diff --git a/.github/workflows/cli-package.yml b/.github/workflows/cli-package.yml
index c662c80ba1..5494a1ce18 100644
--- a/.github/workflows/cli-package.yml
+++ b/.github/workflows/cli-package.yml
@@ -26,6 +26,7 @@ concurrency:
 jobs:
   # ── Resolve version info (mirrors desktop-package.yml) ─────────────
   prepare:
+    if: github.event_name != 'release' || !startsWith(github.event.release.tag_name, 'data-migrator-v')
     name: Prepare
     runs-on: ubuntu-latest
     outputs:
diff --git a/.github/workflows/data-migrator-package.yml b/.github/workflows/data-migrator-package.yml
new file mode 100644
index 0000000000..be681e5930
--- /dev/null
+++ b/.github/workflows/data-migrator-package.yml
@@ -0,0 +1,112 @@
+name: Data Migrator Package
+
+on:
+  push:
+    tags: ['data-migrator-v*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: data-migrator-package-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Migrator (${{ matrix.platform }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: windows-x64
+            os: windows-latest
+            target: x86_64-pc-windows-msvc
+            bundles: --no-bundle
+          - platform: macos-arm64
+            os: macos-15
+            target: aarch64-apple-darwin
+            bundles: --bundles dmg
+          - platform: macos-x64
+            os: macos-15-intel
+            target: x86_64-apple-darwin
+            bundles: --bundles dmg
+          - platform: linux-x64
+            os: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+            bundles: --bundles appimage
+    steps:
+      - uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: '22.18.0'
+          cache: pnpm
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - uses: swatinem/rust-cache@v2
+        with:
+          shared-key: data-migrator-${{ matrix.platform }}
+          cache-bin: false
+      - name: Install Linux WebView build dependencies
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
+      - run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Verify independent version and packaging contract
+        run: |
+          node scripts/data-migrator-release.mjs --check-version
+          node --test scripts/data-migrator-tauri-build.test.mjs
+      - name: Check offline data compatibility
+        run: cargo test --locked -p openbitfun-data-migrator -p openbitfun-legacy-migration-adapters -p openbitfun-legacy-migration -p openbitfun-config-contracts --lib --test migration_engine_contracts
+      - name: Build independent package
+        run: pnpm run data-migrator:build -- --target ${{ matrix.target }} ${{ matrix.bundles }}
+      - name: Stage package and checksum
+        run: node scripts/data-migrator-release.mjs ${{ matrix.platform }}
+      - uses: actions/upload-artifact@v6
+        with:
+          name: data-migrator-${{ matrix.platform }}
+          path: target/data-migrator-release/${{ matrix.platform }}/*
+          if-no-files-found: error
+
+  draft-release:
+    if: startsWith(github.ref, 'refs/tags/data-migrator-v')
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: '22.18.0'
+      - uses: actions/download-artifact@v7
+        with:
+          pattern: data-migrator-*
+          path: migrator-release-assets
+          merge-multiple: true
+      - name: Sign and verify with the independent migrator release key
+        shell: bash
+        env:
+          OPENBITFUN_SIGNING_KEY: ${{ secrets.DATA_MIGRATOR_SIGNING_PRIVATE_KEY }}
+          OPENBITFUN_SIGNING_PASSWORD: ${{ secrets.DATA_MIGRATOR_SIGNING_PRIVATE_KEY_PASSWORD }}
+          OPENBITFUN_SIGNING_PUBKEY: ${{ secrets.DATA_MIGRATOR_SIGNING_PUBKEY }}
+        run: |
+          set -euo pipefail
+          test -n "$OPENBITFUN_SIGNING_KEY"
+          test -n "$OPENBITFUN_SIGNING_PUBKEY"
+          cat migrator-release-assets/*.sha256 | sort -k2 > migrator-release-assets/SHA256SUMS
+          (cd migrator-release-assets && sha256sum --check SHA256SUMS)
+          bash scripts/sign-release-assets.sh migrator-release-assets/*
+          node scripts/write-minisign-public-key.mjs --out migrator-release-assets/data-migrator.minisign.pub
+      - name: Create a separately reviewed release
+        uses: softprops/action-gh-release@v3
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: OpenBitFun Data Migrator ${{ github.ref_name }}
+          draft: true
+          make_latest: false
+          files: migrator-release-assets/*
+          body_path: src/apps/data-migrator/RELEASE.md
diff --git a/.github/workflows/desktop-package.yml b/.github/workflows/desktop-package.yml
index b5f2480557..44e90b0601 100644
--- a/.github/workflows/desktop-package.yml
+++ b/.github/workflows/desktop-package.yml
@@ -44,6 +44,7 @@ concurrency:
 jobs:
   # ── Resolve version info ───────────────────────────────────────────
   prepare:
+    if: github.event_name != 'release' || !startsWith(github.event.release.tag_name, 'data-migrator-v')
     name: Prepare
     runs-on: ubuntu-latest
     outputs:
diff --git a/Cargo.lock b/Cargo.lock
index 7d9fa167ab..5b599783f2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5863,6 +5863,21 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "openbitfun-config-contracts"
+version = "1.0.0"
+dependencies = [
+ "chrono",
+ "hex",
+ "log",
+ "openbitfun-core-types",
+ "openbitfun-product-domains",
+ "serde",
+ "serde_json",
+ "sha2",
+ "ts-rs",
+]
+
 [[package]]
 name = "openbitfun-core"
 version = "1.0.0"
@@ -5897,11 +5912,12 @@ dependencies = [
  "openbitfun-ai-adapters",
  "openbitfun-claude-code-adapter",
  "openbitfun-codex-adapter",
+ "openbitfun-config-contracts",
  "openbitfun-core-types",
  "openbitfun-dsh-adapter",
  "openbitfun-events",
  "openbitfun-external-sources",
- "openbitfun-legacy-migration",
+ "openbitfun-legacy-migration-adapters",
  "openbitfun-opencode-adapter",
  "openbitfun-opencode-plugin-host",
  "openbitfun-plugin-runtime-client",
@@ -5945,12 +5961,11 @@ dependencies = [
 
 [[package]]
 name = "openbitfun-data-migrator"
-version = "1.0.0"
+version = "0.1.0"
 dependencies = [
- "openbitfun-core",
  "openbitfun-core-types",
  "openbitfun-legacy-migration",
- "openbitfun-product-capabilities",
+ "openbitfun-legacy-migration-adapters",
  "openbitfun-product-domains",
  "serde",
  "serde_json",
@@ -6003,7 +6018,6 @@ dependencies = [
  "openbitfun-core",
  "openbitfun-core-types",
  "openbitfun-events",
- "openbitfun-legacy-migration",
  "openbitfun-product-domains",
  "openbitfun-relay-service",
  "openbitfun-runtime-ports",
@@ -6111,6 +6125,30 @@ dependencies = [
  "windows 0.61.3",
 ]
 
+[[package]]
+name = "openbitfun-legacy-migration-adapters"
+version = "1.0.0"
+dependencies = [
+ "anyhow",
+ "chrono",
+ "dunce",
+ "hex",
+ "openbitfun-agent-runtime",
+ "openbitfun-config-contracts",
+ "openbitfun-core-types",
+ "openbitfun-legacy-migration",
+ "openbitfun-product-domains",
+ "openbitfun-services-core",
+ "openbitfun-services-integrations",
+ "rusqlite",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tempfile",
+ "tokio",
+ "uuid",
+]
+
 [[package]]
 name = "openbitfun-miniapp-market-server"
 version = "1.0.0"
diff --git a/Cargo.toml b/Cargo.toml
index b4f13d7fe5..7460f7acf5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -29,6 +29,7 @@ members = [
     "src/crates/services/services-core",
     "src/crates/services/services-integrations",
     "src/crates/services/legacy-migration",
+    "src/crates/services/legacy-migration-adapters",
     "src/crates/services/miniapp-market-service",
     "src/crates/services/skin-market-service",
     "src/crates/services/relay-service",
@@ -46,6 +47,7 @@ members = [
     "src/crates/execution/tool-provider-groups",
     "src/crates/execution/tool-execution",
     "src/crates/contracts/core-types",
+    "src/crates/contracts/config-contracts",
     "src/crates/contracts/events",
     "src/crates/contracts/runtime-ports",
 ]
diff --git a/README.md b/README.md
index cbd9d9d93b..524d80a94d 100644
--- a/README.md
+++ b/README.md
@@ -103,6 +103,12 @@ OpenBitFun is still evolving. Here are three directions we want to explore:
 
 Getting there means making long-running tasks more reliable, the runtime more efficient, and the desktop experience smoother.
 
+## Optional legacy data migration
+
+Data migration is optional and uses a **separately downloaded OpenBitFun Data
+Migrator**. It runs independently and is not bundled with or launched by the main
+application. See the [download, compatibility and recovery guide](src/apps/data-migrator/README.md).
+
 ## Build with it. Help shape it.
 
 **Star OpenBitFun to follow along. Share what you build, offer feedback, or contribute code to help shape what comes next.**
diff --git a/README.zh-CN.md b/README.zh-CN.md
index af66b1db9e..7c500d8543 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -105,6 +105,12 @@ OpenBitFun 仍在演进，我们希望继续探索三个方向：
 
 更可靠的长任务、更高效的 Runtime、更从容的桌面体验，是这些探索共同的基础。
 
+## 按需迁移旧版数据
+
+数据迁移是可选操作，请按需**单独下载 OpenBitFun 数据迁移器**。工具独立运行，
+不随主应用打包，也不会由主应用自动启动。下载、兼容范围、操作步骤与中断恢复见
+[迁移器使用说明](src/apps/data-migrator/README.zh-CN.md)。
+
 ## 用它创造，也一起创造它
 
 **欢迎用 Star 关注 OpenBitFun，用作品、反馈和代码参与它的未来。**
diff --git a/docs/architecture/product-architecture.md b/docs/architecture/product-architecture.md
index b4bbea2ad4..b8a0bd1be3 100644
--- a/docs/architecture/product-architecture.md
+++ b/docs/architecture/product-architecture.md
@@ -895,3 +895,19 @@ Shared Agent Runtime 是第一方多实例的目标部署，不是上表新增
   启停顺序和失败回滚。这项宿主接入不构成 CLI、Server、ACP 或 HarmonyOS 本地产品支持。
 - HarmonyOS PC 的完整目标同时包含本地 CLI/TUI 与 GUI，当前均不能标记可用；两种宿主分别验收，具体支持证据和禁止替代项以平台规约及各自专题为准。
 - 文档、边界脚本和 focused 测试能说明本次变更保护了哪个稳定接口边界，或删除/降级了哪个过宽接口。
+
+## 独立数据迁移工具的依赖边界
+
+Data Migrator 是独立发布的本地离线工具，不依赖 Core、Product Assembly、Desktop 或 Web UI。
+主应用不检测、启动或捆绑迁移器。两者在同一源码工作区复用稳定的数据格式与存储实现：
+
+- contracts/config-contracts：配置 DTO、默认值、版本校验及到共享模型 DTO 的纯转换；Core 原路径保留转发，ConfigProvider 仍在 Core。
+- services-core 的 workspace-persistence、coordination-store、session-event-format：工作区记录、注册表校验、SQLite 物理 schema 和会话日志格式。
+- services/legacy-migration-adapters：旧版读取、转换、引用修复；只调用共享存储 owner。
+- services/legacy-migration：快照、锁、暂存、备份、原子写入、日志恢复和无时效交接依赖的任务存储。
+
+本次只移动数据/存储 owner，不移动 WorkspaceManager、会话生命周期、权限、事件或远程执行。
+WorkspaceInfo/WorkspaceIdentity 的运行操作由 Core 的 runtime extension traits 保留，稳定记录无需导入这些能力。
+原 Core 存储入口保留错误映射；可选 legacy-migration facade 保留旧导入路径，但不再由 product-full 启用。
+远程四种场景不提供迁移工具的执行入口；仅转换本机保存的连接记录，不连接远端。
+使用与发行契约以 [独立迁移器说明](../../src/apps/data-migrator/README.zh-CN.md) 为准。
diff --git a/docs/architecture/product-customization-blueprint.md b/docs/architecture/product-customization-blueprint.md
index 22ff0d80bd..4e864d4a26 100644
--- a/docs/architecture/product-customization-blueprint.md
+++ b/docs/architecture/product-customization-blueprint.md
@@ -17,15 +17,13 @@ C0a 实现一个构建期 JSONC 产品定义、严格解析器和确定性解析
 当前真实消费者只有：
 
 - Desktop build adapter：从解析结果覆盖 Tauri `productName`、`mainBinaryName` 与 bundle identifier；
-- Data Migrator build adapter：从解析结果覆盖独立 Tauri 身份，并把 Desktop 与 Migrator 的 sibling binary name
-  编译进交接边界；
 - CLI dev/build wrapper：从同一解析结果设置命令名、隔离定制构建缓存，并按成员 `binaryName` 暂存构建产物；
-- First-party Rust artifacts：Desktop/Data Migrator/CLI build adapter 通过编译期环境注入 `productId`、
+- First-party Rust artifacts：Desktop/CLI build adapter 通过编译期环境注入 `productId`、
   `dataNamespace` 与由其派生的隐藏目录名，`openbitfun-core-types::product_identity` 作为最小事实 owner，供数据路径、Runtime
   ownership、Remote Connect 与 Detached Dispatch 复用；
 
 `product:check` / `product:explain` 只是构建作者的校验与解释工具，不计作产品字段的生产消费者。C0a 不生成无人读取的
-通用产品 manifest 或 locale projection；三个 build adapter 直接消费同一次内存解析结果，Rust consumer
+通用产品 manifest 或 locale projection；两个 build adapter 直接消费同一次内存解析结果，Rust consumer
 只读取随对应产品 artifact 编译进去的不可变事实，不在运行时重新选产品。
 
 产品定义 v1 仅包含已被这些消费者读取的字段，未知字段一律拒绝。localized 名称独立于技术 ID，并按共享 locale contract
@@ -37,7 +35,7 @@ GUI/TUI 布局、插件/内置扩展选择、Installer/Store target、更新与
 
 ### 0.1 当前定义与解析契约
 
-产品定义描述一个 family，其中 Desktop、Data Migrator 与 CLI 是分别命名、分别消费的成员；Installer 与 Store 是可能的 Desktop
+产品定义描述一个 family，其中 Desktop 与 CLI 是分别命名、分别消费的成员；Installer 与 Store 是可能的 Desktop
 交付目标，不是独立成员，当前也没有对应实现。schema v1 只接受以下已消费字段：
 
 ```jsonc
@@ -51,11 +49,6 @@ GUI/TUI 布局、插件/内置扩展选择、Installer/Store target、更新与
       "binaryName": "acme-desktop",
       "bundleId": "com.acme.desktop"
     },
-    "dataMigrator": {
-      "displayNameKey": "product.dataMigrator.name",
-      "binaryName": "acme-data-migrator",
-      "bundleId": "com.acme.data-migrator"
-    },
     "cli": {
       "displayNameKey": "product.cli.name",
       "binaryName": "acme"
@@ -65,7 +58,7 @@ GUI/TUI 布局、插件/内置扩展选择、Installer/Store target、更新与
 ```
 
 解析器先校验完整 family、双方 locale key、owned path 与技术 ID，再选择命令对应成员；digest-bearing `assembly`
-只携带 schema/source digest、成员、display-name key、binary/bundle identity、交接所需 sibling binary names、
+只携带 schema/source digest、成员、display-name key、binary/bundle identity、
 locale contract facts 与 assembly digest。
 构建 adapter 所需的源路径、localized 名称、输出目录和 default-product 标记保留在外围 build context，不扩展成通用
 manifest。相同输入必须产生相同摘要；非默认产品使用 digest-scoped Cargo target 目录，避免复用其他产品的编译期身份。
@@ -79,9 +72,13 @@ i18n locale 集合和 key parity。
 
 - 只修改默认产品定义或资源引用时运行 `pnpm run product:check`；非默认定义运行
   `pnpm run product:check -- --product-config <path>`，确保校验实际改动的产品；
-- 修改 schema、resolver 或 Desktop/Data Migrator/CLI build adapter 行为时，再运行 `pnpm run product:test`；
+- 修改 schema、resolver 或 Desktop/CLI build adapter 行为时，再运行 `pnpm run product:test`；
 - 打包和平台矩阵只在变更触及对应交付路径时运行，不作为产品定义的默认本地预检。
 
+Data Migrator 已从产品 family 与 sibling binary 投影中移除，使用自己的版本、Tauri 身份、构建与发布工作流。
+它固定面向 OpenBitFun 数据格式；工具身份与目标数据身份分开。旧定制产品定义应移除 `members.dataMigrator`。
+详见 [迁移器 README](../../src/apps/data-migrator/README.zh-CN.md)。
+
 ## 1. 设计结论
 
 产品定制只需要四类对象：
diff --git a/docs/architecture/rust-build-dependency-boundaries.md b/docs/architecture/rust-build-dependency-boundaries.md
index c0a7ddc46c..1873ee621a 100644
--- a/docs/architecture/rust-build-dependency-boundaries.md
+++ b/docs/architecture/rust-build-dependency-boundaries.md
@@ -246,3 +246,19 @@ cargo check -p <product> --timings
 
 当前硬边界由 `scripts/check-core-boundaries.mjs` 统一执行。不要为同一 Cargo 架构事实增加第二个 checker；新增规则先证明当前树满足、fixture 能捕获回归，并保持错误消息可直接定位到 owner manifest。
 检查器必须保持工作树只读；读取独立 manifest 的声明事实时不得生成新的 lockfile、target artifact 或格式化改动。
+
+## 独立数据迁移工具的依赖边界
+
+Data Migrator 是独立发布的本地离线工具，不依赖 Core、Product Assembly、Desktop 或 Web UI。
+主应用不检测、启动或捆绑迁移器。两者在同一源码工作区复用稳定的数据格式与存储实现：
+
+- contracts/config-contracts：配置 DTO、默认值、版本校验及到共享模型 DTO 的纯转换；Core 原路径保留转发，ConfigProvider 仍在 Core。
+- services-core 的 workspace-persistence、coordination-store、session-event-format：工作区记录、注册表校验、SQLite 物理 schema 和会话日志格式。
+- services/legacy-migration-adapters：旧版读取、转换、引用修复；只调用共享存储 owner。
+- services/legacy-migration：快照、锁、暂存、备份、原子写入、日志恢复和无时效交接依赖的任务存储。
+
+本次只移动数据/存储 owner，不移动 WorkspaceManager、会话生命周期、权限、事件或远程执行。
+WorkspaceInfo/WorkspaceIdentity 的运行操作由 Core 的 runtime extension traits 保留，稳定记录无需导入这些能力。
+原 Core 存储入口保留错误映射；可选 legacy-migration facade 保留旧导入路径，但不再由 product-full 启用。
+远程四种场景不提供迁移工具的执行入口；仅转换本机保存的连接记录，不连接远端。
+使用与发行契约以 [独立迁移器说明](../../src/apps/data-migrator/README.zh-CN.md) 为准。
diff --git a/docs/architecture/theme-token-optimization.md b/docs/architecture/theme-token-optimization.md
index 2008504d70..fb00602c13 100644
--- a/docs/architecture/theme-token-optimization.md
+++ b/docs/architecture/theme-token-optimization.md
@@ -200,6 +200,13 @@ Mobile Web 直接消费 `@openbitfun/theme-openbitfun`。`ThemeProvider` 与首
 
 ### Desktop bootstrap 与 Native Mobile 预览
 
+Data Migrator 的独立静态界面直接消费设计系统公开的字体、间距、控件和语义颜色 Token。
+`generate-data-migrator-theme.mjs` 构建设计系统的 Token/主题包，并将公开 CSS 入口及其依赖打包为
+`src/apps/data-migrator/ui/generated/design-system.css`，随迁移程序离线交付。原生控件只使用 canonical
+Token；`theme.js` 在首屏绘制前选择系统浅色/深色和高对比模式，并监听系统设置变化。
+仅独立迁移器打包刷新该资源，开发者也可显式运行生成命令；Desktop 开发和打包不依赖迁移器。
+统一颜色审计同时检查源码和生成物漂移。
+
 Desktop 的更新确认页和启动页只消费 `src/apps/desktop/src/generated/bootstrap_theme.css` 发布的 canonical
 `--openbitfun-*`，不得内联另一套启动色。该 CSS 和两个 Appearance manifest 一起由
 `generate-startup-appearance-bootstrap.mjs` 从正式主题/Appearance 源生成；统一颜色审计执行 `--check`，
diff --git a/docs/interactive-capabilities/README.md b/docs/interactive-capabilities/README.md
index 3bcdd2c880..09eac55a30 100644
--- a/docs/interactive-capabilities/README.md
+++ b/docs/interactive-capabilities/README.md
@@ -1,9 +1,9 @@
 <!-- generated by scripts/generate-interactive-capabilities.mjs; do not edit -->
 # OpenBitFun 功能与设置目录 / OpenBitFun Features & Settings
 
-OpenBitFun Playbook 当前包含 **22 个功能**和 **22 个设置页**，共 **44 个**用户可理解的条目、**326 项**有源码证据的子能力。每个条目有独立 Markdown，并直接服务于说明书网站、OpenBitFun 全局搜索和 `OpenBitFunControl` Agent 工具。
+OpenBitFun Playbook 当前包含 **22 个功能**和 **21 个设置页**，共 **43 个**用户可理解的条目、**321 项**有源码证据的子能力。每个条目有独立 Markdown，并直接服务于说明书网站、OpenBitFun 全局搜索和 `OpenBitFunControl` Agent 工具。
 
-OpenBitFun Playbook currently contains **22 features**, **22 settings pages**, and **326** source-backed sub-capabilities across **44** user-facing entries. Every entry has its own Markdown page and directly powers the website, in-app global search, and the `OpenBitFunControl` agent tool.
+OpenBitFun Playbook currently contains **22 features**, **21 settings pages**, and **321** source-backed sub-capabilities across **43** user-facing entries. Every entry has its own Markdown page and directly powers the website, in-app global search, and the `OpenBitFunControl` agent tool.
 
 ## 唯一事实源 / Single source of truth
 
@@ -27,20 +27,20 @@ OpenBitFun Playbook currently contains **22 features**, **22 settings pages**, a
 - Generated per-item interaction audit: `docs/interactive-capabilities/technical/product-control-open-audit.json`
 - Generated low-level audit map: `docs/interactive-capabilities/technical/tauri-command-map.json`
 
-说明书、网站、搜索和 Agent 只看“功能 + 设置 + 子能力”。每项子能力都必须引用已注册 Tauri Command 或可解析的源码标记；这些证据不会进入公开目录。当前 **671** 个 Tauri 命令只用于实现覆盖审计。产品 UI 交互源码会在生成和检查时扫描并校验，但不会保存成随普通 UI 改动频繁变化的版本化快照。
+说明书、网站、搜索和 Agent 只看“功能 + 设置 + 子能力”。每项子能力都必须引用已注册 Tauri Command 或可解析的源码标记；这些证据不会进入公开目录。当前 **666** 个 Tauri 命令只用于实现覆盖审计。产品 UI 交互源码会在生成和检查时扫描并校验，但不会保存成随普通 UI 改动频繁变化的版本化快照。
 
-Docs, website, search, and agents see only features, settings, and documented sub-capabilities. Every sub-capability must reference a registered Tauri command or a resolvable source marker; evidence is stripped from public projections. The **671** Tauri commands remain implementation-audit evidence only. Product UI interaction sources are scanned and validated during generation and checks, but are not stored as a versioned snapshot that churns with ordinary UI changes.
+Docs, website, search, and agents see only features, settings, and documented sub-capabilities. Every sub-capability must reference a registered Tauri command or a resolvable source marker; evidence is stripped from public projections. The **666** Tauri commands remain implementation-audit evidence only. Product UI interaction sources are scanned and validated during generation and checks, but are not stored as a versioned snapshot that churns with ordinary UI changes.
 
 ## 控制边界 / Control boundary
 
-- 每个子能力都明确标记为直接控制、委托给专用 Agent 工具、需交互打开或不支持；“打开页面”不会再被统计成“Agent 已控制”。当前覆盖：直接 **48**、委托 **61**、需交互 **217**、不支持 **0**。
+- 每个子能力都明确标记为直接控制、委托给专用 Agent 工具、需交互打开或不支持；“打开页面”不会再被统计成“Agent 已控制”。当前覆盖：直接 **48**、委托 **61**、需交互 **212**、不支持 **0**。
 - 稳定行为声明为带 JSON 输入契约的 `operations` 或 `options`，并绑定原生产品控制 Provider；Agent 不接触原始 Tauri Command。
-- `OpenBitFunControl list` 和 `search` 都返回带 `nextCursor` 的精简分页结果；目录可持续增长，不靠固定总量上限。完整目录和 326 项子能力都不会写入 system prompt。
+- `OpenBitFunControl list` 和 `search` 都返回带 `nextCursor` 的精简分页结果；目录可持续增长，不靠固定总量上限。完整目录和 321 项子能力都不会写入 system prompt。
 - 目录发现与契约读取不依赖 React 或可见窗口。普通配置型 option 统一由 Product Assembly 的共享 ConfigService 执行器读、写并回读，因此 Desktop、CLI 与 Headless 表面走同一份实现；只有宿主原生 operation/provider option 和界面导航按表面注册适配器，缺失时必须明确返回不可用，禁止静默回退本机。只读 Agent 只能发现和读取目录。
 
-- Every documented item is classified as direct control, delegated Agent control, interactive opening, or unsupported; opening a page is never counted as direct control. Current coverage is **48 direct**, **61 delegated**, **217 interactive**, and **0 unsupported**.
+- Every documented item is classified as direct control, delegated Agent control, interactive opening, or unsupported; opening a page is never counted as direct control. Current coverage is **48 direct**, **61 delegated**, **212 interactive**, and **0 unsupported**.
 - Stable behavior becomes a typed `operation` or `option` with a JSON input contract and a native product-control provider. Agents never receive raw Tauri commands.
-- `OpenBitFunControl list` and `search` return compact pages with a `nextCursor`; the catalog can grow without a fixed total-size ceiling. Neither the full catalog nor its 326 documented items enters the system prompt.
+- `OpenBitFunControl list` and `search` return compact pages with a `nextCursor`; the catalog can grow without a fixed total-size ceiling. Neither the full catalog nor its 321 documented items enters the system prompt.
 - Discovery and contract lookup do not depend on React or a visible window. Ordinary config-backed options are read, written, and read back by one Product Assembly ConfigService executor shared by Desktop, CLI, and headless surfaces. Only host-native operations/provider options and presentation routes install surface adapters; missing adapters return explicit unavailability without local fallback. Read-only agents may only discover and inspect entries.
 
 ## 防腐化门禁 / Anti-drift gates
diff --git a/docs/interactive-capabilities/capabilities.json b/docs/interactive-capabilities/capabilities.json
index 653efc45a6..a8c4149de3 100644
--- a/docs/interactive-capabilities/capabilities.json
+++ b/docs/interactive-capabilities/capabilities.json
@@ -4,7 +4,7 @@
   "title": "OpenBitFun Playbook",
   "origin": "https://playbook.openbitfun.com",
   "source": "src/shared/interactive-capabilities/catalog.json",
-  "digest": "c77c16c414ce9fe50929fe249d900489fdceedb8e646aaaca03893aa33d4fbc8",
+  "digest": "d7a7419ddd673eb733ae8bd33dbb3dcd3b4d1ce0acfc953067a3403fe26d6699",
   "ownerDigest": "c0e5c187cf62bc6ed06196ce8520b3eb427bf268cf24659b72d2552fb1d99c54",
   "searchAcceptance": [
     {
@@ -136,13 +136,13 @@
   ],
   "counts": {
     "features": 22,
-    "settings": 22,
-    "userFacing": 44,
-    "documentedItems": 326,
+    "settings": 21,
+    "userFacing": 43,
+    "documentedItems": 321,
     "controlCoverage": {
       "direct": 48,
       "delegated": 61,
-      "interactive": 217,
+      "interactive": 212,
       "unsupported": 0
     }
   },
@@ -18765,285 +18765,6 @@
         "pageId": "data.archived"
       }
     },
-    {
-      "id": "setting.data.migration:query",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "scan",
-        "scope",
-        "launch",
-        "report",
-        "reminder"
-      ],
-      "kind": "query",
-      "risk": "read",
-      "executionHost": "productHost",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": true
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": true
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "valueSource": {
-        "kind": "static"
-      },
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
-    {
-      "id": "setting.data.migration:open:scan",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "scan"
-      ],
-      "kind": "open",
-      "risk": "ui",
-      "executionHost": "presentationSurface",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1",
-            "product_control_presentation_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "openReason": "unstructuredInteraction",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
-    {
-      "id": "setting.data.migration:open:scope",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "scope"
-      ],
-      "kind": "open",
-      "risk": "ui",
-      "executionHost": "presentationSurface",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1",
-            "product_control_presentation_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "openReason": "visualSelection",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
-    {
-      "id": "setting.data.migration:open:launch",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "launch"
-      ],
-      "kind": "open",
-      "risk": "ui",
-      "executionHost": "presentationSurface",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1",
-            "product_control_presentation_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "openReason": "unstructuredInteraction",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
-    {
-      "id": "setting.data.migration:open:report",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "report"
-      ],
-      "kind": "open",
-      "risk": "ui",
-      "executionHost": "presentationSurface",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1",
-            "product_control_presentation_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "openReason": "unstructuredInteraction",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
-    {
-      "id": "setting.data.migration:open:reminder",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "reminder"
-      ],
-      "kind": "open",
-      "risk": "ui",
-      "executionHost": "presentationSurface",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1",
-            "product_control_presentation_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "openReason": "unstructuredInteraction",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
     {
       "id": "setting.data.diagnostics:query",
       "capabilityId": "setting.data.diagnostics",
@@ -29844,156 +29565,6 @@
       ],
       "docsUrl": "https://playbook.openbitfun.com/capabilities/setting.data.archived/"
     },
-    {
-      "id": "setting.data.migration",
-      "kind": "setting",
-      "categoryId": "data",
-      "titleZh": "旧版数据迁移",
-      "titleEn": "Legacy data migration",
-      "summaryZh": "从本机旧版 安装扫描并导入受支持的数据，查看去敏报告，同时保持旧来源不变。",
-      "summaryEn": "Scan and import supported data from a local legacy installation, inspect redacted reports, and leave the legacy source unchanged.",
-      "keywordsZh": [
-        "旧版数据迁移",
-        "旧版数据",
-        "迁移报告",
-        "导入旧数据",
-        "Data Migrator"
-      ],
-      "keywordsEn": [
-        "legacy data migration",
-        "legacy data",
-        "migration report",
-        "import old data",
-        "Data Migrator"
-      ],
-      "highlightsZh": [
-        "只读扫描本机旧版数据",
-        "按五个高层数据组选择迁移范围",
-        "通过独立 Data Migrator 导入并查看去敏报告"
-      ],
-      "highlightsEn": [
-        "Read-only scan of local legacy data",
-        "Choose migration scope across five high-level data groups",
-        "Import through the standalone Data Migrator and inspect redacted reports"
-      ],
-      "items": [
-        {
-          "id": "scan",
-          "titleZh": "只读扫描本机旧版数据来源及所选数据组",
-          "titleEn": "Read-only scan the local legacy source and selected data groups",
-          "control": {
-            "kind": "open",
-            "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“只读扫描本机旧版数据来源及所选数据组”：扫描依赖当前设备上的旧版数据、实时范围选择和结果状态；Agent 会打开精确入口，并把选择与扫描保留在用户可见界面。",
-            "reasonEn": "Read-only scan the local legacy source and selected data groups: Scanning depends on legacy data on the current device, live scope selection, and result state; the Agent opens the exact entry and keeps selection and scanning visible to the user."
-          }
-        },
-        {
-          "id": "scope",
-          "titleZh": "选择设置、扩展、会话、记忆和远程连接迁移范围",
-          "titleEn": "Choose settings, extensions, sessions, memory, and remote-connection migration scope",
-          "control": {
-            "kind": "open",
-            "reasonCode": "visualSelection",
-            "reasonZh": "迁移范围是影响本机持久数据的五组可见选择；Agent 会打开精确入口，由用户确认所需范围。",
-            "reasonEn": "Migration scope is a visible five-group selection affecting local persisted data; the Agent opens the exact entry so the user can confirm the intended scope."
-          }
-        },
-        {
-          "id": "launch",
-          "titleZh": "确认关闭影响后启动独立 Data Migrator",
-          "titleEn": "Launch the standalone Data Migrator after confirming shutdown impact",
-          "control": {
-            "kind": "open",
-            "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“确认关闭影响后启动独立 Data Migrator”：启动迁移器会停止正在运行的 Agent 和终端任务、关闭 Desktop，并交接到独立本机进程；Agent 只打开入口，确认和启动保留在用户可见界面。",
-            "reasonEn": "Launch the standalone Data Migrator after confirming shutdown impact: Launching the migrator can stop running agents and terminal tasks, close Desktop, and hand off to a separate local process; the Agent only opens the entry while confirmation and launch remain visible to the user."
-          }
-        },
-        {
-          "id": "report",
-          "titleZh": "查看最近运行结果和各领域去敏状态",
-          "titleEn": "Inspect the latest run result and redacted per-domain status",
-          "control": {
-            "kind": "open",
-            "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“查看最近运行结果和各领域去敏状态”：报告取决于本机最近一次迁移运行和各领域实时状态；Agent 会打开精确入口，并把报告查看与失败组重试保留在用户可见界面。",
-            "reasonEn": "Inspect the latest run result and redacted per-domain status: Reports depend on the most recent local migration run and live per-domain state; the Agent opens the exact entry and keeps report review and failed-group retry visible to the user."
-          }
-        },
-        {
-          "id": "reminder",
-          "titleZh": "恢复已关闭的首次启动迁移提醒",
-          "titleEn": "Restore the first-start migration reminder after it was disabled",
-          "control": {
-            "kind": "open",
-            "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“恢复已关闭的首次启动迁移提醒”：提醒偏好与当前本机旧数据来源绑定；Agent 会打开精确入口，由用户在可见界面决定是否恢复提醒。",
-            "reasonEn": "Restore the first-start migration reminder after it was disabled: The reminder preference is bound to the current local legacy source; the Agent opens the exact entry so the user can decide visibly whether to restore it."
-          }
-        }
-      ],
-      "stepsZh": [
-        "打开设置",
-        "进入“数据 > 旧版数据迁移”",
-        "扫描来源、选择范围并在确认关闭影响后启动迁移器"
-      ],
-      "stepsEn": [
-        "Open Settings",
-        "Go to Data > Legacy data migration",
-        "Scan the source, choose scope, and launch the migrator after confirming shutdown impact"
-      ],
-      "agentExamplesZh": [
-        "打开旧版数据迁移",
-        "带我查看数据迁移报告"
-      ],
-      "agentExamplesEn": [
-        "Open legacy data migration",
-        "Show me the data migration report"
-      ],
-      "destination": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      },
-      "operations": [],
-      "options": [],
-      "searchTerms": [
-        "setting.data.migration",
-        "旧版数据迁移",
-        "Legacy data migration",
-        "数据与诊断",
-        "Data & diagnostics",
-        "旧版数据",
-        "迁移报告",
-        "导入旧数据",
-        "Data Migrator",
-        "legacy data migration",
-        "legacy data",
-        "migration report",
-        "import old data",
-        "只读扫描本机旧版数据",
-        "按五个高层数据组选择迁移范围",
-        "通过独立 Data Migrator 导入并查看去敏报告",
-        "Read-only scan of local legacy data",
-        "Choose migration scope across five high-level data groups",
-        "Import through the standalone Data Migrator and inspect redacted reports",
-        "只读扫描本机旧版数据来源及所选数据组",
-        "Read-only scan the local legacy source and selected data groups",
-        "选择设置、扩展、会话、记忆和远程连接迁移范围",
-        "Choose settings, extensions, sessions, memory, and remote-connection migration scope",
-        "确认关闭影响后启动独立 Data Migrator",
-        "Launch the standalone Data Migrator after confirming shutdown impact",
-        "查看最近运行结果和各领域去敏状态",
-        "Inspect the latest run result and redacted per-domain status",
-        "恢复已关闭的首次启动迁移提醒",
-        "Restore the first-start migration reminder after it was disabled",
-        "打开旧版数据迁移",
-        "带我查看数据迁移报告",
-        "Open legacy data migration",
-        "Show me the data migration report"
-      ],
-      "docsUrl": "https://playbook.openbitfun.com/capabilities/setting.data.migration/"
-    },
     {
       "id": "setting.data.diagnostics",
       "kind": "setting",
diff --git a/docs/interactive-capabilities/capabilities/setting.data.migration.md b/docs/interactive-capabilities/capabilities/setting.data.migration.md
deleted file mode 100644
index a8039fde4c..0000000000
--- a/docs/interactive-capabilities/capabilities/setting.data.migration.md
+++ /dev/null
@@ -1,63 +0,0 @@
-<!-- generated by scripts/generate-interactive-capabilities.mjs; do not edit -->
----
-id: setting.data.migration
-kind: setting
-category: data
-title_zh: "旧版数据迁移"
-title_en: "Legacy data migration"
----
-
-# 旧版数据迁移 / Legacy data migration
-
-> 设置 / Setting
-
-从本机旧版 安装扫描并导入受支持的数据，查看去敏报告，同时保持旧来源不变。
-
-Scan and import supported data from a local legacy installation, inspect redacted reports, and leave the legacy source unchanged.
-
-## 完整功能清单 / Everything included
-
-- **Agent 可定位入口，需交互完成 / Agent opens; interaction required** · 只读扫描本机旧版数据来源及所选数据组
-  - Read-only scan the local legacy source and selected data groups
-- **Agent 可定位入口，需交互完成 / Agent opens; interaction required** · 选择设置、扩展、会话、记忆和远程连接迁移范围
-  - Choose settings, extensions, sessions, memory, and remote-connection migration scope
-- **Agent 可定位入口，需交互完成 / Agent opens; interaction required** · 确认关闭影响后启动独立 Data Migrator
-  - Launch the standalone Data Migrator after confirming shutdown impact
-- **Agent 可定位入口，需交互完成 / Agent opens; interaction required** · 查看最近运行结果和各领域去敏状态
-  - Inspect the latest run result and redacted per-domain status
-- **Agent 可定位入口，需交互完成 / Agent opens; interaction required** · 恢复已关闭的首次启动迁移提醒
-  - Restore the first-start migration reminder after it was disabled
-
-## 怎么用 / How to use it
-
-1. 打开设置
-   Open Settings
-2. 进入“数据 > 旧版数据迁移”
-   Go to Data > Legacy data migration
-3. 扫描来源、选择范围并在确认关闭影响后启动迁移器
-   Scan the source, choose scope, and launch the migrator after confirming shutdown impact
-
-入口 / Entry: OpenBitFun 设置
-
-## Agent 可替你做什么 / What an agent can do for you
-
-| 操作 / Action | 中文说明 | English description |
-| --- | --- | --- |
-| 打开对应界面 / Open the UI | 进入 OpenBitFun 中对应的功能界面。 | Open the matching feature in OpenBitFun. |
-
-## 可配置选项 / Configurable options
-
-| 选项 / Option | 可用值 / Values | 中文说明 | English description |
-| --- | --- | --- | --- |
-| 在界面中配置 / Configure in the UI | — | 此页面的设置在对应界面中完成。 | Configure this page in its matching UI. |
-
-## 可以直接对 Agent 说 / Try saying
-
-- “打开旧版数据迁移”
-  - “Open legacy data migration”
-- “带我查看数据迁移报告”
-  - “Show me the data migration report”
-
-Agent 会先查找相关功能或设置，确认目标后再替你打开、执行或修改。完整能力目录不会预先塞进对话上下文。
-
-The agent first finds the relevant feature or setting, confirms the target, and then opens, runs, or changes it for you. The full catalog is never embedded in the conversation context.
diff --git a/docs/interactive-capabilities/technical/product-control-open-audit.json b/docs/interactive-capabilities/technical/product-control-open-audit.json
index 1839909c20..b2f434a198 100644
--- a/docs/interactive-capabilities/technical/product-control-open-audit.json
+++ b/docs/interactive-capabilities/technical/product-control-open-audit.json
@@ -1,13 +1,13 @@
 {
   "schemaVersion": 1,
   "generatedFrom": "src/shared/interactive-capabilities/catalog.json",
-  "catalogDigest": "c77c16c414ce9fe50929fe249d900489fdceedb8e646aaaca03893aa33d4fbc8",
-  "count": 217,
+  "catalogDigest": "d7a7419ddd673eb733ae8bd33dbb3dcd3b4d1ce0acfc953067a3403fe26d6699",
+  "count": 212,
   "reasonCounts": {
     "externalAuth": 4,
     "secretEntry": 5,
-    "unstructuredInteraction": 189,
-    "visualSelection": 19
+    "unstructuredInteraction": 185,
+    "visualSelection": 18
   },
   "entries": [
     {
@@ -3749,91 +3749,6 @@
         "command:delete_all_archived_sessions"
       ]
     },
-    {
-      "capabilityId": "setting.data.migration",
-      "itemId": "scan",
-      "titleZh": "只读扫描本机旧版数据来源及所选数据组",
-      "titleEn": "Read-only scan the local legacy source and selected data groups",
-      "reasonCode": "unstructuredInteraction",
-      "reasonZh": "“只读扫描本机旧版数据来源及所选数据组”：扫描依赖当前设备上的旧版数据、实时范围选择和结果状态；Agent 会打开精确入口，并把选择与扫描保留在用户可见界面。",
-      "reasonEn": "Read-only scan the local legacy source and selected data groups: Scanning depends on legacy data on the current device, live scope selection, and result state; the Agent opens the exact entry and keeps selection and scanning visible to the user.",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      },
-      "evidence": [
-        "command:get_legacy_migration_status",
-        "command:scan_legacy_migration",
-        "source:src/web-ui/src/locales/zh-CN/settings/legacy-migration.json#actions.scan"
-      ]
-    },
-    {
-      "capabilityId": "setting.data.migration",
-      "itemId": "scope",
-      "titleZh": "选择设置、扩展、会话、记忆和远程连接迁移范围",
-      "titleEn": "Choose settings, extensions, sessions, memory, and remote-connection migration scope",
-      "reasonCode": "visualSelection",
-      "reasonZh": "迁移范围是影响本机持久数据的五组可见选择；Agent 会打开精确入口，由用户确认所需范围。",
-      "reasonEn": "Migration scope is a visible five-group selection affecting local persisted data; the Agent opens the exact entry so the user can confirm the intended scope.",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      },
-      "evidence": [
-        "source:src/web-ui/src/locales/zh-CN/settings/legacy-migration.json#sections.scope.title"
-      ]
-    },
-    {
-      "capabilityId": "setting.data.migration",
-      "itemId": "launch",
-      "titleZh": "确认关闭影响后启动独立 Data Migrator",
-      "titleEn": "Launch the standalone Data Migrator after confirming shutdown impact",
-      "reasonCode": "unstructuredInteraction",
-      "reasonZh": "“确认关闭影响后启动独立 Data Migrator”：启动迁移器会停止正在运行的 Agent 和终端任务、关闭 Desktop，并交接到独立本机进程；Agent 只打开入口，确认和启动保留在用户可见界面。",
-      "reasonEn": "Launch the standalone Data Migrator after confirming shutdown impact: Launching the migrator can stop running agents and terminal tasks, close Desktop, and hand off to a separate local process; the Agent only opens the entry while confirmation and launch remain visible to the user.",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      },
-      "evidence": [
-        "command:prepare_legacy_migration",
-        "source:src/web-ui/src/locales/zh-CN/settings/legacy-migration.json#confirm.title"
-      ]
-    },
-    {
-      "capabilityId": "setting.data.migration",
-      "itemId": "report",
-      "titleZh": "查看最近运行结果和各领域去敏状态",
-      "titleEn": "Inspect the latest run result and redacted per-domain status",
-      "reasonCode": "unstructuredInteraction",
-      "reasonZh": "“查看最近运行结果和各领域去敏状态”：报告取决于本机最近一次迁移运行和各领域实时状态；Agent 会打开精确入口，并把报告查看与失败组重试保留在用户可见界面。",
-      "reasonEn": "Inspect the latest run result and redacted per-domain status: Reports depend on the most recent local migration run and live per-domain state; the Agent opens the exact entry and keeps report review and failed-group retry visible to the user.",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      },
-      "evidence": [
-        "command:get_legacy_migration_report",
-        "source:src/web-ui/src/locales/zh-CN/settings/legacy-migration.json#sections.report.title"
-      ]
-    },
-    {
-      "capabilityId": "setting.data.migration",
-      "itemId": "reminder",
-      "titleZh": "恢复已关闭的首次启动迁移提醒",
-      "titleEn": "Restore the first-start migration reminder after it was disabled",
-      "reasonCode": "unstructuredInteraction",
-      "reasonZh": "“恢复已关闭的首次启动迁移提醒”：提醒偏好与当前本机旧数据来源绑定；Agent 会打开精确入口，由用户在可见界面决定是否恢复提醒。",
-      "reasonEn": "Restore the first-start migration reminder after it was disabled: The reminder preference is bound to the current local legacy source; the Agent opens the exact entry so the user can decide visibly whether to restore it.",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      },
-      "evidence": [
-        "command:set_legacy_migration_prompt_preference",
-        "source:src/web-ui/src/locales/zh-CN/settings/legacy-migration.json#actions.restoreReminder"
-      ]
-    },
     {
       "capabilityId": "setting.data.diagnostics",
       "itemId": "log-path",
diff --git a/docs/interactive-capabilities/technical/tauri-command-map.json b/docs/interactive-capabilities/technical/tauri-command-map.json
index c33322462f..04b6121d30 100644
--- a/docs/interactive-capabilities/technical/tauri-command-map.json
+++ b/docs/interactive-capabilities/technical/tauri-command-map.json
@@ -1,11 +1,11 @@
 {
   "schemaVersion": 2,
   "generatedFrom": "src/shared/interactive-capabilities/catalog.json",
-  "catalogDigest": "c77c16c414ce9fe50929fe249d900489fdceedb8e646aaaca03893aa33d4fbc8",
-  "commandCount": 671,
+  "catalogDigest": "d7a7419ddd673eb733ae8bd33dbb3dcd3b4d1ce0acfc953067a3403fe26d6699",
+  "commandCount": 666,
   "coverage": {
-    "commandCount": 671,
-    "documentedCommandCount": 638,
+    "commandCount": 666,
+    "documentedCommandCount": 633,
     "implementationCommandCount": 33,
     "implementationDigest": "35539d9c1510287cb47f4a68fe35859b78f93bb06cd66b86e58d878a48d8c509"
   },
@@ -3230,38 +3230,6 @@
       "signature": "fn get_latest_insights() -> Result<Vec<InsightsReportMeta>, String>",
       "remoteWorkspacePolicy": "LocalOnly"
     },
-    {
-      "id": "get_legacy_migration_report",
-      "moduleId": "legacy_migration",
-      "capabilityId": "setting.data.migration",
-      "capabilityIds": [
-        "setting.data.migration"
-      ],
-      "documentedItemIds": [
-        "setting.data.migration:report"
-      ],
-      "visibility": "documented",
-      "rustPath": "api::legacy_migration_api::get_legacy_migration_report",
-      "sourceFile": "src/apps/desktop/src/api/legacy_migration_api.rs",
-      "signature": "fn get_legacy_migration_report( request: GetLegacyMigrationReportRequest, ) -> Result<Option<MigrationRunReport>, LegacyMigrationCommandError>",
-      "remoteWorkspacePolicy": "LocalOnly"
-    },
-    {
-      "id": "get_legacy_migration_status",
-      "moduleId": "legacy_migration",
-      "capabilityId": "setting.data.migration",
-      "capabilityIds": [
-        "setting.data.migration"
-      ],
-      "documentedItemIds": [
-        "setting.data.migration:scan"
-      ],
-      "visibility": "documented",
-      "rustPath": "api::legacy_migration_api::get_legacy_migration_status",
-      "sourceFile": "src/apps/desktop/src/api/legacy_migration_api.rs",
-      "signature": "fn get_legacy_migration_status( request: EmptyLegacyMigrationRequest, ) -> Result<LegacyMigrationStatusView, LegacyMigrationCommandError>",
-      "remoteWorkspacePolicy": "LocalOnly"
-    },
     {
       "id": "get_mcp_prompt",
       "moduleId": "mcp",
@@ -6646,22 +6614,6 @@
       "signature": "fn predownload_acp_client_adapter( state: State<'_, AppState>, request: AcpClientIdRequest, ) -> Result<(), String>",
       "remoteWorkspacePolicy": "LegacyUnaudited"
     },
-    {
-      "id": "prepare_legacy_migration",
-      "moduleId": "legacy_migration",
-      "capabilityId": "setting.data.migration",
-      "capabilityIds": [
-        "setting.data.migration"
-      ],
-      "documentedItemIds": [
-        "setting.data.migration:launch"
-      ],
-      "visibility": "documented",
-      "rustPath": "api::legacy_migration_api::prepare_legacy_migration",
-      "sourceFile": "src/apps/desktop/src/api/legacy_migration_api.rs",
-      "signature": "fn prepare_legacy_migration( app: AppHandle, request: PrepareLegacyMigrationRequest, ) -> Result<LegacyMigrationHandoffView, LegacyMigrationCommandError>",
-      "remoteWorkspacePolicy": "LocalOnly"
-    },
     {
       "id": "preview_commit_message",
       "moduleId": "git_agent",
@@ -8417,22 +8369,6 @@
       "signature": "fn save_web_search_credential( _state: State<'_, AppState>, request: openbitfun_core::service::web_search::SaveWebSearchCredentialRequest, ) -> Result<openbitfun_core::service::web_search::WebSearchCredentialStatus, String>",
       "remoteWorkspacePolicy": "WorkspaceAgnostic"
     },
-    {
-      "id": "scan_legacy_migration",
-      "moduleId": "legacy_migration",
-      "capabilityId": "setting.data.migration",
-      "capabilityIds": [
-        "setting.data.migration"
-      ],
-      "documentedItemIds": [
-        "setting.data.migration:scan"
-      ],
-      "visibility": "documented",
-      "rustPath": "api::legacy_migration_api::scan_legacy_migration",
-      "sourceFile": "src/apps/desktop/src/api/legacy_migration_api.rs",
-      "signature": "fn scan_legacy_migration( request: ScanLegacyMigrationRequest, ) -> Result<LegacyMigrationScanView, LegacyMigrationCommandError>",
-      "remoteWorkspacePolicy": "LocalOnly"
-    },
     {
       "id": "scan_workspace_info",
       "moduleId": "commands",
@@ -8901,22 +8837,6 @@
       "signature": "fn set_global_skill_disabled( request: SetGlobalSkillDisabledRequest, ) -> Result<GlobalSkillSettingsResponse, String>",
       "remoteWorkspacePolicy": "WorkspaceAgnostic"
     },
-    {
-      "id": "set_legacy_migration_prompt_preference",
-      "moduleId": "legacy_migration",
-      "capabilityId": "setting.data.migration",
-      "capabilityIds": [
-        "setting.data.migration"
-      ],
-      "documentedItemIds": [
-        "setting.data.migration:reminder"
-      ],
-      "visibility": "documented",
-      "rustPath": "api::legacy_migration_api::set_legacy_migration_prompt_preference",
-      "sourceFile": "src/apps/desktop/src/api/legacy_migration_api.rs",
-      "signature": "fn set_legacy_migration_prompt_preference( request: SetLegacyMigrationPromptPreferenceRequest, ) -> Result<MigrationOnboardingState, LegacyMigrationCommandError>",
-      "remoteWorkspacePolicy": "LocalOnly"
-    },
     {
       "id": "set_macos_edit_menu_mode",
       "moduleId": "system",
diff --git a/package.json b/package.json
index 2748bf7658..111c68a395 100644
--- a/package.json
+++ b/package.json
@@ -115,7 +115,10 @@
     "product:check": "node scripts/product-customization/cli.mjs check",
     "product:explain": "node scripts/product-customization/cli.mjs explain",
     "product:test": "node --test --test-concurrency=1 scripts/product-customization/*.test.mjs scripts/cli-product.test.mjs scripts/desktop-tauri-build.test.mjs scripts/data-migrator-tauri-build.test.mjs",
+    "data-migrator:dev": "cargo run -p openbitfun-data-migrator --bin openbitfun-data-migrator",
     "data-migrator:check": "cargo check -p openbitfun-data-migrator",
+    "data-migrator:theme:generate": "node scripts/generate-data-migrator-theme.mjs",
+    "data-migrator:theme:check": "node scripts/generate-data-migrator-theme.mjs --check",
     "data-migrator:build": "node scripts/data-migrator-tauri-build.mjs",
     "desktop:build": "node scripts/desktop-tauri-build.mjs",
     "desktop:build:fast": "node scripts/desktop-tauri-build.mjs --debug --no-bundle",
diff --git a/products/fixtures/acme/locales/en-US.json b/products/fixtures/acme/locales/en-US.json
index fa286b519c..a8d066b01c 100644
--- a/products/fixtures/acme/locales/en-US.json
+++ b/products/fixtures/acme/locales/en-US.json
@@ -1,5 +1,4 @@
 {
   "product.cli.name": "Acme CLI",
-  "product.dataMigrator.name": "Acme Data Migrator",
   "product.desktop.name": "Acme Desktop"
 }
diff --git a/products/fixtures/acme/locales/zh-CN.json b/products/fixtures/acme/locales/zh-CN.json
index ed492ddd53..140f3111ef 100644
--- a/products/fixtures/acme/locales/zh-CN.json
+++ b/products/fixtures/acme/locales/zh-CN.json
@@ -1,5 +1,4 @@
 {
   "product.cli.name": "Acme 命令行",
-  "product.dataMigrator.name": "Acme 数据迁移器",
   "product.desktop.name": "Acme 桌面版"
 }
diff --git a/products/fixtures/acme/locales/zh-TW.json b/products/fixtures/acme/locales/zh-TW.json
index a9e7eb4ac9..770e9abd60 100644
--- a/products/fixtures/acme/locales/zh-TW.json
+++ b/products/fixtures/acme/locales/zh-TW.json
@@ -1,5 +1,4 @@
 {
   "product.cli.name": "Acme 命令列",
-  "product.dataMigrator.name": "Acme 資料遷移器",
   "product.desktop.name": "Acme 桌面版"
 }
diff --git a/products/fixtures/acme/product.jsonc b/products/fixtures/acme/product.jsonc
index 6b2ab8af27..2af9a0dfa4 100644
--- a/products/fixtures/acme/product.jsonc
+++ b/products/fixtures/acme/product.jsonc
@@ -10,11 +10,6 @@
       "binaryName": "acme-desktop",
       "bundleId": "com.acme.desktop"
     },
-    "dataMigrator": {
-      "displayNameKey": "product.dataMigrator.name",
-      "binaryName": "acme-data-migrator",
-      "bundleId": "com.acme.data-migrator"
-    },
     "cli": {
       "displayNameKey": "product.cli.name",
       "binaryName": "acme"
diff --git a/products/openbitfun/locales/en-US.json b/products/openbitfun/locales/en-US.json
index e2ef5aa960..92463c4799 100644
--- a/products/openbitfun/locales/en-US.json
+++ b/products/openbitfun/locales/en-US.json
@@ -1,5 +1,4 @@
 {
   "product.cli.name": "OpenBitFun CLI",
-  "product.dataMigrator.name": "OpenBitFun Data Migrator",
   "product.desktop.name": "OpenBitFun"
 }
diff --git a/products/openbitfun/locales/zh-CN.json b/products/openbitfun/locales/zh-CN.json
index 223b6b308e..92463c4799 100644
--- a/products/openbitfun/locales/zh-CN.json
+++ b/products/openbitfun/locales/zh-CN.json
@@ -1,5 +1,4 @@
 {
   "product.cli.name": "OpenBitFun CLI",
-  "product.dataMigrator.name": "OpenBitFun 数据迁移器",
   "product.desktop.name": "OpenBitFun"
 }
diff --git a/products/openbitfun/locales/zh-TW.json b/products/openbitfun/locales/zh-TW.json
index 61b90a2bfb..92463c4799 100644
--- a/products/openbitfun/locales/zh-TW.json
+++ b/products/openbitfun/locales/zh-TW.json
@@ -1,5 +1,4 @@
 {
   "product.cli.name": "OpenBitFun CLI",
-  "product.dataMigrator.name": "OpenBitFun 資料遷移器",
   "product.desktop.name": "OpenBitFun"
 }
diff --git a/products/openbitfun/product.jsonc b/products/openbitfun/product.jsonc
index 29c10f9d8a..b6f199e067 100644
--- a/products/openbitfun/product.jsonc
+++ b/products/openbitfun/product.jsonc
@@ -10,11 +10,6 @@
       "binaryName": "openbitfun-desktop",
       "bundleId": "com.openbitfun.desktop"
     },
-    "dataMigrator": {
-      "displayNameKey": "product.dataMigrator.name",
-      "binaryName": "openbitfun-data-migrator",
-      "bundleId": "com.openbitfun.data-migrator"
-    },
     "cli": {
       "displayNameKey": "product.cli.name",
       "binaryName": "openbitfun"
diff --git a/products/schemas/product-definition.schema.json b/products/schemas/product-definition.schema.json
index 8ec650671e..a5e530f87e 100644
--- a/products/schemas/product-definition.schema.json
+++ b/products/schemas/product-definition.schema.json
@@ -14,10 +14,9 @@
     "members": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["desktop", "dataMigrator", "cli"],
+      "required": ["desktop", "cli"],
       "properties": {
         "desktop": { "$ref": "#/$defs/desktopMember" },
-        "dataMigrator": { "$ref": "#/$defs/desktopMember" },
         "cli": { "$ref": "#/$defs/commonMember" }
       }
     }
diff --git a/scripts/check-core-boundaries.test.mjs b/scripts/check-core-boundaries.test.mjs
index bdb2450a10..7057a221e8 100644
--- a/scripts/check-core-boundaries.test.mjs
+++ b/scripts/check-core-boundaries.test.mjs
@@ -198,7 +198,8 @@ test('Agent Runtime leaf capabilities have one managed feature and source contra
     'native-hook-runtime',
     'native-hook-settings',
   ]);
-  assert.equal(rule.consumers.size, 10);
+  assert.equal(rule.consumers.size, 11);
+  assert.ok(rule.consumers.has('openbitfun-legacy-migration-adapters'));
   assert.ok(
     guardedEmptyInternalDefaultManifestPaths.includes(
       'src/crates/execution/agent-runtime/Cargo.toml',
@@ -4156,7 +4157,7 @@ test('Core Tokio capabilities cannot hide behind an unreviewed owner feature', (
     ],
     features: {
       'agent-runtime': ['tokio/io-util', 'tokio/macros', 'tokio/rt', 'tokio/time'],
-      'legacy-migration': ['tokio/rt'],
+      'legacy-migration': [],
       'mcp-runtime': ['agent-runtime', 'tokio/rt-multi-thread'],
       'browser-control': ['tokio/net', 'tokio/rt', 'tokio/time'],
       sneaky: ['agent-runtime', 'browser-control'],
@@ -4178,7 +4179,7 @@ test('reviewed Tokio aggregates cannot declare runtime capabilities directly', (
     dependencies: [{ name: 'tokio', kind: null, optional: false, features: ['fs', 'sync'] }],
     features: {
       'agent-runtime': ['tokio/io-util', 'tokio/macros', 'tokio/rt', 'tokio/time'],
-      'legacy-migration': ['tokio/rt'],
+      'legacy-migration': [],
       'mcp-runtime': ['agent-runtime', 'tokio/rt-multi-thread'],
       'browser-control': ['tokio/net', 'tokio/rt', 'tokio/time'],
       'product-full': ['agent-runtime', 'tokio/net'],
diff --git a/scripts/core-boundaries/cargo-dependency-boundaries.mjs b/scripts/core-boundaries/cargo-dependency-boundaries.mjs
index 57e9fdebb0..dd3ca537d7 100644
--- a/scripts/core-boundaries/cargo-dependency-boundaries.mjs
+++ b/scripts/core-boundaries/cargo-dependency-boundaries.mjs
@@ -174,7 +174,7 @@ const SERVICES_INTEGRATIONS_TOKIO_AGGREGATES = new Set(['product-full']);
 const SERVICES_CORE_TOKIO_AGGREGATES = new Set(['session-git', 'token-usage-statistics']);
 const CORE_TOKIO_FEATURES = new Map([
   ['agent-runtime', ['io-util', 'macros', 'rt', 'time']],
-  ['legacy-migration', ['rt']],
+  ['legacy-migration', []],
   ['mcp-runtime', ['io-util', 'macros', 'rt', 'rt-multi-thread', 'time']],
   ['browser-control', ['net', 'rt', 'time']],
 ]);
diff --git a/scripts/core-boundaries/rules/crate-layout.mjs b/scripts/core-boundaries/rules/crate-layout.mjs
index 1f550325e3..5642062585 100644
--- a/scripts/core-boundaries/rules/crate-layout.mjs
+++ b/scripts/core-boundaries/rules/crate-layout.mjs
@@ -2,6 +2,7 @@
 // owns where workspace crates live under src/crates.
 
 export const crateLayoutRules = [
+  { crateName: 'config-contracts', layer: 'contracts', path: 'src/crates/contracts/config-contracts' },
   { crateName: 'core-types', layer: 'contracts', path: 'src/crates/contracts/core-types' },
   { crateName: 'events', layer: 'contracts', path: 'src/crates/contracts/events' },
   { crateName: 'product-domains', layer: 'contracts', path: 'src/crates/contracts/product-domains' },
@@ -23,6 +24,7 @@ export const crateLayoutRules = [
 
   { crateName: 'services-core', layer: 'services', path: 'src/crates/services/services-core' },
   { crateName: 'services-integrations', layer: 'services', path: 'src/crates/services/services-integrations' },
+  { crateName: 'legacy-migration-adapters', layer: 'services', path: 'src/crates/services/legacy-migration-adapters' },
   { crateName: 'legacy-migration', layer: 'services', path: 'src/crates/services/legacy-migration' },
   { crateName: 'miniapp-market-service', layer: 'services', path: 'src/crates/services/miniapp-market-service' },
   { crateName: 'skin-market-service', layer: 'services', path: 'src/crates/services/skin-market-service' },
diff --git a/scripts/core-boundaries/rules/feature-rules.mjs b/scripts/core-boundaries/rules/feature-rules.mjs
index c576e7ead8..0b2c575fff 100644
--- a/scripts/core-boundaries/rules/feature-rules.mjs
+++ b/scripts/core-boundaries/rules/feature-rules.mjs
@@ -38,6 +38,7 @@ export const optionalDependencyFeatureOwnerRules = [
   },
   {
     crateName: 'services-core',
+    reviewedAggregateFeatures: ['workspace-persistence'],
     reason:
       'services-core optional implementation dependencies must stay behind their exact owner capability',
     dependencies: [
@@ -47,11 +48,11 @@ export const optionalDependencyFeatureOwnerRules = [
       { depName: 'base64', ownerFeatures: ['credential-vault', 'filesystem'] },
       {
         depName: 'openbitfun-core-types',
-        ownerFeatures: ['filesystem', 'local-storage', 'product-identity'],
+        ownerFeatures: ['filesystem', 'local-storage', 'product-identity', 'workspace-persistence'],
       },
-      { depName: 'openbitfun-events', ownerFeatures: ['local-storage'] },
-      { depName: 'openbitfun-runtime-ports', ownerFeatures: ['permission', 'workspace-runtime'] },
-      { depName: 'chrono', ownerFeatures: ['filesystem', 'local-storage'] },
+      { depName: 'openbitfun-events', ownerFeatures: ['local-storage', 'session-event-format'] },
+      { depName: 'openbitfun-runtime-ports', ownerFeatures: ['permission', 'workspace-runtime', 'workspace-persistence'] },
+      { depName: 'chrono', ownerFeatures: ['filesystem', 'local-storage', 'workspace-persistence'] },
       { depName: 'chrono-tz', ownerFeatures: ['token-usage-statistics'] },
       { depName: 'dunce', ownerFeatures: ['runtime-ownership', 'workspace-identity', 'workspace-runtime'] },
       { depName: 'fs2', ownerFeatures: ['credential-vault', 'json-io', 'local-storage', 'runtime-ownership'] },
@@ -70,7 +71,7 @@ export const optionalDependencyFeatureOwnerRules = [
           'workspace-instructions',
         ],
       },
-      { depName: 'rusqlite', ownerFeatures: ['memory-store', 'permission', 'session-search'] },
+      { depName: 'rusqlite', ownerFeatures: ['memory-store', 'permission', 'session-search', 'coordination-store'] },
       { depName: 'rustls', ownerFeatures: ['tls-provider'] },
       { depName: 'serde_yaml', ownerFeatures: ['markdown', 'workspace-instructions'] },
       { depName: 'similar', ownerFeatures: ['diff', 'local-storage'] },
@@ -157,14 +158,14 @@ export const optionalDependencyFeatureOwnerRules = [
         depName: 'openbitfun-ai-adapters',
         ownerFeatures: ['ai-adapter-runtime', 'subscription-auth'],
       },
-      { depName: 'openbitfun-agent-runtime', ownerFeatures: ['agent-runtime', 'legacy-migration'] },
+      { depName: 'openbitfun-agent-runtime', ownerFeatures: ['agent-runtime'] },
       { depName: 'openbitfun-agent-workflows', ownerFeatures: ['deep-research'] },
       { depName: 'openbitfun-agent-stream', ownerFeatures: ['agent-runtime'] },
       { depName: 'openbitfun-agent-tools', ownerFeatures: ['agent-runtime', 'local-storage', 'mcp-runtime'] },
       { depName: 'openbitfun-claude-code-adapter', ownerFeatures: ['external-sources'] },
       { depName: 'openbitfun-codex-adapter', ownerFeatures: ['external-sources'] },
       { depName: 'openbitfun-external-sources', ownerFeatures: ['external-sources'] },
-      { depName: 'openbitfun-legacy-migration', ownerFeatures: ['legacy-migration'] },
+      { depName: 'openbitfun-legacy-migration-adapters', ownerFeatures: ['legacy-migration'] },
       { depName: 'openbitfun-opencode-adapter', ownerFeatures: ['external-sources'] },
       { depName: 'openbitfun-dsh-adapter', ownerFeatures: ['external-sources'] },
       { depName: 'openbitfun-plugin-runtime-client', ownerFeatures: ['plugin-runtime'] },
@@ -175,7 +176,6 @@ export const optionalDependencyFeatureOwnerRules = [
           'agent-runtime',
           'canvas-runtime',
           'function-agents',
-          'legacy-migration',
           'plugin-source',
           'product-search',
           'tools-miniapp',
@@ -193,7 +193,6 @@ export const optionalDependencyFeatureOwnerRules = [
           'external-sources',
           'file-watch',
           'function-agents',
-          'legacy-migration',
           'git',
           'mcp-runtime',
           'model-catalog',
@@ -239,7 +238,7 @@ export const optionalDependencyFeatureOwnerRules = [
       { depName: 'md5', ownerFeatures: ['agent-runtime'] },
       { depName: 'reqwest', ownerFeatures: ['mcp-runtime', 'tools-miniapp'] },
       { depName: 'regex', ownerFeatures: ['agent-runtime'] },
-      { depName: 'rusqlite', ownerFeatures: ['agent-runtime', 'legacy-migration'] },
+      { depName: 'rusqlite', ownerFeatures: ['agent-runtime'] },
       { depName: 'semver', ownerFeatures: ['tools-miniapp'] },
       { depName: 'serde_yaml', ownerFeatures: ['workspace-runtime'] },
       { depName: 'similar', ownerFeatures: ['agent-runtime'] },
@@ -498,7 +497,7 @@ export const capabilityContractDependencyRules = [
           capabilityForwarder('workspace-runtime', 'runtime-event-port'),
           capabilityForwarder('workspace-runtime', 'workspace-ports'),
         ],
-        ['permission', 'workspace-runtime'],
+        ['permission', 'workspace-runtime', 'workspace-persistence'],
       )],
       ['openbitfun-services-integrations', capabilityConsumer(
         [capabilityEdge([], { optional: true })],
@@ -639,6 +638,7 @@ export const capabilityContractDependencyRules = [
       ],
     },
     consumers: new Map([
+      ['openbitfun-legacy-migration-adapters', capabilityConsumer([capabilityEdge(['definition-contracts'])])],
       ['openbitfun-acp', capabilityConsumer(
         [capabilityEdge([], { optional: true })],
         [capabilityForwarder('server', 'agent-runtime')],
@@ -655,9 +655,8 @@ export const capabilityContractDependencyRules = [
         [capabilityEdge([], { optional: true })],
         [
           capabilityForwarder('agent-runtime', 'agent-runtime'),
-          capabilityForwarder('legacy-migration', 'definition-contracts'),
         ],
-        ['agent-runtime', 'legacy-migration'],
+        ['agent-runtime'],
         ['external-sources', 'mcp-runtime', 'opencode-plugin-host', 'plugin-runtime', 'product-search', 'product-full', 'remote-connect', 'tools-mcp'],
       )],
       ['openbitfun-desktop', capabilityConsumer([
@@ -883,6 +882,8 @@ export const coreClosedFeatureProfileRules = [
       // Complete ExecCommand constraint syntax facts live in the tool owner.
       'tool-runtime/shell-analysis',
       'openbitfun-services-core/memory-store',
+      'openbitfun-services-core/coordination-store',
+      'openbitfun-services-core/session-event-format',
       'openbitfun-services-core/permission',
       'openbitfun-services-core/runtime-ownership',
       'openbitfun-services-core/session-git',
@@ -1633,6 +1634,7 @@ export const coreClosedFeatureProfileRules = [
       'openbitfun-services-core/workspace-identity',
       'openbitfun-services-core/workspace-instructions',
       'openbitfun-services-core/workspace-runtime',
+      'openbitfun-services-core/workspace-persistence',
     ],
     exact: true,
     reason: 'openbitfun-core workspace-runtime must select only local workspace and runtime layout owners',
diff --git a/scripts/core-boundaries/self-test.mjs b/scripts/core-boundaries/self-test.mjs
index 0667091eae..a6d5c193f5 100644
--- a/scripts/core-boundaries/self-test.mjs
+++ b/scripts/core-boundaries/self-test.mjs
@@ -544,6 +544,7 @@ export function runManifestParserSelfTest({
         'openbitfun-services-core/workspace-identity',
         'openbitfun-services-core/workspace-instructions',
         'openbitfun-services-core/workspace-runtime',
+        'openbitfun-services-core/workspace-persistence',
       ],
     ],
     [coreManifest, 'workspace-watch', ['workspace-runtime', 'dep:notify']],
diff --git a/scripts/data-migrator-release.mjs b/scripts/data-migrator-release.mjs
new file mode 100644
index 0000000000..ae45a91e1e
--- /dev/null
+++ b/scripts/data-migrator-release.mjs
@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import { copyFileSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+const ROOT = resolve(import.meta.dirname, '..');
+export const PLATFORMS = {
+  'windows-x64': { target: 'x86_64-pc-windows-msvc', extension: 'zip' },
+  'macos-arm64': { target: 'aarch64-apple-darwin', extension: 'dmg', folder: 'dmg' },
+  'macos-x64': { target: 'x86_64-apple-darwin', extension: 'dmg', folder: 'dmg' },
+  'linux-x64': { target: 'x86_64-unknown-linux-gnu', extension: 'AppImage', folder: 'appimage' },
+};
+export function releaseVersion(root = ROOT) {
+  const manifest = readFileSync(join(root, 'src/apps/data-migrator/Cargo.toml'), 'utf8');
+  const version = manifest.match(/^version = "([^"]+)"/m)?.[1];
+  if (!version || !/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?$/.test(version)) throw new Error('Invalid independent migrator version');
+  const config = JSON.parse(readFileSync(join(root, 'src/apps/data-migrator/tauri.conf.json'), 'utf8'));
+  if (config.version !== version) throw new Error('Migrator version differs between Cargo and Tauri');
+  return version;
+}
+
+export function validateReleaseTag(tag, version) {
+  if (tag !== `data-migrator-v${version}`) throw new Error('Tag must match the independent migrator version');
+}
+
+function stage(platform) {
+  const metadata = PLATFORMS[platform];
+  if (!metadata) throw new Error('Unsupported migrator release platform');
+  const version = releaseVersion();
+  if (process.env.GITHUB_REF_TYPE === 'tag') validateReleaseTag(process.env.GITHUB_REF_NAME, version);
+  const target = resolve(ROOT, process.env.CARGO_TARGET_DIR || 'target', metadata.target, 'release');
+  const output = join(ROOT, 'target/data-migrator-release', platform);
+  mkdirSync(output, { recursive: true });
+  const asset = `openbitfun-data-migrator-v${version}-${platform}.${metadata.extension}`;
+  const destination = join(output, asset);
+  if (platform === 'windows-x64') {
+    const portable = join(ROOT, 'target/data-migrator-portable', version);
+    mkdirSync(portable, { recursive: true });
+    copyFileSync(join(target, 'openbitfun-data-migrator.exe'), join(portable, 'openbitfun-data-migrator.exe'));
+    for (const file of ['README.md', 'README.zh-CN.md']) copyFileSync(join(ROOT, 'src/apps/data-migrator', file), join(portable, file));
+    copyFileSync(join(ROOT, 'THIRD_PARTY_NOTICES.md'), join(portable, 'THIRD_PARTY_NOTICES.md'));
+    const result = spawnSync('tar', ['-a', '-cf', destination, '-C', portable, 'openbitfun-data-migrator.exe', 'README.md', 'README.zh-CN.md', 'THIRD_PARTY_NOTICES.md'], { stdio: 'inherit', windowsHide: true });
+    if (result.error) throw result.error;
+    if (result.status !== 0) throw new Error('Could not archive the portable migrator');
+  } else {
+    const folder = join(target, 'bundle', metadata.folder);
+    const files = readdirSync(folder).filter((name) => name.startsWith(`OpenBitFun Data Migrator_${version}_`) && name.endsWith(`.${metadata.extension}`));
+    if (files.length !== 1) throw new Error('Expected exactly one migrator package in the bundle output');
+    copyFileSync(join(folder, files[0]), destination);
+  }
+  const sha256 = createHash('sha256').update(readFileSync(destination)).digest('hex');
+  writeFileSync(`${destination}.sha256`, `${sha256}  ${asset}\n`);
+  console.log(destination);
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  if (process.argv[2] === '--check-version') {
+    const version = releaseVersion();
+    if (process.env.GITHUB_REF_TYPE === 'tag') validateReleaseTag(process.env.GITHUB_REF_NAME, version);
+    console.log(version);
+  } else stage(process.argv[2]);
+}
diff --git a/scripts/data-migrator-tauri-build.mjs b/scripts/data-migrator-tauri-build.mjs
index e52219ac7f..9c2a7a4cff 100644
--- a/scripts/data-migrator-tauri-build.mjs
+++ b/scripts/data-migrator-tauri-build.mjs
@@ -5,27 +5,19 @@ import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-import { extractProductConfigArg } from './product-customization/cli.mjs';
-import { productBuildEnvironment } from './product-customization/projections.mjs';
-import { resolveProductDefinition } from './product-customization/resolver.mjs';
+import { generateDataMigratorTheme } from './generate-data-migrator-theme.mjs';
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 const APP_DIR = join(ROOT, 'src', 'apps', 'data-migrator');
 
 export function prepareDataMigratorTauriConfig(
   baseConfigPath,
-  resolution,
   outputDirectory = join(APP_DIR, 'gen'),
 ) {
-  if (resolution.assembly.member !== 'dataMigrator') {
-    throw new Error('Data Migrator packaging requires the dataMigrator product member.');
-  }
   const config = JSON.parse(readFileSync(baseConfigPath, 'utf8'));
-  const productName = resolution.productNames[resolution.assembly.fallbackLocale]
-    ?? resolution.productNames[resolution.assembly.defaultLocale];
-  config.productName = productName;
-  config.mainBinaryName = resolution.assembly.binaryName;
-  config.identifier = resolution.assembly.bundleId;
+  const manifest = readFileSync(join(APP_DIR, 'Cargo.toml'), 'utf8');
+  const version = manifest.match(/^version = "([^"]+)"/m)?.[1];
+  if (!version || config.version !== version) throw new Error('Migrator Cargo and Tauri versions must match.');
   config.build = {
     frontendDist: config.build?.frontendDist || 'ui',
   };
@@ -38,12 +30,28 @@ export function prepareDataMigratorTauriConfig(
   mkdirSync(outputDirectory, { recursive: true });
   const output = join(
     outputDirectory,
-    `tauri.${resolution.assembly.assemblyDigest}.generated.conf.json`,
+    'tauri.generated.conf.json',
   );
   writeFileSync(output, `${JSON.stringify(config, null, 2)}\n`, 'utf8');
   return output;
 }
 
+// The tool identity and the format destination are separate. Never inherit a
+// branded Desktop build's data namespace or sibling-executable projections.
+export function dataMigratorEnvironment(environment = process.env) {
+  const result = { ...environment };
+  for (const key of ['OPENBITFUN_DESKTOP_BINARY_NAME', 'OPENBITFUN_DATA_MIGRATOR_BINARY_NAME']) delete result[key];
+  return {
+    ...result,
+    CI: 'true',
+    OPENBITFUN_PRODUCT_ID: 'openbitfun',
+    OPENBITFUN_DATA_NAMESPACE: 'openbitfun',
+    OPENBITFUN_HIDDEN_DATA_DIRECTORY: '.openbitfun',
+    OPENBITFUN_PRODUCT_BINARY_NAME: 'openbitfun-data-migrator',
+    OPENBITFUN_PRODUCT_DISPLAY_NAME: 'OpenBitFun Data Migrator',
+  };
+}
+
 function tauriArguments(raw) {
   let offset = 0;
   while (raw[offset] === '--') offset += 1;
@@ -51,26 +59,19 @@ function tauriArguments(raw) {
 }
 
 async function main() {
-  const { productConfig, forwardArgs } = extractProductConfigArg(
-    tauriArguments(process.argv.slice(2)),
-  );
-  const resolution = resolveProductDefinition({
-    rootDir: ROOT,
-    productConfig,
-    member: 'dataMigrator',
-  });
-  Object.assign(process.env, productBuildEnvironment(resolution));
-  process.env.CI = 'true';
+  await generateDataMigratorTheme();
+  const forwardArgs = tauriArguments(process.argv.slice(2));
+  if (forwardArgs.some((arg) => arg.startsWith('--product-config'))) {
+    throw new Error('The standalone migrator has its own identity and supports OpenBitFun data only.');
+  }
   const generated = prepareDataMigratorTauriConfig(
     join(APP_DIR, 'tauri.conf.json'),
-    resolution,
   );
-  console.log(`[product] dataMigrator ${resolution.assembly.assemblyDigest}`);
 
   const tauriBin = join(ROOT, 'node_modules', '.bin', 'tauri');
   const result = spawnSync(tauriBin, ['build', '--config', generated, ...forwardArgs], {
     cwd: APP_DIR,
-    env: process.env,
+    env: dataMigratorEnvironment(),
     stdio: 'inherit',
     shell: true,
     windowsHide: true,
diff --git a/scripts/data-migrator-tauri-build.test.mjs b/scripts/data-migrator-tauri-build.test.mjs
index 8d2cad1615..b045752d87 100644
--- a/scripts/data-migrator-tauri-build.test.mjs
+++ b/scripts/data-migrator-tauri-build.test.mjs
@@ -1,92 +1,67 @@
 import assert from 'node:assert/strict';
-import { mkdtempSync, readFileSync } from 'node:fs';
+import { mkdtempSync, readFileSync, existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import test from 'node:test';
-
-import { prepareDataMigratorTauriConfig } from './data-migrator-tauri-build.mjs';
-import { productBuildEnvironment } from './product-customization/projections.mjs';
-import { resolveProductDefinition } from './product-customization/resolver.mjs';
-
+import { prepareDataMigratorTauriConfig, dataMigratorEnvironment } from './data-migrator-tauri-build.mjs';
+import { releaseVersion, validateReleaseTag } from './data-migrator-release.mjs';
+import { prepareTauriConfig } from './desktop-tauri-build.mjs';
 const ROOT = resolve(import.meta.dirname, '..');
-const APP = join(ROOT, 'src', 'apps', 'data-migrator');
-const ACME = join(ROOT, 'products', 'fixtures', 'acme', 'product.jsonc');
+const APP = join(ROOT, 'src/apps/data-migrator');
 
-test('Data Migrator has an independent product and non-updating bundle identity', () => {
-  const resolution = resolveProductDefinition({
-    rootDir: ROOT,
-    productConfig: ACME,
-    member: 'dataMigrator',
-  });
-  const output = prepareDataMigratorTauriConfig(
-    join(APP, 'tauri.conf.json'),
-    resolution,
-    mkdtempSync(join(tmpdir(), 'openbitfun-data-migrator-config-')),
-  );
+test('independent bundle owns version, offline assets, icons and identity', () => {
+  const output = prepareDataMigratorTauriConfig(join(APP, 'tauri.conf.json'), mkdtempSync(join(tmpdir(), 'migrator-config-')));
   const config = JSON.parse(readFileSync(output, 'utf8'));
-
-  assert.equal(config.productName, 'Acme Data Migrator');
-  assert.equal(config.mainBinaryName, 'acme-data-migrator');
-  assert.equal(config.identifier, 'com.acme.data-migrator');
-  assert.notEqual(config.identifier, 'com.acme.desktop');
+  assert.equal(config.productName, 'OpenBitFun Data Migrator');
+  assert.equal(config.identifier, 'com.openbitfun.data-migrator');
+  assert.equal(config.version, releaseVersion());
   assert.deepEqual(config.build, { frontendDist: 'ui' });
   assert.equal(config.plugins?.updater, undefined);
-  assert.equal(config.bundle.createUpdaterArtifacts, undefined);
-  assert.deepEqual(Object.values(config.bundle.resources), ['THIRD_PARTY_NOTICES.md']);
-  assert.deepEqual(config.app.windows.map(({ label }) => label), ['migrator']);
+  assert.equal(config.bundle.externalBin, undefined);
+  assert.ok(config.bundle.icon.every((icon) => !icon.includes('desktop') && existsSync(join(APP, icon))));
+  assert.ok(config.app.security.csp.includes("connect-src 'self'"));
 });
 
-test('Data Migrator projection provides both trusted sibling binary names', () => {
-  const resolution = resolveProductDefinition({
-    rootDir: ROOT,
-    productConfig: ACME,
-    member: 'dataMigrator',
-  });
-  const environment = productBuildEnvironment(resolution);
-
-  assert.equal(environment.OPENBITFUN_PRODUCT_BINARY_NAME, 'acme-data-migrator');
-  assert.equal(environment.OPENBITFUN_DATA_MIGRATOR_BINARY_NAME, 'acme-data-migrator');
-  assert.equal(environment.OPENBITFUN_DESKTOP_BINARY_NAME, 'acme-desktop');
+test('a Desktop product environment cannot change the migration destination identity', () => {
+  const env = dataMigratorEnvironment({ OPENBITFUN_PRODUCT_ID: 'acme', OPENBITFUN_DATA_NAMESPACE: 'acme', OPENBITFUN_DESKTOP_BINARY_NAME: 'acme', CI: '1' });
+  assert.equal(env.OPENBITFUN_PRODUCT_ID, 'openbitfun');
+  assert.equal(env.OPENBITFUN_DATA_NAMESPACE, 'openbitfun');
+  assert.equal(env.OPENBITFUN_DESKTOP_BINARY_NAME, undefined);
+  assert.equal(env.CI, 'true');
 });
 
-test('Data Migrator dependency and command closure stays migration-only', () => {
-  const manifest = readFileSync(join(APP, 'Cargo.toml'), 'utf8');
-  const source = readFileSync(join(APP, 'src', 'app_state.rs'), 'utf8');
-  const registration = readFileSync(join(APP, 'src', 'lib.rs'), 'utf8');
-  const capability = readFileSync(join(APP, 'capabilities', 'migrator.json'), 'utf8');
-
-  assert.match(manifest, /openbitfun-core[^\n]+features = \["legacy-migration"\]/);
-  for (const forbidden of ['product-full', 'openbitfun-agent-runtime', 'plugin-runtime']) {
-    assert.equal(manifest.includes(forbidden), false, `manifest must not include ${forbidden}`);
-  }
-  assert.match(source, /product_assembly_plan_for_profile\(DeliveryProfile::DataMigrator\)/);
-  assert.match(registration, /tauri::generate_handler!/);
-  assert.match(registration, /commands::export_migration_diagnostics/);
-  assert.match(
-    readFileSync(join(ROOT, 'scripts', 'data-migrator-tauri-build.mjs'), 'utf8'),
-    /windowsHide:\s*true/,
-  );
-  for (const forbidden of ['fs:', 'shell:', 'updater:', 'dialog:']) {
-    assert.equal(capability.includes(forbidden), false, `capability must not include ${forbidden}`);
+test('Desktop package generation has no migrator payload or build hook', () => {
+  const desktop = join(ROOT, 'src/apps/desktop');
+  const output = prepareTauriConfig(join(desktop, 'tauri.conf.json'), { desktopDir: desktop });
+  const config = JSON.parse(readFileSync(output, 'utf8'));
+  assert.ok(!(config.bundle.externalBin || []).some((file) => file.includes('migrator')));
+  for (const file of ['scripts/dev.cjs', 'scripts/desktop-tauri-build.mjs', 'src/apps/desktop/src/lib.rs']) {
+    assert.doesNotMatch(readFileSync(join(ROOT, file), 'utf8'), /data-migrator|legacy_migration_api/);
   }
 });
 
-test('Data Migrator gates onboarding actions on authenticated bootstrap', () => {
-  const html = readFileSync(join(APP, 'ui', 'index.html'), 'utf8');
-  const source = readFileSync(join(APP, 'ui', 'app.js'), 'utf8');
-
-  assert.match(html, /<section id="choice-card"[^>]+hidden>/);
-  assert.match(source, /function requireBootstrap\(\)/);
-  assert.match(source, /if \(!requireBootstrap\(\)\) return;/);
-  assert.match(source, /catch \(error\) \{\s+notice\(/);
+test('migrator dependency and command closure exclude the main app and restart handshake', () => {
+  const manifest = readFileSync(join(APP, 'Cargo.toml'), 'utf8');
+  assert.doesNotMatch(manifest, /^openbitfun-core\s*=|product-full|product-capabilities|plugin-runtime/m);
+  const source = readFileSync(join(APP, 'src/app_state.rs'), 'utf8');
+  assert.doesNotMatch(source, /HandoffStore|MigrationOnboardingStore|restart_desktop|TrustedInstallationResolver/);
+  const capability = readFileSync(join(APP, 'capabilities/migrator.json'), 'utf8');
+  assert.doesNotMatch(capability, /fs:|shell:|updater:|dialog:/);
 });
 
-test('Data Migrator labels unverified report counts as staged', () => {
-  const source = readFileSync(join(APP, 'ui', 'app.js'), 'utf8');
+test('independent release tags cannot be confused with main app versions', () => {
+  const version = releaseVersion();
+  assert.doesNotThrow(() => validateReleaseTag('data-migrator-v' + version, version));
+  assert.throws(() => validateReleaseTag('v' + version, version));
+  assert.throws(() => validateReleaseTag('data-migrator-v9.0.0', version));
+});
 
-  assert.match(
-    source,
-    /result\.state === 'verified' \? text\.imported : text\.staged/,
-  );
-  assert.match(source, /\$\{result\.imported\} \$\{transferLabel\(result\)\}/);
+test('all static UI labels and locale keys have complete translations', () => {
+  const html = readFileSync(join(APP, 'ui/index.html'), 'utf8');
+  const locales = JSON.parse(readFileSync(join(APP, 'ui/locales.json'), 'utf8'));
+  const keys = Object.keys(locales.en).sort();
+  for (const labels of Object.values(locales)) {
+    assert.deepEqual(Object.keys(labels).sort(), keys);
+    for (const match of html.matchAll(/data-i18n="([^"]+)"/g)) assert.ok(labels[match[1]], match[1]);
+  }
 });
diff --git a/scripts/desktop-dev-migration.mjs b/scripts/desktop-dev-migration.mjs
deleted file mode 100644
index 99aa2455ae..0000000000
--- a/scripts/desktop-dev-migration.mjs
+++ /dev/null
@@ -1,65 +0,0 @@
-import { mkdtemp, readFile, rm } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { setTimeout as delay } from 'node:timers/promises';
-
-const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-
-async function readOptionalJson(file) {
-  try {
-    return JSON.parse(await readFile(file, 'utf8'));
-  } catch (error) {
-    if (error.code === 'ENOENT') return null;
-    throw error;
-  }
-}
-
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    if (error.code === 'ESRCH') return false;
-    throw error;
-  }
-}
-
-// Tauri stops its frontend server when Desktop hands off to Data Migrator.
-// Keep the development supervisor alive and re-enter Tauri after the migrator
-// requests a restart, restoring both Vite and the Rust watcher.
-export async function runDesktopWithMigrationRestart(run, {
-  info = () => {},
-  isAlive = isProcessAlive,
-  wait = () => delay(250),
-} = {}) {
-  let restartArgs = [];
-  for (;;) {
-    const directory = await mkdtemp(path.join(os.tmpdir(), 'openbitfun-dev-migration-'));
-    try {
-      let failure;
-      try {
-        await run(restartArgs, { OPENBITFUN_DEV_MIGRATION_DIR: directory });
-      } catch (error) {
-        failure = error;
-      }
-      const handoff = await readOptionalJson(path.join(directory, 'handoff.json'));
-      if (!handoff) {
-        if (failure) throw failure;
-        return;
-      }
-      if (!UUID.test(handoff.runId) || !Number.isSafeInteger(handoff.pid) || handoff.pid <= 0) {
-        throw new Error('Invalid development migration handoff');
-      }
-      info('Waiting for Data Migrator; Desktop will reopen automatically when it finishes');
-      while (isAlive(handoff.pid)) await wait();
-      const restart = await readOptionalJson(path.join(directory, 'restart.json'));
-      if (restart?.runId !== handoff.runId) {
-        throw new Error('Data Migrator exited without completing its restart handoff; run desktop:dev to retry');
-      }
-      restartArgs = ['--legacy-migration-run-id', handoff.runId];
-      info('Restarting Desktop through the development launcher');
-    } finally {
-      await rm(directory, { recursive: true, force: true });
-    }
-  }
-}
diff --git a/scripts/desktop-dev-migration.test.mjs b/scripts/desktop-dev-migration.test.mjs
deleted file mode 100644
index 6f064f228c..0000000000
--- a/scripts/desktop-dev-migration.test.mjs
+++ /dev/null
@@ -1,60 +0,0 @@
-import assert from 'node:assert/strict';
-import { access, writeFile } from 'node:fs/promises';
-import path from 'node:path';
-import test from 'node:test';
-import { runDesktopWithMigrationRestart } from './desktop-dev-migration.mjs';
-
-const runId = '01234567-89ab-4cde-8fab-0123456789ab';
-const write = (directory, file, value) => writeFile(path.join(directory, file), JSON.stringify(value));
-
-test('normal exit does not restart and removes its temporary channel', async () => {
-  let directory;
-  let calls = 0;
-  await runDesktopWithMigrationRestart(async (args, env) => {
-    calls++;
-    assert.deepEqual(args, []);
-    directory = env.OPENBITFUN_DEV_MIGRATION_DIR;
-  });
-  assert.equal(calls, 1);
-  await assert.rejects(access(directory), { code: 'ENOENT' });
-});
-
-test('build failures remain failures when no migration was launched', async () => {
-  const failure = new Error('build failed');
-  await assert.rejects(runDesktopWithMigrationRestart(async () => { throw failure; }), failure);
-});
-
-test('migration completion waits for child exit then restores the development host with the run id', async () => {
-  let calls = 0;
-  let directory;
-  let running = true;
-  await runDesktopWithMigrationRestart(async (args, env) => {
-    calls++;
-    if (calls === 1) {
-      directory = env.OPENBITFUN_DEV_MIGRATION_DIR;
-      await write(directory, 'handoff.json', { runId, pid: 123 });
-      // A handoff may also make Tauri report its stopped frontend as a failure.
-      throw new Error('frontend stopped');
-    }
-    assert.equal(running, false);
-    assert.deepEqual(args, ['--legacy-migration-run-id', runId]);
-    assert.notEqual(env.OPENBITFUN_DEV_MIGRATION_DIR, directory);
-  }, {
-    isAlive: (pid) => { assert.equal(pid, 123); return running; },
-    wait: async () => {
-      await write(directory, 'restart.json', { runId });
-      running = false;
-    },
-  });
-  assert.equal(calls, 2);
-  await assert.rejects(access(directory), { code: 'ENOENT' });
-});
-
-test('crashed or mismatched migrators cannot silently restart Desktop', async () => {
-  for (const restart of [null, { runId: 'wrong-run' }]) {
-    await assert.rejects(runDesktopWithMigrationRestart(async (_, env) => {
-      await write(env.OPENBITFUN_DEV_MIGRATION_DIR, 'handoff.json', { runId, pid: 123 });
-      if (restart) await write(env.OPENBITFUN_DEV_MIGRATION_DIR, 'restart.json', restart);
-    }, { isAlive: () => false }), /without completing its restart handoff/);
-  }
-});
diff --git a/scripts/desktop-tauri-build.mjs b/scripts/desktop-tauri-build.mjs
index e362c16503..34ca961ce6 100644
--- a/scripts/desktop-tauri-build.mjs
+++ b/scripts/desktop-tauri-build.mjs
@@ -30,7 +30,6 @@ const LINUX_FLASHGREP_BINARIES = [
   'flashgrep-aarch64-unknown-linux-musl',
   'flashgrep-aarch64-unknown-linux-gnu',
 ];
-const DATA_MIGRATOR_CARGO_BINARY = 'openbitfun-data-migrator';
 
 function tauriBuildArgsFromArgv() {
   const args = process.argv.slice(2);
@@ -54,7 +53,6 @@ async function main() {
 
   const desktopDir = join(ROOT, 'src', 'apps', 'desktop');
   preparePluginHost();
-  const dataMigratorSidecar = prepareDataMigratorSidecar(forward, resolution, desktopDir);
   // Flashgrep distribution is temporarily suspended.
   const flashgrepBinary = null;
   // Tauri CLI reads CI and rejects numeric "1" (common in CI providers).
@@ -68,7 +66,6 @@ async function main() {
   const tauriConfig = prepareTauriConfig(join(desktopDir, 'tauri.conf.json'), {
     desktopDir,
     flashgrepBinary,
-    dataMigratorSidecar,
     resolution,
     releaseChannel,
   });
@@ -99,10 +96,6 @@ async function main() {
     process.exit(1);
   }
 
-  if (r.status === 0 && forward.includes('--no-bundle')) {
-    stageNoBundleDataMigrator(dataMigratorSidecar);
-  }
-
   // Keep only the latest useful Cargo caches for this build profile after tauri build ends.
   try {
     const { profileFromTauriBuildArgs, runGcBestEffort, targetFromTauriBuildArgs } = await import(
@@ -142,84 +135,6 @@ function rustHostTargetTriple() {
   return host;
 }
 
-export function planDataMigratorSidecar(
-  args,
-  resolution,
-  desktopDir,
-  runtime = {},
-) {
-  const explicitTarget = optionValue(args, '--target');
-  const targetTriple = explicitTarget || runtime.hostTarget || rustHostTargetTriple();
-  const profile = args.includes('--debug') ? 'debug' : optionValue(args, '--profile') || 'release';
-  const targetDirValue = runtime.cargoTargetDir ?? process.env.CARGO_TARGET_DIR;
-  const targetDir = targetDirValue
-    ? isAbsolute(targetDirValue)
-      ? targetDirValue
-      : resolve(ROOT, targetDirValue)
-    : join(ROOT, 'target');
-  const windowsTarget = targetTriple.includes('windows');
-  const suffix = windowsTarget ? '.exe' : '';
-  const artifactDirectory = join(targetDir, ...(explicitTarget ? [explicitTarget] : []), profile);
-  const cargoArgs = ['build', '-p', 'openbitfun-data-migrator', '--bin', DATA_MIGRATOR_CARGO_BINARY];
-  if (explicitTarget) cargoArgs.push('--target', explicitTarget);
-  if (args.includes('--debug')) {
-    // Cargo's default profile is the Tauri CLI's debug profile.
-  } else if (optionValue(args, '--profile')) {
-    cargoArgs.push('--profile', profile);
-  } else {
-    cargoArgs.push('--release');
-  }
-
-  const siblingBinaryName = resolution.assembly.memberBinaryNames.dataMigrator;
-  const externalBinBase = join(desktopDir, 'gen', 'sidecars', siblingBinaryName);
-  return {
-    artifactDirectory,
-    cargoArgs,
-    externalBinBase,
-    externalBinInput: `${externalBinBase}-${targetTriple}${suffix}`,
-    sourceArtifact: join(artifactDirectory, `${DATA_MIGRATOR_CARGO_BINARY}${suffix}`),
-    siblingArtifact: join(artifactDirectory, `${siblingBinaryName}${suffix}`),
-    siblingBinaryName,
-    targetTriple,
-  };
-}
-
-function prepareDataMigratorSidecar(args, resolution, desktopDir) {
-  const plan = planDataMigratorSidecar(args, resolution, desktopDir);
-  console.log(
-    `[tauri-build] Building Data Migrator sidecar (${plan.targetTriple}, ${plan.artifactDirectory})`
-  );
-  const result = spawnSync('cargo', plan.cargoArgs, {
-    cwd: ROOT,
-    env: process.env,
-    stdio: 'inherit',
-    shell: false,
-    windowsHide: true,
-  });
-  if (result.error) throw result.error;
-  if (result.status !== 0) {
-    throw new Error(`Data Migrator sidecar build failed with exit code ${result.status}`);
-  }
-  if (!existsSync(plan.sourceArtifact)) {
-    throw new Error(`Data Migrator build did not produce ${plan.sourceArtifact}`);
-  }
-  mkdirSync(dirname(plan.externalBinInput), { recursive: true });
-  copyFileSync(plan.sourceArtifact, plan.externalBinInput);
-  if (!plan.externalBinInput.endsWith('.exe')) {
-    chmodSync(plan.externalBinInput, statSync(plan.externalBinInput).mode | 0o111);
-  }
-  return plan;
-}
-
-export function stageNoBundleDataMigrator(plan) {
-  if (resolve(plan.sourceArtifact) === resolve(plan.siblingArtifact)) return plan.siblingArtifact;
-  copyFileSync(plan.sourceArtifact, plan.siblingArtifact);
-  if (!plan.siblingArtifact.endsWith('.exe')) {
-    chmodSync(plan.siblingArtifact, statSync(plan.siblingArtifact).mode | 0o111);
-  }
-  return plan.siblingArtifact;
-}
-
 function preparePluginHost() {
   const result = spawnSync('pnpm', ['run', 'plugin-host:prepare'], {
     cwd: ROOT,
@@ -378,7 +293,7 @@ export function prepareMacOSFlashgrepForSigning(
 
 export function prepareTauriConfig(
   baseConfigPath,
-  { desktopDir, flashgrepBinary, dataMigratorSidecar, resolution, releaseChannel }
+  { desktopDir, flashgrepBinary, resolution, releaseChannel }
 ) {
   const config = JSON.parse(readFileSync(baseConfigPath, 'utf8'));
   if (resolution) {
@@ -390,7 +305,6 @@ export function prepareTauriConfig(
     config.identifier = resolution.assembly.bundleId;
   }
   injectTargetFlashgrepResource(config, desktopDir, flashgrepBinary);
-  injectDataMigratorSidecar(config, desktopDir, dataMigratorSidecar);
   // The DeepSeek bridge is not a compile-time resource: cargo check and
   // desktop:dev must not require packages/dsh-acp/dist-profile. Official
   // packaging injects it here; frontend:build-all (beforeBuildCommand)
@@ -457,16 +371,6 @@ export function prepareTauriConfig(
   return generatedConfig;
 }
 
-function injectDataMigratorSidecar(config, desktopDir, sidecar) {
-  if (!sidecar) return;
-  const externalBin = new Set(config.bundle?.externalBin || []);
-  externalBin.add(toTauriPath(relative(desktopDir, sidecar.externalBinBase)));
-  config.bundle = {
-    ...(config.bundle || {}),
-    externalBin: [...externalBin],
-  };
-}
-
 const DSH_PROFILE_RESOURCE_SOURCE = '../../../packages/dsh-acp/dist-profile';
 const DSH_PROFILE_RESOURCE_TARGET = 'resources/dsh-profile';
 const EXTERNAL_FRONTEND_RESOURCE_SOURCE = '../../../dist';
diff --git a/scripts/desktop-tauri-build.test.mjs b/scripts/desktop-tauri-build.test.mjs
index 5c27bcda53..2399ecc306 100644
--- a/scripts/desktop-tauri-build.test.mjs
+++ b/scripts/desktop-tauri-build.test.mjs
@@ -5,10 +5,8 @@ import { join } from 'node:path';
 import test from 'node:test';
 import {
   configureDesktopWebFontProfile,
-  planDataMigratorSidecar,
   prepareMacOSFlashgrepForSigning,
   prepareTauriConfig,
-  stageNoBundleDataMigrator,
   shouldRetryMacDmgBuild,
 } from './desktop-tauri-build.mjs';
 import { resolveProductDefinition } from './product-customization/resolver.mjs';
@@ -345,58 +343,6 @@ test('Desktop packaging works without the suspended Flashgrep resource', () => {
   }
 });
 
-test('Desktop packaging builds and projects the matching Data Migrator sidecar', () => {
-  const fixture = join(tmpdir(), `openbitfun-migrator-sidecar-${process.pid}-${Date.now()}`);
-  const desktopDir = join(fixture, 'src', 'apps', 'desktop');
-  const targetDir = join(fixture, 'target');
-  mkdirSync(desktopDir, { recursive: true });
-  const baseConfig = join(fixture, 'tauri.conf.json');
-  writeFileSync(baseConfig, JSON.stringify({ bundle: { resources: {} } }));
-  try {
-    const resolution = resolveProductDefinition({
-      rootDir: ROOT,
-      productConfig: join(ROOT, 'products', 'fixtures', 'acme', 'product.jsonc'),
-      member: 'desktop',
-    });
-    const plan = planDataMigratorSidecar(
-      ['--target', 'x86_64-pc-windows-msvc', '--profile', 'release-fast'],
-      resolution,
-      desktopDir,
-      { cargoTargetDir: targetDir },
-    );
-    assert.deepEqual(plan.cargoArgs, [
-      'build',
-      '-p',
-      'openbitfun-data-migrator',
-      '--bin',
-      'openbitfun-data-migrator',
-      '--target',
-      'x86_64-pc-windows-msvc',
-      '--profile',
-      'release-fast',
-    ]);
-    assert.equal(
-      plan.externalBinInput,
-      join(desktopDir, 'gen', 'sidecars', 'acme-data-migrator-x86_64-pc-windows-msvc.exe'),
-    );
-    const generated = prepareTauriConfig(baseConfig, {
-      desktopDir,
-      flashgrepBinary: join(fixture, 'flashgrep'),
-      dataMigratorSidecar: plan,
-      resolution,
-    });
-    const config = JSON.parse(readFileSync(generated, 'utf8'));
-    assert.deepEqual(config.bundle.externalBin, ['gen/sidecars/acme-data-migrator']);
-
-    mkdirSync(plan.artifactDirectory, { recursive: true });
-    writeFileSync(plan.sourceArtifact, 'migrator');
-    assert.equal(stageNoBundleDataMigrator(plan), plan.siblingArtifact);
-    assert.equal(readFileSync(plan.siblingArtifact, 'utf8'), 'migrator');
-  } finally {
-    rmSync(fixture, { force: true, recursive: true });
-  }
-});
-
 test('Windows updater installs NSIS packages without showing its progress window', () => {
   const fixture = join(tmpdir(), `openbitfun-tauri-updater-${process.pid}-${Date.now()}`);
   const baseConfig = join(fixture, 'tauri.conf.json');
diff --git a/scripts/dev.cjs b/scripts/dev.cjs
index e3672f494c..bcfd15567b 100644
--- a/scripts/dev.cjs
+++ b/scripts/dev.cjs
@@ -557,31 +557,30 @@ async function startDesktopPreview() {
 
   printInfo(`Launching debug desktop binary: ${desktopBinary}`);
 
-  const { runDesktopWithMigrationRestart } = await import(
-    pathToFileURL(path.join(__dirname, 'desktop-dev-migration.mjs')).href
-  );
-  try {
-    await runDesktopWithMigrationRestart((restartArgs, migrationEnv) => new Promise((resolve, reject) => {
-      appProcess = spawnBackgroundCommand(desktopBinary, restartArgs, ROOT_DIR, {
-        ...process.env,
-        ...migrationEnv,
-        // Upload the current workspace mobile bundle instead of the staged copy.
-        OPENBITFUN_MOBILE_WEB_DIR: path.join(ROOT_DIR, 'src/mobile-web/dist'),
-      });
-      appProcess.on('error', reject);
-      appProcess.on('close', (code, signal) => {
-        appProcess = null;
-        if (code === 0) resolve();
-        else reject(new Error(`Desktop preview exited (code=${code}, signal=${signal})`));
-      });
-      printSuccess('Desktop preview is running');
-      printInfo('Front-end edits continue to use Vite HMR; rebuild Rust only when desktop-side code changes');
-    }), { info: printInfo });
-    await shutdown(0);
-  } catch (error) {
-    printError(error.message || String(error));
-    await shutdown(1);
-  }
+  appProcess = spawnBackgroundCommand(desktopBinary, [], ROOT_DIR, {
+    ...process.env,
+    // Debug previews must upload the current workspace build. The adjacent
+    // target/debug resource tree is only a build-time copy and can lag behind
+    // mobile-web edits made while the desktop binary is being reused.
+    OPENBITFUN_MOBILE_WEB_DIR: path.join(ROOT_DIR, 'src/mobile-web/dist'),
+  });
+
+  appProcess.on('error', (error) => {
+    printError(`Desktop preview failed to start: ${error.message || String(error)}`);
+    void shutdown(1);
+  });
+
+  appProcess.on('exit', (code, signal) => {
+    if (!shuttingDown) {
+      printInfo(`Desktop preview exited (code=${code ?? 'null'}, signal=${signal ?? 'null'})`);
+    }
+    void shutdown(code ?? 0);
+  });
+
+  printSuccess('Desktop preview is running');
+  printInfo('Front-end edits continue to use Vite HMR; rebuild Rust only when desktop-side code changes');
+
+  await new Promise(() => {});
 }
 
 /**
@@ -677,22 +676,6 @@ async function main() {
     process.exit(1);
   }
 
-  // Build after version generation and before Desktop starts. Cargo checks
-  // freshness so an existing but stale Migrator is rebuilt as well.
-  if (desktopMode) {
-    printInfo('Preparing Data Migrator (incremental Debug build)');
-    const migratorBuild = await runCommandPrefixed(
-      'data-migrator',
-      'cargo',
-      ['build', '-p', 'openbitfun-data-migrator', '--bin', 'openbitfun-data-migrator'],
-    );
-    if (!migratorBuild.ok) {
-      printError('Data Migrator build failed; Desktop was not started');
-      if (migratorBuild.error?.message) printError(migratorBuild.error.message);
-      process.exit(1);
-    }
-  }
-
   if (desktopMode) {
     const baselineHelperUrl = pathToFileURL(
       path.join(__dirname, 'frontend-workbench-dev-baseline.mjs')
@@ -751,26 +734,19 @@ async function main() {
         OPENBITFUN_MOBILE_WEB_DIR: path.join(ROOT_DIR, 'src/mobile-web/dist'),
       };
       try {
-        const { runDesktopWithMigrationRestart } = await import(
-          pathToFileURL(path.join(__dirname, 'desktop-dev-migration.mjs')).href
-        );
-        await runDesktopWithMigrationRestart(async (restartArgs, migrationEnv) => {
-          const args = ['dev', '--config', tauriConfig, ...(restartArgs.length ? ['--', '--', ...restartArgs] : [])];
-          if (process.platform === 'win32') {
-            // Running the generated .cmd shim directly via spawn is flaky on Windows.
-            // Use cmd.exe with an explicit args array so the desktop app directory
-            // stays the Tauri project root without pnpm workspace path rewriting.
-            const tauriBin = path.join(ROOT_DIR, 'node_modules', '.bin', 'tauri.cmd');
-            await runWindowsCommandArgs(tauriBin, args, desktopDir, { ...tauriDevEnv, ...migrationEnv });
-          } else {
-            const tauriBin = path.join(ROOT_DIR, 'node_modules', '.bin', 'tauri');
-            await spawnCommand(tauriBin, args, desktopDir, {
-              CARGO_PROFILE_DEV_CODEGEN_UNITS: tauriDevEnv.CARGO_PROFILE_DEV_CODEGEN_UNITS,
-              OPENBITFUN_MOBILE_WEB_DIR: tauriDevEnv.OPENBITFUN_MOBILE_WEB_DIR,
-              ...migrationEnv,
-            });
-          }
-        }, { info: printInfo });
+        if (process.platform === 'win32') {
+          // Running the generated .cmd shim directly via spawn is flaky on Windows.
+          // Use cmd.exe with an explicit args array so the desktop app directory
+          // stays the Tauri project root without pnpm workspace path rewriting.
+          const tauriBin = path.join(ROOT_DIR, 'node_modules', '.bin', 'tauri.cmd');
+          await runWindowsCommandArgs(tauriBin, ['dev', '--config', tauriConfig], desktopDir, tauriDevEnv);
+        } else {
+          const tauriBin = path.join(ROOT_DIR, 'node_modules', '.bin', 'tauri');
+          await spawnCommand(tauriBin, ['dev', '--config', tauriConfig], desktopDir, {
+            CARGO_PROFILE_DEV_CODEGEN_UNITS: tauriDevEnv.CARGO_PROFILE_DEV_CODEGEN_UNITS,
+            OPENBITFUN_MOBILE_WEB_DIR: tauriDevEnv.OPENBITFUN_MOBILE_WEB_DIR,
+          });
+        }
       } finally {
         // Option B: prune only when the desktop:dev session ends, not on each rebuild.
         await runDesktopTargetGc('debug');
diff --git a/scripts/frontend-color-surface-registry.json b/scripts/frontend-color-surface-registry.json
index 5693d6497e..dd7bf656a6 100644
--- a/scripts/frontend-color-surface-registry.json
+++ b/scripts/frontend-color-surface-registry.json
@@ -114,6 +114,19 @@
         "baseline": "scripts/theme-color-governance-baseline.installer.json"
       }
     },
+    {
+      "id": "data-migrator",
+      "label": "Offline Data Migrator",
+      "kind": "canonical-web",
+      "owner": "@openbitfun/design-tokens and @openbitfun/theme-openbitfun public CSS exports",
+      "root": "src/apps/data-migrator/ui",
+      "audit": {
+        "engine": "theme",
+        "policy": "canonical-ui-zero",
+        "packageContracts": ["@openbitfun/design-tokens", "@openbitfun/theme-openbitfun"],
+        "excludePaths": ["generated"]
+      }
+    },
     {
       "id": "desktop-bootstrap",
       "label": "Desktop pre-JavaScript bootstrap pages",
@@ -362,6 +375,11 @@
     }
   ],
   "generatedChecks": [
+    {
+      "id": "data-migrator-design-system",
+      "surfaceIds": ["data-migrator"],
+      "command": ["node", "scripts/generate-data-migrator-theme.mjs", "--check"]
+    },
     {
       "id": "desktop-appearance-projection",
       "surfaceIds": ["web-ui", "desktop-bootstrap"],
@@ -463,6 +481,13 @@
       "owner": "scripts/mobile-ui-design-system.mjs",
       "reason": "Preview data is generated from the native mobile token contract and checked for drift."
     },
+    {
+      "id": "data-migrator-generated",
+      "path": "src/apps/data-migrator/ui/generated",
+      "kind": "generated-output",
+      "owner": "scripts/generate-data-migrator-theme.mjs",
+      "reason": "Offline CSS is bundled from public design-system exports and checked for drift."
+    },
     {
       "id": "desktop-bootstrap-generated",
       "path": "src/apps/desktop/src/generated",
diff --git a/scripts/generate-data-migrator-theme.mjs b/scripts/generate-data-migrator-theme.mjs
new file mode 100644
index 0000000000..1631e45c24
--- /dev/null
+++ b/scripts/generate-data-migrator-theme.mjs
@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+/** Bundle the public design-system CSS for the offline, static migrator UI. */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = resolve(import.meta.dirname, '..');
+const OUTPUT = join(ROOT, 'src/apps/data-migrator/ui/generated/design-system.css');
+const themeRequire = createRequire(join(ROOT, 'design-system/packages/theme-openbitfun/package.json'));
+
+function bundleStylesheet(file, ancestors = new Set()) {
+  if (ancestors.has(file)) throw new Error(`Circular design-system stylesheet import: ${file}`);
+  const imports = new Set([...ancestors, file]);
+  const requireFromFile = createRequire(file);
+  return readFileSync(file, 'utf8').replace(/\r\n?/g, '\n').replace(
+    /@import\s+["']([^"']+)["'];/g,
+    (_, specifier) => bundleStylesheet(requireFromFile.resolve(specifier), imports).trimEnd(),
+  );
+}
+
+export async function generateDataMigratorTheme({ check = false } = {}) {
+  // Build the owning packages before reading their exports; an older dist must
+  // never make a source change appear current in the generated-output check.
+  await import('../design-system/packages/design-tokens/scripts/build.mjs');
+  await import('../design-system/packages/theme-openbitfun/scripts/build.mjs');
+  const css = bundleStylesheet(themeRequire.resolve('@openbitfun/theme-openbitfun/default.css'));
+  if (/@import\b|url\(/i.test(css)) {
+    throw new Error('Data Migrator design-system CSS must have no external asset dependencies.');
+  }
+  const content = '/* Generated by scripts/generate-data-migrator-theme.mjs. Do not edit. */\n'
+    + `${css.trimEnd()}\n`;
+  const current = existsSync(OUTPUT) ? readFileSync(OUTPUT, 'utf8').replace(/\r\n?/g, '\n') : null;
+  if (current === content) return;
+  if (check) {
+    throw new Error('Data Migrator theme is stale. Run `pnpm run data-migrator:theme:generate`.');
+  }
+  mkdirSync(dirname(OUTPUT), { recursive: true });
+  writeFileSync(OUTPUT, content, 'utf8');
+  console.log('[data-migrator] Generated offline design-system CSS');
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  generateDataMigratorTheme({ check: process.argv.includes('--check') }).catch((error) => {
+    console.error(error.message);
+    process.exitCode = 1;
+  });
+}
diff --git a/scripts/product-customization/projections.mjs b/scripts/product-customization/projections.mjs
index 8918e16777..8bf06c09a9 100644
--- a/scripts/product-customization/projections.mjs
+++ b/scripts/product-customization/projections.mjs
@@ -46,9 +46,6 @@ export function productBuildEnvironment(resolution) {
     OPENBITFUN_HIDDEN_DATA_DIRECTORY: `.${resolution.assembly.dataNamespace}`,
     OPENBITFUN_PRODUCT_BINARY_NAME: resolution.assembly.binaryName,
     OPENBITFUN_PRODUCT_DISPLAY_NAME: fallbackName,
-    OPENBITFUN_DESKTOP_BINARY_NAME: resolution.assembly.memberBinaryNames.desktop,
-    OPENBITFUN_DATA_MIGRATOR_BINARY_NAME:
-      resolution.assembly.memberBinaryNames.dataMigrator,
   };
   if (!resolution.isDefaultProduct) {
     const cargoTargetRoot = process.env.CARGO_TARGET_DIR
diff --git a/scripts/product-customization/projections.test.mjs b/scripts/product-customization/projections.test.mjs
index 25334218db..6f6ffeb472 100644
--- a/scripts/product-customization/projections.test.mjs
+++ b/scripts/product-customization/projections.test.mjs
@@ -32,9 +32,4 @@ test('build environment isolates custom Cargo output without overriding the defa
   assert.equal(customEnvironment.OPENBITFUN_HIDDEN_DATA_DIRECTORY, '.acme');
   assert.equal(customEnvironment.OPENBITFUN_PRODUCT_BINARY_NAME, 'acme');
   assert.equal(customEnvironment.OPENBITFUN_PRODUCT_DISPLAY_NAME, 'Acme CLI');
-  assert.equal(customEnvironment.OPENBITFUN_DESKTOP_BINARY_NAME, 'acme-desktop');
-  assert.equal(
-    customEnvironment.OPENBITFUN_DATA_MIGRATOR_BINARY_NAME,
-    'acme-data-migrator',
-  );
 });
diff --git a/scripts/product-customization/resolver.mjs b/scripts/product-customization/resolver.mjs
index c522f00ad4..8a6487ec9b 100644
--- a/scripts/product-customization/resolver.mjs
+++ b/scripts/product-customization/resolver.mjs
@@ -15,7 +15,7 @@ const ROOT_FIELDS = new Set([
   'localeRoot',
   'members',
 ]);
-const MEMBERS_FIELDS = new Set(['desktop', 'dataMigrator', 'cli']);
+const MEMBERS_FIELDS = new Set(['desktop', 'cli']);
 const COMMON_MEMBER_FIELDS = new Set(['displayNameKey', 'binaryName']);
 const BUNDLED_MEMBER_FIELDS = new Set([...COMMON_MEMBER_FIELDS, 'bundleId']);
 
@@ -192,7 +192,7 @@ function ownedLocaleFile(localeRoot, locale) {
 function validateMember(raw, member) {
   const owner = `members.${member}`;
   const value = requireObject(raw, owner);
-  const bundled = member === 'desktop' || member === 'dataMigrator';
+  const bundled = member === 'desktop';
   rejectUnknownFields(value, bundled ? BUNDLED_MEMBER_FIELDS : COMMON_MEMBER_FIELDS, owner);
   const result = {
     displayNameKey: requiredString(value.displayNameKey, `${owner}.displayNameKey`),
@@ -235,8 +235,8 @@ function loadProductNames(rootDir, localeRoot, displayNameKeys) {
 }
 
 export function resolveProductDefinition({ rootDir, productConfig, member }) {
-  if (!['desktop', 'dataMigrator', 'cli'].includes(member)) {
-    fail('invalid_member', `Unsupported product member: ${member}`, 'Use desktop, dataMigrator, or cli.');
+  if (!['desktop', 'cli'].includes(member)) {
+    fail('invalid_member', `Unsupported product member: ${member}`, 'Use desktop or cli.');
   }
   const canonicalRoot = realpathSync.native(resolve(rootDir));
   const defaultPath = realpathSync.native(join(canonicalRoot, 'products', 'openbitfun', 'product.jsonc'));
@@ -262,7 +262,6 @@ export function resolveProductDefinition({ rootDir, productConfig, member }) {
   rejectUnknownFields(members, MEMBERS_FIELDS, 'members');
   const normalizedMembers = {
     desktop: validateMember(members.desktop, 'desktop'),
-    dataMigrator: validateMember(members.dataMigrator, 'dataMigrator'),
     cli: validateMember(members.cli, 'cli'),
   };
   const locales = loadProductNames(
@@ -270,7 +269,6 @@ export function resolveProductDefinition({ rootDir, productConfig, member }) {
     localeRoot,
     [
       normalizedMembers.desktop.displayNameKey,
-      normalizedMembers.dataMigrator.displayNameKey,
       normalizedMembers.cli.displayNameKey,
     ],
   );
@@ -281,10 +279,6 @@ export function resolveProductDefinition({ rootDir, productConfig, member }) {
     productId,
     dataNamespace,
     member,
-    memberBinaryNames: {
-      desktop: normalizedMembers.desktop.binaryName,
-      dataMigrator: normalizedMembers.dataMigrator.binaryName,
-    },
     displayNameKey: selected.displayNameKey,
     binaryName: selected.binaryName,
     localeDigest: locales.digest,
diff --git a/scripts/product-customization/resolver.test.mjs b/scripts/product-customization/resolver.test.mjs
index 79eae41705..4c2283601c 100644
--- a/scripts/product-customization/resolver.test.mjs
+++ b/scripts/product-customization/resolver.test.mjs
@@ -12,7 +12,6 @@ const ACME = join(ROOT, 'products', 'fixtures', 'acme', 'product.jsonc');
 test('default and custom members resolve through one deterministic contract', () => {
   const openbitfun = resolveProductDefinition({ rootDir: ROOT, member: 'desktop' });
   const desktop = resolveProductDefinition({ rootDir: ROOT, productConfig: ACME, member: 'desktop' });
-  const dataMigrator = resolveProductDefinition({ rootDir: ROOT, productConfig: ACME, member: 'dataMigrator' });
   const cli = resolveProductDefinition({ rootDir: ROOT, productConfig: ACME, member: 'cli' });
 
   assert.equal(openbitfun.assembly.productId, 'openbitfun');
@@ -20,16 +19,9 @@ test('default and custom members resolve through one deterministic contract', ()
   assert.equal(openbitfun.assembly.binaryName, 'openbitfun-desktop');
   assert.equal(openbitfun.assembly.bundleId, 'com.openbitfun.desktop');
   assert.equal(desktop.assembly.bundleId, 'com.acme.desktop');
-  assert.equal(dataMigrator.assembly.binaryName, 'acme-data-migrator');
-  assert.equal(dataMigrator.assembly.bundleId, 'com.acme.data-migrator');
-  assert.deepEqual(dataMigrator.assembly.memberBinaryNames, {
-    desktop: 'acme-desktop',
-    dataMigrator: 'acme-data-migrator',
-  });
   assert.equal(cli.assembly.binaryName, 'acme');
   assert.equal(cli.assembly.bundleId, undefined);
   assert.notEqual(desktop.assembly.assemblyDigest, cli.assembly.assemblyDigest);
-  assert.notEqual(desktop.assembly.assemblyDigest, dataMigrator.assembly.assemblyDigest);
   assert.equal(
     resolveProductDefinition({ rootDir: ROOT, productConfig: ACME, member: 'desktop' })
       .assembly.assemblyDigest,
diff --git a/scripts/product-identity-audit.mjs b/scripts/product-identity-audit.mjs
index 84c2253364..ec8d0873aa 100644
--- a/scripts/product-identity-audit.mjs
+++ b/scripts/product-identity-audit.mjs
@@ -21,10 +21,6 @@ const productIdentityOwner = 'src/crates/contracts/core-types/src/product_identi
 const retiredIdentityDataBoundaryFiles = new Set([
   'OPENBITFUN_LEGACY_DATA_MIGRATION_IMPLEMENTATION_PLAN.md',
   'OPENBITFUN_LEGACY_DATA_MIGRATION_INVENTORY.md',
-  'src/apps/desktop/src/api/legacy_migration_api.rs',
-  'src/web-ui/src/locales/en-US/settings/legacy-migration.json',
-  'src/web-ui/src/locales/zh-CN/settings/legacy-migration.json',
-  'src/web-ui/src/locales/zh-TW/settings/legacy-migration.json',
   'deploy/openbitfun-host/README.md',
   'deploy/openbitfun-host/migrate-market-data-v1.py',
   'src/apps/relay-server/README.md',
@@ -39,6 +35,7 @@ const retiredIdentityDataBoundaryPrefixes = Object.freeze([
   'src/apps/data-migrator/',
   'src/crates/assembly/core/src/legacy_migration/',
   'src/crates/services/legacy-migration/',
+  'src/crates/services/legacy-migration-adapters/',
 ]);
 const noncanonicalIdentityDataBoundaryFiles = new Set([
   'OPENBITFUN_LEGACY_DATA_MIGRATION_INVENTORY.md',
diff --git a/scripts/product-identity-audit.test.mjs b/scripts/product-identity-audit.test.mjs
index 6d11658599..0a32a89540 100644
--- a/scripts/product-identity-audit.test.mjs
+++ b/scripts/product-identity-audit.test.mjs
@@ -106,10 +106,6 @@ test('allows only the exact legacy data-directory ignore entry', () => {
 
 test('limits retired identity data to the one-time production migration boundary', () => {
   for (const file of [
-    'src/apps/desktop/src/api/legacy_migration_api.rs',
-    'src/web-ui/src/locales/en-US/settings/legacy-migration.json',
-    'src/web-ui/src/locales/zh-CN/settings/legacy-migration.json',
-    'src/web-ui/src/locales/zh-TW/settings/legacy-migration.json',
   ]) {
     assert.deepEqual(violationsFor(retiredName, file), []);
   }
diff --git a/src/apps/data-migrator/AGENTS.md b/src/apps/data-migrator/AGENTS.md
index 55f856171d..2128eca3de 100644
--- a/src/apps/data-migrator/AGENTS.md
+++ b/src/apps/data-migrator/AGENTS.md
@@ -1,44 +1,42 @@
 # Data Migrator Agent Guide
 
-Scope: this guide applies to `src/apps/data-migrator`.
-
-This app is the offline, local-only host for importing legacy BitFun data. It
-must remain a separate executable and WebView identity from Desktop.
-
-## Guardrails
-
-- Select `DeliveryProfile::DataMigrator` and only the Core
-  `legacy-migration` feature. Do not add `product-full`, Agent Runtime,
-  plugin runtime, normal session startup, updater, shell, or frontend
-  filesystem capabilities.
-- Accept only the handoff `run_id` on the command line. Derive the request path
-  from `MigrationRoots`; never accept a request or executable path from UI or
-  command-line input.
-- Keep all filesystem, process, credential, and restart work in Rust. The UI
-  may call only the typed commands registered in `src/lib.rs`.
-- Report domain, phase, and counts. Do not invent progress percentages or emit
-  secrets, user content, credential values, or absolute paths in errors.
-- Cancellation is advisory and may be honored only at engine-declared safe
-  boundaries. Closing during execution requests cancellation and keeps the
-  window open until a safe boundary.
-- The migrator never updates itself. Resolve Desktop as a fixed-name sibling
-  binary using product-definition projections and the trusted installation
-  resolver; do not accept executable paths from handoff input.
-
-## Verification
+Scope: src/apps/data-migrator. This is a separately versioned, offline local tool.
+Read README.md for its user-facing contract.
+
+## Boundaries
+
+- Launch with no arguments. Own directory selection, discovery, durable task
+  recovery and completion; never depend on a Desktop request or restart Desktop.
+- Keep preferences under the tool's Tauri app-config identity. Migration run
+  journals/backups remain under the destination data directory for recovery.
+  Do not write Desktop onboarding/reminder state.
+- Consume config-contracts, shared storage services and legacy-migration-adapters.
+  Do not depend on Core, product assembly, Agent execution, Web UI, updater,
+  plugin lifecycle or a main-application sibling executable.
+- Use typed Rust commands for filesystem/process operations. Cancellation is
+  advisory and is honored only at engine-declared safe boundaries.
+- Reject unsupported data formats and unsafe directory overlaps. Preserve source
+  data, old plans/reports, snapshots, journals, backups and owner conflict policies.
+- The UI uses public @openbitfun/design-tokens and @openbitfun/theme-openbitfun
+  exports bundled in ui/generated/design-system.css. Regenerate through
+  pnpm run data-migrator:theme:generate. Direct Cargo builds are offline;
+  Desktop dev/build must never generate or build migrator assets.
+- ui/theme.js selects system scheme/contrast before paint. Workflow translations
+  are app-owned; do not import Web UI catalogs. No mocks or browser automation
+  for visual verification.
+- Tool version lives in Cargo.toml and tauri.conf.json. Packaging/signing uses
+  the independent Data Migrator workflow and data-migrator-v tags.
+
+## Focused verification
 
 ```bash
-cargo test -p openbitfun-data-migrator
+cargo test -p openbitfun-data-migrator -p openbitfun-legacy-migration-adapters -p openbitfun-legacy-migration --lib
+cargo test -p openbitfun-legacy-migration --test migration_engine_contracts
 node --test scripts/data-migrator-tauri-build.test.mjs
-node --test scripts/desktop-dev-migration.test.mjs
+node --check src/apps/data-migrator/ui/app.js
+pnpm run theme:color-audit:all
 ```
 
-Completion always returns to Desktop. Debug builds launched through `desktop:dev`
-or `desktop:preview:debug` ask that launcher to restart via its private temporary
-handoff directory, preserving the frontend server and development lifecycle.
-Builds without that channel restart the trusted sibling Desktop executable.
-Keep this developer-only channel out of persisted migration and remote protocols.
-
-Run `pnpm run check:core-boundaries` when dependencies or delivery-profile
-selection change. Packaging, signing, and UI interaction are separate explicit
-verification steps.
+Run pnpm run check:core-boundaries for dependency ownership changes and
+pnpm run check:github-config for release workflow changes. Platform packaging
+and native visual checks are separate from these contract checks.
diff --git a/src/apps/data-migrator/Cargo.toml b/src/apps/data-migrator/Cargo.toml
index 8c112cad8d..52b1c3fd20 100644
--- a/src/apps/data-migrator/Cargo.toml
+++ b/src/apps/data-migrator/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "openbitfun-data-migrator"
-version.workspace = true
+version = "0.1.0"
 authors.workspace = true
 edition.workspace = true
 description = "OpenBitFun offline legacy data migrator"
@@ -17,18 +17,17 @@ path = "src/main.rs"
 tauri-build = { workspace = true }
 
 [dependencies]
-openbitfun-core = { path = "../../crates/assembly/core", features = ["legacy-migration"] }
+openbitfun-legacy-migration-adapters = { path = "../../crates/services/legacy-migration-adapters" }
 openbitfun-core-types = { path = "../../crates/contracts/core-types" }
 openbitfun-legacy-migration = { path = "../../crates/services/legacy-migration" }
-openbitfun-product-capabilities = { path = "../../crates/assembly/product-capabilities" }
 openbitfun-product-domains = { path = "../../crates/contracts/product-domains", features = ["legacy-migration"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tauri = { workspace = true }
+uuid = { workspace = true }
 
 [dev-dependencies]
 tempfile = { workspace = true }
-uuid = { workspace = true }
 
 [lints]
 workspace = true
diff --git a/src/apps/data-migrator/README.md b/src/apps/data-migrator/README.md
new file mode 100644
index 0000000000..b821573866
--- /dev/null
+++ b/src/apps/data-migrator/README.md
@@ -0,0 +1,130 @@
+# OpenBitFun Data Migrator
+
+[中文](README.zh-CN.md)
+
+A separate, optional desktop utility for importing old **BitFun** data into
+**OpenBitFun**. It runs without installing or opening the main application, has
+its own window and settings, and never starts or restarts Desktop. OpenBitFun
+does not bundle, download, or launch it automatically.
+
+## Download and run
+
+Look for **OpenBitFun Data Migrator** releases with a `data-migrator-v*` tag on
+the [release page](https://github.com/GCWing/OpenBitFun/releases?q=data-migrator-v&expanded=true).
+These releases have their own version and assets; the main application's
+installer does not contain the tool. If no migrator release is listed, build
+from source using the commands below.
+
+| Platform | Download | Launch |
+| --- | --- | --- |
+| Windows x64 | `openbitfun-data-migrator-v<version>-windows-x64.zip` | Extract, then double-click `openbitfun-data-migrator.exe` |
+| macOS Apple Silicon | `openbitfun-data-migrator-v<version>-macos-arm64.dmg` | Open the DMG and its Data Migrator app |
+| macOS Intel | `openbitfun-data-migrator-v<version>-macos-x64.dmg` | Open the DMG and its Data Migrator app |
+| Linux x64 | `openbitfun-data-migrator-v<version>-linux-x64.AppImage` | Make executable and launch in a desktop session |
+
+Windows needs the Microsoft Edge WebView2 runtime. macOS uses the system WebView;
+Linux packages are built on Ubuntu 22.04. No login or network connection is
+needed for migration. ARM Windows/Linux packages are not currently produced.
+
+1. Close BitFun, OpenBitFun, their CLI instances, and background data writers.
+2. Open Data Migrator. Check the **source and destination** directories. All
+   four locations on each side can be edited; apply changes before scanning.
+3. Select the data groups, scan, then run the preflight plan.
+4. Review the destination and conflicts, then start migration. If known writers
+   remain open, the tool waits for them to stop; it does not terminate them.
+5. Read the report. Sign in again or repair paths where indicated, close the
+   tool, and open OpenBitFun yourself.
+
+The UI uses the shared design-system tokens bundled offline, follows the system
+light/dark/high-contrast setting, and offers English, Simplified Chinese, and
+Traditional Chinese.
+
+## Data and compatibility
+
+The declared source range is BitFun `>=0.2.0,<1.0.0`; the archived integration
+fixture is **0.2.19**. This is format-based support, not a claim that every old
+release has been tested. The source must pass the probe and selected domain
+validators. Unsupported or corrupt data is kept and reported.
+
+The destination is OpenBitFun: configuration schema **1**, workspace registry
+format **1**, coordination database schema **2**, and the session, memory,
+extension, and connection formats accepted by the shared storage owners in
+this source revision. Unknown product/configuration schemas and newer SQLite
+or session schemas fail validation. A future storage format requires a new
+migrator release; matching application and tool version numbers is unnecessary.
+Custom branded products are not supported by this tool.
+
+Migration covers settings and credentials; user Agents, Skills and MiniApps;
+workspaces, sessions and task records; memories; and local connection/device
+records. Existing destination values take priority or conflicts are preserved
+under a new identity according to the domain policy. Runtime caches, locks,
+process discovery files, built-in executable content and request traces are
+excluded. Credentials that cannot be decrypted on the destination require
+sign-in again.
+
+Source data is never automatically deleted. Writes use consistent snapshots,
+staging, validation, backups, a migration lock and atomic replacement. Keep
+both applications closed until the run finishes. Cancellation and window close
+requests wait for an engine-declared safe boundary; already verified domains
+may remain imported.
+
+## Resume and diagnose
+
+Plans, journals, reports, backups and staging live under:
+
+```text
+<destination settings-and-data>/data/migrations/bitfun-to-openbitfun/runs/<run-id>/
+```
+
+Reopen the tool, select the original directories, and use **Saved migration
+tasks → Review / resume task**. Recovery requires a valid plan and unchanged
+source fingerprint and resumes through the journal; it does not expire after
+ten minutes. Completed reports can be reopened. New scans create new tasks and
+never replace earlier journals. Old handoff-based plans remain readable even
+if their `request.json` has expired; select the original locations before
+resuming them. Unreadable files are not deleted or reset.
+
+The tool remembers selected locations in its own `com.openbitfun.data-migrator`
+application configuration directory. It does not write main-app onboarding or
+reminder preferences. **Export failure diagnostics** writes a sanitized file
+containing result codes and journal phases; full local reports and backups
+can contain sensitive data and should stay private.
+
+This tool only operates on files accessible on the computer where it runs.
+Remote workspace execution, remote control, Peer Device Mode and Detached
+Dispatch are not execution surfaces for it. Run it on the data-owning computer;
+importing stored connection records does not connect to or migrate a remote host.
+
+## Build and release
+
+From the repository root with Rust, Node, pnpm and the platform's Tauri build prerequisites:
+
+```bash
+pnpm install
+pnpm run data-migrator:dev       # independent window; no Desktop or dev server
+pnpm run data-migrator:build     # independent release bundle
+cargo build -p openbitfun-data-migrator --bin openbitfun-data-migrator
+```
+
+Direct Cargo builds embed the committed UI and design-system CSS. After changing
+the token/theme owners run `pnpm run data-migrator:theme:generate`; the packaging
+entry does this automatically. Desktop development/build commands do not build
+the migrator. Shared Rust crates remain in the same source workspace to preserve
+storage compatibility; there is no dependency on the main application's Core,
+runtime assembly, Web UI, installer or updater.
+
+The tool version is maintained in its own `Cargo.toml` and `tauri.conf.json`.
+The **Data Migrator Package** workflow builds four platform artifacts manually
+or on `data-migrator-v<version>` tags. Tag builds require the separate
+`DATA_MIGRATOR_SIGNING_PRIVATE_KEY`, `DATA_MIGRATOR_SIGNING_PRIVATE_KEY_PASSWORD`
+and `DATA_MIGRATOR_SIGNING_PUBKEY` secrets, verify checksums/signatures, and create
+a **draft** release for review. Manual workflow runs only upload CI artifacts.
+Publishing migrator releases does not start main-app packaging or update feeds.
+
+Each asset has a SHA-256 sidecar and a base64-encoded minisign `.sig`; the
+release also carries `SHA256SUMS` and `data-migrator.minisign.pub`. Verify the key
+against the maintainer's trusted key before checking signatures. Detached
+signatures are distinct from Apple/Authenticode platform signing; the workflow
+does not currently configure those certificates or macOS notarization.
+
+Focused checks and architecture rules are in [AGENTS.md](AGENTS.md).
diff --git a/src/apps/data-migrator/README.zh-CN.md b/src/apps/data-migrator/README.zh-CN.md
new file mode 100644
index 0000000000..4ba91993b9
--- /dev/null
+++ b/src/apps/data-migrator/README.zh-CN.md
@@ -0,0 +1,100 @@
+# OpenBitFun 独立数据迁移器
+
+[English](README.md)
+
+这是一个可选的独立桌面工具，用于将旧版 **BitFun** 数据导入 **OpenBitFun**。
+无需安装或启动主应用；工具有自己的窗口、版本和配置，完成后只关闭自身。
+主应用不会捆绑、自动下载、自动启动迁移器，也不会因为旧版数据而阻止正常启动。
+
+## 下载和使用
+
+在 [GitHub Releases](https://github.com/GCWing/OpenBitFun/releases?q=data-migrator-v&expanded=true)
+寻找 **OpenBitFun Data Migrator**、标签以 `data-migrator-v` 开头的独立发布。
+迁移器不在主应用安装包内；如果尚未列出独立发布，请按下文从源码构建。
+
+| 系统 | 下载文件 | 启动方式 |
+| --- | --- | --- |
+| Windows x64 | `openbitfun-data-migrator-v<版本>-windows-x64.zip` | 解压后双击 `openbitfun-data-migrator.exe` |
+| macOS Apple Silicon | `openbitfun-data-migrator-v<版本>-macos-arm64.dmg` | 打开 DMG 中的迁移器 |
+| macOS Intel | `openbitfun-data-migrator-v<版本>-macos-x64.dmg` | 打开 DMG 中的迁移器 |
+| Linux x64 | `openbitfun-data-migrator-v<版本>-linux-x64.AppImage` | 添加可执行权限，在桌面会话中启动 |
+
+Windows 需要 Microsoft Edge WebView2；macOS 使用系统 WebView，Linux 包以 Ubuntu 22.04
+为构建基线。迁移不需要登录或联网，目前不产出 Windows/Linux ARM 安装包。
+
+1. 关闭 BitFun、OpenBitFun、CLI 实例及其后台数据写入进程。
+2. 启动迁移器，检查**来源和目标目录**。两侧各有设置与数据、主目录数据、Skills、SSH
+   四个位置；如需修改，先点击“使用这些目录”。
+3. 选择迁移范围，扫描数据，再运行预检。
+4. 确认目标、范围和冲突后开始迁移。发现已知写入进程时会等待其退出，不会强制终止进程。
+5. 查看结果，根据提示重新登录或修复路径，关闭迁移器，再自行打开 OpenBitFun。
+
+界面使用离线打包的共享设计系统，跟随系统深浅色和高对比度设置，并提供中英文切换。
+
+## 支持范围与数据保护
+
+声明支持的来源是 BitFun `>=0.2.0,<1.0.0`，仓库保存的集成验证样本是 **0.2.19**。
+支持以实际数据格式和各领域校验为准，不代表已验证范围内的每个旧版本。
+未知格式、损坏数据会明确报告并保留。
+
+目标是 OpenBitFun：配置 schema **1**、工作区格式 **1**、任务协调数据库 schema **2**，
+以及此源码版本共享存储模块支持的会话、记忆、扩展和连接格式。未知产品/配置格式以及
+超出支持范围的数据库、会话版本会被拒绝。未来数据格式变更需要发布新的迁移器，
+工具版本无需与主应用版本相同；此工具不支持定制品牌产品的数据。
+
+可迁移设置与凭据、用户 Agents/Skills/MiniApps、工作区与会话及任务记录、记忆、
+本机保存的远程连接与设备记录。已有目标值优先，部分冲突会按领域规则保留双方。
+缓存、锁、进程发现文件、内置可执行内容和请求追踪不迁移；不可解密的凭据需重新登录。
+
+来源不会被自动删除。写入使用一致性快照、暂存、校验、备份、迁移锁和原子替换。
+迁移期间请保持相关应用关闭；取消或关闭窗口会等到安全边界，已验证完成的领域可能已导入。
+
+## 中断恢复与诊断
+
+任务保存在：
+
+```text
+<目标设置与数据目录>/data/migrations/bitfun-to-openbitfun/runs/<任务 ID>/
+```
+
+重新打开迁移器，选择原来的目录，在“历史迁移任务”中查看或恢复。恢复会校验计划、
+来源指纹和原目录，并沿用日志，不受原来十分钟交接请求有效期限制。
+已完成任务仍可查看报告；新扫描会创建新任务，不会覆盖旧日志。
+旧版交接流程留下的计划与日志仍可读取，即使 `request.json` 已过期；恢复前须选择原目录。
+无法读取的任务文件不会被删除或重置。
+
+迁移器只在自己的 `com.openbitfun.data-migrator` 配置目录中记住所选位置，不写主应用的
+引导或提醒状态。“导出失败诊断”生成包含结果码和执行阶段的去敏文件。
+完整本地报告与备份可能含敏感信息，请保留在本机。
+
+迁移器只操作运行电脑可访问的文件，不接入远程工作区执行、远程控制、Peer Device Mode
+或 Detached Dispatch。请在数据所在电脑上运行；迁移连接记录并不连接或迁移远端主机。
+
+## 开发与独立发布
+
+安装 Rust、Node、pnpm 和对应系统的 Tauri 构建依赖后，在仓库根目录执行：
+
+```bash
+pnpm install
+pnpm run data-migrator:dev       # 独立窗口，无需主应用或开发服务器
+pnpm run data-migrator:build     # 独立发行包
+cargo build -p openbitfun-data-migrator --bin openbitfun-data-migrator
+```
+
+直接 Cargo 构建使用已提交的静态 UI 和设计系统 CSS。修改主题源后运行
+`pnpm run data-migrator:theme:generate`；独立打包入口会自动生成。
+主应用开发和构建不再构建迁移器。两者仍在同一源码工作区共享稳定的数据契约和存储模块，
+以保证格式一致，但迁移器不依赖主应用 Core、运行时组装、Web UI、安装器或更新器。
+
+版本由迁移器自己的 `Cargo.toml` 和 `tauri.conf.json` 维护。**Data Migrator Package**
+工作流支持手动构建，或通过 `data-migrator-v<版本>` 标签生成独立发布草稿。
+标签发布使用专用的 `DATA_MIGRATOR_SIGNING_PRIVATE_KEY`、
+`DATA_MIGRATOR_SIGNING_PRIVATE_KEY_PASSWORD`、`DATA_MIGRATOR_SIGNING_PUBKEY`，
+完成签名和校验后创建草稿，审核后再发布。手动运行只生成 CI 构建产物。
+迁移器发布不会触发主应用打包或更新源。
+
+每个产物带 SHA-256 校验文件和 base64 编码的 minisign `.sig`，同时提供
+`SHA256SUMS` 与 `data-migrator.minisign.pub`。验证签名前应通过可信渠道确认公钥。
+独立文件签名不等于 Apple/Authenticode 系统代码签名；当前工作流尚未配置这些证书及 macOS 公证。
+
+开发约束和针对性检查见 [AGENTS.md](AGENTS.md)。
diff --git a/src/apps/data-migrator/RELEASE.md b/src/apps/data-migrator/RELEASE.md
new file mode 100644
index 0000000000..68f4fc1fc1
--- /dev/null
+++ b/src/apps/data-migrator/RELEASE.md
@@ -0,0 +1,16 @@
+Optional, independently downloaded BitFun → OpenBitFun data migrator.
+
+Extract the Windows ZIP and double-click the migrator, or open the macOS/Linux
+package. Close all BitFun/OpenBitFun data writers first. Review source,
+destination and the preflight plan before importing. Source data is retained;
+interrupted runs can be resumed from Saved migration tasks.
+
+Declared source range: BitFun >=0.2.0,<1.0.0. Archived integration fixture: 0.2.19.
+The tool uses explicit storage-format validation and rejects unsupported data.
+No main application installation, login, network or restart handoff is required.
+
+See the README files at this release tag for compatibility, recovery, build and
+signature verification details. Every package carries a SHA-256 sidecar and a
+verified detached minisign signature. Platform code signing/notarization is not
+configured by this workflow. This draft requires maintainer review and platform
+launch checks before publication.
diff --git a/src/apps/data-migrator/icons/openbitfun-app-icon.icns b/src/apps/data-migrator/icons/openbitfun-app-icon.icns
new file mode 100644
index 0000000000..976eec4c27
Binary files /dev/null and b/src/apps/data-migrator/icons/openbitfun-app-icon.icns differ
diff --git a/src/apps/data-migrator/icons/openbitfun-app-icon.ico b/src/apps/data-migrator/icons/openbitfun-app-icon.ico
new file mode 100644
index 0000000000..2d88a5a677
Binary files /dev/null and b/src/apps/data-migrator/icons/openbitfun-app-icon.ico differ
diff --git a/src/apps/data-migrator/icons/openbitfun-app-icon.png b/src/apps/data-migrator/icons/openbitfun-app-icon.png
new file mode 100644
index 0000000000..2cfdd17e94
Binary files /dev/null and b/src/apps/data-migrator/icons/openbitfun-app-icon.png differ
diff --git a/src/apps/data-migrator/src/app_state.rs b/src/apps/data-migrator/src/app_state.rs
index c4d6a04d3f..1b2eb172b0 100644
--- a/src/apps/data-migrator/src/app_state.rs
+++ b/src/apps/data-migrator/src/app_state.rs
@@ -1,36 +1,23 @@
-use openbitfun_core::legacy_migration::adapters_for_groups;
-use openbitfun_core_types::product_identity::product_id;
 use openbitfun_legacy_migration::{
-    blocking_writer_processes_for_product, export_failure_diagnostics, launch_trusted_executable,
-    probe_legacy_source, CancellationToken, HandoffDisposition, HandoffStore, LegacyMigrationError,
-    LegacyMigrationResult, MigrationEngine, MigrationLayout, MigrationOnboardingStore,
-    MigrationRoots, NoCrashInjection, ProbeLimits, TrustedInstallationResolver, WriterProcess,
+    atomic_write_json, blocking_writer_processes, export_failure_diagnostics, list_tasks,
+    load_task, probe_legacy_source, save_task, CancellationToken, LegacyMigrationError,
+    LegacyMigrationResult, MigrationEngine, MigrationLayout, MigrationRoots, NoCrashInjection,
+    ProbeLimits, SavedMigrationTask, WriterProcess,
 };
-use openbitfun_product_capabilities::{product_assembly_plan_for_profile, DeliveryProfile};
+use openbitfun_legacy_migration_adapters::adapters_for_groups;
 use openbitfun_product_domains::legacy_migration::{
     FindingSeverity, LegacySourceDescriptor, MigrationPhase, MigrationPlan, MigrationProgressEvent,
-    MigrationPromptChoice, MigrationRunReport, MigrationRunStatus, MigrationSelection,
-    MigratorHandoffRequest, MigratorProtocolCapabilities, MigratorRequestMode, ScanFinding,
-    CURRENT_MIGRATION_FORMAT_VERSION,
+    MigrationRunReport, MigrationRunStatus, MigrationSelection, ScanFinding,
 };
 use serde::Serialize;
-use std::ffi::OsStr;
-use std::path::Path;
+use std::path::PathBuf;
 use std::sync::{Arc, Mutex, MutexGuard};
-use std::time::{Duration, SystemTime, UNIX_EPOCH};
+use std::time::Duration;
 
-const RELEASE_CHANNEL: &str = match option_env!("OPENBITFUN_RELEASE_CHANNEL") {
-    Some(value) => value,
-    None => "stable",
-};
-const DESKTOP_BINARY_NAME: &str = match option_env!("OPENBITFUN_DESKTOP_BINARY_NAME") {
-    Some(value) => value,
-    None => "openbitfun-desktop",
-};
-const DATA_MIGRATOR_BINARY_NAME: &str = match option_env!("OPENBITFUN_DATA_MIGRATOR_BINARY_NAME") {
-    Some(value) => value,
-    None => "openbitfun-data-migrator",
-};
+#[derive(Debug, Clone)]
+struct TaskRequest {
+    run_id: String,
+}
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 #[serde(rename_all = "camelCase")]
@@ -82,9 +69,14 @@ impl CommandError {
                 "This legacy BitFun data format is not supported by this migrator.",
                 false,
             ),
+            LegacyMigrationError::UnsupportedTarget(_) => Self::new(
+                "unsupported_target",
+                "The destination data format is not supported. Use a compatible migrator or an empty destination.",
+                true,
+            ),
             LegacyMigrationError::InvalidRequest(_) => Self::new(
-                "invalid_handoff",
-                "The migration handoff could not be authenticated or has expired.",
+                "invalid_task",
+                "The selected migration task or data locations are invalid.",
                 false,
             ),
             LegacyMigrationError::InvalidPlan(_) => Self::new(
@@ -167,10 +159,9 @@ impl CommandError {
 #[derive(Debug, Clone, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub(crate) struct MigratorView {
-    pub delivery_profile: String,
-    pub restart_desktop_on_finish: bool,
-    pub protocol: MigratorProtocolCapabilities,
-    pub mode: MigratorRequestMode,
+    pub tool_version: String,
+    pub locations: MigrationRoots,
+    pub saved_tasks: Vec<SavedMigrationTask>,
     pub source: Option<LegacySourceDescriptor>,
     pub selection: MigrationSelection,
     pub findings: Vec<ScanFinding>,
@@ -194,8 +185,10 @@ pub(crate) struct DiagnosticsExportView {
 #[derive(Debug)]
 struct MigratorSession {
     roots: MigrationRoots,
-    request: MigratorHandoffRequest,
-    disposition: HandoffDisposition,
+    request: TaskRequest,
+    recovery: bool,
+    saved_tasks: Vec<SavedMigrationTask>,
+    settings_path: PathBuf,
     source: Option<LegacySourceDescriptor>,
     selection: MigrationSelection,
     findings: Vec<ScanFinding>,
@@ -215,80 +208,111 @@ pub(crate) struct MigratorCoordinator {
 }
 
 impl MigratorCoordinator {
-    pub(crate) fn bootstrap(run_id: &str) -> LegacyMigrationResult<Self> {
-        Self::bootstrap_with(
-            run_id,
-            MigrationRoots::resolve_current_user()?,
-            product_id(),
-            RELEASE_CHANNEL,
-        )
-    }
-
-    fn bootstrap_with(
-        run_id: &str,
-        roots: MigrationRoots,
-        expected_product_id: &str,
-        expected_release_channel: &str,
-    ) -> LegacyMigrationResult<Self> {
-        let product_plan = product_assembly_plan_for_profile(DeliveryProfile::DataMigrator);
-        if !product_plan.capability_set().ids().is_empty()
-            || !product_plan.capability_assembly().agent_ids().is_empty()
-            || !product_plan.feature_groups().is_empty()
-        {
-            return Err(LegacyMigrationError::InvalidRequest(
-                "data migrator delivery profile unexpectedly selected runtime capabilities"
-                    .to_string(),
-            ));
+    pub(crate) fn bootstrap(settings_path: PathBuf) -> LegacyMigrationResult<Self> {
+        let defaults = MigrationRoots::current_user_locations()?;
+        let layout = MigrationLayout::new(&defaults, "preferences");
+        let saved = layout.read_json::<MigrationRoots>(&settings_path);
+        let (roots, error) = match saved {
+            Ok(Some(roots)) => (roots, None),
+            Ok(None) => (defaults, None),
+            Err(error) => (defaults, Some(CommandError::from_legacy(&error))),
+        };
+        let coordinator = Self::bootstrap_with(roots, settings_path);
+        if let Some(error) = error {
+            coordinator.lock().error = Some(error);
         }
+        Ok(coordinator)
+    }
 
-        let store = HandoffStore::new(roots.clone(), expected_product_id, expected_release_channel);
-        let handoff = store.load_request(run_id, now_ms())?;
-        let request = handoff.request().clone();
-        let source = probe_bound_source(&roots, &request)?;
-        let plan = store.load_authorized_plan(&handoff)?;
-        let report = handoff
-            .layout()
-            .read_json::<MigrationRunReport>(&handoff.layout().report_path())?;
-        let selection = plan
-            .as_ref()
-            .map(|plan| plan.selection.clone())
-            .unwrap_or_else(|| request.selection.clone());
-        let findings = plan
-            .as_ref()
-            .map(|plan| plan.findings.clone())
-            .unwrap_or_default();
-        let status = report
-            .as_ref()
-            .map(|report| report.status)
-            .unwrap_or_else(|| {
-                if plan.is_some() {
-                    MigrationRunStatus::Planned
-                } else if source.is_some() {
+    fn bootstrap_with(roots: MigrationRoots, settings_path: PathBuf) -> Self {
+        let probe = crate::locations::validate(&roots)
+            .and_then(|_| probe_legacy_source(&roots, ProbeLimits::default()));
+        let (source, mut error) = match probe {
+            Ok(source) => (source, None),
+            Err(error) => (None, Some(CommandError::from_legacy(&error))),
+        };
+        let saved_tasks = match list_tasks(&roots) {
+            Ok(tasks) => tasks,
+            Err(failure) => {
+                error = Some(CommandError::from_legacy(&failure));
+                Vec::new()
+            }
+        };
+        Self {
+            session: Arc::new(Mutex::new(MigratorSession {
+                roots,
+                settings_path,
+                saved_tasks,
+                request: TaskRequest {
+                    run_id: uuid::Uuid::new_v4().to_string(),
+                },
+                recovery: false,
+                status: if source.is_some() {
                     MigrationRunStatus::Discovered
                 } else {
                     MigrationRunStatus::default()
-                }
-            });
-        let blockers = writer_processes(request.caller_process_id)?;
-
-        Ok(Self {
-            session: Arc::new(Mutex::new(MigratorSession {
-                roots,
-                request,
-                disposition: handoff.disposition(),
+                },
                 source,
-                selection,
-                findings,
-                plan,
-                report,
+                error,
+                selection: MigrationSelection::all(),
+                findings: Vec::new(),
+                plan: None,
+                report: None,
                 progress: None,
-                blockers,
-                status,
+                blockers: Vec::new(),
                 running: false,
-                error: None,
                 cancellation: CancellationToken::default(),
             })),
-        })
+        }
+    }
+
+    pub(crate) fn set_locations(
+        &self,
+        roots: MigrationRoots,
+    ) -> Result<MigratorView, CommandError> {
+        let mut session = self.lock();
+        if session.running {
+            return Err(CommandError::operation_in_progress());
+        }
+        crate::locations::validate(&roots).map_err(|error| CommandError::from_legacy(&error))?;
+        atomic_write_json(&session.settings_path, &roots)
+            .map_err(|error| CommandError::from_legacy(&error))?;
+        let replacement = Self::bootstrap_with(roots, session.settings_path.clone());
+        std::mem::swap(&mut *session, &mut *replacement.lock());
+        Ok(snapshot(&session))
+    }
+
+    pub(crate) fn new_task(&self) -> Result<MigratorView, CommandError> {
+        let mut session = self.lock();
+        if session.running {
+            return Err(CommandError::operation_in_progress());
+        }
+        let replacement =
+            Self::bootstrap_with(session.roots.clone(), session.settings_path.clone());
+        std::mem::swap(&mut *session, &mut *replacement.lock());
+        Ok(snapshot(&session))
+    }
+
+    pub(crate) fn resume_task(&self, run_id: &str) -> Result<MigratorView, CommandError> {
+        let mut session = self.lock();
+        if session.running {
+            return Err(CommandError::operation_in_progress());
+        }
+        let (plan, report) =
+            load_task(&session.roots, run_id).map_err(|error| CommandError::from_legacy(&error))?;
+        session.request.run_id = run_id.to_string();
+        session.selection = plan.selection.clone();
+        session.findings = plan.findings.clone();
+        session.status = report
+            .as_ref()
+            .map(|report| report.status)
+            .unwrap_or(MigrationRunStatus::Planned);
+        session.plan = Some(plan);
+        session.report = report;
+        session.progress = None;
+        session.recovery = true;
+        session.error = None;
+        Ok(snapshot(&session))
     }
 
     pub(crate) fn snapshot(&self) -> MigratorView {
@@ -333,12 +357,12 @@ impl MigratorCoordinator {
     fn scan_background(
         &self,
         roots: MigrationRoots,
-        request: MigratorHandoffRequest,
+        _request: TaskRequest,
         selection: MigrationSelection,
         cancellation: CancellationToken,
     ) {
         let result = (|| {
-            let source = probe_bound_source(&roots, &request)?.ok_or_else(|| {
+            let source = probe_legacy_source(&roots, ProbeLimits::default())?.ok_or_else(|| {
                 LegacyMigrationError::UnsupportedSource(
                     "no supported legacy BitFun data was discovered".to_string(),
                 )
@@ -395,24 +419,25 @@ impl MigratorCoordinator {
     fn prepare_background(
         &self,
         roots: MigrationRoots,
-        request: MigratorHandoffRequest,
+        request: TaskRequest,
         selection: MigrationSelection,
         cancellation: CancellationToken,
     ) {
         let result = (|| {
-            let source = probe_bound_source(&roots, &request)?.ok_or_else(|| {
+            let source = probe_legacy_source(&roots, ProbeLimits::default())?.ok_or_else(|| {
                 LegacyMigrationError::UnsupportedSource(
                     "no supported legacy BitFun data was discovered".to_string(),
                 )
             })?;
-            let engine = migration_engine(roots, &selection)?;
+            let engine = migration_engine(roots.clone(), &selection)?;
             let plan = engine.plan_with_run_id(
                 &source,
                 selection.clone(),
                 request.run_id.clone(),
                 &cancellation,
             )?;
-            let blockers = writer_processes(request.caller_process_id)?;
+            save_task(&roots, &plan)?;
+            let blockers = writer_processes()?;
             Ok::<_, LegacyMigrationError>((source, plan, blockers))
         })();
 
@@ -424,6 +449,8 @@ impl MigratorCoordinator {
                 session.selection = selection;
                 session.findings = plan.findings.clone();
                 session.plan = Some(plan);
+                session.saved_tasks =
+                    list_tasks(&session.roots).unwrap_or_else(|_| session.saved_tasks.clone());
                 session.report = None;
                 session.blockers = blockers;
                 session.status = MigrationRunStatus::Planned;
@@ -445,8 +472,10 @@ impl MigratorCoordinator {
     }
 
     pub(crate) fn refresh_blockers(&self) -> Result<MigratorView, CommandError> {
-        let caller_process_id = self.lock().request.caller_process_id;
-        match writer_processes(caller_process_id) {
+        if self.is_running() {
+            return Err(CommandError::operation_in_progress());
+        }
+        match writer_processes() {
             Ok(blockers) => {
                 let mut session = self.lock();
                 session.blockers = blockers;
@@ -480,13 +509,25 @@ impl MigratorCoordinator {
                     true,
                 ));
             }
-            let store = HandoffStore::new(session.roots.clone(), product_id(), RELEASE_CHANNEL);
-            let handoff = store
-                .load_request(&session.request.run_id, now_ms())
-                .map_err(|error| CommandError::from_legacy(&error))?;
-            store
-                .authorize_plan(&handoff, &plan, now_ms())
+            let (saved, _) = load_task(&session.roots, &session.request.run_id)
                 .map_err(|error| CommandError::from_legacy(&error))?;
+            if saved != plan {
+                return Err(CommandError::new(
+                    "stale_plan",
+                    "Review the saved plan again before continuing.",
+                    true,
+                ));
+            }
+            if matches!(
+                session.status,
+                MigrationRunStatus::Completed | MigrationRunStatus::CompletedWithWarnings
+            ) {
+                return Err(CommandError::new(
+                    "task_completed",
+                    "This task is already complete. Start a new scan to import other data.",
+                    true,
+                ));
+            }
 
             session.cancellation = CancellationToken::default();
             session.running = true;
@@ -532,66 +573,29 @@ impl MigratorCoordinator {
         self.lock().running
     }
 
-    pub(crate) fn finish_and_restart(
-        &self,
-        choice: MigrationPromptChoice,
-    ) -> Result<(), CommandError> {
-        self.finish_with_restart(choice, || self.restart_desktop())
-    }
-
-    fn finish_with_restart(
-        &self,
-        choice: MigrationPromptChoice,
-        restart: impl FnOnce() -> LegacyMigrationResult<()>,
-    ) -> Result<(), CommandError> {
+    pub(crate) fn finish(&self) -> Result<(), CommandError> {
         if self.is_running() {
             return Err(CommandError::operation_in_progress());
         }
-        if choice == MigrationPromptChoice::Unset {
-            return Err(CommandError::new(
-                "invalid_prompt_choice",
-                "Choose whether to migrate now, be reminded later, or stop reminders.",
-                true,
-            ));
-        }
-        if choice == MigrationPromptChoice::MigrateNow && self.lock().report.is_none() {
-            return Err(CommandError::new(
-                "migration_result_required",
-                "A completed or recoverable migration report is required before finishing.",
-                true,
-            ));
-        }
-
-        let result = (|| {
-            self.persist_prompt_choice(choice)?;
-            restart()
-        })();
-        if let Err(error) = result {
-            let mut session = self.lock();
-            let command_error = self.finish_error_locked(&mut session, &error);
-            return Err(command_error);
-        }
         Ok(())
     }
 
-    pub(crate) fn close_and_restart(&self) -> Result<(), CommandError> {
-        let choice = if self.lock().report.is_some() {
-            MigrationPromptChoice::MigrateNow
-        } else {
-            MigrationPromptChoice::RemindLater
-        };
-        self.finish_and_restart(choice)
-    }
-
     fn begin_operation(
         &self,
         selection: &MigrationSelection,
-    ) -> Result<(MigrationRoots, MigratorHandoffRequest, CancellationToken), CommandError> {
+    ) -> Result<(MigrationRoots, TaskRequest, CancellationToken), CommandError> {
         let mut session = self.lock();
         if session.running {
             return Err(CommandError::operation_in_progress());
         }
-        validate_selection(&session.request, selection)?;
+        validate_selection(selection)?;
+        // A changed scan/selection is a new task. Never overwrite an old journal.
+        session.request.run_id = uuid::Uuid::new_v4().to_string();
+        session.recovery = false;
+        session.selection = selection.clone();
+        session.plan = None;
+        session.report = None;
+        session.findings.clear();
         session.cancellation = CancellationToken::default();
         session.running = true;
         session.error = None;
@@ -634,7 +638,7 @@ impl MigratorCoordinator {
     fn execute_background(
         &self,
         roots: MigrationRoots,
-        request: MigratorHandoffRequest,
+        _request: TaskRequest,
         plan: MigrationPlan,
         cancellation: CancellationToken,
     ) {
@@ -643,7 +647,7 @@ impl MigratorCoordinator {
                 self.finish_cancelled_before_execution(&plan);
                 return;
             }
-            match writer_processes(request.caller_process_id) {
+            match writer_processes() {
                 Ok(blockers) => {
                     let done = blockers.is_empty();
                     let mut session = self.lock();
@@ -694,8 +698,8 @@ impl MigratorCoordinator {
                 session.status = report.status;
                 session.report = Some(report);
                 session.error = None;
-                drop(session);
-                let _ = self.persist_prompt_choice(MigrationPromptChoice::MigrateNow);
+                session.saved_tasks =
+                    list_tasks(&session.roots).unwrap_or_else(|_| session.saved_tasks.clone());
             }
             Err(error) => {
                 let layout = MigrationLayout::new(&roots, &plan.run_id);
@@ -734,49 +738,6 @@ impl MigratorCoordinator {
         session.progress = Some(progress);
     }
 
-    fn persist_prompt_choice(&self, choice: MigrationPromptChoice) -> LegacyMigrationResult<()> {
-        let session = self.lock();
-        let store = MigrationOnboardingStore::new(session.roots.clone());
-        let request = &session.request;
-        let source = session.source.as_ref();
-        let has_report = session.report.is_some();
-        store.update(|state| {
-            state.format_version = CURRENT_MIGRATION_FORMAT_VERSION;
-            if let Some(source) = source {
-                state.source_fingerprint = source.source_fingerprint.clone();
-                state.detected_at_ms.get_or_insert_with(now_ms);
-            }
-            state.choice = choice;
-            state.last_prompted_version = Some(env!("CARGO_PKG_VERSION").to_string());
-            state.run_id = Some(request.run_id.clone());
-            state.handled_run_id = Some(request.run_id.clone());
-            if has_report {
-                state.last_report_run_id = Some(request.run_id.clone());
-            }
-        })?;
-        Ok(())
-    }
-
-    fn restart_desktop(&self) -> LegacyMigrationResult<()> {
-        let run_id = self.lock().request.run_id.clone();
-        #[cfg(debug_assertions)]
-        if let Some(directory) = std::env::var_os("OPENBITFUN_DEV_MIGRATION_DIR") {
-            return request_dev_restart(Path::new(&directory), &run_id);
-        }
-        let current = std::env::current_exe().map_err(|error| LegacyMigrationError::Io {
-            path: Path::new(DATA_MIGRATOR_BINARY_NAME).to_path_buf(),
-            source: error,
-        })?;
-        let executable = TrustedInstallationResolver::resolve_sibling(
-            &current,
-            DATA_MIGRATOR_BINARY_NAME,
-            DESKTOP_BINARY_NAME,
-        )?;
-        let arguments = [OsStr::new("--legacy-migration-run-id"), OsStr::new(&run_id)];
-        launch_trusted_executable(&executable, &arguments)?;
-        Ok(())
-    }
-
     fn finish_error_locked(
         &self,
         session: &mut MigratorSession,
@@ -806,46 +767,20 @@ impl MigratorCoordinator {
     }
 }
 
-#[cfg(debug_assertions)]
-fn request_dev_restart(directory: &Path, run_id: &str) -> LegacyMigrationResult<()> {
-    // Only the development supervisor supplies this private, per-launch channel.
-    // The migration request never supplies paths or executable names.
-    let handoff_path = directory.join("handoff.json");
-    let bytes = std::fs::read(&handoff_path).map_err(|source| LegacyMigrationError::Io {
-        path: handoff_path,
-        source,
-    })?;
-    let handoff: serde_json::Value = serde_json::from_slice(&bytes).map_err(|_| {
-        LegacyMigrationError::InvalidRequest("invalid development restart handoff".to_string())
-    })?;
-    if handoff["runId"].as_str() != Some(run_id)
-        || handoff["pid"].as_u64() != Some(u64::from(std::process::id()))
-    {
-        return Err(LegacyMigrationError::InvalidRequest(
-            "development restart handoff does not match this migrator".to_string(),
-        ));
-    }
-    openbitfun_legacy_migration::atomic_write_json(
-        &directory.join("restart.json"),
-        &serde_json::json!({ "runId": run_id }),
-    )
-}
-
 fn migration_engine(
     roots: MigrationRoots,
     selection: &MigrationSelection,
 ) -> LegacyMigrationResult<MigrationEngine> {
+    crate::locations::validate(&roots)?;
+    openbitfun_legacy_migration_adapters::validate_target(&roots)?;
     MigrationEngine::new(roots, adapters_for_groups(selection))
 }
 
-fn writer_processes(caller_process_id: u32) -> LegacyMigrationResult<Vec<WriterProcess>> {
-    blocking_writer_processes_for_product(caller_process_id, &[DESKTOP_BINARY_NAME])
+fn writer_processes() -> LegacyMigrationResult<Vec<WriterProcess>> {
+    blocking_writer_processes(0)
 }
 
-fn validate_selection(
-    request: &MigratorHandoffRequest,
-    selection: &MigrationSelection,
-) -> Result<(), CommandError> {
+fn validate_selection(selection: &MigrationSelection) -> Result<(), CommandError> {
     if selection.groups.is_empty() {
         return Err(CommandError::new(
             "empty_selection",
@@ -853,51 +788,16 @@ fn validate_selection(
             true,
         ));
     }
-    if request.mode == MigratorRequestMode::Execute && request.selection != *selection {
-        return Err(CommandError::new(
-            "selection_mismatch",
-            "The selected groups differ from the scope confirmed in OpenBitFun.",
-            false,
-        ));
-    }
     Ok(())
 }
 
-fn probe_bound_source(
-    roots: &MigrationRoots,
-    request: &MigratorHandoffRequest,
-) -> LegacyMigrationResult<Option<LegacySourceDescriptor>> {
-    let source = probe_legacy_source(roots, ProbeLimits::default())?;
-    if let Some(source) = &source {
-        if request
-            .source_id
-            .as_deref()
-            .is_some_and(|source_id| source_id != source.source_id)
-            || request
-                .source_fingerprint
-                .as_deref()
-                .is_some_and(|fingerprint| fingerprint != source.source_fingerprint)
-        {
-            return Err(LegacyMigrationError::InvalidRequest(
-                "discovered source does not match the authenticated handoff".to_string(),
-            ));
-        }
-    } else if request.source_id.is_some() || request.source_fingerprint.is_some() {
-        return Err(LegacyMigrationError::InvalidRequest(
-            "authenticated handoff source is no longer present".to_string(),
-        ));
-    }
-    Ok(source)
-}
-
 fn snapshot(session: &MigratorSession) -> MigratorView {
     let plan = session.plan.as_ref().map(redact_plan_for_ui);
     let report = session.report.as_ref().map(redact_report_for_ui);
     MigratorView {
-        delivery_profile: DeliveryProfile::DataMigrator.id().to_string(),
-        restart_desktop_on_finish: true,
-        protocol: MigratorProtocolCapabilities::current(),
-        mode: session.request.mode,
+        tool_version: env!("CARGO_PKG_VERSION").to_string(),
+        locations: session.roots.clone(),
+        saved_tasks: session.saved_tasks.clone(),
         source: session.source.clone(),
         selection: session.selection.clone(),
         findings: session
@@ -911,14 +811,18 @@ fn snapshot(session: &MigratorSession) -> MigratorView {
                 .source
                 .as_ref()
                 .is_some_and(|source| source.supported)
-            && !session.running,
+            && !session.running
+            && !matches!(
+                session.status,
+                MigrationRunStatus::Completed | MigrationRunStatus::CompletedWithWarnings
+            ),
         plan,
         report,
         progress: session.progress.clone(),
         blockers: session.blockers.clone(),
         status: session.status,
         running: session.running,
-        recovery: session.disposition == HandoffDisposition::Recovery,
+        recovery: session.recovery,
         error: session.error.clone(),
     }
 }
@@ -973,24 +877,11 @@ fn status_for_phase(phase: MigrationPhase) -> MigrationRunStatus {
     }
 }
 
-fn now_ms() -> i64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .unwrap_or_default()
-        .as_millis()
-        .try_into()
-        .unwrap_or(i64::MAX)
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
-    use openbitfun_product_domains::legacy_migration::{
-        MigratorProtocolCapability, MigratorRequestOrigin, CURRENT_MIGRATOR_PROTOCOL_VERSION,
-    };
-    use std::collections::BTreeSet;
     use std::fs;
-
+    use std::path::Path;
     fn fixture_roots(root: &Path) -> MigrationRoots {
         MigrationRoots {
             legacy_user_root: root.join("legacy/user"),
@@ -1004,103 +895,78 @@ mod tests {
         }
     }
 
-    fn handoff_request() -> MigratorHandoffRequest {
-        let current = now_ms();
-        MigratorHandoffRequest {
-            protocol_version: CURRENT_MIGRATOR_PROTOCOL_VERSION,
-            mode: MigratorRequestMode::Onboarding,
-            origin: MigratorRequestOrigin::FirstLaunch,
-            run_id: uuid::Uuid::new_v4().to_string(),
-            nonce: uuid::Uuid::new_v4().to_string(),
-            selection: MigrationSelection::all(),
-            caller_process_id: u32::MAX,
-            product_id: "openbitfun".to_string(),
-            release_channel: "stable".to_string(),
-            created_at_ms: current,
-            expires_at_ms: current + 60_000,
-            required_capabilities: BTreeSet::from([
-                MigratorProtocolCapability::ReadOnlyScan,
-                MigratorProtocolCapability::JournalRecovery,
-            ]),
-            ..MigratorHandoffRequest::default()
-        }
-    }
-
-    fn write_probe_fixture(roots: &MigrationRoots) {
-        let config = roots.legacy_user_root.join("config");
-        fs::create_dir_all(&config).unwrap();
-        fs::write(config.join("app.json"), br#"{"version":"0.2.19"}"#).unwrap();
-    }
-
     #[test]
-    fn bootstrap_consumes_the_real_non_agent_delivery_profile() {
-        let temporary = tempfile::tempdir().unwrap();
-        let roots = fixture_roots(temporary.path());
-        write_probe_fixture(&roots);
-        let request = handoff_request();
-        HandoffStore::new(roots.clone(), "openbitfun", "stable")
-            .write_request(&request, now_ms())
-            .unwrap();
-
-        let coordinator =
-            MigratorCoordinator::bootstrap_with(&request.run_id, roots, "openbitfun", "stable")
-                .unwrap();
+    fn starts_without_desktop_request_or_data() {
+        let temp = tempfile::tempdir().unwrap();
+        let roots = fixture_roots(temp.path());
+        let coordinator = MigratorCoordinator::bootstrap_with(
+            roots.clone(),
+            temp.path().join("tool/locations.json"),
+        );
         let view = coordinator.snapshot();
-
-        assert_eq!(view.delivery_profile, "data-migrator");
-        assert!(view.restart_desktop_on_finish);
-        assert_eq!(view.mode, MigratorRequestMode::Onboarding);
-        assert!(view.source.is_some());
-        assert!(!view.recovery);
-    }
-
-    #[test]
-    fn execute_handoff_rejects_a_scope_change() {
-        let mut request = handoff_request();
-        request.mode = MigratorRequestMode::Execute;
-        let mut changed = request.selection.clone();
-        changed
-            .groups
-            .remove(&openbitfun_product_domains::legacy_migration::MigrationGroupId::Memory);
-
-        let error = validate_selection(&request, &changed).unwrap_err();
-        assert_eq!(error.code, "selection_mismatch");
+        assert!(view.source.is_none());
+        assert!(view.error.is_none());
+        assert!(!view.running);
+        coordinator.finish().unwrap();
+        assert!(!roots.target_user_root.exists());
     }
 
     #[test]
-    fn cancelled_scan_finishes_in_an_explicit_cancelled_state() {
-        let temporary = tempfile::tempdir().unwrap();
-        let roots = fixture_roots(temporary.path());
-        write_probe_fixture(&roots);
-        let request = handoff_request();
-        HandoffStore::new(roots.clone(), "openbitfun", "stable")
-            .write_request(&request, now_ms())
-            .unwrap();
-        let coordinator = MigratorCoordinator::bootstrap_with(
-            &request.run_id,
-            roots.clone(),
-            "openbitfun",
-            "stable",
+    fn cancelled_scan_preserves_safe_boundary() {
+        let temp = tempfile::tempdir().unwrap();
+        let roots = fixture_roots(temp.path());
+        fs::create_dir_all(roots.legacy_user_root.join("config")).unwrap();
+        fs::write(
+            roots.legacy_user_root.join("config/app.json"),
+            br#"{"version":"0.2.19"}"#,
         )
         .unwrap();
+        let coordinator =
+            MigratorCoordinator::bootstrap_with(roots, temp.path().join("tool/locations.json"));
         let selection = MigrationSelection::all();
         let (roots, request, cancellation) = coordinator.begin_operation(&selection).unwrap();
+        assert!(coordinator.finish().is_err());
+        assert!(coordinator.new_task().is_err());
         cancellation.cancel();
         coordinator.scan_background(roots, request, selection, cancellation);
+        assert_eq!(coordinator.snapshot().status, MigrationRunStatus::Cancelled);
+        assert!(!coordinator.is_running());
+    }
 
-        let view = coordinator.snapshot();
-        assert!(!view.running);
-        assert_eq!(view.status, MigrationRunStatus::Cancelled);
-        assert_eq!(
-            view.error.map(|error| error.code).as_deref(),
-            Some("cancelled")
-        );
-        assert_eq!(
-            view.progress.map(|progress| progress.code).as_deref(),
-            Some("migration_cancelled")
-        );
+    #[test]
+    fn rejects_nested_locations_without_writing_preferences() {
+        let temp = tempfile::tempdir().unwrap();
+        let mut roots = fixture_roots(temp.path());
+        let settings = temp.path().join("tool/locations.json");
+        let coordinator = MigratorCoordinator::bootstrap_with(roots.clone(), settings.clone());
+        roots.target_home_root = roots.legacy_user_root.join("nested");
+        assert!(coordinator.set_locations(roots).is_err());
+        assert!(!settings.exists());
     }
 
+    #[test]
+    fn unsupported_target_is_rejected_before_scan_or_any_writes() {
+        let temp = tempfile::tempdir().unwrap();
+        let roots = fixture_roots(temp.path());
+        assert!(migration_engine(roots.clone(), &MigrationSelection::all()).is_ok());
+        assert!(!roots.target_user_root.exists());
+        let target = roots.target_user_root.join("config/app.json");
+        for value in [
+            serde_json::json!({"product_id":"openbitfun", "schema_version":999, "version":"9.0.0"}),
+            serde_json::json!({"product_id":"other-product", "schema_version":1, "version":"1.0.0"}),
+            serde_json::json!({"version":"0.2.19"}),
+        ] {
+            atomic_write_json(&target, &value).unwrap();
+            let before = fs::read(&target).unwrap();
+            assert!(matches!(
+                migration_engine(roots.clone(), &MigrationSelection::all()),
+                Err(LegacyMigrationError::UnsupportedTarget(_))
+            ));
+            assert_eq!(fs::read(&target).unwrap(), before);
+            assert!(!roots.migration_root().exists());
+            assert!(!roots.legacy_user_root.exists());
+        }
+    }
     #[test]
     fn command_errors_do_not_expose_storage_paths() {
         let error = LegacyMigrationError::Io {
@@ -1141,93 +1007,4 @@ mod tests {
         assert!(!serialized.contains("private"));
         assert!(!serialized.contains("session-state"));
     }
-
-    #[test]
-    fn dismissing_onboarding_persists_choice_and_restarts_desktop() {
-        for choice in [
-            MigrationPromptChoice::DoNotRemind,
-            MigrationPromptChoice::RemindLater,
-        ] {
-            let temporary = tempfile::tempdir().unwrap();
-            let roots = fixture_roots(temporary.path());
-            write_probe_fixture(&roots);
-            let request = handoff_request();
-            HandoffStore::new(roots.clone(), "openbitfun", "stable")
-                .write_request(&request, now_ms())
-                .unwrap();
-            let coordinator = MigratorCoordinator::bootstrap_with(
-                &request.run_id,
-                roots.clone(),
-                "openbitfun",
-                "stable",
-            )
-            .unwrap();
-            let mut restarted = false;
-            coordinator
-                .finish_with_restart(choice, || {
-                    // Restart must observe the saved choice and one-time restart receipt.
-                    let state = MigrationOnboardingStore::new(roots.clone()).load().unwrap();
-                    assert_eq!(state.choice, choice);
-                    assert_eq!(
-                        state.handled_run_id.as_deref(),
-                        Some(request.run_id.as_str())
-                    );
-                    restarted = true;
-                    Ok(())
-                })
-                .unwrap();
-            assert!(restarted);
-            assert!(coordinator.snapshot().restart_desktop_on_finish);
-        }
-    }
-
-    #[test]
-    fn failed_restart_stays_visible_and_keeps_the_saved_choice() {
-        let temporary = tempfile::tempdir().unwrap();
-        let roots = fixture_roots(temporary.path());
-        write_probe_fixture(&roots);
-        let request = handoff_request();
-        HandoffStore::new(roots.clone(), "openbitfun", "stable")
-            .write_request(&request, now_ms())
-            .unwrap();
-        let coordinator = MigratorCoordinator::bootstrap_with(
-            &request.run_id,
-            roots.clone(),
-            "openbitfun",
-            "stable",
-        )
-        .unwrap();
-        assert!(coordinator
-            .finish_with_restart(MigrationPromptChoice::DoNotRemind, || {
-                Err(LegacyMigrationError::TrustedInstallationUnavailable(
-                    "missing desktop".into(),
-                ))
-            })
-            .is_err());
-        assert!(coordinator.snapshot().error.is_some());
-        assert_eq!(
-            MigrationOnboardingStore::new(roots).load().unwrap().choice,
-            MigrationPromptChoice::DoNotRemind
-        );
-    }
-
-    #[test]
-    #[cfg(debug_assertions)]
-    fn development_restart_requires_matching_handoff() {
-        let temporary = tempfile::tempdir().unwrap();
-        let run_id = uuid::Uuid::new_v4().to_string();
-        let handoff = temporary.path().join("handoff.json");
-        openbitfun_legacy_migration::atomic_write_json(
-            &handoff,
-            &serde_json::json!({ "runId": run_id, "pid": std::process::id() }),
-        )
-        .unwrap();
-        assert!(request_dev_restart(temporary.path(), "wrong-run").is_err());
-        assert!(!temporary.path().join("restart.json").exists());
-        request_dev_restart(temporary.path(), &run_id).unwrap();
-        let restart: serde_json::Value =
-            serde_json::from_slice(&std::fs::read(temporary.path().join("restart.json")).unwrap())
-                .unwrap();
-        assert_eq!(restart["runId"], run_id);
-    }
 }
diff --git a/src/apps/data-migrator/src/commands.rs b/src/apps/data-migrator/src/commands.rs
index be2dd043da..e9bf9de2e9 100644
--- a/src/apps/data-migrator/src/commands.rs
+++ b/src/apps/data-migrator/src/commands.rs
@@ -1,5 +1,6 @@
 use crate::app_state::{CommandError, DiagnosticsExportView, MigratorCoordinator, MigratorView};
-use openbitfun_product_domains::legacy_migration::{MigrationPromptChoice, MigrationSelection};
+use openbitfun_legacy_migration::MigrationRoots;
+use openbitfun_product_domains::legacy_migration::MigrationSelection;
 use serde::Deserialize;
 use tauri::{AppHandle, State};
 
@@ -21,8 +22,39 @@ pub(crate) struct ExecuteRequest {
 
 #[derive(Debug, Deserialize)]
 #[serde(deny_unknown_fields, rename_all = "camelCase")]
-pub(crate) struct PromptChoiceRequest {
-    pub choice: MigrationPromptChoice,
+pub(crate) struct LocationsRequest {
+    pub locations: MigrationRoots,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub(crate) struct ResumeRequest {
+    pub run_id: String,
+}
+
+#[tauri::command]
+pub(crate) fn set_migration_locations(
+    state: State<'_, MigratorCoordinator>,
+    request: LocationsRequest,
+) -> Result<MigratorView, CommandError> {
+    state.set_locations(request.locations)
+}
+
+#[tauri::command]
+pub(crate) fn new_migration_task(
+    state: State<'_, MigratorCoordinator>,
+    request: EmptyRequest,
+) -> Result<MigratorView, CommandError> {
+    let _ = request;
+    state.new_task()
+}
+
+#[tauri::command]
+pub(crate) fn resume_migration_task(
+    state: State<'_, MigratorCoordinator>,
+    request: ResumeRequest,
+) -> Result<MigratorView, CommandError> {
+    state.resume_task(&request.run_id)
 }
 
 #[tauri::command]
@@ -89,9 +121,10 @@ pub(crate) fn export_migration_diagnostics(
 pub(crate) fn finish_legacy_migration(
     app: AppHandle,
     state: State<'_, MigratorCoordinator>,
-    request: PromptChoiceRequest,
+    request: EmptyRequest,
 ) -> Result<(), CommandError> {
-    state.finish_and_restart(request.choice)?;
+    let _ = request;
+    state.finish()?;
     app.exit(0);
     Ok(())
 }
diff --git a/src/apps/data-migrator/src/lib.rs b/src/apps/data-migrator/src/lib.rs
index 64894deb98..b50be4419b 100644
--- a/src/apps/data-migrator/src/lib.rs
+++ b/src/apps/data-migrator/src/lib.rs
@@ -1,5 +1,6 @@
 mod app_state;
 mod commands;
+mod locations;
 
 use app_state::MigratorCoordinator;
 use std::fmt;
@@ -22,10 +23,14 @@ impl fmt::Display for RunError {
 
 impl std::error::Error for RunError {}
 
-pub fn run(run_id: &str) -> Result<(), RunError> {
-    let coordinator = MigratorCoordinator::bootstrap(run_id).map_err(|_| RunError::Bootstrap)?;
+pub fn run() -> Result<(), RunError> {
     tauri::Builder::default()
-        .manage(coordinator)
+        .setup(|app| {
+            let settings = app.path().app_config_dir()?.join("locations.json");
+            let coordinator = MigratorCoordinator::bootstrap(settings)?;
+            app.manage(coordinator);
+            Ok(())
+        })
         .on_window_event(|window, event| {
             if let tauri::WindowEvent::CloseRequested { api, .. } = event {
                 let coordinator = window.app_handle().state::<MigratorCoordinator>();
@@ -34,13 +39,16 @@ pub fn run(run_id: &str) -> Result<(), RunError> {
                     coordinator.cancel();
                     return;
                 }
-                if coordinator.close_and_restart().is_ok() {
+                if coordinator.finish().is_ok() {
                     window.app_handle().exit(0);
                 }
             }
         })
         .invoke_handler(tauri::generate_handler![
             commands::get_migrator_bootstrap,
+            commands::set_migration_locations,
+            commands::new_migration_task,
+            commands::resume_migration_task,
             commands::scan_legacy_migration,
             commands::prepare_legacy_migration,
             commands::retry_writer_check,
diff --git a/src/apps/data-migrator/src/locations.rs b/src/apps/data-migrator/src/locations.rs
new file mode 100644
index 0000000000..d2f0569d5f
--- /dev/null
+++ b/src/apps/data-migrator/src/locations.rs
@@ -0,0 +1,89 @@
+//! Local user-selected locations, independent of Desktop configuration.
+use openbitfun_legacy_migration::{LegacyMigrationError, LegacyMigrationResult, MigrationRoots};
+use std::path::{Component, Path, PathBuf};
+
+pub(crate) fn validate(roots: &MigrationRoots) -> LegacyMigrationResult<()> {
+    let sources = [
+        &roots.legacy_user_root,
+        &roots.legacy_home_root,
+        &roots.legacy_skills_root,
+        &roots.legacy_ssh_root,
+    ];
+    let targets = [
+        &roots.target_user_root,
+        &roots.target_home_root,
+        &roots.target_skills_root,
+        &roots.target_ssh_root,
+    ];
+    let sources = sources
+        .into_iter()
+        .map(normalized)
+        .collect::<LegacyMigrationResult<Vec<_>>>()?;
+    let targets = targets
+        .into_iter()
+        .map(normalized)
+        .collect::<LegacyMigrationResult<Vec<_>>>()?;
+    for source in &sources {
+        for target in &targets {
+            if source.starts_with(target) || target.starts_with(source) {
+                return Err(LegacyMigrationError::SourceEqualsTarget(source.clone()));
+            }
+        }
+    }
+    Ok(())
+}
+
+fn normalized(path: &PathBuf) -> LegacyMigrationResult<PathBuf> {
+    if !path.is_absolute()
+        || path.parent().is_none()
+        || path
+            .components()
+            .any(|part| matches!(part, Component::ParentDir))
+    {
+        return Err(LegacyMigrationError::PathUnavailable(
+            "choose an absolute local data directory".into(),
+        ));
+    }
+    // Resolve existing parents too: destinations often do not exist yet.
+    let mut parent: &Path = path;
+    let mut suffix = Vec::new();
+    while !parent.exists() {
+        suffix.push(
+            parent
+                .file_name()
+                .ok_or_else(|| LegacyMigrationError::PathUnavailable("data directory".into()))?,
+        );
+        parent = parent
+            .parent()
+            .ok_or_else(|| LegacyMigrationError::PathUnavailable("data directory".into()))?;
+    }
+    if !parent.is_dir() {
+        return Err(LegacyMigrationError::PathUnavailable(
+            "data directory".into(),
+        ));
+    }
+    let mut resolved =
+        std::fs::canonicalize(parent).map_err(|source| LegacyMigrationError::Io {
+            path: parent.to_path_buf(),
+            source,
+        })?;
+    for part in suffix.into_iter().rev() {
+        resolved.push(part);
+    }
+    if cfg!(windows) {
+        resolved = PathBuf::from(resolved.to_string_lossy().to_lowercase());
+    }
+    Ok(resolved)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn normalizes_missing_children_and_rejects_relative_paths() {
+        let temp = tempfile::tempdir().unwrap();
+        assert!(normalized(&temp.path().join("missing/child")).is_ok());
+        assert!(normalized(&PathBuf::from("relative/data")).is_err());
+        assert!(normalized(&temp.path().join("../escape")).is_err());
+    }
+}
diff --git a/src/apps/data-migrator/src/main.rs b/src/apps/data-migrator/src/main.rs
index d73be4545e..27588eb2a5 100644
--- a/src/apps/data-migrator/src/main.rs
+++ b/src/apps/data-migrator/src/main.rs
@@ -3,18 +3,7 @@
 use std::process::ExitCode;
 
 fn main() -> ExitCode {
-    let mut arguments = std::env::args_os().skip(1);
-    let Some(run_id) = arguments.next() else {
-        return ExitCode::from(2);
-    };
-    if arguments.next().is_some() {
-        return ExitCode::from(2);
-    }
-    let Some(run_id) = run_id.to_str() else {
-        return ExitCode::from(2);
-    };
-
-    match openbitfun_data_migrator_lib::run(run_id) {
+    match openbitfun_data_migrator_lib::run() {
         Ok(()) => ExitCode::SUCCESS,
         Err(_) => ExitCode::from(1),
     }
diff --git a/src/apps/data-migrator/tauri.conf.json b/src/apps/data-migrator/tauri.conf.json
index c7b678c1c6..5383a891e9 100644
--- a/src/apps/data-migrator/tauri.conf.json
+++ b/src/apps/data-migrator/tauri.conf.json
@@ -1,6 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "OpenBitFun Data Migrator",
+  "version": "0.1.0",
   "mainBinaryName": "openbitfun-data-migrator",
   "identifier": "com.openbitfun.data-migrator",
   "build": {
@@ -11,9 +12,9 @@
     "targets": "all",
     "publisher": "OpenBitFun Team",
     "icon": [
-      "../desktop/icons/openbitfun-app-icon.icns",
-      "../desktop/icons/openbitfun-app-icon.ico",
-      "../desktop/icons/openbitfun-app-icon.png"
+      "icons/openbitfun-app-icon.icns",
+      "icons/openbitfun-app-icon.ico",
+      "icons/openbitfun-app-icon.png"
     ],
     "resources": {
       "../../../THIRD_PARTY_NOTICES.md": "THIRD_PARTY_NOTICES.md"
@@ -34,7 +35,7 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src ipc: http://ipc.localhost"
+      "csp": "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self' ipc: http://ipc.localhost"
     },
     "withGlobalTauri": true
   }
diff --git a/src/apps/data-migrator/ui/app.js b/src/apps/data-migrator/ui/app.js
index df1ca5b99b..ec21b9f52a 100644
--- a/src/apps/data-migrator/ui/app.js
+++ b/src/apps/data-migrator/ui/app.js
@@ -1,90 +1,27 @@
-const invoke = window.__TAURI__.core.invoke;
+import { invoke } from './transport.js';
+
+async function loadTranslations() {
+  try {
+    const response = await fetch('locales.json');
+    if (!response.ok) throw new Error('Locale asset unavailable');
+    const catalogs = await response.json();
+    if (!catalogs.en) throw new Error('Default locale unavailable');
+    return catalogs;
+  } catch (error) {
+    const output = document.getElementById('notice');
+    output.textContent = 'Data Migrator could not load its language files. Close it and download or rebuild the complete package.';
+    output.hidden = false;
+    document.querySelectorAll('button, select').forEach((node) => { node.disabled = true; });
+    throw error;
+  }
+}
+const translations = await loadTranslations();
 
-const translations = {
-  en: {
-    eyebrow: 'OpenBitFun maintenance', title: 'Import data from BitFun',
-    intro: 'Choose what to bring forward. Your original BitFun data will not be deleted.',
-    stepSource: 'Step 1', sourceTitle: 'Legacy source', firstLaunch: 'First launch',
-    choiceTitle: 'What would you like to do?',
-    choiceHelp: 'Migration runs only after OpenBitFun and other data writers have stopped.',
-    migrateNow: 'Migrate now', remindLater: 'Remind me later', doNotRemind: 'Do not remind me',
-    stepScope: 'Step 2', scopeTitle: 'Choose migration scope', scan: 'Scan selected data',
-    stepReview: 'Step 3', reviewTitle: 'Review scan', prepare: 'Run preflight plan',
-    stepConfirm: 'Step 4', planTitle: 'Confirm migration', retryWriters: 'Check processes again',
-    start: 'Start migration', stepProgress: 'Step 5', progressTitle: 'Migration progress',
-    phase: 'Phase', domain: 'Domain', count: 'Completed steps',
-    cancel: 'Cancel', stepDone: 'Result', reportTitle: 'Migration report',
-    reportPrivacy: 'This summary contains counts and result codes, not credentials or user content.',
-    exportDiagnostics: 'Export failure diagnostics',
-    diagnosticsExported: 'Sanitized diagnostics saved to {path}',
-    openDesktop: 'Open OpenBitFun', ready: 'Ready', unsupported: 'Unsupported', missing: 'Not found',
-    closeMigrator: 'Close Data Migrator',
-    devRestartHelp: 'Development build: close Data Migrator, then run pnpm run desktop:dev again.',
-    bootstrapPending: 'Data Migrator is still loading. Please try again.',
-    bootstrapFailed: 'Data Migrator could not load its authenticated migration request.',
-    sourceFound: 'BitFun {version} was found. The source stays read-only.',
-    recovery: 'A previous migration journal was found and can be resumed.',
-    blockers: '{count} data-writing process(es) must stop before migration can continue.',
-    noBlockers: 'No data-writing processes are blocking migration.',
-    steps: '{count} migration step(s)', conflicts: '{count} conflict(s)',
-    imported: 'imported', staged: 'staged', skipped: 'skipped', warnings: 'warnings',
-  },
-  'zh-CN': {
-    eyebrow: 'OpenBitFun 数据维护', title: '从 BitFun 导入数据',
-    intro: '选择要迁移的内容。原始 BitFun 数据不会被删除。', stepSource: '第 1 步',
-    sourceTitle: '旧版数据来源', firstLaunch: '首次启动', choiceTitle: '你希望如何处理？',
-    choiceHelp: '迁移只会在 OpenBitFun 和其他数据写入进程停止后运行。', migrateNow: '立即迁移',
-    remindLater: '稍后提醒', doNotRemind: '不再提醒', stepScope: '第 2 步',
-    scopeTitle: '选择迁移范围', scan: '扫描所选数据', stepReview: '第 3 步',
-    reviewTitle: '检查扫描结果', prepare: '运行迁移预检', stepConfirm: '第 4 步',
-    planTitle: '确认迁移', retryWriters: '重新检查进程', start: '开始迁移',
-    stepProgress: '第 5 步', progressTitle: '迁移进度', phase: '阶段', domain: '领域',
-    count: '已完成步骤', cancel: '取消', stepDone: '结果', reportTitle: '迁移报告',
-    reportPrivacy: '此摘要仅包含计数和结果码，不包含凭据或用户正文。',
-    exportDiagnostics: '导出失败诊断', diagnosticsExported: '去敏诊断已保存到 {path}',
-    openDesktop: '打开 OpenBitFun',
-    closeMigrator: '关闭数据迁移器',
-    devRestartHelp: '开发版本：关闭数据迁移器，然后重新运行 pnpm run desktop:dev。',
-    bootstrapPending: '数据迁移器仍在加载，请稍后重试。',
-    bootstrapFailed: '数据迁移器无法加载已认证的迁移请求。',
-    ready: '可迁移', unsupported: '不受支持', missing: '未发现',
-    sourceFound: '已发现 BitFun {version}。迁移期间来源保持只读。',
-    recovery: '发现上次迁移日志，可以从安全状态继续。',
-    blockers: '迁移前还需停止 {count} 个数据写入进程。', noBlockers: '没有进程阻止迁移。',
-    steps: '{count} 个迁移步骤', conflicts: '{count} 个冲突',
-    imported: '已导入', staged: '已暂存', skipped: '已跳过', warnings: '警告',
-  },
-  'zh-TW': {
-    eyebrow: 'OpenBitFun 資料維護', title: '從 BitFun 匯入資料',
-    intro: '選擇要遷移的內容。原始 BitFun 資料不會被刪除。', stepSource: '第 1 步',
-    sourceTitle: '舊版資料來源', firstLaunch: '首次啟動', choiceTitle: '你希望如何處理？',
-    choiceHelp: '遷移只會在 OpenBitFun 和其他資料寫入程序停止後執行。', migrateNow: '立即遷移',
-    remindLater: '稍後提醒', doNotRemind: '不再提醒', stepScope: '第 2 步',
-    scopeTitle: '選擇遷移範圍', scan: '掃描所選資料', stepReview: '第 3 步',
-    reviewTitle: '檢查掃描結果', prepare: '執行遷移預檢', stepConfirm: '第 4 步',
-    planTitle: '確認遷移', retryWriters: '重新檢查程序', start: '開始遷移',
-    stepProgress: '第 5 步', progressTitle: '遷移進度', phase: '階段', domain: '領域',
-    count: '已完成步驟', cancel: '取消', stepDone: '結果', reportTitle: '遷移報告',
-    reportPrivacy: '此摘要僅包含計數和結果碼，不包含憑據或使用者正文。',
-    exportDiagnostics: '匯出失敗診斷', diagnosticsExported: '去敏診斷已儲存至 {path}',
-    openDesktop: '開啟 OpenBitFun',
-    closeMigrator: '關閉資料遷移器',
-    devRestartHelp: '開發版本：關閉資料遷移器，然後重新執行 pnpm run desktop:dev。',
-    bootstrapPending: '資料遷移器仍在載入，請稍後重試。',
-    bootstrapFailed: '資料遷移器無法載入已驗證的遷移請求。',
-    ready: '可遷移', unsupported: '不支援', missing: '未發現',
-    sourceFound: '已發現 BitFun {version}。遷移期間來源保持唯讀。',
-    recovery: '發現上次遷移日誌，可以從安全狀態繼續。',
-    blockers: '遷移前還需停止 {count} 個資料寫入程序。', noBlockers: '沒有程序阻止遷移。',
-    steps: '{count} 個遷移步驟', conflicts: '{count} 個衝突',
-    imported: '已匯入', staged: '已暫存', skipped: '已略過', warnings: '警告',
-  },
-};
 
-const locale = navigator.language.startsWith('zh-TW') || navigator.language.startsWith('zh-HK')
+const locale = localStorage.getItem('migrator.language') || (navigator.language.startsWith('zh-TW') || navigator.language.startsWith('zh-HK')
   ? 'zh-TW'
-  : navigator.language.startsWith('zh') ? 'zh-CN' : 'en';
-const text = translations[locale];
+  : navigator.language.startsWith('zh') ? 'zh-CN' : 'en');
+const text = translations[locale] || translations.en;
 document.documentElement.lang = locale;
 document.querySelectorAll('[data-i18n]').forEach((node) => {
   node.textContent = text[node.dataset.i18n] || translations.en[node.dataset.i18n];
@@ -120,6 +57,9 @@ const groups = [
 
 let current;
 let pollTimer;
+let locationsDirty = false;
+let locationSnapshot;
+let scopeSnapshot;
 
 function format(template, values) {
   return Object.entries(values).reduce((value, [key, replacement]) =>
@@ -134,9 +74,10 @@ function setBusy(busy) {
   document.querySelectorAll('button').forEach((button) => { button.disabled = busy; });
 }
 
-function notice(message) {
+function notice(message, tone = 'danger') {
   const node = document.getElementById('notice');
   node.textContent = message || '';
+  node.dataset.tone = tone;
   node.hidden = !message;
 }
 
@@ -161,8 +102,16 @@ function transferLabel(result) {
   return result.state === 'verified' ? text.imported : text.staged;
 }
 
+function groupLabel(id) {
+  const labels = groups.find(([group]) => group === id)?.[1];
+  return (labels?.[locale] || labels?.en || [id])[0];
+}
+
 function renderScopes(selection) {
   const list = document.getElementById('scope-list');
+  const signature = JSON.stringify([selection, current?.recovery, current?.running]);
+  if (signature === scopeSnapshot) return;
+  scopeSnapshot = signature;
   list.replaceChildren();
   const selected = new Set(selection?.groups?.length ? selection.groups : groups.map(([id]) => id));
   groups.forEach(([id, labels]) => {
@@ -173,7 +122,7 @@ function renderScopes(selection) {
     checkbox.id = `scope-${id}`;
     checkbox.value = id;
     checkbox.checked = selected.has(id);
-    if (current?.mode === 'execute') checkbox.disabled = true;
+    checkbox.disabled = Boolean(current?.running || current?.recovery);
     const label = document.createElement('label');
     label.htmlFor = checkbox.id;
     const strong = document.createElement('strong');
@@ -196,13 +145,28 @@ function render(view) {
   const source = view.source;
   document.getElementById('source-badge').textContent = !source
     ? text.missing : source.supported ? text.ready : text.unsupported;
+  document.getElementById('source-badge').dataset.tone = !source || !source.supported
+    ? 'warning' : 'success';
   document.getElementById('source-summary').textContent = source
     ? format(text.sourceFound, { version: source.productVersion }) : text.missing;
-  document.getElementById('source-path').textContent = source?.roots?.[0]?.displayPath || '';
-  notice(view.error?.message || (view.recovery ? text.recovery : ''));
+  if (!source) document.getElementById('source-summary').textContent = text.noSource;
+  renderLocations(view.locations);
+  document.getElementById('tool-version').textContent = 'v' + view.toolVersion;
+  const tasks = document.getElementById('saved-task');
+  const previousTask = tasks.value;
+  tasks.replaceChildren(...view.savedTasks.map((task) => {
+    const option = document.createElement('option');
+    option.value = task.runId;
+    option.textContent = task.runId + ' · ' + (task.readable ? task.status : text.unreadableTask);
+    option.disabled = !task.readable;
+    return option;
+  }));
+  if ([...tasks.options].some((option) => option.value === previousTask && !option.disabled)) tasks.value = previousTask;
+  show('history-card', view.savedTasks.length > 0 && !view.running);
+  document.getElementById('resume-task').disabled = !tasks.selectedOptions[0] || tasks.selectedOptions[0].disabled || view.running || locationsDirty;
+  notice(view.error?.message || (view.recovery ? text.recovery : ''), view.error ? 'danger' : 'info');
 
-  show('choice-card', view.mode === 'onboarding' && !view.findings.length && !view.plan && !view.running);
-  show('scope-card', Boolean(source) && (view.mode === 'execute' || view.findings.length || view.plan));
+  show('scope-card', !view.recovery && !view.running && !view.plan);
   renderScopes(view.selection);
 
   const findings = document.getElementById('findings');
@@ -213,11 +177,12 @@ function render(view) {
   const planSummary = document.getElementById('plan-summary');
   if (view.plan) {
     planSummary.replaceChildren(
-      row(text.steps.replace('{count}', view.plan.steps.length), view.plan.planHash),
-      row(text.conflicts.replace('{count}', view.plan.conflicts.length), `${view.plan.estimatedWriteBytes} byte(s)`),
+      row(text.steps.replace('{count}', view.plan.steps.length), view.plan.selection.groups.map(groupLabel).join(' · ')),
+      row(text.conflicts.replace('{count}', view.plan.conflicts.length), text.confirmHelp),
+      ...view.plan.conflicts.map((conflict) => row(conflict.domain, conflict.code || conflict.resolution || '')),
     );
   }
-  show('plan-card', Boolean(view.plan) && !view.running && !view.report);
+  show('plan-card', Boolean(view.plan) && !view.running && !['completed', 'completed_with_warnings'].includes(view.status));
   const blocker = document.getElementById('blockers');
   blocker.textContent = view.blockers.length
     ? format(text.blockers, { count: view.blockers.length }) : text.noBlockers;
@@ -239,9 +204,6 @@ function render(view) {
     reportSummary.replaceChildren(...view.report.domainResults.map((result) =>
       row(result.domain, `${result.imported} ${transferLabel(result)}, ${result.skipped} ${text.skipped}, ${result.warnings.filter((item) => item.severity !== 'info').length} ${text.warnings}`)));
   }
-  show('dev-restart-help', !view.restartDesktopOnFinish);
-  document.getElementById('open-desktop').textContent = view.restartDesktopOnFinish
-    ? text.openDesktop : text.closeMigrator;
   show('report-card', !view.running && (Boolean(view.report) || view.status === 'cancelled'));
   const canExportDiagnostics = ['failed_recoverable', 'failed_manual_action_required'].includes(view.status);
   show('export-diagnostics', canExportDiagnostics);
@@ -250,7 +212,12 @@ function render(view) {
     output.textContent = '';
     output.hidden = true;
   }
-  document.getElementById('start').disabled = !view.canExecute;
+  document.querySelectorAll('button, #locations input, #language, #saved-task').forEach((node) => { node.disabled = view.running; });
+  document.getElementById('cancel').disabled = !view.running;
+  document.getElementById('start').disabled = !view.canExecute || locationsDirty;
+  document.getElementById('resume-task').disabled = !tasks.selectedOptions[0] || tasks.selectedOptions[0].disabled || view.running || locationsDirty;
+  for (const id of ['scan', 'prepare']) document.getElementById(id).disabled = view.running || locationsDirty;
+  if (locationsDirty) notice(text.dirtyLocations, 'info');
 
   if (view.running && !pollTimer) {
     pollTimer = window.setInterval(refresh, 500);
@@ -262,16 +229,18 @@ function render(view) {
 
 async function call(command, request = {}) {
   setBusy(true);
+  let failure;
   try {
     const result = await invoke(command, { request });
     if (result) render(result);
     return result;
   } catch (error) {
-    notice(error?.message || String(error));
+    failure = error?.message || String(error);
     return undefined;
   } finally {
     setBusy(false);
     if (current) render(current);
+    if (failure) notice(failure);
   }
 }
 
@@ -286,16 +255,47 @@ async function refresh() {
   }
 }
 
-document.getElementById('migrate-now').addEventListener('click', () => {
+function renderLocations(locations) {
+  const signature = JSON.stringify(locations);
+  if (signature === locationSnapshot || locationsDirty) return;
+  locationSnapshot = signature;
+  const host = document.getElementById('locations');
+  host.replaceChildren();
+  for (const [prefix, title] of [['legacy', text.source], ['target', text.target]]) {
+    const group = document.createElement('fieldset');
+    const legend = document.createElement('legend');
+    legend.textContent = title;
+    group.append(legend);
+    for (const suffix of ['UserRoot', 'HomeRoot', 'SkillsRoot', 'SshRoot']) {
+      const key = prefix + suffix;
+      const label = document.createElement('label');
+      const input = document.createElement('input');
+      label.htmlFor = key;
+      label.textContent = text[suffix[0].toLowerCase() + suffix.slice(1)];
+      input.type = 'text'; input.id = key; input.value = locations[key];
+      input.spellcheck = false; input.autocomplete = 'off';
+      input.addEventListener('input', () => { locationsDirty = true; if (current) render(current); });
+      group.append(label, input);
+    }
+    host.append(group);
+  }
+}
+
+document.getElementById('language').value = locale;
+document.getElementById('language').addEventListener('change', (event) => {
+  localStorage.setItem('migrator.language', event.target.value);
+  window.location.reload();
+});
+document.getElementById('apply-locations').addEventListener('click', async () => {
   if (!requireBootstrap()) return;
-  show('choice-card', false);
-  show('scope-card');
-  renderScopes(current.selection);
+  const locations = Object.fromEntries([...document.querySelectorAll('#locations input')].map((input) => [input.id, input.value.trim()]));
+  const result = await call('set_migration_locations', { locations });
+  if (result) { locationsDirty = false; locationSnapshot = undefined; render(result); }
 });
-document.getElementById('remind-later').addEventListener('click', () =>
-  call('finish_legacy_migration', { choice: 'remind_later' }));
-document.getElementById('do-not-remind').addEventListener('click', () =>
-  call('finish_legacy_migration', { choice: 'do_not_remind' }));
+document.getElementById('resume-task').addEventListener('click', () => call('resume_migration_task', { runId: document.getElementById('saved-task').value }));
+document.getElementById('new-task').addEventListener('click', () => call('new_migration_task'));
+for (const id of ['close', 'finish']) document.getElementById(id).addEventListener('click', () => call('finish_legacy_migration'));
+
 document.getElementById('scan').addEventListener('click', () =>
   call('scan_legacy_migration', { selection: selection() }));
 document.getElementById('prepare').addEventListener('click', () =>
@@ -308,21 +308,18 @@ document.getElementById('cancel').addEventListener('click', () =>
   call('cancel_legacy_migration'));
 document.getElementById('export-diagnostics').addEventListener('click', async () => {
   setBusy(true);
+  let failure;
   try {
     const result = await invoke('export_migration_diagnostics', { request: {} });
     const output = document.getElementById('diagnostics-path');
     output.textContent = format(text.diagnosticsExported, { path: result.filePath });
     output.hidden = false;
   } catch (error) {
-    notice(error?.message || String(error));
+    failure = error?.message || String(error);
   } finally {
     setBusy(false);
     if (current) render(current);
+    if (failure) notice(failure);
   }
 });
-document.getElementById('open-desktop').addEventListener('click', () =>
-  call('finish_legacy_migration', { choice: current.report ? 'migrate_now' : 'remind_later' }));
-
-refresh().then(() => {
-  if (current?.mode === 'execute') show('scope-card');
-});
+refresh();
diff --git a/src/apps/data-migrator/ui/generated/design-system.css b/src/apps/data-migrator/ui/generated/design-system.css
new file mode 100644
index 0000000000..70e3125ba3
--- /dev/null
+++ b/src/apps/data-migrator/ui/generated/design-system.css
@@ -0,0 +1,1026 @@
+/* Generated by scripts/generate-data-migrator-theme.mjs. Do not edit. */
+@layer openbitfun.tokens.system, openbitfun.tokens.theme, openbitfun.reset, openbitfun.base, openbitfun.components, openbitfun.overrides;
+
+@layer openbitfun.tokens.system {
+  :where([data-openbitfun-design-system-root]) {
+    --openbitfun-border-width-default: 1px;
+    --openbitfun-border-width-strong: 2px;
+    --openbitfun-control-action-card-actions-gap: 0px;
+    --openbitfun-control-action-card-actions-padding-inline-end: var(--openbitfun-space-2);
+    --openbitfun-control-action-card-content-gap: var(--openbitfun-space-1);
+    --openbitfun-control-action-card-gap: var(--openbitfun-space-2);
+    --openbitfun-control-action-card-icon-size: 16px;
+    --openbitfun-control-action-card-leading-size: 30px;
+    --openbitfun-control-action-card-md-min-block-size: 62px;
+    --openbitfun-control-action-card-padding-block: var(--openbitfun-space-2);
+    --openbitfun-control-action-card-padding-inline: var(--openbitfun-space-3);
+    --openbitfun-control-action-card-radius: var(--openbitfun-radius-base);
+    --openbitfun-control-action-card-sm-min-block-size: 54px;
+    --openbitfun-control-activity-item-content-gap: var(--openbitfun-space-1);
+    --openbitfun-control-activity-item-divider-block-size: 16px;
+    --openbitfun-control-activity-item-inline-gap: var(--openbitfun-space-1);
+    --openbitfun-control-activity-item-inline-icon-size: 12px;
+    --openbitfun-control-activity-item-surface-gap: var(--openbitfun-space-2);
+    --openbitfun-control-activity-item-surface-height: 30px;
+    --openbitfun-control-activity-item-surface-icon-size: 14px;
+    --openbitfun-control-activity-item-surface-padding-block: var(--openbitfun-space-1);
+    --openbitfun-control-activity-item-surface-padding-inline-end: 3px;
+    --openbitfun-control-activity-item-surface-padding-inline-start: var(--openbitfun-space-2);
+    --openbitfun-control-activity-item-surface-radius: var(--openbitfun-radius-base);
+    --openbitfun-control-ask-user-body-gap: var(--openbitfun-space-3);
+    --openbitfun-control-ask-user-body-padding: var(--openbitfun-space-4);
+    --openbitfun-control-ask-user-description-max-width: 500px;
+    --openbitfun-control-ask-user-header-height: 30px;
+    --openbitfun-control-ask-user-icon-size: 14px;
+    --openbitfun-control-ask-user-option-content-gap: var(--openbitfun-space-2);
+    --openbitfun-control-ask-user-option-gap: var(--openbitfun-space-1);
+    --openbitfun-control-ask-user-option-padding-block: 7px;
+    --openbitfun-control-ask-user-option-padding-inline: var(--openbitfun-space-2);
+    --openbitfun-control-ask-user-question-options-gap: var(--openbitfun-space-3);
+    --openbitfun-control-ask-user-question-padding-inline: var(--openbitfun-space-1);
+    --openbitfun-control-ask-user-summary-action-size: 22px;
+    --openbitfun-control-ask-user-summary-padding-block: var(--openbitfun-space-1);
+    --openbitfun-control-ask-user-summary-padding-inline-end: var(--openbitfun-space-1);
+    --openbitfun-control-ask-user-summary-padding-inline-start: var(--openbitfun-space-2);
+    --openbitfun-control-button-xs-height: 24px;
+    --openbitfun-control-button-xs-leading-icon-size: 12px;
+    --openbitfun-control-button-xs-padding-inline: 6px;
+    --openbitfun-control-button-xs-trailing-icon-size: 10px;
+    --openbitfun-control-change-count-gap: var(--openbitfun-space-1);
+    --openbitfun-control-change-count-padding-block: 2px;
+    --openbitfun-control-change-count-padding-inline: var(--openbitfun-space-1);
+    --openbitfun-control-change-count-radius: var(--openbitfun-radius-xs);
+    --openbitfun-control-chat-composer-action-icon-size: 14px;
+    --openbitfun-control-chat-composer-compact-gap: 9px;
+    --openbitfun-control-chat-composer-compact-height: 45px;
+    --openbitfun-control-chat-composer-compact-padding-block: 9px;
+    --openbitfun-control-chat-composer-compact-padding-inline: 9px;
+    --openbitfun-control-chat-composer-compact-track-height: 25px;
+    --openbitfun-control-chat-composer-control-height: 25px;
+    --openbitfun-control-composer-context-gap: var(--openbitfun-space-2);
+    --openbitfun-control-composer-context-offset: 32px;
+    --openbitfun-control-composer-context-padding-block: 6px;
+    --openbitfun-control-composer-context-padding-inline: var(--openbitfun-space-2);
+    --openbitfun-control-composer-divider-block-size: 16px;
+    --openbitfun-control-composer-editor-padding: var(--openbitfun-space-1);
+    --openbitfun-control-composer-min-block-size: 120px;
+    --openbitfun-control-composer-surface-gap: var(--openbitfun-space-3);
+    --openbitfun-control-composer-surface-padding: var(--openbitfun-space-2);
+    --openbitfun-control-composer-surface-radius: var(--openbitfun-radius-xl);
+    --openbitfun-control-composer-toolbar-gap: var(--openbitfun-space-2);
+    --openbitfun-control-flow-chat-card-expanded-padding-block: 0.5rem;
+    --openbitfun-control-flow-chat-card-expanded-padding-inline: 0.625rem;
+    --openbitfun-control-flow-chat-card-gap: 0.42rem;
+    --openbitfun-control-flow-chat-card-padding-block: 0.625rem;
+    --openbitfun-control-flow-chat-card-padding-inline: 0.75rem;
+    --openbitfun-control-flow-chat-card-radius: var(--openbitfun-radius-base);
+    --openbitfun-control-flow-chat-code-block-padding-block: 0.55rem;
+    --openbitfun-control-flow-chat-code-block-padding-inline: 0.75rem;
+    --openbitfun-control-flow-chat-content-padding-inline: 3rem;
+    --openbitfun-control-flow-chat-content-padding-inline-mobile: 1.5rem;
+    --openbitfun-control-flow-chat-control-gap: 0.5rem;
+    --openbitfun-control-flow-chat-control-padding-block: 0.35rem;
+    --openbitfun-control-flow-chat-control-padding-inline: 0.75rem;
+    --openbitfun-control-flow-chat-flow-item-gap: 0.42rem;
+    --openbitfun-control-flow-chat-inline-gap: 0.35rem;
+    --openbitfun-control-flow-chat-turn-gap: var(--openbitfun-space-4);
+    --openbitfun-control-height-lg: 48px;
+    --openbitfun-control-height-md: 40px;
+    --openbitfun-control-height-sm: 32px;
+    --openbitfun-control-hit-target: 40px;
+    --openbitfun-control-icon-size2xs: 8px;
+    --openbitfun-control-icon-size-lg: 24px;
+    --openbitfun-control-icon-size-md: 16px;
+    --openbitfun-control-icon-size-sm: 14px;
+    --openbitfun-control-icon-size-xs: 12px;
+    --openbitfun-control-icon-button-xs-icon-size: 14px;
+    --openbitfun-control-icon-button-xs-size: 22px;
+    --openbitfun-control-launcher-button-block-size: var(--openbitfun-control-height-md);
+    --openbitfun-control-launcher-button-gap: var(--openbitfun-space-2);
+    --openbitfun-control-launcher-button-icon-size: 16px;
+    --openbitfun-control-launcher-button-min-inline-size: 104px;
+    --openbitfun-control-launcher-button-padding-inline: 14px;
+    --openbitfun-control-launcher-button-radius: var(--openbitfun-radius-lg);
+    --openbitfun-control-segmented-control-gap: 2px;
+    --openbitfun-control-segmented-control-icon-size: 12px;
+    --openbitfun-control-segmented-control-icon-size-md: 14px;
+    --openbitfun-control-segmented-control-padding: 2px;
+    --openbitfun-control-segmented-control-padding-md: 3px;
+    --openbitfun-control-segmented-control-pill-segment-height: 24px;
+    --openbitfun-control-segmented-control-pill-segment-radius: var(--openbitfun-radius-sm);
+    --openbitfun-control-segmented-control-radius: var(--openbitfun-radius-pill);
+    --openbitfun-control-segmented-control-segment-gap: var(--openbitfun-space-1);
+    --openbitfun-control-segmented-control-segment-height: 22px;
+    --openbitfun-control-segmented-control-segment-height-md: 28px;
+    --openbitfun-control-segmented-control-segment-padding-inline: var(--openbitfun-space-2);
+    --openbitfun-control-segmented-control-segment-radius: var(--openbitfun-radius-pill);
+    --openbitfun-control-select-content-gap: var(--openbitfun-space-2);
+    --openbitfun-control-select-indicator-size: 14px;
+    --openbitfun-control-select-leading-inset: var(--openbitfun-space-3);
+    --openbitfun-control-select-padding-inline: var(--openbitfun-space-3);
+    --openbitfun-control-select-radius: var(--openbitfun-radius-base);
+    --openbitfun-control-select-trailing-inset: var(--openbitfun-space-3);
+    --openbitfun-control-status-pill-gap: 2px;
+    --openbitfun-control-status-pill-icon-size: 14px;
+    --openbitfun-control-status-pill-padding-block: 3px;
+    --openbitfun-control-status-pill-padding-inline: 6px;
+    --openbitfun-control-status-pill-radius: var(--openbitfun-radius-pill);
+    --openbitfun-control-switch-thumb-inset: 2px;
+    --openbitfun-control-switch-thumb-size: 12px;
+    --openbitfun-control-switch-thumb-travel: 12px;
+    --openbitfun-control-switch-thumb-travel-reverse: -12px;
+    --openbitfun-control-switch-track-height: 16px;
+    --openbitfun-control-switch-track-width: 28px;
+    --openbitfun-control-tab-group-gap: var(--openbitfun-space-2);
+    --openbitfun-control-tab-group-item-action-inset: var(--openbitfun-space-2);
+    --openbitfun-control-tab-group-item-action-size: var(--openbitfun-space-5);
+    --openbitfun-control-tab-group-item-gap: 6px;
+    --openbitfun-control-tab-group-item-height: var(--openbitfun-control-height-md);
+    --openbitfun-control-tab-group-item-height-sm: 30px;
+    --openbitfun-control-tab-group-item-icon-size: 16px;
+    --openbitfun-control-tab-group-item-padding-block-sm: 7px;
+    --openbitfun-control-tab-group-item-padding-inline: var(--openbitfun-space-4);
+    --openbitfun-control-tab-group-item-padding-inline-sm: var(--openbitfun-space-3);
+    --openbitfun-control-tab-group-item-radius: var(--openbitfun-radius-pill);
+    --openbitfun-control-tool-card-ambient-row-min-block-size: 22px;
+    --openbitfun-control-tool-card-expanded-padding-inline: 0.625rem;
+    --openbitfun-control-tool-card-header-icon-slot: 34px;
+    --openbitfun-control-tool-card-header-padding-block: 0.44rem;
+    --openbitfun-control-tool-card-header-padding-inline-end: 0.625rem;
+    --openbitfun-focus-offset: 2px;
+    --openbitfun-focus-width: 2px;
+    --openbitfun-font-family-control: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI Variable Text', 'Segoe UI', 'PingFang SC', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', 'Helvetica Neue', Helvetica, Arial, sans-serif;
+    --openbitfun-font-family-mono: 'JetBrains Mono', 'Fira Code', ui-monospace, SFMono-Regular, 'SF Mono', Menlo, Monaco, 'Cascadia Mono', 'Cascadia Code', Consolas, 'Liberation Mono', 'Courier New', monospace;
+    --openbitfun-font-family-sans: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', 'PingFang SC', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', 'Helvetica Neue', Helvetica, Arial, sans-serif;
+    --openbitfun-font-size-2xl: 18px;
+    --openbitfun-font-size-2xl-plus: 20px;
+    --openbitfun-font-size-2xs: 9px;
+    --openbitfun-font-size-3xl: 22px;
+    --openbitfun-font-size-3xl-plus: 24px;
+    --openbitfun-font-size-3xs: 8px;
+    --openbitfun-font-size-4xl: 26px;
+    --openbitfun-font-size-4xs: 7px;
+    --openbitfun-font-size-5xl: 32px;
+    --openbitfun-font-size-6xl: 40px;
+    --openbitfun-font-size-7xl: 48px;
+    --openbitfun-font-size-8xl: 56px;
+    --openbitfun-font-size-9xl: 64px;
+    --openbitfun-font-size-base: 14px;
+    --openbitfun-font-size-lg: 15px;
+    --openbitfun-font-size-meta: 11px;
+    --openbitfun-font-size-micro: 10px;
+    --openbitfun-font-size-sm: 13px;
+    --openbitfun-font-size-xl: 16px;
+    --openbitfun-font-size-xl-plus: 17px;
+    --openbitfun-font-size-xs: 12px;
+    --openbitfun-font-weight-bold: 700;
+    --openbitfun-font-weight-medium: 500;
+    --openbitfun-font-weight-regular: 400;
+    --openbitfun-font-weight-semibold: 600;
+    --openbitfun-layer-base: 0;
+    --openbitfun-layer-content: 2;
+    --openbitfun-layer-context-menu: 500;
+    --openbitfun-layer-decoration: 1;
+    --openbitfun-layer-dropdown: 60;
+    --openbitfun-layer-floating: 50;
+    --openbitfun-layer-fullscreen: 280;
+    --openbitfun-layer-modal: 200;
+    --openbitfun-layer-modal-active: 250;
+    --openbitfun-layer-notification: 400;
+    --openbitfun-layer-overlay: 100;
+    --openbitfun-layer-overlay-host: 300;
+    --openbitfun-layer-popover: 360;
+    --openbitfun-layer-sticky: 15;
+    --openbitfun-layer-toast: 400;
+    --openbitfun-layer-tooltip: 350;
+    --openbitfun-layout-card-footer-gap: var(--openbitfun-space-2);
+    --openbitfun-layout-card-gap-lg: 30px;
+    --openbitfun-layout-card-gap-md: var(--openbitfun-space-3);
+    --openbitfun-layout-card-gap-sm: var(--openbitfun-space-2);
+    --openbitfun-layout-card-header-gap: var(--openbitfun-space-2);
+    --openbitfun-layout-card-media-min-block-size: 120px;
+    --openbitfun-layout-card-padding-md: var(--openbitfun-space-5);
+    --openbitfun-layout-card-padding-sm: var(--openbitfun-space-3);
+    --openbitfun-layout-card-radius-lg: 28px;
+    --openbitfun-layout-card-radius-md: var(--openbitfun-radius-lg);
+    --openbitfun-layout-card-radius-sm: var(--openbitfun-radius-base);
+    --openbitfun-layout-card-title-description-gap: var(--openbitfun-space-1);
+    --openbitfun-layout-confirm-dialog-content-gap: var(--openbitfun-space-4);
+    --openbitfun-layout-confirm-dialog-icon-glyph-size: var(--openbitfun-control-icon-size-md);
+    --openbitfun-layout-confirm-dialog-icon-size: 32px;
+    --openbitfun-layout-confirm-dialog-message-gap: var(--openbitfun-space-2);
+    --openbitfun-layout-confirm-dialog-preview-max-block-size: 240px;
+    --openbitfun-layout-confirm-dialog-preview-padding-block: var(--openbitfun-space-3);
+    --openbitfun-layout-confirm-dialog-preview-padding-inline: var(--openbitfun-space-4);
+    --openbitfun-layout-confirm-dialog-preview-radius: var(--openbitfun-radius-base);
+    --openbitfun-layout-disclosure-actions-gap: var(--openbitfun-space-1);
+    --openbitfun-layout-disclosure-content-padding-block: var(--openbitfun-space-3);
+    --openbitfun-layout-disclosure-content-padding-inline: var(--openbitfun-space-8);
+    --openbitfun-layout-disclosure-indicator-size: 14px;
+    --openbitfun-layout-disclosure-trigger-gap: var(--openbitfun-space-2);
+    --openbitfun-layout-disclosure-trigger-min-block-size: 30px;
+    --openbitfun-layout-disclosure-trigger-padding-block: var(--openbitfun-space-1);
+    --openbitfun-layout-disclosure-trigger-padding-inline: var(--openbitfun-space-2);
+    --openbitfun-layout-disclosure-trigger-radius: var(--openbitfun-radius-base);
+    --openbitfun-layout-field-content-gap: var(--openbitfun-space-1);
+    --openbitfun-layout-field-control-gap: var(--openbitfun-space-2);
+    --openbitfun-layout-field-horizontal-gap: var(--openbitfun-space-5);
+    --openbitfun-layout-field-horizontal-gap-wide: var(--openbitfun-space-10);
+    --openbitfun-layout-field-label-action-gap: var(--openbitfun-space-2);
+    --openbitfun-layout-field-label-gap: 2px;
+    --openbitfun-layout-field-label-width-lg: 400px;
+    --openbitfun-layout-field-label-width-md: 200px;
+    --openbitfun-layout-field-label-width-sm: 150px;
+    --openbitfun-layout-field-root-gap: var(--openbitfun-space-2);
+    --openbitfun-layout-field-group-radius: var(--openbitfun-radius-lg);
+    --openbitfun-layout-field-group-row-padding-block: var(--openbitfun-space-4);
+    --openbitfun-layout-field-group-row-padding-inline: var(--openbitfun-space-5);
+    --openbitfun-layout-form-section-gap: var(--openbitfun-space-4);
+    --openbitfun-layout-form-section-header-gap: var(--openbitfun-space-5);
+    --openbitfun-layout-form-section-title-description-gap: var(--openbitfun-space-1);
+    --openbitfun-layout-navigation-panel-content-gap: var(--openbitfun-space-4);
+    --openbitfun-layout-navigation-panel-footer-height: 40px;
+    --openbitfun-layout-navigation-panel-footer-padding: var(--openbitfun-space-2);
+    --openbitfun-layout-navigation-panel-heading-action-size: 22px;
+    --openbitfun-layout-navigation-panel-heading-gap: var(--openbitfun-space-5);
+    --openbitfun-layout-navigation-panel-heading-height: 22px;
+    --openbitfun-layout-navigation-panel-heading-padding-inline: var(--openbitfun-space-2);
+    --openbitfun-layout-navigation-panel-inline-size: 216px;
+    --openbitfun-layout-navigation-panel-item-gap: var(--openbitfun-space-2);
+    --openbitfun-layout-navigation-panel-item-height: 30px;
+    --openbitfun-layout-navigation-panel-item-icon-size: 14px;
+    --openbitfun-layout-navigation-panel-item-padding-inline: var(--openbitfun-space-2);
+    --openbitfun-layout-navigation-panel-item-radius: var(--openbitfun-radius-base);
+    --openbitfun-layout-navigation-panel-scrollbar-gap: 2px;
+    --openbitfun-layout-navigation-panel-section-gap: var(--openbitfun-space-1);
+    --openbitfun-layout-navigation-panel-surface-padding: var(--openbitfun-space-2);
+    --openbitfun-layout-overflow-text-fade-extent: var(--openbitfun-space-4);
+    --openbitfun-layout-spinner-matrix-cell-lg: 8px;
+    --openbitfun-layout-spinner-matrix-cell-md: 6px;
+    --openbitfun-layout-spinner-matrix-cell-sm: 4px;
+    --openbitfun-layout-spinner-matrix-cell-xs: 3px;
+    --openbitfun-layout-spinner-matrix-gap-md: 2px;
+    --openbitfun-layout-spinner-matrix-gap-sm: 1px;
+    --openbitfun-layout-spinner-matrix-radius: 1px;
+    --openbitfun-layout-split-view-content-panel-radius: var(--openbitfun-radius-3xl);
+    --openbitfun-layout-toolbar-badge-size: 24px;
+    --openbitfun-layout-toolbar-content-gap: 40px;
+    --openbitfun-layout-toolbar-group-gap-md: var(--openbitfun-space-2);
+    --openbitfun-layout-toolbar-group-gap-sm: var(--openbitfun-space-1);
+    --openbitfun-layout-toolbar-md-height: 45px;
+    --openbitfun-layout-toolbar-md-padding-block-end: 6px;
+    --openbitfun-layout-toolbar-md-padding-block-start: var(--openbitfun-space-2);
+    --openbitfun-layout-toolbar-md-padding-inline-end: 11px;
+    --openbitfun-layout-toolbar-md-padding-inline-start: var(--openbitfun-space-2);
+    --openbitfun-layout-toolbar-overflow-fade-extent: 16px;
+    --openbitfun-layout-toolbar-separator-block-size: 16px;
+    --openbitfun-layout-toolbar-sm-height: 33px;
+    --openbitfun-layout-toolbar-sm-padding-block: var(--openbitfun-space-1);
+    --openbitfun-layout-toolbar-sm-padding-inline: var(--openbitfun-space-2);
+    --openbitfun-letter-spacing-caps: 0.1em;
+    --openbitfun-letter-spacing-expanded: 0.26em;
+    --openbitfun-letter-spacing-normal: 0em;
+    --openbitfun-letter-spacing-snug: -0.01em;
+    --openbitfun-letter-spacing-subtle: 0.01em;
+    --openbitfun-letter-spacing-tight: -0.02em;
+    --openbitfun-letter-spacing-tighter: -0.04em;
+    --openbitfun-letter-spacing-wide: 0.02em;
+    --openbitfun-letter-spacing-wider: 0.04em;
+    --openbitfun-letter-spacing-widest: 0.08em;
+    --openbitfun-line-height-balanced: 1.35;
+    --openbitfun-line-height-base: 1.5;
+    --openbitfun-line-height-code: 1.52;
+    --openbitfun-line-height-comfortable: 1.55;
+    --openbitfun-line-height-compact: 1.32;
+    --openbitfun-line-height-dense: 1.25;
+    --openbitfun-line-height-display: 1.1;
+    --openbitfun-line-height-loose: 1.8;
+    --openbitfun-line-height-none: 1;
+    --openbitfun-line-height-reading: 1.58;
+    --openbitfun-line-height-relaxed: 1.6;
+    --openbitfun-line-height-snug: 1.3;
+    --openbitfun-line-height-spacious: 1.7;
+    --openbitfun-line-height-support: 1.45;
+    --openbitfun-line-height-tight: 1.2;
+    --openbitfun-line-height-ui: 1.4;
+    --openbitfun-motion-distance-sm: var(--openbitfun-space-1);
+    --openbitfun-motion-duration-base: 220ms;
+    --openbitfun-motion-duration-fast: 140ms;
+    --openbitfun-motion-duration-instant: 80ms;
+    --openbitfun-motion-duration-lazy: 1s;
+    --openbitfun-motion-duration-loop: 720ms;
+    --openbitfun-motion-duration-normal: var(--openbitfun-motion-duration-base);
+    --openbitfun-motion-duration-slow: 420ms;
+    --openbitfun-motion-easing-accelerate: cubic-bezier(0.4, 0, 1, 1);
+    --openbitfun-motion-easing-decelerate: var(--openbitfun-motion-easing-standard);
+    --openbitfun-motion-easing-enter: var(--openbitfun-motion-easing-standard);
+    --openbitfun-motion-easing-exit: cubic-bezier(0.3, 0, 1, 1);
+    --openbitfun-motion-easing-smooth: cubic-bezier(0.77, 0, 0.175, 1);
+    --openbitfun-motion-easing-standard: cubic-bezier(0.23, 1, 0.32, 1);
+    --openbitfun-overlay-dialog-backdrop-blur: blur(20px);
+    --openbitfun-overlay-dialog-content-padding-lg: var(--openbitfun-space-6);
+    --openbitfun-overlay-dialog-content-padding-md: var(--openbitfun-space-4);
+    --openbitfun-overlay-dialog-content-padding-sm: var(--openbitfun-space-3);
+    --openbitfun-overlay-dialog-content-padding-xl: var(--openbitfun-space-8);
+    --openbitfun-overlay-dialog-description-gap: var(--openbitfun-space-2);
+    --openbitfun-overlay-dialog-edge-gutter: 8px;
+    --openbitfun-overlay-dialog-footer-action-min-width: 100px;
+    --openbitfun-overlay-dialog-footer-blur: blur(10px);
+    --openbitfun-overlay-dialog-footer-content-inset: 104px;
+    --openbitfun-overlay-dialog-footer-fade-extent: var(--openbitfun-space-6);
+    --openbitfun-overlay-dialog-footer-gap: var(--openbitfun-space-2);
+    --openbitfun-overlay-dialog-footer-height: 68px;
+    --openbitfun-overlay-dialog-footer-padding-block-end: var(--openbitfun-space-5);
+    --openbitfun-overlay-dialog-footer-padding-block-start: var(--openbitfun-space-2);
+    --openbitfun-overlay-dialog-footer-padding-inline: var(--openbitfun-space-6);
+    --openbitfun-overlay-dialog-header-actions-gap: var(--openbitfun-space-2);
+    --openbitfun-overlay-dialog-header-gap: var(--openbitfun-space-5);
+    --openbitfun-overlay-dialog-header-padding-block-end: var(--openbitfun-space-5);
+    --openbitfun-overlay-dialog-header-padding-block-start: var(--openbitfun-space-6);
+    --openbitfun-overlay-dialog-header-padding-inline: var(--openbitfun-space-6);
+    --openbitfun-overlay-dialog-max-inline-size-large: 600px;
+    --openbitfun-overlay-dialog-max-inline-size-medium: 560px;
+    --openbitfun-overlay-dialog-max-inline-size-small: 420px;
+    --openbitfun-overlay-dialog-max-inline-size-wide: 1200px;
+    --openbitfun-overlay-dialog-max-inline-size-xlarge: 720px;
+    --openbitfun-overlay-dialog-max-inline-size-xxlarge: 960px;
+    --openbitfun-overlay-dialog-scrollbar-width: var(--openbitfun-scrollbar-width);
+    --openbitfun-overlay-dialog-surface-radius: 28px;
+    --openbitfun-overlay-dialog-viewport-gutter: 24px;
+    --openbitfun-overlay-menu-heading-action-size: 22px;
+    --openbitfun-overlay-menu-heading-gap: var(--openbitfun-space-5);
+    --openbitfun-overlay-menu-heading-height: 24px;
+    --openbitfun-overlay-menu-heading-padding-inline: var(--openbitfun-space-2);
+    --openbitfun-overlay-menu-inline-size: 220px;
+    --openbitfun-overlay-menu-item-gap: var(--openbitfun-space-2);
+    --openbitfun-overlay-menu-item-height: 30px;
+    --openbitfun-overlay-menu-item-icon-size: 14px;
+    --openbitfun-overlay-menu-item-padding-inline: var(--openbitfun-space-2);
+    --openbitfun-overlay-menu-item-radius: var(--openbitfun-radius-base);
+    --openbitfun-overlay-menu-max-block-size: 480px;
+    --openbitfun-overlay-menu-scrollbar-gap: 2px;
+    --openbitfun-overlay-menu-section-gap: var(--openbitfun-space-2);
+    --openbitfun-overlay-menu-surface-padding: var(--openbitfun-space-2);
+    --openbitfun-overlay-menu-surface-radius: var(--openbitfun-radius-xl);
+    --openbitfun-overlay-tooltip-arrow-size: 8px;
+    --openbitfun-overlay-tooltip-gap: var(--openbitfun-space-2);
+    --openbitfun-overlay-tooltip-max-block-size: 320px;
+    --openbitfun-overlay-tooltip-max-inline-size: 280px;
+    --openbitfun-overlay-tooltip-padding-block: 6px;
+    --openbitfun-overlay-tooltip-padding-inline: 10px;
+    --openbitfun-overlay-tooltip-surface-radius: var(--openbitfun-radius-sm);
+    --openbitfun-radius-2xl: 20px;
+    --openbitfun-radius-3xl: 24px;
+    --openbitfun-radius-4xl: 32px;
+    --openbitfun-radius-base: 8px;
+    --openbitfun-radius-lg: 12px;
+    --openbitfun-radius-md: var(--openbitfun-radius-base);
+    --openbitfun-radius-pill: 9999px;
+    --openbitfun-radius-sm: 6px;
+    --openbitfun-radius-xl: 16px;
+    --openbitfun-radius-xs: 4px;
+    --openbitfun-scrollbar-radius: var(--openbitfun-radius-pill);
+    --openbitfun-scrollbar-width: 6px;
+    --openbitfun-space-0: 0px;
+    --openbitfun-space-1: 4px;
+    --openbitfun-space-10: 40px;
+    --openbitfun-space-12: 48px;
+    --openbitfun-space-16: 64px;
+    --openbitfun-space-2: 8px;
+    --openbitfun-space-3: 12px;
+    --openbitfun-space-4: 16px;
+    --openbitfun-space-5: 20px;
+    --openbitfun-space-6: 24px;
+    --openbitfun-space-8: 32px;
+    --openbitfun-space-component-block: 8px;
+    --openbitfun-space-component-inline: 12px;
+    --openbitfun-type-body-lg-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-body-lg-font-size: var(--openbitfun-font-size-lg);
+    --openbitfun-type-body-lg-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-body-lg-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-body-lg-line-height: var(--openbitfun-line-height-relaxed);
+    --openbitfun-type-body-md-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-body-md-font-size: var(--openbitfun-font-size-base);
+    --openbitfun-type-body-md-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-body-md-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-body-md-line-height: var(--openbitfun-line-height-base);
+    --openbitfun-type-body-sm-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-body-sm-font-size: var(--openbitfun-font-size-sm);
+    --openbitfun-type-body-sm-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-body-sm-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-body-sm-line-height: var(--openbitfun-line-height-base);
+    --openbitfun-type-body-xs-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-body-xs-font-size: var(--openbitfun-font-size-xs);
+    --openbitfun-type-body-xs-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-body-xs-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-body-xs-line-height: var(--openbitfun-line-height-base);
+    --openbitfun-type-code-md-font-family: var(--openbitfun-font-family-mono);
+    --openbitfun-type-code-md-font-size: var(--openbitfun-font-size-sm);
+    --openbitfun-type-code-md-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-code-md-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-code-md-line-height: var(--openbitfun-line-height-code);
+    --openbitfun-type-code-sm-font-family: var(--openbitfun-font-family-mono);
+    --openbitfun-type-code-sm-font-size: var(--openbitfun-font-size-xs);
+    --openbitfun-type-code-sm-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-code-sm-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-code-sm-line-height: var(--openbitfun-line-height-code);
+    --openbitfun-type-display-fluid-hero-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-display-fluid-hero-font-size: clamp(var(--openbitfun-font-size-6xl), 4vw, var(--openbitfun-font-size-8xl));
+    --openbitfun-type-display-fluid-hero-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-display-fluid-hero-letter-spacing: var(--openbitfun-letter-spacing-tight);
+    --openbitfun-type-display-fluid-hero-line-height: var(--openbitfun-line-height-display);
+    --openbitfun-type-display-fluid-title-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-display-fluid-title-font-size: clamp(var(--openbitfun-font-size-5xl), 3.2vw, var(--openbitfun-font-size-7xl));
+    --openbitfun-type-display-fluid-title-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-display-fluid-title-letter-spacing: var(--openbitfun-letter-spacing-tight);
+    --openbitfun-type-display-fluid-title-line-height: var(--openbitfun-line-height-display);
+    --openbitfun-type-display-lg-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-display-lg-font-size: var(--openbitfun-font-size-7xl);
+    --openbitfun-type-display-lg-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-display-lg-letter-spacing: var(--openbitfun-letter-spacing-tight);
+    --openbitfun-type-display-lg-line-height: var(--openbitfun-line-height-display);
+    --openbitfun-type-display-md-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-display-md-font-size: var(--openbitfun-font-size-6xl);
+    --openbitfun-type-display-md-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-display-md-letter-spacing: var(--openbitfun-letter-spacing-tight);
+    --openbitfun-type-display-md-line-height: var(--openbitfun-line-height-display);
+    --openbitfun-type-display-sm-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-display-sm-font-size: var(--openbitfun-font-size-5xl);
+    --openbitfun-type-display-sm-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-display-sm-letter-spacing: var(--openbitfun-letter-spacing-tight);
+    --openbitfun-type-display-sm-line-height: var(--openbitfun-line-height-display);
+    --openbitfun-type-display-xl-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-display-xl-font-size: var(--openbitfun-font-size-8xl);
+    --openbitfun-type-display-xl-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-display-xl-letter-spacing: var(--openbitfun-letter-spacing-tight);
+    --openbitfun-type-display-xl-line-height: var(--openbitfun-line-height-display);
+    --openbitfun-type-display-xxl-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-display-xxl-font-size: var(--openbitfun-font-size-9xl);
+    --openbitfun-type-display-xxl-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-display-xxl-letter-spacing: var(--openbitfun-letter-spacing-tight);
+    --openbitfun-type-display-xxl-line-height: var(--openbitfun-line-height-display);
+    --openbitfun-type-flow-body-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-flow-body-font-size: var(--openbitfun-font-size-base);
+    --openbitfun-type-flow-body-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-flow-body-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-flow-body-line-height: var(--openbitfun-line-height-reading);
+    --openbitfun-type-flow-code-font-family: var(--openbitfun-font-family-mono);
+    --openbitfun-type-flow-code-font-size: var(--openbitfun-font-size-sm);
+    --openbitfun-type-flow-code-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-flow-code-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-flow-code-line-height: var(--openbitfun-line-height-code);
+    --openbitfun-type-flow-control-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-flow-control-font-size: var(--openbitfun-font-size-sm);
+    --openbitfun-type-flow-control-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-flow-control-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-flow-control-line-height: var(--openbitfun-line-height-support);
+    --openbitfun-type-flow-lead-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-flow-lead-font-size: var(--openbitfun-font-size-lg);
+    --openbitfun-type-flow-lead-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-flow-lead-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-flow-lead-line-height: var(--openbitfun-line-height-relaxed);
+    --openbitfun-type-flow-meta-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-flow-meta-font-size: var(--openbitfun-font-size-meta);
+    --openbitfun-type-flow-meta-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-flow-meta-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-flow-meta-line-height: var(--openbitfun-line-height-compact);
+    --openbitfun-type-flow-micro-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-flow-micro-font-size: var(--openbitfun-font-size-micro);
+    --openbitfun-type-flow-micro-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-flow-micro-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-flow-micro-line-height: var(--openbitfun-line-height-compact);
+    --openbitfun-type-flow-page-title-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-flow-page-title-font-size: var(--openbitfun-font-size-3xl);
+    --openbitfun-type-flow-page-title-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-flow-page-title-letter-spacing: var(--openbitfun-letter-spacing-tight);
+    --openbitfun-type-flow-page-title-line-height: var(--openbitfun-line-height-tight);
+    --openbitfun-type-flow-section-title-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-flow-section-title-font-size: var(--openbitfun-font-size-2xl);
+    --openbitfun-type-flow-section-title-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-flow-section-title-letter-spacing: var(--openbitfun-letter-spacing-snug);
+    --openbitfun-type-flow-section-title-line-height: var(--openbitfun-line-height-tight);
+    --openbitfun-type-flow-support-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-flow-support-font-size: var(--openbitfun-font-size-xs);
+    --openbitfun-type-flow-support-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-flow-support-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-flow-support-line-height: var(--openbitfun-line-height-support);
+    --openbitfun-type-flow-title-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-flow-title-font-size: var(--openbitfun-font-size-xl);
+    --openbitfun-type-flow-title-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-flow-title-letter-spacing: var(--openbitfun-letter-spacing-snug);
+    --openbitfun-type-flow-title-line-height: var(--openbitfun-line-height-tight);
+    --openbitfun-type-heading-card-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-heading-card-font-size: var(--openbitfun-font-size-sm);
+    --openbitfun-type-heading-card-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-heading-card-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-heading-card-line-height: var(--openbitfun-line-height-tight);
+    --openbitfun-type-heading-compact-page-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-heading-compact-page-font-size: var(--openbitfun-font-size-2xl-plus);
+    --openbitfun-type-heading-compact-page-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-heading-compact-page-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-heading-compact-page-line-height: var(--openbitfun-line-height-tight);
+    --openbitfun-type-heading-dialog-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-heading-dialog-font-size: var(--openbitfun-font-size-3xl);
+    --openbitfun-type-heading-dialog-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-heading-dialog-letter-spacing: var(--openbitfun-letter-spacing-tight);
+    --openbitfun-type-heading-dialog-line-height: var(--openbitfun-line-height-tight);
+    --openbitfun-type-heading-display-font-family: var(--openbitfun-font-family-sans);
+    --openbitfun-type-heading-display-font-size: var(--openbitfun-font-size-4xl);
+    --openbitfun-type-heading-display-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-heading-display-letter-spacing: var(--openbitfun-letter-spacing-tight);
+    --openbitfun-type-heading-display-line-height: var(--openbitfun-line-height-display);
+    --openbitfun-type-heading-navigation-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-heading-navigation-font-size: var(--openbitfun-font-size-xl-plus);
+    --openbitfun-type-heading-navigation-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-heading-navigation-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-heading-navigation-line-height: var(--openbitfun-line-height-tight);
+    --openbitfun-type-heading-page-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-heading-page-font-size: var(--openbitfun-font-size-3xl-plus);
+    --openbitfun-type-heading-page-font-weight: var(--openbitfun-font-weight-bold);
+    --openbitfun-type-heading-page-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-heading-page-line-height: var(--openbitfun-line-height-tight);
+    --openbitfun-type-heading-section-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-heading-section-font-size: var(--openbitfun-font-size-lg);
+    --openbitfun-type-heading-section-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-heading-section-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-heading-section-line-height: var(--openbitfun-line-height-tight);
+    --openbitfun-type-label-lg-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-label-lg-font-size: var(--openbitfun-font-size-base);
+    --openbitfun-type-label-lg-font-weight: var(--openbitfun-font-weight-medium);
+    --openbitfun-type-label-lg-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-label-lg-line-height: var(--openbitfun-line-height-tight);
+    --openbitfun-type-label-md-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-label-md-font-size: var(--openbitfun-font-size-sm);
+    --openbitfun-type-label-md-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-label-md-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-label-md-line-height: var(--openbitfun-line-height-tight);
+    --openbitfun-type-label-selected-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-label-selected-font-size: var(--openbitfun-font-size-sm);
+    --openbitfun-type-label-selected-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-label-selected-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-label-selected-line-height: var(--openbitfun-line-height-tight);
+    --openbitfun-type-label-sm-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-label-sm-font-size: var(--openbitfun-font-size-xs);
+    --openbitfun-type-label-sm-font-weight: var(--openbitfun-font-weight-medium);
+    --openbitfun-type-label-sm-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-label-sm-line-height: var(--openbitfun-line-height-tight);
+    --openbitfun-type-label-xs-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-label-xs-font-size: var(--openbitfun-font-size-meta);
+    --openbitfun-type-label-xs-font-weight: var(--openbitfun-font-weight-medium);
+    --openbitfun-type-label-xs-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-label-xs-line-height: var(--openbitfun-line-height-tight);
+    --openbitfun-type-meta-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-meta-font-size: var(--openbitfun-font-size-meta);
+    --openbitfun-type-meta-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-meta-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-meta-line-height: var(--openbitfun-line-height-compact);
+    --openbitfun-type-micro-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-micro-font-size: var(--openbitfun-font-size-micro);
+    --openbitfun-type-micro-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-micro-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-micro-line-height: var(--openbitfun-line-height-compact);
+    --openbitfun-type-modifier-leading-balanced-line-height: var(--openbitfun-line-height-balanced);
+    --openbitfun-type-modifier-leading-dense-line-height: var(--openbitfun-line-height-dense);
+    --openbitfun-type-modifier-leading-loose-line-height: var(--openbitfun-line-height-loose);
+    --openbitfun-type-modifier-leading-none-line-height: var(--openbitfun-line-height-none);
+    --openbitfun-type-modifier-leading-snug-line-height: var(--openbitfun-line-height-snug);
+    --openbitfun-type-modifier-leading-spacious-line-height: var(--openbitfun-line-height-spacious);
+    --openbitfun-type-modifier-leading-support-line-height: var(--openbitfun-line-height-support);
+    --openbitfun-type-modifier-leading-ui-line-height: var(--openbitfun-line-height-ui);
+    --openbitfun-type-modifier-tracking-caps-letter-spacing: var(--openbitfun-letter-spacing-caps);
+    --openbitfun-type-modifier-tracking-expanded-letter-spacing: var(--openbitfun-letter-spacing-expanded);
+    --openbitfun-type-modifier-tracking-subtle-letter-spacing: var(--openbitfun-letter-spacing-subtle);
+    --openbitfun-type-modifier-tracking-tighter-letter-spacing: var(--openbitfun-letter-spacing-tighter);
+    --openbitfun-type-modifier-tracking-wide-letter-spacing: var(--openbitfun-letter-spacing-wide);
+    --openbitfun-type-modifier-tracking-wider-letter-spacing: var(--openbitfun-letter-spacing-wider);
+    --openbitfun-type-modifier-tracking-widest-letter-spacing: var(--openbitfun-letter-spacing-widest);
+    --openbitfun-type-overline-micro-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-overline-micro-font-size: var(--openbitfun-font-size-4xs);
+    --openbitfun-type-overline-micro-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-overline-micro-letter-spacing: var(--openbitfun-letter-spacing-widest);
+    --openbitfun-type-overline-micro-line-height: var(--openbitfun-line-height-none);
+    --openbitfun-type-overline-sm-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-overline-sm-font-size: var(--openbitfun-font-size-2xs);
+    --openbitfun-type-overline-sm-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-overline-sm-letter-spacing: var(--openbitfun-letter-spacing-wider);
+    --openbitfun-type-overline-sm-line-height: var(--openbitfun-line-height-none);
+    --openbitfun-type-overline-xs-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-overline-xs-font-size: var(--openbitfun-font-size-3xs);
+    --openbitfun-type-overline-xs-font-weight: var(--openbitfun-font-weight-semibold);
+    --openbitfun-type-overline-xs-letter-spacing: var(--openbitfun-letter-spacing-widest);
+    --openbitfun-type-overline-xs-line-height: var(--openbitfun-line-height-none);
+    --openbitfun-type-support-font-family: var(--openbitfun-font-family-control);
+    --openbitfun-type-support-font-size: var(--openbitfun-font-size-meta);
+    --openbitfun-type-support-font-weight: var(--openbitfun-font-weight-regular);
+    --openbitfun-type-support-letter-spacing: var(--openbitfun-letter-spacing-normal);
+    --openbitfun-type-support-line-height: var(--openbitfun-line-height-comfortable);
+  }
+}
+
+@layer openbitfun.tokens.system {
+  :where([data-openbitfun-design-system-root][data-density="compact"]) {
+    --openbitfun-control-height-lg: 44px;
+    --openbitfun-control-height-md: 36px;
+    --openbitfun-control-height-sm: 28px;
+    --openbitfun-control-hit-target: 36px;
+    --openbitfun-control-launcher-button-block-size: var(--openbitfun-control-height-md);
+    --openbitfun-control-tab-group-item-height: var(--openbitfun-control-height-md);
+    --openbitfun-space-component-block: 6px;
+    --openbitfun-space-component-inline: 10px;
+  }
+}
+
+@layer openbitfun.tokens.system {
+  :where([data-openbitfun-design-system-root][data-density="touch"]) {
+    --openbitfun-control-height-lg: 56px;
+    --openbitfun-control-height-md: 48px;
+    --openbitfun-control-height-sm: 40px;
+    --openbitfun-control-hit-target: 48px;
+    --openbitfun-control-launcher-button-block-size: var(--openbitfun-control-height-md);
+    --openbitfun-control-tab-group-item-height: var(--openbitfun-control-height-md);
+    --openbitfun-space-component-block: 12px;
+    --openbitfun-space-component-inline: 16px;
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+
+  :where([data-openbitfun-design-system-root]) {
+
+    --openbitfun-motion-duration-fast: 0ms;
+
+    --openbitfun-motion-duration-normal: 0ms;
+
+    --openbitfun-motion-duration-slow: 0ms;
+
+    --openbitfun-motion-duration-loop: 0ms;
+
+  }
+
+}
+@layer openbitfun.tokens.theme {
+  :where([data-openbitfun-design-system-root]), :where([data-openbitfun-design-system-root][data-color-scheme="light"]) {
+    --openbitfun-color-accent-border: color-mix(in srgb, #059cb0 40%, transparent);
+    --openbitfun-color-accent-border-subtle: color-mix(in srgb, #059cb0 25%, transparent);
+    --openbitfun-color-accent-default: #059cb0;
+    --openbitfun-color-accent-disabled: rgba(5, 156, 176, 0.30);
+    --openbitfun-color-accent-hover: #059cb0;
+    --openbitfun-color-accent-secondary: #7c6b99;
+    --openbitfun-color-accent-secondary-border: color-mix(in srgb, #7c6b99 25%, transparent);
+    --openbitfun-color-accent-secondary-hover: #655680;
+    --openbitfun-color-accent-secondary-surface: color-mix(in srgb, #7c6b99 9%, transparent);
+    --openbitfun-color-accent-secondary-surface-strong: color-mix(in srgb, #7c6b99 15%, transparent);
+    --openbitfun-color-accent-surface: color-mix(in srgb, #059cb0 9%, transparent);
+    --openbitfun-color-accent-surface-strong: color-mix(in srgb, #059cb0 15%, transparent);
+    --openbitfun-color-accent-surface-subtle: color-mix(in srgb, #059cb0 5%, transparent);
+    --openbitfun-color-action-neutral-border: rgba(0, 0, 0, 0.05);
+    --openbitfun-color-action-neutral-content: rgba(0, 0, 0, 0.80);
+    --openbitfun-color-action-neutral-content-disabled: rgba(0, 0, 0, 0.30);
+    --openbitfun-color-action-neutral-fill-border: rgba(0, 0, 0, 0.05);
+    --openbitfun-color-action-neutral-surface: rgba(0, 0, 0, 0.05);
+    --openbitfun-color-action-neutral-surface-hover: rgba(0, 0, 0, 0.08);
+    --openbitfun-color-action-neutral-surface-pressed: rgba(0, 0, 0, 0.10);
+    --openbitfun-color-action-primary-background: #101a27;
+    --openbitfun-color-action-primary-content: #ffffff;
+    --openbitfun-color-action-primary-hover: #1c1c1f;
+    --openbitfun-color-action-primary-pressed: #000000;
+    --openbitfun-color-action-quiet-content: rgba(0, 0, 0, 0.60);
+    --openbitfun-color-action-quiet-hover: #f3f3f5;
+    --openbitfun-color-action-quiet-pressed: rgba(16, 26, 39, 0.09);
+    --openbitfun-color-action-secondary-background: #f3f3f5;
+    --openbitfun-color-action-secondary-content: rgba(0, 0, 0, 0.80);
+    --openbitfun-color-action-secondary-hover: rgba(16, 26, 39, 0.09);
+    --openbitfun-color-action-secondary-pressed: rgba(16, 26, 39, 0.13);
+    --openbitfun-color-border-default: rgba(16, 26, 39, 0.15);
+    --openbitfun-color-border-strong: rgba(16, 26, 39, 0.34);
+    --openbitfun-color-border-subtle: rgba(16, 26, 39, 0.08);
+    --openbitfun-color-code-change-added: #1aa73e;
+    --openbitfun-color-code-change-removed: #ec221f;
+    --openbitfun-color-content-disabled: rgba(0, 0, 0, 0.30);
+    --openbitfun-color-content-inverse: #ffffff;
+    --openbitfun-color-content-muted: #6a6a6a;
+    --openbitfun-color-content-on-dark: #ffffff;
+    --openbitfun-color-content-on-light: #000000;
+    --openbitfun-color-content-primary: rgba(0, 0, 0, 0.80);
+    --openbitfun-color-content-required-indicator: #059cb0;
+    --openbitfun-color-content-secondary: rgba(0, 0, 0, 0.60);
+    --openbitfun-color-control-highlight-background: #059cb0;
+    --openbitfun-color-control-highlight-content: #000000;
+    --openbitfun-color-control-launcher-background: rgba(0, 0, 0, 0.10);
+    --openbitfun-color-control-launcher-background-hover: color-mix(in srgb, #059cb0 20%, transparent);
+    --openbitfun-color-control-launcher-background-pressed: color-mix(in srgb, #059cb0 30%, transparent);
+    --openbitfun-color-control-launcher-content: rgba(0, 0, 0, 0.80);
+    --openbitfun-color-control-launcher-content-disabled: rgba(0, 0, 0, 0.30);
+    --openbitfun-color-control-launcher-content-hover: #059cb0;
+    --openbitfun-color-control-launcher-content-pressed: #059cb0;
+    --openbitfun-color-control-switch-thumb: #ffffff;
+    --openbitfun-color-control-switch-track: #dddddd;
+    --openbitfun-color-control-switch-track-checked: #059cb0;
+    --openbitfun-color-field-background: #ffffff;
+    --openbitfun-color-field-background-hover: #ffffff;
+    --openbitfun-color-field-border: rgba(16, 26, 39, 0.15);
+    --openbitfun-color-field-border-focus: #858585;
+    --openbitfun-color-field-border-hover: rgba(16, 26, 39, 0.24);
+    --openbitfun-color-focus-ring: #6a6a6a;
+    --openbitfun-color-identity-assistant-border: color-mix(in srgb, #db2777 15%, transparent);
+    --openbitfun-color-identity-assistant-content: #db2777;
+    --openbitfun-color-identity-assistant-content-hover: #be185d;
+    --openbitfun-color-identity-assistant-surface: color-mix(in srgb, #db2777 9%, transparent);
+    --openbitfun-color-identity-assistant-surface-subtle: color-mix(in srgb, #db2777 5%, transparent);
+    --openbitfun-color-identity-global-search-new-project: #3271d7;
+    --openbitfun-color-identity-global-search-new-session: #ec221f;
+    --openbitfun-color-identity-global-search-open-browser: #ff8c00;
+    --openbitfun-color-identity-global-search-open-files: #9e54ff;
+    --openbitfun-color-identity-global-search-open-project: #059cb0;
+    --openbitfun-color-identity-global-search-open-terminal: rgba(0, 0, 0, 0.80);
+    --openbitfun-color-identity-harness-creative: #2e7eff;
+    --openbitfun-color-identity-harness-minimal: #b434ef;
+    --openbitfun-color-identity-harness-standard: #1aa73e;
+    --openbitfun-color-identity-harness-ultimate: #ff8c00;
+    --openbitfun-color-key-hint-background: rgba(0, 0, 0, 0.05);
+    --openbitfun-color-link-default: #2563eb;
+    --openbitfun-color-link-hover: #005fcc;
+    --openbitfun-color-overlay-scrim: rgba(16, 26, 39, 0.20);
+    --openbitfun-color-scrollbar-thumb: rgba(0, 0, 0, 0.08);
+    --openbitfun-color-scrollbar-thumb-hover: rgba(0, 0, 0, 0.10);
+    --openbitfun-color-selection-surface: rgba(0, 0, 0, 0.08);
+    --openbitfun-color-status-danger-border: rgba(236, 34, 31, 0.3);
+    --openbitfun-color-status-danger-content: #bd1b19;
+    --openbitfun-color-status-danger-emphasis: #ec221f;
+    --openbitfun-color-status-danger-surface: rgba(236, 34, 31, 0.1);
+    --openbitfun-color-status-info-border: rgba(46, 126, 255, 0.3);
+    --openbitfun-color-status-info-content: #2360c2;
+    --openbitfun-color-status-info-emphasis: #2e7eff;
+    --openbitfun-color-status-info-surface: rgba(46, 126, 255, 0.1);
+    --openbitfun-color-status-success-border: rgba(26, 167, 62, 0.3);
+    --openbitfun-color-status-success-content: #12722a;
+    --openbitfun-color-status-success-emphasis: #1aa73e;
+    --openbitfun-color-status-success-surface: rgba(26, 167, 62, 0.1);
+    --openbitfun-color-status-warning-border: rgba(255, 140, 0, 0.3);
+    --openbitfun-color-status-warning-content: #8a4c00;
+    --openbitfun-color-status-warning-emphasis: #ff8c00;
+    --openbitfun-color-status-warning-surface: rgba(255, 140, 0, 0.1);
+    --openbitfun-color-surface-canvas: #fdfdfd;
+    --openbitfun-color-surface-chrome: #f8f8f9;
+    --openbitfun-color-surface-panel: #ffffff;
+    --openbitfun-color-surface-raised: #ffffff;
+    --openbitfun-color-surface-scene: #ffffff;
+    --openbitfun-color-surface-subtle: rgba(16, 26, 39, 0.03);
+    --openbitfun-color-surface-tertiary: #f7f7f7;
+    --openbitfun-color-surface-workbench: #f3f3f5;
+    --openbitfun-effect-blur-base: blur(8px) saturate(1.05);
+    --openbitfun-effect-blur-medium: blur(12px) saturate(1.2);
+    --openbitfun-effect-blur-subtle: blur(4px) saturate(1.02);
+    --openbitfun-opacity-disabled: 0.55;
+    --openbitfun-opacity-focus: 0.9;
+    --openbitfun-opacity-hover: 0.75;
+    --openbitfun-opacity-muted: 0.75;
+    --openbitfun-shadow-accent-glow: 0 12px 32px color-mix(in srgb, #059cb0 25%, transparent), 0 6px 16px color-mix(in srgb, #059cb0 18%, transparent), 0 3px 8px rgba(0, 0, 0, 0.12);
+    --openbitfun-shadow-base: 0 4px 8px rgba(16, 26, 39, 0.07);
+    --openbitfun-shadow-composer: 0 2px 6px rgba(0, 0, 0, 0.08);
+    --openbitfun-shadow-inner-highlight: inset 0 1px 0 rgba(255, 255, 255, 0.08);
+    --openbitfun-shadow-inner-highlight-hover: inset 0 1px 0 rgba(255, 255, 255, 0.24);
+    --openbitfun-shadow-lg: 0 8px 16px rgba(16, 26, 39, 0.09);
+    --openbitfun-shadow-menu: 0 4px 10px rgba(0, 0, 0, 0.12);
+    --openbitfun-shadow-overlay: 0 4px 20px rgba(0, 0, 0, 0.12);
+    --openbitfun-shadow-raised: 0 2px 4px rgba(16, 26, 39, 0.055);
+    --openbitfun-shadow-sm: 0 2px 4px rgba(16, 26, 39, 0.055);
+    --openbitfun-shadow-xl: 0 12px 24px rgba(16, 26, 39, 0.11);
+    --openbitfun-shadow-xs: 0 1px 2px rgba(16, 26, 39, 0.04);
+  }
+}
+
+@layer openbitfun.tokens.theme {
+  :where([data-openbitfun-design-system-root][data-color-scheme="dark"]) {
+    --openbitfun-color-accent-border: color-mix(in srgb, #60a5fa 40%, transparent);
+    --openbitfun-color-accent-border-subtle: color-mix(in srgb, #60a5fa 25%, transparent);
+    --openbitfun-color-accent-default: #60a5fa;
+    --openbitfun-color-accent-disabled: rgba(96, 165, 250, 0.30);
+    --openbitfun-color-accent-hover: #3b82f6;
+    --openbitfun-color-accent-secondary: #8b5cf6;
+    --openbitfun-color-accent-secondary-border: color-mix(in srgb, #8b5cf6 25%, transparent);
+    --openbitfun-color-accent-secondary-hover: #7c6b99;
+    --openbitfun-color-accent-secondary-surface: color-mix(in srgb, #8b5cf6 9%, transparent);
+    --openbitfun-color-accent-secondary-surface-strong: color-mix(in srgb, #8b5cf6 15%, transparent);
+    --openbitfun-color-accent-surface: color-mix(in srgb, #60a5fa 9%, transparent);
+    --openbitfun-color-accent-surface-strong: color-mix(in srgb, #60a5fa 15%, transparent);
+    --openbitfun-color-accent-surface-subtle: color-mix(in srgb, #60a5fa 5%, transparent);
+    --openbitfun-color-action-neutral-border: rgba(255, 255, 255, 0.18);
+    --openbitfun-color-action-neutral-content: #b0b0b0;
+    --openbitfun-color-action-neutral-content-disabled: #555555;
+    --openbitfun-color-action-neutral-fill-border: rgba(255, 255, 255, 0.1);
+    --openbitfun-color-action-neutral-surface: rgba(255, 255, 255, 0.1);
+    --openbitfun-color-action-neutral-surface-hover: rgba(255, 255, 255, 0.12);
+    --openbitfun-color-action-neutral-surface-pressed: rgba(255, 255, 255, 0.15);
+    --openbitfun-color-action-primary-background: rgba(255, 255, 255, 0.16);
+    --openbitfun-color-action-primary-content: #f3f3f5;
+    --openbitfun-color-action-primary-hover: rgba(255, 255, 255, 0.24);
+    --openbitfun-color-action-primary-pressed: rgba(255, 255, 255, 0.2);
+    --openbitfun-color-action-quiet-content: #b0b0b0;
+    --openbitfun-color-action-quiet-hover: rgba(255, 255, 255, 0.06);
+    --openbitfun-color-action-quiet-pressed: rgba(255, 255, 255, 0.1);
+    --openbitfun-color-action-secondary-background: rgba(255, 255, 255, 0.06);
+    --openbitfun-color-action-secondary-content: #e8e8e8;
+    --openbitfun-color-action-secondary-hover: rgba(255, 255, 255, 0.1);
+    --openbitfun-color-action-secondary-pressed: rgba(255, 255, 255, 0.12);
+    --openbitfun-color-border-default: rgba(255, 255, 255, 0.18);
+    --openbitfun-color-border-strong: rgba(255, 255, 255, 0.3);
+    --openbitfun-color-border-subtle: rgba(255, 255, 255, 0.12);
+    --openbitfun-color-code-change-added: #1aa73e;
+    --openbitfun-color-code-change-removed: #ec221f;
+    --openbitfun-color-content-disabled: #555555;
+    --openbitfun-color-content-inverse: #0e0e10;
+    --openbitfun-color-content-muted: #858585;
+    --openbitfun-color-content-on-dark: #ffffff;
+    --openbitfun-color-content-on-light: #000000;
+    --openbitfun-color-content-primary: #e8e8e8;
+    --openbitfun-color-content-required-indicator: #059cb0;
+    --openbitfun-color-content-secondary: #b0b0b0;
+    --openbitfun-color-control-highlight-background: #059cb0;
+    --openbitfun-color-control-highlight-content: #000000;
+    --openbitfun-color-control-launcher-background: rgba(255, 255, 255, 0.15);
+    --openbitfun-color-control-launcher-background-hover: color-mix(in srgb, #059cb0 20%, transparent);
+    --openbitfun-color-control-launcher-background-pressed: color-mix(in srgb, #059cb0 30%, transparent);
+    --openbitfun-color-control-launcher-content: #b0b0b0;
+    --openbitfun-color-control-launcher-content-disabled: #555555;
+    --openbitfun-color-control-launcher-content-hover: #059cb0;
+    --openbitfun-color-control-launcher-content-pressed: #059cb0;
+    --openbitfun-color-control-switch-thumb: #ffffff;
+    --openbitfun-color-control-switch-track: #555555;
+    --openbitfun-color-control-switch-track-checked: #059cb0;
+    --openbitfun-color-field-background: #1c1c1f;
+    --openbitfun-color-field-background-hover: rgba(255, 255, 255, 0.06);
+    --openbitfun-color-field-border: rgba(255, 255, 255, 0.18);
+    --openbitfun-color-field-border-focus: #858585;
+    --openbitfun-color-field-border-hover: rgba(255, 255, 255, 0.24);
+    --openbitfun-color-focus-ring: #60a5fa;
+    --openbitfun-color-identity-assistant-border: color-mix(in srgb, #ec4899 15%, transparent);
+    --openbitfun-color-identity-assistant-content: #ec4899;
+    --openbitfun-color-identity-assistant-content-hover: #f472b6;
+    --openbitfun-color-identity-assistant-surface: color-mix(in srgb, #ec4899 9%, transparent);
+    --openbitfun-color-identity-assistant-surface-subtle: color-mix(in srgb, #ec4899 5%, transparent);
+    --openbitfun-color-identity-global-search-new-project: #3271d7;
+    --openbitfun-color-identity-global-search-new-session: #ec221f;
+    --openbitfun-color-identity-global-search-open-browser: #ff8c00;
+    --openbitfun-color-identity-global-search-open-files: #9e54ff;
+    --openbitfun-color-identity-global-search-open-project: #059cb0;
+    --openbitfun-color-identity-global-search-open-terminal: #b0b0b0;
+    --openbitfun-color-identity-harness-creative: #2e7eff;
+    --openbitfun-color-identity-harness-minimal: #b434ef;
+    --openbitfun-color-identity-harness-standard: #1aa73e;
+    --openbitfun-color-identity-harness-ultimate: #ff8c00;
+    --openbitfun-color-key-hint-background: rgba(255, 255, 255, 0.1);
+    --openbitfun-color-link-default: #60a5fa;
+    --openbitfun-color-link-hover: #93c5fd;
+    --openbitfun-color-overlay-scrim: rgba(0, 0, 0, 0.56);
+    --openbitfun-color-scrollbar-thumb: rgba(255, 255, 255, 0.12);
+    --openbitfun-color-scrollbar-thumb-hover: rgba(255, 255, 255, 0.15);
+    --openbitfun-color-selection-surface: rgba(255, 255, 255, 0.12);
+    --openbitfun-color-status-danger-border: rgba(236, 34, 31, 0.3);
+    --openbitfun-color-status-danger-content: #f47f7d;
+    --openbitfun-color-status-danger-emphasis: #ec221f;
+    --openbitfun-color-status-danger-surface: rgba(236, 34, 31, 0.1);
+    --openbitfun-color-status-info-border: rgba(46, 126, 255, 0.3);
+    --openbitfun-color-status-info-content: #7dafff;
+    --openbitfun-color-status-info-emphasis: #2e7eff;
+    --openbitfun-color-status-info-surface: rgba(46, 126, 255, 0.1);
+    --openbitfun-color-status-success-border: rgba(26, 167, 62, 0.3);
+    --openbitfun-color-status-success-content: #5fc178;
+    --openbitfun-color-status-success-emphasis: #1aa73e;
+    --openbitfun-color-status-success-surface: rgba(26, 167, 62, 0.1);
+    --openbitfun-color-status-warning-border: rgba(255, 140, 0, 0.3);
+    --openbitfun-color-status-warning-content: #ff930f;
+    --openbitfun-color-status-warning-emphasis: #ff8c00;
+    --openbitfun-color-status-warning-surface: rgba(255, 140, 0, 0.1);
+    --openbitfun-color-surface-canvas: #0e0e10;
+    --openbitfun-color-surface-chrome: #0e0e10;
+    --openbitfun-color-surface-panel: #1c1c1f;
+    --openbitfun-color-surface-raised: #1c1c1f;
+    --openbitfun-color-surface-scene: #1c1c1f;
+    --openbitfun-color-surface-subtle: rgba(255, 255, 255, 0.06);
+    --openbitfun-color-surface-tertiary: #0e0e10;
+    --openbitfun-color-surface-workbench: #0e0e10;
+    --openbitfun-effect-blur-base: blur(8px) saturate(1.1);
+    --openbitfun-effect-blur-medium: blur(12px) saturate(1.2);
+    --openbitfun-effect-blur-subtle: blur(4px) saturate(1.05);
+    --openbitfun-opacity-disabled: 0.6;
+    --openbitfun-opacity-focus: 0.9;
+    --openbitfun-opacity-hover: 0.8;
+    --openbitfun-opacity-muted: 0.8;
+    --openbitfun-shadow-accent-glow: 0 12px 32px color-mix(in srgb, #3b82f6 25%, transparent), 0 6px 16px color-mix(in srgb, #60a5fa 18%, transparent), 0 3px 8px rgba(0, 0, 0, 0.12);
+    --openbitfun-shadow-base: 0 4px 8px rgba(0, 0, 0, 0.7);
+    --openbitfun-shadow-composer: 0 2px 6px rgba(0, 0, 0, 0.32);
+    --openbitfun-shadow-inner-highlight: inset 0 1px 0 rgba(255, 255, 255, 0.08);
+    --openbitfun-shadow-inner-highlight-hover: inset 0 1px 0 rgba(255, 255, 255, 0.24);
+    --openbitfun-shadow-lg: 0 8px 16px rgba(0, 0, 0, 0.6);
+    --openbitfun-shadow-menu: 0 4px 10px rgba(0, 0, 0, 0.48);
+    --openbitfun-shadow-overlay: 0 4px 20px rgba(0, 0, 0, 0.48);
+    --openbitfun-shadow-raised: 0 2px 4px rgba(0, 0, 0, 0.8);
+    --openbitfun-shadow-sm: 0 2px 4px rgba(0, 0, 0, 0.8);
+    --openbitfun-shadow-xl: 0 12px 24px rgba(0, 0, 0, 0.5);
+    --openbitfun-shadow-xs: 0 1px 2px rgba(0, 0, 0, 0.9);
+  }
+}
+
+@layer openbitfun.tokens.theme {
+  :where([data-openbitfun-design-system-root][data-color-scheme="light"][data-contrast="high"]) {
+    --openbitfun-color-action-neutral-border: #000000;
+    --openbitfun-color-action-neutral-content: #000000;
+    --openbitfun-color-action-neutral-content-disabled: #343434;
+    --openbitfun-color-action-neutral-fill-border: #000000;
+    --openbitfun-color-action-neutral-surface: #e6e6e6;
+    --openbitfun-color-action-neutral-surface-hover: #cccccc;
+    --openbitfun-color-action-neutral-surface-pressed: #b3b3b3;
+    --openbitfun-color-action-primary-background: #000000;
+    --openbitfun-color-action-primary-hover: #262626;
+    --openbitfun-color-action-quiet-content: #161616;
+    --openbitfun-color-action-secondary-content: #000000;
+    --openbitfun-color-border-default: #3b3b3b;
+    --openbitfun-color-border-strong: #000000;
+    --openbitfun-color-border-subtle: #707070;
+    --openbitfun-color-content-muted: #343434;
+    --openbitfun-color-content-primary: #000000;
+    --openbitfun-color-content-required-indicator: #005fcc;
+    --openbitfun-color-content-secondary: #161616;
+    --openbitfun-color-control-highlight-background: #005fcc;
+    --openbitfun-color-control-highlight-content: #ffffff;
+    --openbitfun-color-control-launcher-background: #b3b3b3;
+    --openbitfun-color-control-launcher-background-hover: color-mix(in srgb, #005fcc 20%, transparent);
+    --openbitfun-color-control-launcher-background-pressed: color-mix(in srgb, #005fcc 30%, transparent);
+    --openbitfun-color-control-launcher-content: #000000;
+    --openbitfun-color-control-launcher-content-disabled: #343434;
+    --openbitfun-color-control-launcher-content-hover: #005fcc;
+    --openbitfun-color-control-launcher-content-pressed: #005fcc;
+    --openbitfun-color-control-switch-track: #3b3b3b;
+    --openbitfun-color-control-switch-track-checked: #005fcc;
+    --openbitfun-color-field-border: #3b3b3b;
+    --openbitfun-color-field-border-focus: #005fcc;
+    --openbitfun-color-field-border-hover: #000000;
+    --openbitfun-color-focus-ring: #005fcc;
+    --openbitfun-color-identity-global-search-open-terminal: #000000;
+    --openbitfun-color-key-hint-background: #e6e6e6;
+    --openbitfun-color-scrollbar-thumb: #cccccc;
+    --openbitfun-color-scrollbar-thumb-hover: #b3b3b3;
+    --openbitfun-color-selection-surface: #cccccc;
+    --openbitfun-color-status-danger-content: #8e1413;
+    --openbitfun-color-status-info-content: #1c4c99;
+    --openbitfun-color-status-success-content: #0d541f;
+    --openbitfun-color-status-warning-content: #663800;
+    --openbitfun-color-status-warning-surface: rgba(255, 140, 0, 0.04);
+    --openbitfun-color-surface-canvas: #ffffff;
+  }
+}
+
+@layer openbitfun.tokens.theme {
+  :where([data-openbitfun-design-system-root][data-color-scheme="dark"][data-contrast="high"]) {
+    --openbitfun-color-action-neutral-border: #ffffff;
+    --openbitfun-color-action-neutral-content: #ffffff;
+    --openbitfun-color-action-neutral-content-disabled: #d0d0d0;
+    --openbitfun-color-action-neutral-fill-border: #ffffff;
+    --openbitfun-color-action-neutral-surface: #343434;
+    --openbitfun-color-action-neutral-surface-hover: #505050;
+    --openbitfun-color-action-neutral-surface-pressed: #6b6b6b;
+    --openbitfun-color-action-primary-background: #ffffff;
+    --openbitfun-color-action-primary-content: #000000;
+    --openbitfun-color-action-primary-hover: #e6e6e6;
+    --openbitfun-color-action-primary-pressed: #ffffff;
+    --openbitfun-color-border-default: #b5b5b5;
+    --openbitfun-color-border-strong: #ffffff;
+    --openbitfun-color-border-subtle: #8a8a8a;
+    --openbitfun-color-content-muted: #d0d0d0;
+    --openbitfun-color-content-primary: #ffffff;
+    --openbitfun-color-content-required-indicator: #ffcc00;
+    --openbitfun-color-content-secondary: #f0f0f0;
+    --openbitfun-color-control-highlight-background: #ffcc00;
+    --openbitfun-color-control-launcher-background: #6b6b6b;
+    --openbitfun-color-control-launcher-background-hover: color-mix(in srgb, #ffcc00 20%, transparent);
+    --openbitfun-color-control-launcher-background-pressed: color-mix(in srgb, #ffcc00 30%, transparent);
+    --openbitfun-color-control-launcher-content: #ffffff;
+    --openbitfun-color-control-launcher-content-disabled: #d0d0d0;
+    --openbitfun-color-control-launcher-content-hover: #ffcc00;
+    --openbitfun-color-control-launcher-content-pressed: #ffcc00;
+    --openbitfun-color-control-switch-thumb: #000000;
+    --openbitfun-color-control-switch-track: #b5b5b5;
+    --openbitfun-color-control-switch-track-checked: #ffcc00;
+    --openbitfun-color-field-border: #b5b5b5;
+    --openbitfun-color-field-border-focus: #ffcc00;
+    --openbitfun-color-field-border-hover: #ffffff;
+    --openbitfun-color-focus-ring: #ffcc00;
+    --openbitfun-color-identity-global-search-open-terminal: #ffffff;
+    --openbitfun-color-key-hint-background: #343434;
+    --openbitfun-color-scrollbar-thumb: #505050;
+    --openbitfun-color-scrollbar-thumb-hover: #6b6b6b;
+    --openbitfun-color-selection-surface: #505050;
+    --openbitfun-color-status-danger-content: #f7a7a5;
+    --openbitfun-color-status-info-content: #abcbff;
+    --openbitfun-color-status-success-content: #afe0bb;
+    --openbitfun-color-status-warning-content: #ffa940;
+    --openbitfun-color-status-warning-surface: rgba(255, 140, 0, 0.04);
+    --openbitfun-color-surface-canvas: #000000;
+    --openbitfun-color-surface-chrome: #000000;
+    --openbitfun-color-surface-panel: #090909;
+    --openbitfun-color-surface-scene: #090909;
+    --openbitfun-color-surface-tertiary: #000000;
+    --openbitfun-color-surface-workbench: #000000;
+  }
+}
diff --git a/src/apps/data-migrator/ui/index.html b/src/apps/data-migrator/ui/index.html
index 38dd720570..5efdedb074 100644
--- a/src/apps/data-migrator/ui/index.html
+++ b/src/apps/data-migrator/ui/index.html
@@ -1,11 +1,13 @@
 <!doctype html>
-<html lang="en">
+<html lang="en" data-openbitfun-design-system-root data-color-scheme="light" data-contrast="normal" data-density="comfortable">
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>OpenBitFun Data Migrator</title>
+    <script src="theme.js"></script>
+    <link rel="stylesheet" href="generated/design-system.css" />
     <link rel="stylesheet" href="styles.css" />
-    <script src="app.js" defer></script>
+    <script src="app.js" type="module"></script>
   </head>
   <body>
     <main class="shell">
@@ -15,6 +17,11 @@ <h1 data-i18n="title">Import data from BitFun</h1>
         <p class="lead" data-i18n="intro">
           Choose what to bring forward. Your original BitFun data will not be deleted.
         </p>
+        <div class="actions">
+          <label for="language" data-i18n="language">Language</label>
+          <select id="language"><option value="en">English</option><option value="zh-CN">简体中文</option><option value="zh-TW">繁體中文</option></select>
+          <span id="tool-version" class="muted"></span>
+        </div>
       </header>
 
       <div id="notice" class="notice" role="status" aria-live="polite" hidden></div>
@@ -25,23 +32,19 @@ <h1 data-i18n="title">Import data from BitFun</h1>
             <p class="step" data-i18n="stepSource">Step 1</p>
             <h2 id="source-title" data-i18n="sourceTitle">Legacy source</h2>
           </div>
-          <span id="source-badge" class="badge">Checking</span>
+          <span id="source-badge" class="badge" data-tone="neutral">Checking</span>
         </div>
         <p id="source-summary" class="muted"></p>
-        <p id="source-path" class="path"></p>
+        <p class="muted" data-i18n="localOnly"></p>
+        <div class="locations-grid" id="locations"></div>
+        <div class="actions"><button id="apply-locations" data-i18n="applyLocations"></button></div>
       </section>
 
-      <section id="choice-card" class="card" aria-labelledby="choice-title" hidden>
-        <p class="step" data-i18n="firstLaunch">First launch</p>
-        <h2 id="choice-title" data-i18n="choiceTitle">What would you like to do?</h2>
-        <p class="muted" data-i18n="choiceHelp">
-          Migration runs only after OpenBitFun and other data writers have stopped.
-        </p>
-        <div class="actions">
-          <button id="migrate-now" class="primary" data-i18n="migrateNow">Migrate now</button>
-          <button id="remind-later" data-i18n="remindLater">Remind me later</button>
-          <button id="do-not-remind" class="quiet" data-i18n="doNotRemind">Do not remind me</button>
-        </div>
+      <section id="history-card" class="card" aria-labelledby="history-title" hidden>
+        <h2 id="history-title" data-i18n="historyTitle"></h2>
+        <label for="saved-task" data-i18n="savedTask"></label>
+        <select id="saved-task"></select>
+        <div class="actions"><button id="resume-task" data-i18n="resumeTask"></button></div>
       </section>
 
       <section id="scope-card" class="card" aria-labelledby="scope-title" hidden>
@@ -94,15 +97,13 @@ <h2 id="report-title" data-i18n="reportTitle">Migration report</h2>
         <p class="muted" data-i18n="reportPrivacy">
           This summary contains counts and result codes, not credentials or user content.
         </p>
-        <p id="dev-restart-help" class="muted" data-i18n="devRestartHelp" hidden>
-          Development build: close Data Migrator, then run pnpm run desktop:dev again.
-        </p>
         <p id="diagnostics-path" class="path" role="status" aria-live="polite" hidden></p>
         <div class="actions">
           <button id="export-diagnostics" data-i18n="exportDiagnostics" hidden>Export failure diagnostics</button>
-          <button id="open-desktop" class="primary" data-i18n="openDesktop">Open OpenBitFun</button>
+          <button id="finish" class="primary" data-i18n="closeMigrator">Close Data Migrator</button>
         </div>
       </section>
+      <div class="actions"><button id="new-task" data-i18n="newTask"></button><button id="close" class="quiet" data-i18n="closeMigrator"></button></div>
     </main>
   </body>
 </html>
diff --git a/src/apps/data-migrator/ui/locales.json b/src/apps/data-migrator/ui/locales.json
new file mode 100644
index 0000000000..ac5217ef76
--- /dev/null
+++ b/src/apps/data-migrator/ui/locales.json
@@ -0,0 +1,185 @@
+{
+  "en": {
+    "eyebrow": "OpenBitFun Data Migrator",
+    "title": "Import data from BitFun",
+    "intro": "A separate, offline tool. Choose what to import; your original BitFun data is preserved.",
+    "stepSource": "Step 1",
+    "sourceTitle": "Source and destination",
+    "stepScope": "Step 2",
+    "scopeTitle": "Choose migration scope",
+    "scan": "Scan selected data",
+    "stepReview": "Step 3",
+    "reviewTitle": "Review scan",
+    "prepare": "Run preflight plan",
+    "stepConfirm": "Step 4",
+    "planTitle": "Confirm migration",
+    "retryWriters": "Check processes again",
+    "start": "Start migration",
+    "stepProgress": "Step 5",
+    "progressTitle": "Migration progress",
+    "phase": "Phase",
+    "domain": "Domain",
+    "count": "Completed steps",
+    "cancel": "Cancel",
+    "stepDone": "Result",
+    "reportTitle": "Migration report",
+    "reportPrivacy": "This summary contains counts and result codes, not credentials or user content.",
+    "exportDiagnostics": "Export failure diagnostics",
+    "diagnosticsExported": "Sanitized diagnostics saved to {path}",
+    "ready": "Ready",
+    "unsupported": "Unsupported",
+    "missing": "Not found",
+    "closeMigrator": "Close Data Migrator",
+    "bootstrapPending": "Data Migrator is still loading. Please try again.",
+    "bootstrapFailed": "Data Migrator could not load its local state.",
+    "sourceFound": "BitFun {version} was found. The source stays read-only.",
+    "recovery": "A previous migration journal was found and can be resumed.",
+    "blockers": "{count} data-writing process(es) must stop before migration can continue.",
+    "noBlockers": "No data-writing processes are blocking migration.",
+    "steps": "{count} migration step(s)",
+    "conflicts": "{count} conflict(s)",
+    "imported": "imported",
+    "staged": "staged",
+    "skipped": "skipped",
+    "warnings": "warnings",
+    "localOnly": "Run on the computer containing the data. Close BitFun, OpenBitFun, and their background processes before importing.",
+    "applyLocations": "Use these locations",
+    "historyTitle": "Saved migration tasks",
+    "savedTask": "Task and result",
+    "resumeTask": "Review / resume task",
+    "newTask": "New migration",
+    "language": "Language",
+    "noSource": "No legacy data found. Check the source locations, then scan again.",
+    "dirtyLocations": "Apply the edited locations before scanning or continuing.",
+    "source": "BitFun source",
+    "target": "OpenBitFun destination",
+    "userRoot": "Settings and data",
+    "homeRoot": "Home data",
+    "skillsRoot": "Skills",
+    "sshRoot": "SSH data",
+    "unreadableTask": "Unavailable — restore original locations or inspect the saved files",
+    "confirmHelp": "Review the destination, selected groups, and conflicts. Existing destination records take priority; the tool keeps backups for replaced files."
+  },
+  "zh-CN": {
+    "eyebrow": "OpenBitFun 独立数据迁移器",
+    "title": "从 BitFun 导入数据",
+    "intro": "独立运行，离线导入。选择需要迁移的内容，原始 BitFun 数据会被保留。",
+    "stepSource": "第 1 步",
+    "sourceTitle": "来源与目标目录",
+    "stepScope": "第 2 步",
+    "scopeTitle": "选择迁移范围",
+    "scan": "扫描所选数据",
+    "stepReview": "第 3 步",
+    "reviewTitle": "检查扫描结果",
+    "prepare": "运行迁移预检",
+    "stepConfirm": "第 4 步",
+    "planTitle": "确认迁移",
+    "retryWriters": "重新检查进程",
+    "start": "开始迁移",
+    "stepProgress": "第 5 步",
+    "progressTitle": "迁移进度",
+    "phase": "阶段",
+    "domain": "领域",
+    "count": "已完成步骤",
+    "cancel": "取消",
+    "stepDone": "结果",
+    "reportTitle": "迁移报告",
+    "reportPrivacy": "此摘要仅包含计数和结果码，不包含凭据或用户正文。",
+    "exportDiagnostics": "导出失败诊断",
+    "diagnosticsExported": "去敏诊断已保存到 {path}",
+    "closeMigrator": "关闭数据迁移器",
+    "bootstrapPending": "数据迁移器仍在加载，请稍后重试。",
+    "bootstrapFailed": "无法加载迁移器的本地状态。",
+    "ready": "可迁移",
+    "unsupported": "不受支持",
+    "missing": "未发现",
+    "sourceFound": "已发现 BitFun {version}。迁移期间来源保持只读。",
+    "recovery": "发现上次迁移日志，可以从安全状态继续。",
+    "blockers": "迁移前还需停止 {count} 个数据写入进程。",
+    "noBlockers": "没有进程阻止迁移。",
+    "steps": "{count} 个迁移步骤",
+    "conflicts": "{count} 个冲突",
+    "imported": "已导入",
+    "staged": "已暂存",
+    "skipped": "已跳过",
+    "warnings": "警告",
+    "localOnly": "请在保存数据的电脑上运行。导入前请关闭 BitFun、OpenBitFun 及其后台进程。",
+    "applyLocations": "使用这些目录",
+    "historyTitle": "历史迁移任务",
+    "savedTask": "任务与结果",
+    "resumeTask": "查看 / 恢复任务",
+    "newTask": "新建迁移",
+    "language": "语言",
+    "noSource": "未发现旧版数据。请检查来源目录后重新扫描。",
+    "dirtyLocations": "目录已修改，请先应用目录再扫描或继续迁移。",
+    "source": "BitFun 来源",
+    "target": "OpenBitFun 目标",
+    "userRoot": "设置与数据",
+    "homeRoot": "主目录数据",
+    "skillsRoot": "Skills",
+    "sshRoot": "SSH 数据",
+    "unreadableTask": "暂不可用，请恢复原目录或检查任务文件",
+    "confirmHelp": "请确认目标目录、迁移范围和冲突。已有目标记录优先；工具会为需要替换的文件保留备份。"
+  },
+  "zh-TW": {
+    "eyebrow": "OpenBitFun 獨立資料遷移器",
+    "title": "從 BitFun 匯入資料",
+    "intro": "獨立執行，離線匯入。選擇需要遷移的內容，原始 BitFun 資料會被保留。",
+    "stepSource": "第 1 步",
+    "sourceTitle": "來源與目標目錄",
+    "stepScope": "第 2 步",
+    "scopeTitle": "選擇遷移範圍",
+    "scan": "掃描所選資料",
+    "stepReview": "第 3 步",
+    "reviewTitle": "檢查掃描結果",
+    "prepare": "執行遷移預檢",
+    "stepConfirm": "第 4 步",
+    "planTitle": "確認遷移",
+    "retryWriters": "重新檢查程序",
+    "start": "開始遷移",
+    "stepProgress": "第 5 步",
+    "progressTitle": "遷移進度",
+    "phase": "階段",
+    "domain": "領域",
+    "count": "已完成步驟",
+    "cancel": "取消",
+    "stepDone": "結果",
+    "reportTitle": "遷移報告",
+    "reportPrivacy": "此摘要僅包含計數和結果碼，不包含憑據或使用者正文。",
+    "exportDiagnostics": "匯出失敗診斷",
+    "diagnosticsExported": "去敏診斷已儲存至 {path}",
+    "closeMigrator": "關閉資料遷移器",
+    "bootstrapPending": "資料遷移器仍在載入，請稍後重試。",
+    "bootstrapFailed": "無法載入遷移器的本機狀態。",
+    "ready": "可遷移",
+    "unsupported": "不支援",
+    "missing": "未發現",
+    "sourceFound": "已發現 BitFun {version}。遷移期間來源保持唯讀。",
+    "recovery": "發現上次遷移日誌，可以從安全狀態繼續。",
+    "blockers": "遷移前還需停止 {count} 個資料寫入程序。",
+    "noBlockers": "沒有程序阻止遷移。",
+    "steps": "{count} 個遷移步驟",
+    "conflicts": "{count} 個衝突",
+    "imported": "已匯入",
+    "staged": "已暫存",
+    "skipped": "已略過",
+    "warnings": "警告",
+    "localOnly": "請在儲存資料的電腦上執行。匯入前請關閉 BitFun、OpenBitFun 及其背景程序。",
+    "applyLocations": "使用這些目錄",
+    "historyTitle": "歷史遷移工作",
+    "savedTask": "工作與結果",
+    "resumeTask": "檢視 / 恢復工作",
+    "newTask": "新增遷移",
+    "language": "語言",
+    "noSource": "未發現舊版資料。請檢查來源目錄後重新掃描。",
+    "dirtyLocations": "目錄已修改，請先套用目錄再掃描或繼續遷移。",
+    "source": "BitFun 來源",
+    "target": "OpenBitFun 目標",
+    "userRoot": "設定與資料",
+    "homeRoot": "主目錄資料",
+    "skillsRoot": "Skills",
+    "sshRoot": "SSH 資料",
+    "unreadableTask": "暫不可用，請恢復原目錄或檢查工作檔案",
+    "confirmHelp": "請確認目標目錄、遷移範圍和衝突。已有目標記錄優先；工具會為需要取代的檔案保留備份。"
+  }
+}
diff --git a/src/apps/data-migrator/ui/styles.css b/src/apps/data-migrator/ui/styles.css
index 226d1f27ee..c45a472d48 100644
--- a/src/apps/data-migrator/ui/styles.css
+++ b/src/apps/data-migrator/ui/styles.css
@@ -1,81 +1,154 @@
+/* Native UI adapter for the public design-system token contract. */
 :root {
-  color-scheme: light dark;
-  font-family: Inter, "Segoe UI", system-ui, sans-serif;
-  --surface: Canvas;
-  --surface-raised: color-mix(in srgb, Canvas 94%, CanvasText 6%);
-  --text: CanvasText;
-  --muted: color-mix(in srgb, CanvasText 64%, transparent);
-  --border: color-mix(in srgb, CanvasText 18%, transparent);
-  --accent: AccentColor;
-  --accent-text: AccentColorText;
-  --warning: color-mix(in srgb, Mark 18%, Canvas);
-  --focus: AccentColor;
+  color-scheme: light;
+  font-family: var(--openbitfun-type-body-md-font-family);
+  font-size: var(--openbitfun-type-body-md-font-size);
+  font-weight: var(--openbitfun-type-body-md-font-weight);
+  line-height: var(--openbitfun-type-body-md-line-height);
+  letter-spacing: var(--openbitfun-type-body-md-letter-spacing);
+  color: var(--openbitfun-color-content-primary);
+  background: var(--openbitfun-color-surface-canvas);
+}
+
+:root[data-color-scheme="dark"] {
+  color-scheme: dark;
 }
 
 * {
   box-sizing: border-box;
 }
 
+[hidden] {
+  display: none !important;
+}
+
 body {
   margin: 0;
-  background: var(--surface);
-  color: var(--text);
 }
 
 .shell {
-  width: min(760px, calc(100% - 40px));
-  margin: 0 auto;
-  padding: 44px 0 56px;
+  width: min(760px, calc(100% - var(--openbitfun-space-10)));
+  margin-inline: auto;
+  padding-block: var(--openbitfun-space-8) var(--openbitfun-space-12);
+}
+
+.locations-grid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: var(--openbitfun-space-4);
+  margin-block: var(--openbitfun-space-4);
+}
+
+fieldset {
+  min-inline-size: 0;
+  margin: 0;
+  padding: 0;
+  border: 0;
+}
+
+legend {
+  margin-block-end: var(--openbitfun-space-3);
+  font-weight: var(--openbitfun-type-heading-card-font-weight);
+}
+
+fieldset label {
+  display: block;
+  margin-block: var(--openbitfun-space-2);
+  color: var(--openbitfun-color-content-secondary);
+}
+
+input[type="text"],
+select {
+  min-inline-size: 0;
+  max-inline-size: 100%;
+  padding: var(--openbitfun-space-2) var(--openbitfun-space-3);
+  border: var(--openbitfun-border-width-default) solid var(--openbitfun-color-field-border);
+  border-radius: var(--openbitfun-radius-md);
+  background: var(--openbitfun-color-field-background);
+  color: var(--openbitfun-color-content-primary);
+  font: inherit;
+}
+
+input[type="text"],
+#saved-task {
+  inline-size: 100%;
+}
+
+input[type="text"]:focus-visible,
+select:focus-visible {
+  outline: var(--openbitfun-border-width-default) solid var(--openbitfun-color-field-border-focus);
+  outline-offset: var(--openbitfun-space-1);
+}
+
+@media (max-width: 640px) {
+  .locations-grid { grid-template-columns: minmax(0, 1fr); }
 }
 
 header {
-  margin-bottom: 26px;
+  margin-block-end: var(--openbitfun-space-6);
 }
 
 h1,
 h2,
 p {
-  margin-top: 0;
+  margin-block-start: 0;
+  overflow-wrap: anywhere;
 }
 
 h1 {
-  margin-bottom: 10px;
-  font-size: clamp(28px, 5vw, 42px);
-  line-height: 1.1;
+  margin-block-end: var(--openbitfun-space-2);
+  font-family: var(--openbitfun-type-heading-page-font-family);
+  font-size: var(--openbitfun-type-heading-page-font-size);
+  font-weight: var(--openbitfun-type-heading-page-font-weight);
+  line-height: var(--openbitfun-type-heading-page-line-height);
+  letter-spacing: var(--openbitfun-type-heading-page-letter-spacing);
 }
 
 h2 {
-  margin-bottom: 8px;
-  font-size: 20px;
+  margin-block-end: var(--openbitfun-space-2);
+  color: var(--openbitfun-color-content-primary);
+  font-family: var(--openbitfun-type-heading-card-font-family);
+  font-size: var(--openbitfun-type-heading-card-font-size);
+  font-weight: var(--openbitfun-type-heading-card-font-weight);
+  line-height: var(--openbitfun-type-heading-card-line-height);
+  letter-spacing: var(--openbitfun-type-heading-card-letter-spacing);
 }
 
 .eyebrow,
 .step {
-  margin-bottom: 8px;
-  color: var(--accent);
-  font-size: 12px;
-  font-weight: 700;
-  letter-spacing: 0.08em;
-  text-transform: uppercase;
+  margin-block-end: var(--openbitfun-space-2);
+  color: var(--openbitfun-color-content-muted);
+  font-family: var(--openbitfun-type-meta-font-family);
+  font-size: var(--openbitfun-type-meta-font-size);
+  font-weight: var(--openbitfun-type-meta-font-weight);
+  line-height: var(--openbitfun-type-meta-line-height);
+  letter-spacing: var(--openbitfun-type-meta-letter-spacing);
+}
+
+.eyebrow {
+  color: var(--openbitfun-color-accent-default);
 }
 
 .lead,
 .muted {
-  color: var(--muted);
-  line-height: 1.55;
+  color: var(--openbitfun-color-content-secondary);
 }
 
-.card,
-.notice {
-  margin-bottom: 16px;
-  padding: 22px;
-  border: 1px solid var(--border);
-  border-radius: 14px;
-  background: var(--surface-raised);
+.card {
+  margin-block-end: var(--openbitfun-space-4);
+  padding: var(--openbitfun-layout-card-padding-md);
+  border: var(--openbitfun-border-width-default) solid var(--openbitfun-color-border-subtle);
+  border-radius: var(--openbitfun-layout-card-radius-md);
+  background: var(--openbitfun-color-surface-tertiary);
+  font-family: var(--openbitfun-type-body-sm-font-family);
+  font-size: var(--openbitfun-type-body-sm-font-size);
+  font-weight: var(--openbitfun-type-body-sm-font-weight);
+  line-height: var(--openbitfun-type-body-sm-line-height);
+  letter-spacing: var(--openbitfun-type-body-sm-letter-spacing);
 }
 
-.notice {
-  border-color: var(--accent);
+.card > :last-child {
+  margin-block-end: 0;
 }
 
 .card-heading,
@@ -83,43 +156,88 @@ h2 {
 .scope-option {
   display: flex;
   justify-content: space-between;
-  gap: 16px;
+  min-inline-size: 0;
+  gap: var(--openbitfun-space-4);
+}
+
+.card-heading {
+  gap: var(--openbitfun-layout-card-header-gap);
+}
+
+.card-heading > div {
+  min-inline-size: 0;
 }
 
 .badge {
+  flex: 0 0 auto;
   align-self: flex-start;
-  padding: 5px 9px;
-  border-radius: 999px;
-  background: var(--border);
-  font-size: 12px;
-  font-weight: 700;
+  padding-block: var(--openbitfun-control-status-pill-padding-block);
+  padding-inline: var(--openbitfun-control-status-pill-padding-inline);
+  border-radius: var(--openbitfun-control-status-pill-radius);
+  color: var(--openbitfun-color-content-secondary);
+  background: var(--openbitfun-color-action-neutral-surface);
+  font-family: var(--openbitfun-type-meta-font-family);
+  font-size: var(--openbitfun-type-meta-font-size);
+  font-weight: var(--openbitfun-type-meta-font-weight);
+  line-height: var(--openbitfun-type-meta-line-height);
+  letter-spacing: var(--openbitfun-type-meta-letter-spacing);
+}
+
+.badge[data-tone="success"] {
+  color: var(--openbitfun-color-status-success-content);
+  background: var(--openbitfun-color-status-success-surface);
+}
+
+.badge[data-tone="warning"] {
+  color: var(--openbitfun-color-status-warning-content);
+  background: var(--openbitfun-color-status-warning-surface);
 }
 
 .path {
   overflow-wrap: anywhere;
-  color: var(--muted);
-  font-family: ui-monospace, "Cascadia Mono", monospace;
-  font-size: 12px;
+  color: var(--openbitfun-color-content-muted);
+  font-family: var(--openbitfun-font-family-mono);
+  font-size: var(--openbitfun-type-support-font-size);
 }
 
 .scope-list,
 .result-list {
   display: grid;
-  gap: 10px;
-  margin: 18px 0;
+  gap: var(--openbitfun-space-2);
+  margin-block: var(--openbitfun-space-4);
 }
 
 .scope-option,
 .result-row {
-  padding: 14px;
-  border: 1px solid var(--border);
-  border-radius: 10px;
-  background: var(--surface);
+  padding: var(--openbitfun-space-3);
+  border: var(--openbitfun-border-width-default) solid var(--openbitfun-color-border-subtle);
+  border-radius: var(--openbitfun-radius-base);
+  background: var(--openbitfun-color-surface-scene);
+}
+
+.scope-option {
+  justify-content: flex-start;
+  gap: var(--openbitfun-space-3);
+}
+
+.scope-option:has(input:checked) {
+  border-color: var(--openbitfun-color-border-default);
+  background: var(--openbitfun-color-selection-surface);
+}
+
+.scope-option:has(input:enabled):hover {
+  border-color: var(--openbitfun-color-field-border-hover);
 }
 
 .scope-option label {
   flex: 1;
+  min-inline-size: 0;
   cursor: pointer;
+  overflow-wrap: anywhere;
+}
+
+.scope-option:has(input:disabled) label {
+  cursor: default;
 }
 
 .scope-option strong,
@@ -127,98 +245,261 @@ h2 {
   display: block;
 }
 
+.scope-option strong,
+.result-row strong {
+  color: var(--openbitfun-color-content-primary);
+  font-family: var(--openbitfun-type-label-md-font-family);
+  font-size: var(--openbitfun-type-label-md-font-size);
+  font-weight: var(--openbitfun-type-label-md-font-weight);
+  line-height: var(--openbitfun-type-label-md-line-height);
+  letter-spacing: var(--openbitfun-type-label-md-letter-spacing);
+}
+
 .scope-option span,
 .result-row small {
-  margin-top: 4px;
-  color: var(--muted);
-  line-height: 1.4;
+  color: var(--openbitfun-color-content-muted);
+  font-family: var(--openbitfun-type-support-font-family);
+  font-size: var(--openbitfun-type-support-font-size);
+  font-weight: var(--openbitfun-type-support-font-weight);
+  line-height: var(--openbitfun-type-support-line-height);
+  letter-spacing: var(--openbitfun-type-support-letter-spacing);
+}
+
+.scope-option span {
+  margin-block-start: var(--openbitfun-space-1);
+}
+
+.result-row > * {
+  min-inline-size: 0;
+  overflow-wrap: anywhere;
+}
+
+.result-row small {
+  max-inline-size: 60%;
+  text-align: end;
 }
 
 input[type="checkbox"] {
-  width: 20px;
-  height: 20px;
-  accent-color: var(--accent);
+  appearance: none;
+  display: grid;
+  flex: 0 0 auto;
+  place-content: center;
+  inline-size: var(--openbitfun-space-4);
+  block-size: var(--openbitfun-space-4);
+  margin: var(--openbitfun-border-width-default) 0 0;
+  border: var(--openbitfun-border-width-default) solid var(--openbitfun-color-field-border);
+  border-radius: var(--openbitfun-radius-sm);
+  color: var(--openbitfun-color-content-inverse);
+  background: var(--openbitfun-color-field-background);
+  cursor: pointer;
+}
+
+input[type="checkbox"]::before {
+  content: "";
+  inline-size: var(--openbitfun-space-2);
+  block-size: var(--openbitfun-space-1);
+  border-inline-start: var(--openbitfun-border-width-strong) solid currentColor;
+  border-block-end: var(--openbitfun-border-width-strong) solid currentColor;
+  transform: translateY(-1px) rotate(-45deg);
+  visibility: hidden;
+}
+
+input[type="checkbox"]:checked {
+  border-color: var(--openbitfun-color-accent-default);
+  background: var(--openbitfun-color-accent-default);
+}
+
+input[type="checkbox"]:checked::before {
+  visibility: visible;
+}
+
+input[type="checkbox"]:disabled {
+  opacity: var(--openbitfun-opacity-disabled);
+  cursor: default;
 }
 
 .actions {
   display: flex;
   flex-wrap: wrap;
-  gap: 10px;
-  margin-top: 18px;
+  gap: var(--openbitfun-space-2);
+  margin-block-start: var(--openbitfun-space-4);
 }
 
 button {
-  min-height: 40px;
-  padding: 9px 15px;
-  border: 1px solid var(--border);
-  border-radius: 9px;
-  background: var(--surface);
-  color: var(--text);
+  min-block-size: var(--openbitfun-control-height-md);
+  max-inline-size: 100%;
+  padding: var(--openbitfun-space-component-block) var(--openbitfun-space-5);
+  border: var(--openbitfun-border-width-default) solid var(--openbitfun-color-action-neutral-border);
+  border-radius: var(--openbitfun-radius-pill);
+  background: var(--openbitfun-color-surface-tertiary);
+  color: var(--openbitfun-color-action-neutral-content);
   cursor: pointer;
-  font: inherit;
-  font-weight: 650;
+  overflow-wrap: anywhere;
+  font-family: var(--openbitfun-type-label-md-font-family);
+  font-size: var(--openbitfun-type-label-md-font-size);
+  font-weight: var(--openbitfun-type-label-md-font-weight);
+  line-height: var(--openbitfun-type-label-md-line-height);
+  letter-spacing: var(--openbitfun-type-label-md-letter-spacing);
+  transition:
+    background-color var(--openbitfun-motion-duration-fast) var(--openbitfun-motion-easing-standard),
+    border-color var(--openbitfun-motion-duration-fast) var(--openbitfun-motion-easing-standard),
+    color var(--openbitfun-motion-duration-fast) var(--openbitfun-motion-easing-standard);
+}
+
+button:hover:not(:disabled) {
+  background: var(--openbitfun-color-action-neutral-surface-hover);
+}
+
+button:active:not(:disabled) {
+  background: var(--openbitfun-color-action-neutral-surface-pressed);
 }
 
 button.primary {
-  border-color: var(--accent);
-  background: var(--accent);
-  color: var(--accent-text);
+  border-color: transparent;
+  background: var(--openbitfun-color-action-primary-background);
+  color: var(--openbitfun-color-action-primary-content);
+}
+
+button.primary:hover:not(:disabled) {
+  background: var(--openbitfun-color-action-primary-hover);
+}
+
+button.primary:active:not(:disabled) {
+  background: var(--openbitfun-color-action-primary-pressed);
 }
 
 button.quiet {
   border-color: transparent;
-  background: transparent;
+  color: var(--openbitfun-color-accent-default);
+}
+
+button.quiet:hover:not(:disabled) {
+  color: var(--openbitfun-color-accent-hover);
+  text-decoration: underline;
+  text-underline-offset: 0.12em;
 }
 
 button:disabled {
-  cursor: wait;
-  opacity: 0.55;
+  cursor: not-allowed;
+  color: var(--openbitfun-color-action-neutral-content-disabled);
+}
+
+button.primary:disabled {
+  background: var(--openbitfun-color-action-neutral-surface);
 }
 
 button:focus-visible,
 input:focus-visible {
-  outline: 3px solid var(--focus);
-  outline-offset: 2px;
+  outline: var(--openbitfun-focus-width) solid var(--openbitfun-color-focus-ring);
+  outline-offset: var(--openbitfun-focus-offset);
 }
 
+.notice,
 .warning {
-  margin-top: 14px;
-  padding: 14px;
-  border-radius: 10px;
-  background: var(--warning);
-  line-height: 1.5;
+  padding: var(--openbitfun-space-3) var(--openbitfun-space-4);
+  border: var(--openbitfun-border-width-default) solid var(--openbitfun-color-status-info-border);
+  border-radius: var(--openbitfun-radius-base);
+  color: var(--openbitfun-color-status-info-content);
+  background: var(--openbitfun-color-status-info-surface);
+  overflow-wrap: anywhere;
+  font-family: var(--openbitfun-type-body-sm-font-family);
+  font-size: var(--openbitfun-type-body-sm-font-size);
+  line-height: var(--openbitfun-type-body-sm-line-height);
+}
+
+.notice {
+  margin-block-end: var(--openbitfun-space-4);
+}
+
+.notice[data-tone="danger"] {
+  border-color: var(--openbitfun-color-status-danger-border);
+  color: var(--openbitfun-color-status-danger-content);
+  background: var(--openbitfun-color-status-danger-surface);
+}
+
+.warning {
+  margin-block-start: var(--openbitfun-space-3);
+  border-color: var(--openbitfun-color-status-warning-border);
+  color: var(--openbitfun-color-status-warning-content);
+  background: var(--openbitfun-color-status-warning-surface);
 }
 
 .progress-facts {
   display: grid;
   grid-template-columns: repeat(3, minmax(0, 1fr));
-  gap: 10px;
+  gap: var(--openbitfun-space-3);
+  margin-block: var(--openbitfun-space-4);
 }
 
 .progress-facts div {
-  padding: 12px;
-  border: 1px solid var(--border);
-  border-radius: 10px;
+  padding: var(--openbitfun-space-3);
+  border-radius: var(--openbitfun-radius-base);
+  background: var(--openbitfun-color-surface-scene);
 }
 
 .progress-facts dt {
-  color: var(--muted);
-  font-size: 12px;
+  color: var(--openbitfun-color-content-muted);
+  font-family: var(--openbitfun-type-meta-font-family);
+  font-size: var(--openbitfun-type-meta-font-size);
+  line-height: var(--openbitfun-type-meta-line-height);
 }
 
 .progress-facts dd {
-  margin: 6px 0 0;
+  margin: var(--openbitfun-space-2) 0 0;
+  color: var(--openbitfun-color-content-primary);
   overflow-wrap: anywhere;
-  font-weight: 700;
+  font-weight: var(--openbitfun-type-label-md-font-weight);
+  font-variant-numeric: tabular-nums;
 }
 
 @media (max-width: 680px) {
   .shell {
-    width: min(100% - 24px, 760px);
-    padding-top: 24px;
+    width: calc(100% - var(--openbitfun-space-6));
+    padding-block-start: var(--openbitfun-space-6);
+  }
+
+  .card {
+    padding: var(--openbitfun-layout-card-padding-sm);
   }
 
   .progress-facts {
     grid-template-columns: 1fr;
   }
+
+  .result-row {
+    flex-direction: column;
+    gap: var(--openbitfun-space-1);
+  }
+
+  .result-row small {
+    max-inline-size: 100%;
+    text-align: start;
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  button {
+    transition: none;
+  }
+}
+
+@media (forced-colors: active) {
+  button,
+  .card,
+  .scope-option,
+  .result-row,
+  .notice,
+  .warning {
+    border-color: ButtonText;
+  }
+
+  input[type="checkbox"] {
+    appearance: auto;
+    accent-color: auto;
+    opacity: 1;
+  }
+
+  input[type="checkbox"]::before {
+    content: none;
+  }
 }
diff --git a/src/apps/data-migrator/ui/theme.js b/src/apps/data-migrator/ui/theme.js
new file mode 100644
index 0000000000..f3765efaf3
--- /dev/null
+++ b/src/apps/data-migrator/ui/theme.js
@@ -0,0 +1,13 @@
+// Select the public theme before first paint, then follow OS appearance changes.
+(() => {
+  const root = document.documentElement;
+  const dark = window.matchMedia('(prefers-color-scheme: dark)');
+  const contrast = window.matchMedia('(prefers-contrast: more)');
+  const applyTheme = () => {
+    root.dataset.colorScheme = dark.matches ? 'dark' : 'light';
+    root.dataset.contrast = contrast.matches ? 'high' : 'normal';
+  };
+  applyTheme();
+  dark.addEventListener('change', applyTheme);
+  contrast.addEventListener('change', applyTheme);
+})();
diff --git a/src/apps/data-migrator/ui/transport.js b/src/apps/data-migrator/ui/transport.js
new file mode 100644
index 0000000000..8834f67b87
--- /dev/null
+++ b/src/apps/data-migrator/ui/transport.js
@@ -0,0 +1,4 @@
+// The static surface has no direct filesystem, shell or main-app connection.
+export function invoke(command, payload) {
+  return window.__TAURI__.core.invoke(command, payload);
+}
diff --git a/src/apps/desktop/AGENTS.md b/src/apps/desktop/AGENTS.md
index 6d1f3e66bd..d2087e3a83 100644
--- a/src/apps/desktop/AGENTS.md
+++ b/src/apps/desktop/AGENTS.md
@@ -56,10 +56,9 @@ pnpm run desktop:preview:debug
 pnpm run prepare:dsh-profile   # optional: local DeepSeek Harness sessions
 ```
 
-Both development launchers supervise legacy Data Migrator handoffs. Dismissing
-or finishing migration reopens Desktop automatically; `desktop:dev` restores
-Vite and the Rust watcher. Verify this orchestration with
-`node --test scripts/desktop-dev-migration.test.mjs`.
+Data Migrator runs independently. Desktop development launchers do not build,
+launch, or supervise the migrator; use its own development and release entry
+points under `src/apps/data-migrator`.
 
 ## Fast builds
 
diff --git a/src/apps/desktop/Cargo.toml b/src/apps/desktop/Cargo.toml
index 8b9279c212..6189fda773 100644
--- a/src/apps/desktop/Cargo.toml
+++ b/src/apps/desktop/Cargo.toml
@@ -23,8 +23,7 @@ openbitfun-core = { path = "../../crates/assembly/core", features = ["product-fu
 openbitfun-relay-service = { path = "../../crates/services/relay-service" }
 openbitfun-agent-runtime = { path = "../../crates/execution/agent-runtime", features = ["agent-runtime"] }
 openbitfun-runtime-ports = { path = "../../crates/contracts/runtime-ports", features = ["agent-api", "permission", "workspace-ports"] }
-openbitfun-product-domains = { path = "../../crates/contracts/product-domains", features = ["appearance-market", "legacy-migration"] }
-openbitfun-legacy-migration = { path = "../../crates/services/legacy-migration" }
+openbitfun-product-domains = { path = "../../crates/contracts/product-domains", features = ["appearance-market"] }
 openbitfun-services-integrations = { path = "../../crates/services/services-integrations", features = ["canvas-runtime", "miniapp-market", "remote-ssh-concrete", "speech-realtime"] }
 openbitfun-core-types = { path = "../../crates/contracts/core-types" }
 openbitfun-agent-tools = { path = "../../crates/execution/tool-contracts", features = ["element-token"] }
diff --git a/src/apps/desktop/src/api/commands.rs b/src/apps/desktop/src/api/commands.rs
index 125f470c14..f8f995d22f 100644
--- a/src/apps/desktop/src/api/commands.rs
+++ b/src/apps/desktop/src/api/commands.rs
@@ -27,6 +27,7 @@ use openbitfun_core::service::remote_ssh::workspace_state::is_remote_path;
 use openbitfun_core::service::remote_ssh::{
     search_remote_file_names, shell_quote_posix, RemoteFileNameSearch,
 };
+use openbitfun_core::service::workspace::WorkspaceInfoRuntimeExt;
 use openbitfun_core::service::workspace::{
     ScanOptions, WorkspaceInfo, WorkspaceKind, WorkspaceOpenOptions,
 };
diff --git a/src/apps/desktop/src/api/legacy_migration_api.rs b/src/apps/desktop/src/api/legacy_migration_api.rs
deleted file mode 100644
index 28cdfb3983..0000000000
--- a/src/apps/desktop/src/api/legacy_migration_api.rs
+++ /dev/null
@@ -1,694 +0,0 @@
-//! Local-only product entry points for the standalone legacy Data Migrator.
-//!
-//! This module may inspect the retired BitFun roots and create authenticated
-//! handoffs. It never writes migrated product data; only the sibling Data
-//! Migrator executes a plan after Desktop has shut down.
-
-use openbitfun_core::legacy_migration::adapters_for_groups;
-use openbitfun_core_types::product_identity::product_id;
-use openbitfun_legacy_migration::{
-    launch_trusted_executable, probe_legacy_source, CancellationToken, HandoffStore,
-    LegacyMigrationError, LegacyMigrationResult, MigrationEngine, MigrationOnboardingStore,
-    MigrationRoots, ProbeLimits, TrustedInstallationResolver,
-};
-use openbitfun_product_domains::legacy_migration::{
-    LegacySourceDescriptor, MigrationOnboardingState, MigrationPromptChoice, MigrationRunReport,
-    MigrationSelection, MigratorHandoffRequest, MigratorProtocolCapabilities, MigratorRequestMode,
-    MigratorRequestOrigin, ScanFinding, CURRENT_MIGRATION_FORMAT_VERSION,
-};
-use serde::{Deserialize, Serialize};
-use std::ffi::{OsStr, OsString};
-use std::sync::OnceLock;
-use std::time::{SystemTime, UNIX_EPOCH};
-use tauri::AppHandle;
-
-const RELEASE_CHANNEL: &str = match option_env!("OPENBITFUN_RELEASE_CHANNEL") {
-    Some(value) => value,
-    None => "stable",
-};
-const DESKTOP_BINARY_NAME: &str = match option_env!("OPENBITFUN_DESKTOP_BINARY_NAME") {
-    Some(value) => value,
-    None => "openbitfun-desktop",
-};
-const DATA_MIGRATOR_BINARY_NAME: &str = match option_env!("OPENBITFUN_DATA_MIGRATOR_BINARY_NAME") {
-    Some(value) => value,
-    None => "openbitfun-data-migrator",
-};
-const HANDOFF_LIFETIME_MS: i64 = 10 * 60 * 1000;
-
-static STARTUP_MIGRATION_STATE: OnceLock<StartupMigrationState> = OnceLock::new();
-
-#[derive(Debug, Clone, Default)]
-struct StartupMigrationState {
-    handled_run_id: Option<String>,
-    startup_error: Option<LegacyMigrationCommandError>,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub(crate) enum StartupProbeDisposition {
-    Continue {
-        handled_run_id: Option<String>,
-        startup_error: Option<LegacyMigrationCommandError>,
-    },
-    MigratorLaunched,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
-#[serde(rename_all = "camelCase")]
-pub struct LegacyMigrationCommandError {
-    pub code: String,
-    pub message: String,
-    pub recoverable: bool,
-}
-
-impl LegacyMigrationCommandError {
-    fn new(code: &str, message: &str, recoverable: bool) -> Self {
-        Self {
-            code: code.to_string(),
-            message: message.to_string(),
-            recoverable,
-        }
-    }
-
-    fn from_legacy(error: &LegacyMigrationError) -> Self {
-        match error {
-            LegacyMigrationError::UnsupportedSource(_) => Self::new(
-                "unsupported_source",
-                "The discovered BitFun data format is not supported by this Data Migrator.",
-                false,
-            ),
-            LegacyMigrationError::InvalidRequest(_) | LegacyMigrationError::InvalidPlan(_) => {
-                Self::new(
-                    "invalid_migration_request",
-                    "The migration request is invalid or no longer current.",
-                    true,
-                )
-            }
-            LegacyMigrationError::UntrustedExecutable(_)
-            | LegacyMigrationError::TrustedInstallationUnavailable(_) => Self::new(
-                "data_migrator_unavailable",
-                "The installed Data Migrator is missing or failed installation layout checks. Repair or update this OpenBitFun installation.",
-                false,
-            ),
-            LegacyMigrationError::LockUnavailable => Self::new(
-                "migration_locked",
-                "Another Data Migrator currently owns the migration lock.",
-                true,
-            ),
-            LegacyMigrationError::PathUnavailable(_)
-            | LegacyMigrationError::SourceEqualsTarget(_)
-            | LegacyMigrationError::PathEscape(_)
-            | LegacyMigrationError::LinkedPath(_)
-            | LegacyMigrationError::ResourceLimit(_) => Self::new(
-                "migration_storage_unavailable",
-                "The local migration storage or retired BitFun source failed a safety check.",
-                false,
-            ),
-            LegacyMigrationError::ProcessInspection(_) => Self::new(
-                "process_inspection_failed",
-                "OpenBitFun could not inspect local data-writing processes.",
-                true,
-            ),
-            LegacyMigrationError::Cancelled => Self::new(
-                "cancelled",
-                "The read-only migration operation was cancelled.",
-                true,
-            ),
-            LegacyMigrationError::InjectedCrash(_)
-            | LegacyMigrationError::Domain { .. }
-            | LegacyMigrationError::Io { .. }
-            | LegacyMigrationError::Json { .. }
-            | LegacyMigrationError::Sqlite { .. } => Self::new(
-                "migration_operation_failed",
-                "OpenBitFun could not safely inspect or prepare the local migration state.",
-                true,
-            ),
-        }
-    }
-
-    fn from_startup_launch(error: &LegacyMigrationError) -> Self {
-        match error {
-            LegacyMigrationError::UntrustedExecutable(_)
-            | LegacyMigrationError::TrustedInstallationUnavailable(_) => Self::from_legacy(error),
-            _ => Self::new(
-                "data_migrator_launch_failed",
-                "The Data Migrator could not be started safely. OpenBitFun continued without changing legacy BitFun data.",
-                true,
-            ),
-        }
-    }
-}
-
-impl From<LegacyMigrationError> for LegacyMigrationCommandError {
-    fn from(error: LegacyMigrationError) -> Self {
-        Self::from_legacy(&error)
-    }
-}
-
-#[derive(Debug, Default, Deserialize)]
-#[serde(default, deny_unknown_fields, rename_all = "camelCase")]
-pub struct EmptyLegacyMigrationRequest {}
-
-#[derive(Debug, Default, Deserialize)]
-#[serde(default, deny_unknown_fields, rename_all = "camelCase")]
-pub struct ScanLegacyMigrationRequest {
-    pub selection: Option<MigrationSelection>,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields, rename_all = "camelCase")]
-pub struct PrepareLegacyMigrationRequest {
-    pub selection: MigrationSelection,
-}
-
-#[derive(Debug, Default, Deserialize)]
-#[serde(default, deny_unknown_fields, rename_all = "camelCase")]
-pub struct GetLegacyMigrationReportRequest {
-    pub run_id: Option<String>,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields, rename_all = "camelCase")]
-pub struct SetLegacyMigrationPromptPreferenceRequest {
-    pub choice: MigrationPromptChoice,
-}
-
-#[derive(Debug, Clone, Serialize)]
-#[serde(rename_all = "camelCase")]
-pub struct LegacyMigrationStatusView {
-    pub source: Option<LegacySourceDescriptor>,
-    pub onboarding: MigrationOnboardingState,
-    pub latest_report: Option<MigrationRunReport>,
-    pub startup_report: Option<MigrationRunReport>,
-    pub startup_error: Option<LegacyMigrationCommandError>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-#[serde(rename_all = "camelCase")]
-pub struct LegacyMigrationScanView {
-    pub source: LegacySourceDescriptor,
-    pub selection: MigrationSelection,
-    pub scanned_at_ms: i64,
-    pub findings: Vec<ScanFinding>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-#[serde(rename_all = "camelCase")]
-pub struct LegacyMigrationHandoffView {
-    pub run_id: String,
-    pub mode: MigratorRequestMode,
-}
-
-pub(crate) fn run_startup_probe() -> LegacyMigrationResult<StartupProbeDisposition> {
-    let roots = MigrationRoots::resolve_current_user()?;
-    let onboarding = MigrationOnboardingStore::new(roots.clone());
-    let restart_run_id = migration_restart_run_id(std::env::args_os().skip(1));
-    if let Some(run_id) = restart_run_id {
-        if onboarding.consume_handled_run_id(&run_id)? {
-            return Ok(StartupProbeDisposition::Continue {
-                handled_run_id: Some(run_id),
-                startup_error: None,
-            });
-        }
-    }
-
-    let state = onboarding.load()?;
-    let Some(source) = probe_legacy_source(&roots, ProbeLimits::default())? else {
-        return Ok(StartupProbeDisposition::Continue {
-            handled_run_id: None,
-            startup_error: None,
-        });
-    };
-    if !should_offer_onboarding(&state, &source) {
-        return Ok(StartupProbeDisposition::Continue {
-            handled_run_id: None,
-            startup_error: None,
-        });
-    }
-
-    let request = new_handoff_request(
-        MigratorRequestMode::Onboarding,
-        MigratorRequestOrigin::FirstLaunch,
-        &source,
-        MigrationSelection::all(),
-    );
-    HandoffStore::new(roots.clone(), product_id(), RELEASE_CHANNEL)
-        .write_request(&request, now_ms())?;
-    onboarding.update(|state| {
-        state.format_version = CURRENT_MIGRATION_FORMAT_VERSION;
-        if state.source_fingerprint != source.source_fingerprint {
-            state.choice = MigrationPromptChoice::Unset;
-        }
-        state.source_fingerprint = source.source_fingerprint.clone();
-        state.detected_at_ms.get_or_insert_with(now_ms);
-        state.last_prompted_version = Some(env!("CARGO_PKG_VERSION").to_string());
-        state.run_id = Some(request.run_id.clone());
-        state.handled_run_id = None;
-    })?;
-    match launch_data_migrator(&request.run_id) {
-        Ok(_) => Ok(StartupProbeDisposition::MigratorLaunched),
-        Err(error) => Ok(continue_after_startup_launch_failure(error)),
-    }
-}
-
-fn continue_after_startup_launch_failure(error: LegacyMigrationError) -> StartupProbeDisposition {
-    StartupProbeDisposition::Continue {
-        handled_run_id: None,
-        startup_error: Some(LegacyMigrationCommandError::from_startup_launch(&error)),
-    }
-}
-
-pub(crate) fn set_startup_migration_state(
-    handled_run_id: Option<String>,
-    startup_error: Option<LegacyMigrationCommandError>,
-) {
-    let _ = STARTUP_MIGRATION_STATE.set(StartupMigrationState {
-        handled_run_id,
-        startup_error,
-    });
-}
-
-#[tauri::command]
-pub fn get_legacy_migration_status(
-    request: EmptyLegacyMigrationRequest,
-) -> Result<LegacyMigrationStatusView, LegacyMigrationCommandError> {
-    let _ = request;
-    migration_status().map_err(Into::into)
-}
-
-#[tauri::command]
-pub async fn scan_legacy_migration(
-    request: ScanLegacyMigrationRequest,
-) -> Result<LegacyMigrationScanView, LegacyMigrationCommandError> {
-    let selection = request.selection.unwrap_or_else(MigrationSelection::all);
-    if selection.groups.is_empty() {
-        return Err(LegacyMigrationCommandError::new(
-            "empty_selection",
-            "Select at least one migration group.",
-            true,
-        ));
-    }
-    tauri::async_runtime::spawn_blocking(move || scan_local_source(selection))
-        .await
-        .map_err(|_| {
-            LegacyMigrationCommandError::new(
-                "scan_worker_failed",
-                "The local read-only migration scan stopped unexpectedly.",
-                true,
-            )
-        })?
-        .map_err(Into::into)
-}
-
-#[tauri::command]
-pub fn prepare_legacy_migration(
-    app: AppHandle,
-    request: PrepareLegacyMigrationRequest,
-) -> Result<LegacyMigrationHandoffView, LegacyMigrationCommandError> {
-    if request.selection.groups.is_empty() {
-        return Err(LegacyMigrationCommandError::new(
-            "empty_selection",
-            "Select at least one migration group.",
-            true,
-        ));
-    }
-    let handoff =
-        prepare_settings_handoff(request.selection).map_err(LegacyMigrationCommandError::from)?;
-    crate::request_desktop_exit(&app, 0, "legacy_migration_handoff");
-    Ok(handoff)
-}
-
-#[tauri::command]
-pub fn get_legacy_migration_report(
-    request: GetLegacyMigrationReportRequest,
-) -> Result<Option<MigrationRunReport>, LegacyMigrationCommandError> {
-    let roots =
-        MigrationRoots::resolve_current_user().map_err(LegacyMigrationCommandError::from)?;
-    let store = MigrationOnboardingStore::new(roots);
-    let report = match request.run_id.as_deref() {
-        Some(run_id) => store.load_report(run_id),
-        None => store.load_last_report(),
-    }
-    .map_err(LegacyMigrationCommandError::from)?;
-    Ok(report.as_ref().map(redact_report_for_ui))
-}
-
-#[tauri::command]
-pub fn set_legacy_migration_prompt_preference(
-    request: SetLegacyMigrationPromptPreferenceRequest,
-) -> Result<MigrationOnboardingState, LegacyMigrationCommandError> {
-    if !matches!(
-        request.choice,
-        MigrationPromptChoice::Unset
-            | MigrationPromptChoice::RemindLater
-            | MigrationPromptChoice::DoNotRemind
-    ) {
-        return Err(LegacyMigrationCommandError::new(
-            "invalid_prompt_preference",
-            "Only reminder preferences can be changed from OpenBitFun settings.",
-            false,
-        ));
-    }
-    let roots =
-        MigrationRoots::resolve_current_user().map_err(LegacyMigrationCommandError::from)?;
-    MigrationOnboardingStore::new(roots)
-        .update(|state| {
-            state.format_version = CURRENT_MIGRATION_FORMAT_VERSION;
-            state.choice = request.choice;
-            state.handled_run_id = None;
-        })
-        .map_err(Into::into)
-}
-
-fn migration_status() -> LegacyMigrationResult<LegacyMigrationStatusView> {
-    let roots = MigrationRoots::resolve_current_user()?;
-    let onboarding_store = MigrationOnboardingStore::new(roots.clone());
-    let onboarding = onboarding_store.load()?;
-    let source = probe_legacy_source(&roots, ProbeLimits::default())?;
-    let latest_report = onboarding_store
-        .load_last_report()?
-        .as_ref()
-        .map(redact_report_for_ui);
-    let startup_report = STARTUP_MIGRATION_STATE
-        .get()
-        .and_then(|state| state.handled_run_id.as_deref())
-        .map(|run_id| onboarding_store.load_report(run_id))
-        .transpose()?
-        .flatten()
-        .as_ref()
-        .map(redact_report_for_ui);
-    Ok(LegacyMigrationStatusView {
-        source,
-        onboarding,
-        latest_report,
-        startup_report,
-        startup_error: STARTUP_MIGRATION_STATE
-            .get()
-            .and_then(|state| state.startup_error.clone()),
-    })
-}
-
-fn scan_local_source(
-    selection: MigrationSelection,
-) -> LegacyMigrationResult<LegacyMigrationScanView> {
-    let roots = MigrationRoots::resolve_current_user()?;
-    let source = probe_legacy_source(&roots, ProbeLimits::default())?.ok_or_else(|| {
-        LegacyMigrationError::UnsupportedSource(
-            "no supported legacy BitFun data was discovered".to_string(),
-        )
-    })?;
-    if !source.supported {
-        return Err(LegacyMigrationError::UnsupportedSource(
-            source.product_version.clone(),
-        ));
-    }
-    let engine = MigrationEngine::new(roots.clone(), adapters_for_groups(&selection))?;
-    let findings = engine
-        .scan(&selection, &CancellationToken::default())?
-        .into_iter()
-        .map(|scan| scan.finding)
-        .collect();
-    let scanned_at_ms = now_ms();
-    MigrationOnboardingStore::new(roots).update(|state| {
-        state.format_version = CURRENT_MIGRATION_FORMAT_VERSION;
-        state.source_fingerprint = source.source_fingerprint.clone();
-        state.detected_at_ms.get_or_insert(scanned_at_ms);
-        state.last_scanned_at_ms = Some(scanned_at_ms);
-    })?;
-    Ok(LegacyMigrationScanView {
-        source,
-        selection,
-        scanned_at_ms,
-        findings,
-    })
-}
-
-fn prepare_settings_handoff(
-    selection: MigrationSelection,
-) -> LegacyMigrationResult<LegacyMigrationHandoffView> {
-    let roots = MigrationRoots::resolve_current_user()?;
-    let source = probe_legacy_source(&roots, ProbeLimits::default())?.ok_or_else(|| {
-        LegacyMigrationError::UnsupportedSource(
-            "no supported legacy BitFun data was discovered".to_string(),
-        )
-    })?;
-    if !source.supported {
-        return Err(LegacyMigrationError::UnsupportedSource(
-            source.product_version.clone(),
-        ));
-    }
-    let request = new_handoff_request(
-        MigratorRequestMode::Execute,
-        MigratorRequestOrigin::Settings,
-        &source,
-        selection,
-    );
-    HandoffStore::new(roots.clone(), product_id(), RELEASE_CHANNEL)
-        .write_request(&request, now_ms())?;
-    MigrationOnboardingStore::new(roots).update(|state| {
-        state.format_version = CURRENT_MIGRATION_FORMAT_VERSION;
-        state.source_fingerprint = source.source_fingerprint.clone();
-        state.detected_at_ms.get_or_insert_with(now_ms);
-        state.run_id = Some(request.run_id.clone());
-        state.handled_run_id = None;
-    })?;
-    launch_data_migrator(&request.run_id)?;
-    Ok(LegacyMigrationHandoffView {
-        run_id: request.run_id,
-        mode: request.mode,
-    })
-}
-
-fn new_handoff_request(
-    mode: MigratorRequestMode,
-    origin: MigratorRequestOrigin,
-    source: &LegacySourceDescriptor,
-    selection: MigrationSelection,
-) -> MigratorHandoffRequest {
-    let created_at_ms = now_ms();
-    let capabilities = MigratorProtocolCapabilities::current();
-    MigratorHandoffRequest {
-        protocol_version: capabilities.protocol_version,
-        mode,
-        origin,
-        run_id: uuid::Uuid::new_v4().to_string(),
-        nonce: uuid::Uuid::new_v4().to_string(),
-        source_id: Some(source.source_id.clone()),
-        source_fingerprint: Some(source.source_fingerprint.clone()),
-        selection,
-        caller_process_id: std::process::id(),
-        product_id: product_id().to_string(),
-        release_channel: RELEASE_CHANNEL.to_string(),
-        created_at_ms,
-        expires_at_ms: created_at_ms.saturating_add(HANDOFF_LIFETIME_MS),
-        required_capabilities: capabilities.capabilities,
-    }
-}
-
-fn launch_data_migrator(run_id: &str) -> LegacyMigrationResult<u32> {
-    let current = std::env::current_exe().map_err(|error| LegacyMigrationError::Io {
-        path: DESKTOP_BINARY_NAME.into(),
-        source: error,
-    })?;
-    let executable = TrustedInstallationResolver::resolve_sibling(
-        &current,
-        DESKTOP_BINARY_NAME,
-        DATA_MIGRATOR_BINARY_NAME,
-    )?;
-    let pid = launch_trusted_executable(&executable, &[OsStr::new(run_id)])?;
-    #[cfg(debug_assertions)]
-    if let Some(directory) = std::env::var_os("OPENBITFUN_DEV_MIGRATION_DIR") {
-        let path = std::path::PathBuf::from(directory).join("handoff.json");
-        openbitfun_legacy_migration::atomic_write_json(
-            &path,
-            &serde_json::json!({ "runId": run_id, "pid": pid }),
-        )?;
-    }
-    Ok(pid)
-}
-
-fn should_offer_onboarding(
-    state: &MigrationOnboardingState,
-    source: &LegacySourceDescriptor,
-) -> bool {
-    if !source.supported || source.already_migrated {
-        return false;
-    }
-    if state.source_fingerprint != source.source_fingerprint {
-        return true;
-    }
-    !matches!(
-        state.choice,
-        MigrationPromptChoice::DoNotRemind | MigrationPromptChoice::MigrateNow
-    )
-}
-
-fn migration_restart_run_id(arguments: impl IntoIterator<Item = OsString>) -> Option<String> {
-    let mut values = arguments.into_iter();
-    let mut run_id = None;
-    while let Some(argument) = values.next() {
-        if argument != OsStr::new("--legacy-migration-run-id") {
-            continue;
-        }
-        let candidate = values.next()?.into_string().ok()?;
-        if run_id.is_some() || uuid::Uuid::parse_str(&candidate).is_err() {
-            return None;
-        }
-        run_id = Some(candidate);
-    }
-    run_id
-}
-
-fn redact_report_for_ui(report: &MigrationRunReport) -> MigrationRunReport {
-    let mut redacted = report.clone();
-    for diagnostic in &mut redacted.diagnostics {
-        diagnostic.relative_path = None;
-        diagnostic.message = diagnostic.code.replace('_', " ");
-        diagnostic.action = None;
-    }
-    for result in &mut redacted.domain_results {
-        for warning in &mut result.warnings {
-            warning.relative_path = None;
-            warning.message = warning.code.replace('_', " ");
-            warning.action = None;
-        }
-    }
-    redacted
-}
-
-fn now_ms() -> i64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .unwrap_or_default()
-        .as_millis()
-        .try_into()
-        .unwrap_or(i64::MAX)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use openbitfun_product_domains::legacy_migration::MigrationRunStatus;
-
-    fn source(fingerprint: &str) -> LegacySourceDescriptor {
-        LegacySourceDescriptor {
-            source_fingerprint: fingerprint.to_string(),
-            supported: true,
-            ..LegacySourceDescriptor::default()
-        }
-    }
-
-    #[test]
-    fn only_matching_source_preferences_suppress_onboarding() {
-        let mut state = MigrationOnboardingState {
-            source_fingerprint: "source-a".to_string(),
-            choice: MigrationPromptChoice::DoNotRemind,
-            ..MigrationOnboardingState::default()
-        };
-        assert!(!should_offer_onboarding(&state, &source("source-a")));
-        assert!(should_offer_onboarding(&state, &source("source-b")));
-
-        state.choice = MigrationPromptChoice::RemindLater;
-        assert!(should_offer_onboarding(&state, &source("source-a")));
-    }
-
-    #[test]
-    fn completed_source_does_not_offer_onboarding_again() {
-        let mut completed = source("source-a");
-        completed.already_migrated = true;
-        assert!(!should_offer_onboarding(
-            &MigrationOnboardingState::default(),
-            &completed
-        ));
-    }
-
-    #[test]
-    fn restart_argument_requires_one_uuid_value() {
-        let run_id = uuid::Uuid::new_v4().to_string();
-        assert_eq!(
-            migration_restart_run_id([
-                OsString::from("--unrelated"),
-                OsString::from("value"),
-                OsString::from("--legacy-migration-run-id"),
-                OsString::from(&run_id),
-            ]),
-            Some(run_id.clone())
-        );
-        assert_eq!(
-            migration_restart_run_id([
-                OsString::from("--legacy-migration-run-id"),
-                OsString::from("invalid"),
-            ]),
-            None
-        );
-        assert_eq!(
-            migration_restart_run_id([
-                OsString::from("--legacy-migration-run-id"),
-                OsString::from(&run_id),
-                OsString::from("--legacy-migration-run-id"),
-                OsString::from(&run_id),
-            ]),
-            None
-        );
-    }
-
-    #[test]
-    fn settings_handoff_requires_every_current_migrator_capability() {
-        let request = new_handoff_request(
-            MigratorRequestMode::Execute,
-            MigratorRequestOrigin::Settings,
-            &source("source-a"),
-            MigrationSelection::all(),
-        );
-        assert_eq!(
-            request.required_capabilities,
-            MigratorProtocolCapabilities::current().capabilities
-        );
-        assert_eq!(request.mode, MigratorRequestMode::Execute);
-        assert_eq!(request.origin, MigratorRequestOrigin::Settings);
-    }
-
-    #[test]
-    fn ui_report_removes_paths_and_free_text() {
-        let report = MigrationRunReport {
-            status: MigrationRunStatus::FailedRecoverable,
-            diagnostics: vec![
-                openbitfun_product_domains::legacy_migration::MigrationDiagnostic {
-                    code: "legacy_item_failed".to_string(),
-                    relative_path: Some("private/session.md".to_string()),
-                    message: "private body".to_string(),
-                    action: Some("private action".to_string()),
-                    ..Default::default()
-                },
-            ],
-            ..MigrationRunReport::default()
-        };
-        let redacted = redact_report_for_ui(&report);
-        assert!(redacted.diagnostics[0].relative_path.is_none());
-        assert_eq!(redacted.diagnostics[0].message, "legacy item failed");
-        assert!(redacted.diagnostics[0].action.is_none());
-    }
-
-    #[test]
-    fn startup_launch_failure_continues_with_redacted_error() {
-        let disposition = continue_after_startup_launch_failure(LegacyMigrationError::Io {
-            path: r"C:\private\openbitfun-data-migrator.exe".into(),
-            source: std::io::Error::new(
-                std::io::ErrorKind::PermissionDenied,
-                "private operating system detail",
-            ),
-        });
-
-        let StartupProbeDisposition::Continue {
-            handled_run_id,
-            startup_error: Some(error),
-        } = disposition
-        else {
-            panic!("launch failure must allow Desktop startup with a surfaced error");
-        };
-        assert!(handled_run_id.is_none());
-        assert_eq!(error.code, "data_migrator_launch_failed");
-        assert!(error.recoverable);
-        assert!(!error.message.contains("private"));
-    }
-}
diff --git a/src/apps/desktop/src/api/mod.rs b/src/apps/desktop/src/api/mod.rs
index ab82f4c294..38bb045244 100644
--- a/src/apps/desktop/src/api/mod.rs
+++ b/src/apps/desktop/src/api/mod.rs
@@ -31,7 +31,6 @@ pub mod git_api;
 pub mod html_preview_api;
 pub mod i18n_api;
 pub mod insights_api;
-pub mod legacy_migration_api;
 pub mod mcp_api;
 pub mod miniapp_agent_api;
 pub mod miniapp_api;
diff --git a/src/apps/desktop/src/api/terminal_api.rs b/src/apps/desktop/src/api/terminal_api.rs
index c734e30f7d..0c0d67e3eb 100644
--- a/src/apps/desktop/src/api/terminal_api.rs
+++ b/src/apps/desktop/src/api/terminal_api.rs
@@ -128,6 +128,8 @@ pub struct SessionResponse {
     pub name: String,
     pub shell_type: String,
     pub cwd: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub initial_cwd: Option<String>,
     pub pid: Option<u32>,
     pub status: String,
     pub cols: u16,
@@ -146,6 +148,7 @@ impl From<CoreSessionResponse> for SessionResponse {
             name: resp.name,
             shell_type: format!("{:?}", resp.shell_type),
             cwd: resp.cwd,
+            initial_cwd: resp.initial_cwd,
             pid: resp.pid,
             status: resp.status,
             cols: resp.cols,
@@ -399,6 +402,7 @@ async fn spawn_remote_pty_session(
         name: session.name,
         shell_type: "Remote".to_string(),
         cwd: session.cwd.clone(),
+        initial_cwd: Some(session.cwd.clone()),
         pid: session.pid,
         status: format!("{:?}", session.status),
         cols: session.cols,
@@ -554,6 +558,7 @@ pub async fn terminal_get(
                     id: session.id,
                     name: session.name,
                     shell_type: "Remote".to_string(),
+                    initial_cwd: Some(session.cwd.clone()),
                     cwd: session.cwd,
                     pid: session.pid,
                     status: format!("{:?}", session.status),
@@ -590,6 +595,7 @@ pub async fn terminal_list(
                 id: s.id,
                 name: s.name,
                 shell_type: "Remote".to_string(),
+                initial_cwd: Some(s.cwd.clone()),
                 cwd: s.cwd,
                 pid: s.pid,
                 status: format!("{:?}", s.status),
diff --git a/src/apps/desktop/src/lib.rs b/src/apps/desktop/src/lib.rs
index 9a5b67df6e..d113f3e0d9 100644
--- a/src/apps/desktop/src/lib.rs
+++ b/src/apps/desktop/src/lib.rs
@@ -559,20 +559,6 @@ fn get_startup_native_trace(
 /// Tauri application entry point
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub async fn run() {
-    match api::legacy_migration_api::run_startup_probe() {
-        Ok(api::legacy_migration_api::StartupProbeDisposition::Continue {
-            handled_run_id,
-            startup_error,
-        }) => api::legacy_migration_api::set_startup_migration_state(handled_run_id, startup_error),
-        Ok(api::legacy_migration_api::StartupProbeDisposition::MigratorLaunched) => return,
-        Err(error) => {
-            show_fatal_startup_error(&format!(
-                "OpenBitFun could not safely inspect legacy migration state and cannot continue.\n\n{}\n\nRepair the installation or the migration state before retrying.",
-                api::legacy_migration_api::LegacyMigrationCommandError::from(error).message
-            ));
-            return;
-        }
-    }
     let startup_started = Instant::now();
     let startup_trace_id = SystemTime::now()
         .duration_since(UNIX_EPOCH)
@@ -1467,11 +1453,6 @@ pub async fn run() {
             api::agentic_api::set_session_memory_mode,
             webdriver_bridge_result,
             get_startup_native_trace,
-            api::legacy_migration_api::get_legacy_migration_status,
-            api::legacy_migration_api::scan_legacy_migration,
-            api::legacy_migration_api::prepare_legacy_migration,
-            api::legacy_migration_api::get_legacy_migration_report,
-            api::legacy_migration_api::set_legacy_migration_prompt_preference,
             api::agentic_api::list_sessions,
             api::agentic_api::list_pending_permission_requests,
             api::agentic_api::subscribe_permission_requests,
diff --git a/src/crates/assembly/core/Cargo.toml b/src/crates/assembly/core/Cargo.toml
index 9ed1273665..da9d24313c 100644
--- a/src/crates/assembly/core/Cargo.toml
+++ b/src/crates/assembly/core/Cargo.toml
@@ -80,16 +80,17 @@ openbitfun-agent-tools = { path = "../../execution/tool-contracts", optional = t
 openbitfun-tool-packs = { path = "../../execution/tool-provider-groups", optional = true }
 
 # Core service owner crate
-openbitfun-services-core = { path = "../../services/services-core", features = ["json-io", "product-identity"] }
+openbitfun-services-core = { path = "../../services/services-core", features = ["json-io", "product-identity", "workspace-identity"] }
 
 # Integration service owner crate
 openbitfun-services-integrations = { path = "../../services/services-integrations", optional = true }
 
-# Offline legacy-data migration engine. Product-owned adapters are assembled in Core.
-openbitfun-legacy-migration = { path = "../../services/legacy-migration", optional = true }
+# Optional compatibility export for the independent offline migration adapters.
+openbitfun-legacy-migration-adapters = { path = "../../services/legacy-migration-adapters", optional = true }
 
 # Product domain owner crate
 openbitfun-product-domains = { path = "../../contracts/product-domains", optional = true }
+openbitfun-config-contracts = { path = "../../contracts/config-contracts" }
 
 # Tool runtime
 tool-runtime = { path = "../../execution/tool-execution", optional = true }
@@ -137,6 +138,7 @@ default = []
 # product matrix. The other two upstream crates are non-optional and propagate
 # their `ts` features directly.
 ts = [
+    "openbitfun-config-contracts/ts",
     "dep:ts-rs",
     "openbitfun-core-types/ts",
     "openbitfun-services-integrations?/ts",
@@ -190,12 +192,14 @@ product-full = [
     "product-capabilities",
     "runtime-services",
     "tool-packs",
-    "legacy-migration",
 ]
 # Core compatibility facade and concrete product Agent Runtime assembly. This
 # owns the existing agent/session/tool lifecycle, not app presentation or
 # external ecosystem discovery.
 agent-runtime = [
+    "dep:openbitfun-product-domains",
+    "openbitfun-services-core/coordination-store",
+    "openbitfun-services-core/session-event-format",
     "ai-adapter-runtime",
     "dep:openbitfun-agent-runtime",
     "openbitfun-agent-runtime/agent-runtime",
@@ -239,7 +243,6 @@ agent-runtime = [
     "terminal",
     "workspace-runtime",
     "product-capabilities",
-    "dep:openbitfun-product-domains",
     "openbitfun-product-domains/external-sources",
     "runtime-services",
     "tool-packs",
@@ -251,8 +254,8 @@ agent-runtime = [
     "tokio/time",
 ]
 product-search = [
-    "agent-runtime",
     "dep:openbitfun-product-domains",
+    "agent-runtime",
     "openbitfun-runtime-ports/product-search",
     "openbitfun-services-core/session-search",
 ]
@@ -357,8 +360,8 @@ tools-image-analysis = [
     "openbitfun-tool-packs/image-analysis",
 ]
 tools-miniapp = [
-    "openbitfun-tool-packs/miniapp",
     "dep:openbitfun-product-domains",
+    "openbitfun-tool-packs/miniapp",
     "openbitfun-product-domains/appearance-market",
     "openbitfun-product-domains/miniapp",
     "openbitfun-services-integrations/miniapp-runtime",
@@ -403,8 +406,8 @@ plugin-source = [
     "openbitfun-services-integrations/plugin-source",
 ]
 function-agents = [
-    "ai-adapter-runtime",
     "dep:openbitfun-product-domains",
+    "ai-adapter-runtime",
     "openbitfun-product-domains/function-agents",
     "openbitfun-services-integrations/function-agents",
     "runtime-services",
@@ -414,22 +417,7 @@ canvas-runtime = [
     "openbitfun-services-integrations/canvas-runtime",
 ]
 runtime-services = ["dep:openbitfun-runtime-services"]
-legacy-migration = [
-    "dep:openbitfun-agent-runtime",
-    "dep:openbitfun-legacy-migration",
-    "dep:openbitfun-product-domains",
-    "dep:openbitfun-services-integrations",
-    "dep:rusqlite",
-    "openbitfun-agent-runtime/definition-contracts",
-    "openbitfun-product-domains/legacy-migration",
-    "openbitfun-product-domains/miniapp",
-    "openbitfun-services-core/local-storage",
-    "openbitfun-services-core/memory-store",
-    "openbitfun-services-core/workspace-identity",
-    "openbitfun-services-integrations/miniapp-storage",
-    "openbitfun-services-integrations/remote-persistence",
-    "tokio/rt",
-]
+legacy-migration = ["dep:openbitfun-legacy-migration-adapters"]
 announcement = ["openbitfun-services-integrations/announcement"]
 file-watch = ["openbitfun-services-integrations/file-watch"]
 git = ["openbitfun-services-integrations/git"]
@@ -443,6 +431,7 @@ local-storage = ["dep:openbitfun-agent-tools", "openbitfun-services-core/local-s
 process-runtime = ["openbitfun-services-core/process-runtime"]
 terminal = ["dep:terminal-core"]
 workspace-runtime = [
+    "openbitfun-services-core/workspace-persistence",
     "dep:serde_yaml",
     "filesystem",
     "local-storage",
diff --git a/src/crates/assembly/core/src/infrastructure/app_paths/path_manager.rs b/src/crates/assembly/core/src/infrastructure/app_paths/path_manager.rs
index 56538b9ca0..f620b96943 100644
--- a/src/crates/assembly/core/src/infrastructure/app_paths/path_manager.rs
+++ b/src/crates/assembly/core/src/infrastructure/app_paths/path_manager.rs
@@ -12,7 +12,6 @@ use std::env;
 use std::path::{Path, PathBuf};
 use std::sync::{Arc, Mutex};
 
-const MAX_PROJECT_SLUG_LEN: usize = 120;
 /// Storage level
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
 pub enum StorageLevel {
@@ -489,29 +488,7 @@ impl PathManager {
     }
 
     pub(crate) fn build_project_runtime_slug(canonical: &str) -> String {
-        let slug: String = canonical
-            .chars()
-            .map(|ch| {
-                if ch.is_ascii_alphanumeric() {
-                    ch.to_ascii_lowercase()
-                } else {
-                    '-'
-                }
-            })
-            .collect();
-
-        let slug = slug.trim_matches('-');
-        let slug = if slug.is_empty() { "workspace" } else { slug };
-
-        if slug.len() <= MAX_PROJECT_SLUG_LEN {
-            return slug.to_string();
-        }
-
-        let hash = hex::encode(Sha256::digest(canonical.as_bytes()));
-        let suffix = &hash[..12];
-        let max_prefix_len = MAX_PROJECT_SLUG_LEN.saturating_sub(suffix.len() + 1);
-        let prefix = slug[..max_prefix_len].trim_end_matches('-');
-        format!("{}-{}", prefix, suffix)
+        openbitfun_services_core::workspace_identity::build_project_runtime_slug(canonical)
     }
 
     #[cfg(unix)]
diff --git a/src/crates/assembly/core/src/legacy_migration/mod.rs b/src/crates/assembly/core/src/legacy_migration/mod.rs
index 4785cec44a..128df8d991 100644
--- a/src/crates/assembly/core/src/legacy_migration/mod.rs
+++ b/src/crates/assembly/core/src/legacy_migration/mod.rs
@@ -1,121 +1,2 @@
-//! Product-owned legacy BitFun domain adapters.
-//!
-//! The generic service crate owns offline orchestration and filesystem safety;
-//! this module binds each legacy reader and converter to the current product
-//! domain model without moving those owners into the service layer.
-
-mod agent_coordination;
-mod common;
-mod extensions;
-mod memory;
-mod remote_connect;
-mod remote_ssh;
-mod settings;
-mod workspace_sessions;
-
-use openbitfun_legacy_migration::{
-    DomainContext, DomainScan, LegacyDomainAdapter, LegacyMigrationResult, MigrationRoots,
-};
-use openbitfun_product_domains::legacy_migration::{
-    FindingSeverity, MigrationDomainId, MigrationDomainResult, MigrationDomainState,
-    MigrationGroupId, MigrationSelection, ScanFinding,
-};
-
-pub fn adapters_for_groups(selection: &MigrationSelection) -> Vec<Box<dyn LegacyDomainAdapter>> {
-    let selected = selection.expanded_domains();
-    let mut adapters: Vec<Box<dyn LegacyDomainAdapter>> = Vec::new();
-    if selected.contains(&MigrationDomainId::Settings) {
-        adapters.push(Box::new(settings::SettingsAdapter));
-    }
-    if selected.contains(&MigrationDomainId::Credentials) {
-        adapters.push(Box::new(settings::CredentialsAdapter));
-    }
-    if selected.contains(&MigrationDomainId::Skills) {
-        adapters.push(Box::new(extensions::SkillsAdapter));
-    }
-    if selected.contains(&MigrationDomainId::Miniapps) {
-        adapters.push(Box::new(extensions::MiniappsAdapter));
-    }
-    if selected.contains(&MigrationDomainId::Agents) {
-        adapters.push(Box::new(extensions::AgentsAdapter));
-    }
-    if selected.contains(&MigrationDomainId::WorkspaceSessions) {
-        adapters.push(Box::new(workspace_sessions::WorkspaceSessionsAdapter));
-    }
-    if selected.contains(&MigrationDomainId::AgentCoordination) {
-        adapters.push(Box::new(agent_coordination::AgentCoordinationAdapter));
-    }
-    if selected.contains(&MigrationDomainId::StructuredMemory) {
-        adapters.push(Box::new(memory::StructuredMemoryAdapter));
-    }
-    if selected.contains(&MigrationDomainId::FileMemory) {
-        adapters.push(Box::new(memory::FileMemoryAdapter));
-    }
-    if selected.contains(&MigrationDomainId::RemoteConnectDevices) {
-        adapters.push(Box::new(remote_connect::RemoteConnectAdapter));
-    }
-    if selected.contains(&MigrationDomainId::RemoteSsh) {
-        adapters.push(Box::new(remote_ssh::RemoteSshAdapter));
-    }
-    if selected.contains(&MigrationDomainId::CrossReferenceRepair) {
-        adapters.push(Box::new(CrossReferenceAdapter));
-    }
-    adapters
-}
-
-struct CrossReferenceAdapter;
-
-impl LegacyDomainAdapter for CrossReferenceAdapter {
-    fn domain(&self) -> MigrationDomainId {
-        MigrationDomainId::CrossReferenceRepair
-    }
-
-    fn scan(&self, _roots: &MigrationRoots) -> LegacyMigrationResult<DomainScan> {
-        Ok(DomainScan {
-            finding: ScanFinding {
-                domain: self.domain(),
-                code: "cross_reference_validation_enabled".to_string(),
-                severity: FindingSeverity::Info,
-                migratable: true,
-                detail: "Selected owner adapters will be checked after their atomic commits."
-                    .to_string(),
-                ..ScanFinding::default()
-            },
-            conflicts: Vec::new(),
-            target_schema: Some("openbitfun.cross-references.current".to_string()),
-            dependencies: Vec::new(),
-        })
-    }
-
-    fn stage(&self, _context: &DomainContext<'_>) -> LegacyMigrationResult<MigrationDomainResult> {
-        Ok(MigrationDomainResult {
-            domain: self.domain(),
-            state: MigrationDomainState::Staged,
-            ..MigrationDomainResult::default()
-        })
-    }
-
-    fn validate_stage(&self, context: &DomainContext<'_>) -> LegacyMigrationResult<()> {
-        validate_selected_cross_references(context)
-    }
-
-    fn commit(&self, _context: &DomainContext<'_>) -> LegacyMigrationResult<()> {
-        Ok(())
-    }
-
-    fn validate_commit(&self, context: &DomainContext<'_>) -> LegacyMigrationResult<()> {
-        validate_selected_cross_references(context)
-    }
-}
-
-fn validate_selected_cross_references(context: &DomainContext<'_>) -> LegacyMigrationResult<()> {
-    if context
-        .plan
-        .selection
-        .groups
-        .contains(&MigrationGroupId::WorkspacesSessionsAndTasks)
-    {
-        agent_coordination::validate_committed_coordination_cross_references(context)?;
-    }
-    Ok(())
-}
+//! Compatibility export; the standalone migration service owns these adapters.
+pub use openbitfun_legacy_migration_adapters::adapters_for_groups;
diff --git a/src/crates/assembly/core/src/plugin_host_http_routes.rs b/src/crates/assembly/core/src/plugin_host_http_routes.rs
index 10f72bc3ae..174fe34e84 100644
--- a/src/crates/assembly/core/src/plugin_host_http_routes.rs
+++ b/src/crates/assembly/core/src/plugin_host_http_routes.rs
@@ -830,6 +830,7 @@ mod tests {
                 name: "PTY A".to_string(),
                 shell_type: ShellType::Bash,
                 cwd: "/workspace".to_string(),
+                initial_cwd: None,
                 pid: Some(42),
                 status: status.to_string(),
                 cols: 80,
diff --git a/src/crates/assembly/core/src/service/config/manager.rs b/src/crates/assembly/core/src/service/config/manager.rs
index de3ac2b3d5..010cfa454c 100644
--- a/src/crates/assembly/core/src/service/config/manager.rs
+++ b/src/crates/assembly/core/src/service/config/manager.rs
@@ -33,134 +33,16 @@ fn invalid_config_error(context: &str, result: &ConfigValidationResult) -> OpenB
 }
 
 pub(crate) fn validate_openbitfun_product_identity(
-    persisted_product_id: &str,
+    value: &str,
     context: &str,
 ) -> OpenBitFunResult<()> {
-    let expected_product_id = product_identity::product_id();
-    if persisted_product_id != expected_product_id {
-        return Err(OpenBitFunError::validation(format!(
-            "{context} product_id must be '{expected_product_id}', found '{persisted_product_id}'"
-        )));
-    }
-
-    Ok(())
+    openbitfun_config_contracts::validate_openbitfun_product_identity(value, context)
+        .map_err(OpenBitFunError::validation)
 }
 
 pub(crate) fn validate_current_config_value(value: &Value, context: &str) -> OpenBitFunResult<()> {
-    let root = value
-        .as_object()
-        .ok_or_else(|| OpenBitFunError::validation(format!("{context} must be a JSON object")))?;
-    let product_id = root
-        .get("product_id")
-        .and_then(Value::as_str)
-        .ok_or_else(|| {
-            OpenBitFunError::validation(format!(
-                "{context} is missing required string field 'product_id'"
-            ))
-        })?;
-    let schema_version = root
-        .get("schema_version")
-        .and_then(Value::as_u64)
-        .ok_or_else(|| {
-            OpenBitFunError::validation(format!(
-                "{context} is missing required integer field 'schema_version'"
-            ))
-        })?;
-    if schema_version != u64::from(CURRENT_CONFIG_SCHEMA_VERSION) {
-        return Err(OpenBitFunError::validation(format!(
-            "{context} schema_version must be {CURRENT_CONFIG_SCHEMA_VERSION}, found {schema_version}"
-        )));
-    }
-    root.get("version").and_then(Value::as_str).ok_or_else(|| {
-        OpenBitFunError::validation(format!(
-            "{context} is missing required string field 'version'"
-        ))
-    })?;
-    if !root.contains_key("last_modified") {
-        return Err(OpenBitFunError::validation(format!(
-            "{context} is missing required field 'last_modified'"
-        )));
-    }
-    validate_openbitfun_product_identity(product_id, context)?;
-    reject_retired_config_fields(root, context)
-}
-
-fn retired_config_field(context: &str, path: &str) -> OpenBitFunError {
-    OpenBitFunError::validation(format!(
-        "{context} contains retired pre-OpenBitFun field '{path}'; use the explicit data migration tool instead"
-    ))
-}
-
-fn reject_retired_config_fields(
-    root: &serde_json::Map<String, Value>,
-    context: &str,
-) -> OpenBitFunResult<()> {
-    if let Some(app) = root.get("app").and_then(Value::as_object) {
-        for field in ["session", "session_config"] {
-            if app.contains_key(field) {
-                return Err(retired_config_field(context, &format!("app.{field}")));
-            }
-        }
-        if app
-            .get("ai_experience")
-            .and_then(Value::as_object)
-            .is_some_and(|ai_experience| ai_experience.contains_key("agent_companion_display_mode"))
-        {
-            return Err(retired_config_field(
-                context,
-                "app.ai_experience.agent_companion_display_mode",
-            ));
-        }
-    }
-    if root
-        .get("font")
-        .and_then(Value::as_object)
-        .is_some_and(|font| font.contains_key("flowChat"))
-    {
-        return Err(retired_config_field(context, "font.flowChat"));
-    }
-
-    let Some(ai) = root.get("ai").and_then(Value::as_object) else {
-        return Ok(());
-    };
-    for field in ["agent_models", "skip_tool_confirmation"] {
-        if ai.contains_key(field) {
-            return Err(retired_config_field(context, &format!("ai.{field}")));
-        }
-    }
-    if ai
-        .get("review_teams")
-        .and_then(Value::as_object)
-        .is_some_and(|review_teams| review_teams.contains_key("rate_limit_status"))
-    {
-        return Err(retired_config_field(
-            context,
-            "ai.review_teams.rate_limit_status",
-        ));
-    }
-
-    if let Some(models) = ai.get("models").and_then(Value::as_array) {
-        for (index, model) in models.iter().enumerate() {
-            let Some(model) = model.as_object() else {
-                continue;
-            };
-            for field in [
-                "enable_thinking_process",
-                "reasoning_mode",
-                "reasoning_effort",
-                "thinking_budget_tokens",
-            ] {
-                if model.contains_key(field) {
-                    return Err(retired_config_field(
-                        context,
-                        &format!("ai.models[{index}].{field}"),
-                    ));
-                }
-            }
-        }
-    }
-
-    Ok(())
+    openbitfun_config_contracts::validate_current_config_value(value, context)
+        .map_err(OpenBitFunError::validation)
 }
 
 const INSTALLER_MODEL_ID: &str = "installer:default";
diff --git a/src/crates/assembly/core/src/service/config/types.rs b/src/crates/assembly/core/src/service/config/types.rs
index 87d078c9d4..77abb8c3bc 100644
--- a/src/crates/assembly/core/src/service/config/types.rs
+++ b/src/crates/assembly/core/src/service/config/types.rs
@@ -1,1607 +1,8 @@
-//! Unified configuration system type definitions
-//!
-//! Defines all configuration-related types shared between backend and frontend.
+//! Shared persisted configuration records and live provider interface.
 
-use crate::util::errors::*;
+use crate::util::errors::OpenBitFunResult;
 use async_trait::async_trait;
-use openbitfun_core_types::{product_identity, WorktreeSettings};
-pub use openbitfun_core_types::{ReasoningConfig, ReasoningPreset, ReasoningPresetAction};
-use openbitfun_runtime_ports::{PermissionRule, ToolPermissionConfig};
-use serde::{Deserialize, Serialize};
-use sha2::{Digest, Sha256};
-use std::collections::HashMap;
-
-fn deserialize_agent_profiles<'de, D>(
-    deserializer: D,
-) -> Result<HashMap<String, AgentProfileConfig>, D::Error>
-where
-    D: serde::Deserializer<'de>,
-{
-    let raw = Option::<HashMap<String, Option<AgentProfileConfig>>>::deserialize(deserializer)?;
-    Ok(raw
-        .unwrap_or_default()
-        .into_iter()
-        .filter_map(|(profile_id, config)| config.map(|config| (profile_id, config)))
-        .collect())
-}
-
-/// Web UI font preferences (settings → basics). Keys match `FontPreference` in the frontend (camelCase).
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct FontPreferenceSnapshot {
-    pub ui_size: UiFontSizeSnapshot,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct UiFontSizeSnapshot {
-    pub level: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub custom_px: Option<u32>,
-}
-
-/// Global configuration structure - matches the frontend `GlobalConfig` exactly.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct GlobalConfig {
-    /// Immutable product identity for this persisted document.
-    pub product_id: String,
-    pub app: AppConfig,
-    pub editor: EditorConfig,
-    pub terminal: TerminalConfig,
-    pub workspace: WorkspaceConfig,
-    pub ai: AIConfig,
-    /// User-level static tool permission policy and interaction preferences.
-    #[serde(default)]
-    pub tool_permissions: ToolPermissionConfig,
-    #[serde(default)]
-    pub memories: MemoriesConfig,
-    /// Project-scoped overlays stored in the shared config document.
-    #[serde(default, skip_serializing_if = "ProjectConfig::is_empty")]
-    pub project: ProjectConfig,
-    /// MCP server configuration (stored uniformly; supports both JSON and structured formats).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mcp_servers: Option<serde_json::Value>,
-    /// ACP client configuration (stored as `{ "acpClients": { ... } }`).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub acp_clients: Option<serde_json::Value>,
-    /// OpenCode-compatible plugin declarations loaded by the process-wide plugin host.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub plugin: Vec<PluginDeclarationConfig>,
-    /// Web UI appearance selection. The full package contract is owned by the frontend.
-    pub appearance: AppearanceConfig,
-    /// Web UI font size preferences (`get_config` / `set_config` path `font`).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub font: Option<FontPreferenceSnapshot>,
-    /// Version of the persisted configuration schema. This is intentionally
-    /// independent from the OpenBitFun application version stored in `version`.
-    pub schema_version: u32,
-    /// Application build that most recently wrote this document. Informational
-    /// only; compatibility is determined by `schema_version`.
-    pub version: String,
-    #[serde(with = "chrono::serde::ts_milliseconds")]
-    pub last_modified: chrono::DateTime<chrono::Utc>,
-}
-
-impl GlobalConfig {
-    pub fn has_configured_plugins(&self) -> bool {
-        self.plugin
-            .iter()
-            .any(PluginDeclarationConfig::has_non_empty_spec)
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(untagged)]
-pub enum PluginDeclarationConfig {
-    Spec(String),
-    Detailed(PluginDeclarationDetails),
-}
-
-impl PluginDeclarationConfig {
-    pub fn spec(&self) -> &str {
-        match self {
-            Self::Spec(spec) => spec,
-            Self::Detailed(details) => &details.spec,
-        }
-    }
-
-    fn has_non_empty_spec(&self) -> bool {
-        !self.spec().trim().is_empty()
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct PluginDeclarationDetails {
-    pub spec: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub options: Option<serde_json::Map<String, serde_json::Value>>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub base_directory: Option<String>,
-}
-
-/// Project-scoped configuration overlay.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(default)]
-pub struct ProjectConfig {
-    /// Project-level MCP server configuration.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mcp_servers: Option<serde_json::Value>,
-}
-
-impl ProjectConfig {
-    fn is_empty(&self) -> bool {
-        self.mcp_servers.is_none()
-    }
-}
-
-/// App configuration.
-fn default_close_button_behavior() -> String {
-    "minimize_to_tray".to_string()
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct AppConfig {
-    pub language: String,
-    pub auto_update: bool,
-    pub telemetry: bool,
-    pub startup_behavior: String,
-    pub confirm_on_exit: bool,
-    pub restore_windows: bool,
-    /// Keep the local computer awake while the desktop application is running.
-    pub prevent_sleep: bool,
-    pub zoom_level: f64,
-    #[serde(default)]
-    pub logging: AppLoggingConfig,
-    pub sidebar: SidebarConfig,
-    pub right_panel: RightPanelConfig,
-    pub notifications: NotificationConfig,
-    #[serde(default)]
-    pub flow_chat: AppFlowChatConfig,
-    pub ai_experience: AIExperienceConfig,
-    /// Controller-owned end-to-end realtime voice conversation settings.
-    ///
-    /// This is deliberately a sibling of `ai_experience`: generic AI
-    /// experience mutations can be routed to a peer host, while the dedicated
-    /// realtime speech commands always resolve this value on the controller.
-    #[serde(default)]
-    pub voice_call: VoiceCallConfig,
-    /// User-defined keyboard shortcut overrides.
-    /// Stored as opaque JSON so the backend remains schema-agnostic;
-    /// the frontend owns the versioned format (StoredKeybindingsV1).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub keybindings: Option<serde_json::Value>,
-    /// Global, user-defined groups used to organize Agent tool pickers.
-    #[serde(default, skip_serializing_if = "UserToolGroupsConfig::is_empty")]
-    pub user_tool_groups: UserToolGroupsConfig,
-    /// Global, user-defined groups used to organize Skill pickers.
-    #[serde(default, skip_serializing_if = "UserSkillGroupsConfig::is_empty")]
-    pub user_skill_groups: UserSkillGroupsConfig,
-    /// What happens when the window close button is clicked on Windows / Linux.
-    /// Allowed values: "quit" | "minimize_to_tray" | "ask".
-    #[serde(default = "default_close_button_behavior")]
-    pub close_button_behavior: String,
-    /// Native agent lifecycle hooks (Codex-compatible hooks.json).
-    #[serde(default)]
-    pub hooks: AgentHooksConfig,
-    /// Defaults for opt-in managed Git worktrees.
-    #[serde(default)]
-    pub worktrees: WorktreeSettings,
-}
-
-/// Enablement gates for native agent hooks.
-///
-/// Hook declarations themselves live in `hooks.json` documents (user scope:
-/// `config/hooks.json` next to this file; project scope:
-/// `{project}/.openbitfun/config/hooks.json`), not in this settings document.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(default)]
-pub struct AgentHooksConfig {
-    /// Master switch for native agent hooks.
-    pub enabled: bool,
-    /// Whether project-scope hook files are honored. Disabled by default
-    /// because project hook files execute commands from the checked-out
-    /// repository; enable only for workspaces you trust.
-    pub project_hooks_enabled: bool,
-}
-
-impl Default for AgentHooksConfig {
-    fn default() -> Self {
-        Self {
-            enabled: true,
-            project_hooks_enabled: false,
-        }
-    }
-}
-
-/// Versioned user preference for grouping selectable Agent tools in the UI.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "camelCase")]
-pub struct UserToolGroupsConfig {
-    pub version: u32,
-    pub groups: Vec<UserToolGroup>,
-}
-
-impl UserToolGroupsConfig {
-    pub fn is_empty(&self) -> bool {
-        self.groups.is_empty()
-    }
-}
-
-impl Default for UserToolGroupsConfig {
-    fn default() -> Self {
-        Self {
-            version: 1,
-            groups: Vec::new(),
-        }
-    }
-}
-
-/// A user-defined group of canonical tool names.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "camelCase")]
-pub struct UserToolGroup {
-    pub id: String,
-    pub name: String,
-    pub tool_names: Vec<String>,
-}
-
-/// Versioned user preference for grouping selectable Skills in the UI.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "camelCase")]
-pub struct UserSkillGroupsConfig {
-    pub version: u32,
-    pub groups: Vec<UserSkillGroup>,
-}
-
-impl UserSkillGroupsConfig {
-    pub fn is_empty(&self) -> bool {
-        self.groups.is_empty()
-    }
-}
-
-impl Default for UserSkillGroupsConfig {
-    fn default() -> Self {
-        Self {
-            version: 1,
-            groups: Vec::new(),
-        }
-    }
-}
-
-/// A user-defined group of stable Skill keys.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "camelCase")]
-pub struct UserSkillGroup {
-    pub id: String,
-    pub name: String,
-    pub skill_keys: Vec<String>,
-}
-
-/// App logging configuration.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct AppLoggingConfig {
-    /// Runtime backend log level.
-    /// Allowed values: trace, debug, info, warn, error, off.
-    pub level: String,
-    /// Whether diagnostic logs may include sensitive troubleshooting payloads.
-    #[serde(default = "default_true")]
-    pub include_sensitive_diagnostics: bool,
-    /// Whether the local UI records detailed Flow Chat viewport diagnostics.
-    #[serde(default)]
-    pub flow_chat_diagnostics: bool,
-    /// Per-request AI model exchange tracing configuration for developer diagnostics.
-    #[serde(default)]
-    pub model_exchange_tracing: ModelExchangeTracingConfig,
-}
-
-#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Default)]
-#[serde(rename_all = "snake_case")]
-pub enum ModelExchangeTracingMode {
-    #[default]
-    Off,
-    Full,
-    UsageOnly,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct ModelExchangeTracingConfig {
-    pub mode: ModelExchangeTracingMode,
-}
-
-/// FlowChat UI preferences.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct AppFlowChatConfig {
-    /// Optional user override for the default ChatInput mode id.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub default_mode_id: Option<String>,
-    /// Whether the chat input exposes the global permission-mode shortcut.
-    ///
-    /// The default is visible, but that value is omitted from persisted config
-    /// so existing config files remain unchanged until the user hides it.
-    #[serde(
-        default = "default_show_permission_mode_control",
-        skip_serializing_if = "is_permission_mode_control_visible"
-    )]
-    pub show_permission_mode_control: bool,
-}
-
-fn default_show_permission_mode_control() -> bool {
-    true
-}
-
-fn is_permission_mode_control_visible(value: &bool) -> bool {
-    *value
-}
-
-impl Default for AppFlowChatConfig {
-    fn default() -> Self {
-        Self {
-            default_mode_id: None,
-            show_permission_mode_control: default_show_permission_mode_control(),
-        }
-    }
-}
-
-/// A user-defined quick action for the FlowChat post-coding actions menu.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct AiExperienceQuickAction {
-    pub id: String,
-    pub label: String,
-    pub prompt: String,
-    pub enabled: bool,
-}
-
-/// Local voice input preferences for the chat composer.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct VoiceInputConfig {
-    pub enabled: bool,
-    pub provider: String,
-    pub model_id: String,
-    pub default_language: String,
-    pub max_recording_seconds: u32,
-    pub microphone_device_id: String,
-}
-
-impl Default for VoiceInputConfig {
-    fn default() -> Self {
-        Self {
-            enabled: true,
-            provider: "local".to_string(),
-            model_id: "sensevoice-small-int8".to_string(),
-            default_language: "auto".to_string(),
-            max_recording_seconds: 60,
-            microphone_device_id: String::new(),
-        }
-    }
-}
-
-/// Controller-local full-duplex voice-call preferences.
-///
-/// The assistant stays off until the current controller explicitly enables it.
-/// The API key crosses only the controller-local settings IPC; starting a
-/// session resolves it in the Desktop adapter, so it is never forwarded to a
-/// remote workspace or peer HostInvoke request. Session execution selected by
-/// a voice tool call can still target a remote workspace or peer through the
-/// normal Agent Runtime adapters.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct VoiceCallConfig {
-    pub enabled: bool,
-    pub provider: String,
-    pub api_key: String,
-    pub voice: String,
-    pub speed: i32,
-    pub loudness: i32,
-    pub microphone_device_id: String,
-}
-
-impl Default for VoiceCallConfig {
-    fn default() -> Self {
-        Self {
-            enabled: false,
-            provider: "volcengine".to_string(),
-            api_key: String::new(),
-            voice: "zh_female_vv_jupiter_bigtts".to_string(),
-            speed: 0,
-            loudness: 0,
-            microphone_device_id: String::new(),
-        }
-    }
-}
-
-/// Domain request for atomically saving a cloud speech-recognition model and
-/// selecting it for voice input. Text-generation fields are intentionally not
-/// part of this contract.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export))]
-#[serde(rename_all = "camelCase")]
-pub struct SaveCloudSpeechConfigRequest {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub config_id: Option<String>,
-    pub preset: String,
-    pub name: String,
-    pub base_url: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub request_url: Option<String>,
-    pub model_name: String,
-    pub api_key: String,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export))]
-#[serde(rename_all = "camelCase")]
-pub struct SaveCloudSpeechConfigResult {
-    pub model_id: String,
-    pub created: bool,
-}
-
-/// AI experience configuration.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct AIExperienceConfig {
-    /// Whether to enable automatic AI-generated summaries for session titles.
-    pub enable_session_title_generation: bool,
-    /// Whether to enable AI analysis of work status on the FlowChat welcome page.
-    pub enable_welcome_panel_ai_analysis: bool,
-    /// Whether to enable visual mode.
-    pub enable_visual_mode: bool,
-    /// Whether to show the desktop Agent companion.
-    pub enable_agent_companion: bool,
-    /// Optional Petdex-compatible companion package selected by the user.
-    #[serde(
-        default = "default_agent_companion_pet",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub agent_companion_pet: Option<AgentCompanionPetSelection>,
-    /// Whether to enable flashgrep-backed accelerated workspace search.
-    pub enable_workspace_search: bool,
-    /// Local speech-to-text settings for the chat composer.
-    pub voice_input: VoiceInputConfig,
-    /// User-defined quick actions (post-coding menu); persisted for the web UI.
-    #[serde(default = "default_quick_actions")]
-    pub quick_actions: Vec<AiExperienceQuickAction>,
-}
-
-fn default_quick_actions() -> Vec<AiExperienceQuickAction> {
-    [
-        ("commit", "Commit", "Commit all current code changes"),
-        (
-            "create_pr",
-            "Create PR",
-            "Create a Pull Request for the current branch",
-        ),
-    ]
-    .into_iter()
-    .map(|(id, label, prompt)| AiExperienceQuickAction {
-        id: id.to_string(),
-        label: label.to_string(),
-        prompt: prompt.to_string(),
-        enabled: true,
-    })
-    .collect()
-}
-
-/// User-selected Agent companion pet package.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "camelCase")]
-pub struct AgentCompanionPetSelection {
-    pub id: String,
-    pub display_name: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    pub source: String,
-    pub package_path: String,
-    pub spritesheet_path: String,
-    pub spritesheet_mime_type: String,
-}
-
-fn default_agent_companion_pet() -> Option<AgentCompanionPetSelection> {
-    Some(AgentCompanionPetSelection {
-        id: "blue-golden".to_string(),
-        display_name: "困困".to_string(),
-        description: Some(
-            "A sweet, round-faced blue-golden shaded cat with wide bright eyes and soft silver-blue fur warmed by creamy-gold highlights.".to_string(),
-        ),
-        source: "preset".to_string(),
-        package_path: "/agent-companion-pets/blue-golden".to_string(),
-        spritesheet_path: "/agent-companion-pets/blue-golden/spritesheet.png".to_string(),
-        spritesheet_mime_type: "image/png".to_string(),
-    })
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct SidebarConfig {
-    pub width: u32,
-    pub collapsed: bool,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct RightPanelConfig {
-    pub width: u32,
-    pub collapsed: bool,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct NotificationConfig {
-    pub enabled: bool,
-    pub position: String,
-    pub duration: u32,
-    /// Whether to show a toast notification when a dialog turn completes while the window is not focused.
-    #[serde(default = "default_true")]
-    pub dialog_completion_notify: bool,
-    /// Whether to show a toast notification when an approval request arrives while the window is not focused.
-    #[serde(default = "default_true")]
-    pub permission_request_notify: bool,
-    /// Whether to show built-in tip cards on startup (can be disabled by the user).
-    #[serde(default = "default_true")]
-    pub enable_startup_tips: bool,
-}
-
-/// Web UI appearance configuration. Rust stores only the selected package id.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct AppearanceConfig {
-    /// Selected appearance package ID or `system`.
-    pub selection: String,
-}
-
-impl Default for AppearanceConfig {
-    fn default() -> Self {
-        Self {
-            selection: "system".to_string(),
-        }
-    }
-}
-
-/// Editor configuration.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct EditorConfig {
-    pub font_size: u32,
-    pub font_family: String,
-    pub font_weight: String,
-    pub line_height: f64,
-    pub cursor_style: String,
-    pub cursor_blinking: String,
-    pub render_whitespace: String,
-    pub render_line_highlight: String,
-    pub tab_size: u32,
-    pub insert_spaces: bool,
-    pub detect_indentation: bool,
-    pub word_wrap: String,
-    pub scroll_beyond_last_line: bool,
-    pub smooth_scrolling: bool,
-    pub line_numbers: String,
-    pub minimap: MinimapConfig,
-    pub auto_save: String,
-    pub auto_save_delay: u32,
-    pub format_on_save: bool,
-    pub format_on_paste: bool,
-    pub trim_auto_whitespace: bool,
-    pub semantic_highlighting: bool,
-    pub bracket_pair_colorization: bool,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct MinimapConfig {
-    pub enabled: bool,
-    pub side: String,
-    pub size: String,
-}
-
-/// Terminal configuration.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct TerminalConfig {
-    /// Empty string means "auto-detect".
-    pub default_shell: String,
-    /// Terminal panel placement in the session layout: "right" or "bottom".
-    pub terminal_panel_position: String,
-    pub font_size: u32,
-    pub font_family: String,
-    pub cursor_blink: bool,
-    pub cursor_style: String,
-    pub scrollback: u32,
-}
-
-/// Workspace configuration.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct WorkspaceConfig {
-    pub exclude_patterns: Vec<String>,
-    pub include_patterns: Vec<String>,
-    pub watch_ignore: Vec<String>,
-    /// Maximum file size in bytes.
-    pub max_file_size: u64,
-    pub encoding: String,
-    pub line_ending: String,
-    pub trim_trailing_whitespace: bool,
-    pub insert_final_newline: bool,
-}
-
-/// Model capability type (a model can have multiple capabilities).
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Hash)]
-#[serde(rename_all = "snake_case")]
-pub enum ModelCapability {
-    /// Text chat (primary capability).
-    TextChat,
-    /// Image understanding (vision).
-    ImageUnderstanding,
-    /// Image generation.
-    ImageGeneration,
-    /// Embeddings (semantic vectors).
-    Embedding,
-    /// Search API (e.g. Perplexity).
-    Search,
-    /// Code specialized.
-    CodeSpecialized,
-    /// Function calling / tool use.
-    FunctionCalling,
-    /// Speech-to-text.
-    SpeechRecognition,
-}
-
-pub const CURRENT_CONFIG_SCHEMA_VERSION: u32 = 1;
-
-/// Model category (for UI display and filtering).
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
-#[serde(rename_all = "snake_case")]
-#[derive(Default)]
-pub enum ModelCategory {
-    /// General chat model.
-    #[default]
-    GeneralChat,
-    /// Multimodal model (text + image understanding).
-    Multimodal,
-    /// Image generation model.
-    ImageGeneration,
-    /// Embedding / vector model.
-    Embedding,
-    /// Search-enhanced model.
-    SearchEnhanced,
-    /// Code-specialized model.
-    CodeSpecialized,
-    /// Speech recognition model.
-    SpeechRecognition,
-}
-
-/// Default model configuration.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-#[derive(Default)]
-pub struct DefaultModelsConfig {
-    /// Primary model ID (for complex tasks).
-    pub primary: Option<String>,
-    /// Fast model ID (for simple tasks). When unset, selection falls back to primary.
-    pub fast: Option<String>,
-    /// Search model.
-    pub search: Option<String>,
-    /// Image understanding model.
-    pub image_understanding: Option<String>,
-    /// Image generation model.
-    pub image_generation: Option<String>,
-    /// Speech recognition model.
-    pub speech_recognition: Option<String>,
-}
-
-/// Model choice for a subagent created in the context of a parent session.
-///
-/// `Inherit` is intentionally distinct from a model ID so a user-configured
-/// model named `inherit` can never be interpreted as a control value.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(tag = "kind", rename_all = "snake_case")]
-#[derive(Default)]
-pub enum SubagentModelSelection {
-    Fixed {
-        model_id: String,
-    },
-    #[default]
-    Inherit,
-}
-
-impl SubagentModelSelection {
-    pub fn fixed(model_id: impl Into<String>) -> Self {
-        Self::Fixed {
-            model_id: model_id.into(),
-        }
-    }
-
-    pub fn fixed_model_id(&self) -> Option<&str> {
-        match self {
-            Self::Fixed { model_id } => Some(model_id.as_str()),
-            Self::Inherit => None,
-        }
-    }
-}
-
-/// Model defaults for subagents created through user-visible delegation.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct SubagentModelDefaultsConfig {
-    /// Shared fallback for normal subagents without an explicit override.
-    #[serde(rename = "default", default = "default_subagent_model_selection")]
-    pub default_selection: SubagentModelSelection,
-    /// Per-builtin defaults and user overrides. Missing entries use `default`.
-    pub builtin: HashMap<String, SubagentModelSelection>,
-    /// Default choice for a child created from the parent's context.
-    pub fork: SubagentModelSelection,
-}
-
-impl Default for SubagentModelDefaultsConfig {
-    fn default() -> Self {
-        Self {
-            default_selection: default_subagent_model_selection(),
-            builtin: HashMap::from([
-                (
-                    "GeneralPurpose".to_string(),
-                    SubagentModelSelection::fixed("primary"),
-                ),
-                (
-                    "ResearchSpecialist".to_string(),
-                    SubagentModelSelection::Inherit,
-                ),
-            ]),
-            fork: SubagentModelSelection::Inherit,
-        }
-    }
-}
-
-fn default_subagent_model_selection() -> SubagentModelSelection {
-    SubagentModelSelection::fixed("fast")
-}
-
-/// Defaults used when the product creates an agent session without an explicit
-/// per-session model choice.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct AgentModelDefaultsConfig {
-    /// Shared model selector for future mode sessions.
-    pub mode: String,
-    /// User-visible delegated subagent model choices.
-    pub subagents: SubagentModelDefaultsConfig,
-}
-
-impl AgentModelDefaultsConfig {
-    pub fn builtin_subagent_selection(&self, agent_id: &str) -> SubagentModelSelection {
-        self.subagents
-            .builtin
-            .get(agent_id)
-            .cloned()
-            .unwrap_or_else(|| self.subagents.default_selection.clone())
-    }
-}
-
-impl Default for AgentModelDefaultsConfig {
-    fn default() -> Self {
-        Self {
-            mode: "primary".to_string(),
-            subagents: SubagentModelDefaultsConfig::default(),
-        }
-    }
-}
-
-/// Default review-team execution policy and membership configuration.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(default)]
-pub struct ReviewTeamConfig {
-    /// Additional reviewer subagent IDs configured by the user.
-    pub extra_subagent_ids: Vec<String>,
-    /// Default review depth used by the whole review team.
-    pub strategy_level: String,
-    /// Per-reviewer review depth overrides keyed by subagent ID.
-    pub member_strategy_overrides: HashMap<String, String>,
-    /// Optional timeout applied to reviewer Task calls. 0 disables the cap.
-    pub reviewer_timeout_seconds: u64,
-    /// Optional timeout applied to ReviewJudge Task calls. 0 disables the cap.
-    pub judge_timeout_seconds: u64,
-    /// Whether ReviewFixer may be launched by DeepReview.
-    pub auto_fix_enabled: bool,
-    /// Minimum number of target files that triggers same-role reviewer splitting.
-    /// 0 disables file splitting.
-    pub reviewer_file_split_threshold: usize,
-    /// Maximum number of same-role reviewer instances per role when file splitting is active.
-    pub max_same_role_instances: usize,
-    /// Maximum retries for a failed same-role reviewer instance.
-    pub max_retries_per_role: usize,
-    /// Maximum number of review instances that may run at the same time.
-    pub max_parallel_reviewers: usize,
-    /// Seconds to wait for provider capacity before skipping unstarted work. 0 skips immediately.
-    pub max_queue_wait_seconds: u64,
-    /// Whether unstarted review work may wait for provider capacity.
-    pub allow_provider_capacity_queue: bool,
-    /// Whether bounded automatic retry is allowed after a reviewer failure.
-    pub allow_bounded_auto_retry: bool,
-    /// Elapsed-seconds guard that blocks bounded automatic retry after this delay.
-    pub auto_retry_elapsed_guard_seconds: u64,
-}
-
-impl Default for ReviewTeamConfig {
-    fn default() -> Self {
-        Self {
-            extra_subagent_ids: Vec::new(),
-            strategy_level: "normal".to_string(),
-            member_strategy_overrides: HashMap::new(),
-            reviewer_timeout_seconds: 3600,
-            judge_timeout_seconds: 2400,
-            auto_fix_enabled: false,
-            reviewer_file_split_threshold: 20,
-            max_same_role_instances: 3,
-            max_retries_per_role: 1,
-            max_parallel_reviewers: 2,
-            max_queue_wait_seconds: 1200,
-            allow_provider_capacity_queue: true,
-            allow_bounded_auto_retry: false,
-            auto_retry_elapsed_guard_seconds: 180,
-        }
-    }
-}
-
-fn default_review_team_configs() -> HashMap<String, ReviewTeamConfig> {
-    HashMap::from([("default".to_string(), ReviewTeamConfig::default())])
-}
-
-fn default_review_team_rate_limit_status() -> serde_json::Value {
-    serde_json::Value::Object(serde_json::Map::new())
-}
-
-/// Model selection for a product-owned AI task.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(tag = "kind", rename_all = "snake_case")]
-pub enum TaskModelSelection {
-    Inherit,
-    Fixed { model_id: String },
-}
-
-impl TaskModelSelection {
-    pub fn fixed_model_id(&self) -> Option<&str> {
-        match self {
-            Self::Inherit => None,
-            Self::Fixed { model_id } => Some(model_id),
-        }
-    }
-}
-
-fn default_task_model_selection() -> TaskModelSelection {
-    TaskModelSelection::Fixed {
-        model_id: "fast".to_string(),
-    }
-}
-
-fn is_default_task_model_selection(selection: &TaskModelSelection) -> bool {
-    *selection == default_task_model_selection()
-}
-
-/// Model selectors for small product-owned AI tasks.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(default)]
-pub struct TaskModelsConfig {
-    #[serde(
-        default = "default_task_model_selection",
-        skip_serializing_if = "is_default_task_model_selection"
-    )]
-    pub session_title: TaskModelSelection,
-    #[serde(
-        default = "default_task_model_selection",
-        skip_serializing_if = "is_default_task_model_selection"
-    )]
-    pub git_commit: TaskModelSelection,
-}
-
-impl Default for TaskModelsConfig {
-    fn default() -> Self {
-        Self {
-            session_title: default_task_model_selection(),
-            git_commit: default_task_model_selection(),
-        }
-    }
-}
-
-impl TaskModelsConfig {
-    fn is_default(&self) -> bool {
-        *self == Self::default()
-    }
-}
-
-/// AI configuration.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct AIConfig {
-    /// All configured models.
-    pub models: Vec<AIModelConfig>,
-
-    /// Model selectors for product-owned AI tasks.
-    #[serde(default, skip_serializing_if = "TaskModelsConfig::is_default")]
-    pub task_models: TaskModelsConfig,
-
-    /// Default model configuration.
-    #[serde(default)]
-    pub default_models: DefaultModelsConfig,
-
-    /// Default selectors for future mode and delegated-subagent sessions.
-    #[serde(default)]
-    pub agent_model_defaults: AgentModelDefaultsConfig,
-
-    /// Shared agent-profile configuration.
-    /// profile_id -> AgentProfileConfig
-    #[serde(default, deserialize_with = "deserialize_agent_profiles")]
-    pub agent_profiles: HashMap<String, AgentProfileConfig>,
-
-    /// User-level Skill availability shared by every agent profile.
-    #[serde(default)]
-    pub skill_settings: SkillSettingsConfig,
-
-    /// Review team configuration.
-    /// team_id -> ReviewTeamConfig
-    #[serde(default = "default_review_team_configs")]
-    pub review_teams: HashMap<String, ReviewTeamConfig>,
-
-    /// Runtime rate-limit snapshot for Review Team launches.
-    #[serde(default = "default_review_team_rate_limit_status")]
-    pub review_team_rate_limit_status: serde_json::Value,
-
-    /// Maximum number of subagents that may execute concurrently.
-    #[serde(default = "default_subagent_max_concurrency")]
-    pub subagent_max_concurrency: usize,
-
-    /// Maximum number of Swarm workers and reviewers that may execute concurrently.
-    #[serde(default = "default_swarm_max_concurrency")]
-    pub swarm_max_concurrency: usize,
-
-    /// Scheduling policy for multiple subagent launch calls in the same model batch.
-    #[serde(default = "default_subagent_batch_execution_policy")]
-    pub subagent_batch_execution_policy: SubagentBatchExecutionPolicy,
-
-    /// Global proxy configuration.
-    pub proxy: ProxyConfig,
-
-    /// Streaming idle timeout in seconds; `None` means wait indefinitely.
-    #[serde(default = "default_stream_idle_timeout")]
-    pub stream_idle_timeout_secs: Option<u64>,
-
-    /// Time-to-first-token timeout in seconds while opening a streaming request;
-    /// `None` means wait indefinitely.
-    #[serde(default = "default_stream_ttft_timeout")]
-    pub stream_ttft_timeout_secs: Option<u64>,
-
-    /// Tool execution timeout in seconds; `None` means wait indefinitely.
-    #[serde(default = "default_tool_execution_timeout")]
-    pub tool_execution_timeout_secs: Option<u64>,
-
-    /// Whether tools with deferred exposure load their schemas on demand.
-    #[serde(default = "default_enable_deferred_tool_loading")]
-    pub enable_deferred_tool_loading: bool,
-
-    /// Allows broad JSON repair for non-Write tool arguments only after a
-    /// provider confirms a normal tool-use completion.
-    #[serde(default = "default_true")]
-    pub allow_tool_json_repair: bool,
-
-    /// Allow Computer use (desktop automation) when the desktop host is available (all session modes).
-    #[serde(default)]
-    pub computer_use_enabled: bool,
-
-    /// Preferred browser for CDP browser control. Empty/default uses the system default browser.
-    #[serde(default)]
-    pub browser_control_preferred_browser: String,
-
-    /// Provider-neutral WebSearch runtime configuration. Credentials are
-    /// referenced by logical id and remain in the device-local encrypted vault.
-    #[serde(default)]
-    pub web_search: WebSearchConfig,
-
-    /// Reattach to an already-running browser when OpenBitFun starts. Off by
-    /// default: the browser forgets its approval when it restarts, so this can
-    /// put an approval dialog in front of the user before they asked for the
-    /// browser at all.
-    #[serde(default)]
-    pub browser_control_auto_connect_on_startup: bool,
-
-    /// Maximum number of rounds per dialog turn before soft-pausing.
-    /// Zero disables the fixed round limit.
-    #[serde(default = "default_max_rounds")]
-    pub max_rounds: usize,
-}
-
-fn default_web_search_provider() -> String {
-    "exa_mcp_free".to_string()
-}
-
-fn default_exa_search_credential_id() -> String {
-    "exa-search-api".to_string()
-}
-
-fn default_tavily_credential_id() -> String {
-    "tavily-search-api".to_string()
-}
-
-fn default_openbitfun_search_http_credential_id() -> String {
-    "openbitfun-search-http".to_string()
-}
-
-/// Non-secret WebSearch settings that are safe to persist and synchronize.
-/// Unknown fields are retained so a newer provider configuration survives an
-/// older OpenBitFun build reading and writing the document.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
-#[serde(default, rename_all = "camelCase")]
-pub struct WebSearchConfig {
-    #[serde(default = "default_web_search_provider")]
-    pub provider: String,
-    #[serde(default)]
-    pub providers: WebSearchProviderConfigs,
-    #[serde(flatten)]
-    pub unknown: serde_json::Map<String, serde_json::Value>,
-}
-
-impl Default for WebSearchConfig {
-    fn default() -> Self {
-        Self {
-            provider: default_web_search_provider(),
-            providers: WebSearchProviderConfigs::default(),
-            unknown: serde_json::Map::new(),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
-#[serde(default, rename_all = "snake_case")]
-pub struct WebSearchProviderConfigs {
-    pub exa_search_api: WebSearchCredentialProviderConfig,
-    pub tavily: WebSearchCredentialProviderConfig,
-    pub openbitfun_search_http: OpenBitFunSearchHttpConfig,
-    #[serde(flatten)]
-    pub unknown: serde_json::Map<String, serde_json::Value>,
-}
-
-impl Default for WebSearchProviderConfigs {
-    fn default() -> Self {
-        Self {
-            exa_search_api: WebSearchCredentialProviderConfig {
-                credential_id: default_exa_search_credential_id(),
-                unknown: serde_json::Map::new(),
-            },
-            tavily: WebSearchCredentialProviderConfig {
-                credential_id: default_tavily_credential_id(),
-                unknown: serde_json::Map::new(),
-            },
-            openbitfun_search_http: OpenBitFunSearchHttpConfig::default(),
-            unknown: serde_json::Map::new(),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
-#[serde(default, rename_all = "camelCase")]
-pub struct WebSearchCredentialProviderConfig {
-    pub credential_id: String,
-    #[serde(flatten)]
-    pub unknown: serde_json::Map<String, serde_json::Value>,
-}
-
-impl Default for WebSearchCredentialProviderConfig {
-    fn default() -> Self {
-        Self {
-            credential_id: String::new(),
-            unknown: serde_json::Map::new(),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
-#[serde(default, rename_all = "camelCase")]
-pub struct OpenBitFunSearchHttpConfig {
-    pub endpoint: String,
-    pub auth: OpenBitFunSearchHttpAuthConfig,
-    #[serde(flatten)]
-    pub unknown: serde_json::Map<String, serde_json::Value>,
-}
-
-impl Default for OpenBitFunSearchHttpConfig {
-    fn default() -> Self {
-        Self {
-            endpoint: String::new(),
-            auth: OpenBitFunSearchHttpAuthConfig::default(),
-            unknown: serde_json::Map::new(),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
-#[serde(default, rename_all = "camelCase")]
-pub struct OpenBitFunSearchHttpAuthConfig {
-    /// `none`, `bearer`, or `header`. Kept as a string so unknown future modes
-    /// round-trip and fail explicitly only when selected at runtime.
-    pub mode: String,
-    pub credential_id: String,
-    pub header_name: String,
-    #[serde(flatten)]
-    pub unknown: serde_json::Map<String, serde_json::Value>,
-}
-
-impl Default for OpenBitFunSearchHttpAuthConfig {
-    fn default() -> Self {
-        Self {
-            mode: "none".to_string(),
-            credential_id: default_openbitfun_search_http_credential_id(),
-            header_name: String::new(),
-            unknown: serde_json::Map::new(),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Default)]
-#[serde(rename_all = "snake_case")]
-pub enum SubagentBatchExecutionPolicy {
-    /// Preserve the tool-owned concurrency-safety decision.
-    SafeOnly,
-    /// Force multiple Task calls from the same model batch into parallel scheduling.
-    #[default]
-    ForceParallel,
-    /// Treat all Task calls as serial even when a subagent is read-only.
-    Serial,
-}
-
-/// Automatic memory subsystem configuration.
-#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Default)]
-#[serde(rename_all = "snake_case")]
-pub enum MemoryExternalContextPolicy {
-    /// Keep sessions that used external context tools, but clear those tool results in Phase 1.
-    #[default]
-    ClearToolResults,
-    /// Keep sessions and tool results as-is.
-    Allow,
-    /// Mark sessions that used external context tools as polluted and skip extraction.
-    SkipSession,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(default)]
-pub struct MemoriesConfig {
-    /// Enables automatic Phase 1 extraction and Phase 2 consolidation.
-    pub generate_memories: bool,
-    /// Allows persistent BTW sessions to become memory-generation sources.
-    pub generate_for_btw_sessions: bool,
-    /// Enables prompt injection of the consolidated memory summary.
-    pub use_memories: bool,
-    /// Controls how sessions that used external context tools are handled.
-    pub external_context_policy: MemoryExternalContextPolicy,
-    /// Maximum number of stage-1 outputs selected for phase-2 consolidation.
-    pub max_raw_memories_for_consolidation: usize,
-    /// Maximum age in days for a stage-1 output to stay eligible for phase-2 reuse.
-    pub max_unused_days: i64,
-    /// Maximum age in days for a source session to be considered by Phase 1.
-    pub max_rollout_age_days: i64,
-    /// Maximum source sessions claimed for extraction per memory startup pass.
-    pub max_rollouts_per_startup: usize,
-    /// Maximum source sessions scanned while looking for extraction candidates per memory startup pass.
-    pub max_rollouts_scan_limit: usize,
-    /// Minimum idle time in hours before a source session can be extracted.
-    pub min_rollout_idle_hours: i64,
-    /// Maximum number of concurrent Phase 1 extraction jobs.
-    pub phase1_max_concurrency: usize,
-    /// Retry backoff after a failed Phase 1 extraction.
-    pub phase1_retry_backoff_minutes: i64,
-    /// Lease duration for claimed Phase 1 jobs.
-    pub phase1_lease_seconds: i64,
-    /// Lease duration for the global Phase 2 consolidation job.
-    pub phase2_lease_seconds: i64,
-    /// Phase-2 consolidation cooldown in seconds after a successful run.
-    pub phase2_success_cooldown_seconds: i64,
-    /// Phase-2 retry delay in seconds after a failed run.
-    pub phase2_retry_delay_seconds: i64,
-    /// Optional model selector for Phase 1 extraction.
-    pub extract_model: Option<String>,
-    /// Optional model selector for Phase 2 consolidation.
-    pub consolidation_model: Option<String>,
-}
-
-impl AIConfig {
-    /// Resolves a canonical configured model ID.
-    ///
-    /// Returns the model id only when the matched model is `enabled`. This is the
-    /// single source of truth for "is this model usable right now?" and is the
-    /// variant every runtime path (client factory, execution engine, etc.) should
-    /// use. UI / migration code that needs to look up disabled entries should call
-    /// [`Self::resolve_model_reference_any`] instead.
-    pub fn resolve_model_reference(&self, model_id: &str) -> Option<String> {
-        let mut matches = self.models.iter().filter(|m| m.enabled && m.id == model_id);
-        let model = matches.next()?;
-        (matches.next().is_none()).then(|| model.id.clone())
-    }
-
-    /// Resolves a canonical configured model ID regardless of `enabled` state.
-    /// UI / migration only — never use this on the runtime model-selection path.
-    pub fn resolve_model_reference_any(&self, model_id: &str) -> Option<String> {
-        let mut matches = self.models.iter().filter(|m| m.id == model_id);
-        let model = matches.next()?;
-        (matches.next().is_none()).then(|| model.id.clone())
-    }
-
-    /// Returns true if the given reference points to a model that exists and is
-    /// currently enabled.
-    pub fn is_model_reference_active(&self, model_ref: &str) -> bool {
-        self.resolve_model_reference(model_ref).is_some()
-    }
-
-    /// Returns the id of the first enabled model, if any. Used as a final
-    /// fallback when a configured default points to a disabled / missing model.
-    pub fn first_enabled_model_id(&self) -> Option<String> {
-        self.models.iter().find(|m| m.enabled).map(|m| m.id.clone())
-    }
-
-    /// Resolves a model selector value.
-    ///
-    /// Special values:
-    /// - `primary`: must resolve to a valid (enabled) primary model
-    /// - `fast`: first tries the configured fast model, then falls back to primary
-    ///
-    /// Regular values must be canonical configured model IDs. All lookups require
-    /// the target model to be enabled — disabled models are treated as if they did
-    /// not exist.
-    pub fn resolve_model_selection(&self, model_ref: &str) -> Option<String> {
-        match model_ref {
-            "primary" => self
-                .default_models
-                .primary
-                .as_deref()
-                .and_then(|value| self.resolve_model_reference(value)),
-            "fast" => self
-                .default_models
-                .fast
-                .as_deref()
-                .and_then(|value| self.resolve_model_reference(value))
-                .or_else(|| {
-                    self.default_models
-                        .primary
-                        .as_deref()
-                        .and_then(|value| self.resolve_model_reference(value))
-                }),
-            _ => self.resolve_model_reference(model_ref),
-        }
-    }
-}
-
-/// Shared agent-profile configuration.
-///
-/// Tool and skill configuration shared by compatible mode profiles.
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-#[serde(default)]
-pub struct AgentProfileConfig {
-    /// Shared profile ID (e.g. agentic, coding_shared, requirement, ui-design).
-    pub profile_id: String,
-
-    /// Tools explicitly enabled by the user that are not part of the mode defaults.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub added_tools: Vec<String>,
-
-    /// Default tools explicitly disabled by the user.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub removed_tools: Vec<String>,
-
-    /// User-level skills disabled for this mode.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub disabled_user_skills: Vec<String>,
-
-    /// User-level built-in skills explicitly enabled even though the mode default disables them.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub enabled_user_skills: Vec<String>,
-
-    /// User-level subagent availability overrides for this shared profile.
-    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
-    pub subagent_overrides: ParentSubagentOverrideConfig,
-
-    /// Agent-level permission rules applied after project rules.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub tool_permission_rules: Vec<PermissionRule>,
-}
-
-/// User-level Skill configuration shared by every agent profile.
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-#[serde(default)]
-pub struct SkillSettingsConfig {
-    /// User-level Skill keys disabled for every agent profile.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub globally_disabled_user_skills: Vec<String>,
-}
-
-/// API view of a mode configuration.
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export))]
-#[serde(default)]
-pub struct AgentProfileView {
-    pub profile_id: String,
-    pub enabled_tools: Vec<String>,
-    pub default_tools: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub disabled_user_skills: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub enabled_user_skills: Vec<String>,
-}
-
-fn default_true() -> bool {
-    true
-}
-
-/// Default streaming idle timeout between chunks.
-fn default_stream_idle_timeout() -> Option<u64> {
-    Some(600)
-}
-
-/// Default timeout while waiting for the first effective streamed output.
-fn default_stream_ttft_timeout() -> Option<u64> {
-    Some(600)
-}
-
-/// Default is no timeout (wait forever).
-fn default_tool_execution_timeout() -> Option<u64> {
-    None
-}
-
-fn default_enable_deferred_tool_loading() -> bool {
-    true
-}
-
-fn default_subagent_max_concurrency() -> usize {
-    5
-}
-
-fn default_swarm_max_concurrency() -> usize {
-    16
-}
-
-fn default_memory_max_raw_memories_for_consolidation() -> usize {
-    64
-}
-
-fn default_memory_max_unused_days() -> i64 {
-    30
-}
-
-fn default_memory_max_rollout_age_days() -> i64 {
-    10
-}
-
-fn default_memory_max_rollouts_per_startup() -> usize {
-    2
-}
-
-fn default_memory_max_rollouts_scan_limit() -> usize {
-    2_000
-}
-
-fn default_memory_min_rollout_idle_hours() -> i64 {
-    6
-}
-
-fn default_memory_phase1_max_concurrency() -> usize {
-    1
-}
-
-fn default_memory_phase1_retry_backoff_minutes() -> i64 {
-    60
-}
-
-fn default_memory_phase1_lease_seconds() -> i64 {
-    60 * 60
-}
-
-fn default_memory_phase2_lease_seconds() -> i64 {
-    60 * 60
-}
-
-fn default_memory_phase2_success_cooldown_seconds() -> i64 {
-    6 * 60 * 60
-}
-
-fn default_memory_phase2_retry_delay_seconds() -> i64 {
-    60 * 60
-}
-
-fn default_subagent_batch_execution_policy() -> SubagentBatchExecutionPolicy {
-    SubagentBatchExecutionPolicy::ForceParallel
-}
-
-pub const DEFAULT_MAX_ROUNDS: usize = 0;
-
-fn default_max_rounds() -> usize {
-    DEFAULT_MAX_ROUNDS
-}
-
-#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "snake_case")]
-pub enum AgentSubagentOverrideState {
-    Enabled,
-    Disabled,
-}
-
-pub type ParentSubagentOverrideConfig = HashMap<String, AgentSubagentOverrideState>;
-pub type AgentSubagentOverrideConfig = HashMap<String, ParentSubagentOverrideConfig>;
-
-pub const DEFAULT_MODEL_CONTEXT_WINDOW_TOKENS: u32 = 128_128;
-pub const MIN_MODEL_CONTEXT_WINDOW_TOKENS: u32 = 32_000;
-pub const MAX_CONFIGURED_OUTPUT_TOKENS_RATIO_PERCENT: u32 = 40;
-const AUTOMATIC_MAX_OUTPUT_TOKEN_TIERS: [u32; 5] = [8_000, 16_000, 24_000, 32_000, 64_000];
-
-/// Chooses the largest supported output tier that does not exceed one quarter
-/// of the model context window.
-pub fn automatic_max_output_tokens(context_window: u32) -> u32 {
-    let quarter_context = context_window / 4;
-    AUTOMATIC_MAX_OUTPUT_TOKEN_TIERS
-        .iter()
-        .rev()
-        .copied()
-        .find(|tier| *tier <= quarter_context)
-        .unwrap_or(quarter_context)
-}
-
-/// A configured output cap may use up to 40% of the model context window.
-pub fn is_valid_configured_max_output_tokens(context_window: u32, max_tokens: u32) -> bool {
-    max_tokens > 0
-        && u64::from(max_tokens) * 100
-            <= u64::from(context_window) * u64::from(MAX_CONFIGURED_OUTPUT_TOKENS_RATIO_PERCENT)
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(default)]
-pub struct AIModelConfig {
-    pub id: String,
-    pub name: String,
-    pub provider: String,
-    pub model_name: String,
-    pub base_url: String,
-
-    /// Computed actual request URL (auto-derived from base_url + provider format).
-    /// Stored by the frontend when config is saved; falls back to base_url if absent.
-    #[serde(default)]
-    pub request_url: Option<String>,
-
-    pub api_key: String,
-    /// Context window size (total token limit for input + output).
-    pub context_window: Option<u32>,
-    /// Optional advanced override for the request output limit. When absent,
-    /// OpenBitFun derives a tiered limit from the context window at runtime.
-    pub max_tokens: Option<u32>,
-    pub temperature: Option<f64>,
-    pub top_p: Option<f64>,
-    pub enabled: bool,
-    /// Model category (primary category used for UI filtering).
-    pub category: ModelCategory,
-    /// Capability tags (multi-select).
-    pub capabilities: Vec<ModelCapability>,
-    /// Recommended use cases.
-    #[serde(default)]
-    pub recommended_for: Vec<String>,
-    /// Additional metadata (JSON, for extensibility).
-    pub metadata: Option<serde_json::Value>,
-
-    /// Canonical model reasoning presets and default selection.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub reasoning: Option<ReasoningConfig>,
-
-    /// Whether to parse OpenAI-compatible text chunks containing `<think>...</think>` into
-    /// streaming reasoning content.
-    #[serde(default = "default_true")]
-    pub inline_think_in_text: bool,
-
-    /// Custom HTTP request headers.
-    #[serde(default)]
-    pub custom_headers: Option<std::collections::HashMap<String, String>>,
-
-    /// Custom header mode: "replace" (default, full replacement) or "merge" (merge; apply
-    /// defaults first, then custom).
-    #[serde(default)]
-    pub custom_headers_mode: Option<String>,
-
-    /// Whether to skip SSL certificate verification (advanced; use only when necessary).
-    #[serde(default)]
-    pub skip_ssl_verify: bool,
-
-    /// Custom request body (JSON string, used to override default request body fields).
-    #[serde(default)]
-    pub custom_request_body: Option<String>,
-
-    /// Custom request body mode: "merge" (default) or "trim" (keep only essential runtime
-    /// fields, then apply custom JSON).
-    #[serde(default)]
-    pub custom_request_body_mode: Option<String>,
-
-    /// Authentication source for this model. Defaults to a static API key;
-    /// selecting a CLI source causes the AI client
-    /// factory to look up `~/.codex/auth.json` or `~/.gemini/...` at request
-    /// time and inject the resolved Bearer token / extra headers.
-    #[serde(default)]
-    pub auth: AuthConfig,
-}
-
-/// Stable identity of the runtime-affecting parts of a concrete model config.
-///
-/// Credentials are deliberately excluded: rotating a secret must not require
-/// the user to approve the same provider/model again. Endpoint, provider,
-/// model, request options, and authentication source remain part of the
-/// identity so an approved binding cannot silently drift to different runtime
-/// behavior while retaining the same config id.
-pub fn model_runtime_binding_fingerprint(model: &AIModelConfig) -> String {
-    let mut value = serde_json::to_value(model).unwrap_or(serde_json::Value::Null);
-    if let serde_json::Value::Object(fields) = &mut value {
-        fields.remove("api_key");
-    }
-
-    fn canonicalize(value: serde_json::Value) -> serde_json::Value {
-        match value {
-            serde_json::Value::Object(fields) => {
-                let mut entries = fields.into_iter().collect::<Vec<_>>();
-                entries.sort_by(|left, right| left.0.cmp(&right.0));
-                serde_json::Value::Object(
-                    entries
-                        .into_iter()
-                        .map(|(key, value)| (key, canonicalize(value)))
-                        .collect(),
-                )
-            }
-            serde_json::Value::Array(values) => {
-                serde_json::Value::Array(values.into_iter().map(canonicalize).collect())
-            }
-            value => value,
-        }
-    }
-
-    let canonical = serde_json::to_vec(&canonicalize(value)).unwrap_or_default();
-    let mut hasher = Sha256::new();
-    hasher.update(canonical);
-    hex::encode(hasher.finalize())
-}
-
-/// Subscription provider whose in-app OAuth tokens authenticate a model.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum SubscriptionProvider {
-    Codex,
-    Antigravity,
-    Opencode,
-    Grok,
-    Hermes,
-}
-
-/// OpenCode API product selected for a subscription-authenticated model.
-/// Zen and Go share one account credential but use different API namespaces.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum OpenCodePlan {
-    Zen,
-    Go,
-}
-
-/// Where to obtain the runtime auth material for an `AIModelConfig`.
-///
-/// Stored on disk as `{"type":"api_key"}` or
-/// `{"type":"subscription","provider":"codex"|"antigravity"|"opencode"|"grok"|"hermes"}`.
-/// OpenCode models may additionally persist `"plan":"zen"|"go"`; an absent
-/// plan selects the default Zen Chat Completions behavior.
-/// Tokens live in the subscription auth store and are resolved at request time.
-#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(tag = "type", rename_all = "snake_case")]
-pub enum AuthConfig {
-    /// Use the inline `api_key` string (default).
-    #[default]
-    ApiKey,
-    /// Use OpenBitFun in-app subscription OAuth for the named provider.
-    Subscription {
-        provider: SubscriptionProvider,
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        plan: Option<OpenCodePlan>,
-    },
-}
-
-pub use openbitfun_core_types::ProxyConfig;
+pub use openbitfun_config_contracts::*;
 
 /// Configuration provider interface.
 #[async_trait]
@@ -1622,1747 +23,3 @@ pub trait ConfigProvider: Send + Sync {
         new_config: &serde_json::Value,
     ) -> OpenBitFunResult<()>;
 }
-
-/// Configuration change event.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ConfigChangeEvent {
-    pub path: String,
-    pub old_value: serde_json::Value,
-    pub new_value: serde_json::Value,
-    pub timestamp: chrono::DateTime<chrono::Utc>,
-    /// Event source: "user" | "system" | "migration".
-    pub source: String,
-}
-
-/// Configuration validation result.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ConfigValidationResult {
-    pub valid: bool,
-    pub errors: Vec<ConfigValidationError>,
-    pub warnings: Vec<ConfigValidationWarning>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub diagnostics: Vec<ConfigDiagnostic>,
-}
-
-#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "snake_case")]
-pub enum ConfigDiagnosticSeverity {
-    Error,
-    Warning,
-}
-
-#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "snake_case")]
-pub enum ConfigDiagnosticRecoverability {
-    None,
-    AutoFix,
-    ModelDisabled,
-    DefaultsUsed,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct ConfigDiagnostic {
-    pub path: String,
-    pub message: String,
-    pub code: String,
-    pub severity: ConfigDiagnosticSeverity,
-    pub recoverability: ConfigDiagnosticRecoverability,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ConfigValidationError {
-    pub path: String,
-    pub message: String,
-    pub code: String,
-    pub severity: String,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ConfigValidationWarning {
-    pub path: String,
-    pub message: String,
-    pub code: String,
-    pub severity: String,
-}
-
-impl Default for GlobalConfig {
-    fn default() -> Self {
-        Self {
-            product_id: product_identity::product_id().to_string(),
-            app: AppConfig::default(),
-            editor: EditorConfig::default(),
-            terminal: TerminalConfig::default(),
-            workspace: WorkspaceConfig::default(),
-            ai: AIConfig::default(),
-            memories: MemoriesConfig::default(),
-            project: ProjectConfig::default(),
-            tool_permissions: ToolPermissionConfig::default(),
-            mcp_servers: None,
-            acp_clients: None,
-            plugin: Vec::new(),
-            appearance: AppearanceConfig::default(),
-            font: None,
-            schema_version: CURRENT_CONFIG_SCHEMA_VERSION,
-            version: env!("CARGO_PKG_VERSION").to_string(),
-            last_modified: chrono::Utc::now(),
-        }
-    }
-}
-
-impl Default for AppConfig {
-    fn default() -> Self {
-        Self {
-            language: "zh-CN".to_string(),
-            auto_update: true,
-            telemetry: false,
-            startup_behavior: "lastWorkspace".to_string(),
-            confirm_on_exit: true,
-            restore_windows: true,
-            prevent_sleep: false,
-            zoom_level: 1.0,
-            logging: AppLoggingConfig::default(),
-            sidebar: SidebarConfig {
-                width: 300,
-                collapsed: false,
-            },
-            right_panel: RightPanelConfig {
-                width: 400,
-                collapsed: true,
-            },
-            notifications: NotificationConfig {
-                enabled: true,
-                position: "topRight".to_string(),
-                duration: 5000,
-                dialog_completion_notify: true,
-                permission_request_notify: true,
-                enable_startup_tips: true,
-            },
-            flow_chat: AppFlowChatConfig::default(),
-            ai_experience: AIExperienceConfig::default(),
-            voice_call: VoiceCallConfig::default(),
-            keybindings: None,
-            user_tool_groups: UserToolGroupsConfig::default(),
-            user_skill_groups: UserSkillGroupsConfig::default(),
-            close_button_behavior: default_close_button_behavior(),
-            hooks: AgentHooksConfig::default(),
-            worktrees: WorktreeSettings::default(),
-        }
-    }
-}
-
-impl Default for AppLoggingConfig {
-    fn default() -> Self {
-        Self {
-            // Set to Debug in early development for easier diagnostics
-            level: "debug".to_string(),
-            include_sensitive_diagnostics: true,
-            flow_chat_diagnostics: false,
-            model_exchange_tracing: ModelExchangeTracingConfig::default(),
-        }
-    }
-}
-
-impl Default for ModelExchangeTracingConfig {
-    fn default() -> Self {
-        Self {
-            mode: ModelExchangeTracingMode::Off,
-        }
-    }
-}
-
-impl Default for AIExperienceConfig {
-    fn default() -> Self {
-        Self {
-            enable_session_title_generation: true,
-            enable_welcome_panel_ai_analysis: false,
-            enable_visual_mode: false,
-            enable_agent_companion: true,
-            agent_companion_pet: default_agent_companion_pet(),
-            enable_workspace_search: false,
-            voice_input: VoiceInputConfig::default(),
-            quick_actions: default_quick_actions(),
-        }
-    }
-}
-
-impl Default for EditorConfig {
-    fn default() -> Self {
-        Self {
-            font_size: 14,
-            font_family: "Consolas, \"Courier New\", monospace".to_string(),
-            font_weight: "normal".to_string(),
-            line_height: 1.5,
-            cursor_style: "line".to_string(),
-            cursor_blinking: "smooth".to_string(),
-            render_whitespace: "selection".to_string(),
-            render_line_highlight: "line".to_string(),
-            tab_size: 4,
-            insert_spaces: true,
-            detect_indentation: true,
-            word_wrap: "off".to_string(),
-            scroll_beyond_last_line: false,
-            smooth_scrolling: true,
-            line_numbers: "on".to_string(),
-            minimap: MinimapConfig {
-                enabled: true,
-                side: "right".to_string(),
-                size: "proportional".to_string(),
-            },
-            auto_save: "afterDelay".to_string(),
-            auto_save_delay: 1000,
-            format_on_save: true,
-            format_on_paste: true,
-            trim_auto_whitespace: true,
-            semantic_highlighting: true,
-            bracket_pair_colorization: true,
-        }
-    }
-}
-
-impl Default for TerminalConfig {
-    fn default() -> Self {
-        Self {
-            default_shell: String::new(),
-            terminal_panel_position: "right".to_string(),
-            font_size: 14,
-            font_family: "Consolas, \"Courier New\", monospace".to_string(),
-            cursor_blink: true,
-            cursor_style: "block".to_string(),
-            scrollback: 1000,
-        }
-    }
-}
-
-impl Default for WorkspaceConfig {
-    fn default() -> Self {
-        Self {
-            exclude_patterns: vec![
-                "**/node_modules/**".to_string(),
-                "**/target/**".to_string(),
-                "**/.git/**".to_string(),
-                "**/dist/**".to_string(),
-                "**/build/**".to_string(),
-            ],
-            include_patterns: vec!["**/*".to_string()],
-            watch_ignore: vec![
-                "**/node_modules/**".to_string(),
-                "**/target/**".to_string(),
-                "**/.git/**".to_string(),
-            ],
-            max_file_size: 50 * 1024 * 1024,
-            encoding: "utf8".to_string(),
-            line_ending: "auto".to_string(),
-            trim_trailing_whitespace: true,
-            insert_final_newline: true,
-        }
-    }
-}
-
-impl Default for AIConfig {
-    fn default() -> Self {
-        Self {
-            models: vec![],
-            task_models: TaskModelsConfig::default(),
-            default_models: DefaultModelsConfig::default(),
-            agent_model_defaults: AgentModelDefaultsConfig::default(),
-            agent_profiles: std::collections::HashMap::new(),
-            skill_settings: SkillSettingsConfig::default(),
-            review_teams: default_review_team_configs(),
-            review_team_rate_limit_status: default_review_team_rate_limit_status(),
-            subagent_max_concurrency: default_subagent_max_concurrency(),
-            swarm_max_concurrency: default_swarm_max_concurrency(),
-            subagent_batch_execution_policy: default_subagent_batch_execution_policy(),
-            proxy: ProxyConfig::default(),
-            stream_idle_timeout_secs: default_stream_idle_timeout(),
-            stream_ttft_timeout_secs: default_stream_ttft_timeout(),
-            tool_execution_timeout_secs: default_tool_execution_timeout(),
-            enable_deferred_tool_loading: default_enable_deferred_tool_loading(),
-            allow_tool_json_repair: true,
-            computer_use_enabled: false,
-            browser_control_preferred_browser: String::new(),
-            web_search: WebSearchConfig::default(),
-            browser_control_auto_connect_on_startup: false,
-            max_rounds: default_max_rounds(),
-        }
-    }
-}
-
-impl Default for MemoriesConfig {
-    fn default() -> Self {
-        Self {
-            generate_memories: false,
-            generate_for_btw_sessions: false,
-            use_memories: false,
-            external_context_policy: MemoryExternalContextPolicy::ClearToolResults,
-            max_raw_memories_for_consolidation: default_memory_max_raw_memories_for_consolidation(),
-            max_unused_days: default_memory_max_unused_days(),
-            max_rollout_age_days: default_memory_max_rollout_age_days(),
-            max_rollouts_per_startup: default_memory_max_rollouts_per_startup(),
-            max_rollouts_scan_limit: default_memory_max_rollouts_scan_limit(),
-            min_rollout_idle_hours: default_memory_min_rollout_idle_hours(),
-            phase1_max_concurrency: default_memory_phase1_max_concurrency(),
-            phase1_retry_backoff_minutes: default_memory_phase1_retry_backoff_minutes(),
-            phase1_lease_seconds: default_memory_phase1_lease_seconds(),
-            phase2_lease_seconds: default_memory_phase2_lease_seconds(),
-            phase2_success_cooldown_seconds: default_memory_phase2_success_cooldown_seconds(),
-            phase2_retry_delay_seconds: default_memory_phase2_retry_delay_seconds(),
-            extract_model: None,
-            consolidation_model: None,
-        }
-    }
-}
-
-impl Default for AIModelConfig {
-    fn default() -> Self {
-        Self {
-            id: String::new(),
-            name: String::new(),
-            provider: String::new(),
-            model_name: String::new(),
-            base_url: String::new(),
-            request_url: None,
-            api_key: String::new(),
-            context_window: None,
-            max_tokens: None,
-            temperature: None,
-            top_p: None,
-            enabled: false,
-            category: ModelCategory::GeneralChat,
-            capabilities: vec![],
-            recommended_for: vec![],
-            metadata: None,
-            reasoning: None,
-            inline_think_in_text: true,
-            custom_headers: None,
-            custom_headers_mode: None,
-            skip_ssl_verify: false,
-            custom_request_body: None,
-            custom_request_body_mode: None,
-            auth: AuthConfig::ApiKey,
-        }
-    }
-}
-
-impl Default for SidebarConfig {
-    fn default() -> Self {
-        Self {
-            width: 300,
-            collapsed: false,
-        }
-    }
-}
-
-impl Default for RightPanelConfig {
-    fn default() -> Self {
-        Self {
-            width: 400,
-            collapsed: true,
-        }
-    }
-}
-
-impl Default for NotificationConfig {
-    fn default() -> Self {
-        Self {
-            enabled: true,
-            position: "topRight".to_string(),
-            duration: 5000,
-            dialog_completion_notify: true,
-            permission_request_notify: true,
-            enable_startup_tips: true,
-        }
-    }
-}
-
-impl Default for MinimapConfig {
-    fn default() -> Self {
-        Self {
-            enabled: true,
-            side: "right".to_string(),
-            size: "proportional".to_string(),
-        }
-    }
-}
-
-impl AIModelConfig {
-    pub fn supports_capability(&self, capability: ModelCapability) -> bool {
-        if self.capabilities.is_empty() {
-            self.default_capabilities_for_category()
-                .contains(&capability)
-        } else {
-            self.capabilities.contains(&capability)
-        }
-    }
-
-    pub fn supports_text_generation(&self) -> bool {
-        self.supports_capability(ModelCapability::TextChat)
-    }
-
-    /// Canonicalizes fields that only have meaning for text-generation
-    /// requests. Returns the names of fields that were cleared.
-    pub fn normalize_inapplicable_generation_fields(&mut self) -> Vec<&'static str> {
-        if self.supports_text_generation() {
-            return Vec::new();
-        }
-
-        let mut cleared = Vec::new();
-        if self.context_window.take().is_some() {
-            cleared.push("context_window");
-        }
-        if self.max_tokens.take().is_some() {
-            cleared.push("max_tokens");
-        }
-        if self.temperature.take().is_some() {
-            cleared.push("temperature");
-        }
-        if self.top_p.take().is_some() {
-            cleared.push("top_p");
-        }
-        cleared
-    }
-
-    pub fn supports_image_understanding(&self) -> bool {
-        self.supports_capability(ModelCapability::ImageUnderstanding)
-    }
-
-    fn default_capabilities_for_category(&self) -> Vec<ModelCapability> {
-        match self.category {
-            ModelCategory::GeneralChat => vec![ModelCapability::TextChat],
-            ModelCategory::Multimodal => {
-                vec![
-                    ModelCapability::TextChat,
-                    ModelCapability::ImageUnderstanding,
-                ]
-            }
-            ModelCategory::ImageGeneration => vec![ModelCapability::ImageGeneration],
-            ModelCategory::Embedding => vec![ModelCapability::Embedding],
-            ModelCategory::SearchEnhanced => {
-                vec![ModelCapability::TextChat, ModelCapability::Search]
-            }
-            ModelCategory::CodeSpecialized => {
-                vec![ModelCapability::TextChat, ModelCapability::CodeSpecialized]
-            }
-            ModelCategory::SpeechRecognition => vec![ModelCapability::SpeechRecognition],
-        }
-    }
-
-    /// Auto-completes missing capability information without rewriting explicit configuration.
-    ///
-    /// Important: we intentionally do not upgrade `category` or append inferred capabilities
-    /// based on the model name here. Runtime behavior should follow explicit configuration.
-    pub fn ensure_category_and_capabilities(&mut self) {
-        if self.capabilities.is_empty() {
-            self.capabilities = self.default_capabilities_for_category();
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{
-        AIConfig, AIExperienceConfig, AIModelConfig, AgentModelDefaultsConfig, AgentProfileConfig,
-        AgentProfileView, AppConfig, AppLoggingConfig, AuthConfig, EditorConfig, GlobalConfig,
-        MemoryExternalContextPolicy, ModelExchangeTracingMode, NotificationConfig, OpenCodePlan,
-        SubagentBatchExecutionPolicy, SubagentModelSelection, SubscriptionProvider,
-        UserSkillGroupsConfig, UserToolGroupsConfig, WebSearchConfig,
-    };
-    use openbitfun_runtime_ports::ToolPermissionConfig;
-
-    fn current_global_config_with(overrides: serde_json::Value) -> serde_json::Value {
-        let mut value =
-            serde_json::to_value(GlobalConfig::default()).expect("default config should serialize");
-        let root = value
-            .as_object_mut()
-            .expect("default config should serialize as an object");
-        for (key, value) in overrides
-            .as_object()
-            .expect("config fixture overrides must be an object")
-        {
-            root.insert(key.clone(), value.clone());
-        }
-        value
-    }
-
-    #[test]
-    fn legacy_app_config_defaults_realtime_voice_call() {
-        let config: AppConfig = serde_json::from_value(serde_json::json!({}))
-            .expect("legacy app config should deserialize");
-
-        assert!(!config.voice_call.enabled);
-        assert_eq!(config.voice_call.provider, "volcengine");
-        assert!(config.voice_call.api_key.is_empty());
-        assert_eq!(config.voice_call.voice, "zh_female_vv_jupiter_bigtts");
-    }
-
-    #[test]
-    fn persisted_realtime_voice_call_enabled_survives_default_change() {
-        let config: AppConfig = serde_json::from_value(serde_json::json!({
-            "voice_call": {
-                "enabled": true,
-                "api_key": "legacy-controller-key"
-            }
-        }))
-        .expect("saved realtime voice config should deserialize");
-
-        assert!(config.voice_call.enabled);
-        assert_eq!(config.voice_call.api_key, "legacy-controller-key");
-        assert_eq!(config.voice_call.provider, "volcengine");
-        assert_eq!(config.voice_call.voice, "zh_female_vv_jupiter_bigtts");
-    }
-
-    #[test]
-    fn prevent_sleep_defaults_to_disabled() {
-        assert!(!AppConfig::default().prevent_sleep);
-
-        let config: AppConfig =
-            serde_json::from_value(serde_json::json!({})).expect("empty app config should default");
-        assert!(!config.prevent_sleep);
-    }
-
-    #[test]
-    fn current_config_rejects_retired_flow_chat_font_data() {
-        let value = current_global_config_with(serde_json::json!({
-            "font": {
-                "uiSize": {
-                    "level": "large"
-                },
-                "flowChat": {
-                    "mode": "independent",
-                    "basePx": 20
-                }
-            }
-        }));
-        let error = crate::service::config::manager::validate_current_config_value(
-            &value,
-            "Configuration fixture",
-        )
-        .expect_err("retired FlowChat font data must not enter the current runtime");
-        assert!(error.to_string().contains("font.flowChat"));
-    }
-
-    #[test]
-    fn subscription_auth_preserves_legacy_opencode_and_roundtrips_go_plan() {
-        let legacy: AuthConfig = serde_json::from_value(serde_json::json!({
-            "type": "subscription",
-            "provider": "opencode"
-        }))
-        .expect("legacy OpenCode auth should deserialize");
-        assert_eq!(
-            legacy,
-            AuthConfig::Subscription {
-                provider: SubscriptionProvider::Opencode,
-                plan: None,
-            }
-        );
-        assert_eq!(
-            serde_json::to_value(&legacy).expect("legacy auth should serialize"),
-            serde_json::json!({
-                "type": "subscription",
-                "provider": "opencode"
-            })
-        );
-
-        let go = AuthConfig::Subscription {
-            provider: SubscriptionProvider::Opencode,
-            plan: Some(OpenCodePlan::Go),
-        };
-        let serialized = serde_json::to_value(&go).expect("Go auth should serialize");
-        assert_eq!(serialized["plan"], "go");
-        assert_eq!(
-            serde_json::from_value::<AuthConfig>(serialized).expect("Go auth should roundtrip"),
-            go
-        );
-    }
-
-    #[test]
-    fn grok_subscription_auth_roundtrips_without_opencode_plan() {
-        let grok = AuthConfig::Subscription {
-            provider: SubscriptionProvider::Grok,
-            plan: None,
-        };
-        let serialized = serde_json::to_value(&grok).expect("Grok auth should serialize");
-        assert_eq!(
-            serialized,
-            serde_json::json!({
-                "type": "subscription",
-                "provider": "grok"
-            })
-        );
-        assert_eq!(
-            serde_json::from_value::<AuthConfig>(serialized).expect("Grok auth should deserialize"),
-            grok
-        );
-    }
-
-    #[test]
-    fn hermes_subscription_auth_roundtrips_without_opencode_plan() {
-        let hermes = AuthConfig::Subscription {
-            provider: SubscriptionProvider::Hermes,
-            plan: None,
-        };
-        let serialized = serde_json::to_value(&hermes).expect("Hermes auth should serialize");
-        assert_eq!(
-            serialized,
-            serde_json::json!({
-                "type": "subscription",
-                "provider": "hermes"
-            })
-        );
-        assert_eq!(
-            serde_json::from_value::<AuthConfig>(serialized)
-                .expect("Hermes auth should deserialize"),
-            hermes
-        );
-    }
-
-    #[test]
-    fn plugin_config_defaults_to_empty_when_missing() {
-        let config: GlobalConfig =
-            serde_json::from_value(current_global_config_with(serde_json::json!({})))
-                .expect("current global config should apply optional plugin defaults");
-
-        assert!(config.plugin.is_empty());
-        assert!(!config.has_configured_plugins());
-    }
-
-    #[test]
-    fn non_empty_plugin_config_requests_runtime_startup() {
-        let config: GlobalConfig =
-            serde_json::from_value(current_global_config_with(serde_json::json!({
-                "plugin": [
-                    "file:///C:/plugins/demo.mjs",
-                    {
-                        "spec": "@my-org/custom-plugin",
-                        "options": { "mode": "strict" },
-                        "baseDirectory": "C:/workspace"
-                    }
-                ]
-            })))
-            .expect("plugin config should deserialize");
-
-        assert_eq!(config.plugin.len(), 2);
-        assert!(config.has_configured_plugins());
-    }
-
-    #[test]
-    fn empty_plugin_specs_do_not_request_runtime_startup() {
-        let config: GlobalConfig =
-            serde_json::from_value(current_global_config_with(serde_json::json!({
-                "plugin": ["", "   ", { "spec": "" }]
-            })))
-            .expect("empty plugin declarations should deserialize");
-
-        assert!(!config.has_configured_plugins());
-    }
-
-    #[test]
-    fn permission_request_notifications_default_to_enabled() {
-        assert!(NotificationConfig::default().permission_request_notify);
-
-        let config: NotificationConfig = serde_json::from_value(serde_json::json!({}))
-            .expect("empty notification config should default");
-        assert!(config.permission_request_notify);
-    }
-
-    #[test]
-    fn agent_profile_defaults_keep_all_collections_empty() {
-        let config = AgentProfileConfig::default();
-        assert!(config.profile_id.is_empty());
-        assert!(config.added_tools.is_empty());
-        assert!(config.removed_tools.is_empty());
-        assert!(config.disabled_user_skills.is_empty());
-        assert!(config.enabled_user_skills.is_empty());
-        assert!(config.subagent_overrides.is_empty());
-        assert!(config.tool_permission_rules.is_empty());
-
-        let view = AgentProfileView::default();
-        assert!(view.profile_id.is_empty());
-        assert!(view.enabled_tools.is_empty());
-        assert!(view.default_tools.is_empty());
-        assert!(view.disabled_user_skills.is_empty());
-        assert!(view.enabled_user_skills.is_empty());
-    }
-
-    #[test]
-    fn legacy_agent_profile_defaults_permission_rules_and_omits_empty_field() {
-        let config: AgentProfileConfig = serde_json::from_value(serde_json::json!({
-            "profile_id": "coding_shared",
-            "added_tools": ["read"]
-        }))
-        .expect("legacy agent profile should deserialize");
-
-        assert!(config.tool_permission_rules.is_empty());
-        let serialized = serde_json::to_value(config).expect("agent profile should serialize");
-        assert!(serialized.get("tool_permission_rules").is_none());
-    }
-
-    #[test]
-    fn current_global_config_defaults_optional_permission_settings() {
-        let mut current = current_global_config_with(serde_json::json!({}));
-        current
-            .as_object_mut()
-            .expect("current config object")
-            .remove("tool_permissions");
-        let config: GlobalConfig = serde_json::from_value(current)
-            .expect("missing optional permission settings should use current defaults");
-
-        assert_eq!(config.tool_permissions, ToolPermissionConfig::default());
-    }
-
-    #[test]
-    fn missing_max_rounds_defaults_to_unlimited_and_explicit_limits_survive() {
-        let mut default_value = current_global_config_with(serde_json::json!({}));
-        default_value["ai"]
-            .as_object_mut()
-            .expect("current AI config")
-            .remove("max_rounds");
-        let defaulted: GlobalConfig = serde_json::from_value(default_value)
-            .expect("current AI config should default an omitted optional limit");
-        assert_eq!(defaulted.ai.max_rounds, 0);
-
-        let limited: GlobalConfig =
-            serde_json::from_value(current_global_config_with(serde_json::json!({
-                "ai": { "max_rounds": 37 }
-            })))
-            .expect("explicit max rounds should deserialize");
-        assert_eq!(limited.ai.max_rounds, 37);
-    }
-
-    #[test]
-    fn user_tool_groups_default_to_version_one_without_persisted_groups() {
-        let mut value = current_global_config_with(serde_json::json!({}));
-        value["app"]
-            .as_object_mut()
-            .expect("current app config")
-            .remove("user_tool_groups");
-        let config: GlobalConfig = serde_json::from_value(value)
-            .expect("current app config should default omitted tool groups");
-        assert_eq!(config.app.user_tool_groups, UserToolGroupsConfig::default());
-
-        let serialized = serde_json::to_value(&config).expect("config should serialize");
-        assert!(serialized["app"].get("user_tool_groups").is_none());
-    }
-
-    #[test]
-    fn user_tool_groups_preserve_the_versioned_ui_shape() {
-        let config: GlobalConfig =
-            serde_json::from_value(current_global_config_with(serde_json::json!({
-                "app": {
-                    "user_tool_groups": {
-                        "version": 1,
-                        "groups": [{
-                            "id": "daily-code",
-                            "name": "Daily code changes",
-                            "toolNames": ["Read", "Edit"]
-                        }]
-                    }
-                }
-            })))
-            .expect("user tool groups should deserialize");
-
-        assert_eq!(
-            config.app.user_tool_groups.groups[0].tool_names,
-            vec!["Read".to_string(), "Edit".to_string()]
-        );
-
-        let serialized = serde_json::to_value(&config).expect("config should serialize");
-        assert_eq!(
-            serialized["app"]["user_tool_groups"]["groups"][0]["toolNames"],
-            serde_json::json!(["Read", "Edit"])
-        );
-    }
-
-    #[test]
-    fn user_skill_groups_default_to_version_one_without_persisted_groups() {
-        let mut value = current_global_config_with(serde_json::json!({}));
-        value["app"]
-            .as_object_mut()
-            .expect("current app config")
-            .remove("user_skill_groups");
-        let config: GlobalConfig = serde_json::from_value(value)
-            .expect("current app config should default omitted skill groups");
-        assert_eq!(
-            config.app.user_skill_groups,
-            UserSkillGroupsConfig::default()
-        );
-
-        let serialized = serde_json::to_value(&config).expect("config should serialize");
-        assert!(serialized["app"].get("user_skill_groups").is_none());
-    }
-
-    #[test]
-    fn user_skill_groups_preserve_the_versioned_ui_shape() {
-        let config: GlobalConfig =
-            serde_json::from_value(current_global_config_with(serde_json::json!({
-                "app": {
-                    "user_skill_groups": {
-                        "version": 1,
-                        "groups": [{
-                            "id": "daily-coding",
-                            "name": "Daily coding",
-                            "skillKeys": ["builtin::find-skills", "user::review"]
-                        }]
-                    }
-                }
-            })))
-            .expect("user skill groups should deserialize");
-
-        assert_eq!(
-            config.app.user_skill_groups.groups[0].skill_keys,
-            vec![
-                "builtin::find-skills".to_string(),
-                "user::review".to_string()
-            ]
-        );
-
-        let serialized = serde_json::to_value(&config).expect("config should serialize");
-        assert_eq!(
-            serialized["app"]["user_skill_groups"]["groups"][0]["skillKeys"],
-            serde_json::json!(["builtin::find-skills", "user::review"])
-        );
-    }
-
-    #[test]
-    fn global_config_preserves_project_mcp_servers() {
-        let config: GlobalConfig =
-            serde_json::from_value(current_global_config_with(serde_json::json!({
-                "project": {
-                    "mcp_servers": [
-                        {
-                            "id": "project-docs",
-                            "name": "Project Docs",
-                            "server_type": "local",
-                            "command": "docs-mcp",
-                            "args": []
-                        }
-                    ]
-                }
-            })))
-            .expect("project scoped MCP config should deserialize");
-
-        assert_eq!(
-            config
-                .project
-                .mcp_servers
-                .as_ref()
-                .and_then(|value| value.as_array())
-                .map(Vec::len),
-            Some(1)
-        );
-
-        let serialized = serde_json::to_value(&config).expect("config should serialize");
-        assert_eq!(
-            serialized["project"]["mcp_servers"][0]["id"],
-            "project-docs"
-        );
-    }
-
-    #[test]
-    fn global_config_preserves_terminal_panel_position() {
-        let config: GlobalConfig =
-            serde_json::from_value(current_global_config_with(serde_json::json!({
-                "terminal": {
-                    "terminal_panel_position": "bottom"
-                }
-            })))
-            .expect("terminal panel position config should deserialize");
-
-        assert_eq!(config.terminal.terminal_panel_position, "bottom");
-
-        let serialized = serde_json::to_value(&config).expect("config should serialize");
-        assert_eq!(serialized["terminal"]["terminal_panel_position"], "bottom");
-    }
-
-    #[test]
-    fn global_config_serialization_uses_appearance_selection() {
-        let serialized =
-            serde_json::to_value(GlobalConfig::default()).expect("config should serialize");
-
-        assert!(
-            serialized.get("theme").is_none(),
-            "Rust config must not export the removed GUI theme schema"
-        );
-        assert!(serialized.get("themes").is_none());
-        assert_eq!(serialized["appearance"]["selection"], "system");
-    }
-
-    #[test]
-    fn defaults_agent_companion_pet_to_blue_golden() {
-        let config: AIExperienceConfig =
-            serde_json::from_value(serde_json::json!({})).expect("empty config should default");
-
-        let pet = config
-            .agent_companion_pet
-            .as_ref()
-            .expect("default companion pet should be present");
-        assert_eq!(pet.id, "blue-golden");
-        assert_eq!(pet.display_name, "困困");
-        assert_eq!(pet.package_path, "/agent-companion-pets/blue-golden");
-        assert_eq!(
-            pet.spritesheet_path,
-            "/agent-companion-pets/blue-golden/spritesheet.png"
-        );
-        assert_eq!(pet.spritesheet_mime_type, "image/png");
-    }
-
-    #[test]
-    fn preserves_selected_agent_companion_pet() {
-        let config: AIExperienceConfig = serde_json::from_value(serde_json::json!({
-            "enable_session_title_generation": true,
-            "enable_welcome_panel_ai_analysis": false,
-            "enable_visual_mode": false,
-            "enable_agent_companion": true,
-            "agent_companion_pet": {
-                "id": "boxcat",
-                "displayName": "Boxcat",
-                "description": "A tiny cat tucked inside a cardboard box for cozy coding sessions.",
-                "source": "preset",
-                "packagePath": "/agent-companion-pets/boxcat",
-                "spritesheetPath": "/agent-companion-pets/boxcat/spritesheet.webp",
-                "spritesheetMimeType": "image/webp"
-            }
-        }))
-        .expect("AI experience config with selected companion pet should deserialize");
-
-        let pet = config
-            .agent_companion_pet
-            .as_ref()
-            .expect("selected companion pet should be retained");
-        assert_eq!(pet.id, "boxcat");
-        assert_eq!(pet.display_name, "Boxcat");
-        assert_eq!(pet.package_path, "/agent-companion-pets/boxcat");
-
-        let serialized = serde_json::to_value(&config).expect("config should serialize");
-        assert_eq!(serialized["agent_companion_pet"]["displayName"], "Boxcat");
-        assert_eq!(
-            serialized["agent_companion_pet"]["spritesheetPath"],
-            "/agent-companion-pets/boxcat/spritesheet.webp"
-        );
-    }
-
-    #[test]
-    fn quick_action_defaults_do_not_replace_an_explicit_legacy_empty_list() {
-        let absent: AIExperienceConfig = serde_json::from_value(serde_json::json!({})).unwrap();
-        assert_eq!(absent.quick_actions.len(), 2);
-        let cleared: AIExperienceConfig = serde_json::from_value(serde_json::json!({
-            "quick_actions": []
-        }))
-        .unwrap();
-        assert!(cleared.quick_actions.is_empty());
-        let round_trip: AIExperienceConfig =
-            serde_json::from_value(serde_json::to_value(cleared).unwrap()).unwrap();
-        assert!(round_trip.quick_actions.is_empty());
-    }
-
-    #[test]
-    fn ai_experience_quick_actions_round_trip_through_global_config() {
-        let config: GlobalConfig =
-            serde_json::from_value(current_global_config_with(serde_json::json!({
-                "app": {
-                    "language": "en-US",
-                    "auto_update": true,
-                    "telemetry": true,
-                    "startup_behavior": "default",
-                    "confirm_on_exit": true,
-                    "restore_windows": false,
-                    "zoom_level": 100,
-                    "sidebar": { "width": 260, "collapsed": false },
-                    "right_panel": { "width": 400, "collapsed": true },
-                    "notifications": {
-                        "enabled": true,
-                        "position": "top-right",
-                        "duration": 4000,
-                        "dialog_completion_notify": true,
-                        "permission_request_notify": false,
-                        "enable_startup_tips": true
-                    },
-                    "ai_experience": {
-                        "enable_session_title_generation": true,
-                        "enable_welcome_panel_ai_analysis": false,
-                        "enable_visual_mode": false,
-                        "enable_agent_companion": true,
-                        "enable_workspace_search": false,
-                        "quick_actions": [
-                            {
-                                "id": "custom_1",
-                                "label": "Run tests",
-                                "prompt": "Run the test suite",
-                                "enabled": true
-                            }
-                        ]
-                    }
-                }
-            })))
-            .expect("minimal app config with quick_actions should deserialize");
-
-        let actions = &config.app.ai_experience.quick_actions;
-        assert!(!config.app.notifications.permission_request_notify);
-        assert_eq!(actions.len(), 1);
-        assert_eq!(actions[0].id, "custom_1");
-        assert_eq!(actions[0].label, "Run tests");
-
-        let serialized = serde_json::to_value(&config).expect("config should serialize");
-        assert_eq!(
-            serialized["app"]["ai_experience"]["quick_actions"][0]["id"],
-            "custom_1"
-        );
-        assert_eq!(
-            serialized["app"]["notifications"]["permission_request_notify"],
-            false
-        );
-    }
-
-    #[test]
-    fn current_config_rejects_retired_app_session_config() {
-        let value = current_global_config_with(serde_json::json!({
-            "app": {
-                "session_config": {
-                    "default_mode": "cowork"
-                }
-            }
-        }));
-        let error = crate::service::config::manager::validate_current_config_value(
-            &value,
-            "Configuration fixture",
-        )
-        .expect_err("retired app session config must not enter the current runtime");
-        assert!(error.to_string().contains("app.session_config"));
-    }
-
-    #[test]
-    fn app_flow_chat_default_mode_id_round_trips() {
-        let config: GlobalConfig =
-            serde_json::from_value(current_global_config_with(serde_json::json!({
-                "app": {
-                    "flow_chat": {
-                        "default_mode_id": "PlannerPlus"
-                    }
-                }
-            })))
-            .expect("flow chat config should deserialize");
-
-        assert_eq!(
-            config.app.flow_chat.default_mode_id.as_deref(),
-            Some("PlannerPlus")
-        );
-
-        let serialized = serde_json::to_value(&config).expect("config should serialize");
-        assert_eq!(
-            serialized["app"]["flow_chat"]["default_mode_id"],
-            "PlannerPlus"
-        );
-    }
-
-    #[test]
-    fn app_flow_chat_permission_mode_control_defaults_to_visible_without_persisting_default() {
-        let default_config: GlobalConfig =
-            serde_json::from_value(current_global_config_with(serde_json::json!({
-                "app": {
-                    "flow_chat": {}
-                }
-            })))
-            .expect("flow chat config without visibility preference should deserialize");
-
-        assert!(default_config.app.flow_chat.show_permission_mode_control);
-        let default_serialized =
-            serde_json::to_value(&default_config).expect("config should serialize");
-        assert!(default_serialized["app"]["flow_chat"]
-            .get("show_permission_mode_control")
-            .is_none());
-
-        let hidden_config: GlobalConfig =
-            serde_json::from_value(current_global_config_with(serde_json::json!({
-                "app": {
-                    "flow_chat": {
-                        "show_permission_mode_control": false
-                    }
-                }
-            })))
-            .expect("flow chat config with hidden permission control should deserialize");
-
-        assert!(!hidden_config.app.flow_chat.show_permission_mode_control);
-        let hidden_serialized =
-            serde_json::to_value(&hidden_config).expect("config should serialize");
-        assert_eq!(
-            hidden_serialized["app"]["flow_chat"]["show_permission_mode_control"],
-            false
-        );
-    }
-
-    #[test]
-    fn default_model_serialization_contains_no_retired_reasoning_fields() {
-        let config = AIModelConfig::default();
-        let value = serde_json::to_value(&config).expect("config should serialize");
-
-        assert!(value.get("enable_thinking_process").is_none());
-        assert!(value.get("reasoning_mode").is_none());
-        assert!(value.get("reasoning_effort").is_none());
-        assert!(value.get("thinking_budget_tokens").is_none());
-        assert!(value.get("reasoning").is_none());
-    }
-
-    #[test]
-    fn default_model_config_enables_inline_think_in_text() {
-        let config = AIModelConfig::default();
-        assert!(config.inline_think_in_text);
-    }
-
-    #[test]
-    fn deserializes_missing_inline_think_in_text_as_enabled() {
-        let config: AIModelConfig = serde_json::from_value(serde_json::json!({
-            "id": "model_1",
-            "name": "Provider",
-            "provider": "openai",
-            "model_name": "test-model",
-            "base_url": "https://example.com/v1",
-            "api_key": "key",
-            "enabled": true
-        }))
-        .expect("config without inline_think_in_text should deserialize");
-
-        assert!(config.inline_think_in_text);
-    }
-
-    #[test]
-    fn default_ai_config_uses_generous_stream_timeouts() {
-        let config = AIConfig::default();
-
-        assert_eq!(config.stream_idle_timeout_secs, Some(600));
-        assert_eq!(config.stream_ttft_timeout_secs, Some(600));
-        assert!(config.enable_deferred_tool_loading);
-        assert!(config.allow_tool_json_repair);
-        assert_eq!(config.subagent_max_concurrency, 5);
-        assert_eq!(config.swarm_max_concurrency, 16);
-        assert_eq!(
-            config.subagent_batch_execution_policy,
-            SubagentBatchExecutionPolicy::ForceParallel
-        );
-        let review_team = config
-            .review_teams
-            .get("default")
-            .expect("default review team config should exist");
-        assert_eq!(review_team.reviewer_timeout_seconds, 3600);
-        assert_eq!(review_team.judge_timeout_seconds, 2400);
-        assert!(!review_team.auto_fix_enabled);
-        assert_eq!(review_team.strategy_level, "normal");
-        assert!(review_team.member_strategy_overrides.is_empty());
-        assert_eq!(config.review_team_rate_limit_status, serde_json::json!({}));
-        assert_eq!(config.agent_model_defaults.mode, "primary");
-        assert_eq!(
-            config.agent_model_defaults.subagents.default_selection,
-            SubagentModelSelection::fixed("fast")
-        );
-        assert_eq!(
-            config
-                .agent_model_defaults
-                .subagents
-                .builtin
-                .get("GeneralPurpose"),
-            Some(&SubagentModelSelection::fixed("primary"))
-        );
-        assert_eq!(
-            config
-                .agent_model_defaults
-                .subagents
-                .builtin
-                .get("ResearchSpecialist"),
-            Some(&SubagentModelSelection::Inherit)
-        );
-        assert_eq!(
-            config.agent_model_defaults.subagents.fork,
-            SubagentModelSelection::Inherit
-        );
-    }
-
-    #[test]
-    fn subagent_model_selection_uses_a_tagged_persistent_shape() {
-        let selection = SubagentModelSelection::fixed("fast");
-        assert_eq!(
-            serde_json::to_value(selection).expect("selection should serialize"),
-            serde_json::json!({ "kind": "fixed", "model_id": "fast" })
-        );
-
-        let inherited: SubagentModelSelection = serde_json::from_value(serde_json::json!({
-            "kind": "inherit"
-        }))
-        .expect("inherit selection should deserialize");
-        assert_eq!(inherited, SubagentModelSelection::Inherit);
-    }
-
-    #[test]
-    fn builtin_subagent_without_override_uses_the_shared_default() {
-        let mut defaults = AgentModelDefaultsConfig::default();
-        defaults.subagents.default_selection = SubagentModelSelection::fixed("primary");
-
-        assert_eq!(
-            defaults.builtin_subagent_selection("Explore"),
-            SubagentModelSelection::fixed("primary")
-        );
-    }
-
-    #[test]
-    fn general_purpose_uses_primary_unless_explicitly_overridden() {
-        let mut defaults = AgentModelDefaultsConfig::default();
-
-        assert_eq!(
-            defaults.builtin_subagent_selection("GeneralPurpose"),
-            SubagentModelSelection::fixed("primary")
-        );
-
-        defaults.subagents.builtin.insert(
-            "GeneralPurpose".to_string(),
-            SubagentModelSelection::fixed("fast"),
-        );
-        assert_eq!(
-            defaults.builtin_subagent_selection("GeneralPurpose"),
-            SubagentModelSelection::fixed("fast")
-        );
-    }
-
-    #[test]
-    fn research_specialist_inherits_parent_unless_explicitly_overridden() {
-        let mut defaults = AgentModelDefaultsConfig::default();
-
-        assert_eq!(
-            defaults.builtin_subagent_selection("ResearchSpecialist"),
-            SubagentModelSelection::Inherit
-        );
-
-        defaults.subagents.builtin.insert(
-            "ResearchSpecialist".to_string(),
-            SubagentModelSelection::fixed("fast"),
-        );
-        assert_eq!(
-            defaults.builtin_subagent_selection("ResearchSpecialist"),
-            SubagentModelSelection::fixed("fast")
-        );
-    }
-
-    #[test]
-    fn editor_indentation_defaults_and_legacy_round_trip() {
-        let defaults: EditorConfig = serde_json::from_str("{}").unwrap();
-        assert_eq!(defaults.tab_size, 4);
-        assert!(defaults.insert_spaces);
-        assert!(defaults.detect_indentation);
-
-        // Old explicit preferences must not be reset during an upgrade.
-        let legacy = serde_json::json!({ "tab_size": 2, "insert_spaces": false });
-        let config: EditorConfig = serde_json::from_value(legacy.clone()).unwrap();
-        assert_eq!(config.tab_size, 2);
-        assert!(!config.insert_spaces);
-        assert!(config.detect_indentation);
-        let saved = serde_json::to_value(&config).unwrap();
-        for (key, value) in legacy.as_object().unwrap() {
-            assert_eq!(&saved[key], value);
-        }
-        let mut explicit = saved;
-        explicit["detect_indentation"] = serde_json::json!(false);
-        let config: EditorConfig = serde_json::from_value(explicit.clone()).unwrap();
-        assert!(!config.detect_indentation);
-        assert_eq!(serde_json::to_value(config).unwrap(), explicit);
-    }
-
-    #[test]
-    fn current_editor_config_defaults_new_optional_visual_fields() {
-        let config: GlobalConfig =
-            serde_json::from_value(current_global_config_with(serde_json::json!({
-                "editor": {
-                    "font_size": 16,
-                    "font_family": "Fixture Mono",
-                    "line_height": 1.4
-                }
-            })))
-            .expect("current editor config should default optional visual fields");
-
-        assert_eq!(config.editor.font_size, 16);
-        assert_eq!(config.editor.font_family, "Fixture Mono");
-        assert_eq!(config.editor.font_weight, "normal");
-        assert_eq!(config.editor.cursor_style, "line");
-        assert_eq!(config.editor.cursor_blinking, "smooth");
-        assert_eq!(config.editor.render_whitespace, "selection");
-        assert_eq!(config.editor.render_line_highlight, "line");
-        assert!(!config.editor.scroll_beyond_last_line);
-        assert!(config.editor.smooth_scrolling);
-        assert!(config.editor.semantic_highlighting);
-        assert!(config.editor.bracket_pair_colorization);
-    }
-
-    #[test]
-    fn editor_visual_fields_survive_a_persisted_round_trip() {
-        let mut config = GlobalConfig::default();
-        config.editor.font_weight = "bold".to_string();
-        config.editor.cursor_style = "block-outline".to_string();
-        config.editor.cursor_blinking = "solid".to_string();
-        config.editor.render_whitespace = "all".to_string();
-        config.editor.render_line_highlight = "gutter".to_string();
-        config.editor.scroll_beyond_last_line = true;
-        config.editor.smooth_scrolling = false;
-        config.editor.semantic_highlighting = false;
-        config.editor.bracket_pair_colorization = false;
-
-        let restored: GlobalConfig = serde_json::from_value(
-            serde_json::to_value(config).expect("editor config should serialize"),
-        )
-        .expect("editor config should deserialize");
-
-        assert_eq!(restored.editor.font_weight, "bold");
-        assert_eq!(restored.editor.cursor_style, "block-outline");
-        assert_eq!(restored.editor.cursor_blinking, "solid");
-        assert_eq!(restored.editor.render_whitespace, "all");
-        assert_eq!(restored.editor.render_line_highlight, "gutter");
-        assert!(restored.editor.scroll_beyond_last_line);
-        assert!(!restored.editor.smooth_scrolling);
-        assert!(!restored.editor.semantic_highlighting);
-        assert!(!restored.editor.bracket_pair_colorization);
-    }
-
-    #[test]
-    fn default_global_config_includes_enabled_memories_config() {
-        let config = GlobalConfig::default();
-
-        assert!(!config.memories.generate_memories);
-        assert!(!config.memories.generate_for_btw_sessions);
-        assert!(!config.memories.use_memories);
-        assert_eq!(
-            config.memories.external_context_policy,
-            MemoryExternalContextPolicy::ClearToolResults
-        );
-        assert_eq!(config.memories.max_raw_memories_for_consolidation, 64);
-        assert_eq!(config.memories.max_unused_days, 30);
-        assert_eq!(config.memories.max_rollout_age_days, 10);
-        assert_eq!(config.memories.max_rollouts_per_startup, 2);
-        assert_eq!(config.memories.max_rollouts_scan_limit, 2_000);
-        assert_eq!(config.memories.min_rollout_idle_hours, 6);
-        assert_eq!(config.memories.phase1_max_concurrency, 1);
-        assert_eq!(config.memories.phase1_retry_backoff_minutes, 60);
-        assert_eq!(config.memories.phase1_lease_seconds, 60 * 60);
-        assert_eq!(config.memories.phase2_lease_seconds, 60 * 60);
-        assert_eq!(config.memories.phase2_success_cooldown_seconds, 6 * 60 * 60);
-        assert_eq!(config.memories.phase2_retry_delay_seconds, 60 * 60);
-        assert_eq!(config.memories.extract_model, None);
-        assert_eq!(config.memories.consolidation_model, None);
-    }
-
-    #[test]
-    fn deserializes_explicit_memories_config() {
-        let config: GlobalConfig =
-            serde_json::from_value(current_global_config_with(serde_json::json!({
-                "memories": {
-                    "generate_memories": false,
-                    "generate_for_btw_sessions": true,
-                    "use_memories": false,
-                    "external_context_policy": "skip_session",
-                    "max_raw_memories_for_consolidation": 12,
-                    "max_unused_days": 7,
-                    "max_rollout_age_days": 14,
-                    "max_rollouts_per_startup": 8,
-                    "max_rollouts_scan_limit": 200,
-                    "min_rollout_idle_hours": 12,
-                    "phase1_max_concurrency": 3,
-                    "phase1_retry_backoff_minutes": 45,
-                    "phase1_lease_seconds": 600,
-                    "phase2_lease_seconds": 1200,
-                    "phase2_success_cooldown_seconds": 7200,
-                    "phase2_retry_delay_seconds": 300,
-                    "extract_model": "extractor",
-                    "consolidation_model": "consolidator"
-                }
-            })))
-            .expect("global config with memories section should deserialize");
-
-        assert!(!config.memories.generate_memories);
-        assert!(config.memories.generate_for_btw_sessions);
-        assert!(!config.memories.use_memories);
-        assert_eq!(
-            config.memories.external_context_policy,
-            MemoryExternalContextPolicy::SkipSession
-        );
-        assert_eq!(config.memories.max_raw_memories_for_consolidation, 12);
-        assert_eq!(config.memories.max_unused_days, 7);
-        assert_eq!(config.memories.max_rollout_age_days, 14);
-        assert_eq!(config.memories.max_rollouts_per_startup, 8);
-        assert_eq!(config.memories.max_rollouts_scan_limit, 200);
-        assert_eq!(config.memories.min_rollout_idle_hours, 12);
-        assert_eq!(config.memories.phase1_max_concurrency, 3);
-        assert_eq!(config.memories.phase1_retry_backoff_minutes, 45);
-        assert_eq!(config.memories.phase1_lease_seconds, 600);
-        assert_eq!(config.memories.phase2_lease_seconds, 1200);
-        assert_eq!(config.memories.phase2_success_cooldown_seconds, 7200);
-        assert_eq!(config.memories.phase2_retry_delay_seconds, 300);
-        assert_eq!(config.memories.extract_model.as_deref(), Some("extractor"));
-        assert_eq!(
-            config.memories.consolidation_model.as_deref(),
-            Some("consolidator")
-        );
-    }
-
-    #[test]
-    fn deserializes_missing_stream_timeouts_as_generous_defaults() {
-        let config: AIConfig = serde_json::from_value(serde_json::json!({
-            "models": [],
-            "default_models": {},
-            "agent_profiles": {},
-            "proxy": {
-                "enabled": false,
-                "url": ""
-            }
-        }))
-        .expect("config without stream_idle_timeout_secs should deserialize");
-
-        assert_eq!(config.stream_idle_timeout_secs, Some(600));
-        assert_eq!(config.stream_ttft_timeout_secs, Some(600));
-        assert!(config.allow_tool_json_repair);
-        assert_eq!(config.subagent_max_concurrency, 5);
-        assert_eq!(config.swarm_max_concurrency, 16);
-        assert_eq!(
-            config.subagent_batch_execution_policy,
-            SubagentBatchExecutionPolicy::ForceParallel
-        );
-        assert!(config.review_teams.contains_key("default"));
-    }
-
-    #[test]
-    fn task_models_default_to_fast() {
-        let config = AIConfig::default();
-
-        assert_eq!(
-            config.task_models.session_title.fixed_model_id(),
-            Some("fast")
-        );
-        assert_eq!(config.task_models.git_commit.fixed_model_id(), Some("fast"));
-    }
-
-    #[test]
-    fn preserves_explicit_disabled_tool_json_repair() {
-        let config: AIConfig = serde_json::from_value(serde_json::json!({
-            "models": [],
-            "default_models": {},
-            "agent_profiles": {},
-            "allow_tool_json_repair": false,
-            "proxy": {
-                "enabled": false,
-                "url": ""
-            }
-        }))
-        .expect("config with an explicit JSON repair setting should deserialize");
-
-        assert!(!config.allow_tool_json_repair);
-    }
-
-    #[test]
-    fn deserializes_explicit_null_stream_ttft_timeout_as_none() {
-        let config: AIConfig = serde_json::from_value(serde_json::json!({
-            "models": [],
-            "default_models": {},
-            "agent_profiles": {},
-            "proxy": {
-                "enabled": false,
-                "url": ""
-            },
-            "stream_ttft_timeout_secs": null
-        }))
-        .expect("config with explicit null stream_ttft_timeout_secs should deserialize");
-
-        assert_eq!(config.stream_ttft_timeout_secs, None);
-        assert_eq!(config.stream_idle_timeout_secs, Some(600));
-    }
-
-    #[test]
-    fn app_logging_defaults_to_sensitive_diagnostics_enabled() {
-        let config: AppLoggingConfig = serde_json::from_value(serde_json::json!({
-            "level": "trace"
-        }))
-        .expect("logging config without sensitive preference should deserialize");
-
-        assert!(config.include_sensitive_diagnostics);
-        assert!(!config.flow_chat_diagnostics);
-        assert_eq!(
-            config.model_exchange_tracing.mode,
-            ModelExchangeTracingMode::Off
-        );
-    }
-
-    #[test]
-    fn deserializes_explicit_subagent_max_concurrency() {
-        let config: AIConfig = serde_json::from_value(serde_json::json!({
-            "models": [],
-            "default_models": {},
-            "agent_profiles": {},
-            "subagent_max_concurrency": 9,
-            "proxy": {
-                "enabled": false,
-                "url": ""
-            }
-        }))
-        .expect("config with subagent_max_concurrency should deserialize");
-
-        assert_eq!(config.subagent_max_concurrency, 9);
-    }
-
-    #[test]
-    fn deserializes_explicit_swarm_max_concurrency() {
-        let config: AIConfig = serde_json::from_value(serde_json::json!({
-            "models": [],
-            "func_agent_models": {},
-            "default_models": {},
-            "agent_profiles": {},
-            "swarm_max_concurrency": 24,
-            "proxy": {
-                "enabled": false,
-                "url": ""
-            }
-        }))
-        .expect("config with swarm_max_concurrency should deserialize");
-
-        assert_eq!(config.swarm_max_concurrency, 24);
-    }
-
-    #[test]
-    fn deserializes_explicit_subagent_batch_execution_policy() {
-        let config: AIConfig = serde_json::from_value(serde_json::json!({
-            "models": [],
-            "default_models": {},
-            "agent_profiles": {},
-            "subagent_batch_execution_policy": "force_parallel",
-            "proxy": {
-                "enabled": false,
-                "url": ""
-            }
-        }))
-        .expect("config with subagent_batch_execution_policy should deserialize");
-
-        assert_eq!(
-            config.subagent_batch_execution_policy,
-            SubagentBatchExecutionPolicy::ForceParallel
-        );
-    }
-
-    #[test]
-    fn deserializes_mode_profiles_with_null_entries() {
-        let config: AIConfig = serde_json::from_value(serde_json::json!({
-            "models": [],
-            "default_models": {},
-            "agent_profiles": {
-                "Claw": null,
-                "Cowork": {
-                    "profile_id": "Cowork",
-                    "removed_tools": ["shell"]
-                }
-            },
-            "proxy": {
-                "enabled": false,
-                "url": ""
-            }
-        }))
-        .expect("config with null mode config entries should deserialize");
-
-        assert!(!config.agent_profiles.contains_key("Claw"));
-        assert_eq!(
-            config
-                .agent_profiles
-                .get("Cowork")
-                .expect("non-null mode config should be retained")
-                .removed_tools,
-            vec!["shell".to_string()]
-        );
-    }
-
-    #[test]
-    fn deserializes_explicit_default_review_team_config() {
-        let config: AIConfig = serde_json::from_value(serde_json::json!({
-            "models": [],
-            "default_models": {},
-            "agent_profiles": {},
-            "review_teams": {
-                "default": {
-                    "extra_subagent_ids": ["ExtraReviewer"],
-                    "reviewer_timeout_seconds": 120,
-                    "judge_timeout_seconds": 90,
-                    "strategy_level": "deep",
-                    "member_strategy_overrides": {
-                        "ReviewSecurity": "quick",
-                        "ExtraReviewer": "normal"
-                    },
-                    "auto_fix_enabled": false
-                }
-            },
-            "proxy": {
-                "enabled": false,
-                "url": ""
-            }
-        }))
-        .expect("config with review_teams should deserialize");
-
-        let review_team = config
-            .review_teams
-            .get("default")
-            .expect("default review team config should be retained");
-        assert_eq!(review_team.extra_subagent_ids, vec!["ExtraReviewer"]);
-        assert_eq!(review_team.reviewer_timeout_seconds, 120);
-        assert_eq!(review_team.judge_timeout_seconds, 90);
-        assert_eq!(review_team.strategy_level, "deep");
-        assert_eq!(
-            review_team.member_strategy_overrides.get("ReviewSecurity"),
-            Some(&"quick".to_string())
-        );
-        assert_eq!(
-            review_team.member_strategy_overrides.get("ExtraReviewer"),
-            Some(&"normal".to_string())
-        );
-        assert!(!review_team.auto_fix_enabled);
-
-        let serialized = serde_json::to_value(&config).expect("config should serialize");
-        assert_eq!(
-            serialized["review_teams"]["default"]["strategy_level"],
-            "deep"
-        );
-        assert_eq!(
-            serialized["review_teams"]["default"]["member_strategy_overrides"]["ReviewSecurity"],
-            "quick"
-        );
-    }
-
-    #[test]
-    fn preserves_review_team_concurrency_fields_through_config_round_trip() {
-        let config: AIConfig = serde_json::from_value(serde_json::json!({
-            "models": [],
-            "default_models": {},
-            "agent_profiles": {},
-            "review_teams": {
-                "default": {
-                    "extra_subagent_ids": [],
-                    "strategy_level": "normal",
-                    "member_strategy_overrides": {},
-                    "reviewer_timeout_seconds": 3600,
-                    "judge_timeout_seconds": 2400,
-                    "reviewer_file_split_threshold": 20,
-                    "max_same_role_instances": 3,
-                    "max_retries_per_role": 1,
-                    "max_parallel_reviewers": 1,
-                    "max_queue_wait_seconds": 0,
-                    "allow_provider_capacity_queue": true,
-                    "allow_bounded_auto_retry": false,
-                    "auto_retry_elapsed_guard_seconds": 180
-                }
-            },
-            "proxy": {
-                "enabled": false,
-                "url": ""
-            }
-        }))
-        .expect("review team concurrency config should deserialize");
-
-        let serialized = serde_json::to_value(&config).expect("config should serialize");
-        let stored = &serialized["review_teams"]["default"];
-        assert_eq!(stored["max_retries_per_role"], serde_json::json!(1));
-        assert_eq!(stored["max_parallel_reviewers"], serde_json::json!(1));
-        assert_eq!(stored["max_queue_wait_seconds"], serde_json::json!(0));
-        assert_eq!(
-            stored["allow_provider_capacity_queue"],
-            serde_json::json!(true)
-        );
-        assert_eq!(stored["allow_bounded_auto_retry"], serde_json::json!(false));
-        assert_eq!(
-            stored["auto_retry_elapsed_guard_seconds"],
-            serde_json::json!(180)
-        );
-    }
-
-    #[test]
-    fn missing_review_team_concurrency_fields_use_product_defaults() {
-        let config: AIConfig = serde_json::from_value(serde_json::json!({
-            "models": [],
-            "review_teams": {
-                "default": {
-                    "strategy_level": "normal"
-                }
-            }
-        }))
-        .expect("legacy review team config should deserialize");
-
-        let serialized = serde_json::to_value(&config).expect("config should serialize");
-        let stored = &serialized["review_teams"]["default"];
-        assert_eq!(stored["max_retries_per_role"], serde_json::json!(1));
-        assert_eq!(stored["max_parallel_reviewers"], serde_json::json!(2));
-        assert_eq!(stored["max_queue_wait_seconds"], serde_json::json!(1200));
-        assert_eq!(
-            stored["allow_provider_capacity_queue"],
-            serde_json::json!(true)
-        );
-        assert_eq!(stored["allow_bounded_auto_retry"], serde_json::json!(false));
-        assert_eq!(
-            stored["auto_retry_elapsed_guard_seconds"],
-            serde_json::json!(180)
-        );
-    }
-
-    #[test]
-    fn review_team_auxiliary_config_is_not_stored_inside_review_team_map() {
-        let config: AIConfig = serde_json::from_value(serde_json::json!({
-            "models": [],
-            "review_teams": {
-                "default": {
-                    "strategy_level": "normal"
-                }
-            },
-            "review_team_rate_limit_status": {
-                "remaining": 2
-            },
-        }))
-        .expect("review team auxiliary config should deserialize");
-
-        assert!(config.review_teams.contains_key("default"));
-        assert!(!config.review_teams.contains_key("rate_limit_status"));
-        assert_eq!(
-            config.review_team_rate_limit_status["remaining"],
-            serde_json::json!(2)
-        );
-        let serialized =
-            serde_json::to_value(&config).expect("review team auxiliary config should serialize");
-        assert!(serialized["review_teams"]["rate_limit_status"].is_null());
-    }
-
-    #[test]
-    fn legacy_ai_config_defaults_web_search_to_free_exa() {
-        let config: AIConfig = serde_json::from_value(serde_json::json!({
-            "models": []
-        }))
-        .expect("legacy AI config should deserialize");
-
-        assert_eq!(config.web_search.provider, "exa_mcp_free");
-        assert_eq!(
-            config.web_search.providers.exa_search_api.credential_id,
-            "exa-search-api"
-        );
-    }
-
-    #[test]
-    fn web_search_config_preserves_unknown_provider_and_fields() {
-        let config: WebSearchConfig = serde_json::from_value(serde_json::json!({
-            "provider": "future_search",
-            "providers": {
-                "exa_search_api": {
-                    "credentialId": "exa-device-ref",
-                    "futureOption": true
-                },
-                "future_search": {
-                    "endpoint": "https://future.example/search"
-                }
-            },
-            "selectionRevision": 7
-        }))
-        .expect("future WebSearch config should deserialize");
-
-        let serialized = serde_json::to_value(config).expect("WebSearch config should serialize");
-        assert_eq!(serialized["provider"], "future_search");
-        assert_eq!(serialized["selectionRevision"], 7);
-        assert_eq!(
-            serialized["providers"]["exa_search_api"]["futureOption"],
-            true
-        );
-        assert_eq!(
-            serialized["providers"]["future_search"]["endpoint"],
-            "https://future.example/search"
-        );
-    }
-}
diff --git a/src/crates/assembly/core/src/service/coordination_persistence.rs b/src/crates/assembly/core/src/service/coordination_persistence.rs
index c60b6931e4..32e547813b 100644
--- a/src/crates/assembly/core/src/service/coordination_persistence.rs
+++ b/src/crates/assembly/core/src/service/coordination_persistence.rs
@@ -1,177 +1,18 @@
-//! Physical schema owner for the durable Agent coordination database.
-//!
-//! Runtime coordination and offline legacy import both open this database, but
-//! neither should carry a private copy of its versioning and repair rules.
-
-use crate::util::errors::{OpenBitFunError, OpenBitFunResult};
+use crate::util::errors::OpenBitFunResult;
+use openbitfun_services_core::coordination_persistence as storage;
+pub(crate) use openbitfun_services_core::coordination_persistence::COORDINATION_SCHEMA_VERSION;
 use rusqlite::Connection;
 
-pub(crate) const COORDINATION_SCHEMA_VERSION: i64 = 2;
-
 pub(crate) fn initialize_coordination_schema(connection: &Connection) -> OpenBitFunResult<()> {
-    let version = connection
-        .query_row("PRAGMA user_version", [], |row| row.get::<_, i64>(0))
-        .map_err(db_error)?;
-    if version > COORDINATION_SCHEMA_VERSION {
-        return Err(OpenBitFunError::service(format!(
-            "Agent coordination database schema {version} is newer than supported schema {COORDINATION_SCHEMA_VERSION}"
-        )));
-    }
-    if version == 0 {
-        connection
-            .execute_batch(
-                r#"
-CREATE TABLE coordination_sessions (
-    parent_session_id TEXT PRIMARY KEY,
-    next_auto_agent_seq INTEGER NOT NULL DEFAULT 1,
-    updated_at_ms INTEGER NOT NULL
-);
-
-CREATE TABLE agents (
-    agent_pk INTEGER PRIMARY KEY AUTOINCREMENT,
-    parent_session_id TEXT NOT NULL,
-    agent_id TEXT NOT NULL,
-    child_session_id TEXT,
-    next_bg_seq INTEGER NOT NULL DEFAULT 1,
-    state TEXT NOT NULL CHECK (state IN ('active', 'historical')),
-    created_at_ms INTEGER NOT NULL,
-    UNIQUE(parent_session_id, agent_id),
-    UNIQUE(parent_session_id, child_session_id)
-);
-
-CREATE TABLE background_tasks (
-    task_pk INTEGER PRIMARY KEY AUTOINCREMENT,
-    parent_session_id TEXT NOT NULL,
-    agent_pk INTEGER NOT NULL,
-    bg_task_id TEXT NOT NULL,
-    bg_ordinal INTEGER NOT NULL,
-    parent_dialog_turn_id TEXT NOT NULL,
-    parent_tool_call_id TEXT NOT NULL,
-    child_dialog_turn_id TEXT NOT NULL,
-    status TEXT NOT NULL CHECK (
-        status IN ('running', 'completed', 'partial_timeout', 'failed', 'cancelled', 'interrupted')
-    ),
-    error_code TEXT,
-    error_message TEXT,
-    execution_owner_token TEXT NOT NULL,
-    created_at_ms INTEGER NOT NULL,
-    terminal_at_ms INTEGER,
-    delivered_at_ms INTEGER,
-    delivered_parent_dialog_turn_id TEXT,
-    UNIQUE(parent_session_id, bg_task_id),
-    UNIQUE(agent_pk, bg_ordinal),
-    FOREIGN KEY(agent_pk) REFERENCES agents(agent_pk) ON DELETE CASCADE
-);
-
-CREATE INDEX idx_background_tasks_wait
-    ON background_tasks(parent_session_id, delivered_at_ms, status, task_pk);
-CREATE INDEX idx_background_tasks_parent_turn
-    ON background_tasks(parent_session_id, parent_dialog_turn_id);
-
-PRAGMA user_version = 1;
-            "#,
-            )
-            .map_err(db_error)?;
-    }
-    if version < 2 {
-        connection
-            .execute_batch(
-                r#"
-CREATE TABLE swarm_trees (
-    root_session_id TEXT PRIMARY KEY,
-    created_at_ms INTEGER NOT NULL
-);
-
-CREATE TABLE swarm_nodes (
-    session_id TEXT PRIMARY KEY,
-    root_session_id TEXT NOT NULL,
-    parent_session_id TEXT,
-    agent_type TEXT NOT NULL,
-    depth INTEGER NOT NULL,
-    created_at_ms INTEGER NOT NULL,
-    FOREIGN KEY(root_session_id) REFERENCES swarm_trees(root_session_id) ON DELETE CASCADE
-);
-
-CREATE INDEX idx_swarm_nodes_root ON swarm_nodes(root_session_id);
-CREATE INDEX idx_swarm_nodes_parent ON swarm_nodes(parent_session_id);
-PRAGMA user_version = 2;
-                "#,
-            )
-            .map_err(db_error)?;
-    }
-    ensure_v2_additive_columns(connection)?;
-    Ok(())
-}
-
-/// Schema v2 shipped after the background-task delivery columns were added to
-/// schema v1. A retired build could nevertheless leave a database stamped as
-/// v2 without those additive columns. Keep the repair keyed to the physical
-/// shape so reopening such a database is safe and idempotent.
-fn ensure_v2_additive_columns(connection: &Connection) -> OpenBitFunResult<()> {
-    for (column, declaration) in [
-        ("delivered_at_ms", "INTEGER"),
-        ("delivered_parent_dialog_turn_id", "TEXT"),
-    ] {
-        if !coordination_table_has_column(connection, "background_tasks", column)? {
-            connection
-                .execute_batch(&format!(
-                    "ALTER TABLE background_tasks ADD COLUMN {column} {declaration};"
-                ))
-                .map_err(db_error)?;
-        }
-    }
-    connection
-        .execute_batch(
-            r#"
-CREATE INDEX IF NOT EXISTS idx_background_tasks_wait
-    ON background_tasks(parent_session_id, delivered_at_ms, status, task_pk);
-CREATE INDEX IF NOT EXISTS idx_background_tasks_parent_turn
-    ON background_tasks(parent_session_id, parent_dialog_turn_id);
-            "#,
-        )
-        .map_err(db_error)?;
-    Ok(())
+    storage::initialize_coordination_schema(connection).map_err(Into::into)
 }
-
 pub(crate) fn coordination_table_has_column(
     connection: &Connection,
     table: &str,
-    expected_column: &str,
+    column: &str,
 ) -> OpenBitFunResult<bool> {
-    let mut statement = connection
-        .prepare(&format!("PRAGMA table_info({table})"))
-        .map_err(db_error)?;
-    let columns = statement
-        .query_map([], |row| row.get::<_, String>(1))
-        .map_err(db_error)?;
-    for column in columns {
-        if column.map_err(db_error)? == expected_column {
-            return Ok(true);
-        }
-    }
-    Ok(false)
+    storage::coordination_table_has_column(connection, table, column).map_err(Into::into)
 }
-
 pub(crate) fn validate_coordination_agent_id(agent_id: &str) -> OpenBitFunResult<()> {
-    let valid = !agent_id.is_empty()
-        && agent_id.len() <= 32
-        && agent_id
-            .bytes()
-            .enumerate()
-            .all(|(index, byte)| match byte {
-                b'a'..=b'z' => true,
-                b'0'..=b'9' | b'_' | b'-' => index > 0,
-                _ => false,
-            });
-    if valid {
-        Ok(())
-    } else {
-        Err(OpenBitFunError::tool(
-            "agent_id must match [a-z][a-z0-9_-]{0,31}".to_string(),
-        ))
-    }
-}
-
-fn db_error(error: rusqlite::Error) -> OpenBitFunError {
-    OpenBitFunError::io(format!("Agent coordination database error: {error}"))
+    storage::validate_coordination_agent_id(agent_id).map_err(Into::into)
 }
diff --git a/src/crates/assembly/core/src/service/mod.rs b/src/crates/assembly/core/src/service/mod.rs
index 0470e535c3..740a7ddd22 100644
--- a/src/crates/assembly/core/src/service/mod.rs
+++ b/src/crates/assembly/core/src/service/mod.rs
@@ -11,7 +11,7 @@ pub(crate) mod bootstrap; // Workspace persona bootstrap helpers
 #[cfg(feature = "canvas-runtime")]
 pub mod canvas; // Canvas service compatibility facade
 pub mod config; // Config management
-#[cfg(any(feature = "agent-runtime", feature = "legacy-migration"))]
+#[cfg(feature = "agent-runtime")]
 pub(crate) mod coordination_persistence;
 #[cfg(all(feature = "agent-runtime", feature = "scheduled-jobs"))]
 pub mod cron; // Scheduled jobs
@@ -41,7 +41,7 @@ pub mod runtime; // Managed runtime and capability management
 pub mod search; // Workspace search via managed flashgrep daemon
 #[cfg(feature = "local-storage")]
 pub mod session; // Session persistence
-#[cfg(any(feature = "agent-runtime", feature = "legacy-migration"))]
+#[cfg(feature = "agent-runtime")]
 pub(crate) mod session_projection_format;
 #[cfg(feature = "agent-runtime")]
 pub mod session_projection_store; // Durable append-only log of the executing Turn
@@ -55,9 +55,6 @@ pub mod token_usage; // Token usage tracking
 pub mod web_search; // Provider-neutral WebSearch runtime and local credentials
 #[cfg(feature = "workspace-runtime")]
 pub mod workspace; // Workspace management // Diff calculation and merge service
-#[cfg(all(feature = "legacy-migration", not(feature = "workspace-runtime")))]
-#[path = "workspace/mod.rs"]
-pub(crate) mod workspace;
 #[cfg(feature = "workspace-runtime")]
 pub mod workspace_runtime; // Workspace runtime layout / migration / initialization
 #[cfg(all(feature = "agent-runtime", feature = "git"))]
diff --git a/src/crates/assembly/core/src/service/session_projection_format.rs b/src/crates/assembly/core/src/service/session_projection_format.rs
index dddfd7579a..0b8c0fe566 100644
--- a/src/crates/assembly/core/src/service/session_projection_format.rs
+++ b/src/crates/assembly/core/src/service/session_projection_format.rs
@@ -1,121 +1 @@
-//! Stable on-disk envelope for in-flight Session runtime events.
-
-use crate::util::errors::{OpenBitFunError, OpenBitFunResult};
-use openbitfun_events::AgenticEvent;
-use std::collections::BTreeSet;
-use std::io::{BufRead, BufReader};
-use std::path::Path;
-
-#[derive(Debug, serde::Serialize, serde::Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub(crate) struct LoggedEvent {
-    pub(crate) stream_id: String,
-    pub(crate) cursor: u64,
-    pub(crate) event: AgenticEvent,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub(crate) struct RuntimeEventLogSummary {
-    pub(crate) stream_id: String,
-    pub(crate) event_count: usize,
-    pub(crate) turn_ids: BTreeSet<String>,
-}
-
-/// Validate an imported JSONL file through the same envelope and durable-prefix
-/// semantics used by the runtime store. Migration keeps the original bytes and
-/// ordering; a torn tail is retained but is not considered part of the readable
-/// event prefix.
-pub(crate) fn validate_runtime_event_log(
-    path: &Path,
-    expected_session_id: &str,
-) -> OpenBitFunResult<RuntimeEventLogSummary> {
-    let file = std::fs::File::open(path).map_err(|error| {
-        OpenBitFunError::io(format!(
-            "Failed to open runtime event log {}: {error}",
-            path.display()
-        ))
-    })?;
-    let mut stream_id: Option<String> = None;
-    let mut event_count = 0usize;
-    let mut turn_ids = BTreeSet::new();
-    for (line_index, line) in BufReader::new(file).lines().enumerate() {
-        let line = line.map_err(|error| {
-            OpenBitFunError::io(format!(
-                "Failed to read runtime event log {} at line {}: {error}",
-                path.display(),
-                line_index + 1
-            ))
-        })?;
-        if line.trim().is_empty() {
-            continue;
-        }
-        let Ok(record) = serde_json::from_str::<LoggedEvent>(&line) else {
-            break;
-        };
-        if let Some(session_id) = record.event.session_id() {
-            if session_id != expected_session_id {
-                return Err(OpenBitFunError::validation(format!(
-                    "Runtime event log {} contains a different Session id",
-                    path.display()
-                )));
-            }
-        }
-        if let Some(turn_id) = record.event.turn_id() {
-            turn_ids.insert(turn_id.to_string());
-        }
-        match stream_id.as_deref() {
-            Some(current) if current != record.stream_id => {
-                turn_ids.clear();
-                event_count = 0;
-                stream_id = Some(record.stream_id);
-            }
-            None => stream_id = Some(record.stream_id),
-            _ => {}
-        }
-        event_count = event_count.saturating_add(1);
-    }
-    let stream_id = stream_id.ok_or_else(|| {
-        OpenBitFunError::validation(format!(
-            "Runtime event log {} contains no events",
-            path.display()
-        ))
-    })?;
-    Ok(RuntimeEventLogSummary {
-        stream_id,
-        event_count,
-        turn_ids,
-    })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::fs;
-    use std::path::PathBuf;
-
-    #[test]
-    fn imported_log_keeps_the_runtime_readers_torn_tail_semantics() {
-        let root = std::env::var_os("OPENBITFUN_TEST_TMPDIR")
-            .map(PathBuf::from)
-            .unwrap_or_else(|| PathBuf::from("E:/tmp"));
-        fs::create_dir_all(&root).unwrap();
-        let temp = tempfile::Builder::new()
-            .prefix("openbitfun-runtime-event-")
-            .tempdir_in(root)
-            .unwrap();
-        let path = temp.path().join("session-1.jsonl");
-        fs::write(
-            &path,
-            concat!(
-                "{\"streamId\":\"stream-1\",\"cursor\":1,\"event\":{\"type\":\"TextChunk\",\"session_id\":\"session-1\",\"turn_id\":\"turn-1\",\"round_id\":\"round-1\",\"text\":\"durable\"}}\n",
-                "{\"streamId\":\"stream-1\",\"cursor\":"
-            ),
-        )
-        .unwrap();
-
-        let summary = validate_runtime_event_log(&path, "session-1").unwrap();
-        assert_eq!(summary.stream_id, "stream-1");
-        assert_eq!(summary.event_count, 1);
-        assert_eq!(summary.turn_ids, BTreeSet::from(["turn-1".to_string()]));
-    }
-}
+pub(crate) use openbitfun_services_core::session_projection_format::*;
diff --git a/src/crates/assembly/core/src/service/workspace/manager.rs b/src/crates/assembly/core/src/service/workspace/manager.rs
index 891bd1013e..13a422a10a 100644
--- a/src/crates/assembly/core/src/service/workspace/manager.rs
+++ b/src/crates/assembly/core/src/service/workspace/manager.rs
@@ -33,10 +33,22 @@ struct WorkspaceIdentityFrontmatter {
     emoji: Option<String>,
 }
 
-impl WorkspaceIdentity {
-    pub(crate) async fn load_from_workspace_root(
-        workspace_root: &Path,
-    ) -> Result<Option<Self>, String> {
+/// Runtime operations stay in Core; persisted records are shared with offline tools.
+#[async_trait::async_trait]
+pub(crate) trait WorkspaceIdentityRuntimeExt: Sized {
+    async fn load_from_workspace_root(workspace_root: &Path) -> Result<Option<Self>, String>;
+    fn from_markdown(content: &str) -> Result<Self, String>;
+    fn is_empty(&self) -> bool;
+    #[cfg(any(feature = "agent-runtime", test))]
+    fn collect_changed_fields(
+        previous: Option<&WorkspaceIdentity>,
+        current: Option<&WorkspaceIdentity>,
+    ) -> Vec<String>;
+}
+
+#[async_trait::async_trait]
+impl WorkspaceIdentityRuntimeExt for WorkspaceIdentity {
+    async fn load_from_workspace_root(workspace_root: &Path) -> Result<Option<Self>, String> {
         let identity_path = workspace_root.join(IDENTITY_FILE_NAME);
         if !identity_path.exists() {
             return Ok(None);
@@ -81,7 +93,7 @@ impl WorkspaceIdentity {
     }
 
     #[cfg(any(feature = "agent-runtime", test))]
-    pub(crate) fn collect_changed_fields(
+    fn collect_changed_fields(
         previous: Option<&WorkspaceIdentity>,
         current: Option<&WorkspaceIdentity>,
     ) -> Vec<String> {
@@ -192,13 +204,49 @@ impl Default for WorkspaceOpenOptions {
     }
 }
 
-impl WorkspaceInfo {
+/// Runtime operations stay in Core; persisted records are shared with offline tools.
+#[async_trait::async_trait]
+pub trait WorkspaceInfoRuntimeExt: Sized {
+    async fn new(root_path: PathBuf, options: WorkspaceOpenOptions) -> OpenBitFunResult<Self>;
+    async fn new_without_worktree(
+        root_path: PathBuf,
+        options: WorkspaceOpenOptions,
+    ) -> OpenBitFunResult<Self>;
+    async fn new_inner(
+        root_path: PathBuf,
+        options: WorkspaceOpenOptions,
+        load_worktree: bool,
+    ) -> OpenBitFunResult<Self>;
+    async fn load_identity(&mut self);
+    async fn load_worktree(&mut self, freshness: WorktreeTopologyFreshness);
+    async fn resolve_worktree_info(
+        workspace_root: &Path,
+        freshness: WorktreeTopologyFreshness,
+    ) -> Option<WorkspaceWorktreeInfo>;
+    async fn detect_workspace_type(&mut self);
+    async fn detect_languages_from_files(&mut self);
+    async fn scan_workspace(&mut self, options: ScanOptions) -> OpenBitFunResult<()>;
+    fn scan_directory<'a>(
+        &'a self,
+        dir: &'a Path,
+        stats: &'a mut WorkspaceStatistics,
+        options: &'a ScanOptions,
+        depth: usize,
+    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = OpenBitFunResult<()>> + 'a + Send>>;
+    async fn scan_git_info(&self) -> Option<GitInfo>;
+    fn touch(&mut self);
+    async fn is_valid(&self) -> bool;
+    fn get_summary(&self) -> WorkspaceSummary;
+}
+
+#[async_trait::async_trait]
+impl WorkspaceInfoRuntimeExt for WorkspaceInfo {
     /// Creates a new workspace record.
-    pub async fn new(root_path: PathBuf, options: WorkspaceOpenOptions) -> OpenBitFunResult<Self> {
+    async fn new(root_path: PathBuf, options: WorkspaceOpenOptions) -> OpenBitFunResult<Self> {
         Self::new_inner(root_path, options, true).await
     }
 
-    pub(crate) async fn new_without_worktree(
+    async fn new_without_worktree(
         root_path: PathBuf,
         options: WorkspaceOpenOptions,
     ) -> OpenBitFunResult<Self> {
@@ -372,7 +420,7 @@ impl WorkspaceInfo {
         self.worktree = Self::resolve_worktree_info(&self.root_path, freshness).await;
     }
 
-    pub(crate) async fn resolve_worktree_info(
+    async fn resolve_worktree_info(
         workspace_root: &Path,
         freshness: WorktreeTopologyFreshness,
     ) -> Option<WorkspaceWorktreeInfo> {
@@ -628,12 +676,12 @@ impl WorkspaceInfo {
     }
 
     /// Updates the last-accessed timestamp.
-    pub fn touch(&mut self) {
+    fn touch(&mut self) {
         self.last_accessed = chrono::Utc::now();
     }
 
     /// Checks whether the workspace is still valid.
-    pub async fn is_valid(&self) -> bool {
+    async fn is_valid(&self) -> bool {
         if self.workspace_kind == WorkspaceKind::Remote {
             return true;
         }
@@ -641,7 +689,7 @@ impl WorkspaceInfo {
     }
 
     /// Returns a workspace summary.
-    pub fn get_summary(&self) -> WorkspaceSummary {
+    fn get_summary(&self) -> WorkspaceSummary {
         WorkspaceSummary {
             id: self.id.clone(),
             name: self.name.clone(),
@@ -1383,7 +1431,7 @@ pub struct WorkspaceManagerStatistics {
 
 #[cfg(test)]
 mod tests {
-    use super::WorkspaceIdentity;
+    use super::{WorkspaceIdentity, WorkspaceIdentityRuntimeExt};
 
     #[test]
     fn workspace_identity_reads_optional_avatar_without_requiring_it() {
diff --git a/src/crates/assembly/core/src/service/workspace/mod.rs b/src/crates/assembly/core/src/service/workspace/mod.rs
index c4d29adb60..bf46e7654e 100644
--- a/src/crates/assembly/core/src/service/workspace/mod.rs
+++ b/src/crates/assembly/core/src/service/workspace/mod.rs
@@ -32,9 +32,9 @@ pub use identity_watch::WorkspaceIdentityWatchService;
 #[cfg(feature = "workspace-runtime")]
 pub use manager::{
     GitInfo, PrimaryAssistantKey, RelatedPath, ScanOptions, WorkspaceIdentity, WorkspaceInfo,
-    WorkspaceKind, WorkspaceManager, WorkspaceManagerConfig, WorkspaceManagerStatistics,
-    WorkspaceOpenOptions, WorkspaceStatistics, WorkspaceStatus, WorkspaceSummary, WorkspaceType,
-    WorkspaceWorktreeInfo,
+    WorkspaceInfoRuntimeExt, WorkspaceKind, WorkspaceManager, WorkspaceManagerConfig,
+    WorkspaceManagerStatistics, WorkspaceOpenOptions, WorkspaceStatistics, WorkspaceStatus,
+    WorkspaceSummary, WorkspaceType, WorkspaceWorktreeInfo,
 };
 #[cfg(feature = "workspace-runtime")]
 pub use provider::{WorkspaceCleanupResult, WorkspaceProvider, WorkspaceSystemSummary};
@@ -45,7 +45,5 @@ pub use service::{
     WorkspaceHealthStatus, WorkspaceIdentityChangedEvent, WorkspaceImportResult,
     WorkspaceInfoUpdates, WorkspaceQuickSummary, WorkspaceService,
 };
-#[cfg(all(feature = "legacy-migration", not(feature = "workspace-runtime")))]
-pub(crate) use types::{PrimaryAssistantKey, WorkspaceInfo, WorkspaceKind};
 #[cfg(feature = "git")]
 pub use worktree_topology::{global_worktree_topology_service, WorktreeTopologyService};
diff --git a/src/crates/assembly/core/src/service/workspace/persistence.rs b/src/crates/assembly/core/src/service/workspace/persistence.rs
index a8ffc22517..0a545286a7 100644
--- a/src/crates/assembly/core/src/service/workspace/persistence.rs
+++ b/src/crates/assembly/core/src/service/workspace/persistence.rs
@@ -1,230 +1,20 @@
-//! Current Workspace registry persistence contract and validation.
-
-use super::types::{PrimaryAssistantKey, WorkspaceInfo, WorkspaceKind};
+use super::types::WorkspaceInfo;
 use crate::util::errors::{OpenBitFunError, OpenBitFunResult};
-use openbitfun_core_types::product_identity::product_id;
-use openbitfun_services_core::workspace_identity::{
-    canonicalize_local_workspace_root, local_workspace_stable_storage_id,
-    normalize_remote_workspace_path, remote_workspace_stable_id, LOCAL_WORKSPACE_SSH_HOST,
+use openbitfun_services_core::workspace_persistence as storage;
+pub(crate) use openbitfun_services_core::workspace_persistence::{
+    WorkspacePersistenceData, WORKSPACE_PERSISTENCE_FORMAT_VERSION,
 };
-use serde::{Deserialize, Serialize};
-use std::collections::{HashMap, HashSet};
 use std::path::Path;
 
-pub(crate) const WORKSPACE_PERSISTENCE_FORMAT_VERSION: u32 = 1;
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub(crate) struct WorkspacePersistenceData {
-    #[serde(default)]
-    pub(crate) format_version: u32,
-    #[serde(default)]
-    pub(crate) product_id: String,
-    pub(crate) workspaces: HashMap<String, WorkspaceInfo>,
-    #[serde(default)]
-    pub(crate) opened_workspace_ids: Vec<String>,
-    pub(crate) current_workspace_id: Option<String>,
-    #[serde(default)]
-    pub(crate) recent_workspaces: Vec<String>,
-    #[serde(default)]
-    pub(crate) recent_assistant_workspaces: Vec<String>,
-    #[serde(default)]
-    pub(crate) primary_assistant_key: Option<PrimaryAssistantKey>,
-    pub(crate) saved_at: chrono::DateTime<chrono::Utc>,
-}
-
 pub(crate) fn current_workspace_storage_id(workspace: &WorkspaceInfo) -> OpenBitFunResult<String> {
-    match workspace.workspace_kind {
-        WorkspaceKind::Remote => {
-            let ssh_host = workspace
-                .metadata
-                .get("sshHost")
-                .and_then(|value| value.as_str())
-                .map(str::trim)
-                .filter(|value| !value.is_empty())
-                .ok_or_else(|| {
-                    unsupported_workspace_persistence(format!(
-                        "remote workspace '{}' is missing sshHost",
-                        workspace.id
-                    ))
-                })?;
-            workspace.remote_ssh_connection_id().ok_or_else(|| {
-                unsupported_workspace_persistence(format!(
-                    "remote workspace '{}' is missing connectionId",
-                    workspace.id
-                ))
-            })?;
-
-            let stored_root = workspace.root_path.to_string_lossy().replace('\\', "/");
-            let normalized_root = normalize_remote_workspace_path(&stored_root);
-            if !normalized_root.starts_with('/') {
-                return Err(unsupported_workspace_persistence(format!(
-                    "remote workspace '{}' does not use an absolute POSIX root",
-                    workspace.id
-                )));
-            }
-            if stored_root != normalized_root {
-                return Err(unsupported_workspace_persistence(format!(
-                    "remote workspace '{}' rootPath is not normalized",
-                    workspace.id
-                )));
-            }
-            Ok(remote_workspace_stable_id(ssh_host, &normalized_root))
-        }
-        WorkspaceKind::Normal | WorkspaceKind::Assistant => {
-            let ssh_host = workspace
-                .metadata
-                .get("sshHost")
-                .and_then(|value| value.as_str())
-                .map(str::trim);
-            if ssh_host != Some(LOCAL_WORKSPACE_SSH_HOST) {
-                return Err(unsupported_workspace_persistence(format!(
-                    "local workspace '{}' does not declare sshHost=localhost",
-                    workspace.id
-                )));
-            }
-            expected_persisted_local_workspace_id(&workspace.root_path).map_err(|error| {
-                unsupported_workspace_persistence(format!(
-                    "local workspace '{}' is not canonical: {error}",
-                    workspace.id
-                ))
-            })
-        }
-    }
+    storage::current_workspace_storage_id(workspace).map_err(Into::into)
 }
-
 pub(crate) fn validate_workspace_persistence_data(
     data: &WorkspacePersistenceData,
-    miniapps_root: &Path,
-) -> OpenBitFunResult<()> {
-    if data.format_version != WORKSPACE_PERSISTENCE_FORMAT_VERSION {
-        return Err(unsupported_workspace_persistence(format!(
-            "format_version {} is not supported; expected {}",
-            data.format_version, WORKSPACE_PERSISTENCE_FORMAT_VERSION
-        )));
-    }
-    if data.product_id != product_id() {
-        return Err(unsupported_workspace_persistence(format!(
-            "product_id '{}' does not match '{}'",
-            data.product_id,
-            product_id()
-        )));
-    }
-
-    for (storage_id, workspace) in &data.workspaces {
-        if storage_id != &workspace.id {
-            return Err(unsupported_workspace_persistence(format!(
-                "workspace map key '{storage_id}' does not match record id '{}'",
-                workspace.id
-            )));
-        }
-        let expected_id = current_workspace_storage_id(workspace)?;
-        if storage_id != &expected_id {
-            return Err(unsupported_workspace_persistence(format!(
-                "workspace id '{storage_id}' is not canonical; expected '{expected_id}'"
-            )));
-        }
-    }
-    validate_workspace_reference_list(
-        &data.workspaces,
-        &data.opened_workspace_ids,
-        "opened_workspace_ids",
-    )?;
-    validate_workspace_reference_list(
-        &data.workspaces,
-        &data.recent_workspaces,
-        "recent_workspaces",
-    )?;
-    validate_workspace_reference_list(
-        &data.workspaces,
-        &data.recent_assistant_workspaces,
-        "recent_assistant_workspaces",
-    )?;
-
-    for id in &data.recent_workspaces {
-        let workspace = &data.workspaces[id];
-        if workspace.workspace_kind == WorkspaceKind::Assistant {
-            return Err(unsupported_workspace_persistence(format!(
-                "recent_workspaces contains assistant workspace '{id}'"
-            )));
-        }
-        if workspace.root_path.starts_with(miniapps_root) {
-            return Err(unsupported_workspace_persistence(format!(
-                "recent_workspaces contains MiniApp-owned workspace '{id}'"
-            )));
-        }
-    }
-    for id in &data.recent_assistant_workspaces {
-        if data.workspaces[id].workspace_kind != WorkspaceKind::Assistant {
-            return Err(unsupported_workspace_persistence(format!(
-                "recent_assistant_workspaces contains non-assistant workspace '{id}'"
-            )));
-        }
-    }
-
-    if let Some(current_id) = data.current_workspace_id.as_deref() {
-        if !data.workspaces.contains_key(current_id) {
-            return Err(unsupported_workspace_persistence(format!(
-                "current_workspace_id references unknown workspace id '{current_id}'"
-            )));
-        }
-        if !data.opened_workspace_ids.iter().any(|id| id == current_id) {
-            return Err(unsupported_workspace_persistence(format!(
-                "current workspace '{current_id}' is not present in opened_workspace_ids"
-            )));
-        }
-    }
-
-    Ok(())
-}
-
-fn expected_persisted_local_workspace_id(root_path: &Path) -> Result<String, String> {
-    if !root_path.is_absolute() {
-        return Err(format!(
-            "local workspace rootPath is not absolute: {}",
-            root_path.display()
-        ));
-    }
-
-    let normalized_root = if root_path.exists() {
-        let (canonical_root, normalized_root) = canonicalize_local_workspace_root(root_path)?;
-        if canonical_root != root_path {
-            return Err(format!(
-                "local workspace rootPath is not canonical: {}",
-                root_path.display()
-            ));
-        }
-        normalized_root
-    } else {
-        root_path.to_string_lossy().replace('\\', "/")
-    };
-
-    Ok(local_workspace_stable_storage_id(&normalized_root))
-}
-
-fn validate_workspace_reference_list(
-    workspaces: &HashMap<String, WorkspaceInfo>,
-    ids: &[String],
-    field: &str,
+    miniapp_root: &Path,
 ) -> OpenBitFunResult<()> {
-    let mut seen = HashSet::new();
-    for id in ids {
-        if !seen.insert(id.as_str()) {
-            return Err(unsupported_workspace_persistence(format!(
-                "{field} contains duplicate workspace id '{id}'"
-            )));
-        }
-        if !workspaces.contains_key(id) {
-            return Err(unsupported_workspace_persistence(format!(
-                "{field} references unknown workspace id '{id}'"
-            )));
-        }
-    }
-    Ok(())
+    storage::validate_workspace_persistence_data(data, miniapp_root).map_err(Into::into)
 }
-
 pub(crate) fn unsupported_workspace_persistence(detail: impl AsRef<str>) -> OpenBitFunError {
-    OpenBitFunError::config(format!(
-        "Unsupported workspace persistence format: {}. The persisted file was left unchanged; explicit data migration is required",
-        detail.as_ref()
-    ))
+    storage::unsupported_workspace_persistence(detail).into()
 }
diff --git a/src/crates/assembly/core/src/service/workspace/provider.rs b/src/crates/assembly/core/src/service/workspace/provider.rs
index ce8f1103d6..09d71af75c 100644
--- a/src/crates/assembly/core/src/service/workspace/provider.rs
+++ b/src/crates/assembly/core/src/service/workspace/provider.rs
@@ -1,3 +1,4 @@
+use super::manager::WorkspaceInfoRuntimeExt;
 use super::manager::{
     WorkspaceInfo, WorkspaceOpenOptions, WorkspaceStatistics, WorkspaceSummary, WorkspaceType,
 };
diff --git a/src/crates/assembly/core/src/service/workspace/service.rs b/src/crates/assembly/core/src/service/workspace/service.rs
index 6620b1d9b8..64ac27764a 100644
--- a/src/crates/assembly/core/src/service/workspace/service.rs
+++ b/src/crates/assembly/core/src/service/workspace/service.rs
@@ -7,6 +7,7 @@ use super::manager::{
     WorkspaceManager, WorkspaceManagerConfig, WorkspaceManagerStatistics, WorkspaceOpenOptions,
     WorkspaceStatus, WorkspaceSummary, WorkspaceType,
 };
+use super::manager::{WorkspaceIdentityRuntimeExt, WorkspaceInfoRuntimeExt};
 use super::persistence::{
     unsupported_workspace_persistence, validate_workspace_persistence_data,
     WorkspacePersistenceData, WORKSPACE_PERSISTENCE_FORMAT_VERSION,
diff --git a/src/crates/assembly/core/src/service/workspace/types.rs b/src/crates/assembly/core/src/service/workspace/types.rs
index 07739a356a..f13158f7b3 100644
--- a/src/crates/assembly/core/src/service/workspace/types.rs
+++ b/src/crates/assembly/core/src/service/workspace/types.rs
@@ -1,175 +1 @@
-//! Persisted Workspace record types shared by the live service and offline import.
-
-#![cfg_attr(
-    all(feature = "legacy-migration", not(feature = "workspace-runtime")),
-    allow(unreachable_pub)
-)]
-
-use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
-use std::path::PathBuf;
-
-pub(crate) use openbitfun_runtime_ports::RelatedPath;
-
-/// Workspace type.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Hash)]
-pub enum WorkspaceType {
-    RustProject,
-    NodeProject,
-    PythonProject,
-    JavaProject,
-    CppProject,
-    WebProject,
-    MobileProject,
-    Other,
-}
-
-/// Workspace status.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
-pub enum WorkspaceStatus {
-    Active,
-    Inactive,
-    Loading,
-    Error,
-    Archived,
-}
-
-/// Workspace lifecycle kind.
-#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq, Hash)]
-#[serde(rename_all = "lowercase")]
-pub enum WorkspaceKind {
-    #[default]
-    Normal,
-    Assistant,
-    Remote,
-}
-
-/// Stable identity of the assistant workspace that owns the primary role.
-///
-/// Local workspace ids are derived from canonical storage paths, so the primary
-/// selection is persisted using the assistant identity instead of that path-derived id.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(tag = "kind", rename_all = "snake_case")]
-pub enum PrimaryAssistantKey {
-    BuiltIn,
-    Named { assistant_id: String },
-}
-
-#[cfg(feature = "workspace-runtime")]
-impl PrimaryAssistantKey {
-    pub fn from_workspace(workspace: &WorkspaceInfo) -> Option<Self> {
-        if workspace.workspace_kind != WorkspaceKind::Assistant {
-            return None;
-        }
-        Some(match workspace.assistant_id.as_deref() {
-            Some(assistant_id) if !assistant_id.trim().is_empty() => Self::Named {
-                assistant_id: assistant_id.trim().to_string(),
-            },
-            _ => Self::BuiltIn,
-        })
-    }
-
-    pub fn matches(&self, workspace: &WorkspaceInfo) -> bool {
-        if workspace.workspace_kind != WorkspaceKind::Assistant {
-            return false;
-        }
-        match (self, workspace.assistant_id.as_deref()) {
-            (Self::BuiltIn, None) => true,
-            (Self::Named { assistant_id }, Some(candidate)) => assistant_id == candidate,
-            _ => false,
-        }
-    }
-}
-
-/// Parsed agent identity fields from `IDENTITY.md` frontmatter.
-#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "camelCase")]
-pub struct WorkspaceIdentity {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub creature: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub vibe: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub avatar: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub emoji: Option<String>,
-}
-
-/// Git worktree metadata attached to a workspace.
-#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "camelCase")]
-pub struct WorkspaceWorktreeInfo {
-    pub path: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    pub main_repo_path: String,
-    pub is_main: bool,
-}
-
-/// Workspace metadata.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct WorkspaceInfo {
-    pub id: String,
-    pub name: String,
-    #[serde(rename = "rootPath")]
-    pub root_path: PathBuf,
-    #[serde(rename = "workspaceType")]
-    pub workspace_type: WorkspaceType,
-    #[serde(rename = "workspaceKind", default)]
-    pub workspace_kind: WorkspaceKind,
-    #[serde(
-        rename = "assistantId",
-        default,
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub assistant_id: Option<String>,
-    pub status: WorkspaceStatus,
-    pub languages: Vec<String>,
-    #[serde(rename = "openedAt")]
-    pub opened_at: chrono::DateTime<chrono::Utc>,
-    #[serde(rename = "lastAccessed")]
-    pub last_accessed: chrono::DateTime<chrono::Utc>,
-    pub description: Option<String>,
-    pub tags: Vec<String>,
-    pub statistics: Option<WorkspaceStatistics>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub identity: Option<WorkspaceIdentity>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub worktree: Option<WorkspaceWorktreeInfo>,
-    #[serde(rename = "relatedPaths", default)]
-    pub related_paths: Vec<RelatedPath>,
-    pub metadata: HashMap<String, serde_json::Value>,
-}
-
-impl WorkspaceInfo {
-    /// SSH connection id persisted in [`WorkspaceInfo::metadata`] for remote workspaces.
-    pub fn remote_ssh_connection_id(&self) -> Option<&str> {
-        self.metadata
-            .get("connectionId")
-            .and_then(|value| value.as_str())
-            .filter(|value| !value.is_empty())
-    }
-}
-
-/// Workspace statistics.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct WorkspaceStatistics {
-    pub total_files: usize,
-    pub total_directories: usize,
-    pub total_size_bytes: u64,
-    pub file_extensions: HashMap<String, usize>,
-    pub last_modified: Option<chrono::DateTime<chrono::Utc>>,
-    pub git_info: Option<GitInfo>,
-}
-
-/// Git information.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct GitInfo {
-    pub is_git_repo: bool,
-    pub current_branch: Option<String>,
-    pub remote_url: Option<String>,
-    pub has_uncommitted_changes: bool,
-    pub total_commits: Option<usize>,
-}
+pub use openbitfun_services_core::workspace_records::*;
diff --git a/src/crates/assembly/core/src/util/errors.rs b/src/crates/assembly/core/src/util/errors.rs
index a226a6d48f..362c15a6ec 100644
--- a/src/crates/assembly/core/src/util/errors.rs
+++ b/src/crates/assembly/core/src/util/errors.rs
@@ -9,6 +9,19 @@ use openbitfun_core_types::errors::{
 use serde::Serialize;
 use thiserror::Error;
 
+impl From<openbitfun_services_core::storage_error::StorageError> for OpenBitFunError {
+    fn from(error: openbitfun_services_core::storage_error::StorageError) -> Self {
+        use openbitfun_services_core::storage_error::StorageError;
+        match error {
+            StorageError::Config(message) => Self::config(message),
+            StorageError::Validation(message) => Self::validation(message),
+            StorageError::Io(message) => Self::io(message),
+            StorageError::Service(message) => Self::service(message),
+            StorageError::Tool(message) => Self::tool(message),
+        }
+    }
+}
+
 /// Unified error type for the OpenBitFun application
 #[derive(Debug, Error, Serialize)]
 pub enum OpenBitFunError {
diff --git a/src/crates/assembly/core/src/util/types/config.rs b/src/crates/assembly/core/src/util/types/config.rs
index 20149a1f03..11eb35d594 100644
--- a/src/crates/assembly/core/src/util/types/config.rs
+++ b/src/crates/assembly/core/src/util/types/config.rs
@@ -1,336 +1 @@
-use crate::service::config::types::AIModelConfig;
-use crate::service::config::types::{
-    automatic_max_output_tokens, is_valid_configured_max_output_tokens,
-    DEFAULT_MODEL_CONTEXT_WINDOW_TOKENS, MAX_CONFIGURED_OUTPUT_TOKENS_RATIO_PERCENT,
-    MIN_MODEL_CONTEXT_WINDOW_TOKENS,
-};
-use log::warn;
-pub use openbitfun_core_types::AIConfig;
-
-fn append_endpoint(base_url: &str, endpoint: &str) -> String {
-    let base = base_url.trim();
-    if base.is_empty() {
-        return endpoint.to_string();
-    }
-    if base.ends_with(endpoint) {
-        return base.to_string();
-    }
-    format!("{}/{}", base.trim_end_matches('/'), endpoint)
-}
-
-fn gemini_base_url(url: &str) -> &str {
-    let mut u = url;
-    if let Some(pos) = u.find("/v1beta") {
-        u = &u[..pos];
-    }
-    if let Some(pos) = u.find("/models/") {
-        u = &u[..pos];
-    }
-    u.trim_end_matches('/')
-}
-
-fn resolve_gemini_request_url(base_url: &str, model_name: &str) -> String {
-    let trimmed = base_url.trim().trim_end_matches('/');
-    if trimmed.is_empty() {
-        return String::new();
-    }
-
-    if let Some(stripped) = trimmed.strip_suffix('#') {
-        return stripped.trim_end_matches('/').to_string();
-    }
-
-    let model = model_name.trim();
-    if model.is_empty() {
-        return trimmed.to_string();
-    }
-
-    let base = gemini_base_url(trimmed);
-    format!(
-        "{}/v1beta/models/{}:streamGenerateContent?alt=sse",
-        base, model
-    )
-}
-
-pub fn resolve_request_url(base_url: &str, provider: &str, model_name: &str) -> String {
-    let trimmed = base_url.trim().trim_end_matches('/').to_string();
-    if trimmed.is_empty() {
-        return String::new();
-    }
-
-    if let Some(stripped) = trimmed.strip_suffix('#') {
-        return stripped.trim_end_matches('/').to_string();
-    }
-
-    match provider.trim().to_ascii_lowercase().as_str() {
-        "openai" | "nvidia" | "openrouter" => append_endpoint(&trimmed, "chat/completions"),
-        "response" | "responses" => append_endpoint(&trimmed, "responses"),
-        "anthropic" => append_endpoint(&trimmed, "v1/messages"),
-        "gemini" | "google" => resolve_gemini_request_url(&trimmed, model_name),
-        _ => trimmed,
-    }
-}
-
-impl TryFrom<AIModelConfig> for AIConfig {
-    type Error = String;
-
-    fn try_from(other: AIModelConfig) -> Result<Self, Self::Error> {
-        if !other.supports_text_generation() {
-            return Err(format!(
-                "Model '{}' does not support text_chat and cannot be used for text generation",
-                other.name
-            ));
-        }
-
-        let custom_request_body = if let Some(body_str) = &other.custom_request_body {
-            match serde_json::from_str::<serde_json::Value>(body_str) {
-                Ok(value) => Some(value),
-                Err(e) => {
-                    warn!(
-                        "Failed to parse custom_request_body: {}, config: {}",
-                        e, other.name
-                    );
-                    None
-                }
-            }
-        } else {
-            None
-        };
-
-        let request_url = other
-            .request_url
-            .clone()
-            .filter(|url| !url.is_empty())
-            .unwrap_or_else(|| {
-                resolve_request_url(&other.base_url, &other.provider, &other.model_name)
-            });
-
-        let context_window = other
-            .context_window
-            .unwrap_or(DEFAULT_MODEL_CONTEXT_WINDOW_TOKENS);
-        if context_window < MIN_MODEL_CONTEXT_WINDOW_TOKENS {
-            return Err(format!(
-                "Model '{}' context_window must be at least {}",
-                other.name, MIN_MODEL_CONTEXT_WINDOW_TOKENS
-            ));
-        }
-
-        let max_tokens = match other.max_tokens {
-            Some(configured_max_tokens)
-                if is_valid_configured_max_output_tokens(context_window, configured_max_tokens) =>
-            {
-                configured_max_tokens
-            }
-            Some(configured_max_tokens) => {
-                let automatic_max_tokens = automatic_max_output_tokens(context_window);
-                let maximum_allowed_tokens = u64::from(context_window)
-                    * u64::from(MAX_CONFIGURED_OUTPUT_TOKENS_RATIO_PERCENT)
-                    / 100;
-                warn!(
-                    "Invalid model max_tokens; falling back to automatic output limit: model_id={}, model_name={}, context_window={}, configured_max_tokens={}, maximum_allowed_tokens={}, automatic_max_tokens={}",
-                    other.id,
-                    other.name,
-                    context_window,
-                    configured_max_tokens,
-                    maximum_allowed_tokens,
-                    automatic_max_tokens
-                );
-                automatic_max_tokens
-            }
-            None => automatic_max_output_tokens(context_window),
-        };
-
-        Ok(AIConfig {
-            name: other.name.clone(),
-            base_url: other.base_url.clone(),
-            request_url,
-            api_key: other.api_key.clone(),
-            model: other.model_name.clone(),
-            format: other.provider.clone(),
-            context_window,
-            max_tokens: Some(max_tokens),
-            temperature: other.temperature,
-            top_p: other.top_p,
-            inline_think_in_text: other.inline_think_in_text,
-            custom_headers: other.custom_headers,
-            custom_headers_mode: other.custom_headers_mode,
-            skip_ssl_verify: other.skip_ssl_verify,
-            custom_request_body,
-            custom_request_body_mode: other.custom_request_body_mode,
-        })
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{resolve_request_url, AIConfig};
-    use crate::service::config::types::{AIModelConfig, ModelCapability, ModelCategory};
-
-    #[test]
-    fn resolves_openai_request_url() {
-        assert_eq!(
-            resolve_request_url("https://api.openai.com/v1", "openai", ""),
-            "https://api.openai.com/v1/chat/completions"
-        );
-    }
-
-    #[test]
-    fn resolves_responses_request_url() {
-        assert_eq!(
-            resolve_request_url("https://api.openai.com/v1", "responses", ""),
-            "https://api.openai.com/v1/responses"
-        );
-    }
-
-    #[test]
-    fn resolves_response_alias_request_url() {
-        assert_eq!(
-            resolve_request_url("https://api.openai.com/v1", "response", ""),
-            "https://api.openai.com/v1/responses"
-        );
-    }
-
-    #[test]
-    fn keeps_forced_request_url() {
-        assert_eq!(
-            resolve_request_url("https://api.openai.com/v1/responses#", "responses", ""),
-            "https://api.openai.com/v1/responses"
-        );
-    }
-
-    #[test]
-    fn resolves_gemini_request_url_with_v1beta() {
-        assert_eq!(
-            resolve_request_url(
-                "https://generativelanguage.googleapis.com/v1beta",
-                "gemini",
-                "gemini-2.5-pro"
-            ),
-            "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-pro:streamGenerateContent?alt=sse"
-        );
-    }
-
-    #[test]
-    fn resolves_gemini_request_url_bare_host() {
-        assert_eq!(
-            resolve_request_url("https://api.openbitfun.com", "gemini", "gemini-2.5-pro"),
-            "https://api.openbitfun.com/v1beta/models/gemini-2.5-pro:streamGenerateContent?alt=sse"
-        );
-    }
-
-    #[test]
-    fn resolves_nvidia_request_url() {
-        assert_eq!(
-            resolve_request_url("https://integrate.api.nvidia.com/v1", "nvidia", ""),
-            "https://integrate.api.nvidia.com/v1/chat/completions"
-        );
-    }
-
-    #[test]
-    fn resolves_openrouter_request_url() {
-        assert_eq!(
-            resolve_request_url("https://openrouter.ai/api/v1", "openrouter", ""),
-            "https://openrouter.ai/api/v1/chat/completions"
-        );
-    }
-
-    fn base_model_config() -> AIModelConfig {
-        AIModelConfig {
-            id: "model_1".to_string(),
-            name: "Provider".to_string(),
-            provider: "openai".to_string(),
-            model_name: "test-model".to_string(),
-            base_url: "https://example.com/v1".to_string(),
-            request_url: Some("https://example.com/v1/chat/completions".to_string()),
-            api_key: "key".to_string(),
-            context_window: Some(128000),
-            max_tokens: Some(4096),
-            temperature: None,
-            top_p: None,
-            enabled: true,
-            category: ModelCategory::GeneralChat,
-            capabilities: vec![],
-            recommended_for: vec![],
-            metadata: None,
-            reasoning: None,
-            inline_think_in_text: false,
-            custom_headers: None,
-            custom_headers_mode: None,
-            skip_ssl_verify: false,
-            custom_request_body: None,
-            custom_request_body_mode: None,
-            auth: Default::default(),
-        }
-    }
-
-    #[test]
-    fn missing_reasoning_default_does_not_change_runtime_config() {
-        let config = AIConfig::try_from(base_model_config()).expect("conversion should succeed");
-        assert_eq!(config.model, "test-model");
-    }
-
-    #[test]
-    fn derives_the_largest_output_tier_within_one_quarter_of_context() {
-        for (context_window, expected_max_tokens) in [
-            (32_000, 8_000),
-            (48_000, 8_000),
-            (64_000, 16_000),
-            (128_000, 32_000),
-            (128_128, 32_000),
-            (256_000, 64_000),
-            (1_000_000, 64_000),
-        ] {
-            let mut model = base_model_config();
-            model.context_window = Some(context_window);
-            model.max_tokens = None;
-
-            let config = AIConfig::try_from(model).expect("conversion should succeed");
-
-            assert_eq!(config.max_tokens, Some(expected_max_tokens));
-        }
-    }
-
-    #[test]
-    fn preserves_a_configured_output_limit_within_forty_percent_of_context() {
-        let mut model = base_model_config();
-        model.context_window = Some(1_000_000);
-        model.max_tokens = Some(384_000);
-
-        let config = AIConfig::try_from(model).expect("conversion should succeed");
-
-        assert_eq!(config.max_tokens, Some(384_000));
-    }
-
-    #[test]
-    fn falls_back_to_the_automatic_output_limit_when_configured_limit_is_too_large() {
-        let mut model = base_model_config();
-        model.context_window = Some(128_000);
-        model.max_tokens = Some(64_000);
-
-        let config = AIConfig::try_from(model).expect("conversion should succeed");
-
-        assert_eq!(config.max_tokens, Some(32_000));
-    }
-
-    #[test]
-    fn rejects_a_context_window_smaller_than_the_supported_minimum() {
-        let mut model = base_model_config();
-        model.context_window = Some(16_000);
-
-        let error = AIConfig::try_from(model).expect_err("conversion should reject small context");
-
-        assert!(error.contains("at least 32000"));
-    }
-
-    #[test]
-    fn rejects_pure_speech_models_at_the_text_generation_boundary() {
-        let mut model = base_model_config();
-        model.category = ModelCategory::SpeechRecognition;
-        model.capabilities = vec![ModelCapability::SpeechRecognition];
-        model.context_window = None;
-        model.max_tokens = None;
-
-        let error = AIConfig::try_from(model).expect_err("speech model is not a chat model");
-
-        assert!(error.contains("does not support text_chat"));
-    }
-}
+pub use openbitfun_config_contracts::conversion::*;
diff --git a/src/crates/contracts/AGENTS.md b/src/crates/contracts/AGENTS.md
index 73e1d26778..bd401f58ad 100644
--- a/src/crates/contracts/AGENTS.md
+++ b/src/crates/contracts/AGENTS.md
@@ -11,6 +11,7 @@ implementation details upward.
 | Crate | Responsibility | Local doc |
 |---|---|---|
 | `core-types` | Shared DTOs, errors, session/surface data, and small value types | [AGENTS.md](core-types/AGENTS.md) |
+| `config-contracts` | Persisted configuration records, defaults, validation, and pure model conversion | [AGENTS.md](config-contracts/AGENTS.md) |
 | `events` | Event payloads and emitter contracts | [AGENTS.md](events/AGENTS.md) |
 | `product-domains` | Product domain DTOs, rules, policies, and narrow ports | [AGENTS.md](product-domains/AGENTS.md) |
 | `runtime-ports` | Runtime-facing traits and ports used by owner crates | [AGENTS.md](runtime-ports/AGENTS.md) |
diff --git a/src/crates/contracts/config-contracts/AGENTS.md b/src/crates/contracts/config-contracts/AGENTS.md
new file mode 100644
index 0000000000..26131b5e80
--- /dev/null
+++ b/src/crates/contracts/config-contracts/AGENTS.md
@@ -0,0 +1,13 @@
+# Configuration contracts
+
+Pure persisted configuration records, defaults, validation and conversion to
+shared model DTOs. No filesystem, process, network, Tauri or Core dependencies.
+Keep existing schema versions and tolerant field defaults. Core retains the
+live ConfigProvider interface and re-exports the records from its old paths.
+The ts feature preserves TypeScript export capability without enabling runtime.
+
+Focused verification:
+
+```bash
+cargo test -p openbitfun-config-contracts --lib
+```
diff --git a/src/crates/contracts/config-contracts/Cargo.toml b/src/crates/contracts/config-contracts/Cargo.toml
new file mode 100644
index 0000000000..96028a47db
--- /dev/null
+++ b/src/crates/contracts/config-contracts/Cargo.toml
@@ -0,0 +1,23 @@
+[package]
+name = "openbitfun-config-contracts"
+version.workspace = true
+edition.workspace = true
+description = "Persisted OpenBitFun configuration contracts without product runtime"
+
+[dependencies]
+openbitfun-core-types = { path = "../core-types" }
+openbitfun-product-domains = { path = "../product-domains" }
+serde = { workspace = true }
+serde_json = { workspace = true }
+chrono = { workspace = true }
+sha2 = { workspace = true }
+hex = { workspace = true }
+log = { workspace = true }
+ts-rs = { workspace = true, optional = true }
+
+[features]
+default = []
+ts = ["dep:ts-rs", "openbitfun-core-types/ts", "openbitfun-product-domains/ts"]
+
+[lints]
+workspace = true
diff --git a/src/crates/contracts/config-contracts/src/conversion.rs b/src/crates/contracts/config-contracts/src/conversion.rs
new file mode 100644
index 0000000000..02e2c0b859
--- /dev/null
+++ b/src/crates/contracts/config-contracts/src/conversion.rs
@@ -0,0 +1,336 @@
+use crate::types::AIModelConfig;
+use crate::types::{
+    automatic_max_output_tokens, is_valid_configured_max_output_tokens,
+    DEFAULT_MODEL_CONTEXT_WINDOW_TOKENS, MAX_CONFIGURED_OUTPUT_TOKENS_RATIO_PERCENT,
+    MIN_MODEL_CONTEXT_WINDOW_TOKENS,
+};
+use log::warn;
+pub use openbitfun_core_types::AIConfig;
+
+fn append_endpoint(base_url: &str, endpoint: &str) -> String {
+    let base = base_url.trim();
+    if base.is_empty() {
+        return endpoint.to_string();
+    }
+    if base.ends_with(endpoint) {
+        return base.to_string();
+    }
+    format!("{}/{}", base.trim_end_matches('/'), endpoint)
+}
+
+fn gemini_base_url(url: &str) -> &str {
+    let mut u = url;
+    if let Some(pos) = u.find("/v1beta") {
+        u = &u[..pos];
+    }
+    if let Some(pos) = u.find("/models/") {
+        u = &u[..pos];
+    }
+    u.trim_end_matches('/')
+}
+
+fn resolve_gemini_request_url(base_url: &str, model_name: &str) -> String {
+    let trimmed = base_url.trim().trim_end_matches('/');
+    if trimmed.is_empty() {
+        return String::new();
+    }
+
+    if let Some(stripped) = trimmed.strip_suffix('#') {
+        return stripped.trim_end_matches('/').to_string();
+    }
+
+    let model = model_name.trim();
+    if model.is_empty() {
+        return trimmed.to_string();
+    }
+
+    let base = gemini_base_url(trimmed);
+    format!(
+        "{}/v1beta/models/{}:streamGenerateContent?alt=sse",
+        base, model
+    )
+}
+
+pub fn resolve_request_url(base_url: &str, provider: &str, model_name: &str) -> String {
+    let trimmed = base_url.trim().trim_end_matches('/').to_string();
+    if trimmed.is_empty() {
+        return String::new();
+    }
+
+    if let Some(stripped) = trimmed.strip_suffix('#') {
+        return stripped.trim_end_matches('/').to_string();
+    }
+
+    match provider.trim().to_ascii_lowercase().as_str() {
+        "openai" | "nvidia" | "openrouter" => append_endpoint(&trimmed, "chat/completions"),
+        "response" | "responses" => append_endpoint(&trimmed, "responses"),
+        "anthropic" => append_endpoint(&trimmed, "v1/messages"),
+        "gemini" | "google" => resolve_gemini_request_url(&trimmed, model_name),
+        _ => trimmed,
+    }
+}
+
+impl TryFrom<AIModelConfig> for AIConfig {
+    type Error = String;
+
+    fn try_from(other: AIModelConfig) -> Result<Self, Self::Error> {
+        if !other.supports_text_generation() {
+            return Err(format!(
+                "Model '{}' does not support text_chat and cannot be used for text generation",
+                other.name
+            ));
+        }
+
+        let custom_request_body = if let Some(body_str) = &other.custom_request_body {
+            match serde_json::from_str::<serde_json::Value>(body_str) {
+                Ok(value) => Some(value),
+                Err(e) => {
+                    warn!(
+                        "Failed to parse custom_request_body: {}, config: {}",
+                        e, other.name
+                    );
+                    None
+                }
+            }
+        } else {
+            None
+        };
+
+        let request_url = other
+            .request_url
+            .clone()
+            .filter(|url| !url.is_empty())
+            .unwrap_or_else(|| {
+                resolve_request_url(&other.base_url, &other.provider, &other.model_name)
+            });
+
+        let context_window = other
+            .context_window
+            .unwrap_or(DEFAULT_MODEL_CONTEXT_WINDOW_TOKENS);
+        if context_window < MIN_MODEL_CONTEXT_WINDOW_TOKENS {
+            return Err(format!(
+                "Model '{}' context_window must be at least {}",
+                other.name, MIN_MODEL_CONTEXT_WINDOW_TOKENS
+            ));
+        }
+
+        let max_tokens = match other.max_tokens {
+            Some(configured_max_tokens)
+                if is_valid_configured_max_output_tokens(context_window, configured_max_tokens) =>
+            {
+                configured_max_tokens
+            }
+            Some(configured_max_tokens) => {
+                let automatic_max_tokens = automatic_max_output_tokens(context_window);
+                let maximum_allowed_tokens = u64::from(context_window)
+                    * u64::from(MAX_CONFIGURED_OUTPUT_TOKENS_RATIO_PERCENT)
+                    / 100;
+                warn!(
+                    "Invalid model max_tokens; falling back to automatic output limit: model_id={}, model_name={}, context_window={}, configured_max_tokens={}, maximum_allowed_tokens={}, automatic_max_tokens={}",
+                    other.id,
+                    other.name,
+                    context_window,
+                    configured_max_tokens,
+                    maximum_allowed_tokens,
+                    automatic_max_tokens
+                );
+                automatic_max_tokens
+            }
+            None => automatic_max_output_tokens(context_window),
+        };
+
+        Ok(AIConfig {
+            name: other.name.clone(),
+            base_url: other.base_url.clone(),
+            request_url,
+            api_key: other.api_key.clone(),
+            model: other.model_name.clone(),
+            format: other.provider.clone(),
+            context_window,
+            max_tokens: Some(max_tokens),
+            temperature: other.temperature,
+            top_p: other.top_p,
+            inline_think_in_text: other.inline_think_in_text,
+            custom_headers: other.custom_headers,
+            custom_headers_mode: other.custom_headers_mode,
+            skip_ssl_verify: other.skip_ssl_verify,
+            custom_request_body,
+            custom_request_body_mode: other.custom_request_body_mode,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{resolve_request_url, AIConfig};
+    use crate::types::{AIModelConfig, ModelCapability, ModelCategory};
+
+    #[test]
+    fn resolves_openai_request_url() {
+        assert_eq!(
+            resolve_request_url("https://api.openai.com/v1", "openai", ""),
+            "https://api.openai.com/v1/chat/completions"
+        );
+    }
+
+    #[test]
+    fn resolves_responses_request_url() {
+        assert_eq!(
+            resolve_request_url("https://api.openai.com/v1", "responses", ""),
+            "https://api.openai.com/v1/responses"
+        );
+    }
+
+    #[test]
+    fn resolves_response_alias_request_url() {
+        assert_eq!(
+            resolve_request_url("https://api.openai.com/v1", "response", ""),
+            "https://api.openai.com/v1/responses"
+        );
+    }
+
+    #[test]
+    fn keeps_forced_request_url() {
+        assert_eq!(
+            resolve_request_url("https://api.openai.com/v1/responses#", "responses", ""),
+            "https://api.openai.com/v1/responses"
+        );
+    }
+
+    #[test]
+    fn resolves_gemini_request_url_with_v1beta() {
+        assert_eq!(
+            resolve_request_url(
+                "https://generativelanguage.googleapis.com/v1beta",
+                "gemini",
+                "gemini-2.5-pro"
+            ),
+            "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-pro:streamGenerateContent?alt=sse"
+        );
+    }
+
+    #[test]
+    fn resolves_gemini_request_url_bare_host() {
+        assert_eq!(
+            resolve_request_url("https://api.openbitfun.com", "gemini", "gemini-2.5-pro"),
+            "https://api.openbitfun.com/v1beta/models/gemini-2.5-pro:streamGenerateContent?alt=sse"
+        );
+    }
+
+    #[test]
+    fn resolves_nvidia_request_url() {
+        assert_eq!(
+            resolve_request_url("https://integrate.api.nvidia.com/v1", "nvidia", ""),
+            "https://integrate.api.nvidia.com/v1/chat/completions"
+        );
+    }
+
+    #[test]
+    fn resolves_openrouter_request_url() {
+        assert_eq!(
+            resolve_request_url("https://openrouter.ai/api/v1", "openrouter", ""),
+            "https://openrouter.ai/api/v1/chat/completions"
+        );
+    }
+
+    fn base_model_config() -> AIModelConfig {
+        AIModelConfig {
+            id: "model_1".to_string(),
+            name: "Provider".to_string(),
+            provider: "openai".to_string(),
+            model_name: "test-model".to_string(),
+            base_url: "https://example.com/v1".to_string(),
+            request_url: Some("https://example.com/v1/chat/completions".to_string()),
+            api_key: "key".to_string(),
+            context_window: Some(128000),
+            max_tokens: Some(4096),
+            temperature: None,
+            top_p: None,
+            enabled: true,
+            category: ModelCategory::GeneralChat,
+            capabilities: vec![],
+            recommended_for: vec![],
+            metadata: None,
+            reasoning: None,
+            inline_think_in_text: false,
+            custom_headers: None,
+            custom_headers_mode: None,
+            skip_ssl_verify: false,
+            custom_request_body: None,
+            custom_request_body_mode: None,
+            auth: Default::default(),
+        }
+    }
+
+    #[test]
+    fn missing_reasoning_default_does_not_change_runtime_config() {
+        let config = AIConfig::try_from(base_model_config()).expect("conversion should succeed");
+        assert_eq!(config.model, "test-model");
+    }
+
+    #[test]
+    fn derives_the_largest_output_tier_within_one_quarter_of_context() {
+        for (context_window, expected_max_tokens) in [
+            (32_000, 8_000),
+            (48_000, 8_000),
+            (64_000, 16_000),
+            (128_000, 32_000),
+            (128_128, 32_000),
+            (256_000, 64_000),
+            (1_000_000, 64_000),
+        ] {
+            let mut model = base_model_config();
+            model.context_window = Some(context_window);
+            model.max_tokens = None;
+
+            let config = AIConfig::try_from(model).expect("conversion should succeed");
+
+            assert_eq!(config.max_tokens, Some(expected_max_tokens));
+        }
+    }
+
+    #[test]
+    fn preserves_a_configured_output_limit_within_forty_percent_of_context() {
+        let mut model = base_model_config();
+        model.context_window = Some(1_000_000);
+        model.max_tokens = Some(384_000);
+
+        let config = AIConfig::try_from(model).expect("conversion should succeed");
+
+        assert_eq!(config.max_tokens, Some(384_000));
+    }
+
+    #[test]
+    fn falls_back_to_the_automatic_output_limit_when_configured_limit_is_too_large() {
+        let mut model = base_model_config();
+        model.context_window = Some(128_000);
+        model.max_tokens = Some(64_000);
+
+        let config = AIConfig::try_from(model).expect("conversion should succeed");
+
+        assert_eq!(config.max_tokens, Some(32_000));
+    }
+
+    #[test]
+    fn rejects_a_context_window_smaller_than_the_supported_minimum() {
+        let mut model = base_model_config();
+        model.context_window = Some(16_000);
+
+        let error = AIConfig::try_from(model).expect_err("conversion should reject small context");
+
+        assert!(error.contains("at least 32000"));
+    }
+
+    #[test]
+    fn rejects_pure_speech_models_at_the_text_generation_boundary() {
+        let mut model = base_model_config();
+        model.category = ModelCategory::SpeechRecognition;
+        model.capabilities = vec![ModelCapability::SpeechRecognition];
+        model.context_window = None;
+        model.max_tokens = None;
+
+        let error = AIConfig::try_from(model).expect_err("speech model is not a chat model");
+
+        assert!(error.contains("does not support text_chat"));
+    }
+}
diff --git a/src/crates/contracts/config-contracts/src/lib.rs b/src/crates/contracts/config-contracts/src/lib.rs
new file mode 100644
index 0000000000..7c1e401c20
--- /dev/null
+++ b/src/crates/contracts/config-contracts/src/lib.rs
@@ -0,0 +1,4 @@
+//! Persisted configuration DTOs and pure compatibility validation.
+pub mod conversion;
+mod types;
+pub use types::*;
diff --git a/src/crates/contracts/config-contracts/src/types.rs b/src/crates/contracts/config-contracts/src/types.rs
new file mode 100644
index 0000000000..dfeca0bc6c
--- /dev/null
+++ b/src/crates/contracts/config-contracts/src/types.rs
@@ -0,0 +1,3477 @@
+//! Unified configuration system type definitions
+//!
+//! Defines all configuration-related types shared between backend and frontend.
+
+use openbitfun_core_types::{product_identity, WorktreeSettings};
+pub use openbitfun_core_types::{ReasoningConfig, ReasoningPreset, ReasoningPresetAction};
+use openbitfun_product_domains::tool_permissions::{PermissionRule, ToolPermissionConfig};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::collections::HashMap;
+
+fn deserialize_agent_profiles<'de, D>(
+    deserializer: D,
+) -> Result<HashMap<String, AgentProfileConfig>, D::Error>
+where
+    D: serde::Deserializer<'de>,
+{
+    let raw = Option::<HashMap<String, Option<AgentProfileConfig>>>::deserialize(deserializer)?;
+    Ok(raw
+        .unwrap_or_default()
+        .into_iter()
+        .filter_map(|(profile_id, config)| config.map(|config| (profile_id, config)))
+        .collect())
+}
+
+/// Web UI font preferences (settings → basics). Keys match `FontPreference` in the frontend (camelCase).
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct FontPreferenceSnapshot {
+    pub ui_size: UiFontSizeSnapshot,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct UiFontSizeSnapshot {
+    pub level: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub custom_px: Option<u32>,
+}
+
+/// Global configuration structure - matches the frontend `GlobalConfig` exactly.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct GlobalConfig {
+    /// Immutable product identity for this persisted document.
+    pub product_id: String,
+    pub app: AppConfig,
+    pub editor: EditorConfig,
+    pub terminal: TerminalConfig,
+    pub workspace: WorkspaceConfig,
+    pub ai: AIConfig,
+    /// User-level static tool permission policy and interaction preferences.
+    #[serde(default)]
+    pub tool_permissions: ToolPermissionConfig,
+    #[serde(default)]
+    pub memories: MemoriesConfig,
+    /// Project-scoped overlays stored in the shared config document.
+    #[serde(default, skip_serializing_if = "ProjectConfig::is_empty")]
+    pub project: ProjectConfig,
+    /// MCP server configuration (stored uniformly; supports both JSON and structured formats).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mcp_servers: Option<serde_json::Value>,
+    /// ACP client configuration (stored as `{ "acpClients": { ... } }`).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub acp_clients: Option<serde_json::Value>,
+    /// OpenCode-compatible plugin declarations loaded by the process-wide plugin host.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub plugin: Vec<PluginDeclarationConfig>,
+    /// Web UI appearance selection. The full package contract is owned by the frontend.
+    pub appearance: AppearanceConfig,
+    /// Web UI font size preferences (`get_config` / `set_config` path `font`).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub font: Option<FontPreferenceSnapshot>,
+    /// Version of the persisted configuration schema. This is intentionally
+    /// independent from the OpenBitFun application version stored in `version`.
+    pub schema_version: u32,
+    /// Application build that most recently wrote this document. Informational
+    /// only; compatibility is determined by `schema_version`.
+    pub version: String,
+    #[serde(with = "chrono::serde::ts_milliseconds")]
+    pub last_modified: chrono::DateTime<chrono::Utc>,
+}
+
+impl GlobalConfig {
+    pub fn has_configured_plugins(&self) -> bool {
+        self.plugin
+            .iter()
+            .any(PluginDeclarationConfig::has_non_empty_spec)
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum PluginDeclarationConfig {
+    Spec(String),
+    Detailed(PluginDeclarationDetails),
+}
+
+impl PluginDeclarationConfig {
+    pub fn spec(&self) -> &str {
+        match self {
+            Self::Spec(spec) => spec,
+            Self::Detailed(details) => &details.spec,
+        }
+    }
+
+    fn has_non_empty_spec(&self) -> bool {
+        !self.spec().trim().is_empty()
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PluginDeclarationDetails {
+    pub spec: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub options: Option<serde_json::Map<String, serde_json::Value>>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub base_directory: Option<String>,
+}
+
+/// Project-scoped configuration overlay.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(default)]
+pub struct ProjectConfig {
+    /// Project-level MCP server configuration.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mcp_servers: Option<serde_json::Value>,
+}
+
+impl ProjectConfig {
+    fn is_empty(&self) -> bool {
+        self.mcp_servers.is_none()
+    }
+}
+
+/// App configuration.
+fn default_close_button_behavior() -> String {
+    "minimize_to_tray".to_string()
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct AppConfig {
+    pub language: String,
+    pub auto_update: bool,
+    pub telemetry: bool,
+    pub startup_behavior: String,
+    pub confirm_on_exit: bool,
+    pub restore_windows: bool,
+    /// Keep the local computer awake while the desktop application is running.
+    pub prevent_sleep: bool,
+    pub zoom_level: f64,
+    #[serde(default)]
+    pub logging: AppLoggingConfig,
+    pub sidebar: SidebarConfig,
+    pub right_panel: RightPanelConfig,
+    pub notifications: NotificationConfig,
+    #[serde(default)]
+    pub flow_chat: AppFlowChatConfig,
+    pub ai_experience: AIExperienceConfig,
+    /// Controller-owned end-to-end realtime voice conversation settings.
+    ///
+    /// This is deliberately a sibling of `ai_experience`: generic AI
+    /// experience mutations can be routed to a peer host, while the dedicated
+    /// realtime speech commands always resolve this value on the controller.
+    #[serde(default)]
+    pub voice_call: VoiceCallConfig,
+    /// User-defined keyboard shortcut overrides.
+    /// Stored as opaque JSON so the backend remains schema-agnostic;
+    /// the frontend owns the versioned format (StoredKeybindingsV1).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub keybindings: Option<serde_json::Value>,
+    /// Global, user-defined groups used to organize Agent tool pickers.
+    #[serde(default, skip_serializing_if = "UserToolGroupsConfig::is_empty")]
+    pub user_tool_groups: UserToolGroupsConfig,
+    /// Global, user-defined groups used to organize Skill pickers.
+    #[serde(default, skip_serializing_if = "UserSkillGroupsConfig::is_empty")]
+    pub user_skill_groups: UserSkillGroupsConfig,
+    /// What happens when the window close button is clicked on Windows / Linux.
+    /// Allowed values: "quit" | "minimize_to_tray" | "ask".
+    #[serde(default = "default_close_button_behavior")]
+    pub close_button_behavior: String,
+    /// Native agent lifecycle hooks (Codex-compatible hooks.json).
+    #[serde(default)]
+    pub hooks: AgentHooksConfig,
+    /// Defaults for opt-in managed Git worktrees.
+    #[serde(default)]
+    pub worktrees: WorktreeSettings,
+}
+
+/// Enablement gates for native agent hooks.
+///
+/// Hook declarations themselves live in `hooks.json` documents (user scope:
+/// `config/hooks.json` next to this file; project scope:
+/// `{project}/.openbitfun/config/hooks.json`), not in this settings document.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(default)]
+pub struct AgentHooksConfig {
+    /// Master switch for native agent hooks.
+    pub enabled: bool,
+    /// Whether project-scope hook files are honored. Disabled by default
+    /// because project hook files execute commands from the checked-out
+    /// repository; enable only for workspaces you trust.
+    pub project_hooks_enabled: bool,
+}
+
+impl Default for AgentHooksConfig {
+    fn default() -> Self {
+        Self {
+            enabled: true,
+            project_hooks_enabled: false,
+        }
+    }
+}
+
+/// Versioned user preference for grouping selectable Agent tools in the UI.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct UserToolGroupsConfig {
+    pub version: u32,
+    pub groups: Vec<UserToolGroup>,
+}
+
+impl UserToolGroupsConfig {
+    pub fn is_empty(&self) -> bool {
+        self.groups.is_empty()
+    }
+}
+
+impl Default for UserToolGroupsConfig {
+    fn default() -> Self {
+        Self {
+            version: 1,
+            groups: Vec::new(),
+        }
+    }
+}
+
+/// A user-defined group of canonical tool names.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct UserToolGroup {
+    pub id: String,
+    pub name: String,
+    pub tool_names: Vec<String>,
+}
+
+/// Versioned user preference for grouping selectable Skills in the UI.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct UserSkillGroupsConfig {
+    pub version: u32,
+    pub groups: Vec<UserSkillGroup>,
+}
+
+impl UserSkillGroupsConfig {
+    pub fn is_empty(&self) -> bool {
+        self.groups.is_empty()
+    }
+}
+
+impl Default for UserSkillGroupsConfig {
+    fn default() -> Self {
+        Self {
+            version: 1,
+            groups: Vec::new(),
+        }
+    }
+}
+
+/// A user-defined group of stable Skill keys.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct UserSkillGroup {
+    pub id: String,
+    pub name: String,
+    pub skill_keys: Vec<String>,
+}
+
+/// App logging configuration.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct AppLoggingConfig {
+    /// Runtime backend log level.
+    /// Allowed values: trace, debug, info, warn, error, off.
+    pub level: String,
+    /// Whether diagnostic logs may include sensitive troubleshooting payloads.
+    #[serde(default = "default_true")]
+    pub include_sensitive_diagnostics: bool,
+    /// Whether the local UI records detailed Flow Chat viewport diagnostics.
+    #[serde(default)]
+    pub flow_chat_diagnostics: bool,
+    /// Per-request AI model exchange tracing configuration for developer diagnostics.
+    #[serde(default)]
+    pub model_exchange_tracing: ModelExchangeTracingConfig,
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Default)]
+#[serde(rename_all = "snake_case")]
+pub enum ModelExchangeTracingMode {
+    #[default]
+    Off,
+    Full,
+    UsageOnly,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct ModelExchangeTracingConfig {
+    pub mode: ModelExchangeTracingMode,
+}
+
+/// FlowChat UI preferences.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct AppFlowChatConfig {
+    /// Optional user override for the default ChatInput mode id.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub default_mode_id: Option<String>,
+    /// Whether the chat input exposes the global permission-mode shortcut.
+    ///
+    /// The default is visible, but that value is omitted from persisted config
+    /// so existing config files remain unchanged until the user hides it.
+    #[serde(
+        default = "default_show_permission_mode_control",
+        skip_serializing_if = "is_permission_mode_control_visible"
+    )]
+    pub show_permission_mode_control: bool,
+}
+
+fn default_show_permission_mode_control() -> bool {
+    true
+}
+
+fn is_permission_mode_control_visible(value: &bool) -> bool {
+    *value
+}
+
+impl Default for AppFlowChatConfig {
+    fn default() -> Self {
+        Self {
+            default_mode_id: None,
+            show_permission_mode_control: default_show_permission_mode_control(),
+        }
+    }
+}
+
+/// A user-defined quick action for the FlowChat post-coding actions menu.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct AiExperienceQuickAction {
+    pub id: String,
+    pub label: String,
+    pub prompt: String,
+    pub enabled: bool,
+}
+
+/// Local voice input preferences for the chat composer.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct VoiceInputConfig {
+    pub enabled: bool,
+    pub provider: String,
+    pub model_id: String,
+    pub default_language: String,
+    pub max_recording_seconds: u32,
+    pub microphone_device_id: String,
+}
+
+impl Default for VoiceInputConfig {
+    fn default() -> Self {
+        Self {
+            enabled: true,
+            provider: "local".to_string(),
+            model_id: "sensevoice-small-int8".to_string(),
+            default_language: "auto".to_string(),
+            max_recording_seconds: 60,
+            microphone_device_id: String::new(),
+        }
+    }
+}
+
+/// Controller-local full-duplex voice-call preferences.
+///
+/// The assistant stays off until the current controller explicitly enables it.
+/// The API key crosses only the controller-local settings IPC; starting a
+/// session resolves it in the Desktop adapter, so it is never forwarded to a
+/// remote workspace or peer HostInvoke request. Session execution selected by
+/// a voice tool call can still target a remote workspace or peer through the
+/// normal Agent Runtime adapters.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct VoiceCallConfig {
+    pub enabled: bool,
+    pub provider: String,
+    pub api_key: String,
+    pub voice: String,
+    pub speed: i32,
+    pub loudness: i32,
+    pub microphone_device_id: String,
+}
+
+impl Default for VoiceCallConfig {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            provider: "volcengine".to_string(),
+            api_key: String::new(),
+            voice: "zh_female_vv_jupiter_bigtts".to_string(),
+            speed: 0,
+            loudness: 0,
+            microphone_device_id: String::new(),
+        }
+    }
+}
+
+/// Domain request for atomically saving a cloud speech-recognition model and
+/// selecting it for voice input. Text-generation fields are intentionally not
+/// part of this contract.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export))]
+#[serde(rename_all = "camelCase")]
+pub struct SaveCloudSpeechConfigRequest {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub config_id: Option<String>,
+    pub preset: String,
+    pub name: String,
+    pub base_url: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub request_url: Option<String>,
+    pub model_name: String,
+    pub api_key: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export))]
+#[serde(rename_all = "camelCase")]
+pub struct SaveCloudSpeechConfigResult {
+    pub model_id: String,
+    pub created: bool,
+}
+
+/// AI experience configuration.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct AIExperienceConfig {
+    /// Whether to enable automatic AI-generated summaries for session titles.
+    pub enable_session_title_generation: bool,
+    /// Whether to enable AI analysis of work status on the FlowChat welcome page.
+    pub enable_welcome_panel_ai_analysis: bool,
+    /// Whether to enable visual mode.
+    pub enable_visual_mode: bool,
+    /// Whether to show the desktop Agent companion.
+    pub enable_agent_companion: bool,
+    /// Optional Petdex-compatible companion package selected by the user.
+    #[serde(
+        default = "default_agent_companion_pet",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub agent_companion_pet: Option<AgentCompanionPetSelection>,
+    /// Whether to enable flashgrep-backed accelerated workspace search.
+    pub enable_workspace_search: bool,
+    /// Local speech-to-text settings for the chat composer.
+    pub voice_input: VoiceInputConfig,
+    /// User-defined quick actions (post-coding menu); persisted for the web UI.
+    #[serde(default = "default_quick_actions")]
+    pub quick_actions: Vec<AiExperienceQuickAction>,
+}
+
+fn default_quick_actions() -> Vec<AiExperienceQuickAction> {
+    [
+        ("commit", "Commit", "Commit all current code changes"),
+        (
+            "create_pr",
+            "Create PR",
+            "Create a Pull Request for the current branch",
+        ),
+    ]
+    .into_iter()
+    .map(|(id, label, prompt)| AiExperienceQuickAction {
+        id: id.to_string(),
+        label: label.to_string(),
+        prompt: prompt.to_string(),
+        enabled: true,
+    })
+    .collect()
+}
+
+/// User-selected Agent companion pet package.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct AgentCompanionPetSelection {
+    pub id: String,
+    pub display_name: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    pub source: String,
+    pub package_path: String,
+    pub spritesheet_path: String,
+    pub spritesheet_mime_type: String,
+}
+
+fn default_agent_companion_pet() -> Option<AgentCompanionPetSelection> {
+    Some(AgentCompanionPetSelection {
+        id: "blue-golden".to_string(),
+        display_name: "困困".to_string(),
+        description: Some(
+            "A sweet, round-faced blue-golden shaded cat with wide bright eyes and soft silver-blue fur warmed by creamy-gold highlights.".to_string(),
+        ),
+        source: "preset".to_string(),
+        package_path: "/agent-companion-pets/blue-golden".to_string(),
+        spritesheet_path: "/agent-companion-pets/blue-golden/spritesheet.png".to_string(),
+        spritesheet_mime_type: "image/png".to_string(),
+    })
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct SidebarConfig {
+    pub width: u32,
+    pub collapsed: bool,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct RightPanelConfig {
+    pub width: u32,
+    pub collapsed: bool,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct NotificationConfig {
+    pub enabled: bool,
+    pub position: String,
+    pub duration: u32,
+    /// Whether to show a toast notification when a dialog turn completes while the window is not focused.
+    #[serde(default = "default_true")]
+    pub dialog_completion_notify: bool,
+    /// Whether to show a toast notification when an approval request arrives while the window is not focused.
+    #[serde(default = "default_true")]
+    pub permission_request_notify: bool,
+    /// Whether to show built-in tip cards on startup (can be disabled by the user).
+    #[serde(default = "default_true")]
+    pub enable_startup_tips: bool,
+}
+
+/// Web UI appearance configuration. Rust stores only the selected package id.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct AppearanceConfig {
+    /// Selected appearance package ID or `system`.
+    pub selection: String,
+}
+
+impl Default for AppearanceConfig {
+    fn default() -> Self {
+        Self {
+            selection: "system".to_string(),
+        }
+    }
+}
+
+/// Editor configuration.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct EditorConfig {
+    pub font_size: u32,
+    pub font_family: String,
+    pub font_weight: String,
+    pub line_height: f64,
+    pub cursor_style: String,
+    pub cursor_blinking: String,
+    pub render_whitespace: String,
+    pub render_line_highlight: String,
+    pub tab_size: u32,
+    pub insert_spaces: bool,
+    pub detect_indentation: bool,
+    pub word_wrap: String,
+    pub scroll_beyond_last_line: bool,
+    pub smooth_scrolling: bool,
+    pub line_numbers: String,
+    pub minimap: MinimapConfig,
+    pub auto_save: String,
+    pub auto_save_delay: u32,
+    pub format_on_save: bool,
+    pub format_on_paste: bool,
+    pub trim_auto_whitespace: bool,
+    pub semantic_highlighting: bool,
+    pub bracket_pair_colorization: bool,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct MinimapConfig {
+    pub enabled: bool,
+    pub side: String,
+    pub size: String,
+}
+
+/// Terminal configuration.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct TerminalConfig {
+    /// Empty string means "auto-detect".
+    pub default_shell: String,
+    /// Terminal panel placement in the session layout: "right" or "bottom".
+    pub terminal_panel_position: String,
+    pub font_size: u32,
+    pub font_family: String,
+    pub cursor_blink: bool,
+    pub cursor_style: String,
+    pub scrollback: u32,
+}
+
+/// Workspace configuration.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct WorkspaceConfig {
+    pub exclude_patterns: Vec<String>,
+    pub include_patterns: Vec<String>,
+    pub watch_ignore: Vec<String>,
+    /// Maximum file size in bytes.
+    pub max_file_size: u64,
+    pub encoding: String,
+    pub line_ending: String,
+    pub trim_trailing_whitespace: bool,
+    pub insert_final_newline: bool,
+}
+
+/// Model capability type (a model can have multiple capabilities).
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Hash)]
+#[serde(rename_all = "snake_case")]
+pub enum ModelCapability {
+    /// Text chat (primary capability).
+    TextChat,
+    /// Image understanding (vision).
+    ImageUnderstanding,
+    /// Image generation.
+    ImageGeneration,
+    /// Embeddings (semantic vectors).
+    Embedding,
+    /// Search API (e.g. Perplexity).
+    Search,
+    /// Code specialized.
+    CodeSpecialized,
+    /// Function calling / tool use.
+    FunctionCalling,
+    /// Speech-to-text.
+    SpeechRecognition,
+}
+
+pub const CURRENT_CONFIG_SCHEMA_VERSION: u32 = 1;
+
+/// Model category (for UI display and filtering).
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "snake_case")]
+#[derive(Default)]
+pub enum ModelCategory {
+    /// General chat model.
+    #[default]
+    GeneralChat,
+    /// Multimodal model (text + image understanding).
+    Multimodal,
+    /// Image generation model.
+    ImageGeneration,
+    /// Embedding / vector model.
+    Embedding,
+    /// Search-enhanced model.
+    SearchEnhanced,
+    /// Code-specialized model.
+    CodeSpecialized,
+    /// Speech recognition model.
+    SpeechRecognition,
+}
+
+/// Default model configuration.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+#[derive(Default)]
+pub struct DefaultModelsConfig {
+    /// Primary model ID (for complex tasks).
+    pub primary: Option<String>,
+    /// Fast model ID (for simple tasks). When unset, selection falls back to primary.
+    pub fast: Option<String>,
+    /// Search model.
+    pub search: Option<String>,
+    /// Image understanding model.
+    pub image_understanding: Option<String>,
+    /// Image generation model.
+    pub image_generation: Option<String>,
+    /// Speech recognition model.
+    pub speech_recognition: Option<String>,
+}
+
+/// Model choice for a subagent created in the context of a parent session.
+///
+/// `Inherit` is intentionally distinct from a model ID so a user-configured
+/// model named `inherit` can never be interpreted as a control value.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+#[derive(Default)]
+pub enum SubagentModelSelection {
+    Fixed {
+        model_id: String,
+    },
+    #[default]
+    Inherit,
+}
+
+impl SubagentModelSelection {
+    pub fn fixed(model_id: impl Into<String>) -> Self {
+        Self::Fixed {
+            model_id: model_id.into(),
+        }
+    }
+
+    pub fn fixed_model_id(&self) -> Option<&str> {
+        match self {
+            Self::Fixed { model_id } => Some(model_id.as_str()),
+            Self::Inherit => None,
+        }
+    }
+}
+
+/// Model defaults for subagents created through user-visible delegation.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct SubagentModelDefaultsConfig {
+    /// Shared fallback for normal subagents without an explicit override.
+    #[serde(rename = "default", default = "default_subagent_model_selection")]
+    pub default_selection: SubagentModelSelection,
+    /// Per-builtin defaults and user overrides. Missing entries use `default`.
+    pub builtin: HashMap<String, SubagentModelSelection>,
+    /// Default choice for a child created from the parent's context.
+    pub fork: SubagentModelSelection,
+}
+
+impl Default for SubagentModelDefaultsConfig {
+    fn default() -> Self {
+        Self {
+            default_selection: default_subagent_model_selection(),
+            builtin: HashMap::from([
+                (
+                    "GeneralPurpose".to_string(),
+                    SubagentModelSelection::fixed("primary"),
+                ),
+                (
+                    "ResearchSpecialist".to_string(),
+                    SubagentModelSelection::Inherit,
+                ),
+            ]),
+            fork: SubagentModelSelection::Inherit,
+        }
+    }
+}
+
+fn default_subagent_model_selection() -> SubagentModelSelection {
+    SubagentModelSelection::fixed("fast")
+}
+
+/// Defaults used when the product creates an agent session without an explicit
+/// per-session model choice.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct AgentModelDefaultsConfig {
+    /// Shared model selector for future mode sessions.
+    pub mode: String,
+    /// User-visible delegated subagent model choices.
+    pub subagents: SubagentModelDefaultsConfig,
+}
+
+impl AgentModelDefaultsConfig {
+    pub fn builtin_subagent_selection(&self, agent_id: &str) -> SubagentModelSelection {
+        self.subagents
+            .builtin
+            .get(agent_id)
+            .cloned()
+            .unwrap_or_else(|| self.subagents.default_selection.clone())
+    }
+}
+
+impl Default for AgentModelDefaultsConfig {
+    fn default() -> Self {
+        Self {
+            mode: "primary".to_string(),
+            subagents: SubagentModelDefaultsConfig::default(),
+        }
+    }
+}
+
+/// Default review-team execution policy and membership configuration.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(default)]
+pub struct ReviewTeamConfig {
+    /// Additional reviewer subagent IDs configured by the user.
+    pub extra_subagent_ids: Vec<String>,
+    /// Default review depth used by the whole review team.
+    pub strategy_level: String,
+    /// Per-reviewer review depth overrides keyed by subagent ID.
+    pub member_strategy_overrides: HashMap<String, String>,
+    /// Optional timeout applied to reviewer Task calls. 0 disables the cap.
+    pub reviewer_timeout_seconds: u64,
+    /// Optional timeout applied to ReviewJudge Task calls. 0 disables the cap.
+    pub judge_timeout_seconds: u64,
+    /// Whether ReviewFixer may be launched by DeepReview.
+    pub auto_fix_enabled: bool,
+    /// Minimum number of target files that triggers same-role reviewer splitting.
+    /// 0 disables file splitting.
+    pub reviewer_file_split_threshold: usize,
+    /// Maximum number of same-role reviewer instances per role when file splitting is active.
+    pub max_same_role_instances: usize,
+    /// Maximum retries for a failed same-role reviewer instance.
+    pub max_retries_per_role: usize,
+    /// Maximum number of review instances that may run at the same time.
+    pub max_parallel_reviewers: usize,
+    /// Seconds to wait for provider capacity before skipping unstarted work. 0 skips immediately.
+    pub max_queue_wait_seconds: u64,
+    /// Whether unstarted review work may wait for provider capacity.
+    pub allow_provider_capacity_queue: bool,
+    /// Whether bounded automatic retry is allowed after a reviewer failure.
+    pub allow_bounded_auto_retry: bool,
+    /// Elapsed-seconds guard that blocks bounded automatic retry after this delay.
+    pub auto_retry_elapsed_guard_seconds: u64,
+}
+
+impl Default for ReviewTeamConfig {
+    fn default() -> Self {
+        Self {
+            extra_subagent_ids: Vec::new(),
+            strategy_level: "normal".to_string(),
+            member_strategy_overrides: HashMap::new(),
+            reviewer_timeout_seconds: 3600,
+            judge_timeout_seconds: 2400,
+            auto_fix_enabled: false,
+            reviewer_file_split_threshold: 20,
+            max_same_role_instances: 3,
+            max_retries_per_role: 1,
+            max_parallel_reviewers: 2,
+            max_queue_wait_seconds: 1200,
+            allow_provider_capacity_queue: true,
+            allow_bounded_auto_retry: false,
+            auto_retry_elapsed_guard_seconds: 180,
+        }
+    }
+}
+
+fn default_review_team_configs() -> HashMap<String, ReviewTeamConfig> {
+    HashMap::from([("default".to_string(), ReviewTeamConfig::default())])
+}
+
+fn default_review_team_rate_limit_status() -> serde_json::Value {
+    serde_json::Value::Object(serde_json::Map::new())
+}
+
+/// Model selection for a product-owned AI task.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum TaskModelSelection {
+    Inherit,
+    Fixed { model_id: String },
+}
+
+impl TaskModelSelection {
+    pub fn fixed_model_id(&self) -> Option<&str> {
+        match self {
+            Self::Inherit => None,
+            Self::Fixed { model_id } => Some(model_id),
+        }
+    }
+}
+
+fn default_task_model_selection() -> TaskModelSelection {
+    TaskModelSelection::Fixed {
+        model_id: "fast".to_string(),
+    }
+}
+
+fn is_default_task_model_selection(selection: &TaskModelSelection) -> bool {
+    *selection == default_task_model_selection()
+}
+
+/// Model selectors for small product-owned AI tasks.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(default)]
+pub struct TaskModelsConfig {
+    #[serde(
+        default = "default_task_model_selection",
+        skip_serializing_if = "is_default_task_model_selection"
+    )]
+    pub session_title: TaskModelSelection,
+    #[serde(
+        default = "default_task_model_selection",
+        skip_serializing_if = "is_default_task_model_selection"
+    )]
+    pub git_commit: TaskModelSelection,
+}
+
+impl Default for TaskModelsConfig {
+    fn default() -> Self {
+        Self {
+            session_title: default_task_model_selection(),
+            git_commit: default_task_model_selection(),
+        }
+    }
+}
+
+impl TaskModelsConfig {
+    fn is_default(&self) -> bool {
+        *self == Self::default()
+    }
+}
+
+/// AI configuration.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct AIConfig {
+    /// All configured models.
+    pub models: Vec<AIModelConfig>,
+
+    /// Model selectors for product-owned AI tasks.
+    #[serde(default, skip_serializing_if = "TaskModelsConfig::is_default")]
+    pub task_models: TaskModelsConfig,
+
+    /// Default model configuration.
+    #[serde(default)]
+    pub default_models: DefaultModelsConfig,
+
+    /// Default selectors for future mode and delegated-subagent sessions.
+    #[serde(default)]
+    pub agent_model_defaults: AgentModelDefaultsConfig,
+
+    /// Shared agent-profile configuration.
+    /// profile_id -> AgentProfileConfig
+    #[serde(default, deserialize_with = "deserialize_agent_profiles")]
+    pub agent_profiles: HashMap<String, AgentProfileConfig>,
+
+    /// User-level Skill availability shared by every agent profile.
+    #[serde(default)]
+    pub skill_settings: SkillSettingsConfig,
+
+    /// Review team configuration.
+    /// team_id -> ReviewTeamConfig
+    #[serde(default = "default_review_team_configs")]
+    pub review_teams: HashMap<String, ReviewTeamConfig>,
+
+    /// Runtime rate-limit snapshot for Review Team launches.
+    #[serde(default = "default_review_team_rate_limit_status")]
+    pub review_team_rate_limit_status: serde_json::Value,
+
+    /// Maximum number of subagents that may execute concurrently.
+    #[serde(default = "default_subagent_max_concurrency")]
+    pub subagent_max_concurrency: usize,
+
+    /// Maximum number of Swarm workers and reviewers that may execute concurrently.
+    #[serde(default = "default_swarm_max_concurrency")]
+    pub swarm_max_concurrency: usize,
+
+    /// Scheduling policy for multiple subagent launch calls in the same model batch.
+    #[serde(default = "default_subagent_batch_execution_policy")]
+    pub subagent_batch_execution_policy: SubagentBatchExecutionPolicy,
+
+    /// Global proxy configuration.
+    pub proxy: ProxyConfig,
+
+    /// Streaming idle timeout in seconds; `None` means wait indefinitely.
+    #[serde(default = "default_stream_idle_timeout")]
+    pub stream_idle_timeout_secs: Option<u64>,
+
+    /// Time-to-first-token timeout in seconds while opening a streaming request;
+    /// `None` means wait indefinitely.
+    #[serde(default = "default_stream_ttft_timeout")]
+    pub stream_ttft_timeout_secs: Option<u64>,
+
+    /// Tool execution timeout in seconds; `None` means wait indefinitely.
+    #[serde(default = "default_tool_execution_timeout")]
+    pub tool_execution_timeout_secs: Option<u64>,
+
+    /// Whether tools with deferred exposure load their schemas on demand.
+    #[serde(default = "default_enable_deferred_tool_loading")]
+    pub enable_deferred_tool_loading: bool,
+
+    /// Allows broad JSON repair for non-Write tool arguments only after a
+    /// provider confirms a normal tool-use completion.
+    #[serde(default = "default_true")]
+    pub allow_tool_json_repair: bool,
+
+    /// Allow Computer use (desktop automation) when the desktop host is available (all session modes).
+    #[serde(default)]
+    pub computer_use_enabled: bool,
+
+    /// Preferred browser for CDP browser control. Empty/default uses the system default browser.
+    #[serde(default)]
+    pub browser_control_preferred_browser: String,
+
+    /// Provider-neutral WebSearch runtime configuration. Credentials are
+    /// referenced by logical id and remain in the device-local encrypted vault.
+    #[serde(default)]
+    pub web_search: WebSearchConfig,
+
+    /// Reattach to an already-running browser when OpenBitFun starts. Off by
+    /// default: the browser forgets its approval when it restarts, so this can
+    /// put an approval dialog in front of the user before they asked for the
+    /// browser at all.
+    #[serde(default)]
+    pub browser_control_auto_connect_on_startup: bool,
+
+    /// Maximum number of rounds per dialog turn before soft-pausing.
+    /// Zero disables the fixed round limit.
+    #[serde(default = "default_max_rounds")]
+    pub max_rounds: usize,
+}
+
+fn default_web_search_provider() -> String {
+    "exa_mcp_free".to_string()
+}
+
+fn default_exa_search_credential_id() -> String {
+    "exa-search-api".to_string()
+}
+
+fn default_tavily_credential_id() -> String {
+    "tavily-search-api".to_string()
+}
+
+fn default_openbitfun_search_http_credential_id() -> String {
+    "openbitfun-search-http".to_string()
+}
+
+/// Non-secret WebSearch settings that are safe to persist and synchronize.
+/// Unknown fields are retained so a newer provider configuration survives an
+/// older OpenBitFun build reading and writing the document.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(default, rename_all = "camelCase")]
+pub struct WebSearchConfig {
+    #[serde(default = "default_web_search_provider")]
+    pub provider: String,
+    #[serde(default)]
+    pub providers: WebSearchProviderConfigs,
+    #[serde(flatten)]
+    pub unknown: serde_json::Map<String, serde_json::Value>,
+}
+
+impl Default for WebSearchConfig {
+    fn default() -> Self {
+        Self {
+            provider: default_web_search_provider(),
+            providers: WebSearchProviderConfigs::default(),
+            unknown: serde_json::Map::new(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(default, rename_all = "snake_case")]
+pub struct WebSearchProviderConfigs {
+    pub exa_search_api: WebSearchCredentialProviderConfig,
+    pub tavily: WebSearchCredentialProviderConfig,
+    pub openbitfun_search_http: OpenBitFunSearchHttpConfig,
+    #[serde(flatten)]
+    pub unknown: serde_json::Map<String, serde_json::Value>,
+}
+
+impl Default for WebSearchProviderConfigs {
+    fn default() -> Self {
+        Self {
+            exa_search_api: WebSearchCredentialProviderConfig {
+                credential_id: default_exa_search_credential_id(),
+                unknown: serde_json::Map::new(),
+            },
+            tavily: WebSearchCredentialProviderConfig {
+                credential_id: default_tavily_credential_id(),
+                unknown: serde_json::Map::new(),
+            },
+            openbitfun_search_http: OpenBitFunSearchHttpConfig::default(),
+            unknown: serde_json::Map::new(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(default, rename_all = "camelCase")]
+pub struct WebSearchCredentialProviderConfig {
+    pub credential_id: String,
+    #[serde(flatten)]
+    pub unknown: serde_json::Map<String, serde_json::Value>,
+}
+
+impl Default for WebSearchCredentialProviderConfig {
+    fn default() -> Self {
+        Self {
+            credential_id: String::new(),
+            unknown: serde_json::Map::new(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(default, rename_all = "camelCase")]
+pub struct OpenBitFunSearchHttpConfig {
+    pub endpoint: String,
+    pub auth: OpenBitFunSearchHttpAuthConfig,
+    #[serde(flatten)]
+    pub unknown: serde_json::Map<String, serde_json::Value>,
+}
+
+impl Default for OpenBitFunSearchHttpConfig {
+    fn default() -> Self {
+        Self {
+            endpoint: String::new(),
+            auth: OpenBitFunSearchHttpAuthConfig::default(),
+            unknown: serde_json::Map::new(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(default, rename_all = "camelCase")]
+pub struct OpenBitFunSearchHttpAuthConfig {
+    /// `none`, `bearer`, or `header`. Kept as a string so unknown future modes
+    /// round-trip and fail explicitly only when selected at runtime.
+    pub mode: String,
+    pub credential_id: String,
+    pub header_name: String,
+    #[serde(flatten)]
+    pub unknown: serde_json::Map<String, serde_json::Value>,
+}
+
+impl Default for OpenBitFunSearchHttpAuthConfig {
+    fn default() -> Self {
+        Self {
+            mode: "none".to_string(),
+            credential_id: default_openbitfun_search_http_credential_id(),
+            header_name: String::new(),
+            unknown: serde_json::Map::new(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Default)]
+#[serde(rename_all = "snake_case")]
+pub enum SubagentBatchExecutionPolicy {
+    /// Preserve the tool-owned concurrency-safety decision.
+    SafeOnly,
+    /// Force multiple Task calls from the same model batch into parallel scheduling.
+    #[default]
+    ForceParallel,
+    /// Treat all Task calls as serial even when a subagent is read-only.
+    Serial,
+}
+
+/// Automatic memory subsystem configuration.
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Default)]
+#[serde(rename_all = "snake_case")]
+pub enum MemoryExternalContextPolicy {
+    /// Keep sessions that used external context tools, but clear those tool results in Phase 1.
+    #[default]
+    ClearToolResults,
+    /// Keep sessions and tool results as-is.
+    Allow,
+    /// Mark sessions that used external context tools as polluted and skip extraction.
+    SkipSession,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(default)]
+pub struct MemoriesConfig {
+    /// Enables automatic Phase 1 extraction and Phase 2 consolidation.
+    pub generate_memories: bool,
+    /// Allows persistent BTW sessions to become memory-generation sources.
+    pub generate_for_btw_sessions: bool,
+    /// Enables prompt injection of the consolidated memory summary.
+    pub use_memories: bool,
+    /// Controls how sessions that used external context tools are handled.
+    pub external_context_policy: MemoryExternalContextPolicy,
+    /// Maximum number of stage-1 outputs selected for phase-2 consolidation.
+    pub max_raw_memories_for_consolidation: usize,
+    /// Maximum age in days for a stage-1 output to stay eligible for phase-2 reuse.
+    pub max_unused_days: i64,
+    /// Maximum age in days for a source session to be considered by Phase 1.
+    pub max_rollout_age_days: i64,
+    /// Maximum source sessions claimed for extraction per memory startup pass.
+    pub max_rollouts_per_startup: usize,
+    /// Maximum source sessions scanned while looking for extraction candidates per memory startup pass.
+    pub max_rollouts_scan_limit: usize,
+    /// Minimum idle time in hours before a source session can be extracted.
+    pub min_rollout_idle_hours: i64,
+    /// Maximum number of concurrent Phase 1 extraction jobs.
+    pub phase1_max_concurrency: usize,
+    /// Retry backoff after a failed Phase 1 extraction.
+    pub phase1_retry_backoff_minutes: i64,
+    /// Lease duration for claimed Phase 1 jobs.
+    pub phase1_lease_seconds: i64,
+    /// Lease duration for the global Phase 2 consolidation job.
+    pub phase2_lease_seconds: i64,
+    /// Phase-2 consolidation cooldown in seconds after a successful run.
+    pub phase2_success_cooldown_seconds: i64,
+    /// Phase-2 retry delay in seconds after a failed run.
+    pub phase2_retry_delay_seconds: i64,
+    /// Optional model selector for Phase 1 extraction.
+    pub extract_model: Option<String>,
+    /// Optional model selector for Phase 2 consolidation.
+    pub consolidation_model: Option<String>,
+}
+
+impl AIConfig {
+    /// Resolves a canonical configured model ID.
+    ///
+    /// Returns the model id only when the matched model is `enabled`. This is the
+    /// single source of truth for "is this model usable right now?" and is the
+    /// variant every runtime path (client factory, execution engine, etc.) should
+    /// use. UI / migration code that needs to look up disabled entries should call
+    /// [`Self::resolve_model_reference_any`] instead.
+    pub fn resolve_model_reference(&self, model_id: &str) -> Option<String> {
+        let mut matches = self.models.iter().filter(|m| m.enabled && m.id == model_id);
+        let model = matches.next()?;
+        (matches.next().is_none()).then(|| model.id.clone())
+    }
+
+    /// Resolves a canonical configured model ID regardless of `enabled` state.
+    /// UI / migration only — never use this on the runtime model-selection path.
+    pub fn resolve_model_reference_any(&self, model_id: &str) -> Option<String> {
+        let mut matches = self.models.iter().filter(|m| m.id == model_id);
+        let model = matches.next()?;
+        (matches.next().is_none()).then(|| model.id.clone())
+    }
+
+    /// Returns true if the given reference points to a model that exists and is
+    /// currently enabled.
+    pub fn is_model_reference_active(&self, model_ref: &str) -> bool {
+        self.resolve_model_reference(model_ref).is_some()
+    }
+
+    /// Returns the id of the first enabled model, if any. Used as a final
+    /// fallback when a configured default points to a disabled / missing model.
+    pub fn first_enabled_model_id(&self) -> Option<String> {
+        self.models.iter().find(|m| m.enabled).map(|m| m.id.clone())
+    }
+
+    /// Resolves a model selector value.
+    ///
+    /// Special values:
+    /// - `primary`: must resolve to a valid (enabled) primary model
+    /// - `fast`: first tries the configured fast model, then falls back to primary
+    ///
+    /// Regular values must be canonical configured model IDs. All lookups require
+    /// the target model to be enabled — disabled models are treated as if they did
+    /// not exist.
+    pub fn resolve_model_selection(&self, model_ref: &str) -> Option<String> {
+        match model_ref {
+            "primary" => self
+                .default_models
+                .primary
+                .as_deref()
+                .and_then(|value| self.resolve_model_reference(value)),
+            "fast" => self
+                .default_models
+                .fast
+                .as_deref()
+                .and_then(|value| self.resolve_model_reference(value))
+                .or_else(|| {
+                    self.default_models
+                        .primary
+                        .as_deref()
+                        .and_then(|value| self.resolve_model_reference(value))
+                }),
+            _ => self.resolve_model_reference(model_ref),
+        }
+    }
+}
+
+/// Shared agent-profile configuration.
+///
+/// Tool and skill configuration shared by compatible mode profiles.
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(default)]
+pub struct AgentProfileConfig {
+    /// Shared profile ID (e.g. agentic, coding_shared, requirement, ui-design).
+    pub profile_id: String,
+
+    /// Tools explicitly enabled by the user that are not part of the mode defaults.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub added_tools: Vec<String>,
+
+    /// Default tools explicitly disabled by the user.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub removed_tools: Vec<String>,
+
+    /// User-level skills disabled for this mode.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub disabled_user_skills: Vec<String>,
+
+    /// User-level built-in skills explicitly enabled even though the mode default disables them.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub enabled_user_skills: Vec<String>,
+
+    /// User-level subagent availability overrides for this shared profile.
+    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
+    pub subagent_overrides: ParentSubagentOverrideConfig,
+
+    /// Agent-level permission rules applied after project rules.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub tool_permission_rules: Vec<PermissionRule>,
+}
+
+/// User-level Skill configuration shared by every agent profile.
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(default)]
+pub struct SkillSettingsConfig {
+    /// User-level Skill keys disabled for every agent profile.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub globally_disabled_user_skills: Vec<String>,
+}
+
+/// API view of a mode configuration.
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export))]
+#[serde(default)]
+pub struct AgentProfileView {
+    pub profile_id: String,
+    pub enabled_tools: Vec<String>,
+    pub default_tools: Vec<String>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub disabled_user_skills: Vec<String>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub enabled_user_skills: Vec<String>,
+}
+
+fn default_true() -> bool {
+    true
+}
+
+/// Default streaming idle timeout between chunks.
+fn default_stream_idle_timeout() -> Option<u64> {
+    Some(600)
+}
+
+/// Default timeout while waiting for the first effective streamed output.
+fn default_stream_ttft_timeout() -> Option<u64> {
+    Some(600)
+}
+
+/// Default is no timeout (wait forever).
+fn default_tool_execution_timeout() -> Option<u64> {
+    None
+}
+
+fn default_enable_deferred_tool_loading() -> bool {
+    true
+}
+
+fn default_subagent_max_concurrency() -> usize {
+    5
+}
+
+fn default_swarm_max_concurrency() -> usize {
+    16
+}
+
+fn default_memory_max_raw_memories_for_consolidation() -> usize {
+    64
+}
+
+fn default_memory_max_unused_days() -> i64 {
+    30
+}
+
+fn default_memory_max_rollout_age_days() -> i64 {
+    10
+}
+
+fn default_memory_max_rollouts_per_startup() -> usize {
+    2
+}
+
+fn default_memory_max_rollouts_scan_limit() -> usize {
+    2_000
+}
+
+fn default_memory_min_rollout_idle_hours() -> i64 {
+    6
+}
+
+fn default_memory_phase1_max_concurrency() -> usize {
+    1
+}
+
+fn default_memory_phase1_retry_backoff_minutes() -> i64 {
+    60
+}
+
+fn default_memory_phase1_lease_seconds() -> i64 {
+    60 * 60
+}
+
+fn default_memory_phase2_lease_seconds() -> i64 {
+    60 * 60
+}
+
+fn default_memory_phase2_success_cooldown_seconds() -> i64 {
+    6 * 60 * 60
+}
+
+fn default_memory_phase2_retry_delay_seconds() -> i64 {
+    60 * 60
+}
+
+fn default_subagent_batch_execution_policy() -> SubagentBatchExecutionPolicy {
+    SubagentBatchExecutionPolicy::ForceParallel
+}
+
+pub const DEFAULT_MAX_ROUNDS: usize = 0;
+
+fn default_max_rounds() -> usize {
+    DEFAULT_MAX_ROUNDS
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum AgentSubagentOverrideState {
+    Enabled,
+    Disabled,
+}
+
+pub type ParentSubagentOverrideConfig = HashMap<String, AgentSubagentOverrideState>;
+pub type AgentSubagentOverrideConfig = HashMap<String, ParentSubagentOverrideConfig>;
+
+pub const DEFAULT_MODEL_CONTEXT_WINDOW_TOKENS: u32 = 128_128;
+pub const MIN_MODEL_CONTEXT_WINDOW_TOKENS: u32 = 32_000;
+pub const MAX_CONFIGURED_OUTPUT_TOKENS_RATIO_PERCENT: u32 = 40;
+const AUTOMATIC_MAX_OUTPUT_TOKEN_TIERS: [u32; 5] = [8_000, 16_000, 24_000, 32_000, 64_000];
+
+/// Chooses the largest supported output tier that does not exceed one quarter
+/// of the model context window.
+pub fn automatic_max_output_tokens(context_window: u32) -> u32 {
+    let quarter_context = context_window / 4;
+    AUTOMATIC_MAX_OUTPUT_TOKEN_TIERS
+        .iter()
+        .rev()
+        .copied()
+        .find(|tier| *tier <= quarter_context)
+        .unwrap_or(quarter_context)
+}
+
+/// A configured output cap may use up to 40% of the model context window.
+pub fn is_valid_configured_max_output_tokens(context_window: u32, max_tokens: u32) -> bool {
+    max_tokens > 0
+        && u64::from(max_tokens) * 100
+            <= u64::from(context_window) * u64::from(MAX_CONFIGURED_OUTPUT_TOKENS_RATIO_PERCENT)
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct AIModelConfig {
+    pub id: String,
+    pub name: String,
+    pub provider: String,
+    pub model_name: String,
+    pub base_url: String,
+
+    /// Computed actual request URL (auto-derived from base_url + provider format).
+    /// Stored by the frontend when config is saved; falls back to base_url if absent.
+    #[serde(default)]
+    pub request_url: Option<String>,
+
+    pub api_key: String,
+    /// Context window size (total token limit for input + output).
+    pub context_window: Option<u32>,
+    /// Optional advanced override for the request output limit. When absent,
+    /// OpenBitFun derives a tiered limit from the context window at runtime.
+    pub max_tokens: Option<u32>,
+    pub temperature: Option<f64>,
+    pub top_p: Option<f64>,
+    pub enabled: bool,
+    /// Model category (primary category used for UI filtering).
+    pub category: ModelCategory,
+    /// Capability tags (multi-select).
+    pub capabilities: Vec<ModelCapability>,
+    /// Recommended use cases.
+    #[serde(default)]
+    pub recommended_for: Vec<String>,
+    /// Additional metadata (JSON, for extensibility).
+    pub metadata: Option<serde_json::Value>,
+
+    /// Canonical model reasoning presets and default selection.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub reasoning: Option<ReasoningConfig>,
+
+    /// Whether to parse OpenAI-compatible text chunks containing `<think>...</think>` into
+    /// streaming reasoning content.
+    #[serde(default = "default_true")]
+    pub inline_think_in_text: bool,
+
+    /// Custom HTTP request headers.
+    #[serde(default)]
+    pub custom_headers: Option<std::collections::HashMap<String, String>>,
+
+    /// Custom header mode: "replace" (default, full replacement) or "merge" (merge; apply
+    /// defaults first, then custom).
+    #[serde(default)]
+    pub custom_headers_mode: Option<String>,
+
+    /// Whether to skip SSL certificate verification (advanced; use only when necessary).
+    #[serde(default)]
+    pub skip_ssl_verify: bool,
+
+    /// Custom request body (JSON string, used to override default request body fields).
+    #[serde(default)]
+    pub custom_request_body: Option<String>,
+
+    /// Custom request body mode: "merge" (default) or "trim" (keep only essential runtime
+    /// fields, then apply custom JSON).
+    #[serde(default)]
+    pub custom_request_body_mode: Option<String>,
+
+    /// Authentication source for this model. Defaults to a static API key;
+    /// selecting a CLI source causes the AI client
+    /// factory to look up `~/.codex/auth.json` or `~/.gemini/...` at request
+    /// time and inject the resolved Bearer token / extra headers.
+    #[serde(default)]
+    pub auth: AuthConfig,
+}
+
+/// Stable identity of the runtime-affecting parts of a concrete model config.
+///
+/// Credentials are deliberately excluded: rotating a secret must not require
+/// the user to approve the same provider/model again. Endpoint, provider,
+/// model, request options, and authentication source remain part of the
+/// identity so an approved binding cannot silently drift to different runtime
+/// behavior while retaining the same config id.
+pub fn model_runtime_binding_fingerprint(model: &AIModelConfig) -> String {
+    let mut value = serde_json::to_value(model).unwrap_or(serde_json::Value::Null);
+    if let serde_json::Value::Object(fields) = &mut value {
+        fields.remove("api_key");
+    }
+
+    fn canonicalize(value: serde_json::Value) -> serde_json::Value {
+        match value {
+            serde_json::Value::Object(fields) => {
+                let mut entries = fields.into_iter().collect::<Vec<_>>();
+                entries.sort_by(|left, right| left.0.cmp(&right.0));
+                serde_json::Value::Object(
+                    entries
+                        .into_iter()
+                        .map(|(key, value)| (key, canonicalize(value)))
+                        .collect(),
+                )
+            }
+            serde_json::Value::Array(values) => {
+                serde_json::Value::Array(values.into_iter().map(canonicalize).collect())
+            }
+            value => value,
+        }
+    }
+
+    let canonical = serde_json::to_vec(&canonicalize(value)).unwrap_or_default();
+    let mut hasher = Sha256::new();
+    hasher.update(canonical);
+    hex::encode(hasher.finalize())
+}
+
+/// Subscription provider whose in-app OAuth tokens authenticate a model.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum SubscriptionProvider {
+    Codex,
+    Antigravity,
+    Opencode,
+    Grok,
+    Hermes,
+}
+
+/// OpenCode API product selected for a subscription-authenticated model.
+/// Zen and Go share one account credential but use different API namespaces.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum OpenCodePlan {
+    Zen,
+    Go,
+}
+
+/// Where to obtain the runtime auth material for an `AIModelConfig`.
+///
+/// Stored on disk as `{"type":"api_key"}` or
+/// `{"type":"subscription","provider":"codex"|"antigravity"|"opencode"|"grok"|"hermes"}`.
+/// OpenCode models may additionally persist `"plan":"zen"|"go"`; an absent
+/// plan selects the default Zen Chat Completions behavior.
+/// Tokens live in the subscription auth store and are resolved at request time.
+#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum AuthConfig {
+    /// Use the inline `api_key` string (default).
+    #[default]
+    ApiKey,
+    /// Use OpenBitFun in-app subscription OAuth for the named provider.
+    Subscription {
+        provider: SubscriptionProvider,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        plan: Option<OpenCodePlan>,
+    },
+}
+
+pub use openbitfun_core_types::ProxyConfig;
+
+/// Configuration change event.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ConfigChangeEvent {
+    pub path: String,
+    pub old_value: serde_json::Value,
+    pub new_value: serde_json::Value,
+    pub timestamp: chrono::DateTime<chrono::Utc>,
+    /// Event source: "user" | "system" | "migration".
+    pub source: String,
+}
+
+/// Configuration validation result.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ConfigValidationResult {
+    pub valid: bool,
+    pub errors: Vec<ConfigValidationError>,
+    pub warnings: Vec<ConfigValidationWarning>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub diagnostics: Vec<ConfigDiagnostic>,
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum ConfigDiagnosticSeverity {
+    Error,
+    Warning,
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum ConfigDiagnosticRecoverability {
+    None,
+    AutoFix,
+    ModelDisabled,
+    DefaultsUsed,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ConfigDiagnostic {
+    pub path: String,
+    pub message: String,
+    pub code: String,
+    pub severity: ConfigDiagnosticSeverity,
+    pub recoverability: ConfigDiagnosticRecoverability,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ConfigValidationError {
+    pub path: String,
+    pub message: String,
+    pub code: String,
+    pub severity: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ConfigValidationWarning {
+    pub path: String,
+    pub message: String,
+    pub code: String,
+    pub severity: String,
+}
+
+impl Default for GlobalConfig {
+    fn default() -> Self {
+        Self {
+            product_id: product_identity::product_id().to_string(),
+            app: AppConfig::default(),
+            editor: EditorConfig::default(),
+            terminal: TerminalConfig::default(),
+            workspace: WorkspaceConfig::default(),
+            ai: AIConfig::default(),
+            memories: MemoriesConfig::default(),
+            project: ProjectConfig::default(),
+            tool_permissions: ToolPermissionConfig::default(),
+            mcp_servers: None,
+            acp_clients: None,
+            plugin: Vec::new(),
+            appearance: AppearanceConfig::default(),
+            font: None,
+            schema_version: CURRENT_CONFIG_SCHEMA_VERSION,
+            version: env!("CARGO_PKG_VERSION").to_string(),
+            last_modified: chrono::Utc::now(),
+        }
+    }
+}
+
+impl Default for AppConfig {
+    fn default() -> Self {
+        Self {
+            language: "zh-CN".to_string(),
+            auto_update: true,
+            telemetry: false,
+            startup_behavior: "lastWorkspace".to_string(),
+            confirm_on_exit: true,
+            restore_windows: true,
+            prevent_sleep: false,
+            zoom_level: 1.0,
+            logging: AppLoggingConfig::default(),
+            sidebar: SidebarConfig {
+                width: 300,
+                collapsed: false,
+            },
+            right_panel: RightPanelConfig {
+                width: 400,
+                collapsed: true,
+            },
+            notifications: NotificationConfig {
+                enabled: true,
+                position: "topRight".to_string(),
+                duration: 5000,
+                dialog_completion_notify: true,
+                permission_request_notify: true,
+                enable_startup_tips: true,
+            },
+            flow_chat: AppFlowChatConfig::default(),
+            ai_experience: AIExperienceConfig::default(),
+            voice_call: VoiceCallConfig::default(),
+            keybindings: None,
+            user_tool_groups: UserToolGroupsConfig::default(),
+            user_skill_groups: UserSkillGroupsConfig::default(),
+            close_button_behavior: default_close_button_behavior(),
+            hooks: AgentHooksConfig::default(),
+            worktrees: WorktreeSettings::default(),
+        }
+    }
+}
+
+impl Default for AppLoggingConfig {
+    fn default() -> Self {
+        Self {
+            // Set to Debug in early development for easier diagnostics
+            level: "debug".to_string(),
+            include_sensitive_diagnostics: true,
+            flow_chat_diagnostics: false,
+            model_exchange_tracing: ModelExchangeTracingConfig::default(),
+        }
+    }
+}
+
+impl Default for ModelExchangeTracingConfig {
+    fn default() -> Self {
+        Self {
+            mode: ModelExchangeTracingMode::Off,
+        }
+    }
+}
+
+impl Default for AIExperienceConfig {
+    fn default() -> Self {
+        Self {
+            enable_session_title_generation: true,
+            enable_welcome_panel_ai_analysis: false,
+            enable_visual_mode: false,
+            enable_agent_companion: true,
+            agent_companion_pet: default_agent_companion_pet(),
+            enable_workspace_search: false,
+            voice_input: VoiceInputConfig::default(),
+            quick_actions: default_quick_actions(),
+        }
+    }
+}
+
+impl Default for EditorConfig {
+    fn default() -> Self {
+        Self {
+            font_size: 14,
+            font_family: "Consolas, \"Courier New\", monospace".to_string(),
+            font_weight: "normal".to_string(),
+            line_height: 1.5,
+            cursor_style: "line".to_string(),
+            cursor_blinking: "smooth".to_string(),
+            render_whitespace: "selection".to_string(),
+            render_line_highlight: "line".to_string(),
+            tab_size: 4,
+            insert_spaces: true,
+            detect_indentation: true,
+            word_wrap: "off".to_string(),
+            scroll_beyond_last_line: false,
+            smooth_scrolling: true,
+            line_numbers: "on".to_string(),
+            minimap: MinimapConfig {
+                enabled: true,
+                side: "right".to_string(),
+                size: "proportional".to_string(),
+            },
+            auto_save: "afterDelay".to_string(),
+            auto_save_delay: 1000,
+            format_on_save: true,
+            format_on_paste: true,
+            trim_auto_whitespace: true,
+            semantic_highlighting: true,
+            bracket_pair_colorization: true,
+        }
+    }
+}
+
+impl Default for TerminalConfig {
+    fn default() -> Self {
+        Self {
+            default_shell: String::new(),
+            terminal_panel_position: "right".to_string(),
+            font_size: 14,
+            font_family: "Consolas, \"Courier New\", monospace".to_string(),
+            cursor_blink: true,
+            cursor_style: "block".to_string(),
+            scrollback: 1000,
+        }
+    }
+}
+
+impl Default for WorkspaceConfig {
+    fn default() -> Self {
+        Self {
+            exclude_patterns: vec![
+                "**/node_modules/**".to_string(),
+                "**/target/**".to_string(),
+                "**/.git/**".to_string(),
+                "**/dist/**".to_string(),
+                "**/build/**".to_string(),
+            ],
+            include_patterns: vec!["**/*".to_string()],
+            watch_ignore: vec![
+                "**/node_modules/**".to_string(),
+                "**/target/**".to_string(),
+                "**/.git/**".to_string(),
+            ],
+            max_file_size: 50 * 1024 * 1024,
+            encoding: "utf8".to_string(),
+            line_ending: "auto".to_string(),
+            trim_trailing_whitespace: true,
+            insert_final_newline: true,
+        }
+    }
+}
+
+impl Default for AIConfig {
+    fn default() -> Self {
+        Self {
+            models: vec![],
+            task_models: TaskModelsConfig::default(),
+            default_models: DefaultModelsConfig::default(),
+            agent_model_defaults: AgentModelDefaultsConfig::default(),
+            agent_profiles: std::collections::HashMap::new(),
+            skill_settings: SkillSettingsConfig::default(),
+            review_teams: default_review_team_configs(),
+            review_team_rate_limit_status: default_review_team_rate_limit_status(),
+            subagent_max_concurrency: default_subagent_max_concurrency(),
+            swarm_max_concurrency: default_swarm_max_concurrency(),
+            subagent_batch_execution_policy: default_subagent_batch_execution_policy(),
+            proxy: ProxyConfig::default(),
+            stream_idle_timeout_secs: default_stream_idle_timeout(),
+            stream_ttft_timeout_secs: default_stream_ttft_timeout(),
+            tool_execution_timeout_secs: default_tool_execution_timeout(),
+            enable_deferred_tool_loading: default_enable_deferred_tool_loading(),
+            allow_tool_json_repair: true,
+            computer_use_enabled: false,
+            browser_control_preferred_browser: String::new(),
+            web_search: WebSearchConfig::default(),
+            browser_control_auto_connect_on_startup: false,
+            max_rounds: default_max_rounds(),
+        }
+    }
+}
+
+impl Default for MemoriesConfig {
+    fn default() -> Self {
+        Self {
+            generate_memories: false,
+            generate_for_btw_sessions: false,
+            use_memories: false,
+            external_context_policy: MemoryExternalContextPolicy::ClearToolResults,
+            max_raw_memories_for_consolidation: default_memory_max_raw_memories_for_consolidation(),
+            max_unused_days: default_memory_max_unused_days(),
+            max_rollout_age_days: default_memory_max_rollout_age_days(),
+            max_rollouts_per_startup: default_memory_max_rollouts_per_startup(),
+            max_rollouts_scan_limit: default_memory_max_rollouts_scan_limit(),
+            min_rollout_idle_hours: default_memory_min_rollout_idle_hours(),
+            phase1_max_concurrency: default_memory_phase1_max_concurrency(),
+            phase1_retry_backoff_minutes: default_memory_phase1_retry_backoff_minutes(),
+            phase1_lease_seconds: default_memory_phase1_lease_seconds(),
+            phase2_lease_seconds: default_memory_phase2_lease_seconds(),
+            phase2_success_cooldown_seconds: default_memory_phase2_success_cooldown_seconds(),
+            phase2_retry_delay_seconds: default_memory_phase2_retry_delay_seconds(),
+            extract_model: None,
+            consolidation_model: None,
+        }
+    }
+}
+
+impl Default for AIModelConfig {
+    fn default() -> Self {
+        Self {
+            id: String::new(),
+            name: String::new(),
+            provider: String::new(),
+            model_name: String::new(),
+            base_url: String::new(),
+            request_url: None,
+            api_key: String::new(),
+            context_window: None,
+            max_tokens: None,
+            temperature: None,
+            top_p: None,
+            enabled: false,
+            category: ModelCategory::GeneralChat,
+            capabilities: vec![],
+            recommended_for: vec![],
+            metadata: None,
+            reasoning: None,
+            inline_think_in_text: true,
+            custom_headers: None,
+            custom_headers_mode: None,
+            skip_ssl_verify: false,
+            custom_request_body: None,
+            custom_request_body_mode: None,
+            auth: AuthConfig::ApiKey,
+        }
+    }
+}
+
+impl Default for SidebarConfig {
+    fn default() -> Self {
+        Self {
+            width: 300,
+            collapsed: false,
+        }
+    }
+}
+
+impl Default for RightPanelConfig {
+    fn default() -> Self {
+        Self {
+            width: 400,
+            collapsed: true,
+        }
+    }
+}
+
+impl Default for NotificationConfig {
+    fn default() -> Self {
+        Self {
+            enabled: true,
+            position: "topRight".to_string(),
+            duration: 5000,
+            dialog_completion_notify: true,
+            permission_request_notify: true,
+            enable_startup_tips: true,
+        }
+    }
+}
+
+impl Default for MinimapConfig {
+    fn default() -> Self {
+        Self {
+            enabled: true,
+            side: "right".to_string(),
+            size: "proportional".to_string(),
+        }
+    }
+}
+
+impl AIModelConfig {
+    pub fn supports_capability(&self, capability: ModelCapability) -> bool {
+        if self.capabilities.is_empty() {
+            self.default_capabilities_for_category()
+                .contains(&capability)
+        } else {
+            self.capabilities.contains(&capability)
+        }
+    }
+
+    pub fn supports_text_generation(&self) -> bool {
+        self.supports_capability(ModelCapability::TextChat)
+    }
+
+    /// Canonicalizes fields that only have meaning for text-generation
+    /// requests. Returns the names of fields that were cleared.
+    pub fn normalize_inapplicable_generation_fields(&mut self) -> Vec<&'static str> {
+        if self.supports_text_generation() {
+            return Vec::new();
+        }
+
+        let mut cleared = Vec::new();
+        if self.context_window.take().is_some() {
+            cleared.push("context_window");
+        }
+        if self.max_tokens.take().is_some() {
+            cleared.push("max_tokens");
+        }
+        if self.temperature.take().is_some() {
+            cleared.push("temperature");
+        }
+        if self.top_p.take().is_some() {
+            cleared.push("top_p");
+        }
+        cleared
+    }
+
+    pub fn supports_image_understanding(&self) -> bool {
+        self.supports_capability(ModelCapability::ImageUnderstanding)
+    }
+
+    fn default_capabilities_for_category(&self) -> Vec<ModelCapability> {
+        match self.category {
+            ModelCategory::GeneralChat => vec![ModelCapability::TextChat],
+            ModelCategory::Multimodal => {
+                vec![
+                    ModelCapability::TextChat,
+                    ModelCapability::ImageUnderstanding,
+                ]
+            }
+            ModelCategory::ImageGeneration => vec![ModelCapability::ImageGeneration],
+            ModelCategory::Embedding => vec![ModelCapability::Embedding],
+            ModelCategory::SearchEnhanced => {
+                vec![ModelCapability::TextChat, ModelCapability::Search]
+            }
+            ModelCategory::CodeSpecialized => {
+                vec![ModelCapability::TextChat, ModelCapability::CodeSpecialized]
+            }
+            ModelCategory::SpeechRecognition => vec![ModelCapability::SpeechRecognition],
+        }
+    }
+
+    /// Auto-completes missing capability information without rewriting explicit configuration.
+    ///
+    /// Important: we intentionally do not upgrade `category` or append inferred capabilities
+    /// based on the model name here. Runtime behavior should follow explicit configuration.
+    pub fn ensure_category_and_capabilities(&mut self) {
+        if self.capabilities.is_empty() {
+            self.capabilities = self.default_capabilities_for_category();
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{
+        AIConfig, AIExperienceConfig, AIModelConfig, AgentModelDefaultsConfig, AgentProfileConfig,
+        AgentProfileView, AppConfig, AppLoggingConfig, AuthConfig, EditorConfig, GlobalConfig,
+        MemoryExternalContextPolicy, ModelExchangeTracingMode, NotificationConfig, OpenCodePlan,
+        SubagentBatchExecutionPolicy, SubagentModelSelection, SubscriptionProvider,
+        UserSkillGroupsConfig, UserToolGroupsConfig, WebSearchConfig,
+    };
+    use openbitfun_product_domains::tool_permissions::ToolPermissionConfig;
+
+    fn current_global_config_with(overrides: serde_json::Value) -> serde_json::Value {
+        let mut value =
+            serde_json::to_value(GlobalConfig::default()).expect("default config should serialize");
+        let root = value
+            .as_object_mut()
+            .expect("default config should serialize as an object");
+        for (key, value) in overrides
+            .as_object()
+            .expect("config fixture overrides must be an object")
+        {
+            root.insert(key.clone(), value.clone());
+        }
+        value
+    }
+
+    #[test]
+    fn legacy_app_config_defaults_realtime_voice_call() {
+        let config: AppConfig = serde_json::from_value(serde_json::json!({}))
+            .expect("legacy app config should deserialize");
+
+        assert!(!config.voice_call.enabled);
+        assert_eq!(config.voice_call.provider, "volcengine");
+        assert!(config.voice_call.api_key.is_empty());
+        assert_eq!(config.voice_call.voice, "zh_female_vv_jupiter_bigtts");
+    }
+
+    #[test]
+    fn persisted_realtime_voice_call_enabled_survives_default_change() {
+        let config: AppConfig = serde_json::from_value(serde_json::json!({
+            "voice_call": {
+                "enabled": true,
+                "api_key": "legacy-controller-key"
+            }
+        }))
+        .expect("saved realtime voice config should deserialize");
+
+        assert!(config.voice_call.enabled);
+        assert_eq!(config.voice_call.api_key, "legacy-controller-key");
+        assert_eq!(config.voice_call.provider, "volcengine");
+        assert_eq!(config.voice_call.voice, "zh_female_vv_jupiter_bigtts");
+    }
+
+    #[test]
+    fn prevent_sleep_defaults_to_disabled() {
+        assert!(!AppConfig::default().prevent_sleep);
+
+        let config: AppConfig =
+            serde_json::from_value(serde_json::json!({})).expect("empty app config should default");
+        assert!(!config.prevent_sleep);
+    }
+
+    #[test]
+    fn current_config_rejects_retired_flow_chat_font_data() {
+        let value = current_global_config_with(serde_json::json!({
+            "font": {
+                "uiSize": {
+                    "level": "large"
+                },
+                "flowChat": {
+                    "mode": "independent",
+                    "basePx": 20
+                }
+            }
+        }));
+        let error = super::validate_current_config_value(&value, "Configuration fixture")
+            .expect_err("retired FlowChat font data must not enter the current runtime");
+        assert!(error.to_string().contains("font.flowChat"));
+    }
+
+    #[test]
+    fn subscription_auth_preserves_legacy_opencode_and_roundtrips_go_plan() {
+        let legacy: AuthConfig = serde_json::from_value(serde_json::json!({
+            "type": "subscription",
+            "provider": "opencode"
+        }))
+        .expect("legacy OpenCode auth should deserialize");
+        assert_eq!(
+            legacy,
+            AuthConfig::Subscription {
+                provider: SubscriptionProvider::Opencode,
+                plan: None,
+            }
+        );
+        assert_eq!(
+            serde_json::to_value(&legacy).expect("legacy auth should serialize"),
+            serde_json::json!({
+                "type": "subscription",
+                "provider": "opencode"
+            })
+        );
+
+        let go = AuthConfig::Subscription {
+            provider: SubscriptionProvider::Opencode,
+            plan: Some(OpenCodePlan::Go),
+        };
+        let serialized = serde_json::to_value(&go).expect("Go auth should serialize");
+        assert_eq!(serialized["plan"], "go");
+        assert_eq!(
+            serde_json::from_value::<AuthConfig>(serialized).expect("Go auth should roundtrip"),
+            go
+        );
+    }
+
+    #[test]
+    fn grok_subscription_auth_roundtrips_without_opencode_plan() {
+        let grok = AuthConfig::Subscription {
+            provider: SubscriptionProvider::Grok,
+            plan: None,
+        };
+        let serialized = serde_json::to_value(&grok).expect("Grok auth should serialize");
+        assert_eq!(
+            serialized,
+            serde_json::json!({
+                "type": "subscription",
+                "provider": "grok"
+            })
+        );
+        assert_eq!(
+            serde_json::from_value::<AuthConfig>(serialized).expect("Grok auth should deserialize"),
+            grok
+        );
+    }
+
+    #[test]
+    fn hermes_subscription_auth_roundtrips_without_opencode_plan() {
+        let hermes = AuthConfig::Subscription {
+            provider: SubscriptionProvider::Hermes,
+            plan: None,
+        };
+        let serialized = serde_json::to_value(&hermes).expect("Hermes auth should serialize");
+        assert_eq!(
+            serialized,
+            serde_json::json!({
+                "type": "subscription",
+                "provider": "hermes"
+            })
+        );
+        assert_eq!(
+            serde_json::from_value::<AuthConfig>(serialized)
+                .expect("Hermes auth should deserialize"),
+            hermes
+        );
+    }
+
+    #[test]
+    fn plugin_config_defaults_to_empty_when_missing() {
+        let config: GlobalConfig =
+            serde_json::from_value(current_global_config_with(serde_json::json!({})))
+                .expect("current global config should apply optional plugin defaults");
+
+        assert!(config.plugin.is_empty());
+        assert!(!config.has_configured_plugins());
+    }
+
+    #[test]
+    fn non_empty_plugin_config_requests_runtime_startup() {
+        let config: GlobalConfig =
+            serde_json::from_value(current_global_config_with(serde_json::json!({
+                "plugin": [
+                    "file:///C:/plugins/demo.mjs",
+                    {
+                        "spec": "@my-org/custom-plugin",
+                        "options": { "mode": "strict" },
+                        "baseDirectory": "C:/workspace"
+                    }
+                ]
+            })))
+            .expect("plugin config should deserialize");
+
+        assert_eq!(config.plugin.len(), 2);
+        assert!(config.has_configured_plugins());
+    }
+
+    #[test]
+    fn empty_plugin_specs_do_not_request_runtime_startup() {
+        let config: GlobalConfig =
+            serde_json::from_value(current_global_config_with(serde_json::json!({
+                "plugin": ["", "   ", { "spec": "" }]
+            })))
+            .expect("empty plugin declarations should deserialize");
+
+        assert!(!config.has_configured_plugins());
+    }
+
+    #[test]
+    fn permission_request_notifications_default_to_enabled() {
+        assert!(NotificationConfig::default().permission_request_notify);
+
+        let config: NotificationConfig = serde_json::from_value(serde_json::json!({}))
+            .expect("empty notification config should default");
+        assert!(config.permission_request_notify);
+    }
+
+    #[test]
+    fn agent_profile_defaults_keep_all_collections_empty() {
+        let config = AgentProfileConfig::default();
+        assert!(config.profile_id.is_empty());
+        assert!(config.added_tools.is_empty());
+        assert!(config.removed_tools.is_empty());
+        assert!(config.disabled_user_skills.is_empty());
+        assert!(config.enabled_user_skills.is_empty());
+        assert!(config.subagent_overrides.is_empty());
+        assert!(config.tool_permission_rules.is_empty());
+
+        let view = AgentProfileView::default();
+        assert!(view.profile_id.is_empty());
+        assert!(view.enabled_tools.is_empty());
+        assert!(view.default_tools.is_empty());
+        assert!(view.disabled_user_skills.is_empty());
+        assert!(view.enabled_user_skills.is_empty());
+    }
+
+    #[test]
+    fn legacy_agent_profile_defaults_permission_rules_and_omits_empty_field() {
+        let config: AgentProfileConfig = serde_json::from_value(serde_json::json!({
+            "profile_id": "coding_shared",
+            "added_tools": ["read"]
+        }))
+        .expect("legacy agent profile should deserialize");
+
+        assert!(config.tool_permission_rules.is_empty());
+        let serialized = serde_json::to_value(config).expect("agent profile should serialize");
+        assert!(serialized.get("tool_permission_rules").is_none());
+    }
+
+    #[test]
+    fn current_global_config_defaults_optional_permission_settings() {
+        let mut current = current_global_config_with(serde_json::json!({}));
+        current
+            .as_object_mut()
+            .expect("current config object")
+            .remove("tool_permissions");
+        let config: GlobalConfig = serde_json::from_value(current)
+            .expect("missing optional permission settings should use current defaults");
+
+        assert_eq!(config.tool_permissions, ToolPermissionConfig::default());
+    }
+
+    #[test]
+    fn missing_max_rounds_defaults_to_unlimited_and_explicit_limits_survive() {
+        let mut default_value = current_global_config_with(serde_json::json!({}));
+        default_value["ai"]
+            .as_object_mut()
+            .expect("current AI config")
+            .remove("max_rounds");
+        let defaulted: GlobalConfig = serde_json::from_value(default_value)
+            .expect("current AI config should default an omitted optional limit");
+        assert_eq!(defaulted.ai.max_rounds, 0);
+
+        let limited: GlobalConfig =
+            serde_json::from_value(current_global_config_with(serde_json::json!({
+                "ai": { "max_rounds": 37 }
+            })))
+            .expect("explicit max rounds should deserialize");
+        assert_eq!(limited.ai.max_rounds, 37);
+    }
+
+    #[test]
+    fn user_tool_groups_default_to_version_one_without_persisted_groups() {
+        let mut value = current_global_config_with(serde_json::json!({}));
+        value["app"]
+            .as_object_mut()
+            .expect("current app config")
+            .remove("user_tool_groups");
+        let config: GlobalConfig = serde_json::from_value(value)
+            .expect("current app config should default omitted tool groups");
+        assert_eq!(config.app.user_tool_groups, UserToolGroupsConfig::default());
+
+        let serialized = serde_json::to_value(&config).expect("config should serialize");
+        assert!(serialized["app"].get("user_tool_groups").is_none());
+    }
+
+    #[test]
+    fn user_tool_groups_preserve_the_versioned_ui_shape() {
+        let config: GlobalConfig =
+            serde_json::from_value(current_global_config_with(serde_json::json!({
+                "app": {
+                    "user_tool_groups": {
+                        "version": 1,
+                        "groups": [{
+                            "id": "daily-code",
+                            "name": "Daily code changes",
+                            "toolNames": ["Read", "Edit"]
+                        }]
+                    }
+                }
+            })))
+            .expect("user tool groups should deserialize");
+
+        assert_eq!(
+            config.app.user_tool_groups.groups[0].tool_names,
+            vec!["Read".to_string(), "Edit".to_string()]
+        );
+
+        let serialized = serde_json::to_value(&config).expect("config should serialize");
+        assert_eq!(
+            serialized["app"]["user_tool_groups"]["groups"][0]["toolNames"],
+            serde_json::json!(["Read", "Edit"])
+        );
+    }
+
+    #[test]
+    fn user_skill_groups_default_to_version_one_without_persisted_groups() {
+        let mut value = current_global_config_with(serde_json::json!({}));
+        value["app"]
+            .as_object_mut()
+            .expect("current app config")
+            .remove("user_skill_groups");
+        let config: GlobalConfig = serde_json::from_value(value)
+            .expect("current app config should default omitted skill groups");
+        assert_eq!(
+            config.app.user_skill_groups,
+            UserSkillGroupsConfig::default()
+        );
+
+        let serialized = serde_json::to_value(&config).expect("config should serialize");
+        assert!(serialized["app"].get("user_skill_groups").is_none());
+    }
+
+    #[test]
+    fn user_skill_groups_preserve_the_versioned_ui_shape() {
+        let config: GlobalConfig =
+            serde_json::from_value(current_global_config_with(serde_json::json!({
+                "app": {
+                    "user_skill_groups": {
+                        "version": 1,
+                        "groups": [{
+                            "id": "daily-coding",
+                            "name": "Daily coding",
+                            "skillKeys": ["builtin::find-skills", "user::review"]
+                        }]
+                    }
+                }
+            })))
+            .expect("user skill groups should deserialize");
+
+        assert_eq!(
+            config.app.user_skill_groups.groups[0].skill_keys,
+            vec![
+                "builtin::find-skills".to_string(),
+                "user::review".to_string()
+            ]
+        );
+
+        let serialized = serde_json::to_value(&config).expect("config should serialize");
+        assert_eq!(
+            serialized["app"]["user_skill_groups"]["groups"][0]["skillKeys"],
+            serde_json::json!(["builtin::find-skills", "user::review"])
+        );
+    }
+
+    #[test]
+    fn global_config_preserves_project_mcp_servers() {
+        let config: GlobalConfig =
+            serde_json::from_value(current_global_config_with(serde_json::json!({
+                "project": {
+                    "mcp_servers": [
+                        {
+                            "id": "project-docs",
+                            "name": "Project Docs",
+                            "server_type": "local",
+                            "command": "docs-mcp",
+                            "args": []
+                        }
+                    ]
+                }
+            })))
+            .expect("project scoped MCP config should deserialize");
+
+        assert_eq!(
+            config
+                .project
+                .mcp_servers
+                .as_ref()
+                .and_then(|value| value.as_array())
+                .map(Vec::len),
+            Some(1)
+        );
+
+        let serialized = serde_json::to_value(&config).expect("config should serialize");
+        assert_eq!(
+            serialized["project"]["mcp_servers"][0]["id"],
+            "project-docs"
+        );
+    }
+
+    #[test]
+    fn global_config_preserves_terminal_panel_position() {
+        let config: GlobalConfig =
+            serde_json::from_value(current_global_config_with(serde_json::json!({
+                "terminal": {
+                    "terminal_panel_position": "bottom"
+                }
+            })))
+            .expect("terminal panel position config should deserialize");
+
+        assert_eq!(config.terminal.terminal_panel_position, "bottom");
+
+        let serialized = serde_json::to_value(&config).expect("config should serialize");
+        assert_eq!(serialized["terminal"]["terminal_panel_position"], "bottom");
+    }
+
+    #[test]
+    fn global_config_serialization_uses_appearance_selection() {
+        let serialized =
+            serde_json::to_value(GlobalConfig::default()).expect("config should serialize");
+
+        assert!(
+            serialized.get("theme").is_none(),
+            "Rust config must not export the removed GUI theme schema"
+        );
+        assert!(serialized.get("themes").is_none());
+        assert_eq!(serialized["appearance"]["selection"], "system");
+    }
+
+    #[test]
+    fn defaults_agent_companion_pet_to_blue_golden() {
+        let config: AIExperienceConfig =
+            serde_json::from_value(serde_json::json!({})).expect("empty config should default");
+
+        let pet = config
+            .agent_companion_pet
+            .as_ref()
+            .expect("default companion pet should be present");
+        assert_eq!(pet.id, "blue-golden");
+        assert_eq!(pet.display_name, "困困");
+        assert_eq!(pet.package_path, "/agent-companion-pets/blue-golden");
+        assert_eq!(
+            pet.spritesheet_path,
+            "/agent-companion-pets/blue-golden/spritesheet.png"
+        );
+        assert_eq!(pet.spritesheet_mime_type, "image/png");
+    }
+
+    #[test]
+    fn preserves_selected_agent_companion_pet() {
+        let config: AIExperienceConfig = serde_json::from_value(serde_json::json!({
+            "enable_session_title_generation": true,
+            "enable_welcome_panel_ai_analysis": false,
+            "enable_visual_mode": false,
+            "enable_agent_companion": true,
+            "agent_companion_pet": {
+                "id": "boxcat",
+                "displayName": "Boxcat",
+                "description": "A tiny cat tucked inside a cardboard box for cozy coding sessions.",
+                "source": "preset",
+                "packagePath": "/agent-companion-pets/boxcat",
+                "spritesheetPath": "/agent-companion-pets/boxcat/spritesheet.webp",
+                "spritesheetMimeType": "image/webp"
+            }
+        }))
+        .expect("AI experience config with selected companion pet should deserialize");
+
+        let pet = config
+            .agent_companion_pet
+            .as_ref()
+            .expect("selected companion pet should be retained");
+        assert_eq!(pet.id, "boxcat");
+        assert_eq!(pet.display_name, "Boxcat");
+        assert_eq!(pet.package_path, "/agent-companion-pets/boxcat");
+
+        let serialized = serde_json::to_value(&config).expect("config should serialize");
+        assert_eq!(serialized["agent_companion_pet"]["displayName"], "Boxcat");
+        assert_eq!(
+            serialized["agent_companion_pet"]["spritesheetPath"],
+            "/agent-companion-pets/boxcat/spritesheet.webp"
+        );
+    }
+
+    #[test]
+    fn quick_action_defaults_do_not_replace_an_explicit_legacy_empty_list() {
+        let absent: AIExperienceConfig = serde_json::from_value(serde_json::json!({})).unwrap();
+        assert_eq!(absent.quick_actions.len(), 2);
+        let cleared: AIExperienceConfig = serde_json::from_value(serde_json::json!({
+            "quick_actions": []
+        }))
+        .unwrap();
+        assert!(cleared.quick_actions.is_empty());
+        let round_trip: AIExperienceConfig =
+            serde_json::from_value(serde_json::to_value(cleared).unwrap()).unwrap();
+        assert!(round_trip.quick_actions.is_empty());
+    }
+
+    #[test]
+    fn ai_experience_quick_actions_round_trip_through_global_config() {
+        let config: GlobalConfig =
+            serde_json::from_value(current_global_config_with(serde_json::json!({
+                "app": {
+                    "language": "en-US",
+                    "auto_update": true,
+                    "telemetry": true,
+                    "startup_behavior": "default",
+                    "confirm_on_exit": true,
+                    "restore_windows": false,
+                    "zoom_level": 100,
+                    "sidebar": { "width": 260, "collapsed": false },
+                    "right_panel": { "width": 400, "collapsed": true },
+                    "notifications": {
+                        "enabled": true,
+                        "position": "top-right",
+                        "duration": 4000,
+                        "dialog_completion_notify": true,
+                        "permission_request_notify": false,
+                        "enable_startup_tips": true
+                    },
+                    "ai_experience": {
+                        "enable_session_title_generation": true,
+                        "enable_welcome_panel_ai_analysis": false,
+                        "enable_visual_mode": false,
+                        "enable_agent_companion": true,
+                        "enable_workspace_search": false,
+                        "quick_actions": [
+                            {
+                                "id": "custom_1",
+                                "label": "Run tests",
+                                "prompt": "Run the test suite",
+                                "enabled": true
+                            }
+                        ]
+                    }
+                }
+            })))
+            .expect("minimal app config with quick_actions should deserialize");
+
+        let actions = &config.app.ai_experience.quick_actions;
+        assert!(!config.app.notifications.permission_request_notify);
+        assert_eq!(actions.len(), 1);
+        assert_eq!(actions[0].id, "custom_1");
+        assert_eq!(actions[0].label, "Run tests");
+
+        let serialized = serde_json::to_value(&config).expect("config should serialize");
+        assert_eq!(
+            serialized["app"]["ai_experience"]["quick_actions"][0]["id"],
+            "custom_1"
+        );
+        assert_eq!(
+            serialized["app"]["notifications"]["permission_request_notify"],
+            false
+        );
+    }
+
+    #[test]
+    fn current_config_rejects_retired_app_session_config() {
+        let value = current_global_config_with(serde_json::json!({
+            "app": {
+                "session_config": {
+                    "default_mode": "cowork"
+                }
+            }
+        }));
+        let error = super::validate_current_config_value(&value, "Configuration fixture")
+            .expect_err("retired app session config must not enter the current runtime");
+        assert!(error.to_string().contains("app.session_config"));
+    }
+
+    #[test]
+    fn app_flow_chat_default_mode_id_round_trips() {
+        let config: GlobalConfig =
+            serde_json::from_value(current_global_config_with(serde_json::json!({
+                "app": {
+                    "flow_chat": {
+                        "default_mode_id": "PlannerPlus"
+                    }
+                }
+            })))
+            .expect("flow chat config should deserialize");
+
+        assert_eq!(
+            config.app.flow_chat.default_mode_id.as_deref(),
+            Some("PlannerPlus")
+        );
+
+        let serialized = serde_json::to_value(&config).expect("config should serialize");
+        assert_eq!(
+            serialized["app"]["flow_chat"]["default_mode_id"],
+            "PlannerPlus"
+        );
+    }
+
+    #[test]
+    fn app_flow_chat_permission_mode_control_defaults_to_visible_without_persisting_default() {
+        let default_config: GlobalConfig =
+            serde_json::from_value(current_global_config_with(serde_json::json!({
+                "app": {
+                    "flow_chat": {}
+                }
+            })))
+            .expect("flow chat config without visibility preference should deserialize");
+
+        assert!(default_config.app.flow_chat.show_permission_mode_control);
+        let default_serialized =
+            serde_json::to_value(&default_config).expect("config should serialize");
+        assert!(default_serialized["app"]["flow_chat"]
+            .get("show_permission_mode_control")
+            .is_none());
+
+        let hidden_config: GlobalConfig =
+            serde_json::from_value(current_global_config_with(serde_json::json!({
+                "app": {
+                    "flow_chat": {
+                        "show_permission_mode_control": false
+                    }
+                }
+            })))
+            .expect("flow chat config with hidden permission control should deserialize");
+
+        assert!(!hidden_config.app.flow_chat.show_permission_mode_control);
+        let hidden_serialized =
+            serde_json::to_value(&hidden_config).expect("config should serialize");
+        assert_eq!(
+            hidden_serialized["app"]["flow_chat"]["show_permission_mode_control"],
+            false
+        );
+    }
+
+    #[test]
+    fn default_model_serialization_contains_no_retired_reasoning_fields() {
+        let config = AIModelConfig::default();
+        let value = serde_json::to_value(&config).expect("config should serialize");
+
+        assert!(value.get("enable_thinking_process").is_none());
+        assert!(value.get("reasoning_mode").is_none());
+        assert!(value.get("reasoning_effort").is_none());
+        assert!(value.get("thinking_budget_tokens").is_none());
+        assert!(value.get("reasoning").is_none());
+    }
+
+    #[test]
+    fn default_model_config_enables_inline_think_in_text() {
+        let config = AIModelConfig::default();
+        assert!(config.inline_think_in_text);
+    }
+
+    #[test]
+    fn deserializes_missing_inline_think_in_text_as_enabled() {
+        let config: AIModelConfig = serde_json::from_value(serde_json::json!({
+            "id": "model_1",
+            "name": "Provider",
+            "provider": "openai",
+            "model_name": "test-model",
+            "base_url": "https://example.com/v1",
+            "api_key": "key",
+            "enabled": true
+        }))
+        .expect("config without inline_think_in_text should deserialize");
+
+        assert!(config.inline_think_in_text);
+    }
+
+    #[test]
+    fn default_ai_config_uses_generous_stream_timeouts() {
+        let config = AIConfig::default();
+
+        assert_eq!(config.stream_idle_timeout_secs, Some(600));
+        assert_eq!(config.stream_ttft_timeout_secs, Some(600));
+        assert!(config.enable_deferred_tool_loading);
+        assert!(config.allow_tool_json_repair);
+        assert_eq!(config.subagent_max_concurrency, 5);
+        assert_eq!(config.swarm_max_concurrency, 16);
+        assert_eq!(
+            config.subagent_batch_execution_policy,
+            SubagentBatchExecutionPolicy::ForceParallel
+        );
+        let review_team = config
+            .review_teams
+            .get("default")
+            .expect("default review team config should exist");
+        assert_eq!(review_team.reviewer_timeout_seconds, 3600);
+        assert_eq!(review_team.judge_timeout_seconds, 2400);
+        assert!(!review_team.auto_fix_enabled);
+        assert_eq!(review_team.strategy_level, "normal");
+        assert!(review_team.member_strategy_overrides.is_empty());
+        assert_eq!(config.review_team_rate_limit_status, serde_json::json!({}));
+        assert_eq!(config.agent_model_defaults.mode, "primary");
+        assert_eq!(
+            config.agent_model_defaults.subagents.default_selection,
+            SubagentModelSelection::fixed("fast")
+        );
+        assert_eq!(
+            config
+                .agent_model_defaults
+                .subagents
+                .builtin
+                .get("GeneralPurpose"),
+            Some(&SubagentModelSelection::fixed("primary"))
+        );
+        assert_eq!(
+            config
+                .agent_model_defaults
+                .subagents
+                .builtin
+                .get("ResearchSpecialist"),
+            Some(&SubagentModelSelection::Inherit)
+        );
+        assert_eq!(
+            config.agent_model_defaults.subagents.fork,
+            SubagentModelSelection::Inherit
+        );
+    }
+
+    #[test]
+    fn subagent_model_selection_uses_a_tagged_persistent_shape() {
+        let selection = SubagentModelSelection::fixed("fast");
+        assert_eq!(
+            serde_json::to_value(selection).expect("selection should serialize"),
+            serde_json::json!({ "kind": "fixed", "model_id": "fast" })
+        );
+
+        let inherited: SubagentModelSelection = serde_json::from_value(serde_json::json!({
+            "kind": "inherit"
+        }))
+        .expect("inherit selection should deserialize");
+        assert_eq!(inherited, SubagentModelSelection::Inherit);
+    }
+
+    #[test]
+    fn builtin_subagent_without_override_uses_the_shared_default() {
+        let mut defaults = AgentModelDefaultsConfig::default();
+        defaults.subagents.default_selection = SubagentModelSelection::fixed("primary");
+
+        assert_eq!(
+            defaults.builtin_subagent_selection("Explore"),
+            SubagentModelSelection::fixed("primary")
+        );
+    }
+
+    #[test]
+    fn general_purpose_uses_primary_unless_explicitly_overridden() {
+        let mut defaults = AgentModelDefaultsConfig::default();
+
+        assert_eq!(
+            defaults.builtin_subagent_selection("GeneralPurpose"),
+            SubagentModelSelection::fixed("primary")
+        );
+
+        defaults.subagents.builtin.insert(
+            "GeneralPurpose".to_string(),
+            SubagentModelSelection::fixed("fast"),
+        );
+        assert_eq!(
+            defaults.builtin_subagent_selection("GeneralPurpose"),
+            SubagentModelSelection::fixed("fast")
+        );
+    }
+
+    #[test]
+    fn research_specialist_inherits_parent_unless_explicitly_overridden() {
+        let mut defaults = AgentModelDefaultsConfig::default();
+
+        assert_eq!(
+            defaults.builtin_subagent_selection("ResearchSpecialist"),
+            SubagentModelSelection::Inherit
+        );
+
+        defaults.subagents.builtin.insert(
+            "ResearchSpecialist".to_string(),
+            SubagentModelSelection::fixed("fast"),
+        );
+        assert_eq!(
+            defaults.builtin_subagent_selection("ResearchSpecialist"),
+            SubagentModelSelection::fixed("fast")
+        );
+    }
+
+    #[test]
+    fn editor_indentation_defaults_and_legacy_round_trip() {
+        let defaults: EditorConfig = serde_json::from_str("{}").unwrap();
+        assert_eq!(defaults.tab_size, 4);
+        assert!(defaults.insert_spaces);
+        assert!(defaults.detect_indentation);
+
+        // Old explicit preferences must not be reset during an upgrade.
+        let legacy = serde_json::json!({ "tab_size": 2, "insert_spaces": false });
+        let config: EditorConfig = serde_json::from_value(legacy.clone()).unwrap();
+        assert_eq!(config.tab_size, 2);
+        assert!(!config.insert_spaces);
+        assert!(config.detect_indentation);
+        let saved = serde_json::to_value(&config).unwrap();
+        for (key, value) in legacy.as_object().unwrap() {
+            assert_eq!(&saved[key], value);
+        }
+        let mut explicit = saved;
+        explicit["detect_indentation"] = serde_json::json!(false);
+        let config: EditorConfig = serde_json::from_value(explicit.clone()).unwrap();
+        assert!(!config.detect_indentation);
+        assert_eq!(serde_json::to_value(config).unwrap(), explicit);
+    }
+
+    #[test]
+    fn current_editor_config_defaults_new_optional_visual_fields() {
+        let config: GlobalConfig =
+            serde_json::from_value(current_global_config_with(serde_json::json!({
+                "editor": {
+                    "font_size": 16,
+                    "font_family": "Fixture Mono",
+                    "line_height": 1.4
+                }
+            })))
+            .expect("current editor config should default optional visual fields");
+
+        assert_eq!(config.editor.font_size, 16);
+        assert_eq!(config.editor.font_family, "Fixture Mono");
+        assert_eq!(config.editor.font_weight, "normal");
+        assert_eq!(config.editor.cursor_style, "line");
+        assert_eq!(config.editor.cursor_blinking, "smooth");
+        assert_eq!(config.editor.render_whitespace, "selection");
+        assert_eq!(config.editor.render_line_highlight, "line");
+        assert!(!config.editor.scroll_beyond_last_line);
+        assert!(config.editor.smooth_scrolling);
+        assert!(config.editor.semantic_highlighting);
+        assert!(config.editor.bracket_pair_colorization);
+    }
+
+    #[test]
+    fn editor_visual_fields_survive_a_persisted_round_trip() {
+        let mut config = GlobalConfig::default();
+        config.editor.font_weight = "bold".to_string();
+        config.editor.cursor_style = "block-outline".to_string();
+        config.editor.cursor_blinking = "solid".to_string();
+        config.editor.render_whitespace = "all".to_string();
+        config.editor.render_line_highlight = "gutter".to_string();
+        config.editor.scroll_beyond_last_line = true;
+        config.editor.smooth_scrolling = false;
+        config.editor.semantic_highlighting = false;
+        config.editor.bracket_pair_colorization = false;
+
+        let restored: GlobalConfig = serde_json::from_value(
+            serde_json::to_value(config).expect("editor config should serialize"),
+        )
+        .expect("editor config should deserialize");
+
+        assert_eq!(restored.editor.font_weight, "bold");
+        assert_eq!(restored.editor.cursor_style, "block-outline");
+        assert_eq!(restored.editor.cursor_blinking, "solid");
+        assert_eq!(restored.editor.render_whitespace, "all");
+        assert_eq!(restored.editor.render_line_highlight, "gutter");
+        assert!(restored.editor.scroll_beyond_last_line);
+        assert!(!restored.editor.smooth_scrolling);
+        assert!(!restored.editor.semantic_highlighting);
+        assert!(!restored.editor.bracket_pair_colorization);
+    }
+
+    #[test]
+    fn default_global_config_includes_enabled_memories_config() {
+        let config = GlobalConfig::default();
+
+        assert!(!config.memories.generate_memories);
+        assert!(!config.memories.generate_for_btw_sessions);
+        assert!(!config.memories.use_memories);
+        assert_eq!(
+            config.memories.external_context_policy,
+            MemoryExternalContextPolicy::ClearToolResults
+        );
+        assert_eq!(config.memories.max_raw_memories_for_consolidation, 64);
+        assert_eq!(config.memories.max_unused_days, 30);
+        assert_eq!(config.memories.max_rollout_age_days, 10);
+        assert_eq!(config.memories.max_rollouts_per_startup, 2);
+        assert_eq!(config.memories.max_rollouts_scan_limit, 2_000);
+        assert_eq!(config.memories.min_rollout_idle_hours, 6);
+        assert_eq!(config.memories.phase1_max_concurrency, 1);
+        assert_eq!(config.memories.phase1_retry_backoff_minutes, 60);
+        assert_eq!(config.memories.phase1_lease_seconds, 60 * 60);
+        assert_eq!(config.memories.phase2_lease_seconds, 60 * 60);
+        assert_eq!(config.memories.phase2_success_cooldown_seconds, 6 * 60 * 60);
+        assert_eq!(config.memories.phase2_retry_delay_seconds, 60 * 60);
+        assert_eq!(config.memories.extract_model, None);
+        assert_eq!(config.memories.consolidation_model, None);
+    }
+
+    #[test]
+    fn deserializes_explicit_memories_config() {
+        let config: GlobalConfig =
+            serde_json::from_value(current_global_config_with(serde_json::json!({
+                "memories": {
+                    "generate_memories": false,
+                    "generate_for_btw_sessions": true,
+                    "use_memories": false,
+                    "external_context_policy": "skip_session",
+                    "max_raw_memories_for_consolidation": 12,
+                    "max_unused_days": 7,
+                    "max_rollout_age_days": 14,
+                    "max_rollouts_per_startup": 8,
+                    "max_rollouts_scan_limit": 200,
+                    "min_rollout_idle_hours": 12,
+                    "phase1_max_concurrency": 3,
+                    "phase1_retry_backoff_minutes": 45,
+                    "phase1_lease_seconds": 600,
+                    "phase2_lease_seconds": 1200,
+                    "phase2_success_cooldown_seconds": 7200,
+                    "phase2_retry_delay_seconds": 300,
+                    "extract_model": "extractor",
+                    "consolidation_model": "consolidator"
+                }
+            })))
+            .expect("global config with memories section should deserialize");
+
+        assert!(!config.memories.generate_memories);
+        assert!(config.memories.generate_for_btw_sessions);
+        assert!(!config.memories.use_memories);
+        assert_eq!(
+            config.memories.external_context_policy,
+            MemoryExternalContextPolicy::SkipSession
+        );
+        assert_eq!(config.memories.max_raw_memories_for_consolidation, 12);
+        assert_eq!(config.memories.max_unused_days, 7);
+        assert_eq!(config.memories.max_rollout_age_days, 14);
+        assert_eq!(config.memories.max_rollouts_per_startup, 8);
+        assert_eq!(config.memories.max_rollouts_scan_limit, 200);
+        assert_eq!(config.memories.min_rollout_idle_hours, 12);
+        assert_eq!(config.memories.phase1_max_concurrency, 3);
+        assert_eq!(config.memories.phase1_retry_backoff_minutes, 45);
+        assert_eq!(config.memories.phase1_lease_seconds, 600);
+        assert_eq!(config.memories.phase2_lease_seconds, 1200);
+        assert_eq!(config.memories.phase2_success_cooldown_seconds, 7200);
+        assert_eq!(config.memories.phase2_retry_delay_seconds, 300);
+        assert_eq!(config.memories.extract_model.as_deref(), Some("extractor"));
+        assert_eq!(
+            config.memories.consolidation_model.as_deref(),
+            Some("consolidator")
+        );
+    }
+
+    #[test]
+    fn deserializes_missing_stream_timeouts_as_generous_defaults() {
+        let config: AIConfig = serde_json::from_value(serde_json::json!({
+            "models": [],
+            "default_models": {},
+            "agent_profiles": {},
+            "proxy": {
+                "enabled": false,
+                "url": ""
+            }
+        }))
+        .expect("config without stream_idle_timeout_secs should deserialize");
+
+        assert_eq!(config.stream_idle_timeout_secs, Some(600));
+        assert_eq!(config.stream_ttft_timeout_secs, Some(600));
+        assert!(config.allow_tool_json_repair);
+        assert_eq!(config.subagent_max_concurrency, 5);
+        assert_eq!(config.swarm_max_concurrency, 16);
+        assert_eq!(
+            config.subagent_batch_execution_policy,
+            SubagentBatchExecutionPolicy::ForceParallel
+        );
+        assert!(config.review_teams.contains_key("default"));
+    }
+
+    #[test]
+    fn task_models_default_to_fast() {
+        let config = AIConfig::default();
+
+        assert_eq!(
+            config.task_models.session_title.fixed_model_id(),
+            Some("fast")
+        );
+        assert_eq!(config.task_models.git_commit.fixed_model_id(), Some("fast"));
+    }
+
+    #[test]
+    fn preserves_explicit_disabled_tool_json_repair() {
+        let config: AIConfig = serde_json::from_value(serde_json::json!({
+            "models": [],
+            "default_models": {},
+            "agent_profiles": {},
+            "allow_tool_json_repair": false,
+            "proxy": {
+                "enabled": false,
+                "url": ""
+            }
+        }))
+        .expect("config with an explicit JSON repair setting should deserialize");
+
+        assert!(!config.allow_tool_json_repair);
+    }
+
+    #[test]
+    fn deserializes_explicit_null_stream_ttft_timeout_as_none() {
+        let config: AIConfig = serde_json::from_value(serde_json::json!({
+            "models": [],
+            "default_models": {},
+            "agent_profiles": {},
+            "proxy": {
+                "enabled": false,
+                "url": ""
+            },
+            "stream_ttft_timeout_secs": null
+        }))
+        .expect("config with explicit null stream_ttft_timeout_secs should deserialize");
+
+        assert_eq!(config.stream_ttft_timeout_secs, None);
+        assert_eq!(config.stream_idle_timeout_secs, Some(600));
+    }
+
+    #[test]
+    fn app_logging_defaults_to_sensitive_diagnostics_enabled() {
+        let config: AppLoggingConfig = serde_json::from_value(serde_json::json!({
+            "level": "trace"
+        }))
+        .expect("logging config without sensitive preference should deserialize");
+
+        assert!(config.include_sensitive_diagnostics);
+        assert!(!config.flow_chat_diagnostics);
+        assert_eq!(
+            config.model_exchange_tracing.mode,
+            ModelExchangeTracingMode::Off
+        );
+    }
+
+    #[test]
+    fn deserializes_explicit_subagent_max_concurrency() {
+        let config: AIConfig = serde_json::from_value(serde_json::json!({
+            "models": [],
+            "default_models": {},
+            "agent_profiles": {},
+            "subagent_max_concurrency": 9,
+            "proxy": {
+                "enabled": false,
+                "url": ""
+            }
+        }))
+        .expect("config with subagent_max_concurrency should deserialize");
+
+        assert_eq!(config.subagent_max_concurrency, 9);
+    }
+
+    #[test]
+    fn deserializes_explicit_swarm_max_concurrency() {
+        let config: AIConfig = serde_json::from_value(serde_json::json!({
+            "models": [],
+            "func_agent_models": {},
+            "default_models": {},
+            "agent_profiles": {},
+            "swarm_max_concurrency": 24,
+            "proxy": {
+                "enabled": false,
+                "url": ""
+            }
+        }))
+        .expect("config with swarm_max_concurrency should deserialize");
+
+        assert_eq!(config.swarm_max_concurrency, 24);
+    }
+
+    #[test]
+    fn deserializes_explicit_subagent_batch_execution_policy() {
+        let config: AIConfig = serde_json::from_value(serde_json::json!({
+            "models": [],
+            "default_models": {},
+            "agent_profiles": {},
+            "subagent_batch_execution_policy": "force_parallel",
+            "proxy": {
+                "enabled": false,
+                "url": ""
+            }
+        }))
+        .expect("config with subagent_batch_execution_policy should deserialize");
+
+        assert_eq!(
+            config.subagent_batch_execution_policy,
+            SubagentBatchExecutionPolicy::ForceParallel
+        );
+    }
+
+    #[test]
+    fn deserializes_mode_profiles_with_null_entries() {
+        let config: AIConfig = serde_json::from_value(serde_json::json!({
+            "models": [],
+            "default_models": {},
+            "agent_profiles": {
+                "Claw": null,
+                "Cowork": {
+                    "profile_id": "Cowork",
+                    "removed_tools": ["shell"]
+                }
+            },
+            "proxy": {
+                "enabled": false,
+                "url": ""
+            }
+        }))
+        .expect("config with null mode config entries should deserialize");
+
+        assert!(!config.agent_profiles.contains_key("Claw"));
+        assert_eq!(
+            config
+                .agent_profiles
+                .get("Cowork")
+                .expect("non-null mode config should be retained")
+                .removed_tools,
+            vec!["shell".to_string()]
+        );
+    }
+
+    #[test]
+    fn deserializes_explicit_default_review_team_config() {
+        let config: AIConfig = serde_json::from_value(serde_json::json!({
+            "models": [],
+            "default_models": {},
+            "agent_profiles": {},
+            "review_teams": {
+                "default": {
+                    "extra_subagent_ids": ["ExtraReviewer"],
+                    "reviewer_timeout_seconds": 120,
+                    "judge_timeout_seconds": 90,
+                    "strategy_level": "deep",
+                    "member_strategy_overrides": {
+                        "ReviewSecurity": "quick",
+                        "ExtraReviewer": "normal"
+                    },
+                    "auto_fix_enabled": false
+                }
+            },
+            "proxy": {
+                "enabled": false,
+                "url": ""
+            }
+        }))
+        .expect("config with review_teams should deserialize");
+
+        let review_team = config
+            .review_teams
+            .get("default")
+            .expect("default review team config should be retained");
+        assert_eq!(review_team.extra_subagent_ids, vec!["ExtraReviewer"]);
+        assert_eq!(review_team.reviewer_timeout_seconds, 120);
+        assert_eq!(review_team.judge_timeout_seconds, 90);
+        assert_eq!(review_team.strategy_level, "deep");
+        assert_eq!(
+            review_team.member_strategy_overrides.get("ReviewSecurity"),
+            Some(&"quick".to_string())
+        );
+        assert_eq!(
+            review_team.member_strategy_overrides.get("ExtraReviewer"),
+            Some(&"normal".to_string())
+        );
+        assert!(!review_team.auto_fix_enabled);
+
+        let serialized = serde_json::to_value(&config).expect("config should serialize");
+        assert_eq!(
+            serialized["review_teams"]["default"]["strategy_level"],
+            "deep"
+        );
+        assert_eq!(
+            serialized["review_teams"]["default"]["member_strategy_overrides"]["ReviewSecurity"],
+            "quick"
+        );
+    }
+
+    #[test]
+    fn preserves_review_team_concurrency_fields_through_config_round_trip() {
+        let config: AIConfig = serde_json::from_value(serde_json::json!({
+            "models": [],
+            "default_models": {},
+            "agent_profiles": {},
+            "review_teams": {
+                "default": {
+                    "extra_subagent_ids": [],
+                    "strategy_level": "normal",
+                    "member_strategy_overrides": {},
+                    "reviewer_timeout_seconds": 3600,
+                    "judge_timeout_seconds": 2400,
+                    "reviewer_file_split_threshold": 20,
+                    "max_same_role_instances": 3,
+                    "max_retries_per_role": 1,
+                    "max_parallel_reviewers": 1,
+                    "max_queue_wait_seconds": 0,
+                    "allow_provider_capacity_queue": true,
+                    "allow_bounded_auto_retry": false,
+                    "auto_retry_elapsed_guard_seconds": 180
+                }
+            },
+            "proxy": {
+                "enabled": false,
+                "url": ""
+            }
+        }))
+        .expect("review team concurrency config should deserialize");
+
+        let serialized = serde_json::to_value(&config).expect("config should serialize");
+        let stored = &serialized["review_teams"]["default"];
+        assert_eq!(stored["max_retries_per_role"], serde_json::json!(1));
+        assert_eq!(stored["max_parallel_reviewers"], serde_json::json!(1));
+        assert_eq!(stored["max_queue_wait_seconds"], serde_json::json!(0));
+        assert_eq!(
+            stored["allow_provider_capacity_queue"],
+            serde_json::json!(true)
+        );
+        assert_eq!(stored["allow_bounded_auto_retry"], serde_json::json!(false));
+        assert_eq!(
+            stored["auto_retry_elapsed_guard_seconds"],
+            serde_json::json!(180)
+        );
+    }
+
+    #[test]
+    fn missing_review_team_concurrency_fields_use_product_defaults() {
+        let config: AIConfig = serde_json::from_value(serde_json::json!({
+            "models": [],
+            "review_teams": {
+                "default": {
+                    "strategy_level": "normal"
+                }
+            }
+        }))
+        .expect("legacy review team config should deserialize");
+
+        let serialized = serde_json::to_value(&config).expect("config should serialize");
+        let stored = &serialized["review_teams"]["default"];
+        assert_eq!(stored["max_retries_per_role"], serde_json::json!(1));
+        assert_eq!(stored["max_parallel_reviewers"], serde_json::json!(2));
+        assert_eq!(stored["max_queue_wait_seconds"], serde_json::json!(1200));
+        assert_eq!(
+            stored["allow_provider_capacity_queue"],
+            serde_json::json!(true)
+        );
+        assert_eq!(stored["allow_bounded_auto_retry"], serde_json::json!(false));
+        assert_eq!(
+            stored["auto_retry_elapsed_guard_seconds"],
+            serde_json::json!(180)
+        );
+    }
+
+    #[test]
+    fn review_team_auxiliary_config_is_not_stored_inside_review_team_map() {
+        let config: AIConfig = serde_json::from_value(serde_json::json!({
+            "models": [],
+            "review_teams": {
+                "default": {
+                    "strategy_level": "normal"
+                }
+            },
+            "review_team_rate_limit_status": {
+                "remaining": 2
+            },
+        }))
+        .expect("review team auxiliary config should deserialize");
+
+        assert!(config.review_teams.contains_key("default"));
+        assert!(!config.review_teams.contains_key("rate_limit_status"));
+        assert_eq!(
+            config.review_team_rate_limit_status["remaining"],
+            serde_json::json!(2)
+        );
+        let serialized =
+            serde_json::to_value(&config).expect("review team auxiliary config should serialize");
+        assert!(serialized["review_teams"]["rate_limit_status"].is_null());
+    }
+
+    #[test]
+    fn legacy_ai_config_defaults_web_search_to_free_exa() {
+        let config: AIConfig = serde_json::from_value(serde_json::json!({
+            "models": []
+        }))
+        .expect("legacy AI config should deserialize");
+
+        assert_eq!(config.web_search.provider, "exa_mcp_free");
+        assert_eq!(
+            config.web_search.providers.exa_search_api.credential_id,
+            "exa-search-api"
+        );
+    }
+
+    #[test]
+    fn web_search_config_preserves_unknown_provider_and_fields() {
+        let config: WebSearchConfig = serde_json::from_value(serde_json::json!({
+            "provider": "future_search",
+            "providers": {
+                "exa_search_api": {
+                    "credentialId": "exa-device-ref",
+                    "futureOption": true
+                },
+                "future_search": {
+                    "endpoint": "https://future.example/search"
+                }
+            },
+            "selectionRevision": 7
+        }))
+        .expect("future WebSearch config should deserialize");
+
+        let serialized = serde_json::to_value(config).expect("WebSearch config should serialize");
+        assert_eq!(serialized["provider"], "future_search");
+        assert_eq!(serialized["selectionRevision"], 7);
+        assert_eq!(
+            serialized["providers"]["exa_search_api"]["futureOption"],
+            true
+        );
+        assert_eq!(
+            serialized["providers"]["future_search"]["endpoint"],
+            "https://future.example/search"
+        );
+    }
+}
+
+use serde_json::Value;
+
+fn config_validation_message(message: String) -> String {
+    message
+}
+
+pub fn validate_openbitfun_product_identity(
+    persisted_product_id: &str,
+    context: &str,
+) -> Result<(), String> {
+    let expected_product_id = product_identity::product_id();
+    if persisted_product_id != expected_product_id {
+        return Err(config_validation_message(format!(
+            "{context} product_id must be '{expected_product_id}', found '{persisted_product_id}'"
+        )));
+    }
+
+    Ok(())
+}
+
+pub fn validate_current_config_value(value: &Value, context: &str) -> Result<(), String> {
+    let root = value
+        .as_object()
+        .ok_or_else(|| config_validation_message(format!("{context} must be a JSON object")))?;
+    let product_id = root
+        .get("product_id")
+        .and_then(Value::as_str)
+        .ok_or_else(|| {
+            config_validation_message(format!(
+                "{context} is missing required string field 'product_id'"
+            ))
+        })?;
+    let schema_version = root
+        .get("schema_version")
+        .and_then(Value::as_u64)
+        .ok_or_else(|| {
+            config_validation_message(format!(
+                "{context} is missing required integer field 'schema_version'"
+            ))
+        })?;
+    if schema_version != u64::from(CURRENT_CONFIG_SCHEMA_VERSION) {
+        return Err(config_validation_message(format!(
+            "{context} schema_version must be {CURRENT_CONFIG_SCHEMA_VERSION}, found {schema_version}"
+        )));
+    }
+    root.get("version").and_then(Value::as_str).ok_or_else(|| {
+        config_validation_message(format!(
+            "{context} is missing required string field 'version'"
+        ))
+    })?;
+    if !root.contains_key("last_modified") {
+        return Err(config_validation_message(format!(
+            "{context} is missing required field 'last_modified'"
+        )));
+    }
+    validate_openbitfun_product_identity(product_id, context)?;
+    reject_retired_config_fields(root, context)
+}
+
+fn retired_config_field(context: &str, path: &str) -> String {
+    config_validation_message(format!(
+        "{context} contains retired pre-OpenBitFun field '{path}'; use the explicit data migration tool instead"
+    ))
+}
+
+fn reject_retired_config_fields(
+    root: &serde_json::Map<String, Value>,
+    context: &str,
+) -> Result<(), String> {
+    if let Some(app) = root.get("app").and_then(Value::as_object) {
+        for field in ["session", "session_config"] {
+            if app.contains_key(field) {
+                return Err(retired_config_field(context, &format!("app.{field}")));
+            }
+        }
+        if app
+            .get("ai_experience")
+            .and_then(Value::as_object)
+            .is_some_and(|ai_experience| ai_experience.contains_key("agent_companion_display_mode"))
+        {
+            return Err(retired_config_field(
+                context,
+                "app.ai_experience.agent_companion_display_mode",
+            ));
+        }
+    }
+    if root
+        .get("font")
+        .and_then(Value::as_object)
+        .is_some_and(|font| font.contains_key("flowChat"))
+    {
+        return Err(retired_config_field(context, "font.flowChat"));
+    }
+
+    let Some(ai) = root.get("ai").and_then(Value::as_object) else {
+        return Ok(());
+    };
+    for field in ["agent_models", "skip_tool_confirmation"] {
+        if ai.contains_key(field) {
+            return Err(retired_config_field(context, &format!("ai.{field}")));
+        }
+    }
+    if ai
+        .get("review_teams")
+        .and_then(Value::as_object)
+        .is_some_and(|review_teams| review_teams.contains_key("rate_limit_status"))
+    {
+        return Err(retired_config_field(
+            context,
+            "ai.review_teams.rate_limit_status",
+        ));
+    }
+
+    if let Some(models) = ai.get("models").and_then(Value::as_array) {
+        for (index, model) in models.iter().enumerate() {
+            let Some(model) = model.as_object() else {
+                continue;
+            };
+            for field in [
+                "enable_thinking_process",
+                "reasoning_mode",
+                "reasoning_effort",
+                "thinking_budget_tokens",
+            ] {
+                if model.contains_key(field) {
+                    return Err(retired_config_field(
+                        context,
+                        &format!("ai.models[{index}].{field}"),
+                    ));
+                }
+            }
+        }
+    }
+
+    Ok(())
+}
diff --git a/src/crates/contracts/product-domains/src/generated/product-control-catalog.json b/src/crates/contracts/product-domains/src/generated/product-control-catalog.json
index dd663557c6..1a16b0b74a 100644
--- a/src/crates/contracts/product-domains/src/generated/product-control-catalog.json
+++ b/src/crates/contracts/product-domains/src/generated/product-control-catalog.json
@@ -4,7 +4,7 @@
   "title": "OpenBitFun Playbook",
   "origin": "https://playbook.openbitfun.com",
   "source": "src/shared/interactive-capabilities/catalog.json",
-  "digest": "c77c16c414ce9fe50929fe249d900489fdceedb8e646aaaca03893aa33d4fbc8",
+  "digest": "d7a7419ddd673eb733ae8bd33dbb3dcd3b4d1ce0acfc953067a3403fe26d6699",
   "ownerDigest": "c0e5c187cf62bc6ed06196ce8520b3eb427bf268cf24659b72d2552fb1d99c54",
   "searchAcceptance": [
     {
@@ -136,13 +136,13 @@
   ],
   "counts": {
     "features": 22,
-    "settings": 22,
-    "userFacing": 44,
-    "documentedItems": 326,
+    "settings": 21,
+    "userFacing": 43,
+    "documentedItems": 321,
     "controlCoverage": {
       "direct": 48,
       "delegated": 61,
-      "interactive": 217,
+      "interactive": 212,
       "unsupported": 0
     }
   },
@@ -18765,285 +18765,6 @@
         "pageId": "data.archived"
       }
     },
-    {
-      "id": "setting.data.migration:query",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "scan",
-        "scope",
-        "launch",
-        "report",
-        "reminder"
-      ],
-      "kind": "query",
-      "risk": "read",
-      "executionHost": "productHost",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": true
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": true
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "valueSource": {
-        "kind": "static"
-      },
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
-    {
-      "id": "setting.data.migration:open:scan",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "scan"
-      ],
-      "kind": "open",
-      "risk": "ui",
-      "executionHost": "presentationSurface",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1",
-            "product_control_presentation_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "openReason": "unstructuredInteraction",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
-    {
-      "id": "setting.data.migration:open:scope",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "scope"
-      ],
-      "kind": "open",
-      "risk": "ui",
-      "executionHost": "presentationSurface",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1",
-            "product_control_presentation_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "openReason": "visualSelection",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
-    {
-      "id": "setting.data.migration:open:launch",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "launch"
-      ],
-      "kind": "open",
-      "risk": "ui",
-      "executionHost": "presentationSurface",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1",
-            "product_control_presentation_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "openReason": "unstructuredInteraction",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
-    {
-      "id": "setting.data.migration:open:report",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "report"
-      ],
-      "kind": "open",
-      "risk": "ui",
-      "executionHost": "presentationSurface",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1",
-            "product_control_presentation_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "openReason": "unstructuredInteraction",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
-    {
-      "id": "setting.data.migration:open:reminder",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "reminder"
-      ],
-      "kind": "open",
-      "risk": "ui",
-      "executionHost": "presentationSurface",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1",
-            "product_control_presentation_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "openReason": "unstructuredInteraction",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
     {
       "id": "setting.data.diagnostics:query",
       "capabilityId": "setting.data.diagnostics",
@@ -30234,156 +29955,6 @@
       ],
       "docsUrl": "https://playbook.openbitfun.com/capabilities/setting.data.archived/"
     },
-    {
-      "id": "setting.data.migration",
-      "kind": "setting",
-      "categoryId": "data",
-      "titleZh": "旧版数据迁移",
-      "titleEn": "Legacy data migration",
-      "summaryZh": "从本机旧版 安装扫描并导入受支持的数据，查看去敏报告，同时保持旧来源不变。",
-      "summaryEn": "Scan and import supported data from a local legacy installation, inspect redacted reports, and leave the legacy source unchanged.",
-      "keywordsZh": [
-        "旧版数据迁移",
-        "旧版数据",
-        "迁移报告",
-        "导入旧数据",
-        "Data Migrator"
-      ],
-      "keywordsEn": [
-        "legacy data migration",
-        "legacy data",
-        "migration report",
-        "import old data",
-        "Data Migrator"
-      ],
-      "highlightsZh": [
-        "只读扫描本机旧版数据",
-        "按五个高层数据组选择迁移范围",
-        "通过独立 Data Migrator 导入并查看去敏报告"
-      ],
-      "highlightsEn": [
-        "Read-only scan of local legacy data",
-        "Choose migration scope across five high-level data groups",
-        "Import through the standalone Data Migrator and inspect redacted reports"
-      ],
-      "items": [
-        {
-          "id": "scan",
-          "titleZh": "只读扫描本机旧版数据来源及所选数据组",
-          "titleEn": "Read-only scan the local legacy source and selected data groups",
-          "control": {
-            "kind": "open",
-            "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“只读扫描本机旧版数据来源及所选数据组”：扫描依赖当前设备上的旧版数据、实时范围选择和结果状态；Agent 会打开精确入口，并把选择与扫描保留在用户可见界面。",
-            "reasonEn": "Read-only scan the local legacy source and selected data groups: Scanning depends on legacy data on the current device, live scope selection, and result state; the Agent opens the exact entry and keeps selection and scanning visible to the user."
-          }
-        },
-        {
-          "id": "scope",
-          "titleZh": "选择设置、扩展、会话、记忆和远程连接迁移范围",
-          "titleEn": "Choose settings, extensions, sessions, memory, and remote-connection migration scope",
-          "control": {
-            "kind": "open",
-            "reasonCode": "visualSelection",
-            "reasonZh": "迁移范围是影响本机持久数据的五组可见选择；Agent 会打开精确入口，由用户确认所需范围。",
-            "reasonEn": "Migration scope is a visible five-group selection affecting local persisted data; the Agent opens the exact entry so the user can confirm the intended scope."
-          }
-        },
-        {
-          "id": "launch",
-          "titleZh": "确认关闭影响后启动独立 Data Migrator",
-          "titleEn": "Launch the standalone Data Migrator after confirming shutdown impact",
-          "control": {
-            "kind": "open",
-            "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“确认关闭影响后启动独立 Data Migrator”：启动迁移器会停止正在运行的 Agent 和终端任务、关闭 Desktop，并交接到独立本机进程；Agent 只打开入口，确认和启动保留在用户可见界面。",
-            "reasonEn": "Launch the standalone Data Migrator after confirming shutdown impact: Launching the migrator can stop running agents and terminal tasks, close Desktop, and hand off to a separate local process; the Agent only opens the entry while confirmation and launch remain visible to the user."
-          }
-        },
-        {
-          "id": "report",
-          "titleZh": "查看最近运行结果和各领域去敏状态",
-          "titleEn": "Inspect the latest run result and redacted per-domain status",
-          "control": {
-            "kind": "open",
-            "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“查看最近运行结果和各领域去敏状态”：报告取决于本机最近一次迁移运行和各领域实时状态；Agent 会打开精确入口，并把报告查看与失败组重试保留在用户可见界面。",
-            "reasonEn": "Inspect the latest run result and redacted per-domain status: Reports depend on the most recent local migration run and live per-domain state; the Agent opens the exact entry and keeps report review and failed-group retry visible to the user."
-          }
-        },
-        {
-          "id": "reminder",
-          "titleZh": "恢复已关闭的首次启动迁移提醒",
-          "titleEn": "Restore the first-start migration reminder after it was disabled",
-          "control": {
-            "kind": "open",
-            "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“恢复已关闭的首次启动迁移提醒”：提醒偏好与当前本机旧数据来源绑定；Agent 会打开精确入口，由用户在可见界面决定是否恢复提醒。",
-            "reasonEn": "Restore the first-start migration reminder after it was disabled: The reminder preference is bound to the current local legacy source; the Agent opens the exact entry so the user can decide visibly whether to restore it."
-          }
-        }
-      ],
-      "stepsZh": [
-        "打开设置",
-        "进入“数据 > 旧版数据迁移”",
-        "扫描来源、选择范围并在确认关闭影响后启动迁移器"
-      ],
-      "stepsEn": [
-        "Open Settings",
-        "Go to Data > Legacy data migration",
-        "Scan the source, choose scope, and launch the migrator after confirming shutdown impact"
-      ],
-      "agentExamplesZh": [
-        "打开旧版数据迁移",
-        "带我查看数据迁移报告"
-      ],
-      "agentExamplesEn": [
-        "Open legacy data migration",
-        "Show me the data migration report"
-      ],
-      "destination": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      },
-      "operations": [],
-      "options": [],
-      "searchTerms": [
-        "setting.data.migration",
-        "旧版数据迁移",
-        "Legacy data migration",
-        "数据与诊断",
-        "Data & diagnostics",
-        "旧版数据",
-        "迁移报告",
-        "导入旧数据",
-        "Data Migrator",
-        "legacy data migration",
-        "legacy data",
-        "migration report",
-        "import old data",
-        "只读扫描本机旧版数据",
-        "按五个高层数据组选择迁移范围",
-        "通过独立 Data Migrator 导入并查看去敏报告",
-        "Read-only scan of local legacy data",
-        "Choose migration scope across five high-level data groups",
-        "Import through the standalone Data Migrator and inspect redacted reports",
-        "只读扫描本机旧版数据来源及所选数据组",
-        "Read-only scan the local legacy source and selected data groups",
-        "选择设置、扩展、会话、记忆和远程连接迁移范围",
-        "Choose settings, extensions, sessions, memory, and remote-connection migration scope",
-        "确认关闭影响后启动独立 Data Migrator",
-        "Launch the standalone Data Migrator after confirming shutdown impact",
-        "查看最近运行结果和各领域去敏状态",
-        "Inspect the latest run result and redacted per-domain status",
-        "恢复已关闭的首次启动迁移提醒",
-        "Restore the first-start migration reminder after it was disabled",
-        "打开旧版数据迁移",
-        "带我查看数据迁移报告",
-        "Open legacy data migration",
-        "Show me the data migration report"
-      ],
-      "docsUrl": "https://playbook.openbitfun.com/capabilities/setting.data.migration/"
-    },
     {
       "id": "setting.data.diagnostics",
       "kind": "setting",
diff --git a/src/crates/contracts/product-domains/src/generated/remote-surface-registry.json b/src/crates/contracts/product-domains/src/generated/remote-surface-registry.json
index 535a2bd35b..fe0d6941e8 100644
--- a/src/crates/contracts/product-domains/src/generated/remote-surface-registry.json
+++ b/src/crates/contracts/product-domains/src/generated/remote-surface-registry.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "digest": "fnv1a64:f5390eecb4710d17",
+  "digest": "fnv1a64:4cdcd7ff4dcd85a9",
   "retiredCommandPrefixes": [
     {
       "prefix": "lsp_",
@@ -2585,30 +2585,6 @@
         "reason": "the controller keeps this command; peer hosts refuse it before dispatch"
       }
     },
-    {
-      "id": "get_legacy_migration_report",
-      "surface": "tauri_command",
-      "remoteWorkspace": "LocalOnly",
-      "peer": {
-        "kind": "controller_local"
-      },
-      "cliPeer": {
-        "kind": "unsupported",
-        "reason": "the controller keeps this command; peer hosts refuse it before dispatch"
-      }
-    },
-    {
-      "id": "get_legacy_migration_status",
-      "surface": "tauri_command",
-      "remoteWorkspace": "LocalOnly",
-      "peer": {
-        "kind": "controller_local"
-      },
-      "cliPeer": {
-        "kind": "unsupported",
-        "reason": "the controller keeps this command; peer hosts refuse it before dispatch"
-      }
-    },
     {
       "id": "get_mcp_prompt",
       "surface": "tauri_command",
@@ -5163,18 +5139,6 @@
         "reason": "the CLI peer host has no handler for this command"
       }
     },
-    {
-      "id": "prepare_legacy_migration",
-      "surface": "tauri_command",
-      "remoteWorkspace": "LocalOnly",
-      "peer": {
-        "kind": "controller_local"
-      },
-      "cliPeer": {
-        "kind": "unsupported",
-        "reason": "the controller keeps this command; peer hosts refuse it before dispatch"
-      }
-    },
     {
       "id": "preview_commit_message",
       "surface": "tauri_command",
@@ -6493,18 +6457,6 @@
         "kind": "handled"
       }
     },
-    {
-      "id": "scan_legacy_migration",
-      "surface": "tauri_command",
-      "remoteWorkspace": "LocalOnly",
-      "peer": {
-        "kind": "controller_local"
-      },
-      "cliPeer": {
-        "kind": "unsupported",
-        "reason": "the controller keeps this command; peer hosts refuse it before dispatch"
-      }
-    },
     {
       "id": "scan_workspace_info",
       "surface": "tauri_command",
@@ -6841,18 +6793,6 @@
         "reason": "the CLI peer host has no handler for this command"
       }
     },
-    {
-      "id": "set_legacy_migration_prompt_preference",
-      "surface": "tauri_command",
-      "remoteWorkspace": "LocalOnly",
-      "peer": {
-        "kind": "controller_local"
-      },
-      "cliPeer": {
-        "kind": "unsupported",
-        "reason": "the controller keeps this command; peer hosts refuse it before dispatch"
-      }
-    },
     {
       "id": "set_macos_edit_menu_mode",
       "surface": "tauri_command",
diff --git a/src/crates/contracts/product-domains/src/remote_surface/table.rs b/src/crates/contracts/product-domains/src/remote_surface/table.rs
index f9a5639a16..6fcc483ed5 100644
--- a/src/crates/contracts/product-domains/src/remote_surface/table.rs
+++ b/src/crates/contracts/product-domains/src/remote_surface/table.rs
@@ -299,8 +299,6 @@ pub(super) const OPERATIONS: &[OperationDefinition] = &[
     op("get_global_skill_settings",                                  Agnostic,    Proxied,          CLI_NOT_IMPLEMENTED),
     op("get_health_status",                                          Agnostic,    Proxied,          CLI_NOT_IMPLEMENTED),
     op("get_latest_insights",                                        LocalOnly,   ControllerLocal,  REFUSED),
-    op("get_legacy_migration_report",                               LocalOnly,   ControllerLocal,  REFUSED),
-    op("get_legacy_migration_status",                               LocalOnly,   ControllerLocal,  REFUSED),
     op("get_mcp_prompt",                                             Unaudited,   Proxied,          CLI_NOT_IMPLEMENTED),
     op("get_mcp_remote_oauth_session",                               Unaudited,   Proxied,          CLI_NOT_IMPLEMENTED),
     op("get_mcp_server_status",                                      Unaudited,   Proxied,          CLI_NOT_IMPLEMENTED),
@@ -516,7 +514,6 @@ pub(super) const OPERATIONS: &[OperationDefinition] = &[
     op("plan_external_hook_import_command",                          Unsupported, Proxied,          CLI_NOT_IMPLEMENTED),
     op("plan_external_mcp_import_command",                           Unsupported, Proxied,          CLI_NOT_IMPLEMENTED),
     op("predownload_acp_client_adapter",                             Unaudited,   Proxied,          CLI_NOT_IMPLEMENTED),
-    op("prepare_legacy_migration",                                  LocalOnly,   ControllerLocal,  REFUSED),
     op("preview_commit_message",                                     Unaudited,   Proxied,          CLI_NOT_IMPLEMENTED),
     op("probe_acp_client_requirements",                              Unaudited,   Proxied,          CLI_NOT_IMPLEMENTED),
     op("product_control_invoke",                                     Agnostic,    Proxied,          HANDLED),
@@ -628,7 +625,6 @@ pub(super) const OPERATIONS: &[OperationDefinition] = &[
     op("save_session_metadata",                                      Unaudited,   Proxied,          HANDLED),
     op("save_session_turn",                                          Unaudited,   Proxied,          HANDLED),
     op("save_web_search_credential",                                 Agnostic,    Proxied,          HANDLED),
-    op("scan_legacy_migration",                                     LocalOnly,   ControllerLocal,  REFUSED),
     op("scan_workspace_info",                                        Unsupported, Proxied,          CLI_NOT_IMPLEMENTED),
     op("search_build_index",                                         Routed,      Proxied,          CLI_NO_DESKTOP_IDE_SURFACE),
     op("search_file_contents",                                       Routed,      Proxied,          CLI_NO_DESKTOP_IDE_SURFACE),
@@ -658,7 +654,6 @@ pub(super) const OPERATIONS: &[OperationDefinition] = &[
     op("set_external_tool_target_decision_command",                  Unsupported, Proxied,          HANDLED),
     op("set_external_tool_targets_enabled_command",                  Unsupported, Proxied,          HANDLED),
     op("set_global_skill_disabled",                                  Agnostic,    Proxied,          CLI_NOT_IMPLEMENTED),
-    op("set_legacy_migration_prompt_preference",                    LocalOnly,   ControllerLocal,  REFUSED),
     op("set_macos_edit_menu_mode",                                   LocalOnly,   Proxied,          CLI_NOT_IMPLEMENTED),
     op("set_main_window_transient_geometry",                         LocalOnly,   ControllerLocal,  REFUSED),
     op("set_miniapp_draft_storage",                                  Unaudited,   Proxied,          CLI_NOT_IMPLEMENTED),
diff --git a/src/crates/services/AGENTS.md b/src/crates/services/AGENTS.md
index 2edd3bceb8..cf1f85a738 100644
--- a/src/crates/services/AGENTS.md
+++ b/src/crates/services/AGENTS.md
@@ -13,7 +13,8 @@ OS/network capabilities.
 |---|---|---|
 | `services-core` | Reusable local service primitives, process-wide TLS provider selection, managed process-tree lifecycle, filesystem helpers, session storage layout/indexing/deletion, metadata store CRUD/index rebuild, metadata construction/counter/index/field mutation/lineage rules, and JSON file IO without product assembly decisions | [AGENTS.md](services-core/AGENTS.md) |
 | `services-integrations` | Concrete MCP, git, remote, file-watch, MiniApp runtime, review-platform provider service, product-domain port implementations, and platform-neutral Remote Connect primitives | [AGENTS.md](services-integrations/AGENTS.md) |
-| `legacy-migration` | Offline retired-product discovery, locking, consistent SQLite snapshots, staging, journal recovery, and owner-adapter orchestration | — |
+| `legacy-migration-adapters` | Offline legacy-data converters against shared configuration/storage owners, without Core | [AGENTS.md](legacy-migration-adapters/AGENTS.md) |
+| `legacy-migration` | Offline retired-product discovery, locking, consistent SQLite snapshots, staging, journal recovery, and owner-adapter orchestration | [AGENTS.md](legacy-migration/AGENTS.md) |
 | `miniapp-market-service` | Concrete SQLite, artifact storage, GitHub OAuth, package validation, and HTTP behavior for the MiniApp market | [README.md](miniapp-market-service/README.md) |
 | `skin-market-service` | Concrete SQLite, artifact storage, Appearance package validation, review, and HTTP behavior for the Skin market | [README.md](skin-market-service/README.md) |
 | `relay-service` | Reusable Remote Connect relay state, storage, and HTTP/WebSocket routes shared by standalone and embedded hosts | [AGENTS.md](relay-service/AGENTS.md) |
diff --git a/src/crates/services/legacy-migration-adapters/AGENTS.md b/src/crates/services/legacy-migration-adapters/AGENTS.md
new file mode 100644
index 0000000000..0194c780e9
--- /dev/null
+++ b/src/crates/services/legacy-migration-adapters/AGENTS.md
@@ -0,0 +1,15 @@
+# Offline migration adapters
+
+Own concrete BitFun readers and converters against shared storage contracts.
+No Core, product assembly, application host, or live Agent/session lifecycle.
+Agent Runtime may be consumed only with definition-contracts for static Agent
+and Skill parsing. Stored connection imports never connect to remote hosts.
+Keep original source-read-only behavior, atomic domain writes, idempotent journal
+recovery, reference repair and target conflict rules. Share storage formats with
+config-contracts and services-core; do not copy private application schemas.
+
+Focused verification:
+
+```bash
+cargo test -p openbitfun-legacy-migration-adapters --lib
+```
diff --git a/src/crates/services/legacy-migration-adapters/Cargo.toml b/src/crates/services/legacy-migration-adapters/Cargo.toml
new file mode 100644
index 0000000000..8e622ae2ec
--- /dev/null
+++ b/src/crates/services/legacy-migration-adapters/Cargo.toml
@@ -0,0 +1,30 @@
+[package]
+name = "openbitfun-legacy-migration-adapters"
+version.workspace = true
+edition.workspace = true
+description = "Offline BitFun data conversion and current storage owner adapters"
+
+[dependencies]
+openbitfun-config-contracts = { path = "../../contracts/config-contracts" }
+openbitfun-legacy-migration = { path = "../legacy-migration" }
+openbitfun-core-types = { path = "../../contracts/core-types" }
+openbitfun-product-domains = { path = "../../contracts/product-domains", features = ["legacy-migration", "miniapp"] }
+openbitfun-services-core = { path = "../services-core", features = ["local-storage", "memory-store", "workspace-persistence", "coordination-store", "session-event-format"] }
+openbitfun-services-integrations = { path = "../services-integrations", features = ["miniapp-storage", "remote-persistence"] }
+openbitfun-agent-runtime = { path = "../../execution/agent-runtime", features = ["definition-contracts"] }
+serde = { workspace = true }
+serde_json = { workspace = true }
+sha2 = { workspace = true }
+hex = { workspace = true }
+chrono = { workspace = true }
+uuid = { workspace = true }
+anyhow = { workspace = true }
+dunce = { workspace = true }
+rusqlite = { workspace = true, features = ["backup", "bundled"] }
+tokio = { workspace = true, features = ["rt"] }
+
+[dev-dependencies]
+tempfile = { workspace = true }
+
+[lints]
+workspace = true
diff --git a/src/crates/assembly/core/src/legacy_migration/agent_coordination.rs b/src/crates/services/legacy-migration-adapters/src/agent_coordination.rs
similarity index 99%
rename from src/crates/assembly/core/src/legacy_migration/agent_coordination.rs
rename to src/crates/services/legacy-migration-adapters/src/agent_coordination.rs
index 14da87d8d0..dd3daf30d3 100644
--- a/src/crates/assembly/core/src/legacy_migration/agent_coordination.rs
+++ b/src/crates/services/legacy-migration-adapters/src/agent_coordination.rs
@@ -6,10 +6,6 @@ use super::workspace_sessions::{
     read_workspace_sessions_manifest, target_wins_session_ids, SessionImportAction,
     WorkspaceSessionsManifest,
 };
-use crate::service::coordination_persistence::{
-    coordination_table_has_column, initialize_coordination_schema, validate_coordination_agent_id,
-    COORDINATION_SCHEMA_VERSION,
-};
 use openbitfun_core_types::validate_session_id;
 use openbitfun_legacy_migration::{
     atomic_write_bytes, atomic_write_json, snapshot_sqlite_read_only, validate_sqlite,
@@ -20,6 +16,10 @@ use openbitfun_product_domains::legacy_migration::{
     ConflictResolution, FindingSeverity, MigrationConflict, MigrationDomainId,
     MigrationDomainResult, MigrationDomainState, ScanFinding,
 };
+use openbitfun_services_core::coordination_persistence::{
+    coordination_table_has_column, initialize_coordination_schema, validate_coordination_agent_id,
+    COORDINATION_SCHEMA_VERSION,
+};
 use rusqlite::{params, Connection, OpenFlags, OptionalExtension, Transaction};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
@@ -1598,11 +1598,7 @@ fn db_error(path: &Path, error: rusqlite::Error) -> LegacyMigrationError {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::legacy_migration::adapters_for_groups;
-    use crate::service::session_projection_format::validate_runtime_event_log;
-    use crate::service::workspace::persistence::{
-        validate_workspace_persistence_data, WorkspacePersistenceData,
-    };
+    use crate::adapters_for_groups;
     use openbitfun_legacy_migration::{
         probe_legacy_source, CancellationToken, CrashInjector, CrashPoint, MigrationEngine,
         NoCrashInjection, ProbeLimits,
@@ -1611,6 +1607,10 @@ mod tests {
         MigrationGroupId, MigrationRunStatus, MigrationSelection,
     };
     use openbitfun_services_core::session::OfflineSessionImportStore;
+    use openbitfun_services_core::session_projection_format::validate_runtime_event_log;
+    use openbitfun_services_core::workspace_persistence::{
+        validate_workspace_persistence_data, WorkspacePersistenceData,
+    };
     use std::io::Read;
     use std::sync::atomic::{AtomicBool, Ordering};
 
diff --git a/src/crates/assembly/core/src/legacy_migration/common.rs b/src/crates/services/legacy-migration-adapters/src/common.rs
similarity index 100%
rename from src/crates/assembly/core/src/legacy_migration/common.rs
rename to src/crates/services/legacy-migration-adapters/src/common.rs
diff --git a/src/crates/assembly/core/src/legacy_migration/extensions.rs b/src/crates/services/legacy-migration-adapters/src/extensions.rs
similarity index 99%
rename from src/crates/assembly/core/src/legacy_migration/extensions.rs
rename to src/crates/services/legacy-migration-adapters/src/extensions.rs
index 05a5e27f8e..be00f2b82a 100644
--- a/src/crates/assembly/core/src/legacy_migration/extensions.rs
+++ b/src/crates/services/legacy-migration-adapters/src/extensions.rs
@@ -1528,7 +1528,7 @@ fn io(path: &Path, error: std::io::Error) -> LegacyMigrationError {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::legacy_migration::adapters_for_groups;
+    use crate::adapters_for_groups;
     use openbitfun_legacy_migration::{
         probe_legacy_source, CancellationToken, MigrationEngine, NoCrashInjection, ProbeLimits,
     };
diff --git a/src/crates/services/legacy-migration-adapters/src/lib.rs b/src/crates/services/legacy-migration-adapters/src/lib.rs
new file mode 100644
index 0000000000..e1e10c3cd8
--- /dev/null
+++ b/src/crates/services/legacy-migration-adapters/src/lib.rs
@@ -0,0 +1,137 @@
+//! Offline legacy BitFun format adapters.
+//!
+//! The generic service crate owns offline orchestration and filesystem safety;
+//! this crate binds readers and converters to shared data contracts and storage
+//! services without selecting or starting any product runtime.
+
+mod agent_coordination;
+mod common;
+mod extensions;
+mod memory;
+mod remote_connect;
+mod remote_ssh;
+mod settings;
+mod workspace_sessions;
+
+use openbitfun_legacy_migration::{
+    DomainContext, DomainScan, LegacyDomainAdapter, LegacyMigrationResult, MigrationRoots,
+};
+use openbitfun_product_domains::legacy_migration::{
+    FindingSeverity, MigrationDomainId, MigrationDomainResult, MigrationDomainState,
+    MigrationGroupId, MigrationSelection, ScanFinding,
+};
+
+pub fn adapters_for_groups(selection: &MigrationSelection) -> Vec<Box<dyn LegacyDomainAdapter>> {
+    let selected = selection.expanded_domains();
+    let mut adapters: Vec<Box<dyn LegacyDomainAdapter>> = Vec::new();
+    if selected.contains(&MigrationDomainId::Settings) {
+        adapters.push(Box::new(settings::SettingsAdapter));
+    }
+    if selected.contains(&MigrationDomainId::Credentials) {
+        adapters.push(Box::new(settings::CredentialsAdapter));
+    }
+    if selected.contains(&MigrationDomainId::Skills) {
+        adapters.push(Box::new(extensions::SkillsAdapter));
+    }
+    if selected.contains(&MigrationDomainId::Miniapps) {
+        adapters.push(Box::new(extensions::MiniappsAdapter));
+    }
+    if selected.contains(&MigrationDomainId::Agents) {
+        adapters.push(Box::new(extensions::AgentsAdapter));
+    }
+    if selected.contains(&MigrationDomainId::WorkspaceSessions) {
+        adapters.push(Box::new(workspace_sessions::WorkspaceSessionsAdapter));
+    }
+    if selected.contains(&MigrationDomainId::AgentCoordination) {
+        adapters.push(Box::new(agent_coordination::AgentCoordinationAdapter));
+    }
+    if selected.contains(&MigrationDomainId::StructuredMemory) {
+        adapters.push(Box::new(memory::StructuredMemoryAdapter));
+    }
+    if selected.contains(&MigrationDomainId::FileMemory) {
+        adapters.push(Box::new(memory::FileMemoryAdapter));
+    }
+    if selected.contains(&MigrationDomainId::RemoteConnectDevices) {
+        adapters.push(Box::new(remote_connect::RemoteConnectAdapter));
+    }
+    if selected.contains(&MigrationDomainId::RemoteSsh) {
+        adapters.push(Box::new(remote_ssh::RemoteSshAdapter));
+    }
+    if selected.contains(&MigrationDomainId::CrossReferenceRepair) {
+        adapters.push(Box::new(CrossReferenceAdapter));
+    }
+    adapters
+}
+
+/// Fail closed before any domain writes when the destination belongs to an
+/// unknown product/schema. Empty destinations are initialized by the adapters.
+pub fn validate_target(roots: &MigrationRoots) -> LegacyMigrationResult<()> {
+    use openbitfun_legacy_migration::LegacyMigrationError;
+    let path = roots.target_user_root.join("config/app.json");
+    let bytes = match std::fs::read(&path) {
+        Ok(bytes) => bytes,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(()),
+        Err(source) => return Err(LegacyMigrationError::Io { path, source }),
+    };
+    let value = serde_json::from_slice(&bytes)
+        .map_err(|source| LegacyMigrationError::Json { path, source })?;
+    openbitfun_config_contracts::validate_current_config_value(&value, "migration destination")
+        .map_err(LegacyMigrationError::UnsupportedTarget)
+}
+
+struct CrossReferenceAdapter;
+
+impl LegacyDomainAdapter for CrossReferenceAdapter {
+    fn domain(&self) -> MigrationDomainId {
+        MigrationDomainId::CrossReferenceRepair
+    }
+
+    fn scan(&self, _roots: &MigrationRoots) -> LegacyMigrationResult<DomainScan> {
+        Ok(DomainScan {
+            finding: ScanFinding {
+                domain: self.domain(),
+                code: "cross_reference_validation_enabled".to_string(),
+                severity: FindingSeverity::Info,
+                migratable: true,
+                detail: "Selected owner adapters will be checked after their atomic commits."
+                    .to_string(),
+                ..ScanFinding::default()
+            },
+            conflicts: Vec::new(),
+            target_schema: Some("openbitfun.cross-references.current".to_string()),
+            dependencies: Vec::new(),
+        })
+    }
+
+    fn stage(&self, _context: &DomainContext<'_>) -> LegacyMigrationResult<MigrationDomainResult> {
+        Ok(MigrationDomainResult {
+            domain: self.domain(),
+            state: MigrationDomainState::Staged,
+            ..MigrationDomainResult::default()
+        })
+    }
+
+    fn validate_stage(&self, context: &DomainContext<'_>) -> LegacyMigrationResult<()> {
+        validate_selected_cross_references(context)
+    }
+
+    fn commit(&self, _context: &DomainContext<'_>) -> LegacyMigrationResult<()> {
+        Ok(())
+    }
+
+    fn validate_commit(&self, context: &DomainContext<'_>) -> LegacyMigrationResult<()> {
+        validate_selected_cross_references(context)
+    }
+}
+
+fn validate_selected_cross_references(context: &DomainContext<'_>) -> LegacyMigrationResult<()> {
+    if context
+        .plan
+        .selection
+        .groups
+        .contains(&MigrationGroupId::WorkspacesSessionsAndTasks)
+    {
+        agent_coordination::validate_committed_coordination_cross_references(context)?;
+    }
+    Ok(())
+}
diff --git a/src/crates/assembly/core/src/legacy_migration/memory.rs b/src/crates/services/legacy-migration-adapters/src/memory.rs
similarity index 99%
rename from src/crates/assembly/core/src/legacy_migration/memory.rs
rename to src/crates/services/legacy-migration-adapters/src/memory.rs
index b740ebd1d2..bf84db69d6 100644
--- a/src/crates/assembly/core/src/legacy_migration/memory.rs
+++ b/src/crates/services/legacy-migration-adapters/src/memory.rs
@@ -1335,7 +1335,7 @@ fn owner_error(error: impl std::fmt::Display) -> LegacyMigrationError {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::legacy_migration::adapters_for_groups;
+    use crate::adapters_for_groups;
     use openbitfun_legacy_migration::{
         probe_legacy_source, CancellationToken, CrashInjector, CrashPoint, MigrationEngine,
         NoCrashInjection, ProbeLimits,
diff --git a/src/crates/assembly/core/src/legacy_migration/remote_connect.rs b/src/crates/services/legacy-migration-adapters/src/remote_connect.rs
similarity index 99%
rename from src/crates/assembly/core/src/legacy_migration/remote_connect.rs
rename to src/crates/services/legacy-migration-adapters/src/remote_connect.rs
index 11d8a3026a..eb1f7fc955 100644
--- a/src/crates/assembly/core/src/legacy_migration/remote_connect.rs
+++ b/src/crates/services/legacy-migration-adapters/src/remote_connect.rs
@@ -1159,7 +1159,7 @@ fn reset_stage(context: &DomainContext<'_>) -> LegacyMigrationResult<()> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::legacy_migration::adapters_for_groups;
+    use crate::adapters_for_groups;
     use openbitfun_legacy_migration::{
         probe_legacy_source, CancellationToken, CrashInjector, CrashPoint, LegacyMigrationError,
         MigrationEngine, NoCrashInjection, ProbeLimits,
diff --git a/src/crates/assembly/core/src/legacy_migration/remote_ssh.rs b/src/crates/services/legacy-migration-adapters/src/remote_ssh.rs
similarity index 99%
rename from src/crates/assembly/core/src/legacy_migration/remote_ssh.rs
rename to src/crates/services/legacy-migration-adapters/src/remote_ssh.rs
index 6426cace95..d2e6243135 100644
--- a/src/crates/assembly/core/src/legacy_migration/remote_ssh.rs
+++ b/src/crates/services/legacy-migration-adapters/src/remote_ssh.rs
@@ -895,7 +895,7 @@ fn read_manifest(context: &DomainContext<'_>) -> LegacyMigrationResult<RemoteSsh
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::legacy_migration::adapters_for_groups;
+    use crate::adapters_for_groups;
     use openbitfun_legacy_migration::{
         probe_legacy_source, CancellationToken, MigrationEngine, NoCrashInjection, ProbeLimits,
     };
diff --git a/src/crates/assembly/core/src/legacy_migration/settings.rs b/src/crates/services/legacy-migration-adapters/src/settings.rs
similarity index 99%
rename from src/crates/assembly/core/src/legacy_migration/settings.rs
rename to src/crates/services/legacy-migration-adapters/src/settings.rs
index 071c17fe91..92957fa121 100644
--- a/src/crates/assembly/core/src/legacy_migration/settings.rs
+++ b/src/crates/services/legacy-migration-adapters/src/settings.rs
@@ -2,8 +2,8 @@ use super::common::{
     backup_domain_dir, backup_file_once, read_bounded_json, read_optional_bounded_json,
     restore_unverified_file, stage_domain_dir,
 };
-use crate::service::config::manager::validate_current_config_value;
-use crate::service::config::types::{AIModelConfig, GlobalConfig};
+use openbitfun_config_contracts::validate_current_config_value;
+use openbitfun_config_contracts::{AIModelConfig, GlobalConfig};
 use openbitfun_legacy_migration::{
     atomic_write_json, DomainContext, DomainScan, LegacyDomainAdapter, LegacyMigrationError,
     LegacyMigrationResult, MigrationRoots,
@@ -871,7 +871,7 @@ fn credentials_backup_path(context: &DomainContext<'_>) -> PathBuf {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::legacy_migration::adapters_for_groups;
+    use crate::adapters_for_groups;
     use openbitfun_legacy_migration::{
         probe_legacy_source, CancellationToken, MigrationEngine, NoCrashInjection, ProbeLimits,
     };
diff --git a/src/crates/assembly/core/src/legacy_migration/workspace_sessions.rs b/src/crates/services/legacy-migration-adapters/src/workspace_sessions.rs
similarity index 98%
rename from src/crates/assembly/core/src/legacy_migration/workspace_sessions.rs
rename to src/crates/services/legacy-migration-adapters/src/workspace_sessions.rs
index bdd3dc4dc6..eb16a99f18 100644
--- a/src/crates/assembly/core/src/legacy_migration/workspace_sessions.rs
+++ b/src/crates/services/legacy-migration-adapters/src/workspace_sessions.rs
@@ -2,13 +2,6 @@ use super::common::{
     backup_domain_dir, backup_file_once, io_error, read_bounded_json, read_optional_bounded_json,
     relative_display, restore_unverified_file, stage_domain_dir, validate_regular_file,
 };
-use crate::infrastructure::app_paths::PathManager;
-use crate::service::session_projection_format::validate_runtime_event_log;
-use crate::service::workspace::persistence::{
-    current_workspace_storage_id, validate_workspace_persistence_data, WorkspacePersistenceData,
-    WORKSPACE_PERSISTENCE_FORMAT_VERSION,
-};
-use crate::service::workspace::{PrimaryAssistantKey, WorkspaceInfo, WorkspaceKind};
 use openbitfun_core_types::product_identity::product_id;
 use openbitfun_core_types::validate_session_id;
 use openbitfun_legacy_migration::{
@@ -23,9 +16,18 @@ use openbitfun_services_core::session::{
     OfflineSessionBundle, OfflineSessionImportStore, SessionMetadata, SessionRelationship,
     StoredDialogTurnFile, StoredSessionMetadataFile, SESSION_STORAGE_SCHEMA_VERSION,
 };
+use openbitfun_services_core::session_projection_format::validate_runtime_event_log;
+use openbitfun_services_core::workspace_identity::build_project_runtime_slug;
 use openbitfun_services_core::workspace_identity::{
     canonicalize_local_workspace_root, normalize_remote_workspace_path, LOCAL_WORKSPACE_SSH_HOST,
 };
+use openbitfun_services_core::workspace_persistence::{
+    current_workspace_storage_id, validate_workspace_persistence_data, WorkspacePersistenceData,
+    WORKSPACE_PERSISTENCE_FORMAT_VERSION,
+};
+use openbitfun_services_core::workspace_records::{
+    PrimaryAssistantKey, WorkspaceInfo, WorkspaceKind,
+};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
@@ -919,8 +921,23 @@ fn relocate_json_path(
 }
 
 fn assistant_session_runtime_relative(workspace_path: PathBuf) -> PathBuf {
-    let canonical = dunce::canonicalize(&workspace_path).unwrap_or(workspace_path);
-    let slug = PathManager::build_project_runtime_slug(&canonical.to_string_lossy());
+    // New destinations do not exist during planning. Resolve the existing
+    // parent and rebuild native separators so the slug hash matches the path
+    // Desktop will canonicalize after commit (including long Windows paths).
+    let mut parent = workspace_path.as_path();
+    let mut suffix = Vec::new();
+    while !parent.exists() {
+        let (Some(name), Some(next)) = (parent.file_name(), parent.parent()) else {
+            break;
+        };
+        suffix.push(name);
+        parent = next;
+    }
+    let mut canonical = dunce::canonicalize(parent).unwrap_or_else(|_| parent.to_path_buf());
+    for component in suffix.into_iter().rev() {
+        canonical.push(component);
+    }
+    let slug = build_project_runtime_slug(&canonical.to_string_lossy());
     PathBuf::from("projects").join(slug).join("sessions")
 }
 
@@ -1926,6 +1943,15 @@ mod tests {
             .starts_with("remote_"));
     }
 
+    #[test]
+    fn assistant_runtime_slug_is_stable_before_and_after_target_creation() {
+        let temp = test_tempdir("assistant-slug");
+        let target = temp.path().join("long-destination-component-for-hashed-runtime-slug/personal_assistant/workspace-assistant");
+        let planned = assistant_session_runtime_relative(target.clone());
+        fs::create_dir_all(&target).unwrap();
+        assert_eq!(planned, assistant_session_runtime_relative(target));
+    }
+
     #[test]
     fn personal_assistant_tree_and_session_paths_are_rehomed_together() {
         let temp = test_tempdir("personal-assistant");
diff --git a/src/crates/services/legacy-migration/AGENTS.md b/src/crates/services/legacy-migration/AGENTS.md
index fab8de408d..871c650cb5 100644
--- a/src/crates/services/legacy-migration/AGENTS.md
+++ b/src/crates/services/legacy-migration/AGENTS.md
@@ -1,21 +1,25 @@
-# Legacy migration service
+# Offline migration engine
 
-This crate owns local offline migration primitives, authenticated handoffs, and
-writer-process inspection. Keep product selection and UI in their existing
-assembly and app owners.
+Own bounded source discovery, durable tasks, snapshot/staging/backup/journal IO,
+atomic commit and safe cancellation. Never initialize the main product runtime.
+Historical handoff and onboarding files remain readable compatibility formats;
+new standalone tasks use save_task/load_task and do not depend on request expiry.
+Do not delete or reset corrupt plans, reports or user data. Validate UUIDs and
+plan identities before using task paths. Keep source/destination isolation.
 
 Process inspection must fail explicitly when inventory is unavailable. Never
 interpret an inspection error as an empty writer list. On macOS, inspect executable
 names with the system `ps`, preserving full bundle paths and excluding arguments.
 
-## Focused verification
-
-For process inventory, writer classification, and handoff changes:
+Focused verification:
 
 ```bash
-cargo test -p openbitfun-legacy-migration --lib handoff::tests
+cargo test -p openbitfun-legacy-migration --lib
+cargo test -p openbitfun-legacy-migration --test migration_engine_contracts
 ```
 
+For process inventory, writer classification, and handoff changes, use
+`cargo test -p openbitfun-legacy-migration --lib handoff::tests`.
 The macOS inventory test exercises the real host process list and must run on
 macOS; parser and classification fixtures run on all test platforms. These local
 checks do not establish remote-workspace, remote-control, peer, or dispatch behavior.
diff --git a/src/crates/services/legacy-migration/src/error.rs b/src/crates/services/legacy-migration/src/error.rs
index ad189c8bde..0750858629 100644
--- a/src/crates/services/legacy-migration/src/error.rs
+++ b/src/crates/services/legacy-migration/src/error.rs
@@ -11,6 +11,8 @@ pub enum LegacyMigrationError {
     SourceEqualsTarget(PathBuf),
     #[error("legacy source format is unsupported: {0}")]
     UnsupportedSource(String),
+    #[error("unsupported migration destination: {0}")]
+    UnsupportedTarget(String),
     #[error("legacy migration request is invalid: {0}")]
     InvalidRequest(String),
     #[error("legacy migration plan is invalid: {0}")]
diff --git a/src/crates/services/legacy-migration/src/handoff.rs b/src/crates/services/legacy-migration/src/handoff.rs
index a3c7f220ee..baee6062c3 100644
--- a/src/crates/services/legacy-migration/src/handoff.rs
+++ b/src/crates/services/legacy-migration/src/handoff.rs
@@ -612,7 +612,9 @@ fn classify_writer_processes(
         .iter()
         .filter(|entry| entry.process_id != current_process_id)
         .filter_map(|entry| {
-            let is_handoff_caller = entry.process_id == caller_process_id;
+            // Zero means an independent launch with no caller. Windows exposes
+            // the System Idle Process at PID 0; it must never block migration.
+            let is_handoff_caller = caller_process_id != 0 && entry.process_id == caller_process_id;
             let known_writer = WRITER_EXECUTABLE_NAMES
                 .iter()
                 .chain(product_writer_binary_names.iter())
@@ -1109,6 +1111,28 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn standalone_process_check_does_not_wait_for_windows_idle_or_itself() {
+        let processes = vec![
+            ProcessEntry {
+                process_id: 0,
+                executable_name: "System Idle Process".into(),
+            },
+            ProcessEntry {
+                process_id: 42,
+                executable_name: "openbitfun-data-migrator.exe".into(),
+            },
+            ProcessEntry {
+                process_id: 81,
+                executable_name: "openbitfun.exe".into(),
+            },
+        ];
+        let blockers = classify_writer_processes(&processes, 0, 42, &[]);
+        assert_eq!(blockers.len(), 1);
+        assert_eq!(blockers[0].process_id, 81);
+        assert!(!blockers[0].is_handoff_caller);
+    }
+
     #[test]
     fn process_classifier_keeps_caller_and_known_writers_only() {
         let processes = vec![
diff --git a/src/crates/services/legacy-migration/src/lib.rs b/src/crates/services/legacy-migration/src/lib.rs
index 0a319fc003..ad1e316f42 100644
--- a/src/crates/services/legacy-migration/src/lib.rs
+++ b/src/crates/services/legacy-migration/src/lib.rs
@@ -9,6 +9,7 @@ mod paths;
 mod probe;
 mod sqlite;
 mod storage;
+mod tasks;
 
 pub use diagnostics::{export_failure_diagnostics, release_observation};
 pub use engine::{
@@ -26,3 +27,4 @@ pub use paths::{MigrationRoots, LEGACY_PRODUCT_ID};
 pub use probe::{probe_legacy_source, ProbeLimits};
 pub use sqlite::{snapshot_sqlite_read_only, validate_sqlite};
 pub use storage::{atomic_write_bytes, atomic_write_json, MigrationLayout, MigrationLock};
+pub use tasks::{list_tasks, load_task, save_task, SavedMigrationTask};
diff --git a/src/crates/services/legacy-migration/src/paths.rs b/src/crates/services/legacy-migration/src/paths.rs
index a180a875ac..e4dbaac88f 100644
--- a/src/crates/services/legacy-migration/src/paths.rs
+++ b/src/crates/services/legacy-migration/src/paths.rs
@@ -6,7 +6,8 @@ use std::path::{Path, PathBuf};
 pub const LEGACY_PRODUCT_ID: &str = "bitfun";
 const LEGACY_HIDDEN_DATA_DIRECTORY: &str = ".bitfun";
 
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
 pub struct MigrationRoots {
     pub legacy_user_root: PathBuf,
     pub legacy_home_root: PathBuf,
@@ -20,6 +21,13 @@ pub struct MigrationRoots {
 
 impl MigrationRoots {
     pub fn resolve_current_user() -> LegacyMigrationResult<Self> {
+        let roots = Self::current_user_locations()?;
+        roots.validate_distinct()?;
+        Ok(roots)
+    }
+
+    /// Resolve locations without rejecting editable user overrides at UI startup.
+    pub fn current_user_locations() -> LegacyMigrationResult<Self> {
         let config_root = dirs::config_dir().ok_or_else(|| {
             LegacyMigrationError::PathUnavailable("platform config directory".to_string())
         })?;
@@ -62,7 +70,6 @@ impl MigrationRoots {
             target_skills_root,
             target_ssh_root,
         };
-        roots.validate_distinct()?;
         Ok(roots)
     }
 
diff --git a/src/crates/services/legacy-migration/src/tasks.rs b/src/crates/services/legacy-migration/src/tasks.rs
new file mode 100644
index 0000000000..f3cdc034cc
--- /dev/null
+++ b/src/crates/services/legacy-migration/src/tasks.rs
@@ -0,0 +1,291 @@
+//! Durable offline tasks. Plans and journals remain compatible with older runs;
+//! no expiring launch request, caller process, or Desktop lifecycle is involved.
+use crate::{
+    atomic_write_json, compute_plan_hash, LegacyMigrationError, LegacyMigrationResult,
+    MigrationLayout, MigrationRoots,
+};
+use openbitfun_product_domains::legacy_migration::{
+    MigrationPlan, MigrationRunReport, MigrationRunStatus, CURRENT_MIGRATION_FORMAT_VERSION,
+};
+use serde::Serialize;
+use std::fs;
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SavedMigrationTask {
+    pub run_id: String,
+    pub status: MigrationRunStatus,
+    pub readable: bool,
+}
+
+pub fn save_task(roots: &MigrationRoots, plan: &MigrationPlan) -> LegacyMigrationResult<()> {
+    validate_plan(plan, &plan.run_id)?;
+    let layout = MigrationLayout::new(roots, &plan.run_id);
+    if let Some(existing) = layout.read_json::<MigrationPlan>(&layout.plan_path())? {
+        if existing != *plan {
+            return Err(invalid("a saved task has a different plan"));
+        }
+    }
+    validate_locations(&layout, roots)?;
+    layout.initialize()?;
+    atomic_write_json(&layout.run_root().join("locations.json"), roots)?;
+    atomic_write_json(&layout.plan_path(), plan)
+}
+
+pub fn load_task(
+    roots: &MigrationRoots,
+    run_id: &str,
+) -> LegacyMigrationResult<(MigrationPlan, Option<MigrationRunReport>)> {
+    validate_id(run_id)?;
+    let layout = MigrationLayout::new(roots, run_id);
+    let plan = layout
+        .read_json::<MigrationPlan>(&layout.plan_path())?
+        .ok_or_else(|| invalid("saved plan missing"))?;
+    validate_plan(&plan, run_id)?;
+    // Older handoff-based runs did not carry this file. Their plan and journal
+    // remain readable using the locations explicitly selected by the user.
+    validate_locations(&layout, roots)?;
+    let report = layout.read_json::<MigrationRunReport>(&layout.report_path())?;
+    if let Some(report) = &report {
+        if report.run_id != run_id
+            || report.plan_hash != plan.plan_hash
+            || report.source_fingerprint != plan.source_fingerprint
+            || report.format_version != CURRENT_MIGRATION_FORMAT_VERSION
+        {
+            return Err(invalid("saved report does not match the plan"));
+        }
+    }
+    Ok((plan, report))
+}
+
+pub fn list_tasks(roots: &MigrationRoots) -> LegacyMigrationResult<Vec<SavedMigrationTask>> {
+    let directory = roots.migration_root().join("runs");
+    let entries = match fs::read_dir(&directory) {
+        Ok(entries) => entries,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(Vec::new()),
+        Err(error) => return Err(LegacyMigrationError::io(&directory, error)),
+    };
+    let mut tasks = Vec::new();
+    for entry in entries {
+        let entry = entry.map_err(|error| LegacyMigrationError::io(&directory, error))?;
+        if !entry
+            .file_type()
+            .map_err(|error| LegacyMigrationError::io(entry.path(), error))?
+            .is_dir()
+        {
+            continue;
+        }
+        let run_id = entry.file_name().to_string_lossy().into_owned();
+        if validate_id(&run_id).is_err() || !entry.path().join("plan.json").exists() {
+            continue;
+        }
+        let loaded = load_task(roots, &run_id);
+        tasks.push(SavedMigrationTask {
+            run_id,
+            status: loaded
+                .as_ref()
+                .ok()
+                .and_then(|(_, report)| report.as_ref().map(|report| report.status))
+                .unwrap_or(MigrationRunStatus::Planned),
+            readable: loaded.is_ok(),
+        });
+    }
+    tasks.sort_by(|a, b| a.run_id.cmp(&b.run_id));
+    Ok(tasks)
+}
+
+fn validate_id(run_id: &str) -> LegacyMigrationResult<()> {
+    if uuid::Uuid::parse_str(run_id).is_err() {
+        return Err(invalid("invalid task identifier"));
+    }
+    Ok(())
+}
+fn validate_plan(plan: &MigrationPlan, run_id: &str) -> LegacyMigrationResult<()> {
+    validate_id(run_id)?;
+    if plan.run_id != run_id
+        || plan.source_fingerprint.is_empty()
+        || plan.format_version != CURRENT_MIGRATION_FORMAT_VERSION
+        || compute_plan_hash(plan)? != plan.plan_hash
+    {
+        return Err(invalid("saved plan identity, version, or hash mismatch"));
+    }
+    Ok(())
+}
+fn validate_locations(
+    layout: &MigrationLayout,
+    roots: &MigrationRoots,
+) -> LegacyMigrationResult<()> {
+    if let Some(saved) =
+        layout.read_json::<MigrationRoots>(&layout.run_root().join("locations.json"))?
+    {
+        if saved != *roots {
+            return Err(invalid(
+                "restore the original task locations before resuming",
+            ));
+        }
+    }
+    Ok(())
+}
+fn invalid(message: &str) -> LegacyMigrationError {
+    LegacyMigrationError::InvalidPlan(message.into())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::Path;
+
+    fn roots(root: &Path) -> MigrationRoots {
+        MigrationRoots {
+            legacy_user_root: root.join("legacy/user"),
+            legacy_home_root: root.join("legacy/home"),
+            legacy_skills_root: root.join("legacy/skills"),
+            legacy_ssh_root: root.join("legacy/ssh"),
+            target_user_root: root.join("target/user"),
+            target_home_root: root.join("target/home"),
+            target_skills_root: root.join("target/skills"),
+            target_ssh_root: root.join("target/ssh"),
+        }
+    }
+
+    fn plan() -> MigrationPlan {
+        let mut plan = MigrationPlan {
+            format_version: CURRENT_MIGRATION_FORMAT_VERSION,
+            run_id: uuid::Uuid::new_v4().to_string(),
+            source_fingerprint: "sha256:archived-source".into(),
+            ..MigrationPlan::default()
+        };
+        plan.plan_hash = compute_plan_hash(&plan).unwrap();
+        plan
+    }
+
+    #[test]
+    fn independent_task_reopens_with_report_and_journal_without_a_launch_request() {
+        let temp = tempfile::tempdir().unwrap();
+        let roots = roots(temp.path());
+        let plan = plan();
+        save_task(&roots, &plan).unwrap();
+        let layout = MigrationLayout::new(&roots, &plan.run_id);
+        let journal = b"{\"event\":\"committed\"}\n";
+        fs::write(layout.journal_path(), journal).unwrap();
+        let report = MigrationRunReport {
+            format_version: CURRENT_MIGRATION_FORMAT_VERSION,
+            run_id: plan.run_id.clone(),
+            plan_hash: plan.plan_hash.clone(),
+            source_fingerprint: plan.source_fingerprint.clone(),
+            status: MigrationRunStatus::FailedRecoverable,
+            ..MigrationRunReport::default()
+        };
+        atomic_write_json(&layout.report_path(), &report).unwrap();
+        assert!(!layout.request_path().exists());
+        assert_eq!(
+            load_task(&roots, &plan.run_id).unwrap(),
+            (plan.clone(), Some(report))
+        );
+        let tasks = list_tasks(&roots).unwrap();
+        assert_eq!(tasks.len(), 1);
+        assert!(tasks[0].readable);
+        assert_eq!(tasks[0].status, MigrationRunStatus::FailedRecoverable);
+        save_task(&roots, &plan).unwrap();
+        assert_eq!(fs::read(layout.journal_path()).unwrap(), journal);
+    }
+
+    #[test]
+    fn legacy_plan_without_locations_ignores_expired_handoff_and_keeps_it_intact() {
+        let temp = tempfile::tempdir().unwrap();
+        let roots = roots(temp.path());
+        let plan = plan();
+        let layout = MigrationLayout::new(&roots, &plan.run_id);
+        // Old releases persisted plan.json without per-task locations metadata.
+        atomic_write_json(&layout.plan_path(), &plan).unwrap();
+        let old_request = br#"{"expiresAtMs":1,"requestVersion":1}"#;
+        fs::write(layout.request_path(), old_request).unwrap();
+        assert_eq!(
+            load_task(&roots, &plan.run_id).unwrap(),
+            (plan.clone(), None)
+        );
+        assert!(!layout.run_root().join("locations.json").exists());
+        assert_eq!(fs::read(layout.request_path()).unwrap(), old_request);
+    }
+
+    #[test]
+    fn changed_locations_and_source_cannot_replace_a_saved_task() {
+        let temp = tempfile::tempdir().unwrap();
+        let mut roots = roots(temp.path());
+        let plan = plan();
+        save_task(&roots, &plan).unwrap();
+        let layout = MigrationLayout::new(&roots, &plan.run_id);
+        let metadata = fs::read(layout.run_root().join("locations.json")).unwrap();
+        let original_plan = fs::read(layout.plan_path()).unwrap();
+        roots.legacy_home_root = temp.path().join("other-source");
+        assert!(load_task(&roots, &plan.run_id).is_err());
+        assert!(save_task(&roots, &plan).is_err());
+        let mut changed = plan.clone();
+        changed.source_fingerprint = "sha256:another-source".into();
+        changed.plan_hash = compute_plan_hash(&changed).unwrap();
+        assert!(save_task(&roots, &changed).is_err());
+        assert_eq!(
+            fs::read(layout.run_root().join("locations.json")).unwrap(),
+            metadata
+        );
+        assert_eq!(fs::read(layout.plan_path()).unwrap(), original_plan);
+    }
+
+    #[test]
+    fn unknown_and_corrupt_records_are_listed_as_unreadable_and_preserved() {
+        let temp = tempfile::tempdir().unwrap();
+        let roots = roots(temp.path());
+        for corruption in [
+            "json",
+            "version",
+            "hash",
+            "report-identity",
+            "report-version",
+        ] {
+            let plan = plan();
+            save_task(&roots, &plan).unwrap();
+            let layout = MigrationLayout::new(&roots, &plan.run_id);
+            let path = if corruption.starts_with("report") {
+                let mut report = MigrationRunReport {
+                    format_version: CURRENT_MIGRATION_FORMAT_VERSION,
+                    run_id: plan.run_id.clone(),
+                    plan_hash: plan.plan_hash.clone(),
+                    source_fingerprint: plan.source_fingerprint.clone(),
+                    ..MigrationRunReport::default()
+                };
+                if corruption == "report-version" {
+                    report.format_version += 1;
+                } else {
+                    report.source_fingerprint = "other-source".into();
+                }
+                atomic_write_json(&layout.report_path(), &report).unwrap();
+                layout.report_path()
+            } else {
+                let mut value = serde_json::to_value(&plan).unwrap();
+                if corruption == "version" {
+                    value["formatVersion"] = serde_json::json!(999);
+                }
+                if corruption == "hash" {
+                    value["planHash"] = serde_json::json!("changed");
+                }
+                atomic_write_json(&layout.plan_path(), &value).unwrap();
+                if corruption == "json" {
+                    fs::write(layout.plan_path(), b"{broken").unwrap();
+                }
+                layout.plan_path()
+            };
+            let bytes = fs::read(&path).unwrap();
+            assert!(load_task(&roots, &plan.run_id).is_err(), "{corruption}");
+            assert!(
+                !list_tasks(&roots)
+                    .unwrap()
+                    .iter()
+                    .find(|task| task.run_id == plan.run_id)
+                    .unwrap()
+                    .readable
+            );
+            assert_eq!(fs::read(path).unwrap(), bytes, "{corruption}");
+        }
+        assert!(load_task(&roots, "../outside").is_err());
+    }
+}
diff --git a/src/crates/services/services-core/AGENTS.md b/src/crates/services/services-core/AGENTS.md
index 919d369a94..5be558ad58 100644
--- a/src/crates/services/services-core/AGENTS.md
+++ b/src/crates/services/services-core/AGENTS.md
@@ -101,3 +101,16 @@ pnpm run check:core-boundaries
 
 Other capability-specific target names remain in `Cargo.toml`; document a new
 command here only when it becomes a recurring owner workflow.
+
+## Offline-compatible storage formats
+
+workspace-persistence owns workspace records and registry validation;
+coordination-store owns the durable coordination SQLite schema;
+session-event-format owns the logged-event envelope and durable-prefix validator.
+StorageError carries only storage error categories; Core preserves its original
+error mappings. Workspace managers, watchers, identity loading and live scanning
+remain in Core through runtime extension traits on the shared records.
+
+```bash
+cargo test -p openbitfun-services-core --no-default-features --features workspace-persistence,coordination-store,session-event-format --lib
+```
diff --git a/src/crates/services/services-core/Cargo.toml b/src/crates/services/services-core/Cargo.toml
index 89ea3c489e..9150ba8f2e 100644
--- a/src/crates/services/services-core/Cargo.toml
+++ b/src/crates/services/services-core/Cargo.toml
@@ -50,6 +50,9 @@ libc = { workspace = true, optional = true }
 
 [features]
 default = []
+workspace-persistence = ["workspace-identity", "dep:openbitfun-core-types", "dep:openbitfun-runtime-ports", "dep:chrono"]
+coordination-store = ["dep:rusqlite"]
+session-event-format = ["dep:openbitfun-events"]
 tls-provider = ["dep:rustls"]
 credential-vault = [
     "dep:aes-gcm",
diff --git a/src/crates/services/services-core/src/coordination_persistence.rs b/src/crates/services/services-core/src/coordination_persistence.rs
new file mode 100644
index 0000000000..c8e039ae11
--- /dev/null
+++ b/src/crates/services/services-core/src/coordination_persistence.rs
@@ -0,0 +1,177 @@
+//! Physical schema owner for the durable Agent coordination database.
+//!
+//! Runtime coordination and offline legacy import both open this database, but
+//! neither should carry a private copy of its versioning and repair rules.
+
+use crate::storage_error::{StorageError as OpenBitFunError, StorageResult as OpenBitFunResult};
+use rusqlite::Connection;
+
+pub const COORDINATION_SCHEMA_VERSION: i64 = 2;
+
+pub fn initialize_coordination_schema(connection: &Connection) -> OpenBitFunResult<()> {
+    let version = connection
+        .query_row("PRAGMA user_version", [], |row| row.get::<_, i64>(0))
+        .map_err(db_error)?;
+    if version > COORDINATION_SCHEMA_VERSION {
+        return Err(OpenBitFunError::service(format!(
+            "Agent coordination database schema {version} is newer than supported schema {COORDINATION_SCHEMA_VERSION}"
+        )));
+    }
+    if version == 0 {
+        connection
+            .execute_batch(
+                r#"
+CREATE TABLE coordination_sessions (
+    parent_session_id TEXT PRIMARY KEY,
+    next_auto_agent_seq INTEGER NOT NULL DEFAULT 1,
+    updated_at_ms INTEGER NOT NULL
+);
+
+CREATE TABLE agents (
+    agent_pk INTEGER PRIMARY KEY AUTOINCREMENT,
+    parent_session_id TEXT NOT NULL,
+    agent_id TEXT NOT NULL,
+    child_session_id TEXT,
+    next_bg_seq INTEGER NOT NULL DEFAULT 1,
+    state TEXT NOT NULL CHECK (state IN ('active', 'historical')),
+    created_at_ms INTEGER NOT NULL,
+    UNIQUE(parent_session_id, agent_id),
+    UNIQUE(parent_session_id, child_session_id)
+);
+
+CREATE TABLE background_tasks (
+    task_pk INTEGER PRIMARY KEY AUTOINCREMENT,
+    parent_session_id TEXT NOT NULL,
+    agent_pk INTEGER NOT NULL,
+    bg_task_id TEXT NOT NULL,
+    bg_ordinal INTEGER NOT NULL,
+    parent_dialog_turn_id TEXT NOT NULL,
+    parent_tool_call_id TEXT NOT NULL,
+    child_dialog_turn_id TEXT NOT NULL,
+    status TEXT NOT NULL CHECK (
+        status IN ('running', 'completed', 'partial_timeout', 'failed', 'cancelled', 'interrupted')
+    ),
+    error_code TEXT,
+    error_message TEXT,
+    execution_owner_token TEXT NOT NULL,
+    created_at_ms INTEGER NOT NULL,
+    terminal_at_ms INTEGER,
+    delivered_at_ms INTEGER,
+    delivered_parent_dialog_turn_id TEXT,
+    UNIQUE(parent_session_id, bg_task_id),
+    UNIQUE(agent_pk, bg_ordinal),
+    FOREIGN KEY(agent_pk) REFERENCES agents(agent_pk) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_background_tasks_wait
+    ON background_tasks(parent_session_id, delivered_at_ms, status, task_pk);
+CREATE INDEX idx_background_tasks_parent_turn
+    ON background_tasks(parent_session_id, parent_dialog_turn_id);
+
+PRAGMA user_version = 1;
+            "#,
+            )
+            .map_err(db_error)?;
+    }
+    if version < 2 {
+        connection
+            .execute_batch(
+                r#"
+CREATE TABLE swarm_trees (
+    root_session_id TEXT PRIMARY KEY,
+    created_at_ms INTEGER NOT NULL
+);
+
+CREATE TABLE swarm_nodes (
+    session_id TEXT PRIMARY KEY,
+    root_session_id TEXT NOT NULL,
+    parent_session_id TEXT,
+    agent_type TEXT NOT NULL,
+    depth INTEGER NOT NULL,
+    created_at_ms INTEGER NOT NULL,
+    FOREIGN KEY(root_session_id) REFERENCES swarm_trees(root_session_id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_swarm_nodes_root ON swarm_nodes(root_session_id);
+CREATE INDEX idx_swarm_nodes_parent ON swarm_nodes(parent_session_id);
+PRAGMA user_version = 2;
+                "#,
+            )
+            .map_err(db_error)?;
+    }
+    ensure_v2_additive_columns(connection)?;
+    Ok(())
+}
+
+/// Schema v2 shipped after the background-task delivery columns were added to
+/// schema v1. A retired build could nevertheless leave a database stamped as
+/// v2 without those additive columns. Keep the repair keyed to the physical
+/// shape so reopening such a database is safe and idempotent.
+fn ensure_v2_additive_columns(connection: &Connection) -> OpenBitFunResult<()> {
+    for (column, declaration) in [
+        ("delivered_at_ms", "INTEGER"),
+        ("delivered_parent_dialog_turn_id", "TEXT"),
+    ] {
+        if !coordination_table_has_column(connection, "background_tasks", column)? {
+            connection
+                .execute_batch(&format!(
+                    "ALTER TABLE background_tasks ADD COLUMN {column} {declaration};"
+                ))
+                .map_err(db_error)?;
+        }
+    }
+    connection
+        .execute_batch(
+            r#"
+CREATE INDEX IF NOT EXISTS idx_background_tasks_wait
+    ON background_tasks(parent_session_id, delivered_at_ms, status, task_pk);
+CREATE INDEX IF NOT EXISTS idx_background_tasks_parent_turn
+    ON background_tasks(parent_session_id, parent_dialog_turn_id);
+            "#,
+        )
+        .map_err(db_error)?;
+    Ok(())
+}
+
+pub fn coordination_table_has_column(
+    connection: &Connection,
+    table: &str,
+    expected_column: &str,
+) -> OpenBitFunResult<bool> {
+    let mut statement = connection
+        .prepare(&format!("PRAGMA table_info({table})"))
+        .map_err(db_error)?;
+    let columns = statement
+        .query_map([], |row| row.get::<_, String>(1))
+        .map_err(db_error)?;
+    for column in columns {
+        if column.map_err(db_error)? == expected_column {
+            return Ok(true);
+        }
+    }
+    Ok(false)
+}
+
+pub fn validate_coordination_agent_id(agent_id: &str) -> OpenBitFunResult<()> {
+    let valid = !agent_id.is_empty()
+        && agent_id.len() <= 32
+        && agent_id
+            .bytes()
+            .enumerate()
+            .all(|(index, byte)| match byte {
+                b'a'..=b'z' => true,
+                b'0'..=b'9' | b'_' | b'-' => index > 0,
+                _ => false,
+            });
+    if valid {
+        Ok(())
+    } else {
+        Err(OpenBitFunError::tool(
+            "agent_id must match [a-z][a-z0-9_-]{0,31}".to_string(),
+        ))
+    }
+}
+
+fn db_error(error: rusqlite::Error) -> OpenBitFunError {
+    OpenBitFunError::io(format!("Agent coordination database error: {error}"))
+}
diff --git a/src/crates/services/services-core/src/lib.rs b/src/crates/services/services-core/src/lib.rs
index 070c54f100..b82e6db27a 100644
--- a/src/crates/services/services-core/src/lib.rs
+++ b/src/crates/services/services-core/src/lib.rs
@@ -4,6 +4,8 @@
 //! tested without compiling the full OpenBitFun product runtime.
 
 pub mod bounded_fs;
+#[cfg(feature = "coordination-store")]
+pub mod coordination_persistence;
 #[cfg(feature = "credential-vault")]
 pub mod credential_vault;
 #[cfg(feature = "diagnostics")]
@@ -39,6 +41,13 @@ pub mod persistence;
 pub mod process_manager;
 #[cfg(feature = "process-runtime")]
 pub mod process_tree;
+#[cfg(feature = "session-event-format")]
+pub mod session_projection_format;
+pub mod storage_error;
+#[cfg(feature = "workspace-persistence")]
+pub mod workspace_persistence;
+#[cfg(feature = "workspace-persistence")]
+pub mod workspace_records;
 #[cfg(any(
     feature = "filesystem",
     feature = "local-storage",
diff --git a/src/crates/services/services-core/src/session_projection_format.rs b/src/crates/services/services-core/src/session_projection_format.rs
new file mode 100644
index 0000000000..3be4d2c8a4
--- /dev/null
+++ b/src/crates/services/services-core/src/session_projection_format.rs
@@ -0,0 +1,121 @@
+//! Stable on-disk envelope for in-flight Session runtime events.
+
+use crate::storage_error::{StorageError as OpenBitFunError, StorageResult as OpenBitFunResult};
+use openbitfun_events::AgenticEvent;
+use std::collections::BTreeSet;
+use std::io::{BufRead, BufReader};
+use std::path::Path;
+
+#[derive(Debug, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct LoggedEvent {
+    pub stream_id: String,
+    pub cursor: u64,
+    pub event: AgenticEvent,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct RuntimeEventLogSummary {
+    pub stream_id: String,
+    pub event_count: usize,
+    pub turn_ids: BTreeSet<String>,
+}
+
+/// Validate an imported JSONL file through the same envelope and durable-prefix
+/// semantics used by the runtime store. Migration keeps the original bytes and
+/// ordering; a torn tail is retained but is not considered part of the readable
+/// event prefix.
+pub fn validate_runtime_event_log(
+    path: &Path,
+    expected_session_id: &str,
+) -> OpenBitFunResult<RuntimeEventLogSummary> {
+    let file = std::fs::File::open(path).map_err(|error| {
+        OpenBitFunError::io(format!(
+            "Failed to open runtime event log {}: {error}",
+            path.display()
+        ))
+    })?;
+    let mut stream_id: Option<String> = None;
+    let mut event_count = 0usize;
+    let mut turn_ids = BTreeSet::new();
+    for (line_index, line) in BufReader::new(file).lines().enumerate() {
+        let line = line.map_err(|error| {
+            OpenBitFunError::io(format!(
+                "Failed to read runtime event log {} at line {}: {error}",
+                path.display(),
+                line_index + 1
+            ))
+        })?;
+        if line.trim().is_empty() {
+            continue;
+        }
+        let Ok(record) = serde_json::from_str::<LoggedEvent>(&line) else {
+            break;
+        };
+        if let Some(session_id) = record.event.session_id() {
+            if session_id != expected_session_id {
+                return Err(OpenBitFunError::validation(format!(
+                    "Runtime event log {} contains a different Session id",
+                    path.display()
+                )));
+            }
+        }
+        if let Some(turn_id) = record.event.turn_id() {
+            turn_ids.insert(turn_id.to_string());
+        }
+        match stream_id.as_deref() {
+            Some(current) if current != record.stream_id => {
+                turn_ids.clear();
+                event_count = 0;
+                stream_id = Some(record.stream_id);
+            }
+            None => stream_id = Some(record.stream_id),
+            _ => {}
+        }
+        event_count = event_count.saturating_add(1);
+    }
+    let stream_id = stream_id.ok_or_else(|| {
+        OpenBitFunError::validation(format!(
+            "Runtime event log {} contains no events",
+            path.display()
+        ))
+    })?;
+    Ok(RuntimeEventLogSummary {
+        stream_id,
+        event_count,
+        turn_ids,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+    use std::path::PathBuf;
+
+    #[test]
+    fn imported_log_keeps_the_runtime_readers_torn_tail_semantics() {
+        let root = std::env::var_os("OPENBITFUN_TEST_TMPDIR")
+            .map(PathBuf::from)
+            .unwrap_or_else(std::env::temp_dir);
+        fs::create_dir_all(&root).unwrap();
+        let temp = tempfile::Builder::new()
+            .prefix("openbitfun-runtime-event-")
+            .tempdir_in(root)
+            .unwrap();
+        let path = temp.path().join("session-1.jsonl");
+        fs::write(
+            &path,
+            concat!(
+                "{\"streamId\":\"stream-1\",\"cursor\":1,\"event\":{\"type\":\"TextChunk\",\"session_id\":\"session-1\",\"turn_id\":\"turn-1\",\"round_id\":\"round-1\",\"text\":\"durable\"}}\n",
+                "{\"streamId\":\"stream-1\",\"cursor\":"
+            ),
+        )
+        .unwrap();
+
+        let summary = validate_runtime_event_log(&path, "session-1").unwrap();
+        assert_eq!(summary.stream_id, "stream-1");
+        assert_eq!(summary.event_count, 1);
+        assert_eq!(summary.turn_ids, BTreeSet::from(["turn-1".to_string()]));
+    }
+}
diff --git a/src/crates/services/services-core/src/storage_error.rs b/src/crates/services/services-core/src/storage_error.rs
new file mode 100644
index 0000000000..51aef5a603
--- /dev/null
+++ b/src/crates/services/services-core/src/storage_error.rs
@@ -0,0 +1,32 @@
+//! Errors from the shared on-disk format owners.
+#[derive(Debug, thiserror::Error)]
+pub enum StorageError {
+    #[error("Configuration error: {0}")]
+    Config(String),
+    #[error("Validation error: {0}")]
+    Validation(String),
+    #[error("IO error: {0}")]
+    Io(String),
+    #[error("Service error: {0}")]
+    Service(String),
+    #[error("Tool error: {0}")]
+    Tool(String),
+}
+pub type StorageResult<T> = Result<T, StorageError>;
+impl StorageError {
+    pub fn config(message: String) -> Self {
+        Self::Config(message)
+    }
+    pub fn validation(message: String) -> Self {
+        Self::Validation(message)
+    }
+    pub fn io(message: String) -> Self {
+        Self::Io(message)
+    }
+    pub fn service(message: String) -> Self {
+        Self::Service(message)
+    }
+    pub fn tool(message: String) -> Self {
+        Self::Tool(message)
+    }
+}
diff --git a/src/crates/services/services-core/src/workspace_identity.rs b/src/crates/services/services-core/src/workspace_identity.rs
index 782422b207..6e7ff3285d 100644
--- a/src/crates/services/services-core/src/workspace_identity.rs
+++ b/src/crates/services/services-core/src/workspace_identity.rs
@@ -323,3 +323,29 @@ pub fn unresolved_remote_session_storage_dir(
         .join(key)
         .join("sessions")
 }
+
+pub fn build_project_runtime_slug(canonical: &str) -> String {
+    let slug: String = canonical
+        .chars()
+        .map(|ch| {
+            if ch.is_ascii_alphanumeric() {
+                ch.to_ascii_lowercase()
+            } else {
+                '-'
+            }
+        })
+        .collect();
+
+    let slug = slug.trim_matches('-');
+    let slug = if slug.is_empty() { "workspace" } else { slug };
+
+    if slug.len() <= 120 {
+        return slug.to_string();
+    }
+
+    let hash = format!("{:x}", Sha256::digest(canonical.as_bytes()));
+    let suffix = &hash[..12];
+    let max_prefix_len = 120_usize.saturating_sub(suffix.len() + 1);
+    let prefix = slug[..max_prefix_len].trim_end_matches('-');
+    format!("{}-{}", prefix, suffix)
+}
diff --git a/src/crates/services/services-core/src/workspace_persistence.rs b/src/crates/services/services-core/src/workspace_persistence.rs
new file mode 100644
index 0000000000..38d8648091
--- /dev/null
+++ b/src/crates/services/services-core/src/workspace_persistence.rs
@@ -0,0 +1,230 @@
+//! Current Workspace registry persistence contract and validation.
+
+use crate::storage_error::{StorageError as OpenBitFunError, StorageResult as OpenBitFunResult};
+use crate::workspace_identity::{
+    canonicalize_local_workspace_root, local_workspace_stable_storage_id,
+    normalize_remote_workspace_path, remote_workspace_stable_id, LOCAL_WORKSPACE_SSH_HOST,
+};
+use crate::workspace_records::{PrimaryAssistantKey, WorkspaceInfo, WorkspaceKind};
+use openbitfun_core_types::product_identity::product_id;
+use serde::{Deserialize, Serialize};
+use std::collections::{HashMap, HashSet};
+use std::path::Path;
+
+pub const WORKSPACE_PERSISTENCE_FORMAT_VERSION: u32 = 1;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct WorkspacePersistenceData {
+    #[serde(default)]
+    pub format_version: u32,
+    #[serde(default)]
+    pub product_id: String,
+    pub workspaces: HashMap<String, WorkspaceInfo>,
+    #[serde(default)]
+    pub opened_workspace_ids: Vec<String>,
+    pub current_workspace_id: Option<String>,
+    #[serde(default)]
+    pub recent_workspaces: Vec<String>,
+    #[serde(default)]
+    pub recent_assistant_workspaces: Vec<String>,
+    #[serde(default)]
+    pub primary_assistant_key: Option<PrimaryAssistantKey>,
+    pub saved_at: chrono::DateTime<chrono::Utc>,
+}
+
+pub fn current_workspace_storage_id(workspace: &WorkspaceInfo) -> OpenBitFunResult<String> {
+    match workspace.workspace_kind {
+        WorkspaceKind::Remote => {
+            let ssh_host = workspace
+                .metadata
+                .get("sshHost")
+                .and_then(|value| value.as_str())
+                .map(str::trim)
+                .filter(|value| !value.is_empty())
+                .ok_or_else(|| {
+                    unsupported_workspace_persistence(format!(
+                        "remote workspace '{}' is missing sshHost",
+                        workspace.id
+                    ))
+                })?;
+            workspace.remote_ssh_connection_id().ok_or_else(|| {
+                unsupported_workspace_persistence(format!(
+                    "remote workspace '{}' is missing connectionId",
+                    workspace.id
+                ))
+            })?;
+
+            let stored_root = workspace.root_path.to_string_lossy().replace('\\', "/");
+            let normalized_root = normalize_remote_workspace_path(&stored_root);
+            if !normalized_root.starts_with('/') {
+                return Err(unsupported_workspace_persistence(format!(
+                    "remote workspace '{}' does not use an absolute POSIX root",
+                    workspace.id
+                )));
+            }
+            if stored_root != normalized_root {
+                return Err(unsupported_workspace_persistence(format!(
+                    "remote workspace '{}' rootPath is not normalized",
+                    workspace.id
+                )));
+            }
+            Ok(remote_workspace_stable_id(ssh_host, &normalized_root))
+        }
+        WorkspaceKind::Normal | WorkspaceKind::Assistant => {
+            let ssh_host = workspace
+                .metadata
+                .get("sshHost")
+                .and_then(|value| value.as_str())
+                .map(str::trim);
+            if ssh_host != Some(LOCAL_WORKSPACE_SSH_HOST) {
+                return Err(unsupported_workspace_persistence(format!(
+                    "local workspace '{}' does not declare sshHost=localhost",
+                    workspace.id
+                )));
+            }
+            expected_persisted_local_workspace_id(&workspace.root_path).map_err(|error| {
+                unsupported_workspace_persistence(format!(
+                    "local workspace '{}' is not canonical: {error}",
+                    workspace.id
+                ))
+            })
+        }
+    }
+}
+
+pub fn validate_workspace_persistence_data(
+    data: &WorkspacePersistenceData,
+    miniapps_root: &Path,
+) -> OpenBitFunResult<()> {
+    if data.format_version != WORKSPACE_PERSISTENCE_FORMAT_VERSION {
+        return Err(unsupported_workspace_persistence(format!(
+            "format_version {} is not supported; expected {}",
+            data.format_version, WORKSPACE_PERSISTENCE_FORMAT_VERSION
+        )));
+    }
+    if data.product_id != product_id() {
+        return Err(unsupported_workspace_persistence(format!(
+            "product_id '{}' does not match '{}'",
+            data.product_id,
+            product_id()
+        )));
+    }
+
+    for (storage_id, workspace) in &data.workspaces {
+        if storage_id != &workspace.id {
+            return Err(unsupported_workspace_persistence(format!(
+                "workspace map key '{storage_id}' does not match record id '{}'",
+                workspace.id
+            )));
+        }
+        let expected_id = current_workspace_storage_id(workspace)?;
+        if storage_id != &expected_id {
+            return Err(unsupported_workspace_persistence(format!(
+                "workspace id '{storage_id}' is not canonical; expected '{expected_id}'"
+            )));
+        }
+    }
+    validate_workspace_reference_list(
+        &data.workspaces,
+        &data.opened_workspace_ids,
+        "opened_workspace_ids",
+    )?;
+    validate_workspace_reference_list(
+        &data.workspaces,
+        &data.recent_workspaces,
+        "recent_workspaces",
+    )?;
+    validate_workspace_reference_list(
+        &data.workspaces,
+        &data.recent_assistant_workspaces,
+        "recent_assistant_workspaces",
+    )?;
+
+    for id in &data.recent_workspaces {
+        let workspace = &data.workspaces[id];
+        if workspace.workspace_kind == WorkspaceKind::Assistant {
+            return Err(unsupported_workspace_persistence(format!(
+                "recent_workspaces contains assistant workspace '{id}'"
+            )));
+        }
+        if workspace.root_path.starts_with(miniapps_root) {
+            return Err(unsupported_workspace_persistence(format!(
+                "recent_workspaces contains MiniApp-owned workspace '{id}'"
+            )));
+        }
+    }
+    for id in &data.recent_assistant_workspaces {
+        if data.workspaces[id].workspace_kind != WorkspaceKind::Assistant {
+            return Err(unsupported_workspace_persistence(format!(
+                "recent_assistant_workspaces contains non-assistant workspace '{id}'"
+            )));
+        }
+    }
+
+    if let Some(current_id) = data.current_workspace_id.as_deref() {
+        if !data.workspaces.contains_key(current_id) {
+            return Err(unsupported_workspace_persistence(format!(
+                "current_workspace_id references unknown workspace id '{current_id}'"
+            )));
+        }
+        if !data.opened_workspace_ids.iter().any(|id| id == current_id) {
+            return Err(unsupported_workspace_persistence(format!(
+                "current workspace '{current_id}' is not present in opened_workspace_ids"
+            )));
+        }
+    }
+
+    Ok(())
+}
+
+fn expected_persisted_local_workspace_id(root_path: &Path) -> Result<String, String> {
+    if !root_path.is_absolute() {
+        return Err(format!(
+            "local workspace rootPath is not absolute: {}",
+            root_path.display()
+        ));
+    }
+
+    let normalized_root = if root_path.exists() {
+        let (canonical_root, normalized_root) = canonicalize_local_workspace_root(root_path)?;
+        if canonical_root != root_path {
+            return Err(format!(
+                "local workspace rootPath is not canonical: {}",
+                root_path.display()
+            ));
+        }
+        normalized_root
+    } else {
+        root_path.to_string_lossy().replace('\\', "/")
+    };
+
+    Ok(local_workspace_stable_storage_id(&normalized_root))
+}
+
+fn validate_workspace_reference_list(
+    workspaces: &HashMap<String, WorkspaceInfo>,
+    ids: &[String],
+    field: &str,
+) -> OpenBitFunResult<()> {
+    let mut seen = HashSet::new();
+    for id in ids {
+        if !seen.insert(id.as_str()) {
+            return Err(unsupported_workspace_persistence(format!(
+                "{field} contains duplicate workspace id '{id}'"
+            )));
+        }
+        if !workspaces.contains_key(id) {
+            return Err(unsupported_workspace_persistence(format!(
+                "{field} references unknown workspace id '{id}'"
+            )));
+        }
+    }
+    Ok(())
+}
+
+pub fn unsupported_workspace_persistence(detail: impl AsRef<str>) -> OpenBitFunError {
+    OpenBitFunError::config(format!(
+        "Unsupported workspace persistence format: {}. The persisted file was left unchanged; explicit data migration is required",
+        detail.as_ref()
+    ))
+}
diff --git a/src/crates/services/services-core/src/workspace_records.rs b/src/crates/services/services-core/src/workspace_records.rs
new file mode 100644
index 0000000000..d25dc8e885
--- /dev/null
+++ b/src/crates/services/services-core/src/workspace_records.rs
@@ -0,0 +1,169 @@
+//! Persisted Workspace record types shared by the live service and offline import.
+
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::path::PathBuf;
+
+pub use openbitfun_runtime_ports::RelatedPath;
+
+/// Workspace type.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Hash)]
+pub enum WorkspaceType {
+    RustProject,
+    NodeProject,
+    PythonProject,
+    JavaProject,
+    CppProject,
+    WebProject,
+    MobileProject,
+    Other,
+}
+
+/// Workspace status.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub enum WorkspaceStatus {
+    Active,
+    Inactive,
+    Loading,
+    Error,
+    Archived,
+}
+
+/// Workspace lifecycle kind.
+#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq, Hash)]
+#[serde(rename_all = "lowercase")]
+pub enum WorkspaceKind {
+    #[default]
+    Normal,
+    Assistant,
+    Remote,
+}
+
+/// Stable identity of the assistant workspace that owns the primary role.
+///
+/// Local workspace ids are derived from canonical storage paths, so the primary
+/// selection is persisted using the assistant identity instead of that path-derived id.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum PrimaryAssistantKey {
+    BuiltIn,
+    Named { assistant_id: String },
+}
+
+impl PrimaryAssistantKey {
+    pub fn from_workspace(workspace: &WorkspaceInfo) -> Option<Self> {
+        if workspace.workspace_kind != WorkspaceKind::Assistant {
+            return None;
+        }
+        Some(match workspace.assistant_id.as_deref() {
+            Some(assistant_id) if !assistant_id.trim().is_empty() => Self::Named {
+                assistant_id: assistant_id.trim().to_string(),
+            },
+            _ => Self::BuiltIn,
+        })
+    }
+
+    pub fn matches(&self, workspace: &WorkspaceInfo) -> bool {
+        if workspace.workspace_kind != WorkspaceKind::Assistant {
+            return false;
+        }
+        match (self, workspace.assistant_id.as_deref()) {
+            (Self::BuiltIn, None) => true,
+            (Self::Named { assistant_id }, Some(candidate)) => assistant_id == candidate,
+            _ => false,
+        }
+    }
+}
+
+/// Parsed agent identity fields from `IDENTITY.md` frontmatter.
+#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct WorkspaceIdentity {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub creature: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub vibe: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub avatar: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub emoji: Option<String>,
+}
+
+/// Git worktree metadata attached to a workspace.
+#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct WorkspaceWorktreeInfo {
+    pub path: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub branch: Option<String>,
+    pub main_repo_path: String,
+    pub is_main: bool,
+}
+
+/// Workspace metadata.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct WorkspaceInfo {
+    pub id: String,
+    pub name: String,
+    #[serde(rename = "rootPath")]
+    pub root_path: PathBuf,
+    #[serde(rename = "workspaceType")]
+    pub workspace_type: WorkspaceType,
+    #[serde(rename = "workspaceKind", default)]
+    pub workspace_kind: WorkspaceKind,
+    #[serde(
+        rename = "assistantId",
+        default,
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub assistant_id: Option<String>,
+    pub status: WorkspaceStatus,
+    pub languages: Vec<String>,
+    #[serde(rename = "openedAt")]
+    pub opened_at: chrono::DateTime<chrono::Utc>,
+    #[serde(rename = "lastAccessed")]
+    pub last_accessed: chrono::DateTime<chrono::Utc>,
+    pub description: Option<String>,
+    pub tags: Vec<String>,
+    pub statistics: Option<WorkspaceStatistics>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub identity: Option<WorkspaceIdentity>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub worktree: Option<WorkspaceWorktreeInfo>,
+    #[serde(rename = "relatedPaths", default)]
+    pub related_paths: Vec<RelatedPath>,
+    pub metadata: HashMap<String, serde_json::Value>,
+}
+
+impl WorkspaceInfo {
+    /// SSH connection id persisted in [`WorkspaceInfo::metadata`] for remote workspaces.
+    pub fn remote_ssh_connection_id(&self) -> Option<&str> {
+        self.metadata
+            .get("connectionId")
+            .and_then(|value| value.as_str())
+            .filter(|value| !value.is_empty())
+    }
+}
+
+/// Workspace statistics.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct WorkspaceStatistics {
+    pub total_files: usize,
+    pub total_directories: usize,
+    pub total_size_bytes: u64,
+    pub file_extensions: HashMap<String, usize>,
+    pub last_modified: Option<chrono::DateTime<chrono::Utc>>,
+    pub git_info: Option<GitInfo>,
+}
+
+/// Git information.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct GitInfo {
+    pub is_git_repo: bool,
+    pub current_branch: Option<String>,
+    pub remote_url: Option<String>,
+    pub has_uncommitted_changes: bool,
+    pub total_commits: Option<usize>,
+}
diff --git a/src/crates/services/terminal/AGENTS.md b/src/crates/services/terminal/AGENTS.md
index 4e4de3a487..6db99775e5 100644
--- a/src/crates/services/terminal/AGENTS.md
+++ b/src/crates/services/terminal/AGENTS.md
@@ -22,6 +22,7 @@ infrastructure, not a product command or UI layer.
 
 ```bash
 cargo check -p terminal-core
+cargo test -p terminal-core --lib workspace_origin_contract_tests # terminal response compatibility
 node scripts/check-core-boundaries.mjs
 ```
 
diff --git a/src/crates/services/terminal/src/api.rs b/src/crates/services/terminal/src/api.rs
index ac6a7fc161..c1838e91ef 100644
--- a/src/crates/services/terminal/src/api.rs
+++ b/src/crates/services/terminal/src/api.rs
@@ -1,4 +1,4 @@
-//! API module - Public interface for terminal operations
+//! API module - Public interface for terminal operations
 //!
 //! This module provides the public API for external consumers (Tauri, WebSocket, etc.)
 //! It defines request/response types and the main service interface.
@@ -69,6 +69,13 @@ pub struct SessionResponse {
     pub shell_type: ShellType,
     /// Current working directory
     pub cwd: String,
+    /// Immutable creation directory, used to associate the terminal with a workspace.
+    #[serde(
+        default,
+        rename = "initialCwd",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub initial_cwd: Option<String>,
     /// Process ID (if running)
     pub pid: Option<u32>,
     /// Session status
@@ -87,6 +94,7 @@ impl From<TerminalSession> for SessionResponse {
             name: session.name,
             shell_type: session.shell_type,
             cwd: session.cwd,
+            initial_cwd: Some(session.initial_cwd),
             pid: session.pid,
             status: format!("{:?}", session.status),
             cols: session.cols,
@@ -96,6 +104,39 @@ impl From<TerminalSession> for SessionResponse {
     }
 }
 
+#[cfg(test)]
+mod workspace_origin_contract_tests {
+    use super::SessionResponse;
+    use serde_json::json;
+
+    #[test]
+    fn old_terminal_payload_round_trips_without_requiring_initial_cwd() {
+        let legacy = json!({
+            "id": "existing-terminal", "name": "Development", "shellType": "Bash",
+            "cwd": "/repo/src", "pid": null, "status": "Running", "cols": 80,
+            "rows": 24, "source": "manual"
+        });
+        let response: SessionResponse = serde_json::from_value(legacy.clone()).unwrap();
+        assert!(response.initial_cwd.is_none());
+        assert_eq!(serde_json::to_value(response).unwrap(), legacy);
+    }
+
+    #[test]
+    fn initial_directory_survives_current_directory_changes_and_serialization() {
+        let mut response: SessionResponse = serde_json::from_value(json!({
+            "id": "terminal", "name": "Development", "shellType": "Bash",
+            "cwd": "/repo", "initialCwd": "/repo", "pid": null, "status": "Running",
+            "cols": 80, "rows": 24, "source": "agent"
+        }))
+        .unwrap();
+        response.cwd = "/another-project".into();
+        let restored: SessionResponse =
+            serde_json::from_value(serde_json::to_value(response).unwrap()).unwrap();
+        assert_eq!(restored.initial_cwd.as_deref(), Some("/repo"));
+        assert_eq!(restored.cwd, "/another-project");
+    }
+}
+
 /// Request to write data to terminal
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct WriteRequest {
diff --git a/src/shared/interactive-capabilities/catalog.json b/src/shared/interactive-capabilities/catalog.json
index 5ec7b41f3d..1e24bb24d2 100644
--- a/src/shared/interactive-capabilities/catalog.json
+++ b/src/shared/interactive-capabilities/catalog.json
@@ -9125,140 +9125,6 @@
       "operations": [],
       "options": []
     },
-    {
-      "id": "setting.data.migration",
-      "kind": "setting",
-      "categoryId": "data",
-      "titleZh": "旧版数据迁移",
-      "titleEn": "Legacy data migration",
-      "summaryZh": "从本机旧版 安装扫描并导入受支持的数据，查看去敏报告，同时保持旧来源不变。",
-      "summaryEn": "Scan and import supported data from a local legacy installation, inspect redacted reports, and leave the legacy source unchanged.",
-      "keywordsZh": [
-        "旧版数据迁移",
-        "旧版数据",
-        "迁移报告",
-        "导入旧数据",
-        "Data Migrator"
-      ],
-      "keywordsEn": [
-        "legacy data migration",
-        "legacy data",
-        "migration report",
-        "import old data",
-        "Data Migrator"
-      ],
-      "highlightsZh": [
-        "只读扫描本机旧版数据",
-        "按五个高层数据组选择迁移范围",
-        "通过独立 Data Migrator 导入并查看去敏报告"
-      ],
-      "highlightsEn": [
-        "Read-only scan of local legacy data",
-        "Choose migration scope across five high-level data groups",
-        "Import through the standalone Data Migrator and inspect redacted reports"
-      ],
-      "items": [
-        {
-          "id": "scan",
-          "titleZh": "只读扫描本机旧版数据来源及所选数据组",
-          "titleEn": "Read-only scan the local legacy source and selected data groups",
-          "control": {
-            "kind": "open",
-            "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“只读扫描本机旧版数据来源及所选数据组”：扫描依赖当前设备上的旧版数据、实时范围选择和结果状态；Agent 会打开精确入口，并把选择与扫描保留在用户可见界面。",
-            "reasonEn": "Read-only scan the local legacy source and selected data groups: Scanning depends on legacy data on the current device, live scope selection, and result state; the Agent opens the exact entry and keeps selection and scanning visible to the user."
-          },
-          "evidence": [
-            "command:get_legacy_migration_status",
-            "command:scan_legacy_migration",
-            "source:src/web-ui/src/locales/zh-CN/settings/legacy-migration.json#actions.scan"
-          ]
-        },
-        {
-          "id": "scope",
-          "titleZh": "选择设置、扩展、会话、记忆和远程连接迁移范围",
-          "titleEn": "Choose settings, extensions, sessions, memory, and remote-connection migration scope",
-          "control": {
-            "kind": "open",
-            "reasonCode": "visualSelection",
-            "reasonZh": "迁移范围是影响本机持久数据的五组可见选择；Agent 会打开精确入口，由用户确认所需范围。",
-            "reasonEn": "Migration scope is a visible five-group selection affecting local persisted data; the Agent opens the exact entry so the user can confirm the intended scope."
-          },
-          "evidence": [
-            "source:src/web-ui/src/locales/zh-CN/settings/legacy-migration.json#sections.scope.title"
-          ]
-        },
-        {
-          "id": "launch",
-          "titleZh": "确认关闭影响后启动独立 Data Migrator",
-          "titleEn": "Launch the standalone Data Migrator after confirming shutdown impact",
-          "control": {
-            "kind": "open",
-            "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“确认关闭影响后启动独立 Data Migrator”：启动迁移器会停止正在运行的 Agent 和终端任务、关闭 Desktop，并交接到独立本机进程；Agent 只打开入口，确认和启动保留在用户可见界面。",
-            "reasonEn": "Launch the standalone Data Migrator after confirming shutdown impact: Launching the migrator can stop running agents and terminal tasks, close Desktop, and hand off to a separate local process; the Agent only opens the entry while confirmation and launch remain visible to the user."
-          },
-          "evidence": [
-            "command:prepare_legacy_migration",
-            "source:src/web-ui/src/locales/zh-CN/settings/legacy-migration.json#confirm.title"
-          ]
-        },
-        {
-          "id": "report",
-          "titleZh": "查看最近运行结果和各领域去敏状态",
-          "titleEn": "Inspect the latest run result and redacted per-domain status",
-          "control": {
-            "kind": "open",
-            "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“查看最近运行结果和各领域去敏状态”：报告取决于本机最近一次迁移运行和各领域实时状态；Agent 会打开精确入口，并把报告查看与失败组重试保留在用户可见界面。",
-            "reasonEn": "Inspect the latest run result and redacted per-domain status: Reports depend on the most recent local migration run and live per-domain state; the Agent opens the exact entry and keeps report review and failed-group retry visible to the user."
-          },
-          "evidence": [
-            "command:get_legacy_migration_report",
-            "source:src/web-ui/src/locales/zh-CN/settings/legacy-migration.json#sections.report.title"
-          ]
-        },
-        {
-          "id": "reminder",
-          "titleZh": "恢复已关闭的首次启动迁移提醒",
-          "titleEn": "Restore the first-start migration reminder after it was disabled",
-          "control": {
-            "kind": "open",
-            "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“恢复已关闭的首次启动迁移提醒”：提醒偏好与当前本机旧数据来源绑定；Agent 会打开精确入口，由用户在可见界面决定是否恢复提醒。",
-            "reasonEn": "Restore the first-start migration reminder after it was disabled: The reminder preference is bound to the current local legacy source; the Agent opens the exact entry so the user can decide visibly whether to restore it."
-          },
-          "evidence": [
-            "command:set_legacy_migration_prompt_preference",
-            "source:src/web-ui/src/locales/zh-CN/settings/legacy-migration.json#actions.restoreReminder"
-          ]
-        }
-      ],
-      "stepsZh": [
-        "打开设置",
-        "进入“数据 > 旧版数据迁移”",
-        "扫描来源、选择范围并在确认关闭影响后启动迁移器"
-      ],
-      "stepsEn": [
-        "Open Settings",
-        "Go to Data > Legacy data migration",
-        "Scan the source, choose scope, and launch the migrator after confirming shutdown impact"
-      ],
-      "agentExamplesZh": [
-        "打开旧版数据迁移",
-        "带我查看数据迁移报告"
-      ],
-      "agentExamplesEn": [
-        "Open legacy data migration",
-        "Show me the data migration report"
-      ],
-      "destination": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      },
-      "operations": [],
-      "options": []
-    },
     {
       "id": "setting.data.diagnostics",
       "kind": "setting",
@@ -9607,9 +9473,6 @@
     "debug": {
       "capabilityId": "setting.data.diagnostics"
     },
-    "legacy_migration": {
-      "capabilityId": "setting.data.migration"
-    },
     "appearance": {
       "capabilityId": "feature.desktop-pet"
     },
diff --git a/src/web-ui/src/app/App.tsx b/src/web-ui/src/app/App.tsx
index 1a5fe5c7e7..0b250bf543 100644
--- a/src/web-ui/src/app/App.tsx
+++ b/src/web-ui/src/app/App.tsx
@@ -38,7 +38,6 @@ import { activateCreationRuntime } from '@/infrastructure/creation/creationRunti
 import { attachCreationRuntime, recordCreationActivationError } from '@/infrastructure/creation/creationBridge';
 import { createCreationUiApi } from './creation/creationUiApi';
 import { usePeerDeviceModeOptional } from '@/infrastructure/peer-device/peerDeviceContextState';
-import { showLegacyMigrationStartupNotification } from './startup/legacyMigrationStartupNotification';
 
 const log = createLogger('App');
 
@@ -873,13 +872,6 @@ function App() {
   // Debug inspector shortcuts (desktop devtools only)
   useDebugInspector();
 
-  useEffect(() => {
-    if (!isTauriRuntime() || !interactiveShellReady) return;
-    void showLegacyMigrationStartupNotification().catch((error) => {
-      log.warn('Failed to show legacy migration startup result', error);
-    });
-  }, [interactiveShellReady]);
-
   useEffect(() => {
     if (!isTauriRuntime() || !interactiveShellReady) {
       return;
diff --git a/src/web-ui/src/app/components/NavPanel/sections/workspaces/WorkspaceItem.tsx b/src/web-ui/src/app/components/NavPanel/sections/workspaces/WorkspaceItem.tsx
index feebb56057..e6206039b7 100644
--- a/src/web-ui/src/app/components/NavPanel/sections/workspaces/WorkspaceItem.tsx
+++ b/src/web-ui/src/app/components/NavPanel/sections/workspaces/WorkspaceItem.tsx
@@ -878,7 +878,7 @@ const WorkspaceItem: React.FC<WorkspaceItemProps> = ({
           </Tooltip>
 
           <div className="openbitfun-nav-panel__assistant-item-menu" data-openbitfun-component="workspace-item" data-openbitfun-part="menu" ref={menuRef} onClick={e => e.stopPropagation()}>
-            <Tooltip content={t('nav.items.project')} placement="right" followCursor>
+            <Tooltip content={t('nav.resources.title')} placement="right" followCursor>
               <button
                 data-openbitfun-component="workspace-item"
                 data-openbitfun-part="action"
@@ -1351,7 +1351,7 @@ const WorkspaceItem: React.FC<WorkspaceItemProps> = ({
 
         <div className="openbitfun-nav-panel__workspace-item-actions" onClick={e => e.stopPropagation()}>
           <div className="openbitfun-nav-panel__workspace-item-menu" data-openbitfun-component="workspace-item" data-openbitfun-part="menu" ref={menuRef}>
-            <Tooltip content={t('nav.items.project')} placement="right" followCursor>
+            <Tooltip content={t('nav.resources.title')} placement="right" followCursor>
               <button
                 data-openbitfun-component="workspace-item"
                 data-openbitfun-part="menuTrigger"
diff --git a/src/web-ui/src/app/components/panels/FilesPanel.tsx b/src/web-ui/src/app/components/panels/FilesPanel.tsx
index 79bdb592bf..1bf0bc02d8 100644
--- a/src/web-ui/src/app/components/panels/FilesPanel.tsx
+++ b/src/web-ui/src/app/components/panels/FilesPanel.tsx
@@ -14,21 +14,22 @@ import {
   type FileExplorerToolbarHandlers,
 } from '@/tools/file-system';
 import { useExplorerSearch } from '@/tools/file-explorer';
+import { planFileTreeReveal } from '@/tools/file-system/utils/fileTreeReveal';
 
 import { useI18n } from '@/infrastructure/i18n/hooks/useI18n';
 import { confirmWarning } from '@/infrastructure/confirm-dialog';
 import { FileSearchResults } from '@/tools/file-system/components/FileSearchResults';
 import { workspaceAPI } from '@/infrastructure/api';
-import type { FileSystemNode } from '@/tools/file-system/types';
+import type { FileSystemNode, FileTreeRevealTarget } from '@/tools/file-system/types';
 import { globalEventBus } from '@/infrastructure/event-bus';
 import { useNotification } from '@/shared/notification-system';
 import { LoadingState } from '@openbitfun/ui';
 import { InputDialog } from '@/app/components/InputDialog';
 import { openFileInBestTarget } from '@/shared/utils/tabUtils';
-import { getMotionAwareScrollBehavior } from '@/shared/utils/motionPreference';
 import { PanelHeader } from './base';
 import { createLogger } from '@/shared/utils/logger';
 import { isPeerDeviceModeActive } from '@/infrastructure/peer-device/peerModeFlag';
+import { getActiveSurfaceScope } from '@/infrastructure/peer-device/deviceSurface';
 import {
   basenamePath,
   normalizeLocalPathForRename,
@@ -104,6 +105,7 @@ function getSearchBackendBadgeVariant(
 
 interface FilesPanelProps {
   workspacePath?: string;
+  searchStateKey?: string;
   onFileSelect?: (filePath: string, fileName: string) => void;
   onFileDoubleClick?: (filePath: string) => void;
   hideHeader?: boolean;
@@ -116,6 +118,7 @@ interface FilesPanelProps {
 
 const FilesPanel: React.FC<FilesPanelProps> = ({
   workspacePath,
+  searchStateKey,
   onFileSelect,
   onFileDoubleClick,
   hideHeader = false,
@@ -129,6 +132,13 @@ const FilesPanel: React.FC<FilesPanelProps> = ({
   const { workspace: currentWorkspace } = useCurrentWorkspace();
   
   const panelRef = useRef<HTMLDivElement>(null);
+  const navigationRequestRef = useRef(0);
+  const [revealTarget, setRevealTarget] = useState<FileTreeRevealTarget>();
+  useEffect(() => {
+    navigationRequestRef.current += 1;
+    setRevealTarget(undefined);
+    return () => { navigationRequestRef.current += 1; };
+  }, [workspacePath, currentWorkspace?.id, currentWorkspace?.connectionId]);
   const lastFocusRefreshAtRef = useRef<number>(0);
   const [internalViewMode, setInternalViewMode] = useState<'tree' | 'search'>('tree');
   const viewMode = externalViewMode !== undefined ? externalViewMode : internalViewMode;
@@ -156,6 +166,7 @@ const FilesPanel: React.FC<FilesPanelProps> = ({
     clearSearch,
   } = useExplorerSearch({
     workspacePath,
+    stateKey: searchStateKey,
     initialMode: 'content',
     filenameSearchDebounce: 300,
     contentSearchDebounce: 300,
@@ -587,57 +598,15 @@ const FilesPanel: React.FC<FilesPanelProps> = ({
 
     log.debug('Navigating to path', { path: data.path, scrollIntoView: data.scrollIntoView });
 
-    const normalizedTarget = data.path.replace(/\\/g, '/');
-    const normalizedWorkspace = workspacePath.replace(/\\/g, '/');
-
-    let relativePath = normalizedTarget;
-    if (normalizedTarget.toLowerCase().startsWith(normalizedWorkspace.toLowerCase())) {
-      relativePath = normalizedTarget.slice(normalizedWorkspace.length).replace(/^\//, '');
-    }
-
-    const parts = relativePath.split('/').filter(Boolean);
-    let currentPath = normalizedWorkspace;
-    const isWindowsPath = workspacePath.includes('\\');
-
-    const targetPaths = new Set<string>();
-    targetPaths.add(isWindowsPath ? normalizedWorkspace.replace(/\//g, '\\') : normalizedWorkspace);
-
-    let finalExpandPath = '';
-    const pathsToExpand: string[] = [];
-    for (const part of parts) {
-      currentPath = `${currentPath}/${part}`;
-      const expandPath = isWindowsPath ? currentPath.replace(/\//g, '\\') : currentPath;
-      finalExpandPath = expandPath;
-      targetPaths.add(expandPath);
-      pathsToExpand.push(expandPath);
-    }
-
-    expandedFolders.forEach(folderPath => {
-      if (!targetPaths.has(folderPath)) {
-        expandFolder(folderPath, false);
-      }
-    });
-
-    const performScroll = () => {
-      if (!data.scrollIntoView || !finalExpandPath) {
-        return;
-      }
-      const escapedPath = finalExpandPath.replace(/\\/g, '\\\\');
-      const targetElement = document.querySelector(`[data-file-path="${escapedPath}"]`);
-      if (targetElement) {
-        targetElement.scrollIntoView({
-          behavior: getMotionAwareScrollBehavior('smooth'),
-          block: 'center',
-        });
-        targetElement.classList.add('openbitfun-file-explorer__node-content--highlighted');
-        setTimeout(() => {
-          targetElement.classList.remove('openbitfun-file-explorer__node-content--highlighted');
-        }, 2000);
-      }
-    };
+    const plan = planFileTreeReveal(workspacePath, data.path, isRemoteCurrentWorkspace);
+    if (!plan) return;
+    const scope = getActiveSurfaceScope();
+    const request = ++navigationRequestRef.current;
+    const isCurrent = () => scope.isCurrent() && request === navigationRequestRef.current;
 
     void (async () => {
-      for (const expandPath of pathsToExpand) {
+      for (const expandPath of plan.pathsToExpand) {
+        if (!isCurrent()) return;
         try {
           await expandFolderEnsure(expandPath);
         } catch (err) {
@@ -645,9 +614,11 @@ const FilesPanel: React.FC<FilesPanelProps> = ({
           break;
         }
       }
-      setTimeout(performScroll, 100);
+      if (!isCurrent()) return;
+      selectFile(plan.targetPath);
+      if (data.scrollIntoView) setRevealTarget({ path: plan.targetPath, requestId: request });
     })();
-  }, [workspacePath, expandFolder, expandFolderEnsure, expandedFolders]);
+  }, [workspacePath, isRemoteCurrentWorkspace, expandFolderEnsure, selectFile]);
 
   const findNode = useCallback((nodes: FileSystemNode[], path: string): FileSystemNode | null => {
     for (const node of nodes) {
@@ -1255,6 +1226,7 @@ const FilesPanel: React.FC<FilesPanelProps> = ({
               key={workspacePath || 'no-workspace'}
               fileTree={fileTree}
               selectedFile={selectedFile}
+              revealTarget={revealTarget}
               expandedFolders={expandedFolders}
               loadingPaths={loadingPaths}
               onNodeExpand={handleNodeExpandLazy}
diff --git a/src/web-ui/src/app/components/panels/TerminalEditModal.appearance.ts b/src/web-ui/src/app/components/panels/TerminalEditModal.appearance.ts
index 3d9f4f300f..6a296de4a2 100644
--- a/src/web-ui/src/app/components/panels/TerminalEditModal.appearance.ts
+++ b/src/web-ui/src/app/components/panels/TerminalEditModal.appearance.ts
@@ -1,2 +1,2 @@
 import type { AppearanceSurfaceDescriptor } from '@/infrastructure/appearance';
-export const terminalEditModalAppearanceDescriptor: AppearanceSurfaceDescriptor = { id: 'terminal-edit-modal', parts: [{ id: 'content' }, { id: 'footer' }] };
+export const terminalEditModalAppearanceDescriptor: AppearanceSurfaceDescriptor = { id: 'terminal-edit-modal', parts: [{ id: 'content' }, { id: 'footer' }, { id: 'error' }] };
diff --git a/src/web-ui/src/app/components/panels/TerminalEditModal.scss b/src/web-ui/src/app/components/panels/TerminalEditModal.scss
index 051f063e49..e0084b143c 100644
--- a/src/web-ui/src/app/components/panels/TerminalEditModal.scss
+++ b/src/web-ui/src/app/components/panels/TerminalEditModal.scss
@@ -14,6 +14,14 @@
 
 // ==================== Footer Buttons ====================
 
+.terminal-edit-dialog__error {
+  margin: 0;
+  color: var(--openbitfun-color-status-danger-content);
+  font-size: var(--openbitfun-type-body-sm-font-size);
+  line-height: var(--openbitfun-type-body-sm-line-height);
+  overflow-wrap: anywhere;
+}
+
 .terminal-edit-dialog__footer {
   flex-shrink: 0;
   display: flex;
diff --git a/src/web-ui/src/app/components/panels/TerminalEditModal.tsx b/src/web-ui/src/app/components/panels/TerminalEditModal.tsx
index aba2acf23b..33632cee8f 100644
--- a/src/web-ui/src/app/components/panels/TerminalEditModal.tsx
+++ b/src/web-ui/src/app/components/panels/TerminalEditModal.tsx
@@ -41,6 +41,8 @@ export const TerminalEditModal: React.FC<TerminalEditModalProps> = ({
   showStartupCommand = true,
 }) => {
   const { t } = useI18n('panels/terminal');
+  const { t: tCommon } = useI18n('common');
+  const [saveError, setSaveError] = useState<string | null>(null);
   const [name, setName] = useState(initialName);
   const [workingDirectory, setWorkingDirectory] = useState(initialWorkingDirectory);
   const [startupCommand, setStartupCommand] = useState(initialStartupCommand);
@@ -48,6 +50,7 @@ export const TerminalEditModal: React.FC<TerminalEditModalProps> = ({
 
   useEffect(() => {
     if (isOpen) {
+      setSaveError(null);
       setName(initialName);
       setWorkingDirectory(initialWorkingDirectory);
       setStartupCommand(initialStartupCommand);
@@ -74,12 +77,17 @@ export const TerminalEditModal: React.FC<TerminalEditModalProps> = ({
 
     const trimmedWorkingDirectory = workingDirectory.trim();
     const trimmedCommand = startupCommand.trim();
-    onSave({
-      name: trimmedName,
-      workingDirectory: trimmedWorkingDirectory || undefined,
-      startupCommand: trimmedCommand || undefined,
-    });
-    onClose();
+    setSaveError(null);
+    try {
+      onSave({
+        name: trimmedName,
+        workingDirectory: trimmedWorkingDirectory || undefined,
+        startupCommand: trimmedCommand || undefined,
+      });
+      onClose();
+    } catch (error) {
+      setSaveError(error instanceof Error ? error.message : String(error));
+    }
   }, [name, onClose, onSave, startupCommand, workingDirectory]);
 
   const handleKeyDown = useCallback((e: React.KeyboardEvent) => {
@@ -142,6 +150,10 @@ export const TerminalEditModal: React.FC<TerminalEditModalProps> = ({
             />
           </Field>
         ) : null}
+        {saveError && <p role="alert" className="terminal-edit-dialog__error"
+          data-openbitfun-component="terminal-edit-modal" data-openbitfun-part="error">
+          {tCommon('nav.resources.actionFailed', { error: saveError })}
+        </p>}
       </div>
 
       <div data-openbitfun-component="terminal-edit-modal" data-openbitfun-part="footer" className="terminal-edit-dialog__footer">
diff --git a/src/web-ui/src/app/components/panels/content-canvas/hooks/useTabLifecycle.ts b/src/web-ui/src/app/components/panels/content-canvas/hooks/useTabLifecycle.ts
index c5bfd761af..609c00a099 100644
--- a/src/web-ui/src/app/components/panels/content-canvas/hooks/useTabLifecycle.ts
+++ b/src/web-ui/src/app/components/panels/content-canvas/hooks/useTabLifecycle.ts
@@ -89,6 +89,9 @@ export const useTabLifecycle = (options: UseTabLifecycleOptions = {}): UseTabLif
 
   const closeTerminalSession = useCallback(async (tab: { content: PanelContent }): Promise<boolean> => {
     if (tab.content.type !== 'terminal') return true;
+    // Workspace terminals outlive their views. Older/specialized tabs retain
+    // their explicit process-lifecycle contract.
+    if (tab.content.metadata?.terminalCloseBehavior === 'detach') return true;
 
     const sessionId = tab.content.data?.sessionId;
     if (!sessionId) return true;
diff --git a/src/web-ui/src/app/global-search/generated/interactive-capabilities.json b/src/web-ui/src/app/global-search/generated/interactive-capabilities.json
index 653efc45a6..a8c4149de3 100644
--- a/src/web-ui/src/app/global-search/generated/interactive-capabilities.json
+++ b/src/web-ui/src/app/global-search/generated/interactive-capabilities.json
@@ -4,7 +4,7 @@
   "title": "OpenBitFun Playbook",
   "origin": "https://playbook.openbitfun.com",
   "source": "src/shared/interactive-capabilities/catalog.json",
-  "digest": "c77c16c414ce9fe50929fe249d900489fdceedb8e646aaaca03893aa33d4fbc8",
+  "digest": "d7a7419ddd673eb733ae8bd33dbb3dcd3b4d1ce0acfc953067a3403fe26d6699",
   "ownerDigest": "c0e5c187cf62bc6ed06196ce8520b3eb427bf268cf24659b72d2552fb1d99c54",
   "searchAcceptance": [
     {
@@ -136,13 +136,13 @@
   ],
   "counts": {
     "features": 22,
-    "settings": 22,
-    "userFacing": 44,
-    "documentedItems": 326,
+    "settings": 21,
+    "userFacing": 43,
+    "documentedItems": 321,
     "controlCoverage": {
       "direct": 48,
       "delegated": 61,
-      "interactive": 217,
+      "interactive": 212,
       "unsupported": 0
     }
   },
@@ -18765,285 +18765,6 @@
         "pageId": "data.archived"
       }
     },
-    {
-      "id": "setting.data.migration:query",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "scan",
-        "scope",
-        "launch",
-        "report",
-        "reminder"
-      ],
-      "kind": "query",
-      "risk": "read",
-      "executionHost": "productHost",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": true
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": true
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "valueSource": {
-        "kind": "static"
-      },
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
-    {
-      "id": "setting.data.migration:open:scan",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "scan"
-      ],
-      "kind": "open",
-      "risk": "ui",
-      "executionHost": "presentationSurface",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1",
-            "product_control_presentation_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "openReason": "unstructuredInteraction",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
-    {
-      "id": "setting.data.migration:open:scope",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "scope"
-      ],
-      "kind": "open",
-      "risk": "ui",
-      "executionHost": "presentationSurface",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1",
-            "product_control_presentation_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "openReason": "visualSelection",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
-    {
-      "id": "setting.data.migration:open:launch",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "launch"
-      ],
-      "kind": "open",
-      "risk": "ui",
-      "executionHost": "presentationSurface",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1",
-            "product_control_presentation_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "openReason": "unstructuredInteraction",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
-    {
-      "id": "setting.data.migration:open:report",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "report"
-      ],
-      "kind": "open",
-      "risk": "ui",
-      "executionHost": "presentationSurface",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1",
-            "product_control_presentation_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "openReason": "unstructuredInteraction",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
-    {
-      "id": "setting.data.migration:open:reminder",
-      "capabilityId": "setting.data.migration",
-      "itemIds": [
-        "reminder"
-      ],
-      "kind": "open",
-      "risk": "ui",
-      "executionHost": "presentationSurface",
-      "availability": {
-        "desktop": {
-          "available": true
-        },
-        "cli": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        },
-        "peer": {
-          "available": true,
-          "requiredCapabilities": [
-            "product_control_v1",
-            "product_control_presentation_v1"
-          ]
-        },
-        "remoteControl": {
-          "available": true
-        },
-        "detachedDispatch": {
-          "available": false,
-          "reason": "This delivery profile has no live presentation surface"
-        }
-      },
-      "inputSchema": {
-        "type": "object",
-        "additionalProperties": false
-      },
-      "outputSchema": {
-        "type": "object",
-        "additionalProperties": true
-      },
-      "openReason": "unstructuredInteraction",
-      "presentationTarget": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      }
-    },
     {
       "id": "setting.data.diagnostics:query",
       "capabilityId": "setting.data.diagnostics",
@@ -29844,156 +29565,6 @@
       ],
       "docsUrl": "https://playbook.openbitfun.com/capabilities/setting.data.archived/"
     },
-    {
-      "id": "setting.data.migration",
-      "kind": "setting",
-      "categoryId": "data",
-      "titleZh": "旧版数据迁移",
-      "titleEn": "Legacy data migration",
-      "summaryZh": "从本机旧版 安装扫描并导入受支持的数据，查看去敏报告，同时保持旧来源不变。",
-      "summaryEn": "Scan and import supported data from a local legacy installation, inspect redacted reports, and leave the legacy source unchanged.",
-      "keywordsZh": [
-        "旧版数据迁移",
-        "旧版数据",
-        "迁移报告",
-        "导入旧数据",
-        "Data Migrator"
-      ],
-      "keywordsEn": [
-        "legacy data migration",
-        "legacy data",
-        "migration report",
-        "import old data",
-        "Data Migrator"
-      ],
-      "highlightsZh": [
-        "只读扫描本机旧版数据",
-        "按五个高层数据组选择迁移范围",
-        "通过独立 Data Migrator 导入并查看去敏报告"
-      ],
-      "highlightsEn": [
-        "Read-only scan of local legacy data",
-        "Choose migration scope across five high-level data groups",
-        "Import through the standalone Data Migrator and inspect redacted reports"
-      ],
-      "items": [
-        {
-          "id": "scan",
-          "titleZh": "只读扫描本机旧版数据来源及所选数据组",
-          "titleEn": "Read-only scan the local legacy source and selected data groups",
-          "control": {
-            "kind": "open",
-            "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“只读扫描本机旧版数据来源及所选数据组”：扫描依赖当前设备上的旧版数据、实时范围选择和结果状态；Agent 会打开精确入口，并把选择与扫描保留在用户可见界面。",
-            "reasonEn": "Read-only scan the local legacy source and selected data groups: Scanning depends on legacy data on the current device, live scope selection, and result state; the Agent opens the exact entry and keeps selection and scanning visible to the user."
-          }
-        },
-        {
-          "id": "scope",
-          "titleZh": "选择设置、扩展、会话、记忆和远程连接迁移范围",
-          "titleEn": "Choose settings, extensions, sessions, memory, and remote-connection migration scope",
-          "control": {
-            "kind": "open",
-            "reasonCode": "visualSelection",
-            "reasonZh": "迁移范围是影响本机持久数据的五组可见选择；Agent 会打开精确入口，由用户确认所需范围。",
-            "reasonEn": "Migration scope is a visible five-group selection affecting local persisted data; the Agent opens the exact entry so the user can confirm the intended scope."
-          }
-        },
-        {
-          "id": "launch",
-          "titleZh": "确认关闭影响后启动独立 Data Migrator",
-          "titleEn": "Launch the standalone Data Migrator after confirming shutdown impact",
-          "control": {
-            "kind": "open",
-            "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“确认关闭影响后启动独立 Data Migrator”：启动迁移器会停止正在运行的 Agent 和终端任务、关闭 Desktop，并交接到独立本机进程；Agent 只打开入口，确认和启动保留在用户可见界面。",
-            "reasonEn": "Launch the standalone Data Migrator after confirming shutdown impact: Launching the migrator can stop running agents and terminal tasks, close Desktop, and hand off to a separate local process; the Agent only opens the entry while confirmation and launch remain visible to the user."
-          }
-        },
-        {
-          "id": "report",
-          "titleZh": "查看最近运行结果和各领域去敏状态",
-          "titleEn": "Inspect the latest run result and redacted per-domain status",
-          "control": {
-            "kind": "open",
-            "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“查看最近运行结果和各领域去敏状态”：报告取决于本机最近一次迁移运行和各领域实时状态；Agent 会打开精确入口，并把报告查看与失败组重试保留在用户可见界面。",
-            "reasonEn": "Inspect the latest run result and redacted per-domain status: Reports depend on the most recent local migration run and live per-domain state; the Agent opens the exact entry and keeps report review and failed-group retry visible to the user."
-          }
-        },
-        {
-          "id": "reminder",
-          "titleZh": "恢复已关闭的首次启动迁移提醒",
-          "titleEn": "Restore the first-start migration reminder after it was disabled",
-          "control": {
-            "kind": "open",
-            "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“恢复已关闭的首次启动迁移提醒”：提醒偏好与当前本机旧数据来源绑定；Agent 会打开精确入口，由用户在可见界面决定是否恢复提醒。",
-            "reasonEn": "Restore the first-start migration reminder after it was disabled: The reminder preference is bound to the current local legacy source; the Agent opens the exact entry so the user can decide visibly whether to restore it."
-          }
-        }
-      ],
-      "stepsZh": [
-        "打开设置",
-        "进入“数据 > 旧版数据迁移”",
-        "扫描来源、选择范围并在确认关闭影响后启动迁移器"
-      ],
-      "stepsEn": [
-        "Open Settings",
-        "Go to Data > Legacy data migration",
-        "Scan the source, choose scope, and launch the migrator after confirming shutdown impact"
-      ],
-      "agentExamplesZh": [
-        "打开旧版数据迁移",
-        "带我查看数据迁移报告"
-      ],
-      "agentExamplesEn": [
-        "Open legacy data migration",
-        "Show me the data migration report"
-      ],
-      "destination": {
-        "kind": "settings",
-        "pageId": "data.migration"
-      },
-      "operations": [],
-      "options": [],
-      "searchTerms": [
-        "setting.data.migration",
-        "旧版数据迁移",
-        "Legacy data migration",
-        "数据与诊断",
-        "Data & diagnostics",
-        "旧版数据",
-        "迁移报告",
-        "导入旧数据",
-        "Data Migrator",
-        "legacy data migration",
-        "legacy data",
-        "migration report",
-        "import old data",
-        "只读扫描本机旧版数据",
-        "按五个高层数据组选择迁移范围",
-        "通过独立 Data Migrator 导入并查看去敏报告",
-        "Read-only scan of local legacy data",
-        "Choose migration scope across five high-level data groups",
-        "Import through the standalone Data Migrator and inspect redacted reports",
-        "只读扫描本机旧版数据来源及所选数据组",
-        "Read-only scan the local legacy source and selected data groups",
-        "选择设置、扩展、会话、记忆和远程连接迁移范围",
-        "Choose settings, extensions, sessions, memory, and remote-connection migration scope",
-        "确认关闭影响后启动独立 Data Migrator",
-        "Launch the standalone Data Migrator after confirming shutdown impact",
-        "查看最近运行结果和各领域去敏状态",
-        "Inspect the latest run result and redacted per-domain status",
-        "恢复已关闭的首次启动迁移提醒",
-        "Restore the first-start migration reminder after it was disabled",
-        "打开旧版数据迁移",
-        "带我查看数据迁移报告",
-        "Open legacy data migration",
-        "Show me the data migration report"
-      ],
-      "docsUrl": "https://playbook.openbitfun.com/capabilities/setting.data.migration/"
-    },
     {
       "id": "setting.data.diagnostics",
       "kind": "setting",
diff --git a/src/web-ui/src/app/scenes/browser/BrowserAddressField.presentation.test.ts b/src/web-ui/src/app/scenes/browser/BrowserAddressField.presentation.test.ts
index 70a27fdf57..7631f7dec3 100644
--- a/src/web-ui/src/app/scenes/browser/BrowserAddressField.presentation.test.ts
+++ b/src/web-ui/src/app/scenes/browser/BrowserAddressField.presentation.test.ts
@@ -5,7 +5,7 @@ import { describe, expect, it } from 'vitest';
 const stylesheets = [
   './BrowserPanel.scss',
   './BrowserScene.scss',
-].map(path => readFileSync(fileURLToPath(new URL(path, import.meta.url)), 'utf8'));
+].map(path => readFileSync(fileURLToPath(new URL(path, import.meta.url)), 'utf8').replaceAll('\r\n', '\n'));
 
 function addressWrapperRule(stylesheet: string): string {
   const match = stylesheet.match(/&__address\s*\{([\s\S]*?)\n\s*}\n\n\s*&__address-field/);
diff --git a/src/web-ui/src/app/scenes/file-viewer/FileViewerNav.appearance.ts b/src/web-ui/src/app/scenes/file-viewer/FileViewerNav.appearance.ts
index 5d1e0eb4e5..9ac43e1000 100644
--- a/src/web-ui/src/app/scenes/file-viewer/FileViewerNav.appearance.ts
+++ b/src/web-ui/src/app/scenes/file-viewer/FileViewerNav.appearance.ts
@@ -1,2 +1,10 @@
 import type { AppearanceSurfaceDescriptor } from '@/infrastructure/appearance';
-export const fileViewerNavAppearanceDescriptor: AppearanceSurfaceDescriptor = { id: 'file-viewer-nav', parts: [{ id: 'root' }, { id: 'header' }, { id: 'actions' }] };
+export const fileViewerNavAppearanceDescriptor: AppearanceSurfaceDescriptor = {
+  id: 'file-viewer-nav',
+  parts: [
+    { id: 'root' }, { id: 'header' }, { id: 'actions' },
+    { id: 'workspace' }, { id: 'workspaceButton' }, { id: 'location' }, { id: 'sections' },
+    { id: 'divider' }, { id: 'terminalList' }, { id: 'terminalRow' }, { id: 'terminalOpen' },
+    { id: 'terminalMeta' }, { id: 'status' }, { id: 'terminalActions' }, { id: 'empty' }, { id: 'error' },
+  ],
+};
diff --git a/src/web-ui/src/app/scenes/file-viewer/FileViewerNav.presentation.test.ts b/src/web-ui/src/app/scenes/file-viewer/FileViewerNav.presentation.test.ts
index 249a4364cd..511e7d407e 100644
--- a/src/web-ui/src/app/scenes/file-viewer/FileViewerNav.presentation.test.ts
+++ b/src/web-ui/src/app/scenes/file-viewer/FileViewerNav.presentation.test.ts
@@ -5,7 +5,7 @@ import { resolve } from 'node:path';
 import { compile } from 'sass';
 import { describe, expect, it } from 'vitest';
 
-const navSource = readFileSync(resolve(__dirname, 'FileViewerNav.tsx'), 'utf8').replace(
+const navSource = readFileSync(resolve(__dirname, '../workspace-resources/WorkspaceResourcePanel.tsx'), 'utf8').replace(
   /\r\n/g,
   '\n',
 );
diff --git a/src/web-ui/src/app/scenes/file-viewer/FileViewerNav.scss b/src/web-ui/src/app/scenes/file-viewer/FileViewerNav.scss
index 4e0c51073c..a872af1995 100644
--- a/src/web-ui/src/app/scenes/file-viewer/FileViewerNav.scss
+++ b/src/web-ui/src/app/scenes/file-viewer/FileViewerNav.scss
@@ -27,7 +27,7 @@
   &__header {
     display: flex;
     align-items: center;
-    justify-content: flex-end;
+    justify-content: space-between;
     flex-shrink: 0;
     height: 32px;
     padding: 0 var(--openbitfun-space-2);
@@ -39,4 +39,181 @@
     flex-shrink: 0;
     gap: 2px;
   }
+
+  &__workspace {
+    padding: var(--openbitfun-space-2) var(--openbitfun-space-3);
+    border-bottom: 1px solid var(--openbitfun-color-border-subtle);
+    min-inline-size: 0;
+  }
+
+  &__workspace-button {
+    display: flex;
+    align-items: center;
+    gap: var(--openbitfun-space-2);
+    inline-size: 100%;
+    min-inline-size: 0;
+    padding: 4px 0;
+    border: 0;
+    background: transparent;
+    color: var(--openbitfun-color-content-primary);
+    font: inherit;
+    font-size: var(--openbitfun-type-label-md-font-size);
+    font-weight: var(--openbitfun-type-label-selected-font-weight);
+    text-align: start;
+    cursor: pointer;
+
+    &:disabled { cursor: default; }
+    > .openbitfun-overflow-text { flex: 1; }
+  }
+
+  &__location {
+    display: flex;
+    align-items: center;
+    gap: var(--openbitfun-space-2);
+    min-inline-size: 0;
+    padding-block: 2px;
+    color: var(--openbitfun-color-content-muted);
+    font-size: var(--openbitfun-type-label-xs-font-size);
+    > span:first-child { flex-shrink: 0; }
+  }
+
+  &__sections {
+    display: flex;
+    flex-direction: column;
+    flex: 1;
+    min-block-size: 0;
+    overflow: hidden;
+  }
+
+  &__section {
+    display: flex;
+    flex-direction: column;
+    min-block-size: 32px;
+    overflow: hidden;
+  }
+
+  &__section--terminals {
+    border-top: 1px solid var(--openbitfun-color-border-subtle);
+  }
+
+  &__section-toggle {
+    display: flex;
+    align-items: center;
+    gap: var(--openbitfun-space-1);
+    min-inline-size: 0;
+    flex: 1;
+    align-self: stretch;
+    border: 0;
+    padding: 0;
+    background: transparent;
+    color: var(--openbitfun-color-content-secondary);
+    font: inherit;
+    font-size: var(--openbitfun-type-label-sm-font-size);
+    font-weight: var(--openbitfun-type-label-selected-font-weight);
+    text-align: start;
+    cursor: pointer;
+  }
+
+  &__section-body {
+    display: flex;
+    flex-direction: column;
+    flex: 1;
+    min-block-size: 0;
+    overflow: hidden;
+    &[hidden] { display: none; }
+  }
+
+  &__count {
+    margin-inline-start: var(--openbitfun-space-1);
+    font-size: var(--openbitfun-type-label-xs-font-size);
+    font-weight: var(--openbitfun-type-label-md-font-weight);
+    color: var(--openbitfun-color-content-muted);
+    font-variant-numeric: tabular-nums;
+  }
+
+  &__divider {
+    flex: 0 0 5px;
+    cursor: row-resize;
+    touch-action: none;
+    background: transparent;
+    &:hover, &:focus-visible { background: var(--openbitfun-color-action-quiet-hover); }
+  }
+
+  &__terminal-list {
+    overflow: auto;
+    overscroll-behavior: contain;
+    min-block-size: 0;
+    padding: 2px var(--openbitfun-space-2) var(--openbitfun-space-2);
+    scrollbar-gutter: stable;
+  }
+
+  &__terminal-row {
+    display: flex;
+    align-items: center;
+    min-inline-size: 0;
+    border-radius: var(--openbitfun-radius-sm);
+    &:hover, &:focus-within { background: var(--openbitfun-color-action-quiet-hover); }
+    &.is-selected { background: var(--openbitfun-color-selection-surface); }
+  }
+
+  &__terminal-open {
+    display: flex;
+    align-items: center;
+    gap: var(--openbitfun-space-2);
+    flex: 1;
+    min-inline-size: 0;
+    padding: 7px var(--openbitfun-space-1);
+    border: 0;
+    border-radius: inherit;
+    background: transparent;
+    color: var(--openbitfun-color-content-secondary);
+    text-align: start;
+    font: inherit;
+    font-size: var(--openbitfun-type-label-sm-font-size);
+    cursor: pointer;
+    &:disabled { cursor: default; }
+    > svg { flex-shrink: 0; }
+  }
+
+  &__terminal-text { display: flex; flex-direction: column; flex: 1; min-inline-size: 0; gap: 2px; }
+  &__terminal-meta {
+    display: flex;
+    align-items: center;
+    min-inline-size: 0;
+    gap: var(--openbitfun-space-2);
+    color: var(--openbitfun-color-content-muted);
+    font-size: var(--openbitfun-type-label-xs-font-size);
+  }
+  &__source { flex-shrink: 0; }
+  &__status {
+    flex-shrink: 0;
+    font-size: var(--openbitfun-type-label-xs-font-size);
+    color: var(--openbitfun-color-content-muted);
+    &[data-status='running'] { color: var(--openbitfun-color-status-success-content); }
+    &[data-status='unknown'] { color: var(--openbitfun-color-status-warning-content); }
+  }
+  &__terminal-actions { display: flex; flex-shrink: 0; align-items: center; padding-inline-end: 2px; }
+  &__empty {
+    margin: 0;
+    padding: var(--openbitfun-space-2);
+    color: var(--openbitfun-color-content-muted);
+    font-size: var(--openbitfun-type-label-sm-font-size);
+    line-height: var(--openbitfun-type-body-sm-line-height);
+  }
+  &__error {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    flex-shrink: 0;
+    gap: var(--openbitfun-space-2);
+    padding: var(--openbitfun-space-2) var(--openbitfun-space-3);
+    color: var(--openbitfun-color-content-secondary);
+    font-size: var(--openbitfun-type-label-sm-font-size);
+    line-height: var(--openbitfun-type-body-sm-line-height);
+  }
+  &__workspace-button:focus-visible, &__section-toggle:focus-visible,
+  &__terminal-open:focus-visible, &__divider:focus-visible {
+    outline: 2px solid var(--openbitfun-color-focus-ring);
+    outline-offset: -2px;
+  }
 }
diff --git a/src/web-ui/src/app/scenes/file-viewer/FileViewerNav.tsx b/src/web-ui/src/app/scenes/file-viewer/FileViewerNav.tsx
index ed5f0bfc9e..9bbdc6b82f 100644
--- a/src/web-ui/src/app/scenes/file-viewer/FileViewerNav.tsx
+++ b/src/web-ui/src/app/scenes/file-viewer/FileViewerNav.tsx
@@ -1,115 +1,2 @@
-/**
- * FileViewerNav — scene-specific navigation for the file viewer scene.
- *
- * NavBar owns the scene title and navigation controls. This panel keeps the
- * workspace-specific file actions above the file tree or search results.
- */
-
-import React, { useState, useCallback } from 'react';
-import {
-  Icon,
-  IconButton,
-  NavigationPanel,
-  NavigationPanelBody,
-  NavigationPanelContent,
-  NavigationPanelHeader,
-  Tooltip,
-} from '@openbitfun/ui';
-import { List, FilePlus, FolderPlus } from 'lucide-react';
-import { useTranslation } from 'react-i18next';
-import { useCurrentWorkspace } from '../../../infrastructure/contexts/WorkspaceContext';
-import { useI18n } from '@/infrastructure/i18n';
-
-import type { FileExplorerToolbarHandlers } from '@/tools/file-system';
-import FilesPanel from '../../components/panels/FilesPanel';
-import './FileViewerNav.scss';
-
-const FileViewerNav: React.FC = () => {
-  const { workspace: currentWorkspace } = useCurrentWorkspace();
-  const { t } = useI18n('common');
-  const { t: tTools } = useI18n('tools');
-  const { t: tFiles } = useTranslation('panels/files');
-  const [viewMode, setViewMode] = useState<'tree' | 'search'>('tree');
-  const [explorerToolbar, setExplorerToolbar] = useState<FileExplorerToolbarHandlers | null>(null);
-
-  const handleToggleViewMode = useCallback(() => {
-    setViewMode(prev => prev === 'tree' ? 'search' : 'tree');
-  }, []);
-
-  return (
-    <NavigationPanel
-      data-openbitfun-component="file-viewer-nav"
-      data-openbitfun-part="root"
-      className="openbitfun-file-viewer-nav"
-      aria-label={t('nav.items.project')}
-    >
-      {currentWorkspace?.rootPath && (
-        <NavigationPanelHeader className="openbitfun-file-viewer-nav__panel-header">
-          <div
-            className="openbitfun-file-viewer-nav__header"
-            data-openbitfun-component="file-viewer-nav"
-            data-openbitfun-part="header"
-            role="toolbar"
-            aria-label={t('nav.items.project')}
-          >
-            <span className="openbitfun-file-viewer-nav__actions" data-openbitfun-component="file-viewer-nav" data-openbitfun-part="actions">
-              {viewMode === 'tree' && explorerToolbar && (
-                <>
-                  <Tooltip content={tTools('fileTree.newFile')} placement="bottom">
-                    <IconButton
-                      size="sm"
-                      aria-label={tTools('fileTree.newFile')}
-                      icon={<FilePlus />}
-                      onClick={explorerToolbar.onNewFile}
-                    />
-                  </Tooltip>
-                  <Tooltip content={tTools('fileTree.newFolder')} placement="bottom">
-                    <IconButton
-                      size="sm"
-                      aria-label={tTools('fileTree.newFolder')}
-                      icon={<FolderPlus />}
-                      onClick={explorerToolbar.onNewFolder}
-                    />
-                  </Tooltip>
-                  <Tooltip content={tTools('fileTree.refresh')} placement="bottom">
-                    <IconButton
-                      size="sm"
-                      aria-label={tTools('fileTree.refresh')}
-                      icon={<Icon name="refresh" size="lg" />}
-                      onClick={explorerToolbar.onRefresh}
-                    />
-                  </Tooltip>
-                </>
-              )}
-              <Tooltip
-                content={viewMode === 'tree' ? tFiles('actions.switchToSearch') : tFiles('actions.switchToTree')}
-                placement="bottom"
-              >
-                <IconButton
-                  size="sm"
-                  aria-label={viewMode === 'tree' ? tFiles('actions.switchToSearch') : tFiles('actions.switchToTree')}
-                  icon={viewMode === 'tree' ? <Icon name="search" size="sm" /> : <List />}
-                  onClick={handleToggleViewMode}
-                />
-              </Tooltip>
-            </span>
-          </div>
-        </NavigationPanelHeader>
-      )}
-      <NavigationPanelBody className="openbitfun-file-viewer-nav__body">
-        <NavigationPanelContent className="openbitfun-file-viewer-nav__content">
-          <FilesPanel
-            workspacePath={currentWorkspace?.rootPath}
-            hideHeader
-            hideExplorerToolbar
-            onExplorerToolbarApi={setExplorerToolbar}
-            viewMode={viewMode}
-            onViewModeChange={setViewMode}
-          />
-        </NavigationPanelContent>
-      </NavigationPanelBody>
-    </NavigationPanel>
-  );
-};
-
-export default FileViewerNav;
+// Preserve the existing scene entry and appearance identity for saved navigation and skins.
+export { default } from '../workspace-resources/WorkspaceResourcePanel';
diff --git a/src/web-ui/src/app/scenes/nav-registry.ts b/src/web-ui/src/app/scenes/nav-registry.ts
index 8c78eb0e03..774f78a396 100644
--- a/src/web-ui/src/app/scenes/nav-registry.ts
+++ b/src/web-ui/src/app/scenes/nav-registry.ts
@@ -43,7 +43,7 @@ const SCENE_NAV_REGISTRY: Partial<Record<SceneTabId, SceneNavRegistration>> = {
   },
   'file-viewer': {
     component: lazy(loadFileViewerNav),
-    titleKey: 'nav.items.project',
+    titleKey: 'nav.resources.title',
     preload: loadFileViewerNav,
   },
 };
diff --git a/src/web-ui/src/app/scenes/settings/settingsRegistry.test.ts b/src/web-ui/src/app/scenes/settings/settingsRegistry.test.ts
index ce7458ab48..7dd3066e23 100644
--- a/src/web-ui/src/app/scenes/settings/settingsRegistry.test.ts
+++ b/src/web-ui/src/app/scenes/settings/settingsRegistry.test.ts
@@ -15,7 +15,7 @@ vi.mock('@/infrastructure/i18n/core/I18nService', () => ({
 }));
 
 describe('settings information architecture', () => {
-  it('uses five ownership categories and twenty-one canonical pages', () => {
+  it('uses five ownership categories and twenty canonical pages', () => {
     expect(SETTINGS_CATEGORIES.map((category) => category.id)).toEqual([
       'application',
       'ai',
@@ -23,8 +23,8 @@ describe('settings information architecture', () => {
       'tools',
       'data',
     ]);
-    expect(SETTINGS_PAGE_MANIFESTS).toHaveLength(21);
-    expect(new Set(SETTINGS_PAGE_MANIFESTS.map((page) => page.id)).size).toBe(21);
+    expect(SETTINGS_PAGE_MANIFESTS).toHaveLength(20);
+    expect(new Set(SETTINGS_PAGE_MANIFESTS.map((page) => page.id)).size).toBe(20);
   });
 
   it('keeps memory with AI, pet with application, and review inside execution', () => {
@@ -142,13 +142,10 @@ describe('settings information architecture', () => {
     expect(dataPages?.map((page) => page.id)).toEqual([
       'data.usage',
       'data.archived',
-      'data.migration',
       'data.diagnostics',
     ]);
     expect(SETTINGS_PAGE_MANIFESTS.find((page) => page.id === 'data.usage')?.views).toBeUndefined();
     expect(SETTINGS_PAGE_MANIFESTS.find((page) => page.id === 'data.archived')?.views).toBeUndefined();
-    expect(SETTINGS_PAGE_MANIFESTS.find((page) => page.id === 'data.migration')?.namespaces)
-      .toEqual(['settings/legacy-migration']);
   });
 
   it('contains old links at the upgrade boundary and emits canonical destinations', () => {
diff --git a/src/web-ui/src/app/scenes/settings/settingsRegistry.ts b/src/web-ui/src/app/scenes/settings/settingsRegistry.ts
index 64fa3d00df..bec302602d 100644
--- a/src/web-ui/src/app/scenes/settings/settingsRegistry.ts
+++ b/src/web-ui/src/app/scenes/settings/settingsRegistry.ts
@@ -377,21 +377,6 @@ export const SETTINGS_PAGE_MANIFESTS: readonly SettingsPageManifest[] = [
     ],
     load: () => import('./components/ArchivedSessionsConfig'),
   }),
-  definePage({
-    id: 'data.migration',
-    categoryId: 'data',
-    labelKey: 'navigation.pages.legacyMigration.label',
-    descriptionKey: 'navigation.pages.legacyMigration.description',
-    keywords: ['legacy', 'migration', 'import', 'upgrade', 'maintenance'],
-    namespaces: ['settings/legacy-migration'],
-    searchPhrases: [
-      phrase('settings/legacy-migration', 'title'),
-      phrase('settings/legacy-migration', 'subtitle'),
-      phrase('settings/legacy-migration', 'sections.source.title'),
-      phrase('settings/legacy-migration', 'sections.report.title'),
-    ],
-    load: () => import('../../../infrastructure/config/components/LegacyMigrationSettingsPage'),
-  }),
   definePage({
     id: 'data.diagnostics',
     categoryId: 'data',
diff --git a/src/web-ui/src/app/scenes/settings/settingsTypes.ts b/src/web-ui/src/app/scenes/settings/settingsTypes.ts
index 8caa196a31..848833b8b5 100644
--- a/src/web-ui/src/app/scenes/settings/settingsTypes.ts
+++ b/src/web-ui/src/app/scenes/settings/settingsTypes.ts
@@ -25,7 +25,6 @@ export type SettingsPageId =
   | 'tools.acp'
   | 'data.usage'
   | 'data.archived'
-  | 'data.migration'
   | 'data.diagnostics';
 
 export type SettingsViewId =
diff --git a/src/web-ui/src/app/scenes/shell/hooks/shellEntryTypes.ts b/src/web-ui/src/app/scenes/shell/hooks/shellEntryTypes.ts
index 6b8f458848..da2bc34f49 100644
--- a/src/web-ui/src/app/scenes/shell/hooks/shellEntryTypes.ts
+++ b/src/web-ui/src/app/scenes/shell/hooks/shellEntryTypes.ts
@@ -14,6 +14,7 @@ export interface ShellEntry {
   name: string;
   isRunning: boolean;
   isPersisted: boolean;
+  status?: string;
   profileId?: string;
   cwd?: string;
   workingDirectory?: string;
@@ -29,7 +30,17 @@ export interface SaveShellEntryInput {
 
 export function isSessionRunning(session: SessionResponse): boolean {
   const normalizedStatus = String(session.status).toLowerCase();
-  return !['exited', 'stopped', 'error', 'terminating'].includes(normalizedStatus);
+  return ['active', 'running', 'ready', 'orphaned', 'starting', 'restoring'].includes(normalizedStatus);
+}
+
+export function getShellEntryState(entry: ShellEntry): 'running' | 'starting' | 'stopping' | 'saved' | 'exited' | 'error' | 'unknown' {
+  const status = entry.status?.toLowerCase() ?? '';
+  if (status === 'saved') return 'saved';
+  if (status === 'starting' || status === 'restoring') return 'starting';
+  if (status === 'terminating') return 'stopping';
+  if (status === 'error') return 'error';
+  if (status === 'stopped' || status.startsWith('exited')) return 'exited';
+  return entry.isRunning ? 'running' : 'unknown';
 }
 
 export function compareShellEntries(a: ShellEntry, b: ShellEntry): number {
@@ -51,11 +62,12 @@ export function createManualProfileEntry(
   return {
     id: profile.id,
     kind: 'manual-profile',
-    source: MANUAL_SOURCE,
+    source: session?.source ?? MANUAL_SOURCE,
     sessionId: profile.sessionId,
     name: profile.name,
     isRunning: session ? isSessionRunning(session) : false,
     isPersisted: true,
+    status: session?.status ?? 'saved',
     profileId: profile.id,
     cwd: session?.cwd,
     workingDirectory: profile.workingDirectory,
@@ -76,6 +88,7 @@ export function createSessionEntry(
     name: session.name,
     isRunning: isSessionRunning(session),
     isPersisted: false,
+    status: session.status,
     cwd: session.cwd,
     workingDirectory: session.cwd,
     shellType: session.shellType,
diff --git a/src/web-ui/src/app/scenes/shell/hooks/useManualTerminalProfiles.ts b/src/web-ui/src/app/scenes/shell/hooks/useManualTerminalProfiles.ts
index b9a2f55c39..cfe6f0a98a 100644
--- a/src/web-ui/src/app/scenes/shell/hooks/useManualTerminalProfiles.ts
+++ b/src/web-ui/src/app/scenes/shell/hooks/useManualTerminalProfiles.ts
@@ -11,6 +11,7 @@ import {
 
 interface UseManualTerminalProfilesReturn {
   profiles: ManualTerminalProfile[];
+  error: string | null;
   profilesBySessionId: Map<string, ManualTerminalProfile>;
   refreshProfiles: () => void;
   saveProfile: (input: ManualTerminalProfileInput) => ManualTerminalProfile | null;
@@ -22,15 +23,25 @@ interface UseManualTerminalProfilesReturn {
 export function useManualTerminalProfiles(
   workspacePath?: string,
 ): UseManualTerminalProfilesReturn {
-  const [profiles, setProfiles] = useState<ManualTerminalProfile[]>([]);
+  const [snapshot, setSnapshot] = useState<{
+    key: string | undefined; profiles: ManualTerminalProfile[]; error: string | null;
+  }>({ key: workspacePath, profiles: [], error: null });
+  const profiles = useMemo(() => snapshot.key === workspacePath ? snapshot.profiles : [], [snapshot, workspacePath]);
 
   const refreshProfiles = useCallback(() => {
     if (!workspacePath) {
-      setProfiles([]);
+      setSnapshot({ key: workspacePath, profiles: [], error: null });
       return;
     }
 
-    setProfiles(listManualTerminalProfiles(workspacePath));
+    try {
+      setSnapshot({ key: workspacePath, profiles: listManualTerminalProfiles(workspacePath), error: null });
+    } catch (error) {
+      setSnapshot(previous => ({
+        key: workspacePath, profiles: previous.key === workspacePath ? previous.profiles : [],
+        error: error instanceof Error ? error.message : String(error),
+      }));
+    }
   }, [workspacePath]);
 
   useEffect(() => {
@@ -79,6 +90,7 @@ export function useManualTerminalProfiles(
 
   return {
     profiles,
+    error: snapshot.key === workspacePath ? snapshot.error : null,
     profilesBySessionId,
     refreshProfiles,
     saveProfile,
diff --git a/src/web-ui/src/app/scenes/shell/hooks/useShellEntries.ts b/src/web-ui/src/app/scenes/shell/hooks/useShellEntries.ts
index e1262d7c70..78cf030b63 100644
--- a/src/web-ui/src/app/scenes/shell/hooks/useShellEntries.ts
+++ b/src/web-ui/src/app/scenes/shell/hooks/useShellEntries.ts
@@ -1,5 +1,6 @@
-import { useCallback, useMemo, useState } from 'react';
-import { useCurrentWorkspace } from '@/infrastructure/contexts/WorkspaceContext';
+import { useCallback, useEffect, useMemo, useState, useSyncExternalStore } from 'react';
+import { useWorkspaceContext } from '@/infrastructure/contexts/WorkspaceContext';
+import { getActiveSurfaceScope, onSurfaceActivated } from '@/infrastructure/peer-device/deviceSurface';
 import { openShellSessionTarget } from '@/shared/services/openShellSessionTarget';
 import {
   AGENT_SOURCE,
@@ -11,21 +12,25 @@ import {
   type ShellEntry,
 } from './shellEntryTypes';
 import { useManualTerminalProfiles } from './useManualTerminalProfiles';
+import { getTerminalService } from '@/tools/terminal/services/TerminalService';
 import { useTerminalSessions } from './useTerminalSessions';
 
 interface EditingTerminalState {
   entry: ShellEntry;
+  key: string | undefined;
 }
 
 export interface UseShellEntriesReturn {
   entries: ShellEntry[];
+  loading: boolean;
+  error: string | null;
   editModalOpen: boolean;
   editingTerminal: EditingTerminalState | null;
   closeEditModal: () => void;
   refresh: () => Promise<void>;
-  createManualTerminal: (shellType?: string) => Promise<void>;
+  createManualTerminal: (shellType?: string, directory?: string, shellId?: string) => Promise<void>;
   openEntry: (entry: ShellEntry) => Promise<void>;
-  startEntry: (entry: ShellEntry) => Promise<boolean>;
+  startEntry: (entry: ShellEntry) => Promise<string>;
   stopEntry: (entry: ShellEntry) => Promise<void>;
   deleteEntry: (entry: ShellEntry) => Promise<void>;
   openEditModal: (entry: ShellEntry) => void;
@@ -33,23 +38,37 @@ export interface UseShellEntriesReturn {
 }
 
 export function useShellEntries(): UseShellEntriesReturn {
-  const { workspacePath, workspace } = useCurrentWorkspace();
+  const { workspacePath, activeWorkspace: workspace, openedWorkspacesList } = useWorkspaceContext();
+  const scope = useSyncExternalStore(onSurfaceActivated, getActiveSurfaceScope, getActiveSurfaceScope);
   const isRemote = workspace?.workspaceKind === 'remote';
   const currentConnectionId = workspace?.connectionId ?? null;
-
-  const [editModalOpen, setEditModalOpen] = useState(false);
-  const [editingTerminal, setEditingTerminal] = useState<EditingTerminalState | null>(null);
+  // Keep legacy local keys; never load controller profiles on another target.
+  const profileKey = scope.surfaceId === 'local' && !isRemote
+    ? workspacePath : scope.key('terminal-profiles', currentConnectionId, workspacePath);
+  const workspaces = useMemo(() => openedWorkspacesList.map(item => ({
+    rootPath: item.rootPath, isRemote: item.workspaceKind === 'remote', connectionId: item.connectionId,
+  })), [openedWorkspacesList]);
+
+  const [editingState, setEditingTerminal] = useState<EditingTerminalState | null>(null);
+  const editingTerminal = editingState?.key === profileKey ? editingState : null;
+  const editModalOpen = editingTerminal !== null;
+  useEffect(() => { setEditingTerminal(null); }, [profileKey, scope]);
 
   const {
     profiles,
+    error: profilesError,
     profilesBySessionId,
     refreshProfiles,
     saveProfile,
     removeProfile,
     getProfileById,
     getProfileBySessionId,
-  } = useManualTerminalProfiles(workspacePath);
+  } = useManualTerminalProfiles(workspacePath ? profileKey : undefined);
+  const savedSessionIds = useMemo(() => new Set(profiles.map(profile => profile.sessionId)), [profiles]);
   const {
+    assertCurrent,
+    loading,
+    error,
     sessions,
     sessionMap,
     refreshSessions,
@@ -63,6 +82,9 @@ export function useShellEntries(): UseShellEntriesReturn {
     workspacePath,
     isRemote,
     currentConnectionId,
+    scope,
+    workspaces,
+    savedSessionIds,
   });
 
   const manualEntries = useMemo<ShellEntry[]>(() => {
@@ -80,10 +102,10 @@ export function useShellEntries(): UseShellEntriesReturn {
   const agentEntries = useMemo<ShellEntry[]>(
     () =>
       sessions
-        .filter((session) => session.source === AGENT_SOURCE)
+        .filter((session) => session.source === AGENT_SOURCE && !profilesBySessionId.has(session.id))
         .map((session) => createSessionEntry(session, 'agent-session'))
         .sort(compareShellEntries),
-    [sessions],
+    [profilesBySessionId, sessions],
   );
 
   const entries = useMemo<ShellEntry[]>(
@@ -93,31 +115,47 @@ export function useShellEntries(): UseShellEntriesReturn {
 
   const refresh = useCallback(async () => {
     await refreshSessions();
+    assertCurrent();
     refreshProfiles();
-  }, [refreshProfiles, refreshSessions]);
+  }, [assertCurrent, refreshProfiles, refreshSessions]);
 
   const openShellSession = useCallback((sessionId: string, sessionName: string) => {
+    assertCurrent();
     openShellSessionTarget({ sessionId, sessionName });
-  }, []);
-
-  const startEntry = useCallback(
-    (entry: ShellEntry) => startEntrySession(entry),
-    [startEntrySession],
-  );
+  }, [assertCurrent]);
+
+  const startEntry = useCallback(async (entry: ShellEntry) => {
+    const { session, created } = await startEntrySession(entry);
+    assertCurrent();
+    // SSH and older hosts may allocate a new id despite the requested id.
+    // Bind the saved configuration before running a command that can fail.
+    if (entry.profileId && session.id !== entry.sessionId) {
+      saveProfile({
+        id: entry.profileId, sessionId: session.id, name: entry.name,
+        workingDirectory: entry.workingDirectory, startupCommand: entry.startupCommand,
+        shellType: entry.shellType,
+      });
+    }
+    openShellSession(session.id, entry.name);
+    if (created && entry.startupCommand?.trim()) {
+      await getTerminalService().sendCommand(session.id, entry.startupCommand);
+      assertCurrent();
+    }
+    return session.id;
+  }, [assertCurrent, openShellSession, saveProfile, startEntrySession]);
 
   const openEntry = useCallback(async (entry: ShellEntry) => {
-    if (!entry.isRunning) {
-      const started = await startEntry(entry);
-      if (!started) {
-        return;
-      }
+    assertCurrent();
+    if (!entry.isRunning && entry.isPersisted) {
+      setEditingTerminal({ entry, key: profileKey });
+      return;
     }
 
     openShellSession(entry.sessionId, entry.name);
-  }, [openShellSession, startEntry]);
+  }, [assertCurrent, openShellSession, profileKey]);
 
-  const createManualTerminal = useCallback(async (shellType?: string) => {
-    const session = await createManualSession(shellType);
+  const createManualTerminal = useCallback(async (shellType?: string, directory?: string, shellId?: string) => {
+    const session = await createManualSession(shellType, directory, shellId);
     if (session) {
       openShellSession(session.id, session.name);
     }
@@ -128,28 +166,31 @@ export function useShellEntries(): UseShellEntriesReturn {
   }, [stopEntrySession]);
 
   const deleteEntry = useCallback(async (entry: ShellEntry) => {
+    assertCurrent();
     if (entry.profileId) {
       removeProfile(entry.profileId);
+      return;
     }
 
+    if (entry.isRunning) throw new Error('Stop the terminal before removing it');
     if (hasSession(entry.sessionId)) {
       await closeSessionIfPresent(entry.sessionId);
     }
 
     await refreshSessions();
-  }, [closeSessionIfPresent, hasSession, refreshSessions, removeProfile]);
+  }, [assertCurrent, closeSessionIfPresent, hasSession, refreshSessions, removeProfile]);
 
   const openEditModal = useCallback((entry: ShellEntry) => {
-    setEditingTerminal({ entry });
-    setEditModalOpen(true);
-  }, []);
+    assertCurrent();
+    setEditingTerminal({ entry, key: profileKey });
+  }, [assertCurrent, profileKey]);
 
   const closeEditModal = useCallback(() => {
-    setEditModalOpen(false);
     setEditingTerminal(null);
   }, []);
 
   const saveEdit = useCallback((input: SaveShellEntryInput) => {
+    assertCurrent();
     if (!editingTerminal || !workspacePath) {
       return;
     }
@@ -173,10 +214,12 @@ export function useShellEntries(): UseShellEntriesReturn {
     }
 
     closeEditModal();
-  }, [closeEditModal, editingTerminal, getProfileById, getProfileBySessionId, hasSession, renameSessionLocally, saveProfile, workspacePath]);
+  }, [assertCurrent, closeEditModal, editingTerminal, getProfileById, getProfileBySessionId, hasSession, renameSessionLocally, saveProfile, workspacePath]);
 
   return {
     entries,
+    loading,
+    error: error || profilesError,
     editModalOpen,
     editingTerminal,
     closeEditModal,
diff --git a/src/web-ui/src/app/scenes/shell/hooks/useTerminalSessions.ts b/src/web-ui/src/app/scenes/shell/hooks/useTerminalSessions.ts
index 615aaadf1c..31114adce7 100644
--- a/src/web-ui/src/app/scenes/shell/hooks/useTerminalSessions.ts
+++ b/src/web-ui/src/app/scenes/shell/hooks/useTerminalSessions.ts
@@ -1,225 +1,171 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
-import { getTerminalService, type TerminalService } from '@/tools/terminal/services/TerminalService';
-import type { SessionResponse, TerminalEvent } from '@/tools/terminal/types/session';
-import { configManager } from '@/infrastructure/config/services/ConfigManager';
-import type { TerminalConfig } from '@/infrastructure/config/types';
-import { createLogger } from '@/shared/utils/logger';
+import { getTerminalService } from '@/tools/terminal/services/TerminalService';
+import type { SessionResponse } from '@/tools/terminal/types/session';
+import { createManualTerminalSession } from '@/shared/services/createManualTerminalSession';
+import type { SurfaceScope } from '@/infrastructure/peer-device/deviceSurface';
 import {
-  isSessionRunning,
-  MANUAL_SOURCE,
-  type ShellEntry,
-} from './shellEntryTypes';
-
-const log = createLogger('useTerminalSessions');
+  terminalBelongsToWorkspace, terminalMatchesEnvironment, type TerminalWorkspaceScope,
+} from '@/tools/terminal/services/terminalWorkspaceScope';
+import { isSessionRunning, type ShellEntry } from './shellEntryTypes';
 
 interface UseTerminalSessionsOptions {
   workspacePath?: string;
   isRemote: boolean;
   currentConnectionId: string | null;
+  scope: SurfaceScope;
+  workspaces: TerminalWorkspaceScope[];
+  savedSessionIds: Set<string>;
 }
-
-interface UseTerminalSessionsReturn {
+interface SessionSnapshot {
+  key: string;
   sessions: SessionResponse[];
-  sessionMap: Map<string, SessionResponse>;
-  refreshSessions: () => Promise<void>;
-  startEntrySession: (entry: ShellEntry) => Promise<boolean>;
-  createManualSession: (shellType?: string) => Promise<SessionResponse | null>;
-  stopEntrySession: (entry: ShellEntry) => Promise<void>;
-  closeSessionIfPresent: (sessionId: string) => Promise<void>;
-  renameSessionLocally: (sessionId: string, newName: string) => void;
-  hasSession: (sessionId: string) => boolean;
-}
-
-async function getDefaultShellType(): Promise<string | undefined> {
-  try {
-    const config = await configManager.getConfig<TerminalConfig>('terminal');
-    return config?.default_shell || undefined;
-  } catch {
-    return undefined;
-  }
+  loading: boolean;
+  error: string | null;
 }
-
-function dispatchTerminalDestroyed(sessionId: string) {
-  if (typeof window === 'undefined') {
-    return;
-  }
-
-  window.dispatchEvent(new CustomEvent('terminal-session-destroyed', { detail: { sessionId } }));
-}
-
-function dispatchTerminalRenamed(sessionId: string, newName: string) {
-  if (typeof window === 'undefined') {
-    return;
-  }
-
-  window.dispatchEvent(new CustomEvent('terminal-session-renamed', { detail: { sessionId, newName } }));
-}
-
-export function useTerminalSessions(
-  options: UseTerminalSessionsOptions,
-): UseTerminalSessionsReturn {
-  const { workspacePath, isRemote, currentConnectionId } = options;
-  const [sessions, setSessions] = useState<SessionResponse[]>([]);
-  const serviceRef = useRef<TerminalService | null>(null);
-
-  const sessionMap = useMemo(
-    () => new Map(sessions.map((session) => [session.id, session])),
-    [sessions],
+// Read projections survive panel navigation; they never own or stop a PTY.
+const snapshots = new Map<string, SessionResponse[]>();
+
+export function useTerminalSessions(options: UseTerminalSessionsOptions) {
+  const { workspacePath, isRemote, currentConnectionId, scope, workspaces, savedSessionIds } = options;
+  const key = scope.key('workspace-terminals', currentConnectionId, workspacePath);
+  const activation = useMemo(() => ({ key, scope }), [key, scope]);
+  const currentActivation = useRef<typeof activation | null>(activation);
+  currentActivation.current = activation;
+  useEffect(() => {
+    currentActivation.current = activation;
+    return () => { currentActivation.current = null; };
+  }, [activation]);
+  const requestVersion = useRef(0);
+  const [snapshot, setSnapshot] = useState<SessionSnapshot>(() => ({
+    key, sessions: snapshots.get(key) ?? [], loading: true, error: null,
+  }));
+  const sessions = useMemo(
+    () => snapshot.key === key ? snapshot.sessions : snapshots.get(key) ?? [],
+    [key, snapshot],
   );
+  const sessionMap = useMemo(() => new Map(sessions.map(session => [session.id, session])), [sessions]);
+  const target = useMemo<TerminalWorkspaceScope>(() => ({
+    rootPath: workspacePath ?? '', isRemote, connectionId: currentConnectionId,
+  }), [workspacePath, isRemote, currentConnectionId]);
+  const assertCurrent = useCallback(() => {
+    scope.assertCurrent('workspace terminal action');
+    if (currentActivation.current !== activation) throw new Error('Workspace changed during terminal action');
+    if (isRemote && !currentConnectionId) throw new Error('Remote workspace connection is unavailable');
+  }, [scope, activation, isRemote, currentConnectionId]);
 
   const refreshSessions = useCallback(async () => {
-    const service = serviceRef.current;
-    if (!service) {
-      return;
-    }
-
+    if (!workspacePath || !scope.isCurrent() || currentActivation.current !== activation) return;
+    const version = ++requestVersion.current;
+    setSnapshot(previous => ({
+      key, sessions: previous.key === key ? previous.sessions : snapshots.get(key) ?? [],
+      loading: true, error: previous.key === key ? previous.error : null,
+    }));
     try {
+      assertCurrent();
+      const service = getTerminalService();
+      await service.connect();
+      assertCurrent();
       const allSessions = await service.listSessions();
-      const filtered = allSessions.filter((session) => {
-        const isRemoteSession = session.shellType === 'Remote';
-        if (isRemote) {
-          return isRemoteSession && session.connectionId === currentConnectionId;
-        }
-        return !isRemoteSession;
-      });
-      setSessions(filtered);
+      if (!scope.isCurrent() || currentActivation.current !== activation || version !== requestVersion.current) return;
+      const filtered = allSessions.filter(session =>
+        (savedSessionIds.has(session.id) && terminalMatchesEnvironment(session, target))
+        || terminalBelongsToWorkspace(session, target, workspaces),
+      );
+      snapshots.set(key, filtered);
+      setSnapshot({ key, sessions: filtered, loading: false, error: null });
     } catch (error) {
-      log.error('Failed to list sessions', error);
+      if (!scope.isCurrent() || currentActivation.current !== activation || version !== requestVersion.current) return;
+      setSnapshot(previous => ({
+        key, sessions: previous.key === key ? previous.sessions : snapshots.get(key) ?? [],
+        loading: false, error: error instanceof Error ? error.message : String(error),
+      }));
     }
-  }, [currentConnectionId, isRemote]);
+  }, [activation, assertCurrent, key, savedSessionIds, scope, target, workspacePath, workspaces]);
 
   useEffect(() => {
     const service = getTerminalService();
-    serviceRef.current = service;
-
-    const init = async () => {
-      try {
-        await service.connect();
-        await refreshSessions();
-      } catch (error) {
-        log.error('Failed to connect terminal service', error);
-      }
-    };
-
-    void init();
-
-    const unsubscribe = service.onEvent((event: TerminalEvent) => {
-      if (event.type === 'ready' || event.type === 'exit') {
+    void refreshSessions();
+    const unsubscribe = service.onEvent(event => {
+      if (event.type === 'ready' || event.type === 'exit' || event.type === 'error') {
         void refreshSessions();
+      } else if (event.type === 'cwd' || event.type === 'title') {
+        if (!scope.isCurrent() || currentActivation.current !== activation) return;
+        setSnapshot(previous => {
+          if (previous.key !== key) return previous;
+          const next = previous.sessions.map(session => session.id !== event.sessionId ? session : {
+            ...session, ...(event.type === 'cwd' ? { cwd: event.cwd } : { name: event.title }),
+          });
+          snapshots.set(key, next);
+          return { ...previous, sessions: next };
+        });
       }
     });
-
-    return () => unsubscribe();
-  }, [refreshSessions]);
+    window.addEventListener('focus', refreshSessions);
+    return () => {
+      requestVersion.current += 1;
+      unsubscribe();
+      window.removeEventListener('focus', refreshSessions);
+    };
+  }, [activation, key, refreshSessions, scope]);
 
   const closeSessionIfPresent = useCallback(async (sessionId: string) => {
-    const service = serviceRef.current;
-    if (!service || !sessionMap.has(sessionId)) {
-      return;
-    }
-
-    try {
-      await service.closeSession(sessionId);
-      dispatchTerminalDestroyed(sessionId);
-    } catch (error) {
-      log.error('Failed to close terminal session', { sessionId, error });
-    }
-  }, [sessionMap]);
-
-  const startEntrySession = useCallback(async (entry: ShellEntry): Promise<boolean> => {
-    const service = serviceRef.current;
-    const existingSession = sessionMap.get(entry.sessionId);
-    if (!service) {
-      return false;
-    }
-
-    try {
-      if (existingSession && !isSessionRunning(existingSession)) {
-        await service.closeSession(entry.sessionId);
-      }
-
-      const shellType = entry.shellType ?? await getDefaultShellType();
-      await service.createSession({
-        sessionId: entry.sessionId,
-        workingDirectory: entry.workingDirectory ?? entry.cwd ?? workspacePath,
-        name: entry.name,
-        shellType,
-        source: entry.source,
-      });
-
-      if (entry.startupCommand?.trim()) {
-        await new Promise((resolve) => setTimeout(resolve, 800));
-        try {
-          await service.sendCommand(entry.sessionId, entry.startupCommand);
-        } catch (error) {
-          log.error('Failed to run startup command', { sessionId: entry.sessionId, error });
-        }
-      }
-
-      await refreshSessions();
-      return true;
-    } catch (error) {
-      log.error('Failed to start terminal entry', { entry, error });
-      return false;
-    }
-  }, [refreshSessions, sessionMap, workspacePath]);
-
-  const createManualSession = useCallback(async (shellTypeOverride?: string): Promise<SessionResponse | null> => {
-    const service = serviceRef.current;
-    if (!service) {
-      return null;
-    }
-
-    try {
-      const shellType = shellTypeOverride ?? await getDefaultShellType();
-      const nextIndex = sessions.filter((session) => session.source === MANUAL_SOURCE).length + 1;
-      const session = await service.createSession({
-        workingDirectory: workspacePath,
-        name: `Shell ${nextIndex}`,
-        shellType,
-        source: MANUAL_SOURCE,
-      });
-
-      await refreshSessions();
-      return session;
-    } catch (error) {
-      log.error('Failed to create manual terminal', error);
-      return null;
-    }
-  }, [refreshSessions, sessions, workspacePath]);
-
-  const stopEntrySession = useCallback(async (entry: ShellEntry) => {
-    const session = sessionMap.get(entry.sessionId);
-    if (!session || !isSessionRunning(session)) {
-      return;
+    assertCurrent();
+    if (!sessionMap.has(sessionId)) return;
+    await getTerminalService().closeSession(sessionId);
+    assertCurrent();
+    window.dispatchEvent(new CustomEvent('terminal-session-destroyed', { detail: { sessionId } }));
+    await refreshSessions();
+  }, [assertCurrent, refreshSessions, sessionMap]);
+
+  const startEntrySession = useCallback(async (entry: ShellEntry) => {
+    assertCurrent();
+    const current = sessionMap.get(entry.sessionId);
+    if (current && isSessionRunning(current)) return { session: current, created: false };
+    if (current) {
+      await getTerminalService().closeSession(entry.sessionId);
+      assertCurrent();
     }
-
-    await closeSessionIfPresent(entry.sessionId);
+    const session = await createManualTerminalSession({
+      workspacePath: entry.workingDirectory ?? entry.cwd ?? workspacePath,
+      connectionId: currentConnectionId, shellType: entry.shellType,
+      sessionId: entry.sessionId, name: entry.name,
+    });
+    assertCurrent();
     await refreshSessions();
-  }, [closeSessionIfPresent, refreshSessions, sessionMap]);
-
+    assertCurrent();
+    return { session, created: true };
+  }, [assertCurrent, currentConnectionId, refreshSessions, sessionMap, workspacePath]);
+
+  const createManualSession = useCallback(async (shellType?: string, directory?: string, shellId?: string) => {
+    assertCurrent();
+    const session = await createManualTerminalSession({
+      workspacePath: directory ?? workspacePath, connectionId: currentConnectionId, shellType, shellId,
+    });
+    assertCurrent();
+    await refreshSessions();
+    assertCurrent();
+    return session;
+  }, [assertCurrent, currentConnectionId, refreshSessions, workspacePath]);
+  const stopEntrySession = useCallback(async (entry: ShellEntry) => {
+    if (entry.isRunning) await closeSessionIfPresent(entry.sessionId);
+  }, [closeSessionIfPresent]);
   const renameSessionLocally = useCallback((sessionId: string, newName: string) => {
-    if (!sessionMap.has(sessionId)) {
-      return;
-    }
-
-    setSessions((prev) =>
-      prev.map((session) => (session.id === sessionId ? { ...session, name: newName } : session)),
-    );
-    dispatchTerminalRenamed(sessionId, newName);
-  }, [sessionMap]);
-
+    assertCurrent();
+    setSnapshot(previous => {
+      if (previous.key !== key) return previous;
+      const next = previous.sessions.map(session => session.id === sessionId ? { ...session, name: newName } : session);
+      snapshots.set(key, next);
+      return { ...previous, sessions: next };
+    });
+    window.dispatchEvent(new CustomEvent('terminal-session-renamed', { detail: { sessionId, newName } }));
+  }, [assertCurrent, key]);
   const hasSession = useCallback((sessionId: string) => sessionMap.has(sessionId), [sessionMap]);
 
   return {
-    sessions,
-    sessionMap,
-    refreshSessions,
-    startEntrySession,
-    createManualSession,
-    stopEntrySession,
-    closeSessionIfPresent,
-    renameSessionLocally,
-    hasSession,
+    assertCurrent,
+    sessions, sessionMap, loading: snapshot.key !== key || snapshot.loading,
+    error: snapshot.key === key ? snapshot.error : null,
+    refreshSessions, startEntrySession, createManualSession, stopEntrySession, closeSessionIfPresent,
+    renameSessionLocally, hasSession,
   };
 }
diff --git a/src/web-ui/src/app/scenes/terminal/TerminalActionBridge.tsx b/src/web-ui/src/app/scenes/terminal/TerminalActionBridge.tsx
index 2909a112e5..97984693ef 100644
--- a/src/web-ui/src/app/scenes/terminal/TerminalActionBridge.tsx
+++ b/src/web-ui/src/app/scenes/terminal/TerminalActionBridge.tsx
@@ -3,28 +3,53 @@ import { useCurrentWorkspace } from '@/infrastructure/contexts/WorkspaceContext'
 import { createManualTerminalSession } from '@/shared/services/createManualTerminalSession';
 import { openShellSessionTarget } from '@/shared/services/openShellSessionTarget';
 import { createLogger } from '@/shared/utils/logger';
+import { getActiveSurfaceScope } from '@/infrastructure/peer-device/deviceSurface';
+import { isTerminalPathInside, normalizeTerminalPath } from '@/tools/terminal/services/terminalWorkspaceScope';
+import { notificationService } from '@/shared/notification-system';
+import { useI18n } from '@/infrastructure/i18n';
 
 const log = createLogger('TerminalActionBridge');
 
 /** Handles global terminal actions while keeping terminal creation out of NavPanel. */
 export const TerminalActionBridge: FC = () => {
+  const { t } = useI18n('common');
   const { workspacePath, workspace } = useCurrentWorkspace();
   const creatingRef = useRef(false);
+  const workspaceKey = JSON.stringify([workspace?.id, workspace?.connectionId, workspace?.workspaceKind, workspacePath]);
+  const currentWorkspaceKey = useRef(workspaceKey);
+  currentWorkspaceKey.current = workspaceKey;
 
   useEffect(() => {
-    const handleCreate = () => {
+    let active = true;
+    const handleCreate = (event: Event) => {
+      const detail = (event as CustomEvent<{
+        workingDirectory?: string; workspacePath?: string; surfaceId?: string;
+      }>).detail;
+      const scope = getActiveSurfaceScope();
+      const remote = workspace?.workspaceKind === 'remote';
+      if (detail?.surfaceId && detail.surfaceId !== scope.surfaceId) return;
+      if (detail?.workspacePath && normalizeTerminalPath(detail.workspacePath, remote) !== normalizeTerminalPath(workspacePath, remote)) return;
+      if (detail?.workingDirectory && !isTerminalPathInside(detail.workingDirectory, workspacePath, remote)) return;
+      if (remote && !workspace?.connectionId) {
+        notificationService.error(t('nav.resources.unavailable'));
+        return;
+      }
       if (creatingRef.current) return;
       creatingRef.current = true;
 
       void createManualTerminalSession({
-        workspacePath,
+        workspacePath: detail?.workingDirectory ?? workspacePath,
         connectionId: workspace?.connectionId,
       })
         .then((session) => {
+          if (!active || !scope.isCurrent() || currentWorkspaceKey.current !== workspaceKey) return;
           openShellSessionTarget({ sessionId: session.id, sessionName: session.name });
         })
         .catch((error) => {
           log.error('Failed to create terminal from global action', error);
+          if (active && scope.isCurrent() && currentWorkspaceKey.current === workspaceKey) notificationService.error(t('nav.resources.actionFailed', {
+            error: error instanceof Error ? error.message : String(error),
+          }));
         })
         .finally(() => {
           creatingRef.current = false;
@@ -32,8 +57,11 @@ export const TerminalActionBridge: FC = () => {
     };
 
     window.addEventListener('terminal-create-requested', handleCreate);
-    return () => window.removeEventListener('terminal-create-requested', handleCreate);
-  }, [workspace?.connectionId, workspacePath]);
+    return () => {
+      active = false;
+      window.removeEventListener('terminal-create-requested', handleCreate);
+    };
+  }, [t, workspace?.connectionId, workspace?.workspaceKind, workspaceKey, workspacePath]);
 
   return null;
 };
diff --git a/src/web-ui/src/app/scenes/terminal/TerminalScene.tsx b/src/web-ui/src/app/scenes/terminal/TerminalScene.tsx
index 2b0ba0587f..352db9570b 100644
--- a/src/web-ui/src/app/scenes/terminal/TerminalScene.tsx
+++ b/src/web-ui/src/app/scenes/terminal/TerminalScene.tsx
@@ -22,10 +22,6 @@ const TerminalScene: React.FC<TerminalSceneProps> = ({ isActive = true }) => {
   const { activeSessionId, setActiveSession } = useTerminalSceneStore();
   const { t } = useTranslation('panels/terminal');
 
-  const handleExit = useCallback(() => {
-    setActiveSession(null);
-  }, [setActiveSession]);
-
   const handleClose = useCallback(() => {
     setActiveSession(null);
   }, [setActiveSession]);
@@ -49,8 +45,8 @@ const TerminalScene: React.FC<TerminalSceneProps> = ({ isActive = true }) => {
           autoFocus={isActive}
           showToolbar
           showStatusBar
-          onExit={handleExit}
           onClose={handleClose}
+          closeBehavior="detach"
         />
       ) : (
         <div className="openbitfun-terminal-scene__empty" data-testid="shell-command-list" data-openbitfun-scene="terminal" data-openbitfun-part="empty">
diff --git a/src/web-ui/src/app/scenes/workspace-resources/README.md b/src/web-ui/src/app/scenes/workspace-resources/README.md
new file mode 100644
index 0000000000..b813dc2fb7
--- /dev/null
+++ b/src/web-ui/src/app/scenes/workspace-resources/README.md
@@ -0,0 +1,87 @@
+# Workspace resources
+
+The workspace's folder entry opens one persistent navigation panel containing files
+and terminals. Opening this panel leaves the active conversation or editor intact.
+The existing `file-viewer` scene id and `file-viewer-nav` appearance identity remain
+compatible with navigation, links and installed skins.
+
+## Ownership
+
+| Owner | Responsibility |
+| --- | --- |
+| `WorkspaceResourcePanel` | Workspace identity, composition, accessible section controls and action feedback |
+| `workspaceResourceState` | Device/workspace-scoped layout preferences; no files, terminal processes or credentials |
+| `FilesPanel` / file-explorer | File operations, tree state, search and navigation |
+| Existing Shell hooks | Workspace terminal projections, saved configurations and explicit terminal actions |
+| `TerminalService` / platform adapter | Terminal transport, event subscriptions and device-epoch boundaries |
+| `terminal-core` | PTY lifetime and immutable initial working directory |
+
+The panel reuses existing owners; it does not create an independent terminal manager
+or filesystem cache. Search preferences are kept in the file-explorer owner under an
+explicit resource key, while results are refreshed from the target.
+
+## Interaction contracts
+
+- File and terminal sections scroll independently and support collapse. The splitter
+  supports pointer capture, arrow keys, Shift for larger increments, and Home/End.
+  Empty terminals consume only a compact section.
+- File and terminal content opens keep workspace navigation visible. Explicit
+  navigation back to the main sidebar is respected; settings keep their own navigation.
+- File-tree context menus can create a terminal in the selected directory. A terminal
+  can reveal its current directory when it is inside the active workspace.
+  Reveal preserves unrelated expanded folders, applies the target's path semantics,
+  and addresses virtual rows by data index, including compressed directory chains.
+- Opening a saved configuration does not run its startup command. Start, stop and
+  remove are explicit actions. Removing a saved configuration does not stop its PTY.
+- Regular terminal tabs carry `terminalCloseBehavior: detach`. Closing those tabs
+  or the standalone terminal view does not stop the process. Specialized and legacy
+  terminal tabs retain their existing lifetime policy.
+- Exiting a shell leaves its output visible; only closing the view clears its selection.
+- A running status means an active terminal session, not that its foreground program
+  or development server is healthy.
+
+## Workspace and device scope
+
+Layout and terminal projections include the device surface and remote connection.
+Asynchronous terminal work checks the originating device epoch and workspace before
+committing UI state or opening a view. A panel unmount only detaches UI listeners.
+
+Terminal ownership is projected from the immutable creation directory. Among nested
+opened projects, the closest matching root owns the terminal. Current-directory events
+change the displayed location without moving the terminal between projects. Saved
+configurations remain attached to the workspace in which they were saved.
+
+Remote paths use POSIX semantics even on a Windows controller. New SSH terminals pass
+the owning connection explicitly and do not apply the controller's shell executable.
+Host errors retain the last terminal projection and show an unavailable state; an
+unsupported CLI peer terminal command remains visibly unsupported.
+
+## Compatibility
+
+`initialCwd` is optional response enrichment backed by the existing terminal-core
+`initial_cwd` fact. Old payloads deserialize and round-trip unchanged. Older hosts
+without this field remain usable: the frontend anchors their first observed directory
+for the terminal-service lifetime. A fresh client cannot reconstruct an earlier
+directory an old host never supplied.
+
+Existing local saved-terminal keys and their version-1 records remain readable.
+Unknown record fields survive edits. Unreadable configurations and newer record
+versions remain intact, with read/write errors surfaced instead of reporting a save.
+Other devices and SSH connections use isolated namespaces. Ambiguous historical
+path-only profiles are left intact and are not automatically imported onto another
+host.
+
+The feature is a shared Web UI surface over existing adapters. Remote-workspace and
+peer scoping have contract coverage; these tests do not establish live SSH/peer,
+mobile Remote Control, or Detached Dispatch end-to-end behavior.
+
+## Focused verification
+
+```bash
+pnpm --dir src/web-ui run test:run src/tools/terminal/services/terminalWorkspaceScope.test.ts src/tools/terminal/services/manualTerminalProfileService.test.ts src/tools/file-system/utils/fileTreeReveal.test.ts src/app/scenes/workspace-resources/workspaceResources.test.ts src/app/scenes/workspace-resources/terminalViewLifecycle.test.tsx
+cargo test -p terminal-core --lib workspace_origin_contract_tests
+pnpm run check:web
+pnpm run i18n:audit
+```
+
+No mock-based visual validation or browser control is required for this change.
diff --git a/src/web-ui/src/app/scenes/workspace-resources/WorkspaceResourcePanel.tsx b/src/web-ui/src/app/scenes/workspace-resources/WorkspaceResourcePanel.tsx
new file mode 100644
index 0000000000..9b3464e499
--- /dev/null
+++ b/src/web-ui/src/app/scenes/workspace-resources/WorkspaceResourcePanel.tsx
@@ -0,0 +1,207 @@
+import { useCallback, useEffect, useId, useRef, useState, useSyncExternalStore } from 'react';
+import { FilePlus, FolderPlus, List, RotateCw } from 'lucide-react';
+import {
+  Icon, IconButton, NavigationPanel, NavigationPanelBody, NavigationPanelContent,
+  NavigationPanelHeader, OverflowText, Tooltip,
+} from '@openbitfun/ui';
+import { useI18n } from '@/infrastructure/i18n';
+import { getWorkspaceDisplayName, useWorkspaceContext } from '@/infrastructure/contexts/WorkspaceContext';
+import { getActiveSurfaceScope, onSurfaceActivated } from '@/infrastructure/peer-device/deviceSurface';
+import { globalEventBus } from '@/infrastructure/event-bus';
+import type { FileExplorerToolbarHandlers } from '@/tools/file-system';
+import { isTerminalPathInside } from '@/tools/terminal/services/terminalWorkspaceScope';
+import type { ShellInfo } from '@/tools/terminal/types/session';
+import { getTerminalService } from '@/tools/terminal/services/TerminalService';
+import FilesPanel from '../../components/panels/FilesPanel';
+import TerminalEditModal from '../../components/panels/TerminalEditModal';
+import { useShellEntries } from '../shell/hooks';
+import { DEFAULT_RESOURCE_LAYOUT, useWorkspaceResourceState } from './workspaceResourceState';
+import WorkspaceTerminals from './WorkspaceTerminals';
+import { useResourceSplit } from './useResourceSplit';
+import { showResourceMenu } from './resourceMenus';
+import '../file-viewer/FileViewerNav.scss';
+
+export default function WorkspaceResourcePanel() {
+  const { activeWorkspace } = useWorkspaceContext();
+  const scope = useSyncExternalStore(onSurfaceActivated, getActiveSurfaceScope, getActiveSurfaceScope);
+  const resourceKey = scope.key('workspace-resources', activeWorkspace?.connectionId, activeWorkspace?.id, activeWorkspace?.rootPath);
+  return <WorkspaceResourceContent key={resourceKey} resourceKey={resourceKey} />;
+}
+
+function WorkspaceResourceContent({ resourceKey }: { resourceKey: string }) {
+  const { t, formatNumber } = useI18n('common');
+  const { t: tFiles } = useI18n('panels/files');
+  const { t: tTools } = useI18n('tools');
+  const { activeWorkspace: workspace, openedWorkspacesList, setActiveWorkspace } = useWorkspaceContext();
+  const scope = getActiveSurfaceScope();
+  const terminals = useShellEntries();
+  const layout = useWorkspaceResourceState(state => state.layouts[resourceKey] ?? DEFAULT_RESOURCE_LAYOUT);
+  const updateLayout = useWorkspaceResourceState(state => state.updateLayout);
+  const [toolbar, setToolbar] = useState<FileExplorerToolbarHandlers | null>(null);
+  const [busy, setBusy] = useState(false);
+  const busyRef = useRef(false);
+  const mounted = useRef(true);
+  const [actionError, setActionError] = useState<string | null>(null);
+  const [selectedTerminal, setSelectedTerminal] = useState<string | null>(null);
+  const [pendingReveal, setPendingReveal] = useState<string | null>(null);
+  const [shells, setShells] = useState<ShellInfo[]>([]);
+  const container = useRef<HTMLDivElement>(null);
+  const filesId = useId();
+  const terminalsId = useId();
+  const split = useResourceSplit(container, layout.terminalFraction, fraction => updateLayout(resourceKey, { terminalFraction: fraction }));
+  const hasTerminalContent = terminals.entries.length > 0 || Boolean(terminals.error || actionError);
+  const showSplit = !layout.filesCollapsed && !layout.terminalsCollapsed && hasTerminalContent;
+  const isRemote = workspace?.workspaceKind === 'remote';
+
+  useEffect(() => {
+    mounted.current = true;
+    return () => { mounted.current = false; };
+  }, []);
+  useEffect(() => {
+    if (isRemote) return;
+    let cancelled = false;
+    void getTerminalService().getAvailableShells().then(items => {
+      if (!cancelled && scope.isCurrent()) setShells(items.filter(item => item.available));
+    }).catch(() => { /* Default terminal creation reports errors through the action surface. */ });
+    return () => { cancelled = true; };
+  }, [isRemote, scope]);
+  const run = useCallback((action: () => void | Promise<unknown>) => {
+    if (busyRef.current || !mounted.current || !scope.isCurrent()) return;
+    busyRef.current = true;
+    setBusy(true);
+    setActionError(null);
+    void Promise.resolve().then(() => {
+      if (mounted.current && scope.isCurrent()) return action();
+    }).catch(error => {
+      if (mounted.current && scope.isCurrent()) {
+        setActionError(error instanceof Error ? error.message : String(error));
+      }
+    }).finally(() => {
+      busyRef.current = false;
+      if (mounted.current) setBusy(false);
+    });
+  }, [scope]);
+  const revealDirectory = useCallback((path: string) => {
+    if (!mounted.current || !scope.isCurrent()) return;
+    updateLayout(resourceKey, { filesCollapsed: false, fileView: 'tree' });
+    setPendingReveal(path);
+  }, [resourceKey, scope, updateLayout]);
+  useEffect(() => {
+    if (!pendingReveal || layout.filesCollapsed || layout.fileView !== 'tree') return;
+    globalEventBus.emit('file-explorer:navigate', { path: pendingReveal, scrollIntoView: true });
+    setPendingReveal(null);
+  }, [pendingReveal, layout.filesCollapsed, layout.fileView]);
+
+  const workspaceName = getWorkspaceDisplayName(workspace);
+  const location = isRemote ? workspace?.connectionName || workspace?.sshHost || t('nav.resources.remote')
+    : scope.surfaceId === 'local' ? t('nav.resources.local') : t('nav.resources.peer');
+  const error = actionError || terminals.error;
+  const createTerminal = (shellType?: string, shellId?: string) => run(async () => {
+    updateLayout(resourceKey, { terminalsCollapsed: false });
+    await terminals.createManualTerminal(shellType, undefined, shellId);
+  });
+
+  return (
+    <NavigationPanel className="openbitfun-file-viewer-nav" aria-label={t('nav.resources.title')}
+      data-openbitfun-component="file-viewer-nav" data-openbitfun-part="root" data-testid="workspace-resources">
+      <NavigationPanelHeader className="openbitfun-file-viewer-nav__panel-header">
+        <div className="openbitfun-file-viewer-nav__workspace" data-openbitfun-component="file-viewer-nav" data-openbitfun-part="workspace">
+          <button type="button" data-overflow-trigger className="openbitfun-file-viewer-nav__workspace-button"
+            data-openbitfun-component="file-viewer-nav" data-openbitfun-part="workspaceButton"
+            disabled={openedWorkspacesList.length < 2 || busy} aria-haspopup="menu"
+            aria-label={t('nav.resources.switchWorkspace')}
+            onClick={event => showResourceMenu(event, openedWorkspacesList.map(item => ({
+              id: item.id, label: getWorkspaceDisplayName(item), icon: item.id === workspace?.id ? 'Check' : 'Folder',
+              onClick: () => run(async () => { await setActiveWorkspace(item.id); }),
+            })))}>
+            <Icon name="folder" size="sm" />
+            <OverflowText>{workspaceName || t('nav.resources.title')}</OverflowText>
+            {openedWorkspacesList.length > 1 && <Icon name="chevron-down" size="xs" />}
+          </button>
+          {workspace && <div className="openbitfun-file-viewer-nav__location" data-overflow-trigger
+            data-openbitfun-component="file-viewer-nav" data-openbitfun-part="location">
+            <span>{location}</span><OverflowText title={workspace.rootPath}>{workspace.rootPath}</OverflowText>
+          </div>}
+        </div>
+      </NavigationPanelHeader>
+      <NavigationPanelBody className="openbitfun-file-viewer-nav__body">
+        <NavigationPanelContent className="openbitfun-file-viewer-nav__content">
+          {!workspace ? <p className="openbitfun-file-viewer-nav__empty">{tFiles('empty.selectWorkspace')}</p> : (
+            <div ref={container} className="openbitfun-file-viewer-nav__sections"
+              data-openbitfun-component="file-viewer-nav" data-openbitfun-part="sections">
+              <section className="openbitfun-file-viewer-nav__section" aria-label={t('nav.resources.files')}
+                style={{ flex: layout.filesCollapsed ? '0 0 auto' : showSplit ? `${1 - split.fraction} 1 0` : '1 1 0' }}>
+                <div className="openbitfun-file-viewer-nav__header" data-openbitfun-component="file-viewer-nav" data-openbitfun-part="header">
+                  <button type="button" className="openbitfun-file-viewer-nav__section-toggle" aria-expanded={!layout.filesCollapsed}
+                    aria-controls={filesId} onClick={() => updateLayout(resourceKey, { filesCollapsed: !layout.filesCollapsed })}>
+                    <Icon name={layout.filesCollapsed ? 'chevron-right' : 'chevron-down'} size="xs" />{t('nav.resources.files')}
+                  </button>
+                  <div className="openbitfun-file-viewer-nav__actions" data-openbitfun-component="file-viewer-nav" data-openbitfun-part="actions">
+                    {layout.fileView === 'tree' && toolbar && <>
+                      <Tooltip content={tTools('fileTree.newFile')}><IconButton size="xs" aria-label={tTools('fileTree.newFile')} icon={<FilePlus />} onClick={toolbar.onNewFile} /></Tooltip>
+                      <Tooltip content={tTools('fileTree.newFolder')}><IconButton size="xs" aria-label={tTools('fileTree.newFolder')} icon={<FolderPlus />} onClick={toolbar.onNewFolder} /></Tooltip>
+                      <Tooltip content={tTools('fileTree.refresh')}><IconButton size="xs" aria-label={tTools('fileTree.refresh')} icon={<RotateCw />} onClick={toolbar.onRefresh} /></Tooltip>
+                    </>}
+                    <Tooltip content={layout.fileView === 'tree' ? tFiles('actions.switchToSearch') : tFiles('actions.switchToTree')}>
+                      <IconButton size="xs" aria-label={layout.fileView === 'tree' ? tFiles('actions.switchToSearch') : tFiles('actions.switchToTree')}
+                        icon={layout.fileView === 'tree' ? <Icon name="search" size="xs" /> : <List />}
+                        onClick={() => updateLayout(resourceKey, { filesCollapsed: false, fileView: layout.fileView === 'tree' ? 'search' : 'tree' })} />
+                    </Tooltip>
+                  </div>
+                </div>
+                <div id={filesId} hidden={layout.filesCollapsed} className="openbitfun-file-viewer-nav__section-body">
+                  <FilesPanel workspacePath={workspace.rootPath} searchStateKey={resourceKey} hideHeader hideExplorerToolbar onExplorerToolbarApi={setToolbar}
+                    viewMode={layout.fileView} onViewModeChange={fileView => updateLayout(resourceKey, { fileView })} />
+                </div>
+              </section>
+              {showSplit && <div className="openbitfun-file-viewer-nav__divider" role="separator" tabIndex={0}
+                data-openbitfun-component="file-viewer-nav" data-openbitfun-part="divider"
+                aria-label={t('nav.resources.resize')} aria-orientation="horizontal" aria-controls={terminalsId}
+                aria-valuemin={15} aria-valuemax={75} aria-valuenow={Math.round(split.fraction * 100)}
+                {...split.handlers} />}
+              <section className="openbitfun-file-viewer-nav__section openbitfun-file-viewer-nav__section--terminals" aria-label={t('nav.resources.terminals')}
+                style={{ flex: layout.terminalsCollapsed || !hasTerminalContent ? '0 0 auto' : showSplit ? `${split.fraction} 1 0` : '1 1 0' }}>
+                <div className="openbitfun-file-viewer-nav__header" data-openbitfun-component="file-viewer-nav" data-openbitfun-part="header">
+                  <button type="button" className="openbitfun-file-viewer-nav__section-toggle" aria-expanded={!layout.terminalsCollapsed}
+                    aria-controls={terminalsId} onClick={() => updateLayout(resourceKey, { terminalsCollapsed: !layout.terminalsCollapsed })}>
+                    <Icon name={layout.terminalsCollapsed ? 'chevron-right' : 'chevron-down'} size="xs" />
+                    {t('nav.resources.terminals')}
+                    {terminals.entries.length > 0 && <span className="openbitfun-file-viewer-nav__count">{formatNumber(terminals.entries.length)}</span>}
+                  </button>
+                  <div className="openbitfun-file-viewer-nav__actions" data-openbitfun-component="file-viewer-nav" data-openbitfun-part="actions">
+                    <Tooltip content={t('nav.shell.actions.refresh')}><IconButton size="xs" aria-label={t('nav.shell.actions.refresh')} icon={<RotateCw />}
+                      disabled={busy || terminals.loading} onClick={() => run(terminals.refresh)} /></Tooltip>
+                    <Tooltip content={t('nav.shell.actions.newTerminal')}><IconButton size="xs" aria-label={t('nav.shell.actions.newTerminal')} icon={<Icon name="plus" size="xs" />}
+                      disabled={busy} onClick={() => createTerminal()} /></Tooltip>
+                    {!isRemote && shells.length > 1 && <IconButton size="xs" aria-label={t('nav.resources.chooseShell')} aria-haspopup="menu"
+                      icon={<Icon name="chevron-down" size="xs" />} disabled={busy}
+                      onClick={event => showResourceMenu(event, shells.map(shell => ({
+                        id: shell.id, label: shell.version ? `${shell.name} ${shell.version}` : shell.name,
+                        onClick: () => createTerminal(shell.shellType, shell.id),
+                      })))} />}
+                  </div>
+                </div>
+                <div id={terminalsId} hidden={layout.terminalsCollapsed} className="openbitfun-file-viewer-nav__section-body">
+                  {error && <div className="openbitfun-file-viewer-nav__error" role="alert" title={error}
+                    data-openbitfun-component="file-viewer-nav" data-openbitfun-part="error">
+                    <span>{actionError ? t('nav.resources.actionFailed', { error: actionError }) : t('nav.resources.unavailable')}</span>
+                    <IconButton size="xs" aria-label={t('nav.shell.actions.refresh')} icon={<RotateCw />} disabled={busy}
+                      onClick={() => run(terminals.refresh)} />
+                  </div>}
+                  <WorkspaceTerminals terminals={terminals} busy={busy} selectedId={selectedTerminal} onSelect={setSelectedTerminal}
+                    run={run} onReveal={revealDirectory}
+                    canReveal={path => isTerminalPathInside(path, workspace.rootPath, isRemote)} />
+                </div>
+              </section>
+            </div>
+          )}
+        </NavigationPanelContent>
+      </NavigationPanelBody>
+      <TerminalEditModal isOpen={terminals.editModalOpen} onClose={terminals.closeEditModal}
+        onSave={terminals.saveEdit}
+        initialName={terminals.editingTerminal?.entry.name ?? ''}
+        initialWorkingDirectory={terminals.editingTerminal?.entry.workingDirectory ?? terminals.editingTerminal?.entry.cwd}
+        initialStartupCommand={terminals.editingTerminal?.entry.startupCommand} />
+    </NavigationPanel>
+  );
+}
diff --git a/src/web-ui/src/app/scenes/workspace-resources/WorkspaceTerminals.tsx b/src/web-ui/src/app/scenes/workspace-resources/WorkspaceTerminals.tsx
new file mode 100644
index 0000000000..9994642631
--- /dev/null
+++ b/src/web-ui/src/app/scenes/workspace-resources/WorkspaceTerminals.tsx
@@ -0,0 +1,105 @@
+import { Play } from 'lucide-react';
+import { Icon, IconButton, OverflowText, Tooltip } from '@openbitfun/ui';
+import { useI18n } from '@/infrastructure/i18n';
+import type { MenuItem } from '@/shared/context-menu-system/types/menu.types';
+import type { ShellEntry, UseShellEntriesReturn } from '../shell/hooks';
+import { getShellEntryState } from '../shell/hooks/shellEntryTypes';
+import { showResourceMenu } from './resourceMenus';
+
+interface Props {
+  terminals: UseShellEntriesReturn;
+  busy: boolean;
+  selectedId: string | null;
+  onSelect: (id: string) => void;
+  run: (action: () => void | Promise<unknown>) => void;
+  onReveal: (path: string) => void;
+  canReveal: (path: string) => boolean;
+}
+
+export default function WorkspaceTerminals({ terminals, busy, selectedId, onSelect, run, onReveal, canReveal }: Props) {
+  const { t } = useI18n('common');
+  const { entries, error, loading } = terminals;
+  const statusLabels = {
+    running: t('nav.resources.status.running'), saved: t('nav.resources.status.saved'),
+    exited: t('nav.resources.status.exited'), unknown: t('nav.resources.status.unknown'),
+    starting: t('nav.resources.status.starting'), stopping: t('nav.resources.status.stopping'), error: t('nav.resources.status.error'),
+  };
+  const open = (entry: ShellEntry) => {
+    onSelect(entry.sessionId);
+    if (entry.isRunning) run(() => terminals.openEntry(entry));
+    else if (entry.isPersisted) run(() => terminals.openEditModal(entry));
+    else run(() => terminals.openEntry(entry));
+  };
+  const menuItems = (entry: ShellEntry): MenuItem[] => {
+    const cwd = entry.cwd ?? entry.workingDirectory;
+    return [
+      ...(entry.isRunning ? [{
+        id: 'stop', label: t('nav.shell.context.stop'), icon: 'Square',
+        disabled: busy || Boolean(error), onClick: () => run(() => terminals.stopEntry(entry)),
+      }] : entry.source === 'manual' && ['saved', 'exited', 'error'].includes(getShellEntryState(entry)) ? [{
+        id: 'start', label: t('nav.shell.context.start'), icon: 'Play',
+        disabled: busy || Boolean(error),
+        onClick: () => run(async () => { onSelect(await terminals.startEntry(entry)); }),
+      }] : []),
+      {
+        id: 'configure', label: t(entry.isPersisted ? 'nav.shell.context.editConfig' : 'nav.shell.context.saveConfig'),
+        icon: 'Settings', disabled: busy, onClick: () => run(() => terminals.openEditModal(entry)),
+      },
+      ...(cwd ? [{
+        id: 'reveal-directory', label: t('nav.resources.revealDirectory'), icon: 'FolderOpen',
+        disabled: busy || !canReveal(cwd), onClick: () => run(() => onReveal(cwd)),
+      }] : []),
+      {
+        id: 'remove', label: t(entry.isPersisted ? 'nav.shell.context.deleteSavedTerminal' : 'nav.resources.removeTerminal'),
+        icon: 'Trash2', disabled: busy || (!entry.isPersisted && entry.isRunning) || Boolean(error),
+        onClick: () => run(() => terminals.deleteEntry(entry)),
+      },
+    ];
+  };
+  return (
+    <div className="openbitfun-file-viewer-nav__terminal-list" data-openbitfun-component="file-viewer-nav" data-openbitfun-part="terminalList" aria-busy={loading}>
+      {entries.map(entry => {
+        const cwd = entry.cwd ?? entry.workingDirectory;
+        const state = error ? 'unknown' : getShellEntryState(entry);
+        const status = statusLabels[state];
+        const label = `${entry.name} · ${status}`;
+        return (
+          <div key={entry.id} className={`openbitfun-file-viewer-nav__terminal-row${selectedId === entry.sessionId ? ' is-selected' : ''}`}
+            data-openbitfun-component="file-viewer-nav" data-openbitfun-part="terminalRow"
+            data-testid="workspace-terminal" data-session-id={entry.sessionId}
+            onContextMenu={event => showResourceMenu(event, menuItems(entry), true)}>
+            <button type="button" data-overflow-trigger className="openbitfun-file-viewer-nav__terminal-open"
+              data-openbitfun-component="file-viewer-nav" data-openbitfun-part="terminalOpen"
+              aria-label={label} aria-pressed={selectedId === entry.sessionId} disabled={busy || Boolean(error) || state === 'unknown' || state === 'stopping'}
+              onClick={() => open(entry)}>
+              <Icon name="terminal" size="sm" />
+              <span className="openbitfun-file-viewer-nav__terminal-text">
+                <OverflowText>{entry.name}</OverflowText>
+                <span className="openbitfun-file-viewer-nav__terminal-meta" data-openbitfun-component="file-viewer-nav" data-openbitfun-part="terminalMeta">
+                  <span className="openbitfun-file-viewer-nav__source">{t(entry.source === 'agent' ? 'nav.resources.agent' : 'nav.resources.manual')}</span>
+                  {cwd && <OverflowText title={cwd}>{cwd}</OverflowText>}
+                </span>
+              </span>
+              <span className="openbitfun-file-viewer-nav__status" data-status={state}
+                data-openbitfun-component="file-viewer-nav" data-openbitfun-part="status">{status}</span>
+            </button>
+            <div className="openbitfun-file-viewer-nav__terminal-actions" data-openbitfun-component="file-viewer-nav" data-openbitfun-part="terminalActions">
+              {entry.isPersisted && ['saved', 'exited', 'error'].includes(state) && (
+                <Tooltip content={t('nav.shell.context.start')}>
+                  <IconButton size="xs" aria-label={t('nav.shell.context.start')} icon={<Play size={12} />}
+                    disabled={busy || Boolean(error)}
+                    onClick={() => run(async () => { onSelect(await terminals.startEntry(entry)); })} />
+                </Tooltip>
+              )}
+              <IconButton size="xs" aria-label={t('nav.resources.terminalActions')} icon={<Icon name="more" size="xs" />}
+                aria-haspopup="menu" onClick={event => showResourceMenu(event, menuItems(entry))} />
+            </div>
+          </div>
+        );
+      })}
+      {!loading && entries.length === 0 && !error && (
+        <p className="openbitfun-file-viewer-nav__empty" data-openbitfun-component="file-viewer-nav" data-openbitfun-part="empty">{t('nav.resources.noTerminals')}</p>
+      )}
+    </div>
+  );
+}
diff --git a/src/web-ui/src/app/scenes/workspace-resources/resourceMenus.ts b/src/web-ui/src/app/scenes/workspace-resources/resourceMenus.ts
new file mode 100644
index 0000000000..27cafeae66
--- /dev/null
+++ b/src/web-ui/src/app/scenes/workspace-resources/resourceMenus.ts
@@ -0,0 +1,16 @@
+import type { MouseEvent } from 'react';
+import { useContextMenuStore } from '@/shared/context-menu-system/store/ContextMenuStore';
+import { ContextType } from '@/shared/context-menu-system/types/context.types';
+import type { MenuItem } from '@/shared/context-menu-system/types/menu.types';
+
+export function showResourceMenu(event: MouseEvent<HTMLElement>, items: MenuItem[], atPointer = false) {
+  event.preventDefault();
+  event.stopPropagation();
+  const target = event.currentTarget;
+  const rect = target.getBoundingClientRect();
+  const position = atPointer ? { x: event.clientX, y: event.clientY } : { x: rect.left, y: rect.bottom };
+  useContextMenuStore.getState().showMenu(position, items, {
+    type: ContextType.CUSTOM, customType: 'workspace-resources', data: {},
+    event, targetElement: target, position, timestamp: Date.now(),
+  });
+}
diff --git a/src/web-ui/src/app/scenes/workspace-resources/terminalViewLifecycle.test.tsx b/src/web-ui/src/app/scenes/workspace-resources/terminalViewLifecycle.test.tsx
new file mode 100644
index 0000000000..b9cd33c3fb
--- /dev/null
+++ b/src/web-ui/src/app/scenes/workspace-resources/terminalViewLifecycle.test.tsx
@@ -0,0 +1,38 @@
+// @vitest-environment jsdom
+import { act } from 'react';
+import { createRoot } from 'react-dom/client';
+import { describe, expect, it } from 'vitest';
+import { useTabLifecycle } from '../../components/panels/content-canvas/hooks/useTabLifecycle';
+import { useAgentCanvasStore } from '../../components/panels/content-canvas/stores/canvasStore';
+
+// Exercise the actual hook and store. No terminal adapter or rendered UI is replaced.
+describe('workspace terminal view lifetime', () => {
+  it('closes one view and all views without invoking terminal destruction', async () => {
+    (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+    const container = document.createElement('div');
+    const root = createRoot(container);
+    let lifecycle: ReturnType<typeof useTabLifecycle> | undefined;
+    function Probe() {
+      lifecycle = useTabLifecycle({ mode: 'agent' });
+      return null;
+    }
+    useAgentCanvasStore.getState().reset();
+    const addTerminal = (id: string) => useAgentCanvasStore.getState().addTab({
+      type: 'terminal', title: id, data: { sessionId: id },
+      metadata: { terminalCloseBehavior: 'detach', sessionId: id },
+    }, 'active', 'primary');
+    try {
+      await act(async () => { root.render(<Probe />); });
+      await act(async () => { addTerminal('workspace-terminal-1'); addTerminal('workspace-terminal-2'); });
+      const firstId = useAgentCanvasStore.getState().primaryGroup.tabs[0].id;
+      await act(async () => { expect(await lifecycle!.handleCloseWithDirtyCheck(firstId, 'primary')).toBe(true); });
+      expect(useAgentCanvasStore.getState().primaryGroup.tabs).toHaveLength(1);
+      await act(async () => { expect(await lifecycle!.handleCloseAllWithDirtyCheck('primary')).toBe(true); });
+      expect(useAgentCanvasStore.getState().primaryGroup.tabs).toHaveLength(0);
+    } finally {
+      await act(async () => { root.unmount(); });
+      useAgentCanvasStore.getState().reset();
+      container.remove();
+    }
+  });
+});
diff --git a/src/web-ui/src/app/scenes/workspace-resources/useResourceSplit.ts b/src/web-ui/src/app/scenes/workspace-resources/useResourceSplit.ts
new file mode 100644
index 0000000000..42ec978df6
--- /dev/null
+++ b/src/web-ui/src/app/scenes/workspace-resources/useResourceSplit.ts
@@ -0,0 +1,47 @@
+import { useRef, useState, type KeyboardEvent, type PointerEvent, type RefObject } from 'react';
+
+export function useResourceSplit(
+  containerRef: RefObject<HTMLDivElement>,
+  fraction: number,
+  commit: (fraction: number) => void,
+) {
+  const [preview, setPreview] = useState<number | null>(null);
+  const drag = useRef<{ pointerId: number; y: number; fraction: number; height: number } | null>(null);
+  const latest = useRef(fraction);
+  const clamp = (value: number) => Math.max(0.15, Math.min(0.75, value));
+
+  const onPointerDown = (event: PointerEvent<HTMLDivElement>) => {
+    if (event.button !== 0 || !containerRef.current) return;
+    event.preventDefault();
+    const height = containerRef.current.getBoundingClientRect().height;
+    if (height <= 0) return;
+    drag.current = { pointerId: event.pointerId, y: event.clientY, fraction, height };
+    latest.current = fraction;
+    event.currentTarget.setPointerCapture(event.pointerId);
+  };
+  const onPointerMove = (event: PointerEvent<HTMLDivElement>) => {
+    const start = drag.current;
+    if (!start || start.pointerId !== event.pointerId) return;
+    latest.current = clamp(start.fraction - (event.clientY - start.y) / start.height);
+    setPreview(latest.current);
+  };
+  const finish = (event: PointerEvent<HTMLDivElement>) => {
+    if (drag.current?.pointerId !== event.pointerId) return;
+    drag.current = null;
+    if (event.currentTarget.hasPointerCapture(event.pointerId)) event.currentTarget.releasePointerCapture(event.pointerId);
+    commit(latest.current);
+    setPreview(null);
+  };
+  const onKeyDown = (event: KeyboardEvent<HTMLDivElement>) => {
+    const step = event.shiftKey ? 0.1 : 0.03;
+    const next = event.key === 'ArrowUp' ? fraction + step : event.key === 'ArrowDown' ? fraction - step
+      : event.key === 'Home' ? 0.15 : event.key === 'End' ? 0.75 : null;
+    if (next === null) return;
+    event.preventDefault();
+    commit(clamp(next));
+  };
+  return {
+    fraction: preview ?? fraction,
+    handlers: { onPointerDown, onPointerMove, onPointerUp: finish, onPointerCancel: finish, onLostPointerCapture: finish, onKeyDown },
+  };
+}
diff --git a/src/web-ui/src/app/scenes/workspace-resources/workspaceResourceState.ts b/src/web-ui/src/app/scenes/workspace-resources/workspaceResourceState.ts
new file mode 100644
index 0000000000..cae48f0eba
--- /dev/null
+++ b/src/web-ui/src/app/scenes/workspace-resources/workspaceResourceState.ts
@@ -0,0 +1,51 @@
+import { create } from 'zustand';
+import { createJSONStorage, persist } from 'zustand/middleware';
+
+export interface WorkspaceResourceLayout {
+  filesCollapsed: boolean;
+  terminalsCollapsed: boolean;
+  terminalFraction: number;
+  fileView: 'tree' | 'search';
+}
+
+export const DEFAULT_RESOURCE_LAYOUT: WorkspaceResourceLayout = {
+  filesCollapsed: false,
+  terminalsCollapsed: false,
+  terminalFraction: 0.3,
+  fileView: 'tree',
+};
+
+export function normalizeResourceLayout(input: Partial<WorkspaceResourceLayout> = {}): WorkspaceResourceLayout {
+  return {
+    filesCollapsed: input.filesCollapsed === true,
+    terminalsCollapsed: input.terminalsCollapsed === true,
+    terminalFraction: typeof input.terminalFraction === 'number' && Number.isFinite(input.terminalFraction)
+      ? Math.min(0.75, Math.max(0.15, input.terminalFraction)) : 0.3,
+    fileView: input.fileView === 'search' ? 'search' : 'tree',
+  };
+}
+
+interface ResourceState {
+  layouts: Record<string, WorkspaceResourceLayout>;
+  updateLayout: (key: string, update: Partial<WorkspaceResourceLayout>) => void;
+}
+
+/** Presentation preferences only. Files and PTYs retain their existing owners. */
+export const useWorkspaceResourceState = create<ResourceState>()(persist((set) => ({
+  layouts: {},
+  updateLayout: (key, update) => set(state => ({
+    layouts: { ...state.layouts, [key]: normalizeResourceLayout({ ...state.layouts[key], ...update }) },
+  })),
+}), {
+  name: 'openbitfun-workspace-resource-layouts',
+  version: 1,
+  storage: createJSONStorage(() => localStorage),
+  partialize: state => ({ layouts: state.layouts }),
+  merge: (persisted, current) => {
+    const layouts = (persisted as Partial<ResourceState> | undefined)?.layouts;
+    if (!layouts || typeof layouts !== 'object' || Array.isArray(layouts)) return current;
+    return { ...current, layouts: Object.fromEntries(Object.entries(layouts)
+      .filter(([, value]) => value && typeof value === 'object')
+      .map(([key, value]) => [key, normalizeResourceLayout(value)])) };
+  },
+}));
diff --git a/src/web-ui/src/app/scenes/workspace-resources/workspaceResources.test.ts b/src/web-ui/src/app/scenes/workspace-resources/workspaceResources.test.ts
new file mode 100644
index 0000000000..89756122ae
--- /dev/null
+++ b/src/web-ui/src/app/scenes/workspace-resources/workspaceResources.test.ts
@@ -0,0 +1,58 @@
+// @vitest-environment jsdom
+import { beforeEach, describe, expect, it } from 'vitest';
+import { useSceneStore } from '../../stores/sceneStore';
+import { useNavSceneStore } from '../../stores/navSceneStore';
+import { normalizeResourceLayout, useWorkspaceResourceState } from './workspaceResourceState';
+
+describe('workspace resource navigation', () => {
+  beforeEach(() => {
+    useSceneStore.getState().resetForPeerSwitch();
+    useNavSceneStore.getState().closeNavScene();
+  });
+  it('opens resources without replacing the active conversation', () => {
+    useSceneStore.getState().openScene('session');
+    useNavSceneStore.getState().openNavScene('file-viewer');
+    expect(useSceneStore.getState().activeTabId).toBe('session');
+  });
+  it('keeps resources during file, terminal and conversation navigation', () => {
+    useNavSceneStore.getState().openNavScene('file-viewer');
+    for (const scene of ['file-viewer', 'terminal', 'session'] as const) {
+      useSceneStore.getState().openScene(scene);
+      expect(useNavSceneStore.getState().showSceneNav).toBe(true);
+      expect(useNavSceneStore.getState().navSceneId).toBe('file-viewer');
+    }
+  });
+  it('respects going back to the main navigation', () => {
+    useNavSceneStore.getState().openNavScene('file-viewer');
+    useNavSceneStore.getState().goBack();
+    useSceneStore.getState().openScene('terminal');
+    expect(useNavSceneStore.getState().showSceneNav).toBe(false);
+    useNavSceneStore.getState().goForward();
+    expect(useNavSceneStore.getState().navSceneId).toBe('file-viewer');
+  });
+  it('lets settings own their navigation and clears resources on a device switch', () => {
+    useNavSceneStore.getState().openNavScene('file-viewer');
+    useSceneStore.getState().openScene('settings');
+    expect(useNavSceneStore.getState().navSceneId).toBe('settings');
+    useSceneStore.getState().resetForPeerSwitch();
+    expect(useNavSceneStore.getState().showSceneNav).toBe(false);
+  });
+});
+
+describe('workspace resource preferences', () => {
+  it('isolates layouts by complete resource key', () => {
+    const state = useWorkspaceResourceState.getState();
+    state.updateLayout('local/project', { terminalFraction: 0.5, filesCollapsed: true });
+    state.updateLayout('peer/project', { terminalsCollapsed: true });
+    const layouts = useWorkspaceResourceState.getState().layouts;
+    expect(layouts['local/project'].filesCollapsed).toBe(true);
+    expect(layouts['peer/project'].filesCollapsed).toBe(false);
+    expect(layouts['peer/project'].terminalFraction).toBe(0.3);
+  });
+  it('tolerates missing and invalid persisted preferences', () => {
+    expect(normalizeResourceLayout({}).terminalFraction).toBe(0.3);
+    expect(normalizeResourceLayout({ terminalFraction: Number.NaN }).terminalFraction).toBe(0.3);
+    expect(normalizeResourceLayout({ terminalFraction: 10 }).terminalFraction).toBe(0.75);
+    expect(normalizeResourceLayout({ terminalFraction: -1 }).terminalFraction).toBe(0.15);
+  });
+});
diff --git a/src/web-ui/src/app/startup/legacyMigrationStartupNotification.test.ts b/src/web-ui/src/app/startup/legacyMigrationStartupNotification.test.ts
deleted file mode 100644
index c1e0589421..0000000000
--- a/src/web-ui/src/app/startup/legacyMigrationStartupNotification.test.ts
+++ /dev/null
@@ -1,90 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { showLegacyMigrationStartupNotification } from './legacyMigrationStartupNotification';
-
-const mocks = vi.hoisted(() => ({
-  getStatus: vi.fn(),
-  loadNamespace: vi.fn(),
-  t: vi.fn((key: string) => key),
-  success: vi.fn(),
-  warning: vi.fn(),
-  error: vi.fn(),
-  info: vi.fn(),
-}));
-
-vi.mock('@/infrastructure/api/service-api/LegacyMigrationAPI', () => ({
-  legacyMigrationAPI: { getStatus: mocks.getStatus },
-}));
-vi.mock('@/infrastructure/i18n', () => ({
-  i18nService: { loadNamespace: mocks.loadNamespace, t: mocks.t },
-}));
-vi.mock('@/shared/notification-system', () => ({
-  notificationService: {
-    success: mocks.success,
-    warning: mocks.warning,
-    error: mocks.error,
-    info: mocks.info,
-  },
-}));
-
-describe('legacy migration startup notification', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    mocks.loadNamespace.mockResolvedValue(undefined);
-  });
-
-  it('loads the lazy namespace and shows a completed report once', async () => {
-    mocks.getStatus.mockResolvedValue({
-      startupError: null,
-      startupReport: { runId: 'run-1', status: 'completed' },
-    });
-    const values = new Map<string, string>();
-    const storage = {
-      getItem: (key: string) => values.get(key) ?? null,
-      setItem: (key: string, value: string) => { values.set(key, value); },
-    };
-
-    await showLegacyMigrationStartupNotification(storage);
-    await showLegacyMigrationStartupNotification(storage);
-
-    expect(mocks.loadNamespace).toHaveBeenCalledWith('settings/legacy-migration');
-    expect(mocks.success).toHaveBeenCalledTimes(1);
-    expect(mocks.success.mock.calls[0][1].metadata).toEqual({
-      source: 'legacy-migration-startup-result',
-      runId: 'run-1',
-      status: 'completed',
-    });
-  });
-
-  it('prioritizes a redacted startup launch error over an older report', async () => {
-    mocks.getStatus.mockResolvedValue({
-      startupError: {
-        code: 'data_migrator_launch_failed',
-        message: 'A redacted backend message',
-        recoverable: true,
-      },
-      startupReport: { runId: 'run-1', status: 'completed' },
-    });
-    const values = new Map<string, string>();
-    const storage = {
-      getItem: (key: string) => values.get(key) ?? null,
-      setItem: (key: string, value: string) => { values.set(key, value); },
-    };
-
-    await showLegacyMigrationStartupNotification(storage);
-    await showLegacyMigrationStartupNotification(storage);
-
-    expect(mocks.error).toHaveBeenCalledTimes(1);
-    expect(mocks.error.mock.calls[0][0]).toBe(
-      'startupNotification.launchFailed',
-    );
-    expect(mocks.t).toHaveBeenCalledWith('startupNotification.launchFailed', {
-      ns: 'settings/legacy-migration',
-    });
-    expect(mocks.error.mock.calls[0][1].metadata).toEqual({
-      source: 'legacy-migration-startup-error',
-      code: 'data_migrator_launch_failed',
-      recoverable: true,
-    });
-    expect(mocks.success).not.toHaveBeenCalled();
-  });
-});
diff --git a/src/web-ui/src/app/startup/legacyMigrationStartupNotification.ts b/src/web-ui/src/app/startup/legacyMigrationStartupNotification.ts
deleted file mode 100644
index 1044e3f69d..0000000000
--- a/src/web-ui/src/app/startup/legacyMigrationStartupNotification.ts
+++ /dev/null
@@ -1,75 +0,0 @@
-import { legacyMigrationAPI, type MigrationRunStatus } from '@/infrastructure/api/service-api/LegacyMigrationAPI';
-import { i18nService } from '@/infrastructure/i18n';
-import { notificationService } from '@/shared/notification-system';
-
-function notificationKind(status: MigrationRunStatus): 'success' | 'warning' | 'error' | 'info' {
-  if (status === 'completed') return 'success';
-  if (status === 'completed_with_warnings' || status === 'cancelled') return 'warning';
-  if (status.startsWith('failed_')) return 'error';
-  return 'info';
-}
-
-export async function showLegacyMigrationStartupNotification(
-  storage: Pick<Storage, 'getItem' | 'setItem'> = sessionStorage,
-): Promise<void> {
-  const status = await legacyMigrationAPI.getStatus();
-  const startupError = status.startupError;
-  const report = status.startupReport;
-  if (!startupError && !report) return;
-
-  await i18nService.loadNamespace('settings/legacy-migration');
-  const namespace = 'settings/legacy-migration';
-  const openMigrationSettings = () => {
-    void import('@/shared/services/ide-control').then(({ quickActions }) => {
-      quickActions.openSettings({ pageId: 'data.migration' });
-    });
-  };
-
-  if (startupError) {
-    const noticeKey = `openbitfun:legacy-migration-startup-error:${startupError.code}`;
-    if (storage.getItem(noticeKey) === 'shown') return;
-
-    storage.setItem(noticeKey, 'shown');
-    notificationService.error(
-      i18nService.t('startupNotification.launchFailed', { ns: namespace }),
-      {
-        title: i18nService.t('startupNotification.title', { ns: namespace }),
-        duration: 0,
-        actions: [{
-          label: i18nService.t('startupNotification.openSettings', { ns: namespace }),
-          variant: 'primary' as const,
-          onClick: openMigrationSettings,
-        }],
-        metadata: {
-          source: 'legacy-migration-startup-error',
-          code: startupError.code,
-          recoverable: startupError.recoverable,
-        },
-      },
-    );
-    return;
-  }
-
-  if (!report) return;
-
-  const noticeKey = `openbitfun:legacy-migration-notice:${report.runId}`;
-  if (storage.getItem(noticeKey) === 'shown') return;
-
-  storage.setItem(noticeKey, 'shown');
-  const options = {
-    title: i18nService.t('startupNotification.title', { ns: namespace }),
-    duration: 0,
-    actions: [{
-      label: i18nService.t('actions.viewReport', { ns: namespace }),
-      variant: 'primary' as const,
-      onClick: openMigrationSettings,
-    }],
-    metadata: {
-      source: 'legacy-migration-startup-result',
-      runId: report.runId,
-      status: report.status,
-    },
-  };
-  const message = i18nService.t(`startupNotification.statuses.${report.status}`, { ns: namespace });
-  notificationService[notificationKind(report.status)](message, options);
-}
diff --git a/src/web-ui/src/app/stores/sceneStore.ts b/src/web-ui/src/app/stores/sceneStore.ts
index 72b777f272..396b5f2328 100644
--- a/src/web-ui/src/app/stores/sceneStore.ts
+++ b/src/web-ui/src/app/stores/sceneStore.ts
@@ -306,6 +306,7 @@ export const useSceneStore = create<SceneState>((set, get) => ({
 
   resetForPeerSwitch: () => {
     abandonSettingsDraftsForContextSwitch();
+    useNavSceneStore.getState().closeNavScene();
     const state = get();
     const tabs = buildDefaultTabs();
     const activeTabId = tabs[0]?.id ?? null;
@@ -358,7 +359,10 @@ if (typeof window !== 'undefined') {
       const navStore = useNavSceneStore.getState();
       if (navSceneId) {
         navStore.openNavScene(navSceneId);
-      } else {
+      } else if (!(navStore.navSceneId === 'file-viewer'
+        && (state.activeTabId === 'session' || state.activeTabId === 'terminal'
+          || state.activeTabId === 'shell' || state.activeTabId === 'git'
+          || state.activeTabId === null))) {
         navStore.closeNavScene();
       }
     }
diff --git a/src/web-ui/src/infrastructure/api/generated/productControl.ts b/src/web-ui/src/infrastructure/api/generated/productControl.ts
index 16c6dd80af..e7bf7973cb 100644
--- a/src/web-ui/src/infrastructure/api/generated/productControl.ts
+++ b/src/web-ui/src/infrastructure/api/generated/productControl.ts
@@ -1,7 +1,7 @@
 // Generated by scripts/generate-interactive-capabilities.mjs; do not edit.
-export const PRODUCT_CONTROL_GRAPH_DIGEST = "c77c16c414ce9fe50929fe249d900489fdceedb8e646aaaca03893aa33d4fbc8" as const;
+export const PRODUCT_CONTROL_GRAPH_DIGEST = "d7a7419ddd673eb733ae8bd33dbb3dcd3b4d1ce0acfc953067a3403fe26d6699" as const;
 
-export type ProductControlCapabilityId = "feature.ai-assistant" | "feature.agents" | "feature.personal-assistants" | "feature.projects" | "feature.files-editor" | "feature.terminal" | "feature.git" | "feature.code-review" | "feature.browser" | "feature.computer-use" | "feature.skills" | "feature.miniapps" | "feature.canvas" | "feature.tasks-automation" | "feature.insights" | "feature.ecosystem-compatibility" | "feature.remote-workspaces" | "feature.remote-connect" | "feature.detached-dispatch" | "feature.pages" | "feature.voice-input" | "feature.desktop-pet" | "setting.application.general" | "setting.application.appearance" | "setting.application.pet" | "setting.application.input" | "setting.application.shortcuts" | "setting.application.development" | "setting.ai.models" | "setting.ai.memory" | "setting.workspace.session" | "setting.workspace.worktrees" | "setting.tools.execution" | "setting.application.terminal" | "setting.tools.desktop-control" | "setting.tools.browser-control" | "setting.tools.automation" | "setting.tools.web-search" | "setting.tools.mcp" | "setting.tools.acp" | "setting.data.usage" | "setting.data.archived" | "setting.data.migration" | "setting.data.diagnostics";
+export type ProductControlCapabilityId = "feature.ai-assistant" | "feature.agents" | "feature.personal-assistants" | "feature.projects" | "feature.files-editor" | "feature.terminal" | "feature.git" | "feature.code-review" | "feature.browser" | "feature.computer-use" | "feature.skills" | "feature.miniapps" | "feature.canvas" | "feature.tasks-automation" | "feature.insights" | "feature.ecosystem-compatibility" | "feature.remote-workspaces" | "feature.remote-connect" | "feature.detached-dispatch" | "feature.pages" | "feature.voice-input" | "feature.desktop-pet" | "setting.application.general" | "setting.application.appearance" | "setting.application.pet" | "setting.application.input" | "setting.application.shortcuts" | "setting.application.development" | "setting.ai.models" | "setting.ai.memory" | "setting.workspace.session" | "setting.workspace.worktrees" | "setting.tools.execution" | "setting.application.terminal" | "setting.tools.desktop-control" | "setting.tools.browser-control" | "setting.tools.automation" | "setting.tools.web-search" | "setting.tools.mcp" | "setting.tools.acp" | "setting.data.usage" | "setting.data.archived" | "setting.data.diagnostics";
 
 export interface ProductControlOptionIdsByCapability {
   "feature.ai-assistant": never;
@@ -46,7 +46,6 @@ export interface ProductControlOptionIdsByCapability {
   "setting.tools.acp": never;
   "setting.data.usage": never;
   "setting.data.archived": never;
-  "setting.data.migration": never;
   "setting.data.diagnostics": "log-level" | "sensitive-diagnostics";
 }
 
@@ -93,7 +92,6 @@ export interface ProductControlOperationIdsByCapability {
   "setting.tools.acp": never;
   "setting.data.usage": never;
   "setting.data.archived": never;
-  "setting.data.migration": never;
   "setting.data.diagnostics": never;
 }
 
diff --git a/src/web-ui/src/infrastructure/api/generated/remoteSurface.ts b/src/web-ui/src/infrastructure/api/generated/remoteSurface.ts
index 39c35913da..4b94ff2c3b 100644
--- a/src/web-ui/src/infrastructure/api/generated/remoteSurface.ts
+++ b/src/web-ui/src/infrastructure/api/generated/remoteSurface.ts
@@ -1,6 +1,6 @@
 // Generated by scripts/generate-interactive-capabilities.mjs; do not edit.
 // Source: openbitfun_product_domains::remote_surface (Product Operation Registry).
-export const REMOTE_SURFACE_REGISTRY_DIGEST = "fnv1a64:f5390eecb4710d17" as const;
+export const REMOTE_SURFACE_REGISTRY_DIGEST = "fnv1a64:4cdcd7ff4dcd85a9" as const;
 
 /**
  * Registered Tauri commands the Peer Device controller keeps on the controller
@@ -83,8 +83,6 @@ export const PEER_CONTROLLER_LOCAL_COMMANDS: ReadonlySet<string> = new Set([
   "get_announcement_tips",
   "get_frontend_update_status",
   "get_latest_insights",
-  "get_legacy_migration_report",
-  "get_legacy_migration_status",
   "get_pending_announcements",
   "get_pending_update",
   "get_prevent_sleep_enabled",
@@ -114,7 +112,6 @@ export const PEER_CONTROLLER_LOCAL_COMMANDS: ReadonlySet<string> = new Set([
   "peer_controller_set_active",
   "peer_host_invoke_complete",
   "peer_mode_ping",
-  "prepare_legacy_migration",
   "quit_app",
   "relay_deploy_cancel",
   "relay_deploy_install_docker",
@@ -145,8 +142,6 @@ export const PEER_CONTROLLER_LOCAL_COMMANDS: ReadonlySet<string> = new Set([
   "resolve_browser_dropped_file_paths",
   "restart_app",
   "rollback_frontend_update",
-  "scan_legacy_migration",
-  "set_legacy_migration_prompt_preference",
   "set_main_window_transient_geometry",
   "set_prevent_sleep_enabled",
   "show_agent_companion_desktop_pet",
diff --git a/src/web-ui/src/infrastructure/api/service-api/LegacyMigrationAPI.test.ts b/src/web-ui/src/infrastructure/api/service-api/LegacyMigrationAPI.test.ts
deleted file mode 100644
index 7d4e19c54c..0000000000
--- a/src/web-ui/src/infrastructure/api/service-api/LegacyMigrationAPI.test.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { LegacyMigrationAPI } from './LegacyMigrationAPI';
-
-const invokeMock = vi.hoisted(() => vi.fn());
-
-vi.mock('./ApiClient', () => ({
-  api: { invoke: invokeMock },
-}));
-
-describe('LegacyMigrationAPI', () => {
-  beforeEach(() => invokeMock.mockReset());
-
-  it('uses structured requests through the active ApiClient transport', async () => {
-    invokeMock.mockResolvedValue({ runId: 'run-1', mode: 'execute' });
-    const selection = { groups: ['memory'] as const };
-
-    await new LegacyMigrationAPI().prepare({ groups: [...selection.groups] });
-
-    expect(invokeMock).toHaveBeenCalledWith('prepare_legacy_migration', {
-      request: { selection: { groups: ['memory'] } },
-    });
-  });
-
-  it('does not expose an in-process execute command', () => {
-    const migration = new LegacyMigrationAPI() as unknown as Record<string, unknown>;
-
-    expect(migration.execute).toBeUndefined();
-    expect(migration.run).toBeUndefined();
-  });
-});
diff --git a/src/web-ui/src/infrastructure/api/service-api/LegacyMigrationAPI.ts b/src/web-ui/src/infrastructure/api/service-api/LegacyMigrationAPI.ts
deleted file mode 100644
index f2e5ecf3a5..0000000000
--- a/src/web-ui/src/infrastructure/api/service-api/LegacyMigrationAPI.ts
+++ /dev/null
@@ -1,184 +0,0 @@
-import { createTauriCommandError } from '../errors/TauriCommandError';
-import { api } from './ApiClient';
-
-export type MigrationGroupId =
-  | 'settings_and_credentials'
-  | 'agents_skills_and_miniapps'
-  | 'workspaces_sessions_and_tasks'
-  | 'memory'
-  | 'remote_connections_and_devices';
-
-export type MigrationDomainId =
-  | 'settings'
-  | 'credentials'
-  | 'skills'
-  | 'miniapps'
-  | 'agents'
-  | 'workspace_sessions'
-  | 'agent_coordination'
-  | 'structured_memory'
-  | 'file_memory'
-  | 'remote_connect_devices'
-  | 'remote_ssh'
-  | 'cross_reference_repair';
-
-export type MigrationPromptChoice =
-  | 'unset'
-  | 'migrate_now'
-  | 'remind_later'
-  | 'do_not_remind';
-
-export type MigrationRunStatus =
-  | 'discovered'
-  | 'scanned'
-  | 'planned'
-  | 'waiting_for_processes'
-  | 'staging'
-  | 'validating_stage'
-  | 'committing'
-  | 'validating_commit'
-  | 'completed'
-  | 'completed_with_warnings'
-  | 'cancelled'
-  | 'failed_recoverable'
-  | 'failed_manual_action_required';
-
-export type MigrationDomainState =
-  | 'not_started'
-  | 'staged'
-  | 'committed'
-  | 'verified'
-  | 'failed'
-  | 'skipped';
-
-export interface MigrationSelection {
-  groups: MigrationGroupId[];
-}
-
-export interface MigrationDiagnostic {
-  code: string;
-  severity: 'info' | 'warning' | 'blocking';
-  domain: MigrationDomainId | null;
-  relativePath: string | null;
-  message: string;
-  action: string | null;
-}
-
-export interface LegacySourceDescriptor {
-  sourceId: string;
-  sourceFingerprint: string;
-  productId: string;
-  productVersion: string;
-  platform: string;
-  readable: boolean;
-  supported: boolean;
-  approximateBytes: number;
-  alreadyMigrated: boolean;
-  diagnostics: MigrationDiagnostic[];
-}
-
-export interface MigrationOnboardingState {
-  formatVersion: number;
-  sourceFingerprint: string;
-  detectedAtMs: number | null;
-  lastScannedAtMs: number | null;
-  choice: MigrationPromptChoice;
-  lastPromptedVersion: string | null;
-  runId: string | null;
-  lastReportRunId: string | null;
-  handledRunId: string | null;
-}
-
-export interface MigrationDomainResult {
-  domain: MigrationDomainId;
-  state: MigrationDomainState;
-  imported: number;
-  skipped: number;
-  conflicts: number;
-  warnings: MigrationDiagnostic[];
-  requiresReauthentication: string[];
-  requiresRelocation: string[];
-}
-
-export interface MigrationRunReport {
-  formatVersion: number;
-  runId: string;
-  sourceFingerprint: string;
-  planHash: string;
-  status: MigrationRunStatus;
-  startedAtMs: number;
-  finishedAtMs: number | null;
-  domainResults: MigrationDomainResult[];
-  diagnostics: MigrationDiagnostic[];
-  requiresReauthentication: string[];
-  requiresRelocation: string[];
-}
-
-export interface LegacyMigrationStartupError {
-  code: string;
-  message: string;
-  recoverable: boolean;
-}
-
-export interface LegacyMigrationStatusView {
-  source: LegacySourceDescriptor | null;
-  onboarding: MigrationOnboardingState;
-  latestReport: MigrationRunReport | null;
-  startupReport: MigrationRunReport | null;
-  startupError?: LegacyMigrationStartupError | null;
-}
-
-export interface ScanFinding {
-  domain: MigrationDomainId;
-  code: string;
-  severity: 'info' | 'warning' | 'blocking';
-  entityCount: number;
-  logicalBytes: number;
-  sourceSchema: string | null;
-  migratable: boolean;
-  detail: string;
-}
-
-export interface LegacyMigrationScanView {
-  source: LegacySourceDescriptor;
-  selection: MigrationSelection;
-  scannedAtMs: number;
-  findings: ScanFinding[];
-}
-
-export interface LegacyMigrationHandoffView {
-  runId: string;
-  mode: 'onboarding' | 'execute';
-}
-
-export class LegacyMigrationAPI {
-  private async invoke<T>(command: string, request: object): Promise<T> {
-    try {
-      return await api.invoke<T>(command, { request });
-    } catch (error) {
-      throw createTauriCommandError(command, error, request);
-    }
-  }
-
-  getStatus(): Promise<LegacyMigrationStatusView> {
-    return this.invoke('get_legacy_migration_status', {});
-  }
-
-  scan(selection?: MigrationSelection): Promise<LegacyMigrationScanView> {
-    return this.invoke('scan_legacy_migration', selection ? { selection } : {});
-  }
-
-  prepare(selection: MigrationSelection): Promise<LegacyMigrationHandoffView> {
-    return this.invoke('prepare_legacy_migration', { selection });
-  }
-
-  getReport(runId?: string): Promise<MigrationRunReport | null> {
-    return this.invoke('get_legacy_migration_report', runId ? { runId } : {});
-  }
-
-  setPromptPreference(choice: MigrationPromptChoice): Promise<MigrationOnboardingState> {
-    return this.invoke('set_legacy_migration_prompt_preference', { choice });
-  }
-}
-
-export const legacyMigrationAPI = new LegacyMigrationAPI();
diff --git a/src/web-ui/src/infrastructure/config/components/LegacyMigrationSettingsPage.scss b/src/web-ui/src/infrastructure/config/components/LegacyMigrationSettingsPage.scss
deleted file mode 100644
index 38106e38c8..0000000000
--- a/src/web-ui/src/infrastructure/config/components/LegacyMigrationSettingsPage.scss
+++ /dev/null
@@ -1,20 +0,0 @@
-.openbitfun-legacy-migration__actions {
-  display: flex;
-  flex-wrap: wrap;
-  justify-content: flex-end;
-  gap: var(--openbitfun-space-2);
-}
-
-.openbitfun-legacy-migration__value {
-  color: var(--openbitfun-color-content-secondary);
-  font-size: var(--openbitfun-type-body-sm-font-size);
-  overflow-wrap: anywhere;
-  text-align: end;
-}
-
-.openbitfun-legacy-migration__impact-list {
-  display: grid;
-  gap: var(--openbitfun-space-1);
-  margin: 0;
-  padding-inline-start: var(--openbitfun-space-5);
-}
diff --git a/src/web-ui/src/infrastructure/config/components/LegacyMigrationSettingsPage.tsx b/src/web-ui/src/infrastructure/config/components/LegacyMigrationSettingsPage.tsx
deleted file mode 100644
index 7f83e9b6cd..0000000000
--- a/src/web-ui/src/infrastructure/config/components/LegacyMigrationSettingsPage.tsx
+++ /dev/null
@@ -1,443 +0,0 @@
-import { Button, Checkbox, Dialog, DialogBody, DialogClose, DialogHeader, DialogHeading, DialogTitle, StatusPill, type StatusPillTone } from '@openbitfun/ui';
-import { useCallback, useEffect, useMemo, useState } from 'react';
-import { confirmDialog } from '@/infrastructure/confirm-dialog';
-import { useI18n } from '@/infrastructure/i18n';
-import {
-  legacyMigrationAPI,
-  type LegacyMigrationScanView,
-  type LegacyMigrationStatusView,
-  type MigrationDomainId,
-  type MigrationDomainState,
-  type MigrationGroupId,
-  type MigrationRunReport,
-  type MigrationRunStatus,
-  type MigrationSelection,
-} from '@/infrastructure/api/service-api/LegacyMigrationAPI';
-import { useNotification } from '@/shared/notification-system';
-import { createLogger } from '@/shared/utils/logger';
-import {
-  ConfigLoadingState,
-  ConfigMessage,
-  ConfigPageContent,
-  ConfigPageHeader,
-  ConfigPageLayout,
-  ConfigPageRow,
-  ConfigPageSection,
-  ConfigRetryState,
-} from './common';
-import './LegacyMigrationSettingsPage.scss';
-
-const log = createLogger('LegacyMigrationSettings');
-
-const MIGRATION_GROUPS: readonly MigrationGroupId[] = [
-  'settings_and_credentials',
-  'agents_skills_and_miniapps',
-  'workspaces_sessions_and_tasks',
-  'memory',
-  'remote_connections_and_devices',
-];
-
-const DOMAIN_GROUPS: Partial<Record<MigrationDomainId, MigrationGroupId>> = {
-  settings: 'settings_and_credentials',
-  credentials: 'settings_and_credentials',
-  skills: 'agents_skills_and_miniapps',
-  miniapps: 'agents_skills_and_miniapps',
-  agents: 'agents_skills_and_miniapps',
-  workspace_sessions: 'workspaces_sessions_and_tasks',
-  agent_coordination: 'workspaces_sessions_and_tasks',
-  structured_memory: 'memory',
-  file_memory: 'memory',
-  remote_connect_devices: 'remote_connections_and_devices',
-  remote_ssh: 'remote_connections_and_devices',
-};
-
-function reportTone(status: MigrationRunStatus): StatusPillTone {
-  if (status === 'completed') return 'success';
-  if (status === 'completed_with_warnings' || status === 'cancelled') return 'warning';
-  if (status.startsWith('failed_')) return 'danger';
-  return 'info';
-}
-
-function domainTone(state: MigrationDomainState): StatusPillTone {
-  if (state === 'verified') return 'success';
-  if (state === 'failed') return 'danger';
-  if (state === 'skipped') return 'warning';
-  return 'neutral';
-}
-
-function errorMessage(error: unknown, fallback: string): string {
-  return error instanceof Error && error.message ? error.message : fallback;
-}
-
-export default function LegacyMigrationSettingsPage() {
-  const { t, formatDate, formatNumber } = useI18n('settings/legacy-migration');
-  const notification = useNotification();
-  const [status, setStatus] = useState<LegacyMigrationStatusView | null>(null);
-  const [scan, setScan] = useState<LegacyMigrationScanView | null>(null);
-  const [report, setReport] = useState<MigrationRunReport | null>(null);
-  const [reportOpen, setReportOpen] = useState(false);
-  const [selectedGroups, setSelectedGroups] = useState<Set<MigrationGroupId>>(
-    () => new Set(MIGRATION_GROUPS),
-  );
-  const [loading, setLoading] = useState(true);
-  const [loadFailed, setLoadFailed] = useState(false);
-  const [busy, setBusy] = useState<'scan' | 'prepare' | 'report' | 'preference' | null>(null);
-
-  const loadStatus = useCallback(async () => {
-    setLoading(true);
-    setLoadFailed(false);
-    try {
-      const next = await legacyMigrationAPI.getStatus();
-      setStatus(next);
-      setReport(next.latestReport);
-    } catch (error) {
-      log.error('Failed to load legacy migration status', error);
-      setLoadFailed(true);
-    } finally {
-      setLoading(false);
-    }
-  }, []);
-
-  useEffect(() => {
-    void loadStatus();
-  }, [loadStatus]);
-
-  const selection = useMemo<MigrationSelection>(() => ({
-    groups: MIGRATION_GROUPS.filter((group) => selectedGroups.has(group)),
-  }), [selectedGroups]);
-
-  const toggleGroup = useCallback((group: MigrationGroupId) => {
-    setSelectedGroups((current) => {
-      const next = new Set(current);
-      if (next.has(group)) next.delete(group);
-      else next.add(group);
-      return next;
-    });
-  }, []);
-
-  const handleScan = useCallback(async () => {
-    if (selection.groups.length === 0) {
-      notification.warning(t('messages.emptySelection'));
-      return;
-    }
-    setBusy('scan');
-    try {
-      const next = await legacyMigrationAPI.scan(selection);
-      setScan(next);
-      setStatus((current) => current ? {
-        ...current,
-        source: next.source,
-        onboarding: { ...current.onboarding, lastScannedAtMs: next.scannedAtMs },
-      } : current);
-      notification.success(t('messages.scanComplete'));
-    } catch (error) {
-      log.error('Failed to scan legacy migration source', error);
-      notification.error(errorMessage(error, t('messages.scanFailed')));
-    } finally {
-      setBusy(null);
-    }
-  }, [notification, selection, t]);
-
-  const prepareMigration = useCallback(async (nextSelection: MigrationSelection) => {
-    if (nextSelection.groups.length === 0) {
-      notification.warning(t('messages.emptySelection'));
-      return;
-    }
-    const confirmed = await confirmDialog({
-      title: t('confirm.title'),
-      message: t('confirm.message'),
-      preview: (
-        <ul className="openbitfun-legacy-migration__impact-list">
-          <li>{t('confirm.agentImpact')}</li>
-          <li>{t('confirm.terminalImpact')}</li>
-          <li>{t('confirm.fileImpact')}</li>
-          <li>{t('confirm.unsavedImpact')}</li>
-          <li>{t('confirm.closeImpact')}</li>
-        </ul>
-      ),
-      confirmText: t('actions.startMigration'),
-      cancelText: t('actions.cancel'),
-      type: 'warning',
-    });
-    if (!confirmed) return;
-
-    setBusy('prepare');
-    try {
-      await legacyMigrationAPI.prepare(nextSelection);
-      notification.info(t('messages.handoffStarted'));
-    } catch (error) {
-      log.error('Failed to prepare legacy migration handoff', error);
-      notification.error(errorMessage(error, t('messages.prepareFailed')));
-      setBusy(null);
-    }
-  }, [notification, t]);
-
-  const handleLoadReport = useCallback(async () => {
-    setBusy('report');
-    try {
-      const next = await legacyMigrationAPI.getReport();
-      setReport(next);
-      setReportOpen(next !== null);
-      if (!next) notification.info(t('messages.noReport'));
-    } catch (error) {
-      log.error('Failed to load legacy migration report', error);
-      notification.error(errorMessage(error, t('messages.reportFailed')));
-    } finally {
-      setBusy(null);
-    }
-  }, [notification, t]);
-
-  const retrySelection = useMemo<MigrationSelection>(() => {
-    if (!report) return { groups: [] };
-    const failed = new Set<MigrationGroupId>();
-    let crossReferenceFailed = false;
-    for (const result of report.domainResults) {
-      if (result.state !== 'failed') continue;
-      const group = DOMAIN_GROUPS[result.domain];
-      if (group) failed.add(group);
-      else crossReferenceFailed = true;
-    }
-    return { groups: crossReferenceFailed && failed.size === 0 ? [...MIGRATION_GROUPS] : [...failed] };
-  }, [report]);
-
-  const restoreReminder = useCallback(async () => {
-    setBusy('preference');
-    try {
-      const onboarding = await legacyMigrationAPI.setPromptPreference('remind_later');
-      setStatus((current) => current ? { ...current, onboarding } : current);
-      notification.success(t('messages.reminderRestored'));
-    } catch (error) {
-      log.error('Failed to restore legacy migration reminder', error);
-      notification.error(errorMessage(error, t('messages.preferenceFailed')));
-    } finally {
-      setBusy(null);
-    }
-  }, [notification, t]);
-
-  if (loading || loadFailed) {
-    return (
-      <ConfigPageLayout
-        className="openbitfun-legacy-migration"
-        data-openbitfun-component="config"
-        data-openbitfun-part="root"
-      >
-        <ConfigPageHeader title={t('title')} subtitle={t('subtitle')} />
-        <ConfigPageContent>
-          {loading ? (
-            <ConfigLoadingState label={t('messages.loading')} />
-          ) : (
-            <ConfigRetryState
-              message={t('messages.loadFailed')}
-              retryLabel={t('actions.retry')}
-              onRetry={() => void loadStatus()}
-            />
-          )}
-        </ConfigPageContent>
-      </ConfigPageLayout>
-    );
-  }
-
-  const source = status?.source ?? null;
-  const lastScannedAtMs = scan?.scannedAtMs ?? status?.onboarding.lastScannedAtMs ?? null;
-
-  return (
-    <ConfigPageLayout
-      className="openbitfun-legacy-migration"
-      data-openbitfun-component="config"
-      data-openbitfun-part="root"
-    >
-      <ConfigPageHeader title={t('title')} subtitle={t('subtitle')} />
-      <ConfigPageContent>
-        <ConfigMessage message={{ type: 'info', text: t('localOnlyNotice') }} />
-
-        <ConfigPageSection title={t('sections.source.title')} description={t('sections.source.description')}>
-          <ConfigPageRow label={t('fields.detected.label')} description={t('fields.detected.description')} align="center">
-            <StatusPill tone={source ? (source.supported ? 'success' : 'warning') : 'neutral'}>
-              {source
-                ? t(source.supported ? 'source.supported' : 'source.unsupported')
-                : t('source.notDetected')}
-            </StatusPill>
-          </ConfigPageRow>
-          <ConfigPageRow label={t('fields.source.label')} description={t('fields.source.description')} align="center">
-            <span className="openbitfun-legacy-migration__value">
-              {source
-                ? t('source.summary', {
-                  product: source.productId,
-                  version: source.productVersion || t('source.unknownVersion'),
-                  platform: source.platform,
-                })
-                : t('source.none')}
-            </span>
-          </ConfigPageRow>
-          <ConfigPageRow label={t('fields.lastScan.label')} description={t('fields.lastScan.description')} align="center">
-            <span className="openbitfun-legacy-migration__value">
-              {lastScannedAtMs
-                ? formatDate(lastScannedAtMs, { dateStyle: 'medium', timeStyle: 'short' })
-                : t('source.neverScanned')}
-            </span>
-          </ConfigPageRow>
-          <ConfigPageRow label={t('fields.actions.label')} description={t('fields.actions.description')} align="center" wide>
-            <div className="openbitfun-legacy-migration__actions">
-              <Button
-                type="button"
-                variant="outline"
-                size="sm"
-                loading={busy === 'scan'}
-                disabled={busy !== null || !source}
-                onClick={() => void handleScan()}
-              >
-                {t('actions.scan')}
-              </Button>
-              <Button
-                type="button"
-                variant="primary"
-                size="sm"
-                loading={busy === 'prepare'}
-                disabled={busy !== null || !source?.supported || source.alreadyMigrated}
-                onClick={() => void prepareMigration(selection)}
-              >
-                {t('actions.startMigration')}
-              </Button>
-              <Button
-                type="button"
-                variant="outline"
-                size="sm"
-                loading={busy === 'report'}
-                disabled={busy !== null}
-                onClick={() => void handleLoadReport()}
-              >
-                {t('actions.viewReport')}
-              </Button>
-            </div>
-          </ConfigPageRow>
-          {status?.onboarding.choice === 'do_not_remind' ? (
-            <ConfigPageRow label={t('fields.reminder.label')} description={t('fields.reminder.description')} align="center">
-              <Button
-                type="button"
-                variant="outline"
-                size="sm"
-                loading={busy === 'preference'}
-                disabled={busy !== null}
-                onClick={() => void restoreReminder()}
-              >
-                {t('actions.restoreReminder')}
-              </Button>
-            </ConfigPageRow>
-          ) : null}
-        </ConfigPageSection>
-
-        <ConfigPageSection title={t('sections.scope.title')} description={t('sections.scope.description')}>
-          {MIGRATION_GROUPS.map((group) => (
-            <ConfigPageRow
-              key={group}
-              label={t(`groups.${group}.label`)}
-              description={t(`groups.${group}.description`)}
-              align="center"
-            >
-              <Checkbox
-                checked={selectedGroups.has(group)}
-                disabled={busy !== null}
-                onCheckedChange={() => toggleGroup(group)}
-                aria-label={t(`groups.${group}.label`)}
-              />
-            </ConfigPageRow>
-          ))}
-        </ConfigPageSection>
-
-        {scan ? (
-          <ConfigPageSection title={t('sections.scan.title')} description={t('sections.scan.description')}>
-            {scan.findings.length === 0 ? (
-              <ConfigPageRow label={t('scan.empty')}><span /></ConfigPageRow>
-            ) : scan.findings.map((finding) => (
-              <ConfigPageRow
-                key={`${finding.domain}:${finding.code}`}
-                label={t(`domains.${finding.domain}`)}
-                description={t('scan.summary', {
-                  count: formatNumber(finding.entityCount),
-                  bytes: formatNumber(finding.logicalBytes),
-                })}
-                align="center"
-              >
-                <StatusPill tone={finding.migratable ? 'info' : 'warning'}>
-                  {t(finding.migratable ? 'scan.migratable' : 'scan.blocked')}
-                </StatusPill>
-              </ConfigPageRow>
-            ))}
-          </ConfigPageSection>
-        ) : null}
-
-        <ConfigPageSection title={t('sections.report.title')} description={t('sections.report.description')}>
-          {report ? (
-            <>
-              <ConfigPageRow label={t('report.result')} description={report.finishedAtMs
-                ? formatDate(report.finishedAtMs, { dateStyle: 'medium', timeStyle: 'short' })
-                : t('report.timeUnavailable')} align="center">
-                <StatusPill tone={reportTone(report.status)}>{t(`statuses.${report.status}`)}</StatusPill>
-              </ConfigPageRow>
-              {report.domainResults.map((result) => (
-                <ConfigPageRow
-                  key={result.domain}
-                  label={t(`domains.${result.domain}`)}
-                  description={t('report.domainCounts', {
-                    imported: formatNumber(result.imported),
-                    skipped: formatNumber(result.skipped),
-                    conflicts: formatNumber(result.conflicts),
-                  })}
-                  align="center"
-                >
-                  <StatusPill tone={domainTone(result.state)}>{t(`domainStates.${result.state}`)}</StatusPill>
-                </ConfigPageRow>
-              ))}
-              {retrySelection.groups.length > 0 ? (
-                <ConfigPageRow label={t('fields.retryFailed.label')} description={t('fields.retryFailed.description')} align="center">
-                  <Button
-                    type="button"
-                    variant="outline"
-                    size="sm"
-                    disabled={busy !== null}
-                    onClick={() => void prepareMigration(retrySelection)}
-                  >
-                    {t('actions.retryFailed')}
-                  </Button>
-                </ConfigPageRow>
-              ) : null}
-            </>
-          ) : (
-            <ConfigPageRow label={t('report.none')}><span /></ConfigPageRow>
-          )}
-        </ConfigPageSection>
-      </ConfigPageContent>
-      <Dialog open={reportOpen} onOpenChange={setReportOpen} size="lg">
-        <DialogHeader>
-          <DialogHeading><DialogTitle>{t('actions.viewReport')}</DialogTitle></DialogHeading>
-          <DialogClose />
-        </DialogHeader>
-        <DialogBody>
-          {report ? <>
-            <p>{t(`statuses.${report.status}`)}</p>
-            {report.domainResults.map((result) => (
-              <section key={result.domain}>
-                <h3>{t(`domains.${result.domain}`)} — {t(`domainStates.${result.state}`)}</h3>
-                <p>{t('report.domainCounts', {
-                  imported: formatNumber(result.imported), skipped: formatNumber(result.skipped),
-                  conflicts: formatNumber(result.conflicts),
-                })}</p>
-                <ul>{Array.from(new Map(result.warnings.map((item) => [item.code, item])).values()).map((item) => (
-                  <li key={item.code}>
-                    {item.code === 'session_path_not_migrated' ? t('report.excludedPaths')
-                      : item.code === 'session_parent_not_present' ? t('report.orphanedSessions') : item.message}
-                    {' '}{t('report.occurrences', { count: result.warnings.filter((entry) => entry.code === item.code).length })}
-                    {item.action ? <p>{item.action}</p> : null}
-                  </li>
-                ))}</ul>
-              </section>
-            ))}
-            {report.diagnostics.map((item, index) => <p key={`${item.code}:${index}`}>{item.message}</p>)}
-            {(report.requiresReauthentication ?? []).length > 0 ? <p>{t('report.reauthentication')}</p> : null}
-            {(report.requiresRelocation ?? []).length > 0 ? <p>{t('report.relocation')}</p> : null}
-          </> : null}
-        </DialogBody>
-      </Dialog>
-    </ConfigPageLayout>
-  );
-}
diff --git a/src/web-ui/src/infrastructure/config/components/ModelServiceCollapse.presentation.test.ts b/src/web-ui/src/infrastructure/config/components/ModelServiceCollapse.presentation.test.ts
index 03678c1466..46cb2e8990 100644
--- a/src/web-ui/src/infrastructure/config/components/ModelServiceCollapse.presentation.test.ts
+++ b/src/web-ui/src/infrastructure/config/components/ModelServiceCollapse.presentation.test.ts
@@ -5,7 +5,7 @@ import { describe, expect, it } from 'vitest';
 const modelSettingsSource = readFileSync(
   fileURLToPath(new URL('./ModelSettingsPage.tsx', import.meta.url)),
   'utf8',
-);
+).replaceAll('\r\n', '\n');
 const defaultModelSource = readFileSync(
   fileURLToPath(new URL('./DefaultModelConfig.tsx', import.meta.url)),
   'utf8',
diff --git a/src/web-ui/src/infrastructure/i18n/presets/namespaceRegistry.ts b/src/web-ui/src/infrastructure/i18n/presets/namespaceRegistry.ts
index b51e185115..01475580a8 100644
--- a/src/web-ui/src/infrastructure/i18n/presets/namespaceRegistry.ts
+++ b/src/web-ui/src/infrastructure/i18n/presets/namespaceRegistry.ts
@@ -32,7 +32,6 @@ export const ALL_NAMESPACES = [
   'settings/editor',
   'settings/external-apps',
   'settings/hooks',
-  'settings/legacy-migration',
   'settings/mcp',
   'settings/mcp-tools',
   'settings/memory',
diff --git a/src/web-ui/src/locales/en-US/common.json b/src/web-ui/src/locales/en-US/common.json
index 60b53b8189..65299a7793 100644
--- a/src/web-ui/src/locales/en-US/common.json
+++ b/src/web-ui/src/locales/en-US/common.json
@@ -209,6 +209,35 @@
         "analytics": "Analytics"
       }
     },
+    "resources": {
+      "title": "Workspace resources",
+      "files": "Files",
+      "terminals": "Terminals",
+      "local": "Local",
+      "remote": "Remote workspace",
+      "peer": "Peer device",
+      "switchWorkspace": "Switch workspace",
+      "chooseShell": "Choose a shell",
+      "noTerminals": "Create a terminal to get started",
+      "resize": "Resize files and terminals",
+      "revealDirectory": "Reveal working directory in files",
+      "openTerminalHere": "New terminal here",
+      "terminalActions": "Terminal actions",
+      "removeTerminal": "Remove ended terminal",
+      "unavailable": "Terminal status is unavailable. Try again.",
+      "actionFailed": "Terminal action failed: {{error}}",
+      "manual": "Mine",
+      "agent": "Agent",
+      "status": {
+        "running": "$t(shared:statuses.running)",
+        "saved": "Saved",
+        "exited": "Ended",
+        "unknown": "Unknown",
+        "starting": "Starting",
+        "stopping": "Stopping",
+        "error": "Error"
+      }
+    },
     "shell": {
       "title": "Shell",
       "views": {
diff --git a/src/web-ui/src/locales/en-US/panels/terminal.json b/src/web-ui/src/locales/en-US/panels/terminal.json
index 249941e713..3f2e2f4617 100644
--- a/src/web-ui/src/locales/en-US/panels/terminal.json
+++ b/src/web-ui/src/locales/en-US/panels/terminal.json
@@ -1,6 +1,7 @@
 {
   "title": "Terminal",
   "emptyState": "No terminal is open",
+  "actions": { "closeView": "Close terminal view", "stopTerminal": "Stop terminal" },
   "dialog": {
     "editTerminal": {
       "title": "Edit Terminal",
diff --git a/src/web-ui/src/locales/en-US/settings.json b/src/web-ui/src/locales/en-US/settings.json
index 424eb21ae1..661d005665 100644
--- a/src/web-ui/src/locales/en-US/settings.json
+++ b/src/web-ui/src/locales/en-US/settings.json
@@ -31,7 +31,6 @@
       "acp": { "label": "ACP Agents", "description": "Configure external agents that connect through Agent Client Protocol." },
       "usage": { "label": "Call Statistics", "description": "Model requests, token usage, and cache hit rates." },
       "archivedSessions": { "label": "Archived Sessions", "description": "View, restore, or permanently delete archived sessions." },
-      "legacyMigration": { "label": "Data Migration", "description": "Import supported data from an older installation." },
       "diagnostics": { "label": "Logs & Diagnostics", "description": "Log levels, runtime information, and troubleshooting." }
     },
     "views": {
diff --git a/src/web-ui/src/locales/en-US/settings/legacy-migration.json b/src/web-ui/src/locales/en-US/settings/legacy-migration.json
deleted file mode 100644
index 05255bea08..0000000000
--- a/src/web-ui/src/locales/en-US/settings/legacy-migration.json
+++ /dev/null
@@ -1,152 +0,0 @@
-{
-  "title": "Data Migration",
-  "subtitle": "Import supported data from an older BitFun installation without changing the source.",
-  "localOnlyNotice": "Migration is available only in OpenBitFun Desktop on the device that stores the older BitFun data. It cannot be started through Remote Control, Peer Device Mode, or Detached Dispatch.",
-  "sections": {
-    "source": {
-      "title": "Legacy source",
-      "description": "OpenBitFun performs a read-only check before the standalone Data Migrator is started."
-    },
-    "scope": {
-      "title": "Migration scope",
-      "description": "Select high-level data groups. Session data always includes Agent coordination state."
-    },
-    "scan": {
-      "title": "Latest scan",
-      "description": "Counts and sizes are summaries only; private content and full paths are not shown here."
-    },
-    "report": {
-      "title": "Latest report",
-      "description": "The report shows redacted results for each owning domain. Older BitFun data is never deleted automatically."
-    }
-  },
-  "fields": {
-    "detected": { "label": "Detection", "description": "Whether a supported local BitFun source is available." },
-    "source": { "label": "Source", "description": "Product version and platform reported by the read-only probe." },
-    "lastScan": { "label": "Last scanned", "description": "Time of the latest explicit read-only scan." },
-    "actions": { "label": "Actions", "description": "Scan locally, start the standalone migrator, or refresh the report." },
-    "reminder": { "label": "First-start reminder", "description": "Automatic migration prompts are currently disabled for this source." },
-    "retryFailed": { "label": "Retry failed groups", "description": "Start a new standalone run containing only groups with failed domains." }
-  },
-  "source": {
-    "supported": "Supported",
-    "unsupported": "Unsupported format",
-    "notDetected": "Not detected",
-    "summary": "{{product}} {{version}} on {{platform}}",
-    "unknownVersion": "unknown version",
-    "none": "No older BitFun data was detected on this device.",
-    "neverScanned": "Never scanned"
-  },
-  "actions": {
-    "scan": "Scan old data",
-    "startMigration": "Start migration",
-    "viewReport": "View report",
-    "retryFailed": "Retry failed items",
-    "restoreReminder": "Restore reminder",
-    "retry": "Retry",
-    "cancel": "Cancel"
-  },
-  "groups": {
-    "settings_and_credentials": { "label": "Settings and credentials", "description": "Supported preferences, model/service configuration, and secure credential references." },
-    "agents_skills_and_miniapps": { "label": "Agents, Skills, and MiniApps", "description": "User Agents, non-system Skills, and non-built-in MiniApps." },
-    "workspaces_sessions_and_tasks": { "label": "Workspaces, sessions, and Agent tasks", "description": "Workspace and session records together with required coordination state." },
-    "memory": { "label": "Memory", "description": "Supported structured memory and user-authored memory files." },
-    "remote_connections_and_devices": { "label": "Remote connections and devices", "description": "Supported Remote Connect device records and SSH profiles; secrets may require reauthentication." }
-  },
-  "scan": {
-    "empty": "The selected groups contain no migratable records.",
-    "summary": "{{count}} records, {{bytes}} logical bytes",
-    "migratable": "Migratable",
-    "blocked": "Needs attention"
-  },
-  "report": {
-    "excludedPaths": "Non-core session files were left in the legacy source as intended. No action is required.",
-    "orphanedSessions": "Some parent sessions are absent from the legacy source. Relationships and session history were preserved; no action is required.",
-    "occurrences": "{{count}} records",
-    "reauthentication": "Some connections require authentication again. Review connection settings.",
-    "relocation": "Some paths require relocation. Review workspace settings.",
-    "result": "Run result",
-    "none": "No migration report is available yet.",
-    "timeUnavailable": "Completion time unavailable",
-    "domainCounts": "{{imported}} imported, {{skipped}} skipped, {{conflicts}} conflicts"
-  },
-  "statuses": {
-    "discovered": "Discovered",
-    "scanned": "Scanned",
-    "planned": "Planned",
-    "waiting_for_processes": "Waiting for applications",
-    "staging": "Staging",
-    "validating_stage": "Validating staged data",
-    "committing": "Committing",
-    "validating_commit": "Validating imported data",
-    "completed": "$t(shared:statuses.done)",
-    "completed_with_warnings": "Completed with warnings",
-    "cancelled": "$t(shared:statuses.cancelled)",
-    "failed_recoverable": "Failed; retry available",
-    "failed_manual_action_required": "Manual action required"
-  },
-  "domainStates": {
-    "not_started": "Not started",
-    "staged": "Staged",
-    "committed": "Committed",
-    "verified": "Verified",
-    "failed": "$t(shared:statuses.failed)",
-    "skipped": "Skipped"
-  },
-  "domains": {
-    "settings": "$t(shared:features.settings)",
-    "credentials": "Credentials",
-    "skills": "Skills",
-    "miniapps": "MiniApps",
-    "agents": "Agents",
-    "workspace_sessions": "Workspaces and sessions",
-    "agent_coordination": "Agent coordination",
-    "structured_memory": "Structured memory",
-    "file_memory": "Memory files",
-    "remote_connect_devices": "Remote Connect devices",
-    "remote_ssh": "Remote SSH",
-    "cross_reference_repair": "Cross-reference repair"
-  },
-  "messages": {
-    "loading": "Loading migration status…",
-    "loadFailed": "Migration status could not be loaded on this device.",
-    "emptySelection": "Select at least one migration group.",
-    "scanComplete": "Read-only scan completed.",
-    "scanFailed": "The old data could not be scanned safely.",
-    "handoffStarted": "The Data Migrator is starting. OpenBitFun will close after the handoff.",
-    "prepareFailed": "The Data Migrator could not be started safely.",
-    "noReport": "No migration report is available yet.",
-    "reportFailed": "The migration report could not be loaded.",
-    "reminderRestored": "The first-start migration reminder was restored.",
-    "preferenceFailed": "The reminder preference could not be changed."
-  },
-  "startupNotification": {
-    "title": "BitFun data migration",
-    "launchFailed": "OpenBitFun continued to start, but the Data Migrator could not be launched. Existing OpenBitFun and BitFun data were not changed.",
-    "openSettings": "Open migration settings",
-    "statuses": {
-      "discovered": "The Data Migrator discovered old data but did not finish a migration.",
-      "scanned": "The Data Migrator completed a read-only scan.",
-      "planned": "The Data Migrator saved a plan but did not import data.",
-      "waiting_for_processes": "Migration is still waiting for local applications to close.",
-      "staging": "Migration stopped while staging data and can be resumed safely.",
-      "validating_stage": "Migration stopped while validating staged data and can be resumed safely.",
-      "committing": "Migration stopped during a domain commit; review the report before retrying.",
-      "validating_commit": "Migration stopped while validating imported data; review the report.",
-      "completed": "Supported BitFun data was migrated successfully.",
-      "completed_with_warnings": "BitFun data migration completed with warnings.",
-      "cancelled": "BitFun data migration was cancelled at a safe boundary.",
-      "failed_recoverable": "BitFun data migration did not finish and can be retried.",
-      "failed_manual_action_required": "BitFun data migration needs manual action before it can continue."
-    }
-  },
-  "confirm": {
-    "title": "Close OpenBitFun and start Data Migrator?",
-    "message": "The standalone Data Migrator needs exclusive access to local product data. Review the shutdown impact before continuing.",
-    "agentImpact": "Running Agent turns will stop.",
-    "terminalImpact": "Terminal tasks and other child processes may stop.",
-    "fileImpact": "Active file writes must finish before migration can proceed.",
-    "unsavedImpact": "Unsaved editor or settings changes may be lost.",
-    "closeImpact": "OpenBitFun will close, the migrator will confirm the final scope, and OpenBitFun will reopen when migration ends."
-  }
-}
diff --git a/src/web-ui/src/locales/zh-CN/common.json b/src/web-ui/src/locales/zh-CN/common.json
index 4d13976e8c..e82c23aa9e 100644
--- a/src/web-ui/src/locales/zh-CN/common.json
+++ b/src/web-ui/src/locales/zh-CN/common.json
@@ -209,6 +209,35 @@
         "analytics": "分析"
       }
     },
+    "resources": {
+      "title": "工作区资源",
+      "files": "文件",
+      "terminals": "终端",
+      "local": "本地",
+      "remote": "远程工作区",
+      "peer": "对端设备",
+      "switchWorkspace": "切换工作区",
+      "chooseShell": "选择 Shell",
+      "noTerminals": "在此新建终端，开始工作",
+      "resize": "调整文件与终端分区大小",
+      "revealDirectory": "在文件树中定位工作目录",
+      "openTerminalHere": "在此新建终端",
+      "terminalActions": "终端操作",
+      "removeTerminal": "移除已结束终端",
+      "unavailable": "无法获取终端状态，请重试",
+      "actionFailed": "终端操作失败：{{error}}",
+      "manual": "我的",
+      "agent": "Agent",
+      "status": {
+        "running": "$t(shared:statuses.running)",
+        "saved": "已保存",
+        "exited": "已结束",
+        "unknown": "状态未知",
+        "starting": "正在启动",
+        "stopping": "正在停止",
+        "error": "异常"
+      }
+    },
     "shell": {
       "title": "Shell",
       "views": {
diff --git a/src/web-ui/src/locales/zh-CN/panels/terminal.json b/src/web-ui/src/locales/zh-CN/panels/terminal.json
index 6b5065d5fc..7536c9aaa8 100644
--- a/src/web-ui/src/locales/zh-CN/panels/terminal.json
+++ b/src/web-ui/src/locales/zh-CN/panels/terminal.json
@@ -1,6 +1,7 @@
 {
   "title": "终端",
   "emptyState": "当前没有打开的终端",
+  "actions": { "closeView": "关闭终端视图", "stopTerminal": "停止终端" },
   "dialog": {
     "editTerminal": {
       "title": "编辑终端",
diff --git a/src/web-ui/src/locales/zh-CN/settings.json b/src/web-ui/src/locales/zh-CN/settings.json
index ec361d80b6..6af3eb7f42 100644
--- a/src/web-ui/src/locales/zh-CN/settings.json
+++ b/src/web-ui/src/locales/zh-CN/settings.json
@@ -31,7 +31,6 @@
       "acp": { "label": "ACP Agent", "description": "配置通过 Agent Client Protocol 接入的外部 Agent。" },
       "usage": { "label": "调用统计", "description": "模型请求数、Token 用量与缓存命中率。" },
       "archivedSessions": { "label": "已归档会话", "description": "查看、恢复或永久删除已归档的会话。" },
-      "legacyMigration": { "label": "数据迁移", "description": "从受支持的旧版 安装导入数据。" },
       "diagnostics": { "label": "日志与诊断", "description": "日志级别、运行信息与故障排查。" }
     },
     "views": {
diff --git a/src/web-ui/src/locales/zh-CN/settings/legacy-migration.json b/src/web-ui/src/locales/zh-CN/settings/legacy-migration.json
deleted file mode 100644
index 8d6feb9951..0000000000
--- a/src/web-ui/src/locales/zh-CN/settings/legacy-migration.json
+++ /dev/null
@@ -1,140 +0,0 @@
-{
-  "title": "数据迁移",
-  "subtitle": "从旧版 BitFun 安装导入受支持的数据，同时保持来源不变。",
-  "localOnlyNotice": "只能在保存旧 BitFun 数据的设备上，通过 OpenBitFun Desktop 启动迁移。Remote Control、Peer Device Mode 和 Detached Dispatch 均不能启动迁移。",
-  "sections": {
-    "source": { "title": "旧数据来源", "description": "启动独立 Data Migrator 前，OpenBitFun 会先执行只读检查。" },
-    "scope": { "title": "迁移范围", "description": "选择高层数据组。会话数据始终包含 Agent 协调状态。" },
-    "scan": { "title": "最近扫描", "description": "这里只显示数量和大小摘要，不显示私密正文或完整路径。" },
-    "report": { "title": "最近报告", "description": "报告按所属领域显示去敏结果。旧 BitFun 数据永远不会被自动删除。" }
-  },
-  "fields": {
-    "detected": { "label": "检测状态", "description": "本机是否存在受支持的 BitFun 数据来源。" },
-    "source": { "label": "来源", "description": "只读探测得到的产品版本和平台。" },
-    "lastScan": { "label": "上次扫描", "description": "最近一次显式只读扫描的时间。" },
-    "actions": { "label": "操作", "description": "在本机扫描、启动独立迁移器或刷新报告。" },
-    "reminder": { "label": "首次启动提醒", "description": "当前来源的自动迁移提示已关闭。" },
-    "retryFailed": { "label": "重试失败数据组", "description": "仅使用包含失败领域的数据组启动新的独立迁移。" }
-  },
-  "source": {
-    "supported": "支持迁移",
-    "unsupported": "格式不受支持",
-    "notDetected": "未检测到",
-    "summary": "{{platform}} 上的 {{product}} {{version}}",
-    "unknownVersion": "未知版本",
-    "none": "此设备上未检测到旧版 BitFun 数据。",
-    "neverScanned": "尚未扫描"
-  },
-  "actions": {
-    "scan": "扫描旧数据",
-    "startMigration": "开始迁移",
-    "viewReport": "查看报告",
-    "retryFailed": "重试失败项",
-    "restoreReminder": "恢复提醒",
-    "retry": "重试",
-    "cancel": "取消"
-  },
-  "groups": {
-    "settings_and_credentials": { "label": "设置和凭据", "description": "受支持的偏好、模型与服务配置，以及安全凭据引用。" },
-    "agents_skills_and_miniapps": { "label": "Agents、Skills 和 MiniApps", "description": "用户 Agents、非系统 Skills 和非内置 MiniApps。" },
-    "workspaces_sessions_and_tasks": { "label": "工作区、会话与 Agent 任务", "description": "工作区和会话记录，以及必需的协调状态。" },
-    "memory": { "label": "Memory", "description": "受支持的结构化记忆和用户编写的记忆文件。" },
-    "remote_connections_and_devices": { "label": "远程连接和设备", "description": "受支持的 Remote Connect 设备记录和 SSH 配置；秘密可能需要重新认证。" }
-  },
-  "scan": {
-    "empty": "所选数据组中没有可迁移记录。",
-    "summary": "{{count}} 条记录，{{bytes}} 逻辑字节",
-    "migratable": "可迁移",
-    "blocked": "需要处理"
-  },
-  "report": {
-    "excludedPaths": "按迁移范围保留在旧数据中的非核心会话文件，无需处理。",
-    "orphanedSessions": "部分会话的父会话在旧数据中不存在；已保留关系及会话历史，无需处理。",
-    "occurrences": "共 {{count}} 条记录",
-    "reauthentication": "部分连接需要重新认证，请到连接设置中处理。",
-    "relocation": "部分路径需要重新定位，请检查工作区设置。",
-    "result": "运行结果",
-    "none": "尚无迁移报告。",
-    "timeUnavailable": "完成时间不可用",
-    "domainCounts": "导入 {{imported}}，跳过 {{skipped}}，冲突 {{conflicts}}"
-  },
-  "statuses": {
-    "discovered": "已发现",
-    "scanned": "已扫描",
-    "planned": "已计划",
-    "waiting_for_processes": "正在等待应用退出",
-    "staging": "正在暂存",
-    "validating_stage": "正在验证暂存数据",
-    "committing": "正在提交",
-    "validating_commit": "正在验证导入数据",
-    "completed": "$t(shared:statuses.done)",
-    "completed_with_warnings": "已完成，但有警告",
-    "cancelled": "$t(shared:statuses.cancelled)",
-    "failed_recoverable": "失败，可以重试",
-    "failed_manual_action_required": "需要手动处理"
-  },
-  "domainStates": {
-    "not_started": "未开始",
-    "staged": "已暂存",
-    "committed": "已提交",
-    "verified": "已验证",
-    "failed": "$t(shared:statuses.failed)",
-    "skipped": "已跳过"
-  },
-  "domains": {
-    "settings": "$t(shared:features.settings)",
-    "credentials": "凭据",
-    "skills": "Skills",
-    "miniapps": "MiniApps",
-    "agents": "Agents",
-    "workspace_sessions": "工作区和会话",
-    "agent_coordination": "Agent 协调",
-    "structured_memory": "结构化记忆",
-    "file_memory": "记忆文件",
-    "remote_connect_devices": "Remote Connect 设备",
-    "remote_ssh": "Remote SSH",
-    "cross_reference_repair": "交叉引用修复"
-  },
-  "messages": {
-    "loading": "正在加载迁移状态…",
-    "loadFailed": "无法加载此设备上的迁移状态。",
-    "emptySelection": "请至少选择一个迁移数据组。",
-    "scanComplete": "只读扫描已完成。",
-    "scanFailed": "无法安全扫描旧数据。",
-    "handoffStarted": "Data Migrator 正在启动。交接完成后 OpenBitFun 将关闭。",
-    "prepareFailed": "无法安全启动 Data Migrator。",
-    "noReport": "尚无迁移报告。",
-    "reportFailed": "无法加载迁移报告。",
-    "reminderRestored": "已恢复首次启动迁移提醒。",
-    "preferenceFailed": "无法修改提醒偏好。"
-  },
-  "startupNotification": {
-    "title": "BitFun 数据迁移",
-    "launchFailed": "OpenBitFun 已继续启动，但无法启动 Data Migrator。现有 OpenBitFun 和 BitFun 数据均未更改。",
-    "openSettings": "打开迁移设置",
-    "statuses": {
-      "discovered": "Data Migrator 发现了旧数据，但尚未完成迁移。",
-      "scanned": "Data Migrator 已完成只读扫描。",
-      "planned": "Data Migrator 已保存计划，但尚未导入数据。",
-      "waiting_for_processes": "迁移仍在等待本机应用退出。",
-      "staging": "迁移在暂存数据时停止，可以安全恢复。",
-      "validating_stage": "迁移在验证暂存数据时停止，可以安全恢复。",
-      "committing": "迁移在提交领域数据时停止；重试前请查看报告。",
-      "validating_commit": "迁移在验证导入数据时停止；请查看报告。",
-      "completed": "受支持的 BitFun 数据已成功迁移。",
-      "completed_with_warnings": "BitFun 数据迁移已完成，但有警告。",
-      "cancelled": "BitFun 数据迁移已在安全边界取消。",
-      "failed_recoverable": "BitFun 数据迁移未完成，可以重试。",
-      "failed_manual_action_required": "BitFun 数据迁移需要手动处理后才能继续。"
-    }
-  },
-  "confirm": {
-    "title": "关闭 OpenBitFun 并启动 Data Migrator？",
-    "message": "独立 Data Migrator 需要独占访问本机产品数据。继续前请确认关闭影响。",
-    "agentImpact": "正在运行的 Agent 回合将停止。",
-    "terminalImpact": "终端任务和其他子进程可能会停止。",
-    "fileImpact": "迁移开始前，正在进行的文件写入必须完成。",
-    "unsavedImpact": "未保存的编辑器或设置更改可能会丢失。",
-    "closeImpact": "OpenBitFun 将关闭；迁移器会再次确认最终范围，并在迁移结束后重新打开 OpenBitFun。"
-  }
-}
diff --git a/src/web-ui/src/locales/zh-TW/common.json b/src/web-ui/src/locales/zh-TW/common.json
index 825a60a1c1..a519e47cbc 100644
--- a/src/web-ui/src/locales/zh-TW/common.json
+++ b/src/web-ui/src/locales/zh-TW/common.json
@@ -209,6 +209,35 @@
         "analytics": "分析"
       }
     },
+    "resources": {
+      "title": "工作區資源",
+      "files": "檔案",
+      "terminals": "終端機",
+      "local": "本機",
+      "remote": "遠端工作區",
+      "peer": "對端裝置",
+      "switchWorkspace": "切換工作區",
+      "chooseShell": "選擇 Shell",
+      "noTerminals": "在此新增終端機，開始工作",
+      "resize": "調整檔案與終端機分區大小",
+      "revealDirectory": "在檔案樹中定位工作目錄",
+      "openTerminalHere": "在此新增終端機",
+      "terminalActions": "終端機操作",
+      "removeTerminal": "移除已結束終端機",
+      "unavailable": "無法取得終端機狀態，請重試",
+      "actionFailed": "終端機操作失敗：{{error}}",
+      "manual": "我的",
+      "agent": "Agent",
+      "status": {
+        "running": "$t(shared:statuses.running)",
+        "saved": "已儲存",
+        "exited": "已結束",
+        "unknown": "狀態未知",
+        "starting": "正在啟動",
+        "stopping": "正在停止",
+        "error": "異常"
+      }
+    },
     "shell": {
       "title": "Shell",
       "views": {
diff --git a/src/web-ui/src/locales/zh-TW/panels/terminal.json b/src/web-ui/src/locales/zh-TW/panels/terminal.json
index d1905e9c61..fdb047c5a6 100644
--- a/src/web-ui/src/locales/zh-TW/panels/terminal.json
+++ b/src/web-ui/src/locales/zh-TW/panels/terminal.json
@@ -1,6 +1,7 @@
 {
   "title": "終端",
   "emptyState": "目前沒有開啟的終端",
+  "actions": { "closeView": "關閉終端機檢視", "stopTerminal": "停止終端機" },
   "dialog": {
     "editTerminal": {
       "title": "編輯終端",
diff --git a/src/web-ui/src/locales/zh-TW/settings.json b/src/web-ui/src/locales/zh-TW/settings.json
index d420864e33..17f45bf10f 100644
--- a/src/web-ui/src/locales/zh-TW/settings.json
+++ b/src/web-ui/src/locales/zh-TW/settings.json
@@ -31,7 +31,6 @@
       "acp": { "label": "ACP Agent", "description": "設定透過 Agent Client Protocol 接入的外部 Agent。" },
       "usage": { "label": "調用統計", "description": "模型請求數、Token 用量與快取命中率。" },
       "archivedSessions": { "label": "已歸檔會話", "description": "檢視、恢復或永久刪除已歸檔的會話。" },
-      "legacyMigration": { "label": "資料遷移", "description": "從受支援的舊版 產品安裝匯入資料。" },
       "diagnostics": { "label": "日誌與診斷", "description": "日誌層級、執行資訊與故障排查。" }
     },
     "views": {
diff --git a/src/web-ui/src/locales/zh-TW/settings/legacy-migration.json b/src/web-ui/src/locales/zh-TW/settings/legacy-migration.json
deleted file mode 100644
index 6d22c83153..0000000000
--- a/src/web-ui/src/locales/zh-TW/settings/legacy-migration.json
+++ /dev/null
@@ -1,140 +0,0 @@
-{
-  "title": "資料遷移",
-  "subtitle": "從舊版 BitFun 安裝匯入受支援的資料，同時保持來源不變。",
-  "localOnlyNotice": "只能在儲存舊 BitFun 資料的裝置上，透過 OpenBitFun Desktop 啟動遷移。Remote Control、Peer Device Mode 和 Detached Dispatch 均不能啟動遷移。",
-  "sections": {
-    "source": { "title": "舊資料來源", "description": "啟動獨立 Data Migrator 前，OpenBitFun 會先執行唯讀檢查。" },
-    "scope": { "title": "遷移範圍", "description": "選擇高層資料群組。會話資料始終包含 Agent 協調狀態。" },
-    "scan": { "title": "最近掃描", "description": "這裡只顯示數量和大小摘要，不顯示私密正文或完整路徑。" },
-    "report": { "title": "最近報告", "description": "報告按所屬領域顯示去敏結果。舊 BitFun 資料永遠不會被自動刪除。" }
-  },
-  "fields": {
-    "detected": { "label": "偵測狀態", "description": "本機是否存在受支援的 BitFun 資料來源。" },
-    "source": { "label": "來源", "description": "唯讀探測得到的產品版本和平台。" },
-    "lastScan": { "label": "上次掃描", "description": "最近一次明確唯讀掃描的時間。" },
-    "actions": { "label": "操作", "description": "在本機掃描、啟動獨立遷移器或重新整理報告。" },
-    "reminder": { "label": "首次啟動提醒", "description": "目前來源的自動遷移提示已關閉。" },
-    "retryFailed": { "label": "重試失敗資料群組", "description": "僅使用包含失敗領域的資料群組啟動新的獨立遷移。" }
-  },
-  "source": {
-    "supported": "支援遷移",
-    "unsupported": "格式不受支援",
-    "notDetected": "未偵測到",
-    "summary": "{{platform}} 上的 {{product}} {{version}}",
-    "unknownVersion": "未知版本",
-    "none": "此裝置上未偵測到舊版 BitFun 資料。",
-    "neverScanned": "尚未掃描"
-  },
-  "actions": {
-    "scan": "掃描舊資料",
-    "startMigration": "開始遷移",
-    "viewReport": "檢視報告",
-    "retryFailed": "重試失敗項",
-    "restoreReminder": "恢復提醒",
-    "retry": "重試",
-    "cancel": "取消"
-  },
-  "groups": {
-    "settings_and_credentials": { "label": "設定和憑據", "description": "受支援的偏好、模型與服務設定，以及安全憑據引用。" },
-    "agents_skills_and_miniapps": { "label": "Agents、Skills 和 MiniApps", "description": "使用者 Agents、非系統 Skills 和非內建 MiniApps。" },
-    "workspaces_sessions_and_tasks": { "label": "工作區、會話與 Agent 任務", "description": "工作區和會話記錄，以及必需的協調狀態。" },
-    "memory": { "label": "Memory", "description": "受支援的結構化記憶和使用者編寫的記憶檔案。" },
-    "remote_connections_and_devices": { "label": "遠端連線和裝置", "description": "受支援的 Remote Connect 裝置記錄和 SSH 設定；秘密可能需要重新驗證。" }
-  },
-  "scan": {
-    "empty": "所選資料群組中沒有可遷移記錄。",
-    "summary": "{{count}} 筆記錄，{{bytes}} 邏輯位元組",
-    "migratable": "可遷移",
-    "blocked": "需要處理"
-  },
-  "report": {
-    "excludedPaths": "依遷移範圍保留在舊資料中的非核心會話檔案，無須處理。",
-    "orphanedSessions": "部分會話的父會話在舊資料中不存在；已保留關係及會話歷史，無須處理。",
-    "occurrences": "共 {{count}} 筆記錄",
-    "reauthentication": "部分連線需要重新認證，請至連線設定處理。",
-    "relocation": "部分路徑需要重新定位，請檢查工作區設定。",
-    "result": "執行結果",
-    "none": "尚無遷移報告。",
-    "timeUnavailable": "完成時間不可用",
-    "domainCounts": "匯入 {{imported}}，跳過 {{skipped}}，衝突 {{conflicts}}"
-  },
-  "statuses": {
-    "discovered": "已發現",
-    "scanned": "已掃描",
-    "planned": "已規劃",
-    "waiting_for_processes": "正在等待應用程式退出",
-    "staging": "正在暫存",
-    "validating_stage": "正在驗證暫存資料",
-    "committing": "正在提交",
-    "validating_commit": "正在驗證匯入資料",
-    "completed": "$t(shared:statuses.done)",
-    "completed_with_warnings": "已完成，但有警告",
-    "cancelled": "$t(shared:statuses.cancelled)",
-    "failed_recoverable": "失敗，可以重試",
-    "failed_manual_action_required": "需要手動處理"
-  },
-  "domainStates": {
-    "not_started": "未開始",
-    "staged": "已暫存",
-    "committed": "已提交",
-    "verified": "已驗證",
-    "failed": "$t(shared:statuses.failed)",
-    "skipped": "已跳過"
-  },
-  "domains": {
-    "settings": "$t(shared:features.settings)",
-    "credentials": "憑據",
-    "skills": "Skills",
-    "miniapps": "MiniApps",
-    "agents": "Agents",
-    "workspace_sessions": "工作區和會話",
-    "agent_coordination": "Agent 協調",
-    "structured_memory": "結構化記憶",
-    "file_memory": "記憶檔案",
-    "remote_connect_devices": "Remote Connect 裝置",
-    "remote_ssh": "Remote SSH",
-    "cross_reference_repair": "交叉引用修復"
-  },
-  "messages": {
-    "loading": "正在載入遷移狀態…",
-    "loadFailed": "無法載入此裝置上的遷移狀態。",
-    "emptySelection": "請至少選擇一個遷移資料群組。",
-    "scanComplete": "唯讀掃描已完成。",
-    "scanFailed": "無法安全掃描舊資料。",
-    "handoffStarted": "Data Migrator 正在啟動。交接完成後 OpenBitFun 將關閉。",
-    "prepareFailed": "無法安全啟動 Data Migrator。",
-    "noReport": "尚無遷移報告。",
-    "reportFailed": "無法載入遷移報告。",
-    "reminderRestored": "已恢復首次啟動遷移提醒。",
-    "preferenceFailed": "無法修改提醒偏好。"
-  },
-  "startupNotification": {
-    "title": "BitFun 資料遷移",
-    "launchFailed": "OpenBitFun 已繼續啟動，但無法啟動 Data Migrator。現有 OpenBitFun 和 BitFun 資料均未變更。",
-    "openSettings": "開啟遷移設定",
-    "statuses": {
-      "discovered": "Data Migrator 發現了舊資料，但尚未完成遷移。",
-      "scanned": "Data Migrator 已完成唯讀掃描。",
-      "planned": "Data Migrator 已儲存計畫，但尚未匯入資料。",
-      "waiting_for_processes": "遷移仍在等待本機應用程式退出。",
-      "staging": "遷移在暫存資料時停止，可以安全恢復。",
-      "validating_stage": "遷移在驗證暫存資料時停止，可以安全恢復。",
-      "committing": "遷移在提交領域資料時停止；重試前請檢視報告。",
-      "validating_commit": "遷移在驗證匯入資料時停止；請檢視報告。",
-      "completed": "受支援的 BitFun 資料已成功遷移。",
-      "completed_with_warnings": "BitFun 資料遷移已完成，但有警告。",
-      "cancelled": "BitFun 資料遷移已在安全邊界取消。",
-      "failed_recoverable": "BitFun 資料遷移未完成，可以重試。",
-      "failed_manual_action_required": "BitFun 資料遷移需要手動處理後才能繼續。"
-    }
-  },
-  "confirm": {
-    "title": "關閉 OpenBitFun 並啟動 Data Migrator？",
-    "message": "獨立 Data Migrator 需要獨占存取本機產品資料。繼續前請確認關閉影響。",
-    "agentImpact": "正在執行的 Agent 回合將停止。",
-    "terminalImpact": "終端任務和其他子程序可能會停止。",
-    "fileImpact": "遷移開始前，正在進行的檔案寫入必須完成。",
-    "unsavedImpact": "未儲存的編輯器或設定變更可能會遺失。",
-    "closeImpact": "OpenBitFun 將關閉；遷移器會再次確認最終範圍，並在遷移結束後重新開啟 OpenBitFun。"
-  }
-}
diff --git a/src/web-ui/src/shared/context-menu-system/providers/FileExplorerMenuProvider.ts b/src/web-ui/src/shared/context-menu-system/providers/FileExplorerMenuProvider.ts
index 1047d4d318..861aa0d88e 100644
--- a/src/web-ui/src/shared/context-menu-system/providers/FileExplorerMenuProvider.ts
+++ b/src/web-ui/src/shared/context-menu-system/providers/FileExplorerMenuProvider.ts
@@ -12,6 +12,7 @@ import { addFileMentionToChat } from '@/shared/utils/chatContext';
 import { dirnameAbsolutePath } from '@/shared/utils/pathUtils';
 import { isHtmlFilePath } from '@/shared/utils/htmlFilePreview';
 import { openFileInBestTarget } from '@/shared/utils/tabUtils';
+import { getActiveSurfaceId } from '@/infrastructure/peer-device/deviceSurface';
 
 const PASTE_SHORTCUT = /Mac|iPhone|iPad|iPod/.test(navigator.userAgent) ? 'Cmd+V' : 'Ctrl+V';
 
@@ -49,6 +50,17 @@ export class FileExplorerMenuProvider implements IMenuProvider {
   async getMenuItems(context: MenuContext): Promise<MenuItem[]> {
     const items: MenuItem[] = [];
     const localFileActionsDisabled = isRemoteWorkspace(workspaceManager.getState().currentWorkspace);
+    const surfaceId = getActiveSurfaceId();
+    const newTerminalItem = (directory: string, workspacePath: string): MenuItem => ({
+      id: 'file-new-terminal',
+      label: i18nService.t('common:nav.resources.openTerminalHere'),
+      icon: 'Terminal',
+      onClick: () => {
+        window.dispatchEvent(new CustomEvent('terminal-create-requested', {
+          detail: { workingDirectory: directory, workspacePath, surfaceId },
+        }));
+      },
+    });
 
     if (context.type === ContextType.EMPTY_SPACE) {
       const emptyContext = context as any;
@@ -57,7 +69,8 @@ export class FileExplorerMenuProvider implements IMenuProvider {
       const workspaceRoot = this.findWorkspaceRoot(emptyContext.targetElement);
       
       if (workspaceRoot) {
-        const parentPath = workspaceRoot; 
+        const parentPath = workspaceRoot;
+        items.push(newTerminalItem(parentPath, workspaceRoot));
         
         items.push({
           id: 'file-new-file',
@@ -102,6 +115,9 @@ export class FileExplorerMenuProvider implements IMenuProvider {
     const fileContext = context as FileNodeContext;
     const isDirectory = fileContext.isDirectory;
     const isReadOnly = fileContext.isReadOnly;
+    if (isDirectory && fileContext.workspacePath) {
+      items.push(newTerminalItem(fileContext.filePath, fileContext.workspacePath));
+    }
 
     
     if (!isDirectory) {
diff --git a/src/web-ui/src/shared/services/createManualTerminalSession.ts b/src/web-ui/src/shared/services/createManualTerminalSession.ts
index 8207c1c941..55281cdf04 100644
--- a/src/web-ui/src/shared/services/createManualTerminalSession.ts
+++ b/src/web-ui/src/shared/services/createManualTerminalSession.ts
@@ -2,10 +2,15 @@ import { configManager } from '@/infrastructure/config/services/ConfigManager';
 import type { TerminalConfig } from '@/infrastructure/config/types';
 import { getTerminalService } from '@/tools/terminal/services/TerminalService';
 import type { CreateSessionRequest, SessionResponse } from '@/tools/terminal/types/session';
+import { getActiveSurfaceScope } from '@/infrastructure/peer-device/deviceSurface';
 
 export interface CreateManualTerminalSessionOptions {
   workspacePath?: string;
   connectionId?: string | null;
+  shellType?: string;
+  shellId?: string;
+  name?: string;
+  sessionId?: string;
 }
 
 async function getDefaultShellPreference(): Promise<string | undefined> {
@@ -40,19 +45,24 @@ export async function createManualTerminalSession(
   options: CreateManualTerminalSessionOptions,
 ): Promise<SessionResponse> {
   const service = getTerminalService();
+  const scope = getActiveSurfaceScope();
   await service.connect();
+  scope.assertCurrent('create manual terminal');
 
   const [sessions, shellSelection] = await Promise.all([
     service.listSessions(),
-    resolveDefaultShellSelection(service),
+    options.connectionId ? Promise.resolve({}) : resolveDefaultShellSelection(service),
   ]);
+  scope.assertCurrent('create manual terminal');
   const manualCount = sessions.filter((session) => session.source === 'manual').length;
 
   return service.createSession({
     workingDirectory: options.workspacePath,
     connectionId: options.connectionId ?? undefined,
-    name: `Shell ${manualCount + 1}`,
-    ...shellSelection,
+    name: options.name ?? `Shell ${manualCount + 1}`,
+    sessionId: options.sessionId,
+    ...(options.shellId ? { shellId: options.shellId, shellType: options.shellType }
+      : options.shellType && options.shellType !== 'Remote' ? { shellType: options.shellType } : shellSelection),
     source: 'manual',
   });
 }
diff --git a/src/web-ui/src/shared/services/openShellSessionTarget.ts b/src/web-ui/src/shared/services/openShellSessionTarget.ts
index 064c60a587..fd2727237b 100644
--- a/src/web-ui/src/shared/services/openShellSessionTarget.ts
+++ b/src/web-ui/src/shared/services/openShellSessionTarget.ts
@@ -15,16 +15,6 @@ function openStandaloneShellSession(sessionId: string): void {
 
   openScene('terminal' as SceneTabId);
 
-  // Force a remount when reopening the same session so the terminal view
-  // can recover from stale/error state and always reflect the latest selection.
-  if (terminalState.activeSessionId === sessionId) {
-    terminalState.setActiveSession(null);
-    window.setTimeout(() => {
-      useTerminalSceneStore.getState().setActiveSession(sessionId);
-    }, 0);
-    return;
-  }
-
   terminalState.setActiveSession(sessionId);
 }
 
diff --git a/src/web-ui/src/shared/utils/tabUtils.ts b/src/web-ui/src/shared/utils/tabUtils.ts
index de2e01816a..3d27717298 100644
--- a/src/web-ui/src/shared/utils/tabUtils.ts
+++ b/src/web-ui/src/shared/utils/tabUtils.ts
@@ -461,6 +461,7 @@ export function createTerminalTab(
       isTerminal: true,
       sessionId,
       duplicateCheckKey: `terminal-${sessionId}`,
+      terminalCloseBehavior: 'detach',
     },
     checkDuplicate: true,
     duplicateCheckKey: `terminal-${sessionId}`,
diff --git a/src/web-ui/src/tools/editor/services/ModelIndentation.test.ts b/src/web-ui/src/tools/editor/services/ModelIndentation.test.ts
index 253767b915..5204f01059 100644
--- a/src/web-ui/src/tools/editor/services/ModelIndentation.test.ts
+++ b/src/web-ui/src/tools/editor/services/ModelIndentation.test.ts
@@ -4,10 +4,12 @@ import type * as Monaco from 'monaco-editor';
 import { applyModelIndentation, readModelIndentation, setModelIndentation } from './ModelIndentation';
 
 let monaco: typeof Monaco;
+// Loading the real Monaco module graph can exceed 10 seconds on a cold Windows run.
+// Keep this setup allowance separate from the default timeout for each assertion.
 beforeAll(async () => {
   window.matchMedia ??= vi.fn().mockReturnValue({ matches: false, addEventListener() {}, removeEventListener() {} });
   monaco = await import('monaco-editor/esm/vs/editor/editor.api');
-});
+}, 60_000);
 
 const defaults = { tab_size: 4, insert_spaces: true, detect_indentation: true };
 
diff --git a/src/web-ui/src/tools/file-explorer/search/useExplorerSearch.ts b/src/web-ui/src/tools/file-explorer/search/useExplorerSearch.ts
index 0a52115418..d346f8d999 100644
--- a/src/web-ui/src/tools/file-explorer/search/useExplorerSearch.ts
+++ b/src/web-ui/src/tools/file-explorer/search/useExplorerSearch.ts
@@ -34,6 +34,8 @@ export interface ExplorerSearchPhase {
 
 export interface UseExplorerSearchOptions {
   workspacePath?: string;
+  /** Optional host/workspace-scoped presentation key. Results are always fetched fresh. */
+  stateKey?: string;
   initialMode?: ExplorerSearchMode;
   filenameSearchDebounce?: number;
   contentSearchDebounce?: number;
@@ -159,11 +161,14 @@ function combineSearchGroups(
   return mergeSearchGroups(filenameGroups, contentGroups);
 }
 
+const searchPreferences = new Map<string, { query: string; mode: ExplorerSearchMode; options: ExplorerSearchOptions }>();
+
 export function useExplorerSearch(
   options: UseExplorerSearchOptions = {}
 ): UseExplorerSearchResult {
   const {
     workspacePath,
+    stateKey,
     initialMode = 'filenames',
     filenameSearchDebounce = 300,
     contentSearchDebounce = 300,
@@ -173,8 +178,9 @@ export function useExplorerSearch(
     contentMaxResults = 1000,
   } = options;
 
-  const [query, setQueryState] = useState('');
-  const [searchMode, setSearchMode] = useState<ExplorerSearchMode>(initialMode);
+  const saved = stateKey ? searchPreferences.get(stateKey) : undefined;
+  const [query, setQueryState] = useState(saved?.query ?? '');
+  const [searchMode, setSearchMode] = useState<ExplorerSearchMode>(saved?.mode ?? initialMode);
   const [filenameGroups, setFilenameGroups] = useState<FileSearchResultGroup[]>([]);
   const [contentGroups, setContentGroups] = useState<FileSearchResultGroup[]>([]);
   const [contentSearchMetadata, setContentSearchMetadata] = useState<SearchMetadata | null>(null);
@@ -184,11 +190,14 @@ export function useExplorerSearch(
   const [filenameTruncated, setFilenameTruncated] = useState(false);
   const [contentTruncated, setContentTruncated] = useState(false);
   const [error, setError] = useState<string | null>(null);
-  const [searchOptions, setSearchOptions] = useState<ExplorerSearchOptions>({
+  const [searchOptions, setSearchOptions] = useState<ExplorerSearchOptions>(saved?.options ?? {
     caseSensitive: false,
     useRegex: false,
     wholeWord: false,
   });
+  useEffect(() => {
+    if (stateKey) searchPreferences.set(stateKey, { query, mode: searchMode, options: searchOptions });
+  }, [stateKey, query, searchMode, searchOptions]);
 
   const filenameAbortController = useRef<AbortController | null>(null);
   const contentAbortController = useRef<AbortController | null>(null);
diff --git a/src/web-ui/src/tools/file-system/components/FileExplorer.tsx b/src/web-ui/src/tools/file-system/components/FileExplorer.tsx
index 51c07c64b4..1395ef1e4b 100644
--- a/src/web-ui/src/tools/file-system/components/FileExplorer.tsx
+++ b/src/web-ui/src/tools/file-system/components/FileExplorer.tsx
@@ -48,6 +48,7 @@ function buildFileNodeContext(node: FileSystemNode, workspacePath?: string): Fil
 export const FileExplorer: React.FC<FileExplorerProps> = ({
   fileTree,
   selectedFile,
+  revealTarget,
   onFileSelect,
   className = '',
   showFileSize = false,
@@ -359,6 +360,7 @@ export const FileExplorer: React.FC<FileExplorerProps> = ({
       <VirtualFileTree
         flatNodes={flatNodes}
         selectedFile={selectedFile}
+        revealTarget={revealTarget}
         expandedFolders={expandedFolders}
         onNodeSelect={(node: FlatFileNode) => emitFileSelect(node.path, node.name)}
         onToggleExpand={toggleExpandedState}
diff --git a/src/web-ui/src/tools/file-system/components/VirtualFileTree.tsx b/src/web-ui/src/tools/file-system/components/VirtualFileTree.tsx
index 696bd1a7e1..985cf41868 100644
--- a/src/web-ui/src/tools/file-system/components/VirtualFileTree.tsx
+++ b/src/web-ui/src/tools/file-system/components/VirtualFileTree.tsx
@@ -1,8 +1,10 @@
-import React, { useCallback, useMemo, useRef, forwardRef } from 'react';
+import React, { useCallback, useEffect, useMemo, useRef, forwardRef } from 'react';
 import { Virtuoso, VirtuosoHandle } from 'react-virtuoso';
 import { VirtualFileTreeProps, FlatFileNode, FileSystemNode } from '../types';
 import { useI18n } from '@/infrastructure/i18n';
-import { expandedFoldersContains } from '@/shared/utils/pathUtils';
+import { expandedFoldersContains, repositoryPathKey } from '@/shared/utils/pathUtils';
+import { getMotionAwareScrollBehavior } from '@/shared/utils/motionPreference';
+import { findFileTreeRevealIndex } from '../utils/fileTreeReveal';
 import { FileTreeItem } from './FileTreeItem';
 
 interface VirtualFileRowProps {
@@ -68,6 +70,8 @@ VirtualFileRow.displayName = 'VirtualFileRow';
 export const VirtualFileTree = forwardRef<VirtuosoHandle, VirtualFileTreeProps>(({
   flatNodes,
   selectedFile,
+  revealTarget,
+  workspacePath,
   expandedFolders,
   onNodeSelect,
   onToggleExpand,
@@ -81,6 +85,15 @@ export const VirtualFileTree = forwardRef<VirtuosoHandle, VirtualFileTreeProps>(
 }, ref) => {
   const { t } = useI18n('tools');
   const virtuosoRef = useRef<VirtuosoHandle>(null);
+  const completedReveal = useRef<typeof revealTarget>(undefined);
+  useEffect(() => {
+    if (!revealTarget || completedReveal.current === revealTarget || !virtuosoRef.current) return;
+    let index = findFileTreeRevealIndex(flatNodes, revealTarget.path);
+    if (index < 0 && workspacePath && repositoryPathKey(workspacePath) === repositoryPathKey(revealTarget.path)) index = 0;
+    if (index < 0 || flatNodes.length === 0) return;
+    virtuosoRef.current.scrollToIndex({ index, align: 'center', behavior: getMotionAwareScrollBehavior('smooth') });
+    completedReveal.current = revealTarget;
+  }, [flatNodes, revealTarget, workspacePath]);
 
   React.useImperativeHandle(ref, () => virtuosoRef.current!, []);
 
@@ -93,7 +106,7 @@ export const VirtualFileTree = forwardRef<VirtuosoHandle, VirtualFileTreeProps>(
   }, [onToggleExpand]);
 
   const itemContent = useCallback((_index: number, node: FlatFileNode) => {
-    const isSelected = selectedFile === node.path;
+    const isSelected = Boolean(selectedFile && findFileTreeRevealIndex([node], selectedFile) === 0);
     const isExpanded = expandedFoldersContains(expandedFolders, node.path);
 
     return (
diff --git a/src/web-ui/src/tools/file-system/types/index.ts b/src/web-ui/src/tools/file-system/types/index.ts
index ac7c655cdf..685ef51488 100644
--- a/src/web-ui/src/tools/file-system/types/index.ts
+++ b/src/web-ui/src/tools/file-system/types/index.ts
@@ -22,6 +22,7 @@ export interface FileSystemNode {
 export interface FileExplorerProps {
   fileTree: FileSystemNode[];
   selectedFile?: string;
+  revealTarget?: FileTreeRevealTarget;
   onFileSelect?: (filePath: string, fileName: string) => void;
   className?: string;
   enablePathCompression?: boolean;
@@ -193,9 +194,15 @@ export interface FlatFileNode {
 }
 
 
+export interface FileTreeRevealTarget {
+  path: string;
+  requestId: number;
+}
+
 export interface VirtualFileTreeProps {
   flatNodes: FlatFileNode[];
   selectedFile?: string;
+  revealTarget?: FileTreeRevealTarget;
   expandedFolders: Set<string>;
   onNodeSelect?: (node: FlatFileNode) => void;
   onToggleExpand?: (path: string) => void;
diff --git a/src/web-ui/src/tools/file-system/utils/fileTreeReveal.test.ts b/src/web-ui/src/tools/file-system/utils/fileTreeReveal.test.ts
new file mode 100644
index 0000000000..d3b881b7ea
--- /dev/null
+++ b/src/web-ui/src/tools/file-system/utils/fileTreeReveal.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, it } from 'vitest';
+import { findFileTreeRevealIndex, planFileTreeReveal } from './fileTreeReveal';
+import type { FlatFileNode } from '../types';
+
+describe('workspace directory reveal', () => {
+  it('preserves remote case, literal backslashes and quoted names on any controller', () => {
+    expect(planFileTreeReveal('/Repo', '/Repo/a\\b/"quoted"', true)).toEqual({
+      pathsToExpand: ['/Repo/a\\b', '/Repo/a\\b/"quoted"'], targetPath: '/Repo/a\\b/"quoted"',
+    });
+    expect(planFileTreeReveal('/Repo', '/repo/src', true)).toBeNull();
+  });
+  it('respects Windows target separators and case-insensitive roots', () => {
+    expect(planFileTreeReveal('C:\\Repo', 'c:/repo/src/lib')).toEqual({
+      pathsToExpand: ['C:\\Repo\\src', 'C:\\Repo\\src\\lib'], targetPath: 'C:\\Repo\\src\\lib',
+    });
+  });
+  it('rejects other workspace prefixes and traversal', () => {
+    expect(planFileTreeReveal('/repo', '/repository/src')).toBeNull();
+    expect(planFileTreeReveal('/repo', '/repo/../elsewhere')).toBeNull();
+  });
+  it('handles the workspace itself and a filesystem root', () => {
+    expect(planFileTreeReveal('/repo/', '/repo')).toEqual({ pathsToExpand: [], targetPath: '/repo' });
+    expect(planFileTreeReveal('/', '/src/lib', true)).toEqual({
+      pathsToExpand: ['/src', '/src/lib'], targetPath: '/src/lib',
+    });
+    expect(planFileTreeReveal('C:\\', 'c:/')?.targetPath).toBe('C:\\');
+  });
+  it('addresses offscreen rows by index and finds directories inside a compressed row', () => {
+    const nodes: FlatFileNode[] = Array.from({ length: 1000 }, (_, index) => ({
+      path: `/repo/folder-${index}`, name: `folder-${index}`, parentPath: '/repo',
+      isDirectory: true, depth: 0, childrenLoaded: false,
+    }));
+    expect(findFileTreeRevealIndex(nodes, '/repo/folder-999')).toBe(999);
+    const path = '/repo/a/b';
+    nodes.push({ ...nodes[0], path, isCompressed: true, originalNode: {
+      path, name: 'a/b', isDirectory: true, originalNodes: [
+        { path: '/repo/a', name: 'a', isDirectory: true },
+        { path, name: 'b', isDirectory: true },
+      ],
+    } });
+    expect(findFileTreeRevealIndex(nodes, '/repo/a')).toBe(1000);
+  });
+});
diff --git a/src/web-ui/src/tools/file-system/utils/fileTreeReveal.ts b/src/web-ui/src/tools/file-system/utils/fileTreeReveal.ts
new file mode 100644
index 0000000000..d74ce1f034
--- /dev/null
+++ b/src/web-ui/src/tools/file-system/utils/fileTreeReveal.ts
@@ -0,0 +1,38 @@
+import { repositoryPathKey } from '@/shared/utils/pathUtils';
+import type { FlatFileNode } from '../types';
+
+/** Plan ancestor expansion using the target filesystem's path semantics. */
+export function planFileTreeReveal(root: string, target: string, remote = false): {
+  pathsToExpand: string[]; targetPath: string;
+} | null {
+  if (!root || !target) return null;
+  const windows = !remote && (/^[a-z]:[/\\]/i.test(root) || root.startsWith('\\\\'));
+  const normalize = (path: string) => (windows ? path.replace(/\\/g, '/') : path).replace(/\/+$/, '') || '/';
+  const normalizedRoot = normalize(root);
+  const normalizedTarget = normalize(target);
+  const compare = (path: string) => windows ? path.toLowerCase() : path;
+  const prefix = normalizedRoot === '/' ? '/' : `${normalizedRoot}/`;
+  if (compare(normalizedTarget) !== compare(normalizedRoot)
+    && !compare(normalizedTarget).startsWith(compare(prefix))) return null;
+
+  const parts = normalizedTarget.slice(normalizedRoot === '/' ? 1 : normalizedRoot.length).split('/').filter(Boolean);
+  // Paths from a host are absolute. Do not let an unnormalized path escape the tree.
+  if (parts.some(part => part === '.' || part === '..')) return null;
+  const native = (path: string) => {
+    const absolute = windows && /^[a-z]:$/i.test(path) ? `${path}/` : path;
+    return windows && root.includes('\\') ? absolute.replace(/\//g, '\\') : absolute;
+  };
+  let currentPath = normalizedRoot;
+  const pathsToExpand = parts.map(part => {
+    currentPath = `${currentPath === '/' ? '' : currentPath}/${part}`;
+    return native(currentPath);
+  });
+  return { pathsToExpand, targetPath: native(currentPath) };
+}
+
+/** Address the data row, including compressed folders, rather than rendered DOM. */
+export function findFileTreeRevealIndex(nodes: FlatFileNode[], target: string): number {
+  const key = repositoryPathKey(target);
+  return nodes.findIndex(node => repositoryPathKey(node.path) === key
+    || node.originalNode?.originalNodes?.some(original => repositoryPathKey(original.path) === key));
+}
diff --git a/src/web-ui/src/tools/terminal/components/ConnectedTerminal.tsx b/src/web-ui/src/tools/terminal/components/ConnectedTerminal.tsx
index 90f9279844..0969025706 100644
--- a/src/web-ui/src/tools/terminal/components/ConnectedTerminal.tsx
+++ b/src/web-ui/src/tools/terminal/components/ConnectedTerminal.tsx
@@ -5,6 +5,7 @@
 
 import React, { useEffect, useRef, useCallback, useState, memo } from 'react';
 import { Button, Icon } from '@openbitfun/ui';
+import { useI18n } from '@/infrastructure/i18n';
 import { AlertCircle } from 'lucide-react';
 import Terminal, { TerminalRef, type TerminalOptions } from './Terminal';
 import { useTerminal } from '../hooks/useTerminal';
@@ -51,6 +52,8 @@ export interface ConnectedTerminalProps {
   /** Optional session data; fetched when omitted. */
   session?: SessionResponse;
   onClose?: () => void;
+  /** Closing a resource view must not terminate the host-owned PTY. */
+  closeBehavior?: 'detach' | 'terminate';
   onTitleChange?: (title: string) => void;
   onExit?: (exitCode?: number) => void;
   resizeSuspended?: boolean;
@@ -65,10 +68,12 @@ const ConnectedTerminal: React.FC<ConnectedTerminalProps> = memo(({
   options,
   session: initialSession,
   onClose,
+  closeBehavior = 'terminate',
   onTitleChange,
   onExit,
   resizeSuspended = false,
 }) => {
+  const { t } = useI18n('panels/terminal');
   const terminalRef = useRef<TerminalRef>(null);
   const [title, setTitle] = useState<string>(initialSession?.name || 'Terminal');
   const [exitCode, setExitCode] = useState<number | null>(null);
@@ -396,11 +401,13 @@ const ConnectedTerminal: React.FC<ConnectedTerminalProps> = memo(({
   }, [sendCtrlC, sessionId]);
 
   const handleClose = useCallback(() => {
-    close().catch(err => {
-      log.error('Failed to close', { sessionId, error: err });
-    });
+    if (closeBehavior === 'terminate') {
+      close().catch(err => {
+        log.error('Failed to close', { sessionId, error: err });
+      });
+    }
     onClose?.();
-  }, [close, onClose, sessionId]);
+  }, [close, closeBehavior, onClose, sessionId]);
 
   const handleRetry = useCallback(() => {
     refresh().catch(err => {
@@ -508,12 +515,12 @@ const ConnectedTerminal: React.FC<ConnectedTerminalProps> = memo(({
               <span style={{ fontSize: 'var(--openbitfun-type-micro-font-size)', fontWeight: 'var(--openbitfun-type-heading-page-font-weight)' }}>^C</span>
             </button>
             <button
-              className="openbitfun-terminal__toolbar-btn openbitfun-terminal__toolbar-btn--danger"
+              className={`openbitfun-terminal__toolbar-btn${closeBehavior === 'terminate' ? ' openbitfun-terminal__toolbar-btn--danger' : ''}`}
               onClick={handleClose}
-              title="Close terminal"
+              title={closeBehavior === 'detach' ? t('actions.closeView') : t('actions.stopTerminal')}
               data-testid="shell-panel-close"
             >
-              <Icon name="delete" size="sm" />
+              {closeBehavior === 'detach' ? <Icon name="xmark" size="sm" /> : <Icon name="delete" size="sm" />}
             </button>
           </div>
         </div>
diff --git a/src/web-ui/src/tools/terminal/services/TerminalService.ts b/src/web-ui/src/tools/terminal/services/TerminalService.ts
index e0720b29af..1122e957c8 100644
--- a/src/web-ui/src/tools/terminal/services/TerminalService.ts
+++ b/src/web-ui/src/tools/terminal/services/TerminalService.ts
@@ -25,6 +25,7 @@ import type {
   TerminalEventCallback,
   UnsubscribeFunction,
 } from '../types';
+import { TerminalOriginCache } from './terminalWorkspaceScope';
 
 const log = createLogger('TerminalService');
 
@@ -32,6 +33,7 @@ const log = createLogger('TerminalService');
  * Singleton wrapper for terminal-related Tauri API calls.
  */
 export class TerminalService {
+  private readonly originCache = new TerminalOriginCache();
   private static instance: TerminalService | null = null;
   
   private eventListeners: Map<string, Set<TerminalEventCallback>> = new Map();
@@ -240,10 +242,14 @@ export class TerminalService {
   }
 
   async createSession(request: CreateSessionRequest): Promise<SessionResponse> {
+    const scope = getActiveSurfaceScope();
     try {
       const session = await api.invoke<SessionResponse>('terminal_create', { request });
+      scope.assertCurrent('terminal_create');
       log.debug('Session created', { sessionId: session.id });
-      return session;
+      return this.originCache.project(scope.surfaceId, {
+        ...session, initialCwd: session.initialCwd || request.workingDirectory || session.cwd,
+      });
     } catch (error) {
       log.error('Failed to create session', error);
       throw error;
@@ -251,9 +257,11 @@ export class TerminalService {
   }
 
   async getSession(sessionId: string): Promise<SessionResponse> {
+    const scope = getActiveSurfaceScope();
     try {
       const session = await api.invoke<SessionResponse>('terminal_get', { sessionId });
-      return session;
+      scope.assertCurrent('terminal_get');
+      return this.originCache.project(scope.surfaceId, session);
     } catch (error) {
       log.error('Failed to get session', { sessionId, error });
       throw error;
@@ -261,9 +269,11 @@ export class TerminalService {
   }
 
   async listSessions(): Promise<SessionResponse[]> {
+    const scope = getActiveSurfaceScope();
     try {
       const sessions = await api.invoke<SessionResponse[]>('terminal_list');
-      return sessions;
+      scope.assertCurrent('terminal_list');
+      return sessions.map(session => this.originCache.project(scope.surfaceId, session));
     } catch (error) {
       log.error('Failed to list sessions', error);
       throw error;
diff --git a/src/web-ui/src/tools/terminal/services/manualTerminalProfileService.test.ts b/src/web-ui/src/tools/terminal/services/manualTerminalProfileService.test.ts
new file mode 100644
index 0000000000..bf8f8e62af
--- /dev/null
+++ b/src/web-ui/src/tools/terminal/services/manualTerminalProfileService.test.ts
@@ -0,0 +1,48 @@
+// @vitest-environment jsdom
+import { beforeEach, describe, expect, it } from 'vitest';
+import { STORAGE_KEYS } from '@/shared/constants/app';
+import {
+  deleteManualTerminalProfile, listManualTerminalProfiles, upsertManualTerminalProfile,
+} from './manualTerminalProfileService';
+
+const workspace = '/project';
+const storageKey = `${STORAGE_KEYS.MANUAL_TERMINAL_PROFILES}:${workspace}`;
+const legacyProfile = { id: 'saved-1', sessionId: 'terminal-1', name: 'Build' };
+
+describe('saved terminal configuration compatibility', () => {
+  beforeEach(() => { localStorage.clear(); });
+
+  it('reads legacy records and preserves unknown fields when rebinding a host-allocated session', () => {
+    localStorage.setItem(storageKey, JSON.stringify({
+      version: 1, futureSetting: { enabled: true },
+      profiles: [{ ...legacyProfile, futureField: 'preserve' }],
+    }));
+    expect(listManualTerminalProfiles(workspace)[0]).toMatchObject(legacyProfile);
+    upsertManualTerminalProfile(workspace, { ...legacyProfile, sessionId: 'ssh-host-allocated-id' });
+    expect(JSON.parse(localStorage.getItem(storageKey)!)).toMatchObject({
+      version: 1, futureSetting: { enabled: true },
+      profiles: [{ ...legacyProfile, sessionId: 'ssh-host-allocated-id', futureField: 'preserve' }],
+    });
+  });
+
+  it.each([
+    ['malformed JSON', '{unfinished'],
+    ['invalid entry', JSON.stringify({ version: 1, profiles: [legacyProfile, null] })],
+    ['newer format', JSON.stringify({ version: 2, profiles: [legacyProfile] })],
+  ])('leaves %s intact and surfaces read and write failures', (_name, raw) => {
+    localStorage.setItem(storageKey, raw);
+    expect(() => listManualTerminalProfiles(workspace)).toThrow();
+    expect(() => upsertManualTerminalProfile(workspace, legacyProfile)).toThrow();
+    expect(() => deleteManualTerminalProfile(workspace, legacyProfile.id)).toThrow();
+    expect(localStorage.getItem(storageKey)).toBe(raw);
+  });
+
+  it('isolates workspace records and removes only the explicitly selected configuration', () => {
+    upsertManualTerminalProfile(workspace, legacyProfile);
+    upsertManualTerminalProfile(workspace, { id: 'saved-2', sessionId: 'terminal-2', name: 'Tests' });
+    upsertManualTerminalProfile('peer:/project', legacyProfile);
+    deleteManualTerminalProfile(workspace, legacyProfile.id);
+    expect(listManualTerminalProfiles(workspace).map(profile => profile.id)).toEqual(['saved-2']);
+    expect(listManualTerminalProfiles('peer:/project')).toHaveLength(1);
+  });
+});
diff --git a/src/web-ui/src/tools/terminal/services/manualTerminalProfileService.ts b/src/web-ui/src/tools/terminal/services/manualTerminalProfileService.ts
index 331d54b22c..43925f9116 100644
--- a/src/web-ui/src/tools/terminal/services/manualTerminalProfileService.ts
+++ b/src/web-ui/src/tools/terminal/services/manualTerminalProfileService.ts
@@ -39,12 +39,19 @@ export function generateManualTerminalProfileId(): string {
   return `manual_profile_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
 }
 
-function normalizeProfile(profile: Partial<ManualTerminalProfile>): ManualTerminalProfile | null {
-  if (!profile.id || !profile.sessionId || !profile.name?.trim()) {
+function normalizeProfile(raw: unknown): ManualTerminalProfile | null {
+  if (!raw || typeof raw !== 'object') return null;
+  const profile = raw as Partial<ManualTerminalProfile>;
+  if (typeof profile.id !== 'string' || !profile.id
+    || typeof profile.sessionId !== 'string' || !profile.sessionId
+    || typeof profile.name !== 'string' || !profile.name.trim()
+    || [profile.workingDirectory, profile.startupCommand, profile.shellType]
+      .some(value => value != null && typeof value !== 'string')) {
     return null;
   }
 
   return {
+    ...profile,
     id: profile.id,
     sessionId: profile.sessionId,
     name: profile.name.trim(),
@@ -56,16 +63,20 @@ function normalizeProfile(profile: Partial<ManualTerminalProfile>): ManualTermin
 
 function normalizeState(raw: unknown): ManualTerminalProfilesState {
   if (!raw || typeof raw !== 'object') {
-    return EMPTY_STATE;
+    throw new Error('Invalid saved terminal configurations');
   }
-
-  const profiles = Array.isArray((raw as { profiles?: unknown[] }).profiles)
-    ? (raw as { profiles: unknown[] }).profiles
-        .map((item) => normalizeProfile(item as Partial<ManualTerminalProfile>))
-        .filter((item): item is ManualTerminalProfile => item !== null)
-    : [];
+  const state = raw as { version?: unknown; profiles?: unknown };
+  if ((state.version !== undefined && state.version !== 1) || !Array.isArray(state.profiles)) {
+    throw new Error('Unsupported saved terminal configuration format');
+  }
+  const profiles = state.profiles.map(item => {
+    const profile = normalizeProfile(item);
+    if (!profile) throw new Error('Invalid saved terminal configuration; existing data has been preserved');
+    return profile;
+  });
 
   return {
+    ...raw,
     version: 1,
     profiles,
   };
@@ -74,11 +85,12 @@ function normalizeState(raw: unknown): ManualTerminalProfilesState {
 export function loadManualTerminalProfiles(workspacePath: string): ManualTerminalProfilesState {
   try {
     const raw = localStorage.getItem(getStorageKey(workspacePath));
-    if (raw) {
+    if (raw !== null) {
       return normalizeState(JSON.parse(raw));
     }
   } catch (error) {
     logger.error('Failed to load manual terminal profiles', { workspacePath, error });
+    throw new Error('Saved terminal configurations could not be read; existing data has been preserved');
   }
 
   return EMPTY_STATE;
@@ -88,10 +100,13 @@ export function saveManualTerminalProfiles(
   workspacePath: string,
   state: ManualTerminalProfilesState,
 ): void {
+  // Do not replace an unreadable or newer-format record with a normalized subset.
+  loadManualTerminalProfiles(workspacePath);
   try {
     localStorage.setItem(getStorageKey(workspacePath), JSON.stringify(normalizeState(state)));
   } catch (error) {
     logger.error('Failed to save manual terminal profiles', { workspacePath, error });
+    throw error;
   }
 }
 
@@ -122,6 +137,7 @@ export function upsertManualTerminalProfile(
     (profile) => profile.id === input.id || profile.sessionId === input.sessionId,
   );
   const normalizedProfile = normalizeProfile({
+    ...existingProfile,
     id: existingProfile?.id ?? input.id ?? generateManualTerminalProfileId(),
     sessionId: input.sessionId,
     name: input.name,
@@ -144,7 +160,7 @@ export function upsertManualTerminalProfile(
   }
 
   saveManualTerminalProfiles(workspacePath, {
-    version: 1,
+    ...currentState,
     profiles: nextProfiles,
   });
 
@@ -154,7 +170,7 @@ export function upsertManualTerminalProfile(
 export function deleteManualTerminalProfile(workspacePath: string, profileId: string): void {
   const currentState = loadManualTerminalProfiles(workspacePath);
   saveManualTerminalProfiles(workspacePath, {
-    version: 1,
+    ...currentState,
     profiles: currentState.profiles.filter((profile) => profile.id !== profileId),
   });
 }
diff --git a/src/web-ui/src/tools/terminal/services/terminalWorkspaceScope.test.ts b/src/web-ui/src/tools/terminal/services/terminalWorkspaceScope.test.ts
new file mode 100644
index 0000000000..5278dd03f5
--- /dev/null
+++ b/src/web-ui/src/tools/terminal/services/terminalWorkspaceScope.test.ts
@@ -0,0 +1,54 @@
+import { describe, expect, it } from 'vitest';
+import type { SessionResponse } from '../types/session';
+import { isSessionRunning } from '@/app/scenes/shell/hooks/shellEntryTypes';
+import { TerminalOriginCache, isTerminalPathInside, terminalBelongsToWorkspace } from './terminalWorkspaceScope';
+
+const terminal = (overrides: Partial<SessionResponse> = {}): SessionResponse => ({
+  id: 'terminal-1', name: 'Development', shellType: 'Bash', cwd: '/repo/src', initialCwd: '/repo',
+  source: 'manual', status: 'Running', cols: 80, rows: 24, ...overrides,
+});
+
+describe('workspace terminal projection', () => {
+  it('keeps a terminal in its creation workspace after cd', () => {
+    expect(terminalBelongsToWorkspace(terminal({ cwd: '/another-project' }), { rootPath: '/repo', isRemote: false })).toBe(true);
+    expect(terminalBelongsToWorkspace(terminal({ cwd: '/another-project' }), { rootPath: '/another-project', isRemote: false })).toBe(false);
+  });
+  it('uses path boundaries and the closest opened project', () => {
+    expect(isTerminalPathInside('/repository/src', '/repo')).toBe(false);
+    const parent = { rootPath: '/repo', isRemote: false };
+    const child = { rootPath: '/repo/packages/app', isRemote: false };
+    const session = terminal({ initialCwd: '/repo/packages/app/src' });
+    expect(terminalBelongsToWorkspace(session, parent, [parent, child])).toBe(false);
+    expect(terminalBelongsToWorkspace(session, child, [parent, child])).toBe(true);
+  });
+  it('uses the target path semantics on every controller OS', () => {
+    expect(isTerminalPathInside('C:\\Repo\\src', 'c:/repo/')).toBe(true);
+    expect(isTerminalPathInside('/Repo/src', '/repo', true)).toBe(false);
+    expect(isTerminalPathInside('/repo/a\\b', '/repo/a', true)).toBe(false);
+    expect(isTerminalPathInside('/repo/src', '/', true)).toBe(true);
+  });
+  it('isolates local workspaces and two SSH connections with identical paths', () => {
+    const remote = terminal({ shellType: 'Remote', connectionId: 'ssh-a' });
+    expect(terminalBelongsToWorkspace(remote, { rootPath: '/repo', isRemote: false })).toBe(false);
+    expect(terminalBelongsToWorkspace(remote, { rootPath: '/repo', isRemote: true, connectionId: 'ssh-b' })).toBe(false);
+    expect(terminalBelongsToWorkspace(remote, { rootPath: '/repo', isRemote: true, connectionId: 'ssh-a' })).toBe(true);
+    expect(terminalBelongsToWorkspace(remote, { rootPath: '/repo', isRemote: true })).toBe(false);
+  });
+  it('accepts old host payloads and anchors their first observation per device', () => {
+    const origins = new TerminalOriginCache();
+    const old = terminal({ initialCwd: undefined });
+    expect(origins.project('local', old).initialCwd).toBe('/repo/src');
+    expect(origins.project('local', { ...old, cwd: '/different' }).initialCwd).toBe('/repo/src');
+    expect(origins.project('peer-b', { ...old, cwd: '/different' }).initialCwd).toBe('/different');
+    expect(origins.project('local', { ...old, initialCwd: '/authoritative' }).initialCwd).toBe('/authoritative');
+  });
+  it('does not report an exited or unknown session as running', () => {
+    for (const status of ['Exited { exit_code: Some(0) }', 'Stopped', 'Terminating', 'Error', 'unknown']) {
+      expect(isSessionRunning(terminal({ status }))).toBe(false);
+    }
+    expect(isSessionRunning(terminal())).toBe(true);
+    expect(isSessionRunning(terminal({ status: 'Active' }))).toBe(true);
+    expect(isSessionRunning(terminal({ status: 'Starting' }))).toBe(true);
+    expect(isSessionRunning(terminal({ status: 'Restoring' }))).toBe(true);
+  });
+});
diff --git a/src/web-ui/src/tools/terminal/services/terminalWorkspaceScope.ts b/src/web-ui/src/tools/terminal/services/terminalWorkspaceScope.ts
new file mode 100644
index 0000000000..a47a29b55c
--- /dev/null
+++ b/src/web-ui/src/tools/terminal/services/terminalWorkspaceScope.ts
@@ -0,0 +1,57 @@
+import type { SessionResponse } from '../types/session';
+
+export interface TerminalWorkspaceScope {
+  rootPath: string;
+  connectionId?: string | null;
+  isRemote: boolean;
+}
+
+/** Target path semantics, independent of the controller's operating system. */
+export function normalizeTerminalPath(path: string, remote = false): string {
+  const windows = !remote && (/^[a-z]:[/\\]/i.test(path) || path.startsWith('\\\\'));
+  const normalized = windows ? path.replace(/\\/g, '/').toLowerCase() : path;
+  return normalized.replace(/\/+$/, '') || '/';
+}
+
+export function isTerminalPathInside(path: string, root: string, remote = false): boolean {
+  if (!path || !root) return false;
+  const candidate = normalizeTerminalPath(path, remote);
+  const parent = normalizeTerminalPath(root, remote);
+  return candidate === parent || candidate.startsWith(parent === '/' ? '/' : `${parent}/`);
+}
+
+export function terminalMatchesEnvironment(session: SessionResponse, scope: TerminalWorkspaceScope): boolean {
+  const remote = session.shellType === 'Remote' || Boolean(session.connectionId);
+  return scope.isRemote
+    ? remote && Boolean(scope.connectionId) && session.connectionId === scope.connectionId
+    : !remote;
+}
+
+/** Prefer the closest opened workspace, so nested projects do not share terminals. */
+export function terminalBelongsToWorkspace(
+  session: SessionResponse,
+  scope: TerminalWorkspaceScope,
+  workspaces: TerminalWorkspaceScope[] = [],
+): boolean {
+  if (!terminalMatchesEnvironment(session, scope)) return false;
+  const origin = session.initialCwd || session.cwd;
+  if (!isTerminalPathInside(origin, scope.rootPath, scope.isRemote)) return false;
+  const root = normalizeTerminalPath(scope.rootPath, scope.isRemote);
+  return !workspaces.some(other =>
+    terminalMatchesEnvironment(session, other)
+    && normalizeTerminalPath(other.rootPath, other.isRemote).length > root.length
+    && isTerminalPathInside(origin, other.rootPath, other.isRemote),
+  );
+}
+
+/** Legacy hosts expose only cwd. Remember the first observation for this service lifetime. */
+export class TerminalOriginCache {
+  private origins = new Map<string, string>();
+
+  project(surfaceId: string, session: SessionResponse): SessionResponse {
+    const key = JSON.stringify([surfaceId, session.connectionId ?? '', session.id]);
+    const initialCwd = session.initialCwd || this.origins.get(key) || session.cwd;
+    if (initialCwd) this.origins.set(key, initialCwd);
+    return { ...session, initialCwd };
+  }
+}
diff --git a/src/web-ui/src/tools/terminal/types/session.ts b/src/web-ui/src/tools/terminal/types/session.ts
index 6425ed43dd..5a0ce7bd5b 100644
--- a/src/web-ui/src/tools/terminal/types/session.ts
+++ b/src/web-ui/src/tools/terminal/types/session.ts
@@ -34,6 +34,8 @@ export interface SessionResponse {
   name: string;
   shellType: string;
   cwd: string;
+  /** Immutable creation directory; omitted by older hosts. */
+  initialCwd?: string;
   pid?: number;
   status: SessionStatus | string;
   cols: number;