {
   return state.activePaneId === paneId && state.floats.at(-1) === paneId
 }
 
-/** Every floating panel, in z order. */
-export function FloatLayer({ state, intents, labels, renderTab, renderTabTitle, canCloseTab }: FloatLayerProps): ReactNode {
+/**
+ * Shared move/resize gestures; changing layout mode never owns the content DOM.
+ * @param state - committed layout and float stacking order.
+ * @param intents - gesture settlements.
+ * @returns the current preview and focus/gesture callbacks.
+ */
+export function useFloatGestures(state: LayoutState, intents: DockIntents) {
   const [preview, setPreview] = useState<{ paneId: PaneId; rect: FloatRect } | undefined>(undefined)
   const begin = useGesture(() => { setPreview(undefined) })
 
@@ -93,6 +98,54 @@ export function FloatLayer({ state, intents, labels, renderTab, renderTabTitle,
     })
   }
 
+  return { preview, raise, drag }
+}
+
+/**
+ * Header-only controls, usable above either retained or visibility-mounted bodies.
+ * @param props - owning pane/tab, localized labels and gesture callbacks.
+ * @returns the float header without a content container.
+ */
+export function FloatHeader({ paneId, tab, labels, intents, renderTabTitle, canCloseTab, drag }: {
+  readonly paneId: PaneId
+  readonly tab: TabRecord
+  readonly labels: DockLabels
+  readonly intents: DockIntents
+  readonly renderTabTitle: TabRenderer | undefined
+  readonly canCloseTab: ((id: TabId) => boolean) | undefined
+  readonly drag: ReturnType<typeof useFloatGestures>['drag']
+}): ReactNode {
+  return (
+    <header className={clsx(css.tabStrip, css.floatHeader)} data-dockkit-float-grip={paneId}
+      onPointerDown={(event) => { drag('move', paneId, event) }}>
+      <div className={clsx(css.tab, css.floatTitle)} data-dockkit-float-title>
+        <TabTitle>{renderTabTitle?.(tab) ?? tab.title}</TabTitle>
+      </div>
+      <div className={css.stripFill} />
+      <Tooltip label={labels.dockFloat} side="bottom" delayMs={500}>
+        <button type="button" className={css.iconButton} aria-label={labels.dockFloat}
+          data-dockkit-float-dock={paneId} onPointerDown={(event) => { event.stopPropagation() }}
+          onClick={() => { intents.unfloatPane(paneId) }}>
+          <IconPanelLeftOutlineRegular className={css.dockGlyph} />
+        </button>
+      </Tooltip>
+      {(canCloseTab?.(tab.id) ?? true) && (
+        <Tooltip label={labels.closeFloat} side="bottom" delayMs={500}>
+          <button type="button" className={css.iconButton} aria-label={labels.closeFloat}
+            data-dockkit-float-close={paneId} onPointerDown={(event) => { event.stopPropagation() }}
+            onClick={() => { intents.closeTab(tab.id) }}>
+            <IconCloseOutlineRegular />
+          </button>
+        </Tooltip>
+      )}
+    </header>
+  )
+}
+
+/** Every floating panel, in z order. */
+export function FloatLayer({ state, intents, labels, renderTab, renderTabTitle, canCloseTab }: FloatLayerProps): ReactNode {
+  const { preview, raise, drag } = useFloatGestures(state, intents)
+
   return (
     <>
       {state.floats.map((paneId, depth) => {
@@ -117,42 +170,7 @@ export function FloatLayer({ state, intents, labels, renderTab, renderTabTitle,
             }}
             onPointerDown={() => { raise(paneId) }}
           >
-            <header
-              className={clsx(css.tabStrip, css.floatHeader)}
-              data-dockkit-float-grip={paneId}
-              onPointerDown={(event) => { drag('move', paneId, event) }}
-            >
-              <div className={clsx(css.tab, css.floatTitle)} data-dockkit-float-title>
-                <TabTitle>{renderTabTitle?.(tab) ?? tab.title}</TabTitle>
-              </div>
-              <div className={css.stripFill} />
-              <Tooltip label={labels.dockFloat} side="bottom" delayMs={500}>
-                <button
-                  type="button"
-                  className={css.iconButton}
-                  aria-label={labels.dockFloat}
-                  data-dockkit-float-dock={paneId}
-                  onPointerDown={(event) => { event.stopPropagation() }}
-                  onClick={() => { intents.unfloatPane(paneId) }}
-                >
-                  <IconPanelLeftOutlineRegular className={css.dockGlyph} />
-                </button>
-              </Tooltip>
-              {(canCloseTab?.(tab.id) ?? true) && (
-                <Tooltip label={labels.closeFloat} side="bottom" delayMs={500}>
-                  <button
-                    type="button"
-                    className={css.iconButton}
-                    aria-label={labels.closeFloat}
-                    data-dockkit-float-close={paneId}
-                    onPointerDown={(event) => { event.stopPropagation() }}
-                    onClick={() => { intents.closeTab(tab.id) }}
-                  >
-                    <IconCloseOutlineRegular />
-                  </button>
-                </Tooltip>
-              )}
-            </header>
+            <FloatHeader {...{ paneId, tab, labels, intents, renderTabTitle, canCloseTab, drag }} />
             <div className={css.floatBody}>{renderTab(tab)}</div>
             <div
               className={css.floatResize}
diff --git a/packages/client/ui-dockkit/src/components/TabLayout.tsx b/packages/client/ui-dockkit/src/components/TabLayout.tsx
new file mode 100644
index 0000000000..1bb41b353d
--- /dev/null
+++ b/packages/client/ui-dockkit/src/components/TabLayout.tsx
@@ -0,0 +1,157 @@
+/** Stable tab siblings in one horizontal Grid, including viewport-positioned floats. */
+import { useEffect, useLayoutEffect, useRef, useState } from 'react'
+import type { MutableRefObject, ReactNode } from 'react'
+import clsx from 'clsx'
+import type { DockIntents } from '../contract/adapter.ts'
+import type { LayoutState, PaneNode, TabId, TabRecord } from '../contract/types.ts'
+import { findTabPane, floatRect, getNode, getPane } from '../engine/tree.ts'
+import type { SizePreview } from './PaneTree.tsx'
+import type { PaneCallbacks } from './render.ts'
+import { FloatHeader, useFloatGestures } from './FloatLayer.tsx'
+import { PaneDropHints, TabPanel, TabStrip } from './TabPanel.tsx'
+import css from './dockkit.module.css'
+
+/** Host policy for lazily retaining a tab body without reparenting it. */
+export interface TabRetention {
+  /** Whether a visited body survives hiding; omitted means visibility-mounted. */
+  readonly keepMounted?: (tab: TabRecord) => boolean
+  /** Whether this layout's Session is on screen; defaults to true. */
+  readonly active?: boolean
+}
+
+interface LayoutProps extends TabRetention {
+  readonly state: LayoutState
+  readonly callbacks: PaneCallbacks
+  readonly preview: SizePreview | undefined
+  readonly intents: DockIntents
+}
+
+interface TabHostProps extends LayoutProps {
+  readonly tab: TabRecord
+  readonly pane: PaneNode
+  readonly column: number
+  readonly floats: ReturnType<typeof useFloatGestures>
+  readonly focusRequest: MutableRefObject<{ readonly tabId: TabId; readonly origin: Element | null } | undefined>
+}
+
+/** A tab's ancestors stay identical across selection, pane moves and floating. */
+function TabHost({ state, callbacks, intents, tab, pane, column, floats, focusRequest, keepMounted,
+  active = true }: TabHostProps): ReactNode {
+  const floating = pane.host === 'float'
+  const selected = floating || pane.activeTabId === tab.id
+  const visible = active && selected && (floating || state.expanded)
+  const retained = keepMounted?.(tab) ?? false
+  const [visited, setVisited] = useState(visible)
+  if (visible && !visited) setVisited(true)
+  const host = useRef<HTMLElement | null>(null)
+  const body = useRef<HTMLDivElement | null>(null)
+  useLayoutEffect(() => {
+    // Both refs target unconditional descendants attached before these effects.
+    const section = host.current as HTMLElement
+    section.inert = !visible
+    const focused = document.activeElement
+    if (!visible && focused instanceof HTMLElement && section.contains(focused)) focused.blur()
+    const request = focusRequest.current
+    if (!visible || request?.tabId !== tab.id) return
+    focusRequest.current = undefined
+    // Preserve deliberate focus taken by another control or the newly shown body.
+    if (focused !== null && focused !== document.body && focused !== document.documentElement && focused !== request.origin) return
+    const strip = section.querySelector('[data-dockkit-strip]')
+    const chip = [...strip?.querySelectorAll<HTMLElement>('[data-dockkit-tab]') ?? []]
+      .find(element => element.dataset.dockkitTab === tab.id)
+    chip?.focus({ preventScroll: true })
+  }, [visible, tab.id, focusRequest])
+  // Electron emits a non-bubbling focus event on the webview element.
+  useEffect(() => {
+    const element = body.current as HTMLDivElement
+    const focus = (): void => {
+      if (!visible) return
+      if (floating) floats.raise(pane.id)
+      else if (state.activePaneId !== pane.id) callbacks.onFocusPane(pane.id)
+    }
+    element.addEventListener('focus', focus, true)
+    return () => { element.removeEventListener('focus', focus, true) }
+  }, [visible, floating, floats, pane.id, state.activePaneId, callbacks])
+  const lifted = floating && floats.preview?.paneId === pane.id ? floats.preview.rect : undefined
+  const rect = floating ? lifted ?? floatRect(pane) : undefined
+  const depth = lifted === undefined ? state.floats.indexOf(pane.id) + 1 : state.floats.length + 1
+  return (
+    <div className={clsx(css.tabCell, floating && css.floatingCell)} hidden={!selected}
+      data-dockkit-host={floating ? 'float' : 'dock'} data-dockkit-column={floating ? undefined : column}
+      style={{ gridColumn: floating ? 1 : column * 2 + 1, gridRow: 1, order: floating ? depth : 0 }}>
+      <section ref={host} className={clsx(css.tabHost, floating ? css.float : css.pane)}
+        aria-hidden={!visible || undefined}
+        data-dockkit-content={tab.id}
+        data-dockkit-pane={!floating && selected ? pane.id : undefined}
+        data-dockkit-pane-active={!floating && state.activePaneId === pane.id || undefined}
+        data-dockkit-float={floating ? pane.id : undefined}
+        data-dockkit-float-active={floating && state.activePaneId === pane.id || undefined}
+        data-dockkit-column={!floating ? column : undefined}
+        style={rect === undefined ? undefined : {
+          left: rect.x, top: rect.y, width: rect.width, height: rect.height,
+        }}
+        onPointerDown={() => { if (floating) floats.raise(pane.id) }}
+        onClick={() => { if (!floating && state.activePaneId !== pane.id) callbacks.onFocusPane(pane.id) }}>
+        <div className={css.tabHostHeader}>
+          {selected && (floating
+            ? <FloatHeader paneId={pane.id} tab={tab} labels={callbacks.labels} intents={intents}
+              renderTabTitle={callbacks.renderTabTitle} canCloseTab={callbacks.canCloseTab} drag={floats.drag} />
+            : <TabStrip state={state} pane={pane} callbacks={callbacks} />)}
+        </div>
+        <div ref={body} className={clsx(css.tabHostBody, floating ? css.floatBody : css.paneBody)}>
+          {visited && (retained || (active && selected)) ? callbacks.renderTab(tab) : null}
+          {!floating && <PaneDropHints pane={pane} callbacks={callbacks} />}
+        </div>
+        {floating && <div className={css.floatResize} data-dockkit-float-resize={pane.id}
+          onPointerDown={(event) => { floats.drag('resize', pane.id, event) }} />}
+      </section>
+    </div>
+  )
+}
+
+/**
+ * One or two horizontal panes; CSS resolves content sizes from track fractions.
+ * @param props - committed layout, gesture preview and body retention policy.
+ * @returns stable tab containers, including floating tabs.
+ * @throws if the docked tree is not one pane or two horizontal panes.
+ */
+export function TabLayout(props: LayoutProps): ReactNode {
+  const { state, callbacks, preview } = props
+  const focusRequest = useRef<{ readonly tabId: TabId; readonly origin: Element | null }>()
+  const tabCallbacks: PaneCallbacks = {
+    ...callbacks,
+    onFocusTab: (tabId) => {
+      // Only changing the selected body replaces its strip; pane-only focus does not.
+      focusRequest.current = findTabPane(state, tabId).activeTabId === tabId
+        ? undefined : { tabId, origin: document.activeElement }
+      callbacks.onFocusTab(tabId)
+    },
+  }
+  const root = getNode(state, state.rootId)
+  if (root.kind === 'split' && (root.axis !== 'row' || root.children.length !== 2)) {
+    throw new Error('DockLayout requires one pane or two horizontally split panes')
+  }
+  const panes = root.kind === 'pane' ? [root] : root.children.map(id => getPane(state, id))
+  const sizes = root.kind === 'split' ? preview?.splitId === root.id ? preview.sizes : root.sizes : [1]
+  const floats = useFloatGestures(state, props.intents)
+  const columns = sizes.map(size => `minmax(0, ${size}fr)`).join(' 0px ')
+  return (
+    <div className={css.tabLayout} data-dockkit-split={root.kind === 'split' ? root.id : undefined}
+      style={{ gridTemplateColumns: columns }}>
+      {/* Logical order changes must not make React move a connected webview's ancestor. */}
+      {Object.values(state.tabs).sort((a, b) => a.id.localeCompare(b.id)).map((tab) => {
+        const pane = findTabPane(state, tab.id)
+        return <TabHost key={tab.id} {...props} callbacks={tabCallbacks} tab={tab} pane={pane}
+          column={panes.findIndex(candidate => candidate.id === pane.id)} floats={floats} focusRequest={focusRequest} />
+      })}
+      {panes.filter(pane => pane.tabs.length === 0).map(pane => (
+        <div key={pane.id} className={css.emptyTabHost} data-dockkit-empty style={{ gridColumn: panes.indexOf(pane) * 2 + 1, gridRow: 1 }}>
+          <TabPanel state={state} pane={pane} callbacks={callbacks} />
+        </div>
+      ))}
+      {root.kind === 'split' && <div className={clsx(css.divider, css.tabLayoutDivider)}
+        data-dockkit-divider={`${root.id}:0`} style={{ gridColumn: 2, gridRow: 1 }}
+        onPointerDown={(event) => { callbacks.onDividerPressed(root.id, 0, event) }} />}
+    </div>
+  )
+}
diff --git a/packages/client/ui-dockkit/src/components/TabPanel.tsx b/packages/client/ui-dockkit/src/components/TabPanel.tsx
index ae7d2e6fa7..1088e71399 100644
--- a/packages/client/ui-dockkit/src/components/TabPanel.tsx
+++ b/packages/client/ui-dockkit/src/components/TabPanel.tsx
@@ -208,8 +208,8 @@ function splitBlockedTitle(labels: PaneCallbacks['labels'], block: SplitBlock):
   }
 }
 
-/** The pane's tab strip, split control, and body. */
-export function TabPanel({ state, pane, callbacks }: TabPanelProps): ReactNode {
+/** @param props - pane state and gestures. @returns its tab strip without a content container. */
+export function TabStrip({ state, pane, callbacks }: TabPanelProps): ReactNode {
   // The open context menu and the chip that opened it; the menu positions
   // itself against that chip from its portal.
   const [menu, setMenu] = useState<{ readonly tabId: TabId; readonly anchor: HTMLElement } | undefined>(undefined)
@@ -218,15 +218,11 @@ export function TabPanel({ state, pane, callbacks }: TabPanelProps): ReactNode {
   const stripTabs = useRef<HTMLDivElement | null>(null)
   useStripScrollFades(stripTabs, pane.tabs)
   useActiveChipInView(stripTabs, chips, pane.tabs, pane.activeTabId)
-  const active = pane.activeTabId === undefined ? undefined : getTab(state, pane.activeTabId)
   const block = callbacks.splitBlock(pane.id)
   const target = callbacks.dropTarget
   const stripIndex = target !== undefined && target.kind === 'strip' && target.paneId === pane.id
     ? target.index
     : undefined
-  const zone = target !== undefined && target.kind === 'zone' && target.paneId === pane.id
-    ? target.zone
-    : undefined
 
   /** Select a tab from a click or a key, unless it is the active pane's selected tab already: that changes nothing. */
   const activate = (tabId: TabId): void => {
@@ -241,187 +237,196 @@ export function TabPanel({ state, pane, callbacks }: TabPanelProps): ReactNode {
     chip.focus()
   }
 
+  return (
+    <div className={css.tabStrip} role="tablist" data-dockkit-strip={pane.id}>
+      <div ref={stripTabs} className={css.stripTabs} role="presentation" data-dockkit-strip-tabs={pane.id}>
+        {pane.tabs.map((tabId, index) => {
+          const tab = getTab(state, tabId)
+          const selected = tabId === pane.activeTabId
+          const closable = callbacks.canCloseTab(tabId)
+          // A pane's lone unclosable chip is a label, not a choice: there is
+          // no other tab to select against and nothing to do to it.
+          const quiet = !closable && pane.tabs.length === 1
+          return (
+            <Fragment key={tabId}>
+              {(index > 0 || stripIndex === index) && (
+                <div
+                  className={clsx(css.slot, stripIndex === index && css.slotCaret)}
+                  data-dockkit-caret={stripIndex === index ? index : undefined}
+                />
+              )}
+              <div
+                role="tab"
+                aria-selected={selected}
+                tabIndex={selected ? 0 : -1}
+                className={clsx(
+                  css.tab,
+                  selected && css.tabActive,
+                  quiet && css.tabQuiet,
+                  callbacks.draggingTabId === tabId && css.tabDragging,
+                )}
+                data-dockkit-tab={tabId}
+                data-dockkit-tab-quiet={quiet || undefined}
+                ref={(element) => {
+                  if (element === null) chips.delete(tabId)
+                  else chips.set(tabId, element)
+                }}
+                // Focus lands on click, not on press: a state change between
+                // pointerdown and the first pointermove rebuilds this subtree,
+                // and Chromium cancels the pointer when the pressed element is
+                // replaced — which would abandon every drag. A drag that ends
+                // elsewhere fires no click, and its own operation carries focus.
+                onPointerDown={(event) => {
+                  // A secondary press is the menu, never a drag.
+                  if (event.button === 2) return
+                  callbacks.onTabPressed(tabId, event)
+                }}
+                onClick={(event) => {
+                  event.stopPropagation()
+                  activate(tabId)
+                }}
+                onKeyDown={(event) => {
+                  // Keys on the chip's nested close control are that control's.
+                  if (event.target !== event.currentTarget) return
+                  const next = chipToFocus(event.key, pane.tabs, tabId)
+                  if (next !== undefined) {
+                    event.preventDefault()
+                    focusChip(next)
+                    return
+                  }
+                  if (selects(event.key)) {
+                    event.preventDefault()
+                    activate(tabId)
+                  }
+                }}
+                onContextMenu={(event) => {
+                  event.preventDefault()
+                  const anchor = event.currentTarget
+                  setMenu(current => current?.tabId === tabId ? undefined : { tabId, anchor })
+                }}
+              >
+                <TabTitle>{callbacks.renderTabTitle?.(tab) ?? tab.title}</TabTitle>
+                {closable && (
+                  <button
+                    type="button"
+                    className={css.tabClose}
+                    aria-label={callbacks.labels.closeTab}
+                    data-dockkit-tab-close={tabId}
+                    // A nested control stops its own press: otherwise the press
+                    // starts a drag, captures the pointer, and this click never lands.
+                    onPointerDown={(event) => { event.stopPropagation() }}
+                    onClick={(event) => {
+                      event.stopPropagation()
+                      callbacks.onCloseTab(tabId)
+                    }}
+                  >
+                    <IconCloseFillRegular size={14} />
+                  </button>
+                )}
+                {menu?.tabId === tabId && (
+                  <TabMenu
+                    labels={callbacks.labels}
+                    anchor={menu.anchor}
+                    onClose={closable ? () => { setMenu(undefined); callbacks.onCloseTab(tabId) } : undefined}
+                    onDismiss={() => { setMenu(undefined) }}
+                    extras={callbacks.renderTabMenuItems?.(tab, () => { setMenu(undefined) })}
+                  />
+                )}
+              </div>
+            </Fragment>
+          )
+        })}
+        {stripIndex === pane.tabs.length && <div className={clsx(css.slot, css.slotCaret)} data-dockkit-caret={stripIndex} />}
+      </div>
+      {callbacks.canAddTab(pane.id) && (
+        <Tooltip label={callbacks.labels.addTab} side="bottom" delayMs={500}>
+          <button
+            type="button"
+            className={css.addTab}
+            aria-label={callbacks.labels.addTab}
+            data-dockkit-add-tab={pane.id}
+            onClick={(event) => {
+              event.stopPropagation()
+              callbacks.onAddTab(pane.id)
+            }}
+          >
+            <IconPlusOutlineRegular size={14} />
+          </button>
+        </Tooltip>
+      )}
+      <div className={css.stripFill} data-dockkit-strip-fill />
+      {!(callbacks.hideSplitWhenBlocked && block !== undefined) && (
+        <Tooltip label={callbacks.labels.splitPane} side="bottom" delayMs={500} disabled={block !== undefined}>
+          <button
+            type="button"
+            className={css.iconButton}
+            aria-label={callbacks.labels.splitPane}
+            // Disabled buttons fire no hover events, so the blocked reason
+            // stays a native title.
+            title={block === undefined ? undefined : splitBlockedTitle(callbacks.labels, block)}
+            disabled={block !== undefined}
+            data-dockkit-split-button={pane.id}
+            data-dockkit-split-blocked={block}
+            onClick={(event) => {
+              event.stopPropagation()
+              callbacks.onSplitPane(pane.id)
+            }}
+          >
+            <SplitGlyph />
+          </button>
+        </Tooltip>
+      )}
+      {/* The embedder's surface-wide controls, in the top-right pane only: the
+            strip is the surface's top edge, and this pane's end is its corner. */}
+      {pane.id === callbacks.chromePaneId && callbacks.chrome !== undefined && (
+      // The embedder's controls report their own intents; the pane's
+      // click-to-focus must not add a focus entry to each of them.
+        <div
+          className={css.stripChrome}
+          data-dockkit-strip-chrome
+          onClick={(event) => { event.stopPropagation() }}
+        >
+          {callbacks.chrome}
+        </div>
+      )}
+    </div>
+  )
+}
+
+/** @param props - target pane and drag preview. @returns body-local drop feedback, or nothing. */
+export function PaneDropHints({ pane, callbacks }: Pick<TabPanelProps, 'pane' | 'callbacks'>): ReactNode {
+  const target = callbacks.dropTarget
+  const zone = target?.kind === 'zone' && target.paneId === pane.id ? target.zone : undefined
+  if (zone === undefined) return null
+  return <>
+    <div className={css.dockScrim} data-dockkit-dock-scrim />
+    {callbacks.horizontalDrops && zone !== 'center'
+      ? <>
+        <DockHint zone="left" active={zone === 'left'} labels={callbacks.labels} />
+        <DockHint zone="right" active={zone === 'right'} labels={callbacks.labels} />
+      </>
+      : <DockHint zone={zone} active labels={callbacks.labels} />}
+  </>
+}
+
+/** @param props - pane state and gestures. @returns one pane in the recursive, visibility-mounted layout. */
+export function TabPanel({ state, pane, callbacks }: TabPanelProps): ReactNode {
+  const active = pane.activeTabId === undefined ? undefined : getTab(state, pane.activeTabId)
   return (
     <section
       className={css.pane}
       data-dockkit-pane={pane.id}
       data-dockkit-pane-active={state.activePaneId === pane.id || undefined}
-      // A click on the pane's body or strip focuses the pane, unless it is the
-      // active one already: that click changes nothing and records nothing. The
-      // chips and the strip's controls stop their own clicks: each reports one
-      // intent, and that intent already decides which pane is active.
       onClick={() => {
-        if (state.activePaneId === pane.id) return
-        callbacks.onFocusPane(pane.id)
+        if (state.activePaneId !== pane.id) callbacks.onFocusPane(pane.id)
       }}
     >
-      <div className={css.tabStrip} role="tablist" data-dockkit-strip={pane.id}>
-        <div ref={stripTabs} className={css.stripTabs} role="presentation" data-dockkit-strip-tabs={pane.id}>
-          {pane.tabs.map((tabId, index) => {
-            const tab = getTab(state, tabId)
-            const selected = tabId === pane.activeTabId
-            const closable = callbacks.canCloseTab(tabId)
-            // A pane's lone unclosable chip is a label, not a choice: there is
-            // no other tab to select against and nothing to do to it.
-            const quiet = !closable && pane.tabs.length === 1
-            return (
-              <Fragment key={tabId}>
-                {(index > 0 || stripIndex === index) && (
-                  <div
-                    className={clsx(css.slot, stripIndex === index && css.slotCaret)}
-                    data-dockkit-caret={stripIndex === index ? index : undefined}
-                  />
-                )}
-                <div
-                  role="tab"
-                  aria-selected={selected}
-                  tabIndex={selected ? 0 : -1}
-                  className={clsx(
-                    css.tab,
-                    selected && css.tabActive,
-                    quiet && css.tabQuiet,
-                    callbacks.draggingTabId === tabId && css.tabDragging,
-                  )}
-                  data-dockkit-tab={tabId}
-                  data-dockkit-tab-quiet={quiet || undefined}
-                  ref={(element) => {
-                    if (element === null) chips.delete(tabId)
-                    else chips.set(tabId, element)
-                  }}
-                  // Focus lands on click, not on press: a state change between
-                  // pointerdown and the first pointermove rebuilds this subtree,
-                  // and Chromium cancels the pointer when the pressed element is
-                  // replaced — which would abandon every drag. A drag that ends
-                  // elsewhere fires no click, and its own operation carries focus.
-                  onPointerDown={(event) => {
-                    // A secondary press is the menu, never a drag.
-                    if (event.button === 2) return
-                    callbacks.onTabPressed(tabId, event)
-                  }}
-                  onClick={(event) => {
-                    event.stopPropagation()
-                    activate(tabId)
-                  }}
-                  onKeyDown={(event) => {
-                    // Keys on the chip's nested close control are that control's.
-                    if (event.target !== event.currentTarget) return
-                    const next = chipToFocus(event.key, pane.tabs, tabId)
-                    if (next !== undefined) {
-                      event.preventDefault()
-                      focusChip(next)
-                      return
-                    }
-                    if (selects(event.key)) {
-                      event.preventDefault()
-                      activate(tabId)
-                    }
-                  }}
-                  onContextMenu={(event) => {
-                    event.preventDefault()
-                    const anchor = event.currentTarget
-                    setMenu(current => current?.tabId === tabId ? undefined : { tabId, anchor })
-                  }}
-                >
-                  <TabTitle>{callbacks.renderTabTitle?.(tab) ?? tab.title}</TabTitle>
-                  {closable && (
-                    <button
-                      type="button"
-                      className={css.tabClose}
-                      aria-label={callbacks.labels.closeTab}
-                      data-dockkit-tab-close={tabId}
-                      // A nested control stops its own press: otherwise the press
-                      // starts a drag, captures the pointer, and this click never lands.
-                      onPointerDown={(event) => { event.stopPropagation() }}
-                      onClick={(event) => {
-                        event.stopPropagation()
-                        callbacks.onCloseTab(tabId)
-                      }}
-                    >
-                      <IconCloseFillRegular size={14} />
-                    </button>
-                  )}
-                  {menu?.tabId === tabId && (
-                    <TabMenu
-                      labels={callbacks.labels}
-                      anchor={menu.anchor}
-                      onClose={closable ? () => { setMenu(undefined); callbacks.onCloseTab(tabId) } : undefined}
-                      onDismiss={() => { setMenu(undefined) }}
-                      extras={callbacks.renderTabMenuItems?.(tab, () => { setMenu(undefined) })}
-                    />
-                  )}
-                </div>
-              </Fragment>
-            )
-          })}
-          {stripIndex === pane.tabs.length && <div className={clsx(css.slot, css.slotCaret)} data-dockkit-caret={stripIndex} />}
-        </div>
-        {callbacks.canAddTab(pane.id) && (
-          <Tooltip label={callbacks.labels.addTab} side="bottom" delayMs={500}>
-            <button
-              type="button"
-              className={css.addTab}
-              aria-label={callbacks.labels.addTab}
-              data-dockkit-add-tab={pane.id}
-              onClick={(event) => {
-                event.stopPropagation()
-                callbacks.onAddTab(pane.id)
-              }}
-            >
-              <IconPlusOutlineRegular size={14} />
-            </button>
-          </Tooltip>
-        )}
-        <div className={css.stripFill} data-dockkit-strip-fill />
-        {!(callbacks.hideSplitWhenBlocked && block !== undefined) && (
-          <Tooltip label={callbacks.labels.splitPane} side="bottom" delayMs={500} disabled={block !== undefined}>
-            <button
-              type="button"
-              className={css.iconButton}
-              aria-label={callbacks.labels.splitPane}
-              // Disabled buttons fire no hover events, so the blocked reason
-              // stays a native title.
-              title={block === undefined ? undefined : splitBlockedTitle(callbacks.labels, block)}
-              disabled={block !== undefined}
-              data-dockkit-split-button={pane.id}
-              data-dockkit-split-blocked={block}
-              onClick={(event) => {
-                event.stopPropagation()
-                callbacks.onSplitPane(pane.id)
-              }}
-            >
-              <SplitGlyph />
-            </button>
-          </Tooltip>
-        )}
-        {/* The embedder's surface-wide controls, in the top-right pane only: the
-            strip is the surface's top edge, and this pane's end is its corner. */}
-        {pane.id === callbacks.chromePaneId && callbacks.chrome !== undefined && (
-          // The embedder's controls report their own intents; the pane's
-          // click-to-focus must not add a focus entry to each of them.
-          <div
-            className={css.stripChrome}
-            data-dockkit-strip-chrome
-            onClick={(event) => { event.stopPropagation() }}
-          >
-            {callbacks.chrome}
-          </div>
-        )}
-      </div>
+      <TabStrip state={state} pane={pane} callbacks={callbacks} />
       <div className={css.paneBody}>
         {active === undefined
           ? <p className={css.empty}>{callbacks.labels.emptyPane}</p>
           : callbacks.renderTab(active)}
-        {zone !== undefined && (
-          <>
-            <div className={css.dockScrim} data-dockkit-dock-scrim />
-            {callbacks.horizontalDrops && zone !== 'center'
-              ? <>
-                <DockHint zone="left" active={zone === 'left'} labels={callbacks.labels} />
-                <DockHint zone="right" active={zone === 'right'} labels={callbacks.labels} />
-              </>
-              : <DockHint zone={zone} active labels={callbacks.labels} />}
-          </>
-        )}
+        <PaneDropHints pane={pane} callbacks={callbacks} />
       </div>
     </section>
   )
diff --git a/packages/client/ui-dockkit/src/components/dockkit.module.css b/packages/client/ui-dockkit/src/components/dockkit.module.css
index fab875c5b6..fd24348a10 100644
--- a/packages/client/ui-dockkit/src/components/dockkit.module.css
+++ b/packages/client/ui-dockkit/src/components/dockkit.module.css
@@ -129,6 +129,82 @@
   min-height: 0;
 }
 
+/* Every tab remains a sibling. Explicit tracks determine placement; order only
+   changes painting, so raising a float never moves a connected DOM ancestor. */
+.tabLayout {
+  display: grid;
+  flex: 1 1 auto;
+  grid-template-rows: minmax(0, 1fr);
+  min-width: 0;
+  min-height: 0;
+}
+
+.tabCell,
+.emptyTabHost {
+  display: flex;
+  min-width: 0;
+  min-height: 0;
+  z-index: var(--dsh-dockkit-dock-layer, 10);
+}
+
+.tabCell[hidden] {
+  display: none;
+}
+
+/* A zero-sized Grid item supplies a stacking context, not a containing block
+   for its fixed child. Floats share one layer and use Grid paint order within it. */
+.floatingCell {
+  width: 0;
+  height: 0;
+  z-index: var(--dsh-dockkit-float-layer, 60);
+}
+
+.tabHost {
+  min-width: 0;
+  min-height: 0;
+  pointer-events: auto;
+}
+
+.tabHost:not(.float),
+.emptyTabHost {
+  background: var(--dsw-alias-bg-base);
+}
+
+.tabCell[data-dockkit-host='dock'][data-dockkit-column='0'] > .tabHost {
+  border-left: 0.5px solid var(--dsw-alias-border-l4);
+}
+
+.tabHostHeader {
+  flex: none;
+}
+
+.tabHostBody {
+  position: relative;
+  min-width: 0;
+}
+
+.tabLayoutDivider {
+  width: 0;
+  cursor: col-resize;
+  z-index: calc(var(--dsh-dockkit-dock-layer, 10) + 1);
+  pointer-events: auto;
+}
+
+.tabLayoutDivider::before {
+  top: 0;
+  bottom: 0;
+  left: -0.25px;
+  width: 0.5px;
+}
+
+.tabLayoutDivider::after {
+  top: 0;
+  bottom: 0;
+  left: -4px;
+  right: -4px;
+  background: linear-gradient(to bottom, transparent, var(--dsw-alias-label-caption) 50%, transparent) center / 1px 100% no-repeat;
+}
+
 /* A body that overflows scrolls inside its pane; nothing escapes the pane. */
 .pane {
   display: flex;
@@ -234,6 +310,7 @@
 :global(html[data-platform='darwin']) .stripTabs,
 :global(html[data-platform='darwin']) .stripChrome,
 :global(html[data-platform='darwin']) .paneBody,
+:global(html[data-platform='darwin']) .float,
 :global(html[data-platform='darwin']) .divider {
   -webkit-app-region: no-drag;
 }
diff --git a/packages/client/ui-dockkit/src/components/pointer.ts b/packages/client/ui-dockkit/src/components/pointer.ts
index a3b368ea9b..bd2f136bf4 100644
--- a/packages/client/ui-dockkit/src/components/pointer.ts
+++ b/packages/client/ui-dockkit/src/components/pointer.ts
@@ -40,6 +40,10 @@ export function followPointer(element: HTMLElement, pointerId: number, followers
   capturePointer(element, pointerId)
   const controller = new AbortController()
   const { signal } = controller
+  element.dataset.dockkitPointer = String(pointerId)
+  signal.addEventListener('abort', () => {
+    if (element.dataset.dockkitPointer === String(pointerId)) delete element.dataset.dockkitPointer
+  }, { once: true })
   const own = (event: PointerEvent): boolean => event.pointerId === pointerId
   window.addEventListener('pointermove', (event) => { if (own(event)) followers.move(event) }, { signal })
   window.addEventListener('pointerup', (event) => {
diff --git a/packages/client/ui-dockkit/src/index.ts b/packages/client/ui-dockkit/src/index.ts
index f72adb9271..0632f84fe5 100644
--- a/packages/client/ui-dockkit/src/index.ts
+++ b/packages/client/ui-dockkit/src/index.ts
@@ -66,3 +66,5 @@ export { DockSurface } from './components/DockSurface.tsx'
 export type { DockSurfaceProps } from './components/DockSurface.tsx'
 export { FloatLayer } from './components/FloatLayer.tsx'
 export type { FloatLayerProps } from './components/FloatLayer.tsx'
+export { DockLayout } from './components/DockSurface.tsx'
+export type { DockLayoutProps } from './components/DockSurface.tsx'
diff --git a/packages/client/ui-dockkit/tests/tab-layout.client.spec.tsx b/packages/client/ui-dockkit/tests/tab-layout.client.spec.tsx
new file mode 100644
index 0000000000..8a884ba72a
--- /dev/null
+++ b/packages/client/ui-dockkit/tests/tab-layout.client.spec.tsx
@@ -0,0 +1,212 @@
+// @vitest-environment jsdom
+import { afterEach, expect, it, vi } from 'vitest'
+import { act, cleanup, fireEvent, render } from '@testing-library/react'
+import type { ComponentProps } from 'react'
+import { TabLayout } from '../src/components/TabLayout.tsx'
+import { DockController } from '../src/engine/controller.ts'
+import { getNode, getPane } from '../src/engine/tree.ts'
+import type { PaneCallbacks } from '../src/components/render.ts'
+import type { TabId } from '../src/contract/types.ts'
+import { followPointer } from '../src/components/pointer.ts'
+import { seededController, TEST_LABELS } from './fixtures.client.ts'
+
+afterEach(() => { cleanup(); vi.restoreAllMocks() })
+
+function mounted(controller = seededController(), options: Partial<ComponentProps<typeof TabLayout>> = {}) {
+  const callbacks: PaneCallbacks = {
+    onFocusTab: (id) => { controller.focusTab(id); redraw() },
+    onFocusPane: (id) => { controller.focusPane(id); redraw() },
+    onSplitPane: vi.fn(), onAddTab: vi.fn(), onCloseTab: vi.fn(), onTabPressed: vi.fn(), onDividerPressed: vi.fn(),
+    splitBlock: () => undefined, canAddTab: () => true, canCloseTab: () => true,
+    dropTarget: undefined, draggingTabId: undefined, labels: TEST_LABELS,
+    renderTab: tab => <input data-body={tab.id} defaultValue={tab.title} />,
+    renderTabTitle: undefined, renderTabMenuItems: undefined,
+    chromePaneId: getPane(controller.getSnapshot().state, controller.getSnapshot().state.rootId).id,
+    chrome: undefined,
+  }
+  const props = () => ({ state: controller.getSnapshot().state, callbacks, intents: controller, preview: undefined, ...options })
+  const view = render(<TabLayout {...props()} />)
+  function redraw(next: typeof options = {}) {
+    options = { ...options, ...next }
+    view.rerender(<TabLayout {...props()} />)
+  }
+  const node = (selector: string): HTMLElement => {
+    const element = view.container.querySelector<HTMLElement>(selector)
+    if (element === null) throw new Error(`missing ${selector}`)
+    return element
+  }
+  return { controller, view, redraw, callbacks, node, body: (id: TabId) => node(`[data-body="${id}"]`) }
+}
+
+it('retains visited bodies and hands keyboard focus to the newly selected strip', () => {
+  const controller = seededController()
+  controller.setExpanded(true)
+  const first = getPane(controller.getSnapshot().state, controller.getSnapshot().state.rootId).tabs[0]!
+  const second = controller.openContent({ kind: 'file', contentId: 'file:b', title: 'B' })
+  controller.focusTab(first)
+  const h = mounted(controller, { keepMounted: () => true })
+  const original = h.body(first)
+  expect(h.view.container.querySelector(`[data-body="${second}"]`)).toBeNull()
+  const chip = h.node(`[data-dockkit-tab="${second}"]`)
+  chip.focus()
+  fireEvent.click(chip)
+  expect(document.activeElement).toBe(h.node(`[data-dockkit-content="${second}"] [data-dockkit-tab="${second}"]`))
+  expect(h.body(first)).toBe(original)
+  expect(original.closest('[data-dockkit-host]')).toHaveProperty('hidden', true)
+  fireEvent.click(h.node(`[data-dockkit-content="${second}"] [data-dockkit-tab="${second}"]`))
+  const body = h.body(second)
+  body.focus()
+  h.redraw({ active: false })
+  expect(body.closest('[data-dockkit-content]')).toHaveProperty('inert', true)
+  expect(document.activeElement).not.toBe(body)
+  fireEvent.focus(body)
+  h.redraw({ active: true })
+  expect(h.body(second)).toBe(body)
+  expect(body.closest('[data-dockkit-content]')).toHaveProperty('inert', false)
+  act(() => { controller.setExpanded(false); h.redraw() })
+  expect(h.body(second)).toBe(body)
+})
+
+it('keeps body ancestors through pane moves, floating, raising and docking', () => {
+  const controller = seededController()
+  controller.setExpanded(true)
+  const tab = controller.openContent({ kind: 'file', contentId: 'file:a', title: 'A' })
+  const h = mounted(controller, { keepMounted: () => true })
+  const body = h.body(tab)
+  const host = body.closest('[data-dockkit-host]')!
+  act(() => { controller.splitPane(); h.redraw() })
+  expect(h.view.container.querySelectorAll('[data-dockkit-pane]')).toHaveLength(2)
+  const state = controller.getSnapshot().state
+  const split = getNode(state, state.rootId)
+  if (split.kind !== 'split') throw new Error('expected a split')
+  h.redraw({ preview: { splitId: split.id, sizes: [0.3, 0.7] } })
+  expect(h.node('[data-dockkit-split]').style.gridTemplateColumns).toContain('0.3fr')
+  fireEvent.pointerDown(h.node('[data-dockkit-divider]'), { button: 0, pointerId: 1 })
+  expect(h.callbacks.onDividerPressed).toHaveBeenCalledOnce()
+  h.redraw({ preview: undefined })
+  const secondPane = getPane(state, split.children[1]!).id
+  fireEvent.click(h.node(`[data-dockkit-content="${tab}"] [data-dockkit-tab="${tab}"]`))
+  expect(controller.getSnapshot().state.activePaneId).toBe(split.children[0])
+  act(() => { controller.focusPane(secondPane); h.redraw() })
+  fireEvent.focus(body)
+  expect(controller.getSnapshot().state.activePaneId).toBe(split.children[0])
+  act(() => { controller.focusPane(secondPane); h.redraw() })
+  fireEvent.pointerDown(h.node(`[data-dockkit-content="${tab}"]`), { button: 0, pointerId: 1 })
+  fireEvent.click(body)
+  fireEvent.focus(body)
+  expect(controller.getSnapshot().state.activePaneId).toBe(getPane(state, split.children[0]!).id)
+  act(() => { controller.placeTab(tab, secondPane, 0); h.redraw() })
+  expect(h.body(tab)).toBe(body)
+  expect(body.closest('[data-dockkit-host]')).toBe(host)
+  act(() => { controller.floatTab(tab); h.redraw() })
+  const floating = controller.getSnapshot().state.floats[0]!
+  expect(body.closest('[data-dockkit-host]')).toBe(host)
+  expect(host.getAttribute('data-dockkit-host')).toBe('float')
+  act(() => { controller.setExpanded(false); h.redraw() })
+  expect(body.closest('[data-dockkit-content]')?.getAttribute('aria-hidden')).toBeNull()
+  fireEvent.pointerDown(h.node(`[data-dockkit-float="${floating}"]`), { pointerId: 1, button: 0 })
+  fireEvent.click(h.node(`[data-dockkit-float="${floating}"]`))
+  fireEvent.focus(body)
+  const resize = h.node('[data-dockkit-float-resize]')
+  fireEvent.pointerDown(resize, { pointerId: 2, button: 0, clientX: 500, clientY: 400 })
+  fireEvent.pointerMove(window, { pointerId: 2, clientX: 540, clientY: 440 })
+  fireEvent.pointerUp(window, { pointerId: 2, clientX: 540, clientY: 440 })
+  act(() => { h.redraw(); controller.unfloatPane(floating); h.redraw() })
+  expect(h.body(tab)).toBe(body)
+  expect(body.closest('[data-dockkit-host]')).toBe(host)
+})
+
+it('unmounts unretained bodies and restores focus to their replacement strip', () => {
+  const controller = seededController()
+  controller.setExpanded(true)
+  const first = getPane(controller.getSnapshot().state, controller.getSnapshot().state.rootId).tabs[0]!
+  const second = controller.openContent({ kind: 'file', contentId: 'file:b', title: 'B' })
+  controller.focusTab(first)
+  const h = mounted(controller)
+  const original = h.body(first)
+  fireEvent.click(h.node(`[data-dockkit-tab="${second}"]`))
+  expect(original.isConnected).toBe(false)
+  h.redraw({ active: false })
+  expect(h.view.container.querySelector('[data-body]')).toBeNull()
+  h.redraw({ active: true })
+  const focus = vi.spyOn(HTMLElement.prototype, 'focus')
+  fireEvent.click(h.node(`[data-dockkit-tab="${first}"]`))
+  expect(focus).toHaveBeenCalled()
+})
+
+it.for(['new-control', 'origin-control', 'document', 'no-focus'] as const)('transfers tab focus without overriding a new owner: %s', (kind, test) => {
+  const controller = seededController()
+  controller.setExpanded(true)
+  const first = getPane(controller.getSnapshot().state, controller.getSnapshot().state.rootId).tabs[0]!
+  const second = controller.openContent({ kind: 'file', contentId: 'file:b', title: 'B' })
+  controller.focusTab(first)
+  const h = mounted(controller)
+  const control = document.createElement('button')
+  document.body.append(control)
+  test.onTestFinished(() => { control.remove() })
+  if (kind === 'origin-control') control.focus()
+  vi.spyOn(h.callbacks, 'onFocusTab').mockImplementation((id) => {
+    if (kind === 'new-control') control.focus()
+    if (kind === 'document' || kind === 'no-focus') {
+      vi.spyOn(document, 'activeElement', 'get').mockReturnValue(kind === 'document' ? document.documentElement : null)
+    }
+    controller.focusTab(id)
+    h.redraw()
+  })
+  const focus = vi.spyOn(HTMLElement.prototype, 'focus')
+  fireEvent.click(h.node(`[data-dockkit-tab="${second}"]`))
+  if (kind === 'new-control') expect(document.activeElement).toBe(control)
+  else expect(focus).toHaveBeenCalledWith({ preventScroll: true })
+})
+
+it('does not require a docked strip when a selected tab becomes floating in the same update', () => {
+  const controller = seededController()
+  controller.setExpanded(true)
+  const first = getPane(controller.getSnapshot().state, controller.getSnapshot().state.rootId).tabs[0]!
+  const second = controller.openContent({ kind: 'file', contentId: 'file:b', title: 'B' })
+  controller.focusTab(first)
+  const h = mounted(controller)
+  vi.spyOn(h.callbacks, 'onFocusTab').mockImplementation((id) => {
+    controller.focusTab(id)
+    controller.floatTab(id)
+    h.redraw()
+  })
+  fireEvent.click(h.node(`[data-dockkit-tab="${second}"]`))
+  expect(h.node(`[data-dockkit-content="${second}"]`).hasAttribute('data-dockkit-float')).toBe(true)
+})
+
+it('renders an empty pane and rejects unsupported docked trees', () => {
+  const controller = new DockController()
+  controller.setExpanded(true)
+  const h = mounted(controller)
+  expect(h.node('[data-dockkit-empty]')).toBeDefined()
+  controller.openContent({ kind: 'file', contentId: 'file:a', title: 'A' })
+  controller.splitPane()
+  const state = controller.getSnapshot().state
+  const root = getNode(state, state.rootId)
+  if (root.kind !== 'split') throw new Error('expected a split')
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+  const suppress = (event: ErrorEvent): void => {
+    if (event.error instanceof Error && event.error.message === 'DockLayout requires one pane or two horizontally split panes') {
+      event.preventDefault()
+    }
+  }
+  window.addEventListener('error', suppress)
+  try {
+    expect(() =>{  h.redraw({ state: { ...state, nodes: { ...state.nodes, [root.id]: { ...root, axis: 'column' } } } }) })
+      .toThrow('two horizontally split panes')
+  } finally {
+    window.removeEventListener('error', suppress)
+  }
+})
+
+it('keeps a superseding gesture marker when an older follower detaches', () => {
+  const element = document.createElement('div')
+  const followers = { move: vi.fn(), up: vi.fn(), cancel: vi.fn() }
+  const first = followPointer(element, 1, followers)
+  const second = followPointer(element, 2, followers)
+  first()
+  expect(element.dataset.dockkitPointer).toBe('2')
+  second()
+  expect(element.dataset.dockkitPointer).toBeUndefined()
+})
diff --git a/packages/client/ui-jobs/README.i18n.yaml b/packages/client/ui-jobs/README.i18n.yaml
index 3be8b2febf..0f1cb98168 100644
--- a/packages/client/ui-jobs/README.i18n.yaml
+++ b/packages/client/ui-jobs/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-jobs/README.md
-README.md: b775bdd354dda43f7427de7878299e6a7d7e9d2d
-README.zh.md: ef7ac07710393b9af8bb47d8763ef2c79f176d7d
+README.md: b6c8f39d40ca4630313659a94adc305f4c379119
+README.zh.md: 871948194dfcc9a5f0a9ab1f795556944b19144f
diff --git a/packages/client/ui-jobs/README.md b/packages/client/ui-jobs/README.md
index b775bdd354..b6c8f39d40 100644
--- a/packages/client/ui-jobs/README.md
+++ b/packages/client/ui-jobs/README.md
@@ -1,5 +1,5 @@
 ---
-description: "Web background-job surface: the session-header action listing the jobs this session can see; for users and maintainers of the background-job experience."
+description: "The session-header background-job list: expandable streaming output panels, running/finished sections, and static rows for settled jobs without retained output."
 kind: "package-reference"
 ---
 
@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
 
 ## Summary
 
-This package renders the background-job surface of the Web GUI: a session-header action that opens a popover listing the jobs this session can see. It reads host-computed registry state through the runtime's `jobsBySession` mirror and issues no RPC of its own. The trigger appears only when the session has at least one job, with a badge counting running and stopping jobs; settled rows stay visible and de-emphasized until the registry drops them. The model's own view of the same jobs belongs to `dsh-tool-jobs`; this package is a read-only projection for the human.
+`dsh-client-ui-jobs` shows the session's background jobs in one header control, with lifecycle, elapsed time, progress, and terminal detail. Live jobs and settled jobs with retained output offer expandable output panels; collapsing stops the stream. Live rows lead with a ticking duration, followed by kind and status. Settled rows fold under a section heading; those without retained output, including subagents whose answers went to the model, stay static.
 
 ## Table of Contents
 
@@ -25,11 +25,15 @@ This package renders the background-job surface of the Web GUI: a session-header
 <a id="use-this-package"></a>
 ## Use this package
 
-Mount this plugin alongside the runtime; the job action then appears in the session header whenever the session has at least one job. A click opens the popover: live rows first by start time, then settled rows by finish time, each showing the producer kind, label, status, and an elapsed duration that ticks once per second while live and freezes at completion.
+Load the plugin through the web-app manifest; it renders nothing until the session can see at least one job, so an ordinary conversation never grows a control for a capability it is not using.
 
-### Dismissal and limits
+### One row per job
 
-Escape closes the list and returns focus to the trigger, as does a pointer press outside it. The list shows what one session can see through the wire view, so a job owned by another session never appears here; a process restart empties the list while the transcript keeps the `run_in_background` cards that started those jobs.
+The `job.list` stream `ctx.jobs` mirrors is the single roster: each `JobView` row carries lifecycle, duration, the live `progress` line or the terminal `detail`, and its retained byte count — a live job, or a settled one with retained output, is what makes a row expandable. There is no second roster to join.
+
+### The expanded panel
+
+Expanding an observable row opens that job's output observation stream from `ctx.jobs` (installed by `dsh-api-job-controller`) into an embedded terminal panel. The panel copies the command (not the output), wraps commands and output lines in full, scrolls its output inside a fixed height instead of folding, and draws no run-state dot of its own — the row above carries the state. Retention gaps and stream interruptions render as notices above the panel.
 
 -----
 
@@ -39,7 +43,13 @@ Escape closes the list and returns focus to the trigger, as does a pointer press
 <details>
 <summary>Implementation internals — click to expand</summary>
 
-The package contributes one entry to `conversation.session.header.actions` (`JobListAction`), and the data arrives entirely through the `jobsBySession` list mirror that the Session Controller binding folds from `session/jobs` frames — no RPC, and no state beyond popover visibility. The badge counts `running` plus `stopping` and is omitted at zero. Rows are ordered with live rows first by `startedAt` ascending, then settled rows by `finishedAt` descending, with a same-millisecond tie broken on start order; a settled row missing `finishedAt` reads as zero rather than as a negative figure, and a duration past an hour stays in hours. Settled rows stay visible because a failed job's `detail` is the only place its failure is legible. The behavior is specified by the [Web background-job display Agent Note](../../../.agents/notes/implemented/feature/2026-08-08-web-background-job-display.md).
+One slot entry in the header actions band (after the preset label, before the subagent catalog) renders the trigger and popover; the popover fits itself to the viewport by measuring its anchor. All data arrives through `ctx.jobs` — the component holds no transport state. The roster follows the mount: one `useEffect` keeps the session's `job.list` stream open while the control lives. Observation follows visibility: another `useEffect` opens the stream for the expanded row's job and closes it on collapse, unmount, or popover close.
+
+| File | Role |
+|---|---|
+| [`src/client/JobListAction.tsx`](src/client/JobListAction.tsx) | The job list: sections, durations, panels |
+| [`src/client/index.ts`](src/client/index.ts) | Slot registration and the dictionaries |
+| [`src/client/locales.ts`](src/client/locales.ts) | The `job` namespace copy (zh source of truth) |
 
 </details>
 
@@ -48,19 +58,16 @@ The package contributes one entry to `conversation.session.header.actions` (`Job
 <a id="further-exploration"></a>
 ## Further Exploration
 
-Read these pages when the job surface is not enough. They move from the browser list to the registry and the model-facing tool.
-
-- [dsh-tool-jobs](../../jobs/tool-jobs/README.md) — the model-facing jobs tool over the same registry.
-- [Session Controller](../../api/session-controller/README.md) — folds the `jobsBySession` mirror this package reads.
-- [ui-subagent](../ui-subagent/README.md) — the subagent catalog, where a running one-shot background subagent also appears.
-- [Web client architecture](../../../.agents/notes/implemented/architecture/2026-07-19-gui-web-client-architecture.md) — how browser plugin rows load and register slots.
+- [`dsh-api-job-controller`](../../api/job-controller/README.md) — the `job.list` and `job.follow` streams and the `ctx.jobs` service behind the rows and the panel.
+- [`dsh-jobs`](../../jobs/jobs/README.md) — the registry contract that owns the ring and projection semantics.
+- [`dsh-client-ui-primitives`](../ui-primitives/README.md) — the `TerminalBlock` surface the panel configures.
 
 -----
 
 <a id="model-experience"></a>
 ## Model Experience
 
-None, as this package renders host-computed registry state for a human and touches no prompt, message, schema, stream, or tool result.
+None, as this package renders host-observed state and live output for a human and touches no prompt, message, schema, stream, or tool result. The model's own view of the same work stays with [`dsh-tool-jobs`](../../jobs/tool-jobs/README.md).
 
 #### KV Cache effect
 
@@ -70,11 +77,10 @@ None; the package never assembles or sends provider requests.
 
 <a id="known-limitations-and-deferred-work"></a>
 
+These limits define current package constraints, not a task backlog.
 
-These limits define the current job list. They are current package constraints, not a general job-management comparison or a task backlog.
-
-- **Rows are read-only** — a job's streamed output and a human-initiated cancellation are separate phases. Cancellation additionally owes a model-facing decision the seam does not answer: `kill()` marks terminal delivery reported, so an interrupt written against the current contract would leave the model believing its job is still running.
-- **The list is not the registry's own set** — it shows what one session can see through the wire view, so a job owned by another session never appears here, and a process restart empties the list while the transcript keeps the `run_in_background` cards that started those jobs. An unowned job (one started without a live `Agent`) reaches every session's list, matching what `list(caller)` reports to every caller.
+- **No kill control** — cancellation stays with the model's `job_kill`.
+- **Channel labels are not rendered** — stdout and stderr chunks concatenate into one stream; per-channel tinting is a presentation follow-up.
 
 <a id="dev-note"></a>
 ### Dev Note
@@ -86,4 +92,4 @@ None.
 
 </details>
 
-**Runtime invariant:** No companion is published. This package is a read-only projection of the `jobsBySession` mirror onto one header slot entry. It emits no Cordis events, owns no cross-plugin mutable state, and its single slot registration proves disposal through the HMR-safety spec.
+**Runtime invariant:** No companion is published. This package is a read-only projection of the `ctx.jobs` rosters and views onto one header slot entry. It emits no Cordis events, owns no cross-plugin mutable state, and its single slot registration proves disposal through the HMR-safety spec.
diff --git a/packages/client/ui-jobs/README.zh.md b/packages/client/ui-jobs/README.zh.md
index ef7ac07710..871948194d 100644
--- a/packages/client/ui-jobs/README.zh.md
+++ b/packages/client/ui-jobs/README.zh.md
@@ -1,5 +1,5 @@
 ---
-description: "Web 后台任务界面：列出本会话可见任务的会话头部动作；供后台任务体验的用户与维护者阅读。"
+description: "会话头部后台任务列表：可展开的流式输出面板、进行中/已结束分组，以及无保留输出的已结束任务的静态行。"
 kind: "package-reference"
 ---
 
@@ -9,7 +9,7 @@ kind: "package-reference"
 
 ## 概述
 
-本包渲染 Web GUI 的后台任务界面：一个会话头部动作，打开后以弹层列出本会话可见的任务。它经运行时提供的 `jobsBySession` 镜像读取宿主计算的注册表状态，自身不发任何 RPC。触发器只在会话至少有一个任务时出现，角标计数运行中与停止中的任务；终态行保持可见并弱化，直到注册表把它们丢弃。模型对同一批任务的视角属于 `dsh-tool-jobs`；本包是给人类看的只读投影。
+`dsh-client-ui-jobs` 在一个头部控件中展示本会话的后台任务，包括生命周期、耗时、进度与终态详情。进行中的任务和保留了输出的已结束任务提供可展开的输出面板；收起即停流。进行中的行以持续更新的时长为主行，随后展示类型与状态。已结束的行折叠在分组标题下；没有保留输出的任务保持静态，包括回答已交给模型的 subagent。
 
 ## 目录
 
@@ -25,11 +25,15 @@ kind: "package-reference"
 <a id="use-this-package"></a>
 ## 使用本包
 
-与运行时一起挂载本插件；只要会话至少有一个任务，任务动作就会出现在会话头部。点击打开弹层：活跃行在前按开始时间升序，随后终态行按结束时间降序，每行显示生产者 kind、标签、状态，以及一个活跃时每秒跳动、完成后冻结的已耗时。
+通过 web-app 清单加载本插件；在会话看得到至少一个 job 之前它不渲染任何东西，因此普通对话不会为未使用的能力长出控件。
 
-### 关闭与边界
+### 一 job 一行
 
-Escape 关闭列表并把焦点交还触发器，在其外部按下指针同理。列表展示的是「一个会话通过协议视图能看到什么」，因此别的会话拥有的任务在这里永不出现；进程重启会清空列表，而 transcript（文本记录）里启动这些任务的 `run_in_background` 卡片仍在。
+`ctx.jobs` 镜像的 `job.list` 流是唯一名册：每个 `JobView` 行携带生命周期、时长、实时 `progress` 行或终态 `detail`，以及其保留字节数——进行中的 job，或留有保留输出的已结束 job，就是行可展开的依据。不存在需要 join 的第二份名册。
+
+### 展开的面板
+
+展开可观察的行会从 `ctx.jobs`（由 `dsh-api-job-controller` 安装）打开该 job 的输出观测流，注入内嵌终端面板。面板复制的是命令（不是输出），命令与输出行完整换行，输出在固定高度内滚动而非折叠，且不绘制自己的运行状态点——上方的行承载状态。保留缺口与流中断在面板上方渲染为提示。
 
 -----
 
@@ -37,9 +41,15 @@ Escape 关闭列表并把焦点交还触发器，在其外部按下指针同理
 ## 理解实现
 
 <details>
-<summary>实现细节——点击展开</summary>
+<summary>实现内幕——点击展开</summary>
 
-本包向 `conversation.session.header.actions` 贡献一个条目（`JobListAction`），数据完全来自会话控制器绑定从 `session/jobs` 帧折叠出的 `jobsBySession` 列表镜像——不发 RPC，除弹层开合外不持有任何状态。角标计数 `running` 加 `stopping`，为零时省略。行序为活跃行在前按 `startedAt` 升序、终态行按 `finishedAt` 降序，毫秒并列按启动顺序打破；缺少 `finishedAt` 的终态行读作零而不是负数，超过一小时的耗时停留在小时单位。终态行保持可见，因为失败任务的 `detail` 是其失败唯一可读之处。行为由 [Web 后台任务展示 Agent Note](../../../.agents/notes/implemented/feature/2026-08-08-web-background-job-display.zh.md) 规定。
+头部操作带里的一个 slot 条目（preset 标签之后、subagent 目录之前）渲染触发器与弹出层；弹出层通过测量锚点把自己收进视口。所有数据经 `ctx.jobs` 到达——组件不持有任何传输状态。名册跟随挂载：一个 `useEffect` 在控件存活期间保持会话的 `job.list` 流打开。观测跟随可见性：另一个 `useEffect` 为展开行的 job 打开流，并在收起、卸载或弹出层关闭时关闭它。
+
+| 文件 | 角色 |
+|---|---|
+| [`src/client/JobListAction.tsx`](src/client/JobListAction.tsx) | 任务列表：分组、时长、面板 |
+| [`src/client/index.ts`](src/client/index.ts) | slot 注册与词典 |
+| [`src/client/locales.ts`](src/client/locales.ts) | `job` 命名空间文案（zh 为事实源） |
 
 </details>
 
@@ -48,42 +58,38 @@ Escape 关闭列表并把焦点交还触发器，在其外部按下指针同理
 <a id="further-exploration"></a>
 ## 进一步探索
 
-当任务界面本身无法满足需要时，请阅读以下页面。它们从浏览器列表进入注册表与面向模型的工具。
-
-- [dsh-tool-jobs](../../jobs/tool-jobs/README.zh.md)——同一注册表之上的面向模型任务工具。
-- [会话控制器](../../api/session-controller/README.zh.md)——折叠出本包读取的 `jobsBySession` 镜像。
-- [ui-subagent](../ui-subagent/README.zh.md)——subagent 目录，运行中的一次性后台 subagent 也会出现在那里。
-- [Web 客户端架构](../../../.agents/notes/implemented/architecture/2026-07-19-gui-web-client-architecture.zh.md)——浏览器插件行如何加载并注册 slot。
+- [`dsh-api-job-controller`](../../api/job-controller/README.zh.md) —— 行与面板背后的 `job.list`、`job.follow` 流与 `ctx.jobs` 服务。
+- [`dsh-jobs`](../../jobs/jobs/README.zh.md) —— 拥有环与投影语义的注册表契约。
+- [`dsh-client-ui-primitives`](../ui-primitives/README.zh.md) —— 面板所配置的 `TerminalBlock` 表面。
 
 -----
 
 <a id="model-experience"></a>
 ## 模型体验
 
-无，因为本包为人类渲染宿主计算出的注册表状态，不触及提示词、消息、schema、流或工具结果。
+无。本包为人类渲染宿主观测到的状态与实时输出，不触碰任何提示词、消息、schema、流或工具结果。模型对同一工作的视图仍在 [`dsh-tool-jobs`](../../jobs/tool-jobs/README.zh.md)。
 
-#### KV Cache 影响
+#### KV 缓存影响
 
-无；本包从不组装或发送提供方请求。
+无；本包从不组装或发送 provider 请求。
 
 ## 已知限制与延期工作
 
 <a id="known-limitations-and-deferred-work"></a>
 
+这些限制界定当前包约束，不是任务清单。
 
-这些限制界定了当前任务列表。它们是当前包约束，不是通用任务管理对比或任务积压。
-
-- **行是只读的**——任务的流式输出与人类发起的取消是各自独立的阶段。取消还额外欠一个 seam 没有回答的、面向模型的决策：`kill()` 会把终态投递标为已上报，所以照当前契约写出来的中断会让模型一直以为它的任务还在跑。
-- **列表不等于注册表自己的集合**——它展示的是一个会话通过协议视图能看到什么，因此别的会话拥有的任务在这里永不出现；进程重启会清空列表，而 transcript 里启动这些任务的 `run_in_background` 卡片仍在。无主任务（没有活体 `Agent` 时启动的）反过来会进入每个会话的列表，与 `list(caller)` 对每个调用方的报告一致。
+- **没有 kill 控件**——取消仍归模型的 `job_kill`。
+- **不渲染 channel 标签**——stdout 与 stderr 块拼接为一条流；按 channel 着色是展示层的后续工作。
 
 <a id="dev-note"></a>
 ### 开发备注
 
 <details>
-<summary>维护者的工作上下文——点击展开</summary>
+<summary>维护者工作语境——点击展开</summary>
 
 无。
 
 </details>
 
-**运行时不变式：** 不发布伴生入口。本包只是将 `jobsBySession` 镜像以只读方式投影为一个会话头部 slot 条目，不发出 Cordis 事件，也不持有跨插件可变状态；其唯一的 slot 注册通过 HMR（热模块替换）安全性规范验证了资源释放行为。
+**运行时不变式：** 不发布伴生入口。本包只把 `ctx.jobs` 的名册与视图只读投影到一个 header slot，不发出 Cordis 事件，也不持有跨插件可变状态；其唯一的 slot 注册通过 HMR（热模块替换）安全性规范验证了资源释放行为。
diff --git a/packages/client/ui-jobs/package.json b/packages/client/ui-jobs/package.json
index e98eca744b..4a5d68d808 100644
--- a/packages/client/ui-jobs/package.json
+++ b/packages/client/ui-jobs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@deepseek-ai/dsh-client-ui-jobs",
-  "description": "Session-header background-job list: live registry state mirrored from session/jobs frames",
+  "description": "Session-header background-job list with on-demand streaming record panels",
   "version": "0.1.6-alpha.2",
   "type": "module",
   "main": "lib/index.js",
@@ -17,16 +17,6 @@
     "./src/*": "./src/*",
     "./package.json": "./package.json"
   },
-  "dsh": {
-    "client": {
-      "inject": [
-        "@deepseek-ai/dsh-client-locale",
-        "@deepseek-ai/dsh-client-ui-conversation",
-        "@deepseek-ai/dsh-client-ui-primitives"
-      ],
-      "platform": "web"
-    }
-  },
   "scripts": {
     "bundle": "tsdown",
     "watch": "tsdown --watch"
@@ -44,21 +34,33 @@
     "@deepseek-ai/cordis": "workspace:^"
   },
   "devDependencies": {
+    "@deepseek-ai/cordis": "workspace:^",
+    "@deepseek-ai/dsh-api-job-controller": "workspace:^",
     "@deepseek-ai/dsh-client-locale": "workspace:^",
     "@deepseek-ai/dsh-client-test-runtime": "workspace:^",
     "@deepseek-ai/dsh-client-ui-conversation": "workspace:^",
     "@deepseek-ai/dsh-client-ui-primitives": "workspace:^",
-    "@deepseek-ai/dsh-client-ui-slots": "workspace:^",
-    "@types/react": "~18.3.1",
-    "@deepseek-ai/cordis": "workspace:^",
-    "react": "^18.2.0",
-    "@deepseek-ai/dsh-api-session-controller": "workspace:^",
     "@deepseek-ai/dsh-client-ui-renderer": "workspace:^",
-    "@deepseek-ai/dsh-client-ui-session": "workspace:^"
+    "@deepseek-ai/dsh-client-ui-session": "workspace:^",
+    "@deepseek-ai/dsh-client-ui-slots": "workspace:^",
+    "@deepseek-ai/dsh-session": "workspace:^",
+    "@types/react": "~18.3.1",
+    "react": "^18.2.0"
   },
   "files": [
     "lib/index.js",
     "lib/client.js",
     "lib/types/**/*.d.ts"
-  ]
+  ],
+  "dsh": {
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-api-job-controller",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-conversation",
+        "@deepseek-ai/dsh-client-ui-primitives"
+      ],
+      "platform": "web"
+    }
+  }
 }
diff --git a/packages/client/ui-jobs/src/client/JobListAction.module.css b/packages/client/ui-jobs/src/client/JobListAction.module.css
index 06a78a4492..8d0cc4440c 100644
--- a/packages/client/ui-jobs/src/client/JobListAction.module.css
+++ b/packages/client/ui-jobs/src/client/JobListAction.module.css
@@ -47,9 +47,9 @@
   display: flex;
   flex-direction: column;
   gap: 1px;
-  width: 336px;
-  max-width: min(400px, calc(100vw - 32px));
-  max-height: min(420px, calc(100vh - 140px));
+  width: 440px;
+  max-width: min(520px, calc(100vw - 32px));
+  max-height: min(480px, calc(100vh - 140px));
   margin: 0;
   padding: 3px;
   overflow: auto;
@@ -64,6 +64,27 @@
   box-shadow: var(--dsw-elevation-prominent);
 }
 
+/* Section labels over the live rows and the settled tail. */
+.sectionHeader {
+  margin: 4px 4px 1px;
+  padding: 4px 4px 3px;
+  border-top: 0.5px solid var(--dsw-alias-border-l1);
+  color: var(--dsw-alias-label-tertiary);
+  font-size: 11px;
+  line-height: 16px;
+}
+
+/* The leading section needs no divider above it. */
+.sectionHeader:first-child {
+  margin-top: 0;
+  border-top: 0;
+}
+
+.item {
+  display: flex;
+  flex-direction: column;
+}
+
 .row {
   display: flex;
   align-items: center;
@@ -72,20 +93,61 @@
   width: 100%;
   min-height: 28px;
   padding: 4px 7px;
+  border: 0;
   border-radius: 7px;
+  background: transparent;
   color: var(--dsw-alias-label-primary);
   font-size: 12px;
   line-height: 17px;
+  text-align: left;
+  cursor: pointer;
+}
+
+.row:hover,
+.row:focus-visible {
+  background: var(--dsw-alias-fill-l1);
+}
+
+/* A row with no observable output offers no interaction. */
+.rowStatic {
+  cursor: default;
+}
+
+.rowStatic:hover {
+  background: transparent;
 }
 
 .rowSettled {
   color: var(--dsw-alias-label-tertiary);
 }
 
-.rowDot {
+/* Live rows align the dot with the first text line, not the row center. */
+.row .rowDot {
   flex: none;
 }
 
+.main {
+  display: flex;
+  flex: 1;
+  flex-direction: column;
+  gap: 2px;
+  min-width: 0;
+}
+
+.primary {
+  display: flex;
+  align-items: baseline;
+  gap: 8px;
+  min-width: 0;
+}
+
+.secondary {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  min-width: 0;
+}
+
 .kind {
   flex: none;
   padding: 0 5px;
@@ -105,23 +167,61 @@
   text-overflow: ellipsis;
 }
 
-.status,
-.duration {
+/* A failed task's detail is the producer's raw text, so it has no bound;
+   without this it widens the row past the menu instead of eliding like .label. */
+.status {
   flex: none;
+  max-width: 60%;
+  overflow: hidden;
   color: var(--dsw-alias-label-tertiary);
   font-size: 10px;
   line-height: 16px;
-}
-
-/* A failed job's detail is the producer's raw error text, so it has no bound;
-   without this it widens the row past the menu instead of eliding like .label. */
-.status {
-  max-width: 40%;
-  overflow: hidden;
   white-space: nowrap;
   text-overflow: ellipsis;
 }
 
 .duration {
+  flex: none;
+  color: var(--dsw-alias-label-tertiary);
+  font-size: 11px;
+  line-height: 18px;
   font-variant-numeric: tabular-nums;
 }
+
+.chevron {
+  flex: none;
+  color: var(--dsw-alias-label-tertiary);
+}
+
+.chevronOpen {
+  transform: rotate(180deg);
+}
+
+.panel {
+  margin: 0 8px 8px;
+  /* Long commands and output lines wrap in full instead of ellipsizing or
+     scrolling sideways, and the output region scrolls within a fixed height
+     instead of folding its middle lines. */
+  --dsl-terminal-command-whitespace: pre-wrap;
+  --dsl-terminal-line-whitespace: pre-wrap;
+  --dsl-terminal-output-max-height: 288px;
+}
+
+/* The row carries the state dot, so the panel omits its own and reclaims the
+   dot gutter down to an ordinary content inset. The override targets the card
+   element itself because the gutter variable is declared on it — a value
+   inherited from this container would lose to that declaration. */
+.panel :global([data-terminal]) {
+  --dsl-terminal-gutter: 12px;
+}
+
+.notice {
+  margin: 0 8px 6px;
+  color: var(--dsw-alias-label-tertiary);
+  font-size: 11px;
+  line-height: 16px;
+}
+
+.noticeError {
+  color: var(--dsw-alias-label-error, var(--dsw-alias-label-secondary));
+}
diff --git a/packages/client/ui-jobs/src/client/JobListAction.tsx b/packages/client/ui-jobs/src/client/JobListAction.tsx
index 7853ec4e2c..95b35d8f53 100644
--- a/packages/client/ui-jobs/src/client/JobListAction.tsx
+++ b/packages/client/ui-jobs/src/client/JobListAction.tsx
@@ -1,23 +1,66 @@
-import { useEffect, useMemo, useRef, useState, type KeyboardEvent } from 'react'
-import type { SessionJob as JobView } from '@deepseek-ai/dsh-api-session-controller/types'
-import { IconChevronDownOutlineRegular, StateDot, useDismissOnOutsidePointer, type StateDotState } from '@deepseek-ai/dsh-client-ui-primitives'
-import type { PropsLocale, PropsRuntime, TranslateNS } from '@deepseek-ai/dsh-client-ui-slots'
+import { useEffect, useLayoutEffect, useMemo, useRef, useState, type KeyboardEvent } from 'react'
+import type { JobsSnapshot, JobView, ObservedJob } from '@deepseek-ai/dsh-api-job-controller/client'
+import type { SessionId } from '@deepseek-ai/dsh-session/types'
+import {
+  IconChevronDownOutlineRegular, StateDot, TerminalBlock, useDismissOnOutsidePointer,
+  type StateDotState, type TerminalBlockLabels,
+} from '@deepseek-ai/dsh-client-ui-primitives'
+import type { InjectFace, PropsLocale, PropsRuntime, TranslateNS } from '@deepseek-ai/dsh-client-ui-slots'
 import { NS } from './locales.ts'
 import type {} from '@deepseek-ai/dsh-client-ui-conversation/client'
 import css from './JobListAction.module.css'
 
-/** Full props for the session-header background-job action. */
+/** Registration-side business face for the job list. */
+export interface JobListInjected {
+  hooks: {
+    /** Client jobs snapshot (rosters and observations) bound by the renderer as useJobs. */
+    jobs: {
+      getSnapshot(): JobsSnapshot
+      subscribe(listener: () => void): () => void
+    }
+  }
+  /**
+   * Keep one session's roster current while the list is mounted; returns the
+   * stop function. Reference-counted by the client service.
+   */
+  watchRows: (sessionId: SessionId) => () => void
+  /**
+   * Start observing one job's live output; returns the stop function.
+   * Reference-counted by the client service, so panels can overlap safely.
+   */
+  observe: (sessionId: SessionId | undefined, id: JobView['id']) => () => void
+}
+
+/** Full props for the session-header job-list action. */
 export type JobListActionProps =
-  PropsRuntime<'conversation.session.header.actions'> & PropsLocale<typeof NS>
+  PropsRuntime<'conversation.session.header.actions'>
+  & PropsLocale<typeof NS>
+  & InjectFace<JobListInjected>
 
 /** Stable empty list so a session with no jobs keeps one array identity. */
-const NO_TASKS: readonly JobView[] = []
+const NO_JOBS: readonly JobView[] = []
+
+/** Minimum gap kept between the popover and the viewport edges (the Menu primitive's portal margin). */
+const VIEWPORT_MARGIN = 12
+
 
-/** A job the registry still holds open, and whose duration therefore ticks. */
 function isLive(job: JobView): boolean {
   return job.status === 'running' || job.status === 'stopping'
 }
 
+/**
+ * Whether the row offers an output panel: every live job (its output may
+ * still arrive) and a settled one that left retained output behind.
+ */
+function isObservable(job: JobView): boolean {
+  return isLive(job) || job.output.total > 0
+}
+
+/** The one-line qualifier beside the status: live progress while running, the terminal reason once settled. */
+function jobDetail(job: JobView): string | undefined {
+  return job.progress ?? job.detail
+}
+
 /** Closed-union exhaustiveness fence for the wire status set. */
 /* v8 ignore next 3 -- closed-union backstop; only reached if a status is forged */
 function assertNever(value: never): never {
@@ -40,7 +83,6 @@ function dotState(status: JobView['status']): StateDotState {
   }
 }
 
-/** Human status word for the row and its accessible name. */
 function statusLabel(status: JobView['status'], t: TranslateNS<typeof NS>): string {
   switch (status) {
     case 'running': return t('status.running')
@@ -54,9 +96,9 @@ function statusLabel(status: JobView['status'], t: TranslateNS<typeof NS>): stri
 }
 
 /**
- * Elapsed time in at most two adjacent units. A background job that outlives
- * an hour is already exceptional, so hours is the widest unit — beyond that the
- * figure stays in hours rather than growing a day/month vocabulary no producer
+ * Elapsed time in at most two adjacent units. A job that outlives an hour is
+ * already exceptional, so hours is the widest unit — beyond that the figure
+ * stays in hours rather than growing a day/month vocabulary no producer
  * currently reaches.
  */
 function formatDuration(elapsedMs: number, t: TranslateNS<typeof NS>): string {
@@ -69,8 +111,35 @@ function formatDuration(elapsedMs: number, t: TranslateNS<typeof NS>): string {
   return t('duration.seconds', { seconds })
 }
 
+/** Localized display copy for the embedded terminal panel. */
+function terminalLabels(t: TranslateNS<typeof NS>): TerminalBlockLabels {
+  return {
+    // The labels contract requires exit-fact formatters, but this panel never
+    // passes exit facts, so TerminalBlock never invokes them.
+    /* v8 ignore next */
+    signal: signal => t('terminal.signal', { signal }),
+    /* v8 ignore next */
+    exitCode: code => t('terminal.exitCode', { code }),
+    noExitCode: t('terminal.noExitCode'),
+    running: t('terminal.running'),
+    failed: t('terminal.failed'),
+    done: t('terminal.done'),
+    copy: t('terminal.copy'),
+    copied: t('terminal.copied'),
+    noOutput: t('terminal.noOutput'),
+    collapseAria: t('terminal.collapseAria'),
+    collapse: t('terminal.collapse'),
+    // The panel never caps lines (it scrolls), so the fold controls that
+    // would invoke these stay unrendered.
+    /* v8 ignore next */
+    expandAria: hidden => t('terminal.expandAria', { n: hidden }),
+    /* v8 ignore next */
+    expand: hidden => t('terminal.expand', { n: hidden }),
+  }
+}
+
 /**
- * Live rows first in start order, then settled rows newest-first. Two jobs
+ * Live rows first in start order, then settled rows newest-first. Two rows
  * that settled in the same millisecond fall back to start order, so the sort
  * never depends on the host's map iteration.
  */
@@ -84,45 +153,202 @@ function ordered(jobs: readonly JobView[]): JobView[] {
   })
 }
 
+/** One job row plus, when observable and expanded, its live output panel. */
+function JobItem({ job, view, expanded, now, onToggle, t }: {
+  job: JobView
+  view: ObservedJob | undefined
+  expanded: boolean
+  /** Clock sample live rows derive their running duration from. */
+  now: number
+  onToggle: () => void
+  t: TranslateNS<typeof NS>
+}) {
+  const live = isLive(job)
+  const status = statusLabel(job.status, t)
+  const detail = jobDetail(job)
+  const observable = isObservable(job)
+  const labels = useMemo(() => terminalLabels(t), [t])
+  const elapsed = live ? now - job.startedAt : (job.finishedAt ?? job.startedAt) - job.startedAt
+  const duration = formatDuration(elapsed, t)
+  const durationCell = (
+    <span
+      className={css.duration}
+      title={t(live ? 'duration.title.live' : 'duration.title.done', { duration })}
+    >
+      {duration}
+    </span>
+  )
+  const body = live
+    ? (
+      <>
+        <StateDot state={dotState(job.status)} className={css.rowDot} />
+        <span className={css.main}>
+          <span className={css.primary}>
+            <span className={css.label} title={job.label}>{job.label}</span>
+            {durationCell}
+          </span>
+          <span className={css.secondary}>
+            <span className={css.kind}>{job.kind}</span>
+            <span className={css.status} title={detail ?? status}>{detail ?? status}</span>
+          </span>
+        </span>
+        {/* A live row is always observable: its output may still arrive. */}
+        <IconChevronDownOutlineRegular size={14} className={expanded ? `${css.chevron} ${css.chevronOpen}` : css.chevron} />
+      </>
+    )
+    : (
+      <>
+        <StateDot state={dotState(job.status)} className={css.rowDot} />
+        <span className={css.kind}>{job.kind}</span>
+        <span className={css.label} title={job.label}>{job.label}</span>
+        <span className={css.status} title={detail ?? status}>{detail ?? status}</span>
+        {durationCell}
+        {observable ? <IconChevronDownOutlineRegular size={14} className={expanded ? `${css.chevron} ${css.chevronOpen}` : css.chevron} /> : null}
+      </>
+    )
+  return (
+    <li className={css.item}>
+      {observable
+        ? (
+          <button
+            type="button"
+            className={live ? css.row : `${css.row} ${css.rowSettled}`}
+            aria-expanded={expanded}
+            aria-label={t(expanded ? 'row.collapseAria' : 'row.expandAria', { label: job.label })}
+            onClick={onToggle}
+          >
+            {body}
+          </button>
+        )
+        : (
+          <span className={`${css.row} ${css.rowSettled} ${css.rowStatic}`}>
+            {body}
+          </span>
+        )}
+      {expanded && view !== undefined
+        ? (
+          <div className={css.panel}>
+            {view.gapBefore ? <div className={css.notice}>{t('output.gap')}</div> : null}
+            {view.error !== undefined
+              ? <div className={`${css.notice} ${css.noticeError}`}>{t('output.error', { error: view.error })}</div>
+              : null}
+            <TerminalBlock
+              command={job.label}
+              output={view.text}
+              running={live}
+              copyText={job.label}
+              // The row above the panel already carries the state dot.
+              runStateDot={false}
+              // The panel scrolls its output (a stylesheet height cap) instead
+              // of collapsing the middle.
+              maxLines={Number.POSITIVE_INFINITY}
+              labels={labels}
+            />
+          </div>
+        )
+        : null}
+    </li>
+  )
+}
+
 /**
- * Session-header entry point for this session's background jobs. It renders
- * nothing at all until the session has at least one job, so an ordinary
- * conversation never grows a control for a capability it is not using.
- * @param props - runtime slot currency plus the namespace translator.
+ * Session-header entry point for this session's background jobs. Mounting it
+ * keeps the session's roster stream open; it renders nothing at all until the
+ * session can see at least one job. Expanding an observable row (a live job,
+ * or a settled one with retained output) starts its observation stream, and
+ * collapsing (or closing the popover) stops it — output only flows while
+ * someone is watching.
+ * @param props - runtime slot currency, the jobs snapshot hook, the roster
+ *   and observation controls, and the namespace translator.
  * @returns the trigger and its popover list, or null when there is nothing to show.
  */
-export function JobListAction({ sessionId, useSessions, t }: JobListActionProps) {
-  const jobs = useSessions(state => state.jobsBySession[sessionId]) ?? NO_TASKS
+export function JobListAction({ sessionId, useJobs, watchRows, observe, t }: JobListActionProps) {
+  const jobs = useJobs(state => state.rows[sessionId]) ?? NO_JOBS
+  const observedViews = useJobs(state => state.observed)
   const [open, setOpen] = useState(false)
+  const [expandedKey, setExpandedKey] = useState<string | undefined>(undefined)
   const [now, setNow] = useState(() => Date.now())
   const rootRef = useRef<HTMLDivElement>(null)
   const triggerRef = useRef<HTMLButtonElement>(null)
+  const menuRef = useRef<HTMLUListElement>(null)
+  // Horizontal shift applied to the trigger-anchored popover so it stays
+  // inside the viewport (the stylesheet alone cannot see the anchor offset).
+  const [menuShift, setMenuShift] = useState(0)
 
   const rows = useMemo(() => ordered(jobs), [jobs])
-  const liveCount = useMemo(() => jobs.filter(isLive).length, [jobs])
+  const liveRows = useMemo(() => rows.filter(isLive), [rows])
+  const settledRows = useMemo(() => rows.filter(job => !isLive(job)), [rows])
 
   useDismissOnOutsidePointer(rootRef, open, setOpen)
 
+  // The roster follows the mounted session: one stream while this control
+  // lives, released with it.
+  useEffect(() => watchRows(sessionId), [sessionId, watchRows])
+
   // The clock only runs while an open list is showing something that moves.
   useEffect(() => {
-    if (!open || liveCount === 0) return
+    if (!open || liveRows.length === 0) return
     setNow(Date.now())
     const timer = setInterval(() => { setNow(Date.now()) }, 1_000)
     return () => { clearInterval(timer) }
-  }, [open, liveCount])
+  }, [open, liveRows.length])
 
-  // The last job disappearing removes this control; close first so focus does
-  // not vanish from an unmounting node.
+  // Fit the open popover to the viewport: shift left when the anchored width
+  // would cross the right edge, never past the left margin.
+  useLayoutEffect(() => {
+    if (!open) {
+      setMenuShift(0)
+      return
+    }
+    const fit = (): void => {
+      const root = rootRef.current
+      const menu = menuRef.current
+      /* v8 ignore next -- both refs are attached while the open popover renders. */
+      if (root === null || menu === null) return
+      const width = menu.offsetWidth
+      // Unlaid-out nodes (and jsdom) measure 0: keep the pure CSS anchor.
+      if (width === 0) return
+      const anchorLeft = root.getBoundingClientRect().left
+      setMenuShift(Math.max(
+        VIEWPORT_MARGIN - anchorLeft,
+        Math.min(0, window.innerWidth - VIEWPORT_MARGIN - width - anchorLeft),
+      ))
+    }
+    fit()
+    window.addEventListener('resize', fit)
+    return () => { window.removeEventListener('resize', fit) }
+  }, [open])
+
+  // Observation follows visibility: the stream opens when an observable panel
+  // expands and closes when it collapses, unmounts, or the popover closes.
+  const expandedRow = open && expandedKey !== undefined
+    ? rows.find(job => String(job.id) === expandedKey)
+    : undefined
+  const activeJob = expandedRow !== undefined && isObservable(expandedRow) ? expandedRow.id : undefined
   useEffect(() => {
-    if (jobs.length === 0 && open) setOpen(false)
-  }, [jobs.length, open])
+    if (activeJob === undefined) return
+    return observe(sessionId, activeJob)
+  }, [sessionId, activeJob, observe])
 
-  if (jobs.length === 0) return null
+  // The last job disappearing removes this control; close first so focus
+  // does not vanish from an unmounting node.
+  useEffect(() => {
+    if (rows.length === 0 && open) setOpen(false)
+  }, [rows.length, open])
 
-  const countKey = liveCount > 0
-    ? (liveCount === 1 ? 'count.live.one' : 'count.live.other')
-    : (jobs.length === 1 ? 'count.idle.one' : 'count.idle.other')
-  const countLabel = t(countKey, { count: liveCount > 0 ? liveCount : jobs.length })
+  // An expanded row that left the list (owner disposal) folds its panel.
+  useEffect(() => {
+    if (expandedKey !== undefined && !rows.some(job => String(job.id) === expandedKey)) {
+      setExpandedKey(undefined)
+    }
+  }, [rows, expandedKey])
+
+  if (rows.length === 0) return null
+
+  const countKey = liveRows.length > 0
+    ? (liveRows.length === 1 ? 'count.live.one' : 'count.live.other')
+    : (rows.length === 1 ? 'count.idle.one' : 'count.idle.other')
+  const countLabel = t(countKey, { count: liveRows.length > 0 ? liveRows.length : rows.length })
 
   const onKeyDown = (event: KeyboardEvent<HTMLDivElement>): void => {
     if (event.key !== 'Escape' || !open) return
@@ -131,6 +357,20 @@ export function JobListAction({ sessionId, useSessions, t }: JobListActionProps)
     triggerRef.current?.focus()
   }
 
+  const item = (job: JobView) => (
+    <JobItem
+      key={String(job.id)}
+      job={job}
+      view={isObservable(job) ? observedViews[String(job.id)] : undefined}
+      expanded={expandedKey === String(job.id)}
+      now={now}
+      onToggle={() => {
+        setExpandedKey(current => current === String(job.id) ? undefined : String(job.id))
+      }}
+      t={t}
+    />
+  )
+
   return (
     <div ref={rootRef} className={css.root} onKeyDown={onKeyDown}>
       <button
@@ -148,33 +388,21 @@ export function JobListAction({ sessionId, useSessions, t }: JobListActionProps)
           setOpen(current => !current)
         }}
       >
-        {liveCount > 0 ? <StateDot state="ongoing" className={css.triggerDot} /> : null}
+        {liveRows.length > 0 ? <StateDot state="ongoing" className={css.triggerDot} /> : null}
         <span className={css.count}>{countLabel}</span>
         <IconChevronDownOutlineRegular size={12} className={open ? css.triggerOpen : undefined} />
       </button>
       {open
         ? (
-          <ul className={css.menu} aria-label={t('list.aria')}>
-            {rows.map((job) => {
-              const live = isLive(job)
-              const elapsed = live ? now - job.startedAt : (job.finishedAt ?? job.startedAt) - job.startedAt
-              const duration = formatDuration(elapsed, t)
-              const status = statusLabel(job.status, t)
-              return (
-                <li key={job.id} className={live ? css.row : `${css.row} ${css.rowSettled}`}>
-                  <StateDot state={dotState(job.status)} className={css.rowDot} />
-                  <span className={css.kind}>{job.kind}</span>
-                  <span className={css.label} title={job.label}>{job.label}</span>
-                  <span className={css.status} title={job.detail ?? status}>{job.detail ?? status}</span>
-                  <span
-                    className={css.duration}
-                    title={t(live ? 'duration.title.live' : 'duration.title.done', { duration })}
-                  >
-                    {duration}
-                  </span>
-                </li>
-              )
-            })}
+          <ul ref={menuRef} className={css.menu} style={{ left: menuShift }} aria-label={t('list.aria')}>
+            {liveRows.length > 0
+              ? <li className={css.sectionHeader} aria-hidden="true">{t('section.live')}</li>
+              : null}
+            {liveRows.map(item)}
+            {settledRows.length > 0
+              ? <li className={css.sectionHeader} aria-hidden="true">{t('section.settled')}</li>
+              : null}
+            {settledRows.map(item)}
           </ul>
         )
         : null}
diff --git a/packages/client/ui-jobs/src/client/index.ts b/packages/client/ui-jobs/src/client/index.ts
index 22dc2c8425..4ee3c3b5de 100644
--- a/packages/client/ui-jobs/src/client/index.ts
+++ b/packages/client/ui-jobs/src/client/index.ts
@@ -1,11 +1,13 @@
 /**
  * Background-job plugin, browser half: contributes one session-header action
- * that renders this session's `ctx.jobs` records. The data arrives entirely
- * through the `jobsBySession` list mirror, so the plugin issues no RPC and
- * holds no state of its own beyond popover visibility.
+ * that renders this session's jobs. Job rows and per-row observation streams
+ * both arrive through the `jobs` client service; this plugin holds no
+ * transport state of its own.
  */
 import type { Context as ClientContext } from '@deepseek-ai/cordis'
 import { JobListAction } from './JobListAction.tsx'
+import type { JobListInjected } from './JobListAction.tsx'
+import type {} from '@deepseek-ai/dsh-api-job-controller/client'
 import type {} from '@deepseek-ai/dsh-client-locale/client'
 import type {} from '@deepseek-ai/dsh-client-ui-renderer/client'
 import type {} from '@deepseek-ai/dsh-client-ui-session/client'
@@ -18,25 +20,31 @@ declare module '@deepseek-ai/dsh-client-ui-slots' {
   }
 }
 
-export type { JobListActionProps } from './JobListAction.tsx'
+export type { JobListActionProps, JobListInjected } from './JobListAction.tsx'
 
-/** Required services for locale registration and header-slot contribution. */
-export const inject = ['sessions', 'slots', 'locale']
+/** Required services: the jobs rosters and observations, the slot registry, and dictionaries. */
+export const inject = ['jobs', 'slots', 'locale']
 
 /**
  * Client plugin body: register the dictionaries and the header action.
  * @param ctx - client root context.
  */
 export function apply(ctx: ClientContext): void {
-  ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'ui-job: dictionaries')
+  ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'ui-jobs: dictionaries')
   ctx.slots.inject(
     'conversation.session.header.actions',
     () => ctx.slots.register({
       name: 'conversation.session.header.actions',
       id: 'job-list',
-      // After the subagent catalog: session lineage reads before process work.
+      // Between the preset label and the subagent catalog (order 30): running
+      // work reads before the session lineage.
       order: 20,
       locale: NS,
+      inject: (): JobListInjected => ({
+        hooks: { jobs: ctx.jobs.state },
+        watchRows: sessionId => ctx.jobs.watchRows(sessionId),
+        observe: (sessionId, id) => ctx.jobs.observe(sessionId, id),
+      }),
     }, JobListAction),
   )
 }
diff --git a/packages/client/ui-jobs/src/client/locales.ts b/packages/client/ui-jobs/src/client/locales.ts
index 70bb2e9e0f..1dc263aa19 100644
--- a/packages/client/ui-jobs/src/client/locales.ts
+++ b/packages/client/ui-jobs/src/client/locales.ts
@@ -10,6 +10,10 @@ export const zh = {
   'count.idle.one': '{count} 个后台任务',
   'count.idle.other': '{count} 个后台任务',
   'list.aria': '后台任务',
+  'section.live': '进行中',
+  'section.settled': '已结束',
+  'row.expandAria': '展开 {label} 的实时输出',
+  'row.collapseAria': '收起 {label} 的实时输出',
   'status.running': '运行中',
   'status.stopping': '正在停止',
   'status.completed': '已完成',
@@ -20,6 +24,21 @@ export const zh = {
   'duration.hours': '{hours}小时{minutes}分',
   'duration.title.live': '已运行 {duration}',
   'duration.title.done': '耗时 {duration}',
+  'output.gap': '……较早的输出已丢弃……',
+  'output.error': '实时输出流中断：{error}',
+  'terminal.signal': '信号 {signal}',
+  'terminal.exitCode': '退出码 {code}',
+  'terminal.noExitCode': '未正常退出',
+  'terminal.running': '运行中',
+  'terminal.failed': '已失败',
+  'terminal.done': '已完成',
+  'terminal.copy': '复制',
+  'terminal.copied': '已复制',
+  'terminal.noOutput': '（无输出）',
+  'terminal.collapse': '收起',
+  'terminal.collapseAria': '收起输出',
+  'terminal.expand': '展开其余 {n} 行',
+  'terminal.expandAria': '展开被折叠的 {n} 行输出',
 } as const
 
 /** English dictionary, key-identical to the Chinese source of truth. */
@@ -29,6 +48,10 @@ export const en: Record<JobKey, string> = {
   'count.idle.one': '{count} background job',
   'count.idle.other': '{count} background jobs',
   'list.aria': 'Background jobs',
+  'section.live': 'Running',
+  'section.settled': 'Finished',
+  'row.expandAria': 'Show live output of {label}',
+  'row.collapseAria': 'Hide live output of {label}',
   'status.running': 'running',
   'status.stopping': 'stopping',
   'status.completed': 'completed',
@@ -39,6 +62,21 @@ export const en: Record<JobKey, string> = {
   'duration.hours': '{hours}h {minutes}m',
   'duration.title.live': 'Running for {duration}',
   'duration.title.done': 'Took {duration}',
+  'output.gap': '… earlier output dropped …',
+  'output.error': 'live output stream interrupted: {error}',
+  'terminal.signal': 'signal {signal}',
+  'terminal.exitCode': 'exit {code}',
+  'terminal.noExitCode': 'no exit code',
+  'terminal.running': 'running',
+  'terminal.failed': 'failed',
+  'terminal.done': 'done',
+  'terminal.copy': 'Copy',
+  'terminal.copied': 'Copied',
+  'terminal.noOutput': '(no output)',
+  'terminal.collapse': 'Collapse',
+  'terminal.collapseAria': 'Collapse output',
+  'terminal.expand': 'Show {n} more lines',
+  'terminal.expandAria': 'Expand {n} collapsed output lines',
 }
 
 /** Key domain of the `job` namespace (zh is the source of truth). */
diff --git a/packages/client/ui-jobs/src/css-modules.d.ts b/packages/client/ui-jobs/src/css-modules.d.ts
index bc5e482353..8811db1264 100644
--- a/packages/client/ui-jobs/src/css-modules.d.ts
+++ b/packages/client/ui-jobs/src/css-modules.d.ts
@@ -2,5 +2,3 @@ declare module '*.module.css' {
   const classes: Record<string, string>
   export default classes
 }
-
-declare module '*.css'
diff --git a/packages/client/ui-jobs/src/index.ts b/packages/client/ui-jobs/src/index.ts
index 94d45c3ba1..457e7eeb9c 100644
--- a/packages/client/ui-jobs/src/index.ts
+++ b/packages/client/ui-jobs/src/index.ts
@@ -1,9 +1,9 @@
 /**
- * Background-job list plugin, node half. Pure UI plugin: the empty apply
- * exists so the plugin appears in the host cordis.yml / Loader; the browser
- * half ships via exports["./client"], discovered through the package.json
- * dshClient declaration.
+ * Node half of the background-job list plugin. The browser half in
+ * `src/client/` owns every contribution; this entry exists so the package
+ * appears as an ordinary Loader row.
+ * @module @deepseek-ai/dsh-client-ui-jobs
  */
 
-/** Host plugin body — no host-side behavior for this source plugin. */
+/** Loader-visible no-op body; the browser half carries the feature. */
 export function apply(): void {}
diff --git a/packages/client/ui-jobs/tests/browser-plugin.client.spec.ts b/packages/client/ui-jobs/tests/browser-plugin.client.spec.ts
index ceee59fe1d..c78482198d 100644
--- a/packages/client/ui-jobs/tests/browser-plugin.client.spec.ts
+++ b/packages/client/ui-jobs/tests/browser-plugin.client.spec.ts
@@ -1,15 +1,18 @@
 /**
- * ui-job plugin halves: the browser entry's dictionary and header-slot
+ * ui-jobs plugin halves: the browser entry's dictionary and header-slot
  * registrations against the real SlotRegistry (with fiber teardown proving
  * removal — HMR safety), and the inert node entry.
  */
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
 import { Context } from '@deepseek-ai/cordis'
+import { JobId } from '@deepseek-ai/dsh-jobs/brand'
+import { SessionId } from '@deepseek-ai/dsh-session/types'
 import { describe, expect, it } from 'vitest'
 import { SlotRegistry } from '@deepseek-ai/dsh-client-ui-renderer/client'
 import { stubSettingsScope } from '@deepseek-ai/dsh-client-test-runtime'
 import { apply as applyLocale, inject as localeInject } from '@deepseek-ai/dsh-client-locale/client'
 import { apply, inject } from '../src/client/index.ts'
+import type { JobListInjected } from '../src/client/JobListAction.tsx'
 import { apply as applyNode } from '../src/index.ts'
 import { en, NS, zh } from '../src/client/locales.ts'
 
@@ -20,6 +23,11 @@ function headerEntryIds(ctx: Context): (string | undefined)[] {
     .map(entry => entry.options.id)
 }
 
+/** Observation requests handed to the stubbed jobs service. */
+const observed: [string | undefined, string][] = []
+/** Roster watches handed to the stubbed jobs service. */
+const watched: string[] = []
+
 /** Boot the browser half over a real slot tree that declares the header list. */
 async function bench(): Promise<{ ctx: Context; fiber: ReturnType<Context['plugin']> }> {
   const ctx = new Context()
@@ -30,7 +38,17 @@ async function bench(): Promise<{ ctx: Context; fiber: ReturnType<Context['plugi
       'conversation.session.header.actions': { kind: 'list', scope: 'session' },
     },
   } as never, () => null)
-  ctx.provide('sessions', {})
+  ctx.provide('jobs', {
+    state: { getSnapshot: () => ({ rows: {}, observed: {} }), subscribe: () => () => {} },
+    watchRows: (sessionId: string) => {
+      watched.push(sessionId)
+      return () => {}
+    },
+    observe: (sessionId: string | undefined, id: string) => {
+      observed.push([sessionId, id])
+      return () => {}
+    },
+  } as never)
   // The locale plugin binds a settings scope, which reads the connection handle
   // and the forwarded-event port.
   ctx.provide('connection', { api: { settings: {} }, isLoopback: false } as never)
@@ -46,9 +64,26 @@ async function bench(): Promise<{ ctx: Context; fiber: ReturnType<Context['plugi
   return { ctx, fiber }
 }
 
-describe('ui-job browser half', () => {
+describe('ui-jobs browser half', () => {
   it('declares the services it binds', () => {
-    expect(inject).toEqual(['sessions', 'slots', 'locale'])
+    expect(inject).toEqual(['jobs', 'slots', 'locale'])
+  })
+
+  it('exposes the jobs source and the roster and observation controls through the inject face', async () => {
+    const { ctx } = await bench()
+    const entry = ctx.slots
+      .entries('conversation.session.header.actions')
+      .find(candidate => candidate.options.id === 'job-list')
+    const inject = entry?.inject as (() => JobListInjected) | undefined
+    if (inject === undefined) throw new Error('job-list entry registered no inject face')
+    const face = inject()
+    expect(face.hooks.jobs).toBeDefined()
+    const release = face.watchRows(SessionId('session'))
+    expect(watched).toEqual(['session'])
+    release()
+    const stopper = face.observe(SessionId('session'), JobId('bash-1'))
+    expect(observed).toEqual([['session', 'bash-1']])
+    stopper()
   })
 
   it('registers the header action, and fiber teardown removes it (HMR safety)', async () => {
@@ -75,7 +110,7 @@ describe('ui-job browser half', () => {
   })
 })
 
-describe('ui-job node half', () => {
+describe('ui-jobs node half', () => {
   it('contributes no host behavior', () => {
     // The node half exists only so the plugin appears in the Loader tree.
     expect(applyNode).not.toThrow()
diff --git a/packages/client/ui-jobs/tests/job-list-action.client.spec.tsx b/packages/client/ui-jobs/tests/job-list-action.client.spec.tsx
index e42e0ef556..dd50c639c6 100644
--- a/packages/client/ui-jobs/tests/job-list-action.client.spec.tsx
+++ b/packages/client/ui-jobs/tests/job-list-action.client.spec.tsx
@@ -1,241 +1,370 @@
 // @vitest-environment jsdom
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import { act, cleanup, fireEvent, render, screen, within } from '@testing-library/react'
 import { makeTranslate } from '@deepseek-ai/dsh-client-test-runtime'
-import type { SessionListState } from '@deepseek-ai/dsh-api-session-controller/client'
-import type { SessionJob as JobView } from '@deepseek-ai/dsh-api-session-controller/types'
+import type { JobsSnapshot, JobView, ObservedJob } from '@deepseek-ai/dsh-api-job-controller/client'
 import type { SessionId } from '@deepseek-ai/dsh-session/types'
 import { JobListAction, type JobListActionProps } from '../src/client/JobListAction.tsx'
 import { zh } from '../src/client/locales.ts'
 
-// Live rows render `now - startedAt`, so every assertion needs a pinned clock.
-beforeEach(() => {
-  vi.useFakeTimers()
-  vi.setSystemTime(START)
-})
-
 afterEach(() => {
   cleanup()
-  vi.useRealTimers()
   vi.restoreAllMocks()
+  vi.useRealTimers()
 })
 
 const SESSION = 'session' as SessionId
-const START = 1_700_000_000_000
 const t: JobListActionProps['t'] = makeTranslate(zh)
 
+/** A running job with nothing retained yet. */
 function job(over: Partial<JobView> = {}): JobView {
   return {
     id: 'bash-1' as JobView['id'],
     kind: 'bash',
     label: 'pnpm run build',
     status: 'running',
-    startedAt: START,
+    startedAt: 1_700_000_000_000,
+    output: { total: 0, earliest: 0 },
     ...over,
   }
 }
 
-function props(jobs: readonly JobView[] | undefined): JobListActionProps {
-  const state = {
-    ids: [SESSION],
-    byId: {},
-    phase: 'ready',
-    projectionsBySession: {},
-    jobsBySession: jobs === undefined ? {} : { [SESSION]: jobs },
-  } satisfies SessionListState
-  function useSessions<T>(select: (snapshot: SessionListState) => T): T {
-    return select(state)
-  }
-  return { sessionId: SESSION, useSessions, t } as unknown as JobListActionProps
+/** A job that left retained output behind, so its row offers a panel even once settled. */
+function outputJob(over: Partial<JobView> = {}): JobView {
+  return job({ output: { total: 12, earliest: 0 }, ...over })
 }
 
-/**
- * Rows in render order as `[kind, label, status, duration]`. Adjacent spans
- * carry no whitespace between them, so the cells are read one element at a
- * time rather than split out of a flattened string.
- */
-function rowCells(): string[][] {
-  return within(screen.getByRole('list', { name: zh['list.aria'] }))
-    .getAllByRole('listitem')
-    .map(row => [...row.children]
-      .map(cell => cell.textContent ?? '')
-      .filter(text => text !== ''))
+function props(
+  jobs: readonly JobView[],
+  observe: JobListActionProps['observe'] = () => () => {},
+  observed: Readonly<Record<string, ObservedJob>> = {},
+  watchRows: JobListActionProps['watchRows'] = () => () => {},
+): JobListActionProps {
+  const jobsState: JobsSnapshot = { rows: jobs.length > 0 ? { [SESSION]: jobs } : {}, observed }
+  function useJobs<T>(select: (value: JobsSnapshot) => T): T {
+    return select(jobsState)
+  }
+  return { sessionId: SESSION, useJobs, watchRows, observe, t } as JobListActionProps
+}
+
+function openList(): void {
+  fireEvent.click(screen.getAllByRole('button')[0]!)
 }
 
 describe('JobListAction visibility', () => {
-  it('renders nothing while the session has no jobs', () => {
-    const { container } = render(<JobListAction {...props(undefined)} />)
+  it('renders nothing while the session sees no jobs', () => {
+    const { container } = render(<JobListAction {...props([])} />)
     expect(container.innerHTML).toBe('')
   })
 
-  it('counts only live jobs, and falls back to the total when none are live', () => {
-    const { rerender } = render(<JobListAction {...props([job(), job({ id: 'bash-2' as JobView['id'] })])} />)
+  it('watches the session roster while mounted and releases it on unmount', () => {
+    const stop = vi.fn()
+    const watchRows = vi.fn(() => stop)
+    const { unmount } = render(<JobListAction {...props([], undefined, {}, watchRows)} />)
+    expect(watchRows).toHaveBeenCalledWith(SESSION)
+    expect(stop).not.toHaveBeenCalled()
+    unmount()
+    expect(stop).toHaveBeenCalledTimes(1)
+  })
+
+  it('counts live jobs on the trigger', () => {
+    render(<JobListAction {...props([
+      job(),
+      job({ id: 'subagent-1' as JobView['id'], kind: 'subagent', label: 'explore' }),
+    ])} />)
     expect(screen.getByRole('button', { name: '2 个后台任务运行中' })).toBeDefined()
-
-    rerender(<JobListAction {...props([job({ status: 'completed', finishedAt: START + 3_000 })])} />)
-    expect(screen.getByRole('button', { name: '1 个后台任务' })).toBeDefined()
   })
 
-  it('closes and unmounts when the last job disappears while the list is open', () => {
-    const { container, rerender } = render(<JobListAction {...props([job()])} />)
-    fireEvent.click(screen.getByRole('button'))
-    expect(screen.getByRole('list', { name: zh['list.aria'] })).toBeDefined()
-
-    rerender(<JobListAction {...props([])} />)
-    expect(container.innerHTML).toBe('')
+  it('falls back to the total when nothing is live', () => {
+    render(<JobListAction {...props([
+      job({ status: 'completed', finishedAt: 1_700_000_003_000 }),
+    ])} />)
+    expect(screen.getByRole('button', { name: '1 个后台任务' })).toBeDefined()
   })
 })
 
 describe('JobListAction rows', () => {
-  it('orders live jobs by start, then settled jobs newest-first', () => {
+  it('renders a settled job without retained output as a static row', () => {
     render(<JobListAction {...props([
-      job({ id: 'bash-3' as JobView['id'], label: 'old done', status: 'completed', startedAt: START, finishedAt: START + 1_000 }),
-      job({ id: 'bash-4' as JobView['id'], label: 'new done', status: 'failed', startedAt: START, finishedAt: START + 9_000 }),
-      job({ id: 'bash-2' as JobView['id'], label: 'later live', startedAt: START + 5_000 }),
-      job({ id: 'bash-1' as JobView['id'], label: 'earlier live', startedAt: START }),
+      job({ id: 'subagent-1' as JobView['id'], kind: 'subagent', label: 'explore the repo', status: 'completed', finishedAt: 1_700_000_003_000 }),
     ])} />)
-    fireEvent.click(screen.getByRole('button'))
-    expect(rowCells()).toEqual([
-      ['bash', 'earlier live', '运行中', '0秒'],
-      ['bash', 'later live', '运行中', '0秒'],
-      ['bash', 'new done', '已失败', '9秒'],
-      ['bash', 'old done', '已完成', '1秒'],
+    expect(screen.getByRole('button', { name: '1 个后台任务' })).toBeDefined()
+    openList()
+    expect(screen.getByText('explore the repo')).toBeDefined()
+    expect(screen.queryByRole('button', { name: zh['row.expandAria'].replace('{label}', 'explore the repo') })).toBeNull()
+  })
+
+  it('offers a panel on a live row before any output arrived', () => {
+    render(<JobListAction {...props([job({ label: 'warming up' })])} />)
+    openList()
+    expect(screen.getByRole('button', { name: zh['row.expandAria'].replace('{label}', 'warming up') })).toBeDefined()
+  })
+
+  it('shows the live progress line in place of the status word', () => {
+    render(<JobListAction {...props([job({ status: 'stopping', progress: 'winding down' })])} />)
+    openList()
+    const list = screen.getByRole('list', { name: zh['list.aria'] })
+    expect(within(list).getAllByRole('listitem')).toHaveLength(1)
+    expect(within(list).getByText('pnpm run build')).toBeDefined()
+    expect(within(list).getByText('winding down')).toBeDefined()
+  })
+
+  it('labels each non-empty section and drops the heading of an empty one', () => {
+    const settled = [job({ id: 'bash-2' as JobView['id'], status: 'completed', finishedAt: 1_700_000_012_000 })]
+    const { rerender } = render(<JobListAction {...props([job(), ...settled])} />)
+    openList()
+    expect(screen.getByText(zh['section.live'])).toBeDefined()
+    expect(screen.getByText(zh['section.settled'])).toBeDefined()
+    // A live-only list keeps its own heading and drops the settled one.
+    rerender(<JobListAction {...props([job()])} />)
+    expect(screen.getByText(zh['section.live'])).toBeDefined()
+    expect(screen.queryByText(zh['section.settled'])).toBeNull()
+  })
+
+  it('shows a settled duration and ticks a live one', () => {
+    vi.useFakeTimers({ now: 1_700_000_020_000 })
+    render(<JobListAction {...props([
+      job({ startedAt: 1_700_000_015_000 }),
+      job({ id: 'bash-2' as JobView['id'], status: 'completed', startedAt: 1_700_000_000_000, finishedAt: 1_700_000_012_000 }),
+      job({ id: 'bash-3' as JobView['id'], status: 'completed', startedAt: 1_699_996_200_000, finishedAt: 1_700_000_000_000 }),
+      job({ id: 'bash-4' as JobView['id'], status: 'completed', startedAt: 1_699_999_900_000, finishedAt: 1_699_999_972_000 }),
+    ])} />)
+    openList()
+    expect(screen.getByText('5秒')).toBeDefined()
+    expect(screen.getByText('12秒')).toBeDefined()
+    expect(screen.getByText('1小时3分')).toBeDefined()
+    expect(screen.getByText('1分12秒')).toBeDefined()
+    act(() => { vi.advanceTimersByTime(1_000) })
+    expect(screen.getByText('6秒')).toBeDefined()
+  })
+
+  it('lists rows with kind, label, and progress, terminal detail, or status', () => {
+    render(<JobListAction {...props([
+      job(),
+      outputJob({ id: 'bash-2' as JobView['id'], status: 'failed', detail: 'exit code: 3', finishedAt: 1_700_000_002_000 }),
+    ])} />)
+    openList()
+    const list = screen.getByRole('list', { name: zh['list.aria'] })
+    const items = within(list).getAllByRole('listitem')
+    expect(items).toHaveLength(2)
+    expect(items[0]?.textContent).toContain('pnpm run build')
+    expect(items[0]?.textContent).toContain(zh['status.running'])
+    expect(items[1]?.textContent).toContain('exit code: 3')
+  })
+
+  it('orders live rows first by start and settled rows newest-first with tie-breaks', () => {
+    const settled = (id: string, label: string, startedAt: number, finishedAt?: number): JobView =>
+      job({
+        id: id as JobView['id'],
+        label,
+        status: 'completed',
+        startedAt,
+        ...finishedAt !== undefined ? { finishedAt } : {},
+      })
+    render(<JobListAction {...props([
+      settled('bash-a', 'settled-a', 10, 100),
+      settled('bash-c', 'settled-c', 80, 100),
+      settled('bash-b', 'settled-b', 90),
+      settled('bash-e', 'settled-e', 95, 50),
+      settled('bash-d', 'settled-d', 10, 200),
+      job({ id: 'bash-l1' as JobView['id'], label: 'live-1', startedAt: 5 }),
+      job({ id: 'bash-l2' as JobView['id'], label: 'live-2', startedAt: 3 }),
+    ])} />)
+    openList()
+    const labels = within(screen.getByRole('list', { name: zh['list.aria'] }))
+      .getAllByRole('listitem')
+      .map(item => item.querySelector('[title]')?.getAttribute('title'))
+    expect(labels).toEqual([
+      'live-2', 'live-1', 'settled-d', 'settled-a', 'settled-c', 'settled-b', 'settled-e',
     ])
+    expect(screen.getAllByText(zh['status.completed']).length).toBeGreaterThan(0)
   })
 
   it('breaks a settled tie on start order so map iteration never decides it', () => {
     render(<JobListAction {...props([
-      job({ id: 'bash-2' as JobView['id'], label: 'second', status: 'completed', startedAt: START + 10, finishedAt: START + 100 }),
-      job({ id: 'bash-1' as JobView['id'], label: 'first', status: 'completed', startedAt: START, finishedAt: START + 100 }),
+      job({ id: 'bash-2' as JobView['id'], label: 'second', status: 'completed', startedAt: 1_700_000_000_000 + 10, finishedAt: 1_700_000_000_000 + 100 }),
+      job({ id: 'bash-1' as JobView['id'], label: 'first', status: 'completed', startedAt: 1_700_000_000_000, finishedAt: 1_700_000_000_000 + 100 }),
     ])} />)
-    fireEvent.click(screen.getByRole('button'))
-    expect(rowCells().map(cells => cells[1])).toEqual(['first', 'second'])
+    openList()
+    expect(within(screen.getByRole('list')).getAllByRole('listitem').map(row => row.querySelector('[title]')?.getAttribute('title')))
+      .toEqual(['first', 'second'])
   })
 
   it('prefers the producer detail over the generic status word', () => {
     render(<JobListAction {...props([
-      job({ status: 'killed', detail: 'signal: SIGTERM', finishedAt: START + 2_000 }),
+      job({ status: 'killed', detail: 'signal: SIGTERM', finishedAt: 1_700_000_000_000 + 2_000 }),
     ])} />)
-    fireEvent.click(screen.getByRole('button'))
-    expect(rowCells()[0]).toContain('signal: SIGTERM')
+    openList()
+    expect(within(screen.getByRole('list')).getAllByRole('listitem')[0]?.textContent).toContain('signal: SIGTERM')
   })
 
   it('renders every status word, including the stopping transition', () => {
     render(<JobListAction {...props([
       job({ id: 'bash-1' as JobView['id'], label: 'a', status: 'running' }),
       job({ id: 'bash-2' as JobView['id'], label: 'b', status: 'stopping' }),
-      job({ id: 'bash-3' as JobView['id'], label: 'c', status: 'completed', finishedAt: START }),
-      job({ id: 'bash-4' as JobView['id'], label: 'd', status: 'killed', finishedAt: START }),
-      job({ id: 'bash-5' as JobView['id'], label: 'e', status: 'failed', finishedAt: START }),
+      job({ id: 'bash-3' as JobView['id'], label: 'c', status: 'completed', finishedAt: 1_700_000_000_000 }),
+      job({ id: 'bash-4' as JobView['id'], label: 'd', status: 'killed', finishedAt: 1_700_000_000_000 }),
+      job({ id: 'bash-5' as JobView['id'], label: 'e', status: 'failed', finishedAt: 1_700_000_000_000 }),
     ])} />)
-    fireEvent.click(screen.getByRole('button'))
-    const words = rowCells().map(cells => cells[2])
-    expect(new Set(words)).toEqual(new Set(['运行中', '正在停止', '已完成', '已取消', '已失败']))
-    expect([...screen.getByRole('list').querySelectorAll(':scope > li [data-state]')].map(node => node.getAttribute('data-state')))
+    openList()
+    for (const word of ['运行中', '正在停止', '已完成', '已取消', '已失败']) {
+      expect(within(screen.getByRole('list')).getByText(word)).toBeDefined()
+    }
+    expect([...screen.getByRole('list').querySelectorAll('li [data-state]')].map(node => node.getAttribute('data-state')))
       .toEqual(['ongoing', 'warning', 'done', 'warning', 'error'])
   })
 })
 
-describe('JobListAction duration', () => {
-  it('advances a live row once per second and freezes a settled one', () => {
-    vi.setSystemTime(START + 1_000)
-    render(<JobListAction {...props([
-      job({ id: 'bash-1' as JobView['id'], label: 'live' }),
-      job({ id: 'bash-2' as JobView['id'], label: 'done', status: 'completed', finishedAt: START + 4_000 }),
-    ])} />)
-    fireEvent.click(screen.getByRole('button'))
-    expect(rowCells()[0]).toContain('1秒')
-    expect(rowCells()[1]).toContain('4秒')
-
-    act(() => { vi.advanceTimersByTime(2_000) })
-    expect(rowCells()[0]).toContain('3秒')
-    expect(rowCells()[1]).toContain('4秒')
+describe('JobListAction observation', () => {
+  it('marks killed rows, renders every output line unfolded, and copies the command', async () => {
+    const writeText = vi.fn().mockResolvedValue(undefined)
+    Object.defineProperty(navigator, 'clipboard', { configurable: true, value: { writeText } })
+    const lines = Array.from({ length: 24 }, (_value, index) => `line ${index + 1}`).join('\n')
+    const view: ObservedJob = {
+      jobId: 'bash-1' as JobView['id'],
+      text: lines,
+      gapBefore: false,
+      streaming: false,
+    }
+    render(<JobListAction {...props(
+      [outputJob({ status: 'killed', finishedAt: 1_700_000_001_000 })],
+      undefined,
+      { 'bash-1': view },
+    )} />)
+    openList()
+    expect(screen.getByText(zh['status.killed'])).toBeDefined()
+    fireEvent.click(screen.getByRole('button', { name: zh['row.expandAria'].replace('{label}', 'pnpm run build') }))
+    // The panel scrolls instead of folding: every line renders, no fold control.
+    expect(screen.getByText('line 1')).toBeDefined()
+    expect(screen.getByText('line 24')).toBeDefined()
+    expect(screen.queryByRole('button', { name: zh['terminal.expandAria'].replace('{n}', '8') })).toBeNull()
+    // The panel draws no state dot or label of its own — the row carries it.
+    expect(screen.queryByText(zh['terminal.done'])).toBeNull()
+    // The copy control carries the command, not the output.
+    await act(async () => { fireEvent.click(screen.getByRole('button', { name: zh['terminal.copy'] })) })
+    expect(writeText).toHaveBeenCalledWith('pnpm run build')
   })
 
-  it('widens to minutes and then hours, and never shows a negative figure', () => {
-    render(<JobListAction {...props([
-      job({ id: 'bash-1' as JobView['id'], label: 'm', status: 'completed', finishedAt: START + 125_000 }),
-      job({ id: 'bash-2' as JobView['id'], label: 'h', status: 'completed', finishedAt: START + 7_380_000 }),
-      // A clock that moved backwards must not render a negative duration.
-      job({ id: 'bash-3' as JobView['id'], label: 'skew', status: 'completed', startedAt: START + 5_000, finishedAt: START }),
-    ])} />)
-    fireEvent.click(screen.getByRole('button'))
-    expect(rowCells().map(cells => cells[3])).toEqual(['2小时3分', '2分5秒', '0秒'])
+  it('shifts an overflowing popover back inside the viewport and follows resizes', () => {
+    vi.spyOn(HTMLElement.prototype, 'offsetWidth', 'get').mockReturnValue(440)
+    vi.spyOn(HTMLDivElement.prototype, 'getBoundingClientRect').mockReturnValue({ left: 344 } as DOMRect)
+    const originalWidth = window.innerWidth
+    Object.defineProperty(window, 'innerWidth', { value: 700, configurable: true, writable: true })
+    try {
+      render(<JobListAction {...props([job()])} />)
+      openList()
+      const menu = screen.getByRole('list', { name: zh['list.aria'] })
+      // 700 - 12 - 440 - 344 = -96: the popover moves left to keep the margin.
+      expect(menu.style.left).toBe('-96px')
+
+      window.innerWidth = 900
+      fireEvent(window, new Event('resize'))
+      // 900 - 12 - 440 - 344 = 104 > 0: the anchored position fits again.
+      expect(menu.style.left).toBe('0px')
+    } finally {
+      Object.defineProperty(window, 'innerWidth', { value: originalWidth, configurable: true, writable: true })
+    }
   })
 
-  it('runs no clock while the list is closed', () => {
-    const interval = vi.spyOn(globalThis, 'setInterval')
-    render(<JobListAction {...props([job()])} />)
-    expect(interval).not.toHaveBeenCalled()
-    fireEvent.click(screen.getByRole('button'))
-    expect(interval).toHaveBeenCalledTimes(1)
+  it('never crosses the left viewport margin for an oversized popover', () => {
+    vi.spyOn(HTMLElement.prototype, 'offsetWidth', 'get').mockReturnValue(800)
+    vi.spyOn(HTMLDivElement.prototype, 'getBoundingClientRect').mockReturnValue({ left: 4 } as DOMRect)
+    const originalWidth = window.innerWidth
+    Object.defineProperty(window, 'innerWidth', { value: 700, configurable: true, writable: true })
+    try {
+      render(<JobListAction {...props([job()])} />)
+      openList()
+      const menu = screen.getByRole('list', { name: zh['list.aria'] })
+      // max(12 - 4, min(0, 700 - 12 - 800 - 4)) = 8: clamped at the left margin.
+      expect(menu.style.left).toBe('8px')
+    } finally {
+      Object.defineProperty(window, 'innerWidth', { value: originalWidth, configurable: true, writable: true })
+    }
   })
 
-  it('runs no clock for an open list holding only settled jobs', () => {
-    const interval = vi.spyOn(globalThis, 'setInterval')
-    render(<JobListAction {...props([job({ status: 'completed', finishedAt: START })])} />)
-    fireEvent.click(screen.getByRole('button'))
-    expect(interval).not.toHaveBeenCalled()
+  it('ignores other keys while open and closes once the roster empties', () => {
+    const settledPair = [
+      outputJob({ id: 'bash-1' as JobView['id'], status: 'completed', finishedAt: 2 }),
+      outputJob({ id: 'bash-2' as JobView['id'], status: 'completed', finishedAt: 3 }),
+    ]
+    const { rerender } = render(<JobListAction {...props(settledPair)} />)
+    expect(screen.getByRole('button', { name: '2 个后台任务' })).toBeDefined()
+    openList()
+    const list = screen.getByRole('list', { name: zh['list.aria'] })
+    fireEvent.keyDown(list, { key: 'a' })
+    expect(screen.getByRole('list', { name: zh['list.aria'] })).toBeDefined()
+    // The roster emptying unmounts the control entirely; the open flag resets first.
+    rerender(<JobListAction {...props([])} />)
+    expect(screen.queryByRole('button')).toBeNull()
   })
-})
 
-describe('JobListAction dismissal', () => {
-  it('closes on Escape and returns focus to the trigger', () => {
-    render(<JobListAction {...props([job()])} />)
-    const trigger = screen.getByRole('button')
-    fireEvent.click(trigger)
-    expect(trigger.getAttribute('aria-expanded')).toBe('true')
+  it('starts observing on expand with the session identity, renders the live text, and stops on collapse', () => {
+    const stop = vi.fn()
+    const observe = vi.fn(() => stop)
+    const view: ObservedJob = {
+      jobId: 'bash-1' as JobView['id'],
+      text: 'compiling…\n',
+      gapBefore: false,
+      streaming: true,
+    }
+    render(<JobListAction {...props([job()], observe, { 'bash-1': view })} />)
+    openList()
+    fireEvent.click(screen.getByRole('button', { name: zh['row.expandAria'].replace('{label}', 'pnpm run build') }))
+    expect(observe).toHaveBeenCalledWith(SESSION, 'bash-1')
+    expect(screen.getByText('compiling…')).toBeDefined()
 
-    fireEvent.keyDown(trigger, { key: 'Escape' })
-    expect(trigger.getAttribute('aria-expanded')).toBe('false')
-    expect(document.activeElement).toBe(trigger)
+    fireEvent.click(screen.getByRole('button', { name: zh['row.collapseAria'].replace('{label}', 'pnpm run build') }))
+    expect(stop).toHaveBeenCalledTimes(1)
   })
 
-  it('ignores other keys and a closed-list Escape', () => {
-    render(<JobListAction {...props([job()])} />)
-    const trigger = screen.getByRole('button')
-    fireEvent.keyDown(trigger, { key: 'Escape' })
-    expect(trigger.getAttribute('aria-expanded')).toBe('false')
-
-    fireEvent.click(trigger)
-    fireEvent.keyDown(trigger, { key: 'ArrowDown' })
-    expect(trigger.getAttribute('aria-expanded')).toBe('true')
+  it('renders a running panel with the prompt alone for a live row whose output has not arrived', () => {
+    const view: ObservedJob = {
+      jobId: 'bash-1' as JobView['id'],
+      text: '',
+      gapBefore: false,
+      streaming: true,
+    }
+    const { container } = render(<JobListAction {...props([job()], undefined, { 'bash-1': view })} />)
+    openList()
+    fireEvent.click(screen.getByRole('button', { name: zh['row.expandAria'].replace('{label}', 'pnpm run build') }))
+    expect(container.querySelector('[data-running]')).not.toBeNull()
+    expect(screen.queryByText(zh['terminal.noOutput'])).toBeNull()
   })
-
-  it('closes on an outside pointer press but not on one inside', () => {
-    render(<JobListAction {...props([job()])} />)
-    const trigger = screen.getByRole('button')
-    fireEvent.click(trigger)
-
-    fireEvent.pointerDown(screen.getByRole('list', { name: zh['list.aria'] }))
-    expect(trigger.getAttribute('aria-expanded')).toBe('true')
 
-    fireEvent.pointerDown(document.body)
-    expect(trigger.getAttribute('aria-expanded')).toBe('false')
+  it('surfaces retention gaps and stream failures above the panel', () => {
+    const view: ObservedJob = {
+      jobId: 'bash-1' as JobView['id'],
+      text: 'tail only',
+      gapBefore: true,
+      streaming: false,
+      error: 'connection lost',
+    }
+    render(<JobListAction {...props([job()], undefined, { 'bash-1': view })} />)
+    openList()
+    fireEvent.click(screen.getByRole('button', { name: zh['row.expandAria'].replace('{label}', 'pnpm run build') }))
+    expect(screen.getByText(zh['output.gap'])).toBeDefined()
+    expect(screen.getByText('实时输出流中断：connection lost')).toBeDefined()
   })
-})
 
-describe('JobListAction wire tolerance', () => {
-  it('treats a settled job with no finishedAt as zero-duration and sorts it by start', () => {
-    // `finishedAt` is optional on the wire; the Host always sets it, so this
-    // covers a producer or carrier that ever stops doing so.
-    render(<JobListAction {...props([
-      job({ id: 'bash-1' as JobView['id'], label: 'no finish', status: 'completed' }),
-      job({ id: 'bash-2' as JobView['id'], label: 'finished', status: 'completed', startedAt: START - 1_000, finishedAt: START + 2_000 }),
-    ])} />)
-    fireEvent.click(screen.getByRole('button'))
-    expect(rowCells().map(cells => [cells[1], cells[3]])).toEqual([
-      ['finished', '3秒'],
-      ['no finish', '0秒'],
-    ])
+  it('stops observation when the popover closes via Escape', () => {
+    const stop = vi.fn()
+    render(<JobListAction {...props([job()], () => stop)} />)
+    openList()
+    fireEvent.click(screen.getByRole('button', { name: zh['row.expandAria'].replace('{label}', 'pnpm run build') }))
+    fireEvent.keyDown(screen.getByRole('list', { name: zh['list.aria'] }), { key: 'Escape' })
+    expect(stop).toHaveBeenCalledTimes(1)
+    expect(screen.queryByRole('list', { name: zh['list.aria'] })).toBeNull()
   })
 
-  it('falls back to start order when neither settled job carries a finish time', () => {
-    render(<JobListAction {...props([
-      job({ id: 'bash-2' as JobView['id'], label: 'later', status: 'failed', startedAt: START + 1_000 }),
-      job({ id: 'bash-1' as JobView['id'], label: 'earlier', status: 'failed', startedAt: START }),
-    ])} />)
-    fireEvent.click(screen.getByRole('button'))
-    expect(rowCells().map(cells => cells[1])).toEqual(['later', 'earlier'])
+  it('folds an expanded panel whose row left the roster', () => {
+    const stop = vi.fn()
+    // One stable observe identity across renders, as the inject face provides.
+    const observe = () => stop
+    const { rerender } = render(<JobListAction {...props([job()], observe)} />)
+    openList()
+    fireEvent.click(screen.getByRole('button', { name: zh['row.expandAria'].replace('{label}', 'pnpm run build') }))
+    rerender(<JobListAction {...props([job({ id: 'bash-2' as JobView['id'], label: 'other' })], observe)} />)
+    expect(stop).toHaveBeenCalledTimes(1)
+    expect(screen.queryByRole('button', { name: zh['row.collapseAria'].replace('{label}', 'other') })).toBeNull()
   })
 })
diff --git a/packages/client/ui-jobs/tsconfig.json b/packages/client/ui-jobs/tsconfig.json
index 0e66aa4958..38756e4d88 100644
--- a/packages/client/ui-jobs/tsconfig.json
+++ b/packages/client/ui-jobs/tsconfig.json
@@ -8,6 +8,9 @@
     "src"
   ],
   "references": [
+    {
+      "path": "../../api/job-controller/tsconfig.client.json"
+    },
     {
       "path": "../../api/session-controller/tsconfig.client.json"
     },
diff --git a/packages/client/ui-layout/tests/app-frame.client.spec.tsx b/packages/client/ui-layout/tests/app-frame.client.spec.tsx
index b097c4b62c..7e334afb80 100644
--- a/packages/client/ui-layout/tests/app-frame.client.spec.tsx
+++ b/packages/client/ui-layout/tests/app-frame.client.spec.tsx
@@ -78,7 +78,6 @@ function mountFrame(windowWidth = frameWidth) {
     },
     phase: 'ready',
     projectionsBySession: {},
-    jobsBySession: {},
   })
   const workspaceState: WorkspaceSnapshot = {
     items: [], archivedSessionIds: [], pinnedSessionIds: [], state: 'idle', phase: 'ready', error: null,
diff --git a/packages/client/ui-layout/tests/document-title.client.spec.tsx b/packages/client/ui-layout/tests/document-title.client.spec.tsx
index 0aefd57215..0b39340f74 100644
--- a/packages/client/ui-layout/tests/document-title.client.spec.tsx
+++ b/packages/client/ui-layout/tests/document-title.client.spec.tsx
@@ -21,7 +21,6 @@ function titleSources() {
     byId: { [sessionId]: { id: sessionId, displayTitle: 'Test', running: false, retainedBy: { mainView: 1 }, blank: false, updatedAt: 1 } },
     phase: 'ready',
     projectionsBySession: {},
-    jobsBySession: {},
   })
   const panelInfo = createSnapshotStore<PanelInfo>({ activePanelId: null })
   return {
diff --git a/packages/client/ui-open-in-app/README.i18n.yaml b/packages/client/ui-open-in-app/README.i18n.yaml
index fbf2a75bc6..b0fa75db3e 100644
--- a/packages/client/ui-open-in-app/README.i18n.yaml
+++ b/packages/client/ui-open-in-app/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-open-in-app/README.md
-README.md: b70b39e79a172badc2b237083d6cd268e9cce06e
-README.zh.md: 9d47e57cfe388b3823cee648f1fdf3187b534d78
+README.md: 138be128c291fc4a0611295c54768a95f33f3ae1
+README.zh.md: b81f62f9dbf8ccfbc1822b8a72df95e7169228c0
diff --git a/packages/client/ui-open-in-app/README.md b/packages/client/ui-open-in-app/README.md
index b70b39e79a..138be128c2 100644
--- a/packages/client/ui-open-in-app/README.md
+++ b/packages/client/ui-open-in-app/README.md
@@ -29,9 +29,11 @@ Mount this plugin in the Web composition beside [`dsh-host-open-in-app`](../../h
 
 ### What to expect
 
-The main button shows the remembered application's icon — the real application icon wherever the host extracts one (macOS bundle icons, Windows executable icons, Linux theme icons), a generic glyph where it serves none — and a design-system tooltip ("Open locally"); clicking launches immediately. The chevron opens a dense menu of the installed applications with the remembered one marked by a filled row. Availability is read once per page from the host; the last chosen application persists in the browser (`dsh.open-in-app.choice`), and a choice that is no longer installed falls back to the first available entry. A launch that finishes quickly leaves the button untouched — the dimmed busy treatment appears only after 250 ms in flight — and a failed launch shows the error tooltip and a red outline for two seconds. All copy lives in the bilingual `open-in-app` locale namespace; an application id the dictionaries cannot name is not offered.
+The Session header and document header use the same 24px-high split button with 9px corners. Both headers show only the icon; their tooltip names the default application or the reveal action. Both show the default action’s icon, mark its application with “(default)” in the menu, disable while their own gesture runs, and report failures through a transient toast. The directory adapter uses the existing cross-platform application catalog and remembers the last successful choice in `dsh.open-in-app.choice`; a missing choice falls back to the first available application.
 
-In the document preview, the header's "Open ▾" split button opens the previewed file in the Host's default application from its main button, and its menu offers that action and "Show file location" (the file manager's reveal). A file the preview cannot render, whether an unsupported suffix such as video or an archive or a file the reader rejected as non-text or oversized, shows an "Open in default app" button in its empty state where Retry would otherwise stand. Both controls hand the Host the absolute path the file's metadata reports, appear only after the Host answered that a desktop is available, disable only while their own gesture settles, and announce a failed gesture once through a transient toast ("Could not open. Try again." or "Could not show the file location. Try again."); nothing stays on the control afterwards.
+File menus list the discovered associated applications without a separate “Open in default app” row. “Show file location” stays in a fixed footer separated from the scrolling applications. A successful query with only one available action renders a single button without a dropdown. Initial file-association loading uses a gray skeleton icon. When no default application is identified, that row reads “Show file location (default)” and the main button reveals the file. Directory menus have no reveal row. Choosing a file application does not change the system default. An unpreviewable file uses the same menu in a 40px-high split button with an icon and action text; its label is “Open” or “Show file location” according to the default action.
+
+Mounted controls with the same association reader and file share one query and its results; opening either menu refreshes all of them. Releasing the last control cancels the query and discards its state. Cancelled queries cannot replace another file’s results. A failed query displays a menu message and leaves reveal available as the default action. File-association discovery follows [native-command](../../util/native-command/README.md); an empty result, including a platform without a discovery adapter, uses the same reveal fallback without platform branches in the control.
 
 -----
 
@@ -43,7 +45,7 @@ In the document preview, the header's "Open ▾" split button opens the previewe
 
 The plugin registers the split button on `conversation.session.header.utilities` through the standard slot/inject currency and registers the `open-in-app` dictionaries as one effect. A page-lifetime controller ([`src/client/controller.ts`](src/client/controller.ts)) owns the once-per-page availability read, the persisted choice snapshot store, and the launch POST; the component receives both stores through the inject `hooks` compartment, so every Session header shares one truth. Document-relative route forms and wire payload types come from the host package's browser-safe `@deepseek-ai/dsh-host-open-in-app/shared` subpath. In-flight launches are guarded by a ref — repeat clicks and menu picks during a launch are ignored whole (a pick would otherwise persist a choice the gesture never opened) — and the busy/error dress is timer-driven around the `launch` promise.
 
-The file controls register on the document preview's `sidebar.right.tab.document.actions` and `sidebar.right.tab.document.unpreviewable` child slots, whose owner props carry the file’s absolute execution-environment path. A second page-lifetime controller ([`src/client/open-path.ts`](src/client/open-path.ts)) reads the Session Remote's `session.canOpenWorkspacePath` once per page into a desktop snapshot store both controls share, and runs each gesture through `session.openWorkspacePath` with the path and, for reveal, `action: 'reveal'`; a refused or rejected call resolves as the failure kind the control announces. The controls share one gesture hook that owns the pending flag and the toast, so a gesture from one control never restyles the other. The node half is an empty `apply` that keeps the plugin on the host roster.
+The directory and file adapters supply application metadata and operations to [`OpenTargetButton`](src/client/OpenTargetButton.tsx), which owns menu ordering, default markers, icons, sizing, and gesture feedback. The file header and empty state share `FileOpenTarget`, while `OpenPathInjected.applications` queries `session.workspacePathApplications` through [`open-path.ts`](src/client/open-path.ts). Opening uses `session.openWorkspacePath`; the Host revalidates an explicitly selected handler before launch. The directory adapter keeps the existing catalog routes. `FileRouteAction` supplies the same control to delivery cards and change review through `deliverables.file.actions` and `deliverables.review.file.actions`; their authenticated routes retain Session file authorization. A failed or unavailable file query therefore needs no platform-specific UI implementation.
 
 </details>
 
@@ -90,4 +92,4 @@ The feature-level decisions, including the split into the host package and this
 
 </details>
 
-**Runtime invariant:** No companion is published. The plugin registers one dictionary effect and three slot entries whose disposal the HMR-safety spec proves; application availability, the choice, and the desktop answer live in the controllers' snapshot stores with no second copy to diverge.
+**Runtime invariant:** No companion is published. The plugin registers one dictionary effect and five slot entries whose disposal the HMR-safety spec proves; application availability, the choice, and the desktop answer live in the controllers' snapshot stores with no second copy to diverge.
diff --git a/packages/client/ui-open-in-app/README.zh.md b/packages/client/ui-open-in-app/README.zh.md
index 9d47e57cfe..b81f62f9db 100644
--- a/packages/client/ui-open-in-app/README.zh.md
+++ b/packages/client/ui-open-in-app/README.zh.md
@@ -29,9 +29,11 @@ kind: "package-reference"
 
 ### 预期行为
 
-主按钮显示记住的应用图标——凡主机能提取的都是应用真实图标（macOS bundle 图标、Windows 可执行文件图标、Linux 主题图标），提取不到时是通用占位图形——并带设计系统 tooltip（「在本地打开」）；点击立即启动。下拉箭头打开已安装应用的紧凑菜单，记住的条目以整行填充标记。可用性每页读取一次；上次选择的应用持久化在浏览器中（`dsh.open-in-app.choice`），不再安装的选择回退到第一个可用条目。快速完成的启动不改变按钮外观——变暗的等待态只在飞行超过 250 毫秒后出现——失败的启动显示错误 tooltip 与红色描边两秒。所有文案在双语 `open-in-app` locale 命名空间中；词典无法命名的应用 id 不会被提供。
+会话标题栏和文档标题栏共用同一个高 24px、圆角 9px 的分体按钮。两个标题栏都只显示图标，悬停提示显示默认应用名称或文件定位动作。两者都显示默认动作的图标，在菜单的默认应用后标注“（默认）”，仅在自己的操作执行期间禁用，并通过短暂提示报告失败。目录适配器使用已有的跨平台应用列表，将最后一次成功选择保存在 `dsh.open-in-app.choice` 中；原选择不可用时回退到第一个可用应用。
 
-在文档预览里，头部的「打开 ▾」分体按钮的主按钮用 Host 默认应用打开当前文件，菜单提供同一动作和「显示文件位置」（文件管理器的定位）。预览无法渲染的文件，无论是视频、压缩包这类不支持的后缀，还是被读取器判为非文本或过大的文件，都会在空态里原本放重试的位置显示「用默认应用打开」按钮。两个控件都把文件元数据报出的绝对路径交给 Host，只在 Host 回答有桌面之后出现，只在自己的手势结算期间禁用，失败时通过短暂 toast 提示一次（「打开失败，请重试」或「无法显示文件位置，请重试」），之后控件上不残留任何状态。
+文件菜单列出已发现的关联应用，不单列“用默认应用打开”。“显示文件位置”固定在菜单底部，通过分隔线与滚动的应用列表分开。查询成功且只有一个可用操作时显示单按钮，不再显示下拉箭头。文件关联首次加载时使用灰色骨架图标。未识别到默认应用时，该项显示为“显示文件位置（默认）”，主按钮也执行文件定位。目录菜单不包含定位项。选择文件应用不修改系统默认应用。无法预览文件时，空态使用同一菜单，按钮增大到 40px 高并显示图标和动作文字；根据默认动作显示“打开”或“显示文件位置”。
+
+使用同一查询函数和文件的已挂载控件共用查询与结果，打开任一菜单会刷新所有相关控件。最后一个控件释放后取消查询并清除状态。已取消的查询不会覆盖其他文件的结果。查询失败时菜单显示提示，并以文件定位作为默认动作。文件关联查询的平台支持范围见 [native-command](../../util/native-command/README.zh.md)；查询结果为空时，包括平台尚无查询适配器的情况，控件统一使用定位动作，不按操作系统分支处理。
 
 -----
 
@@ -43,7 +45,7 @@ kind: "package-reference"
 
 插件通过标准 slot/inject 机制把分体按钮注册到 `conversation.session.header.utilities`，并以一个 effect 注册 `open-in-app` 词典。一个页面生命周期的 controller（[`src/client/controller.ts`](src/client/controller.ts)）拥有每页一次的可用性读取、持久化选择的 snapshot store 与启动 POST；组件经 inject 的 `hooks` 隔间接收两个 store，因此所有会话头部共享同一份事实。文档相对的路由形式与 wire 载荷类型来自主机包的浏览器安全子路径 `@deepseek-ai/dsh-host-open-in-app/shared`。飞行中的启动由 ref 守卫——启动期间的重复点击与菜单选择被整体忽略（否则会持久化一个该手势从未打开的选择）——busy/error 视觉由围绕 `launch` promise 的定时器驱动。
 
-文件控件注册在文档预览的 `sidebar.right.tab.document.actions` 与 `sidebar.right.tab.document.unpreviewable` 子 slot 上，owner props 携带文件在执行环境中的绝对路径。第二个页面生命周期的 controller（[`src/client/open-path.ts`](src/client/open-path.ts)）每页读取一次 Session Remote 的 `session.canOpenWorkspacePath`，写进两个控件共用的桌面 snapshot store，并把每个手势交给 `session.openWorkspacePath`，带上路径，定位时再带 `action: 'reveal'`；被拒绝或抛错的调用解析为控件要提示的失败种类。两个控件共用一个手势 hook，由它持有 pending 标志和 toast，所以一个控件的手势不会改变另一个控件的样子。节点半边是一个空 `apply`，让插件出现在主机侧的插件名册上。
+目录和文件适配器把应用信息与操作交给 [`OpenTargetButton`](src/client/OpenTargetButton.tsx)，由它统一管理菜单顺序、默认标记、图标、尺寸和操作反馈。文件标题栏和空态共用 `FileOpenTarget`，`OpenPathInjected.applications` 通过 [`open-path.ts`](src/client/open-path.ts) 查询 `session.workspacePathApplications`。打开操作使用 `session.openWorkspacePath`，Host 在启动前重新验证指定的关联应用。`FileRouteAction` 通过 `deliverables.file.actions` 和 `deliverables.review.file.actions` 为交付卡片和变更对比页提供同一控件，其认证路由保留会话文件校验。目录适配器继续使用已有的应用列表路由，文件查询失败或不可用时无需增加平台专用的界面实现。
 
 </details>
 
@@ -90,4 +92,4 @@ Host 在打开或定位前通过当前文件系统验证路径。没有对应 Ho
 
 </details>
 
-**运行时不变式：** 不发布伴生入口。插件注册一个词典 effect 和三个 slot 条目，HMR 安全性 spec 证明它们都会在资源释放时撤销；应用可用性、选择与桌面回答存储在控制器的快照存储中，不存在可能与之分歧的第二份副本。
+**运行时不变式：** 不发布伴生入口。插件注册一个词典 effect 和五个 slot 条目，HMR 安全性 spec 证明它们都会在资源释放时撤销；应用可用性、选择与桌面回答存储在控制器的快照存储中，不存在可能与之分歧的第二份副本。
diff --git a/packages/client/ui-open-in-app/package.json b/packages/client/ui-open-in-app/package.json
index 3b9e784afb..fde52fc3e9 100644
--- a/packages/client/ui-open-in-app/package.json
+++ b/packages/client/ui-open-in-app/package.json
@@ -70,6 +70,8 @@
     "@deepseek-ai/dsh-host-open-in-app": "workspace:^",
     "@deepseek-ai/dsh-session": "workspace:^",
     "@types/react": "~18.3.1",
-    "react": "^18.2.0"
+    "react": "^18.2.0",
+    "@deepseek-ai/dsh-client-ui-deliverables": "workspace:^",
+    "@deepseek-ai/dsh-native-command": "workspace:^"
   }
 }
diff --git a/packages/client/ui-open-in-app/src/client/FileRouteAction.tsx b/packages/client/ui-open-in-app/src/client/FileRouteAction.tsx
new file mode 100644
index 0000000000..49c27245f1
--- /dev/null
+++ b/packages/client/ui-open-in-app/src/client/FileRouteAction.tsx
@@ -0,0 +1,37 @@
+/** Adapt authorized delivery and changed-file routes to the shared opening control. */
+import type { PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
+import type {} from '@deepseek-ai/dsh-client-ui-deliverables/client'
+import { parseNativeFileApplications } from '@deepseek-ai/dsh-native-command/types'
+import type { SessionWorkspacePathApplication } from '@deepseek-ai/dsh-api-session-controller/types'
+import { useFileApplications } from './file-applications.ts'
+import { OpenTargetButton } from './OpenTargetButton.tsx'
+import type { NS } from './locales.ts'
+
+async function queryRoute(url: string, signal: AbortSignal): Promise<readonly SessionWorkspacePathApplication[] | null> {
+  try {
+    const response = await fetch(url, { signal })
+    if (!response.ok) return null
+    return parseNativeFileApplications(await response.json())
+  } catch (_error) {
+    // Unavailable routes and malformed responses leave file reveal as the fallback.
+    return null
+  }
+}
+
+/**
+ * Render file actions without bypassing the owning Session's authorization route.
+ * @param props - authenticated route, desktop availability, and native gesture callback.
+ * @returns the shared compact control, or null without a desktop.
+ */
+export function FileRouteAction(
+  props: Pick<PropsRuntime<'deliverables.file.actions'>, 'actionUrl' | 'available' | 'pending' | 'onAction'> & PropsLocale<typeof NS>,
+) {
+  const association = useFileApplications(props.actionUrl, queryRoute, props.available)
+  if (!props.available) return null
+  return <OpenTargetButton key={props.actionUrl} kind="file" applications={association.apps}
+    defaultId={association.apps.find(app => app.default)?.id} failed={association.failed}
+    loading={association.loading} busy={props.pending} refresh={association.refresh} t={props.t}
+    execute={async (operation) => {
+      return props.onAction(operation.kind === 'reveal' ? 'reveal' : 'open', operation.kind === 'application' ? operation.id : undefined)
+    }} />
+}
diff --git a/packages/client/ui-open-in-app/src/client/OpenInAppAction.module.css b/packages/client/ui-open-in-app/src/client/OpenInAppAction.module.css
deleted file mode 100644
index f5186cc9a6..0000000000
--- a/packages/client/ui-open-in-app/src/client/OpenInAppAction.module.css
+++ /dev/null
@@ -1,64 +0,0 @@
-/* Compact Session-header split button beside the round icon buttons. */
-
-.split {
-  display: inline-flex;
-  align-items: stretch;
-  box-sizing: border-box;
-  height: 24px;
-  border: 0.5px solid var(--dsw-alias-border-l4);
-  border-radius: 9px;
-  overflow: hidden;
-  font-family: var(--dsw-font-family);
-}
-
-.main,
-.chevron {
-  display: inline-flex;
-  align-items: center;
-  gap: 3px;
-  border: 0;
-  background: none;
-  color: var(--dsw-alias-label-primary);
-  font-size: 11px;
-  font-weight: 400;
-  line-height: 16px;
-  cursor: pointer;
-  white-space: nowrap;
-}
-
-.main {
-  padding: 3px 5px;
-}
-
-.main:hover:not(:disabled),
-.main:focus-visible,
-.chevron:hover,
-.chevron:focus-visible {
-  background: var(--dsw-alias-interactive-bg-hover);
-}
-
-.main:disabled {
-  color: var(--dsw-alias-label-dimmed);
-  cursor: wait;
-}
-
-.main[data-state='error'] {
-  color: var(--dsw-alias-state-error-primary);
-  box-shadow: inset 0 0 0 1px var(--dsw-alias-state-error-primary);
-}
-
-.chevron {
-  padding: 3px 4px 3px 3px;
-  border-left: 0.5px solid var(--dsw-alias-border-l4);
-  color: var(--dsw-alias-label-secondary);
-}
-
-.icon {
-  flex: none;
-}
-
-img.icon {
-  display: block;
-  object-fit: contain;
-  user-select: none;
-}
diff --git a/packages/client/ui-open-in-app/src/client/OpenInAppAction.tsx b/packages/client/ui-open-in-app/src/client/OpenInAppAction.tsx
index 78f547a802..a58ed63933 100644
--- a/packages/client/ui-open-in-app/src/client/OpenInAppAction.tsx
+++ b/packages/client/ui-open-in-app/src/client/OpenInAppAction.tsx
@@ -1,10 +1,8 @@
-import { useEffect, useRef, useState } from 'react'
-import { IconChevronDownOutlineRegular, Menu, Tooltip, type MenuItem } from '@deepseek-ai/dsh-client-ui-primitives'
 import type { ObservableSnapshot } from '@deepseek-ai/dsh-client-store'
 import type { InjectFace, PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
 import type {} from '@deepseek-ai/dsh-client-ui-conversation/client'
 import { NS, type OpenInAppKey } from './locales.ts'
-import css from './OpenInAppAction.module.css'
+import { OpenTargetButton } from './OpenTargetButton.tsx'
 
 /** Browser operations and state injected into the Session Header contribution. */
 export interface OpenInAppActionInjected {
@@ -65,162 +63,36 @@ const APP_LABEL_KEY: Record<string, OpenInAppKey | undefined> = {
   konsole: 'app.konsole',
 }
 
-/** App ids whose icon image already failed this page; a 404 icon is fetched once, not per menu open. */
-const failedIcons = new Set<string>()
-
 /**
- * One application's real bundle icon (host-served PNG) with an inline generic
- * app-square fallback while the host has none.
- * @param props - catalog id, host icon URL, and rendered size.
- * @returns the icon image or its fallback glyph.
- */
-function AppIcon({ id, url, size }: { id: string; url: string; size: number }): React.JSX.Element {
-  const [failed, setFailed] = useState(failedIcons.has(id))
-  if (failed) {
-    return (
-      <svg
-        width={size}
-        height={size}
-        viewBox="0 0 24 24"
-        fill="none"
-        className={css.icon}
-        aria-hidden
-      >
-        <path d="M16 3H8C5.23858 3 3 5.23858 3 8V16C3 18.7614 5.23858 21 8 21H16C18.7614 21 21 18.7614 21 16V8C21 5.23858 18.7614 3 16 3Z" fill="currentColor" fillOpacity="0.05" />
-      </svg>
-    )
-  }
-  return (
-    <img
-      src={url}
-      width={size}
-      height={size}
-      className={css.icon}
-      alt=""
-      aria-hidden
-      draggable={false}
-      onError={() => {
-        failedIcons.add(id)
-        setFailed(true)
-      }}
-    />
-  )
-}
-
-/**
- * Quick launches settle well under this delay, so their busy dress never
- * paints — the visible dim-and-wait treatment is reserved for launches that
- * are actually taking a while, instead of flashing on every click.
- */
-const BUSY_DRESS_DELAY_MS = 250
-
-/**
- * Session-header split button: the main button opens the session's workspace
- * directory in the remembered application, the chevron opens the menu of
- * every application the host probed as installed. It renders nothing until
- * the host reported at least one nameable application and the session has a
- * known workspace directory, so a host without the capability never grows
- * the control.
- * @param props - session runtime, injected controller face, and localized copy.
- * @returns the split button and its menu, or null when there is nothing to offer.
+ * Adapt the installed directory catalog to the shared opening control.
+ * @param props - workspace state, installed catalog, and launch operations.
+ * @returns the shared control, or null without an eligible application and directory.
  */
 export function OpenInAppAction(props: OpenInAppActionProps): React.JSX.Element | null {
   const { sessionId, useSessions, useOpenInAppApps, useOpenInAppChoice, t } = props
   const cwd = useSessions(state => state.byId[sessionId]?.cwd)
   const available = useOpenInAppApps(apps => apps)
   const choice = useOpenInAppChoice(id => id)
-  const [open, setOpen] = useState(false)
-  const [phase, setPhase] = useState<'idle' | 'busy' | 'error'>('idle')
-  const inFlight = useRef(false)
-  const busyTimer = useRef<ReturnType<typeof setTimeout> | undefined>(undefined)
-  const errorTimer = useRef<ReturnType<typeof setTimeout> | undefined>(undefined)
-
-  useEffect(() => () => {
-    clearTimeout(busyTimer.current)
-    clearTimeout(errorTimer.current)
-  }, [])
-
-  const apps = (available ?? [])
-    .map(id => ({ id, labelKey: APP_LABEL_KEY[id] }))
-    .filter((entry): entry is { id: string; labelKey: OpenInAppKey } => entry.labelKey !== undefined)
-  const currentEntry = apps.find(entry => entry.id === choice) ?? apps[0]
-  if (currentEntry === undefined || cwd === undefined || cwd === '') return null
-
-  const current = currentEntry.id
-  const currentLabel = t(currentEntry.labelKey)
-  const title = phase === 'error' ? t('open.error') : t('open.title', { app: currentLabel })
-
-  const launch = (appId: string): void => {
-    if (inFlight.current) return
-    inFlight.current = true
-    // A pending error decay must not flip the button back to idle mid-launch.
-    clearTimeout(errorTimer.current)
-    clearTimeout(busyTimer.current)
-    busyTimer.current = setTimeout(() => { setPhase('busy') }, BUSY_DRESS_DELAY_MS)
-    props.launch(appId, cwd).then(() => {
-      inFlight.current = false
-      clearTimeout(busyTimer.current)
-      setPhase('idle')
-    }, () => {
-      inFlight.current = false
-      clearTimeout(busyTimer.current)
-      setPhase('error')
-      clearTimeout(errorTimer.current)
-      errorTimer.current = setTimeout(() => { setPhase('idle') }, 2_000)
-    })
-  }
-
-  const items: MenuItem[] = apps.map(entry => ({
-    id: entry.id,
-    label: t(entry.labelKey),
-    icon: <AppIcon id={entry.id} url={props.iconUrl(entry.id)} size={14} />,
-  }))
-
+  const apps = (available ?? []).flatMap((id) => {
+    const key = APP_LABEL_KEY[id]
+    return key === undefined ? [] : [{ id, name: t(key), icon: props.iconUrl(id) }]
+  })
+  const preferred = apps.find(app => app.id === choice) ?? apps[0]
+  if (preferred === undefined || cwd === undefined || cwd === '') return null
   return (
-    <Menu
-      open={open}
-      align="end"
-      dense
-      selection="fill"
-      onClose={() => { setOpen(false) }}
-      items={items}
-      selectedId={current}
-      onSelect={(id) => {
-        setOpen(false)
-        // A pick while a launch is in flight is ignored whole: persisting the
-        // choice without launching would leave the button naming an app the
-        // gesture never opened.
-        if (inFlight.current) return
-        props.choose(id)
-        launch(id)
+    <OpenTargetButton
+      key={cwd} kind="directory" applications={apps} defaultId={preferred.id} failed={false} t={t}
+      execute={async (operation) => {
+        const id = operation.kind === 'application' ? operation.id : preferred.id
+        try {
+          await props.launch(id, cwd)
+        } catch (_error) {
+          // Native launch failure is announced by the shared control.
+          return 'openError'
+        }
+        if (operation.kind === 'application') props.choose(id)
+        return null
       }}
-      anchor={(
-        <div className={css.split}>
-          <Tooltip label={phase === 'error' ? t('open.error') : t('open.tooltip')} side="bottom">
-            <button
-              type="button"
-              className={css.main}
-              data-state={phase}
-              disabled={phase === 'busy'}
-              aria-label={title}
-              onClick={() => { launch(current) }}
-            >
-              <AppIcon id={current} url={props.iconUrl(current)} size={13} />
-            </button>
-          </Tooltip>
-          <button
-            type="button"
-            className={css.chevron}
-            aria-expanded={open}
-            aria-haspopup="menu"
-            title={t('menu.toggle')}
-            aria-label={t('menu.toggle')}
-            onClick={() => { setOpen(value => !value) }}
-          >
-            <IconChevronDownOutlineRegular size={10} />
-          </button>
-        </div>
-      )}
     />
   )
 }
diff --git a/packages/client/ui-open-in-app/src/client/OpenPathAction.tsx b/packages/client/ui-open-in-app/src/client/OpenPathAction.tsx
index bc7f842386..2b6008d9b1 100644
--- a/packages/client/ui-open-in-app/src/client/OpenPathAction.tsx
+++ b/packages/client/ui-open-in-app/src/client/OpenPathAction.tsx
@@ -1,20 +1,14 @@
-/**
- * Document-header split button: the main button opens the previewed file in
- * its default application, the chevron's menu adds the file-manager reveal.
- * Both path controls share the gesture hook declared here.
- */
-import { useEffect, useState } from 'react'
+/** File association adapter for the shared file/directory opening control. */
+import { useEffect } from 'react'
 import type { ReactNode } from 'react'
-import {
-  IconChevronDownOutlineRegular, IconFolderOpenOutlineRegular, IconRightUpOutlineRegular, Menu, Tooltip,
-} from '@deepseek-ai/dsh-client-ui-primitives'
+import type { SessionWorkspacePathApplication } from '@deepseek-ai/dsh-api-session-controller/types'
 import type { ObservableSnapshot } from '@deepseek-ai/dsh-client-store'
-import type { InjectFace, PropsLocale, PropsRuntime, TranslateNS } from '@deepseek-ai/dsh-client-ui-slots'
+import type { InjectFace, PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
 import type {} from '@deepseek-ai/dsh-client-ui-sidebar-documentpreview/client'
 import type { OpenInAppPathAction, OpenInAppPathFailure } from './open-path.ts'
-import { useOpenFailureToast } from './open-failure-toast.tsx'
+import { useFileApplications } from './file-applications.ts'
+import { OpenTargetButton } from './OpenTargetButton.tsx'
 import type { NS } from './locales.ts'
-import css from './OpenPathAction.module.css'
 
 /** Desktop availability and the gesture carrier injected into both path controls. */
 export interface OpenPathInjected {
@@ -22,7 +16,8 @@ export interface OpenPathInjected {
     openInAppDesktop: ObservableSnapshot<boolean | null>
   }
   loadDesktop: () => Promise<void>
-  openPath: (path: string, action: OpenInAppPathAction) => Promise<OpenInAppPathFailure | null>
+  openPath: (path: string, action: OpenInAppPathAction, application?: string) => Promise<OpenInAppPathFailure | null>
+  applications: (path: string, signal: AbortSignal) => Promise<readonly SessionWorkspacePathApplication[] | null>
 }
 
 /** Full props of the document-header contribution. */
@@ -31,102 +26,41 @@ export type OpenPathActionProps =
   & PropsLocale<typeof NS>
   & InjectFace<OpenPathInjected>
 
-/** What one path control needs from its props: the file, the injected face, and copy. */
-type PathGestureProps = Pick<OpenPathActionProps, 'absolutePath' | 'useOpenInAppDesktop' | 'loadDesktop' | 'openPath'> & {
-  t: TranslateNS<typeof NS>
+/** File inputs shared by the document header and its unpreviewable state. */
+type FileOpenTargetProps = Pick<OpenPathActionProps, 'absolutePath' | 'useOpenInAppDesktop' | 'loadDesktop' | 'openPath' | 'applications' | 't'> & {
+  empty?: boolean
 }
 
 /**
- * Desktop availability, this control's own pending state, and a gesture
- * runner announcing failures through this control's toast. Only the control
- * that ran the gesture disables while it settles; failure never persists on
- * the control.
- * @param props - the file's Host path, the injected face, and copy.
- * @returns availability, pending, the toast to render, and the runner.
+ * Resolve file associations and adapt operations without embedding platform behavior in the control.
+ * @param props - verified file path, desktop query, native operations, and display variant.
+ * @returns the shared opening control, or null without a desktop.
  */
-export function usePathGesture({ absolutePath, useOpenInAppDesktop, loadDesktop, openPath, t }: PathGestureProps): {
-  available: boolean
-  pending: boolean
-  toast: ReactNode
-  act: (action: OpenInAppPathAction) => void
-} {
-  const desktop = useOpenInAppDesktop(value => value)
-  const [pending, setPending] = useState(false)
-  const { toast, show } = useOpenFailureToast()
+export function FileOpenTarget(props: FileOpenTargetProps): ReactNode {
+  const desktop = props.useOpenInAppDesktop(value => value)
+  const association = useFileApplications(props.absolutePath, props.applications, desktop === true)
   useEffect(() => {
-    if (desktop === null) void loadDesktop()
-  }, [desktop, loadDesktop])
-  return {
-    available: desktop === true,
-    pending,
-    toast,
-    act: (action) => {
-      setPending(true)
-      void openPath(absolutePath, action).then((failure) => {
-        if (failure !== null) show(t(`path.${failure}`))
-      }).finally(() => { setPending(false) })
-    },
-  }
-}
-
-/**
- * Render the split button, or nothing until the Host reports a desktop.
- * @param props - the previewed file, the injected face, and copy.
- * @returns the split button with its menu and toast, or null.
- */
-export function OpenPathAction(props: OpenPathActionProps): ReactNode {
-  const { t } = props
-  const [menuOpen, setMenuOpen] = useState(false)
-  const { available, pending, toast, act } = usePathGesture(props)
-  if (!available) return null
-  const run = (action: OpenInAppPathAction): void => {
-    setMenuOpen(false)
-    act(action)
-  }
+    if (desktop === null) void props.loadDesktop()
+  }, [desktop, props.loadDesktop])
+  if (desktop !== true) return null
+  const { apps } = association
   return (
-    <>
-      <Menu
-        className={css.menuAnchor}
-        open={menuOpen && !pending}
-        autoFocus
-        portal
-        dense
-        align="end"
-        onClose={() => { setMenuOpen(false) }}
-        items={[
-          { id: 'open', icon: <IconRightUpOutlineRegular />, label: t('path.defaultApp') },
-          { id: 'reveal', icon: <IconFolderOpenOutlineRegular />, label: t('path.reveal') },
-        ]}
-        onSelect={(id) => { run(id === 'reveal' ? 'reveal' : 'open') }}
-        anchor={(
-          <div className={css.split} data-open-path data-state={pending ? 'busy' : 'idle'}>
-            <Tooltip label={t('path.open.tooltip')} side="bottom" delayMs={500}>
-              <button
-                type="button"
-                className={css.main}
-                disabled={pending}
-                data-open-path-open
-                onClick={() => { run('open') }}
-              >
-                {t('path.open')}
-              </button>
-            </Tooltip>
-            <button
-              type="button"
-              className={css.chevron}
-              disabled={pending}
-              aria-haspopup="menu"
-              aria-expanded={menuOpen && !pending}
-              aria-label={t('path.more')}
-              data-open-path-more
-              onClick={() => { setMenuOpen(value => !value) }}
-            >
-              <IconChevronDownOutlineRegular size={11} />
-            </button>
-          </div>
-        )}
-      />
-      {toast}
-    </>
+    <OpenTargetButton
+      key={props.absolutePath} kind="file" applications={apps} defaultId={apps.find(app => app.default)?.id}
+      loading={association.loading} failed={association.failed}
+      prominent={props.empty === true} t={props.t}
+      refresh={association.refresh}
+      execute={operation => props.openPath(props.absolutePath, operation.kind === 'reveal' ? 'reveal' : 'open',
+        operation.kind === 'application' ? operation.id : undefined)}
+    />
   )
 }
+
+/**
+ * Render the file adapter in the document header.
+ * @param props - document owner inputs and injected opening capabilities.
+ * @returns the shared split button.
+ */
+export function OpenPathAction(props: OpenPathActionProps): ReactNode {
+  return <FileOpenTarget {...props} />
+}
diff --git a/packages/client/ui-open-in-app/src/client/OpenPathEmptyAction.module.css b/packages/client/ui-open-in-app/src/client/OpenPathEmptyAction.module.css
deleted file mode 100644
index cf9036e0d6..0000000000
--- a/packages/client/ui-open-in-app/src/client/OpenPathEmptyAction.module.css
+++ /dev/null
@@ -1,26 +0,0 @@
-/* The empty state's capsule, sized like the preview's own Retry
-   (ui-sidebar-documentpreview TextPreview `.retry`) so the two recourses read
-   as one family. */
-.open {
-  display: inline-flex;
-  flex: none;
-  gap: 6px;
-  align-items: center;
-  height: 32px;
-  padding: 0 12px 0 14px;
-  color: var(--dsw-alias-label-primary);
-  font-size: var(--dsh-content-font-size-secondary, 13px);
-  font-family: inherit;
-  background: transparent;
-  border: 0.5px solid var(--dsw-alias-border-l2);
-  border-radius: 16px;
-  cursor: pointer;
-}
-
-.open:hover:not(:disabled) {
-  background: var(--dsw-alias-interactive-bg-hover);
-}
-
-.open:disabled {
-  cursor: default;
-}
diff --git a/packages/client/ui-open-in-app/src/client/OpenPathEmptyAction.tsx b/packages/client/ui-open-in-app/src/client/OpenPathEmptyAction.tsx
index bf86006ed5..05a2b66800 100644
--- a/packages/client/ui-open-in-app/src/client/OpenPathEmptyAction.tsx
+++ b/packages/client/ui-open-in-app/src/client/OpenPathEmptyAction.tsx
@@ -1,11 +1,9 @@
-/** Empty-state contribution: open a file the document preview cannot render in its default application. */
+/** File opening action in an unpreviewable document's empty state. */
 import type { ReactNode } from 'react'
-import { IconRightUpOutlineRegular } from '@deepseek-ai/dsh-client-ui-primitives'
 import type { InjectFace, PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
 import type {} from '@deepseek-ai/dsh-client-ui-sidebar-documentpreview/client'
 import type { NS } from './locales.ts'
-import { usePathGesture, type OpenPathInjected } from './OpenPathAction.tsx'
-import css from './OpenPathEmptyAction.module.css'
+import { FileOpenTarget, type OpenPathInjected } from './OpenPathAction.tsx'
 
 /** Full props of the unpreviewable empty-state contribution. */
 export type OpenPathEmptyActionProps =
@@ -14,27 +12,10 @@ export type OpenPathEmptyActionProps =
   & InjectFace<OpenPathInjected>
 
 /**
- * Render the default-application open button, or nothing until the Host reports a desktop.
- * @param props - the unpreviewable file, the injected face, and copy.
- * @returns the open button and its toast, or null.
+ * Render the shared file opening menu with a larger labeled main button.
+ * @param props - unpreviewable file and injected opening capabilities.
+ * @returns the shared file opening action.
  */
 export function OpenPathEmptyAction(props: OpenPathEmptyActionProps): ReactNode {
-  const { t } = props
-  const { available, pending, toast, act } = usePathGesture(props)
-  if (!available) return null
-  return (
-    <>
-      <button
-        type="button"
-        className={css.open}
-        disabled={pending}
-        data-open-path-unpreviewable
-        onClick={() => { act('open') }}
-      >
-        {t('path.unpreviewable')}
-        <IconRightUpOutlineRegular size={14} />
-      </button>
-      {toast}
-    </>
-  )
+  return <FileOpenTarget {...props} empty />
 }
diff --git a/packages/client/ui-open-in-app/src/client/OpenPathAction.module.css b/packages/client/ui-open-in-app/src/client/OpenTargetButton.module.css
similarity index 54%
rename from packages/client/ui-open-in-app/src/client/OpenPathAction.module.css
rename to packages/client/ui-open-in-app/src/client/OpenTargetButton.module.css
index f23f590613..44a66f59f2 100644
--- a/packages/client/ui-open-in-app/src/client/OpenPathAction.module.css
+++ b/packages/client/ui-open-in-app/src/client/OpenTargetButton.module.css
@@ -1,4 +1,4 @@
-/* Sized to sit in the document header's 28px control row beside its round
+/* Sized to sit in the document header's 24px control row beside its round
    icon buttons: a hairline pill with a 12px label and a narrow chevron half. */
 
 .menuAnchor {
@@ -11,10 +11,10 @@
   display: inline-flex;
   align-items: stretch;
   box-sizing: border-box;
-  height: 28px;
+  height: 24px;
   overflow: hidden;
-  border: 0.5px solid var(--dsw-alias-border-l3);
-  border-radius: 14px;
+  border: 0.5px solid var(--dsw-alias-border-l4);
+  border-radius: 9px;
   font-family: var(--dsw-font-family);
 }
 
@@ -26,19 +26,20 @@
   border: 0;
   background: none;
   color: var(--dsw-alias-label-primary);
-  font-size: 12px;
+  font-size: 11px;
   line-height: 16px;
   white-space: nowrap;
   cursor: pointer;
 }
 
 .main {
-  padding: 5px 8px 5px 10px;
+  gap: 4px;
+  padding: 3px 5px;
 }
 
 .chevron {
-  padding: 5px 6px 5px 4px;
-  border-left: 0.5px solid var(--dsw-alias-border-l3);
+  padding: 3px 4px 3px 3px;
+  border-left: 0.5px solid var(--dsw-alias-border-l4);
   color: var(--dsw-alias-label-secondary);
 }
 
@@ -54,3 +55,26 @@
 .chevron:disabled {
   cursor: default;
 }
+
+.appIcon {
+  object-fit: contain;
+}
+
+/* The unavailable preview emphasizes the same actions with a labeled button. */
+.split[data-size='large'] {
+  height: 40px;
+  border-radius: 14px;
+  border-color: var(--dsw-alias-border-l2);
+}
+
+.split[data-size='large'] .main {
+  gap: 6px;
+  padding: 8px 14px;
+  font-size: 14px;
+}
+
+.split[data-size='large'] .chevron {
+  padding: 8px 10px;
+}
+
+.skeleton { display: inline-block; flex: none; border-radius: 3px; background: var(--dsw-alias-interactive-bg-hover); }
diff --git a/packages/client/ui-open-in-app/src/client/OpenTargetButton.tsx b/packages/client/ui-open-in-app/src/client/OpenTargetButton.tsx
new file mode 100644
index 0000000000..93a3a34657
--- /dev/null
+++ b/packages/client/ui-open-in-app/src/client/OpenTargetButton.tsx
@@ -0,0 +1,144 @@
+/** Shared file and directory opener: one default action, application menu, and per-gesture feedback. */
+import { useRef, useState } from 'react'
+import type { ReactNode } from 'react'
+import {
+  IconChevronDownOutlineRegular, IconFolderOpenOutlineRegular, IconRightUpOutlineRegular, Menu, Tooltip,
+} from '@deepseek-ai/dsh-client-ui-primitives'
+import type { TranslateNS } from '@deepseek-ai/dsh-client-ui-slots'
+import type { OpenInAppPathFailure } from './open-path.ts'
+import { useOpenFailureToast } from './open-failure-toast.tsx'
+import type { NS } from './locales.ts'
+import css from './OpenTargetButton.module.css'
+
+/** Application metadata supplied by either the directory catalog or a file association query. */
+export interface OpenTargetApplication {
+  readonly id: string
+  readonly name: string
+  readonly icon: string | null
+}
+
+/** Opening intent; default selection remains owned by the target's adapter. */
+export type OpenTargetOperation = { readonly kind: 'default' } | { readonly kind: 'application'; readonly id: string } | { readonly kind: 'reveal' }
+
+/** Inputs shared by both target adapters and the file empty-state action. */
+export interface OpenTargetButtonProps {
+  readonly kind: 'file' | 'directory'
+  readonly applications: readonly OpenTargetApplication[]
+  readonly defaultId: string | undefined
+  readonly failed: boolean
+  readonly busy?: boolean
+  readonly loading?: boolean
+  readonly prominent?: boolean
+  readonly t: TranslateNS<typeof NS>
+  readonly execute: (operation: OpenTargetOperation) => Promise<OpenInAppPathFailure | null>
+  readonly refresh?: () => void
+}
+
+/**
+ * Serialize gestures and announce their failures through the initiating control's toast.
+ * @param execute - target adapter that returns the failure to announce, or null.
+ * @param t - localized control copy.
+ * @returns the pending state, feedback, and guarded action callback.
+ */
+export function useOpenTargetGesture(execute: OpenTargetButtonProps['execute'], t: TranslateNS<typeof NS>): {
+  pending: boolean
+  toast: ReactNode
+  act: (operation: OpenTargetOperation) => void
+} {
+  const [pending, setPending] = useState(false)
+  const inFlight = useRef(false)
+  const { toast, show } = useOpenFailureToast()
+  return {
+    pending,
+    toast,
+    act: (operation) => {
+      if (inFlight.current) return
+      inFlight.current = true
+      setPending(true)
+      void execute(operation).then((failure) => {
+        if (failure !== null) show(t(`path.${failure}`))
+      }).finally(() => { inFlight.current = false; setPending(false) })
+    },
+  }
+}
+
+/** One application image with a per-image fallback, shared by main and menu buttons. */
+function ApplicationIcon({ source, size = 14 }: { source: string | null; size?: number }): ReactNode {
+  const [failed, setFailed] = useState(false)
+  return source === null || failed
+    ? <IconRightUpOutlineRegular size={size} />
+    : <img src={source} width={size} height={size} className={css.appIcon} alt="" draggable={false} onError={() => { setFailed(true) }} />
+}
+
+/**
+ * Render identical split buttons for files and directories. File reveal always stays last and becomes the default when no app is selected.
+ * @param props - target applications, default selection, and operations.
+ * @returns the control and its transient failure feedback.
+ */
+export function OpenTargetButton(props: OpenTargetButtonProps): ReactNode {
+  const { applications, defaultId, kind, t } = props
+  const [menuOpen, setMenuOpen] = useState(false)
+  const { pending, toast, act } = useOpenTargetGesture(props.execute, t)
+  const preferred = applications.find(app => app.id === defaultId)
+  const disabled = pending || props.busy === true || props.loading === true
+  const hasMenu = props.loading === true || props.failed || applications.length + (kind === 'file' ? 1 : 0) > 1
+  const revealDefault = kind === 'file' && preferred === undefined && props.loading !== true
+  const primaryLabel = preferred === undefined ? t('path.reveal') : t('open.title', { app: preferred.name })
+  const run = (operation: OpenTargetOperation): void => { setMenuOpen(false); act(operation) }
+  const primary = (): void => { run({ kind: revealDefault ? 'reveal' : 'default' }) }
+  const icon = props.loading === true && preferred === undefined
+    ? <span className={css.skeleton} data-open-target-skeleton aria-hidden="true" style={{ width: props.prominent ? 18 : 13, height: props.prominent ? 18 : 13 }} />
+    : revealDefault
+      ? <IconFolderOpenOutlineRegular size={props.prominent ? 18 : 13} />
+      : <ApplicationIcon key={preferred?.icon} source={preferred?.icon ?? null} size={props.prominent ? 18 : 13} />
+  return (
+    <>
+      <Menu
+        className={css.menuAnchor}
+        open={menuOpen && !disabled && hasMenu}
+        autoFocus
+        portal
+        dense
+        align="end"
+        onClose={() => { setMenuOpen(false) }}
+        items={[
+          ...applications.map(app => ({
+            id: `app:${app.id}`,
+            icon: <ApplicationIcon key={app.icon} source={app.icon} />,
+            label: app.id === defaultId ? t('path.appDefault', { app: app.name }) : app.name,
+          })),
+          ...(props.failed ? [{ id: 'unavailable', label: t('path.appsError'), disabled: true }] : []),
+        ]}
+        footer={kind === 'file' ? [{
+          id: 'reveal', icon: <IconFolderOpenOutlineRegular />,
+          label: revealDefault ? t('path.appDefault', { app: t('path.reveal') }) : t('path.reveal'),
+        }] : []}
+        onSelect={(id) => { run(id === 'reveal' ? { kind: 'reveal' } : { kind: 'application', id: id.slice(4) }) }}
+        anchor={(
+          <div className={css.split} data-open-target={kind} data-size={props.prominent ? 'large' : 'compact'}
+            data-open-path={kind === 'file' && !props.prominent ? '' : undefined} data-state={disabled ? 'busy' : 'idle'}>
+            <Tooltip portal label={primaryLabel} side="bottom" delayMs={500}>
+              <button type="button" className={css.main} disabled={disabled} aria-label={props.prominent ? undefined : primaryLabel}
+                data-open-path-open={kind === 'file' && !props.prominent ? '' : undefined}
+                data-open-path-unpreviewable={props.prominent ? '' : undefined} onClick={primary}>
+                {icon}{(props.prominent) && (revealDefault ? t('path.reveal') : t('path.open'))}
+              </button>
+            </Tooltip>
+            {hasMenu && <button
+              type="button" className={css.chevron} disabled={disabled}
+              aria-haspopup="menu" aria-expanded={menuOpen && !disabled} aria-label={t('path.more')}
+              data-open-path-more={kind === 'file' && !props.prominent ? '' : undefined}
+              onClick={() => {
+                if (!menuOpen) props.refresh?.()
+                setMenuOpen(value => !value)
+              }}
+            >
+              <IconChevronDownOutlineRegular size={10} />
+            </button>}
+          </div>
+        )}
+      />
+      {toast}
+    </>
+  )
+}
diff --git a/packages/client/ui-open-in-app/src/client/file-applications.ts b/packages/client/ui-open-in-app/src/client/file-applications.ts
new file mode 100644
index 0000000000..5b80c14575
--- /dev/null
+++ b/packages/client/ui-open-in-app/src/client/file-applications.ts
@@ -0,0 +1,73 @@
+/** File association reads shared by mounted controls using the same reader and target. */
+import { useCallback, useSyncExternalStore } from 'react'
+import { createSnapshotStore, type SnapshotStore } from '@deepseek-ai/dsh-client-store'
+import type { SessionWorkspacePathApplication } from '@deepseek-ai/dsh-api-session-controller/types'
+
+type Query = (target: string, signal: AbortSignal) => Promise<readonly SessionWorkspacePathApplication[] | null>
+interface Result {
+  apps: readonly SessionWorkspacePathApplication[]
+  loading: boolean
+  failed: boolean
+}
+interface Entry {
+  state: SnapshotStore<Result>
+  users: number
+  controller: AbortController | null
+  refresh: () => void
+}
+const EMPTY: Result = { apps: [], loading: true, failed: false }
+const readers = new WeakMap<Query, Map<string, Entry>>()
+
+/** Each mounted consumer retains the query; the last release cancels and discards it. */
+function subscribe(query: Query, target: string, listener: () => void): () => void {
+  let targets = readers.get(query)
+  if (targets === undefined) { targets = new Map(); readers.set(query, targets) }
+  let entry = targets.get(target)
+  const initial = entry === undefined
+  if (entry === undefined) {
+    const created: Entry = {
+      state: createSnapshotStore<Result>(EMPTY), users: 0, controller: null,
+      refresh: () => {
+        created.controller?.abort()
+        const controller = new AbortController()
+        created.controller = controller
+        void query(target, controller.signal).then((apps) => {
+          if (!controller.signal.aborted) created.state.set({ apps: apps ?? [], loading: false, failed: apps === null })
+        })
+      },
+    }
+    entry = created
+    targets.set(target, entry)
+  }
+  const retained = entry
+  retained.users += 1
+  const release = retained.state.subscribe(listener)
+  if (initial) retained.refresh()
+  return () => {
+    release()
+    retained.users -= 1
+    if (retained.users === 0) {
+      retained.controller?.abort()
+      targets.delete(target)
+    }
+  }
+}
+
+/**
+ * Share associations and refreshes across mounted controls for the same file and reader.
+ * @param target - path or authenticated route identifying the current file.
+ * @param query - stable reader scoped to the serving Host; failures resolve to null.
+ * @param enabled - whether a native desktop is available.
+ * @returns metadata, initial loading state, failure state, and a shared refresh callback.
+ */
+export function useFileApplications(
+  target: string, query: Query, enabled: boolean,
+): Result & { refresh: () => void } {
+  const retain = useCallback((listener: () => void) => enabled ? subscribe(query, target, listener) : () => {}, [enabled, query, target])
+  const snapshot = useCallback(
+    () => enabled ? readers.get(query)?.get(target)?.state.getSnapshot() ?? EMPTY : EMPTY, [enabled, query, target],
+  )
+  const state = useSyncExternalStore(retain, snapshot, snapshot)
+  const refresh = useCallback(() => { readers.get(query)?.get(target)?.refresh() }, [query, target])
+  return { ...state, refresh }
+}
diff --git a/packages/client/ui-open-in-app/src/client/index.ts b/packages/client/ui-open-in-app/src/client/index.ts
index 4073eaec1f..95f753b16f 100644
--- a/packages/client/ui-open-in-app/src/client/index.ts
+++ b/packages/client/ui-open-in-app/src/client/index.ts
@@ -1,12 +1,7 @@
 /**
- * Browser half of open-in-app: one Session-header split button opening the
- * session's workspace directory (the summary's `cwd`) in the remembered
- * installed application, and the document preview's default-application
- * controls opening one previewed file. Application availability arrives once
- * per page from the host apps route and the last choice persists in the
- * browser through the controller's persisted snapshot store; desktop
- * availability for file paths arrives once per page from the Session Remote,
- * which also runs the open and reveal gestures.
+ * Shared native opening controls for workspace directories, document previews,
+ * delivery cards, and changed-file review. Directory choices persist in the browser;
+ * file defaults and application lists come from the serving Host desktop.
  */
 
 import type { Context as ClientContext } from '@deepseek-ai/cordis'
@@ -22,6 +17,7 @@ import { OpenInAppController } from './controller.ts'
 import { OpenInAppAction, type OpenInAppActionInjected } from './OpenInAppAction.tsx'
 import { OpenInAppPathController } from './open-path.ts'
 import { OpenPathAction, type OpenPathInjected } from './OpenPathAction.tsx'
+import { FileRouteAction } from './FileRouteAction.tsx'
 import { OpenPathEmptyAction } from './OpenPathEmptyAction.tsx'
 import { en, NS, zh, type OpenInAppKey } from './locales.ts'
 
@@ -65,10 +61,12 @@ export function apply(ctx: ClientContext): void {
       iconUrl: appId => `${OPEN_IN_APP_ICON_PREFIX_ROUTE}/${appId}`,
     }),
   }, OpenInAppAction))
+  const applications: OpenPathInjected['applications'] = (path, signal) => paths.applications(path, signal)
   const pathInjected = (): OpenPathInjected => ({
     hooks: { openInAppDesktop: paths.desktop },
     loadDesktop: () => paths.load(),
-    openPath: (path, action) => paths.openPath(path, action),
+    openPath: (path, action, application) => paths.openPath(path, action, application),
+    applications,
   })
   ctx.slots.inject('sidebar.right.tab.document.actions', () => ctx.slots.register({
     name: 'sidebar.right.tab.document.actions',
@@ -82,4 +80,10 @@ export function apply(ctx: ClientContext): void {
     locale: NS,
     inject: pathInjected,
   }, OpenPathEmptyAction))
+  ctx.slots.inject('deliverables.file.actions', () => ctx.slots.register({
+    name: 'deliverables.file.actions', id: 'open-in-app', locale: NS,
+  }, FileRouteAction))
+  ctx.slots.inject('deliverables.review.file.actions', () => ctx.slots.register({
+    name: 'deliverables.review.file.actions', id: 'open-in-app', locale: NS,
+  }, FileRouteAction))
 }
diff --git a/packages/client/ui-open-in-app/src/client/locales.ts b/packages/client/ui-open-in-app/src/client/locales.ts
index 6d32f759a0..e8aedbdbf9 100644
--- a/packages/client/ui-open-in-app/src/client/locales.ts
+++ b/packages/client/ui-open-in-app/src/client/locales.ts
@@ -39,17 +39,12 @@ const PRODUCT_NAMES = {
 
 /** Simplified Chinese dictionary (the key-set source of truth). */
 export const zh = {
-  'open.title': '在 {app} 中打开工作目录',
-  'open.tooltip': '在本地打开',
-  'open.error': '打开失败',
-  'menu.toggle': '选择打开方式',
-  'menu.aria': '打开方式',
+  'open.title': '用 {app} 打开',
+  'path.appDefault': '{app}（默认）',
+  'path.appsError': '无法获取应用列表',
   'path.open': '打开',
-  'path.open.tooltip': '用默认应用打开',
   'path.more': '更多打开方式',
-  'path.defaultApp': '用默认应用打开',
   'path.reveal': '显示文件位置',
-  'path.unpreviewable': '用默认应用打开',
   'path.openError': '打开失败，请重试',
   'path.revealError': '无法显示文件位置，请重试',
   ...PRODUCT_NAMES,
@@ -61,17 +56,12 @@ export const zh = {
 
 /** English dictionary, key-identical to the Chinese source of truth. */
 export const en: Record<OpenInAppKey, string> = {
-  'open.title': 'Open workspace in {app}',
-  'open.tooltip': 'Open locally',
-  'open.error': 'Failed to open',
-  'menu.toggle': 'Choose an app to open in',
-  'menu.aria': 'Open in',
+  'open.title': 'Open in {app}',
+  'path.appDefault': '{app} (default)',
+  'path.appsError': 'Could not load applications',
   'path.open': 'Open',
-  'path.open.tooltip': 'Open in default app',
   'path.more': 'More ways to open',
-  'path.defaultApp': 'Open in default app',
   'path.reveal': 'Show file location',
-  'path.unpreviewable': 'Open in default app',
   'path.openError': 'Could not open. Try again.',
   'path.revealError': 'Could not show the file location. Try again.',
   ...PRODUCT_NAMES,
diff --git a/packages/client/ui-open-in-app/src/client/open-path.ts b/packages/client/ui-open-in-app/src/client/open-path.ts
index 161fcf104f..e403a80da9 100644
--- a/packages/client/ui-open-in-app/src/client/open-path.ts
+++ b/packages/client/ui-open-in-app/src/client/open-path.ts
@@ -1,11 +1,10 @@
 /**
- * Default-application actions on one Host file path, over the Session Remote:
- * whether this Host can hand a path to a desktop, and the open or reveal call.
+ * Host desktop availability, file associations, and open/reveal actions over the Session Remote.
  * The desktop answer is read once per page; a failed read renders no control.
  */
 import { createSnapshotStore, type SnapshotStore } from '@deepseek-ai/dsh-client-store'
 import type { RemoteResult } from '@deepseek-ai/dsh-api-remotes/client'
-import type { SessionOpenWorkspacePathRequest } from '@deepseek-ai/dsh-api-session-controller/types'
+import type { SessionOpenWorkspacePathRequest, SessionWorkspacePathApplication } from '@deepseek-ai/dsh-api-session-controller/types'
 
 /** What a path gesture asks of the Host desktop: the default application, or the file manager showing the file. */
 export type OpenInAppPathAction = 'open' | 'reveal'
@@ -18,6 +17,10 @@ export interface OpenInAppPathRemote {
   readonly session: {
     /** Whether the Host can hand a workspace path to a native desktop. */
     canOpenWorkspacePath(): Promise<RemoteResult<boolean>>
+    /** Current registered file handlers and their default selection. */
+    workspacePathApplications(
+      request: { path: string }, signal?: AbortSignal,
+    ): Promise<RemoteResult<readonly SessionWorkspacePathApplication[]>>
     /** Open one Host path in its default application, or reveal it in the file manager. */
     openWorkspacePath(request: SessionOpenWorkspacePathRequest, signal?: AbortSignal): Promise<RemoteResult<unknown>>
   }
@@ -47,10 +50,11 @@ export class OpenInAppPathController {
    * Open one Host path in its default application, or reveal it in the file manager.
    * @param path - absolute path on the Host, as the file's metadata reports it.
    * @param action - default application open, or file-manager reveal.
+   * @param application - registered application path for an explicit open.
    * @returns the failure kind to announce, or `null` once the Host acknowledged.
    */
-  async openPath(path: string, action: OpenInAppPathAction): Promise<OpenInAppPathFailure | null> {
-    const request: SessionOpenWorkspacePathRequest = action === 'reveal' ? { path, action } : { path }
+  async openPath(path: string, action: OpenInAppPathAction, application?: string): Promise<OpenInAppPathFailure | null> {
+    const request: SessionOpenWorkspacePathRequest = action === 'reveal' ? { path, action } : { path, ...(application === undefined ? {} : { application }) }
     let ok = false
     try {
       ok = (await this.remote.session.openWorkspacePath(request)).ok
@@ -61,6 +65,23 @@ export class OpenInAppPathController {
     return ok ? null : action === 'open' ? 'openError' : 'revealError'
   }
 
+  /**
+   * Refresh the file's OS associations; failures remain distinct from an empty handler list.
+   * @param path - file path reported by the Host.
+   * @param signal - lifetime of the requesting preview.
+   * @returns application metadata, or null when the query fails.
+   */
+  async applications(path: string, signal: AbortSignal): Promise<readonly SessionWorkspacePathApplication[] | null> {
+    let result: RemoteResult<readonly SessionWorkspacePathApplication[]>
+    try {
+      result = await this.remote.session.workspacePathApplications({ path }, signal)
+    } catch (_error) {
+      // The control reports query failure and keeps file reveal available.
+      return null
+    }
+    return result.ok ? result.value : null
+  }
+
   private async run(): Promise<void> {
     let available = false
     try {
diff --git a/packages/client/ui-open-in-app/tests/browser-plugin.client.spec.ts b/packages/client/ui-open-in-app/tests/browser-plugin.client.spec.ts
index dab2b08df0..4c86980614 100644
--- a/packages/client/ui-open-in-app/tests/browser-plugin.client.spec.ts
+++ b/packages/client/ui-open-in-app/tests/browser-plugin.client.spec.ts
@@ -24,6 +24,7 @@ afterEach(() => {
 /** The Session Remote slice the path controls call; answers a desktop and acknowledges every gesture. */
 const remote = {
   session: {
+    workspacePathApplications: vi.fn(async () => ({ ok: true as const, value: [] })),
     canOpenWorkspacePath: vi.fn(async () => ({ ok: true as const, value: true })),
     openWorkspacePath: vi.fn(async () => ({ ok: true as const, value: { opened: true as const } })),
   },
@@ -39,6 +40,8 @@ async function bench(): Promise<{ ctx: Context; fiber: ReturnType<Context['plugi
       'conversation.session.header.utilities': { kind: 'list', scope: 'session' },
       'sidebar.right.tab.document.actions': { kind: 'list', scope: 'session' },
       'sidebar.right.tab.document.unpreviewable': { kind: 'list', scope: 'session' },
+      'deliverables.file.actions': { kind: 'list', scope: 'session' },
+      'deliverables.review.file.actions': { kind: 'list', scope: 'session' },
     },
   } as never, () => null)
   ctx.provide('sessions', {})
@@ -66,19 +69,25 @@ describe('open-in-app browser half', () => {
     const empty = ctx.slots.entries('sidebar.right.tab.document.unpreviewable')[0]
     expect(header?.component).toBe(OpenPathAction)
     expect(empty?.component).toBe(OpenPathEmptyAction)
+    expect(ctx.slots.entries('deliverables.file.actions')).toHaveLength(1)
     expect(header?.options).toMatchObject({ id: 'open-in-app' })
     const face = (header?.inject as unknown as () => OpenPathInjected)()
     const emptyFace = (empty?.inject as unknown as () => OpenPathInjected)()
     expect(emptyFace.hooks.openInAppDesktop).toBe(face.hooks.openInAppDesktop)
+    expect(emptyFace.applications).toBe(face.applications)
     expect(face.hooks.openInAppDesktop.getSnapshot()).toBeNull()
     await Promise.all([face.loadDesktop(), emptyFace.loadDesktop()])
     expect(remote.session.canOpenWorkspacePath).toHaveBeenCalledOnce()
+    const signal = new AbortController().signal
+    await expect(face.applications('/w/clip.mp4', signal)).resolves.toEqual([])
+    expect(remote.session.workspacePathApplications).toHaveBeenCalledWith({ path: '/w/clip.mp4' }, signal)
     expect(face.hooks.openInAppDesktop.getSnapshot()).toBe(true)
     expect(await face.openPath('/w/clip.mp4', 'reveal')).toBeNull()
     expect(remote.session.openWorkspacePath).toHaveBeenLastCalledWith({ path: '/w/clip.mp4', action: 'reveal' })
     await fiber.dispose()
     expect(ctx.slots.entries('sidebar.right.tab.document.actions').map(entry => entry.options.id)).not.toContain('open-in-app')
     expect(ctx.slots.entries('sidebar.right.tab.document.unpreviewable').map(entry => entry.options.id)).not.toContain('open-in-app')
+    expect(ctx.slots.entries('deliverables.file.actions')).toHaveLength(0)
   })
 
   it('registers the header split button, and fiber teardown removes it (HMR safety)', async () => {
@@ -143,11 +152,11 @@ describe('open-in-app browser half', () => {
     const { ctx, fiber } = await bench()
     ctx.locale.setLocale('zh')
     const translate = ctx.locale.bind(NS)
-    expect(translate('menu.aria')).toBe(zh['menu.aria'])
+    expect(translate('path.more')).toBe(zh['path.more'])
     ctx.locale.setLocale('en')
-    expect(translate('menu.aria')).toBe(en['menu.aria'])
+    expect(translate('path.more')).toBe(en['path.more'])
     await fiber.dispose()
-    expect(translate('menu.aria')).not.toBe(en['menu.aria'])
+    expect(translate('path.more')).not.toBe(en['path.more'])
   })
 
   it('keeps the English dictionary key-identical to the Chinese source of truth', () => {
diff --git a/packages/client/ui-open-in-app/tests/file-applications.client.spec.tsx b/packages/client/ui-open-in-app/tests/file-applications.client.spec.tsx
new file mode 100644
index 0000000000..273f78deed
--- /dev/null
+++ b/packages/client/ui-open-in-app/tests/file-applications.client.spec.tsx
@@ -0,0 +1,53 @@
+// @vitest-environment jsdom
+/** Shared association reads retain one native request until the last control leaves. */
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, expect, it, vi } from 'vitest'
+import type { SessionWorkspacePathApplication } from '@deepseek-ai/dsh-api-session-controller/types'
+import { useFileApplications } from '../src/client/file-applications.ts'
+
+afterEach(cleanup)
+const music = [{ id: 'music', name: 'Music', default: true, icon: null }]
+
+it('shares the initial read and publishes a menu refresh to both controls', async () => {
+  const query = vi.fn(async () => music)
+  const first = renderHook(() => useFileApplications('/file.mp3', query, true))
+  const second = renderHook(() => useFileApplications('/file.mp3', query, true))
+  await act(async () => {})
+  expect(query).toHaveBeenCalledOnce()
+  expect(first.result.current.apps).toBe(second.result.current.apps)
+  query.mockResolvedValueOnce([{ id: 'player', name: 'Player', default: true, icon: null }])
+  await act(async () => { second.result.current.refresh() })
+  expect(query).toHaveBeenCalledTimes(2)
+  expect(first.result.current.apps[0]?.id).toBe('player')
+  expect(second.result.current.apps).toBe(first.result.current.apps)
+})
+
+it('cancels only after the last consumer leaves and discards the released result', async () => {
+  const pending = Promise.withResolvers<readonly SessionWorkspacePathApplication[] | null>()
+  const query = vi.fn((_path: string, _signal: AbortSignal) => pending.promise)
+  const first = renderHook(() => useFileApplications('/file.mp3', query, true))
+  const second = renderHook(() => useFileApplications('/file.mp3', query, true))
+  const signal = query.mock.calls[0]![1]
+  first.unmount()
+  expect(signal.aborted).toBe(false)
+  second.unmount()
+  expect(signal.aborted).toBe(true)
+  await act(async () => { pending.resolve(music) })
+  const next = renderHook(() => useFileApplications('/file.mp3', query, true))
+  expect(query).toHaveBeenCalledTimes(2)
+  await act(async () => {})
+  expect(next.result.current.apps).toEqual(music)
+})
+
+it('keeps disabled controls out of the query and permits refresh only while retained', async () => {
+  const query = vi.fn(async () => music)
+  const view = renderHook(({ enabled }) => useFileApplications('/file.mp3', query, enabled), { initialProps: { enabled: false } })
+  act(() => { view.result.current.refresh() })
+  expect(query).not.toHaveBeenCalled()
+  view.rerender({ enabled: true })
+  await act(async () => {})
+  expect(view.result.current.apps).toEqual(music)
+  view.rerender({ enabled: false })
+  act(() => { view.result.current.refresh() })
+  expect(query).toHaveBeenCalledOnce()
+})
diff --git a/packages/client/ui-open-in-app/tests/file-route-action.client.spec.tsx b/packages/client/ui-open-in-app/tests/file-route-action.client.spec.tsx
new file mode 100644
index 0000000000..d67cf7127c
--- /dev/null
+++ b/packages/client/ui-open-in-app/tests/file-route-action.client.spec.tsx
@@ -0,0 +1,53 @@
+// @vitest-environment jsdom
+/** Authorized file routes use the same application menu and failure feedback as previews. */
+import { act, cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, expect, it, vi } from 'vitest'
+import { makeTranslate } from '@deepseek-ai/dsh-client-test-runtime'
+import { FileRouteAction } from '../src/client/FileRouteAction.tsx'
+import { en } from '../src/client/locales.ts'
+
+afterEach(() => { cleanup(); vi.unstubAllGlobals() })
+const apps = [{ id: 'music', name: 'Music', default: true, icon: null }]
+const props = () => ({ actionUrl: 'api/present.open?sessionId=s&seq=2&index=0', available: true, pending: false,
+  onAction: vi.fn(async () => null), t: makeTranslate(en) })
+
+it('queries the authorized route, selects a handler, and keeps reveal last', async () => {
+  const fetcher = vi.fn(async () => Response.json(apps))
+  vi.stubGlobal('fetch', fetcher)
+  const p = props()
+  render(<FileRouteAction {...p} />)
+  await act(async () => {})
+  expect(fetcher).toHaveBeenCalledWith(p.actionUrl, { signal: expect.any(AbortSignal) as AbortSignal })
+  fireEvent.mouseEnter(screen.getByRole('button', { name: 'Open in Music' }))
+  expect(await screen.findByRole('tooltip')).toHaveProperty('textContent', 'Open in Music')
+  await act(async () => { fireEvent.click(screen.getByRole('button', { name: en['path.more'] })) })
+  expect(screen.getAllByRole('menuitem').map(item => item.textContent)).toEqual(['Music (default)', 'Show file location'])
+  await act(async () => { fireEvent.click(screen.getByRole('menuitem', { name: 'Music (default)' })) })
+  expect(p.onAction).toHaveBeenLastCalledWith('open', 'music')
+  await act(async () => { fireEvent.click(screen.getByRole('button', { name: 'Open in Music' })) })
+  expect(p.onAction).toHaveBeenLastCalledWith('open', undefined)
+})
+
+it.each(['http', 'transport', 'invalid'] as const)('keeps reveal available after a %s query failure', async (failure) => {
+  vi.stubGlobal('fetch', vi.fn(async () => {
+    if (failure === 'transport') throw new Error('offline')
+    return failure === 'http' ? new Response(null, { status: 404 }) : Response.json({ invalid: true })
+  }))
+  const p = props()
+  render(<FileRouteAction {...p} />)
+  await act(async () => {})
+  await act(async () => { fireEvent.click(screen.getByRole('button', { name: en['path.reveal'] })) })
+  expect(p.onAction).toHaveBeenCalledWith('reveal', undefined)
+})
+
+it('does not query without a desktop and honors another pending gesture', async () => {
+  const fetcher = vi.fn(async () => Response.json(apps))
+  vi.stubGlobal('fetch', fetcher)
+  const p = props()
+  const view = render(<FileRouteAction {...p} available={false} />)
+  expect(view.container.innerHTML).toBe('')
+  expect(fetcher).not.toHaveBeenCalled()
+  view.rerender(<FileRouteAction {...p} pending />)
+  await act(async () => {})
+  expect(screen.getByRole('button', { name: 'Open in Music' })).toHaveProperty('disabled', true)
+})
diff --git a/packages/client/ui-open-in-app/tests/open-in-app-action.client.spec.tsx b/packages/client/ui-open-in-app/tests/open-in-app-action.client.spec.tsx
index 62f1ba2295..23b2c943bc 100644
--- a/packages/client/ui-open-in-app/tests/open-in-app-action.client.spec.tsx
+++ b/packages/client/ui-open-in-app/tests/open-in-app-action.client.spec.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { cleanup, fireEvent, render, screen, waitFor, act } from '@testing-library/react'
+import { cleanup, fireEvent, render, screen, act } from '@testing-library/react'
 import { makeTranslate } from '@deepseek-ai/dsh-client-test-runtime'
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
 import type { SessionListState } from '@deepseek-ai/dsh-api-session-controller/client'
@@ -29,15 +29,12 @@ function bench(over: {
   cwd?: string
   launch?: (appId: string, path: string) => Promise<void>
 } = {}): Bench {
-  const state = {
+  const state: SessionListState = {
     ids: [SESSION],
-    byId: over.cwd === undefined ? {} : { [SESSION]: { cwd: over.cwd } },
-    current: SESSION,
+    byId: over.cwd === undefined ? {} : { [SESSION]: { id: SESSION, displayTitle: 'Workspace', cwd: over.cwd, running: false, retainedBy: {}, blank: false, updatedAt: 0 } },
     phase: 'ready',
     projectionsBySession: {},
-    jobsBySession: {},
-    currentAddress: undefined,
-  } as unknown as SessionListState
+  }
   const apps = createSnapshotStore<readonly string[] | null>(over.apps ?? null)
   const choice = createSnapshotStore<string>(over.choice ?? '')
   const launch = vi.fn(over.launch ?? (async () => {}))
@@ -57,7 +54,7 @@ function bench(over: {
     choose,
     iconUrl: (appId: string) => `open-in-app/icon/${appId}`,
     t,
-  } as unknown as OpenInAppActionProps
+  } as OpenInAppActionProps
   return { props, launch, choose }
 }
 
@@ -79,165 +76,73 @@ describe('OpenInAppAction visibility', () => {
 
   it('shows the remembered choice, falling back to the first available app when it is gone', () => {
     render(<OpenInAppAction {...bench({ apps: ['finder', 'cursor'], choice: 'cursor', cwd: '/w' }).props} />)
-    expect(screen.getByRole('button', { name: zh['open.title'].replace('{app}', 'Cursor') })).toBeDefined()
+    expect(screen.getByRole('button', { name: t('open.title', { app: 'Cursor' }) }).querySelector('img')?.getAttribute('src')).toBe('open-in-app/icon/cursor')
     cleanup()
 
     render(<OpenInAppAction {...bench({ apps: ['finder', 'cursor'], choice: 'vscode', cwd: '/w' }).props} />)
-    expect(screen.getByRole('button', { name: zh['open.title'].replace('{app}', zh['app.finder']) })).toBeDefined()
+    expect(screen.getByRole('button', { name: t('open.title', { app: zh['app.finder'] }) }).querySelector('img')?.getAttribute('src')).toBe('open-in-app/icon/finder')
   })
 })
 
 describe('OpenInAppAction launching', () => {
-  it('launches without painting the busy dress when the launch settles quickly', async () => {
-    let resolve: () => void = () => {}
-    const b = bench({
-      apps: ['finder'],
-      cwd: '/w/dir',
-      launch: () => new Promise((r) => { resolve = r }),
-    })
+  it('disables both buttons and ignores duplicate gestures until the launch settles', async () => {
+    const pending = Promise.withResolvers<undefined>()
+    const b = bench({ apps: ['finder', 'cursor'], cwd: '/w/dir', launch: () => pending.promise })
+    const view = render(<OpenInAppAction {...b.props} />)
+    const main = screen.getByRole('button', { name: t('open.title', { app: zh['app.finder'] }) })
+    fireEvent.click(main)
+    expect(main).toHaveProperty('disabled', true)
+    expect(screen.getByRole('button', { name: zh['path.more'] })).toHaveProperty('disabled', true)
+    fireEvent.click(main)
+    expect(b.launch).toHaveBeenCalledOnce()
+    expect(view.container.querySelector('[data-open-target]')?.getAttribute('data-state')).toBe('busy')
+    await act(async () => { pending.resolve(undefined) })
+    expect(main).toHaveProperty('disabled', false)
+  })
+
+  it('announces launch failure without changing the remembered application', async () => {
+    const b = bench({ apps: ['finder', 'cursor'], cwd: '/w', launch: async () => { throw new Error('gone') } })
     render(<OpenInAppAction {...b.props} />)
-    const main = screen.getByRole('button', { name: zh['open.title'].replace('{app}', zh['app.finder']) })
-    fireEvent.click(main)
-    expect(b.launch).toHaveBeenCalledWith('finder', '/w/dir')
-    // No flash: the button keeps its idle dress while the launch is fast.
-    expect((main as HTMLButtonElement).disabled).toBe(false)
-    expect(main.getAttribute('data-state')).toBe('idle')
-    // A second click while in flight is ignored rather than double-launching.
-    fireEvent.click(main)
-    expect(b.launch).toHaveBeenCalledTimes(1)
-
-    resolve()
-    await waitFor(() => {
-      fireEvent.click(main)
-      expect(b.launch).toHaveBeenCalledTimes(2)
-    })
+    fireEvent.click(screen.getByRole('button', { name: zh['path.more'] }))
+    await act(async () => { fireEvent.click(screen.getByRole('menuitem', { name: 'Cursor' })) })
+    expect(screen.getByRole('alert').textContent).toContain(zh['path.openError'])
+    expect(b.choose).not.toHaveBeenCalled()
   })
 
-  it('dresses a slow launch as busy, then shows the error state on failure', async () => {
-    vi.useFakeTimers()
-    let reject: (error: Error) => void = () => {}
-    const b = bench({
-      apps: ['finder'],
-      cwd: '/w/dir',
-      launch: () => new Promise((_, r) => { reject = r }),
-    })
-    render(<OpenInAppAction {...b.props} />)
-    const main = screen.getByRole('button', { name: zh['open.title'].replace('{app}', zh['app.finder']) })
-    fireEvent.click(main)
-
-    // The busy dress appears only after the launch has taken a while.
-    act(() => { vi.advanceTimersByTime(300) })
-    expect((main as HTMLButtonElement).disabled).toBe(true)
-    expect(main.getAttribute('data-state')).toBe('busy')
-
-    act(() => { reject(new Error('launch failed')) })
-    await act(async () => { await vi.runOnlyPendingTimersAsync() })
-    expect(screen.getByRole('button', { name: zh['open.title'].replace('{app}', zh['app.finder']) })).toBeDefined()
-  })
-
-  it('shows the error state and decays back to idle after a fast failure', async () => {
-    const b = bench({
-      apps: ['finder'],
-      cwd: '/w/dir',
-      launch: () => Promise.reject(new Error('launch failed')),
-    })
-    render(<OpenInAppAction {...b.props} />)
-    const main = screen.getByRole('button', { name: zh['open.title'].replace('{app}', zh['app.finder']) })
-    fireEvent.click(main)
-    await waitFor(() => {
-      expect(screen.getByRole('button', { name: zh['open.error'] })).toBeDefined()
-    })
-    // The error state decays back to idle.
-    await waitFor(() => {
-      expect(screen.getByRole('button', { name: zh['open.title'].replace('{app}', zh['app.finder']) })).toBeDefined()
-    }, { timeout: 4_000 })
-  })
-
-  it('shows the product tooltip on hover instead of a native title', async () => {
-    render(<OpenInAppAction {...bench({ apps: ['finder'], cwd: '/w/dir' }).props} />)
-    const main = screen.getByRole('button', { name: zh['open.title'].replace('{app}', zh['app.finder']) })
-    expect(main.getAttribute('title')).toBeNull()
-    fireEvent.mouseEnter(main)
-    expect(await screen.findByText(zh['open.tooltip'])).toBeDefined()
-    fireEvent.mouseLeave(main)
-    await waitFor(() => {
-      expect(screen.queryByText(zh['open.tooltip'])).toBeNull()
-    })
-  })
-
-  it('opens the menu from the chevron, launches and persists a picked app', async () => {
+  it('lists only applications, marks the remembered default, and remembers a successful choice', async () => {
     const b = bench({ apps: ['finder', 'cursor', 'terminal'], cwd: '/w/dir' })
     render(<OpenInAppAction {...b.props} />)
-    fireEvent.click(screen.getByRole('button', { name: zh['menu.toggle'] }))
-    const cursorItem = await screen.findByText('Cursor')
-    fireEvent.click(cursorItem)
-    expect(b.choose).toHaveBeenCalledWith('cursor')
+    fireEvent.click(screen.getByRole('button', { name: zh['path.more'] }))
+    expect(screen.getAllByRole('menuitem').map(item => item.textContent)).toEqual(['访达（默认）', 'Cursor', '终端'])
+    expect(screen.queryByText(zh['path.reveal'])).toBeNull()
+    await act(async () => { fireEvent.click(screen.getByRole('menuitem', { name: 'Cursor' })) })
     expect(b.launch).toHaveBeenCalledWith('cursor', '/w/dir')
+    expect(b.choose).toHaveBeenCalledWith('cursor')
   })
 
-  it('ignores a menu pick while a launch is in flight', async () => {
-    let resolve: () => void = () => {}
-    const b = bench({
-      apps: ['finder', 'cursor'],
-      cwd: '/w/dir',
-      launch: () => new Promise((r) => { resolve = r }),
-    })
-    render(<OpenInAppAction {...b.props} />)
-    fireEvent.click(screen.getByRole('button', { name: zh['open.title'].replace('{app}', zh['app.finder']) }))
-    expect(b.launch).toHaveBeenCalledTimes(1)
-    fireEvent.click(screen.getByRole('button', { name: zh['menu.toggle'] }))
-    fireEvent.click(await screen.findByText('Cursor'))
-    // Mid-flight the pick is ignored whole: no persisted choice, no launch.
-    expect(b.choose).not.toHaveBeenCalled()
-    expect(b.launch).toHaveBeenCalledTimes(1)
-    resolve()
-    await act(async () => {})
-  })
-
-  it('clears a pending error decay when a retry starts', async () => {
-    vi.useFakeTimers()
-    const outcomes: Array<() => Promise<void>> = [
-      () => Promise.reject(new Error('launch failed')),
-      // The retry stays in flight past the original decay deadline.
-      () => new Promise(() => {}),
-    ]
-    const b = bench({
-      apps: ['finder'],
-      cwd: '/w/dir',
-      launch: () => (outcomes.shift() ?? (() => Promise.resolve()))(),
-    })
-    render(<OpenInAppAction {...b.props} />)
-    fireEvent.click(screen.getByRole('button', { name: zh['open.title'].replace('{app}', zh['app.finder']) }))
-    await act(async () => {})
-    fireEvent.click(screen.getByRole('button', { name: zh['open.error'] }))
-    // Past the first failure's 2s decay: the stale timer must not flip the
-    // in-flight retry's busy dress back to a clickable idle button.
-    act(() => { vi.advanceTimersByTime(2_500) })
-    const main = screen.getByRole('button', { name: zh['open.title'].replace('{app}', zh['app.finder']) })
-    expect(main.getAttribute('data-state')).toBe('busy')
-    expect((main as HTMLButtonElement).disabled).toBe(true)
-  })
-
-  it('closes an open menu on Escape without launching', async () => {
-    const b = bench({ apps: ['finder', 'terminal'], cwd: '/w/dir' })
-    render(<OpenInAppAction {...b.props} />)
-    fireEvent.click(screen.getByRole('button', { name: zh['menu.toggle'] }))
-    await screen.findByText(zh['app.terminal'])
-    fireEvent.keyDown(document, { key: 'Escape' })
-    await waitFor(() => {
-      expect(screen.queryByText(zh['app.terminal'])).toBeNull()
-    })
+  it('closes on Escape without launching and falls back after an icon fails', async () => {
+    const b = bench({ apps: ['finder', 'terminal'], cwd: '/w' })
+    const view = render(<OpenInAppAction {...b.props} />)
+    fireEvent.click(screen.getByRole('button', { name: zh['path.more'] }))
+    fireEvent.keyDown(screen.getByRole('menu'), { key: 'Escape' })
+    expect(screen.queryByRole('menu')).toBeNull()
     expect(b.launch).not.toHaveBeenCalled()
+    const image = view.container.querySelector('img')!
+    fireEvent.error(image)
+    expect(view.container.querySelector('img')).toBeNull()
+    expect(view.container.querySelector('svg')).not.toBeNull()
   })
 
-  it('falls back to the generic icon after a failed image load', async () => {
-    const b = bench({ apps: ['terminal'], cwd: '/w/dir' })
-    const { container } = render(<OpenInAppAction {...b.props} />)
-    const img = container.querySelector('img')
-    if (img !== null) fireEvent.error(img)
-    await waitFor(() => {
-      expect(container.querySelector('img')).toBeNull()
-      expect(container.querySelector('svg path[fill-opacity="0.05"]')).not.toBeNull()
-    })
+  it('names the selected application in the tooltip', async () => {
+    render(<OpenInAppAction {...bench({ apps: ['finder'], cwd: '/w' }).props} />)
+    fireEvent.mouseEnter(screen.getByRole('button', { name: t('open.title', { app: zh['app.finder'] }) }))
+    expect(await screen.findByText(t('open.title', { app: zh['app.finder'] }))).toBeTruthy()
   })
 })
+
+
+it('omits the dropdown when only one directory application is available', () => {
+  render(<OpenInAppAction {...bench({ apps: ['finder'], cwd: '/w' }).props} />)
+  expect(screen.getAllByRole('button')).toHaveLength(1)
+  expect(screen.queryByRole('button', { name: zh['path.more'] })).toBeNull()
+})
diff --git a/packages/client/ui-open-in-app/tests/open-path-action.client.spec.tsx b/packages/client/ui-open-in-app/tests/open-path-action.client.spec.tsx
index ae9803c164..0a4a13f090 100644
--- a/packages/client/ui-open-in-app/tests/open-path-action.client.spec.tsx
+++ b/packages/client/ui-open-in-app/tests/open-path-action.client.spec.tsx
@@ -5,12 +5,13 @@
  * through their own toast.
  */
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { act, cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { act, cleanup, fireEvent, render, renderHook, screen } from '@testing-library/react'
 import { makeTranslate } from '@deepseek-ai/dsh-client-test-runtime'
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
 import { OpenPathAction, type OpenPathActionProps } from '../src/client/OpenPathAction.tsx'
 import { OpenPathEmptyAction, type OpenPathEmptyActionProps } from '../src/client/OpenPathEmptyAction.tsx'
 import type { OpenInAppPathAction, OpenInAppPathFailure } from '../src/client/open-path.ts'
+import { useOpenTargetGesture } from '../src/client/OpenTargetButton.tsx'
 import { zh } from '../src/client/locales.ts'
 
 afterEach(() => {
@@ -40,9 +41,10 @@ function bench(over: { desktop?: boolean | null; openPath?: Bench['openPath'] }
     absolutePath: ABSOLUTE_PATH,
     useOpenInAppDesktop: useSelector(desktop),
     loadDesktop,
+    applications: vi.fn(async () => [{ id: '/Music.app', name: 'Music', default: true, icon: null }]),
     openPath,
     t,
-  } as unknown as Bench['props']
+  } as Bench['props']
   return { props, desktop, loadDesktop, openPath }
 }
 
@@ -63,18 +65,19 @@ describe('OpenPathAction gestures', () => {
   it('opens the file in its default application from the main button and reveals it from the menu', async () => {
     const b = bench()
     render(<OpenPathAction {...b.props} />)
-    const main = screen.getByRole('button', { name: zh['path.open'] })
+    const main = await screen.findByRole('button', { name: t('open.title', { app: 'Music' }) })
     await act(async () => { fireEvent.click(main) })
-    expect(b.openPath).toHaveBeenLastCalledWith(ABSOLUTE_PATH, 'open')
+    expect(b.openPath).toHaveBeenLastCalledWith(ABSOLUTE_PATH, 'open', undefined)
     fireEvent.click(screen.getByRole('button', { name: zh['path.more'] }))
     await act(async () => { fireEvent.click(screen.getByRole('menuitem', { name: zh['path.reveal'] })) })
-    expect(b.openPath).toHaveBeenLastCalledWith(ABSOLUTE_PATH, 'reveal')
+    expect(b.openPath).toHaveBeenLastCalledWith(ABSOLUTE_PATH, 'reveal', undefined)
     expect(screen.queryByRole('menu')).toBeNull()
   })
 
   it('offers the default application from the menu too, and Escape closes the menu without a gesture', async () => {
     const b = bench()
     render(<OpenPathAction {...b.props} />)
+    await act(async () => {})
     const more = screen.getByRole('button', { name: zh['path.more'] })
     fireEvent.click(more)
     expect(more.getAttribute('aria-expanded')).toBe('true')
@@ -82,15 +85,15 @@ describe('OpenPathAction gestures', () => {
     expect(screen.queryByRole('menu')).toBeNull()
     expect(b.openPath).not.toHaveBeenCalled()
     fireEvent.click(more)
-    await act(async () => { fireEvent.click(screen.getByRole('menuitem', { name: zh['path.defaultApp'] })) })
-    expect(b.openPath).toHaveBeenLastCalledWith(ABSOLUTE_PATH, 'open')
+    await act(async () => { fireEvent.click(screen.getByRole('menuitem', { name: 'Music（默认）' })) })
+    expect(b.openPath).toHaveBeenLastCalledWith(ABSOLUTE_PATH, 'open', '/Music.app')
   })
 
   it('disables both halves while its own gesture settles and leaves no failure on the control', async () => {
     const settled = Promise.withResolvers<OpenInAppPathFailure | null>()
     const b = bench({ openPath: vi.fn(() => settled.promise) })
     const { container } = render(<OpenPathAction {...b.props} />)
-    const main = screen.getByRole('button', { name: zh['path.open'] })
+    const main = await screen.findByRole('button', { name: t('open.title', { app: 'Music' }) })
     fireEvent.click(main)
     expect(main).toHaveProperty('disabled', true)
     expect(screen.getByRole('button', { name: zh['path.more'] })).toHaveProperty('disabled', true)
@@ -111,8 +114,9 @@ describe('OpenPathEmptyAction', () => {
     cleanup()
     const b = bench()
     render(<OpenPathEmptyAction {...b.props} />)
-    await act(async () => { fireEvent.click(screen.getByRole('button', { name: zh['path.unpreviewable'] })) })
-    expect(b.openPath).toHaveBeenCalledWith(ABSOLUTE_PATH, 'open')
+    await act(async () => {})
+    await act(async () => { fireEvent.click(screen.getByRole('button', { name: zh['path.open'] })) })
+    expect(b.openPath).toHaveBeenCalledWith(ABSOLUTE_PATH, 'open', undefined)
     expect(screen.queryByRole('alert')).toBeNull()
   })
 
@@ -120,7 +124,8 @@ describe('OpenPathEmptyAction', () => {
     vi.useFakeTimers()
     const b = bench({ openPath: vi.fn(async () => 'openError' as const) })
     render(<OpenPathEmptyAction {...b.props} />)
-    await act(async () => { fireEvent.click(screen.getByRole('button', { name: zh['path.unpreviewable'] })) })
+    await act(async () => {})
+    await act(async () => { fireEvent.click(screen.getByRole('button', { name: zh['path.open'] })) })
     expect(screen.getAllByRole('alert')).toHaveLength(1)
     expect(screen.getByRole('alert').textContent).toContain(zh['path.openError'])
     act(() => { vi.advanceTimersByTime(4_000) })
@@ -132,11 +137,151 @@ it('dismisses a failure on schedule even when its owner rerenders', async () =>
   vi.useFakeTimers()
   const b = bench({ openPath: vi.fn(async () => 'openError' as const) })
   const view = render(<OpenPathEmptyAction {...b.props} />)
-  await act(async () => { fireEvent.click(screen.getByRole('button', { name: zh['path.unpreviewable'] })) })
+  await act(async () => {})
+  await act(async () => { fireEvent.click(screen.getByRole('button', { name: zh['path.open'] })) })
   act(() => { vi.advanceTimersByTime(2_000) })
   view.rerender(<OpenPathEmptyAction {...b.props} />)
+  await act(async () => {})
   act(() => { vi.advanceTimersByTime(1_999) })
   expect(screen.getByRole('alert')).toBeTruthy()
   act(() => { vi.advanceTimersByTime(1) })
   expect(screen.queryByRole('alert')).toBeNull()
 })
+
+
+it('shows the default icon and current application list, and selects an application without replacing default opening', async () => {
+  const b = bench()
+  const icon = 'data:image/png;base64,aGVsbG8='
+  const applications = vi.fn(async () => [
+    { id: '/Music.app', name: 'Music', default: true, icon },
+    { id: '/Player.app', name: 'Player', default: false, icon: null },
+  ])
+  const view = render(<OpenPathAction {...b.props} applications={applications} />)
+  await act(async () => {})
+  expect(view.container.querySelector('[data-open-path-open] img')?.getAttribute('src')).toBe(icon)
+  await act(async () => { fireEvent.click(screen.getByRole('button', { name: zh['path.more'] })) })
+  expect(screen.getByRole('menuitem', { name: 'Music（默认）' })).toBeTruthy()
+  await act(async () => { fireEvent.click(screen.getByRole('menuitem', { name: 'Player' })) })
+  expect(b.openPath).toHaveBeenLastCalledWith(ABSOLUTE_PATH, 'open', '/Player.app')
+  await act(async () => { fireEvent.click(screen.getByRole('button', { name: t('open.title', { app: 'Music' }) })) })
+  expect(b.openPath).toHaveBeenLastCalledWith(ABSOLUTE_PATH, 'open', undefined)
+})
+
+
+it('ignores an obsolete file query and refreshes the default application when the menu opens', async () => {
+  const b = bench()
+  const old = Promise.withResolvers<readonly { id: string; name: string; default: boolean; icon: null }[]>()
+  const applications = vi.fn<OpenPathActionProps['applications']>()
+    .mockImplementationOnce(() => old.promise)
+    .mockResolvedValue([{ id: '/Player.app', name: 'Player', default: true, icon: null }])
+  const view = render(<OpenPathAction {...b.props} applications={applications} />)
+  view.rerender(<OpenPathAction {...b.props} absolutePath="/other.mp3" applications={applications} />)
+  await act(async () => { old.resolve([{ id: '/Old.app', name: 'Old', default: true, icon: null }]) })
+  await act(async () => { fireEvent.click(screen.getByRole('button', { name: zh['path.more'] })) })
+  expect(screen.queryByRole('menuitem', { name: 'Old（默认）' })).toBeNull()
+  expect(screen.getByRole('menuitem', { name: 'Player（默认）' })).toBeTruthy()
+  expect(applications.mock.calls[0]![1].aborted).toBe(true)
+  expect(applications).toHaveBeenLastCalledWith('/other.mp3', expect.any(AbortSignal))
+})
+
+it('keeps reveal last and makes it the default when the file query fails', async () => {
+  const b = bench()
+  render(<OpenPathAction {...b.props} applications={async () => null} />)
+  await act(async () => {})
+  await act(async () => { fireEvent.click(screen.getByRole('button', { name: zh['path.more'] })) })
+  const items = screen.getAllByRole('menuitem')
+  expect(items.map(item => item.textContent)).toEqual([zh['path.appsError'], '显示文件位置（默认）'])
+  expect(items[0]).toHaveProperty('disabled', true)
+  await act(async () => { fireEvent.click(items[1]!) })
+  expect(b.openPath).toHaveBeenLastCalledWith(ABSOLUTE_PATH, 'reveal', undefined)
+})
+
+it.each([{ apps: [] }, { apps: [{ id: '/Player.app', name: 'Player', default: false, icon: null }] }])('uses reveal as the default after the available applications when none is default', async ({ apps }) => {
+  const b = bench()
+  render(<OpenPathAction {...b.props} applications={async () => apps} />)
+  await act(async () => {})
+  if (apps.length > 0) {
+    await act(async () => { fireEvent.click(screen.getByRole('button', { name: zh['path.more'] })) })
+    expect(screen.getAllByRole('menuitem').at(-1)?.textContent).toBe('显示文件位置（默认）')
+    expect(screen.queryByText('用默认应用打开')).toBeNull()
+    fireEvent.keyDown(screen.getByRole('menu'), { key: 'Escape' })
+  } else expect(screen.queryByRole('button', { name: zh['path.more'] })).toBeNull()
+  await act(async () => { fireEvent.click(screen.getByRole('button', { name: zh['path.reveal'] })) })
+  expect(b.openPath).toHaveBeenLastCalledWith(ABSOLUTE_PATH, 'reveal', undefined)
+})
+
+
+it('coalesces repeated gestures before the busy state renders', async () => {
+  const pending = Promise.withResolvers<OpenInAppPathFailure | null>()
+  const b = bench({ openPath: vi.fn(() => pending.promise) })
+  const { result } = renderHook(() => useOpenTargetGesture(() => b.openPath(ABSOLUTE_PATH, 'open'), t))
+  act(() => { result.current.act({ kind: 'default' }); result.current.act({ kind: 'default' }) })
+  expect(b.openPath).toHaveBeenCalledOnce()
+  await act(async () => { pending.resolve(null) })
+  expect(result.current.pending).toBe(false)
+})
+
+
+it('closes the application menu from its chevron without querying again', async () => {
+  const b = bench()
+  render(<OpenPathAction {...b.props} />)
+  await act(async () => {})
+  const more = screen.getByRole('button', { name: zh['path.more'] })
+  await act(async () => { fireEvent.click(more) })
+  expect(screen.getByRole('menu')).toBeTruthy()
+  const calls = vi.mocked(b.props.applications).mock.calls.length
+  await act(async () => { fireEvent.click(more) })
+  expect(screen.queryByRole('menu')).toBeNull()
+  expect(b.props.applications).toHaveBeenCalledTimes(calls)
+})
+
+
+it('waits for the file association query before allowing a default action', async () => {
+  const b = bench()
+  const query = Promise.withResolvers<Awaited<ReturnType<OpenPathActionProps['applications']>>>()
+  const view = render(<OpenPathAction {...b.props} applications={() => query.promise} />)
+  const main = view.container.querySelector('[data-open-path-open]')!
+  expect(main).toHaveProperty('disabled', true)
+  fireEvent.click(main)
+  expect(b.openPath).not.toHaveBeenCalled()
+  await act(async () => { query.resolve([]) })
+  expect(main).toHaveProperty('disabled', false)
+  await act(async () => { fireEvent.click(main) })
+  expect(b.openPath).toHaveBeenLastCalledWith(ABSOLUTE_PATH, 'reveal', undefined)
+})
+
+
+it('uses the same application menu in the prominent empty-state control', async () => {
+  const b = bench()
+  const view = render(<OpenPathEmptyAction {...b.props} />)
+  await act(async () => {})
+  expect(view.container.querySelector('[data-open-target]')?.getAttribute('data-size')).toBe('large')
+  await act(async () => { fireEvent.click(screen.getByRole('button', { name: zh['path.more'] })) })
+  expect(screen.getAllByRole('menuitem').map(item => item.textContent)).toEqual(['Music（默认）', zh['path.reveal']])
+  await act(async () => { fireEvent.click(screen.getByRole('menuitem', { name: 'Music（默认）' })) })
+  expect(b.openPath).toHaveBeenLastCalledWith(ABSOLUTE_PATH, 'open', '/Music.app')
+})
+
+it('labels the prominent default action as reveal when no default application is discovered', async () => {
+  const b = bench()
+  render(<OpenPathEmptyAction {...b.props} applications={async () => []} />)
+  await act(async () => {})
+  await act(async () => { fireEvent.click(screen.getByRole('button', { name: zh['path.reveal'] })) })
+  expect(b.openPath).toHaveBeenLastCalledWith(ABSOLUTE_PATH, 'reveal', undefined)
+})
+
+
+it('uses a skeleton while associations load and pins reveal outside the application list', async () => {
+  const b = bench()
+  const pending = Promise.withResolvers<readonly { id: string; name: string; default: boolean; icon: null }[]>()
+  const view = render(<OpenPathAction {...b.props} applications={() => pending.promise} />)
+  expect(view.container.querySelector('[data-open-target-skeleton]')).not.toBeNull()
+  expect(view.container.querySelector('[data-open-path-open] svg')).toBeNull()
+  await act(async () => { pending.resolve([{ id: 'music', name: 'Music', default: true, icon: null }]) })
+  expect(view.container.querySelector('[data-open-target-skeleton]')).toBeNull()
+  await act(async () => { fireEvent.click(screen.getByRole('button', { name: zh['path.more'] })) })
+  const menu = screen.getByRole('menu')
+  const reveal = screen.getByRole('menuitem', { name: zh['path.reveal'] })
+  expect(menu.firstElementChild?.contains(reveal)).toBe(false)
+  expect(menu.lastElementChild?.contains(reveal)).toBe(true)
+})
diff --git a/packages/client/ui-open-in-app/tests/open-path.client.spec.ts b/packages/client/ui-open-in-app/tests/open-path.client.spec.ts
index 2e8560f7cf..2def94a830 100644
--- a/packages/client/ui-open-in-app/tests/open-path.client.spec.ts
+++ b/packages/client/ui-open-in-app/tests/open-path.client.spec.ts
@@ -10,6 +10,7 @@ type SessionRemote = OpenInAppPathRemote['session']
 function remoteOf(over: Partial<SessionRemote> = {}): OpenInAppPathRemote {
   return {
     session: {
+      workspacePathApplications: async () => ({ ok: true, value: [] }),
       canOpenWorkspacePath: async () => ({ ok: true, value: true }),
       openWorkspacePath: async () => ({ ok: true, value: { opened: true } }),
       ...over,
@@ -69,3 +70,27 @@ describe('OpenInAppPathController gestures', () => {
     expect(await rejecting.openPath('/w/clip.mp4', 'open')).toBe('openError')
   })
 })
+
+
+it('queries current handlers and carries an explicit application without changing the default gesture', async () => {
+  const applications = [{ id: '/Applications/Music.app', name: 'Music', default: true, icon: null }]
+  const query = vi.fn(async () => ({ ok: true as const, value: applications }))
+  const open = vi.fn(async () => ({ ok: true as const, value: { opened: true } }))
+  const controller = new OpenInAppPathController(remoteOf({ workspacePathApplications: query, openWorkspacePath: open }))
+  const signal = new AbortController().signal
+  expect(await controller.applications('/file.mp3', signal)).toEqual(applications)
+  expect(query).toHaveBeenCalledWith({ path: '/file.mp3' }, signal)
+  await controller.openPath('/file.mp3', 'open', '/Applications/Music.app')
+  expect(open).toHaveBeenLastCalledWith({ path: '/file.mp3', application: '/Applications/Music.app' })
+  await controller.openPath('/file.mp3', 'open')
+  expect(open).toHaveBeenLastCalledWith({ path: '/file.mp3' })
+})
+
+
+it('distinguishes failed association queries from an empty application list', async () => {
+  const remote = remoteOf({ workspacePathApplications: async () => ({ ok: false, error: new RemoteError('gateway/internal', 'unavailable', {}) }) })
+  const controller = new OpenInAppPathController(remote)
+  expect(await controller.applications('/file.mp3', new AbortController().signal)).toBeNull()
+  const rejecting = new OpenInAppPathController(remoteOf({ workspacePathApplications: async () => { throw new Error('disconnected') } }))
+  expect(await rejecting.applications('/file.mp3', new AbortController().signal)).toBeNull()
+})
diff --git a/packages/client/ui-open-in-app/tsconfig.json b/packages/client/ui-open-in-app/tsconfig.json
index 1f0c094732..e37925c8a4 100644
--- a/packages/client/ui-open-in-app/tsconfig.json
+++ b/packages/client/ui-open-in-app/tsconfig.json
@@ -46,6 +46,12 @@
     },
     {
       "path": "../ui-slots"
+    },
+    {
+      "path": "../ui-deliverables/tsconfig.client.json"
+    },
+    {
+      "path": "../../util/native-command"
     }
   ]
 }
diff --git a/packages/client/ui-plugin-manager/README.i18n.yaml b/packages/client/ui-plugin-manager/README.i18n.yaml
index df24d45717..2489489230 100644
--- a/packages/client/ui-plugin-manager/README.i18n.yaml
+++ b/packages/client/ui-plugin-manager/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-plugin-manager/README.md
-README.md: c04a614668d5afb2e09c1f923ac9be473a4aab5a
-README.zh.md: f0b30c91cb87ce96349d92086673809139956e0a
+README.md: 75d972a310f7f5fc505775bcc72d2f18675d0c89
+README.zh.md: 66c441950ba288f554e2e41750cfe4e0c0b0b359
diff --git a/packages/client/ui-plugin-manager/README.md b/packages/client/ui-plugin-manager/README.md
index c04a614668..75d972a310 100644
--- a/packages/client/ui-plugin-manager/README.md
+++ b/packages/client/ui-plugin-manager/README.md
@@ -77,7 +77,9 @@ The browser plugin registers the `plugins` sidebar entry and its `main` panel th
 
 ### Configuration slots
 
-The page's `main` registration declares `plugins.item`, `plugins.bundle.config`, and `plugins.row.config` as its children, so the slots exist while the page does and a registrant's `ctx.slots.inject` waits for them. `configLedgerSource` projects the three ledgers into one observable — the official items in ledger order with their labels resolved in the active locale, and the bundle and row keys — cached until a ledger or the locale moves; the page binds it as `useConfigLedger` beside the store and never names a configurable plugin itself. Which page is open is page-local state: the cards, a bundle, an official plugin, or a row of a bundle. A registration lives with the browser half that made it. `dsh-client-modules` attaches a package's browser half to the Loader row whose specifier is the bare package name, so every page a bundle registers, for itself or for any of its rows, goes away when that row is switched off; a sub-plugin whose page must outlive the other rows ships as its own package.
+The page's `main` registration declares `plugins.item`, `plugins.bundle.config`, and `plugins.row.config` as its children, so the slots exist while the page does and a registrant's `ctx.slots.inject` waits for them. `configLedgerSource` projects the three ledgers into one observable — the official items in ledger order with their labels resolved in the active locale, and the bundle and row keys — cached until a ledger or the locale moves; the page binds it as `useConfigLedger` beside the store and never names a configurable plugin itself. Which page is open is page-local state: the cards, a bundle, an official plugin, or a row of a bundle. A registration lives with the browser half that made it. `dsh-client-modules` attaches a package's browser half to the Loader row whose specifier is the bare package name, so every page a bundle registers, for itself or for any of its rows, goes away when that row is switched off; a sub-plugin whose page must outlive the other rows ships as its own package. Official packages whose names begin with `@deepseek-ai/dsh-experimental-` display the Beta marker.
+
+`plugins.bundle.config` supplies bundle detail configuration, keyed by npm package name. `plugins.bundle.activation` offers bundle-owned guidance after explicit enablement from the list, with callbacks to dismiss it or open the bundle details. It does not appear merely because an enabled bundle was listed.
 
 </details>
 
diff --git a/packages/client/ui-plugin-manager/README.zh.md b/packages/client/ui-plugin-manager/README.zh.md
index f0b30c91cb..66c441950b 100644
--- a/packages/client/ui-plugin-manager/README.zh.md
+++ b/packages/client/ui-plugin-manager/README.zh.md
@@ -77,7 +77,9 @@ ctx.slots.inject('plugins.row.config', () => ctx.slots.register({
 
 ### 配置 slot
 
-页面的 `main` 注册把 `plugins.item`、`plugins.bundle.config` 与 `plugins.row.config` 声明为子 slot，因此它们与页面同生，注册方的 `ctx.slots.inject` 会等到它们出现。`configLedgerSource` 把三份账本投影成一个可观察对象——按账本顺序排列、标签按当前语言解析的官方条目，以及组合包与行的键——在账本或语言变化前保持缓存；页面把它作为 `useConfigLedger` 绑在 store 旁边，自身从不点名任何可配置插件。打开的是哪一页是页面本地状态：卡片、某个组合包、某个官方插件，或组合包的某一行。注册与做出它的浏览器半侧同生共死。`dsh-client-modules` 只把一个包的浏览器半侧挂在说明符恰为包名的那一行 Loader 行上，所以组合包为自己或任一行注册的页面，都会在那一行被关闭时一起消失；需要在其他行关闭时仍保留页面的子插件，应作为独立的包发布。
+页面的 `main` 注册把 `plugins.item`、`plugins.bundle.config` 与 `plugins.row.config` 声明为子 slot，因此它们与页面同生，注册方的 `ctx.slots.inject` 会等到它们出现。`configLedgerSource` 把三份账本投影成一个可观察对象——按账本顺序排列、标签按当前语言解析的官方条目，以及组合包与行的键——在账本或语言变化前保持缓存；页面把它作为 `useConfigLedger` 绑在 store 旁边，自身从不点名任何可配置插件。打开的是哪一页是页面本地状态：卡片、某个组合包、某个官方插件，或组合包的某一行。注册与做出它的浏览器半侧同生共死。`dsh-client-modules` 只把一个包的浏览器半侧挂在说明符恰为包名的那一行 Loader 行上，所以组合包为自己或任一行注册的页面，都会在那一行被关闭时一起消失；需要在其他行关闭时仍保留页面的子插件，应作为独立的包发布。 名称以 `@deepseek-ai/dsh-experimental-` 开头的官方包显示 Beta 标记。
+
+`plugins.bundle.config` 以 npm 包名为 key，提供 Bundle 详情配置。`plugins.bundle.activation` 在用户从列表显式启用后提供 Bundle 自有引导，并传入关闭引导和打开详情的回调。仅列出已启用的 Bundle 不会触发引导。
 
 </details>
 
diff --git a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.tsx b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.tsx
index 5ef0212a3c..dfa77f913c 100644
--- a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.tsx
+++ b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.tsx
@@ -37,7 +37,7 @@ import css from './PluginManagerPage.module.css'
 export type PluginManagerPageProps =
   PropsRuntime<'main'>
   & PropsLocale<'pluginManager'>
-  & PropsRenderSlots<'plugins.item' | 'plugins.bundle.config' | 'plugins.row.config'>
+  & PropsRenderSlots<'plugins.item' | 'plugins.bundle.config' | 'plugins.row.config' | 'plugins.bundle.activation'>
   & InjectFace<PluginManagerFace>
 
 /** The page's slot renderer, narrowed to the configuration slots. */
@@ -1072,6 +1072,7 @@ export function PluginManagerPage(props: PluginManagerPageProps): ReactNode {
   const ledger = props.useConfigLedger(snapshot => snapshot)
   // What is open; a package that leaves the list (uninstalled) drops back to the cards.
   const [view, setView] = useState<View>({ kind: 'list' })
+  const [activation, setActivation] = useState<string | null>(null)
   useEffect(() => { ensure() }, [ensure])
   // A package an install just enabled: scroll it into view and mark it for a moment.
   const { highlight, clearHighlight } = { highlight: state.highlight, clearHighlight: props.clearHighlight }
@@ -1096,6 +1097,7 @@ export function PluginManagerPage(props: PluginManagerPageProps): ReactNode {
   const openItem = view.kind === 'item' ? ledger.items.find(item => item.id === view.id) : undefined
   const openRow = view.kind === 'row' && openPkg !== undefined ? openPkg.rows.find(row => row.rowId === view.rowId) : undefined
   const showsCards = openPkg === undefined && openItem === undefined
+  const activated = listed.find(pkg => pkg.name === activation && pkg.enabled && !state.busy.includes(pkg.name))
   const setRowEnabled = (row: PackageRow, enabled: boolean): void => {
     /* v8 ignore next -- a row without a live entry has its switch disabled */
     if (row.entryId !== undefined) props.setRowEnabled(row.entryId, enabled)
@@ -1112,8 +1114,8 @@ export function PluginManagerPage(props: PluginManagerPageProps): ReactNode {
       resolveText={resolveText}
       busy={state.busy.includes(pkg.name)}
       highlighted={state.highlight === pkg.name}
-      onOpen={() => { setView({ kind: 'package', name: pkg.name }) }}
-      onSetEnabled={(enabled) => { props.setEnabled(pkg.name, enabled) }}
+      onOpen={() => { setActivation(null); setView({ kind: 'package', name: pkg.name }) }}
+      onSetEnabled={(enabled) => { setActivation(enabled ? pkg.name : null); props.setEnabled(pkg.name, enabled) }}
     />
   )
   // The Official group: the bundles the installation ships, then the plugins that registered their configuration.
@@ -1242,6 +1244,12 @@ export function PluginManagerPage(props: PluginManagerPageProps): ReactNode {
             </>
           )
         : null}
+      {showsCards && activated !== undefined && !state.install.open
+        ? renderSlot('plugins.bundle.activation', {
+          packageName: activated.name,
+          onDismiss: () => { setActivation(null) },
+          onOpenDetails: () => { setActivation(null); setView({ kind: 'package', name: activated.name }) },
+        }, { entryKey: activated.name }) : null}
       <InstallDialog
         install={state.install}
         t={t}
@@ -1251,7 +1259,7 @@ export function PluginManagerPage(props: PluginManagerPageProps): ReactNode {
         onCancel={props.cancelInstall}
         onReconcile={props.reconcileInstall}
         onToggleDetails={props.toggleInstallDetails}
-        onEnableNow={props.enableInstalled}
+        onEnableNow={() => { setActivation(state.install.installed); props.enableInstalled() }}
         onApproveBuilds={props.approveBuildsAndRetry}
         onToggleRegistry={props.toggleRegistryOptions}
         onChooseRegistry={props.chooseRegistry}
diff --git a/packages/client/ui-plugin-manager/src/client/index.ts b/packages/client/ui-plugin-manager/src/client/index.ts
index f3394b69cc..e0f9e1ea26 100644
--- a/packages/client/ui-plugin-manager/src/client/index.ts
+++ b/packages/client/ui-plugin-manager/src/client/index.ts
@@ -31,7 +31,7 @@ export type { PluginManagerPageProps } from './PluginManagerPage.tsx'
 export type { ConfigLedger, OfficialItem } from './config-ledger.ts'
 export type { PluginManagerFace } from './manager-store.ts'
 export type { PluginManagerLocaleKey } from './locales.ts'
-export type { PluginConfigViewProps } from './slot-contract.ts'
+export type { PluginConfigViewProps, PluginActivationOwnerProps } from './slot-contract.ts'
 
 declare module '@deepseek-ai/dsh-client-ui-slots' {
   interface LocaleNamespaceMap {
@@ -87,6 +87,7 @@ export function apply(ctx: ClientContext): void {
     inject: () => controller.inject(configLedger, text => ctx.locale.resolveText(text)),
     children: {
       'plugins.item': { kind: 'list', scope: 'root' },
+      'plugins.bundle.activation': { kind: 'keyed', scope: 'root' },
       'plugins.bundle.config': { kind: 'keyed', scope: 'root' },
       'plugins.row.config': { kind: 'keyed', scope: 'root' },
     },
diff --git a/packages/client/ui-plugin-manager/src/client/presentation.ts b/packages/client/ui-plugin-manager/src/client/presentation.ts
index c76633ff97..b5f004b0ac 100644
--- a/packages/client/ui-plugin-manager/src/client/presentation.ts
+++ b/packages/client/ui-plugin-manager/src/client/presentation.ts
@@ -8,12 +8,6 @@ import type { FailedAction, ManagerNotice, PackageRow, PackageView, PluginManage
 /** The translate seat of the manager's dictionary. */
 export type Translate = PropsLocale<'pluginManager'>['t']
 
-/** Official packages whose release status the page identifies as beta. */
-const BETA_PACKAGES = new Set([
-  '@deepseek-ai/dsh-experimental-agent-team-profile',
-  '@deepseek-ai/dsh-experimental-auto-review',
-])
-
 /** The registries with a name of their own, by host. */
 const REGISTRY_COPY = new Map<string, PluginManagerLocaleKey>([
   ['registry.npmmirror.com', 'registryNpmmirror'],
@@ -105,7 +99,7 @@ export function packageText(
   return {
     title: pkg.meta?.title === undefined ? pkg.name : resolveText(pkg.meta.title),
     description: pkg.meta?.description === undefined ? undefined : resolveText(pkg.meta.description) || undefined,
-    beta: BETA_PACKAGES.has(pkg.name),
+    beta: pkg.name.startsWith('@deepseek-ai/dsh-experimental-'),
   }
 }
 
diff --git a/packages/client/ui-plugin-manager/src/client/slot-contract.ts b/packages/client/ui-plugin-manager/src/client/slot-contract.ts
index 89a9b52115..4f291b865f 100644
--- a/packages/client/ui-plugin-manager/src/client/slot-contract.ts
+++ b/packages/client/ui-plugin-manager/src/client/slot-contract.ts
@@ -19,8 +19,19 @@ export interface PluginConfigViewProps {
   readonly view: 'summary' | 'page'
 }
 
+/** One user-requested bundle activation and navigation to its configuration page. */
+export interface PluginActivationOwnerProps {
+  readonly packageName: string
+  /** Dismiss guidance for this activation. */
+  readonly onDismiss: () => void
+  /** Dismiss guidance and open this bundle's detail page. */
+  readonly onOpenDetails: () => void
+}
+
 declare module '@deepseek-ai/dsh-client-ui-slots' {
   interface SlotMap {
+    /** Optional guidance after the user enables a bundle from the list, keyed by npm package name. */
+    'plugins.bundle.activation': { kind: 'keyed'; scope: 'root'; owner: PluginActivationOwnerProps }
     /**
      * One official plugin the Plugins page lists in its Official group after
      * the official bundles: `label` is the card's title and `order` its place.
diff --git a/packages/client/ui-plugin-manager/tests/components.client.spec.tsx b/packages/client/ui-plugin-manager/tests/components.client.spec.tsx
index 9aaa8c1cee..89bf43e9b0 100644
--- a/packages/client/ui-plugin-manager/tests/components.client.spec.tsx
+++ b/packages/client/ui-plugin-manager/tests/components.client.spec.tsx
@@ -12,6 +12,7 @@ import type { PluginManagerPageProps } from '../src/client/index.ts'
 import type { ConfigLedger } from '../src/client/config-ledger.ts'
 import { rowKey, type InstallState, type PackageRow, type PackageView, type PluginManagerState } from '../src/client/manager-store.ts'
 import { en, zh, type PluginManagerLocaleKey } from '../src/client/locales.ts'
+import type { PluginActivationOwnerProps } from '../src/client/slot-contract.ts'
 
 afterEach(cleanup)
 
@@ -66,7 +67,7 @@ const READY: PluginManagerState = {
 }
 
 /** Configuration entries a test supplies: what each slot cell renders, by `<slot>:<cell>` and the view asked for. */
-type SlotBodies = Record<string, (view: 'summary' | 'page') => ReactNode>
+type SlotBodies = Record<string, (view: 'summary' | 'page' | 'activation', owner: unknown) => ReactNode>
 
 const NO_CONFIG: ConfigLedger = { items: [], bundles: new Set(), rows: new Set() }
 
@@ -120,10 +121,11 @@ function renderTab(state: Partial<PluginManagerState> = {}, config: Partial<Conf
     renderSlot: (name, owner, opts) => {
       const body = bodies[`${name}:${opts?.only ?? opts?.entryKey ?? ''}`]
       if (body === undefined) return null
+      if (name === 'plugins.bundle.activation') return body('activation', owner)
       if (!('view' in owner) || (owner.view !== 'summary' && owner.view !== 'page')) {
         throw new Error('Plugin configuration fixture requires a summary or page view')
       }
-      return body(owner.view)
+      return body(owner.view, owner)
     },
   }
   const { rerender } = render(<PluginManagerPage {...props} />)
@@ -256,6 +258,7 @@ describe('PluginManagerPage', () => {
   it.each([
     '@deepseek-ai/dsh-experimental-agent-team-profile',
     '@deepseek-ai/dsh-experimental-auto-review',
+    '@deepseek-ai/dsh-experimental-fixture-input',
     '@acme/dsh-local-tools',
   ])('localizes Host metadata for %s across cards, details, switches, and uninstall confirmation', (name) => {
     const meta = {
@@ -272,6 +275,7 @@ describe('PluginManagerPage', () => {
       expect(document.getElementById(card.getAttribute('aria-describedby')!)?.textContent).toBe(description(dict))
       expect(screen.getByRole('switch', { name: dict.enableToggle.replace('{name}', title(dict)) })).toBeTruthy()
       expect(screen.queryByText('Original metadata.')).toBeNull()
+      expect(screen.queryByText(dict.statusBeta) !== null).toBe(name.startsWith('@deepseek-ai/dsh-experimental-'))
     }
     assertCard(en)
     setLanguage(zh)
@@ -1193,3 +1197,41 @@ describe('PluginManagerPage', () => {
     expect(actions.closeInstall).toHaveBeenCalledOnce()
   })
 })
+
+it('offers bundle-owned guidance only after explicit enablement and navigates to its detail page', () => {
+  const name = 'dsh-better-sidebar'
+  const { set, actions } = renderTab({ packages: [pkg({ enabled: false })] }, { bundles: new Set([name]) }, {
+    [`plugins.bundle.activation:${name}`]: (_view, owner) => <button onClick={(owner as PluginActivationOwnerProps).onOpenDetails}>Go to setup</button>,
+    [`plugins.bundle.config:${name}`]: () => <div>Bundle setup</div>,
+  })
+  expect(screen.queryByText('Go to setup')).toBeNull()
+  set({ packages: [pkg()] })
+  expect(screen.queryByText('Go to setup')).toBeNull()
+  set({ packages: [pkg({ enabled: false })] })
+  fireEvent.click(screen.getByRole('switch'))
+  expect(actions.setEnabled).toHaveBeenCalledWith(name, true)
+  expect(screen.queryByText('Go to setup')).toBeNull()
+  set({ packages: [pkg()], busy: [name] })
+  expect(screen.queryByText('Go to setup')).toBeNull()
+  set({ busy: [] })
+  fireEvent.click(screen.getByText('Go to setup'))
+  expect(screen.getByText('Bundle setup')).toBeTruthy()
+  expect(screen.queryByText('Go to setup')).toBeNull()
+})
+
+it('dismisses activation guidance until the user enables the bundle again', () => {
+  const name = 'dsh-better-sidebar'
+  const { set } = renderTab({ packages: [pkg({ enabled: false })] }, {}, {
+    [`plugins.bundle.activation:${name}`]: (_view, owner) => <button onClick={(owner as PluginActivationOwnerProps).onDismiss}>Later</button>,
+  })
+  fireEvent.click(screen.getByRole('switch'))
+  set({ packages: [pkg()] })
+  fireEvent.click(screen.getByText('Later'))
+  set({ packages: [pkg()] })
+  expect(screen.queryByText('Later')).toBeNull()
+  fireEvent.click(screen.getByRole('switch'))
+  set({ packages: [pkg({ enabled: false })] })
+  fireEvent.click(screen.getByRole('switch'))
+  set({ packages: [pkg()] })
+  expect(screen.getByText('Later')).toBeTruthy()
+})
diff --git a/packages/client/ui-primitives/README.i18n.yaml b/packages/client/ui-primitives/README.i18n.yaml
index 5e3699e8e5..e9518efb50 100644
--- a/packages/client/ui-primitives/README.i18n.yaml
+++ b/packages/client/ui-primitives/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-primitives/README.md
-README.md: 2606bd0dd5895319c9887b15497b2ca6b7a045ce
-README.zh.md: cdf816549ea6cf12382b819a493ded7f61ecddd9
+README.md: 6ba9e8f79b9b8f8473fec2094a724e9d371e0f4e
+README.zh.md: 919659266ca729dfdaf50b00783cff065112ee07
diff --git a/packages/client/ui-primitives/README.md b/packages/client/ui-primitives/README.md
index 2606bd0dd5..6ba9e8f79b 100644
--- a/packages/client/ui-primitives/README.md
+++ b/packages/client/ui-primitives/README.md
@@ -44,13 +44,13 @@ Check this table before writing a control in a feature package. A plugin cannot
 | `Pill` | Selectable capsule button for view switchers and filters; takes `active` and `onClick`. |
 | `SegmentedTabs` | Controlled equal-width tabs with a sliding indicator and Left/Right, Home, and End navigation. The caller supplies labels, tab/panel ids, and panel content. |
 | `Tag` | Read-only capsule badge; `tone` selects one of eight palettes. |
-| `StateDot` | Solid green `done`, amber `warning`, red `error`, and neutral-grey `idle` marks in a 10px slot, plus a tertiary-grey 14px rotating `ongoing` loader whose animations pin to document time zero so every visible loader rotates in phase. `aria-hidden`, so the render site owns the name. |
+| `StateDot` | Solid green `done`, amber `warning`, red `error`, and neutral-grey `idle` marks in a 10px slot, plus a tertiary-grey 14px rotating `ongoing` loader whose animations pin to document time zero so every visible loader rotates in phase. `aria-hidden`, so the render site owns the name. `appearance="step"` shows a filled check for completion and a hollow pending circle. |
 | `ConnectionIndicator` | Inline connection-recovery control across outage, retry, and recovered states. |
 | `DisclosureRow` | 24px compact disclosure that lays title and content side by side. Memoized with shallow prop comparison; keep callbacks and React-node props stable when their content is unchanged. |
 | `Modal` | Centered dialog over a page mask. |
 | `RiskConfirmation` | Sensitive action gated behind an explicit checkbox. |
 | `OnboardingSurface` | First-run stage that holds the application root inert. |
-| `Tooltip` | Hover text on a cloned anchor, placed right, bottom, or top. |
+| `Tooltip` | Hover text anchored to a cloned child; optional `portal` rendering escapes clipping containers. |
 | `HoverCard` | Hover preview the pointer can rest on and select from; optional copy button. |
 | `Toast` | Transient top-center banner held for the owner's `holdMs`. |
 | `JsonTree`, `JsonBlock` | Read-only JSON inspection. |
@@ -120,7 +120,7 @@ While a reply streams, `MarkdownText` parses incrementally: all but the trailing
 
 ### Geometry and overflow
 
-The output cards share one geometry model: `white-space: pre` with horizontal scrolling so column-aligned content keeps its alignment, and a head-plus-tail slice behind an expand button past `maxLines` (default 16) so a long body never stretches the card. `TerminalBlock` parses ANSI into React spans with a per-line column buffer for cursor movement, honoring erase-in-line, tab stops, and character width.
+The output cards share one geometry model: `white-space: pre` with horizontal scrolling so column-aligned content keeps its alignment, and a head-plus-tail slice behind an expand button past `maxLines` (default 16) so a long body never stretches the card. `TerminalBlock` parses ANSI into React spans with a per-line column buffer for cursor movement, honoring erase-in-line, tab stops, and character width. Hosts opt out of the shared geometry per surface: rebinding `--dsl-terminal-command-whitespace` / `--dsl-terminal-line-whitespace` to `pre-wrap` wraps commands and output in full with no sideways scroll, `maxLines: Infinity` disables the fold for hosts capping height through `--dsl-terminal-output-max-height` instead, `copyText` overrides the copy payload (and keeps the control rendered before any output), and `runStateDot: false` omits the run-state dot when the surrounding row already carries the state, reclaiming its gutter via `--dsl-terminal-gutter`. The banner divider follows the rendered body, so a running card that streams live output separates its command from the text like a settled card.
 
 </details>
 
diff --git a/packages/client/ui-primitives/README.zh.md b/packages/client/ui-primitives/README.zh.md
index cdf816549e..919659266c 100644
--- a/packages/client/ui-primitives/README.zh.md
+++ b/packages/client/ui-primitives/README.zh.md
@@ -44,13 +44,13 @@ kind: "package-library"
 | `Pill` | 可选中的胶囊按钮，用于视图切换与筛选器；接受 `active` 与 `onClick`。 |
 | `SegmentedTabs` | 受控的等宽分段标签，支持滑动指示条及左／右方向键、Home、End 导航。调用方提供文案、标签与面板 id，以及面板内容。 |
 | `Tag` | 只读胶囊徽章；`tone` 选择八种配色之一。 |
-| `StateDot` | 10px 槽内的绿色 `done`、琥珀色 `warning`、红色 `error`、中性灰色 `idle` 圆点，以及 tertiary 灰色 14px 旋转 `ongoing` loading，其动画固定到文档时间零点，所以所有可见 loading 同相旋转。它是 `aria-hidden` 的，名称由渲染点提供。 |
+| `StateDot` | 10px 槽内的绿色 `done`、琥珀色 `warning`、红色 `error`、中性灰色 `idle` 圆点，以及 tertiary 灰色 14px 旋转 `ongoing` loading，其动画固定到文档时间零点，所以所有可见 loading 同相旋转。它是 `aria-hidden` 的，名称由渲染点提供。 `appearance="step"` 以实心勾表示完成、空心圆表示等待。 |
 | `ConnectionIndicator` | 行内连接恢复控件，覆盖断线、重试与已恢复三种状态。 |
 | `DisclosureRow` | 24px 紧凑折叠行，标题与内容左右排列。使用浅层 prop 比较进行 memo；内容未变时，保持回调与 React 节点 prop 的引用稳定。 |
 | `Modal` | 页面遮罩之上的居中对话框。 |
 | `RiskConfirmation` | 以显式复选框把关的敏感操作确认。 |
 | `OnboardingSurface` | 首次运行的引导舞台，期间保持应用根节点 inert。 |
-| `Tooltip` | 克隆锚点上的悬停文本，可置于右、下、上三个方向。 |
+| `Tooltip` | 锚定在克隆子元素上的悬停文本；可通过 `portal` 渲染到外层，避免被容器裁剪。 |
 | `HoverCard` | 指针可停留、可选中的悬停预览；可选带复制按钮。 |
 | `Toast` | 顶部居中的瞬时横幅，保持时长由所有者的 `holdMs` 决定。 |
 | `JsonTree`、`JsonBlock` | 只读 JSON 查看。 |
@@ -120,7 +120,7 @@ kind: "package-library"
 
 ### 几何与溢出
 
-输出卡片共享同一套几何模型：`white-space: pre` 并横向滚动，让按列对齐的内容保持对齐；超过 `maxLines`（默认 16）时折叠为头部切片加尾部切片，由展开按钮控制，长正文不会撑高卡片。`TerminalBlock` 把 ANSI 解析为 React span，并带逐行列缓冲处理光标移动，遵循行内擦除、制表位与字符宽度。
+输出卡片共享同一套几何模型：`white-space: pre` 并横向滚动，让按列对齐的内容保持对齐；超过 `maxLines`（默认 16）时折叠为头部切片加尾部切片，由展开按钮控制，长正文不会撑高卡片。`TerminalBlock` 把 ANSI 解析为 React span，并带逐行列缓冲处理光标移动，遵循行内擦除、制表位与字符宽度。宿主可按表层选择退出共享几何：把 `--dsl-terminal-command-whitespace` / `--dsl-terminal-line-whitespace` 重绑为 `pre-wrap` 让命令与输出完整换行且不横向滚动；`maxLines: Infinity` 为改用 `--dsl-terminal-output-max-height` 限高滚动的宿主禁用折叠；`copyText` 覆盖复制载荷（并让控件在任何输出出现之前就保持渲染）；`runStateDot: false` 在外围行已携带同一状态时省去状态点，并经 `--dsl-terminal-gutter` 收回其落区。横幅分割线跟随渲染出的正文：正在流式输出的 running 卡片像已结束卡片一样把命令与文本分隔开。
 
 </details>
 
diff --git a/packages/client/ui-primitives/src/StateDot.module.css b/packages/client/ui-primitives/src/StateDot.module.css
index 186e54eb57..1a692c6892 100644
--- a/packages/client/ui-primitives/src/StateDot.module.css
+++ b/packages/client/ui-primitives/src/StateDot.module.css
@@ -93,3 +93,8 @@
     stroke-dashoffset: -3;
   }
 }
+
+.step { display: inline-flex; flex: none; align-items: center; justify-content: center; box-sizing: border-box; border-radius: 50%; corner-shape: round; border: 1.5px solid var(--dsw-alias-label-tertiary); color: var(--dsw-alias-label-primary-foreground); }
+.step[data-state='done'] { border-color: var(--dsw-alias-state-success-primary); background: var(--dsw-alias-state-success-primary); }
+.step[data-state='error'] { border-color: var(--dsw-alias-state-error-primary); background: var(--dsw-alias-state-error-primary); }
+.step[data-state='warning'] { border-color: var(--dsw-alias-state-warn-primary); }
diff --git a/packages/client/ui-primitives/src/StateDot.tsx b/packages/client/ui-primitives/src/StateDot.tsx
index b0d84b89ec..ede3c6b98c 100644
--- a/packages/client/ui-primitives/src/StateDot.tsx
+++ b/packages/client/ui-primitives/src/StateDot.tsx
@@ -1,5 +1,6 @@
 import clsx from 'clsx'
 import css from './StateDot.module.css'
+import { IconCheckOutlineRegular } from './icons/index.tsx'
 
 /**
  * State semantic: green done / amber user-attention / tertiary-grey loading /
@@ -26,12 +27,14 @@ function syncSpinner(element: SVGSVGElement | null): void {
  * @param props.state - which of `done`, `warning`, `ongoing`, `error`, or `idle` to show.
  * @param props.size - outer diameter in px; defaults to 14 for ongoing and 10 for solid states.
  * @param props.className - extra class for layout placement.
+ * @param props.appearance - compact dot by default; step uses a filled check or hollow pending circle.
  * @returns the dot element (aria-hidden; pair with text for accessibility).
  */
-export function StateDot({ state, size, className }: {
+export function StateDot({ state, size, className, appearance = 'dot' }: {
   state: StateDotState
   size?: number | undefined
   className?: string | undefined
+  appearance?: 'dot' | 'step'
 }) {
   const edge = size ?? (state === 'ongoing' ? 14 : 10)
   if (state === 'ongoing') {
@@ -54,10 +57,10 @@ export function StateDot({ state, size, className }: {
   }
   return (
     <span
-      className={clsx(css.dot, className)}
+      className={clsx(appearance === 'step' ? css.step : css.dot, className)}
       data-state={state}
       style={{ width: edge, height: edge }}
       aria-hidden="true"
-    />
+    >{appearance === 'step' && state === 'done' && <IconCheckOutlineRegular size={edge - 2} />}</span>
   )
 }
diff --git a/packages/client/ui-primitives/src/TerminalBlock.module.css b/packages/client/ui-primitives/src/TerminalBlock.module.css
index 3524b1dadc..b58bbee735 100644
--- a/packages/client/ui-primitives/src/TerminalBlock.module.css
+++ b/packages/client/ui-primitives/src/TerminalBlock.module.css
@@ -110,15 +110,18 @@
   color: var(--dsw-alias-label-tertiary);
 }
 
-/* `pre`, not `nowrap`: the prompt row renders the command verbatim, and
-   `nowrap` collapses the repeated spaces, tabs, and alignment of an indented
-   continuation. Both hold the single row and the ellipsis. */
+/* Default `pre`, not `nowrap`: the prompt row renders the command verbatim,
+   and `nowrap` would collapse the repeated spaces, tabs, and alignment of an
+   indented continuation. Hosts opt into wrapping long commands by rebinding
+   the variable to `pre-wrap`; the ellipsis then simply never engages, and
+   overflow-wrap is inert while white-space stays `pre`. */
 .command {
   min-width: 0;
   color: var(--dsw-alias-label-primary);
   overflow: hidden;
   text-overflow: ellipsis;
-  white-space: pre;
+  white-space: var(--dsl-terminal-command-whitespace, pre);
+  overflow-wrap: anywhere;
 }
 
 /* Capped to the prompt's line height (Pill's own 24px height would exceed a
@@ -176,10 +179,14 @@
   margin: 6px;
 }
 
-/* No wrapping, no word-break: alignment is the payload of terminal output. */
+/* Default `pre`: alignment is the payload of terminal output. Hosts opt
+   into wrapping long lines by rebinding the variable to `pre-wrap`, which
+   also keeps the output region from ever scrolling sideways; overflow-wrap
+   is inert while white-space stays `pre`. */
 .line {
   min-height: var(--dsl-terminal-line-height);
-  white-space: pre;
+  white-space: var(--dsl-terminal-line-whitespace, pre);
+  overflow-wrap: anywhere;
 }
 
 .expand {
diff --git a/packages/client/ui-primitives/src/TerminalBlock.tsx b/packages/client/ui-primitives/src/TerminalBlock.tsx
index dfeddcd27f..76e7f92808 100644
--- a/packages/client/ui-primitives/src/TerminalBlock.tsx
+++ b/packages/client/ui-primitives/src/TerminalBlock.tsx
@@ -57,12 +57,24 @@ export interface TerminalBlockProps {
   /** Settled terminating signal name; any value renders the status pill, taking precedence over the exit code. */
   signal?: string | undefined
   /**
-   * The command is still running: the block shows the prompt line, and the
-   * output printed so far when there is any, with no copy control until it settles.
+   * The command is still running: with no `output` the block shows the prompt
+   * line alone; with output it renders the live text under the running state.
    */
   running?: boolean | undefined
   /** Height cap in output lines before the middle collapses (default {@link DEFAULT_TERMINAL_MAX_LINES}); Infinity disables the cap. */
   maxLines?: number | undefined
+  /**
+   * Copy-control payload override; the control copies the raw output when
+   * absent. Supplying it also keeps the control rendered before any output
+   * exists — a command is copyable before it prints.
+   */
+  copyText?: string | undefined
+  /**
+   * Draw the run-state dot and its assistive label in the card gutter
+   * (default true). Hosts whose surrounding row already carries the same
+   * state omit both and reclaim the gutter via `--dsl-terminal-gutter`.
+   */
+  runStateDot?: boolean | undefined
   /** Extra class merged onto the wrapper (callers position; this component draws). */
   className?: string | undefined
   /** Localized display copy supplied by the owning render site. */
@@ -158,6 +170,8 @@ export function TerminalBlock({
   signal,
   running = false,
   maxLines = DEFAULT_TERMINAL_MAX_LINES,
+  copyText,
+  runStateDot = true,
   className,
   labels,
 }: TerminalBlockProps) {
@@ -169,7 +183,7 @@ export function TerminalBlock({
   // newline (`line\n\x1b[0m`) leaves the string not ending in one while still
   // producing a last line with nothing visible in it. A genuinely blank final
   // line — the double newline — survives, since it has a real empty line before
-  // the terminator. The copy control still copies `text` untouched.
+  // the terminator. The copy control's payload is unaffected.
   const lines = useMemo(() => {
     const parsed = parseAnsiLines(text)
     const last = parsed[parsed.length - 1]
@@ -178,9 +192,9 @@ export function TerminalBlock({
     return terminated ? parsed.slice(0, -1) : parsed
   }, [text])
   const [expanded, setExpanded] = useState(false)
-  // The raw output, never the rendered tree: the prompt line and the status pill
-  // are chrome the user did not run.
-  const { copied, onCopy } = useCopyFeedback(text)
+  // The raw output (or the caller's override), never the rendered tree: the
+  // prompt line and the status pill are chrome the user did not run.
+  const { copied, onCopy } = useCopyFeedback(copyText ?? text)
 
   const onToggle = useCallback(() => { setExpanded(value => !value) }, [])
 
@@ -213,14 +227,14 @@ export function TerminalBlock({
     >
       <div className={css.header}>
         <div className={css.prompt}>
-          <span className={css.runStateLabel}>{state.label}</span>
+          {runStateDot && <span className={css.runStateLabel}>{state.label}</span>}
           {commandLines.map((line, index) => (
             <div key={index} className={css.promptLine}>
               {/* One dot for the card, on the first row: the exit status the
                   view carries is the whole call's, and bash reports no
                   per-command status, so a dot per row would assert a
                   per-line outcome nothing here knows. */}
-              {index === 0 && <StateDot state={state.state} className={css.runState} />}
+              {index === 0 && runStateDot && <StateDot state={state.state} className={css.runState} />}
               {/* The cwd labels the CALL, so only its first row carries it. The
                   view knows one working directory — where the call started —
                   and a later line may well run somewhere else (a `cd` in the
@@ -235,7 +249,7 @@ export function TerminalBlock({
           ))}
         </div>
         {status !== undefined && <Pill className={css.status}>{status}</Pill>}
-        {!running && !empty && (
+        {(copyText !== undefined || (!running && !empty)) && (
           <button type="button" className={css.copyButton} onClick={onCopy}>
             {copied ? copy.copied : copy.copy}
           </button>
diff --git a/packages/client/ui-primitives/src/Tooltip.module.css b/packages/client/ui-primitives/src/Tooltip.module.css
index 926fb68557..ed546ce13c 100644
--- a/packages/client/ui-primitives/src/Tooltip.module.css
+++ b/packages/client/ui-primitives/src/Tooltip.module.css
@@ -19,6 +19,8 @@
   animation: tooltip-in 150ms var(--ds-ease-in-out);
 }
 
+.bubble[data-portal] { z-index: 1100; }
+
 .bubble[data-side='right'] {
   transform: translateY(-50%);
 }
diff --git a/packages/client/ui-primitives/src/Tooltip.tsx b/packages/client/ui-primitives/src/Tooltip.tsx
index 688a411fb9..0316840a25 100644
--- a/packages/client/ui-primitives/src/Tooltip.tsx
+++ b/packages/client/ui-primitives/src/Tooltip.tsx
@@ -1,8 +1,8 @@
-// Cloning the anchor preserves its layout context. Fixed positioning lets the
-// bubble escape ancestor overflow clipping without a portal.
+/** Anchor-preserving tooltips with optional body portals for clipping containers. */
 
 import { cloneElement, createContext, useCallback, useContext, useEffect, useLayoutEffect, useRef, useState } from 'react'
 import type { FocusEventHandler, MouseEventHandler, MutableRefObject, ReactElement, Ref } from 'react'
+import { createPortal } from 'react-dom'
 import css from './Tooltip.module.css'
 
 /** Bubble placement relative to the anchor. */
@@ -46,17 +46,18 @@ if (typeof window !== 'undefined') {
  * @param props.align - horizontal anchor-edge alignment for 'bottom'/'top' bubbles: 'end' pins
  * the bubble's right edge to the anchor's (for anchors beside other hover surfaces the centered
  * bubble would overlap); default 'center'. Ignored for side 'right'.
+ * @param props.portal - render the bubble under document.body to escape containing blocks and clipping ancestors.
  * @param props.delayMs - hover delay in milliseconds; keyboard focus remains immediate.
  * @param props.disabled - suppress the bubble while true; the anchor renders identically so
  * toggling never remounts it (which would cut its CSS transitions).
  * @param props.maxWidth - bubble width cap in pixels, for labels long enough that the default
  * half-viewport cap would render a slab wider than the surface the anchor sits on.
  * @param props.children - a single anchor element; its own ref (callback or object) is forwarded alongside the tooltip's.
- * @returns the cloned anchor plus a fixed-position bubble while hovered/focused; clicking the
+ * @returns the cloned anchor plus a fixed-position bubble, optionally portaled to the body; clicking the
  * anchor dismisses the bubble until the next trigger, and focus arriving after a pointer
  * interaction (a closing menu refocusing its trigger) never raises it.
  */
-export function Tooltip({ label, side = 'right', align = 'center', delayMs = 0, disabled = false, maxWidth, children }: { label: TooltipLabel; side?: TooltipSide; align?: 'center' | 'end'; delayMs?: number; disabled?: boolean; maxWidth?: number; children: ReactElement<AnchorProps> }) {
+export function Tooltip({ label, side = 'right', align = 'center', delayMs = 0, disabled = false, portal = false, maxWidth, children }: { label: TooltipLabel; side?: TooltipSide; align?: 'center' | 'end'; delayMs?: number; disabled?: boolean; portal?: boolean; maxWidth?: number; children: ReactElement<AnchorProps> }) {
   const anchor = useRef<HTMLElement | null>(null)
   // React 18 keeps the element's ref outside props; forward it so wrapping an
   // anchor in Tooltip never silently severs the owner's ref.
@@ -184,6 +185,20 @@ export function Tooltip({ label, side = 'right', align = 'center', delayMs = 0,
     if (!triggers.current.hover && !triggers.current.focus) withdraw()
   }
 
+  const content = visible && !suppressed && (
+    <span
+      ref={bubble}
+      className={css.bubble}
+      data-side={placement}
+      data-portal={portal || undefined}
+      data-align={align}
+      style={{ left: pos.x, top: y, ...maxWidth === undefined ? {} : { maxWidth } }}
+      role="tooltip"
+    >
+      {resolvedLabel}
+    </span>
+  )
+
   return (
     <TooltipSuppression.Provider value={setSuppressed}>
       {cloneElement(children, {
@@ -197,18 +212,7 @@ export function Tooltip({ label, side = 'right', align = 'center', delayMs = 0,
         onFocus: (e) => { children.props.onFocus?.(e); if (pointerModality) return; triggers.current.focus = true; cancelShow(); show() },
         onBlur: (e) => { children.props.onBlur?.(e); triggers.current.focus = false; hide() },
       })}
-      {visible && !suppressed && (
-        <span
-          ref={bubble}
-          className={css.bubble}
-          data-side={placement}
-          data-align={align}
-          style={{ left: pos.x, top: y, ...maxWidth === undefined ? {} : { maxWidth } }}
-          role="tooltip"
-        >
-          {resolvedLabel}
-        </span>
-      )}
+      {portal ? (content !== false && createPortal(content, document.body)) : content}
     </TooltipSuppression.Provider>
   )
 }
diff --git a/packages/client/ui-primitives/src/icons/index.tsx b/packages/client/ui-primitives/src/icons/index.tsx
index 1a31577bb3..1c048370c1 100644
--- a/packages/client/ui-primitives/src/icons/index.tsx
+++ b/packages/client/ui-primitives/src/icons/index.tsx
@@ -1593,3 +1593,19 @@ export const IconSlidersTwoOutlineRegular = (props: IconProps) => (
 export const IconSlidersTwoOutlineMedium = (props: IconProps) => (
   <IconSlidersTwoOutlineArtwork {...props} strokeWidth={ICON_MEDIUM_STROKE} />
 )
+
+const IconMicrophoneOutlineArtwork = ({ size = 16, className, strokeWidth }: WeightedIconProps) => (
+  <svg width={size} height={size} viewBox="0 0 16 16" className={className} fill="none" stroke="currentColor" strokeWidth={strokeWidth} aria-hidden="true">
+    <rect x="6" y="1" width="4" height="8" rx="2" /><path d="M3 7v1a5 5 0 0 0 10 0V7M8 13v2m-3 0h6" />
+  </svg>
+)
+
+/** Regular one-pixel microphone artwork. */
+export const IconMicrophoneOutlineRegular = (props: IconProps) => (
+  <IconMicrophoneOutlineArtwork {...props} strokeWidth={ICON_REGULAR_STROKE} />
+)
+
+/** Medium microphone artwork with a 1.3px stroke. */
+export const IconMicrophoneOutlineMedium = (props: IconProps) => (
+  <IconMicrophoneOutlineArtwork {...props} strokeWidth={ICON_MEDIUM_STROKE} />
+)
diff --git a/packages/client/ui-primitives/tests/icons.client.spec.tsx b/packages/client/ui-primitives/tests/icons.client.spec.tsx
index d3f950e63d..62f67def95 100644
--- a/packages/client/ui-primitives/tests/icons.client.spec.tsx
+++ b/packages/client/ui-primitives/tests/icons.client.spec.tsx
@@ -17,13 +17,14 @@ const icons = Object.fromEntries(
 const iconNames = Object.keys(icons)
 
 describe('product icon set', () => {
-  it('exports regular and medium variants for all 91 public glyphs', () => {
-    expect(iconNames.length).toBe(182)
+  it('exports regular and medium variants for all 92 public glyphs', () => {
+    expect(iconNames.length).toBe(184)
     expect(iconNames.some(name => /\d+$/.test(name))).toBe(false)
     const regular = iconNames.filter(name => name.endsWith('Regular')).map(name => name.slice(0, -'Regular'.length))
     const medium = iconNames.filter(name => name.endsWith('Medium')).map(name => name.slice(0, -'Medium'.length))
     expect(medium.sort()).toEqual(regular.sort())
     expect(iconNames).toEqual(expect.arrayContaining([
+      'IconMicrophoneOutlineRegular',
       'IconPlanOutlineRegular', 'IconCompactOutlineRegular', 'IconShieldOutlineRegular', 'IconDeliverDocRegular',
       'IconWarningTriangleOutlineRegular', 'IconCompareSplitOutlineRegular', 'IconCloseCircleFillRegular',
     ]))
diff --git a/packages/client/ui-primitives/tests/state-dot.client.spec.tsx b/packages/client/ui-primitives/tests/state-dot.client.spec.tsx
index d3e21fe772..5b6bad53f0 100644
--- a/packages/client/ui-primitives/tests/state-dot.client.spec.tsx
+++ b/packages/client/ui-primitives/tests/state-dot.client.spec.tsx
@@ -57,6 +57,14 @@ describe('StateDot', () => {
   })
 })
 
+it('renders completed steps with a check and pending steps without one', () => {
+  const { container, rerender } = render(<StateDot state="done" appearance="step" size={16} />)
+  expect(container.querySelector('[data-state="done"] svg')).toBeTruthy()
+  rerender(<StateDot state="idle" appearance="step" size={16} />)
+  expect(container.querySelector('[data-state="idle"] svg')).toBeNull()
+  expect(container.firstElementChild?.className).toContain('step')
+})
+
 describe('StateDot ongoing phase', () => {
   it('pins every loader animation to document time zero on mount', () => {
     const animations = [{ startTime: 42 }, { startTime: 7 }]
diff --git a/packages/client/ui-primitives/tests/terminal-block.client.spec.tsx b/packages/client/ui-primitives/tests/terminal-block.client.spec.tsx
index 48f34678e9..432a20fde2 100644
--- a/packages/client/ui-primitives/tests/terminal-block.client.spec.tsx
+++ b/packages/client/ui-primitives/tests/terminal-block.client.spec.tsx
@@ -89,23 +89,50 @@ describe('TerminalBlock prompt label', () => {
 })
 
 describe('TerminalBlock states', () => {
-  it('running with nothing printed yet shows the command line only: no placeholder, no copy, no body', () => {
+  it('running with no output shows the command line only: no output box, no placeholder, no copy', () => {
     const view = render(<TerminalBlock command="sleep 5" running />)
     expect(view.getByText('sleep 5')).toBeTruthy()
+    expect(outputLines(view.container)).toEqual([])
     expect(view.queryByText('无输出')).toBeNull()
     expect(view.queryByRole('button')).toBeNull()
     expect(view.container.firstElementChild?.getAttribute('data-running')).toBe('')
-    expect(view.container.firstElementChild?.hasAttribute('data-body')).toBe(false)
+    // Banner-only: no body, so no banner divider either.
+    expect(view.container.firstElementChild?.getAttribute('data-body')).toBeNull()
   })
 
-  it('running shows the output printed so far under the banner, still without a copy control', () => {
-    const view = render(<TerminalBlock command="pnpm add x" running output={'Progress: resolved 1\n'} />)
-    expect(outputLines(view.container)).toEqual(['Progress: resolved 1'])
-    expect(view.queryByRole('button')).toBeNull()
+  it('copyText overrides the copy payload and keeps the control before any output', async () => {
+    const writeText = vi.fn().mockResolvedValue(undefined)
+    Object.defineProperty(navigator, 'clipboard', { configurable: true, value: { writeText } })
+    const view = render(<TerminalBlock command="npm run build --verbose" running copyText="npm run build --verbose" />)
+    // No output yet, but the command is already copyable.
+    const button = view.getByRole('button', { name: '复制' })
+    await act(async () => { fireEvent.click(button) })
+    expect(writeText).toHaveBeenCalledWith('npm run build --verbose')
+  })
+
+  it('omits the run-state dot and its assistive label when the host carries the state', () => {
+    const view = render(<TerminalBlock command="sleep 5" running output="partial" runStateDot={false} />)
+    expect(view.container.querySelector('[class*="runState"]')).toBeNull()
+    expect(view.queryByText('运行中')).toBeNull()
+  })
+
+  it('running with supplied output streams the live text without a default copy control', () => {
+    const view = render(<TerminalBlock command="sleep 5" running output="partial" />)
+    expect(view.getByText('partial')).toBeTruthy()
+    expect(view.queryByText('无输出')).toBeNull()
+    expect(view.queryByRole('button', { name: '复制' })).toBeNull()
     expect(view.container.firstElementChild?.getAttribute('data-running')).toBe('')
+    // Live output renders a body, so the banner divider returns.
     expect(view.container.firstElementChild?.getAttribute('data-body')).toBe('')
   })
 
+  it('running with an empty live stream draws neither output nor placeholder', () => {
+    const view = render(<TerminalBlock command="tail -f log" running output="" />)
+    expect(outputLines(view.container)).toEqual([])
+    expect(view.queryByText('无输出')).toBeNull()
+    expect(view.queryByRole('button')).toBeNull()
+  })
+
   it('running still shows a settled-looking status pill when one is supplied', () => {
     render(<TerminalBlock command="sleep 5" running signal="SIGINT" />)
     expect(screen.getByText('信号 SIGINT')).toBeTruthy()
diff --git a/packages/client/ui-primitives/tests/tooltip.client.spec.tsx b/packages/client/ui-primitives/tests/tooltip.client.spec.tsx
index 3f1c4f059c..5d6633c387 100644
--- a/packages/client/ui-primitives/tests/tooltip.client.spec.tsx
+++ b/packages/client/ui-primitives/tests/tooltip.client.spec.tsx
@@ -466,3 +466,18 @@ describe('Tooltip', () => {
     expect(screen.getByRole('tooltip').textContent).toBe('Open sidebar')
   })
 })
+
+
+it('keeps the anchor in its clipping container and portals only the tooltip', () => {
+  const view = render(<div style={{ overflow: 'hidden', contain: 'layout' }}>
+    <Tooltip portal label="Open in Music" side="bottom"><button type="button">File action</button></Tooltip>
+  </div>)
+  const anchor = screen.getByRole('button', { name: 'File action' })
+  fireEvent.mouseEnter(anchor)
+  const tooltip = screen.getByRole('tooltip')
+  expect(tooltip.parentElement).toBe(document.body)
+  expect(view.container.contains(anchor)).toBe(true)
+  expect(view.container.contains(tooltip)).toBe(false)
+  view.unmount()
+  expect(screen.queryByRole('tooltip')).toBeNull()
+})
diff --git a/packages/client/ui-session/tests/ui-session.client.spec.ts b/packages/client/ui-session/tests/ui-session.client.spec.ts
index 4fe28d1abf..a91f0e2b9c 100644
--- a/packages/client/ui-session/tests/ui-session.client.spec.ts
+++ b/packages/client/ui-session/tests/ui-session.client.spec.ts
@@ -54,7 +54,6 @@ function createSessionsBench(ctx: Context): SessionsBench {
     byId: {},
     phase: 'ready',
     projectionsBySession: {},
-    jobsBySession: {},
   })
   const bindings = new Map<SessionId, SessionBinding>()
   const scopes = new Map<SessionId, Context>()
diff --git a/packages/client/ui-settings-general/package.json b/packages/client/ui-settings-general/package.json
index b0d0e950b6..7e2ce5978b 100644
--- a/packages/client/ui-settings-general/package.json
+++ b/packages/client/ui-settings-general/package.json
@@ -22,6 +22,9 @@
       "types": "./lib/types/client/index.d.ts",
       "default": "./lib/client.js"
     },
+    "./types": {
+      "types": "./lib/types/types.d.ts"
+    },
     "./src/*": "./src/*",
     "./package.json": "./package.json"
   },
diff --git a/packages/client/ui-settings-general/src/client/DesktopUpdateIndicator.tsx b/packages/client/ui-settings-general/src/client/DesktopUpdateIndicator.tsx
index 4ee64a0f34..b4b10350a3 100644
--- a/packages/client/ui-settings-general/src/client/DesktopUpdateIndicator.tsx
+++ b/packages/client/ui-settings-general/src/client/DesktopUpdateIndicator.tsx
@@ -2,7 +2,7 @@
 import { IconDownloadOutlineRegular, IconLoadingOutlineRegular, Tooltip } from '@deepseek-ai/dsh-client-ui-primitives'
 import type { InjectFace, PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
 import css from './DesktopUpdateIndicator.module.css'
-import type { DesktopUpdateFailureKind, DesktopUpdatePresentation, DesktopUpdateView } from './desktop-update-bridge.ts'
+import type { DesktopUpdateFailureKind, DesktopUpdatePresentation, DesktopUpdateView } from '../types.ts'
 import type { SettingsRootInjected } from './shell-contract.ts'
 
 type SettingsTranslate = PropsLocale<'settings'>['t']
diff --git a/packages/client/ui-settings-general/src/client/desktop-update-source.ts b/packages/client/ui-settings-general/src/client/desktop-update-source.ts
index 7b34bf0efb..9b30244c1c 100644
--- a/packages/client/ui-settings-general/src/client/desktop-update-source.ts
+++ b/packages/client/ui-settings-general/src/client/desktop-update-source.ts
@@ -1,6 +1,6 @@
 /** Client-owned observation of the optional Desktop preload. */
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
-import type { DesktopUpdateBridge, DesktopUpdateView } from './desktop-update-bridge.ts'
+import type { DesktopUpdateBridge, DesktopUpdateView } from '../types.ts'
 
 /** Owns one preload subscription across both sidebar locations. */
 export class DesktopUpdateSource {
diff --git a/packages/client/ui-settings-general/src/client/index.ts b/packages/client/ui-settings-general/src/client/index.ts
index 427229d47c..77c321001d 100644
--- a/packages/client/ui-settings-general/src/client/index.ts
+++ b/packages/client/ui-settings-general/src/client/index.ts
@@ -25,7 +25,7 @@ import type {
 } from './shell-contract.ts'
 import { SettingsRoot } from './SettingsRoot.tsx'
 import { DesktopUpdateBadge } from './DesktopUpdateIndicator.tsx'
-import type { DesktopUpdateBridge } from './desktop-update-bridge.ts'
+import type { DesktopUpdateBridge } from '../types.ts'
 import { DesktopUpdateSource } from './desktop-update-source.ts'
 import { CloseLabel, HeaderContent, TriggerContent } from './chrome.tsx'
 import { GeneralSection } from './GeneralSection.tsx'
diff --git a/packages/client/ui-settings-general/src/client/shell-contract.ts b/packages/client/ui-settings-general/src/client/shell-contract.ts
index bc8497361b..9f2690ac96 100644
--- a/packages/client/ui-settings-general/src/client/shell-contract.ts
+++ b/packages/client/ui-settings-general/src/client/shell-contract.ts
@@ -15,7 +15,7 @@ import type {
 import type {} from '@deepseek-ai/dsh-client-ui-sidebar/client'
 // Type-only: pulls the settings slot declarations the shell renders into.
 import type {} from '@deepseek-ai/dsh-client-ui-settings/client'
-import type { DesktopUpdateView } from './desktop-update-bridge.ts'
+import type { DesktopUpdateView } from '../types.ts'
 
 /** One nav row projected from a settings.section registration's options. */
 export interface SettingsSectionRow {
diff --git a/packages/client/ui-settings-general/src/client/desktop-update-bridge.ts b/packages/client/ui-settings-general/src/types.ts
similarity index 91%
rename from packages/client/ui-settings-general/src/client/desktop-update-bridge.ts
rename to packages/client/ui-settings-general/src/types.ts
index 82eda22079..f9dae34f87 100644
--- a/packages/client/ui-settings-general/src/client/desktop-update-bridge.ts
+++ b/packages/client/ui-settings-general/src/types.ts
@@ -1,4 +1,4 @@
-/** Optional Electron preload declarations consumed by the settings row. */
+/** Type-only Electron update declarations shared by the settings UI and Desktop compatibility checks. */
 
 /** Classified failure copy selected by the Web locale without exposing raw updater diagnostics. */
 export type DesktopUpdateFailureKind =
diff --git a/packages/client/ui-settings-general/tests/components.client.spec.tsx b/packages/client/ui-settings-general/tests/components.client.spec.tsx
index fab06a77e7..e81254d0bc 100644
--- a/packages/client/ui-settings-general/tests/components.client.spec.tsx
+++ b/packages/client/ui-settings-general/tests/components.client.spec.tsx
@@ -25,7 +25,7 @@ function derivedDocumentStore(remote: object) {
 import { en, zh } from '../src/client/locales.ts'
 import { CurrentVersionRow } from '../src/client/CurrentVersionRow.tsx'
 import { DesktopUpdateBadge } from '../src/client/DesktopUpdateIndicator.tsx'
-import type { DesktopUpdateView } from '../src/client/desktop-update-bridge.ts'
+import type { DesktopUpdateView } from '../src/types.ts'
 
 afterEach(() => { cleanup(); vi.unstubAllEnvs() })
 
diff --git a/packages/client/ui-settings-general/tests/desktop-update.client.spec.tsx b/packages/client/ui-settings-general/tests/desktop-update.client.spec.tsx
index 316204370d..b16119a527 100644
--- a/packages/client/ui-settings-general/tests/desktop-update.client.spec.tsx
+++ b/packages/client/ui-settings-general/tests/desktop-update.client.spec.tsx
@@ -4,7 +4,7 @@ import { useSyncExternalStore } from 'react'
 import { afterEach, expect, it, vi } from 'vitest'
 import type { PropsLocale } from '@deepseek-ai/dsh-client-ui-slots'
 import { DesktopUpdateIndicator } from '../src/client/DesktopUpdateIndicator.tsx'
-import type { DesktopUpdateBridge, DesktopUpdatePresentation } from '../src/client/desktop-update-bridge.ts'
+import type { DesktopUpdateBridge, DesktopUpdatePresentation } from '../src/types.ts'
 import { DesktopUpdateSource } from '../src/client/desktop-update-source.ts'
 import { en, zh } from '../src/client/locales.ts'
 
diff --git a/packages/client/ui-settings-general/tests/host.client.spec.ts b/packages/client/ui-settings-general/tests/index.host.spec.ts
similarity index 100%
rename from packages/client/ui-settings-general/tests/host.client.spec.ts
rename to packages/client/ui-settings-general/tests/index.host.spec.ts
diff --git a/packages/client/ui-settings-general/tests/settings-root.client.spec.tsx b/packages/client/ui-settings-general/tests/settings-root.client.spec.tsx
index 74a5b22cfb..aa270b6fea 100644
--- a/packages/client/ui-settings-general/tests/settings-root.client.spec.tsx
+++ b/packages/client/ui-settings-general/tests/settings-root.client.spec.tsx
@@ -9,7 +9,7 @@ import { SessionId } from '@deepseek-ai/dsh-session/types'
 import type { SettingsRootComponentProps } from '../src/client/shell-contract.ts'
 import { SettingsRoot } from '../src/client/SettingsRoot.tsx'
 import { en, zh } from '../src/client/locales.ts'
-import type { DesktopUpdateView } from '../src/client/desktop-update-bridge.ts'
+import type { DesktopUpdateView } from '../src/types.ts'
 
 // Every fixture carries the resource hook the resources plugin merges into GlobalStandardProps.
 const useResource = (() => ({ status: 'none' as const, value: undefined, failure: undefined, reload: () => {} })) as GlobalStandardProps['useResource']
@@ -88,7 +88,7 @@ function mount({
         updatedAt: 0,
       },
     },
-    phase: 'ready', projectionsBySession: {}, jobsBySession: {},
+    phase: 'ready', projectionsBySession: {},
   }
   const unusedHook = (() => { throw new Error('unused by SettingsRoot') }) as never
   const props: SettingsRootComponentProps = {
diff --git a/packages/client/ui-settings-general/tests/shell.client.spec.ts b/packages/client/ui-settings-general/tests/shell.client.spec.ts
index f0ed057d43..2f4c9a6714 100644
--- a/packages/client/ui-settings-general/tests/shell.client.spec.ts
+++ b/packages/client/ui-settings-general/tests/shell.client.spec.ts
@@ -11,7 +11,7 @@ import { createClientTest, type TestClient, webApp } from '@deepseek-ai/dsh-clie
 import { inject } from '../src/client/index.ts'
 import type { SettingsRootInjected } from '../src/client/shell-contract.ts'
 import { SettingsRoot } from '../src/client/SettingsRoot.tsx'
-import type { DesktopUpdatePresentation } from '../src/client/desktop-update-bridge.ts'
+import type { DesktopUpdatePresentation } from '../src/types.ts'
 
 const SELF = '@deepseek-ai/dsh-client-ui-settings-general'
 const SIDEBAR = '@deepseek-ai/dsh-client-ui-sidebar'
diff --git a/packages/client/ui-settings-general/tsconfig.client.json b/packages/client/ui-settings-general/tsconfig.client.json
new file mode 100644
index 0000000000..aa580faf19
--- /dev/null
+++ b/packages/client/ui-settings-general/tsconfig.client.json
@@ -0,0 +1,28 @@
+{
+  "extends": "../../../tsconfig.base.client.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "lib/types",
+    "tsBuildInfoFile": "lib/tsconfig.client.tsbuildinfo"
+  },
+  "include": [
+    "src/client",
+    "src/types.ts",
+    "src/css-modules.d.ts"
+  ],
+  "references": [
+    { "path": "../../../vendor/cordis" },
+    { "path": "../../../vendor/schemastery" },
+    { "path": "../ui-slots" },
+    { "path": "../ui-primitives" },
+    { "path": "../ui-renderer" },
+    { "path": "../ui-session" },
+    { "path": "../store" },
+    { "path": "../ui-settings" },
+    { "path": "../locale" },
+    { "path": "../connection/tsconfig.client.json" },
+    { "path": "../../settings/settings" },
+    { "path": "../../api/remotes/tsconfig.client.json" },
+    { "path": "../ui-sidebar" }
+  ]
+}
diff --git a/packages/client/ui-settings-general/tsconfig.host.json b/packages/client/ui-settings-general/tsconfig.host.json
new file mode 100644
index 0000000000..466d8deab2
--- /dev/null
+++ b/packages/client/ui-settings-general/tsconfig.host.json
@@ -0,0 +1,17 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "lib/types",
+    "tsBuildInfoFile": "lib/tsconfig.host.tsbuildinfo"
+  },
+  "files": [
+    "src/index.ts",
+    "src/types.ts"
+  ],
+  "references": [
+    { "path": "../../../vendor/cordis" },
+    { "path": "../../../vendor/schemastery" },
+    { "path": "../../settings/settings" }
+  ]
+}
diff --git a/packages/client/ui-settings-general/tsconfig.json b/packages/client/ui-settings-general/tsconfig.json
index a0984445cd..2a0b0e33f7 100644
--- a/packages/client/ui-settings-general/tsconfig.json
+++ b/packages/client/ui-settings-general/tsconfig.json
@@ -1,51 +1,7 @@
 {
-  "extends": "../../../tsconfig.base.client.json",
-  "compilerOptions": {
-    "rootDir": "src",
-    "outDir": "lib/types"
-  },
-  "include": [
-    "src"
-  ],
+  "files": [],
   "references": [
-    {
-      "path": "../../../vendor/cordis"
-    },
-    {
-      "path": "../../../vendor/schemastery"
-    },
-    {
-      "path": "../ui-slots"
-    },
-    {
-      "path": "../ui-primitives"
-    },
-    {
-      "path": "../ui-renderer"
-    },
-    {
-      "path": "../ui-session"
-    },
-    {
-      "path": "../store"
-    },
-    {
-      "path": "../ui-settings"
-    },
-    {
-      "path": "../locale"
-    },
-    {
-      "path": "../connection/tsconfig.client.json"
-    },
-    {
-      "path": "../../settings/settings"
-    },
-    {
-      "path": "../../api/remotes/tsconfig.client.json"
-    },
-    {
-      "path": "../ui-sidebar"
-    }
+    { "path": "./tsconfig.host.json" },
+    { "path": "./tsconfig.client.json" }
   ]
 }
diff --git a/packages/client/ui-sidebar-browser/README.i18n.yaml b/packages/client/ui-sidebar-browser/README.i18n.yaml
index 455edd84ea..9cd455c8d6 100644
--- a/packages/client/ui-sidebar-browser/README.i18n.yaml
+++ b/packages/client/ui-sidebar-browser/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-sidebar-browser/README.md
-README.md: dcfaccdfb85cdada9300aadb2f6e9058dc5a95bc
-README.zh.md: 8d5c34ab4c1b4d87e2a25912f38f102442f7a454
+README.md: 52ebeddd088a8427b1bf058442b6fab6a768de37
+README.zh.md: 93df01dbe13bfa4a5aa318a1fd3a9e9786cd3c67
diff --git a/packages/client/ui-sidebar-browser/README.md b/packages/client/ui-sidebar-browser/README.md
index dcfaccdfb8..52ebeddd08 100644
--- a/packages/client/ui-sidebar-browser/README.md
+++ b/packages/client/ui-sidebar-browser/README.md
@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
 
 ## Summary
 
-Browse HTTP(S) pages, including loopback services, inside independent right-Sidebar tabs. The current carrier is an iframe with application-managed history in both Web and Desktop. The package never injects Electron or Node access into visited content.
+Browse HTTP(S) pages, including loopback services, inside independent right-Sidebar tabs. Web uses an iframe with application-managed history; Desktop uses Electron `<webview>` with native navigation history and retained pages. The package never injects Electron or Node access into visited content.
 
 ## Table of Contents
 
@@ -42,7 +42,7 @@ The package has no plugin configuration. A Web profile enables the shipped entry
 
 Client plugins can open a tab through `ctx.sidebarRight.openTab('browser', { params: { url } })`. The optional URL passes the same validation as address-bar input before navigation.
 
-The toolbar provides Back, Forward, Reload, Go, Open in system browser, and a rightmost per-tab sandbox toggle. Disabling the sandbox is temporary and displays a warning. The external action accepts a known HTTP(S) target. The tab title is the Web host.
+The toolbar provides Back, Forward, Reload, Go, and Open in system browser. Web also offers a per-tab sandbox toggle; disabling it is temporary and displays a warning. Desktop shows the observed page title. After a restart, Browser shows the saved title and URL; Restore or Reload opens that address only when requested.
 
 -----
 
@@ -58,15 +58,15 @@ The address parser accepts HTTP and HTTPS, including loopback targets. It reject
 
 ### Iframe carrier
 
-Web and Desktop use `sandbox="allow-scripts allow-forms allow-same-origin allow-popups allow-popups-to-escape-sandbox"` by default. The frame has no direct download or top-navigation flag. Popups leave the sandbox; in Web, an escaped popup retains its opener and can navigate the top-level application. The visited origin can use its own cookies and Web storage but a cross-origin target cannot read DSH DOM, storage, or API responses. The iframe sends no referrer and adds no package-owned Permissions Policy, so browser defaults and user grants apply. The toolbar can remove the sandbox for the current tab occurrence; the choice is not persisted. An unsandboxed page can navigate the top-level application under browser activation rules and use downloads, modal dialogs, and input locks. The package does not proxy or probe remote pages.
+Web uses `sandbox="allow-scripts allow-forms allow-same-origin allow-popups allow-popups-to-escape-sandbox"` by default. The frame has no direct download or top-navigation flag. Popups leave the sandbox; in Web, an escaped popup retains its opener and can navigate the top-level application. The visited origin can use its own cookies and Web storage but a cross-origin target cannot read DSH DOM, storage, or API responses. The iframe sends no referrer and adds no package-owned Permissions Policy, so browser defaults and user grants apply. The toolbar can remove the sandbox for the current tab occurrence; the choice is not persisted. An unsandboxed page can navigate the top-level application under browser activation rules and use downloads, modal dialogs, and input locks. The package does not proxy or probe remote pages.
 
 Web records toolbar submissions and typed tab opens. A navigation state machine treats the first iframe load for each controlled revision as known and a later load as proof that the page changed to an unreadable URL. In that unknown state the address is marked, Back, Forward, and external-open are disabled, and Reload returns to the last controlled URL. A remounted body reloads the latest application-known URL and uses its optional initial URL only before the first controlled target. History API and fragment changes that emit no iframe load remain invisible. An iframe `error` event displays a transient load-failure notice until the next controlled load without changing URL history.
 
 ### Controller
 
-Each tab receives one `BrowserController` class. Its public commands are `loadUrl`, `goBack`, `goForward`, and `reload`; address validation and history mutation stay behind that object. Its `BrowserNavigation` class owns the serializable URL state machine. The `BrowserFrame` interface owns transient sandbox and document state plus carrier operations, and `IframeImpl` implements that interface for the current iframe carrier. Slot injection exposes keyed frame state through `useBrowserFrame` and supplies plain callbacks, so the React body receives neither the controller nor an observable source; it keeps only the editable draft and iframe DOM.
+Each tab's `BrowserController` owns address validation, commands and explicit restoration. `BrowserFrame` supplies carrier-neutral navigation state; `IframeImpl` uses `BrowserNavigation`, while `ElectronWebViewImpl` observes Chromium history. `BrowserPresentation` owns physical DOM attachment. Slot injection supplies `useBrowserState` and plain callbacks, keeping provider objects and observables out of the React body.
 
-The controller interface does not depend on iframe APIs. A future `ElectronWebViewImpl` can implement `BrowserFrame` while owning `<webview>` attachment and target identity. That deferred carrier is documented in the same Sidebar Browser decision, but is not registered or tested today.
+Desktop's main process approves guest leases and enforces attachment, navigation and permission policy. Preload exposes only scoped Browser operations. Shared declarations use the standard `/types` export with `import type`; the Host and Client compile through separate tsconfig files. Desktop Browser tabs declare `keepMounted`, so Sidebar preserves their DOM across tab changes, Session switches, collapse and floating.
 
 </details>
 
@@ -77,7 +77,8 @@ The controller interface does not depend on iframe APIs. A future `ElectronWebVi
 
 - [Right Sidebar](../../../docs/subsystems/sidebar-right.md) — tab composition, navigation, and lifecycle.
 - [Document Preview](../ui-sidebar-documentpreview/README.md) — local source, Markdown, images, HTML, and PDF rendering.
-- [Sidebar Browser decision](../../../.agents/notes/implemented/feature/2026-09-16-sidebar-browser.md) — current iframe behavior, controller ownership, and deferred Electron carrier.
+- [Sidebar Browser decision](../../../.agents/notes/implemented/feature/2026-09-16-sidebar-browser.md) — iframe behavior and controller ownership.
+- [Desktop Browser decision](../../../.agents/notes/implemented/feature/2026-09-20-desktop-browser-webview.md) — webview leases, CWD storage grouping and manual restoration.
 
 -----
 
@@ -100,9 +101,9 @@ The isolation policy deliberately gives up some browser compatibility:
 - In Web, a popup that escapes the sandbox retains its opener and can use that chain to navigate the top-level application. Desktop handles popup creation separately.
 - A later iframe load reveals that navigation occurred but not the new cross-origin URL. History API and fragment changes may remain invisible; Web Back and Forward are unavailable after the state becomes unknown.
 - Browsers conceal many iframe failures for security: DNS, TLS, mixed-content, CSP, and `X-Frame-Options` failures may emit `load` or no actionable event instead of `error`. The load-failure notice is best-effort.
-- Browser history survives body remounts and ordinary page reloads, but closing the tab or unloading `ui-sidebar-right` aborts its occurrence and removes the stored history bucket.
+- Saved title and URL survive reloads and plugin unload while the tab remains in Sidebar's layout. Closing the tab removes its checkpoint. Restart restoration does not recover page memory, unsaved forms or Chromium's history stack.
 - Local files are rejected and remain owned by Document Preview.
-- The proposed Electron `<webview>` carrier, per-tab cookie partitions, native history, and target-specific CDP connection are not implemented.
+- Desktop shares process-local storage partitions by canonical workspace CWD; Sessions without a resolved Workspace are isolated separately. Cookies and Web storage do not survive application restart. Guest permissions, downloads and native popups are denied; approved HTTP(S) popup requests open Sidebar tabs. Host-address filtering is not a general private-network or DNS-rebinding firewall.
 
 <a id="dev-note"></a>
 ### Dev Note
@@ -114,4 +115,4 @@ None.
 
 </details>
 
-**Runtime invariant:** No companion is published. `BrowserNavigation` is the sole URL-state writer; the store receives its immutable snapshots, and focused controller and component tests exercise publication and cleanup directly.
+**Runtime invariant:** No companion is published. Each navigation provider owns its live state and publishes checkpoints directly; the UI consumes the same provider state through its controller.
diff --git a/packages/client/ui-sidebar-browser/README.zh.md b/packages/client/ui-sidebar-browser/README.zh.md
index 8d5c34ab4c..93df01dbe1 100644
--- a/packages/client/ui-sidebar-browser/README.zh.md
+++ b/packages/client/ui-sidebar-browser/README.zh.md
@@ -9,7 +9,7 @@ kind: "package-reference"
 
 ## 概述
 
-在独立的右侧 Sidebar tab 中浏览 HTTP(S) 页面，包括 loopback 服务。当前 Web 与 Desktop 都使用 iframe 和应用维护的 history。本包不会向被访问内容注入 Electron 或 Node 能力。
+在独立的右侧 Sidebar tab 中浏览 HTTP(S) 页面，包括 loopback 服务。Web 使用 iframe 和应用维护的 history；Desktop 使用 Electron `<webview>`、原生导航 history 和保活页面。本包不会向被访问内容注入 Electron 或 Node 能力。
 
 ## 目录
 
@@ -42,7 +42,7 @@ Browser 在 Web profile 中默认禁用，在 Desktop 中默认启用。Web 用
 
 Client 插件可以调用 `ctx.sidebarRight.openTab('browser', { params: { url } })` 打开 tab。可选 URL 会在导航前接受与地址栏输入相同的校验。
 
-工具栏提供后退、前进、刷新、前往、在系统浏览器中打开，以及最右侧的逐 tab sandbox 开关。关闭 sandbox 是临时选择，并会显示警告。外部打开接受已知的 HTTP(S) 目标。tab 标题显示 Web 主机名。
+工具栏提供后退、前进、刷新、前往和在系统浏览器中打开。Web 还提供逐 tab sandbox 开关；关闭它是临时选择，并会显示警告。Desktop 显示观察到的页面标题。重启后，Browser 展示保存的标题和 URL；只有点击恢复或刷新才打开该地址。
 
 -----
 
@@ -58,15 +58,15 @@ Client 插件可以调用 `ctx.sidebarRight.openTab('browser', { params: { url }
 
 ### Iframe 载体
 
-Web 与 Desktop 默认使用 `sandbox="allow-scripts allow-forms allow-same-origin allow-popups allow-popups-to-escape-sandbox"`。frame 没有直接的下载或顶层导航 flag。popup 会脱离 sandbox；在 Web 中，逃逸的 popup 会保留 opener，并可以导航顶层应用。被访问的 origin 可以使用自身 Cookie 与 Web storage，但跨域目标无法读取 DSH DOM、storage 或 API 响应。iframe 不发送 referrer，也不添加包自有的 Permissions Policy，因此浏览器默认策略与用户授权生效。toolbar 可以为当前 tab occurrence 移除 sandbox；该选择不持久化。未受 sandbox 约束的页面可以按浏览器 activation 规则导航顶层应用，并使用下载、模态对话框和输入锁定。本包不代理或探测远程页面。
+Web 默认使用 `sandbox="allow-scripts allow-forms allow-same-origin allow-popups allow-popups-to-escape-sandbox"`。frame 没有直接的下载或顶层导航 flag。popup 会脱离 sandbox；在 Web 中，逃逸的 popup 会保留 opener，并可以导航顶层应用。被访问的 origin 可以使用自身 Cookie 与 Web storage，但跨域目标无法读取 DSH DOM、storage 或 API 响应。iframe 不发送 referrer，也不添加包自有的 Permissions Policy，因此浏览器默认策略与用户授权生效。toolbar 可以为当前 tab occurrence 移除 sandbox；该选择不持久化。未受 sandbox 约束的页面可以按浏览器 activation 规则导航顶层应用，并使用下载、模态对话框和输入锁定。本包不代理或探测远程页面。
 
 Web 记录 toolbar 提交和 typed tab 打开。导航状态机把每个受控 revision 的第一次 iframe load 视为已知，把后续 load 视为页面已经变化到不可读取 URL 的证据。进入 unknown 状态后，地址会显示标记，后退、前进和外部打开会禁用，刷新则返回最后一个受控 URL。body 重挂载时会重新加载应用最后已知的 URL，并且仅在尚无受控目标时使用可选初始 URL。不产生 iframe load 的 History API 与 fragment 变化仍不可见。iframe `error` event 会显示临时加载失败 notice，直到下一个受控加载，但不会改变 URL history。
 
 ### Controller
 
-每个 tab 获得一个 `BrowserController` class。它的公开命令只有 `loadUrl`、`goBack`、`goForward` 与 `reload`；地址校验与 history 变更均由该对象封装。它的 `BrowserNavigation` class 拥有可序列化的 URL 状态机。`BrowserFrame` 接口负责临时 sandbox 与 document 状态以及载体操作，`IframeImpl` 为当前 iframe 载体实现该接口。Slot injection 通过 `useBrowserFrame` 提供按 key 索引的 frame 状态，并提供普通 callback，因此 React body 不接收 controller 或 observable source；它只保留可编辑草稿与 iframe DOM。
+每个 tab 的 `BrowserController` 负责地址校验、命令和显式恢复。`BrowserFrame` 提供与载体无关的导航状态；`IframeImpl` 使用 `BrowserNavigation`，`ElectronWebViewImpl` 观察 Chromium history。`BrowserPresentation` 负责 DOM 的物理挂载。Slot injection 提供 `useBrowserState` 和普通 callback，React body 不接收 provider 对象或 observable。
 
-Controller 接口不依赖 iframe API。未来的 `ElectronWebViewImpl` 可以实现 `BrowserFrame`，并持有 `<webview>` attachment 与 target identity。该延期载体记录在同一份 Sidebar Browser 决策中，当前不注册也不测试。
+Desktop 主进程批准 guest 租约，并执行挂载、导航和权限策略。preload 只暴露限定范围的 Browser 操作。共享声明通过标准 `/types` 出口配合 `import type` 引入；Host 与 Client 使用独立 tsconfig 编译。Desktop Browser tab 声明 `keepMounted`，Sidebar 因而在切 tab、切 Session、收起与浮动期间保留其 DOM。
 
 </details>
 
@@ -77,7 +77,8 @@ Controller 接口不依赖 iframe API。未来的 `ElectronWebViewImpl` 可以
 
 - [右侧 Sidebar](../../../docs/subsystems/sidebar-right.zh.md)——tab composition、导航与生命周期。
 - [Document Preview](../ui-sidebar-documentpreview/README.zh.md)——本地源码、Markdown、图片、HTML 与 PDF 渲染。
-- [Sidebar Browser 决策](../../../.agents/notes/implemented/feature/2026-09-16-sidebar-browser.zh.md)——当前 iframe 行为、controller 所有权与延期 Electron 载体。
+- [Sidebar Browser 决策](../../../.agents/notes/implemented/feature/2026-09-16-sidebar-browser.zh.md)——iframe 行为与 controller 所有权。
+- [Desktop Browser 决策](../../../.agents/notes/implemented/feature/2026-09-20-desktop-browser-webview.zh.md)——webview 租约、CWD 存储分组与手动恢复。
 
 -----
 
@@ -100,9 +101,9 @@ Controller 接口不依赖 iframe API。未来的 `ElectronWebViewImpl` 可以
 - 在 Web 中，逃逸出 sandbox 的 popup 会保留 opener，并可以通过该链导航顶层应用。Desktop 会单独处理 popup 创建。
 - 后续 iframe load 能表明发生了导航，但无法给出新的跨域 URL。History API 与 fragment 变化可能仍不可见；状态变成 unknown 后，Web 的后退与前进不可用。
 - 出于安全原因，浏览器会隐藏很多 iframe 失败：DNS、TLS、mixed-content、CSP 与 `X-Frame-Options` 失败可能触发 `load`，也可能不提供可操作 event，而不是触发 `error`。加载失败 notice 只能作为 best-effort 提示。
-- Browser history 会跨 body 重挂载与普通页面刷新保留，但关闭 tab 或卸载 `ui-sidebar-right` 会中止其 occurrence 并删除已存储的 history bucket。
+- 只要 tab 仍在 Sidebar 布局中，保存的标题和 URL 就会跨刷新与插件卸载保留。关闭 tab 会删除其检查点。重启恢复不恢复页面内存、未保存的表单或 Chromium history 栈。
 - 本地文件会被拒绝，并继续由 Document Preview 负责。
-- 拟议的 Electron `<webview>` 载体、per-tab Cookie partition、原生 history 和 target-specific CDP 连接尚未实现。
+- Desktop 按规范化的工作区 CWD 共享进程内存储分区；没有解析到 Workspace 的 Session 单独隔离。Cookie 与 Web storage 不跨应用重启保留。guest 权限、下载与原生 popup 均被拒绝；通过检查的 HTTP(S) popup 请求会打开 Sidebar tab。Host 地址过滤不是通用私网或 DNS-rebinding 防火墙。
 
 <a id="dev-note"></a>
 ### 开发备注
@@ -114,4 +115,4 @@ Controller 接口不依赖 iframe API。未来的 `ElectronWebViewImpl` 可以
 
 </details>
 
-**运行时不变量：** 不发布 companion。`BrowserNavigation` 是唯一的 URL 状态写入方；store 接收它的 immutable snapshot，controller 与组件的聚焦测试直接覆盖发布与清理。
+**运行时不变量：** 不发布 companion。每个导航 provider 拥有自身的实时状态并直接发布检查点；UI 通过 controller 消费同一份 provider 状态。
diff --git a/packages/client/ui-sidebar-browser/package.json b/packages/client/ui-sidebar-browser/package.json
index 3e833cf496..94f05df6ed 100644
--- a/packages/client/ui-sidebar-browser/package.json
+++ b/packages/client/ui-sidebar-browser/package.json
@@ -22,12 +22,16 @@
       "types": "./lib/types/client/index.d.ts",
       "default": "./lib/client.js"
     },
+    "./types": {
+      "types": "./lib/types/types.d.ts"
+    },
     "./src/*": "./src/*",
     "./package.json": "./package.json"
   },
   "dsh": {
     "client": {
       "inject": [
+        "@deepseek-ai/dsh-api-workspace-controller",
         "@deepseek-ai/dsh-client-ui-sidebar-right",
         "@deepseek-ai/dsh-client-ui-session"
       ],
@@ -44,6 +48,8 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "workspace:^",
+    "@deepseek-ai/dsh-api-workspace-controller": "workspace:^",
+    "@deepseek-ai/dsh-brand": "workspace:^",
     "@deepseek-ai/dsh-client-locale": "workspace:^",
     "@deepseek-ai/dsh-client-store": "workspace:^",
     "@deepseek-ai/dsh-client-ui-dockkit": "workspace:^",
diff --git a/packages/client/ui-sidebar-browser/src/client/browser/BrowserController.ts b/packages/client/ui-sidebar-browser/src/client/browser/BrowserController.ts
index afa413010f..45d17bb259 100644
--- a/packages/client/ui-sidebar-browser/src/client/browser/BrowserController.ts
+++ b/packages/client/ui-sidebar-browser/src/client/browser/BrowserController.ts
@@ -1,166 +1,267 @@
-/** Per-tab Browser controller. */
-import type { BoundActions } from '@deepseek-ai/dsh-client-store'
+/** Carrier-independent tab commands and renderer-facing state. */
+import { createSnapshotStore, type BoundActions, type SnapshotStore } from '@deepseek-ai/dsh-client-store'
 import type { TabId } from '@deepseek-ai/dsh-client-ui-dockkit'
 import type { HostObservable } from '@deepseek-ai/dsh-client-ui-slots'
-import { IframeImpl } from './BrowserFrame.ts'
-import type { BrowserFrame, BrowserFrameState } from './BrowserFrame.ts'
-import { BrowserNavigation } from './BrowserNavigation.ts'
-import type { BrowserTabState } from './BrowserNavigation.ts'
+import type { BrowserFrameState } from './BrowserFrame.ts'
+import type { BrowserPage, BrowserPageFactory } from './BrowserPage.ts'
+import { currentBrowserTarget, type BrowserTabState } from './BrowserPersistence.ts'
 import type { BrowserStore } from './store.ts'
-import { parseBrowserAddress } from './url.ts'
+import { parseBrowserAddress, type BrowserAddressFailure, type BrowserTarget } from './url.ts'
 
-/** Construction dependencies for one tab-scoped Browser controller. */
+/** Live tab state; navigation comes from its provider and draft validation stays local. */
+export interface BrowserControllerState {
+  readonly frame: BrowserFrameState
+  /** Saved address offered for explicit restoration before any page has been requested. */
+  readonly restoreTarget: BrowserTarget | undefined
+  readonly addressFailure: BrowserAddressFailure | undefined
+  readonly addressRevision: number
+}
+
+/** Construction inputs for one tab occurrence. */
 export interface BrowserControllerOptions {
   readonly tabId: TabId
   readonly signal: AbortSignal
   readonly applicationOrigin: string
-  readonly initial?: BrowserTabState
+  readonly initial: BrowserTabState | undefined
   readonly actions: BoundActions<BrowserStore>
+  readonly createPage: BrowserPageFactory
+  readonly openTab: (url: string) => void
 }
 
-/** Owns one Browser tab's URL state, loading lifecycle, and four navigation commands. */
-export class BrowserController {
-  /** Renderer-facing iframe and sandbox state. */
-  readonly frame: BrowserFrame
-  private readonly navigation: BrowserNavigation
+/** Owns input validation and page lifetime without inspecting the carrier type. */
+export class BrowserController implements HostObservable<BrowserControllerState> {
+  private readonly page: BrowserPage
+  private readonly store: SnapshotStore<BrowserControllerState>
+  private readonly unsubscribe: () => void
+  private actions: BoundActions<BrowserStore>
+  private checkpoint: BrowserTabState | undefined
+  private started = false
   private disposed = false
+  private disposal: Promise<void> | undefined
+  private readonly abort = (): void => { void this.dispose() }
+
+  /** @param options - identity, persistence, page factory and source-tab navigation. */
+  constructor(private readonly options: BrowserControllerOptions) {
+    this.actions = options.actions
+    this.checkpoint = options.initial
+    this.page = options.createPage({
+      initial: options.initial,
+      persist: (state) => {
+        if (this.disposed) return
+        this.checkpoint = state
+        this.actions.replace(options.tabId, state)
+      },
+      openRequested: (value) => {
+        if (this.disposed) return
+        const result = parseBrowserAddress(value, options.applicationOrigin)
+        if (!result.ok) { this.addressFailed(result.reason); return }
+        options.openTab(result.target.url)
+      },
+    })
+    this.store = createSnapshotStore({ frame: this.page.frame.getSnapshot(),
+      restoreTarget: currentBrowserTarget(this.checkpoint), addressFailure: undefined, addressRevision: 0 })
+    this.unsubscribe = this.page.frame.subscribe(() => {
+      if (this.disposed) return
+      const current = this.store.getSnapshot()
+      const frame = this.page.frame.getSnapshot()
+      const changed = frame.target?.url !== current.frame.target?.url
+      this.store.set({ frame, restoreTarget: frame.target === undefined ? currentBrowserTarget(this.checkpoint) : undefined,
+        addressFailure: changed ? undefined : current.addressFailure,
+        addressRevision: current.addressRevision + Number(changed) })
+    })
+    options.signal.addEventListener('abort', this.abort, { once: true })
+  }
+
+  /** @returns immutable state for the common toolbar. */
+  getSnapshot = (): BrowserControllerState => this.store.getSnapshot()
+  /** @param listener - state invalidation. @returns unsubscribe callback. */
+  subscribe = (listener: () => void): (() => void) => this.store.subscribe(listener)
 
   /**
-   * @param options - tab identity, persistence writer, URL origin, and lifetime.
+   * Attach the page without transferring ownership of its tab occurrence.
+   * @param viewportId - mounted content container.
+   * @returns physical attachment cleanup only.
    */
-  constructor(private readonly options: BrowserControllerOptions) {
-    this.navigation = new BrowserNavigation(options.initial)
-    this.frame = new IframeImpl(
-      () => { this.reload() },
-      (revision) => { this.frameLoaded(revision) },
-    )
-    options.signal.addEventListener('abort', () => { this.dispose() }, { once: true })
+  mount(viewportId: string): () => void {
+    this.publishSaved()
+    return this.page.presentation.mount(viewportId)
   }
 
   /**
-   * Validate and load one address, replacing a same-address load with Reload.
-   * @param value - address-bar or typed-tab value.
+   * Consume initial navigation once; a saved checkpoint alone never starts a page.
+   * @param initialUrl - explicit typed-open address, or absence.
+   */
+  start(initialUrl: string | undefined): void {
+    if (this.started || this.disposed) return
+    this.started = true
+    if (initialUrl !== undefined) this.loadUrl(initialUrl)
+  }
+
+  /** Load the saved address only after an explicit restore action. */
+  restore(): void {
+    const target = this.store.getSnapshot().restoreTarget
+    if (target !== undefined) this.loadUrl(target.url)
+  }
+
+  /**
+   * Validate an address before navigation, publishing invalid input for correction.
+   * @param value - address-bar or typed-open input.
    */
   loadUrl(value: string): void {
     if (this.disposed) return
     const parsed = parseBrowserAddress(value, this.options.applicationOrigin)
-    if (!parsed.ok) {
-      this.navigation.addressFailed(parsed.reason)
-      this.publish()
-      return
-    }
-    const current = BrowserNavigation.current(this.navigation.snapshot)
-    if (current?.url === parsed.target.url) {
-      this.reload()
-      return
-    }
-    this.start(this.navigation.navigate(parsed.target))
+    if (!parsed.ok) { this.addressFailed(parsed.reason); return }
+    this.command(() => { this.page.frame.loadUrl(parsed.target) })
   }
 
-  /** Move to the preceding application-known address when Web history remains usable. */
-  goBack(): void {
-    if (this.disposed) return
-    const request = this.navigation.back()
-    if (request !== undefined) this.start(request)
-  }
-
-  /** Move to the following application-known address when Web history remains usable. */
-  goForward(): void {
-    if (this.disposed) return
-    const request = this.navigation.forward()
-    if (request !== undefined) this.start(request)
-  }
-
-  /** Reload the last application-known address without adding history. */
+  /** Delegate Back to the page's navigation provider. */
+  goBack(): void { this.command(() => { this.page.frame.goBack() }) }
+  /** Delegate Forward to the page's navigation provider. */
+  goForward(): void { this.command(() => { this.page.frame.goForward() }) }
+  /** Restore a saved address, or reload the already requested page. */
   reload(): void {
-    if (this.disposed) return
-    const request = this.navigation.reload()
-    if (request !== undefined) this.start(request)
+    if (this.store.getSnapshot().restoreTarget !== undefined) this.restore()
+    else this.command(() => { this.page.frame.reload() })
   }
 
-  private start(request: NonNullable<BrowserTabState['request']>): void {
-    this.publish()
-    this.frame.clearDocument()
-    this.frame.setDocument({ target: request.target, src: request.target.url, revision: request.revision })
+  /**
+   * Apply the optional embedding-sandbox control; unsupported providers remain unchanged.
+   * @param enabled - whether to enforce the provider's embedding sandbox.
+   */
+  setSandbox(enabled: boolean): void {
+    const sandbox = this.page.frame.sandbox
+    if (sandbox !== undefined) this.command(() => { sandbox.setEnabled(enabled) })
   }
 
-  private frameLoaded(revision: number): void {
-    if (this.disposed) return
-    const previous = this.navigation.snapshot
-    this.navigation.frameLoaded(revision)
-    if (this.navigation.snapshot !== previous) this.publish()
-  }
+  /**
+   * Redirect future checkpoint writes to a replacement Session binding.
+   * @param actions - replacement persistence writer.
+   */
+  rebind(actions: BoundActions<BrowserStore>): void { this.actions = actions }
 
-  private publish(): void {
-    this.options.actions.replace(this.options.tabId, this.navigation.snapshot)
-  }
-
-  private dispose(): void {
+  /**
+   * Release the page and detach occurrence and state listeners.
+   * @returns after page teardown; repeated callers join the same disposal.
+   */
+  dispose(): Promise<void> {
+    if (this.disposal !== undefined) return this.disposal
     this.disposed = true
-    this.frame.clearDocument()
+    this.options.signal.removeEventListener('abort', this.abort)
+    this.unsubscribe()
+    this.disposal = this.page.frame.dispose()
+    return this.disposal
+  }
+
+  private publishSaved(): void {
+    if (this.checkpoint !== undefined) this.actions.replace(this.options.tabId, this.checkpoint)
+  }
+
+  private addressFailed(reason: BrowserAddressFailure): void {
+    this.store.set({ ...this.store.getSnapshot(), addressFailure: reason })
+  }
+
+  private command(run: () => void): void {
+    if (this.disposed) return
+    const current = this.store.getSnapshot()
+    this.store.set({ ...current, addressFailure: undefined, addressRevision: current.addressRevision + 1 })
+    run()
   }
 }
 
-/** Browser commands and keyed frame state injected into the tab body. */
+/** Values available once a Sidebar body has committed its content container. */
+export interface BrowserMountRequest {
+  readonly tabId: TabId
+  readonly signal: AbortSignal
+  readonly viewportId: string
+  readonly applicationOrigin: string
+  readonly initial: BrowserTabState | undefined
+  readonly initialUrl: string | undefined
+  readonly openTab: (url: string) => void
+}
+
+/** Plain Slot callbacks and a framework-bound state source, not a desktop protocol. */
 export interface BrowserInjected {
   readonly keyedHooks: {
-    readonly browserFrame: (key: string) => HostObservable<BrowserFrameState> | undefined
+    readonly browserState: (key: string) => HostObservable<BrowserControllerState> | undefined
   }
-  /**
-   * @param tabId - tab occurrence.
-   * @param signal - occurrence lifetime.
-   * @param applicationOrigin - current application origin.
-   * @param initial - persisted tab state.
-   */
-  mount(tabId: TabId, signal: AbortSignal, applicationOrigin: string, initial?: BrowserTabState): void
-  /** @param tabId - tab occurrence. @param value - address-bar or typed-open value. */
+  /** @param request - committed tab and container. @returns ends physical attachment without closing the tab. */
+  mount(request: BrowserMountRequest): () => void
+  /** @returns after every page has been disposed. */
+  dispose(): Promise<void>
+  /** @param actions - writer from a recreated Session binding. */
+  rebind(actions: BoundActions<BrowserStore>): void
+  /** @param tabId - owning tab. @param value - address input. */
   loadUrl(tabId: TabId, value: string): void
-  /** @param tabId - tab occurrence. */
+  /** @param tabId - tab whose saved address the user requested to restore. */
+  restore(tabId: TabId): void
+  /** @param tabId - owning tab. */
   goBack(tabId: TabId): void
-  /** @param tabId - tab occurrence. */
+  /** @param tabId - owning tab. */
   goForward(tabId: TabId): void
-  /** @param tabId - tab occurrence. */
+  /** Restore a saved address or reload its page. @param tabId - owning tab. */
   reload(tabId: TabId): void
-  /** @param tabId - tab occurrence. */
-  toggleSandbox(tabId: TabId): void
-  /** @param tabId - tab occurrence. @param revision - rendered document revision. */
-  reportLoaded(tabId: TabId, revision: number): void
-  /** @param tabId - tab occurrence. @param revision - rendered document revision that emitted `error`. */
-  reportLoadFailed(tabId: TabId, revision: number): void
+  /** @param tabId - owning tab. @param enabled - provider's optional sandbox control. */
+  setSandbox(tabId: TabId, enabled: boolean): void
 }
 
 /**
- * Bind Browser controllers to one Session and its persistence writer.
- * @param actions - Browser store mutation face.
- * @returns a per-tab controller registry exposed as plain Slot callbacks.
+ * Own tab-occurrence controllers behind Session-scoped callbacks.
+ * @param actions - persisted view-state writer.
+ * @param createPage - composition-selected provider.
+ * @param isTabOpen - authoritative layout membership, independent of mounted bodies and plugin lifetime.
+ * @returns tab callbacks.
  */
-export function createBrowserControllers(
-  actions: BoundActions<BrowserStore>,
-): BrowserInjected {
-  const controllers = new Map<TabId, { readonly signal: AbortSignal; readonly controller: BrowserController }>()
-  const controller = (tabId: TabId): BrowserController | undefined => controllers.get(tabId)?.controller
+export function createBrowserControllers(actions: BoundActions<BrowserStore>, createPage: BrowserPageFactory,
+  isTabOpen: (tabId: TabId) => boolean): BrowserInjected {
+  let currentActions = actions
+  const controllers = new Map<TabId, {
+    readonly signal: AbortSignal
+    readonly controller: BrowserController
+    readonly forget: () => void
+  }>()
+  const controller = (id: TabId): BrowserController | undefined => controllers.get(id)?.controller
   return {
-    keyedHooks: { browserFrame: key => controller(key as TabId)?.frame },
-    mount(tabId, signal, applicationOrigin, initial) {
-      const held = controllers.get(tabId)
-      if (held?.signal === signal) return
-      const created = new BrowserController({
-        tabId, signal, applicationOrigin, actions,
-        ...(initial === undefined ? {} : { initial }),
-      })
-      controllers.set(tabId, { signal, controller: created })
-      signal.addEventListener('abort', () => {
-        if (controllers.get(tabId)?.controller !== created) return
-        controllers.delete(tabId)
-        actions.forget(tabId)
-      }, { once: true })
+    keyedHooks: { browserState: key => controller(key as TabId) },
+    mount(request) {
+      const { tabId, signal } = request
+      if (signal.aborted) return () => {}
+      let held = controllers.get(tabId)
+      if (held?.signal !== signal) {
+        if (held !== undefined) {
+          held.signal.removeEventListener('abort', held.forget)
+          void held.controller.dispose()
+        }
+        const created = new BrowserController({ ...request, actions: currentActions, createPage })
+        const forget = (): void => {
+          controllers.delete(tabId)
+          // Plugin unload also aborts occurrences; only layout removal deletes saved navigation.
+          if (!isTabOpen(tabId)) currentActions.forget(tabId)
+        }
+        held = { signal, controller: created, forget }
+        controllers.set(tabId, held)
+        signal.addEventListener('abort', forget, { once: true })
+      }
+      const hide = held.controller.mount(request.viewportId)
+      held.controller.start(request.initialUrl)
+      return hide
     },
-    loadUrl: (tabId, value) => { controller(tabId)?.loadUrl(value) },
-    goBack: (tabId) => { controller(tabId)?.goBack() },
-    goForward: (tabId) => { controller(tabId)?.goForward() },
-    reload: (tabId) => { controller(tabId)?.reload() },
-    toggleSandbox: (tabId) => { controller(tabId)?.frame.toggleSandbox() },
-    reportLoaded: (tabId, revision) => { controller(tabId)?.frame.reportLoaded(revision) },
-    reportLoadFailed: (tabId, revision) => { controller(tabId)?.frame.reportLoadFailed(revision) },
+    dispose: async () => {
+      const pending = [...controllers.values()].map(({ signal, controller, forget }) => {
+        signal.removeEventListener('abort', forget)
+        return controller.dispose()
+      })
+      controllers.clear()
+      await Promise.all(pending)
+    },
+    rebind: (actions) => {
+      currentActions = actions
+      for (const { controller } of controllers.values()) controller.rebind(actions)
+    },
+    loadUrl: (id, value) => { controller(id)?.loadUrl(value) },
+    restore: (id) => { controller(id)?.restore() },
+    goBack: (id) => { controller(id)?.goBack() },
+    goForward: (id) => { controller(id)?.goForward() },
+    reload: (id) => { controller(id)?.reload() },
+    setSandbox: (id, enabled) => { controller(id)?.setSandbox(enabled) },
   }
 }
diff --git a/packages/client/ui-sidebar-browser/src/client/browser/BrowserFrame.ts b/packages/client/ui-sidebar-browser/src/client/browser/BrowserFrame.ts
index f26b983050..6c24081a8e 100644
--- a/packages/client/ui-sidebar-browser/src/client/browser/BrowserFrame.ts
+++ b/packages/client/ui-sidebar-browser/src/client/browser/BrowserFrame.ts
@@ -1,98 +1,51 @@
-/** BrowserFrame interface and the current iframe implementation. */
-import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
-import type { SnapshotStore } from '@deepseek-ai/dsh-client-store'
+/** Carrier-neutral page navigation and observable state. */
 import type { HostObservable } from '@deepseek-ai/dsh-client-ui-slots'
 import type { BrowserTarget } from './url.ts'
 
-/** One prepared document rendered by a BrowserFrame implementation. */
-export interface BrowserDocument {
-  readonly target: BrowserTarget
-  readonly src: string
-  readonly revision: number
+/** A loading failure, optionally carrying the underlying browser's diagnostic. */
+export interface BrowserLoadError {
+  readonly code: number | undefined
+  readonly description: string | undefined
 }
 
-/** Current renderer-facing state for one Browser tab. */
+/** State consumed by common browser chrome, without DOM or carrier identifiers. */
 export interface BrowserFrameState {
-  readonly document: BrowserDocument | undefined
-  readonly sandboxed: boolean
-  readonly loadFailed: boolean
+  readonly target: BrowserTarget | undefined
+  readonly address: 'empty' | 'requested' | 'observed' | 'unknown'
+  readonly loading: boolean
+  readonly canGoBack: boolean
+  readonly canGoForward: boolean
+  readonly error: BrowserLoadError | undefined
+  /** Undefined when this provider does not expose a sandbox control. */
+  readonly sandboxEnabled: boolean | undefined
 }
 
-/** Browser rendering operations shared by Web and future Electron implementations. */
+/** Optional iframe policy control, not an Electron process-sandbox switch. */
+export interface BrowserSandboxControl {
+  /** @param enabled - whether the provider's embedding sandbox is enforced. */
+  setEnabled(enabled: boolean): void
+}
+
+/** Navigation owns page lifetime; mounting and hiding belong to BrowserPresentation. */
 export interface BrowserFrame extends HostObservable<BrowserFrameState> {
-  /** Toggle sandbox enforcement for this tab occurrence. */
-  toggleSandbox(): void
-  /** @param document - current prepared document. */
-  setDocument(document: BrowserDocument): void
-  /** Remove the current prepared document. */
-  clearDocument(): void
-  /** @param revision - rendered document revision reported by the carrier. */
-  reportLoaded(revision: number): void
-  /** @param revision - rendered document revision whose carrier reported an error. */
-  reportLoadFailed(revision: number): void
+  readonly sandbox?: BrowserSandboxControl
+  /** @param target - validated HTTP(S) address; loading failures are published in state. */
+  loadUrl(target: BrowserTarget): void
+  /** Move backward when the provider reports an available entry. */
+  goBack(): void
+  /** Move forward when the provider reports an available entry. */
+  goForward(): void
+  /** Reload the current address without creating a new history entry. */
+  reload(): void
+  /** @returns after the page, listeners and pending initialization have been released; repeated calls join disposal. */
+  dispose(): Promise<void>
 }
 
-/** Owns transient iframe and sandbox-toggle state independently from URL navigation. */
-export class IframeImpl implements BrowserFrame {
-  private readonly store: SnapshotStore<BrowserFrameState> = createSnapshotStore({
-    document: undefined,
-    sandboxed: true,
-    loadFailed: false,
-  })
-
-  /**
-   * @param sandboxChanged - applies the new policy to the current controlled target.
-   * @param documentLoaded - reports an iframe load to the navigation state machine.
-   */
-  constructor(
-    private readonly sandboxChanged: (sandboxed: boolean) => void,
-    private readonly documentLoaded: (revision: number) => void,
-  ) {}
-
-  /** @returns the immutable renderer snapshot. */
-  getSnapshot = (): BrowserFrameState => this.store.getSnapshot()
-
-  /**
-   * Subscribe to iframe or sandbox-mode changes.
-   * @param listener - invalidation callback.
-   * @returns the unsubscribe function.
-   */
-  subscribe = (listener: () => void): (() => void) => this.store.subscribe(listener)
-
-  /** Toggle sandbox enforcement for this tab occurrence. */
-  toggleSandbox(): void {
-    const current = this.store.getSnapshot()
-    const sandboxed = !current.sandboxed
-    this.store.set({ ...current, sandboxed })
-    this.sandboxChanged(sandboxed)
-  }
-
-  /**
-   * Publish a prepared frame from the owning controller.
-   * @param document - current prepared document.
-   */
-  setDocument(document: BrowserDocument): void {
-    this.store.set({ ...this.store.getSnapshot(), document, loadFailed: false })
-  }
-
-  /** Remove the current prepared frame and transient load failure. */
-  clearDocument(): void {
-    const current = this.store.getSnapshot()
-    const { document } = current
-    if (document !== undefined) {
-      this.store.set({ ...current, document: undefined, loadFailed: false })
-    }
-  }
-
-  /** @param revision - rendered document revision reported by the iframe. */
-  reportLoaded(revision: number): void {
-    this.documentLoaded(revision)
-  }
-
-  /** @param revision - rendered document revision whose iframe emitted `error`. */
-  reportLoadFailed(revision: number): void {
-    const current = this.store.getSnapshot()
-    if (current.document?.revision !== revision || current.loadFailed) return
-    this.store.set({ ...current, loadFailed: true })
-  }
+/**
+ * Create idle navigation state without a page target.
+ * @returns state before any page has been requested.
+ */
+export function emptyBrowserFrame(): BrowserFrameState {
+  return { target: undefined, address: 'empty', loading: false, canGoBack: false, canGoForward: false,
+    error: undefined, sandboxEnabled: undefined }
 }
diff --git a/packages/client/ui-sidebar-browser/src/client/browser/BrowserNavigation.ts b/packages/client/ui-sidebar-browser/src/client/browser/BrowserNavigation.ts
index d8f8508a0e..d0401a5a5f 100644
--- a/packages/client/ui-sidebar-browser/src/client/browser/BrowserNavigation.ts
+++ b/packages/client/ui-sidebar-browser/src/client/browser/BrowserNavigation.ts
@@ -1,33 +1,10 @@
-/** URL, history, and observability state for one Browser tab. */
-import type { BrowserAddressFailure, BrowserTarget } from './url.ts'
+/** Bounded, application-known history used only by the iframe provider. */
+import type { BrowserTarget } from './url.ts'
+import type { BrowserHistoryEntry, BrowserTabState } from './BrowserPersistence.ts'
 
 /** Maximum retained application-known navigation entries per tab. */
 export const MAX_BROWSER_HISTORY = 100
 
-/** One canonical address in the application-managed Web history. */
-export type BrowserHistoryEntry = BrowserTarget
-
-/** Whether the current carrier document still corresponds to an application-known URL. */
-export type BrowserNavigationStatus =
-  | { readonly status: 'empty' }
-  | { readonly status: 'loading'; readonly revision: number }
-  | { readonly status: 'known'; readonly revision: number }
-  | { readonly status: 'unknown'; readonly revision: number }
-
-/** Address-policy or loading failure shown below the toolbar. */
-export type BrowserFailure =
-  { readonly kind: 'address'; readonly reason: BrowserAddressFailure }
-
-/** One Browser tab's serializable URL state. */
-export interface BrowserTabState {
-  readonly entries: readonly BrowserHistoryEntry[]
-  readonly index: number
-  /** Last application-directed load; carrier observations do not rewrite it. */
-  readonly request: { readonly revision: number; readonly target: BrowserTarget } | undefined
-  readonly navigation: BrowserNavigationStatus
-  readonly failure: BrowserFailure | undefined
-}
-
 /**
  * Owns the application-known URL history and the iframe observation state machine.
  * The first load for a request keeps its URL authoritative; another load marks it unknown.
@@ -136,14 +113,6 @@ export class BrowserNavigation {
     return target === undefined ? undefined : this.request(target, this.value)
   }
 
-  /**
-   * Record an invalid address without changing the active document state.
-   * @param reason - parser refusal.
-   */
-  addressFailed(reason: BrowserAddressFailure): void {
-    this.value = { ...this.value, failure: { kind: 'address', reason } }
-  }
-
   /**
    * Record a frame load for its captured revision.
    * @param revision - revision bound to the rendered frame.
diff --git a/packages/client/ui-sidebar-browser/src/client/browser/BrowserPage.ts b/packages/client/ui-sidebar-browser/src/client/browser/BrowserPage.ts
new file mode 100644
index 0000000000..c235126cf6
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/src/client/browser/BrowserPage.ts
@@ -0,0 +1,20 @@
+/** Composition of one navigation provider and its presentation. */
+import type { BrowserPresentation } from '../view/BrowserPresentation.ts'
+import type { BrowserFrame } from './BrowserFrame.ts'
+import type { BrowserTabState } from './BrowserPersistence.ts'
+
+/** Provider construction inputs; persistence does not enter the live navigation interface. */
+export interface BrowserPageOptions {
+  readonly initial: BrowserTabState | undefined
+  readonly persist: (state: BrowserTabState) => void
+  readonly openRequested: (url: string) => void
+}
+
+/** The owning controller disposes frame; UI mounts only presentation. */
+export interface BrowserPage {
+  readonly frame: BrowserFrame
+  readonly presentation: BrowserPresentation
+}
+
+/** Construct an idle provider without attaching DOM; saved navigation waits for an explicit frame command. */
+export type BrowserPageFactory = (options: BrowserPageOptions) => BrowserPage
diff --git a/packages/client/ui-sidebar-browser/src/client/browser/BrowserPersistence.ts b/packages/client/ui-sidebar-browser/src/client/browser/BrowserPersistence.ts
new file mode 100644
index 0000000000..3153ee3136
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/src/client/browser/BrowserPersistence.ts
@@ -0,0 +1,44 @@
+/** Existing browser-local navigation records, independent from live frame state. */
+import type { BrowserAddressFailure, BrowserTarget } from './url.ts'
+
+/** One retained address. */
+export type BrowserHistoryEntry = BrowserTarget
+
+/** Observability recorded for a controlled navigation. */
+export type BrowserNavigationStatus =
+  | { readonly status: 'empty' }
+  | { readonly status: 'loading'; readonly revision: number }
+  | { readonly status: 'known'; readonly revision: number }
+  | { readonly status: 'unknown'; readonly revision: number }
+
+/** Address refusal carried by existing browser-local records. */
+export type BrowserFailure = { readonly kind: 'address'; readonly reason: BrowserAddressFailure }
+
+/** Serializable record; providers retain the history they can restore. */
+export interface BrowserTabState {
+  readonly entries: readonly BrowserHistoryEntry[]
+  readonly index: number
+  readonly request: { readonly revision: number; readonly target: BrowserTarget } | undefined
+  readonly navigation: BrowserNavigationStatus
+  readonly failure: BrowserFailure | undefined
+}
+
+/**
+ * Read the selected address from a saved navigation record.
+ * @param state - saved navigation.
+ * @returns its last selected address, if any.
+ */
+export function currentBrowserTarget(state: BrowserTabState | undefined): BrowserTarget | undefined {
+  return state === undefined || state.index < 0 ? undefined : state.entries[state.index]
+}
+
+/**
+ * Checkpoint an observed address without serializing native history.
+ * @param target - current address.
+ * @param revision - navigation generation.
+ * @returns an address-only checkpoint.
+ */
+export function browserAddressCheckpoint(target: BrowserTarget, revision: number): BrowserTabState {
+  return { entries: [target], index: 0, request: { target, revision },
+    navigation: { status: 'known', revision }, failure: undefined }
+}
diff --git a/packages/client/ui-sidebar-browser/src/client/browser/IframeImpl.ts b/packages/client/ui-sidebar-browser/src/client/browser/IframeImpl.ts
new file mode 100644
index 0000000000..0692b80997
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/src/client/browser/IframeImpl.ts
@@ -0,0 +1,104 @@
+/** Iframe navigation provider with bounded application-known history. */
+import { createSnapshotStore, type SnapshotStore } from '@deepseek-ai/dsh-client-store'
+import type { IframePresentation } from '../view/IframePresentation.ts'
+import { emptyBrowserFrame, type BrowserFrame, type BrowserFrameState, type BrowserLoadError, type BrowserSandboxControl } from './BrowserFrame.ts'
+import type { BrowserPageOptions } from './BrowserPage.ts'
+import { BrowserNavigation } from './BrowserNavigation.ts'
+import type { BrowserTarget } from './url.ts'
+
+/** Owns iframe navigation; the view reports loads without reading cross-origin content. */
+export class IframeImpl implements BrowserFrame {
+  readonly sandbox: BrowserSandboxControl = { setEnabled: (enabled) => { this.setSandbox(enabled) } }
+  private readonly navigation: BrowserNavigation
+  private readonly store: SnapshotStore<BrowserFrameState>
+  private sandboxed = true
+  private error: BrowserLoadError | undefined
+  private disposed = false
+  private disposal: Promise<void> | undefined
+
+  /** @param options - initial checkpoint and persistence writer. @param presentation - iframe DOM adapter. */
+  constructor(private readonly options: BrowserPageOptions, private readonly presentation: IframePresentation) {
+    this.navigation = new BrowserNavigation(options.initial)
+    this.store = createSnapshotStore({ ...emptyBrowserFrame(), sandboxEnabled: this.sandboxed })
+  }
+
+  /**
+   * Record a controlled load or a later navigation to an unreadable address.
+   * @param revision - document generation whose iframe emitted load.
+   */
+  handleLoaded(revision: number): void {
+    if (this.disposed) return
+    this.navigation.frameLoaded(revision)
+    this.publish()
+  }
+
+  /**
+   * Publish a failure only for the current document generation.
+   * @param revision - document generation whose iframe reported failure.
+   */
+  handleLoadFailed(revision: number): void {
+    if (this.disposed || this.navigation.snapshot.request?.revision !== revision) return
+    this.error = { code: undefined, description: undefined }
+    this.publish()
+  }
+
+  /** @returns immutable navigation state. */
+  getSnapshot = (): BrowserFrameState => this.store.getSnapshot()
+  /** @param listener - state invalidation. @returns unsubscribe callback. */
+  subscribe = (listener: () => void): (() => void) => this.store.subscribe(listener)
+
+  /** @param target - validated address; submitting the current address reloads it. */
+  loadUrl(target: BrowserTarget): void {
+    if (this.disposed) return
+    const request = BrowserNavigation.current(this.navigation.snapshot)?.url === target.url
+      ? this.navigation.reload() : this.navigation.navigate(target)
+    this.load(request)
+  }
+
+  /** Move through application-known history while the iframe address remains known. */
+  goBack(): void { if (!this.disposed) this.load(this.navigation.back()) }
+  /** Move through application-known history while the iframe address remains known. */
+  goForward(): void { if (!this.disposed) this.load(this.navigation.forward()) }
+  /** Reload the last application-known address. */
+  reload(): void { if (!this.disposed) this.load(this.navigation.reload()) }
+
+  /** @returns after the presentation has been removed; repeated calls join disposal. */
+  dispose(): Promise<void> {
+    if (this.disposal !== undefined) return this.disposal
+    this.disposed = true
+    this.presentation.dispose()
+    this.disposal = Promise.resolve()
+    return this.disposal
+  }
+
+  private setSandbox(enabled: boolean): void {
+    if (this.disposed || enabled === this.sandboxed) return
+    this.sandboxed = enabled
+    if (this.store.getSnapshot().target === undefined) {
+      this.store.set({ ...this.store.getSnapshot(), sandboxEnabled: enabled })
+      return
+    }
+    this.load(this.navigation.reload())
+  }
+
+  private load(request: ReturnType<BrowserNavigation['navigate']> | undefined): void {
+    if (request === undefined) return
+    this.error = undefined
+    this.publish()
+    this.presentation.show({ target: request.target, revision: request.revision, sandboxed: this.sandboxed })
+  }
+
+  private snapshot(): BrowserFrameState {
+    const state = this.navigation.snapshot
+    const target = BrowserNavigation.current(state)
+    return { target, address: target === undefined ? 'empty' : state.navigation.status === 'unknown' ? 'unknown' : 'requested',
+      loading: state.navigation.status === 'loading' && this.error === undefined,
+      canGoBack: this.navigation.canGoBack, canGoForward: this.navigation.canGoForward,
+      error: this.error, sandboxEnabled: this.sandboxed }
+  }
+
+  private publish(): void {
+    this.store.set(this.snapshot())
+    this.options.persist(this.navigation.snapshot)
+  }
+}
diff --git a/packages/client/ui-sidebar-browser/src/client/browser/store.ts b/packages/client/ui-sidebar-browser/src/client/browser/store.ts
index 4702f7c7c1..cd0c38aa04 100644
--- a/packages/client/ui-sidebar-browser/src/client/browser/store.ts
+++ b/packages/client/ui-sidebar-browser/src/client/browser/store.ts
@@ -1,7 +1,7 @@
 /** Persisted Browser tab snapshots shared by the body and title slots. */
 import { defineStore, type EngineStoreHandle } from '@deepseek-ai/dsh-client-store'
 import type { TabId } from '@deepseek-ai/dsh-client-ui-dockkit'
-import type { BrowserTabState } from './BrowserNavigation.ts'
+import type { BrowserTabState } from './BrowserPersistence.ts'
 
 /** All Browser tabs in one Session-scoped store. */
 export interface BrowserState {
diff --git a/packages/client/ui-sidebar-browser/src/client/electron/ElectronWebViewImpl.ts b/packages/client/ui-sidebar-browser/src/client/electron/ElectronWebViewImpl.ts
new file mode 100644
index 0000000000..b6987bbc8f
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/src/client/electron/ElectronWebViewImpl.ts
@@ -0,0 +1,271 @@
+/** Electron navigation and guest lifetime, independent from DOM placement. */
+import { createSnapshotStore, type SnapshotStore } from '@deepseek-ai/dsh-client-store'
+import type { DesktopBrowserBridge, DesktopBrowserLeaseId } from '../../types.ts'
+import type { ElectronWebviewPresentation, WebviewElement } from './ElectronWebviewPresentation.ts'
+import { emptyBrowserFrame, type BrowserFrame, type BrowserFrameState, type BrowserLoadError } from '../browser/BrowserFrame.ts'
+import type { BrowserPageOptions } from '../browser/BrowserPage.ts'
+import { browserAddressCheckpoint, currentBrowserTarget } from '../browser/BrowserPersistence.ts'
+import { parseBrowserAddress, type BrowserTarget } from '../browser/url.ts'
+
+interface NavigationEvent extends Event { readonly isMainFrame: boolean }
+interface LoadFailureEvent extends NavigationEvent {
+  readonly errorCode: number
+  readonly errorDescription: string
+}
+
+/** Owns native history and translates Electron observations into common frame state. */
+export class ElectronWebViewImpl implements BrowserFrame {
+  private readonly store: SnapshotStore<BrowserFrameState>
+  private readonly lifetime = new AbortController()
+  private guestLifetime: AbortController | undefined
+  private element: WebviewElement | undefined
+  private lease: DesktopBrowserLeaseId | undefined
+  private workspaceKey: string | undefined
+  private initializing: Promise<void> | undefined
+  private ready = false
+  private pending: BrowserTarget | undefined
+  private revision = 0
+  private firstDocument = true
+  private checkpoint: BrowserTarget | undefined
+  private disposal: Promise<void> | undefined
+  private attachment: AbortController | undefined
+  private readonly releases = new Set<Promise<void>>()
+
+  /**
+   * @param options - saved address, persistence and source-tab opening callback.
+   * @param bridge - main-process guest operations.
+   * @param workspace - resolves the storage account once for this frame lifetime.
+   * @param presentation - tag and Sidebar placement adapter.
+   */
+  constructor(private readonly options: BrowserPageOptions, private readonly bridge: DesktopBrowserBridge,
+    private readonly workspace: (signal: AbortSignal) => Promise<string>,
+    private readonly presentation: ElectronWebviewPresentation) {
+    this.checkpoint = currentBrowserTarget(options.initial)
+    this.store = createSnapshotStore(emptyBrowserFrame())
+  }
+
+  /** @returns immutable carrier-neutral navigation state. */
+  getSnapshot = (): BrowserFrameState => this.store.getSnapshot()
+  /** @param listener - state invalidation. @returns unsubscribe callback. */
+  subscribe = (listener: () => void): (() => void) => this.store.subscribe(listener)
+
+  /** A physical mount may recreate a lost guest; ordinary Sidebar hiding never calls this. */
+  attach(): void {
+    if (this.lifetime.signal.aborted) return
+    this.attachment = new AbortController()
+    this.pending ??= this.store.getSnapshot().target
+    if (this.pending !== undefined) {
+      this.store.set({ ...this.store.getSnapshot(), address: 'requested', loading: true,
+        canGoBack: false, canGoForward: false, error: undefined })
+      this.initialize()
+    }
+  }
+
+  /** Invalidate pending attachment before the containing DOM is removed. */
+  detach(): void {
+    this.attachment?.abort()
+    this.attachment = undefined
+    this.pending = this.store.getSnapshot().target
+    void this.dropGuest()
+  }
+
+  /** @param target - validated address, loaded without replacing the guest. */
+  loadUrl(target: BrowserTarget): void {
+    if (this.lifetime.signal.aborted) return
+    const current = this.store.getSnapshot()
+    if (this.ready && current.address === 'observed' && current.target?.url === target.url) {
+      this.reload()
+      return
+    }
+    this.revision++
+    this.pending = target
+    this.store.set({ ...current, target, address: 'requested', loading: true, error: undefined })
+    this.persist(target)
+    if (this.ready) this.loadPending()
+    else this.initialize()
+  }
+
+  /** Move backward through Chromium history. */
+  goBack(): void {
+    if (this.store.getSnapshot().canGoBack) this.navigate('goBack')
+  }
+
+  /** Move forward through Chromium history. */
+  goForward(): void {
+    if (this.store.getSnapshot().canGoForward) this.navigate('goForward')
+  }
+
+  /** Reload the actual current page, or retry failed guest creation. */
+  reload(): void {
+    const current = this.store.getSnapshot()
+    if (this.lifetime.signal.aborted || current.target === undefined) return
+    if (!this.ready || current.error !== undefined) {
+      this.revision++
+      this.pending = current.target
+      this.store.set({ ...current, loading: true, error: undefined })
+      if (this.ready) this.loadPending()
+      else this.initialize()
+    } else this.navigate('reload')
+  }
+
+  /** @returns after pending initialization and the owned guest have been released. */
+  dispose(): Promise<void> {
+    if (this.disposal !== undefined) return this.disposal
+    this.lifetime.abort()
+    this.pending = undefined
+    this.disposal = Promise.all([this.dropGuest(), this.initializing])
+      .then(() => Promise.all(this.releases)).then(() => {})
+    this.presentation.dispose()
+    return this.disposal
+  }
+
+  private navigate(command: 'goBack' | 'goForward' | 'reload'): void {
+    if (this.lifetime.signal.aborted || !this.ready || this.element === undefined) return
+    this.revision++
+    this.pending = undefined
+    this.store.set({ ...this.store.getSnapshot(), loading: true, error: undefined })
+    try { this.element[command]() }
+    catch (error) { this.commandFailed(error) }
+  }
+
+  private initialize(): void {
+    const attachment = this.attachment
+    if (attachment === undefined || this.initializing !== undefined || this.element !== undefined || this.lifetime.signal.aborted) return
+    const signal = AbortSignal.any([this.lifetime.signal, attachment.signal])
+    this.initializing = this.createGuest(signal).catch(async (error: unknown) => {
+      await this.dropGuest()
+      if (!signal.aborted) this.commandFailed(error)
+    }).finally(() => {
+      this.initializing = undefined
+      if (this.attachment !== attachment && this.pending !== undefined) this.initialize()
+    })
+  }
+
+  private async createGuest(attachmentSignal: AbortSignal): Promise<void> {
+    this.workspaceKey ??= await this.workspace(attachmentSignal)
+    if (attachmentSignal.aborted) return
+    const reservation = await this.bridge.acquire(this.workspaceKey)
+    // oxlint-disable-next-line typescript/no-unnecessary-condition -- The signal can abort while acquire is pending.
+    if (attachmentSignal.aborted) { await this.release(reservation.lease); return }
+    this.lease = reservation.lease
+    this.guestLifetime = new AbortController()
+    const signal = AbortSignal.any([attachmentSignal, this.guestLifetime.signal])
+    const element = this.presentation.createElement(reservation)
+    this.element = element
+    const unsubscribeOpen = this.bridge.onOpenRequested(reservation.lease, (url) => {
+      if (this.element === element && !signal.aborted) this.options.openRequested(url)
+    })
+    signal.addEventListener('abort', unsubscribeOpen, { once: true })
+    element.addEventListener('dom-ready', () => {
+      this.ready = true
+      this.observe(this.store.getSnapshot().address !== 'requested')
+      this.loadPending()
+    }, { signal })
+    element.addEventListener('did-navigate', () => { this.observe(true) }, { signal })
+    element.addEventListener('did-navigate-in-page', (event) => {
+      if ((event as NavigationEvent).isMainFrame) this.observe(true)
+    }, { signal })
+    element.addEventListener('did-start-navigation', (event) => {
+      if ((event as NavigationEvent).isMainFrame) {
+        this.store.set({ ...this.store.getSnapshot(), loading: true, error: undefined })
+      }
+    }, { signal })
+    for (const name of ['did-start-loading', 'did-stop-loading', 'page-title-updated']) {
+      element.addEventListener(name, () => {
+        this.observe(name === 'page-title-updated' && this.store.getSnapshot().address === 'observed')
+      }, { signal })
+    }
+    element.addEventListener('did-fail-load', (event) => {
+      const failure = event as LoadFailureEvent
+      if (failure.isMainFrame && failure.errorCode !== -3) {
+        this.failed({ code: failure.errorCode, description: failure.errorDescription })
+      }
+    }, { signal })
+    for (const name of ['render-process-gone', 'destroyed']) {
+      element.addEventListener(name, () => { void this.dropGuest(); this.failed() }, { signal })
+    }
+    this.presentation.present(element)
+  }
+
+  private loadPending(): void {
+    const target = this.pending
+    const element = this.element
+    if (!this.ready || target === undefined || element === undefined) return
+    const revision = this.revision
+    this.pending = undefined
+    void element.loadURL(target.url).catch((error: unknown) => {
+      if (this.element !== element || this.lifetime.signal.aborted || this.revision !== revision) return
+      if (typeof error === 'object' && error !== null && 'code' in error && error.code === 'ERR_ABORTED') return
+      if (this.store.getSnapshot().error === undefined) this.commandFailed(error)
+    })
+  }
+
+  private observe(committed: boolean): void {
+    if (!this.ready || this.element === undefined || this.lifetime.signal.aborted) return
+    try { this.observeReady(this.element, committed) }
+    catch (error) { this.commandFailed(error) }
+  }
+
+  private observeReady(element: WebviewElement, committed: boolean): void {
+    const current = this.store.getSnapshot()
+    const parsed = committed ? parseBrowserAddress(element.getURL()) : undefined
+    if (parsed?.ok && this.firstDocument) {
+      // The lease-bearing bootstrap document is not a user history entry.
+      element.clearHistory()
+      this.firstDocument = false
+    }
+    let target = current.target
+    let address = current.address
+    if (parsed?.ok) {
+      target = { ...parsed.target, title: element.getTitle() || parsed.target.title }
+      address = 'observed'
+      this.presentation.show(target.title)
+    }
+    const loading = current.error === undefined && element.isLoading()
+    const canGoBack = element.canGoBack()
+    const canGoForward = element.canGoForward()
+    if (target?.url !== current.target?.url || target?.title !== current.target?.title || address !== current.address
+      || loading !== current.loading || canGoBack !== current.canGoBack || canGoForward !== current.canGoForward) {
+      this.store.set({ ...current, target, address, loading, canGoBack, canGoForward })
+    }
+    if (parsed?.ok && target !== undefined) this.persist(target)
+  }
+
+  private persist(target: BrowserTarget): void {
+    if (target.url === this.checkpoint?.url && target.title === this.checkpoint.title) return
+    this.checkpoint = target
+    this.options.persist(browserAddressCheckpoint(target, this.revision))
+  }
+
+  private failed(error: BrowserLoadError = { code: undefined, description: undefined }): void {
+    if (this.lifetime.signal.aborted) return
+    const current = this.store.getSnapshot()
+    this.store.set({ ...current, loading: false, error,
+      canGoBack: this.ready && current.canGoBack, canGoForward: this.ready && current.canGoForward })
+  }
+
+  private commandFailed(error: unknown): void {
+    console.error('Desktop browser operation failed', error)
+    this.failed()
+  }
+
+  private dropGuest(): Promise<void> {
+    this.guestLifetime?.abort()
+    this.guestLifetime = undefined
+    this.presentation.clear()
+    this.element = undefined
+    this.ready = false
+    this.firstDocument = true
+    const lease = this.lease
+    this.lease = undefined
+    return lease === undefined ? Promise.resolve() : this.release(lease)
+  }
+
+  private release(lease: DesktopBrowserLeaseId): Promise<void> {
+    const released = this.bridge.release(lease)
+      .catch((error: unknown) => { console.error('Desktop browser guest release failed', error) })
+      .finally(() => { this.releases.delete(released) })
+    this.releases.add(released)
+    return released
+  }
+}
diff --git a/packages/client/ui-sidebar-browser/src/client/electron/ElectronWebviewPresentation.ts b/packages/client/ui-sidebar-browser/src/client/electron/ElectronWebviewPresentation.ts
new file mode 100644
index 0000000000..4fc6798e50
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/src/client/electron/ElectronWebviewPresentation.ts
@@ -0,0 +1,93 @@
+/** Electron tag DOM inside a Sidebar-owned, stable content container. */
+import type { DesktopBrowserReservation } from '../../types.ts'
+import type { BrowserPresentation } from '../view/BrowserPresentation.ts'
+import css from '../view/Browser.module.css'
+
+/** The Electron tag API used by its navigation provider. */
+export interface WebviewElement extends HTMLElement {
+  loadURL(url: string): Promise<void>
+  getURL(): string
+  getTitle(): string
+  canGoBack(): boolean
+  canGoForward(): boolean
+  clearHistory(): void
+  goBack(): void
+  goForward(): void
+  reload(): void
+  isLoading(): boolean
+}
+
+/** Physical attachment notifications; hiding a retained Sidebar body emits neither. */
+export interface ElectronPresentationEvents {
+  readonly mounted: () => void
+  readonly unmounted: () => void
+}
+
+/** Owns tag creation and attachment, without measuring or following another element. */
+export class ElectronWebviewPresentation implements BrowserPresentation {
+  private element: WebviewElement | undefined
+  private host: HTMLElement | undefined
+
+  constructor(private readonly events: ElectronPresentationEvents) {}
+
+  /** @param viewportId - committed content container. @returns ends attachment and releases its guest. */
+  mount(viewportId: string): () => void {
+    const host = document.getElementById(viewportId)
+    if (host === null) throw new Error('Electron presentation: content container is not mounted')
+    if (this.host !== undefined) this.events.unmounted()
+    this.host = host
+    this.events.mounted()
+    return () => {
+      if (this.host !== host) return
+      this.events.unmounted()
+      this.host = undefined
+    }
+  }
+
+  /**
+   * Configure a detached webview for an approved guest reservation.
+   * @param reservation - main-approved partition and bootstrap lease.
+   * @returns a detached, configured webview.
+   */
+  createElement(reservation: DesktopBrowserReservation): WebviewElement {
+    const element = document.createElement('webview') as WebviewElement
+    element.className = css.webview as string
+    element.dataset.sidebarBrowserFrame = 'webview'
+    element.setAttribute('partition', reservation.partition)
+    element.setAttribute('allowpopups', '')
+    element.setAttribute('src', 'about:blank#' + reservation.lease)
+    return element
+  }
+
+  /**
+   * Attach a prepared guest, removing any previous guest DOM from the container.
+   * @param element - configured guest with its navigation listeners already installed.
+   * @throws when no content container is mounted.
+   */
+  present(element: WebviewElement): void {
+    if (this.host === undefined) throw new Error('Electron presentation: cannot attach without a content container')
+    this.clear()
+    this.element = element
+    this.host.append(element)
+  }
+
+  /**
+   * Set the guest element's accessible label.
+   * @param title - observed document title.
+   */
+  show(title: string): void {
+    this.element?.setAttribute('aria-label', title)
+  }
+
+  /** Destroy only the guest DOM; a replacement may use the same mounted container. */
+  clear(): void {
+    this.element?.remove()
+    this.element = undefined
+  }
+
+  /** Destroy the guest DOM and release its content container. */
+  dispose(): void {
+    this.clear()
+    this.host = undefined
+  }
+}
diff --git a/packages/client/ui-sidebar-browser/src/client/electron/pages.ts b/packages/client/ui-sidebar-browser/src/client/electron/pages.ts
new file mode 100644
index 0000000000..d2430ad019
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/src/client/electron/pages.ts
@@ -0,0 +1,22 @@
+/** Assemble Electron navigation and presentation behind the shared BrowserPage interface. */
+import type { DesktopBrowserBridge } from '../../types.ts'
+import type { BrowserPage, BrowserPageOptions } from '../browser/BrowserPage.ts'
+import { ElectronWebViewImpl } from './ElectronWebViewImpl.ts'
+import { ElectronWebviewPresentation } from './ElectronWebviewPresentation.ts'
+
+/**
+ * Assemble an idle Electron provider; guest creation waits for mounting and navigation.
+ * @param options - checkpoint and source-tab callbacks.
+ * @param bridge - desktop-only transport.
+ * @param workspace - storage account resolver.
+ * @returns separate navigation and presentation faces.
+ */
+export function createElectronPage(options: BrowserPageOptions, bridge: DesktopBrowserBridge,
+  workspace: (signal: AbortSignal) => Promise<string>): BrowserPage {
+  const presentation = new ElectronWebviewPresentation({
+    mounted: () => { frame.attach() },
+    unmounted: () => { frame.detach() },
+  })
+  const frame = new ElectronWebViewImpl(options, bridge, workspace, presentation)
+  return { frame, presentation }
+}
diff --git a/packages/client/ui-sidebar-browser/src/client/electron/workspace.ts b/packages/client/ui-sidebar-browser/src/client/electron/workspace.ts
new file mode 100644
index 0000000000..85cd73de20
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/src/client/electron/workspace.ts
@@ -0,0 +1,33 @@
+/** Resolve CWD-keyed Electron storage after the authoritative Workspace list has arrived. */
+import type { WorkspaceSource } from '@deepseek-ai/dsh-api-workspace-controller/client'
+
+/**
+ * Use the Workspace's canonical CWD, not its record id; ungrouped Sessions remain isolated.
+ * @param source - authoritative Workspace membership.
+ * @param sessionId - owning DSH Session.
+ * @param signal - guest initialization lifetime.
+ * @returns the storage account for this occurrence.
+ */
+export async function browserWorkspace(source: WorkspaceSource, sessionId: string, signal: AbortSignal): Promise<string> {
+  signal.throwIfAborted()
+  if (source.getSnapshot().phase !== 'ready') {
+    await new Promise<void>((resolve, reject) => {
+      const abort = (): void => {
+        stop()
+        const reason: unknown = signal.reason
+        // oxlint-disable-next-line typescript/prefer-promise-reject-errors -- Preserve the caller-owned AbortSignal reason.
+        reject(reason)
+      }
+      const stop = source.subscribe(() => {
+        if (source.getSnapshot().phase !== 'ready') return
+        stop()
+        signal.removeEventListener('abort', abort)
+        resolve()
+      })
+      signal.addEventListener('abort', abort, { once: true })
+    })
+  }
+  signal.throwIfAborted()
+  const workspace = source.getSnapshot().items.find(item => item.sessionIds.some(id => id === sessionId))
+  return workspace === undefined ? `session:${sessionId}` : `cwd:${workspace.path}`
+}
diff --git a/packages/client/ui-sidebar-browser/src/client/index.ts b/packages/client/ui-sidebar-browser/src/client/index.ts
index 8a301255ba..780f7f2d85 100644
--- a/packages/client/ui-sidebar-browser/src/client/index.ts
+++ b/packages/client/ui-sidebar-browser/src/client/index.ts
@@ -4,17 +4,26 @@ import type {} from '@deepseek-ai/dsh-client-locale/client'
 import type {} from '@deepseek-ai/dsh-client-ui-renderer/client'
 import type {} from '@deepseek-ai/dsh-client-ui-session/client'
 import type {} from '@deepseek-ai/dsh-client-ui-sidebar-right/client'
-import { BrowserBody } from './view/BrowserBody.tsx'
+import type {} from '@deepseek-ai/dsh-api-workspace-controller/client'
+import { BrowserBody, type BrowserBodyProps } from './view/BrowserBody.tsx'
 import { BrowserTitle } from './view/BrowserTitle.tsx'
 import { createBrowserControllers } from './browser/BrowserController.ts'
+import type { BrowserInjected } from './browser/BrowserController.ts'
+import { createIframePage } from './pages.ts'
+import { createElectronPage } from './electron/pages.ts'
+import type { DesktopBrowserBridge } from '../types.ts'
+import { browserWorkspace } from './electron/workspace.ts'
+import type { BrowserPageFactory } from './browser/BrowserPage.ts'
 import { BROWSER_ID, browserDefinition } from './definition.tsx'
 import { en, zh } from './locales.ts'
 import { createBrowserStore } from './browser/store.ts'
 
 export type { BrowserBodyProps } from './view/BrowserBody.tsx'
-export type { BrowserInjected } from './browser/BrowserController.ts'
-export type { BrowserDocument, BrowserFrame, BrowserFrameState } from './browser/BrowserFrame.ts'
-export type { BrowserFailure, BrowserHistoryEntry, BrowserNavigationStatus, BrowserTabState } from './browser/BrowserNavigation.ts'
+export type { BrowserControllerState, BrowserInjected, BrowserMountRequest } from './browser/BrowserController.ts'
+export type { BrowserFrame, BrowserFrameState, BrowserLoadError, BrowserSandboxControl } from './browser/BrowserFrame.ts'
+export type { BrowserPage, BrowserPageFactory, BrowserPageOptions } from './browser/BrowserPage.ts'
+export type { BrowserPresentation } from './view/BrowserPresentation.ts'
+export type { BrowserFailure, BrowserHistoryEntry, BrowserNavigationStatus, BrowserTabState } from './browser/BrowserPersistence.ts'
 export type { SidebarBrowserKey } from './locales.ts'
 export type { BrowserState } from './browser/store.ts'
 export type { BrowserAddressFailure, BrowserAddressResult, BrowserTarget } from './browser/url.ts'
@@ -27,19 +36,47 @@ declare module '@deepseek-ai/dsh-client-ui-sidebar-right/client' {
 }
 
 /** Required Browser services. */
-export const inject = ['slots', 'locale', 'sidebarRightTabs']
+export const inject = ['slots', 'locale', 'sidebarRight', 'sidebarRightTabs']
 
 /** Register the Browser type, localized guide entry, body, and title. */
 export function apply(ctx: Context): void {
   const namespace = 'sidebarBrowser'
   const t = ctx.locale.bind(namespace)
   const store = createBrowserStore()
+  const openTabs = ctx.sidebarRight.openTabs
+  const carrier = (globalThis as typeof globalThis & {
+    dshDesktop?: { readonly protocolVersion: number; readonly browser?: DesktopBrowserBridge }
+  }).dshDesktop
+  const desktop = carrier?.protocolVersion === 1 ? carrier.browser : undefined
   ctx.effect(() => ctx.locale.register(namespace, { zh, en }), 'ui-sidebar-browser.copy')
-  ctx.effect(() => ctx.sidebarRightTabs.register(browserDefinition(t)), 'ui-sidebar-browser.type')
-  ctx.effect(() => ctx.slots.inject('sidebar.right.pane.tab', () => ctx.slots.register({
-    name: 'sidebar.right.pane.tab', key: BROWSER_ID, locale: namespace, store,
-    inject: (_sessionId, actions) => createBrowserControllers(actions),
-  }, BrowserBody)), 'ui-sidebar-browser.body')
+  ctx.effect(() => ctx.sidebarRightTabs.register({ ...browserDefinition(t), keepMounted: desktop !== undefined }), 'ui-sidebar-browser.type')
+  const installFrames = (scope: Context, factory: (sessionId: BrowserBodyProps['sessionId']) => BrowserPageFactory): void => {
+    const controllers = new Map<BrowserBodyProps['sessionId'], BrowserInjected>()
+    scope.effect(() => async () => {
+      const pending = [...controllers.values()].map(controller => controller.dispose())
+      controllers.clear()
+      await Promise.all(pending)
+    }, 'ui-sidebar-browser.frames')
+    scope.effect(() => scope.slots.inject('sidebar.right.pane.tab', () => scope.slots.register({
+      name: 'sidebar.right.pane.tab', key: BROWSER_ID, locale: namespace, store,
+      inject: (sessionId, actions) => {
+        const existing = controllers.get(sessionId)
+        if (existing !== undefined) {
+          existing.rebind(actions)
+          return existing
+        }
+        const controller = createBrowserControllers(actions, factory(sessionId), tabId =>
+          openTabs.getSnapshot().some(tab => tab.sessionId === sessionId && tab.tabId === tabId))
+        controllers.set(sessionId, controller)
+        return controller
+      },
+    }, BrowserBody)), 'ui-sidebar-browser.body')
+  }
+  if (desktop === undefined) installFrames(ctx, () => createIframePage)
+  else ctx.inject(['workspaces'], (scope) => {
+    installFrames(scope, sessionId => options => createElectronPage(options, desktop,
+      signal => browserWorkspace(scope.workspaces.list, sessionId, signal)))
+  })
   ctx.effect(() => ctx.slots.inject('sidebar.right.pane.tab.title', () => ctx.slots.register({
     name: 'sidebar.right.pane.tab.title', key: BROWSER_ID, store,
   }, BrowserTitle)), 'ui-sidebar-browser.title')
diff --git a/packages/client/ui-sidebar-browser/src/client/locales.ts b/packages/client/ui-sidebar-browser/src/client/locales.ts
index 4c551b123e..3c0d305b66 100644
--- a/packages/client/ui-sidebar-browser/src/client/locales.ts
+++ b/packages/client/ui-sidebar-browser/src/client/locales.ts
@@ -15,13 +15,16 @@ export const zh = {
   'sandbox.warning': '沙箱限制已关闭；页面可以导航顶层应用，并使用下载、模态对话框与输入锁定。',
   start: '输入 HTTP(S) 地址开始浏览',
   loading: '正在打开…',
+  'restore.previous': '上次打开',
+  'restore.action': '恢复页面',
   'error.empty': '请输入地址。',
   'error.invalid': '这个地址无效或过长。',
   'error.protocol': '只支持 HTTP 和 HTTPS 地址；本地文件请使用文档预览。',
   'error.credentials': '地址不能包含用户名或密码。',
   'error.application-origin': '不能在嵌入浏览器中打开 DSH 应用自身。',
-  'web.loadFailed': '页面报告加载失败或可能禁止嵌入；可尝试在系统浏览器中打开。',
-  'web.unknown': '页面已在 iframe 内跳转；Web 模式无法读取当前 URL。',
+  'load.failed': '页面加载失败；请刷新重试或在系统浏览器中打开。',
+  'load.failed.detail': '页面加载失败 ({code}): {description}',
+  'address.unknown': '页面已跳转；当前载体无法读取新的 URL。',
 } satisfies Record<string, string>
 
 /** Browser dictionary key union. */
@@ -44,13 +47,16 @@ export const en = {
   'sandbox.warning': 'Sandbox restrictions are disabled; the page can navigate the top-level app and use downloads, modal dialogs, and input locks.',
   start: 'Enter an HTTP(S) address to start browsing',
   loading: 'Opening…',
+  'restore.previous': 'Previously opened',
+  'restore.action': 'Restore page',
   'error.empty': 'Enter an address.',
   'error.invalid': 'That address is invalid or too long.',
   'error.protocol': 'Only HTTP and HTTPS addresses are supported; use Document Preview for local files.',
   'error.credentials': 'Addresses cannot contain a username or password.',
   'error.application-origin': 'The embedded browser cannot open the DSH application itself.',
-  'web.loadFailed': 'The page reported a load failure or may block embedding; try opening it in the system browser.',
-  'web.unknown': 'The page navigated inside the iframe; Web mode cannot read its current URL.',
+  'load.failed': 'The page could not load; reload or open it in the system browser.',
+  'load.failed.detail': 'Page load failed ({code}): {description}',
+  'address.unknown': 'The page navigated; this carrier cannot read its new URL.',
 } satisfies Record<SidebarBrowserKey, string>
 
 declare module '@deepseek-ai/dsh-client-ui-slots' {
diff --git a/packages/client/ui-sidebar-browser/src/client/pages.ts b/packages/client/ui-sidebar-browser/src/client/pages.ts
new file mode 100644
index 0000000000..220616b4bd
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/src/client/pages.ts
@@ -0,0 +1,19 @@
+/** Assemble iframe navigation and presentation without platform branches in consumers. */
+import type { BrowserPage, BrowserPageOptions } from './browser/BrowserPage.ts'
+import { IframeImpl } from './browser/IframeImpl.ts'
+import { IframePresentation } from './view/IframePresentation.ts'
+
+/**
+ * Assemble an idle iframe provider and its DOM presentation.
+ * @param options - saved navigation and callbacks.
+ * @returns the Web page's navigation and presentation objects.
+ */
+export function createIframePage(options: BrowserPageOptions): BrowserPage {
+  const presentation = new IframePresentation({
+    loaded: (revision) => { frame.handleLoaded(revision) },
+    failed: (revision) => { frame.handleLoadFailed(revision) },
+    remounted: () => { frame.reload() },
+  })
+  const frame = new IframeImpl(options, presentation)
+  return { frame, presentation }
+}
diff --git a/packages/client/ui-sidebar-browser/src/client/view/Browser.module.css b/packages/client/ui-sidebar-browser/src/client/view/Browser.module.css
index 0914d8e6f5..ed6d2cd882 100644
--- a/packages/client/ui-sidebar-browser/src/client/view/Browser.module.css
+++ b/packages/client/ui-sidebar-browser/src/client/view/Browser.module.css
@@ -81,6 +81,9 @@
 }
 
 .addressUnknown {
+  --dsh-scrollbar-thumb: var(--dsw-alias-scrollbar-bg-l2);
+  --dsh-scrollbar-thumb-hover: var(--dsw-alias-scrollbar-hover-l2);
+
   color: var(--dsw-alias-label-tertiary);
   background: var(--dsw-alias-bg-layer-2);
 }
@@ -121,6 +124,83 @@
   background: var(--dsw-alias-bg-base);
 }
 
+.content {
+  position: relative;
+  display: flex;
+  flex: 1 1 auto;
+  min-width: 0;
+  min-height: 0;
+}
+
+.viewport {
+  display: flex;
+  flex: 1 1 auto;
+  min-width: 0;
+  min-height: 0;
+}
+
+.placeholder {
+  position: absolute;
+  inset: 0;
+  display: flex;
+  pointer-events: none;
+}
+
+.restore {
+  position: absolute;
+  inset: 0;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 10px;
+  padding: 24px;
+  overflow: auto;
+  text-align: center;
+}
+
+.restoreLabel {
+  margin: auto 0 0;
+  color: var(--dsw-alias-label-tertiary);
+  font: var(--dsw-font-xxs-12);
+}
+
+.restoreTitle {
+  max-width: 100%;
+  margin: 0;
+  overflow-wrap: anywhere;
+  font: var(--dsw-font-xs-13);
+  font-weight: 500;
+}
+
+.restoreUrl {
+  max-width: 100%;
+  margin: 0;
+  overflow-wrap: anywhere;
+  color: var(--dsw-alias-label-secondary);
+  font: var(--dsw-font-xxs-12);
+}
+
+.restore > :last-child {
+  flex-shrink: 0;
+  margin-bottom: auto;
+}
+
+.webview {
+  display: flex;
+  flex: 1 1 auto;
+  min-width: 0;
+  min-height: 0;
+  width: 100%;
+  height: 100%;
+  border: 0;
+  -webkit-app-region: no-drag;
+}
+
+/* Native guest input must not consume a docking gesture's window events. */
+:global(html:has([data-dockkit-pointer])) .webview {
+  pointer-events: none;
+}
+
 .start {
   display: flex;
   flex: 1 1 auto;
diff --git a/packages/client/ui-sidebar-browser/src/client/view/BrowserBody.tsx b/packages/client/ui-sidebar-browser/src/client/view/BrowserBody.tsx
index 5c11a1f374..7c5a7e455b 100644
--- a/packages/client/ui-sidebar-browser/src/client/view/BrowserBody.tsx
+++ b/packages/client/ui-sidebar-browser/src/client/view/BrowserBody.tsx
@@ -1,7 +1,8 @@
-/** Browser toolbar and Web iframe renderer. */
-import { useEffect, useRef, useState } from 'react'
+/** Common browser chrome; a presentation adapter attaches the page inside its content container. */
+import { useId, useLayoutEffect, useRef, useState } from 'react'
 import type { FormEvent, ReactNode } from 'react'
 import {
+  Button,
   IconChevronLeftOutlineRegular,
   IconChevronRightOutlineRegular,
   IconLinkOutlineRegular,
@@ -12,16 +13,12 @@ import {
 } from '@deepseek-ai/dsh-client-ui-primitives'
 import type { InjectFace, PropsLocale, PropsRuntime, PropsStore } from '@deepseek-ai/dsh-client-ui-slots'
 import type { BrowserInjected } from '../browser/BrowserController.ts'
-import type { BrowserFrameState } from '../browser/BrowserFrame.ts'
-import { BrowserNavigation } from '../browser/BrowserNavigation.ts'
-import type { BrowserAddressFailure } from '../browser/url.ts'
+import { emptyBrowserFrame } from '../browser/BrowserFrame.ts'
+import { currentBrowserTarget } from '../browser/BrowserPersistence.ts'
 import type { BrowserStore } from '../browser/store.ts'
 import css from './Browser.module.css'
 
-/** Fixed Web iframe sandbox; popups escape the sandbox while top navigation remains absent. */
-export const WEB_BROWSER_SANDBOX = 'allow-scripts allow-forms allow-same-origin allow-popups allow-popups-to-escape-sandbox'
-
-const INITIAL_BROWSER_FRAME: BrowserFrameState = { document: undefined, sandboxed: true, loadFailed: false }
+const EMPTY_FRAME = emptyBrowserFrame()
 
 function SandboxPolicyIcon({ sandboxed }: { readonly sandboxed: boolean }): ReactNode {
   return (
@@ -40,116 +37,94 @@ export type BrowserBodyProps = PropsRuntime<'sidebar.right.pane.tab'>
   & PropsLocale<'sidebarBrowser'>
   & InjectFace<BrowserInjected>
 
-/** Translate one parser refusal without matching display strings in logic. */
-function failureText(reason: BrowserAddressFailure, t: BrowserBodyProps['t']): string {
-  return t(`error.${reason}`)
+function useBrowserDraft(url: string | undefined, revision: number): readonly [string, (value: string) => void] {
+  const [edit, setEdit] = useState<{ readonly revision: number; readonly value: string }>()
+  return [edit?.revision === revision ? edit.value : url ?? '',
+    (value) => { setEdit({ revision, value }) }]
 }
 
-function useBrowserDraft(
-  controlledUrl: string | undefined,
-  requestId: number | undefined,
-): readonly [string, (value: string) => void] {
-  const [edit, setEdit] = useState<{ readonly requestId: number | undefined; readonly value: string }>()
-  const value = edit !== undefined && edit.requestId === requestId ? edit.value : controlledUrl ?? ''
-  return [value, (draft) => { setEdit({ requestId, value: draft }) }]
-}
-
-/** Browser tab renderer for a controller-owned URL state and Web iframe carrier. */
+/** Render provider-neutral navigation state and optional controls. */
 export function BrowserBody(props: BrowserBodyProps): ReactNode {
-  const {
-    goBack, goForward, loadUrl, mount, reload, reportLoaded, reportLoadFailed, toggleSandbox,
-    useBrowserFrame, useStore, useTabInfo, t,
-  } = props
+  const { mount, loadUrl, restore, goBack, goForward, reload, setSandbox, useBrowserState, useStore, useTabInfo, t } = props
   const { tab } = useTabInfo()
-  const state = useStore(snapshot => snapshot.byTab[tab.id]) ?? BrowserNavigation.empty()
-  const initialState = useRef(state)
+  const saved = useStore(state => state.byTab[tab.id])
+  const initial = useRef(saved)
   const initialUrl = useRef(tab.navigation.params?.url)
-  const current = BrowserNavigation.current(state)
-  const [draft, setDraft] = useBrowserDraft(current?.url ?? initialUrl.current, state.request?.revision)
-  const [mountCount, setMountCount] = useState(0)
+  const viewportId = useId()
+  const [mountEpoch, setMountEpoch] = useState(0)
+  const state = useBrowserState(tab.id)
+  const frame = state?.frame ?? EMPTY_FRAME
+  const restoreTarget = state === undefined ? currentBrowserTarget(initial.current) : state.restoreTarget
+  const target = frame.target ?? restoreTarget
+  const [draft, setDraft] = useBrowserDraft(target?.url ?? initialUrl.current, state?.addressRevision ?? 0)
 
-  useEffect(() => {
-    mount(tab.id, tab.signal, window.location.origin, initialState.current)
-    setMountCount(count => count + 1)
-  }, [mount, tab.id, tab.signal])
+  useLayoutEffect(() => {
+    const hide = mount({
+      tabId: tab.id, signal: tab.signal, viewportId, applicationOrigin: window.location.origin,
+      initial: initial.current, initialUrl: initialUrl.current,
+      openTab: (url) => { tab.actions.openTab('browser', { params: { url }, revealIfOpened: false }) },
+    })
+    setMountEpoch(value => value + 1)
+    return hide
+  }, [mount, tab.id, tab.signal, tab.actions, viewportId, props.actions])
 
-  useEffect(() => {
-    if (mountCount === 0) return
-    const resumed = BrowserNavigation.current(initialState.current)
-    if (resumed !== undefined) {
-      reload(tab.id)
-      return
-    }
-    const url = initialUrl.current
-    if (url !== undefined) loadUrl(tab.id, url)
-  }, [loadUrl, mountCount, reload, tab.id])
-
-  const frameState = useBrowserFrame(tab.id) ?? INITIAL_BROWSER_FRAME
-  const { document, sandboxed, loadFailed } = frameState
-
-  const navigationUnknown = state.navigation.status === 'unknown'
-  const externalUrl = navigationUnknown ? undefined : current?.url
+  const unknown = frame.address === 'unknown'
+  const externalUrl = unknown ? undefined : target?.url
+  const sandboxed = frame.sandboxEnabled
+  const failure = state?.addressFailure
+  const error = frame.error
   const submit = (event: FormEvent): void => { event.preventDefault(); loadUrl(tab.id, draft) }
-  const failure = state.failure === undefined ? undefined : failureText(state.failure.reason, t)
-  const placeholder = current === undefined ? t('start') : t('loading')
 
   return (
     <div className={css.root}>
       <form className={css.toolbar} onSubmit={submit}>
-        <button type="button" className={css.tool} aria-label={t('back')} title={t('back')} disabled={!BrowserNavigation.canGoBack(state)} onClick={() => { goBack(tab.id) }}><IconChevronLeftOutlineRegular /></button>
-        <button type="button" className={css.tool} aria-label={t('forward')} title={t('forward')} disabled={!BrowserNavigation.canGoForward(state)} onClick={() => { goForward(tab.id) }}><IconChevronRightOutlineRegular /></button>
-        <button type="button" className={css.tool} aria-label={t('reload')} title={t('reload')} disabled={current === undefined} onClick={() => { reload(tab.id) }}><IconRefreshOutlineRegular /></button>
+        <button type="button" className={css.tool} aria-label={t('back')} title={t('back')} disabled={!frame.canGoBack} onClick={() => { goBack(tab.id) }}><IconChevronLeftOutlineRegular /></button>
+        <button type="button" className={css.tool} aria-label={t('forward')} title={t('forward')} disabled={!frame.canGoForward} onClick={() => { goForward(tab.id) }}><IconChevronRightOutlineRegular /></button>
+        <button type="button" className={css.tool} aria-label={t('reload')} title={t('reload')} disabled={target === undefined || mountEpoch === 0} onClick={() => { reload(tab.id) }}><IconRefreshOutlineRegular /></button>
         <div className={css.addressBox}>
           <input
-            className={`${css.address} ${navigationUnknown ? css.addressUnknown : ''}`}
+            className={[css.address, unknown ? css.addressUnknown : ''].join(' ')}
             value={draft}
             aria-label={t('address.placeholder')}
             placeholder={t('address.placeholder')}
             spellCheck={false}
             onChange={(event) => { setDraft(event.currentTarget.value) }}
           />
-          {navigationUnknown && <span className={css.addressChanged}>{t('address.changed')}</span>}
-          <button type="submit" className={`${css.tool} ${css.addressGo}`} aria-label={t('go')} title={t('go')}><IconLinkOutlineRegular /></button>
+          {unknown && <span className={css.addressChanged}>{t('address.changed')}</span>}
+          <button type="submit" className={[css.tool, css.addressGo].join(' ')} aria-label={t('go')} title={t('go')}><IconLinkOutlineRegular /></button>
         </div>
-        <button
-          type="button"
-          className={css.tool}
-          aria-label={t('external')}
-          title={t('external')}
-          disabled={externalUrl === undefined}
-          onClick={() => {
-            /* v8 ignore next -- React does not dispatch clicks from this disabled button. */
-            if (externalUrl !== undefined) window.open(externalUrl, '_blank', 'noopener,noreferrer')
-          }}
+        <button type="button" className={css.tool} aria-label={t('external')} title={t('external')} disabled={externalUrl === undefined}
+          onClick={externalUrl === undefined ? undefined : () => { window.open(externalUrl, '_blank', 'noopener,noreferrer') }}
         ><IconRightUpOutlineRegular size={14} /></button>
-        <button
+        {sandboxed !== undefined && <button
           type="button"
-          className={`${css.tool} ${sandboxed ? '' : css.sandboxOff}`}
+          className={[css.tool, sandboxed ? '' : css.sandboxOff].join(' ')}
           aria-label={t(sandboxed ? 'sandbox.disable' : 'sandbox.enable')}
           title={t(sandboxed ? 'sandbox.disable' : 'sandbox.enable')}
           aria-pressed={!sandboxed}
-          disabled={mountCount === 0}
-          onClick={() => { toggleSandbox(tab.id) }}
-        ><SandboxPolicyIcon sandboxed={sandboxed} /></button>
+          onClick={() => { setSandbox(tab.id, !sandboxed) }}
+        ><SandboxPolicyIcon sandboxed={sandboxed} /></button>}
       </form>
-      {!sandboxed && <div className={css.sandboxWarning} role="status">{t('sandbox.warning')}</div>}
-      {loadFailed && <div className={css.failure} role="status">{t('web.loadFailed')}</div>}
-      {failure !== undefined && <div className={css.failure} role="alert">{failure}</div>}
-      {document === undefined
-        ? <div className={css.start}>{placeholder}</div>
-        : <iframe
-          key={`${document.target.url}:${String(document.revision)}`}
-          className={css.frame}
-          src={document.src}
-          sandbox={sandboxed ? WEB_BROWSER_SANDBOX : undefined}
-          referrerPolicy="no-referrer"
-          title={document.target.title}
-          onLoad={() => { reportLoaded(tab.id, document.revision) }}
-          /* v8 ignore next -- jsdom does not dispatch React iframe error events; BrowserFrame owns the tested behavior. */
-          onError={() => { reportLoadFailed(tab.id, document.revision) }}
-          data-sidebar-browser-frame
-        />}
-      {navigationUnknown && <p className={css.limit}>{t('web.unknown')}</p>}
+      {sandboxed === false && <div className={css.sandboxWarning} role="status">{t('sandbox.warning')}</div>}
+      {error !== undefined && <div className={css.failure} role="status">{error.code !== undefined && error.description !== undefined
+        ? t('load.failed.detail', { code: String(error.code), description: error.description })
+        : t('load.failed')}</div>}
+      {failure !== undefined && <div className={css.failure} role="alert">{t(`error.${failure}`)}</div>}
+      <div className={css.content} aria-busy={frame.loading}>
+        <div id={viewportId} className={css.viewport} aria-label={t('type.label')} />
+        {restoreTarget !== undefined && <section className={css.restore} aria-label={t('restore.previous')}>
+          <p className={css.restoreLabel}>{t('restore.previous')}</p>
+          <p className={css.restoreTitle}>{restoreTarget.title}</p>
+          <p className={css.restoreUrl}>{restoreTarget.url}</p>
+          <Button variant="primary" size="sm" disabled={mountEpoch === 0} onClick={() => { restore(tab.id) }}>
+            {t('restore.action')}
+          </Button>
+        </section>}
+        {restoreTarget === undefined && (target === undefined || frame.loading) && error === undefined && <div className={css.placeholder}>
+          <div className={css.start}>{t(target === undefined ? 'start' : 'loading')}</div>
+        </div>}
+      </div>
+      {unknown && <p className={css.limit}>{t('address.unknown')}</p>}
     </div>
   )
 }
diff --git a/packages/client/ui-sidebar-browser/src/client/view/BrowserPresentation.ts b/packages/client/ui-sidebar-browser/src/client/view/BrowserPresentation.ts
new file mode 100644
index 0000000000..dadf0dc478
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/src/client/view/BrowserPresentation.ts
@@ -0,0 +1,9 @@
+/** The presentation face is separate from page navigation and terminal disposal. */
+export interface BrowserPresentation {
+  /**
+   * Attach the page inside a committed content container.
+   * @param viewportId - content element id; its DOM ancestors must remain connected for page retention.
+   * @returns ends physical attachment, without disposing the navigation model; a later mount may reload the page.
+   */
+  mount(viewportId: string): () => void
+}
diff --git a/packages/client/ui-sidebar-browser/src/client/view/BrowserTitle.tsx b/packages/client/ui-sidebar-browser/src/client/view/BrowserTitle.tsx
index 55d479d5ae..6a3c54c7f5 100644
--- a/packages/client/ui-sidebar-browser/src/client/view/BrowserTitle.tsx
+++ b/packages/client/ui-sidebar-browser/src/client/view/BrowserTitle.tsx
@@ -2,7 +2,7 @@
 import type { ReactNode } from 'react'
 import { IconGlobeOutlineRegular } from '@deepseek-ai/dsh-client-ui-primitives'
 import type { PropsRuntime, PropsStore } from '@deepseek-ai/dsh-client-ui-slots'
-import { BrowserNavigation } from '../browser/BrowserNavigation.ts'
+import { currentBrowserTarget } from '../browser/BrowserPersistence.ts'
 import type { BrowserStore } from '../browser/store.ts'
 import css from './Browser.module.css'
 
@@ -12,6 +12,6 @@ export type BrowserTitleProps = PropsRuntime<'sidebar.right.pane.tab.title'> & P
 /** Browser icon and current host name. */
 export function BrowserTitle({ useTabInfo, useStore }: BrowserTitleProps): ReactNode {
   const { tab } = useTabInfo()
-  const entry = useStore(state => BrowserNavigation.current(state.byTab[tab.id]))
+  const entry = useStore(state => currentBrowserTarget(state.byTab[tab.id]))
   return <><IconGlobeOutlineRegular className={css.titleIcon} />{entry?.title ?? tab.title}</>
 }
diff --git a/packages/client/ui-sidebar-browser/src/client/view/IframePresentation.ts b/packages/client/ui-sidebar-browser/src/client/view/IframePresentation.ts
new file mode 100644
index 0000000000..fc064f5ca7
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/src/client/view/IframePresentation.ts
@@ -0,0 +1,88 @@
+/** Iframe DOM and revision-tagged load observations. */
+import type { BrowserTarget } from '../browser/url.ts'
+import type { BrowserPresentation } from './BrowserPresentation.ts'
+import css from './Browser.module.css'
+
+/** Fixed iframe policy; top navigation and downloads are not granted directly. */
+export const WEB_BROWSER_SANDBOX = 'allow-scripts allow-forms allow-same-origin allow-popups allow-popups-to-escape-sandbox'
+
+interface IframeDocument {
+  readonly target: BrowserTarget
+  readonly revision: number
+  readonly sandboxed: boolean
+}
+
+/** Reports only what an iframe can observe without inspecting cross-origin content. */
+export interface IframePresentationEvents {
+  readonly loaded: (revision: number) => void
+  readonly failed: (revision: number) => void
+  readonly remounted: () => void
+}
+
+/** Owns the iframe element; navigation and history remain in IframeImpl. */
+export class IframePresentation implements BrowserPresentation {
+  private host: HTMLElement | undefined
+  private element: HTMLIFrameElement | undefined
+  private document: IframeDocument | undefined
+  private rendered = false
+
+  /** @param events - provider-owned load and remount callbacks. */
+  constructor(private readonly events: IframePresentationEvents) {}
+
+  /** @param viewportId - mounted placeholder. @returns removes only the iframe presentation. */
+  mount(viewportId: string): () => void {
+    const host = document.getElementById(viewportId)
+    if (host === null) throw new Error('iframe presentation: viewport is not mounted')
+    this.element?.remove()
+    this.element = undefined
+    this.host = host
+    if (this.rendered) this.events.remounted()
+    else this.render()
+    return () => {
+      if (this.host !== host) return
+      this.element?.remove()
+      this.element = undefined
+      this.host = undefined
+    }
+  }
+
+  /**
+   * Retain the prepared document and render it when a container is mounted.
+   * @param value - prepared document and event generation.
+   */
+  show(value: IframeDocument): void {
+    this.document = value
+    this.render()
+  }
+
+  /** Remove the owned DOM and retained presentation data. */
+  dispose(): void {
+    this.element?.remove()
+    this.element = undefined
+    this.host = undefined
+    this.document = undefined
+  }
+
+  private render(): void {
+    const current = this.document
+    const host = this.host
+    if (current === undefined || host === undefined) return
+    this.element?.remove()
+    const element = document.createElement('iframe')
+    element.className = css.frame as string
+    element.src = current.target.url
+    element.title = current.target.title
+    element.referrerPolicy = 'no-referrer'
+    element.dataset.sidebarBrowserFrame = 'iframe'
+    if (current.sandboxed) element.setAttribute('sandbox', WEB_BROWSER_SANDBOX)
+    element.addEventListener('load', () => {
+      if (this.element === element) this.events.loaded(current.revision)
+    })
+    element.addEventListener('error', () => {
+      if (this.element === element) this.events.failed(current.revision)
+    })
+    this.element = element
+    this.rendered = true
+    host.append(element)
+  }
+}
diff --git a/packages/client/ui-sidebar-browser/src/types.ts b/packages/client/ui-sidebar-browser/src/types.ts
new file mode 100644
index 0000000000..932211e13b
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/src/types.ts
@@ -0,0 +1,27 @@
+/** Type-only Electron bridge declarations shared by the desktop shell and browser provider. */
+import type { Branded } from '@deepseek-ai/dsh-brand'
+
+/** Main-issued identity of one guest reservation. */
+export type DesktopBrowserLeaseId = Branded<'DesktopBrowserLeaseId'>
+
+/** A guest's approved, process-local storage partition. */
+export interface DesktopBrowserReservation {
+  readonly lease: DesktopBrowserLeaseId
+  readonly partition: string
+}
+
+/** Main-approved request to open an HTTP(S) page from an existing guest. */
+export interface DesktopBrowserOpenRequest {
+  readonly lease: DesktopBrowserLeaseId
+  readonly url: string
+}
+
+/** Origin-scoped operations; no Electron objects or arbitrary IPC cross this interface. */
+export interface DesktopBrowserBridge {
+  /** @param workspace - resolved storage account. @returns one approved guest reservation. */
+  acquire(workspace: string): Promise<DesktopBrowserReservation>
+  /** @param lease - the caller's reservation. @returns after its guest has been destroyed. */
+  release(lease: DesktopBrowserLeaseId): Promise<void>
+  /** @param lease - originating guest. @param listener - approved URL consumer. @returns unsubscribe callback. */
+  onOpenRequested(lease: DesktopBrowserLeaseId, listener: (url: string) => void): () => void
+}
diff --git a/packages/client/ui-sidebar-browser/tests/apply.client.spec.ts b/packages/client/ui-sidebar-browser/tests/apply.client.spec.ts
index f14dee3038..311138f63e 100644
--- a/packages/client/ui-sidebar-browser/tests/apply.client.spec.ts
+++ b/packages/client/ui-sidebar-browser/tests/apply.client.spec.ts
@@ -1,6 +1,8 @@
+// @vitest-environment jsdom
 /** Browser type, Slot, locale, and HMR disposal through the real registries. */
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import { Context } from '@deepseek-ai/cordis'
+import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
 import { SidebarRightTabRegistry } from '@deepseek-ai/dsh-client-ui-sidebar-right/src/client/tab-registry.ts'
 import { BrowserBody } from '../src/client/view/BrowserBody.tsx'
 import { BrowserTitle } from '../src/client/view/BrowserTitle.tsx'
@@ -8,7 +10,16 @@ import type { BrowserInjected } from '../src/client/browser/BrowserController.ts
 import { BROWSER_ID, BROWSER_KIND } from '../src/client/definition.tsx'
 import { apply, inject } from '../src/client/index.ts'
 import { en, zh } from '../src/client/locales.ts'
-import { apply as hostApply } from '../src/index.ts'
+import { createBrowserStore } from '../src/client/browser/store.ts'
+import type { TabId } from '@deepseek-ai/dsh-client-ui-dockkit'
+import type { DesktopBrowserBridge, DesktopBrowserLeaseId } from '../src/types.ts'
+
+const contexts: Context[] = []
+
+afterEach(async () => {
+  await Promise.all(contexts.splice(0).map(ctx => ctx.fiber.dispose()))
+  vi.unstubAllGlobals()
+})
 
 interface Recorded {
   name: string
@@ -21,6 +32,7 @@ interface Recorded {
 
 async function boot() {
   const ctx = new Context()
+  contexts.push(ctx)
   const tabs = new SidebarRightTabRegistry(ctx)
   const registered: Recorded[] = []
   const slots = {
@@ -40,16 +52,63 @@ async function boot() {
     }),
   }
   ctx.provide('sidebarRightTabs', tabs as never)
+  const openTabs = createSnapshotStore<readonly { sessionId: string; tabId: TabId }[]>([])
+  ctx.provide('sidebarRight', { openTabs } as never)
+  ctx.provide('workspaces', { list: createSnapshotStore({ phase: 'ready', items: [] }) } as never)
   ctx.provide('slots', slots as never)
   ctx.provide('locale', locale as never)
   const fiber = ctx.plugin({ inject: [...inject], apply })
   await fiber.await()
-  return { tabs, registered, dictionaries, fiber }
+  return { tabs, registered, dictionaries, fiber, openTabs }
 }
 
 describe('ui-sidebar-browser apply', () => {
-  it('keeps the Host Loader entry inert', () => {
-    expect(hostApply).not.toThrow()
+  it.each([0, 1])('binds and rebinds session controllers under desktop protocol %s', async (protocolVersion) => {
+    const acquire = vi.fn(async () => ({ lease: 'test-lease' as DesktopBrowserLeaseId, partition: 'test-partition' }))
+    const bridge: DesktopBrowserBridge = {
+      acquire,
+      release: vi.fn(async () => {}),
+      onOpenRequested: vi.fn(() => () => {}),
+    }
+    vi.stubGlobal('dshDesktop', { protocolVersion, browser: bridge })
+    const h = await boot()
+    expect(h.tabs.get(BROWSER_KIND)?.keepMounted).toBe(protocolVersion === 1)
+    const injectFace = h.registered.find(entry => entry.name === 'sidebar.right.pane.tab')!.inject as
+      (sessionId: string, actions: Parameters<BrowserInjected['rebind']>[0]) => BrowserInjected
+    const firstStore = createBrowserStore().create(`apply-first-${protocolVersion}`)
+    const replacementStore = createBrowserStore().create(`apply-replacement-${protocolVersion}`)
+    const controller = injectFace('session', firstStore.actions)
+    expect(injectFace('session', replacementStore.actions)).toBe(controller)
+    const host = document.createElement('div')
+    host.id = `browser-apply-${protocolVersion}`
+    document.body.append(host)
+    const signal = new AbortController()
+    const tabId = 'apply-tab' as TabId
+    try {
+      controller.mount({ tabId, signal: signal.signal, viewportId: host.id, applicationOrigin: 'https://dsh.example',
+        initial: undefined, initialUrl: 'https://example.test/', openTab: vi.fn() })
+      expect(replacementStore.getSnapshot().byTab[tabId]).toBeDefined()
+      expect(firstStore.getSnapshot().byTab[tabId]).toBeUndefined()
+      if (protocolVersion === 1) await vi.waitFor(() => { expect(acquire).toHaveBeenCalledWith('session:session') })
+      else expect(host.querySelector('iframe')).not.toBeNull()
+      h.openTabs.set([{ sessionId: 'other', tabId }, { sessionId: 'session', tabId: 'other-tab' as TabId }])
+      signal.abort()
+      expect(replacementStore.getSnapshot().byTab[tabId]).toBeUndefined()
+      const reopened = new AbortController()
+      controller.mount({ tabId, signal: reopened.signal, viewportId: host.id, applicationOrigin: 'https://dsh.example',
+        initial: undefined, initialUrl: 'https://retained.example/', openTab: vi.fn() })
+      h.openTabs.set([{ sessionId: 'session', tabId }])
+      reopened.abort()
+      expect(replacementStore.getSnapshot().byTab[tabId]).toBeDefined()
+      const active = new AbortController()
+      controller.mount({ tabId, signal: active.signal, viewportId: host.id, applicationOrigin: 'https://dsh.example',
+        initial: undefined, initialUrl: undefined, openTab: vi.fn() })
+      await h.fiber.dispose()
+      expect(controller.keyedHooks.browserState(tabId)).toBeUndefined()
+    } finally {
+      await h.fiber.dispose()
+      host.remove()
+    }
   })
 
   it('registers a multi-instance builtin and its body and title', async () => {
@@ -72,7 +131,7 @@ describe('ui-sidebar-browser apply', () => {
     expect(registered[0]?.inject).toBeTypeOf('function')
     const injectFace = registered[0]?.inject as ((sessionId: string, actions: unknown) => unknown)
     const browser = injectFace('session', { replace: vi.fn(), forget: vi.fn() }) as BrowserInjected
-    expect(browser.keyedHooks.browserFrame('missing')).toBeUndefined()
+    expect(browser.keyedHooks.browserState('missing')).toBeUndefined()
     expect(typeof browser.mount).toBe('function')
   })
 
diff --git a/packages/client/ui-sidebar-browser/tests/apply.host.spec.ts b/packages/client/ui-sidebar-browser/tests/apply.host.spec.ts
new file mode 100644
index 0000000000..419889503c
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/tests/apply.host.spec.ts
@@ -0,0 +1,6 @@
+import { expect, it } from 'vitest'
+import { apply } from '../src/index.ts'
+
+it('keeps the Browser Host Loader entry inert', () => {
+  expect(apply).not.toThrow()
+})
diff --git a/packages/client/ui-sidebar-browser/tests/browser-body.client.spec.tsx b/packages/client/ui-sidebar-browser/tests/browser-body.client.spec.tsx
index 4615a0a0d4..09ca4e75d1 100644
--- a/packages/client/ui-sidebar-browser/tests/browser-body.client.spec.tsx
+++ b/packages/client/ui-sidebar-browser/tests/browser-body.client.spec.tsx
@@ -3,17 +3,24 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 import { act, cleanup, fireEvent, render, waitFor } from '@testing-library/react'
 import { useSyncExternalStore } from 'react'
 import type { SessionId } from '@deepseek-ai/dsh-session/types'
-import type { TabId } from '@deepseek-ai/dsh-client-ui-dockkit'
-import { createBrowserControllers } from '../src/client/browser/BrowserController.ts'
-import type { BrowserFrameState } from '../src/client/browser/BrowserFrame.ts'
+import type { PaneId, TabId } from '@deepseek-ai/dsh-client-ui-dockkit'
+import { createBrowserControllers, type BrowserControllerState, type BrowserInjected } from '../src/client/browser/BrowserController.ts'
 import { createBrowserStore } from '../src/client/browser/store.ts'
 import type { BrowserBodyProps } from '../src/client/view/BrowserBody.tsx'
-import { BrowserBody, WEB_BROWSER_SANDBOX } from '../src/client/view/BrowserBody.tsx'
+import { BrowserBody } from '../src/client/view/BrowserBody.tsx'
+import { WEB_BROWSER_SANDBOX } from '../src/client/view/IframePresentation.ts'
+import { createIframePage } from '../src/client/pages.ts'
 import { zh } from '../src/client/locales.ts'
+import { browserAddressCheckpoint, type BrowserTabState } from '../src/client/browser/BrowserPersistence.ts'
+import type { BrowserPageFactory, BrowserPageOptions } from '../src/client/browser/BrowserPage.ts'
+import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
+import { emptyBrowserFrame, type BrowserFrameState } from '../src/client/browser/BrowserFrame.ts'
 
 const SESSION = 'session' as SessionId
 const TAB = 'tab' as TabId
+const messages: Readonly<Record<string, string>> = zh
 const lifetimes = new Set<AbortController>()
+const controllers: BrowserInjected[] = []
 let mountSequence = 0
 
 function hookOf<T>(store: { subscribe(listener: () => void): () => void; getSnapshot(): T }) {
@@ -25,51 +32,54 @@ function hookOf<T>(store: { subscribe(listener: () => void): () => void; getSnap
   }
 }
 
-const absentFrame = {
+const absentState = {
   subscribe: (_listener: () => void): (() => void) => () => {},
-  getSnapshot: (): BrowserFrameState | undefined => undefined,
+  getSnapshot: (): BrowserControllerState | undefined => undefined,
 }
 
-function mountBrowser(navigation?: { readonly url?: string }) {
+function mountBrowser(navigation?: { readonly url?: string },
+  options: { initial?: BrowserTabState; createPage?: BrowserPageFactory } = {}) {
   const store = createBrowserStore().create(`browser-body-test-${String(++mountSequence)}`)
+  if (options.initial !== undefined) store.actions.replace(TAB, options.initial)
   const lifetime = new AbortController()
   lifetimes.add(lifetime)
-  const injected = createBrowserControllers(store.actions)
+  const injected = createBrowserControllers(store.actions, options.createPage ?? createIframePage, () => true)
+  controllers.push(injected)
   const { keyedHooks, ...commands } = injected
-  const props = {
-    sessionId: SESSION,
-    useSessions: vi.fn(),
-    useResource: vi.fn(),
-    useWorkspaces: vi.fn(),
-    usePanelInfo: vi.fn(),
-    useSessionPendingInteraction: vi.fn(),
-    useTabInfo: () => ({
-      sidebar: { expanded: true, fullscreen: false }, panel: { id: 'pane' },
-      tab: {
-        id: TAB, kind: 'browser', title: 'Browser', contentId: 'sidebar://browser/1', visible: true,
-        navigation: { address: 'sidebar://browser/1', params: navigation, revision: 0 },
-        signal: lifetime.signal,
-        actions: { openResource: vi.fn(), openTab: vi.fn(), close: vi.fn() },
+  const tabActions = { openResource: vi.fn(), openTab: vi.fn(), close: vi.fn() }
+  const props: Pick<BrowserBodyProps, 'sessionId' | 'useTabInfo' | 'useStore' | 'actions' | 't' | 'useBrowserState'>
+    & Omit<BrowserInjected, 'keyedHooks'> = {
+      sessionId: SESSION,
+      useTabInfo: () => ({
+        sidebar: { expanded: true, fullscreen: false }, panel: { id: 'pane' as PaneId },
+        tab: {
+          id: TAB, kind: 'browser', title: 'Browser', contentId: 'sidebar://browser/1', visible: true,
+          navigation: { address: 'sidebar://browser/1', params: navigation, revision: 0 },
+          signal: lifetime.signal,
+          actions: tabActions,
+        },
+      }),
+      useStore: hookOf(store),
+      actions: store.actions,
+      t: (key, params) => {
+        const template = messages[key] ?? key
+        return params === undefined ? template : template.replace(/\{(\w+)\}/g, (_match, name: string) => String(params[name]))
       },
-    }),
-    useStore: hookOf(store),
-    actions: store.actions,
-    t: (key: keyof typeof zh, params?: Record<string, unknown>) => params === undefined
-      ? zh[key] : zh[key].replace('{message}', String(params.message)),
-    ...commands,
-    useBrowserFrame: (key: string) => {
-      const frame = keyedHooks.browserFrame(key) ?? absentFrame
-      return useSyncExternalStore(frame.subscribe, frame.getSnapshot)
-    },
-  } as unknown as BrowserBodyProps
-  const renderBody = () => render(<BrowserBody {...props} />)
+      ...commands,
+      useBrowserState: (key: string) => {
+        const state = keyedHooks.browserState(key) ?? absentState
+        return useSyncExternalStore(state.subscribe, state.getSnapshot)
+      },
+    }
+  const renderBody = () => render(<BrowserBody {...props as BrowserBodyProps} />)
   return {
-    view: renderBody(), remount: renderBody, store, lifetime, injected,
+    view: renderBody(), remount: renderBody, store, lifetime, injected, tabActions,
   }
 }
 
-afterEach(() => {
+afterEach(async () => {
   cleanup()
+  await Promise.all(controllers.splice(0).map(controller => controller.dispose()))
   for (const lifetime of lifetimes) lifetime.abort()
   lifetimes.clear()
   localStorage.clear()
@@ -77,6 +87,39 @@ afterEach(() => {
 })
 
 describe('BrowserBody', () => {
+  it('shows the saved title and URL without loading until Restore is clicked', async () => {
+    const target = { kind: 'https' as const, url: 'https://saved.example/page', title: 'Saved title' }
+    const mounted = mountBrowser(undefined, { initial: browserAddressCheckpoint(target, 1) })
+    expect(mounted.view.getByText(target.title)).toBeDefined()
+    expect(mounted.view.getByText(target.url)).toBeDefined()
+    expect(mounted.view.container.querySelector('iframe')).toBeNull()
+    expect(mounted.view.getByRole('button', { name: zh.reload })).toHaveProperty('disabled', false)
+    fireEvent.click(mounted.view.getByRole('button', { name: zh['restore.action'] }))
+    await waitFor(() => { expect(mounted.view.container.querySelector('iframe')?.src).toBe(target.url) })
+    expect(mounted.view.queryByText(target.title)).toBeNull()
+  })
+
+  it('renders native error details and routes provider open requests through the source tab', () => {
+    const state = createSnapshotStore<BrowserFrameState>({ ...emptyBrowserFrame(), error: { code: -105, description: 'DNS failure' } })
+    const providers: BrowserPageOptions[] = []
+    const mounted = mountBrowser(undefined, { createPage: (options) => {
+      providers.push(options)
+      return {
+        presentation: { mount: () => () => {} },
+        frame: { getSnapshot: () => state.getSnapshot(), subscribe: listener => state.subscribe(listener),
+          loadUrl: vi.fn(), goBack: vi.fn(), goForward: vi.fn(), reload: vi.fn(), dispose: async () => {} },
+      }
+    } })
+    expect(mounted.view.getByRole('status').textContent).toContain('DNS failure')
+    expect(mounted.view.getByRole('status').textContent).toContain('-105')
+    act(() => { state.set({ ...state.getSnapshot(), error: { code: -105, description: undefined } }) })
+    expect(mounted.view.getByRole('status').textContent).toBe(zh['load.failed'])
+    act(() => { providers[0]!.openRequested('https://new.example/') })
+    expect(mounted.tabActions.openTab).toHaveBeenCalledExactlyOnceWith('browser', {
+      params: { url: 'https://new.example/' }, revealIfOpened: false,
+    })
+  })
+
   it('routes address input to the controller and renders parser failures', async () => {
     const mounted = mountBrowser()
     const input = mounted.view.getByRole('textbox')
@@ -101,7 +144,8 @@ describe('BrowserBody', () => {
     expect(frame.getAttribute('src')).toBe('https://example.com/one')
     expect(frame.getAttribute('sandbox')).toBe(WEB_BROWSER_SANDBOX)
     expect(frame.getAttribute('allow')).toBeNull()
-    expect(frame.getAttribute('referrerpolicy')).toBe('no-referrer')
+    // jsdom does not reflect the iframe referrerPolicy property to its attribute.
+    expect(frame.referrerPolicy).toBe('no-referrer')
     const disableSandbox = mounted.view.getByRole('button', { name: zh['sandbox.disable'] })
     const protectedMark = disableSandbox.querySelector('svg path:last-child')?.getAttribute('d')
     fireEvent.click(disableSandbox)
@@ -169,15 +213,15 @@ describe('BrowserBody', () => {
     fireEvent.change(input, { target: { value: 'https://example.com/one' } })
     fireEvent.submit(input.closest('form')!)
     await waitFor(() => { expect(mounted.view.container.querySelector('iframe')).not.toBeNull() })
-    const failedRevision = mounted.store.getSnapshot().byTab[TAB]!.request!.revision
+    const failedFrame = mounted.view.container.querySelector('iframe')!
 
-    act(() => { mounted.injected.reportLoadFailed(TAB, failedRevision) })
-    expect(mounted.injected.keyedHooks.browserFrame(TAB)?.getSnapshot().loadFailed).toBe(true)
-    await waitFor(() => { expect(mounted.view.getByText(zh['web.loadFailed'])).toBeDefined() })
+    fireEvent.error(failedFrame)
+    expect(mounted.injected.keyedHooks.browserState(TAB)?.getSnapshot().frame.error).toBeDefined()
+    await waitFor(() => { expect(mounted.view.getByText(zh['load.failed'])).toBeDefined() })
     fireEvent.click(mounted.view.getByRole('button', { name: zh.reload }))
-    await waitFor(() => { expect(mounted.view.queryByText(zh['web.loadFailed'])).toBeNull() })
-    act(() => { mounted.injected.reportLoadFailed(TAB, failedRevision) })
-    expect(mounted.view.queryByText(zh['web.loadFailed'])).toBeNull()
+    await waitFor(() => { expect(mounted.view.queryByText(zh['load.failed'])).toBeNull() })
+    fireEvent.error(failedFrame)
+    expect(mounted.view.queryByText(zh['load.failed'])).toBeNull()
   })
 
   it('loads loopback under the default sandbox and keeps it across sandbox changes', async () => {
diff --git a/packages/client/ui-sidebar-browser/tests/browser-controller.client.spec.ts b/packages/client/ui-sidebar-browser/tests/browser-controller.client.spec.ts
index 3801351adb..f3b09fb9e5 100644
--- a/packages/client/ui-sidebar-browser/tests/browser-controller.client.spec.ts
+++ b/packages/client/ui-sidebar-browser/tests/browser-controller.client.spec.ts
@@ -3,10 +3,18 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { TabId } from '@deepseek-ai/dsh-client-ui-dockkit'
 import { BrowserController, createBrowserControllers } from '../src/client/browser/BrowserController.ts'
 import { createBrowserStore } from '../src/client/browser/store.ts'
+import { createIframePage } from '../src/client/pages.ts'
+import type { BrowserPageFactory, BrowserPageOptions } from '../src/client/browser/BrowserPage.ts'
+import { browserAddressCheckpoint } from '../src/client/browser/BrowserPersistence.ts'
+import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
+import { emptyBrowserFrame, type BrowserFrameState } from '../src/client/browser/BrowserFrame.ts'
 
 const TAB = 'tab' as TabId
 const APP = 'https://dsh.example'
 const lifetimes = new Set<AbortController>()
+const disposables: { dispose(): Promise<void> }[] = []
+const hosts: HTMLElement[] = []
+let sequence = 0
 
 function lifetime(): AbortController {
   const controller = new AbortController()
@@ -14,49 +22,159 @@ function lifetime(): AbortController {
   return controller
 }
 
-afterEach(() => {
+function harness() {
+  const id = `browser-controller-test-${String(++sequence)}`
+  const store = createBrowserStore().create(id)
+  let open = true
+  const face = createBrowserControllers(store.actions, createIframePage, () => open)
+  disposables.push(face)
+  const host = document.createElement('div')
+  host.id = id
+  hosts.push(host)
+  document.body.append(host)
+  const mount = (signal: AbortSignal): (() => void) => face.mount({
+    tabId: TAB, signal, viewportId: id, applicationOrigin: APP,
+    initial: store.getSnapshot().byTab[TAB], initialUrl: undefined, openTab: vi.fn(),
+  })
+  const iframe = (): HTMLIFrameElement => {
+    const element = host.querySelector('iframe')
+    if (element === null) throw new Error('expected a mounted iframe')
+    return element
+  }
+  return { store, face, mount, iframe, close: () => { open = false } }
+}
+
+afterEach(async () => {
+  await Promise.all(disposables.splice(0).map(value => value.dispose()))
   for (const controller of lifetimes) controller.abort()
   lifetimes.clear()
+  for (const host of hosts.splice(0)) host.remove()
   localStorage.clear()
   vi.restoreAllMocks()
 })
 
 describe('BrowserController', () => {
-  it('ignores navigation commands after its tab occurrence ends', () => {
+  it('restores only on request and redirects saved checkpoints to a replacement binding', () => {
+    const h = harness()
+    const saved = browserAddressCheckpoint({ kind: 'https', url: 'https://saved.example/', title: 'Saved page' }, 2)
+    h.store.actions.replace(TAB, saved)
+    const tabLifetime = lifetime()
+    h.mount(tabLifetime.signal)
+    const state = h.face.keyedHooks.browserState(TAB)!
+    expect(state.getSnapshot().restoreTarget?.title).toBe('Saved page')
+    expect(state.getSnapshot().frame.target).toBeUndefined()
+    const rebound = createBrowserStore().create('rebound-browser-controller')
+    h.face.rebind(rebound.actions)
+    h.mount(tabLifetime.signal)
+    expect(rebound.getSnapshot().byTab[TAB]).toEqual(saved)
+    h.face.restore(TAB)
+    expect(h.iframe().src).toBe('https://saved.example/')
+    h.face.restore(TAB)
+    h.face.loadUrl(TAB, 'https://next.example/')
+    expect(rebound.getSnapshot().byTab[TAB]?.entries.at(-1)?.url).toBe('https://next.example/')
+    expect(h.store.getSnapshot().byTab[TAB]).toEqual(saved)
+    tabLifetime.abort()
+    expect(rebound.getSnapshot().byTab[TAB]).toBeDefined()
+    h.face.restore(TAB)
+    h.face.setSandbox(TAB, false)
+    h.mount(tabLifetime.signal)()
+    expect(h.face.keyedHooks.browserState(TAB)).toBeUndefined()
+  })
+
+  it('refresh restores a saved page and ignores cancellation from a retired physical mount', () => {
+    const h = harness()
+    h.store.actions.replace(TAB, browserAddressCheckpoint({ kind: 'https', url: 'https://saved.example/', title: 'Saved' }, 1))
+    const tabLifetime = lifetime()
+    const oldMount = h.mount(tabLifetime.signal)
+    h.face.reload(TAB)
+    const secondHost = document.createElement('div')
+    secondHost.id = 'replacement-browser-host'
+    document.body.append(secondHost)
+    hosts.push(secondHost)
+    h.face.mount({ tabId: TAB, signal: tabLifetime.signal, viewportId: secondHost.id,
+      applicationOrigin: APP, initial: undefined, initialUrl: undefined, openTab: vi.fn() })
+    oldMount()
+    expect(secondHost.querySelector('iframe')?.src).toBe('https://saved.example/')
+    expect(() => h.face.mount({ tabId: TAB, signal: tabLifetime.signal, viewportId: 'missing-browser-host',
+      applicationOrigin: APP, initial: undefined, initialUrl: undefined, openTab: vi.fn() })).toThrow('not mounted')
+  })
+
+  it('validates provider open requests and ignores late provider callbacks after disposal', async () => {
+    const saved = browserAddressCheckpoint({ kind: 'https', url: 'https://saved.example/', title: 'Saved' }, 1)
+    const frames = createSnapshotStore<BrowserFrameState>(emptyBrowserFrame())
+    const callbacks: BrowserPageOptions[] = []
+    const pendingNotifications: (() => void)[] = []
+    const pageFactory: BrowserPageFactory = (options) => {
+      callbacks.push(options)
+      return {
+        frame: { getSnapshot: () => frames.getSnapshot(), subscribe: (listener) => {
+          pendingNotifications.push(listener)
+          return frames.subscribe(listener)
+        }, loadUrl: vi.fn(), goBack: vi.fn(), goForward: vi.fn(), reload: vi.fn(), dispose: async () => {} },
+        presentation: { mount: () => () => {}, dispose: () => {} },
+      }
+    }
+    const store = createBrowserStore().create('provider-callbacks')
+    const openTab = vi.fn()
+    const controller = new BrowserController({ tabId: TAB, signal: lifetime().signal, applicationOrigin: APP,
+      actions: store.actions, initial: saved, createPage: pageFactory, openTab })
+    disposables.push(controller)
+    const provider = callbacks[0]!
+    provider.openRequested('file:/secret')
+    expect(controller.getSnapshot().addressFailure).toBe('protocol')
+    provider.openRequested('https://new.example/path')
+    expect(openTab).toHaveBeenCalledExactlyOnceWith('https://new.example/path')
+    controller.setSandbox(false)
+    frames.set({ ...emptyBrowserFrame(), loading: true })
+    expect(controller.getSnapshot().restoreTarget?.title).toBe('Saved')
+    expect(controller.getSnapshot().addressFailure).toBe('protocol')
+    const before = controller.getSnapshot()
+    await controller.dispose()
+    controller.start('https://ignored.example/')
+    provider.persist(saved)
+    provider.openRequested('https://ignored.example/')
+    for (const notify of pendingNotifications) notify()
+    expect(controller.getSnapshot()).toBe(before)
+    expect(store.getSnapshot().byTab[TAB]).toBeUndefined()
+    expect(openTab).toHaveBeenCalledOnce()
+  })
+
+  it('ignores navigation commands after its tab occurrence ends', async () => {
     const store = createBrowserStore().create('browser-controller-ended-test')
     const tabLifetime = lifetime()
     const controller = new BrowserController({
       tabId: TAB, signal: tabLifetime.signal, applicationOrigin: APP, actions: store.actions,
+      initial: undefined, createPage: createIframePage, openTab: vi.fn(),
     })
+    disposables.push(controller)
     tabLifetime.abort()
+    await controller.dispose()
 
     controller.loadUrl('https://ignored.example/')
     controller.goBack()
     controller.goForward()
     controller.reload()
-    controller.frame.reportLoaded(1)
+    expect(controller.getSnapshot().frame.target).toBeUndefined()
     expect(store.getSnapshot().byTab[TAB]).toBeUndefined()
   })
 
   it('owns the four navigation commands and frame load state', () => {
-    const store = createBrowserStore().create('browser-controller-test')
-    const face = createBrowserControllers(store.actions)
+    const { store, face, mount, iframe, close } = harness()
     const tabLifetime = lifetime()
-    face.mount(TAB, tabLifetime.signal, APP)
-    const frame = face.keyedHooks.browserFrame(TAB)!
-    face.mount(TAB, tabLifetime.signal, APP)
-    expect(face.keyedHooks.browserFrame(TAB)).toBe(frame)
+    mount(tabLifetime.signal)
+    const state = face.keyedHooks.browserState(TAB)!
+    mount(tabLifetime.signal)
+    expect(face.keyedHooks.browserState(TAB)).toBe(state)
     face.goBack(TAB)
     face.goForward(TAB)
     face.reload(TAB)
 
     face.loadUrl(TAB, 'https://example.test/one')
-    const first = frame.getSnapshot().document!
+    const first = iframe()
     expect(first.src).toBe('https://example.test/one')
-    face.reportLoaded(TAB, first.revision - 1)
-    face.reportLoaded(TAB, first.revision)
+    first.dispatchEvent(new Event('load'))
     expect(store.getSnapshot().byTab[TAB]?.navigation.status).toBe('known')
-    face.reportLoaded(TAB, first.revision)
+    first.dispatchEvent(new Event('load'))
     expect(store.getSnapshot().byTab[TAB]?.navigation.status).toBe('unknown')
     face.goBack(TAB)
     face.goForward(TAB)
@@ -64,79 +182,86 @@ describe('BrowserController', () => {
 
     face.loadUrl(TAB, 'https://example.test/two')
     face.goBack(TAB)
-    expect(frame.getSnapshot().document?.target.url).toBe('https://example.test/one')
+    expect(state.getSnapshot().frame.target?.url).toBe('https://example.test/one')
     face.goForward(TAB)
-    expect(frame.getSnapshot().document?.target.url).toBe('https://example.test/two')
+    expect(state.getSnapshot().frame.target?.url).toBe('https://example.test/two')
     const beforeReload = store.getSnapshot().byTab[TAB]!.request!.revision
     face.reload(TAB)
     expect(store.getSnapshot().byTab[TAB]?.request?.revision).toBe(beforeReload + 1)
     face.loadUrl(TAB, 'https://example.test/two')
     expect(store.getSnapshot().byTab[TAB]?.request?.revision).toBe(beforeReload + 2)
 
+    close()
     tabLifetime.abort()
     expect(store.getSnapshot().byTab[TAB]).toBeUndefined()
-    face.reportLoaded(TAB, first.revision)
+    first.dispatchEvent(new Event('load'))
     face.loadUrl(TAB, 'https://ignored.example/')
     face.goBack(TAB)
     face.goForward(TAB)
     face.reload(TAB)
+    expect(store.getSnapshot().byTab[TAB]).toBeUndefined()
+    expect(face.keyedHooks.browserState(TAB)).toBeUndefined()
   })
 
   it('does not let an old occurrence delete a replacement controller', () => {
-    const store = createBrowserStore().create('browser-controller-replacement-test')
-    const face = createBrowserControllers(store.actions)
+    const { store, face, mount } = harness()
     const first = lifetime()
     const second = lifetime()
-    face.mount(TAB, first.signal, APP)
-    const original = face.keyedHooks.browserFrame(TAB)
-    face.mount(TAB, second.signal, APP)
-    const replacement = face.keyedHooks.browserFrame(TAB)
+    mount(first.signal)
+    const original = face.keyedHooks.browserState(TAB)
+    mount(second.signal)
+    const replacement = face.keyedHooks.browserState(TAB)
     expect(replacement).not.toBe(original)
     first.abort()
     expect(store.getSnapshot().byTab[TAB]).toBeUndefined()
     face.loadUrl(TAB, 'https://example.test/')
     expect(store.getSnapshot().byTab[TAB]).toBeDefined()
-    face.mount(TAB, second.signal, APP)
-    expect(face.keyedHooks.browserFrame(TAB)).toBe(replacement)
+    mount(second.signal)
+    expect(face.keyedHooks.browserState(TAB)).toBe(replacement)
   })
 
   it('loads loopback under sandbox and reloads it across sandbox changes', () => {
-    const store = createBrowserStore().create('browser-controller-loopback-test')
-    const face = createBrowserControllers(store.actions)
+    const { store, face, mount, iframe } = harness()
     const tabLifetime = lifetime()
-    face.mount(TAB, tabLifetime.signal, APP)
-    const frame = face.keyedHooks.browserFrame(TAB)!
+    mount(tabLifetime.signal)
+    const state = face.keyedHooks.browserState(TAB)!
 
     face.loadUrl(TAB, 'http://localhost:5173/app')
-    expect(frame.getSnapshot()).toMatchObject({
-      sandboxed: true,
-      document: { src: 'http://localhost:5173/app' },
+    expect(state.getSnapshot().frame).toMatchObject({
+      sandboxEnabled: true,
+      target: { url: 'http://localhost:5173/app' },
     })
     const beforeToggle = store.getSnapshot().byTab[TAB]!.request!.revision
 
-    face.toggleSandbox(TAB)
-    expect(frame.getSnapshot().sandboxed).toBe(false)
-    expect(frame.getSnapshot().document?.src).toBe('http://localhost:5173/app')
+    face.setSandbox(TAB, false)
+    expect(state.getSnapshot().frame.sandboxEnabled).toBe(false)
+    expect(iframe().src).toBe('http://localhost:5173/app')
     expect(store.getSnapshot().byTab[TAB]?.request?.revision).toBe(beforeToggle + 1)
 
-    face.toggleSandbox(TAB)
-    expect(frame.getSnapshot()).toMatchObject({
-      sandboxed: true,
-      document: { src: 'http://localhost:5173/app' },
+    face.setSandbox(TAB, true)
+    expect(state.getSnapshot().frame).toMatchObject({
+      sandboxEnabled: true,
+      target: { url: 'http://localhost:5173/app' },
     })
     expect(store.getSnapshot().byTab[TAB]?.request?.revision).toBe(beforeToggle + 2)
   })
 
   it('loads public HTTP without changing the sandbox policy', () => {
-    const store = createBrowserStore().create('browser-controller-http-test')
-    const face = createBrowserControllers(store.actions)
+    const { face, mount } = harness()
     const tabLifetime = lifetime()
-    face.mount(TAB, tabLifetime.signal, APP)
+    mount(tabLifetime.signal)
 
     face.loadUrl(TAB, 'http://example.test/path')
-    expect(face.keyedHooks.browserFrame(TAB)?.getSnapshot()).toMatchObject({
-      sandboxed: true,
-      document: { src: 'http://example.test/path' },
+    const state = face.keyedHooks.browserState(TAB)!
+    expect(state.getSnapshot().frame).toMatchObject({
+      sandboxEnabled: true,
+      target: { url: 'http://example.test/path' },
     })
+    const beforeFailure = state.getSnapshot().frame
+    face.loadUrl(TAB, 'javascript:alert(1)')
+    expect(state.getSnapshot().addressFailure).toBe('protocol')
+    expect(state.getSnapshot().frame).toBe(beforeFailure)
+    face.reload(TAB)
+    expect(state.getSnapshot().addressFailure).toBeUndefined()
   })
 })
diff --git a/packages/client/ui-sidebar-browser/tests/browser-frame.client.spec.ts b/packages/client/ui-sidebar-browser/tests/browser-frame.client.spec.ts
index 5660e586c0..8ef82c7665 100644
--- a/packages/client/ui-sidebar-browser/tests/browser-frame.client.spec.ts
+++ b/packages/client/ui-sidebar-browser/tests/browser-frame.client.spec.ts
@@ -1,41 +1,58 @@
-import { describe, expect, it, vi } from 'vitest'
-import { IframeImpl } from '../src/client/browser/BrowserFrame.ts'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { IframeImpl } from '../src/client/browser/IframeImpl.ts'
+import { IframePresentation } from '../src/client/view/IframePresentation.ts'
+
+const frames: IframeImpl[] = []
+
+afterEach(async () => {
+  await Promise.all(frames.splice(0).map(frame => frame.dispose()))
+})
 
 describe('IframeImpl', () => {
-  it('owns transient sandbox mode and prepared document state', () => {
-    const changed = vi.fn<(sandboxed: boolean) => void>()
-    const loaded = vi.fn<(revision: number) => void>()
-    const frame = new IframeImpl(changed, loaded)
+  it('owns transient sandbox mode and revision-scoped load state', async () => {
+    const persist = vi.fn()
+    const presentation = new IframePresentation({ loaded: vi.fn(), failed: vi.fn(), remounted: vi.fn() })
+    const frame = new IframeImpl({ initial: undefined, persist, openRequested: vi.fn() }, presentation)
+    frames.push(frame)
     const listener = vi.fn()
     const unsubscribe = frame.subscribe(listener)
+    try {
+      frame.handleLoaded(0)
+      expect(frame.getSnapshot().address).toBe('empty')
+      frame.sandbox.setEnabled(false)
+      frame.sandbox.setEnabled(false)
+      expect(frame.getSnapshot().sandboxEnabled).toBe(false)
+      expect(frame.getSnapshot().target).toBeUndefined()
 
-    frame.toggleSandbox()
-    expect(frame.getSnapshot().sandboxed).toBe(false)
-    expect(changed).toHaveBeenCalledWith(false)
+      const target = { kind: 'https' as const, url: 'https://example.test/', title: 'example.test' }
+      frame.handleLoadFailed(1)
+      expect(frame.getSnapshot().error).toBeUndefined()
+      frame.loadUrl(target)
+      frame.handleLoadFailed(0)
+      expect(frame.getSnapshot().error).toBeUndefined()
+      frame.handleLoadFailed(1)
+      frame.handleLoadFailed(1)
+      expect(frame.getSnapshot()).toMatchObject({ target, error: { code: undefined, description: undefined }, loading: false })
+      frame.handleLoaded(1)
+      expect(persist).toHaveBeenLastCalledWith(expect.objectContaining({ navigation: { status: 'known', revision: 1 } }))
+      frame.reload()
+      expect(frame.getSnapshot()).toMatchObject({ target, error: undefined, loading: true })
+      frame.handleLoadFailed(1)
+      expect(frame.getSnapshot().error).toBeUndefined()
+      expect(listener).toHaveBeenCalled()
 
-    const document = {
-      target: { kind: 'https' as const, url: 'https://example.test/', title: 'example.test' },
-      src: 'https://example.test/',
-      revision: 4,
+      await frame.dispose()
+      const stopped = frame.getSnapshot()
+      frame.handleLoadFailed(2)
+      frame.handleLoaded(2)
+      frame.reload()
+      frame.loadUrl(target)
+      frame.goBack()
+      frame.goForward()
+      frame.sandbox.setEnabled(true)
+      expect(frame.getSnapshot()).toBe(stopped)
+    } finally {
+      unsubscribe()
     }
-    frame.reportLoadFailed(4)
-    expect(frame.getSnapshot().loadFailed).toBe(false)
-    frame.setDocument(document)
-    frame.reportLoadFailed(3)
-    expect(frame.getSnapshot().loadFailed).toBe(false)
-    frame.reportLoadFailed(4)
-    frame.reportLoadFailed(4)
-    expect(frame.getSnapshot().loadFailed).toBe(true)
-    frame.reportLoaded(4)
-    expect(loaded).toHaveBeenCalledWith(4)
-    frame.setDocument({ ...document, revision: 5 })
-    expect(frame.getSnapshot().loadFailed).toBe(false)
-    frame.clearDocument()
-    expect(frame.getSnapshot().document).toBeUndefined()
-    frame.reportLoadFailed(5)
-    expect(frame.getSnapshot().loadFailed).toBe(false)
-    frame.clearDocument()
-    expect(listener).toHaveBeenCalled()
-    unsubscribe()
   })
 })
diff --git a/packages/client/ui-sidebar-browser/tests/browser-navigation.client.spec.ts b/packages/client/ui-sidebar-browser/tests/browser-navigation.client.spec.ts
index cce1f9a0a1..d6d2b36762 100644
--- a/packages/client/ui-sidebar-browser/tests/browser-navigation.client.spec.ts
+++ b/packages/client/ui-sidebar-browser/tests/browser-navigation.client.spec.ts
@@ -51,19 +51,14 @@ describe('BrowserNavigation', () => {
     expect(navigation.snapshot.navigation).toEqual({ status: 'loading', revision: reload.revision })
   })
 
-  it('leaves address failures outside navigation', () => {
+  it('ignores frame observations before a controlled request', () => {
     const navigation = new BrowserNavigation()
     navigation.frameLoaded(1)
+    expect(navigation.snapshot).toEqual(BrowserNavigation.empty())
     navigation.navigate(httpsTarget(1))
     const revision = navigation.snapshot.request!.revision
     expect(navigation.snapshot.failure).toBeUndefined()
     navigation.frameLoaded(revision)
     expect(navigation.snapshot.navigation).toEqual({ status: 'known', revision })
-
-    navigation.addressFailed('invalid')
-    expect(navigation.snapshot).toMatchObject({
-      navigation: { status: 'known', revision },
-      failure: { kind: 'address', reason: 'invalid' },
-    })
   })
 })
diff --git a/packages/client/ui-sidebar-browser/tests/electron-frame.client.spec.ts b/packages/client/ui-sidebar-browser/tests/electron-frame.client.spec.ts
new file mode 100644
index 0000000000..20480c615b
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/tests/electron-frame.client.spec.ts
@@ -0,0 +1,51 @@
+// @vitest-environment jsdom
+import { expect, it, vi } from 'vitest'
+import { ElectronWebViewImpl } from '../src/client/electron/ElectronWebViewImpl.ts'
+import { ElectronWebviewPresentation, type WebviewElement } from '../src/client/electron/ElectronWebviewPresentation.ts'
+import type { DesktopBrowserBridge, DesktopBrowserLeaseId } from '../src/types.ts'
+
+it('clears a failed load when the main page retries without a toolbar command', async () => {
+  let url = 'about:blank'
+  let loading = true
+  const element: WebviewElement = Object.assign(document.createElement('div'), {
+    loadURL: vi.fn(async () => {}), getURL: () => url, getTitle: () => 'Recovered',
+    canGoBack: () => false, canGoForward: () => false, clearHistory: vi.fn(),
+    goBack: vi.fn(), goForward: vi.fn(), reload: vi.fn(), isLoading: () => loading,
+  })
+  const bridge: DesktopBrowserBridge = {
+    acquire: vi.fn(async () => ({ lease: 'lease' as DesktopBrowserLeaseId, partition: 'partition' })),
+    release: vi.fn(async () => {}), onOpenRequested: () => () => {},
+  }
+  const presentation = new ElectronWebviewPresentation({ mounted: () =>{  frame.attach() }, unmounted: () =>{  frame.detach() } })
+  const frame = new ElectronWebViewImpl({ initial: undefined, persist: vi.fn(), openRequested: vi.fn() },
+    bridge, async () => 'cwd:/workspace', presentation)
+  const createElement = vi.spyOn(presentation, 'createElement').mockReturnValue(element)
+  const host = document.createElement('div')
+  host.id = 'electron-frame-retry'
+  document.body.append(host)
+  try {
+    presentation.mount(host.id)
+    frame.loadUrl({ kind: 'https', url: 'https://example.test/', title: 'Example' })
+    await vi.waitFor(() => { expect(host.firstElementChild).toBe(element) })
+    element.dispatchEvent(new Event('dom-ready'))
+    element.dispatchEvent(Object.assign(new Event('did-fail-load'), {
+      isMainFrame: true, errorCode: -105, errorDescription: 'ERR_NAME_NOT_RESOLVED',
+    }))
+    expect(frame.getSnapshot().error?.code).toBe(-105)
+    element.dispatchEvent(new Event('page-title-updated'))
+    element.dispatchEvent(Object.assign(new Event('did-start-navigation'), { isMainFrame: false }))
+    expect(frame.getSnapshot().error?.code).toBe(-105)
+
+    element.dispatchEvent(Object.assign(new Event('did-start-navigation'), { isMainFrame: true }))
+    expect(frame.getSnapshot()).toMatchObject({ error: undefined, loading: true })
+    url = 'https://example.test/recovered'
+    element.dispatchEvent(new Event('did-navigate'))
+    loading = false
+    element.dispatchEvent(new Event('did-stop-loading'))
+    expect(frame.getSnapshot()).toMatchObject({ error: undefined, loading: false, target: { url, title: 'Recovered' } })
+  } finally {
+    await frame.dispose()
+    createElement.mockRestore()
+    host.remove()
+  }
+})
diff --git a/packages/client/ui-sidebar-browser/tests/electron-harness.client.ts b/packages/client/ui-sidebar-browser/tests/electron-harness.client.ts
new file mode 100644
index 0000000000..bebfb96c53
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/tests/electron-harness.client.ts
@@ -0,0 +1,66 @@
+/** Native webview events controlled by each test; presentation and navigation stay real. */
+import { vi } from 'vitest'
+import type { DesktopBrowserBridge, DesktopBrowserLeaseId, DesktopBrowserReservation } from '../src/types.ts'
+import type { BrowserTabState } from '../src/client/browser/BrowserPersistence.ts'
+import { createElectronPage } from '../src/client/electron/pages.ts'
+import { ElectronWebviewPresentation } from '../src/client/electron/ElectronWebviewPresentation.ts'
+
+let sequence = 0
+
+/** @returns one isolated, explicitly mounted page with native operations replaced by spies. */
+export function electronFixture(initial?: BrowserTabState) {
+  const opens = new Set<(url: string) => void>()
+  const reservation: DesktopBrowserReservation = { lease: `lease-${++sequence}` as DesktopBrowserLeaseId, partition: 'partition' }
+  const bridge = {
+    acquire: vi.fn(async (_workspace: string) => reservation),
+    release: vi.fn(async (_lease: DesktopBrowserLeaseId) => {}),
+    onOpenRequested: vi.fn((_lease: DesktopBrowserLeaseId, listener: (url: string) => void) => {
+      opens.add(listener)
+      return () => { opens.delete(listener) }
+    }),
+  } satisfies DesktopBrowserBridge
+  const workspace = vi.fn(async (_signal: AbortSignal) => 'cwd:/workspace')
+  const persist = vi.fn()
+  const openRequested = vi.fn()
+  const page = createElectronPage({ initial, persist, openRequested }, bridge, workspace)
+  const presentation = page.presentation
+  if (!(presentation instanceof ElectronWebviewPresentation)) throw new Error('expected the Electron presentation')
+  const create = presentation.createElement.bind(presentation)
+  const guests: ReturnType<typeof prepareGuest>[] = []
+  function prepareGuest(approved: DesktopBrowserReservation) {
+    const element = create(approved)
+    const state = { url: 'about:blank', title: '', loading: true, back: false, forward: false }
+    const methods = {
+      loadURL: vi.fn(async (_url: string) => {}), getURL: vi.fn(() => state.url), getTitle: vi.fn(() => state.title),
+      canGoBack: () => state.back, canGoForward: () => state.forward, clearHistory: vi.fn(),
+      goBack: vi.fn(), goForward: vi.fn(), reload: vi.fn(), isLoading: () => state.loading,
+    }
+    Object.assign(element, methods)
+    const emit = (type: string, fields: object = {}): void => { element.dispatchEvent(Object.assign(new Event(type), fields)) }
+    return { element, state, emit, ...methods }
+  }
+  const createElement = vi.spyOn(presentation, 'createElement').mockImplementation((approved) => {
+    const guest = prepareGuest(approved)
+    guests.push(guest)
+    return guest.element
+  })
+  const host = document.createElement('div')
+  host.id = `electron-fixture-${sequence}`
+  document.body.append(host)
+  return {
+    ...page, presentation, bridge, workspace, persist, openRequested, opens, guests, host, reservation,
+    mount: () => presentation.mount(host.id),
+    async guest() {
+      await vi.waitFor(() => { expectGuest() })
+      return guests.at(-1)!
+    },
+    async dispose() {
+      await page.frame.dispose()
+      createElement.mockRestore()
+      host.remove()
+    },
+  }
+  function expectGuest(): void {
+    if (host.firstElementChild === null || guests.length === 0) throw new Error('guest has not attached')
+  }
+}
diff --git a/packages/client/ui-sidebar-browser/tests/electron-lifecycle.client.spec.ts b/packages/client/ui-sidebar-browser/tests/electron-lifecycle.client.spec.ts
new file mode 100644
index 0000000000..ef14e6de07
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/tests/electron-lifecycle.client.spec.ts
@@ -0,0 +1,179 @@
+// @vitest-environment jsdom
+import { afterEach, expect, it, vi } from 'vitest'
+import type { DesktopBrowserReservation } from '../src/types.ts'
+import { electronFixture } from './electron-harness.client.ts'
+
+const target = { kind: 'https' as const, url: 'https://example.test/', title: 'Example' }
+const fixtures: ReturnType<typeof electronFixture>[] = []
+function fixture() {
+  const h = electronFixture()
+  fixtures.push(h)
+  return h
+}
+afterEach(async () => {
+  for (const h of fixtures.splice(0)) await h.dispose()
+  vi.restoreAllMocks()
+})
+
+it('waits for a mounted container and observes native history, titles and new-tab requests', async () => {
+  const h = fixture()
+  h.frame.goBack()
+  h.frame.goForward()
+  h.frame.reload()
+  h.frame.loadUrl(target)
+  expect(h.bridge.acquire).not.toHaveBeenCalled()
+  h.mount()
+  const guest = await h.guest()
+  expect(guest.element.getAttribute('partition')).toBe(h.reservation.partition)
+  expect(guest.element.getAttribute('src')).toBe(`about:blank#${h.reservation.lease}`)
+  guest.emit('dom-ready')
+  expect(guest.loadURL).toHaveBeenCalledWith(target.url)
+  guest.state.url = target.url
+  guest.state.title = 'Title'
+  guest.state.back = true
+  guest.state.forward = true
+  guest.emit('did-navigate')
+  expect(guest.clearHistory).toHaveBeenCalledOnce()
+  expect(h.frame.getSnapshot()).toMatchObject({ address: 'observed', target: { ...target, title: 'Title' } })
+  expect(guest.element.getAttribute('aria-label')).toBe('Title')
+  const writes = h.persist.mock.calls.length
+  guest.emit('page-title-updated')
+  expect(h.persist).toHaveBeenCalledTimes(writes)
+  h.frame.loadUrl(target)
+  h.frame.goBack()
+  h.frame.goForward()
+  expect(guest.reload).toHaveBeenCalledOnce()
+  expect(guest.goBack).toHaveBeenCalledOnce()
+  expect(guest.goForward).toHaveBeenCalledOnce()
+  guest.state.url = `${target.url}next`
+  guest.emit('did-navigate-in-page', { isMainFrame: false })
+  expect(h.frame.getSnapshot().target?.url).toBe(target.url)
+  guest.emit('did-navigate-in-page', { isMainFrame: true })
+  guest.state.title = ''
+  guest.state.loading = false
+  guest.emit('page-title-updated')
+  guest.emit('did-stop-loading')
+  expect(h.frame.getSnapshot()).toMatchObject({ loading: false, target: { url: guest.state.url, title: 'example.test' } })
+  const open = h.bridge.onOpenRequested.mock.calls[0]![1]
+  open('https://new.example/')
+  expect(h.openRequested).toHaveBeenCalledOnce()
+  await h.frame.dispose()
+  open('https://late.example/')
+  guest.emit('did-navigate')
+  h.frame.loadUrl(target)
+  h.frame.reload()
+  h.frame.goBack()
+  expect(h.openRequested).toHaveBeenCalledOnce()
+  expect(h.opens.size).toBe(0)
+  expect(h.bridge.release).toHaveBeenCalledExactlyOnceWith(h.reservation.lease)
+})
+
+it('releases an acquisition that finishes after attachment cancellation', async () => {
+  const h = fixture()
+  const pending = Promise.withResolvers<DesktopBrowserReservation>()
+  h.bridge.acquire.mockReturnValueOnce(pending.promise)
+  const unmount = h.mount()
+  h.frame.loadUrl(target)
+  try {
+    await vi.waitFor(() => { expect(h.bridge.acquire).toHaveBeenCalledOnce() })
+    unmount()
+    const disposed = h.frame.dispose()
+    expect(h.frame.dispose()).toBe(disposed)
+    pending.resolve(h.reservation)
+    await disposed
+    expect(h.guests).toHaveLength(0)
+    expect(h.bridge.release).toHaveBeenCalledExactlyOnceWith(h.reservation.lease)
+  } finally {
+    pending.resolve(h.reservation)
+  }
+})
+
+it('does not acquire a guest when Workspace resolution finishes after disposal', async () => {
+  const h = fixture()
+  const pending = Promise.withResolvers<string>()
+  h.workspace.mockReturnValueOnce(pending.promise)
+  h.mount()
+  h.frame.loadUrl(target)
+  try {
+    const disposed = h.frame.dispose()
+    pending.resolve('cwd:/late')
+    await disposed
+    expect(h.bridge.acquire).not.toHaveBeenCalled()
+    h.mount()
+    expect(h.guests).toHaveLength(0)
+  } finally {
+    pending.resolve('cwd:/late')
+  }
+})
+
+it('recreates the guest after physical remount or crash without resolving Workspace again', async () => {
+  const h = fixture()
+  const unmount = h.mount()
+  h.frame.loadUrl(target)
+  const first = await h.guest()
+  first.emit('dom-ready')
+  unmount()
+  h.mount()
+  const second = await h.guest()
+  expect(second.element).not.toBe(first.element)
+  expect(h.workspace).toHaveBeenCalledOnce()
+  second.emit('dom-ready')
+  expect(second.loadURL).toHaveBeenCalledWith(target.url)
+  second.emit('render-process-gone')
+  expect(h.frame.getSnapshot().error).toBeDefined()
+  h.frame.reload()
+  const third = await h.guest()
+  third.emit('dom-ready')
+  expect(third.loadURL).toHaveBeenCalledWith(target.url)
+  expect(h.frame.getSnapshot().error).toBeUndefined()
+  third.emit('destroyed')
+  expect(h.frame.getSnapshot().error).toBeDefined()
+})
+
+it('contains acquisition, native command and release failures and keeps retry available', async () => {
+  const h = fixture()
+  const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+  h.bridge.acquire.mockRejectedValueOnce(new Error('acquire failed'))
+  h.mount()
+  h.frame.loadUrl(target)
+  await vi.waitFor(() => { expect(h.frame.getSnapshot().error).toBeDefined() })
+  h.frame.reload()
+  const guest = await h.guest()
+  guest.emit('dom-ready')
+  guest.state.url = target.url
+  guest.emit('did-navigate')
+  guest.reload.mockImplementationOnce(() => { throw new Error('command failed') })
+  h.frame.reload()
+  expect(h.frame.getSnapshot().error).toBeDefined()
+  h.frame.reload()
+  expect(h.frame.getSnapshot().error).toBeUndefined()
+  guest.getURL.mockImplementationOnce(() => { throw new Error('observation failed') })
+  guest.emit('did-navigate')
+  expect(h.frame.getSnapshot().error).toBeDefined()
+  h.bridge.release.mockRejectedValueOnce(new Error('release failed'))
+  await h.frame.dispose()
+  expect(error.mock.calls.some(call => call[0] === 'Desktop browser guest release failed')).toBe(true)
+})
+
+it('ignores superseded and aborted load promises, but publishes an active navigation rejection', async () => {
+  const h = fixture()
+  const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+  h.mount()
+  h.frame.loadUrl(target)
+  const guest = await h.guest()
+  const stale = Promise.withResolvers<undefined>()
+  guest.loadURL.mockReturnValueOnce(stale.promise)
+  guest.emit('dom-ready')
+  h.frame.loadUrl({ ...target, url: 'https://example.test/new' })
+  stale.reject(new Error('old navigation failed'))
+  await expect(stale.promise).rejects.toThrow('old navigation')
+  expect(h.frame.getSnapshot().error).toBeUndefined()
+  guest.loadURL.mockRejectedValueOnce(Object.assign(new Error('aborted'), { code: 'ERR_ABORTED' }))
+  h.frame.loadUrl({ ...target, url: 'https://example.test/cancelled' })
+  await Promise.resolve()
+  expect(h.frame.getSnapshot().error).toBeUndefined()
+  guest.loadURL.mockRejectedValueOnce(new Error('active navigation failed'))
+  h.frame.loadUrl(target)
+  await vi.waitFor(() => { expect(h.frame.getSnapshot().error).toBeDefined() })
+  expect(error).toHaveBeenCalledOnce()
+})
diff --git a/packages/client/ui-sidebar-browser/tests/workspace.client.spec.ts b/packages/client/ui-sidebar-browser/tests/workspace.client.spec.ts
new file mode 100644
index 0000000000..236e306ea9
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/tests/workspace.client.spec.ts
@@ -0,0 +1,57 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
+import type { WorkspaceId, WorkspaceSnapshot, WorkspaceView } from '@deepseek-ai/dsh-api-workspace-controller/client'
+import type { SessionId } from '@deepseek-ai/dsh-session/types'
+import { browserWorkspace } from '../src/client/electron/workspace.ts'
+
+const SESSION = 'session' as SessionId
+const workspace = (id: string, path: string, sessionIds: readonly SessionId[]): WorkspaceView => ({
+  workspaceId: id as WorkspaceId, path, title: path, sessionIds, createdAt: '', updatedAt: '',
+})
+const snapshot = (phase: WorkspaceSnapshot['phase'], items: readonly WorkspaceView[] = []): WorkspaceSnapshot => ({
+  phase, items, state: 'idle', error: null, archivedSessionIds: [], pinnedSessionIds: [],
+})
+
+afterEach(() => { vi.restoreAllMocks() })
+
+it('groups resolved Sessions by canonical CWD rather than Workspace identity', async () => {
+  const source = createSnapshotStore(snapshot('ready', [
+    workspace('other', '/other', ['other' as SessionId]), workspace('first', '/canonical', [SESSION]),
+  ]))
+  const signal = new AbortController().signal
+  await expect(browserWorkspace(source, SESSION, signal)).resolves.toBe('cwd:/canonical')
+  source.set(snapshot('ready', [workspace('renamed', '/canonical', [SESSION])]))
+  await expect(browserWorkspace(source, SESSION, signal)).resolves.toBe('cwd:/canonical')
+  await expect(browserWorkspace(source, 'unaccounted', signal)).resolves.toBe('session:unaccounted')
+})
+
+it('waits for an authoritative baseline and removes the readiness subscription', async () => {
+  const source = createSnapshotStore(snapshot('pending'))
+  const subscribe = source.subscribe.bind(source)
+  const stopped = vi.fn()
+  vi.spyOn(source, 'subscribe').mockImplementation((listener) => {
+    const stop = subscribe(listener)
+    return () => { stop(); stopped() }
+  })
+  const lifetime = new AbortController()
+  const result = browserWorkspace(source, SESSION, lifetime.signal)
+  source.set(snapshot('pending', [workspace('partial', '/partial', [SESSION])]))
+  expect(stopped).not.toHaveBeenCalled()
+  source.set(snapshot('ready', [workspace('ready', '/ready', [SESSION])]))
+  await expect(result).resolves.toBe('cwd:/ready')
+  expect(stopped).toHaveBeenCalledOnce()
+  lifetime.abort()
+  expect(stopped).toHaveBeenCalledOnce()
+})
+
+it('rejects cancellation before and during readiness without retaining a listener', async () => {
+  const source = createSnapshotStore(snapshot('pending'))
+  const lifetime = new AbortController()
+  const failure = new Error('tab closed')
+  const result = browserWorkspace(source, SESSION, lifetime.signal)
+  const rejected = expect(result).rejects.toBe(failure)
+  lifetime.abort(failure)
+  await rejected
+  source.set(snapshot('ready'))
+  await expect(browserWorkspace(source, SESSION, lifetime.signal)).rejects.toBe(failure)
+})
diff --git a/packages/client/ui-sidebar-browser/tsconfig.client.json b/packages/client/ui-sidebar-browser/tsconfig.client.json
new file mode 100644
index 0000000000..82b0c48f2c
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/tsconfig.client.json
@@ -0,0 +1,26 @@
+{
+  "extends": "../../../tsconfig.base.client.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "lib/types",
+    "tsBuildInfoFile": "lib/tsconfig.client.tsbuildinfo"
+  },
+  "include": [
+    "src/client",
+    "src/types.ts",
+    "src/css-modules.d.ts"
+  ],
+  "references": [
+    { "path": "../../../vendor/cordis" },
+    { "path": "../../api/workspace-controller/tsconfig.client.json" },
+    { "path": "../../util/brand" },
+    { "path": "../locale" },
+    { "path": "../store" },
+    { "path": "../ui-dockkit" },
+    { "path": "../ui-primitives" },
+    { "path": "../ui-renderer" },
+    { "path": "../ui-session" },
+    { "path": "../ui-sidebar-right" },
+    { "path": "../ui-slots" }
+  ]
+}
diff --git a/packages/client/ui-sidebar-browser/tsconfig.host.json b/packages/client/ui-sidebar-browser/tsconfig.host.json
new file mode 100644
index 0000000000..20cb732d2f
--- /dev/null
+++ b/packages/client/ui-sidebar-browser/tsconfig.host.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "lib/types",
+    "tsBuildInfoFile": "lib/tsconfig.host.tsbuildinfo"
+  },
+  "files": [
+    "src/index.ts",
+    "src/types.ts"
+  ],
+  "references": [
+    { "path": "../../../vendor/cordis" },
+    { "path": "../../util/brand" }
+  ]
+}
diff --git a/packages/client/ui-sidebar-browser/tsconfig.json b/packages/client/ui-sidebar-browser/tsconfig.json
index d9c72fa907..2a0b0e33f7 100644
--- a/packages/client/ui-sidebar-browser/tsconfig.json
+++ b/packages/client/ui-sidebar-browser/tsconfig.json
@@ -1,21 +1,7 @@
 {
-  "extends": "../../../tsconfig.base.client.json",
-  "compilerOptions": {
-    "rootDir": "src",
-    "outDir": "lib/types"
-  },
-  "include": [
-    "src"
-  ],
+  "files": [],
   "references": [
-    { "path": "../../../vendor/cordis" },
-    { "path": "../locale" },
-    { "path": "../store" },
-    { "path": "../ui-dockkit" },
-    { "path": "../ui-primitives" },
-    { "path": "../ui-renderer" },
-    { "path": "../ui-session" },
-    { "path": "../ui-sidebar-right" },
-    { "path": "../ui-slots" }
+    { "path": "./tsconfig.host.json" },
+    { "path": "./tsconfig.client.json" }
   ]
 }
diff --git a/packages/client/ui-sidebar-right/README.i18n.yaml b/packages/client/ui-sidebar-right/README.i18n.yaml
index 16d1bd6f79..e5fef88086 100644
--- a/packages/client/ui-sidebar-right/README.i18n.yaml
+++ b/packages/client/ui-sidebar-right/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-sidebar-right/README.md
-README.md: 9318723b99adb003b25cf69bf07a8419eea6d1ae
-README.zh.md: dcd6dcd59ac19c18c0a7d2e9a72e7a92a6d3bec4
+README.md: 14014cb0986222a73e962e390c2675dd7354df1c
+README.zh.md: 7686d7afa8b164bf780b4ce6f927d8829e7b3a96
diff --git a/packages/client/ui-sidebar-right/README.md b/packages/client/ui-sidebar-right/README.md
index 9318723b99..14014cb098 100644
--- a/packages/client/ui-sidebar-right/README.md
+++ b/packages/client/ui-sidebar-right/README.md
@@ -56,7 +56,7 @@ While the panel is hidden, one button in the conversation header's corner seat (
 
 The panel takes the conversation's ground colour and content font sizes rather than a raised layer of its own: it is a column of the page, not a card over it.
 
-The `rightbar` entry is a root-scoped controller. It reads `usePanelInfo` and mounts the Session-scoped `rightbar.session` subtree only while the Conversation is selected. Switching to a global panel hides the right Sidebar and releases its frame track without deleting the Session's tab state.
+The root-scoped `rightbar` entry renders the selected Session and background Sessions with initialized `keepMounted` bodies through separate `rightbar.session` subtrees. Each View owns its Session reference. Only the foreground Conversation reports a frame track and binds public navigation; other subtrees stay hidden without deleting tab state.
 
 <a id="state"></a>
 ## State
@@ -67,9 +67,9 @@ Carrying the mint counter in the surface is what makes a recorded sequence repla
 
 After every action the kit's settle planner keeps the expanded surface populated: a docked pane whose last tab was moved out or floated is merged away, and an emptied root pane receives the default page. A collapsed surface holds no such backfill — a session starts collapsed and empty, and a close that collapses the column leaves it empty — the expansion that would first show an empty layout is what seeds the default page. Explicit closing follows [the default-page and close rules](#the-guide). While expanded there is always at least one tab, and never an empty pane — so there is no separate "close pane" gesture.
 
-The docked surface's last tab carries one more rule, decided in the store's `closeTab` and mirrored to the kit through `canCloseTab`: the guide standing as the only docked tab draws no close control and no menu close item — its chip sits quiet, and with no extension item contributed a secondary press opens no menu — and a programmatic close of it records nothing; any other tab standing alone closes together with the column in one entry — the layout stays empty until the next expansion seeds its current default page. Floating panels take no part in the rule: they render whether or not the column is expanded, and their tabs close freely.
+The docked surface's last tab carries one more rule, decided in the store's `closeTab` and mirrored to the kit through `canCloseTab`: the guide standing as the only docked tab draws no close control and no menu close item — its chip sits quiet, and with no extension item contributed a secondary press opens no menu — and a programmatic close of it records nothing; any other tab standing alone closes together with the column in one entry — the layout stays empty until the next expansion seeds its current default page. Floating panels take no part in the rule: the foreground Session's floats render whether or not the column is expanded, and their tabs close freely.
 
-The store saves each Session's layout, tab identities, selection, split ratios, floating rectangles, presentation and identity counter as JSON under `dsh.sidebar-right.v1.<sessionId>` in localStorage. Reload restores that layout before tab bodies render; switching Sessions keeps their layouts independent. Providers restore their own content from the retained tab identity and resource address, including [terminal reconnection](../ui-sidebar-terminal/README.md#use-this-package). Navigation parameters, resource contents and live connections are not layout state. Undo history stays in memory and resets on reload. Saved field types, node membership, selection and identity counters are validated before adoption or startup discovery; invalid data clears only its Session key. Storage failures leave the current layout usable in memory. Windows at the same origin share the last saved layout per Session; each active window keeps its own current layout until reload.
+The store saves each Session's layout, tab identities, selection, split ratios, floating rectangles, presentation and identity counter as JSON under `dsh.sidebar-right.v1.<sessionId>` in localStorage. Reload restores that layout before tab bodies render; switching Sessions keeps their layouts independent. Providers restore their own content from the retained tab identity and resource address, including [terminal reconnection](../ui-sidebar-terminal/README.md#use-this-package). Navigation parameters, resource contents and live connections are not layout state. Undo history stays in memory and resets on reload. Saved field types, node membership, selection, identity counters and the one-pane or two-horizontal-pane dock layout are validated before adoption or startup discovery; invalid data clears only its Session key. Storage failures leave the current layout usable in memory. Windows at the same origin share the last saved layout per Session; each active window keeps its own current layout until reload.
 
 `sidebarRight.openTabs` publishes stable metadata for every open tab across saved and adopted Sessions. Startup discovery reads the layout keys without mounting dormant content, pinning files or activating Agents. Adopted stores replace their own metadata on membership commits, and permanently cleared scopes remove it. Other windows' storage writes do not overwrite this window's live membership. Providers use this inventory to restore their own resource lifetimes.
 
@@ -78,7 +78,7 @@ The store saves each Session's layout, tab identities, selection, split ratios,
 
 A tab type registers in two stages, and the shipped guide type goes through exactly the same public path a type from another package does (`ui-sidebar-documentpreview` is the live proof). Both stages sit inside the type's own `ctx.effect`, so the registration lives exactly as long as the plugin that made it.
 
-1. **The type** — `ctx.sidebarRightTabs.register({ id, kind, patterns?, priority?, canOpen?, title, guide? })`, a static declaration with no runtime hook, returning a disposer. `id` is this implementation's identity in the tab system, unique across every registration (a package name is the natural value; the shipped guide is `@deepseek-ai/dsh-client-ui-sidebar-right/guide`): a kind is not unique once an extension may take a builtin's over, so the implementation names itself, and a second registration of an `id` throws. A resource type names `patterns`, globs over `dsh-resource://` addresses: one containing `:` matches the whole address (`dsh-resource://file/**`); one without matches the URI's path at any depth, ignoring case (`*.md`), and an address that is not a URI matches no such pattern. A page type — the guide, a file tree — names none and is opened by kind. `canOpen(address)` vetoes a match. `title(address)` is the tab chip's text, captured when the tab opens. `guide` lists entry boxes for the guide page; picking one opens the contributing type as a page. A `kind` carries at most one `builtin` and one `extension` registration (the extension is in force; the builtin resumes when it leaves); any other collision on a kind throws. The `id` is also the key the type's body and title register under, so an extension and the builtin it takes over hold distinct cells and the seat renders the one in force.
+1. **The type** — `ctx.sidebarRightTabs.register({ id, kind, patterns?, priority?, canOpen?, title, guide?, keepMounted? })`, a static declaration with no runtime hook, returning a disposer. `id` is this implementation's identity in the tab system, unique across every registration (a package name is the natural value; the shipped guide is `@deepseek-ai/dsh-client-ui-sidebar-right/guide`): a kind is not unique once an extension may take a builtin's over, so the implementation names itself, and a second registration of an `id` throws. A resource type names `patterns`, globs over `dsh-resource://` addresses: one containing `:` matches the whole address (`dsh-resource://file/**`); one without matches the URI's path at any depth, ignoring case (`*.md`), and an address that is not a URI matches no such pattern. A page type — the guide, a file tree — names none and is opened by kind. `canOpen(address)` vetoes a match. `title(address)` is the tab chip's text, captured when the tab opens. `guide` lists entry boxes for the guide page; picking one opens the contributing type as a page. A `kind` carries at most one `builtin` and one `extension` registration (the extension is in force; the builtin resumes when it leaves); any other collision on a kind throws. The `id` is also the key the type's body and title register under, so an extension and the builtin it takes over hold distinct cells and the seat renders the one in force.
 2. **The body** — `ctx.slots.register({ name: 'sidebar.right.pane.tab', key: definition.id }, Body)` reads `{ sidebar, panel, tab }` through the framework-injected `useTabInfo()`. `sidebar` supplies expansion and fullscreen information; `panel.id` identifies its pane; `tab` contains the record fields, `visible`, `navigation`, `signal`, and `actions`. These are not parallel owner props; the type's own store still uses `useStore`/`actions`. Optional title registrations and guide replacements share this hook; an absent title registration uses the text captured at open time.
 
 Which type opens a resource follows the editor-resolver convention: the types whose `patterns` match are ranked by `priority` band — `extension` (a type from outside the product, the highest, and the default when none is named), `builtin`, `fallback` (plain viewers anything more specific should beat) — then by the length of the matched pattern, then by registration order; `canOpen` removes a candidate. The bands are string literals so a type in another package needs no runtime import from here. `candidates(address)` returns the ranking, `claim(address, kind?)` the decision; naming a `kind` skips its globs but keeps its `canOpen`.
@@ -97,7 +97,9 @@ Two more seats extend what is already there: `sidebar.right.tab.guide` (chain) r
 <a id="the-tab-domain"></a>
 ## The Tab domain
 
-The Tab domain retains navigation, an abort signal, and bound actions per (Session, tab id). A private assembly callback adopts each Session's store, reconciles restored records immediately, and follows its commits. Reconstructing a Session store replaces its adoption, releasing the old subscription and cleanup reference. Only record removal or plugin unload aborts the signal; closing the sidebar and switching Sessions retain records, while undo restores a new occurrence. `useTabInfo()` composes framework-bound store and navigation hooks without manual component subscriptions or render-time record creation. `tab.actions` always target their own Session; `tab.visible` distinguishes bodies from titles, and floating tabs remain visible when the sidebar closes. `adopt` is absent from the public controller.
+The Tab domain retains navigation, an abort signal, and bound actions per (Session, tab id). A private assembly callback adopts each Session's store, reconciles restored records immediately, and follows its commits. Reconstructing a Session store replaces its adoption, releasing the old subscription and cleanup reference. Only record removal or plugin unload aborts the signal; closing the sidebar and switching Sessions retain records, while undo restores a new occurrence. `useTabInfo()` composes framework-bound store and navigation hooks without manual component subscriptions or render-time record creation. `tab.actions` always target their own Session; `tab.visible` distinguishes bodies from titles and excludes background Sessions; foreground floating tabs remain visible when the sidebar closes. `adopt` is absent from the public controller.
+
+A type's `keepMounted: true` retains visited bodies across tab and Session changes, collapse, and docking. Each View supplies its stable hold callback through owner props, so rebuilding Session injection bindings does not release a body. Unvisited bodies are not mounted eagerly.
 
 Tab owners register `registerCloseHandler(kind, handler)` through an effect. A handler synchronously retains any background cleanup before allowing explicit close or replacement. The resource owner tracks completion and retry; the sidebar does not wait. A thrown handler preserves the tab. Collapse, presentation changes and plugin disposal do not invoke close handlers; the tab abort signal identifies occurrence disposal, not an explicit close.
 
@@ -132,7 +134,8 @@ None; this package neither assembles nor sends a provider request.
 
 - **Browser-local layout.** Layout does not synchronize between devices; provider-specific state requires its provider's recovery support.
 - **No surface without a session.** State is keyed by session id, so the hero screen shows nothing on the right.
-- **Hard-coded stacking.** The panel and the float host use fixed z-index values because the client has no z-index token layer yet.
+- **Hard-coded stacking.** The content tree uses a fixed stacking layer; floats reorder within it without raising that layer above menus.
+- **Retained Session deletion.** Catalog absence alone does not retire an initialized retained View; its tab lifetimes and plugin teardown own release.
 - **Undo is not exposed.** The recorded sequence is stepped only through the `@internal` service methods; product controls are deliberately absent.
 - **Titles are fixed at open time.** A type's `title(address)` is captured into the record; a live title comes only from the optional title seat.
 - **No content navigation stack.** Stepping back replays layout operations; an editor-style back/forward over visited content is not built.
diff --git a/packages/client/ui-sidebar-right/README.zh.md b/packages/client/ui-sidebar-right/README.zh.md
index dcd6dcd59a..7686d7afa8 100644
--- a/packages/client/ui-sidebar-right/README.zh.md
+++ b/packages/client/ui-sidebar-right/README.zh.md
@@ -56,7 +56,7 @@ kind: "package-reference"
 
 面板取会话区的底色与正文字号，而不是自成一层浮起的表面：它是页面的一列，不是压在页面上的卡片。
 
-`rightbar` 入口是 root 作用域的控制器。它读取 `usePanelInfo`，仅在选中会话界面时挂载 session 作用域的 `rightbar.session` 子树。切换到全局面板会隐藏右侧 Sidebar 并释放框架列宽，但不删除会话的 tab 状态。
+root 作用域的 `rightbar` 入口通过独立的 `rightbar.session` 子树渲染选中的 Session，以及拥有已初始化 `keepMounted` 正文的后台 Session。每个 View 拥有自身的 Session reference。只有前台 Conversation 上报框架列宽并绑定公共导航；其他子树保持隐藏，不删除 tab 状态。
 
 <a id="state"></a>
 ## 状态
@@ -67,9 +67,9 @@ kind: "package-reference"
 
 每个动作之后，套件的 settle planner 保证展开的停靠面有内容：最后一个 tab 被搬走或浮出的停靠格会被并掉；根格被清空时填入默认页。折叠的停靠面没有这种回填——会话以折叠且为空的停靠面开始，收起整列的关闭也让它保持为空——首次会展示空布局的那次展开才播种默认页。显式关闭遵循[默认页与关闭规则](#the-guide)。展开期间永远至少有一个 tab，永远没有空格——因此没有单独的「关闭格」手势。
 
-停靠面的最后一个 tab 还多带一条规则，由 store 的 `closeTab` 决定并经 `canCloseTab` 镜像给套件：作为唯一停靠 tab 的引导页不画关闭控件也不画菜单里的关闭项——它的 chip 呈安静样式，在没有扩展条目时次键按下也不弹出菜单——对它的编程式关闭什么都不记录；任何其它 tab 独自留下时，点击关闭会连同整列一起收起，记为一条历史，布局保持为空，直到下次展开时创建当时的默认页。浮动面板不参与这条规则：它们无论列是否展开都会渲染，其 tab 照常关闭。
+停靠面的最后一个 tab 还多带一条规则，由 store 的 `closeTab` 决定并经 `canCloseTab` 镜像给套件：作为唯一停靠 tab 的引导页不画关闭控件也不画菜单里的关闭项——它的 chip 呈安静样式，在没有扩展条目时次键按下也不弹出菜单——对它的编程式关闭什么都不记录；任何其它 tab 独自留下时，点击关闭会连同整列一起收起，记为一条历史，布局保持为空，直到下次展开时创建当时的默认页。浮动面板不参与这条规则：前台 Session 的浮窗无论列是否展开都会渲染，其 tab 照常关闭。
 
-store 将每个 Session 的布局、标签身份、选中项、分栏比例、浮窗矩形、呈现方式和身份计数以 JSON 保存到 localStorage 的 `dsh.sidebar-right.v1.<sessionId>`。刷新时在渲染标签正文前恢复布局；不同 Session 的布局独立。provider 根据保留的标签身份和资源地址恢复自身内容，包括[终端重连](../ui-sidebar-terminal/README.zh.md#use-this-package)。导航参数、资源内容和活动连接不属于布局状态。撤销历史只保留在内存中，刷新后清空。采用布局或启动探测前会校验保存字段类型、节点成员关系、选中项和身份计数；无效数据只清除对应 Session 的 key。存储失败时，当前布局仍可在内存中使用。同源窗口共享每个 Session 最后保存的布局；活动窗口在刷新前保留各自的当前布局。
+store 将每个 Session 的布局、标签身份、选中项、分栏比例、浮窗矩形、呈现方式和身份计数以 JSON 保存到 localStorage 的 `dsh.sidebar-right.v1.<sessionId>`。刷新时在渲染标签正文前恢复布局；不同 Session 的布局独立。provider 根据保留的标签身份和资源地址恢复自身内容，包括[终端重连](../ui-sidebar-terminal/README.zh.md#use-this-package)。导航参数、资源内容和活动连接不属于布局状态。撤销历史只保留在内存中，刷新后清空。采用布局或启动探测前会校验保存字段类型、节点成员关系、选中项、身份计数，以及单格或左右两格的停靠布局；无效数据只清除对应 Session 的 key。存储失败时，当前布局仍可在内存中使用。同源窗口共享每个 Session 最后保存的布局；活动窗口在刷新前保留各自的当前布局。
 
 `sidebarRight.openTabs` 发布所有已保存和已采用 Session 的打开标签元数据，并保持快照引用稳定。启动时读取布局 key，不挂载非当前内容、pin 文件或激活 Agent。已采用的 store 在标签成员变化时更新自己的元数据，永久清除的 scope 删除对应记录。其他窗口写入 storage 不会覆盖当前窗口的活动成员关系。provider 使用该清单恢复自己的资源生命周期。
 
@@ -78,7 +78,7 @@ store 将每个 Session 的布局、标签身份、选中项、分栏比例、
 
 tab 类型分两阶段注册，随包发布的引导类型走的正是别的包的类型走的同一条公开路径（`ui-sidebar-documentpreview` 是活的证明）。两个阶段都在类型自己的 `ctx.effect` 里，因此注册与创建它的插件同生共死。
 
-1. **类型**——`ctx.sidebarRightTabs.register({ id, kind, patterns?, priority?, canOpen?, title, guide? })`，一份没有运行时钩子的静态声明，返回 disposer。`id` 是这个实现在 tab 系统里的身份，在全部注册中唯一（包名是天然取值；随包引导页是 `@deepseek-ai/dsh-client-ui-sidebar-right/guide`）：一旦 extension 可以接管 builtin 的 kind，kind 就不再唯一，所以实现要自己命名，同一 `id` 的第二次注册会 throw。资源类型给出 `patterns`，即作用于 `dsh-resource://` 地址的 glob：含 `:` 的匹配整个地址（`dsh-resource://file/**`）；不含的匹配 URI 路径的任意深度且忽略大小写（`*.md`），不是 URI 的地址不匹配任何这类模式。页类型——引导页、文件树——不给出模式，按 kind 打开。`canOpen(address)` 否决一次命中。`title(address)` 是 tab chip 的文字，在 tab 打开时捕获。`guide` 列出引导页的入口框；选中一个即把贡献它的类型作为页打开。一个 `kind` 最多承载一份 `builtin` 与一份 `extension` 注册（extension 生效；它离开后 builtin 恢复）；kind 上的其它任何撞名都 throw。`id` 同时也是该类型正文与标题注册时用的 key，因此 extension 与它接管的 builtin 各占一个格位，席位渲染生效的那个。
+1. **类型**——`ctx.sidebarRightTabs.register({ id, kind, patterns?, priority?, canOpen?, title, guide?, keepMounted? })`，一份没有运行时钩子的静态声明，返回 disposer。`id` 是这个实现在 tab 系统里的身份，在全部注册中唯一（包名是天然取值；随包引导页是 `@deepseek-ai/dsh-client-ui-sidebar-right/guide`）：一旦 extension 可以接管 builtin 的 kind，kind 就不再唯一，所以实现要自己命名，同一 `id` 的第二次注册会 throw。资源类型给出 `patterns`，即作用于 `dsh-resource://` 地址的 glob：含 `:` 的匹配整个地址（`dsh-resource://file/**`）；不含的匹配 URI 路径的任意深度且忽略大小写（`*.md`），不是 URI 的地址不匹配任何这类模式。页类型——引导页、文件树——不给出模式，按 kind 打开。`canOpen(address)` 否决一次命中。`title(address)` 是 tab chip 的文字，在 tab 打开时捕获。`guide` 列出引导页的入口框；选中一个即把贡献它的类型作为页打开。一个 `kind` 最多承载一份 `builtin` 与一份 `extension` 注册（extension 生效；它离开后 builtin 恢复）；kind 上的其它任何撞名都 throw。`id` 同时也是该类型正文与标题注册时用的 key，因此 extension 与它接管的 builtin 各占一个格位，席位渲染生效的那个。
 2. **正文**——`ctx.slots.register({ name: 'sidebar.right.pane.tab', key: definition.id }, Body)` 通过框架注入的 `useTabInfo()` 读取 `{ sidebar, panel, tab }`。`sidebar` 提供开合与全屏信息，`panel.id` 命名所在格，`tab` 包含原记录字段、`visible`、`navigation`、`signal` 和 `actions`。这些字段不再作为平铺owner props传入；类型自己的store仍使用 `useStore`/`actions`。可选标题注册及引导替换共享该hook；未注册标题时使用打开时保存的文本。
 
 由哪个类型打开资源遵循编辑器解析器的惯例：`patterns` 命中的类型先按 `priority` 档排序——`extension`（产品外的类型，最高档，也是未命名时的默认）、`builtin`、`fallback`（任何更具体的类型都应胜过的通用查看器）——再按命中模式的长度，再按注册顺序；`canOpen` 会剔除候选。各档是字符串字面量，因此别的包里的类型不需要从这里做运行时导入。`candidates(address)` 返回排序，`claim(address, kind?)` 返回决定；指定 `kind` 时跳过它的 glob 但保留它的 `canOpen`。
@@ -97,7 +97,9 @@ tab 类型分两阶段注册，随包发布的引导类型走的正是别的包
 <a id="the-tab-domain"></a>
 ## Tab 域
 
-Tab 域按（Session，Tab id）保留导航、中止信号与绑定动作。私有装配回调采用各 Session 的 store，立即对齐恢复的记录，再跟随其提交。同一 Session 的 store 重建会替换其 `adopt` 注册，同时释放旧订阅与清理引用。记录消失或插件卸载才中止 signal，收起和切会话不销毁记录；undo 恢复的是新 occurrence。`useTabInfo()` 组合框架绑定的 store 与导航 hook，不在组件中手写订阅或在渲染时创建记录。`tab.actions` 始终作用于自己的会话；`tab.visible` 区分正文与标题，浮窗不受整栏收起影响。`adopt` 不在公开控制器上。
+Tab 域按（Session，Tab id）保留导航、中止信号与绑定动作。私有装配回调采用各 Session 的 store，立即对齐恢复的记录，再跟随其提交。同一 Session 的 store 重建会替换其 `adopt` 注册，同时释放旧订阅与清理引用。记录消失或插件卸载才中止 signal，收起和切会话不销毁记录；undo 恢复的是新 occurrence。`useTabInfo()` 组合框架绑定的 store 与导航 hook，不在组件中手写订阅或在渲染时创建记录。`tab.actions` 始终作用于自己的会话；`tab.visible` 区分正文与标题，并排除后台 Session；前台浮窗不受整栏收起影响。`adopt` 不在公开控制器上。
+
+类型声明 `keepMounted: true` 后，已访问正文会在切 tab、切 Session、收起和停靠切换期间保留。每个 View 通过 owner props 提供自身稳定的持有回调，因此 Session injection binding 重建不会释放正文。未访问的正文不会提前挂载。
 
 标签页所有者通过 effect 注册 `registerCloseHandler(kind, handler)`。handler 在允许显式关闭或替换前同步保存后台清理任务。资源所有者跟踪完成和重试，侧栏不等待清理。handler 抛错时保留标签页。折叠、展示方式改变和插件卸载不调用关闭 handler；tab abort signal 标识 occurrence 卸载，不代表显式关闭。
 
@@ -132,7 +134,8 @@ Tab 域按（Session，Tab id）保留导航、中止信号与绑定动作。私
 
 - **布局保存在当前浏览器。** 布局不跨设备同步；provider 专属状态需要由该 provider 支持恢复。
 - **没有会话就没有停靠面。** 状态按会话 id 键控，因此 hero 画面右侧什么都不显示。
-- **硬编码的层叠。** 面板与浮窗宿主使用固定的 z-index 值，因为客户端还没有 z-index token 层。
+- **硬编码的层叠。** 内容树使用固定层叠层；浮窗在该层内重排，不会把整层抬到菜单之上。
+- **保活 Session 的删除。** 仅从目录消失不会使已初始化的保活 View 退休；释放由 tab 生命周期和插件卸载负责。
 - **未暴露撤销。** 记录的序列只能通过 `@internal` 服务方法步进；产品控件是有意缺席的。
 - **标题在打开时固定。** 类型的 `title(address)` 被捕获进记录；会变的标题只来自可选的标题席位。
 - **没有内容导航栈。** 后退回放的是布局操作；编辑器式的「已访问内容」前进/后退尚未构建。
diff --git a/packages/client/ui-sidebar-right/src/client/contract/slots.ts b/packages/client/ui-sidebar-right/src/client/contract/slots.ts
index 6095752b27..28b026a3ad 100644
--- a/packages/client/ui-sidebar-right/src/client/contract/slots.ts
+++ b/packages/client/ui-sidebar-right/src/client/contract/slots.ts
@@ -25,7 +25,7 @@ import type { RightbarOwnerProps } from '@deepseek-ai/dsh-client-ui-layout/clien
 // The locale plugin's own merge carries the shared `common` vocabulary that the
 // lookup chain consults after this namespace misses.
 import type {} from '@deepseek-ai/dsh-client-locale/client'
-import type { PaneId, TabRecord } from '@deepseek-ai/dsh-client-ui-dockkit'
+import type { PaneId, TabId, TabRecord } from '@deepseek-ai/dsh-client-ui-dockkit'
 import type { SlotHookFactory } from '@deepseek-ai/dsh-client-ui-slots'
 import type { TabHookContext } from '../tab-info.ts'
 import type { SidebarRightKey } from '../locales.ts'
@@ -39,7 +39,15 @@ declare module '@deepseek-ai/dsh-client-ui-slots' {
 
   interface SlotMap {
     /** Session content selected by the root-scoped right Sidebar controller. */
-    'rightbar.session': { kind: 'single'; scope: 'session'; owner: RightbarOwnerProps }
+    'rightbar.session': {
+      kind: 'single'
+      scope: 'session'
+      owner: RightbarOwnerProps & {
+        readonly active: boolean
+        /** @param tabId - retained body. @param signal - tab occurrence lifetime. @returns releases the View-owned hold. */
+        readonly retainTab: (tabId: TabId, signal: AbortSignal) => () => void
+      }
+    }
     /**
      * One tab's body, dispatched with the `id` of the type in force for
      * `tab.kind`. A tab type registers here under its definition's `id` and
@@ -148,7 +156,7 @@ export interface SidebarRightTabInfo {
   }
   readonly panel: { readonly id: PaneId }
   readonly tab: TabRecord & {
-    /** Docked bodies need an expanded sidebar and an active tab; expanded titles include inactive tabs. Floats stay visible. */
+    /** Only the foreground Session is visible. Docked bodies also require expansion and selection; its floats survive collapse. */
     readonly visible: boolean
     readonly navigation: SidebarRightTabNavigation
     /** Aborted only when the record disappears or this plugin unloads, not on hide or session switch. */
diff --git a/packages/client/ui-sidebar-right/src/client/index.ts b/packages/client/ui-sidebar-right/src/client/index.ts
index c50c757f23..19c307c063 100644
--- a/packages/client/ui-sidebar-right/src/client/index.ts
+++ b/packages/client/ui-sidebar-right/src/client/index.ts
@@ -33,7 +33,8 @@ import { GuideBody, type GuideInjected } from './tabs/guide/GuideBody.tsx'
 import { GuideTitle } from './tabs/guide/GuideTitle.tsx'
 import { ExpandButton } from './shell/ExpandButton.tsx'
 import { RightbarSeat, type SidebarRightInjected } from './shell/SidebarRight.tsx'
-import { RightbarRoot } from './shell/RightbarRoot.tsx'
+import { RightbarRoot, type RightbarRootInjected } from './shell/RightbarRoot.tsx'
+import { SidebarSessionViews } from './session-views.ts'
 import { createSidebarRightController, type SidebarRightController } from './service.ts'
 import { SidebarRightTabRegistry } from './tab-registry.ts'
 import { createSidebarRightStore } from './stores.ts'
@@ -74,7 +75,7 @@ export type { SidebarRightOpenTab } from './tab-inventory.ts'
 const NS = 'sidebarRight'
 
 /** Required browser services: the slot registry, the frame's panel actions, copy, and the resource model. */
-export const inject = ['slots', 'layout', 'locale', 'resources']
+export const inject = ['slots', 'layout', 'locale', 'resources', 'sessions', 'uiSession']
 
 declare module '@deepseek-ai/cordis' {
   interface Context {
@@ -102,6 +103,14 @@ export function apply(ctx: ClientContext): void {
   // its own apply top level for the same reason.
   const t = ctx.locale.bind(NS)
   const tabs = new SidebarRightTabRegistry(ctx)
+  const views = new SidebarSessionViews(ctx.sessions)
+  ctx.effect(() => {
+    const current = ctx.uiSession.adapter.current
+    const sync = (): void => { views.select(current.getSnapshot().key as SessionId | undefined) }
+    const unsubscribe = current.subscribe(sync)
+    sync()
+    return () => { unsubscribe(); views.dispose() }
+  }, 'ui-sidebar-right: retained Session views')
   const { controller, adopt, forget } = createSidebarRightController(
     tabs,
     (address, signal) => { ctx.resources.pin(address, signal) },
@@ -156,6 +165,10 @@ export function apply(ctx: ClientContext): void {
       yield ctx.slots.register({
         name: 'rightbar',
         children: { 'rightbar.session': { kind: 'single', scope: 'session' } },
+        inject: (): RightbarRootInjected => ({
+          hooks: { views: views.source },
+          mountView: reference => views.mount(reference),
+        }),
       }, RightbarRoot)
       yield ctx.slots.register({
         name: 'rightbar.session',
diff --git a/packages/client/ui-sidebar-right/src/client/persistence.ts b/packages/client/ui-sidebar-right/src/client/persistence.ts
index 9fc941a837..7335573d97 100644
--- a/packages/client/ui-sidebar-right/src/client/persistence.ts
+++ b/packages/client/ui-sidebar-right/src/client/persistence.ts
@@ -38,7 +38,8 @@ function validateReferences(value: z.infer<typeof surface>): void {
     if (visited.has(id) || entry === undefined) reject()
     visited.add(id)
     if (entry.kind === 'split') {
-      if (host !== 'dock' || entry.children.length !== entry.sizes.length
+      if (host !== 'dock' || id !== layout.rootId || entry.axis !== 'row' || entry.children.length !== 2
+        || entry.children.length !== entry.sizes.length
         || Math.abs(entry.sizes.reduce((sum, size) => sum + size, 0) - 1) > 1e-9) reject()
       pending.push(...entry.children.map(id => ({ id, host })))
     } else {
diff --git a/packages/client/ui-sidebar-right/src/client/session-view.ts b/packages/client/ui-sidebar-right/src/client/session-view.ts
new file mode 100644
index 0000000000..f36bb3f977
--- /dev/null
+++ b/packages/client/ui-sidebar-right/src/client/session-view.ts
@@ -0,0 +1,91 @@
+/** One Sidebar view's Session reference, retained bodies and committed mount lifetime. */
+import type { ISessions, SessionReference } from '@deepseek-ai/dsh-api-session-controller/client'
+import type { SessionId } from '@deepseek-ai/dsh-session/types'
+import type { TabId } from '@deepseek-ai/dsh-client-ui-dockkit'
+
+declare module '@deepseek-ai/dsh-api-session-controller/client' {
+  interface SessionReferenceSourceMap {
+    sidebarView: unknown
+  }
+}
+
+/** Owns its reference until retirement finishes or the Sidebar plugin shuts down. */
+export class SidebarSessionView {
+  /** Session reference released exclusively by this View. */
+  readonly reference: SessionReference
+  private readonly tabs = new Map<TabId, number>()
+  private mounts = 0
+  private retired = false
+  private disposed = false
+
+  /**
+   * @param sessionId - Session displayed by this view.
+   * @param sessions - allocator for this view's independent reference.
+   * @param onDispose - removes this view from the collection's index before reference release.
+   * @param onTabRelease - reconsiders retention after a body releases its hold.
+   */
+  constructor(
+    readonly sessionId: SessionId,
+    sessions: ISessions,
+    private readonly onDispose: (view: SidebarSessionView) => void,
+    private readonly onTabRelease: (view: SidebarSessionView) => void,
+  ) {
+    this.reference = sessions.retain(sessionId, { source: 'sidebarView' })
+    void this.reference.ready.catch((error: unknown) => { console.error('Sidebar Session opening failed:', error) })
+  }
+
+  /** Whether an initialized retained body still needs this view. */
+  get hasRetainedTabs(): boolean {
+    return this.tabs.size > 0
+  }
+
+  /**
+   * Keep a retired View's reference until its committed roots finish unmounting.
+   * @returns cleanup to call once for this root; the final cleanup releases a retired View.
+   */
+  mount(): () => void {
+    this.mounts += 1
+    return () => {
+      this.mounts -= 1
+      if (this.retired && this.mounts === 0) this.dispose()
+    }
+  }
+
+  /**
+   * Hold an initialized body until unmount or occurrence cancellation.
+   * @param tabId - initialized body identity.
+   * @param signal - occurrence lifetime; closing and undoing a tab creates a new lifetime.
+   * @returns idempotent release of this body's hold.
+   */
+  readonly retainTab = (tabId: TabId, signal: AbortSignal): (() => void) => {
+    if (signal.aborted || this.disposed) return () => {}
+    this.tabs.set(tabId, (this.tabs.get(tabId) ?? 0) + 1)
+    let held = true
+    const release = (): void => {
+      if (!held) return
+      held = false
+      signal.removeEventListener('abort', release)
+      const count = this.tabs.get(tabId) as number
+      if (count === 1) this.tabs.delete(tabId)
+      else this.tabs.set(tabId, count - 1)
+      this.onTabRelease(this)
+    }
+    signal.addEventListener('abort', release, { once: true })
+    return release
+  }
+
+  /** End a withdrawn view after its existing committed mounts finish. */
+  retire(): void {
+    this.retired = true
+    if (this.mounts === 0) this.dispose()
+  }
+
+  /** Release once; plugin shutdown does not wait for remaining React mounts. */
+  dispose(): void {
+    if (this.disposed) return
+    this.disposed = true
+    this.retired = true
+    this.onDispose(this)
+    this.reference.release()
+  }
+}
diff --git a/packages/client/ui-sidebar-right/src/client/session-views.ts b/packages/client/ui-sidebar-right/src/client/session-views.ts
new file mode 100644
index 0000000000..232b310755
--- /dev/null
+++ b/packages/client/ui-sidebar-right/src/client/session-views.ts
@@ -0,0 +1,80 @@
+/** Selection and retention policy for independently owned Sidebar Session views. */
+import type { ISessions, SessionReference } from '@deepseek-ai/dsh-api-session-controller/client'
+import type { SessionId } from '@deepseek-ai/dsh-session/types'
+import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
+import { SidebarSessionView } from './session-view.ts'
+
+/** The reference is exclusively a framework SessionProvider target, not a business-component service. */
+export interface SidebarSessionViewSnapshot {
+  readonly sessionId: SessionId
+  readonly reference: SessionReference
+  readonly selected: boolean
+  /** Stable for this View's lifetime, independently of Session injection bindings. */
+  readonly retainTab: SidebarSessionView['retainTab']
+}
+
+/** Selects and retires views; the Sidebar plugin's injected dependencies own global teardown. */
+export class SidebarSessionViews {
+  /** Selected and retained View targets observed by the root renderer. */
+  readonly source = createSnapshotStore<readonly SidebarSessionViewSnapshot[]>([])
+  private readonly views = new Map<SessionId, SidebarSessionView>()
+  private readonly viewsByReference = new Map<SessionReference, SidebarSessionView>()
+  private selected: SessionId | undefined
+  private closed = false
+
+  constructor(private readonly sessions: ISessions) {}
+
+  /**
+   * Change the foreground Session while preserving retained background Views.
+   * @param sessionId - main selection, or absence.
+   */
+  select(sessionId: SessionId | undefined): void {
+    if (this.closed || this.selected === sessionId) return
+    this.selected = sessionId
+    if (sessionId !== undefined && !this.views.has(sessionId)) {
+      const view = new SidebarSessionView(sessionId, this.sessions, (disposed) => {
+        this.viewsByReference.delete(disposed.reference)
+      }, (released) => { this.prune(released) })
+      this.views.set(sessionId, view)
+      this.viewsByReference.set(view.reference, view)
+    }
+    for (const view of this.views.values()) this.prune(view)
+    this.publish()
+  }
+
+  /**
+   * Bind a committed root; release retired references after that root unmounts.
+   * @param reference - framework target published by this owner.
+   * @returns releases this committed mount.
+   */
+  mount(reference: SessionReference): () => void {
+    const view = this.viewsByReference.get(reference)
+    if (view === undefined) {
+      if (this.closed) return () => {}
+      throw new Error('Sidebar Session view reference is no longer owned')
+    }
+    return view.mount()
+  }
+
+  /** Plugin shutdown releases every view, including any awaiting a React unmount. */
+  dispose(): void {
+    this.closed = true
+    this.views.clear()
+    this.source.set([])
+    for (const view of this.viewsByReference.values()) view.dispose()
+  }
+
+  private prune(view: SidebarSessionView): void {
+    if (view.sessionId === this.selected || view.hasRetainedTabs || this.views.get(view.sessionId) !== view) return
+    this.views.delete(view.sessionId)
+    // Render targets must be withdrawn before an unmounted view can release its reference.
+    this.publish()
+    view.retire()
+  }
+
+  private publish(): void {
+    this.source.set([...this.views.values()].sort((a, b) => a.sessionId.localeCompare(b.sessionId)).map(view => ({
+      sessionId: view.sessionId, reference: view.reference, selected: view.sessionId === this.selected, retainTab: view.retainTab,
+    })))
+  }
+}
diff --git a/packages/client/ui-sidebar-right/src/client/shell/RightbarRoot.tsx b/packages/client/ui-sidebar-right/src/client/shell/RightbarRoot.tsx
index 46420e5970..26bedb1d18 100644
--- a/packages/client/ui-sidebar-right/src/client/shell/RightbarRoot.tsx
+++ b/packages/client/ui-sidebar-right/src/client/shell/RightbarRoot.tsx
@@ -1,20 +1,38 @@
 /** Root-scoped controller for the right Sidebar's Session content. */
-import type { PropsRenderSlots, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
+import { useLayoutEffect } from 'react'
+import type { HostObservable, InjectFace, PropsRenderSlots, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
+import type { SessionReference } from '@deepseek-ai/dsh-api-session-controller/client'
+import type { SidebarSessionViewSnapshot } from '../session-views.ts'
 import type {} from '../contract/slots.ts'
+import css from './SidebarRight.module.css'
+
+/** Root-only retained Session targets and their committed mount lifetimes. */
+export interface RightbarRootInjected {
+  readonly hooks: { readonly views: HostObservable<readonly SidebarSessionViewSnapshot[]> }
+  readonly mountView: (reference: SessionReference) => () => void
+}
+
+type RootProps = PropsRuntime<'rightbar'> & PropsRenderSlots<'rightbar.session'> & InjectFace<RightbarRootInjected>
+
+function SessionView({ view, visible, SessionProvider, renderSlot, mountView, width, viewportWidth, canShow }:
+  Pick<RootProps, 'SessionProvider' | 'renderSlot' | 'mountView' | 'width' | 'viewportWidth' | 'canShow'>
+  & { readonly view: SidebarSessionViewSnapshot; readonly visible: boolean }) {
+  useLayoutEffect(() => mountView(view.reference), [mountView, view.reference])
+  const active = visible && view.selected
+  return <div className={css.session} hidden={!active} data-sidebar-right-session={view.sessionId}>
+    <SessionProvider session={view.reference}>
+      {renderSlot('rightbar.session', { width, viewportWidth, canShow, active, retainTab: view.retainTab })}
+    </SessionProvider>
+  </div>
+}
 
 /**
- * Render the Session-bound Sidebar only while the Conversation is selected.
- * @param props - frame geometry, panel selection, and the authorized Session renderer.
- * @returns the current Session's right Sidebar, or no content for a global panel.
+ * Keep independent Session subtrees and hide those outside the selected Conversation.
+ * @param props - frame geometry, view targets and the authorized Session renderer.
+ * @returns the foreground and retained background Sidebars.
  */
-export function RightbarRoot({
-  usePanelInfo, SessionProvider, renderSlot, width, viewportWidth, canShow,
-}: PropsRuntime<'rightbar'> & PropsRenderSlots<'rightbar.session'>) {
+export function RightbarRoot({ usePanelInfo, useViews, ...props }: RootProps) {
   const visible = usePanelInfo(info => info.activePanelId === null)
-  if (!visible) return null
-  return (
-    <SessionProvider>
-      {renderSlot('rightbar.session', { width, viewportWidth, canShow })}
-    </SessionProvider>
-  )
+  const views = useViews(value => value)
+  return <>{views.map(view => <SessionView key={view.sessionId} {...props} view={view} visible={visible} />)}</>
 }
diff --git a/packages/client/ui-sidebar-right/src/client/shell/SidebarRight.module.css b/packages/client/ui-sidebar-right/src/client/shell/SidebarRight.module.css
index 890b897cc8..7c7833556f 100644
--- a/packages/client/ui-sidebar-right/src/client/shell/SidebarRight.module.css
+++ b/packages/client/ui-sidebar-right/src/client/shell/SidebarRight.module.css
@@ -9,7 +9,7 @@
  * One content tree uses the frame's width normally and fills the viewport in
  * fullscreen. The frame retains a shown wide panel's track in both modes.
  *
- * Hidden, the panel is translated off the frame's right edge rather than
+ * Hidden, docked Grid items translate off the frame's right edge rather than
  * unmounted, so showing and hiding are one slide in both presentations. The
  * transform rides the same variables as the frame's track transition (ui-theme
  * base.css); while squeezing, the panel's left edge and the conversation's right
@@ -17,30 +17,45 @@
  * is out of reach once off-edge, and flips back before the slide starts.
  *
  * The normal panel is below frame overlays (20); fullscreen (40) covers the
- * frame and remains below independently floating panels (60).
+ * frame and remains below independently floating panels (60). The common
+ * content root owns no stacking context or transform.
  */
+.session {
+  display: contents;
+}
+
+.session[hidden] {
+  display: none;
+}
+
 .panel {
+  --dsh-dockkit-dock-layer: 10;
+  --dsh-dockkit-float-layer: 60;
   position: absolute;
   top: 0;
   right: 0;
   bottom: 0;
-  z-index: 10;
   display: flex;
   flex-direction: column;
   min-width: 0;
-  /* The same ground as the conversation: this is a column of the page, not a
-     raised surface. The edge is the weight of the kit's split dividers inside
-     (ui-dockkit `.divider`), so the panel's outline and its inner rules match. */
-  background: var(--dsw-alias-bg-base);
-  border-left: 0.5px solid var(--dsw-alias-border-l4);
-  transform: translateX(100%);
+  pointer-events: none;
+}
+
+/* Only docked Grid items slide. Their common ancestor remains untransformed,
+   unclipped and without a stacking context, so fixed floating children escape. */
+.panel :global([data-dockkit-host='dock']),
+.panel :global([data-dockkit-empty]),
+.panel :global([data-dockkit-divider]) {
+  transform: translateX(var(--dsh-sidebar-width));
   visibility: hidden;
   transition:
     transform var(--ds-transition-duration-slow) var(--ds-ease-in-out),
     visibility 0s linear var(--ds-transition-duration-slow);
 }
 
-.panel[data-sidebar-right-open] {
+.panel[data-sidebar-right-open] :global([data-dockkit-host='dock']),
+.panel[data-sidebar-right-open] :global([data-dockkit-empty]),
+.panel[data-sidebar-right-open] :global([data-dockkit-divider]) {
   transform: none;
   visibility: visible;
   transition: transform var(--ds-transition-duration-slow) var(--ds-ease-in-out);
@@ -60,15 +75,12 @@
 }
 
 .panel[data-sidebar-right-panel='fullscreen'] {
-  position: fixed;
-  inset: 0;
-  z-index: 40;
-  border: none;
+  --dsh-dockkit-dock-layer: 40;
 }
 
 /* No whole-box subtraction here: Electron drag regions are window geometry,
    not stacking, so the frame's leading band does keep acting through this
-   fixed overlay — but the kit already subtracts every box that must stay
+   fullscreen content — but the kit already subtracts every box that must stay
    usable (tabs, strip-end chrome, pane bodies, dividers; ui-dockkit), and
    ui-web base.css subtracts interactive elements and portalled overlays.
    What remains of the band under the strips' blank runs is the window drag
@@ -79,10 +91,10 @@
 
 /* Windows keeps caption controls above fullscreen file and terminal panels. */
 :global([data-windows-titlebar]) .panel[data-sidebar-right-panel='fullscreen'] {
-  overflow: hidden;
-  left: var(--dsh-windows-sidebar-width);
-  max-width: calc(100% - var(--dsh-windows-sidebar-width));
-  top: var(--dsh-windows-titlebar-height);
+  max-width: calc(100vw - var(--dsh-windows-sidebar-width));
+}
+
+:global([data-windows-titlebar]) .panel[data-sidebar-right-panel='fullscreen'] :global([data-dockkit-column='0'][data-dockkit-pane]) {
   border-radius: var(--dsh-windows-content-radius) 0 0 0;
   corner-shape: round;
 }
@@ -90,27 +102,27 @@
 /* macOS fullscreen: the panel reaches the window's top-left corner, where the
    hiddenInset traffic lights (x 16..~68) float over the first pane's tab
    strip. Widen that strip's start inset (dockkit publishes the variable);
-   panes below or right of a divider sit clear of the lights, and every
-   non-first split cell resets the inherited value for its whole subtree. */
-:global([data-platform='darwin']) .panel[data-sidebar-right-panel='fullscreen'] .panelBody {
+   the second Grid column sits clear of the lights and uses the ordinary inset. */
+:global([data-platform='darwin']) .panel[data-sidebar-right-panel='fullscreen'] :global([data-dockkit-host='dock'][data-dockkit-column='0']) {
   /* Lights end near x 68; 88 leaves the same 20px of air the conversation
      header's leading controls keep after them (ui-sidebar HeaderLeadingControls). */
   --dsh-dockkit-strip-inline-start: 88px;
 }
 
-:global([data-platform='darwin']) .panel[data-sidebar-right-panel='fullscreen'] .panelBody :global([data-dockkit-cell]):not(:first-child) {
+:global([data-platform='darwin']) .panel[data-sidebar-right-panel='fullscreen'] :global([data-dockkit-host='dock'][data-dockkit-column='1']) {
   --dsh-dockkit-strip-inline-start: 10px;
 }
 
 /* Window fullscreen hides the traffic lights (html[data-fullscreen], desktop
    preload); the first pane's strip keeps only the ordinary inset. */
-:global([data-platform='darwin'][data-fullscreen]) .panel[data-sidebar-right-panel='fullscreen'] .panelBody {
+:global([data-platform='darwin'][data-fullscreen]) .panel[data-sidebar-right-panel='fullscreen'] :global([data-dockkit-host='dock'][data-dockkit-column='0']) {
   --dsh-dockkit-strip-inline-start: 10px;
 }
 
 @media (prefers-reduced-motion: reduce) {
-  .panel,
-  .panel[data-sidebar-right-open] {
+  .panel :global([data-dockkit-host='dock']),
+  .panel :global([data-dockkit-empty]),
+  .panel :global([data-dockkit-divider]) {
     transition: none;
   }
 }
@@ -159,17 +171,3 @@
   color: var(--dsw-alias-label-tertiary);
   font-size: var(--dsh-content-font-size-secondary, 13px);
 }
-
-/*
- * Host for the portalled floating panels. Panels leave the column so they can
- * cross it and the conversation, which puts them beside the app root rather than
- * inside it — and a sibling of the root does not inherit its stacking, so the
- * level is stated here. The value sits above the frame's own overlay layer;
- * there is no z-index token layer to draw from yet.
- */
-.floatHost {
-  position: fixed;
-  inset: 0;
-  z-index: 60;
-  pointer-events: none;
-}
diff --git a/packages/client/ui-sidebar-right/src/client/shell/SidebarRight.tsx b/packages/client/ui-sidebar-right/src/client/shell/SidebarRight.tsx
index 6b388b219f..38a86eff2f 100644
--- a/packages/client/ui-sidebar-right/src/client/shell/SidebarRight.tsx
+++ b/packages/client/ui-sidebar-right/src/client/shell/SidebarRight.tsx
@@ -2,11 +2,11 @@
  * The Sidebar's seat in the frame, and the panel it draws.
  *
  * The frame owns the right column's geometry; this package owns one content
- * tree at the column width or fixed across the viewport. A shown wide panel
+ * tree at the column width or spanning the viewport. A shown wide panel
  * retains its track in fullscreen, preserving the conversation width. Below
  * 768px fullscreen is derived from viewport width, without changing manual mode.
  *
- * The panel stays mounted while collapsed, translated off the frame's right
+ * Docked content stays mounted while collapsed, translated off the frame's right
  * edge, so opening and closing are one gesture in both presentations: a slide
  * from and to that edge. Normal presentation moves the frame's tracks with
  * the panel. A fullscreen opening reserves its underlying track only after
@@ -17,8 +17,8 @@
  * pane's tab strip, so the strip is the panel's whole top edge. The way back in
  * while collapsed is not here either: it is one button in the conversation
  * header (`ExpandButton.tsx`), because it exists only while this panel is
- * hidden. Floating panels portal out because they must cross the column and the
- * conversation, and the kit already positions them in viewport coordinates.
+ * hidden. Floating panels remain in the same content tree; untransformed
+ * ancestors let their fixed-position frames cross the column and conversation.
  *
  * Tab bodies do not live here. Each one is a registration under its type's kind,
  * dispatched through the keyed `sidebar.right.pane.tab` seat (and a live chip
@@ -28,15 +28,14 @@
  * domain follows each session's store commits, including sessions off screen.
  */
 import { useCallback, useEffect, useLayoutEffect, useMemo, useRef } from 'react'
-import type { ReactNode, RefObject } from 'react'
-import { createPortal } from 'react-dom'
+import type { CSSProperties, ReactNode, RefObject } from 'react'
 import { IconPanelLeftOutlineRegular, Tooltip } from '@deepseek-ai/dsh-client-ui-primitives'
 import type {
   HostObservable, InjectFace, PropsLocale, PropsRenderSlots, PropsRuntime, PropsStore,
 } from '@deepseek-ai/dsh-client-ui-slots'
 import type {} from '../contract/slots.ts'
 import type { DockIntents, DockMode, FloatRect, TabId, TabRecord, TabRenderer } from '@deepseek-ai/dsh-client-ui-dockkit'
-import { canSplit, dockPaneIds, DockSurface, findPaneContentTab, FloatLayer } from '@deepseek-ai/dsh-client-ui-dockkit'
+import { canSplit, dockPaneIds, DockLayout, findPaneContentTab } from '@deepseek-ai/dsh-client-ui-dockkit'
 import type { HalvesFit, LayoutState, PaneId } from '@deepseek-ai/dsh-client-ui-dockkit'
 import type { SessionId } from '@deepseek-ai/dsh-session/types'
 import { GUIDE_KIND, pageAddress } from '../contract/seed.ts'
@@ -133,6 +132,8 @@ interface PanelProps {
   readonly occurrence: SidebarRightInjected['occurrence']
   readonly fullscreen: boolean
   readonly autoFullscreen: boolean
+  readonly active: boolean
+  readonly retainTab: RightbarSeatProps['retainTab']
   /** Receives the kit's room-rule readings for the service's `split`. */
   readonly reportRoom: (fits: ReadonlyMap<PaneId, HalvesFit>) => void
 }
@@ -172,7 +173,7 @@ export function intentsFor(sessionId: SessionId, actions: Store['actions'], open
 }
 
 /** One tab's slot dispatch: which seat, and what to render when no type registered. */
-interface TabSlotProps extends Pick<PanelProps, 'renderSlot' | 'occurrence' | 'useTabTypes' | 'useTabNavigation' | 'useStore' | 'fullscreen'> {
+interface TabSlotProps extends Pick<PanelProps, 'renderSlot' | 'occurrence' | 'useTabTypes' | 'useTabNavigation' | 'useStore' | 'fullscreen' | 'active' | 'retainTab'> {
   readonly tab: TabRecord
   readonly seat: 'sidebar.right.pane.tab' | 'sidebar.right.pane.tab.title'
   readonly fallback: ReactNode
@@ -182,19 +183,22 @@ interface TabSlotProps extends Pick<PanelProps, 'renderSlot' | 'occurrence' | 'u
  * Dispatch one tab's body or title with stable framework hooks and record lifetime.
  */
 function TabSlot({
-  renderSlot, occurrence, useTabTypes, useTabNavigation, useStore, fullscreen, tab, seat, fallback,
+  renderSlot, occurrence, useTabTypes, useTabNavigation, useStore, fullscreen, active, retainTab, tab, seat, fallback,
 }: TabSlotProps): ReactNode {
   const { signal, tabActions } = occurrence(tab)
   const definition = useTabTypes(types => types.find(definition => definition.kind === tab.kind))
+  const retained = seat === 'sidebar.right.pane.tab' && definition?.keepMounted === true
+  useLayoutEffect(() => retained ? retainTab(tab.id, signal) : undefined, [retained, retainTab, tab.id, signal])
   const hookContext = useMemo((): TabHookContext => ({
     tabId: tab.id,
     title: seat === 'sidebar.right.pane.tab.title',
     fullscreen,
+    active,
     signal,
     actions: tabActions,
     useStore,
     useTabNavigation,
-  }), [tab.id, seat, fullscreen, signal, tabActions, useStore, useTabNavigation])
+  }), [tab.id, seat, fullscreen, active, signal, tabActions, useStore, useTabNavigation])
   return renderSlot(seat, {}, { entryKey: definition?.id ?? tab.kind, fallback, hookContext })
 }
 
@@ -207,9 +211,7 @@ function TabSlot({
  */
 function bodiesFor(panel: PanelProps): TabRenderer {
   const { t, ...rest } = panel
-  // Keyed by record: the kit draws one body per pane in one place, and the
-  // keyed slot below keys on the type, so two tabs of one kind would otherwise
-  // share a component instance and its local state (a scroll position, a ref).
+  // Slot dispatch selects a type; the record key separates bodies of that type.
   return tab => (
     <TabSlot
       key={tab.id}
@@ -287,20 +289,18 @@ function PanelChrome({ sessionId, fullscreen, autoFullscreen, actions, t }: Pick
 function SidebarPanel(panel: PanelProps & { width: number; panelRef: RefObject<HTMLDivElement> }): ReactNode {
   const { sessionId, surface, actions, t, renderSlot, openTab, width, reportRoom, fullscreen, autoFullscreen, panelRef } = panel
   const { expanded } = surface.layout
+  const types = panel.useTabTypes(value => value)
   return (
     <div
       ref={panelRef}
       className={css.panel}
-      style={{ width: fullscreen ? '100%' : width }}
+      style={{ width: fullscreen ? '100vw' : width,
+        '--dsh-sidebar-width': fullscreen ? '100vw' : `${width}px` } as CSSProperties}
       data-sidebar-right-panel={fullscreen ? 'fullscreen' : 'push'}
       data-sidebar-right-open={expanded || undefined}
-      // Off-edge is out of reach: the stylesheet's visibility flip takes the
-      // hidden panel out of the tab order, and this takes it out of the
-      // accessibility tree.
-      aria-hidden={!expanded || undefined}
     >
       <div className={css.panelBody}>
-        <DockSurface
+        <DockLayout
           state={surface.layout}
           canSplit={canSplit(surface.layout) && dockPaneIds(surface.layout).length < 2}
           hideSplitWhenBlocked
@@ -312,6 +312,8 @@ function SidebarPanel(panel: PanelProps & { width: number; panelRef: RefObject<H
           labels={dockLabels(t)}
           renderTab={bodiesFor(panel)}
           renderTabTitle={titlesFor(panel)}
+          active={panel.active}
+          keepMounted={tab => types.find(type => type.kind === tab.kind)?.keepMounted === true}
           renderTabMenuItems={(tab, dismiss) =>
             renderSlot('sidebar.right.tab.menu.item', { tab, dismiss })}
           chrome={<PanelChrome sessionId={sessionId} fullscreen={fullscreen} autoFullscreen={autoFullscreen} actions={actions} t={t} />}
@@ -322,34 +324,15 @@ function SidebarPanel(panel: PanelProps & { width: number; panelRef: RefObject<H
   )
 }
 
-/** Portal the floating layer out of whichever seat rendered it. */
-function Floats(panel: PanelProps): ReactNode {
-  const { sessionId, surface, actions, t, openTab } = panel
-  if (surface.layout.floats.length === 0) return null
-  return createPortal(
-    <div className={css.floatHost} data-sidebar-right-float-host>
-      <FloatLayer
-        state={surface.layout}
-        canCloseTab={tabId => canCloseTab(surface, tabId)}
-        intents={intentsFor(sessionId, actions, openTab, panel.closeTab)}
-        labels={dockLabels(t)}
-        renderTab={bodiesFor(panel)}
-        renderTabTitle={titlesFor(panel)}
-      />
-    </div>,
-    document.body,
-  )
-}
-
 /**
- * The right column's occupant: the panel, anchored to the column's edge and
- * shown or hidden by sliding, plus the floating layer. It is also where the
+ * The right column's occupant: stable tab containers, docked or floating.
+ * It is also where the
  * frame learns the panel's presentation, and where `ctx.sidebarRight` learns
  * which session it is acting on, because this is the seat that knows both.
  */
 export function RightbarSeat({
   sessionId, width, viewportWidth, canShow, useStore, actions, t, renderSlot, syncPresentation, bindService, openTab, closeTab,
-  useTabTypes, useTabNavigation, occurrence,
+  useTabTypes, useTabNavigation, occurrence, retainTab, active,
 }: RightbarSeatProps): ReactNode {
   // One store instance per session, so this map holds this session's surface.
   // The binding published below serves the public face's commands on the
@@ -357,7 +340,7 @@ export function RightbarSeat({
   // adopted stores instead.
   const surfaces = useStore(state => state.bySession)
   const surface = surfaces[sessionId]
-  const shown = surface !== undefined && surface.layout.expanded
+  const shown = active && surface !== undefined && surface.layout.expanded
   const autoFullscreen = viewportWidth < 768
   const fullscreen = autoFullscreen || surface?.layout.mode === 'fullscreen'
   const panelRef = useRef<HTMLDivElement | null>(null)
@@ -368,8 +351,8 @@ export function RightbarSeat({
   const track = shown && !autoFullscreen
 
   useEffect(() => {
-    if (surface === undefined) actions.open(sessionId)
-  }, [actions, sessionId, surface])
+    if (active && surface === undefined) actions.open(sessionId)
+  }, [actions, sessionId, surface, active])
 
   useLayoutEffect(() => {
     if (shown && !fullscreen && !canShow) actions.setExpanded(sessionId, false)
@@ -386,7 +369,7 @@ export function RightbarSeat({
   // of the gesture: once at the flip, once after the slide settles and the
   // stylesheet's delayed visibility flip (0.3s) has landed.
   useEffect(() => {
-    if (document.documentElement.dataset.platform !== 'darwin') return
+    if (!active || document.documentElement.dataset.platform !== 'darwin') return
     const panel = panelRef.current
     if (panel === null) return
     let raf: number | null = null
@@ -404,17 +387,18 @@ export function RightbarSeat({
       if (raf !== null) cancelAnimationFrame(raf)
       panel.removeAttribute('data-sidebar-right-region-nudge')
     }
-  }, [shown])
+  }, [shown, active])
 
   // Fullscreen leaves the previous column report in force until its own slide
   // completes. Normal presentation and zero-duration transitions report before paint.
   useLayoutEffect(() => {
+    if (!active) return
     let disposed = false
     const reportWhenCovered = (): void => {
       if (disposed) return
       // A shown panel renders unconditionally and attaches its ref before this effect.
       const entering = shown && fullscreen
-        ? (panelRef.current as HTMLDivElement).getAnimations().filter(animation =>
+        ? (panelRef.current as HTMLDivElement).getAnimations({ subtree: true }).filter(animation =>
           'transitionProperty' in animation && animation.transitionProperty === 'transform'
           && animation.playState !== 'finished' && animation.playState !== 'idle')
         : []
@@ -427,16 +411,20 @@ export function RightbarSeat({
     }
     reportWhenCovered()
     return () => { disposed = true }
-  }, [sessionId, shown, track, fullscreen, syncPresentation])
+  }, [sessionId, shown, track, fullscreen, syncPresentation, active])
   // Leaving is part of that report: a seat that unmounts with its session must
   // hand the track back rather than leave one sized for a surface nobody draws.
-  useLayoutEffect(() => () => { syncPresentation({ shown: false, track: false, fullscreen: false }) }, [syncPresentation])
+  useLayoutEffect(() => active
+    ? () => { syncPresentation({ shown: false, track: false, fullscreen: false }) }
+    : undefined, [syncPresentation, active])
 
   // Republished on every committed change: the service's readers answer from the
   // last commit, and its commands act on the session actually on screen.
   useEffect(
-    () => bindService({ sessionId, actions, surfaces, canSplitPane: paneId => room.current.get(paneId)?.row !== false }),
-    [bindService, sessionId, actions, surfaces],
+    () => active
+      ? bindService({ sessionId, actions, surfaces, canSplitPane: paneId => room.current.get(paneId)?.row !== false })
+      : undefined,
+    [bindService, sessionId, actions, surfaces, active],
   )
   // The Tab domain is not synced here: the controller adopted this session's
   // store as the runtime minted it and reconciles on the store's own commits,
@@ -445,12 +433,7 @@ export function RightbarSeat({
   if (surface === undefined) return null
   const panel: PanelProps = {
     sessionId, actions, t, renderSlot, surface, openTab, closeTab, useTabTypes, useTabNavigation, useStore, occurrence,
-    fullscreen, autoFullscreen, reportRoom,
+    fullscreen, autoFullscreen, reportRoom, active, retainTab,
   }
-  return (
-    <>
-      <SidebarPanel {...panel} width={width} panelRef={panelRef} />
-      <Floats {...panel} />
-    </>
-  )
+  return <SidebarPanel {...panel} width={width} panelRef={panelRef} />
 }
diff --git a/packages/client/ui-sidebar-right/src/client/tab-info.ts b/packages/client/ui-sidebar-right/src/client/tab-info.ts
index 940b86822a..8205bb95da 100644
--- a/packages/client/ui-sidebar-right/src/client/tab-info.ts
+++ b/packages/client/ui-sidebar-right/src/client/tab-info.ts
@@ -11,6 +11,7 @@ export interface TabHookContext {
   readonly tabId: TabId
   readonly title: boolean
   readonly fullscreen: boolean
+  readonly active: boolean
   readonly signal: AbortSignal
   readonly actions: SidebarRightTabActions
   readonly useStore: PropsStore<ReturnType<typeof createSidebarRightStore>>['useStore']
@@ -25,7 +26,7 @@ export interface TabHookContext {
  */
 export const tabInfoFactory: SlotHookFactory<'sidebar.right.pane.tab', UseSidebarRightTabInfo> = (standard, context) => {
   const { sessionId } = standard
-  const { tabId, title, fullscreen, signal, actions, useStore, useTabNavigation } = context
+  const { tabId, title, fullscreen, active, signal, actions, useStore, useTabNavigation } = context
   return function useTabInfo() {
     const layout = useStore(state => state.bySession[sessionId]?.layout)
     const navigation = useTabNavigation(tabId)
@@ -40,13 +41,13 @@ export const tabInfoFactory: SlotHookFactory<'sidebar.right.pane.tab', UseSideba
         panel: { id: pane.id },
         tab: {
           ...tab,
-          visible: pane.host === 'float' || (layout.expanded && (title || pane.activeTabId === tabId)),
+          visible: active && (pane.host === 'float' || (layout.expanded && (title || pane.activeTabId === tabId))),
           navigation,
           signal,
           actions,
         },
       }
-    }, [layout, navigation, tabId, title, fullscreen, signal, actions])
+    }, [layout, navigation, tabId, title, fullscreen, active, signal, actions])
   }
 }
 
diff --git a/packages/client/ui-sidebar-right/src/client/tab-registry.ts b/packages/client/ui-sidebar-right/src/client/tab-registry.ts
index 7961a5e4ad..76de73578a 100644
--- a/packages/client/ui-sidebar-right/src/client/tab-registry.ts
+++ b/packages/client/ui-sidebar-right/src/client/tab-registry.ts
@@ -101,6 +101,8 @@ export interface SidebarRightTabDefinition {
   readonly kind: string
   /** Each open by kind creates independent content; omission keeps one page per kind in each pane. */
   readonly multiple?: boolean
+  /** Lazily keep a visited body mounted through hiding, Session changes and docking; default false. */
+  readonly keepMounted?: boolean
   /**
    * Resource-address globs this type recognizes; omit for a page type, which is
    * opened by kind and recognizes no address.
diff --git a/packages/client/ui-sidebar-right/tests/apply.client.spec.ts b/packages/client/ui-sidebar-right/tests/apply.client.spec.ts
index 530334eae2..7c3489931e 100644
--- a/packages/client/ui-sidebar-right/tests/apply.client.spec.ts
+++ b/packages/client/ui-sidebar-right/tests/apply.client.spec.ts
@@ -10,6 +10,7 @@
  */
 import { describe, expect, it, vi } from 'vitest'
 import { Context } from '@deepseek-ai/cordis'
+import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
 import type { SlotRegistry } from '@deepseek-ai/dsh-client-ui-renderer/client'
 import type { SessionId } from '@deepseek-ai/dsh-session/types'
 import { apply, inject } from '../src/client/index.ts'
@@ -65,6 +66,8 @@ async function boot() {
   ctx.provide('locale', locale as never)
   ctx.provide('layout', layout as never)
   ctx.provide('resources', resources as never)
+  ctx.provide('sessions', { retain: vi.fn() } as never)
+  ctx.provide('uiSession', { adapter: { current: createSnapshotStore({ key: undefined }) } } as never)
   const fiber = ctx.plugin({ inject: [...inject], apply })
   await fiber.await()
   const seat = (name: string): Recorded => {
diff --git a/packages/client/ui-sidebar-right/tests/persistence-validation.client.spec.ts b/packages/client/ui-sidebar-right/tests/persistence-validation.client.spec.ts
index 43ca6f818e..bce86c42ea 100644
--- a/packages/client/ui-sidebar-right/tests/persistence-validation.client.spec.ts
+++ b/packages/client/ui-sidebar-right/tests/persistence-validation.client.spec.ts
@@ -37,6 +37,16 @@ it.each([
   ['split cycle', { minted: 4, layout: { ...splitLayout, nodes: { ...splitLayout.nodes, split3: { ...split, children: ['split3', 'pane1'] } } } }],
   ['invalid split sum', { minted: 4, layout: { ...splitLayout, nodes: { ...splitLayout.nodes, split3: { ...split, sizes: [0.4, 0.4] } } } }],
   ['mismatched split sizes', { minted: 4, layout: { ...splitLayout, nodes: { ...splitLayout.nodes, split3: { ...split, sizes: [0.2, 0.3, 0.5] } } } }],
+  ['vertical split', { minted: 4, layout: { ...splitLayout, nodes: { ...splitLayout.nodes, split3: { ...split, axis: 'column' } } } }],
+  ['three docked panes', { minted: 5, layout: { ...splitLayout, nodes: {
+    ...splitLayout.nodes, pane5: { ...otherPane, id: 'pane5' },
+    split3: { ...split, children: ['pane1', 'pane4', 'pane5'], sizes: [0.3, 0.3, 0.4] },
+  } } }],
+  ['nested split', { minted: 6, layout: { ...splitLayout, nodes: {
+    ...splitLayout.nodes, pane6: { ...otherPane, id: 'pane6' },
+    split3: { ...split, children: ['pane1', 'split5'] },
+    split5: { ...split, id: 'split5', children: ['pane4', 'pane6'] },
+  } } }],
   ['split as active pane', { minted: 4, layout: { ...splitLayout, activePaneId: 'split3' } }],
   ['floating split', { minted: 4, layout: { ...splitLayout, floats: ['split3'] } }],
   ['float without rectangle', { minted: 3, layout: { ...empty.layout, tabs: { tab2: tab }, floats: ['float3'], nodes: { ...empty.layout.nodes, float3: { ...pane, id: 'float3', host: 'float' } } } }],
diff --git a/packages/client/ui-sidebar-right/tests/seat.client.spec.tsx b/packages/client/ui-sidebar-right/tests/seat.client.spec.tsx
index 417e3742ca..fd61162198 100644
--- a/packages/client/ui-sidebar-right/tests/seat.client.spec.tsx
+++ b/packages/client/ui-sidebar-right/tests/seat.client.spec.tsx
@@ -64,7 +64,7 @@ function transition(property = 'transform') {
   }
 }
 
-async function mountSeat(viewportWidth = 1440, canShow = true, entryCount = 0, opener = false) {
+async function mountSeat(viewportWidth = 1440, canShow = true, entryCount = 0, opener = false, keepMounted = false) {
   const runtime = await SlotTestRuntime.create()
   runtimes.push(runtime)
   const frame = { openRightbar: vi.fn(), closeRightbar: vi.fn() }
@@ -130,6 +130,7 @@ async function mountSeat(viewportWidth = 1440, canShow = true, entryCount = 0, o
     runtime.ctx.sidebarRightTabs.register({
       id: 'test/text', kind: 'text', priority: 'builtin', patterns: ['dsh-resource://file/**'],
       title: address => address.slice(address.lastIndexOf('/') + 1),
+      keepMounted,
       guide: Array.from({ length: entryCount }, (_, order) => ({ id: String(order), order, title: () => 'Test', description: () => 'Test page' })),
     })
     runtime.slots.register({ name: 'sidebar.right.pane.tab', key: 'test/text' }, Body)
@@ -161,12 +162,34 @@ function element(container: HTMLElement, selector: string): HTMLElement {
 }
 
 describe('RightbarSeat presentation', () => {
+  it('keeps a background retained body through standard-source registration and removal', async () => {
+    const h = await mountSeat(1440, true, 0, false, true)
+    const tab = h.open('retained.txt')
+    const body = element(h.view.container, `[data-tab-body="${tab.id}"]`)
+    await act(async () => { await h.runtime.sessions.add({ id: OTHER }) })
+    act(() => { h.selectSession(OTHER) })
+    expect(body.isConnected).toBe(true)
+    let withdraw = () => {}
+    act(() => {
+      withdraw = h.runtime.ctx.uiSession.provide({
+        props: ['sidebarRetentionProbe'],
+        resolve: () => ({ props: { sidebarRetentionProbe: true } }),
+      })
+    })
+    expect(element(h.view.container, `[data-tab-body="${tab.id}"]`)).toBe(body)
+    act(withdraw)
+    expect(element(h.view.container, `[data-tab-body="${tab.id}"]`)).toBe(body)
+    act(() => { h.selectSession(SESSION) })
+    expect(element(h.view.container, `[data-tab-body="${tab.id}"]`)).toBe(body)
+    expect(h.bodies.get(tab.id)?.tab.signal.aborted).toBe(false)
+  })
+
   it('hides for a global main panel and retains the Session sidebar state', async () => {
     const h = await mountSeat()
     h.open('retained.txt')
     const retained = h.layout()
     act(() => { h.runtime.panelInfo.set({ activePanelId: 'other-panel' as MainPanelId }) })
-    expect(h.view.container.querySelector('[data-sidebar-right-panel]')).toBeNull()
+    expect(element(h.view.container, '[data-sidebar-right-session]').hidden).toBe(true)
     expect(h.frame.closeRightbar).toHaveBeenCalled()
     expect(h.layout()).toBe(retained)
     act(() => { h.runtime.panelInfo.set({ activePanelId: null }) })
@@ -182,12 +205,11 @@ describe('RightbarSeat presentation', () => {
     act(() => { h.arm(true) })
     expect(h.opened).toHaveLength(1)
     expect(Object.values(h.layout().tabs).map(tab => tab.contentId)).toEqual(h.opened)
-    // A global panel unmounts both columns and the mounted seat with them.
+    // A global panel hides the Sidebar and releases its public navigation binding.
     act(() => { h.runtime.panelInfo.set({ activePanelId: 'other-panel' as MainPanelId }) })
-    expect(h.view.container.querySelector('[data-sidebar-right-panel]')).toBeNull()
+    expect(element(h.view.container, '[data-sidebar-right-session]').hidden).toBe(true)
     expect(h.controller.mounted.getSnapshot()).toBeUndefined()
-    // Returning mounts both in one commit, the Conversation's effects first; the
-    // opener sees no seat, then the seat's own effect binds and it opens.
+    // The opener waits until the foreground seat republishes its navigation binding.
     act(() => { h.runtime.panelInfo.set({ activePanelId: null }) })
     expect(h.controller.mounted.getSnapshot()).toBe(SESSION)
     expect(h.opened).toHaveLength(2)
@@ -258,7 +280,7 @@ describe('RightbarSeat presentation', () => {
   it('keeps the panel mounted while collapsed and releases the frame on unmount', async () => {
     const h = await mountSeat()
     const panel = element(h.view.container, '[data-sidebar-right-panel]')
-    expect(panel.getAttribute('aria-hidden')).toBe('true')
+    expect(panel.hasAttribute('data-sidebar-right-open')).toBe(false)
     expect(h.frame.closeRightbar).toHaveBeenCalled()
     h.open()
     expect(element(h.view.container, '[data-sidebar-right-panel]')).toBe(panel)
@@ -317,7 +339,7 @@ describe('RightbarSeat presentation', () => {
     expect(panel.style.width).toBe('420px')
     fireEvent.click(element(h.view.container, '[data-sidebar-right-mode]'))
     expect(h.layout().mode).toBe('fullscreen')
-    expect(panel.style.width).toBe('100%')
+    expect(panel.style.width).toBe('100vw')
     expect(panel.dataset['sidebarRightPanel']).toBe('fullscreen')
     expect(element(h.view.container, '[data-tab-body]')).toBe(body)
     expect(h.frame.openRightbar).toHaveBeenLastCalledWith(true, true)
diff --git a/packages/client/ui-sidebar-right/tests/session-views.client.spec.ts b/packages/client/ui-sidebar-right/tests/session-views.client.spec.ts
new file mode 100644
index 0000000000..1c11e825a7
--- /dev/null
+++ b/packages/client/ui-sidebar-right/tests/session-views.client.spec.ts
@@ -0,0 +1,114 @@
+// @vitest-environment jsdom
+import { afterEach, expect, it, vi } from 'vitest'
+import { SlotTestRuntime } from '@deepseek-ai/dsh-client-test-runtime'
+import type { SessionId } from '@deepseek-ai/dsh-session/types'
+import type { TabId } from '@deepseek-ai/dsh-client-ui-dockkit'
+import { SidebarSessionView } from '../src/client/session-view.ts'
+import { SidebarSessionViews } from '../src/client/session-views.ts'
+
+const A = 'a' as SessionId
+const B = 'b' as SessionId
+const TAB = 'tab' as TabId
+const runtimes: SlotTestRuntime[] = []
+const owners: { dispose(): void }[] = []
+
+afterEach(async () => {
+  for (const owner of owners.splice(0)) owner.dispose()
+  for (const runtime of runtimes.splice(0)) await runtime.dispose()
+  vi.restoreAllMocks()
+})
+
+async function runtime() {
+  const runtime = await SlotTestRuntime.create()
+  runtimes.push(runtime)
+  await runtime.sessions.add({ id: A })
+  await runtime.sessions.add({ id: B })
+  return runtime
+}
+
+it('keeps one reference per View until the final committed root of a retired View unmounts', async () => {
+  const r = await runtime()
+  const disposed = vi.fn()
+  const changed = vi.fn()
+  const view = new SidebarSessionView(A, r.sessions, disposed, changed)
+  owners.push(view)
+  await view.reference.ready
+  const release = vi.spyOn(view.reference, 'release')
+  const firstMount = view.mount()
+  const secondMount = view.mount()
+  const first = new AbortController()
+  const second = new AbortController()
+  const firstHold = view.retainTab(TAB, first.signal)
+  const secondHold = view.retainTab(TAB, second.signal)
+  firstHold()
+  firstHold()
+  expect(view.hasRetainedTabs).toBe(true)
+  expect(changed).toHaveBeenCalledOnce()
+  second.abort()
+  secondHold()
+  expect(view.hasRetainedTabs).toBe(false)
+  view.retainTab(TAB, second.signal)()
+  view.retire()
+  firstMount()
+  expect(release).not.toHaveBeenCalled()
+  secondMount()
+  expect(release).toHaveBeenCalledOnce()
+  view.retainTab(TAB, first.signal)()
+  view.dispose()
+  expect(disposed).toHaveBeenCalledExactlyOnceWith(view)
+})
+
+it('retires only unselected Views without retained bodies and rejects released reference identities', async () => {
+  const r = await runtime()
+  const views = new SidebarSessionViews(r.sessions)
+  owners.push(views)
+  views.select(A)
+  const first = views.source.getSnapshot()
+  const a = first[0]!
+  views.select(A)
+  expect(views.source.getSnapshot()).toBe(first)
+  const unmount = views.mount(a.reference)
+  const lifetime = new AbortController()
+  const release = vi.spyOn(a.reference, 'release')
+  a.retainTab(TAB, lifetime.signal)
+  views.select(B)
+  expect(views.source.getSnapshot().map(view => [view.sessionId, view.selected])).toEqual([[A, false], [B, true]])
+  lifetime.abort()
+  expect(views.source.getSnapshot().map(view => view.sessionId)).toEqual([B])
+  expect(release).not.toHaveBeenCalled()
+  unmount()
+  expect(release).toHaveBeenCalledOnce()
+  expect(() => views.mount(a.reference)).toThrow('no longer owned')
+  views.select(undefined)
+  expect(views.source.getSnapshot()).toEqual([])
+  views.dispose()
+  views.select(A)
+  views.mount(a.reference)()
+  expect(views.source.getSnapshot()).toEqual([])
+})
+
+it('reports opening failure and releases Views even when committed roots are still present', async () => {
+  const r = await runtime()
+  const reference = r.sessions.retain(A, { source: 'sidebarView' })
+  const failure = new Error('opening failed')
+  const release = vi.fn(() => { reference.release() })
+  vi.spyOn(r.sessions, 'retain').mockReturnValueOnce({
+    sessionId: reference.sessionId,
+    get binding() { return reference.binding },
+    ready: Promise.reject(failure),
+    release,
+    [Symbol.dispose]: () => { reference.release() },
+  })
+  const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+  const views = new SidebarSessionViews(r.sessions)
+  owners.push(views)
+  views.select(A)
+  const view = views.source.getSnapshot()[0]!
+  const unmount = views.mount(view.reference)
+  await expect(view.reference.ready).rejects.toBe(failure)
+  expect(error).toHaveBeenCalledWith('Sidebar Session opening failed:', failure)
+  views.dispose()
+  expect(release).toHaveBeenCalledOnce()
+  unmount()
+  expect(release).toHaveBeenCalledOnce()
+})
diff --git a/packages/client/ui-sidebar-right/tests/tab-info.client.spec.tsx b/packages/client/ui-sidebar-right/tests/tab-info.client.spec.tsx
index 3f36395704..5ce30f033e 100644
--- a/packages/client/ui-sidebar-right/tests/tab-info.client.spec.tsx
+++ b/packages/client/ui-sidebar-right/tests/tab-info.client.spec.tsx
@@ -40,7 +40,8 @@ function harness() {
     const occurrence = domain.occurrence(SESSION, { id: tabId })
     navigationSources.set(tabId, occurrence.navigation)
     return tabInfoFactory(standard, {
-      tabId, title: false, fullscreen: false, signal: occurrence.signal, actions: occurrence.tabActions, useStore, useTabNavigation,
+      tabId, title: false, fullscreen: false, active: true,
+      signal: occurrence.signal, actions: occurrence.tabActions, useStore, useTabNavigation,
     })
   }
   const open = (beforeCommit?: (tabId: TabId) => void): TabId => {
diff --git a/packages/client/ui-subagent/README.i18n.yaml b/packages/client/ui-subagent/README.i18n.yaml
index 834e8fe5e5..271593d30b 100644
--- a/packages/client/ui-subagent/README.i18n.yaml
+++ b/packages/client/ui-subagent/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-subagent/README.md
-README.md: d1451ea0deecd3d6e39f4ce8a43abdcd3a8603e8
-README.zh.md: e50985cd6934c881beecf4d9ff631af37e3a9297
+README.md: b3dfb4a3aa56dbf240f4b76db410d45cc6ae5651
+README.zh.md: a6ebd6da3c3caba2a3bd015da450b5a33ab79d67
diff --git a/packages/client/ui-subagent/README.md b/packages/client/ui-subagent/README.md
index d1451ea0de..b3dfb4a3aa 100644
--- a/packages/client/ui-subagent/README.md
+++ b/packages/client/ui-subagent/README.md
@@ -25,7 +25,7 @@ Use this package to browse every subagent conversation beneath a parent session,
 <a id="use-this-package"></a>
 ## Use this package
 
-The session header keeps the current session title as the lineage breadcrumb and appends a `/` count trigger when its direct catalog has entries or a read has failed. An absent catalog, an empty loading catalog, or a successfully loaded empty catalog hides the count trigger. The trigger opens that direct catalog, reports its total and running counts, and loads nested catalogs only when their rows expand. Select any depth to open that child's conversation with its exact `{parentSessionId, childSessionId, mode}` address, or use the row's trailing arrow to open the same address in the right Sidebar, preferring a separate pane when room permits.
+The session header keeps the current session title as the lineage breadcrumb; when the session's direct catalog has entries or a read has failed, the descendant-count trigger renders in the header actions band after the task list, with no breadcrumb separator. An absent catalog, an empty loading catalog, or a successfully loaded empty catalog hides the count trigger. The trigger opens that direct catalog, reports its total and running counts, and loads nested catalogs only when their rows expand. Select any depth to open that child's conversation with its exact `{parentSessionId, childSessionId, mode}` address, or use the row's trailing arrow to open the same address in the right Sidebar, preferring a separate pane when room permits.
 
 This package registers the `dsh-resource://subagentchat/session/<child>?parent=<parent>&mode=<mode>` resource and builtin Sidebar tab type. The resource retains the child `SessionReference` directly from its address without refreshing the parent catalog, and releases the reference when the tab record closes. The tab renders the shared `conversation.content` Factory through `sidebar.chat.conversation`, fixes the local View to Chat, and omits the main Conversation header and width controls.
 
diff --git a/packages/client/ui-subagent/README.zh.md b/packages/client/ui-subagent/README.zh.md
index e50985cd69..a6ebd6da3c 100644
--- a/packages/client/ui-subagent/README.zh.md
+++ b/packages/client/ui-subagent/README.zh.md
@@ -25,7 +25,7 @@ kind: "package-reference"
 <a id="use-this-package"></a>
 ## 使用本包
 
-会话页头保留当前会话 title 作为谱系面包屑，并在直接目录有子项或读取失败时追加 `/` 数量触发器。目录缺席、空目录加载中或成功加载为空时，均隐藏数量触发器。触发器打开该直接目录，报告总数与运行数，并且只在行展开时加载嵌套目录。选择任意深度，即可用该子会话的确切 `{parentSessionId, childSessionId, mode}` 地址打开其对话；也可以使用行尾箭头在右侧 Sidebar 打开同一地址，并在空间允许时优先使用独立分栏。
+会话页头把当前会话标题作为谱系面包屑；当会话的直接目录有子项或读取失败时，后代数量触发器渲染在页头操作区、任务列表之后，不带任何面包屑分隔符。目录缺席、空目录加载中或成功加载为空时，均隐藏数量触发器。触发器打开该直接目录，报告总数与运行数，并且只在行展开时加载嵌套目录。选择任意深度，即可用该子会话的确切 `{parentSessionId, childSessionId, mode}` 地址打开其对话；也可以使用行尾箭头在右侧 Sidebar 打开同一地址，并在空间允许时优先使用独立分栏。
 
 本包注册 `dsh-resource://subagentchat/session/<child>?parent=<parent>&mode=<mode>` 资源与 builtin Sidebar tab 类型。资源直接根据地址保留 child 的 `SessionReference`，不刷新 parent 目录，并在 tab 记录关闭时释放 reference。tab 通过 `sidebar.chat.conversation` 渲染共享 `conversation.content` Factory，把局部 View 固定为 Chat，并省略主 Conversation 的 Header 与宽度控制。
 
diff --git a/packages/client/ui-subagent/src/client/SubagentHeaderLineage.module.css b/packages/client/ui-subagent/src/client/SubagentHeaderLineage.module.css
index b9a28a3781..46eda23205 100644
--- a/packages/client/ui-subagent/src/client/SubagentHeaderLineage.module.css
+++ b/packages/client/ui-subagent/src/client/SubagentHeaderLineage.module.css
@@ -55,12 +55,6 @@
   flex: none;
 }
 
-.separator {
-  color: var(--dsw-alias-label-caption);
-  font-size: 14px;
-  line-height: 20px;
-}
-
 .activitySlot {
   display: inline-flex;
   flex: none;
diff --git a/packages/client/ui-subagent/src/client/SubagentHeaderLineage.tsx b/packages/client/ui-subagent/src/client/SubagentHeaderLineage.tsx
index 332ff6bbe9..3f4190c94e 100644
--- a/packages/client/ui-subagent/src/client/SubagentHeaderLineage.tsx
+++ b/packages/client/ui-subagent/src/client/SubagentHeaderLineage.tsx
@@ -401,8 +401,6 @@ function CatalogRows({
 interface CatalogDropdownSharedProps extends SubagentCatalogInjected {
   /** Session whose direct catalog roots the tree. */
   rootSessionId: SessionId
-  /** Whether an ordinary title needs a breadcrumb separator before its count. */
-  separator?: boolean
   useSessions: SubagentHeaderLineageProps['useSessions']
   useSessionStatus: SubagentHeaderLineageProps['useSessionStatus']
   t: TranslateNS<typeof NS>
@@ -445,7 +443,7 @@ function catalogMenuPosition(trigger: HTMLButtonElement): CSSProperties {
 
 /** One trigger-plus-tree dropdown over the catalog rooted at `rootSessionId`. */
 function CatalogDropdown({
-  rootSessionId, currentSessionId, displayTitle, openTitle, variant, separator = false,
+  rootSessionId, currentSessionId, displayTitle, openTitle, variant,
   useSessions, useSessionStatus, openChild, openChildAside, refreshProjection, t,
 }: CatalogDropdownProps) {
   const ancestorSwitcher = variant === 'switcher' && openTitle !== undefined
@@ -645,7 +643,6 @@ function CatalogDropdown({
       onMouseEnter={scheduleHoverOpen}
       onMouseLeave={scheduleHoverClose}
     >
-      {separator && <span className={css.separator}>/</span>}
       <button
         ref={triggerRef}
         type="button"
@@ -721,10 +718,42 @@ function CatalogDropdown({
   )
 }
 
+/** Full props for the root-session catalog entry in the header actions band. */
+export type SubagentCatalogActionProps =
+  PropsRuntime<'conversation.session.header.actions'> & SubagentCatalogInjected & PropsLocale<typeof NS>
+
+/**
+ * Session-header catalog action for root sessions: the descendant count and
+ * its dropdown, ordered after the task list. Child sessions render nothing
+ * here — their breadcrumb switcher in the lineage slot owns the same
+ * navigation.
+ * @param props - Session standard props plus the catalog actions and translator.
+ * @returns The count dropdown, or null on a child session.
+ */
+export function SubagentCatalogAction({
+  sessionId, useSessions, useSessionStatus, openChild, openChildAside, refreshProjection, t,
+}: SubagentCatalogActionProps) {
+  const isChild = useSessions(state => state.byId[sessionId]?.origin === 'subagent')
+  if (isChild) return null
+  return (
+    <CatalogDropdown
+      key={sessionId}
+      rootSessionId={sessionId}
+      variant="count"
+      useSessions={useSessions}
+      useSessionStatus={useSessionStatus}
+      openChild={openChild}
+      openChildAside={openChildAside}
+      refreshProjection={refreshProjection}
+      t={t}
+    />
+  )
+}
+
 /**
  * Render one breadcrumb title together with its subagent navigation.
  * @param props - Breadcrumb title, session standard props, and catalog actions.
- * @returns An ordinary-title direct-child count, or a title-and-chevron sibling switcher.
+ * @returns A title-and-chevron sibling switcher, or nothing on a root session.
  */
 export function SubagentHeaderLineage({
   lineageSessionId, displayTitle, openTitle,
@@ -739,17 +768,9 @@ export function SubagentHeaderLineage({
     return undefined
   })
   const shared = { useSessions, useSessionStatus, openChild, openChildAside, refreshProjection, t }
-  if (parentId === undefined) {
-    return (
-      <CatalogDropdown
-        key={lineageSessionId}
-        rootSessionId={lineageSessionId}
-        variant="count"
-        separator
-        {...shared}
-      />
-    )
-  }
+  // Root sessions carry no breadcrumb; their descendant count lives in the
+  // header actions band (SubagentCatalogAction), after the task list.
+  if (parentId === undefined) return null
   return (
     <>
       <CatalogDropdown
diff --git a/packages/client/ui-subagent/src/client/index.ts b/packages/client/ui-subagent/src/client/index.ts
index 753870747b..fc70c93abf 100644
--- a/packages/client/ui-subagent/src/client/index.ts
+++ b/packages/client/ui-subagent/src/client/index.ts
@@ -3,7 +3,7 @@ import type { Context as ClientContext } from '@deepseek-ai/cordis'
 import type { SubagentAddress } from '@deepseek-ai/dsh-subagent/client'
 import type { SessionId } from '@deepseek-ai/dsh-session/types'
 import type { ComposerChainProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
-import { SubagentHeaderLineage, type SubagentCatalogInjected } from './SubagentHeaderLineage.tsx'
+import { SubagentCatalogAction, SubagentHeaderLineage, type SubagentCatalogInjected } from './SubagentHeaderLineage.tsx'
 import {
   SubagentReadOnlyComposer, type SubagentReadOnlyMatch,
 } from './SubagentReadOnlyComposer.tsx'
@@ -24,7 +24,7 @@ declare module '@deepseek-ai/dsh-client-ui-slots' {
 }
 
 export type {
-  SubagentCatalogInjected, SubagentHeaderLineageProps,
+  SubagentCatalogActionProps, SubagentCatalogInjected, SubagentHeaderLineageProps,
 } from './SubagentHeaderLineage.tsx'
 export type {
   SubagentReadOnlyComposerProps, SubagentReadOnlyMatch,
@@ -79,6 +79,18 @@ export function apply(ctx: ClientContext): void {
       inject: catalogActions,
     }, SubagentHeaderLineage),
   )
+  ctx.slots.inject(
+    'conversation.session.header.actions',
+    () => ctx.slots.register({
+      name: 'conversation.session.header.actions',
+      id: 'subagent-catalog',
+      // After the task list: the preset label leads, running work follows,
+      // and delegation navigation closes the band.
+      order: 30,
+      locale: NS,
+      inject: catalogActions,
+    }, SubagentCatalogAction),
+  )
   ctx.slots.inject(
     'conversation.composer',
     () => ctx.slots.register({
diff --git a/packages/client/ui-subagent/tests/browser-plugin.client.spec.ts b/packages/client/ui-subagent/tests/browser-plugin.client.spec.ts
index 22c94106ea..d5fe68c02b 100644
--- a/packages/client/ui-subagent/tests/browser-plugin.client.spec.ts
+++ b/packages/client/ui-subagent/tests/browser-plugin.client.spec.ts
@@ -35,7 +35,7 @@ const sid = (id: string) => id as SessionId
 function sessionsWith(sessions: SessionSummary[]) {
   const byId: Record<string, SessionSummary> = {}
   for (const s of sessions) byId[s.id] = s
-  const snapshot: SessionListState = { ids: sessions.map(s => s.id), byId, phase: 'ready', projectionsBySession: {}, jobsBySession: {} }
+  const snapshot: SessionListState = { ids: sessions.map(s => s.id), byId, phase: 'ready', projectionsBySession: {} }
   const actionCalls: { method: string; args: unknown[] }[] = []
   const address: SubagentAddress = {
     parentSessionId: sid('parent'),
@@ -64,6 +64,7 @@ async function provideSlotFaces(ctx: Context): Promise<void> {
     name: 'root',
     children: {
       'conversation.session.header.lineage': { kind: 'single', scope: 'session' },
+      'conversation.session.header.actions': { kind: 'list', scope: 'session' },
       'conversation.composer': { kind: 'chain', scope: 'session' },
     },
   } as never, () => null)
@@ -132,6 +133,13 @@ describe('apply', () => {
       { method: 'refreshProjections', args: [sid('parent')] },
     ])
 
+    // The root-session catalog seat registers in the actions band with the
+    // same business face, ordered after the task list.
+    const actionEntry = ctx.slots.entries('conversation.session.header.actions')
+      .find(entry => entry.options.id === 'subagent-catalog')!
+    expect(actionEntry.options.order).toBe(30)
+    expect(actionEntry.inject).toBe(catalogEntry.inject)
+
     const composerEntry = ctx.slots.entries('conversation.composer')
       .find(entry => entry.component === SubagentReadOnlyComposer)!
     const select = composerEntry.select as (owner: ComposerChainProps) => SubagentReadOnlyMatch | null
diff --git a/packages/client/ui-subagent/tests/conversation-ui.client.spec.tsx b/packages/client/ui-subagent/tests/conversation-ui.client.spec.tsx
index c314c6e669..381d7523fb 100644
--- a/packages/client/ui-subagent/tests/conversation-ui.client.spec.tsx
+++ b/packages/client/ui-subagent/tests/conversation-ui.client.spec.tsx
@@ -9,7 +9,8 @@ import type { SubagentAddress, SubagentCatalogRow } from '@deepseek-ai/dsh-subag
 import type { SessionId } from '@deepseek-ai/dsh-session/types'
 import type { SessionStatusSnapshot } from '@deepseek-ai/dsh-client-ui-session/client'
 import {
-  SubagentHeaderLineage, type SubagentHeaderLineageProps,
+  SubagentCatalogAction, SubagentHeaderLineage,
+  type SubagentCatalogActionProps, type SubagentHeaderLineageProps,
 } from '../src/client/SubagentHeaderLineage.tsx'
 import { SubagentReadOnlyComposer } from '../src/client/SubagentReadOnlyComposer.tsx'
 import { zh } from '../src/client/locales.ts'
@@ -75,7 +76,6 @@ function props(
       state: catalog.state, error: catalog.error,
       values: { subagentCatalog: catalog.entries.map(({ activity: _activity, ...entry }) => ({ ...entry, createdAt: 1 })) },
     }])) ,
-    jobsBySession: {},
   } satisfies SessionListState
   function useSessions<T>(select: (snapshot: SessionListState) => T): T {
     return select(state)
@@ -96,6 +96,8 @@ function props(
     useChat: unused,
     useTrajectory: unused,
     inputActions: {
+      captureInsertion: unused,
+      insertText: unused,
       setDraft: unused,
       addAttachments: unused,
       removeAttachment: unused,
@@ -137,6 +139,22 @@ function hoverCatalog(trigger: HTMLElement): void {
   act(() => { vi.advanceTimersByTime(150) })
 }
 
+/**
+ * Both header seats as the real header composes them: the breadcrumb switcher
+ * (child sessions, lineage slot) and the actions-band catalog entry (root
+ * sessions) — exactly one renders per form. The actions seat sees the same
+ * session the lineage renders.
+ */
+function HeaderCatalog(props: SubagentHeaderLineageProps) {
+  const actionProps: SubagentCatalogActionProps = { ...props, sessionId: props.lineageSessionId }
+  return (
+    <>
+      <SubagentHeaderLineage {...props} />
+      <SubagentCatalogAction {...actionProps} />
+    </>
+  )
+}
+
 describe('SubagentHeaderLineage', () => {
   it('shows current catalog-only child status before Host list discovery', () => {
     const input = props(catalog({ entries: [{ id: CHILD, mode: 'continuable', label: 'worker', activity: 'inactive' }] }))
@@ -144,7 +162,7 @@ describe('SubagentHeaderLineage', () => {
     const statuses: SessionStatusSnapshot = new Map([[CHILD, {
       running: true, completionUnread: false, pendingInteraction: undefined,
     }]])
-    render(<SubagentHeaderLineage {...input}
+    render(<HeaderCatalog {...input}
       useSessions={select => select({ ...initial, ids: [] })}
       useSessionStatus={select => select(statuses)}
     />)
@@ -161,13 +179,13 @@ describe('SubagentHeaderLineage', () => {
       ...injected,
       useSessions: select => select({ ...initial, projectionsBySession: projections }),
     }
-    const view = render(<SubagentHeaderLineage {...current} />)
+    const view = render(<HeaderCatalog {...current} />)
     expect(screen.queryByRole('button')).toBeNull()
 
     projections = {
       [PARENT]: { ...initial.projectionsBySession[PARENT]!, state: 'idle' },
     }
-    view.rerender(<SubagentHeaderLineage {...current} />)
+    view.rerender(<HeaderCatalog {...current} />)
     hoverCatalog(screen.getByRole('button'))
     expect(screen.getByRole('treeitem', { name: /worker/ })).toBeTruthy()
     expect(screen.getByRole('treeitem', { name: /reviewer/ })).toBeTruthy()
@@ -192,12 +210,12 @@ describe('SubagentHeaderLineage', () => {
         origin: 'subagent',
       },
     }
-    const view = render(<SubagentHeaderLineage {...props(catalog(), {}, summaries)} />)
+    const view = render(<HeaderCatalog {...props(catalog(), {}, summaries)} />)
 
     const trigger = screen.getByRole('button', { name: '1 个子代理，正在运行' })
     expect(trigger.querySelector('[data-state="ongoing"]')).not.toBeNull()
 
-    view.rerender(<SubagentHeaderLineage {...props(catalog(), {}, {
+    view.rerender(<HeaderCatalog {...props(catalog(), {}, {
       ...summaries, [CHILD]: { ...summaries[CHILD]!, running: false },
     })} />)
     const inactiveTrigger = screen.getByRole('button', { name: '2 个子代理' })
@@ -207,7 +225,7 @@ describe('SubagentHeaderLineage', () => {
   it('does not count Sessions outside projected membership', () => {
     const fork = 'fork' as SessionId
     const forkChild = 'fork-child' as SessionId
-    render(<SubagentHeaderLineage {...props(catalog({
+    render(<HeaderCatalog {...props(catalog({
       entries: [{
         id: CHILD, mode: 'continuable', label: 'worker', activity: 'inactive',
       }],
@@ -226,7 +244,7 @@ describe('SubagentHeaderLineage', () => {
 
   it('renders stable rows and catalog-addressed navigation', () => {
     const input = props(catalog())
-    render(<SubagentHeaderLineage {...input} />)
+    render(<HeaderCatalog {...input} />)
     const trigger = screen.getByRole('button', { name: /1 个子代理，正在运行/ })
     hoverCatalog(trigger)
 
@@ -264,14 +282,14 @@ describe('SubagentHeaderLineage', () => {
       },
     })
     const translate = vi.fn(base.t)
-    render(<SubagentHeaderLineage {...base} t={translate} />)
+    render(<HeaderCatalog {...base} t={translate} />)
 
     expect(translate).toHaveBeenCalledWith('count.running.one', { count: 1 })
     expect(translate).toHaveBeenCalledWith('count.total.one', { count: 1 })
   })
 
   it('removes the disclosure column from branchless catalog levels', () => {
-    render(<SubagentHeaderLineage {...props(catalog({
+    render(<HeaderCatalog {...props(catalog({
       entries: catalog().entries.slice(0, 1),
     }), { [CHILD]: catalog({ entries: [] }) })} />)
     hoverCatalog(screen.getByRole('button', { name: /1 个子代理/ }))
@@ -280,7 +298,7 @@ describe('SubagentHeaderLineage', () => {
   })
 
   it('aligns a known leaf with siblings whose child catalog is still unknown', () => {
-    render(<SubagentHeaderLineage {...props(catalog(), { [CHILD]: catalog({ entries: [] }) })} />)
+    render(<HeaderCatalog {...props(catalog(), { [CHILD]: catalog({ entries: [] }) })} />)
     hoverCatalog(screen.getByRole('button', { name: /1 个子代理，正在运行/ }))
 
     expect(screen.getByRole('treeitem', { name: /worker/ }).children).toHaveLength(2)
@@ -289,7 +307,7 @@ describe('SubagentHeaderLineage', () => {
 
   it('supports trigger/menu keyboard traversal, Escape focus restore, and outside close', async () => {
     const input = props(catalog())
-    render(<SubagentHeaderLineage {...input} />)
+    render(<HeaderCatalog {...input} />)
     const trigger = screen.getByRole('button', { name: /1 个子代理，正在运行/ })
     fireEvent.keyDown(trigger, { key: 'ArrowDown' })
     await Promise.resolve()
@@ -318,7 +336,7 @@ describe('SubagentHeaderLineage', () => {
     const advance = async (duration: number): Promise<void> => {
       await act(async () => { await vi.advanceTimersByTimeAsync(duration) })
     }
-    const view = render(<SubagentHeaderLineage {...props(catalog())} />)
+    const view = render(<HeaderCatalog {...props(catalog())} />)
     const trigger = screen.getByRole('button', { name: /1 个子代理，正在运行/ })
     const triggerRect = vi.spyOn(trigger, 'getBoundingClientRect')
       .mockReturnValue({ bottom: 40, left: 50 } as DOMRect)
@@ -355,7 +373,7 @@ describe('SubagentHeaderLineage', () => {
   })
 
   it('repositions an open catalog after viewport resize and document scroll', () => {
-    const view = render(<SubagentHeaderLineage {...props(catalog())} />)
+    const view = render(<HeaderCatalog {...props(catalog())} />)
     const trigger = screen.getByRole('button', { name: /1 个子代理，正在运行/ })
     const bounds = vi.spyOn(trigger, 'getBoundingClientRect')
     bounds.mockReturnValue({ bottom: 20, left: 30 } as DOMRect)
@@ -378,12 +396,12 @@ describe('SubagentHeaderLineage', () => {
 
   it('cancels a pending hover when the trigger becomes hidden', async () => {
     vi.useFakeTimers()
-    const view = render(<SubagentHeaderLineage {...props(catalog())} />)
+    const view = render(<HeaderCatalog {...props(catalog())} />)
     const trigger = screen.getByRole('button', { name: /1 个子代理，正在运行/ })
 
     fireEvent.mouseEnter(trigger.parentElement!)
     await vi.advanceTimersByTimeAsync(149)
-    view.rerender(<SubagentHeaderLineage {...props(catalog({ entries: [] }))} />)
+    view.rerender(<HeaderCatalog {...props(catalog({ entries: [] }))} />)
     expect(screen.queryByRole('button')).toBeNull()
 
     await vi.advanceTimersByTimeAsync(1)
@@ -405,7 +423,7 @@ describe('SubagentHeaderLineage', () => {
         },
       ],
     }))
-    render(<SubagentHeaderLineage {...input} />)
+    render(<HeaderCatalog {...input} />)
     const trigger = screen.getByRole('button', { name: /1 个子代理，正在运行/ })
     fireEvent.keyDown(trigger, { key: 'Tab' })
     expect(screen.queryByRole('tree')).toBeNull()
@@ -426,7 +444,7 @@ describe('SubagentHeaderLineage', () => {
 
   it('keeps unknown catalog children clickable by their durable parent address', () => {
     const input = props(catalog({ entries: [{ id: CHILD, mode: 'unknown', activity: 'inactive' }] }))
-    render(<SubagentHeaderLineage {...input} />)
+    render(<HeaderCatalog {...input} />)
     hoverCatalog(screen.getByRole('button', { name: /子代理/ }))
     const row = screen.getByRole('treeitem', { name: new RegExp(CHILD) })
     expect(row.textContent).toContain('模式未知')
@@ -506,7 +524,7 @@ describe('SubagentHeaderLineage', () => {
       }]
     })) as Record<SessionId, SessionSummary>
     const input = props(catalog({ entries }), {}, summaries)
-    render(<SubagentHeaderLineage {...input} />)
+    render(<HeaderCatalog {...input} />)
     const trigger = screen.getByRole('button', { name: '1 个子代理，正在运行' })
     expect(within(trigger).getByText('9 个子代理')).toBeTruthy()
     hoverCatalog(trigger)
@@ -560,7 +578,7 @@ describe('SubagentHeaderLineage', () => {
         },
       },
     })
-    render(<SubagentHeaderLineage {...input} />)
+    render(<HeaderCatalog {...input} />)
     hoverCatalog(screen.getByRole('button', { name: '1 个子代理' }))
     const beforeExpand = vi.getTimerCount()
     fireEvent.click(screen.getByRole('button', { name: '展开 worker 的下级子代理' }))
@@ -588,7 +606,7 @@ describe('SubagentHeaderLineage', () => {
       [CHILD]: childCatalog,
       [GRANDCHILD]: grandchildCatalog,
     })
-    render(<SubagentHeaderLineage {...input} />)
+    render(<HeaderCatalog {...input} />)
     hoverCatalog(screen.getByRole('button', { name: /1 个子代理，正在运行/ }))
 
     fireEvent.click(screen.getByRole('button', { name: '展开 worker 的下级子代理' }))
@@ -616,7 +634,7 @@ describe('SubagentHeaderLineage', () => {
       },
     }
     const deferred = props(catalog(), {}, summaries)
-    const view = render(<SubagentHeaderLineage {...deferred} />)
+    const view = render(<HeaderCatalog {...deferred} />)
     hoverCatalog(screen.getByRole('button', { name: /1 个子代理，正在运行/ }))
     fireEvent.click(screen.getByRole('button', { name: '展开 worker 的下级子代理' }))
 
@@ -628,7 +646,7 @@ describe('SubagentHeaderLineage', () => {
     const loading = props(catalog(), {
       [CHILD]: catalog({ entries: [], state: 'loading' }),
     }, summaries)
-    view.rerender(<SubagentHeaderLineage {...loading} />)
+    view.rerender(<HeaderCatalog {...loading} />)
     expect(screen.getByText('正在加载子代理…')).toBeTruthy()
 
     const ready = props(catalog(), {
@@ -645,7 +663,7 @@ describe('SubagentHeaderLineage', () => {
         ],
       }),
     }, summaries)
-    view.rerender(<SubagentHeaderLineage {...ready} />)
+    view.rerender(<HeaderCatalog {...ready} />)
     expect(screen.getByRole('group').getAttribute('aria-busy')).toBeNull()
     expect(screen.getByRole('treeitem', { name: /indexer/ }).querySelector('[data-state="idle"]')).not.toBeNull()
     expect(screen.getByRole('treeitem', { name: /critic/ }).querySelector('[data-state="ongoing"]')).not.toBeNull()
@@ -661,7 +679,7 @@ describe('SubagentHeaderLineage', () => {
         }],
       }),
     })
-    render(<SubagentHeaderLineage {...input} />)
+    render(<HeaderCatalog {...input} />)
     const trigger = screen.getByRole('button', { name: /1 个子代理，正在运行/ })
     fireEvent.keyDown(trigger, { key: 'ArrowDown' })
     await Promise.resolve()
@@ -681,7 +699,7 @@ describe('SubagentHeaderLineage', () => {
         }],
       }),
     })
-    render(<SubagentHeaderLineage {...input} />)
+    render(<HeaderCatalog {...input} />)
     hoverCatalog(screen.getByRole('button', { name: /1 个子代理，正在运行/ }))
     fireEvent.click(screen.getByRole('button', { name: '展开 worker 的下级子代理' }))
     fireEvent.click(screen.getByRole('button', { name: '展开 indexer 的下级子代理' }))
@@ -691,12 +709,12 @@ describe('SubagentHeaderLineage', () => {
   })
 
   it('hides an arrived empty catalog and exposes retry for a failed one', () => {
-    const absent = render(<SubagentHeaderLineage {...props(undefined)} />)
+    const absent = render(<HeaderCatalog {...props(undefined)} />)
     expect(screen.queryByRole('button')).toBeNull()
     absent.unmount()
 
     const empty = props(catalog({ entries: [] }))
-    const view = render(<SubagentHeaderLineage {...empty} />)
+    const view = render(<HeaderCatalog {...empty} />)
     expect(screen.queryByRole('button')).toBeNull()
     view.unmount()
 
@@ -705,7 +723,7 @@ describe('SubagentHeaderLineage', () => {
       state: 'error',
       error: new RemoteError('gateway/internal', 'index down', {}),
     }))
-    render(<SubagentHeaderLineage {...failed} />)
+    render(<HeaderCatalog {...failed} />)
     hoverCatalog(screen.getByRole('button', { name: /0 个子代理/ }))
     expect(screen.getByText('index down')).toBeTruthy()
     fireEvent.click(screen.getByRole('button', { name: /重试/ }))
@@ -723,23 +741,23 @@ describe('SubagentHeaderLineage', () => {
       },
     }
     const absent = props(undefined, {}, summaries)
-    const view = render(<SubagentHeaderLineage {...absent} />)
+    const view = render(<HeaderCatalog {...absent} />)
     expect(screen.queryByRole('button')).toBeNull()
 
     const staleEmpty = props(catalog({ entries: [] }), {}, summaries)
-    view.rerender(<SubagentHeaderLineage {...staleEmpty} />)
+    view.rerender(<HeaderCatalog {...staleEmpty} />)
     expect(screen.queryByRole('button')).toBeNull()
   })
 
   it('hides a bare loading catalog and keeps the error fallback without focusable rows', async () => {
     // A loading snapshot without evidence of children must not flash the action in.
     const loading = props(catalog({ entries: [], state: 'loading' }))
-    const view = render(<SubagentHeaderLineage {...loading} />)
+    const view = render(<HeaderCatalog {...loading} />)
     expect(screen.queryByRole('button')).toBeNull()
     view.unmount()
 
     const failed = props(catalog({ entries: [], state: 'error', error: null }))
-    render(<SubagentHeaderLineage {...failed} />)
+    render(<HeaderCatalog {...failed} />)
     const trigger = screen.getByRole('button', { name: /0 个子代理/ })
     hoverCatalog(trigger)
     expect(screen.getByText('无法加载子代理')).toBeTruthy()
@@ -751,7 +769,7 @@ describe('SubagentHeaderLineage', () => {
 
   it('navigates from outside the tree and tolerates a deferred focus after unmount', async () => {
     const input = props(catalog())
-    const view = render(<SubagentHeaderLineage {...input} />)
+    const view = render(<HeaderCatalog {...input} />)
     const trigger = screen.getByRole('button', { name: /1 个子代理，正在运行/ })
     hoverCatalog(trigger)
     fireEvent.keyDown(screen.getByRole('tree'), { key: 'ArrowUp' })
@@ -770,23 +788,23 @@ describe('SubagentHeaderLineage', () => {
         }],
       }),
     })
-    const view = render(<SubagentHeaderLineage {...populated} />)
+    const view = render(<HeaderCatalog {...populated} />)
     hoverCatalog(screen.getByRole('button', { name: /1 个子代理，正在运行/ }))
     fireEvent.click(screen.getByRole('button', { name: '展开 worker 的下级子代理' }))
 
     const empty = props(catalog({ entries: [] }))
-    view.rerender(<SubagentHeaderLineage {...empty} />)
+    view.rerender(<HeaderCatalog {...empty} />)
     expect(screen.queryByRole('button')).toBeNull()
   })
 
-  it('places a separator before a visible ordinary-session direct-child count', () => {
-    const view = render(<SubagentHeaderLineage {...props(catalog())} />)
+  it('renders an ordinary-session direct-child count in the actions seat with no separator', () => {
+    const view = render(<HeaderCatalog {...props(catalog())} />)
 
-    expect(screen.getByText('/')).toBeTruthy()
+    expect(screen.queryByText('/')).toBeNull()
     expect(screen.getByRole('button', { name: /1 个子代理，正在运行/ })).toBeTruthy()
 
-    view.rerender(<SubagentHeaderLineage {...props(catalog({ entries: [] }))} />)
-    expect(screen.queryByText('/')).toBeNull()
+    view.rerender(<HeaderCatalog {...props(catalog({ entries: [] }))} />)
+    expect(screen.queryByRole('button')).toBeNull()
   })
 
   it('combines the current subagent title and chevron into the parent-catalog trigger', () => {
@@ -804,7 +822,7 @@ describe('SubagentHeaderLineage', () => {
       lineageSessionId: CHILD,
       displayTitle: 'worker',
     }
-    render(<SubagentHeaderLineage {...input} />)
+    render(<HeaderCatalog {...input} />)
 
     const switcher = screen.getByRole('button', { name: '切换子代理：worker' })
     expect(switcher.className).toContain('switcherTrigger')
@@ -837,7 +855,7 @@ describe('SubagentHeaderLineage', () => {
       lineageSessionId: CHILD,
       displayTitle: 'worker',
     }
-    render(<SubagentHeaderLineage {...input} />)
+    render(<HeaderCatalog {...input} />)
 
     expect(screen.queryByRole('button', { name: '切换子代理：worker' })).toBeNull()
   })
@@ -856,7 +874,7 @@ describe('SubagentHeaderLineage', () => {
       lineageSessionId: CHILD,
       displayTitle: 'summary title',
     }
-    render(<SubagentHeaderLineage {...input} />)
+    render(<HeaderCatalog {...input} />)
 
     expect(screen.getByRole('button', { name: `切换子代理：${CHILD}` })).toBeTruthy()
   })
@@ -880,7 +898,7 @@ describe('SubagentHeaderLineage', () => {
       displayTitle: '正在扫描项目文件',
       openTitle: vi.fn(),
     }
-    render(<SubagentHeaderLineage {...input} />)
+    render(<HeaderCatalog {...input} />)
 
     const switcher = screen.getByRole('button', { name: '切换子代理：worker' })
     expect(switcher.className).toContain('ancestorSwitcherTrigger')
@@ -914,7 +932,7 @@ describe('SubagentHeaderLineage', () => {
       displayTitle: '正在扫描项目文件',
       ...(openTitle === undefined ? {} : { openTitle }),
     }
-    render(<SubagentHeaderLineage {...input} />)
+    render(<HeaderCatalog {...input} />)
 
     expect(screen.getByRole('button', { name: '切换子代理：正在扫描项目文件' })).toBeTruthy()
     expect(input.refreshProjection).not.toHaveBeenCalled()
@@ -939,7 +957,7 @@ describe('SubagentHeaderLineage', () => {
       lineageSessionId: GRANDCHILD,
       displayTitle: 'indexer',
     }
-    render(<SubagentHeaderLineage {...input} />)
+    render(<HeaderCatalog {...input} />)
 
     hoverCatalog(screen.getByRole('button', { name: '切换子代理：indexer' }))
 
diff --git a/packages/client/ui-theme/tests/appearance-row.client.spec.tsx b/packages/client/ui-theme/tests/appearance-row.client.spec.tsx
index 6f36e9fe6a..75fcdcd0d2 100644
--- a/packages/client/ui-theme/tests/appearance-row.client.spec.tsx
+++ b/packages/client/ui-theme/tests/appearance-row.client.spec.tsx
@@ -26,7 +26,7 @@ const COPY: Record<string, string> = {
 
 function emptySessions() {
   const store = createSnapshotStore<SessionListState>(
-    { ids: [], byId: {}, phase: 'ready', projectionsBySession: {}, jobsBySession: {} })
+    { ids: [], byId: {}, phase: 'ready', projectionsBySession: {} })
   return bindSnapshotSelector(store)
 }
 function emptyWorkspaces() {
diff --git a/packages/client/ui-theme/tests/font-size-row.client.spec.tsx b/packages/client/ui-theme/tests/font-size-row.client.spec.tsx
index ded9cc0377..f75138b44a 100644
--- a/packages/client/ui-theme/tests/font-size-row.client.spec.tsx
+++ b/packages/client/ui-theme/tests/font-size-row.client.spec.tsx
@@ -28,7 +28,7 @@ const COPY: Record<string, string> = {
 /** Empty global standard-kit hooks (the row reads neither). */
 function emptySessions() {
   const store = createSnapshotStore<SessionListState>(
-    { ids: [], byId: {}, phase: 'ready', projectionsBySession: {}, jobsBySession: {} })
+    { ids: [], byId: {}, phase: 'ready', projectionsBySession: {} })
   return bindSnapshotSelector(store)
 }
 function emptyWorkspaces() {
diff --git a/packages/client/ui-tool/tests/coverage-tails.client.spec.tsx b/packages/client/ui-tool/tests/coverage-tails.client.spec.tsx
index 8254a70476..3f56f5f679 100644
--- a/packages/client/ui-tool/tests/coverage-tails.client.spec.tsx
+++ b/packages/client/ui-tool/tests/coverage-tails.client.spec.tsx
@@ -28,7 +28,7 @@ function listStore() {
       [SID]: { id: SID, title: 'r', displayTitle: 'r', running: false, retainedBy: {}, blank: false, updatedAt: 0 },
     },
     phase: 'ready',
-    projectionsBySession: {}, jobsBySession: {},
+    projectionsBySession: {},
   })
 }
 
diff --git a/packages/client/ui-tool/tests/details-models.client.spec.ts b/packages/client/ui-tool/tests/details-models.client.spec.ts
index 34c355b211..a38c41ff34 100644
--- a/packages/client/ui-tool/tests/details-models.client.spec.ts
+++ b/packages/client/ui-tool/tests/details-models.client.spec.ts
@@ -5,7 +5,7 @@ import type { ToolResultNode } from '@deepseek-ai/dsh-client-ui-chat/client'
 import { makeTranslate } from '@deepseek-ai/dsh-client-test-runtime'
 import { en } from '@deepseek-ai/dsh-client-ui-conversation/src/client/locales.ts'
 import { en as commonEn } from '@deepseek-ai/dsh-client-locale/src/locales/en.ts'
-import { statusLine } from '@deepseek-ai/dsh-tool-jobs/src/index.ts'
+import { statusLine } from '@deepseek-ai/dsh-tool-jobs/src/render.ts'
 import { presentation } from '@deepseek-ai/dsh-tool-session-query/src/presentation.ts'
 import { renderList, renderRead, renderSpawn } from '@deepseek-ai/dsh-tool-terminal/src/render.ts'
 import { formatSpillNotice } from '@deepseek-ai/dsh-spill-policy/notice'
diff --git a/packages/client/ui-tool/tests/diff-card.client.spec.tsx b/packages/client/ui-tool/tests/diff-card.client.spec.tsx
index d1b298c8fd..d7e37d6962 100644
--- a/packages/client/ui-tool/tests/diff-card.client.spec.tsx
+++ b/packages/client/ui-tool/tests/diff-card.client.spec.tsx
@@ -202,7 +202,7 @@ describe('FileMutationRow diff card', () => {
     ids: [SID],
     byId: { [SID]: { id: SID, displayTitle: 'r', running: false, retainedBy: {}, blank: false, updatedAt: 0, cwd: '/w/app' } },
     phase: 'ready',
-    projectionsBySession: {}, jobsBySession: {},
+    projectionsBySession: {},
   })
 
   const rowProps = (block: RunningToolCall | ToolResultNode, toolName = 'edit'): FileMutationRowProps => ({
diff --git a/packages/client/ui-tool/tests/read-card.client.spec.tsx b/packages/client/ui-tool/tests/read-card.client.spec.tsx
index 366c4c69cb..f5ca38418e 100644
--- a/packages/client/ui-tool/tests/read-card.client.spec.tsx
+++ b/packages/client/ui-tool/tests/read-card.client.spec.tsx
@@ -206,7 +206,7 @@ describe('ReadRow keyed toolview', () => {
     ids: [SID],
     byId: { [SID]: { id: SID, displayTitle: 'r', running: false, retainedBy: {}, blank: false, updatedAt: 0, cwd: '/w/app' } },
     phase: 'ready',
-    projectionsBySession: {}, jobsBySession: {},
+    projectionsBySession: {},
   })
 
   const rowProps = (block: RunningToolCall | ToolResultNode): Parameters<typeof ReadRow>[0] => ({
diff --git a/packages/client/ui-tool/tests/terminal-card.client.spec.tsx b/packages/client/ui-tool/tests/terminal-card.client.spec.tsx
index bdeb4ee60e..d1087f7ce2 100644
--- a/packages/client/ui-tool/tests/terminal-card.client.spec.tsx
+++ b/packages/client/ui-tool/tests/terminal-card.client.spec.tsx
@@ -407,7 +407,7 @@ describe('BashRow terminal card', () => {
     ids: [SID],
     byId: { [SID]: { id: SID, displayTitle: 'r', running: false, retainedBy: {}, blank: false, updatedAt: 0 } },
     phase: 'ready',
-    projectionsBySession: {}, jobsBySession: {},
+    projectionsBySession: {},
   })
 
   const rowProps = (block: RunningToolCall | ToolResultNode): BashRowProps => ({
diff --git a/packages/client/ui-trajectory/tests/views.client.spec.tsx b/packages/client/ui-trajectory/tests/views.client.spec.tsx
index ea8641c0e2..ae5097476c 100644
--- a/packages/client/ui-trajectory/tests/views.client.spec.tsx
+++ b/packages/client/ui-trajectory/tests/views.client.spec.tsx
@@ -172,7 +172,7 @@ function standaloneDuration(): Pick<
 /** Empty sessions-list hook; breadcrumbs therefore fall back to the raw id. */
 function emptySessions() {
   const store = createSnapshotStore<SessionListState>(
-    { ids: [], byId: {}, phase: 'ready', projectionsBySession: {}, jobsBySession: {} })
+    { ids: [], byId: {}, phase: 'ready', projectionsBySession: {} })
   return bindSnapshotSelector(store)
 }
 
@@ -214,6 +214,8 @@ function standaloneProps(
     draft: '', attachmentIds: [], draftRev: 0, phase: 'plain', occurrences: [], queue: [],
   })
   const inputActions: InputActions = {
+    captureInsertion: () => ({ start: 0, end: 0, draftRev: 0 }),
+    insertText: () => false,
     setDraft: () => {},
     addAttachments: () => false,
     removeAttachment: () => {},
@@ -339,6 +341,8 @@ function mount(fixture: Awaited<ReturnType<typeof bench>>) {
     draft: '', attachmentIds: [], draftRev: 0, phase: 'plain', occurrences: [], queue: [],
   }))
   const inputActions: InputActions = {
+    captureInsertion: () => ({ start: 0, end: 0, draftRev: 0 }),
+    insertText: () => false,
     setDraft: vi.fn(),
     addAttachments: vi.fn(() => false),
     removeAttachment: vi.fn(),
diff --git a/packages/client/ui-user-questions/tests/plan-review-panel.client.spec.tsx b/packages/client/ui-user-questions/tests/plan-review-panel.client.spec.tsx
index 4daccc5a42..fff2d81a6b 100644
--- a/packages/client/ui-user-questions/tests/plan-review-panel.client.spec.tsx
+++ b/packages/client/ui-user-questions/tests/plan-review-panel.client.spec.tsx
@@ -53,7 +53,6 @@ const sessionList = {
   byId: { [SID]: { id: SID, displayTitle: 'Session', running: false, retainedBy: {}, blank: false, updatedAt: 0 } },
   phase: 'ready' as const,
   projectionsBySession: {},
-  jobsBySession: {},
 }
 const attentionState: AttentionState = new Map()
 const workspaceState = {
@@ -127,6 +126,8 @@ const kit: Omit<QuestionComposerProps, 'matched'> = {
   useProjection: (() => undefined),
   useInput: selector => selector(inputState),
   inputActions: {
+    captureInsertion: () => ({ start: 0, end: 0, draftRev: 0 }),
+    insertText: () => false,
     setDraft: () => { throw new Error('unused') },
     addAttachments: () => { throw new Error('unused') },
     removeAttachment: () => { throw new Error('unused') },
diff --git a/packages/client/ui-user-questions/tests/user-questions-composer.client.spec.tsx b/packages/client/ui-user-questions/tests/user-questions-composer.client.spec.tsx
index e119213f65..ac9fe34d22 100644
--- a/packages/client/ui-user-questions/tests/user-questions-composer.client.spec.tsx
+++ b/packages/client/ui-user-questions/tests/user-questions-composer.client.spec.tsx
@@ -51,7 +51,6 @@ const sessionList = {
   byId: { [SID]: { id: SID, displayTitle: 'Session', running: false, retainedBy: {}, blank: false, updatedAt: 0 } },
   phase: 'ready' as const,
   projectionsBySession: {},
-  jobsBySession: {},
 }
 const attentionState: AttentionState = new Map()
 const workspaceState = {
@@ -125,6 +124,8 @@ const kitBase: Omit<QuestionComposerProps, 'matched' | 'useStore' | 'actions'> =
   useProjection: (() => undefined),
   useInput: selector => selector(inputState),
   inputActions: {
+    captureInsertion: () => ({ start: 0, end: 0, draftRev: 0 }),
+    insertText: () => false,
     setDraft: () => { throw new Error('unused') },
     addAttachments: () => { throw new Error('unused') },
     removeAttachment: () => { throw new Error('unused') },
diff --git a/packages/client/ui-workflow-run/tests/workflow-run.client.spec.tsx b/packages/client/ui-workflow-run/tests/workflow-run.client.spec.tsx
index 5f7df5979e..cd62e634bd 100644
--- a/packages/client/ui-workflow-run/tests/workflow-run.client.spec.tsx
+++ b/packages/client/ui-workflow-run/tests/workflow-run.client.spec.tsx
@@ -307,7 +307,6 @@ const listState = (overrides: Partial<SessionListState> = {}): SessionListState
   projectionsBySession: { [PARENT_ID]: { state: 'ready', error: null, values: { subagentCatalog: [
     { createdAt: 1, id: CHILD_ID, mode: 'one-shot' },
   ] } } },
-  jobsBySession: {},
   ...overrides,
 })
 
@@ -326,6 +325,8 @@ function panelProps(data: WorkflowRunChatData, sessions = listState(), openSessi
     useTrajectory: selector => selector(panelTrajectory),
     useInput: () => { throw new Error('unused') },
     inputActions: {
+      captureInsertion: () => ({ start: 0, end: 0, draftRev: 0 }),
+      insertText: () => false,
       setDraft: () => {},
       addAttachments: () => false,
       removeAttachment: () => {},
diff --git a/packages/client/ui-workspace/tests/apply.client.spec.ts b/packages/client/ui-workspace/tests/apply.client.spec.ts
index b10a212790..7899234773 100644
--- a/packages/client/ui-workspace/tests/apply.client.spec.ts
+++ b/packages/client/ui-workspace/tests/apply.client.spec.ts
@@ -34,7 +34,7 @@ const sessionState = (items: readonly SessionSummary[]): SessionListState => ({
   ids: items.map(item => item.id),
   byId: Object.fromEntries(items.map(item => [item.id, item])),
   phase: 'ready',
-  projectionsBySession: {}, jobsBySession: {},
+  projectionsBySession: {},
 })
 const workspace = (id: string, sessionIds: readonly string[]): WorkspaceView => ({
   workspaceId: id as WorkspaceId, path: `/projects/${id}`, title: id,
diff --git a/packages/client/ui-workspace/tests/session-actions.client.spec.tsx b/packages/client/ui-workspace/tests/session-actions.client.spec.tsx
index bce8cdf2e6..55698968ad 100644
--- a/packages/client/ui-workspace/tests/session-actions.client.spec.tsx
+++ b/packages/client/ui-workspace/tests/session-actions.client.spec.tsx
@@ -48,7 +48,7 @@ const one: SessionSummary = {
   id: ROW.sessionId, displayTitle: ROW.displayTitle, running: false, blank: false, updatedAt: 1, retainedBy: {},
 }
 const sessions: SessionListState = {
-  ids: [one.id], byId: { [one.id]: one }, phase: 'ready', projectionsBySession: {}, jobsBySession: {},
+  ids: [one.id], byId: { [one.id]: one }, phase: 'ready', projectionsBySession: {},
 }
 // The Workspace snapshot lists no pins or archives: an action's membership
 // arrives through its injected Set hooks, never through this seat.
diff --git a/packages/client/ui-workspace/tests/tree.client.spec.ts b/packages/client/ui-workspace/tests/tree.client.spec.ts
index 5072250b20..c8e117488a 100644
--- a/packages/client/ui-workspace/tests/tree.client.spec.ts
+++ b/packages/client/ui-workspace/tests/tree.client.spec.ts
@@ -23,7 +23,7 @@ const summary = (id: string, updatedAt: number, cwd?: string): SessionSummary =>
 const list = (...items: SessionSummary[]): SessionListState => ({
   ids: items.map(item => item.id),
   byId: Object.fromEntries(items.map(item => [item.id, item])),
-  phase: 'ready', projectionsBySession: {}, jobsBySession: {},
+  phase: 'ready', projectionsBySession: {},
 })
 const catalog = (...ids: string[]): SessionProjectionSnapshot => ({
   values: { subagentCatalog: ids.map(id => ({
diff --git a/packages/client/ui-workspace/tests/workspace-browser.client.spec.tsx b/packages/client/ui-workspace/tests/workspace-browser.client.spec.tsx
index 4d7110b1a6..c4c55b612d 100644
--- a/packages/client/ui-workspace/tests/workspace-browser.client.spec.tsx
+++ b/packages/client/ui-workspace/tests/workspace-browser.client.spec.tsx
@@ -49,7 +49,7 @@ const sessionState = (
     ids: items.map(item => item.id),
     byId: Object.fromEntries(items.map(item => [item.id, item])),
     phase: 'ready',
-    projectionsBySession: {}, jobsBySession: {},
+    projectionsBySession: {},
     ...stateOverrides,
   }
   if (main === undefined) return state
diff --git a/packages/client/ui-workspace/tests/workspace-picker.client.spec.tsx b/packages/client/ui-workspace/tests/workspace-picker.client.spec.tsx
index 9ff0181207..4bb54db303 100644
--- a/packages/client/ui-workspace/tests/workspace-picker.client.spec.tsx
+++ b/packages/client/ui-workspace/tests/workspace-picker.client.spec.tsx
@@ -35,7 +35,7 @@ function hook<T>(snapshot: T) {
   return function select<S>(selector: (state: T) => S): S { return selector(snapshot) }
 }
 const sessions: SessionListState = {
-  ids: [], byId: {}, phase: 'ready', projectionsBySession: {}, jobsBySession: {},
+  ids: [], byId: {}, phase: 'ready', projectionsBySession: {},
 }
 const noPendingInteraction: SessionStatusSnapshot = new Map()
 const workspaceState = (items: readonly WorkspaceView[]): WorkspaceSnapshot => ({
diff --git a/packages/client/ui-workspace/tests/workspaces-service.client.spec.ts b/packages/client/ui-workspace/tests/workspaces-service.client.spec.ts
index fd8e77e237..b74a51b3ca 100644
--- a/packages/client/ui-workspace/tests/workspaces-service.client.spec.ts
+++ b/packages/client/ui-workspace/tests/workspaces-service.client.spec.ts
@@ -81,7 +81,6 @@ function sessionState(
     byId: Object.fromEntries(summaries.map(item => [item.id, item])),
     phase,
     projectionsBySession: {},
-    jobsBySession: {},
   }
 }
 
diff --git a/packages/context/file-reference-local/README.i18n.yaml b/packages/context/file-reference-local/README.i18n.yaml
index 1395353c93..8bd8e62df0 100644
--- a/packages/context/file-reference-local/README.i18n.yaml
+++ b/packages/context/file-reference-local/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/context/file-reference-local/README.md
-README.md: efeebdbd3e113597cc93dfe4d6c379e16b324d93
-README.zh.md: f286f92d6e6ec76afc9919db9f81c73e4ace8d04
+README.md: b80f5863e2cae166277d7672085bd1a9742e6cf3
+README.zh.md: 343d0950986df8e071c307314ce2e860168c4308
diff --git a/packages/context/file-reference-local/README.md b/packages/context/file-reference-local/README.md
index efeebdbd3e..b80f5863e2 100644
--- a/packages/context/file-reference-local/README.md
+++ b/packages/context/file-reference-local/README.md
@@ -105,7 +105,7 @@ When the addressed agent has an effective `read` tool, the provider contributes
 ##### File-reference instruction
 
 ```markdown
-Tokens prefixed with @ are workspace paths the user explicitly referenced, relative to the workspace root. A trailing slash marks a directory: list it when its contents matter. Anything else is a file: use the read tool when its contents are needed, and do not claim to have inspected it before reading. @"..." quotes a path containing spaces.
+Tokens prefixed with @ are paths the user explicitly referenced. Relative paths resolve from the workspace root; absolute paths identify files or directories on the host. A trailing slash marks a directory: list it when its contents matter. Anything else is a file: use the read tool when its contents are needed, and do not claim to have inspected it before reading. @"..." quotes a path containing spaces.
 ```
 
 #### Token effect
diff --git a/packages/context/file-reference-local/README.zh.md b/packages/context/file-reference-local/README.zh.md
index f286f92d6e..343d095098 100644
--- a/packages/context/file-reference-local/README.zh.md
+++ b/packages/context/file-reference-local/README.zh.md
@@ -105,7 +105,7 @@ agent（智能体）及宿主 UI 可以用各 agent 本地工作区中经过排
 ##### 文件引用指令
 
 ```markdown
-Tokens prefixed with @ are workspace paths the user explicitly referenced, relative to the workspace root. A trailing slash marks a directory: list it when its contents matter. Anything else is a file: use the read tool when its contents are needed, and do not claim to have inspected it before reading. @"..." quotes a path containing spaces.
+Tokens prefixed with @ are paths the user explicitly referenced. Relative paths resolve from the workspace root; absolute paths identify files or directories on the host. A trailing slash marks a directory: list it when its contents matter. Anything else is a file: use the read tool when its contents are needed, and do not claim to have inspected it before reading. @"..." quotes a path containing spaces.
 ```
 
 #### Token 影响
diff --git a/packages/context/file-reference/README.i18n.yaml b/packages/context/file-reference/README.i18n.yaml
index 404975fb63..6d1e7a991a 100644
--- a/packages/context/file-reference/README.i18n.yaml
+++ b/packages/context/file-reference/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/context/file-reference/README.md
-README.md: ce84a91e96988fb662ee665707d1ce2ad1651327
-README.zh.md: ffdce668dd1b4a5a39a076d6abc998ec6db2ce92
+README.md: 3b759a88bd9ebb59fbf3d039756e66ad6901a893
+README.zh.md: d7dedc46365d70740480167cdfa0432f494d4563
diff --git a/packages/context/file-reference/README.md b/packages/context/file-reference/README.md
index ce84a91e96..3b759a88bd 100644
--- a/packages/context/file-reference/README.md
+++ b/packages/context/file-reference/README.md
@@ -29,7 +29,7 @@ Choose this package when a host-backed UI (web or terminal) should offer `@file`
 
 ### Mention grammar
 
-An `@path` token at the start of input or after whitespace triggers completion; an `@` inside another token, such as an email address, does not. `@"path with spaces"` opens a quoted mention, and a directory candidate keeps that quote open after its trailing slash so completion can descend another level. The formatter rejects paths with control characters or embedded quotes that the grammar cannot represent safely.
+An `@path` token at the start of input or after whitespace triggers completion; an `@` inside another token, such as an email address, does not. `@"path with spaces"` opens a quoted mention, and a directory candidate keeps that quote open after its trailing slash so completion can descend another level. Completed directory chips close the quote after the trailing slash. Relative mentions resolve from the workspace root; absolute mentions retain the host path. The formatter rejects paths with control characters or embedded quotes that the grammar cannot represent safely.
 
 ### Getting candidates
 
diff --git a/packages/context/file-reference/README.zh.md b/packages/context/file-reference/README.zh.md
index ffdce668dd..d7dedc4636 100644
--- a/packages/context/file-reference/README.zh.md
+++ b/packages/context/file-reference/README.zh.md
@@ -29,7 +29,7 @@ kind: "package-reference"
 
 ### mention 语法
 
-输入开头或空白后的 `@path` token 会触发补全；其他 token 内部的 `@`（如电子邮件地址）不会。`@"path with spaces"` 打开带引号的 mention，目录候选在其尾斜杠后保持引号打开，使补全可以继续深入下一层。格式化器会拒绝含有语法无法安全表示的控制字符或内嵌引号的路径。
+输入开头或空白后的 `@path` token 会触发补全；其他 token 内部的 `@`（如电子邮件地址）不会。`@"path with spaces"` 打开带引号的 mention，目录候选在其尾斜杠后保持引号打开，使补全可以继续深入下一层。格式化器会拒绝含有语法无法安全表示的控制字符或内嵌引号的路径。 已完成的目录 chip 在末尾斜杠之后闭合引号。相对引用从工作区根目录解析，绝对引用保留主机路径。
 
 ### 获取候选
 
diff --git a/packages/context/file-reference/src/index.ts b/packages/context/file-reference/src/index.ts
index bf1025714f..d6b30e783e 100644
--- a/packages/context/file-reference/src/index.ts
+++ b/packages/context/file-reference/src/index.ts
@@ -14,7 +14,7 @@ export type { ActiveAtToken } from './grammar.ts'
 export type { FileReferenceCandidate } from './types.ts'
 
 /** Model guidance for path-only references selected by a user interface. */
-export const FILE_REFERENCE_PROMPT = 'Tokens prefixed with @ are workspace paths the user explicitly referenced, relative to the workspace root. A trailing slash marks a directory: list it when its contents matter. Anything else is a file: use the read tool when its contents are needed, and do not claim to have inspected it before reading. @"..." quotes a path containing spaces.'
+export const FILE_REFERENCE_PROMPT = 'Tokens prefixed with @ are paths the user explicitly referenced. Relative paths resolve from the workspace root; absolute paths identify files or directories on the host. A trailing slash marks a directory: list it when its contents matter. Anything else is a file: use the read tool when its contents are needed, and do not claim to have inspected it before reading. @"..." quotes a path containing spaces.'
 
 declare module '@deepseek-ai/cordis' {
   interface Context {
diff --git a/packages/core/system-prompt/src/index.ts b/packages/core/system-prompt/src/index.ts
index 0a5d7555f0..6935ed1d06 100644
--- a/packages/core/system-prompt/src/index.ts
+++ b/packages/core/system-prompt/src/index.ts
@@ -143,7 +143,6 @@ const SECTION_ORDERS = {
   TOOL_LSP: 2200,
   TOOL_SESSION_QUERY: 2300,
   TOOL_GOAL: 2400,
-  TOOL_CORDIS: 2500,
   TOOL_WORKFLOW: 2600,
   TOOL_RALPH: 2700,
   TOOL_SUBAGENT: 2800,
diff --git a/packages/core/system-prompt/tests/system-prompt.spec.ts b/packages/core/system-prompt/tests/system-prompt.spec.ts
index 1d73203062..16a79c807f 100644
--- a/packages/core/system-prompt/tests/system-prompt.spec.ts
+++ b/packages/core/system-prompt/tests/system-prompt.spec.ts
@@ -18,7 +18,7 @@ const SECTION_ORDER_NAMES = [
   'PLAN_POLICY', 'TEAM_POLICY', 'PTC_ONLY', 'FILE_REFERENCE', 'TOOL_BASH',
   'TOOL_PWSH', 'TOOL_READ', 'TOOL_WRITE', 'TOOL_EDIT', 'TOOL_GLOB',
   'TOOL_GREP', 'TOOL_JOBS', 'TOOL_PTY', 'TOOL_WEB_SEARCH', 'TOOL_WEB_FETCH',
-  'TOOL_LSP', 'TOOL_SESSION_QUERY', 'TOOL_GOAL', 'TOOL_CORDIS', 'TOOL_WORKFLOW',
+  'TOOL_LSP', 'TOOL_SESSION_QUERY', 'TOOL_GOAL', 'TOOL_WORKFLOW',
   'TOOL_RALPH', 'TOOL_SUBAGENT', 'TOOL_REPORT', 'TOOLS_SDK',
   'DELIVERABLE_FILE_REFERENCES', 'STRUCTURED_OUTPUT',
   'HARNESS_SOURCE', 'WEB_SURFACE', 'DEPLOYMENT_PERSONA_SUFFIX',
diff --git a/packages/experimental/webworker-packer/README.i18n.yaml b/packages/experimental/webworker-packer/README.i18n.yaml
index 0d9d1a565a..ef7b29f03e 100644
--- a/packages/experimental/webworker-packer/README.i18n.yaml
+++ b/packages/experimental/webworker-packer/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/experimental/webworker-packer/README.md
-README.md: c927fd2f4b3bef3078a263f7b65bb0130898ef5b
-README.zh.md: 2a10a8c0f51f7596d27b8c2ad92a1eeea6715ca8
+README.md: dfb3eccf8343f29c1028dae3a2db22a543675de8
+README.zh.md: 3c528628a8d810db00d9bd8b2c0b64a179faa729
diff --git a/packages/experimental/webworker-packer/README.md b/packages/experimental/webworker-packer/README.md
index c927fd2f4b..dfb3eccf83 100644
--- a/packages/experimental/webworker-packer/README.md
+++ b/packages/experimental/webworker-packer/README.md
@@ -31,7 +31,7 @@ The pack is a three-layer standard stack:
 
 1. **Roster** — the composed profile's plugin rows (standard YAML parse under Include's dialect, `!!js` intact), plus the rows of every config tree the CLI declares in its `package.json` `dsh.configTrees` (agent presets), materialized as a Node-style dependency closure. External peer edges never bind the worker; workspace peers stay on the chain.
 2. **Publish view** — each workspace or vendored package contributes its built npm slice (`files` through picomatch) without source or workspace `dist/`. External packages retain published JavaScript under both `src/` and `dist/` because their `main` or `exports` may point there; only generic test, map, declaration, and archive exclusions apply.
-3. **Reachability sweep** — the runtime loader's own resolution walks from every workspace export face plus the worker assembly's seeds (`IMAGE_ENTRY_SEEDS`), lowering each reached module to the wrapper contract at pack time. The transform reports statically named imports, re-exports, and dynamic imports; calls through `require`; and module-scope direct calls of the form `createRequire(import.meta.url)('pkg')` through a named import from `node:module` or `module`, including an import alias. Page assets (`lib/client.js` behind `./client` exports) ship verbatim; an unresolvable request from our own code fails the pack, third-party ones are tolerated to fail loud at require time.
+3. **Reachability sweep** — the runtime loader's own resolution walks from every non-wildcard workspace runtime export plus the worker assembly's seeds (`IMAGE_ENTRY_SEEDS`), lowering each reached module to the wrapper contract at pack time. Declaration-only condition trees do not seed the sweep; runtime requests for those exports still fail. The transform reports statically named imports, re-exports, and dynamic imports; calls through `require`; and module-scope direct calls of the form `createRequire(import.meta.url)('pkg')` through a named import from `node:module` or `module`, including an import alias. Page assets (`lib/client.js` behind `./client` exports) ship verbatim; an unresolvable request from our own code fails the pack, third-party ones are tolerated to fail loud at require time.
 
 `repository.ts` owns the repo-shaped inputs (workspace scan of `vendor/`, `packages/`, `native/system/packages/`, and `apps/`; profile composition through the real CLI dump path); `pack.ts` owns none of them, so the same library packs a different tree by being called differently. The native scan makes the Landlock entry package an ordinary published-view dependency while its executable remains a Worker platform implementation. The CLI is `dsh-pack-vfs-image --out <file> [--profile web]`; `apps/web`'s `build:preview` runs it after the preview shell build.
 
diff --git a/packages/experimental/webworker-packer/README.zh.md b/packages/experimental/webworker-packer/README.zh.md
index 2a10a8c0f5..3c528628a8 100644
--- a/packages/experimental/webworker-packer/README.zh.md
+++ b/packages/experimental/webworker-packer/README.zh.md
@@ -31,7 +31,7 @@ VFS 镜像打包器：把一份合成 profile 变成浏览器 worker 挂载为
 
 1. **Roster**——合成 profile 的插件行（标准 YAML 解析、Include 方言、`!!js` 原样保留），加上 CLI（命令行界面）在 `package.json` `dsh.configTrees` 里声明的每棵配置树（agent（智能体） presets）的行，按 Node 式依赖闭包物化。外部 peer 边绝不会绑定到 worker，workspace peer 保留在链上。
 2. **发布视图**——每个 workspace 或 vendored 包贡献其构建后的 npm 切片（`files` 走 picomatch），不带源码和 workspace `dist/`。外部包的 `main` 或 `exports` 可能指向 `src/` 或 `dist/`，因此两处发布 JavaScript 都会保留，只应用通用的测试、map、声明与归档排除规则。
-3. **可达性 sweep**——用运行时加载器自己的解析，从全部 workspace 导出面加 worker 装配种子（`IMAGE_ENTRY_SEEDS`）出发，打包时把每个可达模块转换为符合包装层约定的形式。该转换会报告名称可静态确定的 import、re-export 与动态 import、经 `require` 发起的调用，以及通过 `node:module` 或 `module` 具名导入（含导入别名）在模块作用域直接发起的 `createRequire(import.meta.url)('pkg')` 调用。页面资产（`./client` 导出背后的 `lib/client.js`）原样直发；自家代码的不可解析请求会让打包失败，第三方不可解析请求则允许延后到 require 时明确失败。
+3. **可达性 sweep**——用运行时加载器自己的解析, 从全部不含通配符的 workspace 运行时导出加 worker 装配种子 (`IMAGE_ENTRY_SEEDS`) 出发, 打包时把每个可达模块转换为符合包装层约定的形式. 仅含类型声明的条件树不作为扫描入口; 运行时代码请求这些导出仍会失败. 该转换会报告名称可静态确定的 import、re-export 与动态 import、经 `require` 发起的调用, 以及通过 `node:module` 或 `module` 具名导入 (含导入别名) 在模块作用域直接发起的 `createRequire(import.meta.url)('pkg')` 调用. 页面资产 (`./client` 导出背后的 `lib/client.js`) 原样直发; 自家代码的不可解析请求会让打包失败, 第三方不可解析请求则允许延后到 require 时明确失败.
 
 `repository.ts` 拥有仓库形态输入（`vendor/`、`packages/`、`native/system/packages/` 与 `apps/` 的 workspace 扫描；经真 CLI dump 路径合成 profile）；`pack.ts` 一概不拥有，同一库换参即可打另一棵树。Native 扫描使 Landlock 入口包成为普通发布视图依赖，其可执行文件仍由 Worker 平台实现。CLI 为 `dsh-pack-vfs-image --out <file> [--profile web]`；`apps/web` 的 `build:preview` 在预览壳构建后运行它。
 
diff --git a/packages/experimental/webworker-packer/src/pack.ts b/packages/experimental/webworker-packer/src/pack.ts
index 63d37ef6e8..4a065b96e7 100644
--- a/packages/experimental/webworker-packer/src/pack.ts
+++ b/packages/experimental/webworker-packer/src/pack.ts
@@ -349,6 +349,15 @@ function debuggerNamer(workspaces: ReadonlyMap<string, string>, resolveFrom: str
   }
 }
 
+/** Declaration-only condition trees add no runtime roots; explicit imports still resolve normally. */
+function isDeclarationOnlyExport(value: unknown): boolean {
+  if (typeof value !== 'object' || value === null) return false
+  if (Array.isArray(value)) return value.length > 0 && value.every(isDeclarationOnlyExport)
+  const conditions = Object.entries(value)
+  return conditions.length > 0 && conditions.every(([condition, target]) =>
+    condition === 'types' || condition.startsWith('types@') || isDeclarationOnlyExport(target))
+}
+
 function sweepImage(
   files: ImageFiles,
   options: PackOptions,
@@ -383,11 +392,13 @@ function sweepImage(
     } catch {
       continue
     }
-    // Every non-wildcard face is a root; a face resolving onto a page asset is
-    // kept untransformed below rather than excluded here.
+    // Every non-wildcard runtime face is a root; a face resolving onto a page
+    // asset is kept untransformed below rather than excluded here.
     const subpaths = manifest.exports === undefined
       ? ['.']
-      : Object.keys(manifest.exports).filter(key => key.startsWith('.') && !key.includes('*'))
+      : Object.entries(manifest.exports)
+        .filter(([key, target]) => key.startsWith('.') && !key.includes('*') && !isDeclarationOnlyExport(target))
+        .map(([key]) => key)
     for (const subpath of subpaths) {
       queue.push({ specifier: subpath === '.' ? name : `${name}/${subpath.slice(2)}`, from: root, importer: `workspace face ${name}` })
     }
diff --git a/packages/experimental/webworker-packer/tests/built-lib.e2e.ts b/packages/experimental/webworker-packer/tests/built-lib.e2e.ts
index 87ed0e83f1..e945c60c8c 100644
--- a/packages/experimental/webworker-packer/tests/built-lib.e2e.ts
+++ b/packages/experimental/webworker-packer/tests/built-lib.e2e.ts
@@ -87,6 +87,23 @@ it('loads both tarballs through plain Node and mounts their base image and overl
     assert.equal(readFileSync(worker, 'utf8').match(/^import[ \\t]/m), null)
     const base = packer.packVfsImage({ config: '[]\\n', profile: 'packed-consumer', workspaces: new Map(), resolveFrom: process.cwd(), entries: [] })
     assert.deepEqual(base.missing, [])
+    mkdirSync('subject/lib', { recursive: true })
+    const subject = '@deepseek-ai/dsh-image-export-fixture'
+    writeFileSync('subject/package.json', JSON.stringify({ name: subject, files: ['lib'], exports: {
+      '.': { default: './lib/index.js' }, './types': { types: './lib/index.d.ts' },
+    } }))
+    writeFileSync('subject/lib/index.js', 'export const value = 1')
+    writeFileSync('subject/lib/index.d.ts', 'export declare const value: number')
+    const typedOptions = { config: '- id: subject\\n  name: "' + subject + '"\\n', profile: 'typed-consumer',
+      workspaces: new Map([[subject, fileURLToPath(new URL('./subject', import.meta.url))]]),
+      resolveFrom: process.cwd(), entries: [] }
+    const typed = packer.packVfsImage(typedOptions)
+    assert.deepEqual(typed.missing, [])
+    assert.ok(Object.hasOwn(typed.files, 'node_modules/' + subject + '/lib/index.js'))
+    assert.equal(Object.hasOwn(typed.files, 'node_modules/' + subject + '/lib/index.d.ts'), false)
+    writeFileSync('subject/lib/index.js', 'export { value } from "' + subject + '/types"')
+    assert.throws(() => packer.packVfsImage(typedOptions),
+      error => error instanceof Error && error.message.includes('does not export "./types"'))
     const vfs = runtime.loadVfsImage(await runtime.inflateImage(base.image, 'packed base'))
     assert.ok(vfs.existsSync('/dsh/' + packer.MANIFEST_PATH))
     mkdirSync('overlay')
diff --git a/packages/experimental/webworker-packer/tests/exports.spec.ts b/packages/experimental/webworker-packer/tests/exports.spec.ts
new file mode 100644
index 0000000000..b34b157d49
--- /dev/null
+++ b/packages/experimental/webworker-packer/tests/exports.spec.ts
@@ -0,0 +1,69 @@
+/** Runtime reachability ignores declaration-only export roots, not runtime requests. */
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, it, type TestContext } from 'vitest'
+import { packVfsImage, type PackOptions } from '../src/pack.ts'
+
+const SUBJECT = '@deepseek-ai/dsh-image-export-fixture'
+
+function fixture(test: TestContext, face: unknown, source = 'export const value = 1'): PackOptions {
+  const root = mkdtempSync(join(tmpdir(), 'dsh-image-exports-'))
+  test.onTestFinished(() => { rmSync(root, { recursive: true, force: true }) })
+  mkdirSync(join(root, 'lib'))
+  writeFileSync(join(root, 'package.json'), JSON.stringify({
+    name: SUBJECT,
+    type: 'module',
+    files: ['lib'],
+    exports: {
+      '.': { types: './lib/index.d.ts', default: './lib/index.js' },
+      './contract': face,
+    },
+  }))
+  writeFileSync(join(root, 'lib/index.js'), source)
+  writeFileSync(join(root, 'lib/index.d.ts'), 'export declare const value: number')
+  writeFileSync(join(root, 'lib/contract.js'), 'export const value = 2')
+  return {
+    config: `- id: subject\n  name: '${SUBJECT}'\n`,
+    profile: 'export-check',
+    workspaces: new Map([[SUBJECT, root]]),
+    resolveFrom: root,
+    entries: [],
+  }
+}
+
+it.for([
+  { types: './lib/index.d.ts' },
+  { 'types@>=5.2': './lib/index.d.ts' },
+  { browser: { types: './lib/index.d.ts' } },
+  [{ types: './lib/index.d.ts' }],
+])('packs a declaration-only export without requesting a runtime entry: %j', (face, test) => {
+  const result = packVfsImage(fixture(test, face))
+  expect(result.missing).toEqual([])
+  expect(Object.keys(result.files)).toContain(`node_modules/${SUBJECT}/lib/index.js`)
+  expect(Object.keys(result.files)).not.toContain(`node_modules/${SUBJECT}/lib/index.d.ts`)
+  expect(Object.keys(result.files)).not.toContain(`node_modules/${SUBJECT}/lib/contract.js`)
+})
+
+it.for([
+  { types: './lib/index.d.ts', default: './lib/contract.js' },
+  [{ types: './lib/index.d.ts' }, './lib/contract.js'],
+])('retains the runtime target beside a types condition: %j', (face, test) => {
+  const result = packVfsImage(fixture(test, face))
+  expect(Object.keys(result.files)).toContain(`node_modules/${SUBJECT}/lib/contract.js`)
+})
+
+it('rejects a runtime import of a declaration-only export', (test) => {
+  const options = fixture(test, { types: './lib/index.d.ts' }, `export { value } from '${SUBJECT}/contract'`)
+  expect(() => packVfsImage(options)).toThrow('does not export "./contract"')
+})
+
+it('rejects an assembly entry that requests a declaration-only export', (test) => {
+  const options = fixture(test, { types: './lib/index.d.ts' })
+  expect(() => packVfsImage({ ...options, entries: [`${SUBJECT}/contract`] })).toThrow('worker assembly entry')
+})
+
+it('rejects a missing runtime target beside a types condition', (test) => {
+  const options = fixture(test, { types: './lib/index.d.ts', default: './lib/missing.js' })
+  expect(() => packVfsImage(options)).toThrow('cannot resolve')
+})
diff --git a/packages/extensions/cordis-client-runner/src/client/slot-catalog.ts b/packages/extensions/cordis-client-runner/src/client/slot-catalog.ts
index 73647081a7..af3043fd78 100644
--- a/packages/extensions/cordis-client-runner/src/client/slot-catalog.ts
+++ b/packages/extensions/cordis-client-runner/src/client/slot-catalog.ts
@@ -406,7 +406,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.composer\', () => ctx.slots.register(\n      { name: \'conversation.composer\', select: owner => null },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:183',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:187',
   },
   {
     key: 'conversation.composer.bar',
@@ -445,7 +445,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'shadows-shipped-ui',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.composer.bar\', () => ctx.slots.register(\n      { name: \'conversation.composer.bar\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:201',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:207',
   },
   {
     key: 'conversation.composer.dock',
@@ -501,7 +501,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.composer.dock\', () => ctx.slots.register(\n      { name: \'conversation.composer.dock\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:195',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:199',
   },
   {
     key: 'conversation.header',
@@ -536,7 +536,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'shadows-shipped-ui',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.header\', () => ctx.slots.register(\n      { name: \'conversation.header\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:135',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:139',
   },
   {
     key: 'conversation.header.leading',
@@ -565,7 +565,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     occupants: [],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.header.leading\', () => ctx.slots.register(\n      { name: \'conversation.header.leading\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:164',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:168',
   },
   {
     key: 'conversation.hero.agentPreset',
@@ -602,7 +602,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'shadows-shipped-ui',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.hero.agentPreset\', () => ctx.slots.register(\n      { name: \'conversation.hero.agentPreset\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:189',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:193',
   },
   {
     key: 'conversation.hero.brand.mark',
@@ -631,7 +631,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     occupants: [],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.hero.brand.mark\', () => ctx.slots.register(\n      { name: \'conversation.hero.brand.mark\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:187',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:191',
   },
   {
     key: 'conversation.hero.workspace',
@@ -664,7 +664,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'shadows-shipped-ui',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.hero.workspace\', () => ctx.slots.register(\n      { name: \'conversation.hero.workspace\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:185',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:189',
   },
   {
     key: 'conversation.hero.workspace.directoryFlow',
@@ -698,6 +698,45 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.hero.workspace.directoryFlow\', () => ctx.slots.register(\n      { name: \'conversation.hero.workspace.directoryFlow\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
     source: 'packages/client/ui-workspace/src/client/contract/slots.ts:99',
   },
+  {
+    key: 'conversation.input.activity',
+    kind: 'single',
+    scope: 'session',
+    summary: 'Compact action after the model selector; it can expand across the toolbar while retaining the editor and submit action.',
+    doc: 'Compact action after the model selector; it can expand across the toolbar while retaining the editor and submit action.',
+    registerOptions: [],
+    ownerProps: [
+      '/** A toolbar activity hides ordinary accessory controls while expanded; its occupant must release expansion on unmount. */\nexport interface InputActivityOwnerProps extends InputControlOwnerProps {\n  /** @param active - whether the occupant needs the toolbar width before the submit action. */\n  onActiveChange: (active: boolean) => void\n}',
+    ],
+    ownerPropsReferences: [
+      'InputControlOwnerProps',
+    ],
+    standardProps: [
+      'useResource: UseResource',
+      'useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>',
+      'usePanelInfo: UsePanelInfo',
+      'useSessions: UseSessions',
+      'useSessionStatus: UseSessionStatus',
+      'useSessionRetainInfo: UseSessionRetainInfo',
+      'useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>',
+      'useChat: UseChat',
+      'useConversation: UseConversation',
+      'useInput: SnapshotSelectorHook<InputState>',
+      'inputActions: InputActions',
+      'useSession: SessionSnapshotSelector',
+      'sessionId: SessionId',
+      'useProjection: UseProjection',
+      'useTrajectory: UseTrajectory',
+    ],
+    keyDomain: '',
+    hookContext: '',
+    slotInject: '',
+    declaredBy: 'an entry in \'conversation.composer.bar\' (client-ui-conversation), so it exists while that entry is mounted',
+    occupants: [],
+    replaceRisk: 'none',
+    example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.input.activity\', () => ctx.slots.register(\n      { name: \'conversation.input.activity\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:205',
+  },
   {
     key: 'conversation.input.attachments',
     kind: 'single',
@@ -706,7 +745,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     doc: 'Optional draft-attachment rail and drop target.',
     registerOptions: [],
     ownerProps: [
-      '/** Input state handed to the optional attachment presentation plugin. */\nexport interface ComposerAttachmentsOwnerProps {\n  /** Browser-owned draft attachments in input order. */\n  attachments: readonly ComposerAttachment[]\n  /** Whether a document-level file drop may add attachments now. */\n  canAcceptDrop: boolean\n  /** Add one dropped batch through the composer\'s validation path. */\n  onAddFiles: (files: readonly File[]) => void\n  /** Remove one draft attachment through the Conversation service. */\n  onRemoveAttachment: (id: DraftAttachmentId) => void\n  /** Current per-draft upload states for file-kind attachments. */\n  uploads: DraftFileUploads\n  /** Restart one failed file upload. */\n  onRetryFile: (id: DraftAttachmentId) => void\n  /** Display-ready limits for the drop invitation. */\n  dropLimits?: { readonly count: number; readonly size: string } | undefined\n}',
+      '/** Input state handed to the optional attachment presentation plugin. */\nexport interface ComposerAttachmentsOwnerProps {\n  /** Browser-owned draft attachments in input order. */\n  attachments: readonly ComposerAttachment[]\n  /** Whether a document-level file drop may add attachments now. */\n  canAcceptDrop: boolean\n  /**\n   * Add one dropped batch through the composer\'s validation path.\n   * @param files - dropped, pasted, or picked browser files in source order.\n   * @param directories - members of `files` the drop source identified as directories.\n   */\n  onAddFiles: (files: readonly File[], directories?: ReadonlySet<File>) => void\n  /** Remove one draft attachment through the Conversation service. */\n  onRemoveAttachment: (id: DraftAttachmentId) => void\n  /** Current per-draft upload states for file-kind attachments. */\n  uploads: DraftFileUploads\n  /** Restart one failed file upload. */\n  onRetryFile: (id: DraftAttachmentId) => void\n  /** Display-ready limits for the drop invitation. */\n  dropLimits?: { readonly count: number; readonly size: string } | undefined\n}',
     ],
     ownerPropsReferences: [
       'ComposerAttachment',
@@ -737,7 +776,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'shadows-shipped-ui',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.input.attachments\', () => ctx.slots.register(\n      { name: \'conversation.input.attachments\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:203',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:209',
   },
   {
     key: 'conversation.input.dock',
@@ -800,7 +839,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.input.dock\', () => ctx.slots.register(\n      { name: \'conversation.input.dock\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:191',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:195',
   },
   {
     key: 'conversation.input.left',
@@ -854,7 +893,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     occupants: [],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.input.left\', () => ctx.slots.register(\n      { name: \'conversation.input.left\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:197',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:201',
   },
   {
     key: 'conversation.input.model',
@@ -893,7 +932,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'shadows-shipped-ui',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.input.model\', () => ctx.slots.register(\n      { name: \'conversation.input.model\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:213',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:219',
   },
   {
     key: 'conversation.input.overlay',
@@ -951,7 +990,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.input.overlay\', () => ctx.slots.register(\n      { name: \'conversation.input.overlay\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:193',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:197',
   },
   {
     key: 'conversation.input.permission',
@@ -990,7 +1029,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'shadows-shipped-ui',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.input.permission\', () => ctx.slots.register(\n      { name: \'conversation.input.permission\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:211',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:217',
   },
   {
     key: 'conversation.input.plan',
@@ -1029,7 +1068,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'shadows-shipped-ui',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.input.plan\', () => ctx.slots.register(\n      { name: \'conversation.input.plan\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:209',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:215',
   },
   {
     key: 'conversation.input.right',
@@ -1083,7 +1122,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     occupants: [],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.input.right\', () => ctx.slots.register(\n      { name: \'conversation.input.right\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:199',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:203',
   },
   {
     key: 'conversation.message.images',
@@ -1221,7 +1260,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'shadows-shipped-ui',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.session\', () => ctx.slots.register(\n      { name: \'conversation.session\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:129',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:133',
   },
   {
     key: 'conversation.session.header',
@@ -1258,7 +1297,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'shadows-shipped-ui',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.session.header\', () => ctx.slots.register(\n      { name: \'conversation.session.header\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:137',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:141',
   },
   {
     key: 'conversation.session.header.actions',
@@ -1315,11 +1354,12 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
       'client-ui-agent-preset AgentPresetLabel id \'agent-preset\'',
       'client-ui-jobs JobListAction id \'job-list\'',
       'client-ui-schedule ScheduleCatalogAction id \'schedule-catalog\'',
+      'client-ui-subagent SubagentCatalogAction id \'subagent-catalog\'',
       'experimental-client-ui-agent-team TeamAction id \'agent-team\'',
     ],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.session.header.actions\', () => ctx.slots.register(\n      { name: \'conversation.session.header.actions\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:152',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:156',
   },
   {
     key: 'conversation.session.header.corner',
@@ -1358,7 +1398,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'shadows-shipped-ui',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.session.header.corner\', () => ctx.slots.register(\n      { name: \'conversation.session.header.corner\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:175',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:179',
   },
   {
     key: 'conversation.session.header.lineage',
@@ -1399,7 +1439,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'shadows-shipped-ui',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.session.header.lineage\', () => ctx.slots.register(\n      { name: \'conversation.session.header.lineage\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:146',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:150',
   },
   {
     key: 'conversation.session.header.utilities',
@@ -1458,7 +1498,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.session.header.utilities\', () => ctx.slots.register(\n      { name: \'conversation.session.header.utilities\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:158',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:162',
   },
   {
     key: 'conversation.trajectory.images',
@@ -1562,7 +1602,126 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.view\', () => ctx.slots.register(\n      { name: \'conversation.view\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:181',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:185',
+  },
+  {
+    key: 'deliverables.file.actions',
+    kind: 'list',
+    scope: 'session',
+    summary: 'Open one file through its authorized Session event coordinates.',
+    doc: 'Open one file through its authorized Session event coordinates.',
+    registerOptions: [
+      {
+        name: 'id',
+        requirement: 'required',
+        type: 'string',
+        doc: 'Your cell key. Use an id of your own: a fresh id is added beside the shipped entries, while reusing a shipped id puts you in THAT cell and replaces it. Owners that filter by id address you by it.',
+      },
+      {
+        name: 'order',
+        requirement: 'optional',
+        type: 'number',
+        doc: 'Position among the entries, ascending (default 0).',
+      },
+      {
+        name: 'label',
+        requirement: 'optional',
+        type: 'string | (() => string)',
+        doc: 'Display text where the owner projects one (nav rows, tabs). A thunk is re-read on every projection, so localized text follows the active locale without re-registering.',
+      },
+    ],
+    ownerProps: [
+      '/** Native file action selected by an explicit user gesture. */\nexport type PresentedAction = \'open\' | \'reveal\'',
+      '/** Failure feedback for the shared native opening control. */\nexport type PresentedOpenFailure = \'openError\' | \'revealError\' | null',
+    ],
+    ownerPropsReferences: [],
+    standardProps: [
+      'useResource: UseResource',
+      'useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>',
+      'usePanelInfo: UsePanelInfo',
+      'useSessions: UseSessions',
+      'useSessionStatus: UseSessionStatus',
+      'useSessionRetainInfo: UseSessionRetainInfo',
+      'useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>',
+      'useChat: UseChat',
+      'useConversation: UseConversation',
+      'useInput: SnapshotSelectorHook<InputState>',
+      'inputActions: InputActions',
+      'useSession: SessionSnapshotSelector',
+      'sessionId: SessionId',
+      'useProjection: UseProjection',
+      'useTrajectory: UseTrajectory',
+    ],
+    keyDomain: '',
+    hookContext: '',
+    slotInject: '',
+    declaredBy: 'an entry in \'conversation.chat.turnTail\' (client-ui-deliverables), so it exists while that entry is mounted',
+    occupants: [
+      'client-ui-open-in-app FileRouteAction id \'open-in-app\'',
+    ],
+    replaceRisk: 'none',
+    example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'deliverables.file.actions\', () => ctx.slots.register(\n      { name: \'deliverables.file.actions\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
+    source: 'packages/client/ui-deliverables/src/client/file-actions.ts:8',
+  },
+  {
+    key: 'deliverables.review.file.actions',
+    kind: 'list',
+    scope: 'session',
+    summary: 'The same file actions owned by a changed-file review tab.',
+    doc: 'The same file actions owned by a changed-file review tab.',
+    registerOptions: [
+      {
+        name: 'id',
+        requirement: 'required',
+        type: 'string',
+        doc: 'Your cell key. Use an id of your own: a fresh id is added beside the shipped entries, while reusing a shipped id puts you in THAT cell and replaces it. Owners that filter by id address you by it.',
+      },
+      {
+        name: 'order',
+        requirement: 'optional',
+        type: 'number',
+        doc: 'Position among the entries, ascending (default 0).',
+      },
+      {
+        name: 'label',
+        requirement: 'optional',
+        type: 'string | (() => string)',
+        doc: 'Display text where the owner projects one (nav rows, tabs). A thunk is re-read on every projection, so localized text follows the active locale without re-registering.',
+      },
+    ],
+    ownerProps: [
+      '/** Slot contract table. Owners extend via declaration merging; entries are {@link SlotEntryDef}. */\nexport interface SlotMap {}',
+    ],
+    ownerPropsReferences: [
+      'SlotEntryDef',
+    ],
+    standardProps: [
+      'useResource: UseResource',
+      'useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>',
+      'usePanelInfo: UsePanelInfo',
+      'useSessions: UseSessions',
+      'useSessionStatus: UseSessionStatus',
+      'useSessionRetainInfo: UseSessionRetainInfo',
+      'useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>',
+      'useChat: UseChat',
+      'useConversation: UseConversation',
+      'useInput: SnapshotSelectorHook<InputState>',
+      'inputActions: InputActions',
+      'useSession: SessionSnapshotSelector',
+      'sessionId: SessionId',
+      'useProjection: UseProjection',
+      'useTrajectory: UseTrajectory',
+    ],
+    keyDomain: '',
+    hookContext: '',
+    slotInject: '',
+    declaredBy: 'an entry in \'sidebar.right.pane.tab\' (client-ui-deliverables), so it exists while that entry is mounted',
+    occupants: [
+      'client-ui-open-in-app FileRouteAction id \'open-in-app\'',
+    ],
+    replaceRisk: 'none',
+    example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'deliverables.review.file.actions\', () => ctx.slots.register(\n      { name: \'deliverables.review.file.actions\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
+    source: 'packages/client/ui-deliverables/src/client/file-actions.ts:21',
   },
   {
     key: 'main',
@@ -1634,7 +1793,43 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'shadows-shipped-ui',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'main.conversation\', () => ctx.slots.register(\n      { name: \'main.conversation\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:127',
+    source: 'packages/client/ui-conversation/src/client/contract/slots.ts:131',
+  },
+  {
+    key: 'plugins.bundle.activation',
+    kind: 'keyed',
+    scope: 'root',
+    summary: 'Optional guidance after the user enables a bundle from the list, keyed by npm package name.',
+    doc: 'Optional guidance after the user enables a bundle from the list, keyed by npm package name.',
+    registerOptions: [
+      {
+        name: 'key',
+        requirement: 'required',
+        type: 'string',
+        doc: 'Your cell key: the entry renders where the owner dispatches this exact key. Registering an already-occupied key replaces that occupant.',
+      },
+    ],
+    ownerProps: [
+      '/** One user-requested bundle activation and navigation to its configuration page. */\nexport interface PluginActivationOwnerProps {\n  readonly packageName: string\n  /** Dismiss guidance for this activation. */\n  readonly onDismiss: () => void\n  /** Dismiss guidance and open this bundle\'s detail page. */\n  readonly onOpenDetails: () => void\n}',
+    ],
+    ownerPropsReferences: [],
+    standardProps: [
+      'useResource: UseResource',
+      'useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>',
+      'usePanelInfo: UsePanelInfo',
+      'useSessions: UseSessions',
+      'useSessionStatus: UseSessionStatus',
+      'useSessionRetainInfo: UseSessionRetainInfo',
+      'useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>',
+    ],
+    keyDomain: 'open: any string the owner dispatches (no compile-time key set), none are taken yet',
+    hookContext: '',
+    slotInject: '',
+    declaredBy: 'an entry in \'main\' (client-ui-plugin-manager), so it exists while that entry is mounted',
+    occupants: [],
+    replaceRisk: 'none',
+    example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'plugins.bundle.activation\', () => ctx.slots.register(\n      { name: \'plugins.bundle.activation\', key: \'<one key the owner dispatches>\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
+    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:34',
   },
   {
     key: 'plugins.bundle.config',
@@ -1670,7 +1865,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     occupants: [],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'plugins.bundle.config\', () => ctx.slots.register(\n      { name: \'plugins.bundle.config\', key: \'<one key the owner dispatches>\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:39',
+    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:50',
   },
   {
     key: 'plugins.item',
@@ -1723,7 +1918,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'plugins.item\', () => ctx.slots.register(\n      { name: \'plugins.item\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:33',
+    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:44',
   },
   {
     key: 'plugins.row.config',
@@ -1759,7 +1954,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     occupants: [],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'plugins.row.config\', () => ctx.slots.register(\n      { name: \'plugins.row.config\', key: \'<one key the owner dispatches>\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:47',
+    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:58',
   },
   {
     key: 'rightbar',
@@ -1801,8 +1996,11 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     registerOptions: [],
     ownerProps: [
       '/** Right column owner share: resolved normal geometry and opening eligibility. */\nexport interface RightbarOwnerProps {\n  /** Resolved normal panel width in px, not the saved preference; zero if it cannot fit. */\n  width: number\n  /** Current frame width in px. */\n  viewportWidth: number\n  /**\n   * Whether a normal right panel can retain 300px beside a 400px center.\n   * Before a narrow opening, includes the space from collapsing the left sidebar.\n   */\n  canShow: boolean\n}',
+      '/** Identity of one open tab; distinct copies of one content share `contentId`, never `TabId`. */\nexport type TabId = Branded<\'TabId\'>',
+    ],
+    ownerPropsReferences: [
+      'Branded',
     ],
-    ownerPropsReferences: [],
     standardProps: [
       'useResource: UseResource',
       'useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>',
@@ -2661,7 +2859,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'sidebar.right.pane.tab\', () => ctx.slots.register(\n      { name: \'sidebar.right.pane.tab\', key: \'<one key the owner dispatches>\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-sidebar-right/src/client/contract/slots.ts:50',
+    source: 'packages/client/ui-sidebar-right/src/client/contract/slots.ts:58',
   },
   {
     key: 'sidebar.right.pane.tab.title',
@@ -2710,7 +2908,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'sidebar.right.pane.tab.title\', () => ctx.slots.register(\n      { name: \'sidebar.right.pane.tab.title\', key: \'<one key the owner dispatches>\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-sidebar-right/src/client/contract/slots.ts:64',
+    source: 'packages/client/ui-sidebar-right/src/client/contract/slots.ts:72',
   },
   {
     key: 'sidebar.right.tab.document',
@@ -3014,7 +3212,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     occupants: [],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'sidebar.right.tab.guide\', () => ctx.slots.register(\n      { name: \'sidebar.right.tab.guide\', select: owner => null },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-sidebar-right/src/client/contract/slots.ts:75',
+    source: 'packages/client/ui-sidebar-right/src/client/contract/slots.ts:83',
   },
   {
     key: 'sidebar.right.tab.guide.entry',
@@ -3060,7 +3258,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'sidebar.right.tab.guide.entry\', () => ctx.slots.register(\n      { name: \'sidebar.right.tab.guide.entry\', key: \'<one key the owner dispatches>\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-sidebar-right/src/client/contract/slots.ts:82',
+    source: 'packages/client/ui-sidebar-right/src/client/contract/slots.ts:90',
   },
   {
     key: 'sidebar.right.tab.menu.item',
@@ -3118,7 +3316,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     occupants: [],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'sidebar.right.tab.menu.item\', () => ctx.slots.register(\n      { name: \'sidebar.right.tab.menu.item\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-sidebar-right/src/client/contract/slots.ts:94',
+    source: 'packages/client/ui-sidebar-right/src/client/contract/slots.ts:102',
   },
   {
     key: 'sidebar.settings',
diff --git a/packages/extensions/tool-cordis/README.i18n.yaml b/packages/extensions/tool-cordis/README.i18n.yaml
index d9eef3eede..c149c628cd 100644
--- a/packages/extensions/tool-cordis/README.i18n.yaml
+++ b/packages/extensions/tool-cordis/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/extensions/tool-cordis/README.md
-README.md: a0152cf3dbdd08599ba431113123c6aaf097723d
-README.zh.md: cde328fce54b4c18f57b7a044e6afc24215417dd
+README.md: 3536ae2fc39f7a8db425da89df3f4d93e1ca8b4f
+README.zh.md: 8127683111f1807b6920d6bb6f56479e1495f281
diff --git a/packages/extensions/tool-cordis/README.md b/packages/extensions/tool-cordis/README.md
index a0152cf3db..3536ae2fc3 100644
--- a/packages/extensions/tool-cordis/README.md
+++ b/packages/extensions/tool-cordis/README.md
@@ -35,7 +35,7 @@ Creator mode includes this toolset. Other compositions mount `@deepseek-ai/dsh-t
 <details>
 <summary>Implementation internals — click to expand</summary>
 
-Host providers combine generated Service/Event catalogs and the requesting agent's tool registry. Client providers synchronize their manifests through the existing inspection registry and answer queries from a connected page. The tool plugin owns its registrations through Cordis effects; disposal removes both tools and prompt contributions. No invariant companion is published because inspection reads its providers directly and maintains no independent runtime projection.
+Host providers combine generated Service/Event catalogs and the requesting agent's tool registry. Client providers synchronize their manifests through the existing inspection registry and answer queries from a connected page. The tool plugin owns its registrations through Cordis effects; disposal removes the two tools and the Host inspect providers. No invariant companion is published because inspection reads its providers directly and maintains no independent runtime projection.
 
 </details>
 
@@ -54,15 +54,15 @@ Host providers combine generated Service/Event catalogs and the requesting agent
 
 #### What the model sees
 
-The [tool catalog](../../../docs/tool-catalog.md#deepseek-aidsh-tool-cordis) describes two read-only inspection tools. The [prompt](src/prompt.ts) directs persistent changes through Plugin Manager and describes MCP setup. Creator visual requests default to an installed UI plugin displayed in the current Web page; the development skill covers Client packaging and slot registration. Query results contain the requested API declarations or live tool schemas.
+The [tool catalog](../../../docs/tool-catalog.md#deepseek-aidsh-tool-cordis) describes two read-only inspection tools. The plugin contributes no system prompt section: the tool descriptions state when to call each tool and that queries never invoke business methods. In the `cordis` preset, the first-turn skill catalog carries the descriptions of the two shipped skills, which route plugin, MCP, composition, and destination-less visual requests to the skill covering Plugin Manager, MCP setup, Client packaging, and slot registration. Query results contain the requested API declarations or live tool schemas.
 
 #### Token effect
 
-Both tool schemas and the guidance section enter model requests while this plugin is visible. Query results append to the transcript; exact queries avoid loading unrelated declarations.
+Only the two tool schemas enter model requests while this plugin is visible. Query results append to the transcript; exact queries avoid loading unrelated declarations.
 
 #### KV Cache effect
 
-Unchanged schemas and guidance remain prefix-stable. Query results append to history; enabling other plugins can change subsequent tool schemas.
+Unchanged tool schemas remain prefix-stable. Query results append to history; enabling other plugins can change subsequent tool schemas.
 
 ## Known Limitations and Deferred Work
 
diff --git a/packages/extensions/tool-cordis/README.zh.md b/packages/extensions/tool-cordis/README.zh.md
index cde328fce5..8127683111 100644
--- a/packages/extensions/tool-cordis/README.zh.md
+++ b/packages/extensions/tool-cordis/README.zh.md
@@ -35,7 +35,7 @@ kind: "package-reference"
 <details>
 <summary>实现细节 — 点击展开</summary>
 
-Host provider 结合生成的 Service/Event 目录与请求 agent 的工具注册表。Client provider 通过现有检查注册表同步清单，并从已连接页面回答查询。工具插件通过 Cordis effect 持有注册；释放时移除工具和提示词贡献。检查直接读取 provider，不维护独立运行时投影，因此不发布不变式配套插件。
+Host provider 结合生成的 Service/Event 目录与请求 agent 的工具注册表。Client provider 通过现有检查注册表同步清单，并从已连接页面回答查询。工具插件通过 Cordis effect 持有注册；释放时移除两个工具和 Host inspect provider。检查直接读取 provider，不维护独立运行时投影，因此不发布不变式配套插件。
 
 </details>
 
@@ -54,15 +54,15 @@ Host provider 结合生成的 Service/Event 目录与请求 agent 的工具注
 
 #### 模型所见
 
-[工具目录](../../../docs/tool-catalog.zh.md#deepseek-aidsh-tool-cordis) 描述两个只读检查工具。[提示词](src/prompt.ts) 指引模型通过 Plugin Manager 进行持久化变更并说明 MCP 设置方式。创造模式的视觉请求默认通过已安装的 UI 插件显示在当前 Web 页面；开发技能说明 Client 打包和 slot 注册方法。查询结果包含所请求的 API 声明或当前工具 schema。
+[工具目录](../../../docs/tool-catalog.zh.md#deepseek-aidsh-tool-cordis) 描述两个只读检查工具。插件不贡献 system prompt 段落：工具描述已说明何时调用每个工具以及查询不会调用业务方法。在 `cordis` preset 中，首轮 skill catalog 携带两个随附技能的描述，把插件、MCP、组合编辑和未指定去向的视觉请求路由到覆盖 Plugin Manager、MCP 设置、Client 打包和 slot 注册的技能。查询结果包含所请求的 API 声明或当前工具 schema。
 
 #### Token 影响
 
-插件可见时，两个工具 schema 和指导段落进入模型请求。查询结果追加到转录中；精确查询避免加载无关声明。
+插件可见时，只有两个工具 schema 进入模型请求。查询结果追加到转录中；精确查询避免加载无关声明。
 
 #### KV Cache 影响
 
-未改变的 schema 和指导保持前缀稳定。查询结果追加到历史中；启用其他插件可能改变后续工具 schema。
+未改变的工具 schema 保持前缀稳定。查询结果追加到历史中；启用其他插件可能改变后续工具 schema。
 
 ## 已知限制与待办
 
diff --git a/packages/extensions/tool-cordis/package.json b/packages/extensions/tool-cordis/package.json
index 8e9d109d8b..883eac2792 100644
--- a/packages/extensions/tool-cordis/package.json
+++ b/packages/extensions/tool-cordis/package.json
@@ -29,7 +29,6 @@
   "peerDependencies": {
     "@deepseek-ai/dsh-agent": "workspace:^",
     "@deepseek-ai/dsh-cordis-host-runner": "workspace:^",
-    "@deepseek-ai/dsh-system-prompt": "workspace:^",
     "@deepseek-ai/dsh-tools": "workspace:^",
     "@deepseek-ai/cordis": "workspace:^"
   },
@@ -37,7 +36,6 @@
     "@deepseek-ai/cordis-plugin-loader": "workspace:^",
     "@deepseek-ai/dsh-agent": "workspace:^",
     "@deepseek-ai/dsh-cordis-host-runner": "workspace:^",
-    "@deepseek-ai/dsh-system-prompt": "workspace:^",
     "@deepseek-ai/dsh-tools": "workspace:^",
     "@deepseek-ai/cordis": "workspace:^"
   }
diff --git a/packages/extensions/tool-cordis/src/api-catalog.ts b/packages/extensions/tool-cordis/src/api-catalog.ts
index bb90159ee9..06602809cb 100644
--- a/packages/extensions/tool-cordis/src/api-catalog.ts
+++ b/packages/extensions/tool-cordis/src/api-catalog.ts
@@ -1214,57 +1214,75 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
     ],
   },
   {
-    key: 'jobs',
-    summary: 'Abstract background job registry.',
-    description: 'Abstract background job registry. Subclass, implement the abstract methods, and load the subclass as a plugin — it registers as `ctx.jobs` (one implementation per context; loading a second throws, which is cordis\' standard duplicate-service behavior).\n\nImplementations must honor these semantics:\n\n- Registrations outlive producer and controller fibers. Owner and service disposal cancel live work and await compliant producers; a throwing teardown cancel force-fails only the record. Teardown cancellation also marks the record reported, because a record its owner is being destroyed for has no reader left.\n- Owned-job access is fenced by the owner\'s session id. Ids are predictable, so authorization — not secrecy — is the boundary.\n- Settlement is first-wins: one terminal record, released waiters, and one round of contained listener notification, even against a late producer outcome. Completion is announced last, after the record is committed and every other observer of the settlement has seen it, because a reporter may open a model turn synchronously.\n- start refuses work while no attached job controller serves the spec\'s owner, so a producer cannot start work that owner cannot collect or stop. One registry serves every composition in the process, so this question — and completion-listener delivery — is owner-relative rather than process-wide: registrations made from an unscoped context serve every owner, and registrations made under an agent composition\'s scope serve exactly the agents composed under it.',
+    key: 'jobController',
+    summary: 'Host service backing the generated `ctx.remote.job` namespace.',
+    description: 'Host service backing the generated `ctx.remote.job` namespace.',
     methods: [
       {
-        signature: 'abstract start(spec: JobStart): JobId',
-        description: 'Preflight access, validation, owner cleanup, and implementation-owned admission before starting and atomically registering work. Any preflight rejection leaves no job id or execution resource. A throwing starter leaves nothing registered; after it returns, registration cannot fail. Settlement records the outcome, notifies listeners, and releases waiters.',
-        parameters: [{ name: 'spec', description: 'job identity, owner, and synchronous starter.' }],
+        signature: '@Remote({ mode: \'stream\' }) list(request: JobListRequest, signal: AbortSignal): AsyncIterable<JobListFrame>',
+        description: 'Stream the jobs one session can see — its own plus every unowned job — as whole-set frames: one on open, then one after each coalesced burst of lifecycle commits. The stream has no natural end; the carrier closes it.',
+        parameters: [{ name: 'request', description: 'the session whose visible set to mirror.' }, { name: 'signal', description: 'cancellation owned by the Remote stream carrier.' }],
+        returns: 'the roster frames.',
+      },
+      {
+        signature: '@Remote({ mode: \'stream\' }) follow(request: JobFollowRequest, signal: AbortSignal): AsyncIterable<JobFollowFrame>',
+        description: 'Stream one job\'s retained output from an absolute byte offset, then its terminal projection once settled and drained. Non-consuming: the model-facing cursor and notice state never observe these reads. The request\'s session is the fenced read\'s caller; the registry rejects a job the session cannot see and an unknown job.',
+        parameters: [{ name: 'request', description: 'target job, owning session, and optional resume offset.' }, { name: 'signal', description: 'cancellation owned by the Remote stream carrier.' }],
+        returns: 'anchor, coalesced output frames, and the terminal status.',
+      },
+    ],
+  },
+  {
+    key: 'jobs',
+    summary: 'Abstract background job registry.',
+    description: 'Abstract background job registry. Subclass, implement the abstract members, and load the subclass as a plugin — it registers as `ctx.jobs` (one implementation per context; loading a second throws, which is cordis\' standard duplicate-service behavior).\n\nImplementations must honor these semantics:\n\n- Registrations outlive producer and controller fibers. Owner and service disposal cancel live work and await compliant producers; a throwing teardown cancel force-fails only the record. Such settlements announce `cause: \'teardown\'`, because a job whose owner is being destroyed has no reader left.\n- Owned-job access is fenced by the owner\'s session id. Ids are predictable, so authorization — not secrecy — is the boundary.\n- Settlement is first-wins: one terminal record, released waiters, then one round of contained event delivery, even against a late producer outcome. The `settled` event follows every released waiter, so a consumer that claims a settlement while waiting always claims before the event.\n- start refuses work while no attached job controller serves the spec\'s owner, so a producer cannot start work that owner cannot collect or stop. One registry serves every composition in the process, so this question — and event delivery under `{ owners: \'scope\' }` — is owner-relative rather than process-wide: registrations made from an unscoped context serve every owner, and registrations made under an agent composition\'s scope serve exactly the agents composed under it.\n- Every job owns one output ring. Pull sources named by the spec are pumped by the registry and drained once more before settlement; pushed appends land whole. The model\'s consuming cursor and observers\' absolute offsets read the same bytes and never disturb each other.\n- Ring retention is bounded. Appends past the live cap drop the oldest retained bytes; a reader below the retained window gets a lossy read, never an error. Settlement trims retention to the settled cap and ends the stream; the ring has no separate lifecycle.',
+    methods: [
+      {
+        signature: 'abstract readonly events: JobEvents',
+        description: 'Lifecycle and output events, filtered per subscription.',
+        parameters: [],
+      },
+      {
+        signature: 'abstract start(spec: JobSpec): JobId',
+        description: 'Preflight access, validation, owner cleanup, and implementation-owned admission before starting and atomically registering work. Any preflight rejection leaves no job id or execution resource. A throwing starter leaves nothing registered; after it returns, registration cannot fail.',
+        parameters: [{ name: 'spec', description: 'job identity, owner, output sources, and synchronous starter.' }],
         returns: 'the registry-issued `<kind>-N` id.',
       },
       {
-        signature: 'abstract list(caller?: Agent): JobSnapshot[]',
-        description: 'List caller-owned and unowned jobs in registration order without exposing another session\'s labels.',
-        parameters: [{ name: 'caller', description: 'reading agent; a non-agent caller sees only unowned jobs.' }],
-        returns: 'fresh snapshots.',
+        signature: 'abstract list(caller?: SessionId): JobView[]',
+        description: 'List caller-owned and unowned jobs in registration order.',
+        parameters: [{ name: 'caller', description: 'reading session; omission sees only unowned jobs.' }],
+        returns: 'fresh projections.',
       },
       {
-        signature: 'abstract get(id: JobId, caller?: Agent): JobSnapshot',
-        description: 'Return a non-consuming snapshot without changing its read cursor or notice state. Throws for an unknown or foreign job.',
-        parameters: [{ name: 'id', description: 'job to look up.' }, { name: 'caller', description: 'reading agent checked against the owner.' }],
-        returns: 'a fresh snapshot.',
+        signature: 'abstract get(id: JobId, caller?: SessionId): JobView',
+        description: 'Project one job without changing its cursor. Throws for an unknown or foreign job.',
+        parameters: [{ name: 'id', description: 'job to look up.' }, { name: 'caller', description: 'reading session checked against the owner.' }],
+        returns: 'a fresh projection.',
       },
       {
-        signature: 'abstract read(id: JobId, caller?: Agent): JobRead',
-        description: 'Read the next stream delta, or the idempotent final output after settlement. A terminal read marks the job reported. Throws for an unknown or foreign job.',
-        parameters: [{ name: 'id', description: 'job to read.' }, { name: 'caller', description: 'reading agent checked against the owner.' }],
-        returns: 'output text and the post-read snapshot.',
+        signature: 'abstract read(id: JobId, caller?: SessionId): JobRead',
+        description: 'Consume the ring from the model cursor and advance it to the current total. After settlement the first read also carries the producer\'s result. Throws for an unknown or foreign job.',
+        parameters: [{ name: 'id', description: 'job to read.' }, { name: 'caller', description: 'reading session checked against the owner.' }],
+        returns: 'the chunks since the cursor, the lossy flag, the result once, and the post-read projection.',
       },
       {
-        signature: 'abstract kill(id: JobId, caller?: Agent, reason?: string): \'requested\' | \'already-finished\'',
-        description: 'Request cancellation, then mark the job stopping and reported. A producer throw propagates without changing job state. Throws for an unknown or foreign job.',
-        parameters: [{ name: 'id', description: 'job to cancel.' }, { name: 'caller', description: 'killing agent checked against the owner.' }, { name: 'reason', description: 'logged reason forwarded to the producer.' }],
+        signature: 'abstract readAt(id: JobId, from: number, caller?: SessionId): JobOutputRead',
+        description: 'Read retained ring output without moving the model cursor. Resume with a previous read\'s `next`; an offset inside a retained chunk returns the whole chunk (its `at` may precede `from`). Throws for a negative or non-integer offset, or an unknown or foreign job.',
+        parameters: [{ name: 'id', description: 'job to read.' }, { name: 'from', description: 'absolute byte offset to read from (0 for the retained head).' }, { name: 'caller', description: 'reading session checked against the owner.' }],
+        returns: 'retained chunks overlapping `[from, total)`, the resume offset, and the lossy flag.',
+      },
+      {
+        signature: 'abstract kill(id: JobId, caller?: SessionId, reason?: string): \'requested\' | \'already-finished\'',
+        description: 'Request cancellation, then mark the job stopping. A producer throw propagates without changing job state. A supplied reason is merged into terminal `detail` when the job settles `killed`. Throws for an unknown or foreign job.',
+        parameters: [{ name: 'id', description: 'job to cancel.' }, { name: 'caller', description: 'killing session checked against the owner.' }, { name: 'reason', description: 'cancellation reason forwarded verbatim to the producer.' }],
         returns: '`requested` for live work, otherwise `already-finished`.',
       },
       {
-        signature: 'abstract wait(id: JobId, timeoutMs: number, caller?: Agent, signal?: AbortSignal): Promise<JobSnapshot>',
-        description: 'Wait for settlement or timeout without cancelling the job. Caller abort rejects only while the job is live; after settlement the terminal snapshot wins so a notice suppressed for this waiter is still delivered. Throws for invalid, unknown, or foreign input.',
-        parameters: [{ name: 'id', description: 'job to wait for.' }, { name: 'timeoutMs', description: 'positive finite wait bound in milliseconds.' }, { name: 'caller', description: 'waiting agent checked against the owner.' }, { name: 'signal', description: 'optional cancellation of the wait itself.' }],
-        returns: 'snapshot at settlement or timeout.',
-      },
-      {
-        signature: 'abstract onJobDone(listener: JobDoneListener): () => void',
-        description: 'Register an effect-scoped completion listener. It receives the settlements of the owners its registering context\'s scope covers; each listener is contained; returned promises are observed but not awaited. No listener runs after service disposal.',
-        parameters: [{ name: 'listener', description: 'receives each terminal snapshot and its exact owner.' }],
-        returns: 'disposer that unregisters the listener.',
-      },
-      {
-        signature: 'abstract onJobsChanged(listener: JobsChangedListener): () => void',
-        description: '/** Register an effect-scoped observer of visible-set changes. It fires after every commit that changes what list returns for that owner — registration, every stopping transition (including the one teardown performs before it awaits a slow producer), settlement, owner-disposal removal, and the emptying that service disposal commits — so an observer re-reads rather than accumulating deltas.\n\nDelivery is owner-relative on the same terms as onJobDone: an observer registered from an unscoped context — a host composition\'s own carrier — sees every owner, while one registered under an agent composition\'s scope sees exactly the agents composed under it.\n\nThis is not a superset of onJobDone: that one delivers the terminal record under first-wins semantics a job controller couples to notice delivery, while this one carries no delivery meaning and marks nothing reported. Listeners are contained and never awaited.',
-        parameters: [{ name: 'listener', description: 'receives the owner whose visible set changed, or `undefined` when an unowned job changed and every caller\'s set did.' }],
-        returns: 'disposer that unregisters the listener.',
+        signature: 'abstract wait(id: JobId, timeoutMs: number, caller?: SessionId, signal?: AbortSignal): Promise<JobView>',
+        description: 'Wait for settlement or timeout without cancelling the job. Caller abort rejects only while the job is live; after settlement the terminal projection wins. Rejects for an invalid timeout or an unknown or foreign job.',
+        parameters: [{ name: 'id', description: 'job to wait for.' }, { name: 'timeoutMs', description: 'positive finite wait bound in milliseconds.' }, { name: 'caller', description: 'waiting session checked against the owner.' }, { name: 'signal', description: 'optional cancellation of the wait itself.' }],
+        returns: 'projection at settlement or timeout.',
       },
       {
         signature: 'abstract attachController(name: string): () => void',
@@ -1755,6 +1773,13 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
         returns: 'confirmation after the native opener accepts the path.',
         throws: ['RemoteError when the request is invalid, has no verified Host mapping, is cancelled, or the opener fails.'],
       },
+      {
+        signature: '@Remote(\'workspacePathApplications\') async workspacePathApplications( request: { readonly path: string }, signal: AbortSignal, ): Promise<readonly SessionWorkspacePathApplication[]>',
+        description: 'Query current file handlers on the serving desktop without activating an Agent.',
+        parameters: [{ name: 'request', description: 'file path in Host filesystem syntax.' }, { name: 'signal', description: 'caller lifetime, propagated to filesystem and desktop queries.' }],
+        returns: 'OS application names, icons, and default selection; empty when desktop opening is unavailable.',
+        throws: ['RemoteError when the path is invalid, the query is cancelled, or native discovery fails.'],
+      },
       {
         signature: '@Remote(\'rename\') rename(request: SessionRenameRequest): Promise<SessionRenameValue>',
         description: 'Rename one Session after explicitly resuming it.',
@@ -4968,12 +4993,48 @@ export const TYPE_API: readonly TypeApiEntry[] = [
     declaration: 'export interface InvokeRemoteRequest {\n    readonly namespace: string;\n    readonly method: string;\n    readonly args: Readonly<Record<string, unknown>>;\n    readonly uplink?: AsyncIterable<unknown>;\n    readonly peer?: PeerScope;\n    readonly signal?: AbortSignal;\n}',
   },
   {
-    name: 'JobDoneListener',
-    declaration: 'export type JobDoneListener = (snapshot: JobSnapshot, owner: Agent | undefined) => void | PromiseLike<void>;',
+    name: 'JobAppendOptions',
+    declaration: 'export interface JobAppendOptions {\n    channel?: JobChannel;\n    gapBefore?: true;\n}',
+  },
+  {
+    name: 'JobChannel',
+    declaration: 'export type JobChannel = \'stdout\' | \'stderr\' | \'log\';',
+  },
+  {
+    name: 'JobChunk',
+    declaration: 'export interface JobChunk {\n    readonly at: number;\n    readonly text: string;\n    readonly channel?: JobChannel;\n    readonly gapBefore?: true;\n}',
+  },
+  {
+    name: 'JobEvent',
+    declaration: 'export type JobEvent = {\n    readonly type: \'registered\' | \'progress\' | \'stopping\' | \'removed\';\n    readonly job: JobView;\n} | {\n    readonly type: \'settled\';\n    readonly job: JobView;\n    readonly cause: JobSettleCause;\n} | {\n    readonly type: \'output\';\n    readonly id: JobId;\n    readonly owner?: SessionId;\n    readonly total: number;\n};',
+  },
+  {
+    name: 'JobEventFilter',
+    declaration: 'export type JobEventFilter = {\n    readonly owner: SessionId;\n} | {\n    readonly owners: \'all\' | \'scope\';\n};',
+  },
+  {
+    name: 'JobEventListener',
+    declaration: 'export type JobEventListener = (event: JobEvent) => void;',
+  },
+  {
+    name: 'JobEvents',
+    declaration: 'export interface JobEvents {\n    subscribe(filter: JobEventFilter, listener: JobEventListener): () => void;\n}',
+  },
+  {
+    name: 'JobFollowFrame',
+    declaration: 'export type JobFollowFrame = {\n    readonly type: \'opened\';\n    readonly job: JobView;\n    readonly from: number;\n} | {\n    readonly type: \'output\';\n    readonly chunks: readonly JobChunk[];\n    readonly next: number;\n    readonly lossy?: true;\n} | {\n    readonly type: \'status\';\n    readonly job: JobView;\n};',
+  },
+  {
+    name: 'JobFollowRequest',
+    declaration: 'export interface JobFollowRequest {\n    readonly sessionId?: SessionId;\n    readonly jobId: JobId;\n    readonly from?: number;\n}',
+  },
+  {
+    name: 'JobHandle',
+    declaration: 'export interface JobHandle {\n    readonly id: JobId;\n    append(text: string, options?: JobAppendOptions): void;\n    updateProgress(line: string): void;\n}',
   },
   {
     name: 'JobHooks',
-    declaration: 'export interface JobHooks {\n    cancel(reason?: string): void;\n    done: Promise<JobOutcome>;\n    readOutput?(): string;\n}',
+    declaration: 'export interface JobHooks {\n    cancel(reason?: string): void;\n    done: Promise<JobOutcome>;\n}',
   },
   {
     name: 'JobId',
@@ -4987,30 +5048,50 @@ export const TYPE_API: readonly TypeApiEntry[] = [
     name: 'JobKindMap',
     declaration: 'export interface JobKindMap {\n    bash: \'bash\';\n    subagent: \'subagent\';\n}',
   },
+  {
+    name: 'JobListFrame',
+    declaration: 'export interface JobListFrame {\n    readonly type: \'rows\';\n    readonly jobs: readonly JobView[];\n}',
+  },
+  {
+    name: 'JobListRequest',
+    declaration: 'export interface JobListRequest {\n    readonly sessionId: SessionId;\n}',
+  },
   {
     name: 'JobOutcome',
-    declaration: 'export interface JobOutcome {\n    status: \'completed\' | \'killed\' | \'failed\';\n    detail?: string;\n    output?: string;\n}',
+    declaration: 'export interface JobOutcome {\n    status: \'completed\' | \'killed\' | \'failed\';\n    detail?: string;\n    result?: string;\n}',
+  },
+  {
+    name: 'JobOutputRead',
+    declaration: 'export interface JobOutputRead {\n    chunks: readonly JobChunk[];\n    next: number;\n    lossy: boolean;\n}',
+  },
+  {
+    name: 'JobOutputSource',
+    declaration: 'export interface JobOutputSource {\n    channel?: JobChannel;\n    read(fromByte: number): JobSourceRead;\n}',
   },
   {
     name: 'JobRead',
-    declaration: 'export interface JobRead {\n    text: string;\n    snapshot: JobSnapshot;\n}',
+    declaration: 'export interface JobRead {\n    chunks: readonly JobChunk[];\n    lossy: boolean;\n    result?: string;\n    job: JobView;\n}',
   },
   {
-    name: 'JobsChangedListener',
-    declaration: 'export type JobsChangedListener = (owner: Agent | undefined) => void;',
+    name: 'JobSettleCause',
+    declaration: 'export type JobSettleCause = \'producer\' | \'kill\' | \'teardown\';',
   },
   {
-    name: 'JobSnapshot',
-    declaration: 'export interface JobSnapshot {\n    id: JobId;\n    kind: JobKind;\n    label: string;\n    outputLimitBytes?: number;\n    ownerSession?: SessionId;\n    status: JobStatus;\n    detail?: string;\n    startedAt: number;\n    finishedAt?: number;\n    reported: boolean;\n}',
+    name: 'JobSourceRead',
+    declaration: 'export interface JobSourceRead {\n    text: string;\n    nextOffset: number;\n    lossy: boolean;\n    spillPath?: string;\n}',
   },
   {
-    name: 'JobStart',
-    declaration: 'export interface JobStart {\n    kind: JobKind;\n    label: string;\n    outputLimitBytes?: number;\n    owner?: Agent;\n    run(): JobHooks;\n}',
+    name: 'JobSpec',
+    declaration: 'export interface JobSpec {\n    kind: JobKind;\n    label: string;\n    owner?: SessionId;\n    outputLimitBytes?: number;\n    output?: readonly JobOutputSource[];\n    run(job: JobHandle): JobHooks;\n}',
   },
   {
     name: 'JobStatus',
     declaration: 'export type JobStatus = \'running\' | \'stopping\' | \'completed\' | \'killed\' | \'failed\';',
   },
+  {
+    name: 'JobView',
+    declaration: 'export interface JobView {\n    readonly id: JobId;\n    readonly kind: string;\n    readonly label: string;\n    readonly owner?: SessionId;\n    readonly outputLimitBytes?: number;\n    readonly status: JobStatus;\n    readonly progress?: string;\n    readonly detail?: string;\n    readonly startedAt: number;\n    readonly finishedAt?: number;\n    readonly output: {\n        readonly total: number;\n        readonly earliest: number;\n        readonly spillPaths?: readonly string[];\n    };\n}',
+  },
   {
     name: 'JsonSchemaNode',
     declaration: 'export interface JsonSchemaNode {\n    type?: JsonSchemaType;\n    oneOf?: JsonSchemaNode[];\n    properties?: Record<string, JsonSchemaNode>;\n    required?: string[];\n    additionalProperties?: boolean;\n    items?: JsonSchemaNode;\n    enum?: JsonSchemaScalar[];\n    const?: JsonSchemaScalar;\n    description?: string;\n    title?: string;\n    default?: JsonValue;\n    examples?: JsonValue;\n}',
@@ -5299,6 +5380,10 @@ export const TYPE_API: readonly TypeApiEntry[] = [
     name: 'ModelReasoningEffort',
     declaration: 'export interface ModelReasoningEffort {\n    readonly id: string;\n    readonly name: string;\n    readonly description?: string;\n}',
   },
+  {
+    name: 'NativeFileApplication',
+    declaration: 'export interface NativeFileApplication {\n    readonly id: string;\n    readonly name: string;\n    readonly default: boolean;\n    readonly icon: string | null;\n}',
+  },
   {
     name: 'ObjectJsonSchema',
     declaration: 'export type ObjectJsonSchema = JsonSchemaNode & {\n    type: \'object\';\n};',
@@ -5821,11 +5906,11 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'SessionControlBaseline',
-    declaration: 'export interface SessionControlBaseline {\n    readonly jobs: Readonly<Record<SessionId, readonly SessionJob[]>>;\n    readonly projections: Readonly<Record<SessionId, SessionProjectionBaseline>>;\n}',
+    declaration: 'export interface SessionControlBaseline {\n    readonly projections: Readonly<Record<SessionId, SessionProjectionBaseline>>;\n}',
   },
   {
     name: 'SessionControlFrame',
-    declaration: 'export type SessionControlFrame = {\n    readonly type: \'baseline\';\n    readonly value: SessionControlBaseline;\n} | {\n    readonly type: \'jobs\';\n    readonly sessionId: SessionId;\n    readonly jobs: readonly SessionJob[];\n} | ({\n    readonly type: \'projection\';\n} & SessionProjectionUpdate);',
+    declaration: 'export type SessionControlFrame = {\n    readonly type: \'baseline\';\n    readonly value: SessionControlBaseline;\n} | ({\n    readonly type: \'projection\';\n} & SessionProjectionUpdate);',
   },
   {
     name: 'SessionCreateRequest',
@@ -5975,10 +6060,6 @@ export const TYPE_API: readonly TypeApiEntry[] = [
     name: 'SessionInspection',
     declaration: 'export interface SessionInspection extends SessionStorageMetadata {\n    readonly events: readonly SessionEvent[];\n}',
   },
-  {
-    name: 'SessionJob',
-    declaration: 'export interface SessionJob {\n    readonly id: JobId;\n    readonly kind: string;\n    readonly label: string;\n    readonly status: \'running\' | \'stopping\' | \'completed\' | \'killed\' | \'failed\';\n    readonly detail?: string;\n    readonly startedAt: number;\n    readonly finishedAt?: number;\n}',
-  },
   {
     name: 'SessionLineageNode',
     declaration: 'export interface SessionLineageNode {\n    session: SessionRecord;\n    descendants: SessionLineageNode[];\n}',
@@ -6021,7 +6102,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'SessionOpenWorkspacePathRequest',
-    declaration: 'export interface SessionOpenWorkspacePathRequest {\n    readonly action?: \'reveal\';\n    readonly path: string;\n}',
+    declaration: 'export interface SessionOpenWorkspacePathRequest {\n    readonly action?: \'reveal\';\n    readonly application?: string;\n    readonly path: string;\n}',
   },
   {
     name: 'SessionOpenWorkspacePathValue',
@@ -6275,6 +6356,10 @@ export const TYPE_API: readonly TypeApiEntry[] = [
     name: 'SessionWireHeader',
     declaration: 'export interface SessionWireHeader {\n    readonly version: number;\n    readonly id: SessionId;\n    readonly createdAt: number;\n    readonly cwd?: string;\n    readonly parentSession?: SessionId;\n    readonly isSeeded: boolean;\n    readonly origin?: \'subagent\';\n    readonly delegationDepth?: number;\n    readonly agentPreset?: string;\n}',
   },
+  {
+    name: 'SessionWorkspacePathApplication',
+    declaration: 'export type SessionWorkspacePathApplication = NativeFileApplication;',
+  },
   {
     name: 'SettingsApplies',
     declaration: 'export type SettingsApplies = \'live\' | \'restart\';',
@@ -6335,9 +6420,13 @@ export const TYPE_API: readonly TypeApiEntry[] = [
     name: 'ShellExecSpec',
     declaration: 'export interface ShellExecSpec {\n    command: string;\n    workdir: string;\n    timeoutMs: number;\n    stdoutMaxBytes: number;\n    signal?: AbortSignal | undefined;\n    stdin?: string | undefined;\n    env?: Record<string, string> | undefined;\n    dshEnv?: DshEnvironment | undefined;\n    sandboxPolicy: SandboxExecutionPolicy | undefined;\n}',
   },
+  {
+    name: 'ShellObservedStreams',
+    declaration: 'export interface ShellObservedStreams {\n    stdout: SubprocessOutputReader;\n    stderr: SubprocessOutputReader;\n}',
+  },
   {
     name: 'ShellProcess',
-    declaration: 'export interface ShellProcess {\n    status: ShellProcessStatus;\n    exitCode: number | null;\n    signal: NodeJS.Signals | null;\n    readonly done: Promise<void>;\n    sandbox?: ShellSandboxInfo;\n    readOutput(): ShellProcessRead;\n    kill(): boolean;\n}',
+    declaration: 'export interface ShellProcess {\n    status: ShellProcessStatus;\n    exitCode: number | null;\n    signal: NodeJS.Signals | null;\n    readonly done: Promise<void>;\n    sandbox?: ShellSandboxInfo;\n    readOutput(): ShellProcessRead;\n    observed: ShellObservedStreams;\n    kill(): boolean;\n}',
   },
   {
     name: 'ShellProcessRead',
diff --git a/packages/extensions/tool-cordis/src/index.ts b/packages/extensions/tool-cordis/src/index.ts
index 90f3401d75..4bbf72fe83 100644
--- a/packages/extensions/tool-cordis/src/index.ts
+++ b/packages/extensions/tool-cordis/src/index.ts
@@ -5,11 +5,10 @@ import type { JsonValue } from '@deepseek-ai/dsh-util-values'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import type { ToolExecution } from '@deepseek-ai/dsh-tools'
 import { presentInspectListCall, presentInspectQueryCall } from './present.ts'
-import { CORDIS_SYSTEM_PROMPT } from './prompt.ts'
 import { hostInspectProviders } from './providers.ts'
 
 export const name = 'tool-cordis'
-export const inject = ['tools', 'systemPrompt', 'cordisInspect']
+export const inject = ['tools', 'cordisInspect']
 
 function requireAgent(exec: ToolExecution): Agent {
   if (exec.agent === undefined) throw new Error('Cordis inspection requires an Agent-backed session')
@@ -20,7 +19,6 @@ function requireAgent(exec: ToolExecution): Agent {
  * @param ctx Agent-scoped registration context.
  */
 export function apply(ctx: Context): void {
-  ctx.systemPrompt.section({ name: 'tool:cordis', order: ctx.systemPrompt.getSectionOrder('TOOL_CORDIS'), text: CORDIS_SYSTEM_PROMPT })
   for (const provider of hostInspectProviders(ctx)) {
     ctx.effect(() => ctx.cordisInspect.register(provider), `tool-cordis: inspect ${provider.manifest.id}`)
   }
@@ -46,16 +44,12 @@ export function apply(ctx: Context): void {
   ctx.tools.register(defineTool({
     name: 'cordis_inspect_query',
     description:
-      'Run a read-only query explicitly declared by an Inspect Provider. platform, provider, and method must come '
-      + 'from cordis_inspect_list, and input must satisfy that method\'s schema. Use this Tool before writing plugin code '
+      'Run a read-only query declared by an Inspect Provider. platform, provider, and method must come from '
+      + 'cordis_inspect_list, and input must satisfy that method\'s schema. Use this Tool before writing plugin code '
       + 'to read exact Service methods, Event modes, Builtin signatures, Tool schemas, theme tokens, or live Slot '
       + 'trees and props. Host queries run locally. A Client query waits for the first valid page response and '
       + 'remains pending until a page answers or the Tool is cancelled. This Tool cannot invoke business Service '
-      + 'methods or modify the runtime. For Service.listService and Event.listEvents, query without input to navigate '
-      + 'the compact signature directory, then query the exact service or event for its structured contract and '
-      + 'referenced types. For Slots.listSubTree, query without root to navigate the compact tree, then query an '
-      + 'exact Slot root for its complete registration contract and props; an exact Factory root returns its identity, '
-      + 'scope, and registrant.',
+      + 'methods or modify the runtime.',
     parameters: {
       platform: { type: 'string', required: true, enum: ['host', 'client'], description: 'Runtime platform that owns the Provider.' },
       provider: { type: 'string', required: true, description: 'Exact Provider ID returned by cordis_inspect_list.' },
diff --git a/packages/extensions/tool-cordis/src/prompt.ts b/packages/extensions/tool-cordis/src/prompt.ts
deleted file mode 100644
index 6f0dd7eafb..0000000000
--- a/packages/extensions/tool-cordis/src/prompt.ts
+++ /dev/null
@@ -1,4 +0,0 @@
-/** Model guidance for read-only runtime API discovery. */
-export const CORDIS_SYSTEM_PROMPT = `# Harness runtime inspection
-
-Use cordis_inspect_list to discover Host and Client providers, then cordis_inspect_query to read exact Service, Event, Tool, Theme or Slot APIs. These tools are read-only; queries do not invoke business methods.`
diff --git a/packages/host/open-in-app/README.i18n.yaml b/packages/host/open-in-app/README.i18n.yaml
index a0f9b65499..6d300a6296 100644
--- a/packages/host/open-in-app/README.i18n.yaml
+++ b/packages/host/open-in-app/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/host/open-in-app/README.md
-README.md: 0f0c05f48469a03bc115d84e93a174fbfeba0c42
-README.zh.md: 8a46759a9cc84fdda8ce62c3f448344c86179bb8
+README.md: 39cc7b854725aab363c4c42ad1ab27f99718e75e
+README.zh.md: c47a47c43f3dcf7b842af2bf57469c7b09dc49c9
diff --git a/packages/host/open-in-app/README.md b/packages/host/open-in-app/README.md
index 0f0c05f484..39cc7b8547 100644
--- a/packages/host/open-in-app/README.md
+++ b/packages/host/open-in-app/README.md
@@ -72,6 +72,8 @@ The route paths and wire payload types are published as the browser-safe `./shar
 <a id="understand-the-implementation"></a>
 ## Understand the implementation
 
+Linux desktop-entry fields and icons use the shared [native-command](../../util/native-command/README.md) helpers. Directory launchers come from this package’s installed application catalog; file handlers come from the operating system’s associations.
+
 <details>
 <summary>Implementation internals — click to expand</summary>
 
diff --git a/packages/host/open-in-app/README.zh.md b/packages/host/open-in-app/README.zh.md
index 8a46759a9c..c47a47c43f 100644
--- a/packages/host/open-in-app/README.zh.md
+++ b/packages/host/open-in-app/README.zh.md
@@ -72,6 +72,8 @@ kind: "package-reference"
 <a id="understand-the-implementation"></a>
 ## 理解实现
 
+Linux 桌面文件字段和图标使用共享的 [native-command](../../util/native-command/README.zh.md) 工具。目录打开器来自本包的已安装应用列表，文件打开器来自操作系统的文件关联。
+
 <details>
 <summary>实现内幕——点击展开</summary>
 
diff --git a/packages/host/open-in-app/src/icons.ts b/packages/host/open-in-app/src/icons.ts
index 6908ce795b..4b07441c8c 100644
--- a/packages/host/open-in-app/src/icons.ts
+++ b/packages/host/open-in-app/src/icons.ts
@@ -11,10 +11,11 @@
 
 import { mkdtemp, readdir, readFile, rm, stat, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
-import { isAbsolute, join } from 'node:path'
+import { join } from 'node:path'
+import { desktopApplicationIcon } from '@deepseek-ai/dsh-native-command'
 import type { OpenInAppApp } from './catalog.ts'
 import {
-  findDesktopEntry, isFile, output, resolveInternals, specFor, xdgDataDirectories,
+  findDesktopEntry, output, resolveInternals, specFor, xdgDataDirectories,
   type OpenInAppInternals, type OpenInAppResolvedLaunch, type ResolvedInternals,
 } from './resolver.ts'
 
@@ -121,50 +122,6 @@ async function extractExecutableIconPng(
   }
 }
 
-/** Theme sizes searched largest-first; the button renders at 15-18 CSS px. */
-const HICOLOR_SIZES = ['512x512', '256x256', '128x128', '64x64', '48x48', '32x32'] as const
-
-/** The media type an icon file's extension names. */
-function iconContentType(path: string): OpenInAppIcon['contentType'] | null {
-  if (path.endsWith('.png')) return 'image/png'
-  if (path.endsWith('.svg')) return 'image/svg+xml'
-  return null
-}
-
-/** Read one icon file when it exists and carries a servable media type. */
-async function readIconFile(path: string): Promise<OpenInAppIcon | null> {
-  const contentType = iconContentType(path)
-  if (contentType === null || !await isFile(path)) return null
-  return { bytes: await readFile(path), contentType }
-}
-
-/**
- * Resolve a Linux icon name through the hicolor theme and pixmaps
- * directories, largest size first. The user's active icon theme is not
- * consulted (README Known Limitations): hicolor is the freedesktop fallback
- * every theme inherits from, so the stock icon is found wherever the
- * application installed one.
- */
-async function findLinuxThemeIcon(
-  name: string, dataDirs: readonly string[],
-): Promise<OpenInAppIcon | null> {
-  for (const dataDir of dataDirs) {
-    for (const size of HICOLOR_SIZES) {
-      for (const extension of ['png', 'svg'] as const) {
-        const icon = await readIconFile(join(dataDir, 'icons', 'hicolor', size, 'apps', `${name}.${extension}`))
-        if (icon !== null) return icon
-      }
-    }
-    const scalable = await readIconFile(join(dataDir, 'icons', 'hicolor', 'scalable', 'apps', `${name}.svg`))
-    if (scalable !== null) return scalable
-    for (const extension of ['png', 'svg'] as const) {
-      const pixmap = await readIconFile(join(dataDir, 'pixmaps', `${name}.${extension}`))
-      if (pixmap !== null) return pixmap
-    }
-  }
-  return null
-}
-
 /** One Linux application's icon from its desktop entry's `Icon=` key. */
 async function extractLinuxIcon(
   desktopId: string, internals: ResolvedInternals,
@@ -172,8 +129,7 @@ async function extractLinuxIcon(
   const entry = await findDesktopEntry(desktopId, internals)
   const icon = entry?.icon
   if (icon === undefined || icon === '') return null
-  if (isAbsolute(icon)) return readIconFile(icon)
-  return findLinuxThemeIcon(icon, xdgDataDirectories(internals))
+  return desktopApplicationIcon(icon, xdgDataDirectories(internals))
 }
 
 /**
diff --git a/packages/host/open-in-app/src/resolver.ts b/packages/host/open-in-app/src/resolver.ts
index 7ab964b4fd..62c6f8e4bc 100644
--- a/packages/host/open-in-app/src/resolver.ts
+++ b/packages/host/open-in-app/src/resolver.ts
@@ -17,7 +17,7 @@ import { readdir, readFile, stat } from 'node:fs/promises'
 import { homedir, platform as osPlatform } from 'node:os'
 import { dirname, isAbsolute, join } from 'node:path'
 import {
-  canOpenNativePath, openNativePath, runNativeCommand, type NativeCommandRunner,
+  canOpenNativePath, openNativePath, runNativeCommand, desktopEntryFields, desktopDataDirectories, type NativeCommandRunner,
 } from '@deepseek-ai/dsh-native-command'
 import { scrubbedParentEnv } from '@deepseek-ai/dsh-subprocess'
 import {
@@ -379,24 +379,12 @@ export interface DesktopEntry {
  * @returns the recognized fields; keys outside the entry section are ignored.
  */
 export function parseDesktopEntry(text: string): DesktopEntry {
-  let inEntry = false
-  const fields: { exec?: string; tryExec?: string; icon?: string } = {}
-  for (const line of text.split(/\r?\n/)) {
-    const trimmed = line.trim()
-    if (trimmed.startsWith('[')) {
-      inEntry = trimmed === '[Desktop Entry]'
-      continue
-    }
-    if (!inEntry) continue
-    const separator = trimmed.indexOf('=')
-    if (separator < 0) continue
-    const key = trimmed.slice(0, separator).trim()
-    const value = trimmed.slice(separator + 1).trim()
-    if (key === 'Exec') fields.exec = value
-    else if (key === 'TryExec') fields.tryExec = value
-    else if (key === 'Icon') fields.icon = value
+  const fields = desktopEntryFields(text)
+  return {
+    ...(fields.Exec === undefined ? {} : { exec: fields.Exec }),
+    ...(fields.TryExec === undefined ? {} : { tryExec: fields.TryExec }),
+    ...(fields.Icon === undefined ? {} : { icon: fields.Icon }),
   }
-  return fields
 }
 
 /**
@@ -405,9 +393,7 @@ export function parseDesktopEntry(text: string): DesktopEntry {
  * @returns the data directories, freedesktop defaults applied.
  */
 export function xdgDataDirectories(internals: ResolvedInternals): readonly string[] {
-  const dataHome = internals.env['XDG_DATA_HOME'] ?? join(internals.home, '.local', 'share')
-  const dataDirs = internals.env['XDG_DATA_DIRS'] ?? '/usr/local/share:/usr/share'
-  return [dataHome, ...dataDirs.split(':').filter(dir => dir !== '')]
+  return desktopDataDirectories(internals.home, internals.env)
 }
 
 /**
diff --git a/packages/jobs/jobs-local/README.i18n.yaml b/packages/jobs/jobs-local/README.i18n.yaml
index 963541f876..fa9e9e94bb 100644
--- a/packages/jobs/jobs-local/README.i18n.yaml
+++ b/packages/jobs/jobs-local/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/jobs/jobs-local/README.md
-README.md: 51fbffc4892f6a4781343e13863770fb4e8e8e6a
-README.zh.md: 710c02c923994df596e544345cac4cd4d0bd2809
+README.md: d141d19b06f0d329ee6a544b10f535d87086a48d
+README.zh.md: 38f8989f230fc9317fbc56d73ffcc9a8dc42db00
diff --git a/packages/jobs/jobs-local/README.md b/packages/jobs/jobs-local/README.md
index 51fbffc489..d141d19b06 100644
--- a/packages/jobs/jobs-local/README.md
+++ b/packages/jobs/jobs-local/README.md
@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
 
 ## Summary
 
-`dsh-jobs-local` runs background jobs inside the harness process: work keeps running while the agent moves on, and the owning agent can read, wait on, list, and cancel it, with completion delivered as an in-session notice when `dsh-tool-jobs` is also mounted. It implements the `dsh-jobs` contract with in-memory records handed out as fresh snapshots, never live state. A per-owner concurrency limit (default 10) bounds how many jobs one agent can have running or stopping at once; jobs die with the harness process and are not durable across restarts.
+`dsh-jobs-local` runs background jobs inside the harness process while the agent continues. The owning agent can read, wait on, list, and cancel its jobs; mounting `dsh-tool-jobs` also delivers completion notices in-session. Configurable concurrency and output-retention limits bound resource use. Producers can supply output for periodic reading or append it directly; users can observe retained output without consuming the agent's unread output. Jobs end when their owner or the harness shuts down.
 
 ## Table of Contents
 
@@ -33,7 +33,7 @@ Choose it when jobs should live in the harness process and die with it. Avoid it
 
 ### Minimal configuration
 
-Loading the plugin registers `ctx.jobs`; `maxConcurrentJobsPerOwner` is optional and defaults to `10`.
+Loading the plugin registers `ctx.jobs`; every field is optional.
 
 ```yaml
 - name: '@deepseek-ai/dsh-jobs-local'
@@ -42,8 +42,11 @@ Loading the plugin registers `ctx.jobs`; `maxConcurrentJobsPerOwner` is optional
 | Field | Default | Meaning |
 |---|---|---|
 | `maxConcurrentJobsPerOwner` | `10` | Maximum `running` plus `stopping` jobs per exact owner, or in the shared unowned bucket |
+| `retainBytes` | `262144` | Live ring retention per job, in UTF-8 bytes |
+| `settledRetainBytes` | `16384` | Ring retention kept after a job settles, in UTF-8 bytes; bytes the model has not read stay until its first terminal read |
+| `pumpPollMs` | `150` | Poll interval for a job's pull sources, in milliseconds |
 
-The generated [configuration catalog](../../../docs/config-catalog.md#deepseek-aidsh-jobs-local) is the exhaustive source for the accepted field.
+The generated [configuration catalog](../../../docs/config-catalog.md#deepseek-aidsh-jobs-local) is the exhaustive source for the accepted fields.
 
 ### What each owner gets
 
@@ -69,10 +72,11 @@ This section explains the design decisions behind the registry and points at the
 
 ### Design philosophy
 
-- **In-memory records, fresh snapshots.** `LocalJobRegistry` keeps one `TrackedJob` per job and projects a new read-only snapshot per call; callers never receive live state.
-- **Owner-relative layers, one process-wide registry.** Controllers, completion listeners, and change observers are filed into the scope that registered them (`ScopedLayers`), and reads union the global layer with the owner's scope chain — so one preset's job controls never hold `start()` open for an agent whose own composition loads none, and a settlement reaches only the listeners its owner's composition registered.
+- **In-memory records, fresh projections.** `LocalJobRegistry` keeps one `TrackedJob` per job — lifecycle state, the output ring, and the model cursor — and projects a new read-only view or chunk copy per call; callers never receive live state.
+- **Retention is bounded per ring.** Appends past the live cap drop the oldest retained chunks (a single oversized chunk keeps its UTF-8-safe tail); a reader below the retained window gets a lossy read, never an error. Settlement trims to the settled cap but never below the bytes the model cursor has not consumed, so a job that finishes before its first `job_output` hands over everything the live cap retained; that terminal read then trims to the settled cap.
+- **Owner-relative layers, one process-wide registry.** Controllers and `{ owners: 'scope' }` subscriptions are filed into the scope that registered them (`ScopedLayers`), and reads union the global layer with the owner's scope chain — so one preset's job controls never hold `start()` open for an agent whose own composition loads none, and a scoped settlement reaches only the listeners its owner's composition registered.
 - **Preflight before start.** `start()` checks controller service, spec validity, live ownership, and capacity before invoking the producer, so a rejection leaves no job id or execution resource; registration commits without a later failable step.
-- **First-wins settlement, completion last.** The earliest terminal outcome records once, releases waiters, and notifies listeners once with per-listener containment; completion is announced after the record is committed and the visible-set change published, because a reporter may open a model turn synchronously.
+- **First-wins settlement, event last.** The earliest terminal outcome records once, waits for the pump's final drain, trims the ring, releases waiters, and then delivers one `settled` event with per-listener containment, followed by the ring's final `output` signal.
 - **Teardown never deadlocks.** A throwing cancel force-fails the record and reports a possible orphan instead of stalling disposal.
 
 ### Source map
@@ -80,19 +84,22 @@ This section explains the design decisions behind the registry and points at the
 | File | Role |
 |---|---|
 | [`src/index.ts`](src/index.ts) | Plugin entry: `Config` schema, `LocalJobRegistry`, admission, lifecycle, teardown |
-| — | No runtime invariant companion is published; `@deepseek-ai/dsh-jobs/invariant` owns per-snapshot identity, status, timestamp, and owner checks. This provider's admission decision uses private configuration and must fail before a backend starter runs; `LocalJobRegistry.start()` enforces it synchronously for current producers. Repeating an aggregate after publication would expose private configuration solely to this companion and would not verify the fail-closed pre-start guarantee. |
+| [`src/events.ts`](src/events.ts) | Scope-layered event routing: `{ owner }`, `{ owners: 'all' }`, and `{ owners: 'scope' }` subscriptions |
+| [`src/ring.ts`](src/ring.ts) | The bounded per-job output ring: append, retention trim, offset reads |
+| [`src/pump.ts`](src/pump.ts) | The registry-owned pull pump: one timer per job, final drain before settlement |
+| — | No runtime invariant companion is published; `@deepseek-ai/dsh-jobs/invariant` owns the event-protocol and event-versus-read checks. This provider's admission decision uses private configuration and must fail before a backend starter runs; `LocalJobRegistry.start()` enforces it synchronously for current producers. Repeating an aggregate after publication would expose private configuration solely to this companion and would not verify the fail-closed pre-start guarantee. |
 
 ### Scope layers
 
-`attachController`, `onJobDone`, and `onJobsChanged` register into the calling context's scope layer. The controller question (`servesOwner`) and listener delivery (`listenersFor`, `changedFor`) walk the same chain: global layer first, then each scoped layer along the owner's chain. Registrations are anonymous tokens so duplicate labels stay independently disposable.
+`attachController` and `{ owners: 'scope' }` subscriptions register into the calling context's scope layer; `{ owner }` and `{ owners: 'all' }` subscriptions are unscoped. The controller question (`servesOwner`) and scoped delivery walk the same chain: global layer first, then each scoped layer along the owner's chain. Registrations are anonymous tokens so duplicate labels stay independently disposable.
 
 ### Admission and settlement
 
-`activeJobCount` counts authoritative records per exact owner or in the shared unowned bucket. `settle` marks a job reported when waiters are pending, resolves every waiter, records the terminal snapshot, announces the visible-set change, then notifies completion listeners. Pending waits mark the job reported before listeners run so completion reporters do not duplicate notices; a teardown cancel marks it for the same reason — nothing will read a notice addressed to an owner being destroyed.
+`activeJobCount` counts authoritative records per exact owner or in the shared unowned bucket. `settle` records the terminal outcome once (merging a recorded kill reason into a `killed` detail), clears the progress line, trims the ring to the settled cap (keeping every byte the model cursor has not consumed), resolves every waiter, then emits `settled` with its cause and the ring's final `output` signal. The cause is `kill` after `JobRegistry.kill`, `teardown` after an owner or service cancel, and `producer` otherwise; `dsh-tool-jobs` uses it to skip notices nobody can read.
 
 ### Teardown
 
-Owner disposal (`disposeOwned`) cancels the owner's jobs, awaits their settlement, removes their records, and announces the removal — the one visible-set change no per-job record carries. Service disposal (`disposeAll`) closes listeners, cancels all live jobs, awaits settlement, clears the store, announces the emptying to the distinct owners, then detaches the cross-fiber owner-cleanup effects.
+Owner disposal (`disposeOwned`) cancels the owner's jobs, awaits their settlement, removes their records, and announces each removal — the one visible-set change no per-job record carries. Service disposal (`disposeAll`) cancels all live jobs, awaits settlement, removes every record (announcing each removal, so a subscriber mounted outside the service drops its rows), then detaches the cross-fiber owner-cleanup effects.
 
 </details>
 
@@ -103,7 +110,7 @@ Owner disposal (`disposeOwned`) cancels the owner's jobs, awaits their settlemen
 
 Read these pages when the package-level contract is not enough. They move from the registry contract to the model-facing controls and the design records.
 
-- [Background task runtime subsystem](../../../docs/subsystems/jobs.md) — the job types, snapshot fields, and `ctx.jobs` Cordis surface.
+- [Background task runtime subsystem](../../../docs/subsystems/jobs.md) — the job types, projection fields, and `ctx.jobs` Cordis surface.
 - [jobs group map](../README.md) — the sibling group page and its package table.
 - [Registry contract](../jobs/README.md) — the abstract `ctx.jobs` service this package implements.
 - [Model-facing job controls](../tool-jobs/README.md) — the `job_output`, `job_list`, and `job_kill` tools and completion notices.
diff --git a/packages/jobs/jobs-local/README.zh.md b/packages/jobs/jobs-local/README.zh.md
index 710c02c923..38f8989f23 100644
--- a/packages/jobs/jobs-local/README.zh.md
+++ b/packages/jobs/jobs-local/README.zh.md
@@ -9,7 +9,7 @@ kind: "package-reference"
 
 ## 概述
 
-`dsh-jobs-local` 在 harness 进程内运行后台任务：工作会在 agent（智能体）继续推进的同时保持运行，拥有它的 agent 可以读取、等待、列出和取消它；同时挂载 `dsh-tool-jobs` 时，完成以会话内通知送达。它用内存记录实现 `dsh-jobs` 约定，并且只交出全新快照，从不交出实时状态。按所有者的并发上限（默认 10）约束一个 agent 同时处于运行或停止中的任务数量；任务会随 harness 进程终止而消失，无法跨重启持久。
+`dsh-jobs-local` 在 agent（智能体）继续推进时，于 harness 进程内运行后台任务。拥有任务的 agent 可以读取、等待、列出和取消任务；同时挂载 `dsh-tool-jobs` 时，还会收到会话内完成通知。可配置的并发与输出保留上限约束资源使用。生产方可以提供供定期读取的输出，也可以直接追加；用户可以观察保留的输出，而不消耗 agent 尚未读取的内容。任务在拥有者或 harness 关闭时结束。
 
 ## 目录
 
@@ -33,7 +33,7 @@ kind: "package-reference"
 
 ### 最小配置
 
-加载插件即注册 `ctx.jobs`；`maxConcurrentJobsPerOwner` 可选，默认为 `10`。
+加载插件即注册 `ctx.jobs`；每个字段都是可选的。
 
 ```yaml
 - name: '@deepseek-ai/dsh-jobs-local'
@@ -42,6 +42,9 @@ kind: "package-reference"
 | 字段 | 默认值 | 含义 |
 |---|---|---|
 | `maxConcurrentJobsPerOwner` | `10` | 每个精确所有者，或共享的无主桶中，`running` 加 `stopping` 任务的最大数量 |
+| `retainBytes` | `262144` | 每个任务输出环的运行期保留量，UTF-8 字节 |
+| `settledRetainBytes` | `16384` | 任务结算后保留的环容量，UTF-8 字节；模型尚未读取的字节保留到它的首次终态读取 |
+| `pumpPollMs` | `150` | 任务拉取源的轮询间隔，毫秒 |
 
 生成的[配置目录](../../../docs/config-catalog.zh.md#deepseek-aidsh-jobs-local)是每个受支持字段的穷尽式真源。
 
@@ -69,10 +72,11 @@ kind: "package-reference"
 
 ### 设计理念
 
-- **内存记录，全新快照。** `LocalJobRegistry` 为每个任务保存一条 `TrackedJob`，每次调用都投影出新的只读快照；调用方永远不会拿到实时状态。
-- **按所有者分层，一个进程级注册表。** 控制器、完成监听器与变更观察者归档到注册方所在的 scope（`ScopedLayers`），读取把全局层与所有者的 scope 链求并集——因此某个 preset 的任务控制绝不会为自身组合未加载任何控制器的 agent 保持 `start()` 可用，一次结算也只会抵达其所有者所属组合注册的监听器。
+- **内存记录、全新投影。** `LocalJobRegistry` 为每个任务保存一份 `TrackedJob`——生命周期状态、输出环与模型游标——每次调用都投影新的只读视图或块副本；调用方永远拿不到实时状态。
+- **环的保留量有界。** 追加超出运行期上限时丢弃最老的保留块（单个超限块保留其 UTF-8 安全尾部）；低于保留窗口的读取得到 lossy 结果而非错误。结算时裁剪到结算上限，但绝不低于模型游标尚未消费的字节数，因此在首次 `job_output` 之前结束的任务会交出运行期上限保留的全部输出；那次终态读取之后才裁剪到结算上限。
+- **按所有者分层，一个进程级注册表。** 控制器与 `{ owners: 'scope' }` 订阅归档到注册方所在的 scope（`ScopedLayers`），读取把全局层与所有者的 scope 链求并集——因此某个 preset 的任务控制绝不会为自身组合未加载任何控制器的 agent 保持 `start()` 可用，一次带 scope 的结算也只会抵达其所有者所属组合注册的监听器。
 - **启动前先预检。** `start()` 在调用生产方之前检查控制器服务、spec 有效性、仍存活的所有权与容量，因此拒绝不会留下 job id 或执行资源；注册一旦提交，后续不再有可失败步骤。
-- **结算首次优先，完成最后。** 最早的终止结果只记录一次，释放等待方，并只通知监听器一次，各监听器故障单独隔离；完成在记录提交且可见集变更发布之后才宣布，因为报告方可能同步开启一个模型轮次。
+- **结算首次优先，事件最后。** 最早的终止结果只记录一次，等待泵的最后一次排干，裁剪环，释放等待方，然后投递一次带逐监听器隔离的 `settled` 事件，再跟上环的最终 `output` 信号。
 - **销毁永不死锁。** 抛出的取消会强制失败记录并报告可能的孤立工作，而不是让释放停滞。
 
 ### 源码地图
@@ -80,19 +84,22 @@ kind: "package-reference"
 | 文件 | 职责 |
 |---|---|
 | [`src/index.ts`](src/index.ts) | 插件入口：`Config` schema、`LocalJobRegistry`、准入、生命周期、销毁 |
-| — | 不发布运行时不变式伴生入口；快照的标识、状态、时间戳与所有者检查位于 `@deepseek-ai/dsh-jobs/invariant`。此提供方的准入决策使用私有配置，并且必须在后端启动器运行前失败；当前生产方由 `LocalJobRegistry.start()` 同步执行该决策。发布后再重复聚合只会向 companion 暴露私有配置，也无法验证失败发生在启动前。 |
+| [`src/events.ts`](src/events.ts) | 按 scope 分层的事件路由：`{ owner }`、`{ owners: 'all' }` 与 `{ owners: 'scope' }` 订阅 |
+| [`src/ring.ts`](src/ring.ts) | 每个任务的有界输出环：追加、保留裁剪、按偏移读取 |
+| [`src/pump.ts`](src/pump.ts) | 注册表拥有的拉取泵：每个任务一个定时器，结算前最后一次排干 |
+| — | 不发布运行时不变式伴生入口；事件协议与事件对读取的检查位于 `@deepseek-ai/dsh-jobs/invariant`。此提供方的准入决策使用私有配置，并且必须在后端启动器运行前失败；当前生产方由 `LocalJobRegistry.start()` 同步执行该决策。发布后再重复聚合只会向 companion 暴露私有配置，也无法验证失败发生在启动前。 |
 
 ### scope 分层
 
-`attachController`、`onJobDone` 与 `onJobsChanged` 注册到调用上下文所在的 scope 层。控制器问题（`servesOwner`）与监听器投递（`listenersFor`、`changedFor`）走同一条链：先是全局层，再沿所有者的链逐层。注册是无名 token，因此重复标签仍可独立释放。
+`attachController` 与 `{ owners: 'scope' }` 订阅注册到调用上下文所在的 scope 层；`{ owner }` 与 `{ owners: 'all' }` 订阅不带 scope。控制器问题（`servesOwner`）与带 scope 的投递走同一条链：先是全局层，再沿所有者的链逐层。注册是无名 token，因此重复标签仍可独立释放。
 
 ### 准入与结算
 
-`activeJobCount` 按精确所有者或共享无主桶统计权威记录。`settle` 在存在挂起等待方时把任务标为已报告，解析每个等待方，记录终止快照，宣布可见集变更，然后通知完成监听器。挂起的等待会在监听器运行前把任务标为已报告，因此完成报告方不会重复通知；销毁时的取消出于同样理由标记——面向正在被销毁的所有者的通知不会有人读到。
+`activeJobCount` 按精确所有者或共享无主桶统计权威记录。`settle` 只记录一次终止结果（把记录下来的 kill 原因合并进 `killed` 的 detail），清除进度行，把环裁剪到结算保留量（保留模型游标尚未消费的全部字节），解析每个等待方，然后发出带原因的 `settled` 与环的最终 `output` 信号。原因在 `JobRegistry.kill` 之后为 `kill`，在所有者或服务取消之后为 `teardown`，否则为 `producer`；`dsh-tool-jobs` 据此跳过没人能读的通知。
 
 ### 销毁
 
-所有者释放（`disposeOwned`）会取消该所有者的任务、等待其结算、移除其记录，并宣布移除——这是任何逐任务记录都无法表达的可见集变更。服务释放（`disposeAll`）会关闭监听器、取消所有存活任务、等待结算、清空存储、向不同的所有者宣布清空，然后分离跨 fiber 的所有者清理 effect。
+所有者释放（`disposeOwned`）会取消该所有者的任务、等待其结算、移除其记录，并逐条宣布移除——这是任何逐任务记录都无法表达的可见集变更。服务释放（`disposeAll`）会取消所有存活任务、等待结算、移除每条记录（逐条宣布移除，让挂载在服务之外的订阅者丢掉它的行），然后分离跨 fiber 的所有者清理 effect。
 
 </details>
 
@@ -103,7 +110,7 @@ kind: "package-reference"
 
 当包级约定不够用时阅读以下页面。它们从注册表约定逐步进入模型侧控制与设计记录。
 
-- [后台任务运行时子系统](../../../docs/subsystems/jobs.zh.md)——任务类型、快照字段与 `ctx.jobs` 的 Cordis 接口面。
+- [后台任务运行时子系统](../../../docs/subsystems/jobs.zh.md)——任务类型、投影字段与 `ctx.jobs` 的 Cordis 接口面。
 - [jobs 组映射](../README.zh.md)——同级组页面及其包表格。
 - [注册表约定](../jobs/README.zh.md)——本包实现的抽象 `ctx.jobs` 服务。
 - [模型侧任务控制](../tool-jobs/README.zh.md)——`job_output`、`job_list` 与 `job_kill` 工具及完成通知。
diff --git a/packages/jobs/jobs-local/src/events.ts b/packages/jobs/jobs-local/src/events.ts
new file mode 100644
index 0000000000..8c13e4dd9c
--- /dev/null
+++ b/packages/jobs/jobs-local/src/events.ts
@@ -0,0 +1,102 @@
+/**
+ * Event routing for the local registry: subscriptions file by filter, and
+ * every commit dispatches once to each matching listener with containment.
+ * @module @deepseek-ai/dsh-jobs-local/events
+ */
+
+import type { Context } from '@deepseek-ai/cordis'
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import { AnonymousEntries, ScopedLayers, scopeOf } from '@deepseek-ai/dsh-scope'
+import type { ScopeLayer } from '@deepseek-ai/dsh-scope'
+import type { JobEvent, JobEventFilter, JobEventListener } from '@deepseek-ai/dsh-jobs'
+
+/** One registered listener and the filter it declared. */
+interface Subscription {
+  filter: JobEventFilter
+  listener: JobEventListener
+}
+
+/**
+ * One scope's contributions: the job controllers attached from it and the
+ * `{ owners: 'scope' }` subscriptions registered there. Both tables are
+ * anonymous because a contribution is identified by its own disposer, never
+ * by a name a second registrant could shadow.
+ */
+export class JobLayer implements ScopeLayer {
+  /** Tokens of the job controllers attached from this scope. */
+  readonly controllers = new AnonymousEntries<symbol>()
+  /** The `{ owners: 'scope' }` subscriptions registered from this scope. */
+  readonly scoped = new AnonymousEntries<Subscription>()
+
+  isEmpty(): boolean {
+    return this.controllers.isEmpty() && this.scoped.isEmpty()
+  }
+}
+
+/**
+ * Routes events to subscriptions. `{ owner }` and `{ owners: 'all' }`
+ * subscriptions are evaluated against every event regardless of where they
+ * were registered; `{ owners: 'scope' }` subscriptions file into the
+ * registering context's scope layer and receive the owners composed under it
+ * — the global layer, reached from an unscoped context, receives every owner.
+ */
+export class JobEventHub {
+  private readonly unscoped = new Set<Subscription>()
+
+  /**
+   * @param layers - the scope-layer table shared with the controller handshake.
+   * @param warn - sink for a listener's contained failure.
+   */
+  constructor(
+    private readonly layers: ScopedLayers<JobLayer>,
+    private readonly warn: (message: string) => void,
+  ) {}
+
+  /**
+   * Register one listener as an effect of `ctx`.
+   * @param ctx - the subscribing context; owns the effect and, for `'scope'`, names the scope.
+   * @param filter - which owners' events to deliver.
+   * @param listener - receives each matching event.
+   * @returns disposer that unregisters the listener.
+   */
+  subscribe(ctx: Context, filter: JobEventFilter, listener: JobEventListener): () => void {
+    const subscription: Subscription = { filter, listener }
+    if ('owners' in filter && filter.owners === 'scope') {
+      return this.layers.effect(ctx, layer => layer.scoped.append(subscription), { label: 'jobs.events.subscribe()' })
+    }
+    const dispose = ctx.effect(() => {
+      this.unscoped.add(subscription)
+      return () => { this.unscoped.delete(subscription) }
+    }, 'jobs.events.subscribe()')
+    // oxlint-disable-next-line typescript/no-misused-promises -- exact synchronous disposer preserves Cordis effect identity
+    return dispose
+  }
+
+  /**
+   * Deliver one event to every matching subscription, containing each
+   * listener so an observer cannot break the commit already made.
+   * @param event - the event to deliver.
+   * @param owner - the job's exact owner, or undefined for unowned work.
+   */
+  emit(event: JobEvent, owner: Agent | undefined): void {
+    const ownerId = owner?.id
+    for (const subscription of this.unscoped) {
+      const { filter } = subscription
+      if ('owner' in filter && ownerId !== undefined && ownerId !== filter.owner) continue
+      this.deliver(subscription, event)
+    }
+    for (const subscription of this.layers.global.scoped.values()) this.deliver(subscription, event)
+    const scope = owner === undefined ? undefined : scopeOf(owner.ctx)
+    for (const layer of this.layers.chainLayers(scope)) {
+      for (const subscription of layer.scoped.values()) this.deliver(subscription, event)
+    }
+  }
+
+  private deliver(subscription: Subscription, event: JobEvent): void {
+    try {
+      subscription.listener(event)
+    } catch (error: unknown) {
+      this.warn(`jobs: event listener threw on ${event.type}: ${String(error)}`)
+    }
+  }
+}
diff --git a/packages/jobs/jobs-local/src/index.ts b/packages/jobs/jobs-local/src/index.ts
index 0e0f161eaf..54ba6905d2 100644
--- a/packages/jobs/jobs-local/src/index.ts
+++ b/packages/jobs/jobs-local/src/index.ts
@@ -1,7 +1,8 @@
 /**
  * Process-local provider for the background-job capability seam
- * (`ctx.jobs`). It keeps every record in memory and hands out fresh
- * snapshots, never live state.
+ * (`ctx.jobs`). It keeps every job — lifecycle state, the bounded output
+ * ring, and the model cursor — in memory and hands out fresh projections and
+ * chunk copies, never live state.
  *
  * Registrations outlive producer and controller fibers. Agent or service
  * disposal cancels live work and awaits compliant producers; a throwing
@@ -12,14 +13,18 @@
 import { Context } from '@deepseek-ai/cordis'
 import z from '@deepseek-ai/schemastery'
 import type { Agent } from '@deepseek-ai/dsh-agent'
-import { AnonymousEntries, ScopedLayers, scopeOf } from '@deepseek-ai/dsh-scope'
-import type { ScopeLayer } from '@deepseek-ai/dsh-scope'
+import { ScopedLayers, scopeOf } from '@deepseek-ai/dsh-scope'
+import type { SessionId } from '@deepseek-ai/dsh-session'
 import { deadline, timeoutOf } from '@deepseek-ai/dsh-timeout'
 import { JobRegistry, JobId } from '@deepseek-ai/dsh-jobs'
 import type {
-  JobDoneListener, JobKind, JobOutcome, JobRead, JobSnapshot, JobStart, JobStatus,
-  JobsChangedListener,
+  JobAppendOptions, JobEvent, JobEvents, JobHandle, JobKind, JobOutcome, JobOutputRead, JobOutputSource,
+  JobRead, JobSettleCause, JobSpec, JobStatus, JobView,
 } from '@deepseek-ai/dsh-jobs'
+import { JobEventHub, JobLayer } from './events.ts'
+import { startPump } from './pump.ts'
+import type { PumpHandle } from './pump.ts'
+import { OutputRing } from './ring.ts'
 
 /** Timeout code that distinguishes a bounded wait from caller cancellation. */
 export const TASK_WAIT_TIMEOUT = 'TASK_WAIT_TIMEOUT'
@@ -27,6 +32,15 @@ export const TASK_WAIT_TIMEOUT = 'TASK_WAIT_TIMEOUT'
 /** Default maximum number of active jobs in one exact-owner bucket. */
 const DEFAULT_MAX_CONCURRENT_JOBS_PER_OWNER = 10
 
+/** Default live ring retention per job, in UTF-8 bytes. */
+const DEFAULT_RETAIN_BYTES = 256 * 1024
+
+/** Default ring retention kept after settlement, in UTF-8 bytes. */
+const DEFAULT_SETTLED_RETAIN_BYTES = 16 * 1024
+
+/** Default poll interval for pull sources, in milliseconds. */
+const DEFAULT_PUMP_POLL_MS = 150
+
 /** Configuration for the process-local job registry. */
 export interface Config {
   /**
@@ -34,9 +48,31 @@ export interface Config {
    * omission defaults to 10.
    */
   maxConcurrentJobsPerOwner?: number
+  /** Live ring retention per job in UTF-8 bytes; omission defaults to 262144. */
+  retainBytes?: number
+  /**
+   * Ring retention kept after a job settles, in UTF-8 bytes; omission defaults to 16384.
+   * Settlement keeps every byte the model cursor has not consumed on top of
+   * this cap; the first terminal model read then trims to it.
+   */
+  settledRetainBytes?: number
+  /** Poll interval for a job's pull sources, in milliseconds; omission defaults to 150. */
+  pumpPollMs?: number
 }
 
-/** The registry's mutable per-job record (never handed out — see {@link LocalJobRegistry.snapshot}). */
+/**
+ * Producer-written state shared between the {@link JobHandle} and the
+ * registered record: the starter call writes through it before the commit,
+ * the same object serves the job for its whole life afterwards.
+ */
+interface ProducerState {
+  /** Live progress line until settlement clears it. */
+  progress: string | undefined
+  /** The committed registry record; undefined exactly during the starter call. */
+  job: TrackedJob | undefined
+}
+
+/** The registry's mutable per-job record (never handed out — see {@link LocalJobRegistry.view}). */
 interface TrackedJob {
   id: JobId
   kind: JobKind
@@ -45,21 +81,38 @@ interface TrackedJob {
   /** Exact lifecycle owner; session-id authorization is derived from it. */
   owner: Agent | undefined
   cancel: (reason?: string) => void
-  readOutput: (() => string) | undefined
   status: JobStatus
+  ring: OutputRing
+  /** The model's consuming cursor; {@link JobRegistry.readAt} never moves it. */
+  modelCursor: number
+  /** Whether the first post-settlement read already handed out `result`. */
+  resultDelivered: boolean
+  /** Producer-shared progress line and commit binding. */
+  state: ProducerState
+  /** Terminal reason; a recorded kill reason is merged in at settlement. */
   detail: string | undefined
-  output: string | undefined
+  result: string | undefined
   startedAt: number
   finishedAt: number | undefined
-  reported: boolean
-  /** Resolves once the terminal snapshot is recorded and listeners notified. */
+  /** Reason recorded by {@link JobRegistry.kill}, merged into a `killed` settlement's detail. */
+  killReason: string | undefined
+  /** Set once a kill or teardown cancel ran; settlement reports it as the cause. */
+  settleCause: JobSettleCause | undefined
+  /** Resolves once the terminal record is committed and announced. */
   settled: Promise<void>
   /** Resolver for {@link settled}, called by the first effective settlement. */
   markSettled: () => void
-  /** Live waits; settlement with a waiter marks the job reported. */
-  waiters: number
   /** Removable resolvers for live waits; timeout/abort unregister before the job settles. */
   waitResolvers: Set<() => void>
+  /** The registry-owned pump over the spec's pull sources, when it named any. */
+  pump: PumpHandle | undefined
+  /**
+   * The spill file each pull source reported on its latest read, by source
+   * index; an entry is undefined while that source keeps none. Source
+   * metadata rather than per-chunk metadata, so it survives ring eviction and
+   * follows a source that withdraws its file.
+   */
+  spillPaths: (string | undefined)[]
 }
 
 /** True for the three terminal {@link JobStatus} values. */
@@ -67,22 +120,6 @@ function isTerminal(status: JobStatus): boolean {
   return status === 'completed' || status === 'killed' || status === 'failed'
 }
 
-/**
- * One scope's contributions: the job controllers attached from it and the
- * completion listeners registered there. Both tables are anonymous because a
- * contribution is identified by its own disposer, never by a name a second
- * registrant could shadow.
- */
-class JobLayer implements ScopeLayer {
-  readonly controllers = new AnonymousEntries<symbol>()
-  readonly listeners = new AnonymousEntries<JobDoneListener>()
-  readonly changed = new AnonymousEntries<JobsChangedListener>()
-
-  isEmpty(): boolean {
-    return this.controllers.isEmpty() && this.listeners.isEmpty() && this.changed.isEmpty()
-  }
-}
-
 /**
  * The in-memory `jobs` registry. See the Service Definition contract in
  * `@deepseek-ai/dsh-jobs` for the ownership, isolation, and lifecycle
@@ -95,16 +132,38 @@ export class LocalJobRegistry extends JobRegistry {
       .min(1)
       .max(Number.MAX_SAFE_INTEGER)
       .default(DEFAULT_MAX_CONCURRENT_JOBS_PER_OWNER),
+    retainBytes: z.number()
+      .step(1)
+      .min(1)
+      .max(Number.MAX_SAFE_INTEGER)
+      .default(DEFAULT_RETAIN_BYTES),
+    settledRetainBytes: z.number()
+      .step(1)
+      .min(1)
+      .max(Number.MAX_SAFE_INTEGER)
+      .default(DEFAULT_SETTLED_RETAIN_BYTES),
+    pumpPollMs: z.number()
+      .step(1)
+      .min(1)
+      .max(Number.MAX_SAFE_INTEGER)
+      .default(DEFAULT_PUMP_POLL_MS),
   })
 
   /** Schemastery-defaulted active-job limit. */
   private readonly maxConcurrentJobsPerOwner: number
+  /** Schemastery-defaulted live ring retention cap. */
+  private readonly retainBytes: number
+  /** Schemastery-defaulted settled ring retention cap. */
+  private readonly settledRetainBytes: number
+  /** Schemastery-defaulted pull-source poll interval. */
+  private readonly pumpPollMs: number
   private store = new Map<JobId, TrackedJob>()
   private counters = new Map<string, number>()
   /**
-   * Surfaces and listeners layered by the scope that registered them, in the
-   * tools-registry shape: a contribution files into its registering context's
-   * scope, and a read unions the global layer with the reader's scope chain.
+   * Controllers and scoped subscriptions layered by the scope that registered
+   * them, in the tools-registry shape: a contribution files into its
+   * registering context's scope, and a read unions the global layer with the
+   * owner's scope chain.
    *
    * The registry is one process-wide instance serving every composition, so a
    * flat table would answer a per-owner question process-wide: one preset's
@@ -114,7 +173,7 @@ export class LocalJobRegistry extends JobRegistry {
    * layer, so change notification is a no-op.
    */
   private readonly layers = new ScopedLayers<JobLayer>(() => new JobLayer(), () => {})
-  private listenersClosed = false
+  private readonly hub: JobEventHub
   /** Owner agents with attached scope cleanup, mapped to the exact disposer. */
   private ownerCleanups = new Map<Agent, () => Promise<void> | void>()
   /** Service context used by detached settlement continuations and teardown. */
@@ -122,14 +181,31 @@ export class LocalJobRegistry extends JobRegistry {
 
   constructor(ctx: Context, config: Config) {
     super(ctx)
-    // Schemastery validates and fills the default before constructing the service.
-    this.maxConcurrentJobsPerOwner = (config as Required<Config>).maxConcurrentJobsPerOwner
+    // Schemastery validates and fills the defaults before constructing the service.
+    const resolved = config as Required<Config>
+    this.maxConcurrentJobsPerOwner = resolved.maxConcurrentJobsPerOwner
+    this.retainBytes = resolved.retainBytes
+    this.settledRetainBytes = resolved.settledRetainBytes
+    this.pumpPollMs = resolved.pumpPollMs
     this.selfCtx = ctx
+    this.hub = new JobEventHub(this.layers, (message) => { ctx.logger.warn(message) })
     ctx.effect(() => () => this.disposeAll(), 'jobs teardown')
   }
 
-  start(spec: JobStart): JobId {
-    if (!this.servesOwner(spec.owner)) {
+  /**
+   * The event stream bound to the accessing context: a subscription is an
+   * effect of that context, and `{ owners: 'scope' }` names its scope.
+   */
+  get events(): JobEvents {
+    const registrar = this.ctx
+    return {
+      subscribe: (filter, listener) => this.hub.subscribe(registrar, filter, listener),
+    }
+  }
+
+  start(spec: JobSpec): JobId {
+    const owner = this.resolveOwner(spec.owner)
+    if (!this.servesOwner(owner)) {
       throw new Error('background jobs unavailable: no job controller serves this agent (load @deepseek-ai/dsh-tool-jobs in its composition)')
     }
     if (spec.kind.length === 0) throw new Error('invalid job kind: expected a non-empty string')
@@ -138,19 +214,29 @@ export class LocalJobRegistry extends JobRegistry {
       && (!Number.isSafeInteger(spec.outputLimitBytes) || spec.outputLimitBytes <= 0)) {
       throw new Error(`invalid outputLimitBytes: expected a positive safe integer, got ${JSON.stringify(spec.outputLimitBytes)}`)
     }
-    if (spec.owner !== undefined) this.ensureOwnerCleanup(spec.owner)
+    if (owner !== undefined) this.ensureOwnerCleanup(owner)
 
-    const active = this.activeJobCount(spec.owner)
+    const active = this.activeJobCount(owner)
     if (active >= this.maxConcurrentJobsPerOwner) {
       throw new Error(
         `background job limit reached for this owner (limit: ${this.maxConcurrentJobsPerOwner}); use job_kill to stop an unneeded job, wait for it to finish, then retry`,
       )
     }
 
-    const hooks = spec.run()
+    // The id is issued before the starter runs so the producer face can carry
+    // it; a throwing starter still leaves nothing registered — its ordinal is
+    // simply skipped.
     const count = (this.counters.get(spec.kind) ?? 0) + 1
     this.counters.set(spec.kind, count)
     const id = JobId(`${spec.kind}-${count}`)
+    const ring = new OutputRing()
+    const state: ProducerState = { progress: undefined, job: undefined }
+    const handle: JobHandle = {
+      id,
+      append: (text, options) => { this.appendRing(state, ring, text, options, 'producer') },
+      updateProgress: (line) => { this.updateProgress(state, line) },
+    }
+    const hooks = spec.run(handle)
 
     let markSettled!: () => void
     const settled = new Promise<void>((resolve) => { markSettled = resolve })
@@ -159,139 +245,92 @@ export class LocalJobRegistry extends JobRegistry {
       kind: spec.kind,
       label: spec.label,
       outputLimitBytes: spec.outputLimitBytes,
-      owner: spec.owner,
+      owner,
       cancel: hooks.cancel.bind(hooks),
-      readOutput: hooks.readOutput?.bind(hooks),
       status: 'running',
+      ring,
+      modelCursor: 0,
+      resultDelivered: false,
+      state,
       detail: undefined,
-      output: undefined,
+      result: undefined,
       startedAt: Date.now(),
       finishedAt: undefined,
-      reported: false,
+      killReason: undefined,
+      settleCause: undefined,
       settled,
       markSettled,
-      waiters: 0,
       waitResolvers: new Set(),
+      pump: undefined,
+      spillPaths: [],
     }
+    // Binding the shared producer state is the commit: writes staged inside
+    // the starter are already in the ring and `state`, and every later handle
+    // call reaches the registered record for its terminal checks and signals.
+    state.job = job
     this.store.set(id, job)
+    // Registration is complete and cannot fail from here, so the visible set
+    // has genuinely changed. The announcement precedes the pump because the
+    // pump drains its sources once synchronously, and that drain may append
+    // and announce output: a job's first event is always `registered`.
+    this.emit({ type: 'registered', job: this.view(job) }, owner)
 
-    void hooks.done.then(
-      (outcome) => { this.settle(job, outcome) },
-      (error: unknown) => {
+    // The producer's settlement or a registry-forced one ends the pump; the
+    // pump's final drain then lands before this registry trims the ring.
+    const producerDone = hooks.done.then(
+      outcome => outcome,
+      (error: unknown): JobOutcome => {
         // Contain a producer contract violation (`done` rejected) so cleanup and waiters cannot hang.
         this.selfCtx.logger.warn(`jobs: job ${job.id} producer done promise rejected (producer contract violation): ${String(error)}`)
-        this.settle(job, { status: 'failed', detail: String(error) })
+        return { status: 'failed', detail: String(error) }
       },
     )
-    // Registration is complete and cannot fail from here, so the visible set
-    // has genuinely changed.
-    this.notifyChanged(job.owner)
+    if (spec.output !== undefined && spec.output.length > 0) {
+      job.pump = startPump(
+        spec.output.map(source => this.guardSource(job, source)),
+        {
+          append: (text, options) => { this.appendRing(state, ring, text, options, 'pump') },
+          spill: (index, path) => { job.spillPaths[index] = path },
+        },
+        this.pumpPollMs,
+        Promise.race([producerDone, settled]),
+      )
+    }
+    void producerDone.then(async (outcome) => {
+      if (job.pump !== undefined) await job.pump.done
+      this.settle(job, outcome, job.settleCause ?? 'producer')
+    })
     return id
   }
 
-  list(caller?: Agent): JobSnapshot[] {
-    const session = caller?.id
+  list(caller?: SessionId): JobView[] {
     return [...this.store.values()]
-      .filter(job => job.owner === undefined || job.owner.id === session)
-      .map(job => this.snapshot(job))
+      .filter(job => job.owner === undefined || job.owner.id === caller)
+      .map(job => this.view(job))
   }
 
-  get(id: JobId, caller?: Agent): JobSnapshot {
-    const job = this.expect(id)
-    this.assertAccess(job, caller)
-    return this.snapshot(job)
+  get(id: JobId, caller?: SessionId): JobView {
+    return this.view(this.expect(id, caller))
   }
 
-  read(id: JobId, caller?: Agent): JobRead {
-    const job = this.expect(id)
-    this.assertAccess(job, caller)
-    const text = job.readOutput !== undefined
-      ? job.readOutput()
-      : isTerminal(job.status) ? job.output ?? '' : ''
-    if (isTerminal(job.status)) job.reported = true
-    return { text, snapshot: this.snapshot(job) }
+  read(id: JobId, caller?: SessionId): JobRead {
+    return this.readJob(this.expect(id, caller))
   }
 
-  kill(id: JobId, caller?: Agent, reason?: string): 'requested' | 'already-finished' {
-    const job = this.expect(id)
-    this.assertAccess(job, caller)
-    if (isTerminal(job.status)) {
-      job.reported = true
-      return 'already-finished'
+  readAt(id: JobId, from: number, caller?: SessionId): JobOutputRead {
+    const job = this.expect(id, caller)
+    if (!Number.isSafeInteger(from) || from < 0) {
+      throw new Error(`invalid output read offset: expected a non-negative safe integer, got ${JSON.stringify(from)}`)
     }
-    // Cancel first so a throw leaves both lifecycle and notice state unchanged.
-    job.cancel(reason)
-    job.status = 'stopping'
-    job.reported = true
-    this.notifyChanged(job.owner)
-    return 'requested'
+    return job.ring.readFrom(from)
   }
 
-  async wait(id: JobId, timeoutMs: number, caller?: Agent, signal?: AbortSignal): Promise<JobSnapshot> {
-    const job = this.expect(id)
-    this.assertAccess(job, caller)
-    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
-      throw new Error(`invalid wait timeout: expected a positive number of milliseconds, got ${JSON.stringify(timeoutMs)}`)
-    }
-    if (!isTerminal(job.status)) {
-      if (signal?.aborted) throw new Error('wait aborted')
-      // Abort removes the waiter synchronously so same-tick settlement cannot
-      // suppress a notice for a wait that will reject.
-      job.waiters += 1
-      let counted = true
-      const uncount = (): void => {
-        if (!counted) return
-        counted = false
-        job.waiters -= 1
-      }
-      try {
-        // The scoped deadline distinguishes a successful wait timeout from
-        // caller cancellation and clears its timer on every exit.
-        using d = deadline(signal, timeoutMs, TASK_WAIT_TIMEOUT)
-        await new Promise<void>((resolve, reject) => {
-          const onSettled = (): void => {
-            job.waitResolvers.delete(onSettled)
-            d.signal.removeEventListener('abort', onAbort)
-            resolve()
-          }
-          const onAbort = (): void => {
-            job.waitResolvers.delete(onSettled)
-            // A settled job cannot reach here: settlement releases every waiter
-            // before it announces completion, and each released waiter detaches
-            // this listener in the same synchronous span, so nothing that reacts
-            // to a settlement can abort a wait the settlement already owed.
-            if (timeoutOf(d.signal, TASK_WAIT_TIMEOUT) !== undefined) {
-              resolve()
-            } else {
-              uncount()
-              reject(new Error('wait aborted'))
-            }
-          }
-          job.waitResolvers.add(onSettled)
-          d.signal.addEventListener('abort', onAbort, { once: true })
-        })
-      } finally {
-        uncount()
-      }
-    }
-    if (isTerminal(job.status)) job.reported = true
-    return this.snapshot(job)
+  kill(id: JobId, caller?: SessionId, reason?: string): 'requested' | 'already-finished' {
+    return this.killJob(this.expect(id, caller), reason)
   }
 
-  onJobDone(listener: JobDoneListener): () => void {
-    return this.layers.effect(
-      this.ctx,
-      layer => layer.listeners.append(listener),
-      { label: 'jobs.onJobDone()' },
-    )
-  }
-
-  onJobsChanged(listener: JobsChangedListener): () => void {
-    return this.layers.effect(
-      this.ctx,
-      layer => layer.changed.append(listener),
-      { label: 'jobs.onJobsChanged()' },
-    )
+  async wait(id: JobId, timeoutMs: number, caller?: SessionId, signal?: AbortSignal): Promise<JobView> {
+    return this.waitJob(this.expect(id, caller), timeoutMs, signal)
   }
 
   attachController(name: string): () => void {
@@ -304,6 +343,24 @@ export class LocalJobRegistry extends JobRegistry {
     )
   }
 
+  /**
+   * Resolve a spec's owner session to its live Agent. An owned registration
+   * needs the agent registry, and the session must currently have a live
+   * instance: that instance's disposal is what cancels and drops the job.
+   */
+  private resolveOwner(session: SessionId | undefined): Agent | undefined {
+    if (session === undefined) return undefined
+    const agents = this.selfCtx.get('agents')
+    if (agents === undefined) {
+      throw new Error('background job ownership requires the agent registry (load @deepseek-ai/dsh-agent)')
+    }
+    const owner = agents.get(session)
+    if (owner === undefined) {
+      throw new Error(`session "${session}" has no live agent (background job owner must be live)`)
+    }
+    return owner
+  }
+
   /**
    * Whether an attached job controller can collect and stop work owned by
    * `owner`. The global layer holds every controller attached from an unscoped
@@ -327,133 +384,227 @@ export class LocalJobRegistry extends JobRegistry {
     return count
   }
 
-  /**
-   * The completion listeners that own `owner`'s notices: the global layer's
-   * first, then each scoped layer along the owner's chain. A listener outside
-   * that chain belongs to another composition and must not deliver, or the
-   * owner reads one notice per mounted preset.
-   * @param owner - the settled job's owner, or undefined for unowned work.
-   * @returns the listeners to notify, in registration order per layer.
-   */
-  private *listenersFor(owner?: Agent): IterableIterator<JobDoneListener> {
-    yield* this.layers.global.listeners.values()
-    const scope = owner === undefined ? undefined : scopeOf(owner.ctx)
-    for (const layer of this.layers.chainLayers(scope)) yield* layer.listeners.values()
-  }
-
-  /** Look up a job or fail loud. */
-  private expect(id: JobId): TrackedJob {
+  /** Look up a job and enforce caller access. */
+  private expect(id: JobId, caller?: SessionId): TrackedJob {
     const job = this.store.get(id)
     if (job === undefined) throw new Error(`unknown job ${id}`)
+    this.assertAccess(job, caller)
     return job
   }
 
   /**
    * The isolation fence: a job with an owner is reachable only by callers
    * whose session id matches (`!== undefined` semantics — an unowned job is
-   * open, and a no-agent caller can never match an owned one).
+   * open, and a caller-less view can never match an owned one).
    */
-  private assertAccess(job: TrackedJob, caller?: Agent): void {
-    if (job.owner !== undefined && job.owner.id !== caller?.id) {
+  private assertAccess(job: TrackedJob, caller: SessionId | undefined): void {
+    if (job.owner !== undefined && job.owner.id !== caller) {
       throw new Error(`job ${job.id} belongs to another session`)
     }
   }
 
-  /** Project a fresh read-only snapshot from the mutable record. */
-  private snapshot(job: TrackedJob): JobSnapshot {
-    const ownerSession = job.owner?.id
+  /** Project a fresh read-only view from the mutable record. */
+  private view(job: TrackedJob): JobView {
+    const owner = job.owner?.id
+    const spillPaths = [...new Set(job.spillPaths.filter((path): path is string => path !== undefined))]
     return {
       id: job.id,
       kind: job.kind,
       label: job.label,
+      ...owner !== undefined ? { owner } : {},
       ...job.outputLimitBytes !== undefined ? { outputLimitBytes: job.outputLimitBytes } : {},
-      ...ownerSession !== undefined ? { ownerSession } : {},
       status: job.status,
+      ...job.state.progress !== undefined ? { progress: job.state.progress } : {},
       ...job.detail !== undefined ? { detail: job.detail } : {},
       startedAt: job.startedAt,
       ...job.finishedAt !== undefined ? { finishedAt: job.finishedAt } : {},
-      reported: job.reported,
+      output: {
+        total: job.ring.total,
+        earliest: job.ring.earliest,
+        ...spillPaths.length > 0 ? { spillPaths } : {},
+      },
     }
   }
 
-  /**
-   * The change observers that own `owner`'s updates, resolved exactly like
-   * {@link listenersFor}: the global layer — a host composition's own carrier,
-   * which serves every owner — then each scoped layer along the owner's chain.
-   * An observer outside that chain belongs to another composition and would
-   * otherwise be told about agents it does not compose.
-   * @param owner - the owner whose visible set moved, or undefined for unowned work.
-   * @returns the observers to notify, in registration order per layer.
-   */
-  private *changedFor(owner?: Agent): IterableIterator<JobsChangedListener> {
-    yield* this.layers.global.changed.values()
-    const scope = owner === undefined ? undefined : scopeOf(owner.ctx)
-    for (const layer of this.layers.chainLayers(scope)) yield* layer.changed.values()
+  private emit(event: JobEvent, owner: Agent | undefined): void {
+    this.hub.emit(event, owner)
   }
 
   /**
-   * Announce that one owner's visible set changed. Each listener is contained
-   * so an observer cannot break a lifecycle commit that already happened.
+   * Consume the ring from the model cursor; the result rides the first read
+   * after settlement. A terminal read is the point the settled stream drops
+   * to the settled cap: settlement kept every unconsumed byte for it.
    */
-  private notifyChanged(owner: Agent | undefined): void {
-    for (const listener of this.changedFor(owner)) {
-      try {
-        listener(owner)
-      } catch (error: unknown) {
-        this.selfCtx.logger.warn(`jobs: onJobsChanged listener threw: ${String(error)}`)
-      }
+  private readJob(job: TrackedJob): JobRead {
+    const read = job.ring.readFrom(job.modelCursor)
+    job.modelCursor = job.ring.total
+    const result = isTerminal(job.status) && !job.resultDelivered ? job.result : undefined
+    if (result !== undefined) job.resultDelivered = true
+    if (isTerminal(job.status)) job.ring.trim(this.settledRetainBytes)
+    return {
+      chunks: read.chunks,
+      lossy: read.lossy,
+      ...result !== undefined ? { result } : {},
+      job: this.view(job),
     }
   }
 
+  private killJob(job: TrackedJob, reason?: string): 'requested' | 'already-finished' {
+    if (isTerminal(job.status)) return 'already-finished'
+    // Cancel first so a throw leaves lifecycle state unchanged.
+    job.cancel(reason)
+    job.status = 'stopping'
+    // Last writer wins on purpose: the detail reports the latest kill intent.
+    if (reason !== undefined) job.killReason = reason
+    job.settleCause = 'kill'
+    this.emit({ type: 'stopping', job: this.view(job) }, job.owner)
+    return 'requested'
+  }
+
+  private async waitJob(job: TrackedJob, timeoutMs: number, signal?: AbortSignal): Promise<JobView> {
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+      throw new Error(`invalid wait timeout: expected a positive number of milliseconds, got ${JSON.stringify(timeoutMs)}`)
+    }
+    if (!isTerminal(job.status)) {
+      if (signal?.aborted) throw new Error('wait aborted')
+      // The scoped deadline distinguishes a successful wait timeout from
+      // caller cancellation and clears its timer on every exit.
+      using d = deadline(signal, timeoutMs, TASK_WAIT_TIMEOUT)
+      await new Promise<void>((resolve, reject) => {
+        const onSettled = (): void => {
+          job.waitResolvers.delete(onSettled)
+          d.signal.removeEventListener('abort', onAbort)
+          resolve()
+        }
+        const onAbort = (): void => {
+          job.waitResolvers.delete(onSettled)
+          // A settled job cannot reach here: settlement releases every waiter
+          // before it announces, and each released waiter detaches this
+          // listener in the same synchronous span, so nothing that reacts to a
+          // settlement can abort a wait the settlement already owed.
+          if (timeoutOf(d.signal, TASK_WAIT_TIMEOUT) !== undefined) {
+            resolve()
+          } else {
+            reject(new Error('wait aborted'))
+          }
+        }
+        job.waitResolvers.add(onSettled)
+        d.signal.addEventListener('abort', onAbort, { once: true })
+      })
+    }
+    return this.view(job)
+  }
+
   /**
-   * Record the first terminal outcome, release waiters, then announce
-   * completion. First-wins preserves a teardown force-failure against late
-   * producer settlement. Pending waits mark the job reported before listeners
-   * run. Completion is announced last because a reporter may open a model turn
-   * synchronously: every other observer of this settlement must already have
-   * seen the committed record.
+   * Append one chunk to the ring. A producer chunk against a settled job is
+   * logged and dropped; the registry's own pump drains silently after
+   * settlement (a forced settlement may precede the producer's). A chunk
+   * staged inside the starter call is retained and signals no observer — the
+   * registration commit publishes it.
    */
-  private settle(job: TrackedJob, outcome: JobOutcome): void {
+  private appendRing(
+    state: ProducerState,
+    ring: OutputRing,
+    text: string,
+    options: JobAppendOptions | undefined,
+    writer: 'producer' | 'pump',
+  ): void {
+    const job = state.job
+    if (job !== undefined && isTerminal(job.status)) {
+      if (writer === 'producer') this.selfCtx.logger.warn(`jobs: append to settled job ${job.id} dropped`)
+      return
+    }
+    if (!ring.append(text, options, this.retainBytes)) return
+    if (job !== undefined) this.emitOutput(job)
+  }
+
+  /**
+   * Contain a failing pull source: the first throw is logged, and the source
+   * reads as exhausted from then on, so the job runs to its own settlement
+   * with whatever the ring holds instead of freezing on a pump failure.
+   */
+  private guardSource(job: TrackedJob, source: JobOutputSource): JobOutputSource {
+    let failed = false
+    return {
+      ...source.channel !== undefined ? { channel: source.channel } : {},
+      read: (fromByte) => {
+        if (failed) return { text: '', nextOffset: fromByte, lossy: false }
+        try {
+          return source.read(fromByte)
+        } catch (error: unknown) {
+          failed = true
+          this.selfCtx.logger.warn(`jobs: output source for ${job.id} failed; its stream stops here: ${String(error)}`)
+          return { text: '', nextOffset: fromByte, lossy: false }
+        }
+      },
+    }
+  }
+
+  /** Announce that one job's ring advanced (append or settlement). */
+  private emitOutput(job: TrackedJob): void {
+    const owner = job.owner?.id
+    this.emit({ type: 'output', id: job.id, ...owner !== undefined ? { owner } : {}, total: job.ring.total }, job.owner)
+  }
+
+  /**
+   * Replace the live progress line through a producer face; a write against a
+   * settled job is logged and dropped. A write staged inside the starter call
+   * seeds the registered projection and signals no observer.
+   */
+  private updateProgress(state: ProducerState, line: string): void {
+    const job = state.job
+    if (job !== undefined && isTerminal(job.status)) {
+      this.selfCtx.logger.warn(`jobs: progress update on settled job ${job.id} dropped`)
+      return
+    }
+    state.progress = line
+    if (job !== undefined) this.emit({ type: 'progress', job: this.view(job) }, job.owner)
+  }
+
+  /**
+   * Record the first terminal outcome, release waiters, then announce the
+   * settlement. First-wins preserves a teardown force-failure against late
+   * producer settlement. The settled event follows every released waiter, so
+   * a consumer that claims while waiting always claims before the event.
+   */
+  private settle(job: TrackedJob, outcome: JobOutcome, cause: JobSettleCause): void {
     if (isTerminal(job.status)) return
     job.status = outcome.status
-    job.detail = outcome.detail
-    job.output = outcome.output
+    // A killed settlement carries the recorded kill reason in its detail:
+    // producer facts first (`signal: SIGTERM; cancelled by the user`). A job
+    // that outran its kill request (settled `completed`/`failed`) keeps the
+    // producer detail alone — the reason describes a kill that never landed.
+    if (outcome.status === 'killed' && job.killReason !== undefined) {
+      job.detail = outcome.detail !== undefined
+        ? `${outcome.detail}; ${job.killReason}`
+        : job.killReason
+    } else if (outcome.detail !== undefined) {
+      job.detail = outcome.detail
+    }
+    job.state.progress = undefined
+    job.result = outcome.result
     job.finishedAt = Date.now()
-    if (job.waiters > 0) job.reported = true
-    const snapshot = this.snapshot(job)
+    // Settlement ends the stream: trim to the settled cap before any observer
+    // reads the terminal projection, but never below the bytes the model
+    // cursor has not consumed. A job that finishes before its first model
+    // read keeps everything the live cap retained until that read.
+    job.ring.trim(Math.max(this.settledRetainBytes, job.ring.total - job.modelCursor))
     const waitResolvers = [...job.waitResolvers]
     job.waitResolvers.clear()
     for (const resolveWait of waitResolvers) resolveWait()
     job.markSettled()
-    this.notifyChanged(job.owner)
-    if (this.listenersClosed) return
-    for (const listener of this.listenersFor(job.owner)) {
-      try {
-        const returned = listener(snapshot, job.owner)
-        void Promise.resolve(returned).catch((error: unknown) => {
-          this.selfCtx.logger.warn(`jobs: onJobDone listener rejected for ${job.id}: ${String(error)}`)
-        })
-      } catch (error: unknown) {
-        this.selfCtx.logger.warn(`jobs: onJobDone listener threw for ${job.id}: ${String(error)}`)
-      }
-    }
+    this.emit({ type: 'settled', job: this.view(job), cause }, job.owner)
+    // The ring's stream ends with settlement; the signal follows the committed
+    // settlement so an observer that wakes on it reads the terminal state.
+    this.emitOutput(job)
   }
 
   /**
    * Attach one awaited cleanup through the exact owner's scope. This survives
    * producer reloads and joins agent quiescence; the retained disposer lets
-   * service teardown detach the cross-fiber effect. Fails when the registry is
-   * absent or the owner is not its currently registered instance.
+   * service teardown detach the cross-fiber effect.
    */
   private ensureOwnerCleanup(owner: Agent): void {
-    const ownerId = owner.id
-    const agents = this.selfCtx.get('agents')
-    if (agents === undefined) {
-      throw new Error('background job ownership requires the agent registry (load @deepseek-ai/dsh-agent)')
-    }
-    if (agents.get(ownerId) !== owner) {
-      throw new Error(`agent "${ownerId}" is not the registered agent instance (background job owner must be live)`)
-    }
     if (this.ownerCleanups.has(owner)) return
     // Record only after attach succeeds; a disposing scope rejects new effects.
     const detach = owner.ctx.effect(() => async () => {
@@ -468,31 +619,30 @@ export class LocalJobRegistry extends JobRegistry {
     const owned = [...this.store.values()].filter(job => job.owner === owner)
     this.cancelForTeardown(owned, 'owner disposed')
     await Promise.all(owned.map(job => job.settled))
-    for (const job of owned) this.store.delete(job.id)
-    // Removal is the one visible-set change no per-job record carries, so it
-    // must be announced here or an observer keeps the dropped rows forever.
-    if (owned.length > 0) this.notifyChanged(owner)
+    this.remove(owned)
+  }
+
+  /** Drop settled records and announce each removal, the one visible-set change no per-job record carries. */
+  private remove(jobs: readonly TrackedJob[]): void {
+    for (const job of jobs) {
+      this.store.delete(job.id)
+      this.emit({ type: 'removed', job: this.view(job) }, job.owner)
+    }
   }
 
   /**
-   * Close listeners, cancel live jobs, await settlement, and detach owner
+   * Cancel live jobs, await settlement, drop every record, and detach owner
    * effects. Throwing cancels are force-failed to avoid teardown deadlock.
    */
   private async disposeAll(): Promise<void> {
-    // The flag is the whole guard: each layer entry's undo belongs to the fiber
-    // that registered it, so this service may not drop them on its own way out.
-    this.listenersClosed = true
     const all = [...this.store.values()]
     this.cancelForTeardown(all, 'jobs service disposed')
     await Promise.all(all.map(job => job.settled))
-    // Distinct owners whose records just disappeared. A change observer files
-    // into the layer of the context that registered it, so a consumer mounted
-    // outside this service — the api-proxy carrier registers from the mux
-    // stream — is still reachable here. Without this it keeps the rows it last
-    // received after a registry reload.
-    const emptied = new Set(all.map(job => job.owner))
-    this.store.clear()
-    for (const owner of emptied) this.notifyChanged(owner)
+    // A subscriber mounted outside this service — the job controller's rows
+    // stream registers from its own context — is still reachable here.
+    // Without the removals it keeps the rows it last received after a
+    // registry reload.
+    this.remove(all)
     // Detach cross-fiber owner effects after the shared store is quiescent.
     const ownerCleanups = [...this.ownerCleanups.values()]
     this.ownerCleanups.clear()
@@ -507,25 +657,21 @@ export class LocalJobRegistry extends JobRegistry {
   private cancelForTeardown(jobs: TrackedJob[], reason: string): void {
     for (const job of jobs) {
       if (isTerminal(job.status)) continue
-      // Teardown cancellation is a kill without a caller, so it claims the
-      // terminal report the same way `kill()` does. Nothing will read a notice
-      // for a job whose owner or service is being destroyed, and a waking
-      // reporter would spend a model request per teardown layer. This is
-      // decided before the producer runs: the force-failure below settles the
-      // record too, so a throwing cancel must not be the one path that
-      // announces an unreported completion into a disposing owner.
-      job.reported = true
+      // Whatever settles this job from here on, its owner or the service is
+      // being destroyed: the settlement announces `teardown` so a completion
+      // reporter does not address a reader that no longer exists.
+      job.settleCause = 'teardown'
       try {
         job.cancel(reason)
         job.status = 'stopping'
         // Teardown reaches settlement only after the producer releases, which a
         // slow stop can defer; announcing the transition here is what keeps an
         // observer from showing `running` for that whole window.
-        this.notifyChanged(job.owner)
+        this.emit({ type: 'stopping', job: this.view(job) }, job.owner)
       } catch (error: unknown) {
         const detail = `cancel threw during teardown; work may be orphaned: ${String(error)}`
         this.selfCtx.logger.warn(`jobs: cancel of ${job.id} threw during teardown; job record forced failed and work may be orphaned: ${String(error)}`)
-        this.settle(job, { status: 'failed', detail })
+        this.settle(job, { status: 'failed', detail }, 'teardown')
       }
     }
   }
diff --git a/packages/jobs/jobs-local/src/pump.ts b/packages/jobs/jobs-local/src/pump.ts
new file mode 100644
index 0000000000..4cd98e0dea
--- /dev/null
+++ b/packages/jobs/jobs-local/src/pump.ts
@@ -0,0 +1,106 @@
+/**
+ * The registry-owned pull pump: copies a job's {@link JobOutputSource}s into
+ * its ring at a bounded cadence and drains them once more after the
+ * producer settles, so the ring holds every byte before settlement trims and
+ * closes it. A lossy source read lands as a gap chunk; the spill file a source
+ * keeps is reported to the sink on every read, because that reference
+ * outlives any chunk. Pure utility — no cordis, no timers retained past
+ * settlement.
+ * @module @deepseek-ai/dsh-jobs-local/pump
+ */
+
+import type { JobAppendOptions, JobOutputSource } from '@deepseek-ai/dsh-jobs'
+
+/** One pump run; `done` resolves after the final post-settlement drain. */
+export interface PumpHandle {
+  done: Promise<void>
+}
+
+/** Where a pump delivers what it reads. */
+export interface PumpSink {
+  /**
+   * Append copied text to the ring.
+   * @param text - the chunk text, exactly as read.
+   * @param options - stream label and gap marker.
+   */
+  append(text: string, options?: JobAppendOptions): void
+  /**
+   * Record the spill file source `index` advertised on its latest read; called
+   * on every read, with `undefined` when the source keeps none or withdrew it.
+   * @param index - the source's position in the pump's source array.
+   * @param path - the host path the source reported, if any.
+   */
+  spill(index: number, path: string | undefined): void
+}
+
+/**
+ * Drain every source in array order, sleep `pollMs` or until `until`
+ * settles, repeat, then drain one final time. A lossy source read appends
+ * its surviving tail with `gapBefore`, so the discontinuity stays visible to
+ * observers. Sources drain in array order each round, so bytes two sources
+ * produced inside one poll window land in that order, not in the order they
+ * were written: the ring is a best-effort live view whose cross-source
+ * reordering is bounded by `pollMs`.
+ *
+ * The wait holds constant resources however long the job runs: one
+ * subscription on `until` for the whole run and one pending timer at a time.
+ * @param sources - producer streams, each pumped at its own offset.
+ * @param sink - receives each copied chunk and each source's current spill file.
+ * @param pollMs - poll interval in milliseconds; a positive finite number.
+ * @param until - settles (or rejects, which counts as settlement) when the producer finished; only its `then` is used.
+ * @returns the handle whose `done` resolves after the final drain.
+ */
+export function startPump(
+  sources: readonly JobOutputSource[],
+  sink: PumpSink,
+  pollMs: number,
+  until: PromiseLike<unknown>,
+): PumpHandle {
+  if (!Number.isFinite(pollMs) || pollMs <= 0) {
+    throw new Error(`invalid pump pollMs: expected a positive finite number of milliseconds, got ${JSON.stringify(pollMs)}`)
+  }
+  const states = sources.map(source => ({ source, cursor: 0 }))
+  const drain = (): void => {
+    for (const [index, state] of states.entries()) {
+      const { source } = state
+      const read = source.read(state.cursor)
+      state.cursor = read.nextOffset
+      sink.spill(index, read.spillPath)
+      if (read.text.length === 0) continue
+      if (source.channel === undefined && !read.lossy) {
+        sink.append(read.text)
+      } else {
+        sink.append(read.text, {
+          ...source.channel !== undefined ? { channel: source.channel } : {},
+          ...read.lossy ? { gapBefore: true as const } : {},
+        })
+      }
+    }
+  }
+  const done = (async (): Promise<void> => {
+    let settled = false
+    let timer: ReturnType<typeof setTimeout> | undefined
+    let wake: (() => void) | undefined
+    const finish = (): void => {
+      settled = true
+      // Clear the pending poll so a finished pump holds no timer for up to one
+      // interval, and release the current wait so the final drain runs at once.
+      // `finish` always runs from a microtask, after the loop parked on its
+      // first timer, so the timer is never absent here.
+      clearTimeout(timer)
+      wake?.()
+    }
+    void until.then(finish, finish)
+    while (!settled) {
+      drain()
+      await new Promise<void>((resolve) => {
+        wake = resolve
+        timer = setTimeout(resolve, pollMs)
+      })
+      wake = undefined
+      timer = undefined
+    }
+    drain()
+  })()
+  return { done }
+}
diff --git a/packages/jobs/jobs-local/src/ring.ts b/packages/jobs/jobs-local/src/ring.ts
new file mode 100644
index 0000000000..fb4bcb3c5b
--- /dev/null
+++ b/packages/jobs/jobs-local/src/ring.ts
@@ -0,0 +1,113 @@
+/**
+ * The bounded output ring behind one job: chunks at absolute byte offsets,
+ * head eviction that never moves an assigned offset, and non-consuming reads
+ * from any offset.
+ * @module @deepseek-ai/dsh-jobs-local/ring
+ */
+
+import type { JobAppendOptions, JobChannel, JobOutputRead } from '@deepseek-ai/dsh-jobs'
+
+/** One retained ring entry; `bytes` caches the chunk's UTF-8 length. */
+interface RingChunk {
+  at: number
+  text: string
+  bytes: number
+  channel?: JobChannel
+  gapBefore?: true
+}
+
+/**
+ * The UTF-8-safe tail of `text` no longer than `maxBytes`: the byte cut
+ * advances past continuation bytes so the surviving text never starts inside
+ * a code point.
+ * @param text - the oversized chunk text.
+ * @param maxBytes - positive byte budget for the surviving tail.
+ * @returns the surviving tail and its exact byte length.
+ */
+function utf8Tail(text: string, maxBytes: number): { text: string; bytes: number } {
+  const raw = Buffer.from(text, 'utf8')
+  let start = raw.length - maxBytes
+  // The loop bound proves the index is in range; the assertion only
+  // discharges noUncheckedIndexedAccess.
+  while (start < raw.length && ((raw[start] as number) & 0xC0) === 0x80) start += 1
+  const tail = raw.subarray(start)
+  return { text: tail.toString('utf8'), bytes: tail.length }
+}
+
+/** Offsets stay absolute across eviction: `earliest` only ever advances. */
+export class OutputRing {
+  /** Retained chunks in offset order. */
+  private readonly chunks: RingChunk[] = []
+  /** Sum of the retained chunks' byte lengths. */
+  retainedBytes = 0
+  /** Total UTF-8 bytes ever appended — the offset the next chunk starts at. */
+  total = 0
+  /** Offset of the oldest retained byte (equals {@link total} when nothing is retained). */
+  earliest = 0
+
+  /**
+   * Append one chunk and trim the head to `cap`.
+   * @param text - the chunk text, exactly as produced.
+   * @param options - stream label and gap marker.
+   * @param cap - retention cap in UTF-8 bytes after this append.
+   * @returns false when the chunk was empty and nothing changed.
+   */
+  append(text: string, options: JobAppendOptions | undefined, cap: number): boolean {
+    if (text.length === 0) return false
+    const bytes = Buffer.byteLength(text, 'utf8')
+    this.chunks.push({
+      at: this.total,
+      text,
+      bytes,
+      ...options?.channel !== undefined ? { channel: options.channel } : {},
+      ...options?.gapBefore !== undefined ? { gapBefore: options.gapBefore } : {},
+    })
+    this.total += bytes
+    this.retainedBytes += bytes
+    this.trim(cap)
+    return true
+  }
+
+  /**
+   * Drop retained head chunks until the ring fits `cap`; a single oversized
+   * chunk keeps only its UTF-8-safe tail with a `gapBefore` marker.
+   * @param cap - retention cap in UTF-8 bytes.
+   */
+  trim(cap: number): void {
+    while (this.retainedBytes > cap && this.chunks.length > 1) {
+      const dropped = this.chunks.shift()
+      /* v8 ignore next -- the length guard proves shift() returns a chunk; the check only satisfies noUncheckedIndexedAccess. */
+      if (dropped === undefined) break
+      this.retainedBytes -= dropped.bytes
+    }
+    const single = this.chunks.length === 1 ? this.chunks[0] : undefined
+    if (single !== undefined && single.bytes > cap) {
+      const tail = utf8Tail(single.text, cap)
+      single.at += single.bytes - tail.bytes
+      single.text = tail.text
+      single.bytes = tail.bytes
+      single.gapBefore = true
+      this.retainedBytes = tail.bytes
+    }
+    this.earliest = this.chunks[0]?.at ?? this.total
+  }
+
+  /**
+   * Retained chunks overlapping `[from, total)` as fresh wire chunks.
+   * @param from - absolute byte offset to read from.
+   * @returns the chunks, the resume offset, and whether bytes before them were evicted.
+   */
+  readFrom(from: number): JobOutputRead {
+    const chunks = []
+    for (const chunk of this.chunks) {
+      if (chunk.at + chunk.bytes <= from) continue
+      chunks.push({
+        at: chunk.at,
+        text: chunk.text,
+        ...chunk.channel !== undefined ? { channel: chunk.channel } : {},
+        ...chunk.gapBefore !== undefined ? { gapBefore: chunk.gapBefore } : {},
+      })
+    }
+    return { chunks, next: this.total, lossy: from < this.earliest }
+  }
+}
diff --git a/packages/jobs/jobs-local/tests/events.spec.ts b/packages/jobs/jobs-local/tests/events.spec.ts
new file mode 100644
index 0000000000..5a653569b9
--- /dev/null
+++ b/packages/jobs/jobs-local/tests/events.spec.ts
@@ -0,0 +1,146 @@
+import { describe, expect, it, vi } from 'vitest'
+import { Context } from '@deepseek-ai/cordis'
+import { Session, SessionId } from '@deepseek-ai/dsh-session'
+import { unsupportedInbox } from '@deepseek-ai/dsh-agent-loop-testkit'
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import { ScopedLayers, bindScopeParent, createScope, scopeOf } from '@deepseek-ai/dsh-scope'
+import type { ScopeKey } from '@deepseek-ai/dsh-scope'
+import { JobId } from '@deepseek-ai/dsh-jobs'
+import type { JobEvent, JobView } from '@deepseek-ai/dsh-jobs'
+import { JobEventHub, JobLayer } from '../src/events.ts'
+
+function agentIn(ctx: Context, rawId: string, presetScope?: ScopeKey): Agent {
+  const id = SessionId(rawId)
+  let agentCtx = ctx.plugin(() => {}).ctx
+  if (presetScope !== undefined) {
+    const key = {}
+    bindScopeParent(key, presetScope)
+    agentCtx = createScope(agentCtx, key).ctx
+  }
+  const session = Session.create(id)
+  return {
+    id,
+    options: {},
+    session,
+    inbox: unsupportedInbox(),
+    status: 'idle',
+    ctx: agentCtx,
+    send: () => {},
+    followup: () => {},
+    steer: () => {},
+    inject: () => {},
+    cancel: () => {},
+    runMaintenance: task => task(new AbortController().signal),
+    whenIdle: () => Promise.resolve(),
+  }
+}
+
+function view(owner: Agent | undefined): JobView {
+  return {
+    id: JobId('bash-1'),
+    kind: 'bash',
+    label: 'x',
+    ...owner !== undefined ? { owner: owner.id } : {},
+    status: 'running',
+    startedAt: 0,
+    output: { total: 0, earliest: 0 },
+  }
+}
+
+function bench() {
+  const ctx = new Context()
+  const warnings: string[] = []
+  const layers = new ScopedLayers<JobLayer>(() => new JobLayer(), () => {})
+  const hub = new JobEventHub(layers, message => warnings.push(message))
+  return { ctx, hub, warnings }
+}
+
+describe('JobEventHub', () => {
+  it('delivers by owner: that session plus every unowned job, never another session', () => {
+    const { ctx, hub } = bench()
+    const alice = agentIn(ctx, 'alice')
+    const bob = agentIn(ctx, 'bob')
+    const seen: (string | undefined)[] = []
+    hub.subscribe(ctx, { owner: alice.id }, (event) => { seen.push(event.type === 'output' ? event.owner : event.job.owner) })
+
+    hub.emit({ type: 'registered', job: view(alice) }, alice)
+    hub.emit({ type: 'registered', job: view(bob) }, bob)
+    hub.emit({ type: 'registered', job: view(undefined) }, undefined)
+    hub.emit({ type: 'output', id: JobId('bash-1'), owner: bob.id, total: 1 }, bob)
+    hub.emit({ type: 'output', id: JobId('bash-1'), total: 1 }, undefined)
+    expect(seen).toEqual(['alice', undefined, undefined])
+  })
+
+  it("delivers 'all' everything and 'scope' only the owners composed under the subscriber", async () => {
+    const { ctx, hub } = bench()
+    const mount = createScope(ctx, {})
+    const otherMount = createScope(ctx, {})
+    const alice = agentIn(ctx, 'alice', scopeOf(mount.ctx))
+    const bob = agentIn(ctx, 'bob', scopeOf(otherMount.ctx))
+
+    const all: string[] = []
+    hub.subscribe(ctx, { owners: 'all' }, (event) => { all.push(event.type === 'output' ? String(event.owner) : String(event.job.owner)) })
+    const scoped: string[] = []
+    await mount.ctx.plugin((pluginCtx: Context) => {
+      hub.subscribe(pluginCtx, { owners: 'scope' }, (event) => { scoped.push(event.type === 'output' ? String(event.owner) : String(event.job.owner)) })
+    })
+    const unscoped: string[] = []
+    hub.subscribe(ctx, { owners: 'scope' }, (event) => { unscoped.push(event.type === 'output' ? String(event.owner) : String(event.job.owner)) })
+
+    hub.emit({ type: 'registered', job: view(alice) }, alice)
+    hub.emit({ type: 'registered', job: view(bob) }, bob)
+    hub.emit({ type: 'registered', job: view(undefined) }, undefined)
+    expect(all).toEqual(['alice', 'bob', 'undefined'])
+    // A preset-scoped subscription hears its own agents only; an unowned job
+    // has no chain to walk, so only unscoped subscriptions hear it.
+    expect(scoped).toEqual(['alice'])
+    expect(unscoped).toEqual(['alice', 'bob', 'undefined'])
+  })
+
+  it('contains a throwing listener and keeps delivering to later ones', () => {
+    const { ctx, hub, warnings } = bench()
+    const seen: JobEvent[] = []
+    hub.subscribe(ctx, { owners: 'all' }, () => { throw new Error('listener boom') })
+    hub.subscribe(ctx, { owners: 'all' }, (event) => { seen.push(event) })
+    hub.emit({ type: 'registered', job: view(undefined) }, undefined)
+    expect(seen).toHaveLength(1)
+    expect(warnings).toEqual([expect.stringContaining('event listener threw on registered: Error: listener boom')])
+  })
+
+  it('unregisters through the disposer and with the subscribing fiber', async () => {
+    const { ctx, hub } = bench()
+    const seen: number[] = []
+    const detach = hub.subscribe(ctx, { owners: 'all' }, () => { seen.push(1) })
+    const fiber = await ctx.plugin((pluginCtx: Context) => {
+      hub.subscribe(pluginCtx, { owners: 'scope' }, () => { seen.push(2) })
+      hub.subscribe(pluginCtx, { owner: SessionId('nobody') }, () => { seen.push(3) })
+    })
+
+    // Filter-kind order is not a contract; the assertion only fixes it for determinism.
+    hub.emit({ type: 'registered', job: view(undefined) }, undefined)
+    expect(seen).toEqual([1, 3, 2])
+    detach()
+    detach()
+    hub.emit({ type: 'registered', job: view(undefined) }, undefined)
+    expect(seen).toEqual([1, 3, 2, 3, 2])
+    await fiber.dispose()
+    hub.emit({ type: 'registered', job: view(undefined) }, undefined)
+    expect(seen).toEqual([1, 3, 2, 3, 2])
+  })
+
+  it('keeps a scoped layer alive only while a subscription or controller remains in it', async () => {
+    const { ctx, hub } = bench()
+    const mount = createScope(ctx, {})
+    const spy = vi.fn()
+    const fiber = await mount.ctx.plugin((pluginCtx: Context) => {
+      hub.subscribe(pluginCtx, { owners: 'scope' }, spy)
+    })
+    const alice = agentIn(ctx, 'alice', scopeOf(mount.ctx))
+    hub.emit({ type: 'registered', job: view(alice) }, alice)
+    expect(spy).toHaveBeenCalledTimes(1)
+    await fiber.dispose()
+    hub.emit({ type: 'registered', job: view(alice) }, alice)
+    expect(spy).toHaveBeenCalledTimes(1)
+    expect(new JobLayer().isEmpty()).toBe(true)
+  })
+})
diff --git a/packages/jobs/jobs-local/tests/jobs.spec.ts b/packages/jobs/jobs-local/tests/jobs.spec.ts
index dafd91844f..2b1fc0c08f 100644
--- a/packages/jobs/jobs-local/tests/jobs.spec.ts
+++ b/packages/jobs/jobs-local/tests/jobs.spec.ts
@@ -6,7 +6,9 @@ import type { Agent } from '@deepseek-ai/dsh-agent'
 import { bindScopeParent, createScope, scopeOf } from '@deepseek-ai/dsh-scope'
 import type { ScopeKey } from '@deepseek-ai/dsh-scope'
 import { JobId } from '@deepseek-ai/dsh-jobs'
-import type { JobHooks, JobKind, JobOutcome, JobSnapshot, JobStart } from '@deepseek-ai/dsh-jobs'
+import type {
+  JobEvent, JobEventFilter, JobHandle, JobHooks, JobKind, JobOutcome, JobOutputSource, JobSpec, JobView,
+} from '@deepseek-ai/dsh-jobs'
 import LocalJobRegistry, { type Config as JobsConfig } from '@deepseek-ai/dsh-jobs-local'
 import { unsupportedInbox } from '@deepseek-ai/dsh-agent-loop-testkit'
 
@@ -56,25 +58,50 @@ async function disposeAgentScope(agent: Agent): Promise<void> {
   await dispose()
 }
 
-/** A controllable producer start-spec: settle its `done` on demand, record cancels. */
-function producer(overrides: Partial<Omit<JobStart, 'run'> & JobHooks> = {}) {
+/** Register a stub agent so the registry can resolve it as a live owner. */
+async function liveAgent(ctx: Context, rawId: string, presetScope?: ScopeKey): Promise<Agent> {
+  const agent = stubAgent(ctx, rawId, presetScope)
+  await ctx.agents.register(agent)
+  return agent
+}
+
+type ProducerOverrides = Partial<Pick<JobSpec, 'kind' | 'label' | 'outputLimitBytes' | 'output'> & JobHooks> & {
+  owner?: Agent
+}
+
+/** A controllable producer spec: settle its `done` on demand, record cancels, expose the handle. */
+function producer(overrides: ProducerOverrides = {}) {
   let settle!: (outcome: JobOutcome) => void
   let reject!: (error: unknown) => void
   const cancels: (string | undefined)[] = []
-  const { kind = 'bash', label = 'sleep 60', owner, outputLimitBytes, ...hookOverrides } = overrides
+  const { kind = 'bash', label = 'sleep 60', owner, outputLimitBytes, output, ...hookOverrides } = overrides
   const hooks: JobHooks = {
     cancel(reason) { cancels.push(reason) },
     done: new Promise<JobOutcome>((res, rej) => { settle = res; reject = rej }),
     ...hookOverrides,
   }
-  const spec: JobStart = {
+  let started: JobHandle | undefined
+  const spec: JobSpec = {
     kind,
     label,
-    ...owner !== undefined ? { owner } : {},
+    ...owner !== undefined ? { owner: owner.id } : {},
     ...outputLimitBytes !== undefined ? { outputLimitBytes } : {},
-    run: () => hooks,
+    ...output !== undefined ? { output } : {},
+    run: (job) => {
+      started = job
+      return hooks
+    },
+  }
+  return {
+    spec,
+    settle,
+    reject,
+    cancels,
+    job(): JobHandle {
+      if (started === undefined) throw new Error('producer not started')
+      return started
+    },
   }
-  return { spec, settle, reject, cancels }
 }
 
 async function harness(config: JobsConfig = {}) {
@@ -85,12 +112,19 @@ async function harness(config: JobsConfig = {}) {
   return ctx
 }
 
+/** Collect events matching `filter`; `types` narrows what is recorded. */
+function collect(ctx: Context, filter: JobEventFilter = { owners: 'all' }, types?: JobEvent['type'][]): JobEvent[] {
+  const seen: JobEvent[] = []
+  ctx.jobs.events.subscribe(filter, (event) => {
+    if (types === undefined || types.includes(event.type)) seen.push(event)
+  })
+  return seen
+}
+
 /**
  * Attach a job controller the way `tool-jobs` does: from a plugin whose own
  * `inject` resolves `ctx.jobs`, so the service method binds to the REGISTERING
- * context and the controller files into that context's scope layer. Reading the
- * service off a bare scoped context instead throws `cannot get property "jobs"
- * without inject`, which is the same rule the shipped plugin obeys.
+ * context and the controller files into that context's scope layer.
  * @param ctx - the context whose scope should own the controller.
  */
 async function attachControllerIn(ctx: Context): Promise<void> {
@@ -111,9 +145,22 @@ function waitResolverCount(ctx: Context, id: JobId): number {
   return job.waitResolvers.size
 }
 
+/** A scripted pull source: each read shifts the next scripted result. */
+function scriptedSource(reads: { text: string; lossy?: boolean }[], channel?: 'stdout' | 'stderr'): JobOutputSource {
+  let offset = 0
+  return {
+    ...channel !== undefined ? { channel } : {},
+    read() {
+      const next = reads.shift() ?? { text: '' }
+      offset += Buffer.byteLength(next.text, 'utf8')
+      return { text: next.text, nextOffset: offset, lossy: next.lossy ?? false }
+    },
+  }
+}
+
 describe('LocalJobRegistry.start', () => {
-  it('preserves the SessionId brand on public owner snapshots', () => {
-    expectTypeOf<JobSnapshot['ownerSession']>().toEqualTypeOf<SessionId | undefined>()
+  it('preserves the SessionId brand on public owner projections', () => {
+    expectTypeOf<JobView['owner']>().toEqualTypeOf<SessionId | undefined>()
   })
 
   it('refuses to register while no job controller serves the owner', async () => {
@@ -133,10 +180,8 @@ describe('LocalJobRegistry.start', () => {
     const withoutControls = createScope(ctx, {})
     await attachControllerIn(withControls.ctx)
 
-    const served = stubAgent(ctx, 'served', scopeOf(withControls.ctx))
-    const unserved = stubAgent(ctx, 'unserved', scopeOf(withoutControls.ctx))
-    await ctx.agents.register(served)
-    await ctx.agents.register(unserved)
+    const served = await liveAgent(ctx, 'served', scopeOf(withControls.ctx))
+    const unserved = await liveAgent(ctx, 'unserved', scopeOf(withoutControls.ctx))
 
     expect(() => ctx.jobs.start(producer({ owner: served }).spec)).not.toThrow()
     expect(() => ctx.jobs.start(producer({ owner: unserved }).spec))
@@ -153,8 +198,7 @@ describe('LocalJobRegistry.start', () => {
     // The host-plane composition's own controls: no scope, so the global layer
     // holds them and every owner's read includes it.
     await attachControllerIn(ctx)
-    const scoped = stubAgent(ctx, 'scoped', scopeOf(createScope(ctx, {}).ctx))
-    await ctx.agents.register(scoped)
+    const scoped = await liveAgent(ctx, 'scoped', scopeOf(createScope(ctx, {}).ctx))
 
     expect(() => ctx.jobs.start(producer({ owner: scoped }).spec)).not.toThrow()
     expect(() => ctx.jobs.start(producer().spec)).not.toThrow()
@@ -176,6 +220,11 @@ describe('LocalJobRegistry.start', () => {
     },
   )
 
+  it('rejects a non-positive pump interval', async () => {
+    const ctx = new Context()
+    await expect(ctx.plugin(LocalJobRegistry, { pumpPollMs: 0 })).rejects.toThrow()
+  })
+
   it('accepts the largest safe integer limit', async () => {
     const ctx = await harness({ maxConcurrentJobsPerOwner: Number.MAX_SAFE_INTEGER })
     expect(ctx.jobs).toBeInstanceOf(LocalJobRegistry)
@@ -187,7 +236,7 @@ describe('LocalJobRegistry.start', () => {
     for (const job of live) ctx.jobs.start(job.spec)
 
     const blocked = producer()
-    const run = vi.fn(() => blocked.spec.run())
+    const run = vi.fn((job: JobHandle) => blocked.spec.run(job))
     expect(() => ctx.jobs.start({ ...blocked.spec, run }))
       .toThrow('background job limit reached for this owner (limit: 10)')
     expect(run).not.toHaveBeenCalled()
@@ -200,7 +249,7 @@ describe('LocalJobRegistry.start', () => {
     expect(ctx.jobs.start(first.spec)).toBe('bash-1')
 
     const blocked = producer()
-    const run = vi.fn(() => blocked.spec.run())
+    const run = vi.fn((job: JobHandle) => blocked.spec.run(job))
     expect(() => ctx.jobs.start({ ...blocked.spec, run }))
       .toThrow('use job_kill to stop an unneeded job, wait for it to finish, then retry')
     expect(run).not.toHaveBeenCalled()
@@ -236,17 +285,18 @@ describe('LocalJobRegistry.start', () => {
     },
   )
 
-  it('isolates exact owners, replacement objects with the same session id, and the unowned bucket', async () => {
+  it('buckets by exact owner: a same-session replacement and the unowned bucket count separately', async () => {
     const ctx = await harness({ maxConcurrentJobsPerOwner: 1 })
     const oldOwner = stubAgent(ctx, 'shared-session')
     const detachOld = await ctx.agents.register(oldOwner)
     const oldTask = producer({ owner: oldOwner })
     ctx.jobs.start(oldTask.spec)
 
-    const otherOwner = stubAgent(ctx, 'other-session')
-    await ctx.agents.register(otherOwner)
-    expect(() => ctx.jobs.start(producer({ owner: otherOwner }).spec)).not.toThrow()
+    await liveAgent(ctx, 'other-session')
+    expect(() => ctx.jobs.start({ ...producer().spec, owner: SessionId('other-session') })).not.toThrow()
 
+    // The session id resolves to whichever agent is live now; a replacement
+    // instance starts with its own bucket even while the old job runs on.
     await detachOld()
     const replacement = stubAgent(ctx, 'shared-session')
     await ctx.agents.register(replacement)
@@ -254,8 +304,6 @@ describe('LocalJobRegistry.start', () => {
 
     ctx.jobs.start(producer().spec)
     expect(() => ctx.jobs.start(producer().spec)).toThrow('(limit: 1)')
-    expect(() => ctx.jobs.start(producer({ owner: oldOwner }).spec))
-      .toThrow('is not the registered agent instance')
 
     oldTask.settle({ status: 'completed' })
     await tick()
@@ -272,94 +320,81 @@ describe('LocalJobRegistry.start', () => {
 })
 
 describe('LocalJobRegistry reads and settlement', () => {
-  it('stream kinds read a consuming delta; terminal reads mark reported', async () => {
+  it('read consumes the ring from the model cursor and advances it; readAt never moves it', async () => {
     const ctx = await harness()
-    const chunks = ['first', '', 'rest']
-    const p = producer({ readOutput: () => chunks.shift() ?? '' })
+    const p = producer()
     const id = ctx.jobs.start(p.spec)
+    const jobs = ctx.jobs
+    p.job().append('first', { channel: 'stdout' })
+    p.job().append('err', { channel: 'stderr' })
 
-    expect(ctx.jobs.read(id)).toMatchObject({ text: 'first', snapshot: { status: 'running', reported: false } })
-    expect(ctx.jobs.read(id).text).toBe('')
+    const first = jobs.read(id)
+    expect(first.chunks).toEqual([{ at: 0, text: 'first', channel: 'stdout' }, { at: 5, text: 'err', channel: 'stderr' }])
+    expect(first.lossy).toBe(false)
+    expect(first.result).toBeUndefined()
+    expect(first.job).toMatchObject({ status: 'running', output: { total: 8, earliest: 0 } })
+    expect(jobs.read(id).chunks).toEqual([])
 
-    p.settle({ status: 'completed', detail: 'exit code: 0' })
-    await tick()
-    const read = ctx.jobs.read(id)
-    expect(read.text).toBe('rest')
-    expect(read.snapshot).toMatchObject({ status: 'completed', detail: 'exit code: 0', reported: true })
-    expect(read.snapshot.finishedAt).toBeTypeOf('number')
+    // A non-consuming read from the head sees everything again, and leaves the cursor alone.
+    expect(jobs.readAt(id, 0).chunks).toHaveLength(2)
+    p.job().append('rest')
+    expect(jobs.read(id).chunks).toEqual([{ at: 8, text: 'rest' }])
   })
 
-  it('projects a producer-owned model output limit into reads and snapshots', async () => {
-    const ctx = await harness()
-    const p = producer({ outputLimitBytes: 64, readOutput: () => 'delta' })
-    const id = ctx.jobs.start(p.spec)
-    expect(ctx.jobs.read(id)).toMatchObject({
-      text: 'delta', snapshot: { outputLimitBytes: 64 },
-    })
-    expect(ctx.jobs.get(id)).toMatchObject({ outputLimitBytes: 64 })
-  })
-
-  it('final-output kinds read empty while live, the outcome output idempotently once settled', async () => {
+  it('hands the producer result out once, on the first read after settlement', async () => {
     const ctx = await harness()
     const p = producer({ kind: 'subagent', label: 'research job' })
     const id = ctx.jobs.start(p.spec)
+    const jobs = ctx.jobs
+    expect(jobs.read(id)).toMatchObject({ chunks: [], job: { status: 'running' } })
 
-    expect(ctx.jobs.read(id)).toMatchObject({ text: '', snapshot: { status: 'running' } })
-
-    p.settle({ status: 'completed', output: 'final answer' })
+    p.settle({ status: 'completed', result: 'final answer' })
     await tick()
-    expect(ctx.jobs.read(id).text).toBe('final answer')
-    expect(ctx.jobs.read(id).text).toBe('final answer') // idempotent, not consumed
+    const read = jobs.read(id)
+    expect(read.result).toBe('final answer')
+    expect(read.job).toMatchObject({ status: 'completed' })
+    expect(read.job.finishedAt).toBeTypeOf('number')
+    expect(jobs.read(id).result).toBeUndefined()
   })
 
-  it('a settled job without output reads as empty text', async () => {
+  it('a settled job without a result reads as empty', async () => {
     const ctx = await harness()
     const p = producer({ kind: 'subagent' })
     const id = ctx.jobs.start(p.spec)
     p.settle({ status: 'failed', detail: 'max-tokens' })
     await tick()
-    expect(ctx.jobs.read(id)).toMatchObject({ text: '', snapshot: { status: 'failed', detail: 'max-tokens' } })
+    expect(ctx.jobs.read(id)).toMatchObject({ chunks: [], job: { status: 'failed', detail: 'max-tokens' } })
+  })
+
+  it('projects a producer-owned model output limit into views', async () => {
+    const ctx = await harness()
+    const p = producer({ outputLimitBytes: 64 })
+    const id = ctx.jobs.start(p.spec)
+    expect(ctx.jobs.get(id)).toMatchObject({ outputLimitBytes: 64 })
+    expect(ctx.jobs.read(id).job).toMatchObject({ outputLimitBytes: 64 })
   })
 
   it('throws for unknown job ids', async () => {
     const ctx = await harness()
     expect(() => ctx.jobs.read(JobId('bash-99'))).toThrow('unknown job bash-99')
+    expect(() => ctx.jobs.get(JobId('bash-99'))).toThrow('unknown job bash-99')
   })
 
-  it('notifies onJobDone once per job with containment across listeners', async () => {
+  it('announces settlement once with containment across listeners', async () => {
     const ctx = await harness()
     const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => {})
-    const seen: JobSnapshot[] = []
-    ctx.jobs.onJobDone(() => { throw new Error('listener boom') })
-    ctx.jobs.onJobDone(snapshot => void seen.push(snapshot))
+    ctx.jobs.events.subscribe({ owners: 'all' }, () => { throw new Error('listener boom') })
+    const seen = collect(ctx, { owners: 'all' }, ['settled'])
 
     const p = producer()
     const id = ctx.jobs.start(p.spec)
     p.settle({ status: 'completed', detail: 'exit code: 0' })
     await tick()
 
-    expect(seen).toHaveLength(1)
-    expect(seen[0]).toMatchObject({ id, status: 'completed', reported: false })
+    expect(seen).toMatchObject([{ type: 'settled', cause: 'producer', job: { id, status: 'completed', detail: 'exit code: 0' } }])
     expect(warn).toHaveBeenCalledWith(expect.stringContaining('listener boom'))
   })
 
-  it('contains a rejecting onJobDone listener without starving later listeners', async () => {
-    const ctx = await harness()
-    const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => {})
-    const seen: JobId[] = []
-    ctx.jobs.onJobDone(async () => { throw new Error('async listener boom') })
-    ctx.jobs.onJobDone(snapshot => void seen.push(snapshot.id))
-
-    const p = producer()
-    const id = ctx.jobs.start(p.spec)
-    p.settle({ status: 'completed' })
-    await tick()
-
-    expect(seen).toEqual([id])
-    expect(warn).toHaveBeenCalledWith(expect.stringContaining('onJobDone listener rejected'))
-    expect(warn).toHaveBeenCalledWith(expect.stringContaining('async listener boom'))
-  })
-
   it("contains rejection from the producer's done promise as a failed outcome (producer contract violation)", async () => {
     const ctx = await harness()
     const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => {})
@@ -368,19 +403,19 @@ describe('LocalJobRegistry reads and settlement', () => {
     p.reject(new Error('transport exploded'))
     await tick()
 
-    expect(ctx.jobs.read(id).snapshot).toMatchObject({ status: 'failed', detail: 'Error: transport exploded' })
+    expect(ctx.jobs.get(id)).toMatchObject({ status: 'failed', detail: 'Error: transport exploded' })
     expect(warn).toHaveBeenCalledWith(expect.stringContaining('producer contract violation'))
   })
 
-  it('unregisters onJobDone listeners with the contributing fiber (HMR safety)', async () => {
+  it('unregisters event listeners with the contributing fiber (HMR safety)', async () => {
     const ctx = await harness()
     const seen: string[] = []
     const fiber = await ctx.plugin(Object.assign((inner: Context) => {
-      inner.jobs.onJobDone(snapshot => void seen.push(snapshot.id))
+      inner.jobs.events.subscribe({ owners: 'all' }, event => void seen.push(event.type))
     }, { inject: ['jobs'] }))
     await fiber.dispose()
     // The returned disposer detaches too (the non-fiber path).
-    const detach = ctx.jobs.onJobDone(snapshot => void seen.push(snapshot.id))
+    const detach = ctx.jobs.events.subscribe({ owners: 'all' }, event => void seen.push(event.type))
     detach()
 
     const p = producer()
@@ -392,22 +427,39 @@ describe('LocalJobRegistry reads and settlement', () => {
 })
 
 describe('LocalJobRegistry.kill', () => {
-  it('cancels a live job with the forwarded reason and suppresses the notice', async () => {
+  it('cancels a live job with the forwarded reason and settles with cause kill', async () => {
     const ctx = await harness()
-    const seen: JobSnapshot[] = []
-    ctx.jobs.onJobDone(snapshot => void seen.push(snapshot))
+    const seen = collect(ctx, { owners: 'all' }, ['stopping', 'settled'])
     const p = producer()
     const id = ctx.jobs.start(p.spec)
 
     expect(ctx.jobs.kill(id, undefined, 'no longer needed')).toBe('requested')
     expect(p.cancels).toEqual(['no longer needed'])
-    expect(ctx.jobs.list()[0]).toMatchObject({ status: 'stopping', reported: true })
+    expect(ctx.jobs.list()[0]).toMatchObject({ status: 'stopping' })
+    expect(seen).toMatchObject([{ type: 'stopping', job: { id, status: 'stopping' } }])
 
-    p.settle({ status: 'killed' })
+    p.settle({ status: 'killed', detail: 'signal: SIGTERM' })
     await tick()
-    // The listener still fires (telemetry may care), but carries reported: true
-    // so the notice path suppresses its redundant "finished".
-    expect(seen[0]).toMatchObject({ id, status: 'killed', reported: true })
+    expect(seen[1]).toMatchObject({
+      type: 'settled',
+      cause: 'kill',
+      job: { id, status: 'killed', detail: 'signal: SIGTERM; no longer needed' },
+    })
+  })
+
+  it('merges a reason without producer detail and keeps producer detail alone when the job outran the kill', async () => {
+    const ctx = await harness()
+    const killed = producer()
+    const killedId = ctx.jobs.start(killed.spec)
+    ctx.jobs.kill(killedId, undefined, 'cancelled by the user')
+    killed.settle({ status: 'killed' })
+    const outran = producer()
+    const outranId = ctx.jobs.start(outran.spec)
+    ctx.jobs.kill(outranId, undefined, 'too late')
+    outran.settle({ status: 'completed', detail: 'exit code: 0' })
+    await tick()
+    expect(ctx.jobs.get(killedId).detail).toBe('cancelled by the user')
+    expect(ctx.jobs.get(outranId).detail).toBe('exit code: 0')
   })
 
   it('reports an already-finished job instead of failing', async () => {
@@ -421,8 +473,7 @@ describe('LocalJobRegistry.kill', () => {
 
   it('propagates a throwing producer cancel and leaves the job untouched', async () => {
     const ctx = await harness()
-    const seen: JobSnapshot[] = []
-    ctx.jobs.onJobDone(snapshot => void seen.push(snapshot))
+    const seen = collect(ctx, { owners: 'all' }, ['stopping', 'settled'])
     let broken = true
     let settle!: (outcome: JobOutcome) => void
     const id = ctx.jobs.start({
@@ -434,12 +485,13 @@ describe('LocalJobRegistry.kill', () => {
       }),
     })
     expect(() => ctx.jobs.kill(id)).toThrow('cancel boom')
-    // The failed kill mutated NOTHING: still running, notice not suppressed,
-    // and a later (successful) kill still works.
-    expect(ctx.jobs.get(id)).toMatchObject({ status: 'running', reported: false })
+    // The failed kill mutated NOTHING: still running, and the settlement
+    // still reports the producer as its cause.
+    expect(ctx.jobs.get(id)).toMatchObject({ status: 'running' })
+    expect(seen).toEqual([])
     settle({ status: 'completed' })
     await tick()
-    expect(seen[0]).toMatchObject({ id, reported: false }) // notice would still fire
+    expect(seen).toMatchObject([{ type: 'settled', cause: 'producer', job: { id } }])
 
     broken = false
     expect(ctx.jobs.kill(id)).toBe('already-finished')
@@ -447,24 +499,26 @@ describe('LocalJobRegistry.kill', () => {
 })
 
 describe('LocalJobRegistry.wait', () => {
-  it('resolves with the terminal snapshot when the job settles, marked reported', async () => {
+  it('resolves with the terminal projection when the job settles, before the settled event', async () => {
     const ctx = await harness()
-    const seen: JobSnapshot[] = []
-    ctx.jobs.onJobDone(snapshot => void seen.push(snapshot))
+    const order: string[] = []
+    ctx.jobs.events.subscribe({ owners: 'all' }, (event) => { if (event.type === 'settled') order.push('event') })
     const p = producer()
     const id = ctx.jobs.start(p.spec)
 
-    const wait = ctx.jobs.wait(id, 5_000)
+    const wait = ctx.jobs.wait(id, 5_000).then((view) => { order.push('wait'); return view })
     p.settle({ status: 'completed', detail: 'exit code: 0' })
-    expect(await wait).toMatchObject({ status: 'completed', reported: true })
-    // A waiting reader claims delivery before completion listeners inspect the snapshot.
-    expect(seen[0]).toMatchObject({ id, reported: true })
+    expect(await wait).toMatchObject({ status: 'completed' })
+    // Waiters are released synchronously inside the settlement, ahead of the
+    // event; their continuations run afterwards, which is why a claim made
+    // when the wait starts (not when it returns) is what stays ordered.
+    expect(order).toEqual(['event', 'wait'])
   })
 
-  it('returns the live snapshot on timeout without marking reported', async () => {
+  it('returns the live projection on timeout', async () => {
     const ctx = await harness()
     const id = ctx.jobs.start(producer().spec)
-    expect(await ctx.jobs.wait(id, 5)).toMatchObject({ status: 'running', reported: false })
+    expect(await ctx.jobs.wait(id, 5)).toMatchObject({ status: 'running' })
   })
 
   it('unregisters timed-out and aborted wait resolvers while the job remains live', async () => {
@@ -493,7 +547,7 @@ describe('LocalJobRegistry.wait', () => {
     const id = ctx.jobs.start(p.spec)
     p.settle({ status: 'completed' })
     await tick()
-    expect(await ctx.jobs.wait(id, 5_000)).toMatchObject({ status: 'completed', reported: true })
+    expect(await ctx.jobs.wait(id, 5_000)).toMatchObject({ status: 'completed' })
   })
 
   it('rejects a non-positive or non-finite timeout', async () => {
@@ -518,79 +572,70 @@ describe('LocalJobRegistry.wait', () => {
     await expect(ctx.jobs.wait(id, 5_000, undefined, preAborted.signal)).rejects.toThrow('wait aborted')
   })
 
-  it('an abort racing settlement in the same tick does not swallow the notice', async () => {
+  it('an abort racing settlement in the same tick rejects the wait and leaves the settlement intact', async () => {
     const ctx = await harness()
-    const seen: JobSnapshot[] = []
-    ctx.jobs.onJobDone(snapshot => void seen.push(snapshot))
+    const seen = collect(ctx, { owners: 'all' }, ['settled'])
     const p = producer()
     const id = ctx.jobs.start(p.spec)
 
     const controller = new AbortController()
     const wait = ctx.jobs.wait(id, 5_000, undefined, controller.signal)
-    // Settlement is queued first, so abort must remove the waiter synchronously;
-    // otherwise settlement suppresses the notice for a reader that receives nothing.
     p.settle({ status: 'completed', detail: 'exit code: 0' })
     controller.abort()
     await expect(wait).rejects.toThrow('wait aborted')
-    expect(seen).toHaveLength(1)
-    expect(seen[0]).toMatchObject({ id, status: 'completed', reported: false })
+    expect(seen).toMatchObject([{ type: 'settled', cause: 'producer', job: { id, status: 'completed' } }])
   })
 
-  it('an abort landing after settlement still delivers the terminal snapshot it owes', async () => {
+  it('an abort landing after settlement still delivers the terminal projection it owes', async () => {
     const ctx = await harness()
     const controller = new AbortController()
-    const seen: JobSnapshot[] = []
     // The listener aborts after settlement released this waiter but before its
     // resolve microtask runs. Releasing waiters ahead of the announcement is
     // what makes that abort harmless; this is the guard on that ordering.
-    ctx.jobs.onJobDone((snapshot) => {
-      seen.push(snapshot)
-      controller.abort()
-    })
+    ctx.jobs.events.subscribe({ owners: 'all' }, (event) => { if (event.type === 'settled') controller.abort() })
     const p = producer()
     const id = ctx.jobs.start(p.spec)
 
     const wait = ctx.jobs.wait(id, 5_000, undefined, controller.signal)
     p.settle({ status: 'completed', detail: 'exit code: 0' })
-    await expect(wait).resolves.toMatchObject({ status: 'completed', reported: true })
-    expect(seen[0]).toMatchObject({ id, reported: true }) // suppression stays honest: the wait delivered
+    await expect(wait).resolves.toMatchObject({ status: 'completed' })
   })
 })
 
 describe('LocalJobRegistry owner isolation', () => {
-  it('fences read/kill/wait to the owning session and keeps unowned jobs open', async () => {
+  it('fences every view operation to the owning session and keeps unowned jobs open', async () => {
     const ctx = await harness()
-    const owner = stubAgent(ctx, 'owner')
-    await ctx.agents.register(owner)
+    const owner = await liveAgent(ctx, 'owner')
     const other = stubAgent(ctx, 'other')
 
     const owned = ctx.jobs.start(producer({ owner }).spec)
     const open = ctx.jobs.start(producer().spec)
 
     // The owner and the unowned job are reachable.
-    expect(ctx.jobs.read(owned, owner).snapshot.id).toBe(owned)
-    expect(ctx.jobs.read(open, other).snapshot.id).toBe(open)
+    expect(ctx.jobs.read(owned, owner.id).job.id).toBe(owned)
+    expect(ctx.jobs.read(open, other.id).job.id).toBe(open)
 
-    // A different session and a no-agent caller are rejected.
-    expect(() => ctx.jobs.read(owned, other)).toThrow(`job ${owned} belongs to another session`)
-    expect(() => ctx.jobs.kill(owned, other)).toThrow('belongs to another session')
-    await expect(ctx.jobs.wait(owned, 10, other)).rejects.toThrow('belongs to another session')
+    // A different session and an anonymous caller are rejected.
+    const foreign = ctx.jobs
+    expect(() => foreign.read(owned, other.id)).toThrow(`job ${owned} belongs to another session`)
+    expect(() => foreign.get(owned, other.id)).toThrow('belongs to another session')
+    expect(() => foreign.readAt(owned, 0, other.id)).toThrow('belongs to another session')
+    expect(() => foreign.kill(owned, other.id)).toThrow('belongs to another session')
+    await expect(foreign.wait(owned, 10, other.id)).rejects.toThrow('belongs to another session')
     expect(() => ctx.jobs.read(owned)).toThrow('belongs to another session')
   })
 
   it('list() shows only caller-owned plus unowned jobs', async () => {
     const ctx = await harness()
-    const alice = stubAgent(ctx, 'alice')
-    const bob = stubAgent(ctx, 'bob')
-    await ctx.agents.register(alice)
-    await ctx.agents.register(bob)
+    const alice = await liveAgent(ctx, 'alice')
+    const bob = await liveAgent(ctx, 'bob')
 
     const aliceTask = ctx.jobs.start(producer({ owner: alice }).spec)
     const bobTask = ctx.jobs.start(producer({ owner: bob }).spec)
     const openTask = ctx.jobs.start(producer({ kind: 'subagent' }).spec)
 
-    expect(ctx.jobs.list(alice).map(t => t.id)).toEqual([aliceTask, openTask])
-    expect(ctx.jobs.list(bob).map(t => t.id)).toEqual([bobTask, openTask])
+    expect(ctx.jobs.list(alice.id).map(t => t.id)).toEqual([aliceTask, openTask])
+    expect(ctx.jobs.list(bob.id).map(t => t.id)).toEqual([bobTask, openTask])
     expect(ctx.jobs.list().map(t => t.id)).toEqual([openTask])
   })
 
@@ -598,30 +643,30 @@ describe('LocalJobRegistry owner isolation', () => {
     const ctx = new Context()
     await ctx.plugin(LocalJobRegistry)
     ctx.jobs.attachController('test-controller')
-    expect(() => ctx.jobs.start(producer({ owner: stubAgent(ctx, 'a') }).spec))
+    expect(() => ctx.jobs.start({ ...producer().spec, owner: SessionId('a') }))
       .toThrow('background job ownership requires the agent registry')
     // The failed registration mutated nothing: no stored job, counter untouched.
     expect(ctx.jobs.list()).toEqual([])
     expect(ctx.jobs.start(producer().spec)).toBe('bash-1')
   })
 
-  it('a failed owner-cleanup attach leaves the registry unchanged and does not poison the owner', async () => {
+  it('rejects a session without a live agent and attaches cleanup once it has one', async () => {
     const ctx = await harness()
     const ghost = stubAgent(ctx, 'ghost') // never registered in ctx.agents
 
-    // Exact-instance validation precedes registry mutation and cleanup attachment.
+    // Owner resolution precedes registry mutation and cleanup attachment.
     expect(() => ctx.jobs.start(producer({ owner: ghost }).spec))
-      .toThrow('is not the registered agent instance')
-    expect(ctx.jobs.list(ghost)).toEqual([])
+      .toThrow('has no live agent')
+    expect(ctx.jobs.list(ghost.id)).toEqual([])
 
-    // A later valid registration must still attach cleanup for the same object.
+    // A later valid registration must still attach cleanup for the live instance.
     await ctx.agents.register(ghost)
     const cancels: (string | undefined)[] = []
     let settle!: (outcome: JobOutcome) => void
     const id = ctx.jobs.start({
       kind: 'bash',
       label: 'after retry',
-      owner: ghost,
+      owner: ghost.id,
       run: () => ({
         cancel(reason) { cancels.push(reason); settle({ status: 'killed' }) },
         done: new Promise<JobOutcome>((res) => { settle = res }),
@@ -630,42 +675,37 @@ describe('LocalJobRegistry owner isolation', () => {
     expect(id).toBe('bash-1') // the failed attempt burned no counter
     await disposeAgentScope(ghost)
     expect(cancels).toEqual(['owner disposed'])
-    expect(ctx.jobs.list(ghost)).toEqual([])
+    expect(ctx.jobs.list(ghost.id)).toEqual([])
   })
 
-  it('rejects a stale owner instance after another agent reuses its id', async () => {
+  it('binds a session id to the agent that is live now, and reads stay keyed by that id', async () => {
     const ctx = await harness()
     const staleOwner = stubAgent(ctx, 'owner')
     const unregisterStale = await ctx.agents.register(staleOwner)
     await unregisterStale()
-
     const currentOwner = stubAgent(ctx, 'owner')
     await ctx.agents.register(currentOwner)
-    const current = producer({ owner: currentOwner })
-    ctx.jobs.start(current.spec) // Attach the current owner's cleanup first.
 
-    const stale = producer({ owner: staleOwner })
-    const staleRun = vi.fn(() => stale.spec.run())
-    expect(() => ctx.jobs.start({ ...stale.spec, run: staleRun }))
-      .toThrow('is not the registered agent instance')
-    expect(staleRun).not.toHaveBeenCalled()
-    // Access is keyed by the unified session id, so a reconnect carrying the
-    // same identity can observe the current job even though stale ownership
-    // registration is rejected by exact-instance validation.
-    expect(ctx.jobs.list(staleOwner)).toHaveLength(1)
-    expect(ctx.jobs.list(currentOwner)).toHaveLength(1)
+    const current = producer({ owner: currentOwner })
+    const id = ctx.jobs.start(current.spec)
+    // The stale instance shares the id, so the fence lets it read; ownership
+    // (and therefore teardown) belongs to the live instance.
+    expect(ctx.jobs.get(id, staleOwner.id).owner).toBe(currentOwner.id)
+    await disposeAgentScope(staleOwner)
+    expect(ctx.jobs.list(currentOwner.id)).toHaveLength(1)
 
     current.settle({ status: 'completed' })
     await tick()
     await disposeAgentScope(currentOwner)
+    expect(ctx.jobs.list(currentOwner.id)).toEqual([])
   })
 })
 
 describe('LocalJobRegistry owner cleanup', () => {
-  it('drains the owner: cancels live jobs, awaits settlement, drops snapshots', async () => {
+  it('drains the owner: cancels live jobs, awaits settlement, removes the rows', async () => {
     const ctx = await harness()
-    const owner = stubAgent(ctx, 'owner')
-    await ctx.agents.register(owner)
+    const owner = await liveAgent(ctx, 'owner')
+    const seen = collect(ctx, { owner: owner.id }, ['removed'])
 
     // The producer settles only when cancelled — models a child that stops on request.
     let settle!: (outcome: JobOutcome) => void
@@ -673,7 +713,7 @@ describe('LocalJobRegistry owner cleanup', () => {
     ctx.jobs.start({
       kind: 'subagent',
       label: 'long research',
-      owner,
+      owner: owner.id,
       run: () => ({
         cancel(reason) { cancels.push(reason); settle({ status: 'killed' }) },
         done: new Promise<JobOutcome>((res) => { settle = res }),
@@ -686,59 +726,33 @@ describe('LocalJobRegistry owner cleanup', () => {
 
     await disposeAgentScope(owner)
     expect(cancels).toEqual(['owner disposed'])
-    // Snapshots dropped: nothing of the owner's remains, listing is empty.
-    expect(ctx.jobs.list(owner)).toEqual([])
+    expect(ctx.jobs.list(owner.id)).toEqual([])
+    expect(seen.map(event => event.type === 'removed' ? event.job.id : undefined)).toEqual(['subagent-1', 'bash-1'])
   })
 
-  it('publishes the settled visible set before announcing completion', async () => {
+  it('announces teardown settlements with cause teardown', async () => {
     const ctx = await harness()
-    const owner = stubAgent(ctx, 'owner')
-    await ctx.agents.register(owner)
-    const p = producer({ owner })
-    ctx.jobs.start(p.spec)
-    // Registered after start so only the settlement's notifications are ordered.
-    const order: string[] = []
-    ctx.jobs.onJobsChanged(() => void order.push('changed'))
-    ctx.jobs.onJobDone(() => void order.push('done'))
-
-    p.settle({ status: 'completed' })
-    await tick()
-
-    // A completion reporter may open a turn synchronously. Announcing before
-    // the visible set is published would let a client render that turn while
-    // its job row still reads `running`.
-    expect(order).toEqual(['changed', 'done'])
-  })
-
-  it('reports a teardown-cancelled record so completion reporters stay quiet', async () => {
-    const ctx = await harness()
-    const owner = stubAgent(ctx, 'owner')
-    await ctx.agents.register(owner)
-    const seen: JobSnapshot[] = []
-    ctx.jobs.onJobDone(snapshot => void seen.push(snapshot))
+    const owner = await liveAgent(ctx, 'owner')
+    const seen = collect(ctx, { owners: 'all' }, ['settled'])
 
     let settle!: (outcome: JobOutcome) => void
     ctx.jobs.start({
       kind: 'subagent',
       label: 'long research',
-      owner,
+      owner: owner.id,
       run: () => ({
         cancel() { settle({ status: 'killed' }) },
         done: new Promise<JobOutcome>((res) => { settle = res }),
       }),
     })
 
-    // Observers still receive the terminal record; the report bit is what
-    // keeps a notice reporter from addressing an owner being destroyed.
     await disposeAgentScope(owner)
-    expect(seen).toHaveLength(1)
-    expect(seen[0]?.reported).toBe(true)
+    expect(seen).toMatchObject([{ type: 'settled', cause: 'teardown', job: { status: 'killed' } }])
   })
 
   it('attaches one cleanup per owner and drains all owned jobs with the scope', async () => {
     const ctx = await harness()
-    const owner = stubAgent(ctx, 'owner')
-    await ctx.agents.register(owner)
+    const owner = await liveAgent(ctx, 'owner')
 
     const first = producer({ owner })
     const second = producer({ owner })
@@ -749,21 +763,21 @@ describe('LocalJobRegistry owner cleanup', () => {
     await tick()
     expect(owner.ctx.fiber.getEffects().filter(effect => effect.label === 'jobs.ownerCleanup()')).toHaveLength(1)
     await disposeAgentScope(owner)
-    expect(ctx.jobs.list(owner)).toEqual([])
+    expect(ctx.jobs.list(owner.id)).toEqual([])
   })
 
-  it('does not let an old scope cleanup cancel a same-id/session replacement job', async () => {
+  it('does not let an old scope cleanup cancel a same-session replacement job', async () => {
     const ctx = await harness()
     const oldOwner = stubAgent(ctx, 'owner')
     const detachOld = await ctx.agents.register(oldOwner)
     const cancels: string[] = []
 
-    function start(owner: Agent, label: string): JobId {
+    function start(label: string): JobId {
       let settle!: (outcome: JobOutcome) => void
       return ctx.jobs.start({
         kind: 'bash',
         label,
-        owner,
+        owner: SessionId('owner'),
         run: () => ({
           cancel() { cancels.push(label); settle({ status: 'killed' }) },
           done: new Promise<JobOutcome>((resolve) => { settle = resolve }),
@@ -771,15 +785,15 @@ describe('LocalJobRegistry owner cleanup', () => {
       })
     }
 
-    start(oldOwner, 'old job')
+    start('old job')
     await detachOld()
     const replacement = stubAgent(ctx, 'owner')
     await ctx.agents.register(replacement)
-    const replacementId = start(replacement, 'replacement job')
+    const replacementId = start('replacement job')
 
     await disposeAgentScope(oldOwner)
     expect(cancels).toEqual(['old job'])
-    expect(ctx.jobs.list(replacement).map(job => job.id)).toEqual([replacementId])
+    expect(ctx.jobs.list(replacement.id).map(job => job.id)).toEqual([replacementId])
 
     await disposeAgentScope(replacement)
     expect(cancels).toEqual(['old job', 'replacement job'])
@@ -790,8 +804,7 @@ describe('LocalJobRegistry owner cleanup', () => {
     await ctx.plugin(AgentRegistry)
     const tasksFiber = await ctx.plugin(LocalJobRegistry)
     ctx.jobs.attachController('test-controller')
-    const owner = stubAgent(ctx, 'owner')
-    await ctx.agents.register(owner)
+    const owner = await liveAgent(ctx, 'owner')
     const ownerCleanupEffects = () => owner.ctx.fiber.getEffects()
       .filter(effect => effect.label === 'jobs.ownerCleanup()')
 
@@ -808,22 +821,19 @@ describe('LocalJobRegistry owner cleanup', () => {
     expect(ownerCleanupEffects()).toHaveLength(0)
     expect(ctx.get('jobs')).toBeDefined()
     expect(tasksFiber.getEffects().some(effect => effect.label === 'jobs teardown')).toBe(true)
-
   })
 
   it('force-fails a throwing teardown cancel without awaiting producer done, first outcome wins', async () => {
     const ctx = await harness()
     const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => {})
-    const owner = stubAgent(ctx, 'owner')
-    await ctx.agents.register(owner)
-    const seen: JobSnapshot[] = []
-    ctx.jobs.onJobDone(snapshot => void seen.push(snapshot))
+    const owner = await liveAgent(ctx, 'owner')
+    const seen = collect(ctx, { owners: 'all' }, ['settled'])
 
     let settle!: (outcome: JobOutcome) => void
     ctx.jobs.start({
       kind: 'bash',
       label: 'broken producer',
-      owner,
+      owner: owner.id,
       run: () => ({
         cancel() { throw new Error('cancel boom') },
         done: new Promise<JobOutcome>((res) => { settle = res }),
@@ -848,24 +858,27 @@ describe('LocalJobRegistry owner cleanup', () => {
     expect(drainedWithoutProducerDone).toBe(true)
     expect(warn).toHaveBeenCalledWith(expect.stringContaining('work may be orphaned'))
     expect(seen).toHaveLength(1)
-    expect(seen[0]?.status).toBe('failed')
-    expect(seen[0]?.detail).toContain('cancel threw during teardown')
-    expect(ctx.jobs.list(owner)).toEqual([])
+    expect(seen[0]).toMatchObject({ cause: 'teardown', job: { status: 'failed' } })
+    expect((seen[0] as { job: JobView }).job.detail).toContain('cancel threw during teardown')
+    expect(ctx.jobs.list(owner.id)).toEqual([])
   })
 })
 
 describe('LocalJobRegistry disposal', () => {
-  it('cancels live jobs, awaits settlement, and silences listeners', async () => {
+  it('cancels live jobs, awaits settlement, and announces the teardown to outside subscribers', async () => {
     const ctx = new Context()
     await ctx.plugin(AgentRegistry)
     const fiber = await ctx.plugin(LocalJobRegistry)
-    const controller = await ctx.plugin(Object.assign((inner: Context) => {
+    await ctx.plugin(Object.assign((inner: Context) => {
       inner.jobs.attachController('test-controller')
     }, { inject: ['jobs'] }))
-    void controller
 
+    // A subscriber outside the registry's fiber is still listening when the
+    // registry unloads: it must see the rows leave, not keep them forever.
     const seen: string[] = []
-    ctx.jobs.onJobDone(snapshot => void seen.push(snapshot.id))
+    ctx.jobs.events.subscribe({ owners: 'all' }, (event) => {
+      seen.push(event.type === 'settled' ? `settled:${event.cause}` : event.type)
+    })
     let settle!: (outcome: JobOutcome) => void
     const cancels: (string | undefined)[] = []
     ctx.jobs.start({
@@ -879,8 +892,7 @@ describe('LocalJobRegistry disposal', () => {
 
     await fiber.dispose()
     expect(cancels).toEqual(['jobs service disposed'])
-    // The teardown kill settles AFTER the listener registry closed: silent.
-    expect(seen).toEqual([])
+    expect(seen).toEqual(['registered', 'stopping', 'settled:teardown', 'output', 'removed'])
   })
 
   it('force-fails a throwing cancel so service disposal does not await producer done', async () => {
@@ -889,8 +901,7 @@ describe('LocalJobRegistry disposal', () => {
     const fiber = await ctx.plugin(LocalJobRegistry)
     ctx.jobs.attachController('test-controller')
     const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => {})
-    const seen: JobSnapshot[] = []
-    ctx.jobs.onJobDone(snapshot => void seen.push(snapshot))
+    const seen = collect(ctx, { owners: 'all' }, ['settled'])
 
     let settle!: (outcome: JobOutcome) => void
     ctx.jobs.start({
@@ -918,7 +929,7 @@ describe('LocalJobRegistry disposal', () => {
 
     expect(disposedWithoutProducerDone).toBe(true)
     expect(warn).toHaveBeenCalledWith(expect.stringContaining('work may be orphaned'))
-    expect(seen).toEqual([])
+    expect(seen).toMatchObject([{ type: 'settled', cause: 'teardown', job: { status: 'failed' } }])
   })
 
   it('detaches owner effects from still-live agent scopes when the service unloads', async () => {
@@ -926,13 +937,12 @@ describe('LocalJobRegistry disposal', () => {
     await ctx.plugin(AgentRegistry)
     const tasksFiber = await ctx.plugin(LocalJobRegistry)
     ctx.jobs.attachController('test-controller')
-    const owner = stubAgent(ctx, 'owner')
-    await ctx.agents.register(owner)
+    const owner = await liveAgent(ctx, 'owner')
     let settle!: (outcome: JobOutcome) => void
     ctx.jobs.start({
       kind: 'bash',
       label: 'owned work',
-      owner,
+      owner: owner.id,
       run: () => ({
         cancel() { settle({ status: 'killed' }) },
         done: new Promise<JobOutcome>((resolve) => { settle = resolve }),
@@ -958,11 +968,10 @@ describe('LocalJobRegistry disposal', () => {
       inject: ['jobs'],
       apply(pluginCtx: Context) {
         pluginCtx.jobs.attachController('tool-jobs')
-        pluginCtx.jobs.onJobDone(() => {})
+        pluginCtx.jobs.events.subscribe({ owners: 'scope' }, () => {})
       },
     })
-    const owner = stubAgent(ctx, 'joined', scopeOf(standing.ctx))
-    await ctx.agents.register(owner)
+    const owner = await liveAgent(ctx, 'joined', scopeOf(standing.ctx))
     expect(() => ctx.jobs.start(producer({ owner }).spec)).not.toThrow()
 
     await mount.dispose()
@@ -990,149 +999,415 @@ describe('LocalJobRegistry disposal', () => {
   })
 })
 
-describe('LocalJobRegistry.onJobsChanged', () => {
-  it('fires after registration, the stopping transition, and settlement', async () => {
+describe('LocalJobRegistry events', () => {
+  it('announces registration, progress, stopping, and settlement with the committed projection', async () => {
     const ctx = await harness()
-    const owner = stubAgent(ctx, 'alice')
-    await ctx.agents.register(owner)
-    const seen: (string | undefined)[] = []
-    ctx.jobs.onJobsChanged(changed => void seen.push(changed?.id))
+    const owner = await liveAgent(ctx, 'alice')
+    const seen = collect(ctx, { owner: owner.id }, ['registered', 'progress', 'stopping', 'settled'])
 
     const p = producer({ owner })
     const id = ctx.jobs.start(p.spec)
     // Registration is announced only once the record is readable.
-    expect(seen).toEqual(['alice'])
-    expect(ctx.jobs.list(owner)).toHaveLength(1)
+    expect(seen).toMatchObject([{ type: 'registered', job: { id, owner: 'alice', status: 'running' } }])
+    expect(ctx.jobs.list(owner.id)).toHaveLength(1)
 
-    expect(ctx.jobs.kill(id, owner)).toBe('requested')
-    expect(seen).toEqual(['alice', 'alice'])
-    expect(ctx.jobs.get(id, owner).status).toBe('stopping')
+    p.job().updateProgress('3/10')
+    expect(seen[1]).toMatchObject({ type: 'progress', job: { id, progress: '3/10' } })
+
+    expect(ctx.jobs.kill(id, owner.id)).toBe('requested')
+    expect(seen[2]).toMatchObject({ type: 'stopping', job: { id, status: 'stopping', progress: '3/10' } })
 
     p.settle({ status: 'killed' })
     await tick()
-    expect(seen).toEqual(['alice', 'alice', 'alice'])
-    expect(ctx.jobs.get(id, owner).status).toBe('killed')
+    const settled = seen[3] as { job: JobView }
+    expect(seen[3]).toMatchObject({ type: 'settled', cause: 'kill', job: { id, status: 'killed' } })
+    expect(settled.job.progress).toBeUndefined()
     await disposeAgentScope(owner)
   })
 
-  it('reports an unowned change as undefined, since every caller can see it', async () => {
+  it('announces an unowned job to every session filter, since every caller can see it', async () => {
     const ctx = await harness()
-    const seen: (string | undefined)[] = []
-    ctx.jobs.onJobsChanged(changed => void seen.push(changed?.id))
-
+    const seen = collect(ctx, { owner: SessionId('anyone') }, ['registered'])
     ctx.jobs.start(producer().spec)
-    expect(seen).toEqual([undefined])
+    expect(seen).toMatchObject([{ type: 'registered', job: { id: 'bash-1' } }])
+    expect((seen[0] as { job: JobView }).job.owner).toBeUndefined()
   })
 
   it('announces the owner-disposal removal, and stays silent when that owner had none', async () => {
     const ctx = await harness()
-    const owner = stubAgent(ctx, 'alice')
-    const bystander = stubAgent(ctx, 'bob')
-    await ctx.agents.register(owner)
-    await ctx.agents.register(bystander)
+    const owner = await liveAgent(ctx, 'alice')
+    const bystander = await liveAgent(ctx, 'bob')
     const p = producer({ owner })
     ctx.jobs.start(p.spec)
 
-    const seen: (string | undefined)[] = []
-    ctx.jobs.onJobsChanged(changed => void seen.push(changed?.id))
+    const seen = collect(ctx, { owners: 'all' }, ['settled', 'removed'])
     p.settle({ status: 'completed' })
     await tick()
-    expect(seen).toEqual(['alice'])
+    expect(seen.map(event => event.type)).toEqual(['settled'])
 
     // Disposing an owner with no records changes no visible set.
     await disposeAgentScope(bystander)
-    expect(seen).toEqual(['alice'])
+    expect(seen.map(event => event.type)).toEqual(['settled'])
 
     await disposeAgentScope(owner)
-    expect(seen).toEqual(['alice', 'alice'])
-    expect(ctx.jobs.list(owner)).toEqual([])
+    expect(seen.map(event => event.type)).toEqual(['settled', 'removed'])
+    expect(ctx.jobs.list(owner.id)).toEqual([])
   })
 
   it('contains a throwing listener so the lifecycle commit still stands', async () => {
     const ctx = await harness()
     const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => {})
-    const seen: (string | undefined)[] = []
-    ctx.jobs.onJobsChanged(() => { throw new Error('observer boom') })
-    ctx.jobs.onJobsChanged(changed => void seen.push(changed?.id))
+    ctx.jobs.events.subscribe({ owners: 'all' }, () => { throw new Error('observer boom') })
+    const seen = collect(ctx, { owners: 'all' }, ['registered'])
 
     const id = ctx.jobs.start(producer().spec)
     expect(id).toBe('bash-1')
-    expect(seen).toEqual([undefined])
-    expect(warn).toHaveBeenCalledWith(expect.stringContaining('onJobsChanged listener threw'))
+    expect(seen).toHaveLength(1)
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('event listener threw on registered'))
   })
 
-  it('unregisters through its disposer and with its fiber (HMR safety)', async () => {
-    const ctx = await harness()
-    const seen: number[] = []
-    const detach = ctx.jobs.onJobsChanged(() => void seen.push(1))
-    const fiber = await ctx.plugin(Object.assign((inner: Context) => {
-      inner.jobs.onJobsChanged(() => void seen.push(2))
-    }, { inject: ['jobs'] }))
-
-    ctx.jobs.start(producer().spec)
-    expect(seen).toEqual([1, 2])
-
-    detach()
-    detach() // second call of the same disposer is a no-op
-    ctx.jobs.start(producer().spec)
-    expect(seen).toEqual([1, 2, 2])
-
-    await fiber.dispose()
-    ctx.jobs.start(producer().spec)
-    expect(seen).toEqual([1, 2, 2])
-  })
-})
-
-describe('LocalJobRegistry teardown change notifications', () => {
   it('announces the stopping transition during owner teardown, before settlement', async () => {
     const ctx = await harness()
-    const owner = stubAgent(ctx, 'alice')
-    await ctx.agents.register(owner)
+    const owner = await liveAgent(ctx, 'alice')
     const p = producer({ owner })
-    const id = ctx.jobs.start(p.spec)
+    ctx.jobs.start(p.spec)
 
-    const statuses: (string | undefined)[] = []
-    ctx.jobs.onJobsChanged((changed) => {
-      statuses.push(changed === undefined ? undefined : ctx.jobs.list(changed)[0]?.status)
+    const statuses: string[] = []
+    ctx.jobs.events.subscribe({ owner: owner.id }, (event) => {
+      if (event.type !== 'output') statuses.push(`${event.type}:${event.job.status}`)
     })
 
     // A slow producer keeps teardown parked between cancel and settlement;
     // an observer must not be left showing `running` for that whole window.
     const disposal = disposeAgentScope(owner)
     await tick()
-    expect(statuses).toEqual(['stopping'])
+    expect(statuses).toEqual(['stopping:stopping'])
 
     p.settle({ status: 'killed' })
     await disposal
     // Settlement, then the removal that empties the visible set.
-    expect(statuses).toEqual(['stopping', 'killed', undefined])
-    expect(ctx.jobs.list(owner)).toEqual([])
-    void id
+    expect(statuses).toEqual(['stopping:stopping', 'settled:killed', 'removed:killed'])
+    expect(ctx.jobs.list(owner.id)).toEqual([])
   })
 
-  it('announces the emptied set to a listener registered outside this service (reload safety)', async () => {
-    const ctx = new Context()
-    await ctx.plugin(AgentRegistry)
-    const fiber = await ctx.plugin(LocalJobRegistry)
-    ctx.jobs.attachController('test-controller')
-
-    // The api-proxy carrier registers from its own stream context, not the
-    // registry's fiber, so it is still listening when the registry unloads.
-    const seen: (string | undefined)[] = []
-    ctx.jobs.onJobsChanged(changed => void seen.push(changed?.id))
-    let settle!: (outcome: JobOutcome) => void
-    ctx.jobs.start({
-      kind: 'bash',
-      label: 'sleep 600',
-      run: () => ({
-        cancel() { settle({ status: 'killed' }) },
-        done: new Promise<JobOutcome>((resolve) => { settle = resolve }),
-      }),
+  it('delivers scoped subscriptions to the owning composition only', async () => {
+    const ctx = await harness()
+    const mount = createScope(ctx, {})
+    const otherMount = createScope(ctx, {})
+    const alice = await liveAgent(ctx, 'alice', scopeOf(mount.ctx))
+    const bob = await liveAgent(ctx, 'bob', scopeOf(otherMount.ctx))
+    const everyone = collect(ctx, { owners: 'all' }, ['output'])
+    const scoped: string[] = []
+    await mount.ctx.plugin({
+      inject: ['jobs'],
+      apply(scopedCtx: Context) {
+        scopedCtx.jobs.events.subscribe({ owners: 'scope' }, (event) => {
+          if (event.type === 'output') scoped.push(String(event.id))
+        })
+      },
     })
-    seen.length = 0
+    const pa = producer({ owner: alice })
+    const aliceId = ctx.jobs.start(pa.spec)
+    const pb = producer({ owner: bob })
+    ctx.jobs.start(pb.spec)
+    pa.job().append('for alice observers')
+    pb.job().append('for bob observers')
+    expect(everyone).toHaveLength(2)
+    expect(scoped).toEqual([String(aliceId)])
+  })
+})
 
-    await fiber.dispose()
-    // stopping (teardown cancel), settlement, then the final empty set.
-    expect(seen).toEqual([undefined, undefined, undefined])
+describe('LocalJobRegistry output ring', () => {
+  it('appends advance absolute offsets and reach observers as output events', async () => {
+    const ctx = await harness()
+    const outputs = collect(ctx, { owners: 'all' }, ['output'])
+    const p = producer()
+    const id = ctx.jobs.start(p.spec)
+    p.job().append('hello ')
+    p.job().append('world', { channel: 'stderr' })
+    const first = ctx.jobs.readAt(id, 0)
+    expect(first).toEqual({
+      chunks: [{ at: 0, text: 'hello ' }, { at: 6, text: 'world', channel: 'stderr' }],
+      next: 11,
+      lossy: false,
+    })
+    // A second identical read proves nothing was consumed.
+    expect(ctx.jobs.readAt(id, 0)).toEqual(first)
+    // Resuming from `next` yields nothing until more output arrives.
+    expect(ctx.jobs.readAt(id, first.next).chunks).toEqual([])
+    p.job().append('!')
+    expect(ctx.jobs.readAt(id, first.next).chunks).toEqual([{ at: 11, text: '!' }])
+    expect(ctx.jobs.get(id).output).toEqual({ total: 12, earliest: 0 })
+    expect(outputs).toEqual([
+      { type: 'output', id, total: 6 },
+      { type: 'output', id, total: 11 },
+      { type: 'output', id, total: 12 },
+    ])
+  })
+
+  it('staged starter writes surface at the registration commit without observer signals', async () => {
+    const ctx = await harness()
+    const seen = collect(ctx)
+    let settle!: (outcome: JobOutcome) => void
+    const id = ctx.jobs.start({
+      kind: 'bash',
+      label: 'staged writes',
+      run: (job) => {
+        job.append('early ', { channel: 'stdout' })
+        job.updateProgress('booting')
+        return {
+          cancel() {},
+          done: new Promise<JobOutcome>((resolve) => { settle = resolve }),
+        }
+      },
+    })
+    // Only the registration commit announced anything.
+    expect(seen.map(event => event.type)).toEqual(['registered'])
+    const view = ctx.jobs.get(id)
+    expect(view.progress).toBe('booting')
+    expect(view.output.total).toBe(6)
+    expect(ctx.jobs.readAt(id, 0).chunks).toEqual([{ at: 0, text: 'early ', channel: 'stdout' }])
+    settle({ status: 'completed' })
+    await tick()
+  })
+
+  it('drops an empty append without waking observers', async () => {
+    const ctx = await harness()
+    const outputs = collect(ctx, { owners: 'all' }, ['output'])
+    const p = producer()
+    const id = ctx.jobs.start(p.spec)
+    p.job().append('')
+    expect(outputs).toEqual([])
+    expect(ctx.jobs.get(id).output.total).toBe(0)
+  })
+
+  it('rejects a negative or fractional read offset', async () => {
+    const ctx = await harness()
+    const p = producer()
+    const id = ctx.jobs.start(p.spec)
+    expect(() => ctx.jobs.readAt(id, -1)).toThrow(/invalid output read offset/)
+    expect(() => ctx.jobs.readAt(id, 0.5)).toThrow(/invalid output read offset/)
+    expect(() => ctx.jobs.readAt(JobId('bash-99'), 0)).toThrow(/unknown job/)
+  })
+
+  it('keeps the spill file each source currently reports as job metadata, beyond any chunk', async () => {
+    const ctx = await harness({ retainBytes: 4, pumpPollMs: 5 })
+    let withdrawn = false
+    const out: JobOutputSource = {
+      channel: 'stdout',
+      read: from => from === 0
+        ? { text: 'abcdefgh', nextOffset: 8, lossy: false, spillPath: '/spill/out.log' }
+        : { text: '', nextOffset: from, lossy: false, ...withdrawn ? {} : { spillPath: '/spill/out.log' } },
+    }
+    const err: JobOutputSource = {
+      channel: 'stderr',
+      read: from => ({ text: '', nextOffset: from, lossy: false, spillPath: '/spill/err.log' }),
+    }
+    const p = producer({ output: [out, err] })
+    const id = ctx.jobs.start(p.spec)
+    // The first drain ran inside start(): the live cap already evicted the head, yet the
+    // projection still names the files — no chunk carried them.
+    const view = ctx.jobs.get(id)
+    expect(view.output).toEqual({ total: 8, earliest: 4, spillPaths: ['/spill/out.log', '/spill/err.log'] })
+    expect(ctx.jobs.readAt(id, 0).chunks).toEqual([{ at: 4, text: 'efgh', channel: 'stdout', gapBefore: true }])
+
+    // A source that stops naming its file (a failed seal) withdraws it on the next drain.
+    withdrawn = true
+    await new Promise<void>(resolve => setTimeout(resolve, 20))
+    expect(ctx.jobs.get(id).output.spillPaths).toEqual(['/spill/err.log'])
+    p.settle({ status: 'completed' })
+    await tick()
+  })
+
+  it('announces registration before the pump drains a source that is readable at once', async () => {
+    const ctx = await harness({ pumpPollMs: 5 })
+    const events = collect(ctx)
+    const source: JobOutputSource = {
+      read: from => from === 0 ? { text: 'boot', nextOffset: 4, lossy: false } : { text: '', nextOffset: from, lossy: false },
+    }
+    const p = producer({ output: [source] })
+    const id = ctx.jobs.start(p.spec)
+    // The pump's first drain runs synchronously inside start(); the job's
+    // first event is still its registration.
+    expect(events.slice(0, 2).map(event => event.type)).toEqual(['registered', 'output'])
+    expect(ctx.jobs.readAt(id, 0).chunks.map(chunk => chunk.text)).toEqual(['boot'])
+    p.settle({ status: 'completed' })
+    await tick()
+  })
+
+  it('evicts whole head chunks past the live cap and flags stale readers lossy', async () => {
+    const ctx = await harness({ retainBytes: 8 })
+    const p = producer()
+    const id = ctx.jobs.start(p.spec)
+    p.job().append('aaaa')
+    p.job().append('bbbb')
+    p.job().append('cccc')
+    const read = ctx.jobs.readAt(id, 0)
+    expect(read.lossy).toBe(true)
+    expect(read.chunks).toEqual([{ at: 4, text: 'bbbb' }, { at: 8, text: 'cccc' }])
+    expect(read.next).toBe(12)
+    expect(ctx.jobs.get(id).output).toEqual({ total: 12, earliest: 4 })
+    // A reader at the retained boundary is not lossy.
+    expect(ctx.jobs.readAt(id, 4).lossy).toBe(false)
+    // The model cursor is subject to the same eviction.
+    expect(ctx.jobs.read(id).lossy).toBe(true)
+  })
+
+  it('settlement keeps the unconsumed stream for the model; the terminal read trims to the settled cap, ends the stream, and later writes drop', async () => {
+    const ctx = await harness({ retainBytes: 1024, settledRetainBytes: 4 })
+    const warn = vi.fn()
+    ctx.logger.warn = warn as never
+    const outputs = collect(ctx, { owners: 'all' }, ['output'])
+    const p = producer()
+    const id = ctx.jobs.start(p.spec)
+    p.job().append('abcdefgh')
+    p.settle({ status: 'completed', detail: 'exit code: 0' })
+    await tick()
+    expect(outputs.map(event => event.type === 'output' ? event.total : -1)).toEqual([8, 8])
+    // Nothing the model has not read is trimmed at settlement: a job that
+    // finishes before its first read still hands over everything the live
+    // cap retained, and observers see the same bytes.
+    expect(ctx.jobs.get(id)).toMatchObject({ status: 'completed', detail: 'exit code: 0', output: { total: 8, earliest: 0 } })
+    expect(ctx.jobs.readAt(id, 0)).toMatchObject({ lossy: false, chunks: [{ at: 0, text: 'abcdefgh' }] })
+    expect(ctx.jobs.read(id)).toMatchObject({ lossy: false, chunks: [{ at: 0, text: 'abcdefgh' }] })
+    // The terminal read consumed the stream: retention drops to the settled cap.
+    expect(ctx.jobs.get(id).output).toEqual({ total: 8, earliest: 4 })
+    const read = ctx.jobs.readAt(id, 0)
+    expect(read.lossy).toBe(true)
+    expect(read.chunks).toEqual([{ at: 4, text: 'efgh', gapBefore: true }])
+    // The stream ended with the settlement: a trailing flush cannot break teardown.
+    p.job().append('late')
+    p.job().updateProgress('late progress')
+    expect(warn.mock.calls.map(call => String(call[0]))).toEqual([
+      expect.stringContaining('append to settled job'),
+      expect.stringContaining('progress update on settled job'),
+    ])
+    expect(outputs).toHaveLength(2)
+    expect(ctx.jobs.get(id).progress).toBeUndefined()
+  })
+
+  it('a settlement after the model consumed the stream trims to the settled cap at once', async () => {
+    const ctx = await harness({ retainBytes: 1024, settledRetainBytes: 4 })
+    const p = producer()
+    const id = ctx.jobs.start(p.spec)
+    p.job().append('abcdefgh')
+    expect(ctx.jobs.read(id).chunks).toEqual([{ at: 0, text: 'abcdefgh' }])
+    p.settle({ status: 'completed' })
+    await tick()
+    expect(ctx.jobs.get(id).output).toEqual({ total: 8, earliest: 4 })
+    // The cursor sits at the end: nothing new, and nothing lost behind it.
+    expect(ctx.jobs.read(id)).toMatchObject({ chunks: [], lossy: false })
+  })
+
+  it('settlement clears the progress line; the terminal detail is the outcome alone', async () => {
+    const ctx = await harness()
+    const p = producer()
+    const id = ctx.jobs.start(p.spec)
+    p.job().updateProgress('3/10 agents done')
+    expect(ctx.jobs.get(id)).toMatchObject({ progress: '3/10 agents done' })
+    p.settle({ status: 'completed' })
+    await tick()
+    const view = ctx.jobs.get(id)
+    expect(view.status).toBe('completed')
+    expect(view.progress).toBeUndefined()
+    expect(view.detail).toBeUndefined()
+  })
+
+  it('a teardown-forced settlement also ends the ring', async () => {
+    const ctx = await harness()
+    const warn = vi.fn()
+    ctx.logger.warn = warn as never
+    const owner = await liveAgent(ctx, 'owner')
+    const p = producer({ owner })
+    const id = ctx.jobs.start(p.spec)
+    p.job().append('partial')
+    const disposal = disposeAgentScope(owner)
+    p.settle({ status: 'killed' })
+    await disposal
+    expect(() => ctx.jobs.readAt(id, 0, owner.id)).toThrow(/unknown job/)
+    // The producer face outlives the row; its trailing flush is dropped, not thrown.
+    p.job().append('late')
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('append to settled job'))
+  })
+
+  it('hands out fresh projections, never live registry state', async () => {
+    const ctx = await harness()
+    const p = producer()
+    const id = ctx.jobs.start(p.spec)
+    const before = ctx.jobs.get(id)
+    p.job().append('grow')
+    expect(before.output.total).toBe(0)
+    expect(ctx.jobs.get(id).output.total).toBe(4)
+  })
+})
+
+describe('LocalJobRegistry pull sources', () => {
+  it('pumps the spec sources into the ring and drains them once more before settlement', async () => {
+    const ctx = await harness({ pumpPollMs: 1 })
+    const out = scriptedSource([{ text: 'a' }, { text: 'bc' }], 'stdout')
+    // stderr only becomes readable once the producer has settled: the pump's
+    // final drain is the only read that can collect it.
+    let finishing = false
+    let errOffset = 0
+    const err: JobOutputSource = {
+      channel: 'stderr',
+      read() {
+        const text = finishing && errOffset === 0 ? 'E' : ''
+        errOffset += text.length
+        return { text, nextOffset: errOffset, lossy: false }
+      },
+    }
+    const p = producer({ output: [out, err] })
+    const id = ctx.jobs.start(p.spec)
+    await new Promise(resolve => setTimeout(resolve, 10))
+    expect(ctx.jobs.readAt(id, 0).chunks.map(chunk => chunk.text)).toEqual(['a', 'bc'])
+
+    const settled = collect(ctx, { owners: 'all' }, ['settled'])
+    finishing = true
+    p.settle({ status: 'completed', detail: 'exit code: 0' })
+    await new Promise(resolve => setTimeout(resolve, 10))
+    // The final drain landed before the settlement announced itself.
+    expect(settled).toHaveLength(1)
+    expect(ctx.jobs.readAt(id, 0).chunks.map(chunk => chunk.text)).toEqual(['a', 'bc', 'E'])
+    expect(ctx.jobs.get(id)).toMatchObject({ status: 'completed', output: { total: 4 } })
+  })
+
+  it('contains a throwing source: warns once, keeps the job live, and settles on the producer', async () => {
+    const ctx = await harness({ pumpPollMs: 1 })
+    const warn = vi.fn()
+    ctx.logger.warn = warn as never
+    const broken: JobOutputSource = { channel: 'stdout', read() { throw new Error('reader boom') } }
+    const healthy = scriptedSource([{ text: 'ok' }], 'stderr')
+    const p = producer({ output: [broken, healthy] })
+    const id = ctx.jobs.start(p.spec)
+    await new Promise(resolve => setTimeout(resolve, 10))
+    expect(ctx.jobs.get(id).status).toBe('running')
+    expect(ctx.jobs.readAt(id, 0).chunks).toEqual([{ at: 0, text: 'ok', channel: 'stderr' }])
+    expect(warn.mock.calls.map(call => String(call[0]))).toEqual([expect.stringContaining(`output source for ${id} failed`)])
+    p.settle({ status: 'completed', detail: 'exit code: 0' })
+    await new Promise(resolve => setTimeout(resolve, 10))
+    expect(ctx.jobs.get(id)).toMatchObject({ status: 'completed', detail: 'exit code: 0' })
+  })
+
+  it('stops pumping silently after a forced settlement', async () => {
+    const ctx = await harness({ pumpPollMs: 1 })
+    const warn = vi.fn()
+    ctx.logger.warn = warn as never
+    const owner = await liveAgent(ctx, 'owner')
+    const source: JobOutputSource = {
+      read: fromByte => ({ text: 'x', nextOffset: fromByte + 1, lossy: false }),
+    }
+    ctx.jobs.start({
+      kind: 'bash',
+      label: 'endless',
+      owner: owner.id,
+      output: [source],
+      run: () => ({ cancel() { throw new Error('cancel boom') }, done: new Promise(() => {}) }),
+    })
+    await new Promise(resolve => setTimeout(resolve, 5))
+    await disposeAgentScope(owner)
+    await new Promise(resolve => setTimeout(resolve, 5))
+    // The forced failure is the only warning: the pump's later drains are silent.
+    expect(warn.mock.calls.map(call => String(call[0]))).toEqual([expect.stringContaining('work may be orphaned')])
   })
 })
diff --git a/packages/jobs/jobs-local/tests/pump.spec.ts b/packages/jobs/jobs-local/tests/pump.spec.ts
new file mode 100644
index 0000000000..f9d6087bb4
--- /dev/null
+++ b/packages/jobs/jobs-local/tests/pump.spec.ts
@@ -0,0 +1,156 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { JobAppendOptions, JobOutputSource } from '@deepseek-ai/dsh-jobs'
+import { startPump } from '../src/pump.ts'
+import type { PumpSink } from '../src/pump.ts'
+
+/** Record every append and spill report so pump behavior is observable without a registry. */
+function recorder() {
+  const appends: { text: string; options?: JobAppendOptions }[] = []
+  const spills: [number, string | undefined][] = []
+  const sink: PumpSink = {
+    append: (text, options) => { appends.push({ text, ...options !== undefined ? { options } : {} }) },
+    spill: (index, path) => { spills.push([index, path]) },
+  }
+  return { appends, spills, sink }
+}
+
+/** A scripted source: each read() shifts the next scripted result. */
+function scriptedSource(
+  reads: { text: string; lossy?: boolean; spillPath?: string }[],
+  channel?: 'stdout' | 'stderr',
+): { source: JobOutputSource; offsets: number[] } {
+  const offsets: number[] = []
+  let offset = 0
+  const source: JobOutputSource = {
+    ...channel !== undefined ? { channel } : {},
+    read(fromByte) {
+      offsets.push(fromByte)
+      const next = reads.shift() ?? { text: '' }
+      offset += Buffer.byteLength(next.text, 'utf8')
+      return {
+        text: next.text,
+        nextOffset: offset,
+        lossy: next.lossy ?? false,
+        ...next.spillPath !== undefined ? { spillPath: next.spillPath } : {},
+      }
+    },
+  }
+  return { source, offsets }
+}
+
+describe('startPump', () => {
+  it('copies labeled deltas at the poll cadence and resumes each source at its own offset', async () => {
+    vi.useFakeTimers()
+    try {
+      const { appends, sink } = recorder()
+      let settle!: () => void
+      const until = new Promise<void>((resolve) => { settle = resolve })
+      const out = scriptedSource([{ text: 'a' }, { text: 'bc' }], 'stdout')
+      const err = scriptedSource([{ text: '' }, { text: 'E' }], 'stderr')
+      const pump = startPump([out.source, err.source], sink, 50, until)
+
+      await vi.advanceTimersByTimeAsync(50)
+      settle()
+      await pump.done
+      expect(appends).toEqual([
+        { text: 'a', options: { channel: 'stdout' } },
+        { text: 'bc', options: { channel: 'stdout' } },
+        { text: 'E', options: { channel: 'stderr' } },
+      ])
+      // Every read resumed from the previous nextOffset, never from a shared cursor.
+      expect(out.offsets).toEqual([0, 1, 3])
+      expect(err.offsets).toEqual([0, 0, 1])
+      // Settlement cleared the pending poll timer instead of leaving it pending.
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('marks a lossy source read as a gap so observers see the discontinuity', async () => {
+    const { appends, sink } = recorder()
+    const { source } = scriptedSource([{ text: 'tail', lossy: true }])
+    await startPump([source], sink, 1, Promise.resolve()).done
+    expect(appends).toEqual([{ text: 'tail', options: { gapBefore: true } }])
+  })
+
+  it("reports each source's spill file on every read and withdraws it once a read stops naming it", async () => {
+    vi.useFakeTimers()
+    try {
+      const { appends, spills, sink } = recorder()
+      let settle!: () => void
+      const until = new Promise<void>((resolve) => { settle = resolve })
+      const out = scriptedSource([
+        { text: 'tail', lossy: true, spillPath: '/spill/out.log' },
+        { text: 'more', spillPath: '/spill/out.log' },
+        { text: '' },
+      ], 'stdout')
+      const err = scriptedSource([{ text: '' }, { text: 'E', spillPath: '/spill/err.log' }], 'stderr')
+      const pump = startPump([out.source, err.source], sink, 50, until)
+
+      await vi.advanceTimersByTimeAsync(50)
+      settle()
+      await pump.done
+      // Chunks carry the gap marker only; the file reference is source metadata.
+      expect(appends).toEqual([
+        { text: 'tail', options: { channel: 'stdout', gapBefore: true } },
+        { text: 'more', options: { channel: 'stdout' } },
+        { text: 'E', options: { channel: 'stderr' } },
+      ])
+      // Every read reports, lossy or clean, empty or not: the third stdout read withdraws the file.
+      expect(spills).toEqual([
+        [0, '/spill/out.log'], [1, undefined],
+        [0, '/spill/out.log'], [1, '/spill/err.log'],
+        [0, undefined], [1, undefined],
+      ])
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('treats a rejected settlement as settlement and still drains the final bytes', async () => {
+    const { appends, sink } = recorder()
+    const { source } = scriptedSource([{ text: 'last' }])
+    await startPump([source], sink, 1, Promise.reject(new Error('producer broke'))).done
+    expect(appends).toEqual([{ text: 'last' }])
+  })
+
+  it('subscribes to the settlement once and holds one poll timer however long the job runs', async () => {
+    vi.useFakeTimers()
+    try {
+      const { sink } = recorder()
+      let subscriptions = 0
+      let settle!: () => void
+      const settled = new Promise<void>((resolve) => { settle = resolve })
+      const counting = (promise: PromiseLike<unknown>): PromiseLike<unknown> => ({
+        then<Fulfilled = unknown, Rejected = never>(
+          onFulfilled?: ((value: unknown) => Fulfilled | PromiseLike<Fulfilled>) | null,
+          onRejected?: ((reason: unknown) => Rejected | PromiseLike<Rejected>) | null,
+        ): PromiseLike<Fulfilled | Rejected> {
+          subscriptions += 1
+          return counting(promise.then(onFulfilled, onRejected)) as PromiseLike<Fulfilled | Rejected>
+        },
+      })
+      const { source, offsets } = scriptedSource([])
+      const pump = startPump([source], sink, 50, counting(settled))
+
+      const rounds = 10_000
+      await vi.advanceTimersByTimeAsync(50 * rounds)
+      expect(offsets).toHaveLength(rounds + 1)
+      expect(subscriptions).toBeLessThanOrEqual(2)
+      expect(vi.getTimerCount()).toBe(1)
+
+      settle()
+      await pump.done
+      expect(offsets).toHaveLength(rounds + 2)
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('rejects a non-positive poll interval before touching any source', () => {
+    const { sink } = recorder()
+    expect(() => startPump([], sink, 0, Promise.resolve())).toThrow(/invalid pump pollMs/)
+  })
+})
diff --git a/packages/jobs/jobs-local/tests/ring.spec.ts b/packages/jobs/jobs-local/tests/ring.spec.ts
new file mode 100644
index 0000000000..670e121d0b
--- /dev/null
+++ b/packages/jobs/jobs-local/tests/ring.spec.ts
@@ -0,0 +1,65 @@
+import { describe, expect, it } from 'vitest'
+import { OutputRing } from '../src/ring.ts'
+
+describe('OutputRing', () => {
+  it('assigns absolute offsets by UTF-8 byte length and drops empty chunks silently', () => {
+    const ring = new OutputRing()
+    expect(ring.append('', undefined, 1024)).toBe(false)
+    expect(ring.append('héllo', { channel: 'stdout' }, 1024)).toBe(true)
+    expect(ring.append('wörld', { channel: 'stderr', gapBefore: true }, 1024)).toBe(true)
+    expect(ring.total).toBe(12)
+    expect(ring.earliest).toBe(0)
+    expect(ring.retainedBytes).toBe(12)
+    expect(ring.readFrom(0)).toEqual({
+      chunks: [
+        { at: 0, text: 'héllo', channel: 'stdout' },
+        { at: 6, text: 'wörld', channel: 'stderr', gapBefore: true },
+      ],
+      next: 12,
+      lossy: false,
+    })
+  })
+
+  it('reads from a foreign offset by returning the whole overlapping chunk', () => {
+    const ring = new OutputRing()
+    ring.append('abc', undefined, 1024)
+    ring.append('def', undefined, 1024)
+    expect(ring.readFrom(4).chunks).toEqual([{ at: 3, text: 'def' }])
+    expect(ring.readFrom(6)).toEqual({ chunks: [], next: 6, lossy: false })
+  })
+
+  it('trims whole head chunks past the cap and reports the evicted span as lossy', () => {
+    const ring = new OutputRing()
+    ring.append('aaaa', undefined, 8)
+    ring.append('bbbb', undefined, 8)
+    ring.append('cc', undefined, 8)
+    // 10 bytes retained > cap 8: the oldest whole chunk goes.
+    expect(ring.earliest).toBe(4)
+    expect(ring.retainedBytes).toBe(6)
+    expect(ring.readFrom(0)).toEqual({ chunks: [{ at: 4, text: 'bbbb' }, { at: 8, text: 'cc' }], next: 10, lossy: true })
+    expect(ring.readFrom(4).lossy).toBe(false)
+  })
+
+  it('keeps a lone oversized chunk as a UTF-8-safe tail marked gapBefore', () => {
+    const ring = new OutputRing()
+    // 3 two-byte code points = 6 bytes; a 3-byte cap must not start inside a code point.
+    ring.append('ééé', undefined, 3)
+    expect(ring.retainedBytes).toBe(2)
+    expect(ring.earliest).toBe(4)
+    expect(ring.readFrom(0)).toEqual({ chunks: [{ at: 4, text: 'é', gapBefore: true }], next: 6, lossy: true })
+  })
+
+  it('re-trims to a smaller cap on demand and leaves total untouched', () => {
+    const ring = new OutputRing()
+    ring.append('12345678', undefined, 64)
+    ring.append('abcdefgh', undefined, 64)
+    ring.trim(8)
+    expect(ring.total).toBe(16)
+    expect(ring.earliest).toBe(8)
+    expect(ring.readFrom(8)).toEqual({ chunks: [{ at: 8, text: 'abcdefgh' }], next: 16, lossy: false })
+    // Trimming an empty ring is a no-op that keeps earliest at total.
+    const empty = new OutputRing()
+    empty.trim(1)
+    expect(empty.earliest).toBe(0)
+  })
+})
diff --git a/packages/jobs/jobs/README.i18n.yaml b/packages/jobs/jobs/README.i18n.yaml
index 3c3d1db594..a3a87e082e 100644
--- a/packages/jobs/jobs/README.i18n.yaml
+++ b/packages/jobs/jobs/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/jobs/jobs/README.md
-README.md: a96db102354b41ebd196b0718ed0ef0b97f6935b
-README.zh.md: 7198c8e6a82ed0d4f4d9dd9a3a2a501cfdebcbf2
+README.md: d5c67eccec42a7eb10179495f0397bf394c8d6ff
+README.zh.md: 41899dcd018c0d33ff42a1c3d5b521317c129e11
diff --git a/packages/jobs/jobs/README.md b/packages/jobs/jobs/README.md
index a96db10235..d5c67eccec 100644
--- a/packages/jobs/jobs/README.md
+++ b/packages/jobs/jobs/README.md
@@ -1,5 +1,5 @@
 ---
-description: "The background-job registry contract for users and maintainers composing, implementing, or debugging background work: ids, ownership, lifecycle, and completion listeners."
+description: "The background-job registry contract for users and maintainers composing, implementing, or debugging background work: ids, ownership, lifecycle, the output ring, and the event stream."
 kind: "package-reference"
 ---
 
@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
 
 ## Summary
 
-`dsh-jobs` lets tools keep long-running work active while an agent continues. Each job receives a stable `<kind>-N` id, and its owning agent can read output, wait with a timeout, or request cancellation. Ownership is scoped to the agent session, so other agents cannot inspect or stop the job; completion arrives as an in-session notice without polling. Background jobs can start only when the deployment supplies job execution.
+`dsh-jobs` lets tools keep long-running work active while an agent continues. Each job receives a stable `<kind>-N` id, and its owning agent can read output, wait with a timeout, or request cancellation. Ownership is scoped to the agent session, so other agents cannot inspect or stop the job; completion arrives as an in-session notice without polling. Users can watch retained live output without consuming what the agent can read. Background jobs can start only when the deployment supplies job execution.
 
 ## Table of Contents
 
@@ -29,7 +29,9 @@ Use this package when you are composing a background-job capability or writing a
 
 ### What a background job gives you
 
-A producer registers work with a kind and a one-line label; the registry returns a `<kind>-N` id such as `bash-1`. Anyone who owns the job can read output, list jobs, wait up to a timeout for settlement, and request cancellation — each call returns a fresh snapshot of the job's status, from `running` and `stopping` to the terminal `completed`, `killed`, or `failed`. When a job settles, the owning agent is notified through the completion listener that `dsh-tool-jobs` turns into an in-session notice, so no polling is needed. A producer may attach an optional byte cap so each complete model-facing output read or completion notice stays bounded.
+A producer registers work with a kind and a one-line label; the registry returns a `<kind>-N` id such as `bash-1`. Anyone who owns the job can read output, list jobs, wait up to a timeout for settlement, and request cancellation — each call returns a fresh projection of the job's status, from `running` and `stopping` to the terminal `completed`, `killed`, or `failed`. When a job settles, the registry's event stream announces it and `dsh-tool-jobs` turns the settlement into an in-session notice, so no polling is needed. A producer may attach an optional byte cap so each complete model-facing read or notice stays bounded.
+
+A producer streams output by naming pull sources on its spec — non-consuming offset readers the registry pumps at its own cadence — or by pushing chunks through the `JobHandle` its starter receives; both land in the job's bounded ring, where `stdout` and `stderr` chunks reach the model and `log` chunks reach observers only. Observers read retained chunks at absolute byte offsets and are signaled on advancement; the settlement that ends the job also ends the stream, and `updateProgress` publishes a live progress line into every projection until then. Observation is invisible to the model: `readAt` consumes nothing and never touches notice state.
 
 ### The ownership boundary
 
@@ -67,7 +69,7 @@ This section explains the design decisions behind the contract and points at the
 - **Contract and implementation are separate packages.** `JobRegistry` is an abstract Cordis service; loading the class directly throws, so a misconfigured composition fails at load instead of registering an empty `ctx.jobs`.
 - **One registry per process, owner-relative answers.** One instance serves every composition in the process, so registrations and deliveries are relative to the registering scope: a controller or listener registered from an unscoped context serves every owner; one registered under an agent composition's scope serves exactly the agents composed under it.
 - **Access is fenced by the owner's session id.** Ids are predictable, so authorization — not secrecy — is the boundary.
-- **Settlement is first-wins, and completion is announced last.** One terminal record, released waiters, and one round of contained listener notification; completion is announced after the record is committed and every other observer has seen it, because a reporter may open a model turn synchronously.
+- **Settlement is first-wins, and its event follows every released waiter.** One terminal record, released waiters, then one round of contained event delivery; a consumer that claims a settlement while waiting therefore always claims before the event, so `dsh-tool-jobs` never announces a completion the model already collected.
 - **Registrations outlive producer and controller fibers.** Owner and service disposal cancel live work and await compliant producers; a throwing teardown cancel force-fails only the record.
 
 ### Source map
@@ -75,13 +77,14 @@ This section explains the design decisions behind the contract and points at the
 | File | Role |
 |---|---|
 | [`src/index.ts`](src/index.ts) | Plugin entry: the abstract `JobRegistry` service and its contract |
-| [`src/types.ts`](src/types.ts) | Shared vocabulary: `JobKindMap`, `JobStart`, `JobHooks`, `JobSnapshot`, listener types |
+| [`src/types.ts`](src/types.ts) | Shared vocabulary: `JobSpec`, `JobHandle`, `JobHooks`, `JobOutcome`, `JobEvent`, and the read results |
+| [`src/view.ts`](src/view.ts) | Client-safe leaf: `JobView`, `JobChunk`, `JobStatus`, and the merge-extensible `JobKindMap` |
 | [`src/brand.ts`](src/brand.ts) | `JobId` branded identifier, importable without the agent dependency |
-| [`src/invariant.ts`](src/invariant.ts) | Invariant companion: validates snapshot identity, status, timestamps, and owner fields |
+| [`src/invariant.ts`](src/invariant.ts) | Invariant companion: checks the announced event protocol per job (registered first, one settlement, removal last) and each announced projection against the registry's own read |
 
 ### Service operations
 
-Every operation is a thin projection over the registered jobs: `get` and `list` return non-consuming snapshots, `read` advances the single stream cursor, `kill` invokes producer cancellation before changing status, `wait` blocks up to a timeout, and `start()` preflights access, validation, and admission before invoking the producer's `run()` once while refusing any owner no attached controller serves; listeners observe terminal records and visible-set changes at owner granularity, and `attachController` scopes controller availability to its effect lifetime. Exact signatures and behavior live in the JSDoc on [`src/index.ts`](src/index.ts) and the generated [`ctx.jobs` Cordis surface](../../../docs/subsystems/jobs.md).
+Each read or control operation accepts an optional caller `SessionId`; omitting it permits only unowned jobs: `list` and `get` return fresh projections, `read` advances the model's cursor and hands out the producer's result once after settlement, `readAt` reads retained chunks at an absolute offset without consuming anything, `kill` invokes producer cancellation before changing status and records the reason for the terminal `detail`, `wait` blocks up to a timeout, and `start()` preflights access, validation, and admission before invoking the producer's `run()` once while refusing any owner no attached controller serves; `events.subscribe` delivers registration, progress, stopping, settlement, removal, and output commits at owner, scope, or process granularity.
 
 </details>
 
@@ -92,12 +95,13 @@ Every operation is a thin projection over the registered jobs: `get` and `list`
 
 Read these pages when the package-level contract is not enough. They move from the job types to the shipped implementation, the model-facing controls, and the design records.
 
-- [Background task runtime subsystem](../../../docs/subsystems/jobs.md) — the job types, snapshot fields, and `ctx.jobs` Cordis surface.
+- [Background task runtime subsystem](../../../docs/subsystems/jobs.md) — the job types, projection fields, and `ctx.jobs` Cordis surface.
 - [jobs group map](../README.md) — the sibling group page and its package table.
 - [Process-local registry](../jobs-local/README.md) — the shipped implementation that runs jobs in this process.
 - [Model-facing job controls](../tool-jobs/README.md) — the `job_output`, `job_list`, and `job_kill` tools and completion notices.
 - [Generic long-running tool runtime Agent Note](../../../.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.md) — the design behind the background-job runtime.
 - [job-registry seam Agent Note](../../../.agents/notes/archived/architecture/2026-07-26-job-registry-seam.md) — the owner-fenced registry contract and its rationale.
+- [Jobs seam consolidation Agent Note](../../../.agents/notes/implemented/architecture/2026-09-03-jobs-seam-consolidation.md) — one output ring, one projection, one event stream.
 
 -----
 
@@ -117,8 +121,8 @@ No direct invalidation; the named consumers own any request-prefix changes.
 
 These limits define when the contract is a poor fit. They are current package constraints, not a task backlog.
 
-- **The contract is in-process** — `JobStart.run()` passes callbacks and exact `Agent` objects; a durable or cross-process backend must reshape identity, restart, ownership, and observation semantics before it can implement this seam.
-- **Stream output has one consuming cursor** — independent observers need a cursor or snapshot API.
+- **The contract is in-process** — `JobSpec.run()` passes callbacks and the registry resolves the live `Agent` behind the owner session; a durable or cross-process backend must reshape identity, restart, ownership, and observation semantics before it can implement this seam.
+- **The model's cursor is the only consuming read** — independent observers use the non-consuming `readAt` and never move it.
 - **Foreground work cannot be promoted** — producers choose foreground or background before starting.
 
 <a id="dev-note"></a>
diff --git a/packages/jobs/jobs/README.zh.md b/packages/jobs/jobs/README.zh.md
index 7198c8e6a8..41899dcd01 100644
--- a/packages/jobs/jobs/README.zh.md
+++ b/packages/jobs/jobs/README.zh.md
@@ -1,5 +1,5 @@
 ---
-description: "后台任务注册表约定，供组合、实现或排查后台工作的用户与维护者阅读：id、归属、生命周期与完成监听器。"
+description: "后台任务注册表约定，供组合、实现或排查后台工作的用户与维护者阅读：id、归属、生命周期、输出环与事件流。"
 kind: "package-reference"
 ---
 
@@ -9,7 +9,7 @@ kind: "package-reference"
 
 ## 概述
 
-`dsh-jobs` 让工具可以在 agent（智能体）继续推进时保持长时间工作运行。每项任务都会获得稳定的 `<kind>-N` id，拥有它的 agent 可以读取输出、带超时等待或请求取消。归属范围限定在 agent 会话内，因此其他 agent 无法查看或停止任务；任务完成时会通过会话内通知送达，无需轮询。只有部署提供任务执行能力时，后台任务才能启动。
+`dsh-jobs` 让工具可以在 agent（智能体）继续推进时保持长时间工作运行。每项任务都会获得稳定的 `<kind>-N` id，拥有它的 agent 可以读取输出、带超时等待或请求取消。归属范围限定在 agent 会话内，因此其他 agent 无法查看或停止任务；任务完成时会通过会话内通知送达，无需轮询。用户可以查看保留的实时输出，而不消耗 agent 可读取的内容。只有部署提供任务执行能力时，后台任务才能启动。
 
 ## 目录
 
@@ -29,7 +29,9 @@ kind: "package-reference"
 
 ### 后台任务提供什么
 
-生产方以 kind 和一行标签注册工作；注册表返回 `<kind>-N` id，例如 `bash-1`。拥有任务的任何一方都可以读取输出、列出任务、带超时等待结算或请求取消——每次调用都返回任务状态的全新快照，从 `running`、`stopping` 到终止态的 `completed`、`killed` 或 `failed`。任务结算时，拥有它的 agent 会通过 `dsh-tool-jobs` 转成会话内通知的完成监听器得到通知，因此无需轮询。生产方还可以附加可选的字节上限，让每次完整的模型侧输出读取或完成通知保持有界。
+生产方以 kind 和一行标签注册工作；注册表返回 `<kind>-N` id，例如 `bash-1`。拥有任务的任何一方都可以读取输出、列出任务、带超时等待结算或请求取消——每次调用都返回任务状态的全新投影，从 `running`、`stopping` 到终止态的 `completed`、`killed` 或 `failed`。任务结算时，注册表的事件流宣布它，`dsh-tool-jobs` 把结算变成会话内通知，因此无需轮询。生产方可以附加一个可选的字节上限，让每次完整的模型侧读取或通知保持有界。
+
+生产方通过在 spec 上声明拉取源——由注册表按自己的节奏泵送的非消耗偏移读取器——或经 starter 收到的 `JobHandle` 推送块来流式输出；二者都落入该 job 的有界环，其中 `stdout` 与 `stderr` 块到达模型，`log` 块只到达观察者。观察者按绝对字节偏移读取保留块并在推进时收到信号；结束 job 的结算同时封流，在此之前 `updateProgress` 把实时进度行发布进每个投影。观测对模型不可见：`readAt` 不消耗任何东西，也从不触碰通知状态。
 
 ### 归属边界
 
@@ -67,7 +69,7 @@ kind: "package-reference"
 - **约定与实现分属不同包。** `JobRegistry` 是抽象 Cordis 服务；直接加载该类会抛出异常，因此错误配置的组合会在加载时失败，而不是注册一个空的 `ctx.jobs`。
 - **每个进程一个注册表，按所有者返回结果。** 一个实例服务进程内的每套组合，因此注册与投递都相对注册方所在 scope：从不带 scope 的上下文注册的控制器或监听器服务于每个所有者；在某套 agent 组合的 scope 下注册的，恰好服务于该组合下组合出的 agent。
 - **访问以所有者的会话 id 为界。** id 可预测，因此是授权——而非保密——构成边界。
-- **结算首次优先，完成最后宣布。** 一条终止记录、释放的等待方，以及一轮受到隔离的监听器通知；完成在记录提交且该结算的所有其他观察者都已看到之后才宣布，因为报告方可能同步开启一个模型轮次。
+- **结算首次优先，其事件跟在每个被释放的等待方之后。** 一条终止记录、释放的等待方，然后是一轮受到隔离的事件投递；在等待中认领结算的消费方因此总是在事件之前认领，`dsh-tool-jobs` 永远不会播报模型已经收走的完成。
 - **注册的存续期长于生产方与控制器 fiber。** 所有者与服务释放会取消正在运行的工作并等待守约的生产方；销毁期间的取消若抛出异常，只会将记录强制标记为失败。
 
 ### 源码地图
@@ -75,13 +77,14 @@ kind: "package-reference"
 | 文件 | 职责 |
 |---|---|
 | [`src/index.ts`](src/index.ts) | 插件入口：抽象 `JobRegistry` 服务及其约定 |
-| [`src/types.ts`](src/types.ts) | 共享词汇：`JobKindMap`、`JobStart`、`JobHooks`、`JobSnapshot`、监听器类型 |
+| [`src/types.ts`](src/types.ts) | 共享词汇：`JobSpec`、`JobHandle`、`JobHooks`、`JobOutcome`、`JobEvent` 与读取结果 |
+| [`src/view.ts`](src/view.ts) | 客户端安全叶子：`JobView`、`JobChunk`、`JobStatus` 与可合并扩展的 `JobKindMap` |
 | [`src/brand.ts`](src/brand.ts) | `JobId` 带类型标记的标识符，无需 agent 依赖即可导入 |
-| [`src/invariant.ts`](src/invariant.ts) | 不变式伴生插件：校验快照标识、状态、时间戳与所有者字段 |
+| [`src/invariant.ts`](src/invariant.ts) | 不变式伴生插件：校验每个 job 的事件协议（先 registered、恰一次结算、最后 removed）以及每个通告的投影与注册表自身读取的一致性 |
 
 ### 服务操作
 
-每个操作都是已注册任务之上的薄投影：`get` 与 `list` 返回非消费式快照，`read` 推进唯一的流游标，`kill` 在改变状态前调用生产方取消，`wait` 最多阻塞至超时，`start()` 在调用生产方 `run()` 一次之前预检访问、校验与准入，同时拒绝任何没有已附加控制器服务的所有者；监听器按所有者粒度观察终止记录与可见集变化，`attachController` 把控制器可用性限定在其 effect 生命周期内。确切签名与行为见 [`src/index.ts`](src/index.ts) 的 JSDoc 与生成的 [`ctx.jobs` Cordis 接口面](../../../docs/subsystems/jobs.zh.md)。
+每个读取或控制操作接收可选的调用方 `SessionId`，省略时仅允许访问无主 job：`list` 与 `get` 返回全新投影，`read` 推进模型游标并在结算后把生产方的 result 交出一次，`readAt` 按绝对偏移读取保留块且不消耗任何东西，`kill` 在改变状态前调用生产方取消并为终态 `detail` 记录原因，`wait` 阻塞至超时，`start()` 在调用生产方 `run()` 一次之前预检访问、校验与准入，同时拒绝任何没有已附加控制器服务的所有者；`events.subscribe` 按所有者、scope 或进程粒度投递注册、进度、停止中、结算、移除与输出提交。
 
 </details>
 
@@ -92,12 +95,13 @@ kind: "package-reference"
 
 当包级约定不够用时阅读以下页面。它们从任务类型逐步进入随附实现、模型侧控制与设计记录。
 
-- [后台任务运行时子系统](../../../docs/subsystems/jobs.zh.md)——任务类型、快照字段与 `ctx.jobs` 的 Cordis 接口面。
+- [后台任务运行时子系统](../../../docs/subsystems/jobs.zh.md)——任务类型、投影字段与 `ctx.jobs` 的 Cordis 接口面。
 - [jobs 组映射](../README.zh.md)——同级组页面及其包表格。
 - [进程本地注册表](../jobs-local/README.zh.md)——在本进程中运行任务的随附实现。
 - [模型侧任务控制](../tool-jobs/README.zh.md)——`job_output`、`job_list` 与 `job_kill` 工具及完成通知。
 - [通用长时间运行工具运行时 Agent Note](../../../.agents/notes/implemented/architecture/2026-06-20-generic-long-running-tool-runtime.zh.md)——后台任务运行时背后的设计。
 - [任务注册表 seam Agent Note](../../../.agents/notes/archived/architecture/2026-07-26-job-registry-seam.md)——按所有者隔离的注册表约定及其理由。
+- [jobs seam 收敛 Agent Note](../../../.agents/notes/implemented/architecture/2026-09-03-jobs-seam-consolidation.zh.md)——一个输出环、一个投影、一条事件流。
 
 -----
 
@@ -117,8 +121,8 @@ kind: "package-reference"
 
 这些限制说明约定何时不合适。它们是当前包约束，不是任务积压。
 
-- **约定是进程内的**——`JobStart.run()` 传入回调和确切的 `Agent` 对象；持久化或跨进程后端必须先重塑身份、重启、所有权与观察语义，才能实现此 seam。
-- **流输出只有一个消费游标**——独立观察者需要游标或快照 API。
+- **约定是进程内的**——`JobSpec.run()` 传入回调，注册表解析拥有者会话背后的活体 `Agent`；持久化或跨进程后端必须先重塑身份、重启、所有权与观察语义，才能实现此 seam。
+- **模型游标是唯一的消耗式读取**——独立观察者使用非消耗的 `readAt`，从不移动它。
 - **前台工作无法转为后台**——生产方在启动前选择前台或后台。
 
 <a id="dev-note"></a>
diff --git a/packages/jobs/jobs/package.json b/packages/jobs/jobs/package.json
index ccbd216368..ea35be2cea 100644
--- a/packages/jobs/jobs/package.json
+++ b/packages/jobs/jobs/package.json
@@ -26,6 +26,10 @@
       "types": "./lib/types/brand.d.ts",
       "default": "./lib/types/brand.js"
     },
+    "./view": {
+      "types": "./lib/types/view.d.ts",
+      "default": "./lib/types/view.js"
+    },
     "./src/*": "./src/*",
     "./package.json": "./package.json"
   },
diff --git a/packages/jobs/jobs/src/index.ts b/packages/jobs/jobs/src/index.ts
index 7d46dfa342..57aebe0d17 100644
--- a/packages/jobs/jobs/src/index.ts
+++ b/packages/jobs/jobs/src/index.ts
@@ -1,29 +1,40 @@
 /**
  * The background-job Service Definition (`ctx.jobs`). It owns the contract for
- * job ids, session-scoped access, lifecycle state, completion listeners, and
- * owner cleanup while producers retain their execution resources. The
- * process-local registry lives in `@deepseek-ai/dsh-jobs-local`.
+ * job ids, session-scoped access, lifecycle state, the per-job output ring —
+ * one bounded stream that the model consumes through a registry-kept cursor
+ * and that any number of observers read at absolute byte offsets — and the
+ * event stream announcing every commit, while producers retain their
+ * execution resources. The process-local registry lives in
+ * `@deepseek-ai/dsh-jobs-local`.
  * @module @deepseek-ai/dsh-jobs
  */
 
 import { Context, Service } from '@deepseek-ai/cordis'
-import type { Agent } from '@deepseek-ai/dsh-agent'
-import type {
-  JobDoneListener, JobId, JobRead, JobSnapshot, JobStart, JobsChangedListener,
-} from './types.ts'
+import type { SessionId } from '@deepseek-ai/dsh-session'
+import type { JobEvents, JobId, JobOutputRead, JobRead, JobSpec, JobView } from './types.ts'
 
 export { JobId } from './types.ts'
 export type {
-  JobDoneListener,
+  JobAppendOptions,
+  JobChannel,
+  JobChunk,
+  JobEvent,
+  JobEventFilter,
+  JobEventListener,
+  JobEvents,
+  JobHandle,
   JobHooks,
   JobKind,
   JobKindMap,
   JobOutcome,
+  JobOutputRead,
+  JobOutputSource,
   JobRead,
-  JobSnapshot,
-  JobStart,
+  JobSettleCause,
+  JobSourceRead,
+  JobSpec,
   JobStatus,
-  JobsChangedListener,
+  JobView,
 } from './types.ts'
 
 declare module '@deepseek-ai/cordis' {
@@ -33,7 +44,7 @@ declare module '@deepseek-ai/cordis' {
 }
 
 /**
- * Abstract background job registry. Subclass, implement the abstract methods,
+ * Abstract background job registry. Subclass, implement the abstract members,
  * and load the subclass as a plugin — it registers as `ctx.jobs` (one
  * implementation per context; loading a second throws, which is cordis'
  * standard duplicate-service behavior).
@@ -41,23 +52,30 @@ declare module '@deepseek-ai/cordis' {
  * Implementations must honor these semantics:
  * - Registrations outlive producer and controller fibers. Owner and
  *   service disposal cancel live work and await compliant producers; a
- *   throwing teardown cancel force-fails only the record. Teardown
- *   cancellation also marks the record reported, because a record its owner
- *   is being destroyed for has no reader left.
+ *   throwing teardown cancel force-fails only the record. Such settlements
+ *   announce `cause: 'teardown'`, because a job whose owner is being destroyed
+ *   has no reader left.
  * - Owned-job access is fenced by the owner's session id. Ids are
  *   predictable, so authorization — not secrecy — is the boundary.
- * - Settlement is first-wins: one terminal record, released waiters, and one
- *   round of contained listener notification, even against a late producer
- *   outcome. Completion is announced last, after the record is committed and
- *   every other observer of the settlement has seen it, because a reporter
- *   may open a model turn synchronously.
+ * - Settlement is first-wins: one terminal record, released waiters, then one
+ *   round of contained event delivery, even against a late producer outcome.
+ *   The `settled` event follows every released waiter, so a consumer that
+ *   claims a settlement while waiting always claims before the event.
  * - {@link start} refuses work while no attached job controller serves the
  *   spec's owner, so a producer cannot start work that owner cannot collect
  *   or stop. One registry serves every composition in the process, so this
- *   question — and completion-listener delivery — is owner-relative rather
- *   than process-wide: registrations made from an unscoped context serve
- *   every owner, and registrations made under an agent composition's scope
- *   serve exactly the agents composed under it.
+ *   question — and event delivery under `{ owners: 'scope' }` — is
+ *   owner-relative rather than process-wide: registrations made from an
+ *   unscoped context serve every owner, and registrations made under an agent
+ *   composition's scope serve exactly the agents composed under it.
+ * - Every job owns one output ring. Pull sources named by the spec are pumped
+ *   by the registry and drained once more before settlement; pushed appends
+ *   land whole. The model's consuming cursor and observers' absolute offsets
+ *   read the same bytes and never disturb each other.
+ * - Ring retention is bounded. Appends past the live cap drop the oldest
+ *   retained bytes; a reader below the retained window gets a lossy read,
+ *   never an error. Settlement trims retention to the settled cap and ends
+ *   the stream; the ring has no separate lifecycle.
  */
 export abstract class JobRegistry extends Service {
   constructor(ctx: Context) {
@@ -70,101 +88,81 @@ export abstract class JobRegistry extends Service {
     super(ctx, 'jobs')
   }
 
+  /** Lifecycle and output events, filtered per subscription. */
+  abstract readonly events: JobEvents
+
   /**
    * Preflight access, validation, owner cleanup, and implementation-owned
    * admission before starting and atomically registering work. Any preflight
    * rejection leaves no job id or execution resource. A throwing starter
    * leaves nothing registered; after it returns, registration cannot fail.
-   * Settlement records the outcome, notifies listeners, and releases waiters.
-   * @param spec - job identity, owner, and synchronous starter.
+   * @param spec - job identity, owner, output sources, and synchronous starter.
    * @returns the registry-issued `<kind>-N` id.
    */
-  abstract start(spec: JobStart): JobId
+  abstract start(spec: JobSpec): JobId
 
   /**
-   * List caller-owned and unowned jobs in registration order without exposing
-   * another session's labels.
-   * @param caller - reading agent; a non-agent caller sees only unowned jobs.
-   * @returns fresh snapshots.
+   * List caller-owned and unowned jobs in registration order.
+   * @param caller - reading session; omission sees only unowned jobs.
+   * @returns fresh projections.
    */
-  abstract list(caller?: Agent): JobSnapshot[]
+  abstract list(caller?: SessionId): JobView[]
 
   /**
-   * Return a non-consuming snapshot without changing its read cursor or notice
-   * state. Throws for an unknown or foreign job.
-   * @param id - job to look up.
-   * @param caller - reading agent checked against the owner.
-   * @returns a fresh snapshot.
-   */
-  abstract get(id: JobId, caller?: Agent): JobSnapshot
-
-  /**
-   * Read the next stream delta, or the idempotent final output after settlement.
-   * A terminal read marks the job reported. Throws for an unknown or foreign
-   * job.
-   * @param id - job to read.
-   * @param caller - reading agent checked against the owner.
-   * @returns output text and the post-read snapshot.
-   */
-  abstract read(id: JobId, caller?: Agent): JobRead
-
-  /**
-   * Request cancellation, then mark the job stopping and reported. A producer
-   * throw propagates without changing job state. Throws for an unknown or
+   * Project one job without changing its cursor. Throws for an unknown or
    * foreign job.
+   * @param id - job to look up.
+   * @param caller - reading session checked against the owner.
+   * @returns a fresh projection.
+   */
+  abstract get(id: JobId, caller?: SessionId): JobView
+
+  /**
+   * Consume the ring from the model cursor and advance it to the current
+   * total. After settlement the first read also carries the producer's
+   * result. Throws for an unknown or foreign job.
+   * @param id - job to read.
+   * @param caller - reading session checked against the owner.
+   * @returns the chunks since the cursor, the lossy flag, the result once, and the post-read projection.
+   */
+  abstract read(id: JobId, caller?: SessionId): JobRead
+
+  /**
+   * Read retained ring output without moving the model cursor. Resume with
+   * a previous read's `next`; an offset inside a retained chunk returns the
+   * whole chunk (its `at` may precede `from`). Throws for a negative or
+   * non-integer offset, or an unknown or foreign job.
+   * @param id - job to read.
+   * @param from - absolute byte offset to read from (0 for the retained head).
+   * @param caller - reading session checked against the owner.
+   * @returns retained chunks overlapping `[from, total)`, the resume offset, and the lossy flag.
+   */
+  abstract readAt(id: JobId, from: number, caller?: SessionId): JobOutputRead
+
+  /**
+   * Request cancellation, then mark the job stopping. A producer throw
+   * propagates without changing job state. A supplied reason is merged into
+   * terminal `detail` when the job settles `killed`. Throws for an unknown
+   * or foreign job.
    * @param id - job to cancel.
-   * @param caller - killing agent checked against the owner.
-   * @param reason - logged reason forwarded to the producer.
+   * @param caller - killing session checked against the owner.
+   * @param reason - cancellation reason forwarded verbatim to the producer.
    * @returns `requested` for live work, otherwise `already-finished`.
    */
-  abstract kill(id: JobId, caller?: Agent, reason?: string): 'requested' | 'already-finished'
+  abstract kill(id: JobId, caller?: SessionId, reason?: string): 'requested' | 'already-finished'
 
   /**
    * Wait for settlement or timeout without cancelling the job. Caller abort
    * rejects only while the job is live; after settlement the terminal
-   * snapshot wins so a notice suppressed for this waiter is still delivered.
-   * Throws for invalid, unknown, or foreign input.
+   * projection wins. Rejects for an invalid timeout or an unknown or foreign
+   * job.
    * @param id - job to wait for.
    * @param timeoutMs - positive finite wait bound in milliseconds.
-   * @param caller - waiting agent checked against the owner.
+   * @param caller - waiting session checked against the owner.
    * @param signal - optional cancellation of the wait itself.
-   * @returns snapshot at settlement or timeout.
+   * @returns projection at settlement or timeout.
    */
-  abstract wait(id: JobId, timeoutMs: number, caller?: Agent, signal?: AbortSignal): Promise<JobSnapshot>
-
-  /**
-   * Register an effect-scoped completion listener. It receives the settlements
-   * of the owners its registering context's scope covers; each listener is
-   * contained; returned promises are observed but not awaited. No listener runs
-   * after service disposal.
-   * @param listener - receives each terminal snapshot and its exact owner.
-   * @returns disposer that unregisters the listener.
-   */
-  abstract onJobDone(listener: JobDoneListener): () => void
-
-  /**
-  /**
-   * Register an effect-scoped observer of visible-set changes. It fires after
-   * every commit that changes what {@link list} returns for that owner —
-   * registration, every stopping transition (including the one teardown
-   * performs before it awaits a slow producer), settlement, owner-disposal
-   * removal, and the emptying that service disposal commits — so an observer
-   * re-reads rather than accumulating deltas.
-   *
-   * Delivery is owner-relative on the same terms as {@link onJobDone}: an
-   * observer registered from an unscoped context — a host composition's own
-   * carrier — sees every owner, while one registered under an agent
-   * composition's scope sees exactly the agents composed under it.
-   *
-   * This is not a superset of {@link onJobDone}: that one delivers the terminal
-   * record under first-wins semantics a job controller couples to notice
-   * delivery, while this one carries no delivery meaning and marks nothing
-   * reported. Listeners are contained and never awaited.
-   * @param listener - receives the owner whose visible set changed, or
-   *   `undefined` when an unowned job changed and every caller's set did.
-   * @returns disposer that unregisters the listener.
-   */
-  abstract onJobsChanged(listener: JobsChangedListener): () => void
+  abstract wait(id: JobId, timeoutMs: number, caller?: SessionId, signal?: AbortSignal): Promise<JobView>
 
   /**
    * Attach an effect-scoped controller that can read and stop jobs. It serves the
diff --git a/packages/jobs/jobs/src/invariant.ts b/packages/jobs/jobs/src/invariant.ts
index 5963179c00..110a94c34b 100644
--- a/packages/jobs/jobs/src/invariant.ts
+++ b/packages/jobs/jobs/src/invariant.ts
@@ -1,51 +1,110 @@
-/** Package-owned background-job snapshot invariants. @module @deepseek-ai/dsh-jobs/invariant */
+/** Package-owned background-job event-protocol invariants. @module @deepseek-ai/dsh-jobs/invariant */
 
 import type { Context } from '@deepseek-ai/cordis'
-import type { Agent } from '@deepseek-ai/dsh-agent'
 import type { InvariantFailure, InvariantInstaller } from '@deepseek-ai/dsh-invariants'
-import type { JobSnapshot } from './types.ts'
+import type { JobId } from './brand.ts'
+import type { JobEvent, JobView } from './types.ts'
 
 const PACKAGE_NAME = '@deepseek-ai/dsh-jobs'
 const TERMINAL_STATUSES = new Set(['completed', 'killed', 'failed'])
 
+/**
+ * Where one announced job stands: `live` from its first event until its
+ * settlement, `settled` until its removal. An id first seen through a later
+ * event is adopted at that phase, so a companion mounted after the job
+ * started raises nothing.
+ */
+type Phase = 'live' | 'settled'
+
 /** Cordis companion plugin name. */
 export const name = 'jobs-invariant'
 /** Service required before the companion can reserve package ownership. */
 export const inject = ['invariants']
 
-/** Validate the cross-field relationships in one registry snapshot. */
-function validateSnapshot(snapshot: JobSnapshot, owner: Agent | undefined, fail: InvariantFailure): void {
-  const id = String(snapshot.id)
-  const prefix = `${snapshot.kind}-`
-  const ordinal = Number(id.slice(prefix.length))
-  if (snapshot.kind.length === 0 || !id.startsWith(prefix)
-    || !Number.isSafeInteger(ordinal) || ordinal < 1) {
-    fail(`job snapshot id ${JSON.stringify(id)} must be ${JSON.stringify(prefix)} followed by a positive ordinal`)
-  }
-  if (snapshot.label.length === 0) fail(`job ${JSON.stringify(id)} label must be non-empty`)
-  if (!Number.isSafeInteger(snapshot.startedAt) || snapshot.startedAt < 0) {
-    fail(`job ${JSON.stringify(id)} startedAt must be a non-negative epoch integer`)
-  }
-
-  const terminal = TERMINAL_STATUSES.has(snapshot.status)
-  if (terminal !== (snapshot.finishedAt !== undefined)) {
-    fail(`job ${JSON.stringify(id)} finishedAt must be present exactly for a terminal status`)
-  }
-  if (snapshot.finishedAt !== undefined
-    && (!Number.isSafeInteger(snapshot.finishedAt) || snapshot.finishedAt < snapshot.startedAt)) {
-    fail(`job ${JSON.stringify(id)} finishedAt must be an epoch integer no earlier than startedAt`)
-  }
-
-  const expectedOwner = owner?.id
-  if (snapshot.ownerSession !== expectedOwner) {
-    fail(`job ${JSON.stringify(id)} ownerSession does not match its completion owner`)
+/** The registry's own current projection of `id`, or undefined once the record is gone. */
+function readBack(ctx: Context, id: JobId, owner: JobView['owner']): JobView | undefined {
+  try {
+    return ctx.jobs.get(id, owner)
+  } catch {
+    // The registry throws for an id outside the caller's set; after a removal that is the expected answer.
+    return undefined
   }
 }
 
-/** Install checks over current unowned records and every terminal snapshot. */
+/**
+ * The announced projection must agree with the registry's own read: the
+ * immutable identity matches, and the announced output total is not ahead of
+ * the committed one.
+ */
+function checkAnnounced(read: JobView, announced: JobView, what: string, fail: InvariantFailure): void {
+  const id = String(announced.id)
+  for (const key of ['kind', 'label', 'owner', 'startedAt'] as const) {
+    if (read[key] !== announced[key]) {
+      fail(`${what} for job ${id} announces ${key} ${JSON.stringify(announced[key])} while the registry reads ${JSON.stringify(read[key])}`)
+    }
+  }
+  if (announced.output.total > read.output.total) {
+    fail(`${what} for job ${id} announces output total ${announced.output.total} ahead of the registry's ${read.output.total}`)
+  }
+}
+
+/** Install the per-job protocol and event-versus-read checks over the whole event stream. */
 const install: InvariantInstaller = Object.assign((ctx: Context, fail: InvariantFailure) => {
-  for (const snapshot of ctx.jobs.list()) validateSnapshot(snapshot, undefined, fail)
-  ctx.jobs.onJobDone((snapshot, owner) => { validateSnapshot(snapshot, owner, fail) })
+  const phases = new Map<string, Phase>()
+  ctx.jobs.events.subscribe({ owners: 'all' }, (event: JobEvent) => {
+    if (event.type === 'output') {
+      const id = String(event.id)
+      const read = readBack(ctx, event.id, event.owner)
+      if (read === undefined) fail(`output announced for job ${id} that the registry no longer returns`)
+      if (event.total > read.output.total) {
+        fail(`output announced for job ${id} at total ${event.total} ahead of the registry's ${read.output.total}`)
+      }
+      if (!phases.has(id)) phases.set(id, 'live')
+      return
+    }
+    const { job } = event
+    const id = String(job.id)
+    const phase = phases.get(id)
+    const terminal = TERMINAL_STATUSES.has(job.status)
+    switch (event.type) {
+      case 'registered':
+        if (phase !== undefined) fail(`registered announced for job ${id} after earlier events for the same id`)
+        if (terminal || job.finishedAt !== undefined) fail(`registered job ${id} must announce a live status without finishedAt`)
+        break
+      case 'progress':
+      case 'stopping':
+        if (phase === 'settled') fail(`${event.type} announced for job ${id} after its settlement`)
+        if (terminal) fail(`${event.type} announced for job ${id} with a terminal status`)
+        break
+      case 'settled':
+        if (phase === 'settled') fail(`settled announced twice for job ${id}`)
+        if (!terminal) fail(`settled job ${id} must announce a terminal status, got ${JSON.stringify(job.status)}`)
+        if (job.finishedAt === undefined || job.finishedAt < job.startedAt) {
+          fail(`settled job ${id} must announce finishedAt no earlier than startedAt`)
+        }
+        if (job.progress !== undefined) fail(`settled job ${id} must announce a cleared progress line`)
+        break
+      case 'removed':
+        if (phase === 'live') fail(`removed announced for job ${id} before its settlement`)
+        if (readBack(ctx, job.id, job.owner) !== undefined) fail(`removed announced for job ${id} that the registry still returns`)
+        phases.delete(id)
+        return
+      /* v8 ignore start -- defensive: the lifecycle event union is closed and exhaustive here; a new variant fails loudly */
+      default: {
+        const exhaustive: never = event
+        fail(`unknown job event ${String(exhaustive)} for job ${id}`)
+      }
+      /* v8 ignore stop */
+    }
+    const read = readBack(ctx, job.id, job.owner)
+    if (read === undefined) fail(`${event.type} announced for job ${id} that the registry does not return`)
+    checkAnnounced(read, job, event.type, fail)
+    if (event.type === 'settled' && (read.status !== job.status || read.finishedAt !== job.finishedAt)) {
+      fail(`settled job ${id} announces ${job.status} at ${String(job.finishedAt)}`
+        + ` while the registry reads ${read.status} at ${String(read.finishedAt)}`)
+    }
+    phases.set(id, event.type === 'settled' ? 'settled' : 'live')
+  })
 }, { inject: ['jobs'] })
 
 /**
diff --git a/packages/jobs/jobs/src/types.ts b/packages/jobs/jobs/src/types.ts
index 2842f6a3a5..e607ee99f9 100644
--- a/packages/jobs/jobs/src/types.ts
+++ b/packages/jobs/jobs/src/types.ts
@@ -1,71 +1,104 @@
 /**
- * Types shared by job producers, the registry, and controllers. The
- * service implementation lives in `./index.ts`.
+ * Types shared by job producers, the registry, and its consumers. The
+ * client-safe projection vocabulary lives in `./view.ts`; the service
+ * implementation lives in `./index.ts`.
  * @module @deepseek-ai/dsh-jobs/types
  */
 
-import type { Agent } from '@deepseek-ai/dsh-agent'
 import type { SessionId } from '@deepseek-ai/dsh-session'
 import type { JobId } from './brand.ts'
+import type { JobChannel, JobChunk, JobKind, JobView } from './view.ts'
 
 export { JobId } from './brand.ts'
-
-/**
- * Task lifecycle: `running`, optionally `stopping`, then exactly one terminal
- * status. Producer-specific facts belong in {@link JobSnapshot.detail}.
- */
-export type JobStatus = 'running' | 'stopping' | 'completed' | 'killed' | 'failed'
-
-/**
- * Producer-defined job kinds. Plugins extend this map by declaration merging;
- * the registry treats every value as an opaque id namespace.
- */
-export interface JobKindMap {
-  bash: 'bash'
-  subagent: 'subagent'
-}
-
-/** The merge-extensible union of registered producer kind names. */
-export type JobKind = JobKindMap[keyof JobKindMap]
+export type { JobChannel, JobChunk, JobKind, JobKindMap, JobStatus, JobView } from './view.ts'
 
 /** Terminal result supplied by a producer through {@link JobHooks.done}. */
 export interface JobOutcome {
   /** How the job ended: finished (`completed`), cancelled (`killed`), or broke (`failed`). */
   status: 'completed' | 'killed' | 'failed'
-  /** Kind-specific detail rendered into status lines ('exit code: 3', 'max-tokens'). */
+  /**
+   * Terminal reason rendered into status lines (`exit code: 3`, `max-tokens`).
+   * When the job settles `killed` after a {@link JobRegistry.kill} with a
+   * reason, the registry appends that reason.
+   */
   detail?: string
-  /** Final output for jobs without `readOutput`; stream jobs leave it unset. */
-  output?: string
+  /**
+   * Return value for jobs whose result is a value rather than a stream (a
+   * workflow's rendered result, a subagent's report). The output ring carries
+   * the stream; this is handed out once by the model's next {@link JobRegistry.read}.
+   */
+  result?: string
+}
+
+/** One incremental read from a {@link JobOutputSource}. */
+export interface JobSourceRead {
+  /** Text captured since the requested offset (the whole retained tail when lossy). */
+  text: string
+  /** Whole-stream offset to resume from on the next read. */
+  nextOffset: number
+  /** True when the requested offset slid out of the source's retained window. */
+  lossy: boolean
+  /**
+   * Host path of a file holding the complete stream, when the source
+   * currently keeps an intact one. Reported on every read, so the registry
+   * tracks it as source metadata: a later read without it withdraws the file.
+   */
+  spillPath?: string
 }
 
 /**
- * Producer declaration passed to {@link JobRegistry.start}. The runtime
- * preflights access and cleanup before invoking {@link run}; the producer owns
- * execution resources while the runtime owns identity and lifecycle state.
+ * A pull source the registry pumps into the job's output ring — the subprocess
+ * `readFrom` family. The registry owns the cadence and drains every source one
+ * last time before settlement closes the ring, so a producer folds nothing
+ * into its `done`.
  */
-export interface JobStart {
-  /** Producer kind — also the id prefix (`bash`, `subagent`, …). */
-  kind: JobKind
-  /** One-line model-facing label (the command; the delegation description). */
-  label: string
+export interface JobOutputSource {
+  /** Stream label attached to every chunk this source yields. */
+  channel?: JobChannel
   /**
-   * Optional UTF-8 byte cap for each complete model-facing completion notice or
-   * output read, including controller status metadata.
+   * Read everything captured since `fromByte` without consuming it.
+   * @param fromByte - whole-stream offset to resume from (a prior read's `nextOffset`; 0 first).
+   * @returns the delta text, the next offset, the lossy flag, and the spill path the source currently keeps.
    */
-  outputLimitBytes?: number
+  read(fromByte: number): JobSourceRead
+}
+
+/** Options for one {@link JobHandle.append}. */
+export interface JobAppendOptions {
+  /** Stream label for the chunk; omitted for producers without distinct streams. */
+  channel?: JobChannel
   /**
-   * Owning live agent. Access is fenced by its session id, and agent disposal
-   * cancels and awaits the job. The instance must be the one currently
-   * registered under its agent id. Omitting the owner creates an unowned job,
-   * open to any caller until service disposal.
+   * Marks that producer-side bytes between the previous chunk and this one
+   * were lost, so an observer can render the discontinuity instead of a
+   * silent splice.
    */
-  owner?: Agent
+  gapBefore?: true
+}
+
+/**
+ * Producer face of one registered job, handed to {@link JobSpec.run} and
+ * valid for the job's whole life. All methods are synchronous. Writes staged
+ * inside the starter call are retained and become visible with the
+ * registration commit; after settlement — the producer's own outcome, a kill,
+ * or a registry-forced teardown end — writes log and drop instead of
+ * throwing, so a producer's trailing flush cannot break its own teardown path.
+ */
+export interface JobHandle {
+  /** The registry-issued id (`<kind>-N`). */
+  readonly id: JobId
   /**
-   * Start the work after preflight and synchronously return its hooks. Called
-   * once; a throw leaves nothing registered, and the producer must clean up any
-   * partially started resources.
+   * Append one chunk to the output ring. Offsets advance by the chunk's UTF-8
+   * byte length; an empty chunk is dropped without waking observers.
+   * @param text - the chunk text, exactly as produced.
+   * @param options - stream label and gap marker.
    */
-  run(): JobHooks
+  append(text: string, options?: JobAppendOptions): void
+  /**
+   * Replace the live progress line (`3/10`, the current phase). Settlement
+   * clears it; the terminal reason travels in {@link JobOutcome.detail}.
+   * @param line - the new progress line.
+   */
+  updateProgress(line: string): void
 }
 
 /** Hooks through which the runtime controls and observes producer work. */
@@ -82,79 +115,132 @@ export interface JobHooks {
    * registry record without claiming that the work stopped.
    */
   done: Promise<JobOutcome>
-  /**
-   * Consume output produced since the previous call. The producer formats
-   * truncation and spill notices. Absence marks a final-output-only job; each
-   * job has one consuming cursor.
-   */
-  readOutput?(): string
 }
 
 /**
- * A read-only projection of one job, safe to hand to listeners and tools —
- * a fresh object per call, never live registry state.
+ * Producer declaration passed to {@link JobRegistry.start}. The runtime
+ * preflights access and cleanup before invoking {@link run}; the producer owns
+ * execution resources while the runtime owns identity, lifecycle state, and
+ * the output ring.
  */
-export interface JobSnapshot {
-  /** The registry-issued id (`<kind>-N`). */
-  id: JobId
-  /** The producer kind the job was registered with. */
+export interface JobSpec {
+  /** Producer kind — also the id prefix (`bash`, `subagent`, …). */
   kind: JobKind
-  /** The producer-supplied one-line label. */
+  /** One-line model-facing label (the command; the delegation description). */
   label: string
-  /** Producer-owned cap for complete model-facing notices and output reads. */
+  /**
+   * Owning session. Access is fenced by it, and the owner's live Agent must be
+   * the one currently registered under that id: its disposal cancels and
+   * awaits the job. Omitting the owner creates an unowned job, open to any
+   * caller until service disposal.
+   */
+  owner?: SessionId
+  /**
+   * Optional UTF-8 byte cap for each complete model-facing completion notice or
+   * output read, including controller status metadata. Independent of ring
+   * retention: it bounds the consuming model surface, never observers.
+   */
   outputLimitBytes?: number
   /**
-   * Owner session id used for authorization and correlation; absent for
-   * unowned jobs. Completion listeners receive the exact {@link Agent}
-   * separately through {@link JobDoneListener}.
+   * Pull sources the registry pumps into the ring at its own cadence.
+   * Producers that narrate their own progress use {@link JobHandle.append}
+   * instead; a job may use both.
    */
-  ownerSession?: SessionId
-  /** Current lifecycle state. */
-  status: JobStatus
-  /** Kind-specific status detail, present once the producer supplied one (usually terminal). */
-  detail?: string
-  /** Epoch ms when the job was registered. */
-  startedAt: number
-  /** Epoch ms when the job settled; absent while `running`/`stopping`. */
-  finishedAt?: number
+  output?: readonly JobOutputSource[]
   /**
-   * True when a kill, read, wait, or teardown cancel has reported or committed
-   * to report the terminal state. Completion reporters suppress redundant
-   * notices when set. Teardown claims it because the owner or service being
-   * destroyed leaves no reader: a reporter that opens a turn on notice would
-   * otherwise spend a model request per teardown layer.
+   * Start the work after preflight and synchronously return its hooks. Called
+   * once with the job's producer face; a throw leaves nothing registered (the
+   * spent ordinal is skipped), and the producer must clean up any partially
+   * started resources.
+   * @param job - the issued id plus the ring append and progress writers.
    */
-  reported: boolean
+  run(job: JobHandle): JobHooks
 }
 
-/** Output and post-read state returned by {@link JobRegistry.read}. */
+/** Output and post-read state returned by the consuming {@link JobRegistry.read}. */
 export interface JobRead {
-  /**
-   * Stream kinds: the consuming delta since the previous read. Final-output
-   * kinds: empty while live, the terminal {@link JobOutcome.output} (or
-   * empty) once settled — idempotent, never consumed.
-   */
-  text: string
+  /** Ring chunks appended since the model cursor, in offset order; every channel included. */
+  chunks: readonly JobChunk[]
+  /** True when the cursor fell below the oldest retained byte, so bytes are missing before `chunks`. */
+  lossy: boolean
+  /** The producer's {@link JobOutcome.result}, handed out by the first read after settlement only. */
+  result?: string
   /** The job's state at read time. */
-  snapshot: JobSnapshot
+  job: JobView
+}
+
+/** Result of one non-consuming {@link JobRegistry.readAt}. */
+export interface JobOutputRead {
+  /** Retained chunks overlapping `[from, total)`, in offset order. */
+  chunks: readonly JobChunk[]
+  /**
+   * Offset to resume from — the ring's current `total`. Always a chunk
+   * boundary: appends land whole and trimming only advances chunk starts, and
+   * consumers concatenate `chunks` under that assumption, so a provider
+   * serving partial chunks would silently duplicate text.
+   */
+  next: number
+  /** True when `from` fell below the oldest retained byte, so bytes are missing before `chunks`. */
+  lossy: boolean
 }
 
 /**
- * Completion callback with the exact owner supplied at start, or `undefined`
- * for an unowned job. Returned promises are observed but not awaited.
+ * Why a job settled: its producer finished (`producer`), a
+ * {@link JobRegistry.kill} ran first (`kill`), or owner or service teardown
+ * cancelled it (`teardown`) — a settlement whose owner has no reader left.
  */
-export type JobDoneListener = (
-  snapshot: JobSnapshot,
-  owner: Agent | undefined,
-) => void | PromiseLike<void>
+export type JobSettleCause = 'producer' | 'kill' | 'teardown'
 
 /**
- * Observation callback for a change to what one owner's {@link JobRegistry.list}
- * would return. It is owner-granular rather than job-granular because the
- * change may be a removal, which no per-job record can express, and because
- * its consumers re-read the whole visible set anyway.
- *
- * An `undefined` owner means an unowned job changed, so every caller's visible
- * set changed with it.
+ * One lifecycle or output event. Lifecycle events carry the job's projection
+ * after the commit they announce; `output` carries only the id and the new
+ * total, so an observer schedules a {@link JobRegistry.readAt} from its own
+ * cursor and the registry never pushes payloads.
  */
-export type JobsChangedListener = (owner: Agent | undefined) => void
+export type JobEvent =
+  | {
+    /** Registration commit, progress line change, stopping transition, or removal from the visible set. */
+    readonly type: 'registered' | 'progress' | 'stopping' | 'removed'
+    readonly job: JobView
+  }
+  | {
+    readonly type: 'settled'
+    readonly job: JobView
+    readonly cause: JobSettleCause
+  }
+  | {
+    readonly type: 'output'
+    readonly id: JobId
+    /** Owning session, absent for an unowned job. */
+    readonly owner?: SessionId
+    /** The ring's total after the append (or at settlement, which ends the stream). */
+    readonly total: number
+  }
+
+/**
+ * Who a subscription hears about. `{ owner }` delivers that session's jobs
+ * plus every unowned job (the set that session can see). `{ owners: 'scope' }`
+ * delivers the owners composed under the subscribing context — one registry
+ * serves every composition in the process, and a mount under one preset must
+ * not hear another preset's agents. `{ owners: 'all' }` delivers everything.
+ */
+export type JobEventFilter =
+  | { readonly owner: SessionId }
+  | { readonly owners: 'all' | 'scope' }
+
+/** Event callback; contained by the registry, never awaited. */
+export type JobEventListener = (event: JobEvent) => void
+
+/** The registry's event stream. */
+export interface JobEvents {
+  /**
+   * Register an effect-scoped listener. Events are dispatched synchronously
+   * after the commit they announce; a job's first event is `registered`, and
+   * a `settled` event follows the release of every waiter. No listener runs
+   * after service disposal.
+   * @param filter - which owners' events to deliver.
+   * @param listener - receives each matching event.
+   * @returns disposer that unregisters the listener.
+   */
+  subscribe(filter: JobEventFilter, listener: JobEventListener): () => void
+}
diff --git a/packages/jobs/jobs/src/view.ts b/packages/jobs/jobs/src/view.ts
new file mode 100644
index 0000000000..39a1eb45d1
--- /dev/null
+++ b/packages/jobs/jobs/src/view.ts
@@ -0,0 +1,91 @@
+/**
+ * Client-safe job vocabulary: the read-only projection of one job and the
+ * chunks its output ring hands out. This leaf reaches no Host package, so
+ * browser programs and Remote wire types import it without pulling the
+ * registry's Host declaration merges.
+ * @module @deepseek-ai/dsh-jobs/view
+ */
+
+import type { SessionId } from '@deepseek-ai/dsh-session/types'
+import type { JobId } from './brand.ts'
+
+/**
+ * Job lifecycle: `running`, optionally `stopping`, then exactly one terminal
+ * status. Producer-specific facts belong in {@link JobView.progress} and
+ * {@link JobView.detail}.
+ */
+export type JobStatus = 'running' | 'stopping' | 'completed' | 'killed' | 'failed'
+
+/**
+ * Producer-defined job kinds. Plugins extend this map by declaration merging;
+ * the registry treats every value as an opaque id namespace.
+ */
+export interface JobKindMap {
+  bash: 'bash'
+  subagent: 'subagent'
+}
+
+/** The merge-extensible union of registered producer kind names. */
+export type JobKind = JobKindMap[keyof JobKindMap]
+
+/**
+ * Stream label of one output chunk. `stdout` and `stderr` reach the model's
+ * consuming read; `log` marks producer narration (a workflow's phase lines)
+ * that only observers see. Consumers treat an unrecognized label like an
+ * absent one.
+ */
+export type JobChannel = 'stdout' | 'stderr' | 'log'
+
+/** One chunk of a job's output ring: absolute offset, text, channel, and loss marker. */
+export interface JobChunk {
+  /** Absolute offset of the chunk's first byte; offsets never move once assigned. */
+  readonly at: number
+  /** Chunk text exactly as appended (possibly tail-trimmed by retention). */
+  readonly text: string
+  /** Stream label, when the producer supplied one. */
+  readonly channel?: JobChannel
+  /** Bytes immediately before this chunk were lost, at the producer or to retention. */
+  readonly gapBefore?: true
+}
+
+/**
+ * Read-only projection of one job — a fresh object per call, never live
+ * registry state. The model tools, the browser roster, and the observation
+ * stream all consume this one shape.
+ */
+export interface JobView {
+  /** The registry-issued id (`<kind>-N`). */
+  readonly id: JobId
+  /**
+   * The producer kind the job was registered with: a Host-registered
+   * `JobKind`, carried as an open string because a browser bundle or a Remote
+   * codec sees only the `JobKindMap` merges its own program compiles.
+   */
+  readonly kind: string
+  /** The producer-supplied one-line label. */
+  readonly label: string
+  /** Owning session; absent for an unowned job, which every caller can see. */
+  readonly owner?: SessionId
+  /** Producer-owned cap for complete model-facing notices and reads, in UTF-8 bytes. */
+  readonly outputLimitBytes?: number
+  /** Current lifecycle state. */
+  readonly status: JobStatus
+  /** The producer's live progress line (`3/10`, the current phase); cleared at settlement. */
+  readonly progress?: string
+  /** Terminal reason (`exit code: 3`); a recorded kill reason is merged in. */
+  readonly detail?: string
+  /** Epoch ms when the job was registered. */
+  readonly startedAt: number
+  /** Epoch ms when the job settled; absent while live. */
+  readonly finishedAt?: number
+  /**
+   * The output ring's absolute coordinates and the complete-stream files
+   * behind it. `total` is the offset the next chunk starts at (0 while
+   * nothing was written); `earliest` is the oldest retained byte, greater
+   * than zero exactly when retention dropped the head. `spillPaths` lists the
+   * spill files the job's pull sources currently keep, in source order and
+   * deduplicated, and is absent while no source keeps one: it outlives any
+   * chunk, so a reader below `earliest` can still name where the bytes went.
+   */
+  readonly output: { readonly total: number; readonly earliest: number; readonly spillPaths?: readonly string[] }
+}
diff --git a/packages/jobs/jobs/tests/invariant.spec.ts b/packages/jobs/jobs/tests/invariant.spec.ts
index 5cbaf94b11..df52f9780f 100644
--- a/packages/jobs/jobs/tests/invariant.spec.ts
+++ b/packages/jobs/jobs/tests/invariant.spec.ts
@@ -1,87 +1,193 @@
 import { describe, expect, it } from 'vitest'
 import { Context } from '@deepseek-ai/cordis'
-import type { Agent } from '@deepseek-ai/dsh-agent'
 import { SessionId } from '@deepseek-ai/dsh-session'
 import JobRegistry, { JobId } from '@deepseek-ai/dsh-jobs'
-import type { JobDoneListener, JobSnapshot } from '@deepseek-ai/dsh-jobs'
+import type { JobEvent, JobEventFilter, JobEventListener, JobView } from '@deepseek-ai/dsh-jobs'
 import * as JobsInvariant from '@deepseek-ai/dsh-jobs/invariant'
 import InvariantRegistry from '@deepseek-ai/dsh-invariants'
 
-const BASE: JobSnapshot = {
-  id: JobId('bash-1'),
-  kind: 'bash',
-  label: 'compile',
-  status: 'completed',
-  startedAt: 10,
-  finishedAt: 20,
-  reported: false,
-}
+const ID = JobId('bash-1')
 
-const RUNNING: JobSnapshot = {
-  id: JobId('bash-1'),
+const RUNNING: JobView = {
+  id: ID,
   kind: 'bash',
   label: 'compile',
   status: 'running',
   startedAt: 10,
-  reported: false,
+  output: { total: 0, earliest: 0 },
 }
 
-const TERMINAL_WITHOUT_FINISH: JobSnapshot = {
-  id: JobId('bash-1'),
-  kind: 'bash',
-  label: 'compile',
-  status: 'completed',
-  startedAt: 10,
-  reported: false,
-}
+const DONE: JobView = { ...RUNNING, status: 'completed', finishedAt: 20 }
 
-async function setup(seed: JobSnapshot[] = []): Promise<(snapshot: unknown, owner?: Agent) => void> {
+/**
+ * A stub registry whose reads come from a map the test edits: the companion
+ * compares every announced projection against these reads.
+ */
+async function setup() {
   const ctx = new Context()
-  let listener: JobDoneListener | undefined
-  const probe = {
-    list: () => seed,
-    onJobDone(value: JobDoneListener) {
-      listener = value
-      return () => { listener = undefined }
-    },
-  } as unknown as JobRegistry
+  const reads = new Map<string, JobView>()
+  let listener: JobEventListener | undefined
+  /** A registry serving only the reads and the subscription the companion uses. */
+  class ProbeRegistry extends JobRegistry {
+    readonly events = {
+      subscribe: (_filter: JobEventFilter, value: JobEventListener): (() => void) => {
+        listener = value
+        return () => { listener = undefined }
+      },
+    }
+    get(id: JobId, caller?: SessionId): JobView {
+      const view = reads.get(String(id))
+      if (view === undefined || view.owner !== caller) throw new Error(`unknown job ${String(id)}`)
+      return view
+    }
+    start(): never { throw new Error('unsupported') }
+    list(): never { throw new Error('unsupported') }
+    read(): never { throw new Error('unsupported') }
+    readAt(): never { throw new Error('unsupported') }
+    kill(): never { throw new Error('unsupported') }
+    wait(): never { throw new Error('unsupported') }
+    attachController(): never { throw new Error('unsupported') }
+  }
   await ctx.plugin(InvariantRegistry)
-  await ctx.plugin({
-    name: 'job-invariant-probe',
-    apply(child: Context) { child.provide('jobs', probe) },
-  })
+  await ctx.plugin(ProbeRegistry)
   await ctx.plugin(JobsInvariant)
-  if (listener === undefined) throw new Error('job invariant did not subscribe to terminal snapshots')
-  return (snapshot, owner) => { listener!(snapshot as JobSnapshot, owner) }
+  if (listener === undefined) throw new Error('job invariant did not subscribe to the event stream')
+  const emit = (event: JobEvent): void => { listener!(event) }
+  const read = (view: JobView | undefined): void => {
+    if (view === undefined) reads.delete(String(ID))
+    else reads.set(String(view.id), view)
+  }
+  return { emit, read }
 }
 
 describe('job-registry invariants', () => {
-  it('accepts coherent current and terminal snapshots', async () => {
-    const notify = await setup([RUNNING])
-    expect(() => { notify(BASE) }).not.toThrow()
-    const owner = { id: SessionId('owner') } as Agent
-    expect(() => { notify({ ...BASE, id: JobId('subagent-2'), kind: 'subagent', ownerSession: owner.id }, owner) })
-      .not.toThrow()
+  it('accepts one job announced from registration to removal, each event agreeing with the read', async () => {
+    const { emit, read } = await setup()
+    read(RUNNING)
+    emit({ type: 'registered', job: RUNNING })
+    read({ ...RUNNING, progress: '1/2' })
+    emit({ type: 'progress', job: { ...RUNNING, progress: '1/2' } })
+    read({ ...RUNNING, progress: '1/2', output: { total: 4, earliest: 0 } })
+    emit({ type: 'output', id: ID, total: 4 })
+    read({ ...RUNNING, status: 'stopping', output: { total: 4, earliest: 0 } })
+    emit({ type: 'stopping', job: { ...RUNNING, status: 'stopping', output: { total: 4, earliest: 0 } } })
+    read({ ...DONE, status: 'killed', output: { total: 4, earliest: 0 } })
+    emit({ type: 'settled', job: { ...DONE, status: 'killed', output: { total: 4, earliest: 0 } }, cause: 'kill' })
+    emit({ type: 'output', id: ID, total: 4 })
+    read(undefined)
+    expect(() => { emit({ type: 'removed', job: { ...DONE, status: 'killed', output: { total: 4, earliest: 0 } } }) }).not.toThrow()
+  })
+
+  it('adopts a job first seen through a later event, so a companion mounted late raises nothing', async () => {
+    const { emit, read } = await setup()
+    read({ ...RUNNING, progress: '3/4' })
+    expect(() => { emit({ type: 'progress', job: { ...RUNNING, progress: '3/4' } }) }).not.toThrow()
+    read(DONE)
+    expect(() => { emit({ type: 'settled', job: DONE, cause: 'producer' }) }).not.toThrow()
+    read(undefined)
+    expect(() => { emit({ type: 'removed', job: DONE }) }).not.toThrow()
+  })
+
+  it('accepts an unowned job read through the unowned view and an owned job through its owner', async () => {
+    const { emit, read } = await setup()
+    const owner = SessionId('owner')
+    const owned: JobView = { ...RUNNING, id: JobId('subagent-2'), kind: 'subagent', owner }
+    read(RUNNING)
+    read(owned)
+    expect(() => { emit({ type: 'registered', job: RUNNING }) }).not.toThrow()
+    expect(() => { emit({ type: 'registered', job: owned }) }).not.toThrow()
+    expect(() => { emit({ type: 'output', id: owned.id, owner, total: 0 }) }).not.toThrow()
   })
 
   it.each([
-    [{ ...BASE, id: JobId('-1'), kind: '' }, undefined, /positive ordinal/],
-    [{ ...BASE, id: JobId('other-1') }, undefined, /must be "bash-" followed by a positive ordinal/],
-    [{ ...BASE, id: JobId('bash-x') }, undefined, /positive ordinal/],
-    [{ ...BASE, id: JobId('bash-0') }, undefined, /positive ordinal/],
-    [{ ...BASE, startedAt: -1 }, undefined, /startedAt must be a non-negative epoch integer/],
-    [{ ...BASE, startedAt: 0.5 }, undefined, /startedAt must be a non-negative epoch integer/],
-    [{ ...BASE, status: 'running' }, undefined, /finishedAt must be present exactly for a terminal status/],
-    [TERMINAL_WITHOUT_FINISH, undefined, /finishedAt must be present exactly for a terminal status/],
-    [{ ...BASE, finishedAt: 9 }, undefined, /no earlier than startedAt/],
-    [{ ...BASE, finishedAt: 20.5 }, undefined, /no earlier than startedAt/],
-    [{ ...BASE, ownerSession: SessionId('recorded') }, { id: SessionId('actual') } as Agent, /does not match its completion owner/],
-  ] as const)('rejects an incoherent registry snapshot', async (snapshot, owner, message) => {
-    const notify = await setup()
-    expect(() => { notify(snapshot, owner) }).toThrow(message)
-  })
-
-  it('rejects an incoherent record already present at installation', async () => {
-    await expect(setup([{ ...BASE, label: '' }])).rejects.toThrow(/label must be non-empty/)
-  })
+    ['registered after an earlier event for the same id', ({ emit, read }) => {
+      read(RUNNING)
+      emit({ type: 'output', id: ID, total: 0 })
+      emit({ type: 'registered', job: RUNNING })
+    }, /registered announced for job bash-1 after earlier events/],
+    ['registered twice', ({ emit, read }) => {
+      read(RUNNING)
+      emit({ type: 'registered', job: RUNNING })
+      emit({ type: 'registered', job: RUNNING })
+    }, /registered announced for job bash-1 after earlier events/],
+    ['registered with a terminal status', ({ emit, read }) => {
+      read(DONE)
+      emit({ type: 'registered', job: DONE })
+    }, /must announce a live status without finishedAt/],
+    ['progress after settlement', ({ emit, read }) => {
+      read(DONE)
+      emit({ type: 'settled', job: DONE, cause: 'producer' })
+      emit({ type: 'progress', job: { ...DONE, progress: 'late' } })
+    }, /progress announced for job bash-1 after its settlement/],
+    ['stopping with a terminal status', ({ emit, read }) => {
+      read(DONE)
+      emit({ type: 'stopping', job: DONE })
+    }, /stopping announced for job bash-1 with a terminal status/],
+    ['settled twice', ({ emit, read }) => {
+      read(DONE)
+      emit({ type: 'settled', job: DONE, cause: 'producer' })
+      emit({ type: 'settled', job: DONE, cause: 'producer' })
+    }, /settled announced twice for job bash-1/],
+    ['settled with a live status', ({ emit, read }) => {
+      read(RUNNING)
+      emit({ type: 'settled', job: { ...RUNNING, finishedAt: 20 }, cause: 'producer' })
+    }, /must announce a terminal status, got "running"/],
+    ['settled without finishedAt', ({ emit, read }) => {
+      read(DONE)
+      emit({ type: 'settled', job: { ...RUNNING, status: 'completed' }, cause: 'producer' })
+    }, /finishedAt no earlier than startedAt/],
+    ['settled before it started', ({ emit, read }) => {
+      read(DONE)
+      emit({ type: 'settled', job: { ...DONE, finishedAt: 9 }, cause: 'producer' })
+    }, /finishedAt no earlier than startedAt/],
+    ['settled with a progress line', ({ emit, read }) => {
+      read(DONE)
+      emit({ type: 'settled', job: { ...DONE, progress: '9/10' }, cause: 'producer' })
+    }, /must announce a cleared progress line/],
+    ['settled while the registry still reads it live', ({ emit, read }) => {
+      read(RUNNING)
+      emit({ type: 'settled', job: DONE, cause: 'producer' })
+    }, /announces completed at 20 while the registry reads running at undefined/],
+    ['removed before settlement', ({ emit, read }) => {
+      read(RUNNING)
+      emit({ type: 'registered', job: RUNNING })
+      read(undefined)
+      emit({ type: 'removed', job: RUNNING })
+    }, /removed announced for job bash-1 before its settlement/],
+    ['removed while the registry still returns the job', ({ emit, read }) => {
+      read(DONE)
+      emit({ type: 'settled', job: DONE, cause: 'producer' })
+      emit({ type: 'removed', job: DONE })
+    }, /removed announced for job bash-1 that the registry still returns/],
+    ['output ahead of the read total', ({ emit, read }) => {
+      read(RUNNING)
+      emit({ type: 'output', id: ID, total: 8 })
+    }, /output announced for job bash-1 at total 8 ahead of the registry's 0/],
+    ['output for a job the registry no longer returns', ({ emit }) => {
+      emit({ type: 'output', id: ID, total: 0 })
+    }, /output announced for job bash-1 that the registry no longer returns/],
+    ['a lifecycle event for a job the registry does not return', ({ emit }) => {
+      emit({ type: 'registered', job: RUNNING })
+    }, /registered announced for job bash-1 that the registry does not return/],
+    ['an announced label the registry does not read', ({ emit, read }) => {
+      read(RUNNING)
+      emit({ type: 'registered', job: { ...RUNNING, label: 'link' } })
+    }, /announces label "link" while the registry reads "compile"/],
+    ['an announced owner the registry does not read', ({ emit, read }) => {
+      read({ ...RUNNING, owner: SessionId('alice') })
+      emit({ type: 'registered', job: { ...RUNNING, owner: SessionId('alice') } })
+      read({ ...RUNNING, owner: SessionId('alice'), startedAt: 11 })
+      emit({ type: 'progress', job: { ...RUNNING, owner: SessionId('alice'), progress: 'x' } })
+    }, /announces startedAt 10 while the registry reads 11/],
+    ['an announced output total ahead of the read', ({ emit, read }) => {
+      read(RUNNING)
+      emit({ type: 'registered', job: { ...RUNNING, output: { total: 2, earliest: 0 } } })
+    }, /announces output total 2 ahead of the registry's 0/],
+  ] as const satisfies readonly (readonly [string, (probe: Awaited<ReturnType<typeof setup>>) => void, RegExp])[])(
+    'rejects %s',
+    async (_name, script, message) => {
+      const probe = await setup()
+      expect(() => { script(probe) }).toThrow(message)
+    },
+  )
 })
diff --git a/packages/jobs/jobs/tests/service.spec.ts b/packages/jobs/jobs/tests/service.spec.ts
index 6e6ef6accb..3b87863c70 100644
--- a/packages/jobs/jobs/tests/service.spec.ts
+++ b/packages/jobs/jobs/tests/service.spec.ts
@@ -1,59 +1,72 @@
 import { describe, expect, it } from 'vitest'
 import { Context } from '@deepseek-ai/cordis'
-import type { Agent } from '@deepseek-ai/dsh-agent'
+import { SessionId } from '@deepseek-ai/dsh-session'
 import { JobId, JobRegistry } from '@deepseek-ai/dsh-jobs'
 import type {
-  JobDoneListener, JobRead, JobSnapshot, JobStart, JobsChangedListener,
+  JobEvent, JobEventFilter, JobEventListener, JobHooks, JobOutputSource, JobOutputRead, JobRead, JobSpec, JobView,
 } from '@deepseek-ai/dsh-jobs'
 
+/** Compile-time probe: does `Shape` carry a `Key` member? */
+type HasKey<Shape, Key extends string> = Key extends keyof Shape ? true : false
+
 /**
- * Minimal concrete registry: one canned record. The Service Definition owns the contract
- * only (ids, snapshots, authorization-shaped signatures); the registry
+ * Minimal concrete registry: one canned row. The Service Definition owns the
+ * contract only (ids, caller-scoped operations, the event stream); the registry
  * behavior suite lives with `@deepseek-ai/dsh-jobs-local`.
  */
 class StubJobRegistry extends JobRegistry {
-  snapshotOf(id: JobId): JobSnapshot {
+  readonly subscriptions: { filter: JobEventFilter; listener: JobEventListener }[] = []
+  readonly started: JobSpec[] = []
+
+  readonly events = {
+    subscribe: (filter: JobEventFilter, listener: JobEventListener): (() => void) => {
+      const entry = { filter, listener }
+      this.subscriptions.push(entry)
+      return () => { this.subscriptions.splice(this.subscriptions.indexOf(entry), 1) }
+    },
+  }
+
+  private view(id: JobId, owner: SessionId | undefined): JobView {
     return {
       id,
       kind: 'bash',
       label: 'sleep 60',
+      ...owner !== undefined ? { owner } : {},
       status: 'running',
       startedAt: 0,
-      reported: false,
+      output: { total: 0, earliest: 0 },
     }
   }
 
-  start(spec: JobStart): JobId {
-    spec.run()
-    return JobId(`${spec.kind}-1`)
+  start(spec: JobSpec): JobId {
+    this.started.push(spec)
+    const id = JobId(`${spec.kind}-1`)
+    spec.run({ id, append() {}, updateProgress() {} })
+    return id
   }
 
-  list(): JobSnapshot[] {
-    return [this.snapshotOf(JobId('bash-1'))]
+  list(caller?: SessionId): JobView[] {
+    return [this.view(JobId('bash-1'), caller)]
   }
 
-  get(id: JobId): JobSnapshot {
-    return this.snapshotOf(id)
+  get(id: JobId, caller?: SessionId): JobView {
+    return this.view(id, caller)
   }
 
-  read(id: JobId): JobRead {
-    return { text: '', snapshot: this.snapshotOf(id) }
+  read(id: JobId, caller?: SessionId): JobRead {
+    return { chunks: [], lossy: false, job: this.view(id, caller) }
   }
 
-  kill(): 'requested' | 'already-finished' {
+  readAt(_id: JobId, from: number): JobOutputRead {
+    return { chunks: [], next: from, lossy: false }
+  }
+
+  kill(): 'requested' {
     return 'requested'
   }
 
-  wait(id: JobId, _timeoutMs: number, _caller?: Agent, _signal?: AbortSignal): Promise<JobSnapshot> {
-    return Promise.resolve(this.snapshotOf(id))
-  }
-
-  onJobDone(_listener: JobDoneListener): () => void {
-    return () => {}
-  }
-
-  onJobsChanged(_listener: JobsChangedListener): () => void {
-    return () => {}
+  wait(id: JobId, _timeoutMs: number, caller?: SessionId): Promise<JobView> {
+    return Promise.resolve(this.view(id, caller))
   }
 
   attachController(_name: string): () => void {
@@ -65,22 +78,63 @@ describe('JobRegistry seam', () => {
   it('a concrete subclass registers as ctx.jobs and serves the abstract API', async () => {
     const ctx = new Context()
     await ctx.plugin(StubJobRegistry)
+    const caller = SessionId('session-1')
+    const hooks: JobHooks = { cancel() {}, done: new Promise(() => {}) }
 
     const detachController = ctx.jobs.attachController('seam-test')
-    const id = ctx.jobs.start({ kind: 'bash', label: 'sleep 60', run: () => ({ cancel() {}, done: new Promise(() => {}) }) })
+    const id = ctx.jobs.start({ kind: 'bash', label: 'sleep 60', owner: caller, run: () => hooks })
     expect(id).toBe('bash-1')
-    expect(ctx.jobs.list()).toHaveLength(1)
-    expect(ctx.jobs.get(id).status).toBe('running')
-    expect(ctx.jobs.read(id).text).toBe('')
-    expect(ctx.jobs.kill(id)).toBe('requested')
-    await expect(ctx.jobs.wait(id, 5)).resolves.toMatchObject({ id })
-    const detachListener = ctx.jobs.onJobDone(() => {})
-    detachListener()
-    const detachChanges = ctx.jobs.onJobsChanged(() => {})
-    detachChanges()
+
+    const jobs = ctx.jobs
+    expect(jobs.list(caller)).toHaveLength(1)
+    expect(jobs.get(id, caller).status).toBe('running')
+    expect(jobs.get(id, caller).owner).toBe(caller)
+    expect(jobs.read(id, caller)).toMatchObject({ chunks: [], lossy: false, job: { id } })
+    expect(jobs.readAt(id, 7, caller)).toEqual({ chunks: [], next: 7, lossy: false })
+    expect(jobs.kill(id, caller, 'seam test')).toBe('requested')
+    await expect(jobs.wait(id, 5, caller)).resolves.toMatchObject({ id })
+    // Omission selects unowned jobs.
+    expect(ctx.jobs.get(id).owner).toBeUndefined()
+
+    const events: JobEvent[] = []
+    const unsubscribe = ctx.jobs.events.subscribe({ owners: 'all' }, (event) => { events.push(event) })
+    unsubscribe()
     detachController()
   })
 
+  it('types every start the same way: one handle, pull sources optional', () => {
+    const hooks: JobHooks = { cancel() {}, done: new Promise(() => {}) }
+    const source: JobOutputSource = {
+      channel: 'stdout',
+      read: fromByte => ({ text: '', nextOffset: fromByte, lossy: false }),
+    }
+    const spec: JobSpec = {
+      kind: 'bash',
+      label: 'x',
+      output: [source],
+      run: (job) => {
+        job.append('lands in the ring', { channel: 'log' })
+        job.updateProgress('1/2')
+        return hooks
+      },
+    }
+    expect(spec.output).toHaveLength(1)
+    // Bookkeeping never reaches the public view, and the record declaration is gone.
+    const viewHasReported: HasKey<JobView, 'reported'> = false
+    const specHasRecord: HasKey<JobSpec, 'record'> = false
+    const hooksHaveReadOutput: HasKey<JobHooks, 'readOutput'> = false
+    expect([viewHasReported, specHasRecord, hooksHaveReadOutput]).toEqual([false, false, false])
+  })
+
+  it('keeps the projection kind an open string, so a program compiling fewer JobKindMap merges accepts every Host kind', () => {
+    // A browser bundle or a generated Remote codec sees only the merges its
+    // own program compiles; a literal union here would reject `pwsh`,
+    // `pty-send`, and every kind another package registers.
+    type KindIsOpenString = string extends JobView['kind'] ? true : false
+    const viewKindOpen: KindIsOpenString = true
+    expect(viewKindOpen).toBe(true)
+  })
+
   it('loading a second implementation throws (one jobs service per context — cordis standard)', async () => {
     const ctx = new Context()
     await ctx.plugin(StubJobRegistry)
diff --git a/packages/jobs/tool-jobs/README.i18n.yaml b/packages/jobs/tool-jobs/README.i18n.yaml
index f7986ed7c0..6185c49fd5 100644
--- a/packages/jobs/tool-jobs/README.i18n.yaml
+++ b/packages/jobs/tool-jobs/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/jobs/tool-jobs/README.md
-README.md: 8f3de4276d766f931f9461d25d15bf33aec26856
-README.zh.md: 83f8fca0cd7e74f4c4687351752bd8c36b002647
+README.md: 1c4c60a32e628963b4751702d522b66b73dae411
+README.zh.md: ff730b7b53d1f45cd2c5004b5d5b1df975ef53c8
diff --git a/packages/jobs/tool-jobs/README.md b/packages/jobs/tool-jobs/README.md
index 8f3de4276d..1c4c60a32e 100644
--- a/packages/jobs/tool-jobs/README.md
+++ b/packages/jobs/tool-jobs/README.md
@@ -25,19 +25,19 @@ Use `dsh-tool-jobs` to inspect and control background commands, PTY work, and su
 <a id="use-this-package"></a>
 ## Use this package
 
-Load this plugin in any composition where the agent should start, observe, and stop background jobs: it registers the three tools, attaches the controller producers need, and delivers completion notices. It requires the `ctx.tools`, `ctx.jobs`, and `ctx.systemPrompt` services from the composed harness.
+Load this plugin in any composition where the agent should start, observe, and stop background jobs: it registers the three tools, attaches the controller producers need, and delivers completion notices. It requires the `ctx.tools`, `ctx.jobs`, and `ctx.systemPrompt` services from the composed harness; completion notices resolve their destination through `ctx.agents`, which every composition with owned jobs already provides.
 
 ### The three tools
 
-- `job_output(job_id, wait?, timeout_ms?)` — Read a job's output. Stream jobs return only the output since the previous read; final-output jobs return their result after settlement. Every response ends with `[status: ...]`. Reads are non-blocking unless `wait: true`, which waits up to the configured cap and leaves a still-running job alive on timeout.
+- `job_output(job_id, wait?, timeout_ms?)` — Read a job's output. Stream jobs return only the output since the previous read; final-output jobs return their result after settlement. Every response ends with `[status: ...]`. Reads are non-blocking unless `wait: true`, which waits up to the configured cap and leaves a still-running job alive on timeout. A read renders stdout first and stderr in one `[stderr]` section, notes output that left memory before the read, and carries a job's result (a subagent's answer) exactly once, on the first read after settlement.
 - `job_list()` — List your background jobs with their ids, kinds, and statuses, one per line: `<id> [<kind>] <status> — <label>`.
 - `job_kill(job_id, reason?)` — Request cancellation of a running job immediately; the job settles as `killed` once its work actually stops. A terminal job returns its current snapshot, and the optional reason is recorded and forwarded to the job.
 
-The three tools return `{ text, job }`, `PublicJobSnapshot[]`, and `{ outcome: 'cancellation-requested' | 'already-finished', job }` respectively. A public snapshot carries id, kind, label, status/detail, and start/finish times and omits ownership and notification bookkeeping. All three render through generic UI cards: `read` for output and list, `execute` for kill.
+The three tools return `{ text, job }`, `PublicJobSnapshot[]`, and `{ outcome: 'cancellation-requested' | 'already-finished', job }` respectively. A public snapshot carries id, kind, label, status with the live progress line or the terminal detail, and start/finish times, and omits ownership and ring offsets. All three render through generic UI cards: `read` for output and list, `execute` for kill.
 
 ### Completion notices
 
-When a job finishes, the owning agent receives `background job <id> (<kind>: <label>) finished [status: ...]. Read its output with job_output.` as an in-session message. A busy agent has the notice injected into its next step — the turn cannot close while the inbox holds it, so several jobs settling together cost one step rather than one turn each. An idle agent is instead woken with a follow-up turn, because an unclaimed notice is a completion the model never learns about. A kill or a terminal read/wait marks the completion reported and suppresses the redundant notice, as does the teardown cancel that drains an owner or the service.
+When a job finishes, the owning agent receives `background job <id> (<kind>: <label>) finished [status: ...]. Read its output with job_output.` as an in-session message. A busy agent has the notice injected into its next step — the turn cannot close while the inbox holds it, so several jobs settling together cost one step rather than one turn each. An idle agent is instead woken with a follow-up turn, because an unclaimed notice is a completion the model never learns about. The plugin keeps its own ledger of what the model already collected: a `job_kill` it accepted and a `wait` that returned the terminal state claim the job, so no redundant notice follows, and a settlement caused by owner or service teardown is skipped because nobody is left to read it.
 
 Waking is bounded: each owner may be woken `maxConsecutiveWakes` times before further notices degrade to injection, and claiming any user-authored message restores the budget. The bound exists because the chain is self-exciting — a woken turn may start the background job whose completion wakes it again. `completionDelivery: quiet` keeps even idle owners on the injection lane, which deterministic transcripts need.
 
@@ -82,7 +82,8 @@ This section explains the design decisions behind the tools and points at the co
 
 | File | Role |
 |---|---|
-| [`src/index.ts`](src/index.ts) | Plugin entry: tool registrations, completion listener, prompt section, output capping |
+| [`src/index.ts`](src/index.ts) | Plugin entry: tool registrations, the notice ledger and settlement subscription, prompt section, output capping |
+| [`src/render.ts`](src/render.ts) | Model-facing rendering: the public projection, status lines, and the consuming delta (stdout, `[stderr]` section, dropped-output notice) |
 | — | No runtime invariant companion is published; this model-facing adapter has no independent lifecycle stream; execution relations are owned by the capability seam it calls. |
 
 ### Output capping
@@ -91,7 +92,7 @@ This section explains the design decisions behind the tools and points at the co
 
 ### Notice delivery lanes
 
-`onJobDone` skips jobs already reported or unowned. A `wakeup` delivery opens a turn on an idle owner while the budget lasts, tracked per exact `Agent` in a `WeakMap`; claiming a user-authored message (`agent/inbox/claimed`) resets that owner's budget. A busy owner — or any notice past the budget, or `quiet` delivery — is injected into the next-step inbox instead. Teardown settlements arrive already `reported`, so disposal never spends a model request announcing a notice nobody can read.
+The settlement subscription (`{ owners: 'scope' }`) skips jobs the ledger already claimed, unowned jobs, and teardown settlements, then resolves the agent registered for the owner session. A `wakeup` delivery opens a turn on an idle owner while the budget lasts, tracked per exact `Agent` in a `WeakMap`; claiming a user-authored message (`agent/inbox/claimed`) resets that owner's budget. A busy owner — or any notice past the budget, or `quiet` delivery — is injected into the next-step inbox instead. A wait claims when it starts and withdraws on timeout or abort; a removal drops the ledger entry, so the ledger only ever holds live jobs the model touched.
 
 </details>
 
@@ -153,7 +154,7 @@ Prefix-stable while tool definitions and visibility are unchanged. Registration
 
 #### What the model sees
 
-Reads return output or `(no new output)` followed by `[status: <status>]` and optional detail. An empty list returns `(no background jobs)`. Kill returns `requested cancellation of job <id>` or the existing terminal status. An unreported owned completion uses the notice above.
+Reads return output or `(no new output)` followed by `[status: <status>]` and optional detail. An empty list returns `(no background jobs)`. Kill returns `requested cancellation of job <id>` or the existing terminal status. An owned completion the model has not already collected uses the notice above.
 
 #### Token effect
 
@@ -173,7 +174,7 @@ These limits define when the tools are a poor fit. They are current package cons
 - **A settlement inside the driver's retirement window still strands its notice** — between the turn loop's last inbox check and the driver committing its idle phase the owner still reads as busy, so the notice is injected and nothing wakes. Steering has the same hole; closing it belongs to `agent-loop`.
 - **A spent wake budget is not restored by time** — only user-authored input refills it, so an unattended agent whose budget ran out collects its remaining notices on the next turn something else opens.
 - **A notice pending on an idle owner does not survive that owner's disposal** — the disposal cancel clears the unclaimed inbox, and the log keeps the insert/cancel pair as the record.
-- **Stream reads are single-consumer** — independent observers need another runtime API.
+- **Model reads are single-consumer** — independent observers use the registry's non-consuming `readAt` (the Web client's `job.follow`), not these tools.
 - **Unowned jobs have no session fence** — external callers must supply policy or avoid them.
 
 <a id="dev-note"></a>
diff --git a/packages/jobs/tool-jobs/README.zh.md b/packages/jobs/tool-jobs/README.zh.md
index 83f8fca0cd..ff730b7b53 100644
--- a/packages/jobs/tool-jobs/README.zh.md
+++ b/packages/jobs/tool-jobs/README.zh.md
@@ -25,19 +25,19 @@ kind: "package-reference"
 <a id="use-this-package"></a>
 ## 使用本包
 
-在 agent 需要启动、观察和停止后台任务的任何组合中加载本插件：它注册三个工具、附加生产方所需的控制器，并投递完成通知。它需要组合中已提供的 `ctx.tools`、`ctx.jobs` 与 `ctx.systemPrompt` 服务。
+在 agent 需要启动、观察和停止后台任务的任何组合中加载本插件：它注册三个工具、附加生产方所需的控制器，并投递完成通知。它需要组合中已提供的 `ctx.tools`、`ctx.jobs` 与 `ctx.systemPrompt` 服务；完成通知经 `ctx.agents` 解析投递目标，凡有归属任务的组合都已提供它。
 
 ### 三个工具
 
-- `job_output(job_id, wait?, timeout_ms?)`——读取任务输出。流任务只返回自上次读取以来的输出；最终输出任务在结算后返回其结果。每个响应都以 `[status: ...]` 结尾。除非 `wait: true`，否则读取是非阻塞的；`wait: true` 最多等待到配置上限，超时时仍让运行中的任务保持存活。
+- `job_output(job_id, wait?, timeout_ms?)`——读取任务输出。流任务只返回自上次读取以来的输出；最终输出任务在结算后返回其结果。每个响应都以 `[status: ...]` 结尾。除非 `wait: true`，否则读取是非阻塞的；`wait: true` 最多等待到配置上限，超时时仍让运行中的任务保持存活。一次读取先渲染 stdout，再把 stderr 放进一段 `[stderr]`，标注读取前已离开内存的输出，并在结算后的第一次读取恰好携带一次任务的结果（subagent 的回答）。
 - `job_list()`——列出你的后台任务及其 id、kind 与状态，每行一个：`<id> [<kind>] <status> — <label>`。
 - `job_kill(job_id, reason?)`——立即请求取消运行中的任务；任务在其工作真正停止后以 `killed` 结算。终止任务返回其当前快照，可选的原因会被记录并转发给任务。
 
-三个工具依次返回 `{ text, job }`、`PublicJobSnapshot[]` 与 `{ outcome: 'cancellation-requested' | 'already-finished', job }`。公共快照携带 id、kind、label、status/detail 及开始／结束时间，并省略归属与通知簿记字段。三个工具都通过通用 UI 卡片渲染：output 和 list 用 `read`，kill 用 `execute`。
+三个工具依次返回 `{ text, job }`、`PublicJobSnapshot[]` 与 `{ outcome: 'cancellation-requested' | 'already-finished', job }`。公共快照携带 id、kind、label、带实时进度行或终态 detail 的状态，以及开始／结束时间，并省略归属与环偏移。三个工具都通过通用 UI 卡片渲染：output 和 list 用 `read`，kill 用 `execute`。
 
 ### 完成通知
 
-任务完成时，拥有它的 agent 会收到会话内消息 `background job <id> (<kind>: <label>) finished [status: ...]. Read its output with job_output.`。繁忙的 agent 会在下一步收到注入的通知——inbox 尚有内容时轮次无法结束，因此同时结算的多个任务只花掉一步，而不是各占一轮。空闲的 agent 则被一个 follow-up 轮次唤醒，因为无人领取的通知等于模型永远不会知道的完成。kill 或针对终止任务的 read/wait 会把完成标为已报告并抑制重复通知；排空 owner 或服务的 teardown 取消同样如此。
+任务完成时，拥有它的 agent 会收到会话内消息 `background job <id> (<kind>: <label>) finished [status: ...]. Read its output with job_output.`。繁忙的 agent 会在下一步收到注入的通知——inbox 尚有内容时轮次无法结束，因此同时结算的多个任务只花掉一步，而不是各占一轮。空闲的 agent 则被一个 follow-up 轮次唤醒，因为无人领取的通知就是模型永远不会知道的完成。插件自己记着模型已经收走了什么：被接受的 `job_kill` 与返回终态的 `wait` 会认领该任务，之后不再有多余通知；所有者或服务 teardown 导致的结算会被跳过，因为没有人能读它。
 
 唤醒是有界的：每个所有者最多可被唤醒 `maxConsecutiveWakes` 次，此后的通知降级为注入；领取任何用户撰写的消息都会恢复预算。设界是因为这条链会自激——被唤醒的一轮可能启动某个后台任务，而它的完成又会唤醒同一个所有者。`completionDelivery: quiet` 让空闲所有者也在注入通道上，确定性 transcript（文本记录）需要的正是这一点。
 
@@ -82,8 +82,9 @@ kind: "package-reference"
 
 | 文件 | 职责 |
 |---|---|
-| [`src/index.ts`](src/index.ts) | 插件入口：工具注册、完成监听器、提示词区段、输出上限 |
-| — | 不发布运行时不变式伴生入口；这个面向模型的适配器没有独立的生命周期流；执行关系归其调用的能力 seam 所有。 |
+| [`src/index.ts`](src/index.ts) | 插件入口：工具注册、播报台账与结算订阅、提示词区段、输出上限 |
+| [`src/render.ts`](src/render.ts) | 面向模型的渲染：公共投影、状态行与消耗式增量（stdout、`[stderr]` 段、丢失输出提示） |
+| — | 不发布运行时不变式伴生入口；执行关系归能力 seam 所有。 |
 
 ### 输出上限
 
@@ -91,7 +92,7 @@ kind: "package-reference"
 
 ### 通知投递通道
 
-`onJobDone` 跳过已报告或无所有者的任务。`wakeup` 投递在预算内为空闲所有者开启一轮，按确切 `Agent` 记录在 `WeakMap` 中；领取用户撰写的消息（`agent/inbox/claimed`）会重置该所有者的预算。繁忙的所有者——或超出预算的任何通知，以及 `quiet` 投递——改为注入 next-step inbox。teardown 结算抵达时已标记为 `reported`，因此释放永远不会花一次模型请求来宣布无人能读的通知。
+结算订阅（`{ owners: 'scope' }`）跳过台账已认领的任务、无所有者的任务与 teardown 结算，然后解析登记在拥有者会话下的 agent。`wakeup` 投递在预算内为空闲所有者开启一轮，按确切 `Agent` 记录在 `WeakMap` 中；领取用户撰写的消息（`agent/inbox/claimed`）会重置该所有者的预算。繁忙的所有者——或超出预算的任何通知，以及 `quiet` 投递——改为注入 next-step inbox。等待在开始时认领、在超时或中止时撤回；移除会删除台账条目，因此台账只保有模型触碰过的存活任务。
 
 </details>
 
@@ -153,7 +154,7 @@ Track every background job id you start. You are notified in-session when a job
 
 #### 模型看到什么
 
-读取会返回输出或 `(no new output)`，随后是 `[status: <status>]` 和可选 detail。空列表返回 `(no background jobs)`。kill 返回 `requested cancellation of job <id>` 或现有终止状态。尚未报告且有所有者归属的完成使用上述通知。
+读取会返回输出或 `(no new output)`，随后是 `[status: <status>]` 和可选 detail。空列表返回 `(no background jobs)`。kill 返回 `requested cancellation of job <id>` 或现有终止状态。模型尚未收走且有所有者归属的完成使用上述通知。
 
 #### Token 影响
 
@@ -173,7 +174,7 @@ Track every background job id you start. You are notified in-session when a job
 - **落在 driver 退休窗口内的结算仍会让通知搁浅**——在轮次循环最后一次检查 inbox 与 driver 提交 idle 相位之间，所有者读起来仍是繁忙，因此通知走注入且无人唤醒。steering（中途引导）存在同样的问题；修复它属于 `agent-loop`。
 - **已花掉的唤醒预算不会随时间恢复**——只有用户撰写的输入才能补充，因此预算耗尽的无人值守 agent 要等到其他原因开启下一轮时才收走剩余通知。
 - **待领于空闲所有者的通知无法在该所有者释放后存活**——释放时的取消会清空未领取的 inbox，日志保留插入/取消这一对作为记录。
-- **流读取只有单一消费方**——独立观察者需要另一套运行时 API。
+- **模型读取只有单一消费方**——独立观察者使用注册表非消耗的 `readAt`（Web 客户端的 `job.follow`），而不是这些工具。
 - **无 owner 的任务没有会话隔离**——外部调用方必须提供策略或避开这些任务。
 
 <a id="dev-note"></a>
diff --git a/packages/jobs/tool-jobs/src/index.ts b/packages/jobs/tool-jobs/src/index.ts
index 210005be6a..cd75bb3a8b 100644
--- a/packages/jobs/tool-jobs/src/index.ts
+++ b/packages/jobs/tool-jobs/src/index.ts
@@ -1,9 +1,10 @@
 /**
  * Model-facing `job_output`, `job_list`, and `job_kill` tools over
  * `ctx.jobs`. Loading the plugin attaches the controller required by
- * producers. It also delivers unreported completions to the owning agent:
- * injected into a busy owner's next step, or opening a turn on an idle one
- * under the default `wakeup` delivery, bounded per owner.
+ * producers. It also delivers completions the model has not already
+ * collected to the owning agent: injected into a busy owner's next step, or
+ * opening a turn on an idle one under the default `wakeup` delivery, bounded
+ * per owner.
  * @module @deepseek-ai/dsh-tool-jobs
  */
 
@@ -15,8 +16,11 @@ import { TextRetainer } from '@deepseek-ai/dsh-output-retention'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import type { GenericCallView, ToolDefinition, ToolExecution } from '@deepseek-ai/dsh-tools'
 import { JobId } from '@deepseek-ai/dsh-jobs'
-import type { JobSnapshot } from '@deepseek-ai/dsh-jobs'
+import type { JobView, JobRead } from '@deepseek-ai/dsh-jobs'
 import type { Agent } from '@deepseek-ai/dsh-agent'
+import type {} from '@deepseek-ai/dsh-agent'
+import { publicJob, renderModelDelta, statusLine } from './render.ts'
+import type { PublicJobSnapshot } from './render.ts'
 declare module '@deepseek-ai/dsh-llm' {
   interface MessageSourceMap {
     'tool-jobs': { kind: 'tool-jobs' } & ContextFormed
@@ -27,12 +31,23 @@ export const name = 'tool-jobs'
 export const inject = ['tools', 'jobs', 'systemPrompt']
 
 /**
- * How an unreported completion reaches an owner that is already idle: `wakeup`
+ * How an uncollected completion reaches an owner that is already idle: `wakeup`
  * opens a turn for it, `quiet` leaves it pending until something else wakes the
  * owner. A busy owner is injected either way.
  */
 export type CompletionDelivery = 'quiet' | 'wakeup'
 
+/**
+ * One model touch of a live job's settlement: a wait in flight or a kill the
+ * model requested. `live` says whether the tool result that made the claim
+ * will still carry the settlement; a wait's claim dies the moment its caller
+ * aborts, before the registry's rejection reaches the tool.
+ */
+interface Claim {
+  readonly id: JobId
+  live: boolean
+}
+
 /** Configures bounded `job_output` waits and completion-notice delivery. */
 export interface Config {
   /** Wait duration applied when `job_output` sets `wait` without `timeout_ms` (default 30s). */
@@ -57,17 +72,6 @@ export const Config: z<Config> = z.object({
   maxConsecutiveWakes: z.number().min(1).default(3),
 })
 
-/** Task state safe for model-authored programs; ownership/bookkeeping fields are omitted. */
-export interface PublicJobSnapshot {
-  id: string
-  kind: string
-  label: string
-  status: JobSnapshot['status']
-  detail?: string
-  startedAt: number
-  finishedAt?: number
-}
-
 /** Shared schema for job-control outputs. */
 const PUBLIC_JOB_SCHEMA = {
   type: 'object',
@@ -87,30 +91,6 @@ const PUBLIC_JOB_SCHEMA = {
   },
 } as const
 
-/** Remove job ownership and notification bookkeeping from a registry snapshot. */
-function publicJob(snapshot: JobSnapshot): PublicJobSnapshot {
-  return {
-    id: snapshot.id,
-    kind: snapshot.kind,
-    label: snapshot.label,
-    status: snapshot.status,
-    ...snapshot.detail !== undefined ? { detail: snapshot.detail } : {},
-    startedAt: snapshot.startedAt,
-    ...snapshot.finishedAt !== undefined ? { finishedAt: snapshot.finishedAt } : {},
-  }
-}
-
-/**
- * Render generic status with optional producer detail.
- * @param snapshot - job state to render.
- * @returns a bracketed status line.
- */
-export function statusLine(snapshot: Pick<JobSnapshot, 'status' | 'detail'>): string {
-  return snapshot.detail !== undefined
-    ? `[status: ${snapshot.status}, ${snapshot.detail}]`
-    : `[status: ${snapshot.status}]`
-}
-
 const encoder = new TextEncoder()
 
 function retainTail(text: string, maxBytes: number): string {
@@ -141,19 +121,19 @@ function fitWithSuffix(
 
 /**
  * One-line account of a settled job for the `notice` form's collapsed row.
- * @param snapshot - the settled job.
+ * @param job - the settled job.
  * @returns its kind, label, and status, bounded like every notice summary.
  */
-function completionSummary(snapshot: JobSnapshot): string {
-  return boundContextSummary(`${snapshot.kind} ${snapshot.label} ${statusLine(snapshot)}`)
+function completionSummary(job: JobView): string {
+  return boundContextSummary(`${job.kind} ${job.label} ${statusLine(publicJob(job))}`)
 }
 
-function fitCompletionNotice(snapshot: JobSnapshot): string {
-  const prefix = `background job ${snapshot.id}`
-  const detail = ` (${snapshot.kind}: ${snapshot.label}) finished ${statusLine(snapshot)}`
+function fitCompletionNotice(job: JobView): string {
+  const prefix = `background job ${job.id}`
+  const detail = ` (${job.kind}: ${job.label}) finished ${statusLine(publicJob(job))}`
   const action = '\nDone; job_output.'
   const complete = `${prefix}${detail}. Read its output with job_output.`
-  const maxBytes = snapshot.outputLimitBytes
+  const maxBytes = job.outputLimitBytes
   if (maxBytes === undefined || encoder.encode(complete).byteLength <= maxBytes) return complete
   const omitted = '\n[notice truncated]'
   const fixed = `${prefix}${omitted}${action}`
@@ -187,11 +167,12 @@ function boundSingleText(content: readonly ContentBlock[], maxBytes: number): Co
   }]
 }
 
+/** The producer's cap for the job a `job_output` or `job_kill` call names, when it is visible to the caller. */
 function visibleOutputLimit(ctx: Context, exec: ToolExecution): number | undefined {
   if (exec.name !== 'job_output' && exec.name !== 'job_kill') return undefined
   const jobId = (exec.arguments as { job_id?: unknown } | null | undefined)?.job_id
   if (typeof jobId !== 'string' || jobId.length === 0) return undefined
-  return ctx.jobs.list(exec.agent).find(snapshot => snapshot.id === jobId)?.outputLimitBytes
+  return ctx.jobs.list(exec.agent?.id).find(job => job.id === jobId)?.outputLimitBytes
 }
 
 /** Validate the non-empty constraint that ParameterSchemaSpec cannot express. */
@@ -207,6 +188,20 @@ function presentJobCall(title: string, kind: 'read' | 'execute', rawInput?: stri
   return { card: 'generic', title, kind, ...rawInput !== undefined ? { rawInput } : {} }
 }
 
+/** True for the three terminal statuses. */
+function isTerminal(job: JobView): boolean {
+  return job.status === 'completed' || job.status === 'killed' || job.status === 'failed'
+}
+
+/** The consuming read as the model sees it: the delta, then the result once, then the status line. */
+function readBody(read: JobRead): { text: string; job: PublicJobSnapshot } {
+  const delta = renderModelDelta(read.chunks, read.lossy, read.job.output.spillPaths ?? [])
+  const text = read.result === undefined
+    ? delta
+    : `${delta}${delta.length > 0 && !delta.endsWith('\n') ? '\n' : ''}${read.result}`
+  return { text, job: publicJob(read.job) }
+}
+
 export function apply(ctx: Context, config: Config): void {
   const waitDefault = config.waitTimeoutMs ?? 30_000
   const waitCap = config.maxWaitTimeoutMs ?? 600_000
@@ -271,27 +266,62 @@ export function apply(ctx: Context, config: Config): void {
     text: 'Track every background job id you start. You are notified in-session when a job finishes — do not busy-poll or sleep on one; keep working on independent steps and do not duplicate a running job\'s work. Before giving a final answer, collect every still-relevant job with job_output (set wait: true only when you are genuinely blocked on it), and job_kill jobs that stopped mattering.',
   })
 
-  // Use the exact lifecycle owner; reusable ids could resolve to a replacement.
+  // Jobs whose terminal state this plugin already handed to the model through
+  // a tool result: a terminal `job_output`, a wait that returned it, or a
+  // `job_kill` it requested. A wait claims when it starts, not when it
+  // returns — settlement releases waiters before it announces, but their
+  // continuations run after the event. Each call holds its own claim, so a
+  // timed-out wait drops only its own while a concurrent wait on the same job
+  // keeps the settlement covered. The settlement event drops every claim on
+  // the job, so the ledger holds only live jobs the model already touched.
+  const claims = new Set<Claim>()
+  const claim = (id: JobId): Claim => {
+    const entry: Claim = { id, live: true }
+    claims.add(entry)
+    return entry
+  }
+  // Drop every claim on the job; true when one of them still covered the settlement.
+  const settleClaims = (id: JobId): boolean => {
+    let covered = false
+    for (const entry of claims) {
+      if (entry.id !== id) continue
+      claims.delete(entry)
+      if (entry.live) covered = true
+    }
+    return covered
+  }
+
   // A busy owner is injected: the notice waits in its next-step inbox, which
   // the turn cannot close over, so jobs settling together cost one step. An
   // idle owner is woken instead, because an unclaimed notice is a completion
   // the model never learns about. Either way, disposal before the claim
-  // discards it with the owner, and teardown settlements arrive `reported`.
+  // discards it with the owner, and a teardown settlement has no reader left.
   //
-  // The registry routes each settlement to the listeners its owner's scope
-  // chain reaches, so a mount under one preset never sees another preset's
-  // agents; this listener owns delivery, not the choice of whom to deliver to.
-  ctx.jobs.onJobDone((snapshot, owner) => {
-    if (snapshot.reported || owner === undefined) return
+  // The registry routes each settlement to the scope this plugin was mounted
+  // under, so a mount under one preset never sees another preset's agents;
+  // this listener owns delivery, not the choice of whom to deliver to.
+  ctx.jobs.events.subscribe({ owners: 'scope' }, (event) => {
+    if (event.type === 'removed') {
+      settleClaims(event.job.id)
+      return
+    }
+    if (event.type !== 'settled') return
+    const claimed = settleClaims(event.job.id)
+    if (claimed || event.cause === 'teardown' || event.job.owner === undefined) return
+    // The destination is the agent registered for the owner session now. An
+    // owned job needed the agent registry to start, so the registry is only
+    // absent here when it left before settlement — and then no inbox is left.
+    const owner = ctx.get('agents')?.get(event.job.owner)
+    if (owner === undefined) return
     const message = createUserMessage({
       content: [{
         type: 'text',
-        text: fitCompletionNotice(snapshot),
+        text: fitCompletionNotice(event.job),
       }],
       source: {
         kind: 'tool-jobs',
         form: 'notice',
-        summary: completionSummary(snapshot),
+        summary: completionSummary(event.job),
       },
     })
     const spent = spentWakes.get(owner) ?? 0
@@ -333,12 +363,30 @@ export function apply(ctx: Context, config: Config): void {
     },
     async execute(args, exec) {
       const id = validateJobId(args.job_id)
+      const jobs = ctx.jobs
       if (args.wait === true) {
         const timeout = Math.min(args.timeout_ms ?? waitDefault, waitCap)
-        await ctx.jobs.wait(id, timeout, exec.agent, exec.signal)
+        const entry = claim(id)
+        // The registry rejects an aborted wait on a later microtask, and a
+        // settlement announced in between must not find this claim live: the
+        // tool result carries the abort, so the notice is the model's only
+        // completion record. ToolRuntime never dispatches an aborted call, so
+        // the listener covers every abort. A timeout needs no such guard —
+        // the registry resolves it from a timer callback, and the wait's
+        // continuation runs before anything else can settle the job.
+        const abandon = (): void => { entry.live = false }
+        exec.signal.addEventListener('abort', abandon, { once: true })
+        try {
+          const view = await jobs.wait(id, timeout, exec.agent?.id, exec.signal)
+          if (!isTerminal(view)) claims.delete(entry)
+        } catch (error: unknown) {
+          claims.delete(entry)
+          throw error
+        } finally {
+          exec.signal.removeEventListener('abort', abandon)
+        }
       }
-      const read = ctx.jobs.read(id, exec.agent)
-      return { text: read.text, job: publicJob(read.snapshot) }
+      return readBody(jobs.read(id, exec.agent?.id))
     },
     presentCall: args => presentJobCall(`Read output from background job ${args.job_id}`, 'read', args.job_id),
   }))
@@ -357,7 +405,7 @@ export function apply(ctx: Context, config: Config): void {
       }],
     },
     execute(_args, exec) {
-      const jobs = ctx.jobs.list(exec.agent)
+      const jobs = ctx.jobs.list(exec.agent?.id)
       return Promise.resolve(jobs.map(publicJob))
     },
     presentCall: () => presentJobCall('List background jobs', 'read'),
@@ -393,12 +441,16 @@ export function apply(ctx: Context, config: Config): void {
     },
     execute(args, exec) {
       const id = validateJobId(args.job_id)
-      const result = ctx.jobs.kill(id, exec.agent, args.reason)
-      // A snapshot describes current state without consuming pending output.
-      const snapshot = publicJob(ctx.jobs.get(id, exec.agent))
+      const jobs = ctx.jobs
+      const result = jobs.kill(id, exec.agent?.id, args.reason)
+      // The model's own kill is its delivery: the settlement notice would only
+      // repeat what this tool result already said.
+      if (result === 'requested') claim(id)
+      // A projection describes current state without consuming pending output.
+      const job = publicJob(jobs.get(id, exec.agent?.id))
       return Promise.resolve({
         outcome: result === 'already-finished' ? 'already-finished' as const : 'cancellation-requested' as const,
-        job: snapshot,
+        job,
       })
     },
     presentCall: args => presentJobCall(`Kill background job ${args.job_id}`, 'execute', args.job_id),
diff --git a/packages/jobs/tool-jobs/src/render.ts b/packages/jobs/tool-jobs/src/render.ts
new file mode 100644
index 0000000000..b95eb4393b
--- /dev/null
+++ b/packages/jobs/tool-jobs/src/render.ts
@@ -0,0 +1,84 @@
+/**
+ * Model-facing rendering of registry reads: the consuming delta as the
+ * shell tools have always shown it (stdout, then one marked stderr section),
+ * the `[status: …]` line, and the public job projection the tool schemas
+ * expose.
+ * @module @deepseek-ai/dsh-tool-jobs/render
+ */
+
+import type { JobChunk, JobView } from '@deepseek-ai/dsh-jobs/view'
+
+/** Job state safe for model-authored programs; ownership and offsets are omitted. */
+export interface PublicJobSnapshot {
+  id: string
+  kind: string
+  label: string
+  status: JobView['status']
+  /** The live progress line while running, the terminal reason once settled. */
+  detail?: string
+  startedAt: number
+  finishedAt?: number
+}
+
+/**
+ * The one-line qualifier the model reads beside a status: live progress while
+ * the job runs, the terminal reason once it settled.
+ * @param job - the job projection.
+ * @returns the qualifier, or undefined when the job carries neither.
+ */
+export function jobDetail(job: Pick<JobView, 'progress' | 'detail'>): string | undefined {
+  return job.progress ?? job.detail
+}
+
+/**
+ * Remove ownership, offsets, and limits from a registry projection.
+ * @param job - the registry projection.
+ * @returns the model-safe projection.
+ */
+export function publicJob(job: JobView): PublicJobSnapshot {
+  const detail = jobDetail(job)
+  return {
+    id: job.id,
+    kind: job.kind,
+    label: job.label,
+    status: job.status,
+    ...detail !== undefined ? { detail } : {},
+    startedAt: job.startedAt,
+    ...job.finishedAt !== undefined ? { finishedAt: job.finishedAt } : {},
+  }
+}
+
+/**
+ * Render generic status with optional detail.
+ * @param snapshot - job state to render.
+ * @returns a bracketed status line.
+ */
+export function statusLine(snapshot: Pick<PublicJobSnapshot, 'status' | 'detail'>): string {
+  return snapshot.detail !== undefined
+    ? `[status: ${snapshot.status}, ${snapshot.detail}]`
+    : `[status: ${snapshot.status}]`
+}
+
+/**
+ * Render one consuming read for the model: stdout and unlabeled chunks in
+ * order, then every stderr chunk in one `[stderr]` section, exactly as the
+ * shell tools render a foreground result. `log` chunks are producer
+ * narration for observers and never reach the model. Lost bytes — the cursor
+ * fell behind the ring's retention, or a model-visible chunk carries a
+ * producer-side gap — end the read with the shell tools' dropped-output
+ * notice, naming the spill files the job's sources keep.
+ * @param chunks - the chunks since the model cursor, in offset order.
+ * @param lossy - whether bytes before `chunks` were evicted unread.
+ * @param spillPaths - the complete-stream files the job currently advertises (`JobView.output.spillPaths`).
+ * @returns the delta text, possibly empty.
+ */
+export function renderModelDelta(chunks: readonly JobChunk[], lossy: boolean, spillPaths: readonly string[]): string {
+  const visible = chunks.filter(chunk => chunk.channel !== 'log')
+  const out = visible.filter(chunk => chunk.channel !== 'stderr').map(chunk => chunk.text).join('')
+  const err = visible.filter(chunk => chunk.channel === 'stderr').map(chunk => chunk.text).join('')
+  const separator = out.length > 0 && !out.endsWith('\n') ? '\n' : ''
+  const body = out + (err.length > 0 ? `${separator}[stderr]\n${err}` : '')
+  if (!lossy && !visible.some(chunk => chunk.gapBefore === true)) return body
+  const notice = `[some output was dropped from memory; full output: ${spillPaths.length > 0 ? spillPaths.join(', ') : '(unavailable)'}]`
+  return `${body}${body.length > 0 && !body.endsWith('\n') ? '\n' : ''}${notice}`
+}
diff --git a/packages/jobs/tool-jobs/tests/tool-jobs.spec.ts b/packages/jobs/tool-jobs/tests/tool-jobs.spec.ts
index f7c543c024..f9ffa2a8b4 100644
--- a/packages/jobs/tool-jobs/tests/tool-jobs.spec.ts
+++ b/packages/jobs/tool-jobs/tests/tool-jobs.spec.ts
@@ -10,21 +10,26 @@ import { SessionId } from '@deepseek-ai/dsh-session'
 import { bindScopeParent, createScope, scopeOf } from '@deepseek-ai/dsh-scope'
 import { JobId } from '@deepseek-ai/dsh-jobs'
 import LocalJobRegistry from '@deepseek-ai/dsh-jobs-local'
-import type { JobHooks, JobOutcome, JobSnapshot, JobStart } from '@deepseek-ai/dsh-jobs'
+import type { JobAppendOptions, JobHandle, JobHooks, JobOutcome, JobOutputSource, JobSpec, JobView } from '@deepseek-ai/dsh-jobs'
 import * as ToolJobs from '@deepseek-ai/dsh-tool-jobs'
-import { statusLine } from '@deepseek-ai/dsh-tool-jobs'
+import { publicJob, renderModelDelta, statusLine } from '../src/render.ts'
 
 const testToolSignal = new AbortController().signal
 
 const agentRegistryDisposers = new WeakMap<Agent, () => Promise<void>>()
 const agentScopeFibers = new WeakMap<Agent, { dispose: () => Promise<void> }>()
 
-async function setup(config: ToolJobs.Config = {}) {
+/** Registry knobs a test may narrow; every producer here pushes, so the pump stays idle. */
+interface RegistryConfig {
+  retainBytes?: number
+}
+
+async function setup(config: ToolJobs.Config = {}, registry: RegistryConfig = {}) {
   const ctx = new Context()
   await ctx.plugin(SystemPrompt)
   await ctx.plugin(ToolRuntime)
   const agentsFiber = await ctx.plugin(AgentRegistry)
-  await ctx.plugin(LocalJobRegistry)
+  await ctx.plugin(LocalJobRegistry, registry)
   const toolsFiber = await ctx.plugin(ToolJobs, config)
   return { ctx, agentsFiber, toolsFiber }
 }
@@ -70,9 +75,13 @@ async function disposeAgentScope(agent: Agent): Promise<void> {
   await fiber.dispose()
 }
 
-/** A controllable producer start-spec (settle `done` on demand, record cancels). */
-function producer(overrides: Partial<Omit<JobStart, 'run'> & JobHooks> = {}) {
+/**
+ * A controllable producer spec: pushes output and progress through the handle
+ * the registry hands its starter, settles `done` on demand, records cancels.
+ */
+function producer(overrides: Partial<Omit<JobSpec, 'run' | 'output'> & JobHooks> = {}) {
   let settle!: (outcome: JobOutcome) => void
+  let handle: JobHandle | undefined
   const cancels: (string | undefined)[] = []
   const { kind = 'bash', label = 'sleep 60', owner, outputLimitBytes, ...hookOverrides } = overrides
   const hooks: JobHooks = {
@@ -80,14 +89,24 @@ function producer(overrides: Partial<Omit<JobStart, 'run'> & JobHooks> = {}) {
     done: new Promise<JobOutcome>((res) => { settle = res }),
     ...hookOverrides,
   }
-  const spec: JobStart = {
+  const spec: JobSpec = {
     kind,
     label,
     ...owner !== undefined ? { owner } : {},
     ...outputLimitBytes !== undefined ? { outputLimitBytes } : {},
-    run: () => hooks,
+    run: (job) => { handle = job; return hooks },
+  }
+  const started = (): JobHandle => {
+    if (handle === undefined) throw new Error('producer not started')
+    return handle
+  }
+  return {
+    spec,
+    settle,
+    cancels,
+    append: (text: string, options?: JobAppendOptions) => { started().append(text, options) },
+    progress: (line: string) => { started().updateProgress(line) },
   }
-  return { spec, settle, cancels }
 }
 
 let callCounter = 0
@@ -104,7 +123,7 @@ const tick = () => new Promise<void>(r => setTimeout(r, 0))
 /** Start and settle `count` owned jobs one at a time, letting each notice land. */
 async function settleTasks(ctx: Context, owner: Agent, count: number): Promise<void> {
   for (let i = 0; i < count; i += 1) {
-    const p = producer({ owner })
+    const p = producer({ owner: owner.id })
     ctx.jobs.start(p.spec)
     p.settle({ status: 'completed' })
     await tick()
@@ -119,10 +138,26 @@ describe('tool-jobs setup', () => {
     expect(() => ctx.jobs.start(producer().spec)).toThrow('no job controller serves this agent')
   })
 
+  it('serves unowned jobs in a composition without an agent registry', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SystemPrompt)
+    await ctx.plugin(ToolRuntime)
+    await ctx.plugin(LocalJobRegistry)
+    await ctx.plugin(ToolJobs)
+    const p = producer()
+    ctx.jobs.start(p.spec)
+    p.append('open\n')
+    expect(text(await call(ctx, 'job_output', { job_id: 'bash-1' }))).toBe('open\n[status: running]')
+    p.settle({ status: 'completed' })
+    await tick()
+    expect(text(await call(ctx, 'job_list', {}))).toBe('bash-1 [bash] completed — sleep 60')
+  })
+
   it('rejects a config whose default wait exceeds the cap', async () => {
     const ctx = new Context()
     await ctx.plugin(SystemPrompt)
     await ctx.plugin(ToolRuntime)
+    await ctx.plugin(AgentRegistry)
     await ctx.plugin(LocalJobRegistry)
     await expect(ctx.plugin(ToolJobs, { waitTimeoutMs: 100, maxWaitTimeoutMs: 50 }))
       .rejects.toThrow('waitTimeoutMs (100) exceeds maxWaitTimeoutMs (50)')
@@ -141,6 +176,7 @@ describe('tool-jobs setup', () => {
       const ctx = new Context()
       await ctx.plugin(SystemPrompt)
       await ctx.plugin(ToolRuntime)
+      await ctx.plugin(AgentRegistry)
       await ctx.plugin(LocalJobRegistry)
       try {
         await ctx.plugin(ToolJobs, { maxConsecutiveWakes })
@@ -158,9 +194,78 @@ describe('tool-jobs setup', () => {
   })
 
   it('renders status lines with and without producer detail', () => {
-    const base = { id: 'bash-1', kind: 'bash', label: 'x', startedAt: 0, reported: false } as unknown as JobSnapshot
-    expect(statusLine({ ...base, status: 'running' })).toBe('[status: running]')
-    expect(statusLine({ ...base, status: 'completed', detail: 'exit code: 0' })).toBe('[status: completed, exit code: 0]')
+    expect(statusLine({ status: 'running' })).toBe('[status: running]')
+    expect(statusLine({ status: 'completed', detail: 'exit code: 0' })).toBe('[status: completed, exit code: 0]')
+  })
+
+  it('projects the public job: live progress or terminal detail, never ownership or offsets', () => {
+    const live: JobView = {
+      id: JobId('bash-1'), kind: 'bash', label: 'x', owner: SessionId('sess-1'), outputLimitBytes: 8,
+      status: 'running', progress: '3/10 files', startedAt: 5, output: { total: 12, earliest: 0 },
+    }
+    expect(publicJob(live)).toEqual({ id: 'bash-1', kind: 'bash', label: 'x', status: 'running', detail: '3/10 files', startedAt: 5 })
+    const settled: JobView = {
+      id: JobId('bash-1'), kind: 'bash', label: 'x', status: 'completed', detail: 'exit code: 0',
+      startedAt: 5, finishedAt: 9, output: { total: 12, earliest: 0 },
+    }
+    expect(publicJob(settled)).toEqual({ id: 'bash-1', kind: 'bash', label: 'x', status: 'completed', detail: 'exit code: 0', startedAt: 5, finishedAt: 9 })
+  })
+
+  it('renders a model delta as stdout, one stderr section, and a dropped-output notice', () => {
+    expect(renderModelDelta([], false, [])).toBe('')
+    expect(renderModelDelta([], true, [])).toBe('[some output was dropped from memory; full output: (unavailable)]')
+    expect(renderModelDelta([
+      { at: 0, text: 'a' },
+      { at: 1, text: 'e1\n', channel: 'stderr' },
+      { at: 4, text: 'narration', channel: 'log' },
+      { at: 13, text: 'b', channel: 'stdout' },
+      { at: 14, text: 'e2', channel: 'stderr' },
+    ], false, [])).toBe('ab\n[stderr]\ne1\ne2')
+    expect(renderModelDelta([{ at: 0, text: 'tail' }], true, [])).toBe('tail\n[some output was dropped from memory; full output: (unavailable)]')
+    expect(renderModelDelta([{ at: 0, text: 'line\n' }], true, [])).toBe('line\n[some output was dropped from memory; full output: (unavailable)]')
+    // Ring eviction names the files the job's sources keep, whether or not a retained chunk carries a gap.
+    expect(renderModelDelta([{ at: 8, text: 'tail' }], true, ['/spill/out.log', '/spill/err.log']))
+      .toBe('tail\n[some output was dropped from memory; full output: /spill/out.log, /spill/err.log]')
+  })
+
+  it('reports a producer-side gap as dropped output and names the spill files the job advertises', () => {
+    // The ring itself lost nothing (`lossy: false`); the source did, between two pumps.
+    expect(renderModelDelta([{ at: 0, text: 'head' }, { at: 4, text: 'tail', gapBefore: true }], false, ['/spill/out.log']))
+      .toBe('headtail\n[some output was dropped from memory; full output: /spill/out.log]')
+    expect(renderModelDelta([
+      { at: 0, text: 'o', gapBefore: true },
+      { at: 1, text: 'e', channel: 'stderr', gapBefore: true },
+    ], false, ['/spill/out.log', '/spill/err.log'])).toBe('o\n[stderr]\ne\n[some output was dropped from memory; full output: /spill/out.log, /spill/err.log]')
+    // A gap while no source keeps a file yields the generic notice.
+    expect(renderModelDelta([{ at: 0, text: 'tail', gapBefore: true }], false, []))
+      .toBe('tail\n[some output was dropped from memory; full output: (unavailable)]')
+    // A gap on observer-only narration never reaches the model.
+    expect(renderModelDelta([{ at: 0, text: 'phase', channel: 'log', gapBefore: true }], false, ['/spill/log'])).toBe('')
+  })
+
+  it('names the spill file when the ring evicted output the model never read', async () => {
+    const { ctx } = await setup({}, { retainBytes: 8 })
+    const owner = await fakeAgent(ctx, 'sess-1')
+    let settle!: (outcome: JobOutcome) => void
+    // The source never reads lossy: the pump keeps up, and only the ring's live cap drops bytes.
+    const source: JobOutputSource = {
+      channel: 'stdout',
+      read: from => from === 0
+        ? { text: 'x'.repeat(32), nextOffset: 32, lossy: false, spillPath: '/spill/out.log' }
+        : { text: '', nextOffset: from, lossy: false, spillPath: '/spill/out.log' },
+    }
+    ctx.jobs.start({
+      kind: 'bash',
+      label: 'noisy',
+      owner: owner.id,
+      output: [source],
+      run: () => ({ cancel() {}, done: new Promise<JobOutcome>((resolve) => { settle = resolve }) }),
+    })
+
+    expect(text(await call(ctx, 'job_output', { job_id: 'bash-1' }, owner)))
+      .toBe(`${'x'.repeat(8)}\n[some output was dropped from memory; full output: /spill/out.log]\n[status: running]`)
+    settle({ status: 'completed' })
+    await tick()
   })
 
   it('applies the built-in wait bounds when apply() receives a bare config', async () => {
@@ -169,6 +274,7 @@ describe('tool-jobs setup', () => {
     const ctx = new Context()
     await ctx.plugin(SystemPrompt)
     await ctx.plugin(ToolRuntime)
+    await ctx.plugin(AgentRegistry)
     await ctx.plugin(LocalJobRegistry)
     ToolJobs.apply(ctx, {})
     expect(ctx.tools.get('job_output')).toBeDefined()
@@ -179,8 +285,9 @@ describe('tool-jobs setup', () => {
 describe('job_output', () => {
   it('reads a consuming delta with a trailing status line', async () => {
     const { ctx } = await setup()
-    const chunks = ['line one\n', '']
-    ctx.jobs.start(producer({ readOutput: () => chunks.shift() ?? '' }).spec)
+    const p = producer()
+    ctx.jobs.start(p.spec)
+    p.append('line one\n')
 
     // A body already ending in a newline gets no doubled separator.
     const first = await call(ctx, 'job_output', { job_id: 'bash-1' })
@@ -190,29 +297,75 @@ describe('job_output', () => {
       text: 'line one\n',
       job: { id: 'bash-1', kind: 'bash', label: 'sleep 60', status: 'running' },
     })
-    expect(firstValue.job).not.toHaveProperty('ownerSession')
-    expect(firstValue.job).not.toHaveProperty('reported')
+    expect(firstValue.job).not.toHaveProperty('owner')
+    expect(firstValue.job).not.toHaveProperty('output')
     expect(text(first)).toBe('line one\n[status: running]')
     expect(text(await call(ctx, 'job_output', { job_id: 'bash-1' }))).toBe('(no new output)\n[status: running]')
   })
 
-  it('returns the final output of a settled final-output job', async () => {
+  it('renders stderr in a trailing section and never shows log narration', async () => {
+    const { ctx } = await setup()
+    const p = producer()
+    ctx.jobs.start(p.spec)
+    p.append('out\n')
+    p.append('warn\n', { channel: 'stderr' })
+    p.append('observer-only narration', { channel: 'log' })
+    expect(text(await call(ctx, 'job_output', { job_id: 'bash-1' }))).toBe('out\n[stderr]\nwarn\n[status: running]')
+    expect(text(await call(ctx, 'job_output', { job_id: 'bash-1' }))).toBe('(no new output)\n[status: running]')
+  })
+
+  it('shows live progress beside the status until settlement replaces it with the terminal detail', async () => {
+    const { ctx } = await setup()
+    const p = producer()
+    ctx.jobs.start(p.spec)
+    p.progress('3/10 files')
+    expect(text(await call(ctx, 'job_output', { job_id: 'bash-1' }))).toBe('(no new output)\n[status: running, 3/10 files]')
+    p.settle({ status: 'completed', detail: 'exit code: 0' })
+    await tick()
+    expect(text(await call(ctx, 'job_output', { job_id: 'bash-1' }))).toBe('(no new output)\n[status: completed, exit code: 0]')
+  })
+
+  it('flags a read whose cursor fell behind the ring', async () => {
+    const { ctx } = await setup({}, { retainBytes: 16 })
+    const p = producer()
+    ctx.jobs.start(p.spec)
+    p.append('x'.repeat(40))
+    const first = text(await call(ctx, 'job_output', { job_id: 'bash-1' }))
+    expect(first).toContain('[some output was dropped from memory; full output: (unavailable)]')
+    expect(first).toContain('[status: running]')
+    expect(first).not.toContain('x'.repeat(17))
+    // The cursor now sits at the ring's end: the next read is clean.
+    expect(text(await call(ctx, 'job_output', { job_id: 'bash-1' }))).toBe('(no new output)\n[status: running]')
+  })
+
+  it('returns the result of a settled job exactly once, after the pending delta', async () => {
     const { ctx } = await setup()
     const p = producer({ kind: 'subagent', label: 'research' })
     ctx.jobs.start(p.spec)
     expect(text(await call(ctx, 'job_output', { job_id: 'subagent-1' }))).toBe('(no new output)\n[status: running]')
 
-    p.settle({ status: 'completed', detail: 'completed', output: 'the answer' })
+    p.append('partial')
+    p.settle({ status: 'completed', detail: 'completed', result: 'the answer' })
     await tick()
-    expect(text(await call(ctx, 'job_output', { job_id: 'subagent-1' }))).toBe('the answer\n[status: completed, completed]')
+    expect(text(await call(ctx, 'job_output', { job_id: 'subagent-1' }))).toBe('partial\nthe answer\n[status: completed, completed]')
+    expect(text(await call(ctx, 'job_output', { job_id: 'subagent-1' }))).toBe('(no new output)\n[status: completed, completed]')
+  })
+
+  it('keeps a newline-terminated delta and the result on separate lines', async () => {
+    const { ctx } = await setup()
+    const p = producer({ kind: 'subagent', label: 'research' })
+    ctx.jobs.start(p.spec)
+    p.append('progress log\n')
+    p.settle({ status: 'completed', result: 'the answer' })
+    await tick()
+    expect(text(await call(ctx, 'job_output', { job_id: 'subagent-1' }))).toBe('progress log\nthe answer\n[status: completed]')
   })
 
   it('applies a producer limit to the complete body and status result', async () => {
     const { ctx } = await setup()
-    ctx.jobs.start(producer({
-      outputLimitBytes: 48,
-      readOutput: () => '界'.repeat(100),
-    }).spec)
+    const p = producer({ outputLimitBytes: 48 })
+    ctx.jobs.start(p.spec)
+    p.append('界'.repeat(100))
 
     const output = text(await call(ctx, 'job_output', { job_id: 'bash-1' }))
     expect(Buffer.byteLength(output)).toBeLessThanOrEqual(48)
@@ -221,24 +374,21 @@ describe('job_output', () => {
 
   it('preserves empty and newline-terminated output under a producer limit', async () => {
     const { ctx } = await setup()
-    const chunks = ['', 'line\n']
-    ctx.jobs.start(producer({
-      outputLimitBytes: 64,
-      readOutput: () => chunks.shift() ?? '',
-    }).spec)
+    const p = producer({ outputLimitBytes: 64 })
+    ctx.jobs.start(p.spec)
 
     expect(text(await call(ctx, 'job_output', { job_id: 'bash-1' })))
       .toBe('(no new output)\n[status: running]')
+    p.append('line\n')
     expect(text(await call(ctx, 'job_output', { job_id: 'bash-1' })))
       .toBe('line\n[status: running]')
   })
 
   it('bounds post-policy output without restoring the canonical status rendering', async () => {
     const { ctx } = await setup()
-    ctx.jobs.start(producer({
-      outputLimitBytes: 64,
-      readOutput: () => 'canonical output',
-    }).spec)
+    const p = producer({ outputLimitBytes: 64 })
+    ctx.jobs.start(p.spec)
+    p.append('canonical output')
     ctx.on('tools/post-execute', (exec, _result, next) => {
       if (exec.name !== 'job_output') return next()
       return Promise.resolve({ kind: 'accept', content: [{ type: 'text', text: 'p'.repeat(1_000) }] })
@@ -250,17 +400,30 @@ describe('job_output', () => {
     expect(text(result)).not.toContain('[status: running]')
   })
 
-  it('applies a producer limit to a normalized read failure', async () => {
+  it('does not double a truncation marker a policy already appended', async () => {
     const { ctx } = await setup()
-    ctx.jobs.start(producer({
-      outputLimitBytes: 64,
-      readOutput: () => { throw new Error('read failed: '.repeat(100)) },
-    }).spec)
+    ctx.jobs.start(producer({ outputLimitBytes: 64 }).spec)
+    ctx.on('tools/post-execute', (exec, _result, next) => {
+      if (exec.name !== 'job_output') return next()
+      return Promise.resolve({ kind: 'accept', content: [{ type: 'text', text: `${'z'.repeat(1_000)}\n[result truncated]` }] })
+    })
 
     const result = await call(ctx, 'job_output', { job_id: 'bash-1' })
-    expect(result.isError).toBe(true)
     expect(Buffer.byteLength(text(result))).toBeLessThanOrEqual(64)
-    expect(text(result)).toContain('[result truncated]')
+    expect(text(result).match(/\[result truncated\]/g)).toHaveLength(1)
+  })
+
+  it('refuses a job owned by another session as an errored result', async () => {
+    const { ctx } = await setup()
+    const alice = await fakeAgent(ctx, 'sess-alice')
+    ctx.jobs.start(producer({ owner: alice.id }).spec)
+    const bob = await fakeAgent(ctx, 'sess-bob')
+
+    const result = await call(ctx, 'job_output', { job_id: 'bash-1' }, bob)
+    expect(result.isError).toBe(true)
+    expect(text(result)).toContain('belongs to another session')
+    expect((await call(ctx, 'job_output', { job_id: 'bash-1' })).isError).toBe(true)
+    expect((await call(ctx, 'job_output', { job_id: 'bash-1' }, alice)).isError).toBe(false)
   })
 
   it('bounds pre-, around-, and post-execute policy outcomes and failures', async () => {
@@ -325,7 +488,7 @@ describe('job_output', () => {
     ctx.jobs.start(p.spec)
 
     const pending = call(ctx, 'job_output', { job_id: 'subagent-1', wait: true })
-    p.settle({ status: 'completed', output: 'done deal' })
+    p.settle({ status: 'completed', result: 'done deal' })
     expect(text(await pending)).toBe('done deal\n[status: completed]')
   })
 
@@ -354,9 +517,9 @@ describe('job_list', () => {
     expect(text(await call(ctx, 'job_list', {}))).toBe('(no background jobs)')
 
     const alice = await fakeAgent(ctx, 'sess-alice')
-    ctx.jobs.start(producer({ owner: alice, label: 'pnpm test' }).spec)
+    ctx.jobs.start(producer({ owner: alice.id, label: 'pnpm test' }).spec)
     ctx.jobs.start(producer({ kind: 'subagent', label: 'open research' }).spec)
-    const p = producer({ owner: alice, label: 'build' })
+    const p = producer({ owner: alice.id, label: 'build' })
     ctx.jobs.start(p.spec)
     p.settle({ status: 'completed', detail: 'exit code: 0' })
     await tick()
@@ -368,8 +531,8 @@ describe('job_list', () => {
     expect(listedValue[0]).toMatchObject({ id: 'bash-1', kind: 'bash', label: 'pnpm test', status: 'running' })
     expect(listedValue[2]).toMatchObject({ id: 'bash-2', kind: 'bash', label: 'build', status: 'completed', detail: 'exit code: 0' })
     for (const job of listedValue) {
-      expect(job).not.toHaveProperty('ownerSession')
-      expect(job).not.toHaveProperty('reported')
+      expect(job).not.toHaveProperty('owner')
+      expect(job).not.toHaveProperty('output')
     }
     expect(text(listed)).toBe([
       'bash-1 [bash] running — pnpm test',
@@ -395,8 +558,8 @@ describe('job_kill', () => {
       outcome: 'cancellation-requested',
       job: { id: 'bash-1', kind: 'bash', label: 'sleep 60', status: 'stopping' },
     })
-    expect(killValue.job).not.toHaveProperty('ownerSession')
-    expect(killValue.job).not.toHaveProperty('reported')
+    expect(killValue.job).not.toHaveProperty('owner')
+    expect(killValue.job).not.toHaveProperty('output')
     expect(text(result)).toBe('requested cancellation of job bash-1')
     expect(p.cancels).toEqual(['superseded'])
   })
@@ -422,7 +585,7 @@ describe('job_kill', () => {
     expect(result.isError).toBe(true)
     expect(Buffer.byteLength(text(result))).toBeLessThanOrEqual(64)
     expect(text(result)).toContain('[result truncated]')
-    expect(ctx.jobs.get(JobId('bash-1'))).toMatchObject({ status: 'running', reported: false })
+    expect(ctx.jobs.get(JobId('bash-1')).status).toBe('running')
   })
 
   it('bounds single-text post policy while preserving structured policy results', async () => {
@@ -470,9 +633,9 @@ describe('job_kill', () => {
 
   it('reports an already-finished job without consuming its pending delta', async () => {
     const { ctx } = await setup()
-    let delta = 'unread tail'
-    const p = producer({ readOutput: () => { const d = delta; delta = ''; return d } })
+    const p = producer()
     ctx.jobs.start(p.spec)
+    p.append('unread tail')
     p.settle({ status: 'completed', detail: 'exit code: 0' })
     await tick()
 
@@ -483,7 +646,7 @@ describe('job_kill', () => {
       job: { id: 'bash-1', kind: 'bash', label: 'sleep 60', status: 'completed', detail: 'exit code: 0' },
     })
     expect(text(killed)).toBe('job bash-1 had already finished [status: completed, exit code: 0]')
-    // The kill described the job via a non-consuming snapshot: the delta is intact.
+    // The kill described the job via a non-consuming projection: the delta is intact.
     expect(text(await call(ctx, 'job_output', { job_id: 'bash-1' }))).toBe('unread tail\n[status: completed, exit code: 0]')
   })
 
@@ -508,9 +671,9 @@ describe('tool-owned UI presentation (presentCall)', () => {
 describe('completion notices across scoped mounts', () => {
   /**
    * Two agent presets mounting `tool-jobs` over ONE host registry: each mount
-   * registers its own `onJobDone` listener on the shared service, and
-   * `settle()` broadcasts one snapshot to every listener with no scope filter.
-   * Only the mount whose scope the owner belongs to may deliver the notice.
+   * subscribes with `{ owners: 'scope' }`, which the registry files into the
+   * mount's own scope layer and reaches along the owner's scope chain. Only
+   * the mount whose scope the owner belongs to sees the settlement.
    */
   it('delivers one notice from the owning scope when two mounts share the registry', async () => {
     const ctx = new Context()
@@ -539,9 +702,7 @@ describe('completion notices across scoped mounts', () => {
     const dispose = await ctx.agents.register(owner)
 
     try {
-      // No waiter: `settle()` leaves `reported` false, which is the only path
-      // that reaches the notice listeners at all.
-      const p = producer({ owner, label: 'pnpm test' })
+      const p = producer({ owner: owner.id, label: 'pnpm test' })
       ctx.jobs.start(p.spec)
       p.settle({ status: 'completed', detail: 'exit code: 0' })
       await tick()
@@ -559,7 +720,7 @@ describe('completion notice delivery', () => {
     const inject = vi.fn()
     const followup = vi.fn()
     const owner = await fakeAgent(ctx, 'sess-1', { inject, followup, status: 'idle' })
-    const p = producer({ owner, label: 'pnpm test' })
+    const p = producer({ owner: owner.id, label: 'pnpm test' })
     ctx.jobs.start(p.spec)
 
     p.settle({ status: 'completed', detail: 'exit code: 0' })
@@ -573,7 +734,7 @@ describe('completion notice delivery', () => {
     const inject = vi.fn()
     const followup = vi.fn()
     const owner = await fakeAgent(ctx, 'sess-1', { inject, followup, status: 'idle' })
-    const p = producer({ owner })
+    const p = producer({ owner: owner.id })
     ctx.jobs.start(p.spec)
 
     p.settle({ status: 'completed' })
@@ -621,15 +782,15 @@ describe('completion notice delivery', () => {
     ctx.jobs.start({
       kind: 'bash',
       label: 'sleep 60',
-      owner,
+      owner: owner.id,
       run: () => ({
         cancel() { settle({ status: 'killed' }) },
         done: new Promise<JobOutcome>((res) => { settle = res }),
       }),
     })
 
-    // Disposal cancels and settles the owned job. Waking here would spend a
-    // model request on an agent the host is destroying, once per tree layer.
+    // Disposal cancels and settles the owned job with a teardown cause. Waking
+    // here would spend a model request on an agent the host is destroying.
     await disposeAgentScope(owner)
     await tick()
     expect(followup).not.toHaveBeenCalled()
@@ -645,17 +806,16 @@ describe('completion notice delivery', () => {
     ctx.jobs.start({
       kind: 'bash',
       label: 'broken producer',
-      owner,
+      owner: owner.id,
       run: () => ({
         cancel() { throw new Error('cancel boom') },
         done: new Promise<JobOutcome>(() => {}),
       }),
     })
 
-    // The registry force-fails the record instead of deadlocking. That path
-    // settles the job too, so it must claim the report as the ordinary
-    // teardown cancel does — otherwise a throwing producer is all it takes to
-    // spend a model request on an owner being destroyed.
+    // The registry force-fails the record instead of deadlocking. That
+    // settlement also announces a teardown cause, so a throwing producer is
+    // not enough to spend a model request on an owner being destroyed.
     await disposeAgentScope(owner)
     await tick()
     expect(warn).toHaveBeenCalledWith(expect.stringContaining('work may be orphaned'))
@@ -682,11 +842,11 @@ describe('completion notice delivery', () => {
 })
 
 describe('completion notices', () => {
-  it('injects a notice into the owning agent when an unreported job settles', async () => {
+  it('injects a notice into the owning agent when an uncollected job settles', async () => {
     const { ctx } = await setup()
     const inject = vi.fn()
     const owner = await fakeAgent(ctx, 'sess-1', { inject })
-    const p = producer({ owner, label: 'pnpm test' })
+    const p = producer({ owner: owner.id, label: 'pnpm test' })
     ctx.jobs.start(p.spec)
 
     p.settle({ status: 'completed', detail: 'exit code: 0' })
@@ -709,7 +869,7 @@ describe('completion notices', () => {
     const inject = vi.fn()
     const owner = await fakeAgent(ctx, 'sess-1', { inject })
     const first = producer({
-      owner,
+      owner: owner.id,
       kind: 'subagent',
       label: 'x'.repeat(1_000),
       outputLimitBytes: 61,
@@ -735,7 +895,7 @@ describe('completion notices', () => {
     )
 
     const second = producer({
-      owner,
+      owner: owner.id,
       kind: 'subagent',
       label: 'x'.repeat(1_000),
       outputLimitBytes: 80,
@@ -762,7 +922,7 @@ describe('completion notices', () => {
     const inject = vi.fn()
     const owner = await fakeAgent(ctx, 'sess-1', { inject })
     const target = producer({
-      owner,
+      owner: owner.id,
       kind: 'pty-send',
       label: 'x'.repeat(1_000),
       outputLimitBytes: 64,
@@ -782,8 +942,8 @@ describe('completion notices', () => {
     const { ctx } = await setup()
     const inject = vi.fn()
     const owner = await fakeAgent(ctx, 'sess-1', { inject })
-    const tiny = producer({ owner, kind: 'pty-send', label: 'x'.repeat(100), outputLimitBytes: 8 })
-    const short = producer({ owner, kind: 'pty-send', label: 'x'.repeat(100), outputLimitBytes: 32 })
+    const tiny = producer({ owner: owner.id, kind: 'pty-send', label: 'x'.repeat(100), outputLimitBytes: 8 })
+    const short = producer({ owner: owner.id, kind: 'pty-send', label: 'x'.repeat(100), outputLimitBytes: 32 })
     ctx.jobs.start(tiny.spec)
     ctx.jobs.start(short.spec)
 
@@ -803,7 +963,7 @@ describe('completion notices', () => {
     const { ctx } = await setup()
     const inject = vi.fn()
     const owner = await fakeAgent(ctx, 'sess-1', { inject })
-    const p = producer({ owner })
+    const p = producer({ owner: owner.id })
     ctx.jobs.start(p.spec)
 
     await call(ctx, 'job_kill', { job_id: 'bash-1' }, owner)
@@ -816,15 +976,117 @@ describe('completion notices', () => {
     const { ctx } = await setup()
     const inject = vi.fn()
     const owner = await fakeAgent(ctx, 'sess-1', { inject })
-    const p = producer({ owner, kind: 'subagent' })
+    const p = producer({ owner: owner.id, kind: 'subagent' })
     ctx.jobs.start(p.spec)
 
     const pending = call(ctx, 'job_output', { job_id: 'subagent-1', wait: true }, owner)
-    p.settle({ status: 'completed', output: 'answer' })
+    p.settle({ status: 'completed', result: 'answer' })
     expect(text(await pending)).toContain('answer')
+    await tick()
     expect(inject).not.toHaveBeenCalled()
   })
 
+  it('a timed-out wait withdraws only its own claim; a concurrent wait keeps the settlement covered', async () => {
+    const { ctx } = await setup({ waitTimeoutMs: 10, maxWaitTimeoutMs: 1000 })
+    const inject = vi.fn()
+    const owner = await fakeAgent(ctx, 'sess-1', { inject })
+    const p = producer({ owner: owner.id })
+    ctx.jobs.start(p.spec)
+
+    const patient = call(ctx, 'job_output', { job_id: 'bash-1', wait: true, timeout_ms: 1000 }, owner)
+    expect(text(await call(ctx, 'job_output', { job_id: 'bash-1', wait: true, timeout_ms: 10 }, owner))).toBe('(no new output)\n[status: running]')
+    p.settle({ status: 'completed' })
+    expect(text(await patient)).toBe('(no new output)\n[status: completed]')
+    await tick()
+    expect(inject).not.toHaveBeenCalled()
+  })
+
+  it('withdraws the wait claim when the wait times out, so the later settlement still notifies', async () => {
+    const { ctx } = await setup({ waitTimeoutMs: 10, maxWaitTimeoutMs: 20 })
+    const inject = vi.fn()
+    const owner = await fakeAgent(ctx, 'sess-1', { inject })
+    const p = producer({ owner: owner.id })
+    ctx.jobs.start(p.spec)
+
+    expect(text(await call(ctx, 'job_output', { job_id: 'bash-1', wait: true }, owner))).toBe('(no new output)\n[status: running]')
+    p.settle({ status: 'completed' })
+    await tick()
+    expect(inject).toHaveBeenCalledTimes(1)
+  })
+
+  it('withdraws the wait claim when the caller aborts the wait', async () => {
+    const { ctx } = await setup()
+    const inject = vi.fn()
+    const owner = await fakeAgent(ctx, 'sess-1', { inject })
+    const p = producer({ owner: owner.id })
+    ctx.jobs.start(p.spec)
+
+    const aborter = new AbortController()
+    const pending = ctx.tools.execute({
+      signal: aborter.signal,
+      callId: ToolCallId('call-aborted-wait'),
+      name: 'job_output',
+      arguments: { job_id: 'bash-1', wait: true },
+      agent: owner,
+    })
+    await tick()
+    aborter.abort()
+    const result = await pending
+    expect(result.isError).toBe(true)
+    expect(text(result)).toContain('wait aborted')
+
+    p.settle({ status: 'completed' })
+    await tick()
+    expect(inject).toHaveBeenCalledTimes(1)
+  })
+
+  it('delivers the notice when the wait aborts and the job settles before the rejection lands', async () => {
+    const { ctx } = await setup()
+    const inject = vi.fn()
+    const owner = await fakeAgent(ctx, 'sess-1', { inject })
+    const p = producer({ owner: owner.id, kind: 'subagent' })
+    ctx.jobs.start(p.spec)
+
+    const aborter = new AbortController()
+    const pending = ctx.tools.execute({
+      signal: aborter.signal,
+      callId: ToolCallId('call-abort-then-settle'),
+      name: 'job_output',
+      arguments: { job_id: 'subagent-1', wait: true },
+      agent: owner,
+    })
+    await tick()
+    // One synchronous span: the registry rejects the aborted wait on a later
+    // microtask, and a push producer's settlement lands before that rejection
+    // reaches the tool. The tool result carries the abort, not the outcome, so
+    // the settlement notice is the model's only completion record.
+    aborter.abort()
+    p.settle({ status: 'completed', result: 'answer' })
+    const result = await pending
+    expect(result.isError).toBe(true)
+    expect(text(result)).toContain('wait aborted')
+    await tick()
+    expect(inject).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps a claim on one job while another job settles', async () => {
+    const { ctx } = await setup()
+    const inject = vi.fn()
+    const owner = await fakeAgent(ctx, 'sess-1', { inject })
+    const killed = producer({ owner: owner.id })
+    const other = producer({ owner: owner.id })
+    ctx.jobs.start(killed.spec)
+    ctx.jobs.start(other.spec)
+
+    await call(ctx, 'job_kill', { job_id: 'bash-1' }, owner)
+    other.settle({ status: 'completed' })
+    await tick()
+    expect(inject).toHaveBeenCalledTimes(1)
+    killed.settle({ status: 'killed' })
+    await tick()
+    expect(inject).toHaveBeenCalledTimes(1)
+  })
+
   it('drops the notice for unowned jobs without throwing', async () => {
     const { ctx } = await setup()
     // Unowned: settles with nobody to notify — nothing throws.
@@ -834,31 +1096,58 @@ describe('completion notices', () => {
     await tick()
   })
 
-  it('does not route an old owner completion notice to a same-session replacement', async () => {
+  it('delivers to the agent currently registered for the owner session', async () => {
     const { ctx } = await setup()
-    // Delivery into a tearing-down owner is a plain inject: the loop has no
-    // terminal state, so the notice lands in the old owner's (detached)
-    // session instead of throwing or re-routing.
+    // The settlement names the owner session; the notice goes to whichever
+    // agent holds that session when the job settles, which can read the job
+    // through the same session id.
     const oldInject = vi.fn()
     const oldOwner = await fakeAgent(ctx, 'shared', { inject: oldInject })
-    const p = producer({ owner: oldOwner })
+    const p = producer({ owner: oldOwner.id })
     ctx.jobs.start(p.spec)
 
     await detachAgent(oldOwner)
     const replacementInject = vi.fn()
-    await fakeAgent(ctx, 'shared', { inject: replacementInject })
+    const replacement = await fakeAgent(ctx, 'shared', { inject: replacementInject })
     p.settle({ status: 'completed' })
     await tick()
 
-    expect(oldInject).toHaveBeenCalledTimes(1)
-    expect(replacementInject).not.toHaveBeenCalled()
+    expect(oldInject).not.toHaveBeenCalled()
+    expect(replacementInject).toHaveBeenCalledTimes(1)
+    expect(text(await call(ctx, 'job_output', { job_id: 'bash-1' }, replacement))).toBe('(no new output)\n[status: completed]')
+  })
+
+  it('drops the notice when the agent registry left before settlement', async () => {
+    const { ctx, agentsFiber } = await setup()
+    const inject = vi.fn()
+    const owner = await fakeAgent(ctx, 'sess-1', { inject })
+    const p = producer({ owner: owner.id })
+    ctx.jobs.start(p.spec)
+
+    await agentsFiber.dispose()
+    p.settle({ status: 'completed' })
+    await tick()
+    expect(inject).not.toHaveBeenCalled()
+  })
+
+  it('drops the notice when the owner session has no live agent at settlement', async () => {
+    const { ctx } = await setup()
+    const inject = vi.fn()
+    const owner = await fakeAgent(ctx, 'sess-1', { inject })
+    const p = producer({ owner: owner.id })
+    ctx.jobs.start(p.spec)
+
+    await detachAgent(owner)
+    p.settle({ status: 'completed' })
+    await tick()
+    expect(inject).not.toHaveBeenCalled()
   })
 
   it('surfaces an inject failure through listener containment (a real bug must be visible)', async () => {
     const { ctx } = await setup()
     const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => {})
     const owner = await fakeAgent(ctx, 'sess-1', { inject: () => { throw new Error('unexpected inject bug') } })
-    const p = producer({ owner })
+    const p = producer({ owner: owner.id })
     ctx.jobs.start(p.spec)
     p.settle({ status: 'completed' })
     await tick()
@@ -866,23 +1155,4 @@ describe('completion notices', () => {
     // registry's per-listener containment — visible, not swallowed.
     expect(warn).toHaveBeenCalledWith(expect.stringContaining('unexpected inject bug'))
   })
-
-  it('keeps using the exact owner after the agent registry is gone', async () => {
-    const { ctx, agentsFiber } = await setup()
-    const inject = vi.fn()
-    const owner = await fakeAgent(ctx, 'sess-1', { inject })
-
-    // Settlement must not depend on a later registry lookup: the exact owner
-    // supplied at start remains the destination while its own scope is live.
-    const p1 = producer({ owner })
-    ctx.jobs.start(p1.spec)
-    const p2 = producer({ owner })
-    ctx.jobs.start(p2.spec)
-
-    await agentsFiber.dispose()
-    p1.settle({ status: 'completed' })
-    p2.settle({ status: 'failed' })
-    await tick()
-    expect(inject).toHaveBeenCalledTimes(2)
-  })
 })
diff --git a/packages/llm/llm-pi-ai/README.i18n.yaml b/packages/llm/llm-pi-ai/README.i18n.yaml
index 175e1ab36e..06072e5b87 100644
--- a/packages/llm/llm-pi-ai/README.i18n.yaml
+++ b/packages/llm/llm-pi-ai/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/llm/llm-pi-ai/README.md
-README.md: 4b3297ab96c2c691f9bbf849d8e49cb10a126a6a
-README.zh.md: b33381468891fa81b199cca40f22a59183f5076a
+README.md: 35d4ce1ad9318c4c27a71af362014d53bf3e3798
+README.zh.md: bd12102d0b35963495907ee53a69d2dd339f5ffc
diff --git a/packages/llm/llm-pi-ai/README.md b/packages/llm/llm-pi-ai/README.md
index 4b3297ab96..35d4ce1ad9 100644
--- a/packages/llm/llm-pi-ai/README.md
+++ b/packages/llm/llm-pi-ai/README.md
@@ -229,6 +229,7 @@ These limits define where the adapter stops and future work begins. They are cur
 - **Only a leading in-history `system` message becomes pi-ai's `systemPrompt`** — pi-ai has one system slot, so a later `system` message, or a leading one when `GenerateOptions.system` is also set, folds into a `user` message at its position; provider-specific placement of the prompt follows pi-ai rather than a harness-owned wire override. Images in system or assistant history, including the leading system message, fail with `UNSUPPORTED_CONTENT` on both conversion paths.
 - **Provider HTTP status is unavailable** — pi-ai error events do not expose a stable HTTP status across providers.
 - **Retry policy is provider-owned, not an SDK retry** — pi-ai SDK retries stay disabled so durable agent steps and `llm/retry` events own every visible attempt, and direct `ctx.llm.stream()` calls remain single-attempt.
+- **Streamed tool-call arguments are parsed once, when the call ends** — the installed pi-ai carries [`patches/@earendil-works__pi-ai@0.85.1.patch`](../../../patches/@earendil-works__pi-ai@0.85.1.patch), which removes the per-delta re-parse of the whole accumulated argument JSON in every stream adapter (upstream [earendil-works/pi#9265](https://github.com/earendil-works/pi/issues/9265)); unpatched, a multi-megabyte argument stream costs O(n²) CPU on the event loop and stalls every session in the process. Until `toolcall_end`, a pi-ai partial's tool-call `arguments` stays `{}`; this adapter reads only the delta strings and the finalized arguments. Re-apply or retire the patch on every pi-ai upgrade.
 
 <a id="dev-note"></a>
 ### Dev Note
diff --git a/packages/llm/llm-pi-ai/README.zh.md b/packages/llm/llm-pi-ai/README.zh.md
index b333814688..bd12102d0b 100644
--- a/packages/llm/llm-pi-ai/README.zh.md
+++ b/packages/llm/llm-pi-ai/README.zh.md
@@ -229,6 +229,7 @@ pi-ai 事件变成 harness 的推理、文本、工具调用、用量与 finish
 - **只有历史中首条 `system` 消息会成为 pi-ai 的 `systemPrompt`**——pi-ai 只有一个系统槽位，因此后续的 `system` 消息，或在同时设置了 `GenerateOptions.system` 时的首条消息，会在原位置折叠为 `user` 消息；系统提示词的提供方专属放置遵循 pi-ai，而非 harness 自有的协议覆盖。system 或 assistant 历史中的图片（包括首条系统消息中的图片）在两条转换路径上都会以 `UNSUPPORTED_CONTENT` 失败。
 - **提供方 HTTP 状态不可用**——pi-ai 错误事件不跨提供方暴露稳定 HTTP 状态。
 - **重试策略由提供方自有，而非 SDK 重试**——pi-ai SDK 重试保持禁用，因此持久 agent（智能体）步骤与 `llm/retry` 事件拥有每个可见尝试，直接 `ctx.llm.stream()` 调用仍是单次尝试。
+- **流式工具调用参数只在调用结束时解析一次**——安装的 pi-ai 带有 [`patches/@earendil-works__pi-ai@0.85.1.patch`](../../../patches/@earendil-works__pi-ai@0.85.1.patch)，它移除了每个流适配器中对整段累计参数 JSON 的逐 delta 重新解析（上游 [earendil-works/pi#9265](https://github.com/earendil-works/pi/issues/9265)）；未打补丁时，数 MB 的参数流会在事件循环上消耗 O(n²) CPU，并使进程内所有会话停滞。在 `toolcall_end` 之前，pi-ai partial 的工具调用 `arguments` 保持为 `{}`；本适配器只读取 delta 字符串与最终参数。每次升级 pi-ai 时都要重新应用或撤销该补丁。
 
 <a id="dev-note"></a>
 ### 开发备注
diff --git a/packages/llm/llm-pi-ai/tests/tool-argument-streaming.spec.ts b/packages/llm/llm-pi-ai/tests/tool-argument-streaming.spec.ts
new file mode 100644
index 0000000000..14a4e09a9b
--- /dev/null
+++ b/packages/llm/llm-pi-ai/tests/tool-argument-streaming.spec.ts
@@ -0,0 +1,81 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import type { AssistantMessageEvent, Model } from '@earendil-works/pi-ai'
+import { stream as streamCompletions } from '@earendil-works/pi-ai/api/openai-completions'
+import { stream as streamResponses } from '@earendil-works/pi-ai/api/openai-responses'
+import { closeMockServers, mockServer } from './mock-server.ts'
+
+afterEach(closeMockServers)
+
+/** A write call whose arguments arrive in many small deltas. */
+const args = { file_path: 'notes.md', content: 'x'.repeat(2048) }
+const argsJson = JSON.stringify(args)
+const fragments = argsJson.match(/.{1,7}/gs) ?? []
+
+function model<A extends 'openai-completions' | 'openai-responses'>(api: A, baseUrl: string): Model<A> {
+  return {
+    id: 'm', name: 'm', api, provider: 'test', baseUrl, reasoning: false, input: ['text'],
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }, contextWindow: 8192, maxTokens: 1024,
+  }
+}
+
+/** The arguments each `toolcall_delta` partial carries, and the finalized arguments. */
+async function collect(events: AsyncIterable<AssistantMessageEvent>): Promise<{ partials: unknown[]; final: unknown }> {
+  const partials: unknown[] = []
+  let final: unknown
+  for await (const event of events) {
+    if (event.type === 'toolcall_delta' && event.delta.length > 0) {
+      const block = event.partial.content[event.contentIndex]
+      partials.push(block?.type === 'toolCall' ? block.arguments : undefined)
+    } else if (event.type === 'toolcall_end') {
+      final = event.toolCall.arguments
+    } else if (event.type === 'error') {
+      throw new Error(event.error.errorMessage)
+    }
+  }
+  return { partials, final }
+}
+
+const context = { messages: [{ role: 'user' as const, content: 'hi', timestamp: 0 }] }
+
+describe('streamed tool-call arguments (patched pi-ai)', () => {
+  it('openai-completions parses arguments once, at the end of the call', async () => {
+    const server = await mockServer([{ events: [
+      JSON.stringify({ choices: [{
+        delta: {
+          role: 'assistant',
+          tool_calls: [{ index: 0, id: 'call_1', type: 'function', function: { name: 'write', arguments: '' } }],
+        },
+        index: 0, finish_reason: null,
+      }] }),
+      ...fragments.map(fragment => JSON.stringify({
+        choices: [{ delta: { tool_calls: [{ index: 0, function: { arguments: fragment } }] }, index: 0, finish_reason: null }],
+      })),
+      '{"choices":[{"delta":{},"index":0,"finish_reason":"tool_calls"}],"usage":{"prompt_tokens":3,"completion_tokens":1}}',
+      '[DONE]',
+    ] }])
+    const events = streamCompletions(model('openai-completions', server.url), context, { apiKey: 'test-key' })
+    const { partials, final } = await collect(events)
+    expect(partials).toHaveLength(fragments.length)
+    expect(partials.every(partial => JSON.stringify(partial) === '{}')).toBe(true)
+    expect(final).toEqual(args)
+  })
+
+  it('openai-responses parses arguments once, at the end of the call', async () => {
+    const item = { type: 'function_call', call_id: 'call_1', id: 'fc_1', name: 'write' }
+    const server = await mockServer([{ events: [
+      '{"type":"response.created","response":{"id":"resp_1"}}',
+      JSON.stringify({ type: 'response.output_item.added', output_index: 0, item: { ...item, arguments: '' } }),
+      ...fragments.map(fragment => JSON.stringify({ type: 'response.function_call_arguments.delta', output_index: 0, delta: fragment })),
+      JSON.stringify({ type: 'response.function_call_arguments.done', output_index: 0, arguments: argsJson }),
+      JSON.stringify({ type: 'response.output_item.done', output_index: 0, item: { ...item, arguments: argsJson } }),
+      JSON.stringify({ type: 'response.completed', response: {
+        id: 'resp_1', status: 'completed', output: [], usage: { input_tokens: 3, output_tokens: 1, total_tokens: 4 },
+      } }),
+    ] }])
+    const events = streamResponses(model('openai-responses', server.url), context, { apiKey: 'test-key' })
+    const { partials, final } = await collect(events)
+    expect(partials).toHaveLength(fragments.length)
+    expect(partials.every(partial => JSON.stringify(partial) === '{}')).toBe(true)
+    expect(final).toEqual(args)
+  })
+})
diff --git a/packages/llm/llm-retry/tests/transport-recovery.spec.ts b/packages/llm/llm-retry/tests/transport-recovery.spec.ts
index 6322a88f27..8fd91ece9e 100644
--- a/packages/llm/llm-retry/tests/transport-recovery.spec.ts
+++ b/packages/llm/llm-retry/tests/transport-recovery.spec.ts
@@ -14,19 +14,26 @@ import type { SessionEvent } from '@deepseek-ai/dsh-session'
 import * as Retry from '../src/index.ts'
 
 let context: Context | undefined
-const servers: MockLlmServer[] = []
+const servers: Promise<MockLlmServer>[] = []
 
 afterEach(async () => {
-  await context?.fiber.dispose()
+  const ownedContext = context
   context = undefined
-  await Promise.all(servers.splice(0).map(server => server.close()))
+  // A failed transport can still await a stalled socket while its context disposes.
+  const results = await Promise.allSettled([
+    ownedContext?.fiber.dispose(),
+    ...servers.splice(0).map(async server => (await server).close()),
+  ])
+  vi.unstubAllEnvs()
+  const failure = results.find(result => result.status === 'rejected')
+  if (failure?.status === 'rejected') throw failure.reason
 })
 
-async function start(
+function start(
   sequence: readonly MockLlmBehavior[],
   options: Omit<Parameters<typeof startMockLlmServer>[0], 'sequence'> = {},
 ): Promise<MockLlmServer> {
-  const server = await startMockLlmServer({ sequence, ...options })
+  const server = startMockLlmServer({ sequence, ...options })
   servers.push(server)
   return server
 }
@@ -218,7 +225,7 @@ describe('bounded retry through the real DeepSeek HTTP/SSE adapter', () => {
     expect(agent.session.snapshotEvents().filter(event => event.type === 'llm/retry').map(event => event.data.failure.code))
       .toEqual(['TIMEOUT'])
     expect(finalAssistantText(agent)).toBe('recovered after timeout')
-  }, 10_000)
+  })
 
   it('stops after the configured transport retry budget is exhausted', async () => {
     const server = await start(['connection_reset', 'connection_reset', 'connection_reset'], {
diff --git a/packages/preset/agent-presets/presets/cordis/agent.cordis.yml b/packages/preset/agent-presets/presets/cordis/agent.cordis.yml
index 9df711310c..5cb8b059f5 100644
--- a/packages/preset/agent-presets/presets/cordis/agent.cordis.yml
+++ b/packages/preset/agent-presets/presets/cordis/agent.cordis.yml
@@ -5,37 +5,21 @@
 #
 # It exists so a person can ask an agent to author another agent. Everything in
 # `standard` is here unchanged; Creator adds persistent plugin management,
-# runtime inspection, composition-authoring skills, and a persona that explains
-# where profile and preset changes belong.
+# runtime inspection, and composition-authoring skills. The persona is the
+# `standard` one: tool descriptions and the skill catalog carry the operating
+# detail, and the skills own the off-limits rule (an upgrade overwrites the
+# shipped preset install, and corrupting the `cordis` preset disables this mode).
 #
 # Profile management persists configuration shared by every session in that profile.
 
-# The preset's own persona, shadowing the deployment default for this agent.
+# Same persona as `standard`, shadowing the deployment default for this agent.
 # `{{model}}` and `{{cwd}}` resolve from the agent's own route and workspace.
 - id: persona
   name: '@deepseek-ai/dsh-persona'
   config:
     suffix: Your working directory is {{cwd}}.
-    prefix: |-
-      You are a coding agent powered by the {{model}} model, running on the DeepSeek Harness.
-
-      You can read and modify the harness you run on. Its composition is Cordis: every capability is a plugin row in a `cordis.yml`, and an agent preset is one such file mounted for a single session.
-
-      Two planes decide where an edit belongs. The HOST composition holds the registries and anything shared across sessions — persistence, the sandbox and approval stack, the model route, the subagent registry and its backends. An AGENT PRESET holds what one session contributes to those registries: its tools, its persona, its prompt sections. A row that publishes a service belongs in the host composition, or inside an `isolate` realm if the preset genuinely owns that service and nothing outside one agent reads it.
-
-      Presets you author live one directory per preset under `${DSH_HOME:-$HOME/.dsh}/.agent-presets/<id>/`. Load `editing-cordis-compositions` for file discovery and copying instructions. NEVER edit or delete the shipped preset install (the `agent-presets` directory beside the deployment's own config): it belongs to the deployment, an upgrade overwrites it, and corrupting the `cordis` preset would disable this very mode. To change what a shipped preset does, copy its composition into a new preset directory and edit the copy.
-
-      Load the `editing-cordis-compositions` skill before writing or changing a composition.
-
-      Use plugin_manager for persistent bundle installation, removal and enablement in the current profile. Author plugin code and configuration as ordinary workspace bundle files. Changes affect every session in that profile. Read saved-state and activation outcomes separately; restart-required means the new capability is not available yet.
-
-      In Creator mode, requests to make a visual object, decoration, or widget mean creating an installed UI plugin that displays it in this Harness Web UI, unless the user specifies another destination. Choose reasonable visual details and proceed. Load cordis-plugin-development, inspect the Client slots, build the plugin in the workspace, and install it with plugin_manager. Install a minimal working version before visual refinement; use the connected page as its preview. Verify that the open page renders it; a standalone image or HTML file does not complete an in-app creation request.
-
-      Load the cordis-plugin-development skill before authoring an installed plugin. Use cordis_inspect_list to discover Host and Client providers, then cordis_inspect_query to read exact Service, Event, Tool, Theme or Slot APIs. These tools are read-only; queries do not invoke business methods.
-
-      To connect an MCP server, create a configuration-only bundle whose patch inserts @deepseek-ai/dsh-mcp-client, then install it with plugin_manager. Load cordis-plugin-development for the package and YAML examples. After successful activation, call one of the newly available mcp__<serverName>__<tool> tools to verify the connection.
-
-      Use installed bundles for new plugin code. Package installation may require explicit user approval for build scripts. Preserve returned failures and pending states; only report success after observing the requested capability.
+    prefix: >-
+      You are a coding agent powered by the {{model}} model.
 
 - id: agent-instructions
   name: '@deepseek-ai/dsh-agent-instructions'
diff --git a/packages/preset/agent-presets/presets/cordis/skills/cordis-plugin-development/SKILL.md b/packages/preset/agent-presets/presets/cordis/skills/cordis-plugin-development/SKILL.md
index 84a48f2a75..67aadc1cd7 100644
--- a/packages/preset/agent-presets/presets/cordis/skills/cordis-plugin-development/SKILL.md
+++ b/packages/preset/agent-presets/presets/cordis/skills/cordis-plugin-development/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: cordis-plugin-development
-description: Use when authoring, installing, configuring, or debugging persistent plugins and MCP connections in the current Harness profile.
+description: Use when authoring, installing, configuring, or debugging persistent plugins and MCP connections in the current Harness profile, and for any visual object, decoration, or widget request that names no other destination, which means an installed UI plugin rendered in the Harness Web UI.
 ---
 
 # Persistent Harness plugins
@@ -9,7 +9,7 @@ Use ordinary workspace files to author a bundle, then `plugin_manager install_bu
 
 ## Deliver a working plugin first
 
-1. Resolve the requested result and destination. In Creator mode, an unspecified visual destination is the current Harness Web UI. Choose reasonable visual details and implement a small first version.
+1. Resolve the requested result and destination. An unspecified visual destination is the current Harness Web UI; a standalone image or HTML file does not complete such a request. Choose reasonable visual details and implement a small first version; install it before visual refinement.
 2. Discover only the APIs needed for that version: `cordis_inspect_list`, then targeted `cordis_inspect_query` calls. For UI, query Client `Slots.listSubTree` and the selected slot's registration options and props. Treat the recipes below and returned API declarations as the supported implementation path. Once the chosen slot and registration API are known, write the plugin. Before the first installation, resolve missing declarations through inspection; do not re-check these recipes by reading Loader, manifest-parser, package-manager, React, or slot implementation source. Source-level diagnosis starts from a concrete installation or runtime failure.
 3. The first files you write are the installable package, patch, and required Host/Client files in one workspace directory. Check JavaScript syntax and the manifest, then install it. Before that first installation, do not create preview HTML, mock shells, design variants, screenshot scripts, or rasterizer tooling. Use the installed plugin itself as the first preview.
 4. Read the installation result. After `application: applied`, exercise the capability or inspect the live Client registration. Use the connected page for visual verification when browser control is available. State any verification limitation explicitly; installation and slot registration alone do not establish what the user can see.
@@ -47,7 +47,7 @@ For a simple drawing, prefer a slot with allocated space, such as `conversation.
       name: '@local/my-decoration'
 ```
 
-Call `plugin_manager` with `action: install_bundle` and the absolute package directory as `target`. It performs package installation and bundle selection; do not reproduce those steps with shell commands. Only pass `approvedBuilds` after the user explicitly approves the reported pending build scripts.
+Call `plugin_manager` with `action: install_bundle` and the absolute package directory as `target`. It performs package installation and bundle selection; do not reproduce those steps with shell commands. Only pass `approvedBuilds` after the user explicitly approves the reported pending build scripts. Preserve returned failures and pending states; report success only after observing the requested capability.
 
 Use `list_plugins` or `list_bundles` to obtain exact identifiers for existing installations. `set_plugin` and `set_bundle` toggle them; `remove_bundle` removes a bundle. Inspect saved-state and activation outcomes separately: `failed` requires diagnosis, `overridden` means a higher-priority layer wins, and `restart-required` means the change is not live. Installing a new bundle can activate through HMR; replacing an installed package requires restart to load a fresh JavaScript module generation. Do not infer updated browser code from an unchanged slot id.
 
@@ -105,4 +105,4 @@ Create a configuration-only bundle: its manifest needs a unique name, version, a
         failOnStartupError: true
 ```
 
-Replace the endpoint, install the bundle through `plugin_manager`, then call `mcp__demo__ping` or another discovered tool. For stdio, use `transport: stdio`, `command`, and optional `args`, `env`, and `cwd`. Ambient credentials are scrubbed; reference existing credentials with Loader `!!js` rather than copying secrets into conversation text. Repair the same bundle on failure instead of creating duplicates.
+Replace the endpoint, install the bundle through `plugin_manager`, then call `mcp__demo__ping` or another newly available `mcp__<serverName>__<tool>` tool to verify the connection. For stdio, use `transport: stdio`, `command`, and optional `args`, `env`, and `cwd`. Ambient credentials are scrubbed; reference existing credentials with Loader `!!js` rather than copying secrets into conversation text. Repair the same bundle on failure instead of creating duplicates.
diff --git a/packages/preset/agent-presets/presets/cordis/skills/editing-cordis-compositions/SKILL.md b/packages/preset/agent-presets/presets/cordis/skills/editing-cordis-compositions/SKILL.md
index 727099f6fc..dfdc4de73a 100644
--- a/packages/preset/agent-presets/presets/cordis/skills/editing-cordis-compositions/SKILL.md
+++ b/packages/preset/agent-presets/presets/cordis/skills/editing-cordis-compositions/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: editing-cordis-compositions
-description: Use when creating, changing, or validating a Cordis composition for this harness — writing or editing an agent preset, adding or removing a plugin row, deciding whether something belongs to the host composition or to one session, checking whether a preset you authored actually mounts, or diagnosing a row that mounted but contributed nothing.
+description: Use when creating, changing, or validating an agent preset or other Cordis composition for this harness, including deciding host versus preset placement and checking that an authored preset mounts.
 ---
 
 # Editing Cordis compositions
diff --git a/packages/shell/bash-local/README.i18n.yaml b/packages/shell/bash-local/README.i18n.yaml
index 0b83b6bf09..72667a855c 100644
--- a/packages/shell/bash-local/README.i18n.yaml
+++ b/packages/shell/bash-local/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/shell/bash-local/README.md
-README.md: 2cd69993b454a462bcbfa43175ff7dc7dba72e01
-README.zh.md: 81436511992d93a2bb81c4f3e242dd2046ec11e8
+README.md: a91eae878ec1fd6db115e11c6a4fea86763f8153
+README.zh.md: f4f5af410310086f7e639c492c31b10943e0f0c8
diff --git a/packages/shell/bash-local/README.md b/packages/shell/bash-local/README.md
index 2cd69993b4..a91eae878e 100644
--- a/packages/shell/bash-local/README.md
+++ b/packages/shell/bash-local/README.md
@@ -139,7 +139,7 @@ These limits define when this executor is a poor fit. They are current package c
 - **Unconfined by itself** — commands run with the harness process's authority; deployments needing confinement compose `dsh-bash-sandbox`, while per-call allow/deny/ask policy belongs on the tools' `pre-execute` waterfall.
 - **No persistent shell or PTY** — every call starts a fresh non-login `bash -c`; cwd-only persistence and interactive terminal sessions remain deferred until a real workflow requires them.
 - **POSIX-only** — the `bash` binary is hardcoded and the underlying service's group semantics are POSIX; Windows is unsupported.
-- **A background provider-failure note is single-delivery** — `SubprocessHandle.done` can reject before or after target execution begins, so the executor injects the stage-neutral `subprocess failed before reporting an outcome: …` into exactly one `readOutput()` delta; a reader that discards that delta cannot recover it.
+- **A background provider-failure note is the whole stderr stream** — `SubprocessHandle.done` can reject before or after target execution begins, and the subprocess service buffers no output for a target that never reported, so the executor serves the stage-neutral `subprocess failed before reporting an outcome: …` as the observed stderr stream (offset readers re-read it at their own offsets) and folds it into exactly one `readOutput()` delta; a consuming reader that discards that delta recovers it only through `observed.stderr`.
 
 <a id="dev-note"></a>
 ### Dev Note
diff --git a/packages/shell/bash-local/README.zh.md b/packages/shell/bash-local/README.zh.md
index 8143651199..f4f5af4103 100644
--- a/packages/shell/bash-local/README.zh.md
+++ b/packages/shell/bash-local/README.zh.md
@@ -139,7 +139,7 @@ if (result.timedOut) console.log('timed out after', result.timeoutMs)
 - **自身不提供隔离**——命令以 harness 进程的权限运行；需要隔离的部署组合 `dsh-bash-sandbox`，每次调用的 allow/deny/ask 策略则属于工具的 `pre-execute` waterfall（瀑布式事件）。
 - **没有持久 shell 或 PTY**——每次调用都启动全新的非登录 `bash -c`；仅持久化 cwd 与交互式终端会话均继续延期，直到真实工作流需要它们。
 - **仅支持 POSIX**——`bash` 二进制已硬编码，底层服务的进程组语义也是 POSIX 的；不支持 Windows。
-- **后台提供方失败提示只交付一次**——`SubprocessHandle.done` 可能在目标命令开始执行前或后被拒绝，因此执行器把不声明失败阶段的 `subprocess failed before reporting an outcome: …` 注入恰好一个 `readOutput()` 增量；丢弃了该增量的读取方无法再恢复它。
+- **后台提供方失败提示就是整条 stderr 流**——`SubprocessHandle.done` 可能在目标命令开始执行前或后被拒绝，而 subprocess 服务不会为从未上报结果的目标命令 缓冲任何输出，因此执行器把不声明失败阶段的 `subprocess failed before reporting an outcome: …` 作为观测到的 stderr 流提供（偏移读取方按各自偏移重读），并只折入恰好一个 `readOutput()` 增量；丢弃了该增量的消耗式读取方只能经 `observed.stderr` 恢复它。
 
 <a id="dev-note"></a>
 ### 开发备注
diff --git a/packages/shell/bash-local/src/index.ts b/packages/shell/bash-local/src/index.ts
index c455eebff5..725e4cbdfc 100644
--- a/packages/shell/bash-local/src/index.ts
+++ b/packages/shell/bash-local/src/index.ts
@@ -287,13 +287,24 @@ export class LocalBashExecutor extends ShellExecutor {
     const running = this.ctx.subprocess.spawn(this.spawnSpec(spec, argv, this.config.maxOutputBytes, spec.signal))
     const collected = LocalBashExecutor.collected(running)
 
-    // A provider rejection has no direct outcome to display; its stage is not
-    // public, so a neutral note is delivered once through the read path.
+    // A provider rejection produces no process output, so the subprocess
+    // service has nothing to buffer: once the provider rejected, its
+    // stage-neutral note is the whole stderr stream for every reader. The
+    // observed reader serves it at offset 0 and the consuming read folds it in
+    // exactly once.
     let providerFailureNote: string | undefined
+    let providerFailureReported = false
     const consumeProviderFailure = (): string => {
-      const note = providerFailureNote ?? ''
-      providerFailureNote = undefined
-      return note
+      if (providerFailureNote === undefined || providerFailureReported) return ''
+      providerFailureReported = true
+      return providerFailureNote
+    }
+    const observedStderr: SubprocessOutputReader = {
+      readFrom: (fromByte) => {
+        if (providerFailureNote === undefined) return collected.stderr.readFrom(fromByte)
+        const note = Buffer.from(providerFailureNote, 'utf8')
+        return { text: note.subarray(Math.min(fromByte, note.length)).toString('utf8'), nextOffset: note.length, lossy: false }
+      },
     }
 
     let stdoutOffset = 0
@@ -302,6 +313,7 @@ export class LocalBashExecutor extends ShellExecutor {
       status: 'running',
       exitCode: null,
       signal: null,
+      observed: { stdout: collected.stdout, stderr: observedStderr },
       done: running.done.then((outcome) => {
         // Any signal termination is killed, including a command signaling itself.
         if (proc.status === 'running') {
@@ -311,7 +323,7 @@ export class LocalBashExecutor extends ShellExecutor {
         proc.signal = outcome.signal
         this.onProcessDone(proc, collected.stderr.readFrom(0).text, false)
       }, (error: unknown) => {
-        // Background provider failures settle as killed and surface through the read path.
+        // Background provider failures settle as killed and surface on stderr for every reader.
         proc.status = 'killed'
         let detail = 'unprintable provider failure'
         try {
diff --git a/packages/shell/bash-local/tests/executor.spec.ts b/packages/shell/bash-local/tests/executor.spec.ts
index 36ae874486..8a8873a627 100644
--- a/packages/shell/bash-local/tests/executor.spec.ts
+++ b/packages/shell/bash-local/tests/executor.spec.ts
@@ -370,7 +370,15 @@ describe('LocalBashExecutor.start (background process handles)', () => {
     // done resolves (never rejects) even though the process never ran.
     await expect(proc.done).resolves.toBeUndefined()
     expect(proc.status).toBe('killed')
-    expect(proc.readOutput().delta).toContain('subprocess failed before reporting an outcome:')
+    // Observers read the note as the whole stderr stream at their own offsets.
+    const first = proc.observed.stderr.readFrom(0)
+    expect(first.text).toMatch(/^subprocess failed before reporting an outcome: /)
+    expect(first).toMatchObject({ nextOffset: Buffer.byteLength(first.text, 'utf8'), lossy: false })
+    expect(proc.observed.stderr.readFrom(first.nextOffset)).toEqual({ text: '', nextOffset: first.nextOffset, lossy: false })
+    expect(proc.observed.stdout.readFrom(0).text).toBe('')
+    // The consuming read folds the same note in exactly once.
+    expect(proc.readOutput().delta).toBe(`[stderr]\n${first.text}`)
+    expect(proc.readOutput().delta).toBe('')
   })
 })
 
diff --git a/packages/shell/pwsh-local/README.i18n.yaml b/packages/shell/pwsh-local/README.i18n.yaml
index ce3d9b02a3..4029d81bb7 100644
--- a/packages/shell/pwsh-local/README.i18n.yaml
+++ b/packages/shell/pwsh-local/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/shell/pwsh-local/README.md
-README.md: 1dbc90835cb95a0e171a33b10c7409a181dd98cf
-README.zh.md: f87c7d435cccb600d123cf80264e027657ef1835
+README.md: 752a0c6cdae826102ca2de35ba671f7b116ff20d
+README.zh.md: 731f6ccc9b20d06e39e7f447c29dd17bcacba2a1
diff --git a/packages/shell/pwsh-local/README.md b/packages/shell/pwsh-local/README.md
index 1dbc90835c..752a0c6cda 100644
--- a/packages/shell/pwsh-local/README.md
+++ b/packages/shell/pwsh-local/README.md
@@ -145,7 +145,7 @@ These limits define when this executor is a poor fit. They are current package c
 - **Unconfined by itself** — commands run with the harness process's authority; deployments needing confinement compose a sandboxing executor or policy instead.
 - **No persistent shell or PTY** — every call starts a fresh `pwsh -Command`.
 - **The command string is PowerShell text** — the `-Command` domain has no shell-quoting layer, but a model-facing command is parsed by PowerShell itself, so PowerShell syntax errors are command failures, not launch failures.
-- **A background provider-failure note is single-delivery** — `SubprocessHandle.done` can reject before or after target execution begins, so the executor injects the stage-neutral `subprocess failed before reporting an outcome: …` into exactly one `readOutput()` delta; a reader that discards that delta cannot recover it.
+- **A background provider-failure note is the whole stderr stream** — `SubprocessHandle.done` can reject before or after target execution begins, and the subprocess service buffers no output for a target that never reported, so the executor serves the stage-neutral `subprocess failed before reporting an outcome: …` as the observed stderr stream (offset readers re-read it at their own offsets) and folds it into exactly one `readOutput()` delta; a consuming reader that discards that delta recovers it only through `observed.stderr`.
 - **Windows termination reports no signal** — a force-killed process settles as exit 1 with `signal: null`, so signal-based status classification does not apply on Windows; `kill()`-initiated stops still stamp `killed` directly.
 - **The encoding preamble precedes the command** — PowerShell requires `param(...)`, `#requires`, and `using` statements at the very top of a script, so a command whose first statement is one of those cannot run under the UTF-8 output preamble; wrap a `param(...)` script in `& { … }`, and run `using`/`#requires` scripts from a file instead.
 - **Non-ASCII stdin under Windows PowerShell 5.1 may be mis-decoded** — the preamble pins output encoding only; `[Console]::InputEncoding` stays at the host default because setting it under redirected stdin throws; pwsh 7 defaults to UTF-8 and is unaffected.
diff --git a/packages/shell/pwsh-local/README.zh.md b/packages/shell/pwsh-local/README.zh.md
index f87c7d435c..731f6ccc9b 100644
--- a/packages/shell/pwsh-local/README.zh.md
+++ b/packages/shell/pwsh-local/README.zh.md
@@ -145,7 +145,7 @@ if (result.timedOut) console.log('timed out after', result.timeoutMs)
 - **自身不提供隔离**——命令以 harness 进程的权限运行；需要隔离的部署组合沙箱执行器或策略。
 - **没有持久 shell 或 PTY**——每次调用都启动全新的 `pwsh -Command`。
 - **命令字符串是 PowerShell 文本**——`-Command` 域没有 shell 引号层，但面向模型的命令由 PowerShell 自己解析，因此 PowerShell 语法错误是命令失败，而非启动失败。
-- **后台提供方失败提示只投递一次**——`SubprocessHandle.done` 可能在目标开始执行前或后被拒绝，因此执行器会将不指明失败阶段的 `subprocess failed before reporting an outcome: …` 注入且仅注入一个 `readOutput()` 增量；丢弃该增量的读取方无法恢复它。
+- **后台提供方失败提示就是整条 stderr 流**——`SubprocessHandle.done` 可能在目标命令开始执行前或后被拒绝，而 subprocess 服务不会为从未上报结果的目标命令 缓冲任何输出，因此执行器把不声明失败阶段的 `subprocess failed before reporting an outcome: …` 作为观测到的 stderr 流提供（偏移读取方按各自偏移重读），并只折入恰好一个 `readOutput()` 增量；丢弃了该增量的消耗式读取方只能经 `observed.stderr` 恢复它。
 - **Windows 终止不报告信号**——被强制终止的进程以退出码 1、`signal: null` 结算，因此基于信号的状态分类在 Windows 上不适用；`kill()` 发起的停止仍会直接标记为 `killed`。
 - **编码 preamble 位于命令之前**——PowerShell 要求 `param(...)`、`#requires` 与 `using` 语句位于脚本最顶部，因此以其中一种开头的命令无法在 UTF-8 输出 preamble 下运行；`param(...)` 脚本请包进 `& { … }`，`using`/`#requires` 脚本请改从文件运行。
 - **Windows PowerShell 5.1 下的非 ASCII stdin 可能被错误解码**——preamble 只固定输出编码；`[Console]::InputEncoding` 保持主机默认，因为在重定向 stdin 下设置它会抛出异常；pwsh 7 默认 UTF-8，不受影响。
diff --git a/packages/shell/pwsh-local/src/index.ts b/packages/shell/pwsh-local/src/index.ts
index bf1dd1cd10..167878f93a 100644
--- a/packages/shell/pwsh-local/src/index.ts
+++ b/packages/shell/pwsh-local/src/index.ts
@@ -321,13 +321,24 @@ export class PwshLocalExecutor extends ShellExecutor {
     const running = this.ctx.subprocess.spawn(this.spawnSpec(spec, this.config.maxOutputBytes, spec.signal, argv))
     const collected = PwshLocalExecutor.collected(running)
 
-    // A provider rejection has no direct outcome to display; its stage is not
-    // public, so a neutral note is delivered once through the read path.
+    // A provider rejection produces no process output, so the subprocess
+    // service has nothing to buffer: once the provider rejected, its
+    // stage-neutral note is the whole stderr stream for every reader. The
+    // observed reader serves it at offset 0 and the consuming read folds it in
+    // exactly once.
     let providerFailureNote: string | undefined
+    let providerFailureReported = false
     const consumeProviderFailure = (): string => {
-      const note = providerFailureNote ?? ''
-      providerFailureNote = undefined
-      return note
+      if (providerFailureNote === undefined || providerFailureReported) return ''
+      providerFailureReported = true
+      return providerFailureNote
+    }
+    const observedStderr: SubprocessOutputReader = {
+      readFrom: (fromByte) => {
+        if (providerFailureNote === undefined) return collected.stderr.readFrom(fromByte)
+        const note = Buffer.from(providerFailureNote, 'utf8')
+        return { text: note.subarray(Math.min(fromByte, note.length)).toString('utf8'), nextOffset: note.length, lossy: false }
+      },
     }
 
     let stdoutOffset = 0
@@ -336,6 +347,7 @@ export class PwshLocalExecutor extends ShellExecutor {
       status: 'running',
       exitCode: null,
       signal: null,
+      observed: { stdout: collected.stdout, stderr: observedStderr },
       done: running.done.then((outcome) => {
         // Any signal termination is killed, including a command signaling itself.
         if (proc.status === 'running') {
@@ -345,7 +357,7 @@ export class PwshLocalExecutor extends ShellExecutor {
         proc.signal = outcome.signal
         this.onProcessDone(proc, collected.stderr.readFrom(0).text, false)
       }, (error: unknown) => {
-        // Background provider failures settle as killed and surface through the read path.
+        // Background provider failures settle as killed and surface on stderr for every reader.
         proc.status = 'killed'
         let detail = 'unprintable provider failure'
         try {
diff --git a/packages/shell/pwsh-local/tests/executor.spec.ts b/packages/shell/pwsh-local/tests/executor.spec.ts
index 1e21231a26..3d893e0cd3 100644
--- a/packages/shell/pwsh-local/tests/executor.spec.ts
+++ b/packages/shell/pwsh-local/tests/executor.spec.ts
@@ -294,6 +294,45 @@ describe('spawn construction (pure, every platform)', () => {
   })
 })
 
+describe('background spawn failure (fake backend, every platform)', () => {
+  /** A subprocess service whose spawn rejects the way a missing pwsh does. */
+  class RejectingSubprocessRuntime extends SubprocessRuntime {
+    override async terminalEnvironment() { return { platform: 'posix' as const } }
+    override async resolveExecutable(command: string): Promise<string> { return command }
+    override spawnTerminal(): Promise<never> { throw new Error('pwsh spawns pipes, never terminals') }
+    private readonly reader: SubprocessOutputReader = {
+      readFrom: () => ({ text: '', lossy: false, nextOffset: 0 }),
+    }
+    override spawn(): SubprocessHandle {
+      return {
+        stdin: undefined,
+        stdout: undefined,
+        stderr: undefined,
+        control: undefined,
+        collected: { stdout: this.reader, stderr: this.reader },
+        done: Promise.reject(new Error('spawn pwsh ENOENT')),
+        terminate: () => {},
+        waitForExit: async () => true,
+      }
+    }
+  }
+
+  it('serves the note as the whole observed stderr stream and folds it into one consuming delta', async () => {
+    const ctx = new Context()
+    new RejectingSubprocessRuntime(ctx)
+    await ctx.plugin(PwshLocalExecutor)
+    const proc = await ctx.shell.start(ctx.shell.resolve({ command: 'Write-Output hi' }))
+    await expect(proc.done).resolves.toBeUndefined()
+    expect(proc.status).toBe('killed')
+    const note = 'subprocess failed before reporting an outcome: Error: spawn pwsh ENOENT'
+    expect(proc.observed.stderr.readFrom(0)).toEqual({ text: note, nextOffset: Buffer.byteLength(note), lossy: false })
+    expect(proc.observed.stderr.readFrom(Buffer.byteLength(note))).toEqual({ text: '', nextOffset: Buffer.byteLength(note), lossy: false })
+    expect(proc.observed.stdout.readFrom(0).text).toBe('')
+    expect(proc.readOutput().delta).toBe(`[stderr]\n${note}`)
+    expect(proc.readOutput().delta).toBe('')
+  })
+})
+
 describe.skipIf(!hasPwsh)('PwshLocalExecutor.run', () => {
   it('resolves with output and the effective timeout', { timeout: 15_000 }, async () => {
     const { bash } = await setup({ timeoutMs: 10_000 })
diff --git a/packages/shell/shell/README.i18n.yaml b/packages/shell/shell/README.i18n.yaml
index 2d142673ab..556c7479d9 100644
--- a/packages/shell/shell/README.i18n.yaml
+++ b/packages/shell/shell/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/shell/shell/README.md
-README.md: 9b32149691a8cf4d4d8316101f4feec6762d0846
-README.zh.md: 9d23b0c5957f9d59169c53c92b960c0b26b77a23
+README.md: 49e101612618405ad0b877df3e4cbf4d3f491155
+README.zh.md: 77e89a9b4bf749d91e1120541bf6799f9d72f3e3
diff --git a/packages/shell/shell/README.md b/packages/shell/shell/README.md
index 9b32149691..49e1016126 100644
--- a/packages/shell/shell/README.md
+++ b/packages/shell/shell/README.md
@@ -38,7 +38,7 @@ console.log(result.exitCode, result.stdout.text)
 
 ### Background processes
 
-Await `start` with a resolved spec to launch a background process; it publishes the handle after preparation and applies no background execution timeout. Cancellation or preparation failure rejects before publication. Read output incrementally with `readOutput()` — consecutive reads never repeat output, and lossy reads point at full-stream spill files. Terminate the provider-managed range with `kill()` (returns `false` once the direct command has finished) and await `done` for direct-command settlement. Job ids, ownership, polling, and notices belong to the generic `ctx.jobs` runtime, where the tool layer registers the handle.
+Await `start` with a resolved spec to launch a background process; it publishes the handle after preparation and applies no background execution timeout. Cancellation or preparation failure rejects before publication. Read output incrementally with `readOutput()` — consecutive reads never repeat output, and lossy reads point at full-stream spill files. Terminate the provider-managed range with `kill()` (returns `false` once the direct command has finished) and await `done` for direct-command settlement. Job ids, ownership, polling, and notices belong to the generic `ctx.jobs` runtime, where the tool layer registers the handle. `ShellProcess.observed` exposes non-consuming offset readers over the same captured streams — for observers independent of the consuming cursor, such as the job registry's pump — and every provider serves them, including the provider-failure note of a spawn that never ran.
 
 ### Requests and resolved specs
 
diff --git a/packages/shell/shell/README.zh.md b/packages/shell/shell/README.zh.md
index 9d23b0c595..77e89a9b4b 100644
--- a/packages/shell/shell/README.zh.md
+++ b/packages/shell/shell/README.zh.md
@@ -38,7 +38,7 @@ console.log(result.exitCode, result.stdout.text)
 
 ### 后台进程
 
-用已解析的 spec 等待 `start` 即可启动后台进程；它在准备完成后发布句柄，不应用后台执行超时。取消或准备失败会在发布前拒绝调用。用 `readOutput()` 增量读取输出——连续读取绝不会重复交付，有损读取会指向完整流的 spill 文件。用 `kill()` 终止由提供方管理的进程范围（直接命令结束后返回 `false`），并等待 `done` 完成直接命令结算。job id、所有权、轮询与通知属于通用 `ctx.jobs` 运行时，工具层会把句柄注册进去。
+用已解析的 spec 等待 `start` 即可启动后台进程；它在准备完成后发布句柄，不应用后台执行超时。取消或准备失败会在发布前拒绝调用。用 `readOutput()` 增量读取输出——连续读取绝不会重复交付，有损读取会指向完整流的 spill 文件。用 `kill()` 终止由提供方管理的进程范围（直接命令结束后返回 `false`），并等待 `done` 完成直接命令结算。job id、所有权、轮询与通知属于通用 `ctx.jobs` 运行时，工具层会把句柄注册进去。`ShellProcess.observed` 在同一份捕获流上暴露非消费的偏移读取器——供独立于消费游标的观察者（例如 job 注册表的泵）使用——每个提供方都必须提供，包括从未真正运行的命令留下的提供方失败提示。
 
 ### 请求与已解析 spec
 
diff --git a/packages/shell/shell/src/types.ts b/packages/shell/shell/src/types.ts
index 8964d76b5b..ba32255167 100644
--- a/packages/shell/shell/src/types.ts
+++ b/packages/shell/shell/src/types.ts
@@ -8,10 +8,24 @@
  */
 
 import type { SandboxEnforcement, SandboxExecutionPolicy, SandboxMode } from '@deepseek-ai/dsh-sandbox'
-import type { CollectedOutput, DshEnvironment } from '@deepseek-ai/dsh-subprocess'
+import type { CollectedOutput, DshEnvironment, SubprocessOutputReader } from '@deepseek-ai/dsh-subprocess'
 
 export { DSH_ENV_PREFIX } from '@deepseek-ai/dsh-subprocess'
-export type { CollectedOutput, DshEnvironment, DshEnvironmentKey } from '@deepseek-ai/dsh-subprocess'
+export type { CollectedOutput, DshEnvironment, DshEnvironmentKey, SubprocessOutputRead, SubprocessOutputReader } from '@deepseek-ai/dsh-subprocess'
+
+/**
+ * Non-consuming offset readers over a background process's captured streams,
+ * for observers independent of the consuming {@link ShellProcess.readOutput}
+ * cursor. Every background process exposes both streams; a spawn that
+ * rejected produced no process output, so its stderr reader serves the
+ * `spawn failed: …` note as the whole stream.
+ */
+export interface ShellObservedStreams {
+  /** Offset reader over captured stdout. */
+  stdout: SubprocessOutputReader
+  /** Offset reader over captured stderr (the spawn-failure note after a rejected spawn). */
+  stderr: SubprocessOutputReader
+}
 
 /**
  * Sandbox facts for one run, present iff a sandboxing executor handled it.
@@ -178,6 +192,13 @@ export interface ShellProcess {
    * full-stream spill files when available.
    */
   readOutput(): ShellProcessRead
+  /**
+   * Non-consuming offset readers over the same captured streams the consuming
+   * {@link readOutput} cursor drains, including the provider-failure note a
+   * rejected spawn leaves on stderr. Independent observers read here at their
+   * own offsets without stealing bytes from `readOutput`.
+   */
+  observed: ShellObservedStreams
   /**
    * Terminate the provider-managed range. Returns false when it had already finished
    * (no-op); idempotent.
diff --git a/packages/shell/shell/tests/service.spec.ts b/packages/shell/shell/tests/service.spec.ts
index 1a988ed8f3..91523cdfd9 100644
--- a/packages/shell/shell/tests/service.spec.ts
+++ b/packages/shell/shell/tests/service.spec.ts
@@ -3,6 +3,9 @@ import { Context } from '@deepseek-ai/cordis'
 import { ShellExecutor } from '@deepseek-ai/dsh-shell'
 import type { ShellExecRequest, ShellExecSpec, ShellProcess, ShellProcessRead, ShellRunResult } from '@deepseek-ai/dsh-shell'
 
+/** Empty offset readers for fakes that never produce output. */
+const silentReader = { readFrom: (fromByte: number) => ({ text: '', nextOffset: fromByte, lossy: false }) }
+
 /**
  * Minimal concrete executor: canned foreground results, a hand-built process
  * handle. The seam is TASK-FREE (start returns a {@link ShellProcess} handle;
@@ -40,6 +43,7 @@ class StubExecutor extends ShellExecutor {
       signal: null,
       done: Promise.resolve(),
       readOutput: (): ShellProcessRead => ({ delta: '', lossy: false }),
+      observed: { stdout: silentReader, stderr: silentReader },
       kill: (): boolean => {
         if (proc.status !== 'running') return false
         proc.status = 'killed'
diff --git a/packages/shell/tool-bash/README.i18n.yaml b/packages/shell/tool-bash/README.i18n.yaml
index f3b351a17c..730d782903 100644
--- a/packages/shell/tool-bash/README.i18n.yaml
+++ b/packages/shell/tool-bash/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/shell/tool-bash/README.md
-README.md: 5426cc17ccefc7eecf511355734e168377fc2d0f
-README.zh.md: f48c6cb1a9f37da08ccc816eed37c9fbd35eeb62
+README.md: 34b3042e4cd0ab2d54d3cbc038b71b584391b47d
+README.zh.md: 0872a0f1fbf41389483df44624d15ffcb07936ec
diff --git a/packages/shell/tool-bash/README.md b/packages/shell/tool-bash/README.md
index 5426cc17cc..34b3042e4c 100644
--- a/packages/shell/tool-bash/README.md
+++ b/packages/shell/tool-bash/README.md
@@ -56,7 +56,7 @@ The tool executes `bash -c <command>` and returns the combined output. Commands
 <a id="running-long-commands-in-the-background"></a>
 ### Running long commands in the background
 
-Passing `run_in_background: true` admits a job and returns its id immediately; confinement preparation may still be pending, and no background execution timeout applies. Output is empty until the process is available. Job cancellation aborts preparation and stops any process that arrives afterward; startup failure settles the admitted job as failed. The agent reads its output with `job_output` (non-blocking unless `wait: true`), lists jobs with `job_list`, and stops it with `job_kill`; a finished job notifies the owning agent in-session. Background support needs the generic job runtime (`dsh-jobs-local`) and its control tools (`dsh-tool-jobs`) mounted.
+Passing `run_in_background: true` admits a job and returns its id immediately; confinement preparation may still be pending, and no background execution timeout applies. Output is empty until the process is available. Job cancellation aborts preparation and stops any process that arrives afterward; startup failure settles the admitted job as failed. The agent reads its output with `job_output` (non-blocking unless `wait: true`), lists jobs with `job_list`, and stops it with `job_kill`; a finished job notifies the owning agent in-session. Background support needs the generic job runtime (`dsh-jobs-local`) and its control tools (`dsh-tool-jobs`) mounted. The background job hands the run's non-consuming `observed` readers to the job registry as pull sources; the registry pumps them into the job's output ring at its own cadence (`pumpPollMs` on `dsh-jobs-local`), so the Web client streams live output and the model's `job_output` reads consume the same bytes through a separate cursor. A reader that throws is logged once and its stream stops; the job runs on to its own settlement. The ring is a best-effort live preview: stdout and stderr are copied per poll round, so writes the two streams made inside one poll window appear stdout first rather than in write order.
 
 ### Sandboxed execution and escalation
 
diff --git a/packages/shell/tool-bash/README.zh.md b/packages/shell/tool-bash/README.zh.md
index f48c6cb1a9..0872a0f1fb 100644
--- a/packages/shell/tool-bash/README.zh.md
+++ b/packages/shell/tool-bash/README.zh.md
@@ -56,7 +56,7 @@ kind: "package-reference"
 <a id="running-long-commands-in-the-background"></a>
 ### 后台运行长时间命令
 
-传入 `run_in_background: true` 会准入任务并立即返回 job id；限制准备可能仍在进行，且不设后台执行超时。进程可用前输出为空。任务取消会中止准备并停止随后返回的进程；启动失败使已准入任务以失败状态结算。agent 用 `job_output` 读取输出（除非 `wait: true`，否则非阻塞）、用 `job_list` 列出任务、用 `job_kill` 停止任务；完成的任务会在会话内通知拥有它的 agent。后台支持需要挂载通用任务运行时（`dsh-jobs-local`）及其控制工具（`dsh-tool-jobs`）。
+传入 `run_in_background: true` 会准入任务并立即返回 job id；限制准备可能仍在进行，且不设后台执行超时。进程可用前输出为空。任务取消会中止准备并停止随后返回的进程；启动失败使已准入任务以失败状态结算。agent 用 `job_output` 读取输出（除非 `wait: true`，否则非阻塞）、用 `job_list` 列出任务、用 `job_kill` 停止任务；完成的任务会在会话内通知拥有它的 agent。后台支持需要挂载通用任务运行时（`dsh-jobs-local`）及其控制工具（`dsh-tool-jobs`）。后台 job 把运行的非消费 `observed` 读取器交给 job 注册表作为拉式源；注册表按自己的节奏（`dsh-jobs-local` 的 `pumpPollMs`）把它们泵入 job 的输出环，Web 客户端由此流式看到实时输出，模型的 `job_output` 读取则经另一个游标消费同一份字节。读取器抛错只记录一次，该流就此停止，job 继续跑到自己的结算。输出环是尽力而为的实时预览：stdout 与 stderr 按轮询轮次复制，同一个轮询窗口内两条流的写入会先 stdout 后 stderr 出现，而不是按写入顺序。
 
 ### 沙箱执行与升权
 
diff --git a/packages/shell/tool-bash/src/background.ts b/packages/shell/tool-bash/src/background.ts
index c2087f3698..0bdb2dc4d1 100644
--- a/packages/shell/tool-bash/src/background.ts
+++ b/packages/shell/tool-bash/src/background.ts
@@ -1,41 +1,87 @@
 /**
- * Generic-task adaptation for background bash process handles.
+ * Generic-job adaptation for background bash process handles: the terminal
+ * outcome the registry records and the pull sources it pumps.
  *
  * @module @deepseek-ai/dsh-tool-bash/background
  */
 
-import type { ShellProcess } from '@deepseek-ai/dsh-shell'
-import type { JobHooks, JobOutcome } from '@deepseek-ai/dsh-jobs'
+import type { SandboxMode } from '@deepseek-ai/dsh-sandbox'
+import { escalationHintMarker, sandboxDenialMarker } from '@deepseek-ai/dsh-sandbox'
+import type { ShellProcess, ShellSandboxInfo } from '@deepseek-ai/dsh-shell'
+import type { JobHooks, JobOutcome, JobOutputSource } from '@deepseek-ai/dsh-jobs'
 
 /**
- * Map a settled background process onto the generic task-outcome vocabulary:
+ * Sandbox facts worth the terminal detail: a runner that never ran the
+ * command, or a denial (with the escalation hint this composition offers).
+ * @param sandbox - settled sandbox facts, when this was a confined process.
+ * @param escalationModes - escalation targets advertised by this composition.
+ * @returns the markers to append, oldest first.
+ */
+function sandboxNotes(sandbox: ShellSandboxInfo | undefined, escalationModes: readonly SandboxMode[]): string[] {
+  if (sandbox?.runnerFailed) {
+    return [`[sandbox: the sandbox runner itself failed under ${sandbox.mode} mode — the command did not run; this is a sandbox problem, not a command failure]`]
+  }
+  if (sandbox?.denied) {
+    const notes = [sandboxDenialMarker(sandbox.mode)]
+    if (escalationModes.length > 0) notes.push(escalationHintMarker('command'))
+    return notes
+  }
+  return []
+}
+
+/**
+ * Map a settled background process onto the generic job-outcome vocabulary:
  * `killed` stays `killed` (detail: the signal when one is known), everything
  * else is `completed` with the exit code as detail. A nonzero command exit is
- * reported, not failed, exactly like the foreground rendering.
+ * reported, not failed, exactly like the foreground rendering. Sandbox facts
+ * join the detail, since a job's terminal reason is the one line every
+ * reader — the model's status line, the roster row — shows.
  * @param proc - the settled process handle.
+ * @param escalationModes - escalation targets advertised by this composition.
  * @returns the outcome for the `ctx.jobs` registration.
  */
-export function processOutcome(proc: ShellProcess): { status: 'completed' | 'killed'; detail: string } {
+export function processOutcome(proc: ShellProcess, escalationModes: readonly SandboxMode[] = []): JobOutcome {
   // TODO(background-infrastructure-outcome): widen ShellProcess with an explicit
-  // infrastructure-failure outcome, then map it to task `failed`. Restricted
+  // infrastructure-failure outcome, then map it to job `failed`. Restricted
   // runner failures expose sandbox.runnerFailed, but unconfined spawn failures
   // still alias a signal-less kill; real nonzero command exits must remain
   // `completed`.
-  if (proc.status === 'killed') {
-    return { status: 'killed', detail: proc.signal !== null ? `signal: ${proc.signal}` : 'killed before exit' }
-  }
-  return { status: 'completed', detail: `exit code: ${proc.exitCode ?? 0}` }
+  const base: JobOutcome = proc.status === 'killed'
+    ? { status: 'killed', detail: proc.signal !== null ? `signal: ${proc.signal}` : 'killed before exit' }
+    : { status: 'completed', detail: `exit code: ${proc.exitCode ?? 0}` }
+  const notes = sandboxNotes(proc.sandbox, escalationModes)
+  return notes.length === 0 ? base : { ...base, detail: `${base.detail}; ${notes.join(' ')}` }
+}
+
+/**
+ * The process's non-consuming stream readers as registry pull sources. They
+ * bind lazily because the process is spawned inside the starter, after the
+ * registry admitted the job; a read before the spawn yields nothing, and the
+ * pump keeps the model's consuming cursor untouched. A rejected spawn's
+ * stderr reader carries the provider's `spawn failed: …` note.
+ * @param proc - the started process's observed streams, once the starter has spawned it.
+ * @returns one source per stream, stdout first.
+ */
+export function processSources(proc: () => Pick<ShellProcess, 'observed'> | undefined): JobOutputSource[] {
+  const source = (channel: 'stdout' | 'stderr'): JobOutputSource => ({
+    channel,
+    read: (fromByte) => {
+      const live = proc()
+      return live === undefined ? { text: '', nextOffset: fromByte, lossy: false } : live.observed[channel].readFrom(fromByte)
+    },
+  })
+  return [source('stdout'), source('stderr')]
 }
 
 /**
  * Adapt asynchronous shell preparation after job admission without exposing a partial process.
  * @param start - starts the process with job-owned cancellation.
- * @param renderOutput - consumes output from a published process.
+ * @param outcome - projects the settled process into the job outcome.
  * @returns synchronous job hooks whose completion includes preparation and process settlement.
  */
 export function processJob(
   start: (signal: AbortSignal) => Promise<ShellProcess>,
-  renderOutput: (process: ShellProcess) => string,
+  outcome: (process: ShellProcess) => JobOutcome,
 ): JobHooks {
   const controller = new AbortController()
   let process: ShellProcess | undefined
@@ -47,7 +93,7 @@ export function processJob(
       } finally {
         await process.done
       }
-      return processOutcome(process)
+      return outcome(process)
     } catch (error: unknown) {
       return {
         status: controller.signal.aborted && process === undefined ? 'killed' : 'failed',
@@ -62,6 +108,5 @@ export function processJob(
       process?.kill()
     },
     done,
-    readOutput: () => process === undefined ? '' : renderOutput(process),
   }
 }
diff --git a/packages/shell/tool-bash/src/index.ts b/packages/shell/tool-bash/src/index.ts
index fd59129f49..7e1f6227e2 100644
--- a/packages/shell/tool-bash/src/index.ts
+++ b/packages/shell/tool-bash/src/index.ts
@@ -22,9 +22,9 @@ import type { SandboxExecutionPolicy, SandboxMode } from '@deepseek-ai/dsh-sandb
 import { ESCALATION_TARGETS, approveEscalation, validateEscalationArgs } from '@deepseek-ai/dsh-sandbox'
 import type { SandboxPolicyService } from '@deepseek-ai/dsh-sandbox-policy'
 import { DSH_ENV_PREFIX } from '@deepseek-ai/dsh-shell'
-import type { ShellRunResult } from '@deepseek-ai/dsh-shell'
-import { processJob } from './background.ts'
-import { parseExitStatus, renderProcessRead, renderResult } from './render.ts'
+import type { ShellRunResult, ShellProcess } from '@deepseek-ai/dsh-shell'
+import { processJob, processOutcome, processSources } from './background.ts'
+import { parseExitStatus, renderResult } from './render.ts'
 
 export const name = 'tool-bash'
 export const inject = ['tools', 'shell', 'systemPrompt', 'shellEnv']
@@ -363,14 +363,21 @@ export function apply(ctx: Context, config: Config = {}): void {
           error.name = 'AbortError'
           throw error
         }
-        // Task preflight finishes before the starter can spawn a process.
+        // The registry pumps the process's non-consuming readers into the
+        // job's ring; the sources bind lazily because the process is spawned
+        // only once admission has passed.
+        let proc: ShellProcess | undefined
         const id = jobs.start({
           kind: 'bash',
           label: args.command,
-          ...exec.agent ? { owner: exec.agent } : {},
+          ...exec.agent ? { owner: exec.agent.id } : {},
+          output: processSources(() => proc),
           run: () => processJob(
-            signal => ctx.shell.start(ctx.shell.resolve({ ...request, signal })),
-            proc => renderProcessRead(proc.readOutput(), proc.sandbox, escalationModes),
+            async (signal) => {
+              proc = await ctx.shell.start(ctx.shell.resolve({ ...request, signal }))
+              return proc
+            },
+            started => processOutcome(started, escalationModes),
           ),
         })
         return { kind: 'background' as const, jobId: id }
diff --git a/packages/shell/tool-bash/src/render.ts b/packages/shell/tool-bash/src/render.ts
index 82403cca44..a13b8348f1 100644
--- a/packages/shell/tool-bash/src/render.ts
+++ b/packages/shell/tool-bash/src/render.ts
@@ -4,7 +4,7 @@
  * @module @deepseek-ai/dsh-tool-bash/render
  */
 
-import type { ShellProcessRead, ShellRunResult, ShellSandboxInfo, CollectedOutput } from '@deepseek-ai/dsh-shell'
+import type { ShellRunResult, CollectedOutput } from '@deepseek-ai/dsh-shell'
 import type { SandboxMode } from '@deepseek-ai/dsh-sandbox'
 import { escalationHintMarker, sandboxDenialMarker } from '@deepseek-ai/dsh-sandbox'
 
@@ -62,38 +62,6 @@ export function renderResult(
   return body + markers.join('\n')
 }
 
-/**
- * Shape one background-process read into the `job_output` delta the model
- * sees: the incremental delta, plus the lossy-read notice (with full-stream
- * spill paths) when in-memory truncation dropped unread bytes. Empty-delta
- * rendering (`(no new output)`) is the generic job controller's job.
- * @param read - one incremental read from the process handle.
- * @param sandbox - settled sandbox facts, when this was a confined process.
- * @param escalationModes - escalation targets advertised by this composition.
- * @returns the delta text with any loss or sandbox notice appended.
- */
-export function renderProcessRead(
-  read: ShellProcessRead,
-  sandbox?: ShellSandboxInfo,
-  escalationModes: readonly SandboxMode[] = [],
-): string {
-  const notices: string[] = []
-  if (read.lossy) {
-    const paths = [read.stdoutSpillPath, read.stderrSpillPath].filter((path): path is string => path !== undefined)
-    notices.push(`[some output was dropped from memory; full output: ${paths.length > 0 ? paths.join(', ') : '(unavailable)'}]`)
-  }
-  if (sandbox?.runnerFailed) {
-    notices.push(`[sandbox: the sandbox runner itself failed under ${sandbox.mode} mode — the command did not run; this is a sandbox problem, not a command failure]`)
-  } else if (sandbox?.denied) {
-    notices.push(sandboxDenialMarker(sandbox.mode))
-    if (escalationModes.length > 0) {
-      notices.push(escalationHintMarker('command'))
-    }
-  }
-  if (notices.length === 0) return read.delta
-  return `${read.delta}${read.delta.length > 0 && !read.delta.endsWith('\n') ? '\n' : ''}${notices.join('\n')}`
-}
-
 /**
  * The exit-status parse is the shared marker-contract half of the shell-tool
  * rendering story, owned by `@deepseek-ai/dsh-shell` so `dsh-tool-pwsh` reuses
diff --git a/packages/shell/tool-bash/tests/background-start.spec.ts b/packages/shell/tool-bash/tests/background-start.spec.ts
index 19e31e3a10..4140d50c44 100644
--- a/packages/shell/tool-bash/tests/background-start.spec.ts
+++ b/packages/shell/tool-bash/tests/background-start.spec.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it, onTestFinished, vi } from 'vitest'
 import type { ShellProcess } from '@deepseek-ai/dsh-shell'
-import { processJob } from '../src/background.ts'
+import { processJob, processOutcome, processSources } from '../src/background.ts'
 
 function processHandle() {
   const exited = Promise.withResolvers<undefined>()
@@ -12,25 +12,34 @@ function processHandle() {
     killed.resolve(undefined)
     return true
   })
+  const readOutput = vi.fn(() => ({ delta: 'output', lossy: false }))
   const process: ShellProcess = {
     status: 'running', exitCode: null, signal: null, done: exited.promise,
-    readOutput: () => ({ delta: 'output', lossy: false }), kill,
+    readOutput, kill,
+    observed: {
+      stdout: { readFrom: fromByte => ({ text: 'output'.slice(fromByte), nextOffset: 6, lossy: false }) },
+      stderr: { readFrom: () => ({ text: '', nextOffset: 0, lossy: false }) },
+    },
   }
   onTestFinished(() => { exited.resolve(undefined) })
-  return { process, exited, killed, kill }
+  return { process, exited, killed, kill, readOutput }
 }
 
 describe('background job ownership during asynchronous shell startup', () => {
-  it('keeps output empty until a process is published and then consumes its output', async () => {
+  it('keeps observation empty during preparation and reads published output without consuming it', async () => {
     const child = processHandle()
     const prepared = Promise.withResolvers<ShellProcess>()
-    const render = vi.fn((process: ShellProcess) => process.readOutput().delta)
-    const hooks = processJob(() => prepared.promise, render)
-    expect(hooks.readOutput!()).toBe('')
-    expect(render).not.toHaveBeenCalled()
+    let published: ShellProcess | undefined
+    const source = processSources(() => published)[0]!
+    const outcome = vi.fn(processOutcome)
+    const hooks = processJob(async () => { published = await prepared.promise; return published }, outcome)
+    expect(source.read(0).text).toBe('')
+    expect(outcome).not.toHaveBeenCalled()
     prepared.resolve(child.process)
     await Promise.resolve()
-    expect(hooks.readOutput!()).toBe('output')
+    expect(source.read(0).text).toBe('output')
+    expect(source.read(0).text).toBe('output')
+    expect(child.readOutput).not.toHaveBeenCalled()
     child.process.status = 'completed'
     child.process.exitCode = 5
     child.exited.resolve(undefined)
@@ -44,19 +53,18 @@ describe('background job ownership during asynchronous shell startup', () => {
       return new Promise<ShellProcess>((_resolve, reject) => {
         signal.addEventListener('abort', () => { reject(new Error(String(signal.reason))) }, { once: true })
       })
-    }, () => 'unreachable')
+    }, processOutcome)
     expect(received?.aborted).toBe(false)
     hooks.cancel('cancel pending confinement')
     hooks.cancel('later cancellation')
     expect(received?.reason).toBe('cancel pending confinement')
     expect(await hooks.done).toEqual({ status: 'killed', detail: 'cancel pending confinement' })
-    expect(hooks.readOutput!()).toBe('')
   })
 
   it('kills a process that materializes after cancellation and awaits its exit', async () => {
     const child = processHandle()
     const prepared = Promise.withResolvers<ShellProcess>()
-    const hooks = processJob(() => prepared.promise, () => 'output')
+    const hooks = processJob(() => prepared.promise, processOutcome)
     let settled = false
     void hooks.done.then(() => { settled = true })
     hooks.cancel('cancel before process publication')
@@ -70,7 +78,7 @@ describe('background job ownership during asynchronous shell startup', () => {
 
   it('cancels a published process once and keeps done pending until exit', async () => {
     const child = processHandle()
-    const hooks = processJob(async () => child.process, () => 'output')
+    const hooks = processJob(async () => child.process, processOutcome)
     await Promise.resolve()
     let settled = false
     void hooks.done.then(() => { settled = true })
@@ -88,7 +96,7 @@ describe('background job ownership during asynchronous shell startup', () => {
     const attempted = Promise.withResolvers<undefined>()
     vi.mocked(child.kill).mockImplementation(() => { attempted.resolve(undefined); throw new Error('termination failed') })
     const prepared = Promise.withResolvers<ShellProcess>()
-    const hooks = processJob(() => prepared.promise, () => '')
+    const hooks = processJob(() => prepared.promise, processOutcome)
     let settled = false
     void hooks.done.then(() => { settled = true })
     hooks.cancel('stop before publication')
@@ -100,17 +108,16 @@ describe('background job ownership during asynchronous shell startup', () => {
   })
 
   it('reports a startup failure through job completion without publishing output', async () => {
-    const render = vi.fn(() => 'unreachable')
+    const render = vi.fn(processOutcome)
     const hooks = processJob(async () => { throw new Error('remote sandbox unavailable') }, render)
     expect(await hooks.done).toEqual({ status: 'failed', detail: 'remote sandbox unavailable' })
-    expect(hooks.readOutput!()).toBe('')
     expect(render).not.toHaveBeenCalled()
   })
 
   it('reports a primitive upstream abort reason as a failed startup', async () => {
     const upstream = new AbortController()
     upstream.abort('upstream preparation stopped')
-    const hooks = processJob(async () => { upstream.signal.throwIfAborted(); throw new Error('unreachable') }, () => '')
+    const hooks = processJob(async () => { upstream.signal.throwIfAborted(); throw new Error('unreachable') }, processOutcome)
     expect(await hooks.done).toEqual({ status: 'failed', detail: 'upstream preparation stopped' })
   })
 })
diff --git a/packages/shell/tool-bash/tests/background.spec.ts b/packages/shell/tool-bash/tests/background.spec.ts
new file mode 100644
index 0000000000..1fe2292f37
--- /dev/null
+++ b/packages/shell/tool-bash/tests/background.spec.ts
@@ -0,0 +1,216 @@
+import { mkdtempSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { Context } from '@deepseek-ai/cordis'
+import { ToolCallId } from '@deepseek-ai/dsh-llm'
+import { Session, SessionId } from '@deepseek-ai/dsh-session'
+import { SESSION_FORMAT_VERSION } from '@deepseek-ai/dsh-session/types'
+import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
+import ToolRuntime from '@deepseek-ai/dsh-tools'
+import AgentRegistry from '@deepseek-ai/dsh-agent'
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import { unsupportedInbox } from '@deepseek-ai/dsh-agent-loop-testkit'
+import LocalJobRegistry from '@deepseek-ai/dsh-jobs-local'
+import type { JobId } from '@deepseek-ai/dsh-jobs'
+import * as ToolTasks from '@deepseek-ai/dsh-tool-jobs'
+import type { ShellProcess } from '@deepseek-ai/dsh-shell'
+import { LocalBashExecutor } from '@deepseek-ai/dsh-bash-local'
+import LocalSubprocessRuntime from '@deepseek-ai/dsh-subprocess-local'
+import * as ToolBash from '@deepseek-ai/dsh-tool-bash'
+import { processSources } from '../src/background.ts'
+import * as BashEnvPlugin from '@deepseek-ai/dsh-shell-env'
+
+const testToolSignal = new AbortController().signal
+const spillDir = mkdtempSync(join(tmpdir(), 'dsh-tool-bash-background-spec-'))
+
+/** Job harness with a fast registry pump for tests. */
+async function setup() {
+  const ctx = new Context()
+  await ctx.plugin(SystemPrompt)
+  await ctx.plugin(ToolRuntime)
+  await ctx.plugin(AgentRegistry)
+  await ctx.plugin(LocalJobRegistry, { pumpPollMs: 25 })
+  await ctx.plugin(ToolTasks)
+  await ctx.plugin(LocalSubprocessRuntime)
+  ;(ctx.subprocess as LocalSubprocessRuntime).internals = { spillDir }
+  await ctx.plugin(BashEnvPlugin)
+  await ctx.plugin(LocalBashExecutor, { timeoutMs: 10_000, graceMs: 200 })
+  await ctx.plugin(ToolBash)
+  return ctx
+}
+
+let callCounter = 0
+function call(ctx: Context, args: Record<string, unknown>) {
+  return ctx.tools.execute({
+    signal: testToolSignal,
+    callId: ToolCallId(`background-call-${++callCounter}`),
+    name: 'bash',
+    arguments: args,
+  })
+}
+
+function text(result: { content: { type: string; text?: string }[] }): string {
+  return result.content.filter(block => block.type === 'text').map(block => block.text).join('')
+}
+
+async function until<T>(read: () => T | undefined, timeoutMs = 5_000): Promise<T> {
+  const deadline = Date.now() + timeoutMs
+  while (Date.now() < deadline) {
+    const value = read()
+    if (value !== undefined) return value
+    await new Promise(resolve => setTimeout(resolve, 20))
+  }
+  throw new Error('condition not reached before timeout')
+}
+
+function retainedText(ctx: Context, id: JobId, caller?: Agent): string {
+  return ctx.jobs.readAt(id, 0, caller?.id).chunks.map(chunk => chunk.text).join('')
+}
+
+describe('background bash output', () => {
+  it('streams a background run into the job ring with live output and settlement', async () => {
+    const ctx = await setup()
+    const ack = await call(ctx, {
+      command: 'printf "line-1\\n"; sleep 0.4; printf "line-2\\n"',
+      description: 'test command',
+      run_in_background: true,
+    })
+    expect(text(ack)).toContain('started background job')
+    const jobs = ctx.jobs
+    const job = jobs.list()[0]
+    expect(job).toBeDefined()
+
+    // Live output appears in the ring while the command is still running.
+    await until(() => retainedText(ctx, job!.id).includes('line-1') ? true : undefined)
+    expect(jobs.get(job!.id).status).toBe('running')
+
+    // Settlement ends the ring with the job; the trailing bytes are drained first.
+    await until(() => jobs.get(job!.id).status === 'completed' ? true : undefined)
+    expect(jobs.get(job!.id).detail).toBe('exit code: 0')
+    expect(retainedText(ctx, job!.id)).toContain('line-2')
+
+    // The model-facing consuming cursor reads the same bytes: observation stole nothing.
+    const consumed = jobs.read(job!.id).chunks.map(chunk => chunk.text).join('')
+    expect(consumed).toContain('line-1')
+    expect(consumed).toContain('line-2')
+  })
+
+  it('a killed background job settles killed with the kill reason merged into its detail', async () => {
+    const ctx = await setup()
+    await call(ctx, { command: 'sleep 60', description: 'test command', run_in_background: true })
+    const jobs = ctx.jobs
+    const job = jobs.list()[0]
+    jobs.kill(job!.id, undefined, 'test cleanup')
+    await until(() => jobs.get(job!.id).status === 'killed' ? true : undefined)
+    expect(jobs.get(job!.id).detail).toMatch(/(signal|killed before exit).*; test cleanup$/)
+  })
+
+  it('a background spawn failure reaches the model as the stderr note master rendered', async () => {
+    const ctx = await setup()
+    const started = await call(ctx, {
+      command: 'true',
+      description: 'test command',
+      workdir: '/nonexistent-dsh',
+      run_in_background: true,
+    })
+    expect(text(started)).toMatch(/^started background job bash-\d+$/)
+    const jobs = ctx.jobs
+    const job = jobs.list()[0]
+    await until(() => jobs.get(job!.id).status === 'killed' ? true : undefined)
+    const read = text(await ctx.tools.execute({
+      signal: testToolSignal,
+      callId: ToolCallId('background-spawn-failure-read'),
+      name: 'job_output',
+      arguments: { job_id: String(job!.id) },
+    }))
+    expect(read).toMatch(/^\[stderr\]\nsubprocess failed before reporting an outcome: .*\n\[status: killed, killed before exit\]$/s)
+  })
+
+  it('labels stderr chunks with their channel', async () => {
+    const ctx = await setup()
+    await call(ctx, {
+      command: 'echo out-line; echo err-line 1>&2',
+      description: 'test command',
+      run_in_background: true,
+    })
+    const jobs = ctx.jobs
+    const job = jobs.list()[0]
+    await until(() => jobs.get(job!.id).status === 'completed' ? true : undefined)
+    const chunks = jobs.readAt(job!.id, 0).chunks
+    expect(chunks.find(chunk => chunk.text.includes('out-line'))?.channel).toBe('stdout')
+    expect(chunks.find(chunk => chunk.text.includes('err-line'))?.channel).toBe('stderr')
+  })
+})
+
+describe('processSources', () => {
+  it('reads nothing while the process is not spawned yet', () => {
+    const [stdout, stderr] = processSources(() => undefined)
+    expect(stdout!.channel).toBe('stdout')
+    expect(stderr!.channel).toBe('stderr')
+    expect(stdout!.read(0)).toEqual({ text: '', nextOffset: 0, lossy: false })
+    expect(stderr!.read(3)).toEqual({ text: '', nextOffset: 3, lossy: false })
+  })
+
+  it('forwards each read to the matching stream reader at its own offset once the process exists', () => {
+    const reads: { channel: string; from: number }[] = []
+    const reader = (channel: string, text: string): ShellProcess['observed']['stdout'] => ({
+      readFrom: (from: number) => { reads.push({ channel, from }); return { text, nextOffset: from + text.length, lossy: false } },
+    })
+    const proc: Pick<ShellProcess, 'observed'> = { observed: { stdout: reader('stdout', 'out'), stderr: reader('stderr', 'err!') } }
+    const [stdout, stderr] = processSources(() => proc)
+    expect(stdout!.read(2)).toEqual({ text: 'out', nextOffset: 5, lossy: false })
+    expect(stderr!.read(7)).toEqual({ text: 'err!', nextOffset: 11, lossy: false })
+    expect(reads).toEqual([{ channel: 'stdout', from: 2 }, { channel: 'stderr', from: 7 }])
+  })
+
+  it("passes a lossy read's spill file through, so the model's notice can name it", () => {
+    const proc: Pick<ShellProcess, 'observed'> = {
+      observed: {
+        stdout: { readFrom: (from: number) => ({ text: '', nextOffset: from, lossy: false }) },
+        stderr: { readFrom: (from: number) => ({ text: 'tail', nextOffset: from + 4, lossy: true, spillPath: '/spill/err.log' }) },
+      },
+    }
+    const [, stderr] = processSources(() => proc)
+    expect(stderr!.read(0)).toEqual({ text: 'tail', nextOffset: 4, lossy: true, spillPath: '/spill/err.log' })
+  })
+})
+
+describe('owned background output', () => {
+  it('fences an owned background run under the owning session', async () => {
+    const ctx = await setup()
+    const ownerId = SessionId('background-owner')
+    const owner: Agent = {
+      id: ownerId,
+      options: {},
+      session: Session.create(ownerId, undefined, {
+        version: SESSION_FORMAT_VERSION, id: ownerId, createdAt: 0, cwd: process.cwd(), isSeeded: false,
+      }),
+      inbox: unsupportedInbox(),
+      status: 'idle',
+      ctx,
+      send: () => {},
+      followup: () => {},
+      steer: () => {},
+      inject: () => {},
+      cancel: () => {},
+      runMaintenance: task => task(new AbortController().signal),
+      whenIdle: () => Promise.resolve(),
+    }
+    ctx.agents.register(owner)
+    await ctx.tools.execute({
+      signal: testToolSignal,
+      callId: ToolCallId('background-owned-1'),
+      name: 'bash',
+      arguments: { command: 'echo owned', description: 'test command', run_in_background: true },
+      agent: owner,
+    })
+    const owned = ctx.jobs
+    const job = owned.list(owner.id)[0]
+    expect(job).toBeDefined()
+    expect(job!.owner).toBe(owner.id)
+    await until(() => owned.get(job!.id, owner.id).status === 'completed' ? true : undefined)
+    expect(() => retainedText(ctx, job!.id)).toThrow(/belongs to another session/)
+    await until(() => retainedText(ctx, job!.id, owner).includes('owned') ? true : undefined)
+  })
+})
diff --git a/packages/shell/tool-bash/tests/tools.spec.ts b/packages/shell/tool-bash/tests/tools.spec.ts
index c2291d0812..525c9e8220 100644
--- a/packages/shell/tool-bash/tests/tools.spec.ts
+++ b/packages/shell/tool-bash/tests/tools.spec.ts
@@ -5,7 +5,7 @@ import { afterAll, describe, expect, it, vi } from 'vitest'
 import { Context } from '@deepseek-ai/cordis'
 import { ToolCallId } from '@deepseek-ai/dsh-llm'
 import { ShellExecutor } from '@deepseek-ai/dsh-shell'
-import type { ShellExecRequest, ShellExecSpec, ShellProcess, ShellProcessRead, ShellRunResult } from '@deepseek-ai/dsh-shell'
+import type { ShellExecRequest, ShellExecSpec, ShellProcess, ShellRunResult } from '@deepseek-ai/dsh-shell'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRuntime, { TOOL_ABORTED, TOOL_ABORTED_BEFORE_DISPATCH } from '@deepseek-ai/dsh-tools'
 import AgentRegistry from '@deepseek-ai/dsh-agent'
@@ -22,8 +22,12 @@ import SandboxPolicyService from '@deepseek-ai/dsh-sandbox-policy'
 import SessionProjectionRegistry from '@deepseek-ai/dsh-session-projection'
 import * as ToolBash from '@deepseek-ai/dsh-tool-bash'
 import * as BashEnvPlugin from '@deepseek-ai/dsh-shell-env'
+import { escalationHintMarker, sandboxDenialMarker } from '@deepseek-ai/dsh-sandbox'
 import { processOutcome } from '../src/background.ts'
-import { renderProcessRead, renderResult } from '../src/render.ts'
+import { renderResult } from '../src/render.ts'
+
+/** Empty offset readers for fakes that never produce output. */
+const silentReader = { readFrom: (fromByte: number) => ({ text: '', nextOffset: fromByte, lossy: false }) }
 
 const testToolSignal = new AbortController().signal
 
@@ -152,6 +156,7 @@ class RecordingSandboxExecutor extends ShellExecutor {
       done: Promise.resolve(),
       sandbox: { mode: spec.sandboxPolicy?.mode ?? 'read-only', denied: false },
       readOutput: () => ({ delta: '', lossy: false }),
+      observed: { stdout: silentReader, stderr: silentReader },
       kill: () => false,
     }
   }
@@ -181,6 +186,7 @@ class CountingStartExecutor extends ShellExecutor {
       signal: null,
       done: Promise.resolve(),
       readOutput: () => ({ delta: '', lossy: false }),
+      observed: { stdout: silentReader, stderr: silentReader },
       kill: () => false,
     }
   }
@@ -794,53 +800,6 @@ describe('sandbox escalation through the generic task producer', () => {
   })
 })
 
-describe('renderProcessRead', () => {
-  const base: ShellProcessRead = { delta: 'out\n', lossy: false }
-
-  it('returns the delta verbatim for a lossless read', () => {
-    expect(renderProcessRead(base)).toBe('out\n')
-    expect(renderProcessRead({ delta: '', lossy: false })).toBe('')
-  })
-
-  it('appends the loss notice with the available spill paths', () => {
-    expect(renderProcessRead({ ...base, lossy: true, stdoutSpillPath: '/spill/out.log' }))
-      .toBe('out\n[some output was dropped from memory; full output: /spill/out.log]')
-    expect(renderProcessRead({ ...base, lossy: true, stdoutSpillPath: '/spill/out.log', stderrSpillPath: '/spill/err.log' }))
-      .toBe('out\n[some output was dropped from memory; full output: /spill/out.log, /spill/err.log]')
-  })
-
-  it('reports (unavailable) when a lossy read has no safe spill path', () => {
-    expect(renderProcessRead({ ...base, lossy: true }))
-      .toBe('out\n[some output was dropped from memory; full output: (unavailable)]')
-  })
-
-  it('an empty lossy delta is the notice alone', () => {
-    expect(renderProcessRead({ delta: '', lossy: true, stderrSpillPath: '/spill/err.log' }))
-      .toBe('[some output was dropped from memory; full output: /spill/err.log]')
-  })
-
-  it('inserts the separating newline only when the delta lacks one', () => {
-    expect(renderProcessRead({ delta: 'tail', lossy: true }))
-      .toBe('tail\n[some output was dropped from memory; full output: (unavailable)]')
-    expect(renderProcessRead({ delta: 'tail\n', lossy: true }))
-      .toBe('tail\n[some output was dropped from memory; full output: (unavailable)]')
-  })
-
-  it('appends settled sandbox denial and runner-failure facts', () => {
-    expect(renderProcessRead(base, { mode: 'read-only', denied: true }, ['workspace-write']))
-      .toContain('[sandbox: escalation available')
-    expect(renderProcessRead({ delta: 'tail', lossy: false }, { mode: 'read-only', denied: true }))
-      .toBe('tail\n[sandbox: file access denied under read-only mode]')
-    const runner = renderProcessRead(
-      { delta: '', lossy: false },
-      { mode: 'workspace-write', denied: true, runnerFailed: true },
-      ['danger-full-access'],
-    )
-    expect(runner).toContain('sandbox runner itself failed under workspace-write mode')
-    expect(runner).not.toContain('file access denied')
-  })
-})
-
 describe('processOutcome', () => {
   function settled(over: Partial<ShellProcess>): ShellProcess {
     return {
@@ -849,6 +808,7 @@ describe('processOutcome', () => {
       signal: null,
       done: Promise.resolve(),
       readOutput: () => ({ delta: '', lossy: false }),
+      observed: { stdout: silentReader, stderr: silentReader },
       kill: () => false,
       ...over,
     }
@@ -873,6 +833,16 @@ describe('processOutcome', () => {
     expect(processOutcome(settled({ exitCode: null })))
       .toEqual({ status: 'completed', detail: 'exit code: 0' })
   })
+
+  it('appends sandbox facts to the terminal detail', () => {
+    const denied = processOutcome(settled({ exitCode: 1, sandbox: { mode: 'read-only', denied: true } }), ['workspace-write'])
+    expect(denied.detail).toBe(`exit code: 1; ${sandboxDenialMarker('read-only')} ${escalationHintMarker('command')}`)
+    const deniedWithoutEscalation = processOutcome(settled({ exitCode: 1, sandbox: { mode: 'read-only', denied: true } }))
+    expect(deniedWithoutEscalation.detail).toBe(`exit code: 1; ${sandboxDenialMarker('read-only')}`)
+    const runnerFailed = processOutcome(settled({ exitCode: 1, sandbox: { mode: 'read-only', denied: false, runnerFailed: true } }))
+    expect(runnerFailed.detail).toContain('the sandbox runner itself failed under read-only mode')
+    expect(processOutcome(settled({ sandbox: { mode: 'read-only', denied: false } })).detail).toBe('exit code: 0')
+  })
 })
 
 describe('session-cwd routing (per-session workdir)', () => {
@@ -1172,6 +1142,7 @@ describe('the model-facing bash tool builds its request from named args only (no
         signal: null,
         done: Promise.resolve(),
         readOutput: () => ({ delta: '', lossy: false }),
+        observed: { stdout: silentReader, stderr: silentReader },
         kill: () => false,
       }
     }
diff --git a/packages/shell/tool-pwsh/README.i18n.yaml b/packages/shell/tool-pwsh/README.i18n.yaml
index 348769a6d8..274c7e20be 100644
--- a/packages/shell/tool-pwsh/README.i18n.yaml
+++ b/packages/shell/tool-pwsh/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/shell/tool-pwsh/README.md
-README.md: a1b8755c50862bb318f72af90f3cdbae158e7746
-README.zh.md: efcf188b31365f6897eb14fb6482c973f23f6a7b
+README.md: ef6a347545652be5cd388ad06ddc72d9491759d7
+README.zh.md: 59b98c232d39e0eedae7b8cb584782875407d54a
diff --git a/packages/shell/tool-pwsh/README.md b/packages/shell/tool-pwsh/README.md
index a1b8755c50..ef6a347545 100644
--- a/packages/shell/tool-pwsh/README.md
+++ b/packages/shell/tool-pwsh/README.md
@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
 
 ## Summary
 
-`dsh-tool-pwsh` gives the agent a `pwsh` tool that runs PowerShell commands through the mounted shell executor — the Windows counterpart of `dsh-tool-bash`, mirroring it call-for-call. Each call runs in a fresh pwsh process, so no state survives; `run_in_background` turns long-running commands into background jobs. Commands are PowerShell-dialect: native `C:\...` paths and `$env:NAME` variables, with no dialect translation. Every call runs with the managed `DSH_*` environment, and under a sandboxing executor the tool teaches and enforces the Windows-specific language-mode and named-pipe contracts. Mount it with a PowerShell executor such as `dsh-pwsh-local` and the `dsh-shell-env` plugin.
+`dsh-tool-pwsh` lets the agent run PowerShell commands through a mounted shell executor. Each call uses a fresh process; `run_in_background` keeps long-running commands active as jobs with observable output. Commands use native Windows paths and `$env:NAME` variables without dialect translation. Calls receive the managed `DSH_*` environment, and sandboxed execution enforces Windows language-mode and named-pipe requirements. Mount it with a PowerShell executor such as `dsh-pwsh-local` and the `dsh-shell-env` plugin.
 
 ## Table of Contents
 
diff --git a/packages/shell/tool-pwsh/README.zh.md b/packages/shell/tool-pwsh/README.zh.md
index efcf188b31..59b98c232d 100644
--- a/packages/shell/tool-pwsh/README.zh.md
+++ b/packages/shell/tool-pwsh/README.zh.md
@@ -9,7 +9,7 @@ kind: "package-reference"
 
 ## 概述
 
-`dsh-tool-pwsh` 为 agent（智能体）提供 `pwsh` 工具，通过已挂载的 shell 执行器运行 PowerShell 命令——它是 `dsh-tool-bash` 的 Windows 对应物，逐调用镜像。每次调用都运行在全新 pwsh 进程中，因此状态不会保留；`run_in_background` 把长时间运行的命令变成后台任务。命令是 PowerShell 方言：原生 `C:\...` 路径与 `$env:NAME` 变量，不做方言翻译。每次调用都运行在受管 `DSH_*` 环境中；在沙箱执行器下，工具会向模型说明并强制执行 Windows 特有的语言模式与命名管道约定。请与 `dsh-pwsh-local` 等 PowerShell 执行器以及 `dsh-shell-env` 插件一起挂载。
+`dsh-tool-pwsh` 让 agent（智能体）通过已挂载的 shell 执行器运行 PowerShell 命令。每次调用使用全新进程；`run_in_background` 将长时间运行的命令保持为输出可观测的任务。命令使用原生 Windows 路径和 `$env:NAME` 变量，不做方言翻译。调用获得受管 `DSH_*` 环境，沙箱执行会落实 Windows 语言模式与命名管道要求。请与 `dsh-pwsh-local` 等 PowerShell 执行器及 `dsh-shell-env` 插件一起挂载。
 
 ## 目录
 
diff --git a/packages/shell/tool-pwsh/package.json b/packages/shell/tool-pwsh/package.json
index 5b1d2a8bc4..b8ce764201 100644
--- a/packages/shell/tool-pwsh/package.json
+++ b/packages/shell/tool-pwsh/package.json
@@ -46,6 +46,7 @@
     "@deepseek-ai/cordis": "workspace:^",
     "@deepseek-ai/dsh-agent": "workspace:^",
     "@deepseek-ai/dsh-agent-loop": "workspace:^",
+    "@deepseek-ai/dsh-agent-loop-testkit": "workspace:^",
     "@deepseek-ai/dsh-app-boot": "workspace:^",
     "@deepseek-ai/dsh-jobs": "workspace:^",
     "@deepseek-ai/dsh-jobs-local": "workspace:^",
diff --git a/packages/shell/tool-pwsh/src/background.ts b/packages/shell/tool-pwsh/src/background.ts
index ce506a569d..ec4c2d4836 100644
--- a/packages/shell/tool-pwsh/src/background.ts
+++ b/packages/shell/tool-pwsh/src/background.ts
@@ -1,44 +1,90 @@
 /**
- * Generic-task adaptation for background pwsh process handles — the shell-agnostic
- * twin of `dsh-tool-bash`'s background adaptation.
+ * Generic-job adaptation for background pwsh process handles — the
+ * shell-agnostic twin of `dsh-tool-bash`'s background adaptation: the terminal
+ * outcome the registry records and the pull sources it pumps.
  *
  * @module @deepseek-ai/dsh-tool-pwsh/background
  */
 
-import type { ShellProcess } from '@deepseek-ai/dsh-shell'
-import type { JobHooks, JobOutcome } from '@deepseek-ai/dsh-jobs'
+import type { SandboxMode } from '@deepseek-ai/dsh-sandbox'
+import { escalationHintMarker, sandboxDenialMarker } from '@deepseek-ai/dsh-sandbox'
+import type { ShellProcess, ShellSandboxInfo } from '@deepseek-ai/dsh-shell'
+import type { JobHooks, JobOutcome, JobOutputSource } from '@deepseek-ai/dsh-jobs'
 
 /* jscpd:ignore-start -- deliberate twin of dsh-tool-bash/background.ts (Agent Note). */
 
 /**
- * Map a settled background process onto the generic task-outcome vocabulary:
+ * Sandbox facts worth the terminal detail: a runner that never ran the
+ * command, or a denial (with the escalation hint this composition offers).
+ * @param sandbox - settled sandbox facts, when this was a confined process.
+ * @param escalationModes - escalation targets advertised by this composition.
+ * @returns the markers to append, oldest first.
+ */
+function sandboxNotes(sandbox: ShellSandboxInfo | undefined, escalationModes: readonly SandboxMode[]): string[] {
+  if (sandbox?.runnerFailed) {
+    return [`[sandbox: the sandbox runner itself failed under ${sandbox.mode} mode — the command did not run; this is a sandbox problem, not a command failure]`]
+  }
+  if (sandbox?.denied) {
+    const notes = [sandboxDenialMarker(sandbox.mode)]
+    if (escalationModes.length > 0) notes.push(escalationHintMarker('command'))
+    return notes
+  }
+  return []
+}
+
+/**
+ * Map a settled background process onto the generic job-outcome vocabulary:
  * `killed` stays `killed` (detail: the signal when one is known), everything
  * else is `completed` with the exit code as detail. A nonzero command exit is
- * reported, not failed, exactly like the foreground rendering.
+ * reported, not failed, exactly like the foreground rendering. Sandbox facts
+ * join the detail, since a job's terminal reason is the one line every
+ * reader — the model's status line, the roster row — shows.
  * @param proc - the settled process handle.
+ * @param escalationModes - escalation targets advertised by this composition.
  * @returns the outcome for the `ctx.jobs` registration.
  */
-export function processOutcome(proc: ShellProcess): { status: 'completed' | 'killed'; detail: string } {
+export function processOutcome(proc: ShellProcess, escalationModes: readonly SandboxMode[] = []): JobOutcome {
   // TODO(background-infrastructure-outcome): widen ShellProcess with an explicit
   // infrastructure-failure outcome, then map spawn failures and
-  // sandbox.runnerFailed to task `failed`. The current contract aliases a spawn
+  // sandbox.runnerFailed to job `failed`. The current contract aliases a spawn
   // failure with a signal-less kill and a runner failure with an ordinary
   // wrapper exit; real nonzero command exits must remain `completed`.
-  if (proc.status === 'killed') {
-    return { status: 'killed', detail: proc.signal !== null ? `signal: ${proc.signal}` : 'killed before exit' }
-  }
-  return { status: 'completed', detail: `exit code: ${proc.exitCode ?? 0}` }
+  const base: JobOutcome = proc.status === 'killed'
+    ? { status: 'killed', detail: proc.signal !== null ? `signal: ${proc.signal}` : 'killed before exit' }
+    : { status: 'completed', detail: `exit code: ${proc.exitCode ?? 0}` }
+  const notes = sandboxNotes(proc.sandbox, escalationModes)
+  return notes.length === 0 ? base : { ...base, detail: `${base.detail}; ${notes.join(' ')}` }
+}
+
+/**
+ * The process's non-consuming stream readers as registry pull sources. They
+ * bind lazily because the process is spawned inside the starter, after the
+ * registry admitted the job; a read before the spawn yields nothing, and the
+ * pump keeps the model's consuming cursor untouched. A rejected spawn's
+ * stderr reader carries the provider's `spawn failed: …` note.
+ * @param proc - the started process's observed streams, once the starter has spawned it.
+ * @returns one source per stream, stdout first.
+ */
+export function processSources(proc: () => Pick<ShellProcess, 'observed'> | undefined): JobOutputSource[] {
+  const source = (channel: 'stdout' | 'stderr'): JobOutputSource => ({
+    channel,
+    read: (fromByte) => {
+      const live = proc()
+      return live === undefined ? { text: '', nextOffset: fromByte, lossy: false } : live.observed[channel].readFrom(fromByte)
+    },
+  })
+  return [source('stdout'), source('stderr')]
 }
 
 /**
  * Adapt asynchronous shell preparation after job admission without exposing a partial process.
  * @param start - starts the process with job-owned cancellation.
- * @param renderOutput - consumes output from a published process.
+ * @param outcome - projects the settled process into the job outcome.
  * @returns synchronous job hooks whose completion includes preparation and process settlement.
  */
 export function processJob(
   start: (signal: AbortSignal) => Promise<ShellProcess>,
-  renderOutput: (process: ShellProcess) => string,
+  outcome: (process: ShellProcess) => JobOutcome,
 ): JobHooks {
   const controller = new AbortController()
   let process: ShellProcess | undefined
@@ -50,7 +96,7 @@ export function processJob(
       } finally {
         await process.done
       }
-      return processOutcome(process)
+      return outcome(process)
     } catch (error: unknown) {
       return {
         status: controller.signal.aborted && process === undefined ? 'killed' : 'failed',
@@ -65,7 +111,6 @@ export function processJob(
       process?.kill()
     },
     done,
-    readOutput: () => process === undefined ? '' : renderOutput(process),
   }
 }
 /* jscpd:ignore-end */
diff --git a/packages/shell/tool-pwsh/src/index.ts b/packages/shell/tool-pwsh/src/index.ts
index 76e43401c4..bbb266ba38 100644
--- a/packages/shell/tool-pwsh/src/index.ts
+++ b/packages/shell/tool-pwsh/src/index.ts
@@ -32,10 +32,10 @@ import type {} from '@deepseek-ai/dsh-user-approval'
 import type { SandboxExecutionPolicy, SandboxMode } from '@deepseek-ai/dsh-sandbox'
 import { ESCALATION_TARGETS, approveEscalation, validateEscalationArgs } from '@deepseek-ai/dsh-sandbox'
 import type { SandboxPolicyService } from '@deepseek-ai/dsh-sandbox-policy'
-import type { ShellRunResult } from '@deepseek-ai/dsh-shell'
+import type { ShellRunResult, ShellProcess } from '@deepseek-ai/dsh-shell'
 import { parseExitStatus } from '@deepseek-ai/dsh-shell'
-import { processJob } from './background.ts'
-import { renderPwshProcessRead, renderPwshResult } from './render.ts'
+import { processJob, processOutcome, processSources } from './background.ts'
+import { renderPwshResult } from './render.ts'
 import type { RenderablePwshResult } from './render.ts'
 
 declare module '@deepseek-ai/dsh-jobs' {
@@ -47,6 +47,7 @@ declare module '@deepseek-ai/dsh-jobs' {
 export const name = 'tool-pwsh'
 export const inject = ['tools', 'shell', 'systemPrompt', 'shellEnv']
 
+/* jscpd:ignore-start -- the pwsh Config mirrors tool-bash's by design, like render/background. */
 /** Configuration for the pwsh tool. */
 export interface Config {
   /** Expose `run_in_background` (default true); disabled calls are also rejected. */
@@ -57,6 +58,7 @@ export interface Config {
 export const Config: z<Config> = z.object({
   enableRunInBackground: z.boolean().default(true),
 })
+/* jscpd:ignore-end */
 
 /** Parsed tool args; execute validates value constraints absent from ParameterSchemaSpec. */
 interface PwshToolArgs {
@@ -376,14 +378,21 @@ export function apply(ctx: Context, config: Config = {}): void {
           error.name = 'AbortError'
           throw error
         }
-        // Task preflight finishes before the starter can spawn a process.
+        // The registry pumps the process's non-consuming readers into the
+        // job's ring; the sources bind lazily because the process is spawned
+        // only once admission has passed.
+        let proc: ShellProcess | undefined
         const id = jobs.start({
           kind: 'pwsh',
           label: args.command,
-          ...exec.agent ? { owner: exec.agent } : {},
+          ...exec.agent ? { owner: exec.agent.id } : {},
+          output: processSources(() => proc),
           run: () => processJob(
-            signal => ctx.shell.start(ctx.shell.resolve({ ...request, signal })),
-            proc => renderPwshProcessRead(proc.readOutput(), proc.sandbox, escalationModes),
+            async (signal) => {
+              proc = await ctx.shell.start(ctx.shell.resolve({ ...request, signal }))
+              return proc
+            },
+            started => processOutcome(started, escalationModes),
           ),
         })
         return { kind: 'background' as const, jobId: id }
diff --git a/packages/shell/tool-pwsh/src/render.ts b/packages/shell/tool-pwsh/src/render.ts
index cc7b8a661d..01e0a51e2e 100644
--- a/packages/shell/tool-pwsh/src/render.ts
+++ b/packages/shell/tool-pwsh/src/render.ts
@@ -10,7 +10,7 @@
  * @module @deepseek-ai/dsh-tool-pwsh/render
  */
 
-import type { ShellProcessRead, ShellSandboxInfo, CollectedOutput } from '@deepseek-ai/dsh-shell'
+import type { ShellSandboxInfo, CollectedOutput } from '@deepseek-ai/dsh-shell'
 import type { SandboxMode } from '@deepseek-ai/dsh-sandbox'
 import { escalationHintMarker, sandboxDenialMarker } from '@deepseek-ai/dsh-sandbox'
 
@@ -80,34 +80,4 @@ export function renderPwshResult(
   return body + markers.join('\n')
 }
 
-/**
- * Shape one background-process read into the `job_output` delta the model
- * sees: the incremental delta, plus the lossy-read notice (with full-stream
- * spill paths) when in-memory truncation dropped unread bytes.
- * @param read - one incremental read from the process handle.
- * @param sandbox - settled sandbox facts, when this was a confined process.
- * @param escalationModes - escalation targets advertised by this composition.
- * @returns the delta text with any loss or sandbox notice appended.
- */
-export function renderPwshProcessRead(
-  read: ShellProcessRead,
-  sandbox?: ShellSandboxInfo,
-  escalationModes: readonly SandboxMode[] = [],
-): string {
-  const notices: string[] = []
-  if (read.lossy) {
-    const paths = [read.stdoutSpillPath, read.stderrSpillPath].filter((path): path is string => path !== undefined)
-    notices.push(`[some output was dropped from memory; full output: ${paths.length > 0 ? paths.join(', ') : '(unavailable)'}]`)
-  }
-  if (sandbox?.runnerFailed) {
-    notices.push(`[sandbox: the sandbox runner itself failed under ${sandbox.mode} mode — the command did not run; this is a sandbox problem, not a command failure]`)
-  } else if (sandbox?.denied) {
-    notices.push(sandboxDenialMarker(sandbox.mode))
-    if (escalationModes.length > 0) {
-      notices.push(escalationHintMarker('command'))
-    }
-  }
-  if (notices.length === 0) return read.delta
-  return `${read.delta}${read.delta.length > 0 && !read.delta.endsWith('\n') ? '\n' : ''}${notices.join('\n')}`
-}
 /* jscpd:ignore-end */
diff --git a/packages/shell/tool-pwsh/tests/background-start.spec.ts b/packages/shell/tool-pwsh/tests/background-start.spec.ts
index 19e31e3a10..4140d50c44 100644
--- a/packages/shell/tool-pwsh/tests/background-start.spec.ts
+++ b/packages/shell/tool-pwsh/tests/background-start.spec.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it, onTestFinished, vi } from 'vitest'
 import type { ShellProcess } from '@deepseek-ai/dsh-shell'
-import { processJob } from '../src/background.ts'
+import { processJob, processOutcome, processSources } from '../src/background.ts'
 
 function processHandle() {
   const exited = Promise.withResolvers<undefined>()
@@ -12,25 +12,34 @@ function processHandle() {
     killed.resolve(undefined)
     return true
   })
+  const readOutput = vi.fn(() => ({ delta: 'output', lossy: false }))
   const process: ShellProcess = {
     status: 'running', exitCode: null, signal: null, done: exited.promise,
-    readOutput: () => ({ delta: 'output', lossy: false }), kill,
+    readOutput, kill,
+    observed: {
+      stdout: { readFrom: fromByte => ({ text: 'output'.slice(fromByte), nextOffset: 6, lossy: false }) },
+      stderr: { readFrom: () => ({ text: '', nextOffset: 0, lossy: false }) },
+    },
   }
   onTestFinished(() => { exited.resolve(undefined) })
-  return { process, exited, killed, kill }
+  return { process, exited, killed, kill, readOutput }
 }
 
 describe('background job ownership during asynchronous shell startup', () => {
-  it('keeps output empty until a process is published and then consumes its output', async () => {
+  it('keeps observation empty during preparation and reads published output without consuming it', async () => {
     const child = processHandle()
     const prepared = Promise.withResolvers<ShellProcess>()
-    const render = vi.fn((process: ShellProcess) => process.readOutput().delta)
-    const hooks = processJob(() => prepared.promise, render)
-    expect(hooks.readOutput!()).toBe('')
-    expect(render).not.toHaveBeenCalled()
+    let published: ShellProcess | undefined
+    const source = processSources(() => published)[0]!
+    const outcome = vi.fn(processOutcome)
+    const hooks = processJob(async () => { published = await prepared.promise; return published }, outcome)
+    expect(source.read(0).text).toBe('')
+    expect(outcome).not.toHaveBeenCalled()
     prepared.resolve(child.process)
     await Promise.resolve()
-    expect(hooks.readOutput!()).toBe('output')
+    expect(source.read(0).text).toBe('output')
+    expect(source.read(0).text).toBe('output')
+    expect(child.readOutput).not.toHaveBeenCalled()
     child.process.status = 'completed'
     child.process.exitCode = 5
     child.exited.resolve(undefined)
@@ -44,19 +53,18 @@ describe('background job ownership during asynchronous shell startup', () => {
       return new Promise<ShellProcess>((_resolve, reject) => {
         signal.addEventListener('abort', () => { reject(new Error(String(signal.reason))) }, { once: true })
       })
-    }, () => 'unreachable')
+    }, processOutcome)
     expect(received?.aborted).toBe(false)
     hooks.cancel('cancel pending confinement')
     hooks.cancel('later cancellation')
     expect(received?.reason).toBe('cancel pending confinement')
     expect(await hooks.done).toEqual({ status: 'killed', detail: 'cancel pending confinement' })
-    expect(hooks.readOutput!()).toBe('')
   })
 
   it('kills a process that materializes after cancellation and awaits its exit', async () => {
     const child = processHandle()
     const prepared = Promise.withResolvers<ShellProcess>()
-    const hooks = processJob(() => prepared.promise, () => 'output')
+    const hooks = processJob(() => prepared.promise, processOutcome)
     let settled = false
     void hooks.done.then(() => { settled = true })
     hooks.cancel('cancel before process publication')
@@ -70,7 +78,7 @@ describe('background job ownership during asynchronous shell startup', () => {
 
   it('cancels a published process once and keeps done pending until exit', async () => {
     const child = processHandle()
-    const hooks = processJob(async () => child.process, () => 'output')
+    const hooks = processJob(async () => child.process, processOutcome)
     await Promise.resolve()
     let settled = false
     void hooks.done.then(() => { settled = true })
@@ -88,7 +96,7 @@ describe('background job ownership during asynchronous shell startup', () => {
     const attempted = Promise.withResolvers<undefined>()
     vi.mocked(child.kill).mockImplementation(() => { attempted.resolve(undefined); throw new Error('termination failed') })
     const prepared = Promise.withResolvers<ShellProcess>()
-    const hooks = processJob(() => prepared.promise, () => '')
+    const hooks = processJob(() => prepared.promise, processOutcome)
     let settled = false
     void hooks.done.then(() => { settled = true })
     hooks.cancel('stop before publication')
@@ -100,17 +108,16 @@ describe('background job ownership during asynchronous shell startup', () => {
   })
 
   it('reports a startup failure through job completion without publishing output', async () => {
-    const render = vi.fn(() => 'unreachable')
+    const render = vi.fn(processOutcome)
     const hooks = processJob(async () => { throw new Error('remote sandbox unavailable') }, render)
     expect(await hooks.done).toEqual({ status: 'failed', detail: 'remote sandbox unavailable' })
-    expect(hooks.readOutput!()).toBe('')
     expect(render).not.toHaveBeenCalled()
   })
 
   it('reports a primitive upstream abort reason as a failed startup', async () => {
     const upstream = new AbortController()
     upstream.abort('upstream preparation stopped')
-    const hooks = processJob(async () => { upstream.signal.throwIfAborted(); throw new Error('unreachable') }, () => '')
+    const hooks = processJob(async () => { upstream.signal.throwIfAborted(); throw new Error('unreachable') }, processOutcome)
     expect(await hooks.done).toEqual({ status: 'failed', detail: 'upstream preparation stopped' })
   })
 })
diff --git a/packages/shell/tool-pwsh/tests/background.spec.ts b/packages/shell/tool-pwsh/tests/background.spec.ts
new file mode 100644
index 0000000000..8ceb0b88bf
--- /dev/null
+++ b/packages/shell/tool-pwsh/tests/background.spec.ts
@@ -0,0 +1,244 @@
+import { describe, expect, it, vi } from 'vitest'
+import { Context } from '@deepseek-ai/cordis'
+import { ToolCallId } from '@deepseek-ai/dsh-llm'
+import { Session, SessionId } from '@deepseek-ai/dsh-session'
+import { SESSION_FORMAT_VERSION } from '@deepseek-ai/dsh-session/types'
+import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
+import ToolRuntime from '@deepseek-ai/dsh-tools'
+import AgentRegistry from '@deepseek-ai/dsh-agent'
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import { unsupportedInbox } from '@deepseek-ai/dsh-agent-loop-testkit'
+import LocalJobRegistry from '@deepseek-ai/dsh-jobs-local'
+import * as ToolTasks from '@deepseek-ai/dsh-tool-jobs'
+import { ShellExecutor } from '@deepseek-ai/dsh-shell'
+import type { ShellExecRequest, ShellExecSpec, ShellProcess, ShellRunResult } from '@deepseek-ai/dsh-shell'
+import * as ToolPwsh from '@deepseek-ai/dsh-tool-pwsh'
+import * as BashEnvPlugin from '@deepseek-ai/dsh-shell-env'
+import { processSources } from '../src/background.ts'
+
+const testToolSignal = new AbortController().signal
+
+/** ASCII-only scripted stream: readFrom offsets are byte-exact string indexes. */
+function scriptedReader(state: { text: string }) {
+  return {
+    readFrom(fromByte: number) {
+      return { text: state.text.slice(fromByte), nextOffset: state.text.length, lossy: false }
+    },
+  }
+}
+
+/** A running fake background handle over scripted non-consuming observed streams. */
+function observableProcess(streams: { stdout: { text: string }; stderr: { text: string } } = { stdout: { text: '' }, stderr: { text: '' } }) {
+  let resolveDone: () => void = () => {}
+  const done = new Promise<void>((resolve) => { resolveDone = resolve })
+  const proc: ShellProcess = {
+    status: 'running',
+    exitCode: null,
+    signal: null,
+    done,
+    readOutput: () => ({ delta: '', lossy: false }),
+    kill: () => false,
+    observed: { stdout: scriptedReader(streams.stdout), stderr: scriptedReader(streams.stderr) },
+  }
+  return {
+    proc,
+    finish() {
+      proc.status = 'completed'
+      proc.exitCode = 0
+      resolveDone()
+    },
+  }
+}
+
+class FakePwsh extends ShellExecutor {
+  backgroundHandler: (spec: ShellExecSpec) => ShellProcess = () => { throw new Error('unscripted start') }
+
+  override resolve(request: ShellExecRequest): ShellExecSpec {
+    return {
+      command: request.command,
+      workdir: request.workdir ?? process.cwd(),
+      timeoutMs: request.timeoutMs ?? 60_000,
+      stdoutMaxBytes: request.stdoutMaxBytes ?? 64_000,
+      ...request.signal ? { signal: request.signal } : {},
+      ...request.dshEnv !== undefined ? { dshEnv: request.dshEnv } : {},
+      sandboxPolicy: request.sandboxPolicy,
+    }
+  }
+
+  override async run(): Promise<ShellRunResult> {
+    throw new Error('foreground is not exercised here')
+  }
+
+  override async start(spec: ShellExecSpec): Promise<ShellProcess> {
+    return this.backgroundHandler(spec)
+  }
+}
+
+async function setup() {
+  const ctx = new Context()
+  await ctx.plugin(SystemPrompt)
+  await ctx.plugin(ToolRuntime)
+  await ctx.plugin(AgentRegistry)
+  await ctx.plugin(LocalJobRegistry, { pumpPollMs: 5 })
+  await ctx.plugin(ToolTasks)
+  await ctx.plugin(BashEnvPlugin)
+  await ctx.plugin(FakePwsh)
+  await ctx.plugin(ToolPwsh)
+  return { ctx, pwsh: ctx.shell as FakePwsh }
+}
+
+let callCounter = 0
+function call(ctx: Context, args: Record<string, unknown>) {
+  return ctx.tools.execute({
+    signal: testToolSignal,
+    callId: ToolCallId(`pwsh-background-${++callCounter}`),
+    name: 'pwsh',
+    arguments: args,
+  })
+}
+
+async function until<T>(read: () => T | undefined, timeoutMs = 5_000): Promise<T> {
+  const deadline = Date.now() + timeoutMs
+  while (Date.now() < deadline) {
+    const value = read()
+    if (value !== undefined) return value
+    await new Promise(resolve => setTimeout(resolve, 5))
+  }
+  throw new Error('condition not reached before timeout')
+}
+
+describe('background pwsh output', () => {
+  it('streams observed channels into the job ring and settles with the mapped outcome', async () => {
+    const { ctx, pwsh } = await setup()
+    const stdout = { text: '' }
+    const stderr = { text: '' }
+    const scripted = observableProcess({ stdout, stderr })
+    pwsh.backgroundHandler = () => scripted.proc
+
+    await call(ctx, { command: 'Get-Progress', description: 'test command', run_in_background: true })
+    const jobs = ctx.jobs
+    const job = jobs.list()[0]
+    expect(job).toBeDefined()
+    expect(job!.kind).toBe('pwsh')
+    expect(job!.output).toEqual({ total: 0, earliest: 0 })
+
+    stdout.text = 'progress-line\n'
+    stderr.text = 'warn-line\n'
+    await until(() => {
+      const chunks = jobs.readAt(job!.id, 0).chunks
+      return chunks.some(chunk => chunk.text.includes('progress-line'))
+        && chunks.some(chunk => chunk.text.includes('warn-line'))
+        ? true
+        : undefined
+    })
+    const chunks = jobs.readAt(job!.id, 0).chunks
+    expect(chunks.find(chunk => chunk.text.includes('progress-line'))?.channel).toBe('stdout')
+    expect(chunks.find(chunk => chunk.text.includes('warn-line'))?.channel).toBe('stderr')
+
+    scripted.finish()
+    await until(() => jobs.get(job!.id).status === 'completed' ? true : undefined)
+    expect(jobs.get(job!.id).detail).toBe('exit code: 0')
+  })
+
+  it('a failing reader warns once and never fakes a terminal state onto the running job', async () => {
+    const { ctx, pwsh } = await setup()
+    const warn = vi.fn()
+    ctx.logger.warn = warn as never
+    let resolveDone: () => void = () => {}
+    const done = new Promise<void>((resolve) => { resolveDone = resolve })
+    const proc: ShellProcess = {
+      status: 'running',
+      exitCode: null,
+      signal: null,
+      done,
+      readOutput: () => ({ delta: '', lossy: false }),
+      kill: () => false,
+      observed: {
+        stdout: { readFrom() { throw new Error('reader boom') } },
+        stderr: { readFrom: () => ({ text: '', nextOffset: 0, lossy: false }) },
+      },
+    }
+    pwsh.backgroundHandler = () => proc
+    await call(ctx, { command: 'Get-Broken', description: 'test command', run_in_background: true })
+    const jobs = ctx.jobs
+    const job = jobs.list()[0]
+    await until(() => warn.mock.calls.some(args => String(args[0]).includes('output source for')) ? true : undefined)
+    // The reader already failed; the job must wait for real settlement rather
+    // than freezing a fake terminal state onto the running process.
+    await new Promise(resolve => setTimeout(resolve, 50))
+    expect(jobs.get(job!.id).status).toBe('running')
+    expect(warn).toHaveBeenCalledTimes(1)
+    proc.status = 'completed'
+    proc.exitCode = 0
+    resolveDone()
+    await until(() => jobs.get(job!.id).status !== 'running' ? true : undefined)
+    expect(jobs.get(job!.id)).toMatchObject({ status: 'completed', detail: 'exit code: 0' })
+  })
+
+  it('a silent process settles with an empty ring', async () => {
+    const { ctx, pwsh } = await setup()
+    const scripted = observableProcess()
+    pwsh.backgroundHandler = () => scripted.proc
+
+    await call(ctx, { command: 'Start-Job', description: 'test command', run_in_background: true })
+    const jobs = ctx.jobs
+    const job = jobs.list()[0]
+    expect(jobs.readAt(job!.id, 0).chunks).toEqual([])
+
+    scripted.finish()
+    await until(() => jobs.get(job!.id).status === 'completed' ? true : undefined)
+    expect(jobs.get(job!.id).output).toEqual({ total: 0, earliest: 0 })
+  })
+})
+
+describe('owned background output (pwsh)', () => {
+  it('keeps an owned background run under the owning session', async () => {
+    const { ctx, pwsh } = await setup()
+    const ownerId = SessionId('pwsh-background-owner')
+    const owner: Agent = {
+      id: ownerId,
+      options: {},
+      session: Session.create(ownerId, undefined, {
+        version: SESSION_FORMAT_VERSION, id: ownerId, createdAt: 0, cwd: process.cwd(), isSeeded: false,
+      }),
+      inbox: unsupportedInbox(),
+      status: 'idle',
+      ctx,
+      send: () => {},
+      followup: () => {},
+      steer: () => {},
+      inject: () => {},
+      cancel: () => {},
+      runMaintenance: task => task(new AbortController().signal),
+      whenIdle: () => Promise.resolve(),
+    }
+    ctx.agents.register(owner)
+    const scripted = observableProcess()
+    pwsh.backgroundHandler = () => scripted.proc
+    await ctx.tools.execute({
+      signal: testToolSignal,
+      callId: ToolCallId('pwsh-background-owned'),
+      name: 'pwsh',
+      arguments: { command: 'Get-Slow', description: 'test command', run_in_background: true },
+      agent: owner,
+    })
+    const owned = ctx.jobs
+    const job = owned.list(owner.id)[0]
+    expect(job).toBeDefined()
+    expect(job!.owner).toBe(owner.id)
+    expect(() => ctx.jobs.readAt(job!.id, 0)).toThrow(/belongs to another session/)
+    expect(owned.readAt(job!.id, 0, owner.id).chunks).toEqual([])
+    scripted.finish()
+    await until(() => owned.get(job!.id, owner.id).status === 'completed' ? true : undefined)
+  })
+})
+
+describe('processSources (pwsh)', () => {
+  it('reads nothing while the process is not spawned yet', () => {
+    const [stdout, stderr] = processSources(() => undefined)
+    expect(stdout!.channel).toBe('stdout')
+    expect(stderr!.channel).toBe('stderr')
+    expect(stdout!.read(0)).toEqual({ text: '', nextOffset: 0, lossy: false })
+    expect(stderr!.read(3)).toEqual({ text: '', nextOffset: 3, lossy: false })
+  })
+})
diff --git a/packages/shell/tool-pwsh/tests/tools.spec.ts b/packages/shell/tool-pwsh/tests/tools.spec.ts
index 34e095d49c..d5c14d363d 100644
--- a/packages/shell/tool-pwsh/tests/tools.spec.ts
+++ b/packages/shell/tool-pwsh/tests/tools.spec.ts
@@ -32,9 +32,12 @@ import { turnBoundaryProjectionDefinition } from '@deepseek-ai/dsh-agent-loop'
 import SandboxPolicyService from '@deepseek-ai/dsh-sandbox-policy'
 import * as ToolPwsh from '@deepseek-ai/dsh-tool-pwsh'
 import * as BashEnvPlugin from '@deepseek-ai/dsh-shell-env'
-import type { ShellProcessRead } from '@deepseek-ai/dsh-shell'
+import { escalationHintMarker, sandboxDenialMarker } from '@deepseek-ai/dsh-sandbox'
 import { processOutcome } from '../src/background.ts'
-import { renderPwshProcessRead, renderPwshResult } from '../src/render.ts'
+import { renderPwshResult } from '../src/render.ts'
+
+/** Empty offset readers for fakes that never produce output. */
+const silentReader = { readFrom: (fromByte: number) => ({ text: '', nextOffset: fromByte, lossy: false }) }
 
 const testToolSignal = new AbortController().signal
 
@@ -97,20 +100,19 @@ function runResult(stdout: string, overrides?: Partial<ShellRunResult>): ShellRu
   }
 }
 
-/** A settled successful background handle; overrides script failure shapes. */
+/** A settled successful background handle whose stdout the registry pump reads by offset (ASCII: offsets are string indexes). */
 function fakeProcess(delta = 'bg-ok\n'): ShellProcess {
-  let consumed = false
   return {
     status: 'completed',
     exitCode: 0,
     signal: null,
     done: Promise.resolve(),
-    readOutput: () => {
-      if (consumed) return { delta: '', lossy: false }
-      consumed = true
-      return { delta, lossy: false }
-    },
+    readOutput: () => ({ delta: '', lossy: false }),
     kill: () => false,
+    observed: {
+      stdout: { readFrom: (fromByte: number) => ({ text: delta.slice(fromByte), nextOffset: delta.length, lossy: false }) },
+      stderr: { readFrom: (fromByte: number) => ({ text: '', nextOffset: fromByte, lossy: false }) },
+    },
   }
 }
 
@@ -124,6 +126,7 @@ function killableProcess(): ShellProcess {
     signal: null,
     done,
     readOutput: () => ({ delta: '', lossy: false }),
+    observed: { stdout: silentReader, stderr: silentReader },
     kill: () => {
       if (proc.status !== 'running') return false
       proc.status = 'killed'
@@ -1018,58 +1021,6 @@ describe('renderPwshResult sandbox markers', () => {
   })
 })
 
-describe('renderPwshProcessRead', () => {
-  const base: ShellProcessRead = { delta: 'out\n', lossy: false }
-
-  it('returns the delta verbatim for a lossless read', () => {
-    expect(renderPwshProcessRead(base)).toBe('out\n')
-    expect(renderPwshProcessRead({ delta: '', lossy: false })).toBe('')
-  })
-
-  it('appends the loss notice with the available spill paths', () => {
-    expect(renderPwshProcessRead({ ...base, lossy: true, stdoutSpillPath: 'C:\\spill\\out.log' }))
-      .toBe('out\n[some output was dropped from memory; full output: C:\\spill\\out.log]')
-    expect(renderPwshProcessRead({
-      ...base,
-      lossy: true,
-      stdoutSpillPath: 'C:\\spill\\out.log',
-      stderrSpillPath: 'C:\\spill\\err.log',
-    }))
-      .toBe('out\n[some output was dropped from memory; full output: C:\\spill\\out.log, C:\\spill\\err.log]')
-  })
-
-  it('reports (unavailable) when a lossy read has no safe spill path', () => {
-    expect(renderPwshProcessRead({ ...base, lossy: true }))
-      .toBe('out\n[some output was dropped from memory; full output: (unavailable)]')
-  })
-
-  it('an empty lossy delta is the notice alone', () => {
-    expect(renderPwshProcessRead({ delta: '', lossy: true, stderrSpillPath: 'C:\\spill\\err.log' }))
-      .toBe('[some output was dropped from memory; full output: C:\\spill\\err.log]')
-  })
-
-  it('inserts the separating newline only when the delta lacks one', () => {
-    expect(renderPwshProcessRead({ delta: 'tail', lossy: true }))
-      .toBe('tail\n[some output was dropped from memory; full output: (unavailable)]')
-    expect(renderPwshProcessRead({ delta: 'tail\n', lossy: true }))
-      .toBe('tail\n[some output was dropped from memory; full output: (unavailable)]')
-  })
-
-  it('appends the runner-failed notice (denial outranked)', () => {
-    expect(renderPwshProcessRead({ delta: 'x', lossy: false }, { mode: 'read-only', denied: true, runnerFailed: true }))
-      .toBe('x\n[sandbox: the sandbox runner itself failed under read-only mode — the command did not run; this is a sandbox problem, not a command failure]')
-  })
-
-  it('appends the denial marker and hints only when escalation is advertised', () => {
-    expect(renderPwshProcessRead({ delta: 'x', lossy: false }, { mode: 'read-only', denied: true }))
-      .toBe('x\n[sandbox: file access denied under read-only mode]')
-    expect(renderPwshProcessRead({ delta: 'x', lossy: false }, { mode: 'read-only', denied: true }, ['workspace-write']))
-      .toBe('x\n[sandbox: file access denied under read-only mode]\n'
-        + '[sandbox: escalation available — retry this exact command once with sandbox_permissions '
-        + '(the narrowest wider mode that suffices) + justification; the approval prompt asks the user]')
-  })
-})
-
 describe('processOutcome', () => {
   function settled(over: Partial<ShellProcess>): ShellProcess {
     return {
@@ -1078,6 +1029,7 @@ describe('processOutcome', () => {
       signal: null,
       done: Promise.resolve(),
       readOutput: () => ({ delta: '', lossy: false }),
+      observed: { stdout: silentReader, stderr: silentReader },
       kill: () => false,
       ...over,
     }
@@ -1102,4 +1054,14 @@ describe('processOutcome', () => {
     expect(processOutcome(settled({ exitCode: null })))
       .toEqual({ status: 'completed', detail: 'exit code: 0' })
   })
+
+  it('appends sandbox facts to the terminal detail', () => {
+    const denied = processOutcome(settled({ exitCode: 1, sandbox: { mode: 'read-only', denied: true } }), ['workspace-write'])
+    expect(denied.detail).toBe(`exit code: 1; ${sandboxDenialMarker('read-only')} ${escalationHintMarker('command')}`)
+    const deniedWithoutEscalation = processOutcome(settled({ exitCode: 1, sandbox: { mode: 'read-only', denied: true } }))
+    expect(deniedWithoutEscalation.detail).toBe(`exit code: 1; ${sandboxDenialMarker('read-only')}`)
+    const runnerFailed = processOutcome(settled({ exitCode: 1, sandbox: { mode: 'read-only', denied: false, runnerFailed: true } }))
+    expect(runnerFailed.detail).toContain('the sandbox runner itself failed under read-only mode')
+    expect(processOutcome(settled({ sandbox: { mode: 'read-only', denied: false } })).detail).toBe('exit code: 0')
+  })
 })
diff --git a/packages/subagent/subagent/src/run-settlement.ts b/packages/subagent/subagent/src/run-settlement.ts
index 90eb9eec43..8d46ffbff4 100644
--- a/packages/subagent/subagent/src/run-settlement.ts
+++ b/packages/subagent/subagent/src/run-settlement.ts
@@ -37,7 +37,7 @@ function failureDetail(result: SubagentResult): string {
 function runOutcome(result: SubagentResult): JobOutcome {
   switch (result.stopReason) {
     case 'completed':
-      return { status: 'completed', output: finalText(result.output) }
+      return { status: 'completed', result: finalText(result.output) }
     case 'aborted':
       return result.diagnostic === undefined
         ? { status: 'killed' }
diff --git a/packages/subagent/subagent/tests/run-settlement.spec.ts b/packages/subagent/subagent/tests/run-settlement.spec.ts
index 146181d43a..20fc514504 100644
--- a/packages/subagent/subagent/tests/run-settlement.spec.ts
+++ b/packages/subagent/subagent/tests/run-settlement.spec.ts
@@ -9,7 +9,7 @@ const MAX_SUBAGENT_DIAGNOSTIC_BYTES = 4_096
 
 describe('outcome mapping helpers', () => {
   it.each([
-    ['completed', { status: 'completed', output: 'partial' }],
+    ['completed', { status: 'completed', result: 'partial' }],
     ['aborted', { status: 'killed' }],
     ['error', { status: 'failed', detail: 'error' }],
     ['max-tokens', { status: 'failed', detail: 'max-tokens' }],
@@ -34,7 +34,7 @@ describe('outcome mapping helpers', () => {
       dispose() { order.push('dispose'); return Promise.resolve() },
     })
     order.push('reported')
-    expect(completed).toEqual({ status: 'completed', output: 'ok' })
+    expect(completed).toEqual({ status: 'completed', result: 'ok' })
     expect(order).toEqual(['dispose', 'reported'])
 
     // An infrastructure rejection still disposes and reports failed.
diff --git a/packages/subagent/tool-subagent/src/index.ts b/packages/subagent/tool-subagent/src/index.ts
index 3c70b80c6b..e16a70f949 100644
--- a/packages/subagent/tool-subagent/src/index.ts
+++ b/packages/subagent/tool-subagent/src/index.ts
@@ -545,7 +545,7 @@ export function apply(ctx: Context, config: Config, session?: Session): void {
             const id = jobs.start({
               kind: 'subagent',
               label: args.description,
-              owner: parent,
+              owner: parent.id,
               run: () => {
                 const controller = new AbortController()
                 const start = runtimeCtx.subagents.start(config.provider, { ...request, signal: controller.signal })
@@ -554,7 +554,7 @@ export function apply(ctx: Context, config: Config, session?: Session): void {
                     controller.abort(reason ?? 'background subagent task killed')
                   },
                   done: settleStart(start, controller.signal),
-                  // No readOutput: the child session owns intermediate detail.
+                  // No output sources: the child session owns intermediate detail.
                 }
               },
             })
diff --git a/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts b/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts
index 5b58115cfa..b7d20b8946 100644
--- a/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts
+++ b/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts
@@ -883,7 +883,7 @@ describe('dsh-tool-subagent background mode', () => {
     })
     expect(text(collected)).toBe('background answer\n[status: completed]')
 
-    // Final-output reads are idempotent (not consumed).
+    // The result rides the first read after settlement; a later read carries only the status.
     const again = await ctx.tools.execute({
       signal: testToolSignal,
       callId: ToolCallId('collect-2'),
@@ -891,7 +891,7 @@ describe('dsh-tool-subagent background mode', () => {
       arguments: { job_id: 'subagent-1' },
       agent: parent,
     })
-    expect(text(again)).toBe('background answer\n[status: completed]')
+    expect(text(again)).toBe('(no new output)\n[status: completed]')
   })
 
   it('preserves provider diagnostics in one-shot background failure detail', async () => {
@@ -972,7 +972,7 @@ describe('dsh-tool-subagent background mode', () => {
     const result = await resultPromise
 
     expect(result.isError).toBe(true)
-    expect(ctx.jobs.list(parent)).toEqual([])
+    expect(ctx.jobs.list(parent.id)).toEqual([])
   })
 
   it('rejects startup when the provider changes during asynchronous route preflight', async () => {
@@ -1082,7 +1082,8 @@ describe('dsh-tool-subagent background mode', () => {
       arguments: { job_id: 'subagent-1', wait: true },
       agent: parent,
     })
-    expect(text(output)).toBe('(no new output)\n[status: killed]')
+    // The registry records the model's kill reason as the terminal detail.
+    expect(text(output)).toBe('(no new output)\n[status: killed, no longer needed]')
   })
 
   it('reports startup rollback failure after cancellation as a failed job', async () => {
@@ -1169,7 +1170,7 @@ describe('dsh-tool-subagent background mode', () => {
 
     // The aborted children settle as killed tasks.
     const killed = await ctx.tools.execute({ signal: testToolSignal, callId: ToolCallId('w1'), name: 'job_output', arguments: { job_id: 'subagent-1', wait: true }, agent: parent })
-    expect(text(killed)).toBe('(no new output)\n[status: killed]')
+    expect(text(killed)).toBe('(no new output)\n[status: killed, superseded]')
   })
 
 })
@@ -1240,7 +1241,7 @@ describe('dsh-tool-subagent continuable background mode', () => {
     expect(match).not.toBeNull()
     const [, childId] = match!
     // No Task was created for the continuable child.
-    expect(ctx.jobs.list(parent)).toEqual([])
+    expect(ctx.jobs.list(parent.id)).toEqual([])
 
     await vi.waitFor(() => {
       expect(ctx.agents.get(SessionId(childId!))).toBeUndefined()
@@ -1271,7 +1272,7 @@ describe('dsh-tool-subagent continuable background mode', () => {
     if (result.isError) throw new Error('expected foreground subagent success')
     expect(result.value).toMatchObject({ kind: 'foreground' })
     expect(text(result)).toBe('continuable answer')
-    expect(ctx.jobs.list(parent)).toEqual([])
+    expect(ctx.jobs.list(parent.id)).toEqual([])
   })
 
   it('isolates a cancelled continuable preparation from a concurrent sibling', async () => {
diff --git a/packages/terminal/terminal-bash/tests/local.spec.ts b/packages/terminal/terminal-bash/tests/local.spec.ts
index 7ef28c6929..962421ce9c 100644
--- a/packages/terminal/terminal-bash/tests/local.spec.ts
+++ b/packages/terminal/terminal-bash/tests/local.spec.ts
@@ -233,9 +233,10 @@ describe.skipIf(process.platform === 'win32')('terminal-bash real shell', () =>
     const child = /CHILD=(\d+)/.exec(output)?.[1]
     expect(child).toBeDefined()
     const pid = Number(child)
-    expect(() => process.kill(pid, 0)).not.toThrow()
+    expect(processIsRunning(pid)).toBe(true)
     await ctx.terminals.kill(agent, created.sessionId)
-    expect(() => process.kill(pid, 0)).toThrow()
+    // Linux can retain a stopped descendant as a zombie until its parent reaps it.
+    expect(processIsRunning(pid)).toBe(false)
   }, 10_000)
 
   it('quiesces a disowned same-session descendant after the shell exits naturally', async () => {
diff --git a/packages/terminal/tool-terminal/src/background.ts b/packages/terminal/tool-terminal/src/background.ts
new file mode 100644
index 0000000000..47494f7cff
--- /dev/null
+++ b/packages/terminal/tool-terminal/src/background.ts
@@ -0,0 +1,31 @@
+/**
+ * Generic-job adaptation for background terminal sends: the registry pull
+ * source over the backend's consuming send reader.
+ *
+ * @module @deepseek-ai/dsh-tool-terminal/background
+ */
+
+import type { JobOutputSource } from '@deepseek-ai/dsh-jobs'
+import type { TerminalSendOperation } from '@deepseek-ai/dsh-terminal'
+import { renderSendRead } from './render.ts'
+
+/**
+ * Adapt the backend's consuming send reader to a registry pull source. The
+ * reader has no offsets of its own — each call hands over what arrived since
+ * the previous one — so the source counts the bytes it delivered to keep the
+ * registry's cursor monotonic. It binds lazily because the send starts inside
+ * the job starter, after the registry admitted the job; a read before that
+ * point delivers nothing.
+ * @param operation - the live send, once the starter has begun it.
+ * @returns one unlabeled source over the send's bounded delta.
+ */
+export function sendSource(operation: () => TerminalSendOperation | undefined): JobOutputSource {
+  return {
+    read: (fromByte) => {
+      const live = operation()
+      if (live === undefined) return { text: '', nextOffset: fromByte, lossy: false }
+      const text = renderSendRead(live.readOutput())
+      return { text, nextOffset: fromByte + Buffer.byteLength(text), lossy: false }
+    },
+  }
+}
diff --git a/packages/terminal/tool-terminal/src/index.ts b/packages/terminal/tool-terminal/src/index.ts
index 1865ebe165..6da2af03fe 100644
--- a/packages/terminal/tool-terminal/src/index.ts
+++ b/packages/terminal/tool-terminal/src/index.ts
@@ -9,11 +9,12 @@ import z from '@deepseek-ai/schemastery'
 import type { Agent } from '@deepseek-ai/dsh-agent'
 import type { ContentBlock } from '@deepseek-ai/dsh-llm'
 import { TerminalSessionId } from '@deepseek-ai/dsh-terminal'
-import type { TerminalSendResult, TerminalSessionId as TerminalSessionIdType, TerminalSignal } from '@deepseek-ai/dsh-terminal'
+import type { TerminalSendOperation, TerminalSendResult, TerminalSessionId as TerminalSessionIdType, TerminalSignal } from '@deepseek-ai/dsh-terminal'
 import type {} from '@deepseek-ai/dsh-jobs'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import type { ToolDefinition } from '@deepseek-ai/dsh-tools'
-import { boundTerminalText, renderList, renderRead, renderSend, renderSendRead, renderSpawn } from './render.ts'
+import { sendSource } from './background.ts'
+import { boundTerminalText, renderList, renderRead, renderSend, renderSpawn } from './render.ts'
 
 declare module '@deepseek-ai/dsh-jobs' {
   interface JobKindMap {
@@ -252,23 +253,25 @@ export function apply(ctx: Context, config: Config = {}): void {
         const jobs = ctx.get('jobs')
         if (jobs === undefined) throw new Error('background terminal sends require @deepseek-ai/dsh-jobs and @deepseek-ai/dsh-tool-jobs')
         let cancelRequested = false
+        let operation: TerminalSendOperation | undefined
         const jobId = jobs.start({
           kind: 'pty-send',
           label: `${id}: ${args.text || '(input)'}`,
-          owner,
+          owner: owner.id,
           outputLimitBytes: maxResultBytes,
+          output: [sendSource(() => operation)],
           run: () => {
-            const operation = ctx.terminals.startSend(owner, id, request)
+            const started = ctx.terminals.startSend(owner, id, request)
+            operation = started
             return {
               cancel: () => {
                 cancelRequested = true
-                operation.cancel()
+                started.cancel()
               },
-              done: operation.done.then(
+              done: started.done.then(
                 result => ({ status: cancelRequested ? 'killed' as const : 'completed' as const, detail: sendDetail(result) }),
                 (error: unknown) => ({ status: 'failed' as const, detail: String(error) }),
               ),
-              readOutput: () => renderSendRead(operation.readOutput()),
             }
           },
         })
diff --git a/packages/terminal/tool-terminal/tests/tools.spec.ts b/packages/terminal/tool-terminal/tests/tools.spec.ts
index 934b4c6d60..e110562551 100644
--- a/packages/terminal/tool-terminal/tests/tools.spec.ts
+++ b/packages/terminal/tool-terminal/tests/tools.spec.ts
@@ -8,10 +8,11 @@ import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRuntime, { renderToolsSdk } from '@deepseek-ai/dsh-tools'
 import type { ToolSdkSchema } from '@deepseek-ai/dsh-tools/src/ts-types.ts'
 import TerminalSessionService, { TerminalSessionId } from '@deepseek-ai/dsh-terminal'
-import type { TerminalBackend, TerminalBackendSession, TerminalSendOperation, TerminalSendRequest, TerminalSessionStatus, TerminalSignal } from '@deepseek-ai/dsh-terminal'
+import type { TerminalBackend, TerminalBackendSession, TerminalSendOperation, TerminalSendRead, TerminalSendRequest, TerminalSessionStatus, TerminalSignal } from '@deepseek-ai/dsh-terminal'
 import LocalJobRegistry from '@deepseek-ai/dsh-jobs-local'
 import * as ToolJobs from '@deepseek-ai/dsh-tool-jobs'
 import * as ToolPty from '@deepseek-ai/dsh-tool-terminal'
+import { sendSource } from '../src/background.ts'
 import { unsupportedInbox } from '@deepseek-ai/dsh-agent-loop-testkit'
 
 async function fakeAgent(ctx: Context, rawId: string): Promise<Agent> {
@@ -55,7 +56,11 @@ class StubSession implements TerminalBackendSession {
     }))
     const operation: TerminalSendOperation = {
       done,
-      readOutput: () => ({ delta: this.delta, truncated: this.deltaTruncated }),
+      readOutput: () => {
+        const delta = this.delta
+        this.delta = ''
+        return { delta, truncated: this.deltaTruncated }
+      },
       cancel: () => {
         if (cancelled) return false
         cancelled = true
@@ -403,6 +408,19 @@ describe('tool-terminal foreground API', () => {
   })
 })
 
+describe('sendSource', () => {
+  it('reads nothing before the send starts and counts delivered bytes afterwards', () => {
+    const reads: TerminalSendRead[] = [{ delta: '界', truncated: false }, { delta: '', truncated: true }]
+    const send: { operation?: TerminalSendOperation } = {}
+    const source = sendSource(() => send.operation)
+    expect(source.read(0)).toEqual({ text: '', nextOffset: 0, lossy: false })
+    send.operation = { readOutput: () => reads.shift()!, cancel: () => false, done: new Promise(() => {}) }
+    expect(source.read(0)).toEqual({ text: '界', nextOffset: 3, lossy: false })
+    // A truncated delta carries the same marker the foreground read shows.
+    expect(source.read(3)).toEqual({ text: '[output truncated]', nextOffset: 21, lossy: false })
+  })
+})
+
 describe('tool-terminal task integration', () => {
   it('registers a generic task and exposes incremental output', async () => {
     const { ctx, agent } = await setup(true)
diff --git a/packages/test-support/client-runtime/src/assembly/remote-default-responses.ts b/packages/test-support/client-runtime/src/assembly/remote-default-responses.ts
index 485882f05f..074db36701 100644
--- a/packages/test-support/client-runtime/src/assembly/remote-default-responses.ts
+++ b/packages/test-support/client-runtime/src/assembly/remote-default-responses.ts
@@ -42,7 +42,7 @@ export const remoteDefaultResponses: RemoteTable = {
   ],
   stream: {
     // api-session-controller client `apply`: the control stream's opening baseline, then open.
-    'session/control': openStream([{ type: 'baseline', value: { jobs: {}, projections: {} } }]),
+    'session/control': openStream([{ type: 'baseline', value: { projections: {} } }]),
     // api-workspace-controller client `apply`: the follow stream's opening baseline, then open.
     'workspace/follow': openStream([{ type: 'baseline', value: { items: [], archivedSessionIds: [], pinnedSessionIds: [] } }]),
   },
diff --git a/packages/test-support/client-runtime/src/sessions.ts b/packages/test-support/client-runtime/src/sessions.ts
index dd07c98254..5ad261b5b0 100644
--- a/packages/test-support/client-runtime/src/sessions.ts
+++ b/packages/test-support/client-runtime/src/sessions.ts
@@ -328,7 +328,7 @@ export class TestSessions implements ISessions {
    */
   constructor(private readonly stabilize: Stabilizer, private readonly rootCtx: Context) {
     this.list = createSnapshotStore<SessionListState>({
-      ids: [], byId: {}, phase: 'ready', projectionsBySession: {}, jobsBySession: {},
+      ids: [], byId: {}, phase: 'ready', projectionsBySession: {},
     })
     rootCtx.effect(() => async () => {
       this.closed = true
diff --git a/packages/test-support/remote-mock/tests/proxy.client.spec.ts b/packages/test-support/remote-mock/tests/proxy.client.spec.ts
index b089522c48..bef18eb4c8 100644
--- a/packages/test-support/remote-mock/tests/proxy.client.spec.ts
+++ b/packages/test-support/remote-mock/tests/proxy.client.spec.ts
@@ -3,7 +3,7 @@ import { describe, expect, it, onTestFinished, vi } from 'vitest'
 import { RemoteMock, frames, ok, openStream, streamHandle, type StreamHandle } from '../src/index.ts'
 
 const describeValue = (hasDocument: boolean) => ok({ writable: true, hasDocument, namespaces: [] })
-const baseline = { type: 'baseline' as const, value: { queues: {}, jobs: {}, projections: {} } }
+const baseline = { type: 'baseline' as const, value: { projections: {} } }
 
 async function drain(source: AsyncIterable<unknown>): Promise<unknown[]> {
   const values: unknown[] = []
diff --git a/packages/util/native-command/README.i18n.yaml b/packages/util/native-command/README.i18n.yaml
index 8bc90e6e8d..b234b64011 100644
--- a/packages/util/native-command/README.i18n.yaml
+++ b/packages/util/native-command/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/util/native-command/README.md
-README.md: 9abf4031a915121b6fd2a218473b27c864f8ced8
-README.zh.md: 083318cf4bb37e1c18f016512d58df8bb8f3aec5
+README.md: e17228c694ffb8f69ef694695df54a1fa2f9a21a
+README.zh.md: 68556683ce45bbceb510a4e2fa9227ece033c492
diff --git a/packages/util/native-command/README.md b/packages/util/native-command/README.md
index 9abf4031a9..e17228c694 100644
--- a/packages/util/native-command/README.md
+++ b/packages/util/native-command/README.md
@@ -49,6 +49,8 @@ The `NativeCommandRunner` type is the injectable command boundary for host integ
 
 `revealNativePath(path, signal)` selects the file in Finder or Explorer, including WSL path translation, and opens its parent directory through `xdg-open` on desktop Linux. `nativeFileManager()` identifies that action for Host-derived UI labels; desktop availability remains a separate `canOpenNativePath()` check. Callers must authorize the absolute file path before invoking either operation. Platform dispatch is covered by injected-runner tests; native desktop verification belongs to the corresponding platform. Explorer receives an encoded file URI as a separate argument. Its exit code 1 is accepted as a delegated handoff; cancellation, missing executables, and other exit codes still reject. This acknowledgement does not prove that a desktop window selected the file.
 
+`nativeFileApplications(path, signal)` returns registered applications, localized names, icons, and the current default. macOS 12 and later use LaunchServices; Windows uses Shell association handlers; Linux uses GIO with shared XDG desktop-entry and icon lookup. `openNativeFileApplication(path, application, signal)` revalidates the handler without changing the system default. Windows delegates invocation to the Shell, and Linux delegates argument expansion to `gio launch`. WSL translates the path and uses the Windows adapter. Callers authorize the local file path. Native integration tests use private Windows file associations and Linux XDG roots on their respective platforms.
+
 -----
 
 <a id="understand-the-implementation"></a>
@@ -101,10 +103,12 @@ Nothing here enters a request prefix; this package neither assembles nor sends a
 
 <a id="known-limitations-and-deferred-work"></a>
 
+Linux association discovery and explicit launching require GIO. Missing native commands reject the query, and missing artwork returns null; callers can retain file-manager reveal as their fallback.
+
 
 These limits define when this runner is not the right tool. They are current package constraints, not a task backlog.
 
-- **No output bounding** — both streams buffer unbounded in memory; every current caller invokes small native tools whose output is a path or an error line. Adopt `dsh-output-retention` bounding before pointing this at commands with meaningful output volume.
+- Command output uses Node’s `execFile` buffer limit; oversized replies reject. Use the subprocess capability for streaming output.
 
 <a id="dev-note"></a>
 ### Dev Note
diff --git a/packages/util/native-command/README.zh.md b/packages/util/native-command/README.zh.md
index 083318cf4b..68556683ce 100644
--- a/packages/util/native-command/README.zh.md
+++ b/packages/util/native-command/README.zh.md
@@ -49,6 +49,8 @@ const { stdout, stderr } = await runNativeCommand('osascript', ['-e', script], s
 
 `revealNativePath(path, signal)` 在 Finder 或文件资源管理器中选中文件，包含 WSL 路径转换；在桌面 Linux 上通过 `xdg-open` 打开上层目录。`nativeFileManager()` 标识该操作，供 UI 根据 Host 选择文案；桌面是否可用仍由独立的 `canOpenNativePath()` 检查决定。调用方必须先授权绝对文件路径，再执行操作。平台分派由注入运行器的测试覆盖；原生桌面验证由对应平台负责。 Explorer 接收独立参数中的编码文件 URI。退出码 1 按已转交请求处理；取消、找不到可执行文件和其他退出码仍然报错。该确认不能证明桌面窗口已选中文件。
 
+`nativeFileApplications(path, signal)` 返回关联应用、本地化名称、图标和当前默认项。macOS 12 及以上版本使用 LaunchServices，Windows 使用 Shell 关联处理器，Linux 使用 GIO，并共用 XDG 桌面文件和图标读取逻辑。`openNativeFileApplication(path, application, signal)` 重新验证关联应用，不修改系统默认值。Windows 交给 Shell 启动应用，Linux 交给 `gio launch` 展开参数。WSL 转换路径后使用 Windows 适配器。调用方负责验证本地文件路径。原生集成测试分别在相应平台使用独立的 Windows 文件关联和 Linux XDG 目录。
+
 -----
 
 <a id="understand-the-implementation"></a>
@@ -101,10 +103,12 @@ const { stdout, stderr } = await runNativeCommand('osascript', ['-e', script], s
 
 <a id="known-limitations-and-deferred-work"></a>
 
+Linux 的关联查询和指定应用启动需要 GIO。缺少原生命令时查询失败，缺失的图标返回 null；调用方可以保留文件定位作为备用动作。
+
 
 这些限制说明本运行器何时不是合适的工具。它们是当前包约束，不是任务积压。
 
-- **不做输出限量**——两路流在内存中无界缓冲；当前每个调用方只运行输出为一个路径或一行错误的小型原生工具。把它指向输出量可观的命令之前，先接入 `dsh-output-retention` 限量。
+- 命令输出受 Node 的 `execFile` 缓冲上限约束，超过上限时拒绝结果。流式输出由 subprocess 能力处理。
 
 <a id="dev-note"></a>
 ### 开发备注
diff --git a/packages/util/native-command/package.json b/packages/util/native-command/package.json
index 8060a32a2a..9fc16ba0a9 100644
--- a/packages/util/native-command/package.json
+++ b/packages/util/native-command/package.json
@@ -19,10 +19,15 @@
       "default": "./lib/index.js"
     },
     "./src/*": "./src/*",
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./types": {
+      "types": "./lib/types/types.d.ts",
+      "default": "./lib/types/types.js"
+    }
   },
   "files": [
     "lib/index.js",
+    "lib/types/**/*.js",
     "lib/types/**/*.d.ts"
   ],
   "license": "MIT",
diff --git a/packages/util/native-command/src/desktop-entry.ts b/packages/util/native-command/src/desktop-entry.ts
new file mode 100644
index 0000000000..b2589aabb4
--- /dev/null
+++ b/packages/util/native-command/src/desktop-entry.ts
@@ -0,0 +1,76 @@
+/** Shared XDG desktop-entry fields and icon lookup for directory and file application catalogs. */
+import { readFile, stat } from 'node:fs/promises'
+import { isAbsolute, join } from 'node:path'
+
+/** Decoded application icon bytes suitable for an image response or data URL. */
+export interface DesktopIcon {
+  readonly bytes: Buffer
+  readonly contentType: 'image/png' | 'image/svg+xml'
+}
+
+/**
+ * Read the main desktop-entry section without interpreting executable commands.
+ * @param text - installed desktop-entry text.
+ * @returns its literal field values; action sections are excluded.
+ */
+export function desktopEntryFields(text: string): Readonly<Record<string, string>> {
+  let main = false
+  const fields = new Map<string, string>()
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim()
+    if (trimmed.startsWith('[')) { main = trimmed === '[Desktop Entry]'; continue }
+    if (!main || trimmed.startsWith('#')) continue
+    const separator = trimmed.indexOf('=')
+    if (separator > 0) fields.set(trimmed.slice(0, separator).trim(), trimmed.slice(separator + 1).trim())
+  }
+  return Object.fromEntries(fields)
+}
+
+/**
+ * Resolve XDG application and icon roots in desktop precedence order.
+ * @param home - user's home directory.
+ * @param env - desktop environment values.
+ * @returns data-home followed by system data directories.
+ */
+export function desktopDataDirectories(home: string, env: Readonly<Record<string, string | undefined>>): readonly string[] {
+  return [env.XDG_DATA_HOME ?? join(home, '.local', 'share'),
+    ...(env.XDG_DATA_DIRS ?? '/usr/local/share:/usr/share').split(':').filter(Boolean)]
+}
+
+/** Read an installed PNG or SVG icon; absent paths and directories have no pixels. */
+async function readIcon(path: string): Promise<DesktopIcon | null> {
+  const contentType = path.endsWith('.png') ? 'image/png' : path.endsWith('.svg') ? 'image/svg+xml' : null
+  if (contentType === null) return null
+  try {
+    if (!(await stat(path)).isFile()) return null
+    return { bytes: await readFile(path), contentType }
+  } catch (_error) {
+    // Missing or unreadable artwork does not remove an otherwise usable application.
+    return null
+  }
+}
+
+/**
+ * Resolve an absolute icon path or an installed hicolor/pixmaps icon name.
+ * @param name - desktop-entry Icon field.
+ * @param directories - XDG data roots in precedence order.
+ * @returns image bytes and media type, or null when artwork is unavailable.
+ */
+export async function desktopApplicationIcon(name: string, directories: readonly string[]): Promise<DesktopIcon | null> {
+  if (isAbsolute(name)) return readIcon(name)
+  for (const directory of directories) {
+    for (const size of ['512x512', '256x256', '128x128', '64x64', '48x48', '32x32']) {
+      for (const extension of ['png', 'svg']) {
+        const icon = await readIcon(join(directory, 'icons', 'hicolor', size, 'apps', `${name}.${extension}`))
+        if (icon !== null) return icon
+      }
+    }
+    const scalable = await readIcon(join(directory, 'icons', 'hicolor', 'scalable', 'apps', `${name}.svg`))
+    if (scalable !== null) return scalable
+    for (const extension of ['png', 'svg']) {
+      const icon = await readIcon(join(directory, 'pixmaps', `${name}.${extension}`))
+      if (icon !== null) return icon
+    }
+  }
+  return null
+}
diff --git a/packages/util/native-command/src/file-applications-linux.ts b/packages/util/native-command/src/file-applications-linux.ts
new file mode 100644
index 0000000000..017473f273
--- /dev/null
+++ b/packages/util/native-command/src/file-applications-linux.ts
@@ -0,0 +1,66 @@
+/** Linux file associations from GIO, with shared XDG metadata and artwork lookup. */
+import { readdir, readFile } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { join, relative, sep } from 'node:path'
+import { desktopApplicationIcon, desktopDataDirectories, desktopEntryFields } from './desktop-entry.ts'
+import type { NativeCommandRunner } from './runner.ts'
+import type { NativeFileApplication } from './types.ts'
+
+/** Find a desktop id, including ids derived from nested application directories. */
+async function desktopFile(root: string, id: string, directory = root): Promise<string | null> {
+  let entries
+  try { entries = await readdir(directory, { withFileTypes: true }) } catch (_error) {
+    // An absent XDG root contributes no applications.
+    return null
+  }
+  for (const entry of entries) {
+    const path = join(directory, entry.name)
+    if (!entry.isDirectory() && relative(root, path).split(sep).join('-') === id) return path
+  }
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      const found = await desktopFile(root, id, join(directory, entry.name))
+      if (found !== null) return found
+    }
+  }
+  return null
+}
+
+/**
+ * Query all registered file handlers from GIO without executing desktop-entry command text.
+ * @param path - verified local file path.
+ * @param signal - caller cancellation.
+ * @param run - native command runner.
+ * @param env - XDG and locale settings.
+ * @returns registered applications with the desktop's default marked.
+ */
+export async function linuxFileApplications(
+  path: string, signal: AbortSignal, run: NativeCommandRunner, env: NodeJS.ProcessEnv,
+): Promise<readonly NativeFileApplication[]> {
+  const info = await run('gio', ['info', '-a', 'standard::content-type', path], signal)
+  const mime = /standard::content-type:\s*(\S+)/.exec(info.stdout)?.[1]
+  if (mime === undefined) throw new Error('GIO did not identify the file content type')
+  const result = await run('env', ['LC_ALL=C', 'gio', 'mime', mime], signal)
+  const preferred = /^Default application.*:\s*(.+\.desktop)\s*$/m.exec(result.stdout)?.[1]
+  const ids = [...new Set([...(preferred === undefined ? [] : [preferred]), ...result.stdout.split(/\r?\n/)
+    .filter(line => /^\s+.*\.desktop\s*$/.test(line)).map(line => line.trim())])]
+  const directories = desktopDataDirectories(env.HOME ?? homedir(), env)
+  const locale = (env.LC_ALL ?? env.LC_MESSAGES ?? env.LANG ?? '').replace(/\..*$/, '')
+  const applications: NativeFileApplication[] = []
+  for (const id of ids) {
+    signal.throwIfAborted()
+    let entryPath: string | null = null
+    for (const directory of directories) {
+      entryPath = await desktopFile(join(directory, 'applications'), id)
+      if (entryPath !== null) break
+    }
+    if (entryPath === null) continue
+    const fields = desktopEntryFields(await readFile(entryPath, 'utf8'))
+    const name = fields[`Name[${locale}]`] ?? fields[`Name[${locale.replace(/_.*/, '')}]`] ?? fields.Name
+    if (name === undefined || fields.Hidden === 'true') continue
+    const icon = fields.Icon === undefined ? null : await desktopApplicationIcon(fields.Icon, directories)
+    applications.push({ id: entryPath, name, default: id === preferred,
+      icon: icon === null ? null : `data:${icon.contentType};base64,${icon.bytes.toString('base64')}` })
+  }
+  return applications
+}
diff --git a/packages/util/native-command/src/file-applications-windows.ts b/packages/util/native-command/src/file-applications-windows.ts
new file mode 100644
index 0000000000..a468c9979c
--- /dev/null
+++ b/packages/util/native-command/src/file-applications-windows.ts
@@ -0,0 +1,233 @@
+/** Windows Shell association queries and invocation; paths are encoded data, never PowerShell expressions. */
+import type { NativeCommandRunner } from './runner.ts'
+
+/** Shell interfaces are declared in their native vtable order; Invoke preserves packaged-app and DDE handling. */
+const WINDOWS_ASSOCIATIONS = String.raw`
+using System;
+using System.Collections.Generic;
+using System.Drawing;
+using System.Drawing.Imaging;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Runtime.InteropServices.ComTypes;
+using System.Text;
+
+public static class DshFileAssociations {
+  [ComImport, Guid("973810ae-9599-4b88-9e4d-6ee98c9552da"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+  public interface IEnumHandlers {
+    [PreserveSig] int Next(uint count, out IHandler handler, out uint fetched);
+  }
+  [ComImport, Guid("f04061ac-1659-4a3f-a954-775aa57fc083"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+  public interface IHandler {
+    void GetName([MarshalAs(UnmanagedType.LPWStr)] out string name);
+    void GetUIName([MarshalAs(UnmanagedType.LPWStr)] out string name);
+    void GetIconLocation([MarshalAs(UnmanagedType.LPWStr)] out string path, out int index);
+    [PreserveSig] int IsRecommended();
+    void MakeDefault([MarshalAs(UnmanagedType.LPWStr)] string description);
+    void Invoke(IDataObject data);
+    void CreateInvoker(IDataObject data, [MarshalAs(UnmanagedType.Interface)] out object invoker);
+  }
+  [ComImport, Guid("43826d1e-e718-42ee-bc55-a1e261c37bfe"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+  public interface IShellItem {
+    void BindToHandler(IntPtr context, ref Guid handler, ref Guid iid, [MarshalAs(UnmanagedType.Interface)] out IDataObject data);
+  }
+  [DllImport("shell32.dll", CharSet = CharSet.Unicode, PreserveSig = false)]
+  static extern void SHAssocEnumHandlers(string extension, uint filter, out IEnumHandlers handlers);
+  [DllImport("shell32.dll", CharSet = CharSet.Unicode, PreserveSig = false)]
+  static extern void SHCreateItemFromParsingName(string path, IntPtr context, ref Guid iid, out IShellItem item);
+  [DllImport("shlwapi.dll", CharSet = CharSet.Unicode)]
+  static extern int AssocQueryString(uint flags, uint kind, string association, string extra, StringBuilder output, ref uint size);
+  [DllImport("shell32.dll", CharSet = CharSet.Unicode)]
+  static extern int SHDefExtractIcon(string path, int index, uint flags, out IntPtr large, out IntPtr small, uint size);
+  [DllImport("user32.dll")]
+  static extern bool DestroyIcon(IntPtr icon);
+
+  [DllImport("shlwapi.dll", PreserveSig = false)]
+  static extern void SHCreateThreadRef(IntPtr count, out IntPtr reference);
+  [DllImport("shlwapi.dll", PreserveSig = false)]
+  static extern void SHSetThreadRef(IntPtr reference);
+  [DllImport("shell32.dll")]
+  static extern void SHSetInstanceExplorer(IntPtr reference);
+  [StructLayout(LayoutKind.Sequential)]
+  struct Message {
+    public IntPtr window;
+    public uint message;
+    public UIntPtr wParam;
+    public IntPtr lParam;
+    public uint time;
+    public int x, y;
+    public uint reserved;
+  }
+  [DllImport("user32.dll", SetLastError = true)]
+  static extern UIntPtr SetTimer(IntPtr window, UIntPtr id, uint milliseconds, IntPtr callback);
+  [DllImport("user32.dll")]
+  static extern bool KillTimer(IntPtr window, UIntPtr id);
+  [DllImport("user32.dll", CharSet = CharSet.Unicode)]
+  static extern int GetMessage(out Message message, IntPtr window, uint min, uint max);
+  [DllImport("user32.dll")]
+  static extern bool TranslateMessage(ref Message message);
+  [DllImport("user32.dll", CharSet = CharSet.Unicode)]
+  static extern IntPtr DispatchMessage(ref Message message);
+
+  // Shell handlers may return before their asynchronous launch work releases the host.
+  // The shared Shell reference, rather than an arbitrary delay, owns that lifetime.
+  static void WithShellLifetime(Action action) {
+    IntPtr count = Marshal.AllocHGlobal(sizeof(int));
+    IntPtr reference = IntPtr.Zero;
+    try {
+      Marshal.WriteInt32(count, 0);
+      SHCreateThreadRef(count, out reference);
+      SHSetThreadRef(reference);
+      SHSetInstanceExplorer(reference);
+      int owned = Marshal.ReadInt32(count);
+      try { action(); }
+      finally {
+        if (Marshal.ReadInt32(count) > owned) {
+          // USER_TIMER_MINIMUM wakes the STA to inspect the reference count while dispatching COM work.
+          UIntPtr timer = SetTimer(IntPtr.Zero, UIntPtr.Zero, 10, IntPtr.Zero);
+          if (timer == UIntPtr.Zero) throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
+          try {
+            while (Marshal.ReadInt32(count) > owned) {
+              Message message;
+              if (GetMessage(out message, IntPtr.Zero, 0, 0) <= 0) throw new InvalidOperationException("Shell handoff message loop ended");
+              TranslateMessage(ref message);
+              DispatchMessage(ref message);
+            }
+          } finally { KillTimer(IntPtr.Zero, timer); }
+        }
+      }
+    } finally {
+      SHSetInstanceExplorer(IntPtr.Zero);
+      SHSetThreadRef(IntPtr.Zero);
+      int remaining = reference == IntPtr.Zero ? 0 : Marshal.Release(reference);
+      // An interrupted drain leaves its counter owned by the terminating helper process.
+      if (remaining == 0) Marshal.FreeHGlobal(count);
+    }
+  }
+
+  public sealed class Application {
+    public string id;
+    public string name;
+    public string icon;
+    public bool @default;
+  }
+  static string Associated(string extension, uint kind) {
+    uint size = 0;
+    AssocQueryString(0, kind, extension, null, null, ref size);
+    if (size == 0) return null;
+    var text = new StringBuilder((int)size);
+    return AssocQueryString(0, kind, extension, null, text, ref size) == 0 ? text.ToString() : null;
+  }
+  static string IconData(IHandler handler) {
+    IntPtr large = IntPtr.Zero, small = IntPtr.Zero;
+    try {
+      string source; int index;
+      handler.GetIconLocation(out source, out index);
+      source = Environment.ExpandEnvironmentVariables(source);
+      if (Path.GetExtension(source).Equals(".png", StringComparison.OrdinalIgnoreCase)) {
+        using (var original = Image.FromFile(source))
+        using (var resized = new Bitmap(original, new Size(32, 32)))
+        using (var stream = new MemoryStream()) {
+          resized.Save(stream, ImageFormat.Png);
+          return "data:image/png;base64," + Convert.ToBase64String(stream.ToArray());
+        }
+      }
+      if (SHDefExtractIcon(source, index, 0, out large, out small, 32) != 0 || large == IntPtr.Zero) return null;
+      using (var image = Icon.FromHandle(large))
+      using (var bitmap = image.ToBitmap())
+      using (var stream = new MemoryStream()) {
+        bitmap.Save(stream, ImageFormat.Png);
+        return "data:image/png;base64," + Convert.ToBase64String(stream.ToArray());
+      }
+    } catch (Exception) {
+      // Missing icon resources do not make the application unusable.
+      return null;
+    } finally {
+      if (large != IntPtr.Zero) DestroyIcon(large);
+      if (small != IntPtr.Zero) DestroyIcon(small);
+    }
+  }
+  static void Visit(string path, Action<IHandler> visit) {
+    var extension = Path.GetExtension(path);
+    if (extension.Length == 0) return;
+    IEnumHandlers handlers;
+    SHAssocEnumHandlers(extension, 0, out handlers);
+    try {
+      while (true) {
+        IHandler handler; uint fetched;
+        int result = handlers.Next(1, out handler, out fetched);
+        Marshal.ThrowExceptionForHR(result);
+        if (result != 0 || fetched == 0) break;
+        try { visit(handler); } finally { Marshal.FinalReleaseComObject(handler); }
+      }
+    } finally { Marshal.FinalReleaseComObject(handlers); }
+  }
+  public static Application[] List(string path) {
+    var extension = Path.GetExtension(path);
+    var executable = extension.Length == 0 ? null : Associated(extension, 2);
+    var appId = extension.Length == 0 ? null : Associated(extension, 21);
+    var apps = new List<Application>();
+    var seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+    Visit(path, delegate(IHandler handler) {
+      string id, name;
+      handler.GetName(out id); handler.GetUIName(out name);
+      if (!seen.Add(id)) return;
+      apps.Add(new Application { id = id, name = name, icon = IconData(handler),
+        @default = String.Equals(id, executable, StringComparison.OrdinalIgnoreCase) || String.Equals(id, appId, StringComparison.OrdinalIgnoreCase) });
+    });
+    return apps.ToArray();
+  }
+  public static void Open(string path, string application) {
+    WithShellLifetime(delegate { OpenRegistered(path, application); });
+  }
+  static void OpenRegistered(string path, string application) {
+    bool opened = false;
+    Visit(path, delegate(IHandler handler) {
+      string id; handler.GetName(out id);
+      if (opened || !String.Equals(id, application, StringComparison.OrdinalIgnoreCase)) return;
+      var iid = typeof(IShellItem).GUID;
+      IShellItem item;
+      SHCreateItemFromParsingName(path, IntPtr.Zero, ref iid, out item);
+      IDataObject data = null;
+      try {
+        var bhid = new Guid("b8c0bd9f-ed24-455c-83e6-d5390c4fe8c4");
+        var dataIid = typeof(IDataObject).GUID;
+        item.BindToHandler(IntPtr.Zero, ref bhid, ref dataIid, out data);
+        handler.Invoke(data);
+        opened = true;
+      } finally {
+        if (data != null) Marshal.FinalReleaseComObject(data);
+        Marshal.FinalReleaseComObject(item);
+      }
+    });
+    if (!opened) throw new InvalidOperationException("Application is not registered for this file");
+  }
+}`
+
+/**
+ * Execute the Windows Shell adapter in a Unicode STA PowerShell process.
+ * @param path - Windows file path, translated by the caller for WSL.
+ * @param application - registered handler to invoke; null requests the application list.
+ * @param signal - caller cancellation.
+ * @param run - native command runner.
+ * @returns adapter output; query mode emits a JSON array.
+ */
+export async function windowsFileApplications(
+  path: string, application: string | null, signal: AbortSignal, run: NativeCommandRunner,
+): Promise<string> {
+  const encodedPath = Buffer.from(path).toString('base64')
+  const encodedApplication = Buffer.from(application ?? '').toString('base64')
+  const script = `$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+Add-Type -ReferencedAssemblies System,System.Core,System.Drawing -TypeDefinition @'
+${WINDOWS_ASSOCIATIONS}
+'@
+$path = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encodedPath}'))
+$application = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encodedApplication}'))
+${application === null ? 'ConvertTo-Json -InputObject @([DshFileAssociations]::List($path)) -Depth 4 -Compress' : '[DshFileAssociations]::Open($path, $application)'}
+`
+  const result = await run('powershell.exe', [
+    '-NoProfile', '-NonInteractive', '-STA', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64'),
+  ], signal)
+  return result.stdout
+}
diff --git a/packages/util/native-command/src/file-applications.ts b/packages/util/native-command/src/file-applications.ts
new file mode 100644
index 0000000000..7a9b7f9ea8
--- /dev/null
+++ b/packages/util/native-command/src/file-applications.ts
@@ -0,0 +1,110 @@
+/** Native file associations queried from the desktop that owns the path. */
+import { runNativeCommand } from './runner.ts'
+import { linuxFileApplications } from './file-applications-linux.ts'
+import { windowsFileApplications } from './file-applications-windows.ts'
+import { nativeFileManager } from './path-opener.ts'
+import type { PathOpenerInternals } from './path-opener.ts'
+import { parseNativeFileApplications, type NativeFileApplication } from './types.ts'
+
+/** AppKit runs inside the system JXA host; paths arrive as argv, never executable source. */
+const MAC_APPLICATIONS = `
+ObjC.import('AppKit');
+function run(argv) {
+  var workspace = $.NSWorkspace.sharedWorkspace;
+  var file = $.NSURL.fileURLWithPath(argv[0]);
+  var preferred = workspace.URLForApplicationToOpenURL(file);
+  var preferredPath = preferred.isNil() ? null : ObjC.unwrap(preferred.path);
+  var urls = workspace.URLsForApplicationsToOpenURL(file);
+  var apps = [];
+  for (var i = 0; i < urls.count; i++) {
+    var url = urls.objectAtIndex(i);
+    var path = ObjC.unwrap(url.path);
+    var image = null;
+    if (argv[1] === 'icons') {
+      var icon = workspace.iconForFile(path);
+      var thumbnail = $.NSImage.alloc.initWithSize($.NSMakeSize(32, 32));
+      thumbnail.lockFocus;
+      icon.drawInRectFromRectOperationFraction($.NSMakeRect(0, 0, 32, 32), $.NSZeroRect, $.NSCompositingOperationSourceOver, 1);
+      thumbnail.unlockFocus;
+      var bitmap = $.NSBitmapImageRep.imageRepWithData(thumbnail.TIFFRepresentation);
+      var png = bitmap.representationUsingTypeProperties($.NSBitmapImageFileTypePNG, $({}));
+      image = png.isNil() ? null : 'data:image/png;base64,' + ObjC.unwrap(png.base64EncodedStringWithOptions(0));
+    }
+    apps.push({
+      id: path,
+      name: ObjC.unwrap($.NSFileManager.defaultManager.displayNameAtPath(path)),
+      default: path === preferredPath,
+      icon: image
+    });
+  }
+  return JSON.stringify(apps);
+}`
+
+/**
+ * List registered handlers in OS preference order, including the current default and application icons.
+ * @param path - verified absolute local file path.
+ * @param signal - caller lifetime, propagated to the OS query.
+ * @param internals - platform and command adapter for deterministic tests.
+ * @returns current file handlers; an empty list when the platform has no association query.
+ */
+export async function nativeFileApplications(
+  path: string, signal: AbortSignal, internals: PathOpenerInternals = {},
+): Promise<readonly NativeFileApplication[]> {
+  return queryFileApplications(path, signal, internals, true)
+}
+
+/** Query metadata with optional macOS icon rendering for display or launch authorization. */
+async function queryFileApplications(
+  path: string, signal: AbortSignal, internals: PathOpenerInternals, icons: boolean,
+): Promise<readonly NativeFileApplication[]> {
+  signal.throwIfAborted()
+  const target = await desktopTarget(path, signal, internals)
+  const run = internals.run ?? runNativeCommand
+  if (target.platform === 'linux') return linuxFileApplications(path, signal, run, internals.env ?? process.env)
+  let stdout: string
+  if (target.platform === 'darwin') {
+    stdout = (await run('osascript', ['-l', 'JavaScript', '-e', MAC_APPLICATIONS, target.path, icons ? 'icons' : 'handlers'], signal)).stdout
+  } else if (target.platform === 'win32') {
+    stdout = await windowsFileApplications(target.path, null, signal, run)
+  } else return []
+  return parseNativeFileApplications(JSON.parse(stdout))
+}
+
+/**
+ * Open a file in a currently registered handler; stale or arbitrary application identifiers are rejected.
+ * @param path - verified absolute local file path.
+ * @param application - identifier returned by the file association query.
+ * @param signal - caller lifetime, propagated to query and launch.
+ * @param internals - platform and command adapter for deterministic tests.
+ * @returns after the system launcher accepts the file.
+ */
+export async function openNativeFileApplication(
+  path: string, application: string, signal: AbortSignal, internals: PathOpenerInternals = {},
+): Promise<void> {
+  const target = await desktopTarget(path, signal, internals)
+  const run = internals.run ?? runNativeCommand
+  if (target.platform === 'win32') {
+    await windowsFileApplications(target.path, application, signal, run)
+    return
+  }
+  const apps = await queryFileApplications(path, signal, internals, false)
+  if (!apps.some(app => app.id === application)) throw new Error('Application is not registered for this file')
+  if (target.platform === 'linux') await run('gio', ['launch', application, path], signal)
+  else await run('open', ['-a', application, path], signal)
+}
+
+/** Resolve the desktop that owns the file, including Windows applications reached from WSL. */
+async function desktopTarget(
+  path: string, signal: AbortSignal, internals: PathOpenerInternals,
+): Promise<{ platform: NodeJS.Platform; path: string }> {
+  signal.throwIfAborted()
+  const platform = internals.platform ?? process.platform
+  if (platform === 'linux' && nativeFileManager(internals) === 'explorer') {
+    const translated = await (internals.run ?? runNativeCommand)('wslpath', ['-w', path], signal)
+    signal.throwIfAborted()
+    const windowsPath = translated.stdout.replace(/[\r\n]+$/, '')
+    if (windowsPath === '') throw new Error('wslpath returned no Windows path')
+    return { platform: 'win32', path: windowsPath }
+  }
+  return { platform, path }
+}
diff --git a/packages/util/native-command/src/index.ts b/packages/util/native-command/src/index.ts
index 29a0f16c18..9ad8e0883c 100644
--- a/packages/util/native-command/src/index.ts
+++ b/packages/util/native-command/src/index.ts
@@ -18,3 +18,8 @@ export type {
   PathOpenerInternals,
   PathOpenerRunner,
 } from './path-opener.ts'
+
+export { nativeFileApplications, openNativeFileApplication } from './file-applications.ts'
+export type { NativeFileApplication } from './types.ts'
+
+export { desktopEntryFields, desktopDataDirectories, desktopApplicationIcon } from './desktop-entry.ts'
diff --git a/packages/util/native-command/src/types.ts b/packages/util/native-command/src/types.ts
new file mode 100644
index 0000000000..5af42bb996
--- /dev/null
+++ b/packages/util/native-command/src/types.ts
@@ -0,0 +1,34 @@
+/** Browser-safe metadata for native file associations. */
+
+/** One OS-registered application capable of opening the requested file. */
+export interface NativeFileApplication {
+  /** OS application identifier; callers must revalidate it against the file's current handlers before opening. */
+  readonly id: string
+  readonly name: string
+  readonly default: boolean
+  /** PNG or SVG data URL, or null when the desktop supplies no icon. */
+  readonly icon: string | null
+}
+
+/**
+ * Validate file association metadata received from a native process or authenticated Host.
+ * @param value - decoded application list.
+ * @returns validated application metadata.
+ * @throws Error for malformed entries or unsupported icon URLs.
+ */
+export function parseNativeFileApplications(value: unknown): readonly NativeFileApplication[] {
+  if (!Array.isArray(value)) throw new Error('Invalid native application list')
+  const applications: NativeFileApplication[] = []
+  const entries: readonly unknown[] = value
+  for (const entry of entries) {
+    if (typeof entry !== 'object' || entry === null
+      || !('id' in entry) || !('name' in entry) || !('default' in entry) || !('icon' in entry)
+      || typeof entry.id !== 'string' || entry.id.length === 0
+      || typeof entry.name !== 'string' || typeof entry.default !== 'boolean'
+      || !(entry.icon === null || (typeof entry.icon === 'string' && /^data:image\/(?:png|svg\+xml);base64,[A-Za-z0-9+/=]+$/.test(entry.icon)))) {
+      throw new Error('Invalid native application entry')
+    }
+    applications.push({ id: entry.id, name: entry.name, default: entry.default, icon: entry.icon })
+  }
+  return applications
+}
diff --git a/packages/util/native-command/tests/file-applications-linux-native.spec.ts b/packages/util/native-command/tests/file-applications-linux-native.spec.ts
new file mode 100644
index 0000000000..42cc4083cf
--- /dev/null
+++ b/packages/util/native-command/tests/file-applications-linux-native.spec.ts
@@ -0,0 +1,59 @@
+/** Real GIO discovery and desktop-entry launch in private XDG data/config roots. */
+import { execFile, spawnSync } from 'node:child_process'
+import { promisify } from 'node:util'
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, it, onTestFinished, vi } from 'vitest'
+import { nativeFileApplications, openNativeFileApplication } from '../src/file-applications.ts'
+import type { NativeCommandRunner } from '../src/runner.ts'
+
+const gioAvailable = process.platform === 'linux' && spawnSync('gio', ['help'], { stdio: 'ignore' }).error === undefined
+const execute = promisify(execFile)
+
+/** Desktop Exec quoted-argument syntax; GIO performs its expansion. */
+function quoted(value: string): string {
+  return `"${value.replace(/[\\"`$]/g, match => `\\${match}`)}"`
+}
+
+it.skipIf(!gioAvailable)('queries and launches an installed Linux desktop entry through GIO', async ({ task }) => {
+  const root = await mkdtemp(join(tmpdir(), 'dsh-gio-associations-'))
+  const lifetime = new AbortController()
+  const active = new Set<Promise<Awaited<ReturnType<NativeCommandRunner>>>>()
+  onTestFinished(async () => {
+    lifetime.abort()
+    await Promise.allSettled([...active])
+    await rm(root, { recursive: true, force: true })
+  })
+  const data = join(root, 'data')
+  const config = join(root, 'config')
+  const empty = join(root, 'empty')
+  await mkdir(join(data, 'applications'), { recursive: true })
+  await mkdir(config)
+  await mkdir(empty)
+  const path = join(root, "测试 ' file.txt")
+  const script = join(root, 'handler.cjs')
+  const marker = join(root, 'opened.json')
+  await writeFile(path, 'plain text')
+  await writeFile(script, `require('node:fs').writeFileSync(${JSON.stringify(marker)}, JSON.stringify({ path: process.argv[2], pid: process.pid }));\n`)
+  const desktop = join(data, 'applications', 'dsh-test.desktop')
+  await writeFile(desktop, `[Desktop Entry]\nType=Application\nName=DSH Test Handler\nExec=${quoted(process.execPath)} ${quoted(script)} %f\nMimeType=text/plain;\n`)
+  await writeFile(join(data, 'applications', 'mimeinfo.cache'), '[MIME Cache]\ntext/plain=dsh-test.desktop;\n')
+  await writeFile(join(config, 'mimeapps.list'), '[Default Applications]\ntext/plain=dsh-test.desktop;\n')
+  const env = { ...process.env, XDG_DATA_HOME: data, XDG_DATA_DIRS: empty, XDG_CONFIG_HOME: config, XDG_CONFIG_DIRS: empty, LC_ALL: 'C' }
+  const run: NativeCommandRunner = (command, args, signal) => {
+    const task = execute(command, [...args], { signal, env, encoding: 'utf8' })
+    active.add(task)
+    void task.then(() => active.delete(task), () => active.delete(task))
+    return task
+  }
+  const apps = await nativeFileApplications(path, lifetime.signal, { run, env })
+  expect(apps).toContainEqual({ id: desktop, name: 'DSH Test Handler', default: true, icon: null })
+  await openNativeFileApplication(path, desktop, lifetime.signal, { run, env })
+  let opened: { path: string; pid: number } | undefined
+  await vi.waitFor(async () => {
+    opened = JSON.parse(await readFile(marker, 'utf8')) as { path: string; pid: number }
+    expect(opened.path).toBe(path)
+  }, { timeout: task.timeout })
+  await vi.waitFor(() => { expect(() => process.kill(opened!.pid, 0)).toThrow() }, { timeout: task.timeout })
+})
diff --git a/packages/util/native-command/tests/file-applications-linux.spec.ts b/packages/util/native-command/tests/file-applications-linux.spec.ts
new file mode 100644
index 0000000000..7615218f3b
--- /dev/null
+++ b/packages/util/native-command/tests/file-applications-linux.spec.ts
@@ -0,0 +1,64 @@
+/** Linux association parsing over isolated installed-entry fixtures and an injected OS command runner. */
+import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, it, onTestFinished, vi } from 'vitest'
+import { desktopApplicationIcon } from '../src/desktop-entry.ts'
+import { nativeFileApplications, openNativeFileApplication } from '../src/file-applications.ts'
+import type { NativeCommandRunner } from '../src/runner.ts'
+
+async function fixture() {
+  const root = await mkdtemp(join(tmpdir(), 'dsh-file-apps-'))
+  onTestFinished(() => rm(root, { recursive: true, force: true }))
+  await mkdir(join(root, 'applications', 'nested'), { recursive: true })
+  await mkdir(join(root, 'pixmaps'))
+  await writeFile(join(root, 'applications', 'player.desktop'), '[Desktop Entry]\nName=Player\nName[zh_CN]=播放器\nIcon=player\nExec=player %f\n[Desktop Action Extra]\nName=Wrong\n')
+  await writeFile(join(root, 'applications', 'nested', 'other.desktop'), '[Desktop Entry]\nName=Other\nExec=other %f\n')
+  await writeFile(join(root, 'pixmaps', 'player.svg'), '<svg xmlns="http://www.w3.org/2000/svg"/>')
+  const run = vi.fn<NativeCommandRunner>(async (command, args) => ({
+    stdout: command === 'gio' && args[0] === 'info' ? '  standard::content-type: audio/mpeg\n'
+      : command === 'env' ? 'Default application for audio/mpeg: player.desktop\nRegistered applications:\n  player.desktop\n  nested-other.desktop\n  missing.desktop\nRecommended applications:\n  player.desktop\n' : '', stderr: '',
+  }))
+  return { root, run, facts: { platform: 'linux' as const, osRelease: 'linux', env: { XDG_DATA_HOME: root, XDG_DATA_DIRS: '', LANG: 'zh_CN.UTF-8' }, run } }
+}
+
+it('deduplicates GIO handlers, resolves nested ids, localizes names, and reuses desktop artwork', async () => {
+  const { root, facts, run } = await fixture()
+  const signal = new AbortController().signal
+  const apps = await nativeFileApplications('/file.mp3', signal, facts)
+  expect(apps).toEqual([
+    { id: join(root, 'applications', 'player.desktop'), name: '播放器', default: true, icon: expect.stringMatching(/^data:image\/svg\+xml;base64,/) as string },
+    { id: join(root, 'applications', 'nested', 'other.desktop'), name: 'Other', default: false, icon: null },
+  ])
+  await openNativeFileApplication('/file.mp3', apps[0]!.id, signal, facts)
+  expect(run).toHaveBeenLastCalledWith('gio', ['launch', apps[0]!.id, '/file.mp3'], signal)
+  await expect(openNativeFileApplication('/file.mp3', '/unregistered.desktop', signal, facts)).rejects.toThrow('not registered')
+})
+
+it('keeps nondefault applications when the desktop has no default and omits hidden or unnamed entries', async () => {
+  const { root, facts, run } = await fixture()
+  await writeFile(join(root, 'applications', 'player.desktop'), '[Desktop Entry]\nHidden=true\nName=Hidden\n')
+  await writeFile(join(root, 'applications', 'unnamed.desktop'), '[Desktop Entry]\nExec=unnamed\n')
+  run.mockImplementation(async command => ({ stdout: command === 'gio' ? 'standard::content-type: audio/mpeg' : 'Registered applications:\n  player.desktop\n  unnamed.desktop\n  nested-other.desktop\n', stderr: '' }))
+  expect(await nativeFileApplications('/file.mp3', new AbortController().signal, facts)).toEqual([
+    { id: join(root, 'applications', 'nested', 'other.desktop'), name: 'Other', default: false, icon: null },
+  ])
+})
+
+it('rejects missing content-type metadata instead of fabricating associations', async () => {
+  const { facts, run } = await fixture()
+  run.mockResolvedValue({ stdout: 'no content type', stderr: '' })
+  await expect(nativeFileApplications('/file.mp3', new AbortController().signal, facts)).rejects.toThrow('content type')
+})
+
+
+it('tolerates absent desktop roots and directory-shaped icon paths without a locale override', async () => {
+  const { root, facts } = await fixture()
+  const icon = join(root, 'folder.png')
+  await mkdir(icon)
+  expect(await desktopApplicationIcon(icon, [])).toBeNull()
+  const apps = await nativeFileApplications('/file.mp3', new AbortController().signal, {
+    ...facts, env: { XDG_DATA_HOME: root, XDG_DATA_DIRS: join(root, 'absent') },
+  })
+  expect(apps[0]?.name).toBe('Player')
+})
diff --git a/packages/util/native-command/tests/file-applications-windows.spec.ts b/packages/util/native-command/tests/file-applications-windows.spec.ts
new file mode 100644
index 0000000000..9f009d0b91
--- /dev/null
+++ b/packages/util/native-command/tests/file-applications-windows.spec.ts
@@ -0,0 +1,111 @@
+/** Real Windows Shell discovery and invocation with a private extension and a private executable. */
+import { randomUUID } from 'node:crypto'
+import { mkdtemp, readFile, realpath, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, it, vi, onTestFinished } from 'vitest'
+import { nativeFileApplications, openNativeFileApplication } from '../src/file-applications.ts'
+import { runNativeCommand, type NativeCommandRunner } from '../src/runner.ts'
+
+/** Encode fixture data without placing its quotes or Unicode in executable PowerShell text. */
+function literal(value: string): string {
+  return `[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${Buffer.from(value).toString('base64')}'))`
+}
+
+it.skipIf(process.platform !== 'win32')('queries and invokes a registered Windows handler through the system Shell', async ({ task, signal: testSignal, onTestFailed }) => {
+  const root = await mkdtemp(join(tmpdir(), 'dsh-windows-association-'))
+  const suffix = randomUUID().replaceAll('-', '')
+  const extension = `.dsh${suffix}`
+  const progId = `DSH.Test.${suffix}`
+  const appName = `dsh-handler-${suffix}.exe`
+  const executable = join(root, appName)
+  const path = join(root, `${String.fromCharCode(0x6d4b, 0x8bd5)} ' audio${extension}`)
+  const marker = join(root, 'opened.txt')
+  const lifetime = new AbortController()
+  const signal = AbortSignal.any([testSignal, lifetime.signal])
+  const active = new Set<Promise<Awaited<ReturnType<NativeCommandRunner>>>>()
+  let phase = 'compile fixture'
+  onTestFailed(async () => {
+    const opened = await readFile(marker, 'utf8').catch(() => '(no handoff marker)')
+    console.error('Windows association fixture:', phase, 'active native commands:', active.size, opened)
+  })
+  const run: NativeCommandRunner = (command, args, operationSignal) => {
+    const pending = runNativeCommand(command, args, operationSignal)
+    active.add(pending)
+    void pending.then(() => active.delete(pending), () => active.delete(pending))
+    return pending
+  }
+  const runScript = async (source: string): Promise<void> => {
+    await run('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(source, 'utf16le').toString('base64')], signal)
+  }
+  onTestFinished(async () => {
+    lifetime.abort()
+    await Promise.allSettled([...active])
+    try {
+      await runNativeCommand('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(`
+$root = [Microsoft.Win32.Registry]::CurrentUser
+$root.DeleteSubKeyTree('Software\\Classes\\${extension}', $false)
+$root.DeleteSubKeyTree('Software\\Classes\\${progId}', $false)
+$root.DeleteSubKeyTree('Software\\Classes\\Applications\\${appName}', $false)
+`, 'utf16le').toString('base64')], new AbortController().signal)
+    } finally { await rm(root, { recursive: true, force: true }) }
+  })
+  await writeFile(path, 'test')
+  // A dedicated executable accepts the file directly; no pre-existing Node association can discard fixture-script arguments.
+  await runScript(`$ErrorActionPreference = 'Stop'
+Add-Type -ReferencedAssemblies System -OutputAssembly (${literal(executable)}) -OutputType ConsoleApplication -TypeDefinition @'
+using System;
+using System.IO;
+using System.Diagnostics;
+public static class Handler {
+  public static void Main(string[] args) {
+    File.WriteAllLines(${JSON.stringify(marker)}, new string[] { args.Length == 0 ? "(no file argument)" : args[0], Process.GetCurrentProcess().Id.ToString() });
+  }
+}
+'@
+`)
+  phase = 'verify fixture executable'
+  await run(executable, [path], signal)
+  expect((await readFile(marker, 'utf8')).split(/\r?\n/)[0]).toBe(path)
+  await rm(marker)
+  phase = 'register association'
+  const command = literal(`"${executable}" "%1"`)
+  await runScript(`$ErrorActionPreference = 'Stop'
+$root = [Microsoft.Win32.Registry]::CurrentUser
+$key = $root.CreateSubKey('Software\\Classes\\${extension}')
+$key.SetValue('', '${progId}'); $key.Dispose()
+$key = $root.CreateSubKey('Software\\Classes\\${extension}\\OpenWithProgids')
+$key.SetValue('${progId}', ''); $key.Dispose()
+$key = $root.CreateSubKey('Software\\Classes\\${progId}\\shell\\open\\command')
+$key.SetValue('', ${command}); $key.Dispose()
+$key = $root.CreateSubKey('Software\\Classes\\Applications\\${appName}\\shell\\open\\command')
+$key.SetValue('', ${command}); $key.Dispose()
+$key = $root.CreateSubKey('Software\\Classes\\Applications\\${appName}\\SupportedTypes')
+$key.SetValue('${extension}', ''); $key.Dispose()
+`)
+  phase = 'query associations'
+  const applications = await nativeFileApplications(path, signal, { run })
+  const expected = applications.find(app => app.id.toLowerCase() === executable.toLowerCase())
+  expect(expected).toMatchObject({ default: true, name: expect.any(String) as string })
+  phase = 'invoke handler'
+  await openNativeFileApplication(path, expected!.id, signal, { run })
+  phase = 'wait for fixture marker'
+  let opened: string[] = []
+  await vi.waitUntil(async () => {
+    signal.throwIfAborted()
+    try { opened = (await readFile(marker, 'utf8')).trim().split(/\r?\n/) } catch (_error) { return false }
+    return true
+  }, { timeout: task.timeout })
+  // Windows Shell can expand an 8.3 input path to its long spelling.
+  expect(await realpath(opened[0]!)).toBe(await realpath(path))
+  const pid = Number(opened[1])
+  expect(pid).toBeGreaterThan(0)
+  phase = 'wait for fixture exit'
+  await vi.waitUntil(() => {
+    signal.throwIfAborted()
+    try { process.kill(pid, 0); return false } catch (error) {
+      if (typeof error === 'object' && error !== null && 'code' in error && error.code === 'ESRCH') return true
+      throw error
+    }
+  }, { timeout: task.timeout })
+})
diff --git a/packages/util/native-command/tests/file-applications.spec.ts b/packages/util/native-command/tests/file-applications.spec.ts
new file mode 100644
index 0000000000..2dfe31a9da
--- /dev/null
+++ b/packages/util/native-command/tests/file-applications.spec.ts
@@ -0,0 +1,88 @@
+/** File association results and explicit handler authorization at the native command adapter. */
+import { describe, expect, it, vi, onTestFinished } from 'vitest'
+import * as runner from '../src/runner.ts'
+import { nativeFileApplications, openNativeFileApplication } from '../src/file-applications.ts'
+
+const application = { id: '/Applications/Music.app', name: 'Music', default: true, icon: null }
+const signal = new AbortController().signal
+
+describe('native file associations', () => {
+  it('passes file paths as arguments and preserves the desktop default', async () => {
+    const run = vi.fn(async () => ({ stdout: JSON.stringify([application]), stderr: '' }))
+    const path = '/tmp/中文 $(touch nope).mp3'
+    await expect(nativeFileApplications(path, signal, { platform: 'darwin', run })).resolves.toEqual([application])
+    expect(run).toHaveBeenCalledWith('osascript', ['-l', 'JavaScript', '-e', expect.any(String), path, 'icons'], signal)
+  })
+
+  it.each(['{}', '[null]', '[{"id":1}]', JSON.stringify([{ ...application, icon: 'javascript:alert(1)' }])])('rejects malformed native output %s', async (stdout) => {
+    await expect(nativeFileApplications('/file.mp3', signal, {
+      platform: 'darwin', run: async () => ({ stdout, stderr: '' }),
+    })).rejects.toThrow()
+  })
+
+  it('launches only a currently registered application with argv', async () => {
+    const run = vi.fn(async () => ({ stdout: JSON.stringify([application]), stderr: '' }))
+    await openNativeFileApplication('/file.mp3', application.id, signal, { platform: 'darwin', run })
+    expect(run).toHaveBeenNthCalledWith(1, 'osascript', ['-l', 'JavaScript', '-e', expect.any(String), '/file.mp3', 'handlers'], signal)
+    expect(run).toHaveBeenLastCalledWith('open', ['-a', application.id, '/file.mp3'], signal)
+    run.mockClear()
+    await expect(openNativeFileApplication('/file.mp3', '/arbitrary.app', signal, { platform: 'darwin', run })).rejects.toThrow('not registered')
+    expect(run).toHaveBeenCalledOnce()
+  })
+
+  it('does not query after cancellation or on unsupported platforms', async () => {
+    const run = vi.fn()
+    await expect(nativeFileApplications('/file.mp3', signal, { platform: 'freebsd', run })).resolves.toEqual([])
+    await expect(nativeFileApplications('/file.mp3', AbortSignal.abort(), { platform: 'darwin', run })).rejects.toThrow()
+    expect(run).not.toHaveBeenCalled()
+  })
+})
+
+
+it('uses the production command adapter and current platform when no override is supplied', async () => {
+  const run = vi.spyOn(runner, 'runNativeCommand').mockImplementation(async command => ({
+    stdout: command === 'gio' ? 'standard::content-type: audio/mpeg' : command === 'env' ? 'No applications found' : JSON.stringify([application]), stderr: '',
+  }))
+  onTestFinished(() => { run.mockRestore() })
+  expect(await nativeFileApplications('/file.mp3', signal)).toEqual(process.platform === 'linux' ? [] : [application])
+  await openNativeFileApplication('/file.mp3', application.id, signal, { platform: 'darwin' })
+  expect(run).toHaveBeenLastCalledWith('open', ['-a', application.id, '/file.mp3'], signal)
+})
+
+
+it('encodes Windows query and invocation data separately from native adapter source', async () => {
+  const run = vi.fn<runner.NativeCommandRunner>(async () => ({ stdout: JSON.stringify([application]), stderr: '' }))
+  const path = "C:\\测试\\a'; write-host nope.mp3"
+  expect(await nativeFileApplications(path, signal, { platform: 'win32', run })).toEqual([application])
+  const query = Buffer.from(run.mock.calls[0]![1].at(-1)!, 'base64').toString('utf16le')
+  expect(query).toContain(Buffer.from(path).toString('base64'))
+  expect(query).not.toContain(path)
+  expect(query).toContain('::List($path)')
+  await openNativeFileApplication(path, application.id, signal, { platform: 'win32', run })
+  expect(Buffer.from(run.mock.calls[1]![1].at(-1)!, 'base64').toString('utf16le')).toContain('::Open($path, $application)')
+  expect(run.mock.calls[1]![0]).toBe('powershell.exe')
+})
+
+it('uses the Windows desktop for WSL paths and rejects an empty translation', async () => {
+  const run = vi.fn<runner.NativeCommandRunner>(async command => ({
+    stdout: command === 'wslpath' ? 'C:\\音频.mp3\n' : JSON.stringify([application]), stderr: '',
+  }))
+  const facts = { platform: 'linux' as const, osRelease: 'microsoft', env: {}, run }
+  expect(await nativeFileApplications('/mnt/c/音频.mp3', signal, facts)).toEqual([application])
+  await openNativeFileApplication('/mnt/c/音频.mp3', application.id, signal, facts)
+  expect(run).toHaveBeenCalledWith('wslpath', ['-w', '/mnt/c/音频.mp3'], signal)
+  const empty = async () => ({ stdout: '', stderr: '' })
+  await expect(nativeFileApplications('/a', signal, { ...facts, run: empty })).rejects.toThrow('no Windows path')
+})
+
+
+it('uses production environment and runner defaults for Linux and WSL', async () => {
+  const run = vi.spyOn(runner, 'runNativeCommand').mockImplementation(async command => ({
+    stdout: command === 'gio' ? 'standard::content-type: audio/mpeg'
+      : command === 'env' ? 'No applications found'
+        : command === 'wslpath' ? 'C:\\file.mp3\n' : JSON.stringify([application]), stderr: '',
+  }))
+  onTestFinished(() => { run.mockRestore() })
+  expect(await nativeFileApplications('/file.mp3', signal, { platform: 'linux', osRelease: 'linux' })).toEqual([])
+  expect(await nativeFileApplications('/file.mp3', signal, { platform: 'linux', osRelease: 'microsoft', env: {} })).toEqual([application])
+})
diff --git a/packages/workflow/tool-workflow/README.i18n.yaml b/packages/workflow/tool-workflow/README.i18n.yaml
index a58a195684..9b2ed335a8 100644
--- a/packages/workflow/tool-workflow/README.i18n.yaml
+++ b/packages/workflow/tool-workflow/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/workflow/tool-workflow/README.md
-README.md: 4cf16a233637da3fb2384ba80cdba8adb0298e5a
-README.zh.md: cfbbdd74f14c1c6f8c8c97b2bb84366ff61bb4d1
+README.md: d34ba156409b5c1cc1d9b3c320af5b8e92082a59
+README.zh.md: ea446f1ddf74a6c118bc2fa6a0f5d77c824b34cc
diff --git a/packages/workflow/tool-workflow/README.md b/packages/workflow/tool-workflow/README.md
index 4cf16a2336..d34ba15640 100644
--- a/packages/workflow/tool-workflow/README.md
+++ b/packages/workflow/tool-workflow/README.md
@@ -68,6 +68,8 @@ The consumer owns the model-facing schema, the `tool:<toolName>` system-prompt g
 
 For a root transport execution (`exec.parent` absent), the tool projects the run into the calling Agent's Session with four log-only events: run-start after `start()` returns, member starts and endings filtered by `run.id`, then run-end only after the result is available and disposal reaches quiescence. Nested transport calls execute normally but write no record. The first failed Session append disables later recording for that run with one warning, leaving either no record or a legal continuous prefix without changing the tool result or cleanup. The package invariant rejects duplicate starts, unpaired members, terminal events with open members, and updates after run-end on both cold load and live append, while accepting missing terminal suffixes.
 
+The engine's `workflow/phase` and `workflow/log` events have no per-line durable or observer surface from this tool: the session log deliberately records run and member lifecycle only, and the Web transcript derives from those records.
+
 ### Render intent
 
 Decided up front per the [render-intent Agent Note](../../../.agents/notes/implemented/architecture/2026-07-02-tool-render-intent-union.md): a `generic` card titled `workflow: <meta.name>`, read directly from `args.meta.name` — presentation is a pure function of args — with the script text carried as `rawInput`. The result keeps the generic card.
diff --git a/packages/workflow/tool-workflow/README.zh.md b/packages/workflow/tool-workflow/README.zh.md
index cfbbdd74f1..ea446f1ddf 100644
--- a/packages/workflow/tool-workflow/README.zh.md
+++ b/packages/workflow/tool-workflow/README.zh.md
@@ -68,6 +68,8 @@ kind: "package-reference"
 
 对于根 transport 执行（`exec.parent` 缺省），工具会用四个 log-only 事件把运行投影到调用方 agent 的会话：`start()` 返回后写 run-start，只记录 `run.id` 匹配的成员开始与结束，并且只在结果可用且 dispose 完全停稳后写 run-end。嵌套 transport 调用照常执行，但不写任何记录。会话追加操作首次失败后，本运行会停止后续记录并只告警一次，留下空记录或合法连续前缀，同时不改变工具结果和清理。包 invariant 会在冷加载与实时追加时拒绝重复 start、未配对成员、仍有开放成员的终点与 run-end 后更新，同时允许缺失终态后缀的连续前缀。
 
+引擎的 `workflow/phase` 与 `workflow/log` 事件在本工具没有逐行的持久或观察面：会话日志刻意只记录 run 与成员生命周期，Web transcript 由这些记录派生。
+
 ### 渲染意图
 
 按[渲染意图 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-02-tool-render-intent-union.zh.md)预先确定：使用 `generic` 卡片，标题为 `workflow: <meta.name>`，直接从 `args.meta.name` 读取——呈现是参数的纯函数——脚本文本作为 `rawInput` 携带。结果继续使用 generic 卡片。
diff --git a/packages/workflow/tool-workflow/package.json b/packages/workflow/tool-workflow/package.json
index d75d1e8124..e14338c5f4 100644
--- a/packages/workflow/tool-workflow/package.json
+++ b/packages/workflow/tool-workflow/package.json
@@ -37,19 +37,20 @@
   ],
   "license": "MIT",
   "peerDependencies": {
+    "@deepseek-ai/cordis": "workspace:^",
     "@deepseek-ai/dsh-agent": "workspace:^",
     "@deepseek-ai/dsh-invariants": "workspace:^",
     "@deepseek-ai/dsh-llm": "workspace:^",
     "@deepseek-ai/dsh-session": "workspace:^",
     "@deepseek-ai/dsh-system-prompt": "workspace:^",
     "@deepseek-ai/dsh-tools": "workspace:^",
-    "@deepseek-ai/dsh-workflow": "workspace:^",
-    "@deepseek-ai/cordis": "workspace:^"
+    "@deepseek-ai/dsh-workflow": "workspace:^"
   },
   "dependencies": {
     "@deepseek-ai/schemastery": "workspace:^"
   },
   "devDependencies": {
+    "@deepseek-ai/cordis": "workspace:^",
     "@deepseek-ai/dsh-agent": "workspace:^",
     "@deepseek-ai/dsh-invariants": "workspace:^",
     "@deepseek-ai/dsh-llm": "workspace:^",
diff --git a/patches/@earendil-works__pi-ai@0.85.1.patch b/patches/@earendil-works__pi-ai@0.85.1.patch
new file mode 100644
index 0000000000..227a183e12
--- /dev/null
+++ b/patches/@earendil-works__pi-ai@0.85.1.patch
@@ -0,0 +1,73 @@
+diff --git a/dist/api/anthropic-messages.js b/dist/api/anthropic-messages.js
+index e1538a5dfcf2225da9dc3ec622576564ee7c8530..abb8f990d680ee247708ca774a467fc5774e28b0 100644
+--- a/dist/api/anthropic-messages.js
++++ b/dist/api/anthropic-messages.js
+@@ -500,7 +500,6 @@ export const stream = (model, context, options) => {
+                         const block = blocks[index];
+                         if (block && block.type === "toolCall") {
+                             block.partialJson += event.delta.partial_json;
+-                            block.arguments = parseStreamingJson(block.partialJson);
+                             stream.push({
+                                 type: "toolcall_delta",
+                                 contentIndex: index,
+diff --git a/dist/api/bedrock-converse-stream.js b/dist/api/bedrock-converse-stream.js
+index 6bc6312906ec3d75f31d190994d21c87f1d0767d..7ff68fb60c3c1d9e3e7d2d2df8d4619593a67335 100644
+--- a/dist/api/bedrock-converse-stream.js
++++ b/dist/api/bedrock-converse-stream.js
+@@ -453,7 +453,6 @@ function handleContentBlockDelta(event, blocks, output, stream) {
+     }
+     else if (delta?.toolUse && block?.type === "toolCall") {
+         block.partialJson = (block.partialJson || "") + (delta.toolUse.input || "");
+-        block.arguments = parseStreamingJson(block.partialJson);
+         stream.push({ type: "toolcall_delta", contentIndex: index, delta: delta.toolUse.input || "", partial: output });
+     }
+     else if (delta?.reasoningContent) {
+diff --git a/dist/api/mistral-conversations.js b/dist/api/mistral-conversations.js
+index 67f9341a6f7d855dce25054fd48cd9077e8e04a1..afdb5c2c873abb72ca8011b7e3f06a230dbe3e8a 100644
+--- a/dist/api/mistral-conversations.js
++++ b/dist/api/mistral-conversations.js
+@@ -543,7 +543,6 @@ async function consumeChatStream(model, output, stream, mistralStream) {
+                 ? toolCall.function.arguments
+                 : JSON.stringify(toolCall.function.arguments || {});
+             block.partialArgs = (block.partialArgs || "") + argsDelta;
+-            block.arguments = parseStreamingJson(block.partialArgs);
+             stream.push({
+                 type: "toolcall_delta",
+                 contentIndex: toolBlocksByKey.get(key),
+diff --git a/dist/api/openai-completions.js b/dist/api/openai-completions.js
+index 48464f2bf56b9369d5c202e4f02fc4f13d35b412..d829f5e8e56e788d96fa7a82c0e3cfaef3fc1f63 100644
+--- a/dist/api/openai-completions.js
++++ b/dist/api/openai-completions.js
+@@ -453,7 +453,6 @@ export const stream = (model, context, options) => {
+                             if (toolCall.function?.arguments) {
+                                 delta = toolCall.function.arguments;
+                                 block.partialArgs = (block.partialArgs ?? "") + toolCall.function.arguments;
+-                                block.arguments = parseStreamingJson(block.partialArgs);
+                             }
+                             else if (toolCall.custom?.input) {
+                                 const nextInput = getCustomToolCallInput(block) + toolCall.custom.input;
+diff --git a/dist/api/openai-responses-shared.js b/dist/api/openai-responses-shared.js
+index 43e463dbfd1e6cc437ebc680468036f47678de26..f4259772e289c326697ea7f2ece25954bfb5a520 100644
+--- a/dist/api/openai-responses-shared.js
++++ b/dist/api/openai-responses-shared.js
+@@ -546,7 +546,6 @@ export async function processResponsesStream(openaiStream, output, stream, model
+             if (!slot || slot.block.partialJson === undefined)
+                 continue;
+             slot.block.partialJson += event.delta;
+-            slot.block.arguments = parseStreamingJson(slot.block.partialJson);
+             pushToolCallDelta(slot, event.delta);
+         }
+         else if (event.type === "response.function_call_arguments.done") {
+diff --git a/dist/api/pi-messages.js b/dist/api/pi-messages.js
+index 5b9cb1680c47083a9a36eefa93124c67c750fd42..dc5a43ebd801fa6d4b7897c3739b588d4d571d3a 100644
+--- a/dist/api/pi-messages.js
++++ b/dist/api/pi-messages.js
+@@ -155,8 +155,6 @@ function createEventConverter(model) {
+             case "toolcall_delta": {
+                 const json = `${toolJson.get(event.contentIndex) ?? ""}${event.delta}`;
+                 toolJson.set(event.contentIndex, json);
+-                partial.content[event.contentIndex].arguments =
+-                    parseStreamingJson(json);
+                 break;
+             }
+             case "toolcall_end":
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 39acefeee7..c2803aabdc 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -10,6 +10,7 @@ overrides:
   '@deepseek-ai/schemastery': link:vendor/schemastery
 
 patchedDependencies:
+  '@earendil-works/pi-ai@0.85.1': b9bcce474fb2ac44633dff0fa722816a5bff5451b4575d5874035ea14ba70a4f
   '@electron/osx-sign@1.3.3': 280e7b2816caf01423097d24e79107a66afeb563a348630ce9928ae8499a5861
   '@yao-pkg/pkg@6.21.0': 75891fc22b277c145cafeab83e41baf4a70f5b8fe6dc0801c6a0b922d7ee88c7
   node-pty@1.2.0-beta.15: b40ae545608897914bd25fb009c97eeac478c34e8a910298ddcb01b746534bb0
@@ -557,6 +558,12 @@ importers:
       '@deepseek-ai/dsh-app-boot':
         specifier: workspace:^
         version: link:../../packages/boot/app-boot
+      '@deepseek-ai/dsh-client-ui-settings-general':
+        specifier: workspace:^
+        version: link:../../packages/client/ui-settings-general
+      '@deepseek-ai/dsh-client-ui-sidebar-browser':
+        specifier: workspace:^
+        version: link:../../packages/client/ui-sidebar-browser
       '@deepseek-ai/dsh-home-paths':
         specifier: workspace:^
         version: link:../../packages/util/home-paths
@@ -964,6 +971,46 @@ importers:
         specifier: ^4.4.3
         version: 4.4.3
 
+  packages/api/job-controller:
+    dependencies:
+      '@deepseek-ai/dsh-typert-protocol':
+        specifier: workspace:^
+        version: link:../../typert/protocol
+      '@deepseek-ai/schemastery':
+        specifier: link:../../../vendor/schemastery
+        version: link:../../../vendor/schemastery
+      zod:
+        specifier: ^4.4.3
+        version: 4.4.3
+    devDependencies:
+      '@deepseek-ai/cordis':
+        specifier: workspace:^
+        version: link:../../../vendor/cordis
+      '@deepseek-ai/dsh-agent':
+        specifier: workspace:^
+        version: link:../../core/agent
+      '@deepseek-ai/dsh-api-gateway':
+        specifier: workspace:^
+        version: link:../gateway
+      '@deepseek-ai/dsh-client-connection':
+        specifier: workspace:^
+        version: link:../../client/connection
+      '@deepseek-ai/dsh-client-store':
+        specifier: workspace:^
+        version: link:../../client/store
+      '@deepseek-ai/dsh-jobs':
+        specifier: workspace:^
+        version: link:../../jobs/jobs
+      '@deepseek-ai/dsh-jobs-local':
+        specifier: workspace:^
+        version: link:../../jobs/jobs-local
+      '@deepseek-ai/dsh-session':
+        specifier: workspace:^
+        version: link:../../core/session
+      '@deepseek-ai/dsh-typert-registry':
+        specifier: workspace:^
+        version: link:../../typert/registry
+
   packages/api/remotes:
     dependencies:
       '@deepseek-ai/dsh-deque':
@@ -988,6 +1035,9 @@ importers:
       '@deepseek-ai/dsh-api-gateway':
         specifier: workspace:^
         version: link:../gateway
+      '@deepseek-ai/dsh-api-job-controller':
+        specifier: workspace:^
+        version: link:../job-controller
       '@deepseek-ai/dsh-api-session-controller':
         specifier: workspace:^
         version: link:../session-controller
@@ -1136,9 +1186,6 @@ importers:
       '@deepseek-ai/dsh-fs-local':
         specifier: workspace:^
         version: link:../../fs/fs-local
-      '@deepseek-ai/dsh-jobs':
-        specifier: workspace:^
-        version: link:../../jobs/jobs
       '@deepseek-ai/dsh-llm':
         specifier: workspace:^
         version: link:../../llm/llm
@@ -2088,6 +2135,9 @@ importers:
       '@deepseek-ai/dsh-agent-presets':
         specifier: workspace:^
         version: link:../../preset/agent-presets
+      '@deepseek-ai/dsh-api-job-controller':
+        specifier: workspace:^
+        version: link:../../api/job-controller
       '@deepseek-ai/dsh-api-remotes':
         specifier: workspace:^
         version: link:../../api/remotes
@@ -3001,6 +3051,9 @@ importers:
       '@deepseek-ai/dsh-commands':
         specifier: workspace:^
         version: link:../../interaction/commands
+      '@deepseek-ai/dsh-file-reference':
+        specifier: workspace:^
+        version: link:../../context/file-reference
       '@deepseek-ai/dsh-goal':
         specifier: workspace:^
         version: link:../../goal/goal
@@ -3386,9 +3439,9 @@ importers:
       '@deepseek-ai/cordis':
         specifier: workspace:^
         version: link:../../../vendor/cordis
-      '@deepseek-ai/dsh-api-session-controller':
+      '@deepseek-ai/dsh-api-job-controller':
         specifier: workspace:^
-        version: link:../../api/session-controller
+        version: link:../../api/job-controller
       '@deepseek-ai/dsh-client-locale':
         specifier: workspace:^
         version: link:../locale
@@ -3410,6 +3463,9 @@ importers:
       '@deepseek-ai/dsh-client-ui-slots':
         specifier: workspace:^
         version: link:../ui-slots
+      '@deepseek-ai/dsh-session':
+        specifier: workspace:^
+        version: link:../../core/session
       '@types/react':
         specifier: ~18.3.1
         version: 18.3.31
@@ -3614,6 +3670,9 @@ importers:
       '@deepseek-ai/dsh-client-ui-conversation':
         specifier: workspace:^
         version: link:../ui-conversation
+      '@deepseek-ai/dsh-client-ui-deliverables':
+        specifier: workspace:^
+        version: link:../ui-deliverables
       '@deepseek-ai/dsh-client-ui-primitives':
         specifier: workspace:^
         version: link:../ui-primitives
@@ -3632,6 +3691,9 @@ importers:
       '@deepseek-ai/dsh-host-open-in-app':
         specifier: workspace:^
         version: link:../../host/open-in-app
+      '@deepseek-ai/dsh-native-command':
+        specifier: workspace:^
+        version: link:../../util/native-command
       '@deepseek-ai/dsh-session':
         specifier: workspace:^
         version: link:../../core/session
@@ -4363,6 +4425,12 @@ importers:
       '@deepseek-ai/cordis':
         specifier: workspace:^
         version: link:../../../vendor/cordis
+      '@deepseek-ai/dsh-api-workspace-controller':
+        specifier: workspace:^
+        version: link:../../api/workspace-controller
+      '@deepseek-ai/dsh-brand':
+        specifier: workspace:^
+        version: link:../../util/brand
       '@deepseek-ai/dsh-client-locale':
         specifier: workspace:^
         version: link:../locale
@@ -7060,9 +7128,6 @@ importers:
       '@deepseek-ai/dsh-cordis-host-runner':
         specifier: workspace:^
         version: link:../cordis-host-runner
-      '@deepseek-ai/dsh-system-prompt':
-        specifier: workspace:^
-        version: link:../../core/system-prompt
       '@deepseek-ai/dsh-tools':
         specifier: workspace:^
         version: link:../../core/tools
@@ -8311,7 +8376,7 @@ importers:
         version: link:../../../vendor/schemastery
       '@earendil-works/pi-ai':
         specifier: ^0.85.1
-        version: 0.85.1(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(ws@8.21.0)(zod@4.4.3)
+        version: 0.85.1(patch_hash=b9bcce474fb2ac44633dff0fa722816a5bff5451b4575d5874035ea14ba70a4f)(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(ws@8.21.0)(zod@4.4.3)
     devDependencies:
       '@deepseek-ai/cordis':
         specifier: workspace:^
@@ -10195,6 +10260,9 @@ importers:
       '@deepseek-ai/dsh-agent-loop':
         specifier: workspace:^
         version: link:../../core/agent-loop
+      '@deepseek-ai/dsh-agent-loop-testkit':
+        specifier: workspace:^
+        version: link:../../test-support/agent-loop-testkit
       '@deepseek-ai/dsh-app-boot':
         specifier: workspace:^
         version: link:../../boot/app-boot
@@ -20808,7 +20876,7 @@ snapshots:
     transitivePeerDependencies:
       - '@algolia/client-search'
 
-  '@earendil-works/pi-ai@0.85.1(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(ws@8.21.0)(zod@4.4.3)':
+  '@earendil-works/pi-ai@0.85.1(patch_hash=b9bcce474fb2ac44633dff0fa722816a5bff5451b4575d5874035ea14ba70a4f)(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(ws@8.21.0)(zod@4.4.3)':
     dependencies:
       '@anthropic-ai/sdk': 0.123.0(zod@4.4.3)
       '@aws-sdk/client-bedrock-runtime': 3.1048.0
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 05802dbbd7..58172c0252 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -95,6 +95,7 @@ minimumReleaseAgeExclude:
   - '@trycua/cua-driver-win32-x64-msvc@0.28.0'
   - '@trycua/cua-driver@0.28.0'
 patchedDependencies:
+  '@earendil-works/pi-ai@0.85.1': patches/@earendil-works__pi-ai@0.85.1.patch
   '@electron/osx-sign@1.3.3': patches/@electron__osx-sign@1.3.3.patch
   '@yao-pkg/pkg@6.21.0': patches/@yao-pkg__pkg@6.21.0.patch
   node-pty@1.2.0-beta.15: patches/node-pty@1.2.0-beta.15.patch
diff --git a/scripts/client-bundle-purity.spec.ts b/scripts/client-bundle-purity.spec.ts
index ed3ca6a0a8..cf706b334c 100644
--- a/scripts/client-bundle-purity.spec.ts
+++ b/scripts/client-bundle-purity.spec.ts
@@ -141,6 +141,8 @@ describe('client bundle purity gate', () => {
     expect(() => resolveId('@deepseek-ai/dsh-token-meter')).toThrow(/purity/)
     expect(() => resolveId('@deepseek-ai/dsh-token-meter/client/internal')).toThrow(/purity/)
     expect(resolveId('@deepseek-ai/dsh-host-open-in-app/shared')).toBeNull()
+    expect(resolveId('@deepseek-ai/dsh-native-command/types')).toBeNull()
+    expect(() => resolveId('@deepseek-ai/dsh-native-command')).toThrow('client bundle purity')
     expect(() => resolveId('@deepseek-ai/dsh-host-open-in-app')).toThrow(/purity/)
     expect(resolveId('@deepseek-ai/dsh-plugin-manager/registry')).toBeNull()
     expect(() => resolveId('@deepseek-ai/dsh-plugin-manager')).toThrow(/purity/)
diff --git a/scripts/gen-cordis-catalog.ts b/scripts/gen-cordis-catalog.ts
index b742bbcc58..8e6b094b10 100644
--- a/scripts/gen-cordis-catalog.ts
+++ b/scripts/gen-cordis-catalog.ts
@@ -119,6 +119,7 @@ export const SERVICE_PAGE: Record<string, string> = {
   subprocess: 'subprocess.md',
   systemPrompt: 'system-prompt.md',
   jobs: 'jobs.md',
+  jobController: 'jobs.md',
   sessionTelemetry: 'session-telemetry.md',
   agentTeams: 'agent-team.md',
   tokenMeter: 'token-meter.md',
@@ -380,6 +381,7 @@ export const LINK_MAP: Readonly<Record<string, string>> = {
   ModelCatalog: 'session.md',
   SessionOpenWorkspacePathRequest: 'session.md',
   SessionOpenWorkspacePathValue: 'session.md',
+  SessionWorkspacePathApplication: 'session.md',
   SessionModels: 'session.md',
   SessionModelsRequest: 'session.md',
   SessionPage: 'session.md',
@@ -583,12 +585,28 @@ export const LINK_MAP: Readonly<Record<string, string>> = {
   PromptSectionOrderName: 'system-prompt.md',
   SystemPrompt: 'system-prompt.md',
   ToolProviderResult: 'system-prompt.md',
-  JobDoneListener: 'jobs.md',
   JobId: 'jobs.md',
+  JobFollowFrame: 'jobs.md',
+  JobFollowRequest: 'jobs.md',
+  JobListFrame: 'jobs.md',
+  JobListRequest: 'jobs.md',
   JobRead: 'jobs.md',
-  JobSnapshot: 'jobs.md',
-  JobStart: 'jobs.md',
-  JobsChangedListener: 'jobs.md',
+  JobView: 'jobs.md',
+  JobChunk: 'jobs.md',
+  JobSpec: 'jobs.md',
+  JobHandle: 'jobs.md',
+  JobHooks: 'jobs.md',
+  JobOutcome: 'jobs.md',
+  JobOutputSource: 'jobs.md',
+  JobSourceRead: 'jobs.md',
+  JobOutputRead: 'jobs.md',
+  JobAppendOptions: 'jobs.md',
+  JobChannel: 'jobs.md',
+  JobEvent: 'jobs.md',
+  JobEventFilter: 'jobs.md',
+  JobEventListener: 'jobs.md',
+  JobEvents: 'jobs.md',
+  JobSettleCause: 'jobs.md',
   CreateTeamTaskRequest: 'agent-team.md',
   SendTeamMessageRequest: 'agent-team.md',
   SendTeamMessageResult: 'agent-team.md',
diff --git a/scripts/gen-doc-graphs.ts b/scripts/gen-doc-graphs.ts
index 5b32da720a..6bc2e62bb2 100644
--- a/scripts/gen-doc-graphs.ts
+++ b/scripts/gen-doc-graphs.ts
@@ -243,6 +243,13 @@ const SERVICE_ROLES: ServiceRole[] = [
     mode: 'core',
     note: 'Lists the Session composition\'s user-invocable skills without activating a cold Agent.',
   },
+  {
+    key: 'jobController',
+    pkg: 'api-job-controller',
+    title: 'Host job Remote controller',
+    mode: 'core',
+    note: 'Streams one background job\'s observation record over the generated Remote namespace; the roster stays on the session control stream.',
+  },
   {
     key: 'credentialsController',
     pkg: 'api-settings-controller',
@@ -677,8 +684,8 @@ const SERVICE_ROLES: ServiceRole[] = [
     title: 'Background job registry',
     mode: 'seam',
     implementations: ['jobs-local'],
-    consumers: ['tool-bash', 'tool-terminal', 'tool-subagent', 'tool-jobs'],
-    note: 'Producers (background bash, PTY sends, and subagent delegations) register running work; tool-jobs is the model-facing controller that reads, lists, and kills it; jobs-local is the process-local registry.',
+    consumers: ['tool-bash', 'tool-pwsh', 'tool-terminal', 'tool-subagent', 'tool-jobs', 'api-job-controller'],
+    note: 'Producers (background bash/pwsh, PTY sends, and subagent delegations) register running work; record-declaring jobs additionally stream raw output for non-consuming observers; tool-jobs is the model-facing controller that reads, lists, and kills it; jobs-local is the process-local registry.',
   },
   {
     key: 'web',
diff --git a/scripts/no-unknown-casts.baseline.json b/scripts/no-unknown-casts.baseline.json
index 56acc44135..3a90b2606a 100644
--- a/scripts/no-unknown-casts.baseline.json
+++ b/scripts/no-unknown-casts.baseline.json
@@ -50,7 +50,6 @@
   },
   "apps/desktop/tests/host-update-tasks.spec.ts": {
     "46197efe57255c9d92d64476470c89d0602c7333bf98ad75509bf43c1b357a3b": 1,
-    "4c5672583f1c38f4fb7dd757e94f8424866a00aa5c9a9d3dfc07d45718fa04c4": 1,
     "f6c86f29edc554d5fda72589a77b006468b174a428a5345ce7e88dec698b9829": 1
   },
   "apps/desktop/tests/main-startup.spec.ts": {
@@ -586,10 +585,6 @@
   "packages/client/ui-deliverables/tests/present-open.host.spec.ts": {
     "556e0d31b686cc80ef5c9562dad5534556f1b55ce1ce20491aa39eda98255364": 1
   },
-  "packages/client/ui-deliverables/tests/review-tab.client.spec.tsx": {
-    "52e0f8e51efd9a65974af6ad6868c7e01fff0d6faeb669e9da1bf91de8a2d422": 1,
-    "56f9870142343b23a01725140b72d040d1b9071dd30227271518f50cfa614b6c": 1
-  },
   "packages/client/ui-goal/tests/browser-plugin.client.spec.tsx": {
     "04984a2ce1486250236e638e0197da0a1a840855ed3975c59130a85358c7e5fe": 1,
     "5f1a0867b42cf35dac7fdf5839e3a39c2384c5b3b03142e799a36733ad96b9da": 1,
@@ -603,9 +598,6 @@
   "packages/client/ui-input-trigger/tests/apply.client.spec.ts": {
     "fc590cb703f599e5bb15f23909cedddeb2a77cb2cad0d4b9b8e664a62c46f44e": 1
   },
-  "packages/client/ui-jobs/tests/job-list-action.client.spec.tsx": {
-    "0a7212cab13eacbb983b226949951fc76bad9e2d93dab9fad4639f7c541c2547": 1
-  },
   "packages/client/ui-message-feedback/tests/browser-plugin.client.spec.tsx": {
     "04984a2ce1486250236e638e0197da0a1a840855ed3975c59130a85358c7e5fe": 2
   },
@@ -620,13 +612,6 @@
     "eee35b4d8641824c6eaacfe03ed60d353d81d5257d1111132f34d46a7b13ef35": 2,
     "ff65b54ee69109a8b059fc2a2136c71a5476b47115120c7c92a01171d517f3d7": 1
   },
-  "packages/client/ui-open-in-app/tests/open-in-app-action.client.spec.tsx": {
-    "d6ca469f487b05b19564776f9a8f8288b1f0d9fb5b7fb6681e68f063fb021f38": 1,
-    "fdc0ec545dc17a50bdc1c64102915706cfbfdbb65a2165ae4691f29d577063cd": 1
-  },
-  "packages/client/ui-open-in-app/tests/open-path-action.client.spec.tsx": {
-    "362d9206df82a6d4563c2e5c19457342207b02b246c91656dec01a4b2033fd8e": 1
-  },
   "packages/client/ui-permission-presets/tests/browser-plugin.client.spec.ts": {
     "dc36dd8f678695e3b84ce0573968470941c5b6fc5efe529cba17acb1f2799d1c": 1
   },
@@ -728,9 +713,6 @@
     "14a0dc9ccde2879c016f779e0e43f3aa71792759126530b418c9a31a5a2e7a53": 1,
     "ad8886dedfafd8e5f4bf7cb55525bb961822ad0c4fb0ff4a643bfb336fb9d94b": 1
   },
-  "packages/client/ui-sidebar-browser/tests/browser-body.client.spec.tsx": {
-    "dac38a9cc792ab6f3a345802975995e35a48d5a706c26d67cb7dba1c906ee3d5": 1
-  },
   "packages/client/ui-sidebar-documentpreview/tests/document-toolbar.client.spec.tsx": {
     "fb9804cc2774409af6935d5a1369497b433c34cd9305cac88e3400eae0f70936": 1
   },
@@ -1487,16 +1469,12 @@
   "packages/jobs/jobs-local/tests/loader-composition.spec.ts": {
     "6dc45d44a978dd86bb9ac2c9baf5d31aed699055698709e09bb34e99150e239d": 1
   },
-  "packages/jobs/jobs/tests/invariant.spec.ts": {
-    "2c66826d784c113eaf3f8ae7ac490920b0a9a5a0c8c3540743927379bebdddc9": 1
-  },
   "packages/jobs/tool-jobs/src/index.ts": {
     "64ab5463fdb068e88a33f022baff473b7a0da77854c4ecf8e26412763d6dccf6": 1
   },
   "packages/jobs/tool-jobs/tests/tool-jobs.spec.ts": {
     "0683cfd7f792f1b6333bc8c419d8ce32a7a630179280a31083a8f664e26e0ec0": 1,
     "0cf18056bb99a9f7435d55db31bed426d69b9973f7e15ebbca466f9e08ac9ee3": 1,
-    "284e4fe44c92b2f7e60f312649a22debe743ec6640e3b7b0ff8c9c35b02c24f2": 1,
     "52faf4558fcd91bd27dbdfa7e497843e8eeb75ea5f68ee231335018d5b3f2053": 2
   },
   "packages/llm/deepseek-llm-api-extensions/src/index.ts": {
diff --git a/scripts/type-equiv.manifest.json b/scripts/type-equiv.manifest.json
index c334beadcc..e36b61fbf7 100644
--- a/scripts/type-equiv.manifest.json
+++ b/scripts/type-equiv.manifest.json
@@ -1069,11 +1069,16 @@
     {
       "doc": "docs/subsystems/jobs.md",
       "symbol": "JobKindMap",
+      "source": "packages/jobs/jobs/src/view.ts"
+    },
+    {
+      "doc": "docs/subsystems/jobs.md",
+      "symbol": "JobSpec",
       "source": "packages/jobs/jobs/src/types.ts"
     },
     {
       "doc": "docs/subsystems/jobs.md",
-      "symbol": "JobStart",
+      "symbol": "JobHandle",
       "source": "packages/jobs/jobs/src/types.ts"
     },
     {
@@ -1088,14 +1093,44 @@
     },
     {
       "doc": "docs/subsystems/jobs.md",
-      "symbol": "JobSnapshot",
+      "symbol": "JobOutputSource",
       "source": "packages/jobs/jobs/src/types.ts"
     },
+    {
+      "doc": "docs/subsystems/jobs.md",
+      "symbol": "JobSourceRead",
+      "source": "packages/jobs/jobs/src/types.ts"
+    },
+    {
+      "doc": "docs/subsystems/jobs.md",
+      "symbol": "JobChunk",
+      "source": "packages/jobs/jobs/src/view.ts"
+    },
+    {
+      "doc": "docs/subsystems/jobs.md",
+      "symbol": "JobOutputRead",
+      "source": "packages/jobs/jobs/src/types.ts"
+    },
+    {
+      "doc": "docs/subsystems/jobs.md",
+      "symbol": "JobView",
+      "source": "packages/jobs/jobs/src/view.ts"
+    },
     {
       "doc": "docs/subsystems/jobs.md",
       "symbol": "JobRead",
       "source": "packages/jobs/jobs/src/types.ts"
     },
+    {
+      "doc": "docs/subsystems/jobs.md",
+      "symbol": "JobEvent",
+      "source": "packages/jobs/jobs/src/types.ts"
+    },
+    {
+      "doc": "docs/subsystems/jobs.md",
+      "symbol": "JobEventFilter",
+      "source": "packages/jobs/jobs/src/types.ts"
+    },
     {
       "doc": "docs/subsystems/terminal.md",
       "symbol": "TerminalWaitReason",
diff --git a/scripts/verify-package-readme-model-experience.ts b/scripts/verify-package-readme-model-experience.ts
index 4727164e95..4ca723fe0f 100644
--- a/scripts/verify-package-readme-model-experience.ts
+++ b/scripts/verify-package-readme-model-experience.ts
@@ -56,6 +56,7 @@ const SENTENCE_MODEL_EXPERIENCE: Readonly<Record<string, SentenceContract>> = {
   'packages/document/office-to-pdf': { kind: 'none', reason: 'The provider returns PDF bytes without constructing model input.' },
   'packages/attachment/attachment': { kind: 'indirect', reason: 'The storage seam delegates model request rendering to provider adapters.' },
   'packages/attachment/attachment-local': { kind: 'indirect', reason: 'The local backend delegates model request rendering to provider adapters.' },
+  'packages/client/ui-jobs': { kind: 'none', reason: 'Browser-side presentation of host-observed output; touches no prompt, message, schema, stream, or tool result.' },
   'packages/shell/shell': { kind: 'indirect', reason: 'The service interface delegates all model rendering to dsh-tool-bash.' },
   'packages/shell/shell-env': { kind: 'indirect', reason: 'The env service exposes managed DSH_* facts through the shell tools (dsh-tool-bash/dsh-tool-pwsh); it registers no prompt or schema of its own.' },
   'packages/shell/bash-local': { kind: 'indirect', reason: 'The executor backend delegates model rendering to dsh-tool-bash.' },
@@ -104,7 +105,6 @@ const SENTENCE_MODEL_EXPERIENCE: Readonly<Record<string, SentenceContract>> = {
   'packages/client/ui-chat': { kind: 'none', reason: 'Browser-side Chat presentation; registers nothing model-facing.' },
   'packages/client/ui-message-feedback': { kind: 'none', reason: 'Browser-side controls over log-only message feedback; ratings and notes never enter model context or change model-input tokens.' },
   'packages/client/ui-tool': { kind: 'none', reason: 'Browser-side Tool presentation layer; renders logged calls without changing model context.' },
-  'packages/client/ui-jobs': { kind: 'none', reason: 'Browser-side read-only projection of ctx.jobs records; dsh-tool-jobs owns the model-facing behavior.' },
   'packages/client/ui-schedule': { kind: 'none', reason: 'Browser-side read-only projection of active Schedule records; dsh-schedule owns the model-facing tools and delivery.' },
   'packages/client/ui-workflow-run': { kind: 'none', reason: 'Browser-side UI plugin layer; renders durable workflow records without changing model context.' },
   'packages/client/ui-input-trigger': { kind: 'none', reason: 'Browser-side UI plugin layer; registers nothing model-facing.' },
@@ -188,6 +188,7 @@ const SENTENCE_MODEL_EXPERIENCE: Readonly<Record<string, SentenceContract>> = {
   'packages/test-support/llm-replay': { kind: 'none', reason: 'The keyless adapter invokes no provider model.' },
   'packages/test-support/remote-mock': { kind: 'none', reason: 'Browser-side test infrastructure (Remote endpoint mock); registers nothing model-facing.' },
   'packages/api/gateway': { kind: 'none', reason: 'Remote dispatch infrastructure; invoked business methods own any model-visible effect.' },
+  'packages/api/job-controller': { kind: 'none', reason: 'Job observation is browser and Host control state; it registers no prompt, tool, or session event.' },
   'packages/api/session-controller': { kind: 'none', reason: 'Session API and transport owner; invoked Agent commands own any model-visible effect.' },
   'packages/api/settings-controller': { kind: 'none', reason: 'Configuration-surface API owner; it registers no prompt, tool, or session event.' },
   'packages/api/workspace-controller': { kind: 'none', reason: 'Workspace API and state projection owner; it registers no prompt, tool, or session event.' },
diff --git a/snapshots/session/cordis-inspect-jsdoc/system-prompt.expected.md b/snapshots/session/cordis-inspect-jsdoc/system-prompt.expected.md
index 158f24c1af..ac4c592e35 100644
--- a/snapshots/session/cordis-inspect-jsdoc/system-prompt.expected.md
+++ b/snapshots/session/cordis-inspect-jsdoc/system-prompt.expected.md
@@ -25,10 +25,6 @@ Use the web_fetch tool to retrieve the content of a specific HTTP(S) URL (for ex
 
 Use goal tools for one long-running completion objective in the current session. create_goal may infer goal intent from a direct human request in any language; do not create a goal for routine single-turn work. Call get_goal before update_goal and copy its exact goal_id and revision. After session resume or fork, an active goal is disarmed: when a human asks to continue or resume in any wording or language, use update_goal action resume to rearm it. Mark complete only when the objective is actually achieved. Mark blocked only after the same blocking condition persists for at least 3 consecutive goal rounds, and report that concrete condition in blocked_reason; difficulty, uncertainty, or useful remaining work is not blocked.
 
-# Harness runtime inspection
-
-Use cordis_inspect_list to discover Host and Client providers, then cordis_inspect_query to read exact Service, Event, Tool, Theme or Slot APIs. These tools are read-only; queries do not invoke business methods.
-
 Use the workflow tool ONLY when the user explicitly asks for a workflow or for large multi-agent orchestration: you write a JavaScript script (the tool description documents the exact format) that fans work out across many subagents with phases and structured results. For one or two delegations, prefer plain subagent calls.
 
 Use subagent in the background by default. Start independent delegations together in one assistant message and continue useful work while they run. Set `run_in_background: false` only when your next action depends on that subagent's result. When a background run settles, the runtime sends you a notice containing its outcome and any final assistant message.
@@ -71,7 +67,7 @@ interface ToolArgsMap {
   } & Record<string, JsonValue>;
   /** List every Cordis Inspect Provider currently known to the Host, including local Host Providers and the latest manifests synchronized from the Client. Each entry includes its platform, purpose, read-only methods, and input/output schemas. Call this Tool before writing or configuring a plugin, then select the provider and method for cordis_inspect_query from its result. Do not guess names or treat an Inspect method as a business Service that Plugin code can call. */
   cordis_inspect_list: Record<string, JsonValue>;
-  /** Run a read-only query explicitly declared by an Inspect Provider. platform, provider, and method must come from cordis_inspect_list, and input must satisfy that method's schema. Use this Tool before writing plugin code to read exact Service methods, Event modes, Builtin signatures, Tool schemas, theme tokens, or live Slot trees and props. Host queries run locally. A Client query waits for the first valid page response and remains pending until a page answers or the Tool is cancelled. This Tool cannot invoke business Service methods or modify the runtime. For Service.listService and Event.listEvents, query without input to navigate the compact signature directory, then query the exact service or event for its structured contract and referenced types. For Slots.listSubTree, query without root to navigate the compact tree, then query an exact Slot root for its complete registration contract and props; an exact Factory root returns its identity, scope, and registrant. */
+  /** Run a read-only query declared by an Inspect Provider. platform, provider, and method must come from cordis_inspect_list, and input must satisfy that method's schema. Use this Tool before writing plugin code to read exact Service methods, Event modes, Builtin signatures, Tool schemas, theme tokens, or live Slot trees and props. Host queries run locally. A Client query waits for the first valid page response and remains pending until a page answers or the Tool is cancelled. This Tool cannot invoke business Service methods or modify the runtime. */
   cordis_inspect_query: {
     /** Runtime platform that owns the Provider. */
     platform: "host" | "client";
diff --git a/snapshots/session/cordis-inspect-jsdoc/tool-schemas.expected.json b/snapshots/session/cordis-inspect-jsdoc/tool-schemas.expected.json
index a48efa53bf..532e048e81 100644
--- a/snapshots/session/cordis-inspect-jsdoc/tool-schemas.expected.json
+++ b/snapshots/session/cordis-inspect-jsdoc/tool-schemas.expected.json
@@ -55,7 +55,7 @@
     },
     {
       "name": "cordis_inspect_query",
-      "description": "Run a read-only query explicitly declared by an Inspect Provider. platform, provider, and method must come from cordis_inspect_list, and input must satisfy that method's schema. Use this Tool before writing plugin code to read exact Service methods, Event modes, Builtin signatures, Tool schemas, theme tokens, or live Slot trees and props. Host queries run locally. A Client query waits for the first valid page response and remains pending until a page answers or the Tool is cancelled. This Tool cannot invoke business Service methods or modify the runtime. For Service.listService and Event.listEvents, query without input to navigate the compact signature directory, then query the exact service or event for its structured contract and referenced types. For Slots.listSubTree, query without root to navigate the compact tree, then query an exact Slot root for its complete registration contract and props; an exact Factory root returns its identity, scope, and registrant.",
+      "description": "Run a read-only query declared by an Inspect Provider. platform, provider, and method must come from cordis_inspect_list, and input must satisfy that method's schema. Use this Tool before writing plugin code to read exact Service methods, Event modes, Builtin signatures, Tool schemas, theme tokens, or live Slot trees and props. Host queries run locally. A Client query waits for the first valid page response and remains pending until a page answers or the Tool is cancelled. This Tool cannot invoke business Service methods or modify the runtime.",
       "parameters": {
         "type": "object",
         "properties": {
diff --git a/snapshots/session/skill-load/session.v4.jsonl b/snapshots/session/skill-load/session.v4.jsonl
new file mode 100644
index 0000000000..62c83cec58
--- /dev/null
+++ b/snapshots/session/skill-load/session.v4.jsonl
@@ -0,0 +1,23 @@
+{"type":"session","version":4,"id":"{{session:1}}","createdAt":1783654655599,"cwd":"{{cwd}}","isSeeded":false,"delegationDepth":0}
+{"type":"permission/preset","data":{"preset":"danger-full-access"}}
+{"type":"sandbox/mode","data":{"mode":"danger-full-access"}}
+{"type":"approval/policy","data":{"policy":"never"}}
+{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"inserted":[{"content":[{"type":"text","text":"Load the editing-cordis-compositions skill with the skill tool, then reply DONE."}],"source":{"kind":"user"},"role":"user","id":"{{message:1}}"}]}}
+{"type":"turn/start","data":{"turn":1}}
+{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"removedCount":1,"inserted":[]}}
+{"type":"step/start","data":{"turn":1,"step":1}}
+{"type":"system/message","data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{message:2}}"}},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Load the editing-cordis-compositions skill with the skill tool, then reply DONE."}],"source":{"kind":"user"},"role":"user","id":"{{message:1}}"},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations.\n\nApproval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations."},{"name":"approval:policy","text":"Approval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}]},"role":"user","id":"{{message:3}}"},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"<system-reminder>\nA skill is a reusable set of task-specific instructions. The following skills are available in this session:\n\n<available_skills>\n- `editing-cordis-compositions`: Use when creating, changing, or validating an agent preset or other Cordis composition for this harness, including deciding host versus preset placement and checking that an authored preset mounts.\n- `model-only-skill`: Prove user-disabled skills remain available to the model.\n- `snapshot-skill`: Exercise project skill discovery and loading in snapshot tests.\n</available_skills>\n\nIf the user names a skill, or the task clearly matches a skill's description, call the `skill` tool with the exact skill name before taking task actions. Load all applicable skills, then follow their full instructions. This catalog contains summaries only; do not infer or follow a skill's instructions until it has been loaded.\nA user may also invoke a skill directly; its <skill_content> block then appears in this conversation. Follow it, and do not call the `skill` tool again for that skill.\n</system-reminder>"}],"source":{"kind":"skill-catalog","form":"catalog","entries":[{"name":"editing-cordis-compositions","description":"Use when creating, changing, or validating an agent preset or other Cordis composition for this harness, including deciding host versus preset placement and checking that an authored preset mounts."},{"name":"model-only-skill","description":"Prove user-disabled skills remain available to the model."},{"name":"snapshot-skill","description":"Exercise project skill discovery and loading in snapshot tests."}]},"role":"user","id":"{{message:4}}"},"surfaceOp":"append"}
+{"type":"request/header","data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"tools":"{{tools}}"},"reason":"initial"}}
+{"type":"request/context","data":{"provider":"deepseek-official","model":"deepseek-v4-flash"}}
+{"type":"session/title","data":{"title":"Load the editing-cordis-compositions ski","messageSeqs":[8],"source":{"kind":"fallback"}}}
+{"type":"assistant/message","data":{"turn":1,"step":1,"message":{"role":"assistant","content":[{"type":"reasoning","text":"Load the requested skill."},{"type":"tool-call","id":"call_skill_load","name":"skill","arguments":"{\"name\":\"editing-cordis-compositions\"}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{message:5}}"},"usage":{"inputTokens":100,"outputTokens":20,"cacheReadTokens":0,"reasoningTokens":5},"stream":[{"type":"chunk","time":1788699430688,"chunk":{"type":"block-start","index":0,"blockType":"reasoning"}},{"type":"reasoning-chunks","time0":1788699430688,"index":0,"dt":[],"texts":["Load the requested skill."]},{"type":"chunk","time":1788699430688,"chunk":{"type":"block-start","index":1,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":1788699430688,"index":1,"dt":[],"id":"call_skill_load","name":"skill","args":["{\"name\":\"editing-cordis-compositions\"}"]},{"type":"chunk","time":1788699430688,"chunk":{"type":"block-end","index":0,"block":{"type":"reasoning","text":"Load the requested skill."}}},{"type":"chunk","time":1788699430688,"chunk":{"type":"block-end","index":1,"block":{"type":"tool-call","id":"call_skill_load","name":"skill","arguments":"{\"name\":\"editing-cordis-compositions\"}"}}},{"type":"chunk","time":1788699430688,"chunk":{"type":"usage","usage":{"inputTokens":100,"outputTokens":20,"cacheReadTokens":0,"reasoningTokens":5}}},{"type":"chunk","time":1788699430688,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":1,"callId":"call_skill_load","name":"skill","arguments":"{\"name\":\"editing-cordis-compositions\"}"}}
+{"type":"tool/result","data":{"turn":1,"step":1,"message":{"role":"tool","source":{"kind":"tool","callId":"call_skill_load"},"toolCallId":"call_skill_load","content":[{"type":"text","text":"<skill_content name=\"editing-cordis-compositions\">\n<skill_resources>\nBase directory for this skill: {{cwd}}/.dsh/skills/editing-cordis-compositions\nResolve relative paths mentioned by this skill against the base directory before using them. Load referenced resources only as needed.\n</skill_resources>\n\n<skill_instructions>\n# Editing Cordis compositions\n\nEvery capability in this harness is a plugin row in a `cordis.yml`. There is no separate configuration language: changing what an agent can do means changing which rows are composed for it.\n\n## Off-limits\n\n**Never edit, delete, or overwrite a preset that ships with the deployment** — the `agent-presets` directory beside the deployment's own config, which supplies `standard`, `ptc`, `minimal`, and `cordis`. Never escalate the sandbox to reach it, even when a change there looks quicker. An upgrade overwrites that install, and corrupting `cordis` disables preset authoring itself. Reading a shipped composition is the intended way to start; writing to one is not, and neither is editing the host composition to work around a preset limitation.\n\nTo change what a shipped preset does, copy it and edit the copy. Locally authored presets under the user root are yours to create, edit, and delete.\n\n## Decide the plane first\n\nTwo planes, and the choice is not about how \"agent-related\" something feels — it is about whether the thing must be shared.\n\n**Host composition.** The registries themselves (`tools`, `systemPrompt`, `agents`, `agent-loop`, `sessions`), anything crossing sessions (persistence, session query, storage, settings, credentials, telemetry), the sandbox and approval stack, the model route, and the subagent registry with its spawn/fork backends. One instance for the process.\n\n**Agent preset.** What one session contributes to those registries: its tool plugins, its persona and prompt sections, its compaction policy. One instance per session, mounted under that session's scope and unwound with it.\n\n**A service with a consumer outside the agent plane cannot move into a preset.** `subagents` is the worked example: the registry answers cross-session queries for the host api-proxy, so a per-session copy both starves that host row — it waits forever for a service nothing provides — and collides on the second session, since a provider name registers once. The preset contributes the delegation *tools*; the registry and its backends stay host-side.\n\nA preset is a directory holding one `agent.cordis.yml`, optionally beside a `preset.yml` carrying display metadata — `name` and `description` (and, for shipped presets, a roster `order`). Write the metadata too: a preset without it shows up in every picker as its bare directory name.\n\nLocally authored presets live one directory per preset under `${DSH_HOME:-$HOME/.dsh}/.agent-presets/`, and the shipped set sits beside the deployment's own config. Use those when the user asks where to look. For deployment overrides, read `${DSH_HOME:-$HOME/.dsh}/profiles/<profile>/cordis.patch.yml`, `${DSH_HOME:-$HOME/.dsh}/cordis.patch.yml`, and any launch `--patch` files for the `agent-presets` row's `roots` and `includeUserRoot`. Obtain the active profile and extra patch paths from the user when they are not in the task context; do not guess a different profile.\n\n## Authoring a preset\n\nUse shell and file tools to locate the installed `@deepseek-ai/dsh-agent-presets` package under the active profile's `node_modules` or the deployment installation. Its `presets/<id>/` directory contains each shipped preset. If those files are unavailable, ask the user to copy the preset through the Web preset picker and provide the copied directory; runtime API inspection does not execute Remote methods.\n\nCopy the complete source directory, including skills and assets, into a new `${DSH_HOME:-$HOME/.dsh}/.agent-presets/<new-id>/` directory (or the explicitly configured writable root). Refuse an existing destination. Set `name` and `description` in `preset.yml` and remove the copied roster `order`. Never overwrite the installed source.\n\nEdit the copy's `agent.cordis.yml` with the normal file tools. Writes outside the workspace follow the active filesystem approval policy. For profile-wide capabilities, author a workspace bundle and install it with `plugin_manager`; load `cordis-plugin-development` for packaging guidance.\n\n## Service isolation\n\nA preset row that publishes a service needs an `isolate` realm containing both the provider and all its consumers. A tool that only consumes a host service remains outside that realm. Copy the shipped preset's existing groups rather than introducing service instances into the process-global realm.\n\n```yaml\n- id: delegation\n  name: cordis:group\n  group: true\n  isolate:\n    workflowEngine: true\n  config:\n    - id: workflow-ptc\n      name: '@deepseek-ai/dsh-workflow-ptc'\n      config:\n        provider: spawn\n    - id: tool-workflow\n      name: '@deepseek-ai/dsh-tool-workflow'\n```\n\n## Verify a preset\n\nCheck the edited YAML and referenced local files with file tools. Ask the user to select the new preset in the Web picker and start a session; this authoring agent cannot invoke the preset Remote API or start a Web session through inspection. Once the user provides a running session or browser control, inspect the visible tools and any activation diagnostic. File validation alone does not verify imports, service dependencies, or isolation. Report which checks ran and leave activation unverified until that session check succeeds.\n\n## Native product subagents\n\nCodex and Claude Code providers are independent optional Profile Bundles. Install only the products a Profile needs, then restart the Profile so its Host registers those providers:\n\n```sh\ndsh plugin --profile <name> add @deepseek-ai/dsh-subagent-codex\ndsh plugin --profile <name> add @deepseek-ai/dsh-subagent-claude-code\ndsh plugin --profile <name> remove @deepseek-ai/dsh-subagent-codex\ndsh plugin --profile <name> remove @deepseek-ai/dsh-subagent-claude-code\n```\n\nEach Bundle owns its Host availability; the preset separately grants one Agent its ordinary delegation tool. Never move a product provider into the preset and never add a product-specific settings field. Removing one package withdraws only that provider on the next Profile start.\n\nCopy these disabled templates from a shipped full preset and remove `disabled` only for the products the user requested:\n\n```yaml\n- id: tool-subagent-codex\n  name: '@deepseek-ai/dsh-tool-subagent'\n  disabled: true\n  config:\n    provider: codex\n    toolName: subagent_codex\n    backgroundMode: one-shot\n    maxDepth: provider-managed\n\n- id: tool-subagent-claude-code\n  name: '@deepseek-ai/dsh-tool-subagent'\n  disabled: true\n  config:\n    provider: claude-code\n    toolName: subagent_claude_code\n    backgroundMode: one-shot\n    maxDepth: provider-managed\n```\n\nFor additional named Codex or Claude Code instances, mount a separate host-plane provider row for each instance with a unique `providerName`, then add a separate preset tool row whose `provider` exactly matches that name and whose `toolName` is also unique. Keep the shipped rows for the default `codex` and `claude-code` names; do not reuse one tool row for several providers or derive either name from permission or environment settings.\n\nThe two rows are independent. Leaving both disabled preserves the copied preset, enabling one exposes only that product tool, and enabling both exposes both. Production `dsh` does not install either optional provider: before enabling a row, install the matching `@deepseek-ai/dsh-subagent-codex` or `@deepseek-ai/dsh-subagent-claude-code` Bundle in the Profile and restart it. Each Bundle registers its dormant default provider and exclusively uses its pinned package-local platform CLI; additional named instances use extra host-plane rows from the same installed package. A preset cannot provide that host dependency. `backgroundMode: one-shot` keeps omitted or `false` calls in the foreground and lets explicit `run_in_background: true` return a generic Job id. Full presets already carry `tool-jobs`, while the base host carries the job registry; retain both so `job_output`, `job_list`, `job_kill`, cancellation, and completion notices stay available. Installing a Bundle or composing a preset row does not start a product, authenticate an account, select a model, probe credentials, or manage native product settings.\n\n## What not to move into a preset\n\n`agent-loop` registers the one agent factory and throws on a second. The registries own the per-session layering and cannot themselves be per-session. Session persistence must stay host-side or the session list fragments. The sandbox, approval, and permission rows are a deliberate boundary: a preset is exactly as privileged as the plugins it names, so letting one relax its own confinement would defeat the confinement.\n</skill_instructions>\n</skill_content>"}],"isError":false,"id":"{{message:6}}"}},"sourceEventSeqs":[15],"surfaceOp":"append"}
+{"type":"step/end","data":{"turn":1,"step":1}}
+{"type":"step/start","data":{"turn":1,"step":2}}
+{"type":"assistant/message","data":{"turn":1,"step":2,"message":{"role":"assistant","content":[{"type":"reasoning","text":"The skill is loaded."},{"type":"text","text":"DONE"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{message:7}}"},"usage":{"inputTokens":180,"outputTokens":10,"cacheReadTokens":0,"reasoningTokens":4},"stream":[{"type":"chunk","time":1788699430709,"chunk":{"type":"block-start","index":0,"blockType":"reasoning"}},{"type":"reasoning-chunks","time0":1788699430709,"index":0,"dt":[],"texts":["The skill is loaded."]},{"type":"chunk","time":1788699430709,"chunk":{"type":"block-start","index":1,"blockType":"text"}},{"type":"text-chunks","time0":1788699430709,"index":1,"dt":[],"texts":["DONE"]},{"type":"chunk","time":1788699430709,"chunk":{"type":"block-end","index":0,"block":{"type":"reasoning","text":"The skill is loaded."}}},{"type":"chunk","time":1788699430709,"chunk":{"type":"block-end","index":1,"block":{"type":"text","text":"DONE"}}},{"type":"chunk","time":1788699430709,"chunk":{"type":"usage","usage":{"inputTokens":180,"outputTokens":10,"cacheReadTokens":0,"reasoningTokens":4}}},{"type":"chunk","time":1788699430709,"chunk":{"type":"finish","reason":{"kind":"stop"}}}]},"surfaceOp":"append"}
+{"type":"step/end","data":{"turn":1,"step":2}}
+{"type":"turn/end","data":{"turn":1,"reason":{"kind":"completed"}}}
diff --git a/snapshots/web/background-job-list/running.expected.md b/snapshots/web/background-job-list/running.expected.md
index 62a413bf4c..d8e1552658 100644
--- a/snapshots/web/background-job-list/running.expected.md
+++ b/snapshots/web/background-job-list/running.expected.md
@@ -1,2 +1,3 @@
 - list "Background jobs":
-  - listitem: bash sleep 45 running {{duration}}
+  - listitem:
+    - button "Show live output of for _ in $(seq 1 3000); do [ -e .background-job-list.release ] && break; sleep 0.2; done": for _ in $(seq 1 3000); do [ -e .background-job-list.release ] && break; sleep 0.2; done {{duration}} bash running
diff --git a/snapshots/web/background-job-list/settled.expected.md b/snapshots/web/background-job-list/settled.expected.md
index cc4bcfef74..d9776370c6 100644
--- a/snapshots/web/background-job-list/settled.expected.md
+++ b/snapshots/web/background-job-list/settled.expected.md
@@ -1,2 +1,2 @@
 - list "Background jobs":
-  - listitem: "bash sleep 45 signal: SIGTERM {{duration}}"
+  - listitem: "bash for _ in $(seq 1 3000); do [ -e .background-job-list.release ] && break; sleep 0.2; done signal: SIGTERM; web e2e cancellation {{duration}}"
diff --git a/snapshots/web/changed-files-turn/ui.expected.md b/snapshots/web/changed-files-turn/ui.expected.md
index f1942da607..cfefec17db 100644
--- a/snapshots/web/changed-files-turn/ui.expected.md
+++ b/snapshots/web/changed-files-turn/ui.expected.md
@@ -80,20 +80,12 @@
 - text: 此主机没有可用的桌面，无法使用外部程序打开文件或文件夹；文件仍可在侧边栏预览
 - button "在侧边栏预览 intro.md"
 - text: intro.md 标题已改为「项目说明」
-- button "在侧边栏打开 intro.md": 打开
-- button "intro.md 的更多文件操作" [disabled]
 - button "在侧边栏预览 src/util.ts"
 - text: util.ts 新增 add 两数相加函数
-- button "在侧边栏打开 src/util.ts": 打开
-- button "src/util.ts 的更多文件操作" [disabled]
 - button "在侧边栏预览 app.local"
 - text: app.local 新增配置文件，内容 mode=demo
-- button "在侧边栏打开 app.local": 打开
-- button "app.local 的更多文件操作" [disabled]
 - button "在侧边栏预览 notes.txt"
 - text: notes.txt 末尾追加了 done 一行
-- button "在侧边栏打开 notes.txt": 打开
-- button "notes.txt 的更多文件操作" [disabled]
 - button "复制"
 - button "好的回答"
 - button "有问题的回答"
diff --git a/snapshots/web/cordis-tool-round/system-prompt.expected.md b/snapshots/web/cordis-tool-round/system-prompt.expected.md
index a6bd84f32d..187a1abeef 100644
--- a/snapshots/web/cordis-tool-round/system-prompt.expected.md
+++ b/snapshots/web/cordis-tool-round/system-prompt.expected.md
@@ -2,7 +2,7 @@ You are an AI agent powered by DeepSeek Harness.
 
 You are a coding agent powered by the deepseek-v4-flash model.
 
-Tokens prefixed with @ are workspace paths the user explicitly referenced, relative to the workspace root. A trailing slash marks a directory: list it when its contents matter. Anything else is a file: use the read tool when its contents are needed, and do not claim to have inspected it before reading. @"..." quotes a path containing spaces.
+Tokens prefixed with @ are paths the user explicitly referenced. Relative paths resolve from the workspace root; absolute paths identify files or directories on the host. A trailing slash marks a directory: list it when its contents matter. Anything else is a file: use the read tool when its contents are needed, and do not claim to have inspected it before reading. @"..." quotes a path containing spaces.
 
 Check the [exit code: N] marker on every bash result; investigate failures before moving on.
 
diff --git a/snapshots/web/cordis-tool-round/tool-schemas.expected.json b/snapshots/web/cordis-tool-round/tool-schemas.expected.json
index ca7afe0add..bb6f987d5a 100644
--- a/snapshots/web/cordis-tool-round/tool-schemas.expected.json
+++ b/snapshots/web/cordis-tool-round/tool-schemas.expected.json
@@ -195,7 +195,7 @@
     },
     {
       "name": "cordis_inspect_query",
-      "description": "Run a read-only query explicitly declared by an Inspect Provider. platform, provider, and method must come from cordis_inspect_list, and input must satisfy that method's schema. Use this Tool before cordis_define to read exact Service methods, Event modes, Builtin signatures, Tool schemas, theme tokens, or live Slot trees and props. Host queries run locally. A Client query waits for the first valid page response and remains pending until a page answers or the Tool is cancelled. This Tool cannot invoke business Service methods or modify the runtime. For Service.listService and Event.listEvents, query without input to navigate the compact signature directory, then query the exact service or event for its structured contract and referenced types. For Slots.listSubTree, query without root to navigate the compact tree, then query an exact Slot root for its complete registration contract and props; an exact Factory root returns its identity, scope, and registrant.",
+      "description": "Run a read-only query declared by an Inspect Provider. platform, provider, and method must come from cordis_inspect_list, and input must satisfy that method's schema. Use this Tool before writing plugin code to read exact Service methods, Event modes, Builtin signatures, Tool schemas, theme tokens, or live Slot trees and props. Host queries run locally. A Client query waits for the first valid page response and remains pending until a page answers or the Tool is cancelled. This Tool cannot invoke business Service methods or modify the runtime.",
       "parameters": {
         "type": "object",
         "properties": {
diff --git a/snapshots/web/details-session-lifecycle/sidebar.expected.md b/snapshots/web/details-session-lifecycle/sidebar.expected.md
index 2a8b1d5955..9ae98ff006 100644
--- a/snapshots/web/details-session-lifecycle/sidebar.expected.md
+++ b/snapshots/web/details-session-lifecycle/sidebar.expected.md
@@ -17,7 +17,7 @@
   "expanded": true,
   "mode": "push",
   "panelContentWidth": 756,
-  "panelOuterWidth": 757,
+  "panelOuterWidth": 756,
   "coversViewport": false,
   "resizeHandleWidth": 8,
   "expandedDirectories": [],
@@ -246,7 +246,7 @@
   "expanded": true,
   "mode": "push",
   "panelContentWidth": 756,
-  "panelOuterWidth": 757,
+  "panelOuterWidth": 756,
   "coversViewport": false,
   "resizeHandleWidth": 8,
   "expandedDirectories": [],
@@ -281,7 +281,7 @@
   "expanded": true,
   "mode": "push",
   "panelContentWidth": 756,
-  "panelOuterWidth": 757,
+  "panelOuterWidth": 756,
   "coversViewport": false,
   "resizeHandleWidth": 8,
   "expandedDirectories": [],
diff --git a/snapshots/web/document-preview/applications.expected.md b/snapshots/web/document-preview/applications.expected.md
new file mode 100644
index 0000000000..d70632d545
--- /dev/null
+++ b/snapshots/web/document-preview/applications.expected.md
@@ -0,0 +1,4 @@
+- menu:
+  - menuitem "Test Player (default)"
+  - menuitem "Other Player"
+  - menuitem "Show file location"
diff --git a/snapshots/web/document-preview/document.expected.md b/snapshots/web/document-preview/document.expected.md
index a787f8f52e..a2489ba886 100644
--- a/snapshots/web/document-preview/document.expected.md
+++ b/snapshots/web/document-preview/document.expected.md
@@ -86,5 +86,5 @@
 
 - State: unsupported
 - Line: Preview is not available for this file type yet.
-- Header control: Open
-- Empty-state control: Open in default app
+- Header control has no text: true
+- Empty-state control has text: true
diff --git a/snapshots/web/fresh-round-trip/system-prompt.expected.md b/snapshots/web/fresh-round-trip/system-prompt.expected.md
index cc5a4013c4..e05a41da44 100644
--- a/snapshots/web/fresh-round-trip/system-prompt.expected.md
+++ b/snapshots/web/fresh-round-trip/system-prompt.expected.md
@@ -2,7 +2,7 @@ You are an AI agent powered by DeepSeek Harness.
 
 You are a coding agent powered by the deepseek-v4-flash model.
 
-Tokens prefixed with @ are workspace paths the user explicitly referenced, relative to the workspace root. A trailing slash marks a directory: list it when its contents matter. Anything else is a file: use the read tool when its contents are needed, and do not claim to have inspected it before reading. @"..." quotes a path containing spaces.
+Tokens prefixed with @ are paths the user explicitly referenced. Relative paths resolve from the workspace root; absolute paths identify files or directories on the host. A trailing slash marks a directory: list it when its contents matter. Anything else is a file: use the read tool when its contents are needed, and do not claim to have inspected it before reading. @"..." quotes a path containing spaces.
 
 Check the [exit code: N] marker on every bash result; investigate failures before moving on.
 
diff --git a/snapshots/web/present-svg/session.v4.jsonl b/snapshots/web/present-svg/session.v4.jsonl
new file mode 100644
index 0000000000..d844e49889
--- /dev/null
+++ b/snapshots/web/present-svg/session.v4.jsonl
@@ -0,0 +1,29 @@
+{"type":"session","version":4,"id":"{{session:1}}","createdAt":1788926678903,"cwd":"{{cwd}}","isSeeded":false,"delegationDepth":0,"agentPreset":"standard"}
+{"type":"permission/preset","data":{"preset":"workspace-write"}}
+{"type":"sandbox/mode","data":{"mode":"workspace-write"}}
+{"type":"approval/policy","data":{"policy":"ask"}}
+{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"inserted":[{"content":[{"type":"text","text":"简单画一个 SVG 表示冯诺依曼架构, 保存为 von-neumann.svg"}],"source":{"kind":"user","rpcId":"{{rpc:1}}","clientTimeZone":"{{clientTimeZone}}"},"role":"user","id":"{{message:1}}"}]}}
+{"type":"turn/start","data":{"turn":1}}
+{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"removedCount":1,"inserted":[]}}
+{"type":"step/start","data":{"turn":1,"step":1}}
+{"type":"system/message","data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{message:2}}"}},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"简单画一个 SVG 表示冯诺依曼架构, 保存为 von-neumann.svg"}],"source":{"kind":"user","rpcId":"{{rpc:1}}","clientTimeZone":"{{clientTimeZone}}"},"role":"user","id":"{{message:1}}"},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{message:3}}"},"surfaceOp":"append"}
+{"type":"request/header","data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"tools":"{{tools}}"},"reason":"initial"}}
+{"type":"request/context","data":{"provider":"deepseek-official","model":"deepseek-v4-flash","contextWindow":128000}}
+{"type":"session/title","data":{"title":"简单画一个 SVG 表示冯诺依曼","messageSeqs":[8],"source":{"kind":"fallback"}}}
+{"type":"assistant/message","data":{"turn":1,"step":1,"message":{"role":"assistant","content":[{"type":"reasoning","text":"The user wants a simple SVG diagram of the von Neumann architecture, saved as von-neumann.svg. Let me create a clean SVG showing CPU (control unit, ALU), memory, input, and output with bidirectional data/control buses.\n\nLet me write the file."},{"type":"text","text":"我来创建一个冯诺依曼架构的 SVG 示意图。"},{"type":"tool-call","id":"call_00_yxav8LdZ9iwWpgkUnspF6361","name":"write","arguments":"{\"file_path\": \"{{cwd}}/von-neumann.svg\", \"content\": \"<svg xmlns=\\\"http://www.w3.org/2000/svg\\\" viewBox=\\\"0 0 900 560\\\" width=\\\"900\\\" height=\\\"560\\\" font-family=\\\"Helvetica, Arial, sans-serif\\\">\\n  <title>冯诺依曼架构</title>\\n\\n  <defs>\\n    <marker id=\\\"arrow\\\" markerWidth=\\\"10\\\" markerHeight=\\\"10\\\" refX=\\\"8\\\" refY=\\\"3\\\" orient=\\\"auto\\\">\\n      <path d=\\\"M0,0 L8,3 L0,6 Z\\\" fill=\\\"#555\\\"/>\\n    </marker>\\n  </defs>\\n\\n  <!-- Background -->\\n  <rect x=\\\"0\\\" y=\\\"0\\\" width=\\\"900\\\" height=\\\"560\\\" fill=\\\"#fafbfc\\\"/>\\n  <text x=\\\"450\\\" y=\\\"34\\\" text-anchor=\\\"middle\\\" font-size=\\\"22\\\" font-weight=\\\"bold\\\" fill=\\\"#222\\\">冯诺依曼体系结构 (Von Neumann Architecture)</text>\\n\\n  <!-- ===== CPU ===== -->\\n  <rect x=\\\"300\\\" y=\\\"70\\\" width=\\\"300\\\" height=\\\"240\\\" rx=\\\"10\\\" fill=\\\"#fff\\\" stroke=\\\"#1f6feb\\\" stroke-width=\\\"2.5\\\"/>\\n  <text x=\\\"450\\\" y=\\\"98\\\" text-anchor=\\\"middle\\\" font-size=\\\"17\\\" font-weight=\\\"bold\\\" fill=\\\"#1f6feb\\\">中央处理器 CPU</text>\\n\\n  <!-- Control Unit -->\\n  <rect x=\\\"325\\\" y=\\\"118\\\" width=\\\"120\\\" height=\\\"160\\\" rx=\\\"8\\\" fill=\\\"#ddf4ff\\\" stroke=\\\"#54aeff\\\" stroke-width=\\\"1.5\\\"/>\\n  <text x=\\\"385\\\" y=\\\"142\\\" text-anchor=\\\"middle\\\" font-size=\\\"12.5\\\" font-weight=\\\"bold\\\" fill=\\\"#0969da\\\">控制单元</text>\\n  <text x=\\\"385\\\" y=\\\"158\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#0b5394\\\">CU</text>\\n  <text x=\\\"385\\\" y=\\\"262\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#555\\\">指令译码 · 时序控制</text>\\n\\n  <!-- ALU -->\\n  <rect x=\\\"455\\\" y=\\\"118\\\" width=\\\"120\\\" height=\\\"160\\\" rx=\\\"8\\\" fill=\\\"#fff8c5\\\" stroke=\\\"#d4a72c\\\" stroke-width=\\\"1.5\\\"/>\\n  <text x=\\\"515\\\" y=\\\"142\\\" text-anchor=\\\"middle\\\" font-size=\\\"12.5\\\" font-weight=\\\"bold\\\" fill=\\\"#9a6700\\\">算术逻辑单元</text>\\n  <text x=\\\"515\\\" y=\\\"158\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#7a5200\\\">ALU</text>\\n  <text x=\\\"515\\\" y=\\\"262\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#555\\\">算术运算 · 逻辑运算</text>\\n\\n  <!-- Registers -->\\n  <rect x=\\\"330\\\" y=\\\"186\\\" width=\\\"110\\\" height=\\\"56\\\" rx=\\\"6\\\" fill=\\\"#fff\\\" stroke=\\\"#8c959f\\\" stroke-width=\\\"1.2\\\" stroke-dasharray=\\\"4,3\\\"/>\\n  <text x=\\\"385\\\" y=\\\"208\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#444\\\">寄存器组</text>\\n  <text x=\\\"385\\\" y=\\\"224\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#666\\\">Registers / 缓存</text>\\n\\n  <!-- ===== Memory ===== -->\\n  <rect x=\\\"300\\\" y=\\\"400\\\" width=\\\"300\\\" height=\\\"110\\\" rx=\\\"10\\\" fill=\\\"#fff\\\" stroke=\\\"#cf222e\\\" stroke-width=\\\"2.5\\\"/>\\n  <text x=\\\"450\\\" y=\\\"428\\\" text-anchor=\\\"middle\\\" font-size=\\\"17\\\" font-weight=\\\"bold\\\" fill=\\\"#cf222e\\\">内存储器 Memory</text>\\n  <text x=\\\"450\\\" y=\\\"452\\\" text-anchor=\\\"middle\\\" font-size=\\\"12\\\" fill=\\\"#444\\\">存储单元: 指令和数据</text>\\n  <text x=\\\"450\\\" y=\\\"470\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#666\\\">(存放程序与数据，同一总线存取)</text>\\n\\n  <!-- ===== Input ===== -->\\n  <rect x=\\\"40\\\" y=\\\"150\\\" width=\\\"170\\\" height=\\\"120\\\" rx=\\\"10\\\" fill=\\\"#fff\\\" stroke=\\\"#1a7f37\\\" stroke-width=\\\"2.5\\\"/>\\n  <text x=\\\"125\\\" y=\\\"186\\\" text-anchor=\\\"middle\\\" font-size=\\\"15\\\" font-weight=\\\"bold\\\" fill=\\\"#1a7f37\\\">输入设备</text>\\n  <text x=\\\"125\\\" y=\\\"206\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#444\\\">Input</text>\\n  <text x=\\\"125\\\" y=\\\"238\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#666\\\">键盘 · 鼠标 · 磁盘</text>\\n\\n  <!-- ===== Output ===== -->\\n  <rect x=\\\"690\\\" y=\\\"150\\\" width=\\\"170\\\" height=\\\"120\\\" rx=\\\"10\\\" fill=\\\"#fff\\\" stroke=\\\"#bf3989\\\" stroke-width=\\\"2.5\\\"/>\\n  <text x=\\\"775\\\" y=\\\"186\\\" text-anchor=\\\"middle\\\" font-size=\\\"15\\\" font-weight=\\\"bold\\\" fill=\\\"#bf3989\\\">输出设备</text>\\n  <text x=\\\"775\\\" y=\\\"206\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#444\\\">Output</text>\\n  <text x=\\\"775\\\" y=\\\"238\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#666\\\">显示器 · 打印机</text>\\n\\n  <!-- ===== Bus lines ===== -->\\n  <!-- Address bus CPU <-> Memory (red) -->\\n  <path d=\\\"M450,320 L450,398\\\" fill=\\\"none\\\" stroke=\\\"#cf222e\\\" stroke-width=\\\"3\\\"/>\\n  <text x=\\\"420\\\" y=\\\"362\\\" text-anchor=\\\"end\\\" font-size=\\\"11\\\" fill=\\\"#cf222e\\\" transform=\\\"rotate(-90 420 362)\\\">地址总线</text>\\n\\n  <!-- Data/control bus label along the bottom -->\\n  <line x1=\\\"300\\\" y1=\\\"355\\\" x2=\\\"600\\\" y2=\\\"355\\\" stroke=\\\"#555\\\" stroke-width=\\\"1\\\" stroke-dasharray=\\\"2,3\\\" opacity=\\\"0.0\\\"/>\\n  <text x=\\\"450\\\" y=\\\"353\\\" text-anchor=\\\"middle\\\" font-size=\\\"12\\\" font-weight=\\\"bold\\\" fill=\\\"#555\\\">← 数据总线 / 控制总线 →</text>\\n\\n  <!-- CPU <-> Input (bidirectional-ish: input data in + control out) -->\\n  <path d=\\\"M212,210 L298,210\\\" fill=\\\"none\\\" stroke=\\\"#1a7f37\\\" stroke-width=\\\"3\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <path d=\\\"M212,196 L298,196\\\" fill=\\\"none\\\" stroke=\\\"#555\\\" stroke-width=\\\"2\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <text x=\\\"255\\\" y=\\\"184\\\" text-anchor=\\\"middle\\\" font-size=\\\"10.5\\\" fill=\\\"#1a7f37\\\">数据(输入)</text>\\n  <text x=\\\"255\\\" y=\\\"236\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#555\\\">控制</text>\\n\\n  <!-- CPU <-> Output -->\\n  <path d=\\\"M602,210 L688,210\\\" fill=\\\"none\\\" stroke=\\\"#bf3989\\\" stroke-width=\\\"3\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <path d=\\\"M602,196 L688,196\\\" fill=\\\"none\\\" stroke=\\\"#555\\\" stroke-width=\\\"2\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <text x=\\\"645\\\" y=\\\"184\\\" text-anchor=\\\"middle\\\" font-size=\\\"10.5\\\" fill=\\\"#bf3989\\\">数据(输出)</text>\\n  <text x=\\\"645\\\" y=\\\"236\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#555\\\">控制</text>\\n\\n  <!-- Memory <-> Input/Output hints: 存储器与 I/O 也通过总线交换 -->\\n  <path d=\\\"M125,272 L125,300 Q125,340 175,340 L298,340\\\" fill=\\\"none\\\" stroke=\\\"#8c959f\\\" stroke-width=\\\"1.8\\\" stroke-dasharray=\\\"6,4\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <text x=\\\"160\\\" y=\\\"328\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#666\\\" transform=\\\"rotate(-8 160 328)\\\">总线</text>\\n\\n  <path d=\\\"M775,272 L775,300 Q775,340 725,340 L602,340\\\" fill=\\\"none\\\" stroke=\\\"#8c959f\\\" stroke-width=\\\"1.8\\\" stroke-dasharray=\\\"6,4\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <text x=\\\"740\\\" y=\\\"328\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#666\\\" transform=\\\"rotate(8 740 328)\\\">总线</text>\\n\\n  <!-- Stored-program note -->\\n  <text x=\\\"450\\\" y=\\\"530\\\" text-anchor=\\\"middle\\\" font-size=\\\"11.5\\\" fill=\\\"#666\\\">核心思想: 指令与数据以二进制形式统一存放在存储器中 —— “存储程序”</text>\\n</svg>\\n\"}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{message:4}}"},"usage":{"inputTokens":7197,"outputTokens":2153,"totalTokens":10502,"cacheReadTokens":1152,"reasoningTokens":55},"stream":[{"type":"chunk","time":1789457782571,"chunk":{"type":"block-start","index":0,"blockType":"reasoning"}},{"type":"reasoning-chunks","time0":1789457782571,"index":0,"dt":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0],"texts":["The"," user"," wants"," a"," simple"," SVG"," diagram"," of"," the"," von"," Neumann"," architecture",","," saved"," as"," von","-","neum","ann",".svg","."," Let"," me"," create"," a"," clean"," SVG"," showing"," CPU"," (","control"," unit",","," AL","U","),"," memory",","," input",","," and"," output"," with"," bidirectional"," data","/","control"," buses",".\n\n","Let"," me"," write"," the"," file","."]},{"type":"chunk","time":1789457782572,"chunk":{"type":"block-start","index":1,"blockType":"text"}},{"type":"text-chunks","time0":1789457782572,"index":1,"dt":[0,0,0,0,0,0,0,0,0,0,0],"texts":["我来","创建一个","冯","诺","依","曼","架构","的"," SVG"," ","示意图","。"]},{"type":"chunk","time":1789457782572,"chunk":{"type":"block-start","index":2,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":1789457782572,"index":2,"dt":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"id":"call_00_yxav8LdZ9iwWpgkUnspF6361","name":"write","args":["","{","\"","file","_path","\"",": ","\"","/","private","/","var","/f","old","ers","/n","5","/f","339","h","wh","15","_g","f","4","gk","8","ns","rt","9","qm","400","00","gn","/T","/d","sh","-web","-e","2","e","-w","s","-g","Ou","Z","JC","/","works","pace","/v","on","-","neum","ann",".svg","\"",", ","\"","content","\"",": ","\"","<","svg"," xmlns","=\\\"","http","://","www",".w","3",".org","/","200","0","/s","vg","\\\""," view","Box","=\\\"","0"," ","0"," ","900"," ","560","\\\""," width","=\\\"","900","\\\""," height","=\\\"","560","\\\""," font","-family","=\\\"","Hel","vetica",","," A","rial",","," sans","-serif","\\\">\\n"," "," <","title",">","冯","诺","依","曼","架构","</","title",">\\n\\n"," "," <","def","s",">\\n","   "," <","mark","er"," id","=\\\"","arrow","\\\""," marker","Width","=\\\"","10","\\\""," marker","Height","=\\\"","10","\\\""," ref","X","=\\\"","8","\\\""," ref","Y","=\\\"","3","\\\""," orient","=\\\"","auto","\\\">\\n","     "," <","path"," d","=\\\"","M","0",",","0"," L","8",",","3"," L","0",",","6"," Z","\\\""," fill","=\\\"#","555","\\\"/>\\n","   "," </","mark","er",">\\n"," "," </","def","s",">\\n\\n"," "," <!--"," Background"," -->\\n"," "," <","rect"," x","=\\\"","0","\\\""," y","=\\\"","0","\\\""," width","=\\\"","900","\\\""," height","=\\\"","560","\\\""," fill","=\\\"#","f","af","bf","c","\\\"/>\\n"," "," <","text"," x","=\\\"","450","\\\""," y","=\\\"","34","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","22","\\\""," font","-weight","=\\\"","bold","\\\""," fill","=\\\"#","222","\\\">","冯","诺","依","曼","体系","结构"," (","Von"," Neumann"," Architecture",")</","text",">\\n\\n"," "," <!--"," =","===="," CPU"," =","===="," -->\\n"," "," <","rect"," x","=\\\"","300","\\\""," y","=\\\"","70","\\\""," width","=\\\"","300","\\\""," height","=\\\"","240","\\\""," rx","=\\\"","10","\\\""," fill","=\\\"#","fff","\\\""," stroke","=\\\"#","1","f","6","f","eb","\\\""," stroke","-width","=\\\"","2",".","5","\\\"/>\\n"," "," <","text"," x","=\\\"","450","\\\""," y","=\\\"","98","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","17","\\\""," font","-weight","=\\\"","bold","\\\""," fill","=\\\"#","1","f","6","f","eb","\\\">","中央","处理器"," CPU","</","text",">\\n\\n"," "," <!--"," Control"," Unit"," -->\\n"," "," <","rect"," x","=\\\"","325","\\\""," y","=\\\"","118","\\\""," width","=\\\"","120","\\\""," height","=\\\"","160","\\\""," rx","=\\\"","8","\\\""," fill","=\\\"#","d","df","4","ff","\\\""," stroke","=\\\"#","54","ae","ff","\\\""," stroke","-width","=\\\"","1",".","5","\\\"/>\\n"," "," <","text"," x","=\\\"","385","\\\""," y","=\\\"","142","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","12",".","5","\\\""," font","-weight","=\\\"","bold","\\\""," fill","=\\\"#","096","9","da","\\\">","控制","单元","</","text",">\\n"," "," <","text"," x","=\\\"","385","\\\""," y","=\\\"","158","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","11","\\\""," fill","=\\\"#","0","b","539","4","\\\">","CU","</","text",">\\n"," "," <","text"," x","=\\\"","385","\\\""," y","=\\\"","262","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","10","\\\""," fill","=\\\"#","555","\\\">","指令","译","码"," ·"," ","时序","控制","</","text",">\\n\\n"," "," <!--"," AL","U"," -->\\n"," "," <","rect"," x","=\\\"","455","\\\""," y","=\\\"","118","\\\""," width","=\\\"","120","\\\""," height","=\\\"","160","\\\""," rx","=\\\"","8","\\\""," fill","=\\\"#","fff","8","c","5","\\\""," stroke","=\\\"#","d","4","a","72","c","\\\""," stroke","-width","=\\\"","1",".","5","\\\"/>\\n"," "," <","text"," x","=\\\"","515","\\\""," y","=\\\"","142","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","12",".","5","\\\""," font","-weight","=\\\"","bold","\\\""," fill","=\\\"#","9","a","670","0","\\\">","算术","逻辑","单元","</","text",">\\n"," "," <","text"," x","=\\\"","515","\\\""," y","=\\\"","158","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","11","\\\""," fill","=\\\"#","7","a","520","0","\\\">","ALU","</","text",">\\n"," "," <","text"," x","=\\\"","515","\\\""," y","=\\\"","262","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","10","\\\""," fill","=\\\"#","555","\\\">","算术","运算"," ·"," ","逻辑","运算","</","text",">\\n\\n"," "," <!--"," Reg","isters"," -->\\n"," "," <","rect"," x","=\\\"","330","\\\""," y","=\\\"","186","\\\""," width","=\\\"","110","\\\""," height","=\\\"","56","\\\""," rx","=\\\"","6","\\\""," fill","=\\\"#","fff","\\\""," stroke","=\\\"#","8","c","959","f","\\\""," stroke","-width","=\\\"","1",".","2","\\\""," stroke","-d","ash","array","=\\\"","4",",","3","\\\"/>\\n"," "," <","text"," x","=\\\"","385","\\\""," y","=\\\"","208","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","11","\\\""," fill","=\\\"#","444","\\\">","寄存器","组","</","text",">\\n"," "," <","text"," x","=\\\"","385","\\\""," y","=\\\"","224","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","10","\\\""," fill","=\\\"#","666","\\\">","Reg","isters"," /"," ","缓存","</","text",">\\n\\n"," "," <!--"," =","===="," Memory"," =","===="," -->\\n"," "," <","rect"," x","=\\\"","300","\\\""," y","=\\\"","400","\\\""," width","=\\\"","300","\\\""," height","=\\\"","110","\\\""," rx","=\\\"","10","\\\""," fill","=\\\"#","fff","\\\""," stroke","=\\\"#","cf","222","e","\\\""," stroke","-width","=\\\"","2",".","5","\\\"/>\\n"," "," <","text"," x","=\\\"","450","\\\""," y","=\\\"","428","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","17","\\\""," font","-weight","=\\\"","bold","\\\""," fill","=\\\"#","cf","222","e","\\\">","内","存储器"," Memory","</","text",">\\n"," "," <","text"," x","=\\\"","450","\\\""," y","=\\\"","452","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","12","\\\""," fill","=\\\"#","444","\\\">","存储","单元",":"," ","指令","和数据","</","text",">\\n"," "," <","text"," x","=\\\"","450","\\\""," y","=\\\"","470","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","11","\\\""," fill","=\\\"#","666","\\\">","(","存放","程序","与","数据","，","同一","总线","存取",")</","text",">\\n\\n"," "," <!--"," =","===="," Input"," =","===="," -->\\n"," "," <","rect"," x","=\\\"","40","\\\""," y","=\\\"","150","\\\""," width","=\\\"","170","\\\""," height","=\\\"","120","\\\""," rx","=\\\"","10","\\\""," fill","=\\\"#","fff","\\\""," stroke","=\\\"#","1","a","7","f","37","\\\""," stroke","-width","=\\\"","2",".","5","\\\"/>\\n"," "," <","text"," x","=\\\"","125","\\\""," y","=\\\"","186","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","15","\\\""," font","-weight","=\\\"","bold","\\\""," fill","=\\\"#","1","a","7","f","37","\\\">","输入","设备","</","text",">\\n"," "," <","text"," x","=\\\"","125","\\\""," y","=\\\"","206","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","11","\\\""," fill","=\\\"#","444","\\\">","Input","</","text",">\\n"," "," <","text"," x","=\\\"","125","\\\""," y","=\\\"","238","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","10","\\\""," fill","=\\\"#","666","\\\">","键盘"," ·"," ","鼠标"," ·"," ","磁盘","</","text",">\\n\\n"," "," <!--"," =","===="," Output"," =","===="," -->\\n"," "," <","rect"," x","=\\\"","690","\\\""," y","=\\\"","150","\\\""," width","=\\\"","170","\\\""," height","=\\\"","120","\\\""," rx","=\\\"","10","\\\""," fill","=\\\"#","fff","\\\""," stroke","=\\\"#","bf","398","9","\\\""," stroke","-width","=\\\"","2",".","5","\\\"/>\\n"," "," <","text"," x","=\\\"","775","\\\""," y","=\\\"","186","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","15","\\\""," font","-weight","=\\\"","bold","\\\""," fill","=\\\"#","bf","398","9","\\\">","输出","设备","</","text",">\\n"," "," <","text"," x","=\\\"","775","\\\""," y","=\\\"","206","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","11","\\\""," fill","=\\\"#","444","\\\">","Output","</","text",">\\n"," "," <","text"," x","=\\\"","775","\\\""," y","=\\\"","238","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","10","\\\""," fill","=\\\"#","666","\\\">","显示器"," ·"," ","打印机","</","text",">\\n\\n"," "," <!--"," =","===="," Bus"," lines"," =","===="," -->\\n"," "," <!--"," Address"," bus"," CPU"," <","->"," Memory"," (","red",")"," -->\\n"," "," <","path"," d","=\\\"","M","450",",","320"," L","450",",","398","\\\""," fill","=\\\"","none","\\\""," stroke","=\\\"#","cf","222","e","\\\""," stroke","-width","=\\\"","3","\\\"/>\\n"," "," <","text"," x","=\\\"","420","\\\""," y","=\\\"","362","\\\""," text","-an","chor","=\\\"","end","\\\""," font","-size","=\\\"","11","\\\""," fill","=\\\"#","cf","222","e","\\\""," transform","=\\\"","rotate","(-","90"," ","420"," ","362",")","\\\">","地址","总线","</","text",">\\n\\n"," "," <!--"," Data","/","control"," bus"," label"," along"," the"," bottom"," -->\\n"," "," <","line"," x","1","=\\\"","300","\\\""," y","1","=\\\"","355","\\\""," x","2","=\\\"","600","\\\""," y","2","=\\\"","355","\\\""," stroke","=\\\"#","555","\\\""," stroke","-width","=\\\"","1","\\\""," stroke","-d","ash","array","=\\\"","2",",","3","\\\""," opacity","=\\\"","0",".","0","\\\"/>\\n"," "," <","text"," x","=\\\"","450","\\\""," y","=\\\"","353","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","12","\\\""," font","-weight","=\\\"","bold","\\\""," fill","=\\\"#","555","\\\">","←"," ","数据","总线"," /"," ","控制","总线"," →","</","text",">\\n\\n"," "," <!--"," CPU"," <","->"," Input"," (","bid","irectional","-ish",":"," input"," data"," in"," +"," control"," out",")"," -->\\n"," "," <","path"," d","=\\\"","M","212",",","210"," L","298",",","210","\\\""," fill","=\\\"","none","\\\""," stroke","=\\\"#","1","a","7","f","37","\\\""," stroke","-width","=\\\"","3","\\\""," marker","-end","=\\\"","url","(#","arrow",")","\\\"/>\\n"," "," <","path"," d","=\\\"","M","212",",","196"," L","298",",","196","\\\""," fill","=\\\"","none","\\\""," stroke","=\\\"#","555","\\\""," stroke","-width","=\\\"","2","\\\""," marker","-end","=\\\"","url","(#","arrow",")","\\\"/>\\n"," "," <","text"," x","=\\\"","255","\\\""," y","=\\\"","184","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","10",".","5","\\\""," fill","=\\\"#","1","a","7","f","37","\\\">","数据","(","输入",")</","text",">\\n"," "," <","text"," x","=\\\"","255","\\\""," y","=\\\"","236","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","10","\\\""," fill","=\\\"#","555","\\\">","控制","</","text",">\\n\\n"," "," <!--"," CPU"," <","->"," Output"," -->\\n"," "," <","path"," d","=\\\"","M","602",",","210"," L","688",",","210","\\\""," fill","=\\\"","none","\\\""," stroke","=\\\"#","bf","398","9","\\\""," stroke","-width","=\\\"","3","\\\""," marker","-end","=\\\"","url","(#","arrow",")","\\\"/>\\n"," "," <","path"," d","=\\\"","M","602",",","196"," L","688",",","196","\\\""," fill","=\\\"","none","\\\""," stroke","=\\\"#","555","\\\""," stroke","-width","=\\\"","2","\\\""," marker","-end","=\\\"","url","(#","arrow",")","\\\"/>\\n"," "," <","text"," x","=\\\"","645","\\\""," y","=\\\"","184","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","10",".","5","\\\""," fill","=\\\"#","bf","398","9","\\\">","数据","(","输出",")</","text",">\\n"," "," <","text"," x","=\\\"","645","\\\""," y","=\\\"","236","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","10","\\\""," fill","=\\\"#","555","\\\">","控制","</","text",">\\n\\n"," "," <!--"," Memory"," <","->"," Input","/","Output"," hints",":"," ","存储器","与"," I","/O"," ","也","通过","总线","交换"," -->\\n"," "," <","path"," d","=\\\"","M","125",",","272"," L","125",",","300"," Q","125",",","340"," ","175",",","340"," L","298",",","340","\\\""," fill","=\\\"","none","\\\""," stroke","=\\\"#","8","c","959","f","\\\""," stroke","-width","=\\\"","1",".","8","\\\""," stroke","-d","ash","array","=\\\"","6",",","4","\\\""," marker","-end","=\\\"","url","(#","arrow",")","\\\"/>\\n"," "," <","text"," x","=\\\"","160","\\\""," y","=\\\"","328","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","10","\\\""," fill","=\\\"#","666","\\\""," transform","=\\\"","rotate","(-","8"," ","160"," ","328",")","\\\">","总线","</","text",">\\n\\n"," "," <","path"," d","=\\\"","M","775",",","272"," L","775",",","300"," Q","775",",","340"," ","725",",","340"," L","602",",","340","\\\""," fill","=\\\"","none","\\\""," stroke","=\\\"#","8","c","959","f","\\\""," stroke","-width","=\\\"","1",".","8","\\\""," stroke","-d","ash","array","=\\\"","6",",","4","\\\""," marker","-end","=\\\"","url","(#","arrow",")","\\\"/>\\n"," "," <","text"," x","=\\\"","740","\\\""," y","=\\\"","328","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","10","\\\""," fill","=\\\"#","666","\\\""," transform","=\\\"","rotate","(","8"," ","740"," ","328",")","\\\">","总线","</","text",">\\n\\n"," "," <!--"," St","ored","-program"," note"," -->\\n"," "," <","text"," x","=\\\"","450","\\\""," y","=\\\"","530","\\\""," text","-an","chor","=\\\"","middle","\\\""," font","-size","=\\\"","11",".","5","\\\""," fill","=\\\"#","666","\\\">","核心","思想",":"," ","指令","与","数据","以","二进制","形式","统一","存放在","存储器","中"," ——"," “","存储","程序","”","</","text",">\\n","</","svg",">\\n","\"","}"]},{"type":"chunk","time":1789457782585,"chunk":{"type":"block-end","index":0,"block":{"type":"reasoning","text":"The user wants a simple SVG diagram of the von Neumann architecture, saved as von-neumann.svg. Let me create a clean SVG showing CPU (control unit, ALU), memory, input, and output with bidirectional data/control buses.\n\nLet me write the file."}}},{"type":"chunk","time":1789457782585,"chunk":{"type":"block-end","index":1,"block":{"type":"text","text":"我来创建一个冯诺依曼架构的 SVG 示意图。"}}},{"type":"chunk","time":1789457782585,"chunk":{"type":"block-end","index":2,"block":{"type":"tool-call","id":"call_00_yxav8LdZ9iwWpgkUnspF6361","name":"write","arguments":"{\"file_path\": \"{{cwd}}/von-neumann.svg\", \"content\": \"<svg xmlns=\\\"http://www.w3.org/2000/svg\\\" viewBox=\\\"0 0 900 560\\\" width=\\\"900\\\" height=\\\"560\\\" font-family=\\\"Helvetica, Arial, sans-serif\\\">\\n  <title>冯诺依曼架构</title>\\n\\n  <defs>\\n    <marker id=\\\"arrow\\\" markerWidth=\\\"10\\\" markerHeight=\\\"10\\\" refX=\\\"8\\\" refY=\\\"3\\\" orient=\\\"auto\\\">\\n      <path d=\\\"M0,0 L8,3 L0,6 Z\\\" fill=\\\"#555\\\"/>\\n    </marker>\\n  </defs>\\n\\n  <!-- Background -->\\n  <rect x=\\\"0\\\" y=\\\"0\\\" width=\\\"900\\\" height=\\\"560\\\" fill=\\\"#fafbfc\\\"/>\\n  <text x=\\\"450\\\" y=\\\"34\\\" text-anchor=\\\"middle\\\" font-size=\\\"22\\\" font-weight=\\\"bold\\\" fill=\\\"#222\\\">冯诺依曼体系结构 (Von Neumann Architecture)</text>\\n\\n  <!-- ===== CPU ===== -->\\n  <rect x=\\\"300\\\" y=\\\"70\\\" width=\\\"300\\\" height=\\\"240\\\" rx=\\\"10\\\" fill=\\\"#fff\\\" stroke=\\\"#1f6feb\\\" stroke-width=\\\"2.5\\\"/>\\n  <text x=\\\"450\\\" y=\\\"98\\\" text-anchor=\\\"middle\\\" font-size=\\\"17\\\" font-weight=\\\"bold\\\" fill=\\\"#1f6feb\\\">中央处理器 CPU</text>\\n\\n  <!-- Control Unit -->\\n  <rect x=\\\"325\\\" y=\\\"118\\\" width=\\\"120\\\" height=\\\"160\\\" rx=\\\"8\\\" fill=\\\"#ddf4ff\\\" stroke=\\\"#54aeff\\\" stroke-width=\\\"1.5\\\"/>\\n  <text x=\\\"385\\\" y=\\\"142\\\" text-anchor=\\\"middle\\\" font-size=\\\"12.5\\\" font-weight=\\\"bold\\\" fill=\\\"#0969da\\\">控制单元</text>\\n  <text x=\\\"385\\\" y=\\\"158\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#0b5394\\\">CU</text>\\n  <text x=\\\"385\\\" y=\\\"262\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#555\\\">指令译码 · 时序控制</text>\\n\\n  <!-- ALU -->\\n  <rect x=\\\"455\\\" y=\\\"118\\\" width=\\\"120\\\" height=\\\"160\\\" rx=\\\"8\\\" fill=\\\"#fff8c5\\\" stroke=\\\"#d4a72c\\\" stroke-width=\\\"1.5\\\"/>\\n  <text x=\\\"515\\\" y=\\\"142\\\" text-anchor=\\\"middle\\\" font-size=\\\"12.5\\\" font-weight=\\\"bold\\\" fill=\\\"#9a6700\\\">算术逻辑单元</text>\\n  <text x=\\\"515\\\" y=\\\"158\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#7a5200\\\">ALU</text>\\n  <text x=\\\"515\\\" y=\\\"262\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#555\\\">算术运算 · 逻辑运算</text>\\n\\n  <!-- Registers -->\\n  <rect x=\\\"330\\\" y=\\\"186\\\" width=\\\"110\\\" height=\\\"56\\\" rx=\\\"6\\\" fill=\\\"#fff\\\" stroke=\\\"#8c959f\\\" stroke-width=\\\"1.2\\\" stroke-dasharray=\\\"4,3\\\"/>\\n  <text x=\\\"385\\\" y=\\\"208\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#444\\\">寄存器组</text>\\n  <text x=\\\"385\\\" y=\\\"224\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#666\\\">Registers / 缓存</text>\\n\\n  <!-- ===== Memory ===== -->\\n  <rect x=\\\"300\\\" y=\\\"400\\\" width=\\\"300\\\" height=\\\"110\\\" rx=\\\"10\\\" fill=\\\"#fff\\\" stroke=\\\"#cf222e\\\" stroke-width=\\\"2.5\\\"/>\\n  <text x=\\\"450\\\" y=\\\"428\\\" text-anchor=\\\"middle\\\" font-size=\\\"17\\\" font-weight=\\\"bold\\\" fill=\\\"#cf222e\\\">内存储器 Memory</text>\\n  <text x=\\\"450\\\" y=\\\"452\\\" text-anchor=\\\"middle\\\" font-size=\\\"12\\\" fill=\\\"#444\\\">存储单元: 指令和数据</text>\\n  <text x=\\\"450\\\" y=\\\"470\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#666\\\">(存放程序与数据，同一总线存取)</text>\\n\\n  <!-- ===== Input ===== -->\\n  <rect x=\\\"40\\\" y=\\\"150\\\" width=\\\"170\\\" height=\\\"120\\\" rx=\\\"10\\\" fill=\\\"#fff\\\" stroke=\\\"#1a7f37\\\" stroke-width=\\\"2.5\\\"/>\\n  <text x=\\\"125\\\" y=\\\"186\\\" text-anchor=\\\"middle\\\" font-size=\\\"15\\\" font-weight=\\\"bold\\\" fill=\\\"#1a7f37\\\">输入设备</text>\\n  <text x=\\\"125\\\" y=\\\"206\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#444\\\">Input</text>\\n  <text x=\\\"125\\\" y=\\\"238\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#666\\\">键盘 · 鼠标 · 磁盘</text>\\n\\n  <!-- ===== Output ===== -->\\n  <rect x=\\\"690\\\" y=\\\"150\\\" width=\\\"170\\\" height=\\\"120\\\" rx=\\\"10\\\" fill=\\\"#fff\\\" stroke=\\\"#bf3989\\\" stroke-width=\\\"2.5\\\"/>\\n  <text x=\\\"775\\\" y=\\\"186\\\" text-anchor=\\\"middle\\\" font-size=\\\"15\\\" font-weight=\\\"bold\\\" fill=\\\"#bf3989\\\">输出设备</text>\\n  <text x=\\\"775\\\" y=\\\"206\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#444\\\">Output</text>\\n  <text x=\\\"775\\\" y=\\\"238\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#666\\\">显示器 · 打印机</text>\\n\\n  <!-- ===== Bus lines ===== -->\\n  <!-- Address bus CPU <-> Memory (red) -->\\n  <path d=\\\"M450,320 L450,398\\\" fill=\\\"none\\\" stroke=\\\"#cf222e\\\" stroke-width=\\\"3\\\"/>\\n  <text x=\\\"420\\\" y=\\\"362\\\" text-anchor=\\\"end\\\" font-size=\\\"11\\\" fill=\\\"#cf222e\\\" transform=\\\"rotate(-90 420 362)\\\">地址总线</text>\\n\\n  <!-- Data/control bus label along the bottom -->\\n  <line x1=\\\"300\\\" y1=\\\"355\\\" x2=\\\"600\\\" y2=\\\"355\\\" stroke=\\\"#555\\\" stroke-width=\\\"1\\\" stroke-dasharray=\\\"2,3\\\" opacity=\\\"0.0\\\"/>\\n  <text x=\\\"450\\\" y=\\\"353\\\" text-anchor=\\\"middle\\\" font-size=\\\"12\\\" font-weight=\\\"bold\\\" fill=\\\"#555\\\">← 数据总线 / 控制总线 →</text>\\n\\n  <!-- CPU <-> Input (bidirectional-ish: input data in + control out) -->\\n  <path d=\\\"M212,210 L298,210\\\" fill=\\\"none\\\" stroke=\\\"#1a7f37\\\" stroke-width=\\\"3\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <path d=\\\"M212,196 L298,196\\\" fill=\\\"none\\\" stroke=\\\"#555\\\" stroke-width=\\\"2\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <text x=\\\"255\\\" y=\\\"184\\\" text-anchor=\\\"middle\\\" font-size=\\\"10.5\\\" fill=\\\"#1a7f37\\\">数据(输入)</text>\\n  <text x=\\\"255\\\" y=\\\"236\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#555\\\">控制</text>\\n\\n  <!-- CPU <-> Output -->\\n  <path d=\\\"M602,210 L688,210\\\" fill=\\\"none\\\" stroke=\\\"#bf3989\\\" stroke-width=\\\"3\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <path d=\\\"M602,196 L688,196\\\" fill=\\\"none\\\" stroke=\\\"#555\\\" stroke-width=\\\"2\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <text x=\\\"645\\\" y=\\\"184\\\" text-anchor=\\\"middle\\\" font-size=\\\"10.5\\\" fill=\\\"#bf3989\\\">数据(输出)</text>\\n  <text x=\\\"645\\\" y=\\\"236\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#555\\\">控制</text>\\n\\n  <!-- Memory <-> Input/Output hints: 存储器与 I/O 也通过总线交换 -->\\n  <path d=\\\"M125,272 L125,300 Q125,340 175,340 L298,340\\\" fill=\\\"none\\\" stroke=\\\"#8c959f\\\" stroke-width=\\\"1.8\\\" stroke-dasharray=\\\"6,4\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <text x=\\\"160\\\" y=\\\"328\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#666\\\" transform=\\\"rotate(-8 160 328)\\\">总线</text>\\n\\n  <path d=\\\"M775,272 L775,300 Q775,340 725,340 L602,340\\\" fill=\\\"none\\\" stroke=\\\"#8c959f\\\" stroke-width=\\\"1.8\\\" stroke-dasharray=\\\"6,4\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <text x=\\\"740\\\" y=\\\"328\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#666\\\" transform=\\\"rotate(8 740 328)\\\">总线</text>\\n\\n  <!-- Stored-program note -->\\n  <text x=\\\"450\\\" y=\\\"530\\\" text-anchor=\\\"middle\\\" font-size=\\\"11.5\\\" fill=\\\"#666\\\">核心思想: 指令与数据以二进制形式统一存放在存储器中 —— “存储程序”</text>\\n</svg>\\n\"}"}}},{"type":"chunk","time":1789457782585,"chunk":{"type":"usage","usage":{"inputTokens":7197,"outputTokens":2153,"totalTokens":10502,"cacheReadTokens":1152,"reasoningTokens":55}}},{"type":"chunk","time":1789457782585,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":1,"callId":"call_00_yxav8LdZ9iwWpgkUnspF6361","name":"write","arguments":"{\"file_path\": \"{{cwd}}/von-neumann.svg\", \"content\": \"<svg xmlns=\\\"http://www.w3.org/2000/svg\\\" viewBox=\\\"0 0 900 560\\\" width=\\\"900\\\" height=\\\"560\\\" font-family=\\\"Helvetica, Arial, sans-serif\\\">\\n  <title>冯诺依曼架构</title>\\n\\n  <defs>\\n    <marker id=\\\"arrow\\\" markerWidth=\\\"10\\\" markerHeight=\\\"10\\\" refX=\\\"8\\\" refY=\\\"3\\\" orient=\\\"auto\\\">\\n      <path d=\\\"M0,0 L8,3 L0,6 Z\\\" fill=\\\"#555\\\"/>\\n    </marker>\\n  </defs>\\n\\n  <!-- Background -->\\n  <rect x=\\\"0\\\" y=\\\"0\\\" width=\\\"900\\\" height=\\\"560\\\" fill=\\\"#fafbfc\\\"/>\\n  <text x=\\\"450\\\" y=\\\"34\\\" text-anchor=\\\"middle\\\" font-size=\\\"22\\\" font-weight=\\\"bold\\\" fill=\\\"#222\\\">冯诺依曼体系结构 (Von Neumann Architecture)</text>\\n\\n  <!-- ===== CPU ===== -->\\n  <rect x=\\\"300\\\" y=\\\"70\\\" width=\\\"300\\\" height=\\\"240\\\" rx=\\\"10\\\" fill=\\\"#fff\\\" stroke=\\\"#1f6feb\\\" stroke-width=\\\"2.5\\\"/>\\n  <text x=\\\"450\\\" y=\\\"98\\\" text-anchor=\\\"middle\\\" font-size=\\\"17\\\" font-weight=\\\"bold\\\" fill=\\\"#1f6feb\\\">中央处理器 CPU</text>\\n\\n  <!-- Control Unit -->\\n  <rect x=\\\"325\\\" y=\\\"118\\\" width=\\\"120\\\" height=\\\"160\\\" rx=\\\"8\\\" fill=\\\"#ddf4ff\\\" stroke=\\\"#54aeff\\\" stroke-width=\\\"1.5\\\"/>\\n  <text x=\\\"385\\\" y=\\\"142\\\" text-anchor=\\\"middle\\\" font-size=\\\"12.5\\\" font-weight=\\\"bold\\\" fill=\\\"#0969da\\\">控制单元</text>\\n  <text x=\\\"385\\\" y=\\\"158\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#0b5394\\\">CU</text>\\n  <text x=\\\"385\\\" y=\\\"262\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#555\\\">指令译码 · 时序控制</text>\\n\\n  <!-- ALU -->\\n  <rect x=\\\"455\\\" y=\\\"118\\\" width=\\\"120\\\" height=\\\"160\\\" rx=\\\"8\\\" fill=\\\"#fff8c5\\\" stroke=\\\"#d4a72c\\\" stroke-width=\\\"1.5\\\"/>\\n  <text x=\\\"515\\\" y=\\\"142\\\" text-anchor=\\\"middle\\\" font-size=\\\"12.5\\\" font-weight=\\\"bold\\\" fill=\\\"#9a6700\\\">算术逻辑单元</text>\\n  <text x=\\\"515\\\" y=\\\"158\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#7a5200\\\">ALU</text>\\n  <text x=\\\"515\\\" y=\\\"262\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#555\\\">算术运算 · 逻辑运算</text>\\n\\n  <!-- Registers -->\\n  <rect x=\\\"330\\\" y=\\\"186\\\" width=\\\"110\\\" height=\\\"56\\\" rx=\\\"6\\\" fill=\\\"#fff\\\" stroke=\\\"#8c959f\\\" stroke-width=\\\"1.2\\\" stroke-dasharray=\\\"4,3\\\"/>\\n  <text x=\\\"385\\\" y=\\\"208\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#444\\\">寄存器组</text>\\n  <text x=\\\"385\\\" y=\\\"224\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#666\\\">Registers / 缓存</text>\\n\\n  <!-- ===== Memory ===== -->\\n  <rect x=\\\"300\\\" y=\\\"400\\\" width=\\\"300\\\" height=\\\"110\\\" rx=\\\"10\\\" fill=\\\"#fff\\\" stroke=\\\"#cf222e\\\" stroke-width=\\\"2.5\\\"/>\\n  <text x=\\\"450\\\" y=\\\"428\\\" text-anchor=\\\"middle\\\" font-size=\\\"17\\\" font-weight=\\\"bold\\\" fill=\\\"#cf222e\\\">内存储器 Memory</text>\\n  <text x=\\\"450\\\" y=\\\"452\\\" text-anchor=\\\"middle\\\" font-size=\\\"12\\\" fill=\\\"#444\\\">存储单元: 指令和数据</text>\\n  <text x=\\\"450\\\" y=\\\"470\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#666\\\">(存放程序与数据，同一总线存取)</text>\\n\\n  <!-- ===== Input ===== -->\\n  <rect x=\\\"40\\\" y=\\\"150\\\" width=\\\"170\\\" height=\\\"120\\\" rx=\\\"10\\\" fill=\\\"#fff\\\" stroke=\\\"#1a7f37\\\" stroke-width=\\\"2.5\\\"/>\\n  <text x=\\\"125\\\" y=\\\"186\\\" text-anchor=\\\"middle\\\" font-size=\\\"15\\\" font-weight=\\\"bold\\\" fill=\\\"#1a7f37\\\">输入设备</text>\\n  <text x=\\\"125\\\" y=\\\"206\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#444\\\">Input</text>\\n  <text x=\\\"125\\\" y=\\\"238\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#666\\\">键盘 · 鼠标 · 磁盘</text>\\n\\n  <!-- ===== Output ===== -->\\n  <rect x=\\\"690\\\" y=\\\"150\\\" width=\\\"170\\\" height=\\\"120\\\" rx=\\\"10\\\" fill=\\\"#fff\\\" stroke=\\\"#bf3989\\\" stroke-width=\\\"2.5\\\"/>\\n  <text x=\\\"775\\\" y=\\\"186\\\" text-anchor=\\\"middle\\\" font-size=\\\"15\\\" font-weight=\\\"bold\\\" fill=\\\"#bf3989\\\">输出设备</text>\\n  <text x=\\\"775\\\" y=\\\"206\\\" text-anchor=\\\"middle\\\" font-size=\\\"11\\\" fill=\\\"#444\\\">Output</text>\\n  <text x=\\\"775\\\" y=\\\"238\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#666\\\">显示器 · 打印机</text>\\n\\n  <!-- ===== Bus lines ===== -->\\n  <!-- Address bus CPU <-> Memory (red) -->\\n  <path d=\\\"M450,320 L450,398\\\" fill=\\\"none\\\" stroke=\\\"#cf222e\\\" stroke-width=\\\"3\\\"/>\\n  <text x=\\\"420\\\" y=\\\"362\\\" text-anchor=\\\"end\\\" font-size=\\\"11\\\" fill=\\\"#cf222e\\\" transform=\\\"rotate(-90 420 362)\\\">地址总线</text>\\n\\n  <!-- Data/control bus label along the bottom -->\\n  <line x1=\\\"300\\\" y1=\\\"355\\\" x2=\\\"600\\\" y2=\\\"355\\\" stroke=\\\"#555\\\" stroke-width=\\\"1\\\" stroke-dasharray=\\\"2,3\\\" opacity=\\\"0.0\\\"/>\\n  <text x=\\\"450\\\" y=\\\"353\\\" text-anchor=\\\"middle\\\" font-size=\\\"12\\\" font-weight=\\\"bold\\\" fill=\\\"#555\\\">← 数据总线 / 控制总线 →</text>\\n\\n  <!-- CPU <-> Input (bidirectional-ish: input data in + control out) -->\\n  <path d=\\\"M212,210 L298,210\\\" fill=\\\"none\\\" stroke=\\\"#1a7f37\\\" stroke-width=\\\"3\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <path d=\\\"M212,196 L298,196\\\" fill=\\\"none\\\" stroke=\\\"#555\\\" stroke-width=\\\"2\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <text x=\\\"255\\\" y=\\\"184\\\" text-anchor=\\\"middle\\\" font-size=\\\"10.5\\\" fill=\\\"#1a7f37\\\">数据(输入)</text>\\n  <text x=\\\"255\\\" y=\\\"236\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#555\\\">控制</text>\\n\\n  <!-- CPU <-> Output -->\\n  <path d=\\\"M602,210 L688,210\\\" fill=\\\"none\\\" stroke=\\\"#bf3989\\\" stroke-width=\\\"3\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <path d=\\\"M602,196 L688,196\\\" fill=\\\"none\\\" stroke=\\\"#555\\\" stroke-width=\\\"2\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <text x=\\\"645\\\" y=\\\"184\\\" text-anchor=\\\"middle\\\" font-size=\\\"10.5\\\" fill=\\\"#bf3989\\\">数据(输出)</text>\\n  <text x=\\\"645\\\" y=\\\"236\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#555\\\">控制</text>\\n\\n  <!-- Memory <-> Input/Output hints: 存储器与 I/O 也通过总线交换 -->\\n  <path d=\\\"M125,272 L125,300 Q125,340 175,340 L298,340\\\" fill=\\\"none\\\" stroke=\\\"#8c959f\\\" stroke-width=\\\"1.8\\\" stroke-dasharray=\\\"6,4\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <text x=\\\"160\\\" y=\\\"328\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#666\\\" transform=\\\"rotate(-8 160 328)\\\">总线</text>\\n\\n  <path d=\\\"M775,272 L775,300 Q775,340 725,340 L602,340\\\" fill=\\\"none\\\" stroke=\\\"#8c959f\\\" stroke-width=\\\"1.8\\\" stroke-dasharray=\\\"6,4\\\" marker-end=\\\"url(#arrow)\\\"/>\\n  <text x=\\\"740\\\" y=\\\"328\\\" text-anchor=\\\"middle\\\" font-size=\\\"10\\\" fill=\\\"#666\\\" transform=\\\"rotate(8 740 328)\\\">总线</text>\\n\\n  <!-- Stored-program note -->\\n  <text x=\\\"450\\\" y=\\\"530\\\" text-anchor=\\\"middle\\\" font-size=\\\"11.5\\\" fill=\\\"#666\\\">核心思想: 指令与数据以二进制形式统一存放在存储器中 —— “存储程序”</text>\\n</svg>\\n\"}"}}
+{"type":"tool/result","data":{"turn":1,"step":1,"message":{"role":"tool","source":{"kind":"tool","callId":"call_00_yxav8LdZ9iwWpgkUnspF6361"},"toolCallId":"call_00_yxav8LdZ9iwWpgkUnspF6361","content":[{"type":"text","text":"<path>{{cwd}}/von-neumann.svg</path>\n<type>file</type>\n<content>\nCreated file\n</content>"}],"isError":false,"id":"{{message:5}}"},"meta":{"operation":"create","diffs":[]}},"sourceEventSeqs":[14],"surfaceOp":"append"}
+{"type":"step/end","data":{"turn":1,"step":1}}
+{"type":"step/start","data":{"turn":1,"step":2}}
+{"type":"assistant/message","data":{"turn":1,"step":2,"message":{"role":"assistant","content":[{"type":"reasoning","text":"The file is created. Let me present it as a deliverable."},{"type":"tool-call","id":"call_00_otuUentgajQb2RkFVoKT3699","name":"present","arguments":"{\"files\": [{\"path\": \"von-neumann.svg\", \"description\": \"冯诺依曼架构示意图 SVG\"}]}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{message:6}}"},"usage":{"inputTokens":85,"outputTokens":80,"totalTokens":10661,"cacheReadTokens":10496,"reasoningTokens":14},"stream":[{"type":"chunk","time":1789457782632,"chunk":{"type":"block-start","index":0,"blockType":"reasoning"}},{"type":"reasoning-chunks","time0":1789457782632,"index":0,"dt":[0,0,0,0,0,0,0,0,0,0,0,0,0],"texts":["The"," file"," is"," created","."," Let"," me"," present"," it"," as"," a"," deliver","able","."]},{"type":"chunk","time":1789457782632,"chunk":{"type":"block-start","index":1,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":1789457782632,"index":1,"dt":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"id":"call_00_otuUentgajQb2RkFVoKT3699","name":"present","args":["","{","\"","files","\"",": ","[","{\"","path","\":"," \"","von","-","neum","ann",".svg","\","," \"","description","\":"," \"","冯","诺","依","曼","架构","示意图"," SVG","\"","}]","}"]},{"type":"chunk","time":1789457782632,"chunk":{"type":"block-end","index":0,"block":{"type":"reasoning","text":"The file is created. Let me present it as a deliverable."}}},{"type":"chunk","time":1789457782632,"chunk":{"type":"block-end","index":1,"block":{"type":"tool-call","id":"call_00_otuUentgajQb2RkFVoKT3699","name":"present","arguments":"{\"files\": [{\"path\": \"von-neumann.svg\", \"description\": \"冯诺依曼架构示意图 SVG\"}]}"}}},{"type":"chunk","time":1789457782632,"chunk":{"type":"usage","usage":{"inputTokens":85,"outputTokens":80,"totalTokens":10661,"cacheReadTokens":10496,"reasoningTokens":14}}},{"type":"chunk","time":1789457782632,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":2,"callId":"call_00_otuUentgajQb2RkFVoKT3699","name":"present","arguments":"{\"files\": [{\"path\": \"von-neumann.svg\", \"description\": \"冯诺依曼架构示意图 SVG\"}]}"}}
+{"type":"deliverables/presented","data":{"turn":1,"callId":"call_00_otuUentgajQb2RkFVoKT3699","files":[{"path":"von-neumann.svg","description":"冯诺依曼架构示意图 SVG"}]}}
+{"type":"tool/result","data":{"turn":1,"step":2,"message":{"role":"tool","source":{"kind":"tool","callId":"call_00_otuUentgajQb2RkFVoKT3699"},"toolCallId":"call_00_otuUentgajQb2RkFVoKT3699","content":[{"type":"text","text":"Presented von-neumann.svg"}],"isError":false,"id":"{{message:7}}"}},"sourceEventSeqs":[19],"surfaceOp":"append"}
+{"type":"step/end","data":{"turn":1,"step":2}}
+{"type":"step/start","data":{"turn":1,"step":3}}
+{"type":"assistant/message","data":{"turn":1,"step":3,"message":{"role":"assistant","content":[{"type":"text","text":"已创建 `von-neumann.svg`，一个简洁的冯诺依曼架构示意图，包含：\n\n- **CPU（中央处理器）**：内含控制单元 CU、算术逻辑单元 ALU 和寄存器组\n- **内存储器 Memory**：标注\"指令和数据统一存放\"（存储程序思想）\n- **输入设备 / 输出设备**：分别用绿色和粉色表示数据流向\n- **总线连接**：CPU 与内存间的地址总线，以及 CPU 与 I/O 设备间的数据/控制线，箭头标明数据流向\n\n下方附一行核心思想说明：指令与数据以二进制统一存储在存储器中。用浏览器打开该 SVG 文件即可查看。"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{message:8}}"},"usage":{"inputTokens":56,"outputTokens":145,"totalTokens":10825,"cacheReadTokens":10624,"reasoningTokens":0},"stream":[{"type":"chunk","time":1789457782649,"chunk":{"type":"block-start","index":0,"blockType":"text"}},{"type":"text-chunks","time0":1789457782649,"index":0,"dt":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"texts":["已","创建"," `","von","-","neum","ann",".svg","`","，","一个","简洁","的","冯","诺","依","曼","架构","示意图","，","包含","：\n\n","-"," **","CPU","（","中央","处理器","）","**","：","内含","控制","单元"," CU","、","算术","逻辑","单元"," AL","U"," ","和","寄存器","组","\n","-"," **","内","存储器"," Memory","**","：","标注","\"","指令","和数据","统一","存放","\"","（","存储","程序","思想","）\n","-"," **","输入","设备"," /"," ","输出","设备","**","：","分别","用","绿色","和","粉色","表示","数据","流向","\n","-"," **","总线","连接","**","：","CPU"," ","与","内存","间的","地址","总线","，","以及"," CPU"," ","与"," I","/O"," ","设备","间的","数据","/","控制","线","，","箭头","标明","数据","流向","\n\n","下方","附","一行","核心","思想","说明","：","指令","与","数据","以","二进制","统一","存储在","存储器","中","。","用","浏览器","打开","该"," SVG"," ","文件","即可","查看","。"]},{"type":"chunk","time":1789457782650,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"已创建 `von-neumann.svg`，一个简洁的冯诺依曼架构示意图，包含：\n\n- **CPU（中央处理器）**：内含控制单元 CU、算术逻辑单元 ALU 和寄存器组\n- **内存储器 Memory**：标注\"指令和数据统一存放\"（存储程序思想）\n- **输入设备 / 输出设备**：分别用绿色和粉色表示数据流向\n- **总线连接**：CPU 与内存间的地址总线，以及 CPU 与 I/O 设备间的数据/控制线，箭头标明数据流向\n\n下方附一行核心思想说明：指令与数据以二进制统一存储在存储器中。用浏览器打开该 SVG 文件即可查看。"}}},{"type":"chunk","time":1789457782650,"chunk":{"type":"usage","usage":{"inputTokens":56,"outputTokens":145,"totalTokens":10825,"cacheReadTokens":10624,"reasoningTokens":0}}},{"type":"chunk","time":1789457782650,"chunk":{"type":"finish","reason":{"kind":"stop"}}}]},"surfaceOp":"append"}
+{"type":"step/end","data":{"turn":1,"step":3}}
+{"type":"workspace/changes","data":{"turn":1}}
+{"type":"turn/end","data":{"turn":1,"reason":{"kind":"completed"}}}
diff --git a/snapshots/web/present-svg/ui.expected.md b/snapshots/web/present-svg/ui.expected.md
index 5238b2a252..9920928bed 100644
--- a/snapshots/web/present-svg/ui.expected.md
+++ b/snapshots/web/present-svg/ui.expected.md
@@ -36,8 +36,6 @@
 - text: 此主机没有可用的桌面，无法使用外部程序打开文件或文件夹；文件仍可在侧边栏预览
 - button "在侧边栏预览 von-neumann.svg"
 - text: von-neumann.svg 冯诺依曼架构示意图 SVG
-- button "在侧边栏打开 von-neumann.svg": 打开
-- button "von-neumann.svg 的更多文件操作" [disabled]
 - button "复制"
 - button "好的回答"
 - button "有问题的回答"
diff --git a/snapshots/web/present/session.v4.jsonl b/snapshots/web/present/session.v4.jsonl
new file mode 100644
index 0000000000..442cd7b022
--- /dev/null
+++ b/snapshots/web/present/session.v4.jsonl
@@ -0,0 +1,29 @@
+{"type":"session","version":4,"id":"{{session:1}}","createdAt":1788883598275,"cwd":"{{cwd}}","isSeeded":false,"delegationDepth":0,"agentPreset":"ptc"}
+{"type":"permission/preset","data":{"preset":"workspace-write"}}
+{"type":"sandbox/mode","data":{"mode":"workspace-write"}}
+{"type":"approval/policy","data":{"policy":"ask"}}
+{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"inserted":[{"content":[{"type":"text","text":"Use one run_code program to do the following in order. Call present for missing.txt and catch its error without creating that file. Use bash to run exactly `printf \"DELIVERED_REPORT\\n\" > report.txt; printf \"DELIVERED_NOTE\\n\" > 说明.txt`. Call present for report.txt and 说明.txt. After present succeeds, deliberately throw the string \"AFTER_PRESENT\" (not an Error object) from that same run_code program. Do not retry the program or create any other files. Finish by mentioning `report.txt` and `说明.txt` in inline code, and put PRESENT_DONE in a separate paragraph."}],"source":{"kind":"user","rpcId":"{{rpc:1}}","clientTimeZone":"{{clientTimeZone}}"},"role":"user","id":"{{message:1}}"}]}}
+{"type":"turn/start","data":{"turn":1}}
+{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"removedCount":1,"inserted":[]}}
+{"type":"step/start","data":{"turn":1,"step":1}}
+{"type":"system/message","data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{message:2}}"}},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Use one run_code program to do the following in order. Call present for missing.txt and catch its error without creating that file. Use bash to run exactly `printf \"DELIVERED_REPORT\\n\" > report.txt; printf \"DELIVERED_NOTE\\n\" > 说明.txt`. Call present for report.txt and 说明.txt. After present succeeds, deliberately throw the string \"AFTER_PRESENT\" (not an Error object) from that same run_code program. Do not retry the program or create any other files. Finish by mentioning `report.txt` and `说明.txt` in inline code, and put PRESENT_DONE in a separate paragraph."}],"source":{"kind":"user","rpcId":"{{rpc:1}}","clientTimeZone":"{{clientTimeZone}}"},"role":"user","id":"{{message:1}}"},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable.\n\nApproval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"sandbox:policy","text":"Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: \"{{cwd}}\". Some platform temporary areas may also be writable."},{"name":"approval:policy","text":"Approval policy: ask. Operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed."}]},"role":"user","id":"{{message:3}}"},"surfaceOp":"append"}
+{"type":"request/header","data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"tools":"{{tools}}"},"reason":"initial"}}
+{"type":"request/context","data":{"provider":"deepseek-official","model":"deepseek-v4-flash","contextWindow":128000}}
+{"type":"session/title","data":{"title":"Use one run_code program to","messageSeqs":[8],"source":{"kind":"fallback"}}}
+{"type":"assistant/message","data":{"turn":1,"step":1,"message":{"role":"assistant","content":[{"type":"reasoning","text":"The user wants one run_code program that:\n1. Calls present for missing.txt and catches its error without creating that file.\n2. Uses bash to run exactly `printf \"DELIVERED_REPORT\\n\" > report.txt; printf \"DELIVERED_NOTE\\n\" > 说明.txt`.\n3. Calls present for report.txt and 说明.txt.\n4. After present succeeds, deliberately throws the string \"AFTER_PRESENT\" (not an Error object) from that same run_code program.\n5. Does not retry the program or create other files.\n6. Finishes by mentioning report.txt and 说明.txt in inline code, and put PRESENT_DONE in a separate paragraph.\n\nLet me write the program.\n\npresent tool args: { files: [{ path, description? }] }.\n\nSo first: try present for missing.txt — catch error. It should error because the file doesn't exist (present requires existing workspace file).\n\nThen bash run exact command. Note the command uses `;` inside a single string. Run as a single command string: `printf \"DELIVERED_REPORT\\n\" > report.txt; printf \"DELIVERED_NOTE\\n\" > 说明.txt`.\n\nWait — printf interprets the arguments... In bash, `printf \"DELIVERED_REPORT\\n\"` with the format string containing \\n — printf will interpret \\n as newline. Good.\n\nThen present for report.txt and 说明.txt.\n\nThen throw \"AFTER_PRESENT\" string. In TS async function body, `throw \"AFTER_PRESENT\"` works.\n\nLet me write it."},{"type":"tool-call","id":"call_00_GgvYPol45qxGf6GezK3L3590","name":"run_code","arguments":"{\"code\": \"// Step 1: present for missing.txt — must fail, catch the error, don't create the file\\ntry {\\n  await tools.present({ files: [{ path: \\\"missing.txt\\\", description: \\\"must not exist\\\" }] });\\n  console.log(\\\"UNEXPECTED: present succeeded for missing.txt\\\");\\n} catch (err) {\\n  console.log(\\\"Caught present error for missing.txt:\\\", typeof err, String(err).slice(0, 200));\\n}\\n\\n// Step 2: run the exact bash command to create the two report files\\nconst res = await tools.bash({\\n  command: 'printf \\\"DELIVERED_REPORT\\\\n\\\" > report.txt; printf \\\"DELIVERED_NOTE\\\\n\\\" > 说明.txt',\\n  description: \\\"Write DELIVERED_REPORT and DELIVERED_NOTE to files\\\",\\n});\\nconsole.log(\\\"bash exit:\\\", res.exitCode);\\n\\n// Step 3: present for report.txt and 说明.txt (must succeed)\\nconst p2 = await tools.present({\\n  files: [\\n    { path: \\\"report.txt\\\", description: \\\"delivered report\\\" },\\n    { path: \\\"说明.txt\\\", description: \\\"delivered note\\\" },\\n  ],\\n});\\nconsole.log(\\\"present ok, files:\\\", p2.files.map((f) => f.path).join(\\\", \\\"));\\n\\n// Step 4: deliberately throw a plain string AFTER_PRESENT (not an Error)\\nthrow \\\"AFTER_PRESENT\\\";\", \"description\": \"Present files then deliberately throw AFTER_PRESENT\"}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{message:4}}"},"usage":{"inputTokens":981,"outputTokens":695,"totalTokens":9356,"cacheReadTokens":7680,"reasoningTokens":329},"stream":[{"type":"chunk","time":1788883599120,"chunk":{"type":"block-start","index":0,"blockType":"reasoning"}},{"type":"reasoning-chunks","time0":1788883599120,"index":0,"dt":[0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"texts":["The"," user"," wants"," one"," run","_code"," program"," that",":\n","1","."," Calls"," present"," for"," missing",".txt"," and"," catches"," its"," error"," without"," creating"," that"," file",".\n","2","."," Uses"," bash"," to"," run"," exactly"," `","printf"," \"","DEL","IVER","ED","_RE","PORT","\\n","\""," >"," report",".txt",";"," printf"," \"","DEL","IVER","ED","_N","OTE","\\n","\""," >"," ","说明",".txt","`.\n","3","."," Calls"," present"," for"," report",".txt"," and"," ","说明",".txt",".\n","4","."," After"," present"," succeeds",","," deliberately"," throws"," the"," string"," \"","AF","TER","_P","RES","ENT","\""," (","not"," an"," Error"," object",")"," from"," that"," same"," run","_code"," program",".\n","5","."," Does"," not"," ret","ry"," the"," program"," or"," create"," other"," files",".\n","6","."," Fin","ishes"," by"," mentioning"," report",".txt"," and"," ","说明",".txt"," in"," inline"," code",","," and"," put"," PRES","ENT","_D","ONE"," in"," a"," separate"," paragraph",".\n\n","Let"," me"," write"," the"," program",".\n\n","present"," tool"," args",":"," {"," files",":"," [{"," path",","," description","?"," }","]"," }",".\n\n","So"," first",":"," try"," present"," for"," missing",".txt"," —"," catch"," error","."," It"," should"," error"," because"," the"," file"," doesn","'t"," exist"," (","present"," requires"," existing"," workspace"," file",").\n\n","Then"," bash"," run"," exact"," command","."," Note"," the"," command"," uses"," `",";","`"," inside"," a"," single"," string","."," Run"," as"," a"," single"," command"," string",":"," `","printf"," \"","DEL","IVER","ED","_RE","PORT","\\n","\""," >"," report",".txt",";"," printf"," \"","DEL","IVER","ED","_N","OTE","\\n","\""," >"," ","说明",".txt","`.\n\n","Wait"," —"," printf"," interprets"," the"," arguments","..."," In"," bash",","," `","printf"," \"","DEL","IVER","ED","_RE","PORT","\\n","\"","`"," with"," the"," format"," string"," containing"," \\","n"," —"," printf"," will"," interpret"," \\","n"," as"," new","line","."," Good",".\n\n","Then"," present"," for"," report",".txt"," and"," ","说明",".txt",".\n\n","Then"," throw"," \"","AF","TER","_P","RES","ENT","\""," string","."," In"," TS"," async"," function"," body",","," `","throw"," \"","AF","TER","_P","RES","ENT","\"","`"," works",".\n\n","Let"," me"," write"," it","."]},{"type":"chunk","time":1788883599123,"chunk":{"type":"block-start","index":1,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":1788883599123,"index":1,"dt":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"id":"call_00_GgvYPol45qxGf6GezK3L3590","name":"run_code","args":["","{","\"","code","\"",": ","\"","//"," Step"," ","1",":"," present"," for"," missing",".txt"," —"," must"," fail",","," catch"," the"," error",","," don","'t"," create"," the"," file","\\n","try"," {\\n"," "," await"," tools",".p","resent","({"," files",":"," [{"," path",":"," \\\"","missing",".txt","\\\","," description",":"," \\\"","must"," not"," exist","\\\""," }","]"," });\\n"," "," console",".log","(\\\"","UN","EXP","ECT","ED",":"," present"," succeeded"," for"," missing",".txt","\\\");\\n","}"," catch"," (","err",")"," {\\n"," "," console",".log","(\\\"","Ca","ught"," present"," error"," for"," missing",".txt",":\\\","," typeof"," err",","," String","(err",").","slice","(","0",","," ","200","));\\n","}\\n\\n","//"," Step"," ","2",":"," run"," the"," exact"," bash"," command"," to"," create"," the"," two"," report"," files","\\n","const"," res"," ="," await"," tools",".b","ash","({\\n"," "," command",":"," '","printf"," \\\"","DEL","IVER","ED","_RE","PORT","\\\\n","\\\""," >"," report",".txt",";"," printf"," \\\"","DEL","IVER","ED","_N","OTE","\\\\n","\\\""," >"," ","说明",".txt","',\\n"," "," description",":"," \\\"","Write"," DEL","IVER","ED","_RE","PORT"," and"," DEL","IVER","ED","_N","OTE"," to"," files","\\\",\\n","});\\n","console",".log","(\\\"","bash"," exit",":\\\","," res",".exit","Code",");\\n\\n","//"," Step"," ","3",":"," present"," for"," report",".txt"," and"," ","说明",".txt"," (","must"," succeed",")\\n","const"," p","2"," ="," await"," tools",".p","resent","({\\n"," "," files",":"," [\\n","   "," {"," path",":"," \\\"","report",".txt","\\\","," description",":"," \\\"","del","ivered"," report","\\\""," },\\n","   "," {"," path",":"," \\\"","说明",".txt","\\\","," description",":"," \\\"","del","ivered"," note","\\\""," },\\n"," "," ],\\n","});\\n","console",".log","(\\\"","present"," ok",","," files",":\\\","," p","2",".f","iles",".map","((","f",")"," =>"," f",".path",").","join","(\\\","," \\\"","));\\n\\n","//"," Step"," ","4",":"," deliberately"," throw"," a"," plain"," string"," AFTER","_P","RES","ENT"," (","not"," an"," Error",")\\n","throw"," \\\"","AF","TER","_P","RES","ENT","\\\";","\"",", ","\"","description","\"",": ","\"","Present"," files"," then"," deliberately"," throw"," AFTER","_P","RES","ENT","\"","}"]},{"type":"chunk","time":1788883599125,"chunk":{"type":"block-end","index":0,"block":{"type":"reasoning","text":"The user wants one run_code program that:\n1. Calls present for missing.txt and catches its error without creating that file.\n2. Uses bash to run exactly `printf \"DELIVERED_REPORT\\n\" > report.txt; printf \"DELIVERED_NOTE\\n\" > 说明.txt`.\n3. Calls present for report.txt and 说明.txt.\n4. After present succeeds, deliberately throws the string \"AFTER_PRESENT\" (not an Error object) from that same run_code program.\n5. Does not retry the program or create other files.\n6. Finishes by mentioning report.txt and 说明.txt in inline code, and put PRESENT_DONE in a separate paragraph.\n\nLet me write the program.\n\npresent tool args: { files: [{ path, description? }] }.\n\nSo first: try present for missing.txt — catch error. It should error because the file doesn't exist (present requires existing workspace file).\n\nThen bash run exact command. Note the command uses `;` inside a single string. Run as a single command string: `printf \"DELIVERED_REPORT\\n\" > report.txt; printf \"DELIVERED_NOTE\\n\" > 说明.txt`.\n\nWait — printf interprets the arguments... In bash, `printf \"DELIVERED_REPORT\\n\"` with the format string containing \\n — printf will interpret \\n as newline. Good.\n\nThen present for report.txt and 说明.txt.\n\nThen throw \"AFTER_PRESENT\" string. In TS async function body, `throw \"AFTER_PRESENT\"` works.\n\nLet me write it."}}},{"type":"chunk","time":1788883599125,"chunk":{"type":"block-end","index":1,"block":{"type":"tool-call","id":"call_00_GgvYPol45qxGf6GezK3L3590","name":"run_code","arguments":"{\"code\": \"// Step 1: present for missing.txt — must fail, catch the error, don't create the file\\ntry {\\n  await tools.present({ files: [{ path: \\\"missing.txt\\\", description: \\\"must not exist\\\" }] });\\n  console.log(\\\"UNEXPECTED: present succeeded for missing.txt\\\");\\n} catch (err) {\\n  console.log(\\\"Caught present error for missing.txt:\\\", typeof err, String(err).slice(0, 200));\\n}\\n\\n// Step 2: run the exact bash command to create the two report files\\nconst res = await tools.bash({\\n  command: 'printf \\\"DELIVERED_REPORT\\\\n\\\" > report.txt; printf \\\"DELIVERED_NOTE\\\\n\\\" > 说明.txt',\\n  description: \\\"Write DELIVERED_REPORT and DELIVERED_NOTE to files\\\",\\n});\\nconsole.log(\\\"bash exit:\\\", res.exitCode);\\n\\n// Step 3: present for report.txt and 说明.txt (must succeed)\\nconst p2 = await tools.present({\\n  files: [\\n    { path: \\\"report.txt\\\", description: \\\"delivered report\\\" },\\n    { path: \\\"说明.txt\\\", description: \\\"delivered note\\\" },\\n  ],\\n});\\nconsole.log(\\\"present ok, files:\\\", p2.files.map((f) => f.path).join(\\\", \\\"));\\n\\n// Step 4: deliberately throw a plain string AFTER_PRESENT (not an Error)\\nthrow \\\"AFTER_PRESENT\\\";\", \"description\": \"Present files then deliberately throw AFTER_PRESENT\"}"}}},{"type":"chunk","time":1788883599125,"chunk":{"type":"usage","usage":{"inputTokens":981,"outputTokens":695,"totalTokens":9356,"cacheReadTokens":7680,"reasoningTokens":329}}},{"type":"chunk","time":1788883599125,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":1,"callId":"call_00_GgvYPol45qxGf6GezK3L3590","name":"run_code","arguments":"{\"code\": \"// Step 1: present for missing.txt — must fail, catch the error, don't create the file\\ntry {\\n  await tools.present({ files: [{ path: \\\"missing.txt\\\", description: \\\"must not exist\\\" }] });\\n  console.log(\\\"UNEXPECTED: present succeeded for missing.txt\\\");\\n} catch (err) {\\n  console.log(\\\"Caught present error for missing.txt:\\\", typeof err, String(err).slice(0, 200));\\n}\\n\\n// Step 2: run the exact bash command to create the two report files\\nconst res = await tools.bash({\\n  command: 'printf \\\"DELIVERED_REPORT\\\\n\\\" > report.txt; printf \\\"DELIVERED_NOTE\\\\n\\\" > 说明.txt',\\n  description: \\\"Write DELIVERED_REPORT and DELIVERED_NOTE to files\\\",\\n});\\nconsole.log(\\\"bash exit:\\\", res.exitCode);\\n\\n// Step 3: present for report.txt and 说明.txt (must succeed)\\nconst p2 = await tools.present({\\n  files: [\\n    { path: \\\"report.txt\\\", description: \\\"delivered report\\\" },\\n    { path: \\\"说明.txt\\\", description: \\\"delivered note\\\" },\\n  ],\\n});\\nconsole.log(\\\"present ok, files:\\\", p2.files.map((f) => f.path).join(\\\", \\\"));\\n\\n// Step 4: deliberately throw a plain string AFTER_PRESENT (not an Error)\\nthrow \\\"AFTER_PRESENT\\\";\", \"description\": \"Present files then deliberately throw AFTER_PRESENT\"}"}}
+{"type":"tool/ptc-dispatch-start","data":{"rootCallId":"call_00_GgvYPol45qxGf6GezK3L3590","parentCallId":"call_00_GgvYPol45qxGf6GezK3L3590","subCallId":"call_00_GgvYPol45qxGf6GezK3L3590:ptc:1","name":"present","arguments":{"files":[{"path":"missing.txt","description":"must not exist"}]}}}
+{"type":"tool/ptc-dispatch","data":{"rootCallId":"call_00_GgvYPol45qxGf6GezK3L3590","parentCallId":"call_00_GgvYPol45qxGf6GezK3L3590","subCallId":"call_00_GgvYPol45qxGf6GezK3L3590:ptc:1","name":"present","arguments":{"files":[{"path":"missing.txt","description":"must not exist"}]},"isError":true,"error":{"name":"FsError","code":"FS_NOT_FOUND"},"content":[{"type":"text","text":"Error: Cannot present missing.txt: file not found. Check the path, create the file if needed, and retry."}]}}
+{"type":"tool/ptc-dispatch-start","data":{"rootCallId":"call_00_GgvYPol45qxGf6GezK3L3590","parentCallId":"call_00_GgvYPol45qxGf6GezK3L3590","subCallId":"call_00_GgvYPol45qxGf6GezK3L3590:ptc:2","name":"bash","arguments":{"command":"printf \"DELIVERED_REPORT\n\" > report.txt; printf \"DELIVERED_NOTE\n\" > 说明.txt","description":"Write DELIVERED_REPORT and DELIVERED_NOTE to files"}}}
+{"type":"tool/ptc-dispatch","data":{"rootCallId":"call_00_GgvYPol45qxGf6GezK3L3590","parentCallId":"call_00_GgvYPol45qxGf6GezK3L3590","subCallId":"call_00_GgvYPol45qxGf6GezK3L3590:ptc:2","name":"bash","arguments":{"command":"printf \"DELIVERED_REPORT\n\" > report.txt; printf \"DELIVERED_NOTE\n\" > 说明.txt","description":"Write DELIVERED_REPORT and DELIVERED_NOTE to files"},"isError":false,"content":[{"type":"text","text":"(no output)"}]}}
+{"type":"tool/ptc-dispatch-start","data":{"rootCallId":"call_00_GgvYPol45qxGf6GezK3L3590","parentCallId":"call_00_GgvYPol45qxGf6GezK3L3590","subCallId":"call_00_GgvYPol45qxGf6GezK3L3590:ptc:3","name":"present","arguments":{"files":[{"path":"report.txt","description":"delivered report"},{"path":"说明.txt","description":"delivered note"}]}}}
+{"type":"deliverables/presented","data":{"turn":1,"callId":"call_00_GgvYPol45qxGf6GezK3L3590:ptc:3","files":[{"path":"report.txt","description":"delivered report"},{"path":"说明.txt","description":"delivered note"}]}}
+{"type":"tool/ptc-dispatch","data":{"rootCallId":"call_00_GgvYPol45qxGf6GezK3L3590","parentCallId":"call_00_GgvYPol45qxGf6GezK3L3590","subCallId":"call_00_GgvYPol45qxGf6GezK3L3590:ptc:3","name":"present","arguments":{"files":[{"path":"report.txt","description":"delivered report"},{"path":"说明.txt","description":"delivered note"}]},"isError":false,"content":[{"type":"text","text":"Presented report.txt\nPresented 说明.txt"}]}}
+{"type":"tool/result","data":{"turn":1,"step":1,"message":{"role":"tool","source":{"kind":"tool","callId":"call_00_GgvYPol45qxGf6GezK3L3590"},"toolCallId":"call_00_GgvYPol45qxGf6GezK3L3590","content":[{"type":"text","text":"Error: code run failed (exception): AFTER_PRESENT\nCaptured output:\nCaught present error for missing.txt: object ToolCallError: Cannot present missing.txt: file not found. Check the path, create the file if needed, and retry.\nbash exit: 0\npresent ok, files: report.txt, 说明.txt\nFile sandbox: workspace-write; enforcement: full."}],"isError":true,"id":"{{message:5}}"},"error":{"name":"CodeRunFailedError","code":"CODE_RUN_FAILED"}},"sourceEventSeqs":[14],"surfaceOp":"append"}
+{"type":"step/end","data":{"turn":1,"step":1}}
+{"type":"step/start","data":{"turn":1,"step":2}}
+{"type":"assistant/message","data":{"turn":1,"step":2,"message":{"role":"assistant","content":[{"type":"reasoning","text":"The program ran as intended:\n1. present for missing.txt failed with a ToolCallError, caught and logged — missing.txt was not created.\n2. bash ran exactly the given command, exit 0.\n3. present succeeded for report.txt and 说明.txt.\n4. Then threw the plain string \"AFTER_PRESENT\" (program failed with that exception, as expected — not an Error object).\n\nI did not retry the program or create other files. Now finish mentioning `report.txt` and `说明.txt` in inline code, with PRESENT_DONE in a separate paragraph."},{"type":"text","text":"The single program ran exactly as ordered: `present` for `missing.txt` failed and was caught (no file created), bash ran the exact command successfully, then `present` succeeded for `report.txt` and `说明.txt`, after which the program deliberately threw the string `AFTER_PRESENT` — no retries, no extra files.\n\nPRESENT_DONE"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{message:6}}"},"usage":{"inputTokens":94,"outputTokens":198,"totalTokens":9636,"cacheReadTokens":9344,"reasoningTokens":121},"stream":[{"type":"chunk","time":1788883599242,"chunk":{"type":"block-start","index":0,"blockType":"reasoning"}},{"type":"reasoning-chunks","time0":1788883599242,"index":0,"dt":[1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0],"texts":["The"," program"," ran"," as"," intended",":\n","1","."," present"," for"," missing",".txt"," failed"," with"," a"," Tool","Call","Error",","," caught"," and"," logged"," —"," missing",".txt"," was"," not"," created",".\n","2","."," bash"," ran"," exactly"," the"," given"," command",","," exit"," ","0",".\n","3","."," present"," succeeded"," for"," report",".txt"," and"," ","说明",".txt",".\n","4","."," Then"," threw"," the"," plain"," string"," \"","AF","TER","_P","RES","ENT","\""," (","program"," failed"," with"," that"," exception",","," as"," expected"," —"," not"," an"," Error"," object",").\n\n","I"," did"," not"," ret","ry"," the"," program"," or"," create"," other"," files","."," Now"," finish"," mentioning"," `","report",".txt","`"," and"," `","说明",".txt","`"," in"," inline"," code",","," with"," PRES","ENT","_D","ONE"," in"," a"," separate"," paragraph","."]},{"type":"chunk","time":1788883599244,"chunk":{"type":"block-start","index":1,"blockType":"text"}},{"type":"text-chunks","time0":1788883599244,"index":1,"dt":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"texts":["The"," single"," program"," ran"," exactly"," as"," ordered",":"," `","present","`"," for"," `","missing",".txt","`"," failed"," and"," was"," caught"," (","no"," file"," created","),"," bash"," ran"," the"," exact"," command"," successfully",","," then"," `","present","`"," succeeded"," for"," `","report",".txt","`"," and"," `","说明",".txt","`,"," after"," which"," the"," program"," deliberately"," threw"," the"," string"," `","AF","TER","_P","RES","ENT","`"," —"," no"," ret","ries",","," no"," extra"," files",".\n\n","PR","ES","ENT","_D","ONE"]},{"type":"chunk","time":1788883599244,"chunk":{"type":"block-end","index":0,"block":{"type":"reasoning","text":"The program ran as intended:\n1. present for missing.txt failed with a ToolCallError, caught and logged — missing.txt was not created.\n2. bash ran exactly the given command, exit 0.\n3. present succeeded for report.txt and 说明.txt.\n4. Then threw the plain string \"AFTER_PRESENT\" (program failed with that exception, as expected — not an Error object).\n\nI did not retry the program or create other files. Now finish mentioning `report.txt` and `说明.txt` in inline code, with PRESENT_DONE in a separate paragraph."}}},{"type":"chunk","time":1788883599244,"chunk":{"type":"block-end","index":1,"block":{"type":"text","text":"The single program ran exactly as ordered: `present` for `missing.txt` failed and was caught (no file created), bash ran the exact command successfully, then `present` succeeded for `report.txt` and `说明.txt`, after which the program deliberately threw the string `AFTER_PRESENT` — no retries, no extra files.\n\nPRESENT_DONE"}}},{"type":"chunk","time":1788883599244,"chunk":{"type":"usage","usage":{"inputTokens":94,"outputTokens":198,"totalTokens":9636,"cacheReadTokens":9344,"reasoningTokens":121}}},{"type":"chunk","time":1788883599244,"chunk":{"type":"finish","reason":{"kind":"stop"}}}]},"surfaceOp":"append"}
+{"type":"step/end","data":{"turn":1,"step":2}}
+{"type":"turn/end","data":{"turn":1,"reason":{"kind":"completed"}}}
diff --git a/snapshots/web/present/ui.expected.md b/snapshots/web/present/ui.expected.md
index 02fb01a3f8..2892aa7897 100644
--- a/snapshots/web/present/ui.expected.md
+++ b/snapshots/web/present/ui.expected.md
@@ -35,15 +35,13 @@
   - text: — no retries, no extra files.
 - paragraph: PRESENT_DONE
 - button "Preview report.txt in sidebar"
-- text: report.txt
-- status: Opened in default app
-- button "Open report.txt in sidebar": Open
-- button "More file actions for report.txt"
+- text: report.txt delivered report
+- button "Open in Test Editor"
+- button "More ways to open"
 - button "Preview 说明.txt in sidebar"
-- text: 说明.txt
-- status: Opened in default app
-- button "Open 说明.txt in sidebar": Open
-- button "More file actions for 说明.txt"
+- text: 说明.txt delivered note
+- button "Open in Test Editor"
+- button "More ways to open"
 - button "Copy"
 - button "Good response"
 - button "Bad response"
diff --git a/snapshots/web/ptc-round/system-prompt.expected.md b/snapshots/web/ptc-round/system-prompt.expected.md
index 8787372c8f..107c581adc 100644
--- a/snapshots/web/ptc-round/system-prompt.expected.md
+++ b/snapshots/web/ptc-round/system-prompt.expected.md
@@ -4,7 +4,7 @@ You are a coding agent powered by the deepseek-v4-flash model.
 
 `run_code` is the only tool you can call directly — a tool call naming any other tool fails. Reach every tool the SDK declares below from inside the program.
 
-Tokens prefixed with @ are workspace paths the user explicitly referenced, relative to the workspace root. A trailing slash marks a directory: list it when its contents matter. Anything else is a file: use the read tool when its contents are needed, and do not claim to have inspected it before reading. @"..." quotes a path containing spaces.
+Tokens prefixed with @ are paths the user explicitly referenced. Relative paths resolve from the workspace root; absolute paths identify files or directories on the host. A trailing slash marks a directory: list it when its contents matter. Anything else is a file: use the read tool when its contents are needed, and do not claim to have inspected it before reading. @"..." quotes a path containing spaces.
 
 Check the [exit code: N] marker on every bash result; investigate failures before moving on.
 
diff --git a/snapshots/web/schedule-catalog/system-prompt.expected.md b/snapshots/web/schedule-catalog/system-prompt.expected.md
index 0c5f3c77cc..01b43eca97 100644
--- a/snapshots/web/schedule-catalog/system-prompt.expected.md
+++ b/snapshots/web/schedule-catalog/system-prompt.expected.md
@@ -6,7 +6,7 @@ You are interacting with the user through the DeepSeek Harness Web GUI at {{webU
 
 You are a coding agent powered by the deepseek-v4-flash model. Your working directory is {{cwd}}.
 
-Tokens prefixed with @ are workspace paths the user explicitly referenced, relative to the workspace root. A trailing slash marks a directory: list it when its contents matter. Anything else is a file: use the read tool when its contents are needed, and do not claim to have inspected it before reading. @"..." quotes a path containing spaces.
+Tokens prefixed with @ are paths the user explicitly referenced. Relative paths resolve from the workspace root; absolute paths identify files or directories on the host. A trailing slash marks a directory: list it when its contents matter. Anything else is a file: use the read tool when its contents are needed, and do not claim to have inspected it before reading. @"..." quotes a path containing spaces.
 
 Check the [exit code: N] marker on every bash result; investigate failures before moving on.
 
diff --git a/snapshots/web/seeded-history/file-preview.expected.md b/snapshots/web/seeded-history/file-preview.expected.md
index 197bb3c9cf..64d5ce902f 100644
--- a/snapshots/web/seeded-history/file-preview.expected.md
+++ b/snapshots/web/seeded-history/file-preview.expected.md
@@ -1,6 +1,5 @@
 - text: {{cwd}}/a.txt
 - button "Line wrap" [pressed]
 - button "Read the file again"
-- button "Open"
-- button "More ways to open"
+- button "Show file location"
 - text: alpha
diff --git a/snapshots/web/skill-tool-row/snapshot.yml b/snapshots/web/skill-tool-row/snapshot.yml
index 4c82c05edb..8b01149257 100644
--- a/snapshots/web/skill-tool-row/snapshot.yml
+++ b/snapshots/web/skill-tool-row/snapshot.yml
@@ -6,4 +6,4 @@ recording: authored
 header:
   class: skill
 session:
-  source: ../../session/skill-load/session.v3.jsonl
+  source: ../../session/skill-load/session.v4.jsonl
diff --git a/tsconfig.base.json b/tsconfig.base.json
index 41d158f02a..60c97b6946 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -71,6 +71,9 @@
       "@deepseek-ai/dsh-api-gateway": ["./packages/api/gateway/src/index.ts"],
       "@deepseek-ai/dsh-api-gateway/client": ["./packages/api/gateway/src/client/index.ts"],
       "@deepseek-ai/dsh-api-gateway/types": ["./packages/api/gateway/src/types.ts"],
+      "@deepseek-ai/dsh-api-job-controller": ["./packages/api/job-controller/src/index.ts"],
+      "@deepseek-ai/dsh-api-job-controller/client": ["./packages/api/job-controller/src/client/index.ts"],
+      "@deepseek-ai/dsh-api-job-controller/types": ["./packages/api/job-controller/src/types.ts"],
       "@deepseek-ai/dsh-api-session-controller": ["./packages/api/session-controller/src/index.ts"],
       "@deepseek-ai/dsh-api-session-controller/client": ["./packages/api/session-controller/src/client/index.ts"],
       "@deepseek-ai/dsh-api-session-controller/types": ["./packages/api/session-controller/src/types.ts"],
@@ -128,6 +131,7 @@
       "@deepseek-ai/dsh-commands/brand": ["./packages/interaction/commands/src/brand.ts"],
       "@deepseek-ai/dsh-commands/types": ["./packages/interaction/commands/src/types.ts"],
       "@deepseek-ai/dsh-jobs/brand": ["./packages/jobs/jobs/src/brand.ts"],
+      "@deepseek-ai/dsh-jobs/view": ["./packages/jobs/jobs/src/view.ts"],
       "@deepseek-ai/dsh-credentials/types": ["./packages/credentials/credentials/src/types.ts"],
       "@deepseek-ai/dsh-authorization/types": ["./packages/credentials/authorization/src/types.ts"],
       "@deepseek-ai/dsh-settings/types": ["./packages/settings/settings/src/types.ts"],
@@ -193,6 +197,7 @@
       "@deepseek-ai/dsh-client-ui-sidebar-documentpreview/client": ["./packages/client/ui-sidebar-documentpreview/src/client"],
       "@deepseek-ai/dsh-client-ui-sidebar-browser": ["./packages/client/ui-sidebar-browser/src"],
       "@deepseek-ai/dsh-client-ui-sidebar-browser/client": ["./packages/client/ui-sidebar-browser/src/client"],
+      "@deepseek-ai/dsh-client-ui-sidebar-browser/types": ["./packages/client/ui-sidebar-browser/src/types.ts"],
       "@deepseek-ai/dsh-api-workspace-files": ["./packages/api/workspace-files/src"],
       "@deepseek-ai/dsh-api-workspace-files/types": ["./packages/api/workspace-files/src/types.ts"],
       "@deepseek-ai/dsh-api-workspace-files/client": ["./packages/api/workspace-files/src/client/index.ts"],
@@ -245,6 +250,8 @@
       "@deepseek-ai/dsh-experimental-client-ui-agent-team": ["./packages/experimental/client-ui-agent-team/src"],
       "@deepseek-ai/dsh-client-ui-settings-plugins": ["./packages/client/ui-settings-plugins/src"],
       "@deepseek-ai/dsh-client-ui-jobs": ["./packages/client/ui-jobs/src"],
+      "@deepseek-ai/dsh-client-ui-jobs/client": ["./packages/client/ui-jobs/src/client/index.ts"],
+      "@deepseek-ai/dsh-client-ui-jobs/invariant": ["./packages/client/ui-jobs/src/invariant.ts"],
       "@deepseek-ai/dsh-client-ui-schedule": ["./packages/client/ui-schedule/src"],
       "@deepseek-ai/dsh-client-ui-schedule/client": ["./packages/client/ui-schedule/src/client/index.ts"],
       "@deepseek-ai/dsh-client-ui-plan": ["./packages/client/ui-plan/src"],
@@ -254,6 +261,7 @@
       "@deepseek-ai/dsh-client-ui-theme": ["./packages/client/ui-theme/src"],
       "@deepseek-ai/dsh-client-ui-settings": ["./packages/client/ui-settings/src"],
       "@deepseek-ai/dsh-client-ui-settings-general": ["./packages/client/ui-settings-general/src"],
+      "@deepseek-ai/dsh-client-ui-settings-general/types": ["./packages/client/ui-settings-general/src/types.ts"],
       "@deepseek-ai/dsh-client-ui-settings-models": ["./packages/client/ui-settings-models/src"],
       "@deepseek-ai/dsh-client-ui-plugin-manager": ["./packages/client/ui-plugin-manager/src"],
       "@deepseek-ai/dsh-client-ui-settings-plugin-inventory": ["./packages/client/ui-settings-plugin-inventory/src"],
@@ -289,6 +297,7 @@
       "@deepseek-ai/dsh-session-log-export/client": ["./packages/session-query/session-log-export/src/client"],
       "@deepseek-ai/dsh-compaction-image-offload/projection": ["./packages/compaction/compaction-image-offload/src/projection.ts"],
       "@deepseek-ai/dsh-session-format-catalog/message-projections": ["./packages/session/session-format-catalog/src/message-projections.ts"],
+      "@deepseek-ai/dsh-native-command/types": ["./packages/util/native-command/src/types.ts"],
       // BEGIN generated package aliases — pnpm run gen-tsconfig-paths
       "@deepseek-ai/dsh-acp": ["./packages/acp/acp/src"],
       "@deepseek-ai/dsh-acp-app": ["./packages/bundle/acp-app/src"],
diff --git a/tsconfig.client.json b/tsconfig.client.json
index 08538a0e76..d6b4de5dc2 100644
--- a/tsconfig.client.json
+++ b/tsconfig.client.json
@@ -91,7 +91,7 @@
     { "path": "./packages/client/ui-dockkit" },
     { "path": "./packages/client/ui-sidebar-right" },
     { "path": "./packages/client/ui-sidebar-documentpreview/tsconfig.client.json" },
-    { "path": "./packages/client/ui-sidebar-browser" },
+    { "path": "./packages/client/ui-sidebar-browser/tsconfig.client.json" },
     { "path": "./packages/client/ui-sidebar-files" },
     { "path": "./packages/client/ui-jobs" },
     { "path": "./packages/client/ui-schedule" },
@@ -110,7 +110,7 @@
     { "path": "./packages/client/ui-open-in-app" },
     { "path": "./packages/client/ui-theme" },
     { "path": "./packages/client/ui-settings" },
-    { "path": "./packages/client/ui-settings-general" },
+    { "path": "./packages/client/ui-settings-general/tsconfig.client.json" },
     { "path": "./packages/client/ui-settings-models" },
     { "path": "./packages/client/ui-plugin-manager" },
     { "path": "./packages/client/ui-settings-plugin-inventory" },
diff --git a/tsconfig.host.json b/tsconfig.host.json
index 01cca0cb14..30dc0ea0bf 100644
--- a/tsconfig.host.json
+++ b/tsconfig.host.json
@@ -7,10 +7,7 @@
     "noEmit": true,
     "rewriteRelativeImportExtensions": false
   },
-  "files": [
-    "packages/client/ui-settings-general/src/client/desktop-update-bridge.ts",
-    "packages/client/ui-sidebar-browser/src/index.ts"
-  ],
+  "files": [],
   "include": [
     "apps/web/product-isolation.ts",
     "apps/web/tests/default-product-isolation.e2e.ts",
@@ -49,6 +46,7 @@
     "apps/web/tests/office-fixture.ts",
     "apps/web/tests/sidebar-browser.e2e.ts",
     "apps/web/tests/plugin-config.e2e.ts",
+    "apps/web/tests/input-plugin-extensions.e2e.ts",
     "apps/web/tests/plugin-manager.e2e.ts",
     "apps/web/tests/plugin-install-cancel.e2e.ts",
     "apps/web/tests/plugin-install-approve.e2e.ts",
@@ -125,6 +123,7 @@
     "apps/web/tests/subagent-interrupt-ui.e2e.ts",
     "apps/web/tests/sidebar-subagent-activity.e2e.ts",
     "apps/web/tests/background-job-list.e2e.ts",
+    "apps/web/tests/live-job-stream.e2e.ts",
     "apps/web/tests/bash-abort-row.e2e.ts",
     "apps/web/tests/skill-tool-row.e2e.ts",
     "apps/web/tests/tool-details.e2e.ts",
@@ -184,6 +183,8 @@
     { "path": "./packages/experimental/computer-use-cua-driver-mcp" },
     { "path": "./packages/experimental/computer-use-cua-driver-native" },
     { "path": "./packages/client/ui-sidebar-documentpreview/tsconfig.host.json" },
+    { "path": "./packages/client/ui-sidebar-browser/tsconfig.host.json" },
+    { "path": "./packages/client/ui-settings-general/tsconfig.host.json" },
     { "path": "./packages/document/office-to-pdf" },
     { "path": "./packages/client/ui-deliverables/tsconfig.host.json" },
     { "path": "./vendor/cosmokit" },
@@ -224,6 +225,7 @@
     { "path": "./packages/typert/registry" },
     { "path": "./packages/api/gateway/tsconfig.host.json" },
     { "path": "./packages/api/remotes/tsconfig.host.json" },
+    { "path": "./packages/api/job-controller/tsconfig.host.json" },
     { "path": "./packages/api/session-controller/tsconfig.host.json" },
     { "path": "./packages/api/workspace-files/tsconfig.host.json" },
     { "path": "./packages/api/settings-controller" },
diff --git a/vitest.config.ts b/vitest.config.ts
index baf4f35fc3..22c5e530e3 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -224,6 +224,9 @@ export default defineConfig({
         // harness the jsdom lane doesn't cover yet. TODO(gui): cover and
         // remove as the client test lane matures.
         'packages/client/ui-trajectory/src/*',
+        // Electron guest integration retains its unit specs; per-file coverage
+        // is deferred until a native Electron harness covers guest behavior.
+        'packages/client/ui-sidebar-browser/src/client/electron/**',
         // Trajectory's compact Markdown projection retains deferred branch coverage.
         'packages/client/ui-primitives/src/markdown/plain-text.ts',
         'packages/client/ui-user-questions/src/client/QuestionComposer.tsx',