diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7935cf9..961eed2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,8 +37,13 @@ jobs:
       - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: "10.0.x"
-      - run: dotnet test desktop/CodexProviderSync.Core.Tests/CodexProviderSync.Core.Tests.csproj
-      - run: dotnet test desktop/CodexProviderSync.App.Tests/CodexProviderSync.App.Tests.csproj
+      - run: dotnet build CodexProviderSync.sln --configuration Release
+      - run: dotnet test desktop/CodexProviderSync.Core.Tests/CodexProviderSync.Core.Tests.csproj --configuration Release --no-build
+      - run: dotnet test desktop/CodexProviderSync.Application.Tests/CodexProviderSync.Application.Tests.csproj --configuration Release --no-build
+      - run: dotnet test desktop/CodexProviderSync.Automation.Tests/CodexProviderSync.Automation.Tests.csproj --configuration Release --no-build
+      - run: dotnet test desktop/CodexProviderSync.App.Tests/CodexProviderSync.App.Tests.csproj --configuration Release --no-build
+      - name: Run GUI E2E contract tests (not headful)
+        run: dotnet test desktop/CodexProviderSync.GuiE2E.Tests/CodexProviderSync.GuiE2E.Tests.csproj --configuration Release --no-build
 
   desktop-macos:
     runs-on: macos-latest
@@ -48,8 +53,18 @@ jobs:
         with:
           dotnet-version: "10.0.x"
       - run: dotnet test desktop/CodexProviderSync.Core.Tests/CodexProviderSync.Core.Tests.csproj
+      - run: dotnet test desktop/CodexProviderSync.Application.Tests/CodexProviderSync.Application.Tests.csproj
       - run: dotnet build desktop/CodexProviderSync.Mac/CodexProviderSync.Mac.csproj --configuration Release
 
+  desktop-linux-lock:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          dotnet-version: "10.0.x"
+      - run: dotnet test desktop/CodexProviderSync.Core.Tests/CodexProviderSync.Core.Tests.csproj --filter FullyQualifiedName~LockServiceTests
+
   ci-gate:
     name: ci-gate
     if: ${{ always() }}
@@ -57,6 +72,7 @@ jobs:
       - test
       - desktop-test
       - desktop-macos
+      - desktop-linux-lock
     runs-on: ubuntu-latest
     steps:
       - name: Verify required jobs
@@ -64,10 +80,12 @@ jobs:
           NODE_TEST_RESULT: ${{ needs.test.result }}
           DESKTOP_TEST_RESULT: ${{ needs.desktop-test.result }}
           MACOS_TEST_RESULT: ${{ needs.desktop-macos.result }}
+          LINUX_LOCK_RESULT: ${{ needs.desktop-linux-lock.result }}
         run: |
           if [ "$NODE_TEST_RESULT" != "success" ] ||
              [ "$DESKTOP_TEST_RESULT" != "success" ] ||
-             [ "$MACOS_TEST_RESULT" != "success" ]; then
+             [ "$MACOS_TEST_RESULT" != "success" ] ||
+             [ "$LINUX_LOCK_RESULT" != "success" ]; then
             echo "One or more required CI jobs did not succeed."
             exit 1
           fi
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b22669d..5f65d2d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -44,10 +44,15 @@ jobs:
 
       - run: npm ci
       - run: npm test
-      - run: dotnet test desktop/CodexProviderSync.Core.Tests/CodexProviderSync.Core.Tests.csproj
-      - run: dotnet test desktop/CodexProviderSync.App.Tests/CodexProviderSync.App.Tests.csproj
-
-      - name: Build Windows GUI
+      - run: dotnet build CodexProviderSync.sln --configuration Release
+      - run: dotnet test desktop/CodexProviderSync.Core.Tests/CodexProviderSync.Core.Tests.csproj --configuration Release --no-build
+      - run: dotnet test desktop/CodexProviderSync.Application.Tests/CodexProviderSync.Application.Tests.csproj --configuration Release --no-build
+      - run: dotnet test desktop/CodexProviderSync.Automation.Tests/CodexProviderSync.Automation.Tests.csproj --configuration Release --no-build
+      - run: dotnet test desktop/CodexProviderSync.App.Tests/CodexProviderSync.App.Tests.csproj --configuration Release --no-build
+      - name: Run GUI E2E contract tests (not headful)
+        run: dotnet test desktop/CodexProviderSync.GuiE2E.Tests/CodexProviderSync.GuiE2E.Tests.csproj --configuration Release --no-build
+
+      - name: Build Windows GUI and Business Automation API
         shell: pwsh
         run: ./scripts/publish-gui.ps1 -Output artifacts/win-x64
 
diff --git a/AGENTS.md b/AGENTS.md
index 566263f..870da3a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -17,6 +17,22 @@ The tool works by updating both:
 - rollout metadata under `~/.codex/sessions` and `~/.codex/archived_sessions`
 - SQLite thread metadata in the resolved Codex state database
 
+## Architecture Direction
+
+`docs/AUTOMATION_DESIGN_NOTES.md` records the experimental 0.x direction.
+It is not a public compatibility contract. No Automation executable, stable
+JSONL protocol, or UI probe is currently shipped.
+
+For Windows GUI work:
+
+- move UI-independent state, validation, and Core request construction into the
+  Application/controller layer incrementally
+- keep Core authoritative for config, rollout, SQLite, backup, restore, and
+  storage-safety behavior
+- keep WinForms handlers focused on presentation and platform interaction
+- preserve observable behavior and add controller tests for each migrated slice
+- prefer controller tests over adding new reflection-based MainForm business tests
+
 Resolve SQLite Home in this order: explicit CLI/GUI override, root `sqlite_home` in `config.toml`, `CODEX_SQLITE_HOME`, then `<codex-home>/sqlite`. Only the default layout may fall back to `<codex-home>/state_5.sqlite`. Never fall back when an explicit/config/environment SQLite Home is missing.
 
 On Windows, `\\wsl.localhost\...` and `\\wsl$\...` SQLite Homes are diagnostic-only. SQLite operations for these paths run inside WSL and use the corresponding Linux path.
diff --git a/CodexProviderSync.sln b/CodexProviderSync.sln
index 800e03d..a06a944 100644
--- a/CodexProviderSync.sln
+++ b/CodexProviderSync.sln
@@ -11,8 +11,26 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CodexProviderSync.Mac", "de
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CodexProviderSync.Core", "desktop\CodexProviderSync.Core\CodexProviderSync.Core.csproj", "{0BAD4EAB-F18E-405C-AA1F-0D08B03B599B}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CodexProviderSync.Application", "desktop\CodexProviderSync.Application\CodexProviderSync.Application.csproj", "{A2A9E0B8-D2F3-4E21-AEF0-6DDE4688D80A}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CodexProviderSync.Automation", "desktop\CodexProviderSync.Automation\CodexProviderSync.Automation.csproj", "{D4E17AB1-7F5C-48A8-A47E-8BE5F37BD761}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CodexProviderSync.GuiE2E", "desktop\CodexProviderSync.GuiE2E\CodexProviderSync.GuiE2E.csproj", "{B8C38C3E-5C80-4F69-B4AB-55772F61A138}"
+EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CodexProviderSync.App.Tests", "desktop\CodexProviderSync.App.Tests\CodexProviderSync.App.Tests.csproj", "{C2B35A41-4A58-49EC-A8D1-65F8AA6D9914}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CodexProviderSync.Application.Tests", "desktop\CodexProviderSync.Application.Tests\CodexProviderSync.Application.Tests.csproj", "{F4F86035-7CC3-4D8E-BA71-1C87E2A7E2E9}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CodexProviderSync.Automation.Tests", "desktop\CodexProviderSync.Automation.Tests\CodexProviderSync.Automation.Tests.csproj", "{E650246E-C6E1-4E34-9CF7-9890CE46B65C}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CodexProviderSync.GuiE2E.Tests", "desktop\CodexProviderSync.GuiE2E.Tests\CodexProviderSync.GuiE2E.Tests.csproj", "{9E3EA4B7-BD0E-48CD-B74A-C4E4F1F44589}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CodexProviderSync.PlanClaimHost", "desktop\CodexProviderSync.Application.Tests\ClaimHost\CodexProviderSync.PlanClaimHost.csproj", "{577DF582-39B9-4306-8F51-DB65DFD375E0}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CodexProviderSync.CrashHost", "desktop\CodexProviderSync.Core.Tests\CrashHost\CodexProviderSync.CrashHost.csproj", "{1DD4AD0F-F74F-452B-8633-96326FE0769E}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CodexProviderSync.Core.Tests", "desktop\CodexProviderSync.Core.Tests\CodexProviderSync.Core.Tests.csproj", "{3D212656-31F9-4591-A19C-B7F77EE09AA3}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -59,6 +77,42 @@ Global
 		{0BAD4EAB-F18E-405C-AA1F-0D08B03B599B}.Release|x64.Build.0 = Release|Any CPU
 		{0BAD4EAB-F18E-405C-AA1F-0D08B03B599B}.Release|x86.ActiveCfg = Release|Any CPU
 		{0BAD4EAB-F18E-405C-AA1F-0D08B03B599B}.Release|x86.Build.0 = Release|Any CPU
+		{A2A9E0B8-D2F3-4E21-AEF0-6DDE4688D80A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{A2A9E0B8-D2F3-4E21-AEF0-6DDE4688D80A}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{A2A9E0B8-D2F3-4E21-AEF0-6DDE4688D80A}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{A2A9E0B8-D2F3-4E21-AEF0-6DDE4688D80A}.Debug|x64.Build.0 = Debug|Any CPU
+		{A2A9E0B8-D2F3-4E21-AEF0-6DDE4688D80A}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{A2A9E0B8-D2F3-4E21-AEF0-6DDE4688D80A}.Debug|x86.Build.0 = Debug|Any CPU
+		{A2A9E0B8-D2F3-4E21-AEF0-6DDE4688D80A}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{A2A9E0B8-D2F3-4E21-AEF0-6DDE4688D80A}.Release|Any CPU.Build.0 = Release|Any CPU
+		{A2A9E0B8-D2F3-4E21-AEF0-6DDE4688D80A}.Release|x64.ActiveCfg = Release|Any CPU
+		{A2A9E0B8-D2F3-4E21-AEF0-6DDE4688D80A}.Release|x64.Build.0 = Release|Any CPU
+		{A2A9E0B8-D2F3-4E21-AEF0-6DDE4688D80A}.Release|x86.ActiveCfg = Release|Any CPU
+		{A2A9E0B8-D2F3-4E21-AEF0-6DDE4688D80A}.Release|x86.Build.0 = Release|Any CPU
+		{D4E17AB1-7F5C-48A8-A47E-8BE5F37BD761}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{D4E17AB1-7F5C-48A8-A47E-8BE5F37BD761}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{D4E17AB1-7F5C-48A8-A47E-8BE5F37BD761}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{D4E17AB1-7F5C-48A8-A47E-8BE5F37BD761}.Debug|x64.Build.0 = Debug|Any CPU
+		{D4E17AB1-7F5C-48A8-A47E-8BE5F37BD761}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{D4E17AB1-7F5C-48A8-A47E-8BE5F37BD761}.Debug|x86.Build.0 = Debug|Any CPU
+		{D4E17AB1-7F5C-48A8-A47E-8BE5F37BD761}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{D4E17AB1-7F5C-48A8-A47E-8BE5F37BD761}.Release|Any CPU.Build.0 = Release|Any CPU
+		{D4E17AB1-7F5C-48A8-A47E-8BE5F37BD761}.Release|x64.ActiveCfg = Release|Any CPU
+		{D4E17AB1-7F5C-48A8-A47E-8BE5F37BD761}.Release|x64.Build.0 = Release|Any CPU
+		{D4E17AB1-7F5C-48A8-A47E-8BE5F37BD761}.Release|x86.ActiveCfg = Release|Any CPU
+		{D4E17AB1-7F5C-48A8-A47E-8BE5F37BD761}.Release|x86.Build.0 = Release|Any CPU
+		{B8C38C3E-5C80-4F69-B4AB-55772F61A138}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{B8C38C3E-5C80-4F69-B4AB-55772F61A138}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{B8C38C3E-5C80-4F69-B4AB-55772F61A138}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{B8C38C3E-5C80-4F69-B4AB-55772F61A138}.Debug|x64.Build.0 = Debug|Any CPU
+		{B8C38C3E-5C80-4F69-B4AB-55772F61A138}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{B8C38C3E-5C80-4F69-B4AB-55772F61A138}.Debug|x86.Build.0 = Debug|Any CPU
+		{B8C38C3E-5C80-4F69-B4AB-55772F61A138}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{B8C38C3E-5C80-4F69-B4AB-55772F61A138}.Release|Any CPU.Build.0 = Release|Any CPU
+		{B8C38C3E-5C80-4F69-B4AB-55772F61A138}.Release|x64.ActiveCfg = Release|Any CPU
+		{B8C38C3E-5C80-4F69-B4AB-55772F61A138}.Release|x64.Build.0 = Release|Any CPU
+		{B8C38C3E-5C80-4F69-B4AB-55772F61A138}.Release|x86.ActiveCfg = Release|Any CPU
+		{B8C38C3E-5C80-4F69-B4AB-55772F61A138}.Release|x86.Build.0 = Release|Any CPU
 		{C2B35A41-4A58-49EC-A8D1-65F8AA6D9914}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{C2B35A41-4A58-49EC-A8D1-65F8AA6D9914}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{C2B35A41-4A58-49EC-A8D1-65F8AA6D9914}.Debug|x64.ActiveCfg = Debug|Any CPU
@@ -71,6 +125,78 @@ Global
 		{C2B35A41-4A58-49EC-A8D1-65F8AA6D9914}.Release|x64.Build.0 = Release|Any CPU
 		{C2B35A41-4A58-49EC-A8D1-65F8AA6D9914}.Release|x86.ActiveCfg = Release|Any CPU
 		{C2B35A41-4A58-49EC-A8D1-65F8AA6D9914}.Release|x86.Build.0 = Release|Any CPU
+		{F4F86035-7CC3-4D8E-BA71-1C87E2A7E2E9}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{F4F86035-7CC3-4D8E-BA71-1C87E2A7E2E9}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{F4F86035-7CC3-4D8E-BA71-1C87E2A7E2E9}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{F4F86035-7CC3-4D8E-BA71-1C87E2A7E2E9}.Debug|x64.Build.0 = Debug|Any CPU
+		{F4F86035-7CC3-4D8E-BA71-1C87E2A7E2E9}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{F4F86035-7CC3-4D8E-BA71-1C87E2A7E2E9}.Debug|x86.Build.0 = Debug|Any CPU
+		{F4F86035-7CC3-4D8E-BA71-1C87E2A7E2E9}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{F4F86035-7CC3-4D8E-BA71-1C87E2A7E2E9}.Release|Any CPU.Build.0 = Release|Any CPU
+		{F4F86035-7CC3-4D8E-BA71-1C87E2A7E2E9}.Release|x64.ActiveCfg = Release|Any CPU
+		{F4F86035-7CC3-4D8E-BA71-1C87E2A7E2E9}.Release|x64.Build.0 = Release|Any CPU
+		{F4F86035-7CC3-4D8E-BA71-1C87E2A7E2E9}.Release|x86.ActiveCfg = Release|Any CPU
+		{F4F86035-7CC3-4D8E-BA71-1C87E2A7E2E9}.Release|x86.Build.0 = Release|Any CPU
+		{E650246E-C6E1-4E34-9CF7-9890CE46B65C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{E650246E-C6E1-4E34-9CF7-9890CE46B65C}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{E650246E-C6E1-4E34-9CF7-9890CE46B65C}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{E650246E-C6E1-4E34-9CF7-9890CE46B65C}.Debug|x64.Build.0 = Debug|Any CPU
+		{E650246E-C6E1-4E34-9CF7-9890CE46B65C}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{E650246E-C6E1-4E34-9CF7-9890CE46B65C}.Debug|x86.Build.0 = Debug|Any CPU
+		{E650246E-C6E1-4E34-9CF7-9890CE46B65C}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{E650246E-C6E1-4E34-9CF7-9890CE46B65C}.Release|Any CPU.Build.0 = Release|Any CPU
+		{E650246E-C6E1-4E34-9CF7-9890CE46B65C}.Release|x64.ActiveCfg = Release|Any CPU
+		{E650246E-C6E1-4E34-9CF7-9890CE46B65C}.Release|x64.Build.0 = Release|Any CPU
+		{E650246E-C6E1-4E34-9CF7-9890CE46B65C}.Release|x86.ActiveCfg = Release|Any CPU
+		{E650246E-C6E1-4E34-9CF7-9890CE46B65C}.Release|x86.Build.0 = Release|Any CPU
+		{9E3EA4B7-BD0E-48CD-B74A-C4E4F1F44589}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{9E3EA4B7-BD0E-48CD-B74A-C4E4F1F44589}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{9E3EA4B7-BD0E-48CD-B74A-C4E4F1F44589}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{9E3EA4B7-BD0E-48CD-B74A-C4E4F1F44589}.Debug|x64.Build.0 = Debug|Any CPU
+		{9E3EA4B7-BD0E-48CD-B74A-C4E4F1F44589}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{9E3EA4B7-BD0E-48CD-B74A-C4E4F1F44589}.Debug|x86.Build.0 = Debug|Any CPU
+		{9E3EA4B7-BD0E-48CD-B74A-C4E4F1F44589}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{9E3EA4B7-BD0E-48CD-B74A-C4E4F1F44589}.Release|Any CPU.Build.0 = Release|Any CPU
+		{9E3EA4B7-BD0E-48CD-B74A-C4E4F1F44589}.Release|x64.ActiveCfg = Release|Any CPU
+		{9E3EA4B7-BD0E-48CD-B74A-C4E4F1F44589}.Release|x64.Build.0 = Release|Any CPU
+		{9E3EA4B7-BD0E-48CD-B74A-C4E4F1F44589}.Release|x86.ActiveCfg = Release|Any CPU
+		{9E3EA4B7-BD0E-48CD-B74A-C4E4F1F44589}.Release|x86.Build.0 = Release|Any CPU
+		{577DF582-39B9-4306-8F51-DB65DFD375E0}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{577DF582-39B9-4306-8F51-DB65DFD375E0}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{577DF582-39B9-4306-8F51-DB65DFD375E0}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{577DF582-39B9-4306-8F51-DB65DFD375E0}.Debug|x64.Build.0 = Debug|Any CPU
+		{577DF582-39B9-4306-8F51-DB65DFD375E0}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{577DF582-39B9-4306-8F51-DB65DFD375E0}.Debug|x86.Build.0 = Debug|Any CPU
+		{577DF582-39B9-4306-8F51-DB65DFD375E0}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{577DF582-39B9-4306-8F51-DB65DFD375E0}.Release|Any CPU.Build.0 = Release|Any CPU
+		{577DF582-39B9-4306-8F51-DB65DFD375E0}.Release|x64.ActiveCfg = Release|Any CPU
+		{577DF582-39B9-4306-8F51-DB65DFD375E0}.Release|x64.Build.0 = Release|Any CPU
+		{577DF582-39B9-4306-8F51-DB65DFD375E0}.Release|x86.ActiveCfg = Release|Any CPU
+		{577DF582-39B9-4306-8F51-DB65DFD375E0}.Release|x86.Build.0 = Release|Any CPU
+		{1DD4AD0F-F74F-452B-8633-96326FE0769E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{1DD4AD0F-F74F-452B-8633-96326FE0769E}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{1DD4AD0F-F74F-452B-8633-96326FE0769E}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{1DD4AD0F-F74F-452B-8633-96326FE0769E}.Debug|x64.Build.0 = Debug|Any CPU
+		{1DD4AD0F-F74F-452B-8633-96326FE0769E}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{1DD4AD0F-F74F-452B-8633-96326FE0769E}.Debug|x86.Build.0 = Debug|Any CPU
+		{1DD4AD0F-F74F-452B-8633-96326FE0769E}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{1DD4AD0F-F74F-452B-8633-96326FE0769E}.Release|Any CPU.Build.0 = Release|Any CPU
+		{1DD4AD0F-F74F-452B-8633-96326FE0769E}.Release|x64.ActiveCfg = Release|Any CPU
+		{1DD4AD0F-F74F-452B-8633-96326FE0769E}.Release|x64.Build.0 = Release|Any CPU
+		{1DD4AD0F-F74F-452B-8633-96326FE0769E}.Release|x86.ActiveCfg = Release|Any CPU
+		{1DD4AD0F-F74F-452B-8633-96326FE0769E}.Release|x86.Build.0 = Release|Any CPU
+		{3D212656-31F9-4591-A19C-B7F77EE09AA3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{3D212656-31F9-4591-A19C-B7F77EE09AA3}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{3D212656-31F9-4591-A19C-B7F77EE09AA3}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{3D212656-31F9-4591-A19C-B7F77EE09AA3}.Debug|x64.Build.0 = Debug|Any CPU
+		{3D212656-31F9-4591-A19C-B7F77EE09AA3}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{3D212656-31F9-4591-A19C-B7F77EE09AA3}.Debug|x86.Build.0 = Debug|Any CPU
+		{3D212656-31F9-4591-A19C-B7F77EE09AA3}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{3D212656-31F9-4591-A19C-B7F77EE09AA3}.Release|Any CPU.Build.0 = Release|Any CPU
+		{3D212656-31F9-4591-A19C-B7F77EE09AA3}.Release|x64.ActiveCfg = Release|Any CPU
+		{3D212656-31F9-4591-A19C-B7F77EE09AA3}.Release|x64.Build.0 = Release|Any CPU
+		{3D212656-31F9-4591-A19C-B7F77EE09AA3}.Release|x86.ActiveCfg = Release|Any CPU
+		{3D212656-31F9-4591-A19C-B7F77EE09AA3}.Release|x86.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
@@ -79,6 +205,15 @@ Global
 		{046C07E6-8117-4F19-B2CF-683D62D944C9} = {7A1224A0-F22D-34FF-DE0A-A058FAFFD90C}
 		{2F00CBA5-C5E9-42BC-9F25-01641E0B8901} = {7A1224A0-F22D-34FF-DE0A-A058FAFFD90C}
 		{0BAD4EAB-F18E-405C-AA1F-0D08B03B599B} = {7A1224A0-F22D-34FF-DE0A-A058FAFFD90C}
+		{A2A9E0B8-D2F3-4E21-AEF0-6DDE4688D80A} = {7A1224A0-F22D-34FF-DE0A-A058FAFFD90C}
+		{D4E17AB1-7F5C-48A8-A47E-8BE5F37BD761} = {7A1224A0-F22D-34FF-DE0A-A058FAFFD90C}
+		{B8C38C3E-5C80-4F69-B4AB-55772F61A138} = {7A1224A0-F22D-34FF-DE0A-A058FAFFD90C}
 		{C2B35A41-4A58-49EC-A8D1-65F8AA6D9914} = {7A1224A0-F22D-34FF-DE0A-A058FAFFD90C}
+		{F4F86035-7CC3-4D8E-BA71-1C87E2A7E2E9} = {7A1224A0-F22D-34FF-DE0A-A058FAFFD90C}
+		{E650246E-C6E1-4E34-9CF7-9890CE46B65C} = {7A1224A0-F22D-34FF-DE0A-A058FAFFD90C}
+		{9E3EA4B7-BD0E-48CD-B74A-C4E4F1F44589} = {7A1224A0-F22D-34FF-DE0A-A058FAFFD90C}
+		{577DF582-39B9-4306-8F51-DB65DFD375E0} = {7A1224A0-F22D-34FF-DE0A-A058FAFFD90C}
+		{1DD4AD0F-F74F-452B-8633-96326FE0769E} = {7A1224A0-F22D-34FF-DE0A-A058FAFFD90C}
+		{3D212656-31F9-4591-A19C-B7F77EE09AA3} = {7A1224A0-F22D-34FF-DE0A-A058FAFFD90C}
 	EndGlobalSection
 EndGlobal
diff --git a/README.md b/README.md
index 2e1cdce..17db0e5 100644
--- a/README.md
+++ b/README.md
@@ -90,6 +90,34 @@ codex-provider sync --codex-home /mnt/c/Users/you/.codex --sqlite-home /home/you
 
 `status` 会显示 effective SQLite Home 和来源。显式路径缺少 `state_5.sqlite` 时，状态查询只报告诊断，`sync`、`switch` 和数据库恢复不会偷偷回退到其它位置。默认布局中的数据库被删除时，`restore` 可以根据备份 metadata 在原默认位置重建数据库。
 
+### Business Automation API（v0.4 实验性）
+
+v0.4 Windows Release 构建同时包含 `CodexProviderSync.Automation.exe` 和 `automation-protocol-v0.4.schema.json`。这个一次性进程接口与 Windows GUI 共用同一套 Application 用例；每次调用只在 stdout 输出一份协议 `0.4` JSON，诊断信息写入 stderr。
+
+| 命令 | 用途 |
+| --- | --- |
+| `describe` | 描述协议能力和安全要求 |
+| `status` | 读取状态和诊断 |
+| `plan --operation sync\|switch\|restore\|prune` | 为指定写操作创建计划 |
+| `sync` | 规划或显式执行同步 |
+| `switch` | 规划或显式执行 Provider/model 切换与同步 |
+| `restore` | 规划或显式执行备份恢复 |
+| `prune` | 规划或显式清理托管备份 |
+
+所有写命令默认都是 dry-run，只返回计划，不会修改目标。实际写入必须同时提供 `--apply`、只包含 `plan` 响应中 `data` 对象的计划文件，以及该对象的精确小写 SHA-256 `digest`：
+
+```powershell
+.\CodexProviderSync.Automation.exe describe
+.\CodexProviderSync.Automation.exe status --codex-home C:\isolated\.codex
+.\CodexProviderSync.Automation.exe sync --codex-home C:\isolated\.codex --provider openai
+$planResponse = .\CodexProviderSync.Automation.exe plan --operation sync --codex-home C:\isolated\.codex --provider openai | ConvertFrom-Json
+$planResponse.data | ConvertTo-Json -Depth 100 -Compress | Set-Content -LiteralPath C:\isolated\sync-plan.json -Encoding utf8NoBOM
+$planDigest = $planResponse.data.digest
+.\CodexProviderSync.Automation.exe sync --codex-home C:\isolated\.codex --provider openai --apply --plan C:\isolated\sync-plan.json --plan-digest $planDigest
+```
+
+计划有有效期、绑定规范化输入和目标状态，并由持久化 ledger 保证只能使用一次；默认 ledger 位于 `<Codex Home>\tmp\provider-sync-automation-ledger`。所有路径参数必须是绝对路径，不能穿过符号链接或 reparse point，Automation 也拒绝直接指向或访问 `auth.json`。协议仍处于 pre-1.0 实验阶段，`0.4` 之外不承诺兼容。
+
 ## 安全与限制
 
 每次 `sync` / `switch` 前都会备份到：
@@ -111,6 +139,8 @@ codex-provider sync --codex-home /mnt/c/Users/you/.codex --sqlite-home /home/you
 
 - [Windows GUI 说明](docs/README_GUI_ZH.md)
 - macOS GUI 说明：[中文](docs/README_MAC_GUI_ZH.md) · [English](docs/README_MAC_GUI_EN.md)
+- [v0.4.0 Release Notes（Draft）](docs/RELEASE_NOTES_V0.4.0.md)
+- [v0.4 Automation 执行计划](docs/V0.4_AUTOMATION_PLAN.md)
 - [English documentation](docs/README_EN.md)
 - [AI / Agent 操作指南](AGENTS.md)
 - [贡献指南](CONTRIBUTING.md)
@@ -124,10 +154,11 @@ npm test
 dotnet test desktop/CodexProviderSync.Core.Tests/CodexProviderSync.Core.Tests.csproj
 ./scripts/test-wsl-unc-safety.sh
 pwsh ./scripts/publish-gui.ps1
+pwsh ./scripts/run-windows-gui-e2e.ps1
 ./scripts/publish-gui-macos.sh
 ```
 
-`test-wsl-unc-safety.sh` 需要从 WSL 运行，并调用 Windows `dotnet.exe` 验证真实 WSL ext4 SQLite 的安全阻断。
+`test-wsl-unc-safety.sh` 需要从 WSL 运行，并调用 Windows `dotnet.exe` 验证真实 WSL ext4 SQLite 的安全阻断。`run-windows-gui-e2e.ps1` 必须在可见、可交互的 Windows 桌面中运行。v0.4 的实现提交 `7545b5d` 已通过该 gate：40/40 manifest 入口覆盖、53/53 必需场景通过、0 error、0 blocker，且发布 EXE 哈希、真实控件事件、原生对话框、文件/SQLite 差异、重启持久化和 GUI → Application trace 均由证据门禁核验。后续若修改相关实现必须重新运行；隐藏、跳过或直接调用 Application 不能替代真实 GUI PASS。
 
 ## License
 
diff --git a/desktop/CodexProviderSync.App.Tests/ApplicationOperationTrackingTests.cs b/desktop/CodexProviderSync.App.Tests/ApplicationOperationTrackingTests.cs
new file mode 100644
index 0000000..1ff5c87
--- /dev/null
+++ b/desktop/CodexProviderSync.App.Tests/ApplicationOperationTrackingTests.cs
@@ -0,0 +1,339 @@
+using CodexProviderSync.Application;
+using CodexProviderSync.App.Automation;
+using CodexProviderSync.Core;
+using Microsoft.Data.Sqlite;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Windows.Forms;
+
+namespace CodexProviderSync.App.Tests;
+
+public sealed class ApplicationOperationTrackingTests
+{
+    [Theory]
+    [InlineData(GuiAutomationCatalog.Ids.RefreshStatus)]
+    [InlineData(GuiAutomationCatalog.Ids.Execute)]
+    [InlineData(GuiAutomationCatalog.Ids.Restore)]
+    [InlineData(GuiAutomationCatalog.Ids.PruneBackups)]
+    public void EveryBusinessButton_RequiresAnApplicationTraceWindow(string automationId)
+    {
+        Assert.True(MainForm.IsApplicationBoundAutomationId(automationId));
+    }
+
+    [Theory]
+    [InlineData(GuiAutomationCatalog.Ids.AddManualProvider)]
+    [InlineData(GuiAutomationCatalog.Ids.OpenBackupDirectory)]
+    [InlineData(GuiAutomationCatalog.Ids.CheckUpdates)]
+    public void UiAndSettingsButtons_AreExplicitlyNotApplicationBound(string automationId)
+    {
+        Assert.False(MainForm.IsApplicationBoundAutomationId(automationId));
+    }
+
+    [Fact]
+    public void DryRunReadyToApply_IsNeverAcceptedAsGuiApplySuccess()
+    {
+        DateTimeOffset now = DateTimeOffset.UtcNow;
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> dryRun = new(
+            "dry-run-operation",
+            ApplicationOperationKind.Sync,
+            ApplicationOperationLifecycle.ReadyToApply,
+            now,
+            now,
+            new ApplicationWriteResult<SyncResult>(null!, Applied: false, Result: null),
+            [],
+            [],
+            []);
+
+        Assert.False(GuiApplicationOutcomePolicy.IsAppliedSuccess(dryRun));
+    }
+
+    [Fact]
+    public void PlanStale_IsTheOnlyBoundedGuiReplanSignal()
+    {
+        DateTimeOffset now = DateTimeOffset.UtcNow;
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> stale = new(
+            "stale-operation",
+            ApplicationOperationKind.Sync,
+            ApplicationOperationLifecycle.Rejected,
+            now,
+            now,
+            null,
+            [],
+            [new ApplicationError("plan_stale", "changed")],
+            []);
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> busy = stale with
+        {
+            Errors = [new ApplicationError("target_busy", "busy")]
+        };
+
+        Assert.True(GuiApplicationOutcomePolicy.IsPlanStale(stale));
+        Assert.False(GuiApplicationOutcomePolicy.IsPlanStale(busy));
+    }
+
+    [Fact]
+    public async Task AsyncHandler_RetainsGuiCorrelation_AfterDispatcherScopeReturns()
+    {
+        ApplicationOperationTraceHub hub = new();
+        DeferredStatusService inner = new();
+        TrackedApplicationService tracked = new(inner, hub);
+        Task handler;
+        ApplicationInvocationWindow window;
+
+        using (ApplicationOperationTraceHub.ApplicationInvocationScope scope =
+            hub.BeginInvocation("request-1", GuiAutomationCatalog.Ids.RefreshStatus))
+        {
+            window = scope.Window;
+            handler = RunHandlerAsync();
+        }
+
+        inner.Complete(CreateStatusOutcome("status-real-1"));
+        await handler;
+        IReadOnlyList<ApplicationOperationTraceRecord> operations =
+            await window.WaitAsync(CancellationToken.None);
+
+        ApplicationOperationTraceRecord operation = Assert.Single(operations);
+        Assert.Equal("status-real-1", operation.OperationId);
+        Assert.Equal(ApplicationOperationKind.Status, operation.Operation);
+        Assert.Equal(ApplicationOperationLifecycle.Succeeded, operation.Lifecycle);
+
+        async Task RunHandlerAsync()
+        {
+            await tracked.GetStatusAsync(new ApplicationStatusRequest("C:\\fixture"));
+            hub.CompleteCurrentInvocation();
+        }
+    }
+
+    [Fact]
+    public void TraceSink_WritesRealApplicationIdentityLifecycleAndCausalRequest()
+    {
+        string root = Path.Combine(
+            Path.GetTempPath(),
+            $"codex-provider-gui-trace-{Guid.NewGuid():N}");
+        string path = Path.Combine(root, "trace.jsonl");
+        try
+        {
+            DateTimeOffset now = DateTimeOffset.UtcNow;
+            GuiAutomationTraceSink sink = new(path);
+            sink.Append(
+                "request-apply",
+                "ui.invoke",
+                GuiAutomationCatalog.Ids.Execute,
+                "Click",
+                eventObserved: true,
+                [new ApplicationOperationTraceRecord(
+                    "apply-operation-1",
+                    ApplicationOperationKind.Sync,
+                    ApplicationOperationLifecycle.Succeeded,
+                    now,
+                    now,
+                    [])]);
+
+            using JsonDocument document = JsonDocument.Parse(File.ReadAllText(path));
+            JsonElement rootElement = document.RootElement;
+            Assert.Equal(2, rootElement.GetProperty("schemaVersion").GetInt32());
+            Assert.Equal("request-apply", rootElement.GetProperty("requestId").GetString());
+            Assert.True(rootElement.GetProperty("applicationOperationLinked").GetBoolean());
+            Assert.Equal("apply-operation-1", rootElement.GetProperty("applicationOperationId").GetString());
+            Assert.Equal("Sync", rootElement.GetProperty("applicationOperation").GetString());
+            Assert.Equal("Succeeded", rootElement.GetProperty("applicationLifecycle").GetString());
+            Assert.Equal(1, rootElement.GetProperty("applicationOperations").GetArrayLength());
+        }
+        finally
+        {
+            if (Directory.Exists(root))
+            {
+                Directory.Delete(root, recursive: true);
+            }
+        }
+    }
+
+    [Fact]
+    public async Task RefreshButton_RealWinFormsEvent_UsesProductionApplicationAndCoreFixture()
+    {
+        string root = Path.Combine(
+            Path.GetTempPath(),
+            $"codex-provider-gui-core-event-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(root);
+        IAppPathProvider paths = new IsolatedAppPathProvider(root);
+        Directory.CreateDirectory(paths.DefaultCodexHome);
+        Directory.CreateDirectory(paths.RequiredSqliteHomeOverride!);
+        await File.WriteAllTextAsync(
+            Path.Combine(paths.DefaultCodexHome, "config.toml"),
+            "model_provider = \"openai\"\n");
+        await CreateStateDatabaseAsync(Path.Combine(
+            paths.RequiredSqliteHomeOverride!,
+            "state_5.sqlite"));
+        SettingsService settings = new(paths.SettingsPath);
+        AutomationIsolation.PrepareSettings(settings, paths);
+
+        TaskCompletionSource<JsonNode> completion =
+            new(TaskCreationOptions.RunContinuationsAsynchronously);
+        Thread ui = new(() =>
+        {
+            try
+            {
+                using MainForm form = new(
+                    new ExecutionLogService(paths.LogDirectory),
+                    settings,
+                    paths: paths,
+                    platformBoundary: new IsolatedAppPlatformBoundary(paths));
+                GuiAutomationDispatcher dispatcher = new(
+                    form,
+                    new GuiAutomationTraceSink(paths.AutomationTracePath!));
+                form.Shown += async (_, _) =>
+                {
+                    try
+                    {
+                        Button refresh = form.Controls
+                            .Find(GuiAutomationCatalog.Ids.RefreshStatus, true)
+                            .OfType<Button>()
+                            .Single();
+                        Label state = form.Controls
+                            .Find(GuiAutomationCatalog.Ids.OperationState, true)
+                            .OfType<Label>()
+                            .Single();
+                        RichTextBox status = form.Controls
+                            .Find(GuiAutomationCatalog.Ids.StatusOutput, true)
+                            .OfType<RichTextBox>()
+                            .Single();
+                        DateTimeOffset readyDeadline = DateTimeOffset.UtcNow.AddSeconds(5);
+                        while ((!refresh.Enabled || state.Text != "就绪" || status.TextLength == 0)
+                            && DateTimeOffset.UtcNow < readyDeadline)
+                        {
+                            await Task.Delay(25);
+                        }
+                        Assert.True(
+                            refresh.Enabled && status.TextLength > 0,
+                            "Initial real Application status refresh did not become ready.");
+                        GuiAutomationRequest request = GuiAutomationRequest.Parse(
+                            "{\"id\":\"real-refresh\",\"method\":\"ui.invoke\",\"params\":{\"automationId\":\"status.refresh\"}}");
+                        JsonNode result = (await dispatcher.DispatchAsync(
+                            request,
+                            CancellationToken.None))!;
+                        completion.TrySetResult(result);
+                    }
+                    catch (Exception error)
+                    {
+                        completion.TrySetException(error);
+                    }
+                    finally
+                    {
+                        form.Close();
+                    }
+                };
+                System.Windows.Forms.Application.Run(form);
+            }
+            catch (Exception error)
+            {
+                completion.TrySetException(error);
+            }
+        });
+        ui.SetApartmentState(ApartmentState.STA);
+        ui.Start();
+
+        try
+        {
+            JsonNode result = await completion.Task.WaitAsync(TimeSpan.FromSeconds(20));
+            Assert.True(result["applicationOperationLinked"]!.GetValue<bool>());
+            Assert.Equal("Status", result["applicationOperation"]!.GetValue<string>());
+            Assert.Equal("Succeeded", result["applicationLifecycle"]!.GetValue<string>());
+            JsonArray operations = result["applicationOperations"]!.AsArray();
+            JsonNode operation = Assert.Single(operations)!;
+            Assert.Equal("Status", operation["operation"]!.GetValue<string>());
+            Assert.Equal("Succeeded", operation["lifecycle"]!.GetValue<string>());
+
+            string trace = await File.ReadAllTextAsync(paths.AutomationTracePath!);
+            Assert.Contains("\"requestId\":\"real-refresh\"", trace, StringComparison.Ordinal);
+            Assert.Contains("\"applicationOperationLinked\":true", trace, StringComparison.Ordinal);
+        }
+        finally
+        {
+            if (!ui.Join(TimeSpan.FromSeconds(5)))
+            {
+                throw new TimeoutException("The isolated WinForms fixture did not close.");
+            }
+            SqliteConnection.ClearAllPools();
+            Directory.Delete(root, recursive: true);
+        }
+    }
+
+    private static async Task CreateStateDatabaseAsync(string path)
+    {
+        SQLitePCL.Batteries_V2.Init();
+        await using SqliteConnection connection = new($"Data Source={path}");
+        await connection.OpenAsync();
+        await using SqliteCommand command = connection.CreateCommand();
+        command.CommandText = """
+            CREATE TABLE threads (
+              id TEXT PRIMARY KEY,
+              model_provider TEXT,
+              cwd TEXT NOT NULL DEFAULT '',
+              archived INTEGER NOT NULL DEFAULT 0,
+              first_user_message TEXT NOT NULL DEFAULT '',
+              model TEXT
+            );
+            INSERT INTO threads (id, model_provider, cwd, archived, first_user_message, model)
+            VALUES ('fixture-thread', 'openai', 'C:\fixture', 0, 'hello', NULL);
+            """;
+        await command.ExecuteNonQueryAsync();
+    }
+
+    private static ApplicationOutcome<StatusSnapshot> CreateStatusOutcome(string operationId)
+    {
+        DateTimeOffset now = DateTimeOffset.UtcNow;
+        return new ApplicationOutcome<StatusSnapshot>(
+            operationId,
+            ApplicationOperationKind.Status,
+            ApplicationOperationLifecycle.Succeeded,
+            now,
+            now,
+            new StatusSnapshot
+            {
+                CodexHome = "C:\\fixture",
+                CurrentProvider = new CurrentProviderInfo("openai", false),
+                ConfiguredProviders = ["openai"],
+                RolloutCounts = new ProviderCounts(),
+                LockedRolloutFiles = [],
+                UnreadableRolloutFiles = [],
+                EncryptedContentCounts = new ProviderCounts(),
+                SqliteCounts = null,
+                BackupRoot = "C:\\fixture\\backups",
+                BackupSummary = new BackupSummary { Count = 0, TotalBytes = 0 }
+            },
+            [],
+            [],
+            [new ApplicationLifecycleEvent(ApplicationOperationLifecycle.Succeeded, now)]);
+    }
+
+    private sealed class DeferredStatusService : IApplicationService
+    {
+        private readonly TaskCompletionSource<ApplicationOutcome<StatusSnapshot>> _status =
+            new(TaskCreationOptions.RunContinuationsAsynchronously);
+
+        internal void Complete(ApplicationOutcome<StatusSnapshot> outcome) =>
+            _status.TrySetResult(outcome);
+
+        public Task<ApplicationOutcome<StatusSnapshot>> GetStatusAsync(
+            ApplicationStatusRequest request,
+            CancellationToken cancellationToken = default) =>
+            _status.Task.WaitAsync(cancellationToken);
+
+        public Task<ApplicationOutcome<ApplicationDescription>> DescribeAsync(CancellationToken cancellationToken = default) =>
+            throw new NotSupportedException();
+
+        public Task<ApplicationOutcome<ApplicationOperationPlan>> CreatePlanAsync(CreateApplicationPlanRequest request, CancellationToken cancellationToken = default) =>
+            throw new NotSupportedException();
+
+        public Task<ApplicationOutcome<ApplicationWriteResult<SyncResult>>> SyncAsync(SyncApplicationRequest request, CancellationToken cancellationToken = default) =>
+            throw new NotSupportedException();
+
+        public Task<ApplicationOutcome<ApplicationWriteResult<SyncResult>>> SwitchAsync(SwitchApplicationRequest request, CancellationToken cancellationToken = default) =>
+            throw new NotSupportedException();
+
+        public Task<ApplicationOutcome<ApplicationWriteResult<RestoreResult>>> RestoreAsync(RestoreApplicationRequest request, CancellationToken cancellationToken = default) =>
+            throw new NotSupportedException();
+
+        public Task<ApplicationOutcome<ApplicationWriteResult<BackupPruneResult>>> PruneAsync(PruneApplicationRequest request, CancellationToken cancellationToken = default) =>
+            throw new NotSupportedException();
+    }
+}
diff --git a/desktop/CodexProviderSync.App.Tests/AutomationBootstrapTests.cs b/desktop/CodexProviderSync.App.Tests/AutomationBootstrapTests.cs
new file mode 100644
index 0000000..ebe8d51
--- /dev/null
+++ b/desktop/CodexProviderSync.App.Tests/AutomationBootstrapTests.cs
@@ -0,0 +1,473 @@
+using System.IO.Pipes;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using CodexProviderSync.App.Automation;
+using CodexProviderSync.Core;
+using System.Windows.Forms;
+
+namespace CodexProviderSync.App.Tests;
+
+public sealed class AutomationBootstrapTests
+{
+    [Fact]
+    public void FolderPickerFactory_ProducesARealConfiguredWinFormsDialog()
+    {
+        string initial = Path.GetTempPath();
+        FolderPickerRequest request = new(
+            "isolated real folder picker",
+            initial,
+            AllowCreate: true);
+
+        using FolderBrowserDialog dialog = AppFolderPickerDialog.Create(request);
+
+        Assert.Equal(request.Description, dialog.Description);
+        Assert.True(dialog.UseDescriptionForTitle);
+        Assert.Equal(initial, dialog.InitialDirectory);
+        Assert.True(dialog.ShowNewFolderButton);
+    }
+
+    [Fact]
+    public void IsolatedFolderPicker_RejectsAnExternalInitialPathBeforeShowingUi()
+    {
+        using AutomationRoot fixture = new();
+        IAppPathProvider paths = new IsolatedAppPathProvider(fixture.Root);
+        IsolatedAppPlatformBoundary boundary = new(paths);
+        string outside = Path.Combine(
+            Path.GetDirectoryName(fixture.Root)!,
+            $"outside-picker-{Guid.NewGuid():N}");
+
+        InvalidOperationException error = Assert.Throws<InvalidOperationException>(() =>
+            boundary.PickFolder(
+                owner: null!,
+                new FolderPickerRequest("must stay isolated", outside)));
+
+        Assert.Contains("outside", error.Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task IsolatedUpdateEntry_IsEnabledAndReturnsDeterministicNoNetworkState()
+    {
+        using AutomationRoot fixture = new();
+        IAppPathProvider paths = new IsolatedAppPathProvider(fixture.Root);
+        IsolatedAppPlatformBoundary boundary = new(paths);
+        RejectingNetworkHandler handler = new();
+        UpdateService updateService = new(new HttpClient(handler));
+
+        UpdateCheckResult result = await boundary.CheckForUpdateAsync(
+            updateService,
+            new Version(0, 4, 0));
+
+        Assert.True(boundary.UpdatesEnabled);
+        Assert.False(result.IsUpdateAvailable);
+        Assert.Equal(new Version(0, 4, 0), result.CurrentVersion);
+        Assert.Equal(0, handler.RequestCount);
+    }
+
+    [Fact]
+    public void ValidDescriptor_IsClaimedOnce_AndEveryPathStaysInsideTheSentinelRoot()
+    {
+        using AutomationRoot fixture = new();
+        string descriptor = fixture.WriteDescriptor();
+
+        AutomationBootstrap bootstrap = AutomationBootstrap.ParseAndClaim(
+            [AutomationBootstrap.Argument, descriptor]);
+        IAppPathProvider paths = new IsolatedAppPathProvider(bootstrap.IsolationRoot!);
+
+        Assert.True(bootstrap.Enabled);
+        Assert.True(File.Exists(descriptor + ".claimed"));
+        Assert.All(new[]
+        {
+            paths.SettingsPath,
+            paths.LogDirectory,
+            paths.SingletonDirectory,
+            paths.DefaultCodexHome,
+            paths.RequiredSqliteHomeOverride!,
+            paths.UpdateDownloadDirectory,
+            paths.UpdaterRoot,
+            paths.StartupErrorPath,
+            paths.AutomationTracePath!
+        }, path => Assert.True(paths.Contains(path), path));
+
+        InvalidOperationException replay = Assert.Throws<InvalidOperationException>(() =>
+            AutomationBootstrap.ParseAndClaim([AutomationBootstrap.Argument, descriptor]));
+        Assert.Contains("replay", replay.Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void DescriptorOutsideDeclaredRoot_IsRejectedWithoutAClaim()
+    {
+        using AutomationRoot fixture = new();
+        string other = Path.Combine(Path.GetDirectoryName(fixture.Root)!, $"outside-{Guid.NewGuid():N}.json");
+        try
+        {
+            fixture.WriteDescriptor(other);
+            Assert.Throws<InvalidDataException>(() =>
+                AutomationBootstrap.ParseAndClaim([AutomationBootstrap.Argument, other]));
+            Assert.False(File.Exists(other + ".claimed"));
+        }
+        finally
+        {
+            File.Delete(other);
+        }
+    }
+
+    [Fact]
+    public void MissingOrWrongSentinel_RandomPipeTokenAndExactArguments_AreFailClosed()
+    {
+        using AutomationRoot missingSentinel = new(createSentinel: false);
+        string missingDescriptor = missingSentinel.WriteDescriptor();
+        Assert.ThrowsAny<Exception>(() =>
+            AutomationBootstrap.ParseAndClaim([AutomationBootstrap.Argument, missingDescriptor]));
+
+        using AutomationRoot invalidPipe = new();
+        string invalidPipeDescriptor = invalidPipe.WriteDescriptor(pipeName: "CodexProviderSync.Automation.fixed");
+        Assert.Throws<InvalidDataException>(() =>
+            AutomationBootstrap.ParseAndClaim([AutomationBootstrap.Argument, invalidPipeDescriptor]));
+
+        using AutomationRoot invalidToken = new();
+        string invalidTokenDescriptor = invalidToken.WriteDescriptor(token: "abcd");
+        Assert.Throws<InvalidDataException>(() =>
+            AutomationBootstrap.ParseAndClaim([AutomationBootstrap.Argument, invalidTokenDescriptor]));
+
+        using AutomationRoot lowEntropyToken = new();
+        string lowEntropyDescriptor = lowEntropyToken.WriteDescriptor(token: new string('a', 64));
+        Assert.Throws<InvalidDataException>(() =>
+            AutomationBootstrap.ParseAndClaim([AutomationBootstrap.Argument, lowEntropyDescriptor]));
+
+        Assert.Throws<InvalidOperationException>(() =>
+            AutomationBootstrap.ParseAndClaim([AutomationBootstrap.Argument]));
+        Assert.Throws<InvalidOperationException>(() =>
+            AutomationBootstrap.ParseAndClaim([AutomationBootstrap.Argument, "x", "--extra"]));
+        Assert.Throws<InvalidOperationException>(() =>
+            AutomationBootstrap.ParseAndClaim(["--gui-automation-descripto", "x"]));
+    }
+
+    [Fact]
+    public void NormalArguments_DoNotEnableOrClaimAutomation()
+    {
+        AutomationBootstrap bootstrap = AutomationBootstrap.ParseAndClaim(["--apply-update"]);
+        Assert.False(bootstrap.Enabled);
+    }
+
+    [Fact]
+    public void IsolatedSingleInstanceGuard_UsesOnlyInjectedPathAndKeepsAProcessLease()
+    {
+        using AutomationRoot fixture = new();
+        IAppPathProvider paths = new IsolatedAppPathProvider(fixture.Root);
+        AppInstanceGuard guard = new(paths);
+
+        using AppInstanceAcquisition first = guard.Acquire();
+        using AppInstanceAcquisition second = guard.Acquire();
+        Assert.True(first.IsOwner);
+        Assert.False(second.IsOwner);
+        Assert.True(paths.Contains(paths.SingletonDirectory));
+
+        first.Dispose();
+        using AppInstanceAcquisition third = guard.Acquire();
+        Assert.True(third.IsOwner);
+    }
+
+    [Fact]
+    public async Task AutomationSettings_AreSanitizedBeforeControllerInitialization()
+    {
+        using AutomationRoot fixture = new();
+        IAppPathProvider paths = new IsolatedAppPathProvider(fixture.Root);
+        SettingsService settings = new(paths.SettingsPath);
+        string outside = Path.Combine(Path.GetDirectoryName(fixture.Root)!, "real-user-data");
+        settings.Save(new AppSettings
+        {
+            LastCodexHome = outside,
+            RecentCodexHomes = [outside],
+            SqliteHomeOverrides = new Dictionary<string, string> { [outside] = outside },
+            LastBackupDirectory = outside,
+            ManualProviders = ["kept-provider"]
+        });
+
+        AutomationIsolation.PrepareSettings(settings, paths);
+
+        AppSettings sanitized = await settings.LoadAsync();
+        Assert.Equal(paths.DefaultCodexHome, sanitized.LastCodexHome);
+        Assert.All(sanitized.RecentCodexHomes, path => Assert.True(paths.Contains(path)));
+        Assert.Equal(
+            paths.RequiredSqliteHomeOverride,
+            sanitized.SqliteHomeOverrides[paths.DefaultCodexHome]);
+        Assert.Null(sanitized.LastBackupDirectory);
+        Assert.Equal(["kept-provider"], sanitized.ManualProviders);
+        Assert.True(Directory.Exists(paths.DefaultCodexHome));
+        Assert.True(Directory.Exists(paths.RequiredSqliteHomeOverride));
+    }
+
+    [Fact]
+    public void ExternalConfigAndEnvironmentSqliteHomes_CannotEscapeTheAutomationRoot()
+    {
+        using AutomationRoot fixture = new();
+        IAppPathProvider paths = new IsolatedAppPathProvider(fixture.Root);
+        SettingsService settings = new(paths.SettingsPath);
+        AutomationIsolation.PrepareSettings(settings, paths);
+        using MainForm form = new(
+            new ExecutionLogService(paths.LogDirectory),
+            settings,
+            paths: paths,
+            platformBoundary: new IsolatedAppPlatformBoundary(paths));
+
+        string outsideRoot = Path.Combine(
+            Path.GetDirectoryName(fixture.Root)!,
+            $"real-sqlite-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(outsideRoot);
+        string outsideDb = Path.Combine(outsideRoot, "state_5.sqlite");
+        File.WriteAllBytes(outsideDb, RandomNumberGenerator.GetBytes(256));
+        string before = Convert.ToHexString(SHA256.HashData(File.ReadAllBytes(outsideDb)));
+        try
+        {
+            (string codexHome, string? sqliteHome) = form.CaptureStorageSelection();
+            Assert.Equal(paths.DefaultCodexHome, codexHome);
+            Assert.Equal(paths.RequiredSqliteHomeOverride, sqliteHome);
+
+            string configText = $"model_provider = \"openai\"{Environment.NewLine}sqlite_home = \"{outsideRoot.Replace("\\", "/")}\"";
+            CodexStorageLayout resolved = new CodexStorageLayoutService().Resolve(
+                codexHome,
+                sqliteHome,
+                configText,
+                new Dictionary<string, string?>
+                {
+                    ["CODEX_SQLITE_HOME"] = outsideRoot
+                });
+            Assert.Equal(paths.RequiredSqliteHomeOverride, resolved.SqliteHome);
+            Assert.Equal("gui", resolved.SqliteHomeSource);
+
+            StatusSnapshot safe = CreateStatus(paths);
+            form.ValidateAutomationStatusSnapshot(safe);
+            Assert.Throws<InvalidOperationException>(() =>
+                form.ValidateAutomationStatusSnapshot(CreateStatus(paths, codexHome: outsideRoot)));
+            Assert.Throws<InvalidOperationException>(() =>
+                form.ValidateAutomationStatusSnapshot(CreateStatus(paths, sqliteHome: outsideRoot)));
+            Assert.Throws<InvalidOperationException>(() =>
+                form.ValidateAutomationStatusSnapshot(CreateStatus(paths, stateDbPath: outsideDb)));
+            Assert.Throws<InvalidOperationException>(() =>
+                form.ValidateAutomationStatusSnapshot(CreateStatus(paths, backupRoot: outsideRoot)));
+            Assert.Throws<InvalidOperationException>(() =>
+                form.ValidateAutomationStatusSnapshot(CreateStatus(paths, checkedStateDbPath: outsideDb)));
+            Assert.Throws<InvalidOperationException>(() =>
+                form.ValidateAutomationStatusSnapshot(CreateStatus(paths, lockedRolloutPath: outsideDb)));
+            Assert.Throws<InvalidOperationException>(() =>
+                form.ValidateAutomationStatusSnapshot(CreateStatus(paths, unreadableRolloutPath: outsideDb)));
+            Assert.Throws<InvalidOperationException>(() =>
+                form.ValidateAutomationStatusSnapshot(CreateStatus(paths, pendingPath: outsideRoot)));
+            Assert.Throws<InvalidOperationException>(() =>
+                form.EnsureAutomationMutationBoundary(codexHome, sqliteHome, outsideRoot));
+
+            string after = Convert.ToHexString(SHA256.HashData(File.ReadAllBytes(outsideDb)));
+            Assert.Equal(before, after);
+        }
+        finally
+        {
+            Directory.Delete(outsideRoot, recursive: true);
+        }
+    }
+
+    private static StatusSnapshot CreateStatus(
+        IAppPathProvider paths,
+        string? codexHome = null,
+        string? sqliteHome = null,
+        string? stateDbPath = null,
+        string? backupRoot = null,
+        string? checkedStateDbPath = null,
+        string? lockedRolloutPath = null,
+        string? unreadableRolloutPath = null,
+        string? pendingPath = null)
+    {
+        return new StatusSnapshot
+        {
+            CodexHome = codexHome ?? paths.DefaultCodexHome,
+            SqliteHome = sqliteHome ?? paths.RequiredSqliteHomeOverride!,
+            SqliteHomeSource = "gui",
+            CheckedStateDbPaths = checkedStateDbPath is null ? [] : [checkedStateDbPath],
+            CurrentProvider = new CurrentProviderInfo("openai", false),
+            ConfiguredProviders = ["openai"],
+            RolloutCounts = new ProviderCounts(),
+            LockedRolloutFiles = lockedRolloutPath is null ? [] : [lockedRolloutPath],
+            UnreadableRolloutFiles = unreadableRolloutPath is null ? [] : [unreadableRolloutPath],
+            EncryptedContentCounts = new ProviderCounts(),
+            SqliteCounts = null,
+            StateDbLocation = stateDbPath is null
+                ? null
+                : new StateDbLocation(stateDbPath, "state_5.sqlite", "sqlite-home"),
+            BackupRoot = backupRoot ?? Path.Combine(paths.DefaultCodexHome, "backups_state", "provider-sync"),
+            BackupSummary = new BackupSummary
+            {
+                Count = 0,
+                TotalBytes = 0
+            },
+            PendingTransactions = pendingPath is null
+                ? []
+                : [new TransactionRecoveryInfo(
+                    "operation",
+                    "prepared",
+                    pendingPath,
+                    Path.Combine(pendingPath, "transaction.jsonl"))]
+        };
+    }
+
+    private sealed class RejectingNetworkHandler : HttpMessageHandler
+    {
+        internal int RequestCount { get; private set; }
+
+        protected override Task<HttpResponseMessage> SendAsync(
+            HttpRequestMessage request,
+            CancellationToken cancellationToken)
+        {
+            RequestCount++;
+            return Task.FromException<HttpResponseMessage>(
+                new InvalidOperationException("The isolated update entry attempted network access."));
+        }
+    }
+
+    [Fact]
+    public async Task BoundedReader_RejectsMessagesOverTheProtocolLimit()
+    {
+        await using MemoryStream stream = new(Encoding.UTF8.GetBytes(new string('x', 33)));
+        await Assert.ThrowsAsync<InvalidDataException>(() => GuiAutomationBridge.ReadBoundedLineAsync(
+            stream,
+            maximumBytes: 32,
+            timeout: TimeSpan.FromSeconds(1),
+            cancellationToken: CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task WrongTokenSpendsTheSingleClientPipe_AndASecondClientCannotConnect()
+    {
+        if (!OperatingSystem.IsWindows())
+        {
+            return;
+        }
+        using AutomationRoot fixture = new();
+        IAppPathProvider paths = new IsolatedAppPathProvider(fixture.Root);
+        AutomationBootstrap bootstrap = new(
+            true,
+            fixture.WriteDescriptor(),
+            fixture.Root,
+            $"CodexProviderSync.Automation.{Guid.NewGuid():N}",
+            new string('a', 64));
+        using MainForm form = new(
+            new ExecutionLogService(paths.LogDirectory),
+            new SettingsService(paths.SettingsPath),
+            paths: paths,
+            platformBoundary: new IsolatedAppPlatformBoundary(paths));
+        using GuiAutomationBridge bridge = new(form, bootstrap, paths);
+        bridge.Start();
+
+        using NamedPipeClientStream first = new(".", bootstrap.PipeName!, PipeDirection.InOut, PipeOptions.Asynchronous);
+        await first.ConnectAsync(2000, CancellationToken.None);
+        byte[] request = Encoding.UTF8.GetBytes(
+            "{\"id\":\"one\",\"method\":\"ui.describe\",\"token\":\"" + new string('b', 64) + "\"}\n");
+        await first.WriteAsync(request, CancellationToken.None);
+        string? response = await GuiAutomationBridge.ReadBoundedLineAsync(
+            first,
+            GuiAutomationBridge.MaximumMessageBytes,
+            TimeSpan.FromSeconds(2),
+            CancellationToken.None);
+        Assert.Contains("authentication-failed", response, StringComparison.Ordinal);
+        first.Dispose();
+
+        using NamedPipeClientStream second = new(".", bootstrap.PipeName!, PipeDirection.InOut, PipeOptions.Asynchronous);
+        await Assert.ThrowsAnyAsync<Exception>(() => second.ConnectAsync(200, CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task AuthenticatedConnection_RejectsAReplayedRequestIdBeforeDispatch()
+    {
+        if (!OperatingSystem.IsWindows())
+        {
+            return;
+        }
+        using AutomationRoot fixture = new();
+        IAppPathProvider paths = new IsolatedAppPathProvider(fixture.Root);
+        string token = new('a', 64);
+        AutomationBootstrap bootstrap = new(
+            true,
+            fixture.WriteDescriptor(),
+            fixture.Root,
+            $"CodexProviderSync.Automation.{Guid.NewGuid():N}",
+            token);
+        using MainForm form = new(
+            new ExecutionLogService(paths.LogDirectory),
+            new SettingsService(paths.SettingsPath),
+            paths: paths,
+            platformBoundary: new IsolatedAppPlatformBoundary(paths));
+        using GuiAutomationBridge bridge = new(form, bootstrap, paths);
+        bridge.Start();
+
+        using NamedPipeClientStream client = new(
+            ".",
+            bootstrap.PipeName!,
+            PipeDirection.InOut,
+            PipeOptions.Asynchronous);
+        await client.ConnectAsync(2000, CancellationToken.None);
+        await WriteLineAsync(
+            client,
+            "{\"id\":\"replay\",\"method\":\"ui.describe\",\"token\":\"" + token + "\"}");
+        string? first = await GuiAutomationBridge.ReadBoundedLineAsync(
+            client,
+            GuiAutomationBridge.MaximumMessageBytes,
+            TimeSpan.FromSeconds(2),
+            CancellationToken.None);
+        Assert.Contains("\"ok\":true", first, StringComparison.Ordinal);
+
+        await WriteLineAsync(client, "{\"id\":\"replay\",\"method\":\"ui.describe\"}");
+        string? replay = await GuiAutomationBridge.ReadBoundedLineAsync(
+            client,
+            GuiAutomationBridge.MaximumMessageBytes,
+            TimeSpan.FromSeconds(2),
+            CancellationToken.None);
+        Assert.Contains("request-replayed", replay, StringComparison.Ordinal);
+    }
+
+    private static async Task WriteLineAsync(Stream stream, string value)
+    {
+        byte[] payload = Encoding.UTF8.GetBytes(value + "\n");
+        await stream.WriteAsync(payload, CancellationToken.None);
+        await stream.FlushAsync(CancellationToken.None);
+    }
+
+    private sealed class AutomationRoot : IDisposable
+    {
+        internal AutomationRoot(bool createSentinel = true)
+        {
+            Root = Path.Combine(Path.GetTempPath(), $"codex-provider-gui-bootstrap-{Guid.NewGuid():N}");
+            Directory.CreateDirectory(Root);
+            if (createSentinel)
+            {
+                File.WriteAllText(
+                    Path.Combine(Root, AutomationBootstrap.SentinelFileName),
+                    AutomationBootstrap.SentinelContent);
+            }
+        }
+
+        internal string Root { get; }
+
+        internal string WriteDescriptor(
+            string? path = null,
+            string? pipeName = null,
+            string? token = null)
+        {
+            path ??= Path.Combine(Root, "automation.json");
+            File.WriteAllText(path, JsonSerializer.Serialize(new
+            {
+                schemaVersion = 1,
+                isolationRoot = Root,
+                pipeName = pipeName ?? $"CodexProviderSync.Automation.{Guid.NewGuid():N}",
+                token = token ?? Convert.ToHexString(System.Security.Cryptography.RandomNumberGenerator.GetBytes(32)).ToLowerInvariant()
+            }));
+            return path;
+        }
+
+        public void Dispose()
+        {
+            if (Directory.Exists(Root))
+            {
+                Directory.Delete(Root, recursive: true);
+            }
+        }
+    }
+}
diff --git a/desktop/CodexProviderSync.App.Tests/GuiAutomationBridgeTests.cs b/desktop/CodexProviderSync.App.Tests/GuiAutomationBridgeTests.cs
new file mode 100644
index 0000000..0269163
--- /dev/null
+++ b/desktop/CodexProviderSync.App.Tests/GuiAutomationBridgeTests.cs
@@ -0,0 +1,246 @@
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Windows.Forms;
+using CodexProviderSync.App.Automation;
+using CodexProviderSync.Application;
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.App.Tests;
+
+public sealed class GuiAutomationBridgeTests
+{
+    [Fact]
+    public async Task Set_ChangesTheRealMainFormControl_RaisesItsEvent_AndWritesAnExplicitTrace()
+    {
+        using Fixture fixture = new();
+        TextBox input = fixture.Form.Controls.Find(GuiAutomationCatalog.Ids.ManualProviderId, true)
+            .OfType<TextBox>()
+            .Single();
+        int observedEvents = 0;
+        input.TextChanged += (_, _) => observedEvents++;
+        GuiAutomationRequest request = GuiAutomationRequest.Parse(
+            "{\"id\":\"set-1\",\"method\":\"ui.set\",\"params\":{\"automationId\":\"provider.manualId\",\"value\":\"isolated-provider\"}}");
+
+        JsonNode? result = await fixture.Dispatcher.DispatchAsync(
+            request,
+            CancellationToken.None);
+
+        Assert.Equal("isolated-provider", input.Text);
+        Assert.Equal(1, observedEvents);
+        Assert.Equal("isolated-provider", result!["value"]!.GetValue<string>());
+        string trace = File.ReadAllText(fixture.TracePath);
+        Assert.Contains("\"automationId\":\"provider.manualId\"", trace, StringComparison.Ordinal);
+        Assert.Contains("\"guiEvent\":\"TextChanged\"", trace, StringComparison.Ordinal);
+        Assert.Contains("\"eventObserved\":true", trace, StringComparison.Ordinal);
+        Assert.Contains("\"applicationOperationLinked\":false", trace, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task DescribeSnapshotAndGet_AreBoundToTheManifestAndRuntimeDenominator()
+    {
+        using Fixture fixture = new();
+        JsonNode? describe = await fixture.Dispatch("ui.describe");
+        JsonNode? snapshot = await fixture.Dispatch("ui.snapshot");
+        JsonNode? get = await fixture.Dispatch(
+            "ui.get",
+            "{\"automationId\":\"state.operation\"}");
+
+        Assert.Equal("0.4", describe!["schemaVersion"]!.GetValue<string>());
+        Assert.Equal(31, snapshot!["controls"]!.AsArray().Count);
+        Assert.Equal("state.operation", get!["automationId"]!.GetValue<string>());
+        Assert.Equal("就绪", get["value"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public async Task UnknownMethodAndUnknownControl_AreRejected()
+    {
+        Assert.Throws<InvalidDataException>(() => GuiAutomationRequest.Parse(
+            "{\"id\":\"bad\",\"method\":\"application.sync\"}"));
+
+        using Fixture fixture = new();
+        GuiAutomationRequest request = GuiAutomationRequest.Parse(
+            "{\"id\":\"missing\",\"method\":\"ui.get\",\"params\":{\"automationId\":\"missing.control\"}}");
+        await Assert.ThrowsAsync<KeyNotFoundException>(() => fixture.Dispatcher.DispatchAsync(
+            request,
+            CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task Set_RejectsDisabledRealControl()
+    {
+        using Fixture fixture = new();
+        TextBox input = fixture.Form.Controls.Find(GuiAutomationCatalog.Ids.ManualProviderId, true)
+            .OfType<TextBox>()
+            .Single();
+        input.Enabled = false;
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(() =>
+            fixture.Dispatch(
+                "ui.set",
+                "{\"automationId\":\"provider.manualId\",\"value\":\"blocked\"}"));
+
+        Assert.Contains("disabled", error.Message, StringComparison.OrdinalIgnoreCase);
+        Assert.Equal(string.Empty, input.Text);
+    }
+
+    [Fact]
+    public async Task AutomationStorageInputs_CannotEscapeTheIsolationRoot()
+    {
+        using Fixture fixture = new();
+        string outside = Path.Combine(Path.GetDirectoryName(fixture.Root)!, "real-codex-home");
+        string json = JsonSerializer.Serialize(new
+        {
+            id = "escape",
+            method = "ui.set",
+            @params = new
+            {
+                automationId = GuiAutomationCatalog.Ids.CodexHome,
+                value = outside
+            }
+        });
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() => fixture.Dispatcher.DispatchAsync(
+            GuiAutomationRequest.Parse(json),
+            CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task DynamicProviderAndRecentHomeIds_SelectRealItemsAndRaiseRealEvents()
+    {
+        using Fixture fixture = new();
+        AppController controller = Field<AppController>(fixture.Form, "_appController");
+        controller.ApplyProviderOptions(
+        [
+            new ProviderOption
+            {
+                Id = "relay-a",
+                Sources = [ProviderSource.Config]
+            },
+            new ProviderOption
+            {
+                Id = "relay-b",
+                Sources = [ProviderSource.Manual],
+                IsManual = true
+            }
+        ], "relay-a");
+        Invoke(fixture.Form, "ReloadProviderList");
+
+        ListView providers = fixture.Form.Controls.Find(GuiAutomationCatalog.Ids.ProviderList, true)
+            .OfType<ListView>()
+            .Single();
+        _ = fixture.Form.Handle;
+        _ = providers.Handle;
+        ListViewItem relayB = providers.Items.Cast<ListViewItem>()
+            .Single(item => string.Equals(item.Tag as string, "relay-b", StringComparison.Ordinal));
+        int providerEvents = 0;
+        providers.SelectedIndexChanged += (_, _) => providerEvents++;
+
+        JsonNode? providerResult = await fixture.Dispatch(
+            "ui.set",
+            JsonSerializer.Serialize(new { automationId = relayB.Name, value = true }));
+
+        Assert.True(relayB.Selected);
+        Assert.True(providerEvents > 0);
+        Assert.Equal("relay-b", controller.Snapshot.SelectedProviderId);
+        Assert.True(providerResult!["selected"]!.GetValue<bool>());
+
+        ComboBox recentHomes = fixture.Form.Controls.Find(GuiAutomationCatalog.Ids.CodexHome, true)
+            .OfType<ComboBox>()
+            .Single();
+        AutomationComboBoxItem recent = GuiAutomationCatalog.RecentCodexHome(fixture.Root);
+        recentHomes.Items.Add(recent);
+        int recentEvents = 0;
+        recentHomes.SelectedIndexChanged += (_, _) => recentEvents++;
+
+        JsonNode? recentResult = await fixture.Dispatch(
+            "ui.set",
+            JsonSerializer.Serialize(new { automationId = recent.AutomationId, value = true }));
+
+        Assert.Same(recent, recentHomes.SelectedItem);
+        Assert.Equal(1, recentEvents);
+        Assert.True(recentResult!["selected"]!.GetValue<bool>());
+        string trace = File.ReadAllText(fixture.TracePath);
+        Assert.Contains(relayB.Name, trace, StringComparison.Ordinal);
+        Assert.Contains(recent.AutomationId, trace, StringComparison.Ordinal);
+        Assert.Contains("SelectedIndexChanged", trace, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task CancelledQueuedUiAction_CannotExecuteAfterCancellationIsReported()
+    {
+        Action? queued = null;
+        int executions = 0;
+        using CancellationTokenSource cancellation = new();
+        Task<int> pending = GuiAutomationDispatcher.RunScheduledOnceAsync(
+            callback => queued = callback,
+            () => ++executions,
+            cancellation.Token);
+
+        Assert.NotNull(queued);
+        cancellation.Cancel();
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(async () => await pending);
+
+        queued!();
+        Assert.Equal(0, executions);
+    }
+
+    private static T Field<T>(MainForm form, string name) where T : class
+    {
+        return (T)(typeof(MainForm)
+            .GetField(name, System.Reflection.BindingFlags.Instance | System.Reflection.BindingFlags.NonPublic)
+            ?.GetValue(form)
+            ?? throw new InvalidOperationException($"Missing MainForm field {name}."));
+    }
+
+    private static void Invoke(MainForm form, string name)
+    {
+        typeof(MainForm)
+            .GetMethod(name, System.Reflection.BindingFlags.Instance | System.Reflection.BindingFlags.NonPublic)
+            ?.Invoke(form, null);
+    }
+
+    private sealed class Fixture : IDisposable
+    {
+        private readonly string _root = Path.Combine(
+            Path.GetTempPath(),
+            $"codex-provider-gui-bridge-{Guid.NewGuid():N}");
+        private int _requestId;
+
+        internal Fixture()
+        {
+            Directory.CreateDirectory(_root);
+            IAppPathProvider paths = new IsolatedAppPathProvider(_root);
+            TracePath = paths.AutomationTracePath!;
+            Form = new MainForm(
+                new ExecutionLogService(paths.LogDirectory),
+                new SettingsService(paths.SettingsPath),
+                paths: paths,
+                platformBoundary: new IsolatedAppPlatformBoundary(paths));
+            Dispatcher = new GuiAutomationDispatcher(Form, new GuiAutomationTraceSink(TracePath));
+        }
+
+        internal MainForm Form { get; }
+        internal GuiAutomationDispatcher Dispatcher { get; }
+        internal string TracePath { get; }
+        internal string Root => _root;
+
+        internal Task<JsonNode?> Dispatch(string method, string parameters = "{}")
+        {
+            string request = JsonSerializer.Serialize(new
+            {
+                id = $"request-{++_requestId}",
+                method,
+                @params = JsonDocument.Parse(parameters).RootElement
+            });
+            return Dispatcher.DispatchAsync(
+                GuiAutomationRequest.Parse(request),
+                CancellationToken.None);
+        }
+
+        public void Dispose()
+        {
+            Form.Dispose();
+            Directory.Delete(_root, recursive: true);
+        }
+    }
+}
diff --git a/desktop/CodexProviderSync.App.Tests/GuiAutomationManifestTests.cs b/desktop/CodexProviderSync.App.Tests/GuiAutomationManifestTests.cs
new file mode 100644
index 0000000..f91868a
--- /dev/null
+++ b/desktop/CodexProviderSync.App.Tests/GuiAutomationManifestTests.cs
@@ -0,0 +1,327 @@
+using System.Drawing;
+using System.Reflection;
+using System.Text.Json;
+using System.Windows.Forms;
+using CodexProviderSync.App.Automation;
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.App.Tests;
+
+/// <summary>
+/// Contract tests for the static manifest and the real MainForm control tree.
+/// These are in-process WinForms tests, not headful GUI E2E evidence.
+/// </summary>
+public sealed class GuiAutomationManifestTests
+{
+    [Fact]
+    public void RealMainForm_RuntimeDenominatorMatchesManifestWithoutMissingOrDuplicateIds()
+    {
+        using JsonDocument manifest = LoadManifest();
+        using IsolatedMainForm fixture = new();
+
+        JsonElement root = manifest.RootElement;
+        JsonElement window = root.GetProperty("window");
+        JsonElement[] declaredControls = root.GetProperty("controls").EnumerateArray().ToArray();
+        Dictionary<string, JsonElement> declaredById = declaredControls.ToDictionary(
+            declaration => declaration.GetProperty("id").GetString()!,
+            StringComparer.Ordinal);
+
+        Control[] runtimeDenominator = EnumerateRuntimeDenominator(fixture.Form).ToArray();
+        Assert.Equal(31, runtimeDenominator.Length);
+        Assert.All(runtimeDenominator, control =>
+        {
+            Assert.False(string.IsNullOrWhiteSpace(control.Name));
+            Assert.False(string.IsNullOrWhiteSpace(control.AccessibleName));
+            Assert.Equal($"AutomationId:{control.Name}", control.AccessibleDescription);
+        });
+        Button browse = fixture.Form.Controls.Find(GuiAutomationCatalog.Ids.BrowseCodexHome, true)
+            .OfType<Button>()
+            .Single();
+        Assert.Equal(browse.Text, browse.AccessibleName);
+        Assert.NotEqual(browse.Name, browse.AccessibleName);
+
+        string[] runtimeIds = runtimeDenominator.Select(control => control.Name).ToArray();
+        Assert.DoesNotContain(
+            runtimeIds.GroupBy(id => id, StringComparer.Ordinal),
+            group => group.Count() > 1);
+
+        HashSet<string> declaredIds = declaredById.Keys.ToHashSet(StringComparer.Ordinal);
+        declaredIds.Add(window.GetProperty("id").GetString()!);
+        Assert.Equal(declaredIds.Order(StringComparer.Ordinal), runtimeIds.Order(StringComparer.Ordinal));
+
+        Assert.Equal("0.4", root.GetProperty("schemaVersion").GetString());
+        Assert.Equal(26, declaredControls.Count(control => control.GetProperty("logicalControl").GetBoolean()));
+        Assert.Equal(GuiAutomationCatalog.Ids.MainWindow, window.GetProperty("id").GetString());
+        Assert.Equal("Form", window.GetProperty("controlType").GetString());
+        Assert.All(window.GetProperty("actions").EnumerateArray(), action =>
+            Assert.True(
+                GuiAutomationActionCoverage.SupportsControl(fixture.Form, action.GetString()!),
+                $"Missing window action implementation: {action.GetString()}"));
+
+        foreach (Control control in runtimeDenominator.Where(control => control != fixture.Form))
+        {
+            JsonElement declaration = declaredById[control.Name];
+            Assert.Equal(control.GetType().Name, declaration.GetProperty("controlType").GetString());
+            Assert.NotEmpty(declaration.GetProperty("actions").EnumerateArray());
+            Assert.False(string.IsNullOrWhiteSpace(declaration.GetProperty("visibleWhen").GetString()));
+            Assert.False(string.IsNullOrWhiteSpace(declaration.GetProperty("enabledWhen").GetString()));
+            Assert.Equal(JsonValueKind.Array, declaration.GetProperty("applicationCapabilities").ValueKind);
+            Assert.True(declaration.GetProperty("uiOnly").ValueKind is JsonValueKind.True or JsonValueKind.False);
+            Assert.False(string.IsNullOrWhiteSpace(declaration.GetProperty("risk").GetString()));
+            Assert.NotEmpty(declaration.GetProperty("scenarioIds").EnumerateArray());
+            Assert.All(declaration.GetProperty("actions").EnumerateArray(), action =>
+                Assert.True(
+                    GuiAutomationActionCoverage.SupportsControl(control, action.GetString()!),
+                    $"Missing action implementation: {control.Name}.{action.GetString()}"));
+        }
+    }
+
+    [Fact]
+    public void RealMainForm_StableIdsSurvivePresentationAndBusyStateChanges()
+    {
+        using IsolatedMainForm fixture = new();
+        MainForm form = fixture.Form;
+        Dictionary<Control, (string Name, string? AccessibleName)> before =
+            EnumerateRuntimeDenominator(form).ToDictionary(
+                control => control,
+                control => (control.Name, control.AccessibleName));
+
+        Field<CheckBox>(form, "_updateConfigCheck").Checked = true;
+        Field<RadioButton>(form, "_modelCustomRadio").Checked = true;
+        Field<TextBox>(form, "_modelCustomText").Text = "example-model";
+        Field<ComboBox>(form, "_codexHomeCombo").Text = fixture.HomeA;
+        Invoke(form, "SetBusy", true, "执行中...");
+        Invoke(form, "SetBusy", false, "就绪");
+        form.Size = form.MinimumSize;
+        form.PerformLayout();
+
+        Control[] after = EnumerateRuntimeDenominator(form).ToArray();
+        Assert.Equal(before.Count, after.Length);
+        Assert.All(after, control => Assert.Equal(before[control], (control.Name, control.AccessibleName)));
+    }
+
+    [Fact]
+    public void DynamicEntries_UseDeclaredTemplatesAndOrderIndependentHashedInstanceKeys()
+    {
+        using JsonDocument manifest = LoadManifest();
+        string[] templateIds = manifest.RootElement.GetProperty("templates")
+            .EnumerateArray()
+            .Select(template => template.GetProperty("id").GetString()!)
+            .Order(StringComparer.Ordinal)
+            .ToArray();
+        Assert.Equal(
+            new[] { GuiAutomationCatalog.Templates.ProviderRow, GuiAutomationCatalog.Templates.RecentCodexHome }
+                .Order(StringComparer.Ordinal),
+            templateIds);
+        Assert.All(manifest.RootElement.GetProperty("templates").EnumerateArray(), template =>
+        {
+            string templateId = template.GetProperty("id").GetString()!;
+            Assert.All(template.GetProperty("actions").EnumerateArray(), action =>
+                Assert.True(
+                    GuiAutomationActionCoverage.SupportsTemplate(templateId, action.GetString()!),
+                    $"Missing template action implementation: {templateId}.{action.GetString()}"));
+        });
+
+        ListViewItem firstProviderRow = new("visible text one");
+        ListViewItem secondProviderRow = new("different visible text");
+        GuiAutomationCatalog.RegisterProviderRow(firstProviderRow, "  api-gather  ");
+        GuiAutomationCatalog.RegisterProviderRow(secondProviderRow, "api-gather");
+        Assert.Equal(firstProviderRow.Name, secondProviderRow.Name);
+        Assert.StartsWith($"{GuiAutomationCatalog.Templates.ProviderRow}:", firstProviderRow.Name, StringComparison.Ordinal);
+        Assert.DoesNotContain("api-gather", firstProviderRow.Name, StringComparison.OrdinalIgnoreCase);
+
+        using IsolatedMainForm fixture = new();
+        SetField(fixture.Form, "_settings", new AppSettings
+        {
+            RecentCodexHomes = [fixture.HomeA, fixture.HomeB]
+        });
+        Invoke(fixture.Form, "ReloadRecentHomes");
+        ComboBox combo = Field<ComboBox>(fixture.Form, "_codexHomeCombo");
+        AutomationComboBoxItem[] original = combo.Items.Cast<AutomationComboBoxItem>().ToArray();
+        Assert.Equal([fixture.HomeA, fixture.HomeB], original.Select(item => item.Value));
+        AutomationComboBoxItem equivalentRecentHome = GuiAutomationCatalog.RecentCodexHome(
+            fixture.HomeA.ToUpperInvariant() + Path.DirectorySeparatorChar);
+        Assert.Equal(original[0].InstanceKey, equivalentRecentHome.InstanceKey);
+        Assert.All(original, item =>
+        {
+            Assert.Equal(GuiAutomationCatalog.Templates.RecentCodexHome, item.TemplateId);
+            Assert.StartsWith($"{GuiAutomationCatalog.Templates.RecentCodexHome}:", item.AutomationId, StringComparison.Ordinal);
+            Assert.DoesNotContain(item.Value, item.AutomationId, StringComparison.OrdinalIgnoreCase);
+        });
+        combo.SelectedIndex = 0;
+        Assert.Equal(fixture.HomeA, combo.Text);
+        Assert.Equal(fixture.HomeA, fixture.Form.CaptureStorageSelection().CodexHome);
+
+        SetField(fixture.Form, "_settings", new AppSettings
+        {
+            RecentCodexHomes = [fixture.HomeB, fixture.HomeA]
+        });
+        Invoke(fixture.Form, "ReloadRecentHomes");
+        Dictionary<string, string> reordered = combo.Items.Cast<AutomationComboBoxItem>()
+            .ToDictionary(item => item.Value, item => item.InstanceKey, StringComparer.OrdinalIgnoreCase);
+        Dictionary<string, string> originalKeys = original.ToDictionary(
+            item => item.Value,
+            item => item.InstanceKey,
+            StringComparer.OrdinalIgnoreCase);
+        Assert.Equal(originalKeys.OrderBy(pair => pair.Key), reordered.OrderBy(pair => pair.Key));
+    }
+
+    [Fact]
+    public void Manifest_DialogOwnershipAndExemptionsAreExplicitAndNarrow()
+    {
+        using JsonDocument manifest = LoadManifest();
+        JsonElement root = manifest.RootElement;
+        JsonElement[] dialogs = root.GetProperty("dialogs").EnumerateArray().ToArray();
+        JsonElement[] nativePickers = dialogs
+            .Where(dialog => dialog.GetProperty("kind").GetString() == "native-folder-picker")
+            .ToArray();
+        Assert.Equal(3, nativePickers.Length);
+        Assert.All(nativePickers, dialog =>
+        {
+            Assert.Equal("windows-shell", dialog.GetProperty("owner").GetString());
+            Assert.Equal("native-folder-picker-internals", dialog.GetProperty("exemptionId").GetString());
+            Assert.NotEmpty(dialog.GetProperty("launchControlId").GetString()!);
+        });
+
+        JsonElement[] applicationDialogs = dialogs
+            .Where(dialog => dialog.GetProperty("owner").GetString() == "application")
+            .ToArray();
+        Assert.NotEmpty(applicationDialogs);
+        Assert.All(applicationDialogs, dialog =>
+        {
+            Assert.Equal("native-message-box-internals", dialog.GetProperty("exemptionId").GetString());
+            Assert.NotEmpty(dialog.GetProperty("actions").EnumerateArray());
+            Assert.NotEmpty(dialog.GetProperty("scenarioIds").EnumerateArray());
+        });
+
+        Dictionary<string, JsonElement> exemptions = root.GetProperty("exemptions")
+            .EnumerateArray()
+            .ToDictionary(item => item.GetProperty("id").GetString()!, StringComparer.Ordinal);
+        Assert.Equal(3, exemptions.Count);
+        Assert.Contains("native-folder-picker-internals", exemptions.Keys);
+        Assert.Contains("native-message-box-internals", exemptions.Keys);
+        Assert.Contains("framework-composite-internals", exemptions.Keys);
+        Assert.Equal(3, exemptions["native-folder-picker-internals"]
+            .GetProperty("doesNotExempt")
+            .GetArrayLength());
+    }
+
+    [Fact]
+    public void Manifest_IsEmbeddedAndCopiedBesideTheApplication()
+    {
+        Assembly assembly = typeof(MainForm).Assembly;
+        Assert.Contains(GuiAutomationCatalog.ManifestResourceName, assembly.GetManifestResourceNames());
+
+        string outputManifest = Path.Combine(
+            Path.GetDirectoryName(assembly.Location)!,
+            "Automation",
+            "gui-automation-manifest.v0.4.json");
+        Assert.True(File.Exists(outputManifest), $"Expected copied static manifest at {outputManifest}.");
+    }
+
+    private static JsonDocument LoadManifest()
+    {
+        Stream stream = typeof(MainForm).Assembly.GetManifestResourceStream(GuiAutomationCatalog.ManifestResourceName)
+            ?? throw new InvalidOperationException("Embedded GUI automation manifest was not found.");
+        return JsonDocument.Parse(stream);
+    }
+
+    private static IEnumerable<Control> EnumerateRuntimeDenominator(MainForm form)
+    {
+        yield return form;
+        foreach (Control control in Descendants(form))
+        {
+            if (HasRegisteredCompositeAncestor(control))
+            {
+                continue;
+            }
+
+            if (control is ButtonBase or TextBoxBase or ComboBox or ListView or NumericUpDown
+                || IsMeaningfulStateSurface(control))
+            {
+                yield return control;
+            }
+        }
+    }
+
+    private static bool HasRegisteredCompositeAncestor(Control control)
+    {
+        for (Control? ancestor = control.Parent; ancestor is not null; ancestor = ancestor.Parent)
+        {
+            if (ancestor is NumericUpDown)
+            {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private static bool IsMeaningfulStateSurface(Control control)
+    {
+        return control is Label label
+            && (label.Font.Bold
+                || label.ForeColor is var foreground && (foreground == Color.DarkGreen || foreground == Color.DarkOrange)
+                || label.BackColor == Color.FromArgb(255, 244, 214));
+    }
+
+    private static IEnumerable<Control> Descendants(Control control)
+    {
+        foreach (Control child in control.Controls)
+        {
+            yield return child;
+            foreach (Control descendant in Descendants(child))
+            {
+                yield return descendant;
+            }
+        }
+    }
+
+    private static T Field<T>(MainForm form, string name) where T : class
+    {
+        return typeof(MainForm)
+            .GetField(name, BindingFlags.Instance | BindingFlags.NonPublic)?
+            .GetValue(form) as T
+            ?? throw new InvalidOperationException($"Unable to read {name}.");
+    }
+
+    private static void SetField<T>(MainForm form, string name, T value)
+    {
+        FieldInfo field = typeof(MainForm).GetField(name, BindingFlags.Instance | BindingFlags.NonPublic)
+            ?? throw new InvalidOperationException($"Unable to find {name}.");
+        field.SetValue(form, value);
+    }
+
+    private static void Invoke(MainForm form, string name, params object[] arguments)
+    {
+        MethodInfo method = typeof(MainForm).GetMethod(name, BindingFlags.Instance | BindingFlags.NonPublic)
+            ?? throw new InvalidOperationException($"Unable to find {name}.");
+        method.Invoke(form, arguments);
+    }
+
+    private sealed class IsolatedMainForm : IDisposable
+    {
+        private readonly string _root = Path.Combine(
+            Path.GetTempPath(),
+            $"codex-provider-gui-manifest-{Guid.NewGuid():N}");
+
+        internal IsolatedMainForm()
+        {
+            Directory.CreateDirectory(_root);
+            HomeA = Path.Combine(_root, "home-a");
+            HomeB = Path.Combine(_root, "home-b");
+            Form = new MainForm(
+                new ExecutionLogService(Path.Combine(_root, "logs")),
+                new SettingsService(Path.Combine(_root, "settings.json")));
+        }
+
+        internal MainForm Form { get; }
+        internal string HomeA { get; }
+        internal string HomeB { get; }
+
+        public void Dispose()
+        {
+            Form.Dispose();
+            Directory.Delete(_root, recursive: true);
+        }
+    }
+}
diff --git a/desktop/CodexProviderSync.App/AppInstanceGuard.cs b/desktop/CodexProviderSync.App/AppInstanceGuard.cs
new file mode 100644
index 0000000..051cf15
--- /dev/null
+++ b/desktop/CodexProviderSync.App/AppInstanceGuard.cs
@@ -0,0 +1,86 @@
+using System.Text.Json;
+
+namespace CodexProviderSync.App;
+
+/// <summary>
+/// A path-injected, process-lifetime single-instance lease. The lock file is
+/// intentionally persistent: closing then deleting it would introduce an ABA
+/// window in which an exiting process could delete a new owner's lock.
+/// </summary>
+internal sealed class AppInstanceGuard(IAppPathProvider paths)
+{
+    internal AppInstanceAcquisition Acquire()
+    {
+        Directory.CreateDirectory(paths.SingletonDirectory);
+        string lockPath = Path.Combine(paths.SingletonDirectory, "instance.lock");
+        try
+        {
+            FileStream stream = new(
+                lockPath,
+                FileMode.OpenOrCreate,
+                FileAccess.ReadWrite,
+                FileShare.Read,
+                4096,
+                FileOptions.WriteThrough);
+            AppInstanceOwner owner = new(
+                Environment.ProcessId,
+                DateTimeOffset.UtcNow,
+                Environment.CurrentDirectory);
+            stream.SetLength(0);
+            JsonSerializer.Serialize(stream, owner, JsonOptions);
+            stream.Flush(flushToDisk: true);
+            return AppInstanceAcquisition.Owner(stream, owner);
+        }
+        catch (IOException)
+        {
+            return AppInstanceAcquisition.NonOwner(ReadOwner(lockPath));
+        }
+        catch (UnauthorizedAccessException)
+        {
+            return AppInstanceAcquisition.NonOwner(ReadOwner(lockPath));
+        }
+    }
+
+    private static AppInstanceOwner? ReadOwner(string lockPath)
+    {
+        try
+        {
+            using FileStream stream = new(lockPath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite);
+            return JsonSerializer.Deserialize<AppInstanceOwner>(stream, JsonOptions);
+        }
+        catch
+        {
+            return null;
+        }
+    }
+
+    private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web);
+}
+
+internal sealed record AppInstanceOwner(
+    int ProcessId,
+    DateTimeOffset StartedAt,
+    string CurrentDirectory);
+
+internal sealed class AppInstanceAcquisition : IDisposable
+{
+    private FileStream? _stream;
+
+    private AppInstanceAcquisition(bool isOwner, FileStream? stream, AppInstanceOwner? owner)
+    {
+        IsOwner = isOwner;
+        _stream = stream;
+        ExistingOwner = owner;
+    }
+
+    internal bool IsOwner { get; }
+    internal AppInstanceOwner? ExistingOwner { get; }
+
+    internal static AppInstanceAcquisition Owner(FileStream stream, AppInstanceOwner owner) =>
+        new(true, stream, owner);
+
+    internal static AppInstanceAcquisition NonOwner(AppInstanceOwner? owner) =>
+        new(false, null, owner);
+
+    public void Dispose() => Interlocked.Exchange(ref _stream, null)?.Dispose();
+}
diff --git a/desktop/CodexProviderSync.App/AppPaths.cs b/desktop/CodexProviderSync.App/AppPaths.cs
new file mode 100644
index 0000000..8110bb7
--- /dev/null
+++ b/desktop/CodexProviderSync.App/AppPaths.cs
@@ -0,0 +1,291 @@
+using System.Diagnostics;
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.App;
+
+internal interface IAppPathProvider
+{
+    bool IsAutomation { get; }
+    string? IsolationRoot { get; }
+    string SettingsPath { get; }
+    string LogDirectory { get; }
+    string SingletonDirectory { get; }
+    string DefaultCodexHome { get; }
+    string? RequiredSqliteHomeOverride { get; }
+    string UpdateDownloadDirectory { get; }
+    string UpdaterRoot { get; }
+    string StartupErrorPath { get; }
+    string? AutomationTracePath { get; }
+    bool Contains(string path);
+}
+
+internal sealed class SystemAppPathProvider : IAppPathProvider
+{
+    private readonly string _settingsDirectory = Path.Combine(
+        Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData),
+        "codex-provider-sync");
+
+    public bool IsAutomation => false;
+    public string? IsolationRoot => null;
+    public string SettingsPath => Path.Combine(_settingsDirectory, "settings.json");
+    public string LogDirectory => Path.Combine(_settingsDirectory, "logs");
+    public string SingletonDirectory => Path.Combine(_settingsDirectory, "singleton");
+    public string DefaultCodexHome => Path.Combine(
+        Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
+        ".codex");
+    public string? RequiredSqliteHomeOverride => null;
+    public string UpdateDownloadDirectory => Path.Combine(
+        Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+        "codex-provider-sync",
+        "updates");
+    public string UpdaterRoot => Path.Combine(Path.GetTempPath(), "codex-provider-sync-updater");
+    public string StartupErrorPath => Path.Combine(_settingsDirectory, "startup-error.log");
+    public string? AutomationTracePath => null;
+    public bool Contains(string path) => true;
+}
+
+internal sealed class IsolatedAppPathProvider : IAppPathProvider
+{
+    private readonly StringComparison _comparison = OperatingSystem.IsWindows()
+        ? StringComparison.OrdinalIgnoreCase
+        : StringComparison.Ordinal;
+
+    internal IsolatedAppPathProvider(string isolationRoot)
+    {
+        IsolationRoot = Path.TrimEndingDirectorySeparator(Path.GetFullPath(isolationRoot));
+    }
+
+    public bool IsAutomation => true;
+    public string IsolationRoot { get; }
+    string? IAppPathProvider.IsolationRoot => IsolationRoot;
+    public string SettingsPath => UnderRoot("appdata", "settings.json");
+    public string LogDirectory => UnderRoot("appdata", "logs");
+    public string SingletonDirectory => UnderRoot("appdata", "singleton");
+    public string DefaultCodexHome => UnderRoot("codex-home");
+    public string? RequiredSqliteHomeOverride => UnderRoot("sqlite-home");
+    public string UpdateDownloadDirectory => UnderRoot("updates", "downloads");
+    public string UpdaterRoot => UnderRoot("updates", "updater");
+    public string StartupErrorPath => UnderRoot("appdata", "startup-error.log");
+    public string? AutomationTracePath => UnderRoot("automation", "gui-trace.jsonl");
+
+    public bool Contains(string path)
+    {
+        string candidate = Path.GetFullPath(path);
+        string prefix = IsolationRoot + Path.DirectorySeparatorChar;
+        bool lexicallyContained = string.Equals(candidate, IsolationRoot, _comparison)
+            || candidate.StartsWith(prefix, _comparison);
+        if (!lexicallyContained)
+        {
+            return false;
+        }
+
+        string relative = Path.GetRelativePath(IsolationRoot, candidate);
+        string current = IsolationRoot;
+        foreach (string segment in relative.Split(
+            [Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar],
+            StringSplitOptions.RemoveEmptyEntries))
+        {
+            current = Path.Combine(current, segment);
+            if ((File.Exists(current) || Directory.Exists(current))
+                && (File.GetAttributes(current) & FileAttributes.ReparsePoint) != 0)
+            {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    private string UnderRoot(params string[] segments)
+    {
+        string path = segments.Aggregate(IsolationRoot, Path.Combine);
+        if (!Contains(path))
+        {
+            throw new InvalidOperationException($"Automation path escaped the isolation root: {path}");
+        }
+        return path;
+    }
+}
+
+internal static class AutomationIsolation
+{
+    internal static void PrepareSettings(SettingsService settingsService, IAppPathProvider paths)
+    {
+        if (!paths.IsAutomation)
+        {
+            return;
+        }
+        AppSettings current = settingsService.LoadAsync().GetAwaiter().GetResult();
+        string lastHome = SafeContains(paths, current.LastCodexHome)
+            ? Path.GetFullPath(current.LastCodexHome!)
+            : paths.DefaultCodexHome;
+        List<string> recents = current.RecentCodexHomes
+            .Where(path => SafeContains(paths, path))
+            .Select(Path.GetFullPath)
+            .ToList();
+        if (!recents.Contains(lastHome, OperatingSystem.IsWindows()
+            ? StringComparer.OrdinalIgnoreCase
+            : StringComparer.Ordinal))
+        {
+            recents.Insert(0, lastHome);
+        }
+        Dictionary<string, string> overrides = current.SqliteHomeOverrides
+            .Where(pair => SafeContains(paths, pair.Key) && SafeContains(paths, pair.Value))
+            .ToDictionary(
+                pair => Path.GetFullPath(pair.Key),
+                pair => Path.GetFullPath(pair.Value),
+                OperatingSystem.IsWindows() ? StringComparer.OrdinalIgnoreCase : StringComparer.Ordinal);
+
+        if (paths.RequiredSqliteHomeOverride is { } requiredSqliteHome)
+        {
+            Directory.CreateDirectory(requiredSqliteHome);
+            overrides[lastHome] = requiredSqliteHome;
+        }
+
+        Directory.CreateDirectory(lastHome);
+        settingsService.Save(new AppSettings
+        {
+            RecentCodexHomes = recents,
+            LastCodexHome = lastHome,
+            SqliteHomeOverrides = overrides,
+            SavedProviders = current.SavedProviders,
+            ManualProviders = current.ManualProviders,
+            LastSelectedProvider = current.LastSelectedProvider,
+            LastBackupDirectory = SafeContains(paths, current.LastBackupDirectory)
+                ? Path.GetFullPath(current.LastBackupDirectory!)
+                : null,
+            BackupRetentionCount = current.BackupRetentionCount,
+            UiLanguage = current.UiLanguage,
+            LastAutomaticUpdateCheckDate = current.LastAutomaticUpdateCheckDate,
+            WindowBounds = current.WindowBounds
+        });
+    }
+
+    private static bool SafeContains(IAppPathProvider paths, string? value)
+    {
+        if (string.IsNullOrWhiteSpace(value))
+        {
+            return false;
+        }
+        try
+        {
+            return paths.Contains(value);
+        }
+        catch (Exception error) when (error is IOException or UnauthorizedAccessException or ArgumentException or NotSupportedException)
+        {
+            return false;
+        }
+    }
+}
+
+internal interface IAppPlatformBoundary
+{
+    bool UpdatesEnabled { get; }
+    string? PickFolder(IWin32Window owner, FolderPickerRequest request);
+    Task<UpdateCheckResult> CheckForUpdateAsync(
+        UpdateService updateService,
+        Version currentVersion,
+        CancellationToken cancellationToken = default);
+    void OpenPath(string path);
+    void StartUpdate(string downloadedExePath, string targetExePath, string expectedSha256);
+}
+
+internal sealed record FolderPickerRequest(
+    string Description,
+    string InitialDirectory,
+    bool AllowCreate = false);
+
+internal static class AppFolderPickerDialog
+{
+    internal static FolderBrowserDialog Create(FolderPickerRequest request)
+    {
+        ArgumentNullException.ThrowIfNull(request);
+        return new FolderBrowserDialog
+        {
+            Description = request.Description,
+            UseDescriptionForTitle = true,
+            InitialDirectory = request.InitialDirectory,
+            ShowNewFolderButton = request.AllowCreate
+        };
+    }
+}
+
+internal sealed class SystemAppPlatformBoundary(IAppPathProvider paths) : IAppPlatformBoundary
+{
+    public bool UpdatesEnabled => true;
+
+    public string? PickFolder(IWin32Window owner, FolderPickerRequest request)
+    {
+        using FolderBrowserDialog dialog = AppFolderPickerDialog.Create(request);
+        return dialog.ShowDialog(owner) == DialogResult.OK ? dialog.SelectedPath : null;
+    }
+
+    public Task<UpdateCheckResult> CheckForUpdateAsync(
+        UpdateService updateService,
+        Version currentVersion,
+        CancellationToken cancellationToken = default) =>
+        updateService.CheckForUpdateAsync(currentVersion, cancellationToken);
+
+    public void OpenPath(string path)
+    {
+        _ = Process.Start(new ProcessStartInfo
+        {
+            FileName = path,
+            UseShellExecute = true
+        }) ?? throw new InvalidOperationException($"Unable to open {path}.");
+    }
+
+    public void StartUpdate(string downloadedExePath, string targetExePath, string expectedSha256) =>
+        UpdateApplier.Start(downloadedExePath, targetExePath, expectedSha256, paths.UpdaterRoot);
+}
+
+internal sealed class IsolatedAppPlatformBoundary(IAppPathProvider paths) : IAppPlatformBoundary
+{
+    public bool UpdatesEnabled => true;
+
+    public string? PickFolder(IWin32Window owner, FolderPickerRequest request)
+    {
+        EnsureContained(request.InitialDirectory);
+        using FolderBrowserDialog dialog = AppFolderPickerDialog.Create(request);
+        if (dialog.ShowDialog(owner) != DialogResult.OK)
+        {
+            return null;
+        }
+
+        EnsureContained(dialog.SelectedPath);
+        return Path.GetFullPath(dialog.SelectedPath);
+    }
+
+    public Task<UpdateCheckResult> CheckForUpdateAsync(
+        UpdateService updateService,
+        Version currentVersion,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(updateService);
+        ArgumentNullException.ThrowIfNull(currentVersion);
+        cancellationToken.ThrowIfCancellationRequested();
+        Version normalized = UpdateService.NormalizeVersion(currentVersion);
+        ReleaseInfo release = new($"v{normalized}", normalized, []);
+        return Task.FromResult(new UpdateCheckResult(
+            normalized,
+            release,
+            IsUpdateAvailable: false));
+    }
+
+    public void OpenPath(string path)
+    {
+        EnsureContained(path);
+        // Deliberately no shell launch in automation mode. The real button event
+        // still runs and reaches this boundary, which is recorded by the GUI trace.
+    }
+
+    public void StartUpdate(string downloadedExePath, string targetExePath, string expectedSha256) =>
+        throw new InvalidOperationException("Self-update is disabled in GUI automation mode.");
+
+    private void EnsureContained(string path)
+    {
+        if (!paths.Contains(path))
+        {
+            throw new InvalidOperationException($"Automation attempted to access a path outside its isolation root: {path}");
+        }
+    }
+}
diff --git a/desktop/CodexProviderSync.App/ApplicationOperationTracking.cs b/desktop/CodexProviderSync.App/ApplicationOperationTracking.cs
new file mode 100644
index 0000000..dd6262f
--- /dev/null
+++ b/desktop/CodexProviderSync.App/ApplicationOperationTracking.cs
@@ -0,0 +1,225 @@
+using CodexProviderSync.Application;
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.App;
+
+internal sealed record ApplicationOperationTraceRecord(
+    string OperationId,
+    ApplicationOperationKind Operation,
+    ApplicationOperationLifecycle Lifecycle,
+    DateTimeOffset StartedAtUtc,
+    DateTimeOffset CompletedAtUtc,
+    IReadOnlyList<string> ErrorCodes);
+
+internal static class GuiApplicationOutcomePolicy
+{
+    internal static bool IsAppliedSuccess<T>(
+        ApplicationOutcome<ApplicationWriteResult<T>> outcome)
+        where T : class =>
+        outcome.Lifecycle == ApplicationOperationLifecycle.Succeeded
+        && outcome.Data is { Applied: true, Result: not null };
+
+    internal static bool IsPlanStale<T>(
+        ApplicationOutcome<ApplicationWriteResult<T>> outcome)
+        where T : class =>
+        outcome.Errors.Any(
+            static error => string.Equals(error.Code, "plan_stale", StringComparison.Ordinal));
+}
+
+/// <summary>
+/// Carries the causal GUI invocation across WinForms async-event continuations.
+/// The bridge opens a window immediately around the real control event and the
+/// event handler closes it only after all Application work and the follow-up
+/// refresh have completed.
+/// </summary>
+internal sealed class ApplicationOperationTraceHub
+{
+    private readonly AsyncLocal<InvocationCorrelation?> _current = new();
+
+    internal ApplicationInvocationScope BeginInvocation(string requestId, string automationId)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(requestId);
+        ArgumentException.ThrowIfNullOrWhiteSpace(automationId);
+        InvocationCorrelation? previous = _current.Value;
+        ApplicationInvocationWindow window = new(requestId, automationId);
+        InvocationCorrelation correlation = new(window);
+        _current.Value = correlation;
+        return new ApplicationInvocationScope(this, correlation, previous, window);
+    }
+
+    internal void Publish<T>(ApplicationOutcome<T> outcome)
+        where T : class
+    {
+        ArgumentNullException.ThrowIfNull(outcome);
+        InvocationCorrelation? correlation = _current.Value;
+        if (correlation is null)
+        {
+            return;
+        }
+
+        _ = correlation.Window.TryAdd(new ApplicationOperationTraceRecord(
+            outcome.OperationId,
+            outcome.Operation,
+            outcome.Lifecycle,
+            outcome.StartedAtUtc,
+            outcome.CompletedAtUtc,
+            Array.AsReadOnly(outcome.Errors.Select(static error => error.Code).ToArray())));
+    }
+
+    internal void CompleteCurrentInvocation()
+    {
+        _current.Value?.Window.Complete();
+    }
+
+    private void Restore(
+        InvocationCorrelation correlation,
+        InvocationCorrelation? previous)
+    {
+        if (ReferenceEquals(_current.Value, correlation))
+        {
+            _current.Value = previous;
+        }
+    }
+
+    internal sealed record InvocationCorrelation(ApplicationInvocationWindow Window);
+
+    internal sealed class ApplicationInvocationScope : IDisposable
+    {
+        private readonly ApplicationOperationTraceHub _owner;
+        private readonly InvocationCorrelation _correlation;
+        private readonly InvocationCorrelation? _previous;
+        private int _disposed;
+
+        internal ApplicationInvocationScope(
+            ApplicationOperationTraceHub owner,
+            InvocationCorrelation correlation,
+            InvocationCorrelation? previous,
+            ApplicationInvocationWindow window)
+        {
+            _owner = owner;
+            _correlation = correlation;
+            _previous = previous;
+            Window = window;
+        }
+
+        internal ApplicationInvocationWindow Window { get; }
+
+        public void Dispose()
+        {
+            if (Interlocked.Exchange(ref _disposed, 1) == 0)
+            {
+                _owner.Restore(_correlation, _previous);
+            }
+        }
+    }
+}
+
+internal sealed class ApplicationInvocationWindow
+{
+    private readonly object _gate = new();
+    private readonly List<ApplicationOperationTraceRecord> _operations = [];
+    private readonly TaskCompletionSource<IReadOnlyList<ApplicationOperationTraceRecord>> _completion =
+        new(TaskCreationOptions.RunContinuationsAsynchronously);
+    private bool _completed;
+
+    internal ApplicationInvocationWindow(string requestId, string automationId)
+    {
+        RequestId = requestId;
+        AutomationId = automationId;
+    }
+
+    internal string RequestId { get; }
+
+    internal string AutomationId { get; }
+
+    internal bool TryAdd(ApplicationOperationTraceRecord operation)
+    {
+        lock (_gate)
+        {
+            if (_completed)
+            {
+                // Trace observation must never turn an already-completed Core
+                // operation into an application failure.
+                return false;
+            }
+            _operations.Add(operation);
+            return true;
+        }
+    }
+
+    internal void Complete()
+    {
+        IReadOnlyList<ApplicationOperationTraceRecord> snapshot;
+        lock (_gate)
+        {
+            if (_completed)
+            {
+                return;
+            }
+            _completed = true;
+            snapshot = Array.AsReadOnly(_operations.ToArray());
+        }
+        _completion.TrySetResult(snapshot);
+    }
+
+    internal Task<IReadOnlyList<ApplicationOperationTraceRecord>> WaitAsync(
+        CancellationToken cancellationToken) =>
+        _completion.Task.WaitAsync(cancellationToken);
+}
+
+internal sealed class TrackedApplicationService : IApplicationService
+{
+    private readonly IApplicationService _inner;
+    private readonly ApplicationOperationTraceHub _trace;
+
+    internal TrackedApplicationService(
+        IApplicationService inner,
+        ApplicationOperationTraceHub trace)
+    {
+        _inner = inner ?? throw new ArgumentNullException(nameof(inner));
+        _trace = trace ?? throw new ArgumentNullException(nameof(trace));
+    }
+
+    public Task<ApplicationOutcome<ApplicationDescription>> DescribeAsync(
+        CancellationToken cancellationToken = default) =>
+        TrackAsync(() => _inner.DescribeAsync(cancellationToken));
+
+    public Task<ApplicationOutcome<StatusSnapshot>> GetStatusAsync(
+        ApplicationStatusRequest request,
+        CancellationToken cancellationToken = default) =>
+        TrackAsync(() => _inner.GetStatusAsync(request, cancellationToken));
+
+    public Task<ApplicationOutcome<ApplicationOperationPlan>> CreatePlanAsync(
+        CreateApplicationPlanRequest request,
+        CancellationToken cancellationToken = default) =>
+        TrackAsync(() => _inner.CreatePlanAsync(request, cancellationToken));
+
+    public Task<ApplicationOutcome<ApplicationWriteResult<SyncResult>>> SyncAsync(
+        SyncApplicationRequest request,
+        CancellationToken cancellationToken = default) =>
+        TrackAsync(() => _inner.SyncAsync(request, cancellationToken));
+
+    public Task<ApplicationOutcome<ApplicationWriteResult<SyncResult>>> SwitchAsync(
+        SwitchApplicationRequest request,
+        CancellationToken cancellationToken = default) =>
+        TrackAsync(() => _inner.SwitchAsync(request, cancellationToken));
+
+    public Task<ApplicationOutcome<ApplicationWriteResult<RestoreResult>>> RestoreAsync(
+        RestoreApplicationRequest request,
+        CancellationToken cancellationToken = default) =>
+        TrackAsync(() => _inner.RestoreAsync(request, cancellationToken));
+
+    public Task<ApplicationOutcome<ApplicationWriteResult<BackupPruneResult>>> PruneAsync(
+        PruneApplicationRequest request,
+        CancellationToken cancellationToken = default) =>
+        TrackAsync(() => _inner.PruneAsync(request, cancellationToken));
+
+    private async Task<ApplicationOutcome<T>> TrackAsync<T>(
+        Func<Task<ApplicationOutcome<T>>> execute)
+        where T : class
+    {
+        ApplicationOutcome<T> outcome = await execute().ConfigureAwait(false);
+        _trace.Publish(outcome);
+        return outcome;
+    }
+}
diff --git a/desktop/CodexProviderSync.App/Automation/AutomationBootstrap.cs b/desktop/CodexProviderSync.App/Automation/AutomationBootstrap.cs
new file mode 100644
index 0000000..b174ac7
--- /dev/null
+++ b/desktop/CodexProviderSync.App/Automation/AutomationBootstrap.cs
@@ -0,0 +1,180 @@
+using System.Security.Cryptography;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+
+namespace CodexProviderSync.App.Automation;
+
+internal sealed record AutomationBootstrap(
+    bool Enabled,
+    string? DescriptorPath,
+    string? IsolationRoot,
+    string? PipeName,
+    string? Token)
+{
+    internal const string Argument = "--gui-automation-descriptor";
+    internal const string SentinelFileName = ".codex-provider-sync-test-root";
+    internal const string SentinelContent = "codex-provider-sync isolated GUI automation root v1";
+    private const string ClaimSuffix = ".claimed";
+    private static readonly Regex PipePattern = new(
+        "^CodexProviderSync\\.Automation\\.[0-9a-f]{32}$",
+        RegexOptions.CultureInvariant | RegexOptions.NonBacktracking);
+    private static readonly Regex TokenPattern = new(
+        "^[0-9a-f]{64}$",
+        RegexOptions.CultureInvariant | RegexOptions.NonBacktracking);
+
+    internal static AutomationBootstrap ParseAndClaim(string[] args)
+    {
+        ArgumentNullException.ThrowIfNull(args);
+        int index = Array.FindIndex(args, value => string.Equals(value, Argument, StringComparison.Ordinal));
+        if (index < 0)
+        {
+            if (args.Any(value => value.StartsWith("--gui-automation", StringComparison.OrdinalIgnoreCase)))
+            {
+                throw new InvalidOperationException("An unrecognized GUI automation option was supplied; startup is refused.");
+            }
+            return new AutomationBootstrap(false, null, null, null, null);
+        }
+        if (args.Length != 2 || index != 0 || string.IsNullOrWhiteSpace(args[1]))
+        {
+            throw new InvalidOperationException($"{Argument} must be the only option and must name one descriptor file.");
+        }
+
+        string descriptorPath = Path.GetFullPath(args[1]);
+        RejectReparsePoint(descriptorPath, "automation descriptor");
+        AutomationDescriptor descriptor;
+        try
+        {
+            using FileStream stream = new(descriptorPath, FileMode.Open, FileAccess.Read, FileShare.Read);
+            descriptor = JsonSerializer.Deserialize<AutomationDescriptor>(stream, JsonOptions)
+                ?? throw new InvalidDataException("Automation descriptor is empty.");
+        }
+        catch (Exception error) when (error is IOException or UnauthorizedAccessException or JsonException)
+        {
+            throw new InvalidOperationException("Unable to read the GUI automation descriptor.", error);
+        }
+
+        if (descriptor.SchemaVersion != 1)
+        {
+            throw new InvalidDataException("Unsupported GUI automation descriptor schema.");
+        }
+        if (string.IsNullOrWhiteSpace(descriptor.IsolationRoot)
+            || string.IsNullOrWhiteSpace(descriptor.PipeName)
+            || string.IsNullOrWhiteSpace(descriptor.Token))
+        {
+            throw new InvalidDataException("GUI automation descriptor fields are incomplete.");
+        }
+
+        string root = Path.TrimEndingDirectorySeparator(Path.GetFullPath(descriptor.IsolationRoot));
+        RejectReparsePoint(root, "automation isolation root");
+        EnsureContained(root, descriptorPath);
+        RejectNestedReparsePoints(root, descriptorPath);
+        string sentinelPath = Path.Combine(root, SentinelFileName);
+        RejectReparsePoint(sentinelPath, "automation isolation sentinel");
+        string sentinel = File.ReadAllText(sentinelPath);
+        if (!string.Equals(sentinel.Trim(), SentinelContent, StringComparison.Ordinal))
+        {
+            throw new InvalidDataException("GUI automation isolation sentinel is missing or invalid.");
+        }
+        if (!PipePattern.IsMatch(descriptor.PipeName))
+        {
+            throw new InvalidDataException("GUI automation pipe name is not a random scoped name.");
+        }
+        string pipeNonce = descriptor.PipeName["CodexProviderSync.Automation.".Length..];
+        if (!Guid.TryParseExact(pipeNonce, "N", out Guid pipeGuid) || pipeGuid == Guid.Empty)
+        {
+            throw new InvalidDataException("GUI automation pipe name must contain a non-empty random GUID.");
+        }
+        if (!TokenPattern.IsMatch(descriptor.Token))
+        {
+            throw new InvalidDataException("GUI automation token must be 32 random bytes encoded as lowercase hex.");
+        }
+        byte[] tokenBytes = Convert.FromHexString(descriptor.Token);
+        if (tokenBytes.Distinct().Count() < 8)
+        {
+            throw new InvalidDataException("GUI automation token does not contain enough entropy.");
+        }
+
+        string claimPath = descriptorPath + ClaimSuffix;
+        try
+        {
+            using FileStream claim = new(
+                claimPath,
+                FileMode.CreateNew,
+                FileAccess.Write,
+                FileShare.None,
+                4096,
+                FileOptions.WriteThrough);
+            using StreamWriter writer = new(claim, leaveOpen: true);
+            writer.Write($"pid={Environment.ProcessId};nonce={Convert.ToHexString(RandomNumberGenerator.GetBytes(16)).ToLowerInvariant()}");
+            writer.Flush();
+            claim.Flush(flushToDisk: true);
+        }
+        catch (IOException error)
+        {
+            throw new InvalidOperationException("GUI automation descriptor was already claimed; replay is refused.", error);
+        }
+
+        return new AutomationBootstrap(true, descriptorPath, root, descriptor.PipeName, descriptor.Token);
+    }
+
+    private static readonly JsonSerializerOptions JsonOptions = new()
+    {
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        PropertyNameCaseInsensitive = false,
+        UnmappedMemberHandling = System.Text.Json.Serialization.JsonUnmappedMemberHandling.Disallow
+    };
+
+    private static void EnsureContained(string root, string candidate)
+    {
+        StringComparison comparison = OperatingSystem.IsWindows()
+            ? StringComparison.OrdinalIgnoreCase
+            : StringComparison.Ordinal;
+        string prefix = root + Path.DirectorySeparatorChar;
+        if (!candidate.StartsWith(prefix, comparison))
+        {
+            throw new InvalidDataException("GUI automation descriptor must be stored inside its isolation root.");
+        }
+    }
+
+    private static void RejectNestedReparsePoints(string root, string descriptorPath)
+    {
+        string? current = Path.GetDirectoryName(descriptorPath);
+        while (current is not null && current.Length >= root.Length)
+        {
+            RejectReparsePoint(current, "automation descriptor path");
+            if (string.Equals(current, root, OperatingSystem.IsWindows()
+                ? StringComparison.OrdinalIgnoreCase
+                : StringComparison.Ordinal))
+            {
+                return;
+            }
+            current = Path.GetDirectoryName(current);
+        }
+        throw new InvalidDataException("GUI automation descriptor path containment could not be verified.");
+    }
+
+    private static void RejectReparsePoint(string path, string label)
+    {
+        FileAttributes attributes;
+        try
+        {
+            attributes = File.GetAttributes(path);
+        }
+        catch (Exception error) when (error is IOException or UnauthorizedAccessException)
+        {
+            throw new InvalidDataException($"The {label} does not exist or cannot be inspected.", error);
+        }
+        if ((attributes & FileAttributes.ReparsePoint) != 0)
+        {
+            throw new InvalidDataException($"The {label} cannot be a reparse point.");
+        }
+    }
+
+    private sealed class AutomationDescriptor
+    {
+        public int SchemaVersion { get; init; }
+        public string? IsolationRoot { get; init; }
+        public string? PipeName { get; init; }
+        public string? Token { get; init; }
+    }
+}
diff --git a/desktop/CodexProviderSync.App/Automation/GuiAutomationBridge.cs b/desktop/CodexProviderSync.App/Automation/GuiAutomationBridge.cs
new file mode 100644
index 0000000..69e8b0c
--- /dev/null
+++ b/desktop/CodexProviderSync.App/Automation/GuiAutomationBridge.cs
@@ -0,0 +1,898 @@
+using System.IO.Pipes;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+namespace CodexProviderSync.App.Automation;
+
+internal sealed class GuiAutomationBridge : IDisposable
+{
+    internal const int MaximumMessageBytes = 64 * 1024;
+    internal const int MaximumRequestsPerConnection = 1024;
+    private static readonly TimeSpan AuthenticationTimeout = TimeSpan.FromSeconds(10);
+    private static readonly TimeSpan InactivityTimeout = TimeSpan.FromSeconds(30);
+
+    private readonly MainForm _form;
+    private readonly string _pipeName;
+    private readonly byte[] _token;
+    private readonly GuiAutomationDispatcher _dispatcher;
+    private readonly CancellationTokenSource _shutdown = new();
+    private Task? _server;
+
+    internal GuiAutomationBridge(
+        MainForm form,
+        AutomationBootstrap bootstrap,
+        IAppPathProvider paths)
+    {
+        if (!bootstrap.Enabled || bootstrap.PipeName is null || bootstrap.Token is null)
+        {
+            throw new ArgumentException("An enabled, validated automation bootstrap is required.", nameof(bootstrap));
+        }
+        if (!paths.IsAutomation || paths.AutomationTracePath is null)
+        {
+            throw new ArgumentException("GUI automation requires isolated application paths.", nameof(paths));
+        }
+
+        _form = form;
+        _pipeName = bootstrap.PipeName;
+        _token = Convert.FromHexString(bootstrap.Token);
+        _dispatcher = new GuiAutomationDispatcher(form, new GuiAutomationTraceSink(paths.AutomationTracePath));
+    }
+
+    internal void Start()
+    {
+        if (_server is not null)
+        {
+            throw new InvalidOperationException("GUI automation bridge has already started.");
+        }
+        GuiAutomationCatalog.ValidateRuntimeCoverage(_form);
+        _server = Task.Run(RunSingleClientAsync);
+    }
+
+    private async Task RunSingleClientAsync()
+    {
+        // One server instance and one accepted connection. Once the connection
+        // ends (including failed authentication) this descriptor is spent.
+        using NamedPipeServerStream server = new(
+            _pipeName,
+            PipeDirection.InOut,
+            1,
+            PipeTransmissionMode.Byte,
+            PipeOptions.Asynchronous | PipeOptions.CurrentUserOnly);
+        await server.WaitForConnectionAsync(_shutdown.Token).ConfigureAwait(false);
+
+        bool authenticated = false;
+        HashSet<string> requestIds = new(StringComparer.Ordinal);
+        while (!_shutdown.IsCancellationRequested && server.IsConnected)
+        {
+            TimeSpan timeout = authenticated ? InactivityTimeout : AuthenticationTimeout;
+            string? line = await ReadBoundedLineAsync(server, MaximumMessageBytes, timeout, _shutdown.Token)
+                .ConfigureAwait(false);
+            if (line is null)
+            {
+                return;
+            }
+
+            GuiAutomationRequest request;
+            try
+            {
+                request = GuiAutomationRequest.Parse(line);
+            }
+            catch (Exception error) when (error is JsonException or InvalidDataException)
+            {
+                await WriteResponseAsync(server, GuiAutomationResponse.Failure(null, "invalid-request", error.Message), _shutdown.Token)
+                    .ConfigureAwait(false);
+                return;
+            }
+
+            if (!authenticated)
+            {
+                if (!Authenticate(request.Token))
+                {
+                    await WriteResponseAsync(server, GuiAutomationResponse.Failure(request.Id, "authentication-failed", "Authentication failed."), _shutdown.Token)
+                        .ConfigureAwait(false);
+                    return;
+                }
+                authenticated = true;
+            }
+
+            if (!requestIds.Add(request.Id))
+            {
+                await WriteResponseAsync(
+                    server,
+                    GuiAutomationResponse.Failure(
+                        request.Id,
+                        "request-replayed",
+                        "A GUI automation request id may only be used once."),
+                    _shutdown.Token).ConfigureAwait(false);
+                return;
+            }
+            if (requestIds.Count > MaximumRequestsPerConnection)
+            {
+                await WriteResponseAsync(
+                    server,
+                    GuiAutomationResponse.Failure(
+                        request.Id,
+                        "request-limit-exceeded",
+                        "The GUI automation connection exceeded its bounded request budget."),
+                    _shutdown.Token).ConfigureAwait(false);
+                return;
+            }
+
+            GuiAutomationResponse response;
+            try
+            {
+                JsonNode? result = await _dispatcher.DispatchAsync(request, _shutdown.Token).ConfigureAwait(false);
+                response = GuiAutomationResponse.Success(request.Id, result);
+            }
+            catch (Exception error) when (error is not OperationCanceledException)
+            {
+                response = GuiAutomationResponse.Failure(request.Id, "command-failed", error.Message);
+            }
+            await WriteResponseAsync(server, response, _shutdown.Token).ConfigureAwait(false);
+
+            if (string.Equals(request.Method, "ui.shutdown", StringComparison.Ordinal))
+            {
+                return;
+            }
+        }
+    }
+
+    private bool Authenticate(string? candidate)
+    {
+        if (candidate is null || candidate.Length != 64 || !candidate.All(Uri.IsHexDigit))
+        {
+            return false;
+        }
+        try
+        {
+            return CryptographicOperations.FixedTimeEquals(_token, Convert.FromHexString(candidate));
+        }
+        catch (FormatException)
+        {
+            return false;
+        }
+    }
+
+    internal static async Task<string?> ReadBoundedLineAsync(
+        Stream stream,
+        int maximumBytes,
+        TimeSpan timeout,
+        CancellationToken cancellationToken)
+    {
+        if (maximumBytes < 1)
+        {
+            throw new ArgumentOutOfRangeException(nameof(maximumBytes));
+        }
+        using CancellationTokenSource timeoutSource = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+        timeoutSource.CancelAfter(timeout);
+        using MemoryStream buffer = new(Math.Min(maximumBytes, 4096));
+        byte[] singleByte = new byte[1];
+        while (buffer.Length <= maximumBytes)
+        {
+            int read = await stream.ReadAsync(singleByte, timeoutSource.Token).ConfigureAwait(false);
+            if (read == 0)
+            {
+                return buffer.Length == 0 ? null : DecodeUtf8(buffer);
+            }
+            if (singleByte[0] == (byte)'\n')
+            {
+                return DecodeUtf8(buffer);
+            }
+            if (singleByte[0] != (byte)'\r')
+            {
+                buffer.WriteByte(singleByte[0]);
+            }
+        }
+        throw new InvalidDataException($"GUI automation message exceeds {maximumBytes} bytes.");
+    }
+
+    private static string DecodeUtf8(MemoryStream buffer) =>
+        new UTF8Encoding(false, true).GetString(buffer.GetBuffer(), 0, checked((int)buffer.Length));
+
+    private static async Task WriteResponseAsync(
+        Stream stream,
+        GuiAutomationResponse response,
+        CancellationToken cancellationToken)
+    {
+        byte[] payload = JsonSerializer.SerializeToUtf8Bytes(response, GuiAutomationJson.Options);
+        if (payload.Length > MaximumMessageBytes)
+        {
+            payload = JsonSerializer.SerializeToUtf8Bytes(
+                GuiAutomationResponse.Failure(response.Id, "response-too-large", "Response exceeds the protocol limit."),
+                GuiAutomationJson.Options);
+        }
+        await stream.WriteAsync(payload, cancellationToken).ConfigureAwait(false);
+        await stream.WriteAsync(new byte[] { (byte)'\n' }, cancellationToken).ConfigureAwait(false);
+        await stream.FlushAsync(cancellationToken).ConfigureAwait(false);
+    }
+
+    public void Dispose()
+    {
+        _shutdown.Cancel();
+        try
+        {
+            _server?.Wait(TimeSpan.FromSeconds(2));
+        }
+        catch (AggregateException)
+        {
+            // Cancellation or a client disconnect is expected during shutdown.
+        }
+        _shutdown.Dispose();
+    }
+}
+
+internal sealed record GuiAutomationRequest(
+    string Id,
+    string Method,
+    string? Token,
+    JsonElement Parameters)
+{
+    private static readonly HashSet<string> AllowedMethods = new(StringComparer.Ordinal)
+    {
+        "ui.describe",
+        "ui.snapshot",
+        "ui.get",
+        "ui.set",
+        "ui.invoke",
+        "ui.wait",
+        "ui.shutdown"
+    };
+
+    internal static GuiAutomationRequest Parse(string json)
+    {
+        using JsonDocument document = JsonDocument.Parse(json, new JsonDocumentOptions
+        {
+            AllowTrailingCommas = false,
+            CommentHandling = JsonCommentHandling.Disallow,
+            MaxDepth = 16
+        });
+        JsonElement root = document.RootElement;
+        if (root.ValueKind != JsonValueKind.Object)
+        {
+            throw new InvalidDataException("Request must be a JSON object.");
+        }
+        string id = RequiredString(root, "id", 128);
+        string method = RequiredString(root, "method", 64);
+        if (!AllowedMethods.Contains(method))
+        {
+            throw new InvalidDataException($"Unsupported GUI automation method: {method}");
+        }
+        string? token = root.TryGetProperty("token", out JsonElement tokenElement)
+            ? tokenElement.GetString()
+            : null;
+        JsonElement parameters = root.TryGetProperty("params", out JsonElement parameterElement)
+            ? parameterElement.Clone()
+            : JsonDocument.Parse("{}").RootElement.Clone();
+        if (parameters.ValueKind != JsonValueKind.Object)
+        {
+            throw new InvalidDataException("params must be a JSON object.");
+        }
+        return new GuiAutomationRequest(id, method, token, parameters);
+    }
+
+    internal string RequiredParameter(string name, int maximumLength = 512) =>
+        RequiredString(Parameters, name, maximumLength);
+
+    private static string RequiredString(JsonElement root, string name, int maximumLength)
+    {
+        if (!root.TryGetProperty(name, out JsonElement value)
+            || value.ValueKind != JsonValueKind.String
+            || string.IsNullOrWhiteSpace(value.GetString())
+            || value.GetString()!.Length > maximumLength)
+        {
+            throw new InvalidDataException($"{name} must be a non-empty string no longer than {maximumLength} characters.");
+        }
+        return value.GetString()!;
+    }
+}
+
+internal sealed record GuiAutomationResponse(
+    string? Id,
+    bool Ok,
+    JsonNode? Result,
+    string? ErrorCode,
+    string? ErrorMessage)
+{
+    internal static GuiAutomationResponse Success(string id, JsonNode? result) =>
+        new(id, true, result, null, null);
+
+    internal static GuiAutomationResponse Failure(string? id, string code, string message) =>
+        new(id, false, null, code, message);
+}
+
+internal static class GuiAutomationJson
+{
+    internal static readonly JsonSerializerOptions Options = new(JsonSerializerDefaults.Web)
+    {
+        WriteIndented = false
+    };
+}
+
+internal sealed class GuiAutomationDispatcher
+{
+    private readonly MainForm _form;
+    private readonly GuiAutomationTraceSink _trace;
+
+    internal GuiAutomationDispatcher(MainForm form, GuiAutomationTraceSink trace)
+    {
+        _form = form;
+        _trace = trace;
+        GuiAutomationCatalog.ValidateRuntimeCoverage(form);
+    }
+
+    internal async Task<JsonNode?> DispatchAsync(GuiAutomationRequest request, CancellationToken cancellationToken)
+    {
+        return request.Method switch
+        {
+            "ui.describe" => await OnUiAsync(Describe, cancellationToken).ConfigureAwait(false),
+            "ui.snapshot" => await OnUiAsync(Snapshot, cancellationToken).ConfigureAwait(false),
+            "ui.get" => await OnUiAsync(() => Get(request.RequiredParameter("automationId")), cancellationToken).ConfigureAwait(false),
+            "ui.set" => await OnUiAsync(() => Set(request), cancellationToken).ConfigureAwait(false),
+            "ui.invoke" => await InvokeAsync(request, cancellationToken).ConfigureAwait(false),
+            "ui.wait" => await WaitAsync(request, cancellationToken).ConfigureAwait(false),
+            "ui.shutdown" => await OnUiAsync(() => Shutdown(request), cancellationToken).ConfigureAwait(false),
+            _ => throw new InvalidDataException($"Unsupported method: {request.Method}")
+        };
+    }
+
+    private JsonNode Describe()
+    {
+        using Stream stream = typeof(MainForm).Assembly.GetManifestResourceStream(GuiAutomationCatalog.ManifestResourceName)
+            ?? throw new InvalidOperationException("Embedded GUI automation manifest was not found.");
+        return JsonNode.Parse(stream) ?? throw new InvalidDataException("GUI automation manifest is empty.");
+    }
+
+    private JsonNode Snapshot()
+    {
+        JsonArray controls = [];
+        foreach (Control control in GuiAutomationCatalog.EnumerateRuntimeDenominator(_form))
+        {
+            JsonObject entry = Get(control.Name).AsObject();
+            controls.Add(entry);
+        }
+        return new JsonObject
+        {
+            ["controls"] = controls
+        };
+    }
+
+    private JsonNode Get(string automationId)
+    {
+        Control? control = FindControlOrDefault(automationId);
+        if (control is not null)
+        {
+            return DescribeControl(control);
+        }
+        if (TryFindProviderRow(automationId, out ListViewItem? providerRow, out _))
+        {
+            return DescribeProviderRow(providerRow!);
+        }
+        if (TryFindRecentHome(automationId, out AutomationComboBoxItem? recentHome, out ComboBox? combo))
+        {
+            return DescribeRecentHome(recentHome!, combo!);
+        }
+
+        throw new KeyNotFoundException($"Unknown GUI automation id: {automationId}");
+    }
+
+    private JsonNode Set(GuiAutomationRequest request)
+    {
+        string automationId = request.RequiredParameter("automationId");
+        if (TrySelectDynamicEntry(request, automationId, out JsonNode? selected))
+        {
+            return selected!;
+        }
+        if (!request.Parameters.TryGetProperty("value", out JsonElement value))
+        {
+            throw new InvalidDataException("value is required.");
+        }
+        Control control = FindControl(automationId);
+        if (!control.Enabled)
+        {
+            throw new InvalidOperationException($"{automationId} is disabled and cannot accept GUI automation input.");
+        }
+        _form.ValidateAutomationValue(automationId, value);
+        string eventName = SetControlValue(control, value, out bool eventObserved);
+        _trace.Append(request.Id, request.Method, automationId, eventName, eventObserved);
+        return DescribeControl(control);
+    }
+
+    private async Task<JsonNode> InvokeAsync(
+        GuiAutomationRequest request,
+        CancellationToken cancellationToken)
+    {
+        InvokeStart started = await OnUiAsync(
+            () => StartInvoke(request),
+            cancellationToken).ConfigureAwait(false);
+        IReadOnlyList<ApplicationOperationTraceRecord> operations = started.Window is null
+            ? []
+            : await started.Window.WaitAsync(cancellationToken).ConfigureAwait(false);
+
+        _trace.Append(
+            request.Id,
+            request.Method,
+            started.AutomationId,
+            started.GuiEvent,
+            started.EventObserved,
+            operations);
+        JsonObject result = (await OnUiAsync(
+            () => DescribeControl(FindControl(started.AutomationId)),
+            cancellationToken).ConfigureAwait(false)).AsObject();
+        AddApplicationLink(result, operations);
+        return result;
+    }
+
+    private InvokeStart StartInvoke(GuiAutomationRequest request)
+    {
+        string automationId = request.RequiredParameter("automationId");
+        Control control = FindControl(automationId);
+        if (control is MainForm window)
+        {
+            window.RequestBringToFront();
+            return new InvokeStart(automationId, "Activated", true, null);
+        }
+        if (control is not Button button)
+        {
+            throw new InvalidOperationException($"{automationId} is not an invokable button.");
+        }
+        if (!button.Enabled || !button.Visible)
+        {
+            throw new InvalidOperationException($"{automationId} is not currently actionable.");
+        }
+        bool observed = false;
+        EventHandler observer = (_, _) => observed = true;
+        ApplicationInvocationWindow? invocationWindow = null;
+        button.Click += observer;
+        try
+        {
+            if (MainForm.IsApplicationBoundAutomationId(automationId))
+            {
+                using ApplicationOperationTraceHub.ApplicationInvocationScope scope =
+                    _form.ApplicationTraceHub.BeginInvocation(request.Id, automationId);
+                invocationWindow = scope.Window;
+                button.PerformClick();
+            }
+            else
+            {
+                button.PerformClick();
+            }
+        }
+        finally
+        {
+            button.Click -= observer;
+        }
+        if (!observed)
+        {
+            throw new InvalidOperationException($"{automationId} did not raise its real Click event.");
+        }
+        return new InvokeStart(automationId, "Click", observed, invocationWindow);
+    }
+
+    private static void AddApplicationLink(
+        JsonObject result,
+        IReadOnlyList<ApplicationOperationTraceRecord> operations)
+    {
+        ApplicationOperationTraceRecord? primary = SelectPrimaryOperation(operations);
+        result["applicationOperationLinked"] = primary is not null;
+        result["applicationOperationId"] = primary?.OperationId;
+        result["applicationOperation"] = primary?.Operation.ToString();
+        result["applicationLifecycle"] = primary?.Lifecycle.ToString();
+        result["applicationOperations"] = new JsonArray(
+            operations.Select(static operation => (JsonNode)new JsonObject
+            {
+                ["operationId"] = operation.OperationId,
+                ["operation"] = operation.Operation.ToString(),
+                ["lifecycle"] = operation.Lifecycle.ToString(),
+                ["startedAtUtc"] = operation.StartedAtUtc,
+                ["completedAtUtc"] = operation.CompletedAtUtc,
+                ["errorCodes"] = new JsonArray(
+                    operation.ErrorCodes.Select(static code => (JsonNode)JsonValue.Create(code)!).ToArray())
+            }).ToArray());
+    }
+
+    private static ApplicationOperationTraceRecord? SelectPrimaryOperation(
+        IReadOnlyList<ApplicationOperationTraceRecord> operations) =>
+        operations.LastOrDefault(static operation => operation.Operation is not (
+            CodexProviderSync.Application.ApplicationOperationKind.Plan
+            or CodexProviderSync.Application.ApplicationOperationKind.Status))
+        ?? operations.LastOrDefault();
+
+    private sealed record InvokeStart(
+        string AutomationId,
+        string GuiEvent,
+        bool EventObserved,
+        ApplicationInvocationWindow? Window);
+
+    private async Task<JsonNode?> WaitAsync(GuiAutomationRequest request, CancellationToken cancellationToken)
+    {
+        string automationId = request.RequiredParameter("automationId");
+        string property = request.RequiredParameter("property", 64);
+        if (!request.Parameters.TryGetProperty("equals", out JsonElement expected))
+        {
+            throw new InvalidDataException("equals is required.");
+        }
+        int timeoutMs = request.Parameters.TryGetProperty("timeoutMs", out JsonElement timeoutElement)
+            ? timeoutElement.GetInt32()
+            : 5000;
+        if (timeoutMs is < 1 or > 30000)
+        {
+            throw new InvalidDataException("timeoutMs must be between 1 and 30000.");
+        }
+
+        DateTimeOffset deadline = DateTimeOffset.UtcNow.AddMilliseconds(timeoutMs);
+        while (DateTimeOffset.UtcNow <= deadline)
+        {
+            JsonNode? actual = await OnUiAsync(
+                () => PropertyValue(FindControl(automationId), property),
+                cancellationToken).ConfigureAwait(false);
+            if (JsonNode.DeepEquals(actual, JsonNode.Parse(expected.GetRawText())))
+            {
+                return new JsonObject
+                {
+                    ["matched"] = true,
+                    ["value"] = actual?.DeepClone()
+                };
+            }
+            await Task.Delay(50, cancellationToken).ConfigureAwait(false);
+        }
+        throw new TimeoutException($"Timed out waiting for {automationId}.{property}.");
+    }
+
+    private JsonNode Shutdown(GuiAutomationRequest request)
+    {
+        _trace.Append(request.Id, request.Method, GuiAutomationCatalog.Ids.MainWindow, "Close", true);
+        _form.BeginInvoke(_form.Close);
+        return new JsonObject { ["accepted"] = true };
+    }
+
+    private Control FindControl(string automationId)
+    {
+        Control? match = FindControlOrDefault(automationId);
+        return match ?? throw new KeyNotFoundException($"Unknown GUI automation id: {automationId}");
+    }
+
+    private Control? FindControlOrDefault(string automationId) =>
+        GuiAutomationCatalog.EnumerateRuntimeDenominator(_form)
+            .SingleOrDefault(control => string.Equals(control.Name, automationId, StringComparison.Ordinal));
+
+    private bool TrySelectDynamicEntry(
+        GuiAutomationRequest request,
+        string automationId,
+        out JsonNode? result)
+    {
+        result = null;
+        if (TryFindProviderRow(automationId, out ListViewItem? providerRow, out ListView? providerList))
+        {
+            if (!providerList!.Enabled)
+            {
+                throw new InvalidOperationException($"{automationId} is disabled and cannot be selected.");
+            }
+            RequireSelectionValue(request);
+            bool observed = false;
+            EventHandler observer = (_, _) => observed = true;
+            providerList!.SelectedIndexChanged += observer;
+            try
+            {
+                providerList.SelectedItems.Clear();
+                providerRow!.Selected = true;
+                providerRow.Focused = true;
+                providerRow.EnsureVisible();
+            }
+            finally
+            {
+                providerList.SelectedIndexChanged -= observer;
+            }
+            _trace.Append(request.Id, request.Method, automationId, "SelectedIndexChanged", observed);
+            if (!observed || !providerRow!.Selected)
+            {
+                throw new InvalidOperationException(
+                    $"{automationId} did not raise its real ListView selection event.");
+            }
+            result = DescribeProviderRow(providerRow);
+            return true;
+        }
+
+        if (TryFindRecentHome(automationId, out AutomationComboBoxItem? recentHome, out ComboBox? combo))
+        {
+            if (!combo!.Enabled)
+            {
+                throw new InvalidOperationException($"{automationId} is disabled and cannot be selected.");
+            }
+            RequireSelectionValue(request);
+            bool observed = false;
+            EventHandler observer = (_, _) => observed = true;
+            combo!.SelectedIndexChanged += observer;
+            try
+            {
+                combo.SelectedItem = recentHome;
+            }
+            finally
+            {
+                combo.SelectedIndexChanged -= observer;
+            }
+            _trace.Append(request.Id, request.Method, automationId, "SelectedIndexChanged", observed);
+            if (!observed || !ReferenceEquals(combo.SelectedItem, recentHome))
+            {
+                throw new InvalidOperationException(
+                    $"{automationId} did not raise its real ComboBox selection event.");
+            }
+            result = DescribeRecentHome(recentHome!, combo);
+            return true;
+        }
+
+        return false;
+    }
+
+    private static void RequireSelectionValue(GuiAutomationRequest request)
+    {
+        if (request.Parameters.TryGetProperty("value", out JsonElement value)
+            && (value.ValueKind != JsonValueKind.True || !value.GetBoolean()))
+        {
+            throw new InvalidDataException("Dynamic selection accepts only value=true when a value is supplied.");
+        }
+    }
+
+    private bool TryFindProviderRow(
+        string automationId,
+        out ListViewItem? item,
+        out ListView? list)
+    {
+        list = FindControlOrDefault(GuiAutomationCatalog.Ids.ProviderList) as ListView;
+        item = list?.Items.Cast<ListViewItem>()
+            .SingleOrDefault(candidate => string.Equals(candidate.Name, automationId, StringComparison.Ordinal));
+        return item is not null;
+    }
+
+    private bool TryFindRecentHome(
+        string automationId,
+        out AutomationComboBoxItem? item,
+        out ComboBox? combo)
+    {
+        combo = FindControlOrDefault(GuiAutomationCatalog.Ids.CodexHome) as ComboBox;
+        item = combo?.Items.OfType<AutomationComboBoxItem>()
+            .SingleOrDefault(candidate => string.Equals(
+                candidate.AutomationId,
+                automationId,
+                StringComparison.Ordinal));
+        return item is not null;
+    }
+
+    private static JsonObject DescribeProviderRow(ListViewItem item) => new()
+    {
+        ["automationId"] = item.Name,
+        ["controlType"] = nameof(ListViewItem),
+        ["selected"] = item.Selected,
+        ["value"] = item.Text
+    };
+
+    private static JsonObject DescribeRecentHome(AutomationComboBoxItem item, ComboBox combo) => new()
+    {
+        ["automationId"] = item.AutomationId,
+        ["controlType"] = "ComboBoxItem",
+        ["selected"] = ReferenceEquals(combo.SelectedItem, item),
+        ["value"] = item.Value
+    };
+
+    private static JsonObject DescribeControl(Control control)
+    {
+        JsonObject result = new()
+        {
+            ["automationId"] = control.Name,
+            ["controlType"] = control.GetType().Name,
+            ["enabled"] = control.Enabled,
+            ["visible"] = control.Visible,
+            ["value"] = ControlValue(control)
+        };
+        return result;
+    }
+
+    private static JsonNode? ControlValue(Control control) => control switch
+    {
+        CheckBox checkBox => JsonValue.Create(checkBox.Checked),
+        RadioButton radio => JsonValue.Create(radio.Checked),
+        NumericUpDown number => JsonValue.Create(number.Value),
+        ListView list => new JsonArray(list.Items.Cast<ListViewItem>().Select(item => (JsonNode)new JsonObject
+        {
+            ["automationId"] = item.Name,
+            ["text"] = item.Text,
+            ["selected"] = item.Selected
+        }).ToArray()),
+        _ => JsonValue.Create(control.Text)
+    };
+
+    private static JsonNode? PropertyValue(Control control, string property) => property switch
+    {
+        "value" => ControlValue(control),
+        "text" => JsonValue.Create(control.Text),
+        "enabled" => JsonValue.Create(control.Enabled),
+        "visible" => JsonValue.Create(control.Visible),
+        "checked" when control is CheckBox checkBox => JsonValue.Create(checkBox.Checked),
+        "checked" when control is RadioButton radio => JsonValue.Create(radio.Checked),
+        _ => throw new InvalidDataException($"Unsupported wait property '{property}' for {control.Name}.")
+    };
+
+    private static string SetControlValue(Control control, JsonElement value, out bool eventObserved)
+    {
+        eventObserved = false;
+        switch (control)
+        {
+            case TextBoxBase textBox when !textBox.ReadOnly:
+            {
+                bool observed = false;
+                EventHandler observer = (_, _) => observed = true;
+                textBox.TextChanged += observer;
+                try { textBox.Text = value.GetString() ?? string.Empty; }
+                finally { textBox.TextChanged -= observer; }
+                eventObserved = observed;
+                return "TextChanged";
+            }
+            case ComboBox combo:
+            {
+                bool observed = false;
+                EventHandler observer = (_, _) => observed = true;
+                combo.TextChanged += observer;
+                try { combo.Text = value.GetString() ?? string.Empty; }
+                finally { combo.TextChanged -= observer; }
+                eventObserved = observed;
+                return "TextChanged";
+            }
+            case CheckBox checkBox:
+            {
+                bool observed = false;
+                EventHandler observer = (_, _) => observed = true;
+                checkBox.CheckedChanged += observer;
+                try { checkBox.Checked = value.GetBoolean(); }
+                finally { checkBox.CheckedChanged -= observer; }
+                eventObserved = observed;
+                return "CheckedChanged";
+            }
+            case RadioButton radio:
+            {
+                bool observed = false;
+                EventHandler observer = (_, _) => observed = true;
+                radio.CheckedChanged += observer;
+                try { radio.Checked = value.GetBoolean(); }
+                finally { radio.CheckedChanged -= observer; }
+                eventObserved = observed;
+                return "CheckedChanged";
+            }
+            case NumericUpDown number:
+            {
+                bool observed = false;
+                EventHandler observer = (_, _) => observed = true;
+                number.ValueChanged += observer;
+                try { number.Value = value.GetDecimal(); }
+                finally { number.ValueChanged -= observer; }
+                eventObserved = observed;
+                return "ValueChanged";
+            }
+            default:
+                throw new InvalidOperationException($"{control.Name} is not writable through GUI automation.");
+        }
+    }
+
+    private async Task<T> OnUiAsync<T>(Func<T> action, CancellationToken cancellationToken)
+    {
+        if (_form.IsDisposed || _form.Disposing)
+        {
+            throw new ObjectDisposedException(nameof(MainForm));
+        }
+        if (!_form.InvokeRequired)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            return action();
+        }
+
+        return await RunScheduledOnceAsync(
+            callback => _form.BeginInvoke(callback),
+            action,
+            cancellationToken).ConfigureAwait(false);
+    }
+
+    internal static async Task<T> RunScheduledOnceAsync<T>(
+        Action<Action> schedule,
+        Func<T> action,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(schedule);
+        ArgumentNullException.ThrowIfNull(action);
+        cancellationToken.ThrowIfCancellationRequested();
+
+        TaskCompletionSource<T> completion = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        int state = 0; // 0=pending, 1=executing/executed, 2=cancelled before execution
+        using CancellationTokenRegistration registration = cancellationToken.Register(
+            () =>
+            {
+                if (Interlocked.CompareExchange(ref state, 2, 0) == 0)
+                {
+                    completion.TrySetCanceled(cancellationToken);
+                }
+            });
+        try
+        {
+            schedule(() =>
+            {
+                if (Interlocked.CompareExchange(ref state, 1, 0) != 0)
+                {
+                    return;
+                }
+
+                try { completion.TrySetResult(action()); }
+                catch (Exception error) { completion.TrySetException(error); }
+            });
+        }
+        catch (Exception error)
+        {
+            if (Interlocked.CompareExchange(ref state, 1, 0) == 0)
+            {
+                completion.TrySetException(error);
+            }
+        }
+        return await completion.Task.ConfigureAwait(false);
+    }
+}
+
+internal sealed class GuiAutomationTraceSink
+{
+    private readonly string _path;
+    private readonly object _gate = new();
+    private long _sequence;
+
+    internal GuiAutomationTraceSink(string path)
+    {
+        _path = Path.GetFullPath(path);
+    }
+
+    internal void Append(
+        string requestId,
+        string method,
+        string automationId,
+        string guiEvent,
+        bool eventObserved,
+        IReadOnlyList<ApplicationOperationTraceRecord>? applicationOperations = null)
+    {
+        IReadOnlyList<ApplicationOperationTraceRecord> operations = applicationOperations ?? [];
+        ApplicationOperationTraceRecord? primary = operations.LastOrDefault(
+            static operation => operation.Operation is not (
+                CodexProviderSync.Application.ApplicationOperationKind.Plan
+                or CodexProviderSync.Application.ApplicationOperationKind.Status))
+            ?? operations.LastOrDefault();
+        lock (_gate)
+        {
+            Directory.CreateDirectory(Path.GetDirectoryName(_path)!);
+            JsonObject record = new()
+            {
+                ["schemaVersion"] = 2,
+                ["sequence"] = ++_sequence,
+                ["timestampUtc"] = DateTimeOffset.UtcNow,
+                ["requestId"] = requestId,
+                ["method"] = method,
+                ["automationId"] = automationId,
+                ["guiEvent"] = guiEvent,
+                ["eventObserved"] = eventObserved,
+                ["applicationOperationId"] = primary?.OperationId,
+                ["applicationOperation"] = primary?.Operation.ToString(),
+                ["applicationLifecycle"] = primary?.Lifecycle.ToString(),
+                ["applicationOperationLinked"] = primary is not null,
+                ["applicationOperations"] = new JsonArray(
+                    operations.Select(static operation => (JsonNode)new JsonObject
+                    {
+                        ["operationId"] = operation.OperationId,
+                        ["operation"] = operation.Operation.ToString(),
+                        ["lifecycle"] = operation.Lifecycle.ToString(),
+                        ["startedAtUtc"] = operation.StartedAtUtc,
+                        ["completedAtUtc"] = operation.CompletedAtUtc,
+                        ["errorCodes"] = new JsonArray(
+                            operation.ErrorCodes.Select(static code => (JsonNode)JsonValue.Create(code)!).ToArray())
+                    }).ToArray())
+            };
+            using FileStream stream = new(_path, FileMode.Append, FileAccess.Write, FileShare.Read);
+            using StreamWriter writer = new(stream, new UTF8Encoding(false), leaveOpen: true);
+            writer.WriteLine(record.ToJsonString(GuiAutomationJson.Options));
+            writer.Flush();
+            stream.Flush(flushToDisk: true);
+        }
+    }
+}
diff --git a/desktop/CodexProviderSync.App/Automation/GuiAutomationCatalog.cs b/desktop/CodexProviderSync.App/Automation/GuiAutomationCatalog.cs
new file mode 100644
index 0000000..5a9e08c
--- /dev/null
+++ b/desktop/CodexProviderSync.App/Automation/GuiAutomationCatalog.cs
@@ -0,0 +1,298 @@
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+
+namespace CodexProviderSync.App.Automation;
+
+/// <summary>
+/// Stable, pre-1.0 identifiers for the real WinForms surface. These identifiers
+/// are presentation metadata only; they do not expose an automation listener.
+/// </summary>
+internal static class GuiAutomationCatalog
+{
+    internal const string ManifestResourceName =
+        "CodexProviderSync.App.Automation.gui-automation-manifest.v0.4.json";
+
+    internal static class Ids
+    {
+        internal const string MainWindow = "window.main";
+        internal const string CodexHome = "storage.codexHome";
+        internal const string BrowseCodexHome = "storage.codexHome.browse";
+        internal const string SqliteHome = "storage.sqliteHome";
+        internal const string BrowseSqliteHome = "storage.sqliteHome.browse";
+        internal const string RefreshStatus = "status.refresh";
+        internal const string StatusOutput = "status.output";
+        internal const string ProviderList = "provider.list";
+        internal const string ManualProviderId = "provider.manualId";
+        internal const string AddManualProvider = "provider.addManual";
+        internal const string RemoveManualProvider = "provider.removeManual";
+        internal const string SelectedProvider = "state.selectedProvider";
+        internal const string UpdateConfig = "execution.updateConfig";
+        internal const string FollowProviderModel = "execution.model.followProvider";
+        internal const string KeepCurrentModel = "execution.model.keepCurrent";
+        internal const string CustomModelMode = "execution.model.custom";
+        internal const string CustomModel = "execution.customModel";
+        internal const string RestoreConfig = "restore.includeConfig";
+        internal const string RestoreDatabase = "restore.includeDatabase";
+        internal const string RestoreSessions = "restore.includeSessions";
+        internal const string BackupRetention = "backup.retentionCount";
+        internal const string Execute = "operation.execute";
+        internal const string Restore = "restore.execute";
+        internal const string OpenBackupDirectory = "backups.openDirectory";
+        internal const string PruneBackups = "backups.prune";
+        internal const string CheckUpdates = "updates.check";
+        internal const string OpenLogDirectory = "logs.openDirectory";
+        internal const string OperationState = "state.operation";
+        internal const string CloseCodexWarningPrimary = "warning.closeCodex.primary";
+        internal const string CloseCodexWarningSecondary = "warning.closeCodex.secondary";
+        internal const string LogOutput = "logs.output";
+    }
+
+    internal static class Templates
+    {
+        internal const string ProviderRow = "provider.row";
+        internal const string RecentCodexHome = "storage.codexHome.recent";
+    }
+
+    internal static T Register<T>(T control, string automationId) where T : Control
+    {
+        ArgumentNullException.ThrowIfNull(control);
+        ValidateIdentifier(automationId);
+        control.Name = automationId;
+        control.AccessibleName = string.IsNullOrWhiteSpace(control.AccessibleName)
+            ? string.IsNullOrWhiteSpace(control.Text) ? automationId : control.Text
+            : control.AccessibleName;
+        control.AccessibleDescription = $"AutomationId:{automationId}";
+        return control;
+    }
+
+    internal static void RegisterProviderRow(ListViewItem item, string providerId)
+    {
+        ArgumentNullException.ThrowIfNull(item);
+        item.Name = InstanceId(Templates.ProviderRow, providerId);
+    }
+
+    internal static AutomationComboBoxItem RecentCodexHome(string path)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(path);
+        string normalizedPath = Path.TrimEndingDirectorySeparator(Path.GetFullPath(path));
+        if (OperatingSystem.IsWindows())
+        {
+            normalizedPath = normalizedPath.ToUpperInvariant();
+        }
+        return new AutomationComboBoxItem(
+            path,
+            Templates.RecentCodexHome,
+            InstanceKey(normalizedPath));
+    }
+
+    internal static IEnumerable<Control> EnumerateRuntimeDenominator(MainForm form)
+    {
+        yield return form;
+        foreach (Control control in Descendants(form))
+        {
+            if (HasRegisteredCompositeAncestor(control))
+            {
+                continue;
+            }
+            if (control is ButtonBase or TextBoxBase or ComboBox or ListView or NumericUpDown
+                || IsMeaningfulStateSurface(control))
+            {
+                yield return control;
+            }
+        }
+    }
+
+    internal static void ValidateRuntimeCoverage(MainForm form)
+    {
+        Control[] runtime = EnumerateRuntimeDenominator(form).ToArray();
+        if (runtime.Any(control => string.IsNullOrWhiteSpace(control.Name)
+            || string.IsNullOrWhiteSpace(control.AccessibleName)
+            || !string.Equals(
+                control.AccessibleDescription,
+                $"AutomationId:{control.Name}",
+                StringComparison.Ordinal)))
+        {
+            throw new InvalidOperationException("The GUI runtime denominator contains an unregistered automation surface.");
+        }
+        string[] duplicates = runtime
+            .GroupBy(control => control.Name, StringComparer.Ordinal)
+            .Where(group => group.Count() > 1)
+            .Select(group => group.Key)
+            .ToArray();
+        if (duplicates.Length > 0)
+        {
+            throw new InvalidOperationException($"Duplicate GUI automation ids: {string.Join(", ", duplicates)}");
+        }
+
+        using Stream stream = typeof(MainForm).Assembly.GetManifestResourceStream(ManifestResourceName)
+            ?? throw new InvalidOperationException("Embedded GUI automation manifest was not found.");
+        using JsonDocument manifest = JsonDocument.Parse(stream);
+        Dictionary<string, JsonElement> declaredControls = manifest.RootElement.GetProperty("controls")
+            .EnumerateArray()
+            .ToDictionary(
+                item => item.GetProperty("id").GetString()!,
+                item => item,
+                StringComparer.Ordinal);
+        JsonElement window = manifest.RootElement.GetProperty("window");
+        HashSet<string> declared = declaredControls.Keys.ToHashSet(StringComparer.Ordinal);
+        declared.Add(window.GetProperty("id").GetString()!);
+        HashSet<string> actual = runtime.Select(control => control.Name).ToHashSet(StringComparer.Ordinal);
+        if (!declared.SetEquals(actual))
+        {
+            string missing = string.Join(", ", declared.Except(actual, StringComparer.Ordinal));
+            string undeclared = string.Join(", ", actual.Except(declared, StringComparer.Ordinal));
+            throw new InvalidOperationException(
+                $"GUI automation manifest/runtime mismatch. Missing: [{missing}]. Undeclared: [{undeclared}].");
+        }
+
+        foreach (Control control in runtime)
+        {
+            JsonElement declaration = control == form
+                ? window
+                : declaredControls[control.Name];
+            string declaredType = declaration.GetProperty("controlType").GetString()!;
+            string runtimeType = control == form ? nameof(Form) : control.GetType().Name;
+            if (!string.Equals(declaredType, runtimeType, StringComparison.Ordinal))
+            {
+                throw new InvalidOperationException(
+                    $"GUI automation manifest type mismatch for {control.Name}: {declaredType} != {runtimeType}.");
+            }
+            foreach (JsonElement action in declaration.GetProperty("actions").EnumerateArray())
+            {
+                string name = action.GetString()!;
+                if (!GuiAutomationActionCoverage.SupportsControl(control, name))
+                {
+                    throw new InvalidOperationException(
+                        $"GUI automation action is declared but not implemented: {control.Name}.{name}.");
+                }
+            }
+        }
+
+        Dictionary<string, JsonElement> templates = manifest.RootElement.GetProperty("templates")
+            .EnumerateArray()
+            .ToDictionary(
+                item => item.GetProperty("id").GetString()!,
+                item => item,
+                StringComparer.Ordinal);
+        string[] expectedTemplates = [Templates.ProviderRow, Templates.RecentCodexHome];
+        if (!templates.Keys.ToHashSet(StringComparer.Ordinal).SetEquals(expectedTemplates))
+        {
+            throw new InvalidOperationException("GUI automation dynamic-template coverage is incomplete.");
+        }
+        foreach ((string templateId, JsonElement declaration) in templates)
+        {
+            foreach (JsonElement action in declaration.GetProperty("actions").EnumerateArray())
+            {
+                string name = action.GetString()!;
+                if (!GuiAutomationActionCoverage.SupportsTemplate(templateId, name))
+                {
+                    throw new InvalidOperationException(
+                        $"GUI automation template action is declared but not implemented: {templateId}.{name}.");
+                }
+            }
+        }
+    }
+
+    private static IEnumerable<Control> Descendants(Control control)
+    {
+        foreach (Control child in control.Controls)
+        {
+            yield return child;
+            foreach (Control descendant in Descendants(child))
+            {
+                yield return descendant;
+            }
+        }
+    }
+
+    private static bool HasRegisteredCompositeAncestor(Control control)
+    {
+        for (Control? ancestor = control.Parent; ancestor is not null; ancestor = ancestor.Parent)
+        {
+            if (ancestor is NumericUpDown)
+            {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private static bool IsMeaningfulStateSurface(Control control)
+    {
+        return control is Label label
+            && (label.Font.Bold
+                || label.ForeColor is var foreground && (foreground == Color.DarkGreen || foreground == Color.DarkOrange)
+                || label.BackColor == Color.FromArgb(255, 244, 214));
+    }
+
+    internal static string InstanceId(string templateId, string naturalKey)
+    {
+        ValidateIdentifier(templateId);
+        return $"{templateId}:{InstanceKey(naturalKey)}";
+    }
+
+    internal static string InstanceKey(string naturalKey)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(naturalKey);
+        string normalized = naturalKey.Trim().Normalize(NormalizationForm.FormKC);
+        byte[] digest = SHA256.HashData(Encoding.UTF8.GetBytes(normalized));
+        return Convert.ToHexString(digest.AsSpan(0, 12)).ToLowerInvariant();
+    }
+
+    private static void ValidateIdentifier(string automationId)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(automationId);
+        if (automationId.Any(character => !(char.IsAsciiLetterOrDigit(character) || character is '.' or '-')))
+        {
+            throw new ArgumentException(
+                $"Automation identifier contains an unsupported character: {automationId}",
+                nameof(automationId));
+        }
+    }
+}
+
+internal static class GuiAutomationActionCoverage
+{
+    internal static bool SupportsControl(Control control, string action)
+    {
+        ArgumentNullException.ThrowIfNull(control);
+        return control switch
+        {
+            MainForm => action is "get" or "focus" or "close",
+            Button => action == "invoke",
+            CheckBox => action is "get" or "set" or "toggle",
+            RadioButton => action is "get" or "set",
+            ComboBox when control.Name == GuiAutomationCatalog.Ids.CodexHome =>
+                action is "get" or "set" or "select",
+            ComboBox => action is "get" or "set",
+            ListView when control.Name == GuiAutomationCatalog.Ids.ProviderList =>
+                action is "get" or "select",
+            NumericUpDown => action is "get" or "set",
+            TextBoxBase textBox when textBox.ReadOnly => action == "get",
+            TextBoxBase => action is "get" or "set",
+            Label => action == "get",
+            _ => false
+        };
+    }
+
+    internal static bool SupportsTemplate(string templateId, string action)
+    {
+        return templateId switch
+        {
+            GuiAutomationCatalog.Templates.ProviderRow => action is "get" or "select",
+            GuiAutomationCatalog.Templates.RecentCodexHome => action is "get" or "select",
+            _ => false
+        };
+    }
+}
+
+internal sealed record AutomationComboBoxItem(
+    string Value,
+    string TemplateId,
+    string InstanceKey)
+{
+    internal string AutomationId => $"{TemplateId}:{InstanceKey}";
+
+    public override string ToString() => Value;
+}
diff --git a/desktop/CodexProviderSync.App/Automation/gui-automation-manifest.v0.4.json b/desktop/CodexProviderSync.App/Automation/gui-automation-manifest.v0.4.json
new file mode 100644
index 0000000..1c24a4f
--- /dev/null
+++ b/desktop/CodexProviderSync.App/Automation/gui-automation-manifest.v0.4.json
@@ -0,0 +1,542 @@
+{
+  "$schema": "https://schemas.codex-provider-sync.invalid/gui-automation-manifest-0.4.json",
+  "schemaVersion": "0.4",
+  "manifestVersion": "0.4.0",
+  "application": "CodexProviderSync",
+  "window": {
+    "id": "window.main",
+    "region": "window",
+    "controlType": "Form",
+    "actions": ["get", "focus", "close"],
+    "visibleWhen": "application-running",
+    "enabledWhen": "application-running",
+    "applicationCapabilities": [],
+    "uiOnly": true,
+    "risk": "ui-lifecycle",
+    "scenarioIds": ["gui.launch", "gui.focus-existing-instance", "gui.shutdown"]
+  },
+  "controls": [
+    {
+      "id": "storage.codexHome",
+      "region": "storage",
+      "controlType": "ComboBox",
+      "actions": ["get", "set", "select"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": ["status"],
+      "uiOnly": false,
+      "risk": "local-settings",
+      "scenarioIds": ["gui.status.explicit-codex-home", "gui.settings.recent-home-persistence"],
+      "logicalControl": true
+    },
+    {
+      "id": "storage.codexHome.browse",
+      "region": "storage",
+      "controlType": "Button",
+      "actions": ["invoke"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": [],
+      "uiOnly": true,
+      "risk": "native-dialog",
+      "scenarioIds": ["gui.status.browse-codex-home"],
+      "logicalControl": true
+    },
+    {
+      "id": "storage.sqliteHome",
+      "region": "storage",
+      "controlType": "TextBox",
+      "actions": ["get", "set"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": ["status"],
+      "uiOnly": false,
+      "risk": "local-settings",
+      "scenarioIds": ["gui.status.explicit-sqlite-home", "gui.settings.sqlite-home-persistence"],
+      "logicalControl": true
+    },
+    {
+      "id": "storage.sqliteHome.browse",
+      "region": "storage",
+      "controlType": "Button",
+      "actions": ["invoke"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": [],
+      "uiOnly": true,
+      "risk": "native-dialog",
+      "scenarioIds": ["gui.status.browse-sqlite-home"],
+      "logicalControl": true
+    },
+    {
+      "id": "status.refresh",
+      "region": "status",
+      "controlType": "Button",
+      "actions": ["invoke"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": ["status"],
+      "uiOnly": false,
+      "risk": "read-only",
+      "scenarioIds": ["gui.status.refresh", "gui.status.refresh-failure"],
+      "logicalControl": true
+    },
+    {
+      "id": "status.output",
+      "region": "status",
+      "controlType": "RichTextBox",
+      "actions": ["get"],
+      "visibleWhen": "always",
+      "enabledWhen": "always-read-only",
+      "applicationCapabilities": ["status"],
+      "uiOnly": true,
+      "risk": "read-only",
+      "scenarioIds": ["gui.status.rendered-result", "gui.status.wsl-diagnostic"],
+      "logicalControl": true
+    },
+    {
+      "id": "provider.list",
+      "region": "provider",
+      "controlType": "ListView",
+      "actions": ["get", "select"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": ["sync", "switch"],
+      "uiOnly": false,
+      "risk": "operation-input",
+      "scenarioIds": ["gui.provider.select", "gui.provider.persist-selection"],
+      "logicalControl": true
+    },
+    {
+      "id": "provider.manualId",
+      "region": "provider",
+      "controlType": "TextBox",
+      "actions": ["get", "set"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": ["settings"],
+      "uiOnly": false,
+      "risk": "local-settings",
+      "scenarioIds": ["gui.provider.manual-input"],
+      "logicalControl": true
+    },
+    {
+      "id": "provider.addManual",
+      "region": "provider",
+      "controlType": "Button",
+      "actions": ["invoke"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": ["settings"],
+      "uiOnly": false,
+      "risk": "local-settings",
+      "scenarioIds": ["gui.provider.add-manual", "gui.provider.add-manual-validation"],
+      "logicalControl": true
+    },
+    {
+      "id": "provider.removeManual",
+      "region": "provider",
+      "controlType": "Button",
+      "actions": ["invoke"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": ["settings"],
+      "uiOnly": false,
+      "risk": "local-settings",
+      "scenarioIds": ["gui.provider.remove-manual", "gui.provider.remove-manual-validation"],
+      "logicalControl": true
+    },
+    {
+      "id": "execution.updateConfig",
+      "region": "execution",
+      "controlType": "CheckBox",
+      "actions": ["get", "set", "toggle"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": ["sync", "switch"],
+      "uiOnly": false,
+      "risk": "operation-input",
+      "scenarioIds": ["gui.sync.mode", "gui.switch.mode"],
+      "logicalControl": true
+    },
+    {
+      "id": "execution.model.followProvider",
+      "region": "execution",
+      "controlType": "RadioButton",
+      "actions": ["get", "set"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy-and-switch-mode",
+      "applicationCapabilities": ["switch"],
+      "uiOnly": false,
+      "risk": "operation-input",
+      "scenarioIds": ["gui.switch.model-follow-provider"],
+      "logicalControl": true
+    },
+    {
+      "id": "execution.model.keepCurrent",
+      "region": "execution",
+      "controlType": "RadioButton",
+      "actions": ["get", "set"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy-and-switch-mode",
+      "applicationCapabilities": ["switch"],
+      "uiOnly": false,
+      "risk": "operation-input",
+      "scenarioIds": ["gui.switch.model-keep-current"],
+      "logicalControl": true
+    },
+    {
+      "id": "execution.model.custom",
+      "region": "execution",
+      "controlType": "RadioButton",
+      "actions": ["get", "set"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy-and-switch-mode",
+      "applicationCapabilities": ["switch"],
+      "uiOnly": false,
+      "risk": "operation-input",
+      "scenarioIds": ["gui.switch.model-custom-mode"],
+      "logicalControl": true
+    },
+    {
+      "id": "execution.customModel",
+      "region": "execution",
+      "controlType": "TextBox",
+      "actions": ["get", "set"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy-and-custom-model-mode",
+      "applicationCapabilities": ["switch"],
+      "uiOnly": false,
+      "risk": "operation-input",
+      "scenarioIds": ["gui.switch.model-custom-value", "gui.switch.model-custom-validation"],
+      "logicalControl": true
+    },
+    {
+      "id": "restore.includeConfig",
+      "region": "restore",
+      "controlType": "CheckBox",
+      "actions": ["get", "set", "toggle"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": ["restore"],
+      "uiOnly": false,
+      "risk": "operation-input",
+      "scenarioIds": ["gui.restore.include-config", "gui.restore.relocation-config-conflict"],
+      "logicalControl": true
+    },
+    {
+      "id": "restore.includeDatabase",
+      "region": "restore",
+      "controlType": "CheckBox",
+      "actions": ["get", "set", "toggle"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": ["restore"],
+      "uiOnly": false,
+      "risk": "operation-input",
+      "scenarioIds": ["gui.restore.include-database", "gui.restore.sqlite-relocation"],
+      "logicalControl": true
+    },
+    {
+      "id": "restore.includeSessions",
+      "region": "restore",
+      "controlType": "CheckBox",
+      "actions": ["get", "set", "toggle"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": ["restore"],
+      "uiOnly": false,
+      "risk": "operation-input",
+      "scenarioIds": ["gui.restore.include-sessions"],
+      "logicalControl": true
+    },
+    {
+      "id": "backup.retentionCount",
+      "region": "backup",
+      "controlType": "NumericUpDown",
+      "actions": ["get", "set"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": ["sync", "switch", "prune"],
+      "uiOnly": false,
+      "risk": "local-settings",
+      "scenarioIds": ["gui.backup.retention", "gui.backup.retention-persistence"],
+      "logicalControl": true
+    },
+    {
+      "id": "operation.execute",
+      "region": "operation",
+      "controlType": "Button",
+      "actions": ["invoke"],
+      "visibleWhen": "always",
+      "enabledWhen": "ready-not-busy-and-storage-supported",
+      "applicationCapabilities": ["sync", "switch"],
+      "uiOnly": false,
+      "risk": "data-mutation",
+      "scenarioIds": ["gui.sync.execute", "gui.switch.execute", "gui.operation.busy", "gui.operation.failure"],
+      "logicalControl": true
+    },
+    {
+      "id": "restore.execute",
+      "region": "restore",
+      "controlType": "Button",
+      "actions": ["invoke"],
+      "visibleWhen": "always",
+      "enabledWhen": "ready-not-busy-and-storage-supported",
+      "applicationCapabilities": ["restore"],
+      "uiOnly": false,
+      "risk": "data-mutation",
+      "scenarioIds": ["gui.restore.execute", "gui.restore.cancel", "gui.restore.failure"],
+      "logicalControl": true
+    },
+    {
+      "id": "backups.openDirectory",
+      "region": "backup",
+      "controlType": "Button",
+      "actions": ["invoke"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": [],
+      "uiOnly": true,
+      "risk": "shell-boundary",
+      "scenarioIds": ["gui.backup.open-directory"],
+      "logicalControl": true
+    },
+    {
+      "id": "backups.prune",
+      "region": "backup",
+      "controlType": "Button",
+      "actions": ["invoke"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": ["prune"],
+      "uiOnly": false,
+      "risk": "data-deletion",
+      "scenarioIds": ["gui.backup.prune", "gui.backup.prune-cancel"],
+      "logicalControl": true
+    },
+    {
+      "id": "updates.check",
+      "region": "update",
+      "controlType": "Button",
+      "actions": ["invoke"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy-and-not-checking-update",
+      "applicationCapabilities": [],
+      "uiOnly": true,
+      "risk": "network-and-process-lifecycle",
+      "scenarioIds": ["gui.update.check", "gui.update.no-update", "gui.update.failure"],
+      "logicalControl": true
+    },
+    {
+      "id": "logs.openDirectory",
+      "region": "logs",
+      "controlType": "Button",
+      "actions": ["invoke"],
+      "visibleWhen": "always",
+      "enabledWhen": "not-busy",
+      "applicationCapabilities": [],
+      "uiOnly": true,
+      "risk": "shell-boundary",
+      "scenarioIds": ["gui.logs.open-directory", "gui.logs.open-directory-failure"],
+      "logicalControl": true
+    },
+    {
+      "id": "logs.output",
+      "region": "logs",
+      "controlType": "TextBox",
+      "actions": ["get"],
+      "visibleWhen": "always",
+      "enabledWhen": "always-read-only",
+      "applicationCapabilities": [],
+      "uiOnly": true,
+      "risk": "read-only-redacted-output",
+      "scenarioIds": ["gui.logs.rendered-output", "gui.logs.write-failure-warning"],
+      "logicalControl": true
+    },
+    {
+      "id": "state.selectedProvider",
+      "region": "state",
+      "controlType": "Label",
+      "actions": ["get"],
+      "visibleWhen": "always",
+      "enabledWhen": "always-read-only",
+      "applicationCapabilities": ["sync", "switch"],
+      "uiOnly": true,
+      "risk": "read-only",
+      "scenarioIds": ["gui.provider.selection-state"],
+      "logicalControl": false
+    },
+    {
+      "id": "state.operation",
+      "region": "state",
+      "controlType": "Label",
+      "actions": ["get"],
+      "visibleWhen": "always",
+      "enabledWhen": "always-read-only",
+      "applicationCapabilities": ["status", "sync", "switch", "restore", "prune"],
+      "uiOnly": true,
+      "risk": "read-only",
+      "scenarioIds": ["gui.operation.ready-state", "gui.operation.busy-state"],
+      "logicalControl": false
+    },
+    {
+      "id": "warning.closeCodex.primary",
+      "region": "warning",
+      "controlType": "Label",
+      "actions": ["get"],
+      "visibleWhen": "always",
+      "enabledWhen": "always-read-only",
+      "applicationCapabilities": [],
+      "uiOnly": true,
+      "risk": "safety-guidance",
+      "scenarioIds": ["gui.warning.close-codex"],
+      "logicalControl": false
+    },
+    {
+      "id": "warning.closeCodex.secondary",
+      "region": "warning",
+      "controlType": "Label",
+      "actions": ["get"],
+      "visibleWhen": "always",
+      "enabledWhen": "always-read-only",
+      "applicationCapabilities": [],
+      "uiOnly": true,
+      "risk": "safety-guidance",
+      "scenarioIds": ["gui.warning.close-app-server"],
+      "logicalControl": false
+    }
+  ],
+  "templates": [
+    {
+      "id": "provider.row",
+      "ownerControlId": "provider.list",
+      "controlType": "ListViewItem",
+      "actions": ["get", "select"],
+      "visibleWhen": "provider-discovered-or-saved",
+      "enabledWhen": "provider-list-enabled",
+      "applicationCapabilities": ["sync", "switch"],
+      "uiOnly": false,
+      "risk": "operation-input",
+      "scenarioIds": ["gui.provider.dynamic-row-identity", "gui.provider.dynamic-row-selection"],
+      "identity": {
+        "instanceKey": "sha256-96",
+        "source": "normalized-provider-id",
+        "normalization": "trim-unicode-nfkc",
+        "visibleTextParticipates": false,
+        "listOrderParticipates": false
+      }
+    },
+    {
+      "id": "storage.codexHome.recent",
+      "ownerControlId": "storage.codexHome",
+      "controlType": "ComboBoxItem",
+      "actions": ["get", "select"],
+      "visibleWhen": "recent-home-present",
+      "enabledWhen": "codex-home-enabled",
+      "applicationCapabilities": ["status"],
+      "uiOnly": false,
+      "risk": "local-settings",
+      "scenarioIds": ["gui.settings.recent-home-identity", "gui.settings.recent-home-selection"],
+      "identity": {
+        "instanceKey": "sha256-96",
+        "source": "normalized-recent-codex-home",
+        "normalization": "full-path-trim-ending-separator-windows-case-fold-then-trim-unicode-nfkc",
+        "visibleTextParticipates": false,
+        "listOrderParticipates": false
+      }
+    }
+  ],
+  "dialogs": [
+    {
+      "id": "dialog.storage.codexHomePicker",
+      "owner": "windows-shell",
+      "kind": "native-folder-picker",
+      "launchControlId": "storage.codexHome.browse",
+      "actions": ["accept", "cancel"],
+      "risk": "filesystem-selection",
+      "scenarioIds": ["gui.status.browse-codex-home"],
+      "exemptionId": "native-folder-picker-internals"
+    },
+    {
+      "id": "dialog.storage.sqliteHomePicker",
+      "owner": "windows-shell",
+      "kind": "native-folder-picker",
+      "launchControlId": "storage.sqliteHome.browse",
+      "actions": ["accept", "cancel"],
+      "risk": "filesystem-selection",
+      "scenarioIds": ["gui.status.browse-sqlite-home"],
+      "exemptionId": "native-folder-picker-internals"
+    },
+    {
+      "id": "dialog.restore.backupPicker",
+      "owner": "windows-shell",
+      "kind": "native-folder-picker",
+      "launchControlId": "restore.execute",
+      "actions": ["accept", "cancel"],
+      "risk": "filesystem-selection",
+      "scenarioIds": ["gui.restore.select-backup"],
+      "exemptionId": "native-folder-picker-internals"
+    },
+    {
+      "id": "dialog.validation",
+      "owner": "application",
+      "kind": "message-box-family",
+      "launchControlIds": ["provider.addManual", "provider.removeManual", "operation.execute", "restore.execute"],
+      "actions": ["acknowledge"],
+      "risk": "ui-only",
+      "scenarioIds": ["gui.provider.add-manual-validation", "gui.provider.remove-manual-validation", "gui.switch.model-custom-validation", "gui.restore.no-target-validation"],
+      "exemptionId": "native-message-box-internals"
+    },
+    {
+      "id": "dialog.confirmation",
+      "owner": "application",
+      "kind": "message-box-family",
+      "launchControlIds": ["operation.execute", "restore.execute", "backups.prune"],
+      "actions": ["accept", "cancel"],
+      "risk": "mutation-confirmation",
+      "scenarioIds": ["gui.sync.confirm-close-codex", "gui.restore.confirm-targets", "gui.restore.confirm-close-codex", "gui.restore.confirm-sqlite-relocation", "gui.backup.prune-confirmation"],
+      "exemptionId": "native-message-box-internals"
+    },
+    {
+      "id": "dialog.operationFailure",
+      "owner": "application",
+      "kind": "message-box-family",
+      "launchControlIds": ["status.refresh", "operation.execute", "restore.execute", "backups.prune", "logs.openDirectory"],
+      "actions": ["acknowledge"],
+      "risk": "error-reporting",
+      "scenarioIds": ["gui.operation.failure", "gui.restore.metadata-failure", "gui.logs.open-directory-failure"],
+      "exemptionId": "native-message-box-internals"
+    },
+    {
+      "id": "dialog.update",
+      "owner": "application",
+      "kind": "message-box-family",
+      "launchControlIds": ["updates.check"],
+      "actions": ["accept", "decline", "acknowledge"],
+      "risk": "network-and-process-lifecycle",
+      "scenarioIds": ["gui.update.available", "gui.update.no-update", "gui.update.timeout", "gui.update.failure", "gui.update.apply-failure"],
+      "exemptionId": "native-message-box-internals"
+    }
+  ],
+  "exemptions": [
+    {
+      "id": "native-folder-picker-internals",
+      "scope": "controls-created-inside-the-three-Windows-owned-FolderBrowserDialog-windows",
+      "reason": "Windows owns their class names, hierarchy, and accessibility identifiers; only the application browse button and the selected isolated path form the supported contract.",
+      "doesNotExempt": ["storage.codexHome.browse", "storage.sqliteHome.browse", "restore.execute"]
+    },
+    {
+      "id": "native-message-box-internals",
+      "scope": "child HWNDs and standard buttons created inside WinForms MessageBox windows",
+      "reason": "WinForms delegates MessageBox hierarchy and native button identifiers to user32; launch controls, dialog text, result, and resulting application state remain test obligations.",
+      "doesNotExempt": ["provider.addManual", "provider.removeManual", "operation.execute", "restore.execute", "backups.prune", "updates.check"]
+    },
+    {
+      "id": "framework-composite-internals",
+      "scope": "non-independent child HWNDs created by NumericUpDown and other registered WinForms composite controls",
+      "reason": "These children implement a declared logical control and are not separate application entry points.",
+      "doesNotExempt": ["backup.retentionCount"]
+    }
+  ]
+}
diff --git a/desktop/CodexProviderSync.App/CodexProviderSync.App.csproj b/desktop/CodexProviderSync.App/CodexProviderSync.App.csproj
index 10833eb..1333730 100644
--- a/desktop/CodexProviderSync.App/CodexProviderSync.App.csproj
+++ b/desktop/CodexProviderSync.App/CodexProviderSync.App.csproj
@@ -1,9 +1,20 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <ItemGroup>
+    <ProjectReference Include="..\CodexProviderSync.Application\CodexProviderSync.Application.csproj" />
     <ProjectReference Include="..\CodexProviderSync.Core\CodexProviderSync.Core.csproj" />
   </ItemGroup>
 
+  <ItemGroup>
+    <Content Include="Automation\gui-automation-manifest.v0.4.json">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+      <CopyToPublishDirectory>PreserveNewest</CopyToPublishDirectory>
+    </Content>
+    <EmbeddedResource Include="Automation\gui-automation-manifest.v0.4.json">
+      <LogicalName>CodexProviderSync.App.Automation.gui-automation-manifest.v0.4.json</LogicalName>
+    </EmbeddedResource>
+  </ItemGroup>
+
   <PropertyGroup>
     <OutputType>WinExe</OutputType>
     <TargetFramework>net10.0-windows</TargetFramework>
@@ -13,9 +24,9 @@
     <AssemblyName>CodexProviderSync</AssemblyName>
     <Product>Codex Provider Sync</Product>
     <Company>Dailin521</Company>
-    <Version>0.3.2</Version>
-    <AssemblyVersion>0.3.2.0</AssemblyVersion>
-    <FileVersion>0.3.2.0</FileVersion>
+    <Version>0.4.0</Version>
+    <AssemblyVersion>0.4.0.0</AssemblyVersion>
+    <FileVersion>0.4.0.0</FileVersion>
   </PropertyGroup>
 
 </Project>
diff --git a/desktop/CodexProviderSync.App/ExecutionLogService.cs b/desktop/CodexProviderSync.App/ExecutionLogService.cs
index cb2cad6..e03a68f 100644
--- a/desktop/CodexProviderSync.App/ExecutionLogService.cs
+++ b/desktop/CodexProviderSync.App/ExecutionLogService.cs
@@ -1,6 +1,5 @@
 using System.Globalization;
 using System.Text;
-using CodexProviderSync.Core;
 
 namespace CodexProviderSync.App;
 
@@ -26,7 +25,7 @@ public ExecutionLogService(
         }
 
         LogDirectory = string.IsNullOrWhiteSpace(logDirectory)
-            ? Path.Combine(AppConstants.SettingsDirectory(), "logs")
+            ? new SystemAppPathProvider().LogDirectory
             : Path.GetFullPath(logDirectory);
         _clock = clock ?? (() => DateTimeOffset.Now);
         _retentionDays = retentionDays;
diff --git a/desktop/CodexProviderSync.App/FocusRequestServer.cs b/desktop/CodexProviderSync.App/FocusRequestServer.cs
index 0f7308b..eb876f1 100644
--- a/desktop/CodexProviderSync.App/FocusRequestServer.cs
+++ b/desktop/CodexProviderSync.App/FocusRequestServer.cs
@@ -4,6 +4,7 @@
 using System.Security.Principal;
 using System.Threading;
 using System.Threading.Tasks;
+using CodexProviderSync.App.Automation;
 
 namespace CodexProviderSync.App;
 
@@ -70,10 +71,13 @@ private async Task RunAsync()
                     PipeDirection.In,
                     NamedPipeServerStream.MaxAllowedServerInstances,
                     PipeTransmissionMode.Byte,
-                    PipeOptions.Asynchronous);
+                    PipeOptions.Asynchronous | PipeOptions.CurrentUserOnly);
                 await server.WaitForConnectionAsync(_shutdown.Token).ConfigureAwait(false);
-                using StreamReader reader = new(server);
-                string? line = await reader.ReadLineAsync().ConfigureAwait(false);
+                string? line = await GuiAutomationBridge.ReadBoundedLineAsync(
+                    server,
+                    maximumBytes: 16,
+                    timeout: TimeSpan.FromSeconds(2),
+                    cancellationToken: _shutdown.Token).ConfigureAwait(false);
                 if (string.Equals(line, "FOCUS", StringComparison.Ordinal))
                 {
                     _onFocusRequested();
diff --git a/desktop/CodexProviderSync.App/MainForm.cs b/desktop/CodexProviderSync.App/MainForm.cs
index 0abcc1c..d0bdf16 100644
--- a/desktop/CodexProviderSync.App/MainForm.cs
+++ b/desktop/CodexProviderSync.App/MainForm.cs
@@ -1,5 +1,7 @@
-using System.Diagnostics;
+using CodexProviderSync.App.Automation;
+using CodexProviderSync.Application;
 using CodexProviderSync.Core;
+using System.Text.Json;
 
 namespace CodexProviderSync.App;
 
@@ -7,10 +9,15 @@ public sealed class MainForm : Form
 {
     private const int ActionGroupMinimumWidth = 460;
 
-    private readonly CodexSyncService _syncService = new();
+    private readonly CodexSyncService _syncService;
+    private readonly IApplicationService _applicationService;
+    private readonly ApplicationOperationTraceHub _applicationTraceHub;
+    private readonly AppController _appController;
     private readonly SettingsService _settingsService;
     private readonly UpdateService _updateService;
     private readonly ExecutionLogService _executionLogService;
+    private readonly IAppPathProvider _paths;
+    private readonly IAppPlatformBoundary _platformBoundary;
     private readonly Func<DateOnly> _localDate;
 
     private readonly ComboBox _codexHomeCombo = new() { Dock = DockStyle.Fill, DropDownStyle = ComboBoxStyle.DropDown };
@@ -126,9 +133,18 @@ public sealed class MainForm : Form
     private bool _logFailureReported;
     private bool _busy;
     private bool _updateCheckInProgress;
+    private bool _renderingControllerState;
     private string? _sqliteOverrideCodexHome;
 
-    public MainForm() : this(new ExecutionLogService())
+    public MainForm() : this(new SystemAppPathProvider())
+    {
+    }
+
+    private MainForm(IAppPathProvider paths) : this(
+        new ExecutionLogService(paths.LogDirectory),
+        new SettingsService(paths.SettingsPath),
+        paths: paths,
+        platformBoundary: new SystemAppPlatformBoundary(paths))
     {
     }
 
@@ -136,13 +152,35 @@ internal MainForm(
         ExecutionLogService executionLogService,
         SettingsService? settingsService = null,
         UpdateService? updateService = null,
-        Func<DateOnly>? localDate = null)
-    {
+        Func<DateOnly>? localDate = null,
+        IAppPathProvider? paths = null,
+        IAppPlatformBoundary? platformBoundary = null,
+        CodexSyncService? syncService = null,
+        IApplicationService? applicationService = null,
+        ApplicationOperationTraceHub? applicationTraceHub = null)
+    {
+        _paths = paths ?? new SystemAppPathProvider();
+        _platformBoundary = platformBoundary ?? new SystemAppPlatformBoundary(_paths);
         _executionLogService = executionLogService;
-        _settingsService = settingsService ?? new SettingsService();
+        _settingsService = settingsService ?? new SettingsService(_paths.SettingsPath);
         _updateService = updateService ?? new UpdateService();
         _localDate = localDate ?? (() => DateOnly.FromDateTime(DateTime.Now));
+        _syncService = syncService ?? new CodexSyncService();
+        _applicationTraceHub = applicationTraceHub ?? new ApplicationOperationTraceHub();
+        IApplicationService sharedApplicationService = applicationService ?? new ApplicationService(
+            new CoreApplicationStatusPort(_syncService),
+            new CoreApplicationWritePort(_syncService, new CodexHomeService()),
+            new InMemoryApplicationPlanLedger());
+        _applicationService = new TrackedApplicationService(
+            sharedApplicationService,
+            _applicationTraceHub);
+        _appController = new AppController(new CoreApplicationAdapter(
+            _syncService,
+            _settingsService,
+            new CodexHomeService(),
+            _applicationService));
         Text = "Codex Provider Sync";
+        ConfigureAutomationIdentities();
         MinimumSize = new Size(1180, 760);
         StartPosition = FormStartPosition.CenterScreen;
 
@@ -164,11 +202,52 @@ internal MainForm(
         WireEvents();
     }
 
+    private void ConfigureAutomationIdentities()
+    {
+        GuiAutomationCatalog.Register(this, GuiAutomationCatalog.Ids.MainWindow);
+        GuiAutomationCatalog.Register(_codexHomeCombo, GuiAutomationCatalog.Ids.CodexHome);
+        GuiAutomationCatalog.Register(_browseButton, GuiAutomationCatalog.Ids.BrowseCodexHome);
+        GuiAutomationCatalog.Register(_refreshButton, GuiAutomationCatalog.Ids.RefreshStatus);
+        GuiAutomationCatalog.Register(_sqliteHomeText, GuiAutomationCatalog.Ids.SqliteHome);
+        GuiAutomationCatalog.Register(_browseSqliteHomeButton, GuiAutomationCatalog.Ids.BrowseSqliteHome);
+        GuiAutomationCatalog.Register(_statusBox, GuiAutomationCatalog.Ids.StatusOutput);
+        GuiAutomationCatalog.Register(_providerList, GuiAutomationCatalog.Ids.ProviderList);
+        GuiAutomationCatalog.Register(_manualProviderText, GuiAutomationCatalog.Ids.ManualProviderId);
+        GuiAutomationCatalog.Register(_addProviderButton, GuiAutomationCatalog.Ids.AddManualProvider);
+        GuiAutomationCatalog.Register(_removeProviderButton, GuiAutomationCatalog.Ids.RemoveManualProvider);
+        GuiAutomationCatalog.Register(_selectedProviderValue, GuiAutomationCatalog.Ids.SelectedProvider);
+        GuiAutomationCatalog.Register(_updateConfigCheck, GuiAutomationCatalog.Ids.UpdateConfig);
+        GuiAutomationCatalog.Register(_modelAutoRadio, GuiAutomationCatalog.Ids.FollowProviderModel);
+        GuiAutomationCatalog.Register(_modelKeepRadio, GuiAutomationCatalog.Ids.KeepCurrentModel);
+        GuiAutomationCatalog.Register(_modelCustomRadio, GuiAutomationCatalog.Ids.CustomModelMode);
+        GuiAutomationCatalog.Register(_modelCustomText, GuiAutomationCatalog.Ids.CustomModel);
+        GuiAutomationCatalog.Register(_restoreConfigCheck, GuiAutomationCatalog.Ids.RestoreConfig);
+        GuiAutomationCatalog.Register(_restoreDatabaseCheck, GuiAutomationCatalog.Ids.RestoreDatabase);
+        GuiAutomationCatalog.Register(_restoreSessionsCheck, GuiAutomationCatalog.Ids.RestoreSessions);
+        GuiAutomationCatalog.Register(_backupRetentionInput, GuiAutomationCatalog.Ids.BackupRetention);
+        GuiAutomationCatalog.Register(_executeButton, GuiAutomationCatalog.Ids.Execute);
+        GuiAutomationCatalog.Register(_restoreButton, GuiAutomationCatalog.Ids.Restore);
+        GuiAutomationCatalog.Register(_openBackupButton, GuiAutomationCatalog.Ids.OpenBackupDirectory);
+        GuiAutomationCatalog.Register(_pruneBackupsButton, GuiAutomationCatalog.Ids.PruneBackups);
+        GuiAutomationCatalog.Register(_checkUpdateButton, GuiAutomationCatalog.Ids.CheckUpdates);
+        GuiAutomationCatalog.Register(_openLogButton, GuiAutomationCatalog.Ids.OpenLogDirectory);
+        GuiAutomationCatalog.Register(_busyLabel, GuiAutomationCatalog.Ids.OperationState);
+        GuiAutomationCatalog.Register(_warningLine1, GuiAutomationCatalog.Ids.CloseCodexWarningPrimary);
+        GuiAutomationCatalog.Register(_warningLine2, GuiAutomationCatalog.Ids.CloseCodexWarningSecondary);
+        GuiAutomationCatalog.Register(_logBox, GuiAutomationCatalog.Ids.LogOutput);
+    }
+
     protected override async void OnLoad(EventArgs e)
     {
         base.OnLoad(e);
+        // Disable all mutable entry points before the first asynchronous
+        // settings read can yield and the form becomes visible.
+        SetBusy(true, "初始化中...");
         await LoadStateAsync();
-        _ = CheckForUpdatesAsync(UpdateCheckTrigger.Automatic);
+        if (_platformBoundary.UpdatesEnabled && !_paths.IsAutomation)
+        {
+            _ = CheckForUpdatesAsync(UpdateCheckTrigger.Automatic);
+        }
     }
 
     /// <summary>
@@ -197,6 +276,15 @@ public void RequestBringToFront()
         Focus();
     }
 
+    internal ApplicationOperationTraceHub ApplicationTraceHub => _applicationTraceHub;
+
+    internal static bool IsApplicationBoundAutomationId(string automationId) =>
+        automationId is
+            GuiAutomationCatalog.Ids.RefreshStatus
+            or GuiAutomationCatalog.Ids.Execute
+            or GuiAutomationCatalog.Ids.Restore
+            or GuiAutomationCatalog.Ids.PruneBackups;
+
     protected override void OnFormClosing(FormClosingEventArgs e)
     {
         PersistUiState();
@@ -434,17 +522,42 @@ private Control BuildUpdateConfigPanel()
         modelOptions.Controls.Add(_modelCustomText, 1, 3);
         panel.Controls.Add(modelOptions, 0, 1);
 
-        _modelAutoRadio.CheckedChanged += (_, _) => UpdateModelOptionsEnabled();
-        _modelKeepRadio.CheckedChanged += (_, _) => UpdateModelOptionsEnabled();
-        _modelCustomRadio.CheckedChanged += (_, _) => UpdateModelOptionsEnabled();
-        _updateConfigCheck.CheckedChanged += (_, _) => UpdateModelOptionsEnabled();
+        _modelAutoRadio.CheckedChanged += (_, _) => UpdateControllerModelState();
+        _modelKeepRadio.CheckedChanged += (_, _) => UpdateControllerModelState();
+        _modelCustomRadio.CheckedChanged += (_, _) => UpdateControllerModelState();
+        _modelCustomText.TextChanged += (_, _) => UpdateControllerModelState();
+        _updateConfigCheck.CheckedChanged += (_, _) => UpdateControllerModelState();
         UpdateModelOptionsEnabled();
         return panel;
     }
 
+    private void UpdateControllerModelState()
+    {
+        if (_renderingControllerState)
+        {
+            return;
+        }
+
+        _appController.SetUpdateConfig(_updateConfigCheck.Checked);
+        if (_modelCustomRadio.Checked)
+        {
+            _appController.SetModelMode(ModelMode.Custom);
+        }
+        else if (_modelKeepRadio.Checked)
+        {
+            _appController.SetModelMode(ModelMode.KeepRootModel);
+        }
+        else
+        {
+            _appController.SetModelMode(ModelMode.FollowProvider);
+        }
+        _appController.SetCustomModel(_modelCustomText.Text);
+        UpdateModelOptionsEnabled();
+    }
+
     private void UpdateModelOptionsEnabled()
     {
-        bool enabled = _updateConfigCheck.Checked;
+        bool enabled = !_busy && _updateConfigCheck.Checked;
         _modelAutoRadio.Enabled = enabled;
         _modelKeepRadio.Enabled = enabled;
         _modelCustomRadio.Enabled = enabled;
@@ -570,59 +683,72 @@ private void WireEvents()
     {
         _browseButton.Click += async (_, _) => await BrowseCodexHomeAsync();
         _browseSqliteHomeButton.Click += async (_, _) => await BrowseSqliteHomeAsync();
-        _refreshButton.Click += async (_, _) => await RefreshStatusAsync();
+        _refreshButton.Click += async (_, _) => await RunApplicationControlEventAsync(() => RefreshStatusAsync());
         _addProviderButton.Click += async (_, _) => await AddManualProviderAsync();
         _removeProviderButton.Click += async (_, _) => await RemoveManualProviderAsync();
         _backupRetentionInput.ValueChanged += async (_, _) => await PersistBackupRetentionAsync();
-        _executeButton.Click += async (_, _) => await ExecuteSyncOrSwitchAsync();
-        _restoreButton.Click += async (_, _) => await RestoreBackupAsync();
+        _executeButton.Click += async (_, _) => await RunApplicationControlEventAsync(ExecuteSyncOrSwitchAsync);
+        _restoreButton.Click += async (_, _) => await RunApplicationControlEventAsync(RestoreBackupAsync);
         _openBackupButton.Click += (_, _) => OpenBackupFolder();
-        _pruneBackupsButton.Click += async (_, _) => await PruneBackupsAsync();
+        _pruneBackupsButton.Click += async (_, _) => await RunApplicationControlEventAsync(PruneBackupsAsync);
         _checkUpdateButton.Click += async (_, _) => await CheckForUpdatesAsync(UpdateCheckTrigger.Manual);
         _openLogButton.Click += (_, _) => OpenLogFolder();
-        _providerList.SelectedIndexChanged += (_, _) => UpdateSelectionLabel();
+        _providerList.SelectedIndexChanged += (_, _) => UpdateControllerProviderSelection();
         _codexHomeCombo.Leave += async (_, _) => await PersistHomeSelectionAsync();
         _sqliteHomeText.Leave += async (_, _) => await PersistSqliteHomeOverrideAsync(CaptureStorageSelection());
     }
 
+    private void UpdateControllerProviderSelection()
+    {
+        if (_renderingControllerState)
+        {
+            return;
+        }
+
+        string? provider = _providerList.SelectedItems.Count == 0
+            ? null
+            : _providerList.SelectedItems[0].Tag as string;
+        _appController.SetProvider(provider);
+        UpdateSelectionLabel();
+    }
+
     private async Task LoadStateAsync()
     {
         _loadingSettings = true;
         _settings = await _settingsService.LoadAsync();
         ApplyWindowBounds(_settings.WindowBounds);
         ReloadRecentHomes();
-        _codexHomeCombo.Text = _settings.LastCodexHome ?? AppConstants.DefaultCodexHome();
+        _codexHomeCombo.Text = _settings.LastCodexHome ?? _paths.DefaultCodexHome;
         LoadSqliteHomeOverride(CurrentCodexHome());
         _backupRetentionInput.Value = Math.Max(_backupRetentionInput.Minimum, Math.Min(_backupRetentionInput.Maximum, _settings.BackupRetentionCount));
         AppendLog($"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] 已加载设置: {_settingsService.SettingsPath}");
         AppendLog($"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] 执行日志文件: {_executionLogService.CurrentLogPath}");
         _loadingSettings = false;
-        await RefreshStatusAsync();
+        await RunBusyAsync("刷新中...", async () =>
+        {
+            AppSnapshot snapshot = await Task.Run(async () => await _appController.InitializeAsync());
+            await ApplyControllerRefreshAsync(snapshot);
+        });
     }
 
-    private async Task RefreshStatusAsync()
+    private async Task RefreshStatusAsync(string? preferredProviderId = null)
     {
         (string codexHome, string? sqliteHome) = CaptureStorageSelection();
         await PersistSqliteHomeOverrideAsync((codexHome, sqliteHome));
-        await RunBusyAsync("刷新中...", () => RefreshStatusCoreAsync(codexHome, sqliteHome));
+        await RunBusyAsync("刷新中...", () => RefreshStatusCoreAsync(codexHome, sqliteHome, preferredProviderId));
     }
 
     private async Task BrowseCodexHomeAsync()
     {
-        using FolderBrowserDialog dialog = new()
-        {
-            Description = "选择 .codex 目录",
-            UseDescriptionForTitle = true,
-            InitialDirectory = Directory.Exists(CurrentCodexHome()) ? CurrentCodexHome() : AppConstants.DefaultCodexHome(),
-            ShowNewFolderButton = false
-        };
-
-        if (dialog.ShowDialog(this) != DialogResult.OK)
+        string? selectedPath = _platformBoundary.PickFolder(this, new FolderPickerRequest(
+            "选择 .codex 目录",
+            Directory.Exists(CurrentCodexHome()) ? CurrentCodexHome() : _paths.DefaultCodexHome));
+        if (selectedPath is null)
         {
             return;
         }
 
-        _codexHomeCombo.Text = dialog.SelectedPath;
+        _codexHomeCombo.Text = selectedPath;
         await PersistHomeSelectionAsync();
         await RefreshStatusAsync();
     }
@@ -644,23 +770,19 @@ private async Task PersistHomeSelectionAsync()
     private async Task BrowseSqliteHomeAsync()
     {
         (_, string? sqliteHome) = CaptureStorageSelection();
-        using FolderBrowserDialog dialog = new()
-        {
-            Description = "选择包含 state_5.sqlite 的目录",
-            UseDescriptionForTitle = true,
-            InitialDirectory = Directory.Exists(sqliteHome)
+        string? selectedPath = _platformBoundary.PickFolder(this, new FolderPickerRequest(
+            "选择包含 state_5.sqlite 的目录",
+            Directory.Exists(sqliteHome)
                 ? sqliteHome!
-                : CurrentCodexHome(),
-            ShowNewFolderButton = false
-        };
-        if (dialog.ShowDialog(this) != DialogResult.OK)
+                : CurrentCodexHome()));
+        if (selectedPath is null)
         {
             return;
         }
 
         (string codexHome, _) = CaptureStorageSelection();
-        _sqliteHomeText.Text = dialog.SelectedPath;
-        await PersistSqliteHomeOverrideAsync((codexHome, dialog.SelectedPath));
+        _sqliteHomeText.Text = selectedPath;
+        await PersistSqliteHomeOverrideAsync((codexHome, selectedPath));
         await RefreshStatusAsync();
     }
 
@@ -680,7 +802,9 @@ private async Task PersistSqliteHomeOverrideAsync((string CodexHome, string? Sql
     private void LoadSqliteHomeOverride(string codexHome)
     {
         _sqliteOverrideCodexHome = Path.GetFullPath(codexHome);
-        _sqliteHomeText.Text = _settingsService.GetSqliteHomeOverride(_settings, codexHome) ?? string.Empty;
+        _sqliteHomeText.Text = _settingsService.GetSqliteHomeOverride(_settings, codexHome)
+            ?? _paths.RequiredSqliteHomeOverride
+            ?? string.Empty;
     }
 
     private async Task PersistBackupRetentionAsync()
@@ -712,8 +836,7 @@ private async Task AddManualProviderAsync()
         _settings = _settingsService.AddManualProvider(_settings, provider);
         await _settingsService.SaveAsync(_settings);
         _manualProviderText.Clear();
-        ReloadProviderList();
-        SelectProvider(provider);
+        RefreshControllerProviderOptions(provider);
         AppendLog($"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] 已添加手动 Provider: {provider}");
     }
 
@@ -728,16 +851,30 @@ private async Task RemoveManualProviderAsync()
 
         _settings = _settingsService.RemoveManualProvider(_settings, provider);
         await _settingsService.SaveAsync(_settings);
-        ReloadProviderList();
-        SelectProvider(_currentStatus?.CurrentProvider.Provider);
+        RefreshControllerProviderOptions(_currentStatus?.CurrentProvider.Provider);
         AppendLog($"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] 已删除手动 Provider: {provider}");
     }
 
+    private void RefreshControllerProviderOptions(string? preferredProviderId)
+    {
+        if (_currentStatus is null)
+        {
+            return;
+        }
+
+        _appController.ApplyProviderOptions(
+            _syncService.BuildProviderOptions(_currentStatus, _settings),
+            preferredProviderId);
+        ReloadProviderList();
+    }
+
     private async Task ExecuteSyncOrSwitchAsync()
     {
         (string codexHome, string? sqliteHome) = CaptureStorageSelection();
-        string? provider = SelectedProvider();
-        if (string.IsNullOrWhiteSpace(provider))
+        _appController.SetStorage(codexHome, sqliteHome);
+        UpdateControllerModelState();
+        SyncRequestPreparation preparation = _appController.PrepareSyncRequest();
+        if (preparation.ValidationIssues.Contains(AppValidationIssue.ProviderRequired))
         {
             MessageBox.Show(this, "请先选择目标 Provider。", Text, MessageBoxButtons.OK, MessageBoxIcon.Information);
             return;
@@ -748,48 +885,64 @@ private async Task ExecuteSyncOrSwitchAsync()
             return;
         }
 
+        if (preparation.ValidationIssues.Contains(AppValidationIssue.CustomModelRequired))
+        {
+            MessageBox.Show(this, "请填写自定义 model 名称,或改成 \"跟随 provider\"。", Text, MessageBoxButtons.OK, MessageBoxIcon.Information);
+            return;
+        }
+        if (!preparation.IsValid)
+        {
+            MessageBox.Show(this, "当前状态无法执行同步，请先刷新后重试。", Text, MessageBoxButtons.OK, MessageBoxIcon.Information);
+            return;
+        }
+
+        PreparedSyncRequest request = preparation.Request!;
+        string provider = request.ProviderId;
+        int backupRetentionCount = CurrentBackupRetentionCount();
+
         await RunBusyAsync("执行中...", async () =>
         {
-            await PersistSqliteHomeOverrideAsync((codexHome, sqliteHome));
-            int backupRetentionCount = CurrentBackupRetentionCount();
-            SyncResult result;
-            if (_updateConfigCheck.Checked)
+            EnsureAutomationMutationBoundary(
+                request.CodexHome,
+                request.SqliteHomeOverride,
+                selectedBackupPath: null);
+            ApplicationWriteIntent intent = request switch
             {
-                bool keepRootModel = _modelKeepRadio.Checked;
-                string? explicitModel = _modelCustomRadio.Checked ? _modelCustomText.Text.Trim() : null;
-                if (_modelCustomRadio.Checked && string.IsNullOrEmpty(explicitModel))
+                SwitchProviderRequest switchRequest => new SwitchIntent(
+                    switchRequest.CodexHome,
+                    switchRequest.SqliteHomeOverride,
+                    switchRequest.ProviderId,
+                    switchRequest.ModelSelection,
+                    backupRetentionCount),
+                SyncProviderRequest syncRequest => new SyncIntent(
+                    syncRequest.CodexHome,
+                    syncRequest.SqliteHomeOverride,
+                    syncRequest.ProviderId,
+                    backupRetentionCount),
+                _ => throw new InvalidOperationException("Unsupported prepared sync request.")
+            };
+            SyncResult result = await ExecutePlannedWriteAsync<SyncResult>(
+                intent,
+                authorization => intent switch
                 {
-                    MessageBox.Show(this, "请填写自定义 model 名称,或改成 \"跟随 provider\"。", Text, MessageBoxButtons.OK, MessageBoxIcon.Information);
-                    return;
-                }
-                result = await Task.Run(async () => await _syncService.RunSwitchAsync(
-                    codexHome,
-                    provider,
-                    backupRetentionCount,
-                    model: explicitModel,
-                    keepRootModel: keepRootModel,
-                    explicitSqliteHome: sqliteHome));
-            }
-            else
-            {
-                result = await Task.Run(async () => await _syncService.RunSyncAsync(
-                    codexHome,
-                    provider: provider,
-                    keepCount: backupRetentionCount,
-                    explicitSqliteHome: sqliteHome));
-            }
-
+                    SwitchIntent switchIntent => Task.Run(() => _applicationService.SwitchAsync(
+                        new SwitchApplicationRequest(switchIntent, authorization))),
+                    SyncIntent syncIntent => Task.Run(() => _applicationService.SyncAsync(
+                        new SyncApplicationRequest(syncIntent, authorization))),
+                    _ => throw new InvalidOperationException("Unsupported Application write intent.")
+                });
+
+            await PersistSqliteHomeOverrideAsync((request.CodexHome, request.SqliteHomeOverride));
             _settings = _settingsService.UpdateState(_settings, provider, result.BackupDir, CaptureWindowBounds(), backupRetentionCount);
             await _settingsService.SaveAsync(_settings);
             AppendLog($"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] 执行完成");
             AppendLog(TextFormatter.FormatSyncResult(
                 result,
-                _updateConfigCheck.Checked ? "已切换并同步" : "已同步",
+                request is SwitchProviderRequest ? "已切换并同步" : "已同步",
                 TextFormatter.ChineseSimplified));
             AppendLog(FormatModelSyncOutcome(result.ModelSync));
             AppendLog(string.Empty);
-            await RefreshStatusCoreAsync(codexHome, sqliteHome);
-            SelectProvider(provider);
+            await RefreshStatusCoreAsync(request.CodexHome, request.SqliteHomeOverride, provider);
         });
     }
 
@@ -801,20 +954,18 @@ private async Task RestoreBackupAsync()
             ? _settings.LastBackupDirectory!
             : backupRoot;
 
-        using FolderBrowserDialog dialog = new()
-        {
-            Description = "选择要恢复的备份目录",
-            UseDescriptionForTitle = true,
-            InitialDirectory = initialBackupDir,
-            ShowNewFolderButton = false
-        };
-
-        if (dialog.ShowDialog(this) != DialogResult.OK)
+        string? selectedBackupPath = _platformBoundary.PickFolder(this, new FolderPickerRequest(
+            "选择要恢复的备份目录",
+            initialBackupDir));
+        if (selectedBackupPath is null)
         {
             return;
         }
 
-        if (!_restoreConfigCheck.Checked && !_restoreDatabaseCheck.Checked && !_restoreSessionsCheck.Checked)
+        bool restoreConfig = _restoreConfigCheck.Checked;
+        bool restoreDatabase = _restoreDatabaseCheck.Checked;
+        bool restoreSessions = _restoreSessionsCheck.Checked;
+        if (!restoreConfig && !restoreDatabase && !restoreSessions)
         {
             MessageBox.Show(this, "请至少选择一种要恢复的内容。", Text, MessageBoxButtons.OK, MessageBoxIcon.Information);
             return;
@@ -822,14 +973,14 @@ private async Task RestoreBackupAsync()
 
         string restoreTargets = string.Join("、", new[]
         {
-            _restoreConfigCheck.Checked ? "配置文件（config.toml）" : null,
-            _restoreDatabaseCheck.Checked ? "线程数据库（SQLite）" : null,
-            _restoreSessionsCheck.Checked ? "会话文件元数据（rollout）" : null
+            restoreConfig ? "配置文件（config.toml）" : null,
+            restoreDatabase ? "线程数据库（SQLite）" : null,
+            restoreSessions ? "会话文件元数据（rollout）" : null
         }.Where(static item => item is not null));
 
         DialogResult confirm = MessageBox.Show(
             this,
-            $"确认恢复以下备份？{Environment.NewLine}{Environment.NewLine}{dialog.SelectedPath}{Environment.NewLine}{Environment.NewLine}将覆盖当前的: {restoreTargets}。",
+            $"确认恢复以下备份？{Environment.NewLine}{Environment.NewLine}{selectedBackupPath}{Environment.NewLine}{Environment.NewLine}将覆盖当前的: {restoreTargets}。",
             Text,
             MessageBoxButtons.OKCancel,
             MessageBoxIcon.Warning);
@@ -846,10 +997,14 @@ private async Task RestoreBackupAsync()
         bool allowSqliteHomeRelocation = false;
         try
         {
-            if (_restoreDatabaseCheck.Checked)
+            EnsureAutomationMutationBoundary(codexHome, sqliteHome, selectedBackupPath);
+            if (restoreDatabase)
             {
-                BackupStorageInfo backupStorage = await _syncService.GetBackupStorageInfoAsync(dialog.SelectedPath);
-                StatusSnapshot targetStatus = await _syncService.GetStatusAsync(codexHome, sqliteHome);
+                BackupStorageInfo backupStorage = await _syncService.GetBackupStorageInfoAsync(selectedBackupPath);
+                StatusSnapshot targetStatus = RequireApplicationSuccess(
+                    await Task.Run(() => _applicationService.GetStatusAsync(
+                        new ApplicationStatusRequest(codexHome, sqliteHome))));
+                ValidateAutomationStatusSnapshot(targetStatus);
                 if (backupStorage.Version >= 2
                     && !string.IsNullOrWhiteSpace(backupStorage.SqliteHome)
                     && !PathsEqual(backupStorage.SqliteHome, targetStatus.StateDbLocation is null
@@ -859,7 +1014,7 @@ private async Task RestoreBackupAsync()
                     string targetSqliteHome = targetStatus.StateDbLocation is null
                         ? targetStatus.SqliteHome
                         : Path.GetDirectoryName(targetStatus.StateDbLocation.Path)!;
-                    if (_restoreConfigCheck.Checked)
+                    if (restoreConfig)
                     {
                         MessageBox.Show(
                             this,
@@ -895,18 +1050,20 @@ private async Task RestoreBackupAsync()
 
         await RunBusyAsync("恢复中...", async () =>
         {
-            RestoreResult result = await Task.Run(async () => await _syncService.RunRestoreAsync(
-                codexHome,
-                dialog.SelectedPath,
-                new RestoreBackupOptions
-                {
-                    RestoreConfig = _restoreConfigCheck.Checked,
-                    RestoreDatabase = _restoreDatabaseCheck.Checked,
-                    RestoreSessions = _restoreSessionsCheck.Checked,
-                    AllowSqliteHomeRelocation = allowSqliteHomeRelocation
-                },
-                sqliteHome));
-            _settings = _settingsService.UpdateState(_settings, SelectedProvider(), dialog.SelectedPath, CaptureWindowBounds(), CurrentBackupRetentionCount());
+            EnsureAutomationMutationBoundary(codexHome, sqliteHome, selectedBackupPath);
+            RestoreIntent intent = new(
+                CodexHome: codexHome,
+                SqliteHomeOverride: sqliteHome,
+                BackupDirectory: selectedBackupPath,
+                RestoreConfig: restoreConfig,
+                RestoreDatabase: restoreDatabase,
+                RestoreSessions: restoreSessions,
+                AllowSqliteHomeRelocation: allowSqliteHomeRelocation);
+            RestoreResult result = await ExecutePlannedWriteAsync<RestoreResult>(
+                intent,
+                authorization => Task.Run(() => _applicationService.RestoreAsync(
+                    new RestoreApplicationRequest(intent, authorization))));
+            _settings = _settingsService.UpdateState(_settings, SelectedProvider(), selectedBackupPath, CaptureWindowBounds(), CurrentBackupRetentionCount());
             await _settingsService.SaveAsync(_settings);
             AppendLog($"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] 恢复完成");
             AppendLog(TextFormatter.FormatRestoreResult(result, TextFormatter.ChineseSimplified));
@@ -918,12 +1075,9 @@ await RunBusyAsync("恢复中...", async () =>
     private void OpenBackupFolder()
     {
         string path = _currentStatus?.BackupRoot ?? AppConstants.DefaultBackupRoot(CurrentCodexHome());
+        EnsureAutomationPath(path, GuiAutomationCatalog.Ids.OpenBackupDirectory);
         Directory.CreateDirectory(path);
-        Process.Start(new ProcessStartInfo
-        {
-            FileName = path,
-            UseShellExecute = true
-        });
+        _platformBoundary.OpenPath(path);
     }
 
     private void OpenLogFolder()
@@ -931,11 +1085,7 @@ private void OpenLogFolder()
         try
         {
             Directory.CreateDirectory(_executionLogService.LogDirectory);
-            Process.Start(new ProcessStartInfo
-            {
-                FileName = _executionLogService.LogDirectory,
-                UseShellExecute = true
-            });
+            _platformBoundary.OpenPath(_executionLogService.LogDirectory);
             AppendLog($"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] 已打开日志目录: {_executionLogService.LogDirectory}");
         }
         catch (Exception error)
@@ -955,7 +1105,12 @@ private async Task PruneBackupsAsync()
 
         await RunBusyAsync("正在清理备份...", async () =>
         {
-            BackupPruneResult result = await Task.Run(async () => await _syncService.RunPruneBackupsAsync(codexHome, CurrentBackupRetentionCount()));
+            EnsureAutomationMutationBoundary(codexHome, sqliteHome, selectedBackupPath: null);
+            PruneIntent intent = new(codexHome, sqliteHome, CurrentBackupRetentionCount());
+            BackupPruneResult result = await ExecutePlannedWriteAsync<BackupPruneResult>(
+                intent,
+                authorization => Task.Run(() => _applicationService.PruneAsync(
+                    new PruneApplicationRequest(intent, authorization))));
             AppendLog($"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] 旧备份清理完成");
             AppendLog(TextFormatter.FormatBackupPruneResult(result, TextFormatter.ChineseSimplified));
             AppendLog(string.Empty);
@@ -965,6 +1120,11 @@ await RunBusyAsync("正在清理备份...", async () =>
 
     private async Task CheckForUpdatesAsync(UpdateCheckTrigger trigger)
     {
+        if (!_platformBoundary.UpdatesEnabled)
+        {
+            AppendLog($"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] GUI automation mode blocks update checks and process launches");
+            return;
+        }
         bool automatic = trigger == UpdateCheckTrigger.Automatic;
         DateOnly today = _localDate();
         if (automatic && !UpdateCheckPolicy.ShouldRunAutomaticCheck(_settings, today))
@@ -1035,7 +1195,9 @@ private async Task CheckForUpdatesCoreAsync(UpdateCheckTrigger trigger)
         UpdateCheckResult update;
         try
         {
-            update = await _updateService.CheckForUpdateAsync(currentVersion);
+            update = await _platformBoundary.CheckForUpdateAsync(
+                _updateService,
+                currentVersion);
         }
         catch (TimeoutException error)
         {
@@ -1110,13 +1272,11 @@ private async Task CheckForUpdatesCoreAsync(UpdateCheckTrigger trigger)
 
         try
         {
-            string updateDirectory = Path.Combine(
-                Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
-                "codex-provider-sync",
-                "updates");
-            DownloadedUpdate downloadedUpdate = await _updateService.DownloadWindowsExeAsync(update.LatestRelease, updateDirectory);
+            DownloadedUpdate downloadedUpdate = await _updateService.DownloadWindowsExeAsync(
+                update.LatestRelease,
+                _paths.UpdateDownloadDirectory);
             string targetExe = Environment.ProcessPath ?? throw new InvalidOperationException("无法确定当前程序文件路径。");
-            UpdateApplier.Start(downloadedUpdate.Path, targetExe, downloadedUpdate.Sha256);
+            _platformBoundary.StartUpdate(downloadedUpdate.Path, targetExe, downloadedUpdate.Sha256);
             AppendLog($"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] 已下载并校验 {update.LatestRelease.TagName}，正在重启完成更新。");
             BeginInvoke(Close);
         }
@@ -1154,7 +1314,7 @@ private void ReloadRecentHomes()
         _codexHomeCombo.Items.Clear();
         foreach (string home in _settings.RecentCodexHomes)
         {
-            _codexHomeCombo.Items.Add(home);
+            _codexHomeCombo.Items.Add(GuiAutomationCatalog.RecentCodexHome(home));
         }
         _codexHomeCombo.EndUpdate();
         if (!string.IsNullOrWhiteSpace(currentText))
@@ -1165,34 +1325,46 @@ private void ReloadRecentHomes()
 
     private void ReloadProviderList()
     {
-        _providerList.BeginUpdate();
-        _providerList.Items.Clear();
-
-        if (_currentStatus is not null)
+        _renderingControllerState = true;
+        try
         {
-            foreach (ProviderOption option in _syncService.BuildProviderOptions(_currentStatus, _settings))
+            _providerList.BeginUpdate();
+            _providerList.Items.Clear();
+            foreach (ProviderOptionState option in _appController.Snapshot.Providers)
             {
                 ListViewItem item = new(option.Id)
                 {
                     Tag = option.Id
                 };
-                item.SubItems.Add(TextFormatter.FormatProviderSources(option, TextFormatter.ChineseSimplified));
+                GuiAutomationCatalog.RegisterProviderRow(item, option.Id);
+                item.SubItems.Add(TextFormatter.FormatProviderSources(new ProviderOption
+                {
+                    Id = option.Id,
+                    Sources = option.Sources,
+                    IsCurrentProvider = option.IsCurrentProvider,
+                    IsManual = option.IsManual,
+                    IsSaved = option.IsSaved
+                }, TextFormatter.ChineseSimplified));
                 item.SubItems.Add(option.IsCurrentProvider ? "是" : string.Empty);
                 item.SubItems.Add(option.IsManual ? "是" : string.Empty);
                 item.SubItems.Add(option.IsSaved ? "是" : string.Empty);
                 _providerList.Items.Add(item);
             }
+            _providerList.EndUpdate();
+            SelectProviderInList(_appController.Snapshot.SelectedProviderId);
+            UpdateSelectionLabel();
+        }
+        finally
+        {
+            _renderingControllerState = false;
         }
-
-        _providerList.EndUpdate();
-        SelectProvider(_settings.LastSelectedProvider ?? _currentStatus?.CurrentProvider.Provider);
-        UpdateSelectionLabel();
     }
 
-    private void SelectProvider(string? provider)
+    private void SelectProviderInList(string? provider)
     {
         if (string.IsNullOrWhiteSpace(provider))
         {
+            _providerList.SelectedItems.Clear();
             return;
         }
 
@@ -1217,19 +1389,137 @@ private void UpdateSelectionLabel()
 
     private string? SelectedProvider()
     {
-        return _providerList.SelectedItems.Count == 0 ? null : _providerList.SelectedItems[0].Tag as string;
+        return _appController.Snapshot.SelectedProviderId;
     }
 
     private string CurrentCodexHome()
     {
         string text = _codexHomeCombo.Text.Trim();
-        return string.IsNullOrWhiteSpace(text) ? AppConstants.DefaultCodexHome() : text;
+        string path = string.IsNullOrWhiteSpace(text) ? _paths.DefaultCodexHome : text;
+        EnsureAutomationPath(path, GuiAutomationCatalog.Ids.CodexHome);
+        return path;
     }
 
     private string? CurrentSqliteHomeOverride()
     {
         string text = _sqliteHomeText.Text.Trim();
-        return string.IsNullOrWhiteSpace(text) ? null : text;
+        if (string.IsNullOrWhiteSpace(text))
+        {
+            return _paths.RequiredSqliteHomeOverride;
+        }
+        EnsureAutomationPath(text, GuiAutomationCatalog.Ids.SqliteHome);
+        return text;
+    }
+
+    internal void ValidateAutomationValue(string automationId, JsonElement value)
+    {
+        if (!_paths.IsAutomation
+            || automationId is not (GuiAutomationCatalog.Ids.CodexHome or GuiAutomationCatalog.Ids.SqliteHome))
+        {
+            return;
+        }
+        string? path = value.ValueKind == JsonValueKind.String ? value.GetString() : null;
+        if (automationId == GuiAutomationCatalog.Ids.SqliteHome && string.IsNullOrWhiteSpace(path))
+        {
+            return;
+        }
+        EnsureAutomationPath(path ?? string.Empty, automationId);
+    }
+
+    private void EnsureAutomationPath(string path, string automationId)
+    {
+        if (!_paths.IsAutomation)
+        {
+            return;
+        }
+
+        bool contained;
+        try
+        {
+            contained = !string.IsNullOrWhiteSpace(path) && _paths.Contains(path);
+        }
+        catch (Exception error) when (error is IOException
+            or UnauthorizedAccessException
+            or ArgumentException
+            or NotSupportedException)
+        {
+            throw new InvalidOperationException(
+                $"{automationId} could not be proven to remain inside the GUI automation isolation root.",
+                error);
+        }
+
+        if (!contained)
+        {
+            throw new InvalidOperationException(
+                $"{automationId} must remain inside the GUI automation isolation root.");
+        }
+    }
+
+    internal void ValidateAutomationStatusSnapshot(StatusSnapshot status)
+    {
+        ArgumentNullException.ThrowIfNull(status);
+        if (!_paths.IsAutomation)
+        {
+            return;
+        }
+
+        EnsureAutomationPath(status.CodexHome, "status.codexHome");
+        EnsureAutomationPath(status.SqliteHome, "status.sqliteHome");
+        EnsureAutomationPath(status.BackupRoot, "status.backupRoot");
+        if (status.StateDbLocation is { } stateDb)
+        {
+            EnsureAutomationPath(stateDb.Path, "status.stateDb");
+        }
+        foreach (string candidate in status.CheckedStateDbPaths)
+        {
+            EnsureAutomationPath(candidate, "status.checkedStateDb");
+        }
+        foreach (string rolloutPath in status.LockedRolloutFiles)
+        {
+            EnsureAutomationPath(rolloutPath, "status.lockedRollout");
+        }
+        foreach (string rolloutPath in status.UnreadableRolloutFiles)
+        {
+            EnsureAutomationPath(rolloutPath, "status.unreadableRollout");
+        }
+        foreach (TransactionRecoveryInfo pending in status.PendingTransactions)
+        {
+            EnsureAutomationPath(pending.BackupDirectory, "status.pendingBackup");
+            EnsureAutomationPath(pending.JournalPath, "status.pendingJournal");
+        }
+    }
+
+    internal void EnsureAutomationMutationBoundary(
+        string codexHome,
+        string? sqliteHome,
+        string? selectedBackupPath)
+    {
+        if (!_paths.IsAutomation)
+        {
+            return;
+        }
+
+        EnsureAutomationPath(codexHome, "mutation.codexHome");
+        string requiredSqliteHome = sqliteHome
+            ?? _paths.RequiredSqliteHomeOverride
+            ?? throw new InvalidOperationException(
+                "GUI automation mutations require an explicit isolated SQLite Home.");
+        EnsureAutomationPath(requiredSqliteHome, "mutation.sqliteHome");
+        if (selectedBackupPath is not null)
+        {
+            EnsureAutomationPath(selectedBackupPath, "mutation.backup");
+        }
+
+        StatusSnapshot status = _currentStatus
+            ?? throw new InvalidOperationException(
+                "GUI automation mutations require a successfully validated status refresh.");
+        ValidateAutomationStatusSnapshot(status);
+        if (!PathsEqual(status.CodexHome, codexHome)
+            || !PathsEqual(status.SqliteHome, requiredSqliteHome))
+        {
+            throw new InvalidOperationException(
+                "GUI automation storage inputs changed after the validated status refresh.");
+        }
     }
 
     internal (string CodexHome, string? SqliteHome) CaptureStorageSelection()
@@ -1266,14 +1556,34 @@ private void PersistUiState()
         }
     }
 
-    private async Task RefreshStatusCoreAsync(string codexHome, string? sqliteHome)
+    private async Task RefreshStatusCoreAsync(
+        string codexHome,
+        string? sqliteHome,
+        string? preferredProviderId = null)
     {
-        _currentStatus = await Task.Run(async () => await _syncService.GetStatusAsync(
+        AppSnapshot snapshot = await Task.Run(async () => await _appController.RefreshAsync(
             codexHome,
-            sqliteHome));
-        _settings = _settingsService.RecordCodexHome(_settings, _currentStatus.CodexHome);
-        _settings = _settingsService.MergeDetectedProviders(_settings, _syncService.ExtractDetectedProviderIds(_currentStatus));
-        _settings = _settingsService.UpdateState(_settings, SelectedProvider(), _settings.LastBackupDirectory, CaptureWindowBounds(), CurrentBackupRetentionCount());
+            sqliteHome,
+            preferredProviderId));
+        await ApplyControllerRefreshAsync(snapshot);
+    }
+
+    private async Task ApplyControllerRefreshAsync(AppSnapshot snapshot)
+    {
+        if (snapshot.Activity == AppActivity.Faulted || snapshot.Status is null)
+        {
+            throw new InvalidOperationException(snapshot.ErrorMessage ?? "Unable to refresh application state.");
+        }
+
+        ValidateAutomationStatusSnapshot(snapshot.Status);
+        _currentStatus = snapshot.Status;
+        _settings = await _settingsService.LoadAsync();
+        _settings = _settingsService.UpdateState(
+            _settings,
+            snapshot.SelectedProviderId,
+            _settings.LastBackupDirectory,
+            CaptureWindowBounds(),
+            CurrentBackupRetentionCount());
         await _settingsService.SaveAsync(_settings);
 
         _statusBox.Text = TextFormatter.FormatStatus(_currentStatus, TextFormatter.ChineseSimplified);
@@ -1307,6 +1617,138 @@ private void ApplyWindowBounds(WindowBoundsState? bounds)
         }
     }
 
+    private async Task RunApplicationControlEventAsync(Func<Task> action)
+    {
+        ArgumentNullException.ThrowIfNull(action);
+        try
+        {
+            await action();
+        }
+        finally
+        {
+            _applicationTraceHub.CompleteCurrentInvocation();
+        }
+    }
+
+    private T RequireApplicationSuccess<T>(ApplicationOutcome<T> outcome)
+        where T : class
+    {
+        AppendLog(
+            $"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] Application {outcome.Operation} "
+            + $"[{outcome.OperationId}] -> {outcome.Lifecycle}");
+        foreach (ApplicationWarning warning in outcome.Warnings)
+        {
+            AppendLog($"  警告 [{warning.Code}]: {warning.Message}");
+        }
+
+        if (outcome.IsSuccess && outcome.Data is not null)
+        {
+            return outcome.Data;
+        }
+
+        string detail = outcome.Errors.Count == 0
+            ? $"Application 操作结束状态为 {outcome.Lifecycle}。"
+            : string.Join(Environment.NewLine, outcome.Errors.Select(FormatApplicationError));
+        throw new GuiApplicationOutcomeException(
+            outcome.OperationId,
+            outcome.Operation,
+            outcome.Lifecycle,
+            detail);
+    }
+
+    private async Task<T> ExecutePlannedWriteAsync<T>(
+        ApplicationWriteIntent intent,
+        Func<ApplicationApplyAuthorization, Task<ApplicationOutcome<ApplicationWriteResult<T>>>> apply)
+        where T : class
+    {
+        ArgumentNullException.ThrowIfNull(intent);
+        ArgumentNullException.ThrowIfNull(apply);
+        for (int attempt = 0; attempt < 2; attempt++)
+        {
+            ApplicationOperationPlan plan = RequireReadyPlan(
+                await Task.Run(() => _applicationService.CreatePlanAsync(
+                    new CreateApplicationPlanRequest(intent))));
+            AppendPlanSummary(plan);
+            ApplicationOutcome<ApplicationWriteResult<T>> outcome = await apply(
+                new ApplicationApplyAuthorization(
+                    Apply: true,
+                    Plan: plan,
+                    PlanDigest: plan.Digest));
+            if (GuiApplicationOutcomePolicy.IsPlanStale(outcome) && attempt == 0)
+            {
+                AppendLog(
+                    $"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] 计划应用前状态发生变化，"
+                    + "将基于同一输入重新生成一次计划。");
+                continue;
+            }
+            return RequireAppliedOutcome(outcome);
+        }
+
+        throw new InvalidOperationException("The bounded plan retry was exhausted.");
+    }
+
+    private ApplicationOperationPlan RequireReadyPlan(
+        ApplicationOutcome<ApplicationOperationPlan> outcome)
+    {
+        ApplicationOperationPlan plan = RequireApplicationSuccess(outcome);
+        if (outcome.Lifecycle != ApplicationOperationLifecycle.ReadyToApply)
+        {
+            throw new GuiApplicationOutcomeException(
+                outcome.OperationId,
+                outcome.Operation,
+                outcome.Lifecycle,
+                "Application did not return a ready-to-apply plan.");
+        }
+        return plan;
+    }
+
+    private T RequireAppliedOutcome<T>(
+        ApplicationOutcome<ApplicationWriteResult<T>> outcome)
+        where T : class
+    {
+        ApplicationWriteResult<T> writeResult = RequireApplicationSuccess(outcome);
+        if (!GuiApplicationOutcomePolicy.IsAppliedSuccess(outcome))
+        {
+            throw new GuiApplicationOutcomeException(
+                outcome.OperationId,
+                outcome.Operation,
+                outcome.Lifecycle,
+                "Application returned a dry-run result where the GUI required explicit apply.");
+        }
+        return writeResult.Result!;
+    }
+
+    private void AppendPlanSummary(ApplicationOperationPlan plan)
+    {
+        AppendLog(
+            $"计划摘要: id={plan.PlanId}, digest={plan.Digest}, "
+            + $"目标={plan.Targets.Count}, 自动清理={plan.AutoPruneDeletionTargets.Count}, "
+            + $"过期={plan.ExpiresAtUtc:O}");
+        foreach (ApplicationPlanTarget target in plan.Targets)
+        {
+            AppendLog($"  {target.Action}: {target.Path} [{target.Fingerprint}]");
+        }
+        foreach (ApplicationPlanTarget target in plan.AutoPruneDeletionTargets)
+        {
+            AppendLog($"  auto-prune {target.Action}: {target.Path} [{target.Fingerprint}]");
+        }
+    }
+
+    private static string FormatApplicationError(ApplicationError error)
+    {
+        List<string> evidence = [];
+        if (!string.IsNullOrWhiteSpace(error.RollbackStatus))
+        {
+            evidence.Add($"rollback={error.RollbackStatus}");
+        }
+        if (!string.IsNullOrWhiteSpace(error.EvidencePath))
+        {
+            evidence.Add($"evidence={error.EvidencePath}");
+        }
+        string suffix = evidence.Count == 0 ? string.Empty : $" ({string.Join(", ", evidence)})";
+        return $"[{error.Code}] {error.Message}{suffix}";
+    }
+
     private async Task RunBusyAsync(string stateText, Func<Task> action)
     {
         SetBusy(true, stateText);
@@ -1314,6 +1756,28 @@ private async Task RunBusyAsync(string stateText, Func<Task> action)
         {
             await action();
         }
+        catch (GuiApplicationOutcomeException error)
+            when (error.Lifecycle == ApplicationOperationLifecycle.Cancelled)
+        {
+            AppendLog(
+                $"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] 操作已取消 "
+                + $"[{error.OperationId}]: {error.Message}");
+        }
+        catch (GuiApplicationOutcomeException error)
+        {
+            AppendLog(
+                $"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] Application 错误 "
+                + $"[{error.OperationId}]: {error}");
+            string prefix = error.Lifecycle == ApplicationOperationLifecycle.RecoveryRequired
+                ? "操作未能安全完成，需要恢复检查。"
+                : "操作失败。";
+            MessageBox.Show(
+                this,
+                $"{prefix}{Environment.NewLine}{Environment.NewLine}{error.Message}",
+                Text,
+                MessageBoxButtons.OK,
+                MessageBoxIcon.Error);
+        }
         catch (Exception error)
         {
             AppendLog($"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] 错误: {error}");
@@ -1325,9 +1789,31 @@ private async Task RunBusyAsync(string stateText, Func<Task> action)
         }
     }
 
+    private sealed class GuiApplicationOutcomeException : InvalidOperationException
+    {
+        internal GuiApplicationOutcomeException(
+            string operationId,
+            ApplicationOperationKind operation,
+            ApplicationOperationLifecycle lifecycle,
+            string message)
+            : base(message)
+        {
+            OperationId = operationId;
+            Operation = operation;
+            Lifecycle = lifecycle;
+        }
+
+        internal string OperationId { get; }
+
+        internal ApplicationOperationKind Operation { get; }
+
+        internal ApplicationOperationLifecycle Lifecycle { get; }
+    }
+
     private void SetBusy(bool busy, string stateText)
     {
-        bool sqliteActionsSupported = _currentStatus?.SqliteAccess.Supported != false;
+        bool sqliteActionsSupported = _appController.Snapshot.Activity == AppActivity.Ready
+            && _currentStatus?.SqliteAccess.Supported != false;
         _busy = busy;
         UseWaitCursor = busy;
         _busyLabel.Text = stateText;
@@ -1352,6 +1838,7 @@ private void SetBusy(bool busy, string stateText)
         _manualProviderText.Enabled = !busy;
         _codexHomeCombo.Enabled = !busy;
         _sqliteHomeText.Enabled = !busy;
+        UpdateModelOptionsEnabled();
     }
 
     private static bool PathsEqual(string left, string right)
diff --git a/desktop/CodexProviderSync.App/Program.cs b/desktop/CodexProviderSync.App/Program.cs
index 83d3c18..7c77c8c 100644
--- a/desktop/CodexProviderSync.App/Program.cs
+++ b/desktop/CodexProviderSync.App/Program.cs
@@ -1,4 +1,5 @@
 using CodexProviderSync.Core;
+using CodexProviderSync.App.Automation;
 
 namespace CodexProviderSync.App;
 
@@ -7,50 +8,98 @@ static class Program
     [STAThread]
     static void Main(string[] args)
     {
-        ExecutionLogService executionLogService = new();
-        if (UpdateApplier.TryRun(args, executionLogService))
+        // This parser is intentionally the first operation. In particular, do
+        // not construct services whose defaults resolve AppData, temp, home, or
+        // singleton paths before an automation descriptor has been validated.
+        AutomationBootstrap bootstrap;
+        try
         {
+            bootstrap = AutomationBootstrap.ParseAndClaim(args);
+        }
+        catch (Exception error)
+        {
+            Console.Error.WriteLine($"GUI automation bootstrap refused startup: {error.Message}");
             return;
         }
 
-        UpdateApplier.CleanupStaleUpdaterDirectories();
+        IAppPathProvider paths = bootstrap.Enabled
+            ? new IsolatedAppPathProvider(bootstrap.IsolationRoot!)
+            : new SystemAppPathProvider();
+        IAppPlatformBoundary platformBoundary = bootstrap.Enabled
+            ? new IsolatedAppPlatformBoundary(paths)
+            : new SystemAppPlatformBoundary(paths);
+        ExecutionLogService executionLogService = new(paths.LogDirectory);
+        if (!bootstrap.Enabled && UpdateApplier.TryRun(args, executionLogService))
+        {
+            return;
+        }
+
+        if (!bootstrap.Enabled)
+        {
+            UpdateApplier.CleanupStaleUpdaterDirectories(paths.UpdaterRoot);
+        }
 
         try
         {
-            SingleInstanceGuard guard = new();
-            using SingleInstanceAcquisition acquisition = guard.Acquire("codex-provider-sync");
+            AppInstanceGuard guard = new(paths);
+            using AppInstanceAcquisition acquisition = guard.Acquire();
             if (!acquisition.IsOwner)
             {
-                FocusExistingInstanceAndExit(acquisition);
+                if (!bootstrap.Enabled)
+                {
+                    FocusExistingInstanceAndExit(acquisition);
+                }
                 return;
             }
 
             ApplicationConfiguration.Initialize();
-            MainForm mainForm = new(executionLogService);
-            using FocusRequestServer focusServer = new(mainForm.BringToFront);
-            focusServer.Start();
-            Application.Run(mainForm);
+            SettingsService settingsService = new(paths.SettingsPath);
+            AutomationIsolation.PrepareSettings(settingsService, paths);
+            MainForm mainForm = new(
+                executionLogService,
+                settingsService,
+                paths: paths,
+                platformBoundary: platformBoundary);
+            using FocusRequestServer? focusServer = bootstrap.Enabled
+                ? null
+                : new FocusRequestServer(mainForm.RequestBringToFront);
+            using GuiAutomationBridge? automationBridge = bootstrap.Enabled
+                ? new GuiAutomationBridge(mainForm, bootstrap, paths)
+                : null;
+            if (automationBridge is not null)
+            {
+                mainForm.Shown += (_, _) => automationBridge.Start();
+            }
+            else
+            {
+                focusServer!.Start();
+            }
+            System.Windows.Forms.Application.Run(mainForm);
         }
         catch (Exception error)
         {
-            string logDir = Path.Combine(
-                Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData),
-                "codex-provider-sync");
-            Directory.CreateDirectory(logDir);
-            string logPath = Path.Combine(logDir, "startup-error.log");
+            string logPath = paths.StartupErrorPath;
+            Directory.CreateDirectory(Path.GetDirectoryName(logPath)!);
             File.WriteAllText(logPath, error.ToString());
             executionLogService.TryAppend(
                 $"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] 启动失败{Environment.NewLine}{error}",
                 out _);
-            MessageBox.Show(
-                $"Codex Provider Sync 启动失败。{Environment.NewLine}{Environment.NewLine}{error.Message}{Environment.NewLine}{Environment.NewLine}详细信息已写入:{Environment.NewLine}{logPath}",
-                "Codex Provider Sync",
-                MessageBoxButtons.OK,
-                MessageBoxIcon.Error);
+            if (!bootstrap.Enabled)
+            {
+                MessageBox.Show(
+                    $"Codex Provider Sync 启动失败。{Environment.NewLine}{Environment.NewLine}{error.Message}{Environment.NewLine}{Environment.NewLine}详细信息已写入:{Environment.NewLine}{logPath}",
+                    "Codex Provider Sync",
+                    MessageBoxButtons.OK,
+                    MessageBoxIcon.Error);
+            }
+            else
+            {
+                Console.Error.WriteLine($"GUI automation startup failed; isolated log: {logPath}");
+            }
         }
     }
 
-    private static void FocusExistingInstanceAndExit(SingleInstanceAcquisition acquisition)
+    private static void FocusExistingInstanceAndExit(AppInstanceAcquisition acquisition)
     {
         string detail = acquisition.ExistingOwner is { } owner
             ? $"pid={owner.ProcessId}, started={owner.StartedAt:O}"
diff --git a/desktop/CodexProviderSync.App/UpdateApplier.cs b/desktop/CodexProviderSync.App/UpdateApplier.cs
index 32dc5ac..89d9095 100644
--- a/desktop/CodexProviderSync.App/UpdateApplier.cs
+++ b/desktop/CodexProviderSync.App/UpdateApplier.cs
@@ -6,9 +6,12 @@ namespace CodexProviderSync.App;
 internal static class UpdateApplier
 {
     private const string ApplyArgument = "--apply-update";
-    private const string UpdaterDirectoryName = "codex-provider-sync-updater";
 
-    public static bool TryRun(string[] args) => TryRun(args, new ExecutionLogService());
+    public static bool TryRun(string[] args)
+    {
+        IAppPathProvider paths = new SystemAppPathProvider();
+        return TryRun(args, new ExecutionLogService(paths.LogDirectory));
+    }
 
     internal static bool TryRun(string[] args, ExecutionLogService executionLogService)
     {
@@ -49,8 +52,17 @@ internal static bool TryRun(string[] args, ExecutionLogService executionLogServi
 
     public static void Start(string downloadedExePath, string targetExePath, string expectedSha256)
     {
-        CleanupStaleUpdaterDirectories();
-        string updaterRoot = UpdaterRoot();
+        IAppPathProvider paths = new SystemAppPathProvider();
+        Start(downloadedExePath, targetExePath, expectedSha256, paths.UpdaterRoot);
+    }
+
+    internal static void Start(
+        string downloadedExePath,
+        string targetExePath,
+        string expectedSha256,
+        string updaterRoot)
+    {
+        CleanupStaleUpdaterDirectories(updaterRoot);
         string updaterDirectory = Path.Combine(updaterRoot, Guid.NewGuid().ToString("N"));
         Directory.CreateDirectory(updaterDirectory);
         string updaterPath = Path.Combine(updaterDirectory, "CodexProviderSync.Updater.exe");
@@ -76,7 +88,11 @@ public static void Start(string downloadedExePath, string targetExePath, string
 
     public static void CleanupStaleUpdaterDirectories()
     {
-        string root = UpdaterRoot();
+        CleanupStaleUpdaterDirectories(new SystemAppPathProvider().UpdaterRoot);
+    }
+
+    internal static void CleanupStaleUpdaterDirectories(string root)
+    {
         string? currentDirectory = Environment.ProcessPath is { } processPath
             ? Path.GetDirectoryName(Path.GetFullPath(processPath))
             : null;
@@ -142,8 +158,6 @@ private static UpdateArguments ParseArguments(string[] args)
             NormalizeSha256(args[5]));
     }
 
-    private static string UpdaterRoot() => Path.Combine(Path.GetTempPath(), UpdaterDirectoryName);
-
     private static string NormalizeSha256(string value)
     {
         string hash = value.Trim();
diff --git a/desktop/CodexProviderSync.Application.Tests/AppControllerTests.cs b/desktop/CodexProviderSync.Application.Tests/AppControllerTests.cs
new file mode 100644
index 0000000..120e34d
--- /dev/null
+++ b/desktop/CodexProviderSync.Application.Tests/AppControllerTests.cs
@@ -0,0 +1,293 @@
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.Application.Tests;
+
+public sealed class AppControllerTests
+{
+    [Fact]
+    public async Task InitializeAsync_LoadsStatusAndKeepsThePreferredProvider()
+    {
+        FakeCoreAdapter core = new(
+            new CoreInitializationState("/codex", "/sqlite-override", "relay"),
+            RefreshState("relay", supported: true, "openai", "relay"));
+        AppController controller = new(core);
+        List<AppActivity> activities = [];
+        controller.SnapshotChanged += snapshot => activities.Add(snapshot.Activity);
+
+        AppSnapshot snapshot = await controller.InitializeAsync();
+
+        Assert.Equal(AppActivity.Ready, snapshot.Activity);
+        Assert.Equal("/codex", snapshot.CodexHome);
+        Assert.Equal("/sqlite-override", snapshot.SqliteHomeOverride);
+        Assert.Equal("relay", snapshot.SelectedProviderId);
+        Assert.True(snapshot.Providers.Single(option => option.Id == "relay").IsSelected);
+        Assert.True(snapshot.Controls.RefreshEnabled);
+        Assert.True(snapshot.Controls.ExecuteEnabled);
+        Assert.Contains(AppActivity.Initializing, activities);
+        Assert.Equal("relay", Assert.Single(core.RefreshRequests).SelectedProviderId);
+
+        SyncRequestPreparation preparation = controller.PrepareSyncRequest();
+        Assert.True(preparation.IsValid);
+        SyncProviderRequest request = Assert.IsType<SyncProviderRequest>(preparation.Request);
+        Assert.Equal("relay", request.ProviderId);
+    }
+
+    [Fact]
+    public async Task ProviderSelection_IsTypedAndMustReferenceAnAvailableOption()
+    {
+        FakeCoreAdapter core = new(
+            new CoreInitializationState("/codex", null, null),
+            RefreshState("openai", supported: true, "openai", "relay"));
+        AppController controller = new(core);
+        await controller.InitializeAsync();
+
+        AppSnapshot selected = controller.SetProvider("relay");
+        Assert.Equal("relay", selected.SelectedProviderId);
+        Assert.True(selected.Providers.Single(option => option.Id == "relay").IsSelected);
+        Assert.False(selected.Providers.Single(option => option.Id == "openai").IsSelected);
+
+        AppSnapshot cleared = controller.SetProvider(null);
+        Assert.True(cleared.HasIssue(AppValidationIssue.ProviderRequired));
+        Assert.True(cleared.Controls.ExecuteEnabled);
+        Assert.False(controller.PrepareSyncRequest().IsValid);
+
+        Assert.Throws<ArgumentOutOfRangeException>(() => controller.SetProvider("missing"));
+    }
+
+    [Fact]
+    public async Task ProviderOptions_CanBeRebuiltAfterManualSettingsChange()
+    {
+        FakeCoreAdapter core = new(
+            new CoreInitializationState("/codex", null, "openai"),
+            RefreshState("openai", supported: true, "openai"));
+        AppController controller = new(core);
+        await controller.InitializeAsync();
+        ProviderOption manual = new()
+        {
+            Id = "relay",
+            Sources = [ProviderSource.Manual],
+            IsManual = true,
+            IsSaved = true
+        };
+
+        AppSnapshot added = controller.ApplyProviderOptions(
+            [.. core.CurrentRefreshState.Providers, manual],
+            "relay");
+        Assert.Equal("relay", added.SelectedProviderId);
+        Assert.True(added.SelectedProvider!.IsManual);
+
+        AppSnapshot removed = controller.ApplyProviderOptions(
+            core.CurrentRefreshState.Providers,
+            "relay");
+        Assert.Equal("openai", removed.SelectedProviderId);
+    }
+
+    [Fact]
+    public async Task ModelMode_DrivesValidationControlsAndPreparedSwitchRequest()
+    {
+        FakeCoreAdapter core = new(
+            new CoreInitializationState("/codex", null, "relay"),
+            RefreshState("openai", supported: true, "openai", "relay"));
+        AppController controller = new(core);
+        await controller.InitializeAsync();
+
+        AppSnapshot switchEnabled = controller.SetUpdateConfig(true);
+        Assert.True(switchEnabled.Controls.ModelModeEnabled);
+        Assert.False(switchEnabled.Controls.CustomModelEnabled);
+        Assert.IsType<FollowProviderModelSelection>(
+            Assert.IsType<SwitchProviderRequest>(controller.PrepareSyncRequest().Request).ModelSelection);
+
+        AppSnapshot custom = controller.SetModelMode(ModelMode.Custom);
+        Assert.True(custom.Controls.CustomModelEnabled);
+        Assert.True(custom.HasIssue(AppValidationIssue.CustomModelRequired));
+        Assert.True(custom.Controls.ExecuteEnabled);
+
+        controller.SetCustomModel("  gpt-custom  ");
+        SyncRequestPreparation preparation = controller.PrepareSyncRequest();
+        Assert.True(preparation.IsValid);
+        SwitchProviderRequest request = Assert.IsType<SwitchProviderRequest>(preparation.Request);
+        CustomModelSelection model = Assert.IsType<CustomModelSelection>(request.ModelSelection);
+        Assert.Equal("gpt-custom", model.Model);
+
+        controller.SetCustomModel("changed-after-prepare");
+        controller.SetProvider(null);
+        Assert.Equal("gpt-custom", model.Model);
+        Assert.Equal("relay", request.ProviderId);
+        controller.SetProvider("relay");
+
+        controller.SetModelMode(ModelMode.KeepRootModel);
+        Assert.IsType<KeepRootModelSelection>(
+            Assert.IsType<SwitchProviderRequest>(controller.PrepareSyncRequest().Request).ModelSelection);
+
+        AppSnapshot syncOnly = controller.SetUpdateConfig(false);
+        Assert.False(syncOnly.Controls.ModelModeEnabled);
+        Assert.False(syncOnly.Controls.CustomModelEnabled);
+        Assert.IsType<SyncProviderRequest>(controller.PrepareSyncRequest().Request);
+    }
+
+    [Fact]
+    public async Task Refresh_UsesExplicitPreferredProviderAndStorageForTheNextRequest()
+    {
+        FakeCoreAdapter core = new(
+            new CoreInitializationState("/codex", null, "openai"),
+            RefreshState("openai", supported: true, "openai", "relay"));
+        AppController controller = new(core);
+        await controller.InitializeAsync();
+
+        await controller.RefreshAsync("/other-codex", "/other-sqlite", "relay");
+        controller.SetStorage("/edited-codex", "/edited-sqlite");
+
+        Assert.Equal("relay", controller.Snapshot.SelectedProviderId);
+        SyncProviderRequest request = Assert.IsType<SyncProviderRequest>(controller.PrepareSyncRequest().Request);
+        Assert.Equal("/edited-codex", request.CodexHome);
+        Assert.Equal("/edited-sqlite", request.SqliteHomeOverride);
+    }
+
+    [Fact]
+    public async Task RefreshInProgress_DisablesModelInputsAndRejectsEdits()
+    {
+        FakeCoreAdapter core = new(
+            new CoreInitializationState("/codex", null, "openai"),
+            RefreshState("openai", supported: true, "openai"));
+        AppController controller = new(core);
+        await controller.InitializeAsync();
+        controller.SetUpdateConfig(true);
+
+        TaskCompletionSource<CoreRefreshState> pending = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        core.RefreshHandler = (_, _) => pending.Task;
+        Task<AppSnapshot> refresh = controller.RefreshAsync("/codex");
+
+        Assert.Equal(AppActivity.Refreshing, controller.Snapshot.Activity);
+        Assert.False(controller.Snapshot.Controls.ModelModeEnabled);
+        Assert.False(controller.Snapshot.Controls.CustomModelEnabled);
+        Assert.Throws<InvalidOperationException>(() => controller.SetModelMode(ModelMode.Custom));
+
+        pending.SetResult(RefreshState("openai", supported: true, "openai"));
+        await refresh;
+    }
+
+    [Fact]
+    public async Task ConcurrentRefresh_IsRejectedWithoutReplacingTheActiveOperation()
+    {
+        FakeCoreAdapter core = new(
+            new CoreInitializationState("/codex", null, "openai"),
+            RefreshState("openai", supported: true, "openai"));
+        AppController controller = new(core);
+        await controller.InitializeAsync();
+        TaskCompletionSource<CoreRefreshState> pending = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        core.RefreshHandler = (_, _) => pending.Task;
+
+        Task<AppSnapshot> active = controller.RefreshAsync("/first");
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => controller.RefreshAsync("/second"));
+        Assert.Equal("/first", controller.Snapshot.CodexHome);
+
+        pending.SetResult(RefreshState("openai", supported: true, "openai"));
+        await active;
+    }
+
+    [Fact]
+    public async Task Refresh_FallsBackToCurrentProviderAndDisablesUnsupportedSqliteActions()
+    {
+        FakeCoreAdapter core = new(
+            new CoreInitializationState("/codex", null, "missing"),
+            RefreshState("openai", supported: false, "openai", "relay"));
+        AppController controller = new(core);
+
+        AppSnapshot snapshot = await controller.InitializeAsync();
+
+        Assert.Equal("openai", snapshot.SelectedProviderId);
+        Assert.True(snapshot.HasIssue(AppValidationIssue.SqliteUnsupported));
+        Assert.False(snapshot.Controls.ExecuteEnabled);
+        Assert.True(snapshot.Controls.RefreshEnabled);
+        Assert.False(controller.PrepareSyncRequest().IsValid);
+    }
+
+    [Fact]
+    public async Task RefreshFailure_LeavesARecoverableFaultedSnapshot()
+    {
+        FakeCoreAdapter core = new(
+            new CoreInitializationState("/codex", null, null),
+            RefreshState("openai", supported: true, "openai"));
+        AppController controller = new(core);
+        await controller.InitializeAsync();
+        core.RefreshHandler = (_, _) => throw new InvalidOperationException("refresh failed");
+
+        AppSnapshot snapshot = await controller.RefreshAsync("/other-codex", "/other-sqlite");
+
+        Assert.Equal(AppActivity.Faulted, snapshot.Activity);
+        Assert.Equal("/other-codex", snapshot.CodexHome);
+        Assert.Equal("/other-sqlite", snapshot.SqliteHomeOverride);
+        Assert.Equal("refresh failed", snapshot.ErrorMessage);
+        Assert.True(snapshot.HasIssue(AppValidationIssue.RefreshFailed));
+        Assert.False(snapshot.Controls.ExecuteEnabled);
+        Assert.True(snapshot.Controls.RefreshEnabled);
+        Assert.False(controller.PrepareSyncRequest().IsValid);
+    }
+
+    private static CoreRefreshState RefreshState(
+        string currentProvider,
+        bool supported,
+        params string[] providerIds)
+    {
+        StatusSnapshot status = new()
+        {
+            CodexHome = "/codex",
+            SqliteHome = "/codex/sqlite",
+            SqliteAccess = supported
+                ? SqliteAccessInfo.Direct
+                : new SqliteAccessInfo(false, "test-unsupported", "unsupported for test"),
+            CurrentProvider = new CurrentProviderInfo(currentProvider, false),
+            ConfiguredProviders = providerIds,
+            RolloutCounts = new ProviderCounts(),
+            LockedRolloutFiles = [],
+            UnreadableRolloutFiles = [],
+            EncryptedContentCounts = new ProviderCounts(),
+            SqliteCounts = null,
+            BackupRoot = "/codex/backups_state/provider-sync",
+            BackupSummary = new BackupSummary { Count = 0, TotalBytes = 0 }
+        };
+        IReadOnlyList<ProviderOption> providers = providerIds
+            .Select(providerId => new ProviderOption
+            {
+                Id = providerId,
+                Sources = [ProviderSource.Config],
+                IsCurrentProvider = string.Equals(providerId, currentProvider, StringComparison.Ordinal)
+            })
+            .ToArray();
+        return new CoreRefreshState(status, providers);
+    }
+
+    private sealed class FakeCoreAdapter : ICoreApplicationAdapter
+    {
+        private readonly CoreInitializationState _initialization;
+        private readonly CoreRefreshState _refreshState;
+
+        public FakeCoreAdapter(CoreInitializationState initialization, CoreRefreshState refreshState)
+        {
+            _initialization = initialization;
+            _refreshState = refreshState;
+            RefreshHandler = (_, _) => Task.FromResult(_refreshState);
+        }
+
+        public List<CoreRefreshRequest> RefreshRequests { get; } = [];
+
+        public CoreRefreshState CurrentRefreshState => _refreshState;
+
+        public Func<CoreRefreshRequest, CancellationToken, Task<CoreRefreshState>> RefreshHandler { get; set; }
+
+        public Task<CoreInitializationState> InitializeAsync(CancellationToken cancellationToken = default)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            return Task.FromResult(_initialization);
+        }
+
+        public Task<CoreRefreshState> RefreshAsync(
+            CoreRefreshRequest request,
+            CancellationToken cancellationToken = default)
+        {
+            RefreshRequests.Add(request);
+            return RefreshHandler(request, cancellationToken);
+        }
+    }
+}
diff --git a/desktop/CodexProviderSync.Application.Tests/ApplicationServiceTests.cs b/desktop/CodexProviderSync.Application.Tests/ApplicationServiceTests.cs
new file mode 100644
index 0000000..93835a4
--- /dev/null
+++ b/desktop/CodexProviderSync.Application.Tests/ApplicationServiceTests.cs
@@ -0,0 +1,835 @@
+using System.Text.Json;
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.Application.Tests;
+
+public sealed class ApplicationServiceTests
+{
+    [Fact]
+    public async Task Describe_ReportsTheSharedDryRunContractWithStructuredLifecycle()
+    {
+        TestRig rig = new();
+
+        ApplicationOutcome<ApplicationDescription> outcome = await rig.Service.DescribeAsync();
+
+        Assert.Equal(ApplicationOperationLifecycle.Succeeded, outcome.Lifecycle);
+        Assert.Equal(ApplicationOperationKind.Describe, outcome.Operation);
+        Assert.Equal(ApplicationProtocol.Version, outcome.Data!.ProtocolVersion);
+        Assert.Equal(
+            ["describe", "status", "plan", "sync", "switch", "restore", "prune"],
+            outcome.Data.Commands);
+        Assert.True(outcome.Data.WritesDefaultToDryRun);
+        Assert.True(outcome.Data.ExplicitApplyRequired);
+        Assert.True(outcome.Data.ExactPlanDigestRequired);
+        Assert.True(outcome.Data.PlansAreSingleUse);
+        Assert.NotEmpty(outcome.OperationId);
+        Assert.Equal(ApplicationOperationLifecycle.Accepted, outcome.Timeline[0].Lifecycle);
+        Assert.Equal(ApplicationOperationLifecycle.Succeeded, outcome.Timeline[^1].Lifecycle);
+        Assert.Empty(outcome.Errors);
+    }
+
+    [Fact]
+    public async Task Status_UsesThePureReadPortAndNeverTouchesTheWritePort()
+    {
+        TestRig rig = new();
+
+        ApplicationOutcome<StatusSnapshot> outcome = await rig.Service.GetStatusAsync(
+            new ApplicationStatusRequest(" /fixture ", " /sqlite "));
+
+        Assert.Equal(ApplicationOperationLifecycle.Succeeded, outcome.Lifecycle);
+        ApplicationStatusRequest request = Assert.Single(rig.Status.Requests);
+        Assert.Equal(" /fixture ", request.CodexHome);
+        Assert.Equal(" /sqlite ", request.SqliteHomeOverride);
+        Assert.Equal(0, rig.Write.PlanCalls);
+        Assert.Equal(0, rig.Write.ExecuteCalls);
+    }
+
+    [Fact]
+    public async Task CoreStatusPort_DoesNotPersistSettingsOrMutateTheFixtureHome()
+    {
+        string fixture = Path.Combine(
+            Path.GetTempPath(),
+            $"codex-provider-sync-application-status-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(fixture);
+        try
+        {
+            string configPath = Path.Combine(fixture, "config.toml");
+            await File.WriteAllTextAsync(configPath, "model_provider = \"openai\"\n");
+            Dictionary<string, (long Length, long LastWrite)> before = SnapshotFiles(fixture);
+            CoreApplicationStatusPort port = new();
+
+            StatusSnapshot status = await port.GetStatusAsync(new ApplicationStatusRequest(fixture));
+
+            Assert.Equal(Path.GetFullPath(fixture), status.CodexHome);
+            Assert.Equal(before, SnapshotFiles(fixture));
+        }
+        finally
+        {
+            Directory.Delete(fixture, recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task EveryWrite_DefaultsToPlanOnlyAndNeverExecutes()
+    {
+        TestRig rig = new();
+
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> sync = await rig.Service.SyncAsync(
+            new SyncApplicationRequest(new SyncIntent("/fixture", null, "relay")));
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> change = await rig.Service.SwitchAsync(
+            new SwitchApplicationRequest(new SwitchIntent(
+                "/fixture",
+                null,
+                "relay",
+                new KeepRootModelSelection())));
+        ApplicationOutcome<ApplicationWriteResult<RestoreResult>> restore = await rig.Service.RestoreAsync(
+            new RestoreApplicationRequest(new RestoreIntent(
+                "/fixture",
+                "/sqlite",
+                "/fixture/backups/one",
+                AllowSqliteHomeRelocation: true)));
+        ApplicationOutcome<ApplicationWriteResult<BackupPruneResult>> prune = await rig.Service.PruneAsync(
+            new PruneApplicationRequest(new PruneIntent("/fixture", null, 3)));
+
+        Assert.All(
+            new[] { sync.Lifecycle, change.Lifecycle, restore.Lifecycle, prune.Lifecycle },
+            lifecycle => Assert.Equal(ApplicationOperationLifecycle.ReadyToApply, lifecycle));
+        Assert.False(sync.Data!.Applied);
+        Assert.False(change.Data!.Applied);
+        Assert.False(restore.Data!.Applied);
+        Assert.False(prune.Data!.Applied);
+        Assert.Null(sync.Data.Result);
+        Assert.Null(change.Data.Result);
+        Assert.Null(restore.Data.Result);
+        Assert.Null(prune.Data.Result);
+        Assert.Equal(4, rig.Write.PlanCalls);
+        Assert.Equal(0, rig.Write.ExecuteCalls);
+        RestoreIntent plannedRestore = Assert.IsType<RestoreIntent>(restore.Data.Plan.Intent);
+        Assert.True(plannedRestore.AllowSqliteHomeRelocation);
+    }
+
+    [Fact]
+    public async Task Plan_ContainsDeterministicTargetsWarningsAndAutoPruneDeletionSet()
+    {
+        TestRig rig = new();
+        List<ApplicationPlanTarget> targets =
+        [
+            new("/fixture/z", "replace", "z"),
+            new("/fixture/a", "replace", "a")
+        ];
+        List<ApplicationPlanTarget> deletions =
+        [
+            new("/fixture/backups/old-2", "delete", "d2"),
+            new("/fixture/backups/old-1", "delete", "d1")
+        ];
+        List<ApplicationWarning> warnings = [new("locked", "one active rollout is locked")];
+        rig.Write.PreviewFactory = intent => new ApplicationPlanPreview(
+            intent,
+            "state-v1",
+            "core-token",
+            targets,
+            deletions,
+            warnings);
+
+        ApplicationOutcome<ApplicationOperationPlan> outcome = await rig.Service.CreatePlanAsync(
+            new CreateApplicationPlanRequest(new SyncIntent("/fixture", null, "relay")));
+        targets.Clear();
+        deletions.Clear();
+        warnings.Clear();
+
+        ApplicationOperationPlan plan = outcome.Data!;
+        Assert.Equal(["/fixture/a", "/fixture/z"], plan.Targets.Select(static target => target.Path));
+        Assert.Equal(
+            ["/fixture/backups/old-1", "/fixture/backups/old-2"],
+            plan.AutoPruneDeletionTargets.Select(static target => target.Path));
+        Assert.Single(plan.Warnings);
+        Assert.Equal(64, plan.Digest.Length);
+        Assert.Equal(ApplicationOperationLifecycle.ReadyToApply, outcome.Lifecycle);
+    }
+
+    [Fact]
+    public async Task Apply_RequiresTheExactRegisteredPlanAndConsumesItOnce()
+    {
+        TestRig rig = new();
+        SyncIntent intent = new("/fixture", null, "relay");
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> dryRun = await rig.Service.SyncAsync(
+            new SyncApplicationRequest(intent));
+        ApplicationOperationPlan plan = dryRun.Data!.Plan;
+        SyncApplicationRequest apply = new(
+            intent,
+            new ApplicationApplyAuthorization(true, plan, plan.Digest));
+
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> applied = await rig.Service.SyncAsync(apply);
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> duplicate = await rig.Service.SyncAsync(apply);
+
+        Assert.Equal(ApplicationOperationLifecycle.Succeeded, applied.Lifecycle);
+        Assert.True(applied.Data!.Applied);
+        Assert.Same(rig.Write.SyncResult, applied.Data.Result);
+        Assert.Equal(1, rig.Write.ExecuteCalls);
+        Assert.Equal(plan.PlanId, rig.Write.LastExecutedPlan!.PlanId);
+        Assert.Equal(ApplicationOperationLifecycle.Rejected, duplicate.Lifecycle);
+        Assert.Equal("plan_already_used", Assert.Single(duplicate.Errors).Code);
+        Assert.Equal(1, rig.Write.ExecuteCalls);
+    }
+
+    [Fact]
+    public async Task Apply_RejectsMissingMismatchedTamperedAndExpiredPlansWithoutExecuting()
+    {
+        TestRig rig = new();
+        SyncIntent intent = new("/fixture", null, "relay");
+        ApplicationOperationPlan plan = (await rig.Service.SyncAsync(
+            new SyncApplicationRequest(intent))).Data!.Plan;
+
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> missing = await rig.Service.SyncAsync(
+            new SyncApplicationRequest(intent, new ApplicationApplyAuthorization(Apply: true)));
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> mismatch = await rig.Service.SyncAsync(
+            new SyncApplicationRequest(
+                intent with { ProviderId = "other" },
+                new ApplicationApplyAuthorization(true, plan, plan.Digest)));
+        ApplicationOperationPlan tampered = plan with
+        {
+            Targets = [new ApplicationPlanTarget("/fixture/other", "replace", "changed")]
+        };
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> changed = await rig.Service.SyncAsync(
+            new SyncApplicationRequest(
+                intent,
+                new ApplicationApplyAuthorization(true, tampered, tampered.Digest)));
+        rig.Clock.Advance(TimeSpan.FromMinutes(11));
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> expired = await rig.Service.SyncAsync(
+            new SyncApplicationRequest(
+                intent,
+                new ApplicationApplyAuthorization(true, plan, plan.Digest)));
+
+        Assert.Equal("plan_required", Assert.Single(missing.Errors).Code);
+        Assert.Equal("plan_input_mismatch", Assert.Single(mismatch.Errors).Code);
+        Assert.Equal("plan_digest_mismatch", Assert.Single(changed.Errors).Code);
+        Assert.Equal("plan_expired", Assert.Single(expired.Errors).Code);
+        Assert.Equal(0, rig.Write.ExecuteCalls);
+    }
+
+    [Fact]
+    public async Task ConcurrentOperation_IsRejectedImmediatelyWithoutReplacingTheActivePlan()
+    {
+        TestRig rig = new();
+        TaskCompletionSource<ApplicationPlanPreview> pending = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        TaskCompletionSource started = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        rig.Write.PreviewHandler = (intent, _, _) =>
+        {
+            started.SetResult();
+            return pending.Task;
+        };
+
+        Task<ApplicationOutcome<ApplicationOperationPlan>> active = rig.Service.CreatePlanAsync(
+            new CreateApplicationPlanRequest(new SyncIntent("/first", null, "relay")));
+        await started.Task;
+        ApplicationOutcome<StatusSnapshot> rejected = await rig.Service.GetStatusAsync(
+            new ApplicationStatusRequest("/second"));
+
+        Assert.Equal(ApplicationOperationLifecycle.Rejected, rejected.Lifecycle);
+        Assert.Equal("operation_busy", Assert.Single(rejected.Errors).Code);
+        Assert.Empty(rig.Status.Requests);
+
+        pending.SetResult(rig.Write.CreatePreview(new SyncIntent("/first", null, "relay")));
+        ApplicationOutcome<ApplicationOperationPlan> completed = await active;
+        Assert.Equal("/first", completed.Data!.Intent.CodexHome);
+    }
+
+    [Fact]
+    public async Task Cancellation_ConsumesThePlanReturnsCancelledAndReleasesTheGate()
+    {
+        TestRig rig = new();
+        SyncIntent intent = new("/fixture", null, "relay");
+        ApplicationOperationPlan plan = (await rig.Service.SyncAsync(
+            new SyncApplicationRequest(intent))).Data!.Plan;
+        TaskCompletionSource started = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        rig.Write.SyncHandler = async (_, _, _, token) =>
+        {
+            started.SetResult();
+            await Task.Delay(Timeout.InfiniteTimeSpan, token);
+            return rig.Write.SyncResult;
+        };
+        using CancellationTokenSource cancellation = new();
+
+        Task<ApplicationOutcome<ApplicationWriteResult<SyncResult>>> applying = rig.Service.SyncAsync(
+            new SyncApplicationRequest(
+                intent,
+                new ApplicationApplyAuthorization(true, plan, plan.Digest)),
+            cancellation.Token);
+        await started.Task;
+        cancellation.Cancel();
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> cancelled = await applying;
+        ApplicationOutcome<ApplicationDescription> next = await rig.Service.DescribeAsync();
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> duplicate = await rig.Service.SyncAsync(
+            new SyncApplicationRequest(
+                intent,
+                new ApplicationApplyAuthorization(true, plan, plan.Digest)));
+
+        Assert.Equal(ApplicationOperationLifecycle.Cancelled, cancelled.Lifecycle);
+        Assert.Equal("cancelled", Assert.Single(cancelled.Errors).Code);
+        Assert.Equal(ApplicationOperationLifecycle.Succeeded, next.Lifecycle);
+        Assert.Equal("plan_already_used", Assert.Single(duplicate.Errors).Code);
+    }
+
+    [Fact]
+    public async Task RolledBackCancellationAndRecoveryFailureHaveDistinctStructuredOutcomes()
+    {
+        TestRig cancelRig = new();
+        SyncIntent intent = new("/fixture", null, "relay");
+        ApplicationOperationPlan cancelPlan = (await cancelRig.Service.SyncAsync(
+            new SyncApplicationRequest(intent))).Data!.Plan;
+        cancelRig.Write.SyncHandler = (_, _, _, _) => throw new SyncTransactionException(
+            new OperationCanceledException("cancelled after a rollout"),
+            [],
+            "/fixture/backups/cancel",
+            ["/fixture/rollout.jsonl"],
+            [],
+            rollbackStatus: "complete",
+            recoveryRequired: false);
+
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> cancelled = await cancelRig.Service.SyncAsync(
+            new SyncApplicationRequest(
+                intent,
+                new ApplicationApplyAuthorization(true, cancelPlan, cancelPlan.Digest)));
+
+        TestRig recoveryRig = new();
+        ApplicationOperationPlan recoveryPlan = (await recoveryRig.Service.SyncAsync(
+            new SyncApplicationRequest(intent))).Data!.Plan;
+        recoveryRig.Write.SyncHandler = (_, _, _, _) => throw new ApplicationPortException(
+            "recovery_required",
+            "rollback could not restore SQLite",
+            recoveryRequired: true,
+            rollbackStatus: "incomplete");
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> recovery = await recoveryRig.Service.SyncAsync(
+            new SyncApplicationRequest(
+                intent,
+                new ApplicationApplyAuthorization(true, recoveryPlan, recoveryPlan.Digest)));
+
+        Assert.Equal(ApplicationOperationLifecycle.Cancelled, cancelled.Lifecycle);
+        Assert.Equal("complete", Assert.Single(cancelled.Errors).RollbackStatus);
+        Assert.Equal(ApplicationOperationLifecycle.RecoveryRequired, recovery.Lifecycle);
+        ApplicationError recoveryError = Assert.Single(recovery.Errors);
+        Assert.True(recoveryError.RecoveryRequired);
+        Assert.Equal("incomplete", recoveryError.RollbackStatus);
+    }
+
+    [Fact]
+    public async Task PolymorphicPlan_RoundTripsAcrossAOneShotProcessBoundary()
+    {
+        TestRig rig = new();
+        SwitchIntent intent = new(
+            "/fixture",
+            "/sqlite",
+            "relay",
+            new CustomModelSelection("model-x"),
+            4);
+        ApplicationOperationPlan plan = (await rig.Service.SwitchAsync(
+            new SwitchApplicationRequest(intent))).Data!.Plan;
+        JsonSerializerOptions options = new(JsonSerializerDefaults.Web);
+
+        string json = JsonSerializer.Serialize(plan, options);
+        ApplicationOperationPlan restored = JsonSerializer.Deserialize<ApplicationOperationPlan>(json, options)!;
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> applied = await rig.Service.SwitchAsync(
+            new SwitchApplicationRequest(
+                Assert.IsType<SwitchIntent>(restored.Intent),
+                new ApplicationApplyAuthorization(true, restored, restored.Digest)));
+
+        Assert.Contains("\"kind\":\"switch\"", json, StringComparison.Ordinal);
+        Assert.Contains("\"mode\":\"custom\"", json, StringComparison.Ordinal);
+        Assert.Equal(ApplicationOperationLifecycle.Succeeded, applied.Lifecycle);
+        SwitchIntent executed = Assert.IsType<SwitchIntent>(rig.Write.LastIntent);
+        Assert.Equal("model-x", Assert.IsType<CustomModelSelection>(executed.ModelSelection).Model);
+    }
+
+    [Fact]
+    public async Task EveryIntentKind_HasAStableExplicitJsonDiscriminator()
+    {
+        TestRig rig = new();
+        JsonSerializerOptions options = new(JsonSerializerDefaults.Web);
+        ApplicationOperationPlan[] plans =
+        [
+            (await rig.Service.SyncAsync(new SyncApplicationRequest(
+                new SyncIntent("/fixture", null, "relay")))).Data!.Plan,
+            (await rig.Service.SwitchAsync(new SwitchApplicationRequest(
+                new SwitchIntent("/fixture", null, "relay", new FollowProviderModelSelection())))).Data!.Plan,
+            (await rig.Service.RestoreAsync(new RestoreApplicationRequest(
+                new RestoreIntent("/fixture", "/sqlite", "/fixture/backups/one", AllowSqliteHomeRelocation: true)))).Data!.Plan,
+            (await rig.Service.PruneAsync(new PruneApplicationRequest(
+                new PruneIntent("/fixture", null, 2)))).Data!.Plan
+        ];
+
+        ApplicationWriteIntent[] restored = plans
+            .Select(plan => JsonSerializer.Deserialize<ApplicationOperationPlan>(
+                JsonSerializer.Serialize(plan, options),
+                options)!.Intent)
+            .ToArray();
+
+        Assert.IsType<SyncIntent>(restored[0]);
+        Assert.IsType<SwitchIntent>(restored[1]);
+        Assert.True(Assert.IsType<RestoreIntent>(restored[2]).AllowSqliteHomeRelocation);
+        Assert.IsType<PruneIntent>(restored[3]);
+    }
+
+    [Fact]
+    public async Task ValidPlan_FromAnotherLedgerIsRejectedBeforeCoreExecution()
+    {
+        TestRig planner = new();
+        SyncIntent intent = new("/fixture", null, "relay");
+        ApplicationOperationPlan plan = (await planner.Service.SyncAsync(
+            new SyncApplicationRequest(intent))).Data!.Plan;
+        TestRig executorWithDifferentLedger = new();
+
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> outcome =
+            await executorWithDifferentLedger.Service.SyncAsync(
+                new SyncApplicationRequest(
+                    intent,
+                    new ApplicationApplyAuthorization(true, plan, plan.Digest)));
+
+        Assert.Equal(ApplicationOperationLifecycle.Rejected, outcome.Lifecycle);
+        Assert.Equal("plan_not_registered", Assert.Single(outcome.Errors).Code);
+        Assert.Equal(0, executorWithDifferentLedger.Write.ExecuteCalls);
+    }
+
+    [Fact]
+    public async Task CorruptDurableLedger_FailsClosedWithControlledStructuredEvidence()
+    {
+        using TemporaryApplicationDirectory temporary = new();
+        string ledgerRoot = Path.Combine(temporary.Path, "ledger");
+        FileApplicationPlanLedger ledger = new(ledgerRoot);
+        TestRig rig = new(ledger);
+        SyncIntent intent = new("/isolated/fixture", null, "relay");
+        ApplicationOperationPlan plan = (await rig.Service.SyncAsync(
+            new SyncApplicationRequest(intent))).Data!.Plan;
+        string registrationPath = Assert.Single(Directory.EnumerateFiles(
+            Path.Combine(ledgerRoot, "entries"),
+            "*.registration.v1.json"));
+        await File.WriteAllTextAsync(registrationPath, "{\"schemaVersion\":1");
+
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> outcome = await rig.Service.SyncAsync(
+            new SyncApplicationRequest(
+                intent,
+                new ApplicationApplyAuthorization(true, plan, plan.Digest)));
+
+        Assert.Equal(ApplicationOperationLifecycle.RecoveryRequired, outcome.Lifecycle);
+        Assert.Null(outcome.Data);
+        Assert.Equal(0, rig.Write.ExecuteCalls);
+        ApplicationError error = Assert.Single(outcome.Errors);
+        Assert.Equal("plan_ledger_corrupt", error.Code);
+        Assert.True(error.RecoveryRequired);
+        Assert.Equal(Path.GetFullPath(registrationPath), error.EvidencePath);
+        Assert.DoesNotContain(registrationPath, error.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(plan.PlanId, error.Message, StringComparison.Ordinal);
+        Assert.Equal(ApplicationOperationLifecycle.RecoveryRequired, outcome.Timeline[^1].Lifecycle);
+    }
+
+    [Fact]
+    public async Task CorruptCompletionReceipt_IsNotDowngradedToAWarningAfterExecution()
+    {
+        string evidencePath = Path.GetFullPath(Path.Combine(
+            Path.GetTempPath(),
+            $"codex-provider-plan-ledger-evidence-{Guid.NewGuid():N}.json"));
+        CorruptOnCompleteLedger ledger = new(evidencePath);
+        TestRig rig = new(ledger);
+        SyncIntent intent = new("/isolated/fixture", null, "relay");
+        ApplicationOperationPlan plan = (await rig.Service.SyncAsync(
+            new SyncApplicationRequest(intent))).Data!.Plan;
+
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> outcome = await rig.Service.SyncAsync(
+            new SyncApplicationRequest(
+                intent,
+                new ApplicationApplyAuthorization(true, plan, plan.Digest)));
+
+        Assert.Equal(1, rig.Write.ExecuteCalls);
+        Assert.Equal(ApplicationOperationLifecycle.RecoveryRequired, outcome.Lifecycle);
+        Assert.Null(outcome.Data);
+        Assert.Empty(outcome.Warnings);
+        ApplicationError error = Assert.Single(outcome.Errors);
+        Assert.Equal("plan_ledger_corrupt", error.Code);
+        Assert.True(error.RecoveryRequired);
+        Assert.Equal(evidencePath, error.EvidencePath);
+        Assert.DoesNotContain("sensitive ledger detail", error.Message, StringComparison.Ordinal);
+        Assert.DoesNotContain(evidencePath, error.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task InMemoryLedger_AtomicallyAllowsOnlyOneConcurrentClaim()
+    {
+        InMemoryApplicationPlanLedger ledger = new();
+        ApplicationOperationPlan plan = new(
+            ApplicationProtocol.Version,
+            "plan-one",
+            "operation-one",
+            new DateTimeOffset(2026, 8, 4, 0, 0, 0, TimeSpan.Zero),
+            new DateTimeOffset(2026, 8, 4, 0, 10, 0, TimeSpan.Zero),
+            new SyncIntent("/fixture", null, "relay"),
+            "state",
+            "token",
+            [new ApplicationPlanTarget("/fixture/target", "replace", "fingerprint")],
+            [],
+            [],
+            "digest-one");
+        await ledger.RegisterAsync(plan);
+
+        ApplicationPlanClaimResult[] claims = await Task.WhenAll(
+            Enumerable.Range(0, 20)
+                .Select(_ => ledger.TryClaimAsync(plan.PlanId, plan.Digest)));
+
+        Assert.Single(claims, static claim => claim.Status == ApplicationPlanClaimStatus.Claimed);
+        Assert.Equal(19, claims.Count(static claim => claim.Status == ApplicationPlanClaimStatus.AlreadyUsed));
+    }
+
+    [Fact]
+    public async Task InMemoryLedger_CompletionMatchesDurableSingleUseTerminalSemantics()
+    {
+        InMemoryApplicationPlanLedger ledger = new();
+        ApplicationOperationPlan plan = new(
+            ApplicationProtocol.Version,
+            "plan-terminal",
+            "operation-terminal",
+            new DateTimeOffset(2026, 8, 4, 0, 0, 0, TimeSpan.Zero),
+            new DateTimeOffset(2026, 8, 4, 0, 10, 0, TimeSpan.Zero),
+            new SyncIntent("/fixture", null, "relay"),
+            "state",
+            "token",
+            [new ApplicationPlanTarget("/fixture/target", "replace", "fingerprint")],
+            [],
+            [],
+            "digest-terminal");
+        await ledger.RegisterAsync(plan);
+
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => ledger.CompleteAsync(plan.PlanId, ApplicationOperationLifecycle.Succeeded));
+        Assert.Equal(
+            ApplicationPlanClaimStatus.Claimed,
+            (await ledger.TryClaimAsync(plan.PlanId, plan.Digest)).Status);
+        await Assert.ThrowsAsync<ArgumentOutOfRangeException>(
+            () => ledger.CompleteAsync(plan.PlanId, ApplicationOperationLifecycle.Applying));
+
+        await ledger.CompleteAsync(plan.PlanId, ApplicationOperationLifecycle.Succeeded);
+        await ledger.CompleteAsync(plan.PlanId, ApplicationOperationLifecycle.Succeeded);
+        InvalidOperationException transition = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => ledger.CompleteAsync(plan.PlanId, ApplicationOperationLifecycle.Failed));
+
+        Assert.Contains("cannot transition", transition.Message, StringComparison.Ordinal);
+        Assert.Equal(
+            ApplicationPlanClaimStatus.AlreadyUsed,
+            (await ledger.TryClaimAsync(plan.PlanId, plan.Digest)).Status);
+    }
+
+    [Fact]
+    public async Task SwitchRestoreAndPrune_ExecuteOnlyThroughTheirTypedPortMethods()
+    {
+        TestRig rig = new();
+
+        SwitchIntent change = new("/fixture", null, "relay", new FollowProviderModelSelection());
+        ApplicationOperationPlan changePlan = (await rig.Service.SwitchAsync(
+            new SwitchApplicationRequest(change))).Data!.Plan;
+        await rig.Service.SwitchAsync(new SwitchApplicationRequest(
+            change,
+            new ApplicationApplyAuthorization(true, changePlan, changePlan.Digest)));
+
+        RestoreIntent restore = new(
+            "/fixture",
+            "/sqlite",
+            "/fixture/backups/one",
+            RestoreConfig: false,
+            RestoreDatabase: true,
+            RestoreSessions: true,
+            AllowSqliteHomeRelocation: true);
+        ApplicationOperationPlan restorePlan = (await rig.Service.RestoreAsync(
+            new RestoreApplicationRequest(restore))).Data!.Plan;
+        await rig.Service.RestoreAsync(new RestoreApplicationRequest(
+            restore,
+            new ApplicationApplyAuthorization(true, restorePlan, restorePlan.Digest)));
+
+        PruneIntent prune = new("/fixture", null, 2);
+        ApplicationOperationPlan prunePlan = (await rig.Service.PruneAsync(
+            new PruneApplicationRequest(prune))).Data!.Plan;
+        await rig.Service.PruneAsync(new PruneApplicationRequest(
+            prune,
+            new ApplicationApplyAuthorization(true, prunePlan, prunePlan.Digest)));
+
+        Assert.Equal(1, rig.Write.SwitchExecuteCalls);
+        Assert.Equal(1, rig.Write.RestoreExecuteCalls);
+        Assert.Equal(1, rig.Write.PruneExecuteCalls);
+        Assert.True(Assert.IsType<RestoreIntent>(rig.Write.ExecutedIntents[1]).AllowSqliteHomeRelocation);
+    }
+
+    private sealed class TestRig
+    {
+        private int _nextId;
+
+        public TestRig(IApplicationPlanLedger? planLedger = null)
+        {
+            Service = new ApplicationService(
+                Status,
+                Write,
+                planLedger ?? new InMemoryApplicationPlanLedger(),
+                Clock,
+                () => $"id-{Interlocked.Increment(ref _nextId)}",
+                TimeSpan.FromMinutes(10));
+        }
+
+        public FakeTimeProvider Clock { get; } = new(new DateTimeOffset(2026, 8, 4, 0, 0, 0, TimeSpan.Zero));
+
+        public FakeStatusPort Status { get; } = new();
+
+        public FakeWritePort Write { get; } = new();
+
+        public ApplicationService Service { get; }
+    }
+
+    private sealed class FakeTimeProvider(DateTimeOffset utcNow) : TimeProvider
+    {
+        private DateTimeOffset _utcNow = utcNow;
+
+        public override DateTimeOffset GetUtcNow() => _utcNow;
+
+        public void Advance(TimeSpan duration) => _utcNow = _utcNow.Add(duration);
+    }
+
+    private sealed class FakeStatusPort : IApplicationStatusPort
+    {
+        public List<ApplicationStatusRequest> Requests { get; } = [];
+
+        public Task<StatusSnapshot> GetStatusAsync(
+            ApplicationStatusRequest request,
+            CancellationToken cancellationToken = default)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            Requests.Add(request);
+            return Task.FromResult(CreateStatus(request.CodexHome));
+        }
+    }
+
+    private sealed class CorruptOnCompleteLedger(string evidencePath) : IApplicationPlanLedger
+    {
+        private readonly InMemoryApplicationPlanLedger _inner = new();
+
+        public Task RegisterAsync(
+            ApplicationOperationPlan plan,
+            CancellationToken cancellationToken = default)
+        {
+            return _inner.RegisterAsync(plan, cancellationToken);
+        }
+
+        public Task<ApplicationPlanClaimResult> TryClaimAsync(
+            string planId,
+            string digest,
+            CancellationToken cancellationToken = default)
+        {
+            return _inner.TryClaimAsync(planId, digest, cancellationToken);
+        }
+
+        public Task CompleteAsync(
+            string planId,
+            ApplicationOperationLifecycle lifecycle,
+            CancellationToken cancellationToken = default)
+        {
+            throw new ApplicationPlanLedgerCorruptionException(
+                planId,
+                evidencePath,
+                "sensitive ledger detail");
+        }
+    }
+
+    private sealed class TemporaryApplicationDirectory : IDisposable
+    {
+        public TemporaryApplicationDirectory()
+        {
+            Path = System.IO.Path.Combine(
+                System.IO.Path.GetTempPath(),
+                $"codex-provider-application-tests-{Guid.NewGuid():N}");
+            Directory.CreateDirectory(Path);
+        }
+
+        public string Path { get; }
+
+        public void Dispose()
+        {
+            if (!Directory.Exists(Path))
+            {
+                return;
+            }
+
+            string fullPath = System.IO.Path.GetFullPath(Path);
+            string fullTemp = System.IO.Path.GetFullPath(System.IO.Path.GetTempPath());
+            string relative = System.IO.Path.GetRelativePath(fullTemp, fullPath);
+            if (System.IO.Path.IsPathRooted(relative)
+                || relative == ".."
+                || relative.StartsWith($"..{System.IO.Path.DirectorySeparatorChar}", StringComparison.Ordinal))
+            {
+                throw new InvalidOperationException("Refusing to remove a test directory outside the system temp root.");
+            }
+
+            Directory.Delete(fullPath, recursive: true);
+        }
+    }
+
+    private sealed class FakeWritePort : IApplicationWritePort
+    {
+        public int PlanCalls { get; private set; }
+
+        public int ExecuteCalls { get; private set; }
+
+        public int SwitchExecuteCalls { get; private set; }
+
+        public int RestoreExecuteCalls { get; private set; }
+
+        public int PruneExecuteCalls { get; private set; }
+
+        public ApplicationWriteIntent? LastIntent { get; private set; }
+
+        public ApplicationOperationPlan? LastExecutedPlan { get; private set; }
+
+        public List<ApplicationWriteIntent> ExecutedIntents { get; } = [];
+
+        public SyncResult SyncResult { get; } = CreateSyncResult();
+
+        public Func<ApplicationWriteIntent, ApplicationPlanPreview> PreviewFactory { get; set; }
+
+        public Func<ApplicationWriteIntent, string, CancellationToken, Task<ApplicationPlanPreview>>? PreviewHandler { get; set; }
+
+        public Func<SyncIntent, ApplicationOperationPlan, string, CancellationToken, Task<SyncResult>>? SyncHandler { get; set; }
+
+        public FakeWritePort()
+        {
+            PreviewFactory = CreatePreview;
+        }
+
+        public ApplicationPlanPreview CreatePreview(ApplicationWriteIntent intent)
+        {
+            return new ApplicationPlanPreview(
+                intent,
+                $"state-{intent.Kind}",
+                $"token-{intent.Kind}",
+                [new ApplicationPlanTarget($"{intent.CodexHome}/target", "replace", "sha256:target")],
+                intent is SyncIntent or SwitchIntent
+                    ? [new ApplicationPlanTarget($"{intent.CodexHome}/backups/old", "delete", "sha256:backup")]
+                    : [],
+                []);
+        }
+
+        public Task<ApplicationPlanPreview> CreatePlanAsync(
+            ApplicationWriteIntent intent,
+            string operationId,
+            CancellationToken cancellationToken = default)
+        {
+            PlanCalls++;
+            return PreviewHandler is null
+                ? Task.FromResult(PreviewFactory(intent))
+                : PreviewHandler(intent, operationId, cancellationToken);
+        }
+
+        public Task<SyncResult> ExecuteSyncAsync(
+            SyncIntent intent,
+            ApplicationOperationPlan plan,
+            string operationId,
+            CancellationToken cancellationToken = default)
+        {
+            RecordExecution(intent, plan);
+            return SyncHandler is null
+                ? Task.FromResult(SyncResult)
+                : SyncHandler(intent, plan, operationId, cancellationToken);
+        }
+
+        public Task<SyncResult> ExecuteSwitchAsync(
+            SwitchIntent intent,
+            ApplicationOperationPlan plan,
+            string operationId,
+            CancellationToken cancellationToken = default)
+        {
+            RecordExecution(intent, plan);
+            SwitchExecuteCalls++;
+            return Task.FromResult(SyncResult);
+        }
+
+        public Task<RestoreResult> ExecuteRestoreAsync(
+            RestoreIntent intent,
+            ApplicationOperationPlan plan,
+            string operationId,
+            CancellationToken cancellationToken = default)
+        {
+            RecordExecution(intent, plan);
+            RestoreExecuteCalls++;
+            return Task.FromResult(new RestoreResult
+            {
+                CodexHome = intent.CodexHome,
+                BackupDir = intent.BackupDirectory,
+                TargetProvider = "relay"
+            });
+        }
+
+        public Task<BackupPruneResult> ExecutePruneAsync(
+            PruneIntent intent,
+            ApplicationOperationPlan plan,
+            string operationId,
+            CancellationToken cancellationToken = default)
+        {
+            RecordExecution(intent, plan);
+            PruneExecuteCalls++;
+            return Task.FromResult(new BackupPruneResult
+            {
+                BackupRoot = $"{intent.CodexHome}/backups",
+                DeletedCount = 1,
+                RemainingCount = intent.BackupRetentionCount,
+                FreedBytes = 10
+            });
+        }
+
+        private void RecordExecution(ApplicationWriteIntent intent, ApplicationOperationPlan plan)
+        {
+            ExecuteCalls++;
+            LastIntent = intent;
+            LastExecutedPlan = plan;
+            ExecutedIntents.Add(intent);
+        }
+    }
+
+    private static StatusSnapshot CreateStatus(string codexHome)
+    {
+        return new StatusSnapshot
+        {
+            CodexHome = codexHome,
+            CurrentProvider = new CurrentProviderInfo("openai", false),
+            ConfiguredProviders = ["openai", "relay"],
+            RolloutCounts = new ProviderCounts(),
+            LockedRolloutFiles = [],
+            UnreadableRolloutFiles = [],
+            EncryptedContentCounts = new ProviderCounts(),
+            SqliteCounts = new ProviderCounts(),
+            BackupRoot = $"{codexHome}/backups",
+            BackupSummary = new BackupSummary { Count = 0, TotalBytes = 0 }
+        };
+    }
+
+    private static SyncResult CreateSyncResult()
+    {
+        return new SyncResult
+        {
+            CodexHome = "/fixture",
+            TargetProvider = "relay",
+            PreviousProvider = "openai",
+            BackupDir = "/fixture/backups/new",
+            ChangedSessionFiles = 1,
+            SkippedLockedRolloutFiles = [],
+            SkippedUnreadableRolloutFiles = [],
+            SqliteRowsUpdated = 1,
+            SqlitePresent = true,
+            RolloutCountsBefore = new ProviderCounts(),
+            EncryptedContentCounts = new ProviderCounts()
+        };
+    }
+
+    private static Dictionary<string, (long Length, long LastWrite)> SnapshotFiles(string root)
+    {
+        return Directory.EnumerateFiles(root, "*", SearchOption.AllDirectories)
+            .ToDictionary(
+                path => Path.GetRelativePath(root, path),
+                path =>
+                {
+                    FileInfo info = new(path);
+                    return (info.Length, info.LastWriteTimeUtc.Ticks);
+                },
+                StringComparer.Ordinal);
+    }
+}
diff --git a/desktop/CodexProviderSync.Application.Tests/ClaimHost/CodexProviderSync.PlanClaimHost.csproj b/desktop/CodexProviderSync.Application.Tests/ClaimHost/CodexProviderSync.PlanClaimHost.csproj
new file mode 100644
index 0000000..6989bd6
--- /dev/null
+++ b/desktop/CodexProviderSync.Application.Tests/ClaimHost/CodexProviderSync.PlanClaimHost.csproj
@@ -0,0 +1,14 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\CodexProviderSync.Application\CodexProviderSync.Application.csproj" />
+  </ItemGroup>
+
+</Project>
diff --git a/desktop/CodexProviderSync.Application.Tests/ClaimHost/Program.cs b/desktop/CodexProviderSync.Application.Tests/ClaimHost/Program.cs
new file mode 100644
index 0000000..acb5fa1
--- /dev/null
+++ b/desktop/CodexProviderSync.Application.Tests/ClaimHost/Program.cs
@@ -0,0 +1,27 @@
+using CodexProviderSync.Application;
+
+if (args is not [string ledgerRoot, string planId, string digest, string readyPath, string startPath])
+{
+    return 64;
+}
+if (!Path.IsPathFullyQualified(ledgerRoot)
+    || !Path.IsPathFullyQualified(readyPath)
+    || !Path.IsPathFullyQualified(startPath))
+{
+    return 65;
+}
+
+await File.WriteAllTextAsync(readyPath, $"{Environment.ProcessId}\n");
+using CancellationTokenSource timeout = new(TimeSpan.FromSeconds(30));
+while (!File.Exists(startPath))
+{
+    await Task.Delay(TimeSpan.FromMilliseconds(10), timeout.Token);
+}
+
+FileApplicationPlanLedger ledger = new(ledgerRoot);
+ApplicationPlanClaimResult result = await ledger.TryClaimAsync(
+    planId,
+    digest,
+    timeout.Token);
+Console.WriteLine(result.Status);
+return 0;
diff --git a/desktop/CodexProviderSync.Application.Tests/CodexProviderSync.Application.Tests.csproj b/desktop/CodexProviderSync.Application.Tests/CodexProviderSync.Application.Tests.csproj
new file mode 100644
index 0000000..aa9e726
--- /dev/null
+++ b/desktop/CodexProviderSync.Application.Tests/CodexProviderSync.Application.Tests.csproj
@@ -0,0 +1,33 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Compile Remove="ClaimHost\**\*.cs" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\CodexProviderSync.Application\CodexProviderSync.Application.csproj" />
+    <ProjectReference
+      Include="ClaimHost\CodexProviderSync.PlanClaimHost.csproj"
+      ReferenceOutputAssembly="false"
+      AdditionalProperties="Configuration=$(Configuration)" />
+  </ItemGroup>
+
+</Project>
diff --git a/desktop/CodexProviderSync.Application.Tests/CoreApplicationAdapterSharedServiceTests.cs b/desktop/CodexProviderSync.Application.Tests/CoreApplicationAdapterSharedServiceTests.cs
new file mode 100644
index 0000000..bfe3b71
--- /dev/null
+++ b/desktop/CodexProviderSync.Application.Tests/CoreApplicationAdapterSharedServiceTests.cs
@@ -0,0 +1,113 @@
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.Application.Tests;
+
+public sealed class CoreApplicationAdapterSharedServiceTests
+{
+    [Fact]
+    public async Task Refresh_UsesSharedApplicationStatus_AndPreservesSettingsProviderMerge()
+    {
+        string root = Path.Combine(
+            Path.GetTempPath(),
+            $"codex-provider-controller-shared-{Guid.NewGuid():N}");
+        string codexHome = Path.Combine(root, "codex-home");
+        string sqliteHome = Path.Combine(root, "sqlite-home");
+        string settingsPath = Path.Combine(root, "appdata", "settings.json");
+        Directory.CreateDirectory(codexHome);
+        Directory.CreateDirectory(sqliteHome);
+        try
+        {
+            SettingsService settings = new(settingsPath);
+            await settings.SaveAsync(new AppSettings
+            {
+                ManualProviders = ["manual"],
+                SavedProviders = ["manual"]
+            });
+            StatusSnapshot status = CreateStatus(codexHome, sqliteHome);
+            RecordingStatusApplicationService shared = new(status);
+            CoreApplicationAdapter adapter = new(
+                new CodexSyncService(),
+                settings,
+                new CodexHomeService(),
+                shared);
+
+            CoreRefreshState refreshed = await adapter.RefreshAsync(
+                new CoreRefreshRequest(codexHome, sqliteHome, "relay"));
+
+            Assert.Equal(1, shared.StatusCalls);
+            Assert.Equal(codexHome, shared.LastStatusRequest!.CodexHome);
+            Assert.Equal(sqliteHome, shared.LastStatusRequest.SqliteHomeOverride);
+            Assert.Same(status, refreshed.Status);
+            Assert.Contains(refreshed.Providers, option => option.Id == "relay");
+            Assert.Contains(refreshed.Providers, option => option.Id == "manual" && option.IsManual);
+            AppSettings persisted = await settings.LoadAsync();
+            Assert.Contains("relay", persisted.SavedProviders);
+            Assert.Equal("relay", persisted.LastSelectedProvider);
+        }
+        finally
+        {
+            Directory.Delete(root, recursive: true);
+        }
+    }
+
+    private static StatusSnapshot CreateStatus(string codexHome, string sqliteHome) => new()
+    {
+        CodexHome = codexHome,
+        SqliteHome = sqliteHome,
+        SqliteHomeSource = "gui",
+        CurrentProvider = new CurrentProviderInfo("openai", false),
+        ConfiguredProviders = ["openai", "relay"],
+        RolloutCounts = new ProviderCounts(),
+        LockedRolloutFiles = [],
+        UnreadableRolloutFiles = [],
+        EncryptedContentCounts = new ProviderCounts(),
+        SqliteCounts = null,
+        BackupRoot = Path.Combine(codexHome, "backups_state", "provider-sync"),
+        BackupSummary = new BackupSummary { Count = 0, TotalBytes = 0 }
+    };
+
+    private sealed class RecordingStatusApplicationService(StatusSnapshot status) : IApplicationService
+    {
+        internal int StatusCalls { get; private set; }
+
+        internal ApplicationStatusRequest? LastStatusRequest { get; private set; }
+
+        public Task<ApplicationOutcome<StatusSnapshot>> GetStatusAsync(
+            ApplicationStatusRequest request,
+            CancellationToken cancellationToken = default)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            StatusCalls++;
+            LastStatusRequest = request;
+            DateTimeOffset now = DateTimeOffset.UtcNow;
+            return Task.FromResult(new ApplicationOutcome<StatusSnapshot>(
+                $"status-{StatusCalls}",
+                ApplicationOperationKind.Status,
+                ApplicationOperationLifecycle.Succeeded,
+                now,
+                now,
+                status,
+                [],
+                [],
+                [new ApplicationLifecycleEvent(ApplicationOperationLifecycle.Succeeded, now)]));
+        }
+
+        public Task<ApplicationOutcome<ApplicationDescription>> DescribeAsync(CancellationToken cancellationToken = default) =>
+            throw new NotSupportedException();
+
+        public Task<ApplicationOutcome<ApplicationOperationPlan>> CreatePlanAsync(CreateApplicationPlanRequest request, CancellationToken cancellationToken = default) =>
+            throw new NotSupportedException();
+
+        public Task<ApplicationOutcome<ApplicationWriteResult<SyncResult>>> SyncAsync(SyncApplicationRequest request, CancellationToken cancellationToken = default) =>
+            throw new NotSupportedException();
+
+        public Task<ApplicationOutcome<ApplicationWriteResult<SyncResult>>> SwitchAsync(SwitchApplicationRequest request, CancellationToken cancellationToken = default) =>
+            throw new NotSupportedException();
+
+        public Task<ApplicationOutcome<ApplicationWriteResult<RestoreResult>>> RestoreAsync(RestoreApplicationRequest request, CancellationToken cancellationToken = default) =>
+            throw new NotSupportedException();
+
+        public Task<ApplicationOutcome<ApplicationWriteResult<BackupPruneResult>>> PruneAsync(PruneApplicationRequest request, CancellationToken cancellationToken = default) =>
+            throw new NotSupportedException();
+    }
+}
diff --git a/desktop/CodexProviderSync.Application.Tests/CoreApplicationWritePortTests.cs b/desktop/CodexProviderSync.Application.Tests/CoreApplicationWritePortTests.cs
new file mode 100644
index 0000000..ba54ec6
--- /dev/null
+++ b/desktop/CodexProviderSync.Application.Tests/CoreApplicationWritePortTests.cs
@@ -0,0 +1,135 @@
+using System.Text.Json;
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.Application.Tests;
+
+public sealed class CoreApplicationWritePortTests
+{
+    [Fact]
+    public async Task ProductionSync_DefaultsToDryRunThenAppliesTheExactCorePlan()
+    {
+        using Fixture fixture = await Fixture.CreateAsync("relay");
+        ApplicationService service = CreateService();
+        SyncIntent intent = new($"  {fixture.CodexHome}  ", null, "  openai  ", 5);
+
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> dryRun = await service.SyncAsync(
+            new SyncApplicationRequest(intent));
+
+        Assert.Equal(ApplicationOperationLifecycle.ReadyToApply, dryRun.Lifecycle);
+        Assert.False(dryRun.Data!.Applied);
+        SyncIntent normalizedIntent = Assert.IsType<SyncIntent>(dryRun.Data.Plan.Intent);
+        Assert.Equal(fixture.CodexHome, normalizedIntent.CodexHome);
+        Assert.Equal("openai", normalizedIntent.ProviderId);
+        Assert.False(Directory.Exists(fixture.BackupRoot));
+        Assert.Contains("\"model_provider\":\"relay\"", await File.ReadAllTextAsync(fixture.RolloutPath));
+
+        ApplicationOperationPlan plan = dryRun.Data.Plan;
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> applied = await service.SyncAsync(
+            new SyncApplicationRequest(
+                intent,
+                new ApplicationApplyAuthorization(true, plan, plan.Digest)));
+
+        Assert.Equal(ApplicationOperationLifecycle.Succeeded, applied.Lifecycle);
+        Assert.True(applied.Data!.Applied);
+        Assert.Equal("openai", applied.Data.Result!.TargetProvider);
+        Assert.True(Directory.Exists(applied.Data.Result.BackupDir));
+        Assert.Contains("\"model_provider\":\"openai\"", await File.ReadAllTextAsync(fixture.RolloutPath));
+    }
+
+    [Fact]
+    public async Task ProductionSync_DriftIsRejectedBeforeCoreCreatesABackup()
+    {
+        using Fixture fixture = await Fixture.CreateAsync("relay");
+        ApplicationService service = CreateService();
+        SyncIntent intent = new(fixture.CodexHome, null, "openai", 5);
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> dryRun = await service.SyncAsync(
+            new SyncApplicationRequest(intent));
+        ApplicationOperationPlan plan = dryRun.Data!.Plan;
+        await File.AppendAllTextAsync(
+            fixture.RolloutPath,
+            "{\"type\":\"event_msg\",\"payload\":{\"type\":\"agent_message\"}}\n");
+        string drifted = await File.ReadAllTextAsync(fixture.RolloutPath);
+
+        ApplicationOutcome<ApplicationWriteResult<SyncResult>> applied = await service.SyncAsync(
+            new SyncApplicationRequest(
+                Assert.IsType<SyncIntent>(plan.Intent),
+                new ApplicationApplyAuthorization(true, plan, plan.Digest)));
+
+        Assert.Equal(ApplicationOperationLifecycle.Rejected, applied.Lifecycle);
+        Assert.Equal("plan_stale", Assert.Single(applied.Errors).Code);
+        Assert.Equal(drifted, await File.ReadAllTextAsync(fixture.RolloutPath));
+        Assert.False(Directory.Exists(fixture.BackupRoot));
+    }
+
+    private static ApplicationService CreateService()
+    {
+        return new ApplicationService(
+            new CoreApplicationStatusPort(),
+            new CoreApplicationWritePort(),
+            new InMemoryApplicationPlanLedger());
+    }
+
+    private sealed class Fixture : IDisposable
+    {
+        private Fixture(string root, string codexHome, string rolloutPath)
+        {
+            Root = root;
+            CodexHome = codexHome;
+            RolloutPath = rolloutPath;
+        }
+
+        public string Root { get; }
+        public string CodexHome { get; }
+        public string RolloutPath { get; }
+        public string BackupRoot => AppConstants.DefaultBackupRoot(CodexHome);
+
+        public static async Task<Fixture> CreateAsync(string provider)
+        {
+            string root = Path.Combine(
+                Path.GetTempPath(),
+                $"codex-provider-application-write-{Guid.NewGuid():N}");
+            string codexHome = Path.Combine(root, ".codex");
+            string sessionDirectory = Path.Combine(codexHome, "sessions", "2026", "08", "04");
+            Directory.CreateDirectory(sessionDirectory);
+            Directory.CreateDirectory(Path.Combine(codexHome, "archived_sessions"));
+            await File.WriteAllTextAsync(
+                Path.Combine(codexHome, "config.toml"),
+                "model_provider = \"openai\"\n");
+            string rolloutPath = Path.Combine(sessionDirectory, "rollout-fixture.jsonl");
+            string sessionMeta = JsonSerializer.Serialize(new
+            {
+                timestamp = "2026-08-04T00:00:00.000Z",
+                type = "session_meta",
+                payload = new
+                {
+                    id = "thread-application-write",
+                    timestamp = "2026-08-04T00:00:00.000Z",
+                    cwd = root,
+                    source = "cli",
+                    cli_version = "0.115.0",
+                    model_provider = provider
+                }
+            });
+            await File.WriteAllTextAsync(rolloutPath, sessionMeta + "\n");
+            return new Fixture(root, codexHome, rolloutPath);
+        }
+
+        public void Dispose()
+        {
+            if (!Directory.Exists(Root))
+            {
+                return;
+            }
+            string fullRoot = Path.GetFullPath(Root);
+            string fullTemp = Path.GetFullPath(Path.GetTempPath());
+            string relative = Path.GetRelativePath(fullTemp, fullRoot);
+            if (Path.IsPathRooted(relative)
+                || relative == ".."
+                || relative.StartsWith($"..{Path.DirectorySeparatorChar}", StringComparison.Ordinal))
+            {
+                throw new InvalidOperationException("Refusing to remove a test directory outside the temp root.");
+            }
+            Directory.Delete(fullRoot, recursive: true);
+        }
+    }
+}
diff --git a/desktop/CodexProviderSync.Application.Tests/FileApplicationPlanLedgerTests.cs b/desktop/CodexProviderSync.Application.Tests/FileApplicationPlanLedgerTests.cs
new file mode 100644
index 0000000..7d2da46
--- /dev/null
+++ b/desktop/CodexProviderSync.Application.Tests/FileApplicationPlanLedgerTests.cs
@@ -0,0 +1,432 @@
+using System.Diagnostics;
+using System.Text;
+using CodexProviderSync.Application;
+
+namespace CodexProviderSync.Application.Tests;
+
+public sealed class FileApplicationPlanLedgerTests
+{
+    private static readonly string DigestA = new('a', 64);
+    private static readonly string DigestB = new('b', 64);
+    private static readonly DateTimeOffset TestNow = new(2026, 8, 4, 3, 0, 0, TimeSpan.Zero);
+
+    [Fact]
+    public void Constructor_RequiresAnExplicitFullyQualifiedNonRootPath_AndDoesNotTouchDisk()
+    {
+        using TemporaryDirectory temporary = new();
+        string ledgerRoot = Path.Combine(temporary.Path, "not-created-yet");
+
+        FileApplicationPlanLedger ledger = new(ledgerRoot);
+
+        Assert.Equal(Path.GetFullPath(ledgerRoot), ledger.LedgerRoot);
+        Assert.False(Directory.Exists(ledgerRoot));
+        Assert.DoesNotContain(
+            typeof(FileApplicationPlanLedger).GetConstructors(),
+            static constructor => constructor.GetParameters().Length == 0);
+        Assert.Throws<ArgumentException>(() => new FileApplicationPlanLedger(string.Empty));
+        Assert.Throws<ArgumentException>(() => new FileApplicationPlanLedger("relative-ledger"));
+        Assert.Throws<ArgumentException>(() => new FileApplicationPlanLedger(Path.GetPathRoot(ledgerRoot)!));
+    }
+
+    [Fact]
+    public async Task Register_IsDurableCanonicalAndIdempotentAcrossIndependentInstances()
+    {
+        using TemporaryDirectory temporary = new();
+        FakeTimeProvider time = new(TestNow);
+        FileApplicationPlanLedger first = new(temporary.LedgerRoot, time);
+        FileApplicationPlanLedger second = new(temporary.LedgerRoot, time);
+        ApplicationOperationPlan plan = CreatePlan("plan-register", DigestA);
+
+        await first.RegisterAsync(plan);
+        await second.RegisterAsync(plan with { });
+
+        string registrationPath = Assert.Single(Directory.EnumerateFiles(
+            Path.Combine(temporary.LedgerRoot, "entries"),
+            "*.registration.v1.json"));
+        string json = await File.ReadAllTextAsync(registrationPath, Encoding.UTF8);
+        Assert.EndsWith("\n", json, StringComparison.Ordinal);
+        Assert.Contains("\"schemaVersion\":1", json, StringComparison.Ordinal);
+        Assert.Contains("\"recordType\":\"registration\"", json, StringComparison.Ordinal);
+        Assert.Contains("\"planId\":\"plan-register\"", json, StringComparison.Ordinal);
+        Assert.Contains($"\"digest\":\"{DigestA}\"", json, StringComparison.Ordinal);
+        Assert.True(json.IndexOf("\"schemaVersion\"", StringComparison.Ordinal)
+            < json.IndexOf("\"recordType\"", StringComparison.Ordinal));
+        Assert.True(json.IndexOf("\"recordType\"", StringComparison.Ordinal)
+            < json.IndexOf("\"planId\"", StringComparison.Ordinal));
+        Assert.True(json.IndexOf("\"planId\"", StringComparison.Ordinal)
+            < json.IndexOf("\"digest\"", StringComparison.Ordinal));
+
+        InvalidOperationException conflict = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => second.RegisterAsync(plan with { Digest = DigestB }));
+        Assert.Contains("different digest", conflict.Message, StringComparison.Ordinal);
+        Assert.Equal(json, await File.ReadAllTextAsync(registrationPath, Encoding.UTF8));
+    }
+
+    [Fact]
+    public async Task TwentyIndependentInstances_AtomicallyAllowExactlyOneClaim()
+    {
+        using TemporaryDirectory temporary = new();
+        ApplicationOperationPlan plan = CreatePlan("plan-concurrent", DigestA);
+        FileApplicationPlanLedger registrar = new(temporary.LedgerRoot, new FakeTimeProvider(TestNow));
+        await registrar.RegisterAsync(plan);
+
+        FileApplicationPlanLedger[] contenders = Enumerable.Range(0, 20)
+            .Select(index => new FileApplicationPlanLedger(
+                temporary.LedgerRoot,
+                new FakeTimeProvider(TestNow.AddMilliseconds(index))))
+            .ToArray();
+        TaskCompletionSource start = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        Task<ApplicationPlanClaimResult>[] tasks = contenders
+            .Select(async ledger =>
+            {
+                await start.Task;
+                return await ledger.TryClaimAsync(plan.PlanId, plan.Digest);
+            })
+            .ToArray();
+
+        start.SetResult();
+        ApplicationPlanClaimResult[] claims = await Task.WhenAll(tasks);
+
+        Assert.Single(claims, static claim => claim.Status == ApplicationPlanClaimStatus.Claimed);
+        Assert.Equal(19, claims.Count(static claim => claim.Status == ApplicationPlanClaimStatus.AlreadyUsed));
+        Assert.Single(Directory.EnumerateFiles(
+            Path.Combine(temporary.LedgerRoot, "entries"),
+            "*.claim.v1.json"));
+    }
+
+    [Fact]
+    public async Task EightIndependentOsProcesses_AtomicallyAllowExactlyOneClaim()
+    {
+        using TemporaryDirectory temporary = new();
+        ApplicationOperationPlan plan = CreatePlan("plan-process-race", DigestA);
+        FileApplicationPlanLedger registrar = new(temporary.LedgerRoot, new FakeTimeProvider(TestNow));
+        await registrar.RegisterAsync(plan);
+
+        string configuration = new DirectoryInfo(AppContext.BaseDirectory).Parent?.Name ?? "Debug";
+        string testProjectDirectory = Path.GetFullPath(Path.Combine(AppContext.BaseDirectory, "..", "..", ".."));
+        string claimHostPath = Path.Combine(
+            testProjectDirectory,
+            "ClaimHost",
+            "bin",
+            configuration,
+            "net10.0",
+            "CodexProviderSync.PlanClaimHost.dll");
+        Assert.True(File.Exists(claimHostPath), $"Plan-claim host was not built: {claimHostPath}");
+
+        string startPath = Path.Combine(temporary.Path, "start.signal");
+        string dotnetHost = Environment.GetEnvironmentVariable("DOTNET_HOST_PATH") ?? "dotnet";
+        List<ChildProcess> children = [];
+        try
+        {
+            for (int index = 0; index < 8; index++)
+            {
+                string readyPath = Path.Combine(temporary.Path, $"ready-{index}.signal");
+                ProcessStartInfo startInfo = new(dotnetHost)
+                {
+                    UseShellExecute = false,
+                    RedirectStandardOutput = true,
+                    RedirectStandardError = true,
+                    CreateNoWindow = true
+                };
+                startInfo.ArgumentList.Add(claimHostPath);
+                startInfo.ArgumentList.Add(temporary.LedgerRoot);
+                startInfo.ArgumentList.Add(plan.PlanId);
+                startInfo.ArgumentList.Add(plan.Digest);
+                startInfo.ArgumentList.Add(readyPath);
+                startInfo.ArgumentList.Add(startPath);
+                Process process = Process.Start(startInfo)
+                    ?? throw new InvalidOperationException("Failed to start a plan-claim child process.");
+                children.Add(new ChildProcess(
+                    process,
+                    readyPath,
+                    process.StandardOutput.ReadToEndAsync(),
+                    process.StandardError.ReadToEndAsync()));
+            }
+
+            using CancellationTokenSource timeout = new(TimeSpan.FromSeconds(30));
+            while (children.Any(static child => !File.Exists(child.ReadyPath)))
+            {
+                ChildProcess? exited = children.FirstOrDefault(static child => child.Process.HasExited);
+                if (exited is not null)
+                {
+                    throw new InvalidOperationException(
+                        $"A plan-claim child exited before the race barrier: {await exited.StandardError}");
+                }
+
+                await Task.Delay(TimeSpan.FromMilliseconds(10), timeout.Token);
+            }
+
+            await File.WriteAllTextAsync(startPath, "start\n", timeout.Token);
+            await Task.WhenAll(children.Select(child => child.Process.WaitForExitAsync(timeout.Token)));
+
+            string[] statuses = await Task.WhenAll(children.Select(static child => child.StandardOutput));
+            string[] errors = await Task.WhenAll(children.Select(static child => child.StandardError));
+            for (int index = 0; index < children.Count; index++)
+            {
+                Assert.True(
+                    children[index].Process.ExitCode == 0,
+                    $"Plan-claim child {index} exited as {children[index].Process.ExitCode}: {errors[index]}");
+            }
+
+            Assert.Single(statuses, static status => status.Trim() == nameof(ApplicationPlanClaimStatus.Claimed));
+            Assert.Equal(
+                7,
+                statuses.Count(static status => status.Trim() == nameof(ApplicationPlanClaimStatus.AlreadyUsed)));
+            Assert.Single(Directory.EnumerateFiles(
+                Path.Combine(temporary.LedgerRoot, "entries"),
+                "*.claim.v1.json"));
+        }
+        finally
+        {
+            foreach (ChildProcess child in children)
+            {
+                try
+                {
+                    if (!child.Process.HasExited)
+                    {
+                        child.Process.Kill(entireProcessTree: true);
+                        child.Process.WaitForExit();
+                    }
+                }
+                catch (InvalidOperationException)
+                {
+                    // The child exited between the state check and cleanup.
+                }
+                child.Process.Dispose();
+            }
+        }
+    }
+
+    [Fact]
+    public async Task ClaimedPlan_RemainsConsumedAfterProcessLikeRestartWithoutCompletion()
+    {
+        using TemporaryDirectory temporary = new();
+        ApplicationOperationPlan plan = CreatePlan("plan-crash", DigestA);
+        FileApplicationPlanLedger beforeCrash = new(temporary.LedgerRoot, new FakeTimeProvider(TestNow));
+        await beforeCrash.RegisterAsync(plan);
+
+        ApplicationPlanClaimResult claimed = await beforeCrash.TryClaimAsync(plan.PlanId, plan.Digest);
+        Assert.Equal(ApplicationPlanClaimStatus.Claimed, claimed.Status);
+        Assert.Empty(Directory.EnumerateFiles(
+            Path.Combine(temporary.LedgerRoot, "entries"),
+            "*.completion.v1.json"));
+
+        FileApplicationPlanLedger afterRestart = new(
+            temporary.LedgerRoot,
+            new FakeTimeProvider(TestNow.AddMinutes(1)));
+        ApplicationPlanClaimResult retried = await afterRestart.TryClaimAsync(plan.PlanId, plan.Digest);
+
+        Assert.Equal(ApplicationPlanClaimStatus.AlreadyUsed, retried.Status);
+        Assert.Single(Directory.EnumerateFiles(
+            Path.Combine(temporary.LedgerRoot, "entries"),
+            "*.claim.v1.json"));
+    }
+
+    [Fact]
+    public async Task DigestMismatch_DoesNotConsumeTheRegisteredPlan()
+    {
+        using TemporaryDirectory temporary = new();
+        ApplicationOperationPlan plan = CreatePlan("plan-digest", DigestA);
+        FileApplicationPlanLedger ledger = new(temporary.LedgerRoot, new FakeTimeProvider(TestNow));
+        await ledger.RegisterAsync(plan);
+
+        ApplicationPlanClaimResult mismatch = await ledger.TryClaimAsync(plan.PlanId, DigestB);
+        Assert.Equal(ApplicationPlanClaimStatus.DigestMismatch, mismatch.Status);
+        Assert.Empty(Directory.EnumerateFiles(
+            Path.Combine(temporary.LedgerRoot, "entries"),
+            "*.claim.v1.json"));
+
+        ApplicationPlanClaimResult claimed = await ledger.TryClaimAsync(plan.PlanId, DigestA);
+        Assert.Equal(ApplicationPlanClaimStatus.Claimed, claimed.Status);
+    }
+
+    [Fact]
+    public async Task Complete_IsIdempotentForTheSameTerminalState_AndRejectsInvalidTransitions()
+    {
+        using TemporaryDirectory temporary = new();
+        ApplicationOperationPlan plan = CreatePlan("plan-complete", DigestA);
+        FakeTimeProvider time = new(TestNow);
+        FileApplicationPlanLedger ledger = new(temporary.LedgerRoot, time);
+        await ledger.RegisterAsync(plan);
+
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => ledger.CompleteAsync(plan.PlanId, ApplicationOperationLifecycle.Succeeded));
+        await Assert.ThrowsAsync<ArgumentOutOfRangeException>(
+            () => ledger.CompleteAsync(plan.PlanId, ApplicationOperationLifecycle.Applying));
+
+        await ledger.TryClaimAsync(plan.PlanId, plan.Digest);
+        time.Advance(TimeSpan.FromSeconds(5));
+        await ledger.CompleteAsync(plan.PlanId, ApplicationOperationLifecycle.Succeeded);
+        await ledger.CompleteAsync(plan.PlanId, ApplicationOperationLifecycle.Succeeded);
+
+        InvalidOperationException transition = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => ledger.CompleteAsync(plan.PlanId, ApplicationOperationLifecycle.Failed));
+        Assert.Contains("cannot transition", transition.Message, StringComparison.Ordinal);
+        string completionPath = Assert.Single(Directory.EnumerateFiles(
+            Path.Combine(temporary.LedgerRoot, "entries"),
+            "*.completion.v1.json"));
+        string completion = await File.ReadAllTextAsync(completionPath, Encoding.UTF8);
+        Assert.Contains("\"lifecycle\":\"succeeded\"", completion, StringComparison.Ordinal);
+        Assert.DoesNotContain("failed", completion, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task CorruptRegistration_IsRejectedAndPreservedAsRecoveryEvidence()
+    {
+        using TemporaryDirectory temporary = new();
+        ApplicationOperationPlan plan = CreatePlan("plan-corrupt-registration", DigestA);
+        FileApplicationPlanLedger ledger = new(temporary.LedgerRoot, new FakeTimeProvider(TestNow));
+        await ledger.RegisterAsync(plan);
+        string registrationPath = Assert.Single(Directory.EnumerateFiles(
+            Path.Combine(temporary.LedgerRoot, "entries"),
+            "*.registration.v1.json"));
+        byte[] corrupted = Encoding.UTF8.GetBytes("{\"schemaVersion\":1");
+        await File.WriteAllBytesAsync(registrationPath, corrupted);
+
+        FileApplicationPlanLedger restarted = new(temporary.LedgerRoot, new FakeTimeProvider(TestNow));
+        ApplicationPlanLedgerCorruptionException error =
+            await Assert.ThrowsAsync<ApplicationPlanLedgerCorruptionException>(
+                () => restarted.TryClaimAsync(plan.PlanId, plan.Digest));
+
+        Assert.Equal("plan_ledger_corrupt", error.Code);
+        Assert.Equal(plan.PlanId, error.PlanId);
+        Assert.Equal(Path.GetFullPath(registrationPath), error.EvidencePath);
+        Assert.Equal(corrupted, await File.ReadAllBytesAsync(registrationPath));
+        Assert.Empty(Directory.EnumerateFiles(
+            Path.Combine(temporary.LedgerRoot, "entries"),
+            "*.claim.v1.json"));
+    }
+
+    [Fact]
+    public async Task CorruptClaim_IsNeverTreatedAsReusable()
+    {
+        using TemporaryDirectory temporary = new();
+        ApplicationOperationPlan plan = CreatePlan("plan-corrupt-claim", DigestA);
+        FileApplicationPlanLedger ledger = new(temporary.LedgerRoot, new FakeTimeProvider(TestNow));
+        await ledger.RegisterAsync(plan);
+        await ledger.TryClaimAsync(plan.PlanId, plan.Digest);
+        string claimPath = Assert.Single(Directory.EnumerateFiles(
+            Path.Combine(temporary.LedgerRoot, "entries"),
+            "*.claim.v1.json"));
+        await File.WriteAllTextAsync(claimPath, "{}\n", Encoding.UTF8);
+
+        FileApplicationPlanLedger restarted = new(temporary.LedgerRoot, new FakeTimeProvider(TestNow));
+        ApplicationPlanLedgerCorruptionException error =
+            await Assert.ThrowsAsync<ApplicationPlanLedgerCorruptionException>(
+                () => restarted.TryClaimAsync(plan.PlanId, plan.Digest));
+
+        Assert.Equal(Path.GetFullPath(claimPath), error.EvidencePath);
+        Assert.Empty(Directory.EnumerateFiles(
+            Path.Combine(temporary.LedgerRoot, "entries"),
+            "*.completion.v1.json"));
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("../escape")]
+    [InlineData("..\\escape")]
+    [InlineData("a/b")]
+    [InlineData("a\\b")]
+    [InlineData(".hidden")]
+    [InlineData("-leading")]
+    [InlineData("plan.with.dot")]
+    [InlineData("计划")]
+    public async Task UnsafePlanIds_AreRejectedBeforeStorageIsCreated(string planId)
+    {
+        using TemporaryDirectory temporary = new();
+        FileApplicationPlanLedger ledger = new(temporary.LedgerRoot, new FakeTimeProvider(TestNow));
+
+        await Assert.ThrowsAsync<ArgumentException>(
+            () => ledger.TryClaimAsync(planId, DigestA));
+
+        Assert.False(Directory.Exists(temporary.LedgerRoot));
+    }
+
+    [Fact]
+    public async Task LocksArePerPlanAndPersistent_WithoutDeletingAnotherPlansLock()
+    {
+        using TemporaryDirectory temporary = new();
+        FileApplicationPlanLedger ledger = new(temporary.LedgerRoot, new FakeTimeProvider(TestNow));
+        ApplicationOperationPlan first = CreatePlan("plan-lock-one", DigestA);
+        ApplicationOperationPlan second = CreatePlan("plan-lock-two", DigestB);
+
+        await ledger.RegisterAsync(first);
+        await ledger.RegisterAsync(second);
+        await ledger.TryClaimAsync(first.PlanId, first.Digest);
+        await ledger.TryClaimAsync(second.PlanId, second.Digest);
+
+        string[] lockFiles = Directory.EnumerateFiles(
+            Path.Combine(temporary.LedgerRoot, "locks"),
+            "*.lock").ToArray();
+        Assert.Equal(2, lockFiles.Length);
+        Assert.All(lockFiles, static path => Assert.True(File.Exists(path)));
+    }
+
+    private static ApplicationOperationPlan CreatePlan(string planId, string digest)
+    {
+        return new ApplicationOperationPlan(
+            ApplicationProtocol.Version,
+            planId,
+            $"operation-{planId}",
+            TestNow,
+            TestNow.AddMinutes(10),
+            new SyncIntent("/isolated/fixture", null, "relay"),
+            "state-fingerprint",
+            "execution-token",
+            [new ApplicationPlanTarget("/isolated/fixture/session.jsonl", "replace", "sha256:target")],
+            [],
+            [],
+            digest);
+    }
+
+    private sealed class FakeTimeProvider(DateTimeOffset now) : TimeProvider
+    {
+        private DateTimeOffset _now = now;
+
+        public override DateTimeOffset GetUtcNow() => _now;
+
+        public void Advance(TimeSpan duration) => _now = _now.Add(duration);
+    }
+
+    private sealed record ChildProcess(
+        Process Process,
+        string ReadyPath,
+        Task<string> StandardOutput,
+        Task<string> StandardError);
+
+    private sealed class TemporaryDirectory : IDisposable
+    {
+        public TemporaryDirectory()
+        {
+            Path = System.IO.Path.Combine(
+                System.IO.Path.GetTempPath(),
+                $"codex-provider-plan-ledger-tests-{Guid.NewGuid():N}");
+            LedgerRoot = System.IO.Path.Combine(Path, "ledger");
+            Directory.CreateDirectory(Path);
+        }
+
+        public string Path { get; }
+
+        public string LedgerRoot { get; }
+
+        public void Dispose()
+        {
+            if (!Directory.Exists(Path))
+            {
+                return;
+            }
+
+            string fullPath = System.IO.Path.GetFullPath(Path);
+            string fullTemp = System.IO.Path.GetFullPath(System.IO.Path.GetTempPath());
+            string relative = System.IO.Path.GetRelativePath(fullTemp, fullPath);
+            if (System.IO.Path.IsPathRooted(relative)
+                || relative == ".."
+                || relative.StartsWith($"..{System.IO.Path.DirectorySeparatorChar}", StringComparison.Ordinal))
+            {
+                throw new InvalidOperationException("Refusing to remove a test directory outside the system temp root.");
+            }
+
+            Directory.Delete(fullPath, recursive: true);
+        }
+    }
+}
diff --git a/desktop/CodexProviderSync.Application/AppController.cs b/desktop/CodexProviderSync.Application/AppController.cs
new file mode 100644
index 0000000..c6f4527
--- /dev/null
+++ b/desktop/CodexProviderSync.Application/AppController.cs
@@ -0,0 +1,451 @@
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.Application;
+
+public sealed class AppController
+{
+    private readonly ICoreApplicationAdapter _core;
+    private readonly object _stateGate = new();
+    private AppSnapshot _snapshot;
+
+    public AppController(ICoreApplicationAdapter core)
+    {
+        _core = core ?? throw new ArgumentNullException(nameof(core));
+        _snapshot = Recalculate(new AppSnapshot());
+    }
+
+    public AppSnapshot Snapshot
+    {
+        get
+        {
+            lock (_stateGate)
+            {
+                return _snapshot;
+            }
+        }
+    }
+
+    public event Action<AppSnapshot>? SnapshotChanged;
+
+    public Task<AppSnapshot> DispatchAsync(
+        AppControllerCommand command,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(command);
+        return command switch
+        {
+            InitializeAppCommand => InitializeAsync(cancellationToken),
+            RefreshStatusCommand refresh => RefreshAsync(
+                refresh.CodexHome,
+                refresh.SqliteHomeOverride,
+                refresh.PreferredProviderId,
+                cancellationToken),
+            SetStorageCommand storage => Task.FromResult(SetStorage(
+                storage.CodexHome,
+                storage.SqliteHomeOverride)),
+            SelectProviderCommand select => Task.FromResult(SetProvider(select.ProviderId)),
+            SetUpdateConfigCommand update => Task.FromResult(SetUpdateConfig(update.Enabled)),
+            SetModelModeCommand model => Task.FromResult(SetModelMode(model.Mode)),
+            SetCustomModelCommand custom => Task.FromResult(SetCustomModel(custom.Value)),
+            _ => throw new ArgumentOutOfRangeException(nameof(command), command, "Unknown controller command.")
+        };
+    }
+
+    public async Task<AppSnapshot> InitializeAsync(CancellationToken cancellationToken = default)
+    {
+        AppSnapshot previous = BeginOperation(AppActivity.Initializing);
+        try
+        {
+            CoreInitializationState initial = await _core.InitializeAsync(cancellationToken);
+            Publish(Snapshot with
+            {
+                CodexHome = initial.CodexHome,
+                SqliteHomeOverride = NormalizeOptional(initial.SqliteHomeOverride),
+                SelectedProviderId = NormalizeOptional(initial.PreferredProviderId)
+            });
+            return await RefreshCoreAsync(
+                initial.CodexHome,
+                initial.SqliteHomeOverride,
+                initial.PreferredProviderId,
+                cancellationToken);
+        }
+        catch (OperationCanceledException)
+        {
+            Publish(previous);
+            throw;
+        }
+        catch (Exception error)
+        {
+            return Publish(Snapshot with
+            {
+                Activity = AppActivity.Faulted,
+                ErrorMessage = error.Message
+            });
+        }
+    }
+
+    public async Task<AppSnapshot> RefreshAsync(
+        string codexHome,
+        string? sqliteHomeOverride = null,
+        string? preferredProviderId = null,
+        CancellationToken cancellationToken = default)
+    {
+        AppSnapshot previous = BeginOperation(
+            AppActivity.Refreshing,
+            codexHome,
+            sqliteHomeOverride);
+        try
+        {
+            return await RefreshCoreAsync(
+                codexHome,
+                sqliteHomeOverride,
+                NormalizeOptional(preferredProviderId) ?? previous.SelectedProviderId,
+                cancellationToken);
+        }
+        catch (OperationCanceledException)
+        {
+            Publish(previous);
+            throw;
+        }
+        catch (Exception error)
+        {
+            return Publish(Snapshot with
+            {
+                Activity = AppActivity.Faulted,
+                ErrorMessage = error.Message
+            });
+        }
+    }
+
+    public AppSnapshot SetStorage(string codexHome, string? sqliteHomeOverride = null)
+    {
+        if (string.IsNullOrWhiteSpace(codexHome))
+        {
+            throw new ArgumentException("Codex Home is required.", nameof(codexHome));
+        }
+
+        return UpdateEditable(snapshot => snapshot with
+        {
+            CodexHome = codexHome.Trim(),
+            SqliteHomeOverride = NormalizeOptional(sqliteHomeOverride)
+        });
+    }
+
+    public AppSnapshot SetProvider(string? providerId)
+    {
+        string? normalizedProviderId = NormalizeOptional(providerId);
+        return UpdateEditable(snapshot =>
+        {
+            if (normalizedProviderId is not null
+                && !snapshot.Providers.Any(option => string.Equals(option.Id, normalizedProviderId, StringComparison.Ordinal)))
+            {
+                throw new ArgumentOutOfRangeException(
+                    nameof(providerId),
+                    providerId,
+                    "The provider is not present in the current provider options.");
+            }
+
+            return snapshot with { SelectedProviderId = normalizedProviderId };
+        });
+    }
+
+    public AppSnapshot ApplyProviderOptions(
+        IReadOnlyList<ProviderOption> providers,
+        string? preferredProviderId = null)
+    {
+        ArgumentNullException.ThrowIfNull(providers);
+        return UpdateEditable(snapshot =>
+        {
+            string? selectedProviderId = ResolveSelection(
+                NormalizeOptional(preferredProviderId) ?? snapshot.SelectedProviderId,
+                snapshot.Status?.CurrentProvider.Provider,
+                providers);
+            IReadOnlyList<ProviderOptionState> providerStates = providers
+                .Select(option => new ProviderOptionState(
+                    option.Id,
+                    Array.AsReadOnly(option.Sources.ToArray()),
+                    option.IsCurrentProvider,
+                    option.IsManual,
+                    option.IsSaved,
+                    string.Equals(option.Id, selectedProviderId, StringComparison.Ordinal)))
+                .ToList()
+                .AsReadOnly();
+
+            return snapshot with
+            {
+                Providers = providerStates,
+                SelectedProviderId = selectedProviderId
+            };
+        });
+    }
+
+    public AppSnapshot SetUpdateConfig(bool enabled)
+    {
+        return UpdateEditable(snapshot => snapshot with { UpdateConfig = enabled });
+    }
+
+    public AppSnapshot SetModelMode(ModelMode mode)
+    {
+        if (!Enum.IsDefined(mode))
+        {
+            throw new ArgumentOutOfRangeException(nameof(mode), mode, "Unknown model mode.");
+        }
+
+        return UpdateEditable(snapshot => snapshot with { ModelMode = mode });
+    }
+
+    public AppSnapshot SetCustomModel(string value)
+    {
+        return UpdateEditable(snapshot => snapshot with { CustomModel = value ?? string.Empty });
+    }
+
+    public SyncRequestPreparation PrepareSyncRequest()
+    {
+        AppSnapshot snapshot = Snapshot;
+        AppValidationIssue[] blockingIssues = snapshot.ValidationIssues
+            .Where(static issue => issue is
+                AppValidationIssue.OperationInProgress or
+                AppValidationIssue.RefreshFailed or
+                AppValidationIssue.StatusUnavailable or
+                AppValidationIssue.ProviderRequired or
+                AppValidationIssue.CustomModelRequired or
+                AppValidationIssue.SqliteUnsupported)
+            .ToArray();
+        if (blockingIssues.Length > 0)
+        {
+            return new SyncRequestPreparation(null, Array.AsReadOnly(blockingIssues));
+        }
+
+        string providerId = snapshot.SelectedProviderId!;
+        PreparedSyncRequest request;
+        if (!snapshot.UpdateConfig)
+        {
+            request = new SyncProviderRequest(
+                snapshot.CodexHome,
+                snapshot.SqliteHomeOverride,
+                providerId);
+        }
+        else
+        {
+            SwitchModelSelection modelSelection = snapshot.ModelMode switch
+            {
+                ModelMode.FollowProvider => new FollowProviderModelSelection(),
+                ModelMode.KeepRootModel => new KeepRootModelSelection(),
+                ModelMode.Custom => new CustomModelSelection(snapshot.CustomModel.Trim()),
+                _ => throw new InvalidOperationException("Unknown model mode.")
+            };
+            request = new SwitchProviderRequest(
+                snapshot.CodexHome,
+                snapshot.SqliteHomeOverride,
+                providerId,
+                modelSelection);
+        }
+
+        return new SyncRequestPreparation(request, []);
+    }
+
+    private async Task<AppSnapshot> RefreshCoreAsync(
+        string codexHome,
+        string? sqliteHomeOverride,
+        string? preferredProviderId,
+        CancellationToken cancellationToken)
+    {
+        CoreRefreshState refreshed = await _core.RefreshAsync(
+            new CoreRefreshRequest(codexHome, sqliteHomeOverride, preferredProviderId),
+            cancellationToken);
+        string? selectedProviderId = ResolveSelection(
+            preferredProviderId,
+            refreshed.Status.CurrentProvider.Provider,
+            refreshed.Providers);
+        IReadOnlyList<ProviderOptionState> providers = refreshed.Providers
+            .Select(option => new ProviderOptionState(
+                option.Id,
+                Array.AsReadOnly(option.Sources.ToArray()),
+                option.IsCurrentProvider,
+                option.IsManual,
+                option.IsSaved,
+                string.Equals(option.Id, selectedProviderId, StringComparison.Ordinal)))
+            .ToList()
+            .AsReadOnly();
+
+        return Publish(Snapshot with
+        {
+            Activity = AppActivity.Ready,
+            CodexHome = refreshed.Status.CodexHome,
+            SqliteHomeOverride = NormalizeOptional(sqliteHomeOverride),
+            Status = refreshed.Status,
+            Providers = providers,
+            SelectedProviderId = selectedProviderId,
+            ErrorMessage = null
+        });
+    }
+
+    private AppSnapshot BeginOperation(
+        AppActivity activity,
+        string? codexHome = null,
+        string? sqliteHomeOverride = null)
+    {
+        AppSnapshot previous;
+        AppSnapshot published;
+        lock (_stateGate)
+        {
+            if (IsBusy(_snapshot.Activity))
+            {
+                throw new InvalidOperationException("Another controller operation is already in progress.");
+            }
+
+            previous = _snapshot;
+            published = Recalculate(_snapshot with
+            {
+                Activity = activity,
+                CodexHome = codexHome is null ? _snapshot.CodexHome : codexHome.Trim(),
+                SqliteHomeOverride = codexHome is null ? _snapshot.SqliteHomeOverride : NormalizeOptional(sqliteHomeOverride),
+                ErrorMessage = null
+            });
+            _snapshot = published;
+        }
+
+        NotifySnapshotChanged(published);
+        return previous;
+    }
+
+    private AppSnapshot UpdateEditable(Func<AppSnapshot, AppSnapshot> update)
+    {
+        ArgumentNullException.ThrowIfNull(update);
+        AppSnapshot published;
+        lock (_stateGate)
+        {
+            if (IsBusy(_snapshot.Activity))
+            {
+                throw new InvalidOperationException("Controller state cannot be edited while an operation is in progress.");
+            }
+
+            published = Recalculate(update(_snapshot));
+            _snapshot = published;
+        }
+
+        NotifySnapshotChanged(published);
+        return published;
+    }
+
+    private AppSnapshot Publish(AppSnapshot snapshot)
+    {
+        AppSnapshot published;
+        lock (_stateGate)
+        {
+            published = Recalculate(snapshot);
+            _snapshot = published;
+        }
+
+        NotifySnapshotChanged(published);
+        return published;
+    }
+
+    private void NotifySnapshotChanged(AppSnapshot snapshot)
+    {
+        Delegate[] handlers = SnapshotChanged?.GetInvocationList() ?? [];
+        foreach (Action<AppSnapshot> handler in handlers.Cast<Action<AppSnapshot>>())
+        {
+            try
+            {
+                handler(snapshot);
+            }
+            catch
+            {
+                // Observers must not corrupt controller state or leave an
+                // operation permanently busy.
+            }
+        }
+    }
+
+    private static AppSnapshot Recalculate(AppSnapshot snapshot)
+    {
+        string? selectedProviderId = NormalizeOptional(snapshot.SelectedProviderId);
+        IReadOnlyList<ProviderOptionState> providers = snapshot.Providers
+            .Select(option => option with
+            {
+                IsSelected = selectedProviderId is not null
+                    && string.Equals(option.Id, selectedProviderId, StringComparison.Ordinal)
+            })
+            .ToList()
+            .AsReadOnly();
+
+        bool busy = IsBusy(snapshot.Activity);
+        List<AppValidationIssue> issues = [];
+        if (busy)
+        {
+            issues.Add(AppValidationIssue.OperationInProgress);
+        }
+        if (snapshot.Activity == AppActivity.Faulted)
+        {
+            issues.Add(AppValidationIssue.RefreshFailed);
+        }
+        if (snapshot.Status is null)
+        {
+            issues.Add(AppValidationIssue.StatusUnavailable);
+        }
+        if (selectedProviderId is null)
+        {
+            issues.Add(AppValidationIssue.ProviderRequired);
+        }
+        if (snapshot.UpdateConfig
+            && snapshot.ModelMode == ModelMode.Custom
+            && string.IsNullOrWhiteSpace(snapshot.CustomModel))
+        {
+            issues.Add(AppValidationIssue.CustomModelRequired);
+        }
+        if (snapshot.Status?.SqliteAccess.Supported == false)
+        {
+            issues.Add(AppValidationIssue.SqliteUnsupported);
+        }
+
+        bool ready = snapshot.Activity == AppActivity.Ready && snapshot.Status is not null;
+        bool sqliteSupported = snapshot.Status?.SqliteAccess.Supported != false;
+        // Keep the existing WinForms behavior: provider/custom-model validation
+        // is shown when Execute is invoked rather than disabling the button.
+        AppControlAvailability controls = new(
+            RefreshEnabled: !busy && !string.IsNullOrWhiteSpace(snapshot.CodexHome),
+            ExecuteEnabled: ready && sqliteSupported,
+            ProviderSelectionEnabled: ready,
+            UpdateConfigEnabled: ready,
+            ModelModeEnabled: ready && snapshot.UpdateConfig,
+            CustomModelEnabled: ready && snapshot.UpdateConfig && snapshot.ModelMode == ModelMode.Custom);
+
+        return snapshot with
+        {
+            Providers = providers,
+            SelectedProviderId = selectedProviderId,
+            ValidationIssues = issues.AsReadOnly(),
+            Controls = controls
+        };
+    }
+
+    private static string? ResolveSelection(
+        string? preferredProviderId,
+        string? currentProviderId,
+        IReadOnlyList<ProviderOption> providers)
+    {
+        string? preferred = NormalizeOptional(preferredProviderId);
+        if (preferred is not null
+            && providers.Any(option => string.Equals(option.Id, preferred, StringComparison.Ordinal)))
+        {
+            return preferred;
+        }
+
+        string? current = NormalizeOptional(currentProviderId);
+        return current is not null
+            && providers.Any(option => string.Equals(option.Id, current, StringComparison.Ordinal))
+            ? current
+            : null;
+    }
+
+    private static bool IsBusy(AppActivity activity)
+    {
+        return activity is AppActivity.Initializing or AppActivity.Refreshing;
+    }
+
+    private static string? NormalizeOptional(string? value)
+    {
+        return string.IsNullOrWhiteSpace(value) ? null : value.Trim();
+    }
+}
diff --git a/desktop/CodexProviderSync.Application/AppControllerCommands.cs b/desktop/CodexProviderSync.Application/AppControllerCommands.cs
new file mode 100644
index 0000000..7e9f6e2
--- /dev/null
+++ b/desktop/CodexProviderSync.Application/AppControllerCommands.cs
@@ -0,0 +1,24 @@
+namespace CodexProviderSync.Application;
+
+public abstract record AppControllerCommand;
+
+public sealed record InitializeAppCommand : AppControllerCommand;
+
+public sealed record RefreshStatusCommand(
+    string CodexHome,
+    string? SqliteHomeOverride = null,
+    string? PreferredProviderId = null)
+    : AppControllerCommand;
+
+public sealed record SetStorageCommand(
+    string CodexHome,
+    string? SqliteHomeOverride = null)
+    : AppControllerCommand;
+
+public sealed record SelectProviderCommand(string? ProviderId) : AppControllerCommand;
+
+public sealed record SetUpdateConfigCommand(bool Enabled) : AppControllerCommand;
+
+public sealed record SetModelModeCommand(ModelMode Mode) : AppControllerCommand;
+
+public sealed record SetCustomModelCommand(string Value) : AppControllerCommand;
diff --git a/desktop/CodexProviderSync.Application/AppModels.cs b/desktop/CodexProviderSync.Application/AppModels.cs
new file mode 100644
index 0000000..c53299d
--- /dev/null
+++ b/desktop/CodexProviderSync.Application/AppModels.cs
@@ -0,0 +1,113 @@
+using CodexProviderSync.Core;
+using System.Text.Json.Serialization;
+
+namespace CodexProviderSync.Application;
+
+public enum AppActivity
+{
+    Uninitialized,
+    Initializing,
+    Refreshing,
+    Ready,
+    Faulted
+}
+
+public enum ModelMode
+{
+    FollowProvider,
+    KeepRootModel,
+    Custom
+}
+
+public enum AppValidationIssue
+{
+    OperationInProgress,
+    RefreshFailed,
+    StatusUnavailable,
+    ProviderRequired,
+    CustomModelRequired,
+    SqliteUnsupported
+}
+
+public sealed record ProviderOptionState(
+    string Id,
+    IReadOnlyList<ProviderSource> Sources,
+    bool IsCurrentProvider,
+    bool IsManual,
+    bool IsSaved,
+    bool IsSelected);
+
+public sealed record AppControlAvailability(
+    bool RefreshEnabled,
+    bool ExecuteEnabled,
+    bool ProviderSelectionEnabled,
+    bool UpdateConfigEnabled,
+    bool ModelModeEnabled,
+    bool CustomModelEnabled);
+
+public sealed record AppSnapshot
+{
+    internal AppSnapshot()
+    {
+    }
+
+    public AppActivity Activity { get; internal init; } = AppActivity.Uninitialized;
+    public string CodexHome { get; internal init; } = string.Empty;
+    public string? SqliteHomeOverride { get; internal init; }
+    public StatusSnapshot? Status { get; internal init; }
+    public IReadOnlyList<ProviderOptionState> Providers { get; internal init; } = [];
+    public string? SelectedProviderId { get; internal init; }
+    public bool UpdateConfig { get; internal init; }
+    public ModelMode ModelMode { get; internal init; } = ModelMode.FollowProvider;
+    public string CustomModel { get; internal init; } = string.Empty;
+    public IReadOnlyList<AppValidationIssue> ValidationIssues { get; internal init; } = [];
+    public AppControlAvailability Controls { get; internal init; } = new(
+        RefreshEnabled: false,
+        ExecuteEnabled: false,
+        ProviderSelectionEnabled: false,
+        UpdateConfigEnabled: false,
+        ModelModeEnabled: false,
+        CustomModelEnabled: false);
+    public string? ErrorMessage { get; internal init; }
+
+    public ProviderOptionState? SelectedProvider => Providers.FirstOrDefault(static option => option.IsSelected);
+
+    public bool HasIssue(AppValidationIssue issue) => ValidationIssues.Contains(issue);
+}
+
+public abstract record PreparedSyncRequest(
+    string CodexHome,
+    string? SqliteHomeOverride,
+    string ProviderId);
+
+public sealed record SyncProviderRequest(
+    string CodexHome,
+    string? SqliteHomeOverride,
+    string ProviderId)
+    : PreparedSyncRequest(CodexHome, SqliteHomeOverride, ProviderId);
+
+[JsonPolymorphic(TypeDiscriminatorPropertyName = "mode")]
+[JsonDerivedType(typeof(FollowProviderModelSelection), "followProvider")]
+[JsonDerivedType(typeof(KeepRootModelSelection), "keepRootModel")]
+[JsonDerivedType(typeof(CustomModelSelection), "custom")]
+public abstract record SwitchModelSelection;
+
+public sealed record FollowProviderModelSelection : SwitchModelSelection;
+
+public sealed record KeepRootModelSelection : SwitchModelSelection;
+
+public sealed record CustomModelSelection(string Model) : SwitchModelSelection;
+
+public sealed record SwitchProviderRequest(
+    string CodexHome,
+    string? SqliteHomeOverride,
+    string ProviderId,
+    SwitchModelSelection ModelSelection)
+    : PreparedSyncRequest(CodexHome, SqliteHomeOverride, ProviderId);
+
+public sealed record SyncRequestPreparation(
+    PreparedSyncRequest? Request,
+    IReadOnlyList<AppValidationIssue> ValidationIssues)
+{
+    public bool IsValid => Request is not null && ValidationIssues.Count == 0;
+}
diff --git a/desktop/CodexProviderSync.Application/ApplicationService.cs b/desktop/CodexProviderSync.Application/ApplicationService.cs
new file mode 100644
index 0000000..ff20254
--- /dev/null
+++ b/desktop/CodexProviderSync.Application/ApplicationService.cs
@@ -0,0 +1,954 @@
+using System.Security.Cryptography;
+using System.Text;
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.Application;
+
+public sealed class ApplicationService : IApplicationService
+{
+    private const string PlanLedgerCorruptionMessage =
+        "Durable plan-ledger evidence is corrupt. No further operation is authorized; inspect the retained evidence before retrying.";
+
+    private static readonly IReadOnlyList<string> SupportedCommands = Array.AsReadOnly(
+        new[] { "describe", "status", "plan", "sync", "switch", "restore", "prune" });
+
+    private readonly IApplicationStatusPort _statusPort;
+    private readonly IApplicationWritePort _writePort;
+    private readonly IApplicationPlanLedger _planLedger;
+    private readonly TimeProvider _timeProvider;
+    private readonly Func<string> _idFactory;
+    private readonly TimeSpan _planLifetime;
+    private int _operationInProgress;
+
+    public ApplicationService(
+        IApplicationStatusPort statusPort,
+        IApplicationWritePort writePort,
+        IApplicationPlanLedger planLedger,
+        TimeProvider? timeProvider = null,
+        Func<string>? idFactory = null,
+        TimeSpan? planLifetime = null)
+    {
+        _statusPort = statusPort ?? throw new ArgumentNullException(nameof(statusPort));
+        _writePort = writePort ?? throw new ArgumentNullException(nameof(writePort));
+        _planLedger = planLedger ?? throw new ArgumentNullException(nameof(planLedger));
+        _timeProvider = timeProvider ?? TimeProvider.System;
+        _idFactory = idFactory ?? (static () => Guid.NewGuid().ToString("N"));
+        _planLifetime = planLifetime ?? TimeSpan.FromMinutes(10);
+        if (_planLifetime <= TimeSpan.Zero)
+        {
+            throw new ArgumentOutOfRangeException(nameof(planLifetime), "Plan lifetime must be positive.");
+        }
+    }
+
+    public Task<ApplicationOutcome<ApplicationDescription>> DescribeAsync(
+        CancellationToken cancellationToken = default)
+    {
+        return RunExclusiveAsync(
+            ApplicationOperationKind.Describe,
+            (context, token) =>
+            {
+                token.ThrowIfCancellationRequested();
+                ApplicationDescription description = new(
+                    ApplicationProtocol.Version,
+                    SupportedCommands,
+                    WritesDefaultToDryRun: true,
+                    ExplicitApplyRequired: true,
+                    ExactPlanDigestRequired: true,
+                    PlansAreSingleUse: true);
+                return Task.FromResult(OperationResult<ApplicationDescription>.Succeeded(description));
+            },
+            cancellationToken);
+    }
+
+    public Task<ApplicationOutcome<StatusSnapshot>> GetStatusAsync(
+        ApplicationStatusRequest request,
+        CancellationToken cancellationToken = default)
+    {
+        return RunExclusiveAsync(
+            ApplicationOperationKind.Status,
+            async (context, token) =>
+            {
+                context.MoveTo(ApplicationOperationLifecycle.Validating);
+                ValidateStatusRequest(request);
+                StatusSnapshot status = await _statusPort.GetStatusAsync(
+                    Freeze(request),
+                    token);
+                return OperationResult<StatusSnapshot>.Succeeded(status);
+            },
+            cancellationToken);
+    }
+
+    public Task<ApplicationOutcome<ApplicationOperationPlan>> CreatePlanAsync(
+        CreateApplicationPlanRequest request,
+        CancellationToken cancellationToken = default)
+    {
+        return RunExclusiveAsync(
+            ApplicationOperationKind.Plan,
+            async (context, token) =>
+            {
+                if (request is null)
+                {
+                    throw new ApplicationRequestException("request_required", "A plan request is required.");
+                }
+
+                if (request.Intent is null)
+                {
+                    throw new ApplicationRequestException("intent_required", "A write intent is required.");
+                }
+
+                ApplicationOperationPlan plan = await CreatePlanCoreAsync(
+                    Freeze(request.Intent),
+                    context,
+                    token);
+                return OperationResult<ApplicationOperationPlan>.ReadyToApply(plan, plan.Warnings);
+            },
+            cancellationToken);
+    }
+
+    public Task<ApplicationOutcome<ApplicationWriteResult<SyncResult>>> SyncAsync(
+        SyncApplicationRequest request,
+        CancellationToken cancellationToken = default)
+    {
+        return RunWriteAsync<SyncIntent, SyncResult>(
+            ApplicationOperationKind.Sync,
+            request?.Intent,
+            request?.Authorization,
+            (intent, plan, operationId, token) => _writePort.ExecuteSyncAsync(
+                intent,
+                plan,
+                operationId,
+                token),
+            cancellationToken);
+    }
+
+    public Task<ApplicationOutcome<ApplicationWriteResult<SyncResult>>> SwitchAsync(
+        SwitchApplicationRequest request,
+        CancellationToken cancellationToken = default)
+    {
+        return RunWriteAsync<SwitchIntent, SyncResult>(
+            ApplicationOperationKind.Switch,
+            request?.Intent,
+            request?.Authorization,
+            (intent, plan, operationId, token) => _writePort.ExecuteSwitchAsync(
+                intent,
+                plan,
+                operationId,
+                token),
+            cancellationToken);
+    }
+
+    public Task<ApplicationOutcome<ApplicationWriteResult<RestoreResult>>> RestoreAsync(
+        RestoreApplicationRequest request,
+        CancellationToken cancellationToken = default)
+    {
+        return RunWriteAsync<RestoreIntent, RestoreResult>(
+            ApplicationOperationKind.Restore,
+            request?.Intent,
+            request?.Authorization,
+            (intent, plan, operationId, token) => _writePort.ExecuteRestoreAsync(
+                intent,
+                plan,
+                operationId,
+                token),
+            cancellationToken);
+    }
+
+    public Task<ApplicationOutcome<ApplicationWriteResult<BackupPruneResult>>> PruneAsync(
+        PruneApplicationRequest request,
+        CancellationToken cancellationToken = default)
+    {
+        return RunWriteAsync<PruneIntent, BackupPruneResult>(
+            ApplicationOperationKind.Prune,
+            request?.Intent,
+            request?.Authorization,
+            (intent, plan, operationId, token) => _writePort.ExecutePruneAsync(
+                intent,
+                plan,
+                operationId,
+                token),
+            cancellationToken);
+    }
+
+    private Task<ApplicationOutcome<ApplicationWriteResult<TResult>>> RunWriteAsync<TIntent, TResult>(
+        ApplicationOperationKind operation,
+        TIntent? intent,
+        ApplicationApplyAuthorization? authorization,
+        Func<TIntent, ApplicationOperationPlan, string, CancellationToken, Task<TResult>> execute,
+        CancellationToken cancellationToken)
+        where TIntent : ApplicationWriteIntent
+        where TResult : class
+    {
+        return RunExclusiveAsync(
+            operation,
+            async (context, token) =>
+            {
+                context.MoveTo(ApplicationOperationLifecycle.Validating);
+                if (intent is null)
+                {
+                    throw new ApplicationRequestException("request_required", "A write request is required.");
+                }
+
+                TIntent requestIntent = (TIntent)Freeze(intent);
+                ValidateIntent(requestIntent);
+                ApplicationApplyAuthorization apply = Freeze(authorization)
+                    ?? ApplicationApplyAuthorization.DryRun;
+                if (!apply.Apply)
+                {
+                    if (apply.Plan is not null || apply.PlanDigest is not null)
+                    {
+                        throw new ApplicationRequestException(
+                            "apply_required",
+                            "A supplied plan is only accepted when apply is explicitly enabled.");
+                    }
+
+                    ApplicationOperationPlan dryRunPlan = await CreatePlanCoreAsync(requestIntent, context, token);
+                    ApplicationWriteResult<TResult> dryRun = new(dryRunPlan, Applied: false, Result: null);
+                    return OperationResult<ApplicationWriteResult<TResult>>.ReadyToApply(
+                        dryRun,
+                        dryRunPlan.Warnings);
+                }
+
+                TIntent frozenIntent = NormalizeIntent(requestIntent);
+                ApplicationOperationPlan plan = ValidateApplyAuthorization(frozenIntent, apply);
+                if (_timeProvider.GetUtcNow() >= plan.ExpiresAtUtc)
+                {
+                    throw new ApplicationRequestException("plan_expired", "The supplied plan has expired.");
+                }
+
+                ApplicationPlanClaimResult claim = await _planLedger.TryClaimAsync(
+                    plan.PlanId,
+                    plan.Digest,
+                    token);
+                if (claim.Status != ApplicationPlanClaimStatus.Claimed)
+                {
+                    throw new ApplicationRequestException(
+                        claim.Status switch
+                        {
+                            ApplicationPlanClaimStatus.NotFound => "plan_not_registered",
+                            ApplicationPlanClaimStatus.DigestMismatch => "plan_digest_mismatch",
+                            ApplicationPlanClaimStatus.AlreadyUsed => "plan_already_used",
+                            _ => "plan_invalid"
+                        },
+                        "The supplied plan is unavailable, does not match, or has already been used.");
+                }
+
+                context.MoveTo(ApplicationOperationLifecycle.Applying);
+                try
+                {
+                    TResult result = await execute(frozenIntent, plan, context.OperationId, token);
+                    ApplicationWarning? ledgerWarning = await TryCompletePlanAsync(
+                        plan.PlanId,
+                        ApplicationOperationLifecycle.Succeeded);
+                    IReadOnlyList<ApplicationWarning> warnings = ledgerWarning is null
+                        ? plan.Warnings
+                        : Array.AsReadOnly(plan.Warnings.Concat([ledgerWarning]).ToArray());
+                    return OperationResult<ApplicationWriteResult<TResult>>.Succeeded(
+                        new ApplicationWriteResult<TResult>(plan, Applied: true, result),
+                        warnings);
+                }
+                catch (ApplicationPlanLedgerCorruptionException)
+                {
+                    // Further ledger transitions cannot be trusted after
+                    // corruption is observed. Preserve the original evidence
+                    // and let the outer boundary return a recovery outcome.
+                    throw;
+                }
+                catch (OperationCanceledException)
+                {
+                    await TryCompletePlanAsync(plan.PlanId, ApplicationOperationLifecycle.Cancelled);
+                    throw;
+                }
+                catch (SyncTransactionException error) when (error.WasCanceled && !error.RecoveryRequired)
+                {
+                    await TryCompletePlanAsync(plan.PlanId, ApplicationOperationLifecycle.Cancelled);
+                    throw;
+                }
+                catch (ApplicationPortException error) when (
+                    !error.RecoveryRequired
+                    && (error.Code == "target_busy"
+                        || error.Code.StartsWith("plan_", StringComparison.Ordinal)))
+                {
+                    await TryCompletePlanAsync(plan.PlanId, ApplicationOperationLifecycle.Rejected);
+                    throw;
+                }
+                catch (Exception error)
+                {
+                    ApplicationOperationLifecycle terminal = IsRecoveryRequired(error)
+                        ? ApplicationOperationLifecycle.RecoveryRequired
+                        : ApplicationOperationLifecycle.Failed;
+                    await TryCompletePlanAsync(plan.PlanId, terminal);
+                    throw;
+                }
+            },
+            cancellationToken);
+    }
+
+    private async Task<ApplicationOperationPlan> CreatePlanCoreAsync(
+        ApplicationWriteIntent intent,
+        OperationContext context,
+        CancellationToken cancellationToken)
+    {
+        context.MoveTo(ApplicationOperationLifecycle.Validating);
+        intent = NormalizeIntent(intent);
+        ValidateIntent(intent);
+        context.MoveTo(ApplicationOperationLifecycle.Planning);
+        ApplicationPlanPreview preview = await _writePort.CreatePlanAsync(
+            intent,
+            context.OperationId,
+            cancellationToken);
+        ValidatePreview(intent.Kind, preview);
+
+        DateTimeOffset createdAt = _timeProvider.GetUtcNow();
+        IReadOnlyList<ApplicationPlanTarget> targets = preview.Targets
+            .Select(static target => target with { })
+            .OrderBy(static target => target.Path, StringComparer.Ordinal)
+            .ThenBy(static target => target.Action, StringComparer.Ordinal)
+            .ThenBy(static target => target.Fingerprint, StringComparer.Ordinal)
+            .ToList()
+            .AsReadOnly();
+        IReadOnlyList<ApplicationWarning> warnings = (preview.Warnings ?? [])
+            .Select(static warning => warning with { })
+            .ToList()
+            .AsReadOnly();
+        IReadOnlyList<ApplicationPlanTarget> autoPruneTargets = (preview.AutoPruneDeletionTargets ?? [])
+            .Select(static target => target with { })
+            .OrderBy(static target => target.Path, StringComparer.Ordinal)
+            .ThenBy(static target => target.Action, StringComparer.Ordinal)
+            .ThenBy(static target => target.Fingerprint, StringComparer.Ordinal)
+            .ToList()
+            .AsReadOnly();
+        ApplicationOperationPlan unsigned = new(
+            ApplicationProtocol.Version,
+            NewId(),
+            context.OperationId,
+            createdAt,
+            createdAt.Add(_planLifetime),
+            Freeze(preview.NormalizedIntent),
+            preview.StateFingerprint,
+            preview.ExecutionToken,
+            targets,
+            autoPruneTargets,
+            warnings,
+            Digest: string.Empty);
+        ApplicationOperationPlan plan = unsigned with { Digest = ComputeDigest(unsigned) };
+        await _planLedger.RegisterAsync(plan, cancellationToken);
+        context.MoveTo(ApplicationOperationLifecycle.ReadyToApply);
+        return plan;
+    }
+
+    private TIntent NormalizeIntent<TIntent>(TIntent intent)
+        where TIntent : ApplicationWriteIntent
+    {
+        ApplicationWriteIntent normalized = _writePort.NormalizeIntent(Freeze(intent));
+        if (normalized is not TIntent typed || normalized.Kind != intent.Kind)
+        {
+            throw new ApplicationPortException(
+                "invalid_normalized_intent",
+                "Core returned a mismatched normalized write intent.");
+        }
+        return (TIntent)Freeze(typed);
+    }
+
+    private ApplicationWriteIntent NormalizeIntent(ApplicationWriteIntent intent)
+    {
+        ApplicationWriteIntent normalized = _writePort.NormalizeIntent(Freeze(intent));
+        if (normalized is null || normalized.Kind != intent.Kind)
+        {
+            throw new ApplicationPortException(
+                "invalid_normalized_intent",
+                "Core returned a mismatched normalized write intent.");
+        }
+        return Freeze(normalized);
+    }
+
+    private ApplicationOperationPlan ValidateApplyAuthorization(
+        ApplicationWriteIntent intent,
+        ApplicationApplyAuthorization authorization)
+    {
+        if (authorization.Plan is null || string.IsNullOrWhiteSpace(authorization.PlanDigest))
+        {
+            throw new ApplicationRequestException(
+                "plan_required",
+                "Explicit apply requires both the plan document and its exact digest.");
+        }
+
+        ApplicationOperationPlan plan = authorization.Plan;
+        if (!string.Equals(plan.ProtocolVersion, ApplicationProtocol.Version, StringComparison.Ordinal))
+        {
+            throw new ApplicationRequestException("plan_version_mismatch", "The plan protocol version is not supported.");
+        }
+        if (plan.Intent != intent || plan.Intent.Kind != intent.Kind)
+        {
+            throw new ApplicationRequestException("plan_input_mismatch", "The supplied plan does not match the request inputs.");
+        }
+
+        string computedDigest = ComputeDigest(plan);
+        if (!FixedTimeEquals(plan.Digest, computedDigest)
+            || !FixedTimeEquals(authorization.PlanDigest, plan.Digest))
+        {
+            throw new ApplicationRequestException("plan_digest_mismatch", "The supplied plan digest is invalid.");
+        }
+
+        return plan;
+    }
+
+    private async Task<ApplicationWarning?> TryCompletePlanAsync(
+        string planId,
+        ApplicationOperationLifecycle lifecycle)
+    {
+        try
+        {
+            // Claiming makes the plan non-reusable. Completion is audit state
+            // and must still be attempted after caller cancellation.
+            await _planLedger.CompleteAsync(planId, lifecycle, CancellationToken.None);
+            return null;
+        }
+        catch (ApplicationPlanLedgerCorruptionException)
+        {
+            // Corruption is not an optional audit-write failure. The plan's
+            // single-use state can no longer be trusted, so surface it through
+            // the fail-closed structured outcome below.
+            throw;
+        }
+        catch (Exception error)
+        {
+            return new ApplicationWarning(
+                "plan_ledger_completion_failed",
+                $"The plan remains consumed, but its terminal audit state could not be recorded: {error.Message}");
+        }
+    }
+
+    private async Task<ApplicationOutcome<T>> RunExclusiveAsync<T>(
+        ApplicationOperationKind operation,
+        Func<OperationContext, CancellationToken, Task<OperationResult<T>>> run,
+        CancellationToken cancellationToken)
+        where T : class
+    {
+        string operationId = NewId();
+        DateTimeOffset startedAt = _timeProvider.GetUtcNow();
+        OperationContext context = new(operationId, startedAt, _timeProvider);
+        if (Interlocked.CompareExchange(ref _operationInProgress, 1, 0) != 0)
+        {
+            context.MoveTo(ApplicationOperationLifecycle.Rejected);
+            return BuildOutcome<T>(
+                operation,
+                context,
+                ApplicationOperationLifecycle.Rejected,
+                null,
+                [],
+                [new ApplicationError("operation_busy", "Another Application operation is already in progress.")]);
+        }
+
+        try
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            OperationResult<T> result = await run(context, cancellationToken);
+            context.MoveTo(result.Lifecycle);
+            return BuildOutcome(
+                operation,
+                context,
+                result.Lifecycle,
+                result.Data,
+                result.Warnings,
+                []);
+        }
+        catch (ApplicationRequestException error)
+        {
+            context.MoveTo(ApplicationOperationLifecycle.Rejected);
+            return BuildOutcome<T>(
+                operation,
+                context,
+                ApplicationOperationLifecycle.Rejected,
+                null,
+                [],
+                [new ApplicationError(error.Code, error.Message)]);
+        }
+        catch (ApplicationPlanLedgerCorruptionException error)
+        {
+            context.MoveTo(ApplicationOperationLifecycle.RecoveryRequired);
+            return BuildOutcome<T>(
+                operation,
+                context,
+                ApplicationOperationLifecycle.RecoveryRequired,
+                null,
+                [],
+                [new ApplicationError(
+                    error.Code,
+                    PlanLedgerCorruptionMessage,
+                    RecoveryRequired: true,
+                    EvidencePath: error.EvidencePath)]);
+        }
+        catch (SyncTransactionException error) when (error.WasCanceled && !error.RecoveryRequired)
+        {
+            context.MoveTo(ApplicationOperationLifecycle.Cancelled);
+            return BuildOutcome<T>(
+                operation,
+                context,
+                ApplicationOperationLifecycle.Cancelled,
+                null,
+                [],
+                [new ApplicationError("cancelled", error.Message, RollbackStatus: error.RollbackStatus)]);
+        }
+        catch (OperationCanceledException error)
+        {
+            context.MoveTo(ApplicationOperationLifecycle.Cancelled);
+            return BuildOutcome<T>(
+                operation,
+                context,
+                ApplicationOperationLifecycle.Cancelled,
+                null,
+                [],
+                [new ApplicationError("cancelled", error.Message)]);
+        }
+        catch (SyncTransactionException error)
+        {
+            ApplicationOperationLifecycle lifecycle = error.RecoveryRequired
+                ? ApplicationOperationLifecycle.RecoveryRequired
+                : ApplicationOperationLifecycle.Failed;
+            context.MoveTo(lifecycle);
+            return BuildOutcome<T>(
+                operation,
+                context,
+                lifecycle,
+                null,
+                [],
+                [new ApplicationError(
+                    error.Code.ToLowerInvariant(),
+                    error.Message,
+                    error.RecoveryRequired,
+                    error.RollbackStatus)]);
+        }
+        catch (RecoveryRequiredException error)
+        {
+            context.MoveTo(ApplicationOperationLifecycle.RecoveryRequired);
+            return BuildOutcome<T>(
+                operation,
+                context,
+                ApplicationOperationLifecycle.RecoveryRequired,
+                null,
+                [],
+                [new ApplicationError("recovery_required", error.Message, RecoveryRequired: true)]);
+        }
+        catch (ApplicationPortException error)
+        {
+            ApplicationOperationLifecycle lifecycle = error.RecoveryRequired
+                ? ApplicationOperationLifecycle.RecoveryRequired
+                : error.Code == "target_busy"
+                    || error.Code.StartsWith("plan_", StringComparison.Ordinal)
+                        ? ApplicationOperationLifecycle.Rejected
+                        : ApplicationOperationLifecycle.Failed;
+            context.MoveTo(lifecycle);
+            return BuildOutcome<T>(
+                operation,
+                context,
+                lifecycle,
+                null,
+                [],
+                [new ApplicationError(
+                    error.Code,
+                    error.Message,
+                    error.RecoveryRequired,
+                    error.RollbackStatus)]);
+        }
+        catch (Exception error)
+        {
+            context.MoveTo(ApplicationOperationLifecycle.Failed);
+            return BuildOutcome<T>(
+                operation,
+                context,
+                ApplicationOperationLifecycle.Failed,
+                null,
+                [],
+                [new ApplicationError("operation_failed", error.Message)]);
+        }
+        finally
+        {
+            Volatile.Write(ref _operationInProgress, 0);
+        }
+    }
+
+    private ApplicationOutcome<T> BuildOutcome<T>(
+        ApplicationOperationKind operation,
+        OperationContext context,
+        ApplicationOperationLifecycle lifecycle,
+        T? data,
+        IReadOnlyList<ApplicationWarning> warnings,
+        IReadOnlyList<ApplicationError> errors)
+        where T : class
+    {
+        return new ApplicationOutcome<T>(
+            context.OperationId,
+            operation,
+            lifecycle,
+            context.StartedAtUtc,
+            _timeProvider.GetUtcNow(),
+            data,
+            warnings.Select(static warning => warning with { }).ToList().AsReadOnly(),
+            errors.Select(static error => error with { }).ToList().AsReadOnly(),
+            context.Timeline);
+    }
+
+    private static void ValidateStatusRequest(ApplicationStatusRequest? request)
+    {
+        if (request is null)
+        {
+            throw new ApplicationRequestException("request_required", "A status request is required.");
+        }
+        if (string.IsNullOrWhiteSpace(request.CodexHome))
+        {
+            throw new ApplicationRequestException("codex_home_required", "Codex Home is required.");
+        }
+    }
+
+    private static void ValidateIntent(ApplicationWriteIntent? intent)
+    {
+        if (intent is null)
+        {
+            throw new ApplicationRequestException("intent_required", "A write intent is required.");
+        }
+        if (string.IsNullOrWhiteSpace(intent.CodexHome))
+        {
+            throw new ApplicationRequestException("codex_home_required", "Codex Home is required.");
+        }
+
+        switch (intent)
+        {
+            case SyncIntent sync when string.IsNullOrWhiteSpace(sync.ProviderId):
+                throw new ApplicationRequestException("provider_required", "A provider id is required.");
+            case SyncIntent sync when sync.BackupRetentionCount < 1:
+                throw new ApplicationRequestException("retention_invalid", "Backup retention must be at least one.");
+            case SwitchIntent change when string.IsNullOrWhiteSpace(change.ProviderId):
+                throw new ApplicationRequestException("provider_required", "A provider id is required.");
+            case SwitchIntent change when change.ModelSelection is null:
+                throw new ApplicationRequestException("model_selection_required", "A switch model selection is required.");
+            case SwitchIntent change when change.ModelSelection is CustomModelSelection custom
+                && string.IsNullOrWhiteSpace(custom.Model):
+                throw new ApplicationRequestException("custom_model_required", "A custom model is required.");
+            case SwitchIntent change when change.BackupRetentionCount < 1:
+                throw new ApplicationRequestException("retention_invalid", "Backup retention must be at least one.");
+            case RestoreIntent restore when string.IsNullOrWhiteSpace(restore.BackupDirectory):
+                throw new ApplicationRequestException("backup_required", "A backup directory is required.");
+            case RestoreIntent restore when !restore.RestoreConfig
+                && !restore.RestoreDatabase
+                && !restore.RestoreSessions:
+                throw new ApplicationRequestException("restore_selection_required", "At least one restore target is required.");
+            case PruneIntent prune when prune.BackupRetentionCount < 1:
+                throw new ApplicationRequestException("retention_invalid", "Backup retention must be at least one.");
+        }
+    }
+
+    private static void ValidatePreview(ApplicationWriteKind expectedKind, ApplicationPlanPreview? preview)
+    {
+        if (preview is null
+            || preview.NormalizedIntent is null
+            || preview.NormalizedIntent.Kind != expectedKind
+            || string.IsNullOrWhiteSpace(preview.StateFingerprint)
+            || string.IsNullOrWhiteSpace(preview.ExecutionToken))
+        {
+            throw new ApplicationPortException(
+                "invalid_plan_preview",
+                "Core returned an incomplete or mismatched plan preview.");
+        }
+        if (preview.Targets is null
+            || preview.Targets.Any(static target =>
+                target is null
+                || string.IsNullOrWhiteSpace(target.Path)
+                || string.IsNullOrWhiteSpace(target.Action)
+                || string.IsNullOrWhiteSpace(target.Fingerprint)))
+        {
+            throw new ApplicationPortException(
+                "invalid_plan_targets",
+                "Core returned an invalid plan target.");
+        }
+        if (preview.Targets
+            .GroupBy(static target => (target.Path, target.Action))
+            .Any(static group => group.Count() > 1))
+        {
+            throw new ApplicationPortException(
+                "duplicate_plan_target",
+                "Core returned a duplicate plan target.");
+        }
+        if (preview.AutoPruneDeletionTargets is not null
+            && preview.AutoPruneDeletionTargets.Any(static target =>
+                target is null
+                || string.IsNullOrWhiteSpace(target.Path)
+                || !string.Equals(target.Action, "delete", StringComparison.Ordinal)
+                || string.IsNullOrWhiteSpace(target.Fingerprint)))
+        {
+            throw new ApplicationPortException(
+                "invalid_auto_prune_targets",
+                "Core returned an invalid automatic-prune target.");
+        }
+        if (preview.AutoPruneDeletionTargets is not null
+            && preview.AutoPruneDeletionTargets
+                .GroupBy(static target => target.Path, StringComparer.Ordinal)
+                .Any(static group => group.Count() > 1))
+        {
+            throw new ApplicationPortException(
+                "duplicate_auto_prune_target",
+                "Core returned a duplicate automatic-prune target.");
+        }
+        if (preview.Warnings is not null
+            && preview.Warnings.Any(static warning =>
+                warning is null
+                || string.IsNullOrWhiteSpace(warning.Code)
+                || string.IsNullOrWhiteSpace(warning.Message)))
+        {
+            throw new ApplicationPortException(
+                "invalid_plan_warning",
+                "Core returned an invalid plan warning.");
+        }
+    }
+
+    private static ApplicationStatusRequest Freeze(ApplicationStatusRequest request)
+    {
+        return new ApplicationStatusRequest(request.CodexHome, request.SqliteHomeOverride);
+    }
+
+    private static ApplicationApplyAuthorization? Freeze(ApplicationApplyAuthorization? authorization)
+    {
+        return authorization is null
+            ? null
+            : new ApplicationApplyAuthorization(
+                authorization.Apply,
+                authorization.Plan is null ? null : Freeze(authorization.Plan),
+                authorization.PlanDigest);
+    }
+
+    private static ApplicationOperationPlan Freeze(ApplicationOperationPlan plan)
+    {
+        return plan with
+        {
+            Intent = plan.Intent is null
+                ? throw new ApplicationRequestException("plan_invalid", "The supplied plan has no intent.")
+                : Freeze(plan.Intent),
+            Targets = (plan.Targets ?? [])
+                .Select(static target => target with { })
+                .ToList()
+                .AsReadOnly(),
+            AutoPruneDeletionTargets = (plan.AutoPruneDeletionTargets ?? [])
+                .Select(static target => target with { })
+                .ToList()
+                .AsReadOnly(),
+            Warnings = (plan.Warnings ?? [])
+                .Select(static warning => warning with { })
+                .ToList()
+                .AsReadOnly()
+        };
+    }
+
+    private static ApplicationWriteIntent Freeze(ApplicationWriteIntent intent)
+    {
+        ArgumentNullException.ThrowIfNull(intent);
+        return intent switch
+        {
+            SyncIntent sync => sync with { },
+            SwitchIntent change => change with
+            {
+                ModelSelection = change.ModelSelection switch
+                {
+                    CustomModelSelection custom => custom with { },
+                    FollowProviderModelSelection follow => follow with { },
+                    KeepRootModelSelection keep => keep with { },
+                    null => null!,
+                    _ => throw new ArgumentOutOfRangeException(nameof(intent), "Unknown model selection.")
+                }
+            },
+            RestoreIntent restore => restore with { },
+            PruneIntent prune => prune with { },
+            _ => throw new ArgumentOutOfRangeException(nameof(intent), "Unknown write intent.")
+        };
+    }
+
+    private string NewId()
+    {
+        string id = _idFactory();
+        if (string.IsNullOrWhiteSpace(id))
+        {
+            throw new InvalidOperationException("The operation id factory returned an empty id.");
+        }
+        return id;
+    }
+
+    private static bool IsRecoveryRequired(Exception error)
+    {
+        return error is ApplicationPlanLedgerCorruptionException
+            || error is RecoveryRequiredException
+            || error is SyncTransactionException { RecoveryRequired: true }
+            || error is ApplicationPortException { RecoveryRequired: true };
+    }
+
+    private static bool FixedTimeEquals(string left, string right)
+    {
+        byte[] leftBytes = Encoding.UTF8.GetBytes(left);
+        byte[] rightBytes = Encoding.UTF8.GetBytes(right);
+        return leftBytes.Length == rightBytes.Length
+            && CryptographicOperations.FixedTimeEquals(leftBytes, rightBytes);
+    }
+
+    internal static string ComputeDigest(ApplicationOperationPlan plan)
+    {
+        StringBuilder canonical = new();
+        Append(canonical, "protocolVersion", plan.ProtocolVersion);
+        Append(canonical, "planId", plan.PlanId);
+        Append(canonical, "createdByOperationId", plan.CreatedByOperationId);
+        Append(canonical, "createdAtUtc", plan.CreatedAtUtc.ToUniversalTime().ToString("O"));
+        Append(canonical, "expiresAtUtc", plan.ExpiresAtUtc.ToUniversalTime().ToString("O"));
+        AppendIntent(canonical, plan.Intent);
+        Append(canonical, "stateFingerprint", plan.StateFingerprint);
+        Append(canonical, "executionToken", plan.ExecutionToken);
+
+        foreach (ApplicationPlanTarget target in plan.Targets
+                     .OrderBy(static item => item.Path, StringComparer.Ordinal)
+                     .ThenBy(static item => item.Action, StringComparer.Ordinal)
+                     .ThenBy(static item => item.Fingerprint, StringComparer.Ordinal))
+        {
+            Append(canonical, "target.path", target.Path);
+            Append(canonical, "target.action", target.Action);
+            Append(canonical, "target.fingerprint", target.Fingerprint);
+        }
+        foreach (ApplicationPlanTarget target in plan.AutoPruneDeletionTargets
+                     .OrderBy(static item => item.Path, StringComparer.Ordinal)
+                     .ThenBy(static item => item.Action, StringComparer.Ordinal)
+                     .ThenBy(static item => item.Fingerprint, StringComparer.Ordinal))
+        {
+            Append(canonical, "autoPruneTarget.path", target.Path);
+            Append(canonical, "autoPruneTarget.action", target.Action);
+            Append(canonical, "autoPruneTarget.fingerprint", target.Fingerprint);
+        }
+        foreach (ApplicationWarning warning in plan.Warnings
+                     .OrderBy(static item => item.Code, StringComparer.Ordinal)
+                     .ThenBy(static item => item.Message, StringComparer.Ordinal))
+        {
+            Append(canonical, "warning.code", warning.Code);
+            Append(canonical, "warning.message", warning.Message);
+        }
+
+        return Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(canonical.ToString())))
+            .ToLowerInvariant();
+    }
+
+    private static void AppendIntent(StringBuilder canonical, ApplicationWriteIntent intent)
+    {
+        Append(canonical, "intent.kind", intent.Kind switch
+        {
+            ApplicationWriteKind.Sync => "sync",
+            ApplicationWriteKind.Switch => "switch",
+            ApplicationWriteKind.Restore => "restore",
+            ApplicationWriteKind.Prune => "prune",
+            _ => throw new ArgumentOutOfRangeException(nameof(intent), "Unknown write kind.")
+        });
+        Append(canonical, "intent.codexHome", intent.CodexHome);
+        Append(canonical, "intent.sqliteHomeOverride", intent.SqliteHomeOverride);
+        switch (intent)
+        {
+            case SyncIntent sync:
+                Append(canonical, "intent.providerId", sync.ProviderId);
+                Append(canonical, "intent.backupRetentionCount", sync.BackupRetentionCount.ToString(System.Globalization.CultureInfo.InvariantCulture));
+                break;
+            case SwitchIntent change:
+                Append(canonical, "intent.providerId", change.ProviderId);
+                Append(canonical, "intent.backupRetentionCount", change.BackupRetentionCount.ToString(System.Globalization.CultureInfo.InvariantCulture));
+                switch (change.ModelSelection)
+                {
+                    case FollowProviderModelSelection:
+                        Append(canonical, "intent.modelMode", "followProvider");
+                        break;
+                    case KeepRootModelSelection:
+                        Append(canonical, "intent.modelMode", "keepRootModel");
+                        break;
+                    case CustomModelSelection custom:
+                        Append(canonical, "intent.modelMode", "custom");
+                        Append(canonical, "intent.model", custom.Model);
+                        break;
+                    default:
+                        Append(canonical, "intent.modelMode", null);
+                        break;
+                }
+                break;
+            case RestoreIntent restore:
+                Append(canonical, "intent.backupDirectory", restore.BackupDirectory);
+                Append(canonical, "intent.restoreConfig", restore.RestoreConfig ? "true" : "false");
+                Append(canonical, "intent.restoreDatabase", restore.RestoreDatabase ? "true" : "false");
+                Append(canonical, "intent.restoreSessions", restore.RestoreSessions ? "true" : "false");
+                Append(canonical, "intent.allowSqliteHomeRelocation", restore.AllowSqliteHomeRelocation ? "true" : "false");
+                break;
+            case PruneIntent prune:
+                Append(canonical, "intent.backupRetentionCount", prune.BackupRetentionCount.ToString(System.Globalization.CultureInfo.InvariantCulture));
+                break;
+        }
+    }
+
+    private static void Append(StringBuilder canonical, string key, string? value)
+    {
+        canonical.Append(key.Length).Append(':').Append(key).Append('=');
+        if (value is null)
+        {
+            canonical.Append("-1:");
+        }
+        else
+        {
+            canonical.Append(value.Length).Append(':').Append(value);
+        }
+        canonical.Append(';');
+    }
+
+    private sealed class OperationContext(
+        string operationId,
+        DateTimeOffset startedAtUtc,
+        TimeProvider timeProvider)
+    {
+        private readonly List<ApplicationLifecycleEvent> _timeline =
+            [new(ApplicationOperationLifecycle.Accepted, startedAtUtc)];
+
+        public string OperationId { get; } = operationId;
+
+        public DateTimeOffset StartedAtUtc { get; } = startedAtUtc;
+
+        public IReadOnlyList<ApplicationLifecycleEvent> Timeline => _timeline
+            .Select(static item => item with { })
+            .ToList()
+            .AsReadOnly();
+
+        public void MoveTo(ApplicationOperationLifecycle lifecycle)
+        {
+            if (_timeline[^1].Lifecycle != lifecycle)
+            {
+                _timeline.Add(new ApplicationLifecycleEvent(lifecycle, timeProvider.GetUtcNow()));
+            }
+        }
+    }
+
+    private sealed record OperationResult<T>(
+        T Data,
+        ApplicationOperationLifecycle Lifecycle,
+        IReadOnlyList<ApplicationWarning> Warnings)
+        where T : class
+    {
+        public static OperationResult<T> Succeeded(
+            T data,
+            IReadOnlyList<ApplicationWarning>? warnings = null)
+        {
+            return new OperationResult<T>(
+                data,
+                ApplicationOperationLifecycle.Succeeded,
+                warnings ?? []);
+        }
+
+        public static OperationResult<T> ReadyToApply(
+            T data,
+            IReadOnlyList<ApplicationWarning>? warnings = null)
+        {
+            return new OperationResult<T>(
+                data,
+                ApplicationOperationLifecycle.ReadyToApply,
+                warnings ?? []);
+        }
+    }
+
+    private sealed class ApplicationRequestException(string code, string message)
+        : InvalidOperationException(message)
+    {
+        public string Code { get; } = code;
+    }
+}
diff --git a/desktop/CodexProviderSync.Application/ApplicationUseCaseContracts.cs b/desktop/CodexProviderSync.Application/ApplicationUseCaseContracts.cs
new file mode 100644
index 0000000..18b3c04
--- /dev/null
+++ b/desktop/CodexProviderSync.Application/ApplicationUseCaseContracts.cs
@@ -0,0 +1,240 @@
+using CodexProviderSync.Core;
+using System.Text.Json.Serialization;
+
+namespace CodexProviderSync.Application;
+
+public static class ApplicationProtocol
+{
+    public const string Version = "0.4";
+}
+
+public enum ApplicationOperationKind
+{
+    Describe,
+    Status,
+    Plan,
+    Sync,
+    Switch,
+    Restore,
+    Prune
+}
+
+public enum ApplicationWriteKind
+{
+    Sync,
+    Switch,
+    Restore,
+    Prune
+}
+
+public enum ApplicationOperationLifecycle
+{
+    Accepted,
+    Validating,
+    Planning,
+    ReadyToApply,
+    Applying,
+    Succeeded,
+    Failed,
+    Cancelled,
+    Rejected,
+    RecoveryRequired
+}
+
+public sealed record ApplicationLifecycleEvent(
+    ApplicationOperationLifecycle Lifecycle,
+    DateTimeOffset TimestampUtc);
+
+public sealed record ApplicationWarning(string Code, string Message);
+
+public sealed record ApplicationError(
+    string Code,
+    string Message,
+    bool RecoveryRequired = false,
+    string? RollbackStatus = null,
+    string? EvidencePath = null);
+
+public sealed record ApplicationOutcome<T>(
+    string OperationId,
+    ApplicationOperationKind Operation,
+    ApplicationOperationLifecycle Lifecycle,
+    DateTimeOffset StartedAtUtc,
+    DateTimeOffset CompletedAtUtc,
+    T? Data,
+    IReadOnlyList<ApplicationWarning> Warnings,
+    IReadOnlyList<ApplicationError> Errors,
+    IReadOnlyList<ApplicationLifecycleEvent> Timeline)
+    where T : class
+{
+    public bool IsSuccess => Lifecycle is
+        ApplicationOperationLifecycle.Succeeded or
+        ApplicationOperationLifecycle.ReadyToApply;
+}
+
+public sealed record ApplicationDescription(
+    string ProtocolVersion,
+    IReadOnlyList<string> Commands,
+    bool WritesDefaultToDryRun,
+    bool ExplicitApplyRequired,
+    bool ExactPlanDigestRequired,
+    bool PlansAreSingleUse);
+
+public sealed record ApplicationStatusRequest(
+    string CodexHome,
+    string? SqliteHomeOverride = null);
+
+[JsonPolymorphic(TypeDiscriminatorPropertyName = "kind")]
+[JsonDerivedType(typeof(SyncIntent), "sync")]
+[JsonDerivedType(typeof(SwitchIntent), "switch")]
+[JsonDerivedType(typeof(RestoreIntent), "restore")]
+[JsonDerivedType(typeof(PruneIntent), "prune")]
+public abstract record ApplicationWriteIntent(
+    string CodexHome,
+    string? SqliteHomeOverride)
+{
+    [JsonIgnore]
+    public abstract ApplicationWriteKind Kind { get; }
+}
+
+public sealed record SyncIntent(
+    string CodexHome,
+    string? SqliteHomeOverride,
+    string ProviderId,
+    int BackupRetentionCount = AppConstants.DefaultBackupRetentionCount)
+    : ApplicationWriteIntent(CodexHome, SqliteHomeOverride)
+{
+    [JsonIgnore]
+    public override ApplicationWriteKind Kind => ApplicationWriteKind.Sync;
+}
+
+public sealed record SwitchIntent(
+    string CodexHome,
+    string? SqliteHomeOverride,
+    string ProviderId,
+    SwitchModelSelection ModelSelection,
+    int BackupRetentionCount = AppConstants.DefaultBackupRetentionCount)
+    : ApplicationWriteIntent(CodexHome, SqliteHomeOverride)
+{
+    [JsonIgnore]
+    public override ApplicationWriteKind Kind => ApplicationWriteKind.Switch;
+}
+
+public sealed record RestoreIntent(
+    string CodexHome,
+    string? SqliteHomeOverride,
+    string BackupDirectory,
+    bool RestoreConfig = true,
+    bool RestoreDatabase = true,
+    bool RestoreSessions = true,
+    bool AllowSqliteHomeRelocation = false)
+    : ApplicationWriteIntent(CodexHome, SqliteHomeOverride)
+{
+    [JsonIgnore]
+    public override ApplicationWriteKind Kind => ApplicationWriteKind.Restore;
+}
+
+public sealed record PruneIntent(
+    string CodexHome,
+    string? SqliteHomeOverride,
+    int BackupRetentionCount = AppConstants.DefaultBackupRetentionCount)
+    : ApplicationWriteIntent(CodexHome, SqliteHomeOverride)
+{
+    [JsonIgnore]
+    public override ApplicationWriteKind Kind => ApplicationWriteKind.Prune;
+}
+
+public sealed record CreateApplicationPlanRequest(ApplicationWriteIntent Intent);
+
+public sealed record ApplicationPlanTarget(
+    string Path,
+    string Action,
+    string Fingerprint);
+
+public sealed record ApplicationPlanPreview(
+    ApplicationWriteIntent NormalizedIntent,
+    string StateFingerprint,
+    string ExecutionToken,
+    IReadOnlyList<ApplicationPlanTarget> Targets,
+    IReadOnlyList<ApplicationPlanTarget>? AutoPruneDeletionTargets = null,
+    IReadOnlyList<ApplicationWarning>? Warnings = null);
+
+public sealed record ApplicationOperationPlan(
+    string ProtocolVersion,
+    string PlanId,
+    string CreatedByOperationId,
+    DateTimeOffset CreatedAtUtc,
+    DateTimeOffset ExpiresAtUtc,
+    ApplicationWriteIntent Intent,
+    string StateFingerprint,
+    string ExecutionToken,
+    IReadOnlyList<ApplicationPlanTarget> Targets,
+    IReadOnlyList<ApplicationPlanTarget> AutoPruneDeletionTargets,
+    IReadOnlyList<ApplicationWarning> Warnings,
+    string Digest);
+
+public sealed record ApplicationApplyAuthorization(
+    bool Apply = false,
+    ApplicationOperationPlan? Plan = null,
+    string? PlanDigest = null)
+{
+    public static ApplicationApplyAuthorization DryRun { get; } = new();
+}
+
+public sealed record SyncApplicationRequest(
+    SyncIntent Intent,
+    ApplicationApplyAuthorization? Authorization = null);
+
+public sealed record SwitchApplicationRequest(
+    SwitchIntent Intent,
+    ApplicationApplyAuthorization? Authorization = null);
+
+public sealed record RestoreApplicationRequest(
+    RestoreIntent Intent,
+    ApplicationApplyAuthorization? Authorization = null);
+
+public sealed record PruneApplicationRequest(
+    PruneIntent Intent,
+    ApplicationApplyAuthorization? Authorization = null);
+
+public sealed record ApplicationWriteResult<T>(
+    ApplicationOperationPlan Plan,
+    bool Applied,
+    T? Result)
+    where T : class;
+
+public enum ApplicationPlanClaimStatus
+{
+    Claimed,
+    NotFound,
+    DigestMismatch,
+    AlreadyUsed
+}
+
+public sealed record ApplicationPlanClaimResult(ApplicationPlanClaimStatus Status);
+
+public sealed class ApplicationPortException : InvalidOperationException
+{
+    public ApplicationPortException(
+        string code,
+        string message,
+        bool recoveryRequired = false,
+        string? rollbackStatus = null,
+        Exception? innerException = null)
+        : base(message, innerException)
+    {
+        if (string.IsNullOrWhiteSpace(code))
+        {
+            throw new ArgumentException("An error code is required.", nameof(code));
+        }
+
+        Code = code;
+        RecoveryRequired = recoveryRequired;
+        RollbackStatus = rollbackStatus;
+    }
+
+    public string Code { get; }
+
+    public bool RecoveryRequired { get; }
+
+    public string? RollbackStatus { get; }
+}
diff --git a/desktop/CodexProviderSync.Application/CodexProviderSync.Application.csproj b/desktop/CodexProviderSync.Application/CodexProviderSync.Application.csproj
new file mode 100644
index 0000000..5b3658a
--- /dev/null
+++ b/desktop/CodexProviderSync.Application/CodexProviderSync.Application.csproj
@@ -0,0 +1,17 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+    <Version>0.4.0</Version>
+    <AssemblyVersion>0.4.0.0</AssemblyVersion>
+    <FileVersion>0.4.0.0</FileVersion>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\CodexProviderSync.Core\CodexProviderSync.Core.csproj" />
+  </ItemGroup>
+
+</Project>
diff --git a/desktop/CodexProviderSync.Application/CoreApplicationAdapter.cs b/desktop/CodexProviderSync.Application/CoreApplicationAdapter.cs
new file mode 100644
index 0000000..481d891
--- /dev/null
+++ b/desktop/CodexProviderSync.Application/CoreApplicationAdapter.cs
@@ -0,0 +1,105 @@
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.Application;
+
+public sealed class CoreApplicationAdapter : ICoreApplicationAdapter
+{
+    private readonly CodexSyncService _syncService;
+    private readonly SettingsService _settingsService;
+    private readonly CodexHomeService _codexHomeService;
+    private readonly IApplicationService? _applicationService;
+
+    public CoreApplicationAdapter()
+        : this(new CodexSyncService(), new SettingsService(), new CodexHomeService())
+    {
+    }
+
+    public CoreApplicationAdapter(
+        CodexSyncService syncService,
+        SettingsService settingsService,
+        CodexHomeService codexHomeService,
+        IApplicationService? applicationService = null)
+    {
+        _syncService = syncService ?? throw new ArgumentNullException(nameof(syncService));
+        _settingsService = settingsService ?? throw new ArgumentNullException(nameof(settingsService));
+        _codexHomeService = codexHomeService ?? throw new ArgumentNullException(nameof(codexHomeService));
+        _applicationService = applicationService;
+    }
+
+    public async Task<CoreInitializationState> InitializeAsync(CancellationToken cancellationToken = default)
+    {
+        cancellationToken.ThrowIfCancellationRequested();
+        AppSettings settings = await _settingsService.LoadAsync();
+        cancellationToken.ThrowIfCancellationRequested();
+
+        string codexHome = _codexHomeService.NormalizeCodexHome(settings.LastCodexHome);
+        string? sqliteHomeOverride = _settingsService.GetSqliteHomeOverride(settings, codexHome);
+        return new CoreInitializationState(
+            codexHome,
+            sqliteHomeOverride,
+            NormalizeOptional(settings.LastSelectedProvider));
+    }
+
+    public async Task<CoreRefreshState> RefreshAsync(
+        CoreRefreshRequest request,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(request);
+        cancellationToken.ThrowIfCancellationRequested();
+        // Other GUI slices still write through SettingsService during the
+        // incremental migration. Reload here so a refresh never overwrites
+        // those newer settings with an adapter-local stale copy.
+        AppSettings settings = await _settingsService.LoadAsync();
+        cancellationToken.ThrowIfCancellationRequested();
+        string codexHome = _codexHomeService.NormalizeCodexHome(request.CodexHome);
+        string? sqliteHomeOverride = NormalizeOptional(request.SqliteHomeOverride);
+        StatusSnapshot status = _applicationService is null
+            ? await _syncService.GetStatusAsync(codexHome, sqliteHomeOverride)
+            : RequireStatus(await _applicationService.GetStatusAsync(
+                new ApplicationStatusRequest(codexHome, sqliteHomeOverride),
+                cancellationToken));
+        cancellationToken.ThrowIfCancellationRequested();
+
+        AppSettings nextSettings = _settingsService.RecordCodexHome(settings, status.CodexHome);
+        nextSettings = _settingsService.RecordSqliteHomeOverride(
+            nextSettings,
+            status.CodexHome,
+            sqliteHomeOverride);
+        nextSettings = _settingsService.MergeDetectedProviders(
+            nextSettings,
+            _syncService.ExtractDetectedProviderIds(status));
+        nextSettings = _settingsService.UpdateState(
+            nextSettings,
+            NormalizeOptional(request.SelectedProviderId),
+            nextSettings.LastBackupDirectory);
+
+        IReadOnlyList<ProviderOption> providers = _syncService.BuildProviderOptions(status, nextSettings);
+        await _settingsService.SaveAsync(nextSettings);
+        cancellationToken.ThrowIfCancellationRequested();
+
+        return new CoreRefreshState(status, providers);
+    }
+
+    private static string? NormalizeOptional(string? value)
+    {
+        return string.IsNullOrWhiteSpace(value) ? null : value.Trim();
+    }
+
+    private static StatusSnapshot RequireStatus(ApplicationOutcome<StatusSnapshot> outcome)
+    {
+        if (outcome.IsSuccess && outcome.Data is not null)
+        {
+            return outcome.Data;
+        }
+
+        string message = outcome.Errors.Count == 0
+            ? $"Application status operation ended as {outcome.Lifecycle}."
+            : string.Join(Environment.NewLine, outcome.Errors.Select(static error => error.Message));
+        if (outcome.Lifecycle == ApplicationOperationLifecycle.Cancelled)
+        {
+            throw new OperationCanceledException(message);
+        }
+
+        throw new InvalidOperationException(message);
+    }
+}
diff --git a/desktop/CodexProviderSync.Application/CoreApplicationStatusPort.cs b/desktop/CodexProviderSync.Application/CoreApplicationStatusPort.cs
new file mode 100644
index 0000000..778a9ec
--- /dev/null
+++ b/desktop/CodexProviderSync.Application/CoreApplicationStatusPort.cs
@@ -0,0 +1,36 @@
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.Application;
+
+public sealed class CoreApplicationStatusPort : IApplicationStatusPort
+{
+    private readonly CodexSyncService _syncService;
+
+    public CoreApplicationStatusPort()
+        : this(new CodexSyncService())
+    {
+    }
+
+    public CoreApplicationStatusPort(CodexSyncService syncService)
+    {
+        _syncService = syncService ?? throw new ArgumentNullException(nameof(syncService));
+    }
+
+    public async Task<StatusSnapshot> GetStatusAsync(
+        ApplicationStatusRequest request,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(request);
+        cancellationToken.ThrowIfCancellationRequested();
+        StatusSnapshot status = await _syncService.GetStatusAsync(
+            request.CodexHome,
+            NormalizeOptional(request.SqliteHomeOverride));
+        cancellationToken.ThrowIfCancellationRequested();
+        return status;
+    }
+
+    private static string? NormalizeOptional(string? value)
+    {
+        return string.IsNullOrWhiteSpace(value) ? null : value.Trim();
+    }
+}
diff --git a/desktop/CodexProviderSync.Application/CoreApplicationWritePort.cs b/desktop/CodexProviderSync.Application/CoreApplicationWritePort.cs
new file mode 100644
index 0000000..a0f284c
--- /dev/null
+++ b/desktop/CodexProviderSync.Application/CoreApplicationWritePort.cs
@@ -0,0 +1,298 @@
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.Application;
+
+/// <summary>
+/// Production write adapter. Planning and checked execution are both owned by
+/// Core; this adapter only normalizes Application inputs and maps immutable
+/// contracts between the two layers.
+/// </summary>
+public sealed class CoreApplicationWritePort : IApplicationWritePort
+{
+    private readonly CodexSyncService _syncService;
+    private readonly CodexHomeService _codexHomeService;
+
+    public CoreApplicationWritePort()
+        : this(new CodexSyncService(), new CodexHomeService())
+    {
+    }
+
+    public CoreApplicationWritePort(
+        CodexSyncService syncService,
+        CodexHomeService codexHomeService)
+    {
+        _syncService = syncService ?? throw new ArgumentNullException(nameof(syncService));
+        _codexHomeService = codexHomeService ?? throw new ArgumentNullException(nameof(codexHomeService));
+    }
+
+    public async Task<ApplicationPlanPreview> CreatePlanAsync(
+        ApplicationWriteIntent intent,
+        string operationId,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(intent);
+        ArgumentException.ThrowIfNullOrWhiteSpace(operationId);
+        ApplicationWriteIntent normalized = NormalizeIntent(intent);
+        CoreWritePlanSnapshot snapshot = await MapCoreFailuresAsync(
+            () => CreateCoreSnapshotAsync(normalized, cancellationToken));
+        return new ApplicationPlanPreview(
+            normalized,
+            snapshot.StateFingerprint,
+            snapshot.ExecutionToken,
+            snapshot.Targets.Select(MapTarget).ToArray(),
+            snapshot.AutoPruneDeletionTargets.Select(MapTarget).ToArray(),
+            snapshot.Warnings.Select(MapWarning).ToArray());
+    }
+
+    public Task<SyncResult> ExecuteSyncAsync(
+        SyncIntent intent,
+        ApplicationOperationPlan plan,
+        string operationId,
+        CancellationToken cancellationToken = default)
+    {
+        SyncIntent normalized = (SyncIntent)NormalizeIntent(intent);
+        CoreWritePlanSnapshot expected = MapExpectedSnapshot("sync", plan);
+        return MapCoreFailuresAsync(() => _syncService.RunSyncCheckedAsync(
+            expected,
+            normalized.CodexHome,
+            normalized.ProviderId,
+            normalized.BackupRetentionCount,
+            explicitSqliteHome: normalized.SqliteHomeOverride,
+            snapshotExpiresAtUtc: plan.ExpiresAtUtc,
+            cancellationToken: cancellationToken));
+    }
+
+    public Task<SyncResult> ExecuteSwitchAsync(
+        SwitchIntent intent,
+        ApplicationOperationPlan plan,
+        string operationId,
+        CancellationToken cancellationToken = default)
+    {
+        SwitchIntent normalized = (SwitchIntent)NormalizeIntent(intent);
+        (string? model, bool keepRootModel) = MapModelSelection(normalized.ModelSelection);
+        CoreWritePlanSnapshot expected = MapExpectedSnapshot("switch", plan);
+        return MapCoreFailuresAsync(() => _syncService.RunSwitchCheckedAsync(
+            expected,
+            explicitCodexHome: normalized.CodexHome,
+            provider: normalized.ProviderId,
+            keepCount: normalized.BackupRetentionCount,
+            model,
+            keepRootModel,
+            explicitSqliteHome: normalized.SqliteHomeOverride,
+            snapshotExpiresAtUtc: plan.ExpiresAtUtc,
+            cancellationToken));
+    }
+
+    public Task<RestoreResult> ExecuteRestoreAsync(
+        RestoreIntent intent,
+        ApplicationOperationPlan plan,
+        string operationId,
+        CancellationToken cancellationToken = default)
+    {
+        RestoreIntent normalized = (RestoreIntent)NormalizeIntent(intent);
+        CoreWritePlanSnapshot expected = MapExpectedSnapshot("restore", plan);
+        return MapCoreFailuresAsync(() => _syncService.RunRestoreCheckedAsync(
+            expected,
+            explicitCodexHome: normalized.CodexHome,
+            backupDir: normalized.BackupDirectory,
+            options: MapRestoreOptions(normalized),
+            explicitSqliteHome: normalized.SqliteHomeOverride,
+            snapshotExpiresAtUtc: plan.ExpiresAtUtc,
+            cancellationToken));
+    }
+
+    public Task<BackupPruneResult> ExecutePruneAsync(
+        PruneIntent intent,
+        ApplicationOperationPlan plan,
+        string operationId,
+        CancellationToken cancellationToken = default)
+    {
+        PruneIntent normalized = (PruneIntent)NormalizeIntent(intent);
+        CoreWritePlanSnapshot expected = MapExpectedSnapshot("prune", plan);
+        return MapCoreFailuresAsync(() => _syncService.RunPruneBackupsCheckedAsync(
+            expected,
+            explicitCodexHome: normalized.CodexHome,
+            keepCount: normalized.BackupRetentionCount,
+            snapshotExpiresAtUtc: plan.ExpiresAtUtc,
+            cancellationToken));
+    }
+
+    private Task<CoreWritePlanSnapshot> CreateCoreSnapshotAsync(
+        ApplicationWriteIntent intent,
+        CancellationToken cancellationToken)
+    {
+        return intent switch
+        {
+            SyncIntent sync => _syncService.CreateSyncPlanSnapshotAsync(
+                sync.CodexHome,
+                sync.ProviderId,
+                sync.BackupRetentionCount,
+                explicitSqliteHome: sync.SqliteHomeOverride,
+                cancellationToken: cancellationToken),
+            SwitchIntent change => CreateSwitchSnapshotAsync(change, cancellationToken),
+            RestoreIntent restore => _syncService.CreateRestorePlanSnapshotAsync(
+                restore.CodexHome,
+                restore.BackupDirectory,
+                MapRestoreOptions(restore),
+                restore.SqliteHomeOverride,
+                cancellationToken),
+            PruneIntent prune => _syncService.CreatePrunePlanSnapshotAsync(
+                prune.CodexHome,
+                prune.BackupRetentionCount,
+                cancellationToken),
+            _ => throw new ApplicationPortException(
+                "operation_unsupported",
+                "The requested Core write operation is not supported.")
+        };
+    }
+
+    private Task<CoreWritePlanSnapshot> CreateSwitchSnapshotAsync(
+        SwitchIntent intent,
+        CancellationToken cancellationToken)
+    {
+        (string? model, bool keepRootModel) = MapModelSelection(intent.ModelSelection);
+        return _syncService.CreateSwitchPlanSnapshotAsync(
+            intent.CodexHome,
+            intent.ProviderId,
+            intent.BackupRetentionCount,
+            model,
+            keepRootModel,
+            intent.SqliteHomeOverride,
+            cancellationToken);
+    }
+
+    public ApplicationWriteIntent NormalizeIntent(ApplicationWriteIntent intent)
+    {
+        string codexHome = _codexHomeService.NormalizeCodexHome(intent.CodexHome);
+        string? sqliteHome = NormalizeOptionalPath(intent.SqliteHomeOverride);
+        return intent switch
+        {
+            SyncIntent sync => new SyncIntent(
+                codexHome,
+                sqliteHome,
+                sync.ProviderId.Trim(),
+                sync.BackupRetentionCount),
+            SwitchIntent change => new SwitchIntent(
+                codexHome,
+                sqliteHome,
+                change.ProviderId.Trim(),
+                NormalizeModelSelection(change.ModelSelection),
+                change.BackupRetentionCount),
+            RestoreIntent restore => new RestoreIntent(
+                codexHome,
+                sqliteHome,
+                Path.GetFullPath(restore.BackupDirectory.Trim()),
+                restore.RestoreConfig,
+                restore.RestoreDatabase,
+                restore.RestoreSessions,
+                restore.AllowSqliteHomeRelocation),
+            PruneIntent prune => new PruneIntent(
+                codexHome,
+                sqliteHome,
+                prune.BackupRetentionCount),
+            _ => throw new ApplicationPortException(
+                "operation_unsupported",
+                "The requested Core write operation is not supported.")
+        };
+    }
+
+    private static SwitchModelSelection NormalizeModelSelection(SwitchModelSelection selection)
+    {
+        return selection switch
+        {
+            FollowProviderModelSelection => new FollowProviderModelSelection(),
+            KeepRootModelSelection => new KeepRootModelSelection(),
+            CustomModelSelection custom => new CustomModelSelection(custom.Model.Trim()),
+            _ => throw new ApplicationPortException(
+                "model_selection_invalid",
+                "The switch model selection is not supported.")
+        };
+    }
+
+    private static (string? Model, bool KeepRootModel) MapModelSelection(
+        SwitchModelSelection selection)
+    {
+        return selection switch
+        {
+            FollowProviderModelSelection => (null, false),
+            KeepRootModelSelection => (null, true),
+            CustomModelSelection custom => (custom.Model, false),
+            _ => throw new ApplicationPortException(
+                "model_selection_invalid",
+                "The switch model selection is not supported.")
+        };
+    }
+
+    private static RestoreBackupOptions MapRestoreOptions(RestoreIntent intent)
+    {
+        return new RestoreBackupOptions
+        {
+            RestoreConfig = intent.RestoreConfig,
+            RestoreDatabase = intent.RestoreDatabase,
+            RestoreSessions = intent.RestoreSessions,
+            AllowSqliteHomeRelocation = intent.AllowSqliteHomeRelocation
+        };
+    }
+
+    private static CoreWritePlanSnapshot MapExpectedSnapshot(
+        string operation,
+        ApplicationOperationPlan plan)
+    {
+        ArgumentNullException.ThrowIfNull(plan);
+        return new CoreWritePlanSnapshot(
+            operation,
+            plan.StateFingerprint,
+            plan.ExecutionToken,
+            plan.Targets.Select(MapTarget).ToArray(),
+            plan.AutoPruneDeletionTargets.Select(MapTarget).ToArray(),
+            plan.Warnings.Select(MapWarning).ToArray());
+    }
+
+    private static ApplicationPlanTarget MapTarget(CoreWritePlanTarget target) =>
+        new(target.Path, target.Action, target.Fingerprint);
+
+    private static CoreWritePlanTarget MapTarget(ApplicationPlanTarget target) =>
+        new(target.Path, target.Action, target.Fingerprint);
+
+    private static ApplicationWarning MapWarning(CoreWritePlanWarning warning) =>
+        new(warning.Code, warning.Message);
+
+    private static CoreWritePlanWarning MapWarning(ApplicationWarning warning) =>
+        new(warning.Code, warning.Message);
+
+    private static string? NormalizeOptionalPath(string? value)
+    {
+        return string.IsNullOrWhiteSpace(value)
+            ? null
+            : Path.GetFullPath(value.Trim());
+    }
+
+    private static async Task<T> MapCoreFailuresAsync<T>(Func<Task<T>> operation)
+    {
+        try
+        {
+            return await operation();
+        }
+        catch (CoreWritePlanStaleException error)
+        {
+            throw new ApplicationPortException(
+                "plan_stale",
+                error.Message,
+                innerException: error);
+        }
+        catch (CoreWritePlanExpiredException error)
+        {
+            throw new ApplicationPortException(
+                "plan_expired",
+                error.Message,
+                innerException: error);
+        }
+        catch (InvalidOperationException error) when (LockService.IsOperationBusy(error))
+        {
+            throw new ApplicationPortException(
+                "target_busy",
+                error.Message,
+                innerException: error);
+        }
+    }
+}
diff --git a/desktop/CodexProviderSync.Application/FileApplicationPlanLedger.cs b/desktop/CodexProviderSync.Application/FileApplicationPlanLedger.cs
new file mode 100644
index 0000000..583563e
--- /dev/null
+++ b/desktop/CodexProviderSync.Application/FileApplicationPlanLedger.cs
@@ -0,0 +1,877 @@
+using System.Diagnostics;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace CodexProviderSync.Application;
+
+/// <summary>
+/// Durable, single-use plan ledger for one-shot Application hosts.
+/// The caller must provide an explicit, fully-qualified storage root. No
+/// Codex Home, user profile, or environment-variable default is consulted.
+/// </summary>
+/// <remarks>
+/// Each transition is an immutable, atomically-published receipt. In
+/// particular, a claim receipt is flushed and published before
+/// <see cref="TryClaimAsync"/> returns <see cref="ApplicationPlanClaimStatus.Claimed"/>.
+/// A process that exits after that point cannot make the plan reusable.
+/// This is a local-filesystem, process-crash guarantee. Portable .NET APIs do
+/// not provide a cross-platform power-loss or hostile-network-filesystem
+/// durability guarantee. The explicitly supplied root is a trust boundary and
+/// must not be writable by an untrusted principal.
+/// </remarks>
+public sealed class FileApplicationPlanLedger : IApplicationPlanLedger
+{
+    private const int SchemaVersion = 1;
+    private const int MaximumRecordBytes = 64 * 1024;
+    private static readonly TimeSpan DefaultLockTimeout = TimeSpan.FromSeconds(30);
+    private static readonly TimeSpan LockRetryDelay = TimeSpan.FromMilliseconds(10);
+    private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web)
+    {
+        AllowTrailingCommas = false,
+        PropertyNameCaseInsensitive = false,
+        ReadCommentHandling = JsonCommentHandling.Disallow,
+        UnmappedMemberHandling = JsonUnmappedMemberHandling.Disallow,
+        WriteIndented = false
+    };
+
+    private readonly string _entriesDirectory;
+    private readonly string _locksDirectory;
+    private readonly TimeProvider _timeProvider;
+    private readonly TimeSpan _lockTimeout;
+
+    public FileApplicationPlanLedger(
+        string ledgerRoot,
+        TimeProvider? timeProvider = null,
+        TimeSpan? lockTimeout = null)
+    {
+        if (string.IsNullOrWhiteSpace(ledgerRoot))
+        {
+            throw new ArgumentException("An explicit plan-ledger root is required.", nameof(ledgerRoot));
+        }
+        if (!Path.IsPathFullyQualified(ledgerRoot))
+        {
+            throw new ArgumentException("The plan-ledger root must be fully qualified.", nameof(ledgerRoot));
+        }
+
+        LedgerRoot = Path.TrimEndingDirectorySeparator(Path.GetFullPath(ledgerRoot));
+        if (OperatingSystem.IsWindows()
+            && LedgerRoot.StartsWith(@"\\", StringComparison.Ordinal))
+        {
+            throw new ArgumentException(
+                "A network or WSL UNC path cannot be used as the plan-ledger root.",
+                nameof(ledgerRoot));
+        }
+        string? volumeRoot = Path.GetPathRoot(LedgerRoot);
+        if (string.IsNullOrEmpty(volumeRoot)
+            || PathsEqual(LedgerRoot, Path.TrimEndingDirectorySeparator(volumeRoot)))
+        {
+            throw new ArgumentException("A filesystem root cannot be used as the plan-ledger root.", nameof(ledgerRoot));
+        }
+
+        _entriesDirectory = GetContainedPath(LedgerRoot, "entries");
+        _locksDirectory = GetContainedPath(LedgerRoot, "locks");
+        _timeProvider = timeProvider ?? TimeProvider.System;
+        _lockTimeout = lockTimeout ?? DefaultLockTimeout;
+        if (_lockTimeout <= TimeSpan.Zero)
+        {
+            throw new ArgumentOutOfRangeException(nameof(lockTimeout), "The plan-ledger lock timeout must be positive.");
+        }
+    }
+
+    public string LedgerRoot { get; }
+
+    public async Task RegisterAsync(
+        ApplicationOperationPlan plan,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(plan);
+        ValidatePlanId(plan.PlanId);
+        ValidateRegistrationPlan(plan);
+        cancellationToken.ThrowIfCancellationRequested();
+
+        EnsureStorageLayout();
+        await using FileStream planLock = await AcquirePlanLockAsync(plan.PlanId, cancellationToken);
+        EnsureStorageLayout();
+        LedgerPaths paths = GetPaths(plan.PlanId);
+
+        if (PathExists(paths.Registration))
+        {
+            RegistrationRecord existing = await ReadRegistrationAsync(
+                paths.Registration,
+                plan.PlanId,
+                cancellationToken);
+            if (!FixedTimeEquals(existing.Digest, plan.Digest))
+            {
+                throw new InvalidOperationException(
+                    $"Plan {plan.PlanId} is already registered with a different digest.");
+            }
+
+            return;
+        }
+
+        string? orphan = FirstExistingPath(paths.Claim, paths.Completion);
+        if (orphan is not null)
+        {
+            throw Corrupt(
+                plan.PlanId,
+                orphan,
+                "A claim or completion receipt exists without its registration record.");
+        }
+
+        RegistrationRecord registration = new()
+        {
+            SchemaVersion = SchemaVersion,
+            RecordType = "registration",
+            PlanId = plan.PlanId,
+            Digest = plan.Digest,
+            ProtocolVersion = plan.ProtocolVersion,
+            CreatedByOperationId = plan.CreatedByOperationId,
+            CreatedAtUtc = plan.CreatedAtUtc.ToUniversalTime(),
+            ExpiresAtUtc = plan.ExpiresAtUtc.ToUniversalTime(),
+            RegisteredAtUtc = _timeProvider.GetUtcNow().ToUniversalTime()
+        };
+        await CreateImmutableRecordAsync(paths.Registration, registration, cancellationToken);
+    }
+
+    public async Task<ApplicationPlanClaimResult> TryClaimAsync(
+        string planId,
+        string digest,
+        CancellationToken cancellationToken = default)
+    {
+        ValidatePlanId(planId);
+        ArgumentNullException.ThrowIfNull(digest);
+        cancellationToken.ThrowIfCancellationRequested();
+
+        EnsureStorageLayout();
+        await using FileStream planLock = await AcquirePlanLockAsync(planId, cancellationToken);
+        EnsureStorageLayout();
+        LedgerPaths paths = GetPaths(planId);
+
+        if (!PathExists(paths.Registration))
+        {
+            string? orphan = FirstExistingPath(paths.Claim, paths.Completion);
+            if (orphan is not null)
+            {
+                throw Corrupt(
+                    planId,
+                    orphan,
+                    "A claim or completion receipt exists without its registration record.");
+            }
+
+            return new ApplicationPlanClaimResult(ApplicationPlanClaimStatus.NotFound);
+        }
+
+        RegistrationRecord registration = await ReadRegistrationAsync(
+            paths.Registration,
+            planId,
+            cancellationToken);
+        if (!FixedTimeEquals(registration.Digest, digest))
+        {
+            return new ApplicationPlanClaimResult(ApplicationPlanClaimStatus.DigestMismatch);
+        }
+
+        if (PathExists(paths.Claim))
+        {
+            await ReadClaimAsync(paths.Claim, registration, cancellationToken);
+            if (PathExists(paths.Completion))
+            {
+                await ReadCompletionAsync(paths.Completion, registration, cancellationToken);
+            }
+
+            return new ApplicationPlanClaimResult(ApplicationPlanClaimStatus.AlreadyUsed);
+        }
+        if (PathExists(paths.Completion))
+        {
+            throw Corrupt(
+                planId,
+                paths.Completion,
+                "A completion receipt exists without its claim receipt.");
+        }
+
+        ClaimRecord claim = new()
+        {
+            SchemaVersion = SchemaVersion,
+            RecordType = "claim",
+            PlanId = planId,
+            Digest = registration.Digest,
+            ClaimedAtUtc = _timeProvider.GetUtcNow().ToUniversalTime()
+        };
+        bool published = await TryCreateClaimRecordAsync(paths.Claim, claim, cancellationToken);
+        if (!published)
+        {
+            // FileMode.CreateNew is the authoritative cross-process claim
+            // primitive. This branch also protects single-use semantics if a
+            // platform does not honor FileShare.None exactly as expected.
+            await ReadClaimAsync(paths.Claim, registration, cancellationToken);
+            return new ApplicationPlanClaimResult(ApplicationPlanClaimStatus.AlreadyUsed);
+        }
+
+        // Do not observe cancellation after publishing the claim. Once this
+        // method can report Claimed, the receipt is already durable and the
+        // caller must treat the plan as permanently consumed.
+        return new ApplicationPlanClaimResult(ApplicationPlanClaimStatus.Claimed);
+    }
+
+    public async Task CompleteAsync(
+        string planId,
+        ApplicationOperationLifecycle lifecycle,
+        CancellationToken cancellationToken = default)
+    {
+        ValidatePlanId(planId);
+        string lifecycleName = ToTerminalLifecycleName(lifecycle);
+        cancellationToken.ThrowIfCancellationRequested();
+
+        EnsureStorageLayout();
+        await using FileStream planLock = await AcquirePlanLockAsync(planId, cancellationToken);
+        EnsureStorageLayout();
+        LedgerPaths paths = GetPaths(planId);
+
+        if (!PathExists(paths.Registration))
+        {
+            string? evidence = FirstExistingPath(paths.Claim, paths.Completion);
+            if (evidence is not null)
+            {
+                throw Corrupt(
+                    planId,
+                    evidence,
+                    "A claim or completion receipt exists without its registration record.");
+            }
+
+            throw new InvalidOperationException($"Plan {planId} is not registered.");
+        }
+
+        RegistrationRecord registration = await ReadRegistrationAsync(
+            paths.Registration,
+            planId,
+            cancellationToken);
+        if (!PathExists(paths.Claim))
+        {
+            if (PathExists(paths.Completion))
+            {
+                throw Corrupt(
+                    planId,
+                    paths.Completion,
+                    "A completion receipt exists without its claim receipt.");
+            }
+
+            throw new InvalidOperationException($"Plan {planId} has not been claimed.");
+        }
+
+        await ReadClaimAsync(paths.Claim, registration, cancellationToken);
+        if (PathExists(paths.Completion))
+        {
+            CompletionRecord existing = await ReadCompletionAsync(
+                paths.Completion,
+                registration,
+                cancellationToken);
+            if (!string.Equals(existing.Lifecycle, lifecycleName, StringComparison.Ordinal))
+            {
+                throw new InvalidOperationException(
+                    $"Plan {planId} is already completed as {existing.Lifecycle} and cannot transition to {lifecycleName}.");
+            }
+
+            return;
+        }
+
+        CompletionRecord completion = new()
+        {
+            SchemaVersion = SchemaVersion,
+            RecordType = "completion",
+            PlanId = planId,
+            Digest = registration.Digest,
+            Lifecycle = lifecycleName,
+            CompletedAtUtc = _timeProvider.GetUtcNow().ToUniversalTime()
+        };
+        await CreateImmutableRecordAsync(paths.Completion, completion, cancellationToken);
+    }
+
+    private static void ValidateRegistrationPlan(ApplicationOperationPlan plan)
+    {
+        if (!string.Equals(plan.ProtocolVersion, ApplicationProtocol.Version, StringComparison.Ordinal))
+        {
+            throw new ArgumentException("The plan protocol version is not supported.", nameof(plan));
+        }
+        if (string.IsNullOrWhiteSpace(plan.CreatedByOperationId))
+        {
+            throw new ArgumentException("The plan creator operation id is required.", nameof(plan));
+        }
+        if (plan.ExpiresAtUtc <= plan.CreatedAtUtc)
+        {
+            throw new ArgumentException("The plan expiry must be later than its creation time.", nameof(plan));
+        }
+
+        ValidateDigest(plan.Digest, nameof(plan));
+    }
+
+    private static void ValidatePlanId(string? planId)
+    {
+        if (string.IsNullOrEmpty(planId)
+            || planId.Length > 128
+            || !IsAsciiLetterOrDigit(planId[0])
+            || planId.Any(static character =>
+                !IsAsciiLetterOrDigit(character)
+                && character != '-'
+                && character != '_'))
+        {
+            throw new ArgumentException(
+                "A plan id must contain 1-128 ASCII letters, digits, hyphens, or underscores and must start with a letter or digit.",
+                nameof(planId));
+        }
+    }
+
+    private static bool IsAsciiLetterOrDigit(char value)
+    {
+        return value is >= 'a' and <= 'z'
+            or >= 'A' and <= 'Z'
+            or >= '0' and <= '9';
+    }
+
+    private static void ValidateDigest(string? digest, string parameterName)
+    {
+        if (digest is null
+            || digest.Length != 64
+            || digest.Any(static character =>
+                character is not (>= '0' and <= '9')
+                and not (>= 'a' and <= 'f')))
+        {
+            throw new ArgumentException(
+                "A plan digest must be a lowercase 64-character SHA-256 hexadecimal value.",
+                parameterName);
+        }
+    }
+
+    private void EnsureStorageLayout()
+    {
+        if (File.Exists(LedgerRoot))
+        {
+            throw new InvalidOperationException($"The plan-ledger root is a file: {LedgerRoot}");
+        }
+
+        Directory.CreateDirectory(LedgerRoot);
+        EnsureSafeDirectory(LedgerRoot);
+        Directory.CreateDirectory(_entriesDirectory);
+        EnsureSafeDirectory(_entriesDirectory);
+        Directory.CreateDirectory(_locksDirectory);
+        EnsureSafeDirectory(_locksDirectory);
+    }
+
+    private async Task<FileStream> AcquirePlanLockAsync(
+        string planId,
+        CancellationToken cancellationToken)
+    {
+        string path = GetPaths(planId).Lock;
+        long started = Stopwatch.GetTimestamp();
+        IOException? lastError = null;
+        while (Stopwatch.GetElapsedTime(started) < _lockTimeout)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            EnsureSafeFileOrMissing(path, planId);
+            try
+            {
+                FileStream stream = new(
+                    path,
+                    FileMode.OpenOrCreate,
+                    FileAccess.ReadWrite,
+                    FileShare.None,
+                    1,
+                    FileOptions.Asynchronous | FileOptions.WriteThrough);
+                try
+                {
+                    EnsureSafeFileOrMissing(path, planId);
+                    return stream;
+                }
+                catch
+                {
+                    await stream.DisposeAsync();
+                    throw;
+                }
+            }
+            catch (ApplicationPlanLedgerCorruptionException)
+            {
+                throw;
+            }
+            catch (IOException error)
+            {
+                lastError = error;
+                await Task.Delay(LockRetryDelay, cancellationToken);
+            }
+        }
+
+        throw new TimeoutException(
+            $"Timed out waiting for the durable plan-ledger lock for plan {planId}.",
+            lastError);
+    }
+
+    private LedgerPaths GetPaths(string planId)
+    {
+        string key = Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(planId)))
+            .ToLowerInvariant();
+        return new LedgerPaths(
+            GetContainedPath(_entriesDirectory, $"{key}.registration.v1.json"),
+            GetContainedPath(_entriesDirectory, $"{key}.claim.v1.json"),
+            GetContainedPath(_entriesDirectory, $"{key}.completion.v1.json"),
+            GetContainedPath(_locksDirectory, $"{key}.lock"));
+    }
+
+    private async Task<RegistrationRecord> ReadRegistrationAsync(
+        string path,
+        string planId,
+        CancellationToken cancellationToken)
+    {
+        RegistrationRecord record = await ReadCanonicalRecordAsync<RegistrationRecord>(
+            path,
+            planId,
+            cancellationToken);
+        if (record.SchemaVersion != SchemaVersion
+            || !string.Equals(record.RecordType, "registration", StringComparison.Ordinal)
+            || !string.Equals(record.PlanId, planId, StringComparison.Ordinal)
+            || !string.Equals(record.ProtocolVersion, ApplicationProtocol.Version, StringComparison.Ordinal)
+            || string.IsNullOrWhiteSpace(record.CreatedByOperationId)
+            || record.ExpiresAtUtc <= record.CreatedAtUtc
+            || record.CreatedAtUtc.Offset != TimeSpan.Zero
+            || record.ExpiresAtUtc.Offset != TimeSpan.Zero
+            || record.RegisteredAtUtc.Offset != TimeSpan.Zero)
+        {
+            throw Corrupt(planId, path, "The registration record has invalid protocol fields.");
+        }
+        try
+        {
+            ValidateDigest(record.Digest, nameof(record.Digest));
+        }
+        catch (ArgumentException error)
+        {
+            throw Corrupt(planId, path, "The registration record has an invalid digest.", error);
+        }
+
+        return record;
+    }
+
+    private async Task<ClaimRecord> ReadClaimAsync(
+        string path,
+        RegistrationRecord registration,
+        CancellationToken cancellationToken)
+    {
+        ClaimRecord record = await ReadCanonicalRecordAsync<ClaimRecord>(
+            path,
+            registration.PlanId,
+            cancellationToken);
+        if (record.SchemaVersion != SchemaVersion
+            || !string.Equals(record.RecordType, "claim", StringComparison.Ordinal)
+            || !string.Equals(record.PlanId, registration.PlanId, StringComparison.Ordinal)
+            || !FixedTimeEquals(record.Digest, registration.Digest)
+            || record.ClaimedAtUtc.Offset != TimeSpan.Zero)
+        {
+            throw Corrupt(registration.PlanId, path, "The claim receipt does not match its registration record.");
+        }
+
+        return record;
+    }
+
+    private async Task<CompletionRecord> ReadCompletionAsync(
+        string path,
+        RegistrationRecord registration,
+        CancellationToken cancellationToken)
+    {
+        CompletionRecord record = await ReadCanonicalRecordAsync<CompletionRecord>(
+            path,
+            registration.PlanId,
+            cancellationToken);
+        if (record.SchemaVersion != SchemaVersion
+            || !string.Equals(record.RecordType, "completion", StringComparison.Ordinal)
+            || !string.Equals(record.PlanId, registration.PlanId, StringComparison.Ordinal)
+            || !FixedTimeEquals(record.Digest, registration.Digest)
+            || !IsTerminalLifecycleName(record.Lifecycle)
+            || record.CompletedAtUtc.Offset != TimeSpan.Zero)
+        {
+            throw Corrupt(registration.PlanId, path, "The completion receipt does not match its registration record.");
+        }
+
+        return record;
+    }
+
+    private async Task<T> ReadCanonicalRecordAsync<T>(
+        string path,
+        string planId,
+        CancellationToken cancellationToken)
+        where T : class
+    {
+        EnsureSafeFile(path, planId);
+        byte[] bytes;
+        try
+        {
+            FileInfo info = new(path);
+            if (info.Length is <= 0 or > MaximumRecordBytes)
+            {
+                throw Corrupt(planId, path, "The durable plan-ledger record has an invalid length.");
+            }
+
+            bytes = await File.ReadAllBytesAsync(path, cancellationToken);
+        }
+        catch (ApplicationPlanLedgerCorruptionException)
+        {
+            throw;
+        }
+        catch (FileNotFoundException error)
+        {
+            throw Corrupt(planId, path, "A durable plan-ledger record disappeared while it was being read.", error);
+        }
+
+        if (bytes.Length is <= 0 or > MaximumRecordBytes)
+        {
+            throw Corrupt(planId, path, "The durable plan-ledger record has an invalid length.");
+        }
+
+        T? record;
+        try
+        {
+            record = JsonSerializer.Deserialize<T>(bytes, JsonOptions);
+        }
+        catch (JsonException error)
+        {
+            throw Corrupt(planId, path, "The durable plan-ledger record is not valid canonical JSON.", error);
+        }
+        catch (NotSupportedException error)
+        {
+            throw Corrupt(planId, path, "The durable plan-ledger record uses an unsupported schema.", error);
+        }
+        if (record is null)
+        {
+            throw Corrupt(planId, path, "The durable plan-ledger record is empty.");
+        }
+
+        byte[] canonical = SerializeCanonical(record);
+        if (!bytes.AsSpan().SequenceEqual(canonical))
+        {
+            throw Corrupt(planId, path, "The durable plan-ledger record is not in canonical form.");
+        }
+
+        return record;
+    }
+
+    private async Task CreateImmutableRecordAsync<T>(
+        string path,
+        T record,
+        CancellationToken cancellationToken)
+        where T : class
+    {
+        EnsureSafeFileOrMissing(path, record switch
+        {
+            RegistrationRecord registration => registration.PlanId,
+            ClaimRecord claim => claim.PlanId,
+            CompletionRecord completion => completion.PlanId,
+            _ => throw new ArgumentOutOfRangeException(nameof(record))
+        });
+        byte[] bytes = SerializeCanonical(record);
+        string directory = Path.GetDirectoryName(path)!;
+        string temporaryPath = GetContainedPath(
+            directory,
+            $".{Path.GetFileName(path)}.{Environment.ProcessId}.{Guid.NewGuid():N}.tmp");
+        try
+        {
+            await using (FileStream stream = new(
+                temporaryPath,
+                FileMode.CreateNew,
+                FileAccess.Write,
+                FileShare.None,
+                4096,
+                FileOptions.Asynchronous | FileOptions.WriteThrough))
+            {
+                await stream.WriteAsync(bytes, cancellationToken);
+                await stream.FlushAsync(cancellationToken);
+                stream.Flush(flushToDisk: true);
+            }
+
+            cancellationToken.ThrowIfCancellationRequested();
+            File.Move(temporaryPath, path, overwrite: false);
+        }
+        catch
+        {
+            TryDeleteTemporaryFile(temporaryPath);
+            throw;
+        }
+    }
+
+    private async Task<bool> TryCreateClaimRecordAsync(
+        string path,
+        ClaimRecord record,
+        CancellationToken cancellationToken)
+    {
+        EnsureSafeFileOrMissing(path, record.PlanId);
+        byte[] bytes = SerializeCanonical(record);
+        cancellationToken.ThrowIfCancellationRequested();
+
+        FileStream stream;
+        try
+        {
+            stream = new FileStream(
+                path,
+                FileMode.CreateNew,
+                FileAccess.Write,
+                FileShare.None,
+                4096,
+                FileOptions.Asynchronous | FileOptions.WriteThrough);
+        }
+        catch (IOException) when (PathExists(path))
+        {
+            return false;
+        }
+
+        await using (stream)
+        {
+            // The successful CreateNew is the irreversible claim point. Ignore
+            // caller cancellation from here onward. If an I/O failure tears
+            // the receipt, it remains in place and future attempts fail closed
+            // as corrupt rather than making the plan reusable.
+            await stream.WriteAsync(bytes, CancellationToken.None);
+            await stream.FlushAsync(CancellationToken.None);
+            stream.Flush(flushToDisk: true);
+        }
+
+        return true;
+    }
+
+    private static byte[] SerializeCanonical<T>(T record)
+    {
+        byte[] json = JsonSerializer.SerializeToUtf8Bytes(record, JsonOptions);
+        byte[] result = new byte[json.Length + 1];
+        json.CopyTo(result, 0);
+        result[^1] = (byte)'\n';
+        return result;
+    }
+
+    private static string ToTerminalLifecycleName(ApplicationOperationLifecycle lifecycle)
+    {
+        return lifecycle switch
+        {
+            ApplicationOperationLifecycle.Succeeded => "succeeded",
+            ApplicationOperationLifecycle.Failed => "failed",
+            ApplicationOperationLifecycle.Cancelled => "cancelled",
+            ApplicationOperationLifecycle.Rejected => "rejected",
+            ApplicationOperationLifecycle.RecoveryRequired => "recoveryRequired",
+            _ => throw new ArgumentOutOfRangeException(
+                nameof(lifecycle),
+                lifecycle,
+                "Only terminal Application lifecycles can complete a claimed plan.")
+        };
+    }
+
+    private static bool IsTerminalLifecycleName(string? lifecycle)
+    {
+        return lifecycle is "succeeded" or "failed" or "cancelled" or "rejected" or "recoveryRequired";
+    }
+
+    private static bool FixedTimeEquals(string? left, string? right)
+    {
+        if (left is null || right is null)
+        {
+            return false;
+        }
+
+        byte[] leftBytes = Encoding.UTF8.GetBytes(left);
+        byte[] rightBytes = Encoding.UTF8.GetBytes(right);
+        return leftBytes.Length == rightBytes.Length
+            && CryptographicOperations.FixedTimeEquals(leftBytes, rightBytes);
+    }
+
+    private static void EnsureSafeDirectory(string path)
+    {
+        FileAttributes attributes = File.GetAttributes(path);
+        if ((attributes & FileAttributes.Directory) == 0)
+        {
+            throw new InvalidOperationException($"Expected a plan-ledger directory at {path}.");
+        }
+        if ((attributes & FileAttributes.ReparsePoint) != 0)
+        {
+            throw new InvalidOperationException($"Plan-ledger directories cannot be reparse points: {path}");
+        }
+    }
+
+    private static void EnsureSafeFile(string path, string planId)
+    {
+        if (!File.Exists(path))
+        {
+            throw Corrupt(planId, path, "The expected durable plan-ledger record is missing.");
+        }
+
+        EnsureSafeFileOrMissing(path, planId);
+    }
+
+    private static void EnsureSafeFileOrMissing(string path, string planId)
+    {
+        if (Directory.Exists(path))
+        {
+            throw Corrupt(planId, path, "A directory occupies a durable plan-ledger file path.");
+        }
+        if (!File.Exists(path))
+        {
+            return;
+        }
+
+        FileAttributes attributes = File.GetAttributes(path);
+        if ((attributes & FileAttributes.ReparsePoint) != 0)
+        {
+            throw Corrupt(planId, path, "Durable plan-ledger files cannot be reparse points.");
+        }
+    }
+
+    private static bool PathExists(string path)
+    {
+        return File.Exists(path) || Directory.Exists(path);
+    }
+
+    private static string? FirstExistingPath(params string[] paths)
+    {
+        return paths.FirstOrDefault(PathExists);
+    }
+
+    private static string GetContainedPath(string parent, string childName)
+    {
+        string fullParent = Path.TrimEndingDirectorySeparator(Path.GetFullPath(parent));
+        string combined = Path.GetFullPath(Path.Combine(fullParent, childName));
+        string? actualParent = Path.GetDirectoryName(combined);
+        if (actualParent is null || !PathsEqual(fullParent, Path.TrimEndingDirectorySeparator(actualParent)))
+        {
+            throw new InvalidOperationException("A plan-ledger path escaped its storage root.");
+        }
+
+        return combined;
+    }
+
+    private static bool PathsEqual(string left, string right)
+    {
+        return string.Equals(
+            left,
+            right,
+            OperatingSystem.IsWindows() ? StringComparison.OrdinalIgnoreCase : StringComparison.Ordinal);
+    }
+
+    private static ApplicationPlanLedgerCorruptionException Corrupt(
+        string planId,
+        string evidencePath,
+        string message,
+        Exception? innerException = null)
+    {
+        return new ApplicationPlanLedgerCorruptionException(
+            planId,
+            Path.GetFullPath(evidencePath),
+            message,
+            innerException);
+    }
+
+    private static void TryDeleteTemporaryFile(string path)
+    {
+        try
+        {
+            if (File.Exists(path))
+            {
+                File.Delete(path);
+            }
+        }
+        catch
+        {
+            // Best-effort cleanup must not hide the durable write failure.
+        }
+    }
+
+    private sealed record LedgerPaths(
+        string Registration,
+        string Claim,
+        string Completion,
+        string Lock);
+
+    private sealed class RegistrationRecord
+    {
+        [JsonPropertyOrder(0)]
+        public required int SchemaVersion { get; init; }
+
+        [JsonPropertyOrder(1)]
+        public required string RecordType { get; init; }
+
+        [JsonPropertyOrder(2)]
+        public required string PlanId { get; init; }
+
+        [JsonPropertyOrder(3)]
+        public required string Digest { get; init; }
+
+        [JsonPropertyOrder(4)]
+        public required string ProtocolVersion { get; init; }
+
+        [JsonPropertyOrder(5)]
+        public required string CreatedByOperationId { get; init; }
+
+        [JsonPropertyOrder(6)]
+        public required DateTimeOffset CreatedAtUtc { get; init; }
+
+        [JsonPropertyOrder(7)]
+        public required DateTimeOffset ExpiresAtUtc { get; init; }
+
+        [JsonPropertyOrder(8)]
+        public required DateTimeOffset RegisteredAtUtc { get; init; }
+    }
+
+    private sealed class ClaimRecord
+    {
+        [JsonPropertyOrder(0)]
+        public required int SchemaVersion { get; init; }
+
+        [JsonPropertyOrder(1)]
+        public required string RecordType { get; init; }
+
+        [JsonPropertyOrder(2)]
+        public required string PlanId { get; init; }
+
+        [JsonPropertyOrder(3)]
+        public required string Digest { get; init; }
+
+        [JsonPropertyOrder(4)]
+        public required DateTimeOffset ClaimedAtUtc { get; init; }
+    }
+
+    private sealed class CompletionRecord
+    {
+        [JsonPropertyOrder(0)]
+        public required int SchemaVersion { get; init; }
+
+        [JsonPropertyOrder(1)]
+        public required string RecordType { get; init; }
+
+        [JsonPropertyOrder(2)]
+        public required string PlanId { get; init; }
+
+        [JsonPropertyOrder(3)]
+        public required string Digest { get; init; }
+
+        [JsonPropertyOrder(4)]
+        public required string Lifecycle { get; init; }
+
+        [JsonPropertyOrder(5)]
+        public required DateTimeOffset CompletedAtUtc { get; init; }
+    }
+}
+
+/// <summary>
+/// Indicates that durable ledger evidence is missing, malformed, non-canonical,
+/// or internally inconsistent. The evidence is retained in place so an
+/// operator can inspect or recover it; the affected plan is never claimed.
+/// </summary>
+public sealed class ApplicationPlanLedgerCorruptionException : IOException
+{
+    public ApplicationPlanLedgerCorruptionException(
+        string planId,
+        string evidencePath,
+        string message,
+        Exception? innerException = null)
+        : base($"{message} Plan: {planId}. Evidence: {evidencePath}", innerException)
+    {
+        PlanId = planId;
+        EvidencePath = evidencePath;
+    }
+
+    public string Code { get; } = "plan_ledger_corrupt";
+
+    public string PlanId { get; }
+
+    public string EvidencePath { get; }
+}
diff --git a/desktop/CodexProviderSync.Application/IApplicationService.cs b/desktop/CodexProviderSync.Application/IApplicationService.cs
new file mode 100644
index 0000000..83dcd70
--- /dev/null
+++ b/desktop/CodexProviderSync.Application/IApplicationService.cs
@@ -0,0 +1,112 @@
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.Application;
+
+public interface IApplicationService
+{
+    Task<ApplicationOutcome<ApplicationDescription>> DescribeAsync(
+        CancellationToken cancellationToken = default);
+
+    Task<ApplicationOutcome<StatusSnapshot>> GetStatusAsync(
+        ApplicationStatusRequest request,
+        CancellationToken cancellationToken = default);
+
+    Task<ApplicationOutcome<ApplicationOperationPlan>> CreatePlanAsync(
+        CreateApplicationPlanRequest request,
+        CancellationToken cancellationToken = default);
+
+    Task<ApplicationOutcome<ApplicationWriteResult<SyncResult>>> SyncAsync(
+        SyncApplicationRequest request,
+        CancellationToken cancellationToken = default);
+
+    Task<ApplicationOutcome<ApplicationWriteResult<SyncResult>>> SwitchAsync(
+        SwitchApplicationRequest request,
+        CancellationToken cancellationToken = default);
+
+    Task<ApplicationOutcome<ApplicationWriteResult<RestoreResult>>> RestoreAsync(
+        RestoreApplicationRequest request,
+        CancellationToken cancellationToken = default);
+
+    Task<ApplicationOutcome<ApplicationWriteResult<BackupPruneResult>>> PruneAsync(
+        PruneApplicationRequest request,
+        CancellationToken cancellationToken = default);
+}
+
+/// <summary>
+/// Pure read boundary. Implementations must not persist GUI settings or mutate
+/// any Codex state while serving <see cref="GetStatusAsync"/>.
+/// </summary>
+public interface IApplicationStatusPort
+{
+    Task<StatusSnapshot> GetStatusAsync(
+        ApplicationStatusRequest request,
+        CancellationToken cancellationToken = default);
+}
+
+/// <summary>
+/// Authoritative Core write boundary. A plan preview must be produced from
+/// the same Core discovery rules used by execution. Every Execute method must
+/// acquire the Core operation lock, revalidate the normalized intent and state
+/// fingerprint while holding that lock, and reject drift before mutation.
+/// </summary>
+public interface IApplicationWritePort
+{
+    /// <summary>
+    /// Pure, deterministic input normalization used on both plan and apply.
+    /// Implementations must not perform I/O or derive values from mutable
+    /// storage; discovered values belong in the Core snapshot instead.
+    /// </summary>
+    ApplicationWriteIntent NormalizeIntent(ApplicationWriteIntent intent) => intent;
+
+    Task<ApplicationPlanPreview> CreatePlanAsync(
+        ApplicationWriteIntent intent,
+        string operationId,
+        CancellationToken cancellationToken = default);
+
+    Task<SyncResult> ExecuteSyncAsync(
+        SyncIntent intent,
+        ApplicationOperationPlan plan,
+        string operationId,
+        CancellationToken cancellationToken = default);
+
+    Task<SyncResult> ExecuteSwitchAsync(
+        SwitchIntent intent,
+        ApplicationOperationPlan plan,
+        string operationId,
+        CancellationToken cancellationToken = default);
+
+    Task<RestoreResult> ExecuteRestoreAsync(
+        RestoreIntent intent,
+        ApplicationOperationPlan plan,
+        string operationId,
+        CancellationToken cancellationToken = default);
+
+    Task<BackupPruneResult> ExecutePruneAsync(
+        PruneIntent intent,
+        ApplicationOperationPlan plan,
+        string operationId,
+        CancellationToken cancellationToken = default);
+}
+
+/// <summary>
+/// Single-use plan ledger. Business Automation must supply a durable
+/// implementation so plan state survives its one-shot process boundary. A
+/// claim must atomically persist the exact registered digest before Core can
+/// mutate any target; a claimed plan may never become available again.
+/// </summary>
+public interface IApplicationPlanLedger
+{
+    Task RegisterAsync(
+        ApplicationOperationPlan plan,
+        CancellationToken cancellationToken = default);
+
+    Task<ApplicationPlanClaimResult> TryClaimAsync(
+        string planId,
+        string digest,
+        CancellationToken cancellationToken = default);
+
+    Task CompleteAsync(
+        string planId,
+        ApplicationOperationLifecycle lifecycle,
+        CancellationToken cancellationToken = default);
+}
diff --git a/desktop/CodexProviderSync.Application/ICoreApplicationAdapter.cs b/desktop/CodexProviderSync.Application/ICoreApplicationAdapter.cs
new file mode 100644
index 0000000..f40e992
--- /dev/null
+++ b/desktop/CodexProviderSync.Application/ICoreApplicationAdapter.cs
@@ -0,0 +1,26 @@
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.Application;
+
+public sealed record CoreInitializationState(
+    string CodexHome,
+    string? SqliteHomeOverride,
+    string? PreferredProviderId);
+
+public sealed record CoreRefreshRequest(
+    string CodexHome,
+    string? SqliteHomeOverride,
+    string? SelectedProviderId);
+
+public sealed record CoreRefreshState(
+    StatusSnapshot Status,
+    IReadOnlyList<ProviderOption> Providers);
+
+public interface ICoreApplicationAdapter
+{
+    Task<CoreInitializationState> InitializeAsync(CancellationToken cancellationToken = default);
+
+    Task<CoreRefreshState> RefreshAsync(
+        CoreRefreshRequest request,
+        CancellationToken cancellationToken = default);
+}
diff --git a/desktop/CodexProviderSync.Application/InMemoryApplicationPlanLedger.cs b/desktop/CodexProviderSync.Application/InMemoryApplicationPlanLedger.cs
new file mode 100644
index 0000000..8f75d81
--- /dev/null
+++ b/desktop/CodexProviderSync.Application/InMemoryApplicationPlanLedger.cs
@@ -0,0 +1,115 @@
+namespace CodexProviderSync.Application;
+
+/// <summary>
+/// Process-local ledger for the desktop GUI. The one-shot Business Automation
+/// host must use a durable <see cref="IApplicationPlanLedger"/> instead.
+/// </summary>
+public sealed class InMemoryApplicationPlanLedger : IApplicationPlanLedger
+{
+    private readonly object _gate = new();
+    private readonly Dictionary<string, Entry> _entries = new(StringComparer.Ordinal);
+
+    public Task RegisterAsync(
+        ApplicationOperationPlan plan,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(plan);
+        cancellationToken.ThrowIfCancellationRequested();
+        lock (_gate)
+        {
+            if (!_entries.TryAdd(plan.PlanId, new Entry(plan.Digest)))
+            {
+                throw new InvalidOperationException($"Plan {plan.PlanId} is already registered.");
+            }
+        }
+
+        return Task.CompletedTask;
+    }
+
+    public Task<ApplicationPlanClaimResult> TryClaimAsync(
+        string planId,
+        string digest,
+        CancellationToken cancellationToken = default)
+    {
+        cancellationToken.ThrowIfCancellationRequested();
+        ApplicationPlanClaimStatus status;
+        lock (_gate)
+        {
+            if (!_entries.TryGetValue(planId, out Entry? entry))
+            {
+                status = ApplicationPlanClaimStatus.NotFound;
+            }
+            else if (!string.Equals(entry.Digest, digest, StringComparison.Ordinal))
+            {
+                status = ApplicationPlanClaimStatus.DigestMismatch;
+            }
+            else if (entry.Claimed)
+            {
+                status = ApplicationPlanClaimStatus.AlreadyUsed;
+            }
+            else
+            {
+                entry.Claimed = true;
+                status = ApplicationPlanClaimStatus.Claimed;
+            }
+        }
+
+        return Task.FromResult(new ApplicationPlanClaimResult(status));
+    }
+
+    public Task CompleteAsync(
+        string planId,
+        ApplicationOperationLifecycle lifecycle,
+        CancellationToken cancellationToken = default)
+    {
+        cancellationToken.ThrowIfCancellationRequested();
+        EnsureTerminalLifecycle(lifecycle);
+        lock (_gate)
+        {
+            if (!_entries.TryGetValue(planId, out Entry? entry) || !entry.Claimed)
+            {
+                throw new InvalidOperationException($"Plan {planId} has not been claimed.");
+            }
+
+            if (entry.TerminalLifecycle is { } existing)
+            {
+                if (existing != lifecycle)
+                {
+                    throw new InvalidOperationException(
+                        $"Plan {planId} is already completed as {existing} and cannot transition to {lifecycle}.");
+                }
+
+                return Task.CompletedTask;
+            }
+
+            entry.TerminalLifecycle = lifecycle;
+        }
+
+        return Task.CompletedTask;
+    }
+
+    private static void EnsureTerminalLifecycle(ApplicationOperationLifecycle lifecycle)
+    {
+        if (lifecycle is not (
+            ApplicationOperationLifecycle.Succeeded
+            or ApplicationOperationLifecycle.Failed
+            or ApplicationOperationLifecycle.Cancelled
+            or ApplicationOperationLifecycle.Rejected
+            or ApplicationOperationLifecycle.RecoveryRequired))
+        {
+            throw new ArgumentOutOfRangeException(
+                nameof(lifecycle),
+                lifecycle,
+                "Only terminal Application lifecycles can complete a claimed plan.");
+        }
+    }
+
+    private sealed class Entry(string digest)
+    {
+        public string Digest { get; } = digest;
+
+        public bool Claimed { get; set; }
+
+        public ApplicationOperationLifecycle? TerminalLifecycle { get; set; }
+    }
+}
diff --git a/desktop/CodexProviderSync.Automation.Tests/AutomationCommandLineTests.cs b/desktop/CodexProviderSync.Automation.Tests/AutomationCommandLineTests.cs
new file mode 100644
index 0000000..d7bb729
--- /dev/null
+++ b/desktop/CodexProviderSync.Automation.Tests/AutomationCommandLineTests.cs
@@ -0,0 +1,141 @@
+using CodexProviderSync.Application;
+
+namespace CodexProviderSync.Automation.Tests;
+
+public sealed class AutomationCommandLineTests
+{
+    [Theory]
+    [InlineData("unknown", "unknown_command")]
+    [InlineData("sync", "option_required")]
+    public void UnknownOrIncompleteCommands_AreControlledUsageFailures(string command, string errorCode)
+    {
+        AutomationParseResult parsed = AutomationCommandLine.Parse([command]);
+
+        Assert.False(parsed.IsSuccess);
+        Assert.Equal(AutomationExitCodes.ValidationOrUsage, parsed.Error!.ExitCode);
+        Assert.Equal(errorCode, Assert.Single(parsed.Error.Errors).Code);
+    }
+
+    [Fact]
+    public void RelativeAndCredentialPaths_AreRejectedBeforeAnyFileRead()
+    {
+        AutomationParseResult relative = AutomationCommandLine.Parse(
+            ["status", "--codex-home", "../escape"]);
+        string authPath = Path.Combine(Path.GetTempPath(), "auth.json");
+        AutomationParseResult credential = AutomationCommandLine.Parse(
+            ["sync", "--codex-home", Path.GetTempPath(), "--provider", "relay", "--apply", "--plan", authPath, "--plan-digest", new string('a', 64)]);
+
+        Assert.Equal("path_escape", Assert.Single(relative.Error!.Errors).Code);
+        // Missing files are rejected before their contents can be inspected.
+        Assert.Contains(
+            Assert.Single(credential.Error!.Errors).Code,
+            new[] { "path_not_found", "credential_path_forbidden" });
+    }
+
+    [Fact]
+    public void AllWriteInputs_AreNormalizedAndTyped()
+    {
+        using TemporaryDirectory temporary = new();
+        string backup = Directory.CreateDirectory(Path.Combine(temporary.Path, "backup")).FullName;
+        string sqliteHome = Directory.CreateDirectory(Path.Combine(temporary.Path, "sqlite")).FullName;
+        string homeWithDots = Path.Combine(temporary.Path, "child", "..", "home");
+        Directory.CreateDirectory(Path.GetFullPath(homeWithDots));
+        AutomationParseResult change = AutomationCommandLine.Parse(
+        [
+            "switch", "--codex-home", homeWithDots, "--provider", "  relay  ",
+            "--model-mode", "custom", "--model", "  model-x  ", "--keep", "3"
+        ]);
+        AutomationParseResult restore = AutomationCommandLine.Parse(
+        [
+            "plan", "--operation", "restore", "--codex-home", temporary.Path,
+            "--backup", backup, "--sqlite-home", sqliteHome,
+            "--no-config", "--allow-sqlite-home-relocation"
+        ]);
+
+        SwitchIntent switchIntent = Assert.IsType<SwitchIntent>(change.Invocation!.Intent);
+        Assert.Equal(Path.GetFullPath(homeWithDots), switchIntent.CodexHome);
+        Assert.Equal("relay", switchIntent.ProviderId);
+        Assert.Equal("model-x", Assert.IsType<CustomModelSelection>(switchIntent.ModelSelection).Model);
+        Assert.Equal(3, switchIntent.BackupRetentionCount);
+        RestoreIntent restoreIntent = Assert.IsType<RestoreIntent>(restore.Invocation!.Intent);
+        Assert.False(restoreIntent.RestoreConfig);
+        Assert.True(restoreIntent.RestoreDatabase);
+        Assert.True(restoreIntent.RestoreSessions);
+        Assert.True(restoreIntent.AllowSqliteHomeRelocation);
+    }
+
+    [Theory]
+    [InlineData("restore")]
+    [InlineData("plan")]
+    public void SqliteHomeRelocation_RequiresExplicitSqliteHomeAndNoConfig(string command)
+    {
+        using TemporaryDirectory temporary = new();
+        string backup = Directory.CreateDirectory(Path.Combine(temporary.Path, "backup")).FullName;
+        string sqliteHome = Directory.CreateDirectory(Path.Combine(temporary.Path, "sqlite")).FullName;
+
+        List<string> missingSqlite = command == "plan"
+            ? ["plan", "--operation", "restore", "--codex-home", temporary.Path, "--backup", backup, "--no-config", "--allow-sqlite-home-relocation"]
+            : ["restore", "--codex-home", temporary.Path, "--backup", backup, "--no-config", "--allow-sqlite-home-relocation"];
+        List<string> restoresConfig = command == "plan"
+            ? ["plan", "--operation", "restore", "--codex-home", temporary.Path, "--backup", backup, "--sqlite-home", sqliteHome, "--allow-sqlite-home-relocation"]
+            : ["restore", "--codex-home", temporary.Path, "--backup", backup, "--sqlite-home", sqliteHome, "--allow-sqlite-home-relocation"];
+
+        AutomationParseResult withoutSqlite = AutomationCommandLine.Parse(missingSqlite);
+        AutomationParseResult withConfigRestore = AutomationCommandLine.Parse(restoresConfig);
+
+        Assert.Equal(AutomationExitCodes.ValidationOrUsage, withoutSqlite.Error!.ExitCode);
+        Assert.Equal(
+            "sqlite_home_relocation_requires_explicit_target_and_no_config",
+            Assert.Single(withoutSqlite.Error.Errors).Code);
+        Assert.Equal(
+            "sqlite_home_relocation_requires_explicit_target_and_no_config",
+            Assert.Single(withConfigRestore.Error!.Errors).Code);
+    }
+
+    [Fact]
+    public void ApplyRequiresExactDigestAndPlanTogether()
+    {
+        using TemporaryDirectory temporary = new();
+        string plan = Path.Combine(temporary.Path, "plan.json");
+        File.WriteAllText(plan, "{}");
+
+        AutomationParseResult missingDigest = AutomationCommandLine.Parse(
+        [
+            "sync", "--codex-home", temporary.Path, "--provider", "relay",
+            "--apply", "--plan", plan
+        ]);
+        AutomationParseResult uppercaseDigest = AutomationCommandLine.Parse(
+        [
+            "sync", "--codex-home", temporary.Path, "--provider", "relay",
+            "--apply", "--plan", plan, "--plan-digest", new string('A', 64)
+        ]);
+
+        Assert.Equal("plan_required", Assert.Single(missingDigest.Error!.Errors).Code);
+        Assert.Equal("plan_digest_invalid", Assert.Single(uppercaseDigest.Error!.Errors).Code);
+    }
+}
+
+internal sealed class TemporaryDirectory : IDisposable
+{
+    public TemporaryDirectory()
+    {
+        Path = System.IO.Path.Combine(
+            System.IO.Path.GetTempPath(),
+            $"codex-provider-sync-automation-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(Path);
+    }
+
+    public string Path { get; }
+
+    public void Dispose()
+    {
+        try
+        {
+            Directory.Delete(Path, recursive: true);
+        }
+        catch
+        {
+            // Test cleanup must not hide the assertion result.
+        }
+    }
+}
diff --git a/desktop/CodexProviderSync.Automation.Tests/AutomationHostTests.cs b/desktop/CodexProviderSync.Automation.Tests/AutomationHostTests.cs
new file mode 100644
index 0000000..7f6e274
--- /dev/null
+++ b/desktop/CodexProviderSync.Automation.Tests/AutomationHostTests.cs
@@ -0,0 +1,508 @@
+using System.Text.Json;
+using CodexProviderSync.Application;
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.Automation.Tests;
+
+public sealed class AutomationHostTests
+{
+    [Fact]
+    public async Task DescribeAndStatus_UseTheSharedApplicationServiceContract()
+    {
+        using TemporaryDirectory temporary = new();
+        TestFactory factory = new();
+        AutomationHost host = new(factory);
+
+        AutomationRunResult describe = await host.RunAsync(["describe"]);
+        AutomationRunResult status = await host.RunAsync(
+            ["status", "--codex-home", temporary.Path]);
+
+        Assert.Equal(AutomationExitCodes.Success, describe.ExitCode);
+        Assert.Equal("success", describe.Response.Result);
+        Assert.Equal(ApplicationProtocol.Version, describe.Response.ProtocolVersion);
+        Assert.IsType<ApplicationDescription>(describe.Response.Data);
+        Assert.Equal(AutomationExitCodes.Success, status.ExitCode);
+        StatusSnapshot snapshot = Assert.IsType<StatusSnapshot>(status.Response.Data);
+        Assert.Equal(Path.GetFullPath(temporary.Path), snapshot.CodexHome);
+        Assert.Equal(0, factory.Write.ExecuteCalls);
+    }
+
+    [Theory]
+    [InlineData("sync")]
+    [InlineData("switch")]
+    [InlineData("restore")]
+    [InlineData("prune")]
+    public async Task EveryWrite_DefaultsToDurablePlanOnly(string command)
+    {
+        using TemporaryDirectory temporary = new();
+        string backup = Directory.CreateDirectory(Path.Combine(temporary.Path, "backup")).FullName;
+        string ledger = Path.Combine(temporary.Path, "ledger");
+        TestFactory factory = new();
+        AutomationHost host = new(factory);
+        string[] args = WriteArgs(command, temporary.Path, ledger, backup);
+
+        AutomationRunResult result = await host.RunAsync(args);
+
+        Assert.Equal(AutomationExitCodes.Success, result.ExitCode);
+        Assert.Equal("readyToApply", result.Response.Lifecycle);
+        Assert.Equal(0, factory.Write.ExecuteCalls);
+        Assert.IsAssignableFrom<object>(result.Response.Data);
+        Assert.NotEmpty(Directory.EnumerateFiles(Path.Combine(ledger, "entries")));
+    }
+
+    [Fact]
+    public async Task PlanThenApply_RequiresExactFreshSingleUseDocumentAcrossHostInstances()
+    {
+        using TemporaryDirectory temporary = new();
+        string ledger = Path.Combine(temporary.Path, "ledger");
+        string planPath = Path.Combine(temporary.Path, "plan.json");
+        TestFactory factory = new();
+        AutomationHost planner = new(factory);
+        AutomationRunResult planned = await planner.RunAsync(
+        [
+            "plan", "--operation", "sync", "--codex-home", temporary.Path,
+            "--provider", "relay", "--ledger-root", ledger
+        ]);
+        ApplicationOperationPlan plan = Assert.IsType<ApplicationOperationPlan>(planned.Response.Data);
+        await File.WriteAllTextAsync(
+            planPath,
+            JsonSerializer.Serialize(plan, AutomationJson.Options));
+        string[] applyArgs =
+        [
+            "sync", "--codex-home", temporary.Path, "--provider", "relay",
+            "--ledger-root", ledger, "--apply", "--plan", planPath,
+            "--plan-digest", plan.Digest
+        ];
+
+        AutomationRunResult applied = await new AutomationHost(factory).RunAsync(applyArgs);
+        AutomationRunResult duplicate = await new AutomationHost(factory).RunAsync(applyArgs);
+
+        Assert.Equal(AutomationExitCodes.Success, applied.ExitCode);
+        Assert.Equal("succeeded", applied.Response.Lifecycle);
+        Assert.True(Assert.IsType<ApplicationWriteResult<SyncResult>>(applied.Response.Data).Applied);
+        Assert.Equal(AutomationExitCodes.InvalidPlan, duplicate.ExitCode);
+        Assert.Equal("plan_already_used", Assert.Single(duplicate.Response.Errors).Code);
+        Assert.Equal(1, factory.Write.ExecuteCalls);
+    }
+
+    [Fact]
+    public async Task TamperedMalformedAndExpiredPlans_AreRejectedBeforeCoreExecution()
+    {
+        using TemporaryDirectory temporary = new();
+        string ledger = Path.Combine(temporary.Path, "ledger");
+        string planPath = Path.Combine(temporary.Path, "plan.json");
+        TestClock clock = new(DateTimeOffset.Parse("2026-08-04T00:00:00Z"));
+        TestFactory factory = new(clock);
+        AutomationHost host = new(factory);
+        AutomationRunResult planned = await host.RunAsync(
+        [
+            "sync", "--codex-home", temporary.Path, "--provider", "relay",
+            "--ledger-root", ledger
+        ]);
+        ApplicationWriteResult<SyncResult> dryRun = Assert.IsType<ApplicationWriteResult<SyncResult>>(planned.Response.Data);
+        ApplicationOperationPlan plan = dryRun.Plan;
+        ApplicationOperationPlan tampered = plan with
+        {
+            Targets = [new ApplicationPlanTarget(Path.Combine(temporary.Path, "other"), "replace", "changed")]
+        };
+        await File.WriteAllTextAsync(planPath, JsonSerializer.Serialize(tampered, AutomationJson.Options));
+        string[] apply =
+        [
+            "sync", "--codex-home", temporary.Path, "--provider", "relay",
+            "--ledger-root", ledger, "--apply", "--plan", planPath,
+            "--plan-digest", plan.Digest
+        ];
+
+        AutomationRunResult changed = await host.RunAsync(apply);
+        await File.WriteAllTextAsync(planPath, "{\"unknown\":true}");
+        AutomationRunResult malformed = await host.RunAsync(apply);
+        await File.WriteAllTextAsync(planPath, JsonSerializer.Serialize(plan, AutomationJson.Options));
+        clock.Advance(TimeSpan.FromMinutes(11));
+        AutomationRunResult expired = await host.RunAsync(apply);
+
+        Assert.Equal("plan_digest_mismatch", Assert.Single(changed.Response.Errors).Code);
+        Assert.Equal("plan_document_malformed", Assert.Single(malformed.Response.Errors).Code);
+        Assert.Equal("plan_expired", Assert.Single(expired.Response.Errors).Code);
+        Assert.All(
+            new[] { changed.ExitCode, malformed.ExitCode, expired.ExitCode },
+            code => Assert.Equal(AutomationExitCodes.InvalidPlan, code));
+        Assert.Equal(0, factory.Write.ExecuteCalls);
+    }
+
+    [Fact]
+    public async Task TimeoutAndConcurrentUse_HaveStableExitCodes()
+    {
+        using TemporaryDirectory temporary = new();
+        string ledger = Path.Combine(temporary.Path, "ledger");
+        TestFactory timeoutFactory = new();
+        timeoutFactory.Write.PlanHandler = async (_, _, token) =>
+        {
+            await Task.Delay(Timeout.InfiniteTimeSpan, token);
+            throw new InvalidOperationException("unreachable");
+        };
+        AutomationRunResult timedOut = await new AutomationHost(timeoutFactory).RunAsync(
+        [
+            "plan", "--operation", "sync", "--codex-home", temporary.Path,
+            "--provider", "relay", "--ledger-root", ledger, "--timeout-ms", "20"
+        ]);
+
+        TestFactory busyFactory = new();
+        TaskCompletionSource<ApplicationPlanPreview> pending = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        TaskCompletionSource started = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        busyFactory.Write.PlanHandler = (_, _, _) =>
+        {
+            started.TrySetResult();
+            return pending.Task;
+        };
+        IApplicationService shared = busyFactory.CreateService(
+            new FileApplicationPlanLedger(Path.Combine(temporary.Path, "busy-ledger")));
+        AutomationHost busyHost = new(new FixedServiceFactory(shared));
+        Task<AutomationRunResult> active = busyHost.RunAsync(
+        [
+            "plan", "--operation", "sync", "--codex-home", temporary.Path,
+            "--provider", "relay", "--ledger-root", Path.Combine(temporary.Path, "busy-ledger")
+        ]);
+        await started.Task;
+        AutomationRunResult busy = await busyHost.RunAsync(
+            ["status", "--codex-home", temporary.Path]);
+        pending.SetResult(busyFactory.Write.Preview(new SyncIntent(temporary.Path, null, "relay")));
+        await active;
+
+        Assert.Equal(AutomationExitCodes.CancelledOrTimedOut, timedOut.ExitCode);
+        Assert.Equal("timeout", Assert.Single(timedOut.Response.Errors).Code);
+        Assert.Equal(AutomationExitCodes.Busy, busy.ExitCode);
+        Assert.Equal("operation_busy", Assert.Single(busy.Response.Errors).Code);
+    }
+
+    [Fact]
+    public async Task CallerCancellation_IsDistinctFromTimeout()
+    {
+        using TemporaryDirectory temporary = new();
+        TestFactory factory = new();
+        TaskCompletionSource started = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        factory.Write.PlanHandler = async (_, _, token) =>
+        {
+            started.TrySetResult();
+            await Task.Delay(Timeout.InfiniteTimeSpan, token);
+            throw new InvalidOperationException("unreachable");
+        };
+        using CancellationTokenSource cancellation = new();
+        Task<AutomationRunResult> running = new AutomationHost(factory).RunAsync(
+        [
+            "plan", "--operation", "sync", "--codex-home", temporary.Path,
+            "--provider", "relay", "--ledger-root", Path.Combine(temporary.Path, "ledger")
+        ], cancellation.Token);
+        await started.Task;
+
+        cancellation.Cancel();
+        AutomationRunResult result = await running;
+
+        Assert.Equal(AutomationExitCodes.CancelledOrTimedOut, result.ExitCode);
+        Assert.Equal("cancelled", result.Response.Lifecycle);
+        Assert.Equal("cancelled", Assert.Single(result.Response.Errors).Code);
+    }
+
+    [Fact]
+    public async Task RollbackAndRecoveryOutcomes_AreDistinct()
+    {
+        using TemporaryDirectory temporary = new();
+        string ledger = Path.Combine(temporary.Path, "ledger");
+        string planPath = Path.Combine(temporary.Path, "plan.json");
+        TestFactory factory = new();
+        ApplicationOperationPlan rollbackPlan = await CreateSyncPlanAsync(factory, temporary.Path, ledger, planPath);
+        factory.Write.SyncHandler = (_, _, _, _) => throw new SyncTransactionException(
+            new IOException("injected"),
+            [],
+            Path.Combine(temporary.Path, "backup"),
+            [],
+            [],
+            rollbackStatus: "complete",
+            recoveryRequired: false);
+        AutomationRunResult rollback = await ApplySyncAsync(factory, temporary.Path, ledger, planPath, rollbackPlan.Digest);
+
+        string recoveryLedger = Path.Combine(temporary.Path, "recovery-ledger");
+        ApplicationOperationPlan recoveryPlan = await CreateSyncPlanAsync(factory, temporary.Path, recoveryLedger, planPath);
+        factory.Write.SyncHandler = (_, _, _, _) => throw new ApplicationPortException(
+            "recovery_required",
+            "rollback incomplete",
+            recoveryRequired: true,
+            rollbackStatus: "incomplete");
+        AutomationRunResult recovery = await ApplySyncAsync(factory, temporary.Path, recoveryLedger, planPath, recoveryPlan.Digest);
+
+        Assert.Equal(AutomationExitCodes.RolledBackFailure, rollback.ExitCode);
+        Assert.Equal("rollback", rollback.Response.Result);
+        Assert.Equal(AutomationExitCodes.RecoveryRequired, recovery.ExitCode);
+        Assert.Equal("recovery", recovery.Response.Result);
+    }
+
+    [Fact]
+    public async Task FailedBeforeApplying_UsesValidationExitCode()
+    {
+        using TemporaryDirectory temporary = new();
+        TestFactory factory = new();
+        factory.Write.PlanHandler = (_, _, _) => throw new ApplicationPortException(
+            "provider_missing",
+            "The selected provider is not configured.");
+
+        AutomationRunResult result = await new AutomationHost(factory).RunAsync(
+        [
+            "switch", "--codex-home", temporary.Path, "--provider", "missing",
+            "--ledger-root", Path.Combine(temporary.Path, "ledger")
+        ]);
+
+        Assert.Equal(AutomationExitCodes.ValidationOrUsage, result.ExitCode);
+        Assert.Equal("failed", result.Response.Lifecycle);
+        Assert.DoesNotContain(result.Response.Timeline, static entry =>
+            entry.Lifecycle == ApplicationOperationLifecycle.Applying);
+        Assert.Equal(0, factory.Write.ExecuteCalls);
+    }
+
+    [Fact]
+    public async Task FailedAfterApplyingWithoutCompleteRollback_FailsClosed()
+    {
+        using TemporaryDirectory temporary = new();
+        string ledger = Path.Combine(temporary.Path, "ledger");
+        string planPath = Path.Combine(temporary.Path, "plan.json");
+        TestFactory factory = new();
+        ApplicationOperationPlan plan = await CreateSyncPlanAsync(factory, temporary.Path, ledger, planPath);
+        factory.Write.SyncHandler = (_, _, _, _) => throw new ApplicationPortException(
+            "operation_failed",
+            "The mutation outcome is unknown.");
+
+        AutomationRunResult result = await ApplySyncAsync(
+            factory,
+            temporary.Path,
+            ledger,
+            planPath,
+            plan.Digest);
+
+        Assert.Equal(AutomationExitCodes.InternalProtocolFailure, result.ExitCode);
+        Assert.Contains(result.Response.Timeline, static entry =>
+            entry.Lifecycle == ApplicationOperationLifecycle.Applying);
+    }
+
+    private static async Task<ApplicationOperationPlan> CreateSyncPlanAsync(
+        TestFactory factory,
+        string home,
+        string ledger,
+        string planPath)
+    {
+        AutomationRunResult result = await new AutomationHost(factory).RunAsync(
+        [
+            "sync", "--codex-home", home, "--provider", "relay", "--ledger-root", ledger
+        ]);
+        ApplicationOperationPlan plan = Assert.IsType<ApplicationWriteResult<SyncResult>>(result.Response.Data).Plan;
+        await File.WriteAllTextAsync(planPath, JsonSerializer.Serialize(plan, AutomationJson.Options));
+        return plan;
+    }
+
+    private static Task<AutomationRunResult> ApplySyncAsync(
+        TestFactory factory,
+        string home,
+        string ledger,
+        string planPath,
+        string digest)
+    {
+        return new AutomationHost(factory).RunAsync(
+        [
+            "sync", "--codex-home", home, "--provider", "relay", "--ledger-root", ledger,
+            "--apply", "--plan", planPath, "--plan-digest", digest
+        ]);
+    }
+
+    private static string[] WriteArgs(string command, string home, string ledger, string backup)
+    {
+        List<string> args = [command, "--codex-home", home, "--ledger-root", ledger];
+        switch (command)
+        {
+            case "sync":
+                args.AddRange(["--provider", "relay"]);
+                break;
+            case "switch":
+                args.AddRange(["--provider", "relay", "--model-mode", "keep-root"]);
+                break;
+            case "restore":
+                args.AddRange(["--backup", backup]);
+                break;
+            case "prune":
+                args.AddRange(["--keep", "3"]);
+                break;
+        }
+        return args.ToArray();
+    }
+}
+
+internal sealed class FixedServiceFactory(IApplicationService service) : IAutomationApplicationFactory
+{
+    public IApplicationService Create(AutomationInvocation invocation) => service;
+}
+
+internal sealed class TestFactory : IAutomationApplicationFactory
+{
+    private int _nextId;
+
+    public TestFactory(TestClock? clock = null)
+    {
+        Clock = clock ?? new TestClock(DateTimeOffset.Parse("2026-08-04T00:00:00Z"));
+    }
+
+    public TestClock Clock { get; }
+
+    public TestWritePort Write { get; } = new();
+
+    public IApplicationService Create(AutomationInvocation invocation)
+    {
+        IApplicationPlanLedger ledger = invocation.IsWrite
+            ? new FileApplicationPlanLedger(invocation.LedgerRoot!)
+            : new InMemoryApplicationPlanLedger();
+        return CreateService(ledger);
+    }
+
+    public IApplicationService CreateService(IApplicationPlanLedger ledger)
+    {
+        return new ApplicationService(
+            new TestStatusPort(),
+            Write,
+            ledger,
+            Clock,
+            () => $"test-{Interlocked.Increment(ref _nextId):D6}");
+    }
+}
+
+internal sealed class TestStatusPort : IApplicationStatusPort
+{
+    public Task<StatusSnapshot> GetStatusAsync(
+        ApplicationStatusRequest request,
+        CancellationToken cancellationToken = default)
+    {
+        cancellationToken.ThrowIfCancellationRequested();
+        return Task.FromResult(TestData.Status(Path.GetFullPath(request.CodexHome)));
+    }
+}
+
+internal sealed class TestWritePort : IApplicationWritePort
+{
+    public int ExecuteCalls;
+
+    public Func<ApplicationWriteIntent, string, CancellationToken, Task<ApplicationPlanPreview>>? PlanHandler { get; set; }
+
+    public Func<SyncIntent, ApplicationOperationPlan, string, CancellationToken, Task<SyncResult>>? SyncHandler { get; set; }
+
+    public Task<ApplicationPlanPreview> CreatePlanAsync(
+        ApplicationWriteIntent intent,
+        string operationId,
+        CancellationToken cancellationToken = default)
+    {
+        return PlanHandler?.Invoke(intent, operationId, cancellationToken)
+            ?? Task.FromResult(Preview(intent));
+    }
+
+    public ApplicationPlanPreview Preview(ApplicationWriteIntent intent)
+    {
+        return new ApplicationPlanPreview(
+            intent,
+            "state-fixture",
+            "execution-fixture",
+            [new ApplicationPlanTarget(Path.Combine(intent.CodexHome, "config.toml"), "replace", "sha256:fixture")]);
+    }
+
+    public async Task<SyncResult> ExecuteSyncAsync(
+        SyncIntent intent,
+        ApplicationOperationPlan plan,
+        string operationId,
+        CancellationToken cancellationToken = default)
+    {
+        Interlocked.Increment(ref ExecuteCalls);
+        return SyncHandler is null
+            ? TestData.Sync(intent)
+            : await SyncHandler(intent, plan, operationId, cancellationToken);
+    }
+
+    public Task<SyncResult> ExecuteSwitchAsync(
+        SwitchIntent intent,
+        ApplicationOperationPlan plan,
+        string operationId,
+        CancellationToken cancellationToken = default)
+    {
+        Interlocked.Increment(ref ExecuteCalls);
+        return Task.FromResult(TestData.Sync(intent));
+    }
+
+    public Task<RestoreResult> ExecuteRestoreAsync(
+        RestoreIntent intent,
+        ApplicationOperationPlan plan,
+        string operationId,
+        CancellationToken cancellationToken = default)
+    {
+        Interlocked.Increment(ref ExecuteCalls);
+        return Task.FromResult(new RestoreResult
+        {
+            CodexHome = intent.CodexHome,
+            BackupDir = intent.BackupDirectory,
+            TargetProvider = "relay"
+        });
+    }
+
+    public Task<BackupPruneResult> ExecutePruneAsync(
+        PruneIntent intent,
+        ApplicationOperationPlan plan,
+        string operationId,
+        CancellationToken cancellationToken = default)
+    {
+        Interlocked.Increment(ref ExecuteCalls);
+        return Task.FromResult(new BackupPruneResult
+        {
+            BackupRoot = Path.Combine(intent.CodexHome, "backups_state", "provider-sync"),
+            DeletedCount = 1,
+            RemainingCount = intent.BackupRetentionCount,
+            FreedBytes = 10
+        });
+    }
+}
+
+internal sealed class TestClock(DateTimeOffset now) : TimeProvider
+{
+    private DateTimeOffset _now = now;
+
+    public override DateTimeOffset GetUtcNow() => _now;
+
+    public void Advance(TimeSpan value) => _now = _now.Add(value);
+}
+
+internal static class TestData
+{
+    public static StatusSnapshot Status(string home) => new()
+    {
+        CodexHome = home,
+        SqliteHome = Path.Combine(home, "sqlite"),
+        CurrentProvider = new CurrentProviderInfo("openai", false),
+        ConfiguredProviders = ["openai", "relay"],
+        RolloutCounts = new ProviderCounts(),
+        LockedRolloutFiles = [],
+        UnreadableRolloutFiles = [],
+        EncryptedContentCounts = new ProviderCounts(),
+        SqliteCounts = null,
+        BackupRoot = Path.Combine(home, "backups_state", "provider-sync"),
+        BackupSummary = new BackupSummary { Count = 0, TotalBytes = 0 }
+    };
+
+    public static SyncResult Sync(ApplicationWriteIntent intent) => new()
+    {
+        CodexHome = intent.CodexHome,
+        TargetProvider = intent switch
+        {
+            SyncIntent sync => sync.ProviderId,
+            SwitchIntent change => change.ProviderId,
+            _ => "relay"
+        },
+        PreviousProvider = "openai",
+        BackupDir = Path.Combine(intent.CodexHome, "backups_state", "provider-sync", "fixture"),
+        ChangedSessionFiles = 0,
+        SkippedLockedRolloutFiles = [],
+        SkippedUnreadableRolloutFiles = [],
+        SqliteRowsUpdated = 0,
+        SqlitePresent = false,
+        RolloutCountsBefore = new ProviderCounts(),
+        EncryptedContentCounts = new ProviderCounts()
+    };
+}
diff --git a/desktop/CodexProviderSync.Automation.Tests/AutomationProcessAndSchemaTests.cs b/desktop/CodexProviderSync.Automation.Tests/AutomationProcessAndSchemaTests.cs
new file mode 100644
index 0000000..da20dfc
--- /dev/null
+++ b/desktop/CodexProviderSync.Automation.Tests/AutomationProcessAndSchemaTests.cs
@@ -0,0 +1,300 @@
+using System.Diagnostics;
+using System.Reflection;
+using System.Text.Json;
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.Automation.Tests;
+
+public sealed class AutomationProcessAndSchemaTests
+{
+    [Fact]
+    public void Schema_IsEmbeddedCopiedAndDeclaresTheStableProtocolSurface()
+    {
+        Assembly assembly = typeof(Program).Assembly;
+        string resourceName = "CodexProviderSync.Automation.automation-protocol-v0.4.schema.json";
+        Assert.Contains(resourceName, assembly.GetManifestResourceNames());
+        using Stream stream = assembly.GetManifestResourceStream(resourceName)!;
+        using JsonDocument schema = JsonDocument.Parse(stream);
+        JsonElement root = schema.RootElement;
+
+        Assert.Equal("https://json-schema.org/draft/2020-12/schema", root.GetProperty("$schema").GetString());
+        JsonElement definitions = root.GetProperty("$defs");
+        JsonElement exitCodes = definitions.GetProperty("response").GetProperty("properties").GetProperty("exitCode").GetProperty("enum");
+        Assert.Equal(new[] { 0, 2, 3, 4, 5, 6, 7, 10 }, exitCodes.EnumerateArray().Select(static value => value.GetInt32()));
+        Assert.Equal(
+            "^[0-9a-f]{64}$",
+            definitions.GetProperty("operationPlan").GetProperty("properties").GetProperty("digest").GetProperty("pattern").GetString());
+        string copied = Path.Combine(Path.GetDirectoryName(assembly.Location)!, "automation-protocol-v0.4.schema.json");
+        Assert.True(File.Exists(copied));
+    }
+
+    [Fact]
+    public async Task Process_EmitsExactlyOneJsonDocumentAndUsesStderrForDiagnostics()
+    {
+        ProcessResult described = await RunProcessAsync("describe");
+        ProcessResult unknown = await RunProcessAsync("unknown-command");
+
+        Assert.Equal(0, described.ExitCode);
+        Assert.Single(NonEmptyLines(described.StdOut));
+        using JsonDocument description = JsonDocument.Parse(described.StdOut);
+        Assert.Equal("0.4", description.RootElement.GetProperty("protocolVersion").GetString());
+        Assert.Equal("success", description.RootElement.GetProperty("result").GetString());
+        Assert.True(string.IsNullOrWhiteSpace(described.StdErr));
+
+        Assert.Equal(AutomationExitCodes.ValidationOrUsage, unknown.ExitCode);
+        Assert.Single(NonEmptyLines(unknown.StdOut));
+        using JsonDocument failure = JsonDocument.Parse(unknown.StdOut);
+        Assert.Equal("unknown_command", failure.RootElement.GetProperty("errors")[0].GetProperty("code").GetString());
+        Assert.Contains("Unknown command", unknown.StdErr, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task Process_StatusUsesOnlyTheExplicitFixtureHome()
+    {
+        using TemporaryDirectory temporary = new();
+        await File.WriteAllTextAsync(
+            Path.Combine(temporary.Path, "config.toml"),
+            "model_provider = \"openai\"\n");
+
+        ProcessResult result = await RunProcessAsync("status", "--codex-home", temporary.Path);
+
+        Assert.Equal(0, result.ExitCode);
+        using JsonDocument json = JsonDocument.Parse(result.StdOut);
+        Assert.Equal(
+            Path.GetFullPath(temporary.Path),
+            json.RootElement.GetProperty("data").GetProperty("codexHome").GetString());
+        Assert.False(File.Exists(Path.Combine(temporary.Path, "auth.json")));
+    }
+
+    [Fact]
+    public async Task Process_WritePlanUsesTheProductionCoreAdapterWithoutMutation()
+    {
+        using TemporaryDirectory temporary = new();
+        string ledger = Path.Combine(temporary.Path, "ledger");
+        Directory.CreateDirectory(Path.Combine(temporary.Path, "sessions"));
+        Directory.CreateDirectory(Path.Combine(temporary.Path, "archived_sessions"));
+        await File.WriteAllTextAsync(
+            Path.Combine(temporary.Path, "config.toml"),
+            "model_provider = \"openai\"\n");
+
+        ProcessResult result = await RunProcessAsync(
+            "plan",
+            "--operation",
+            "sync",
+            "--codex-home",
+            temporary.Path,
+            "--provider",
+            "relay",
+            "--ledger-root",
+            ledger);
+
+        Assert.Equal(AutomationExitCodes.Success, result.ExitCode);
+        using JsonDocument json = JsonDocument.Parse(result.StdOut);
+        Assert.Equal("readyToApply", json.RootElement.GetProperty("lifecycle").GetString());
+        Assert.Equal(64, json.RootElement.GetProperty("data").GetProperty("digest").GetString()!.Length);
+        Assert.True(Directory.Exists(ledger));
+        Assert.False(Directory.Exists(Path.Combine(
+            temporary.Path,
+            "backups_state",
+            "provider-sync")));
+    }
+
+    [Fact]
+    public async Task Process_UndeclaredSwitchProviderIsUsageFailureWithoutWrites()
+    {
+        using TemporaryDirectory temporary = new();
+        await File.WriteAllTextAsync(
+            Path.Combine(temporary.Path, "config.toml"),
+            "model_provider = \"openai\"\n");
+
+        ProcessResult result = await RunProcessAsync(
+            "plan", "--operation", "switch",
+            "--codex-home", temporary.Path,
+            "--provider", "missing-provider",
+            "--ledger-root", Path.Combine(temporary.Path, "ledger"));
+
+        Assert.Equal(AutomationExitCodes.ValidationOrUsage, result.ExitCode);
+        using JsonDocument json = JsonDocument.Parse(result.StdOut);
+        Assert.Equal("failed", json.RootElement.GetProperty("lifecycle").GetString());
+        Assert.Equal("operation_failed", json.RootElement.GetProperty("errors")[0].GetProperty("code").GetString());
+        Assert.False(Directory.Exists(Path.Combine(temporary.Path, "backups_state", "provider-sync")));
+    }
+
+    [Fact]
+    public async Task Process_ExplicitApplyExecutesExactPlanOnceAcrossProcessBoundaries()
+    {
+        using TemporaryDirectory temporary = new();
+        string ledger = Path.Combine(temporary.Path, "ledger");
+        string sessions = Path.Combine(temporary.Path, "sessions");
+        Directory.CreateDirectory(sessions);
+        Directory.CreateDirectory(Path.Combine(temporary.Path, "archived_sessions"));
+        await File.WriteAllTextAsync(
+            Path.Combine(temporary.Path, "config.toml"),
+            "model_provider = \"openai\"\n");
+        string rolloutPath = Path.Combine(sessions, "rollout-process.jsonl");
+        await File.WriteAllTextAsync(
+            rolloutPath,
+            "{\"type\":\"session_meta\",\"payload\":{\"id\":\"thread-process\",\"cwd\":\"C:\\\\fixture\",\"model_provider\":\"relay\"}}\n");
+
+        ProcessResult planned = await RunProcessAsync(
+            "plan", "--operation", "sync",
+            "--codex-home", temporary.Path,
+            "--provider", "openai",
+            "--ledger-root", ledger);
+        Assert.Equal(AutomationExitCodes.Success, planned.ExitCode);
+        using JsonDocument planResponse = JsonDocument.Parse(planned.StdOut);
+        JsonElement plan = planResponse.RootElement.GetProperty("data");
+        string digest = plan.GetProperty("digest").GetString()!;
+        string planPath = Path.Combine(temporary.Path, "plan.json");
+        await File.WriteAllTextAsync(planPath, plan.GetRawText());
+
+        ProcessResult applied = await RunProcessAsync(
+            "sync", "--codex-home", temporary.Path,
+            "--provider", "openai",
+            "--ledger-root", ledger,
+            "--apply", "--plan", planPath,
+            "--plan-digest", digest);
+        ProcessResult duplicate = await RunProcessAsync(
+            "sync", "--codex-home", temporary.Path,
+            "--provider", "openai",
+            "--ledger-root", ledger,
+            "--apply", "--plan", planPath,
+            "--plan-digest", digest);
+
+        Assert.Equal(AutomationExitCodes.Success, applied.ExitCode);
+        Assert.Contains("\"model_provider\":\"openai\"", await File.ReadAllTextAsync(rolloutPath));
+        Assert.Equal(AutomationExitCodes.InvalidPlan, duplicate.ExitCode);
+        using JsonDocument duplicateResponse = JsonDocument.Parse(duplicate.StdOut);
+        Assert.Equal(
+            "plan_already_used",
+            duplicateResponse.RootElement.GetProperty("errors")[0].GetProperty("code").GetString());
+    }
+
+    [Fact]
+    public async Task Process_DriftedPlanReturnsExitThreeWithoutCreatingABackup()
+    {
+        using TemporaryDirectory temporary = new();
+        string ledger = Path.Combine(temporary.Path, "ledger");
+        string sessions = Path.Combine(temporary.Path, "sessions");
+        Directory.CreateDirectory(sessions);
+        Directory.CreateDirectory(Path.Combine(temporary.Path, "archived_sessions"));
+        await File.WriteAllTextAsync(
+            Path.Combine(temporary.Path, "config.toml"),
+            "model_provider = \"openai\"\n");
+        string rolloutPath = Path.Combine(sessions, "rollout-drift.jsonl");
+        await File.WriteAllTextAsync(
+            rolloutPath,
+            "{\"type\":\"session_meta\",\"payload\":{\"id\":\"thread-drift\",\"cwd\":\"C:\\\\fixture\",\"model_provider\":\"relay\"}}\n");
+        ProcessResult planned = await RunProcessAsync(
+            "plan", "--operation", "sync",
+            "--codex-home", temporary.Path,
+            "--provider", "openai",
+            "--ledger-root", ledger);
+        using JsonDocument planResponse = JsonDocument.Parse(planned.StdOut);
+        JsonElement plan = planResponse.RootElement.GetProperty("data");
+        string digest = plan.GetProperty("digest").GetString()!;
+        string planPath = Path.Combine(temporary.Path, "plan.json");
+        await File.WriteAllTextAsync(planPath, plan.GetRawText());
+        await File.AppendAllTextAsync(
+            rolloutPath,
+            "{\"type\":\"event_msg\",\"payload\":{\"type\":\"agent_message\"}}\n");
+        string drifted = await File.ReadAllTextAsync(rolloutPath);
+
+        ProcessResult applied = await RunProcessAsync(
+            "sync", "--codex-home", temporary.Path,
+            "--provider", "openai",
+            "--ledger-root", ledger,
+            "--apply", "--plan", planPath,
+            "--plan-digest", digest);
+
+        Assert.Equal(AutomationExitCodes.InvalidPlan, applied.ExitCode);
+        using JsonDocument response = JsonDocument.Parse(applied.StdOut);
+        Assert.Equal(
+            "plan_stale",
+            response.RootElement.GetProperty("errors")[0].GetProperty("code").GetString());
+        Assert.Equal(drifted, await File.ReadAllTextAsync(rolloutPath));
+        Assert.False(Directory.Exists(Path.Combine(
+            temporary.Path,
+            "backups_state",
+            "provider-sync")));
+    }
+
+    [Fact]
+    public async Task Process_CoreLockContentionReturnsExitFourWithoutMutation()
+    {
+        using TemporaryDirectory temporary = new();
+        string ledger = Path.Combine(temporary.Path, "ledger");
+        string sessions = Path.Combine(temporary.Path, "sessions");
+        Directory.CreateDirectory(sessions);
+        Directory.CreateDirectory(Path.Combine(temporary.Path, "archived_sessions"));
+        await File.WriteAllTextAsync(
+            Path.Combine(temporary.Path, "config.toml"),
+            "model_provider = \"openai\"\n");
+        string rolloutPath = Path.Combine(sessions, "rollout-busy.jsonl");
+        await File.WriteAllTextAsync(
+            rolloutPath,
+            "{\"type\":\"session_meta\",\"payload\":{\"id\":\"thread-busy\",\"cwd\":\"C:\\\\fixture\",\"model_provider\":\"relay\"}}\n");
+        ProcessResult planned = await RunProcessAsync(
+            "plan", "--operation", "sync",
+            "--codex-home", temporary.Path,
+            "--provider", "openai",
+            "--ledger-root", ledger);
+        using JsonDocument planResponse = JsonDocument.Parse(planned.StdOut);
+        JsonElement plan = planResponse.RootElement.GetProperty("data");
+        string digest = plan.GetProperty("digest").GetString()!;
+        string planPath = Path.Combine(temporary.Path, "plan.json");
+        await File.WriteAllTextAsync(planPath, plan.GetRawText());
+        string before = await File.ReadAllTextAsync(rolloutPath);
+
+        await using LockHandle held = await new LockService().AcquireLockAsync(
+            temporary.Path,
+            "automation-process-test");
+        ProcessResult applied = await RunProcessAsync(
+            "sync", "--codex-home", temporary.Path,
+            "--provider", "openai",
+            "--ledger-root", ledger,
+            "--apply", "--plan", planPath,
+            "--plan-digest", digest);
+
+        Assert.Equal(AutomationExitCodes.Busy, applied.ExitCode);
+        using JsonDocument response = JsonDocument.Parse(applied.StdOut);
+        Assert.Equal(
+            "target_busy",
+            response.RootElement.GetProperty("errors")[0].GetProperty("code").GetString());
+        Assert.Equal(before, await File.ReadAllTextAsync(rolloutPath));
+        Assert.False(Directory.Exists(Path.Combine(
+            temporary.Path,
+            "backups_state",
+            "provider-sync")));
+    }
+
+    private static async Task<ProcessResult> RunProcessAsync(params string[] args)
+    {
+        string assemblyPath = typeof(Program).Assembly.Location;
+        ProcessStartInfo start = new("dotnet")
+        {
+            UseShellExecute = false,
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            CreateNoWindow = true
+        };
+        start.ArgumentList.Add(assemblyPath);
+        foreach (string argument in args)
+        {
+            start.ArgumentList.Add(argument);
+        }
+
+        using Process process = Process.Start(start)!;
+        string stdout = await process.StandardOutput.ReadToEndAsync();
+        string stderr = await process.StandardError.ReadToEndAsync();
+        await process.WaitForExitAsync();
+        return new ProcessResult(process.ExitCode, stdout, stderr);
+    }
+
+    private static string[] NonEmptyLines(string value)
+    {
+        return value.Split(['\r', '\n'], StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
+    }
+
+    private sealed record ProcessResult(int ExitCode, string StdOut, string StdErr);
+}
diff --git a/desktop/CodexProviderSync.Automation.Tests/CodexProviderSync.Automation.Tests.csproj b/desktop/CodexProviderSync.Automation.Tests/CodexProviderSync.Automation.Tests.csproj
new file mode 100644
index 0000000..39c422c
--- /dev/null
+++ b/desktop/CodexProviderSync.Automation.Tests/CodexProviderSync.Automation.Tests.csproj
@@ -0,0 +1,26 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+    <IsTestProject>true</IsTestProject>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\CodexProviderSync.Automation\CodexProviderSync.Automation.csproj" />
+  </ItemGroup>
+
+</Project>
diff --git a/desktop/CodexProviderSync.Automation/AutomationCommandLine.cs b/desktop/CodexProviderSync.Automation/AutomationCommandLine.cs
new file mode 100644
index 0000000..d894343
--- /dev/null
+++ b/desktop/CodexProviderSync.Automation/AutomationCommandLine.cs
@@ -0,0 +1,483 @@
+using System.Globalization;
+using CodexProviderSync.Application;
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.Automation;
+
+public static class AutomationCommandLine
+{
+    private const int MaximumTimeoutMilliseconds = 30 * 60 * 1000;
+
+    private static readonly HashSet<string> ValueOptions = new(StringComparer.Ordinal)
+    {
+        "--codex-home",
+        "--sqlite-home",
+        "--ledger-root",
+        "--timeout-ms",
+        "--operation",
+        "--provider",
+        "--keep",
+        "--model-mode",
+        "--model",
+        "--backup",
+        "--plan",
+        "--plan-digest"
+    };
+
+    private static readonly HashSet<string> FlagOptions = new(StringComparer.Ordinal)
+    {
+        "--apply",
+        "--no-config",
+        "--no-database",
+        "--no-sessions",
+        "--allow-sqlite-home-relocation"
+    };
+
+    public static AutomationParseResult Parse(IReadOnlyList<string> args)
+    {
+        if (args.Count == 0)
+        {
+            return Failure(string.Empty, "command_required", "A command is required.");
+        }
+
+        string commandName = args[0];
+        if (!TryParseCommand(commandName, out AutomationCommand command))
+        {
+            return Failure(commandName, "unknown_command", $"Unknown command: {commandName}");
+        }
+
+        Dictionary<string, string> values = new(StringComparer.Ordinal);
+        HashSet<string> flags = new(StringComparer.Ordinal);
+        for (int index = 1; index < args.Count; index++)
+        {
+            string option = args[index];
+            if (ValueOptions.Contains(option))
+            {
+                if (values.ContainsKey(option) || flags.Contains(option))
+                {
+                    return Failure(commandName, "duplicate_option", $"Option {option} may only be specified once.");
+                }
+                if (++index >= args.Count || args[index].StartsWith("--", StringComparison.Ordinal))
+                {
+                    return Failure(commandName, "option_value_required", $"Option {option} requires a value.");
+                }
+                values.Add(option, args[index]);
+                continue;
+            }
+            if (FlagOptions.Contains(option))
+            {
+                if (!flags.Add(option) || values.ContainsKey(option))
+                {
+                    return Failure(commandName, "duplicate_option", $"Option {option} may only be specified once.");
+                }
+                continue;
+            }
+
+            return Failure(commandName, "unknown_option", $"Unknown option: {option}");
+        }
+
+        try
+        {
+            ValidateAllowedOptions(command, values.Keys.Concat(flags));
+            TimeSpan? timeout = ParseTimeout(values.GetValueOrDefault("--timeout-ms"));
+            if (command == AutomationCommand.Describe)
+            {
+                return Success(new AutomationInvocation(
+                    command,
+                    commandName,
+                    null,
+                    null,
+                    false,
+                    null,
+                    null,
+                    null,
+                    timeout));
+            }
+
+            string codexHome = NormalizeDirectoryPath(
+                Required(values, "--codex-home"),
+                "--codex-home",
+                mustExist: true);
+            string? sqliteHome = OptionalDirectoryPath(
+                values.GetValueOrDefault("--sqlite-home"),
+                "--sqlite-home",
+                mustExist: true);
+            if (command == AutomationCommand.Status)
+            {
+                return Success(new AutomationInvocation(
+                    command,
+                    commandName,
+                    new ApplicationStatusRequest(codexHome, sqliteHome),
+                    null,
+                    false,
+                    null,
+                    null,
+                    null,
+                    timeout));
+            }
+
+            string? ledgerRoot = OptionalDirectoryPath(values.GetValueOrDefault("--ledger-root"), "--ledger-root")
+                ?? Path.Combine(codexHome, "tmp", "provider-sync-automation-ledger");
+            AutomationCommand intentCommand = command == AutomationCommand.Plan
+                ? ParseWriteCommand(Required(values, "--operation"))
+                : command;
+            if (command == AutomationCommand.Plan)
+            {
+                ValidatePlanOperationOptions(intentCommand, values.Keys.Concat(flags));
+            }
+            ApplicationWriteIntent intent = CreateIntent(intentCommand, codexHome, sqliteHome, values, flags);
+            bool apply = flags.Contains("--apply");
+            string? planPath = OptionalFilePath(values.GetValueOrDefault("--plan"), "--plan", mustExist: true);
+            string? digest = NormalizeDigest(values.GetValueOrDefault("--plan-digest"));
+
+            if (command == AutomationCommand.Plan && apply)
+            {
+                throw new AutomationUsageException("apply_not_allowed", "The plan command never applies changes.");
+            }
+            if (command == AutomationCommand.Plan && (planPath is not null || digest is not null))
+            {
+                throw new AutomationUsageException("plan_input_not_allowed", "The plan command does not accept an existing plan.");
+            }
+            if (!apply && (planPath is not null || digest is not null))
+            {
+                throw new AutomationUsageException(
+                    "apply_required",
+                    "--plan and --plan-digest are only accepted together with explicit --apply.");
+            }
+            if (apply && (planPath is null || digest is null))
+            {
+                throw new AutomationUsageException(
+                    "plan_required",
+                    "Explicit --apply requires both --plan and --plan-digest.");
+            }
+
+            return Success(new AutomationInvocation(
+                command,
+                commandName,
+                null,
+                intent,
+                apply,
+                planPath,
+                digest,
+                ledgerRoot,
+                timeout));
+        }
+        catch (AutomationUsageException error)
+        {
+            return Failure(commandName, error.Code, error.Message);
+        }
+        catch (Exception error) when (error is ArgumentException or NotSupportedException or PathTooLongException)
+        {
+            return Failure(commandName, "invalid_input", error.Message);
+        }
+    }
+
+    private static ApplicationWriteIntent CreateIntent(
+        AutomationCommand command,
+        string codexHome,
+        string? sqliteHome,
+        IReadOnlyDictionary<string, string> values,
+        IReadOnlySet<string> flags)
+    {
+        int keep = ParsePositiveInteger(values.GetValueOrDefault("--keep") ?? AppConstants.DefaultBackupRetentionCount.ToString(CultureInfo.InvariantCulture), "--keep");
+        if (command == AutomationCommand.Restore
+            && flags.Contains("--allow-sqlite-home-relocation")
+            && (sqliteHome is null || !flags.Contains("--no-config")))
+        {
+            throw new AutomationUsageException(
+                "sqlite_home_relocation_requires_explicit_target_and_no_config",
+                "--allow-sqlite-home-relocation requires both --sqlite-home and --no-config.");
+        }
+
+        return command switch
+        {
+            AutomationCommand.Sync => new SyncIntent(
+                codexHome,
+                sqliteHome,
+                NormalizeRequiredText(Required(values, "--provider"), "--provider"),
+                keep),
+            AutomationCommand.Switch => new SwitchIntent(
+                codexHome,
+                sqliteHome,
+                NormalizeRequiredText(Required(values, "--provider"), "--provider"),
+                ParseModelSelection(values.GetValueOrDefault("--model-mode"), values.GetValueOrDefault("--model")),
+                keep),
+            AutomationCommand.Restore => new RestoreIntent(
+                codexHome,
+                sqliteHome,
+                NormalizeDirectoryPath(Required(values, "--backup"), "--backup", mustExist: true),
+                RestoreConfig: !flags.Contains("--no-config"),
+                RestoreDatabase: !flags.Contains("--no-database"),
+                RestoreSessions: !flags.Contains("--no-sessions"),
+                AllowSqliteHomeRelocation: flags.Contains("--allow-sqlite-home-relocation")),
+            AutomationCommand.Prune => new PruneIntent(codexHome, sqliteHome, keep),
+            _ => throw new AutomationUsageException("invalid_operation", "A write operation is required.")
+        };
+    }
+
+    private static SwitchModelSelection ParseModelSelection(string? mode, string? model)
+    {
+        string normalizedMode = string.IsNullOrWhiteSpace(mode) ? "follow-provider" : mode.Trim();
+        return normalizedMode switch
+        {
+            "follow-provider" when model is null => new FollowProviderModelSelection(),
+            "keep-root" when model is null => new KeepRootModelSelection(),
+            "custom" => new CustomModelSelection(NormalizeRequiredText(model, "--model")),
+            "follow-provider" or "keep-root" => throw new AutomationUsageException(
+                "model_not_allowed",
+                "--model is only valid with --model-mode custom."),
+            _ => throw new AutomationUsageException(
+                "model_mode_invalid",
+                "--model-mode must be follow-provider, keep-root, or custom.")
+        };
+    }
+
+    private static void ValidateAllowedOptions(AutomationCommand command, IEnumerable<string> options)
+    {
+        HashSet<string> allowed = command switch
+        {
+            AutomationCommand.Describe => ["--timeout-ms"],
+            AutomationCommand.Status => ["--codex-home", "--sqlite-home", "--timeout-ms"],
+            AutomationCommand.Plan =>
+            [
+                "--codex-home", "--sqlite-home", "--ledger-root", "--timeout-ms", "--operation",
+                "--provider", "--keep", "--model-mode", "--model", "--backup", "--no-config",
+                "--no-database", "--no-sessions", "--allow-sqlite-home-relocation"
+            ],
+            AutomationCommand.Sync => CommonWriteOptions("--provider", "--keep"),
+            AutomationCommand.Switch => CommonWriteOptions("--provider", "--keep", "--model-mode", "--model"),
+            AutomationCommand.Restore => CommonWriteOptions(
+                "--backup", "--no-config", "--no-database", "--no-sessions", "--allow-sqlite-home-relocation"),
+            AutomationCommand.Prune => CommonWriteOptions("--keep"),
+            _ => throw new ArgumentOutOfRangeException(nameof(command))
+        };
+
+        string? invalid = options.FirstOrDefault(option => !allowed.Contains(option));
+        if (invalid is not null)
+        {
+            throw new AutomationUsageException(
+                "option_not_allowed",
+                $"Option {invalid} is not valid for {ToCommandName(command)}.");
+        }
+    }
+
+    private static void ValidatePlanOperationOptions(
+        AutomationCommand operation,
+        IEnumerable<string> options)
+    {
+        HashSet<string> allowed = new(StringComparer.Ordinal)
+        {
+            "--codex-home", "--sqlite-home", "--ledger-root", "--timeout-ms", "--operation"
+        };
+        allowed.UnionWith(operation switch
+        {
+            AutomationCommand.Sync => ["--provider", "--keep"],
+            AutomationCommand.Switch => ["--provider", "--keep", "--model-mode", "--model"],
+            AutomationCommand.Restore =>
+            [
+                "--backup", "--no-config", "--no-database", "--no-sessions",
+                "--allow-sqlite-home-relocation"
+            ],
+            AutomationCommand.Prune => ["--keep"],
+            _ => throw new ArgumentOutOfRangeException(nameof(operation))
+        });
+        string? invalid = options.FirstOrDefault(option => !allowed.Contains(option));
+        if (invalid is not null)
+        {
+            throw new AutomationUsageException(
+                "option_not_allowed",
+                $"Option {invalid} is not valid for plan --operation {ToCommandName(operation)}.");
+        }
+    }
+
+    private static HashSet<string> CommonWriteOptions(params string[] commandSpecific)
+    {
+        HashSet<string> result = new(StringComparer.Ordinal)
+        {
+            "--codex-home", "--sqlite-home", "--ledger-root", "--timeout-ms",
+            "--apply", "--plan", "--plan-digest"
+        };
+        result.UnionWith(commandSpecific);
+        return result;
+    }
+
+    private static string NormalizeAbsolutePath(string value, string option, bool mustExist)
+    {
+        if (string.IsNullOrWhiteSpace(value))
+        {
+            throw new AutomationUsageException("path_required", $"{option} requires a non-empty path.");
+        }
+        if (!Path.IsPathFullyQualified(value))
+        {
+            throw new AutomationUsageException(
+                "path_escape",
+                $"{option} must be an absolute path; relative and escaping paths are not accepted.");
+        }
+
+        string fullPath = Path.GetFullPath(value);
+        if (string.Equals(Path.GetFileName(fullPath), "auth.json", StringComparison.OrdinalIgnoreCase))
+        {
+            throw new AutomationUsageException("credential_path_forbidden", "Automation never reads auth.json.");
+        }
+        if (mustExist && !File.Exists(fullPath) && !Directory.Exists(fullPath))
+        {
+            throw new AutomationUsageException("path_not_found", $"{option} does not exist.");
+        }
+        EnsureNoReparseAncestors(fullPath, option);
+
+        return fullPath;
+    }
+
+    private static string NormalizeDirectoryPath(string value, string option, bool mustExist)
+    {
+        string path = NormalizeAbsolutePath(value, option, mustExist);
+        if (File.Exists(path))
+        {
+            throw new AutomationUsageException("path_type_invalid", $"{option} must be a directory path.");
+        }
+        return path;
+    }
+
+    private static string NormalizeFilePath(string value, string option, bool mustExist)
+    {
+        string path = NormalizeAbsolutePath(value, option, mustExist);
+        if (Directory.Exists(path))
+        {
+            throw new AutomationUsageException("path_type_invalid", $"{option} must be a file path.");
+        }
+        return path;
+    }
+
+    private static string? OptionalDirectoryPath(string? value, string option, bool mustExist = false)
+    {
+        return value is null ? null : NormalizeDirectoryPath(value, option, mustExist);
+    }
+
+    private static string? OptionalFilePath(string? value, string option, bool mustExist = false)
+    {
+        return value is null ? null : NormalizeFilePath(value, option, mustExist);
+    }
+
+    private static void EnsureNoReparseAncestors(string fullPath, string option)
+    {
+        string? current = fullPath;
+        while (!string.IsNullOrEmpty(current))
+        {
+            if ((File.Exists(current) || Directory.Exists(current))
+                && (File.GetAttributes(current) & FileAttributes.ReparsePoint) != 0)
+            {
+                throw new AutomationUsageException(
+                    "path_escape",
+                    $"{option} cannot traverse a reparse point or symbolic link.");
+            }
+
+            string? parent = Path.GetDirectoryName(current);
+            if (string.Equals(parent, current, StringComparison.Ordinal))
+            {
+                break;
+            }
+            current = parent;
+        }
+    }
+
+    private static string? NormalizeDigest(string? digest)
+    {
+        if (digest is null)
+        {
+            return null;
+        }
+        if (digest.Length != 64 || digest.Any(static character => character is not (>= '0' and <= '9') and not (>= 'a' and <= 'f')))
+        {
+            throw new AutomationUsageException(
+                "plan_digest_invalid",
+                "--plan-digest must be an exact lowercase 64-character SHA-256 hexadecimal value.");
+        }
+        return digest;
+    }
+
+    private static TimeSpan? ParseTimeout(string? value)
+    {
+        if (value is null)
+        {
+            return null;
+        }
+        int milliseconds = ParsePositiveInteger(value, "--timeout-ms");
+        if (milliseconds > MaximumTimeoutMilliseconds)
+        {
+            throw new AutomationUsageException(
+                "timeout_invalid",
+                $"--timeout-ms cannot exceed {MaximumTimeoutMilliseconds}.");
+        }
+        return TimeSpan.FromMilliseconds(milliseconds);
+    }
+
+    private static int ParsePositiveInteger(string value, string option)
+    {
+        if (!int.TryParse(value, NumberStyles.None, CultureInfo.InvariantCulture, out int parsed) || parsed < 1)
+        {
+            throw new AutomationUsageException("integer_invalid", $"{option} must be a positive integer.");
+        }
+        return parsed;
+    }
+
+    private static string Required(IReadOnlyDictionary<string, string> values, string option)
+    {
+        return values.TryGetValue(option, out string? value)
+            ? value
+            : throw new AutomationUsageException("option_required", $"{option} is required.");
+    }
+
+    private static string NormalizeRequiredText(string? value, string option)
+    {
+        if (string.IsNullOrWhiteSpace(value))
+        {
+            throw new AutomationUsageException("option_value_required", $"{option} requires a non-empty value.");
+        }
+        return value.Trim();
+    }
+
+    private static AutomationCommand ParseWriteCommand(string value)
+    {
+        return value switch
+        {
+            "sync" => AutomationCommand.Sync,
+            "switch" => AutomationCommand.Switch,
+            "restore" => AutomationCommand.Restore,
+            "prune" => AutomationCommand.Prune,
+            _ => throw new AutomationUsageException(
+                "operation_invalid",
+                "--operation must be sync, switch, restore, or prune.")
+        };
+    }
+
+    private static bool TryParseCommand(string value, out AutomationCommand command)
+    {
+        command = value switch
+        {
+            "describe" => AutomationCommand.Describe,
+            "status" => AutomationCommand.Status,
+            "plan" => AutomationCommand.Plan,
+            "sync" => AutomationCommand.Sync,
+            "switch" => AutomationCommand.Switch,
+            "restore" => AutomationCommand.Restore,
+            "prune" => AutomationCommand.Prune,
+            _ => default
+        };
+        return value is "describe" or "status" or "plan" or "sync" or "switch" or "restore" or "prune";
+    }
+
+    private static string ToCommandName(AutomationCommand command)
+    {
+        return command.ToString().ToLowerInvariant();
+    }
+
+    private static AutomationParseResult Success(AutomationInvocation invocation) => new(invocation, null);
+
+    private static AutomationParseResult Failure(string command, string code, string message) =>
+        new(null, AutomationProtocolResponse.UsageFailure(command, code, message));
+
+    private sealed class AutomationUsageException(string code, string message) : Exception(message)
+    {
+        public string Code { get; } = code;
+    }
+}
diff --git a/desktop/CodexProviderSync.Automation/AutomationComposition.cs b/desktop/CodexProviderSync.Automation/AutomationComposition.cs
new file mode 100644
index 0000000..bbbbe23
--- /dev/null
+++ b/desktop/CodexProviderSync.Automation/AutomationComposition.cs
@@ -0,0 +1,36 @@
+using CodexProviderSync.Application;
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.Automation;
+
+/// <summary>
+/// Production composition boundary. The GUI and this host both consume the
+/// same IApplicationService use cases. All writes flow through Core's checked
+/// snapshot/execution boundary.
+/// </summary>
+public sealed class AutomationApplicationFactory : IAutomationApplicationFactory
+{
+    private readonly Func<IApplicationStatusPort> _statusPortFactory;
+    private readonly Func<IApplicationWritePort> _writePortFactory;
+
+    public AutomationApplicationFactory(
+        Func<IApplicationStatusPort>? statusPortFactory = null,
+        Func<IApplicationWritePort>? writePortFactory = null)
+    {
+        _statusPortFactory = statusPortFactory ?? (static () => new CoreApplicationStatusPort());
+        _writePortFactory = writePortFactory ?? (static () => new CoreApplicationWritePort());
+    }
+
+    public IApplicationService Create(AutomationInvocation invocation)
+    {
+        ArgumentNullException.ThrowIfNull(invocation);
+        IApplicationPlanLedger ledger = invocation.IsWrite
+            ? new FileApplicationPlanLedger(invocation.LedgerRoot!)
+            : new InMemoryApplicationPlanLedger();
+        return new ApplicationService(
+            _statusPortFactory(),
+            _writePortFactory(),
+            ledger);
+    }
+
+}
diff --git a/desktop/CodexProviderSync.Automation/AutomationHost.cs b/desktop/CodexProviderSync.Automation/AutomationHost.cs
new file mode 100644
index 0000000..8d942ec
--- /dev/null
+++ b/desktop/CodexProviderSync.Automation/AutomationHost.cs
@@ -0,0 +1,366 @@
+using System.Text.Json;
+using CodexProviderSync.Application;
+using CodexProviderSync.Core;
+
+namespace CodexProviderSync.Automation;
+
+public interface IAutomationApplicationFactory
+{
+    IApplicationService Create(AutomationInvocation invocation);
+}
+
+public sealed class AutomationHost
+{
+    private readonly IAutomationApplicationFactory _applicationFactory;
+
+    public AutomationHost(IAutomationApplicationFactory applicationFactory)
+    {
+        _applicationFactory = applicationFactory ?? throw new ArgumentNullException(nameof(applicationFactory));
+    }
+
+    public async Task<AutomationRunResult> RunAsync(
+        IReadOnlyList<string> args,
+        CancellationToken cancellationToken = default)
+    {
+        AutomationParseResult parsed = AutomationCommandLine.Parse(args);
+        if (!parsed.IsSuccess)
+        {
+            AutomationProtocolResponse response = parsed.Error!;
+            return new AutomationRunResult(response.ExitCode, response, response.Errors[0].Message);
+        }
+
+        AutomationInvocation invocation = parsed.Invocation!;
+        using CancellationTokenSource? timeout = invocation.Timeout is null
+            ? null
+            : new CancellationTokenSource(invocation.Timeout.Value);
+        using CancellationTokenSource linked = timeout is null
+            ? CancellationTokenSource.CreateLinkedTokenSource(cancellationToken)
+            : CancellationTokenSource.CreateLinkedTokenSource(cancellationToken, timeout.Token);
+
+        try
+        {
+            IApplicationService service = _applicationFactory.Create(invocation);
+            return await DispatchAsync(
+                service,
+                invocation,
+                timeout,
+                cancellationToken,
+                linked.Token);
+        }
+        catch (PlanDocumentException error)
+        {
+            AutomationProtocolResponse response = new(
+                ApplicationProtocol.Version,
+                "failure",
+                AutomationExitCodes.InvalidPlan,
+                invocation.CommandName,
+                null,
+                "rejected",
+                null,
+                [],
+                [new ApplicationError(error.Code, error.Message)],
+                []);
+            return new AutomationRunResult(response.ExitCode, response, error.Message);
+        }
+        catch (OperationCanceledException)
+        {
+            bool timedOut = timeout?.IsCancellationRequested == true && !cancellationToken.IsCancellationRequested;
+            string code = timedOut ? "timeout" : "cancelled";
+            string message = timedOut ? "The Automation operation timed out." : "The Automation operation was cancelled.";
+            AutomationProtocolResponse response = new(
+                ApplicationProtocol.Version,
+                "failure",
+                AutomationExitCodes.CancelledOrTimedOut,
+                invocation.CommandName,
+                null,
+                timedOut ? "timedOut" : "cancelled",
+                null,
+                [],
+                [new ApplicationError(code, message)],
+                []);
+            return new AutomationRunResult(response.ExitCode, response, message);
+        }
+        catch (Exception error)
+        {
+            AutomationProtocolResponse response = AutomationProtocolResponse.InternalFailure(invocation.CommandName);
+            return new AutomationRunResult(
+                response.ExitCode,
+                response,
+                $"Automation internal failure ({error.GetType().Name}).");
+        }
+    }
+
+    private static async Task<AutomationRunResult> DispatchAsync(
+        IApplicationService service,
+        AutomationInvocation invocation,
+        CancellationTokenSource? timeout,
+        CancellationToken callerToken,
+        CancellationToken operationToken)
+    {
+        return invocation.Command switch
+        {
+            AutomationCommand.Describe => FromOutcome(
+                invocation,
+                await service.DescribeAsync(operationToken),
+                DidTimeOut(timeout, callerToken)),
+            AutomationCommand.Status => FromOutcome(
+                invocation,
+                await service.GetStatusAsync(invocation.StatusRequest!, operationToken),
+                DidTimeOut(timeout, callerToken)),
+            AutomationCommand.Plan => FromOutcome(
+                invocation,
+                await service.CreatePlanAsync(
+                    new CreateApplicationPlanRequest(invocation.Intent!),
+                    operationToken),
+                DidTimeOut(timeout, callerToken)),
+            AutomationCommand.Sync => FromOutcome(
+                invocation,
+                await service.SyncAsync(
+                    new SyncApplicationRequest(
+                        (SyncIntent)invocation.Intent!,
+                        await CreateAuthorizationAsync(invocation, operationToken)),
+                    operationToken),
+                DidTimeOut(timeout, callerToken)),
+            AutomationCommand.Switch => FromOutcome(
+                invocation,
+                await service.SwitchAsync(
+                    new SwitchApplicationRequest(
+                        (SwitchIntent)invocation.Intent!,
+                        await CreateAuthorizationAsync(invocation, operationToken)),
+                    operationToken),
+                DidTimeOut(timeout, callerToken)),
+            AutomationCommand.Restore => FromOutcome(
+                invocation,
+                await service.RestoreAsync(
+                    new RestoreApplicationRequest(
+                        (RestoreIntent)invocation.Intent!,
+                        await CreateAuthorizationAsync(invocation, operationToken)),
+                    operationToken),
+                DidTimeOut(timeout, callerToken)),
+            AutomationCommand.Prune => FromOutcome(
+                invocation,
+                await service.PruneAsync(
+                    new PruneApplicationRequest(
+                        (PruneIntent)invocation.Intent!,
+                        await CreateAuthorizationAsync(invocation, operationToken)),
+                    operationToken),
+                DidTimeOut(timeout, callerToken)),
+            _ => throw new ArgumentOutOfRangeException(nameof(invocation.Command))
+        };
+    }
+
+    private static bool DidTimeOut(CancellationTokenSource? timeout, CancellationToken callerToken)
+    {
+        return timeout?.IsCancellationRequested == true && !callerToken.IsCancellationRequested;
+    }
+
+    private static async Task<ApplicationApplyAuthorization> CreateAuthorizationAsync(
+        AutomationInvocation invocation,
+        CancellationToken cancellationToken)
+    {
+        if (!invocation.Apply)
+        {
+            return ApplicationApplyAuthorization.DryRun;
+        }
+
+        ApplicationOperationPlan plan = await ReadPlanAsync(invocation.PlanPath!, cancellationToken);
+        return new ApplicationApplyAuthorization(
+            Apply: true,
+            Plan: plan,
+            PlanDigest: invocation.PlanDigest);
+    }
+
+    private static async Task<ApplicationOperationPlan> ReadPlanAsync(
+        string path,
+        CancellationToken cancellationToken)
+    {
+        FileInfo info = new(path);
+        if (!info.Exists || info.Length is <= 0 or > AutomationJson.MaximumPlanBytes)
+        {
+            throw new PlanDocumentException(
+                "plan_document_invalid",
+                $"The plan document must be between 1 and {AutomationJson.MaximumPlanBytes} bytes.");
+        }
+
+        byte[] bytes;
+        try
+        {
+            await using FileStream stream = new(
+                path,
+                FileMode.Open,
+                FileAccess.Read,
+                FileShare.Read,
+                4096,
+                FileOptions.Asynchronous | FileOptions.SequentialScan);
+            if (stream.Length is <= 0 or > AutomationJson.MaximumPlanBytes)
+            {
+                throw new PlanDocumentException(
+                    "plan_document_invalid",
+                    $"The plan document must be between 1 and {AutomationJson.MaximumPlanBytes} bytes.");
+            }
+            bytes = new byte[stream.Length];
+            await stream.ReadExactlyAsync(bytes, cancellationToken);
+        }
+        catch (PlanDocumentException)
+        {
+            throw;
+        }
+        catch (IOException error)
+        {
+            throw new PlanDocumentException(
+                "plan_document_unreadable",
+                "The plan document could not be read safely.",
+                error);
+        }
+
+        try
+        {
+            ApplicationOperationPlan? plan = JsonSerializer.Deserialize<ApplicationOperationPlan>(
+                bytes,
+                AutomationJson.Options);
+            return plan ?? throw new PlanDocumentException(
+                "plan_document_malformed",
+                "The plan document is empty or malformed.");
+        }
+        catch (PlanDocumentException)
+        {
+            throw;
+        }
+        catch (Exception error) when (error is JsonException or NotSupportedException)
+        {
+            throw new PlanDocumentException(
+                "plan_document_malformed",
+                "The plan document is not valid protocol 0.4 JSON.",
+                error);
+        }
+    }
+
+    private static AutomationRunResult FromOutcome<T>(
+        AutomationInvocation invocation,
+        ApplicationOutcome<T> outcome,
+        bool timedOut)
+        where T : class
+    {
+        int exitCode = ExitCodeFor(outcome, timedOut);
+        string result = ResultKindFor(outcome, exitCode);
+        IReadOnlyList<ApplicationError> errors = timedOut
+            && outcome.Lifecycle == ApplicationOperationLifecycle.Cancelled
+            ? [new ApplicationError("timeout", "The Automation operation timed out.")]
+            : outcome.Errors;
+        string lifecycle = timedOut && outcome.Lifecycle == ApplicationOperationLifecycle.Cancelled
+            ? "timedOut"
+            : ToProtocolName(outcome.Lifecycle);
+        AutomationProtocolResponse response = new(
+            ApplicationProtocol.Version,
+            result,
+            exitCode,
+            invocation.CommandName,
+            outcome.OperationId,
+            lifecycle,
+            outcome.Data,
+            outcome.Warnings,
+            errors,
+            outcome.Timeline);
+        string? diagnostic = errors.Count == 0
+            ? null
+            : string.Join("; ", errors.Select(static error => $"{error.Code}: {error.Message}"));
+        return new AutomationRunResult(exitCode, response, diagnostic);
+    }
+
+    private static int ExitCodeFor<T>(ApplicationOutcome<T> outcome, bool timedOut)
+        where T : class
+    {
+        if (timedOut && outcome.Lifecycle == ApplicationOperationLifecycle.Cancelled)
+        {
+            return AutomationExitCodes.CancelledOrTimedOut;
+        }
+        if (outcome.Errors.Any(static error => error.Code == "capability_unavailable"))
+        {
+            return AutomationExitCodes.ValidationOrUsage;
+        }
+        if (outcome.Errors.Any(static error => error.RecoveryRequired))
+        {
+            return AutomationExitCodes.RecoveryRequired;
+        }
+        if (outcome.Errors.Any(static error => error.Code is
+            "invalid_normalized_intent" or
+            "invalid_plan_preview" or
+            "invalid_plan_targets" or
+            "duplicate_plan_target" or
+            "invalid_auto_prune_targets" or
+            "duplicate_auto_prune_target" or
+            "invalid_plan_warning"))
+        {
+            return AutomationExitCodes.InternalProtocolFailure;
+        }
+
+        return outcome.Lifecycle switch
+        {
+            ApplicationOperationLifecycle.Succeeded or ApplicationOperationLifecycle.ReadyToApply =>
+                AutomationExitCodes.Success,
+            ApplicationOperationLifecycle.Cancelled => AutomationExitCodes.CancelledOrTimedOut,
+            ApplicationOperationLifecycle.RecoveryRequired => AutomationExitCodes.RecoveryRequired,
+            ApplicationOperationLifecycle.Failed => ExitCodeForFailedOutcome(outcome),
+            ApplicationOperationLifecycle.Rejected when outcome.Errors.Any(static error =>
+                error.Code is "operation_busy" or "target_busy") => AutomationExitCodes.Busy,
+            ApplicationOperationLifecycle.Rejected when outcome.Errors.Any(static error =>
+                error.Code.StartsWith("plan_", StringComparison.Ordinal)) => AutomationExitCodes.InvalidPlan,
+            ApplicationOperationLifecycle.Rejected => AutomationExitCodes.ValidationOrUsage,
+            _ => AutomationExitCodes.InternalProtocolFailure
+        };
+    }
+
+    private static int ExitCodeForFailedOutcome<T>(ApplicationOutcome<T> outcome)
+        where T : class
+    {
+        if (outcome.Errors.Any(static error => string.Equals(
+                error.RollbackStatus,
+                "complete",
+                StringComparison.Ordinal)))
+        {
+            return AutomationExitCodes.RolledBackFailure;
+        }
+
+        // A failure before the mutation boundary is a validation/usage failure.
+        // Once Applying has started, unknown rollback state must fail closed.
+        return outcome.Timeline.Any(static entry =>
+            entry.Lifecycle == ApplicationOperationLifecycle.Applying)
+            ? AutomationExitCodes.InternalProtocolFailure
+            : AutomationExitCodes.ValidationOrUsage;
+    }
+
+    private static string ResultKindFor<T>(ApplicationOutcome<T> outcome, int exitCode)
+        where T : class
+    {
+        if (exitCode == AutomationExitCodes.RecoveryRequired)
+        {
+            return "recovery";
+        }
+        if (outcome.Errors.Any(static error => string.Equals(error.RollbackStatus, "complete", StringComparison.Ordinal)))
+        {
+            return "rollback";
+        }
+        if (exitCode != AutomationExitCodes.Success)
+        {
+            return "failure";
+        }
+        return outcome.Warnings.Count > 0 ? "warning" : "success";
+    }
+
+    private static string ToProtocolName(ApplicationOperationLifecycle lifecycle)
+    {
+        string name = lifecycle.ToString();
+        return char.ToLowerInvariant(name[0]) + name[1..];
+    }
+
+    private sealed class PlanDocumentException : IOException
+    {
+        public PlanDocumentException(string code, string message, Exception? innerException = null)
+            : base(message, innerException)
+        {
+            Code = code;
+        }
+
+        public string Code { get; }
+    }
+}
diff --git a/desktop/CodexProviderSync.Automation/AutomationInvocation.cs b/desktop/CodexProviderSync.Automation/AutomationInvocation.cs
new file mode 100644
index 0000000..69d96f4
--- /dev/null
+++ b/desktop/CodexProviderSync.Automation/AutomationInvocation.cs
@@ -0,0 +1,40 @@
+using CodexProviderSync.Application;
+
+namespace CodexProviderSync.Automation;
+
+public enum AutomationCommand
+{
+    Describe,
+    Status,
+    Plan,
+    Sync,
+    Switch,
+    Restore,
+    Prune
+}
+
+public sealed record AutomationInvocation(
+    AutomationCommand Command,
+    string CommandName,
+    ApplicationStatusRequest? StatusRequest,
+    ApplicationWriteIntent? Intent,
+    bool Apply,
+    string? PlanPath,
+    string? PlanDigest,
+    string? LedgerRoot,
+    TimeSpan? Timeout)
+{
+    public bool IsWrite => Command is
+        AutomationCommand.Plan or
+        AutomationCommand.Sync or
+        AutomationCommand.Switch or
+        AutomationCommand.Restore or
+        AutomationCommand.Prune;
+}
+
+public sealed record AutomationParseResult(
+    AutomationInvocation? Invocation,
+    AutomationProtocolResponse? Error)
+{
+    public bool IsSuccess => Invocation is not null;
+}
diff --git a/desktop/CodexProviderSync.Automation/AutomationProtocol.cs b/desktop/CodexProviderSync.Automation/AutomationProtocol.cs
new file mode 100644
index 0000000..70ff5c2
--- /dev/null
+++ b/desktop/CodexProviderSync.Automation/AutomationProtocol.cs
@@ -0,0 +1,92 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using CodexProviderSync.Application;
+
+namespace CodexProviderSync.Automation;
+
+public static class AutomationExitCodes
+{
+    public const int Success = 0;
+    public const int ValidationOrUsage = 2;
+    public const int InvalidPlan = 3;
+    public const int Busy = 4;
+    public const int RolledBackFailure = 5;
+    public const int RecoveryRequired = 6;
+    public const int CancelledOrTimedOut = 7;
+    public const int InternalProtocolFailure = 10;
+}
+
+public static class AutomationJson
+{
+    public const int MaximumPlanBytes = 1024 * 1024;
+
+    public static JsonSerializerOptions Options { get; } = CreateOptions();
+
+    private static JsonSerializerOptions CreateOptions()
+    {
+        JsonSerializerOptions options = new(JsonSerializerDefaults.Web)
+        {
+            DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
+            PropertyNameCaseInsensitive = false,
+            ReadCommentHandling = JsonCommentHandling.Disallow,
+            AllowTrailingCommas = false,
+            UnmappedMemberHandling = JsonUnmappedMemberHandling.Disallow,
+            WriteIndented = false
+        };
+        options.Converters.Add(new JsonStringEnumConverter(JsonNamingPolicy.CamelCase, allowIntegerValues: false));
+        return options;
+    }
+}
+
+public sealed record AutomationProtocolResponse(
+    string ProtocolVersion,
+    string Result,
+    int ExitCode,
+    string Command,
+    string? OperationId,
+    string Lifecycle,
+    object? Data,
+    IReadOnlyList<ApplicationWarning> Warnings,
+    IReadOnlyList<ApplicationError> Errors,
+    IReadOnlyList<ApplicationLifecycleEvent> Timeline)
+{
+    public static AutomationProtocolResponse UsageFailure(
+        string command,
+        string code,
+        string message)
+    {
+        return new AutomationProtocolResponse(
+            ApplicationProtocol.Version,
+            "failure",
+            AutomationExitCodes.ValidationOrUsage,
+            command,
+            null,
+            "rejected",
+            null,
+            [],
+            [new ApplicationError(code, message)],
+            []);
+    }
+
+    public static AutomationProtocolResponse InternalFailure(string command)
+    {
+        return new AutomationProtocolResponse(
+            ApplicationProtocol.Version,
+            "failure",
+            AutomationExitCodes.InternalProtocolFailure,
+            command,
+            null,
+            "failed",
+            null,
+            [],
+            [new ApplicationError(
+                "internal_protocol_failure",
+                "The Automation host could not complete the protocol operation.")],
+            []);
+    }
+}
+
+public sealed record AutomationRunResult(
+    int ExitCode,
+    AutomationProtocolResponse Response,
+    string? Diagnostic = null);
diff --git a/desktop/CodexProviderSync.Automation/CodexProviderSync.Automation.csproj b/desktop/CodexProviderSync.Automation/CodexProviderSync.Automation.csproj
new file mode 100644
index 0000000..44aa135
--- /dev/null
+++ b/desktop/CodexProviderSync.Automation/CodexProviderSync.Automation.csproj
@@ -0,0 +1,28 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <AssemblyName>CodexProviderSync.Automation</AssemblyName>
+    <RootNamespace>CodexProviderSync.Automation</RootNamespace>
+    <Version>0.4.0</Version>
+    <AssemblyVersion>0.4.0.0</AssemblyVersion>
+    <FileVersion>0.4.0.0</FileVersion>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\CodexProviderSync.Application\CodexProviderSync.Application.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Content Include="automation-protocol-v0.4.schema.json">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
+    <EmbeddedResource Include="automation-protocol-v0.4.schema.json">
+      <LogicalName>CodexProviderSync.Automation.automation-protocol-v0.4.schema.json</LogicalName>
+    </EmbeddedResource>
+  </ItemGroup>
+
+</Project>
diff --git a/desktop/CodexProviderSync.Automation/Program.cs b/desktop/CodexProviderSync.Automation/Program.cs
new file mode 100644
index 0000000..2810b80
--- /dev/null
+++ b/desktop/CodexProviderSync.Automation/Program.cs
@@ -0,0 +1,36 @@
+using System.Text;
+using System.Text.Json;
+
+namespace CodexProviderSync.Automation;
+
+public static class Program
+{
+    public static async Task<int> Main(string[] args)
+    {
+        Console.OutputEncoding = new UTF8Encoding(encoderShouldEmitUTF8Identifier: false);
+        using CancellationTokenSource shutdown = new();
+        ConsoleCancelEventHandler cancelHandler = (_, eventArgs) =>
+        {
+            eventArgs.Cancel = true;
+            shutdown.Cancel();
+        };
+        Console.CancelKeyPress += cancelHandler;
+        try
+        {
+            AutomationHost host = new(new AutomationApplicationFactory());
+            AutomationRunResult result = await host.RunAsync(args, shutdown.Token);
+            if (!string.IsNullOrWhiteSpace(result.Diagnostic))
+            {
+                await Console.Error.WriteLineAsync(result.Diagnostic);
+            }
+
+            string json = JsonSerializer.Serialize(result.Response, AutomationJson.Options);
+            await Console.Out.WriteLineAsync(json);
+            return result.ExitCode;
+        }
+        finally
+        {
+            Console.CancelKeyPress -= cancelHandler;
+        }
+    }
+}
diff --git a/desktop/CodexProviderSync.Automation/automation-protocol-v0.4.schema.json b/desktop/CodexProviderSync.Automation/automation-protocol-v0.4.schema.json
new file mode 100644
index 0000000..dcf9d71
--- /dev/null
+++ b/desktop/CodexProviderSync.Automation/automation-protocol-v0.4.schema.json
@@ -0,0 +1,403 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/Dailin521/codex-provider-sync/schemas/automation-protocol-v0.4.schema.json",
+  "title": "Codex Provider Sync Automation protocol 0.4",
+  "oneOf": [
+    {
+      "$ref": "#/$defs/response"
+    },
+    {
+      "$ref": "#/$defs/operationPlan"
+    }
+  ],
+  "$defs": {
+    "response": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "protocolVersion",
+        "result",
+        "exitCode",
+        "command",
+        "lifecycle",
+        "warnings",
+        "errors",
+        "timeline"
+      ],
+      "properties": {
+        "protocolVersion": {
+          "const": "0.4"
+        },
+        "result": {
+          "enum": ["success", "warning", "failure", "rollback", "recovery"]
+        },
+        "exitCode": {
+          "enum": [0, 2, 3, 4, 5, 6, 7, 10]
+        },
+        "command": {
+          "type": "string"
+        },
+        "operationId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "lifecycle": {
+          "enum": [
+            "accepted",
+            "validating",
+            "planning",
+            "readyToApply",
+            "applying",
+            "succeeded",
+            "failed",
+            "cancelled",
+            "timedOut",
+            "rejected",
+            "recoveryRequired"
+          ]
+        },
+        "data": {},
+        "warnings": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/warning"
+          }
+        },
+        "errors": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/error"
+          }
+        },
+        "timeline": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/lifecycleEvent"
+          }
+        }
+      }
+    },
+    "operationPlan": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "protocolVersion",
+        "planId",
+        "createdByOperationId",
+        "createdAtUtc",
+        "expiresAtUtc",
+        "intent",
+        "stateFingerprint",
+        "executionToken",
+        "targets",
+        "autoPruneDeletionTargets",
+        "warnings",
+        "digest"
+      ],
+      "properties": {
+        "protocolVersion": {
+          "const": "0.4"
+        },
+        "planId": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$"
+        },
+        "createdByOperationId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "createdAtUtc": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "expiresAtUtc": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "intent": {
+          "$ref": "#/$defs/writeIntent"
+        },
+        "stateFingerprint": {
+          "type": "string",
+          "minLength": 1
+        },
+        "executionToken": {
+          "type": "string",
+          "minLength": 1
+        },
+        "targets": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/planTarget"
+          }
+        },
+        "autoPruneDeletionTargets": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/planTarget"
+          }
+        },
+        "warnings": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/warning"
+          }
+        },
+        "digest": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        }
+      }
+    },
+    "writeIntent": {
+      "oneOf": [
+        {
+          "$ref": "#/$defs/syncIntent"
+        },
+        {
+          "$ref": "#/$defs/switchIntent"
+        },
+        {
+          "$ref": "#/$defs/restoreIntent"
+        },
+        {
+          "$ref": "#/$defs/pruneIntent"
+        }
+      ]
+    },
+    "syncIntent": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "codexHome", "providerId", "backupRetentionCount"],
+      "properties": {
+        "kind": {
+          "const": "sync"
+        },
+        "codexHome": {
+          "$ref": "#/$defs/absolutePath"
+        },
+        "sqliteHomeOverride": {
+          "$ref": "#/$defs/absolutePath"
+        },
+        "providerId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "backupRetentionCount": {
+          "type": "integer",
+          "minimum": 1
+        }
+      }
+    },
+    "switchIntent": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "codexHome", "providerId", "modelSelection", "backupRetentionCount"],
+      "properties": {
+        "kind": {
+          "const": "switch"
+        },
+        "codexHome": {
+          "$ref": "#/$defs/absolutePath"
+        },
+        "sqliteHomeOverride": {
+          "$ref": "#/$defs/absolutePath"
+        },
+        "providerId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "modelSelection": {
+          "$ref": "#/$defs/modelSelection"
+        },
+        "backupRetentionCount": {
+          "type": "integer",
+          "minimum": 1
+        }
+      }
+    },
+    "restoreIntent": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "codexHome",
+        "backupDirectory",
+        "restoreConfig",
+        "restoreDatabase",
+        "restoreSessions",
+        "allowSqliteHomeRelocation"
+      ],
+      "properties": {
+        "kind": {
+          "const": "restore"
+        },
+        "codexHome": {
+          "$ref": "#/$defs/absolutePath"
+        },
+        "sqliteHomeOverride": {
+          "$ref": "#/$defs/absolutePath"
+        },
+        "backupDirectory": {
+          "$ref": "#/$defs/absolutePath"
+        },
+        "restoreConfig": {
+          "type": "boolean"
+        },
+        "restoreDatabase": {
+          "type": "boolean"
+        },
+        "restoreSessions": {
+          "type": "boolean"
+        },
+        "allowSqliteHomeRelocation": {
+          "type": "boolean"
+        }
+      }
+    },
+    "pruneIntent": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "codexHome", "backupRetentionCount"],
+      "properties": {
+        "kind": {
+          "const": "prune"
+        },
+        "codexHome": {
+          "$ref": "#/$defs/absolutePath"
+        },
+        "sqliteHomeOverride": {
+          "$ref": "#/$defs/absolutePath"
+        },
+        "backupRetentionCount": {
+          "type": "integer",
+          "minimum": 1
+        }
+      }
+    },
+    "modelSelection": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["mode"],
+          "properties": {
+            "mode": {
+              "const": "followProvider"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["mode"],
+          "properties": {
+            "mode": {
+              "const": "keepRootModel"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["mode", "model"],
+          "properties": {
+            "mode": {
+              "const": "custom"
+            },
+            "model": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        }
+      ]
+    },
+    "planTarget": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "action", "fingerprint"],
+      "properties": {
+        "path": {
+          "$ref": "#/$defs/absolutePath"
+        },
+        "action": {
+          "type": "string",
+          "minLength": 1
+        },
+        "fingerprint": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "absolutePath": {
+      "type": "string",
+      "minLength": 1
+    },
+    "warning": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["code", "message"],
+      "properties": {
+        "code": {
+          "type": "string",
+          "minLength": 1
+        },
+        "message": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "error": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["code", "message", "recoveryRequired"],
+      "properties": {
+        "code": {
+          "type": "string",
+          "minLength": 1
+        },
+        "message": {
+          "type": "string",
+          "minLength": 1
+        },
+        "recoveryRequired": {
+          "type": "boolean"
+        },
+        "rollbackStatus": {
+          "type": "string"
+        },
+        "evidencePath": {
+          "type": "string"
+        }
+      }
+    },
+    "lifecycleEvent": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["lifecycle", "timestampUtc"],
+      "properties": {
+        "lifecycle": {
+          "enum": [
+            "accepted",
+            "validating",
+            "planning",
+            "readyToApply",
+            "applying",
+            "succeeded",
+            "failed",
+            "cancelled",
+            "rejected",
+            "recoveryRequired"
+          ]
+        },
+        "timestampUtc": {
+          "type": "string",
+          "format": "date-time"
+        }
+      }
+    }
+  }
+}
diff --git a/desktop/CodexProviderSync.Core.Tests/BackupParityTests.cs b/desktop/CodexProviderSync.Core.Tests/BackupParityTests.cs
new file mode 100644
index 0000000..b431a96
--- /dev/null
+++ b/desktop/CodexProviderSync.Core.Tests/BackupParityTests.cs
@@ -0,0 +1,167 @@
+using System.Text.Json;
+
+namespace CodexProviderSync.Core.Tests;
+
+public sealed class BackupParityTests
+{
+    [Fact]
+    public async Task CreateBackup_WritesCanonicalCrossRuntimeMetadata()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-backup-parity.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-backup-parity", "apigather");
+        DateTimeOffset originalTimestamp = new(2026, 7, 8, 9, 10, 11, 123, TimeSpan.Zero);
+        File.SetLastWriteTimeUtc(rolloutPath, originalTimestamp.UtcDateTime);
+        await File.WriteAllTextAsync(
+            Path.Combine(fixture.CodexHome, AppConstants.GlobalStateFileBasename),
+            "{\"source\":\"csharp\"}\n");
+
+        SessionRolloutService rollouts = new();
+        SessionChangeCollection changes = await rollouts.CollectSessionChangesAsync(
+            fixture.CodexHome,
+            "openai");
+        BackupService backups = new(rollouts, new SqliteStateService());
+        string backupDir = await backups.CreateBackupAsync(
+            fixture.CodexHome,
+            "openai",
+            changes.Changes,
+            Path.Combine(fixture.CodexHome, "config.toml"));
+
+        using JsonDocument metadata = JsonDocument.Parse(
+            await File.ReadAllTextAsync(Path.Combine(backupDir, "metadata.json")));
+        JsonElement metadataRoot = metadata.RootElement;
+        JsonElement globalStateFiles = metadataRoot.GetProperty("globalStateFiles");
+        Assert.True(globalStateFiles.GetProperty(AppConstants.GlobalStateFileBasename).GetBoolean());
+        Assert.False(globalStateFiles.GetProperty(AppConstants.GlobalStateBackupFileBasename).GetBoolean());
+        Assert.True(metadataRoot.GetProperty("globalStateFilePresent").GetBoolean());
+        Assert.False(metadataRoot.GetProperty("globalStateBackupFilePresent").GetBoolean());
+
+        using JsonDocument manifest = JsonDocument.Parse(
+            await File.ReadAllTextAsync(Path.Combine(backupDir, "session-meta-backup.json")));
+        JsonElement entry = Assert.Single(manifest.RootElement.GetProperty("files").EnumerateArray());
+        Assert.Equal("2026-07-08T09:10:11.123Z", entry.GetProperty("originalLastWriteTimeUtc").GetString());
+        Assert.Equal(originalTimestamp.ToUnixTimeMilliseconds(), entry.GetProperty("originalMtimeMs").GetInt64());
+        Assert.Equal(JsonValueKind.String, entry.GetProperty("originalLastWriteTimeUtcTicks").ValueKind);
+        Assert.Equal(
+            originalTimestamp.UtcTicks.ToString(System.Globalization.CultureInfo.InvariantCulture),
+            entry.GetProperty("originalLastWriteTimeUtcTicks").GetString());
+    }
+
+    [Fact]
+    public async Task RestoreBackup_AcceptsNodeStyleV2MetadataAndMillisecondSessionTimestamp()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-node-backup.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-node-backup", "apigather");
+        string originalFirstLine = (await File.ReadAllLinesAsync(rolloutPath))[0];
+        DateTimeOffset originalTimestamp = new(2026, 7, 8, 9, 10, 11, 456, TimeSpan.Zero);
+
+        string backupDir = fixture.BackupPath("20260708T091011456Z");
+        Directory.CreateDirectory(backupDir);
+        await File.WriteAllTextAsync(Path.Combine(backupDir, "config.toml"), "model_provider = \"apigather\"\n");
+        await File.WriteAllTextAsync(
+            Path.Combine(backupDir, AppConstants.GlobalStateFileBasename),
+            "{\"source\":\"node-backup\"}\n");
+        await File.WriteAllTextAsync(
+            Path.Combine(backupDir, "metadata.json"),
+            JsonSerializer.Serialize(new
+            {
+                version = 2,
+                @namespace = AppConstants.BackupNamespace,
+                codexHome = fixture.CodexHome,
+                sqliteHome = Path.Combine(fixture.CodexHome, AppConstants.SqliteDirBasename),
+                targetProvider = "openai",
+                createdAt = "2026-07-08T09:10:11.456Z",
+                dbFiles = Array.Empty<string>(),
+                sqliteDbFiles = Array.Empty<string>(),
+                changedSessionFiles = 1,
+                globalStateFiles = new Dictionary<string, bool>
+                {
+                    [AppConstants.GlobalStateFileBasename] = true,
+                    [AppConstants.GlobalStateBackupFileBasename] = false
+                }
+            }));
+        await File.WriteAllTextAsync(
+            Path.Combine(backupDir, "session-meta-backup.json"),
+            JsonSerializer.Serialize(new
+            {
+                version = 2,
+                @namespace = AppConstants.BackupNamespace,
+                codexHome = fixture.CodexHome,
+                targetProvider = "openai",
+                createdAt = "2026-07-08T09:10:11.456Z",
+                files = new[]
+                {
+                    new
+                    {
+                        path = rolloutPath,
+                        originalFirstLine,
+                        originalSeparator = "\n",
+                        originalLastWriteTimeUtc = "2026-07-08T09:10:11.456Z",
+                        originalMtimeMs = originalTimestamp.ToUnixTimeMilliseconds(),
+                        modelOnlyChange = false,
+                        originalTurnContextModels = Array.Empty<object>()
+                    }
+                }
+            }));
+
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-node-backup", "openai");
+        string statePath = Path.Combine(fixture.CodexHome, AppConstants.GlobalStateFileBasename);
+        string stateBackupPath = Path.Combine(fixture.CodexHome, AppConstants.GlobalStateBackupFileBasename);
+        await File.WriteAllTextAsync(statePath, "{\"source\":\"current\"}\n");
+        await File.WriteAllTextAsync(stateBackupPath, "created-after-backup\n");
+
+        BackupService backups = new(new SessionRolloutService(), new SqliteStateService());
+        await backups.RestoreBackupAsync(
+            backupDir,
+            fixture.CodexHome,
+            new RestoreBackupOptions { RestoreDatabase = false });
+
+        Assert.Equal(originalFirstLine, (await File.ReadAllLinesAsync(rolloutPath))[0]);
+        Assert.Equal(originalTimestamp.UtcDateTime, File.GetLastWriteTimeUtc(rolloutPath));
+        Assert.Equal("{\"source\":\"node-backup\"}\n", await File.ReadAllTextAsync(statePath));
+        Assert.False(File.Exists(stateBackupPath));
+    }
+
+    [Fact]
+    public async Task RestoreGlobalState_RejectsCanonicalAndLegacyPresenceConflictBeforeMutation()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        string backupDir = fixture.BackupPath("20260708T091011999Z");
+        Directory.CreateDirectory(backupDir);
+        string statePath = Path.Combine(fixture.CodexHome, AppConstants.GlobalStateFileBasename);
+        await File.WriteAllTextAsync(statePath, "current\n");
+        await File.WriteAllTextAsync(
+            Path.Combine(backupDir, AppConstants.GlobalStateFileBasename),
+            "backup\n");
+        await File.WriteAllTextAsync(
+            Path.Combine(backupDir, "metadata.json"),
+            JsonSerializer.Serialize(new
+            {
+                version = 2,
+                @namespace = AppConstants.BackupNamespace,
+                codexHome = fixture.CodexHome,
+                targetProvider = "openai",
+                createdAt = "2026-07-08T09:10:11.999Z",
+                dbFiles = Array.Empty<string>(),
+                sqliteDbFiles = Array.Empty<string>(),
+                changedSessionFiles = 0,
+                globalStateFiles = new Dictionary<string, bool>
+                {
+                    [AppConstants.GlobalStateFileBasename] = true,
+                    [AppConstants.GlobalStateBackupFileBasename] = true
+                },
+                globalStateFilePresent = true,
+                globalStateBackupFilePresent = false
+            }));
+
+        BackupService backups = new(new SessionRolloutService(), new SqliteStateService());
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => backups.RestoreGlobalStateFilesAsync(backupDir, fixture.CodexHome));
+
+        Assert.Contains("disagrees", error.Message, StringComparison.Ordinal);
+        Assert.Equal("current\n", await File.ReadAllTextAsync(statePath));
+    }
+}
diff --git a/desktop/CodexProviderSync.Core.Tests/CodexProviderSync.Core.Tests.csproj b/desktop/CodexProviderSync.Core.Tests/CodexProviderSync.Core.Tests.csproj
index 6cb59ac..b60a51c 100644
--- a/desktop/CodexProviderSync.Core.Tests/CodexProviderSync.Core.Tests.csproj
+++ b/desktop/CodexProviderSync.Core.Tests/CodexProviderSync.Core.Tests.csproj
@@ -18,8 +18,13 @@
     <Using Include="Xunit" />
   </ItemGroup>
 
+  <ItemGroup>
+    <Compile Remove="CrashHost\**\*.cs" />
+  </ItemGroup>
+
   <ItemGroup>
     <ProjectReference Include="..\CodexProviderSync.Core\CodexProviderSync.Core.csproj" />
+    <ProjectReference Include="CrashHost\CodexProviderSync.CrashHost.csproj" ReferenceOutputAssembly="false" />
   </ItemGroup>
 
-</Project>
\ No newline at end of file
+</Project>
diff --git a/desktop/CodexProviderSync.Core.Tests/CoreIntegrationTests.cs b/desktop/CodexProviderSync.Core.Tests/CoreIntegrationTests.cs
index b2cccdd..da14a9f 100644
--- a/desktop/CodexProviderSync.Core.Tests/CoreIntegrationTests.cs
+++ b/desktop/CodexProviderSync.Core.Tests/CoreIntegrationTests.cs
@@ -7,1533 +7,3095 @@ namespace CodexProviderSync.Core.Tests;
 public sealed class CoreIntegrationTests
 {
     [Fact]
-    public async Task GetStatus_ReportsWindowsWslUncSqliteHomeWithoutOpeningDatabase()
+    public async Task RunSync_RollsBackFirstRollout_WhenLaterTargetFails_Issue69()
     {
-        if (!OperatingSystem.IsWindows())
-        {
-            return;
-        }
-
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string sqliteHome = $@"\\wsl.localhost\Ubuntu\tmp\codex-provider-sync-{Guid.NewGuid():N}";
-        Stopwatch timer = Stopwatch.StartNew();
+        string firstPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
+        string secondPath = fixture.RolloutPath("sessions", "rollout-b.jsonl");
+        await fixture.WriteRolloutAsync(firstPath, "thread-a", "apigather");
+        await fixture.WriteRolloutAsync(secondPath, "thread-b", "apigather");
+        await fixture.WriteStateDbAsync([
+            ("thread-a", "apigather", false),
+            ("thread-b", "apigather", false)
+        ]);
+        string firstBefore = await File.ReadAllTextAsync(firstPath);
+        string secondBefore = await File.ReadAllTextAsync(secondPath);
 
-        StatusSnapshot status = await new CodexSyncService().GetStatusAsync(fixture.CodexHome, sqliteHome);
+        CodexSyncService service = new();
+        service.FaultInjector = (point, _, appliedCount) =>
+        {
+            if (point == "before_rollout_apply" && appliedCount == 2)
+            {
+                throw new IOException("injected second-target failure");
+            }
+            return Task.CompletedTask;
+        };
 
-        timer.Stop();
-        Assert.False(status.SqliteAccess.Supported);
-        Assert.Null(status.StateDbLocation);
-        Assert.Null(status.SqliteCounts);
-        Assert.Contains("Windows cannot safely access SQLite", TextFormatter.FormatStatus(status));
-        string chineseStatus = TextFormatter.FormatStatus(status, TextFormatter.ChineseSimplified);
-        Assert.Contains("Windows 进程无法通过 WSL UNC 路径安全访问 SQLite", chineseStatus);
-        Assert.Contains("请在 WSL 内运行 codex-provider", chineseStatus);
-        Assert.DoesNotContain("currently in use", TextFormatter.FormatStatus(status));
-        Assert.True(timer.Elapsed < TimeSpan.FromSeconds(5), $"Status took {timer.Elapsed}.");
+        SyncTransactionException error = await Assert.ThrowsAsync<SyncTransactionException>(
+            () => service.RunSyncAsync(fixture.CodexHome, provider: "openai"));
+        Assert.Contains("injected second-target failure", error.OriginalError.Message);
+        Assert.Equal("complete", error.RollbackStatus);
+        Assert.False(error.RecoveryRequired);
+        Assert.Equal(
+            RelativeTargetIdentity(fixture.CodexHome, firstPath),
+            RelativeTargetIdentity(fixture.CodexHome, Assert.Single(error.CompletedTargets)));
+        Assert.Equal(firstBefore, await File.ReadAllTextAsync(firstPath));
+        Assert.Equal(secondBefore, await File.ReadAllTextAsync(secondPath));
+        Assert.Equal("apigather", await ReadProviderAsync(fixture.StateDbPath(), "thread-a"));
+        Assert.Equal("apigather", await ReadProviderAsync(fixture.StateDbPath(), "thread-b"));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RunSync_BlocksWindowsWslUncBeforeCreatingBackup()
+    public async Task RunSync_RestoresGlobalStatePrimary_WhenBackupWriteFails_Issue69()
     {
-        if (!OperatingSystem.IsWindows())
-        {
-            return;
-        }
-
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        await fixture.WriteGlobalStateAsync(new Dictionary<string, object?>
+        {
+            ["electron-saved-workspace-roots"] = new[] { @"\\?\D:\Workspace\sample" },
+            ["project-order"] = new[] { @"\\?\D:\Workspace\sample" },
+            ["active-workspace-roots"] = new[] { @"\\?\D:\Workspace\sample" }
+        });
+        await fixture.WriteStateDbWithCwdAsync([
+            ("thread-global", "openai", false, @"\\?\D:\Workspace\sample")
+        ]);
+        string primaryPath = Path.Combine(fixture.CodexHome, AppConstants.GlobalStateFileBasename);
+        string backupPath = Path.Combine(fixture.CodexHome, AppConstants.GlobalStateBackupFileBasename);
+        string primaryBefore = await File.ReadAllTextAsync(primaryPath);
+        string backupBefore = await File.ReadAllTextAsync(backupPath);
 
-        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
-            () => new CodexSyncService().RunSyncAsync(
-                fixture.CodexHome,
-                explicitSqliteHome: @"\\wsl.localhost\Ubuntu\home\user\.codex\sqlite"));
+        CodexSyncService service = new();
+        service.FaultInjector = (point, appliedPath, _) =>
+        {
+            if (point == "after_global_state_apply"
+                && string.Equals(appliedPath, primaryPath, StringComparison.Ordinal))
+            {
+                throw new IOException("injected global-state backup failure");
+            }
+            return Task.CompletedTask;
+        };
 
-        Assert.Contains("Cannot sync", error.Message);
-        Assert.Contains("Run codex-provider inside WSL", error.Message);
-        Assert.False(Directory.Exists(fixture.BackupRoot()));
+        SyncTransactionException error = await Assert.ThrowsAsync<SyncTransactionException>(
+            () => service.RunSyncAsync(fixture.CodexHome));
+        Assert.Contains("injected global-state backup failure", error.OriginalError.Message);
+        Assert.Equal("complete", error.RollbackStatus);
+        Assert.False(error.RecoveryRequired);
+        Assert.Equal(primaryBefore, await File.ReadAllTextAsync(primaryPath));
+        Assert.Equal(backupBefore, await File.ReadAllTextAsync(backupPath));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RunSwitch_BlocksWindowsWslUncBeforeUpdatingConfig()
+    public async Task FailureAfterSqliteCommit_RestoresRolloutAndDatabase()
     {
-        if (!OperatingSystem.IsWindows())
-        {
-            return;
-        }
-
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string configPath = Path.Combine(fixture.CodexHome, "config.toml");
-        string originalConfig = await File.ReadAllTextAsync(configPath);
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-after-sqlite.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-after-sqlite", "apigather");
+        await fixture.WriteStateDbAsync([("thread-after-sqlite", "apigather", false)]);
+        string before = await File.ReadAllTextAsync(sessionPath);
 
-        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
-            () => new CodexSyncService().RunSwitchAsync(
-                fixture.CodexHome,
-                "apigather",
-                explicitSqliteHome: @"\\wsl$\Ubuntu\home\user\.codex\sqlite"));
+        CodexSyncService service = new();
+        service.FaultInjector = (point, _, _) =>
+        {
+            if (point == "after_sqlite_commit")
+            {
+                throw new IOException("injected post-SQLite failure");
+            }
+            return Task.CompletedTask;
+        };
 
-        Assert.Contains("Cannot switch", error.Message);
-        Assert.Equal(originalConfig, await File.ReadAllTextAsync(configPath));
-        Assert.False(Directory.Exists(fixture.BackupRoot()));
+        SyncTransactionException error = await Assert.ThrowsAsync<SyncTransactionException>(
+            () => service.RunSyncAsync(fixture.CodexHome, provider: "openai"));
+
+        Assert.Contains("injected post-SQLite failure", error.OriginalError.Message);
+        Assert.Equal("complete", error.RollbackStatus);
+        Assert.False(error.RecoveryRequired);
+        Assert.Contains(
+            RelativeTargetIdentity(fixture.CodexHome, sessionPath),
+            error.CompletedTargets.Select(path => RelativeTargetIdentity(fixture.CodexHome, path)));
+        Assert.Contains(
+            RelativeTargetIdentity(fixture.CodexHome, fixture.StateDbPath()),
+            error.CompletedTargets.Select(path => RelativeTargetIdentity(fixture.CodexHome, path)));
+        Assert.Equal(before, await File.ReadAllTextAsync(sessionPath));
+        Assert.Equal("apigather", await ReadProviderAsync(fixture.StateDbPath(), "thread-after-sqlite"));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RunRestore_BlocksWindowsWslUncBeforeReadingBackup()
+    public async Task SqliteCommitAcknowledgementFailure_RestoresConfigRolloutAndDatabase()
     {
-        if (!OperatingSystem.IsWindows())
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync(
+            "model_provider = \"openai\"\n"
+            + "model = \"gpt-5.4-mini\"\n\n"
+            + "[model_providers.apigather]\n"
+            + "model = \"apigather-prod\"\n"
+            + "base_url = \"https://example.com\"\n");
+        string configPath = Path.Combine(fixture.CodexHome, "config.toml");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-commit-ack-unknown.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-commit-ack-unknown", "openai");
+        await fixture.WriteStateDbAsync([("thread-commit-ack-unknown", "openai", false)]);
+        string configBefore = await File.ReadAllTextAsync(configPath);
+        string rolloutBefore = await File.ReadAllTextAsync(sessionPath);
+        bool durableSqliteMutationObserved = false;
+
+        CodexSyncService service = new();
+        service.FaultInjector = async (point, _, _) =>
         {
-            return;
-        }
+            if (point != "after_sqlite_commit_before_ack")
+            {
+                return;
+            }
 
-        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+            durableSqliteMutationObserved = string.Equals(
+                "apigather",
+                await ReadProviderAsync(fixture.StateDbPath(), "thread-commit-ack-unknown"),
+                StringComparison.Ordinal);
+            throw new IOException("injected lost SQLite commit acknowledgement");
+        };
 
-        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
-            () => new CodexSyncService().RunRestoreAsync(
-                fixture.CodexHome,
-                Path.Combine(fixture.Root, "missing-backup"),
-                @"\\wsl.localhost\Ubuntu\home\user\.codex\sqlite"));
+        SyncTransactionException error = await Assert.ThrowsAsync<SyncTransactionException>(
+            () => service.RunSwitchAsync(fixture.CodexHome, "apigather"));
 
-        Assert.Contains("Cannot restore", error.Message);
-        Assert.Contains("Run codex-provider inside WSL", error.Message);
+        Assert.True(durableSqliteMutationObserved);
+        Assert.Contains("injected lost SQLite commit acknowledgement", error.OriginalError.Message);
+        Assert.Equal("complete", error.RollbackStatus);
+        Assert.False(error.RecoveryRequired);
+        Assert.Equal(configBefore, await File.ReadAllTextAsync(configPath));
+        Assert.Equal(rolloutBefore, await File.ReadAllTextAsync(sessionPath));
+        Assert.Equal(
+            "openai",
+            await ReadProviderAsync(fixture.StateDbPath(), "thread-commit-ack-unknown"));
+
+        string journalPath = Path.Combine(error.BackupDirectory, FileTransactionJournal.FileName);
+        PendingTransactionInfo journal = await FileTransactionJournal.ReadInfoAsync(journalPath);
+        Assert.True(journal.Terminal);
+        Assert.False(journal.InvalidTail);
+        Assert.Equal("rolledBack", journal.State);
+        Assert.Contains(journal.AffectedTargets, target =>
+            target.Kind == "sqlite" && target.State == "applying");
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RunSync_RewritesRolloutFilesAndSqlite_ThenRestoreRevertsBoth()
+    public async Task CancellationAfterSqliteCommit_RestoresRolloutAndDatabase()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
-        string archivedPath = fixture.RolloutPath("archived_sessions", "rollout-b.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
-        await fixture.WriteRolloutAsync(archivedPath, "thread-b", "newapi");
-        await fixture.WriteStateDbAsync(
-        [
-            ("thread-a", "apigather", false),
-            ("thread-b", "newapi", true)
-        ]);
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-cancel-after-sqlite.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-cancel-after-sqlite", "apigather");
+        await fixture.WriteStateDbAsync([("thread-cancel-after-sqlite", "apigather", false)]);
+        string before = await File.ReadAllTextAsync(sessionPath);
+        using CancellationTokenSource cancellation = new();
 
         CodexSyncService service = new();
-        SyncResult syncResult = await service.RunSyncAsync(fixture.CodexHome);
-
-        Assert.Equal("openai", syncResult.TargetProvider);
-        Assert.Equal(2, syncResult.ChangedSessionFiles);
-        Assert.Empty(syncResult.SkippedLockedRolloutFiles);
-        Assert.Empty(syncResult.SkippedUnreadableRolloutFiles);
-        Assert.Equal(2, syncResult.SqliteRowsUpdated);
-        BackupMetadataFile backupMetadata = JsonSerializer.Deserialize<BackupMetadataFile>(
-            await File.ReadAllTextAsync(Path.Combine(syncResult.BackupDir, "metadata.json")),
-            new JsonSerializerOptions { PropertyNamingPolicy = JsonNamingPolicy.CamelCase })!;
-        Assert.Equal(
-        [
-            Path.Combine(AppConstants.SqliteDirBasename, AppConstants.DbFileBasename)
-        ],
-            backupMetadata.DbFiles);
-
-        string syncedSession = await File.ReadAllTextAsync(sessionPath);
-        string syncedArchived = await File.ReadAllTextAsync(archivedPath);
-        Assert.Contains("\"model_provider\":\"openai\"", syncedSession);
-        Assert.Contains("\"model_provider\":\"openai\"", syncedArchived);
-
-        await using (SqliteConnection connection = fixture.OpenSqliteConnection())
+        service.FaultInjector = (point, _, _) =>
         {
-            await connection.OpenAsync();
-            SqliteCommand command = connection.CreateCommand();
-            command.CommandText = "SELECT id, model_provider FROM threads ORDER BY id";
-            await using SqliteDataReader reader = await command.ExecuteReaderAsync();
-            List<(string Id, string Provider)> rows = [];
-            while (await reader.ReadAsync())
+            if (point == "after_sqlite_commit")
             {
-                rows.Add((reader.GetString(0), reader.GetString(1)));
+                cancellation.Cancel();
             }
+            return Task.CompletedTask;
+        };
 
-            Assert.Equal(
-            [
-                ("thread-a", "openai"),
-                ("thread-b", "openai")
-            ], rows);
-        }
-
-        RestoreResult restoreResult = await service.RunRestoreAsync(fixture.CodexHome, syncResult.BackupDir);
-        Assert.Equal("openai", restoreResult.TargetProvider);
-
-        string restoredSession = await File.ReadAllTextAsync(sessionPath);
-        string restoredArchived = await File.ReadAllTextAsync(archivedPath);
-        Assert.Contains("\"model_provider\":\"apigather\"", restoredSession);
-        Assert.Contains("\"model_provider\":\"newapi\"", restoredArchived);
+        SyncTransactionException error = await Assert.ThrowsAsync<SyncTransactionException>(
+            () => service.RunSyncAsync(
+                fixture.CodexHome,
+                provider: "openai",
+                cancellationToken: cancellation.Token));
+
+        Assert.IsType<OperationCanceledException>(error.OriginalError);
+        Assert.True(error.WasCanceled);
+        Assert.Equal("complete", error.RollbackStatus);
+        Assert.False(error.RecoveryRequired);
+        Assert.Equal(before, await File.ReadAllTextAsync(sessionPath));
+        Assert.Equal("apigather", await ReadProviderAsync(fixture.StateDbPath(), "thread-cancel-after-sqlite"));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RunSync_UpdatesLegacyRootSqliteDatabase_WhenSqliteDirStateIsStale()
+    public async Task CancellationAfterTransactionCommit_DoesNotRollBackCommittedState()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-active-a.jsonl");
-        string archivedPath = fixture.RolloutPath("archived_sessions", "rollout-active-b.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-active-a", "dal");
-        await fixture.WriteRolloutAsync(archivedPath, "thread-active-b", "dal");
-        await fixture.WriteStateDbAsync(
-        [
-            ("thread-active-a", "dal", false)
-        ]);
-        await fixture.WriteLegacyStateDbAsync(
-        [
-            ("thread-active-a", "dal", false),
-            ("thread-active-b", "dal", true)
-        ]);
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-cancel-after-commit.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-cancel-after-commit", "apigather");
+        await fixture.WriteStateDbAsync([("thread-cancel-after-commit", "apigather", false)]);
+        using CancellationTokenSource cancellation = new();
 
         CodexSyncService service = new();
-        SyncResult syncResult = await service.RunSyncAsync(fixture.CodexHome);
-
-        Assert.Equal(2, syncResult.SqliteRowsUpdated);
-        BackupMetadataFile backupMetadata = JsonSerializer.Deserialize<BackupMetadataFile>(
-            await File.ReadAllTextAsync(Path.Combine(syncResult.BackupDir, "metadata.json")),
-            new JsonSerializerOptions { PropertyNamingPolicy = JsonNamingPolicy.CamelCase })!;
-        Assert.Equal([AppConstants.DbFileBasename], backupMetadata.DbFiles);
-
-        await using (SqliteConnection connection = fixture.OpenLegacySqliteConnection())
+        service.FaultInjector = (point, _, _) =>
         {
-            await connection.OpenAsync();
-            SqliteCommand command = connection.CreateCommand();
-            command.CommandText = "SELECT id, model_provider FROM threads ORDER BY id";
-            await using SqliteDataReader reader = await command.ExecuteReaderAsync();
-            List<(string Id, string Provider)> rows = [];
-            while (await reader.ReadAsync())
+            if (point == "after_transaction_commit")
             {
-                rows.Add((reader.GetString(0), reader.GetString(1)));
+                cancellation.Cancel();
             }
+            return Task.CompletedTask;
+        };
 
-            Assert.Equal(
-            [
-                ("thread-active-a", "openai"),
-                ("thread-active-b", "openai")
-            ], rows);
-        }
-
-        await using (SqliteConnection connection = fixture.OpenSqliteConnection())
-        {
-            await connection.OpenAsync();
-            SqliteCommand command = connection.CreateCommand();
-            command.CommandText = "SELECT id, model_provider FROM threads ORDER BY id";
-            await using SqliteDataReader reader = await command.ExecuteReaderAsync();
-            List<(string Id, string Provider)> rows = [];
-            while (await reader.ReadAsync())
-            {
-                rows.Add((reader.GetString(0), reader.GetString(1)));
-            }
+        SyncResult result = await service.RunSyncAsync(
+            fixture.CodexHome,
+            provider: "openai",
+            cancellationToken: cancellation.Token);
 
-            Assert.Equal([("thread-active-a", "dal")], rows);
-        }
+        Assert.True(cancellation.IsCancellationRequested);
+        Assert.Equal(1, result.ChangedSessionFiles);
+        Assert.Equal("openai", await ReadProviderAsync(fixture.StateDbPath(), "thread-cancel-after-commit"));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RunSwitch_UpdatesConfigAndSyncsProviderMetadata()
+    public async Task FailureBeforeTransactionCommit_RollsBackBeforePruningOldBackups()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync(string.Empty);
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "openai");
-        await fixture.WriteStateDbAsync(
-        [
-            ("thread-a", "openai", false)
-        ]);
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-before-commit-failure.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-before-commit", "apigather");
+        await fixture.WriteStateDbAsync([("thread-before-commit", "apigather", false)]);
+        string before = await File.ReadAllTextAsync(sessionPath);
+        const string oldBackupName = "20260319T000000000Z";
+        await fixture.WriteBackupAsync(oldBackupName, ("note.txt", "must survive rollback"));
+        string oldBackupDir = fixture.BackupPath(oldBackupName);
 
         CodexSyncService service = new();
-        SyncResult result = await service.RunSwitchAsync(fixture.CodexHome, "apigather");
+        service.FaultInjector = (point, _, _) =>
+        {
+            if (point == "before_transaction_commit")
+            {
+                throw new IOException("injected transaction-commit failure");
+            }
+            return Task.CompletedTask;
+        };
 
-        Assert.Equal("apigather", result.TargetProvider);
-        Assert.True(result.ConfigUpdated);
+        SyncTransactionException error = await Assert.ThrowsAsync<SyncTransactionException>(
+            () => service.RunSyncAsync(fixture.CodexHome, provider: "openai", keepCount: 1));
 
-        string configText = await File.ReadAllTextAsync(Path.Combine(fixture.CodexHome, "config.toml"));
-        Assert.Contains("model_provider = \"apigather\"", configText);
-        string rollout = await File.ReadAllTextAsync(sessionPath);
-        Assert.Contains("\"model_provider\":\"apigather\"", rollout);
+        Assert.Contains("injected transaction-commit failure", error.OriginalError.Message);
+        Assert.Equal("complete", error.RollbackStatus);
+        Assert.False(error.RecoveryRequired);
+        Assert.True(Directory.Exists(oldBackupDir));
+        Assert.Equal(before, await File.ReadAllTextAsync(sessionPath));
+        Assert.Equal("apigather", await ReadProviderAsync(fixture.StateDbPath(), "thread-before-commit"));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RunSwitch_BackupCapturesPreSwitchProviderAndModel()
+    public async Task SqliteRollbackFailure_PreservesRecoveryEvidence_AndManualRestoreRecovers()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"gpt-5.4-mini\"");
-        string configPath = Path.Combine(fixture.CodexHome, "config.toml");
-        string originalConfig = await File.ReadAllTextAsync(configPath);
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-sqlite-rollback-failure.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-sqlite-rollback", "apigather");
+        await fixture.WriteStateDbAsync([("thread-sqlite-rollback", "apigather", false)]);
+        string before = await File.ReadAllTextAsync(sessionPath);
 
-        SyncResult result = await new CodexSyncService().RunSwitchAsync(
-            fixture.CodexHome,
-            "apigather",
-            model: "apigather-prod");
+        CodexSyncService service = new();
+        service.FaultInjector = (point, _, _) =>
+        {
+            if (point == "after_sqlite_commit")
+            {
+                throw new IOException("injected post-SQLite failure");
+            }
+            if (point == "before_sqlite_rollback")
+            {
+                throw new IOException("injected SQLite rollback failure");
+            }
+            return Task.CompletedTask;
+        };
 
-        Assert.Equal(
-            originalConfig,
-            await File.ReadAllTextAsync(Path.Combine(result.BackupDir, "config.toml")));
-        string switchedConfig = await File.ReadAllTextAsync(configPath);
-        Assert.Contains("model_provider = \"apigather\"", switchedConfig);
-        Assert.Contains("model = \"apigather-prod\"", switchedConfig);
+        SyncTransactionException error = await Assert.ThrowsAsync<SyncTransactionException>(
+            () => service.RunSyncAsync(fixture.CodexHome, provider: "openai"));
+
+        Assert.True(error.RecoveryRequired);
+        Assert.Equal("incomplete", error.RollbackStatus);
+        Assert.Contains(error.RollbackErrors, value => value.Contains("injected SQLite rollback failure"));
+        Assert.Equal(before, await File.ReadAllTextAsync(sessionPath));
+        Assert.Equal("openai", await ReadProviderAsync(fixture.StateDbPath(), "thread-sqlite-rollback"));
+        Assert.Single(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+
+        await service.RunRestoreAsync(fixture.CodexHome, error.BackupDirectory);
+        Assert.Equal(before, await File.ReadAllTextAsync(sessionPath));
+        Assert.Equal("apigather", await ReadProviderAsync(fixture.StateDbPath(), "thread-sqlite-rollback"));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RunSwitch_DoesNotTouchConfig_WhenPreSwitchBackupCreationFails()
+    public async Task UnfinishedJournal_BlocksWrites_UntilBoundBackupIsRestored()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"gpt-5.4-mini\"");
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        await fixture.WriteStateDbAsync([("thread-recovery", "openai", false)]);
         string configPath = Path.Combine(fixture.CodexHome, "config.toml");
-        string originalConfig = await File.ReadAllTextAsync(configPath);
-        DateTime pinnedLastWriteTime = new(2001, 2, 3, 4, 5, 6, DateTimeKind.Utc);
-        File.SetLastWriteTimeUtc(configPath, pinnedLastWriteTime);
-
-        Directory.CreateDirectory(Path.GetDirectoryName(fixture.BackupRoot())!);
-        await File.WriteAllTextAsync(fixture.BackupRoot(), "blocks backup directory creation");
+        BackupService backupService = new(new SessionRolloutService(), new SqliteStateService());
+        string backupDir = await backupService.CreateBackupAsync(
+            fixture.CodexHome,
+            "openai",
+            [],
+            configPath);
+        await FileTransactionJournal.CreateAsync(
+            backupDir,
+            fixture.CodexHome,
+            "openai",
+            [configPath]);
 
-        await Assert.ThrowsAnyAsync<Exception>(
-            () => new CodexSyncService().RunSwitchAsync(fixture.CodexHome, "apigather"));
-        Assert.Equal(originalConfig, await File.ReadAllTextAsync(configPath));
-        Assert.Equal(pinnedLastWriteTime, File.GetLastWriteTimeUtc(configPath));
+        CodexSyncService service = new();
+        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
+        Assert.Single(status.PendingTransactions);
+        Assert.Contains("Recovery required:", TextFormatter.FormatStatus(status));
+        Assert.Contains("需要恢复:", TextFormatter.FormatStatus(status, TextFormatter.ChineseSimplified));
+        RecoveryRequiredException error = await Assert.ThrowsAsync<RecoveryRequiredException>(
+            () => service.RunSyncAsync(fixture.CodexHome));
+        Assert.Single(error.PendingBackupDirectories);
+
+        await service.RunRestoreAsync(fixture.CodexHome, backupDir);
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
+        Assert.Equal("openai", result.TargetProvider);
     }
 
     [Fact]
-    public async Task RunSwitch_RestoresConfig_AfterPostBackupSyncFailure()
+    public async Task CrashRecovery_RestoresActuallyMutatedRolloutAndDatabase_FromPendingJournal()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"gpt-5.4-mini\"");
-        string configPath = Path.Combine(fixture.CodexHome, "config.toml");
-        string originalConfig = await File.ReadAllTextAsync(configPath);
-        await File.WriteAllTextAsync(
-            Path.Combine(fixture.CodexHome, AppConstants.GlobalStateFileBasename),
-            "{not-json");
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-crash-recovery.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-crash-recovery", "apigather");
+        await fixture.WriteStateDbAsync([("thread-crash-recovery", "apigather", false)]);
+        string before = await File.ReadAllTextAsync(sessionPath);
+
+        SessionRolloutService rolloutService = new();
+        SqliteStateService sqliteService = new();
+        SessionChangeCollection changes = await rolloutService.CollectSessionChangesAsync(
+            fixture.CodexHome,
+            "openai");
+        BackupService backupService = new(rolloutService, sqliteService);
+        string backupDir = await backupService.CreateBackupAsync(
+            fixture.CodexHome,
+            "openai",
+            changes.Changes,
+            Path.Combine(fixture.CodexHome, "config.toml"));
+        FileTransactionJournal journal = await FileTransactionJournal.CreateAsync(
+            backupDir,
+            fixture.CodexHome,
+            "openai",
+            [sessionPath, fixture.StateDbPath()]);
 
-        await Assert.ThrowsAnyAsync<Exception>(
-            () => new CodexSyncService().RunSwitchAsync(fixture.CodexHome, "apigather"));
-        Assert.Equal(originalConfig, await File.ReadAllTextAsync(configPath));
+        await journal.ApplyingAsync("rollout", sessionPath);
+        await rolloutService.ApplySessionChangesAsync(changes.Changes);
+        await journal.AppliedAsync("rollout", sessionPath);
+        await journal.ApplyingAsync("sqlite", fixture.StateDbPath());
+        await sqliteService.UpdateSqliteProviderAsync(fixture.CodexHome, "openai");
+        await journal.AppliedAsync("sqlite", fixture.StateDbPath());
 
-        string backupDir = Assert.Single(Directory.GetDirectories(fixture.BackupRoot()));
-        Assert.Equal(
-            originalConfig,
-            await File.ReadAllTextAsync(Path.Combine(backupDir, "config.toml")));
+        Assert.NotEqual(before, await File.ReadAllTextAsync(sessionPath));
+        Assert.Equal("openai", await ReadProviderAsync(fixture.StateDbPath(), "thread-crash-recovery"));
+        CodexSyncService service = new();
+        Assert.Single((await service.GetStatusAsync(fixture.CodexHome)).PendingTransactions);
+        await Assert.ThrowsAsync<RecoveryRequiredException>(
+            () => service.RunSyncAsync(fixture.CodexHome));
+
+        await service.RunRestoreAsync(fixture.CodexHome, backupDir);
+
+        Assert.Equal(before, await File.ReadAllTextAsync(sessionPath));
+        Assert.Equal("apigather", await ReadProviderAsync(fixture.StateDbPath(), "thread-crash-recovery"));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RunSync_RepairsSqliteHasUserEventFromRolloutUserMessages()
+    public async Task RollbackFailure_PreservesBothErrors_AndManualRecoveryEvidence()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "openai");
-        await fixture.WriteStateDbWithUserEventColumnAsync(
-        [
-            ("thread-a", "openai", false, false)
-        ]);
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-rollback-failure.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-rollback", "apigather");
+        await fixture.WriteStateDbAsync([("thread-rollback", "apigather", false)]);
 
         CodexSyncService service = new();
-        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
-
-        Assert.Equal(0, result.ChangedSessionFiles);
-        Assert.Equal(1, result.SqliteRowsUpdated);
-        Assert.Equal(1, result.SqliteUserEventRowsUpdated);
+        service.FaultInjector = (point, _, _) =>
+        {
+            if (point == "after_rollout_apply")
+            {
+                throw new IOException("injected original failure");
+            }
+            if (point == "before_rollout_rollback")
+            {
+                throw new IOException("injected rollback failure");
+            }
+            return Task.CompletedTask;
+        };
 
-        await using SqliteConnection connection = fixture.OpenSqliteConnection();
-        await connection.OpenAsync();
-        SqliteCommand command = connection.CreateCommand();
-        command.CommandText = "SELECT has_user_event FROM threads WHERE id = 'thread-a'";
-        long hasUserEvent = (long)(await command.ExecuteScalarAsync())!;
-        Assert.Equal(1, hasUserEvent);
+        SyncTransactionException error = await Assert.ThrowsAsync<SyncTransactionException>(
+            () => service.RunSyncAsync(fixture.CodexHome));
+        Assert.Contains("injected original failure", error.OriginalError.Message);
+        Assert.Contains(error.RollbackErrors, value => value.Contains("injected rollback failure"));
+        Assert.Equal("incomplete", error.RollbackStatus);
+        Assert.True(error.RecoveryRequired);
+        Assert.Single(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+
+        await service.RunRestoreAsync(fixture.CodexHome, error.BackupDirectory);
+        using JsonDocument restored = JsonDocument.Parse(
+            (await File.ReadAllTextAsync(sessionPath)).Split('\n', StringSplitOptions.RemoveEmptyEntries)[0]);
+        Assert.Equal("apigather", restored.RootElement.GetProperty("payload").GetProperty("model_provider").GetString());
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RunSync_RepairsSqliteCwdFromRolloutSessionMetadata()
+    public async Task Cancellation_AfterFirstTarget_RollsBackDiskAndSqlite_WithStructuredEvidence()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-cwd.jsonl");
-        await fixture.WriteRolloutAsync(
-            sessionPath,
-            "thread-cwd",
-            "openai",
-            @"D:\GitHubProject\oss-maintainer-hub");
-        await fixture.WriteStateDbWithCwdAsync(
-        [
-            ("thread-cwd", "openai", false, @"\\?\D:\GitHubProject\oss-maintainer-hub")
+        string firstPath = fixture.RolloutPath("sessions", "rollout-cancel-a.jsonl");
+        string secondPath = fixture.RolloutPath("sessions", "rollout-cancel-b.jsonl");
+        await fixture.WriteRolloutAsync(firstPath, "thread-cancel-a", "apigather");
+        await fixture.WriteRolloutAsync(secondPath, "thread-cancel-b", "apigather");
+        await fixture.WriteStateDbAsync([
+            ("thread-cancel-a", "apigather", false),
+            ("thread-cancel-b", "apigather", false)
         ]);
-
+        string firstBefore = await File.ReadAllTextAsync(firstPath);
+        string secondBefore = await File.ReadAllTextAsync(secondPath);
+        using CancellationTokenSource cancellation = new();
         CodexSyncService service = new();
-        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
-
-        Assert.Equal(0, result.ChangedSessionFiles);
-        Assert.Equal(1, result.SqliteRowsUpdated);
-        Assert.Equal(1, result.SqliteCwdRowsUpdated);
+        string? cancelledAfterPath = null;
+        service.FaultInjector = (point, appliedPath, appliedCount) =>
+        {
+            if (point == "after_rollout_apply" && appliedCount == 1)
+            {
+                cancelledAfterPath = appliedPath;
+                cancellation.Cancel();
+            }
+            return Task.CompletedTask;
+        };
 
-        await using SqliteConnection connection = fixture.OpenSqliteConnection();
-        await connection.OpenAsync();
-        SqliteCommand command = connection.CreateCommand();
-        command.CommandText = "SELECT cwd FROM threads WHERE id = 'thread-cwd'";
-        string cwd = (string)(await command.ExecuteScalarAsync())!;
-        Assert.Equal(@"D:\GitHubProject\oss-maintainer-hub", cwd);
+        SyncTransactionException error = await Assert.ThrowsAsync<SyncTransactionException>(
+            () => service.RunSyncAsync(
+                fixture.CodexHome,
+                provider: "openai",
+                cancellationToken: cancellation.Token));
+
+        Assert.IsType<OperationCanceledException>(error.OriginalError);
+        Assert.True(error.WasCanceled);
+        Assert.Equal("SYNC_FAILED_ROLLED_BACK", error.Code);
+        Assert.Equal("complete", error.RollbackStatus);
+        Assert.False(error.RecoveryRequired);
+        string observedRelativeTarget = RelativeTargetIdentity(
+            fixture.CodexHome,
+            Assert.IsType<string>(cancelledAfterPath));
+        Assert.Equal(
+            RelativeTargetIdentity(fixture.CodexHome, firstPath),
+            observedRelativeTarget);
+        Assert.Equal(
+            RelativeTargetIdentity(fixture.CodexHome, firstPath),
+            RelativeTargetIdentity(fixture.CodexHome, Assert.Single(error.CompletedTargets)));
+        Assert.Equal(firstBefore, await File.ReadAllTextAsync(firstPath));
+        Assert.Equal(secondBefore, await File.ReadAllTextAsync(secondPath));
+        Assert.Equal("apigather", await ReadProviderAsync(fixture.StateDbPath(), "thread-cancel-a"));
+        Assert.Equal("apigather", await ReadProviderAsync(fixture.StateDbPath(), "thread-cancel-b"));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RunSync_NormalizesExtendedRolloutCwd_BeforeRepairingSqlite()
+    public async Task Rollback_ContinuesPerTarget_WhenOneRolloutRestoreFails()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-cwd-extended.jsonl");
-        await fixture.WriteRolloutAsync(
-            sessionPath,
-            "thread-cwd-extended",
-            "openai",
-            @"\\?\E:\GitHubProject\lin-framework");
-        await fixture.WriteStateDbWithCwdAsync(
-        [
-            ("thread-cwd-extended", "openai", false, @"\\?\E:\GitHubProject\lin-framework")
-        ]);
-
+        string firstPath = fixture.RolloutPath("sessions", "rollout-per-target-a.jsonl");
+        string secondPath = fixture.RolloutPath("sessions", "rollout-per-target-b.jsonl");
+        await fixture.WriteRolloutAsync(firstPath, "thread-per-target-a", "apigather");
+        await fixture.WriteRolloutAsync(secondPath, "thread-per-target-b", "apigather");
+        string firstBefore = await File.ReadAllTextAsync(firstPath);
+        string secondBefore = await File.ReadAllTextAsync(secondPath);
         CodexSyncService service = new();
-        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
+        service.FaultInjector = (point, path, count) =>
+        {
+            if (point == "after_rollout_apply" && count == 2)
+            {
+                throw new IOException("injected after both rollout writes");
+            }
+            if (point == "before_rollout_rollback"
+                && string.Equals(Path.GetFullPath(path!), Path.GetFullPath(secondPath), StringComparison.OrdinalIgnoreCase))
+            {
+                throw new IOException("injected second rollout restore failure");
+            }
+            return Task.CompletedTask;
+        };
 
-        Assert.Equal(1, result.SqliteRowsUpdated);
-        Assert.Equal(1, result.SqliteCwdRowsUpdated);
+        SyncTransactionException error = await Assert.ThrowsAsync<SyncTransactionException>(
+            () => service.RunSyncAsync(fixture.CodexHome));
 
-        await using SqliteConnection connection = fixture.OpenSqliteConnection();
-        await connection.OpenAsync();
-        SqliteCommand command = connection.CreateCommand();
-        command.CommandText = "SELECT cwd FROM threads WHERE id = 'thread-cwd-extended'";
-        string cwd = (string)(await command.ExecuteScalarAsync())!;
-        Assert.Equal(@"E:\GitHubProject\lin-framework", cwd);
+        Assert.True(error.RecoveryRequired);
+        Assert.Equal(firstBefore, await File.ReadAllTextAsync(firstPath));
+        Assert.NotEqual(secondBefore, await File.ReadAllTextAsync(secondPath));
+        Assert.Contains(error.RollbackErrors, failure =>
+            failure.Contains(secondPath, StringComparison.Ordinal)
+            && failure.Contains("injected second rollout restore failure", StringComparison.Ordinal));
+
+        await new CodexSyncService().RunRestoreAsync(
+            fixture.CodexHome,
+            error.BackupDirectory,
+            new RestoreBackupOptions
+            {
+                RestoreConfig = false,
+                RestoreDatabase = false,
+                RestoreSessions = true
+            });
+        Assert.Equal(firstBefore, await File.ReadAllTextAsync(firstPath));
+        Assert.Equal(secondBefore, await File.ReadAllTextAsync(secondPath));
     }
 
     [Fact]
-    public async Task RunSync_RestoresWorkspaceRootsFromProjectOrder_NormalizesForDesktop_AndRestoreRevertsGlobalState()
+    public async Task Rollback_DoesNotRestoreSqlite_WhenItsTransactionNeverCommitted()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        await fixture.WriteGlobalStateAsync(new Dictionary<string, object?>
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-sqlite-not-committed.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-sqlite-not-committed", "apigather");
+        await fixture.WriteStateDbAsync([("thread-sqlite-not-committed", "apigather", false)]);
+        bool concurrentMarkerWritten = false;
+        bool sqliteCommitAttemptObserved = false;
+        CodexSyncService service = new();
+        service.FaultInjector = async (point, _, _) =>
         {
-            ["electron-saved-workspace-roots"] = new[]
+            if (point == "after_rollout_apply")
             {
-                @"\\?\D:\GitHubProject\codex-provider-sync"
-            },
-            ["project-order"] = new[]
-            {
-                @"\\?\D:\GitHubProject\codex-provider-sync",
-                @"\\?\E:\NewRich\BrainLife\Code\BrainLife\Assets"
-            },
-            ["active-workspace-roots"] = new[]
+                throw new IOException("injected before SQLite commit");
+            }
+            if (point == "before_rollout_rollback" && !concurrentMarkerWritten)
             {
-                @"\\?\D:\GitHubProject\codex-provider-sync"
-            },
-            ["electron-workspace-root-labels"] = new Dictionary<string, string>
+                await using SqliteConnection connection = fixture.OpenSqliteConnection();
+                await connection.OpenAsync();
+                SqliteCommand command = connection.CreateCommand();
+                command.CommandText = """
+                    INSERT INTO threads (id, model_provider, cwd, archived, first_user_message)
+                    VALUES ('concurrent-marker', 'external', '', 0, 'external')
+                    """;
+                await command.ExecuteNonQueryAsync();
+                concurrentMarkerWritten = true;
+            }
+            if (point == "after_sqlite_commit_before_ack")
             {
-                [@"\\?\E:\NewRich\BrainLife\Code\BrainLife\Assets"] = "BrainLifeAssets"
+                sqliteCommitAttemptObserved = true;
             }
-        });
-        await fixture.WriteStateDbWithCwdAsync(
-        [
-            ("thread-a", "openai", false, @"\\?\D:\GitHubProject\codex-provider-sync"),
-            ("thread-b", "openai", false, @"\\?\E:\NewRich\BrainLife\Code\BrainLife\Assets")
-        ]);
+        };
 
-        CodexSyncService service = new();
-        SyncResult syncResult = await service.RunSyncAsync(fixture.CodexHome);
+        SyncTransactionException error = await Assert.ThrowsAsync<SyncTransactionException>(
+            () => service.RunSyncAsync(fixture.CodexHome));
 
-        Assert.Equal(2, syncResult.UpdatedWorkspaceRoots);
+        Assert.False(error.RecoveryRequired);
+        Assert.True(concurrentMarkerWritten);
+        Assert.False(sqliteCommitAttemptObserved);
+        Assert.Equal("apigather", await ReadProviderAsync(fixture.StateDbPath(), "thread-sqlite-not-committed"));
+        Assert.Equal("external", await ReadProviderAsync(fixture.StateDbPath(), "concurrent-marker"));
+    }
 
-        JsonDocument syncedState = JsonDocument.Parse(
-            await File.ReadAllTextAsync(Path.Combine(fixture.CodexHome, AppConstants.GlobalStateFileBasename)));
-        Assert.Equal(
-        [
-            @"D:\GitHubProject\codex-provider-sync",
-            @"E:\NewRich\BrainLife\Code\BrainLife\Assets"
-        ],
-            syncedState.RootElement.GetProperty("electron-saved-workspace-roots").EnumerateArray().Select(static entry => entry.GetString()!).ToArray());
-        Assert.Equal(
-        [
-            @"D:\GitHubProject\codex-provider-sync",
-            @"E:\NewRich\BrainLife\Code\BrainLife\Assets"
-        ],
-            syncedState.RootElement.GetProperty("project-order").EnumerateArray().Select(static entry => entry.GetString()!).ToArray());
-        Assert.Equal(
-            @"D:\GitHubProject\codex-provider-sync",
-            syncedState.RootElement.GetProperty("active-workspace-roots")[0].GetString());
-        Assert.Equal(
-            "BrainLifeAssets",
-            syncedState.RootElement.GetProperty("electron-workspace-root-labels")
-                .GetProperty(@"E:\NewRich\BrainLife\Code\BrainLife\Assets")
-                .GetString());
+    [Fact]
+    public async Task Cancellation_AfterOnlyRollout_IsObservedBeforeSqliteCommit()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-cancel-only.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-cancel-only", "apigather");
+        await fixture.WriteStateDbAsync([("thread-cancel-only", "apigather", false)]);
+        string before = await File.ReadAllTextAsync(sessionPath);
+        using CancellationTokenSource cancellation = new();
+        CodexSyncService service = new();
+        service.FaultInjector = (point, _, appliedCount) =>
+        {
+            if (point == "after_rollout_apply" && appliedCount == 1)
+            {
+                cancellation.Cancel();
+            }
+            return Task.CompletedTask;
+        };
 
-        await service.RunRestoreAsync(fixture.CodexHome, syncResult.BackupDir);
+        SyncTransactionException error = await Assert.ThrowsAsync<SyncTransactionException>(
+            () => service.RunSyncAsync(
+                fixture.CodexHome,
+                provider: "openai",
+                cancellationToken: cancellation.Token));
 
-        JsonDocument restoredState = JsonDocument.Parse(
-            await File.ReadAllTextAsync(Path.Combine(fixture.CodexHome, AppConstants.GlobalStateFileBasename)));
-        Assert.Equal(
-        [
-            @"\\?\D:\GitHubProject\codex-provider-sync"
-        ],
-            restoredState.RootElement.GetProperty("electron-saved-workspace-roots").EnumerateArray().Select(static entry => entry.GetString()!).ToArray());
+        Assert.IsType<OperationCanceledException>(error.OriginalError);
+        Assert.True(error.WasCanceled);
+        Assert.Equal("complete", error.RollbackStatus);
+        Assert.False(error.RecoveryRequired);
         Assert.Equal(
-        [
-            @"\\?\D:\GitHubProject\codex-provider-sync",
-            @"\\?\E:\NewRich\BrainLife\Code\BrainLife\Assets"
-        ],
-            restoredState.RootElement.GetProperty("project-order").EnumerateArray().Select(static entry => entry.GetString()!).ToArray());
+            RelativeTargetIdentity(fixture.CodexHome, sessionPath),
+            RelativeTargetIdentity(fixture.CodexHome, Assert.Single(error.CompletedTargets)));
+        Assert.Equal(before, await File.ReadAllTextAsync(sessionPath));
+        Assert.Equal("apigather", await ReadProviderAsync(fixture.StateDbPath(), "thread-cancel-only"));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task GetStatus_ReportsImplicitDefaultProviderAndCounts()
+    public async Task ConcurrentSync_IsRejectedByOperationLock_WithoutCompetingMutation()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync(string.Empty);
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
-        string archivedPath = fixture.RolloutPath("archived_sessions", "rollout-b.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
-        await fixture.WriteRolloutAsync(archivedPath, "thread-b", "openai");
-        long backupOneBytes = await fixture.WriteBackupAsync("20260319T000000000Z", ("note.txt", "backup-one"));
-        long backupTwoBytes = await fixture.WriteBackupAsync("20260320T000000000Z", ("note.txt", "backup-two"));
-        await fixture.WriteStateDbAsync(
-        [
-            ("thread-a", "apigather", false),
-            ("thread-b", "openai", true)
-        ]);
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-concurrent.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-concurrent", "apigather");
+        await fixture.WriteStateDbAsync([("thread-concurrent", "apigather", false)]);
+        TaskCompletionSource<bool> firstMutationObserved = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        TaskCompletionSource<bool> releaseFirstOperation = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        CodexSyncService firstService = new();
+        firstService.FaultInjector = async (point, _, appliedCount) =>
+        {
+            if (point == "after_rollout_apply" && appliedCount == 1)
+            {
+                firstMutationObserved.TrySetResult(true);
+                await releaseFirstOperation.Task;
+            }
+        };
 
+        Task<SyncResult> firstSync = firstService.RunSyncAsync(fixture.CodexHome, provider: "openai");
+        await firstMutationObserved.Task.WaitAsync(TimeSpan.FromSeconds(10));
+        try
+        {
+            InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+                () => new CodexSyncService().RunSyncAsync(fixture.CodexHome, provider: "openai"));
+            Assert.Contains("Lock already exists", error.Message);
+        }
+        finally
+        {
+            releaseFirstOperation.TrySetResult(true);
+        }
+
+        SyncResult result = await firstSync.WaitAsync(TimeSpan.FromSeconds(10));
+        Assert.Equal(1, result.ChangedSessionFiles);
+        Assert.Equal("openai", await ReadProviderAsync(fixture.StateDbPath(), "thread-concurrent"));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+    }
+
+    [Fact]
+    public async Task RepeatedSync_IsIdempotentForRolloutAndSqliteState()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-idempotent.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-idempotent", "apigather");
+        await fixture.WriteStateDbAsync([("thread-idempotent", "apigather", false)]);
         CodexSyncService service = new();
-        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
 
-        Assert.Equal("openai", status.CurrentProvider.Provider);
-        Assert.True(status.CurrentProvider.Implicit);
-        Assert.Equal(1, status.RolloutCounts.Sessions["apigather"]);
-        Assert.Equal(1, status.SqliteCounts!.ArchivedSessions["openai"]);
-        Assert.NotNull(status.StateDbLocation);
-        Assert.Equal("sqlite-dir", status.StateDbLocation!.Source);
-        Assert.Equal(fixture.StateDbPath(), status.StateDbLocation.Path);
-        Assert.Equal(2, status.BackupSummary.Count);
-        Assert.Equal(backupOneBytes + backupTwoBytes, status.BackupSummary.TotalBytes);
-        Assert.Contains($"database: {fixture.StateDbPath()}", TextFormatter.FormatStatus(status));
+        SyncResult first = await service.RunSyncAsync(fixture.CodexHome, provider: "openai");
+        string afterFirst = await File.ReadAllTextAsync(sessionPath);
+        SyncResult second = await service.RunSyncAsync(fixture.CodexHome, provider: "openai");
+
+        Assert.Equal(1, first.ChangedSessionFiles);
+        Assert.Equal(1, first.SqliteProviderRowsUpdated);
+        Assert.Equal(0, second.ChangedSessionFiles);
+        Assert.Equal(0, second.SqliteProviderRowsUpdated);
+        Assert.Equal(0, second.SqliteRowsUpdated);
+        Assert.Equal(afterFirst, await File.ReadAllTextAsync(sessionPath));
+        Assert.Equal("openai", await ReadProviderAsync(fixture.StateDbPath(), "thread-idempotent"));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task GetStatus_FallsBackToLegacyRootSqliteDatabase()
+    public async Task BackupFailure_OccursBeforeJournalOrTargetMutation()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync(string.Empty);
-        await using (SqliteConnection connection = fixture.OpenLegacySqliteConnection())
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-backup-failure.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-backup-failure", "apigather");
+        await fixture.WriteStateDbAsync([("thread-backup-failure", "apigather", false)]);
+        string before = await File.ReadAllTextAsync(sessionPath);
+        CodexSyncService service = new();
+        service.FaultInjector = (point, _, _) =>
         {
-            await connection.OpenAsync();
-            SqliteCommand create = connection.CreateCommand();
-            create.CommandText = """
-                CREATE TABLE threads (
-                  id TEXT PRIMARY KEY,
-                  model_provider TEXT,
-                  archived INTEGER NOT NULL DEFAULT 0
-                )
-                """;
-            await create.ExecuteNonQueryAsync();
-            SqliteCommand insert = connection.CreateCommand();
-            insert.CommandText = "INSERT INTO threads (id, model_provider, archived) VALUES ('legacy-thread', 'openai', 0)";
-            await insert.ExecuteNonQueryAsync();
-        }
-
-        CodexSyncService service = new();
-        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
+            if (point == "before_backup")
+            {
+                throw new IOException("injected backup creation failure");
+            }
+            return Task.CompletedTask;
+        };
 
-        Assert.NotNull(status.StateDbLocation);
-        Assert.Equal("legacy-root", status.StateDbLocation!.Source);
-        Assert.Equal(fixture.LegacyStateDbPath(), status.StateDbLocation.Path);
-        Assert.Equal(1, status.SqliteCounts!.Sessions["openai"]);
-        Assert.Contains("legacy root", TextFormatter.FormatStatus(status));
+        IOException error = await Assert.ThrowsAsync<IOException>(
+            () => service.RunSyncAsync(fixture.CodexHome));
+        Assert.Contains("injected backup creation failure", error.Message);
+        Assert.Equal(before, await File.ReadAllTextAsync(sessionPath));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+        Assert.False(Directory.Exists(fixture.BackupRoot()));
     }
 
     [Fact]
-    public async Task GetStatus_ChoosesLegacyRootSqliteDatabase_WhenSqliteDirStateIsStale()
+    public async Task AtomicReplacementFailure_PreservesOriginalAndRemovesStaging()
     {
+        if (!OperatingSystem.IsWindows())
+        {
+            return;
+        }
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync(string.Empty);
-        await fixture.WriteRolloutAsync(
-            fixture.RolloutPath("sessions", "rollout-active-a.jsonl"),
-            "thread-active-a",
-            "openai");
-        await fixture.WriteRolloutAsync(
-            fixture.RolloutPath("sessions", "rollout-active-b.jsonl"),
-            "thread-active-b",
-            "openai");
-        await fixture.WriteRolloutAsync(
-            fixture.RolloutPath("archived_sessions", "rollout-active-c.jsonl"),
-            "thread-active-c",
-            "openai");
-        await fixture.WriteStateDbAsync(
-        [
-            ("thread-active-a", "custom", false)
-        ]);
-        await fixture.WriteLegacyStateDbAsync(
-        [
-            ("thread-active-a", "openai", false),
-            ("thread-active-b", "openai", false),
-            ("thread-active-c", "openai", true)
-        ]);
+        string targetPath = Path.Combine(fixture.Root, "atomic-target.txt");
+        await File.WriteAllTextAsync(targetPath, "before");
+        await using (FileStream locked = new(
+            targetPath,
+            FileMode.Open,
+            FileAccess.Read,
+            FileShare.None))
+        {
+            await Assert.ThrowsAnyAsync<Exception>(
+                () => AtomicFile.WriteAllTextAsync(targetPath, "after"));
+        }
+        Assert.Equal("before", await File.ReadAllTextAsync(targetPath));
+        Assert.Empty(Directory.GetFiles(fixture.Root, "*.provider-sync.*.tmp"));
+    }
 
-        CodexSyncService service = new();
-        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
+    [Theory]
+    [InlineData("before_stage_write")]
+    [InlineData("before_atomic_replace")]
+    public async Task AtomicWriter_InjectedFailure_PreservesOriginalAndRemovesStaging(string faultPoint)
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        string targetPath = Path.Combine(fixture.Root, $"atomic-{faultPoint}.txt");
+        await File.WriteAllTextAsync(targetPath, "before");
+
+        IOException error = await Assert.ThrowsAsync<IOException>(
+            () => AtomicFile.WriteAllTextAsync(
+                targetPath,
+                "after",
+                faultInjector: (point, _, _) =>
+                {
+                    if (point == faultPoint)
+                    {
+                        throw new IOException($"injected {faultPoint}");
+                    }
+                    return Task.CompletedTask;
+                }));
 
-        Assert.NotNull(status.StateDbLocation);
-        Assert.Equal("legacy-root", status.StateDbLocation!.Source);
-        Assert.Equal(fixture.LegacyStateDbPath(), status.StateDbLocation.Path);
-        Assert.Equal(2, status.SqliteCounts!.Sessions["openai"]);
-        Assert.Equal(1, status.SqliteCounts.ArchivedSessions["openai"]);
-        Assert.Contains("legacy root", TextFormatter.FormatStatus(status));
+        Assert.Contains($"injected {faultPoint}", error.Message);
+        Assert.Equal("before", await File.ReadAllTextAsync(targetPath));
+        Assert.Empty(Directory.GetFiles(fixture.Root, "*.provider-sync.*.tmp"));
     }
 
     [Fact]
-    public async Task GetStatus_ReportsPendingSqliteUserEventAndCwdRepairs()
+    public async Task RestoreSqlite_OnlineBackupFailurePreservesCurrentWalDatabase()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-repair-status.jsonl");
-        await fixture.WriteRolloutAsync(
-            sessionPath,
-            "thread-repair-status",
-            "openai",
-            @"E:\GitHubProject\lin-framework");
-        await fixture.WriteStateDbWithUserEventAndCwdAsync(
-        [
-            ("thread-repair-status", "openai", false, false, @"\\?\E:\GitHubProject\lin-framework")
+        await fixture.WriteStateDbAsync([
+            ("thread-atomic-restore", "openai", false)
         ]);
+        SessionRolloutService rollouts = new();
+        BackupService backups = new(rollouts, new SqliteStateService());
+        string backupDir = await backups.CreateBackupAsync(
+            fixture.CodexHome,
+            "openai",
+            [],
+            Path.Combine(fixture.CodexHome, "config.toml"));
+        string stateDbPath = fixture.StateDbPath();
+        await using SqliteConnection connection = fixture.OpenSqliteConnection();
+        await connection.OpenAsync();
+        await using (SqliteCommand wal = connection.CreateCommand())
+        {
+            wal.CommandText = "PRAGMA journal_mode = WAL";
+            Assert.Equal("wal", Convert.ToString(await wal.ExecuteScalarAsync()));
+        }
+        await using (SqliteCommand update = connection.CreateCommand())
+        {
+            update.CommandText = "UPDATE threads SET model_provider = 'apigather' WHERE id = 'thread-atomic-restore'";
+            Assert.Equal(1, await update.ExecuteNonQueryAsync());
+        }
+        Assert.True(new FileInfo(stateDbPath + "-wal").Length > 0);
+        string backupDbPath = Path.Combine(
+            backupDir,
+            "db",
+            "sqlite-home",
+            AppConstants.DbFileBasename);
+        await File.WriteAllTextAsync(backupDbPath, "not a sqlite database");
 
-        CodexSyncService service = new();
-        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => backups.RestoreBackupAsync(
+                backupDir,
+                fixture.CodexHome,
+                new RestoreBackupOptions
+                {
+                    RestoreConfig = false,
+                    RestoreDatabase = true,
+                    RestoreSessions = false
+                }));
 
-        Assert.NotNull(status.SqliteRepairStats);
-        Assert.Equal(1, status.SqliteRepairStats!.UserEventRowsNeedingRepair);
-        Assert.Equal(1, status.SqliteRepairStats.CwdRowsNeedingRepair);
-        string formatted = TextFormatter.FormatStatus(status);
-        Assert.Contains("user-event flags needing repair: 1", formatted);
-        Assert.Contains("cwd paths needing repair: 1", formatted);
+        Assert.Contains("malformed", error.Message, StringComparison.OrdinalIgnoreCase);
+        Assert.True(File.Exists(stateDbPath + "-wal"));
+        Assert.Equal("apigather", await ReadProviderAsync(stateDbPath, "thread-atomic-restore"));
     }
 
     [Fact]
-    public async Task GetStatus_ReportsProjectVisibilityRanksAndCwdExactMatchDiagnostics()
+    public async Task PruneBackups_NeverDeletesBackupReferencedByUnfinishedTransaction()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"dal\"");
-        await fixture.WriteGlobalStateAsync(new Dictionary<string, object?>
-        {
-            ["electron-saved-workspace-roots"] = new[]
-            {
-                @"E:\GitHubProject\lin-framework"
-            }
-        });
+        await fixture.WriteBackupAsync("20260319T000000000Z", ("note.txt", "pending"));
+        await fixture.WriteBackupAsync("20260320T000000000Z", ("note.txt", "terminal"));
+        string pendingDir = fixture.BackupPath("20260319T000000000Z");
+        await FileTransactionJournal.CreateAsync(
+            pendingDir,
+            fixture.CodexHome,
+            "openai",
+            []);
 
-        List<(string Id, string ModelProvider, string Cwd, string Source, bool Archived, string FirstUserMessage, long UpdatedAtMs)> rows = [];
-        for (int index = 0; index < 51; index += 1)
+        BackupPruneResult result = await new BackupService(
+            new SessionRolloutService(),
+            new SqliteStateService()).PruneBackupsAsync(fixture.CodexHome, 0);
+
+        Assert.Equal(1, result.DeletedCount);
+        Assert.Equal(1, result.RemainingCount);
+        Assert.True(Directory.Exists(pendingDir));
+        Assert.False(Directory.Exists(fixture.BackupPath("20260320T000000000Z")));
+    }
+
+    [Fact]
+    public async Task GetStatus_ReportsWindowsWslUncSqliteHomeWithoutOpeningDatabase()
+    {
+        if (!OperatingSystem.IsWindows())
         {
-            rows.Add(($"thread-other-{index:00}", "dal", @"D:\OtherProject", "cli", false, "hello", 1000 - index));
+            return;
         }
-        rows.Add(("thread-lin", "dal", @"\\?\E:\GitHubProject\lin-framework", "cli", false, "hello", 1));
-        await fixture.WriteStateDbForProjectVisibilityAsync(rows);
 
-        CodexSyncService service = new();
-        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
-        ProjectThreadVisibility project = Assert.Single(status.ProjectThreadVisibility);
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sqliteHome = $@"\\wsl.localhost\Ubuntu\tmp\codex-provider-sync-{Guid.NewGuid():N}";
+        Stopwatch timer = Stopwatch.StartNew();
 
-        Assert.Equal(@"E:\GitHubProject\lin-framework", project.Root);
-        Assert.Equal(1, project.InteractiveThreads);
-        Assert.Equal(0, project.FirstPageThreads);
-        Assert.Equal([52], project.Ranks);
-        Assert.Equal(0, project.ExactCwdMatches);
-        Assert.Equal(1, project.VerbatimCwdRows);
+        StatusSnapshot status = await new CodexSyncService().GetStatusAsync(fixture.CodexHome, sqliteHome);
 
-        string formatted = TextFormatter.FormatStatus(status);
-        Assert.Contains("Project visibility:", formatted);
-        Assert.Contains("first page 0/50, ranks 52, exact cwd 0/1, verbatim cwd 1", formatted);
+        timer.Stop();
+        Assert.False(status.SqliteAccess.Supported);
+        Assert.Null(status.StateDbLocation);
+        Assert.Null(status.SqliteCounts);
+        Assert.Contains("Windows cannot safely access SQLite", TextFormatter.FormatStatus(status));
+        string chineseStatus = TextFormatter.FormatStatus(status, TextFormatter.ChineseSimplified);
+        Assert.Contains("Windows 进程无法通过 WSL UNC 路径安全访问 SQLite", chineseStatus);
+        Assert.Contains("请在 WSL 内运行 codex-provider", chineseStatus);
+        Assert.DoesNotContain("currently in use", TextFormatter.FormatStatus(status));
+        Assert.True(timer.Elapsed < TimeSpan.FromSeconds(5), $"Status took {timer.Elapsed}.");
     }
 
     [Fact]
-    public async Task RunSwitch_RejectsUnknownCustomProviders()
+    public async Task RunSync_BlocksWindowsWslUncBeforeCreatingBackup()
     {
+        if (!OperatingSystem.IsWindows())
+        {
+            return;
+        }
+
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync(string.Empty);
-        CodexSyncService service = new();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
 
         InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
-            () => service.RunSwitchAsync(fixture.CodexHome, "missing"));
-        Assert.Contains("Provider \"missing\" is not available", error.Message);
+            () => new CodexSyncService().RunSyncAsync(
+                fixture.CodexHome,
+                explicitSqliteHome: @"\\wsl.localhost\Ubuntu\home\user\.codex\sqlite"));
+
+        Assert.Contains("Cannot sync", error.Message);
+        Assert.Contains("Run codex-provider inside WSL", error.Message);
+        Assert.False(Directory.Exists(fixture.BackupRoot()));
     }
 
     [Fact]
-    public async Task RunSync_LeavesRolloutsUntouched_WhenSqliteIsLocked()
+    public async Task RunSwitch_BlocksWindowsWslUncBeforeUpdatingConfig()
     {
+        if (!OperatingSystem.IsWindows())
+        {
+            return;
+        }
+
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
-        await fixture.WriteStateDbAsync(
-        [
-            ("thread-a", "apigather", false)
-        ]);
-
-        CodexSyncService service = new();
-        await using SqliteConnection connection = fixture.OpenSqliteConnection();
-        await connection.OpenAsync();
-        SqliteCommand begin = connection.CreateCommand();
-        begin.CommandText = "BEGIN IMMEDIATE";
-        await begin.ExecuteNonQueryAsync();
+        string configPath = Path.Combine(fixture.CodexHome, "config.toml");
+        string originalConfig = await File.ReadAllTextAsync(configPath);
 
         InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
-            () => service.RunSyncAsync(fixture.CodexHome, sqliteBusyTimeoutMs: 0));
-        Assert.Contains("state_5.sqlite is currently in use", error.Message);
+            () => new CodexSyncService().RunSwitchAsync(
+                fixture.CodexHome,
+                "apigather",
+                explicitSqliteHome: @"\\wsl$\Ubuntu\home\user\.codex\sqlite"));
 
-        string rollout = await File.ReadAllTextAsync(sessionPath);
-        Assert.Contains("\"model_provider\":\"apigather\"", rollout);
+        Assert.Contains("Cannot switch", error.Message);
+        Assert.Equal(originalConfig, await File.ReadAllTextAsync(configPath));
+        Assert.False(Directory.Exists(fixture.BackupRoot()));
     }
 
     [Fact]
-    public async Task RunSync_SkipsLockedRolloutFiles_AndStillUpdatesSqlite()
+    public async Task RunRestore_BlocksWindowsWslUncBeforeReadingBackup()
     {
-        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
-        await fixture.WriteStateDbAsync(
-        [
-            ("thread-a", "apigather", false)
-        ]);
-
-        CodexSyncService service = new();
-        SyncResult result;
-        using (FileStream lockStream = new(sessionPath, FileMode.Open, FileAccess.ReadWrite, FileShare.None))
+        if (!OperatingSystem.IsWindows())
         {
-            result = await service.RunSyncAsync(fixture.CodexHome, sqliteBusyTimeoutMs: 0);
+            return;
         }
 
-        Assert.Equal(0, result.ChangedSessionFiles);
-        Assert.Equal(1, result.SqliteRowsUpdated);
-        Assert.Equal([sessionPath], result.SkippedLockedRolloutFiles);
-        Assert.Empty(result.SkippedUnreadableRolloutFiles);
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
 
-        string rollout = await File.ReadAllTextAsync(sessionPath);
-        Assert.Contains("\"model_provider\":\"apigather\"", rollout);
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => new CodexSyncService().RunRestoreAsync(
+                fixture.CodexHome,
+                Path.Combine(fixture.Root, "missing-backup"),
+                @"\\wsl.localhost\Ubuntu\home\user\.codex\sqlite"));
 
-        await using SqliteConnection connection = fixture.OpenSqliteConnection();
-        await connection.OpenAsync();
-        SqliteCommand command = connection.CreateCommand();
-        command.CommandText = "SELECT model_provider FROM threads WHERE id = 'thread-a'";
-        string provider = (string)(await command.ExecuteScalarAsync())!;
-        Assert.Equal("openai", provider);
+        Assert.Contains("Cannot restore", error.Message);
+        Assert.Contains("Run codex-provider inside WSL", error.Message);
     }
 
     [Fact]
-    public async Task ApplySessionChanges_SkipsFile_WhenRolloutChangesAfterCollection()
+    public async Task RunSync_RewritesRolloutFilesAndSqlite_ThenRestoreRevertsBoth()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
         string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
+        string archivedPath = fixture.RolloutPath("archived_sessions", "rollout-b.jsonl");
         await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
+        await fixture.WriteRolloutAsync(archivedPath, "thread-b", "newapi");
+        await fixture.WriteStateDbAsync(
+        [
+            ("thread-a", "apigather", false),
+            ("thread-b", "newapi", true)
+        ]);
 
-        SessionRolloutService service = new();
-        SessionChangeCollection collected = await service.CollectSessionChangesAsync(fixture.CodexHome, "openai");
+        CodexSyncService service = new();
+        SyncResult syncResult = await service.RunSyncAsync(fixture.CodexHome);
 
-        await File.AppendAllTextAsync(
-            sessionPath,
-            "{\"timestamp\":\"2026-03-19T00:00:01.000Z\",\"type\":\"event_msg\",\"payload\":{\"type\":\"assistant_message\",\"message\":\"later\"}}\n");
-
-        SessionApplyResult result = await service.ApplySessionChangesAsync(collected.Changes);
-
-        Assert.Equal(0, result.AppliedCount);
-        Assert.Equal([sessionPath], result.SkippedPaths);
-
-        string rollout = await File.ReadAllTextAsync(sessionPath);
-        Assert.Contains("\"model_provider\":\"apigather\"", rollout);
-        Assert.Contains("\"message\":\"later\"", rollout);
-    }
+        Assert.Equal("openai", syncResult.TargetProvider);
+        Assert.Equal(2, syncResult.ChangedSessionFiles);
+        Assert.Empty(syncResult.SkippedLockedRolloutFiles);
+        Assert.Empty(syncResult.SkippedUnreadableRolloutFiles);
+        Assert.Equal(2, syncResult.SqliteRowsUpdated);
+        BackupMetadataFile backupMetadata = JsonSerializer.Deserialize<BackupMetadataFile>(
+            await File.ReadAllTextAsync(Path.Combine(syncResult.BackupDir, "metadata.json")),
+            new JsonSerializerOptions { PropertyNamingPolicy = JsonNamingPolicy.CamelCase })!;
+        Assert.Equal(
+        [
+            Path.Combine(AppConstants.SqliteDirBasename, AppConstants.DbFileBasename)
+        ],
+            backupMetadata.DbFiles);
 
-    [Fact]
-    public async Task ApplySessionChanges_RewritesFile_WhenRolloutIsUnchanged()
-    {
-        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
+        string syncedSession = await File.ReadAllTextAsync(sessionPath);
+        string syncedArchived = await File.ReadAllTextAsync(archivedPath);
+        Assert.Contains("\"model_provider\":\"openai\"", syncedSession);
+        Assert.Contains("\"model_provider\":\"openai\"", syncedArchived);
 
-        SessionRolloutService service = new();
-        SessionChangeCollection collected = await service.CollectSessionChangesAsync(fixture.CodexHome, "openai");
+        await using (SqliteConnection connection = fixture.OpenSqliteConnection())
+        {
+            await connection.OpenAsync();
+            SqliteCommand command = connection.CreateCommand();
+            command.CommandText = "SELECT id, model_provider FROM threads ORDER BY id";
+            await using SqliteDataReader reader = await command.ExecuteReaderAsync();
+            List<(string Id, string Provider)> rows = [];
+            while (await reader.ReadAsync())
+            {
+                rows.Add((reader.GetString(0), reader.GetString(1)));
+            }
 
-        SessionApplyResult result = await service.ApplySessionChangesAsync(collected.Changes);
+            Assert.Equal(
+            [
+                ("thread-a", "openai"),
+                ("thread-b", "openai")
+            ], rows);
+        }
 
-        Assert.Equal(1, result.AppliedCount);
-        Assert.Empty(result.SkippedPaths);
+        RestoreResult restoreResult = await service.RunRestoreAsync(fixture.CodexHome, syncResult.BackupDir);
+        Assert.Equal("openai", restoreResult.TargetProvider);
 
-        string rollout = await File.ReadAllTextAsync(sessionPath);
-        Assert.Contains("\"model_provider\":\"openai\"", rollout);
+        string restoredSession = await File.ReadAllTextAsync(sessionPath);
+        string restoredArchived = await File.ReadAllTextAsync(archivedPath);
+        Assert.Contains("\"model_provider\":\"apigather\"", restoredSession);
+        Assert.Contains("\"model_provider\":\"newapi\"", restoredArchived);
     }
 
     [Fact]
-    public async Task RestoreBackup_OnlyRestoresRolloutFilesThatWereActuallyApplied()
+    public async Task RunSync_UpdatesLegacyRootSqliteDatabase_WhenSqliteDirStateIsStale()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string configPath = Path.Combine(fixture.CodexHome, "config.toml");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-active-a.jsonl");
+        string archivedPath = fixture.RolloutPath("archived_sessions", "rollout-active-b.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-active-a", "dal");
+        await fixture.WriteRolloutAsync(archivedPath, "thread-active-b", "dal");
+        await fixture.WriteStateDbAsync(
+        [
+            ("thread-active-a", "dal", false)
+        ]);
+        await fixture.WriteLegacyStateDbAsync(
+        [
+            ("thread-active-a", "dal", false),
+            ("thread-active-b", "dal", true)
+        ]);
 
-        SessionRolloutService sessionService = new();
-        SessionChangeCollection collected = await sessionService.CollectSessionChangesAsync(fixture.CodexHome, "openai");
-        BackupService backupService = new(sessionService, new SqliteStateService());
-        string backupDir = await backupService.CreateBackupAsync(
-            fixture.CodexHome,
-            "openai",
-            collected.Changes,
-            configPath);
+        CodexSyncService service = new();
+        SyncResult syncResult = await service.RunSyncAsync(fixture.CodexHome);
 
-        await backupService.UpdateSessionBackupManifestAsync(backupDir, []);
-        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "manual");
+        Assert.Equal(2, syncResult.SqliteRowsUpdated);
+        BackupMetadataFile backupMetadata = JsonSerializer.Deserialize<BackupMetadataFile>(
+            await File.ReadAllTextAsync(Path.Combine(syncResult.BackupDir, "metadata.json")),
+            new JsonSerializerOptions { PropertyNamingPolicy = JsonNamingPolicy.CamelCase })!;
+        Assert.Equal([AppConstants.DbFileBasename], backupMetadata.DbFiles);
 
-        await backupService.RestoreBackupAsync(
-            backupDir,
-            fixture.CodexHome,
-            new RestoreBackupOptions
+        await using (SqliteConnection connection = fixture.OpenLegacySqliteConnection())
+        {
+            await connection.OpenAsync();
+            SqliteCommand command = connection.CreateCommand();
+            command.CommandText = "SELECT id, model_provider FROM threads ORDER BY id";
+            await using SqliteDataReader reader = await command.ExecuteReaderAsync();
+            List<(string Id, string Provider)> rows = [];
+            while (await reader.ReadAsync())
             {
-                RestoreConfig = false,
-                RestoreDatabase = false,
-                RestoreSessions = true
-            });
+                rows.Add((reader.GetString(0), reader.GetString(1)));
+            }
 
-        string rollout = await File.ReadAllTextAsync(sessionPath);
-        Assert.Contains("\"model_provider\":\"manual\"", rollout);
-    }
+            Assert.Equal(
+            [
+                ("thread-active-a", "openai"),
+                ("thread-active-b", "openai")
+            ], rows);
+        }
 
-    [Fact]
-    public async Task RunSync_SkipsRolloutFile_WhenAnotherWriterAllowsSharing()
-    {
-        if (!OperatingSystem.IsWindows())
+        await using (SqliteConnection connection = fixture.OpenSqliteConnection())
         {
-            return;
+            await connection.OpenAsync();
+            SqliteCommand command = connection.CreateCommand();
+            command.CommandText = "SELECT id, model_provider FROM threads ORDER BY id";
+            await using SqliteDataReader reader = await command.ExecuteReaderAsync();
+            List<(string Id, string Provider)> rows = [];
+            while (await reader.ReadAsync())
+            {
+                rows.Add((reader.GetString(0), reader.GetString(1)));
+            }
+
+            Assert.Equal([("thread-active-a", "dal")], rows);
         }
+    }
 
+    [Fact]
+    public async Task RunSwitch_UpdatesConfigAndSyncsProviderMetadata()
+    {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        await fixture.WriteConfigAsync(string.Empty);
         string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "openai");
         await fixture.WriteStateDbAsync(
         [
-            ("thread-a", "apigather", false)
+            ("thread-a", "openai", false)
         ]);
 
         CodexSyncService service = new();
-        SyncResult result;
-        using (FileStream writer = new(sessionPath, FileMode.Open, FileAccess.ReadWrite, FileShare.ReadWrite | FileShare.Delete))
-        {
-            result = await service.RunSyncAsync(fixture.CodexHome, sqliteBusyTimeoutMs: 0);
-        }
+        SyncResult result = await service.RunSwitchAsync(fixture.CodexHome, "apigather");
 
-        Assert.Equal(0, result.ChangedSessionFiles);
-        Assert.Equal(1, result.SqliteRowsUpdated);
-        Assert.Equal([sessionPath], result.SkippedLockedRolloutFiles);
-        Assert.Empty(result.SkippedUnreadableRolloutFiles);
+        Assert.Equal("apigather", result.TargetProvider);
+        Assert.True(result.ConfigUpdated);
 
+        string configText = await File.ReadAllTextAsync(Path.Combine(fixture.CodexHome, "config.toml"));
+        Assert.Contains("model_provider = \"apigather\"", configText);
         string rollout = await File.ReadAllTextAsync(sessionPath);
         Assert.Contains("\"model_provider\":\"apigather\"", rollout);
     }
 
     [Fact]
-    public async Task Status_SkipsLockedRolloutFile_WhenAnotherWriterAllowsSharing()
+    public async Task RunSwitch_BackupCapturesPreSwitchProviderAndModel()
     {
-        if (!OperatingSystem.IsWindows())
-        {
-            return;
-        }
-
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-status-locked.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-status-locked", "openai");
-
-        CodexSyncService service = new();
-        using FileStream writer = new(sessionPath, FileMode.Open, FileAccess.ReadWrite, FileShare.ReadWrite | FileShare.Delete);
-        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
-
-        Assert.Equal([sessionPath], status.LockedRolloutFiles);
-        Assert.Empty(status.UnreadableRolloutFiles);
-        Assert.Contains("Locked rollout files skipped during status scan: 1", TextFormatter.FormatStatus(status));
-    }
+        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"gpt-5.4-mini\"");
+        string configPath = Path.Combine(fixture.CodexHome, "config.toml");
+        string originalConfig = await File.ReadAllTextAsync(configPath);
 
-    [Fact]
-    public void FormatStatus_ReportsUnreadableRolloutFiles()
-    {
-        StatusSnapshot status = new()
-        {
-            CodexHome = @"C:\Users\test\.codex",
-            CurrentProvider = new CurrentProviderInfo("openai", false),
-            ConfiguredProviders = ["openai"],
-            RolloutCounts = new ProviderCounts(),
-            LockedRolloutFiles = [],
-            UnreadableRolloutFiles = [@"C:\Users\test\.codex\sessions\rollout-bad.jsonl"],
-            EncryptedContentCounts = new ProviderCounts(),
-            SqliteCounts = null,
-            BackupRoot = @"C:\Users\test\.codex\backups_state\provider-sync",
-            BackupSummary = new BackupSummary
-            {
-                Count = 0,
-                TotalBytes = 0
-            }
-        };
+        SyncResult result = await new CodexSyncService().RunSwitchAsync(
+            fixture.CodexHome,
+            "apigather",
+            model: "apigather-prod");
 
-        Assert.Contains("Unreadable rollout files skipped during status scan: 1", TextFormatter.FormatStatus(status));
+        Assert.Equal(
+            originalConfig,
+            await File.ReadAllTextAsync(Path.Combine(result.BackupDir, "config.toml")));
+        string switchedConfig = await File.ReadAllTextAsync(configPath);
+        Assert.Contains("model_provider = \"apigather\"", switchedConfig);
+        Assert.Contains("model = \"apigather-prod\"", switchedConfig);
     }
 
     [Fact]
-    public async Task RunPruneBackups_RemovesOldestBackupDirectories()
+    public async Task RunSwitch_DoesNotTouchConfig_WhenPreSwitchBackupCreationFails()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        long oldestBytes = await fixture.WriteBackupAsync(
-            "20260319T000000000Z",
-            ("note.txt", "oldest"),
-            ("db/state_5.sqlite", "sqlite"));
-        await fixture.WriteBackupAsync("20260320T000000000Z", ("note.txt", "middle"));
-        await fixture.WriteBackupAsync("20260321T000000000Z", ("note.txt", "newest"));
+        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"gpt-5.4-mini\"");
+        string configPath = Path.Combine(fixture.CodexHome, "config.toml");
+        string originalConfig = await File.ReadAllTextAsync(configPath);
+        DateTime pinnedLastWriteTime = new(2001, 2, 3, 4, 5, 6, DateTimeKind.Utc);
+        File.SetLastWriteTimeUtc(configPath, pinnedLastWriteTime);
 
-        CodexSyncService service = new();
-        BackupPruneResult result = await service.RunPruneBackupsAsync(fixture.CodexHome, 2);
+        Directory.CreateDirectory(Path.GetDirectoryName(fixture.BackupRoot())!);
+        await File.WriteAllTextAsync(fixture.BackupRoot(), "blocks backup directory creation");
 
-        Assert.Equal(fixture.BackupRoot(), result.BackupRoot);
-        Assert.Equal(1, result.DeletedCount);
-        Assert.Equal(2, result.RemainingCount);
-        Assert.Equal(oldestBytes, result.FreedBytes);
-        Assert.False(Directory.Exists(fixture.BackupPath("20260319T000000000Z")));
-        Assert.True(Directory.Exists(fixture.BackupPath("20260320T000000000Z")));
-        Assert.True(Directory.Exists(fixture.BackupPath("20260321T000000000Z")));
+        await Assert.ThrowsAnyAsync<Exception>(
+            () => new CodexSyncService().RunSwitchAsync(fixture.CodexHome, "apigather"));
+        Assert.Equal(originalConfig, await File.ReadAllTextAsync(configPath));
+        Assert.Equal(pinnedLastWriteTime, File.GetLastWriteTimeUtc(configPath));
     }
 
     [Fact]
-    public async Task RunPruneBackups_IgnoresDirectoriesWithoutManagedBackupMetadata()
+    public async Task RunSwitch_RestoresConfig_AfterPostBackupSyncFailure()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        await fixture.WriteBackupAsync(
-            "20260320T000000000Z",
-            ("metadata.json", $$"""
-                {
-                  "version": 1,
-                  "namespace": "provider-sync",
-                  "codexHome": "{{fixture.CodexHome.Replace("\\", "\\\\")}}",
-                  "targetProvider": "openai",
-                  "createdAt": "2026-03-24T00:00:00.0000000+00:00",
-                  "dbFiles": [],
-                  "changedSessionFiles": 0
-                }
-                """));
-        string junkDirectory = fixture.BackupPath("manual-notes");
-        Directory.CreateDirectory(junkDirectory);
-        await File.WriteAllTextAsync(Path.Combine(junkDirectory, "readme.txt"), "keep me");
+        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"gpt-5.4-mini\"");
+        string configPath = Path.Combine(fixture.CodexHome, "config.toml");
+        string originalConfig = await File.ReadAllTextAsync(configPath);
+        await File.WriteAllTextAsync(
+            Path.Combine(fixture.CodexHome, AppConstants.GlobalStateFileBasename),
+            "{not-json");
 
-        CodexSyncService service = new();
-        BackupPruneResult result = await service.RunPruneBackupsAsync(fixture.CodexHome, 0);
+        await Assert.ThrowsAnyAsync<Exception>(
+            () => new CodexSyncService().RunSwitchAsync(fixture.CodexHome, "apigather"));
+        Assert.Equal(originalConfig, await File.ReadAllTextAsync(configPath));
 
-        Assert.Equal(1, result.DeletedCount);
-        Assert.Equal(0, result.RemainingCount);
-        Assert.True(Directory.Exists(junkDirectory));
+        string backupDir = Assert.Single(Directory.GetDirectories(fixture.BackupRoot()));
+        Assert.Equal(
+            originalConfig,
+            await File.ReadAllTextAsync(Path.Combine(backupDir, "config.toml")));
     }
 
     [Fact]
-    public async Task RunSync_AutoPrunesBackupsToDefaultRetention()
+    public async Task RunSync_RepairsSqliteHasUserEventFromRolloutUserMessages()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
         string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
-        await fixture.WriteStateDbAsync(
+        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "openai");
+        await fixture.WriteStateDbWithUserEventColumnAsync(
         [
-            ("thread-a", "apigather", false)
+            ("thread-a", "openai", false, false)
         ]);
 
-        for (int index = 0; index < AppConstants.DefaultBackupRetentionCount; index += 1)
-        {
-            await fixture.WriteBackupAsync(
-                $"20240101T0000{index:00}000Z",
-                ("note.txt", $"backup-{index}"));
-        }
-
         CodexSyncService service = new();
         SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
 
-        string[] backupDirs = Directory.GetDirectories(fixture.BackupRoot());
-        Assert.Equal(AppConstants.DefaultBackupRetentionCount, backupDirs.Length);
-        Assert.True(Directory.Exists(result.BackupDir));
-        Assert.NotNull(result.AutoPruneResult);
-        Assert.Equal(1, result.AutoPruneResult!.DeletedCount);
-        Assert.Equal(AppConstants.DefaultBackupRetentionCount, result.AutoPruneResult.RemainingCount);
-        Assert.True(string.IsNullOrWhiteSpace(result.AutoPruneWarning));
+        Assert.Equal(0, result.ChangedSessionFiles);
+        Assert.Equal(1, result.SqliteRowsUpdated);
+        Assert.Equal(1, result.SqliteUserEventRowsUpdated);
+
+        await using SqliteConnection connection = fixture.OpenSqliteConnection();
+        await connection.OpenAsync();
+        SqliteCommand command = connection.CreateCommand();
+        command.CommandText = "SELECT has_user_event FROM threads WHERE id = 'thread-a'";
+        long hasUserEvent = (long)(await command.ExecuteScalarAsync())!;
+        Assert.Equal(1, hasUserEvent);
     }
 
     [Fact]
-    public async Task RunSync_UsesCustomAutomaticBackupRetentionCount()
+    public async Task RunSync_RepairsSqliteCwdFromRolloutSessionMetadata()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
-        await fixture.WriteStateDbAsync(
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-cwd.jsonl");
+        await fixture.WriteRolloutAsync(
+            sessionPath,
+            "thread-cwd",
+            "openai",
+            @"D:\GitHubProject\oss-maintainer-hub");
+        await fixture.WriteStateDbWithCwdAsync(
         [
-            ("thread-a", "apigather", false)
+            ("thread-cwd", "openai", false, @"\\?\D:\GitHubProject\oss-maintainer-hub")
         ]);
 
-        for (int index = 0; index < 4; index += 1)
-        {
-            await fixture.WriteBackupAsync(
-                $"20240101T0000{index:00}000Z",
-                ("note.txt", $"backup-{index}"));
-        }
-
         CodexSyncService service = new();
-        SyncResult result = await service.RunSyncAsync(fixture.CodexHome, keepCount: 2);
-
-        string[] backupDirs = Directory.GetDirectories(fixture.BackupRoot());
-        Assert.Equal(2, backupDirs.Length);
-        Assert.True(Directory.Exists(result.BackupDir));
-        Assert.NotNull(result.AutoPruneResult);
-        Assert.Equal(3, result.AutoPruneResult!.DeletedCount);
-        Assert.Equal(2, result.AutoPruneResult.RemainingCount);
-    }
-
-    [Fact]
-    public async Task ApplySessionChanges_RestoresOriginalLastWriteTime()
-    {
-        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-mtime.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-mtime", "apigather");
-        DateTime originalTime = new(2026, 1, 2, 3, 4, 5, DateTimeKind.Utc);
-        File.SetLastWriteTimeUtc(sessionPath, originalTime);
+        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
 
-        SessionRolloutService service = new();
-        SessionChangeCollection collected = await service.CollectSessionChangesAsync(fixture.CodexHome, "openai");
-        SessionApplyResult result = await service.ApplySessionChangesAsync(collected.Changes);
+        Assert.Equal(0, result.ChangedSessionFiles);
+        Assert.Equal(1, result.SqliteRowsUpdated);
+        Assert.Equal(1, result.SqliteCwdRowsUpdated);
 
-        Assert.Equal(1, result.AppliedCount);
-        Assert.Equal(originalTime, File.GetLastWriteTimeUtc(sessionPath));
+        await using SqliteConnection connection = fixture.OpenSqliteConnection();
+        await connection.OpenAsync();
+        SqliteCommand command = connection.CreateCommand();
+        command.CommandText = "SELECT cwd FROM threads WHERE id = 'thread-cwd'";
+        string cwd = (string)(await command.ExecuteScalarAsync())!;
+        Assert.Equal(@"D:\GitHubProject\oss-maintainer-hub", cwd);
     }
 
     [Fact]
-    public async Task Status_ReportsEncryptedContentCountsAndWarning()
+    public async Task RunSync_NormalizesExtendedRolloutCwd_BeforeRepairingSqlite()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-enc.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-enc", "apigather");
-        await fixture.AppendEncryptedContentAsync(sessionPath);
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-cwd-extended.jsonl");
+        await fixture.WriteRolloutAsync(
+            sessionPath,
+            "thread-cwd-extended",
+            "openai",
+            @"\\?\E:\GitHubProject\lin-framework");
+        await fixture.WriteStateDbWithCwdAsync(
+        [
+            ("thread-cwd-extended", "openai", false, @"\\?\E:\GitHubProject\lin-framework")
+        ]);
 
         CodexSyncService service = new();
-        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
+        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
 
-        Assert.Equal(1, status.EncryptedContentCounts.Sessions["apigather"]);
-        Assert.Contains("invalid_encrypted_content", status.EncryptedContentWarning);
+        Assert.Equal(1, result.SqliteRowsUpdated);
+        Assert.Equal(1, result.SqliteCwdRowsUpdated);
+
+        await using SqliteConnection connection = fixture.OpenSqliteConnection();
+        await connection.OpenAsync();
+        SqliteCommand command = connection.CreateCommand();
+        command.CommandText = "SELECT cwd FROM threads WHERE id = 'thread-cwd-extended'";
+        string cwd = (string)(await command.ExecuteScalarAsync())!;
+        Assert.Equal(@"E:\GitHubProject\lin-framework", cwd);
     }
 
     [Fact]
-    public async Task CollectSessionChanges_StreamsLargeRolloutContent()
+    public async Task RunSync_RestoresWorkspaceRootsFromProjectOrder_NormalizesForDesktop_AndRestoreRevertsGlobalState()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-streamed.jsonl");
-        object payload = new
-        {
-            id = "thread-streamed",
-            timestamp = "2026-03-19T00:00:00.000Z",
-            cwd = "C:\\AITemp",
-            source = "cli",
-            cli_version = "0.115.0",
-            model_provider = "apigather"
-        };
-        string firstLine = JsonSerializer.Serialize(new
-        {
-            timestamp = "2026-03-19T00:00:00.000Z",
-            type = "session_meta",
-            payload
-        });
-        await File.WriteAllTextAsync(sessionPath, firstLine + "\n");
-
-        const int chunkBytes = 1024 * 1024;
-        const string tokenPrefix = "encrypted_";
-        string userEvent = JsonSerializer.Serialize(new
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        await fixture.WriteGlobalStateAsync(new Dictionary<string, object?>
         {
-            type = "event_msg",
-            payload = new
+            ["electron-saved-workspace-roots"] = new[]
             {
-                type = "user_message",
-                message = "after large content"
+                @"\\?\D:\GitHubProject\codex-provider-sync"
+            },
+            ["project-order"] = new[]
+            {
+                @"\\?\D:\GitHubProject\codex-provider-sync",
+                @"\\?\E:\NewRich\BrainLife\Code\BrainLife\Assets"
+            },
+            ["active-workspace-roots"] = new[]
+            {
+                @"\\?\D:\GitHubProject\codex-provider-sync"
+            },
+            ["electron-workspace-root-labels"] = new Dictionary<string, string>
+            {
+                [@"\\?\E:\NewRich\BrainLife\Code\BrainLife\Assets"] = "BrainLifeAssets"
             }
         });
-        await File.AppendAllTextAsync(
-            sessionPath,
-            $"{new string('x', chunkBytes - tokenPrefix.Length)}{tokenPrefix}content\n{userEvent}\n");
+        await fixture.WriteStateDbWithCwdAsync(
+        [
+            ("thread-a", "openai", false, @"\\?\D:\GitHubProject\codex-provider-sync"),
+            ("thread-b", "openai", false, @"\\?\E:\NewRich\BrainLife\Code\BrainLife\Assets")
+        ]);
 
-        SessionRolloutService service = new();
-        SessionChangeCollection collected = await service.CollectSessionChangesAsync(fixture.CodexHome, "openai");
+        CodexSyncService service = new();
+        SyncResult syncResult = await service.RunSyncAsync(fixture.CodexHome);
 
-        Assert.Equal(1, collected.EncryptedContentCounts.Sessions["apigather"]);
-        Assert.Contains("thread-streamed", collected.UserEventThreadIds);
+        Assert.Equal(2, syncResult.UpdatedWorkspaceRoots);
+
+        JsonDocument syncedState = JsonDocument.Parse(
+            await File.ReadAllTextAsync(Path.Combine(fixture.CodexHome, AppConstants.GlobalStateFileBasename)));
+        Assert.Equal(
+        [
+            @"D:\GitHubProject\codex-provider-sync",
+            @"E:\NewRich\BrainLife\Code\BrainLife\Assets"
+        ],
+            syncedState.RootElement.GetProperty("electron-saved-workspace-roots").EnumerateArray().Select(static entry => entry.GetString()!).ToArray());
+        Assert.Equal(
+        [
+            @"D:\GitHubProject\codex-provider-sync",
+            @"E:\NewRich\BrainLife\Code\BrainLife\Assets"
+        ],
+            syncedState.RootElement.GetProperty("project-order").EnumerateArray().Select(static entry => entry.GetString()!).ToArray());
+        Assert.Equal(
+            @"D:\GitHubProject\codex-provider-sync",
+            syncedState.RootElement.GetProperty("active-workspace-roots")[0].GetString());
+        Assert.Equal(
+            "BrainLifeAssets",
+            syncedState.RootElement.GetProperty("electron-workspace-root-labels")
+                .GetProperty(@"E:\NewRich\BrainLife\Code\BrainLife\Assets")
+                .GetString());
+
+        await service.RunRestoreAsync(fixture.CodexHome, syncResult.BackupDir);
+
+        JsonDocument restoredState = JsonDocument.Parse(
+            await File.ReadAllTextAsync(Path.Combine(fixture.CodexHome, AppConstants.GlobalStateFileBasename)));
+        Assert.Equal(
+        [
+            @"\\?\D:\GitHubProject\codex-provider-sync"
+        ],
+            restoredState.RootElement.GetProperty("electron-saved-workspace-roots").EnumerateArray().Select(static entry => entry.GetString()!).ToArray());
+        Assert.Equal(
+        [
+            @"\\?\D:\GitHubProject\codex-provider-sync",
+            @"\\?\E:\NewRich\BrainLife\Code\BrainLife\Assets"
+        ],
+            restoredState.RootElement.GetProperty("project-order").EnumerateArray().Select(static entry => entry.GetString()!).ToArray());
     }
 
     [Fact]
-    public async Task RunSync_RewritesPerThreadModelColumnFromConfig()
+    public async Task GetStatus_ReportsImplicitDefaultProviderAndCounts()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"MiniMax-M3\"\n");
+        await fixture.WriteConfigAsync(string.Empty);
         string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "openai");
+        string archivedPath = fixture.RolloutPath("archived_sessions", "rollout-b.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
+        await fixture.WriteRolloutAsync(archivedPath, "thread-b", "openai");
+        long backupOneBytes = await fixture.WriteBackupAsync("20260319T000000000Z", ("note.txt", "backup-one"));
+        long backupTwoBytes = await fixture.WriteBackupAsync("20260320T000000000Z", ("note.txt", "backup-two"));
         await fixture.WriteStateDbAsync(
         [
-            ("thread-a", "openai", false)
-        ],
-            model: "gpt-5.4-mini");
+            ("thread-a", "apigather", false),
+            ("thread-b", "openai", true)
+        ]);
 
         CodexSyncService service = new();
-        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
+        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
 
-        Assert.Equal(1, result.SqliteModelRowsUpdated);
-        await using SqliteConnection connection = new($"Data Source={fixture.StateDbPath()};Mode=ReadOnly;Pooling=False");
-        await connection.OpenAsync();
-        await using SqliteCommand command = connection.CreateCommand();
-        command.CommandText = "SELECT model, model_provider FROM threads WHERE id = 'thread-a'";
-        await using SqliteDataReader reader = await command.ExecuteReaderAsync();
-        Assert.True(await reader.ReadAsync());
-        Assert.Equal("MiniMax-M3", reader.GetString(0));
-        Assert.Equal("openai", reader.GetString(1));
+        Assert.Equal("openai", status.CurrentProvider.Provider);
+        Assert.True(status.CurrentProvider.Implicit);
+        Assert.Equal(1, status.RolloutCounts.Sessions["apigather"]);
+        Assert.Equal(1, status.SqliteCounts!.ArchivedSessions["openai"]);
+        Assert.NotNull(status.StateDbLocation);
+        Assert.Equal("sqlite-dir", status.StateDbLocation!.Source);
+        Assert.Equal(fixture.StateDbPath(), status.StateDbLocation.Path);
+        Assert.Equal(2, status.BackupSummary.Count);
+        Assert.Equal(backupOneBytes + backupTwoBytes, status.BackupSummary.TotalBytes);
+        Assert.Contains($"database: {fixture.StateDbPath()}", TextFormatter.FormatStatus(status));
     }
 
     [Fact]
-    public async Task RunSync_LeavesPerThreadModelAlone_WhenNoRootModelConfigured()
+    public async Task GetStatus_FallsBackToLegacyRootSqliteDatabase()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"\n");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "openai");
-        await fixture.WriteStateDbAsync(
-        [
-            ("thread-a", "openai", false)
-        ],
-            model: "gpt-5.4-mini");
+        await fixture.WriteConfigAsync(string.Empty);
+        await using (SqliteConnection connection = fixture.OpenLegacySqliteConnection())
+        {
+            await connection.OpenAsync();
+            SqliteCommand create = connection.CreateCommand();
+            create.CommandText = """
+                CREATE TABLE threads (
+                  id TEXT PRIMARY KEY,
+                  model_provider TEXT,
+                  archived INTEGER NOT NULL DEFAULT 0
+                )
+                """;
+            await create.ExecuteNonQueryAsync();
+            SqliteCommand insert = connection.CreateCommand();
+            insert.CommandText = "INSERT INTO threads (id, model_provider, archived) VALUES ('legacy-thread', 'openai', 0)";
+            await insert.ExecuteNonQueryAsync();
+        }
 
         CodexSyncService service = new();
-        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
+        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
 
-        Assert.Equal(0, result.SqliteModelRowsUpdated);
-        await using SqliteConnection connection = new($"Data Source={fixture.StateDbPath()};Mode=ReadOnly;Pooling=False");
-        await connection.OpenAsync();
-        await using SqliteCommand command = connection.CreateCommand();
-        command.CommandText = "SELECT model FROM threads WHERE id = 'thread-a'";
-        Assert.Equal("gpt-5.4-mini", Convert.ToString(await command.ExecuteScalarAsync()));
+        Assert.NotNull(status.StateDbLocation);
+        Assert.Equal("legacy-root", status.StateDbLocation!.Source);
+        Assert.Equal(fixture.LegacyStateDbPath(), status.StateDbLocation.Path);
+        Assert.Equal(1, status.SqliteCounts!.Sessions["openai"]);
+        Assert.Contains("legacy root", TextFormatter.FormatStatus(status));
     }
 
     [Fact]
-    public async Task RunSwitch_PropagatesNewModelToSqlitePerThreadColumn()
+    public async Task GetStatus_ChoosesLegacyRootSqliteDatabase_WhenSqliteDirStateIsStale()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("""
-            model_provider = "openai"
-            model = "gpt-5.4"
-
-            [model_providers.apigather]
-            name = "apigather"
-            base_url = "https://example.com"
-            model = "MiniMax-M3"
-            """);
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "openai");
+        await fixture.WriteConfigAsync(string.Empty);
+        await fixture.WriteRolloutAsync(
+            fixture.RolloutPath("sessions", "rollout-active-a.jsonl"),
+            "thread-active-a",
+            "openai");
+        await fixture.WriteRolloutAsync(
+            fixture.RolloutPath("sessions", "rollout-active-b.jsonl"),
+            "thread-active-b",
+            "openai");
+        await fixture.WriteRolloutAsync(
+            fixture.RolloutPath("archived_sessions", "rollout-active-c.jsonl"),
+            "thread-active-c",
+            "openai");
         await fixture.WriteStateDbAsync(
         [
-            ("thread-a", "openai", false)
-        ],
-            model: "gpt-5.4");
+            ("thread-active-a", "custom", false)
+        ]);
+        await fixture.WriteLegacyStateDbAsync(
+        [
+            ("thread-active-a", "openai", false),
+            ("thread-active-b", "openai", false),
+            ("thread-active-c", "openai", true)
+        ]);
 
         CodexSyncService service = new();
-        SyncResult result = await service.RunSwitchAsync(
-            fixture.CodexHome,
-            "apigather",
-            keepRootModel: false,
-            model: null);
-
-        Assert.True(result.ModelSync.Applied);
-        Assert.Equal("MiniMax-M3", result.ModelSync.Model);
-        Assert.Equal(1, result.SqliteModelRowsUpdated);
+        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
 
-        await using SqliteConnection connection = new($"Data Source={fixture.StateDbPath()};Mode=ReadOnly;Pooling=False");
-        await connection.OpenAsync();
-        await using SqliteCommand command = connection.CreateCommand();
-        command.CommandText = "SELECT model, model_provider FROM threads WHERE id = 'thread-a'";
-        await using SqliteDataReader reader = await command.ExecuteReaderAsync();
-        Assert.True(await reader.ReadAsync());
-        Assert.Equal("MiniMax-M3", reader.GetString(0));
-        Assert.Equal("apigather", reader.GetString(1));
+        Assert.NotNull(status.StateDbLocation);
+        Assert.Equal("legacy-root", status.StateDbLocation!.Source);
+        Assert.Equal(fixture.LegacyStateDbPath(), status.StateDbLocation.Path);
+        Assert.Equal(2, status.SqliteCounts!.Sessions["openai"]);
+        Assert.Equal(1, status.SqliteCounts.ArchivedSessions["openai"]);
+        Assert.Contains("legacy root", TextFormatter.FormatStatus(status));
     }
 
     [Fact]
-    public async Task RunSwitch_KeepRootModelStillAlignsRolloutAndSqlite()
+    public async Task GetStatus_ReportsPendingSqliteUserEventAndCwdRepairs()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"kept-root-model\"\n");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-keep-root.jsonl");
-        await fixture.WriteRolloutWithTurnContextAsync(
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-repair-status.jsonl");
+        await fixture.WriteRolloutAsync(
             sessionPath,
-            "thread-keep-root",
+            "thread-repair-status",
             "openai",
-            "old-model");
-        await fixture.WriteStateDbAsync(
+            @"E:\GitHubProject\lin-framework");
+        await fixture.WriteStateDbWithUserEventAndCwdAsync(
         [
-            ("thread-keep-root", "openai", false)
-        ],
-            model: "old-model");
+            ("thread-repair-status", "openai", false, false, @"\\?\E:\GitHubProject\lin-framework")
+        ]);
 
         CodexSyncService service = new();
-        SyncResult result = await service.RunSwitchAsync(
-            fixture.CodexHome,
-            "apigather",
-            keepRootModel: true);
+        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
 
-        Assert.False(result.ModelSync.Applied);
-        Assert.Equal(1, result.SqliteModelRowsUpdated);
-        foreach (string line in (await File.ReadAllLinesAsync(sessionPath))
-            .Where(line => line.Contains("\"turn_context\"", StringComparison.Ordinal)))
-        {
-            using JsonDocument document = JsonDocument.Parse(line);
-            Assert.Equal(
-                "kept-root-model",
-                document.RootElement.GetProperty("payload").GetProperty("model").GetString());
-        }
+        Assert.NotNull(status.SqliteRepairStats);
+        Assert.Equal(1, status.SqliteRepairStats!.UserEventRowsNeedingRepair);
+        Assert.Equal(1, status.SqliteRepairStats.CwdRowsNeedingRepair);
+        string formatted = TextFormatter.FormatStatus(status);
+        Assert.Contains("user-event flags needing repair: 1", formatted);
+        Assert.Contains("cwd paths needing repair: 1", formatted);
     }
 
     [Fact]
-    public async Task RunSync_RewritesTurnContextModelFieldInRolloutFiles()
+    public async Task GetStatus_ReportsProjectVisibilityRanksAndCwdExactMatchDiagnostics()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"MiniMax-M3\"\n");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
-        await fixture.WriteRolloutWithTurnContextAsync(sessionPath, "thread-a", "apigather", "gpt-5.4");
-
-        CodexSyncService service = new();
-        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
-
-        Assert.Equal(1, result.ChangedSessionFiles);
-        string rewritten = await File.ReadAllTextAsync(sessionPath);
-        using StringReader reader = new(rewritten);
-        string? line;
-        int turnContextCount = 0;
-        while ((line = reader.ReadLine()) is not null)
+        await fixture.WriteConfigAsync("model_provider = \"dal\"");
+        await fixture.WriteGlobalStateAsync(new Dictionary<string, object?>
         {
-            if (!line.Contains("\"turn_context\"", StringComparison.Ordinal))
+            ["electron-saved-workspace-roots"] = new[]
             {
-                continue;
+                @"E:\GitHubProject\lin-framework"
             }
-            using JsonDocument doc = JsonDocument.Parse(line);
-            string model = doc.RootElement.GetProperty("payload").GetProperty("model").GetString()!;
-            string collabModel = doc.RootElement
-                .GetProperty("payload")
-                .GetProperty("collaboration_mode")
-                .GetProperty("settings")
-                .GetProperty("model")
-                .GetString()!;
-            Assert.Equal("MiniMax-M3", model);
-            Assert.Equal("MiniMax-M3", collabModel);
-            turnContextCount += 1;
+        });
+
+        List<(string Id, string ModelProvider, string Cwd, string Source, bool Archived, string FirstUserMessage, long UpdatedAtMs)> rows = [];
+        for (int index = 0; index < 51; index += 1)
+        {
+            rows.Add(($"thread-other-{index:00}", "dal", @"D:\OtherProject", "cli", false, "hello", 1000 - index));
         }
-        Assert.Equal(2, turnContextCount);
+        rows.Add(("thread-lin", "dal", @"\\?\E:\GitHubProject\lin-framework", "cli", false, "hello", 1));
+        await fixture.WriteStateDbForProjectVisibilityAsync(rows);
+
+        CodexSyncService service = new();
+        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
+        ProjectThreadVisibility project = Assert.Single(status.ProjectThreadVisibility);
+
+        Assert.Equal(@"E:\GitHubProject\lin-framework", project.Root);
+        Assert.Equal(1, project.InteractiveThreads);
+        Assert.Equal(0, project.FirstPageThreads);
+        Assert.Equal([52], project.Ranks);
+        Assert.Equal(0, project.ExactCwdMatches);
+        Assert.Equal(1, project.VerbatimCwdRows);
+
+        string formatted = TextFormatter.FormatStatus(status);
+        Assert.Contains("Project visibility:", formatted);
+        Assert.Contains("first page 0/50, ranks 52, exact cwd 0/1, verbatim cwd 1", formatted);
     }
 
     [Fact]
-    public async Task RunSync_LeavesTurnContextModelFieldAlone_WhenNoRootModelConfigured()
+    public async Task RunSwitch_RejectsUnknownCustomProviders()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"\n");
+        await fixture.WriteConfigAsync(string.Empty);
+        CodexSyncService service = new();
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => service.RunSwitchAsync(fixture.CodexHome, "missing"));
+        Assert.Contains("Provider \"missing\" is not available", error.Message);
+    }
+
+    [Fact]
+    public async Task RunSync_LeavesRolloutsUntouched_WhenSqliteIsLocked()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
         string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
-        await fixture.WriteRolloutWithTurnContextAsync(sessionPath, "thread-a", "apigather", "gpt-5.4");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
+        await fixture.WriteStateDbAsync(
+        [
+            ("thread-a", "apigather", false)
+        ]);
 
         CodexSyncService service = new();
-        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
+        await using SqliteConnection connection = fixture.OpenSqliteConnection();
+        await connection.OpenAsync();
+        SqliteCommand begin = connection.CreateCommand();
+        begin.CommandText = "BEGIN IMMEDIATE";
+        await begin.ExecuteNonQueryAsync();
 
-        Assert.Equal(1, result.ChangedSessionFiles);
-        string rewritten = await File.ReadAllTextAsync(sessionPath);
-        using StringReader reader = new(rewritten);
-        string? line;
-        int turnContextCount = 0;
-        while ((line = reader.ReadLine()) is not null)
-        {
-            if (!line.Contains("\"turn_context\"", StringComparison.Ordinal))
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => service.RunSyncAsync(fixture.CodexHome, sqliteBusyTimeoutMs: 0));
+        Assert.Contains("state_5.sqlite is currently in use", error.Message);
+
+        string rollout = await File.ReadAllTextAsync(sessionPath);
+        Assert.Contains("\"model_provider\":\"apigather\"", rollout);
+    }
+
+    [Fact]
+    public async Task RunSync_SkipsLockedRolloutFiles_AndStillUpdatesSqlite()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
+        await fixture.WriteStateDbAsync(
+        [
+            ("thread-a", "apigather", false)
+        ]);
+
+        CodexSyncService service = new();
+        SyncResult result;
+        using (FileStream lockStream = new(sessionPath, FileMode.Open, FileAccess.ReadWrite, FileShare.None))
+        {
+            result = await service.RunSyncAsync(fixture.CodexHome, sqliteBusyTimeoutMs: 0);
+        }
+
+        Assert.Equal(0, result.ChangedSessionFiles);
+        Assert.Equal(1, result.SqliteRowsUpdated);
+        Assert.Equal([sessionPath], result.SkippedLockedRolloutFiles);
+        Assert.Empty(result.SkippedUnreadableRolloutFiles);
+
+        string rollout = await File.ReadAllTextAsync(sessionPath);
+        Assert.Contains("\"model_provider\":\"apigather\"", rollout);
+
+        await using SqliteConnection connection = fixture.OpenSqliteConnection();
+        await connection.OpenAsync();
+        SqliteCommand command = connection.CreateCommand();
+        command.CommandText = "SELECT model_provider FROM threads WHERE id = 'thread-a'";
+        string provider = (string)(await command.ExecuteScalarAsync())!;
+        Assert.Equal("openai", provider);
+    }
+
+    [Fact]
+    public async Task ApplySessionChanges_SkipsFile_WhenRolloutChangesAfterCollection()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
+
+        SessionRolloutService service = new();
+        SessionChangeCollection collected = await service.CollectSessionChangesAsync(fixture.CodexHome, "openai");
+
+        await File.AppendAllTextAsync(
+            sessionPath,
+            "{\"timestamp\":\"2026-03-19T00:00:01.000Z\",\"type\":\"event_msg\",\"payload\":{\"type\":\"assistant_message\",\"message\":\"later\"}}\n");
+
+        SessionApplyResult result = await service.ApplySessionChangesAsync(collected.Changes);
+
+        Assert.Equal(0, result.AppliedCount);
+        Assert.Equal([sessionPath], result.SkippedPaths);
+
+        string rollout = await File.ReadAllTextAsync(sessionPath);
+        Assert.Contains("\"model_provider\":\"apigather\"", rollout);
+        Assert.Contains("\"message\":\"later\"", rollout);
+    }
+
+    [Fact]
+    public async Task ApplySessionChanges_RewritesFile_WhenRolloutIsUnchanged()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
+
+        SessionRolloutService service = new();
+        SessionChangeCollection collected = await service.CollectSessionChangesAsync(fixture.CodexHome, "openai");
+
+        SessionApplyResult result = await service.ApplySessionChangesAsync(collected.Changes);
+
+        Assert.Equal(1, result.AppliedCount);
+        Assert.Empty(result.SkippedPaths);
+
+        string rollout = await File.ReadAllTextAsync(sessionPath);
+        Assert.Contains("\"model_provider\":\"openai\"", rollout);
+    }
+
+    [Fact]
+    public async Task RestoreBackup_OnlyRestoresRolloutFilesThatWereActuallyApplied()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string configPath = Path.Combine(fixture.CodexHome, "config.toml");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
+
+        SessionRolloutService sessionService = new();
+        SessionChangeCollection collected = await sessionService.CollectSessionChangesAsync(fixture.CodexHome, "openai");
+        BackupService backupService = new(sessionService, new SqliteStateService());
+        string backupDir = await backupService.CreateBackupAsync(
+            fixture.CodexHome,
+            "openai",
+            collected.Changes,
+            configPath);
+
+        await backupService.UpdateSessionBackupManifestAsync(backupDir, []);
+        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "manual");
+
+        await backupService.RestoreBackupAsync(
+            backupDir,
+            fixture.CodexHome,
+            new RestoreBackupOptions
             {
-                continue;
-            }
-            using JsonDocument doc = JsonDocument.Parse(line);
-            string model = doc.RootElement.GetProperty("payload").GetProperty("model").GetString()!;
-            Assert.Equal("gpt-5.4", model);
-            turnContextCount += 1;
+                RestoreConfig = false,
+                RestoreDatabase = false,
+                RestoreSessions = true
+            });
+
+        string rollout = await File.ReadAllTextAsync(sessionPath);
+        Assert.Contains("\"model_provider\":\"manual\"", rollout);
+    }
+
+    [Fact]
+    public async Task RunSync_SkipsRolloutFile_WhenAnotherWriterAllowsSharing()
+    {
+        if (!OperatingSystem.IsWindows())
+        {
+            return;
         }
-        Assert.Equal(2, turnContextCount);
+
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
+        await fixture.WriteStateDbAsync(
+        [
+            ("thread-a", "apigather", false)
+        ]);
+
+        CodexSyncService service = new();
+        SyncResult result;
+        using (FileStream writer = new(sessionPath, FileMode.Open, FileAccess.ReadWrite, FileShare.ReadWrite | FileShare.Delete))
+        {
+            result = await service.RunSyncAsync(fixture.CodexHome, sqliteBusyTimeoutMs: 0);
+        }
+
+        Assert.Equal(0, result.ChangedSessionFiles);
+        Assert.Equal(1, result.SqliteRowsUpdated);
+        Assert.Equal([sessionPath], result.SkippedLockedRolloutFiles);
+        Assert.Empty(result.SkippedUnreadableRolloutFiles);
+
+        string rollout = await File.ReadAllTextAsync(sessionPath);
+        Assert.Contains("\"model_provider\":\"apigather\"", rollout);
+    }
+
+    [Fact]
+    public async Task Status_SkipsLockedRolloutFile_WhenAnotherWriterAllowsSharing()
+    {
+        if (!OperatingSystem.IsWindows())
+        {
+            return;
+        }
+
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-status-locked.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-status-locked", "openai");
+
+        CodexSyncService service = new();
+        using FileStream writer = new(sessionPath, FileMode.Open, FileAccess.ReadWrite, FileShare.ReadWrite | FileShare.Delete);
+        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
+
+        Assert.Equal([sessionPath], status.LockedRolloutFiles);
+        Assert.Empty(status.UnreadableRolloutFiles);
+        Assert.Contains("Locked rollout files skipped during status scan: 1", TextFormatter.FormatStatus(status));
+    }
+
+    [Fact]
+    public void FormatStatus_ReportsUnreadableRolloutFiles()
+    {
+        StatusSnapshot status = new()
+        {
+            CodexHome = @"C:\Users\test\.codex",
+            CurrentProvider = new CurrentProviderInfo("openai", false),
+            ConfiguredProviders = ["openai"],
+            RolloutCounts = new ProviderCounts(),
+            LockedRolloutFiles = [],
+            UnreadableRolloutFiles = [@"C:\Users\test\.codex\sessions\rollout-bad.jsonl"],
+            EncryptedContentCounts = new ProviderCounts(),
+            SqliteCounts = null,
+            BackupRoot = @"C:\Users\test\.codex\backups_state\provider-sync",
+            BackupSummary = new BackupSummary
+            {
+                Count = 0,
+                TotalBytes = 0
+            }
+        };
+
+        Assert.Contains("Unreadable rollout files skipped during status scan: 1", TextFormatter.FormatStatus(status));
+    }
+
+    [Fact]
+    public async Task RunPruneBackups_RemovesOldestBackupDirectories()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        long oldestBytes = await fixture.WriteBackupAsync(
+            "20260319T000000000Z",
+            ("note.txt", "oldest"),
+            ("db/state_5.sqlite", "sqlite"));
+        await fixture.WriteBackupAsync("20260320T000000000Z", ("note.txt", "middle"));
+        await fixture.WriteBackupAsync("20260321T000000000Z", ("note.txt", "newest"));
+
+        CodexSyncService service = new();
+        BackupPruneResult result = await service.RunPruneBackupsAsync(fixture.CodexHome, 2);
+
+        Assert.Equal(fixture.BackupRoot(), result.BackupRoot);
+        Assert.Equal(1, result.DeletedCount);
+        Assert.Equal(2, result.RemainingCount);
+        Assert.Equal(oldestBytes, result.FreedBytes);
+        Assert.False(Directory.Exists(fixture.BackupPath("20260319T000000000Z")));
+        Assert.True(Directory.Exists(fixture.BackupPath("20260320T000000000Z")));
+        Assert.True(Directory.Exists(fixture.BackupPath("20260321T000000000Z")));
+    }
+
+    [Fact]
+    public async Task RunPruneBackups_IgnoresDirectoriesWithoutManagedBackupMetadata()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        await fixture.WriteBackupAsync(
+            "20260320T000000000Z",
+            ("metadata.json", $$"""
+                {
+                  "version": 1,
+                  "namespace": "provider-sync",
+                  "codexHome": "{{fixture.CodexHome.Replace("\\", "\\\\")}}",
+                  "targetProvider": "openai",
+                  "createdAt": "2026-03-24T00:00:00.0000000+00:00",
+                  "dbFiles": [],
+                  "changedSessionFiles": 0
+                }
+                """));
+        string junkDirectory = fixture.BackupPath("manual-notes");
+        Directory.CreateDirectory(junkDirectory);
+        await File.WriteAllTextAsync(Path.Combine(junkDirectory, "readme.txt"), "keep me");
+
+        CodexSyncService service = new();
+        BackupPruneResult result = await service.RunPruneBackupsAsync(fixture.CodexHome, 0);
+
+        Assert.Equal(1, result.DeletedCount);
+        Assert.Equal(0, result.RemainingCount);
+        Assert.True(Directory.Exists(junkDirectory));
+    }
+
+    [Fact]
+    public async Task RunSync_AutoPrunesBackupsToDefaultRetention()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
+        await fixture.WriteStateDbAsync(
+        [
+            ("thread-a", "apigather", false)
+        ]);
+
+        for (int index = 0; index < AppConstants.DefaultBackupRetentionCount; index += 1)
+        {
+            await fixture.WriteBackupAsync(
+                $"20240101T0000{index:00}000Z",
+                ("note.txt", $"backup-{index}"));
+        }
+
+        CodexSyncService service = new();
+        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
+
+        string[] backupDirs = Directory.GetDirectories(fixture.BackupRoot());
+        Assert.Equal(AppConstants.DefaultBackupRetentionCount, backupDirs.Length);
+        Assert.True(Directory.Exists(result.BackupDir));
+        Assert.NotNull(result.AutoPruneResult);
+        Assert.Equal(1, result.AutoPruneResult!.DeletedCount);
+        Assert.Equal(AppConstants.DefaultBackupRetentionCount, result.AutoPruneResult.RemainingCount);
+        Assert.True(string.IsNullOrWhiteSpace(result.AutoPruneWarning));
+    }
+
+    [Fact]
+    public async Task RunSync_UsesCustomAutomaticBackupRetentionCount()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "apigather");
+        await fixture.WriteStateDbAsync(
+        [
+            ("thread-a", "apigather", false)
+        ]);
+
+        for (int index = 0; index < 4; index += 1)
+        {
+            await fixture.WriteBackupAsync(
+                $"20240101T0000{index:00}000Z",
+                ("note.txt", $"backup-{index}"));
+        }
+
+        CodexSyncService service = new();
+        SyncResult result = await service.RunSyncAsync(fixture.CodexHome, keepCount: 2);
+
+        string[] backupDirs = Directory.GetDirectories(fixture.BackupRoot());
+        Assert.Equal(2, backupDirs.Length);
+        Assert.True(Directory.Exists(result.BackupDir));
+        Assert.NotNull(result.AutoPruneResult);
+        Assert.Equal(3, result.AutoPruneResult!.DeletedCount);
+        Assert.Equal(2, result.AutoPruneResult.RemainingCount);
+    }
+
+    [Fact]
+    public async Task ApplySessionChanges_RestoresOriginalLastWriteTime()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-mtime.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-mtime", "apigather");
+        DateTime originalTime = new(2026, 1, 2, 3, 4, 5, DateTimeKind.Utc);
+        File.SetLastWriteTimeUtc(sessionPath, originalTime);
+
+        SessionRolloutService service = new();
+        SessionChangeCollection collected = await service.CollectSessionChangesAsync(fixture.CodexHome, "openai");
+        SessionApplyResult result = await service.ApplySessionChangesAsync(collected.Changes);
+
+        Assert.Equal(1, result.AppliedCount);
+        Assert.Equal(originalTime, File.GetLastWriteTimeUtc(sessionPath));
+    }
+
+    [Fact]
+    public async Task Status_ReportsEncryptedContentCountsAndWarning()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-enc.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-enc", "apigather");
+        await fixture.AppendEncryptedContentAsync(sessionPath);
+
+        CodexSyncService service = new();
+        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
+
+        Assert.Equal(1, status.EncryptedContentCounts.Sessions["apigather"]);
+        Assert.Contains("invalid_encrypted_content", status.EncryptedContentWarning);
+    }
+
+    [Fact]
+    public async Task CollectSessionChanges_StreamsLargeRolloutContent()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-streamed.jsonl");
+        object payload = new
+        {
+            id = "thread-streamed",
+            timestamp = "2026-03-19T00:00:00.000Z",
+            cwd = "C:\\AITemp",
+            source = "cli",
+            cli_version = "0.115.0",
+            model_provider = "apigather"
+        };
+        string firstLine = JsonSerializer.Serialize(new
+        {
+            timestamp = "2026-03-19T00:00:00.000Z",
+            type = "session_meta",
+            payload
+        });
+        await File.WriteAllTextAsync(sessionPath, firstLine + "\n");
+
+        const int chunkBytes = 1024 * 1024;
+        const string tokenPrefix = "encrypted_";
+        string userEvent = JsonSerializer.Serialize(new
+        {
+            type = "event_msg",
+            payload = new
+            {
+                type = "user_message",
+                message = "after large content"
+            }
+        });
+        await File.AppendAllTextAsync(
+            sessionPath,
+            $"{new string('x', chunkBytes - tokenPrefix.Length)}{tokenPrefix}content\n{userEvent}\n");
+
+        SessionRolloutService service = new();
+        SessionChangeCollection collected = await service.CollectSessionChangesAsync(fixture.CodexHome, "openai");
+
+        Assert.Equal(1, collected.EncryptedContentCounts.Sessions["apigather"]);
+        Assert.Contains("thread-streamed", collected.UserEventThreadIds);
+    }
+
+    [Fact]
+    public async Task RunSync_RewritesPerThreadModelColumnFromConfig()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"MiniMax-M3\"\n");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "openai");
+        await fixture.WriteStateDbAsync(
+        [
+            ("thread-a", "openai", false)
+        ],
+            model: "gpt-5.4-mini");
+
+        CodexSyncService service = new();
+        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
+
+        Assert.Equal(1, result.SqliteModelRowsUpdated);
+        await using SqliteConnection connection = new($"Data Source={fixture.StateDbPath()};Mode=ReadOnly;Pooling=False");
+        await connection.OpenAsync();
+        await using SqliteCommand command = connection.CreateCommand();
+        command.CommandText = "SELECT model, model_provider FROM threads WHERE id = 'thread-a'";
+        await using SqliteDataReader reader = await command.ExecuteReaderAsync();
+        Assert.True(await reader.ReadAsync());
+        Assert.Equal("MiniMax-M3", reader.GetString(0));
+        Assert.Equal("openai", reader.GetString(1));
+    }
+
+    [Fact]
+    public async Task RunSync_LeavesPerThreadModelAlone_WhenNoRootModelConfigured()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"\n");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "openai");
+        await fixture.WriteStateDbAsync(
+        [
+            ("thread-a", "openai", false)
+        ],
+            model: "gpt-5.4-mini");
+
+        CodexSyncService service = new();
+        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
+
+        Assert.Equal(0, result.SqliteModelRowsUpdated);
+        await using SqliteConnection connection = new($"Data Source={fixture.StateDbPath()};Mode=ReadOnly;Pooling=False");
+        await connection.OpenAsync();
+        await using SqliteCommand command = connection.CreateCommand();
+        command.CommandText = "SELECT model FROM threads WHERE id = 'thread-a'";
+        Assert.Equal("gpt-5.4-mini", Convert.ToString(await command.ExecuteScalarAsync()));
+    }
+
+    [Fact]
+    public async Task RunSwitch_PropagatesNewModelToSqlitePerThreadColumn()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("""
+            model_provider = "openai"
+            model = "gpt-5.4"
+
+            [model_providers.apigather]
+            name = "apigather"
+            base_url = "https://example.com"
+            model = "MiniMax-M3"
+            """);
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-a", "openai");
+        await fixture.WriteStateDbAsync(
+        [
+            ("thread-a", "openai", false)
+        ],
+            model: "gpt-5.4");
+
+        CodexSyncService service = new();
+        SyncResult result = await service.RunSwitchAsync(
+            fixture.CodexHome,
+            "apigather",
+            keepRootModel: false,
+            model: null);
+
+        Assert.True(result.ModelSync.Applied);
+        Assert.Equal("MiniMax-M3", result.ModelSync.Model);
+        Assert.Equal(1, result.SqliteModelRowsUpdated);
+
+        await using SqliteConnection connection = new($"Data Source={fixture.StateDbPath()};Mode=ReadOnly;Pooling=False");
+        await connection.OpenAsync();
+        await using SqliteCommand command = connection.CreateCommand();
+        command.CommandText = "SELECT model, model_provider FROM threads WHERE id = 'thread-a'";
+        await using SqliteDataReader reader = await command.ExecuteReaderAsync();
+        Assert.True(await reader.ReadAsync());
+        Assert.Equal("MiniMax-M3", reader.GetString(0));
+        Assert.Equal("apigather", reader.GetString(1));
+    }
+
+    [Fact]
+    public async Task RunSwitch_KeepRootModelStillAlignsRolloutAndSqlite()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"kept-root-model\"\n");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-keep-root.jsonl");
+        await fixture.WriteRolloutWithTurnContextAsync(
+            sessionPath,
+            "thread-keep-root",
+            "openai",
+            "old-model");
+        await fixture.WriteStateDbAsync(
+        [
+            ("thread-keep-root", "openai", false)
+        ],
+            model: "old-model");
+
+        CodexSyncService service = new();
+        SyncResult result = await service.RunSwitchAsync(
+            fixture.CodexHome,
+            "apigather",
+            keepRootModel: true);
+
+        Assert.False(result.ModelSync.Applied);
+        Assert.Equal(1, result.SqliteModelRowsUpdated);
+        foreach (string line in (await File.ReadAllLinesAsync(sessionPath))
+            .Where(line => line.Contains("\"turn_context\"", StringComparison.Ordinal)))
+        {
+            using JsonDocument document = JsonDocument.Parse(line);
+            Assert.Equal(
+                "kept-root-model",
+                document.RootElement.GetProperty("payload").GetProperty("model").GetString());
+        }
+    }
+
+    [Fact]
+    public async Task RunSync_RewritesTurnContextModelFieldInRolloutFiles()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"MiniMax-M3\"\n");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
+        await fixture.WriteRolloutWithTurnContextAsync(sessionPath, "thread-a", "apigather", "gpt-5.4");
+
+        CodexSyncService service = new();
+        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
+
+        Assert.Equal(1, result.ChangedSessionFiles);
+        string rewritten = await File.ReadAllTextAsync(sessionPath);
+        using StringReader reader = new(rewritten);
+        string? line;
+        int turnContextCount = 0;
+        while ((line = reader.ReadLine()) is not null)
+        {
+            if (!line.Contains("\"turn_context\"", StringComparison.Ordinal))
+            {
+                continue;
+            }
+            using JsonDocument doc = JsonDocument.Parse(line);
+            string model = doc.RootElement.GetProperty("payload").GetProperty("model").GetString()!;
+            string collabModel = doc.RootElement
+                .GetProperty("payload")
+                .GetProperty("collaboration_mode")
+                .GetProperty("settings")
+                .GetProperty("model")
+                .GetString()!;
+            Assert.Equal("MiniMax-M3", model);
+            Assert.Equal("MiniMax-M3", collabModel);
+            turnContextCount += 1;
+        }
+        Assert.Equal(2, turnContextCount);
+    }
+
+    [Fact]
+    public async Task ApplySessionChanges_RejectsTurnContextAppendedBetweenProviderAndModelRewrite()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-concurrent-append.jsonl");
+        await fixture.WriteRolloutWithTurnContextAsync(
+            sessionPath,
+            "thread-concurrent-append",
+            "apigather",
+            "old-model");
+
+        SessionRolloutService service = new();
+        SessionChangeCollection collected = await service.CollectSessionChangesAsync(
+            fixture.CodexHome,
+            "openai",
+            targetModel: "target-model");
+        Assert.Single(collected.Changes);
+        string appendedLine = JsonSerializer.Serialize(new
+        {
+            timestamp = "2026-08-04T00:00:00Z",
+            type = "turn_context",
+            payload = new
+            {
+                turn_id = "late-turn",
+                model = "late-model",
+                collaboration_mode = new
+                {
+                    settings = new { model = "late-collaboration-model" }
+                }
+            }
+        });
+        service.ApplyFaultInjector = async (phase, _) =>
+        {
+            if (phase == "after-provider-before-model")
+            {
+                await File.AppendAllTextAsync(sessionPath, appendedLine + "\n");
+            }
+        };
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => service.ApplySessionChangesAsync(collected.Changes, "target-model"));
+
+        Assert.Contains("changed after it was scanned", error.Message);
+        string[] lines = await File.ReadAllLinesAsync(sessionPath);
+        using (JsonDocument header = JsonDocument.Parse(lines[0]))
+        {
+            Assert.Equal(
+                "apigather",
+                header.RootElement.GetProperty("payload").GetProperty("model_provider").GetString());
+        }
+        string late = Assert.Single(lines, line => line.Contains("late-turn", StringComparison.Ordinal));
+        using JsonDocument lateRecord = JsonDocument.Parse(late);
+        Assert.Equal(
+            "late-model",
+            lateRecord.RootElement.GetProperty("payload").GetProperty("model").GetString());
+        Assert.Equal(
+            "late-collaboration-model",
+            lateRecord.RootElement
+                .GetProperty("payload")
+                .GetProperty("collaboration_mode")
+                .GetProperty("settings")
+                .GetProperty("model")
+                .GetString());
+    }
+
+    [Fact]
+    public async Task RunSync_LeavesTurnContextModelFieldAlone_WhenNoRootModelConfigured()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"\n");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-a.jsonl");
+        await fixture.WriteRolloutWithTurnContextAsync(sessionPath, "thread-a", "apigather", "gpt-5.4");
+
+        CodexSyncService service = new();
+        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
+
+        Assert.Equal(1, result.ChangedSessionFiles);
+        string rewritten = await File.ReadAllTextAsync(sessionPath);
+        using StringReader reader = new(rewritten);
+        string? line;
+        int turnContextCount = 0;
+        while ((line = reader.ReadLine()) is not null)
+        {
+            if (!line.Contains("\"turn_context\"", StringComparison.Ordinal))
+            {
+                continue;
+            }
+            using JsonDocument doc = JsonDocument.Parse(line);
+            string model = doc.RootElement.GetProperty("payload").GetProperty("model").GetString()!;
+            Assert.Equal("gpt-5.4", model);
+            turnContextCount += 1;
+        }
+        Assert.Equal(2, turnContextCount);
+    }
+
+    [Fact]
+    public async Task Status_ReturnsMalformedSqliteAsUnreadable()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        Directory.CreateDirectory(Path.GetDirectoryName(fixture.StateDbPath())!);
+        await File.WriteAllTextAsync(fixture.StateDbPath(), "not sqlite");
+
+        CodexSyncService service = new();
+        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
+
+        Assert.True(status.SqliteCounts!.Unreadable);
+        Assert.Contains("malformed", TextFormatter.FormatStatus(status));
+    }
+
+    [Fact]
+    public async Task RestoreBackup_CanSkipConfigDatabaseAndSessions()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-skip.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-skip", "apigather");
+
+        SessionRolloutService sessionService = new();
+        SessionChangeCollection collected = await sessionService.CollectSessionChangesAsync(fixture.CodexHome, "openai");
+        BackupService backupService = new(sessionService, new SqliteStateService());
+        string backupDir = await backupService.CreateBackupAsync(
+            fixture.CodexHome,
+            "openai",
+            collected.Changes,
+            Path.Combine(fixture.CodexHome, "config.toml"));
+
+        await fixture.WriteConfigAsync("model_provider = \"manual\"");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-skip", "manual");
+        await backupService.RestoreBackupAsync(
+            backupDir,
+            fixture.CodexHome,
+            new RestoreBackupOptions
+            {
+                RestoreConfig = false,
+                RestoreDatabase = false,
+                RestoreSessions = false
+            });
+
+        Assert.Contains("model_provider = \"manual\"", await File.ReadAllTextAsync(Path.Combine(fixture.CodexHome, "config.toml")));
+        Assert.Contains("\"model_provider\":\"manual\"", await File.ReadAllTextAsync(sessionPath));
+    }
+
+    [Fact]
+    public async Task RunSync_RewritesTurnContextModelField_LinesLargerThan64KB()
+    {
+        // Regression guard for the long-line reader. Codex can pack a
+        // `developer_instructions` blob into a single `turn_context`
+        // payload, easily pushing the encoded JSON past 64 KB. The
+        // previous 64 KB scanner silently returned null for those
+        // files, so the rollout model rewrite was a no-op for
+        // sessions whose first turn was a long planning step.
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"MiniMax-M3\"\n");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-huge.jsonl");
+
+        await fixture.WriteRolloutWithTurnContextPayloadAsync(
+            sessionPath,
+            "thread-huge",
+            "apigather",
+            "gpt-5.4",
+            new Dictionary<string, object>
+            {
+                ["developer_instructions"] = new string('x', 150 * 1024)
+            });
+
+        string onDisk = await File.ReadAllTextAsync(sessionPath);
+        long longestLine = onDisk.Split('\n').Where(line => !string.IsNullOrEmpty(line)).Max(line => (long)line.Length);
+        Assert.True(longestLine > 64 * 1024, $"test setup: longest line should exceed 64 KB; got {longestLine}");
+
+        CodexSyncService service = new();
+        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
+        Assert.Equal(1, result.ChangedSessionFiles);
+
+        string rewritten = await File.ReadAllTextAsync(sessionPath);
+        int rewrittenCount = 0;
+        using (StringReader reader = new(rewritten))
+        {
+            string? line;
+            while ((line = reader.ReadLine()) is not null)
+            {
+                if (!line.Contains("\"turn_context\"", StringComparison.Ordinal))
+                {
+                    continue;
+                }
+
+                using JsonDocument doc = JsonDocument.Parse(line);
+                Assert.Equal("MiniMax-M3", doc.RootElement.GetProperty("payload").GetProperty("model").GetString());
+                Assert.Equal("MiniMax-M3", doc.RootElement
+                    .GetProperty("payload")
+                    .GetProperty("collaboration_mode")
+                    .GetProperty("settings")
+                    .GetProperty("model")
+                    .GetString());
+                rewrittenCount += 1;
+            }
+        }
+
+        Assert.Equal(2, rewrittenCount);
+    }
+
+    [Fact]
+    public async Task RunSync_RewritesTurnContextModelField_WithRegexMetacharactersInModelName()
+    {
+        // Regression guard for regex escaping in the per-turn
+        // rewrite. A model name containing '.', '+', '*', '?', or
+        // '(' is a regex hazard: '.' is a regex any-char, '+' is a
+        // quantifier, and an unbalanced '{' would refuse to compile.
+        // The rewrite must match literally and not poison a decoy
+        // sibling whose pattern over-matches.
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"weird(target)+v2\"\n");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-rewrite.jsonl");
+        await fixture.WriteRolloutWithTurnContextAsync(sessionPath, "thread-rewrite", "apigather", "weird(target)+v2");
+        await File.AppendAllTextAsync(sessionPath, JsonSerializer.Serialize(new
+        {
+            timestamp = "2026-06-09T09:16:03.881Z",
+            type = "turn_context",
+            payload = new
+            {
+                turn_id = "decoy",
+                model = "weirdAtargetAv2"
+            }
+        }) + "\n");
+
+        CodexSyncService service = new();
+        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
+        Assert.Equal(1, result.ChangedSessionFiles);
+
+        string rewritten = await File.ReadAllTextAsync(sessionPath);
+        int totalContext = 0;
+        using (StringReader reader = new(rewritten))
+        {
+            string? line;
+            while ((line = reader.ReadLine()) is not null)
+            {
+                if (!line.Contains("\"turn_context\"", StringComparison.Ordinal))
+                {
+                    continue;
+                }
+                totalContext += 1;
+                using JsonDocument doc = JsonDocument.Parse(line);
+                string turnId = doc.RootElement.GetProperty("payload").GetProperty("turn_id").GetString()!;
+                string model = doc.RootElement.GetProperty("payload").GetProperty("model").GetString()!;
+                if (turnId == "decoy")
+                {
+                    Assert.Equal("weird(target)+v2", model);
+                }
+                else
+                {
+                    Assert.Equal("weird(target)+v2", model);
+                }
+            }
+        }
+        Assert.Equal(3, totalContext);
+    }
+
+    [Fact]
+    public async Task RunSync_RewritesModelOnlyChange_AndRestorePreservesOriginalFile()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"\r\nmodel = \"MiniMax-M3\"\r\n");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-model-only.jsonl");
+        await fixture.WriteRolloutWithTurnContextAsync(
+            sessionPath,
+            "thread-model-only",
+            "openai",
+            "gpt-5.4");
+        string crlfContent = (await File.ReadAllTextAsync(sessionPath)).Replace("\n", "\r\n", StringComparison.Ordinal);
+        await File.WriteAllTextAsync(sessionPath, crlfContent);
+        DateTime originalTime = new(2026, 6, 9, 9, 0, 0, DateTimeKind.Utc);
+        File.SetLastWriteTimeUtc(sessionPath, originalTime);
+        await fixture.WriteStateDbAsync(
+        [
+            ("thread-model-only", "openai", false)
+        ],
+            model: "gpt-5.4");
+
+        CodexSyncService service = new();
+        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
+
+        Assert.Equal(1, result.ChangedSessionFiles);
+        Assert.Equal(1, result.SqliteModelRowsUpdated);
+        byte[] syncedBytes = await File.ReadAllBytesAsync(sessionPath);
+        Assert.Contains((byte)'\r', syncedBytes);
+        Assert.EndsWith("\r\n", await File.ReadAllTextAsync(sessionPath), StringComparison.Ordinal);
+        Assert.Equal(originalTime, File.GetLastWriteTimeUtc(sessionPath));
+
+        await service.RunRestoreAsync(fixture.CodexHome, result.BackupDir);
+
+        Assert.Equal(crlfContent, await File.ReadAllTextAsync(sessionPath));
+        Assert.Equal(originalTime, File.GetLastWriteTimeUtc(sessionPath));
+    }
+
+    [Fact]
+    public async Task RunSync_DetectsStaleModelsAfterAnAlreadyMatchingFirstTurn()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"target-model\"\n");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-mixed-models.jsonl");
+        await fixture.WriteRolloutWithTurnContextAsync(
+            sessionPath,
+            "thread-mixed-models",
+            "openai",
+            "target-model");
+        await File.AppendAllTextAsync(sessionPath, JsonSerializer.Serialize(new
+        {
+            timestamp = "2026-06-09T11:16:03.880Z",
+            type = "turn_context",
+            payload = new
+            {
+                turn_id = "stale-turn",
+                model = "stale-top-level",
+                collaboration_mode = new
+                {
+                    mode = "default",
+                    settings = new
+                    {
+                        model = "stale-nested"
+                    }
+                }
+            }
+        }) + "\n");
+
+        CodexSyncService service = new();
+        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
+
+        Assert.Equal(1, result.ChangedSessionFiles);
+        foreach (string line in (await File.ReadAllLinesAsync(sessionPath))
+            .Where(line => line.Contains("\"turn_context\"", StringComparison.Ordinal)))
+        {
+            using JsonDocument document = JsonDocument.Parse(line);
+            JsonElement payload = document.RootElement.GetProperty("payload");
+            Assert.Equal("target-model", payload.GetProperty("model").GetString());
+            Assert.Equal(
+                "target-model",
+                payload.GetProperty("collaboration_mode").GetProperty("settings").GetProperty("model").GetString());
+        }
+
+        await service.RunRestoreAsync(
+            fixture.CodexHome,
+            result.BackupDir,
+            new RestoreBackupOptions { RestoreDatabase = false });
+        string restoredStaleLine = (await File.ReadAllLinesAsync(sessionPath))
+            .Single(line => line.Contains("\"stale-turn\"", StringComparison.Ordinal));
+        using JsonDocument restoredDocument = JsonDocument.Parse(restoredStaleLine);
+        JsonElement restoredPayload = restoredDocument.RootElement.GetProperty("payload");
+        Assert.Equal("stale-top-level", restoredPayload.GetProperty("model").GetString());
+        Assert.Equal(
+            "stale-nested",
+            restoredPayload.GetProperty("collaboration_mode").GetProperty("settings").GetProperty("model").GetString());
+    }
+
+    [Fact]
+    public async Task RestoreBackup_AcceptsVersionOneSessionManifest()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-legacy-manifest.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-legacy-manifest", "apigather");
+        string originalFirstLine = (await File.ReadAllLinesAsync(sessionPath))[0];
+        await fixture.WriteRolloutAsync(sessionPath, "thread-legacy-manifest", "openai");
+
+        string sessionManifest = JsonSerializer.Serialize(new
+        {
+            version = 1,
+            @namespace = AppConstants.BackupNamespace,
+            codexHome = fixture.CodexHome,
+            targetProvider = "openai",
+            createdAt = DateTimeOffset.UtcNow,
+            files = new[]
+            {
+                new
+                {
+                    path = sessionPath,
+                    originalFirstLine,
+                    originalSeparator = "\n"
+                }
+            }
+        });
+        await fixture.WriteBackupAsync(
+            "20260723T000000000Z",
+            ("session-meta-backup.json", sessionManifest),
+            ("config.toml", await File.ReadAllTextAsync(Path.Combine(fixture.CodexHome, "config.toml"))));
+
+        CodexSyncService service = new();
+        await service.RunRestoreAsync(
+            fixture.CodexHome,
+            fixture.BackupPath("20260723T000000000Z"),
+            new RestoreBackupOptions { RestoreDatabase = false });
+
+        Assert.Equal(originalFirstLine, (await File.ReadAllLinesAsync(sessionPath))[0]);
+    }
+
+    [Fact]
+    public async Task RunSync_UsesExplicitSqliteHomeWithoutTouchingDefaultDatabase()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        await fixture.WriteStateDbAsync([("default-thread", "default-provider", false)]);
+        string sqliteHome = Path.Combine(fixture.Root, "external-sqlite");
+        string externalDbPath = Path.Combine(sqliteHome, AppConstants.DbFileBasename);
+        await fixture.WriteStateDbAtAsync(
+            externalDbPath,
+            [("external-thread", "custom", false)],
+            model: "old-model");
+
+        CodexSyncService service = new();
+        SyncResult result = await service.RunSyncAsync(
+            fixture.CodexHome,
+            model: "new-model",
+            explicitSqliteHome: sqliteHome);
+
+        Assert.Equal(Path.GetFullPath(sqliteHome), result.SqliteHome);
+        Assert.Equal("gui", result.SqliteHomeSource);
+        Assert.Equal("openai", await ReadProviderAsync(externalDbPath, "external-thread"));
+        Assert.Equal("default-provider", await ReadProviderAsync(fixture.StateDbPath(), "default-thread"));
+
+        BackupMetadataFile metadata = JsonSerializer.Deserialize<BackupMetadataFile>(
+            await File.ReadAllTextAsync(Path.Combine(result.BackupDir, "metadata.json")),
+            new JsonSerializerOptions { PropertyNamingPolicy = JsonNamingPolicy.CamelCase })!;
+        Assert.Equal(2, metadata.Version);
+        Assert.Equal(Path.GetFullPath(sqliteHome), metadata.SqliteHome);
+        Assert.Empty(metadata.DbFiles);
+        Assert.Equal([AppConstants.DbFileBasename], metadata.SqliteDbFiles);
+    }
+
+    [Fact]
+    public async Task ConfiguredSqliteHomeWithoutDatabase_IsDiagnosticForStatusButBlocksSync()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        string sqliteHome = Path.Combine(fixture.Root, "missing-sqlite");
+        await fixture.WriteConfigAsync($"model_provider = \"openai\"\nsqlite_home = '{sqliteHome}'");
+        await fixture.WriteStateDbAsync([("stale-thread", "custom", false)]);
+
+        CodexSyncService service = new();
+        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
+
+        Assert.Equal(Path.GetFullPath(sqliteHome), status.SqliteHome);
+        Assert.Equal("config", status.SqliteHomeSource);
+        Assert.Null(status.StateDbLocation);
+        Assert.Single(status.CheckedStateDbPaths);
+        await Assert.ThrowsAsync<InvalidOperationException>(() => service.RunSyncAsync(fixture.CodexHome));
+        Assert.Equal("custom", await ReadProviderAsync(fixture.StateDbPath(), "stale-thread"));
+    }
+
+    [Fact]
+    public async Task RestoreVersionTwo_RebuildsMissingDefaultSqliteDatabase()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        await fixture.WriteStateDbAsync([("thread-missing-default", "custom", false)]);
+
+        CodexSyncService service = new();
+        SyncResult syncResult = await service.RunSyncAsync(fixture.CodexHome);
+        File.Delete(fixture.StateDbPath());
+
+        await service.RunRestoreAsync(
+            fixture.CodexHome,
+            syncResult.BackupDir,
+            new RestoreBackupOptions
+            {
+                RestoreConfig = false,
+                RestoreDatabase = true,
+                RestoreSessions = false
+            });
+
+        Assert.Equal("custom", await ReadProviderAsync(fixture.StateDbPath(), "thread-missing-default"));
+    }
+
+    [Fact]
+    public async Task RestoreVersionTwo_RebuildsMissingLegacyRootSqliteDatabaseInPlace()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        await fixture.WriteLegacyStateDbAsync([("thread-missing-legacy", "custom", false)]);
+
+        CodexSyncService service = new();
+        SyncResult syncResult = await service.RunSyncAsync(fixture.CodexHome);
+        File.Delete(fixture.LegacyStateDbPath());
+
+        await service.RunRestoreAsync(
+            fixture.CodexHome,
+            syncResult.BackupDir,
+            new RestoreBackupOptions
+            {
+                RestoreConfig = false,
+                RestoreDatabase = true,
+                RestoreSessions = false
+            });
+
+        Assert.False(File.Exists(fixture.StateDbPath()));
+        Assert.Equal("custom", await ReadProviderAsync(fixture.LegacyStateDbPath(), "thread-missing-legacy"));
+    }
+
+    [Fact]
+    public async Task RestoreVersionOne_RebuildsMissingDefaultSqliteDatabase()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string backupDir = fixture.BackupPath("20260728T010000000Z");
+        string relativeDbPath = Path.Combine(AppConstants.SqliteDirBasename, AppConstants.DbFileBasename);
+        string backupDbPath = Path.Combine(backupDir, "db", relativeDbPath);
+        await fixture.WriteStateDbAtAsync(
+            backupDbPath,
+            [("thread-v1-missing", "custom", false)],
+            model: null);
+        string metadata = JsonSerializer.Serialize(new
+        {
+            version = 1,
+            @namespace = AppConstants.BackupNamespace,
+            codexHome = fixture.CodexHome,
+            targetProvider = "custom",
+            createdAt = DateTimeOffset.UtcNow,
+            dbFiles = new[] { relativeDbPath },
+            changedSessionFiles = 0
+        });
+        await File.WriteAllTextAsync(Path.Combine(backupDir, "metadata.json"), metadata);
+
+        CodexSyncService service = new();
+        await service.RunRestoreAsync(
+            fixture.CodexHome,
+            backupDir,
+            new RestoreBackupOptions
+            {
+                RestoreConfig = false,
+                RestoreDatabase = true,
+                RestoreSessions = false
+            });
+
+        Assert.Equal("custom", await ReadProviderAsync(fixture.StateDbPath(), "thread-v1-missing"));
+    }
+
+    [Fact]
+    public async Task RestoreVersionTwo_RequiresExplicitRelocationConfirmation()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sourceSqliteHome = Path.Combine(fixture.Root, "source-sqlite");
+        string sourceDbPath = Path.Combine(sourceSqliteHome, AppConstants.DbFileBasename);
+        await fixture.WriteStateDbAtAsync(sourceDbPath, [("thread-a", "custom", false)], model: null);
+
+        CodexSyncService service = new();
+        SyncResult syncResult = await service.RunSyncAsync(
+            fixture.CodexHome,
+            explicitSqliteHome: sourceSqliteHome);
+
+        string targetSqliteHome = Path.Combine(fixture.Root, "target-sqlite");
+        string targetDbPath = Path.Combine(targetSqliteHome, AppConstants.DbFileBasename);
+        await fixture.WriteStateDbAtAsync(targetDbPath, [("thread-a", "target", false)], model: null);
+        RestoreBackupOptions deniedOptions = new()
+        {
+            RestoreConfig = false,
+            RestoreDatabase = true,
+            RestoreSessions = false
+        };
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() => service.RunRestoreAsync(
+            fixture.CodexHome,
+            syncResult.BackupDir,
+            deniedOptions,
+            targetSqliteHome));
+        Assert.Equal("target", await ReadProviderAsync(targetDbPath, "thread-a"));
+
+        InvalidOperationException configError = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => service.RunRestoreAsync(
+                fixture.CodexHome,
+                syncResult.BackupDir,
+                new RestoreBackupOptions
+                {
+                    RestoreConfig = true,
+                    RestoreDatabase = true,
+                    RestoreSessions = false,
+                    AllowSqliteHomeRelocation = true
+                },
+                targetSqliteHome));
+        Assert.Contains("Cannot restore config.toml while relocating SQLite home", configError.Message);
+        Assert.Equal("target", await ReadProviderAsync(targetDbPath, "thread-a"));
+
+        await service.RunRestoreAsync(
+            fixture.CodexHome,
+            syncResult.BackupDir,
+            new RestoreBackupOptions
+            {
+                RestoreConfig = false,
+                RestoreDatabase = true,
+                RestoreSessions = false,
+                AllowSqliteHomeRelocation = true
+            },
+            targetSqliteHome);
+        Assert.Equal("custom", await ReadProviderAsync(targetDbPath, "thread-a"));
+    }
+
+    [Fact]
+    public async Task RestoreVersionTwo_ValidatesDatabaseFilesBeforeRestoringConfig()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"current\"");
+        await fixture.WriteStateDbAsync([("thread-a", "current", false)]);
+        string backupDir = fixture.BackupPath("20260728T000000000Z");
+        string metadata = JsonSerializer.Serialize(new
+        {
+            version = 2,
+            @namespace = AppConstants.BackupNamespace,
+            codexHome = fixture.CodexHome,
+            sqliteHome = Path.GetDirectoryName(fixture.StateDbPath()),
+            targetProvider = "backup",
+            createdAt = DateTimeOffset.UtcNow,
+            dbFiles = Array.Empty<string>(),
+            sqliteDbFiles = new[] { AppConstants.DbFileBasename },
+            changedSessionFiles = 0
+        });
+        await fixture.WriteBackupAsync(
+            "20260728T000000000Z",
+            ("metadata.json", metadata),
+            ("config.toml", "model_provider = \"backup\"\n"));
+
+        CodexSyncService service = new();
+        await Assert.ThrowsAsync<InvalidOperationException>(() => service.RunRestoreAsync(
+            fixture.CodexHome,
+            backupDir,
+            new RestoreBackupOptions { RestoreSessions = false }));
+
+        Assert.Contains(
+            "model_provider = \"current\"",
+            await File.ReadAllTextAsync(Path.Combine(fixture.CodexHome, "config.toml")));
+    }
+
+    [Fact]
+    public async Task CrashWindow_AfterSecondRolloutMutationBeforeApplied_ExplicitRestoreUsesImmutableManifest()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string firstPath = fixture.RolloutPath("sessions", "rollout-crash-window-a.jsonl");
+        string secondPath = fixture.RolloutPath("sessions", "rollout-crash-window-b.jsonl");
+        await fixture.WriteRolloutAsync(firstPath, "thread-crash-window-a", "apigather");
+        await fixture.WriteRolloutAsync(secondPath, "thread-crash-window-b", "apigather");
+        string firstBefore = await File.ReadAllTextAsync(firstPath);
+        string secondBefore = await File.ReadAllTextAsync(secondPath);
+        SessionRolloutService rollouts = new();
+        SessionChangeCollection changes = await rollouts.CollectSessionChangesAsync(
+            fixture.CodexHome,
+            "openai");
+        BackupService backups = new(rollouts, new SqliteStateService());
+        string backupDir = await backups.CreateBackupAsync(
+            fixture.CodexHome,
+            "openai",
+            changes.Changes,
+            Path.Combine(fixture.CodexHome, "config.toml"));
+        FileTransactionJournal journal = await FileTransactionJournal.CreateAsync(
+            backupDir,
+            fixture.CodexHome,
+            "openai",
+            [firstPath, secondPath]);
+        int mutated = 0;
+
+        await Assert.ThrowsAsync<IOException>(() => rollouts.ApplySessionChangesAsync(
+            changes.Changes,
+            onBeforeApply: change => journal.ApplyingAsync("rollout", change.Path),
+            onApplied: async change =>
+            {
+                mutated += 1;
+                if (mutated == 2)
+                {
+                    throw new IOException("simulated process loss before applied record");
+                }
+                await journal.AppliedAsync("rollout", change.Path);
+            },
+            onSkipped: change => journal.SkippedAsync("rollout", change.Path)));
+
+        Assert.NotEqual(firstBefore, await File.ReadAllTextAsync(firstPath));
+        Assert.NotEqual(secondBefore, await File.ReadAllTextAsync(secondPath));
+        PendingTransactionInfo pending = Assert.Single(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+        Assert.Equal(2, pending.AffectedTargets.Count(static target => target.Kind == "rollout"));
+
+        await new CodexSyncService().RunRestoreAsync(
+            fixture.CodexHome,
+            backupDir,
+            new RestoreBackupOptions
+            {
+                RestoreConfig = false,
+                RestoreDatabase = false,
+                RestoreSessions = true
+            });
+
+        Assert.Equal(firstBefore, await File.ReadAllTextAsync(firstPath));
+        Assert.Equal(secondBefore, await File.ReadAllTextAsync(secondPath));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+    }
+
+    [Fact]
+    public async Task Journal_SkippedTargetResolvesApplying_AndCanCommit()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-raced-skip.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-raced-skip", "apigather");
+        SessionRolloutService rollouts = new();
+        SessionChangeCollection changes = await rollouts.CollectSessionChangesAsync(fixture.CodexHome, "openai");
+        BackupService backups = new(rollouts, new SqliteStateService());
+        string backupDir = await backups.CreateBackupAsync(
+            fixture.CodexHome,
+            "openai",
+            changes.Changes,
+            Path.Combine(fixture.CodexHome, "config.toml"));
+        FileTransactionJournal journal = await FileTransactionJournal.CreateAsync(
+            backupDir,
+            fixture.CodexHome,
+            "openai",
+            [sessionPath]);
+
+        await fixture.WriteRolloutAsync(sessionPath, "thread-raced-skip", "changed-by-codex");
+        SessionApplyResult result = await rollouts.ApplySessionChangesAsync(
+            changes.Changes,
+            onBeforeApply: change => journal.ApplyingAsync("rollout", change.Path),
+            onApplied: change => journal.AppliedAsync("rollout", change.Path),
+            onSkipped: change => journal.SkippedAsync("rollout", change.Path));
+        await journal.CommittedAsync();
+
+        Assert.Empty(result.AppliedPaths);
+        PendingTransactionInfo info = await FileTransactionJournal.ReadInfoAsync(journal.FilePath);
+        Assert.True(info.Terminal);
+        Assert.Empty(info.AffectedTargets);
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task Status_ReturnsMalformedSqliteAsUnreadable()
+    public async Task ForeignOperationCommittedTail_RemainsPending_UntilExplicitRestoreRepairsJournal()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        Directory.CreateDirectory(Path.GetDirectoryName(fixture.StateDbPath())!);
-        await File.WriteAllTextAsync(fixture.StateDbPath(), "not sqlite");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-foreign-operation.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-foreign-operation", "apigather");
+        string before = await File.ReadAllTextAsync(sessionPath);
+        SyncResult sync = await new CodexSyncService().RunSyncAsync(fixture.CodexHome);
+        string journalPath = Path.Combine(sync.BackupDir, FileTransactionJournal.FileName);
+        PendingTransactionInfo committed = await FileTransactionJournal.ReadInfoAsync(journalPath);
+        string foreignOperationId = Guid.NewGuid().ToString("D");
+        string foreignRecord = JsonSerializer.Serialize(new
+        {
+            protocolVersion = 1,
+            operationId = foreignOperationId,
+            sequence = committed.LastSequence + 1,
+            state = "committed",
+            recordedAt = DateTimeOffset.UtcNow
+        });
+        await File.AppendAllTextAsync(journalPath, foreignRecord + "\n");
 
-        CodexSyncService service = new();
-        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
+        PendingTransactionInfo corrupted = Assert.Single(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+        Assert.True(corrupted.InvalidTail);
+        Assert.Equal("committed", corrupted.LastValidState);
+        await Assert.ThrowsAsync<RecoveryRequiredException>(
+            () => new CodexSyncService().RunSyncAsync(fixture.CodexHome));
 
-        Assert.True(status.SqliteCounts!.Unreadable);
-        Assert.Contains("malformed", TextFormatter.FormatStatus(status));
+        await new CodexSyncService().RunRestoreAsync(
+            fixture.CodexHome,
+            sync.BackupDir,
+            new RestoreBackupOptions
+            {
+                RestoreConfig = true,
+                RestoreDatabase = false,
+                RestoreSessions = true
+            });
+
+        Assert.Equal(before, await File.ReadAllTextAsync(sessionPath));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+        PendingTransactionInfo repaired = await FileTransactionJournal.ReadInfoAsync(journalPath);
+        Assert.True(repaired.Terminal);
+        Assert.Equal("rolledBack", repaired.State);
+        Assert.DoesNotContain(foreignOperationId, await File.ReadAllTextAsync(journalPath));
+        Assert.Single(Directory.EnumerateFiles(
+            sync.BackupDir,
+            "transaction-journal.invalid.*.jsonl",
+            SearchOption.TopDirectoryOnly));
     }
 
     [Fact]
-    public async Task RestoreBackup_CanSkipConfigDatabaseAndSessions()
+    public async Task ExplicitRestore_RepairsCompletelyUnreadableJournal_AndArchivesRawEvidence()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-skip.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-skip", "apigather");
-
-        SessionRolloutService sessionService = new();
-        SessionChangeCollection collected = await sessionService.CollectSessionChangesAsync(fixture.CodexHome, "openai");
-        BackupService backupService = new(sessionService, new SqliteStateService());
-        string backupDir = await backupService.CreateBackupAsync(
+        BackupService backups = new(new SessionRolloutService(), new SqliteStateService());
+        string backupDir = await backups.CreateBackupAsync(
             fixture.CodexHome,
             "openai",
-            collected.Changes,
+            [],
             Path.Combine(fixture.CodexHome, "config.toml"));
+        string journalPath = Path.Combine(backupDir, FileTransactionJournal.FileName);
+        const string corruptRaw = "this is not JSON\n";
+        await File.WriteAllTextAsync(journalPath, corruptRaw);
 
-        await fixture.WriteConfigAsync("model_provider = \"manual\"");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-skip", "manual");
-        await backupService.RestoreBackupAsync(
-            backupDir,
+        Assert.Single(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+        await new CodexSyncService().RunRestoreAsync(
             fixture.CodexHome,
+            backupDir,
             new RestoreBackupOptions
             {
-                RestoreConfig = false,
+                RestoreConfig = true,
                 RestoreDatabase = false,
                 RestoreSessions = false
             });
 
-        Assert.Contains("model_provider = \"manual\"", await File.ReadAllTextAsync(Path.Combine(fixture.CodexHome, "config.toml")));
-        Assert.Contains("\"model_provider\":\"manual\"", await File.ReadAllTextAsync(sessionPath));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+        PendingTransactionInfo repaired = await FileTransactionJournal.ReadInfoAsync(journalPath);
+        Assert.True(repaired.Terminal);
+        Assert.Equal("rolledBack", repaired.State);
+        string archivePath = Assert.Single(Directory.EnumerateFiles(
+            backupDir,
+            "transaction-journal.invalid.*.jsonl",
+            SearchOption.TopDirectoryOnly));
+        Assert.Equal(corruptRaw, await File.ReadAllTextAsync(archivePath));
     }
 
     [Fact]
-    public async Task RunSync_RewritesTurnContextModelField_LinesLargerThan64KB()
+    public async Task JournalMissingFinalLf_IsPending_AndCannotAppendUntilExplicitRestoreRepairsIt()
     {
-        // Regression guard for the long-line reader. Codex can pack a
-        // `developer_instructions` blob into a single `turn_context`
-        // payload, easily pushing the encoded JSON past 64 KB. The
-        // previous 64 KB scanner silently returned null for those
-        // files, so the rollout model rewrite was a no-op for
-        // sessions whose first turn was a long planning step.
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"MiniMax-M3\"\n");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-huge.jsonl");
-
-        await fixture.WriteRolloutWithTurnContextPayloadAsync(
-            sessionPath,
-            "thread-huge",
-            "apigather",
-            "gpt-5.4",
-            new Dictionary<string, object>
-            {
-                ["developer_instructions"] = new string('x', 150 * 1024)
-            });
-
-        string onDisk = await File.ReadAllTextAsync(sessionPath);
-        long longestLine = onDisk.Split('\n').Where(line => !string.IsNullOrEmpty(line)).Max(line => (long)line.Length);
-        Assert.True(longestLine > 64 * 1024, $"test setup: longest line should exceed 64 KB; got {longestLine}");
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        BackupService backups = new(new SessionRolloutService(), new SqliteStateService());
+        string backupDir = await backups.CreateBackupAsync(
+            fixture.CodexHome,
+            "openai",
+            [],
+            Path.Combine(fixture.CodexHome, "config.toml"));
+        FileTransactionJournal journal = await FileTransactionJournal.CreateAsync(
+            backupDir,
+            fixture.CodexHome,
+            "openai",
+            []);
+        string completeLineWithoutLf = (await File.ReadAllTextAsync(journal.FilePath)).TrimEnd('\n');
+        await File.WriteAllTextAsync(journal.FilePath, completeLineWithoutLf);
 
-        CodexSyncService service = new();
-        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
-        Assert.Equal(1, result.ChangedSessionFiles);
+        PendingTransactionInfo pending = Assert.Single(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+        Assert.True(pending.InvalidTail);
+        InvalidOperationException appendError = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => journal.CommittedAsync());
+        Assert.Contains("cannot commit", appendError.Message);
 
-        string rewritten = await File.ReadAllTextAsync(sessionPath);
-        int rewrittenCount = 0;
-        using (StringReader reader = new(rewritten))
-        {
-            string? line;
-            while ((line = reader.ReadLine()) is not null)
+        await new CodexSyncService().RunRestoreAsync(
+            fixture.CodexHome,
+            backupDir,
+            new RestoreBackupOptions
             {
-                if (!line.Contains("\"turn_context\"", StringComparison.Ordinal))
-                {
-                    continue;
-                }
-
-                using JsonDocument doc = JsonDocument.Parse(line);
-                Assert.Equal("MiniMax-M3", doc.RootElement.GetProperty("payload").GetProperty("model").GetString());
-                Assert.Equal("MiniMax-M3", doc.RootElement
-                    .GetProperty("payload")
-                    .GetProperty("collaboration_mode")
-                    .GetProperty("settings")
-                    .GetProperty("model")
-                    .GetString());
-                rewrittenCount += 1;
-            }
-        }
-
-        Assert.Equal(2, rewrittenCount);
+                RestoreConfig = true,
+                RestoreDatabase = false,
+                RestoreSessions = false
+            });
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+        Assert.EndsWith("\n", await File.ReadAllTextAsync(journal.FilePath));
+        Assert.Single(Directory.EnumerateFiles(
+            backupDir,
+            "transaction-journal.invalid.*.jsonl",
+            SearchOption.TopDirectoryOnly));
     }
 
     [Fact]
-    public async Task RunSync_RewritesTurnContextModelField_WithRegexMetacharactersInModelName()
+    public async Task RecoveryRequiredThenCommitted_CannotForgeTerminalJournal()
     {
-        // Regression guard for regex escaping in the per-turn
-        // rewrite. A model name containing '.', '+', '*', '?', or
-        // '(' is a regex hazard: '.' is a regex any-char, '+' is a
-        // quantifier, and an unbalanced '{' would refuse to compile.
-        // The rewrite must match literally and not poison a decoy
-        // sibling whose pattern over-matches.
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"weird(target)+v2\"\n");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-rewrite.jsonl");
-        await fixture.WriteRolloutWithTurnContextAsync(sessionPath, "thread-rewrite", "apigather", "weird(target)+v2");
-        await File.AppendAllTextAsync(sessionPath, JsonSerializer.Serialize(new
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        await fixture.WriteBackupAsync("20260804T000000000Z");
+        string backupDir = fixture.BackupPath("20260804T000000000Z");
+        FileTransactionJournal journal = await FileTransactionJournal.CreateAsync(
+            backupDir,
+            fixture.CodexHome,
+            "openai",
+            []);
+        IOException original = new("injected");
+        await journal.RollingBackAsync(original);
+        await journal.RecoveryRequiredAsync(original, ["rollback failed"]);
+        PendingTransactionInfo recovery = await FileTransactionJournal.ReadInfoAsync(journal.FilePath);
+        string forged = JsonSerializer.Serialize(new
         {
-            timestamp = "2026-06-09T09:16:03.881Z",
-            type = "turn_context",
-            payload = new
-            {
-                turn_id = "decoy",
-                model = "weirdAtargetAv2"
-            }
-        }) + "\n");
-
-        CodexSyncService service = new();
-        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
-        Assert.Equal(1, result.ChangedSessionFiles);
+            protocolVersion = 1,
+            operationId = recovery.OperationId,
+            sequence = recovery.LastSequence + 1,
+            state = "committed",
+            recordedAt = DateTimeOffset.UtcNow
+        });
+        await File.AppendAllTextAsync(journal.FilePath, forged + "\n");
 
-        string rewritten = await File.ReadAllTextAsync(sessionPath);
-        int totalContext = 0;
-        using (StringReader reader = new(rewritten))
-        {
-            string? line;
-            while ((line = reader.ReadLine()) is not null)
-            {
-                if (!line.Contains("\"turn_context\"", StringComparison.Ordinal))
-                {
-                    continue;
-                }
-                totalContext += 1;
-                using JsonDocument doc = JsonDocument.Parse(line);
-                string turnId = doc.RootElement.GetProperty("payload").GetProperty("turn_id").GetString()!;
-                string model = doc.RootElement.GetProperty("payload").GetProperty("model").GetString()!;
-                if (turnId == "decoy")
-                {
-                    Assert.Equal("weird(target)+v2", model);
-                }
-                else
-                {
-                    Assert.Equal("weird(target)+v2", model);
-                }
-            }
-        }
-        Assert.Equal(3, totalContext);
+        PendingTransactionInfo pending = Assert.Single(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+        Assert.True(pending.InvalidTail);
+        Assert.Equal("recoveryRequired", pending.State);
+        await Assert.ThrowsAsync<RecoveryRequiredException>(
+            () => FileTransactionJournal.AssertNoPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RunSync_RewritesModelOnlyChange_AndRestorePreservesOriginalFile()
+    public async Task Switch_ConfigCompensationFailure_PreservesStructuredRecoveryEvidence()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"\r\nmodel = \"MiniMax-M3\"\r\n");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-model-only.jsonl");
-        await fixture.WriteRolloutWithTurnContextAsync(
-            sessionPath,
-            "thread-model-only",
-            "openai",
-            "gpt-5.4");
-        string crlfContent = (await File.ReadAllTextAsync(sessionPath)).Replace("\n", "\r\n", StringComparison.Ordinal);
-        await File.WriteAllTextAsync(sessionPath, crlfContent);
-        DateTime originalTime = new(2026, 6, 9, 9, 0, 0, DateTimeKind.Utc);
-        File.SetLastWriteTimeUtc(sessionPath, originalTime);
-        await fixture.WriteStateDbAsync(
-        [
-            ("thread-model-only", "openai", false)
-        ],
-            model: "gpt-5.4");
-
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string configPath = Path.Combine(fixture.CodexHome, "config.toml");
+        string before = await File.ReadAllTextAsync(configPath);
         CodexSyncService service = new();
-        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
+        service.FaultInjector = (point, _, _) => point switch
+        {
+            "after_config_mutation_before_applied" => Task.FromException(new IOException("injected post-config failure")),
+            "before_config_rollback" => Task.FromException(new IOException("injected config compensation failure")),
+            _ => Task.CompletedTask
+        };
 
-        Assert.Equal(1, result.ChangedSessionFiles);
-        Assert.Equal(1, result.SqliteModelRowsUpdated);
-        byte[] syncedBytes = await File.ReadAllBytesAsync(sessionPath);
-        Assert.Contains((byte)'\r', syncedBytes);
-        Assert.EndsWith("\r\n", await File.ReadAllTextAsync(sessionPath), StringComparison.Ordinal);
-        Assert.Equal(originalTime, File.GetLastWriteTimeUtc(sessionPath));
+        SyncTransactionException error = await Assert.ThrowsAsync<SyncTransactionException>(
+            () => service.RunSwitchAsync(fixture.CodexHome, "apigather"));
 
-        await service.RunRestoreAsync(fixture.CodexHome, result.BackupDir);
+        Assert.True(error.RecoveryRequired);
+        Assert.Contains("injected post-config failure", error.OriginalError.Message);
+        Assert.Contains(error.RollbackErrors, failure =>
+            failure.Contains("config", StringComparison.Ordinal)
+            && failure.Contains("injected config compensation failure", StringComparison.Ordinal));
+        Assert.Contains("model_provider = \"apigather\"", await File.ReadAllTextAsync(configPath));
+        Assert.Single(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
 
-        Assert.Equal(crlfContent, await File.ReadAllTextAsync(sessionPath));
-        Assert.Equal(originalTime, File.GetLastWriteTimeUtc(sessionPath));
+        await new CodexSyncService().RunRestoreAsync(
+            fixture.CodexHome,
+            error.BackupDirectory,
+            new RestoreBackupOptions { RestoreDatabase = false });
+        Assert.Equal(before, await File.ReadAllTextAsync(configPath));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RunSync_DetectsStaleModelsAfterAnAlreadyMatchingFirstTurn()
+    public async Task Rollback_RemovesGlobalStateBackup_WhenItDidNotExistBeforeSync()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"target-model\"\n");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-mixed-models.jsonl");
-        await fixture.WriteRolloutWithTurnContextAsync(
-            sessionPath,
-            "thread-mixed-models",
-            "openai",
-            "target-model");
-        await File.AppendAllTextAsync(sessionPath, JsonSerializer.Serialize(new
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        await fixture.WriteStateDbWithCwdAsync([
+            ("thread-global-bak", "apigather", false, @"C:\AITemp")
+        ]);
+        string statePath = Path.Combine(fixture.CodexHome, AppConstants.GlobalStateFileBasename);
+        string stateBackupPath = Path.Combine(fixture.CodexHome, AppConstants.GlobalStateBackupFileBasename);
+        string originalState = JsonSerializer.Serialize(new Dictionary<string, object>
         {
-            timestamp = "2026-06-09T11:16:03.880Z",
-            type = "turn_context",
-            payload = new
-            {
-                turn_id = "stale-turn",
-                model = "stale-top-level",
-                collaboration_mode = new
-                {
-                    mode = "default",
-                    settings = new
-                    {
-                        model = "stale-nested"
-                    }
-                }
-            }
-        }) + "\n");
-
+            ["electron-saved-workspace-roots"] = new[] { @"\\?\C:\AITemp" },
+            ["project-order"] = new[] { @"\\?\C:\AITemp" },
+            ["active-workspace-roots"] = new[] { @"\\?\C:\AITemp" }
+        });
+        await File.WriteAllTextAsync(statePath, originalState);
+        Assert.False(File.Exists(stateBackupPath));
         CodexSyncService service = new();
-        SyncResult result = await service.RunSyncAsync(fixture.CodexHome);
+        service.FaultInjector = (point, path, _) =>
+            point == "after_global_state_apply"
+            && string.Equals(Path.GetFullPath(path!), Path.GetFullPath(stateBackupPath), StringComparison.OrdinalIgnoreCase)
+                ? Task.FromException(new IOException("injected after global-state backup write"))
+                : Task.CompletedTask;
+
+        SyncTransactionException error = await Assert.ThrowsAsync<SyncTransactionException>(
+            () => service.RunSyncAsync(fixture.CodexHome));
+
+        Assert.False(error.RecoveryRequired);
+        Assert.Equal(originalState, await File.ReadAllTextAsync(statePath));
+        Assert.False(File.Exists(stateBackupPath));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+    }
 
-        Assert.Equal(1, result.ChangedSessionFiles);
-        foreach (string line in (await File.ReadAllLinesAsync(sessionPath))
-            .Where(line => line.Contains("\"turn_context\"", StringComparison.Ordinal)))
-        {
-            using JsonDocument document = JsonDocument.Parse(line);
-            JsonElement payload = document.RootElement.GetProperty("payload");
-            Assert.Equal("target-model", payload.GetProperty("model").GetString());
-            Assert.Equal(
-                "target-model",
-                payload.GetProperty("collaboration_mode").GetProperty("settings").GetProperty("model").GetString());
-        }
+    [Fact]
+    public async Task RestoreGlobalState_DeclaredOriginalMissingFromBackup_IsFailure()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        await fixture.WriteGlobalStateAsync(new { project_order = Array.Empty<string>() });
+        BackupService backups = new(new SessionRolloutService(), new SqliteStateService());
+        string backupDir = await backups.CreateBackupAsync(
+            fixture.CodexHome,
+            "openai",
+            [],
+            Path.Combine(fixture.CodexHome, "config.toml"));
+        File.Delete(Path.Combine(backupDir, AppConstants.GlobalStateBackupFileBasename));
 
-        await service.RunRestoreAsync(
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => backups.RestoreGlobalStateFilesAsync(backupDir, fixture.CodexHome));
+        Assert.Contains("declares an original file", error.Message);
+    }
+
+    [Fact]
+    public async Task AtomicManifestUpdateFailure_PreservesPreviousManifestAndMetadata()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-atomic-manifest.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-atomic-manifest", "apigather");
+        SessionRolloutService rollouts = new();
+        SessionChangeCollection changes = await rollouts.CollectSessionChangesAsync(fixture.CodexHome, "openai");
+        BackupService backups = new(rollouts, new SqliteStateService());
+        string backupDir = await backups.CreateBackupAsync(
             fixture.CodexHome,
-            result.BackupDir,
-            new RestoreBackupOptions { RestoreDatabase = false });
-        string restoredStaleLine = (await File.ReadAllLinesAsync(sessionPath))
-            .Single(line => line.Contains("\"stale-turn\"", StringComparison.Ordinal));
-        using JsonDocument restoredDocument = JsonDocument.Parse(restoredStaleLine);
-        JsonElement restoredPayload = restoredDocument.RootElement.GetProperty("payload");
-        Assert.Equal("stale-top-level", restoredPayload.GetProperty("model").GetString());
-        Assert.Equal(
-            "stale-nested",
-            restoredPayload.GetProperty("collaboration_mode").GetProperty("settings").GetProperty("model").GetString());
+            "openai",
+            changes.Changes,
+            Path.Combine(fixture.CodexHome, "config.toml"));
+        string manifestPath = Path.Combine(backupDir, "session-meta-backup.json");
+        string metadataPath = Path.Combine(backupDir, "metadata.json");
+        string manifestBefore = await File.ReadAllTextAsync(manifestPath);
+        string metadataBefore = await File.ReadAllTextAsync(metadataPath);
+        backups.AtomicWriteFaultInjector = (point, targetPath, _) =>
+            point == "before_atomic_replace"
+            && string.Equals(targetPath, Path.GetFullPath(manifestPath), StringComparison.OrdinalIgnoreCase)
+                ? Task.FromException(new IOException("injected manifest replace failure"))
+                : Task.CompletedTask;
+
+        await Assert.ThrowsAsync<IOException>(() => backups.UpdateSessionBackupManifestAsync(backupDir, []));
+
+        Assert.Equal(manifestBefore, await File.ReadAllTextAsync(manifestPath));
+        Assert.Equal(metadataBefore, await File.ReadAllTextAsync(metadataPath));
+        Assert.Empty(Directory.EnumerateFiles(backupDir, "*.tmp", SearchOption.TopDirectoryOnly));
     }
 
     [Fact]
-    public async Task RestoreBackup_AcceptsVersionOneSessionManifest()
+    public async Task Restore_RejectsSessionManifestPathOutsideCodexHome()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string sessionPath = fixture.RolloutPath("sessions", "rollout-legacy-manifest.jsonl");
-        await fixture.WriteRolloutAsync(sessionPath, "thread-legacy-manifest", "apigather");
-        string originalFirstLine = (await File.ReadAllLinesAsync(sessionPath))[0];
-        await fixture.WriteRolloutAsync(sessionPath, "thread-legacy-manifest", "openai");
-
-        string sessionManifest = JsonSerializer.Serialize(new
+        SessionRolloutService rollouts = new();
+        BackupService backups = new(rollouts, new SqliteStateService());
+        string backupDir = await backups.CreateBackupAsync(
+            fixture.CodexHome,
+            "openai",
+            [],
+            Path.Combine(fixture.CodexHome, "config.toml"));
+        string outsidePath = Path.Combine(fixture.Root, "rollout-outside.jsonl");
+        await File.WriteAllTextAsync(outsidePath, "outside must remain unchanged\n");
+        string outsideBefore = await File.ReadAllTextAsync(outsidePath);
+        string maliciousManifest = JsonSerializer.Serialize(new
         {
-            version = 1,
+            version = 2,
             @namespace = AppConstants.BackupNamespace,
             codexHome = fixture.CodexHome,
             targetProvider = "openai",
@@ -1542,258 +3104,271 @@ public async Task RestoreBackup_AcceptsVersionOneSessionManifest()
             {
                 new
                 {
-                    path = sessionPath,
-                    originalFirstLine,
-                    originalSeparator = "\n"
+                    path = outsidePath,
+                    originalFirstLine = "attacker controlled",
+                    originalSeparator = "\n",
+                    originalLastWriteTimeUtcTicks = (long?)null,
+                    modelOnlyChange = false,
+                    originalTurnContextModels = Array.Empty<object>()
                 }
             }
         });
-        await fixture.WriteBackupAsync(
-            "20260723T000000000Z",
-            ("session-meta-backup.json", sessionManifest),
-            ("config.toml", await File.ReadAllTextAsync(Path.Combine(fixture.CodexHome, "config.toml"))));
+        await AtomicFile.WriteAllTextAsync(
+            Path.Combine(backupDir, "session-meta-backup.json"),
+            maliciousManifest);
 
-        CodexSyncService service = new();
-        await service.RunRestoreAsync(
-            fixture.CodexHome,
-            fixture.BackupPath("20260723T000000000Z"),
-            new RestoreBackupOptions { RestoreDatabase = false });
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => backups.RestoreBackupAsync(
+                backupDir,
+                fixture.CodexHome,
+                new RestoreBackupOptions
+                {
+                    RestoreConfig = false,
+                    RestoreDatabase = false,
+                    RestoreSessions = true
+                }));
 
-        Assert.Equal(originalFirstLine, (await File.ReadAllLinesAsync(sessionPath))[0]);
+        Assert.Contains("escapes the Codex rollout directories", error.Message);
+        Assert.Equal(outsideBefore, await File.ReadAllTextAsync(outsidePath));
     }
 
     [Fact]
-    public async Task RunSync_UsesExplicitSqliteHomeWithoutTouchingDefaultDatabase()
+    public async Task TruncatedMetadata_WithPendingJournal_BlocksWritesAndPreservesRecoveryEvidence()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        await fixture.WriteStateDbAsync([("default-thread", "default-provider", false)]);
-        string sqliteHome = Path.Combine(fixture.Root, "external-sqlite");
-        string externalDbPath = Path.Combine(sqliteHome, AppConstants.DbFileBasename);
-        await fixture.WriteStateDbAtAsync(
-            externalDbPath,
-            [("external-thread", "custom", false)],
-            model: "old-model");
-
-        CodexSyncService service = new();
-        SyncResult result = await service.RunSyncAsync(
+        BackupService backups = new(new SessionRolloutService(), new SqliteStateService());
+        string backupDir = await backups.CreateBackupAsync(
             fixture.CodexHome,
-            model: "new-model",
-            explicitSqliteHome: sqliteHome);
-
-        Assert.Equal(Path.GetFullPath(sqliteHome), result.SqliteHome);
-        Assert.Equal("gui", result.SqliteHomeSource);
-        Assert.Equal("openai", await ReadProviderAsync(externalDbPath, "external-thread"));
-        Assert.Equal("default-provider", await ReadProviderAsync(fixture.StateDbPath(), "default-thread"));
-
-        BackupMetadataFile metadata = JsonSerializer.Deserialize<BackupMetadataFile>(
-            await File.ReadAllTextAsync(Path.Combine(result.BackupDir, "metadata.json")),
-            new JsonSerializerOptions { PropertyNamingPolicy = JsonNamingPolicy.CamelCase })!;
-        Assert.Equal(2, metadata.Version);
-        Assert.Equal(Path.GetFullPath(sqliteHome), metadata.SqliteHome);
-        Assert.Empty(metadata.DbFiles);
-        Assert.Equal([AppConstants.DbFileBasename], metadata.SqliteDbFiles);
-    }
-
-    [Fact]
-    public async Task ConfiguredSqliteHomeWithoutDatabase_IsDiagnosticForStatusButBlocksSync()
-    {
-        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        string sqliteHome = Path.Combine(fixture.Root, "missing-sqlite");
-        await fixture.WriteConfigAsync($"model_provider = \"openai\"\nsqlite_home = '{sqliteHome}'");
-        await fixture.WriteStateDbAsync([("stale-thread", "custom", false)]);
-
-        CodexSyncService service = new();
-        StatusSnapshot status = await service.GetStatusAsync(fixture.CodexHome);
+            "openai",
+            [],
+            Path.Combine(fixture.CodexHome, "config.toml"));
+        await FileTransactionJournal.CreateAsync(
+            backupDir,
+            fixture.CodexHome,
+            "openai",
+            []);
+        await File.WriteAllTextAsync(Path.Combine(backupDir, "metadata.json"), "{\"version\":2");
 
-        Assert.Equal(Path.GetFullPath(sqliteHome), status.SqliteHome);
-        Assert.Equal("config", status.SqliteHomeSource);
-        Assert.Null(status.StateDbLocation);
-        Assert.Single(status.CheckedStateDbPaths);
-        await Assert.ThrowsAsync<InvalidOperationException>(() => service.RunSyncAsync(fixture.CodexHome));
-        Assert.Equal("custom", await ReadProviderAsync(fixture.StateDbPath(), "stale-thread"));
+        Assert.Single(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+        await Assert.ThrowsAnyAsync<JsonException>(() => new CodexSyncService().RunRestoreAsync(
+            fixture.CodexHome,
+            backupDir,
+            new RestoreBackupOptions
+            {
+                RestoreConfig = false,
+                RestoreDatabase = false,
+                RestoreSessions = false
+            }));
+        Assert.Single(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+        await Assert.ThrowsAsync<RecoveryRequiredException>(
+            () => new CodexSyncService().RunSyncAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RestoreVersionTwo_RebuildsMissingDefaultSqliteDatabase()
+    public async Task PendingTransaction_PartialRestoreCannotUnlockUnrestoredSqlite()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        await fixture.WriteStateDbAsync([("thread-missing-default", "custom", false)]);
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-partial-recovery.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-partial-recovery", "apigather");
+        await fixture.WriteStateDbAsync([("thread-partial-recovery", "apigather", false)]);
+        string sessionBefore = await File.ReadAllTextAsync(sessionPath);
+        SessionRolloutService rollouts = new();
+        SqliteStateService sqlite = new();
+        SessionChangeCollection changes = await rollouts.CollectSessionChangesAsync(fixture.CodexHome, "openai");
+        BackupService backups = new(rollouts, sqlite);
+        string backupDir = await backups.CreateBackupAsync(
+            fixture.CodexHome,
+            "openai",
+            changes.Changes,
+            Path.Combine(fixture.CodexHome, "config.toml"));
+        FileTransactionJournal journal = await FileTransactionJournal.CreateAsync(
+            backupDir,
+            fixture.CodexHome,
+            "openai",
+            [sessionPath, fixture.StateDbPath()]);
+        await journal.ApplyingAsync("rollout", sessionPath);
+        await rollouts.ApplySessionChangesAsync(changes.Changes);
+        await journal.AppliedAsync("rollout", sessionPath);
+        await journal.ApplyingAsync("sqlite", fixture.StateDbPath());
+        await sqlite.UpdateSqliteProviderAsync(fixture.CodexHome, "openai");
+        await journal.AppliedAsync("sqlite", fixture.StateDbPath());
 
         CodexSyncService service = new();
-        SyncResult syncResult = await service.RunSyncAsync(fixture.CodexHome);
-        File.Delete(fixture.StateDbPath());
+        InvalidOperationException partialError = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => service.RunRestoreAsync(
+                fixture.CodexHome,
+                backupDir,
+                new RestoreBackupOptions
+                {
+                    RestoreConfig = false,
+                    RestoreDatabase = false,
+                    RestoreSessions = true
+                }));
+
+        Assert.Contains("partial restore", partialError.Message);
+        Assert.Contains("SQLite", partialError.Message);
+        Assert.NotEqual(sessionBefore, await File.ReadAllTextAsync(sessionPath));
+        Assert.Equal("openai", await ReadProviderAsync(fixture.StateDbPath(), "thread-partial-recovery"));
+        Assert.Single(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
 
         await service.RunRestoreAsync(
             fixture.CodexHome,
-            syncResult.BackupDir,
+            backupDir,
             new RestoreBackupOptions
             {
                 RestoreConfig = false,
                 RestoreDatabase = true,
-                RestoreSessions = false
+                RestoreSessions = true
             });
-
-        Assert.Equal("custom", await ReadProviderAsync(fixture.StateDbPath(), "thread-missing-default"));
+        Assert.Equal(sessionBefore, await File.ReadAllTextAsync(sessionPath));
+        Assert.Equal("apigather", await ReadProviderAsync(fixture.StateDbPath(), "thread-partial-recovery"));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RestoreVersionTwo_RebuildsMissingLegacyRootSqliteDatabaseInPlace()
+    public async Task Journal_InvalidTargetKind_CannotBecomeTerminal()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        await fixture.WriteLegacyStateDbAsync([("thread-missing-legacy", "custom", false)]);
-
-        CodexSyncService service = new();
-        SyncResult syncResult = await service.RunSyncAsync(fixture.CodexHome);
-        File.Delete(fixture.LegacyStateDbPath());
-
-        await service.RunRestoreAsync(
+        await fixture.WriteBackupAsync("20260804T010000000Z");
+        string backupDir = fixture.BackupPath("20260804T010000000Z");
+        string targetPath = Path.Combine(fixture.CodexHome, "config.toml");
+        FileTransactionJournal journal = await FileTransactionJournal.CreateAsync(
+            backupDir,
             fixture.CodexHome,
-            syncResult.BackupDir,
-            new RestoreBackupOptions
-            {
-                RestoreConfig = false,
-                RestoreDatabase = true,
-                RestoreSessions = false
-            });
+            "openai",
+            [targetPath]);
+        PendingTransactionInfo prepared = await FileTransactionJournal.ReadInfoAsync(journal.FilePath);
+        string invalidKind = JsonSerializer.Serialize(new
+        {
+            protocolVersion = 1,
+            operationId = prepared.OperationId,
+            sequence = prepared.LastSequence + 1,
+            state = "applying",
+            kind = "arbitraryFile",
+            targetPath,
+            recordedAt = DateTimeOffset.UtcNow
+        });
+        await File.AppendAllTextAsync(journal.FilePath, invalidKind + "\n");
 
-        Assert.False(File.Exists(fixture.StateDbPath()));
-        Assert.Equal("custom", await ReadProviderAsync(fixture.LegacyStateDbPath(), "thread-missing-legacy"));
+        PendingTransactionInfo pending = Assert.Single(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+        Assert.True(pending.InvalidTail);
+        Assert.Empty(pending.AffectedTargets);
+        await Assert.ThrowsAsync<RecoveryRequiredException>(
+            () => FileTransactionJournal.AssertNoPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RestoreVersionOne_RebuildsMissingDefaultSqliteDatabase()
+    public async Task AbruptChildProcessExit_AfterRolloutMutation_BlocksWritesUntilExplicitRestore()
     {
         TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
         await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string backupDir = fixture.BackupPath("20260728T010000000Z");
-        string relativeDbPath = Path.Combine(AppConstants.SqliteDirBasename, AppConstants.DbFileBasename);
-        string backupDbPath = Path.Combine(backupDir, "db", relativeDbPath);
-        await fixture.WriteStateDbAtAsync(
-            backupDbPath,
-            [("thread-v1-missing", "custom", false)],
-            model: null);
-        string metadata = JsonSerializer.Serialize(new
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-real-process-crash.jsonl");
+        await fixture.WriteRolloutAsync(sessionPath, "thread-real-process-crash", "apigather");
+        string before = await File.ReadAllTextAsync(sessionPath);
+        string configuration = new DirectoryInfo(AppContext.BaseDirectory).Parent?.Name ?? "Debug";
+        string testProjectDirectory = Path.GetFullPath(Path.Combine(AppContext.BaseDirectory, "..", "..", ".."));
+        string crashHostPath = Path.Combine(
+            testProjectDirectory,
+            "CrashHost",
+            "bin",
+            configuration,
+            "net10.0",
+            "CodexProviderSync.CrashHost.dll");
+        Assert.True(File.Exists(crashHostPath), $"Crash host was not built: {crashHostPath}");
+        string dotnetHost = Environment.GetEnvironmentVariable("DOTNET_HOST_PATH") ?? "dotnet";
+        ProcessStartInfo startInfo = new(dotnetHost)
         {
-            version = 1,
-            @namespace = AppConstants.BackupNamespace,
-            codexHome = fixture.CodexHome,
-            targetProvider = "custom",
-            createdAt = DateTimeOffset.UtcNow,
-            dbFiles = new[] { relativeDbPath },
-            changedSessionFiles = 0
-        });
-        await File.WriteAllTextAsync(Path.Combine(backupDir, "metadata.json"), metadata);
+            UseShellExecute = false,
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            CreateNoWindow = true
+        };
+        startInfo.ArgumentList.Add(crashHostPath);
+        startInfo.ArgumentList.Add(fixture.CodexHome);
+        using Process child = Process.Start(startInfo)
+            ?? throw new InvalidOperationException("Failed to start the crash-test child process.");
+        using CancellationTokenSource timeout = new(TimeSpan.FromSeconds(20));
+        try
+        {
+            await child.WaitForExitAsync(timeout.Token);
+        }
+        catch
+        {
+            if (!child.HasExited)
+            {
+                child.Kill(entireProcessTree: true);
+            }
+            throw;
+        }
 
-        CodexSyncService service = new();
-        await service.RunRestoreAsync(
+        Assert.NotEqual(0, child.ExitCode);
+        Assert.NotEqual(before, await File.ReadAllTextAsync(sessionPath));
+        PendingTransactionInfo pending = Assert.Single(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+        Assert.Contains(pending.AffectedTargets, target =>
+            target.Kind == "rollout"
+            && string.Equals(Path.GetFullPath(target.TargetPath), Path.GetFullPath(sessionPath), StringComparison.OrdinalIgnoreCase)
+            && target.State == "applying");
+        await Assert.ThrowsAsync<RecoveryRequiredException>(
+            () => new CodexSyncService().RunSyncAsync(fixture.CodexHome));
+
+        await new CodexSyncService().RunRestoreAsync(
             fixture.CodexHome,
-            backupDir,
+            pending.BackupDir,
             new RestoreBackupOptions
             {
                 RestoreConfig = false,
-                RestoreDatabase = true,
-                RestoreSessions = false
+                RestoreDatabase = false,
+                RestoreSessions = true
             });
-
-        Assert.Equal("custom", await ReadProviderAsync(fixture.StateDbPath(), "thread-v1-missing"));
+        Assert.Equal(before, await File.ReadAllTextAsync(sessionPath));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
     }
 
     [Fact]
-    public async Task RestoreVersionTwo_RequiresExplicitRelocationConfirmation()
+    public async Task AtomicFile_PreservesUnixOwnerOnlyModeOnReplace()
     {
-        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"openai\"");
-        string sourceSqliteHome = Path.Combine(fixture.Root, "source-sqlite");
-        string sourceDbPath = Path.Combine(sourceSqliteHome, AppConstants.DbFileBasename);
-        await fixture.WriteStateDbAtAsync(sourceDbPath, [("thread-a", "custom", false)], model: null);
-
-        CodexSyncService service = new();
-        SyncResult syncResult = await service.RunSyncAsync(
-            fixture.CodexHome,
-            explicitSqliteHome: sourceSqliteHome);
-
-        string targetSqliteHome = Path.Combine(fixture.Root, "target-sqlite");
-        string targetDbPath = Path.Combine(targetSqliteHome, AppConstants.DbFileBasename);
-        await fixture.WriteStateDbAtAsync(targetDbPath, [("thread-a", "target", false)], model: null);
-        RestoreBackupOptions deniedOptions = new()
+        if (OperatingSystem.IsWindows())
         {
-            RestoreConfig = false,
-            RestoreDatabase = true,
-            RestoreSessions = false
-        };
+            return;
+        }
 
-        await Assert.ThrowsAsync<InvalidOperationException>(() => service.RunRestoreAsync(
-            fixture.CodexHome,
-            syncResult.BackupDir,
-            deniedOptions,
-            targetSqliteHome));
-        Assert.Equal("target", await ReadProviderAsync(targetDbPath, "thread-a"));
+        string directory = Path.Combine(Path.GetTempPath(), $"codex-provider-mode-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(directory);
+        string path = Path.Combine(directory, "sensitive.json");
+        await File.WriteAllTextAsync(path, "before");
+        UnixFileMode ownerOnly = UnixFileMode.UserRead | UnixFileMode.UserWrite;
+        File.SetUnixFileMode(path, ownerOnly);
 
-        InvalidOperationException configError = await Assert.ThrowsAsync<InvalidOperationException>(
-            () => service.RunRestoreAsync(
-                fixture.CodexHome,
-                syncResult.BackupDir,
-                new RestoreBackupOptions
-                {
-                    RestoreConfig = true,
-                    RestoreDatabase = true,
-                    RestoreSessions = false,
-                    AllowSqliteHomeRelocation = true
-                },
-                targetSqliteHome));
-        Assert.Contains("Cannot restore config.toml while relocating SQLite home", configError.Message);
-        Assert.Equal("target", await ReadProviderAsync(targetDbPath, "thread-a"));
+        await AtomicFile.WriteAllTextAsync(path, "after");
 
-        await service.RunRestoreAsync(
-            fixture.CodexHome,
-            syncResult.BackupDir,
-            new RestoreBackupOptions
-            {
-                RestoreConfig = false,
-                RestoreDatabase = true,
-                RestoreSessions = false,
-                AllowSqliteHomeRelocation = true
-            },
-            targetSqliteHome);
-        Assert.Equal("custom", await ReadProviderAsync(targetDbPath, "thread-a"));
+        Assert.Equal(ownerOnly, File.GetUnixFileMode(path));
     }
 
     [Fact]
-    public async Task RestoreVersionTwo_ValidatesDatabaseFilesBeforeRestoringConfig()
+    public async Task RunSync_PreservesUnixOwnerOnlyModeOnRolloutReplace()
     {
-        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
-        await fixture.WriteConfigAsync("model_provider = \"current\"");
-        await fixture.WriteStateDbAsync([("thread-a", "current", false)]);
-        string backupDir = fixture.BackupPath("20260728T000000000Z");
-        string metadata = JsonSerializer.Serialize(new
+        if (OperatingSystem.IsWindows())
         {
-            version = 2,
-            @namespace = AppConstants.BackupNamespace,
-            codexHome = fixture.CodexHome,
-            sqliteHome = Path.GetDirectoryName(fixture.StateDbPath()),
-            targetProvider = "backup",
-            createdAt = DateTimeOffset.UtcNow,
-            dbFiles = Array.Empty<string>(),
-            sqliteDbFiles = new[] { AppConstants.DbFileBasename },
-            changedSessionFiles = 0
-        });
-        await fixture.WriteBackupAsync(
-            "20260728T000000000Z",
-            ("metadata.json", metadata),
-            ("config.toml", "model_provider = \"backup\"\n"));
+            return;
+        }
 
-        CodexSyncService service = new();
-        await Assert.ThrowsAsync<InvalidOperationException>(() => service.RunRestoreAsync(
-            fixture.CodexHome,
-            backupDir,
-            new RestoreBackupOptions { RestoreSessions = false }));
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"\nmodel = \"target-model\"");
+        string sessionPath = fixture.RolloutPath("sessions", "rollout-mode-0600.jsonl");
+        await fixture.WriteRolloutWithTurnContextAsync(
+            sessionPath,
+            "thread-mode-0600",
+            "apigather",
+            "old-model");
+        UnixFileMode ownerOnly = UnixFileMode.UserRead | UnixFileMode.UserWrite;
+        File.SetUnixFileMode(sessionPath, ownerOnly);
 
-        Assert.Contains(
-            "model_provider = \"current\"",
-            await File.ReadAllTextAsync(Path.Combine(fixture.CodexHome, "config.toml")));
+        await new CodexSyncService().RunSyncAsync(fixture.CodexHome);
+
+        Assert.Equal(ownerOnly, File.GetUnixFileMode(sessionPath));
     }
 
     private static async Task<string> ReadProviderAsync(string dbPath, string threadId)
@@ -1811,4 +3386,26 @@ private static async Task<string> ReadProviderAsync(string dbPath, string thread
         command.Parameters.AddWithValue("$id", threadId);
         return Convert.ToString(await command.ExecuteScalarAsync())!;
     }
+
+    private static string RelativeTargetIdentity(string codexHome, string targetPath)
+    {
+        string relative = Path.GetRelativePath(
+                Path.GetFullPath(codexHome),
+                Path.GetFullPath(targetPath))
+            .Replace('\\', '/');
+        if (relative != ".." && !relative.StartsWith("../", StringComparison.Ordinal))
+        {
+            return relative;
+        }
+
+        // macOS temp roots can be exposed through both /var and
+        // /private/var. Preserve the complete logical path within the test
+        // Codex Home if the two absolute spellings cross that symlink alias.
+        string normalizedTarget = Path.GetFullPath(targetPath).Replace('\\', '/');
+        string homeMarker = $"/{Path.GetFileName(Path.TrimEndingDirectorySeparator(codexHome))}/";
+        int markerIndex = normalizedTarget.LastIndexOf(homeMarker, StringComparison.Ordinal);
+        return markerIndex >= 0
+            ? normalizedTarget[(markerIndex + homeMarker.Length)..]
+            : relative;
+    }
 }
diff --git a/desktop/CodexProviderSync.Core.Tests/CoreWritePlanningTests.cs b/desktop/CodexProviderSync.Core.Tests/CoreWritePlanningTests.cs
new file mode 100644
index 0000000..16c48d4
--- /dev/null
+++ b/desktop/CodexProviderSync.Core.Tests/CoreWritePlanningTests.cs
@@ -0,0 +1,617 @@
+using System.Security.Cryptography;
+using Microsoft.Data.Sqlite;
+
+namespace CodexProviderSync.Core.Tests;
+
+public sealed class CoreWritePlanningTests
+{
+    [Fact]
+    public async Task CheckedSync_RejectsDriftBeforeBackupOrMutation()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-plan-drift.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-plan-drift", "relay");
+        await fixture.WriteStateDbAsync([("thread-plan-drift", "relay", false)]);
+
+        CodexSyncService service = new();
+        CoreWritePlanSnapshot plan = await service.CreateSyncPlanSnapshotAsync(
+            fixture.CodexHome,
+            provider: "openai");
+        await File.AppendAllTextAsync(rolloutPath, "{\"type\":\"event_msg\",\"payload\":{}}\n");
+        string drifted = await File.ReadAllTextAsync(rolloutPath);
+
+        await Assert.ThrowsAsync<CoreWritePlanStaleException>(() =>
+            service.RunSyncCheckedAsync(
+                plan,
+                fixture.CodexHome,
+                provider: "openai"));
+
+        Assert.Equal(drifted, await File.ReadAllTextAsync(rolloutPath));
+        Assert.False(Directory.Exists(fixture.BackupRoot()));
+        Assert.Empty(await FileTransactionJournal.FindPendingAsync(fixture.CodexHome));
+    }
+
+    [Fact]
+    public async Task CheckedSync_ExecutesTheExistingCoreWorkflowForAnExactSnapshot()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-plan-exact.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-plan-exact", "relay");
+        await fixture.WriteStateDbAsync([("thread-plan-exact", "relay", false)]);
+
+        CodexSyncService service = new();
+        CoreWritePlanSnapshot plan = await service.CreateSyncPlanSnapshotAsync(
+            fixture.CodexHome,
+            provider: "openai");
+
+        SyncResult result = await service.RunSyncCheckedAsync(
+            plan,
+            fixture.CodexHome,
+            provider: "openai");
+
+        Assert.Equal("openai", result.TargetProvider);
+        Assert.Equal(1, result.ChangedSessionFiles);
+        Assert.True(Directory.Exists(result.BackupDir));
+        Assert.Contains("\"model_provider\":\"openai\"", await File.ReadAllTextAsync(rolloutPath));
+    }
+
+    [Fact]
+    public async Task SyncAndSwitchPlans_ListExactAutomaticDeletionTargets()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-auto-prune-plan.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-auto-prune-plan", "relay");
+        await fixture.WriteStateDbAsync([("thread-auto-prune-plan", "relay", false)]);
+        await fixture.WriteBackupAsync("20260801T000000000Z");
+        await fixture.WriteBackupAsync("20260802T000000000Z");
+        string futureManaged = fixture.BackupPath("99991231T235959999Z");
+        await fixture.WriteBackupAsync("99991231T235959999Z");
+        string unmanaged = fixture.BackupPath("manual-sentinel");
+        Directory.CreateDirectory(unmanaged);
+        await File.WriteAllTextAsync(Path.Combine(unmanaged, "keep.txt"), "sentinel");
+
+        CodexSyncService service = new();
+        CoreWritePlanSnapshot syncPlan = await service.CreateSyncPlanSnapshotAsync(
+            fixture.CodexHome,
+            provider: "openai",
+            keepCount: 1);
+        CoreWritePlanSnapshot switchPlan = await service.CreateSwitchPlanSnapshotAsync(
+            fixture.CodexHome,
+            "apigather",
+            keepCount: 1);
+
+        string[] expected =
+        [
+            fixture.BackupPath("20260801T000000000Z"),
+            fixture.BackupPath("20260802T000000000Z"),
+            futureManaged
+        ];
+        AssertAutomaticDeletionTargets(syncPlan, expected);
+        AssertAutomaticDeletionTargets(switchPlan, expected);
+        Assert.True(Directory.Exists(unmanaged));
+    }
+
+    [Fact]
+    public async Task CheckedSync_AutomaticPruneDeletesOnlyPlannedTargetsAndPreservesNewBackup()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-auto-prune-apply.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-auto-prune-apply", "relay");
+        await fixture.WriteStateDbAsync([("thread-auto-prune-apply", "relay", false)]);
+        await fixture.WriteBackupAsync("20260801T000000000Z");
+        await fixture.WriteBackupAsync("20260802T000000000Z");
+        await fixture.WriteBackupAsync("99991231T235959999Z");
+        string unmanaged = fixture.BackupPath("manual-sentinel");
+        Directory.CreateDirectory(unmanaged);
+        await File.WriteAllTextAsync(Path.Combine(unmanaged, "keep.txt"), "sentinel");
+
+        CodexSyncService service = new();
+        CoreWritePlanSnapshot plan = await service.CreateSyncPlanSnapshotAsync(
+            fixture.CodexHome,
+            provider: "openai",
+            keepCount: 1);
+        string[] plannedDeletes = plan.AutoPruneDeletionTargets.Select(static target => target.Path).ToArray();
+
+        SyncResult result = await service.RunSyncCheckedAsync(
+            plan,
+            fixture.CodexHome,
+            provider: "openai",
+            keepCount: 1);
+
+        Assert.NotNull(result.AutoPruneResult);
+        Assert.Equal(plannedDeletes.Length, result.AutoPruneResult!.DeletedCount);
+        Assert.All(plannedDeletes, path => Assert.False(Directory.Exists(path)));
+        Assert.True(Directory.Exists(result.BackupDir));
+        Assert.True(Directory.Exists(unmanaged));
+    }
+
+    [Fact]
+    public async Task CheckedSync_AutomaticPruneWithKeepTwoPreservesFutureDatedAndNewBackups()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-auto-prune-keep-two.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-auto-prune-keep-two", "relay");
+        await fixture.WriteStateDbAsync([("thread-auto-prune-keep-two", "relay", false)]);
+        string oldOne = fixture.BackupPath("20260801T000000000Z");
+        string oldTwo = fixture.BackupPath("20260802T000000000Z");
+        string future = fixture.BackupPath("99991231T235959999Z");
+        await fixture.WriteBackupAsync("20260801T000000000Z");
+        await fixture.WriteBackupAsync("20260802T000000000Z");
+        await fixture.WriteBackupAsync("99991231T235959999Z");
+
+        CodexSyncService service = new();
+        CoreWritePlanSnapshot plan = await service.CreateSyncPlanSnapshotAsync(
+            fixture.CodexHome,
+            provider: "openai",
+            keepCount: 2);
+        SyncResult result = await service.RunSyncCheckedAsync(
+            plan,
+            fixture.CodexHome,
+            provider: "openai",
+            keepCount: 2);
+
+        AssertAutomaticDeletionTargets(plan, [oldOne, oldTwo]);
+        Assert.False(Directory.Exists(oldOne));
+        Assert.False(Directory.Exists(oldTwo));
+        Assert.True(Directory.Exists(future));
+        Assert.True(Directory.Exists(result.BackupDir));
+        Assert.Equal(2, Directory.EnumerateDirectories(fixture.BackupRoot())
+            .Count(directory => File.Exists(Path.Combine(directory, "metadata.json"))));
+    }
+
+    [Fact]
+    public async Task CheckedSync_AutomaticPruneSkipsWholeBatchWhenPlannedBackupFingerprintChangesAfterCommit()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-auto-prune-fingerprint-drift.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-auto-prune-fingerprint-drift", "relay");
+        await fixture.WriteStateDbAsync([("thread-auto-prune-fingerprint-drift", "relay", false)]);
+        await fixture.WriteBackupAsync("20260801T000000000Z", ("note.txt", "original"));
+        await fixture.WriteBackupAsync("20260802T000000000Z");
+
+        CodexSyncService service = new();
+        CoreWritePlanSnapshot plan = await service.CreateSyncPlanSnapshotAsync(
+            fixture.CodexHome,
+            provider: "openai",
+            keepCount: 1);
+        string changedBackup = plan.AutoPruneDeletionTargets[0].Path;
+        service.FaultInjector = async (point, _, _) =>
+        {
+            if (point == "after_transaction_commit")
+            {
+                await File.AppendAllTextAsync(Path.Combine(changedBackup, "note.txt"), "-changed");
+            }
+        };
+
+        SyncResult result = await service.RunSyncCheckedAsync(
+            plan,
+            fixture.CodexHome,
+            provider: "openai",
+            keepCount: 1);
+
+        Assert.Null(result.AutoPruneResult);
+        Assert.False(string.IsNullOrWhiteSpace(result.AutoPruneWarning));
+        Assert.All(plan.AutoPruneDeletionTargets, target => Assert.True(Directory.Exists(target.Path)));
+        Assert.True(Directory.Exists(result.BackupDir));
+    }
+
+    [Fact]
+    public async Task CheckedSync_AutomaticPruneSkipsWholeBatchWhenCandidateSetChangesAfterCommit()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-auto-prune-candidate-drift.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-auto-prune-candidate-drift", "relay");
+        await fixture.WriteStateDbAsync([("thread-auto-prune-candidate-drift", "relay", false)]);
+        await fixture.WriteBackupAsync("20260801T000000000Z");
+        await fixture.WriteBackupAsync("20260802T000000000Z");
+
+        CodexSyncService service = new();
+        CoreWritePlanSnapshot plan = await service.CreateSyncPlanSnapshotAsync(
+            fixture.CodexHome,
+            provider: "openai",
+            keepCount: 1);
+        string addedBackup = fixture.BackupPath("20260803T000000000Z");
+        service.FaultInjector = async (point, _, _) =>
+        {
+            if (point == "after_transaction_commit")
+            {
+                await fixture.WriteBackupAsync("20260803T000000000Z");
+            }
+        };
+
+        SyncResult result = await service.RunSyncCheckedAsync(
+            plan,
+            fixture.CodexHome,
+            provider: "openai",
+            keepCount: 1);
+
+        Assert.Null(result.AutoPruneResult);
+        Assert.False(string.IsNullOrWhiteSpace(result.AutoPruneWarning));
+        Assert.True(Directory.Exists(addedBackup));
+        Assert.All(plan.AutoPruneDeletionTargets, target => Assert.True(Directory.Exists(target.Path)));
+    }
+
+    [Fact]
+    public async Task CheckedSync_RejectsAutomaticPruneInventoryDriftBeforeMutation()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-auto-prune-drift.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-auto-prune-drift", "relay");
+        await fixture.WriteStateDbAsync([("thread-auto-prune-drift", "relay", false)]);
+        await fixture.WriteBackupAsync("20260801T000000000Z");
+        await fixture.WriteBackupAsync("20260802T000000000Z");
+
+        CodexSyncService service = new();
+        CoreWritePlanSnapshot plan = await service.CreateSyncPlanSnapshotAsync(
+            fixture.CodexHome,
+            provider: "openai",
+            keepCount: 1);
+        await fixture.WriteBackupAsync("20260803T000000000Z");
+        string before = await File.ReadAllTextAsync(rolloutPath);
+
+        await Assert.ThrowsAsync<CoreWritePlanStaleException>(() =>
+            service.RunSyncCheckedAsync(
+                plan,
+                fixture.CodexHome,
+                provider: "openai",
+                keepCount: 1));
+
+        Assert.Equal(before, await File.ReadAllTextAsync(rolloutPath));
+        Assert.Equal(3, Directory.EnumerateDirectories(fixture.BackupRoot()).Count());
+    }
+
+    [Fact]
+    public async Task CheckedPrune_RejectsBackupInventoryDriftBeforeDeletion()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        await fixture.WriteBackupAsync("20260801T000000000Z");
+        await fixture.WriteBackupAsync("20260802T000000000Z");
+
+        CodexSyncService service = new();
+        CoreWritePlanSnapshot plan = await service.CreatePrunePlanSnapshotAsync(
+            fixture.CodexHome,
+            keepCount: 1);
+        string addedBackup = fixture.BackupPath("20260803T000000000Z");
+        await fixture.WriteBackupAsync("20260803T000000000Z");
+
+        await Assert.ThrowsAsync<CoreWritePlanStaleException>(() =>
+            service.RunPruneBackupsCheckedAsync(
+                plan,
+                fixture.CodexHome,
+                keepCount: 1));
+
+        Assert.True(Directory.Exists(addedBackup));
+        Assert.Equal(3, Directory.EnumerateDirectories(fixture.BackupRoot()).Count());
+    }
+
+    [Fact]
+    public async Task CheckedSwitch_UsesTheExistingSwitchWorkflowForAnExactSnapshot()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-switch-plan.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-switch-plan", "openai");
+        await fixture.WriteStateDbAsync([("thread-switch-plan", "openai", false)]);
+
+        CodexSyncService service = new();
+        CoreWritePlanSnapshot plan = await service.CreateSwitchPlanSnapshotAsync(
+            fixture.CodexHome,
+            "apigather");
+        SyncResult result = await service.RunSwitchCheckedAsync(
+            plan,
+            fixture.CodexHome,
+            "apigather");
+
+        Assert.True(result.ConfigUpdated);
+        Assert.Equal("apigather", result.TargetProvider);
+        Assert.Contains(
+            "model_provider = \"apigather\"",
+            await File.ReadAllTextAsync(Path.Combine(fixture.CodexHome, "config.toml")));
+        Assert.Contains("\"model_provider\":\"apigather\"", await File.ReadAllTextAsync(rolloutPath));
+    }
+
+    [Fact]
+    public async Task CheckedRestore_RejectsSourceBackupDriftBeforeRestoringAnything()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-restore-plan.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-restore-plan", "relay");
+        await fixture.WriteStateDbAsync([("thread-restore-plan", "relay", false)]);
+
+        CodexSyncService service = new();
+        SyncResult sync = await service.RunSyncAsync(fixture.CodexHome, provider: "openai");
+        RestoreBackupOptions options = new();
+        CoreWritePlanSnapshot plan = await service.CreateRestorePlanSnapshotAsync(
+            fixture.CodexHome,
+            sync.BackupDir,
+            options);
+        await File.AppendAllTextAsync(Path.Combine(sync.BackupDir, "metadata.json"), "\n");
+        string before = await File.ReadAllTextAsync(rolloutPath);
+
+        await Assert.ThrowsAsync<CoreWritePlanStaleException>(() =>
+            service.RunRestoreCheckedAsync(
+                plan,
+                fixture.CodexHome,
+                sync.BackupDir,
+                options));
+
+        Assert.Equal(before, await File.ReadAllTextAsync(rolloutPath));
+        Assert.Contains("\"model_provider\":\"openai\"", before);
+    }
+
+    [Fact]
+    public async Task CheckedSync_RechecksExpiryInsideTheCoreLockBeforeBackup()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-expired-plan.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-expired-plan", "relay");
+        await fixture.WriteStateDbAsync([("thread-expired-plan", "relay", false)]);
+        CodexSyncService service = new();
+        CoreWritePlanSnapshot plan = await service.CreateSyncPlanSnapshotAsync(
+            fixture.CodexHome,
+            provider: "openai");
+
+        await Assert.ThrowsAsync<CoreWritePlanExpiredException>(() =>
+            service.RunSyncCheckedAsync(
+                plan,
+                fixture.CodexHome,
+                provider: "openai",
+                snapshotExpiresAtUtc: DateTimeOffset.UtcNow.AddSeconds(-1)));
+
+        Assert.False(Directory.Exists(fixture.BackupRoot()));
+        Assert.Contains("\"model_provider\":\"relay\"", await File.ReadAllTextAsync(rolloutPath));
+    }
+
+    [Fact]
+    public async Task CheckedRestore_PrioritizesForeignPendingRecoveryOverTheOldPlan()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-foreign-pending.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-foreign-pending", "relay");
+        await fixture.WriteStateDbAsync([("thread-foreign-pending", "relay", false)]);
+        CodexSyncService service = new();
+        SyncResult sync = await service.RunSyncAsync(fixture.CodexHome, provider: "openai");
+        RestoreBackupOptions options = new();
+        CoreWritePlanSnapshot plan = await service.CreateRestorePlanSnapshotAsync(
+            fixture.CodexHome,
+            sync.BackupDir,
+            options);
+        string foreignBackup = fixture.BackupPath("99991231T235959999Z");
+        Directory.CreateDirectory(foreignBackup);
+        await FileTransactionJournal.CreateAsync(
+            foreignBackup,
+            fixture.CodexHome,
+            "openai",
+            [rolloutPath]);
+        string before = await File.ReadAllTextAsync(rolloutPath);
+
+        RecoveryRequiredException error = await Assert.ThrowsAsync<RecoveryRequiredException>(() =>
+            service.RunRestoreCheckedAsync(
+                plan,
+                fixture.CodexHome,
+                sync.BackupDir,
+                options));
+
+        Assert.Contains(foreignBackup, error.PendingBackupDirectories);
+        Assert.Equal(before, await File.ReadAllTextAsync(rolloutPath));
+    }
+
+    [Fact]
+    public async Task SqliteCheckedPlans_TrackMainAndWalButExcludeVolatileShm()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-sqlite-plan-targets.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-sqlite-plan-targets", "relay");
+        await fixture.WriteStateDbAsync([("thread-sqlite-plan-targets", "relay", false)]);
+
+        string databasePath = Path.GetFullPath(fixture.StateDbPath());
+        CodexSyncService service = new();
+        CoreWritePlanSnapshot syncPlan = await service.CreateSyncPlanSnapshotAsync(
+            fixture.CodexHome,
+            provider: "openai");
+
+        Assert.Contains(syncPlan.Targets, target => target.Path == databasePath);
+        Assert.Contains(syncPlan.Targets, target => target.Path == databasePath + "-wal");
+        Assert.DoesNotContain(syncPlan.Targets, target => target.Path == databasePath + "-shm");
+
+        SyncResult sync = await service.RunSyncAsync(fixture.CodexHome, provider: "openai");
+        CoreWritePlanSnapshot restorePlan = await service.CreateRestorePlanSnapshotAsync(
+            fixture.CodexHome,
+            sync.BackupDir,
+            new RestoreBackupOptions());
+
+        Assert.Contains(restorePlan.Targets, target => target.Path == databasePath);
+        Assert.Contains(restorePlan.Targets, target => target.Path == databasePath + "-wal");
+        Assert.DoesNotContain(restorePlan.Targets, target => target.Path == databasePath + "-shm");
+    }
+
+    [Fact]
+    public async Task CheckedRestore_AllowsSqliteMetadataAndShmChurnFromReadOnlyStatus()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-restore-shm-churn.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-restore-shm-churn", "relay");
+        await fixture.WriteStateDbAsync([("thread-restore-shm-churn", "relay", false)]);
+
+        CodexSyncService service = new();
+        SyncResult sync = await service.RunSyncAsync(fixture.CodexHome, provider: "openai");
+        await using SqliteConnection keeper = fixture.OpenSqliteConnection();
+        await keeper.OpenAsync();
+        await EnableWalAsync(keeper);
+        await SetProviderAsync(keeper, "live-before-restore");
+
+        string databasePath = fixture.StateDbPath();
+        string walPath = databasePath + "-wal";
+        string shmPath = databasePath + "-shm";
+        Assert.True(File.Exists(walPath));
+        Assert.True(File.Exists(shmPath));
+        CoreWritePlanSnapshot plan = await service.CreateRestorePlanSnapshotAsync(
+            fixture.CodexHome,
+            sync.BackupDir,
+            new RestoreBackupOptions());
+        string mainBefore = await DigestFileAsync(databasePath);
+        string walBefore = await DigestFileAsync(walPath);
+
+        _ = await service.GetStatusAsync(fixture.CodexHome);
+        Assert.Equal(mainBefore, await DigestFileAsync(databasePath));
+        Assert.Equal(walBefore, await DigestFileAsync(walPath));
+
+        // File timestamps are not logical SQLite state. Force deterministic
+        // metadata-only drift on the durable main file and the derived SHM
+        // coordination file; neither main nor WAL content changes here.
+        DateTime mainWriteTime = File.GetLastWriteTimeUtc(databasePath);
+        File.SetLastWriteTimeUtc(databasePath, mainWriteTime.AddSeconds(2));
+        DateTime shmWriteTime = File.GetLastWriteTimeUtc(shmPath);
+        File.SetLastWriteTimeUtc(shmPath, shmWriteTime.AddSeconds(2));
+        Assert.Equal(mainBefore, await DigestFileAsync(databasePath));
+        Assert.Equal(walBefore, await DigestFileAsync(walPath));
+
+        RestoreResult result = await service.RunRestoreCheckedAsync(
+            plan,
+            fixture.CodexHome,
+            sync.BackupDir,
+            new RestoreBackupOptions());
+
+        Assert.Equal(sync.BackupDir, result.BackupDir);
+        Assert.Equal("relay", await ReadProviderAsync(keeper));
+    }
+
+    [Fact]
+    public async Task SqliteWalFingerprint_TreatsMissingAndZeroLengthAsEquivalent()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        string walPath = Path.Combine(fixture.Root, "sqlite", AppConstants.DbFileBasename + "-wal");
+        CoreWriteTargetSpec walTarget = new(
+            walPath,
+            "update-if-present",
+            CoreWriteFingerprintMode.SqliteWalContent);
+
+        CoreWritePlanSnapshot missing = await CoreWriteSnapshotBuilder.BuildAsync(
+            "sync",
+            "sqlite-wal-normalization",
+            [walTarget]);
+        Directory.CreateDirectory(Path.GetDirectoryName(walPath)!);
+        await File.WriteAllBytesAsync(walPath, []);
+        CoreWritePlanSnapshot empty = await CoreWriteSnapshotBuilder.BuildAsync(
+            "sync",
+            "sqlite-wal-normalization",
+            [walTarget]);
+
+        CoreWriteSnapshotBuilder.AssertExactMatch(missing, empty);
+        Assert.Equal(
+            Assert.Single(missing.Targets).Fingerprint,
+            Assert.Single(empty.Targets).Fingerprint);
+
+        File.Delete(walPath);
+        CoreWritePlanSnapshot missingAgain = await CoreWriteSnapshotBuilder.BuildAsync(
+            "sync",
+            "sqlite-wal-normalization",
+            [walTarget]);
+        CoreWriteSnapshotBuilder.AssertExactMatch(empty, missingAgain);
+    }
+
+    [Fact]
+    public async Task CheckedRestore_RejectsCommittedWalDriftBeforeMutation()
+    {
+        TestCodexHomeFixture fixture = await TestCodexHomeFixture.CreateAsync();
+        await fixture.WriteConfigAsync("model_provider = \"openai\"");
+        string rolloutPath = fixture.RolloutPath("sessions", "rollout-restore-wal-drift.jsonl");
+        await fixture.WriteRolloutAsync(rolloutPath, "thread-restore-wal-drift", "relay");
+        await fixture.WriteStateDbAsync([("thread-restore-wal-drift", "relay", false)]);
+
+        CodexSyncService service = new();
+        SyncResult sync = await service.RunSyncAsync(fixture.CodexHome, provider: "openai");
+        await using SqliteConnection keeper = fixture.OpenSqliteConnection();
+        await keeper.OpenAsync();
+        await EnableWalAsync(keeper);
+        await SetProviderAsync(keeper, "live-before-plan");
+
+        string databasePath = fixture.StateDbPath();
+        string walPath = databasePath + "-wal";
+        CoreWritePlanSnapshot plan = await service.CreateRestorePlanSnapshotAsync(
+            fixture.CodexHome,
+            sync.BackupDir,
+            new RestoreBackupOptions());
+        string mainBefore = await DigestFileAsync(databasePath);
+        string walBefore = await DigestFileAsync(walPath);
+
+        await SetProviderAsync(keeper, "committed-after-plan");
+
+        Assert.Equal(mainBefore, await DigestFileAsync(databasePath));
+        Assert.NotEqual(walBefore, await DigestFileAsync(walPath));
+        await Assert.ThrowsAsync<CoreWritePlanStaleException>(() =>
+            service.RunRestoreCheckedAsync(
+                plan,
+                fixture.CodexHome,
+                sync.BackupDir,
+                new RestoreBackupOptions()));
+        Assert.Equal("committed-after-plan", await ReadProviderAsync(keeper));
+    }
+
+    private static async Task EnableWalAsync(SqliteConnection connection)
+    {
+        await using SqliteCommand journalMode = connection.CreateCommand();
+        journalMode.CommandText = "PRAGMA journal_mode = WAL";
+        Assert.Equal("wal", Convert.ToString(await journalMode.ExecuteScalarAsync()));
+
+        await using SqliteCommand autoCheckpoint = connection.CreateCommand();
+        autoCheckpoint.CommandText = "PRAGMA wal_autocheckpoint = 0";
+        await autoCheckpoint.ExecuteNonQueryAsync();
+    }
+
+    private static async Task SetProviderAsync(SqliteConnection connection, string provider)
+    {
+        await using SqliteCommand command = connection.CreateCommand();
+        command.CommandText = "UPDATE threads SET model_provider = $provider";
+        command.Parameters.AddWithValue("$provider", provider);
+        Assert.Equal(1, await command.ExecuteNonQueryAsync());
+    }
+
+    private static async Task<string> ReadProviderAsync(SqliteConnection connection)
+    {
+        await using SqliteCommand command = connection.CreateCommand();
+        command.CommandText = "SELECT model_provider FROM threads LIMIT 1";
+        return Convert.ToString(await command.ExecuteScalarAsync())!;
+    }
+
+    private static async Task<string> DigestFileAsync(string path)
+    {
+        await using FileStream stream = new(
+            path,
+            FileMode.Open,
+            FileAccess.Read,
+            FileShare.ReadWrite | FileShare.Delete,
+            64 * 1024,
+            FileOptions.Asynchronous | FileOptions.SequentialScan);
+        byte[] digest = await SHA256.HashDataAsync(stream);
+        return Convert.ToHexString(digest);
+    }
+
+    private static void AssertAutomaticDeletionTargets(
+        CoreWritePlanSnapshot plan,
+        IReadOnlyList<string> expectedPaths)
+    {
+        Assert.Equal(
+            expectedPaths.Order(StringComparer.Ordinal),
+            plan.AutoPruneDeletionTargets.Select(static target => target.Path).Order(StringComparer.Ordinal));
+        Assert.All(plan.AutoPruneDeletionTargets, target =>
+        {
+            Assert.Equal("delete", target.Action);
+            Assert.StartsWith("sha256:", target.Fingerprint, StringComparison.Ordinal);
+        });
+    }
+}
diff --git a/desktop/CodexProviderSync.Core.Tests/CrashHost/CodexProviderSync.CrashHost.csproj b/desktop/CodexProviderSync.Core.Tests/CrashHost/CodexProviderSync.CrashHost.csproj
new file mode 100644
index 0000000..ef86c48
--- /dev/null
+++ b/desktop/CodexProviderSync.Core.Tests/CrashHost/CodexProviderSync.CrashHost.csproj
@@ -0,0 +1,14 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\CodexProviderSync.Core\CodexProviderSync.Core.csproj" />
+  </ItemGroup>
+
+</Project>
diff --git a/desktop/CodexProviderSync.Core.Tests/CrashHost/Program.cs b/desktop/CodexProviderSync.Core.Tests/CrashHost/Program.cs
new file mode 100644
index 0000000..c75826f
--- /dev/null
+++ b/desktop/CodexProviderSync.Core.Tests/CrashHost/Program.cs
@@ -0,0 +1,21 @@
+using System.Diagnostics;
+using CodexProviderSync.Core;
+
+if (args is not [string codexHome])
+{
+    return 64;
+}
+
+CodexSyncService service = new();
+service.FaultInjector = (point, _, _) =>
+{
+    if (point == "after_rollout_mutation_before_applied")
+    {
+        Process.GetCurrentProcess().Kill();
+        Thread.Sleep(Timeout.Infinite);
+    }
+    return Task.CompletedTask;
+};
+
+await service.RunSyncAsync(codexHome, provider: "openai");
+return 65;
diff --git a/desktop/CodexProviderSync.Core.Tests/LockServiceTests.cs b/desktop/CodexProviderSync.Core.Tests/LockServiceTests.cs
index d65ce08..de6a410 100644
--- a/desktop/CodexProviderSync.Core.Tests/LockServiceTests.cs
+++ b/desktop/CodexProviderSync.Core.Tests/LockServiceTests.cs
@@ -1,23 +1,633 @@
+using System.Text.Json;
+
 namespace CodexProviderSync.Core.Tests;
 
 public sealed class LockServiceTests
 {
     [Fact]
-    public async Task AcquireLockAsync_CreatesAndReleasesLockDirectory()
+    public async Task AcquireLockAsync_PublishesVersionedOwnerAndClaim_ThenReleasesOnlyItsGeneration()
     {
-        string codexHome = Path.Combine(Path.GetTempPath(), $"codex-provider-lock-{Guid.NewGuid():N}");
-        Directory.CreateDirectory(codexHome);
+        string codexHome = CreateTempDirectory();
         string lockPath = AppConstants.LockPath(codexHome);
+        string claimsPath = lockPath + ".claims";
+
+        LockHandle handle = await new LockService().AcquireLockAsync(codexHome, "test");
+        try
+        {
+            Assert.Equal(Path.GetFullPath(lockPath), handle.LockPath);
+            Assert.True(Directory.Exists(lockPath));
+            string claimPath = Assert.Single(Directory.EnumerateFiles(claimsPath, "*.json"));
+
+            using JsonDocument owner = JsonDocument.Parse(
+                await File.ReadAllTextAsync(Path.Combine(lockPath, "owner.json")));
+            JsonElement root = owner.RootElement;
+            Assert.Equal(2, root.GetProperty("protocolVersion").GetInt32());
+            Assert.Equal("dotnet", root.GetProperty("runtime").GetString());
+            Assert.Equal(Environment.ProcessId, root.GetProperty("pid").GetInt32());
+            Assert.Equal(Environment.ProcessId, root.GetProperty("processId").GetInt32());
+            Assert.Equal(handle.InstanceId, root.GetProperty("instanceId").GetString());
+            Assert.Equal("test", root.GetProperty("label").GetString());
+            Assert.Equal(Environment.CurrentDirectory, root.GetProperty("cwd").GetString());
+            Assert.Matches(
+                @"^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$",
+                root.GetProperty("processStartedAt").GetString()!);
+
+            using JsonDocument claim = JsonDocument.Parse(await File.ReadAllTextAsync(claimPath));
+            Assert.Equal(handle.InstanceId, claim.RootElement.GetProperty("instanceId").GetString());
+            string reservationMarker = Assert.Single(
+                Directory.EnumerateFiles(lockPath, ".reservation.*", SearchOption.TopDirectoryOnly));
+            Assert.Equal(handle.InstanceId, await File.ReadAllTextAsync(reservationMarker));
+        }
+        finally
+        {
+            await handle.DisposeAsync();
+        }
+
+        Assert.False(Directory.Exists(lockPath));
+        Assert.Empty(Directory.EnumerateFiles(claimsPath, "*.json"));
+    }
 
-        await using (await new LockService().AcquireLockAsync(codexHome, "test"))
+    [Fact]
+    public async Task AcquirePathLockAsync_SupportsArbitraryExplicitResourcePath()
+    {
+        string root = CreateTempDirectory();
+        string lockPath = Path.Combine(root, "resource-locks", "sqlite-home.lock");
+
+        await using (LockHandle handle = await new LockService().AcquirePathLockAsync(lockPath, "sqlite"))
         {
+            Assert.Equal(Path.GetFullPath(lockPath), handle.LockPath);
             Assert.True(Directory.Exists(lockPath));
-            Assert.True(File.Exists(Path.Combine(lockPath, "owner.json")));
+            Assert.True(Directory.Exists(lockPath + ".claims"));
+        }
+
+        Assert.False(Directory.Exists(lockPath));
+    }
+
+    [Fact]
+    public async Task AcquirePathLockAsync_RejectsCanonicalFileWithBusyDiagnostic()
+    {
+        string root = CreateTempDirectory();
+        string lockPath = Path.Combine(root, "resource-locks", "sqlite-home.lock");
+        Directory.CreateDirectory(Path.GetDirectoryName(lockPath)!);
+        await File.WriteAllTextAsync(lockPath, "foreign");
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => new LockService().AcquirePathLockAsync(lockPath, "sqlite"));
+
+        Assert.Contains("not a directory", error.Message);
+        Assert.True(LockService.IsOperationBusy(error));
+        Assert.Equal("foreign", await File.ReadAllTextAsync(lockPath));
+        Assert.Empty(Directory.EnumerateFiles(lockPath + ".claims", "*.json"));
+    }
+
+    [Fact]
+    public async Task AcquirePathLockAsync_RejectsCanonicalSymbolicLinkWithoutFollowingIt_OnUnix()
+    {
+        if (OperatingSystem.IsWindows())
+        {
+            return;
+        }
+        string root = CreateTempDirectory();
+        string lockPath = Path.Combine(root, "resource-locks", "sqlite-home.lock");
+        string targetPath = Path.Combine(root, "foreign-target");
+        Directory.CreateDirectory(Path.GetDirectoryName(lockPath)!);
+        Directory.CreateDirectory(targetPath);
+        Directory.CreateSymbolicLink(lockPath, targetPath);
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => new LockService().AcquirePathLockAsync(lockPath, "sqlite"));
+
+        Assert.Contains("symbolic link or reparse point", error.Message);
+        Assert.True(LockService.IsOperationBusy(error));
+        Assert.Empty(Directory.EnumerateFileSystemEntries(targetPath));
+        Assert.Empty(Directory.EnumerateFiles(lockPath + ".claims", "*.json"));
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_HardLinkFailurePreservesForeignPopulationAndReleasesClaim()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        LockService service = new(async (phase, _) =>
+        {
+            if (phase != "canonical-reserved")
+            {
+                return;
+            }
+            await File.WriteAllTextAsync(Path.Combine(lockPath, "owner.json"), "foreign-owner");
+            await File.WriteAllTextAsync(Path.Combine(lockPath, "foreign.txt"), "keep");
+        });
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => service.AcquireLockAsync(codexHome, "injected"));
+
+        Assert.True(LockService.IsOperationBusy(error));
+        Assert.Equal("foreign-owner", await File.ReadAllTextAsync(Path.Combine(lockPath, "owner.json")));
+        Assert.Equal("keep", await File.ReadAllTextAsync(Path.Combine(lockPath, "foreign.txt")));
+        Assert.Empty(Directory.EnumerateFiles(lockPath + ".claims", "*.json"));
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_ReservationAbaRetainsUncertainClaimAndForeignDirectory()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        string displacedPath = lockPath + ".displaced";
+        LockService service = new(async (phase, _) =>
+        {
+            if (phase != "canonical-reserved")
+            {
+                return;
+            }
+            Directory.Move(lockPath, displacedPath);
+            Directory.CreateDirectory(lockPath);
+            await File.WriteAllTextAsync(Path.Combine(lockPath, "foreign.txt"), "keep");
+        });
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => service.AcquireLockAsync(codexHome, "aba"));
+
+        Assert.Contains("reservation changed identity", error.Message);
+        Assert.True(LockService.IsOperationBusy(error));
+        Assert.Equal("keep", await File.ReadAllTextAsync(Path.Combine(lockPath, "foreign.txt")));
+        Assert.Single(Directory.EnumerateFiles(lockPath + ".claims", "*.json"));
+        Assert.True(Directory.Exists(displacedPath));
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_ReclaimsCanonicalOwnedByExitedProcess()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        Directory.CreateDirectory(lockPath);
+        await WriteJsonAsync(Path.Combine(lockPath, "owner.json"), new
+        {
+            processId = int.MaxValue,
+            startedAt = DateTimeOffset.UtcNow.AddHours(-1),
+            processStartedAt = "2000-01-01T00:00:00Z",
+            label = "crashed",
+            currentDirectory = codexHome
+        });
+
+        await using (LockHandle handle = await new LockService().AcquireLockAsync(codexHome, "recovery"))
+        {
+            using JsonDocument owner = JsonDocument.Parse(
+                await File.ReadAllTextAsync(Path.Combine(lockPath, "owner.json")));
+            Assert.Equal(handle.InstanceId, owner.RootElement.GetProperty("instanceId").GetString());
         }
 
         Assert.False(Directory.Exists(lockPath));
     }
 
+    [Fact]
+    public async Task AcquireLockAsync_DoesNotReclaimLiveLegacyDotNetOwner()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        Directory.CreateDirectory(lockPath);
+        await WriteJsonAsync(Path.Combine(lockPath, "owner.json"), new
+        {
+            processId = Environment.ProcessId,
+            startedAt = DateTimeOffset.UtcNow,
+            processStartedAt = LockService.CurrentProcessStartedAtForTests(),
+            label = "active-legacy-dotnet",
+            currentDirectory = codexHome
+        });
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => new LockService().AcquireLockAsync(codexHome, "competing"));
+
+        Assert.Contains("verified owner", error.Message);
+        Assert.True(Directory.Exists(lockPath));
+        Assert.Empty(Directory.EnumerateFiles(lockPath + ".claims", "*.json"));
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_DoesNotReclaimLiveLegacyNodeOwner()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        Directory.CreateDirectory(lockPath);
+        await WriteJsonAsync(Path.Combine(lockPath, "owner.json"), new
+        {
+            pid = Environment.ProcessId,
+            processStartedAt = LockService.CurrentProcessStartedAtForTests(),
+            instanceId = Guid.NewGuid().ToString("D"),
+            runtime = "node",
+            label = "active-legacy-node",
+            cwd = codexHome
+        });
+
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => new LockService().AcquireLockAsync(codexHome, "competing"));
+
+        Assert.True(Directory.Exists(lockPath));
+        Assert.Empty(Directory.EnumerateFiles(lockPath + ".claims", "*.json"));
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_DoesNotReclaimLiveLegacyNodeMarkerOwner()
+    {
+        string? marker = LockService.CurrentProcessStartMarkerForTests();
+        if (marker is null)
+        {
+            return;
+        }
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        Directory.CreateDirectory(lockPath);
+        await WriteJsonAsync(Path.Combine(lockPath, "owner.json"), new
+        {
+            pid = Environment.ProcessId,
+            processStartMarker = marker,
+            instanceId = Guid.NewGuid().ToString("D"),
+            runtime = "node",
+            label = "active-legacy-node-marker",
+            cwd = codexHome
+        });
+
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => new LockService().AcquireLockAsync(codexHome, "competing"));
+
+        Assert.True(Directory.Exists(lockPath));
+        Assert.Empty(Directory.EnumerateFiles(lockPath + ".claims", "*.json"));
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_FailsClosedForOwnerlessLegacyLock()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        Directory.CreateDirectory(lockPath);
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => new LockService().AcquireLockAsync(codexHome, "competing"));
+
+        Assert.Contains("retained fail-closed", error.Message);
+        Assert.True(Directory.Exists(lockPath));
+        Assert.Empty(Directory.EnumerateFiles(lockPath + ".claims", "*.json"));
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_ReclaimsCanonicalAndClaimWhenPidWasReused()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        string staleInstanceId = Guid.NewGuid().ToString("D");
+        Directory.CreateDirectory(lockPath);
+        await WriteVersionTwoOwnerAsync(
+            Path.Combine(lockPath, "owner.json"),
+            staleInstanceId,
+            "2000-01-01T00:00:00Z");
+        string claimsPath = lockPath + ".claims";
+        Directory.CreateDirectory(claimsPath);
+        await WriteVersionTwoOwnerAsync(
+            Path.Combine(claimsPath, staleInstanceId + ".json"),
+            staleInstanceId,
+            "2000-01-01T00:00:00Z");
+
+        await using (LockHandle handle = await new LockService().AcquireLockAsync(codexHome, "replacement"))
+        {
+            Assert.NotEqual(staleInstanceId, handle.InstanceId);
+            Assert.DoesNotContain(
+                Directory.EnumerateFiles(claimsPath, "*.json"),
+                path => string.Equals(
+                    Path.GetFileNameWithoutExtension(path),
+                    staleInstanceId,
+                    StringComparison.OrdinalIgnoreCase));
+        }
+        Assert.False(Directory.Exists(lockPath));
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_TwoReclaimersCannotBothOwnStaleCanonicalGeneration()
+    {
+        await AssertTwoReclaimersRoundAsync(iteration: 0);
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_TwoReclaimersStressLeavesNoLiveClaim()
+    {
+        for (int iteration = 1; iteration <= 50; iteration += 1)
+        {
+            await AssertTwoReclaimersRoundAsync(iteration);
+        }
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_RetriesTransientOwnedClaimCleanupFailure()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        string claimsPath = lockPath + ".claims";
+        string liveInstanceId = Guid.NewGuid().ToString("D");
+        Directory.CreateDirectory(claimsPath);
+        await WriteVersionTwoOwnerAsync(
+            Path.Combine(claimsPath, liveInstanceId + ".json"),
+            liveInstanceId,
+            LockService.CurrentProcessStartedAtForTests());
+        int cleanupAttempts = 0;
+        LockService service = new((phase, _) =>
+        {
+            if (phase == "before-owned-claim-delete"
+                && Interlocked.Increment(ref cleanupAttempts) < 3)
+            {
+                throw new IOException("injected transient owned-claim cleanup failure");
+            }
+            return Task.CompletedTask;
+        });
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => service.AcquireLockAsync(codexHome, "cleanup-retry"));
+
+        Assert.True(LockService.IsOperationBusy(error));
+        Assert.Equal(3, cleanupAttempts);
+        Assert.False(Directory.Exists(lockPath));
+        Assert.Equal(
+            [liveInstanceId + ".json"],
+            Directory.EnumerateFiles(claimsPath, "*.json").Select(path => Path.GetFileName(path)!).ToArray());
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_AggregatesAcquisitionAndExhaustedOwnedClaimCleanupFailure()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        string claimsPath = lockPath + ".claims";
+        string liveInstanceId = Guid.NewGuid().ToString("D");
+        Directory.CreateDirectory(claimsPath);
+        await WriteVersionTwoOwnerAsync(
+            Path.Combine(claimsPath, liveInstanceId + ".json"),
+            liveInstanceId,
+            LockService.CurrentProcessStartedAtForTests());
+        int cleanupAttempts = 0;
+        LockService service = new((phase, _) =>
+        {
+            if (phase == "before-owned-claim-delete")
+            {
+                int attempt = Interlocked.Increment(ref cleanupAttempts);
+                throw new IOException($"injected owned-claim cleanup failure {attempt}");
+            }
+            return Task.CompletedTask;
+        });
+
+        AggregateException error = await Assert.ThrowsAsync<AggregateException>(
+            () => service.AcquireLockAsync(codexHome, "cleanup-exhausted"));
+
+        Assert.Equal(4, cleanupAttempts);
+        Assert.Contains("Lock already exists", error.Message);
+        Assert.Contains("after 4 attempts", error.Message);
+        Assert.False(LockService.IsOperationBusy(error));
+        Assert.Contains(
+            error.InnerExceptions,
+            LockService.IsOperationBusy);
+        Assert.Contains(
+            error.InnerExceptions,
+            inner => inner is IOException
+                && inner.ToString().Contains("injected owned-claim cleanup failure 4", StringComparison.Ordinal));
+        Assert.False(Directory.Exists(lockPath));
+        Assert.Equal(2, Directory.EnumerateFiles(claimsPath, "*.json").Count());
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_RevalidatesOwnedClaimIdentityBeforeCleanupRetry()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        string claimsPath = lockPath + ".claims";
+        string liveInstanceId = Guid.NewGuid().ToString("D");
+        string replacementInstanceId = Guid.NewGuid().ToString("D");
+        Directory.CreateDirectory(claimsPath);
+        string liveClaimPath = Path.Combine(claimsPath, liveInstanceId + ".json");
+        await WriteVersionTwoOwnerAsync(
+            liveClaimPath,
+            liveInstanceId,
+            LockService.CurrentProcessStartedAtForTests());
+        int cleanupAttempts = 0;
+        LockService service = new(async (phase, instanceId) =>
+        {
+            if (phase == "before-owned-claim-delete")
+            {
+                Interlocked.Increment(ref cleanupAttempts);
+                string claimPath = Path.Combine(claimsPath, instanceId + ".json");
+                await WriteVersionTwoOwnerAsync(
+                    claimPath,
+                    replacementInstanceId,
+                    LockService.CurrentProcessStartedAtForTests());
+                throw new IOException("retry after replacing claim identity");
+            }
+        });
+
+        AggregateException error = await Assert.ThrowsAsync<AggregateException>(
+            () => service.AcquireLockAsync(codexHome, "cleanup-revalidation"));
+
+        Assert.Equal(1, cleanupAttempts);
+        Assert.Contains("Lock already exists", error.Message);
+        Assert.Contains(replacementInstanceId, error.Message);
+        Assert.False(LockService.IsOperationBusy(error));
+        Assert.Contains(error.InnerExceptions, LockService.IsOperationBusy);
+        string retainedClaim = Assert.Single(
+            Directory.EnumerateFiles(claimsPath, "*.json"),
+            path => !string.Equals(path, liveClaimPath, StringComparison.OrdinalIgnoreCase));
+        using JsonDocument owner = JsonDocument.Parse(await File.ReadAllTextAsync(retainedClaim));
+        Assert.Equal(replacementInstanceId, owner.RootElement.GetProperty("instanceId").GetString());
+    }
+
+    [Fact]
+    public async Task IdentityReadStream_AllowsConcurrentDelete()
+    {
+        string directory = CreateTempDirectory();
+        string identityPath = Path.Combine(directory, "owner.json");
+        await File.WriteAllTextAsync(identityPath, "{}");
+
+        await using FileStream identityRead = LockService.OpenIdentityReadStreamForTests(identityPath);
+        Assert.True(identityRead.CanRead);
+        File.Delete(identityPath);
+
+        Assert.False(File.Exists(identityPath));
+    }
+
+    [Fact]
+    public async Task DisposeAsync_DoesNotDeleteReplacementCanonicalOwner_AbaDefense()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        LockHandle original = await new LockService().AcquireLockAsync(codexHome, "original");
+        string replacementInstanceId = Guid.NewGuid().ToString("D");
+        await WriteVersionTwoOwnerAsync(
+            Path.Combine(lockPath, "owner.json"),
+            replacementInstanceId,
+            LockService.CurrentProcessStartedAtForTests());
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => original.DisposeAsync().AsTask());
+
+        Assert.Contains("owner identity changed", error.Message);
+        Assert.True(Directory.Exists(lockPath));
+        using JsonDocument owner = JsonDocument.Parse(
+            await File.ReadAllTextAsync(Path.Combine(lockPath, "owner.json")));
+        Assert.Equal(replacementInstanceId, owner.RootElement.GetProperty("instanceId").GetString());
+        Assert.Empty(Directory.EnumerateFiles(lockPath + ".claims", "*.json"));
+    }
+
+    [Fact]
+    public async Task DisposeAsync_DoesNotDeleteReplacementDirectoryThatReusesOwnerFile()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        LockHandle original = await new LockService().AcquireLockAsync(codexHome, "original");
+        string originalPath = lockPath + ".original";
+        Directory.Move(lockPath, originalPath);
+        Directory.CreateDirectory(lockPath);
+        File.Copy(
+            Path.Combine(originalPath, "owner.json"),
+            Path.Combine(lockPath, "owner.json"));
+        await File.WriteAllTextAsync(Path.Combine(lockPath, "foreign.txt"), "keep");
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => original.DisposeAsync().AsTask());
+
+        Assert.Contains("reservation identity changed", error.Message);
+        Assert.Equal("keep", await File.ReadAllTextAsync(Path.Combine(lockPath, "foreign.txt")));
+        Assert.Single(Directory.EnumerateFiles(lockPath + ".claims", "*.json"));
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_StaleReclaimAbaRestoresAndPreservesReplacementOwner()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        string oldInstanceId = Guid.NewGuid().ToString("D");
+        string replacementInstanceId = Guid.NewGuid().ToString("D");
+        Directory.CreateDirectory(lockPath);
+        await WriteVersionTwoOwnerAsync(
+            Path.Combine(lockPath, "owner.json"),
+            oldInstanceId,
+            "2000-01-01T00:00:00Z");
+        string releasedOldPath = lockPath + ".released-old";
+        LockService service = new(async (phase, _) =>
+        {
+            if (phase != "before-stale-canonical-reclaim")
+            {
+                return;
+            }
+            Directory.Move(lockPath, releasedOldPath);
+            Directory.CreateDirectory(lockPath);
+            await WriteVersionTwoOwnerAsync(
+                Path.Combine(lockPath, "owner.json"),
+                replacementInstanceId,
+                LockService.CurrentProcessStartedAtForTests());
+        });
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => service.AcquireLockAsync(codexHome, "aba-contender"));
+
+        Assert.Contains("owner changed during reclamation", error.Message);
+        Assert.True(Directory.Exists(lockPath));
+        using JsonDocument owner = JsonDocument.Parse(
+            await File.ReadAllTextAsync(Path.Combine(lockPath, "owner.json")));
+        Assert.Equal(replacementInstanceId, owner.RootElement.GetProperty("instanceId").GetString());
+        Assert.True(Directory.Exists(releasedOldPath));
+        Assert.Contains(
+            Directory.EnumerateDirectories(Path.GetDirectoryName(lockPath)!),
+            path => Path.GetFileName(path).Contains(".stale.", StringComparison.Ordinal));
+        Assert.Empty(Directory.EnumerateFiles(lockPath + ".claims", "*.json"));
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_FailsClosedForLiveVersionTwoClaimWithoutTouchingCanonical()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        string claimsPath = lockPath + ".claims";
+        string liveInstance = Guid.NewGuid().ToString("D");
+        Directory.CreateDirectory(claimsPath);
+        await WriteVersionTwoOwnerAsync(
+            Path.Combine(claimsPath, liveInstance + ".json"),
+            liveInstance,
+            LockService.CurrentProcessStartedAtForTests());
+
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => new LockService().AcquireLockAsync(codexHome, "competing"));
+
+        Assert.False(Directory.Exists(lockPath));
+        Assert.Equal(
+            [liveInstance + ".json"],
+            Directory.EnumerateFiles(claimsPath, "*.json").Select(path => Path.GetFileName(path)!).ToArray());
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_FailsClosedForConflictingPidFieldsInVersionTwoClaim()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        string claimsPath = lockPath + ".claims";
+        string instanceId = Guid.NewGuid().ToString("D");
+        Directory.CreateDirectory(claimsPath);
+        string claimPath = Path.Combine(claimsPath, instanceId + ".json");
+        await WriteJsonAsync(claimPath, new
+        {
+            protocolVersion = 2,
+            runtime = "node",
+            pid = Environment.ProcessId,
+            processId = int.MaxValue,
+            processStartedAt = LockService.CurrentProcessStartedAtForTests(),
+            instanceId,
+            label = "conflicting-schema",
+            cwd = Environment.CurrentDirectory
+        });
+
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => new LockService().AcquireLockAsync(codexHome, "competing"));
+
+        Assert.True(File.Exists(claimPath));
+        Assert.False(Directory.Exists(lockPath));
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_FailsClosedForFutureCanonicalProtocol()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        Directory.CreateDirectory(lockPath);
+        await WriteJsonAsync(Path.Combine(lockPath, "owner.json"), new
+        {
+            protocolVersion = 99,
+            pid = int.MaxValue,
+            processId = int.MaxValue,
+            processStartedAt = "2000-01-01T00:00:00Z",
+            instanceId = "future-owner",
+            label = "future",
+            cwd = Environment.CurrentDirectory
+        });
+
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => new LockService().AcquireLockAsync(codexHome, "competing"));
+
+        Assert.True(Directory.Exists(lockPath));
+        Assert.Empty(Directory.EnumerateFiles(lockPath + ".claims", "*.json"));
+    }
+
+    [Fact]
+    public async Task AcquireLockAsync_FailsClosedWhenClaimFilenameDoesNotMatchInstanceId()
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        string claimsPath = lockPath + ".claims";
+        Directory.CreateDirectory(claimsPath);
+        string mismatchedPath = Path.Combine(claimsPath, Guid.NewGuid().ToString("D") + ".json");
+        await WriteVersionTwoOwnerAsync(
+            mismatchedPath,
+            "opaque-node-instance-id",
+            LockService.CurrentProcessStartedAtForTests());
+
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => new LockService().AcquireLockAsync(codexHome, "competing"));
+
+        Assert.True(File.Exists(mismatchedPath));
+        Assert.False(Directory.Exists(lockPath));
+    }
+
     [Fact]
     public async Task CreateLockDirectoryAsync_RetriesTransientAccessDeniedErrors()
     {
@@ -52,6 +662,10 @@ public async Task CreateLockDirectoryAsync_ThrowsWhenLockAlreadyExists()
                 tryCreateDirectory: _ => 183));
 
         Assert.Contains("Lock already exists", error.Message);
+        Assert.True(LockService.IsOperationBusy(error));
+        Assert.Equal(
+            LockService.OperationBusyErrorCode,
+            error.Data["codex-provider-sync/error-code"]);
     }
 
     [Fact]
@@ -67,4 +681,93 @@ public async Task CreateLockDirectoryAsync_ThrowsAfterTransientRetryBudgetIsExha
 
         Assert.Contains("Win32 error: 5", error.Message);
     }
+
+    private static async Task<LockHandle?> TryAcquireAsync(LockService service, string codexHome)
+    {
+        try
+        {
+            return await service.AcquireLockAsync(codexHome, "contender");
+        }
+        catch (InvalidOperationException)
+        {
+            return null;
+        }
+    }
+
+    private static async Task AssertTwoReclaimersRoundAsync(int iteration)
+    {
+        string codexHome = CreateTempDirectory();
+        string lockPath = AppConstants.LockPath(codexHome);
+        string claimsPath = lockPath + ".claims";
+        Directory.CreateDirectory(lockPath);
+        await WriteJsonAsync(Path.Combine(lockPath, "owner.json"), new
+        {
+            processId = int.MaxValue,
+            processStartedAt = "2000-01-01T00:00:00Z",
+            label = "stale",
+            currentDirectory = codexHome
+        });
+
+        int published = 0;
+        TaskCompletionSource gate = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        Func<string, string, Task> hook = (phase, _) =>
+        {
+            if (phase == "claim-published" && Interlocked.Increment(ref published) == 2)
+            {
+                gate.TrySetResult();
+            }
+            return gate.Task;
+        };
+
+        Task<LockHandle?> first = TryAcquireAsync(new LockService(hook), codexHome);
+        Task<LockHandle?> second = TryAcquireAsync(new LockService(hook), codexHome);
+        LockHandle?[] acquired = await Task.WhenAll(first, second);
+        LockHandle[] winners = acquired.OfType<LockHandle>().ToArray();
+        Assert.True(
+            winners.Length <= 1,
+            $"Two concurrent stale-lock reclaimers both acquired the canonical lock in stress iteration {iteration}.");
+
+        foreach (LockHandle winner in winners)
+        {
+            await winner.DisposeAsync();
+        }
+
+        await using (LockHandle retry = await new LockService().AcquireLockAsync(codexHome, "retry"))
+        {
+            Assert.True(Directory.Exists(lockPath));
+        }
+        Assert.False(Directory.Exists(lockPath));
+        Assert.Empty(Directory.EnumerateFiles(claimsPath, "*.json"));
+    }
+
+    private static string CreateTempDirectory()
+    {
+        string path = Path.Combine(Path.GetTempPath(), $"codex-provider-lock-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(path);
+        return path;
+    }
+
+    private static Task WriteJsonAsync(string path, object value)
+    {
+        return File.WriteAllTextAsync(path, JsonSerializer.Serialize(value));
+    }
+
+    private static Task WriteVersionTwoOwnerAsync(
+        string path,
+        string instanceId,
+        string processStartedAt)
+    {
+        return WriteJsonAsync(path, new
+        {
+            protocolVersion = 2,
+            runtime = "node",
+            pid = Environment.ProcessId,
+            processId = Environment.ProcessId,
+            processStartedAt,
+            instanceId,
+            startedAt = DateTimeOffset.UtcNow,
+            label = "fixture",
+            cwd = Environment.CurrentDirectory
+        });
+    }
 }
diff --git a/desktop/CodexProviderSync.Core.Tests/SqliteOnlineBackupTests.cs b/desktop/CodexProviderSync.Core.Tests/SqliteOnlineBackupTests.cs
new file mode 100644
index 0000000..d34bda4
--- /dev/null
+++ b/desktop/CodexProviderSync.Core.Tests/SqliteOnlineBackupTests.cs
@@ -0,0 +1,331 @@
+using System.Text.Json;
+using Microsoft.Data.Sqlite;
+
+namespace CodexProviderSync.Core.Tests;
+
+public sealed class SqliteOnlineBackupTests
+{
+    [Fact]
+    public async Task WritesConfigureSynchronousFull_AndNodeDotNetCountersAgree()
+    {
+        await using Fixture fixture = Fixture.Create();
+        await using (SqliteConnection setup = Open(fixture.DbPath))
+        {
+            await setup.OpenAsync();
+            await ExecuteAsync(setup, """
+                PRAGMA synchronous = OFF;
+                CREATE TABLE threads (
+                  id TEXT PRIMARY KEY,
+                  model_provider TEXT,
+                  model TEXT
+                );
+                INSERT INTO threads VALUES ('a', 'legacy', 'old');
+                INSERT INTO threads VALUES ('b', 'openai', 'old');
+                """);
+            Assert.Equal(0L, await ScalarAsync(setup, "PRAGMA synchronous"));
+            Assert.Equal(2, await SqliteStateService.ConfigureSqliteWriteDurabilityAsync(setup));
+            Assert.Equal(2L, await ScalarAsync(setup, "PRAGMA synchronous"));
+        }
+
+        var update = await fixture.Service.UpdateSqliteProviderAsync(
+            fixture.Storage,
+            "openai",
+            targetModel: "new");
+        Assert.True(update.DatabasePresent);
+        Assert.Equal(
+            (3, 1, 2),
+            (update.UpdatedRows, update.ProviderRowsUpdated, update.ModelRowsUpdated));
+
+        await using SqliteConnection verified = Open(fixture.DbPath, SqliteOpenMode.ReadOnly);
+        await verified.OpenAsync();
+        await using SqliteCommand command = verified.CreateCommand();
+        command.CommandText = "SELECT model_provider, model FROM threads ORDER BY id";
+        await using SqliteDataReader reader = await command.ExecuteReaderAsync();
+        int rowCount = 0;
+        while (await reader.ReadAsync())
+        {
+            Assert.Equal("openai", reader.GetString(0));
+            Assert.Equal("new", reader.GetString(1));
+            rowCount += 1;
+        }
+        Assert.Equal(2, rowCount);
+    }
+
+    [Fact]
+    public async Task OfficialOnlineBackup_CapturesLiveWalIntoOneStandaloneMainFile()
+    {
+        await using Fixture fixture = Fixture.Create();
+        string backupPath = Path.Combine(fixture.Root, "backup", "state_5.sqlite");
+        await using SqliteConnection source = Open(fixture.DbPath);
+        await source.OpenAsync();
+        await ExecuteAsync(source, "PRAGMA page_size = 8192; VACUUM;");
+        Assert.Equal("wal", Convert.ToString(await ScalarObjectAsync(source, "PRAGMA journal_mode = WAL")));
+        await ExecuteAsync(source, """
+            PRAGMA user_version = 73;
+            PRAGMA application_id = 1129333840;
+            CREATE TABLE threads (id TEXT PRIMARY KEY, model_provider TEXT);
+            INSERT INTO threads VALUES ('wal-row', 'openai');
+            """);
+        Assert.True(new FileInfo(fixture.DbPath + "-wal").Length > 0);
+
+        SqliteOnlineBackupResult result = await fixture.Service.CreateSqliteOnlineBackupAsync(
+            fixture.Storage,
+            backupPath);
+        Assert.True(result.DatabasePresent);
+        Assert.Equal(Path.GetFullPath(backupPath), result.BackupPath);
+        Assert.NotNull(result.Metadata);
+        Assert.Equal(new SqliteFileMetadata("wal", 8192, 73, 1129333840), result.Metadata.Source);
+        Assert.Equal(result.Metadata.Source, result.Metadata.Backup);
+        Assert.Equal(
+            new SqliteOnlineBackupPreservation(true, true, true, true),
+            result.Metadata.Preserved);
+        Assert.True(File.Exists(backupPath));
+        Assert.False(File.Exists(backupPath + "-wal"));
+        Assert.False(File.Exists(backupPath + "-shm"));
+
+        await source.CloseAsync();
+        await using SqliteConnection backup = Open(backupPath, SqliteOpenMode.ReadOnly);
+        await backup.OpenAsync();
+        Assert.Equal(
+            "openai",
+            Convert.ToString(await ScalarObjectAsync(
+                backup,
+                "SELECT model_provider FROM threads WHERE id = 'wal-row'")));
+    }
+
+    [Fact]
+    public async Task OnlineBackup_DoesNotRecreateSourceDatabaseThatDisappeared()
+    {
+        await using Fixture fixture = Fixture.Create();
+        string backupPath = Path.Combine(fixture.Root, "backup", "state_5.sqlite");
+        await using (SqliteConnection source = Open(fixture.DbPath))
+        {
+            await source.OpenAsync();
+            await ExecuteAsync(source, "CREATE TABLE threads (id TEXT PRIMARY KEY, model_provider TEXT)");
+        }
+        File.Delete(fixture.DbPath);
+        CodexStorageLayout boundStorage = fixture.Storage with
+        {
+            StateDbLocation = new StateDbLocation(
+                fixture.DbPath,
+                AppConstants.DbFileBasename,
+                "explicit")
+        };
+
+        await Assert.ThrowsAnyAsync<Exception>(
+            () => fixture.Service.CreateSqliteOnlineBackupAsync(boundStorage, backupPath));
+
+        Assert.False(File.Exists(fixture.DbPath));
+        Assert.False(File.Exists(backupPath));
+    }
+
+    [Fact]
+    public async Task ManagedBackup_SnapshotsLiveWal_AndManifestsOnlyStandaloneMainDatabases()
+    {
+        await using Fixture fixture = Fixture.Create();
+        string configPath = Path.Combine(fixture.CodexHome, "config.toml");
+        await File.WriteAllTextAsync(configPath, "model_provider = \"openai\"\n");
+
+        await using SqliteConnection source = Open(fixture.DbPath);
+        await source.OpenAsync();
+        Assert.Equal("wal", Convert.ToString(await ScalarObjectAsync(source, "PRAGMA journal_mode = WAL")));
+        await ExecuteAsync(source, """
+            CREATE TABLE threads (id TEXT PRIMARY KEY, model_provider TEXT);
+            INSERT INTO threads VALUES ('live-wal-row', 'apigather');
+            """);
+        Assert.True(new FileInfo(fixture.DbPath + "-wal").Length > 0);
+
+        BackupService backups = new(new SessionRolloutService(), fixture.Service);
+        string backupDir = await backups.CreateBackupAsync(
+            fixture.Storage,
+            "openai",
+            [],
+            configPath);
+
+        using JsonDocument metadata = JsonDocument.Parse(
+            await File.ReadAllTextAsync(Path.Combine(backupDir, "metadata.json")));
+        Assert.Equal(
+            [AppConstants.DbFileBasename],
+            metadata.RootElement.GetProperty("sqliteDbFiles")
+                .EnumerateArray()
+                .Select(static value => value.GetString()!)
+                .ToArray());
+        Assert.Equal(
+            [Path.Combine(AppConstants.SqliteDirBasename, AppConstants.DbFileBasename)],
+            metadata.RootElement.GetProperty("dbFiles")
+                .EnumerateArray()
+                .Select(static value => value.GetString()!)
+                .ToArray());
+
+        string canonicalBackupPath = Path.Combine(
+            backupDir,
+            "db",
+            "sqlite-home",
+            AppConstants.DbFileBasename);
+        string legacyMirrorPath = Path.Combine(
+            backupDir,
+            "db",
+            AppConstants.SqliteDirBasename,
+            AppConstants.DbFileBasename);
+        foreach (string backupPath in new[] { canonicalBackupPath, legacyMirrorPath })
+        {
+            Assert.True(File.Exists(backupPath));
+            Assert.False(File.Exists(backupPath + "-wal"));
+            Assert.False(File.Exists(backupPath + "-shm"));
+        }
+
+        await using (SqliteConnection backup = Open(canonicalBackupPath, SqliteOpenMode.ReadOnly))
+        {
+            await backup.OpenAsync();
+            Assert.Equal(
+                "apigather",
+                Convert.ToString(await ScalarObjectAsync(
+                    backup,
+                    "SELECT model_provider FROM threads WHERE id = 'live-wal-row'")));
+        }
+
+        await ExecuteAsync(source, """
+            UPDATE threads
+            SET model_provider = 'live-after-backup'
+            WHERE id = 'live-wal-row';
+            INSERT INTO threads VALUES ('live-only-row', 'live-after-backup');
+            """);
+        Assert.True(new FileInfo(fixture.DbPath + "-wal").Length > 0);
+
+        await backups.RestoreBackupAsync(
+            backupDir,
+            fixture.Storage,
+            new RestoreBackupOptions
+            {
+                RestoreConfig = false,
+                RestoreDatabase = true,
+                RestoreSessions = false
+            });
+        Assert.Equal(
+            "apigather",
+            Convert.ToString(await ScalarObjectAsync(
+                source,
+                "SELECT model_provider FROM threads WHERE id = 'live-wal-row'")));
+        Assert.Null(await ScalarObjectAsync(
+            source,
+            "SELECT model_provider FROM threads WHERE id = 'live-only-row'"));
+
+        await ExecuteAsync(source, """
+            UPDATE threads
+            SET model_provider = 'live-before-failed-restore'
+            WHERE id = 'live-wal-row';
+            INSERT INTO threads VALUES ('failed-restore-must-preserve', 'live-before-failed-restore');
+            """);
+        byte[] walBeforeFailure = await ReadSharedFileAsync(fixture.DbPath + "-wal");
+        await File.WriteAllTextAsync(canonicalBackupPath, "not a sqlite database");
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => backups.RestoreBackupAsync(
+                backupDir,
+                fixture.Storage,
+                new RestoreBackupOptions
+                {
+                    RestoreConfig = false,
+                    RestoreDatabase = true,
+                    RestoreSessions = false
+                }));
+        Assert.Contains("malformed", error.Message, StringComparison.OrdinalIgnoreCase);
+        Assert.Equal(walBeforeFailure, await ReadSharedFileAsync(fixture.DbPath + "-wal"));
+        Assert.Equal(
+            "live-before-failed-restore",
+            Convert.ToString(await ScalarObjectAsync(
+                source,
+                "SELECT model_provider FROM threads WHERE id = 'live-wal-row'")));
+        Assert.Equal(
+            "live-before-failed-restore",
+            Convert.ToString(await ScalarObjectAsync(
+                source,
+                "SELECT model_provider FROM threads WHERE id = 'failed-restore-must-preserve'")));
+    }
+
+    private sealed class Fixture : IAsyncDisposable
+    {
+        private Fixture(string root)
+        {
+            Root = root;
+            CodexHome = Path.Combine(root, "codex-home");
+            DbPath = Path.Combine(CodexHome, "sqlite", "state_5.sqlite");
+            Directory.CreateDirectory(Path.GetDirectoryName(DbPath)!);
+            Service = new SqliteStateService();
+            Storage = new CodexStorageLayoutService().CreateDefault(CodexHome);
+        }
+
+        public string Root { get; }
+        public string CodexHome { get; }
+        public string DbPath { get; }
+        public SqliteStateService Service { get; }
+        public CodexStorageLayout Storage { get; }
+
+        public static Fixture Create()
+        {
+            string root = Path.Combine(
+                Path.GetTempPath(),
+                $"provider-sync-sqlite-online-{Guid.NewGuid():N}");
+            Directory.CreateDirectory(root);
+            return new Fixture(root);
+        }
+
+        public ValueTask DisposeAsync()
+        {
+            try
+            {
+                Directory.Delete(Root, recursive: true);
+            }
+            catch
+            {
+                // SQLite teardown can briefly retain handles on Windows.
+            }
+            return ValueTask.CompletedTask;
+        }
+    }
+
+    private static SqliteConnection Open(
+        string dbPath,
+        SqliteOpenMode mode = SqliteOpenMode.ReadWriteCreate)
+    {
+        return new SqliteConnection(new SqliteConnectionStringBuilder
+        {
+            DataSource = dbPath,
+            Mode = mode,
+            Pooling = false
+        }.ConnectionString);
+    }
+
+    private static async Task ExecuteAsync(SqliteConnection connection, string sql)
+    {
+        await using SqliteCommand command = connection.CreateCommand();
+        command.CommandText = sql;
+        await command.ExecuteNonQueryAsync();
+    }
+
+    private static async Task<long> ScalarAsync(SqliteConnection connection, string sql)
+    {
+        return Convert.ToInt64(await ScalarObjectAsync(connection, sql));
+    }
+
+    private static async Task<object?> ScalarObjectAsync(SqliteConnection connection, string sql)
+    {
+        await using SqliteCommand command = connection.CreateCommand();
+        command.CommandText = sql;
+        return await command.ExecuteScalarAsync();
+    }
+
+    private static async Task<byte[]> ReadSharedFileAsync(string filePath)
+    {
+        await using FileStream stream = new(
+            filePath,
+            FileMode.Open,
+            FileAccess.Read,
+            FileShare.ReadWrite | FileShare.Delete,
+            4096,
+            FileOptions.Asynchronous | FileOptions.SequentialScan);
+        using MemoryStream copy = new();
+        await stream.CopyToAsync(copy);
+        return copy.ToArray();
+    }
+}
diff --git a/desktop/CodexProviderSync.Core.Tests/TransactionJournalTests.cs b/desktop/CodexProviderSync.Core.Tests/TransactionJournalTests.cs
new file mode 100644
index 0000000..4ab78f0
--- /dev/null
+++ b/desktop/CodexProviderSync.Core.Tests/TransactionJournalTests.cs
@@ -0,0 +1,208 @@
+using System.Text.Json;
+
+namespace CodexProviderSync.Core.Tests;
+
+public sealed class TransactionJournalTests
+{
+    [Fact]
+    public async Task AppendAsync_FailureBeforeWriteDoesNotConsumeSequence()
+    {
+        JournalFixture fixture = await JournalFixture.CreateAsync(1);
+        bool fail = true;
+        fixture.Journal.AppendFaultInjector = (phase, state) =>
+        {
+            if (fail && phase == "before-write" && state == "applying")
+            {
+                fail = false;
+                throw new IOException("injected before write");
+            }
+            return Task.CompletedTask;
+        };
+
+        await Assert.ThrowsAsync<IOException>(
+            () => fixture.Journal.ApplyingAsync("rollout", fixture.Targets[0]));
+        PendingTransactionInfo prepared = await fixture.Journal.ReadCurrentInfoAsync();
+        Assert.Equal(1, prepared.LastSequence);
+        Assert.Equal("prepared", prepared.State);
+
+        fixture.Journal.AppendFaultInjector = null;
+        await fixture.Journal.ApplyingAsync("rollout", fixture.Targets[0]);
+        await fixture.Journal.AppliedAsync("rollout", fixture.Targets[0]);
+        await fixture.Journal.CommittedAsync();
+
+        PendingTransactionInfo committed = await fixture.Journal.ReadCurrentInfoAsync();
+        Assert.Equal(4, committed.LastSequence);
+        Assert.True(committed.Terminal);
+    }
+
+    [Fact]
+    public async Task AppendAsync_FailureAfterReadableWriteResynchronizesSequence()
+    {
+        JournalFixture fixture = await JournalFixture.CreateAsync(1);
+        fixture.Journal.AppendFaultInjector = (phase, state) =>
+        {
+            if (phase == "after-write-before-flush" && state == "applying")
+            {
+                throw new IOException("write reported failure after bytes became readable");
+            }
+            return Task.CompletedTask;
+        };
+
+        await Assert.ThrowsAsync<IOException>(
+            () => fixture.Journal.ApplyingAsync("rollout", fixture.Targets[0]));
+        PendingTransactionInfo applying = await fixture.Journal.ReadCurrentInfoAsync();
+        Assert.Equal(2, applying.LastSequence);
+        Assert.Equal("applying", applying.State);
+
+        fixture.Journal.AppendFaultInjector = null;
+        await fixture.Journal.AppliedAsync("rollout", fixture.Targets[0]);
+        await fixture.Journal.CommittedAsync();
+        Assert.True((await fixture.Journal.ReadCurrentInfoAsync()).Terminal);
+    }
+
+    [Fact]
+    public async Task AppendAsync_ResynchronizesFromValidExternallyAppendedRecord()
+    {
+        JournalFixture fixture = await JournalFixture.CreateAsync(1);
+        PendingTransactionInfo prepared = await fixture.Journal.ReadCurrentInfoAsync();
+        string applying = JsonSerializer.Serialize(new
+        {
+            protocolVersion = 1,
+            operationId = prepared.OperationId,
+            sequence = 2,
+            state = "applying",
+            recordedAt = DateTimeOffset.UtcNow,
+            kind = "rollout",
+            targetPath = Path.GetFullPath(fixture.Targets[0])
+        });
+        await File.AppendAllTextAsync(fixture.Journal.FilePath, applying + "\n");
+
+        await fixture.Journal.AppliedAsync("rollout", fixture.Targets[0]);
+        PendingTransactionInfo applied = await fixture.Journal.ReadCurrentInfoAsync();
+        Assert.Equal(3, applied.LastSequence);
+        Assert.Equal("applied", applied.State);
+        Assert.False(applied.InvalidTail);
+    }
+
+    [Fact]
+    public async Task AppendAsync_ValidatesTargetTransitionBeforeWriting()
+    {
+        JournalFixture fixture = await JournalFixture.CreateAsync(1);
+        string before = await File.ReadAllTextAsync(fixture.Journal.FilePath);
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => fixture.Journal.AppliedAsync("rollout", fixture.Targets[0]));
+
+        Assert.Contains("must be applying", error.Message);
+        Assert.Equal(before, await File.ReadAllTextAsync(fixture.Journal.FilePath));
+    }
+
+    [Fact]
+    public async Task AppendAsync_SerializesConcurrentAppendsAgainstFreshJournalState()
+    {
+        JournalFixture fixture = await JournalFixture.CreateAsync(2);
+
+        await Task.WhenAll(
+            fixture.Journal.ApplyingAsync("rollout", fixture.Targets[0]),
+            fixture.Journal.ApplyingAsync("rollout", fixture.Targets[1]));
+
+        PendingTransactionInfo info = await fixture.Journal.ReadCurrentInfoAsync();
+        Assert.Equal(3, info.LastSequence);
+        Assert.Equal(2, info.AffectedTargets.Count(static target => target.State == "applying"));
+        Assert.False(info.InvalidTail);
+    }
+
+    [Fact]
+    public async Task TerminalAppend_ReReadsJournalAndRejectsConcurrentTail()
+    {
+        JournalFixture fixture = await JournalFixture.CreateAsync(0);
+        fixture.Journal.AppendFaultInjector = async (phase, state) =>
+        {
+            if (phase != "after-flush-before-verify" || state != "committed")
+            {
+                return;
+            }
+            PendingTransactionInfo committed = await FileTransactionJournal.ReadInfoAsync(
+                fixture.Journal.FilePath);
+            string impossibleTail = JsonSerializer.Serialize(new
+            {
+                protocolVersion = 1,
+                operationId = committed.OperationId,
+                sequence = committed.LastSequence + 1,
+                state = "rollingBack",
+                recordedAt = DateTimeOffset.UtcNow,
+                originalError = "forged after commit"
+            });
+            await File.AppendAllTextAsync(fixture.Journal.FilePath, impossibleTail + "\n");
+        };
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => fixture.Journal.CommittedAsync());
+
+        Assert.Contains("could not be verified", error.Message);
+        PendingTransactionInfo pending = await fixture.Journal.ReadCurrentInfoAsync();
+        Assert.True(pending.InvalidTail);
+        Assert.False(pending.Terminal);
+    }
+
+    [Fact]
+    public async Task CommittedAppend_ApiFailureAfterDurableWriteReconcilesWithoutRollback()
+    {
+        JournalFixture fixture = await JournalFixture.CreateAsync(0);
+        fixture.Journal.AppendFaultInjector = (phase, state) =>
+            phase == "after-flush-before-verify" && state == "committed"
+                ? Task.FromException(new IOException("injected post-flush reporting failure"))
+                : Task.CompletedTask;
+
+        await fixture.Journal.CommittedAsync();
+
+        PendingTransactionInfo committed = await fixture.Journal.ReadCurrentInfoAsync();
+        Assert.True(committed.Terminal);
+        Assert.Equal("committed", committed.State);
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => fixture.Journal.RollingBackAsync(new IOException("must not roll back")));
+    }
+
+    [Fact]
+    public async Task CommittedJournal_RejectsRollbackWithoutAppendingOrLosingTerminalState()
+    {
+        JournalFixture fixture = await JournalFixture.CreateAsync(0);
+        await fixture.Journal.CommittedAsync();
+        string committedBytes = await File.ReadAllTextAsync(fixture.Journal.FilePath);
+
+        InvalidOperationException error = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => fixture.Journal.RollingBackAsync(new IOException("too late")));
+
+        Assert.Contains("already terminal", error.Message);
+        Assert.Equal(committedBytes, await File.ReadAllTextAsync(fixture.Journal.FilePath));
+        PendingTransactionInfo committed = await fixture.Journal.ReadCurrentInfoAsync();
+        Assert.True(committed.Terminal);
+        Assert.Equal("committed", committed.State);
+    }
+
+    private sealed record JournalFixture(
+        string Root,
+        FileTransactionJournal Journal,
+        IReadOnlyList<string> Targets)
+    {
+        internal static async Task<JournalFixture> CreateAsync(int targetCount)
+        {
+            string root = Path.Combine(
+                Path.GetTempPath(),
+                $"codex-provider-journal-{Guid.NewGuid():N}");
+            string backupDir = Path.Combine(root, "backup");
+            string codexHome = Path.Combine(root, ".codex");
+            Directory.CreateDirectory(backupDir);
+            Directory.CreateDirectory(codexHome);
+            string[] targets = Enumerable.Range(0, targetCount)
+                .Select(index => Path.Combine(codexHome, $"rollout-{index}.jsonl"))
+                .ToArray();
+            FileTransactionJournal journal = await FileTransactionJournal.CreateAsync(
+                backupDir,
+                codexHome,
+                "target-provider",
+                targets);
+            return new JournalFixture(root, journal, targets);
+        }
+    }
+}
diff --git a/desktop/CodexProviderSync.Core/AtomicFile.cs b/desktop/CodexProviderSync.Core/AtomicFile.cs
new file mode 100644
index 0000000..b95035f
--- /dev/null
+++ b/desktop/CodexProviderSync.Core/AtomicFile.cs
@@ -0,0 +1,186 @@
+using System.Text;
+
+namespace CodexProviderSync.Core;
+
+internal static class AtomicFile
+{
+    internal static async Task<bool> CopyAsync(
+        string sourcePath,
+        string destinationPath,
+        bool overwrite,
+        CancellationToken cancellationToken = default,
+        Func<string, string, string, Task>? faultInjector = null)
+    {
+        string fullSourcePath = Path.GetFullPath(sourcePath);
+        if (!File.Exists(fullSourcePath))
+        {
+            return false;
+        }
+
+        string fullDestinationPath = Path.GetFullPath(destinationPath);
+        string? directory = Path.GetDirectoryName(fullDestinationPath);
+        if (string.IsNullOrEmpty(directory))
+        {
+            throw new InvalidOperationException($"Cannot resolve the parent directory for {fullDestinationPath}.");
+        }
+        if (!overwrite && File.Exists(fullDestinationPath))
+        {
+            throw new IOException($"The destination file already exists: {fullDestinationPath}");
+        }
+
+        Directory.CreateDirectory(directory);
+        string tempPath = CreateTempPath(directory, Path.GetFileName(fullDestinationPath));
+        UnixFileMode? sourceMode = TryGetUnixMode(fullSourcePath);
+        try
+        {
+            await using (FileStream source = new(
+                fullSourcePath,
+                FileMode.Open,
+                FileAccess.Read,
+                FileShare.ReadWrite | FileShare.Delete,
+                64 * 1024,
+                FileOptions.Asynchronous | FileOptions.SequentialScan))
+            await using (FileStream destination = new(
+                tempPath,
+                FileMode.CreateNew,
+                FileAccess.Write,
+                FileShare.None,
+                64 * 1024,
+                FileOptions.Asynchronous | FileOptions.WriteThrough))
+            {
+                if (faultInjector is not null)
+                {
+                    await faultInjector("before_stage_write", fullDestinationPath, tempPath);
+                }
+                await source.CopyToAsync(destination, cancellationToken);
+                await destination.FlushAsync(cancellationToken);
+                destination.Flush(flushToDisk: true);
+            }
+
+            File.SetLastWriteTimeUtc(tempPath, File.GetLastWriteTimeUtc(fullSourcePath));
+            ApplyUnixMode(tempPath, sourceMode ?? OwnerReadWriteMode);
+            if (faultInjector is not null)
+            {
+                await faultInjector("before_atomic_replace", fullDestinationPath, tempPath);
+            }
+            File.Move(tempPath, fullDestinationPath, overwrite);
+            return true;
+        }
+        catch
+        {
+            TryDelete(tempPath);
+            throw;
+        }
+    }
+
+    internal static async Task WriteAllTextAsync(
+        string filePath,
+        string content,
+        CancellationToken cancellationToken = default,
+        Func<string, string, string, Task>? faultInjector = null)
+    {
+        string fullPath = Path.GetFullPath(filePath);
+        string? directory = Path.GetDirectoryName(fullPath);
+        if (string.IsNullOrEmpty(directory))
+        {
+            throw new InvalidOperationException($"Cannot resolve the parent directory for {fullPath}.");
+        }
+
+        Directory.CreateDirectory(directory);
+        string tempPath = CreateTempPath(directory, Path.GetFileName(fullPath));
+        UnixFileMode targetMode = TryGetUnixMode(fullPath) ?? OwnerReadWriteMode;
+        try
+        {
+            byte[] bytes = new UTF8Encoding(encoderShouldEmitUTF8Identifier: false).GetBytes(content);
+            await using (FileStream stream = new(
+                tempPath,
+                FileMode.CreateNew,
+                FileAccess.Write,
+                FileShare.None,
+                64 * 1024,
+                FileOptions.Asynchronous | FileOptions.WriteThrough))
+            {
+                if (faultInjector is not null)
+                {
+                    await faultInjector("before_stage_write", fullPath, tempPath);
+                }
+                await stream.WriteAsync(bytes, cancellationToken);
+                await stream.FlushAsync(cancellationToken);
+                stream.Flush(flushToDisk: true);
+            }
+            ApplyUnixMode(tempPath, targetMode);
+            if (faultInjector is not null)
+            {
+                await faultInjector("before_atomic_replace", fullPath, tempPath);
+            }
+            File.Move(tempPath, fullPath, overwrite: true);
+        }
+        catch
+        {
+            TryDelete(tempPath);
+            throw;
+        }
+    }
+
+    private static string CreateTempPath(string directory, string fileName)
+    {
+        return Path.Combine(
+            directory,
+            $".{fileName}.provider-sync.{Environment.ProcessId}.{Guid.NewGuid():N}.tmp");
+    }
+
+    internal static async Task ReplaceOpenFileFromTempAsync(FileStream destination, string tempPath)
+    {
+        string destinationPath = destination.Name;
+        UnixFileMode targetMode = TryGetUnixMode(destinationPath) ?? OwnerReadWriteMode;
+        await using (FileStream staged = new(
+            tempPath,
+            FileMode.Open,
+            FileAccess.ReadWrite,
+            FileShare.None,
+            64 * 1024,
+            FileOptions.Asynchronous | FileOptions.WriteThrough))
+        {
+            await staged.FlushAsync();
+            staged.Flush(flushToDisk: true);
+        }
+
+        ApplyUnixMode(tempPath, targetMode);
+        await destination.DisposeAsync();
+        File.Move(tempPath, destinationPath, overwrite: true);
+    }
+
+    private const UnixFileMode OwnerReadWriteMode = UnixFileMode.UserRead | UnixFileMode.UserWrite;
+
+    private static UnixFileMode? TryGetUnixMode(string path)
+    {
+        if (OperatingSystem.IsWindows() || !File.Exists(path))
+        {
+            return null;
+        }
+        return File.GetUnixFileMode(path);
+    }
+
+    private static void ApplyUnixMode(string path, UnixFileMode mode)
+    {
+        if (!OperatingSystem.IsWindows())
+        {
+            File.SetUnixFileMode(path, mode);
+        }
+    }
+
+    private static void TryDelete(string path)
+    {
+        try
+        {
+            if (File.Exists(path))
+            {
+                File.Delete(path);
+            }
+        }
+        catch
+        {
+            // Cleanup must not hide the original write failure.
+        }
+    }
+}
diff --git a/desktop/CodexProviderSync.Core/BackupService.cs b/desktop/CodexProviderSync.Core/BackupService.cs
index a6a1e25..a12fd41 100644
--- a/desktop/CodexProviderSync.Core/BackupService.cs
+++ b/desktop/CodexProviderSync.Core/BackupService.cs
@@ -7,6 +7,8 @@ public sealed class BackupService
     private readonly SessionRolloutService _sessionRolloutService;
     private readonly SqliteStateService _sqliteStateService;
 
+    internal Func<string, string, string, Task>? AtomicWriteFaultInjector { get; set; }
+
     public BackupService(SessionRolloutService sessionRolloutService, SqliteStateService sqliteStateService)
     {
         _sessionRolloutService = sessionRolloutService;
@@ -48,32 +50,40 @@ public async Task<string> CreateBackupAsync(
         string actualSqliteHome = stateDb is null ? storage.SqliteHome : Path.GetDirectoryName(stateDb.Path)!;
         if (stateDb is not null)
         {
-            foreach (string suffix in new[] { string.Empty, "-shm", "-wal" })
+            string sqliteRelativePath = AppConstants.DbFileBasename;
+            string sqliteBackupPath = Path.Combine(dbDir, "sqlite-home", sqliteRelativePath);
+            CodexStorageLayout detectedStorage = storage with { StateDbLocation = stateDb };
+            SqliteOnlineBackupResult sqliteBackup = await _sqliteStateService.CreateSqliteOnlineBackupAsync(
+                detectedStorage,
+                sqliteBackupPath);
+            if (!sqliteBackup.DatabasePresent)
             {
-                string sourcePath = stateDb.Path + suffix;
-                string sqliteRelativePath = AppConstants.DbFileBasename + suffix;
-                if (!await CopyIfPresentAsync(
-                    sourcePath,
-                    Path.Combine(dbDir, "sqlite-home", sqliteRelativePath),
-                    overwrite: false))
-                {
-                    continue;
-                }
+                throw new InvalidOperationException(
+                    $"state_5.sqlite disappeared while creating a backup: {stateDb.Path}");
+            }
+            copiedSqliteDbFiles.Add(sqliteRelativePath);
 
-                copiedSqliteDbFiles.Add(sqliteRelativePath);
-                string? legacyRelativePath = SafeRelativePath(codexHome, sourcePath);
-                if (legacyRelativePath is not null)
-                {
-                    await CopyIfPresentAsync(sourcePath, Path.Combine(dbDir, legacyRelativePath), overwrite: false);
-                    copiedDbFiles.Add(legacyRelativePath);
-                }
+            // Keep the v2 legacy mirror for readers that still consult DbFiles,
+            // but derive it from the consistent standalone snapshot. Never
+            // copy live WAL/SHM sidecars independently into a managed backup.
+            string? legacyRelativePath = SafeRelativePath(codexHome, stateDb.Path);
+            if (legacyRelativePath is not null)
+            {
+                await AtomicFile.CopyAsync(
+                    sqliteBackupPath,
+                    Path.Combine(dbDir, legacyRelativePath),
+                    overwrite: false);
+                copiedDbFiles.Add(legacyRelativePath);
             }
         }
 
         string configBackupPath = Path.Combine(backupDir, "config.toml");
         if (configBackupText is not null)
         {
-            await File.WriteAllTextAsync(configBackupPath, configBackupText);
+            await AtomicFile.WriteAllTextAsync(
+                configBackupPath,
+                configBackupText,
+                faultInjector: AtomicWriteFaultInjector);
         }
         else
         {
@@ -96,20 +106,17 @@ await CopyIfPresentAsync(
             CodexHome = codexHome,
             TargetProvider = targetProvider,
             CreatedAt = createdAt,
-            Files = sessionChanges.Select(static change => new SessionBackupManifestEntry
-            {
-                Path = change.Path,
-                OriginalFirstLine = change.OriginalFirstLine,
-                OriginalSeparator = change.OriginalSeparator,
-                OriginalLastWriteTimeUtcTicks = change.OriginalLastWriteTimeUtcTicks,
-                ModelOnlyChange = change.ModelOnlyChange,
-                OriginalTurnContextModels = [.. change.OriginalTurnContextModels]
-            }).ToList()
+            Files = sessionChanges.Select(SessionBackupManifestEntry.FromChange).ToList()
         };
-        await File.WriteAllTextAsync(
+        await AtomicFile.WriteAllTextAsync(
             Path.Combine(backupDir, "session-meta-backup.json"),
-            JsonSerializer.Serialize(sessionManifest, JsonOptions()));
+            JsonSerializer.Serialize(sessionManifest, JsonOptions()),
+            faultInjector: AtomicWriteFaultInjector);
 
+        bool globalStateFilePresent = File.Exists(
+            Path.Combine(codexHome, AppConstants.GlobalStateFileBasename));
+        bool globalStateBackupFilePresent = File.Exists(
+            Path.Combine(codexHome, AppConstants.GlobalStateBackupFileBasename));
         BackupMetadataFile metadata = new()
         {
             Version = 2,
@@ -120,11 +127,19 @@ await File.WriteAllTextAsync(
             CreatedAt = createdAt,
             DbFiles = copiedDbFiles,
             SqliteDbFiles = copiedSqliteDbFiles,
-            ChangedSessionFiles = sessionChanges.Count
+            ChangedSessionFiles = sessionChanges.Count,
+            GlobalStateFiles = new Dictionary<string, bool>(StringComparer.Ordinal)
+            {
+                [AppConstants.GlobalStateFileBasename] = globalStateFilePresent,
+                [AppConstants.GlobalStateBackupFileBasename] = globalStateBackupFilePresent
+            },
+            GlobalStateFilePresent = globalStateFilePresent,
+            GlobalStateBackupFilePresent = globalStateBackupFilePresent
         };
-        await File.WriteAllTextAsync(
+        await AtomicFile.WriteAllTextAsync(
             Path.Combine(backupDir, "metadata.json"),
-            JsonSerializer.Serialize(metadata, JsonOptions()));
+            JsonSerializer.Serialize(metadata, JsonOptions()),
+            faultInjector: AtomicWriteFaultInjector);
 
         return backupDir;
     }
@@ -165,6 +180,11 @@ await File.ReadAllTextAsync(metadataPath),
             throw new InvalidOperationException($"Backup was created for {metadata.CodexHome}, not {codexHome}.");
         }
 
+        if (options.RestoreConfig)
+        {
+            ValidateGlobalStatePresenceMetadata(metadata);
+        }
+
         SessionBackupManifest? sessionManifest = null;
         if (options.RestoreSessions)
         {
@@ -172,12 +192,14 @@ await File.ReadAllTextAsync(metadataPath),
                 await File.ReadAllTextAsync(Path.Combine(normalizedBackupDir, "session-meta-backup.json")),
                 JsonOptions()) ?? throw new InvalidOperationException($"Session backup manifest is invalid: {backupDir}");
 
+            ValidateSessionManifest(sessionManifest, codexHome, normalizedBackupDir);
+            sessionManifest = await SelectSessionEntriesForRestoreAsync(normalizedBackupDir, sessionManifest);
+
             await _sessionRolloutService.AssertSessionFilesWritableAsync(
                 sessionManifest.Files.Select(static entry => entry.Path));
         }
 
-        List<(string SourcePath, string TargetPath)> databaseEntries = [];
-        List<string> sidecarsToRemove = [];
+        (string SourcePath, string TargetPath)? databaseRestorePlan = null;
         if (options.RestoreDatabase)
         {
             StateDbLocation? stateDb = storage.StateDbLocation ?? _sqliteStateService.DetectStateDb(storage);
@@ -232,22 +254,14 @@ await _sessionRolloutService.AssertSessionFilesWritableAsync(
                 {
                     throw new InvalidOperationException($"Backup declares a missing SQLite file: {sourcePath}");
                 }
-                databaseEntries.Add((sourcePath, targetPath));
-            }
-
-            HashSet<string> backedUpFiles = new(databaseFiles, StringComparer.Ordinal);
-            foreach (string baseFile in databaseFiles.Where(
-                static fileName => Path.GetFileName(fileName) == AppConstants.DbFileBasename))
-            {
-                string basePath = metadata.Version >= 2
-                    ? RestoreSqliteTargetPath(restoreRoot, baseFile)
-                    : RestoreDbTargetPath(restoreRoot, baseFile);
-                foreach (string suffix in new[] { "-shm", "-wal" })
+                if (Path.GetFileName(fileName) == AppConstants.DbFileBasename)
                 {
-                    if (!backedUpFiles.Contains(baseFile + suffix))
+                    if (databaseRestorePlan is not null)
                     {
-                        sidecarsToRemove.Add(basePath + suffix);
+                        throw new InvalidOperationException(
+                            "Backup must contain exactly one state_5.sqlite restore source.");
                     }
+                    databaseRestorePlan = (sourcePath, targetPath);
                 }
             }
         }
@@ -261,21 +275,11 @@ await CopyIfPresentAsync(
             await RestoreGlobalStateFilesAsync(normalizedBackupDir, codexHome);
         }
 
-        if (options.RestoreDatabase)
+        if (options.RestoreDatabase && databaseRestorePlan is { } restorePlan)
         {
-            foreach (string sidecarPath in sidecarsToRemove)
-            {
-                if (File.Exists(sidecarPath))
-                {
-                    File.Delete(sidecarPath);
-                }
-            }
-
-            foreach ((string sourcePath, string targetPath) in databaseEntries)
-            {
-                Directory.CreateDirectory(Path.GetDirectoryName(targetPath)!);
-                File.Copy(sourcePath, targetPath, overwrite: true);
-            }
+            await _sqliteStateService.RestoreSqliteOnlineBackupAsync(
+                restorePlan.SourcePath,
+                restorePlan.TargetPath);
         }
 
         if (options.RestoreSessions && sessionManifest is not null)
@@ -313,15 +317,7 @@ await File.ReadAllTextAsync(metadataPath),
             CodexHome = sessionManifest.CodexHome,
             TargetProvider = sessionManifest.TargetProvider,
             CreatedAt = sessionManifest.CreatedAt,
-            Files = sessionChanges.Select(static change => new SessionBackupManifestEntry
-            {
-                Path = change.Path,
-                OriginalFirstLine = change.OriginalFirstLine,
-                OriginalSeparator = change.OriginalSeparator,
-                OriginalLastWriteTimeUtcTicks = change.OriginalLastWriteTimeUtcTicks,
-                ModelOnlyChange = change.ModelOnlyChange,
-                OriginalTurnContextModels = [.. change.OriginalTurnContextModels]
-            }).ToList()
+            Files = sessionChanges.Select(SessionBackupManifestEntry.FromChange).ToList()
         };
         metadata = new BackupMetadataFile
         {
@@ -333,24 +329,129 @@ await File.ReadAllTextAsync(metadataPath),
             CreatedAt = metadata.CreatedAt,
             DbFiles = metadata.DbFiles,
             SqliteDbFiles = metadata.SqliteDbFiles,
-            ChangedSessionFiles = sessionChanges.Count
+            ChangedSessionFiles = sessionChanges.Count,
+            GlobalStateFiles = metadata.GlobalStateFiles,
+            GlobalStateFilePresent = metadata.GlobalStateFilePresent,
+            GlobalStateBackupFilePresent = metadata.GlobalStateBackupFilePresent
         };
 
-        await File.WriteAllTextAsync(manifestPath, JsonSerializer.Serialize(sessionManifest, JsonOptions()));
-        await File.WriteAllTextAsync(metadataPath, JsonSerializer.Serialize(metadata, JsonOptions()));
+        await AtomicFile.WriteAllTextAsync(
+            manifestPath,
+            JsonSerializer.Serialize(sessionManifest, JsonOptions()),
+            faultInjector: AtomicWriteFaultInjector);
+        await AtomicFile.WriteAllTextAsync(
+            metadataPath,
+            JsonSerializer.Serialize(metadata, JsonOptions()),
+            faultInjector: AtomicWriteFaultInjector);
+    }
+
+    internal async Task<IReadOnlyList<SessionBackupManifestEntry>> ReadSessionBackupEntriesAsync(
+        string backupDir,
+        string codexHome)
+    {
+        string normalizedBackupDir = Path.GetFullPath(backupDir);
+        SessionBackupManifest manifest = JsonSerializer.Deserialize<SessionBackupManifest>(
+            await File.ReadAllTextAsync(Path.Combine(normalizedBackupDir, "session-meta-backup.json")),
+            JsonOptions()) ?? throw new InvalidOperationException($"Session backup manifest is invalid: {backupDir}");
+        ValidateSessionManifest(manifest, codexHome, normalizedBackupDir);
+        return manifest.Files;
+    }
+
+    internal async Task<BackupRecoveryCoverage> GetRecoveryCoverageAsync(
+        string backupDir,
+        string codexHome)
+    {
+        string normalizedBackupDir = Path.GetFullPath(backupDir);
+        BackupMetadataFile metadata = JsonSerializer.Deserialize<BackupMetadataFile>(
+            await File.ReadAllTextAsync(Path.Combine(normalizedBackupDir, "metadata.json")),
+            JsonOptions()) ?? throw new InvalidOperationException($"Backup metadata is invalid: {backupDir}");
+        if (!string.Equals(metadata.Namespace, AppConstants.BackupNamespace, StringComparison.Ordinal)
+            || metadata.Version is not (1 or 2)
+            || !PathsEqual(metadata.CodexHome, codexHome))
+        {
+            throw new InvalidOperationException($"Backup metadata is not valid for recovery: {backupDir}");
+        }
+
+        bool database = (metadata.Version >= 2 ? metadata.SqliteDbFiles : metadata.DbFiles)
+            .Any(static fileName => Path.GetFileName(fileName) == AppConstants.DbFileBasename);
+        bool sessions = false;
+        string sessionManifestPath = Path.Combine(normalizedBackupDir, "session-meta-backup.json");
+        if (File.Exists(sessionManifestPath))
+        {
+            sessions = (await ReadSessionBackupEntriesAsync(normalizedBackupDir, codexHome)).Count > 0;
+        }
+        bool? globalStatePresent = ResolveGlobalStatePresence(
+            metadata,
+            AppConstants.GlobalStateFileBasename);
+        bool? globalStateBackupPresent = ResolveGlobalStatePresence(
+            metadata,
+            AppConstants.GlobalStateBackupFileBasename);
+        bool config = File.Exists(Path.Combine(normalizedBackupDir, "config.toml"))
+            || globalStatePresent == true
+            || globalStateBackupPresent == true;
+        return new BackupRecoveryCoverage(config, database, sessions);
+    }
+
+    internal async Task RestoreConfigFileAsync(string backupDir, string codexHome)
+    {
+        string sourcePath = Path.Combine(Path.GetFullPath(backupDir), "config.toml");
+        if (!await CopyIfPresentAsync(sourcePath, Path.Combine(codexHome, "config.toml"), overwrite: true))
+        {
+            throw new InvalidOperationException($"Backup config is missing: {sourcePath}");
+        }
+    }
+
+    internal async Task RestoreGlobalStateTargetAsync(string backupDir, string codexHome, string targetPath)
+    {
+        string statePath = Path.GetFullPath(Path.Combine(codexHome, AppConstants.GlobalStateFileBasename));
+        string backupPath = Path.GetFullPath(Path.Combine(codexHome, AppConstants.GlobalStateBackupFileBasename));
+        string normalizedTarget = Path.GetFullPath(targetPath);
+        string fileName;
+        if (PathsEqual(normalizedTarget, statePath))
+        {
+            fileName = AppConstants.GlobalStateFileBasename;
+        }
+        else if (PathsEqual(normalizedTarget, backupPath))
+        {
+            fileName = AppConstants.GlobalStateBackupFileBasename;
+        }
+        else
+        {
+            throw new InvalidOperationException($"Unexpected global-state rollback target: {targetPath}");
+        }
+
+        string normalizedBackupDir = Path.GetFullPath(backupDir);
+        BackupMetadataFile metadata = JsonSerializer.Deserialize<BackupMetadataFile>(
+            await File.ReadAllTextAsync(Path.Combine(normalizedBackupDir, "metadata.json")),
+            JsonOptions()) ?? throw new InvalidOperationException($"Backup metadata is invalid: {backupDir}");
+        ValidateGlobalStatePresenceMetadata(metadata);
+        await RestoreOptionalFileAsync(
+            Path.Combine(normalizedBackupDir, fileName),
+            normalizedTarget,
+            ResolveGlobalStatePresence(metadata, fileName));
     }
 
     public async Task RestoreGlobalStateFilesAsync(string backupDir, string codexHome)
     {
         string normalizedBackupDir = Path.GetFullPath(backupDir);
-        await CopyIfPresentAsync(
+        string metadataPath = Path.Combine(normalizedBackupDir, "metadata.json");
+        BackupMetadataFile metadata = JsonSerializer.Deserialize<BackupMetadataFile>(
+            await File.ReadAllTextAsync(metadataPath),
+            JsonOptions()) ?? throw new InvalidOperationException($"Backup metadata is invalid: {backupDir}");
+        bool? globalStatePresent = ResolveGlobalStatePresence(
+            metadata,
+            AppConstants.GlobalStateFileBasename);
+        bool? globalStateBackupPresent = ResolveGlobalStatePresence(
+            metadata,
+            AppConstants.GlobalStateBackupFileBasename);
+        await RestoreOptionalFileAsync(
             Path.Combine(normalizedBackupDir, AppConstants.GlobalStateFileBasename),
             Path.Combine(codexHome, AppConstants.GlobalStateFileBasename),
-            overwrite: true);
-        await CopyIfPresentAsync(
+            globalStatePresent);
+        await RestoreOptionalFileAsync(
             Path.Combine(normalizedBackupDir, AppConstants.GlobalStateBackupFileBasename),
             Path.Combine(codexHome, AppConstants.GlobalStateBackupFileBasename),
-            overwrite: true);
+            globalStateBackupPresent);
     }
 
     public async Task<BackupStorageInfo> GetBackupStorageInfoAsync(string backupDir)
@@ -396,15 +497,71 @@ public Task<BackupSummary> GetBackupSummaryAsync(string codexHome)
         });
     }
 
-    public Task<BackupPruneResult> PruneBackupsAsync(string codexHome, int keepCount = AppConstants.DefaultBackupRetentionCount)
+    public async Task<BackupPruneResult> PruneBackupsAsync(string codexHome, int keepCount = AppConstants.DefaultBackupRetentionCount)
     {
         if (keepCount < 0)
         {
             throw new ArgumentOutOfRangeException(nameof(keepCount), keepCount, "keepCount must be 0 or greater.");
         }
 
+        return await PruneBackupsCoreAsync(codexHome, keepCount, reserveNewBackupSlot: false, null, null);
+    }
+
+    /// <summary>
+    /// Lists the managed backups that automatic sync/switch cleanup will delete.
+    /// The new backup has not been created while planning, so reserve its keep
+    /// slot explicitly instead of deriving it from timestamp-like directory names.
+    /// </summary>
+    public Task<IReadOnlyList<string>> GetAutomaticPruneDeletionCandidatesAsync(
+        string codexHome,
+        int keepCount)
+    {
+        if (keepCount < 1)
+        {
+            throw new ArgumentOutOfRangeException(nameof(keepCount), keepCount, "keepCount must be 1 or greater for automatic cleanup.");
+        }
+
+        return GetPruneDeletionCandidatesAsync(codexHome, keepCount, reserveNewBackupSlot: true, null);
+    }
+
+    public Task<BackupPruneResult> PruneAutomaticBackupsAsync(
+        string codexHome,
+        int keepCount,
+        string backupDirectory,
+        IReadOnlyList<CoreWritePlanTarget>? allowedDeletionTargets = null)
+    {
+        if (keepCount < 1)
+        {
+            throw new ArgumentOutOfRangeException(nameof(keepCount), keepCount, "keepCount must be 1 or greater for automatic cleanup.");
+        }
+        ArgumentException.ThrowIfNullOrWhiteSpace(backupDirectory);
+
+        return PruneBackupsCoreAsync(
+            codexHome,
+            keepCount,
+            reserveNewBackupSlot: true,
+            backupDirectory,
+            allowedDeletionTargets);
+    }
+
+    private async Task<BackupPruneResult> PruneBackupsCoreAsync(
+        string codexHome,
+        int keepCount,
+        bool reserveNewBackupSlot,
+        string? preservedBackupDirectory,
+        IReadOnlyList<CoreWritePlanTarget>? allowedDeletionTargets)
+    {
         string backupRoot = AppConstants.DefaultBackupRoot(codexHome);
-        return Task.Run(() =>
+        IReadOnlyList<string> candidates = await GetPruneDeletionCandidatesAsync(
+            codexHome,
+            keepCount,
+            reserveNewBackupSlot,
+            preservedBackupDirectory);
+        if (allowedDeletionTargets is not null)
+        {
+            await AssertAutomaticPrunePlanMatchesAsync(candidates, allowedDeletionTargets);
+        }
+        return await Task.Run(() =>
         {
             if (!Directory.Exists(backupRoot))
             {
@@ -418,8 +575,9 @@ public Task<BackupPruneResult> PruneBackupsAsync(string codexHome, int keepCount
             }
 
             List<DirectoryInfo> entries = GetManagedBackupDirectories(backupRoot);
-
-            List<DirectoryInfo> toDelete = entries.Skip(keepCount).ToList();
+            List<DirectoryInfo> toDelete = entries
+                .Where(entry => candidates.Contains(Path.GetFullPath(entry.FullName), PathComparer))
+                .ToList();
             long freedBytes = 0;
             foreach (DirectoryInfo entry in toDelete)
             {
@@ -437,17 +595,249 @@ public Task<BackupPruneResult> PruneBackupsAsync(string codexHome, int keepCount
         });
     }
 
+    private static async Task AssertAutomaticPrunePlanMatchesAsync(
+        IReadOnlyList<string> candidates,
+        IReadOnlyList<CoreWritePlanTarget> allowedDeletionTargets)
+    {
+        HashSet<string> candidatePaths = new(candidates.Select(Path.GetFullPath), PathComparer);
+        HashSet<string> allowedPaths = new(
+            allowedDeletionTargets.Select(static target => Path.GetFullPath(target.Path)),
+            PathComparer);
+        if (!candidatePaths.SetEquals(allowedPaths))
+        {
+            throw new AutomaticPrunePlanStaleException(
+                "Automatic backup cleanup was skipped because its deletion candidates no longer match the checked plan.");
+        }
+
+        CoreWritePlanSnapshot actual = await CoreWriteSnapshotBuilder.BuildAsync(
+            "automatic-prune",
+            "checked-cleanup",
+            candidates.Select(static path => new CoreWriteTargetSpec(
+                path,
+                "delete",
+                CoreWriteFingerprintMode.RecursiveInventory)));
+        CoreWritePlanTarget[] expected = allowedDeletionTargets
+            .Select(static target => target with { Path = Path.GetFullPath(target.Path) })
+            .OrderBy(static target => target.Path, StringComparer.Ordinal)
+            .ThenBy(static target => target.Action, StringComparer.Ordinal)
+            .ThenBy(static target => target.Fingerprint, StringComparer.Ordinal)
+            .ToArray();
+        if (!actual.Targets.SequenceEqual(expected))
+        {
+            throw new AutomaticPrunePlanStaleException(
+                "Automatic backup cleanup was skipped because a planned backup changed after the checked plan was created.");
+        }
+    }
+
+    private static async Task<IReadOnlyList<string>> GetPruneDeletionCandidatesAsync(
+        string codexHome,
+        int keepCount,
+        bool reserveNewBackupSlot,
+        string? preservedBackupDirectory)
+    {
+        string backupRoot = AppConstants.DefaultBackupRoot(codexHome);
+        IReadOnlyList<PendingTransactionInfo> pending = await FileTransactionJournal.FindPendingAsync(codexHome);
+        HashSet<string> protectedBackups = new(
+            pending.Select(static transaction => Path.GetFullPath(transaction.BackupDir)),
+            PathComparer);
+        string? preserved = string.IsNullOrWhiteSpace(preservedBackupDirectory)
+            ? null
+            : Path.GetFullPath(preservedBackupDirectory);
+
+        return await Task.Run<IReadOnlyList<string>>(() =>
+        {
+            if (!Directory.Exists(backupRoot))
+            {
+                return [];
+            }
+
+            int existingKeepSlots = Math.Max(0, keepCount - (reserveNewBackupSlot ? 1 : 0));
+            return GetManagedBackupDirectories(backupRoot)
+                .Where(entry => preserved is null || !PathComparer.Equals(Path.GetFullPath(entry.FullName), preserved))
+                .Skip(existingKeepSlots)
+                .Where(entry => !protectedBackups.Contains(Path.GetFullPath(entry.FullName)))
+                .Select(static entry => Path.GetFullPath(entry.FullName))
+                .ToArray();
+        });
+    }
+
+    private static async Task<SessionBackupManifest> SelectSessionEntriesForRestoreAsync(
+        string backupDir,
+        SessionBackupManifest manifest)
+    {
+        string journalPath = Path.Combine(backupDir, FileTransactionJournal.FileName);
+        if (!File.Exists(journalPath))
+        {
+            return manifest;
+        }
+
+        PendingTransactionInfo journal = await FileTransactionJournal.ReadInfoAsync(journalPath);
+        if (string.IsNullOrWhiteSpace(journal.OperationId))
+        {
+            // A legacy or externally damaged journal cannot authoritatively
+            // narrow the immutable backup manifest. An explicit restore is
+            // safest when it restores the whole validated manifest.
+            return manifest;
+        }
+
+        HashSet<string> affectedRollouts = new(
+            journal.AffectedTargets
+                .Where(static target => target.Kind == "rollout")
+                .Select(static target => Path.GetFullPath(target.TargetPath)),
+            PathComparer);
+        return new SessionBackupManifest
+        {
+            Version = manifest.Version,
+            Namespace = manifest.Namespace,
+            CodexHome = manifest.CodexHome,
+            TargetProvider = manifest.TargetProvider,
+            CreatedAt = manifest.CreatedAt,
+            Files = manifest.Files
+                .Where(entry => affectedRollouts.Contains(Path.GetFullPath(entry.Path)))
+                .ToList()
+        };
+    }
+
+    private static void ValidateSessionManifest(
+        SessionBackupManifest manifest,
+        string codexHome,
+        string backupDir)
+    {
+        if (!string.Equals(manifest.Namespace, AppConstants.BackupNamespace, StringComparison.Ordinal)
+            || manifest.Version is not (1 or 2))
+        {
+            throw new InvalidOperationException(
+                $"Unsupported session backup manifest in {Path.Combine(backupDir, "session-meta-backup.json")}.");
+        }
+        if (!PathsEqual(manifest.CodexHome, codexHome))
+        {
+            throw new InvalidOperationException(
+                $"Session backup was created for {manifest.CodexHome}, not {codexHome}.");
+        }
+
+        HashSet<string> seen = new(PathComparer);
+        foreach (SessionBackupManifestEntry entry in manifest.Files)
+        {
+            string fullPath = ValidateSessionRestorePath(codexHome, entry.Path);
+            _ = entry.ResolveOriginalLastWriteTimeUtcTicks();
+            if (!seen.Add(fullPath))
+            {
+                throw new InvalidOperationException(
+                    $"Session backup manifest contains a duplicate rollout path: {entry.Path}");
+            }
+        }
+    }
+
+    private static string ValidateSessionRestorePath(string codexHome, string candidatePath)
+    {
+        if (string.IsNullOrWhiteSpace(candidatePath))
+        {
+            throw new InvalidOperationException("Session backup manifest contains an empty rollout path.");
+        }
+
+        string fullHome = Path.GetFullPath(codexHome);
+        string fullPath = Path.GetFullPath(candidatePath);
+        string relativePath = Path.GetRelativePath(fullHome, fullPath);
+        string[] segments = relativePath.Split(
+            [Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar],
+            StringSplitOptions.RemoveEmptyEntries);
+        bool validRoot = segments.Length >= 2
+            && AppConstants.SessionDirectories.Contains(segments[0], PathComparer);
+        if (Path.IsPathRooted(relativePath)
+            || relativePath == ".."
+            || relativePath.StartsWith(".." + Path.DirectorySeparatorChar, StringComparison.Ordinal)
+            || relativePath.StartsWith(".." + Path.AltDirectorySeparatorChar, StringComparison.Ordinal)
+            || !validRoot
+            || !Path.GetFileName(fullPath).StartsWith("rollout-", StringComparison.Ordinal)
+            || !string.Equals(Path.GetExtension(fullPath), ".jsonl", StringComparison.OrdinalIgnoreCase))
+        {
+            throw new InvalidOperationException(
+                $"Session backup path escapes the Codex rollout directories: {candidatePath}");
+        }
+
+        string currentPath = fullHome;
+        foreach (string segment in segments)
+        {
+            currentPath = Path.Combine(currentPath, segment);
+            if (!File.Exists(currentPath) && !Directory.Exists(currentPath))
+            {
+                continue;
+            }
+            if ((File.GetAttributes(currentPath) & FileAttributes.ReparsePoint) != 0)
+            {
+                throw new InvalidOperationException(
+                    $"Session backup path crosses a symbolic link or reparse point: {candidatePath}");
+            }
+        }
+        return fullPath;
+    }
+
+    private static StringComparer PathComparer => OperatingSystem.IsWindows()
+        ? StringComparer.OrdinalIgnoreCase
+        : StringComparer.Ordinal;
+
     private static async Task<bool> CopyIfPresentAsync(string sourcePath, string destinationPath, bool overwrite)
     {
-        if (!File.Exists(sourcePath))
+        return await AtomicFile.CopyAsync(sourcePath, destinationPath, overwrite);
+    }
+
+    private static async Task RestoreOptionalFileAsync(
+        string sourcePath,
+        string destinationPath,
+        bool? originallyPresent)
+    {
+        if (await CopyIfPresentAsync(sourcePath, destinationPath, overwrite: true))
         {
-            return false;
+            return;
         }
 
-        Directory.CreateDirectory(Path.GetDirectoryName(destinationPath)!);
-        File.Copy(sourcePath, destinationPath, overwrite);
-        await Task.CompletedTask;
-        return true;
+        if (originallyPresent == true)
+        {
+            throw new InvalidOperationException(
+                $"Backup declares an original file but the backup copy is missing: {sourcePath}");
+        }
+
+        // Nullable markers keep metadata v1 and early-v2 backups backward
+        // compatible. A new backup explicitly records absence so rollback can
+        // remove a .bak file created by the interrupted operation.
+        if (originallyPresent == false && File.Exists(destinationPath))
+        {
+            File.Delete(destinationPath);
+        }
+    }
+
+    private static bool? ResolveGlobalStatePresence(
+        BackupMetadataFile metadata,
+        string fileName)
+    {
+        bool? legacy = fileName switch
+        {
+            AppConstants.GlobalStateFileBasename => metadata.GlobalStateFilePresent,
+            AppConstants.GlobalStateBackupFileBasename => metadata.GlobalStateBackupFilePresent,
+            _ => throw new InvalidOperationException(
+                $"Unsupported global-state metadata key: {fileName}")
+        };
+        if (metadata.GlobalStateFiles is null)
+        {
+            return legacy;
+        }
+        if (!metadata.GlobalStateFiles.TryGetValue(fileName, out bool canonical))
+        {
+            throw new InvalidOperationException(
+                $"Backup globalStateFiles is missing required key {fileName}.");
+        }
+        if (legacy is not null && legacy.Value != canonical)
+        {
+            throw new InvalidOperationException(
+                $"Backup global-state metadata disagrees for {fileName}.");
+        }
+        return canonical;
+    }
+
+    private static void ValidateGlobalStatePresenceMetadata(BackupMetadataFile metadata)
+    {
+        _ = ResolveGlobalStatePresence(metadata, AppConstants.GlobalStateFileBasename);
+        _ = ResolveGlobalStatePresence(metadata, AppConstants.GlobalStateBackupFileBasename);
     }
 
     private static string? SafeRelativePath(string root, string target)
@@ -543,6 +933,8 @@ private static List<DirectoryInfo> GetManagedBackupDirectories(string backupRoot
             .ToList();
     }
 
+    private sealed class AutomaticPrunePlanStaleException(string message) : InvalidOperationException(message);
+
     private static bool IsManagedBackupDirectory(string backupDirectoryPath)
     {
         string metadataPath = Path.Combine(backupDirectoryPath, "metadata.json");
@@ -564,3 +956,5 @@ private static bool IsManagedBackupDirectory(string backupDirectoryPath)
         }
     }
 }
+
+internal sealed record BackupRecoveryCoverage(bool Config, bool Database, bool Sessions);
diff --git a/desktop/CodexProviderSync.Core/CodexProviderSync.Core.csproj b/desktop/CodexProviderSync.Core/CodexProviderSync.Core.csproj
index e96aa9f..de5ac19 100644
--- a/desktop/CodexProviderSync.Core/CodexProviderSync.Core.csproj
+++ b/desktop/CodexProviderSync.Core/CodexProviderSync.Core.csproj
@@ -4,9 +4,9 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
-    <Version>0.3.2</Version>
-    <AssemblyVersion>0.3.2.0</AssemblyVersion>
-    <FileVersion>0.3.2.0</FileVersion>
+    <Version>0.4.0</Version>
+    <AssemblyVersion>0.4.0.0</AssemblyVersion>
+    <FileVersion>0.4.0.0</FileVersion>
   </PropertyGroup>
 
   <ItemGroup>
diff --git a/desktop/CodexProviderSync.Core/CodexSyncService.cs b/desktop/CodexProviderSync.Core/CodexSyncService.cs
index fbcfe78..8778207 100644
--- a/desktop/CodexProviderSync.Core/CodexSyncService.cs
+++ b/desktop/CodexProviderSync.Core/CodexSyncService.cs
@@ -12,6 +12,8 @@ public sealed class CodexSyncService
     private readonly ProviderDiscoveryService _providerDiscoveryService;
     private readonly CodexStorageLayoutService _storageLayoutService;
 
+    internal Func<string, string?, int, Task>? FaultInjector { get; set; }
+
     public CodexSyncService()
         : this(
             new CodexHomeService(),
@@ -70,6 +72,7 @@ public async Task<StatusSnapshot> GetStatusAsync(
             ? []
             : await _globalStateService.ReadProjectThreadVisibilityAsync(storage);
         BackupSummary backupSummary = await _backupService.GetBackupSummaryAsync(codexHome);
+        IReadOnlyList<PendingTransactionInfo> pendingTransactions = await FileTransactionJournal.FindPendingAsync(codexHome);
 
         return new StatusSnapshot
         {
@@ -90,7 +93,14 @@ public async Task<StatusSnapshot> GetStatusAsync(
             SqliteRepairStats = sqliteRepairStats,
             ProjectThreadVisibility = projectThreadVisibility,
             BackupRoot = _codexHomeService.BackupRoot(codexHome),
-            BackupSummary = backupSummary
+            BackupSummary = backupSummary,
+            PendingTransactions = pendingTransactions
+                .Select(static item => new TransactionRecoveryInfo(
+                    item.OperationId,
+                    item.State,
+                    item.BackupDir,
+                    item.JournalPath))
+                .ToArray()
         };
     }
 
@@ -111,7 +121,8 @@ public Task<SyncResult> RunSyncAsync(
         int keepCount = AppConstants.DefaultBackupRetentionCount,
         int? sqliteBusyTimeoutMs = null,
         string? model = null,
-        string? explicitSqliteHome = null)
+        string? explicitSqliteHome = null,
+        CancellationToken cancellationToken = default)
     {
         return RunSyncCoreAsync(
             explicitCodexHome,
@@ -121,47 +132,97 @@ public Task<SyncResult> RunSyncAsync(
             sqliteBusyTimeoutMs,
             model,
             explicitSqliteHome,
-            afterBackup: null);
+            switchPreparationFactory: null,
+            expectedSnapshot: null,
+            snapshotExpiresAtUtc: null,
+            cancellationToken);
     }
 
-    private async Task<SyncResult> RunSyncCoreAsync(
-        string? explicitCodexHome,
+    public async Task<CoreWritePlanSnapshot> CreateSyncPlanSnapshotAsync(
+        string? explicitCodexHome = null,
+        string? provider = null,
+        int keepCount = AppConstants.DefaultBackupRetentionCount,
+        int? sqliteBusyTimeoutMs = null,
+        string? model = null,
+        string? explicitSqliteHome = null,
+        CancellationToken cancellationToken = default)
+    {
+        ValidateAutomaticRetention(keepCount);
+        string codexHome = _codexHomeService.NormalizeCodexHome(explicitCodexHome);
+        await _codexHomeService.EnsureCodexHomeAsync(codexHome);
+        await using LockHandle _ = await _lockService.AcquireLockAsync(codexHome, "plan-sync");
+        await FileTransactionJournal.AssertNoPendingAsync(codexHome);
+        SyncPreparation preparation = await PrepareSyncAsync(
+            codexHome,
+            provider,
+            sqliteBusyTimeoutMs,
+            model,
+            explicitSqliteHome,
+            switchPreparationFactory: null,
+            cancellationToken);
+        return await BuildSyncPlanSnapshotAsync(preparation, keepCount, cancellationToken);
+    }
+
+    public Task<SyncResult> RunSyncCheckedAsync(
+        CoreWritePlanSnapshot expectedSnapshot,
+        string? explicitCodexHome = null,
+        string? provider = null,
+        int keepCount = AppConstants.DefaultBackupRetentionCount,
+        int? sqliteBusyTimeoutMs = null,
+        string? model = null,
+        string? explicitSqliteHome = null,
+        DateTimeOffset? snapshotExpiresAtUtc = null,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(expectedSnapshot);
+        return RunSyncCoreAsync(
+            explicitCodexHome,
+            provider,
+            configBackupText: null,
+            keepCount,
+            sqliteBusyTimeoutMs,
+            model,
+            explicitSqliteHome,
+            switchPreparationFactory: null,
+            expectedSnapshot,
+            snapshotExpiresAtUtc,
+            cancellationToken);
+    }
+
+    private async Task<SyncPreparation> PrepareSyncAsync(
+        string codexHome,
         string? provider,
-        string? configBackupText,
-        int keepCount,
         int? sqliteBusyTimeoutMs,
         string? model,
         string? explicitSqliteHome,
-        Func<string, Task>? afterBackup)
+        Func<string, SwitchPreparation>? switchPreparationFactory,
+        CancellationToken cancellationToken)
     {
-        if (keepCount < 1)
-        {
-            throw new ArgumentOutOfRangeException(nameof(keepCount), keepCount, "keepCount must be 1 or greater for automatic cleanup.");
-        }
-
-        string codexHome = _codexHomeService.NormalizeCodexHome(explicitCodexHome);
-        await _codexHomeService.EnsureCodexHomeAsync(codexHome);
+        cancellationToken.ThrowIfCancellationRequested();
         string configPath = _codexHomeService.ConfigPath(codexHome);
         string configText = await _configFileService.ReadConfigTextAsync(configPath);
+        SwitchPreparation? switchPreparation = switchPreparationFactory?.Invoke(configText);
         CodexStorageLayout storage = await PrepareStorageAsync(codexHome, explicitSqliteHome, configText);
-        storage.EnsureSqliteAccessSupported("sync");
+        storage.EnsureSqliteAccessSupported(switchPreparation is null ? "sync" : "switch");
         EnsureWritableStorage(storage);
         CurrentProviderInfo current = _configFileService.ReadCurrentProviderFromConfigText(configText);
-        string targetProvider = provider ?? current.Provider ?? AppConstants.DefaultProvider;
+        string targetProvider = switchPreparation?.Provider
+            ?? provider
+            ?? current.Provider
+            ?? AppConstants.DefaultProvider;
 
         // When the caller did not pin a model, mirror the active root-level
         // `model = "..."` field from config.toml into the per-thread SQLite
         // `model` column. Without this, old sessions keep showing the model
         // they were created with in Codex's bottom-right UI label, even after
         // the root-level `model` changes.
-        string? targetModel = model;
+        string? targetModel = switchPreparation?.ThreadModel ?? model;
         if (string.IsNullOrEmpty(targetModel))
         {
             targetModel = _configFileService.ReadRootModelFromConfigText(configText);
         }
 
-        await using LockHandle _ = await _lockService.AcquireLockAsync(codexHome, "sync");
-
+        cancellationToken.ThrowIfCancellationRequested();
         SessionChangeCollection sessionInfo = await _sessionRolloutService.CollectSessionChangesAsync(
             codexHome,
             targetProvider,
@@ -171,7 +232,6 @@ private async Task<SyncResult> RunSyncCoreAsync(
         string? encryptedContentWarning = BuildEncryptedContentWarning(sessionInfo.EncryptedContentCounts, targetProvider);
         (IReadOnlyList<SessionChange> writableChanges, IReadOnlyList<SessionChange> lockedChanges) =
             await _sessionRolloutService.SplitLockedSessionChangesAsync(sessionInfo.Changes);
-
         List<string> skippedRolloutFiles = [.. sessionInfo.LockedPaths, .. lockedChanges.Select(static change => change.Path)];
         IReadOnlyList<string> skippedUnreadableRolloutFiles = sessionInfo.UnreadablePaths
             .Distinct(StringComparer.Ordinal)
@@ -179,15 +239,212 @@ private async Task<SyncResult> RunSyncCoreAsync(
             .ToList();
 
         await _sqliteStateService.AssertSqliteWritableAsync(storage, sqliteBusyTimeoutMs);
-        string backupDir = await _backupService.CreateBackupAsync(storage, targetProvider, writableChanges, configPath, configBackupText);
-        if (afterBackup is not null)
+        cancellationToken.ThrowIfCancellationRequested();
+        return new SyncPreparation(
+            codexHome,
+            configPath,
+            configText,
+            switchPreparation,
+            storage,
+            current,
+            targetProvider,
+            targetModel,
+            sessionInfo,
+            workspaceCwdStats,
+            encryptedContentWarning,
+            writableChanges,
+            skippedRolloutFiles,
+            skippedUnreadableRolloutFiles);
+    }
+
+    private async Task<CoreWritePlanSnapshot> BuildSyncPlanSnapshotAsync(
+        SyncPreparation preparation,
+        int keepCount,
+        CancellationToken cancellationToken)
+    {
+        string operation = preparation.SwitchPreparation is null ? "sync" : "switch";
+        List<CoreWriteTargetSpec> targets =
+        [
+            new(preparation.ConfigPath, preparation.SwitchPreparation is null ? "read" : "replace"),
+            new(
+                Path.Combine(preparation.CodexHome, "sessions"),
+                "scan",
+                CoreWriteFingerprintMode.RecursiveInventory),
+            new(
+                Path.Combine(preparation.CodexHome, "archived_sessions"),
+                "scan",
+                CoreWriteFingerprintMode.RecursiveInventory),
+            new(_globalStateService.StatePath(preparation.CodexHome), "replace-if-present"),
+            new(_globalStateService.BackupPath(preparation.CodexHome), "replace-if-present"),
+            new(
+                _codexHomeService.BackupRoot(preparation.CodexHome),
+                $"create-and-prune-to-{keepCount}",
+                CoreWriteFingerprintMode.RecursiveInventory)
+        ];
+        targets.AddRange(preparation.WritableChanges.Select(
+            static change => new CoreWriteTargetSpec(change.Path, "replace")));
+        if (preparation.Storage.StateDbLocation is { } stateDb)
+        {
+            targets.Add(new CoreWriteTargetSpec(
+                stateDb.Path,
+                "update",
+                CoreWriteFingerprintMode.SqliteMainContent));
+            targets.Add(new CoreWriteTargetSpec(
+                stateDb.Path + "-wal",
+                "update-if-present",
+                CoreWriteFingerprintMode.SqliteWalContent));
+        }
+
+        List<CoreWritePlanWarning> warnings = [];
+        if (preparation.SkippedRolloutFiles.Count > 0)
+        {
+            warnings.Add(new CoreWritePlanWarning(
+                "locked_rollout_files",
+                $"{preparation.SkippedRolloutFiles.Count} rollout file(s) are locked and will be skipped."));
+        }
+        if (preparation.SkippedUnreadableRolloutFiles.Count > 0)
+        {
+            warnings.Add(new CoreWritePlanWarning(
+                "unreadable_rollout_files",
+                $"{preparation.SkippedUnreadableRolloutFiles.Count} rollout file(s) are unreadable and will be skipped."));
+        }
+        if (preparation.EncryptedContentWarning is not null)
+        {
+            warnings.Add(new CoreWritePlanWarning("encrypted_content", preparation.EncryptedContentWarning));
+        }
+        if (preparation.SwitchPreparation?.ModelSync.Warning is { } modelWarning)
+        {
+            warnings.Add(new CoreWritePlanWarning("model_sync", modelWarning));
+        }
+
+        string binding = System.Text.Json.JsonSerializer.Serialize(new
+        {
+            operation,
+            preparation.CodexHome,
+            preparation.Storage.SqliteHome,
+            preparation.Storage.SqliteHomeSource,
+            preparation.TargetProvider,
+            preparation.TargetModel,
+            keepCount,
+            modelSync = preparation.SwitchPreparation?.ModelSync.Source
+        });
+        IReadOnlyList<string> automaticDeletionCandidates = await _backupService
+            .GetAutomaticPruneDeletionCandidatesAsync(preparation.CodexHome, keepCount);
+        return await CoreWriteSnapshotBuilder.BuildAsync(
+            operation,
+            binding,
+            targets,
+            automaticDeletionCandidates.Select(static path => new CoreWriteTargetSpec(
+                path,
+                "delete",
+                CoreWriteFingerprintMode.RecursiveInventory)),
+            warnings: warnings,
+            cancellationToken: cancellationToken);
+    }
+
+    private static void ValidateAutomaticRetention(int keepCount)
+    {
+        if (keepCount < 1)
         {
-            await afterBackup(backupDir);
+            throw new ArgumentOutOfRangeException(
+                nameof(keepCount),
+                keepCount,
+                "keepCount must be 1 or greater for automatic cleanup.");
         }
+    }
 
-        bool sessionRestoreNeeded = false;
+    private async Task<SyncResult> RunSyncCoreAsync(
+        string? explicitCodexHome,
+        string? provider,
+        string? configBackupText,
+        int keepCount,
+        int? sqliteBusyTimeoutMs,
+        string? model,
+        string? explicitSqliteHome,
+        Func<string, SwitchPreparation>? switchPreparationFactory,
+        CoreWritePlanSnapshot? expectedSnapshot,
+        DateTimeOffset? snapshotExpiresAtUtc,
+        CancellationToken cancellationToken = default)
+    {
+        ValidateAutomaticRetention(keepCount);
+
+        string codexHome = _codexHomeService.NormalizeCodexHome(explicitCodexHome);
+        await _codexHomeService.EnsureCodexHomeAsync(codexHome);
+        await using LockHandle _ = await _lockService.AcquireLockAsync(codexHome, "sync");
+        await FileTransactionJournal.AssertNoPendingAsync(codexHome);
+        SyncPreparation preparation = await PrepareSyncAsync(
+            codexHome,
+            provider,
+            sqliteBusyTimeoutMs,
+            model,
+            explicitSqliteHome,
+            switchPreparationFactory,
+            cancellationToken);
+        string configPath = preparation.ConfigPath;
+        string configText = preparation.ConfigText;
+        SwitchPreparation? switchPreparation = preparation.SwitchPreparation;
+        CodexStorageLayout storage = preparation.Storage;
+        CurrentProviderInfo current = preparation.Current;
+        string targetProvider = preparation.TargetProvider;
+        string? targetModel = preparation.TargetModel;
+        SessionChangeCollection sessionInfo = preparation.SessionInfo;
+        IReadOnlyList<ThreadCwdStat> workspaceCwdStats = preparation.WorkspaceCwdStats;
+        string? encryptedContentWarning = preparation.EncryptedContentWarning;
+        IReadOnlyList<SessionChange> writableChanges = preparation.WritableChanges;
+        List<string> skippedRolloutFiles = [.. preparation.SkippedRolloutFiles];
+        IReadOnlyList<string> skippedUnreadableRolloutFiles = preparation.SkippedUnreadableRolloutFiles;
+        IReadOnlyList<CoreWritePlanTarget>? checkedAutoPruneDeletionTargets = null;
+        if (expectedSnapshot is not null)
+        {
+            AssertSnapshotFresh(snapshotExpiresAtUtc);
+            CoreWritePlanSnapshot actualSnapshot = await BuildSyncPlanSnapshotAsync(
+                preparation,
+                keepCount,
+                cancellationToken);
+            CoreWriteSnapshotBuilder.AssertExactMatch(expectedSnapshot, actualSnapshot);
+            AssertSnapshotFresh(snapshotExpiresAtUtc);
+            checkedAutoPruneDeletionTargets = expectedSnapshot.AutoPruneDeletionTargets;
+        }
+        cancellationToken.ThrowIfCancellationRequested();
+        if (FaultInjector is not null)
+        {
+            await FaultInjector("before_backup", null, 0);
+        }
+        string? effectiveConfigBackupText = switchPreparation is null ? configBackupText : configText;
+        string backupDir = await _backupService.CreateBackupAsync(
+            storage,
+            targetProvider,
+            writableChanges,
+            configPath,
+            effectiveConfigBackupText);
         List<SessionChange> appliedSessionChanges = [];
-        bool globalStateRestoreNeeded = false;
+        bool sqliteMutationCommitted = false;
+        bool sqliteCommitAttempted = false;
+        string globalStatePath = _globalStateService.StatePath(codexHome);
+        string globalStateBackupPath = _globalStateService.BackupPath(codexHome);
+        string[] potentialTargets = writableChanges.Select(static change => Path.GetFullPath(change.Path))
+            .Concat(File.Exists(globalStatePath)
+                ? [Path.GetFullPath(globalStatePath), Path.GetFullPath(globalStateBackupPath)]
+                : [])
+            .Concat(switchPreparation is null ? [] : [Path.GetFullPath(configPath)])
+            .Concat(storage.StateDbLocation is null ? [] : [Path.GetFullPath(storage.StateDbLocation.Path)])
+            .ToArray();
+        FileTransactionJournal journal = await FileTransactionJournal.CreateAsync(
+            backupDir,
+            codexHome,
+            targetProvider,
+            potentialTargets);
+        List<string> completedTargets = [];
+        HashSet<string> observedMutatedTargets = new(PathComparer);
+        bool transactionCommitted = false;
+        void RecordCompletedTarget(string targetPath)
+        {
+            string fullPath = Path.GetFullPath(targetPath);
+            if (!completedTargets.Contains(fullPath, StringComparer.Ordinal))
+            {
+                completedTargets.Add(fullPath);
+            }
+        }
         WorkspaceRootSyncResult workspaceRootResult = new()
         {
             Present = false,
@@ -197,7 +454,34 @@ private async Task<SyncResult> RunSyncCoreAsync(
         };
         try
         {
+            if (switchPreparation is not null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await journal.ApplyingAsync("config", configPath);
+                if (FaultInjector is not null)
+                {
+                    await FaultInjector("before_config_apply", configPath, 0);
+                }
+                await _configFileService.WriteConfigTextAsync(configPath, switchPreparation.NextConfigText);
+                observedMutatedTargets.Add(Path.GetFullPath(configPath));
+                if (FaultInjector is not null)
+                {
+                    await FaultInjector("after_config_mutation_before_applied", configPath, 1);
+                }
+                await journal.AppliedAsync("config", configPath);
+                RecordCompletedTarget(configPath);
+                if (FaultInjector is not null)
+                {
+                    await FaultInjector("after_config_apply", configPath, 1);
+                }
+            }
+
             SessionApplyResult? applyResult = null;
+            string? sqliteTargetPath = storage.StateDbLocation?.Path;
+            if (sqliteTargetPath is not null)
+            {
+                await journal.ApplyingAsync("sqlite", sqliteTargetPath);
+            }
             (int updatedRows, int providerRowsUpdated, int modelRowsUpdated, int userEventRowsUpdated, int cwdRowsUpdated, bool databasePresent) = await _sqliteStateService.UpdateSqliteProviderAsync(
                 storage,
                 targetProvider,
@@ -206,34 +490,137 @@ private async Task<SyncResult> RunSyncCoreAsync(
                 {
                     if (writableChanges.Count > 0)
                     {
-                        applyResult = await _sessionRolloutService.ApplySessionChangesAsync(writableChanges, targetModel);
-                        HashSet<string> appliedPathSet = new(applyResult.AppliedPaths, StringComparer.Ordinal);
-                        appliedSessionChanges = writableChanges.Where(change => appliedPathSet.Contains(change.Path)).ToList();
-                        sessionRestoreNeeded = appliedSessionChanges.Count > 0;
-                        await _backupService.UpdateSessionBackupManifestAsync(backupDir, appliedSessionChanges);
+                        applyResult = await _sessionRolloutService.ApplySessionChangesAsync(
+                            writableChanges,
+                            targetModel,
+                            async change =>
+                            {
+                                cancellationToken.ThrowIfCancellationRequested();
+                                await journal.ApplyingAsync("rollout", change.Path);
+                                if (FaultInjector is not null)
+                                {
+                                    await FaultInjector(
+                                        "before_rollout_apply",
+                                        change.Path,
+                                        appliedSessionChanges.Count + 1);
+                                }
+                            },
+                            async change =>
+                            {
+                                observedMutatedTargets.Add(Path.GetFullPath(change.Path));
+                                if (FaultInjector is not null)
+                                {
+                                    await FaultInjector(
+                                        "after_rollout_mutation_before_applied",
+                                        change.Path,
+                                        appliedSessionChanges.Count + 1);
+                                }
+                                appliedSessionChanges.Add(change);
+                                await journal.AppliedAsync("rollout", change.Path);
+                                RecordCompletedTarget(change.Path);
+                                if (FaultInjector is not null)
+                                {
+                                    await FaultInjector("after_rollout_apply", change.Path, appliedSessionChanges.Count);
+                                }
+                            },
+                            async change =>
+                            {
+                                await journal.SkippedAsync("rollout", change.Path);
+                            });
                     }
-                    workspaceRootResult = await _globalStateService.SyncWorkspaceRootsAsync(storage, workspaceCwdStats);
-                    globalStateRestoreNeeded = workspaceRootResult.Updated;
+                    workspaceRootResult = await _globalStateService.SyncWorkspaceRootsAsync(
+                        storage,
+                        workspaceCwdStats,
+                        async targetPath =>
+                        {
+                            cancellationToken.ThrowIfCancellationRequested();
+                            await journal.ApplyingAsync("globalState", targetPath);
+                        },
+                        async targetPath =>
+                        {
+                            observedMutatedTargets.Add(Path.GetFullPath(targetPath));
+                            if (FaultInjector is not null)
+                            {
+                                await FaultInjector("after_global_state_mutation_before_applied", targetPath, 1);
+                            }
+                            await journal.AppliedAsync("globalState", targetPath);
+                            RecordCompletedTarget(targetPath);
+                            if (FaultInjector is not null)
+                            {
+                                await FaultInjector("after_global_state_apply", targetPath, 1);
+                            }
+                        });
+                    cancellationToken.ThrowIfCancellationRequested();
                 },
                 sqliteBusyTimeoutMs,
                 sessionInfo.UserEventThreadIds,
-                sessionInfo.ThreadCwdsById);
+                sessionInfo.ThreadCwdsById,
+                result =>
+                {
+                    sqliteCommitAttempted = result.DatabasePresent && result.UpdatedRows > 0;
+                },
+                async () =>
+                {
+                    if (FaultInjector is not null)
+                    {
+                        await FaultInjector(
+                            "after_sqlite_commit_before_ack",
+                            sqliteTargetPath ?? storage.SqliteHome,
+                            1);
+                    }
+                });
+            sqliteMutationCommitted = databasePresent && updatedRows > 0;
+            if (sqliteMutationCommitted)
+            {
+                observedMutatedTargets.Add(Path.GetFullPath(sqliteTargetPath!));
+                RecordCompletedTarget(sqliteTargetPath!);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            if (sqliteTargetPath is not null)
+            {
+                if (FaultInjector is not null)
+                {
+                    await FaultInjector("after_sqlite_mutation_before_applied", sqliteTargetPath, 1);
+                }
+                await journal.AppliedAsync("sqlite", sqliteTargetPath);
+            }
+            if (FaultInjector is not null)
+            {
+                await FaultInjector("after_sqlite_commit", sqliteTargetPath ?? storage.SqliteHome, 1);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
 
             skippedRolloutFiles.AddRange(applyResult?.SkippedPaths ?? []);
             skippedRolloutFiles = skippedRolloutFiles.Distinct(StringComparer.Ordinal).Order(StringComparer.Ordinal).ToList();
 
+            cancellationToken.ThrowIfCancellationRequested();
+            if (FaultInjector is not null)
+            {
+                await FaultInjector("before_transaction_commit", null, completedTargets.Count);
+            }
+            await journal.CommittedAsync();
+            transactionCommitted = true;
+            if (FaultInjector is not null)
+            {
+                await FaultInjector("after_transaction_commit", null, completedTargets.Count);
+            }
+
             BackupPruneResult? autoPruneResult = null;
             string? autoPruneWarning = null;
             try
             {
-                autoPruneResult = await _backupService.PruneBackupsAsync(codexHome, keepCount);
+                autoPruneResult = await _backupService.PruneAutomaticBackupsAsync(
+                    codexHome,
+                    keepCount,
+                    backupDir,
+                    checkedAutoPruneDeletionTargets);
             }
             catch (Exception error)
             {
                 autoPruneWarning = $"Automatic backup cleanup failed: {error.Message}";
             }
 
-            return new SyncResult
+            SyncResult result = new()
             {
                 CodexHome = codexHome,
                 SqliteHome = storage.SqliteHome,
@@ -256,44 +643,238 @@ private async Task<SyncResult> RunSyncCoreAsync(
                 EncryptedContentCounts = sessionInfo.EncryptedContentCounts,
                 EncryptedContentWarning = encryptedContentWarning,
                 AutoPruneResult = autoPruneResult,
-                AutoPruneWarning = autoPruneWarning
+                AutoPruneWarning = autoPruneWarning,
+                ConfigUpdated = switchPreparation is not null,
+                ModelSync = switchPreparation?.ModelSync ?? ModelSyncOutcome.NotApplicable()
             };
+            return result;
         }
         catch (Exception error)
         {
+            if (transactionCommitted)
+            {
+                throw;
+            }
+
             List<string> restoreFailures = [];
-            if (sessionRestoreNeeded)
+            bool sqliteRollbackNeeded = sqliteMutationCommitted || sqliteCommitAttempted;
+            IReadOnlyList<TransactionTargetInfo> affectedTargets;
+            try
+            {
+                PendingTransactionInfo persisted = await journal.ReadCurrentInfoAsync();
+                affectedTargets = persisted.AffectedTargets;
+            }
+            catch (Exception journalReadError)
+            {
+                restoreFailures.Add($"transaction journal read: {journalReadError.Message}");
+                affectedTargets = BuildConservativeRollbackTargets(
+                    writableChanges,
+                    switchPreparation is not null ? configPath : null,
+                    File.Exists(globalStatePath) ? globalStatePath : null,
+                    File.Exists(globalStateBackupPath) ? globalStateBackupPath : null,
+                    sqliteRollbackNeeded ? storage.StateDbLocation?.Path : null);
+            }
+            try
+            {
+                await journal.RollingBackAsync(error);
+            }
+            catch (Exception journalError)
+            {
+                restoreFailures.Add($"transaction journal: {journalError.Message}");
+            }
+            restoreFailures.AddRange(await RollBackTargetsAsync(
+                affectedTargets
+                    .Where(target => target.Kind != "sqlite" || sqliteRollbackNeeded)
+                    .ToArray(),
+                backupDir,
+                codexHome,
+                storage));
+
+            if (restoreFailures.Count == 0)
             {
                 try
                 {
-                    await _sessionRolloutService.RestoreSessionChangesAsync(appliedSessionChanges);
+                    await journal.RolledBackAsync();
                 }
-                catch (Exception restoreError)
+                catch (Exception journalError)
                 {
-                    restoreFailures.Add($"rollout files: {restoreError.Message}");
+                    restoreFailures.Add($"transaction journal: {journalError.Message}");
                 }
             }
-            if (globalStateRestoreNeeded)
+            if (restoreFailures.Count > 0)
             {
                 try
                 {
-                    await _backupService.RestoreGlobalStateFilesAsync(backupDir, codexHome);
+                    await journal.RecoveryRequiredAsync(error, restoreFailures);
                 }
-                catch (Exception restoreError)
+                catch
                 {
-                    restoreFailures.Add($"global state: {restoreError.Message}");
+                    // Preserve the original and rollback failures when the
+                    // journal itself is no longer writable.
                 }
+                IReadOnlyList<string> reportedCompletedTargets = BuildReportedCompletedTargets(
+                    completedTargets,
+                    observedMutatedTargets);
+                HashSet<string> completedTargetSet = new(reportedCompletedTargets, PathComparer);
+                IReadOnlyList<string> uncompletedTargets = potentialTargets
+                    .Where(targetPath => !completedTargetSet.Contains(targetPath))
+                    .ToArray();
+                throw new SyncTransactionException(
+                    error,
+                    restoreFailures,
+                    backupDir,
+                    reportedCompletedTargets,
+                    uncompletedTargets,
+                    rollbackStatus: "incomplete",
+                    recoveryRequired: true);
             }
 
-            if (restoreFailures.Count > 0)
+            IReadOnlyList<string> completedAfterRollback = BuildReportedCompletedTargets(
+                completedTargets,
+                observedMutatedTargets);
+            HashSet<string> completedSet = new(completedAfterRollback, PathComparer);
+            throw new SyncTransactionException(
+                error,
+                [],
+                backupDir,
+                completedAfterRollback,
+                potentialTargets.Where(targetPath => !completedSet.Contains(targetPath)).ToArray(),
+                rollbackStatus: "complete",
+                recoveryRequired: false);
+        }
+    }
+
+    private async Task<IReadOnlyList<string>> RollBackTargetsAsync(
+        IReadOnlyList<TransactionTargetInfo> affectedTargets,
+        string backupDir,
+        string codexHome,
+        CodexStorageLayout storage)
+    {
+        List<string> failures = [];
+        Dictionary<string, SessionBackupManifestEntry>? sessionEntries = null;
+        HashSet<string> restoredTargets = new(PathComparer);
+        foreach (TransactionTargetInfo target in affectedTargets.Reverse())
+        {
+            string normalizedTarget = Path.GetFullPath(target.TargetPath);
+            string targetKey = target.Kind + "\0" + normalizedTarget;
+            if (!restoredTargets.Add(targetKey))
+            {
+                continue;
+            }
+
+            try
+            {
+                switch (target.Kind)
+                {
+                    case "rollout":
+                        if (FaultInjector is not null)
+                        {
+                            await FaultInjector("before_rollout_rollback", normalizedTarget, 1);
+                        }
+                        if (sessionEntries is null)
+                        {
+                            sessionEntries = (await _backupService.ReadSessionBackupEntriesAsync(backupDir, codexHome))
+                                .ToDictionary(
+                                    static entry => Path.GetFullPath(entry.Path),
+                                    static entry => entry,
+                                    PathComparer);
+                        }
+                        if (!sessionEntries.TryGetValue(normalizedTarget, out SessionBackupManifestEntry? entry))
+                        {
+                            throw new InvalidOperationException(
+                                $"Immutable session backup does not contain rollback target {normalizedTarget}.");
+                        }
+                        await _sessionRolloutService.RestoreSessionChangesAsync([entry]);
+                        break;
+
+                    case "globalState":
+                        if (FaultInjector is not null)
+                        {
+                            await FaultInjector("before_global_state_rollback", normalizedTarget, 1);
+                        }
+                        await _backupService.RestoreGlobalStateTargetAsync(backupDir, codexHome, normalizedTarget);
+                        break;
+
+                    case "config":
+                        if (FaultInjector is not null)
+                        {
+                            await FaultInjector("before_config_rollback", normalizedTarget, 1);
+                        }
+                        await _backupService.RestoreConfigFileAsync(backupDir, codexHome);
+                        break;
+
+                    case "sqlite":
+                        if (FaultInjector is not null)
+                        {
+                            await FaultInjector("before_sqlite_rollback", normalizedTarget, 1);
+                        }
+                        await _backupService.RestoreBackupAsync(
+                            backupDir,
+                            storage,
+                            new RestoreBackupOptions
+                            {
+                                RestoreConfig = false,
+                                RestoreDatabase = true,
+                                RestoreSessions = false
+                            });
+                        break;
+
+                    default:
+                        throw new InvalidOperationException(
+                            $"Unsupported transaction rollback target kind \"{target.Kind}\".");
+                }
+            }
+            catch (Exception restoreError)
             {
-                throw new InvalidOperationException(
-                    $"Failed to restore state after sync error. Original error: {error.Message}. Restore error: {string.Join("; ", restoreFailures)}",
-                    error);
+                failures.Add($"{target.Kind} {normalizedTarget}: {restoreError.Message}");
             }
+        }
+        return failures;
+    }
+
+    private static IReadOnlyList<TransactionTargetInfo> BuildConservativeRollbackTargets(
+        IReadOnlyList<SessionChange> writableChanges,
+        string? configPath,
+        string? globalStatePath,
+        string? globalStateBackupPath,
+        string? sqlitePath)
+    {
+        List<TransactionTargetInfo> targets = writableChanges
+            .Select(static change => new TransactionTargetInfo("rollout", Path.GetFullPath(change.Path), "applying"))
+            .ToList();
+        if (globalStatePath is not null)
+        {
+            targets.Add(new TransactionTargetInfo("globalState", Path.GetFullPath(globalStatePath), "applying"));
+        }
+        if (globalStateBackupPath is not null)
+        {
+            targets.Add(new TransactionTargetInfo("globalState", Path.GetFullPath(globalStateBackupPath), "applying"));
+        }
+        if (sqlitePath is not null)
+        {
+            targets.Add(new TransactionTargetInfo("sqlite", Path.GetFullPath(sqlitePath), "applying"));
+        }
+        if (configPath is not null)
+        {
+            targets.Add(new TransactionTargetInfo("config", Path.GetFullPath(configPath), "applying"));
+        }
+        return targets;
+    }
 
-            throw;
+    private static IReadOnlyList<string> BuildReportedCompletedTargets(
+        IEnumerable<string> journaledCompletedTargets,
+        IEnumerable<string> observedMutatedTargets)
+    {
+        List<string> result = [];
+        foreach (string target in journaledCompletedTargets.Concat(observedMutatedTargets))
+        {
+            string fullPath = Path.GetFullPath(target);
+            if (!result.Contains(fullPath, PathComparer))
+            {
+                result.Add(fullPath);
+            }
         }
+        return result;
     }
 
     public async Task<SyncResult> RunSwitchAsync(
@@ -302,20 +883,99 @@ public async Task<SyncResult> RunSwitchAsync(
         int keepCount = AppConstants.DefaultBackupRetentionCount,
         string? model = null,
         bool keepRootModel = false,
-        string? explicitSqliteHome = null)
+        string? explicitSqliteHome = null,
+        CancellationToken cancellationToken = default)
     {
         if (string.IsNullOrWhiteSpace(provider))
         {
             throw new InvalidOperationException("Missing provider id. Usage: codex-provider switch <provider-id>");
         }
 
+        return await RunSyncCoreAsync(
+            explicitCodexHome,
+            provider: null,
+            configBackupText: null,
+            keepCount,
+            sqliteBusyTimeoutMs: null,
+            model: null,
+            explicitSqliteHome,
+            switchPreparationFactory: originalConfigText => CreateSwitchPreparation(
+                originalConfigText,
+                provider,
+                model,
+                keepRootModel),
+            expectedSnapshot: null,
+            snapshotExpiresAtUtc: null,
+            cancellationToken);
+    }
+
+    public async Task<CoreWritePlanSnapshot> CreateSwitchPlanSnapshotAsync(
+        string? explicitCodexHome,
+        string provider,
+        int keepCount = AppConstants.DefaultBackupRetentionCount,
+        string? model = null,
+        bool keepRootModel = false,
+        string? explicitSqliteHome = null,
+        CancellationToken cancellationToken = default)
+    {
+        ValidateSwitchProvider(provider);
+        ValidateAutomaticRetention(keepCount);
         string codexHome = _codexHomeService.NormalizeCodexHome(explicitCodexHome);
         await _codexHomeService.EnsureCodexHomeAsync(codexHome);
-        string configPath = _codexHomeService.ConfigPath(codexHome);
-        string originalConfigText = await _configFileService.ReadConfigTextAsync(configPath);
-        CodexStorageLayout storage = await PrepareStorageAsync(codexHome, explicitSqliteHome, originalConfigText);
-        storage.EnsureSqliteAccessSupported("switch");
-        EnsureWritableStorage(storage);
+        await using LockHandle _ = await _lockService.AcquireLockAsync(codexHome, "plan-switch");
+        await FileTransactionJournal.AssertNoPendingAsync(codexHome);
+        SyncPreparation preparation = await PrepareSyncAsync(
+            codexHome,
+            provider: null,
+            sqliteBusyTimeoutMs: null,
+            model: null,
+            explicitSqliteHome,
+            originalConfigText => CreateSwitchPreparation(
+                originalConfigText,
+                provider,
+                model,
+                keepRootModel),
+            cancellationToken);
+        return await BuildSyncPlanSnapshotAsync(preparation, keepCount, cancellationToken);
+    }
+
+    public Task<SyncResult> RunSwitchCheckedAsync(
+        CoreWritePlanSnapshot expectedSnapshot,
+        string? explicitCodexHome,
+        string provider,
+        int keepCount = AppConstants.DefaultBackupRetentionCount,
+        string? model = null,
+        bool keepRootModel = false,
+        string? explicitSqliteHome = null,
+        DateTimeOffset? snapshotExpiresAtUtc = null,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(expectedSnapshot);
+        ValidateSwitchProvider(provider);
+        return RunSyncCoreAsync(
+            explicitCodexHome,
+            provider: null,
+            configBackupText: null,
+            keepCount,
+            sqliteBusyTimeoutMs: null,
+            model: null,
+            explicitSqliteHome,
+            originalConfigText => CreateSwitchPreparation(
+                originalConfigText,
+                provider,
+                model,
+                keepRootModel),
+            expectedSnapshot,
+            snapshotExpiresAtUtc,
+            cancellationToken);
+    }
+
+    private SwitchPreparation CreateSwitchPreparation(
+        string originalConfigText,
+        string provider,
+        string? model,
+        bool keepRootModel)
+    {
         if (!_configFileService.ConfigDeclaresProvider(originalConfigText, provider))
         {
             string configuredProviders = string.Join(", ", _configFileService.ListConfiguredProviderIds(originalConfigText));
@@ -324,68 +984,29 @@ public async Task<SyncResult> RunSwitchAsync(
         }
 
         string nextConfigText = _configFileService.SetRootProviderInConfigText(originalConfigText, provider);
-        ModelSyncOutcome modelSync = ResolveModelSyncOutcome(originalConfigText, provider, model, keepRootModel);
+        ModelSyncOutcome modelSync = ResolveModelSyncOutcome(
+            originalConfigText,
+            provider,
+            model,
+            keepRootModel);
         if (modelSync.Applied)
         {
             nextConfigText = _configFileService.SetRootModelInConfigText(nextConfigText, modelSync.Model!);
         }
 
-        bool configMutationAttempted = false;
-        try
-        {
-            // Even when the switch keeps the existing root model, keep
-            // SQLite and rollout turn_context fields aligned with it.
-            string? modelForThreads = modelSync.Applied
-                ? modelSync.Model
-                : _configFileService.ReadRootModelFromConfigText(nextConfigText);
-            SyncResult result = await RunSyncCoreAsync(
-                codexHome,
-                provider,
-                originalConfigText,
-                keepCount,
-                sqliteBusyTimeoutMs: null,
-                model: modelForThreads,
-                explicitSqliteHome: explicitSqliteHome,
-                afterBackup: async _ =>
-                {
-                    configMutationAttempted = true;
-                    await _configFileService.WriteConfigTextAsync(configPath, nextConfigText);
-                });
-            return new SyncResult
-            {
-                CodexHome = result.CodexHome,
-                SqliteHome = result.SqliteHome,
-                SqliteHomeSource = result.SqliteHomeSource,
-                TargetProvider = result.TargetProvider,
-                PreviousProvider = result.PreviousProvider,
-                BackupDir = result.BackupDir,
-                ChangedSessionFiles = result.ChangedSessionFiles,
-                SkippedLockedRolloutFiles = result.SkippedLockedRolloutFiles,
-                SkippedUnreadableRolloutFiles = result.SkippedUnreadableRolloutFiles,
-                SqliteRowsUpdated = result.SqliteRowsUpdated,
-                SqliteProviderRowsUpdated = result.SqliteProviderRowsUpdated,
-                SqliteModelRowsUpdated = result.SqliteModelRowsUpdated,
-                SqliteUserEventRowsUpdated = result.SqliteUserEventRowsUpdated,
-                SqliteCwdRowsUpdated = result.SqliteCwdRowsUpdated,
-                UpdatedWorkspaceRoots = result.UpdatedWorkspaceRoots,
-                SavedWorkspaceRootCount = result.SavedWorkspaceRootCount,
-                SqlitePresent = result.SqlitePresent,
-                RolloutCountsBefore = result.RolloutCountsBefore,
-                EncryptedContentCounts = result.EncryptedContentCounts,
-                EncryptedContentWarning = result.EncryptedContentWarning,
-                ConfigUpdated = true,
-                ModelSync = modelSync,
-                AutoPruneResult = result.AutoPruneResult,
-                AutoPruneWarning = result.AutoPruneWarning
-            };
-        }
-        catch
+        // Even when the switch keeps the existing root model, keep SQLite and
+        // rollout turn_context fields aligned with it.
+        string? modelForThreads = modelSync.Applied
+            ? modelSync.Model
+            : _configFileService.ReadRootModelFromConfigText(nextConfigText);
+        return new SwitchPreparation(provider, nextConfigText, modelForThreads, modelSync);
+    }
+
+    private static void ValidateSwitchProvider(string provider)
+    {
+        if (string.IsNullOrWhiteSpace(provider))
         {
-            if (configMutationAttempted)
-            {
-                await _configFileService.WriteConfigTextAsync(configPath, originalConfigText);
-            }
-            throw;
+            throw new InvalidOperationException("Missing provider id. Usage: codex-provider switch <provider-id>");
         }
     }
 
@@ -441,32 +1062,364 @@ public async Task<RestoreResult> RunRestoreAsync(
         RestoreBackupOptions options,
         string? explicitSqliteHome = null)
     {
-        if (string.IsNullOrWhiteSpace(backupDir))
-        {
-            throw new InvalidOperationException("Missing backup path. Usage: codex-provider restore <backup-dir>");
-        }
+        return await RunRestoreCoreAsync(
+            expectedSnapshot: null,
+            explicitCodexHome,
+            backupDir,
+            options,
+            explicitSqliteHome,
+            snapshotExpiresAtUtc: null,
+            CancellationToken.None);
+    }
 
+    public async Task<CoreWritePlanSnapshot> CreateRestorePlanSnapshotAsync(
+        string? explicitCodexHome,
+        string backupDir,
+        RestoreBackupOptions options,
+        string? explicitSqliteHome = null,
+        CancellationToken cancellationToken = default)
+    {
+        ValidateRestoreRequest(backupDir, options);
         string codexHome = _codexHomeService.NormalizeCodexHome(explicitCodexHome);
         await _codexHomeService.EnsureCodexHomeAsync(codexHome);
-        string configText = await _configFileService.ReadConfigTextAsync(_codexHomeService.ConfigPath(codexHome));
+        await using LockHandle _ = await _lockService.AcquireLockAsync(codexHome, "plan-restore");
+        RestorePreparation preparation = await PrepareRestoreAsync(
+            codexHome,
+            backupDir,
+            options,
+            explicitSqliteHome,
+            cancellationToken);
+        return await BuildRestorePlanSnapshotAsync(preparation, cancellationToken);
+    }
+
+    public Task<RestoreResult> RunRestoreCheckedAsync(
+        CoreWritePlanSnapshot expectedSnapshot,
+        string? explicitCodexHome,
+        string backupDir,
+        RestoreBackupOptions options,
+        string? explicitSqliteHome = null,
+        DateTimeOffset? snapshotExpiresAtUtc = null,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(expectedSnapshot);
+        return RunRestoreCoreAsync(
+            expectedSnapshot,
+            explicitCodexHome,
+            backupDir,
+            options,
+            explicitSqliteHome,
+            snapshotExpiresAtUtc,
+            cancellationToken);
+    }
+
+    private async Task<RestoreResult> RunRestoreCoreAsync(
+        CoreWritePlanSnapshot? expectedSnapshot,
+        string? explicitCodexHome,
+        string backupDir,
+        RestoreBackupOptions options,
+        string? explicitSqliteHome,
+        DateTimeOffset? snapshotExpiresAtUtc,
+        CancellationToken cancellationToken)
+    {
+        ValidateRestoreRequest(backupDir, options);
+        string codexHome = _codexHomeService.NormalizeCodexHome(explicitCodexHome);
+        await _codexHomeService.EnsureCodexHomeAsync(codexHome);
+
+        await using LockHandle _ = await _lockService.AcquireLockAsync(codexHome, "restore");
+        RestorePreparation preparation = await PrepareRestoreAsync(
+            codexHome,
+            backupDir,
+            options,
+            explicitSqliteHome,
+            cancellationToken);
+        if (expectedSnapshot is not null)
+        {
+            AssertSnapshotFresh(snapshotExpiresAtUtc);
+            CoreWritePlanSnapshot actualSnapshot = await BuildRestorePlanSnapshotAsync(
+                preparation,
+                cancellationToken);
+            CoreWriteSnapshotBuilder.AssertExactMatch(expectedSnapshot, actualSnapshot);
+            AssertSnapshotFresh(snapshotExpiresAtUtc);
+        }
+        // BackupService currently exposes an atomic restore operation rather
+        // than per-file cancellation. Honor cancellation until the mutation
+        // boundary, then let that authoritative operation finish and report
+        // its real result instead of returning a false cancelled outcome.
+        cancellationToken.ThrowIfCancellationRequested();
+        RestoreResult result = await _backupService.RestoreBackupAsync(
+            preparation.BackupDirectory,
+            preparation.Storage,
+            preparation.Options);
+        await FileTransactionJournal.MarkBackupRolledBackAsync(
+            preparation.BackupDirectory,
+            codexHome,
+            result.TargetProvider);
+        return result;
+    }
+
+    private async Task<RestorePreparation> PrepareRestoreAsync(
+        string codexHome,
+        string backupDir,
+        RestoreBackupOptions options,
+        string? explicitSqliteHome,
+        CancellationToken cancellationToken)
+    {
+        cancellationToken.ThrowIfCancellationRequested();
+        string configPath = _codexHomeService.ConfigPath(codexHome);
+        string configText = await _configFileService.ReadConfigTextAsync(configPath);
         CodexStorageLayout storage = await PrepareStorageAsync(codexHome, explicitSqliteHome, configText);
         storage.EnsureSqliteAccessSupported("restore");
+        string normalizedBackupDir = Path.GetFullPath(backupDir);
+        IReadOnlyList<PendingTransactionInfo> pending = await FileTransactionJournal.FindPendingAsync(codexHome);
+        PendingTransactionInfo[] foreignPending = pending
+            .Where(transaction => !PathComparer.Equals(
+                Path.GetFullPath(transaction.BackupDir),
+                normalizedBackupDir))
+            .ToArray();
+        if (foreignPending.Length > 0)
+        {
+            string backups = string.Join(", ", foreignPending.Select(static item => item.BackupDir));
+            throw new RecoveryRequiredException(
+                "A different unfinished provider-sync transaction must be restored before this backup can be used. "
+                + $"Restore the bound backup first: {backups}",
+                foreignPending);
+        }
+        await EnsurePendingRecoveryCoverageAsync(normalizedBackupDir, codexHome, options);
+        cancellationToken.ThrowIfCancellationRequested();
+        return new RestorePreparation(
+            codexHome,
+            configPath,
+            normalizedBackupDir,
+            options,
+            storage);
+    }
 
-        await using LockHandle _ = await _lockService.AcquireLockAsync(codexHome, "restore");
-        return await _backupService.RestoreBackupAsync(Path.GetFullPath(backupDir), storage, options);
+    private async Task<CoreWritePlanSnapshot> BuildRestorePlanSnapshotAsync(
+        RestorePreparation preparation,
+        CancellationToken cancellationToken)
+    {
+        List<CoreWriteTargetSpec> targets =
+        [
+            new(preparation.BackupDirectory, "read-restore-source"),
+            new(preparation.ConfigPath, preparation.Options.RestoreConfig ? "restore" : "read")
+        ];
+        if (preparation.Options.RestoreConfig)
+        {
+            targets.Add(new CoreWriteTargetSpec(
+                _globalStateService.StatePath(preparation.CodexHome),
+                "restore"));
+            targets.Add(new CoreWriteTargetSpec(
+                _globalStateService.BackupPath(preparation.CodexHome),
+                "restore"));
+        }
+        if (preparation.Options.RestoreSessions)
+        {
+            targets.Add(new CoreWriteTargetSpec(
+                Path.Combine(preparation.CodexHome, "sessions"),
+                "restore",
+                CoreWriteFingerprintMode.RecursiveInventory));
+            targets.Add(new CoreWriteTargetSpec(
+                Path.Combine(preparation.CodexHome, "archived_sessions"),
+                "restore",
+                CoreWriteFingerprintMode.RecursiveInventory));
+        }
+        if (preparation.Options.RestoreDatabase)
+        {
+            string databasePath = preparation.Storage.StateDbLocation?.Path
+                ?? Path.Combine(preparation.Storage.SqliteHome, AppConstants.DbFileBasename);
+            targets.Add(new CoreWriteTargetSpec(
+                databasePath,
+                "restore",
+                CoreWriteFingerprintMode.SqliteMainContent));
+            targets.Add(new CoreWriteTargetSpec(
+                databasePath + "-wal",
+                "restore-if-present",
+                CoreWriteFingerprintMode.SqliteWalContent));
+        }
+
+        string binding = System.Text.Json.JsonSerializer.Serialize(new
+        {
+            operation = "restore",
+            preparation.CodexHome,
+            preparation.BackupDirectory,
+            preparation.Storage.SqliteHome,
+            preparation.Storage.SqliteHomeSource,
+            preparation.Options.RestoreConfig,
+            preparation.Options.RestoreDatabase,
+            preparation.Options.RestoreSessions,
+            preparation.Options.AllowSqliteHomeRelocation
+        });
+        return await CoreWriteSnapshotBuilder.BuildAsync(
+            "restore",
+            binding,
+            targets,
+            cancellationToken: cancellationToken);
+    }
+
+    private static void ValidateRestoreRequest(string backupDir, RestoreBackupOptions options)
+    {
+        if (string.IsNullOrWhiteSpace(backupDir))
+        {
+            throw new InvalidOperationException("Missing backup path. Usage: codex-provider restore <backup-dir>");
+        }
+        ArgumentNullException.ThrowIfNull(options);
     }
 
-    public async Task<BackupPruneResult> RunPruneBackupsAsync(
+    private async Task EnsurePendingRecoveryCoverageAsync(
+        string backupDir,
+        string codexHome,
+        RestoreBackupOptions options)
+    {
+        string journalPath = Path.Combine(backupDir, FileTransactionJournal.FileName);
+        if (!File.Exists(journalPath))
+        {
+            return;
+        }
+
+        PendingTransactionInfo journal = await FileTransactionJournal.ReadInfoAsync(journalPath);
+        if (journal.Terminal)
+        {
+            return;
+        }
+
+        bool requireConfig;
+        bool requireDatabase;
+        bool requireSessions;
+        if (journal.InvalidTail || string.IsNullOrWhiteSpace(journal.OperationId))
+        {
+            BackupRecoveryCoverage coverage = await _backupService.GetRecoveryCoverageAsync(backupDir, codexHome);
+            requireConfig = coverage.Config;
+            requireDatabase = coverage.Database;
+            requireSessions = coverage.Sessions;
+        }
+        else
+        {
+            requireConfig = journal.AffectedTargets.Any(
+                static target => target.Kind is "config" or "globalState");
+            requireDatabase = journal.AffectedTargets.Any(static target => target.Kind == "sqlite");
+            requireSessions = journal.AffectedTargets.Any(static target => target.Kind == "rollout");
+        }
+
+        List<string> missing = [];
+        if (requireConfig && !options.RestoreConfig)
+        {
+            missing.Add("config/global state");
+        }
+        if (requireDatabase && !options.RestoreDatabase)
+        {
+            missing.Add("SQLite");
+        }
+        if (requireSessions && !options.RestoreSessions)
+        {
+            missing.Add("rollout sessions");
+        }
+        if (missing.Count > 0)
+        {
+            throw new InvalidOperationException(
+                "Cannot resolve the pending transaction with a partial restore. "
+                + $"Enable restore for: {string.Join(", ", missing)}. The recovery journal remains pending.");
+        }
+    }
+
+    public Task<BackupPruneResult> RunPruneBackupsAsync(
         string? explicitCodexHome = null,
         int keepCount = AppConstants.DefaultBackupRetentionCount)
     {
+        return RunPruneBackupsCoreAsync(
+            expectedSnapshot: null,
+            explicitCodexHome,
+            keepCount,
+            snapshotExpiresAtUtc: null,
+            CancellationToken.None);
+    }
+
+    public async Task<CoreWritePlanSnapshot> CreatePrunePlanSnapshotAsync(
+        string? explicitCodexHome = null,
+        int keepCount = AppConstants.DefaultBackupRetentionCount,
+        CancellationToken cancellationToken = default)
+    {
+        ValidatePruneRetention(keepCount);
+        string codexHome = _codexHomeService.NormalizeCodexHome(explicitCodexHome);
+        await _codexHomeService.EnsureCodexHomeAsync(codexHome);
+        await using LockHandle _ = await _lockService.AcquireLockAsync(codexHome, "plan-prune-backups");
+        return await BuildPrunePlanSnapshotAsync(codexHome, keepCount, cancellationToken);
+    }
+
+    public Task<BackupPruneResult> RunPruneBackupsCheckedAsync(
+        CoreWritePlanSnapshot expectedSnapshot,
+        string? explicitCodexHome = null,
+        int keepCount = AppConstants.DefaultBackupRetentionCount,
+        DateTimeOffset? snapshotExpiresAtUtc = null,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(expectedSnapshot);
+        return RunPruneBackupsCoreAsync(
+            expectedSnapshot,
+            explicitCodexHome,
+            keepCount,
+            snapshotExpiresAtUtc,
+            cancellationToken);
+    }
+
+    private async Task<BackupPruneResult> RunPruneBackupsCoreAsync(
+        CoreWritePlanSnapshot? expectedSnapshot,
+        string? explicitCodexHome,
+        int keepCount,
+        DateTimeOffset? snapshotExpiresAtUtc,
+        CancellationToken cancellationToken)
+    {
+        ValidatePruneRetention(keepCount);
         string codexHome = _codexHomeService.NormalizeCodexHome(explicitCodexHome);
         await _codexHomeService.EnsureCodexHomeAsync(codexHome);
 
         await using LockHandle _ = await _lockService.AcquireLockAsync(codexHome, "prune-backups");
+        if (expectedSnapshot is not null)
+        {
+            AssertSnapshotFresh(snapshotExpiresAtUtc);
+            CoreWritePlanSnapshot actualSnapshot = await BuildPrunePlanSnapshotAsync(
+                codexHome,
+                keepCount,
+                cancellationToken);
+            CoreWriteSnapshotBuilder.AssertExactMatch(expectedSnapshot, actualSnapshot);
+            AssertSnapshotFresh(snapshotExpiresAtUtc);
+        }
+        cancellationToken.ThrowIfCancellationRequested();
         return await _backupService.PruneBackupsAsync(codexHome, keepCount);
     }
 
+    private Task<CoreWritePlanSnapshot> BuildPrunePlanSnapshotAsync(
+        string codexHome,
+        int keepCount,
+        CancellationToken cancellationToken)
+    {
+        string backupRoot = _codexHomeService.BackupRoot(codexHome);
+        string binding = System.Text.Json.JsonSerializer.Serialize(new
+        {
+            operation = "prune",
+            codexHome,
+            keepCount
+        });
+        return CoreWriteSnapshotBuilder.BuildAsync(
+            "prune",
+            binding,
+            [new CoreWriteTargetSpec(
+                backupRoot,
+                $"prune-to-{keepCount}",
+                CoreWriteFingerprintMode.RecursiveInventory)],
+            cancellationToken: cancellationToken);
+    }
+
+    private static void ValidatePruneRetention(int keepCount)
+    {
+        if (keepCount < 0)
+        {
+            throw new ArgumentOutOfRangeException(
+                nameof(keepCount),
+                keepCount,
+                "keepCount must be 0 or greater.");
+        }
+    }
+
     public Task<BackupStorageInfo> GetBackupStorageInfoAsync(string backupDir)
     {
         return _backupService.GetBackupStorageInfoAsync(backupDir);
@@ -516,4 +1469,45 @@ private static void EnsureWritableStorage(CodexStorageLayout storage)
                 + $"(source: {storage.SqliteHomeSource}).");
         }
     }
+
+    private static void AssertSnapshotFresh(DateTimeOffset? expiresAtUtc)
+    {
+        if (expiresAtUtc is not null && DateTimeOffset.UtcNow >= expiresAtUtc.Value)
+        {
+            throw new CoreWritePlanExpiredException();
+        }
+    }
+
+    private static StringComparer PathComparer => OperatingSystem.IsWindows()
+        ? StringComparer.OrdinalIgnoreCase
+        : StringComparer.Ordinal;
+
+    private sealed record SwitchPreparation(
+        string Provider,
+        string NextConfigText,
+        string? ThreadModel,
+        ModelSyncOutcome ModelSync);
+
+    private sealed record SyncPreparation(
+        string CodexHome,
+        string ConfigPath,
+        string ConfigText,
+        SwitchPreparation? SwitchPreparation,
+        CodexStorageLayout Storage,
+        CurrentProviderInfo Current,
+        string TargetProvider,
+        string? TargetModel,
+        SessionChangeCollection SessionInfo,
+        IReadOnlyList<ThreadCwdStat> WorkspaceCwdStats,
+        string? EncryptedContentWarning,
+        IReadOnlyList<SessionChange> WritableChanges,
+        IReadOnlyList<string> SkippedRolloutFiles,
+        IReadOnlyList<string> SkippedUnreadableRolloutFiles);
+
+    private sealed record RestorePreparation(
+        string CodexHome,
+        string ConfigPath,
+        string BackupDirectory,
+        RestoreBackupOptions Options,
+        CodexStorageLayout Storage);
 }
diff --git a/desktop/CodexProviderSync.Core/ConfigFileService.cs b/desktop/CodexProviderSync.Core/ConfigFileService.cs
index 9889599..763e0f0 100644
--- a/desktop/CodexProviderSync.Core/ConfigFileService.cs
+++ b/desktop/CodexProviderSync.Core/ConfigFileService.cs
@@ -60,7 +60,7 @@ public Task<string> ReadConfigTextAsync(string configPath)
 
     public async Task WriteConfigTextAsync(string configPath, string configText)
     {
-        await File.WriteAllTextAsync(configPath, configText);
+        await AtomicFile.WriteAllTextAsync(configPath, configText);
     }
 
     public CurrentProviderInfo ReadCurrentProviderFromConfigText(string configText)
diff --git a/desktop/CodexProviderSync.Core/CoreWritePlanning.cs b/desktop/CodexProviderSync.Core/CoreWritePlanning.cs
new file mode 100644
index 0000000..54e51f9
--- /dev/null
+++ b/desktop/CodexProviderSync.Core/CoreWritePlanning.cs
@@ -0,0 +1,343 @@
+using System.Security.Cryptography;
+using System.Text;
+
+namespace CodexProviderSync.Core;
+
+/// <summary>
+/// A read-only, deterministic view of every resource that a checked Core
+/// write depends on. The snapshot is deliberately Core-owned so frontends do
+/// not reproduce storage discovery or mutation rules.
+/// </summary>
+public sealed record CoreWritePlanSnapshot(
+    string Operation,
+    string StateFingerprint,
+    string ExecutionToken,
+    IReadOnlyList<CoreWritePlanTarget> Targets,
+    IReadOnlyList<CoreWritePlanTarget> AutoPruneDeletionTargets,
+    IReadOnlyList<CoreWritePlanWarning> Warnings);
+
+public sealed record CoreWritePlanTarget(
+    string Path,
+    string Action,
+    string Fingerprint);
+
+public sealed record CoreWritePlanWarning(string Code, string Message);
+
+public sealed class CoreWritePlanStaleException : InvalidOperationException
+{
+    public CoreWritePlanStaleException()
+        : base("The Core write plan no longer matches the current storage state; create a new plan before applying.")
+    {
+    }
+}
+
+public sealed class CoreWritePlanExpiredException : InvalidOperationException
+{
+    public CoreWritePlanExpiredException()
+        : base("The Core write plan expired before the mutation boundary; create a new plan before applying.")
+    {
+    }
+}
+
+internal enum CoreWriteFingerprintMode
+{
+    Content,
+    RecursiveInventory,
+    // SQLite file timestamps and WAL-index/SHM state can change on a read-only
+    // open. Bind checked writes to durable main/WAL bytes instead.
+    SqliteMainContent,
+    SqliteWalContent
+}
+
+internal sealed record CoreWriteTargetSpec(
+    string Path,
+    string Action,
+    CoreWriteFingerprintMode FingerprintMode = CoreWriteFingerprintMode.Content);
+
+internal static class CoreWriteSnapshotBuilder
+{
+    private const string FormatVersion = "core-write-snapshot-v2";
+
+    public static async Task<CoreWritePlanSnapshot> BuildAsync(
+        string operation,
+        string binding,
+        IEnumerable<CoreWriteTargetSpec> targets,
+        IEnumerable<CoreWriteTargetSpec>? autoPruneDeletionTargets = null,
+        IEnumerable<CoreWritePlanWarning>? warnings = null,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(operation);
+        ArgumentNullException.ThrowIfNull(binding);
+
+        IReadOnlyList<CoreWritePlanTarget> capturedTargets = await CaptureTargetsAsync(
+            targets,
+            cancellationToken);
+        IReadOnlyList<CoreWritePlanTarget> capturedAutoPruneTargets = await CaptureTargetsAsync(
+            autoPruneDeletionTargets ?? [],
+            cancellationToken);
+        IReadOnlyList<CoreWritePlanWarning> capturedWarnings = (warnings ?? [])
+            .Select(static warning => warning with { })
+            .OrderBy(static warning => warning.Code, StringComparer.Ordinal)
+            .ThenBy(static warning => warning.Message, StringComparer.Ordinal)
+            .ToArray();
+
+        StringBuilder canonical = new();
+        Append(canonical, "format", FormatVersion);
+        Append(canonical, "operation", operation);
+        Append(canonical, "binding", binding);
+        foreach (CoreWritePlanTarget target in capturedTargets)
+        {
+            Append(canonical, "target.path", target.Path);
+            Append(canonical, "target.action", target.Action);
+            Append(canonical, "target.fingerprint", target.Fingerprint);
+        }
+        foreach (CoreWritePlanTarget target in capturedAutoPruneTargets)
+        {
+            Append(canonical, "autoPrune.path", target.Path);
+            Append(canonical, "autoPrune.action", target.Action);
+            Append(canonical, "autoPrune.fingerprint", target.Fingerprint);
+        }
+        foreach (CoreWritePlanWarning warning in capturedWarnings)
+        {
+            Append(canonical, "warning.code", warning.Code);
+            Append(canonical, "warning.message", warning.Message);
+        }
+
+        string stateFingerprint = Sha256(canonical.ToString());
+        string executionToken = Sha256($"{FormatVersion}\nexecution\n{operation}\n{stateFingerprint}");
+        return new CoreWritePlanSnapshot(
+            operation,
+            stateFingerprint,
+            executionToken,
+            capturedTargets,
+            capturedAutoPruneTargets,
+            capturedWarnings);
+    }
+
+    public static void AssertExactMatch(
+        CoreWritePlanSnapshot expected,
+        CoreWritePlanSnapshot actual)
+    {
+        ArgumentNullException.ThrowIfNull(expected);
+        ArgumentNullException.ThrowIfNull(actual);
+        if (!string.Equals(expected.Operation, actual.Operation, StringComparison.Ordinal)
+            || !FixedTimeEquals(expected.StateFingerprint, actual.StateFingerprint)
+            || !FixedTimeEquals(expected.ExecutionToken, actual.ExecutionToken)
+            || !expected.Targets.SequenceEqual(actual.Targets)
+            || !expected.AutoPruneDeletionTargets.SequenceEqual(actual.AutoPruneDeletionTargets))
+        {
+            throw new CoreWritePlanStaleException();
+        }
+    }
+
+    private static async Task<IReadOnlyList<CoreWritePlanTarget>> CaptureTargetsAsync(
+        IEnumerable<CoreWriteTargetSpec> specs,
+        CancellationToken cancellationToken)
+    {
+        CoreWriteTargetSpec[] normalized = specs
+            .Select(static spec => new CoreWriteTargetSpec(
+                Path.GetFullPath(spec.Path),
+                spec.Action,
+                spec.FingerprintMode))
+            .DistinctBy(static spec => (spec.Path, spec.Action, spec.FingerprintMode))
+            .OrderBy(static spec => spec.Path, StringComparer.Ordinal)
+            .ThenBy(static spec => spec.Action, StringComparer.Ordinal)
+            .ToArray();
+        List<CoreWritePlanTarget> result = new(normalized.Length);
+        Dictionary<(string Path, CoreWriteFingerprintMode Mode), string> fingerprintCache = [];
+        foreach (CoreWriteTargetSpec spec in normalized)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            (string Path, CoreWriteFingerprintMode Mode) cacheKey = (spec.Path, spec.FingerprintMode);
+            if (!fingerprintCache.TryGetValue(cacheKey, out string? fingerprint))
+            {
+                fingerprint = await FingerprintPathAsync(
+                    spec.Path,
+                    spec.FingerprintMode,
+                    cancellationToken);
+                fingerprintCache.Add(cacheKey, fingerprint);
+            }
+            result.Add(new CoreWritePlanTarget(spec.Path, spec.Action, fingerprint));
+        }
+        return result.AsReadOnly();
+    }
+
+    private static async Task<string> FingerprintPathAsync(
+        string fullPath,
+        CoreWriteFingerprintMode mode,
+        CancellationToken cancellationToken)
+    {
+        cancellationToken.ThrowIfCancellationRequested();
+        if (!File.Exists(fullPath) && !Directory.Exists(fullPath))
+        {
+            if (mode == CoreWriteFingerprintMode.SqliteWalContent)
+            {
+                return FingerprintEmptySqliteWal(fullPath);
+            }
+            return Sha256($"missing\n{fullPath}");
+        }
+
+        FileAttributes attributes = File.GetAttributes(fullPath);
+        if ((attributes & FileAttributes.ReparsePoint) != 0)
+        {
+            DateTime lastWrite = File.GetLastWriteTimeUtc(fullPath);
+            return Sha256($"reparse\n{fullPath}\n{(int)attributes}\n{lastWrite.Ticks}");
+        }
+        return (attributes & FileAttributes.Directory) != 0
+            ? await FingerprintDirectoryAsync(fullPath, mode, cancellationToken)
+            : mode switch
+            {
+                CoreWriteFingerprintMode.RecursiveInventory => FingerprintFileInventory(fullPath, attributes),
+                CoreWriteFingerprintMode.SqliteMainContent => await FingerprintSqliteFileAsync(
+                    fullPath,
+                    normalizeEmptyWal: false,
+                    cancellationToken),
+                CoreWriteFingerprintMode.SqliteWalContent => await FingerprintSqliteFileAsync(
+                    fullPath,
+                    normalizeEmptyWal: true,
+                    cancellationToken),
+                _ => await FingerprintFileAsync(fullPath, cancellationToken)
+            };
+    }
+
+    private static async Task<string> FingerprintDirectoryAsync(
+        string directoryPath,
+        CoreWriteFingerprintMode mode,
+        CancellationToken cancellationToken)
+    {
+        StringBuilder canonical = new();
+        Append(canonical, "type", "directory");
+        Append(canonical, "path", directoryPath);
+        string[] entries;
+        try
+        {
+            entries = Directory.EnumerateFileSystemEntries(directoryPath)
+                .Where(static path => !string.Equals(
+                    Path.GetFileName(path),
+                    "auth.json",
+                    StringComparison.OrdinalIgnoreCase))
+                .Order(StringComparer.Ordinal)
+                .ToArray();
+        }
+        catch (DirectoryNotFoundException)
+        {
+            return Sha256($"missing\n{directoryPath}");
+        }
+
+        foreach (string entry in entries)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            Append(canonical, "entry.name", Path.GetFileName(entry));
+            Append(
+                canonical,
+                "entry.fingerprint",
+                await FingerprintPathAsync(entry, mode, cancellationToken));
+        }
+        return Sha256(canonical.ToString());
+    }
+
+    private static string FingerprintFileInventory(
+        string filePath,
+        FileAttributes attributes)
+    {
+        FileInfo info = new(filePath);
+        return Sha256(
+            $"file-inventory\n{filePath}\n{(int)attributes}\n{info.Length}\n{info.LastWriteTimeUtc.Ticks}");
+    }
+
+    private static async Task<string> FingerprintFileAsync(
+        string filePath,
+        CancellationToken cancellationToken)
+    {
+        FileInfo before = new(filePath);
+        long beforeLength = before.Length;
+        long beforeWriteTicks = before.LastWriteTimeUtc.Ticks;
+        try
+        {
+            await using FileStream stream = new(
+                filePath,
+                FileMode.Open,
+                FileAccess.Read,
+                FileShare.ReadWrite | FileShare.Delete,
+                64 * 1024,
+                FileOptions.Asynchronous | FileOptions.SequentialScan);
+            byte[] digest = await SHA256.HashDataAsync(stream, cancellationToken);
+            FileInfo after = new(filePath);
+            if (!after.Exists
+                || after.Length != beforeLength
+                || after.LastWriteTimeUtc.Ticks != beforeWriteTicks)
+            {
+                throw new CoreWritePlanStaleException();
+            }
+            return $"sha256:{Convert.ToHexString(digest).ToLowerInvariant()}:{beforeLength}:{beforeWriteTicks}";
+        }
+        catch (FileNotFoundException)
+        {
+            return Sha256($"missing\n{filePath}");
+        }
+    }
+
+    private static async Task<string> FingerprintSqliteFileAsync(
+        string filePath,
+        bool normalizeEmptyWal,
+        CancellationToken cancellationToken)
+    {
+        FileInfo before = new(filePath);
+        long beforeLength = before.Length;
+        try
+        {
+            await using FileStream stream = new(
+                filePath,
+                FileMode.Open,
+                FileAccess.Read,
+                FileShare.ReadWrite | FileShare.Delete,
+                64 * 1024,
+                FileOptions.Asynchronous | FileOptions.SequentialScan);
+            byte[] digest = await SHA256.HashDataAsync(stream, cancellationToken);
+            FileInfo after = new(filePath);
+            if (!after.Exists || after.Length != beforeLength)
+            {
+                throw new CoreWritePlanStaleException();
+            }
+
+            if (normalizeEmptyWal && beforeLength == 0)
+            {
+                return FingerprintEmptySqliteWal(filePath);
+            }
+
+            return $"sqlite-sha256:{Convert.ToHexString(digest).ToLowerInvariant()}:{beforeLength}";
+        }
+        catch (FileNotFoundException)
+        {
+            return normalizeEmptyWal
+                ? FingerprintEmptySqliteWal(filePath)
+                : Sha256($"missing\n{filePath}");
+        }
+    }
+
+    private static string FingerprintEmptySqliteWal(string filePath)
+    {
+        return Sha256($"sqlite-wal-empty\n{filePath}");
+    }
+
+    private static string Sha256(string value)
+    {
+        return "sha256:" + Convert.ToHexString(
+                SHA256.HashData(Encoding.UTF8.GetBytes(value)))
+            .ToLowerInvariant();
+    }
+
+    private static bool FixedTimeEquals(string left, string right)
+    {
+        byte[] leftBytes = Encoding.UTF8.GetBytes(left);
+        byte[] rightBytes = Encoding.UTF8.GetBytes(right);
+        return leftBytes.Length == rightBytes.Length
+            && CryptographicOperations.FixedTimeEquals(leftBytes, rightBytes);
+    }
+
+    private static void Append(StringBuilder builder, string key, string value)
+    {
+        builder.Append(key.Length).Append(':').Append(key).Append('=')
+            .Append(value.Length).Append(':').Append(value).Append(';');
+    }
+}
diff --git a/desktop/CodexProviderSync.Core/GlobalStateService.cs b/desktop/CodexProviderSync.Core/GlobalStateService.cs
index 416bae6..50cf09f 100644
--- a/desktop/CodexProviderSync.Core/GlobalStateService.cs
+++ b/desktop/CodexProviderSync.Core/GlobalStateService.cs
@@ -102,7 +102,9 @@ public async Task<WorkspaceRootSyncResult> SyncWorkspaceRootsAsync(
 
     public async Task<WorkspaceRootSyncResult> SyncWorkspaceRootsAsync(
         CodexStorageLayout storage,
-        IReadOnlyList<ThreadCwdStat>? cwdStats = null)
+        IReadOnlyList<ThreadCwdStat>? cwdStats = null,
+        Func<string, Task>? onBeforeWrite = null,
+        Func<string, Task>? onApplied = null)
     {
         string codexHome = storage.CodexHome;
         string statePath = StatePath(codexHome);
@@ -177,8 +179,25 @@ public async Task<WorkspaceRootSyncResult> SyncWorkspaceRootsAsync(
         if (updated)
         {
             string json = state.ToJsonString(JsonOptions()) + Environment.NewLine;
-            await File.WriteAllTextAsync(statePath, json);
-            await File.WriteAllTextAsync(BackupPath(codexHome), json);
+            if (onBeforeWrite is not null)
+            {
+                await onBeforeWrite(statePath);
+            }
+            await AtomicFile.WriteAllTextAsync(statePath, json);
+            if (onApplied is not null)
+            {
+                await onApplied(statePath);
+            }
+            string backupPath = BackupPath(codexHome);
+            if (onBeforeWrite is not null)
+            {
+                await onBeforeWrite(backupPath);
+            }
+            await AtomicFile.WriteAllTextAsync(backupPath, json);
+            if (onApplied is not null)
+            {
+                await onApplied(backupPath);
+            }
         }
 
         return new WorkspaceRootSyncResult
diff --git a/desktop/CodexProviderSync.Core/LockService.cs b/desktop/CodexProviderSync.Core/LockService.cs
index a94d6dc..47dcf62 100644
--- a/desktop/CodexProviderSync.Core/LockService.cs
+++ b/desktop/CodexProviderSync.Core/LockService.cs
@@ -1,47 +1,1060 @@
+using System.Diagnostics;
+using System.Globalization;
 using System.Runtime.InteropServices;
+using System.Text;
 using System.Text.Json;
 
 namespace CodexProviderSync.Core;
 
 public sealed class LockService
 {
+    private const int ProtocolVersion = 2;
     private const int Win32ErrorAlreadyExists = 183;
+    private const int Win32ErrorFileExists = 80;
+    private const int UnixErrorAlreadyExists = 17;
     private const int Win32ErrorAccessDenied = 5;
     private const int DefaultLockCreateRetryCount = 3;
     private const int DefaultLockCreateRetryDelayMs = 75;
+    private const int DefaultOwnedClaimDeleteRetryCount = 3;
+    private const int DefaultOwnedClaimDeleteRetryDelayMs = 75;
+    private const string BusyErrorDataKey = "codex-provider-sync/error-code";
+    public const string OperationBusyErrorCode = "TARGET_BUSY";
+    private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web)
+    {
+        WriteIndented = true
+    };
+
+    private readonly Func<string, string, Task>? _testHook;
+
+    public LockService()
+    {
+    }
+
+    internal LockService(Func<string, string, Task>? testHook)
+    {
+        _testHook = testHook;
+    }
+
+    public Task<LockHandle> AcquireLockAsync(
+        string codexHome,
+        string label = "codex-provider-sync")
+    {
+        return AcquirePathLockAsync(AppConstants.LockPath(codexHome), label);
+    }
+
+    /// <summary>
+    /// Acquires an operation lock at an explicit canonical path. Keeping this
+    /// primitive path-based lets callers apply the same cross-runtime protocol
+    /// to narrower resources (for example a resolved SQLite home) later.
+    /// </summary>
+    public async Task<LockHandle> AcquirePathLockAsync(
+        string lockPath,
+        string label = "codex-provider-sync")
+    {
+        string canonicalPath = Path.GetFullPath(lockPath);
+        string parentPath = Path.GetDirectoryName(canonicalPath)
+            ?? throw new InvalidOperationException($"Cannot resolve the parent directory for lock {canonicalPath}.");
+        string claimsPath = canonicalPath + ".claims";
+        Directory.CreateDirectory(parentPath);
+        Directory.CreateDirectory(claimsPath);
+        SetOwnerOnlyDirectoryMode(claimsPath);
+
+        LockOwner owner = CreateCurrentOwner(label);
+        string claimPath = Path.Combine(claimsPath, owner.InstanceId + ".json");
+        string candidatePath = $"{canonicalPath}.candidate.{owner.ProcessId}.{owner.InstanceId}";
+        string reservationMarkerPath = ReservationMarkerPath(canonicalPath, owner.InstanceId);
+        bool claimPublished = false;
+        bool canonicalReserved = false;
+        bool ownerLinked = false;
+
+        try
+        {
+            await PublishClaimAsync(claimPath, owner);
+            claimPublished = true;
+            if (_testHook is not null)
+            {
+                await _testHook("claim-published", owner.InstanceId);
+            }
+
+            await AssertSoleLiveClaimAsync(canonicalPath, claimsPath, claimPath, owner);
+            await ReclaimCanonicalIfStaleAsync(canonicalPath);
+
+            // A contender can publish while a stale canonical lock is being
+            // quarantined. Re-check immediately before publishing ours. A new
+            // protocol contender will see this live claim and withdraw.
+            await AssertSoleLiveClaimAsync(canonicalPath, claimsPath, claimPath, owner);
+
+            Directory.CreateDirectory(candidatePath);
+            SetOwnerOnlyDirectoryMode(candidatePath);
+            await AtomicFile.WriteAllTextAsync(
+                Path.Combine(candidatePath, "owner.json"),
+                JsonSerializer.Serialize(owner, JsonOptions));
+
+            await CreateLockDirectoryAsync(canonicalPath);
+            canonicalReserved = true;
+            await WriteReservationMarkerAsync(reservationMarkerPath, owner.InstanceId);
+            if (_testHook is not null)
+            {
+                await _testHook("canonical-reserved", owner.InstanceId);
+            }
+
+            try
+            {
+                CreateHardLinkNoReplace(
+                    Path.Combine(candidatePath, "owner.json"),
+                    Path.Combine(canonicalPath, "owner.json"));
+            }
+            catch (IOException error) when (IsAlreadyExistsError(error))
+            {
+                throw LockAlreadyExists(
+                    canonicalPath,
+                    "another owner populated the canonical reservation before owner.json could be published");
+            }
+            ownerLinked = true;
+            if (!await ReservationMarkerMatchesAsync(reservationMarkerPath, owner.InstanceId))
+            {
+                throw LockAlreadyExists(
+                    canonicalPath,
+                    "the canonical reservation changed identity while owner.json was being published");
+            }
+
+            TryDeleteDirectory(candidatePath);
+            return new LockHandle(canonicalPath, claimsPath, claimPath, owner.InstanceId);
+        }
+        catch (Exception acquisitionError)
+        {
+            TryDeleteDirectory(candidatePath);
+            if (canonicalReserved && !ownerLinked)
+            {
+                if (await TryDeleteOwnedReservationMarkerAsync(reservationMarkerPath, owner.InstanceId))
+                {
+                    TryDeleteEmptyDirectory(canonicalPath);
+                }
+            }
+            if (claimPublished && !ownerLinked)
+            {
+                OwnedClaimDeleteResult cleanup;
+                try
+                {
+                    cleanup = await DeleteOwnedClaimWithRetriesAsync(
+                        claimPath,
+                        owner.InstanceId,
+                        beforeDeleteAttemptAsync: _testHook is null
+                            ? null
+                            : () => _testHook("before-owned-claim-delete", owner.InstanceId));
+                }
+                catch (Exception cleanupError)
+                {
+                    throw new AggregateException(
+                        $"Lock acquisition failed and owned-claim cleanup threw unexpectedly: {acquisitionError.Message} Cleanup failure: {cleanupError.Message}",
+                        acquisitionError,
+                        cleanupError);
+                }
+                if (!cleanup.Succeeded)
+                {
+                    throw new AggregateException(
+                        $"Lock acquisition failed and owned-claim cleanup was incomplete: {acquisitionError.Message} Cleanup failure: {cleanup.Failure!.Message}",
+                        acquisitionError,
+                        cleanup.Failure!);
+                }
+            }
+            throw;
+        }
+    }
+
+    private static LockOwner CreateCurrentOwner(string label)
+    {
+        using Process process = Process.GetCurrentProcess();
+        string processStartedAt = FormatUtcSecond(process.StartTime.ToUniversalTime());
+        return new LockOwner
+        {
+            ProtocolVersion = ProtocolVersion,
+            Runtime = "dotnet",
+            Pid = Environment.ProcessId,
+            ProcessId = Environment.ProcessId,
+            ProcessStartedAt = processStartedAt,
+            InstanceId = Guid.NewGuid().ToString("D"),
+            StartedAt = FormatUtcSecond(DateTime.UtcNow),
+            Label = label,
+            Cwd = Environment.CurrentDirectory,
+            CurrentDirectory = Environment.CurrentDirectory
+        };
+    }
+
+    private static async Task PublishClaimAsync(string claimPath, LockOwner owner)
+    {
+        string directory = Path.GetDirectoryName(claimPath)!;
+        string tempPath = Path.Combine(
+            directory,
+            $".{Path.GetFileName(claimPath)}.{Environment.ProcessId}.{Guid.NewGuid():N}.tmp");
+        try
+        {
+            byte[] bytes = new UTF8Encoding(encoderShouldEmitUTF8Identifier: false)
+                .GetBytes(JsonSerializer.Serialize(owner, JsonOptions));
+            await using (FileStream stream = new(
+                tempPath,
+                FileMode.CreateNew,
+                FileAccess.Write,
+                FileShare.None,
+                16 * 1024,
+                FileOptions.Asynchronous | FileOptions.WriteThrough))
+            {
+                await stream.WriteAsync(bytes);
+                await stream.FlushAsync();
+                stream.Flush(flushToDisk: true);
+            }
+            if (!OperatingSystem.IsWindows())
+            {
+                File.SetUnixFileMode(
+                    tempPath,
+                    UnixFileMode.UserRead | UnixFileMode.UserWrite);
+            }
+            File.Move(tempPath, claimPath, overwrite: false);
+        }
+        finally
+        {
+            TryDeleteFile(tempPath);
+        }
+    }
+
+    private static async Task AssertSoleLiveClaimAsync(
+        string canonicalPath,
+        string claimsPath,
+        string ownClaimPath,
+        LockOwner ownOwner)
+    {
+        foreach (string candidate in Directory
+            .EnumerateFiles(claimsPath, "*.json", SearchOption.TopDirectoryOnly)
+            .Order(StringComparer.Ordinal))
+        {
+            if (PathComparer.Equals(Path.GetFullPath(candidate), Path.GetFullPath(ownClaimPath)))
+            {
+                OwnerReadResult ownRead = await ReadOwnerAsync(candidate, requireVersionTwo: true);
+                if (!ownRead.Valid
+                    || !string.Equals(ownRead.Owner!.InstanceId, ownOwner.InstanceId, StringComparison.OrdinalIgnoreCase))
+                {
+                    throw LockAlreadyExists(canonicalPath, "this process's claim identity changed before acquisition");
+                }
+                continue;
+            }
+
+            OwnerReadResult read = await ReadOwnerAsync(candidate, requireVersionTwo: true);
+            if (!read.Valid)
+            {
+                throw LockAlreadyExists(canonicalPath, $"claim {candidate} cannot be verified and is retained fail-closed");
+            }
+            if (!string.Equals(
+                    Path.GetFileNameWithoutExtension(candidate),
+                    read.Owner!.InstanceId,
+                    StringComparison.OrdinalIgnoreCase))
+            {
+                throw LockAlreadyExists(canonicalPath, $"claim {candidate} does not match its owner instanceId");
+            }
+
+            if (IsOwnerLive(read.Owner))
+            {
+                throw LockAlreadyExists(canonicalPath, $"another live claim ({read.Owner!.InstanceId}) exists");
+            }
+
+            if (!await TryQuarantineAndDeleteStaleClaimAsync(candidate, read.Owner!))
+            {
+                throw LockAlreadyExists(canonicalPath, $"stale claim {candidate} changed while it was being reclaimed");
+            }
+        }
+
+        // Enumeration is a snapshot. Check once more for a claim published
+        // during cleanup. Any other remaining final claim is conservatively a
+        // contender; it will independently observe this live claim as well.
+        string? otherClaim = Directory
+            .EnumerateFiles(claimsPath, "*.json", SearchOption.TopDirectoryOnly)
+            .FirstOrDefault(path => !PathComparer.Equals(
+                Path.GetFullPath(path),
+                Path.GetFullPath(ownClaimPath)));
+        if (otherClaim is not null)
+        {
+            throw LockAlreadyExists(canonicalPath, $"a concurrent claim appeared at {otherClaim}");
+        }
+    }
+
+    private static async Task<bool> TryQuarantineAndDeleteStaleClaimAsync(
+        string claimPath,
+        LockOwnerSnapshot expectedOwner)
+    {
+        string quarantinePath = $"{claimPath}.stale.{Environment.ProcessId}.{Guid.NewGuid():N}";
+        try
+        {
+            File.Move(claimPath, quarantinePath, overwrite: false);
+        }
+        catch (FileNotFoundException)
+        {
+            return true;
+        }
+        catch (DirectoryNotFoundException)
+        {
+            return true;
+        }
+        catch (Exception error) when (error is IOException or UnauthorizedAccessException)
+        {
+            return false;
+        }
+
+        OwnerReadResult moved = await ReadOwnerAsync(quarantinePath, requireVersionTwo: true);
+        if (!moved.Valid || !SameOwnerGeneration(moved.Owner!, expectedOwner))
+        {
+            TryRestoreFile(quarantinePath, claimPath);
+            return false;
+        }
+
+        TryDeleteFile(quarantinePath);
+        return !File.Exists(quarantinePath);
+    }
+
+    private async Task ReclaimCanonicalIfStaleAsync(string canonicalPath)
+    {
+        FileAttributes? attributes = TryGetPathAttributes(canonicalPath);
+        if (attributes is null)
+        {
+            return;
+        }
+        if ((attributes.Value & FileAttributes.ReparsePoint) != 0)
+        {
+            throw LockAlreadyExists(canonicalPath, "the canonical lock path is a symbolic link or reparse point");
+        }
+        if ((attributes.Value & FileAttributes.Directory) == 0)
+        {
+            throw LockAlreadyExists(canonicalPath, "the canonical lock path is not a directory");
+        }
+
+        string ownerPath = Path.Combine(canonicalPath, "owner.json");
+        OwnerReadResult read = await ReadOwnerAsync(ownerPath, requireVersionTwo: false);
+        if (!read.Valid)
+        {
+            throw LockAlreadyExists(canonicalPath, "owner.json cannot be verified and is retained fail-closed");
+        }
+        if (IsOwnerLive(read.Owner!))
+        {
+            throw LockAlreadyExists(canonicalPath, $"PID {read.Owner!.ProcessId} is still the verified owner");
+        }
+        if (_testHook is not null)
+        {
+            await _testHook("before-stale-canonical-reclaim", read.Owner!.InstanceId ?? string.Empty);
+        }
+
+        string quarantinePath = $"{canonicalPath}.stale.{Environment.ProcessId}.{Guid.NewGuid():N}";
+        try
+        {
+            Directory.Move(canonicalPath, quarantinePath);
+        }
+        catch (DirectoryNotFoundException)
+        {
+            return;
+        }
+        catch (Exception error) when (error is IOException or UnauthorizedAccessException)
+        {
+            throw LockAlreadyExists(canonicalPath, "the canonical lock changed during stale-owner reclamation");
+        }
+
+        OwnerReadResult moved = await ReadOwnerAsync(
+            Path.Combine(quarantinePath, "owner.json"),
+            requireVersionTwo: false);
+        if (!moved.Valid || !SameOwnerGeneration(moved.Owner!, read.Owner!))
+        {
+            bool restored = await TryRestoreQuarantinedOwnerAsync(
+                quarantinePath,
+                canonicalPath,
+                moved.Owner?.InstanceId);
+            throw LockAlreadyExists(
+                canonicalPath,
+                restored
+                    ? "the owner changed during reclamation, so the moved lock was restored"
+                    : $"the owner changed during reclamation; it is preserved at {quarantinePath}");
+        }
+
+        TryDeleteDirectory(quarantinePath);
+        if (Directory.Exists(quarantinePath))
+        {
+            throw new IOException($"Unable to remove quarantined stale lock {quarantinePath}.");
+        }
+    }
+
+    private static async Task<OwnerReadResult> ReadOwnerAsync(
+        string ownerPath,
+        bool requireVersionTwo)
+    {
+        string text;
+        try
+        {
+            text = await ReadIdentityTextAsync(ownerPath);
+        }
+        catch (Exception error) when (error is IOException or UnauthorizedAccessException)
+        {
+            return new OwnerReadResult(null, error.Message);
+        }
+
+        try
+        {
+            using JsonDocument document = JsonDocument.Parse(text);
+            JsonElement root = document.RootElement;
+            int? protocolVersion = TryReadInt(root, "protocolVersion");
+            int? pid = TryReadInt(root, "pid");
+            int? processId = TryReadInt(root, "processId");
+            if (pid is not null && processId is not null && pid != processId)
+            {
+                return new OwnerReadResult(null, "pid and processId disagree");
+            }
+            int? effectivePid = pid ?? processId;
+            if (effectivePid is null || effectivePid <= 0)
+            {
+                return new OwnerReadResult(null, "process identity is missing");
+            }
+
+            string? instanceId = TryReadString(root, "instanceId");
+            string? processStartedAtText = TryReadString(root, "processStartedAt");
+            DateTimeOffset? processStartedAt = null;
+            if (processStartedAtText is not null)
+            {
+                if (!DateTimeOffset.TryParse(
+                        processStartedAtText,
+                        CultureInfo.InvariantCulture,
+                        DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal,
+                        out DateTimeOffset parsed))
+                {
+                    return new OwnerReadResult(null, "processStartedAt is invalid");
+                }
+                processStartedAt = TruncateToUtcSecond(parsed);
+            }
+            string? processStartMarker = TryReadString(root, "processStartMarker");
+
+            if (protocolVersion is not null
+                && protocolVersion is not (1 or ProtocolVersion))
+            {
+                return new OwnerReadResult(null, "owner protocol version is unsupported");
+            }
+            if (requireVersionTwo && protocolVersion != ProtocolVersion)
+            {
+                return new OwnerReadResult(null, "version 2 owner identity is required");
+            }
+            if (protocolVersion == ProtocolVersion
+                && (pid is null
+                    || processId is null
+                    || string.IsNullOrWhiteSpace(instanceId)
+                    || processStartedAt is null))
+            {
+                return new OwnerReadResult(null, "version 2 owner identity is incomplete");
+            }
+            if (processStartedAt is null && string.IsNullOrWhiteSpace(processStartMarker))
+            {
+                // Legacy records without a process start identity can only be
+                // treated as live when their PID exists; they are never
+                // reclaimed on a PID-reuse guess.
+                processStartMarker = null;
+            }
+
+            return new OwnerReadResult(new LockOwnerSnapshot(
+                protocolVersion ?? 0,
+                effectivePid.Value,
+                processStartedAt,
+                processStartMarker,
+                instanceId,
+                text), null);
+        }
+        catch (Exception error) when (error is JsonException or InvalidOperationException)
+        {
+            return new OwnerReadResult(null, error.Message);
+        }
+    }
+
+    private static async Task<string> ReadIdentityTextAsync(string path)
+    {
+        await using FileStream stream = OpenIdentityReadStream(path);
+        using StreamReader reader = new(
+            stream,
+            Encoding.UTF8,
+            detectEncodingFromByteOrderMarks: true,
+            bufferSize: 4096,
+            leaveOpen: true);
+        return await reader.ReadToEndAsync();
+    }
+
+    private static FileStream OpenIdentityReadStream(string path)
+    {
+        return new FileStream(
+            path,
+            FileMode.Open,
+            FileAccess.Read,
+            FileShare.Read | FileShare.Delete,
+            bufferSize: 4096,
+            FileOptions.Asynchronous | FileOptions.SequentialScan);
+    }
+
+    internal static FileStream OpenIdentityReadStreamForTests(string path)
+    {
+        return OpenIdentityReadStream(path);
+    }
+
+    private static bool IsOwnerLive(LockOwnerSnapshot owner)
+    {
+        try
+        {
+            using Process process = Process.GetProcessById(owner.ProcessId);
+            if (process.HasExited)
+            {
+                return false;
+            }
+
+            if (owner.ProcessStartedAt is not null)
+            {
+                DateTimeOffset actual = TruncateToUtcSecond(process.StartTime.ToUniversalTime());
+                return actual == owner.ProcessStartedAt.Value;
+            }
+
+            if (!string.IsNullOrWhiteSpace(owner.ProcessStartMarker))
+            {
+                bool? markerMatches = TryMatchLegacyProcessStartMarker(process, owner.ProcessStartMarker);
+                return markerMatches ?? true;
+            }
+
+            // A legacy live PID without a comparable start identity is kept
+            // fail-closed so PID reuse can never delete an active lock.
+            return true;
+        }
+        catch (ArgumentException)
+        {
+            return false;
+        }
+        catch (InvalidOperationException)
+        {
+            return false;
+        }
+        catch (System.ComponentModel.Win32Exception)
+        {
+            return true;
+        }
+    }
+
+    private static bool? TryMatchLegacyProcessStartMarker(Process process, string marker)
+    {
+        if (marker.StartsWith("windows:", StringComparison.Ordinal))
+        {
+            string ticksText = marker["windows:".Length..];
+            return long.TryParse(ticksText, CultureInfo.InvariantCulture, out long ticks)
+                ? process.StartTime.ToUniversalTime().Ticks == ticks
+                : null;
+        }
+
+        if (marker.StartsWith("linux:", StringComparison.Ordinal) && OperatingSystem.IsLinux())
+        {
+            try
+            {
+                string stat = File.ReadAllText($"/proc/{process.Id}/stat");
+                string bootId = File.ReadAllText("/proc/sys/kernel/random/boot_id").Trim();
+                int closeParen = stat.LastIndexOf(')');
+                if (closeParen < 0)
+                {
+                    return null;
+                }
+                string[] fields = stat[(closeParen + 1)..]
+                    .Trim()
+                    .Split(' ', StringSplitOptions.RemoveEmptyEntries);
+                if (fields.Length <= 19)
+                {
+                    return null;
+                }
+                return string.Equals(
+                    marker,
+                    $"linux:{bootId}:{fields[19]}",
+                    StringComparison.Ordinal);
+            }
+            catch
+            {
+                return null;
+            }
+        }
+
+        int separator = marker.IndexOf(':');
+        if (separator > 0
+            && DateTimeOffset.TryParse(
+                marker[(separator + 1)..],
+                CultureInfo.InvariantCulture,
+                DateTimeStyles.AssumeLocal,
+                out DateTimeOffset parsed))
+        {
+            return TruncateToUtcSecond(parsed) == TruncateToUtcSecond(process.StartTime.ToUniversalTime());
+        }
+        return null;
+    }
 
-    public async Task<LockHandle> AcquireLockAsync(string codexHome, string label = "codex-provider-sync")
+    private static bool SameOwnerGeneration(LockOwnerSnapshot left, LockOwnerSnapshot right)
     {
-        string lockPath = AppConstants.LockPath(codexHome);
-        Directory.CreateDirectory(Path.GetDirectoryName(lockPath)!);
+        if (!string.IsNullOrWhiteSpace(left.InstanceId)
+            || !string.IsNullOrWhiteSpace(right.InstanceId))
+        {
+            return string.Equals(left.InstanceId, right.InstanceId, StringComparison.OrdinalIgnoreCase)
+                && left.ProcessId == right.ProcessId
+                && left.ProcessStartedAt == right.ProcessStartedAt
+                && string.Equals(left.ProcessStartMarker, right.ProcessStartMarker, StringComparison.Ordinal);
+        }
+        return string.Equals(left.RawText, right.RawText, StringComparison.Ordinal);
+    }
+
+    private static async Task<OwnedClaimDeleteResult> DeleteOwnedClaimWithRetriesAsync(
+        string claimPath,
+        string instanceId,
+        int retryCount = DefaultOwnedClaimDeleteRetryCount,
+        int retryDelayMs = DefaultOwnedClaimDeleteRetryDelayMs,
+        Func<int, Task>? delayAsync = null,
+        Func<Task>? beforeDeleteAttemptAsync = null)
+    {
+        delayAsync ??= static delay => Task.Delay(delay);
+        Exception? lastFailure = null;
 
-        await CreateLockDirectoryAsync(lockPath);
+        for (int attempt = 0; attempt <= retryCount; attempt += 1)
+        {
+            try
+            {
+                if (TryGetPathAttributes(claimPath) is null)
+                {
+                    return OwnedClaimDeleteResult.Success;
+                }
+
+                OwnerReadResult read = await ReadOwnerAsync(claimPath, requireVersionTwo: true);
+                if (!read.Valid)
+                {
+                    throw new IOException(
+                        $"Unable to verify owned claim {claimPath}: {read.Error ?? "unknown owner-read failure"}.");
+                }
+
+                if (!string.Equals(read.Owner!.InstanceId, instanceId, StringComparison.OrdinalIgnoreCase))
+                {
+                    return OwnedClaimDeleteResult.Failed(new InvalidOperationException(
+                        $"Refusing to delete claim {claimPath}: expected instanceId {instanceId}, but found {read.Owner.InstanceId ?? "<missing>"}."));
+                }
+
+                if (beforeDeleteAttemptAsync is not null)
+                {
+                    await beforeDeleteAttemptAsync();
+                }
+                File.Delete(claimPath);
+                return OwnedClaimDeleteResult.Success;
+            }
+            catch (Exception error) when (error is IOException or UnauthorizedAccessException)
+            {
+                lastFailure = error;
+            }
+            catch (Exception error)
+            {
+                return OwnedClaimDeleteResult.Failed(new IOException(
+                    $"Unable to delete owned claim {claimPath} for instanceId {instanceId}.",
+                    error));
+            }
+
+            if (attempt < retryCount)
+            {
+                await delayAsync(retryDelayMs);
+            }
+        }
+
+        int attempts = retryCount + 1;
+        return OwnedClaimDeleteResult.Failed(new IOException(
+            $"Unable to delete owned claim {claimPath} for instanceId {instanceId} after {attempts} attempts. Last failure: {lastFailure?.Message ?? "unknown cleanup failure"}",
+            lastFailure));
+    }
 
+    private static async Task<bool> TryDeleteOwnedClaimAsync(string claimPath, string instanceId)
+    {
+        return (await DeleteOwnedClaimWithRetriesAsync(claimPath, instanceId)).Succeeded;
+    }
+
+    internal static async ValueTask ReleaseAsync(
+        string canonicalPath,
+        string claimsPath,
+        string claimPath,
+        string instanceId)
+    {
+        FileAttributes? canonicalAttributes = TryGetPathAttributes(canonicalPath);
+        if (canonicalAttributes is null)
+        {
+            if (!await TryDeleteOwnedClaimAsync(claimPath, instanceId))
+            {
+                throw new InvalidOperationException(
+                    $"Refusing to delete claim {claimPath} because its owner identity changed.");
+            }
+            return;
+        }
+        if ((canonicalAttributes.Value & FileAttributes.ReparsePoint) != 0)
+        {
+            throw new InvalidOperationException(
+                $"Refusing to release lock {canonicalPath} because the canonical path is a symbolic link or reparse point.");
+        }
+        if ((canonicalAttributes.Value & FileAttributes.Directory) == 0)
+        {
+            throw new InvalidOperationException(
+                $"Refusing to release lock {canonicalPath} because the canonical path is not a directory.");
+        }
+
+        OwnerReadResult current = await ReadOwnerAsync(
+            Path.Combine(canonicalPath, "owner.json"),
+            requireVersionTwo: true);
+        if (!current.Valid
+            || !string.Equals(current.Owner!.InstanceId, instanceId, StringComparison.OrdinalIgnoreCase))
+        {
+            await TryDeleteOwnedClaimAsync(claimPath, instanceId);
+            throw new InvalidOperationException(
+                $"Refusing to release lock {canonicalPath} because its owner identity changed.");
+        }
+        if (!await ReservationMarkerMatchesAsync(
+                ReservationMarkerPath(canonicalPath, instanceId),
+                instanceId))
+        {
+            throw new InvalidOperationException(
+                $"Refusing to release lock {canonicalPath} because its reservation identity changed.");
+        }
+
+        string releasePath = $"{canonicalPath}.release.{Environment.ProcessId}.{Guid.NewGuid():N}";
         try
         {
-            LockOwner owner = new()
+            Directory.Move(canonicalPath, releasePath);
+        }
+        catch (DirectoryNotFoundException)
+        {
+            if (!await TryDeleteOwnedClaimAsync(claimPath, instanceId))
             {
-                ProcessId = Environment.ProcessId,
-                StartedAt = DateTimeOffset.UtcNow,
-                Label = label,
-                CurrentDirectory = Environment.CurrentDirectory
-            };
-            await File.WriteAllTextAsync(
-                Path.Combine(lockPath, "owner.json"),
-                JsonSerializer.Serialize(owner, new JsonSerializerOptions
+                throw new InvalidOperationException(
+                    $"Refusing to delete claim {claimPath} because its owner identity changed.");
+            }
+            return;
+        }
+
+        OwnerReadResult moved = await ReadOwnerAsync(
+            Path.Combine(releasePath, "owner.json"),
+            requireVersionTwo: true);
+        if (!moved.Valid
+            || !string.Equals(moved.Owner!.InstanceId, instanceId, StringComparison.OrdinalIgnoreCase))
+        {
+            bool restored = await TryRestoreQuarantinedOwnerAsync(
+                releasePath,
+                canonicalPath,
+                moved.Owner?.InstanceId);
+            await TryDeleteOwnedClaimAsync(claimPath, instanceId);
+            throw new InvalidOperationException(
+                restored
+                    ? $"Refusing to release lock {canonicalPath} because its owner identity changed; the lock was restored."
+                    : $"Refusing to release lock {canonicalPath} because its owner identity changed; it is preserved at {releasePath}.");
+        }
+
+        Directory.Delete(releasePath, recursive: true);
+        if (!await TryDeleteOwnedClaimAsync(claimPath, instanceId))
+        {
+            throw new InvalidOperationException(
+                $"Released canonical lock {canonicalPath}, but refused to delete claim {claimPath} because its owner identity changed.");
+        }
+
+        _ = claimsPath; // The sibling claims directory intentionally persists.
+    }
+
+    public static bool IsOperationBusy(Exception error)
+    {
+        return error is InvalidOperationException
+            && string.Equals(
+                error.Data[BusyErrorDataKey] as string,
+                OperationBusyErrorCode,
+                StringComparison.Ordinal);
+    }
+
+    private static InvalidOperationException LockAlreadyExists(string lockPath, string reason)
+    {
+        InvalidOperationException error = new(
+            $"Lock already exists at {lockPath}: {reason}. Close Codex/App and retry; do not remove it unless the recorded owner is known to be gone.");
+        error.Data[BusyErrorDataKey] = OperationBusyErrorCode;
+        return error;
+    }
+
+    private static int? TryReadInt(JsonElement root, string name)
+    {
+        return root.TryGetProperty(name, out JsonElement value)
+            && value.ValueKind == JsonValueKind.Number
+            && value.TryGetInt32(out int parsed)
+                ? parsed
+                : null;
+    }
+
+    private static string? TryReadString(JsonElement root, string name)
+    {
+        return root.TryGetProperty(name, out JsonElement value)
+            && value.ValueKind == JsonValueKind.String
+                ? value.GetString()
+                : null;
+    }
+
+    private static string FormatUtcSecond(DateTime value)
+    {
+        return TruncateToUtcSecond(value).ToString(
+            "yyyy-MM-dd'T'HH:mm:ss'Z'",
+            CultureInfo.InvariantCulture);
+    }
+
+    internal static string CurrentProcessStartedAtForTests()
+    {
+        using Process process = Process.GetCurrentProcess();
+        return FormatUtcSecond(process.StartTime.ToUniversalTime());
+    }
+
+    internal static string? CurrentProcessStartMarkerForTests()
+    {
+        using Process process = Process.GetCurrentProcess();
+        if (OperatingSystem.IsWindows())
+        {
+            return $"windows:{process.StartTime.ToUniversalTime().Ticks}";
+        }
+        if (OperatingSystem.IsLinux())
+        {
+            string stat = File.ReadAllText($"/proc/{process.Id}/stat");
+            string bootId = File.ReadAllText("/proc/sys/kernel/random/boot_id").Trim();
+            int closeParen = stat.LastIndexOf(')');
+            string[] fields = stat[(closeParen + 1)..]
+                .Trim()
+                .Split(' ', StringSplitOptions.RemoveEmptyEntries);
+            return $"linux:{bootId}:{fields[19]}";
+        }
+        if (OperatingSystem.IsMacOS())
+        {
+            return "darwin:" + process.StartTime.ToString(
+                "ddd MMM d HH:mm:ss yyyy",
+                CultureInfo.InvariantCulture);
+        }
+        return null;
+    }
+
+    private static DateTimeOffset TruncateToUtcSecond(DateTime value)
+    {
+        return TruncateToUtcSecond(new DateTimeOffset(value.ToUniversalTime()));
+    }
+
+    private static DateTimeOffset TruncateToUtcSecond(DateTimeOffset value)
+    {
+        DateTimeOffset utc = value.ToUniversalTime();
+        return new DateTimeOffset(
+            utc.Ticks - (utc.Ticks % TimeSpan.TicksPerSecond),
+            TimeSpan.Zero);
+    }
+
+    private static string ReservationMarkerPath(string canonicalPath, string instanceId)
+    {
+        return Path.Combine(canonicalPath, $".reservation.{instanceId}");
+    }
+
+    private static void SetOwnerOnlyDirectoryMode(string path)
+    {
+        if (!OperatingSystem.IsWindows())
+        {
+            File.SetUnixFileMode(
+                path,
+                UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute);
+        }
+    }
+
+    private static async Task WriteReservationMarkerAsync(string markerPath, string instanceId)
+    {
+        byte[] bytes = Encoding.UTF8.GetBytes(instanceId);
+        await using FileStream stream = new(
+            markerPath,
+            FileMode.CreateNew,
+            FileAccess.Write,
+            FileShare.None,
+            4096,
+            FileOptions.Asynchronous | FileOptions.WriteThrough);
+        await stream.WriteAsync(bytes);
+        await stream.FlushAsync();
+        stream.Flush(flushToDisk: true);
+        if (!OperatingSystem.IsWindows())
+        {
+            File.SetUnixFileMode(
+                markerPath,
+                UnixFileMode.UserRead | UnixFileMode.UserWrite);
+        }
+    }
+
+    private static async Task<bool> ReservationMarkerMatchesAsync(
+        string markerPath,
+        string instanceId)
+    {
+        try
+        {
+            return string.Equals(
+                await ReadIdentityTextAsync(markerPath),
+                instanceId,
+                StringComparison.Ordinal);
+        }
+        catch (Exception error) when (error is IOException or UnauthorizedAccessException)
+        {
+            return false;
+        }
+    }
+
+    private static async Task<bool> TryDeleteOwnedReservationMarkerAsync(
+        string markerPath,
+        string instanceId)
+    {
+        if (!await ReservationMarkerMatchesAsync(markerPath, instanceId))
+        {
+            return false;
+        }
+        TryDeleteFile(markerPath);
+        return !File.Exists(markerPath);
+    }
+
+    private static FileAttributes? TryGetPathAttributes(string path)
+    {
+        try
+        {
+            return File.GetAttributes(path);
+        }
+        catch (Exception error) when (error is FileNotFoundException or DirectoryNotFoundException)
+        {
+            return null;
+        }
+    }
+
+    private static void CreateHardLinkNoReplace(string existingPath, string newPath)
+    {
+        int result;
+        if (OperatingSystem.IsWindows())
+        {
+            result = CreateHardLinkWindows(newPath, existingPath, IntPtr.Zero)
+                ? 0
+                : Marshal.GetLastWin32Error();
+        }
+        else
+        {
+            result = LinkUnix(existingPath, newPath) == 0
+                ? 0
+                : Marshal.GetLastWin32Error();
+        }
+        if (result != 0)
+        {
+            throw new IOException(
+                $"Unable to publish lock owner at {newPath}. OS error: {result}",
+                new System.ComponentModel.Win32Exception(result));
+        }
+    }
+
+    private static bool IsAlreadyExistsError(IOException error)
+    {
+        return error.InnerException is System.ComponentModel.Win32Exception native
+            && native.NativeErrorCode is UnixErrorAlreadyExists
+                or Win32ErrorFileExists
+                or Win32ErrorAlreadyExists;
+    }
+
+    private static async Task<bool> TryRestoreQuarantinedOwnerAsync(
+        string source,
+        string destination,
+        string? instanceId)
+    {
+        string restorationToken = "restore-" + Guid.NewGuid().ToString("N");
+        string restorationMarker = ReservationMarkerPath(destination, restorationToken);
+        try
+        {
+            await CreateLockDirectoryAsync(destination, retryCount: 0);
+            await WriteReservationMarkerAsync(restorationMarker, restorationToken);
+            CreateHardLinkNoReplace(
+                Path.Combine(source, "owner.json"),
+                Path.Combine(destination, "owner.json"));
+
+            if (!string.IsNullOrWhiteSpace(instanceId))
+            {
+                string sourceMarker = ReservationMarkerPath(source, instanceId);
+                if (File.Exists(sourceMarker))
                 {
-                    PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
-                    WriteIndented = true
-                }));
-            return new LockHandle(lockPath);
+                    CreateHardLinkNoReplace(
+                        sourceMarker,
+                        ReservationMarkerPath(destination, instanceId));
+                }
+            }
+            if (!await TryDeleteOwnedReservationMarkerAsync(restorationMarker, restorationToken))
+            {
+                return false;
+            }
+            return true;
         }
         catch
         {
-            Directory.Delete(lockPath, recursive: true);
-            throw;
+            // Never rename source over destination here: POSIX rename can
+            // replace a concurrently-created empty directory. Keep source for
+            // diagnosis and remove only a reservation that stayed empty.
+            if (await TryDeleteOwnedReservationMarkerAsync(restorationMarker, restorationToken))
+            {
+                TryDeleteEmptyDirectory(destination);
+            }
+            return false;
         }
     }
 
+    private static void TryRestoreFile(string source, string destination)
+    {
+        try
+        {
+            if (!File.Exists(destination))
+            {
+                File.Move(source, destination, overwrite: false);
+            }
+        }
+        catch
+        {
+            // Preserve the quarantined claim for diagnosis if restoration is
+            // not possible. Never delete an identity that failed validation.
+        }
+    }
+
+    private static void TryDeleteFile(string path)
+    {
+        try
+        {
+            if (File.Exists(path))
+            {
+                File.Delete(path);
+            }
+        }
+        catch
+        {
+            // Best effort cleanup must not hide the ownership decision.
+        }
+    }
+
+    private static void TryDeleteDirectory(string path)
+    {
+        try
+        {
+            if (Directory.Exists(path))
+            {
+                Directory.Delete(path, recursive: true);
+            }
+        }
+        catch
+        {
+            // Best effort cleanup must not hide the ownership decision.
+        }
+    }
+
+    private static void TryDeleteEmptyDirectory(string path)
+    {
+        try
+        {
+            if (Directory.Exists(path))
+            {
+                Directory.Delete(path, recursive: false);
+            }
+        }
+        catch
+        {
+            // A foreign population is retained fail-closed.
+        }
+    }
+
+    private static StringComparer PathComparer => OperatingSystem.IsWindows()
+        ? StringComparer.OrdinalIgnoreCase
+        : StringComparer.Ordinal;
+
     internal static async Task CreateLockDirectoryAsync(
         string lockPath,
         int retryCount = DefaultLockCreateRetryCount,
@@ -63,8 +1076,7 @@ internal static async Task CreateLockDirectoryAsync(
 
             if (errorCode == Win32ErrorAlreadyExists)
             {
-                throw new InvalidOperationException(
-                    $"Lock already exists at {lockPath}. Close Codex/App and retry, or remove the stale lock if you are sure no sync is running.");
+                throw LockAlreadyExists(lockPath, "the canonical directory already exists");
             }
 
             if (!IsTransientLockCreateError(errorCode) || attempts >= retryCount)
@@ -113,41 +1125,89 @@ private static int TryCreateDirectoryUnix(string lockPath)
     [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
     private static extern bool CreateDirectory(string lpPathName, IntPtr lpSecurityAttributes);
 
+    [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode, EntryPoint = "CreateHardLinkW")]
+    private static extern bool CreateHardLinkWindows(
+        string lpFileName,
+        string lpExistingFileName,
+        IntPtr lpSecurityAttributes);
+
     [DllImport("libc", SetLastError = true, EntryPoint = "mkdir")]
     private static extern int Mkdir(string pathname, uint mode);
 
+    [DllImport("libc", SetLastError = true, EntryPoint = "link")]
+    private static extern int LinkUnix(string oldpath, string newpath);
+
     private sealed class LockOwner
     {
+        public required int ProtocolVersion { get; init; }
+        public required string Runtime { get; init; }
+        public required int Pid { get; init; }
         public required int ProcessId { get; init; }
-        public required DateTimeOffset StartedAt { get; init; }
+        public required string ProcessStartedAt { get; init; }
+        public required string InstanceId { get; init; }
+        public required string StartedAt { get; init; }
         public required string Label { get; init; }
+        public required string Cwd { get; init; }
         public required string CurrentDirectory { get; init; }
     }
+
+    private sealed record LockOwnerSnapshot(
+        int ProtocolVersion,
+        int ProcessId,
+        DateTimeOffset? ProcessStartedAt,
+        string? ProcessStartMarker,
+        string? InstanceId,
+        string RawText);
+
+    private sealed record OwnerReadResult(LockOwnerSnapshot? Owner, string? Error)
+    {
+        public bool Valid => Owner is not null;
+    }
+
+    private sealed record OwnedClaimDeleteResult(bool Succeeded, Exception? Failure)
+    {
+        internal static OwnedClaimDeleteResult Success { get; } = new(true, null);
+
+        internal static OwnedClaimDeleteResult Failed(Exception failure) => new(false, failure);
+    }
 }
 
 public sealed class LockHandle : IAsyncDisposable
 {
-    private readonly string _lockPath;
+    private readonly string _canonicalPath;
+    private readonly string _claimsPath;
+    private readonly string _claimPath;
+    private readonly string _instanceId;
     private bool _released;
 
-    public LockHandle(string lockPath)
+    internal LockHandle(
+        string canonicalPath,
+        string claimsPath,
+        string claimPath,
+        string instanceId)
     {
-        _lockPath = lockPath;
+        _canonicalPath = canonicalPath;
+        _claimsPath = claimsPath;
+        _claimPath = claimPath;
+        _instanceId = instanceId;
     }
 
-    public ValueTask DisposeAsync()
+    public string LockPath => _canonicalPath;
+
+    public string InstanceId => _instanceId;
+
+    public async ValueTask DisposeAsync()
     {
         if (_released)
         {
-            return ValueTask.CompletedTask;
+            return;
         }
 
+        await LockService.ReleaseAsync(
+            _canonicalPath,
+            _claimsPath,
+            _claimPath,
+            _instanceId);
         _released = true;
-        if (Directory.Exists(_lockPath))
-        {
-            Directory.Delete(_lockPath, recursive: true);
-        }
-
-        return ValueTask.CompletedTask;
     }
 }
diff --git a/desktop/CodexProviderSync.Core/Models.cs b/desktop/CodexProviderSync.Core/Models.cs
index b37dce8..4f744c8 100644
--- a/desktop/CodexProviderSync.Core/Models.cs
+++ b/desktop/CodexProviderSync.Core/Models.cs
@@ -1,5 +1,8 @@
 using System;
 using System.Collections.Generic;
+using System.Globalization;
+using System.Text.Json;
+using System.Text.Json.Serialization;
 
 namespace CodexProviderSync.Core;
 
@@ -33,8 +36,15 @@ public sealed class StatusSnapshot
     public IReadOnlyList<ProjectThreadVisibility> ProjectThreadVisibility { get; init; } = [];
     public required string BackupRoot { get; init; }
     public required BackupSummary BackupSummary { get; init; }
+    public IReadOnlyList<TransactionRecoveryInfo> PendingTransactions { get; init; } = [];
 }
 
+public sealed record TransactionRecoveryInfo(
+    string? OperationId,
+    string State,
+    string BackupDirectory,
+    string JournalPath);
+
 public sealed record StateDbLocation(string Path, string RelativePath, string Source);
 
 public sealed record SqliteAccessInfo(bool Supported, string? Reason, string? Message)
@@ -268,6 +278,9 @@ internal sealed class BackupMetadataFile
     public required List<string> DbFiles { get; init; }
     public List<string> SqliteDbFiles { get; init; } = [];
     public int ChangedSessionFiles { get; init; }
+    public Dictionary<string, bool>? GlobalStateFiles { get; init; }
+    public bool? GlobalStateFilePresent { get; init; }
+    public bool? GlobalStateBackupFilePresent { get; init; }
 }
 
 internal sealed class SessionBackupManifest
@@ -285,9 +298,113 @@ internal sealed class SessionBackupManifestEntry
     public required string Path { get; init; }
     public required string OriginalFirstLine { get; init; }
     public required string OriginalSeparator { get; init; }
+    public string? OriginalLastWriteTimeUtc { get; init; }
+    public double? OriginalMtimeMs { get; init; }
+    [JsonConverter(typeof(NullableInt64DecimalStringJsonConverter))]
     public long? OriginalLastWriteTimeUtcTicks { get; init; }
     public bool ModelOnlyChange { get; init; }
     public List<TurnContextModelBackup> OriginalTurnContextModels { get; init; } = [];
+
+    internal long? ResolveOriginalLastWriteTimeUtcTicks()
+    {
+        long? isoTicks = null;
+        if (!string.IsNullOrWhiteSpace(OriginalLastWriteTimeUtc))
+        {
+            if (!DateTimeOffset.TryParseExact(
+                    OriginalLastWriteTimeUtc,
+                    "yyyy-MM-dd'T'HH:mm:ss.fff'Z'",
+                    CultureInfo.InvariantCulture,
+                    DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal,
+                    out DateTimeOffset parsed))
+            {
+                throw new InvalidOperationException(
+                    $"Session backup has invalid originalLastWriteTimeUtc for {Path}.");
+            }
+            isoTicks = parsed.UtcTicks;
+        }
+
+        long? mtimeTicks = null;
+        if (OriginalMtimeMs is double mtimeMs)
+        {
+            if (!double.IsFinite(mtimeMs))
+            {
+                throw new InvalidOperationException(
+                    $"Session backup has non-finite originalMtimeMs for {Path}.");
+            }
+            double truncated = Math.Truncate(mtimeMs);
+            if (truncated < DateTimeOffset.MinValue.ToUnixTimeMilliseconds()
+                || truncated > DateTimeOffset.MaxValue.ToUnixTimeMilliseconds())
+            {
+                throw new InvalidOperationException(
+                    $"Session backup originalMtimeMs is out of range for {Path}.");
+            }
+            mtimeTicks = DateTimeOffset.FromUnixTimeMilliseconds(checked((long)truncated)).UtcTicks;
+        }
+
+        long? ticksAtMillisecond = OriginalLastWriteTimeUtcTicks is long ticks
+            ? ticks - (ticks % TimeSpan.TicksPerMillisecond)
+            : null;
+        long? expected = isoTicks ?? mtimeTicks ?? ticksAtMillisecond;
+        if ((isoTicks is not null && isoTicks != expected)
+            || (mtimeTicks is not null && mtimeTicks != expected)
+            || (ticksAtMillisecond is not null && ticksAtMillisecond != expected))
+        {
+            throw new InvalidOperationException(
+                $"Session backup timestamp fields disagree for {Path}.");
+        }
+        return OriginalLastWriteTimeUtcTicks ?? expected;
+    }
+
+    internal static SessionBackupManifestEntry FromChange(SessionChange change)
+    {
+        DateTimeOffset original = new(
+            new DateTime(change.OriginalLastWriteTimeUtcTicks, DateTimeKind.Utc));
+        long unixMilliseconds = original.ToUnixTimeMilliseconds();
+        return new SessionBackupManifestEntry
+        {
+            Path = change.Path,
+            OriginalFirstLine = change.OriginalFirstLine,
+            OriginalSeparator = change.OriginalSeparator,
+            OriginalLastWriteTimeUtc = original.ToString(
+                "yyyy-MM-dd'T'HH:mm:ss.fff'Z'",
+                CultureInfo.InvariantCulture),
+            OriginalMtimeMs = unixMilliseconds,
+            OriginalLastWriteTimeUtcTicks = change.OriginalLastWriteTimeUtcTicks,
+            ModelOnlyChange = change.ModelOnlyChange,
+            OriginalTurnContextModels = [.. change.OriginalTurnContextModels]
+        };
+    }
+}
+
+internal sealed class NullableInt64DecimalStringJsonConverter : JsonConverter<long?>
+{
+    public override long? Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+    {
+        if (reader.TokenType == JsonTokenType.Null)
+        {
+            return null;
+        }
+        if (reader.TokenType == JsonTokenType.String
+            && long.TryParse(reader.GetString(), NumberStyles.None, CultureInfo.InvariantCulture, out long textValue))
+        {
+            return textValue;
+        }
+        if (reader.TokenType == JsonTokenType.Number && reader.TryGetInt64(out long numericValue))
+        {
+            return numericValue;
+        }
+        throw new JsonException("Expected a decimal string or Int64 JSON number.");
+    }
+
+    public override void Write(Utf8JsonWriter writer, long? value, JsonSerializerOptions options)
+    {
+        if (value is null)
+        {
+            writer.WriteNullValue();
+            return;
+        }
+        writer.WriteStringValue(value.Value.ToString(CultureInfo.InvariantCulture));
+    }
 }
 
 public sealed class WorkspaceRootSyncResult
@@ -298,6 +415,46 @@ public sealed class WorkspaceRootSyncResult
     public required int SavedWorkspaceRootCount { get; init; }
 }
 
+public sealed class SyncTransactionException : InvalidOperationException
+{
+    public SyncTransactionException(
+        Exception originalError,
+        IReadOnlyList<string> rollbackErrors,
+        string backupDirectory,
+        IReadOnlyList<string> completedTargets,
+        IReadOnlyList<string> uncompletedTargets,
+        string rollbackStatus = "incomplete",
+        bool recoveryRequired = true)
+        : base(
+            recoveryRequired
+                ? $"Failed to restore state after sync error. Original error: {originalError.Message}. Restore error: {string.Join("; ", rollbackErrors)}"
+                : $"Provider sync failed and all observed changes were rolled back. Original error: {originalError.Message}",
+            originalError)
+    {
+        OriginalError = originalError;
+        RollbackErrors = rollbackErrors;
+        BackupDirectory = backupDirectory;
+        CompletedTargets = completedTargets;
+        UncompletedTargets = uncompletedTargets;
+        RollbackStatus = rollbackStatus;
+        RecoveryRequired = recoveryRequired;
+    }
+
+    public string Code => RecoveryRequired ? "RECOVERY_REQUIRED" : "SYNC_FAILED_ROLLED_BACK";
+    public Exception OriginalError { get; }
+    public IReadOnlyList<string> RollbackErrors { get; }
+    public string BackupDirectory { get; }
+    public IReadOnlyList<string> CompletedTargets { get; }
+    public IReadOnlyList<string> UncompletedTargets { get; }
+    public string RollbackStatus { get; }
+    public bool RecoveryRequired { get; }
+    public bool WasCanceled => OriginalError is OperationCanceledException;
+    public string RecoveryInstructions =>
+        RecoveryRequired
+            ? $"Restore the managed backup at {BackupDirectory}, inspect the pending transaction journal, then retry."
+            : "No manual recovery is required. Inspect the original error, correct its cause, and retry.";
+}
+
 public sealed class ThreadCwdStat
 {
     public required string Cwd { get; init; }
diff --git a/desktop/CodexProviderSync.Core/Properties/AssemblyInfo.cs b/desktop/CodexProviderSync.Core/Properties/AssemblyInfo.cs
index e518ce2..bc56cc4 100644
--- a/desktop/CodexProviderSync.Core/Properties/AssemblyInfo.cs
+++ b/desktop/CodexProviderSync.Core/Properties/AssemblyInfo.cs
@@ -1,3 +1,4 @@
 using System.Runtime.CompilerServices;
 
 [assembly: InternalsVisibleTo("CodexProviderSync.Core.Tests")]
+[assembly: InternalsVisibleTo("CodexProviderSync.CrashHost")]
diff --git a/desktop/CodexProviderSync.Core/SessionRolloutService.cs b/desktop/CodexProviderSync.Core/SessionRolloutService.cs
index fc01fcb..bad86b9 100644
--- a/desktop/CodexProviderSync.Core/SessionRolloutService.cs
+++ b/desktop/CodexProviderSync.Core/SessionRolloutService.cs
@@ -11,6 +11,8 @@ public sealed class SessionRolloutService
     private const string StatusOnlyProvider = "__status_only__";
     private const int ScanBufferSize = 1024 * 1024;
 
+    internal Func<string, SessionChange, Task>? ApplyFaultInjector { get; set; }
+
     public async Task<SessionChangeCollection> CollectSessionChangesAsync(
         string codexHome,
         string targetProvider,
@@ -35,7 +37,9 @@ public async Task<SessionChangeCollection> CollectSessionChangesAsync(
                 continue;
             }
 
-            foreach (string rolloutPath in Directory.EnumerateFiles(rootDir, "rollout-*.jsonl", SearchOption.AllDirectories))
+            foreach (string rolloutPath in Directory
+                .EnumerateFiles(rootDir, "rollout-*.jsonl", SearchOption.AllDirectories)
+                .Order(StringComparer.Ordinal))
             {
                 FirstLineRecord record;
                 try
@@ -97,13 +101,19 @@ record = await ReadFirstLineRecordAsync(rolloutPath);
 
                 bool providerChanged = !string.Equals(targetProvider, StatusOnlyProvider, StringComparison.Ordinal)
                     && !string.Equals(currentProvider, targetProvider, StringComparison.Ordinal);
+                IReadOnlyList<TurnContextModelBackup> currentModelBackups = [];
                 IReadOnlyList<string> currentModels = [];
                 bool modelChanged = false;
                 if (!string.IsNullOrEmpty(targetModel))
                 {
                     try
                     {
-                        currentModels = await ReadTurnContextModelsAsync(rolloutPath, record);
+                        currentModelBackups = await ReadTurnContextModelBackupsAsync(rolloutPath, record);
+                        currentModels = currentModelBackups
+                            .SelectMany(static backup => backup.OriginalModels.Count > 0
+                                ? backup.OriginalModels
+                                : [backup.OriginalModel])
+                            .ToArray();
                         modelChanged = currentModels.Any(model => !string.Equals(model, targetModel, StringComparison.Ordinal));
                     }
                     catch (Exception error) when (skipLockedReads && IsRolloutFileBusyError(error))
@@ -137,7 +147,8 @@ record = await ReadFirstLineRecordAsync(rolloutPath);
                         OriginalLastWriteTimeUtcTicks = snapshot.LastWriteTimeUtcTicks,
                         OriginalProvider = currentProvider,
                         UpdatedFirstLine = providerChanged ? root!.ToJsonString() : record.FirstLine,
-                        ModelOnlyChange = !providerChanged && modelChanged
+                        ModelOnlyChange = !providerChanged && modelChanged,
+                        OriginalTurnContextModels = currentModelBackups
                     });
                 }
             }
@@ -165,7 +176,10 @@ record = await ReadFirstLineRecordAsync(rolloutPath);
 
     public async Task<SessionApplyResult> ApplySessionChangesAsync(
         IEnumerable<SessionChange> changes,
-        string? targetModel = null)
+        string? targetModel = null,
+        Func<SessionChange, Task>? onBeforeApply = null,
+        Func<SessionChange, Task>? onApplied = null,
+        Func<SessionChange, Task>? onSkipped = null)
     {
         int appliedCount = 0;
         List<string> appliedPaths = [];
@@ -173,10 +187,18 @@ public async Task<SessionApplyResult> ApplySessionChangesAsync(
 
         foreach (SessionChange change in changes)
         {
+            if (onBeforeApply is not null)
+            {
+                await onBeforeApply(change);
+            }
             bool providerApplied = change.ModelOnlyChange || await TryRewriteCollectedSessionChangeAsync(change);
             if (!providerApplied)
             {
                 skippedPaths.Add(change.Path);
+                if (onSkipped is not null)
+                {
+                    await onSkipped(change);
+                }
                 continue;
             }
 
@@ -185,6 +207,10 @@ public async Task<SessionApplyResult> ApplySessionChangesAsync(
             {
                 if (!string.IsNullOrEmpty(targetModel))
                 {
+                    if (ApplyFaultInjector is not null)
+                    {
+                        await ApplyFaultInjector("after-provider-before-model", change);
+                    }
                     modelResult = await TryRewriteRolloutModelFieldAsync(change, targetModel);
                     change.OriginalTurnContextModels = modelResult.OriginalModels;
                 }
@@ -204,12 +230,20 @@ await RewriteFirstLineAsync(
             if (change.ModelOnlyChange && modelResult.ReplacedLines == 0)
             {
                 skippedPaths.Add(change.Path);
+                if (onSkipped is not null)
+                {
+                    await onSkipped(change);
+                }
                 continue;
             }
 
             TryRestoreLastWriteTimeUtc(change.Path, change.OriginalLastWriteTimeUtcTicks);
             appliedCount += 1;
             appliedPaths.Add(change.Path);
+            if (onApplied is not null)
+            {
+                await onApplied(change);
+            }
         }
 
         appliedPaths.Sort(StringComparer.Ordinal);
@@ -280,22 +314,14 @@ await RestoreTurnContextModelsAsync(
                     entry.OriginalTurnContextModels,
                     entry.OriginalSeparator);
             }
-            TryRestoreLastWriteTimeUtc(entry.Path, entry.OriginalLastWriteTimeUtcTicks);
+            TryRestoreLastWriteTimeUtc(entry.Path, entry.ResolveOriginalLastWriteTimeUtcTicks());
         }
     }
 
     internal Task RestoreSessionChangesAsync(IEnumerable<SessionChange> changes)
     {
         return RestoreSessionChangesAsync(
-            changes.Select(static change => new SessionBackupManifestEntry
-            {
-                Path = change.Path,
-                OriginalFirstLine = change.OriginalFirstLine,
-                OriginalSeparator = change.OriginalSeparator,
-                OriginalLastWriteTimeUtcTicks = change.OriginalLastWriteTimeUtcTicks,
-                ModelOnlyChange = change.ModelOnlyChange,
-                OriginalTurnContextModels = [.. change.OriginalTurnContextModels]
-            }));
+            changes.Select(SessionBackupManifestEntry.FromChange));
     }
 
     private static bool TryParseSessionMetaRecord(
@@ -473,11 +499,11 @@ private static async Task<FirstLineRecord> ReadFirstLineRecordAsync(FileStream s
         "\"model\"\\s*:\\s*\"((?:[^\"\\\\]|\\\\.)*)\"",
         RegexOptions.Compiled | RegexOptions.CultureInvariant);
 
-    private static async Task<IReadOnlyList<string>> ReadTurnContextModelsAsync(
+    private static async Task<IReadOnlyList<TurnContextModelBackup>> ReadTurnContextModelBackupsAsync(
         string rolloutPath,
         FirstLineRecord record)
     {
-        List<string> models = [];
+        List<TurnContextModelBackup> backups = [];
         try
         {
             await using FileStream stream = new(
@@ -487,22 +513,25 @@ private static async Task<IReadOnlyList<string>> ReadTurnContextModelsAsync(
                 FileShare.ReadWrite | FileShare.Delete);
             stream.Seek(record.Offset, SeekOrigin.Begin);
             using StreamReader reader = new(stream, Encoding.UTF8, detectEncodingFromByteOrderMarks: false, bufferSize: 4096, leaveOpen: true);
+            int lineIndex = 1;
             string? line;
             while ((line = await reader.ReadLineAsync().ConfigureAwait(false)) is not null)
             {
                 if (!TurnContextTypeRegex.IsMatch(line))
                 {
+                    lineIndex += 1;
                     continue;
                 }
 
+                List<string> originals = [];
                 foreach (Match match in TurnContextModelFieldRegex.Matches(line))
                 {
                     try
                     {
                         string? model = JsonSerializer.Deserialize<string>($"\"{match.Groups[1].Value}\"");
-                        if (!string.IsNullOrEmpty(model))
+                        if (model is not null)
                         {
-                            models.Add(model);
+                            originals.Add(model);
                         }
                     }
                     catch (JsonException)
@@ -510,8 +539,18 @@ private static async Task<IReadOnlyList<string>> ReadTurnContextModelsAsync(
                         // Leave malformed model literals untouched.
                     }
                 }
+                if (originals.Count > 0)
+                {
+                    backups.Add(new TurnContextModelBackup
+                    {
+                        LineIndex = lineIndex,
+                        OriginalModel = originals[0],
+                        OriginalModels = originals
+                    });
+                }
+                lineIndex += 1;
             }
-            return models;
+            return backups;
         }
         catch (Exception error) when (IsRolloutFileBusyError(error))
         {
@@ -550,6 +589,7 @@ private async Task<ModelRewriteResult> TryRewriteRolloutModelFieldAsync(
             sourceStream.Seek(0, SeekOrigin.Begin);
             string separator = change.OriginalSeparator == "\r\n" ? "\r\n" : "\n";
             List<TurnContextModelBackup> originalModels = [];
+            List<TurnContextModelBackup> observedModels = [];
             int replacements = 0;
 
             using (StreamReader reader = new(
@@ -583,6 +623,15 @@ private async Task<ModelRewriteResult> TryRewriteRolloutModelFieldAsync(
                             OriginalModels = lineResult.OriginalModels
                         });
                     }
+                    if (lineResult.OriginalModels.Count > 0)
+                    {
+                        observedModels.Add(new TurnContextModelBackup
+                        {
+                            LineIndex = lineIndex,
+                            OriginalModel = lineResult.OriginalModels[0],
+                            OriginalModels = lineResult.OriginalModels
+                        });
+                    }
                     if (!firstLine)
                     {
                         await writer.WriteAsync(separator);
@@ -597,15 +646,20 @@ private async Task<ModelRewriteResult> TryRewriteRolloutModelFieldAsync(
                 }
             }
 
+            if (!ModelSnapshotsMatch(change.OriginalTurnContextModels, observedModels))
+            {
+                File.Delete(tempPath);
+                throw new InvalidOperationException(
+                    $"Rollout file changed after it was scanned; refusing to rewrite newly appended turn_context records: {change.Path}");
+            }
+
             if (replacements == 0)
             {
                 File.Delete(tempPath);
                 return ModelRewriteResult.Empty;
             }
 
-            await OverwriteOpenFileFromTempAsync(sourceStream, tempPath);
-
-            File.Delete(tempPath);
+            await AtomicFile.ReplaceOpenFileFromTempAsync(sourceStream, tempPath);
             return new ModelRewriteResult(replacements, originalModels);
         }
         catch (Exception error)
@@ -622,6 +676,33 @@ private async Task<ModelRewriteResult> TryRewriteRolloutModelFieldAsync(
         }
     }
 
+    private static bool ModelSnapshotsMatch(
+        IReadOnlyList<TurnContextModelBackup> expected,
+        IReadOnlyList<TurnContextModelBackup> observed)
+    {
+        if (expected.Count != observed.Count)
+        {
+            return false;
+        }
+        for (int index = 0; index < expected.Count; index += 1)
+        {
+            TurnContextModelBackup left = expected[index];
+            TurnContextModelBackup right = observed[index];
+            IReadOnlyList<string> leftModels = left.OriginalModels.Count > 0
+                ? left.OriginalModels
+                : [left.OriginalModel];
+            IReadOnlyList<string> rightModels = right.OriginalModels.Count > 0
+                ? right.OriginalModels
+                : [right.OriginalModel];
+            if (left.LineIndex != right.LineIndex
+                || !leftModels.SequenceEqual(rightModels, StringComparer.Ordinal))
+            {
+                return false;
+            }
+        }
+        return true;
+    }
+
     private static ModelLineRewrite RewriteTurnContextModelInLine(string line, string newModel)
     {
         if (!TurnContextTypeRegex.IsMatch(line))
@@ -732,8 +813,7 @@ private static async Task RestoreTurnContextModelsAsync(
                 return;
             }
 
-            await OverwriteOpenFileFromTempAsync(sourceStream, tempPath);
-            File.Delete(tempPath);
+            await AtomicFile.ReplaceOpenFileFromTempAsync(sourceStream, tempPath);
         }
         catch (Exception error)
         {
@@ -786,69 +866,6 @@ private static async Task<bool> EndsWithNewlineAsync(FileStream stream)
         return bytesRead == 1 && tail[0] == (byte)'\n';
     }
 
-    private static async Task OverwriteOpenFileFromTempAsync(
-        FileStream destination,
-        string tempPath)
-    {
-        string rollbackPath = $"{tempPath}.rollback";
-        try
-        {
-            destination.Seek(0, SeekOrigin.Begin);
-            await using (FileStream rollbackWriter = new(
-                rollbackPath,
-                FileMode.CreateNew,
-                FileAccess.Write,
-                FileShare.None,
-                64 * 1024,
-                FileOptions.Asynchronous | FileOptions.SequentialScan))
-            {
-                await destination.CopyToAsync(rollbackWriter);
-                await rollbackWriter.FlushAsync();
-            }
-
-            try
-            {
-                await using FileStream tempReader = new(
-                    tempPath,
-                    FileMode.Open,
-                    FileAccess.Read,
-                    FileShare.Read,
-                    64 * 1024,
-                    FileOptions.Asynchronous | FileOptions.SequentialScan);
-                destination.SetLength(0);
-                destination.Seek(0, SeekOrigin.Begin);
-                await tempReader.CopyToAsync(destination);
-                await destination.FlushAsync();
-            }
-            catch
-            {
-                await using FileStream rollbackReader = new(
-                    rollbackPath,
-                    FileMode.Open,
-                    FileAccess.Read,
-                    FileShare.Read,
-                    64 * 1024,
-                    FileOptions.Asynchronous | FileOptions.SequentialScan);
-                destination.SetLength(0);
-                destination.Seek(0, SeekOrigin.Begin);
-                await rollbackReader.CopyToAsync(destination);
-                await destination.FlushAsync();
-                throw;
-            }
-        }
-        finally
-        {
-            try
-            {
-                File.Delete(rollbackPath);
-            }
-            catch
-            {
-                // The original exception, if any, is more useful than cleanup failure.
-            }
-        }
-    }
-
     private static async Task RewriteFirstLineAsync(
         FileStream sourceStream,
         string filePath,
@@ -884,21 +901,7 @@ private static async Task RewriteFirstLineAsync(
                 }
             }
 
-            await using (FileStream tempReader = new(
-                tempPath,
-                FileMode.Open,
-                FileAccess.Read,
-                FileShare.Read,
-                64 * 1024,
-                FileOptions.Asynchronous | FileOptions.SequentialScan))
-            {
-                sourceStream.SetLength(0);
-                sourceStream.Seek(0, SeekOrigin.Begin);
-                await tempReader.CopyToAsync(sourceStream);
-                await sourceStream.FlushAsync();
-            }
-
-            File.Delete(tempPath);
+            await AtomicFile.ReplaceOpenFileFromTempAsync(sourceStream, tempPath);
         }
         catch
         {
diff --git a/desktop/CodexProviderSync.Core/SqliteStateService.cs b/desktop/CodexProviderSync.Core/SqliteStateService.cs
index a653c27..b83f694 100644
--- a/desktop/CodexProviderSync.Core/SqliteStateService.cs
+++ b/desktop/CodexProviderSync.Core/SqliteStateService.cs
@@ -1,7 +1,30 @@
+using System.Buffers.Binary;
 using Microsoft.Data.Sqlite;
 
 namespace CodexProviderSync.Core;
 
+public sealed record SqliteFileMetadata(
+    string JournalMode,
+    long PageSize,
+    long UserVersion,
+    long ApplicationId);
+
+public sealed record SqliteOnlineBackupPreservation(
+    bool JournalMode,
+    bool PageSize,
+    bool UserVersion,
+    bool ApplicationId);
+
+public sealed record SqliteOnlineBackupMetadata(
+    SqliteFileMetadata Source,
+    SqliteFileMetadata Backup,
+    SqliteOnlineBackupPreservation Preserved);
+
+public sealed record SqliteOnlineBackupResult(
+    bool DatabasePresent,
+    string? BackupPath,
+    SqliteOnlineBackupMetadata? Metadata);
+
 public sealed class SqliteStateService
 {
     private const int DefaultBusyTimeoutMs = 5000;
@@ -267,6 +290,7 @@ public async Task<bool> AssertSqliteWritableAsync(CodexStorageLayout storage, in
         {
             await connection.OpenAsync();
             await SetBusyTimeoutAsync(connection, busyTimeoutMs);
+            await ConfigureSqliteWriteDurabilityAsync(connection);
             await ExecuteNonQueryAsync(connection, "BEGIN IMMEDIATE");
             await ExecuteNonQueryAsync(connection, "ROLLBACK");
             return true;
@@ -286,7 +310,9 @@ public async Task<bool> AssertSqliteWritableAsync(CodexStorageLayout storage, in
         Func<(int UpdatedRows, int ProviderRowsUpdated, int ModelRowsUpdated, int UserEventRowsUpdated, int CwdRowsUpdated, bool DatabasePresent), Task>? afterUpdate = null,
         int? busyTimeoutMs = null,
         IReadOnlyCollection<string>? userEventThreadIds = null,
-        IReadOnlyDictionary<string, string>? threadCwdsById = null)
+        IReadOnlyDictionary<string, string>? threadCwdsById = null,
+        Action<(int UpdatedRows, int ProviderRowsUpdated, int ModelRowsUpdated, int UserEventRowsUpdated, int CwdRowsUpdated, bool DatabasePresent)>? onCommitAttempt = null,
+        Func<Task>? afterCommitBeforeAcknowledgement = null)
     {
         return await UpdateSqliteProviderAsync(
             new CodexStorageLayoutService().CreateDefault(codexHome),
@@ -295,7 +321,9 @@ public async Task<bool> AssertSqliteWritableAsync(CodexStorageLayout storage, in
             afterUpdate,
             busyTimeoutMs,
             userEventThreadIds,
-            threadCwdsById);
+            threadCwdsById,
+            onCommitAttempt,
+            afterCommitBeforeAcknowledgement);
     }
 
     public async Task<(int UpdatedRows, int ProviderRowsUpdated, int ModelRowsUpdated, int UserEventRowsUpdated, int CwdRowsUpdated, bool DatabasePresent)> UpdateSqliteProviderAsync(
@@ -305,7 +333,9 @@ public async Task<bool> AssertSqliteWritableAsync(CodexStorageLayout storage, in
         Func<(int UpdatedRows, int ProviderRowsUpdated, int ModelRowsUpdated, int UserEventRowsUpdated, int CwdRowsUpdated, bool DatabasePresent), Task>? afterUpdate = null,
         int? busyTimeoutMs = null,
         IReadOnlyCollection<string>? userEventThreadIds = null,
-        IReadOnlyDictionary<string, string>? threadCwdsById = null)
+        IReadOnlyDictionary<string, string>? threadCwdsById = null,
+        Action<(int UpdatedRows, int ProviderRowsUpdated, int ModelRowsUpdated, int UserEventRowsUpdated, int CwdRowsUpdated, bool DatabasePresent)>? onCommitAttempt = null,
+        Func<Task>? afterCommitBeforeAcknowledgement = null)
     {
         string? dbPath = ExistingStateDbPath(storage);
         if (dbPath is null)
@@ -324,6 +354,7 @@ public async Task<bool> AssertSqliteWritableAsync(CodexStorageLayout storage, in
         {
             await connection.OpenAsync();
             await SetBusyTimeoutAsync(connection, busyTimeoutMs);
+            await ConfigureSqliteWriteDurabilityAsync(connection);
             await ExecuteNonQueryAsync(connection, "BEGIN IMMEDIATE");
             transactionOpen = true;
 
@@ -403,9 +434,22 @@ UPDATE threads
                 await afterUpdate((updatedRows, providerRowsUpdated, modelRowsUpdated, userEventRowsUpdated, cwdRowsUpdated, true));
             }
 
+            (int UpdatedRows, int ProviderRowsUpdated, int ModelRowsUpdated, int UserEventRowsUpdated, int CwdRowsUpdated, bool DatabasePresent) result =
+                (updatedRows, providerRowsUpdated, modelRowsUpdated, userEventRowsUpdated, cwdRowsUpdated, true);
+
+            // Once COMMIT is attempted, an exception no longer proves that
+            // SQLite stayed unchanged: the database may be durable even when
+            // the caller never receives confirmation. Tell the coordinator
+            // immediately before the attempt so it can conservatively restore
+            // the bound backup on any acknowledgement failure.
+            onCommitAttempt?.Invoke(result);
             await ExecuteNonQueryAsync(connection, "COMMIT");
             transactionOpen = false;
-            return (updatedRows, providerRowsUpdated, modelRowsUpdated, userEventRowsUpdated, cwdRowsUpdated, true);
+            if (afterCommitBeforeAcknowledgement is not null)
+            {
+                await afterCommitBeforeAcknowledgement();
+            }
+            return result;
         }
         catch (Exception error)
         {
@@ -427,6 +471,252 @@ UPDATE threads
         }
     }
 
+    /// <summary>
+    /// Creates one consistent SQLite main database via SQLite's online-backup
+    /// API. WAL/SHM sidecars are neither copied nor emitted.
+    /// </summary>
+    public async Task<SqliteOnlineBackupResult> CreateSqliteOnlineBackupAsync(
+        CodexStorageLayout storage,
+        string destinationPath,
+        int? busyTimeoutMs = null)
+    {
+        string? dbPath = ExistingStateDbPath(storage);
+        if (dbPath is null)
+        {
+            return new SqliteOnlineBackupResult(false, null, null);
+        }
+
+        string fullSourcePath = Path.GetFullPath(dbPath);
+        string fullDestinationPath = Path.GetFullPath(destinationPath);
+        StringComparison pathComparison = OperatingSystem.IsWindows()
+            ? StringComparison.OrdinalIgnoreCase
+            : StringComparison.Ordinal;
+        if (string.Equals(fullSourcePath, fullDestinationPath, pathComparison))
+        {
+            throw new InvalidOperationException(
+                "SQLite online backup destination must differ from the source database.");
+        }
+        if (File.Exists(fullDestinationPath))
+        {
+            throw new IOException("SQLite online backup destination already exists.");
+        }
+        string? destinationDirectory = Path.GetDirectoryName(fullDestinationPath);
+        if (string.IsNullOrEmpty(destinationDirectory))
+        {
+            throw new InvalidOperationException("Cannot resolve SQLite online backup directory.");
+        }
+        Directory.CreateDirectory(destinationDirectory);
+
+        try
+        {
+            SqliteFileMetadata sourceMetadata;
+            await using (SqliteConnection source = OpenConnection(
+                fullSourcePath,
+                SqliteOpenMode.ReadOnly))
+            {
+                await source.OpenAsync();
+                await SetBusyTimeoutAsync(source, busyTimeoutMs);
+                sourceMetadata = await ReadSqliteConnectionMetadataAsync(source);
+                await using SqliteConnection destination = OpenConnection(
+                    fullDestinationPath,
+                    SqliteOpenMode.ReadWriteCreate);
+                await destination.OpenAsync();
+                source.BackupDatabase(destination);
+            }
+
+            await using (FileStream stream = new(
+                fullDestinationPath,
+                FileMode.Open,
+                FileAccess.ReadWrite,
+                FileShare.Read,
+                4096,
+                FileOptions.WriteThrough))
+            {
+                await stream.FlushAsync();
+                stream.Flush(flushToDisk: true);
+            }
+
+            if (File.Exists(fullDestinationPath + "-wal")
+                || File.Exists(fullDestinationPath + "-shm"))
+            {
+                throw new InvalidOperationException(
+                    "SQLite online backup unexpectedly emitted a WAL/SHM sidecar.");
+            }
+
+            SqliteFileMetadata backupMetadata = await ReadStandaloneSqliteHeaderMetadataAsync(
+                fullDestinationPath);
+            SqliteOnlineBackupPreservation preserved = new(
+                sourceMetadata.JournalMode == backupMetadata.JournalMode,
+                sourceMetadata.PageSize == backupMetadata.PageSize,
+                sourceMetadata.UserVersion == backupMetadata.UserVersion,
+                sourceMetadata.ApplicationId == backupMetadata.ApplicationId);
+            return new SqliteOnlineBackupResult(
+                true,
+                fullDestinationPath,
+                new SqliteOnlineBackupMetadata(sourceMetadata, backupMetadata, preserved));
+        }
+        catch (Exception error)
+        {
+            TryDeleteSqliteBackupArtifact(fullDestinationPath);
+            TryDeleteSqliteBackupArtifact(fullDestinationPath + "-wal");
+            TryDeleteSqliteBackupArtifact(fullDestinationPath + "-shm");
+            throw WrapSqliteMalformedError(
+                WrapSqliteBusyError(error, "create a consistent SQLite online backup"),
+                "create a consistent SQLite online backup");
+        }
+    }
+
+    public async Task<SqliteOnlineBackupResult> CreateSqliteOnlineBackupAsync(
+        string codexHome,
+        string destinationPath,
+        int? busyTimeoutMs = null)
+    {
+        return await CreateSqliteOnlineBackupAsync(
+            new CodexStorageLayoutService().CreateDefault(codexHome),
+            destinationPath,
+            busyTimeoutMs);
+    }
+
+    /// <summary>
+    /// Restores a SQLite snapshot into the live database via SQLite's online
+    /// backup API. SQLite owns the destination write transaction, so an
+    /// unfinished restore rolls back without unlinking live WAL/SHM files.
+    /// </summary>
+    public async Task RestoreSqliteOnlineBackupAsync(
+        string sourcePath,
+        string destinationPath,
+        int? busyTimeoutMs = null)
+    {
+        string fullSourcePath = Path.GetFullPath(sourcePath);
+        string fullDestinationPath = Path.GetFullPath(destinationPath);
+        StringComparison pathComparison = OperatingSystem.IsWindows()
+            ? StringComparison.OrdinalIgnoreCase
+            : StringComparison.Ordinal;
+        if (string.Equals(fullSourcePath, fullDestinationPath, pathComparison))
+        {
+            throw new InvalidOperationException(
+                "SQLite online restore source must differ from the destination database.");
+        }
+        if (!File.Exists(fullSourcePath))
+        {
+            throw new FileNotFoundException(
+                "SQLite restore source does not exist.",
+                fullSourcePath);
+        }
+
+        string? destinationDirectory = Path.GetDirectoryName(fullDestinationPath);
+        if (string.IsNullOrEmpty(destinationDirectory))
+        {
+            throw new InvalidOperationException("Cannot resolve SQLite online restore directory.");
+        }
+
+        try
+        {
+            // Open and inspect the source before allowing SQLite to touch the
+            // live destination. ReadOnly closes the disappearance race without
+            // ever creating an empty source database.
+            await using SqliteConnection source = OpenConnection(
+                fullSourcePath,
+                SqliteOpenMode.ReadOnly);
+            await source.OpenAsync();
+            await SetBusyTimeoutAsync(source, busyTimeoutMs);
+            _ = await ReadSqliteConnectionMetadataAsync(source);
+
+            Directory.CreateDirectory(destinationDirectory);
+            await using SqliteConnection destination = OpenConnection(
+                fullDestinationPath,
+                SqliteOpenMode.ReadWriteCreate);
+            await destination.OpenAsync();
+            await SetBusyTimeoutAsync(destination, busyTimeoutMs);
+            await ConfigureSqliteWriteDurabilityAsync(destination);
+            source.BackupDatabase(destination);
+        }
+        catch (Exception error)
+        {
+            // Never delete or replace destination artifacts here. SQLite owns
+            // the destination transaction and rolls it back on failure.
+            throw WrapSqliteMalformedError(
+                WrapSqliteBusyError(error, "restore a consistent SQLite online backup"),
+                "restore a consistent SQLite online backup");
+        }
+    }
+
+    internal static async Task<int> ConfigureSqliteWriteDurabilityAsync(
+        SqliteConnection connection)
+    {
+        await ExecuteNonQueryAsync(connection, "PRAGMA synchronous = FULL");
+        object? rawValue = await ExecuteScalarAsync(connection, "PRAGMA synchronous");
+        int synchronous = Convert.ToInt32(rawValue);
+        if (synchronous != 2)
+        {
+            throw new InvalidOperationException(
+                $"Unable to configure SQLite synchronous=FULL (reported {synchronous}).");
+        }
+        return synchronous;
+    }
+
+    private static async Task<SqliteFileMetadata> ReadSqliteConnectionMetadataAsync(
+        SqliteConnection connection)
+    {
+        string journalMode = Convert.ToString(
+            await ExecuteScalarAsync(connection, "PRAGMA journal_mode"))?.ToLowerInvariant() ?? "";
+        long pageSize = Convert.ToInt64(await ExecuteScalarAsync(connection, "PRAGMA page_size"));
+        long userVersion = Convert.ToInt64(await ExecuteScalarAsync(connection, "PRAGMA user_version"));
+        long applicationId = Convert.ToInt64(await ExecuteScalarAsync(connection, "PRAGMA application_id"));
+        return new SqliteFileMetadata(journalMode, pageSize, userVersion, applicationId);
+    }
+
+    private static async Task<SqliteFileMetadata> ReadStandaloneSqliteHeaderMetadataAsync(
+        string dbPath)
+    {
+        byte[] header = new byte[100];
+        await using FileStream stream = new(
+            dbPath,
+            FileMode.Open,
+            FileAccess.Read,
+            FileShare.Read,
+            4096,
+            FileOptions.Asynchronous | FileOptions.SequentialScan);
+        await stream.ReadExactlyAsync(header);
+        ReadOnlySpan<byte> magic = "SQLite format 3\0"u8;
+        if (!header.AsSpan(0, magic.Length).SequenceEqual(magic))
+        {
+            throw new InvalidOperationException(
+                "SQLite online backup did not produce a valid standalone database header.");
+        }
+        int rawPageSize = BinaryPrimitives.ReadUInt16BigEndian(header.AsSpan(16, 2));
+        string journalMode = header[18] == 2 && header[19] == 2 ? "wal" : "delete";
+        return new SqliteFileMetadata(
+            journalMode,
+            rawPageSize == 1 ? 65536 : rawPageSize,
+            BinaryPrimitives.ReadInt32BigEndian(header.AsSpan(60, 4)),
+            BinaryPrimitives.ReadInt32BigEndian(header.AsSpan(68, 4)));
+    }
+
+    private static async Task<object?> ExecuteScalarAsync(
+        SqliteConnection connection,
+        string commandText)
+    {
+        await using SqliteCommand command = connection.CreateCommand();
+        command.CommandText = commandText;
+        return await command.ExecuteScalarAsync();
+    }
+
+    private static void TryDeleteSqliteBackupArtifact(string filePath)
+    {
+        try
+        {
+            if (File.Exists(filePath))
+            {
+                File.Delete(filePath);
+            }
+        }
+        catch
+        {
+            // Cleanup must not hide the original backup failure.
+        }
+    }
+
     private static SqliteConnection OpenConnection(string dbPath, SqliteOpenMode mode)
     {
         SqliteConnectionStringBuilder builder = new()
diff --git a/desktop/CodexProviderSync.Core/TextFormatter.cs b/desktop/CodexProviderSync.Core/TextFormatter.cs
index 71c9596..291d9d9 100644
--- a/desktop/CodexProviderSync.Core/TextFormatter.cs
+++ b/desktop/CodexProviderSync.Core/TextFormatter.cs
@@ -134,6 +134,16 @@ private static string FormatStatusEnglish(StatusSnapshot status)
         }
         lines.InsertRange(12, rolloutNotes);
 
+        if (status.PendingTransactions.Count > 0)
+        {
+            lines.Insert(6, "  Run restore with the listed backup before the next write operation.");
+            foreach (TransactionRecoveryInfo transaction in status.PendingTransactions.Reverse())
+            {
+                lines.Insert(6, $"  {transaction.State}: {transaction.BackupDirectory}");
+            }
+            lines.Insert(6, "Recovery required:");
+        }
+
         AppendSqliteStatus(lines, status, chinese: false);
         AppendProjectVisibility(lines, status, chinese: false);
         return string.Join(Environment.NewLine, lines);
@@ -176,6 +186,16 @@ private static string FormatStatusChinese(StatusSnapshot status)
         }
         lines.InsertRange(12, rolloutNotes);
 
+        if (status.PendingTransactions.Count > 0)
+        {
+            lines.Insert(6, "  下一次写操作前，请使用列出的备份执行恢复。");
+            foreach (TransactionRecoveryInfo transaction in status.PendingTransactions.Reverse())
+            {
+                lines.Insert(6, $"  {transaction.State}: {transaction.BackupDirectory}");
+            }
+            lines.Insert(6, "需要恢复:");
+        }
+
         AppendSqliteStatus(lines, status, chinese: true);
         AppendProjectVisibility(lines, status, chinese: true);
         return string.Join(Environment.NewLine, lines);
diff --git a/desktop/CodexProviderSync.Core/TransactionJournalService.cs b/desktop/CodexProviderSync.Core/TransactionJournalService.cs
new file mode 100644
index 0000000..6f2a94c
--- /dev/null
+++ b/desktop/CodexProviderSync.Core/TransactionJournalService.cs
@@ -0,0 +1,698 @@
+using System.Text;
+using System.Text.Json;
+
+namespace CodexProviderSync.Core;
+
+internal sealed class FileTransactionJournal
+{
+    internal const string FileName = "transaction-journal.jsonl";
+    private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web);
+
+    private readonly string _filePath;
+    private readonly string _operationId;
+    private readonly SemaphoreSlim _appendGate = new(1, 1);
+    private int _sequence;
+
+    private FileTransactionJournal(string filePath, string operationId, int sequence = 0)
+    {
+        _filePath = filePath;
+        _operationId = operationId;
+        _sequence = sequence;
+    }
+
+    internal string FilePath => _filePath;
+
+    internal Func<string, string, Task>? AppendFaultInjector { get; set; }
+
+    internal Task<PendingTransactionInfo> ReadCurrentInfoAsync() => ReadInfoAsync(_filePath);
+
+    internal static async Task<FileTransactionJournal> CreateAsync(
+        string backupDir,
+        string codexHome,
+        string targetProvider,
+        IEnumerable<string> potentialTargets)
+    {
+        string operationId = Guid.NewGuid().ToString("D");
+        FileTransactionJournal journal = new(
+            Path.Combine(backupDir, FileName),
+            operationId);
+        await journal.AppendAsync("prepared", new Dictionary<string, object?>
+        {
+            ["protocolVersion"] = 1,
+            ["backupDir"] = Path.GetFullPath(backupDir),
+            ["codexHome"] = Path.GetFullPath(codexHome),
+            ["targetProvider"] = targetProvider,
+            ["potentialTargets"] = potentialTargets
+                .Select(Path.GetFullPath)
+                .Distinct(PathComparer)
+                .Order(PathComparer)
+                .ToArray()
+        });
+        return journal;
+    }
+
+    internal Task ApplyingAsync(string kind, string targetPath) => AppendAsync(
+        "applying",
+        new Dictionary<string, object?>
+        {
+            ["kind"] = kind,
+            ["targetPath"] = Path.GetFullPath(targetPath)
+        });
+
+    internal Task AppliedAsync(string kind, string targetPath) => AppendAsync(
+        "applied",
+        new Dictionary<string, object?>
+        {
+            ["kind"] = kind,
+            ["targetPath"] = Path.GetFullPath(targetPath)
+        });
+
+    internal Task SkippedAsync(string kind, string targetPath) => AppendAsync(
+        "skipped",
+        new Dictionary<string, object?>
+        {
+            ["kind"] = kind,
+            ["targetPath"] = Path.GetFullPath(targetPath)
+        });
+
+    internal Task CommittedAsync() => AppendTerminalAsync("committed");
+
+    internal Task RollingBackAsync(Exception originalError) => AppendAsync(
+        "rollingBack",
+        new Dictionary<string, object?> { ["originalError"] = originalError.Message });
+
+    internal Task RolledBackAsync() => AppendTerminalAsync("rolledBack");
+
+    internal Task RecoveryRequiredAsync(Exception originalError, IReadOnlyList<string> rollbackErrors) => AppendAsync(
+        "recoveryRequired",
+        new Dictionary<string, object?>
+        {
+            ["originalError"] = originalError.Message,
+            ["rollbackErrors"] = rollbackErrors
+        });
+
+    private async Task AppendAsync(string state, IReadOnlyDictionary<string, object?>? details = null)
+    {
+        await _appendGate.WaitAsync();
+        try
+        {
+            PendingTransactionInfo? before = null;
+            if (File.Exists(_filePath) && new FileInfo(_filePath).Length > 0)
+            {
+                before = await ReadInfoAsync(_filePath);
+                if (before.InvalidTail)
+                {
+                    throw new InvalidOperationException(
+                        state == "committed"
+                            ? $"Transaction journal is invalid and cannot commit until recovery: {_filePath}"
+                            : $"Transaction journal is invalid and requires recovery before append: {_filePath}");
+                }
+                if (!string.Equals(before.OperationId, _operationId, StringComparison.Ordinal))
+                {
+                    throw new InvalidOperationException(
+                        $"Transaction journal operationId changed before append: {_filePath}");
+                }
+                _sequence = before.LastSequence;
+            }
+            else if (_sequence != 0)
+            {
+                throw new InvalidOperationException(
+                    $"Transaction journal disappeared after it was created: {_filePath}");
+            }
+
+            ValidateAppendTransition(before, state, details);
+            int nextSequence = _sequence + 1;
+            Dictionary<string, object?> value = new()
+            {
+                ["protocolVersion"] = 1,
+                ["operationId"] = _operationId,
+                ["sequence"] = nextSequence,
+                ["state"] = state,
+                ["recordedAt"] = DateTimeOffset.UtcNow
+            };
+            if (details is not null)
+            {
+                foreach ((string key, object? detail) in details)
+                {
+                    value[key] = detail;
+                }
+            }
+
+            // The journal is a cross-runtime recovery protocol. Always use LF
+            // so Node and .NET produce byte-compatible JSONL on every platform.
+            byte[] bytes = Encoding.UTF8.GetBytes(JsonSerializer.Serialize(value, JsonOptions) + "\n");
+            try
+            {
+                if (AppendFaultInjector is not null)
+                {
+                    await AppendFaultInjector("before-write", state);
+                }
+                await using (FileStream stream = new(
+                    _filePath,
+                    FileMode.Append,
+                    FileAccess.Write,
+                    FileShare.Read,
+                    4096,
+                    FileOptions.Asynchronous | FileOptions.WriteThrough))
+                {
+                    await stream.WriteAsync(bytes);
+                    if (AppendFaultInjector is not null)
+                    {
+                        await AppendFaultInjector("after-write-before-flush", state);
+                    }
+                    await stream.FlushAsync();
+                    stream.Flush(flushToDisk: true);
+                }
+                if (AppendFaultInjector is not null)
+                {
+                    await AppendFaultInjector("after-flush-before-verify", state);
+                }
+            }
+            catch
+            {
+                await ReconcileSequenceAfterAppendAttemptAsync();
+                throw;
+            }
+
+            PendingTransactionInfo after = await ReadInfoAsync(_filePath);
+            _sequence = after.LastSequence;
+            if (after.InvalidTail
+                || !string.Equals(after.OperationId, _operationId, StringComparison.Ordinal)
+                || after.LastSequence != nextSequence
+                || !string.Equals(after.State, state, StringComparison.Ordinal)
+                || (state is "committed" or "rolledBack") != after.Terminal)
+            {
+                throw new InvalidOperationException(
+                    $"Transaction journal append could not be verified after writing {state}: {_filePath}");
+            }
+        }
+        finally
+        {
+            _appendGate.Release();
+        }
+    }
+
+    private async Task AppendTerminalAsync(string state)
+    {
+        try
+        {
+            await AppendAsync(state);
+        }
+        catch
+        {
+            // A flush API may report failure after the complete terminal record
+            // reached the durable/readable journal. Treat that exact terminal
+            // event as authoritative so the coordinator never compensates a
+            // transaction after it was already recorded committed.
+            PendingTransactionInfo current = await ReadInfoAsync(_filePath);
+            if (!current.InvalidTail
+                && current.Terminal
+                && string.Equals(current.OperationId, _operationId, StringComparison.Ordinal)
+                && string.Equals(current.State, state, StringComparison.Ordinal))
+            {
+                _sequence = current.LastSequence;
+                return;
+            }
+            throw;
+        }
+    }
+
+    private async Task ReconcileSequenceAfterAppendAttemptAsync()
+    {
+        if (!File.Exists(_filePath))
+        {
+            _sequence = 0;
+            return;
+        }
+        try
+        {
+            PendingTransactionInfo current = await ReadInfoAsync(_filePath);
+            if (string.Equals(current.OperationId, _operationId, StringComparison.Ordinal))
+            {
+                _sequence = current.LastSequence;
+            }
+        }
+        catch
+        {
+            // Preserve the original append failure. The next append performs a
+            // full journal validation and will fail closed if recovery is needed.
+        }
+    }
+
+    private static void ValidateAppendTransition(
+        PendingTransactionInfo? current,
+        string nextState,
+        IReadOnlyDictionary<string, object?>? details)
+    {
+        if (current is null)
+        {
+            if (!string.Equals(nextState, "prepared", StringComparison.Ordinal))
+            {
+                throw new InvalidOperationException("A transaction journal must begin with prepared.");
+            }
+            return;
+        }
+
+        if (current.Terminal || current.State is "committed" or "rolledBack")
+        {
+            throw new InvalidOperationException(
+                $"Transaction journal is already terminal ({current.State}) and cannot append {nextState}: {current.JournalPath}");
+        }
+        if (string.Equals(nextState, "prepared", StringComparison.Ordinal))
+        {
+            throw new InvalidOperationException("A transaction journal cannot contain a second prepared record.");
+        }
+        if (current.State == "rollingBack" && nextState is not ("rolledBack" or "recoveryRequired"))
+        {
+            throw new InvalidOperationException(
+                $"Transaction journal cannot append {nextState} after rollingBack.");
+        }
+        if (current.State == "recoveryRequired" && nextState != "rolledBack")
+        {
+            throw new InvalidOperationException(
+                $"Transaction journal cannot append {nextState} after recoveryRequired.");
+        }
+        if (nextState == "rolledBack" && current.State is not ("rollingBack" or "recoveryRequired"))
+        {
+            throw new InvalidOperationException(
+                $"Transaction journal cannot append rolledBack after {current.State}.");
+        }
+        if (nextState == "committed")
+        {
+            if (current.State is "rollingBack" or "recoveryRequired"
+                || current.AffectedTargets.Any(static target => target.State == "applying"))
+            {
+                throw new InvalidOperationException(
+                    $"Transaction journal cannot commit while rollback or target application is unresolved: {current.JournalPath}");
+            }
+            return;
+        }
+        if (nextState is "rollingBack" or "recoveryRequired" or "rolledBack")
+        {
+            return;
+        }
+        if (nextState is not ("applying" or "applied" or "skipped"))
+        {
+            throw new InvalidOperationException($"Unknown transaction journal state: {nextState}");
+        }
+        if (current.State is "rollingBack" or "recoveryRequired")
+        {
+            throw new InvalidOperationException(
+                $"Transaction journal cannot mutate targets after {current.State}.");
+        }
+
+        string kind = ReadRequiredDetail(details, "kind");
+        string targetPathValue = ReadRequiredDetail(details, "targetPath");
+        if (kind is not ("config" or "rollout" or "globalState" or "sqlite")
+            || !Path.IsPathFullyQualified(targetPathValue))
+        {
+            throw new InvalidOperationException("Transaction target details are invalid.");
+        }
+        string targetPath = Path.GetFullPath(targetPathValue);
+        if (!current.PotentialTargets.Contains(targetPath, PathComparer))
+        {
+            throw new InvalidOperationException(
+                $"Transaction target was not declared by prepared: {targetPath}");
+        }
+        string keyKind = kind;
+        TransactionTargetInfo? affected = current.AffectedTargets.FirstOrDefault(target =>
+            string.Equals(target.Kind, keyKind, StringComparison.Ordinal)
+            && PathComparer.Equals(target.TargetPath, targetPath));
+        if (nextState == "applying" && affected is not null)
+        {
+            throw new InvalidOperationException(
+                $"Transaction target is already being tracked: {targetPath}");
+        }
+        if (nextState is "applied" or "skipped"
+            && affected?.State != "applying")
+        {
+            throw new InvalidOperationException(
+                $"Transaction target must be applying before {nextState}: {targetPath}");
+        }
+    }
+
+    private static string ReadRequiredDetail(
+        IReadOnlyDictionary<string, object?>? details,
+        string name)
+    {
+        return details is not null
+            && details.TryGetValue(name, out object? value)
+            && value is string text
+            && !string.IsNullOrWhiteSpace(text)
+                ? text
+                : throw new InvalidOperationException($"Transaction journal detail {name} is required.");
+    }
+
+    internal static async Task<IReadOnlyList<PendingTransactionInfo>> FindPendingAsync(string codexHome)
+    {
+        string root = new CodexHomeService().BackupRoot(codexHome);
+        if (!Directory.Exists(root))
+        {
+            return [];
+        }
+
+        List<PendingTransactionInfo> pending = [];
+        foreach (string directory in Directory.EnumerateDirectories(root).Order(StringComparer.Ordinal))
+        {
+            string journalPath = Path.Combine(directory, FileName);
+            if (!File.Exists(journalPath))
+            {
+                continue;
+            }
+
+            PendingTransactionInfo info = await ReadInfoAsync(journalPath);
+            if (!info.Terminal)
+            {
+                pending.Add(info);
+            }
+        }
+        return pending;
+    }
+
+    internal static async Task AssertNoPendingAsync(string codexHome)
+    {
+        IReadOnlyList<PendingTransactionInfo> pending = await FindPendingAsync(codexHome);
+        if (pending.Count == 0)
+        {
+            return;
+        }
+
+        string backups = string.Join(", ", pending.Select(static item => item.BackupDir));
+        throw new RecoveryRequiredException(
+            $"An unfinished provider-sync transaction requires recovery before another write. Restore the bound backup, then retry. Backup(s): {backups}",
+            pending);
+    }
+
+    internal static async Task MarkBackupRolledBackAsync(
+        string backupDir,
+        string codexHome,
+        string targetProvider)
+    {
+        string journalPath = Path.Combine(Path.GetFullPath(backupDir), FileName);
+        if (!File.Exists(journalPath))
+        {
+            return;
+        }
+
+        JournalReadResult readResult = await ReadJournalAsync(journalPath);
+        PendingTransactionInfo info = readResult.Info;
+        if (info.Terminal)
+        {
+            return;
+        }
+
+        if (info.InvalidTail)
+        {
+            string invalidArchivePath = Path.Combine(
+                Path.GetDirectoryName(journalPath)!,
+                $"transaction-journal.invalid.{DateTimeOffset.UtcNow:yyyyMMdd'T'HHmmssfff'Z'}.{Guid.NewGuid():N}.jsonl");
+            await AtomicFile.CopyAsync(journalPath, invalidArchivePath, overwrite: false);
+
+            if (string.IsNullOrWhiteSpace(info.OperationId) || readResult.ValidLines.Count == 0)
+            {
+                await AtomicFile.WriteAllTextAsync(journalPath, string.Empty);
+                FileTransactionJournal replacement = await CreateAsync(
+                    Path.GetDirectoryName(journalPath)!,
+                    codexHome,
+                    targetProvider,
+                    []);
+                await replacement.RollingBackAsync(
+                    new InvalidOperationException("Explicit managed-backup restore repaired an unreadable journal"));
+                await replacement.RolledBackAsync();
+                await AssertRolledBackTerminalAsync(replacement);
+                return;
+            }
+
+            List<string> validPrefix = [.. readResult.ValidLines];
+            if (info.LastValidState is "committed" or "rolledBack")
+            {
+                validPrefix.RemoveAt(validPrefix.Count - 1);
+            }
+            string normalizedPrefix = string.Join("\n", validPrefix) + "\n";
+            await AtomicFile.WriteAllTextAsync(journalPath, normalizedPrefix);
+            info = await ReadInfoAsync(journalPath);
+        }
+
+        FileTransactionJournal journal = new(
+            journalPath,
+            info.OperationId!,
+            info.LastSequence);
+        if (info.State is not ("rollingBack" or "recoveryRequired"))
+        {
+            await journal.RollingBackAsync(new InvalidOperationException("Explicit managed-backup restore"));
+        }
+        await journal.RolledBackAsync();
+        await AssertRolledBackTerminalAsync(journal);
+    }
+
+    private static async Task AssertRolledBackTerminalAsync(FileTransactionJournal journal)
+    {
+        PendingTransactionInfo verified = await journal.ReadCurrentInfoAsync();
+        if (verified.InvalidTail
+            || !verified.Terminal
+            || !string.Equals(verified.State, "rolledBack", StringComparison.Ordinal))
+        {
+            throw new InvalidOperationException(
+                $"Transaction journal repair did not reach a verified rolledBack state: {journal.FilePath}");
+        }
+    }
+
+    internal static async Task<PendingTransactionInfo> ReadInfoAsync(string journalPath)
+    {
+        return (await ReadJournalAsync(journalPath)).Info;
+    }
+
+    private static async Task<JournalReadResult> ReadJournalAsync(string journalPath)
+    {
+        byte[] journalBytes = await File.ReadAllBytesAsync(journalPath);
+        bool missingTerminalLf = journalBytes.Length > 0 && journalBytes[^1] != (byte)'\n';
+        string journalText = Encoding.UTF8.GetString(journalBytes);
+        string? operationId = null;
+        int lastSequence = 0;
+        string state = "recoveryRequired";
+        string lastValidState = "none";
+        bool invalidTail = false;
+        bool sawRecord = false;
+        bool sawTerminal = false;
+        List<string> validLines = [];
+        List<string> potentialTargets = [];
+        Dictionary<string, TransactionTargetInfo> affectedTargets = new(PathComparer);
+        foreach (string line in journalText.Split('\n'))
+        {
+            if (string.IsNullOrWhiteSpace(line))
+            {
+                continue;
+            }
+            try
+            {
+                using JsonDocument document = JsonDocument.Parse(line);
+                JsonElement root = document.RootElement;
+                string? recordOperationId = root.TryGetProperty("operationId", out JsonElement operation)
+                    ? operation.GetString()
+                    : null;
+                int recordSequence = root.TryGetProperty("sequence", out JsonElement sequence)
+                    && sequence.TryGetInt32(out int parsedSequence)
+                        ? parsedSequence
+                        : -1;
+                string? recordState = root.TryGetProperty("state", out JsonElement stateValue)
+                    ? stateValue.GetString()
+                    : null;
+                int protocolVersion = root.TryGetProperty("protocolVersion", out JsonElement protocol)
+                    && protocol.TryGetInt32(out int parsedProtocol)
+                        ? parsedProtocol
+                        : -1;
+
+                if (protocolVersion != 1
+                    || string.IsNullOrWhiteSpace(recordOperationId)
+                    || !Guid.TryParse(recordOperationId, out _)
+                    || recordSequence != lastSequence + 1
+                    || string.IsNullOrWhiteSpace(recordState)
+                    || sawTerminal
+                    || (operationId is not null
+                        && !string.Equals(operationId, recordOperationId, StringComparison.Ordinal)))
+                {
+                    invalidTail = true;
+                    state = "recoveryRequired";
+                    break;
+                }
+
+                if (sawRecord
+                    && (recordState == "prepared"
+                        || (state == "rollingBack" && recordState is not ("rolledBack" or "recoveryRequired"))
+                        || (state == "recoveryRequired" && recordState != "rolledBack")
+                        || (recordState == "rolledBack" && state is not ("rollingBack" or "recoveryRequired"))))
+                {
+                    invalidTail = true;
+                    state = "recoveryRequired";
+                    break;
+                }
+
+                if (!sawRecord)
+                {
+                    if (!string.Equals(recordState, "prepared", StringComparison.Ordinal)
+                        || recordSequence != 1)
+                    {
+                        invalidTail = true;
+                        state = "recoveryRequired";
+                        break;
+                    }
+
+                    operationId = recordOperationId;
+                    if (!root.TryGetProperty("potentialTargets", out JsonElement targets)
+                        || targets.ValueKind != JsonValueKind.Array)
+                    {
+                        throw new InvalidOperationException("Prepared journal record must declare potentialTargets.");
+                    }
+
+                    HashSet<string> declaredTargets = new(PathComparer);
+                    foreach (JsonElement target in targets.EnumerateArray())
+                    {
+                        string? targetPath = target.GetString();
+                        if (string.IsNullOrWhiteSpace(targetPath)
+                            || !Path.IsPathFullyQualified(targetPath))
+                        {
+                            throw new InvalidOperationException(
+                                "Prepared journal potentialTargets must contain absolute paths.");
+                        }
+                        string fullTargetPath = Path.GetFullPath(targetPath);
+                        if (!declaredTargets.Add(fullTargetPath))
+                        {
+                            throw new InvalidOperationException(
+                                $"Prepared journal contains a duplicate potential target: {fullTargetPath}");
+                        }
+                        potentialTargets.Add(fullTargetPath);
+                    }
+                }
+                else if (recordState is "applying" or "applied" or "skipped")
+                {
+                    string? kind = root.TryGetProperty("kind", out JsonElement kindValue)
+                        ? kindValue.GetString()
+                        : null;
+                    string? targetPath = root.TryGetProperty("targetPath", out JsonElement targetValue)
+                        ? targetValue.GetString()
+                        : null;
+                    if (kind is not ("config" or "rollout" or "globalState" or "sqlite")
+                        || string.IsNullOrWhiteSpace(targetPath)
+                        || !Path.IsPathFullyQualified(targetPath))
+                    {
+                        invalidTail = true;
+                        state = "recoveryRequired";
+                        break;
+                    }
+
+                    string fullTargetPath = Path.GetFullPath(targetPath);
+                    if (!potentialTargets.Contains(fullTargetPath, PathComparer))
+                    {
+                        invalidTail = true;
+                        state = "recoveryRequired";
+                        break;
+                    }
+
+                    string key = kind + "\0" + fullTargetPath;
+                    if (recordState is "applied" or "skipped"
+                        && (!affectedTargets.TryGetValue(key, out TransactionTargetInfo? applying)
+                            || applying.State != "applying"))
+                    {
+                        invalidTail = true;
+                        state = "recoveryRequired";
+                        break;
+                    }
+
+                    if (recordState == "skipped")
+                    {
+                        affectedTargets.Remove(key);
+                    }
+                    else
+                    {
+                        affectedTargets[key] = new TransactionTargetInfo(kind, fullTargetPath, recordState);
+                    }
+                }
+                else if (recordState is not (
+                    "prepared" or "committed" or "rollingBack" or "rolledBack" or "recoveryRequired"))
+                {
+                    invalidTail = true;
+                    state = "recoveryRequired";
+                    break;
+                }
+
+                if (recordState == "committed"
+                    && affectedTargets.Values.Any(static target => target.State == "applying"))
+                {
+                    invalidTail = true;
+                    state = "recoveryRequired";
+                    break;
+                }
+                sawRecord = true;
+                lastSequence = recordSequence;
+                state = recordState;
+                lastValidState = recordState;
+                sawTerminal = recordState is "committed" or "rolledBack";
+                validLines.Add(line);
+            }
+            catch (Exception error) when (error is JsonException or InvalidOperationException or ArgumentException or NotSupportedException)
+            {
+                invalidTail = true;
+                state = "recoveryRequired";
+                break;
+            }
+        }
+
+        if (!sawRecord)
+        {
+            invalidTail = true;
+            state = "recoveryRequired";
+        }
+        else if (missingTerminalLf)
+        {
+            invalidTail = true;
+            state = "recoveryRequired";
+        }
+
+        bool terminal = !invalidTail && state is "committed" or "rolledBack";
+        PendingTransactionInfo info = new(
+            journalPath,
+            Path.GetDirectoryName(journalPath)!,
+            operationId,
+            lastSequence,
+            state,
+            terminal,
+            invalidTail,
+            lastValidState,
+            potentialTargets.Distinct(PathComparer).Order(PathComparer).ToArray(),
+            affectedTargets.Values.ToArray());
+        return new JournalReadResult(info, validLines);
+    }
+
+    private static StringComparer PathComparer => OperatingSystem.IsWindows()
+        ? StringComparer.OrdinalIgnoreCase
+        : StringComparer.Ordinal;
+
+    private sealed record JournalReadResult(PendingTransactionInfo Info, IReadOnlyList<string> ValidLines);
+}
+
+internal sealed record TransactionTargetInfo(string Kind, string TargetPath, string State);
+
+internal sealed record PendingTransactionInfo(
+    string JournalPath,
+    string BackupDir,
+    string? OperationId,
+    int LastSequence,
+    string State,
+    bool Terminal,
+    bool InvalidTail,
+    string LastValidState,
+    IReadOnlyList<string> PotentialTargets,
+    IReadOnlyList<TransactionTargetInfo> AffectedTargets);
+
+public sealed class RecoveryRequiredException : InvalidOperationException
+{
+    internal RecoveryRequiredException(string message, IReadOnlyList<PendingTransactionInfo> pending)
+        : base(message)
+    {
+        PendingBackupDirectories = pending.Select(static item => item.BackupDir).ToArray();
+    }
+
+    public string Code => "RECOVERY_REQUIRED";
+
+    public IReadOnlyList<string> PendingBackupDirectories { get; }
+}
diff --git a/desktop/CodexProviderSync.GuiE2E.Tests/ApplicationAndDialogContractTests.cs b/desktop/CodexProviderSync.GuiE2E.Tests/ApplicationAndDialogContractTests.cs
new file mode 100644
index 0000000..c114784
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E.Tests/ApplicationAndDialogContractTests.cs
@@ -0,0 +1,160 @@
+using System.Text.Json.Nodes;
+
+namespace CodexProviderSync.GuiE2E.Tests;
+
+public sealed class ApplicationLinkVerifierTests
+{
+    [Fact]
+    public void Verify_AcceptsExactPrimaryAndNestedSuccessfulOperation()
+    {
+        VerifiedApplicationLink verified = ApplicationLinkVerifier.Verify(
+            Result("operation-1", "Sync", "Succeeded"),
+            "Sync",
+            "Succeeded");
+
+        Assert.Equal("operation-1", verified.OperationId);
+        Assert.Equal("Sync", verified.Operation);
+        Assert.Equal("Succeeded", verified.Lifecycle);
+        Assert.Empty(verified.ErrorCodes);
+    }
+
+    [Fact]
+    public void Verify_AcceptsExpectedFailedStatusOperationWithExactErrorCode()
+    {
+        VerifiedApplicationLink verified = ApplicationLinkVerifier.Verify(
+            Result("operation-failure-1", "Status", "Failed", "operation_failed"),
+            "Status",
+            "Failed",
+            ["operation_failed"]);
+
+        Assert.Equal("Failed", verified.Lifecycle);
+        Assert.Equal(["operation_failed"], verified.ErrorCodes);
+    }
+
+    [Fact]
+    public void Verify_RejectsWrongOperationLifecycleAndUnexpectedErrors()
+    {
+        Assert.Throws<InvalidDataException>(() =>
+            ApplicationLinkVerifier.Verify(Result("operation-1", "Switch", "Succeeded"), "Sync", "Succeeded"));
+        Assert.Throws<InvalidDataException>(() =>
+            ApplicationLinkVerifier.Verify(Result("operation-1", "Sync", "Rejected"), "Sync", "Succeeded"));
+        Assert.Throws<InvalidDataException>(() =>
+            ApplicationLinkVerifier.Verify(Result("operation-1", "Sync", "Succeeded", "plan_stale"), "Sync", "Succeeded"));
+    }
+
+    [Fact]
+    public void Verify_RejectsMissingMismatchedOrDuplicateNestedAssociation()
+    {
+        JsonObject mismatched = Result("operation-1", "Restore", "Succeeded");
+        mismatched["applicationOperations"]![0]!["operation"] = "Sync";
+        Assert.Throws<InvalidDataException>(() =>
+            ApplicationLinkVerifier.Verify(mismatched, "Restore", "Succeeded"));
+
+        JsonObject duplicate = Result("operation-1", "Prune", "Succeeded");
+        duplicate["applicationOperations"]!.AsArray().Add(
+            duplicate["applicationOperations"]![0]!.DeepClone());
+        Assert.Throws<InvalidDataException>(() =>
+            ApplicationLinkVerifier.Verify(duplicate, "Prune", "Succeeded"));
+
+        JsonObject missing = Result("operation-1", "Status", "Succeeded");
+        missing["applicationOperations"] = new JsonArray();
+        Assert.Throws<InvalidDataException>(() =>
+            ApplicationLinkVerifier.Verify(missing, "Status", "Succeeded"));
+    }
+
+    private static JsonObject Result(
+        string operationId,
+        string operation,
+        string lifecycle,
+        params string[] errors) => new()
+    {
+        ["applicationOperationLinked"] = true,
+        ["applicationOperationId"] = operationId,
+        ["applicationOperation"] = operation,
+        ["applicationLifecycle"] = lifecycle,
+        ["applicationOperations"] = new JsonArray
+        {
+            new JsonObject
+            {
+                ["operationId"] = operationId,
+                ["operation"] = operation,
+                ["lifecycle"] = lifecycle,
+                ["errorCodes"] = new JsonArray(
+                    errors.Select(error => (JsonNode?)JsonValue.Create(error)).ToArray())
+            }
+        }
+    };
+}
+
+public sealed class DialogContractVerifierTests
+{
+    [Fact]
+    public void Verify_AcceptsExpectedConfirmationAndNoUpdateDialogs()
+    {
+        DialogContractResult sync = DialogContractVerifier.Verify(
+            "sync-apply",
+            "#32770",
+            "Codex Provider Sync",
+            ["执行同步前，请先关闭 Codex。是否继续？", "确定", "取消"]);
+        DialogContractResult noUpdate = DialogContractVerifier.Verify(
+            "update-no-update",
+            "#32770",
+            "Codex Provider Sync",
+            ["当前已是最新版本（v0.4.0）。", "确定"]);
+
+        Assert.True(sync.Passed, sync.Error);
+        Assert.True(noUpdate.Passed, noUpdate.Error);
+    }
+
+    [Fact]
+    public void Verify_RejectsFailureMasqueradingAsNoUpdateAndMissingCancel()
+    {
+        DialogContractResult failure = DialogContractVerifier.Verify(
+            "update-no-update",
+            "#32770",
+            "Codex Provider Sync",
+            ["更新检查失败：network error", "确定"]);
+        DialogContractResult missingCancel = DialogContractVerifier.Verify(
+            "prune-apply",
+            "#32770",
+            "Codex Provider Sync",
+            ["确认清理旧备份？将只保留最近 1 份。", "确定"]);
+
+        Assert.False(failure.Passed);
+        Assert.Contains("forbidden", failure.Error, StringComparison.OrdinalIgnoreCase);
+        Assert.False(missingCancel.Passed);
+        Assert.Contains("cancel", missingCancel.Error, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void Verify_OperationFailureRequiresErrorTextAndAcknowledgementOnly()
+    {
+        DialogContractResult valid = DialogContractVerifier.Verify(
+            "operation-failure",
+            "#32770",
+            "Codex Provider Sync",
+            ["Invalid config.toml: unterminated string.", "确定"]);
+        DialogContractResult confirmation = DialogContractVerifier.Verify(
+            "operation-failure",
+            "#32770",
+            "Codex Provider Sync",
+            ["是否继续？", "确定", "取消"]);
+
+        Assert.True(valid.Passed, valid.Error);
+        Assert.False(confirmation.Passed);
+    }
+
+    [Theory]
+    [InlineData("NotADialog", "Codex Provider Sync")]
+    [InlineData("#32770", "Unexpected title")]
+    public void Verify_RejectsWrongNativeClassOrTitle(string className, string title)
+    {
+        DialogContractResult result = DialogContractVerifier.Verify(
+            "validation",
+            className,
+            title,
+            ["请输入要添加的 Provider ID。", "确定"]);
+
+        Assert.False(result.Passed);
+    }
+}
diff --git a/desktop/CodexProviderSync.GuiE2E.Tests/CodexProviderSync.GuiE2E.Tests.csproj b/desktop/CodexProviderSync.GuiE2E.Tests/CodexProviderSync.GuiE2E.Tests.csproj
new file mode 100644
index 0000000..226c118
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E.Tests/CodexProviderSync.GuiE2E.Tests.csproj
@@ -0,0 +1,26 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0-windows</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+    <IsTestProject>true</IsTestProject>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\CodexProviderSync.GuiE2E\CodexProviderSync.GuiE2E.csproj" />
+  </ItemGroup>
+
+</Project>
diff --git a/desktop/CodexProviderSync.GuiE2E.Tests/EvidenceRedactorTests.cs b/desktop/CodexProviderSync.GuiE2E.Tests/EvidenceRedactorTests.cs
new file mode 100644
index 0000000..9470603
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E.Tests/EvidenceRedactorTests.cs
@@ -0,0 +1,40 @@
+using CodexProviderSync.GuiE2E;
+
+namespace CodexProviderSync.GuiE2E.Tests;
+
+public sealed class EvidenceRedactorTests
+{
+    [Fact]
+    public void Redact_RemovesDescriptorTokenFromMachineReadableEvidence()
+    {
+        var token = string.Concat(Enumerable.Repeat("0123456789abcdef", 4));
+        var evidence = $$"""
+            {
+              "schemaVersion": 1,
+              "descriptor": { "token": "{{token}}" },
+              "diagnostic": "named-pipe authentication used {{token}}",
+              "overallPassed": false
+            }
+            """;
+
+        var redacted = EvidenceRedactor.Redact(evidence, [token]);
+
+        Assert.DoesNotContain(token, redacted, StringComparison.Ordinal);
+        Assert.Contains("schemaVersion", redacted, StringComparison.Ordinal);
+        Assert.Contains("overallPassed", redacted, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Redact_RemovesEverySecretAndIgnoresEmptySecretValues()
+    {
+        const string firstSecret = "first-private-value";
+        const string secondSecret = "second-private-value";
+        const string evidence = "first-private-value|safe-marker|second-private-value";
+
+        var redacted = EvidenceRedactor.Redact(evidence, [firstSecret, "", secondSecret]);
+
+        Assert.DoesNotContain(firstSecret, redacted, StringComparison.Ordinal);
+        Assert.DoesNotContain(secondSecret, redacted, StringComparison.Ordinal);
+        Assert.Contains("safe-marker", redacted, StringComparison.Ordinal);
+    }
+}
diff --git a/desktop/CodexProviderSync.GuiE2E.Tests/IsolatedFixtureTests.cs b/desktop/CodexProviderSync.GuiE2E.Tests/IsolatedFixtureTests.cs
new file mode 100644
index 0000000..3f2190c
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E.Tests/IsolatedFixtureTests.cs
@@ -0,0 +1,45 @@
+namespace CodexProviderSync.GuiE2E.Tests;
+
+public sealed class IsolatedFixtureTests
+{
+    [Fact]
+    public async Task Snapshot_ReleasesEveryExistingSqliteStorageFileForMove()
+    {
+        string parent = Path.Combine(
+            Path.GetTempPath(),
+            "codex-provider-sync-gui-e2e-tests",
+            Guid.NewGuid().ToString("N"));
+        string root = Path.Combine(parent, "isolation");
+        Directory.CreateDirectory(parent);
+        try
+        {
+            IsolatedFixture fixture = new(root);
+            await fixture.InitializeAsync(CancellationToken.None);
+
+            _ = await fixture.SnapshotAsync(CancellationToken.None);
+
+            string[] existing = new[]
+            {
+                fixture.DatabasePath,
+                fixture.DatabasePath + "-wal",
+                fixture.DatabasePath + "-shm"
+            }.Where(File.Exists).ToArray();
+            Assert.Contains(fixture.DatabasePath, existing, StringComparer.OrdinalIgnoreCase);
+            foreach (string source in existing)
+            {
+                string moved = source + ".move-proof";
+                File.Move(source, moved, overwrite: false);
+                Assert.False(File.Exists(source));
+                File.Move(moved, source, overwrite: false);
+                Assert.True(File.Exists(source));
+            }
+        }
+        finally
+        {
+            if (Directory.Exists(parent))
+            {
+                Directory.Delete(parent, recursive: true);
+            }
+        }
+    }
+}
diff --git a/desktop/CodexProviderSync.GuiE2E.Tests/IsolationEnvironmentTests.cs b/desktop/CodexProviderSync.GuiE2E.Tests/IsolationEnvironmentTests.cs
new file mode 100644
index 0000000..335f477
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E.Tests/IsolationEnvironmentTests.cs
@@ -0,0 +1,123 @@
+using CodexProviderSync.GuiE2E;
+
+namespace CodexProviderSync.GuiE2E.Tests;
+
+public sealed class IsolationEnvironmentTests
+{
+    private static readonly string[] IsolatedDirectoryVariables =
+    [
+        "HOME",
+        "USERPROFILE",
+        "CODEX_HOME",
+        "CODEX_SQLITE_HOME",
+        "APPDATA",
+        "LOCALAPPDATA",
+        "TEMP",
+        "TMP",
+    ];
+
+    [Fact]
+    public void Build_MapsEveryUserDataDirectoryInsideIsolationRoot()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "codex-provider-sync-tests", Guid.NewGuid().ToString("N"));
+        var realProfile = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
+        var source = new Dictionary<string, string?>(StringComparer.OrdinalIgnoreCase)
+        {
+            ["HOME"] = realProfile,
+            ["USERPROFILE"] = realProfile,
+            ["CODEX_HOME"] = Path.Combine(realProfile, ".codex"),
+            ["CODEX_SQLITE_HOME"] = Path.Combine(realProfile, ".codex", "sqlite"),
+            ["APPDATA"] = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData),
+            ["LOCALAPPDATA"] = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+            ["TEMP"] = Path.GetTempPath(),
+            ["TMP"] = Path.GetTempPath(),
+            ["PATH"] = "safe-path-value",
+        };
+
+        var result = IsolationEnvironment.Build(root, source);
+
+        Assert.Equal("safe-path-value", result["PATH"]);
+        foreach (var variable in IsolatedDirectoryVariables)
+        {
+            Assert.True(result.TryGetValue(variable, out var value), $"{variable} was not mapped.");
+            Assert.False(string.IsNullOrWhiteSpace(value));
+            AssertPathIsWithin(root, value!);
+        }
+        foreach (var shellFolder in new[] { "Desktop", "Documents", "Downloads" })
+        {
+            var path = Path.Combine(result["USERPROFILE"]!, shellFolder);
+            Assert.True(Directory.Exists(path), $"Isolated shell folder was not created: {shellFolder}");
+            AssertPathIsWithin(root, path);
+        }
+    }
+
+    [Fact]
+    public void Build_RemovesCredentialBearingVariablesWithoutMutatingSource()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "codex-provider-sync-tests", Guid.NewGuid().ToString("N"));
+        var source = new Dictionary<string, string?>(StringComparer.OrdinalIgnoreCase)
+        {
+            ["PATH"] = "safe-path-value",
+            ["OPENAI_API_KEY"] = "openai-secret",
+            ["CODEX_TOKEN"] = "codex-secret",
+            ["GITHUB_TOKEN"] = "github-secret",
+            ["GITHUB_PAT"] = "github-pat-secret",
+            ["CLAUDE_API_KEY"] = "claude-secret",
+            ["AZURE_CLIENT_SECRET"] = "azure-secret",
+            ["DATABASE_PASSWORD"] = "password-secret",
+            ["PACKAGE_CREDENTIAL"] = "credential-secret",
+            ["AUTH_TOKEN"] = "auth-secret",
+            ["NUGET_AUTH_TOKEN"] = "nuget-secret",
+            ["CODEX_INTERNAL_CONTEXT"] = "codex-context",
+            ["OPENAI_ORGANIZATION"] = "openai-organization",
+            ["CLAUDE_CONFIG_DIR"] = "claude-config",
+            ["GITHUB_ACTIONS"] = "true",
+            ["UNRELATED_USER_SETTING"] = "must-not-be-inherited",
+        };
+        var original = source.ToDictionary(pair => pair.Key, pair => pair.Value, StringComparer.OrdinalIgnoreCase);
+
+        var result = IsolationEnvironment.Build(root, source);
+
+        Assert.Equal(
+            original.OrderBy(pair => pair.Key, StringComparer.OrdinalIgnoreCase),
+            source.OrderBy(pair => pair.Key, StringComparer.OrdinalIgnoreCase));
+        Assert.Equal("safe-path-value", result["PATH"]);
+        Assert.DoesNotContain(result.Keys, key => IsCredentialVariable(key));
+        foreach (var blockedVendorVariable in source.Keys.Where(IsBlockedVendorVariable))
+        {
+            Assert.False(result.ContainsKey(blockedVendorVariable));
+        }
+        Assert.False(result.ContainsKey("UNRELATED_USER_SETTING"));
+    }
+
+    private static bool IsCredentialVariable(string name)
+    {
+        return name.Contains("TOKEN", StringComparison.OrdinalIgnoreCase)
+            || name.Contains("API_KEY", StringComparison.OrdinalIgnoreCase)
+            || name.Contains("AUTH", StringComparison.OrdinalIgnoreCase)
+            || name.Equals("PAT", StringComparison.OrdinalIgnoreCase)
+            || name.EndsWith("_PAT", StringComparison.OrdinalIgnoreCase)
+            || name.Contains("KEY", StringComparison.OrdinalIgnoreCase)
+            || name.Contains("SECRET", StringComparison.OrdinalIgnoreCase)
+            || name.Contains("PASSWORD", StringComparison.OrdinalIgnoreCase)
+            || name.Contains("CREDENTIAL", StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static bool IsBlockedVendorVariable(string name)
+    {
+        return name.StartsWith("CODEX", StringComparison.OrdinalIgnoreCase)
+            || name.StartsWith("OPENAI", StringComparison.OrdinalIgnoreCase)
+            || name.StartsWith("CLAUDE", StringComparison.OrdinalIgnoreCase)
+            || name.StartsWith("GITHUB", StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static void AssertPathIsWithin(string root, string candidate)
+    {
+        var normalizedRoot = Path.GetFullPath(root).TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar)
+            + Path.DirectorySeparatorChar;
+        var normalizedCandidate = Path.GetFullPath(candidate).TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar)
+            + Path.DirectorySeparatorChar;
+
+        Assert.StartsWith(normalizedRoot, normalizedCandidate, StringComparison.OrdinalIgnoreCase);
+    }
+}
diff --git a/desktop/CodexProviderSync.GuiE2E.Tests/ManagedBackupContractTests.cs b/desktop/CodexProviderSync.GuiE2E.Tests/ManagedBackupContractTests.cs
new file mode 100644
index 0000000..1b1b42c
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E.Tests/ManagedBackupContractTests.cs
@@ -0,0 +1,156 @@
+namespace CodexProviderSync.GuiE2E.Tests;
+
+public sealed class ManagedBackupContractTests
+{
+    [Fact]
+    public void PruneContract_RequiresEveryRemovedManagedDirectoryToBeAbsent()
+    {
+        string root = Path.Combine(
+            Path.GetTempPath(),
+            "codex-provider-sync-gui-e2e-prune-removal-tests",
+            Guid.NewGuid().ToString("N"));
+        string oldBackup = Path.Combine(root, "20260804T010000000Z");
+        string newestBackup = Path.Combine(root, "20260804T020000000Z");
+        Directory.CreateDirectory(oldBackup);
+        Directory.CreateDirectory(newestBackup);
+        try
+        {
+            Directory.Delete(oldBackup);
+            PruneRemovalEvidence verified = PruneEvidenceContract.VerifyManagedRemoval(
+                [oldBackup, newestBackup], [newestBackup], newestBackup);
+            Assert.Equal([oldBackup], verified.RemovedPaths);
+
+            Directory.CreateDirectory(oldBackup);
+            Assert.Throws<InvalidDataException>(() => PruneEvidenceContract.VerifyManagedRemoval(
+                [oldBackup, newestBackup], [newestBackup], newestBackup));
+        }
+        finally
+        {
+            if (Directory.Exists(root))
+            {
+                Directory.Delete(root, recursive: true);
+            }
+        }
+    }
+
+    [Fact]
+    public async Task PruneContract_RequiresNonManagedSentinelContentToRemainExact()
+    {
+        string root = Path.Combine(
+            Path.GetTempPath(),
+            "codex-provider-sync-gui-e2e-prune-sentinel-tests",
+            Guid.NewGuid().ToString("N"));
+        string sentinel = Path.Combine(root, "non-managed", "must-survive.txt");
+        Directory.CreateDirectory(Path.GetDirectoryName(sentinel)!);
+        try
+        {
+            await File.WriteAllTextAsync(sentinel, "original", CancellationToken.None);
+            string expected = await Hashing.Sha256FileAsync(sentinel, CancellationToken.None);
+            await PruneEvidenceContract.VerifySentinelAsync(sentinel, expected, CancellationToken.None);
+
+            await File.WriteAllTextAsync(sentinel, "changed", CancellationToken.None);
+            await Assert.ThrowsAsync<InvalidDataException>(() =>
+                PruneEvidenceContract.VerifySentinelAsync(sentinel, expected, CancellationToken.None));
+        }
+        finally
+        {
+            if (Directory.Exists(root))
+            {
+                Directory.Delete(root, recursive: true);
+            }
+        }
+    }
+
+    [Fact]
+    public async Task ExclusiveConfigLock_IsDeterministicAndFullyRecoverable()
+    {
+        string parent = Path.Combine(
+            Path.GetTempPath(),
+            "codex-provider-sync-gui-e2e-config-lock-tests",
+            Guid.NewGuid().ToString("N"));
+        string root = Path.Combine(parent, "isolation");
+        Directory.CreateDirectory(parent);
+        try
+        {
+            IsolatedFixture fixture = new(root);
+            await fixture.InitializeAsync(CancellationToken.None);
+            await using (FileStream configLock = new(
+                fixture.ConfigPath,
+                FileMode.Open,
+                FileAccess.ReadWrite,
+                FileShare.None,
+                4096,
+                FileOptions.Asynchronous))
+            {
+                await Assert.ThrowsAnyAsync<IOException>(() =>
+                    File.ReadAllTextAsync(fixture.ConfigPath, CancellationToken.None));
+            }
+
+            string restored = await File.ReadAllTextAsync(fixture.ConfigPath, CancellationToken.None);
+            Assert.Contains("model_provider = \"openai\"", restored, StringComparison.Ordinal);
+        }
+        finally
+        {
+            if (Directory.Exists(parent))
+            {
+                Directory.Delete(parent, recursive: true);
+            }
+        }
+    }
+
+    [Fact]
+    public async Task Fixture_ProvidesValidAlternatePickerTargets_AndCountsOnlyManagedBackups()
+    {
+        string parent = Path.Combine(
+            Path.GetTempPath(),
+            "codex-provider-sync-gui-e2e-managed-backup-tests",
+            Guid.NewGuid().ToString("N"));
+        string root = Path.Combine(parent, "isolation");
+        Directory.CreateDirectory(parent);
+        try
+        {
+            IsolatedFixture fixture = new(root);
+            await fixture.InitializeAsync(CancellationToken.None);
+
+            Assert.True(File.Exists(Path.Combine(fixture.PickerCodexHome, "config.toml")));
+            Assert.True(File.Exists(Path.Combine(fixture.PickerSqliteHome, "state_5.sqlite")));
+
+            string backupRoot = Path.Combine(fixture.CodexHome, "backups_state", "provider-sync");
+            string managed = Path.Combine(backupRoot, "20260804T010000000Z");
+            string wrongNamespace = Path.Combine(backupRoot, "20260804T020000000Z");
+            string malformed = Path.Combine(backupRoot, "20260804T030000000Z");
+            string unmanaged = Path.Combine(backupRoot, "non-managed-sentinel");
+            foreach (string directory in new[] { managed, wrongNamespace, malformed, unmanaged })
+            {
+                Directory.CreateDirectory(directory);
+            }
+            await File.WriteAllTextAsync(
+                Path.Combine(managed, "metadata.json"),
+                "{\"namespace\":\"provider-sync\"}",
+                CancellationToken.None);
+            await File.WriteAllTextAsync(
+                Path.Combine(wrongNamespace, "metadata.json"),
+                "{\"namespace\":\"someone-else\"}",
+                CancellationToken.None);
+            await File.WriteAllTextAsync(
+                Path.Combine(malformed, "metadata.json"),
+                "{not-json",
+                CancellationToken.None);
+            await File.WriteAllTextAsync(
+                Path.Combine(unmanaged, "must-survive.txt"),
+                "sentinel",
+                CancellationToken.None);
+
+            Assert.Equal([managed], fixture.ManagedBackups());
+            FixtureSnapshot snapshot = await fixture.SnapshotAsync(CancellationToken.None);
+            Assert.Equal(1, snapshot.ManagedBackupCount);
+        }
+        finally
+        {
+            if (Directory.Exists(parent))
+            {
+                Directory.Delete(parent, recursive: true);
+            }
+        }
+    }
+}
diff --git a/desktop/CodexProviderSync.GuiE2E.Tests/ManifestCoverageGateTests.cs b/desktop/CodexProviderSync.GuiE2E.Tests/ManifestCoverageGateTests.cs
new file mode 100644
index 0000000..f4344fb
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E.Tests/ManifestCoverageGateTests.cs
@@ -0,0 +1,102 @@
+using CodexProviderSync.GuiE2E;
+
+namespace CodexProviderSync.GuiE2E.Tests;
+
+public sealed class ManifestCoverageGateTests
+{
+    private const string ManifestJson = """
+        {
+          "schemaVersion": "0.4",
+          "window": {
+            "id": "window.main",
+            "scenarioIds": ["gui.launch"]
+          },
+          "controls": [
+            {
+              "id": "status.refresh",
+              "scenarioIds": ["gui.status.refresh", "gui.status.failure"]
+            }
+          ],
+          "templates": [
+            {
+              "id": "provider.row",
+              "scenarioIds": ["gui.provider.dynamic-row"]
+            }
+          ],
+          "dialogs": [
+            {
+              "id": "dialog.validation",
+              "scenarioIds": ["gui.provider.validation"]
+            }
+          ]
+        }
+        """;
+
+    private static readonly string[] EveryEntry =
+    [
+        "window.main",
+        "status.refresh",
+        "provider.row",
+        "dialog.validation",
+    ];
+
+    private static readonly string[] EveryScenario =
+    [
+        "gui.launch",
+        "gui.status.refresh",
+        "gui.status.failure",
+        "gui.provider.dynamic-row",
+        "gui.provider.validation",
+    ];
+
+    [Fact]
+    public void Evaluate_PassesOnlyWhenEveryManifestEntryAndScenarioIsCovered()
+    {
+        var result = ManifestCoverageGate.Evaluate(ManifestJson, EveryEntry, EveryScenario);
+
+        Assert.True(result.Passed);
+        Assert.Empty(result.MissingEntryIds);
+        Assert.Empty(result.MissingScenarioIds);
+    }
+
+    [Fact]
+    public void Evaluate_FailsAndNamesEveryUncoveredEntry()
+    {
+        var coveredEntries = EveryEntry.Where(id => id is not "provider.row" and not "dialog.validation");
+
+        var result = ManifestCoverageGate.Evaluate(ManifestJson, coveredEntries, EveryScenario);
+
+        Assert.False(result.Passed);
+        Assert.Equal(
+            new[] { "dialog.validation", "provider.row" },
+            result.MissingEntryIds.Order(StringComparer.Ordinal));
+        Assert.Empty(result.MissingScenarioIds);
+    }
+
+    [Fact]
+    public void Evaluate_FailsAndNamesEveryUncoveredScenario()
+    {
+        var coveredScenarios = EveryScenario.Where(id => id is not "gui.status.failure" and not "gui.provider.validation");
+
+        var result = ManifestCoverageGate.Evaluate(ManifestJson, EveryEntry, coveredScenarios);
+
+        Assert.False(result.Passed);
+        Assert.Empty(result.MissingEntryIds);
+        Assert.Equal(
+            new[] { "gui.provider.validation", "gui.status.failure" },
+            result.MissingScenarioIds.Order(StringComparer.Ordinal));
+    }
+
+    [Fact]
+    public void Evaluate_DoesNotTreatUnknownCoverageIdsAsManifestCoverage()
+    {
+        var result = ManifestCoverageGate.Evaluate(
+            ManifestJson,
+            ["not.a.real.entry"],
+            ["not.a.real.scenario"]);
+
+        Assert.False(result.Passed);
+        Assert.Equal(EveryEntry.Order(StringComparer.Ordinal), result.MissingEntryIds.Order(StringComparer.Ordinal));
+        Assert.Equal(EveryScenario.Order(StringComparer.Ordinal), result.MissingScenarioIds.Order(StringComparer.Ordinal));
+    }
+}
diff --git a/desktop/CodexProviderSync.GuiE2E.Tests/README.md b/desktop/CodexProviderSync.GuiE2E.Tests/README.md
new file mode 100644
index 0000000..2238bb4
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E.Tests/README.md
@@ -0,0 +1,12 @@
+# GUI E2E harness contract tests
+
+These tests validate only the harness's isolation, manifest-gating, evidence-redaction,
+and scenario-asset contracts. They do not launch WinForms and must never be reported as
+a real GUI pass.
+
+The only release GUI result is the exit code and evidence JSON produced by the headful
+runner against the visible published executable. A missing desktop, blocked required
+headful scenario, skipped required headful scenario, or uncovered manifest entry is a
+failure. The asset explicitly partitions manifest scenarios that require future isolated
+fault injection; those capability scenarios are reported as non-gating and are never
+claimed as PASS by the headful run.
diff --git a/desktop/CodexProviderSync.GuiE2E.Tests/RunnerScriptContractTests.cs b/desktop/CodexProviderSync.GuiE2E.Tests/RunnerScriptContractTests.cs
new file mode 100644
index 0000000..80ed014
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E.Tests/RunnerScriptContractTests.cs
@@ -0,0 +1,80 @@
+namespace CodexProviderSync.GuiE2E.Tests;
+
+public sealed class RunnerScriptContractTests
+{
+    [Fact]
+    public void RunnerScript_UsesAnIndependentWideWatchdog_AndKillsTheProcessTree()
+    {
+        string script = ReadRunnerScript();
+
+        Assert.Contains("$harnessWatchdogSeconds = [Math]::Max(300, $TimeoutSeconds * 8)", script);
+        Assert.Contains("$harnessProcess.WaitForExit($harnessWatchdogMilliseconds)", script);
+        Assert.Contains("taskkill.exe", script);
+        Assert.Contains("/PID $Process.Id /T /F", script);
+        Assert.Contains("$watchdogExitCode = 124", script);
+        Assert.Contains("$harnessExit = $watchdogExitCode", script);
+    }
+
+    [Fact]
+    public void RunnerScript_PreservesHarnessFailureExitCode_AndAlwaysReportsEvidencePath()
+    {
+        string script = ReadRunnerScript();
+
+        Assert.Contains("$harnessExit = $harnessProcess.ExitCode", script);
+        Assert.Contains("Write-Host \"GUI E2E evidence: $evidencePath\"", script);
+        Assert.Contains("if ($harnessExit -ne 0)", script);
+        Assert.Contains("exit $harnessExit", script);
+    }
+
+    [Fact]
+    public void RunnerScript_HardGatesTheCompleteHeadfulEvidenceContract()
+    {
+        string script = ReadRunnerScript();
+
+        Assert.Contains("$expectedManifestEntries = 40", script);
+        Assert.Contains("$expectedRequiredScenarios = 53", script);
+        Assert.Contains("$evidence.passed -eq $true", script);
+        Assert.Contains("$errorRows.Count -eq 0", script);
+        Assert.Contains("$blockerRows.Count -eq 0", script);
+        Assert.Contains("$evidence.manifest.declaredEntryCount -eq $expectedManifestEntries", script);
+        Assert.Contains("$evidence.manifest.coveredEntryCount -eq $expectedManifestEntries", script);
+        Assert.Contains("$evidence.manifest.requiredHeadfulScenarioCount -eq $expectedRequiredScenarios", script);
+        Assert.Contains("$evidence.manifest.passedRequiredHeadfulScenarioCount -eq $expectedRequiredScenarios", script);
+        Assert.Contains("$evidence.manifest.coveragePassed -eq $true", script);
+        Assert.Contains("$scenarioRows.Count -eq $expectedRequiredScenarios", script);
+        Assert.Contains("$invalidScenarioRows.Count -eq 0", script);
+        Assert.Contains("$skippedOrBlockedRows.Count -eq 0", script);
+    }
+
+    [Fact]
+    public void RunnerScript_VerifiesPublishedExecutableSha256AgainstEvidence()
+    {
+        string script = ReadRunnerScript();
+
+        Assert.Contains("Get-FileHash -LiteralPath $appExe -Algorithm SHA256", script);
+        Assert.Contains("$evidence.executable.sha256", script);
+        Assert.Contains("[System.StringComparison]::OrdinalIgnoreCase", script);
+    }
+
+    private static string ReadRunnerScript()
+    {
+        string repositoryRoot = FindRepositoryRoot();
+        return File.ReadAllText(Path.Combine(repositoryRoot, "scripts", "run-windows-gui-e2e.ps1"));
+    }
+
+    private static string FindRepositoryRoot()
+    {
+        DirectoryInfo? directory = new(AppContext.BaseDirectory);
+        while (directory is not null)
+        {
+            if (File.Exists(Path.Combine(directory.FullName, "scripts", "run-windows-gui-e2e.ps1")))
+            {
+                return directory.FullName;
+            }
+
+            directory = directory.Parent;
+        }
+
+        throw new DirectoryNotFoundException("Could not locate the repository root from the test output directory.");
+    }
+}
diff --git a/desktop/CodexProviderSync.GuiE2E.Tests/ScenarioAssetContractTests.cs b/desktop/CodexProviderSync.GuiE2E.Tests/ScenarioAssetContractTests.cs
new file mode 100644
index 0000000..979e25e
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E.Tests/ScenarioAssetContractTests.cs
@@ -0,0 +1,159 @@
+using System.Text.Json;
+
+namespace CodexProviderSync.GuiE2E.Tests;
+
+public sealed class ScenarioAssetContractTests
+{
+    [Fact]
+    public void ScenarioAsset_CoversEveryEntry_AndPartitionsRequiredHeadfulScenarios()
+    {
+        var repositoryRoot = FindRepositoryRoot();
+        using var manifest = JsonDocument.Parse(File.ReadAllText(Path.Combine(
+            repositoryRoot,
+            "desktop",
+            "CodexProviderSync.App",
+            "Automation",
+            "gui-automation-manifest.v0.4.json")));
+        using var asset = JsonDocument.Parse(File.ReadAllText(Path.Combine(
+            repositoryRoot,
+            "desktop",
+            "CodexProviderSync.GuiE2E",
+            "assets",
+            "gui-e2e-scenarios.v0.4.json")));
+
+        var manifestEntries = ManifestEntries(manifest.RootElement).ToArray();
+        var expectedEntries = manifestEntries.Select(entry => entry.GetProperty("id").GetString()!).ToArray();
+        var expectedScenarios = manifestEntries
+            .SelectMany(entry => StringArray(entry, "scenarioIds"))
+            .Distinct(StringComparer.Ordinal)
+            .ToArray();
+        var groups = asset.RootElement.GetProperty("groups").EnumerateArray().ToArray();
+        var actualEntries = groups.SelectMany(group => StringArray(group, "entryIds")).ToArray();
+        var requiredScenarios = groups.SelectMany(group => StringArray(group, "scenarioIds")).ToArray();
+        var nonGatingScenarios = StringArray(asset.RootElement, "nonGatingManifestScenarioIds").ToArray();
+
+        Assert.Equal(expectedEntries.Order(StringComparer.Ordinal), actualEntries.Order(StringComparer.Ordinal));
+        Assert.Equal(
+            expectedScenarios.Order(StringComparer.Ordinal),
+            requiredScenarios.Concat(nonGatingScenarios).Order(StringComparer.Ordinal));
+        Assert.DoesNotContain(
+            actualEntries.GroupBy(id => id, StringComparer.Ordinal),
+            group => group.Count() != 1);
+        Assert.DoesNotContain(
+            requiredScenarios.GroupBy(id => id, StringComparer.Ordinal),
+            group => group.Count() != 1);
+        Assert.DoesNotContain(
+            nonGatingScenarios.GroupBy(id => id, StringComparer.Ordinal),
+            group => group.Count() != 1);
+        Assert.Empty(requiredScenarios.Intersect(nonGatingScenarios, StringComparer.Ordinal));
+        Assert.NotEmpty(requiredScenarios);
+        Assert.NotEmpty(nonGatingScenarios);
+    }
+
+    [Fact]
+    public void ScenarioAsset_TargetsTheCurrentManifestVersion()
+    {
+        var repositoryRoot = FindRepositoryRoot();
+        using var manifest = JsonDocument.Parse(File.ReadAllText(Path.Combine(
+            repositoryRoot,
+            "desktop",
+            "CodexProviderSync.App",
+            "Automation",
+            "gui-automation-manifest.v0.4.json")));
+        using var asset = JsonDocument.Parse(File.ReadAllText(Path.Combine(
+            repositoryRoot,
+            "desktop",
+            "CodexProviderSync.GuiE2E",
+            "assets",
+            "gui-e2e-scenarios.v0.4.json")));
+
+        Assert.Equal(
+            manifest.RootElement.GetProperty("manifestVersion").GetString(),
+            asset.RootElement.GetProperty("manifestVersion").GetString());
+    }
+
+    [Fact]
+    public void ScenarioAsset_ForbidsUnitTestsFromClaimingARealGuiPass()
+    {
+        var repositoryRoot = FindRepositoryRoot();
+        using var asset = JsonDocument.Parse(File.ReadAllText(Path.Combine(
+            repositoryRoot,
+            "desktop",
+            "CodexProviderSync.GuiE2E",
+            "assets",
+            "gui-e2e-scenarios.v0.4.json")));
+        var policy = asset.RootElement.GetProperty("executionPolicy");
+
+        Assert.True(policy.GetProperty("requiresWindows").GetBoolean());
+        Assert.True(policy.GetProperty("requiresUserInteractive").GetBoolean());
+        Assert.True(policy.GetProperty("requiresActiveDesktop").GetBoolean());
+        Assert.True(policy.GetProperty("requiresVisiblePublishedExe").GetBoolean());
+        Assert.True(policy.GetProperty("requiresRealControlsAndEvents").GetBoolean());
+        Assert.True(policy.GetProperty("blockedIsFailure").GetBoolean());
+        Assert.True(policy.GetProperty("skippedIsFailure").GetBoolean());
+        Assert.False(policy.GetProperty("unitTestsMayClaimGuiPass").GetBoolean());
+    }
+
+    [Fact]
+    public void ScenarioAsset_RequiresConcreteEvidenceForEveryGroup()
+    {
+        var repositoryRoot = FindRepositoryRoot();
+        using var asset = JsonDocument.Parse(File.ReadAllText(Path.Combine(
+            repositoryRoot,
+            "desktop",
+            "CodexProviderSync.GuiE2E",
+            "assets",
+            "gui-e2e-scenarios.v0.4.json")));
+
+        foreach (var group in asset.RootElement.GetProperty("groups").EnumerateArray())
+        {
+            string[] requiredEvidence = StringArray(group, "requiredEvidence").ToArray();
+            Assert.NotEmpty(StringArray(group, "entryIds"));
+            Assert.NotEmpty(StringArray(group, "scenarioIds"));
+            Assert.NotEmpty(requiredEvidence);
+            Assert.Equal(requiredEvidence.Length, requiredEvidence.Distinct(StringComparer.Ordinal).Count());
+            Assert.All(requiredEvidence, reference =>
+                Assert.Contains(reference, ScenarioRunner.SupportedEvidenceReferences));
+        }
+    }
+
+    private static IEnumerable<JsonElement> ManifestEntries(JsonElement manifest)
+    {
+        yield return manifest.GetProperty("window");
+
+        foreach (var sectionName in new[] { "controls", "templates", "dialogs" })
+        {
+            foreach (var entry in manifest.GetProperty(sectionName).EnumerateArray())
+            {
+                yield return entry;
+            }
+        }
+    }
+
+    private static IEnumerable<string> StringArray(JsonElement owner, string propertyName)
+    {
+        return owner.GetProperty(propertyName).EnumerateArray().Select(value => value.GetString()!);
+    }
+
+    private static string FindRepositoryRoot()
+    {
+        var directory = new DirectoryInfo(AppContext.BaseDirectory);
+        while (directory is not null)
+        {
+            var manifestPath = Path.Combine(
+                directory.FullName,
+                "desktop",
+                "CodexProviderSync.App",
+                "Automation",
+                "gui-automation-manifest.v0.4.json");
+            if (File.Exists(manifestPath))
+            {
+                return directory.FullName;
+            }
+
+            directory = directory.Parent;
+        }
+
+        throw new DirectoryNotFoundException("Could not locate the repository root from the test output directory.");
+    }
+}
diff --git a/desktop/CodexProviderSync.GuiE2E.Tests/TimeoutAndFailureFinalizationTests.cs b/desktop/CodexProviderSync.GuiE2E.Tests/TimeoutAndFailureFinalizationTests.cs
new file mode 100644
index 0000000..9fd6b7d
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E.Tests/TimeoutAndFailureFinalizationTests.cs
@@ -0,0 +1,162 @@
+using System.Diagnostics;
+using System.IO.Pipes;
+using System.Text;
+using System.Text.Json.Nodes;
+
+namespace CodexProviderSync.GuiE2E.Tests;
+
+public sealed class TimeoutAndFailureFinalizationTests
+{
+    [Fact]
+    public async Task SendAsync_TimesOutAStalledResponse_WithoutOverReleasingQueuedRequestLock()
+    {
+        string pipeName = $"codex-provider-sync-timeout-{Guid.NewGuid():N}";
+        await using NamedPipeServerStream server = new(
+            pipeName,
+            PipeDirection.InOut,
+            1,
+            PipeTransmissionMode.Byte,
+            PipeOptions.Asynchronous);
+        Task serverConnected = server.WaitForConnectionAsync();
+        Task<GuiBridgeClient> clientConnected = GuiBridgeClient.ConnectAsync(
+            pipeName,
+            "test-token",
+            TimeSpan.FromMilliseconds(750),
+            CancellationToken.None);
+        await Task.WhenAll(serverConnected, clientConnected);
+        await using GuiBridgeClient client = await clientConnected;
+        using StreamReader serverReader = new(server, new UTF8Encoding(false), leaveOpen: true);
+
+        Stopwatch elapsed = Stopwatch.StartNew();
+        Task<BridgeResponse> stalled = client.SendAsync("ui.stalled");
+        Assert.NotNull(await serverReader.ReadLineAsync());
+
+        using CancellationTokenSource queuedCancellation = new();
+        Task<BridgeResponse> queued = client.SendAsync(
+            "ui.queued",
+            cancellationToken: queuedCancellation.Token);
+        queuedCancellation.Cancel();
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => queued);
+        TimeoutException timeout = await Assert.ThrowsAsync<TimeoutException>(() => stalled);
+        elapsed.Stop();
+
+        Assert.Contains("ui.stalled", timeout.Message, StringComparison.Ordinal);
+        Assert.InRange(elapsed.Elapsed, TimeSpan.FromMilliseconds(300), TimeSpan.FromSeconds(3));
+    }
+
+    [Theory]
+    [InlineData(15, 240)]
+    [InlineData(90, 540)]
+    [InlineData(600, 2700)]
+    public void WholeRunWatchdog_IsWiderThanARequest_AndBounded(int requestSeconds, int expectedSeconds)
+    {
+        TimeSpan request = TimeSpan.FromSeconds(requestSeconds);
+        TimeSpan wholeRun = GuiE2EWatchdog.WholeRunTimeout(request);
+
+        Assert.Equal(TimeSpan.FromSeconds(expectedSeconds), wholeRun);
+        Assert.True(wholeRun > request);
+    }
+
+    [Fact]
+    public void Watchdog_RejectsNonPositiveTimeouts()
+    {
+        Assert.Throws<ArgumentOutOfRangeException>(() => GuiE2EWatchdog.WholeRunTimeout(TimeSpan.Zero));
+        Assert.Throws<ArgumentOutOfRangeException>(() => GuiE2EWatchdog.FailureFinalizationTimeout(TimeSpan.Zero));
+    }
+
+    [Fact]
+    public async Task FailureFinalization_IsIdempotent_CollectsPartialTrace_AndMaterializesAllRequiredScenarios()
+    {
+        string repositoryRoot = FindRepositoryRoot();
+        string parent = Path.Combine(
+            Path.GetTempPath(),
+            "codex-provider-sync-gui-e2e-finalization-tests",
+            Guid.NewGuid().ToString("N"));
+        string isolationRoot = Path.Combine(parent, "isolation");
+        Directory.CreateDirectory(parent);
+        try
+        {
+            string manifestPath = Path.Combine(
+                repositoryRoot,
+                "desktop",
+                "CodexProviderSync.App",
+                "Automation",
+                "gui-automation-manifest.v0.4.json");
+            string scenarioPath = Path.Combine(
+                repositoryRoot,
+                "desktop",
+                "CodexProviderSync.GuiE2E",
+                "assets",
+                "gui-e2e-scenarios.v0.4.json");
+            string manifestJson = await File.ReadAllTextAsync(manifestPath);
+            string scenarioJson = await File.ReadAllTextAsync(scenarioPath);
+            IsolatedFixture fixture = new(isolationRoot);
+            Directory.CreateDirectory(Path.GetDirectoryName(fixture.TracePath)!);
+            const string firstTrace = "{\"requestId\":\"request-1\",\"eventObserved\":true}";
+            const string secondTrace = "{\"requestId\":\"request-2\",\"eventObserved\":false}";
+            await File.WriteAllLinesAsync(fixture.TracePath, [firstTrace, "not-json", secondTrace]);
+
+            EvidenceDocument evidence = new();
+            evidence.Trace.Add(JsonNode.Parse(firstTrace));
+            GuiE2EOptions options = new(
+                Path.Combine(parent, "CodexProviderSync.exe"),
+                manifestPath,
+                scenarioPath,
+                Path.Combine(parent, "evidence.json"),
+                isolationRoot,
+                TimeSpan.FromSeconds(30));
+            ScenarioRunner runner = new(
+                options,
+                fixture,
+                evidence,
+                new Dictionary<string, string?>(),
+                manifestJson,
+                scenarioJson);
+            using CancellationTokenSource timeout = new(TimeSpan.FromSeconds(5));
+
+            await runner.FinalizeFailureEvidenceAsync(timeout.Token);
+            await runner.FinalizeFailureEvidenceAsync(timeout.Token);
+
+            Assert.Equal(53, evidence.Scenarios.Count);
+            Assert.Equal(53, evidence.Scenarios
+                .Select(item => Assert.IsType<string>(item["id"]))
+                .Distinct(StringComparer.Ordinal)
+                .Count());
+            Assert.All(evidence.Scenarios, item => Assert.Equal("blocked", item["status"]));
+            Assert.Equal(2, evidence.Trace.Count);
+            Assert.Equal(1, evidence.Manifest["failureTraceMalformedLineCount"]);
+            Assert.Equal(53, evidence.Manifest["requiredHeadfulScenarioCount"]);
+            Assert.Equal(0, evidence.Manifest["passedRequiredHeadfulScenarioCount"]);
+            Assert.Equal(false, evidence.Manifest["coveragePassed"]);
+            Assert.Single(evidence.Blockers);
+        }
+        finally
+        {
+            if (Directory.Exists(parent))
+            {
+                Directory.Delete(parent, recursive: true);
+            }
+        }
+    }
+
+    private static string FindRepositoryRoot()
+    {
+        DirectoryInfo? directory = new(AppContext.BaseDirectory);
+        while (directory is not null)
+        {
+            string manifestPath = Path.Combine(
+                directory.FullName,
+                "desktop",
+                "CodexProviderSync.App",
+                "Automation",
+                "gui-automation-manifest.v0.4.json");
+            if (File.Exists(manifestPath))
+            {
+                return directory.FullName;
+            }
+            directory = directory.Parent;
+        }
+        throw new DirectoryNotFoundException("Repository root was not found from the test output path.");
+    }
+}
diff --git a/desktop/CodexProviderSync.GuiE2E/AssemblyInfo.cs b/desktop/CodexProviderSync.GuiE2E/AssemblyInfo.cs
new file mode 100644
index 0000000..b1e29f1
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E/AssemblyInfo.cs
@@ -0,0 +1,3 @@
+using System.Runtime.CompilerServices;
+
+[assembly: InternalsVisibleTo("CodexProviderSync.GuiE2E.Tests")]
diff --git a/desktop/CodexProviderSync.GuiE2E/CodexProviderSync.GuiE2E.csproj b/desktop/CodexProviderSync.GuiE2E/CodexProviderSync.GuiE2E.csproj
new file mode 100644
index 0000000..8947d2a
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E/CodexProviderSync.GuiE2E.csproj
@@ -0,0 +1,24 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net10.0-windows</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <UseWindowsForms>true</UseWindowsForms>
+    <RootNamespace>CodexProviderSync.GuiE2E</RootNamespace>
+    <Version>0.4.0</Version>
+    <AssemblyVersion>0.4.0.0</AssemblyVersion>
+    <FileVersion>0.4.0.0</FileVersion>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.5" />
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.12" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Content Include="assets\gui-e2e-scenarios.v0.4.json" CopyToOutputDirectory="PreserveNewest" />
+  </ItemGroup>
+
+</Project>
diff --git a/desktop/CodexProviderSync.GuiE2E/GuiBridgeClient.cs b/desktop/CodexProviderSync.GuiE2E/GuiBridgeClient.cs
new file mode 100644
index 0000000..bae3caa
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E/GuiBridgeClient.cs
@@ -0,0 +1,153 @@
+using System.IO.Pipes;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+namespace CodexProviderSync.GuiE2E;
+
+internal sealed record BridgeResponse(
+    string? Id,
+    bool Ok,
+    JsonNode? Result,
+    string? ErrorCode,
+    string? ErrorMessage);
+
+internal sealed class GuiBridgeClient : IAsyncDisposable
+{
+    private readonly NamedPipeClientStream _pipe;
+    private readonly StreamReader _reader;
+    private readonly StreamWriter _writer;
+    private readonly string _token;
+    private readonly TimeSpan _requestTimeout;
+    private readonly SemaphoreSlim _singleRequest = new(1, 1);
+    private int _sequence;
+
+    private GuiBridgeClient(NamedPipeClientStream pipe, string token, TimeSpan requestTimeout)
+    {
+        _pipe = pipe;
+        _token = token;
+        _requestTimeout = requestTimeout;
+        _reader = new StreamReader(pipe, new UTF8Encoding(false, true), false, 4096, leaveOpen: true);
+        _writer = new StreamWriter(pipe, new UTF8Encoding(false), 4096, leaveOpen: true)
+        {
+            AutoFlush = true,
+            NewLine = "\n"
+        };
+    }
+
+    internal static async Task<GuiBridgeClient> ConnectAsync(
+        string pipeName,
+        string token,
+        TimeSpan timeout,
+        CancellationToken cancellationToken)
+    {
+        if (timeout <= TimeSpan.Zero)
+        {
+            throw new ArgumentOutOfRangeException(nameof(timeout));
+        }
+        NamedPipeClientStream pipe = new(
+            ".",
+            pipeName,
+            PipeDirection.InOut,
+            PipeOptions.Asynchronous,
+            System.Security.Principal.TokenImpersonationLevel.Identification);
+        try
+        {
+            using CancellationTokenSource timeoutSource = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+            timeoutSource.CancelAfter(timeout);
+            await pipe.ConnectAsync(timeoutSource.Token);
+            return new GuiBridgeClient(pipe, token, timeout);
+        }
+        catch
+        {
+            await pipe.DisposeAsync();
+            throw;
+        }
+    }
+
+    internal async Task<BridgeResponse> SendAsync(
+        string method,
+        JsonObject? parameters = null,
+        CancellationToken cancellationToken = default)
+    {
+        using CancellationTokenSource requestSource = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+        requestSource.CancelAfter(_requestTimeout);
+        bool lockTaken = false;
+        try
+        {
+            await _singleRequest.WaitAsync(requestSource.Token);
+            lockTaken = true;
+            string id = $"e2e-{Interlocked.Increment(ref _sequence):D4}-{Guid.NewGuid():N}";
+            JsonObject request = new()
+            {
+                ["id"] = id,
+                ["method"] = method,
+                ["token"] = _token,
+                ["params"] = parameters ?? new JsonObject()
+            };
+            string requestJson = request.ToJsonString(new JsonSerializerOptions(JsonSerializerDefaults.Web));
+            if (Encoding.UTF8.GetByteCount(requestJson) > 64 * 1024)
+            {
+                throw new InvalidDataException("GUI request exceeds the bridge protocol limit.");
+            }
+            await _writer.WriteLineAsync(requestJson.AsMemory(), requestSource.Token);
+            string? responseJson = await _reader.ReadLineAsync(requestSource.Token);
+            if (responseJson is null)
+            {
+                throw new EndOfStreamException("GUI bridge closed before returning a response.");
+            }
+            BridgeResponse? response = JsonSerializer.Deserialize<BridgeResponse>(
+                responseJson,
+                new JsonSerializerOptions(JsonSerializerDefaults.Web));
+            if (response is null || !string.Equals(response.Id, id, StringComparison.Ordinal))
+            {
+                throw new InvalidDataException("GUI bridge response id did not match its request.");
+            }
+            return response;
+        }
+        catch (OperationCanceledException error) when (!cancellationToken.IsCancellationRequested)
+        {
+            throw new TimeoutException(
+                $"GUI bridge request '{method}' exceeded its {_requestTimeout.TotalSeconds:0.###}-second timeout.",
+                error);
+        }
+        finally
+        {
+            if (lockTaken)
+            {
+                _singleRequest.Release();
+            }
+        }
+    }
+
+    internal async Task<JsonNode?> RequireAsync(
+        string method,
+        JsonObject? parameters = null,
+        CancellationToken cancellationToken = default)
+    {
+        BridgeResponse response = await SendAsync(method, parameters, cancellationToken);
+        if (!response.Ok)
+        {
+            throw new InvalidOperationException(
+                $"GUI bridge {method} failed [{response.ErrorCode}]: {response.ErrorMessage}");
+        }
+        return response.Result;
+    }
+
+    internal Task<JsonNode?> GetAsync(string automationId, CancellationToken cancellationToken = default) =>
+        RequireAsync("ui.get", new JsonObject { ["automationId"] = automationId }, cancellationToken);
+
+    internal Task<JsonNode?> SetAsync(string automationId, JsonNode? value, CancellationToken cancellationToken = default) =>
+        RequireAsync("ui.set", new JsonObject { ["automationId"] = automationId, ["value"] = value }, cancellationToken);
+
+    internal Task<JsonNode?> InvokeAsync(string automationId, CancellationToken cancellationToken = default) =>
+        RequireAsync("ui.invoke", new JsonObject { ["automationId"] = automationId }, cancellationToken);
+
+    public async ValueTask DisposeAsync()
+    {
+        _singleRequest.Dispose();
+        _reader.Dispose();
+        await _writer.DisposeAsync();
+        await _pipe.DisposeAsync();
+    }
+}
diff --git a/desktop/CodexProviderSync.GuiE2E/Infrastructure.cs b/desktop/CodexProviderSync.GuiE2E/Infrastructure.cs
new file mode 100644
index 0000000..7153f09
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E/Infrastructure.cs
@@ -0,0 +1,422 @@
+using System.Security.Cryptography;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+namespace CodexProviderSync.GuiE2E;
+
+public static class IsolationEnvironment
+{
+    private static readonly HashSet<string> AllowedInheritedVariables = new(StringComparer.OrdinalIgnoreCase)
+    {
+        "SystemRoot", "WINDIR", "SystemDrive", "COMSPEC", "PATH", "PATHEXT", "OS",
+        "PROCESSOR_ARCHITECTURE", "PROCESSOR_IDENTIFIER", "PROCESSOR_LEVEL", "PROCESSOR_REVISION",
+        "NUMBER_OF_PROCESSORS", "ProgramFiles", "ProgramFiles(x86)", "ProgramW6432",
+        "CommonProgramFiles", "CommonProgramFiles(x86)", "CommonProgramW6432",
+        "COMPUTERNAME", "USERDOMAIN", "USERNAME", "LANG", "LC_ALL",
+        "DOTNET_ROOT", "DOTNET_ROOT_X64"
+    };
+    private static readonly string[] ForcedDirectories =
+    [
+        "HOME", "USERPROFILE", "CODEX_HOME", "CODEX_SQLITE_HOME",
+        "APPDATA", "LOCALAPPDATA", "TEMP", "TMP"
+    ];
+
+    public static Dictionary<string, string?> Build(
+        string root,
+        IReadOnlyDictionary<string, string?> source)
+    {
+        string fullRoot = Path.TrimEndingDirectorySeparator(Path.GetFullPath(root));
+        Dictionary<string, string?> result = new(StringComparer.OrdinalIgnoreCase);
+        foreach ((string name, string? value) in source)
+        {
+            if (!AllowedInheritedVariables.Contains(name)
+                || IsCredentialVariable(name)
+                || ForcedDirectories.Contains(name, StringComparer.OrdinalIgnoreCase))
+            {
+                continue;
+            }
+            result[name] = value;
+        }
+
+        result["HOME"] = Under(fullRoot, "env", "home");
+        result["USERPROFILE"] = Under(fullRoot, "env", "profile");
+        result["CODEX_HOME"] = Under(fullRoot, "codex-home");
+        result["CODEX_SQLITE_HOME"] = Under(fullRoot, "sqlite-home");
+        result["APPDATA"] = Under(fullRoot, "env", "appdata");
+        result["LOCALAPPDATA"] = Under(fullRoot, "env", "localappdata");
+        result["TEMP"] = Under(fullRoot, "env", "temp");
+        result["TMP"] = Under(fullRoot, "env", "temp");
+        result["DOTNET_BUNDLE_EXTRACT_BASE_DIR"] = Under(fullRoot, "env", "dotnet-bundle");
+        foreach (string path in ForcedDirectories.Select(name => result[name]!)
+            .Append(result["DOTNET_BUNDLE_EXTRACT_BASE_DIR"]!)
+            .Distinct(StringComparer.OrdinalIgnoreCase))
+        {
+            Directory.CreateDirectory(path);
+        }
+        string isolatedProfile = result["USERPROFILE"]!;
+        foreach (string shellFolder in new[] { "Desktop", "Documents", "Downloads" })
+        {
+            Directory.CreateDirectory(Path.Combine(isolatedProfile, shellFolder));
+        }
+        return result;
+    }
+
+    public static bool IsContained(string root, string candidate)
+    {
+        string fullRoot = Path.TrimEndingDirectorySeparator(Path.GetFullPath(root));
+        string fullCandidate = Path.GetFullPath(candidate);
+        return string.Equals(fullRoot, fullCandidate, StringComparison.OrdinalIgnoreCase)
+            || fullCandidate.StartsWith(fullRoot + Path.DirectorySeparatorChar, StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static bool IsCredentialVariable(string name)
+    {
+        string normalized = name.ToUpperInvariant();
+        return normalized.Contains("TOKEN", StringComparison.Ordinal)
+            || normalized.Contains("AUTH", StringComparison.Ordinal)
+            || normalized.Contains("KEY", StringComparison.Ordinal)
+            || normalized.Contains("SECRET", StringComparison.Ordinal)
+            || normalized.Contains("PASSWORD", StringComparison.Ordinal)
+            || normalized.Contains("PASSWD", StringComparison.Ordinal)
+            || normalized.Contains("CREDENTIAL", StringComparison.Ordinal)
+            || normalized.Contains("CLAUDE", StringComparison.Ordinal)
+            || normalized.Contains("GITHUB", StringComparison.Ordinal)
+            || normalized.Contains("OPENAI", StringComparison.Ordinal)
+            || normalized.Contains("CODEX", StringComparison.Ordinal);
+    }
+
+    private static string Under(string root, params string[] segments) =>
+        segments.Aggregate(root, Path.Combine);
+}
+
+public sealed record ManifestCoverageResult(
+    bool Passed,
+    IReadOnlyList<string> MissingEntryIds,
+    IReadOnlyList<string> MissingScenarioIds);
+
+public static class ManifestCoverageGate
+{
+    public static ManifestCoverageResult Evaluate(
+        string manifestJson,
+        IEnumerable<string> coveredEntryIds,
+        IEnumerable<string> coveredScenarioIds)
+    {
+        using JsonDocument document = JsonDocument.Parse(manifestJson);
+        JsonElement root = document.RootElement;
+        HashSet<string> entries = new(StringComparer.Ordinal);
+        HashSet<string> scenarios = new(StringComparer.Ordinal);
+        AddEntry(root.GetProperty("window"), entries, scenarios);
+        foreach (string collection in new[] { "controls", "templates", "dialogs" })
+        {
+            foreach (JsonElement entry in root.GetProperty(collection).EnumerateArray())
+            {
+                AddEntry(entry, entries, scenarios);
+            }
+        }
+
+        HashSet<string> coveredEntries = coveredEntryIds.ToHashSet(StringComparer.Ordinal);
+        HashSet<string> coveredScenarios = coveredScenarioIds.ToHashSet(StringComparer.Ordinal);
+        string[] missingEntries = entries.Except(coveredEntries).Order(StringComparer.Ordinal).ToArray();
+        string[] missingScenarios = scenarios.Except(coveredScenarios).Order(StringComparer.Ordinal).ToArray();
+        return new ManifestCoverageResult(
+            missingEntries.Length == 0 && missingScenarios.Length == 0,
+            missingEntries,
+            missingScenarios);
+    }
+
+    public static (IReadOnlyList<string> Entries, IReadOnlyList<string> Scenarios) ReadRequirements(string manifestJson)
+    {
+        using JsonDocument document = JsonDocument.Parse(manifestJson);
+        HashSet<string> entries = new(StringComparer.Ordinal);
+        HashSet<string> scenarios = new(StringComparer.Ordinal);
+        AddEntry(document.RootElement.GetProperty("window"), entries, scenarios);
+        foreach (string collection in new[] { "controls", "templates", "dialogs" })
+        {
+            foreach (JsonElement entry in document.RootElement.GetProperty(collection).EnumerateArray())
+            {
+                AddEntry(entry, entries, scenarios);
+            }
+        }
+        return (entries.Order(StringComparer.Ordinal).ToArray(), scenarios.Order(StringComparer.Ordinal).ToArray());
+    }
+
+    private static void AddEntry(JsonElement entry, ISet<string> entries, ISet<string> scenarios)
+    {
+        entries.Add(entry.GetProperty("id").GetString()!);
+        foreach (JsonElement scenario in entry.GetProperty("scenarioIds").EnumerateArray())
+        {
+            scenarios.Add(scenario.GetString()!);
+        }
+    }
+}
+
+public static class EvidenceRedactor
+{
+    public static string Redact(string evidence, IEnumerable<string> secrets)
+    {
+        string redacted = evidence;
+        foreach (string secret in secrets.Where(static value => !string.IsNullOrEmpty(value)))
+        {
+            redacted = redacted.Replace(secret, "[REDACTED]", StringComparison.Ordinal);
+            redacted = redacted.Replace(secret.ToUpperInvariant(), "[REDACTED]", StringComparison.Ordinal);
+        }
+        return redacted;
+    }
+}
+
+public sealed record VerifiedApplicationLink(
+    string OperationId,
+    string Operation,
+    string Lifecycle,
+    IReadOnlyList<string> ErrorCodes);
+
+public static class ApplicationLinkVerifier
+{
+    public static VerifiedApplicationLink Verify(
+        JsonNode? result,
+        string expectedOperation,
+        string expectedLifecycle,
+        IEnumerable<string>? expectedErrorCodes = null)
+    {
+        JsonObject root = result as JsonObject
+            ?? throw new InvalidDataException("GUI invoke result did not contain an Application link object.");
+        if (root["applicationOperationLinked"]?.GetValue<bool>() != true)
+        {
+            throw new InvalidDataException("GUI invoke result did not link an Application operation.");
+        }
+        string operationId = RequiredString(root, "applicationOperationId");
+        string operation = RequiredString(root, "applicationOperation");
+        string lifecycle = RequiredString(root, "applicationLifecycle");
+        if (!string.Equals(operation, expectedOperation, StringComparison.Ordinal))
+        {
+            throw new InvalidDataException(
+                $"Application operation mismatch: expected {expectedOperation}, observed {operation}.");
+        }
+        if (!string.Equals(lifecycle, expectedLifecycle, StringComparison.Ordinal))
+        {
+            throw new InvalidDataException(
+                $"Application lifecycle mismatch for {operation}: expected {expectedLifecycle}, observed {lifecycle}.");
+        }
+        JsonArray operations = root["applicationOperations"] as JsonArray
+            ?? throw new InvalidDataException("GUI invoke result omitted applicationOperations.");
+        JsonObject[] matchingOperations = operations.OfType<JsonObject>().Where(candidate =>
+            string.Equals(candidate["operationId"]?.GetValue<string>(), operationId, StringComparison.Ordinal)).ToArray();
+        if (matchingOperations.Length != 1)
+        {
+            throw new InvalidDataException(
+                "Primary applicationOperationId did not identify exactly one nested operation record.");
+        }
+        JsonObject nested = matchingOperations[0];
+        string nestedOperation = RequiredString(nested, "operation");
+        string nestedLifecycle = RequiredString(nested, "lifecycle");
+        if (!string.Equals(nestedOperation, operation, StringComparison.Ordinal)
+            || !string.Equals(nestedLifecycle, lifecycle, StringComparison.Ordinal))
+        {
+            throw new InvalidDataException("Primary and nested Application operation metadata disagree.");
+        }
+        string[] actualErrors = (nested["errorCodes"] as JsonArray
+            ?? throw new InvalidDataException("Nested Application operation omitted errorCodes."))
+            .Select(node => node?.GetValue<string>()
+                ?? throw new InvalidDataException("Application errorCodes contains a null value."))
+            .Order(StringComparer.Ordinal)
+            .ToArray();
+        string[] expectedErrors = (expectedErrorCodes ?? [])
+            .Order(StringComparer.Ordinal)
+            .ToArray();
+        if (!actualErrors.SequenceEqual(expectedErrors, StringComparer.Ordinal))
+        {
+            throw new InvalidDataException(
+                $"Application errorCodes mismatch for {operation}: expected [{string.Join(",", expectedErrors)}], "
+                + $"observed [{string.Join(",", actualErrors)}].");
+        }
+        return new VerifiedApplicationLink(operationId, operation, lifecycle, actualErrors);
+    }
+
+    private static string RequiredString(JsonObject owner, string property)
+    {
+        string? value = owner[property]?.GetValue<string>();
+        return string.IsNullOrWhiteSpace(value)
+            ? throw new InvalidDataException($"Application link omitted {property}.")
+            : value;
+    }
+}
+
+public sealed record DialogContractResult(bool Passed, string? Error);
+
+public static class DialogContractVerifier
+{
+    public static DialogContractResult Verify(
+        string purpose,
+        string className,
+        string title,
+        IEnumerable<string> text)
+    {
+        if (!string.Equals(className, "#32770", StringComparison.Ordinal))
+        {
+            return new(false, $"Expected native MessageBox class #32770, observed {className}.");
+        }
+        if (!string.Equals(title, "Codex Provider Sync", StringComparison.Ordinal))
+        {
+            return new(false, $"Unexpected MessageBox title: {title}.");
+        }
+        string[] labels = text.Where(value => !string.IsNullOrWhiteSpace(value)).ToArray();
+        string combined = string.Join("\n", labels);
+        DialogExpectation expectation = purpose switch
+        {
+            "validation" => new(["请输入要添加的 Provider ID"], true, false, []),
+            "sync-cancel" or "sync-apply" or "switch-apply" =>
+                new(["执行同步前", "是否继续"], true, true, []),
+            "prune-cancel" or "prune-apply" =>
+                new(["确认清理旧备份", "将只保留最近"], true, true, []),
+            "update-no-update" => new(
+                ["当前已是最新版本"],
+                true,
+                false,
+                ["失败", "错误", "超时", "发现新版本", "failed", "error", "timeout"]),
+            "restore-targets" => new(["确认恢复以下备份", "将覆盖当前的"], true, true, []),
+            "restore-close-codex" => new(["恢复备份前", "是否继续"], true, true, []),
+            "operation-failure" => new(
+                [],
+                true,
+                false,
+                ["是否继续", "当前已是最新版本", "确认清理", "确认恢复"]),
+            _ => throw new ArgumentOutOfRangeException(nameof(purpose), purpose, "Unknown dialog contract purpose.")
+        };
+        foreach (string forbidden in expectation.ForbiddenFragments)
+        {
+            if (combined.Contains(forbidden, StringComparison.OrdinalIgnoreCase))
+            {
+                return new(false, $"MessageBox for {purpose} contained forbidden text '{forbidden}'.");
+            }
+        }
+        foreach (string required in expectation.RequiredFragments)
+        {
+            if (!combined.Contains(required, StringComparison.OrdinalIgnoreCase))
+            {
+                return new(false, $"MessageBox for {purpose} omitted required text '{required}'.");
+            }
+        }
+        bool hasAccept = labels.Any(IsAcceptButton);
+        bool hasCancel = labels.Any(IsCancelButton);
+        if (expectation.RequiresAccept && !hasAccept)
+        {
+            return new(false, $"MessageBox for {purpose} omitted an accept button.");
+        }
+        if (expectation.RequiresCancel && !hasCancel)
+        {
+            return new(false, $"MessageBox for {purpose} omitted a cancel button.");
+        }
+        if (string.Equals(purpose, "operation-failure", StringComparison.Ordinal)
+            && (hasCancel || labels.All(value => IsAcceptButton(value) || IsCancelButton(value))))
+        {
+            return new(false, "Operation-failure MessageBox must contain error text and only an acknowledgement action.");
+        }
+        return new(true, null);
+    }
+
+    private static bool IsAcceptButton(string value) =>
+        new[] { "确定", "OK", "是", "Yes" }.Contains(value.Trim('&'), StringComparer.OrdinalIgnoreCase);
+
+    private static bool IsCancelButton(string value) =>
+        new[] { "取消", "Cancel", "否", "No" }.Contains(value.Trim('&'), StringComparer.OrdinalIgnoreCase);
+
+    private sealed record DialogExpectation(
+        IReadOnlyList<string> RequiredFragments,
+        bool RequiresAccept,
+        bool RequiresCancel,
+        IReadOnlyList<string> ForbiddenFragments);
+}
+
+public sealed record PruneRemovalEvidence(IReadOnlyList<string> RemovedPaths);
+
+public static class PruneEvidenceContract
+{
+    public static PruneRemovalEvidence VerifyManagedRemoval(
+        IReadOnlyList<string> managedBefore,
+        IReadOnlyList<string> managedAfter,
+        string expectedNewest)
+    {
+        if (managedBefore.Count <= 1
+            || managedBefore.Distinct(StringComparer.Ordinal).Count() != managedBefore.Count)
+        {
+            throw new InvalidDataException("Prune evidence requires more than one distinct managed backup before apply.");
+        }
+        if (managedAfter.Count != 1
+            || !string.Equals(managedAfter[0], expectedNewest, StringComparison.Ordinal))
+        {
+            throw new InvalidDataException("Prune did not retain exactly the expected newest managed backup.");
+        }
+        string[] removed = managedBefore
+            .Where(path => !string.Equals(path, expectedNewest, StringComparison.Ordinal))
+            .ToArray();
+        if (removed.Length != managedBefore.Count - 1)
+        {
+            throw new InvalidDataException("Expected newest managed backup was absent or duplicated before prune.");
+        }
+        string[] stillPresent = removed.Where(Directory.Exists).ToArray();
+        if (stillPresent.Length > 0)
+        {
+            throw new InvalidDataException(
+                $"Prune removed metadata visibility but left managed backup directories on disk: {string.Join(",", stillPresent)}.");
+        }
+        return new PruneRemovalEvidence(removed);
+    }
+
+    public static async Task VerifySentinelAsync(
+        string sentinelPath,
+        string expectedSha256,
+        CancellationToken cancellationToken = default)
+    {
+        if (!File.Exists(sentinelPath))
+        {
+            throw new InvalidDataException($"Non-managed prune sentinel disappeared: {sentinelPath}.");
+        }
+        string actualSha256 = await Hashing.Sha256FileAsync(sentinelPath, cancellationToken);
+        if (!string.Equals(actualSha256, expectedSha256, StringComparison.Ordinal))
+        {
+            throw new InvalidDataException(
+                $"Non-managed prune sentinel content changed: expected {expectedSha256}, observed {actualSha256}.");
+        }
+    }
+}
+
+internal static class Hashing
+{
+    internal static async Task<string> Sha256FileAsync(string path, CancellationToken cancellationToken = default)
+    {
+        await using FileStream stream = new(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete);
+        byte[] digest = await SHA256.HashDataAsync(stream, cancellationToken);
+        return Convert.ToHexStringLower(digest);
+    }
+
+    internal static string Sha256Text(string text) =>
+        Convert.ToHexStringLower(SHA256.HashData(System.Text.Encoding.UTF8.GetBytes(text)));
+}
+
+internal sealed class EvidenceDocument
+{
+    public int SchemaVersion { get; init; } = 1;
+    public string RunId { get; init; } = Guid.NewGuid().ToString("N");
+    public DateTimeOffset StartedAtUtc { get; init; } = DateTimeOffset.UtcNow;
+    public DateTimeOffset? FinishedAtUtc { get; set; }
+    public bool Passed { get; set; }
+    public Dictionary<string, object?> Environment { get; } = [];
+    public Dictionary<string, object?> Executable { get; } = [];
+    public Dictionary<string, object?> Manifest { get; } = [];
+    public List<Dictionary<string, object?>> Controls { get; } = [];
+    public List<Dictionary<string, object?>> Scenarios { get; } = [];
+    public List<Dictionary<string, object?>> Dialogs { get; } = [];
+    public List<Dictionary<string, object?>> FileDiffs { get; } = [];
+    public List<JsonNode?> Trace { get; } = [];
+    public Dictionary<string, object?> Restart { get; } = [];
+    public List<string> Blockers { get; } = [];
+    public List<string> Errors { get; } = [];
+
+    public void Scenario(string id, string status, string evidence, params string[] entryIds) => Scenarios.Add(new()
+    {
+        ["id"] = id,
+        ["status"] = status,
+        ["evidence"] = evidence,
+        ["entryIds"] = entryIds
+    });
+}
diff --git a/desktop/CodexProviderSync.GuiE2E/IsolatedFixture.cs b/desktop/CodexProviderSync.GuiE2E/IsolatedFixture.cs
new file mode 100644
index 0000000..2a7985d
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E/IsolatedFixture.cs
@@ -0,0 +1,262 @@
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using Microsoft.Data.Sqlite;
+
+namespace CodexProviderSync.GuiE2E;
+
+internal sealed record AutomationLaunchDescriptor(
+    int SchemaVersion,
+    string IsolationRoot,
+    string PipeName,
+    string Token);
+
+internal sealed record FixtureSnapshot(
+    string ConfigSha256,
+    string RolloutSha256,
+    string DatabaseStorageSha256,
+    IReadOnlyList<DatabaseFileEvidence> DatabaseFiles,
+    string ConfigProvider,
+    string RolloutProvider,
+    string DatabaseProvider,
+    string? DatabaseModel,
+    int ManagedBackupCount);
+
+internal sealed record DatabaseFileEvidence(string Name, long Length, string Sha256);
+
+internal sealed class IsolatedFixture
+{
+    internal const string SentinelFileName = ".codex-provider-sync-test-root";
+    internal const string SentinelContent = "codex-provider-sync isolated GUI automation root v1";
+
+    internal IsolatedFixture(string root)
+    {
+        Root = Path.TrimEndingDirectorySeparator(Path.GetFullPath(root));
+        CodexHome = Path.Combine(Root, "codex-home");
+        SqliteHome = Path.Combine(Root, "sqlite-home");
+        RolloutPath = Path.Combine(CodexHome, "sessions", "2026", "08", "04", "rollout-e2e.jsonl");
+        DatabasePath = Path.Combine(SqliteHome, "state_5.sqlite");
+        ConfigPath = Path.Combine(CodexHome, "config.toml");
+        TracePath = Path.Combine(Root, "automation", "gui-trace.jsonl");
+        SettingsPath = Path.Combine(Root, "appdata", "settings.json");
+        PickerCodexHome = Path.Combine(Root, "picker-probes", "codex-home-alternate");
+        PickerSqliteHome = Path.Combine(Root, "picker-probes", "sqlite-home-alternate");
+    }
+
+    internal string Root { get; }
+    internal string CodexHome { get; }
+    internal string SqliteHome { get; }
+    internal string RolloutPath { get; }
+    internal string DatabasePath { get; }
+    internal string ConfigPath { get; }
+    internal string TracePath { get; }
+    internal string SettingsPath { get; }
+    internal string PickerCodexHome { get; }
+    internal string PickerSqliteHome { get; }
+
+    internal IReadOnlyList<string> ManagedBackups()
+    {
+        string root = Path.Combine(CodexHome, "backups_state", "provider-sync");
+        return Directory.Exists(root)
+            ? Directory.EnumerateDirectories(root)
+                .Where(IsManagedBackup)
+                .Order(StringComparer.Ordinal)
+                .ToArray()
+            : [];
+    }
+
+    internal async Task InitializeAsync(CancellationToken cancellationToken)
+    {
+        if (Directory.Exists(Root) && Directory.EnumerateFileSystemEntries(Root).Any())
+        {
+            throw new InvalidOperationException("GUI E2E isolation root must be new and empty.");
+        }
+        Directory.CreateDirectory(Root);
+        if ((File.GetAttributes(Root) & FileAttributes.ReparsePoint) != 0)
+        {
+            throw new InvalidOperationException("GUI E2E isolation root cannot be a reparse point.");
+        }
+        await File.WriteAllTextAsync(
+            Path.Combine(Root, SentinelFileName),
+            SentinelContent + Environment.NewLine,
+            new UTF8Encoding(false),
+            cancellationToken);
+        Directory.CreateDirectory(CodexHome);
+        Directory.CreateDirectory(SqliteHome);
+        Directory.CreateDirectory(Path.GetDirectoryName(RolloutPath)!);
+
+        string config = """
+            model_provider = "openai"
+            model = "gpt-e2e-root"
+
+            [model_providers.apigather]
+            name = "Isolated E2E Provider"
+            base_url = "http://127.0.0.1:9/v1"
+            model = "gpt-e2e-target"
+            """ + Environment.NewLine;
+        await File.WriteAllTextAsync(ConfigPath, config, new UTF8Encoding(false), cancellationToken);
+
+        string rollout = JsonSerializer.Serialize(new
+        {
+            timestamp = "2026-08-04T00:00:00.000Z",
+            type = "session_meta",
+            payload = new
+            {
+                id = "gui-e2e-thread",
+                model_provider = "legacy-e2e",
+                cwd = Path.Combine(Root, "workspace")
+            }
+        }) + Environment.NewLine + JsonSerializer.Serialize(new
+        {
+            timestamp = "2026-08-04T00:00:01.000Z",
+            type = "event_msg",
+            payload = new { type = "user_message", message = "isolated GUI E2E fixture" }
+        }) + Environment.NewLine;
+        await File.WriteAllTextAsync(RolloutPath, rollout, new UTF8Encoding(false), cancellationToken);
+
+        await using SqliteConnection connection = new(SqliteConnectionString(DatabasePath, SqliteOpenMode.ReadWriteCreate));
+        await connection.OpenAsync(cancellationToken);
+        await using SqliteCommand command = connection.CreateCommand();
+        command.CommandText = """
+            PRAGMA journal_mode=WAL;
+            PRAGMA synchronous=FULL;
+            CREATE TABLE threads (
+              id TEXT PRIMARY KEY,
+              model_provider TEXT,
+              cwd TEXT NOT NULL DEFAULT '',
+              archived INTEGER NOT NULL DEFAULT 0,
+              first_user_message TEXT NOT NULL DEFAULT '',
+              model TEXT
+            );
+            INSERT INTO threads (id, model_provider, cwd, archived, first_user_message, model)
+            VALUES ('gui-e2e-thread', 'legacy-e2e', $cwd, 0, 'isolated GUI E2E fixture', 'gpt-e2e-old');
+            PRAGMA wal_checkpoint(TRUNCATE);
+            """;
+        command.Parameters.AddWithValue("$cwd", Path.Combine(Root, "workspace"));
+        await command.ExecuteNonQueryAsync(cancellationToken);
+
+        string alternateConfig = Path.Combine(PickerCodexHome, "config.toml");
+        string alternateRollout = Path.Combine(
+            PickerCodexHome, "sessions", "2026", "08", "04", "rollout-picker-e2e.jsonl");
+        Directory.CreateDirectory(Path.GetDirectoryName(alternateRollout)!);
+        Directory.CreateDirectory(PickerSqliteHome);
+        await File.WriteAllTextAsync(alternateConfig, config, new UTF8Encoding(false), cancellationToken);
+        await File.WriteAllTextAsync(alternateRollout, rollout, new UTF8Encoding(false), cancellationToken);
+        await using SqliteConnection alternate = new(
+            SqliteConnectionString(Path.Combine(PickerSqliteHome, "state_5.sqlite"), SqliteOpenMode.ReadWriteCreate));
+        await alternate.OpenAsync(cancellationToken);
+        connection.BackupDatabase(alternate);
+    }
+
+    internal AutomationLaunchDescriptor CreateDescriptor(int generation)
+    {
+        string pipe = $"CodexProviderSync.Automation.{Guid.NewGuid():N}";
+        string token = Convert.ToHexStringLower(RandomNumberGenerator.GetBytes(32));
+        AutomationLaunchDescriptor descriptor = new(1, Root, pipe, token);
+        string path = DescriptorPath(generation);
+        File.WriteAllText(
+            path,
+            JsonSerializer.Serialize(descriptor, new JsonSerializerOptions(JsonSerializerDefaults.Web)),
+            new UTF8Encoding(false));
+        return descriptor;
+    }
+
+    internal string DescriptorPath(int generation) => Path.Combine(Root, $"gui-automation-{generation:D2}.json");
+
+    internal async Task<FixtureSnapshot> SnapshotAsync(CancellationToken cancellationToken)
+    {
+        string config = await File.ReadAllTextAsync(ConfigPath, cancellationToken);
+        string rollout = await File.ReadAllTextAsync(RolloutPath, cancellationToken);
+        string databaseProvider;
+        string? databaseModel;
+        await using (SqliteConnection connection = new(SqliteConnectionString(DatabasePath, SqliteOpenMode.ReadOnly)))
+        {
+            await connection.OpenAsync(cancellationToken);
+            await using SqliteCommand command = connection.CreateCommand();
+            command.CommandText = "SELECT model_provider, model FROM threads WHERE id = 'gui-e2e-thread'";
+            await using SqliteDataReader reader = await command.ExecuteReaderAsync(cancellationToken);
+            if (!await reader.ReadAsync(cancellationToken))
+            {
+                throw new InvalidDataException("Isolated fixture thread is missing from SQLite.");
+            }
+            databaseProvider = reader.GetString(0);
+            databaseModel = reader.IsDBNull(1) ? null : reader.GetString(1);
+        }
+
+        List<DatabaseFileEvidence> databaseFiles = [];
+        foreach (string path in new[] { DatabasePath, DatabasePath + "-wal", DatabasePath + "-shm" })
+        {
+            if (File.Exists(path))
+            {
+                FileInfo info = new(path);
+                databaseFiles.Add(new(
+                    Path.GetFileName(path),
+                    info.Length,
+                    await Hashing.Sha256FileAsync(path, cancellationToken)));
+            }
+        }
+        string databaseStorageDigest = Hashing.Sha256Text(string.Join(
+            "\n",
+            databaseFiles.Select(file => $"{file.Name}|{file.Length}|{file.Sha256}")));
+
+        string rolloutProvider = ReadRolloutProvider(rollout);
+        string configProvider = ReadConfigProvider(config);
+        int backups = ManagedBackups().Count;
+        return new(
+            Hashing.Sha256Text(config),
+            Hashing.Sha256Text(rollout),
+            databaseStorageDigest,
+            databaseFiles,
+            configProvider,
+            rolloutProvider,
+            databaseProvider,
+            databaseModel,
+            backups);
+    }
+
+    private static string ReadConfigProvider(string config)
+    {
+        string line = config.Split('\n')
+            .First(value => value.TrimStart().StartsWith("model_provider", StringComparison.Ordinal));
+        return line[(line.IndexOf('=') + 1)..].Trim().Trim('"');
+    }
+
+    private static string ReadRolloutProvider(string rollout)
+    {
+        using JsonDocument document = JsonDocument.Parse(rollout.Split('\n', StringSplitOptions.RemoveEmptyEntries)[0]);
+        JsonElement payload = document.RootElement.GetProperty("payload");
+        if (payload.TryGetProperty("model_provider", out JsonElement snake))
+        {
+            return snake.GetString()!;
+        }
+        return payload.GetProperty("modelProvider").GetString()!;
+    }
+
+    private static bool IsManagedBackup(string directory)
+    {
+        string metadataPath = Path.Combine(directory, "metadata.json");
+        if (!File.Exists(metadataPath))
+        {
+            return false;
+        }
+        try
+        {
+            using JsonDocument metadata = JsonDocument.Parse(File.ReadAllText(metadataPath));
+            return metadata.RootElement.TryGetProperty("namespace", out JsonElement backupNamespace)
+                && string.Equals(backupNamespace.GetString(), "provider-sync", StringComparison.Ordinal);
+        }
+        catch (JsonException)
+        {
+            return false;
+        }
+    }
+
+    private static string SqliteConnectionString(string path, SqliteOpenMode mode) =>
+        new SqliteConnectionStringBuilder
+        {
+            DataSource = path,
+            Mode = mode,
+            Cache = SqliteCacheMode.Private,
+            Pooling = false
+        }.ToString();
+}
diff --git a/desktop/CodexProviderSync.GuiE2E/NativeWindows.cs b/desktop/CodexProviderSync.GuiE2E/NativeWindows.cs
new file mode 100644
index 0000000..a14b958
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E/NativeWindows.cs
@@ -0,0 +1,404 @@
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Drawing.Imaging;
+
+namespace CodexProviderSync.GuiE2E;
+
+internal sealed record DesktopProbe(bool Passed, string Message, uint ActiveSessionId, int ProcessSessionId, string? DesktopName);
+internal sealed record NativeDialogObservation(
+    nint Handle,
+    string ClassName,
+    string Title,
+    IReadOnlyList<string> Text,
+    DateTimeOffset ObservedAtUtc);
+
+internal static class NativeWindows
+{
+    private const uint DesktopReadObjects = 0x0001;
+    private const uint DesktopSwitchDesktop = 0x0100;
+    private const int UoiName = 2;
+    private const uint Th32csSnapProcess = 0x00000002;
+    private const uint BmClick = 0x00F5;
+    private const uint WmSetText = 0x000C;
+    private static readonly nint InvalidHandleValue = new(-1);
+
+    internal static DesktopProbe ProbeInteractiveDesktop()
+    {
+        uint active = WTSGetActiveConsoleSessionId();
+        int processSession = Process.GetCurrentProcess().SessionId;
+        if (!Environment.UserInteractive)
+        {
+            return new(false, "Environment.UserInteractive is false.", active, processSession, null);
+        }
+        if (active == uint.MaxValue || active != (uint)processSession)
+        {
+            return new(false, $"Process session {processSession} is not active console session {active}.", active, processSession, null);
+        }
+
+        nint desktop = OpenInputDesktop(0, false, DesktopReadObjects | DesktopSwitchDesktop);
+        if (desktop == 0)
+        {
+            return new(false, $"OpenInputDesktop failed with Win32 error {Marshal.GetLastWin32Error()}.", active, processSession, null);
+        }
+        try
+        {
+            uint needed;
+            _ = GetUserObjectInformation(desktop, UoiName, null, 0, out needed);
+            StringBuilder name = new((int)Math.Max(needed / 2, 16));
+            if (!GetUserObjectInformation(desktop, UoiName, name, (uint)(name.Capacity * 2), out _))
+            {
+                return new(false, $"Unable to identify input desktop: {Marshal.GetLastWin32Error()}.", active, processSession, null);
+            }
+            return new(true, "Interactive process is attached to the active input desktop.", active, processSession, name.ToString());
+        }
+        finally
+        {
+            _ = CloseDesktop(desktop);
+        }
+    }
+
+    internal static async Task<nint> WaitForVisibleMainWindowAsync(
+        Process process,
+        TimeSpan timeout,
+        CancellationToken cancellationToken)
+    {
+        DateTimeOffset deadline = DateTimeOffset.UtcNow + timeout;
+        while (DateTimeOffset.UtcNow < deadline)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            process.Refresh();
+            nint handle = process.MainWindowHandle;
+            if (handle != 0 && IsWindowVisible(handle))
+            {
+                return handle;
+            }
+            if (process.HasExited)
+            {
+                throw new InvalidOperationException($"Published GUI exited before showing a window (exit {process.ExitCode}).");
+            }
+            await Task.Delay(100, cancellationToken);
+        }
+        throw new TimeoutException("Published GUI did not expose a visible main window on the active desktop.");
+    }
+
+    internal static async Task<NativeDialogObservation?> WaitForDialogAsync(
+        int processId,
+        nint mainWindow,
+        TimeSpan timeout,
+        CancellationToken cancellationToken,
+        nint excludedWindow = default)
+    {
+        DateTimeOffset deadline = DateTimeOffset.UtcNow + timeout;
+        while (DateTimeOffset.UtcNow < deadline)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            foreach (nint window in TopLevelWindows(processId))
+            {
+                if (window != mainWindow && window != excludedWindow && IsWindowVisible(window))
+                {
+                    return ObserveDialog(window);
+                }
+            }
+            await Task.Delay(50, cancellationToken);
+        }
+        return null;
+    }
+
+    internal static NativeDialogObservation ObserveDialog(nint handle) => new(
+        handle,
+        GetClass(handle),
+        GetText(handle),
+        ChildWindows(handle).Select(GetText).Where(static value => !string.IsNullOrWhiteSpace(value)).Distinct().ToArray(),
+        DateTimeOffset.UtcNow);
+
+    internal static void CaptureWindow(nint window, string outputPath)
+    {
+        if (!GetWindowRect(window, out Rect bounds))
+        {
+            throw new InvalidOperationException($"GetWindowRect failed with Win32 error {Marshal.GetLastWin32Error()}.");
+        }
+        int width = bounds.Right - bounds.Left;
+        int height = bounds.Bottom - bounds.Top;
+        if (width < 1 || height < 1)
+        {
+            throw new InvalidOperationException("Cannot capture an empty native dialog rectangle.");
+        }
+        Directory.CreateDirectory(Path.GetDirectoryName(outputPath)!);
+        using Bitmap bitmap = new(width, height, PixelFormat.Format32bppArgb);
+        using Graphics graphics = Graphics.FromImage(bitmap);
+        nint device = graphics.GetHdc();
+        bool printed;
+        try
+        {
+            printed = PrintWindow(window, device, 2);
+        }
+        finally
+        {
+            graphics.ReleaseHdc(device);
+        }
+        if (!printed)
+        {
+            _ = SetForegroundWindow(window);
+            Thread.Sleep(50);
+            graphics.CopyFromScreen(
+                bounds.Left,
+                bounds.Top,
+                0,
+                0,
+                new Size(width, height),
+                CopyPixelOperation.SourceCopy);
+        }
+        bitmap.Save(outputPath, ImageFormat.Png);
+    }
+
+    internal static void ClickDialogButton(nint dialog, int controlId)
+    {
+        nint button = GetDlgItem(dialog, controlId);
+        if (button == 0)
+        {
+            string[] preferred = controlId == 2
+                ? ["取消", "Cancel", "否", "No"]
+                : ["确定", "OK", "是", "Yes"];
+            button = ChildWindows(dialog).FirstOrDefault(child =>
+                preferred.Any(text => string.Equals(GetText(child).Trim('&'), text, StringComparison.OrdinalIgnoreCase)));
+        }
+        if (button != 0)
+        {
+            _ = SendMessage(button, BmClick, 0, 0);
+            return;
+        }
+
+        _ = SetForegroundWindow(dialog);
+        Thread.Sleep(50);
+        System.Windows.Forms.SendKeys.SendWait(controlId == 2 ? "{ESC}" : "{ENTER}");
+    }
+
+    internal static bool TryEnterFolderAndAccept(nint dialog, string isolatedPath)
+    {
+        foreach (nint child in Descendants(dialog))
+        {
+            string className = GetClass(child);
+            if (className.Equals("Edit", StringComparison.OrdinalIgnoreCase))
+            {
+                _ = SendMessageString(child, WmSetText, 0, isolatedPath);
+                nint ok = GetDlgItem(dialog, 1);
+                if (ok != 0)
+                {
+                    _ = SendMessage(ok, BmClick, 0, 0);
+                    return true;
+                }
+            }
+        }
+
+        if (!SetForegroundWindow(dialog))
+        {
+            return false;
+        }
+        try
+        {
+            System.Windows.Forms.SendKeys.SendWait("^l");
+            Thread.Sleep(100);
+            System.Windows.Forms.SendKeys.SendWait(EscapeSendKeys(isolatedPath));
+            System.Windows.Forms.SendKeys.SendWait("{ENTER}");
+            Thread.Sleep(250);
+            nint accept = GetDlgItem(dialog, 1);
+            if (accept != 0)
+            {
+                _ = SendMessage(accept, BmClick, 0, 0);
+            }
+            else
+            {
+                System.Windows.Forms.SendKeys.SendWait("{ENTER}");
+            }
+            return true;
+        }
+        catch (InvalidOperationException)
+        {
+            return false;
+        }
+    }
+
+    private static string EscapeSendKeys(string value)
+    {
+        StringBuilder escaped = new(value.Length * 2);
+        foreach (char character in value)
+        {
+            if (character is '+' or '^' or '%' or '~' or '(' or ')' or '[' or ']' or '{' or '}')
+            {
+                escaped.Append('{').Append(character).Append('}');
+            }
+            else
+            {
+                escaped.Append(character);
+            }
+        }
+        return escaped.ToString();
+    }
+
+    internal static IReadOnlySet<int> DescendantProcessIds(int parentProcessId)
+    {
+        List<(int Pid, int Parent)> rows = [];
+        nint snapshot = CreateToolhelp32Snapshot(Th32csSnapProcess, 0);
+        if (snapshot == InvalidHandleValue)
+        {
+            throw new InvalidOperationException($"CreateToolhelp32Snapshot failed: {Marshal.GetLastWin32Error()}.");
+        }
+        try
+        {
+            ProcessEntry32 entry = new() { Size = (uint)Marshal.SizeOf<ProcessEntry32>() };
+            if (Process32First(snapshot, ref entry))
+            {
+                do
+                {
+                    rows.Add(((int)entry.ProcessId, (int)entry.ParentProcessId));
+                    entry.Size = (uint)Marshal.SizeOf<ProcessEntry32>();
+                }
+                while (Process32Next(snapshot, ref entry));
+            }
+        }
+        finally
+        {
+            _ = CloseHandle(snapshot);
+        }
+
+        HashSet<int> descendants = [];
+        bool changed;
+        do
+        {
+            changed = false;
+            foreach ((int pid, int parent) in rows)
+            {
+                if ((parent == parentProcessId || descendants.Contains(parent)) && descendants.Add(pid))
+                {
+                    changed = true;
+                }
+            }
+        }
+        while (changed);
+        return descendants;
+    }
+
+    private static IReadOnlyList<nint> TopLevelWindows(int processId)
+    {
+        List<nint> result = [];
+        _ = EnumWindows((window, state) =>
+        {
+            _ = GetWindowThreadProcessId(window, out uint owner);
+            if (owner == processId)
+            {
+                result.Add(window);
+            }
+            return true;
+        }, 0);
+        return result;
+    }
+
+    private static IReadOnlyList<nint> ChildWindows(nint parent)
+    {
+        List<nint> result = [];
+        _ = EnumChildWindows(parent, (window, state) =>
+        {
+            result.Add(window);
+            return true;
+        }, 0);
+        return result;
+    }
+
+    private static IEnumerable<nint> Descendants(nint parent) => ChildWindows(parent);
+
+    private static string GetText(nint window)
+    {
+        int length = GetWindowTextLength(window);
+        StringBuilder text = new(Math.Max(length + 1, 2));
+        _ = GetWindowText(window, text, text.Capacity);
+        return text.ToString();
+    }
+
+    private static string GetClass(nint window)
+    {
+        StringBuilder name = new(256);
+        _ = GetClassName(window, name, name.Capacity);
+        return name.ToString();
+    }
+
+    private delegate bool EnumWindowsProc(nint window, nint state);
+
+    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+    private struct ProcessEntry32
+    {
+        public uint Size;
+        public uint Usage;
+        public uint ProcessId;
+        public nint DefaultHeapId;
+        public uint ModuleId;
+        public uint Threads;
+        public uint ParentProcessId;
+        public int BasePriority;
+        public uint Flags;
+        [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)] public string ExeFile;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct Rect
+    {
+        public int Left;
+        public int Top;
+        public int Right;
+        public int Bottom;
+    }
+
+    [DllImport("kernel32.dll")]
+    private static extern uint WTSGetActiveConsoleSessionId();
+    [DllImport("user32.dll", SetLastError = true)]
+    private static extern nint OpenInputDesktop(uint flags, [MarshalAs(UnmanagedType.Bool)] bool inherit, uint desiredAccess);
+    [DllImport("user32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool CloseDesktop(nint desktop);
+    [DllImport("user32.dll", EntryPoint = "GetUserObjectInformationW", SetLastError = true, CharSet = CharSet.Unicode)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool GetUserObjectInformation(nint handle, int index, StringBuilder? info, uint length, out uint needed);
+    [DllImport("user32.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool IsWindowVisible(nint window);
+    [DllImport("user32.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool SetForegroundWindow(nint window);
+    [DllImport("user32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool GetWindowRect(nint window, out Rect rectangle);
+    [DllImport("user32.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool PrintWindow(nint window, nint deviceContext, uint flags);
+    [DllImport("user32.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool EnumWindows(EnumWindowsProc callback, nint state);
+    [DllImport("user32.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool EnumChildWindows(nint parent, EnumWindowsProc callback, nint state);
+    [DllImport("user32.dll")]
+    private static extern uint GetWindowThreadProcessId(nint window, out uint processId);
+    [DllImport("user32.dll", EntryPoint = "GetWindowTextLengthW")]
+    private static extern int GetWindowTextLength(nint window);
+    [DllImport("user32.dll", EntryPoint = "GetWindowTextW", CharSet = CharSet.Unicode)]
+    private static extern int GetWindowText(nint window, StringBuilder text, int maximum);
+    [DllImport("user32.dll", EntryPoint = "GetClassNameW", CharSet = CharSet.Unicode)]
+    private static extern int GetClassName(nint window, StringBuilder name, int maximum);
+    [DllImport("user32.dll")]
+    private static extern nint GetDlgItem(nint dialog, int controlId);
+    [DllImport("user32.dll", EntryPoint = "SendMessageW")]
+    private static extern nint SendMessage(nint window, uint message, nint wParam, nint lParam);
+    [DllImport("user32.dll", EntryPoint = "SendMessageW", CharSet = CharSet.Unicode)]
+    private static extern nint SendMessageString(nint window, uint message, nint wParam, string lParam);
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern nint CreateToolhelp32Snapshot(uint flags, uint processId);
+    [DllImport("kernel32.dll", EntryPoint = "Process32FirstW", SetLastError = true, CharSet = CharSet.Unicode)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool Process32First(nint snapshot, ref ProcessEntry32 entry);
+    [DllImport("kernel32.dll", EntryPoint = "Process32NextW", SetLastError = true, CharSet = CharSet.Unicode)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool Process32Next(nint snapshot, ref ProcessEntry32 entry);
+    [DllImport("kernel32.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool CloseHandle(nint handle);
+}
diff --git a/desktop/CodexProviderSync.GuiE2E/Program.cs b/desktop/CodexProviderSync.GuiE2E/Program.cs
new file mode 100644
index 0000000..8d2f490
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E/Program.cs
@@ -0,0 +1,336 @@
+using System.Diagnostics;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+namespace CodexProviderSync.GuiE2E;
+
+internal sealed record GuiE2EOptions(
+    string ExePath,
+    string ManifestPath,
+    string ScenarioAssetPath,
+    string EvidencePath,
+    string IsolationRoot,
+    TimeSpan Timeout)
+{
+    internal static GuiE2EOptions Parse(string[] args)
+    {
+        Dictionary<string, string> values = new(StringComparer.Ordinal);
+        for (int index = 0; index < args.Length; index += 2)
+        {
+            if (index + 1 >= args.Length || !args[index].StartsWith("--", StringComparison.Ordinal))
+            {
+                throw new ArgumentException("GUI E2E options must be supplied as --name value pairs.");
+            }
+            values.Add(args[index], args[index + 1]);
+        }
+        string Required(string name) => values.TryGetValue(name, out string? value) && !string.IsNullOrWhiteSpace(value)
+            ? Path.GetFullPath(value)
+            : throw new ArgumentException($"Missing required option {name}.");
+        int timeoutSeconds = values.TryGetValue("--timeout-seconds", out string? timeoutValue)
+            ? int.Parse(timeoutValue, System.Globalization.CultureInfo.InvariantCulture)
+            : 90;
+        if (timeoutSeconds is < 15 or > 600)
+        {
+            throw new ArgumentOutOfRangeException(nameof(args), "--timeout-seconds must be between 15 and 600.");
+        }
+        return new(
+            Required("--exe"),
+            Required("--manifest"),
+            Required("--scenarios"),
+            Required("--evidence"),
+            Required("--root"),
+            TimeSpan.FromSeconds(timeoutSeconds));
+    }
+}
+
+internal static class Program
+{
+    [STAThread]
+    private static async Task<int> Main(string[] args)
+    {
+        EvidenceDocument evidence = new();
+        GuiE2EOptions? options = null;
+        ScenarioRunner? runner = null;
+        CancellationTokenSource? runWatchdog = null;
+        string? token = null;
+        try
+        {
+            options = GuiE2EOptions.Parse(args);
+            ValidateInputs(options);
+            TimeSpan wholeRunTimeout = GuiE2EWatchdog.WholeRunTimeout(options.Timeout);
+            runWatchdog = new CancellationTokenSource(wholeRunTimeout);
+            CancellationToken runToken = runWatchdog.Token;
+            DesktopProbe desktop = NativeWindows.ProbeInteractiveDesktop();
+            evidence.Environment["operatingSystem"] = Environment.OSVersion.VersionString;
+            evidence.Environment["userInteractive"] = Environment.UserInteractive;
+            evidence.Environment["activeConsoleSessionId"] = desktop.ActiveSessionId;
+            evidence.Environment["processSessionId"] = desktop.ProcessSessionId;
+            evidence.Environment["inputDesktop"] = desktop.DesktopName;
+            evidence.Environment["desktopProbe"] = desktop.Message;
+            evidence.Environment["requestTimeoutSeconds"] = options.Timeout.TotalSeconds;
+            evidence.Environment["wholeRunTimeoutSeconds"] = wholeRunTimeout.TotalSeconds;
+            if (!desktop.Passed)
+            {
+                throw new InvalidOperationException(
+                    "Headful Windows GUI E2E requires the active interactive desktop; this is a FAIL, never a skip. "
+                    + desktop.Message);
+            }
+
+            IsolatedFixture fixture = new(options.IsolationRoot);
+            await fixture.InitializeAsync(runToken);
+            IReadOnlyDictionary<string, string?> sourceEnvironment = Environment.GetEnvironmentVariables()
+                .Cast<System.Collections.DictionaryEntry>()
+                .ToDictionary(entry => (string)entry.Key, entry => entry.Value?.ToString(), StringComparer.OrdinalIgnoreCase);
+            Dictionary<string, string?> childEnvironment = IsolationEnvironment.Build(fixture.Root, sourceEnvironment);
+            foreach (string name in new[] { "HOME", "USERPROFILE", "CODEX_HOME", "CODEX_SQLITE_HOME", "APPDATA", "LOCALAPPDATA", "TEMP", "TMP" })
+            {
+                if (!IsolationEnvironment.IsContained(fixture.Root, childEnvironment[name]!))
+                {
+                    throw new InvalidOperationException($"Sanitized child environment escaped the isolation root: {name}.");
+                }
+            }
+            evidence.Environment["isolationRoot"] = fixture.Root;
+            evidence.Environment["sanitizedDirectories"] = childEnvironment
+                .Where(pair => new[] { "HOME", "USERPROFILE", "CODEX_HOME", "CODEX_SQLITE_HOME", "APPDATA", "LOCALAPPDATA", "TEMP", "TMP" }
+                    .Contains(pair.Key, StringComparer.OrdinalIgnoreCase))
+                .ToDictionary(pair => pair.Key, pair => pair.Value);
+
+            evidence.Executable["path"] = options.ExePath;
+            evidence.Executable["sha256"] = await Hashing.Sha256FileAsync(options.ExePath, runToken);
+            evidence.Executable["releasePublished"] = true;
+
+            string manifestJson = await File.ReadAllTextAsync(options.ManifestPath, runToken);
+            string scenarioJson = await File.ReadAllTextAsync(options.ScenarioAssetPath, runToken);
+            evidence.Manifest["path"] = options.ManifestPath;
+            evidence.Manifest["sha256"] = Hashing.Sha256Text(manifestJson);
+            evidence.Manifest["scenarioAssetSha256"] = Hashing.Sha256Text(scenarioJson);
+
+            FixtureSnapshot before = await fixture.SnapshotAsync(runToken);
+            runner = new ScenarioRunner(options, fixture, evidence, childEnvironment, manifestJson, scenarioJson);
+            token = await runner.RunAsync(before, runToken);
+
+            evidence.Passed = evidence.Errors.Count == 0
+                && evidence.Blockers.Count == 0
+                && evidence.Scenarios.All(item => string.Equals(item["status"] as string, "passed", StringComparison.Ordinal));
+            evidence.FinishedAtUtc = DateTimeOffset.UtcNow;
+            await WriteEvidenceAsync(options.EvidencePath, evidence, token);
+            Console.WriteLine($"GUI_E2E_EVIDENCE={options.EvidencePath}");
+            Console.WriteLine($"GUI_E2E_RESULT={(evidence.Passed ? "PASS" : "FAIL")}");
+            return evidence.Passed ? 0 : 1;
+        }
+        catch (Exception error)
+        {
+            evidence.Errors.Add(error.ToString());
+            if (runWatchdog?.IsCancellationRequested == true)
+            {
+                evidence.Blockers.Add("The whole-run GUI E2E watchdog expired before the harness completed.");
+            }
+            if (options is not null)
+            {
+                try
+                {
+                    using CancellationTokenSource cleanup = new(
+                        GuiE2EWatchdog.FailureFinalizationTimeout(options.Timeout));
+                    if (runner is null && File.Exists(options.ManifestPath) && File.Exists(options.ScenarioAssetPath))
+                    {
+                        string manifestJson = await File.ReadAllTextAsync(options.ManifestPath, cleanup.Token);
+                        string scenarioJson = await File.ReadAllTextAsync(options.ScenarioAssetPath, cleanup.Token);
+                        IsolatedFixture fixture = new(options.IsolationRoot);
+                        IReadOnlyDictionary<string, string?> sourceEnvironment = Environment.GetEnvironmentVariables()
+                            .Cast<System.Collections.DictionaryEntry>()
+                            .ToDictionary(
+                                entry => (string)entry.Key,
+                                entry => entry.Value?.ToString(),
+                                StringComparer.OrdinalIgnoreCase);
+                        runner = new ScenarioRunner(
+                            options,
+                            fixture,
+                            evidence,
+                            IsolationEnvironment.Build(fixture.Root, sourceEnvironment),
+                            manifestJson,
+                            scenarioJson);
+                    }
+                    if (runner is not null)
+                    {
+                        await runner.FinalizeFailureEvidenceAsync(cleanup.Token);
+                    }
+                }
+                catch (Exception finalizationError)
+                {
+                    evidence.Errors.Add($"Failure evidence finalization also failed: {finalizationError}");
+                }
+            }
+            evidence.Passed = false;
+            evidence.FinishedAtUtc = DateTimeOffset.UtcNow;
+            if (options is not null)
+            {
+                try
+                {
+                    await WriteEvidenceAsync(options.EvidencePath, evidence, token);
+                    Console.Error.WriteLine($"GUI_E2E_EVIDENCE={options.EvidencePath}");
+                }
+                catch (Exception evidenceError)
+                {
+                    Console.Error.WriteLine($"Unable to write GUI E2E evidence: {evidenceError.Message}");
+                }
+            }
+            Console.Error.WriteLine(error);
+            Console.Error.WriteLine("GUI_E2E_RESULT=FAIL");
+            return 1;
+        }
+        finally
+        {
+            runWatchdog?.Dispose();
+        }
+    }
+
+    private static void ValidateInputs(GuiE2EOptions options)
+    {
+        if (!OperatingSystem.IsWindows())
+        {
+            throw new PlatformNotSupportedException("Real WinForms E2E can only run on Windows.");
+        }
+        if (!File.Exists(options.ExePath)
+            || !string.Equals(Path.GetFileName(options.ExePath), "CodexProviderSync.exe", StringComparison.OrdinalIgnoreCase))
+        {
+            throw new FileNotFoundException("A published CodexProviderSync.exe is required.", options.ExePath);
+        }
+        if (!File.Exists(options.ManifestPath) || !File.Exists(options.ScenarioAssetPath))
+        {
+            throw new FileNotFoundException("Published manifest and scenario asset are required.");
+        }
+        if (Directory.Exists(options.IsolationRoot) && Directory.EnumerateFileSystemEntries(options.IsolationRoot).Any())
+        {
+            throw new InvalidOperationException("Isolation root must be new and empty.");
+        }
+        string evidenceDirectory = Path.GetDirectoryName(options.EvidencePath)
+            ?? throw new InvalidOperationException("Evidence path must have a parent directory.");
+        Directory.CreateDirectory(evidenceDirectory);
+    }
+
+    private static async Task WriteEvidenceAsync(string path, EvidenceDocument evidence, string? token)
+    {
+        string directory = Path.GetDirectoryName(path)
+            ?? throw new InvalidOperationException("Evidence path must have a parent directory.");
+        Directory.CreateDirectory(directory);
+        JsonSerializerOptions options = new(JsonSerializerDefaults.Web) { WriteIndented = true };
+        string json = JsonSerializer.Serialize(evidence, options);
+        string redacted = EvidenceRedactor.Redact(json, token is null ? [] : [token]);
+        await File.WriteAllTextAsync(path, redacted, new UTF8Encoding(false));
+    }
+}
+
+internal static class GuiE2EWatchdog
+{
+    internal static TimeSpan WholeRunTimeout(TimeSpan requestTimeout)
+    {
+        if (requestTimeout <= TimeSpan.Zero)
+        {
+            throw new ArgumentOutOfRangeException(nameof(requestTimeout));
+        }
+        return TimeSpan.FromSeconds(Math.Clamp(requestTimeout.TotalSeconds * 6, 240, 2700));
+    }
+
+    internal static TimeSpan FailureFinalizationTimeout(TimeSpan requestTimeout)
+    {
+        if (requestTimeout <= TimeSpan.Zero)
+        {
+            throw new ArgumentOutOfRangeException(nameof(requestTimeout));
+        }
+        return TimeSpan.FromSeconds(Math.Clamp(requestTimeout.TotalSeconds, 5, 30));
+    }
+}
+
+internal sealed class AppSession : IAsyncDisposable
+{
+    private AppSession(Process process, GuiBridgeClient bridge, nint mainWindow, string token)
+    {
+        Process = process;
+        Bridge = bridge;
+        MainWindow = mainWindow;
+        Token = token;
+    }
+
+    internal Process Process { get; }
+    internal GuiBridgeClient Bridge { get; }
+    internal nint MainWindow { get; }
+    internal string Token { get; }
+
+    internal static async Task<AppSession> StartAsync(
+        GuiE2EOptions options,
+        IsolatedFixture fixture,
+        IReadOnlyDictionary<string, string?> environment,
+        int generation,
+        CancellationToken cancellationToken)
+    {
+        AutomationLaunchDescriptor descriptor = fixture.CreateDescriptor(generation);
+        ProcessStartInfo startInfo = new()
+        {
+            FileName = options.ExePath,
+            UseShellExecute = false,
+            CreateNoWindow = false,
+            WorkingDirectory = Path.GetDirectoryName(options.ExePath)!
+        };
+        startInfo.ArgumentList.Add("--gui-automation-descriptor");
+        startInfo.ArgumentList.Add(fixture.DescriptorPath(generation));
+        startInfo.Environment.Clear();
+        foreach ((string name, string? value) in environment)
+        {
+            if (value is not null)
+            {
+                startInfo.Environment[name] = value;
+            }
+        }
+        Process process = Process.Start(startInfo)
+            ?? throw new InvalidOperationException("Unable to launch the published GUI executable.");
+        try
+        {
+            Task<nint> windowTask = NativeWindows.WaitForVisibleMainWindowAsync(process, options.Timeout, cancellationToken);
+            Task<GuiBridgeClient> bridgeTask = GuiBridgeClient.ConnectAsync(
+                descriptor.PipeName,
+                descriptor.Token,
+                options.Timeout,
+                cancellationToken);
+            await Task.WhenAll(windowTask, bridgeTask);
+            GuiBridgeClient bridge = await bridgeTask;
+            nint window = await windowTask;
+            return new AppSession(process, bridge, window, descriptor.Token);
+        }
+        catch
+        {
+            if (!process.HasExited)
+            {
+                process.Kill(entireProcessTree: true);
+            }
+            process.Dispose();
+            throw;
+        }
+    }
+
+    internal async Task ShutdownAsync(CancellationToken cancellationToken)
+    {
+        if (!Process.HasExited)
+        {
+            BridgeResponse response = await Bridge.SendAsync("ui.shutdown", cancellationToken: cancellationToken);
+            if (!response.Ok)
+            {
+                throw new InvalidOperationException($"GUI shutdown was rejected: {response.ErrorMessage}");
+            }
+            using CancellationTokenSource timeout = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+            timeout.CancelAfter(TimeSpan.FromSeconds(15));
+            await Process.WaitForExitAsync(timeout.Token);
+        }
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        await Bridge.DisposeAsync();
+        if (!Process.HasExited)
+        {
+            Process.Kill(entireProcessTree: true);
+            await Process.WaitForExitAsync();
+        }
+        Process.Dispose();
+    }
+}
diff --git a/desktop/CodexProviderSync.GuiE2E/ScenarioRunner.Finalization.cs b/desktop/CodexProviderSync.GuiE2E/ScenarioRunner.Finalization.cs
new file mode 100644
index 0000000..3c2df26
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E/ScenarioRunner.Finalization.cs
@@ -0,0 +1,131 @@
+using System.Text.Json.Nodes;
+
+namespace CodexProviderSync.GuiE2E;
+
+internal sealed partial class ScenarioRunner
+{
+    private int _failureFinalizationStarted;
+
+    internal async Task FinalizeFailureEvidenceAsync(CancellationToken cancellationToken)
+    {
+        if (Interlocked.Exchange(ref _failureFinalizationStarted, 1) != 0)
+        {
+            return;
+        }
+
+        await CollectExistingTraceBestEffortAsync(cancellationToken);
+        MaterializeFailureCoverage();
+        _evidence.Manifest["failureEvidenceFinalized"] = true;
+    }
+
+    private async Task CollectExistingTraceBestEffortAsync(CancellationToken cancellationToken)
+    {
+        if (!File.Exists(_fixture.TracePath))
+        {
+            _evidence.Manifest["failureTracePresent"] = false;
+            _evidence.Manifest["failureTraceRecordCount"] = _evidence.Trace.Count;
+            return;
+        }
+
+        HashSet<string> recorded = _evidence.Trace
+            .Where(node => node is not null)
+            .Select(node => node!.ToJsonString())
+            .ToHashSet(StringComparer.Ordinal);
+        int malformedLines = 0;
+        string? collectionError = null;
+        try
+        {
+            foreach (string line in await File.ReadAllLinesAsync(_fixture.TracePath, cancellationToken))
+            {
+                if (string.IsNullOrWhiteSpace(line))
+                {
+                    continue;
+                }
+                try
+                {
+                    JsonNode trace = JsonNode.Parse(line)
+                        ?? throw new InvalidDataException("Trace record was JSON null.");
+                    if (recorded.Add(trace.ToJsonString()))
+                    {
+                        _evidence.Trace.Add(trace);
+                    }
+                }
+                catch (Exception error) when (error is not OperationCanceledException)
+                {
+                    malformedLines++;
+                }
+            }
+        }
+        catch (Exception error)
+        {
+            collectionError = error.Message;
+        }
+
+        _evidence.Manifest["failureTracePresent"] = true;
+        _evidence.Manifest["failureTraceRecordCount"] = _evidence.Trace.Count;
+        _evidence.Manifest["failureTraceMalformedLineCount"] = malformedLines;
+        if (collectionError is not null)
+        {
+            _evidence.Manifest["failureTraceCollectionError"] = collectionError;
+        }
+    }
+
+    private void MaterializeFailureCoverage()
+    {
+        foreach ((string id, ScenarioState state) in _scenarios.Where(pair => pair.Value.Status == "not-run").ToArray())
+        {
+            _scenarios[id] = new ScenarioState(
+                "blocked",
+                "The real-GUI run aborted before this required scenario produced PASS evidence.");
+        }
+
+        string[] passed = _scenarios
+            .Where(pair => pair.Value.Status == "passed")
+            .Select(pair => pair.Key)
+            .ToArray();
+        (IReadOnlyList<string> manifestEntries, IReadOnlyList<string> manifestScenarios) =
+            ManifestCoverageGate.ReadRequirements(_manifestJson);
+        ManifestCoverageResult entryCoverage = ManifestCoverageGate.Evaluate(
+            _manifestJson,
+            _coveredEntries,
+            manifestScenarios);
+        string[] missingRequiredScenarios = _scenarios.Keys
+            .Except(passed, StringComparer.Ordinal)
+            .Order(StringComparer.Ordinal)
+            .ToArray();
+        bool coveragePassed = entryCoverage.MissingEntryIds.Count == 0
+            && missingRequiredScenarios.Length == 0;
+
+        _evidence.Manifest["declaredEntryCount"] = manifestEntries.Count;
+        _evidence.Manifest["coveredEntryCount"] = manifestEntries.Count - entryCoverage.MissingEntryIds.Count;
+        _evidence.Manifest["requiredHeadfulScenarioCount"] = _scenarios.Count;
+        _evidence.Manifest["passedRequiredHeadfulScenarioCount"] = passed.Length;
+        _evidence.Manifest["nonGatingManifestScenarioCount"] = _nonGatingScenarioIds.Count;
+        _evidence.Manifest["nonGatingManifestScenarioIds"] = _nonGatingScenarioIds
+            .Order(StringComparer.Ordinal)
+            .ToArray();
+        _evidence.Manifest["coveragePassed"] = coveragePassed;
+        _evidence.Manifest["missingEntryIds"] = entryCoverage.MissingEntryIds;
+        _evidence.Manifest["missingRequiredHeadfulScenarioIds"] = missingRequiredScenarios;
+
+        _evidence.Scenarios.RemoveAll(item =>
+            item.TryGetValue("id", out object? id)
+            && id is string scenarioId
+            && _scenarios.ContainsKey(scenarioId));
+        foreach ((string id, ScenarioState state) in _scenarios.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+        {
+            _evidence.Scenario(id, state.Status, state.Evidence, _scenarioEntries[id]);
+        }
+
+        if (!coveragePassed)
+        {
+            string blocker =
+                $"Headful gate failed: {entryCoverage.MissingEntryIds.Count} manifest entries and "
+                + $"{missingRequiredScenarios.Length} required scenarios lack PASS evidence.";
+            if (!_evidence.Blockers.Contains(blocker, StringComparer.Ordinal))
+            {
+                _evidence.Blockers.Add(blocker);
+            }
+        }
+    }
+}
diff --git a/desktop/CodexProviderSync.GuiE2E/ScenarioRunner.cs b/desktop/CodexProviderSync.GuiE2E/ScenarioRunner.cs
new file mode 100644
index 0000000..318b2cc
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E/ScenarioRunner.cs
@@ -0,0 +1,1672 @@
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Text;
+
+namespace CodexProviderSync.GuiE2E;
+
+internal sealed partial class ScenarioRunner
+{
+    internal static IReadOnlySet<string> SupportedEvidenceReferences { get; } = new HashSet<string>(StringComparer.Ordinal)
+    {
+        "application-trace",
+        "before-after-file-diff",
+        "bridge-control-event",
+        "isolated-failure-path",
+        "isolated-platform-boundary",
+        "native-folder-dialog",
+        "native-message-box",
+        "no-external-child-process",
+        "no-network-or-external-process",
+        "published-exe-sha256",
+        "real-enabled-state",
+        "real-window-lifecycle",
+        "rendered-log-output",
+        "rendered-status",
+        "restart-persistence",
+        "stable-dynamic-id",
+        "visible-main-window",
+        "visible-real-control-text"
+    };
+    private readonly GuiE2EOptions _options;
+    private readonly IsolatedFixture _fixture;
+    private readonly EvidenceDocument _evidence;
+    private readonly IReadOnlyDictionary<string, string?> _environment;
+    private readonly string _manifestJson;
+    private readonly string _scenarioJson;
+    private readonly HashSet<string> _coveredEntries = new(StringComparer.Ordinal);
+    private readonly Dictionary<string, VerifiedApplicationLink> _linkedRequests = new(StringComparer.Ordinal);
+    private readonly Dictionary<string, ScenarioState> _scenarios = new(StringComparer.Ordinal);
+    private readonly Dictionary<string, string[]> _scenarioEntries = new(StringComparer.Ordinal);
+    private readonly HashSet<string> _nonGatingScenarioIds = new(StringComparer.Ordinal);
+    private bool _coverageFinalized;
+    private AppSession? _session;
+
+    internal ScenarioRunner(
+        GuiE2EOptions options,
+        IsolatedFixture fixture,
+        EvidenceDocument evidence,
+        IReadOnlyDictionary<string, string?> environment,
+        string manifestJson,
+        string scenarioJson)
+    {
+        _options = options;
+        _fixture = fixture;
+        _evidence = evidence;
+        _environment = environment;
+        _manifestJson = manifestJson;
+        _scenarioJson = scenarioJson;
+        LoadScenarioContract();
+    }
+
+    internal async Task<string> RunAsync(FixtureSnapshot before, CancellationToken cancellationToken)
+    {
+        string lastToken = string.Empty;
+        try
+        {
+            _session = await AppSession.StartAsync(
+                _options,
+                _fixture,
+                _environment,
+                generation: 1,
+                cancellationToken);
+            lastToken = _session.Token;
+            _evidence.Executable["pid"] = _session.Process.Id;
+            _evidence.Executable["mainWindow"] = $"0x{_session.MainWindow:X}";
+            _evidence.Executable["visibleMainWindow"] = true;
+            Pass("gui.launch", "Published Release EXE exposed a visible top-level window on the active desktop.");
+
+            await VerifyManifestAndControlsAsync(cancellationToken);
+            await ExerciseStatusAsync(cancellationToken);
+            await ExerciseNativePickersAsync(cancellationToken);
+            string? targetRow = await ExerciseProvidersAsync(cancellationToken);
+            await ExerciseInputsAsync(cancellationToken);
+
+            FixtureSnapshot afterSync = before;
+            if (targetRow is not null)
+            {
+                afterSync = await ExerciseSyncAndSwitchAsync(targetRow, before, cancellationToken);
+            }
+            await ExerciseRestoreEntryAsync(cancellationToken);
+            await ExercisePruneAndShellAsync(cancellationToken);
+            await PreparePersistenceAsync(cancellationToken);
+
+            await _session.ShutdownAsync(cancellationToken);
+            Pass("gui.shutdown", "ui.shutdown closed the real published WinForms process.");
+            await _session.DisposeAsync();
+            _session = null;
+
+            _session = await AppSession.StartAsync(
+                _options,
+                _fixture,
+                _environment,
+                generation: 2,
+                cancellationToken);
+            lastToken = _session.Token;
+            await VerifyRestartPersistenceAsync(cancellationToken);
+            await _session.ShutdownAsync(cancellationToken);
+            await _session.DisposeAsync();
+            _session = null;
+
+            await CollectAndValidateTraceAsync(cancellationToken);
+            FixtureSnapshot final = await _fixture.SnapshotAsync(cancellationToken);
+            _evidence.FileDiffs.Add(Diff("initial-to-final", before, final));
+            _evidence.FileDiffs.Add(Diff("post-sync-to-final", afterSync, final));
+            FinalizeCoverage();
+            return lastToken;
+        }
+        finally
+        {
+            if (_session is not null)
+            {
+                await _session.DisposeAsync();
+                _session = null;
+            }
+        }
+    }
+
+    private GuiBridgeClient Bridge => _session?.Bridge
+        ?? throw new InvalidOperationException("GUI session is not running.");
+
+    private async Task VerifyManifestAndControlsAsync(CancellationToken cancellationToken)
+    {
+        BridgeResponse describe = await RequireResponseAsync("ui.describe", null, false, cancellationToken);
+        JsonNode expected = JsonNode.Parse(_manifestJson)!;
+        if (!JsonNode.DeepEquals(expected, describe.Result))
+        {
+            throw new InvalidDataException("Embedded ui.describe manifest differs from the published manifest file.");
+        }
+        _evidence.Manifest["embeddedMatchesPublished"] = true;
+
+        BridgeResponse snapshot = await RequireResponseAsync("ui.snapshot", null, false, cancellationToken);
+        JsonArray runtimeControls = snapshot.Result?["controls"]?.AsArray()
+            ?? throw new InvalidDataException("ui.snapshot did not return controls.");
+        HashSet<string> runtimeIds = runtimeControls
+            .Select(node => node?["automationId"]?.GetValue<string>() ?? string.Empty)
+            .ToHashSet(StringComparer.Ordinal);
+
+        using JsonDocument manifest = JsonDocument.Parse(_manifestJson);
+        List<string> staticIds =
+        [
+            manifest.RootElement.GetProperty("window").GetProperty("id").GetString()!
+        ];
+        staticIds.AddRange(manifest.RootElement.GetProperty("controls").EnumerateArray()
+            .Select(entry => entry.GetProperty("id").GetString()!));
+        if (!runtimeIds.SetEquals(staticIds))
+        {
+            throw new InvalidDataException(
+                $"Runtime/manifest control mismatch. Missing [{string.Join(",", staticIds.Except(runtimeIds))}], "
+                + $"extra [{string.Join(",", runtimeIds.Except(staticIds))}].");
+        }
+
+        foreach (string id in staticIds)
+        {
+            BridgeResponse response = await RequireResponseAsync(
+                "ui.get",
+                new JsonObject { ["automationId"] = id },
+                false,
+                cancellationToken);
+            JsonObject value = response.Result?.AsObject()
+                ?? throw new InvalidDataException($"ui.get {id} returned no control description.");
+            _coveredEntries.Add(id);
+            _evidence.Controls.Add(new()
+            {
+                ["automationId"] = id,
+                ["requestId"] = response.Id,
+                ["method"] = "ui.get",
+                ["controlType"] = value["controlType"]?.GetValue<string>(),
+                ["enabled"] = value["enabled"]?.GetValue<bool?>(),
+                ["visible"] = value["visible"]?.GetValue<bool?>(),
+                ["value"] = value["value"]?.DeepClone()
+            });
+        }
+
+        PassMany("Real registered controls were read through the named-pipe bridge.",
+            "gui.status.explicit-codex-home",
+            "gui.status.explicit-sqlite-home",
+            "gui.status.rendered-result",
+            "gui.provider.manual-input",
+            "gui.sync.mode",
+            "gui.switch.mode",
+            "gui.restore.include-config",
+            "gui.restore.include-database",
+            "gui.restore.include-sessions",
+            "gui.backup.retention",
+            "gui.operation.ready-state",
+            "gui.logs.rendered-output",
+            "gui.warning.close-codex",
+            "gui.warning.close-app-server");
+    }
+
+    private async Task ExerciseStatusAsync(CancellationToken cancellationToken)
+    {
+        BridgeResponse focus = await RequireResponseAsync(
+            "ui.invoke",
+            new JsonObject { ["automationId"] = "window.main" },
+            false,
+            cancellationToken);
+        RecordControl("window.main", "ui.invoke", focus);
+        Pass("gui.focus-existing-instance", "window.main invocation raised the real activation path.");
+
+        BridgeResponse refresh = await RequireResponseAsync(
+            "ui.invoke",
+            new JsonObject { ["automationId"] = "status.refresh" },
+            true,
+            cancellationToken);
+        RecordControl("status.refresh", "ui.invoke", refresh);
+        Pass("gui.status.refresh", "Refresh Click completed through the shared Application status operation.");
+        JsonNode? status = (await Bridge.GetAsync("status.output", cancellationToken))?["value"];
+        if (status is null || !status.GetValue<string>().Contains("openai", StringComparison.OrdinalIgnoreCase))
+        {
+            throw new InvalidDataException("Rendered GUI status did not contain isolated fixture provider openai.");
+        }
+        await ExerciseExpectedStatusFailureAsync(cancellationToken);
+    }
+
+    private async Task ExerciseExpectedStatusFailureAsync(CancellationToken cancellationToken)
+    {
+        FixtureSnapshot before = await _fixture.SnapshotAsync(cancellationToken);
+        FileStream configLock = new(
+            _fixture.ConfigPath,
+            FileMode.Open,
+            FileAccess.ReadWrite,
+            FileShare.None,
+            bufferSize: 4096,
+            FileOptions.Asynchronous);
+        try
+        {
+            Task<BridgeResponse> pending = Bridge.SendAsync(
+                "ui.invoke",
+                new JsonObject { ["automationId"] = "status.refresh" },
+                cancellationToken);
+            NativeDialogObservation? dialog = await NativeWindows.WaitForDialogAsync(
+                _session!.Process.Id,
+                _session.MainWindow,
+                TimeSpan.FromSeconds(5),
+                cancellationToken);
+            if (dialog is null)
+            {
+                BridgeResponse response = await pending;
+                RecordControl("status.refresh", "ui.invoke", response);
+                throw new InvalidDataException(
+                    "An exclusive lock on isolated config.toml did not show a real status failure MessageBox.");
+            }
+            RequirePendingModal(pending, "status failure MessageBox");
+            DialogContractResult contract = DialogContractVerifier.Verify(
+                "operation-failure", dialog.ClassName, dialog.Title, dialog.Text);
+            if (!contract.Passed)
+            {
+                await RejectUnexpectedDialogAsync(
+                    pending,
+                    "status.refresh",
+                    "operation-failure",
+                    dialog,
+                    contract.Error ?? "Unknown status failure dialog contract failure.",
+                    cancellationToken);
+            }
+            string screenshotPath = Path.Combine(
+                _fixture.Root,
+                "automation",
+                "screenshots",
+                $"{DateTimeOffset.UtcNow:yyyyMMddTHHmmssfffZ}-status-config-lock-failure.png");
+            NativeWindows.CaptureWindow(dialog.Handle, screenshotPath);
+            string screenshotSha256 = await Hashing.Sha256FileAsync(screenshotPath, cancellationToken);
+            RecordDialog(
+                "dialog.operationFailure",
+                "status-refresh-config-lock",
+                dialog,
+                "acknowledge",
+                screenshotPath,
+                screenshotSha256);
+            NativeWindows.ClickDialogButton(dialog.Handle, 1);
+            BridgeResponse completed = await pending;
+            RecordControl("status.refresh", "ui.invoke", completed);
+            if (!completed.Ok)
+            {
+                throw new InvalidDataException(
+                    $"Status failure GUI event returned a bridge failure [{completed.ErrorCode}]: {completed.ErrorMessage}");
+            }
+            RequireApplicationLink(
+                completed,
+                "status.refresh",
+                "Status",
+                "Failed",
+                "operation_failed");
+            _coveredEntries.Add("dialog.operationFailure");
+            Pass("gui.status.refresh-failure",
+                "An exclusive lock on isolated config.toml produced a real failure MessageBox and Failed/operation_failed Application trace; the external driver captured and acknowledged it.");
+        }
+        finally
+        {
+            await configLock.DisposeAsync();
+        }
+
+        FixtureSnapshot restored = await _fixture.SnapshotAsync(cancellationToken);
+        if (!SameFixtureState(before, restored))
+        {
+            throw new InvalidDataException("Status failure injection did not restore the isolated fixture exactly.");
+        }
+        BridgeResponse recovery = await RequireResponseAsync(
+            "ui.invoke",
+            new JsonObject { ["automationId"] = "status.refresh" },
+            true,
+            cancellationToken);
+        RecordControl("status.refresh", "ui.invoke", recovery);
+    }
+
+    private async Task<string?> ExerciseProvidersAsync(CancellationToken cancellationToken)
+    {
+        JsonArray rows = (await Bridge.GetAsync("provider.list", cancellationToken))?["value"]?.AsArray()
+            ?? throw new InvalidDataException("Provider list did not expose dynamic rows.");
+        JsonNode? target = rows.FirstOrDefault(node =>
+            string.Equals(node?["text"]?.GetValue<string>(), "apigather", StringComparison.OrdinalIgnoreCase));
+        if (target is null)
+        {
+            BlockMany("Isolated config provider apigather was not rendered as a real provider row.",
+                "gui.provider.select", "gui.provider.dynamic-row-identity", "gui.provider.dynamic-row-selection");
+            return null;
+        }
+        string rowId = target["automationId"]!.GetValue<string>();
+        BridgeResponse get = await RequireResponseAsync(
+            "ui.get", new JsonObject { ["automationId"] = rowId }, false, cancellationToken);
+        BridgeResponse select = await RequireResponseAsync(
+            "ui.set", new JsonObject { ["automationId"] = rowId, ["value"] = true }, false, cancellationToken);
+        RecordControl(rowId, "ui.get", get);
+        RecordControl(rowId, "ui.set", select);
+        _coveredEntries.Add("provider.row");
+        PassMany("Stable dynamic provider row was read and selected through the real ListView event.",
+            "gui.provider.select", "gui.provider.selection-state", "gui.provider.dynamic-row-identity", "gui.provider.dynamic-row-selection");
+
+        string originalRecentId = "storage.codexHome.recent:"
+            + StableInstanceKey(_fixture.CodexHome.ToUpperInvariant());
+        string alternateRecentId = "storage.codexHome.recent:"
+            + StableInstanceKey(_fixture.PickerCodexHome.ToUpperInvariant());
+        BridgeResponse originalRecent = await RequireResponseAsync(
+            "ui.get", new JsonObject { ["automationId"] = originalRecentId }, false, cancellationToken);
+        BridgeResponse alternateRecent = await RequireResponseAsync(
+            "ui.get", new JsonObject { ["automationId"] = alternateRecentId }, false, cancellationToken);
+        RecordControl(originalRecentId, "ui.get", originalRecent);
+        RecordControl(alternateRecentId, "ui.get", alternateRecent);
+
+        BridgeResponse selectAlternate = await RequireResponseAsync(
+            "ui.set", new JsonObject { ["automationId"] = alternateRecentId, ["value"] = true }, false, cancellationToken);
+        RecordControl(alternateRecentId, "ui.set", selectAlternate);
+        await RequireStorageControlValueAsync("storage.codexHome", _fixture.PickerCodexHome, cancellationToken);
+
+        BridgeResponse selectOriginal = await RequireResponseAsync(
+            "ui.set", new JsonObject { ["automationId"] = originalRecentId, ["value"] = true }, false, cancellationToken);
+        RecordControl(originalRecentId, "ui.set", selectOriginal);
+        await RequireStorageControlValueAsync("storage.codexHome", _fixture.CodexHome, cancellationToken);
+        BridgeResponse recentRefresh = await RequireResponseAsync(
+            "ui.invoke",
+            new JsonObject { ["automationId"] = "status.refresh" },
+            true,
+            cancellationToken);
+        RecordControl("status.refresh", "ui.invoke", recentRefresh);
+        await RequireStoragePickerResultAsync("storage.codexHome", _fixture.CodexHome, cancellationToken);
+
+        _coveredEntries.Add("storage.codexHome.recent");
+        PassMany(
+            "Stable alternate and original recent-home rows were read and selected in sequence; both real ComboBox events fired and final refreshed storage state returned to the original isolated home.",
+            "gui.settings.recent-home-identity", "gui.settings.recent-home-selection");
+
+        await SetChangedAsync("provider.manualId", "validation-probe", cancellationToken);
+        await SetChangedAsync("provider.manualId", string.Empty, cancellationToken);
+        NativeDialogObservation? validation = await InvokeWithDialogAsync(
+            "provider.addManual", 1, "validation", cancellationToken);
+        if (validation is not null)
+        {
+            _coveredEntries.Add("dialog.validation");
+            Pass("gui.provider.add-manual-validation", "Real MessageBox validation was observed and acknowledged externally.");
+        }
+
+        await SetChangedAsync("provider.manualId", "manual-e2e", cancellationToken);
+        BridgeResponse add = await RequireResponseAsync(
+            "ui.invoke", new JsonObject { ["automationId"] = "provider.addManual" }, false, cancellationToken);
+        RecordControl("provider.addManual", "ui.invoke", add);
+        string manualRow = await WaitForDynamicRowAsync("manual-e2e", cancellationToken);
+        Pass("gui.provider.add-manual", "Manual provider was added by the real button/event/settings path.");
+        BridgeResponse selectManual = await RequireResponseAsync(
+            "ui.set", new JsonObject { ["automationId"] = manualRow, ["value"] = true }, false, cancellationToken);
+        RecordControl(manualRow, "ui.set", selectManual);
+        BridgeResponse remove = await RequireResponseAsync(
+            "ui.invoke", new JsonObject { ["automationId"] = "provider.removeManual" }, false, cancellationToken);
+        RecordControl("provider.removeManual", "ui.invoke", remove);
+        await WaitForDynamicRowMissingAsync(manualRow, cancellationToken);
+        Pass("gui.provider.remove-manual", "A real dynamic manual row was selected and removed through the real button/settings path.");
+        return rowId;
+    }
+
+    private async Task ExerciseInputsAsync(CancellationToken cancellationToken)
+    {
+        await SetChangedAsync("execution.updateConfig", true, cancellationToken);
+        await SetChangedAsync("execution.model.keepCurrent", true, cancellationToken);
+        await SetChangedAsync("execution.model.custom", true, cancellationToken);
+        await SetChangedAsync("execution.customModel", "gpt-e2e-custom", cancellationToken);
+        await SetChangedAsync("execution.model.followProvider", true, cancellationToken);
+        await SetChangedAsync("execution.updateConfig", false, cancellationToken);
+        await SetChangedAsync("restore.includeConfig", false, cancellationToken);
+        await SetChangedAsync("restore.includeConfig", true, cancellationToken);
+        await SetChangedAsync("restore.includeDatabase", false, cancellationToken);
+        await SetChangedAsync("restore.includeDatabase", true, cancellationToken);
+        await SetChangedAsync("restore.includeSessions", false, cancellationToken);
+        await SetChangedAsync("restore.includeSessions", true, cancellationToken);
+        await SetChangedAsync("backup.retentionCount", 7, cancellationToken);
+        PassMany("Real CheckedChanged/TextChanged/ValueChanged events exercised operation inputs.",
+            "gui.switch.model-follow-provider",
+            "gui.switch.model-keep-current",
+            "gui.switch.model-custom-mode",
+            "gui.switch.model-custom-value",
+            "gui.restore.include-config",
+            "gui.restore.include-database",
+            "gui.restore.include-sessions",
+            "gui.backup.retention");
+    }
+
+    private async Task ExerciseNativePickersAsync(CancellationToken cancellationToken)
+    {
+        await ProbeFolderPickerRoundTripAsync(
+            "storage.codexHome.browse",
+            "storage.codexHome",
+            "dialog.storage.codexHomePicker",
+            "gui.status.browse-codex-home",
+            _fixture.PickerCodexHome,
+            _fixture.CodexHome,
+            cancellationToken);
+        await ProbeFolderPickerRoundTripAsync(
+            "storage.sqliteHome.browse",
+            "storage.sqliteHome",
+            "dialog.storage.sqliteHomePicker",
+            "gui.status.browse-sqlite-home",
+            _fixture.PickerSqliteHome,
+            _fixture.SqliteHome,
+            cancellationToken);
+    }
+
+    private async Task<FixtureSnapshot> ExerciseSyncAndSwitchAsync(
+        string targetRow,
+        FixtureSnapshot before,
+        CancellationToken cancellationToken)
+    {
+        await RequireResponseAsync(
+            "ui.set", new JsonObject { ["automationId"] = targetRow, ["value"] = true }, false, cancellationToken);
+        await SetChangedAsync("execution.updateConfig", false, cancellationToken);
+
+        NativeDialogObservation? cancelled = await InvokeWithDialogAsync(
+            "operation.execute", 2, "sync-cancel", cancellationToken);
+        if (cancelled is null)
+        {
+            BlockMany("Sync confirmation MessageBox was not externally observable.",
+                "gui.sync.confirm-close-codex", "gui.sync.execute", "gui.switch.execute");
+            return before;
+        }
+        _coveredEntries.Add("dialog.confirmation");
+        Pass("gui.sync.confirm-close-codex", "Real close-Codex confirmation was observed; Cancel left fixture files unchanged.");
+        FixtureSnapshot afterCancel = await _fixture.SnapshotAsync(cancellationToken);
+        if (!SameFixtureState(before, afterCancel))
+        {
+            throw new InvalidDataException("Cancelling the real sync confirmation changed isolated fixture files.");
+        }
+
+        BridgeResponse? sync = await InvokeWithDialogResponseAsync(
+            "operation.execute", 1, "sync-apply", cancellationToken);
+        if (sync is null)
+        {
+            Block("gui.sync.execute", "Sync apply confirmation could not be driven externally.");
+            return before;
+        }
+        RequireApplicationLink(sync, "operation.execute", "Sync");
+        FixtureSnapshot afterSync = await _fixture.SnapshotAsync(cancellationToken);
+        _evidence.FileDiffs.Add(Diff("sync", before, afterSync));
+        if (afterSync.ConfigProvider != "openai"
+            || afterSync.RolloutProvider != "apigather"
+            || afterSync.DatabaseProvider != "apigather"
+            || afterSync.ManagedBackupCount < 1)
+        {
+            throw new InvalidDataException("Real GUI sync did not produce the expected isolated rollout/SQLite/backup diff.");
+        }
+        Pass("gui.sync.execute", "Real Execute Click synced rollout and SQLite, preserved config, and created a backup.");
+
+        await RequireResponseAsync(
+            "ui.set", new JsonObject { ["automationId"] = targetRow, ["value"] = true }, false, cancellationToken);
+        await SetChangedAsync("execution.updateConfig", true, cancellationToken);
+        await SetChangedAsync("execution.model.followProvider", true, cancellationToken);
+        BridgeResponse? switched = await InvokeWithDialogResponseAsync(
+            "operation.execute", 1, "switch-apply", cancellationToken);
+        if (switched is not null)
+        {
+            RequireApplicationLink(switched, "operation.execute", "Switch");
+            FixtureSnapshot afterSwitch = await _fixture.SnapshotAsync(cancellationToken);
+            _evidence.FileDiffs.Add(Diff("switch", afterSync, afterSwitch));
+            if (afterSwitch.ConfigProvider != "apigather")
+            {
+                throw new InvalidDataException("Real GUI switch did not update isolated config.toml.");
+            }
+            Pass("gui.switch.execute", "Real Execute Click switched config and synchronized isolated metadata.");
+            return afterSwitch;
+        }
+        Block("gui.switch.execute", "Switch confirmation could not be driven externally.");
+        return afterSync;
+    }
+
+    private async Task ExerciseRestoreEntryAsync(CancellationToken cancellationToken)
+    {
+        string? backup = _fixture.ManagedBackups().FirstOrDefault();
+        if (backup is null)
+        {
+            BlockMany("No managed backup was produced by the preceding real GUI sync/switch operations.",
+                "gui.restore.select-backup", "gui.restore.execute", "gui.restore.cancel");
+            return;
+        }
+
+        FixtureSnapshot beforeCancel = await _fixture.SnapshotAsync(cancellationToken);
+        BridgeResponse? cancelled = await DriveRestoreAsync(backup, acceptConfirmation: false, cancellationToken);
+        if (cancelled is null)
+        {
+            string blocker = "Restore picker/confirmation could not be driven through the real native modal chain.";
+            _evidence.Blockers.Add(blocker);
+            BlockMany(blocker,
+                "gui.restore.select-backup", "gui.restore.execute", "gui.restore.cancel",
+                "gui.restore.confirm-targets", "gui.restore.confirm-close-codex");
+            throw new InvalidOperationException(blocker);
+        }
+        FixtureSnapshot afterCancel = await _fixture.SnapshotAsync(cancellationToken);
+        if (!SameFixtureState(beforeCancel, afterCancel))
+        {
+            throw new InvalidDataException("Cancelling real restore confirmation changed isolated files.");
+        }
+        PassMany("Real restore picker selected an isolated backup and real confirmation Cancel preserved all files.",
+            "gui.restore.select-backup", "gui.restore.cancel", "gui.restore.confirm-targets");
+
+        BridgeResponse? applied = await DriveRestoreAsync(backup, acceptConfirmation: true, cancellationToken);
+        if (applied is null)
+        {
+            Block("gui.restore.execute", "Restore apply native modal chain failed.");
+            throw new InvalidOperationException(
+                _evidence.Blockers.LastOrDefault()
+                ?? "Restore apply failed through the real GUI modal/Application path.");
+        }
+        RequireApplicationLink(applied, "restore.execute", "Restore");
+        FixtureSnapshot afterRestore = await _fixture.SnapshotAsync(cancellationToken);
+        _evidence.FileDiffs.Add(Diff("restore", beforeCancel, afterRestore));
+        if (afterRestore.ConfigProvider != "openai"
+            || afterRestore.RolloutProvider != "legacy-e2e"
+            || afterRestore.DatabaseProvider != "legacy-e2e"
+            || afterRestore.DatabaseModel != "gpt-e2e-old")
+        {
+            throw new InvalidDataException("Real GUI restore did not restore the earliest isolated backup contents.");
+        }
+        PassMany("Real restore picker, confirmations, shared Application apply, and file diff restored the isolated backup.",
+            "gui.restore.execute", "gui.restore.confirm-close-codex");
+    }
+
+    private async Task<BridgeResponse?> DriveRestoreAsync(
+        string backup,
+        bool acceptConfirmation,
+        CancellationToken cancellationToken)
+    {
+        Task<BridgeResponse> pending = Bridge.SendAsync(
+            "ui.invoke",
+            new JsonObject { ["automationId"] = "restore.execute" },
+            cancellationToken);
+        NativeDialogObservation? picker = await NativeWindows.WaitForDialogAsync(
+            _session!.Process.Id, _session.MainWindow, TimeSpan.FromSeconds(5), cancellationToken);
+        if (picker is null)
+        {
+            BridgeResponse response = await pending;
+            RecordControl("restore.execute", "ui.invoke", response);
+            return null;
+        }
+        if (IsLocationUnavailable(picker))
+        {
+            RecordDialog("dialog.shell.locationUnavailable", "restore-picker-shell-error", picker, "acknowledge");
+            NativeWindows.ClickDialogButton(picker.Handle, 1);
+            NativeDialogObservation? underlying = await NativeWindows.WaitForDialogAsync(
+                _session.Process.Id, _session.MainWindow, TimeSpan.FromSeconds(2), cancellationToken);
+            if (underlying is not null)
+            {
+                NativeWindows.ClickDialogButton(underlying.Handle, 2);
+            }
+            _ = await pending;
+            _evidence.Blockers.Add("Windows shell reported Location unavailable inside the sanitized profile; restore picker evidence is invalid.");
+            return null;
+        }
+        RequirePendingModal(pending, "restore FolderBrowserDialog");
+        RecordDialog("dialog.restore.backupPicker", "restore-picker", picker, "accept");
+        _coveredEntries.Add("dialog.restore.backupPicker");
+        if (!NativeWindows.TryEnterFolderAndAccept(picker.Handle, backup))
+        {
+            NativeWindows.ClickDialogButton(picker.Handle, 2);
+            _ = await pending;
+            return null;
+        }
+
+        NativeDialogObservation? confirmation = await NativeWindows.WaitForDialogAsync(
+            _session.Process.Id, _session.MainWindow, TimeSpan.FromSeconds(5), cancellationToken);
+        if (confirmation is null)
+        {
+            _ = await pending;
+            return null;
+        }
+        RequirePendingModal(pending, "restore target confirmation MessageBox");
+        DialogContractResult targetContract = DialogContractVerifier.Verify(
+            "restore-targets", confirmation.ClassName, confirmation.Title, confirmation.Text);
+        if (!targetContract.Passed)
+        {
+            await RejectUnexpectedDialogAsync(
+                pending,
+                "restore.execute",
+                "restore-targets",
+                confirmation,
+                targetContract.Error ?? "Unknown restore-target dialog contract failure.",
+                cancellationToken);
+        }
+        RecordDialog("dialog.confirmation", "restore-targets", confirmation, acceptConfirmation ? "accept" : "cancel");
+        _coveredEntries.Add("dialog.confirmation");
+        NativeWindows.ClickDialogButton(confirmation.Handle, acceptConfirmation ? 1 : 2);
+        if (!acceptConfirmation)
+        {
+            BridgeResponse cancelled = await pending;
+            RecordControl("restore.execute", "ui.invoke", cancelled);
+            return cancelled.Ok ? cancelled : null;
+        }
+
+        NativeDialogObservation? closeCodex = await NativeWindows.WaitForDialogAsync(
+            _session.Process.Id, _session.MainWindow, TimeSpan.FromSeconds(5), cancellationToken);
+        if (closeCodex is null)
+        {
+            _ = await pending;
+            return null;
+        }
+        RequirePendingModal(pending, "restore close-Codex confirmation MessageBox");
+        DialogContractResult closeContract = DialogContractVerifier.Verify(
+            "restore-close-codex", closeCodex.ClassName, closeCodex.Title, closeCodex.Text);
+        if (!closeContract.Passed)
+        {
+            await RejectUnexpectedDialogAsync(
+                pending,
+                "restore.execute",
+                "restore-close-codex",
+                closeCodex,
+                closeContract.Error ?? "Unknown restore-close-Codex dialog contract failure.",
+                cancellationToken);
+        }
+        RecordDialog("dialog.confirmation", "restore-close-codex", closeCodex, "accept");
+        NativeWindows.ClickDialogButton(closeCodex.Handle, 1);
+        (BridgeResponse applied, bool failureDialog) = await AwaitAfterConfirmationAsync(
+            pending,
+            "restore.execute",
+            "restore-apply",
+            closeCodex.Handle,
+            cancellationToken);
+        return applied.Ok && !failureDialog ? applied : null;
+    }
+
+    private async Task ExercisePruneAndShellAsync(CancellationToken cancellationToken)
+    {
+        await SetChangedAsync("backup.retentionCount", 1, cancellationToken);
+        string backupRoot = Path.Combine(_fixture.CodexHome, "backups_state", "provider-sync");
+        string unmanagedDirectory = Path.Combine(backupRoot, "non-managed-e2e-sentinel");
+        string unmanagedSentinel = Path.Combine(unmanagedDirectory, "must-survive-prune.txt");
+        Directory.CreateDirectory(unmanagedDirectory);
+        await File.WriteAllTextAsync(
+            unmanagedSentinel,
+            "not a managed provider-sync backup" + Environment.NewLine,
+            cancellationToken);
+        string unmanagedSentinelSha256 = await Hashing.Sha256FileAsync(unmanagedSentinel, cancellationToken);
+        string[] managedBefore = _fixture.ManagedBackups().ToArray();
+        if (managedBefore.Length <= 1)
+        {
+            throw new InvalidDataException(
+                $"Prune E2E requires more than one managed backup, observed {managedBefore.Length}.");
+        }
+        string expectedNewest = managedBefore[^1];
+        FixtureSnapshot beforePrune = await _fixture.SnapshotAsync(cancellationToken);
+        NativeDialogObservation? pruneCancel = await InvokeWithDialogAsync(
+            "backups.prune", 2, "prune-cancel", cancellationToken);
+        if (pruneCancel is null)
+        {
+            throw new InvalidOperationException("Prune cancellation confirmation could not be driven externally.");
+        }
+        string[] managedAfterCancel = _fixture.ManagedBackups().ToArray();
+        FixtureSnapshot afterCancel = await _fixture.SnapshotAsync(cancellationToken);
+        await PruneEvidenceContract.VerifySentinelAsync(
+            unmanagedSentinel, unmanagedSentinelSha256, cancellationToken);
+        if (!managedBefore.SequenceEqual(managedAfterCancel, StringComparer.Ordinal)
+            || !SameFixtureState(beforePrune, afterCancel))
+        {
+            throw new InvalidDataException(
+                "Cancelling the real prune confirmation changed managed backups, fixture files, or the unmanaged sentinel.");
+        }
+        _coveredEntries.Add("dialog.confirmation");
+        PassMany("Real prune MessageBox was observed and Cancel preserved every managed backup and the non-managed sentinel.",
+            "gui.backup.prune-cancel", "gui.backup.prune-confirmation");
+
+        BridgeResponse? prune = await InvokeWithDialogResponseAsync(
+            "backups.prune", 1, "prune-apply", cancellationToken);
+        if (prune is null)
+        {
+            throw new InvalidOperationException("Prune apply confirmation could not be driven externally.");
+        }
+        RequireApplicationLink(prune, "backups.prune", "Prune");
+        FixtureSnapshot afterPrune = await _fixture.SnapshotAsync(cancellationToken);
+        string[] managedAfter = _fixture.ManagedBackups().ToArray();
+        PruneRemovalEvidence removal = PruneEvidenceContract.VerifyManagedRemoval(
+            managedBefore, managedAfter, expectedNewest);
+        await PruneEvidenceContract.VerifySentinelAsync(
+            unmanagedSentinel, unmanagedSentinelSha256, cancellationToken);
+        Dictionary<string, object?> pruneDiff = Diff("prune", beforePrune, afterPrune);
+        pruneDiff["managedBefore"] = managedBefore;
+        pruneDiff["managedAfter"] = managedAfter;
+        pruneDiff["expectedNewestRetained"] = expectedNewest;
+        pruneDiff["managedCountDecreased"] = managedAfter.Length < managedBefore.Length;
+        pruneDiff["removedManagedPaths"] = removal.RemovedPaths;
+        pruneDiff["removedManagedPathsAbsent"] = removal.RemovedPaths.All(path => !Directory.Exists(path));
+        pruneDiff["unmanagedSentinel"] = unmanagedSentinel;
+        pruneDiff["unmanagedSentinelSha256"] = unmanagedSentinelSha256;
+        pruneDiff["unmanagedSentinelPreserved"] = true;
+        _evidence.FileDiffs.Add(pruneDiff);
+
+        BridgeResponse logs = await RequireResponseAsync(
+            "ui.get", new JsonObject { ["automationId"] = "logs.output" }, false, cancellationToken);
+        BridgeResponse operation = await RequireResponseAsync(
+            "ui.get", new JsonObject { ["automationId"] = "state.operation" }, false, cancellationToken);
+        RecordControl("logs.output", "ui.get", logs);
+        RecordControl("state.operation", "ui.get", operation);
+        string logText = logs.Result?["value"]?.GetValue<string>() ?? string.Empty;
+        string operationText = operation.Result?["value"]?.GetValue<string>() ?? string.Empty;
+        if (!logText.Contains("旧备份清理完成", StringComparison.Ordinal)
+            || !string.Equals(operationText, "就绪", StringComparison.Ordinal))
+        {
+            throw new InvalidDataException(
+                "Prune storage state changed, but the rendered log/operation-ready state was inconsistent.");
+        }
+        Pass("gui.backup.prune",
+            "Real prune Click/confirmation/Application path reduced managed backups to one, retained the newest, preserved unmanaged data, and rendered ready/log state.");
+
+        IReadOnlySet<int> beforeChildren = NativeWindows.DescendantProcessIds(_session!.Process.Id);
+        BridgeResponse backupOpen = await RequireResponseAsync(
+            "ui.invoke", new JsonObject { ["automationId"] = "backups.openDirectory" }, false, cancellationToken);
+        BridgeResponse logOpen = await RequireResponseAsync(
+            "ui.invoke", new JsonObject { ["automationId"] = "logs.openDirectory" }, false, cancellationToken);
+        await Task.Delay(250, cancellationToken);
+        IReadOnlySet<int> afterChildren = NativeWindows.DescendantProcessIds(_session.Process.Id);
+        int[] launched = afterChildren.Except(beforeChildren).ToArray();
+        RecordControl("backups.openDirectory", "ui.invoke", backupOpen);
+        RecordControl("logs.openDirectory", "ui.invoke", logOpen);
+        if (launched.Length > 0)
+        {
+            throw new InvalidOperationException(
+                $"UI-only isolated shell buttons unexpectedly launched child processes: {string.Join(",", launched)}.");
+        }
+        PassMany("Real shell button Click events reached the isolated boundary without starting a child process.",
+            "gui.backup.open-directory", "gui.logs.open-directory");
+
+        IReadOnlySet<int> updateChildrenBefore = NativeWindows.DescendantProcessIds(_session.Process.Id);
+        BridgeResponse? update = await InvokeWithDialogResponseAsync(
+            "updates.check", 1, "update-no-update", cancellationToken);
+        IReadOnlySet<int> updateChildrenAfter = NativeWindows.DescendantProcessIds(_session.Process.Id);
+        if (update is not null && !updateChildrenAfter.Except(updateChildrenBefore).Any())
+        {
+            _coveredEntries.Add("dialog.update");
+            PassMany("Real update Click reached deterministic isolated no-update boundary, showed a real MessageBox, and launched no process.",
+                "gui.update.check", "gui.update.no-update");
+        }
+        else
+        {
+            BlockMany("Deterministic isolated update no-update MessageBox was not proven.",
+                "gui.update.check", "gui.update.no-update");
+        }
+    }
+
+    private async Task PreparePersistenceAsync(CancellationToken cancellationToken)
+    {
+        await SetChangedAsync("backup.retentionCount", 7, cancellationToken);
+        await SetChangedAsync("provider.manualId", "manual-persist-e2e", cancellationToken);
+        BridgeResponse add = await RequireResponseAsync(
+            "ui.invoke", new JsonObject { ["automationId"] = "provider.addManual" }, false, cancellationToken);
+        RecordControl("provider.addManual", "ui.invoke", add);
+        string rowId = await WaitForDynamicRowAsync("manual-persist-e2e", cancellationToken);
+        BridgeResponse select = await RequireResponseAsync(
+            "ui.set", new JsonObject { ["automationId"] = rowId, ["value"] = true }, false, cancellationToken);
+        RecordControl(rowId, "ui.set", select);
+        await Task.Delay(500, cancellationToken);
+    }
+
+    private async Task VerifyRestartPersistenceAsync(CancellationToken cancellationToken)
+    {
+        JsonNode retention = await Bridge.GetAsync("backup.retentionCount", cancellationToken)
+            ?? throw new InvalidDataException("Retention control missing after restart.");
+        decimal value = retention["value"]!.GetValue<decimal>();
+        string providerRow = await WaitForDynamicRowAsync("manual-persist-e2e", cancellationToken);
+        JsonNode providerState = await Bridge.GetAsync("state.selectedProvider", cancellationToken)
+            ?? throw new InvalidDataException("Selected-provider state missing after restart.");
+        JsonNode persistedRow = await Bridge.GetAsync(providerRow, cancellationToken)
+            ?? throw new InvalidDataException("Persisted manual provider row missing after restart.");
+        JsonNode codex = await Bridge.GetAsync("storage.codexHome", cancellationToken)
+            ?? throw new InvalidDataException("Codex Home control missing after restart.");
+        JsonNode sqlite = await Bridge.GetAsync("storage.sqliteHome", cancellationToken)
+            ?? throw new InvalidDataException("SQLite Home control missing after restart.");
+        bool passed = value == 7
+            && string.Equals(codex["value"]?.GetValue<string>(), _fixture.CodexHome, StringComparison.OrdinalIgnoreCase)
+            && string.Equals(sqlite["value"]?.GetValue<string>(), _fixture.SqliteHome, StringComparison.OrdinalIgnoreCase)
+            && string.Equals(providerState["value"]?.GetValue<string>(), "manual-persist-e2e", StringComparison.Ordinal)
+            && persistedRow["selected"]?.GetValue<bool>() == true;
+        _evidence.Restart["passed"] = passed;
+        _evidence.Restart["retention"] = value;
+        _evidence.Restart["manualProviderRow"] = providerRow;
+        _evidence.Restart["selectedProvider"] = providerState["value"]?.GetValue<string>();
+        _evidence.Restart["codexHome"] = codex["value"]?.GetValue<string>();
+        _evidence.Restart["sqliteHome"] = sqlite["value"]?.GetValue<string>();
+        if (!passed)
+        {
+            throw new InvalidDataException("GUI settings did not persist across a real EXE restart.");
+        }
+        PassMany("Retention, storage paths, and a manual provider survived a real published-EXE restart.",
+            "gui.settings.recent-home-persistence",
+            "gui.settings.sqlite-home-persistence",
+            "gui.provider.persist-selection",
+            "gui.backup.retention-persistence");
+    }
+
+    private async Task CollectAndValidateTraceAsync(CancellationToken cancellationToken)
+    {
+        if (!File.Exists(_fixture.TracePath))
+        {
+            throw new FileNotFoundException("GUI automation trace was not written.", _fixture.TracePath);
+        }
+        HashSet<string> linkedInTrace = new(StringComparer.Ordinal);
+        foreach (string line in await File.ReadAllLinesAsync(_fixture.TracePath, cancellationToken))
+        {
+            if (string.IsNullOrWhiteSpace(line))
+            {
+                continue;
+            }
+            JsonNode trace = JsonNode.Parse(line)
+                ?? throw new InvalidDataException("GUI trace contains an empty JSONL record.");
+            _evidence.Trace.Add(trace);
+            if (trace["eventObserved"]?.GetValue<bool>() != true)
+            {
+                throw new InvalidDataException($"GUI trace contains a false eventObserved record: {line}");
+            }
+            if (trace["requestId"]?.GetValue<string>() is { } requestId
+                && _linkedRequests.TryGetValue(requestId, out VerifiedApplicationLink? expectedLink))
+            {
+                VerifiedApplicationLink traced = ApplicationLinkVerifier.Verify(
+                    trace,
+                    expectedLink.Operation,
+                    expectedLink.Lifecycle,
+                    expectedLink.ErrorCodes);
+                if (!string.Equals(traced.OperationId, expectedLink.OperationId, StringComparison.Ordinal))
+                {
+                    throw new InvalidDataException(
+                        $"GUI→Application trace operation id mismatch for request {requestId}: "
+                        + $"expected {expectedLink.OperationId}, observed {traced.OperationId}.");
+                }
+                linkedInTrace.Add(requestId);
+            }
+        }
+        string[] missing = _linkedRequests.Keys.Except(linkedInTrace).ToArray();
+        if (missing.Length > 0)
+        {
+            throw new InvalidDataException(
+                $"GUI→Application trace linkage is missing for requests: {string.Join(",", missing)}.");
+        }
+        _evidence.Manifest["applicationTraceLinkedRequests"] = _linkedRequests.Count;
+    }
+
+    private async Task ProbeFolderPickerRoundTripAsync(
+        string controlId,
+        string valueControlId,
+        string dialogId,
+        string scenarioId,
+        string alternatePath,
+        string originalPath,
+        CancellationToken cancellationToken)
+    {
+        if (!await ProbeFolderPickerSelectionAsync(
+            controlId, dialogId, scenarioId, alternatePath, "alternate", cancellationToken))
+        {
+            return;
+        }
+        await RequireStoragePickerResultAsync(valueControlId, alternatePath, cancellationToken);
+
+        if (!await ProbeFolderPickerSelectionAsync(
+            controlId, dialogId, scenarioId, originalPath, "restore-original", cancellationToken))
+        {
+            return;
+        }
+        await RequireStoragePickerResultAsync(valueControlId, originalPath, cancellationToken);
+        Pass(scenarioId,
+            "Two real Windows folder pickers selected a different valid isolated path and then restored the original; control and rendered status reflected both choices.");
+    }
+
+    private async Task<bool> ProbeFolderPickerSelectionAsync(
+        string controlId,
+        string dialogId,
+        string scenarioId,
+        string selectedPath,
+        string phase,
+        CancellationToken cancellationToken)
+    {
+        BridgeResponse ready = await Bridge.SendAsync(
+            "ui.wait",
+            new JsonObject
+            {
+                ["automationId"] = controlId,
+                ["property"] = "enabled",
+                ["equals"] = true,
+                ["timeoutMs"] = 30000
+            },
+            cancellationToken);
+        if (!ready.Ok)
+        {
+            string blocker = $"{controlId} did not become actionable before folder picker drive: {ready.ErrorMessage}";
+            _evidence.Blockers.Add(blocker);
+            Block(scenarioId, blocker);
+            return false;
+        }
+        Task<BridgeResponse> pending = Bridge.SendAsync(
+            "ui.invoke",
+            new JsonObject { ["automationId"] = controlId },
+            cancellationToken);
+        NativeDialogObservation? dialog = await NativeWindows.WaitForDialogAsync(
+            _session!.Process.Id,
+            _session.MainWindow,
+            TimeSpan.FromSeconds(2),
+            cancellationToken);
+        if (dialog is null)
+        {
+            BridgeResponse response = await pending;
+            RecordControl(controlId, "ui.invoke", response);
+            string blocker = $"App blocker: {controlId} reaches IsolatedAppPlatformBoundary.PickFolder, which returns null without showing the real FolderBrowserDialog.";
+            _evidence.Blockers.Add(blocker);
+            Block(scenarioId, blocker);
+            return false;
+        }
+        if (IsLocationUnavailable(dialog))
+        {
+            RecordDialog("dialog.shell.locationUnavailable", controlId, dialog, "acknowledge");
+            NativeWindows.ClickDialogButton(dialog.Handle, 1);
+            NativeDialogObservation? underlying = await NativeWindows.WaitForDialogAsync(
+                _session.Process.Id, _session.MainWindow, TimeSpan.FromSeconds(2), cancellationToken);
+            if (underlying is not null)
+            {
+                NativeWindows.ClickDialogButton(underlying.Handle, 2);
+            }
+            _ = await pending;
+            string blocker = $"Windows shell reported Location unavailable for {controlId}; target picker evidence is rejected.";
+            _evidence.Blockers.Add(blocker);
+            Block(scenarioId, blocker);
+            return false;
+        }
+        RequirePendingModal(pending, $"{controlId} FolderBrowserDialog");
+        RecordDialog(dialogId, $"{controlId}-{phase}", dialog, "accept");
+        if (!NativeWindows.TryEnterFolderAndAccept(dialog.Handle, selectedPath))
+        {
+            NativeWindows.ClickDialogButton(dialog.Handle, 2);
+            _ = await pending;
+            Block(scenarioId, "Real folder picker was visible, but the external driver could not enter and accept the isolated path.");
+            return false;
+        }
+        BridgeResponse completed = await pending;
+        RecordControl(controlId, "ui.invoke", completed);
+        if (!completed.Ok)
+        {
+            string blocker = $"{controlId} rejected the {phase} isolated picker path: {completed.ErrorMessage}";
+            _evidence.Blockers.Add(blocker);
+            Block(scenarioId, blocker);
+            return false;
+        }
+        _coveredEntries.Add(dialogId);
+        BridgeResponse settled = await Bridge.SendAsync(
+            "ui.wait",
+            new JsonObject
+            {
+                ["automationId"] = controlId,
+                ["property"] = "enabled",
+                ["equals"] = true,
+                ["timeoutMs"] = 30000
+            },
+            cancellationToken);
+        if (!settled.Ok)
+        {
+            string blocker = $"{controlId} did not return to enabled state after the {phase} picker selection.";
+            _evidence.Blockers.Add(blocker);
+            Block(scenarioId, blocker);
+            return false;
+        }
+        return true;
+    }
+
+    private async Task RequireStoragePickerResultAsync(
+        string valueControlId,
+        string expectedPath,
+        CancellationToken cancellationToken)
+    {
+        _ = await RequireStorageControlValueAsync(
+            valueControlId, expectedPath, cancellationToken);
+        BridgeResponse status = await RequireResponseAsync(
+            "ui.get", new JsonObject { ["automationId"] = "status.output" }, false, cancellationToken);
+        RecordControl("status.output", "ui.get", status);
+        string renderedStatus = status.Result?["value"]?.GetValue<string>() ?? string.Empty;
+        if (!renderedStatus.Contains(Path.GetFullPath(expectedPath), StringComparison.OrdinalIgnoreCase))
+        {
+            throw new InvalidDataException(
+                $"Real folder picker did not propagate {expectedPath} through the storage control and rendered status.");
+        }
+    }
+
+    private async Task<BridgeResponse> RequireStorageControlValueAsync(
+        string valueControlId,
+        string expectedPath,
+        CancellationToken cancellationToken)
+    {
+        BridgeResponse selected = await RequireResponseAsync(
+            "ui.get", new JsonObject { ["automationId"] = valueControlId }, false, cancellationToken);
+        RecordControl(valueControlId, "ui.get", selected);
+        string actualPath = selected.Result?["value"]?.GetValue<string>() ?? string.Empty;
+        if (!PathsEqual(actualPath, expectedPath))
+        {
+            throw new InvalidDataException(
+                $"Storage control {valueControlId} did not adopt the real selection {expectedPath}; observed {actualPath}.");
+        }
+        return selected;
+    }
+
+    private async Task<NativeDialogObservation?> InvokeWithDialogAsync(
+        string controlId,
+        int buttonId,
+        string purpose,
+        CancellationToken cancellationToken)
+    {
+        BridgeResponse? response = await InvokeWithDialogResponseAsync(
+            controlId, buttonId, purpose, cancellationToken);
+        return response is null ? null : _lastDialog;
+    }
+
+    private NativeDialogObservation? _lastDialog;
+
+    private async Task<BridgeResponse?> InvokeWithDialogResponseAsync(
+        string controlId,
+        int buttonId,
+        string purpose,
+        CancellationToken cancellationToken)
+    {
+        _lastDialog = null;
+        Task<BridgeResponse> pending = Bridge.SendAsync(
+            "ui.invoke",
+            new JsonObject { ["automationId"] = controlId },
+            cancellationToken);
+        NativeDialogObservation? dialog = await NativeWindows.WaitForDialogAsync(
+            _session!.Process.Id,
+            _session.MainWindow,
+            TimeSpan.FromSeconds(5),
+            cancellationToken);
+        if (dialog is null)
+        {
+            BridgeResponse response = await pending;
+            RecordControl(controlId, "ui.invoke", response);
+            return null;
+        }
+        RequirePendingModal(pending, $"{controlId} MessageBox");
+        DialogContractResult contract = DialogContractVerifier.Verify(
+            purpose,
+            dialog.ClassName,
+            dialog.Title,
+            dialog.Text);
+        if (!contract.Passed)
+        {
+            await RejectUnexpectedDialogAsync(
+                pending,
+                controlId,
+                purpose,
+                dialog,
+                contract.Error ?? "Unknown native dialog contract failure.",
+                cancellationToken);
+        }
+        _lastDialog = dialog;
+        RecordDialog("native.messageBox", purpose, dialog, buttonId == 1 ? "accept" : "cancel");
+        NativeWindows.ClickDialogButton(dialog.Handle, buttonId);
+        (BridgeResponse completed, bool failureDialog) = await AwaitAfterConfirmationAsync(
+            pending,
+            controlId,
+            purpose,
+            dialog.Handle,
+            cancellationToken);
+        if (failureDialog)
+        {
+            return null;
+        }
+        if (!completed.Ok)
+        {
+            _evidence.Errors.Add($"{controlId} failed after native dialog [{completed.ErrorCode}]: {completed.ErrorMessage}");
+            return null;
+        }
+        return completed;
+    }
+
+    private async Task RejectUnexpectedDialogAsync(
+        Task<BridgeResponse> pending,
+        string controlId,
+        string purpose,
+        NativeDialogObservation dialog,
+        string contractError,
+        CancellationToken cancellationToken)
+    {
+        string screenshotPath = Path.Combine(
+            _fixture.Root,
+            "automation",
+            "screenshots",
+            $"{DateTimeOffset.UtcNow:yyyyMMddTHHmmssfffZ}-{SafeFileName(purpose)}-invalid-first-dialog.png");
+        string? screenshotSha256 = null;
+        try
+        {
+            NativeWindows.CaptureWindow(dialog.Handle, screenshotPath);
+            screenshotSha256 = await Hashing.Sha256FileAsync(screenshotPath, cancellationToken);
+        }
+        catch (Exception screenshotError)
+        {
+            _evidence.Errors.Add(
+                $"Unable to capture invalid {purpose} dialog: {screenshotError.GetType().Name}: {screenshotError.Message}");
+            screenshotPath = string.Empty;
+        }
+
+        RecordDialog(
+            "dialog.operationFailure",
+            purpose + "-invalid-first-dialog",
+            dialog,
+            "acknowledge-and-fail",
+            string.IsNullOrEmpty(screenshotPath) ? null : screenshotPath,
+            screenshotSha256);
+        _coveredEntries.Add("dialog.operationFailure");
+        string blocker = $"{controlId} showed a real native dialog that violated the {purpose} contract: {contractError}";
+        _evidence.Blockers.Add(blocker);
+        NativeWindows.ClickDialogButton(dialog.Handle, 1);
+        try
+        {
+            BridgeResponse completed = await pending.WaitAsync(TimeSpan.FromSeconds(10), cancellationToken);
+            RecordControl(controlId, "ui.invoke", completed);
+        }
+        catch (Exception completionError)
+        {
+            _evidence.Errors.Add(
+                $"Invalid-dialog invoke did not settle after acknowledgement: "
+                + $"{completionError.GetType().Name}: {completionError.Message}");
+        }
+        throw new InvalidDataException(blocker);
+    }
+
+    private async Task<(BridgeResponse Response, bool FailureDialog)> AwaitAfterConfirmationAsync(
+        Task<BridgeResponse> pending,
+        string controlId,
+        string purpose,
+        nint expectedDialogHandle,
+        CancellationToken cancellationToken)
+    {
+        DateTimeOffset deadline = DateTimeOffset.UtcNow + _options.Timeout;
+        while (!pending.IsCompleted && DateTimeOffset.UtcNow < deadline)
+        {
+            NativeDialogObservation? unexpected = await NativeWindows.WaitForDialogAsync(
+                _session!.Process.Id,
+                _session.MainWindow,
+                TimeSpan.FromMilliseconds(250),
+                cancellationToken,
+                expectedDialogHandle);
+            if (unexpected is null)
+            {
+                continue;
+            }
+
+            string screenshotPath = Path.Combine(
+                _fixture.Root,
+                "automation",
+                "screenshots",
+                $"{DateTimeOffset.UtcNow:yyyyMMddTHHmmssfffZ}-{SafeFileName(purpose)}-failure.png");
+            NativeWindows.CaptureWindow(unexpected.Handle, screenshotPath);
+            string screenshotSha256 = await Hashing.Sha256FileAsync(screenshotPath, cancellationToken);
+            RecordDialog(
+                "dialog.operationFailure",
+                purpose + "-unexpected-failure",
+                unexpected,
+                "acknowledge",
+                screenshotPath,
+                screenshotSha256);
+            _coveredEntries.Add("dialog.operationFailure");
+            string dialogText = string.Join(" | ", new[] { unexpected.Title }.Concat(unexpected.Text));
+            string blocker = $"{controlId} showed an unexpected real failure dialog after confirmation: {dialogText}";
+            _evidence.Blockers.Add(blocker);
+            NativeWindows.ClickDialogButton(unexpected.Handle, 1);
+            using CancellationTokenSource responseTimeout = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+            responseTimeout.CancelAfter(TimeSpan.FromSeconds(10));
+            BridgeResponse failed = await pending.WaitAsync(responseTimeout.Token);
+            RecordControl(controlId, "ui.invoke", failed);
+            return (failed, true);
+        }
+        if (!pending.IsCompleted)
+        {
+            throw new TimeoutException($"{controlId} did not complete within {_options.Timeout} after its real confirmation dialog.");
+        }
+        BridgeResponse completed = await pending;
+        RecordControl(controlId, "ui.invoke", completed);
+        return (completed, false);
+    }
+
+    private static void RequirePendingModal(Task<BridgeResponse> pending, string label)
+    {
+        if (pending.IsCompleted)
+        {
+            throw new InvalidDataException(
+                $"Named-pipe invoke completed before external desktop driver operated the real {label}; modal evidence would be invalid.");
+        }
+    }
+
+    private static bool IsLocationUnavailable(NativeDialogObservation dialog)
+    {
+        string combined = string.Join("\n", new[] { dialog.Title }.Concat(dialog.Text));
+        return combined.Contains("位置不可用", StringComparison.OrdinalIgnoreCase)
+            || combined.Contains("Location is not available", StringComparison.OrdinalIgnoreCase);
+    }
+
+    private async Task<BridgeResponse> RequireResponseAsync(
+        string method,
+        JsonObject? parameters,
+        bool requireApplicationLink,
+        CancellationToken cancellationToken)
+    {
+        BridgeResponse response = await Bridge.SendAsync(method, parameters, cancellationToken);
+        if (!response.Ok)
+        {
+            throw new InvalidOperationException($"{method} failed [{response.ErrorCode}]: {response.ErrorMessage}");
+        }
+        if (requireApplicationLink)
+        {
+            string controlId = parameters?["automationId"]?.GetValue<string>() ?? method;
+            string expectedOperation = controlId switch
+            {
+                "status.refresh" => "Status",
+                _ => throw new InvalidDataException(
+                    $"No explicit Application operation contract is registered for {controlId}.")
+            };
+            RequireApplicationLink(response, controlId, expectedOperation);
+        }
+        return response;
+    }
+
+    private void RequireApplicationLink(
+        BridgeResponse response,
+        string controlId,
+        string expectedOperation,
+        string expectedLifecycle = "Succeeded",
+        params string[] expectedErrorCodes)
+    {
+        if (string.IsNullOrWhiteSpace(response.Id))
+        {
+            throw new InvalidDataException($"{controlId} completed without a bridge request id.");
+        }
+        VerifiedApplicationLink link = ApplicationLinkVerifier.Verify(
+            response.Result,
+            expectedOperation,
+            expectedLifecycle,
+            expectedErrorCodes);
+        if (!_linkedRequests.TryAdd(response.Id, link))
+        {
+            throw new InvalidDataException($"Duplicate GUI→Application request linkage: {response.Id}.");
+        }
+    }
+
+    private async Task SetChangedAsync(string automationId, JsonNode value, CancellationToken cancellationToken)
+    {
+        JsonNode current = await Bridge.GetAsync(automationId, cancellationToken)
+            ?? throw new InvalidDataException($"{automationId} is missing.");
+        JsonNode? currentValue = current["value"];
+        if (JsonNode.DeepEquals(currentValue, value))
+        {
+            JsonNode alternate = value switch
+            {
+                JsonValue json when json.TryGetValue<bool>(out bool flag) => JsonValue.Create(!flag)!,
+                JsonValue json when json.TryGetValue<int>(out int integer) => JsonValue.Create(integer == 10 ? 9 : 10)!,
+                JsonValue json when json.TryGetValue<decimal>(out decimal number) => JsonValue.Create(number == 10 ? 9 : 10)!,
+                _ => JsonValue.Create(value.GetValue<string>() + "-changed")!
+            };
+            BridgeResponse alternateResponse = await RequireResponseAsync(
+                "ui.set",
+                new JsonObject { ["automationId"] = automationId, ["value"] = alternate },
+                false,
+                cancellationToken);
+            RecordControl(automationId, "ui.set", alternateResponse);
+        }
+        BridgeResponse response = await RequireResponseAsync(
+            "ui.set",
+            new JsonObject { ["automationId"] = automationId, ["value"] = value },
+            false,
+            cancellationToken);
+        RecordControl(automationId, "ui.set", response);
+    }
+
+    private async Task<string> WaitForDynamicRowAsync(string providerId, CancellationToken cancellationToken)
+    {
+        string rowId = "provider.row:" + StableInstanceKey(providerId);
+        DateTimeOffset deadline = DateTimeOffset.UtcNow + TimeSpan.FromSeconds(10);
+        while (DateTimeOffset.UtcNow < deadline)
+        {
+            BridgeResponse response = await Bridge.SendAsync(
+                "ui.get", new JsonObject { ["automationId"] = rowId }, cancellationToken);
+            if (response.Ok)
+            {
+                return rowId;
+            }
+            await Task.Delay(100, cancellationToken);
+        }
+        throw new TimeoutException($"Dynamic provider row did not appear: {providerId}.");
+    }
+
+    private async Task WaitForDynamicRowMissingAsync(string rowId, CancellationToken cancellationToken)
+    {
+        DateTimeOffset deadline = DateTimeOffset.UtcNow + TimeSpan.FromSeconds(10);
+        while (DateTimeOffset.UtcNow < deadline)
+        {
+            BridgeResponse response = await Bridge.SendAsync(
+                "ui.get", new JsonObject { ["automationId"] = rowId }, cancellationToken);
+            if (!response.Ok && string.Equals(response.ErrorCode, "command-failed", StringComparison.Ordinal))
+            {
+                return;
+            }
+            await Task.Delay(100, cancellationToken);
+        }
+        throw new TimeoutException($"Dynamic provider row did not disappear: {rowId}.");
+    }
+
+    private void RecordControl(string automationId, string method, BridgeResponse response) =>
+        _evidence.Controls.Add(new()
+        {
+            ["automationId"] = automationId,
+            ["requestId"] = response.Id,
+            ["method"] = method,
+            ["ok"] = response.Ok,
+            ["errorCode"] = response.ErrorCode,
+            ["result"] = response.Result?.DeepClone()
+        });
+
+    private void RecordDialog(
+        string dialogId,
+        string purpose,
+        NativeDialogObservation dialog,
+        string action,
+        string? screenshotPath = null,
+        string? screenshotSha256 = null) => _evidence.Dialogs.Add(new()
+    {
+        ["dialogId"] = dialogId,
+        ["purpose"] = purpose,
+        ["className"] = dialog.ClassName,
+        ["title"] = dialog.Title,
+        ["text"] = dialog.Text,
+        ["action"] = action,
+        ["observedAtUtc"] = dialog.ObservedAtUtc,
+        ["screenshotPath"] = screenshotPath,
+        ["screenshotSha256"] = screenshotSha256
+    });
+
+    private static string SafeFileName(string value)
+    {
+        string safe = new(value.Select(character => char.IsAsciiLetterOrDigit(character) ? character : '-').ToArray());
+        return safe.Trim('-');
+    }
+
+    private void LoadScenarioContract()
+    {
+        using JsonDocument document = JsonDocument.Parse(_scenarioJson);
+        foreach (string scenario in document.RootElement.GetProperty("nonGatingManifestScenarioIds")
+            .EnumerateArray().Select(value => value.GetString()!))
+        {
+            if (!_nonGatingScenarioIds.Add(scenario))
+            {
+                throw new InvalidDataException($"Scenario asset duplicates non-gating scenario {scenario}.");
+            }
+        }
+        foreach (JsonElement group in document.RootElement.GetProperty("groups").EnumerateArray())
+        {
+            string groupId = group.GetProperty("id").GetString()
+                ?? throw new InvalidDataException("Scenario group omitted id.");
+            string[] evidenceReferences = group.GetProperty("requiredEvidence").EnumerateArray()
+                .Select(value => value.GetString()
+                    ?? throw new InvalidDataException($"Scenario group {groupId} has a null evidence reference."))
+                .ToArray();
+            string[] unknownEvidence = evidenceReferences
+                .Where(reference => !SupportedEvidenceReferences.Contains(reference))
+                .Order(StringComparer.Ordinal)
+                .ToArray();
+            if (unknownEvidence.Length > 0 || evidenceReferences.Distinct(StringComparer.Ordinal).Count() != evidenceReferences.Length)
+            {
+                throw new InvalidDataException(
+                    $"Scenario group {groupId} has unknown or duplicate evidence references: "
+                    + string.Join(",", unknownEvidence));
+            }
+            string[] entries = group.GetProperty("entryIds").EnumerateArray()
+                .Select(value => value.GetString()!).ToArray();
+            foreach (string scenario in group.GetProperty("scenarioIds").EnumerateArray()
+                .Select(value => value.GetString()!))
+            {
+                if (!_scenarios.TryAdd(scenario, new ScenarioState("not-run", "No real evidence was recorded.")))
+                {
+                    throw new InvalidDataException($"Scenario asset duplicates {scenario}.");
+                }
+                _scenarioEntries[scenario] = entries;
+            }
+        }
+        (_, IReadOnlyList<string> manifestScenarios) = ManifestCoverageGate.ReadRequirements(_manifestJson);
+        HashSet<string> partition = _scenarios.Keys.Concat(_nonGatingScenarioIds).ToHashSet(StringComparer.Ordinal);
+        if (!manifestScenarios.ToHashSet(StringComparer.Ordinal).SetEquals(partition)
+            || _scenarios.Keys.Intersect(_nonGatingScenarioIds, StringComparer.Ordinal).Any())
+        {
+            throw new InvalidDataException(
+                "Scenario asset does not exactly partition required and non-gating manifest scenarioIds.");
+        }
+    }
+
+    private void FinalizeCoverage()
+    {
+        if (_coverageFinalized)
+        {
+            return;
+        }
+        _coverageFinalized = true;
+        foreach ((string id, ScenarioState state) in _scenarios.Where(pair => pair.Value.Status == "not-run").ToArray())
+        {
+            Block(id, "No isolated real-GUI fault/input path currently proves this manifest scenario.");
+        }
+        string[] passed = _scenarios.Where(pair => pair.Value.Status == "passed").Select(pair => pair.Key).ToArray();
+        (IReadOnlyList<string> manifestEntries, IReadOnlyList<string> manifestScenarios) =
+            ManifestCoverageGate.ReadRequirements(_manifestJson);
+        ManifestCoverageResult entryCoverage = ManifestCoverageGate.Evaluate(
+            _manifestJson, _coveredEntries, manifestScenarios);
+        string[] missingRequiredScenarios = _scenarios.Keys.Except(passed, StringComparer.Ordinal)
+            .Order(StringComparer.Ordinal).ToArray();
+        Dictionary<string, string[]> missingRequiredEvidence = MissingRequiredEvidenceByGroup();
+        bool requiredEvidencePassed = missingRequiredEvidence.Count == 0;
+        bool coveragePassed = entryCoverage.MissingEntryIds.Count == 0
+            && missingRequiredScenarios.Length == 0
+            && requiredEvidencePassed;
+        _evidence.Manifest["declaredEntryCount"] = manifestEntries.Count;
+        _evidence.Manifest["coveredEntryCount"] = manifestEntries.Count - entryCoverage.MissingEntryIds.Count;
+        _evidence.Manifest["requiredHeadfulScenarioCount"] = _scenarios.Count;
+        _evidence.Manifest["passedRequiredHeadfulScenarioCount"] = passed.Length;
+        _evidence.Manifest["nonGatingManifestScenarioCount"] = _nonGatingScenarioIds.Count;
+        _evidence.Manifest["nonGatingManifestScenarioIds"] = _nonGatingScenarioIds.Order(StringComparer.Ordinal).ToArray();
+        _evidence.Manifest["coveragePassed"] = coveragePassed;
+        _evidence.Manifest["missingEntryIds"] = entryCoverage.MissingEntryIds;
+        _evidence.Manifest["missingRequiredHeadfulScenarioIds"] = missingRequiredScenarios;
+        _evidence.Manifest["requiredEvidencePassed"] = requiredEvidencePassed;
+        _evidence.Manifest["missingRequiredEvidenceByGroup"] = missingRequiredEvidence;
+        foreach ((string id, ScenarioState state) in _scenarios.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+        {
+            _evidence.Scenario(id, state.Status, state.Evidence, _scenarioEntries[id]);
+        }
+        if (!coveragePassed)
+        {
+            _evidence.Blockers.Add(
+                $"Headful gate failed: {entryCoverage.MissingEntryIds.Count} manifest entries, "
+                + $"{missingRequiredScenarios.Length} required scenarios, and "
+                + $"{missingRequiredEvidence.Sum(pair => pair.Value.Length)} required evidence references lack PASS evidence.");
+        }
+    }
+
+    private Dictionary<string, string[]> MissingRequiredEvidenceByGroup()
+    {
+        HashSet<string> available = ResolveAvailableEvidenceReferences();
+        Dictionary<string, string[]> missing = new(StringComparer.Ordinal);
+        using JsonDocument document = JsonDocument.Parse(_scenarioJson);
+        foreach (JsonElement group in document.RootElement.GetProperty("groups").EnumerateArray())
+        {
+            string groupId = group.GetProperty("id").GetString()
+                ?? throw new InvalidDataException("Scenario group omitted id.");
+            string[] absent = group.GetProperty("requiredEvidence").EnumerateArray()
+                .Select(entry => entry.GetString()
+                    ?? throw new InvalidDataException($"Scenario group {groupId} has a null evidence reference."))
+                .Where(reference => !available.Contains(reference))
+                .Order(StringComparer.Ordinal)
+                .ToArray();
+            if (absent.Length > 0)
+            {
+                missing[groupId] = absent;
+            }
+        }
+        _evidence.Manifest["availableEvidenceReferences"] = available.Order(StringComparer.Ordinal).ToArray();
+        return missing;
+    }
+
+    private HashSet<string> ResolveAvailableEvidenceReferences()
+    {
+        HashSet<string> available = new(StringComparer.Ordinal);
+        if (_evidence.Executable.TryGetValue("sha256", out object? executableHash)
+            && executableHash is string hash
+            && hash.Length == 64)
+        {
+            available.Add("published-exe-sha256");
+        }
+        if (_evidence.Executable.TryGetValue("visibleMainWindow", out object? visible)
+            && visible is true)
+        {
+            available.Add("visible-main-window");
+        }
+        if (ScenariosPassed("gui.launch", "gui.focus-existing-instance", "gui.shutdown"))
+        {
+            available.Add("real-window-lifecycle");
+        }
+        if (_evidence.Controls.Any(control =>
+            control.TryGetValue("requestId", out object? requestId)
+            && requestId is string id
+            && !string.IsNullOrWhiteSpace(id)))
+        {
+            available.Add("bridge-control-event");
+        }
+        if (_evidence.Dialogs.Any(dialog =>
+            dialog.TryGetValue("dialogId", out object? id)
+            && id is string dialogId
+            && (dialogId.StartsWith("dialog.storage.", StringComparison.Ordinal)
+                || string.Equals(dialogId, "dialog.restore.backupPicker", StringComparison.Ordinal))))
+        {
+            available.Add("native-folder-dialog");
+        }
+        if (_evidence.Restart.TryGetValue("passed", out object? restartPassed) && restartPassed is true)
+        {
+            available.Add("restart-persistence");
+        }
+        if (_linkedRequests.Count > 0 && _evidence.Trace.Count > 0)
+        {
+            available.Add("application-trace");
+        }
+        if (HasRenderedControlText("status.output", text => text.Contains("Codex Home", StringComparison.OrdinalIgnoreCase)))
+        {
+            available.Add("rendered-status");
+        }
+        if (ScenarioPassed("gui.status.refresh-failure")
+            && _evidence.Dialogs.Any(dialog =>
+                string.Equals(dialog.GetValueOrDefault("dialogId") as string, "dialog.operationFailure", StringComparison.Ordinal)))
+        {
+            available.Add("isolated-failure-path");
+        }
+        if (_evidence.Dialogs.Any(dialog =>
+            string.Equals(dialog.GetValueOrDefault("className") as string, "#32770", StringComparison.Ordinal)))
+        {
+            available.Add("native-message-box");
+        }
+        if (_coveredEntries.Contains("provider.row")
+            && _coveredEntries.Contains("storage.codexHome.recent"))
+        {
+            available.Add("stable-dynamic-id");
+        }
+        if (ScenarioPassed("gui.operation.ready-state")
+            && _evidence.Controls.Any(control => control.GetValueOrDefault("enabled") is true))
+        {
+            available.Add("real-enabled-state");
+        }
+        if (_evidence.FileDiffs.Any(diff => diff.TryGetValue("phase", out object? phase)
+            && phase is string name
+            && name is "sync" or "switch" or "restore" or "prune"))
+        {
+            available.Add("before-after-file-diff");
+        }
+        if (ScenariosPassed("gui.backup.open-directory", "gui.logs.open-directory"))
+        {
+            available.Add("no-external-child-process");
+        }
+        if (ScenariosPassed("gui.update.check", "gui.update.no-update"))
+        {
+            available.Add("isolated-platform-boundary");
+            available.Add("no-network-or-external-process");
+        }
+        if (HasRenderedControlText("logs.output", text => !string.IsNullOrWhiteSpace(text)))
+        {
+            available.Add("rendered-log-output");
+        }
+        if (HasRenderedControlText("warning.closeCodex.primary", text => !string.IsNullOrWhiteSpace(text))
+            && HasRenderedControlText("warning.closeCodex.secondary", text => !string.IsNullOrWhiteSpace(text)))
+        {
+            available.Add("visible-real-control-text");
+        }
+        return available;
+    }
+
+    private bool ScenarioPassed(string id) =>
+        _scenarios.TryGetValue(id, out ScenarioState? state)
+        && string.Equals(state.Status, "passed", StringComparison.Ordinal);
+
+    private bool ScenariosPassed(params string[] ids) => ids.All(ScenarioPassed);
+
+    private bool HasRenderedControlText(string automationId, Func<string, bool> predicate) =>
+        _evidence.Controls
+            .Where(control => string.Equals(
+                control.GetValueOrDefault("automationId") as string,
+                automationId,
+                StringComparison.Ordinal))
+            .Select(ControlText)
+            .Any(text => text is not null && predicate(text));
+
+    private static string? ControlText(Dictionary<string, object?> control)
+    {
+        if (control.GetValueOrDefault("value") is JsonValue direct
+            && direct.TryGetValue(out string? directText))
+        {
+            return directText;
+        }
+        if (control.GetValueOrDefault("result") is JsonNode result
+            && result["value"] is JsonValue nested
+            && nested.TryGetValue(out string? nestedText))
+        {
+            return nestedText;
+        }
+        return null;
+    }
+
+    private void Pass(string id, string evidence) => _scenarios[id] = new("passed", evidence);
+    private void PassMany(string evidence, params string[] ids)
+    {
+        foreach (string id in ids) Pass(id, evidence);
+    }
+    private void Block(string id, string evidence)
+    {
+        if (_scenarios[id].Status != "passed") _scenarios[id] = new("blocked", evidence);
+    }
+    private void BlockMany(string evidence, params string[] ids)
+    {
+        foreach (string id in ids) Block(id, evidence);
+    }
+
+    private static string StableInstanceKey(string naturalKey)
+    {
+        string normalized = naturalKey.Trim().Normalize(NormalizationForm.FormKC);
+        byte[] hash = System.Security.Cryptography.SHA256.HashData(Encoding.UTF8.GetBytes(normalized));
+        return Convert.ToHexString(hash.AsSpan(0, 12)).ToLowerInvariant();
+    }
+
+    private static Dictionary<string, object?> Diff(string phase, FixtureSnapshot before, FixtureSnapshot after) => new()
+    {
+        ["phase"] = phase,
+        ["before"] = before,
+        ["after"] = after,
+        ["configChanged"] = before.ConfigSha256 != after.ConfigSha256,
+        ["rolloutChanged"] = before.RolloutSha256 != after.RolloutSha256,
+        ["databaseStorageChanged"] = before.DatabaseStorageSha256 != after.DatabaseStorageSha256,
+        ["databaseLogicalChanged"] = before.DatabaseProvider != after.DatabaseProvider
+            || before.DatabaseModel != after.DatabaseModel,
+        ["backupCountDelta"] = after.ManagedBackupCount - before.ManagedBackupCount
+    };
+
+    private static bool SameFixtureState(FixtureSnapshot left, FixtureSnapshot right) =>
+        left.ConfigSha256 == right.ConfigSha256
+        && left.RolloutSha256 == right.RolloutSha256
+        && left.DatabaseStorageSha256 == right.DatabaseStorageSha256
+        && left.ConfigProvider == right.ConfigProvider
+        && left.RolloutProvider == right.RolloutProvider
+        && left.DatabaseProvider == right.DatabaseProvider
+        && left.DatabaseModel == right.DatabaseModel
+        && left.ManagedBackupCount == right.ManagedBackupCount;
+
+    private static bool PathsEqual(string left, string right) =>
+        string.Equals(
+            Path.TrimEndingDirectorySeparator(Path.GetFullPath(left)),
+            Path.TrimEndingDirectorySeparator(Path.GetFullPath(right)),
+            StringComparison.OrdinalIgnoreCase);
+
+    private sealed record ScenarioState(string Status, string Evidence);
+}
diff --git a/desktop/CodexProviderSync.GuiE2E/assets/gui-e2e-scenarios.v0.4.json b/desktop/CodexProviderSync.GuiE2E/assets/gui-e2e-scenarios.v0.4.json
new file mode 100644
index 0000000..ed11fd3
--- /dev/null
+++ b/desktop/CodexProviderSync.GuiE2E/assets/gui-e2e-scenarios.v0.4.json
@@ -0,0 +1,195 @@
+{
+  "$schema": "https://schemas.codex-provider-sync.invalid/gui-e2e-scenarios-0.4.json",
+  "schemaVersion": "0.4",
+  "manifestVersion": "0.4.0",
+  "executionPolicy": {
+    "requiresWindows": true,
+    "requiresUserInteractive": true,
+    "requiresActiveDesktop": true,
+    "requiresVisiblePublishedExe": true,
+    "requiresRealControlsAndEvents": true,
+    "blockedIsFailure": true,
+    "skippedIsFailure": true,
+    "unitTestsMayClaimGuiPass": false
+  },
+  "nonGatingManifestScenarioIds": [
+    "gui.status.wsl-diagnostic",
+    "gui.provider.remove-manual-validation",
+    "gui.switch.model-custom-validation",
+    "gui.operation.busy",
+    "gui.operation.busy-state",
+    "gui.operation.failure",
+    "gui.restore.relocation-config-conflict",
+    "gui.restore.sqlite-relocation",
+    "gui.restore.failure",
+    "gui.restore.no-target-validation",
+    "gui.restore.confirm-sqlite-relocation",
+    "gui.restore.metadata-failure",
+    "gui.update.available",
+    "gui.update.timeout",
+    "gui.update.failure",
+    "gui.update.apply-failure",
+    "gui.logs.open-directory-failure",
+    "gui.logs.write-failure-warning"
+  ],
+  "groups": [
+    {
+      "id": "lifecycle",
+      "entryIds": ["window.main"],
+      "scenarioIds": ["gui.launch", "gui.focus-existing-instance", "gui.shutdown"],
+      "requiredEvidence": ["published-exe-sha256", "visible-main-window", "real-window-lifecycle"]
+    },
+    {
+      "id": "storage",
+      "entryIds": [
+        "storage.codexHome",
+        "storage.codexHome.browse",
+        "storage.sqliteHome",
+        "storage.sqliteHome.browse",
+        "storage.codexHome.recent",
+        "dialog.storage.codexHomePicker",
+        "dialog.storage.sqliteHomePicker"
+      ],
+      "scenarioIds": [
+        "gui.status.explicit-codex-home",
+        "gui.settings.recent-home-persistence",
+        "gui.status.browse-codex-home",
+        "gui.status.explicit-sqlite-home",
+        "gui.settings.sqlite-home-persistence",
+        "gui.status.browse-sqlite-home",
+        "gui.settings.recent-home-identity",
+        "gui.settings.recent-home-selection"
+      ],
+      "requiredEvidence": ["bridge-control-event", "native-folder-dialog", "restart-persistence"]
+    },
+    {
+      "id": "status",
+      "entryIds": ["status.refresh", "status.output"],
+      "scenarioIds": [
+        "gui.status.refresh",
+        "gui.status.refresh-failure",
+        "gui.status.rendered-result"
+      ],
+      "requiredEvidence": ["bridge-control-event", "application-trace", "rendered-status", "isolated-failure-path"]
+    },
+    {
+      "id": "provider",
+      "entryIds": [
+        "provider.list",
+        "provider.manualId",
+        "provider.addManual",
+        "provider.removeManual",
+        "state.selectedProvider",
+        "provider.row",
+        "dialog.validation"
+      ],
+      "scenarioIds": [
+        "gui.provider.select",
+        "gui.provider.persist-selection",
+        "gui.provider.manual-input",
+        "gui.provider.add-manual",
+        "gui.provider.add-manual-validation",
+        "gui.provider.remove-manual",
+        "gui.provider.selection-state",
+        "gui.provider.dynamic-row-identity",
+        "gui.provider.dynamic-row-selection"
+      ],
+      "requiredEvidence": ["bridge-control-event", "native-message-box", "stable-dynamic-id", "restart-persistence"]
+    },
+    {
+      "id": "switch-inputs",
+      "entryIds": [
+        "execution.updateConfig",
+        "execution.model.followProvider",
+        "execution.model.keepCurrent",
+        "execution.model.custom",
+        "execution.customModel"
+      ],
+      "scenarioIds": [
+        "gui.switch.mode",
+        "gui.switch.model-follow-provider",
+        "gui.switch.model-keep-current",
+        "gui.switch.model-custom-mode",
+        "gui.switch.model-custom-value"
+      ],
+      "requiredEvidence": ["bridge-control-event", "native-message-box", "real-enabled-state"]
+    },
+    {
+      "id": "sync-switch",
+      "entryIds": ["operation.execute", "dialog.confirmation"],
+      "scenarioIds": [
+        "gui.sync.mode",
+        "gui.sync.confirm-close-codex",
+        "gui.sync.execute",
+        "gui.switch.execute"
+      ],
+      "requiredEvidence": ["bridge-control-event", "native-message-box", "application-trace", "before-after-file-diff"]
+    },
+    {
+      "id": "operation-state",
+      "entryIds": ["state.operation", "dialog.operationFailure"],
+      "scenarioIds": [
+        "gui.operation.ready-state"
+      ],
+      "requiredEvidence": ["real-enabled-state", "application-trace", "native-message-box", "isolated-failure-path"]
+    },
+    {
+      "id": "restore",
+      "entryIds": [
+        "restore.includeConfig",
+        "restore.includeDatabase",
+        "restore.includeSessions",
+        "restore.execute",
+        "dialog.restore.backupPicker"
+      ],
+      "scenarioIds": [
+        "gui.restore.include-config",
+        "gui.restore.include-database",
+        "gui.restore.include-sessions",
+        "gui.restore.execute",
+        "gui.restore.cancel",
+        "gui.restore.select-backup",
+        "gui.restore.confirm-targets",
+        "gui.restore.confirm-close-codex"
+      ],
+      "requiredEvidence": ["bridge-control-event", "native-folder-dialog", "native-message-box", "application-trace", "before-after-file-diff"]
+    },
+    {
+      "id": "backup",
+      "entryIds": ["backup.retentionCount", "backups.openDirectory", "backups.prune"],
+      "scenarioIds": [
+        "gui.backup.retention",
+        "gui.backup.retention-persistence",
+        "gui.backup.open-directory",
+        "gui.backup.prune",
+        "gui.backup.prune-cancel",
+        "gui.backup.prune-confirmation"
+      ],
+      "requiredEvidence": ["bridge-control-event", "native-message-box", "application-trace", "restart-persistence", "no-external-child-process"]
+    },
+    {
+      "id": "updates",
+      "entryIds": ["updates.check", "dialog.update"],
+      "scenarioIds": [
+        "gui.update.check",
+        "gui.update.no-update"
+      ],
+      "requiredEvidence": ["bridge-control-event", "native-message-box", "isolated-platform-boundary", "no-network-or-external-process"]
+    },
+    {
+      "id": "logs",
+      "entryIds": ["logs.openDirectory", "logs.output"],
+      "scenarioIds": [
+        "gui.logs.open-directory",
+        "gui.logs.rendered-output"
+      ],
+      "requiredEvidence": ["bridge-control-event", "rendered-log-output", "no-external-child-process"]
+    },
+    {
+      "id": "warnings",
+      "entryIds": ["warning.closeCodex.primary", "warning.closeCodex.secondary"],
+      "scenarioIds": ["gui.warning.close-codex", "gui.warning.close-app-server"],
+      "requiredEvidence": ["visible-real-control-text"]
+    }
+  ]
+}
diff --git a/desktop/CodexProviderSync.Mac/CodexProviderSync.Mac.csproj b/desktop/CodexProviderSync.Mac/CodexProviderSync.Mac.csproj
index 9b840d8..55b5856 100644
--- a/desktop/CodexProviderSync.Mac/CodexProviderSync.Mac.csproj
+++ b/desktop/CodexProviderSync.Mac/CodexProviderSync.Mac.csproj
@@ -17,9 +17,9 @@
     <AssemblyName>CodexProviderSync</AssemblyName>
     <Product>Codex Provider Sync</Product>
     <Company>Dailin521</Company>
-    <Version>0.3.2</Version>
-    <AssemblyVersion>0.3.2.0</AssemblyVersion>
-    <FileVersion>0.3.2.0</FileVersion>
+    <Version>0.4.0</Version>
+    <AssemblyVersion>0.4.0.0</AssemblyVersion>
+    <FileVersion>0.4.0.0</FileVersion>
     <AvaloniaUseCompiledBindingsByDefault>true</AvaloniaUseCompiledBindingsByDefault>
   </PropertyGroup>
 
diff --git a/docs/ADR-0001-v0.4-automation-architecture.md b/docs/ADR-0001-v0.4-automation-architecture.md
new file mode 100644
index 0000000..8a9a957
--- /dev/null
+++ b/docs/ADR-0001-v0.4-automation-architecture.md
@@ -0,0 +1,104 @@
+# ADR-0001: v0.4 Application, transaction, and Automation architecture
+
+- Status: accepted for implementation after independent adversarial review
+- Date: 2026-08-03
+- Scope: v0.4.0
+
+## Context
+
+PR #70 establishes a UI-independent controller seam but leaves restore, prune,
+settings, dialogs, and execution orchestration in MainForm. Issue #69 shows
+that the current Node and .NET rollback coordinators learn about applied files
+only after a batch returns, so a mid-batch exception can conceal partial
+writes. v0.4 also requires scriptable business operations and complete real
+WinForms entry automation without exposing production control surfaces.
+
+## Decision
+
+1. Core remains the exclusive data-operation layer and gains a durable,
+   backup-bound file transaction journal with crash detection and compensating
+   rollback.
+2. Application becomes the exclusive use-case layer for all GUI and Business
+   operations. Requests are immutable; plans bind normalized input, targets,
+   fingerprints, digest, expiry, and single-use execution state.
+3. Business Automation is a one-shot console host using experimental JSON
+   protocol 0.4. stdout is machine JSON only; writes require explicit
+   `--apply` plus an exact fresh plan and digest.
+4. GUI Automation runs only in an explicit isolated test launch. It uses a
+   current-user-only random named pipe and one-time credential from a protected
+   bootstrap descriptor. The bridge only invokes registered control actions on
+   the UI thread.
+5. A versioned static manifest plus runtime enumeration and causal traces form
+   a 100% entry/action coverage gate. Native shell-dialog internals are narrow
+   exemptions, but their application-owned launch buttons remain real GUI
+   actions.
+6. The release package contains the GUI, Automation host, schema, and manifest.
+   Protocol 0.4 and manifest versions explicitly permit pre-1.0 evolution.
+
+## Safety invariants
+
+- No Automation path reads, copies, logs, or modifies `auth.json` or
+  credentials.
+- Test roots require a sentinel and canonical path containment before any
+  process starts or write occurs.
+- Normal GUI mode creates no Automation listener.
+- The named pipe is local/current-user only; arbitrary reflection and arbitrary
+  file access are absent.
+- A transaction cannot disappear while non-terminal. Recovery is explicit and
+  diagnostic; rollback failure preserves both original and rollback errors.
+- The current agent never writes remote `main`, merges a PR based on `main`,
+  enables auto-merge, or creates a formal tag/Release.
+
+## Alternatives rejected
+
+- Continuing separate MainForm workflows: duplicates behavior and makes
+  Business/GUI equivalence unverifiable.
+- Direct Application calls from the GUI bridge: does not prove the real control
+  event path.
+- Public HTTP/TCP listener: unnecessary attack surface for a local release
+  tool.
+- Hidden WinForms probe as the release gate: cannot prove visible desktop,
+  focus, dialog, keyboard, or obstruction behavior.
+- Stable JSONL v1 now: commits to compatibility before the real use cases and
+  safety model have release evidence.
+- In-memory applied-file tracking only: cannot recover after process death and
+  repeats Issue #69's fundamental visibility gap.
+
+## Consequences
+
+The implementation adds projects, release artifacts, schema/manifest checks,
+and Windows-only E2E infrastructure. Normal operation remains local and
+backup-first. Tests become more expensive but produce repeatable evidence and
+remove the manual full-entry regression burden. The macOS UI continues to use
+Core and must keep building, but full macOS Application migration is outside
+the v0.4 Windows release gate.
+
+## Independent review reconciliation
+
+A local Claude Opus consultation completed on 2026-08-03 after 687 seconds
+(`fea38f91-b679-405f-bb25-da26bba8fdeb`). Codex compared its threat model with
+the repository and accepted these release-gating corrections:
+
+- read-only status/describe remains available during an unfinished
+  transaction and reports the bound backup; only mutations are blocked;
+- pruning must never delete a backup referenced by a non-terminal journal;
+- modal GUI actions are operated by the external Headful desktop driver while
+  the pending bridge invocation observes the real GUI event and Application
+  lifecycle; no synthetic bridge shortcut substitutes for the dialog;
+- the GUI coverage denominator comes from runtime interactive-control
+  enumeration, not from the static manifest alone;
+- causal proof includes an architecture rule preventing bridge-to-Application
+  shortcuts, an observed GUI event/message leg, and independent filesystem or
+  SQLite effects; a bypass negative-control test must fail the gate;
+- the Headful harness rejects real-home aliases/reparse points and only cleans
+  a sentinel-bearing disposable root beneath its owned evidence directory.
+
+The review's proposed Node-to-C# thin-wrapper conversion was not adopted:
+the npm CLI is an existing cross-platform product surface, while the Business
+host is a Windows release companion. Instead, a shared declarative transaction
+corpus will keep Node and C# failure semantics aligned. Suggestions involving
+`auth.json` replacement and credential backup were inapplicable: this tool
+does not read, copy, or modify `auth.json`. Full two-participant crash
+forward-recovery is not promised by v0.4; a post-crash journal deliberately
+blocks later mutations and exposes the exact backup for explicit restore,
+which matches the Issue #69 acceptance boundary.
diff --git a/docs/AUTOMATION_DESIGN_NOTES.md b/docs/AUTOMATION_DESIGN_NOTES.md
new file mode 100644
index 0000000..c87ea2d
--- /dev/null
+++ b/docs/AUTOMATION_DESIGN_NOTES.md
@@ -0,0 +1,116 @@
+# Automation Design Notes
+
+> Status: implemented for the v0.4 integration branch, experimental and
+> non-normative.
+>
+> The v0.4 source and Windows Release build contain an Automation executable,
+> protocol schema, GUI manifest, and isolated GUI bridge. Implementation commit
+> `7545b5d` passed the visible Headful Windows release gate; v0.4 has not been
+> tagged or published as a formal Release. Protocol `0.4` is a pre-1.0
+> compatibility boundary.
+
+## Motivation
+
+Business scripting and GUI regression tests must exercise the same behavior as
+the real Windows application without duplicating Core workflows or exposing a
+production control port. The design therefore separates two automation
+surfaces:
+
+- Business Automation invokes shared, UI-independent Application use cases.
+- GUI Automation drives real WinForms controls and observes their real event
+  path into those use cases.
+
+## Implemented Architecture
+
+- `CodexProviderSync.Core` remains authoritative for config, rollout, SQLite,
+  backup, restore, pruning, storage resolution, locking, transaction recovery,
+  and WSL safety behavior.
+- `CodexProviderSync.Application` exposes immutable use cases for
+  `describe`, `status`, `plan`, `sync`, `switch`, `restore`, and `prune`.
+- The production Windows GUI and `CodexProviderSync.Automation.exe` use the
+  same `IApplicationService` implementation.
+- WinForms remains responsible for rendering, native dialogs, confirmation,
+  focus, shell launch, update UI, and other Windows-specific presentation.
+- The GUI bridge may only manipulate registered controls on the UI thread. It
+  may not call Application directly while claiming to cover a GUI action.
+
+## Business Automation Protocol
+
+The Windows Release build contains:
+
+- `CodexProviderSync.Automation.exe`
+- `automation-protocol-v0.4.schema.json`
+
+Each invocation emits exactly one protocol `0.4` JSON response on stdout;
+diagnostics use stderr. Supported commands are `describe`, `status`, `plan`,
+`sync`, `switch`, `restore`, and `prune`.
+
+Every write command is dry-run by default. Mutation requires explicit
+`--apply`, a plan document containing the `data` object returned by `plan`, and
+its exact lowercase SHA-256 digest. Plans are expiry-bound, bind normalized
+inputs and target fingerprints, and are single-use through a durable ledger.
+
+## GUI Automation Surface
+
+The versioned manifest is
+`desktop/CodexProviderSync.App/Automation/gui-automation-manifest.v0.4.json`.
+Runtime enumeration checks the manifest against real interactive controls and
+stable Automation IDs.
+
+The bridge supports `ui.describe`, `ui.snapshot`, `ui.get`, `ui.set`,
+`ui.invoke`, `ui.wait`, and `ui.shutdown`; launch and authentication belong to
+the external harness/bootstrap. `ui.set` and `ui.invoke` use real control APIs
+and WinForms events. A schema-2 causal trace records the Automation ID, GUI
+event, Application operation ID/kind/lifecycle, timestamps, and redacted
+values.
+
+The bridge is disabled during normal launches. An automation launch requires
+a protected descriptor beneath a sentinel-bearing disposable root, a random
+current-user-only named pipe, and a one-time token. The bridge permits one
+authenticated client, bounds messages and wait times, rejects replay, and
+confines all paths to the canonical isolated root. The external Headful driver
+operates real native dialogs while the bridge waits for the real GUI event
+path.
+
+## Safety Invariants
+
+- Automation never reads, copies, logs, or modifies `auth.json` or credentials.
+- Tests use explicit disposable fixture homes and never infer the runner's real
+  Codex Home, SQLite Home, AppData, settings, logs, or backup roots.
+- Absolute path validation rejects escapes, symbolic links, and reparse-point
+  ancestors.
+- Writes remain backup-first and preserve Core transaction, rollback, crash
+  recovery, locking, and WSL UNC safety rules.
+- Partial results, rollback failures, recovery-required state, cancellation,
+  timeout, stale plans, and duplicate execution remain machine-distinct.
+- A hidden window, mock control, skipped scenario, or direct Application call
+  cannot be reported as a real GUI pass.
+
+## Release Verification Status
+
+The intended one-command gate is:
+
+```powershell
+pwsh ./scripts/run-windows-gui-e2e.ps1
+```
+
+It publishes the Release GUI and Headful driver, creates an isolated fixture,
+launches the visible executable, traverses the manifest, and produces
+machine-readable evidence. Acceptance requires real controls and events,
+native dialogs, independent file/SQLite effects, state and busy behavior,
+restart persistence, and GUI-to-Application traces. Commit `7545b5d` passed with
+40/40 manifest entries, 53/53 required scenarios, zero errors/blockers, and a
+matching published-EXE SHA-256. Lower-level tests alone are not a PASS claim.
+
+## Compatibility Boundary
+
+Protocol and manifest version `0.4` may change incompatibly before 1.0. The
+project does not promise a public network service, arbitrary reflection,
+arbitrary file access, GUI automation in normal mode, stable native-dialog
+internals, or macOS GUI automation. Full macOS Application migration is not a
+v0.4 Windows release gate, although cross-platform Core/Application builds
+remain compatibility checks.
+
+Stabilization beyond `0.4` requires exact-head schema and package validation,
+the complete Headful Windows gate, transaction/recovery evidence, independent
+review, and CI at the same final commit.
diff --git a/docs/README_EN.md b/docs/README_EN.md
index 4a7fe6d..e1601ee 100644
--- a/docs/README_EN.md
+++ b/docs/README_EN.md
@@ -92,6 +92,34 @@ codex-provider sync --codex-home /mnt/c/Users/you/.codex --sqlite-home /home/you
 
 Node.js 24+ uses the built-in `node:sqlite` module. Older supported Node.js releases use the optional `better-sqlite3` dependency.
 
+### Business Automation API (experimental v0.4)
+
+The v0.4 Windows Release build also contains `CodexProviderSync.Automation.exe` and `automation-protocol-v0.4.schema.json`. This one-shot process interface uses the same Application use cases as the Windows GUI. Each invocation emits exactly one protocol `0.4` JSON document on stdout and sends diagnostics to stderr.
+
+| Command | Purpose |
+| --- | --- |
+| `describe` | Describe protocol capabilities and safety requirements |
+| `status` | Read status and diagnostics |
+| `plan --operation sync\|switch\|restore\|prune` | Create a plan for a selected write operation |
+| `sync` | Plan or explicitly apply synchronization |
+| `switch` | Plan or explicitly apply a Provider/model switch and synchronization |
+| `restore` | Plan or explicitly apply backup restoration |
+| `prune` | Plan or explicitly prune managed backups |
+
+Every write command is dry-run by default and returns a plan without modifying a target. Mutation requires `--apply`, a plan file containing only the `data` object from the `plan` response, and that object's exact lowercase SHA-256 `digest`:
+
+```powershell
+.\CodexProviderSync.Automation.exe describe
+.\CodexProviderSync.Automation.exe status --codex-home C:\isolated\.codex
+.\CodexProviderSync.Automation.exe sync --codex-home C:\isolated\.codex --provider openai
+$planResponse = .\CodexProviderSync.Automation.exe plan --operation sync --codex-home C:\isolated\.codex --provider openai | ConvertFrom-Json
+$planResponse.data | ConvertTo-Json -Depth 100 -Compress | Set-Content -LiteralPath C:\isolated\sync-plan.json -Encoding utf8NoBOM
+$planDigest = $planResponse.data.digest
+.\CodexProviderSync.Automation.exe sync --codex-home C:\isolated\.codex --provider openai --apply --plan C:\isolated\sync-plan.json --plan-digest $planDigest
+```
+
+Plans expire, bind normalized inputs and target state, and are single-use through a durable ledger. The default ledger is `<Codex Home>\tmp\provider-sync-automation-ledger`. Every path argument must be absolute and may not traverse a symbolic link or reparse point. Automation also rejects direct access to `auth.json`. The protocol remains experimental before 1.0; compatibility is not promised outside protocol family `0.4`.
+
 ## Safety and Limitations
 
 Before each `sync` or `switch`, the tool creates a backup under:
@@ -112,6 +140,8 @@ Before each `sync` or `switch`, the tool creates a backup under:
 
 - [Windows GUI guide](README_GUI_ZH.md)
 - [macOS GUI guide](README_MAC_GUI_EN.md)
+- [v0.4.0 Release Notes (Draft)](RELEASE_NOTES_V0.4.0.md)
+- [v0.4 Automation execution plan](V0.4_AUTOMATION_PLAN.md)
 - [中文说明](../README.md)
 - [AI / Agent guide](../AGENTS.md)
 - [Contributing guide](../CONTRIBUTING.md#english-quick-guide)
@@ -125,10 +155,11 @@ npm test
 dotnet test desktop/CodexProviderSync.Core.Tests/CodexProviderSync.Core.Tests.csproj
 ./scripts/test-wsl-unc-safety.sh
 pwsh ./scripts/publish-gui.ps1
+pwsh ./scripts/run-windows-gui-e2e.ps1
 ./scripts/publish-gui-macos.sh
 ```
 
-Run `test-wsl-unc-safety.sh` from WSL. It invokes Windows `dotnet.exe` to verify the safety guard against a real SQLite database on WSL ext4.
+Run `test-wsl-unc-safety.sh` from WSL. It invokes Windows `dotnet.exe` to verify the safety guard against a real SQLite database on WSL ext4. Run `run-windows-gui-e2e.ps1` only on a visible, interactive Windows desktop. The v0.4 implementation commit `7545b5d` passed this gate with 40/40 manifest entries covered, 53/53 required scenarios passed, and zero errors or blockers; the evidence gate also verified the published EXE hash, real control events, native dialogs, file/SQLite effects, restart persistence, and GUI-to-Application traces. Relevant later implementation changes require another run. Hidden, skipped, or direct-Application runs are not substitutes.
 
 ## License
 
diff --git a/docs/README_GUI_ZH.md b/docs/README_GUI_ZH.md
index 353bdd2..3a516a2 100644
--- a/docs/README_GUI_ZH.md
+++ b/docs/README_GUI_ZH.md
@@ -65,6 +65,22 @@ Windows GUI 将 `\\wsl.localhost\<发行版>\...` 和 `\\wsl$\<发行版>\...` 
 
 对于受支持的 Windows 本地路径，显式位置缺少 `state_5.sqlite` 时，“刷新”会显示缺库诊断，写操作会停止，并保持此显式路径作为唯一目标。默认布局中的数据库被删除时，可以从有效备份恢复到原默认位置。从 metadata v2 备份恢复到不同 SQLite Home 时，必须取消勾选“恢复配置文件”；GUI 随后会显示来源与目标并要求二次确认。
 
+## v0.4 Application 与 GUI Automation（开发者）
+
+Windows GUI 的状态、同步、切换、恢复和备份清理入口通过共享的 Application 用例调用 Core；同一组用例也供 `CodexProviderSync.Automation.exe` 的 Business API 使用。WinForms 仍负责控件状态、原生文件夹选择器、确认框、更新提示和其它 Windows 平台交互。
+
+测试专用 GUI Automation 为全部交互入口分配稳定 Automation ID，并由 `Automation/gui-automation-manifest.v0.4.json` 声明控件、动作、风险和场景。桥接器只在带 sentinel 的隔离启动中启用，通过 current-user-only 随机 named pipe 和一次性 token 接受 `ui.describe`、`ui.snapshot`、`ui.get`、`ui.set`、`ui.invoke`、`ui.wait`、`ui.shutdown`。`ui.set` / `ui.invoke` 操作真实控件并触发真实 WinForms 事件，不允许绕过 GUI 直接调用 Application 后冒充控件覆盖；trace schema 2 会关联 Automation ID、GUI 事件和 Application operation/lifecycle。
+
+普通启动不会创建 Automation listener。隔离环境拒绝真实 Codex Home、`auth.json`、越界路径、符号链接或 reparse point；原生对话框由外部 Headful 驱动器在可见桌面上操作，不提供生产控制接口。
+
+真实 Windows Release GUI 全入口 E2E 的运行入口是：
+
+```powershell
+pwsh ./scripts/run-windows-gui-e2e.ps1
+```
+
+它必须在可见、可交互的 Windows 桌面中运行。Release gate 的验收条件包括：发布后的真实 `CodexProviderSync.exe`、manifest 全入口/动作覆盖、真实控件与事件、原生对话框、状态与 busy 行为、独立文件/SQLite 差异、重启持久化，以及 GUI → Application 因果 trace。v0.4 的实现提交 `7545b5d` 已在真实可见桌面通过：40/40 manifest 入口覆盖、53/53 必需场景通过、0 error、0 blocker；prune 证据还逐目录确认旧 managed backup 消失并校验 unmanaged sentinel 哈希未变。单元测试、隐藏窗口、mock 或直接调用 Application 都不能记作真实 GUI PASS，相关实现变更后必须重跑。
+
 ## 更新与日志
 
 Windows GUI 每天首次启动会在后台检查一次最新的稳定版 GitHub Release，也可以随时点击“检查更新”手动重试。自动和手动版本查询共用 10 秒总时限；网络或代理异常不会阻止软件启动，自动检查失败也不会弹窗。
diff --git a/docs/RELEASE_NOTES_V0.4.0.md b/docs/RELEASE_NOTES_V0.4.0.md
new file mode 100644
index 0000000..d9a5377
--- /dev/null
+++ b/docs/RELEASE_NOTES_V0.4.0.md
@@ -0,0 +1,94 @@
+# v0.4.0 Release Notes
+
+> Release tags are created only after exact-head CI, visible Windows GUI E2E,
+> and fresh review gates pass. The tag workflow reruns the release suite and
+> publishes checksum-protected Windows assets.
+
+## Highlights
+
+- Issue #69 reliability work adds backup-bound transaction journals, atomic
+  file replacement, compensating rollback, rollback-failure evidence, and
+  explicit crash-recovery diagnostics for rollout and global-state writes.
+- Ambiguous SQLite COMMIT acknowledgement is treated conservatively: once a
+  mutating COMMIT is attempted, any unconfirmed outcome restores the database
+  from the transaction's bound backup; compensation failure remains
+  `recoveryRequired` rather than being reported as rolled back.
+- The Windows GUI and Business Automation host now share the same Application
+  use cases for status, planning, sync, switch, restore, and backup pruning.
+- `CodexProviderSync.Automation.exe` provides experimental protocol `0.4`
+  commands: `describe`, `status`, `plan`, `sync`, `switch`, `restore`, and
+  `prune`.
+- The WinForms application has stable Automation IDs, a versioned manifest,
+  an isolated named-pipe bridge, and schema-2 GUI-to-Application causal traces.
+- The Windows publish build includes the GUI, Business Automation executable,
+  protocol schema, and GUI automation manifest.
+
+## Business Automation Safety
+
+Write commands are dry-run by default. An actual mutation requires all three
+of the following:
+
+1. explicit `--apply`;
+2. a plan file containing the `data` object returned by a matching `plan`
+   response; and
+3. the plan's exact lowercase SHA-256 digest through `--plan-digest`.
+
+Plans expire, bind normalized inputs and target fingerprints, and are claimed
+only once through a durable ledger. Automation accepts absolute paths only,
+rejects symbolic-link/reparse-point traversal, and never reads or modifies
+`auth.json`.
+
+SQLite Home relocation requires all of `--sqlite-home`,
+`--allow-sqlite-home-relocation`, and `--no-config`. Sync and switch plans expose
+the exact automatic-prune deletion set and checked cleanup revalidates both the
+set and recursive fingerprints before deletion. Exit code `5` is reserved for
+failures with explicit complete-rollback evidence; pre-apply validation uses
+`2`, and an applying failure without rollback evidence fails closed with `10`.
+
+## GUI Automation Safety
+
+Normal GUI launches do not create an Automation listener. Test launches require
+a protected descriptor under a sentinel-bearing disposable root, a random
+current-user-only named pipe, and a one-time token. The bridge drives registered
+real controls and WinForms events on the UI thread; it cannot bypass the GUI
+and call Application directly while claiming GUI coverage. Native dialogs are
+operated by the external visible-desktop driver.
+
+## Compatibility and Migration
+
+- Existing CLI command behavior remains available. Business Automation is an
+  additional Windows companion executable, not a replacement for the Node CLI.
+- Protocol and manifest `0.4` are experimental pre-1.0 contracts and may
+  change incompatibly in a later protocol family.
+- Core remains authoritative for storage resolution, backup/restore, locking,
+  transaction safety, and WSL UNC diagnostics.
+- Full macOS GUI migration to the shared Application layer is outside this
+  Windows v0.4 gate; Core/Application compatibility builds remain required.
+
+## Windows Release GUI Gate Evidence
+
+Run the intended visible Windows Release GUI gate with:
+
+```powershell
+pwsh ./scripts/run-windows-gui-e2e.ps1
+```
+
+Acceptance requires the published real EXE, all manifest entries and declared
+actions, real events and dialogs, independent file/SQLite differences, state
+and busy behavior, restart persistence, and GUI-to-Application traces. Mock,
+hidden, skipped, or direct-Application runs do not count.
+
+Implementation commit `28c4dd4` passed this gate on a visible interactive
+Windows desktop. Machine-readable evidence recorded 40/40 manifest entries,
+53/53 required Headful scenarios, 17 real dialogs, zero errors, zero blockers,
+a matching published-EXE SHA-256, independent sync/switch/restore/prune effects,
+physical prune deletion with an unchanged unmanaged sentinel, restart
+persistence, and linked GUI-to-Application operation/lifecycle traces.
+
+At `28c4dd4`, the complete Node suite passed 183/183; the .NET Core suite passed
+188 tests with one expected environment-gated WSL test skipped; Application,
+Automation, WinForms, and GUI contract suites passed 49/49, 27/27, 66/66, and
+36/36. The Release solution built with zero warnings and errors, and independent
+stable-diff review found no P0/P1/P2. Material reliability decisions received
+the single policy-authorized independent Claude challenge; ordinary final-diff
+review remained local under the current policy.
diff --git a/docs/V0.4_AUTOMATION_PLAN.md b/docs/V0.4_AUTOMATION_PLAN.md
new file mode 100644
index 0000000..2298e94
--- /dev/null
+++ b/docs/V0.4_AUTOMATION_PLAN.md
@@ -0,0 +1,380 @@
+# v0.4.0 Automation execution plan
+
+> Status: authoritative and resumable.
+>
+> Integration branch: `agent/v0.4-automation-integration`
+>
+> Frozen Phase 1 baseline: PR #70 head
+> `b4308ee73dfb6206a61fb71e6f70b4447656af05`
+
+This file is the source of truth for the v0.4.0 engineering work. After a
+context reset, read this file, the final integration PR description, and the
+current Git status before continuing from the first incomplete gate.
+
+## 1. Live baseline
+
+Recorded on 2026-08-03 (Asia/Hong_Kong):
+
+- `origin/main`: `ca347b915026ac44b5f9e63a3224bc4eabe53e6f`
+- PR #70: open Draft, base `main`, head `b4308ee73dfb6206a61fb71e6f70b4447656af05`
+- PR #70 CI: run `30808409605`, conclusion `success`
+- PR #70 review: Codex found no major issue at `b4308ee`; no unresolved
+  review threads
+- PR #70 manual smoke checkbox is still unchecked, so no historical GUI smoke
+  result is accepted as final evidence
+- Issue #69: open; partial rollout and global-state writes are not reliably
+  visible to the outer rollback path
+- PR #62: closed, unmerged, superseded by #70; design reference only
+- final integration branch did not exist remotely before this worktree was
+  created
+
+Local isolated baseline at `b4308ee`:
+
+- Node: 110 passed
+- Core: 91 passed, 1 conditional WSL-only test skipped
+- Application: 9 passed
+- WinForms: 29 passed
+- release version verification for v0.3.2: passed
+- `git diff --check`: passed
+
+Evidence is under the ignored `artifacts/evidence/baseline-b4308ee-*` directory.
+
+Current integration evidence recorded on 2026-08-04:
+
+- implementation commit `28c4dd4` passed the visible Windows Release Headful
+  gate on the interactive input desktop
+- manifest coverage: 40/40; required Headful scenarios: 53/53; errors/blockers:
+  0/0; 17 real dialogs were handled; published EXE SHA-256 independently
+  matched
+- the evidence contains real native dialogs, sync/switch/restore/prune file and
+  SQLite effects, prune physical-deletion/sentinel checks, restart persistence,
+  and GUI-to-Application operation/lifecycle traces
+- Node passed 183/183; Core passed 188 with one expected WSL environment gate;
+  Application passed 49/49, Automation 27/27, WinForms 66/66, and GUI contract
+  tests 36/36; the Release solution built with zero warnings and errors
+- the post-review hardening requires explicit relocation targets, publishes and
+  revalidates automatic-prune deletion targets, and reserves exit code 5 for
+  failures with complete-rollback evidence; independent stable-diff review found
+  no P0/P1/P2
+
+## 2. Architecture and ownership
+
+The required dependency direction is:
+
+```text
+Core storage and domain operations
+             ^
+Application use cases and immutable operation state
+             ^                         ^
+Business Automation host          WinForms event adapter
+                                         ^
+                                  real WinForms controls
+                                         ^
+                                  GUI Automation bridge
+```
+
+Responsibilities:
+
+- Core owns config, rollout, SQLite, global state, backups, transaction
+  primitives, restore, storage resolution, locking, and WSL safety.
+- Application owns status, diagnostics, plan, sync, switch, restore, prune,
+  settings/provider changes, operation serialization, cancellation, immutable
+  inputs, plan freshness, and structured outcomes.
+- WinForms owns rendering, native/platform dialogs, focus, external folder
+  launching, and conversion of real control events to Application calls.
+- Business Automation calls Application use cases directly and never copies
+  Core workflows.
+- GUI Automation drives actual control instances on the UI thread and records
+  the control-event-to-Application causal chain. It may not call Application
+  directly while claiming a control was exercised.
+
+## 3. Transaction and recovery model (Issue #69)
+
+Both Node and .NET implementations use equivalent semantics:
+
+1. Acquire the existing per-Codex-Home operation lock.
+2. Refuse a new write if an unresolved transaction journal exists.
+3. Scan and fingerprint targets, validate SQLite, and create the managed
+   backup before any target mutation.
+4. Create a durable transaction journal under
+   the operation's managed backup as `transaction-journal.jsonl` before the
+   first target mutation.
+5. Stage replacement content beside each target, flush it, and use a
+   same-directory atomic replacement. Each append-only journal record is
+   flushed before the associated target transition.
+6. Before replacing each target, record `applying`; after replacement and
+   metadata restoration, record `applied`. The outer coordinator receives the
+   durable applied list even when the batch throws.
+7. SQLite remains protected by its own transaction. Rollout/global-state file
+   mutations are compensated from the managed backup if any normal failure or
+   cancellation occurs.
+8. Rollback records each target independently. If rollback itself fails, keep
+   the journal and return the original error, rollback errors, backup path,
+   incomplete targets, and safe recovery instructions.
+9. A completed operation atomically marks the journal `committed`; a completed
+   rollback marks it `rolledBack`. Terminal journals may be retained as audit
+   evidence and pruned with their managed backup.
+10. Startup/status checks detect non-terminal or truncated journals. Read-only
+    diagnostics remain available and show the bound backup; mutations are
+    blocked until an explicit restore marks that journal rolled back. No
+    silent half-complete state is accepted, and pruning protects every backup
+    referenced by a non-terminal journal.
+
+The fault-injection matrix covers backup failure, staging failure, first and
+Nth target failure, atomic replacement failure, global-state primary/backup
+partial failure, rollback failure, cancellation, crash/restart recovery,
+concurrency, duplicate execution, idempotent success, and the ordinary success
+path. Tests inspect disk state independently of returned objects.
+
+`--apply` remains unavailable until this matrix passes in both implementations.
+
+M1 evidence at the first implementation checkpoint: Node `120/120`; Core
+`101 passed / 1 pre-existing WSL-only conditional skip`. Both ran with fresh
+temporary HOME/UserProfile/Codex/SQLite/AppData/Temp/cache roots and inherited
+credential-like environment variables removed.
+
+## 4. Application use cases
+
+Application exposes one `IApplicationService` boundary with immutable request
+and result records for:
+
+- `Describe`
+- `GetStatus` / diagnostics
+- `CreatePlan`
+- `Sync`
+- `Switch`
+- `Restore`
+- `Prune`
+
+Every operation has an `operationId`, lifecycle state, structured warnings and
+errors, cancellation, and one-at-a-time concurrency protection. WinForms and
+Business Automation use the same implementation. Existing #70 behavior is a
+regression gate: provider fallback, three model modes, busy locking, immutable
+snapshots, no await-time parameter drift, refresh serialization, and hard
+blocking after a failed storage refresh.
+
+## 5. Business Automation protocol
+
+The Windows Release build contains `CodexProviderSync.Automation.exe` and
+`automation-protocol-v0.4.schema.json`.
+
+Protocol family: experimental `0.4`; one process invocation emits exactly one
+JSON result on stdout. Diagnostics go to stderr. Commands:
+
+- `describe`
+- `status`
+- `plan`
+- `sync`
+- `switch`
+- `restore`
+- `prune`
+
+Write commands default to plan-only. Mutation requires all of:
+
+- explicit `--apply`
+- a plan document produced by the same protocol version
+- the exact SHA-256 plan digest
+- an unexpired plan
+- matching normalized inputs, target paths, target fingerprint, and isolated
+  root policy
+
+Restore relocation additionally requires the explicit trio `--sqlite-home`,
+`--allow-sqlite-home-relocation`, and `--no-config`. Sync and switch plans list
+each concrete automatic-prune deletion target; checked cleanup must match that
+exact set and its recursive fingerprints before any planned backup is deleted.
+
+Exit codes are stable within protocol 0.4: `0` success, `2` validation or
+usage, `3` stale/invalid plan, `4` target busy/concurrency, `5` operation
+failed but rollback completed, `6` recovery required/rollback incomplete,
+`7` cancellation/timeout, and `10` internal protocol failure.
+Code `5` requires explicit complete-rollback evidence. A failure before the
+Application reaches `Applying` is reported as `2`; an applying failure without
+rollback or recovery evidence fails closed as `10`.
+
+Machine-readable results distinguish `success`, `warning`, `failure`,
+`rollback`, and `recovery`. Unknown commands, malformed input, unsupported
+capabilities, path escape, timeout, cancellation, stale plans, and duplicate
+execution are schema-tested. No command reads or modifies `auth.json`.
+
+## 6. GUI interaction inventory
+
+Static MainForm entries currently discovered:
+
+| Region | Stable ID | Type | Actions | Capability |
+| --- | --- | --- | --- | --- |
+| storage | `storage.codexHome` | ComboBox | get/set/select | settings + refresh input |
+| storage | `storage.codexHome.browse` | Button | invoke | dialog service |
+| storage | `storage.sqliteHome` | TextBox | get/set | settings + refresh input |
+| storage | `storage.sqliteHome.browse` | Button | invoke | dialog service |
+| storage | `status.refresh` | Button | invoke | refresh |
+| status | `status.output` | RichTextBox | get | ui-only result rendering |
+| provider | `provider.list` | ListView | get/select | provider selection |
+| provider | `provider.manualId` | TextBox | get/set | manual provider input |
+| provider | `provider.addManual` | Button | invoke | add provider |
+| provider | `provider.removeManual` | Button | invoke | remove provider |
+| execution | `execution.updateConfig` | CheckBox | get/set/toggle | sync/switch mode |
+| execution | `execution.model.followProvider` | RadioButton | get/set | model mode |
+| execution | `execution.model.keepCurrent` | RadioButton | get/set | model mode |
+| execution | `execution.model.custom` | RadioButton | get/set | model mode |
+| execution | `execution.customModel` | TextBox | get/set | model input |
+| restore | `restore.includeConfig` | CheckBox | get/set | restore options |
+| restore | `restore.includeDatabase` | CheckBox | get/set | restore options |
+| restore | `restore.includeSessions` | CheckBox | get/set | restore options |
+| backup | `backup.retentionCount` | NumericUpDown | get/set | retention |
+| operation | `operation.execute` | Button | invoke | sync/switch |
+| restore | `restore.execute` | Button | invoke | restore |
+| backup | `backups.openDirectory` | Button | invoke | ui-only shell boundary |
+| backup | `backups.prune` | Button | invoke | prune |
+| update | `updates.check` | Button | invoke | update check |
+| logs | `logs.openDirectory` | Button | invoke | ui-only shell boundary |
+
+Runtime enumeration is authoritative and may add stable IDs for containers,
+focusable status elements, application-owned dialogs, and keyboard commands.
+Provider rows use template `provider.row` with a normalized provider ID hash as
+`instanceKey`; visible text and list order never participate in identity.
+
+Native folder-picker internals are exempt because Windows owns them. The real
+browse button event and real `FolderBrowserDialog` still run; the external
+Headful driver selects a path inside the isolated root. Shell-open actions use
+an isolated launcher in Automation mode and verify the requested isolated
+path.
+
+## 7. GUI bridge and safety
+
+The bridge is disabled in normal mode. Automation launch requires an isolated
+root containing the sentinel `.codex-provider-sync-test-root` and a
+bootstrap descriptor created with user-only access. The descriptor contains a
+random pipe name and one-time token; the token is never placed on the command
+line or written to ordinary logs.
+
+Transport is a Windows named pipe with `PipeOptions.CurrentUserOnly`, one
+authenticated client, request allowlists, bounded messages, timeouts, and
+replay rejection. Paths must remain under the canonical isolated root. Normal
+mode, missing/wrong/replayed credentials, a second client, path traversal, and
+non-isolated dialog/capture paths are rejected.
+
+Capabilities:
+
+- `ui.launch` (harness/bootstrap)
+- `ui.describe`
+- `ui.snapshot`
+- `ui.get`
+- `ui.set`
+- `ui.invoke`
+- `ui.wait`
+- `ui.shutdown`
+
+Commands marshal to the actual WinForms UI thread. `ui.invoke` uses real
+control APIs (`PerformClick`, selection/text/check changes, and real window
+messages for keyboard paths). The external Headful driver operates real native
+and application-owned dialogs while the pending `ui.invoke` observes the real
+event and Application completion path. A deterministic operation gate can hold
+a real use case to test busy, disabled, cancel, and timeout states.
+
+Each business action emits:
+
+```text
+automationId -> GUI event -> operationId -> Application capability -> result
+```
+
+with UI-thread identity, event name, timestamps, structured outcome, redacted
+values, and schema-2 Application operation ID/kind/lifecycle records.
+
+## 8. Manifest and coverage gate
+
+The static manifest records window/region, control type, actions,
+visible/enabled conditions, Application capability or `ui-only`, risk,
+scenario IDs, and narrow exemptions. Runtime snapshots record created
+instances, visible/enabled/busy state, safe values/options, dialogs, and active
+operations.
+
+The gate fails for an unregistered interactive control, duplicate ID, missing
+template, unused manifest entry, unexecuted declared action, missing E2E
+mapping, missing business trace, or unjustified exemption. Required coverage is
+100% for declarations, runtime instances, and declared entry actions.
+
+Generated matrix:
+
+```text
+window -> automationId/templateId -> control -> action -> API
+       -> Application capability/ui-only -> test -> trace -> result
+```
+
+## 9. Isolated verification and one-command regression
+
+Every test process receives an explicit allowlisted environment with temporary
+`HOME`, `USERPROFILE`, `CODEX_HOME`, SQLite Home, AppData, LocalAppData, Temp,
+NuGet cache, npm cache, settings, backups, logs, captures, and fixture provider
+URLs using `example.invalid`. Credential-like inherited variables are removed.
+Every root contains the sentinel and every candidate read/write path is checked
+before launch. Tests refuse to start if isolation cannot be proven.
+
+The one-command Windows gate is invoked with:
+
+```powershell
+pwsh ./scripts/run-windows-gui-e2e.ps1
+```
+
+It performs Release publish, isolated fixture creation, real visible GUI
+launch, bridge authentication, manifest traversal, all Business and GUI
+scenarios, filesystem/result equivalence, trace/evidence/coverage generation,
+restart verification, and safe shutdown. A hidden or skipped run is not a
+Headful pass. Implementation commit `28c4dd4` passed the full-entry gate with
+40/40 manifest entries and 53/53 required scenarios; relevant implementation
+changes require a new run.
+
+Formal matrix:
+
+- all existing Node/.NET tests
+- transaction fault injection and crash recovery
+- Application unit and concurrency/cancellation tests
+- Business host process/schema/exit-code tests
+- bridge protocol and security tests
+- manifest/runtime/action/trace gate
+- sync/switch/restore/prune Business-vs-GUI filesystem equivalence
+- Windows Release publish and published-host invocation
+- real visible Windows Release GUI full-entry E2E and restart
+- macOS Core/Application build compatibility
+- release version and package-content verification
+- GitHub CI at the exact final head
+
+## 10. Version, packaging, and compatibility
+
+All shipped npm/.NET projects move together to `0.4.0`. The protocol remains
+experimental `0.4`; manifest and protocol versions identify incompatible
+changes. The Windows ZIP includes the GUI, Automation host, schema, and static
+manifest. No formal tag or Release is created in this work.
+
+## 11. PR #62 disposition
+
+Retained: layering, shared application behavior, structured machine protocol,
+plan/apply, explicit write opt-in, temporary fixtures, stable identifiers,
+schema validation, and package verification.
+
+Changed: no stable JSONL v1 promise; one-shot 0.4 JSON is the initial Business
+API; plan lifetime is evidence-driven; UI Automation is a real Headful bridge,
+not a hidden layout probe; the release may contain the companion executable
+because current requirements now justify it.
+
+Rejected: fixed five-minute lifetime as a permanent contract, a prematurely
+stable v1 surface, reflection-based MainForm invocation, hidden/mock GUI
+substitution, and future macOS migration as a v0.4 blocker.
+
+## 12. Milestones and gates
+
+- [x] M0a: read governing instructions and live GitHub state
+- [x] M0b: create integration worktree from exact PR #70 head
+- [x] M0c: isolated baseline bound to `b4308ee`
+- [x] M0d: independent architecture review and checkpoint push
+- [x] M1: #69 transaction/recovery implementation and fault matrix
+- [x] M2: complete shared Application use cases and WinForms migration
+- [x] M3: Business Automation host, schema, packaging, and process tests
+- [x] M4: GUI manifest, stable IDs, real-control bridge, trace, and safety
+- [x] M5: one-command Release Headful E2E and 100% entry/action gate
+- [x] M6: version/docs/release notes/migration notes and preview package
+- [x] M7: final exact-head local suite, policy-authorized Claude reliability
+  challenge, independent local final-diff/GitHub review, CI, and handoff report
+
+Completion is permitted only when every required item passes at the same final
+head. Otherwise the handoff states `PARTIAL-BLOCKED` with exact external
+blockers; touching real data or a protected boundary is `FAILED`.
diff --git a/package-lock.json b/package-lock.json
index eedbab1..17a4f82 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "codex-provider-sync",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codex-provider-sync",
-      "version": "0.3.2",
+      "version": "0.4.0",
       "license": "MIT",
       "bin": {
         "codex-provider": "src/cli.js"
diff --git a/package.json b/package.json
index 4932450..c3b0450 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "codex-provider-sync",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "Synchronize Codex session provider metadata across rollout files and SQLite state.",
   "type": "module",
   "files": [
diff --git a/scripts/publish-gui.ps1 b/scripts/publish-gui.ps1
index c2792ca..7486b6f 100644
--- a/scripts/publish-gui.ps1
+++ b/scripts/publish-gui.ps1
@@ -6,9 +6,22 @@ param(
 
 $ErrorActionPreference = "Stop"
 
-$repoRoot = Resolve-Path (Join-Path $PSScriptRoot "..")
+$repoRoot = [System.IO.Path]::GetFullPath((Resolve-Path (Join-Path $PSScriptRoot "..")).Path)
 $project = Join-Path $repoRoot "desktop\CodexProviderSync.App\CodexProviderSync.App.csproj"
-$outputDir = Join-Path $repoRoot $Output
+$automationProject = Join-Path $repoRoot "desktop\CodexProviderSync.Automation\CodexProviderSync.Automation.csproj"
+$outputDir = [System.IO.Path]::GetFullPath((Join-Path $repoRoot $Output))
+$automationOutputDir = [System.IO.Path]::GetFullPath("$outputDir-automation")
+
+function Assert-WorkspaceOutputPath([string]$Candidate, [string]$Label) {
+    $prefix = $repoRoot.TrimEnd([System.IO.Path]::DirectorySeparatorChar) + [System.IO.Path]::DirectorySeparatorChar
+    if ($Candidate.Equals($repoRoot, [System.StringComparison]::OrdinalIgnoreCase) `
+        -or -not $Candidate.StartsWith($prefix, [System.StringComparison]::OrdinalIgnoreCase)) {
+        throw "$Label must stay inside the repository workspace: $Candidate"
+    }
+}
+
+Assert-WorkspaceOutputPath $outputDir "Publish output"
+Assert-WorkspaceOutputPath $automationOutputDir "Automation staging output"
 
 if (Test-Path $outputDir) {
     try {
@@ -19,6 +32,10 @@ if (Test-Path $outputDir) {
     }
 }
 
+if (Test-Path $automationOutputDir) {
+    Remove-Item -Recurse -Force $automationOutputDir
+}
+
 dotnet publish $project `
     --runtime $Runtime `
     -c $Configuration `
@@ -31,7 +48,37 @@ dotnet publish $project `
     /p:DebugSymbols=false
 
 if ($LASTEXITCODE -ne 0) {
-    throw "dotnet publish failed with exit code $LASTEXITCODE"
+    throw "GUI dotnet publish failed with exit code $LASTEXITCODE"
+}
+
+try {
+    dotnet publish $automationProject `
+        --runtime $Runtime `
+        -c $Configuration `
+        --self-contained true `
+        -o $automationOutputDir `
+        /p:PublishSingleFile=true `
+        /p:IncludeNativeLibrariesForSelfExtract=true `
+        /p:EnableCompressionInSingleFile=true `
+        /p:DebugType=None `
+        /p:DebugSymbols=false
+
+    if ($LASTEXITCODE -ne 0) {
+        throw "Business Automation API dotnet publish failed with exit code $LASTEXITCODE"
+    }
+
+    $automationExecutable = Join-Path $automationOutputDir "CodexProviderSync.Automation.exe"
+    $automationSchema = Join-Path $automationOutputDir "automation-protocol-v0.4.schema.json"
+    if (-not (Test-Path -LiteralPath $automationExecutable) -or -not (Test-Path -LiteralPath $automationSchema)) {
+        throw "Business Automation API publish output is incomplete."
+    }
+    Copy-Item -LiteralPath $automationExecutable -Destination $outputDir -Force
+    Copy-Item -LiteralPath $automationSchema -Destination $outputDir -Force
+}
+finally {
+    if (Test-Path -LiteralPath $automationOutputDir) {
+        Remove-Item -Recurse -Force -LiteralPath $automationOutputDir
+    }
 }
 
-Write-Host "GUI build published to $outputDir"
+Write-Host "Windows GUI and Business Automation API published to $outputDir"
diff --git a/scripts/run-windows-gui-e2e.ps1 b/scripts/run-windows-gui-e2e.ps1
new file mode 100644
index 0000000..1e12366
--- /dev/null
+++ b/scripts/run-windows-gui-e2e.ps1
@@ -0,0 +1,268 @@
+param(
+    [string]$Runtime = "win-x64",
+    [string]$ArtifactsRoot = "artifacts\gui-e2e",
+    [int]$TimeoutSeconds = 90
+)
+
+$ErrorActionPreference = "Stop"
+
+if ([Environment]::OSVersion.Platform -ne [PlatformID]::Win32NT) {
+    throw "Real WinForms GUI E2E requires Windows. This is a FAIL, never a skip."
+}
+if (-not [Environment]::UserInteractive) {
+    throw "Real WinForms GUI E2E requires Environment.UserInteractive=true. This is a FAIL, never a skip."
+}
+if ($TimeoutSeconds -lt 15 -or $TimeoutSeconds -gt 600) {
+    throw "TimeoutSeconds must be between 15 and 600."
+}
+
+function ConvertTo-WindowsProcessArgument {
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyString()]
+        [string]$Value
+    )
+
+    if ($Value.Length -gt 0 -and $Value -notmatch '[\s"]') {
+        return $Value
+    }
+
+    $builder = [System.Text.StringBuilder]::new()
+    [void]$builder.Append('"')
+    $backslashes = 0
+    foreach ($character in $Value.ToCharArray()) {
+        if ($character -eq '\') {
+            $backslashes++
+            continue
+        }
+        if ($character -eq '"') {
+            [void]$builder.Append(('\' * (($backslashes * 2) + 1)))
+            [void]$builder.Append('"')
+            $backslashes = 0
+            continue
+        }
+        if ($backslashes -gt 0) {
+            [void]$builder.Append(('\' * $backslashes))
+            $backslashes = 0
+        }
+        [void]$builder.Append($character)
+    }
+    if ($backslashes -gt 0) {
+        [void]$builder.Append(('\' * ($backslashes * 2)))
+    }
+    [void]$builder.Append('"')
+    return $builder.ToString()
+}
+
+function Stop-GuiE2EProcessTree {
+    param(
+        [Parameter(Mandatory = $true)]
+        [System.Diagnostics.Process]$Process
+    )
+
+    $Process.Refresh()
+    if ($Process.HasExited) {
+        return
+    }
+
+    $taskkill = Join-Path $env:SystemRoot "System32\taskkill.exe"
+    if (Test-Path -LiteralPath $taskkill) {
+        try {
+            & $taskkill /PID $Process.Id /T /F | Out-Host
+        }
+        catch {
+            Write-Warning "taskkill could not terminate the full GUI E2E process tree: $($_.Exception.Message)"
+        }
+    }
+    $Process.Refresh()
+    if (-not $Process.HasExited) {
+        try {
+            $Process.Kill($true)
+        }
+        catch {
+            $Process.Refresh()
+            if (-not $Process.HasExited) {
+                $Process.Kill()
+            }
+        }
+    }
+    [void]$Process.WaitForExit(10000)
+}
+
+function Assert-EvidenceCondition {
+    param(
+        [Parameter(Mandatory = $true)]
+        [bool]$Condition,
+        [Parameter(Mandatory = $true)]
+        [string]$Message
+    )
+
+    if (-not $Condition) {
+        throw "GUI E2E evidence gate failed: $Message"
+    }
+}
+
+$repoRoot = [System.IO.Path]::GetFullPath((Resolve-Path (Join-Path $PSScriptRoot "..")).Path)
+$artifactsBase = [System.IO.Path]::GetFullPath((Join-Path $repoRoot $ArtifactsRoot))
+$workspacePrefix = $repoRoot.TrimEnd([System.IO.Path]::DirectorySeparatorChar) + [System.IO.Path]::DirectorySeparatorChar
+if ($artifactsBase.Equals($repoRoot, [System.StringComparison]::OrdinalIgnoreCase) `
+    -or -not $artifactsBase.StartsWith($workspacePrefix, [System.StringComparison]::OrdinalIgnoreCase)) {
+    throw "ArtifactsRoot must remain inside the repository workspace: $artifactsBase"
+}
+
+$runId = "{0}-{1}" -f (Get-Date).ToUniversalTime().ToString("yyyyMMddTHHmmssfffZ"), ([Guid]::NewGuid().ToString("N"))
+$runDirectory = Join-Path $artifactsBase $runId
+$publishDirectory = Join-Path $runDirectory "publish"
+$harnessDirectory = Join-Path $runDirectory "harness"
+$isolationRoot = Join-Path $runDirectory "isolation"
+$evidencePath = Join-Path $runDirectory "evidence.json"
+$relativePublish = $publishDirectory.Substring($workspacePrefix.Length)
+
+New-Item -ItemType Directory -Force -Path $runDirectory | Out-Null
+
+Write-Host "Publishing the real Windows GUI in Release mode..."
+& (Join-Path $PSScriptRoot "publish-gui.ps1") `
+    -Configuration Release `
+    -Runtime $Runtime `
+    -Output $relativePublish
+if ($LASTEXITCODE -ne 0) {
+    throw "Release GUI publish failed with exit code $LASTEXITCODE."
+}
+
+$appExe = Join-Path $publishDirectory "CodexProviderSync.exe"
+$manifest = Join-Path $publishDirectory "Automation\gui-automation-manifest.v0.4.json"
+if (-not (Test-Path -LiteralPath $appExe) -or -not (Test-Path -LiteralPath $manifest)) {
+    throw "Release publish did not contain CodexProviderSync.exe and its GUI automation manifest."
+}
+
+Write-Host "Building infrastructure contract tests in Release mode..."
+dotnet test (Join-Path $repoRoot "desktop\CodexProviderSync.GuiE2E.Tests\CodexProviderSync.GuiE2E.Tests.csproj") `
+    -c Release `
+    --nologo
+if ($LASTEXITCODE -ne 0) {
+    throw "GUI E2E infrastructure tests failed with exit code $LASTEXITCODE."
+}
+
+Write-Host "Publishing the headful GUI E2E driver in Release mode..."
+dotnet publish (Join-Path $repoRoot "desktop\CodexProviderSync.GuiE2E\CodexProviderSync.GuiE2E.csproj") `
+    -c Release `
+    --runtime $Runtime `
+    --self-contained true `
+    -o $harnessDirectory `
+    /p:PublishSingleFile=true `
+    /p:IncludeNativeLibrariesForSelfExtract=true `
+    /p:DebugType=None `
+    /p:DebugSymbols=false
+if ($LASTEXITCODE -ne 0) {
+    throw "GUI E2E driver publish failed with exit code $LASTEXITCODE."
+}
+
+$harnessExe = Join-Path $harnessDirectory "CodexProviderSync.GuiE2E.exe"
+$scenarios = Join-Path $harnessDirectory "assets\gui-e2e-scenarios.v0.4.json"
+if (-not (Test-Path -LiteralPath $harnessExe) -or -not (Test-Path -LiteralPath $scenarios)) {
+    throw "GUI E2E driver publish output is incomplete."
+}
+
+Write-Host "Launching the visible Release EXE and driving real controls/events..."
+$harnessArguments = [string[]]@(
+    "--exe", $appExe,
+    "--manifest", $manifest,
+    "--scenarios", $scenarios,
+    "--evidence", $evidencePath,
+    "--root", $isolationRoot,
+    "--timeout-seconds", $TimeoutSeconds.ToString([System.Globalization.CultureInfo]::InvariantCulture)
+)
+$startInfo = [System.Diagnostics.ProcessStartInfo]::new()
+$startInfo.FileName = $harnessExe
+$startInfo.UseShellExecute = $false
+$startInfo.CreateNoWindow = $false
+if ($null -ne $startInfo.PSObject.Properties["ArgumentList"]) {
+    foreach ($argument in $harnessArguments) {
+        [void]$startInfo.ArgumentList.Add($argument)
+    }
+}
+else {
+    $startInfo.Arguments = ($harnessArguments | ForEach-Object { ConvertTo-WindowsProcessArgument $_ }) -join " "
+}
+
+$harnessWatchdogSeconds = [Math]::Max(300, $TimeoutSeconds * 8)
+$harnessWatchdogMilliseconds = [int]($harnessWatchdogSeconds * 1000)
+$watchdogExitCode = 124
+$harnessProcess = [System.Diagnostics.Process]::Start($startInfo)
+$completedWithinWatchdog = $harnessProcess.WaitForExit($harnessWatchdogMilliseconds)
+if (-not $completedWithinWatchdog) {
+    $harnessProcess.Refresh()
+    if ($harnessProcess.HasExited) {
+        $completedWithinWatchdog = $true
+    }
+}
+
+if ($completedWithinWatchdog) {
+    $harnessExit = $harnessProcess.ExitCode
+}
+else {
+    Write-Host "GUI E2E watchdog expired after $harnessWatchdogSeconds seconds; terminating the harness and GUI process tree." -ForegroundColor Red
+    Stop-GuiE2EProcessTree -Process $harnessProcess
+    $harnessExit = $watchdogExitCode
+}
+$harnessProcess.Dispose()
+
+Write-Host "GUI E2E evidence: $evidencePath"
+Write-Host "GUI E2E isolated root: $isolationRoot"
+if ($harnessExit -ne 0) {
+    Write-Host "Real Windows GUI E2E failed with exit code $harnessExit. Inspect machine-readable evidence at $evidencePath" -ForegroundColor Red
+    exit $harnessExit
+}
+
+$evidenceGateFailure = $null
+try {
+    Assert-EvidenceCondition (Test-Path -LiteralPath $evidencePath -PathType Leaf) `
+        "the successful harness did not create evidence.json at $evidencePath"
+
+    $evidence = Get-Content -Raw -LiteralPath $evidencePath | ConvertFrom-Json
+    $expectedManifestEntries = 40
+    $expectedRequiredScenarios = 53
+    $errorRows = @($evidence.errors)
+    $blockerRows = @($evidence.blockers)
+    $scenarioRows = @($evidence.scenarios)
+    $invalidScenarioRows = @($scenarioRows | Where-Object { $_.status -ne "passed" })
+    $skippedOrBlockedRows = @($scenarioRows | Where-Object { $_.status -in @("skipped", "blocked") })
+
+    Assert-EvidenceCondition ($evidence.passed -eq $true) "passed was not true"
+    Assert-EvidenceCondition ($errorRows.Count -eq 0) "errors was not empty"
+    Assert-EvidenceCondition ($blockerRows.Count -eq 0) "blockers was not empty"
+    Assert-EvidenceCondition ($evidence.manifest.declaredEntryCount -eq $expectedManifestEntries) `
+        "declaredEntryCount was not $expectedManifestEntries"
+    Assert-EvidenceCondition ($evidence.manifest.coveredEntryCount -eq $expectedManifestEntries) `
+        "coveredEntryCount was not $expectedManifestEntries"
+    Assert-EvidenceCondition ($evidence.manifest.requiredHeadfulScenarioCount -eq $expectedRequiredScenarios) `
+        "requiredHeadfulScenarioCount was not $expectedRequiredScenarios"
+    Assert-EvidenceCondition ($evidence.manifest.passedRequiredHeadfulScenarioCount -eq $expectedRequiredScenarios) `
+        "passedRequiredHeadfulScenarioCount was not $expectedRequiredScenarios"
+    Assert-EvidenceCondition ($evidence.manifest.coveragePassed -eq $true) "coveragePassed was not true"
+    Assert-EvidenceCondition ($scenarioRows.Count -eq $expectedRequiredScenarios) `
+        "scenario row count was not $expectedRequiredScenarios"
+    Assert-EvidenceCondition ($invalidScenarioRows.Count -eq 0) "one or more required scenarios did not have status=passed"
+    Assert-EvidenceCondition ($skippedOrBlockedRows.Count -eq 0) "one or more required scenarios were skipped or blocked"
+    Assert-EvidenceCondition ((@($scenarioRows.id | Sort-Object -Unique)).Count -eq $expectedRequiredScenarios) `
+        "required scenario IDs were missing or duplicated"
+
+    $publishedExeSha256 = (Get-FileHash -LiteralPath $appExe -Algorithm SHA256).Hash.ToLowerInvariant()
+    $evidenceExeSha256 = [string]$evidence.executable.sha256
+    Assert-EvidenceCondition (-not [string]::IsNullOrWhiteSpace($evidenceExeSha256)) `
+        "executable.sha256 was missing"
+    Assert-EvidenceCondition ($publishedExeSha256.Equals($evidenceExeSha256, [System.StringComparison]::OrdinalIgnoreCase)) `
+        "published EXE SHA-256 did not match executable.sha256"
+}
+catch {
+    $evidenceGateFailure = $_.Exception.Message
+}
+
+if ($null -ne $evidenceGateFailure) {
+    Write-Host $evidenceGateFailure -ForegroundColor Red
+    Write-Host "Harness exited successfully, but its machine-readable evidence failed the release gate. Inspect $evidencePath" -ForegroundColor Red
+    exit 1
+}
+
+Write-Host "Real Windows GUI E2E PASS"
+exit 0
diff --git a/src/atomic-file.js b/src/atomic-file.js
new file mode 100644
index 0000000..4631aa9
--- /dev/null
+++ b/src/atomic-file.js
@@ -0,0 +1,81 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+
+const UNSUPPORTED_DIRECTORY_SYNC_CODES = new Set([
+  "EACCES",
+  "EBADF",
+  "EISDIR",
+  "EINVAL",
+  "ENOTSUP",
+  "EPERM"
+]);
+
+export async function syncDirectory(
+  directoryPath,
+  { fsImpl = fs, platform = process.platform } = {}
+) {
+  let handle;
+  try {
+    handle = await fsImpl.open(directoryPath, "r");
+    await handle.sync();
+  } catch (error) {
+    // Windows does not consistently allow directories to be opened and
+    // flushed through the Node fs API. The staged file itself is still
+    // flushed before rename; directory fsync remains mandatory wherever the
+    // host supports it.
+    if (platform !== "win32" || !UNSUPPORTED_DIRECTORY_SYNC_CODES.has(error?.code)) {
+      throw error;
+    }
+  } finally {
+    await handle?.close();
+  }
+}
+
+export async function writeFileAtomic(
+  filePath,
+  content,
+  encoding = "utf8",
+  { faultInjector } = {}
+) {
+  const fullPath = path.resolve(filePath);
+  const directory = path.dirname(fullPath);
+  const tempPath = path.join(
+    directory,
+    `.${path.basename(fullPath)}.provider-sync.${process.pid}.${randomUUID()}.tmp`
+  );
+  let originalMode = null;
+  try {
+    originalMode = (await fs.stat(fullPath)).mode;
+  } catch (error) {
+    if (error?.code !== "ENOENT") {
+      throw error;
+    }
+  }
+
+  try {
+    const handle = await fs.open(tempPath, "wx", originalMode ?? 0o600);
+    try {
+      await faultInjector?.({ point: "before_stage_write", filePath: fullPath, tempPath });
+      await handle.writeFile(content, encoding);
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    if (originalMode !== null) {
+      await fs.chmod(tempPath, originalMode);
+      const modeHandle = await fs.open(tempPath, "r+");
+      try {
+        await modeHandle.sync();
+      } finally {
+        await modeHandle.close();
+      }
+    }
+    await faultInjector?.({ point: "before_atomic_replace", filePath: fullPath, tempPath });
+    await fs.rename(tempPath, fullPath);
+    await syncDirectory(directory);
+  } catch (error) {
+    await fs.rm(tempPath, { force: true }).catch(() => {});
+    throw error;
+  }
+}
diff --git a/src/backup.js b/src/backup.js
index e01e316..8d0ca4c 100644
--- a/src/backup.js
+++ b/src/backup.js
@@ -1,5 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+import { randomUUID } from "node:crypto";
 
 import {
   BACKUP_NAMESPACE,
@@ -9,13 +10,25 @@ import {
   GLOBAL_STATE_BACKUP_FILE_BASENAME,
   GLOBAL_STATE_FILE_BASENAME
 } from "./constants.js";
-import { assertSessionFilesWritable, restoreSessionChanges } from "./session-files.js";
-import { assertSqliteWritable, detectStateDb } from "./sqlite-state.js";
+import { restoreSessionChanges } from "./session-files.js";
+import {
+  assertSqliteWritable,
+  createSqliteOnlineBackup,
+  detectStateDb,
+  restoreSqliteOnlineBackup
+} from "./sqlite-state.js";
 import {
   assertSqliteAccessSupported,
   resolveStorageLayout,
   withStateDbLocation
 } from "./storage-layout.js";
+import {
+  TRANSACTION_JOURNAL_BASENAME,
+  findPendingTransactions,
+  getStartedJournalTargets,
+  readTransactionJournal
+} from "./transaction-journal.js";
+import { syncDirectory, writeFileAtomic } from "./atomic-file.js";
 
 function timestampSlug(date = new Date()) {
   return date.toISOString().replaceAll(":", "").replaceAll("-", "").replace(".", "");
@@ -24,14 +37,51 @@ function timestampSlug(date = new Date()) {
 async function copyIfPresent(sourcePath, destinationPath) {
   try {
     await fs.access(sourcePath);
-  } catch {
-    return false;
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return false;
+    }
+    throw error;
   }
-  await fs.mkdir(path.dirname(destinationPath), { recursive: true });
-  await fs.copyFile(sourcePath, destinationPath);
+  await copyFileAtomic(sourcePath, destinationPath);
   return true;
 }
 
+async function copyFileAtomic(sourcePath, destinationPath) {
+  const fullDestination = path.resolve(destinationPath);
+  const directory = path.dirname(fullDestination);
+  const tempPath = path.join(
+    directory,
+    `.${path.basename(fullDestination)}.provider-sync.${process.pid}.${randomUUID()}.tmp`
+  );
+  await fs.mkdir(directory, { recursive: true });
+  try {
+    const sourceStat = await fs.stat(sourcePath);
+    await fs.copyFile(sourcePath, tempPath);
+    await fs.chmod(tempPath, sourceStat.mode);
+    const handle = await fs.open(tempPath, "r+");
+    try {
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await fs.rename(tempPath, fullDestination);
+    await syncDirectory(directory);
+  } catch (error) {
+    await fs.rm(tempPath, { force: true }).catch(() => {});
+    throw error;
+  }
+}
+
+async function syncFile(filePath) {
+  const handle = await fs.open(filePath, "r+");
+  try {
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+
 function restoreDbTargetPath(codexHome, relativePath) {
   if (path.isAbsolute(relativePath) || relativePath.split(/[\\/]/).includes("..")) {
     throw new Error(`Invalid database backup path: ${relativePath}`);
@@ -61,6 +111,66 @@ function storagePathsEqual(left, right) {
     : normalizedLeft === normalizedRight;
 }
 
+function pathComparisonKey(value) {
+  const resolved = path.resolve(value);
+  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+
+function pathIsWithin(root, target) {
+  const relativePath = path.relative(root, target);
+  return relativePath !== ""
+    && !relativePath.startsWith(`..${path.sep}`)
+    && relativePath !== ".."
+    && !path.isAbsolute(relativePath);
+}
+
+async function assertNoLinkedPathSegments(root, target) {
+  const relativePath = path.relative(root, target);
+  const segments = relativePath.split(path.sep).filter(Boolean);
+  let current = root;
+  for (const segment of [null, ...segments]) {
+    if (segment !== null) {
+      current = path.join(current, segment);
+    }
+    const stat = await fs.lstat(current);
+    if (stat.isSymbolicLink()) {
+      throw new Error(`Backup session target traverses a symbolic link or reparse point: ${current}`);
+    }
+  }
+}
+
+async function validateSessionManifestEntries(entries, codexHome) {
+  const roots = ["sessions", "archived_sessions"].map((name) => path.resolve(codexHome, name));
+  const seen = new Set();
+  for (const entry of entries) {
+    if (!entry || typeof entry.path !== "string" || !path.isAbsolute(entry.path)) {
+      throw new Error("Backup session manifest contains a missing or non-absolute rollout path.");
+    }
+    const target = path.resolve(entry.path);
+    const lexicalRoot = roots.find((root) => pathIsWithin(root, target));
+    if (!lexicalRoot || !/^rollout-.*\.jsonl$/i.test(path.basename(target))) {
+      throw new Error(`Backup session target is outside the allowed rollout roots: ${entry.path}`);
+    }
+    const key = pathComparisonKey(target);
+    if (seen.has(key)) {
+      throw new Error(`Backup session manifest contains a duplicate rollout target: ${entry.path}`);
+    }
+    seen.add(key);
+    await assertNoLinkedPathSegments(lexicalRoot, target);
+    const [canonicalRoot, canonicalTarget] = await Promise.all([
+      fs.realpath(lexicalRoot),
+      fs.realpath(target)
+    ]);
+    if (!pathIsWithin(canonicalRoot, canonicalTarget)) {
+      throw new Error(`Backup session target resolves outside the allowed rollout roots: ${entry.path}`);
+    }
+    const stat = await fs.stat(canonicalTarget);
+    if (!stat.isFile()) {
+      throw new Error(`Backup session target is not a regular file: ${entry.path}`);
+    }
+  }
+}
+
 function resolveRestoreSqliteHome(storage, metadata, stateDb) {
   if (stateDb) {
     return path.dirname(stateDb.path);
@@ -81,14 +191,49 @@ async function removeIfPresent(targetPath) {
 }
 
 async function backupGlobalStateFiles(codexHome, backupDir) {
+  const presence = {};
   for (const fileName of [GLOBAL_STATE_FILE_BASENAME, GLOBAL_STATE_BACKUP_FILE_BASENAME]) {
-    await copyIfPresent(path.join(codexHome, fileName), path.join(backupDir, fileName));
+    presence[fileName] = await copyIfPresent(
+      path.join(codexHome, fileName),
+      path.join(backupDir, fileName)
+    );
   }
+  return presence;
 }
 
-export async function restoreGlobalStateFilesFromBackup(backupDir, codexHome) {
+export async function restoreGlobalStateFilesFromBackup(backupDir, codexHome, options = {}) {
+  let metadata = null;
+  try {
+    metadata = JSON.parse(await fs.readFile(path.join(backupDir, "metadata.json"), "utf8"));
+  } catch (error) {
+    if (error?.code !== "ENOENT") {
+      throw error;
+    }
+  }
+  const selectedTargets = options.targetPaths
+    ? new Set(options.targetPaths.map(pathComparisonKey))
+    : null;
   for (const fileName of [GLOBAL_STATE_FILE_BASENAME, GLOBAL_STATE_BACKUP_FILE_BASENAME]) {
-    await copyIfPresent(path.join(backupDir, fileName), path.join(codexHome, fileName));
+    const targetPath = path.join(codexHome, fileName);
+    if (selectedTargets && !selectedTargets.has(pathComparisonKey(targetPath))) {
+      continue;
+    }
+    const sourcePath = path.join(backupDir, fileName);
+    const originalPresent = metadata?.globalStateFiles?.[fileName];
+    if (originalPresent === true) {
+      try {
+        await fs.access(sourcePath);
+      } catch {
+        throw new Error(`Backup metadata says ${fileName} was present, but its backup copy is missing.`);
+      }
+      await copyFileAtomic(sourcePath, targetPath);
+    } else if (originalPresent === false) {
+      await removeIfPresent(targetPath);
+    } else {
+      // Legacy metadata did not record absence, so preserve its copy-only
+      // behavior instead of deleting a file we cannot classify safely.
+      await copyIfPresent(sourcePath, targetPath);
+    }
   }
 }
 
@@ -115,29 +260,34 @@ export async function createBackup({
     : await detectStateDb(effectiveStorage);
   const actualSqliteHome = stateDb ? path.dirname(stateDb.path) : effectiveStorage.sqliteHome;
   if (stateDb) {
-    for (const suffix of ["", "-shm", "-wal"]) {
-      const sourcePath = `${stateDb.path}${suffix}`;
-      const sqliteRelativePath = `${DB_FILE_BASENAME}${suffix}`;
-      const copied = await copyIfPresent(sourcePath, path.join(dbDir, "sqlite-home", sqliteRelativePath));
-      if (!copied) {
-        continue;
-      }
-      copiedSqliteDbFiles.push(sqliteRelativePath);
-
-      const legacyRelativePath = safeRelativePath(codexHome, sourcePath);
-      if (legacyRelativePath) {
-        await copyIfPresent(sourcePath, path.join(dbDir, legacyRelativePath));
-        copiedDbFiles.push(legacyRelativePath);
-      }
+    const sqliteRelativePath = DB_FILE_BASENAME;
+    const sqliteBackupPath = path.join(dbDir, "sqlite-home", sqliteRelativePath);
+    const sqliteBackup = await createSqliteOnlineBackup(stateDb, sqliteBackupPath);
+    if (!sqliteBackup.databasePresent) {
+      throw new Error(`state_5.sqlite disappeared while creating a backup: ${stateDb.path}`);
+    }
+    copiedSqliteDbFiles.push(sqliteRelativePath);
+
+    // Keep the v2 legacy mirror for readers that still consult dbFiles, but
+    // derive it from the already-consistent standalone snapshot. Never copy
+    // live WAL/SHM sidecars independently into a managed backup.
+    const legacyRelativePath = safeRelativePath(codexHome, stateDb.path);
+    if (legacyRelativePath) {
+      await copyFileAtomic(sqliteBackupPath, path.join(dbDir, legacyRelativePath));
+      copiedDbFiles.push(legacyRelativePath);
     }
   }
 
   if (configBackupText !== undefined) {
-    await fs.writeFile(path.join(backupDir, "config.toml"), configBackupText, "utf8");
+    const configBackupPath = path.join(backupDir, "config.toml");
+    await writeFileAtomic(configBackupPath, configBackupText, "utf8");
+    const configStat = await fs.stat(configPath);
+    await fs.chmod(configBackupPath, configStat.mode);
+    await syncFile(configBackupPath);
   } else {
     await copyIfPresent(configPath, path.join(backupDir, "config.toml"));
   }
-  await backupGlobalStateFiles(codexHome, backupDir);
+  const globalStateFiles = await backupGlobalStateFiles(codexHome, backupDir);
 
   const sessionManifest = {
     version: 2,
@@ -145,6 +295,11 @@ export async function createBackup({
     codexHome,
     targetProvider,
     createdAt: new Date().toISOString(),
+    // Keep the full pre-mutation source of truth for the lifetime of the
+    // backup. appliedPaths is only a compatibility hint for backups without a
+    // transaction journal; journal `applying`/`applied` events decide which
+    // entries a transactional restore must compensate.
+    appliedPaths: null,
     files: sessionChanges.map((change) => ({
       path: change.path,
       originalFirstLine: change.originalFirstLine,
@@ -161,13 +316,13 @@ export async function createBackup({
       modelOnlyChange: Boolean(change.modelOnlyChange)
     }))
   };
-  await fs.writeFile(
+  await writeFileAtomic(
     path.join(backupDir, "session-meta-backup.json"),
     JSON.stringify(sessionManifest, null, 2),
     "utf8"
   );
 
-  await fs.writeFile(
+  await writeFileAtomic(
     path.join(backupDir, "metadata.json"),
     JSON.stringify(
       {
@@ -179,6 +334,7 @@ export async function createBackup({
         createdAt: sessionManifest.createdAt,
         dbFiles: copiedDbFiles,
         sqliteDbFiles: copiedSqliteDbFiles,
+        globalStateFiles,
         changedSessionFiles: sessionChanges.length
       },
       null,
@@ -190,7 +346,7 @@ export async function createBackup({
   return backupDir;
 }
 
-export async function updateSessionBackupManifest(backupDir, sessionChanges) {
+export async function updateSessionBackupManifest(backupDir, sessionChanges, options = {}) {
   const manifestPath = path.join(backupDir, "session-meta-backup.json");
   const metadataPath = path.join(backupDir, "metadata.json");
   const sessionManifest = JSON.parse(await fs.readFile(manifestPath, "utf8"));
@@ -202,18 +358,36 @@ export async function updateSessionBackupManifest(backupDir, sessionChanges) {
     sessionManifest.version = 2;
   }
 
-  sessionManifest.files = sessionChanges.map((change) => ({
-    path: change.path,
-    originalFirstLine: change.originalFirstLine,
-    originalSeparator: change.originalSeparator,
-    originalMtimeMs: change.originalMtimeMs,
-    originalTurnContextModels: change.originalTurnContextModels ?? [],
-    modelOnlyChange: Boolean(change.modelOnlyChange)
-  }));
+  const filesByPath = new Map(
+    (sessionManifest.files ?? []).map((entry) => [pathComparisonKey(entry.path), entry])
+  );
+  for (const change of sessionChanges) {
+    const existing = filesByPath.get(pathComparisonKey(change.path));
+    if (!existing) {
+      throw new Error(`Applied rollout is missing from the immutable backup manifest: ${change.path}`);
+    }
+    // Compatibility for callers that constructed a pre-v2 change without a
+    // scan-time model snapshot. Never remove or replace a full-original entry.
+    if ((!existing.originalTurnContextModels?.length)
+        && change.originalTurnContextModels?.length) {
+      existing.originalTurnContextModels = change.originalTurnContextModels;
+    }
+  }
+  sessionManifest.appliedPaths = sessionChanges.map((change) => path.resolve(change.path));
   metadata.changedSessionFiles = sessionChanges.length;
 
-  await fs.writeFile(manifestPath, JSON.stringify(sessionManifest, null, 2), "utf8");
-  await fs.writeFile(metadataPath, JSON.stringify(metadata, null, 2), "utf8");
+  await writeFileAtomic(
+    manifestPath,
+    JSON.stringify(sessionManifest, null, 2),
+    "utf8",
+    { faultInjector: options.faultInjector }
+  );
+  await writeFileAtomic(
+    metadataPath,
+    JSON.stringify(metadata, null, 2),
+    "utf8",
+    { faultInjector: options.faultInjector }
+  );
 }
 
 export async function getBackupSummary(codexHome) {
@@ -237,7 +411,13 @@ export async function pruneBackups(codexHome, keepCount = DEFAULT_BACKUP_RETENTI
 
   const backupRoot = defaultBackupRoot(codexHome);
   const backupDirs = await listManagedBackupDirectories(backupRoot);
-  const toDelete = backupDirs.slice(keepCount);
+  const pending = await findPendingTransactions(codexHome);
+  const protectedBackups = new Set(
+    pending.map((transaction) => pathComparisonKey(path.dirname(transaction.filePath)))
+  );
+  const toDelete = backupDirs
+    .slice(keepCount)
+    .filter((entry) => !protectedBackups.has(pathComparisonKey(entry.fullPath)));
   let freedBytes = 0;
   for (const entry of toDelete) {
     freedBytes += await getDirectorySize(entry.fullPath);
@@ -252,32 +432,162 @@ export async function pruneBackups(codexHome, keepCount = DEFAULT_BACKUP_RETENTI
   };
 }
 
+async function selectSessionRestoreEntries(backupDir, sessionManifest) {
+  const files = sessionManifest.files ?? [];
+  const journalPath = path.join(backupDir, TRANSACTION_JOURNAL_BASENAME);
+  try {
+    const journal = await readTransactionJournal(journalPath);
+    // A damaged tail cannot prove that no later target was mutated before its
+    // journal record became unreadable. Restore the immutable full-original
+    // manifest for any invalid/empty journal; only a fully valid prefix may
+    // narrow recovery to its applying/applied targets.
+    if (journal.invalidTail || journal.events.length === 0) {
+      return files;
+    }
+    if (journal.events.length > 0) {
+      const startedPaths = new Set(
+        getStartedJournalTargets(journal, "rollout").map(pathComparisonKey)
+      );
+      return files.filter((entry) => startedPaths.has(pathComparisonKey(entry.path)));
+    }
+  } catch (error) {
+    if (error?.code !== "ENOENT") {
+      throw error;
+    }
+  }
+
+  if (Array.isArray(sessionManifest.appliedPaths)) {
+    const applied = new Set(sessionManifest.appliedPaths.map(pathComparisonKey));
+    return files.filter((entry) => applied.has(pathComparisonKey(entry.path)));
+  }
+  return files;
+}
+
+async function readValidatedBackupMetadata(backupDir, codexHome) {
+  const metadataPath = path.join(backupDir, "metadata.json");
+  const metadata = JSON.parse(await fs.readFile(metadataPath, "utf8"));
+  if (metadata.namespace !== BACKUP_NAMESPACE || ![1, 2].includes(metadata.version)) {
+    throw new Error(`Unsupported backup metadata in ${metadataPath}.`);
+  }
+  if (typeof metadata.codexHome !== "string" || !storagePathsEqual(metadata.codexHome, codexHome)) {
+    throw new Error(`Backup was created for ${metadata.codexHome}, not ${codexHome}.`);
+  }
+  return metadata;
+}
+
+async function backupFileExists(filePath) {
+  try {
+    await fs.access(filePath);
+    return true;
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+
+export async function getBackupRecoveryCoverage(backupDir, storageOrCodexHome) {
+  const storage = typeof storageOrCodexHome === "string"
+    ? resolveStorageLayout({ codexHome: storageOrCodexHome, env: {} })
+    : storageOrCodexHome;
+  const codexHome = storage.codexHome;
+  const metadata = await readValidatedBackupMetadata(backupDir, codexHome);
+  const databaseFiles = metadata.version >= 2
+    ? metadata.sqliteDbFiles
+    : metadata.dbFiles;
+  if (!Array.isArray(databaseFiles)
+      || databaseFiles.some((fileName) => typeof fileName !== "string")) {
+    throw new Error(`Backup metadata contains an invalid SQLite file manifest: ${path.join(backupDir, "metadata.json")}`);
+  }
+  for (const fileName of databaseFiles) {
+    if (path.isAbsolute(fileName) || fileName.split(/[\\/]/).includes("..")) {
+      throw new Error(`Invalid SQLite backup path: ${fileName}`);
+    }
+  }
+
+  const sessionManifestPath = path.join(backupDir, "session-meta-backup.json");
+  const sessionManifest = JSON.parse(await fs.readFile(sessionManifestPath, "utf8"));
+  if (sessionManifest.namespace !== BACKUP_NAMESPACE || ![1, 2].includes(sessionManifest.version)) {
+    throw new Error(`Unsupported session backup manifest in ${sessionManifestPath}.`);
+  }
+  if (typeof sessionManifest.codexHome !== "string"
+      || !storagePathsEqual(sessionManifest.codexHome, codexHome)) {
+    throw new Error(`Session backup was created for ${sessionManifest.codexHome}, not ${codexHome}.`);
+  }
+  if (!Array.isArray(sessionManifest.files)) {
+    throw new Error(`Session backup manifest has an invalid files collection: ${sessionManifestPath}`);
+  }
+  await validateSessionManifestEntries(sessionManifest.files, codexHome);
+
+  let globalState = false;
+  if (metadata.version >= 2) {
+    if (!metadata.globalStateFiles
+        || typeof metadata.globalStateFiles !== "object"
+        || Array.isArray(metadata.globalStateFiles)) {
+      throw new Error(`Backup metadata contains invalid global-state presence data: ${path.join(backupDir, "metadata.json")}`);
+    }
+    for (const fileName of [GLOBAL_STATE_FILE_BASENAME, GLOBAL_STATE_BACKUP_FILE_BASENAME]) {
+      if (typeof metadata.globalStateFiles[fileName] !== "boolean") {
+        throw new Error(
+          `Backup metadata lacks a boolean presence record for ${fileName}: ${path.join(backupDir, "metadata.json")}`
+        );
+      }
+    }
+    // A complete v2 presence map is itself recovery coverage. Two false
+    // values mean rollback must delete both targets, not that there is no
+    // global-state work to restore.
+    globalState = true;
+  } else {
+    globalState = await backupFileExists(path.join(backupDir, GLOBAL_STATE_FILE_BASENAME))
+      || await backupFileExists(path.join(backupDir, GLOBAL_STATE_BACKUP_FILE_BASENAME));
+  }
+
+  return {
+    config: await backupFileExists(path.join(backupDir, "config.toml")),
+    globalState,
+    database: databaseFiles.some((fileName) => path.basename(fileName) === DB_FILE_BASENAME),
+    sessions: sessionManifest.files.length > 0
+  };
+}
+
 export async function restoreBackup(backupDir, storageOrCodexHome, options = {}) {
   const {
     restoreConfig = true,
+    restoreGlobalState = restoreConfig,
     restoreDatabase = true,
     restoreSessions = true,
-    allowSqliteHomeRelocation = false
+    allowSqliteHomeRelocation = false,
+    globalStateTargetPaths = null,
+    sessionTargetPaths = null
   } = options;
   const storage = typeof storageOrCodexHome === "string"
     ? resolveStorageLayout({ codexHome: storageOrCodexHome, env: {} })
     : storageOrCodexHome;
   assertSqliteAccessSupported(storage, "restore");
   const codexHome = storage.codexHome;
-  const metadataPath = path.join(backupDir, "metadata.json");
-  const metadata = JSON.parse(await fs.readFile(metadataPath, "utf8"));
-  if (metadata.namespace !== BACKUP_NAMESPACE || ![1, 2].includes(metadata.version)) {
-    throw new Error(`Unsupported backup metadata in ${metadataPath}.`);
-  }
-  if (metadata.codexHome !== codexHome) {
-    throw new Error(`Backup was created for ${metadata.codexHome}, not ${codexHome}.`);
-  }
+  const metadata = await readValidatedBackupMetadata(backupDir, codexHome);
 
   let sessionManifest = null;
+  let sessionRestoreEntries = [];
   if (restoreSessions) {
     const sessionManifestPath = path.join(backupDir, "session-meta-backup.json");
     sessionManifest = JSON.parse(await fs.readFile(sessionManifestPath, "utf8"));
-    await assertSessionFilesWritable(sessionManifest.files ?? []);
+    if (sessionManifest.namespace !== BACKUP_NAMESPACE || ![1, 2].includes(sessionManifest.version)) {
+      throw new Error(`Unsupported session backup manifest in ${sessionManifestPath}.`);
+    }
+    if (typeof sessionManifest.codexHome !== "string"
+        || !storagePathsEqual(sessionManifest.codexHome, codexHome)) {
+      throw new Error(`Session backup was created for ${sessionManifest.codexHome}, not ${codexHome}.`);
+    }
+    await validateSessionManifestEntries(sessionManifest.files ?? [], codexHome);
+    if (sessionTargetPaths) {
+      const selected = new Set(sessionTargetPaths.map(pathComparisonKey));
+      sessionRestoreEntries = (sessionManifest.files ?? [])
+        .filter((entry) => selected.has(pathComparisonKey(entry.path)));
+    } else {
+      sessionRestoreEntries = await selectSessionRestoreEntries(backupDir, sessionManifest);
+    }
   }
 
   let stateDb = null;
@@ -333,39 +643,32 @@ export async function restoreBackup(backupDir, storageOrCodexHome, options = {})
       entries.push({ fileName, sourcePath, targetPath });
     }
 
-    const backedUpFiles = new Set(databaseFiles);
-    const sidecarsToRemove = [];
-    for (const baseFile of databaseFiles.filter((fileName) => path.basename(fileName) === DB_FILE_BASENAME)) {
-      const basePath = metadata.version >= 2
-        ? restoreSqliteTargetPath(restoreRoot, baseFile)
-        : restoreDbTargetPath(restoreRoot, baseFile);
-      for (const suffix of ["-shm", "-wal"]) {
-        if (!backedUpFiles.has(`${baseFile}${suffix}`)) {
-          sidecarsToRemove.push(`${basePath}${suffix}`);
-        }
-      }
+    const mainEntries = entries.filter(({ fileName }) => path.basename(fileName) === DB_FILE_BASENAME);
+    if (mainEntries.length !== 1) {
+      throw new Error("Backup must contain exactly one state_5.sqlite restore source.");
     }
-    databaseRestorePlan = { entries, sidecarsToRemove };
+    databaseRestorePlan = mainEntries[0];
   }
 
   const configBackupPath = path.join(backupDir, "config.toml");
   if (restoreConfig) {
     await copyIfPresent(configBackupPath, path.join(codexHome, "config.toml"));
-    await restoreGlobalStateFilesFromBackup(backupDir, codexHome);
+  }
+  if (restoreGlobalState) {
+    await restoreGlobalStateFilesFromBackup(backupDir, codexHome, {
+      targetPaths: globalStateTargetPaths
+    });
   }
 
   if (databaseRestorePlan) {
-    for (const sidecarPath of databaseRestorePlan.sidecarsToRemove) {
-      await removeIfPresent(sidecarPath);
-    }
-    for (const { sourcePath, targetPath } of databaseRestorePlan.entries) {
-      await fs.mkdir(path.dirname(targetPath), { recursive: true });
-      await fs.copyFile(sourcePath, targetPath);
-    }
+    await restoreSqliteOnlineBackup(
+      databaseRestorePlan.sourcePath,
+      databaseRestorePlan.targetPath
+    );
   }
 
   if (restoreSessions) {
-    await restoreSessionChanges(sessionManifest.files ?? []);
+    await restoreSessionChanges(sessionRestoreEntries);
   }
 
   return metadata;
diff --git a/src/config-file.js b/src/config-file.js
index 479f111..4803760 100644
--- a/src/config-file.js
+++ b/src/config-file.js
@@ -1,4 +1,5 @@
 import fs from "node:fs/promises";
+import { writeFileAtomic } from "./atomic-file.js";
 
 import { DEFAULT_PROVIDER } from "./constants.js";
 
@@ -219,5 +220,5 @@ export function setRootModelInConfigText(configText, model) {
 }
 
 export async function writeConfigText(configPath, configText) {
-  await fs.writeFile(configPath, configText, "utf8");
+  await writeFileAtomic(configPath, configText, "utf8");
 }
diff --git a/src/locking.js b/src/locking.js
index d78ab35..b90ab30 100644
--- a/src/locking.js
+++ b/src/locking.js
@@ -1,77 +1,760 @@
+import { execFile } from "node:child_process";
+import { randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { promisify } from "node:util";
 
 import { DEFAULT_LOCK_NAME } from "./constants.js";
+import { syncDirectory } from "./atomic-file.js";
 
+const execFileAsync = promisify(execFile);
 const DEFAULT_LOCK_CREATE_RETRY_COUNT = 3;
 const DEFAULT_LOCK_CREATE_RETRY_DELAY_MS = 75;
+const DEFAULT_STALE_RECLAIM_ATTEMPT_LIMIT = 8;
 
 function isTransientLockCreateError(error) {
-  return error?.code === "EPERM";
+  return error?.code === "EPERM" || error?.code === "EACCES";
 }
 
 async function sleep(delayMs) {
   await new Promise((resolve) => setTimeout(resolve, delayMs));
 }
 
-async function createLockDirectory(lockDir, {
+async function processExists(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    if (error?.code === "ESRCH") {
+      return false;
+    }
+    if (error?.code === "EPERM") {
+      return true;
+    }
+    throw error;
+  }
+}
+
+async function getProcessStartMarker(pid) {
+  if (!Number.isInteger(pid) || pid <= 0 || !(await processExists(pid))) {
+    return null;
+  }
+  if (process.platform === "win32") {
+    const { stdout } = await execFileAsync("powershell.exe", [
+      "-NoProfile",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-Command",
+      `(Get-Process -Id ${pid} -ErrorAction Stop).StartTime.ToUniversalTime().Ticks`
+    ]);
+    const marker = stdout.trim();
+    if (!/^\d+$/.test(marker)) {
+      throw new Error(`Unable to verify process start identity for PID ${pid}.`);
+    }
+    return `windows:${marker}`;
+  }
+  if (process.platform === "linux") {
+    try {
+      const [stat, bootId] = await Promise.all([
+        fs.readFile(`/proc/${pid}/stat`, "utf8"),
+        fs.readFile("/proc/sys/kernel/random/boot_id", "utf8")
+      ]);
+      const closeParen = stat.lastIndexOf(")");
+      const fieldsAfterCommand = stat.slice(closeParen + 2).trim().split(/\s+/);
+      const startTicks = fieldsAfterCommand[19];
+      if (!startTicks) {
+        throw new Error("missing process start ticks");
+      }
+      return `linux:${bootId.trim()}:${startTicks}`;
+    } catch (error) {
+      if (error?.code === "ENOENT") {
+        return null;
+      }
+      throw error;
+    }
+  }
+  const { stdout } = await execFileAsync("ps", ["-p", String(pid), "-o", "lstart="] , {
+    env: { ...process.env, LC_ALL: "C", LANG: "C" }
+  });
+  const marker = stdout.trim().replace(/\s+/g, " ");
+  return marker ? `${process.platform}:${marker}` : null;
+}
+
+function lockExistsError(lockDir, reason) {
+  return new Error(
+    `Lock already exists at ${lockDir}. ${reason} Close Codex/App and retry; do not remove it unless the recorded owner is known to be gone.`
+  );
+}
+
+function processStartedAtFromMarker(marker) {
+  const windowsTicks = /^windows:(\d+)$/.exec(marker ?? "");
+  if (windowsTicks) {
+    try {
+      const unixEpochTicks = 621355968000000000n;
+      const milliseconds = (BigInt(windowsTicks[1]) - unixEpochTicks) / 10000n;
+      return toUtcSecond(new Date(Number(milliseconds)));
+    } catch {
+      return null;
+    }
+  }
+
+  const calendarStart = /^[^:]+:(.+)$/.exec(marker ?? "")?.[1];
+  if (calendarStart && !marker.startsWith("linux:")) {
+    const parsed = Date.parse(calendarStart);
+    return Number.isFinite(parsed) ? toUtcSecond(new Date(parsed)) : null;
+  }
+  return null;
+}
+
+function toUtcSecond(value) {
+  const milliseconds = value instanceof Date ? value.getTime() : Date.parse(value);
+  if (!Number.isFinite(milliseconds)) {
+    return null;
+  }
+  return new Date(Math.floor(milliseconds / 1000) * 1000).toISOString();
+}
+
+async function getProcessStartedAt(pid, marker) {
+  const fromMarker = processStartedAtFromMarker(marker);
+  if (fromMarker) {
+    return fromMarker;
+  }
+  const { stdout } = await execFileAsync("ps", ["-p", String(pid), "-o", "lstart="], {
+    env: { ...process.env, LC_ALL: "C", LANG: "C" }
+  });
+  const startedAt = stdout.trim().replace(/\s+/g, " ");
+  return startedAt ? toUtcSecond(startedAt) : null;
+}
+
+function ownerGeneration(owner) {
+  return owner.instanceId ?? owner.rawText;
+}
+
+function ownerMatchesExpected(actual, expected) {
+  return actual.pid === expected.pid
+    && ownerGeneration(actual) === ownerGeneration(expected)
+    && actual.processStartMarker === expected.processStartMarker
+    && actual.processStartedAt === expected.processStartedAt;
+}
+
+function liveIdentityMatchesOwner(liveMarker, liveStartedAt, owner) {
+  if (!liveMarker) {
+    return false;
+  }
+  if (owner.processStartMarker
+      && (owner.runtime === "node" || owner.protocolVersion !== 2)) {
+    return liveMarker === owner.processStartMarker;
+  }
+  if (owner.protocolVersion >= 2 && owner.processStartedAt) {
+    if (!liveStartedAt) {
+      // A live PID whose start time cannot be compared safely is retained.
+      // This is preferable to reclaiming another runtime's active lock.
+      return true;
+    }
+    return Math.abs(Date.parse(liveStartedAt) - Date.parse(owner.processStartedAt)) < 1000;
+  }
+  if (owner.processStartMarker) {
+    return liveMarker === owner.processStartMarker;
+  }
+  if (owner.processStartedAt) {
+    if (!liveStartedAt) {
+      return true;
+    }
+    return Math.abs(Date.parse(liveStartedAt) - Date.parse(owner.processStartedAt)) < 1000;
+  }
+  return true;
+}
+
+async function readLockOwner(ownerPath, fsImpl) {
+  let text;
+  try {
+    text = await fsImpl.readFile(ownerPath, "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      const missingOwner = lockExistsError(
+        path.dirname(ownerPath),
+        "owner.json is not visible yet, so ownership cannot be proven safely."
+      );
+      missingOwner.code = "ENOENT";
+      throw missingOwner;
+    }
+    throw error;
+  }
+  let owner;
+  try {
+    owner = JSON.parse(text);
+  } catch {
+    throw lockExistsError(path.dirname(ownerPath), "owner.json is malformed, so the lock is retained fail-closed.");
+  }
+  const protocolVersion = owner?.protocolVersion;
+  if (protocolVersion !== undefined
+      && (!Number.isInteger(protocolVersion) || protocolVersion < 1 || protocolVersion > 2)) {
+    throw lockExistsError(
+      path.dirname(ownerPath),
+      `owner.json uses unsupported lock protocol ${String(protocolVersion)}.`
+    );
+  }
+  const hasPid = Number.isInteger(owner?.pid);
+  const hasProcessId = Number.isInteger(owner?.processId);
+  if (hasPid && hasProcessId && owner.pid !== owner.processId) {
+    throw lockExistsError(path.dirname(ownerPath), "owner.json has conflicting pid and processId values.");
+  }
+  const pid = hasPid ? owner.pid : owner?.processId;
+  const processStartMarker = typeof owner?.processStartMarker === "string"
+    && owner.processStartMarker
+    ? owner.processStartMarker
+    : null;
+  const processStartedAt = typeof owner?.processStartedAt === "string"
+    && Number.isFinite(Date.parse(owner.processStartedAt))
+    ? toUtcSecond(owner.processStartedAt)
+    : null;
+  const instanceId = typeof owner?.instanceId === "string" && owner.instanceId
+    ? owner.instanceId
+    : null;
+  if (protocolVersion === 2
+      && (!hasPid || !hasProcessId || !processStartedAt || !instanceId)) {
+    throw lockExistsError(
+      path.dirname(ownerPath),
+      "owner.json is missing required version 2 identity fields."
+    );
+  }
+  if (!Number.isInteger(pid)
+      || pid <= 0
+      || (!processStartMarker && !processStartedAt && !Number.isInteger(owner?.processId))) {
+    throw lockExistsError(path.dirname(ownerPath), "owner.json lacks a verifiable process identity.");
+  }
+  return {
+    ...owner,
+    pid,
+    processId: pid,
+    processStartMarker,
+    processStartedAt,
+    instanceId,
+    rawText: text
+  };
+}
+
+function directoryIdentity(stats) {
+  return `${String(stats.dev)}:${String(stats.ino)}`;
+}
+
+function sameDirectoryIdentity(left, right) {
+  return left !== null && right !== null && left === right;
+}
+
+async function lstatOrNull(targetPath, fsImpl) {
+  try {
+    return await fsImpl.lstat(targetPath, { bigint: true });
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+
+async function inspectCanonicalDirectory(lockDir, fsImpl) {
+  const stats = await lstatOrNull(lockDir, fsImpl);
+  if (!stats) {
+    return null;
+  }
+  if (stats.isSymbolicLink()) {
+    throw lockExistsError(lockDir, "The canonical lock path is a symbolic link and is retained fail-closed.");
+  }
+  if (!stats.isDirectory()) {
+    throw lockExistsError(lockDir, "The canonical lock path is not a directory and is retained fail-closed.");
+  }
+  return directoryIdentity(stats);
+}
+
+async function restoreQuarantinedOwner(
+  sourceDir,
+  lockDir,
   fsImpl,
-  retryCount,
-  retryDelayMs,
-  sleepImpl
-}) {
+  syncDirectoryImpl,
+  platform
+) {
+  const parentDir = path.dirname(lockDir);
+  let reservationIdentity = null;
+  try {
+    await fsImpl.mkdir(lockDir, { mode: 0o700 });
+    reservationIdentity = await inspectCanonicalDirectory(lockDir, fsImpl);
+    await fsImpl.link(
+      path.join(sourceDir, "owner.json"),
+      path.join(lockDir, "owner.json")
+    );
+    const publishedIdentity = await inspectCanonicalDirectory(lockDir, fsImpl);
+    if (!sameDirectoryIdentity(reservationIdentity, publishedIdentity)) {
+      return false;
+    }
+    await syncDirectoryImpl(lockDir, { fsImpl, platform });
+    await syncDirectoryImpl(parentDir, { fsImpl, platform });
+    return true;
+  } catch {
+    // The quarantined generation remains available for diagnosis. Never use
+    // rename here: POSIX rename may replace a concurrently-created empty dir.
+    return false;
+  }
+}
+
+async function quarantineStaleLock(
+  lockDir,
+  expectedOwner,
+  expectedDirectoryIdentity,
+  fsImpl,
+  syncDirectoryImpl,
+  platform
+) {
+  const quarantinePath = `${lockDir}.stale.${Date.now()}.${randomUUID()}`;
+  try {
+    await fsImpl.rename(lockDir, quarantinePath);
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+
+  let quarantinedOwner;
+  try {
+    quarantinedOwner = await readLockOwner(path.join(quarantinePath, "owner.json"), fsImpl);
+  } catch (error) {
+    await restoreQuarantinedOwner(
+      quarantinePath,
+      lockDir,
+      fsImpl,
+      syncDirectoryImpl,
+      platform
+    );
+    throw error;
+  }
+  const quarantinedStats = await lstatOrNull(quarantinePath, fsImpl);
+  const quarantinedIdentity = quarantinedStats?.isDirectory()
+    ? directoryIdentity(quarantinedStats)
+    : null;
+  if (!ownerMatchesExpected(quarantinedOwner, expectedOwner)
+      || !sameDirectoryIdentity(quarantinedIdentity, expectedDirectoryIdentity)) {
+    const restored = await restoreQuarantinedOwner(
+      quarantinePath,
+      lockDir,
+      fsImpl,
+      syncDirectoryImpl,
+      platform
+    );
+    throw lockExistsError(
+      lockDir,
+      restored
+        ? "The lock generation changed during stale-lock reclamation, so its owner was restored without replacing another directory."
+        : `The owner changed during stale-lock reclamation; its lock is preserved at ${quarantinePath}.`
+    );
+  }
+  await fsImpl.rm(quarantinePath, { recursive: true, force: true });
+  return true;
+}
+
+async function createCandidateDirectory(candidateDir, fsImpl, retryCount, retryDelayMs, sleepImpl) {
   let attempts = 0;
   while (true) {
     try {
-      await fsImpl.mkdir(lockDir);
+      await fsImpl.mkdir(candidateDir, { mode: 0o700 });
       return;
     } catch (error) {
-      if (error && error.code === "EEXIST") {
-        throw new Error(`Lock already exists at ${lockDir}. Close Codex/App and retry, or remove the stale lock if you are sure no sync is running.`);
-      }
-
-      // Windows can briefly surface EPERM after a previous run releases the lock directory.
       if (!isTransientLockCreateError(error) || attempts >= retryCount) {
         throw error;
       }
-
       attempts += 1;
       await sleepImpl(retryDelayMs);
     }
   }
 }
 
+async function removeOwnedCanonical(
+  lockDir,
+  owner,
+  fsImpl,
+  syncDirectoryImpl,
+  platform,
+  expectedDirectoryIdentity,
+  suffix = "release"
+) {
+  const parentDir = path.dirname(lockDir);
+  const removalPath = `${lockDir}.${suffix}.${process.pid}.${randomUUID()}`;
+  const currentDirectoryIdentity = await inspectCanonicalDirectory(lockDir, fsImpl);
+  if (!sameDirectoryIdentity(currentDirectoryIdentity, expectedDirectoryIdentity)) {
+    throw new Error(`Refusing to remove lock ${lockDir} because its directory identity changed.`);
+  }
+  await fsImpl.rename(lockDir, removalPath);
+  const currentOwner = await readLockOwner(path.join(removalPath, "owner.json"), fsImpl);
+  const removalStats = await lstatOrNull(removalPath, fsImpl);
+  const removalIdentity = removalStats?.isDirectory()
+    ? directoryIdentity(removalStats)
+    : null;
+  if (!ownerMatchesExpected(currentOwner, owner)
+      || !sameDirectoryIdentity(removalIdentity, expectedDirectoryIdentity)) {
+    const restored = await restoreQuarantinedOwner(
+      removalPath,
+      lockDir,
+      fsImpl,
+      syncDirectoryImpl,
+      platform
+    );
+    throw new Error(
+      restored
+        ? `Refusing to remove lock ${lockDir} because its generation changed; its owner was restored safely.`
+        : `Refusing to remove lock ${lockDir}; the changed owner is preserved at ${removalPath}.`
+    );
+  }
+  await fsImpl.rm(removalPath, { recursive: true, force: true });
+  await syncDirectoryImpl(parentDir, { fsImpl, platform });
+}
+
+async function publishClaim(claimsDir, owner, fsImpl, syncDirectoryImpl, platform) {
+  const claimPath = path.join(claimsDir, `${owner.instanceId}.json`);
+  const candidatePath = path.join(
+    claimsDir,
+    `.${owner.instanceId}.${process.pid}.${randomUUID()}.tmp`
+  );
+  const handle = await fsImpl.open(candidatePath, "wx", 0o600);
+  try {
+    await handle.writeFile(JSON.stringify(owner, null, 2), "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  try {
+    await fsImpl.rename(candidatePath, claimPath);
+    await syncDirectoryImpl(claimsDir, { fsImpl, platform });
+    return claimPath;
+  } catch (error) {
+    await fsImpl.rm(candidatePath, { force: true }).catch(() => {});
+    throw error;
+  }
+}
+
+async function isOwnerLive(owner, getProcessIdentity, getProcessStartedAtIdentity) {
+  const liveMarker = await getProcessIdentity(owner.pid);
+  if (!liveMarker) {
+    return false;
+  }
+  let liveStartedAt = null;
+  try {
+    liveStartedAt = await getProcessStartedAtIdentity(owner.pid, liveMarker);
+  } catch {
+    // The exact Node process marker remains sufficient for legacy/current
+    // Node owners. Cross-runtime owners fail closed if their start time cannot
+    // be inspected.
+  }
+  return liveIdentityMatchesOwner(liveMarker, liveStartedAt, owner);
+}
+
+async function establishUniqueClaim({
+  claimsDir,
+  claimPath,
+  owner,
+  fsImpl,
+  getProcessIdentity,
+  getProcessStartedAtIdentity,
+  syncDirectoryImpl,
+  platform
+}) {
+  for (let scan = 0; scan < 2; scan += 1) {
+    const entries = await fsImpl.readdir(claimsDir, { withFileTypes: true });
+    entries.sort((left, right) => left.name.localeCompare(right.name));
+    for (const entry of entries) {
+      if (!entry.isFile() || !entry.name.endsWith(".json")) {
+        continue;
+      }
+      const otherPath = path.join(claimsDir, entry.name);
+      if (path.resolve(otherPath) === path.resolve(claimPath)) {
+        continue;
+      }
+      const otherOwner = await readLockOwner(otherPath, fsImpl);
+      if (!otherOwner.instanceId || entry.name !== `${otherOwner.instanceId}.json`) {
+        throw lockExistsError(claimsDir, `Claim ${otherPath} has no matching immutable instance identity.`);
+      }
+      let live;
+      try {
+        live = await isOwnerLive(otherOwner, getProcessIdentity, getProcessStartedAtIdentity);
+      } catch (identityError) {
+        throw lockExistsError(
+          claimsDir,
+          `Claim ${otherPath} could not be verified (${identityError.message}).`
+        );
+      }
+      if (live) {
+        throw lockExistsError(claimsDir, `PID ${otherOwner.pid} holds live claim ${entry.name}.`);
+      }
+      // The filename is a never-reused instance generation. Removing this one
+      // stale file cannot delete a newer claimant's record.
+      await fsImpl.rm(otherPath, { force: true });
+      await syncDirectoryImpl(claimsDir, { fsImpl, platform });
+    }
+  }
+
+  const currentOwner = await readLockOwner(claimPath, fsImpl);
+  if (currentOwner.instanceId !== owner.instanceId) {
+    throw new Error(`Refusing to use claim ${claimPath} because its owner identity changed.`);
+  }
+}
+
+async function removeOwnedClaim(claimPath, owner, fsImpl, syncDirectoryImpl, platform) {
+  let currentOwner;
+  try {
+    currentOwner = await readLockOwner(claimPath, fsImpl);
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return;
+    }
+    throw error;
+  }
+  if (currentOwner.instanceId !== owner.instanceId) {
+    throw new Error(`Refusing to remove claim ${claimPath} because its owner identity changed.`);
+  }
+  await fsImpl.rm(claimPath, { force: true });
+  await syncDirectoryImpl(path.dirname(claimPath), { fsImpl, platform });
+}
+
 export async function acquireLock(codexHome, label = "codex-provider-sync", options = {}) {
+  return acquirePathLock(
+    path.join(codexHome, "tmp", DEFAULT_LOCK_NAME),
+    label,
+    options
+  );
+}
+
+export async function acquirePathLock(lockPath, label = "codex-provider-sync", options = {}) {
   const {
     fsImpl = fs,
     retryCount = DEFAULT_LOCK_CREATE_RETRY_COUNT,
     retryDelayMs = DEFAULT_LOCK_CREATE_RETRY_DELAY_MS,
-    sleepImpl = sleep
+    staleReclaimAttemptLimit = DEFAULT_STALE_RECLAIM_ATTEMPT_LIMIT,
+    sleepImpl = sleep,
+    getProcessIdentity = getProcessStartMarker,
+    getProcessStartedAtIdentity = getProcessStartedAt,
+    syncDirectoryImpl = syncDirectory,
+    onCandidateReady,
+    onBeforeStaleReclaim,
+    platform = process.platform
   } = options;
-  const lockDir = path.join(codexHome, "tmp", DEFAULT_LOCK_NAME);
-  await fsImpl.mkdir(path.dirname(lockDir), { recursive: true });
-  await createLockDirectory(lockDir, {
-    fsImpl,
-    retryCount,
-    retryDelayMs,
-    sleepImpl
-  });
-
+  const lockDir = path.resolve(lockPath);
+  if (!Number.isInteger(staleReclaimAttemptLimit) || staleReclaimAttemptLimit < 0) {
+    throw new TypeError("staleReclaimAttemptLimit must be a non-negative integer.");
+  }
   const ownerPath = path.join(lockDir, "owner.json");
+  const parentDir = path.dirname(lockDir);
+  const claimsDir = `${lockDir}.claims`;
+  const candidateDir = path.join(
+    parentDir,
+    `.${path.basename(lockDir)}.candidate.${process.pid}.${randomUUID()}`
+  );
+  await fsImpl.mkdir(parentDir, { recursive: true });
+  await fsImpl.mkdir(claimsDir, { recursive: true, mode: 0o700 });
+  const processStartMarker = await getProcessIdentity(process.pid);
+  if (!processStartMarker) {
+    throw new Error(`Unable to establish the current process identity for lock ${lockDir}.`);
+  }
+
+  const processStartedAt = await getProcessStartedAtIdentity(process.pid, processStartMarker);
+  if (!processStartedAt) {
+    throw new Error(`Unable to establish the current process start time for lock ${lockDir}.`);
+  }
   const owner = {
+    protocolVersion: 2,
+    runtime: "node",
     pid: process.pid,
+    processId: process.pid,
+    processStartMarker,
+    processStartedAt: toUtcSecond(processStartedAt),
+    instanceId: randomUUID(),
     startedAt: new Date().toISOString(),
     label,
-    cwd: process.cwd()
+    cwd: process.cwd(),
+    currentDirectory: process.cwd()
   };
-  await fsImpl.writeFile(ownerPath, JSON.stringify(owner, null, 2), "utf8");
+  let published = false;
+  let canonicalReserved = false;
+  let ownerLinked = false;
+  let canonicalDirectoryIdentity = null;
+  let claimPath = null;
+  try {
+    claimPath = await publishClaim(
+      claimsDir,
+      owner,
+      fsImpl,
+      syncDirectoryImpl,
+      platform
+    );
+    await establishUniqueClaim({
+      claimsDir,
+      claimPath,
+      owner,
+      fsImpl,
+      getProcessIdentity,
+      getProcessStartedAtIdentity,
+      syncDirectoryImpl,
+      platform
+    });
+    await createCandidateDirectory(
+      candidateDir,
+      fsImpl,
+      retryCount,
+      retryDelayMs,
+      sleepImpl
+    );
+    const candidateOwnerPath = path.join(candidateDir, "owner.json");
+    const ownerHandle = await fsImpl.open(candidateOwnerPath, "wx", 0o600);
+    try {
+      await ownerHandle.writeFile(JSON.stringify(owner, null, 2), "utf8");
+      await ownerHandle.sync();
+    } finally {
+      await ownerHandle.close();
+    }
+    await syncDirectoryImpl(candidateDir, { fsImpl, platform });
+    await onCandidateReady?.({ candidateDir, lockDir, ownerPath: candidateOwnerPath, owner });
+
+    let attempts = 0;
+    let staleReclaimAttempts = 0;
+    while (true) {
+      try {
+        // Directory rename is not an exclusive publish on POSIX: it may replace
+        // an existing empty directory. Reserve the canonical name with mkdir,
+        // then publish the already-durable owner inode with a no-replace link.
+        await fsImpl.mkdir(lockDir, { mode: 0o700 });
+        canonicalReserved = true;
+        canonicalDirectoryIdentity = await inspectCanonicalDirectory(lockDir, fsImpl);
+        await fsImpl.link(candidateOwnerPath, ownerPath);
+        ownerLinked = true;
+        const publishedDirectoryIdentity = await inspectCanonicalDirectory(lockDir, fsImpl);
+        if (!sameDirectoryIdentity(canonicalDirectoryIdentity, publishedDirectoryIdentity)) {
+          throw lockExistsError(
+            lockDir,
+            "The canonical reservation changed identity while owner.json was being published; the live claim is retained because publication is uncertain."
+          );
+        }
+        published = true;
+        await syncDirectoryImpl(lockDir, { fsImpl, platform });
+        await syncDirectoryImpl(parentDir, { fsImpl, platform });
+        await fsImpl.rm(candidateDir, { recursive: true, force: true });
+        break;
+      } catch (error) {
+        if (canonicalReserved) {
+          throw error;
+        }
+        const existingDirectoryIdentity = await inspectCanonicalDirectory(lockDir, fsImpl);
+        if (existingDirectoryIdentity !== null) {
+          const existingOwner = await readLockOwner(ownerPath, fsImpl);
+          let live;
+          try {
+            live = await isOwnerLive(
+              existingOwner,
+              getProcessIdentity,
+              getProcessStartedAtIdentity
+            );
+          } catch (identityError) {
+            throw lockExistsError(lockDir, `The recorded owner could not be verified (${identityError.message}).`);
+          }
+          if (live) {
+            throw lockExistsError(lockDir, `PID ${existingOwner.pid} is still the verified owner.`);
+          }
+          if (staleReclaimAttempts >= staleReclaimAttemptLimit) {
+            throw lockExistsError(
+              lockDir,
+              `Stale-lock reclamation exceeded the bounded limit of ${staleReclaimAttemptLimit} attempts.`
+            );
+          }
+          staleReclaimAttempts += 1;
+          await onBeforeStaleReclaim?.({ lockDir, existingOwner, owner });
+          if (await quarantineStaleLock(
+            lockDir,
+            existingOwner,
+            existingDirectoryIdentity,
+            fsImpl,
+            syncDirectoryImpl,
+            platform
+          )) {
+            await syncDirectoryImpl(parentDir, { fsImpl, platform });
+          }
+          continue;
+        }
+        if (!isTransientLockCreateError(error) || attempts >= retryCount) {
+          throw error;
+        }
+        attempts += 1;
+        await sleepImpl(retryDelayMs);
+      }
+    }
+  } catch (error) {
+    const cleanupFailures = [];
+    let canonicalCleanupSafe = !published && !canonicalReserved;
+    if (published) {
+      try {
+        await removeOwnedCanonical(
+          lockDir,
+          owner,
+          fsImpl,
+          syncDirectoryImpl,
+          platform,
+          canonicalDirectoryIdentity,
+          "acquire-failed"
+        );
+        canonicalCleanupSafe = true;
+      } catch (cleanupError) {
+        cleanupFailures.push(cleanupError);
+      }
+    } else if (canonicalReserved && !ownerLinked) {
+      try {
+        // rmdir is intentionally non-recursive: if another runtime populated
+        // the reserved directory, preserve it. Since link never succeeded, our
+        // independent claim can still be released safely below.
+        const cleanupDirectoryIdentity = await inspectCanonicalDirectory(lockDir, fsImpl);
+        if (!sameDirectoryIdentity(cleanupDirectoryIdentity, canonicalDirectoryIdentity)) {
+          throw new Error(
+            `Refusing to remove empty reservation ${lockDir} because its directory identity changed.`
+          );
+        }
+        await fsImpl.rmdir(lockDir);
+        await syncDirectoryImpl(parentDir, { fsImpl, platform });
+        canonicalCleanupSafe = true;
+      } catch (cleanupError) {
+        cleanupFailures.push(cleanupError);
+      }
+    }
+    try {
+      await fsImpl.rm(candidateDir, { recursive: true, force: true });
+    } catch (cleanupError) {
+      cleanupFailures.push(cleanupError);
+    }
+    if (claimPath && (canonicalCleanupSafe || !ownerLinked)) {
+      try {
+        await removeOwnedClaim(claimPath, owner, fsImpl, syncDirectoryImpl, platform);
+      } catch (cleanupError) {
+        cleanupFailures.push(cleanupError);
+      }
+    }
+    if (cleanupFailures.length > 0) {
+      throw new AggregateError(
+        [error, ...cleanupFailures],
+        `Lock acquisition failed and cleanup was incomplete: ${error.message}`,
+        { cause: error }
+      );
+    }
+    throw error;
+  }
 
   let released = false;
   return async function releaseLock() {
     if (released) {
       return;
     }
+    await removeOwnedCanonical(
+      lockDir,
+      owner,
+      fsImpl,
+      syncDirectoryImpl,
+      platform,
+      canonicalDirectoryIdentity
+    );
+    await removeOwnedClaim(claimPath, owner, fsImpl, syncDirectoryImpl, platform);
     released = true;
-    await fsImpl.rm(lockDir, { recursive: true, force: true });
   };
 }
diff --git a/src/service.js b/src/service.js
index 221fef4..2ceed03 100644
--- a/src/service.js
+++ b/src/service.js
@@ -1,4 +1,5 @@
 import path from "node:path";
+import fs from "node:fs/promises";
 
 import {
   DEFAULT_BACKUP_RETENTION_COUNT,
@@ -18,6 +19,7 @@ import {
 } from "./config-file.js";
 import {
   createBackup,
+  getBackupRecoveryCoverage,
   getBackupSummary,
   pruneBackups,
   restoreBackup,
@@ -28,7 +30,6 @@ import { acquireLock } from "./locking.js";
 import {
   applySessionChanges,
   collectSessionChanges,
-  restoreSessionChanges,
   splitLockedSessionChanges,
   summarizeProviderCounts
 } from "./session-files.js";
@@ -53,6 +54,70 @@ import {
   resolveStorageLayout,
   withStateDbLocation
 } from "./storage-layout.js";
+import {
+  TransactionJournal,
+  assertNoPendingTransactions,
+  findPendingTransactions,
+  getAppliedJournalTargets,
+  getStartedJournalTargets,
+  readTransactionJournal,
+  markBackupTransactionRolledBack
+} from "./transaction-journal.js";
+
+function pathComparisonKey(value) {
+  const resolved = path.resolve(value);
+  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+
+function uniqueResolvedPaths(values) {
+  const pathsByKey = new Map();
+  for (const value of values) {
+    if (typeof value !== "string" || !value) {
+      continue;
+    }
+    const resolved = path.resolve(value);
+    pathsByKey.set(pathComparisonKey(resolved), resolved);
+  }
+  return [...pathsByKey.values()];
+}
+
+export class SyncTransactionError extends Error {
+  constructor(
+    originalError,
+    rollbackErrors,
+    backupDir,
+    completedTargets,
+    uncompletedTargets,
+    { rollbackStatus = "incomplete", recoveryRequired = true } = {}
+  ) {
+    const message = recoveryRequired
+      ? `Failed to restore state after sync error. Original error: ${originalError.message}. Restore error: ${rollbackErrors.join("; ")}`
+      : `Provider sync failed and all observed changes were rolled back. Original error: ${originalError.message}`;
+    super(message, { cause: originalError });
+    this.name = "SyncTransactionError";
+    this.code = recoveryRequired ? "RECOVERY_REQUIRED" : "SYNC_FAILED_ROLLED_BACK";
+    this.originalError = originalError;
+    this.rollbackErrors = rollbackErrors;
+    this.backupDir = backupDir;
+    this.completedTargets = completedTargets;
+    this.uncompletedTargets = uncompletedTargets;
+    this.rollbackStatus = rollbackStatus;
+    this.recoveryRequired = recoveryRequired;
+    this.recoveryInstructions = recoveryRequired
+      ? `Restore the managed backup at ${backupDir}, inspect the pending transaction journal, then retry.`
+      : "No manual recovery is required. Inspect the original error, correct its cause, and retry.";
+  }
+}
+
+function throwIfAborted(signal) {
+  if (!signal?.aborted) {
+    return;
+  }
+  const error = new Error("The provider-sync operation was cancelled.");
+  error.name = "AbortError";
+  error.code = "ABORT_ERR";
+  throw error;
+}
 
 async function prepareStorage({ codexHome: explicitCodexHome, sqliteHome, configText, storage, platform }) {
   if (storage) {
@@ -85,11 +150,90 @@ function formatBytes(bytes) {
 }
 
 function emitProgress(onProgress, event) {
-  if (typeof onProgress === "function") {
-    onProgress(event);
+  if (typeof onProgress !== "function") {
+    return;
+  }
+  try {
+    const observerResult = onProgress(event);
+    if (observerResult && typeof observerResult.then === "function") {
+      observerResult.catch(() => {
+        // Progress is an observer channel. Async observer failures must not
+        // change transaction state or surface as unhandled rejections.
+      });
+    }
+  } catch {
+    // Progress is non-authoritative. A UI/CLI observer failure must never
+    // trigger compensation before commit or turn a committed operation into
+    // an apparent failure afterwards.
   }
 }
 
+async function commitJournalWithReconciliation(journal, faultInjector) {
+  let acknowledgementError = null;
+  try {
+    await journal.committed();
+    await faultInjector?.({ point: "after_transaction_journal_commit_before_ack" });
+  } catch (error) {
+    acknowledgementError = error;
+  }
+
+  let persisted;
+  try {
+    persisted = await readTransactionJournal(journal.filePath);
+  } catch (readError) {
+    if (acknowledgementError) {
+      throw new AggregateError(
+        [acknowledgementError, readError],
+        `Unable to reconcile transaction commit acknowledgement: ${acknowledgementError.message}`,
+        { cause: acknowledgementError }
+      );
+    }
+    throw readError;
+  }
+  if (persisted.terminal
+      && persisted.state === "committed"
+      && persisted.operationId === journal.operationId) {
+    return;
+  }
+  if (acknowledgementError) {
+    throw acknowledgementError;
+  }
+  throw new Error(`Transaction journal did not persist a valid committed terminal state: ${journal.filePath}`);
+}
+
+async function rollbackJournalWithReconciliation(journal, faultInjector) {
+  let acknowledgementError = null;
+  try {
+    await journal.rolledBack();
+    await faultInjector?.({ point: "after_transaction_journal_rollback_before_ack" });
+  } catch (error) {
+    acknowledgementError = error;
+  }
+
+  let persisted;
+  try {
+    persisted = await readTransactionJournal(journal.filePath);
+  } catch (readError) {
+    if (acknowledgementError) {
+      throw new AggregateError(
+        [acknowledgementError, readError],
+        `Unable to reconcile transaction rollback acknowledgement: ${acknowledgementError.message}`,
+        { cause: acknowledgementError }
+      );
+    }
+    throw readError;
+  }
+  if (persisted.terminal
+      && persisted.state === "rolledBack"
+      && persisted.operationId === journal.operationId) {
+    return;
+  }
+  if (acknowledgementError) {
+    throw acknowledgementError;
+  }
+  throw new Error(`Transaction journal did not persist a valid rolledBack terminal state: ${journal.filePath}`);
+}
+
 function sumCounts(counts) {
   return Object.values(counts ?? {}).reduce((total, value) => total + value, 0);
 }
@@ -135,6 +279,7 @@ export async function getStatus({ codexHome: explicitCodexHome, sqliteHome, plat
     ? []
     : await readProjectThreadVisibility(storage);
   const backupSummary = await getBackupSummary(codexHome);
+  const pendingTransactions = await findPendingTransactions(codexHome);
 
   return {
     codexHome,
@@ -154,7 +299,13 @@ export async function getStatus({ codexHome: explicitCodexHome, sqliteHome, plat
     sqliteRepairStats,
     projectThreadVisibility,
     backupRoot: defaultBackupRoot(codexHome),
-    backupSummary
+    backupSummary,
+    pendingTransactions: pendingTransactions.map((transaction) => ({
+      operationId: transaction.operationId ?? null,
+      state: transaction.state,
+      backupDir: transaction.backupDir,
+      journalPath: transaction.filePath
+    }))
   };
 }
 
@@ -168,6 +319,15 @@ export function renderStatus(status) {
     `Backup root: ${status.backupRoot}`
   ];
 
+  if (status.pendingTransactions?.length) {
+    lines.push("");
+    lines.push("Recovery required:");
+    for (const transaction of status.pendingTransactions) {
+      lines.push(`  ${transaction.state}: ${transaction.backupDir}`);
+    }
+    lines.push("  Run restore with the listed backup before the next write operation.");
+  }
+
   lines.push("");
   lines.push("Rollout files:");
   lines.push(`  sessions: ${formatCounts(status.rolloutCounts.sessions)}`);
@@ -239,7 +399,9 @@ async function runSyncCore({
   sqliteBusyTimeoutMs,
   onProgress,
   model = null,
-  platform
+  platform,
+  faultInjector,
+  signal
 } = {}, { afterBackup } = {}) {
   if (!Number.isInteger(keepCount) || keepCount < 1) {
     throw new Error(`Invalid automatic keep count: ${keepCount}. Expected an integer greater than or equal to 1.`);
@@ -247,19 +409,24 @@ async function runSyncCore({
 
   const codexHome = providedStorage?.codexHome ?? normalizeCodexHome(explicitCodexHome);
   const configPath = path.join(codexHome, "config.toml");
-  const configText = await readConfigText(configPath);
-  const storage = await prepareStorage({ codexHome, sqliteHome, configText, storage: providedStorage, platform });
-  assertSqliteAccessSupported(storage, "sync");
-  if (!storage.stateDbLocation && isConfiguredSqliteHome(storage)) {
-    throw missingConfiguredStateDbError(storage);
-  }
-  const current = readCurrentProviderFromConfigText(configText);
-  const targetProvider = provider ?? current.provider ?? DEFAULT_PROVIDER;
-
   const releaseLock = await acquireLock(codexHome, "sync");
   let backupDir = null;
+  let journal = null;
   let backupDurationMs = 0;
   try {
+    await assertNoPendingTransactions(codexHome);
+    throwIfAborted(signal);
+    const configText = await readConfigText(configPath);
+    if (configBackupText !== undefined && configText !== configBackupText) {
+      throw new Error("config.toml changed before the switch operation acquired its lock. Refresh and retry.");
+    }
+    const storage = await prepareStorage({ codexHome, sqliteHome, configText, storage: providedStorage, platform });
+    assertSqliteAccessSupported(storage, "sync");
+    if (!storage.stateDbLocation && isConfiguredSqliteHome(storage)) {
+      throw missingConfiguredStateDbError(storage);
+    }
+    const current = readCurrentProviderFromConfigText(configText);
+    const targetProvider = provider ?? current.provider ?? DEFAULT_PROVIDER;
     emitProgress(onProgress, { stage: "scan_rollout_files", status: "start" });
     const {
       changes,
@@ -301,6 +468,8 @@ async function runSyncCore({
       status: "start",
       writableCount: writableChanges.length
     });
+    throwIfAborted(signal);
+    await faultInjector?.({ point: "before_backup" });
     const backupStartedAt = Date.now();
     backupDir = await createBackup({
       storage,
@@ -318,12 +487,38 @@ async function runSyncCore({
       durationMs: backupDurationMs
     });
 
-    if (typeof afterBackup === "function") {
-      await afterBackup(backupDir);
-    }
+    const globalStatePath = path.join(codexHome, ".codex-global-state.json");
+    const globalStateBackupPath = path.join(codexHome, ".codex-global-state.json.bak");
+    const globalStatePresent = await fs.access(globalStatePath).then(() => true).catch(() => false);
+    const sqliteTarget = storage.stateDbLocation?.path ?? null;
+    const potentialTargets = uniqueResolvedPaths([
+      ...writableChanges.map((change) => change.path),
+      ...(globalStatePresent ? [globalStatePath, globalStateBackupPath] : []),
+      ...(configBackupText !== undefined ? [configPath] : []),
+      ...(sqliteTarget ? [sqliteTarget] : [])
+    ]);
+    journal = await TransactionJournal.create(backupDir, {
+      codexHome,
+      targetProvider,
+      potentialTargets
+    });
 
     let sessionRestoreNeeded = false;
     let appliedSessionChanges = [];
+    let sqliteMutationCommitted = false;
+    let sqliteCommitAttempted = false;
+    let configMutationAttempted = false;
+    const completedTargets = [];
+    const completedTargetKeys = new Set();
+    let transactionCommitted = false;
+    const recordCompletedTarget = (targetPath) => {
+      const fullPath = path.resolve(targetPath);
+      const key = pathComparisonKey(fullPath);
+      if (!completedTargetKeys.has(key)) {
+        completedTargetKeys.add(key);
+        completedTargets.push(fullPath);
+      }
+    };
     let globalStateRestoreNeeded = false;
     let workspaceRootResult = {
       updated: false,
@@ -331,6 +526,17 @@ async function runSyncCore({
       savedWorkspaceRootCount: 0
     };
     try {
+      if (typeof afterBackup === "function") {
+        throwIfAborted(signal);
+        await journal.applying("config", configPath);
+        configMutationAttempted = true;
+        await afterBackup(backupDir);
+        recordCompletedTarget(configPath);
+        await faultInjector?.({ point: "after_config_mutation_before_applied", path: configPath });
+        await journal.applied("config", configPath);
+        await faultInjector?.({ point: "after_config_apply", path: configPath });
+      }
+
       let applyResult = { appliedChanges: 0, appliedPaths: [], skippedPaths: [] };
       emitProgress(onProgress, { stage: "update_sqlite", status: "start" });
       emitProgress(onProgress, {
@@ -338,22 +544,88 @@ async function runSyncCore({
         status: "start",
         writableCount: writableChanges.length
       });
+      if (sqliteTarget) {
+        await journal.applying("sqlite", sqliteTarget);
+      }
       const sqliteResult = await updateSqliteProvider(
         storage,
         targetProvider,
         async () => {
           if (writableChanges.length > 0) {
-            applyResult = await applySessionChanges(writableChanges, { targetModel: model });
-            const appliedPathSet = new Set(applyResult.appliedPaths ?? []);
-            appliedSessionChanges = writableChanges.filter((change) => appliedPathSet.has(change.path));
-            sessionRestoreNeeded = appliedSessionChanges.length > 0;
-            await updateSessionBackupManifest(backupDir, appliedSessionChanges);
+            applyResult = await applySessionChanges(writableChanges, {
+              targetModel: model,
+              onBeforeApply: async (change) => {
+                throwIfAborted(signal);
+                await journal.applying("rollout", change.path);
+                await faultInjector?.({
+                  point: "before_rollout_apply",
+                  path: change.path,
+                  targetIndex: appliedSessionChanges.length + 1
+                });
+              },
+              onMutation: async (change, mutation) => {
+                recordCompletedTarget(change.path);
+                await faultInjector?.({
+                  point: "after_rollout_mutation_before_applied",
+                  path: change.path,
+                  mutation
+                });
+              },
+              onApplied: async (change) => {
+                appliedSessionChanges.push(change);
+                sessionRestoreNeeded = true;
+                await journal.applied("rollout", change.path);
+                await updateSessionBackupManifest(backupDir, appliedSessionChanges);
+                await faultInjector?.({ point: "after_rollout_apply", path: change.path, appliedCount: appliedSessionChanges.length });
+              },
+              onSkipped: async (change, reason) => {
+                await journal.skipped("rollout", change.path);
+                await faultInjector?.({ point: "after_rollout_skip", path: change.path, reason });
+              }
+            });
           }
-          workspaceRootResult = await syncWorkspaceRoots(storage, { cwdStats });
-          globalStateRestoreNeeded = workspaceRootResult.updated;
+          workspaceRootResult = await syncWorkspaceRoots(storage, {
+            cwdStats,
+            onBeforeWrite: async (targetPath) => {
+              throwIfAborted(signal);
+              await journal.applying("globalState", targetPath);
+            },
+            onApplied: async (targetPath) => {
+              globalStateRestoreNeeded = true;
+              recordCompletedTarget(targetPath);
+              await journal.applied("globalState", targetPath);
+              await faultInjector?.({ point: "after_global_state_apply", path: targetPath });
+            }
+          });
+          throwIfAborted(signal);
         },
-        { busyTimeoutMs: sqliteBusyTimeoutMs, userEventThreadIds, threadCwdById, targetModel: model }
+        {
+          busyTimeoutMs: sqliteBusyTimeoutMs,
+          userEventThreadIds,
+          threadCwdById,
+          targetModel: model,
+          onCommitAttempt(result) {
+            sqliteCommitAttempted = result.databasePresent && result.updatedRows > 0;
+          },
+          afterCommit: () => faultInjector?.({
+            point: "after_sqlite_commit_before_ack",
+            path: sqliteTarget
+          })
+        }
       );
+      sqliteMutationCommitted = sqliteResult.databasePresent && sqliteResult.updatedRows > 0;
+      if (sqliteMutationCommitted) {
+        recordCompletedTarget(sqliteTarget);
+      }
+      throwIfAborted(signal);
+      if (sqliteTarget) {
+        if (sqliteMutationCommitted) {
+          await journal.applied("sqlite", sqliteTarget);
+        } else {
+          await journal.skipped("sqlite", sqliteTarget);
+        }
+        await faultInjector?.({ point: "after_sqlite_commit", path: sqliteTarget });
+      }
       emitProgress(onProgress, {
         stage: "rewrite_rollout_files",
         status: "complete",
@@ -369,6 +641,11 @@ async function runSyncCore({
         ...skippedRolloutFiles,
         ...applyResult.skippedPaths
       ])].sort((left, right) => left.localeCompare(right));
+      throwIfAborted(signal);
+      await faultInjector?.({ point: "before_transaction_commit", completedCount: completedTargets.length });
+      await commitJournalWithReconciliation(journal, faultInjector);
+      transactionCommitted = true;
+      await faultInjector?.({ point: "after_transaction_commit", completedCount: completedTargets.length });
       let autoPruneResult = null;
       let autoPruneWarning = null;
       emitProgress(onProgress, {
@@ -387,7 +664,7 @@ async function runSyncCore({
         deletedCount: autoPruneResult?.deletedCount ?? 0,
         warning: autoPruneWarning
       });
-      return {
+      const result = {
         codexHome,
         sqliteHome: storage.sqliteHome,
         sqliteHomeSource: storage.sqliteHomeSource,
@@ -410,32 +687,145 @@ async function runSyncCore({
         autoPruneResult,
         autoPruneWarning
       };
+      return result;
     } catch (error) {
+      if (transactionCommitted) {
+        throw error;
+      }
+      try {
+        const persistedTerminal = journal
+          ? await readTransactionJournal(journal.filePath)
+          : null;
+        if (persistedTerminal?.terminal && persistedTerminal.state === "committed") {
+          // A terminal commit is authoritative even if an observer or the
+          // acknowledgement path failed before the in-memory flag advanced.
+          // Never append rollback events or compensate committed state.
+          throw error;
+        }
+      } catch (reconciliationError) {
+        if (reconciliationError === error) {
+          throw error;
+        }
+        // A journal read failure is handled by the recovery path below.
+      }
+
       const restoreFailures = [];
-      if (sessionRestoreNeeded) {
+      try {
+        await journal?.rollingBack(error);
+      } catch (journalError) {
+        restoreFailures.push(`transaction journal: ${journalError.message}`);
+      }
+      let journalSnapshot = null;
+      try {
+        journalSnapshot = journal ? await readTransactionJournal(journal.filePath) : null;
+      } catch (journalError) {
+        restoreFailures.push(`transaction journal read: ${journalError.message}`);
+      }
+      const startedRolloutTargets = journalSnapshot
+        ? getStartedJournalTargets(journalSnapshot, "rollout")
+        : (sessionRestoreNeeded
+          ? appliedSessionChanges.map((change) => change.path)
+          : writableChanges.map((change) => change.path));
+      const startedGlobalStateTargets = journalSnapshot
+        ? getStartedJournalTargets(journalSnapshot, "globalState")
+        : (globalStateRestoreNeeded || globalStatePresent
+          ? [globalStatePath, globalStateBackupPath]
+          : []);
+      const startedConfigTargets = journalSnapshot
+        ? getStartedJournalTargets(journalSnapshot, "config")
+        : (configMutationAttempted ? [configPath] : []);
+
+      if (startedRolloutTargets.length > 0) {
         try {
-          await restoreSessionChanges(appliedSessionChanges.map((change) => ({
-            path: change.path,
-            originalFirstLine: change.originalFirstLine,
-            originalSeparator: change.originalSeparator
-          })));
+          await faultInjector?.({ point: "before_rollout_rollback", appliedCount: startedRolloutTargets.length });
+          await restoreBackup(backupDir, storage, {
+            restoreConfig: false,
+            restoreGlobalState: false,
+            restoreDatabase: false,
+            restoreSessions: true,
+            sessionTargetPaths: startedRolloutTargets
+          });
         } catch (restoreError) {
           restoreFailures.push(`rollout files: ${restoreError.message}`);
         }
       }
-      if (globalStateRestoreNeeded && backupDir) {
+      if (startedGlobalStateTargets.length > 0 && backupDir) {
         try {
-          await restoreGlobalStateFilesFromBackup(backupDir, codexHome);
+          await faultInjector?.({ point: "before_global_state_rollback" });
+          await restoreGlobalStateFilesFromBackup(backupDir, codexHome, {
+            targetPaths: startedGlobalStateTargets
+          });
         } catch (restoreError) {
           restoreFailures.push(`global state: ${restoreError.message}`);
         }
       }
+      if (startedConfigTargets.length > 0 && configBackupText !== undefined) {
+        try {
+          await faultInjector?.({ point: "before_config_rollback", path: configPath });
+          await writeConfigText(configPath, configBackupText);
+        } catch (restoreError) {
+          restoreFailures.push(`config: ${restoreError.message}`);
+        }
+      }
+      const sqliteRestoreRequired = sqliteMutationCommitted || sqliteCommitAttempted;
+      if (sqliteRestoreRequired && backupDir) {
+        try {
+          const sqliteTarget = storage.stateDbLocation?.path ?? storage.sqliteHome;
+          await faultInjector?.({ point: "before_sqlite_rollback", path: sqliteTarget });
+          await restoreBackup(backupDir, storage, {
+            restoreConfig: false,
+            restoreDatabase: true,
+            restoreSessions: false
+          });
+        } catch (restoreError) {
+          restoreFailures.push(`SQLite: ${restoreError.message}`);
+        }
+      }
+      if (restoreFailures.length === 0) {
+        try {
+          if (journal) {
+            await rollbackJournalWithReconciliation(journal, faultInjector);
+          }
+        } catch (journalError) {
+          restoreFailures.push(`transaction journal: ${journalError.message}`);
+        }
+      }
       if (restoreFailures.length > 0) {
-        throw new Error(
-          `Failed to restore state after sync error. Original error: ${error.message}. Restore error: ${restoreFailures.join("; ")}`
+        try {
+          await journal?.recoveryRequired(error, restoreFailures);
+        } catch {
+          // Preserve the original and rollback errors even if the journal is
+          // no longer writable.
+        }
+        const persistedCompletedTargets = journalSnapshot
+          ? uniqueResolvedPaths([...getAppliedJournalTargets(journalSnapshot), ...completedTargets])
+          : uniqueResolvedPaths(completedTargets);
+        const uncompletedTargets = uniqueResolvedPaths([
+          ...startedRolloutTargets,
+          ...startedGlobalStateTargets,
+          ...startedConfigTargets,
+          ...(sqliteRestoreRequired && sqliteTarget ? [sqliteTarget] : [])
+        ]);
+        throw new SyncTransactionError(
+          error,
+          restoreFailures,
+          backupDir,
+          persistedCompletedTargets,
+          uncompletedTargets,
+          { rollbackStatus: "incomplete", recoveryRequired: true }
         );
       }
-      throw error;
+      const persistedCompletedTargets = journalSnapshot
+        ? uniqueResolvedPaths([...getAppliedJournalTargets(journalSnapshot), ...completedTargets])
+        : uniqueResolvedPaths(completedTargets);
+      throw new SyncTransactionError(
+        error,
+        [],
+        backupDir,
+        persistedCompletedTargets,
+        [],
+        { rollbackStatus: "complete", recoveryRequired: false }
+      );
     }
   } finally {
     await releaseLock();
@@ -450,7 +840,9 @@ export async function runSwitch({
   keepRootModel = false,
   keepCount = DEFAULT_BACKUP_RETENTION_COUNT,
   onProgress,
-  platform
+  platform,
+  faultInjector,
+  signal
 }) {
   if (!provider) {
     throw new Error("Missing provider id. Usage: codex-provider switch <provider-id>");
@@ -496,54 +888,47 @@ export async function runSwitch({
     }
   }
 
-  let configMutationAttempted = false;
-  try {
-    // `nextConfigText` has the final root-level `model` value. Use that to
-    // drive the per-thread rewrite so old sessions match new sessions.
-    let modelForThreads = null;
-    if (modelSync.applied && modelSync.model) {
-      modelForThreads = modelSync.model;
-    } else {
-      modelForThreads = readRootModelFromConfigText(nextConfigText);
-    }
-    const syncResult = await runSyncCore(
-      {
-        codexHome,
-        storage,
-        provider,
-        configBackupText: originalConfigText,
-        keepCount,
-        onProgress,
-        model: modelForThreads
-      },
-      {
-        afterBackup: async () => {
-          emitProgress(onProgress, {
-            stage: "update_config",
-            status: "start",
-            provider
-          });
-          configMutationAttempted = true;
-          await writeConfigText(configPath, nextConfigText);
-          emitProgress(onProgress, {
-            stage: "update_config",
-            status: "complete",
-            provider
-          });
-        }
+  // `nextConfigText` has the final root-level `model` value. Use that to
+  // drive the per-thread rewrite so old sessions match new sessions.
+  let modelForThreads = null;
+  if (modelSync.applied && modelSync.model) {
+    modelForThreads = modelSync.model;
+  } else {
+    modelForThreads = readRootModelFromConfigText(nextConfigText);
+  }
+  const syncResult = await runSyncCore(
+    {
+      codexHome,
+      storage,
+      provider,
+      configBackupText: originalConfigText,
+      keepCount,
+      onProgress,
+      model: modelForThreads,
+      faultInjector,
+      signal
+    },
+    {
+      afterBackup: async () => {
+        emitProgress(onProgress, {
+          stage: "update_config",
+          status: "start",
+          provider
+        });
+        await writeConfigText(configPath, nextConfigText);
+        emitProgress(onProgress, {
+          stage: "update_config",
+          status: "complete",
+          provider
+        });
       }
-    );
-    return {
-      ...syncResult,
-      configUpdated: true,
-      modelSync
-    };
-  } catch (error) {
-    if (configMutationAttempted) {
-      await writeConfigText(configPath, originalConfigText);
     }
-    throw error;
-  }
+  );
+  return {
+    ...syncResult,
+    configUpdated: true,
+    modelSync
+  };
 }
 
 export async function runRestore({
@@ -571,12 +956,64 @@ export async function runRestore({
   }
   const releaseLock = await acquireLock(codexHome, "restore");
   try {
-    return await restoreBackup(path.resolve(backupDir), storage, {
+    const normalizedBackupDir = path.resolve(backupDir);
+    let boundJournal = null;
+    try {
+      boundJournal = await readTransactionJournal(
+        path.join(normalizedBackupDir, "transaction-journal.jsonl")
+      );
+    } catch (error) {
+      if (error?.code !== "ENOENT") {
+        throw error;
+      }
+    }
+    if (boundJournal && !boundJournal.terminal) {
+      const journalUncertain = boundJournal.invalidTail || boundJournal.events.length === 0;
+      let conservativeCoverage = null;
+      if (journalUncertain) {
+        try {
+          conservativeCoverage = await getBackupRecoveryCoverage(normalizedBackupDir, storage);
+        } catch (coverageError) {
+          coverageError.code = "RECOVERY_REQUIRED";
+          coverageError.backupDir = normalizedBackupDir;
+          throw coverageError;
+        }
+      }
+      const missingKinds = [];
+      if ((getStartedJournalTargets(boundJournal, "rollout").length > 0
+          || conservativeCoverage?.sessions) && !restoreSessions) {
+        missingKinds.push("rollout sessions");
+      }
+      if ((getStartedJournalTargets(boundJournal, "sqlite").length > 0
+          || conservativeCoverage?.database) && !restoreDatabase) {
+        missingKinds.push("SQLite database");
+      }
+      if ((getStartedJournalTargets(boundJournal, "config").length > 0
+          || conservativeCoverage?.config) && !restoreConfig) {
+        missingKinds.push("config.toml");
+      }
+      if ((getStartedJournalTargets(boundJournal, "globalState").length > 0
+          || conservativeCoverage?.globalState) && !restoreConfig) {
+        missingKinds.push("global state");
+      }
+      if (missingKinds.length > 0) {
+        const error = new Error(
+          `Partial restore would leave a pending transaction unresolved. Include: ${missingKinds.join(", ")}.`
+        );
+        error.code = "RECOVERY_REQUIRED";
+        error.backupDir = normalizedBackupDir;
+        error.missingRestoreKinds = missingKinds;
+        throw error;
+      }
+    }
+    const result = await restoreBackup(normalizedBackupDir, storage, {
       restoreConfig,
       restoreDatabase,
       restoreSessions,
       allowSqliteHomeRelocation
     });
+    await markBackupTransactionRolledBack(normalizedBackupDir);
+    return result;
   } finally {
     await releaseLock();
   }
diff --git a/src/session-files.js b/src/session-files.js
index d7c1b00..2ae0e08 100644
--- a/src/session-files.js
+++ b/src/session-files.js
@@ -7,10 +7,20 @@ import readline from "node:readline";
 import { promisify } from "node:util";
 
 import { SESSION_DIRS } from "./constants.js";
+import { syncDirectory } from "./atomic-file.js";
 
 const execFileAsync = promisify(execFile);
 const ROLLOUT_SCAN_CHUNK_BYTES = 1024 * 1024;
 
+async function syncStagedFile(filePath) {
+  const handle = await fsp.open(filePath, "r+");
+  try {
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+
 function isRolloutFileBusyError(error) {
   const message = `${error?.code ?? ""} ${error?.message ?? ""}`.toLowerCase();
   return message.includes("ebusy")
@@ -33,7 +43,8 @@ async function getFileSnapshot(filePath) {
   const stat = await fsp.stat(filePath);
   return {
     size: stat.size,
-    mtimeMs: stat.mtimeMs
+    mtimeMs: stat.mtimeMs,
+    mode: stat.mode
   };
 }
 
@@ -198,6 +209,7 @@ async function fileHasUserEvent(filePath, firstLine, startOffset) {
 
 async function listJsonlFiles(rootDir) {
   const entries = await fsp.readdir(rootDir, { withFileTypes: true });
+  entries.sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
   const files = [];
   for (const entry of entries) {
     const fullPath = path.join(rootDir, entry.name);
@@ -289,10 +301,15 @@ function parseSessionMetaRecord(firstLine) {
 // because rollout lines are single JSON objects.
 const ROLLOUT_TURNCONTEXT_TYPE_RE = /"type"\s*:\s*"turn_context"/;
 
-async function readTurnContextModels(rolloutPath, { firstLineOffset, firstLineLength } = {}) {
+async function readTurnContextModelSnapshot(
+  rolloutPath,
+  { firstLineOffset, firstLineLength, targetModel = null } = {}
+) {
   const headerSkip = Math.max(0, firstLineOffset ?? 0);
   const headerLength = Math.max(0, firstLineLength ?? 0);
   const models = [];
+  const originalTurnContextModels = [];
+  let lineIndex = 0;
 
   const stream = fs.createReadStream(rolloutPath, {
     encoding: "utf8",
@@ -306,6 +323,7 @@ async function readTurnContextModels(rolloutPath, { firstLineOffset, firstLineLe
 
   try {
     for await (const line of lines) {
+      lineIndex += 1;
       if (!line.includes('"turn_context"')) {
         continue;
       }
@@ -322,8 +340,18 @@ async function readTurnContextModels(rolloutPath, { firstLineOffset, firstLineLe
           // Leave malformed model literals untouched.
         }
       }
+      if (typeof targetModel === "string" && targetModel.length > 0) {
+        const rewrite = rewriteTurnContextModelInLine(line, targetModel);
+        if (rewrite.replaced) {
+          originalTurnContextModels.push({
+            lineIndex,
+            originalModel: rewrite.originalModel,
+            originalModels: rewrite.originalModels
+          });
+        }
+      }
     }
-    return models;
+    return { models, originalTurnContextModels };
   } catch (error) {
     throw wrapRolloutFileBusyError(error, rolloutPath, "read");
   } finally {
@@ -517,10 +545,10 @@ async function invokeWindowsExclusiveRewriteBatch(changes, { requireOriginalMatc
   function Invoke-RewriteChange($change) {
     $path = [string]$change.path
     $tmpPath = "$path.provider-sync.$PID.$([DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()).tmp"
+    $replaceBackupPath = "$path.provider-sync.$PID.$([DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()).replace-backup"
     $encoding = [System.Text.UTF8Encoding]::new($false)
     $source = $null
     $writer = $null
-    $tempReader = $null
 
     try {
       try {
@@ -546,22 +574,6 @@ async function invokeWindowsExclusiveRewriteBatch(changes, { requireOriginalMatc
         $sourceOffset = [int64]$change.originalOffset
         $headerOnly = $sourceOffset -ge [int64]$change.originalSize
 
-        if ($null -ne $change.inPlaceByteOffset -and -not [string]::IsNullOrEmpty([string]$change.inPlaceReplacementBase64)) {
-          $originalBytes = [Convert]::FromBase64String([string]$change.inPlaceOriginalBase64)
-          $replacementBytes = [Convert]::FromBase64String([string]$change.inPlaceReplacementBase64)
-          try {
-            $source.Seek([int64]$change.inPlaceByteOffset, [System.IO.SeekOrigin]::Begin) | Out-Null
-            $source.Write($replacementBytes, 0, $replacementBytes.Length)
-            $source.Flush()
-            return "APPLIED_IN_PLACE"
-          } catch {
-            $source.Seek([int64]$change.inPlaceByteOffset, [System.IO.SeekOrigin]::Begin) | Out-Null
-            $source.Write($originalBytes, 0, $originalBytes.Length)
-            $source.Flush()
-            # The original bytes are restored; continue into the safe
-            # full-file rewrite below.
-          }
-        }
       } else {
         $record = Read-FirstLineRecord $source
         $separator = [string]$change.separator
@@ -583,21 +595,23 @@ async function invokeWindowsExclusiveRewriteBatch(changes, { requireOriginalMatc
         $source.CopyTo($writer)
       }
 
-      $writer.Flush()
+      $writer.Flush($true)
       $writer.Dispose()
       $writer = $null
 
-      $tempReader = [System.IO.File]::OpenRead($tmpPath)
-      $source.SetLength(0)
-      $source.Seek(0, [System.IO.SeekOrigin]::Begin) | Out-Null
-      $tempReader.CopyTo($source)
-      $source.Flush()
+      $source.Dispose()
+      $source = $null
+      try {
+        [System.IO.File]::Replace($tmpPath, $path, $replaceBackupPath, $true)
+      } catch {
+        if (Test-Path $path) {
+          return "SKIP_BUSY"
+        }
+        return "SKIP_CHANGED"
+      }
 
       return "APPLIED"
     } finally {
-      if ($tempReader) {
-        $tempReader.Dispose()
-      }
       if ($writer) {
         $writer.Dispose()
       }
@@ -605,6 +619,7 @@ async function invokeWindowsExclusiveRewriteBatch(changes, { requireOriginalMatc
         $source.Dispose()
       }
       Remove-Item -Path $tmpPath -Force -ErrorAction SilentlyContinue
+      Remove-Item -Path $replaceBackupPath -Force -ErrorAction SilentlyContinue
     }
   }
 
@@ -629,16 +644,10 @@ async function invokeWindowsExclusiveRewriteBatch(changes, { requireOriginalMatc
 `.trim();
 
   try {
-    const manifestChanges = changes.map((change) => {
-      const replacement = requireOriginalMatch ? getInPlaceProviderReplacement(change) : null;
-      return {
-        ...change,
-        requireOriginalMatch,
-        inPlaceByteOffset: replacement?.byteOffset ?? null,
-        inPlaceOriginalBase64: replacement?.original.toString("base64") ?? null,
-        inPlaceReplacementBase64: replacement?.replacement.toString("base64") ?? null
-      };
-    });
+    const manifestChanges = changes.map((change) => ({
+      ...change,
+      requireOriginalMatch
+    }));
     await fsp.writeFile(
       manifestPath,
       JSON.stringify(manifestChanges),
@@ -690,6 +699,7 @@ async function rewriteFirstLine(filePath, nextFirstLine, separator) {
   }
 
   const current = await readFirstLineRecord(filePath);
+  const sourceStat = await fsp.stat(filePath);
   const tmpPath = `${filePath}.provider-sync.${process.pid}.${Date.now()}.tmp`;
   const writer = fs.createWriteStream(tmpPath, { encoding: "utf8" });
 
@@ -718,105 +728,16 @@ async function rewriteFirstLine(filePath, nextFirstLine, separator) {
       reader.pipe(writer, { end: false });
     });
 
+    await fsp.chmod(tmpPath, sourceStat.mode);
+    await syncStagedFile(tmpPath);
     await fsp.rename(tmpPath, filePath);
+    await syncDirectory(path.dirname(filePath));
   } catch (error) {
     await fsp.rm(tmpPath, { force: true });
     throw wrapRolloutFileBusyError(error, filePath, "rewrite");
   }
 }
 
-function getInPlaceProviderReplacement(change) {
-  if (change.modelRewriteRequired
-      || change.modelOnlyChange
-      || typeof change.originalFirstLine !== "string"
-      || typeof change.originalProvider !== "string"
-      || typeof change.updatedProvider !== "string") {
-    return null;
-  }
-
-  const originalProviderJson = JSON.stringify(change.originalProvider);
-  const updatedProviderJson = JSON.stringify(change.updatedProvider);
-  const originalProvider = Buffer.from(originalProviderJson, "utf8");
-  const updatedProvider = Buffer.from(updatedProviderJson, "utf8");
-  if (originalProvider.length === 0 || originalProvider.length !== updatedProvider.length) {
-    return null;
-  }
-
-  const providerFieldPattern = /"model_provider"\s*:\s*/g;
-  let fieldMatch;
-  while ((fieldMatch = providerFieldPattern.exec(change.originalFirstLine)) !== null) {
-    const valueOffset = fieldMatch.index + fieldMatch[0].length;
-    if (!change.originalFirstLine.startsWith(originalProviderJson, valueOffset)) {
-      continue;
-    }
-
-    return {
-      byteOffset: Buffer.byteLength(change.originalFirstLine.slice(0, valueOffset), "utf8"),
-      original: originalProvider,
-      replacement: updatedProvider
-    };
-  }
-
-  return null;
-}
-
-async function tryRewriteProviderInPlace(change, replacement) {
-  let handle;
-  let writeStarted = false;
-  try {
-    handle = await fsp.open(change.path, "r+");
-    const stat = await handle.stat();
-    if (!snapshotMatches(change, { size: stat.size, mtimeMs: stat.mtimeMs })) {
-      return "SKIP_CHANGED";
-    }
-
-    let totalWritten = 0;
-    writeStarted = true;
-    while (totalWritten < replacement.replacement.length) {
-      const { bytesWritten } = await handle.write(
-        replacement.replacement,
-        totalWritten,
-        replacement.replacement.length - totalWritten,
-        replacement.byteOffset + totalWritten
-      );
-      if (bytesWritten <= 0) {
-        throw new Error(`Unable to rewrite provider bytes in rollout file: ${change.path}`);
-      }
-      totalWritten += bytesWritten;
-    }
-    await handle.sync();
-    return "APPLIED_IN_PLACE";
-  } catch (error) {
-    if (handle && writeStarted) {
-      try {
-        let totalRestored = 0;
-        while (totalRestored < replacement.original.length) {
-          const { bytesWritten } = await handle.write(
-            replacement.original,
-            totalRestored,
-            replacement.original.length - totalRestored,
-            replacement.byteOffset + totalRestored
-          );
-          if (bytesWritten <= 0) {
-            throw new Error(`Unable to restore provider bytes in rollout file: ${change.path}`);
-          }
-          totalRestored += bytesWritten;
-        }
-        await handle.sync();
-        return "FALLBACK";
-      } catch (restoreError) {
-        throw new AggregateError(
-          [error, restoreError],
-          `Unable to restore provider bytes after an in-place rewrite failure: ${change.path}`
-        );
-      }
-    }
-    throw wrapRolloutFileBusyError(error, change.path, "rewrite");
-  } finally {
-    await handle?.close();
-  }
-}
-
 async function tryRewriteCollectedFirstLine(change) {
   const beforeSnapshot = await getFileSnapshot(change.path);
   if (!snapshotMatches(change, beforeSnapshot)) {
@@ -828,14 +749,6 @@ async function tryRewriteCollectedFirstLine(change) {
     return "SKIP_CHANGED";
   }
 
-  const inPlaceReplacement = getInPlaceProviderReplacement(change);
-  if (inPlaceReplacement) {
-    const inPlaceResult = await tryRewriteProviderInPlace(change, inPlaceReplacement);
-    if (inPlaceResult !== "FALLBACK") {
-      return inPlaceResult;
-    }
-  }
-
   const tmpPath = `${change.path}.provider-sync.${process.pid}.${Date.now()}.tmp`;
   const writer = fs.createWriteStream(tmpPath, { encoding: "utf8" });
 
@@ -867,7 +780,10 @@ async function tryRewriteCollectedFirstLine(change) {
       return "SKIP_CHANGED";
     }
 
+    await fsp.chmod(tmpPath, beforeSnapshot.mode);
+    await syncStagedFile(tmpPath);
     await fsp.rename(tmpPath, change.path);
+    await syncDirectory(path.dirname(change.path));
     return "APPLIED";
   } catch (error) {
     await fsp.rm(tmpPath, { force: true });
@@ -992,7 +908,21 @@ async function rewriteRolloutModelField(change, targetModel) {
       return { replacedLines: 0, originalTurnContextModels: [] };
     }
 
+    // Validate the immutable scan-time rollback snapshot before replacing the
+    // file. A turn_context appended after the first-line mutation must not be
+    // rewritten and then discovered only after the destructive rename: that
+    // new line has no original value in the backup manifest. Throwing here
+    // leaves the appended line untouched and lets the transaction restore the
+    // already-mutated first line.
+    if (!modelSnapshotsEqual(change.originalTurnContextModels, originalTurnContextModels)) {
+      await fsp.rm(tmpPath, { force: true });
+      throw new Error(`Rollout turn_context model snapshot changed before rewrite: ${change.path}`);
+    }
+
+    await fsp.chmod(tmpPath, beforeStat.mode);
+    await syncStagedFile(tmpPath);
     await fsp.rename(tmpPath, filePath);
+    await syncDirectory(path.dirname(filePath));
     return { replacedLines: replacements, originalTurnContextModels };
   } catch (error) {
     throw wrapRolloutFileBusyError(error, filePath, "rewrite model field");
@@ -1109,10 +1039,12 @@ export async function collectSessionChanges(codexHome, targetProvider, options =
       // keep this on the summary so the rewrite step knows what
       // value to swap out, without making collectSessionChanges
       // require a target model.
-      const currentModels = await readTurnContextModels(rolloutPath, {
+      const modelSnapshot = await readTurnContextModelSnapshot(rolloutPath, {
         firstLineOffset: 0,
-        firstLineLength: record.offset
+        firstLineLength: record.offset,
+        targetModel
       });
+      const currentModels = modelSnapshot.models;
       const originalModel = currentModels[0] ?? null;
 
       // A file is rewritten when EITHER the provider needs to
@@ -1144,6 +1076,7 @@ export async function collectSessionChanges(codexHome, targetProvider, options =
           originalProvider: currentProvider,
           updatedProvider: targetProvider,
           originalModel,
+          originalTurnContextModels: modelSnapshot.originalTurnContextModels,
           modelRewriteRequired: modelChanged,
           modelOnlyChange: !providerChanged && modelChanged,
           updatedFirstLine: providerChanged ? JSON.stringify(parsed) : record.firstLine
@@ -1157,7 +1090,13 @@ export async function collectSessionChanges(codexHome, targetProvider, options =
 
 export async function applySessionChanges(changes, options = {}) {
   const normalizedChanges = changes ?? [];
-  const { targetModel = null } = options ?? {};
+  const {
+    targetModel = null,
+    onBeforeApply,
+    onMutation,
+    onApplied,
+    onSkipped
+  } = options ?? {};
   const skippedPaths = [];
   const appliedPaths = [];
   let appliedChanges = 0;
@@ -1174,40 +1113,55 @@ export async function applySessionChanges(changes, options = {}) {
   const firstLineChanges = normalizedChanges.filter((change) => !change?.modelOnlyChange);
 
   if (process.platform === "win32") {
-    const results = firstLineChanges.length > 0
-      ? await invokeWindowsExclusiveRewriteBatch(firstLineChanges, { requireOriginalMatch: true })
-      : [];
-    for (let index = 0; index < firstLineChanges.length; index += 1) {
-      const change = firstLineChanges[index];
-      if (results[index] === "APPLIED" || results[index] === "APPLIED_IN_PLACE") {
+    // Process one file per helper invocation. A failed Windows batch cannot
+    // report which earlier members were already replaced, which was the root
+    // cause of #69. Per-target calls let the durable coordinator observe each
+    // successful mutation before the next target starts.
+    for (const change of firstLineChanges) {
+      await onBeforeApply?.(change);
+      const [result] = await invokeWindowsExclusiveRewriteBatch([change], { requireOriginalMatch: true });
+      if (result === "APPLIED" || result === "APPLIED_IN_PLACE") {
         appliedChanges += 1;
-        inPlaceChanges += results[index] === "APPLIED_IN_PLACE" ? 1 : 0;
+        inPlaceChanges += result === "APPLIED_IN_PLACE" ? 1 : 0;
         appliedPaths.push(change.path);
+        await onMutation?.(change, { stage: "firstLine", result });
         if (change.modelRewriteRequired) {
           const modelResult = await rewriteRolloutModelField(change, targetModel);
-          change.originalTurnContextModels = modelResult.originalTurnContextModels;
+          retainOrValidateModelSnapshot(change, modelResult.originalTurnContextModels);
           change.appliedTurnContextRewrites = modelResult.replacedLines;
+          if (modelResult.replacedLines > 0) {
+            await onMutation?.(change, { stage: "model", result: "APPLIED" });
+          }
         }
         await restoreOriginalMtime(change.path, change.originalMtimeMs);
+        await onApplied?.(change);
       } else {
         skippedPaths.push(change.path);
+        await onSkipped?.(change, result);
       }
     }
   } else {
     for (const change of firstLineChanges) {
+      await onBeforeApply?.(change);
       const result = await tryRewriteCollectedFirstLine(change);
       if (result === "APPLIED" || result === "APPLIED_IN_PLACE") {
         appliedChanges += 1;
         inPlaceChanges += result === "APPLIED_IN_PLACE" ? 1 : 0;
         appliedPaths.push(change.path);
+        await onMutation?.(change, { stage: "firstLine", result });
         if (change.modelRewriteRequired) {
           const modelResult = await rewriteRolloutModelField(change, targetModel);
-          change.originalTurnContextModels = modelResult.originalTurnContextModels;
+          retainOrValidateModelSnapshot(change, modelResult.originalTurnContextModels);
           change.appliedTurnContextRewrites = modelResult.replacedLines;
+          if (modelResult.replacedLines > 0) {
+            await onMutation?.(change, { stage: "model", result: "APPLIED" });
+          }
         }
         await restoreOriginalMtime(change.path, change.originalMtimeMs);
+        await onApplied?.(change);
       } else {
         skippedPaths.push(change.path);
+        await onSkipped?.(change, result);
       }
     }
   }
@@ -1220,6 +1174,7 @@ export async function applySessionChanges(changes, options = {}) {
   // the file's timestamp is preserved exactly the way the user
   // set it.
   for (const change of modelOnlyChanges) {
+    await onBeforeApply?.(change);
     let modelResult;
     try {
       modelResult = await rewriteRolloutModelField(change, targetModel);
@@ -1228,13 +1183,16 @@ export async function applySessionChanges(changes, options = {}) {
       throw error;
     }
     if (modelResult.replacedLines > 0) {
+      retainOrValidateModelSnapshot(change, modelResult.originalTurnContextModels);
+      await onMutation?.(change, { stage: "model", result: "APPLIED" });
       await restoreOriginalMtime(change.path, change.originalMtimeMs);
       appliedChanges += 1;
       appliedPaths.push(change.path);
-      change.originalTurnContextModels = modelResult.originalTurnContextModels;
       change.appliedTurnContextRewrites = modelResult.replacedLines;
+      await onApplied?.(change);
     } else {
       skippedPaths.push(change.path);
+      await onSkipped?.(change, "SKIP_CHANGED");
     }
   }
 
@@ -1248,6 +1206,23 @@ export async function applySessionChanges(changes, options = {}) {
   };
 }
 
+function retainOrValidateModelSnapshot(change, actualSnapshot) {
+  const expected = change.originalTurnContextModels;
+  if (!Array.isArray(expected) || expected.length === 0) {
+    change.originalTurnContextModels = actualSnapshot;
+    return;
+  }
+  if (JSON.stringify(expected) !== JSON.stringify(actualSnapshot)) {
+    throw new Error(`Rollout turn_context model snapshot changed before rewrite: ${change.path}`);
+  }
+}
+
+function modelSnapshotsEqual(expected, actual) {
+  return Array.isArray(expected)
+    && Array.isArray(actual)
+    && JSON.stringify(expected) === JSON.stringify(actual);
+}
+
 export async function assertSessionFilesWritable(changes) {
   if (!changes?.length || process.platform !== "win32") {
     return;
@@ -1298,45 +1273,66 @@ export async function splitLockedSessionChanges(changes) {
   };
 }
 
-export async function restoreSessionChanges(manifestEntries) {
+export async function restoreSessionChanges(manifestEntries, options = {}) {
   if (!manifestEntries?.length) {
-    return;
+    return { restoredPaths: [], failures: [] };
   }
 
-  if (process.platform === "win32") {
-    const firstLineEntries = manifestEntries.filter((entry) => !entry.modelOnlyChange);
-    const changes = firstLineEntries.map((entry) => ({
-      path: entry.path,
-      separator: entry.originalSeparator ?? "\n",
-      updatedFirstLine: entry.originalFirstLine,
-      originalMtimeMs: entry.originalMtimeMs
-    }));
-    const results = await invokeWindowsExclusiveRewriteBatch(changes, { requireOriginalMatch: false });
-    const firstFailureIndex = results.findIndex((result) => result !== "APPLIED");
-    if (firstFailureIndex !== -1) {
-      const filePath = changes[firstFailureIndex].path;
-      throw new Error(
-        `Unable to rewrite rollout file because it is currently in use. Close Codex and the Codex app, then retry. Locked file: ${filePath}`
-      );
-    }
-    for (const entry of manifestEntries) {
+  const restoredPaths = [];
+  const failures = [];
+  for (const entry of manifestEntries) {
+    try {
+      await options.onBeforeRestore?.(entry);
+      if (!entry.modelOnlyChange) {
+        if (process.platform === "win32") {
+          const [result] = await invokeWindowsExclusiveRewriteBatch([{
+            path: entry.path,
+            separator: entry.originalSeparator ?? "\n",
+            updatedFirstLine: entry.originalFirstLine,
+            originalMtimeMs: entry.originalMtimeMs
+          }], { requireOriginalMatch: false });
+          if (result !== "APPLIED") {
+            throw new Error(
+              `Unable to rewrite rollout file because it is currently in use. Close Codex and the Codex app, then retry. Locked file: ${entry.path}`
+            );
+          }
+        } else {
+          await rewriteFirstLine(entry.path, entry.originalFirstLine, entry.originalSeparator ?? "\n");
+        }
+      }
       if (entry.originalTurnContextModels?.length) {
         await restoreTurnContextModelsInFile(entry.path, entry.originalTurnContextModels, entry.originalSeparator);
       }
       await restoreOriginalMtime(entry.path, entry.originalMtimeMs);
+      restoredPaths.push(entry.path);
+      await options.onRestored?.(entry);
+    } catch (error) {
+      const failure = new Error(`Unable to restore rollout ${entry.path}: ${error.message}`, { cause: error });
+      failure.path = entry.path;
+      failures.push(failure);
+      try {
+        await options.onRestoreFailed?.(entry, error);
+      } catch (observerError) {
+        failures.push(new Error(
+          `Unable to record rollout restore failure for ${entry.path}: ${observerError.message}`,
+          { cause: observerError }
+        ));
+      }
     }
-    return;
   }
 
-  for (const entry of manifestEntries) {
-    if (!entry.modelOnlyChange) {
-      await rewriteFirstLine(entry.path, entry.originalFirstLine, entry.originalSeparator ?? "\n");
-    }
-    if (entry.originalTurnContextModels?.length) {
-      await restoreTurnContextModelsInFile(entry.path, entry.originalTurnContextModels, entry.originalSeparator);
-    }
-    await restoreOriginalMtime(entry.path, entry.originalMtimeMs);
+  if (failures.length > 0) {
+    const aggregate = new AggregateError(
+      failures,
+      `Unable to restore ${failures.length} rollout target operation(s).`
+    );
+    aggregate.failures = failures.map((failure) => ({
+      path: failure.path ?? null,
+      message: failure.message
+    }));
+    throw aggregate;
   }
+  return { restoredPaths, failures: [] };
 }
 
 // Walk a rollout file and restore the per-turn `model` field for
@@ -1443,7 +1439,10 @@ async function restoreTurnContextModelsInFile(filePath, originalTurnContextModel
       return;
     }
 
+    await fsp.chmod(tmpPath, beforeStat.mode);
+    await syncStagedFile(tmpPath);
     await fsp.rename(tmpPath, filePath);
+    await syncDirectory(path.dirname(filePath));
   } catch (error) {
     throw wrapRolloutFileBusyError(error, filePath, "restore turn_context model");
   } finally {
diff --git a/src/sqlite-state.js b/src/sqlite-state.js
index fe4e9e7..513aaf7 100644
--- a/src/sqlite-state.js
+++ b/src/sqlite-state.js
@@ -1,6 +1,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 
+import { syncDirectory } from "./atomic-file.js";
 import { DB_FILE_BASENAME, SESSION_DIRS, SQLITE_DIR_BASENAME } from "./constants.js";
 import { openDatabase } from "./sqlite.js";
 import { resolveStorageLayout } from "./storage-layout.js";
@@ -186,6 +187,15 @@ function setBusyTimeout(db, busyTimeoutMs) {
   db.exec(`PRAGMA busy_timeout = ${normalizeBusyTimeoutMs(busyTimeoutMs)}`);
 }
 
+export function configureSqliteWriteDurability(db) {
+  db.exec("PRAGMA synchronous = FULL");
+  const synchronous = Number(db.prepare("PRAGMA synchronous").get().synchronous);
+  if (synchronous !== 2) {
+    throw new Error(`Unable to configure SQLite synchronous=FULL (reported ${synchronous}).`);
+  }
+  return { synchronous: "full", value: synchronous };
+}
+
 function isSqliteBusyError(error) {
   const message = `${error?.code ?? ""} ${error?.message ?? ""}`.toLowerCase();
   return message.includes("database is locked") || message.includes("sqlite_busy") || message.includes("busy");
@@ -328,6 +338,7 @@ export async function assertSqliteWritable(storageOrLocation, options = {}) {
   try {
     db = await openDatabase(dbPath);
     setBusyTimeout(db, options.busyTimeoutMs);
+    configureSqliteWriteDurability(db);
     db.exec("BEGIN IMMEDIATE");
     db.exec("ROLLBACK");
     return { databasePresent: true };
@@ -358,6 +369,7 @@ export async function updateSqliteProvider(storageOrLocation, targetProvider, af
       await afterUpdate({
         updatedRows: 0,
         providerRowsUpdated: 0,
+        modelRowsUpdated: 0,
         userEventRowsUpdated: 0,
         cwdRowsUpdated: 0,
         databasePresent: false
@@ -366,6 +378,7 @@ export async function updateSqliteProvider(storageOrLocation, targetProvider, af
     return {
       updatedRows: 0,
       providerRowsUpdated: 0,
+      modelRowsUpdated: 0,
       userEventRowsUpdated: 0,
       cwdRowsUpdated: 0,
       databasePresent: false
@@ -377,6 +390,7 @@ export async function updateSqliteProvider(storageOrLocation, targetProvider, af
   try {
     db = await openDatabase(dbPath);
     setBusyTimeout(db, options.busyTimeoutMs);
+    configureSqliteWriteDurability(db);
     db.exec("BEGIN IMMEDIATE");
     transactionOpen = true;
     // When a target model is provided, align every thread's `model` column
@@ -387,16 +401,22 @@ export async function updateSqliteProvider(storageOrLocation, targetProvider, af
     // with tableHasColumn to keep legacy layouts working.
     const wantsModel = targetModel != null && targetModel.length > 0
       && tableHasColumn(db, "threads", "model");
-    const stmt = db.prepare(wantsModel
-      ? `UPDATE threads
-         SET model_provider = ?, model = ?
-         WHERE COALESCE(model_provider, '') <> ? OR COALESCE(model, '') <> ?`
-      : `UPDATE threads
-         SET model_provider = ?
-         WHERE COALESCE(model_provider, '') <> ?`);
-    const result = wantsModel
-      ? stmt.run(targetProvider, targetModel, targetProvider, targetModel)
-      : stmt.run(targetProvider, targetProvider);
+    // Keep the update shape and counters identical to .NET: provider and
+    // optional model are independent writes, and a row changed in both
+    // columns contributes two to updatedRows.
+    const providerResult = db.prepare(`
+      UPDATE threads
+      SET model_provider = ?
+      WHERE COALESCE(model_provider, '') <> ?
+    `).run(targetProvider, targetProvider);
+    let modelUpdatedRows = 0;
+    if (wantsModel) {
+      modelUpdatedRows = db.prepare(`
+        UPDATE threads
+        SET model = ?
+        WHERE COALESCE(model, '') <> ?
+      `).run(targetModel, targetModel).changes ?? 0;
+    }
     let userEventUpdatedRows = 0;
     if (tableHasColumn(db, "threads", "has_user_event") && options.userEventThreadIds?.size) {
       const userEventStmt = db.prepare(`
@@ -422,25 +442,27 @@ export async function updateSqliteProvider(storageOrLocation, targetProvider, af
         cwdUpdatedRows += cwdStmt.run(cwd, threadId, cwd).changes ?? 0;
       }
     }
-    const updatedRows = (result.changes ?? 0) + userEventUpdatedRows + cwdUpdatedRows;
-    if (afterUpdate) {
-      await afterUpdate({
-        updatedRows,
-        providerRowsUpdated: result.changes ?? 0,
-        userEventRowsUpdated: userEventUpdatedRows,
-        cwdRowsUpdated: cwdUpdatedRows,
-        databasePresent: true
-      });
-    }
-    db.exec("COMMIT");
-    transactionOpen = false;
-    return {
+    const providerUpdatedRows = providerResult.changes ?? 0;
+    const updatedRows = providerUpdatedRows + modelUpdatedRows + userEventUpdatedRows + cwdUpdatedRows;
+    const result = {
       updatedRows,
-      providerRowsUpdated: result.changes ?? 0,
+      providerRowsUpdated: providerUpdatedRows,
+      modelRowsUpdated: modelUpdatedRows,
       userEventRowsUpdated: userEventUpdatedRows,
       cwdRowsUpdated: cwdUpdatedRows,
       databasePresent: true
     };
+    if (afterUpdate) {
+      await afterUpdate(result);
+    }
+    // Record the boundary before COMMIT. A COMMIT exception cannot prove the
+    // transaction was not made durable, so the coordinator must compensate
+    // from its bound backup whenever this attempt covered actual mutations.
+    options.onCommitAttempt?.(result);
+    db.exec("COMMIT");
+    transactionOpen = false;
+    await options.afterCommit?.(result);
+    return result;
   } catch (error) {
     if (transactionOpen) {
       try {
@@ -457,3 +479,179 @@ export async function updateSqliteProvider(storageOrLocation, targetProvider, af
     db?.close();
   }
 }
+
+function readSqliteConnectionMetadata(db) {
+  return {
+    journalMode: String(db.prepare("PRAGMA journal_mode").get().journal_mode).toLowerCase(),
+    pageSize: Number(db.prepare("PRAGMA page_size").get().page_size),
+    userVersion: Number(db.prepare("PRAGMA user_version").get().user_version),
+    applicationId: Number(db.prepare("PRAGMA application_id").get().application_id)
+  };
+}
+
+async function readStandaloneSqliteHeaderMetadata(dbPath) {
+  const handle = await fs.open(dbPath, "r");
+  try {
+    const header = Buffer.alloc(100);
+    const { bytesRead } = await handle.read(header, 0, header.length, 0);
+    if (bytesRead !== header.length
+      || header.subarray(0, 16).toString("binary") !== "SQLite format 3\u0000") {
+      throw new Error("SQLite online backup did not produce a valid standalone database header.");
+    }
+    const rawPageSize = header.readUInt16BE(16);
+    return {
+      journalMode: header[18] === 2 && header[19] === 2 ? "wal" : "delete",
+      pageSize: rawPageSize === 1 ? 65536 : rawPageSize,
+      userVersion: header.readInt32BE(60),
+      applicationId: header.readInt32BE(68)
+    };
+  } finally {
+    await handle.close();
+  }
+}
+
+async function pathExists(filePath) {
+  try {
+    await fs.access(filePath);
+    return true;
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+
+/**
+ * Create one consistent SQLite database file via the active driver's official
+ * online-backup API. WAL/SHM sidecars are intentionally neither copied nor
+ * emitted; metadata is read from the standalone main-file header.
+ */
+export async function createSqliteOnlineBackup(storageOrLocation, destinationPath, options = {}) {
+  const dbPath = await existingStateDbPath(storageOrLocation);
+  if (!dbPath) {
+    return { databasePresent: false, backupPath: null, driver: null, metadata: null };
+  }
+
+  const fullSourcePath = path.resolve(dbPath);
+  const fullDestinationPath = path.resolve(destinationPath);
+  const sourceIdentityPath = process.platform === "win32" ? fullSourcePath.toLowerCase() : fullSourcePath;
+  const destinationIdentityPath = process.platform === "win32"
+    ? fullDestinationPath.toLowerCase()
+    : fullDestinationPath;
+  if (sourceIdentityPath === destinationIdentityPath) {
+    throw new Error("SQLite online backup destination must differ from the source database.");
+  }
+  await fs.mkdir(path.dirname(fullDestinationPath), { recursive: true });
+  if (await pathExists(fullDestinationPath)) {
+    throw new Error("SQLite online backup destination already exists.");
+  }
+
+  let db;
+  try {
+    // Read-only is deliberate: a database that disappears after discovery
+    // must fail here instead of being silently recreated as an empty file.
+    db = await openDatabase(fullSourcePath, { readOnly: true });
+    setBusyTimeout(db, options.busyTimeoutMs);
+    const sourceMetadata = readSqliteConnectionMetadata(db);
+    const driver = db.driver ?? "unknown";
+    await db.backup(fullDestinationPath, options.backupOptions ?? {});
+
+    const handle = await fs.open(fullDestinationPath, "r+");
+    try {
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await syncDirectory(path.dirname(fullDestinationPath));
+
+    const sidecars = [`${fullDestinationPath}-wal`, `${fullDestinationPath}-shm`];
+    if ((await Promise.all(sidecars.map(pathExists))).some(Boolean)) {
+      throw new Error("SQLite online backup unexpectedly emitted a WAL/SHM sidecar.");
+    }
+    const backupMetadata = await readStandaloneSqliteHeaderMetadata(fullDestinationPath);
+    return {
+      databasePresent: true,
+      backupPath: fullDestinationPath,
+      driver,
+      metadata: {
+        source: sourceMetadata,
+        backup: backupMetadata,
+        preserved: {
+          journalMode: sourceMetadata.journalMode === backupMetadata.journalMode,
+          pageSize: sourceMetadata.pageSize === backupMetadata.pageSize,
+          userVersion: sourceMetadata.userVersion === backupMetadata.userVersion,
+          applicationId: sourceMetadata.applicationId === backupMetadata.applicationId
+        }
+      }
+    };
+  } catch (error) {
+    await Promise.all([
+      fullDestinationPath,
+      `${fullDestinationPath}-wal`,
+      `${fullDestinationPath}-shm`
+    ].map((filePath) => fs.rm(filePath, { force: true }).catch(() => {})));
+    throw wrapSqliteMalformedError(
+      wrapSqliteBusyError(error, "create a consistent SQLite online backup"),
+      "create a consistent SQLite online backup"
+    );
+  } finally {
+    db?.close();
+  }
+}
+
+/**
+ * Restore a standalone SQLite snapshot through SQLite's online-backup API.
+ *
+ * The backup is the source and the live database is the destination. SQLite
+ * keeps a write transaction open on the destination for the operation and
+ * rolls it back if the backup does not finish. In particular, live WAL/SHM
+ * files must never be unlinked or copied by this path.
+ */
+export async function restoreSqliteOnlineBackup(sourcePath, destinationPath, options = {}) {
+  const fullSourcePath = path.resolve(sourcePath);
+  const fullDestinationPath = path.resolve(destinationPath);
+  const sourceIdentityPath = process.platform === "win32"
+    ? fullSourcePath.toLowerCase()
+    : fullSourcePath;
+  const destinationIdentityPath = process.platform === "win32"
+    ? fullDestinationPath.toLowerCase()
+    : fullDestinationPath;
+  if (sourceIdentityPath === destinationIdentityPath) {
+    throw new Error("SQLite online restore source must differ from the destination database.");
+  }
+
+  let source;
+  try {
+    const sourceStat = await fs.stat(fullSourcePath);
+    if (!sourceStat.isFile()) {
+      throw new Error(`SQLite restore source is not a regular file: ${fullSourcePath}`);
+    }
+
+    // Open and inspect the source before SQLite is allowed to touch the live
+    // destination. readOnly also closes the disappearance race without ever
+    // creating an empty source database.
+    source = await openDatabase(fullSourcePath, { readOnly: true });
+    setBusyTimeout(source, options.busyTimeoutMs);
+    readSqliteConnectionMetadata(source);
+
+    await fs.mkdir(path.dirname(fullDestinationPath), { recursive: true });
+    await source.backup(fullDestinationPath, options.backupOptions ?? {});
+
+    await syncDirectory(path.dirname(fullDestinationPath));
+    return {
+      sourcePath: fullSourcePath,
+      destinationPath: fullDestinationPath,
+      driver: source.driver ?? "unknown"
+    };
+  } catch (error) {
+    // Never delete or replace destination artifacts here. SQLite owns the
+    // destination transaction and rolls it back on an unfinished backup.
+    throw wrapSqliteMalformedError(
+      wrapSqliteBusyError(error, "restore a consistent SQLite online backup"),
+      "restore a consistent SQLite online backup"
+    );
+  } finally {
+    source?.close();
+  }
+}
diff --git a/src/sqlite.js b/src/sqlite.js
index 57da76d..ae9be21 100644
--- a/src/sqlite.js
+++ b/src/sqlite.js
@@ -6,6 +6,7 @@ function normalizeImportDefault(moduleNamespace) {
 
 class BetterSqliteDatabase {
   constructor(Database, dbPath, options = {}) {
+    this.driver = "better-sqlite3";
     this.db = new Database(dbPath, {
       readonly: Boolean(options.readOnly)
     });
@@ -19,6 +20,34 @@ class BetterSqliteDatabase {
     return this.db.exec(sql);
   }
 
+  async backup(destinationPath, options = {}) {
+    return this.db.backup(destinationPath, options);
+  }
+
+  close() {
+    return this.db.close();
+  }
+}
+
+class NodeSqliteDatabase {
+  constructor(sqlite, dbPath, options = {}) {
+    this.driver = "node:sqlite";
+    this.sqlite = sqlite;
+    this.db = new sqlite.DatabaseSync(dbPath, options);
+  }
+
+  prepare(sql) {
+    return this.db.prepare(sql);
+  }
+
+  exec(sql) {
+    return this.db.exec(sql);
+  }
+
+  async backup(destinationPath, options = {}) {
+    return this.sqlite.backup(this.db, destinationPath, options);
+  }
+
   close() {
     return this.db.close();
   }
@@ -27,8 +56,8 @@ class BetterSqliteDatabase {
 async function loadDatabaseFactory() {
   try {
     const sqlite = await import("node:sqlite");
-    if (sqlite.DatabaseSync) {
-      return (dbPath, options) => new sqlite.DatabaseSync(dbPath, options);
+    if (sqlite.DatabaseSync && typeof sqlite.backup === "function") {
+      return (dbPath, options) => new NodeSqliteDatabase(sqlite, dbPath, options);
     }
   } catch {
     // Older Node.js releases do not include node:sqlite.
diff --git a/src/transaction-journal.js b/src/transaction-journal.js
new file mode 100644
index 0000000..65ee655
--- /dev/null
+++ b/src/transaction-journal.js
@@ -0,0 +1,497 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+
+import { defaultBackupRoot } from "./constants.js";
+import { writeFileAtomic, syncDirectory } from "./atomic-file.js";
+
+export const TRANSACTION_JOURNAL_BASENAME = "transaction-journal.jsonl";
+const TERMINAL_STATES = new Set(["committed", "rolledBack"]);
+const TARGET_STATES = new Set(["applying", "applied", "skipped"]);
+const VALID_STATES = new Set([
+  "prepared",
+  ...TARGET_STATES,
+  "committed",
+  "rollingBack",
+  "rolledBack",
+  "recoveryRequired"
+]);
+const VALID_TARGET_KINDS = new Set(["config", "rollout", "globalState", "sqlite"]);
+
+function pathKey(value) {
+  const resolved = path.resolve(value);
+  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+
+function targetKey(kind, targetPath) {
+  return `${kind}\0${pathKey(targetPath)}`;
+}
+
+async function appendDurableJsonLine(filePath, value) {
+  let existed = true;
+  try {
+    await fs.access(filePath);
+  } catch (error) {
+    if (error?.code !== "ENOENT") {
+      throw error;
+    }
+    existed = false;
+  }
+  const handle = await fs.open(filePath, "a");
+  try {
+    await handle.writeFile(`${JSON.stringify(value)}\n`, "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  if (!existed) {
+    await syncDirectory(path.dirname(filePath));
+  }
+}
+
+export class TransactionJournal {
+  constructor(filePath, operationId, sequence = 0) {
+    this.filePath = filePath;
+    this.operationId = operationId;
+    this.sequence = sequence;
+  }
+
+  static async create(backupDir, details) {
+    const operationId = randomUUID();
+    const filePath = path.join(backupDir, TRANSACTION_JOURNAL_BASENAME);
+    const journal = new TransactionJournal(filePath, operationId);
+    const potentialTargetsByKey = new Map();
+    for (const value of details.potentialTargets) {
+      const resolved = path.resolve(value);
+      potentialTargetsByKey.set(pathKey(resolved), resolved);
+    }
+    const prepared = {
+      protocolVersion: 1,
+      operationId,
+      sequence: 1,
+      state: "prepared",
+      recordedAt: new Date().toISOString(),
+      backupDir: path.resolve(backupDir),
+      codexHome: path.resolve(details.codexHome),
+      targetProvider: details.targetProvider,
+      potentialTargets: [...potentialTargetsByKey.values()].sort()
+    };
+    const exclusive = await fs.open(filePath, "wx", 0o600);
+    try {
+      await exclusive.writeFile(`${JSON.stringify(prepared)}\n`, "utf8");
+      await exclusive.sync();
+    } finally {
+      await exclusive.close();
+    }
+    await syncDirectory(path.dirname(filePath));
+    journal.sequence = 1;
+    return journal;
+  }
+
+  async append(state, details = {}) {
+    const nextSequence = this.sequence + 1;
+    const event = {
+      ...details,
+      protocolVersion: 1,
+      operationId: this.operationId,
+      sequence: nextSequence,
+      state,
+      recordedAt: new Date().toISOString()
+    };
+    try {
+      await appendDurableJsonLine(this.filePath, event);
+      this.sequence = nextSequence;
+    } catch (error) {
+      // A host may report a flush error after the bytes reached the file. Keep
+      // subsequent records sequence-compatible with the durable prefix while
+      // still surfacing the original durability failure to the coordinator.
+      try {
+        const current = await readTransactionJournal(this.filePath);
+        const lastEvent = current.events.at(-1) ?? null;
+        if (!current.invalidTail
+            && lastEvent !== null
+            && JSON.stringify(lastEvent) === JSON.stringify(event)) {
+          this.sequence = nextSequence;
+        } else if (!current.invalidTail) {
+          this.sequence = lastEvent?.sequence ?? this.sequence;
+        }
+      } catch {
+        // The original append error remains authoritative.
+      }
+      throw error;
+    }
+  }
+
+  async applying(kind, targetPath) {
+    await this.append("applying", { kind, targetPath: path.resolve(targetPath) });
+  }
+
+  async applied(kind, targetPath) {
+    await this.append("applied", { kind, targetPath: path.resolve(targetPath) });
+  }
+
+  async skipped(kind, targetPath) {
+    await this.append("skipped", { kind, targetPath: path.resolve(targetPath) });
+  }
+
+  async committed() {
+    await this.append("committed");
+  }
+
+  async rollingBack(originalError) {
+    await this.append("rollingBack", { originalError: String(originalError?.message ?? originalError) });
+  }
+
+  async rolledBack() {
+    await this.append("rolledBack");
+  }
+
+  async recoveryRequired(originalError, rollbackErrors) {
+    await this.append("recoveryRequired", {
+      originalError: String(originalError?.message ?? originalError),
+      rollbackErrors: rollbackErrors.map(String)
+    });
+  }
+}
+
+function validateJournalEvents(parsedEvents) {
+  const events = [];
+  const activeTargets = new Set();
+  let operationId = null;
+  let expectedSequence = 1;
+  let terminalSeen = false;
+  let rollingBack = false;
+  let recoveryRequiredSeen = false;
+  let potentialTargets = null;
+  let validationError = null;
+
+  for (const event of parsedEvents) {
+    const fail = (message) => {
+      validationError = message;
+      return false;
+    };
+    if (!event || typeof event !== "object" || Array.isArray(event)) {
+      fail("Journal event is not an object.");
+      break;
+    }
+    if (event.protocolVersion !== 1 || !VALID_STATES.has(event.state)) {
+      fail("Journal event has an unsupported protocol or state.");
+      break;
+    }
+    if (typeof event.operationId !== "string" || !event.operationId) {
+      fail("Journal event is missing operationId.");
+      break;
+    }
+    if (event.sequence !== expectedSequence) {
+      fail(`Journal sequence mismatch: expected ${expectedSequence}, received ${event.sequence}.`);
+      break;
+    }
+    if (operationId === null) {
+      if (event.state !== "prepared") {
+        fail("Journal must start with prepared.");
+        break;
+      }
+      operationId = event.operationId;
+      if (!Array.isArray(event.potentialTargets)
+          || event.potentialTargets.some((value) => typeof value !== "string" || !path.isAbsolute(value))) {
+        fail("Journal prepared event has invalid potentialTargets.");
+        break;
+      }
+      potentialTargets = new Set(event.potentialTargets.map(pathKey));
+      if (potentialTargets.size !== event.potentialTargets.length
+          || typeof event.backupDir !== "string"
+          || !path.isAbsolute(event.backupDir)
+          || typeof event.codexHome !== "string"
+          || !path.isAbsolute(event.codexHome)) {
+        fail("Journal prepared event has duplicate targets or invalid absolute roots.");
+        break;
+      }
+    } else if (event.operationId !== operationId) {
+      fail("Journal operationId changed within one transaction.");
+      break;
+    } else if (event.state === "prepared") {
+      fail("Journal contains more than one prepared event.");
+      break;
+    }
+    if (terminalSeen) {
+      fail("Journal contains events after a terminal state.");
+      break;
+    }
+
+    if (recoveryRequiredSeen && event.state !== "rolledBack") {
+      fail("Journal continued after recoveryRequired without an explicit restore.");
+      break;
+    }
+    if (rollingBack
+        && !new Set(["rollingBack", "recoveryRequired", "rolledBack"]).has(event.state)) {
+      fail("Journal continued target work after rollback started.");
+      break;
+    }
+
+    if (TARGET_STATES.has(event.state)) {
+      if (rollingBack) {
+        fail("Journal contains a target transition after rollback started.");
+        break;
+      }
+      if (!VALID_TARGET_KINDS.has(event.kind)
+          || typeof event.targetPath !== "string"
+          || !path.isAbsolute(event.targetPath)) {
+        fail("Journal target transition is malformed.");
+        break;
+      }
+      if (!potentialTargets?.has(pathKey(event.targetPath))) {
+        fail("Journal target is not declared in prepared.potentialTargets.");
+        break;
+      }
+      const key = targetKey(event.kind, event.targetPath);
+      if (event.state === "applying") {
+        if (activeTargets.has(key)) {
+          fail("Journal target was started twice without a result.");
+          break;
+        }
+        activeTargets.add(key);
+      } else if (!activeTargets.delete(key)) {
+        fail(`Journal ${event.state} event has no matching applying event.`);
+        break;
+      }
+    } else if (event.state === "rollingBack") {
+      if (rollingBack) {
+        fail("Journal contains duplicate rollingBack events.");
+        break;
+      }
+      rollingBack = true;
+    } else if (event.state === "recoveryRequired") {
+      recoveryRequiredSeen = true;
+    } else if (event.state === "committed") {
+      if (rollingBack || activeTargets.size > 0) {
+        fail("Journal committed with unresolved target transitions.");
+        break;
+      }
+      terminalSeen = true;
+    } else if (event.state === "rolledBack") {
+      if (!rollingBack && !recoveryRequiredSeen) {
+        fail("Journal rolledBack without first entering rollback or recoveryRequired.");
+        break;
+      }
+      terminalSeen = true;
+    }
+
+    events.push(event);
+    expectedSequence += 1;
+  }
+
+  return { events, operationId, validationError };
+}
+
+export async function readTransactionJournal(filePath) {
+  const text = await fs.readFile(filePath, "utf8");
+  const parsedEvents = [];
+  let parseError = text.length > 0 && !text.endsWith("\n")
+    ? "Journal is missing its final newline and may contain a torn append."
+    : null;
+  for (const line of text.split(/\r?\n/)) {
+    if (!line.trim()) {
+      continue;
+    }
+    try {
+      parsedEvents.push(JSON.parse(line));
+    } catch {
+      parseError = "Journal contains a truncated or malformed JSON line.";
+      break;
+    }
+  }
+  const validated = validateJournalEvents(parsedEvents);
+  const events = validated.events;
+  const validationError = parseError ?? validated.validationError;
+  const invalidTail = validationError !== null || events.length !== parsedEvents.length;
+  const lastEvent = events.at(-1) ?? null;
+  return {
+    filePath,
+    events,
+    invalidTail,
+    validationError,
+    operationId: validated.operationId,
+    backupDir: path.dirname(filePath),
+    recordedBackupDir: events[0]?.backupDir ?? null,
+    state: invalidTail ? "recoveryRequired" : (lastEvent?.state ?? "recoveryRequired"),
+    terminal: !invalidTail && TERMINAL_STATES.has(lastEvent?.state),
+    rawText: text
+  };
+}
+
+export function getJournalTargetStates(journal) {
+  const targets = new Map();
+  for (const event of journal?.events ?? []) {
+    if (!TARGET_STATES.has(event.state)) {
+      continue;
+    }
+    const key = targetKey(event.kind, event.targetPath);
+    targets.set(key, {
+      kind: event.kind,
+      targetPath: path.resolve(event.targetPath),
+      state: event.state,
+      sequence: event.sequence
+    });
+  }
+  return [...targets.values()];
+}
+
+export function getStartedJournalTargets(journal, kind) {
+  return getJournalTargetStates(journal)
+    .filter((target) => target.kind === kind && target.state !== "skipped")
+    .map((target) => target.targetPath);
+}
+
+export function getAppliedJournalTargets(journal) {
+  return getJournalTargetStates(journal)
+    .filter((target) => target.state === "applied")
+    .map((target) => target.targetPath);
+}
+
+export async function findPendingTransactions(codexHome) {
+  const root = defaultBackupRoot(codexHome);
+  let entries;
+  try {
+    entries = await fs.readdir(root, { withFileTypes: true });
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+
+  const pending = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory()) {
+      continue;
+    }
+    const journalPath = path.join(root, entry.name, TRANSACTION_JOURNAL_BASENAME);
+    try {
+      const journal = await readTransactionJournal(journalPath);
+      if (!journal.terminal) {
+        pending.push(journal);
+      }
+    } catch (error) {
+      if (error?.code !== "ENOENT") {
+        pending.push({
+          filePath: journalPath,
+          backupDir: path.dirname(journalPath),
+          state: "recoveryRequired",
+          terminal: false,
+          readError: error.message
+        });
+      }
+    }
+  }
+  return pending.sort((left, right) => left.filePath.localeCompare(right.filePath));
+}
+
+export class RecoveryRequiredError extends Error {
+  constructor(pendingTransactions) {
+    const backups = pendingTransactions.map((item) => item.backupDir).join(", ");
+    super(`An unfinished provider-sync transaction requires recovery before another write. Restore the bound backup, then retry. Backup(s): ${backups}`);
+    this.name = "RecoveryRequiredError";
+    this.code = "RECOVERY_REQUIRED";
+    this.pendingTransactions = pendingTransactions;
+  }
+}
+
+export async function assertNoPendingTransactions(codexHome) {
+  const pending = await findPendingTransactions(codexHome);
+  if (pending.length > 0) {
+    throw new RecoveryRequiredError(pending);
+  }
+}
+
+export async function markBackupTransactionRolledBack(backupDir) {
+  const filePath = path.join(path.resolve(backupDir), TRANSACTION_JOURNAL_BASENAME);
+  try {
+    const current = await readTransactionJournal(filePath);
+    if (current.terminal) {
+      return;
+    }
+    if (current.invalidTail || current.events.length === 0) {
+      const archivePath = path.join(
+        path.dirname(filePath),
+        `${TRANSACTION_JOURNAL_BASENAME}.invalid.${Date.now()}.${randomUUID()}`
+      );
+      await writeFileAtomic(archivePath, current.rawText, "utf8");
+
+      let baseEvents = [];
+      for (const event of current.events) {
+        if (TERMINAL_STATES.has(event.state)) {
+          break;
+        }
+        baseEvents.push(event);
+      }
+      if (baseEvents.length === 0) {
+        let metadata = {};
+        try {
+          metadata = JSON.parse(await fs.readFile(path.join(backupDir, "metadata.json"), "utf8"));
+        } catch {
+          // A successful restore already validated metadata. This fallback is
+          // only for a journal whose first record itself was damaged.
+        }
+        const operationId = randomUUID();
+        baseEvents = [{
+          protocolVersion: 1,
+          operationId,
+          sequence: 1,
+          state: "prepared",
+          recordedAt: new Date().toISOString(),
+          backupDir: path.resolve(backupDir),
+          codexHome: metadata.codexHome ? path.resolve(metadata.codexHome) : null,
+          targetProvider: metadata.targetProvider ?? null,
+          potentialTargets: []
+        }];
+      }
+      const operationId = baseEvents[0].operationId;
+      if (!new Set(["rollingBack", "recoveryRequired"]).has(baseEvents.at(-1)?.state)) {
+        baseEvents.push({
+          protocolVersion: 1,
+          operationId,
+          sequence: baseEvents.length + 1,
+          state: "rollingBack",
+          recordedAt: new Date().toISOString(),
+          originalError: "Explicit restore repaired an invalid transaction journal."
+        });
+      }
+      const rolledBack = {
+        protocolVersion: 1,
+        operationId,
+        sequence: baseEvents.length + 1,
+        state: "rolledBack",
+        recordedAt: new Date().toISOString(),
+        recoveredInvalidJournal: true,
+        invalidJournalArchive: path.basename(archivePath)
+      };
+      await writeFileAtomic(
+        filePath,
+        `${[...baseEvents, rolledBack].map((event) => JSON.stringify(event)).join("\n")}\n`,
+        "utf8"
+      );
+      const verified = await readTransactionJournal(filePath);
+      if (!verified.terminal || verified.state !== "rolledBack") {
+        throw new Error(`Transaction journal did not persist a valid rolledBack terminal state: ${filePath}`);
+      }
+      return;
+    }
+    const journal = new TransactionJournal(
+      filePath,
+      current.operationId ?? randomUUID(),
+      current.events?.at(-1)?.sequence ?? 0
+    );
+    if (!new Set(["rollingBack", "recoveryRequired"]).has(current.state)) {
+      await journal.rollingBack(new Error("Explicit restore completed."));
+    }
+    await journal.rolledBack();
+    const verified = await readTransactionJournal(filePath);
+    if (!verified.terminal || verified.state !== "rolledBack") {
+      throw new Error(`Transaction journal did not persist a valid rolledBack terminal state: ${filePath}`);
+    }
+  } catch (error) {
+    if (error?.code !== "ENOENT") {
+      throw error;
+    }
+  }
+}
diff --git a/src/workspace-roots.js b/src/workspace-roots.js
index b2b0dad..54e56ab 100644
--- a/src/workspace-roots.js
+++ b/src/workspace-roots.js
@@ -1,5 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+import { writeFileAtomic } from "./atomic-file.js";
 
 import {
   GLOBAL_STATE_BACKUP_FILE_BASENAME,
@@ -436,8 +437,12 @@ export async function syncWorkspaceRoots(storageOrCodexHome, options = {}) {
   const backupMissing = await fs.access(backupPath).then(() => false).catch(() => true);
   const updated = savedRootsChanged || projectOrderChanged || activeRootsChanged || labelsChanged || openTargetsChanged || backupMissing;
   if (updated) {
-    await fs.writeFile(filePath, nextText, "utf8");
-    await fs.writeFile(backupPath, nextText, "utf8");
+    await options.onBeforeWrite?.(filePath);
+    await writeFileAtomic(filePath, nextText, "utf8");
+    await options.onApplied?.(filePath);
+    await options.onBeforeWrite?.(backupPath);
+    await writeFileAtomic(backupPath, nextText, "utf8");
+    await options.onApplied?.(backupPath);
   }
 
   return {
diff --git a/test/locking.test.js b/test/locking.test.js
index dd672ed..16e3e55 100644
--- a/test/locking.test.js
+++ b/test/locking.test.js
@@ -1,90 +1,615 @@
+import { spawn } from "node:child_process";
+import { rmSync } from "node:fs";
 import test from "node:test";
 import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import os from "node:os";
 import path from "node:path";
+import { pathToFileURL } from "node:url";
 
-import { acquireLock } from "../src/locking.js";
+import { acquireLock, acquirePathLock } from "../src/locking.js";
 import { DEFAULT_LOCK_NAME } from "../src/constants.js";
 
-test("acquireLock retries transient EPERM when creating the lock directory", async () => {
-  const codexHome = "C:\\CodexHome";
+const TEST_STARTED_AT = "2024-01-02T03:04:05.000Z";
+const TEST_MARKER = `test:${TEST_STARTED_AT}`;
+const tempLockHomes = new Set();
+
+process.once("exit", () => {
+  for (const root of tempLockHomes) {
+    try {
+      rmSync(root, { recursive: true, force: true });
+    } catch {
+      // Best-effort cleanup after the test process has released its handles.
+    }
+  }
+});
+
+async function makeLockHome() {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "provider-sync-lock-"));
+  tempLockHomes.add(root);
+  return root;
+}
+
+function lockOptions(overrides = {}) {
+  return {
+    getProcessIdentity: async (pid) => pid === process.pid ? TEST_MARKER : null,
+    getProcessStartedAtIdentity: async (pid) => pid === process.pid ? TEST_STARTED_AT : null,
+    ...overrides
+  };
+}
+
+async function writeCanonicalOwner(codexHome, owner) {
+  const lockDir = path.join(codexHome, "tmp", DEFAULT_LOCK_NAME);
+  await fs.mkdir(lockDir, { recursive: true });
+  await fs.writeFile(path.join(lockDir, "owner.json"), JSON.stringify(owner), "utf8");
+  return lockDir;
+}
+
+async function waitForChild(child) {
+  return new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code, signal) => resolve({ code, signal }));
+  });
+}
+
+test("acquireLock publishes a complete versioned owner and holds a unique claim", async (t) => {
+  const codexHome = await makeLockHome(t);
   const lockDir = path.join(codexHome, "tmp", DEFAULT_LOCK_NAME);
-  const calls = [];
+  const claimsDir = `${lockDir}.claims`;
+  const release = await acquireLock(codexHome, "sync", lockOptions());
+
+  const owner = JSON.parse(await fs.readFile(path.join(lockDir, "owner.json"), "utf8"));
+  assert.equal(owner.protocolVersion, 2);
+  assert.equal(owner.pid, process.pid);
+  assert.equal(owner.processId, process.pid);
+  assert.equal(owner.processStartedAt, TEST_STARTED_AT);
+  assert.equal(typeof owner.instanceId, "string");
+  assert.deepEqual(await fs.readdir(claimsDir), [`${owner.instanceId}.json`]);
+
+  await assert.rejects(acquireLock(codexHome, "other", lockOptions()), /live claim|Lock already exists/);
+  await release();
+  await assert.rejects(fs.access(lockDir), { code: "ENOENT" });
+  assert.deepEqual(await fs.readdir(claimsDir), []);
+});
+
+test("acquireLock retries transient candidate creation failures", async (t) => {
+  const codexHome = await makeLockHome(t);
+  let candidateAttempts = 0;
   const sleepCalls = [];
-  let lockMkdirAttempts = 0;
-
-  const fsImpl = {
-    async mkdir(targetPath, options) {
-      calls.push({ fn: "mkdir", targetPath, options });
-      if (targetPath === lockDir) {
-        lockMkdirAttempts += 1;
-        if (lockMkdirAttempts < 3) {
-          const error = new Error("operation not permitted");
-          error.code = "EPERM";
-          throw error;
-        }
+  const fsImpl = new Proxy(fs, {
+    get(target, property) {
+      if (property === "mkdir") {
+        return async (targetPath, options) => {
+          if (path.basename(targetPath).includes(".candidate.")) {
+            candidateAttempts += 1;
+            if (candidateAttempts < 3) {
+              const error = new Error("operation not permitted");
+              error.code = "EPERM";
+              throw error;
+            }
+          }
+          return target.mkdir(targetPath, options);
+        };
       }
-    },
-    async writeFile(targetPath, content, encoding) {
-      calls.push({ fn: "writeFile", targetPath, content, encoding });
-    },
-    async rm(targetPath, options) {
-      calls.push({ fn: "rm", targetPath, options });
+      const value = target[property];
+      return typeof value === "function" ? value.bind(target) : value;
     }
-  };
+  });
 
-  const releaseLock = await acquireLock(codexHome, "sync", {
+  const release = await acquireLock(codexHome, "sync", lockOptions({
     fsImpl,
-    retryCount: 3,
     retryDelayMs: 25,
-    sleepImpl: async (delayMs) => {
-      sleepCalls.push(delayMs);
+    sleepImpl: async (delayMs) => sleepCalls.push(delayMs)
+  }));
+  assert.equal(candidateAttempts, 3);
+  assert.deepEqual(sleepCalls, [25, 25]);
+  await release();
+});
+
+test("owner publication failure removes its empty canonical reservation and claim", async (t) => {
+  const codexHome = await makeLockHome(t);
+  const lockDir = path.join(codexHome, "tmp", DEFAULT_LOCK_NAME);
+  const fsImpl = new Proxy(fs, {
+    get(target, property) {
+      if (property === "link") {
+        return async () => {
+          const error = new Error("injected owner publication failure");
+          error.code = "EIO";
+          throw error;
+        };
+      }
+      const value = target[property];
+      return typeof value === "function" ? value.bind(target) : value;
     }
   });
 
-  assert.equal(lockMkdirAttempts, 3);
-  assert.deepEqual(sleepCalls, [25, 25]);
-  assert.equal(calls.filter((call) => call.fn === "writeFile").length, 1);
+  await assert.rejects(
+    acquireLock(codexHome, "sync", lockOptions({ fsImpl })),
+    /injected owner publication failure/
+  );
+  await assert.rejects(fs.access(lockDir), { code: "ENOENT" });
+  assert.deepEqual(await fs.readdir(`${lockDir}.claims`), []);
+  assert.equal(
+    (await fs.readdir(path.dirname(lockDir))).some((name) => name.includes(".candidate.")),
+    false
+  );
+});
 
-  await releaseLock();
-  assert.equal(calls.at(-1).fn, "rm");
-  assert.equal(calls.at(-1).targetPath, lockDir);
+test("link failure preserves foreign reservation contents but releases its own claim", async (t) => {
+  const codexHome = await makeLockHome(t);
+  const lockDir = path.join(codexHome, "tmp", DEFAULT_LOCK_NAME);
+  const fsImpl = new Proxy(fs, {
+    get(target, property) {
+      if (property === "link") {
+        return async () => {
+          await fs.writeFile(path.join(lockDir, "foreign.txt"), "keep", "utf8");
+          const error = new Error("injected link failure after foreign population");
+          error.code = "EIO";
+          throw error;
+        };
+      }
+      const value = target[property];
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+
+  await assert.rejects(
+    acquireLock(codexHome, "sync", lockOptions({ fsImpl })),
+    /link failure after foreign population/
+  );
+  assert.equal(await fs.readFile(path.join(lockDir, "foreign.txt"), "utf8"), "keep");
+  assert.deepEqual(await fs.readdir(`${lockDir}.claims`), []);
 });
 
-test("acquireLock does not retry when the lock directory already exists", async () => {
-  const codexHome = "C:\\CodexHome";
+test("reservation ABA is detected by directory identity and retains an uncertain claim", async (t) => {
+  const codexHome = await makeLockHome(t);
   const lockDir = path.join(codexHome, "tmp", DEFAULT_LOCK_NAME);
-  let lockMkdirAttempts = 0;
-  const sleepCalls = [];
+  const displacedReservation = `${lockDir}.displaced`;
+  let swapped = false;
+  const fsImpl = new Proxy(fs, {
+    get(target, property) {
+      if (property === "link") {
+        return async (source, destination) => {
+          if (!swapped && path.resolve(destination) === path.resolve(path.join(lockDir, "owner.json"))) {
+            swapped = true;
+            await fs.rename(lockDir, displacedReservation);
+            await fs.mkdir(lockDir);
+            await fs.writeFile(path.join(lockDir, "foreign.txt"), "keep", "utf8");
+          }
+          return target.link(source, destination);
+        };
+      }
+      const value = target[property];
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+
+  await assert.rejects(
+    acquireLock(codexHome, "sync", lockOptions({ fsImpl })),
+    /reservation changed identity/
+  );
+  assert.equal(await fs.readFile(path.join(lockDir, "foreign.txt"), "utf8"), "keep");
+  assert.equal((await fs.readdir(`${lockDir}.claims`)).length, 1);
+  assert.equal((await fs.lstat(displacedReservation)).isDirectory(), true);
+});
 
-  const fsImpl = {
-    async mkdir(targetPath) {
-      if (targetPath === lockDir) {
-        lockMkdirAttempts += 1;
-        const error = new Error("already exists");
-        error.code = "EEXIST";
-        throw error;
+test("link failure does not remove a swapped empty reservation and still releases its claim", async (t) => {
+  const codexHome = await makeLockHome(t);
+  const lockDir = path.join(codexHome, "tmp", DEFAULT_LOCK_NAME);
+  const displacedReservation = `${lockDir}.displaced-link-failure`;
+  const fsImpl = new Proxy(fs, {
+    get(target, property) {
+      if (property === "link") {
+        return async () => {
+          await fs.rename(lockDir, displacedReservation);
+          await fs.mkdir(lockDir);
+          const error = new Error("injected link failure after reservation swap");
+          error.code = "EIO";
+          throw error;
+        };
       }
-    },
-    async writeFile() {
-      throw new Error("writeFile should not be called");
-    },
-    async rm() {
-      throw new Error("rm should not be called");
+      const value = target[property];
+      return typeof value === "function" ? value.bind(target) : value;
     }
-  };
+  });
+
+  await assert.rejects(
+    acquireLock(codexHome, "sync", lockOptions({ fsImpl })),
+    /cleanup was incomplete/
+  );
+  assert.equal((await fs.lstat(lockDir)).isDirectory(), true);
+  assert.equal((await fs.lstat(displacedReservation)).isDirectory(), true);
+  assert.deepEqual(await fs.readdir(`${lockDir}.claims`), []);
+});
+
+test("acquirePathLock supports an arbitrary future SQLite resource path", async (t) => {
+  const root = await makeLockHome(t);
+  const lockPath = path.join(root, "resource-locks", "state-db.lock");
+  const release = await acquirePathLock(lockPath, "sqlite-resource", lockOptions());
+  const owner = JSON.parse(await fs.readFile(path.join(lockPath, "owner.json"), "utf8"));
+  assert.equal(owner.label, "sqlite-resource");
+  assert.deepEqual(await fs.readdir(`${lockPath}.claims`), [`${owner.instanceId}.json`]);
+  await release();
+  await assert.rejects(fs.access(lockPath), { code: "ENOENT" });
+});
+
+test("acquirePathLock rejects a canonical file with an explicit diagnostic", async (t) => {
+  const root = await makeLockHome(t);
+  const lockPath = path.join(root, "resource-locks", "state-db.lock");
+  await fs.mkdir(path.dirname(lockPath), { recursive: true });
+  await fs.writeFile(lockPath, "foreign", "utf8");
+
+  await assert.rejects(
+    acquirePathLock(lockPath, "sqlite-resource", lockOptions()),
+    /canonical lock path is not a directory/
+  );
+  assert.equal(await fs.readFile(lockPath, "utf8"), "foreign");
+  assert.deepEqual(await fs.readdir(`${lockPath}.claims`), []);
+});
+
+test("acquirePathLock rejects a canonical symlink without following it", async (t) => {
+  const root = await makeLockHome(t);
+  const lockPath = path.join(root, "resource-locks", "state-db.lock");
+  const targetPath = path.join(root, "foreign-target");
+  await fs.mkdir(path.dirname(lockPath), { recursive: true });
+  await fs.mkdir(targetPath);
+  try {
+    await fs.symlink(targetPath, lockPath, process.platform === "win32" ? "junction" : "dir");
+  } catch (error) {
+    if (error?.code === "EPERM") {
+      t.skip("The test account cannot create a directory symlink/junction.");
+      return;
+    }
+    throw error;
+  }
+
+  await assert.rejects(
+    acquirePathLock(lockPath, "sqlite-resource", lockOptions()),
+    /canonical lock path is a symbolic link/
+  );
+  assert.equal((await fs.lstat(lockPath)).isSymbolicLink(), true);
+  assert.deepEqual(await fs.readdir(targetPath), []);
+  assert.deepEqual(await fs.readdir(`${lockPath}.claims`), []);
+});
+
+test("acquireLock reads a live legacy .NET owner fail-closed", async (t) => {
+  const codexHome = await makeLockHome(t);
+  const lockDir = await writeCanonicalOwner(codexHome, {
+    processId: process.pid,
+    processStartedAt: TEST_STARTED_AT,
+    startedAt: TEST_STARTED_AT,
+    label: "dotnet",
+    currentDirectory: codexHome
+  });
 
   await assert.rejects(
-    () => acquireLock(codexHome, "sync", {
+    acquireLock(codexHome, "node", lockOptions()),
+    /PID .* still the verified owner/
+  );
+  assert.equal(JSON.parse(await fs.readFile(path.join(lockDir, "owner.json"), "utf8")).processId, process.pid);
+  assert.deepEqual(await fs.readdir(`${lockDir}.claims`), []);
+});
+
+test("acquireLock recognizes a live version 2 .NET owner from UTC-second identity", async (t) => {
+  const codexHome = await makeLockHome(t);
+  const lockDir = await writeCanonicalOwner(codexHome, {
+    protocolVersion: 2,
+    runtime: "dotnet",
+    pid: process.pid,
+    processId: process.pid,
+    processStartedAt: "2024-01-02T03:04:05Z",
+    instanceId: "dotnet-v2-live",
+    startedAt: TEST_STARTED_AT,
+    label: "dotnet",
+    cwd: codexHome
+  });
+
+  await assert.rejects(acquireLock(codexHome, "node", lockOptions()), /still the verified owner/);
+  assert.equal(
+    JSON.parse(await fs.readFile(path.join(lockDir, "owner.json"), "utf8")).instanceId,
+    "dotnet-v2-live"
+  );
+  assert.deepEqual(await fs.readdir(`${lockDir}.claims`), []);
+});
+
+test("same-second PID reuse is rejected by the exact Node start marker", async (t) => {
+  const codexHome = await makeLockHome(t);
+  const lockDir = await writeCanonicalOwner(codexHome, {
+    protocolVersion: 2,
+    runtime: "node",
+    pid: process.pid,
+    processId: process.pid,
+    processStartMarker: "node:previous-generation",
+    processStartedAt: TEST_STARTED_AT,
+    instanceId: "previous-node-generation",
+    startedAt: TEST_STARTED_AT,
+    label: "node",
+    cwd: codexHome
+  });
+
+  const release = await acquireLock(codexHome, "node", lockOptions());
+  assert.notEqual(
+    JSON.parse(await fs.readFile(path.join(lockDir, "owner.json"), "utf8")).instanceId,
+    "previous-node-generation"
+  );
+  await release();
+});
+
+test("acquireLock reclaims a dead legacy .NET owner", async (t) => {
+  const codexHome = await makeLockHome(t);
+  const deadPid = 2_000_000_000;
+  const lockDir = await writeCanonicalOwner(codexHome, {
+    processId: deadPid,
+    startedAt: "2020-01-01T00:00:01.000Z",
+    label: "dotnet",
+    currentDirectory: codexHome
+  });
+
+  const release = await acquireLock(codexHome, "node", lockOptions());
+  const owner = JSON.parse(await fs.readFile(path.join(lockDir, "owner.json"), "utf8"));
+  assert.equal(owner.protocolVersion, 2);
+  assert.equal(owner.processId, process.pid);
+  await release();
+});
+
+test("a crash after candidate preparation leaves only nonblocking residue", async (t) => {
+  const codexHome = await makeLockHome(t);
+  const moduleUrl = pathToFileURL(path.resolve("src/locking.js")).href;
+  const script = `
+    import { acquireLock } from ${JSON.stringify(moduleUrl)};
+    await acquireLock(${JSON.stringify(codexHome)}, "crash", {
+      getProcessIdentity: async () => ${JSON.stringify(TEST_MARKER)},
+      getProcessStartedAtIdentity: async () => ${JSON.stringify(TEST_STARTED_AT)},
+      onCandidateReady() { process.exit(29); }
+    });
+  `;
+  const child = spawn(process.execPath, ["--input-type=module", "-e", script], {
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const result = await waitForChild(child);
+  assert.equal(result.code, 29);
+
+  const lockDir = path.join(codexHome, "tmp", DEFAULT_LOCK_NAME);
+  await assert.rejects(fs.access(lockDir), { code: "ENOENT" });
+  const residue = await fs.readdir(path.dirname(lockDir));
+  assert.ok(residue.some((name) => name.includes(".candidate.")));
+  assert.equal((await fs.readdir(`${lockDir}.claims`)).length, 1);
+
+  const release = await acquireLock(codexHome, "recovery", lockOptions());
+  await release();
+  assert.deepEqual(await fs.readdir(`${lockDir}.claims`), []);
+});
+
+test("a unique live claim serializes stale reclaimers and prevents ABA", async (t) => {
+  const codexHome = await makeLockHome(t);
+  const deadPid = 2_000_000_000;
+  await writeCanonicalOwner(codexHome, {
+    protocolVersion: 2,
+    pid: deadPid,
+    processId: deadPid,
+    processStartedAt: "2020-01-01T00:00:00.000Z",
+    instanceId: "stale-owner",
+    label: "stale",
+    cwd: codexHome
+  });
+
+  let releaseReclaimer;
+  const reclaimerPaused = new Promise((resolve) => {
+    releaseReclaimer = resolve;
+  });
+  let reachedReclaim;
+  const reclaimReached = new Promise((resolve) => {
+    reachedReclaim = resolve;
+  });
+  const first = acquireLock(codexHome, "first", lockOptions({
+    onBeforeStaleReclaim: async () => {
+      reachedReclaim();
+      await reclaimerPaused;
+    }
+  }));
+  await reclaimReached;
+
+  const contenders = await Promise.allSettled([
+    acquireLock(codexHome, "second", lockOptions()),
+    acquireLock(codexHome, "third", lockOptions())
+  ]);
+  assert.equal(contenders.filter((entry) => entry.status === "fulfilled").length, 0);
+  assert.ok(contenders.every((entry) => /live claim|Lock already exists/.test(entry.reason.message)));
+
+  releaseReclaimer();
+  const release = await first;
+  await release();
+});
+
+test("stale canonical reclamation is bounded under continuous replacement", async (t) => {
+  const codexHome = await makeLockHome(t);
+  const lockDir = await writeCanonicalOwner(codexHome, {
+    processId: 2_000_000_000,
+    startedAt: "2020-01-01T00:00:00.000Z",
+    label: "stale-0",
+    currentDirectory: codexHome
+  });
+  let replacements = 0;
+  const fsImpl = new Proxy(fs, {
+    get(target, property) {
+      if (property === "rename") {
+        return async (source, destination) => {
+          await target.rename(source, destination);
+          if (path.resolve(source) === path.resolve(lockDir)
+              && path.basename(destination).includes(".stale.")) {
+            replacements += 1;
+            await fs.mkdir(lockDir);
+            await fs.writeFile(path.join(lockDir, "owner.json"), JSON.stringify({
+              processId: 2_000_000_000,
+              startedAt: "2020-01-01T00:00:00.000Z",
+              label: `stale-${replacements}`,
+              currentDirectory: codexHome
+            }), "utf8");
+          }
+        };
+      }
+      const value = target[property];
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+
+  await assert.rejects(
+    acquireLock(codexHome, "bounded", lockOptions({
       fsImpl,
-      retryCount: 3,
-      retryDelayMs: 25,
-      sleepImpl: async (delayMs) => {
-        sleepCalls.push(delayMs);
+      staleReclaimAttemptLimit: 2
+    })),
+    /bounded limit of 2 attempts/
+  );
+  assert.equal(replacements, 2);
+  assert.equal(JSON.parse(await fs.readFile(path.join(lockDir, "owner.json"), "utf8")).label, "stale-2");
+  assert.deepEqual(await fs.readdir(`${lockDir}.claims`), []);
+});
+
+test("stale reclaim restores a changed owner without rename-overwrite", async (t) => {
+  const codexHome = await makeLockHome(t);
+  const lockDir = await writeCanonicalOwner(codexHome, {
+    processId: 2_000_000_000,
+    startedAt: "2020-01-01T00:00:00.000Z",
+    label: "stale",
+    currentDirectory: codexHome
+  });
+  const releasedOldPath = `${lockDir}.released-old`;
+  const replacementOwner = {
+    protocolVersion: 2,
+    runtime: "dotnet",
+    pid: process.pid,
+    processId: process.pid,
+    processStartedAt: TEST_STARTED_AT,
+    instanceId: "replacement-generation",
+    startedAt: TEST_STARTED_AT,
+    label: "replacement",
+    cwd: codexHome
+  };
+
+  await assert.rejects(
+    acquireLock(codexHome, "aba-contender", lockOptions({
+      async onBeforeStaleReclaim() {
+        await fs.rename(lockDir, releasedOldPath);
+        await fs.mkdir(lockDir);
+        await fs.writeFile(
+          path.join(lockDir, "owner.json"),
+          JSON.stringify(replacementOwner),
+          "utf8"
+        );
       }
-    }),
-    /Lock already exists/
+    })),
+    /restored without replacing another directory/
+  );
+  assert.deepEqual(
+    JSON.parse(await fs.readFile(path.join(lockDir, "owner.json"), "utf8")),
+    replacementOwner
   );
+  assert.equal((await fs.lstat(releasedOldPath)).isDirectory(), true);
+  assert.ok((await fs.readdir(path.dirname(lockDir))).some((name) => name.includes(".stale.")));
+  assert.deepEqual(await fs.readdir(`${lockDir}.claims`), []);
+});
 
-  assert.equal(lockMkdirAttempts, 1);
-  assert.deepEqual(sleepCalls, []);
+test("release refuses a replacement directory that reuses the same owner inode", async (t) => {
+  const codexHome = await makeLockHome(t);
+  const lockDir = path.join(codexHome, "tmp", DEFAULT_LOCK_NAME);
+  const release = await acquireLock(codexHome, "original", lockOptions());
+  const originalPath = `${lockDir}.original`;
+  await fs.rename(lockDir, originalPath);
+  await fs.mkdir(lockDir);
+  await fs.link(path.join(originalPath, "owner.json"), path.join(lockDir, "owner.json"));
+  await fs.writeFile(path.join(lockDir, "foreign.txt"), "keep", "utf8");
+
+  await assert.rejects(release(), /directory identity changed/);
+  assert.equal(await fs.readFile(path.join(lockDir, "foreign.txt"), "utf8"), "keep");
+  assert.equal((await fs.readdir(`${lockDir}.claims`)).length, 1);
+});
+
+test("failed acquisition cleanup preserves a canonical generation replaced by an older runtime", async (t) => {
+  const codexHome = await makeLockHome(t);
+  const lockDir = path.join(codexHome, "tmp", DEFAULT_LOCK_NAME);
+  const parentDir = path.dirname(lockDir);
+  const replacementOwner = {
+    protocolVersion: 2,
+    runtime: "dotnet",
+    pid: process.pid,
+    processId: process.pid,
+    processStartedAt: TEST_STARTED_AT,
+    instanceId: "replacement-generation",
+    startedAt: TEST_STARTED_AT,
+    label: "older-runtime",
+    cwd: codexHome
+  };
+  let replaced = false;
+
+  await assert.rejects(
+    acquireLock(codexHome, "node", lockOptions({
+      async syncDirectoryImpl(directoryPath) {
+        if (!replaced && path.resolve(directoryPath) === path.resolve(parentDir)) {
+          replaced = true;
+          await fs.writeFile(
+            path.join(lockDir, "owner.json"),
+            JSON.stringify(replacementOwner),
+            "utf8"
+          );
+          throw new Error("injected post-publish durability failure");
+        }
+      }
+    })),
+    /cleanup was incomplete/
+  );
+
+  assert.deepEqual(
+    JSON.parse(await fs.readFile(path.join(lockDir, "owner.json"), "utf8")),
+    replacementOwner
+  );
+  assert.equal((await fs.readdir(`${lockDir}.claims`)).length, 1);
+});
+
+test("acquireLock fails closed while a legacy canonical owner is missing", async (t) => {
+  const codexHome = await makeLockHome(t);
+  const lockDir = path.join(codexHome, "tmp", DEFAULT_LOCK_NAME);
+  await fs.mkdir(lockDir, { recursive: true });
+  await assert.rejects(
+    acquireLock(codexHome, "sync", lockOptions()),
+    /owner\.json is not visible yet/
+  );
+  assert.deepEqual(await fs.readdir(`${lockDir}.claims`), []);
+});
+
+test("acquireLock fails closed for future protocols and conflicting cross-runtime PIDs", async (t) => {
+  for (const fixture of [
+    {
+      name: "future protocol",
+      owner: {
+        protocolVersion: 99,
+        pid: 2_000_000_000,
+        processId: 2_000_000_000,
+        processStartedAt: "2020-01-01T00:00:00.000Z",
+        instanceId: "future-owner"
+      },
+      expected: /unsupported lock protocol 99/
+    },
+    {
+      name: "PID conflict",
+      owner: {
+        protocolVersion: 2,
+        pid: 2_000_000_000,
+        processId: 1_999_999_999,
+        processStartedAt: "2020-01-01T00:00:00.000Z",
+        instanceId: "conflicting-owner"
+      },
+      expected: /conflicting pid and processId/
+    }
+  ]) {
+    await t.test(fixture.name, async (subtest) => {
+      const codexHome = await makeLockHome(subtest);
+      const lockDir = await writeCanonicalOwner(codexHome, fixture.owner);
+      await assert.rejects(acquireLock(codexHome, "sync", lockOptions()), fixture.expected);
+      assert.deepEqual(await fs.readdir(`${lockDir}.claims`), []);
+      assert.deepEqual(
+        JSON.parse(await fs.readFile(path.join(lockDir, "owner.json"), "utf8")),
+        fixture.owner
+      );
+    });
+  }
 });
diff --git a/test/release-version.test.js b/test/release-version.test.js
index 5b6e315..2929415 100644
--- a/test/release-version.test.js
+++ b/test/release-version.test.js
@@ -71,7 +71,10 @@ test("current repository versions match an explicit tag", () => {
 
   assert.deepEqual(result.projects, [
     "desktop/CodexProviderSync.App/CodexProviderSync.App.csproj",
+    "desktop/CodexProviderSync.Application/CodexProviderSync.Application.csproj",
+    "desktop/CodexProviderSync.Automation/CodexProviderSync.Automation.csproj",
     "desktop/CodexProviderSync.Core/CodexProviderSync.Core.csproj",
+    "desktop/CodexProviderSync.GuiE2E/CodexProviderSync.GuiE2E.csproj",
     "desktop/CodexProviderSync.Mac/CodexProviderSync.Mac.csproj",
   ]);
 });
diff --git a/test/sqlite-online-backup.test.js b/test/sqlite-online-backup.test.js
new file mode 100644
index 0000000..726225b
--- /dev/null
+++ b/test/sqlite-online-backup.test.js
@@ -0,0 +1,251 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+import { createBackup, restoreBackup } from "../src/backup.js";
+import { DB_FILE_BASENAME, SQLITE_DIR_BASENAME } from "../src/constants.js";
+import { openDatabase } from "../src/sqlite.js";
+import {
+  configureSqliteWriteDurability,
+  createSqliteOnlineBackup,
+  updateSqliteProvider
+} from "../src/sqlite-state.js";
+
+async function tempDatabase(prefix) {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), prefix));
+  const dbPath = path.join(root, "state_5.sqlite");
+  return {
+    root,
+    dbPath,
+    location: { path: dbPath, source: "explicit" }
+  };
+}
+
+test("SQLite writes configure synchronous=FULL and Node/.NET update counters agree", async () => {
+  const fixture = await tempDatabase("provider-sync-sqlite-durability-");
+  const db = await openDatabase(fixture.dbPath);
+  try {
+    db.exec(`
+      PRAGMA synchronous = OFF;
+      CREATE TABLE threads (
+        id TEXT PRIMARY KEY,
+        model_provider TEXT,
+        model TEXT
+      );
+      INSERT INTO threads VALUES ('a', 'legacy', 'old');
+      INSERT INTO threads VALUES ('b', 'openai', 'old');
+    `);
+    assert.equal(Number(db.prepare("PRAGMA synchronous").get().synchronous), 0);
+    assert.deepEqual(configureSqliteWriteDurability(db), { synchronous: "full", value: 2 });
+    assert.equal(Number(db.prepare("PRAGMA synchronous").get().synchronous), 2);
+  } finally {
+    db.close();
+  }
+
+  const result = await updateSqliteProvider(fixture.location, "openai", {
+    targetModel: "new"
+  });
+  assert.deepEqual(
+    {
+      updatedRows: result.updatedRows,
+      providerRowsUpdated: result.providerRowsUpdated,
+      modelRowsUpdated: result.modelRowsUpdated
+    },
+    { updatedRows: 3, providerRowsUpdated: 1, modelRowsUpdated: 2 }
+  );
+
+  const verified = await openDatabase(fixture.dbPath, { readOnly: true });
+  try {
+    assert.deepEqual(
+      verified.prepare("SELECT model_provider, model FROM threads ORDER BY id").all()
+        .map((row) => ({ model_provider: row.model_provider, model: row.model })),
+      [
+        { model_provider: "openai", model: "new" },
+        { model_provider: "openai", model: "new" }
+      ]
+    );
+  } finally {
+    verified.close();
+    await fs.rm(fixture.root, { recursive: true, force: true });
+  }
+});
+
+test("official SQLite online backup captures live WAL into one standalone main file", async () => {
+  const fixture = await tempDatabase("provider-sync-sqlite-online-backup-");
+  const backupPath = path.join(fixture.root, "backup", "state_5.sqlite");
+  const source = await openDatabase(fixture.dbPath);
+  try {
+    source.exec("PRAGMA page_size = 8192");
+    source.exec("VACUUM");
+    assert.equal(source.prepare("PRAGMA journal_mode = WAL").get().journal_mode, "wal");
+    source.exec("PRAGMA user_version = 73");
+    source.exec("PRAGMA application_id = 1129333840");
+    source.exec("CREATE TABLE threads (id TEXT PRIMARY KEY, model_provider TEXT)");
+    source.prepare("INSERT INTO threads VALUES (?, ?)").run("wal-row", "openai");
+    assert.ok((await fs.stat(`${fixture.dbPath}-wal`)).size > 0);
+
+    const result = await createSqliteOnlineBackup(fixture.location, backupPath);
+    assert.equal(result.databasePresent, true);
+    assert.ok(["node:sqlite", "better-sqlite3"].includes(result.driver));
+    assert.deepEqual(result.metadata.source, {
+      journalMode: "wal",
+      pageSize: 8192,
+      userVersion: 73,
+      applicationId: 1129333840
+    });
+    assert.deepEqual(result.metadata.backup, result.metadata.source);
+    assert.deepEqual(result.metadata.preserved, {
+      journalMode: true,
+      pageSize: true,
+      userVersion: true,
+      applicationId: true
+    });
+    assert.equal(await fs.stat(backupPath).then((stat) => stat.isFile()), true);
+    await assert.rejects(fs.access(`${backupPath}-wal`), { code: "ENOENT" });
+    await assert.rejects(fs.access(`${backupPath}-shm`), { code: "ENOENT" });
+  } finally {
+    source.close();
+  }
+
+  const backup = await openDatabase(backupPath);
+  try {
+    assert.equal(
+      backup.prepare("SELECT model_provider FROM threads WHERE id = ?").get("wal-row").model_provider,
+      "openai"
+    );
+  } finally {
+    backup.close();
+    await fs.rm(fixture.root, { recursive: true, force: true });
+  }
+});
+
+test("online backup never recreates a source database that disappeared", async () => {
+  const fixture = await tempDatabase("provider-sync-sqlite-online-missing-source-");
+  const backupPath = path.join(fixture.root, "backup", "state_5.sqlite");
+  const source = await openDatabase(fixture.dbPath);
+  source.exec("CREATE TABLE threads (id TEXT PRIMARY KEY, model_provider TEXT)");
+  source.close();
+  await fs.rm(fixture.dbPath);
+
+  try {
+    await assert.rejects(
+      () => createSqliteOnlineBackup(fixture.location, backupPath),
+      /unable to open database|does not exist|cannot open/i
+    );
+    await assert.rejects(fs.access(fixture.dbPath), { code: "ENOENT" });
+    await assert.rejects(fs.access(backupPath), { code: "ENOENT" });
+  } finally {
+    await fs.rm(fixture.root, { recursive: true, force: true });
+  }
+});
+
+test("managed backup snapshots live WAL and manifests only standalone main databases", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "provider-sync-managed-online-backup-"));
+  const codexHome = path.join(root, ".codex");
+  const sqliteHome = path.join(codexHome, SQLITE_DIR_BASENAME);
+  const dbPath = path.join(sqliteHome, DB_FILE_BASENAME);
+  const configPath = path.join(codexHome, "config.toml");
+  await fs.mkdir(sqliteHome, { recursive: true });
+  await fs.writeFile(configPath, 'model_provider = "openai"\n', "utf8");
+
+  const source = await openDatabase(dbPath);
+  try {
+    assert.equal(source.prepare("PRAGMA journal_mode = WAL").get().journal_mode, "wal");
+    source.exec(`
+      CREATE TABLE threads (id TEXT PRIMARY KEY, model_provider TEXT);
+      INSERT INTO threads VALUES ('live-wal-row', 'apigather');
+    `);
+    assert.ok((await fs.stat(`${dbPath}-wal`)).size > 0);
+
+    const backupDir = await createBackup({
+      codexHome,
+      targetProvider: "openai",
+      sessionChanges: [],
+      configPath
+    });
+    const metadata = JSON.parse(await fs.readFile(path.join(backupDir, "metadata.json"), "utf8"));
+    assert.deepEqual(metadata.sqliteDbFiles, [DB_FILE_BASENAME]);
+    assert.deepEqual(
+      metadata.dbFiles.map((fileName) => fileName.replaceAll("\\", "/")),
+      [`${SQLITE_DIR_BASENAME}/${DB_FILE_BASENAME}`]
+    );
+
+    const canonicalBackupPath = path.join(backupDir, "db", "sqlite-home", DB_FILE_BASENAME);
+    const legacyMirrorPath = path.join(
+      backupDir,
+      "db",
+      SQLITE_DIR_BASENAME,
+      DB_FILE_BASENAME
+    );
+    for (const backupPath of [canonicalBackupPath, legacyMirrorPath]) {
+      assert.equal((await fs.stat(backupPath)).isFile(), true);
+      await assert.rejects(fs.access(`${backupPath}-wal`), { code: "ENOENT" });
+      await assert.rejects(fs.access(`${backupPath}-shm`), { code: "ENOENT" });
+    }
+
+    const backup = await openDatabase(canonicalBackupPath, { readOnly: true });
+    try {
+      assert.equal(
+        backup.prepare("SELECT model_provider FROM threads WHERE id = ?")
+          .get("live-wal-row").model_provider,
+        "apigather"
+      );
+    } finally {
+      backup.close();
+    }
+
+    source.prepare("UPDATE threads SET model_provider = ? WHERE id = ?")
+      .run("live-after-backup", "live-wal-row");
+    source.prepare("INSERT INTO threads VALUES (?, ?)")
+      .run("live-only-row", "live-after-backup");
+    assert.ok((await fs.stat(`${dbPath}-wal`)).size > 0);
+
+    await restoreBackup(backupDir, codexHome, {
+      restoreConfig: false,
+      restoreGlobalState: false,
+      restoreSessions: false
+    });
+    assert.equal(
+      source.prepare("SELECT model_provider FROM threads WHERE id = ?")
+        .get("live-wal-row").model_provider,
+      "apigather"
+    );
+    assert.equal(
+      source.prepare("SELECT model_provider FROM threads WHERE id = ?")
+        .get("live-only-row"),
+      undefined
+    );
+
+    source.prepare("UPDATE threads SET model_provider = ? WHERE id = ?")
+      .run("live-before-failed-restore", "live-wal-row");
+    source.prepare("INSERT INTO threads VALUES (?, ?)")
+      .run("failed-restore-must-preserve", "live-before-failed-restore");
+    const walBeforeFailure = await fs.readFile(`${dbPath}-wal`);
+    await fs.writeFile(canonicalBackupPath, "not a sqlite database", "utf8");
+
+    await assert.rejects(
+      () => restoreBackup(backupDir, codexHome, {
+        restoreConfig: false,
+        restoreGlobalState: false,
+        restoreSessions: false
+      }),
+      /malformed|not a database/i
+    );
+    assert.deepEqual(await fs.readFile(`${dbPath}-wal`), walBeforeFailure);
+    assert.equal(
+      source.prepare("SELECT model_provider FROM threads WHERE id = ?")
+        .get("live-wal-row").model_provider,
+      "live-before-failed-restore"
+    );
+    assert.equal(
+      source.prepare("SELECT model_provider FROM threads WHERE id = ?")
+        .get("failed-restore-must-preserve").model_provider,
+      "live-before-failed-restore"
+    );
+  } finally {
+    source.close();
+    await fs.rm(root, { recursive: true, force: true });
+  }
+});
diff --git a/test/sync-service.test.js b/test/sync-service.test.js
index ad064b1..b64d1c9 100644
--- a/test/sync-service.test.js
+++ b/test/sync-service.test.js
@@ -7,6 +7,7 @@ import path from "node:path";
 
 import {
   createBackup,
+  getBackupRecoveryCoverage,
   getBackupSummary,
   pruneBackups,
   restoreBackup,
@@ -17,8 +18,1164 @@ import { DB_FILE_BASENAME, DEFAULT_BACKUP_RETENTION_COUNT, SQLITE_DIR_BASENAME }
 import { getUnsupportedNodeVersionMessage } from "../src/node-version.js";
 import { applySessionChanges, collectSessionChanges } from "../src/session-files.js";
 import { openDatabase } from "../src/sqlite.js";
+import {
+  TransactionJournal,
+  findPendingTransactions,
+  readTransactionJournal
+} from "../src/transaction-journal.js";
+import { syncDirectory, writeFileAtomic } from "../src/atomic-file.js";
+
+delete process.env.CODEX_SQLITE_HOME;
+
+test("runSync rolls back the first rollout when a later target fails (#69)", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const firstPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-a.jsonl");
+  const secondPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-b.jsonl");
+  await writeRollout(firstPath, "thread-a", "apigather");
+  await writeRollout(secondPath, "thread-b", "apigather");
+  await writeStateDb(codexHome, [
+    { id: "thread-a", model_provider: "apigather" },
+    { id: "thread-b", model_provider: "apigather" }
+  ]);
+  const firstBefore = await fs.readFile(firstPath, "utf8");
+  const secondBefore = await fs.readFile(secondPath, "utf8");
+  let sqliteBackupRestoreAttempts = 0;
+
+  let error;
+  try {
+    await runSync({
+      codexHome,
+      provider: "openai",
+      faultInjector: ({ point, targetIndex }) => {
+        if (point === "before_rollout_apply" && targetIndex === 2) {
+          throw new Error("injected second-target failure");
+        }
+        if (point === "before_sqlite_rollback") {
+          sqliteBackupRestoreAttempts += 1;
+        }
+      }
+    });
+    assert.fail("runSync should fail before applying the second target");
+  } catch (caught) {
+    error = caught;
+  }
+
+  assert.match(error.originalError.message, /injected second-target failure/);
+  assert.deepEqual(error.completedTargets, [path.resolve(firstPath)]);
+  assert.deepEqual(error.uncompletedTargets, []);
+
+  assert.equal(await fs.readFile(firstPath, "utf8"), firstBefore);
+  assert.equal(await fs.readFile(secondPath, "utf8"), secondBefore);
+  const db = await openDatabase(stateDbPath(codexHome));
+  try {
+    const providers = db.prepare("SELECT model_provider FROM threads ORDER BY id").all();
+    assert.deepEqual(providers.map((row) => row.model_provider), ["apigather", "apigather"]);
+  } finally {
+    db.close();
+  }
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+  assert.equal(sqliteBackupRestoreAttempts, 0, "a pre-COMMIT failure must use SQLite ROLLBACK, not backup restore");
+});
+
+test("runSync restores global-state primary when backup write fails (#69)", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const originalState = {
+    "electron-saved-workspace-roots": ["\\\\?\\D:\\Workspace\\sample"],
+    "project-order": ["\\\\?\\D:\\Workspace\\sample"],
+    "active-workspace-roots": ["\\\\?\\D:\\Workspace\\sample"]
+  };
+  await writeGlobalState(codexHome, originalState);
+  await writeStateDb(codexHome, [
+    { id: "thread-global", model_provider: "openai", cwd: "\\\\?\\D:\\Workspace\\sample" }
+  ]);
+  const primaryPath = path.join(codexHome, ".codex-global-state.json");
+  const backupPath = path.join(codexHome, ".codex-global-state.json.bak");
+  const primaryBefore = await fs.readFile(primaryPath, "utf8");
+  const backupBefore = await fs.readFile(backupPath, "utf8");
+
+  await assert.rejects(
+    runSync({
+      codexHome,
+      faultInjector: ({ point, path: appliedPath }) => {
+        if (point === "after_global_state_apply" && appliedPath === primaryPath) {
+          throw new Error("injected global-state backup failure");
+        }
+      }
+    }),
+    /injected global-state backup failure/
+  );
+
+  assert.equal(await fs.readFile(primaryPath, "utf8"), primaryBefore);
+  assert.equal(await fs.readFile(backupPath, "utf8"), backupBefore);
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("failure after SQLite commit restores rollout and database", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-after-sqlite.jsonl");
+  await writeRollout(sessionPath, "thread-after-sqlite", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-after-sqlite", model_provider: "apigather" }]);
+  const before = await fs.readFile(sessionPath, "utf8");
+
+  let error;
+  try {
+    await runSync({
+      codexHome,
+      provider: "openai",
+      faultInjector: ({ point }) => {
+        if (point === "after_sqlite_commit") {
+          throw new Error("injected post-SQLite failure");
+        }
+      }
+    });
+    assert.fail("runSync should fail after the committed SQLite update");
+  } catch (caught) {
+    error = caught;
+  }
+
+  assert.equal(error.name, "SyncTransactionError");
+  assert.equal(error.code, "SYNC_FAILED_ROLLED_BACK");
+  assert.equal(error.rollbackStatus, "complete");
+  assert.equal(error.recoveryRequired, false);
+  assert.ok(error.completedTargets.includes(path.resolve(sessionPath)));
+  assert.ok(error.completedTargets.includes(path.resolve(stateDbPath(codexHome))));
+  assert.equal(await fs.readFile(sessionPath, "utf8"), before);
+  assert.equal(await readProvider(codexHome, "thread-after-sqlite"), "apigather");
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("unknown SQLite COMMIT acknowledgement restores switch config, rollout, and database", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  const originalConfig = `model_provider = "openai"\nmodel = "gpt-5.4-mini"\n\n[model_providers.apigather]\nmodel = "apigather-prod"\nbase_url = "https://example.com"\n`;
+  const configPath = path.join(codexHome, "config.toml");
+  await fs.writeFile(configPath, originalConfig, "utf8");
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-commit-unknown.jsonl");
+  await writeRollout(sessionPath, "thread-commit-unknown", "openai");
+  await writeStateDb(codexHome, [{ id: "thread-commit-unknown", model_provider: "openai" }]);
+  const rolloutBefore = await fs.readFile(sessionPath, "utf8");
+  let providerObservedAfterCommit = null;
+  let error;
+
+  try {
+    await runSwitch({
+      codexHome,
+      provider: "apigather",
+      async faultInjector({ point }) {
+        if (point === "after_sqlite_commit_before_ack") {
+          providerObservedAfterCommit = await readProvider(codexHome, "thread-commit-unknown");
+          throw new Error("injected lost SQLite COMMIT acknowledgement");
+        }
+      }
+    });
+    assert.fail("runSwitch should fail when SQLite COMMIT acknowledgement is unknown");
+  } catch (caught) {
+    error = caught;
+  }
+
+  assert.equal(providerObservedAfterCommit, "apigather", "the injected failure must occur after the real COMMIT");
+  assert.equal(error.name, "SyncTransactionError");
+  assert.equal(error.rollbackStatus, "complete");
+  assert.equal(error.recoveryRequired, false);
+  assert.match(error.originalError.message, /lost SQLite COMMIT acknowledgement/);
+  assert.equal(await fs.readFile(configPath, "utf8"), originalConfig);
+  assert.equal(await fs.readFile(sessionPath, "utf8"), rolloutBefore);
+  assert.equal(await readProvider(codexHome, "thread-commit-unknown"), "openai");
+
+  const journal = await readTransactionJournal(path.join(error.backupDir, "transaction-journal.jsonl"));
+  assert.equal(journal.state, "rolledBack");
+  assert.equal(journal.terminal, true);
+  assert.equal(journal.invalidTail, false);
+  assert.equal(journal.events.some((event) => event.state === "recoveryRequired"), false);
+  assert.equal(journal.events.some((event) => event.kind === "sqlite" && event.state === "applied"), false);
+  assert.deepEqual(journal.events.slice(-2).map((event) => event.state), ["rollingBack", "rolledBack"]);
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("cancellation after SQLite commit restores rollout and database", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-cancel-after-sqlite.jsonl");
+  await writeRollout(sessionPath, "thread-cancel-after-sqlite", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-cancel-after-sqlite", model_provider: "apigather" }]);
+  const before = await fs.readFile(sessionPath, "utf8");
+  const controller = new AbortController();
+
+  let error;
+  try {
+    await runSync({
+      codexHome,
+      provider: "openai",
+      signal: controller.signal,
+      faultInjector: ({ point }) => {
+        if (point === "after_sqlite_commit") {
+          controller.abort();
+        }
+      }
+    });
+    assert.fail("runSync should observe cancellation before transaction commit");
+  } catch (caught) {
+    error = caught;
+  }
+
+  assert.equal(error.name, "SyncTransactionError");
+  assert.equal(error.originalError.name, "AbortError");
+  assert.equal(error.rollbackStatus, "complete");
+  assert.equal(error.recoveryRequired, false);
+  assert.equal(await fs.readFile(sessionPath, "utf8"), before);
+  assert.equal(await readProvider(codexHome, "thread-cancel-after-sqlite"), "apigather");
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("cancellation after transaction commit does not roll back committed state", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-cancel-after-commit.jsonl");
+  await writeRollout(sessionPath, "thread-cancel-after-commit", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-cancel-after-commit", model_provider: "apigather" }]);
+  const controller = new AbortController();
+
+  const result = await runSync({
+    codexHome,
+    provider: "openai",
+    signal: controller.signal,
+    faultInjector: ({ point }) => {
+      if (point === "after_transaction_commit") {
+        controller.abort();
+      }
+    }
+  });
+
+  assert.equal(result.changedSessionFiles, 1);
+  assert.equal(await readProvider(codexHome, "thread-cancel-after-commit"), "openai");
+  assert.match(await fs.readFile(sessionPath, "utf8"), /"model_provider":"openai"/);
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("a lost acknowledgement after a durable journal commit is reconciled as success", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-commit-ack.jsonl");
+  await writeRollout(sessionPath, "thread-commit-ack", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-commit-ack", model_provider: "apigather" }]);
+
+  const result = await runSync({
+    codexHome,
+    faultInjector: ({ point }) => {
+      if (point === "after_transaction_journal_commit_before_ack") {
+        throw new Error("injected lost commit acknowledgement");
+      }
+    }
+  });
+
+  assert.equal(result.changedSessionFiles, 1);
+  assert.equal(await readProvider(codexHome, "thread-commit-ack"), "openai");
+  assert.match(await fs.readFile(sessionPath, "utf8"), /"model_provider":"openai"/);
+  const journal = await readTransactionJournal(path.join(result.backupDir, "transaction-journal.jsonl"));
+  assert.equal(journal.state, "committed");
+  assert.equal(journal.terminal, true);
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("commit acknowledgement reconciliation rejects a terminal from another operation", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-foreign-commit.jsonl");
+  await writeRollout(sessionPath, "thread-foreign-commit", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-foreign-commit", model_provider: "apigather" }]);
+  let backupDir = null;
+
+  await assert.rejects(
+    runSync({
+      codexHome,
+      onProgress(event) {
+        if (event.stage === "create_backup" && event.status === "complete") {
+          backupDir = event.backupDir;
+        }
+      },
+      async faultInjector({ point }) {
+        if (point !== "after_transaction_journal_commit_before_ack") {
+          return;
+        }
+        const journalPath = path.join(backupDir, "transaction-journal.jsonl");
+        const events = (await fs.readFile(journalPath, "utf8"))
+          .trim()
+          .split("\n")
+          .map((line) => ({ ...JSON.parse(line), operationId: "foreign-operation-id" }));
+        await fs.writeFile(journalPath, `${events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
+        throw new Error("injected lost commit acknowledgement");
+      }
+    }),
+    /injected lost commit acknowledgement/
+  );
+
+  const journal = await readTransactionJournal(path.join(backupDir, "transaction-journal.jsonl"));
+  assert.equal(journal.terminal, true);
+  assert.equal(journal.state, "committed");
+  assert.equal(journal.operationId, "foreign-operation-id");
+});
+
+test("an exception after the committed terminal never triggers rollback", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-post-commit-error.jsonl");
+  await writeRollout(sessionPath, "thread-post-commit-error", "apigather");
+  let backupDir = null;
+
+  await assert.rejects(
+    runSync({
+      codexHome,
+      onProgress(event) {
+        if (event.stage === "create_backup" && event.status === "complete") {
+          backupDir = event.backupDir;
+        }
+      },
+      faultInjector: ({ point }) => {
+        if (point === "after_transaction_commit") {
+          throw new Error("injected post-commit observer failure");
+        }
+      }
+    }),
+    /post-commit observer failure/
+  );
+
+  assert.match(await fs.readFile(sessionPath, "utf8"), /"model_provider":"openai"/);
+  const journal = await readTransactionJournal(path.join(backupDir, "transaction-journal.jsonl"));
+  assert.equal(journal.state, "committed");
+  assert.equal(journal.terminal, true);
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("progress observer failures before and after commit are non-fatal", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-progress-failure.jsonl");
+  await writeRollout(sessionPath, "thread-progress-failure", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-progress-failure", model_provider: "apigather" }]);
+  const observedFailures = [];
+
+  const result = await runSync({
+    codexHome,
+    onProgress(event) {
+      if ((event.stage === "update_sqlite" && event.status === "complete")
+          || (event.stage === "clean_backups" && event.status === "start")) {
+        observedFailures.push(`${event.stage}:${event.status}`);
+        throw new Error("injected progress observer failure");
+      }
+    }
+  });
+
+  assert.deepEqual(observedFailures, ["update_sqlite:complete", "clean_backups:start"]);
+  assert.match(await fs.readFile(sessionPath, "utf8"), /"model_provider":"openai"/);
+  assert.equal(await readProvider(codexHome, "thread-progress-failure"), "openai");
+  const journal = await readTransactionJournal(path.join(result.backupDir, "transaction-journal.jsonl"));
+  assert.equal(journal.state, "committed");
+  assert.equal(journal.terminal, true);
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("failure before transaction commit rolls back before pruning old backups", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-before-commit-failure.jsonl");
+  await writeRollout(sessionPath, "thread-before-commit", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-before-commit", model_provider: "apigather" }]);
+  const before = await fs.readFile(sessionPath, "utf8");
+  const oldBackupDir = path.join(backupRoot(codexHome), "20260319T000000000Z");
+  await writeBackup(codexHome, "20260319T000000000Z", [["note.txt", "must-survive"]]);
+
+  let error;
+  try {
+    await runSync({
+      codexHome,
+      provider: "openai",
+      keepCount: 1,
+      faultInjector: ({ point }) => {
+        if (point === "before_transaction_commit") {
+          throw new Error("injected transaction-commit failure");
+        }
+      }
+    });
+    assert.fail("runSync should fail before committing the transaction");
+  } catch (caught) {
+    error = caught;
+  }
+
+  assert.equal(error.name, "SyncTransactionError");
+  assert.equal(error.rollbackStatus, "complete");
+  assert.equal(await fs.readFile(sessionPath, "utf8"), before);
+  assert.equal(await readProvider(codexHome, "thread-before-commit"), "apigather");
+  await fs.access(oldBackupDir);
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("SQLite rollback failure preserves recovery evidence and manual restore recovers", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-sqlite-rollback-failure.jsonl");
+  await writeRollout(sessionPath, "thread-sqlite-rollback", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-sqlite-rollback", model_provider: "apigather" }]);
+  const before = await fs.readFile(sessionPath, "utf8");
+
+  let error;
+  try {
+    await runSync({
+      codexHome,
+      provider: "openai",
+      faultInjector: ({ point }) => {
+        if (point === "after_sqlite_commit_before_ack") {
+          throw new Error("injected lost SQLite COMMIT acknowledgement");
+        }
+        if (point === "before_sqlite_rollback") {
+          throw new Error("injected SQLite rollback failure");
+        }
+      }
+    });
+    assert.fail("runSync should require recovery when SQLite compensation fails");
+  } catch (caught) {
+    error = caught;
+  }
+
+  assert.equal(error.name, "SyncTransactionError");
+  assert.equal(error.code, "RECOVERY_REQUIRED");
+  assert.equal(error.rollbackStatus, "incomplete");
+  assert.equal(error.recoveryRequired, true);
+  assert.ok(error.rollbackErrors.some((value) => value.includes("injected SQLite rollback failure")));
+  assert.equal(await fs.readFile(sessionPath, "utf8"), before);
+  assert.equal(await readProvider(codexHome, "thread-sqlite-rollback"), "openai");
+  assert.equal((await findPendingTransactions(codexHome)).length, 1);
+  const pendingJournal = await readTransactionJournal(path.join(error.backupDir, "transaction-journal.jsonl"));
+  assert.equal(pendingJournal.state, "recoveryRequired");
+  assert.equal(pendingJournal.terminal, false);
+  assert.equal(pendingJournal.events.some((event) => event.state === "rolledBack"), false);
+
+  await runRestore({ backupDir: error.backupDir, codexHome });
+  assert.equal(await fs.readFile(sessionPath, "utf8"), before);
+  assert.equal(await readProvider(codexHome, "thread-sqlite-rollback"), "apigather");
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("unfinished journal blocks writes until the bound backup is restored", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  await writeStateDb(codexHome, [{ id: "thread-recovery", model_provider: "openai" }]);
+  const configPath = path.join(codexHome, "config.toml");
+  const backupDir = await createBackup({
+    codexHome,
+    targetProvider: "openai",
+    sessionChanges: [],
+    configPath
+  });
+  await TransactionJournal.create(backupDir, {
+    codexHome,
+    targetProvider: "openai",
+    potentialTargets: [configPath]
+  });
+
+  const status = await getStatus({ codexHome });
+  assert.equal(status.pendingTransactions.length, 1);
+  assert.match(renderStatus(status), /Recovery required:[\s\S]*Run restore/);
+  await assert.rejects(
+    runSync({ codexHome }),
+    (error) => error?.code === "RECOVERY_REQUIRED" && error.pendingTransactions.length === 1
+  );
+
+  await runRestore({ backupDir, codexHome });
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+  const result = await runSync({ codexHome });
+  assert.equal(result.targetProvider, "openai");
+});
+
+test("crash recovery restores actually mutated rollout and database from a pending journal", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-crash-recovery.jsonl");
+  await writeRollout(sessionPath, "thread-crash-recovery", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-crash-recovery", model_provider: "apigather" }]);
+  const before = await fs.readFile(sessionPath, "utf8");
+  const { changes } = await collectSessionChanges(codexHome, "openai");
+  const backupDir = await createBackup({
+    codexHome,
+    targetProvider: "openai",
+    sessionChanges: changes,
+    configPath: path.join(codexHome, "config.toml")
+  });
+  const journal = await TransactionJournal.create(backupDir, {
+    codexHome,
+    targetProvider: "openai",
+    potentialTargets: [sessionPath, stateDbPath(codexHome)]
+  });
+
+  await journal.applying("rollout", sessionPath);
+  await applySessionChanges(changes);
+  await journal.applied("rollout", sessionPath);
+  await journal.applying("sqlite", stateDbPath(codexHome));
+  const db = await openDatabase(stateDbPath(codexHome));
+  try {
+    db.prepare("UPDATE threads SET model_provider = ? WHERE id = ?")
+      .run("openai", "thread-crash-recovery");
+  } finally {
+    db.close();
+  }
+  await journal.applied("sqlite", stateDbPath(codexHome));
+
+  assert.notEqual(await fs.readFile(sessionPath, "utf8"), before);
+  assert.equal(await readProvider(codexHome, "thread-crash-recovery"), "openai");
+  assert.equal((await getStatus({ codexHome })).pendingTransactions.length, 1);
+  await assert.rejects(
+    runSync({ codexHome }),
+    (error) => error?.code === "RECOVERY_REQUIRED"
+  );
+
+  await runRestore({ backupDir, codexHome });
+  assert.equal(await fs.readFile(sessionPath, "utf8"), before);
+  assert.equal(await readProvider(codexHome, "thread-crash-recovery"), "apigather");
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("rollback failure preserves both errors and manual recovery evidence", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-rollback-failure.jsonl");
+  await writeRollout(sessionPath, "thread-rollback", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-rollback", model_provider: "apigather" }]);
+
+  let error;
+  try {
+    await runSync({
+      codexHome,
+      faultInjector: ({ point }) => {
+        if (point === "after_rollout_apply") {
+          throw new Error("injected original failure");
+        }
+        if (point === "before_rollout_rollback") {
+          throw new Error("injected rollback failure");
+        }
+      }
+    });
+    assert.fail("runSync should fail when rollback is injected to fail");
+  } catch (caught) {
+    error = caught;
+  }
+
+  assert.equal(error.name, "SyncTransactionError");
+  assert.equal(error.code, "RECOVERY_REQUIRED");
+  assert.match(error.originalError.message, /injected original failure/);
+  assert.ok(error.rollbackErrors.some((value) => value.includes("injected rollback failure")));
+  assert.equal(error.rollbackStatus, "incomplete");
+  assert.equal(error.recoveryRequired, true);
+  assert.equal((await findPendingTransactions(codexHome)).length, 1);
+
+  await runRestore({ backupDir: error.backupDir, codexHome });
+  const firstLine = (await fs.readFile(sessionPath, "utf8")).split("\n")[0];
+  assert.equal(JSON.parse(firstLine).payload.model_provider, "apigather");
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("cancellation after the first target rolls back disk and SQLite with structured evidence", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const firstPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-cancel-a.jsonl");
+  const secondPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-cancel-b.jsonl");
+  await writeRollout(firstPath, "thread-cancel-a", "apigather");
+  await writeRollout(secondPath, "thread-cancel-b", "apigather");
+  await writeStateDb(codexHome, [
+    { id: "thread-cancel-a", model_provider: "apigather" },
+    { id: "thread-cancel-b", model_provider: "apigather" }
+  ]);
+  const before = await Promise.all([fs.readFile(firstPath, "utf8"), fs.readFile(secondPath, "utf8")]);
+  const controller = new AbortController();
+
+  let error;
+  try {
+    await runSync({
+      codexHome,
+      provider: "openai",
+      signal: controller.signal,
+      faultInjector: ({ point, appliedCount }) => {
+        if (point === "after_rollout_apply" && appliedCount === 1) {
+          controller.abort();
+        }
+      }
+    });
+    assert.fail("runSync should observe cancellation at the next target checkpoint");
+  } catch (caught) {
+    error = caught;
+  }
+
+  assert.equal(error.name, "SyncTransactionError");
+  assert.equal(error.code, "SYNC_FAILED_ROLLED_BACK");
+  assert.equal(error.originalError.name, "AbortError");
+  assert.equal(error.rollbackStatus, "complete");
+  assert.equal(error.recoveryRequired, false);
+  assert.ok(error.completedTargets.includes(path.resolve(firstPath)));
+  assert.equal(await fs.readFile(firstPath, "utf8"), before[0]);
+  assert.equal(await fs.readFile(secondPath, "utf8"), before[1]);
+  const db = await openDatabase(stateDbPath(codexHome));
+  try {
+    const providers = db.prepare("SELECT model_provider FROM threads ORDER BY id").all();
+    assert.deepEqual(providers.map((row) => row.model_provider), ["apigather", "apigather"]);
+  } finally {
+    db.close();
+  }
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("cancellation after the only rollout is observed before SQLite commit", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-cancel-only.jsonl");
+  await writeRollout(sessionPath, "thread-cancel-only", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-cancel-only", model_provider: "apigather" }]);
+  const before = await fs.readFile(sessionPath, "utf8");
+  const controller = new AbortController();
+
+  let error;
+  try {
+    await runSync({
+      codexHome,
+      provider: "openai",
+      signal: controller.signal,
+      faultInjector: ({ point, appliedCount }) => {
+        if (point === "after_rollout_apply" && appliedCount === 1) {
+          controller.abort();
+        }
+      }
+    });
+    assert.fail("runSync should observe cancellation before committing SQLite");
+  } catch (caught) {
+    error = caught;
+  }
+
+  assert.equal(error.name, "SyncTransactionError");
+  assert.equal(error.originalError.name, "AbortError");
+  assert.equal(error.rollbackStatus, "complete");
+  assert.equal(error.recoveryRequired, false);
+  assert.equal(await fs.readFile(sessionPath, "utf8"), before);
+  assert.equal(await readProvider(codexHome, "thread-cancel-only"), "apigather");
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("concurrent sync is rejected by the operation lock without competing mutation", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-concurrent.jsonl");
+  await writeRollout(sessionPath, "thread-concurrent", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-concurrent", model_provider: "apigather" }]);
+  let releaseFirstOperation;
+  const holdFirstOperation = new Promise((resolve) => {
+    releaseFirstOperation = resolve;
+  });
+  let firstMutationObserved;
+  const firstMutation = new Promise((resolve) => {
+    firstMutationObserved = resolve;
+  });
+  const firstSync = runSync({
+    codexHome,
+    provider: "openai",
+    faultInjector: async ({ point, appliedCount }) => {
+      if (point === "after_rollout_apply" && appliedCount === 1) {
+        firstMutationObserved();
+        await holdFirstOperation;
+      }
+    }
+  });
+  await firstMutation;
+
+  try {
+    await assert.rejects(
+      runSync({ codexHome, provider: "openai" }),
+      /Lock already exists/
+    );
+  } finally {
+    releaseFirstOperation();
+  }
+
+  const result = await firstSync;
+  assert.equal(result.changedSessionFiles, 1);
+  assert.equal(await readProvider(codexHome, "thread-concurrent"), "openai");
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("repeated sync is idempotent for rollout and SQLite state", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-idempotent.jsonl");
+  await writeRollout(sessionPath, "thread-idempotent", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-idempotent", model_provider: "apigather" }]);
+
+  const first = await runSync({ codexHome, provider: "openai" });
+  const afterFirst = await fs.readFile(sessionPath, "utf8");
+  const second = await runSync({ codexHome, provider: "openai" });
+
+  assert.equal(first.changedSessionFiles, 1);
+  assert.equal(first.sqliteProviderRowsUpdated, 1);
+  assert.equal(second.changedSessionFiles, 0);
+  assert.equal(second.sqliteProviderRowsUpdated, 0);
+  assert.equal(second.sqliteRowsUpdated, 0);
+  assert.equal(await fs.readFile(sessionPath, "utf8"), afterFirst);
+  assert.equal(await readProvider(codexHome, "thread-idempotent"), "openai");
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("failure after model mutation but before journal applied restores full rollout bytes", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"\nmodel = "gpt-new"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "06", "09", "rollout-model-window.jsonl");
+  await writeRolloutWithTurnContext(sessionPath, {
+    id: "thread-model-window",
+    provider: "apigather",
+    model: "gpt-old"
+  });
+  const before = await fs.readFile(sessionPath);
+
+  let error;
+  try {
+    await runSync({
+      codexHome,
+      provider: "openai",
+      model: "gpt-new",
+      faultInjector: ({ point, mutation }) => {
+        if (point === "after_rollout_mutation_before_applied" && mutation?.stage === "model") {
+          throw new Error("injected after-model-before-applied failure");
+        }
+      }
+    });
+    assert.fail("runSync should fail after the model rename");
+  } catch (caught) {
+    error = caught;
+  }
+
+  assert.equal(error.code, "SYNC_FAILED_ROLLED_BACK");
+  assert.ok(error.completedTargets.includes(path.resolve(sessionPath)));
+  assert.deepEqual(await fs.readFile(sessionPath), before);
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("immutable full manifest restores a later applying target after abrupt exit", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const firstPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-crash-full-a.jsonl");
+  const secondPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-crash-full-b.jsonl");
+  await writeRollout(firstPath, "thread-crash-full-a", "apigather");
+  await writeRollout(secondPath, "thread-crash-full-b", "apigather");
+  const before = await Promise.all([fs.readFile(firstPath), fs.readFile(secondPath)]);
+
+  const childScript = `
+    import path from "node:path";
+    import { runSync } from "./src/service.js";
+    const codexHome = ${JSON.stringify(codexHome)};
+    const secondPath = ${JSON.stringify(secondPath)};
+    await runSync({
+      codexHome,
+      provider: "openai",
+      faultInjector: ({ point, path: targetPath, mutation }) => {
+        if (point === "after_rollout_mutation_before_applied"
+            && mutation?.stage === "firstLine"
+            && path.resolve(targetPath) === path.resolve(secondPath)) {
+          process.exit(23);
+        }
+      }
+    });
+  `;
+  const child = spawn(process.execPath, ["--input-type=module", "-e", childScript], {
+    cwd: path.resolve(".")
+  });
+  const exitCode = await new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("exit", resolve);
+  });
+  assert.equal(exitCode, 23);
+  assert.notDeepEqual(await fs.readFile(secondPath), before[1]);
+
+  const status = await getStatus({ codexHome });
+  assert.equal(status.pendingTransactions.length, 1);
+  await assert.rejects(runSync({ codexHome }), (caught) => caught?.code === "RECOVERY_REQUIRED");
+  const [backupDir] = await fs.readdir(backupRoot(codexHome));
+  const fullBackupDir = path.join(backupRoot(codexHome), backupDir);
+  const manifest = JSON.parse(await fs.readFile(path.join(fullBackupDir, "session-meta-backup.json"), "utf8"));
+  assert.equal(manifest.files.length, 2);
+
+  await runRestore({
+    codexHome,
+    backupDir: fullBackupDir,
+    restoreConfig: false,
+    restoreDatabase: false
+  });
+  assert.deepEqual(await fs.readFile(firstPath), before[0]);
+  assert.deepEqual(await fs.readFile(secondPath), before[1]);
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("foreign operationId and missing-final-newline journals stay pending until explicit restore", async (t) => {
+  for (const corruption of ["foreign-operation", "missing-final-newline", "commit-after-recovery-required"]) {
+    await t.test(corruption, async () => {
+      const { codexHome } = await makeTempCodexHome();
+      await writeConfig(codexHome, 'model_provider = "openai"');
+      const configPath = path.join(codexHome, "config.toml");
+      const backupDir = await createBackup({
+        codexHome,
+        targetProvider: "openai",
+        sessionChanges: [],
+        configPath
+      });
+      const journal = await TransactionJournal.create(backupDir, {
+        codexHome,
+        targetProvider: "openai",
+        potentialTargets: [configPath]
+      });
+      if (corruption === "foreign-operation") {
+        await fs.appendFile(journal.filePath, `${JSON.stringify({
+          protocolVersion: 1,
+          operationId: "foreign-operation-id",
+          sequence: 2,
+          state: "committed",
+          recordedAt: new Date().toISOString()
+        })}\n`, "utf8");
+      } else if (corruption === "missing-final-newline") {
+        const text = await fs.readFile(journal.filePath, "utf8");
+        await fs.writeFile(journal.filePath, text.replace(/\n$/, ""), "utf8");
+      } else {
+        await journal.recoveryRequired(new Error("original"), ["rollback"]);
+        await fs.appendFile(journal.filePath, `${JSON.stringify({
+          protocolVersion: 1,
+          operationId: journal.operationId,
+          sequence: 3,
+          state: "committed",
+          recordedAt: new Date().toISOString()
+        })}\n`, "utf8");
+      }
+
+      const corrupted = await readTransactionJournal(journal.filePath);
+      assert.equal(corrupted.invalidTail, true);
+      assert.equal(corrupted.terminal, false);
+      assert.equal((await findPendingTransactions(codexHome)).length, 1);
+
+      await runRestore({
+        codexHome,
+        backupDir,
+        restoreDatabase: false,
+        restoreSessions: false
+      });
+      const repaired = await readTransactionJournal(journal.filePath);
+      assert.equal(repaired.invalidTail, false);
+      assert.equal(repaired.state, "rolledBack");
+      assert.equal(repaired.terminal, true);
+      assert.deepEqual(await findPendingTransactions(codexHome), []);
+      assert.ok((await fs.readdir(backupDir)).some((name) => name.startsWith("transaction-journal.jsonl.invalid.")));
+    });
+  }
+});
+
+test("journal rejects a target outside prepared potentialTargets", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const configPath = path.join(codexHome, "config.toml");
+  const backupDir = await createBackup({
+    codexHome,
+    targetProvider: "openai",
+    sessionChanges: [],
+    configPath
+  });
+  const journal = await TransactionJournal.create(backupDir, {
+    codexHome,
+    targetProvider: "openai",
+    potentialTargets: [configPath]
+  });
+  await fs.appendFile(journal.filePath, `${JSON.stringify({
+    protocolVersion: 1,
+    operationId: journal.operationId,
+    sequence: 2,
+    state: "applying",
+    kind: "config",
+    targetPath: path.join(codexHome, "outside.toml"),
+    recordedAt: new Date().toISOString()
+  })}\n`, "utf8");
+
+  const parsed = await readTransactionJournal(journal.filePath);
+  assert.equal(parsed.invalidTail, true);
+  assert.match(parsed.validationError, /potentialTargets/);
+});
+
+test("journal rejects forged rolledBack and duplicate journal creation", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const configPath = path.join(codexHome, "config.toml");
+  const backupDir = await createBackup({
+    codexHome,
+    targetProvider: "openai",
+    sessionChanges: [],
+    configPath
+  });
+  const journal = await TransactionJournal.create(backupDir, {
+    codexHome,
+    targetProvider: "openai",
+    potentialTargets: [configPath]
+  });
+  await assert.rejects(
+    TransactionJournal.create(backupDir, {
+      codexHome,
+      targetProvider: "openai",
+      potentialTargets: [configPath]
+    }),
+    (error) => error?.code === "EEXIST"
+  );
+  await fs.appendFile(journal.filePath, `${JSON.stringify({
+    protocolVersion: 1,
+    operationId: journal.operationId,
+    sequence: 2,
+    state: "rolledBack",
+    recordedAt: new Date().toISOString()
+  })}\n`, "utf8");
+  const parsed = await readTransactionJournal(journal.filePath);
+  assert.equal(parsed.invalidTail, true);
+  assert.match(parsed.validationError, /without first entering rollback/);
+});
+
+test("partial restore cannot clear a pending SQLite transaction", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  await writeStateDb(codexHome, [{ id: "thread-partial-restore", model_provider: "apigather" }]);
+  const dbPath = stateDbPath(codexHome);
+  const backupDir = await createBackup({
+    codexHome,
+    targetProvider: "openai",
+    sessionChanges: [],
+    configPath: path.join(codexHome, "config.toml")
+  });
+  const journal = await TransactionJournal.create(backupDir, {
+    codexHome,
+    targetProvider: "openai",
+    potentialTargets: [dbPath]
+  });
+  await journal.applying("sqlite", dbPath);
+  const db = await openDatabase(dbPath);
+  try {
+    db.prepare("UPDATE threads SET model_provider = 'openai'").run();
+  } finally {
+    db.close();
+  }
+  await journal.applied("sqlite", dbPath);
+
+  await assert.rejects(
+    runRestore({
+      codexHome,
+      backupDir,
+      restoreConfig: false,
+      restoreDatabase: false,
+      restoreSessions: false
+    }),
+    (error) => error?.code === "RECOVERY_REQUIRED"
+      && error.missingRestoreKinds.includes("SQLite database")
+  );
+  assert.equal(await readProvider(codexHome, "thread-partial-restore"), "openai");
+  assert.equal((await findPendingTransactions(codexHome)).length, 1);
+
+  await runRestore({
+    codexHome,
+    backupDir,
+    restoreConfig: false,
+    restoreDatabase: true,
+    restoreSessions: false
+  });
+  assert.equal(await readProvider(codexHome, "thread-partial-restore"), "apigather");
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("pruning protects the journal directory instead of trusting recorded backupDir", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const configPath = path.join(codexHome, "config.toml");
+  const backupDir = await createBackup({
+    codexHome,
+    targetProvider: "openai",
+    sessionChanges: [],
+    configPath
+  });
+  const journal = await TransactionJournal.create(backupDir, {
+    codexHome,
+    targetProvider: "openai",
+    potentialTargets: [configPath]
+  });
+  const [prepared] = (await fs.readFile(journal.filePath, "utf8")).trim().split("\n").map(JSON.parse);
+  prepared.backupDir = path.join(codexHome, "unrelated-backup");
+  await fs.writeFile(journal.filePath, `${JSON.stringify(prepared)}\n`, "utf8");
+
+  await pruneBackups(codexHome, 0);
+  await fs.access(backupDir);
+  assert.equal((await findPendingTransactions(codexHome)).length, 1);
+});
+
+test("rollback removes a global-state backup that did not exist before the operation", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const statePath = path.join(codexHome, ".codex-global-state.json");
+  const stateBackupPath = `${statePath}.bak`;
+  const original = `${JSON.stringify({
+    "electron-saved-workspace-roots": ["C:\\AITemp"],
+    "project-order": ["C:\\AITemp"],
+    "active-workspace-roots": ["C:\\AITemp"]
+  }, null, 2)}\n`;
+  await fs.writeFile(statePath, original, "utf8");
+
+  await assert.rejects(
+    runSync({
+      codexHome,
+      faultInjector: ({ point, path: targetPath }) => {
+        if (point === "after_global_state_apply" && targetPath === stateBackupPath) {
+          throw new Error("injected after global-state backup creation");
+        }
+      }
+    }),
+    /after global-state backup creation/
+  );
+
+  assert.equal(await fs.readFile(statePath, "utf8"), original);
+  await assert.rejects(fs.access(stateBackupPath), (error) => error?.code === "ENOENT");
+});
+
+test("switch preserves structured original and config rollback failures inside the operation lock", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  const originalConfig = `model_provider = "openai"\n\n[model_providers.apigather]\nbase_url = "https://example.com"\n`;
+  const configPath = path.join(codexHome, "config.toml");
+  await fs.writeFile(configPath, originalConfig, "utf8");
+
+  let error;
+  try {
+    await runSwitch({
+      codexHome,
+      provider: "apigather",
+      faultInjector: ({ point }) => {
+        if (point === "after_config_mutation_before_applied") {
+          throw new Error("injected switch failure");
+        }
+        if (point === "before_config_rollback") {
+          throw new Error("injected config rollback failure");
+        }
+      }
+    });
+    assert.fail("switch should require recovery");
+  } catch (caught) {
+    error = caught;
+  }
+
+  assert.equal(error.code, "RECOVERY_REQUIRED");
+  assert.match(error.originalError.message, /injected switch failure/);
+  assert.ok(error.rollbackErrors.some((message) => message.includes("injected config rollback failure")));
+  assert.match(await fs.readFile(configPath, "utf8"), /^model_provider = "apigather"/m);
+  assert.equal((await findPendingTransactions(codexHome)).length, 1);
+
+  await runRestore({
+    codexHome,
+    backupDir: error.backupDir,
+    restoreDatabase: false,
+    restoreSessions: false
+  });
+  assert.equal(await fs.readFile(configPath, "utf8"), originalConfig);
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("backup failure occurs before journal or target mutation", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-backup-failure.jsonl");
+  await writeRollout(sessionPath, "thread-backup-failure", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-backup-failure", model_provider: "apigather" }]);
+  const before = await fs.readFile(sessionPath, "utf8");
+
+  await assert.rejects(
+    runSync({
+      codexHome,
+      faultInjector: ({ point }) => {
+        if (point === "before_backup") {
+          throw new Error("injected backup creation failure");
+        }
+      }
+    }),
+    /injected backup creation failure/
+  );
 
-delete process.env.CODEX_SQLITE_HOME;
+  assert.equal(await fs.readFile(sessionPath, "utf8"), before);
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+  await assert.rejects(fs.access(backupRoot(codexHome)));
+});
+
+test("atomic replacement failure preserves the original file and removes staging", async () => {
+  if (process.platform !== "win32") {
+    return;
+  }
+  const { root } = await makeTempCodexHome();
+  const targetPath = path.join(root, "atomic-target.txt");
+  await fs.writeFile(targetPath, "before", "utf8");
+  const lockProcess = await lockRolloutFile(targetPath);
+  try {
+    await assert.rejects(() => writeFileAtomic(targetPath, "after"));
+  } finally {
+    lockProcess.kill();
+    await new Promise((resolve) => lockProcess.once("exit", resolve));
+  }
+  assert.equal(await fs.readFile(targetPath, "utf8"), "before");
+  const staging = (await fs.readdir(root)).filter((name) => name.includes(".provider-sync.") && name.endsWith(".tmp"));
+  assert.deepEqual(staging, []);
+});
+
+test("backup, atomic rollout rewrite, and restore preserve restrictive file modes", async () => {
+  if (process.platform === "win32") {
+    return;
+  }
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const configPath = path.join(codexHome, "config.toml");
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-mode.jsonl");
+  await writeRollout(sessionPath, "thread-mode", "apigather");
+  await fs.chmod(configPath, 0o600);
+  await fs.chmod(sessionPath, 0o600);
+  const { changes } = await collectSessionChanges(codexHome, "openai");
+  const backupDir = await createBackup({
+    codexHome,
+    targetProvider: "openai",
+    sessionChanges: changes,
+    configPath
+  });
+  assert.equal((await fs.stat(path.join(backupDir, "config.toml"))).mode & 0o777, 0o600);
+  assert.equal((await fs.stat(path.join(backupDir, "session-meta-backup.json"))).mode & 0o777, 0o600);
+
+  await applySessionChanges(changes);
+  await updateSessionBackupManifest(backupDir, changes);
+  assert.equal((await fs.stat(sessionPath)).mode & 0o777, 0o600);
+  await restoreBackup(backupDir, codexHome, {
+    restoreConfig: true,
+    restoreDatabase: false,
+    restoreSessions: true
+  });
+  assert.equal((await fs.stat(configPath)).mode & 0o777, 0o600);
+  assert.equal((await fs.stat(sessionPath)).mode & 0o777, 0o600);
+});
+
+for (const faultPoint of ["before_stage_write", "before_atomic_replace"]) {
+  test(`atomic writer ${faultPoint} failure preserves the original and removes staging`, async () => {
+    const { root } = await makeTempCodexHome();
+    const targetPath = path.join(root, `atomic-${faultPoint}.txt`);
+    await fs.writeFile(targetPath, "before", "utf8");
+
+    await assert.rejects(
+      () => writeFileAtomic(targetPath, "after", "utf8", {
+        faultInjector: ({ point }) => {
+          if (point === faultPoint) {
+            throw new Error(`injected ${faultPoint}`);
+          }
+        }
+      }),
+      new RegExp(`injected ${faultPoint}`)
+    );
+
+    assert.equal(await fs.readFile(targetPath, "utf8"), "before");
+    const staging = (await fs.readdir(root)).filter((name) => name.includes(".provider-sync.") && name.endsWith(".tmp"));
+    assert.deepEqual(staging, []);
+  });
+}
 
 async function makeTempCodexHome() {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), "codex-provider-sync-"));
@@ -171,6 +1328,16 @@ async function writeStateDb(codexHome, rows) {
   await writeStateDbAt(stateDbPath(codexHome), rows);
 }
 
+async function readProvider(codexHome, threadId) {
+  const db = await openDatabase(stateDbPath(codexHome));
+  try {
+    return db.prepare("SELECT model_provider FROM threads WHERE id = ?")
+      .get(threadId).model_provider;
+  } finally {
+    db.close();
+  }
+}
+
 async function writeLegacyStateDb(codexHome, rows) {
   await writeStateDbAt(legacyStateDbPath(codexHome), rows);
 }
@@ -1886,7 +3053,7 @@ test("applySessionChanges preserves large UTF-8 session metadata", async () => {
   assert.match(rollout, /"large_blob":"数据块数据块/);
 });
 
-test("applySessionChanges replaces equal-length provider IDs in place", async () => {
+test("applySessionChanges atomically replaces equal-length provider IDs", async () => {
   const { codexHome } = await makeTempCodexHome();
   const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-in-place.jsonl");
   await writeRollout(sessionPath, "thread-in-place", "openai");
@@ -1902,22 +3069,17 @@ test("applySessionChanges replaces equal-length provider IDs in place", async ()
   const originalTime = new Date("2026-01-02T03:04:05.000Z");
   await fs.utimes(sessionPath, originalTime, originalTime);
 
-  const before = await fs.stat(sessionPath);
   const { changes } = await collectSessionChanges(codexHome, "prov_a");
   const result = await applySessionChanges(changes);
   const after = await fs.stat(sessionPath);
   const rollout = await fs.readFile(sessionPath, "utf8");
 
   assert.equal(result.appliedChanges, 1);
-  assert.equal(result.inPlaceChanges, 1);
-  if (process.platform !== "win32") {
-    assert.equal(after.ino, before.ino);
-  }
+  assert.equal(result.inPlaceChanges, 0);
   assert.equal(Math.round(after.mtimeMs), originalTime.getTime());
-  assert.equal(
-    rollout,
-    original.replace('"model_provider" : "openai"', '"model_provider" : "prov_a"')
-  );
+  const firstNewline = rollout.indexOf("\n");
+  assert.equal(JSON.parse(rollout.slice(0, firstNewline)).payload.model_provider, "prov_a");
+  assert.equal(rollout.slice(firstNewline + 1), original.slice(original.indexOf("\n") + 1));
 });
 
 test("applySessionChanges falls back when equal-length provider IDs have different JSON byte lengths", async () => {
@@ -2107,6 +3269,120 @@ test("restoreBackup only restores rollout files that were actually applied", asy
   assert.match(rollout, /"model_provider":"manual"/);
 });
 
+test("restoreBackup rejects escaped and non-rollout session manifest targets", async () => {
+  const { root, codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const configPath = path.join(codexHome, "config.toml");
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-safe.jsonl");
+  await writeRollout(sessionPath, "thread-safe", "apigather");
+  const { changes } = await collectSessionChanges(codexHome, "openai");
+  const backupDir = await createBackup({
+    codexHome,
+    targetProvider: "openai",
+    sessionChanges: changes,
+    configPath
+  });
+  const manifestPath = path.join(backupDir, "session-meta-backup.json");
+  const originalManifest = JSON.parse(await fs.readFile(manifestPath, "utf8"));
+
+  const escapedPath = path.join(root, "rollout-escaped.jsonl");
+  await fs.writeFile(escapedPath, "outside", "utf8");
+  const escapedManifest = JSON.parse(JSON.stringify(originalManifest));
+  escapedManifest.files[0].path = escapedPath;
+  await fs.writeFile(manifestPath, JSON.stringify(escapedManifest), "utf8");
+  await assert.rejects(
+    restoreBackup(backupDir, codexHome, {
+      restoreConfig: false,
+      restoreDatabase: false,
+      restoreSessions: true
+    }),
+    /outside the allowed rollout roots/
+  );
+
+  const nonRolloutPath = path.join(codexHome, "sessions", "2026", "03", "19", "arbitrary.jsonl");
+  await fs.writeFile(nonRolloutPath, "inside but not a rollout", "utf8");
+  const nonRolloutManifest = JSON.parse(JSON.stringify(originalManifest));
+  nonRolloutManifest.files[0].path = nonRolloutPath;
+  await fs.writeFile(manifestPath, JSON.stringify(nonRolloutManifest), "utf8");
+  await assert.rejects(
+    restoreBackup(backupDir, codexHome, {
+      restoreConfig: false,
+      restoreDatabase: false,
+      restoreSessions: true
+    }),
+    /outside the allowed rollout roots/
+  );
+});
+
+test("Windows restore attempts every rollout even when one target is locked", async () => {
+  if (process.platform !== "win32") {
+    return;
+  }
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const lockedPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-restore-locked.jsonl");
+  const restorablePath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-restore-restorable.jsonl");
+  await writeRollout(lockedPath, "thread-restore-locked", "apigather");
+  await writeRollout(restorablePath, "thread-restore-restorable", "apigather");
+  const { changes } = await collectSessionChanges(codexHome, "openai");
+  const backupDir = await createBackup({
+    codexHome,
+    targetProvider: "openai",
+    sessionChanges: changes,
+    configPath: path.join(codexHome, "config.toml")
+  });
+  await applySessionChanges(changes);
+  await updateSessionBackupManifest(backupDir, changes);
+  const lockProcess = await lockRolloutFile(lockedPath);
+  try {
+    await assert.rejects(
+      restoreBackup(backupDir, codexHome, {
+        restoreConfig: false,
+        restoreDatabase: false,
+        restoreSessions: true
+      }),
+      (error) => error instanceof AggregateError
+        && error.failures.some((failure) => failure.path === lockedPath)
+    );
+    assert.match(await fs.readFile(restorablePath, "utf8"), /"model_provider":"apigather"/);
+  } finally {
+    lockProcess.kill();
+    await new Promise((resolve) => lockProcess.once("exit", resolve));
+  }
+
+  assert.match(await fs.readFile(lockedPath, "utf8"), /"model_provider":"openai"/);
+
+  await restoreBackup(backupDir, codexHome, {
+    restoreConfig: false,
+    restoreDatabase: false,
+    restoreSessions: true
+  });
+  assert.match(await fs.readFile(lockedPath, "utf8"), /"model_provider":"apigather"/);
+});
+
+test("restore fails when global-state presence metadata points to a missing backup copy", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  await writeGlobalState(codexHome, { "project-order": ["C:\\AITemp"] });
+  const backupDir = await createBackup({
+    codexHome,
+    targetProvider: "openai",
+    sessionChanges: [],
+    configPath: path.join(codexHome, "config.toml")
+  });
+  await fs.rm(path.join(backupDir, ".codex-global-state.json.bak"));
+
+  await assert.rejects(
+    restoreBackup(backupDir, codexHome, {
+      restoreConfig: false,
+      restoreGlobalState: true,
+      restoreDatabase: false,
+      restoreSessions: false
+    }),
+    /was present, but its backup copy is missing/
+  );
+});
+
 test("restoreBackup can skip config, database, and sessions", async () => {
   const { codexHome } = await makeTempCodexHome();
   await writeConfig(codexHome, 'model_provider = "openai"');
@@ -2215,6 +3491,25 @@ test("pruneBackups ignores directories without managed backup metadata", async (
   await fs.access(junkDirectory);
 });
 
+test("pruneBackups never deletes a backup referenced by an unfinished transaction", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  const pendingDir = path.join(backupRoot(codexHome), "20260319T000000000Z");
+  await writeBackup(codexHome, "20260319T000000000Z", [["note.txt", "pending"]]);
+  await writeBackup(codexHome, "20260320T000000000Z", [["note.txt", "terminal"]]);
+  await TransactionJournal.create(pendingDir, {
+    codexHome,
+    targetProvider: "openai",
+    potentialTargets: []
+  });
+
+  const result = await pruneBackups(codexHome, 0);
+
+  assert.equal(result.deletedCount, 1);
+  assert.equal(result.remainingCount, 1);
+  await fs.access(pendingDir);
+  await assert.rejects(fs.access(path.join(backupRoot(codexHome), "20260320T000000000Z")));
+});
+
 test("runSync auto-prunes backups to the default retention count", async () => {
   const { codexHome } = await makeTempCodexHome();
   await writeConfig(codexHome, 'model_provider = "openai"');
@@ -2299,3 +3594,300 @@ test("cli sync prints stage progress and backup timing", async () => {
   assert.match(result.stdout, /Backup created in .*: .+/);
   assert.match(result.stdout, /Backup creation time: /);
 });
+
+test("syncDirectory only downgrades known unsupported flush errors on Windows", async () => {
+  const permissionError = Object.assign(new Error("directory flush denied"), { code: "EPERM" });
+  const unsupportedFs = {
+    async open() {
+      throw permissionError;
+    }
+  };
+  await assert.rejects(
+    syncDirectory("/tmp/provider-sync-dir", { fsImpl: unsupportedFs, platform: "linux" }),
+    /directory flush denied/
+  );
+  await syncDirectory("C:\\provider-sync-dir", { fsImpl: unsupportedFs, platform: "win32" });
+
+  const ioError = Object.assign(new Error("directory flush I/O failure"), { code: "EIO" });
+  await assert.rejects(
+    syncDirectory("C:\\provider-sync-dir", {
+      fsImpl: { async open() { throw ioError; } },
+      platform: "win32"
+    }),
+    /I\/O failure/
+  );
+});
+
+test("runRestore rejects all-disabled recovery when the first journal record is corrupt", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const configPath = path.join(codexHome, "config.toml");
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-corrupt-first.jsonl");
+  await writeRollout(sessionPath, "thread-corrupt-first", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-corrupt-first", model_provider: "apigather" }]);
+  const { changes } = await collectSessionChanges(codexHome, "openai");
+  const backupDir = await createBackup({
+    codexHome,
+    targetProvider: "openai",
+    sessionChanges: changes,
+    configPath
+  });
+  const journal = await TransactionJournal.create(backupDir, {
+    codexHome,
+    targetProvider: "openai",
+    potentialTargets: [configPath, sessionPath, stateDbPath(codexHome)]
+  });
+  await fs.writeFile(journal.filePath, "{corrupt first record\n", "utf8");
+
+  await assert.rejects(
+    runRestore({
+      backupDir,
+      codexHome,
+      restoreConfig: false,
+      restoreDatabase: false,
+      restoreSessions: false
+    }),
+    (error) => {
+      assert.equal(error.code, "RECOVERY_REQUIRED");
+      assert.deepEqual(
+        new Set(error.missingRestoreKinds),
+        new Set(["rollout sessions", "SQLite database", "config.toml", "global state"])
+      );
+      return true;
+    }
+  );
+  assert.equal((await findPendingTransactions(codexHome)).length, 1);
+  assert.equal((await readTransactionJournal(journal.filePath)).terminal, false);
+});
+
+test("one explicit restore repairs an empty crash-window journal", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const configPath = path.join(codexHome, "config.toml");
+  const backupDir = await createBackup({
+    codexHome,
+    targetProvider: "openai",
+    sessionChanges: [],
+    configPath
+  });
+  const journalPath = path.join(backupDir, "transaction-journal.jsonl");
+  await fs.writeFile(journalPath, "", "utf8");
+
+  await runRestore({
+    backupDir,
+    codexHome,
+    restoreConfig: true,
+    restoreDatabase: false,
+    restoreSessions: false
+  });
+
+  const repaired = await readTransactionJournal(journalPath);
+  assert.equal(repaired.invalidTail, false);
+  assert.equal(repaired.terminal, true);
+  assert.equal(repaired.state, "rolledBack");
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("an all-false global-state presence map remains conservative recovery coverage", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const configPath = path.join(codexHome, "config.toml");
+  const backupDir = await createBackup({
+    codexHome,
+    targetProvider: "openai",
+    sessionChanges: [],
+    configPath
+  });
+  const metadata = JSON.parse(await fs.readFile(path.join(backupDir, "metadata.json"), "utf8"));
+  assert.deepEqual(metadata.globalStateFiles, {
+    ".codex-global-state.json": false,
+    ".codex-global-state.json.bak": false
+  });
+  assert.equal((await getBackupRecoveryCoverage(backupDir, codexHome)).globalState, true);
+  await fs.writeFile(path.join(backupDir, "transaction-journal.jsonl"), "", "utf8");
+
+  await assert.rejects(
+    runRestore({
+      backupDir,
+      codexHome,
+      restoreConfig: false,
+      restoreDatabase: false,
+      restoreSessions: false
+    }),
+    (error) => {
+      assert.equal(error.code, "RECOVERY_REQUIRED");
+      assert.ok(error.missingRestoreKinds.includes("global state"));
+      return true;
+    }
+  );
+});
+
+test("invalid journal tail with no validated target restores the full session manifest", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const configPath = path.join(codexHome, "config.toml");
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-tail-coverage.jsonl");
+  await writeRollout(sessionPath, "thread-tail-coverage", "apigather");
+  const original = await fs.readFile(sessionPath, "utf8");
+  const { changes } = await collectSessionChanges(codexHome, "openai");
+  const backupDir = await createBackup({
+    codexHome,
+    targetProvider: "openai",
+    sessionChanges: changes,
+    configPath
+  });
+  const journal = await TransactionJournal.create(backupDir, {
+    codexHome,
+    targetProvider: "openai",
+    potentialTargets: [sessionPath]
+  });
+  await writeRollout(sessionPath, "thread-tail-coverage", "openai");
+  await fs.appendFile(journal.filePath, "{torn target record", "utf8");
+
+  await runRestore({
+    backupDir,
+    codexHome,
+    restoreConfig: true,
+    restoreDatabase: false,
+    restoreSessions: true
+  });
+
+  assert.equal(await fs.readFile(sessionPath, "utf8"), original);
+  const repaired = await readTransactionJournal(journal.filePath);
+  assert.equal(repaired.state, "rolledBack");
+  assert.equal(repaired.terminal, true);
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("automatic rollback does not report success unless the rolledBack terminal re-reads valid", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-terminal-verify.jsonl");
+  await writeRollout(sessionPath, "thread-terminal-verify", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-terminal-verify", model_provider: "apigather" }]);
+  const before = await fs.readFile(sessionPath, "utf8");
+  let backupDir = null;
+
+  await assert.rejects(
+    runSync({
+      codexHome,
+      onProgress(event) {
+        if (event.stage === "create_backup" && event.status === "complete") {
+          backupDir = event.backupDir;
+        }
+      },
+      async faultInjector({ point }) {
+        if (point === "after_rollout_apply") {
+          throw new Error("injected post-apply failure");
+        }
+        if (point === "before_rollout_rollback") {
+          await fs.appendFile(
+            path.join(backupDir, "transaction-journal.jsonl"),
+            `${JSON.stringify({ protocolVersion: 1, operationId: "foreign", sequence: 999, state: "rollingBack" })}\n`,
+            "utf8"
+          );
+        }
+      }
+    }),
+    (error) => {
+      assert.equal(error.code, "RECOVERY_REQUIRED");
+      assert.equal(error.rollbackStatus, "incomplete");
+      assert.match(error.rollbackErrors.join("; "), /valid rolledBack terminal state/);
+      return true;
+    }
+  );
+
+  assert.equal(await fs.readFile(sessionPath, "utf8"), before);
+  assert.equal((await findPendingTransactions(codexHome)).length, 1);
+  await runRestore({ backupDir, codexHome });
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("a lost rolledBack acknowledgement never appends recoveryRequired", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-rollback-ack.jsonl");
+  await writeRollout(sessionPath, "thread-rollback-ack", "apigather");
+  await writeStateDb(codexHome, [{ id: "thread-rollback-ack", model_provider: "apigather" }]);
+  const before = await fs.readFile(sessionPath, "utf8");
+  let caught = null;
+
+  try {
+    await runSync({
+      codexHome,
+      faultInjector({ point }) {
+        if (point === "after_rollout_apply") {
+          throw new Error("injected forward failure");
+        }
+        if (point === "after_transaction_journal_rollback_before_ack") {
+          throw new Error("injected lost rollback acknowledgement");
+        }
+      }
+    });
+  } catch (error) {
+    caught = error;
+  }
+
+  assert.equal(caught?.rollbackStatus, "complete");
+  assert.equal(caught?.recoveryRequired, false);
+  assert.match(caught?.originalError?.message ?? "", /injected forward failure/);
+  assert.equal(await fs.readFile(sessionPath, "utf8"), before);
+  const journal = await readTransactionJournal(path.join(caught.backupDir, "transaction-journal.jsonl"));
+  assert.equal(journal.terminal, true);
+  assert.equal(journal.state, "rolledBack");
+  assert.equal(journal.operationId, journal.events[0].operationId);
+  assert.equal(journal.events.some((event) => event.state === "recoveryRequired"), false);
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});
+
+test("a turn_context appended after first-line mutation remains byte-original on rollback", async () => {
+  const { codexHome } = await makeTempCodexHome();
+  await writeConfig(codexHome, 'model_provider = "openai"\nmodel = "target-model"');
+  const sessionPath = path.join(codexHome, "sessions", "2026", "03", "19", "rollout-concurrent-model.jsonl");
+  await writeRolloutWithTurnContext(sessionPath, {
+    id: "thread-concurrent-model",
+    provider: "apigather",
+    model: "source-model"
+  });
+  await writeStateDb(codexHome, [{ id: "thread-concurrent-model", model_provider: "apigather" }]);
+  const appended = JSON.stringify({
+    timestamp: "2026-06-09T11:16:03.880Z",
+    type: "turn_context",
+    payload: {
+      turn_id: "concurrent-turn",
+      model: "concurrent-source-model",
+      collaboration_mode: {
+        mode: "default",
+        settings: { model: "concurrent-source-model", reasoning_effort: "xhigh" }
+      }
+    }
+  });
+  let appendedOnce = false;
+
+  await assert.rejects(
+    runSync({
+      codexHome,
+      model: "target-model",
+      async faultInjector({ point, mutation }) {
+        if (point === "after_rollout_mutation_before_applied"
+            && mutation?.stage === "firstLine"
+            && !appendedOnce) {
+          appendedOnce = true;
+          await fs.appendFile(sessionPath, `${appended}\n`, "utf8");
+        }
+      }
+    }),
+    (error) => {
+      assert.equal(error.code, "SYNC_FAILED_ROLLED_BACK");
+      assert.match(error.originalError.message, /model snapshot changed before rewrite/);
+      return true;
+    }
+  );
+
+  const restored = await fs.readFile(sessionPath, "utf8");
+  assert.match(restored.split(/\r?\n/)[0], /"model_provider":"apigather"/);
+  assert.ok(restored.includes('"model":"source-model"'));
+  assert.ok(restored.includes('"model":"concurrent-source-model"'));
+  assert.ok(!restored.includes('"model":"target-model"'));
+  assert.deepEqual(await findPendingTransactions(codexHome), []);
+});