diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 72bcd1f5b..d798c1976 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -124,9 +124,9 @@ jobs:
           CORE_DISTRIBUTION_OFFLINE: ${{ (github.event_name == 'push' || inputs.offline) && '1' || '0' }}
         run: |
           inputs="$HOME/.oac/build/release-inputs/inputs.json"
-          AGENTS_RUNTIME_CODEX_PACKAGE="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["codex"])' "$inputs")"
+          CODEX_CLI_DIR="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["codex"])' "$inputs")"
           MCODE_HARNESS_BUILD_DIR="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["mcode"])' "$inputs")"
-          export AGENTS_RUNTIME_CODEX_PACKAGE MCODE_HARNESS_BUILD_DIR
+          export CODEX_CLI_DIR MCODE_HARNESS_BUILD_DIR
           export CORE_DISTRIBUTION_RELEASE_BASE_URL="https://github.com/$RELEASE_REPOSITORY/releases/download/$RELEASE_TAG"
           bash scripts/build-core-distribution.sh
           mkdir -p "$HOME/.oac/build/release-upload"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 04cbec682..95a989fe2 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -142,7 +142,7 @@ Native adapter changes require their build/check targets and live provider accep
 | Provider ownership labels | `io.oac.*` |
 | E2B metadata | `oac_*` |
 
-Provider bootstrap, Runtime images and Harness adapters must agree on these names. The separate Parsar product integration settings keep their own names.
+Provider bootstrap, Runtime images and Harness adapters must agree on these names.
 
 The [installation version policy](docs/getting-started/operations.md#installation-version-policy) owns release changes and preservation of installed data and resources.
 
diff --git a/Makefile b/Makefile
index a69748107..f755dec39 100644
--- a/Makefile
+++ b/Makefile
@@ -3,7 +3,7 @@ SQLC_VERSION ?= v1.29.0
 SQLC ?= go run github.com/sqlc-dev/sqlc/cmd/sqlc@$(SQLC_VERSION)
 SWAG_VERSION ?= v1.16.4
 
-.PHONY: help check check-database check-go check-sqlc sqlc-generate node-deps check-claude-sdk check-web check-mcode-harness build-daemon build-sandbox-io build-core check-core check-core-packages check-core-integration docker-build-core check-core-container build-agents-runtime build-claude-runtime build-claude-sdk-runtime build-mcode-harness build-mcode-runtime
+.PHONY: help check check-database check-go check-sqlc sqlc-generate node-deps check-claude-sdk check-web check-mcode-harness build-daemon build-sandbox-io build-core check-core check-core-packages check-core-integration docker-build-core check-core-container build-codex-runtime build-claude-runtime build-claude-sdk-runtime build-mcode-harness build-mcode-runtime
 
 help:
 	@printf '%s\n' 'make build-core        Build standalone Core commands' 'make build-daemon      Build the execution daemon' 'make build-sandbox-io  Build the Sandbox I/O service for Linux' 'make check             Run Core, persistence and runtime checks' 'See README.md for runtime prerequisites and deployment.'
@@ -151,8 +151,8 @@ check-mcode-harness:
 	@for script in packages/mcode-harness/*.mjs; do node --check "$$script"; done
 	bash -n scripts/build-mcode-harness.sh scripts/build-mcode-runtime.sh
 
-build-agents-runtime:
-	./scripts/build-agents-runtime.sh
+build-codex-runtime:
+	./scripts/build-codex-runtime.sh
 
 build-claude-runtime:
 	./scripts/build-claude-runtime.sh
diff --git a/README.md b/README.md
index 6277909fd..5713ac292 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@
 
 An open-source, self-hosted implementation of the OpenAI Agents API with multiple native harnesses.
 
-[Website](https://minimax-ai.github.io/OpenAgentCore/) · [Install](#install) · [Call the API](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/quickstart) · [Documentation](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/) · [Contributing](CONTRIBUTING.md)
+[Website](https://openagentcore.dev/) · [Install](#install) · [Call the API](https://openagentcore.dev/docs/getting-started/quickstart) · [Documentation](https://openagentcore.dev/docs/getting-started/) · [Contributing](CONTRIBUTING.md)
 
 **English** · [简体中文](README.zh-CN.md)
 
@@ -17,9 +17,9 @@ An open-source, self-hosted implementation of the OpenAI Agents API with multipl
 OpenAgentCore runs AI agents on your own infrastructure behind the [OpenAI Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview).
 
 - **Same API as OpenAI.** Point the [OpenAI Agent API](https://developers.openai.com/api/docs/guides/agents/sdk), or plain HTTP, at your installation. No new client to learn.
-- **Your choice of agent.** Each [Session](https://minimax-ai.github.io/OpenAgentCore/docs/api/public-agent-api) runs a [native harness](https://minimax-ai.github.io/OpenAgentCore/contracts/agents-api/harness-onboarding): [Codex](https://github.com/openai/codex), [Claude Code](https://code.claude.com/docs/en/overview) or [MiniMax Code](https://github.com/MiniMax-AI/minimax-code), with the [model provider you configure](https://minimax-ai.github.io/OpenAgentCore/contracts/agents-api/model-execution).
-- **Your choice of machine.** Agents work in a [managed sandbox](https://minimax-ai.github.io/OpenAgentCore/contracts/agents-api/sandbox-deployment) ([Docker](https://www.docker.com/), [microsandbox](https://github.com/zerocore-ai/microsandbox) or [E2B](https://e2b.dev/)), or on your own Linux, macOS or Windows machine.
-- **Every part is replaceable.** [Sandboxes](https://minimax-ai.github.io/OpenAgentCore/docs/sandbox-provider), [harnesses](https://minimax-ai.github.io/OpenAgentCore/contracts/agents-api/harness-onboarding) and [model providers](https://minimax-ai.github.io/OpenAgentCore/contracts/agents-api/model-execution) plug in through [defined protocols](AGENTS.md#protocols-at-every-boundary).
+- **Your choice of agent.** Each [Session](https://openagentcore.dev/docs/api/public-agent-api) runs a [native harness](https://openagentcore.dev/contracts/agents-api/harness-onboarding): [Codex](https://github.com/openai/codex), [Claude Code](https://code.claude.com/docs/en/overview) or [MiniMax Code](https://github.com/MiniMax-AI/minimax-code), with the [model provider you configure](https://openagentcore.dev/contracts/agents-api/model-execution).
+- **Your choice of machine.** Agents work in a [managed sandbox](https://openagentcore.dev/contracts/agents-api/sandbox-deployment) ([Docker](https://www.docker.com/), [microsandbox](https://github.com/zerocore-ai/microsandbox) or [E2B](https://e2b.dev/)), or on your own Linux, macOS or Windows machine.
+- **Every part is replaceable.** [Sandboxes](https://openagentcore.dev/docs/sandbox-provider), [harnesses](https://openagentcore.dev/contracts/agents-api/harness-onboarding) and [model providers](https://openagentcore.dev/contracts/agents-api/model-execution) plug in through [defined protocols](AGENTS.md#protocols-at-every-boundary).
 
 ## How it fits together
 
@@ -29,10 +29,10 @@ Applications and operators use these Core APIs:
 
 | API | Path | Used by |
 | --- | --- | --- |
-| **[Agents API](https://minimax-ai.github.io/OpenAgentCore/docs/api/public-agent-api)** | `/v1` | Your applications. Same protocol as [OpenAI's Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview) |
-| **[Core API](https://minimax-ai.github.io/OpenAgentCore/contracts/agents-api/admin-api)** | `/core/v1` | Operators, through Web |
+| **[Agents API](https://openagentcore.dev/docs/api/public-agent-api)** | `/v1` | Your applications. Same protocol as [OpenAI's Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview) |
+| **[Core API](https://openagentcore.dev/contracts/agents-api/admin-api)** | `/core/v1` | Operators, through Web |
 
-Core keeps durable execution state. The Runtime runs the chosen harness inside the Environment. Each connection is a defined protocol, so any part can be replaced on its own. See the [architecture guide](https://minimax-ai.github.io/OpenAgentCore/docs/architecture).
+Core keeps durable execution state. The Runtime runs the chosen harness inside the Environment. Each connection is a defined protocol, so any part can be replaced on its own. See the [architecture guide](https://openagentcore.dev/docs/architecture).
 
 ## Screenshots
 
@@ -53,20 +53,20 @@ Then:
 1. **Sign in to Web**, the admin console, with the Core key the installer created, and **configure the domain and HTTPS**.
 2. **Set a default model** and **issue a Project API key**.
 3. **Add execution capacity:** a node, E2B, or your own machine.
-4. **[Run your first Session](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/quickstart)** with the OpenAI SDK.
+4. **[Run your first Session](https://openagentcore.dev/docs/getting-started/quickstart)** with the OpenAI SDK.
 
-The [installation guide](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/install) covers each step, HTTPS and a quick local trial. Listen addresses, ports and other options: [installation options](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/install-options).
+The [installation guide](https://openagentcore.dev/docs/getting-started/install) covers each step, HTTPS and a quick local trial. Listen addresses, ports and other options: [installation options](https://openagentcore.dev/docs/getting-started/install-options).
 
 ## Documentation
 
 | I want to | Start with |
 | --- | --- |
-| Install and operate an installation | [Installation](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/install), then [operations](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/operations) |
-| Build an application on the API | [Quickstart](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/quickstart), then the [Agents API guide](https://minimax-ai.github.io/OpenAgentCore/docs/api/public-agent-api) |
-| See a complete application | [Examples](https://minimax-ai.github.io/OpenAgentCore/docs/examples) |
-| Run agents on my own machine | [Self-hosted execution](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/self-hosted) |
-| Check Harness capabilities and limits | [Harness capabilities](https://minimax-ai.github.io/OpenAgentCore/contracts/agents-api/harness-capabilities) |
-| Understand the design | [Architecture](https://minimax-ai.github.io/OpenAgentCore/docs/architecture) |
-| Add a sandbox, harness or other component | [Developer guide](https://minimax-ai.github.io/OpenAgentCore/docs/development) |
-
-All pages: [documentation index](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/). Before changing code, read the [contributor rules](CONTRIBUTING.md).
+| Install and operate an installation | [Installation](https://openagentcore.dev/docs/getting-started/install), then [operations](https://openagentcore.dev/docs/getting-started/operations) |
+| Build an application on the API | [Quickstart](https://openagentcore.dev/docs/getting-started/quickstart), then the [Agents API guide](https://openagentcore.dev/docs/api/public-agent-api) |
+| See a complete application | [Examples](https://openagentcore.dev/docs/examples) |
+| Run agents on my own machine | [Self-hosted execution](https://openagentcore.dev/docs/getting-started/self-hosted) |
+| Check Harness capabilities and limits | [Harness capabilities](https://openagentcore.dev/contracts/agents-api/harness-capabilities) |
+| Understand the design | [Architecture](https://openagentcore.dev/docs/architecture) |
+| Add a sandbox, harness or other component | [Developer guide](https://openagentcore.dev/docs/development) |
+
+All pages: [documentation index](https://openagentcore.dev/docs/getting-started/). Before changing code, read the [contributor rules](CONTRIBUTING.md).
diff --git a/README.zh-CN.md b/README.zh-CN.md
index b2d5f42a9..5414cea3c 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -6,7 +6,7 @@
 
 OpenAI Agents API 的开源实现，支持多种原生执行引擎，可部署在自己的基础设施上。
 
-[官网](https://minimax-ai.github.io/OpenAgentCore/zh/) · [安装](#安装) · [调用 API](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/quickstart) · [文档](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/) · [参与贡献](CONTRIBUTING.md)
+[官网](https://openagentcore.dev/zh/) · [安装](#安装) · [调用 API](https://openagentcore.dev/zh/docs/getting-started/quickstart) · [文档](https://openagentcore.dev/zh/docs/getting-started/) · [参与贡献](CONTRIBUTING.md)
 
 [English](README.md) · **简体中文**
 
@@ -20,19 +20,19 @@ OpenAI Agents API 的开源实现，支持多种原生执行引擎，可部署
 
 | API | 路径 | 调用方 |
 | --- | --- | --- |
-| **[Agents API](https://minimax-ai.github.io/OpenAgentCore/zh/docs/api/public-agent-api)** | `/v1` | 你的应用，与 [OpenAI 的 Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview) 协议一致 |
-| **[Core API](https://minimax-ai.github.io/OpenAgentCore/zh/contracts/agents-api/admin-api)** | `/core/v1` | 管理员，通过 Web 调用 |
+| **[Agents API](https://openagentcore.dev/zh/docs/api/public-agent-api)** | `/v1` | 你的应用，与 [OpenAI 的 Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview) 协议一致 |
+| **[Core API](https://openagentcore.dev/zh/contracts/agents-api/admin-api)** | `/core/v1` | 管理员，通过 Web 调用 |
 
-持久化执行状态由 Core 保存；Runtime 在 Environment 中运行所选 Harness。各部件之间都通过既定协议连接， 任何一个都可以单独替换。详见[架构说明](https://minimax-ai.github.io/OpenAgentCore/zh/docs/architecture)。
+持久化执行状态由 Core 保存；Runtime 在 Environment 中运行所选 Harness。各部件之间都通过既定协议连接， 任何一个都可以单独替换。详见[架构说明](https://openagentcore.dev/zh/docs/architecture)。
 
 ## 这是什么
 
 OpenAgentCore 在你自己的基础设施上运行 AI Agent，对外提供 [OpenAI Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview)。
 
 - **与 OpenAI 相同的 API。** [官方 OpenAI SDK](https://developers.openai.com/api/docs/guides/agents/sdk) 或直接 HTTP 调用，改一下地址即可，无需学习新客户端。
-- **自选 Agent。** 每个 [Session](https://minimax-ai.github.io/OpenAgentCore/zh/docs/api/public-agent-api) 运行一个[原生 Harness](https://minimax-ai.github.io/OpenAgentCore/zh/contracts/agents-api/harness-onboarding)：[Codex](https://github.com/openai/codex)、[Claude Code](https://code.claude.com/docs/en/overview) 或 [MiniMax Code](https://github.com/MiniMax-AI/minimax-code)， 使用[你配置的模型供应商](https://minimax-ai.github.io/OpenAgentCore/zh/contracts/agents-api/model-execution)。
-- **自选机器。** Agent 可以在[托管沙箱](https://minimax-ai.github.io/OpenAgentCore/zh/contracts/agents-api/sandbox-deployment)（[Docker](https://www.docker.com/)、[microsandbox](https://github.com/zerocore-ai/microsandbox) 或 [E2B](https://e2b.dev/)）里工作， 也可以在你自己的 Linux、macOS 或 Windows 机器上工作。
-- **每个部件都可替换。** [沙箱](https://minimax-ai.github.io/OpenAgentCore/zh/docs/sandbox-provider)、[Harness](https://minimax-ai.github.io/OpenAgentCore/zh/contracts/agents-api/harness-onboarding) 和[模型供应商](https://minimax-ai.github.io/OpenAgentCore/zh/contracts/agents-api/model-execution)都通过[既定协议](AGENTS.md#protocols-at-every-boundary)接入。
+- **自选 Agent。** 每个 [Session](https://openagentcore.dev/zh/docs/api/public-agent-api) 运行一个[原生 Harness](https://openagentcore.dev/zh/contracts/agents-api/harness-onboarding)：[Codex](https://github.com/openai/codex)、[Claude Code](https://code.claude.com/docs/en/overview) 或 [MiniMax Code](https://github.com/MiniMax-AI/minimax-code)， 使用[你配置的模型供应商](https://openagentcore.dev/zh/contracts/agents-api/model-execution)。
+- **自选机器。** Agent 可以在[托管沙箱](https://openagentcore.dev/zh/contracts/agents-api/sandbox-deployment)（[Docker](https://www.docker.com/)、[microsandbox](https://github.com/zerocore-ai/microsandbox) 或 [E2B](https://e2b.dev/)）里工作， 也可以在你自己的 Linux、macOS 或 Windows 机器上工作。
+- **每个部件都可替换。** [沙箱](https://openagentcore.dev/zh/docs/sandbox-provider)、[Harness](https://openagentcore.dev/zh/contracts/agents-api/harness-onboarding) 和[模型供应商](https://openagentcore.dev/zh/contracts/agents-api/model-execution)都通过[既定协议](AGENTS.md#protocols-at-every-boundary)接入。
 
 ## 界面预览
 
@@ -53,20 +53,20 @@ curl -fsSL https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/
 1. 用安装器生成的 Core key **登录 Web**（管理控制台），并**配置域名和 HTTPS**。
 2. **设置默认模型**，并**签发 Project API key**。
 3. **添加执行资源**：节点、E2B，或你自己的机器。
-4. 用 OpenAI SDK **[运行第一个 Session](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/quickstart)**。
+4. 用 OpenAI SDK **[运行第一个 Session](https://openagentcore.dev/zh/docs/getting-started/quickstart)**。
 
-[安装指南](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/install)详细介绍每一步，以及 HTTPS 配置和本地快速试用。监听地址、端口等参数见[安装配置选项](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/install-options)。
+[安装指南](https://openagentcore.dev/zh/docs/getting-started/install)详细介绍每一步，以及 HTTPS 配置和本地快速试用。监听地址、端口等参数见[安装配置选项](https://openagentcore.dev/zh/docs/getting-started/install-options)。
 
 ## 文档
 
 | 我想要 | 从这里开始 |
 | --- | --- |
-| 安装并运维 | [安装指南](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/install)，然后看[运维](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/operations) |
-| 基于 API 开发应用 | [快速开始](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/quickstart)，然后看 [Agents API 指南](https://minimax-ai.github.io/OpenAgentCore/zh/docs/api/public-agent-api) |
-| 看一个完整的应用 | [示例](https://minimax-ai.github.io/OpenAgentCore/zh/docs/examples) |
-| 在自己的机器上运行 Agent | [自托管执行](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/self-hosted) |
-| 查看 Harness 能力和限制 | [Harness 能力](https://minimax-ai.github.io/OpenAgentCore/zh/contracts/agents-api/harness-capabilities) |
-| 了解设计 | [架构说明](https://minimax-ai.github.io/OpenAgentCore/zh/docs/architecture) |
-| 接入新的沙箱、Harness 或其他组件 | [开发指南](https://minimax-ai.github.io/OpenAgentCore/zh/docs/development) |
-
-全部文档见[文档目录](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/)。修改代码前请阅读[贡献规范](CONTRIBUTING.md)。
+| 安装并运维 | [安装指南](https://openagentcore.dev/zh/docs/getting-started/install)，然后看[运维](https://openagentcore.dev/zh/docs/getting-started/operations) |
+| 基于 API 开发应用 | [快速开始](https://openagentcore.dev/zh/docs/getting-started/quickstart)，然后看 [Agents API 指南](https://openagentcore.dev/zh/docs/api/public-agent-api) |
+| 看一个完整的应用 | [示例](https://openagentcore.dev/zh/docs/examples) |
+| 在自己的机器上运行 Agent | [自托管执行](https://openagentcore.dev/zh/docs/getting-started/self-hosted) |
+| 查看 Harness 能力和限制 | [Harness 能力](https://openagentcore.dev/zh/contracts/agents-api/harness-capabilities) |
+| 了解设计 | [架构说明](https://openagentcore.dev/zh/docs/architecture) |
+| 接入新的沙箱、Harness 或其他组件 | [开发指南](https://openagentcore.dev/zh/docs/development) |
+
+全部文档见[文档目录](https://openagentcore.dev/zh/docs/getting-started/)。修改代码前请阅读[贡献规范](CONTRIBUTING.md)。
diff --git a/apps/daemon/cmd/oac-daemon/main.go b/apps/daemon/cmd/oac-daemon/main.go
index b704d8cc3..7ed9bf050 100644
--- a/apps/daemon/cmd/oac-daemon/main.go
+++ b/apps/daemon/cmd/oac-daemon/main.go
@@ -1,5 +1,5 @@
-// Command oac-daemon is the reverse-WebSocket worker that pairs a user
-// machine with a OpenAgentCore server and exposes a local agent CLI
+// Command oac-daemon is the reverse-WebSocket worker that connects a
+// machine to an OpenAgentCore server and exposes a local agent CLI
 // subprocess as a connector_type=agent_daemon target. See
 // apps/daemon/README.md for the subcommand spec.
 package main
diff --git a/apps/daemon/internal/agent/claudesdk/cancellation_live_linux_test.go b/apps/daemon/internal/agent/claudesdk/cancellation_live_linux_test.go
index 2e042f292..86f7e0cf0 100644
--- a/apps/daemon/internal/agent/claudesdk/cancellation_live_linux_test.go
+++ b/apps/daemon/internal/agent/claudesdk/cancellation_live_linux_test.go
@@ -66,7 +66,7 @@ func TestLiveClaudeSDKCancelResume(t *testing.T) {
 		ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
 		defer cancel()
 		out := make(chan proto.Envelope, 64)
-		request := proto.PromptRequestPayload{RunID: uuid.NewString(), Input: proto.TextInput(prompt), AgentSessionID: resume, StrictResume: true, ReleaseOnCompletion: true, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, Model: "MiniMax-M3", ModelProvider: provider, SystemPrompt: "Follow the user's requested format. Preserve the exact verification value in conversation history. Use no tools."}
+		request := proto.PromptRequestPayload{RunID: uuid.NewString(), Input: proto.TextInput(prompt), AgentSessionID: resume, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, Model: "MiniMax-M3", ModelProvider: provider, SystemPrompt: "Follow the user's requested format. Preserve the exact verification value in conversation history. Use no tools."}
 		running, err := NewFactory(config)(ctx, request, out)
 		if err != nil {
 			t.Fatal(err)
diff --git a/apps/daemon/internal/agent/claudesdk/commands.go b/apps/daemon/internal/agent/claudesdk/commands.go
index 46dfa31b1..9bc4c266a 100644
--- a/apps/daemon/internal/agent/claudesdk/commands.go
+++ b/apps/daemon/internal/agent/claudesdk/commands.go
@@ -33,9 +33,7 @@ func (c *commandState) receive(event bridgeEvent, start startRequest, sessionID
 		return fmt.Errorf("claudesdk: inconsistent command observation")
 	}
 	c.calls[event.ID] = *n
-	if start.observeFunctions {
-		emit(proto.TypeToolCall, proto.ToolCallPayload{ID: event.ID, Name: "Bash", Stage: event.Stage, Observation: n})
-	}
+	emit(proto.TypeToolCall, proto.ToolCallPayload{ID: event.ID, Name: "Bash", Stage: event.Stage, Observation: n})
 	return nil
 }
 
@@ -48,15 +46,13 @@ func (c *commandState) complete() bool {
 	return true
 }
 
-func (c *commandState) close(start startRequest, emit func(string, any)) {
+func (c *commandState) close(emit func(string, any)) {
 	for id, call := range c.calls {
 		if call.Status != "in_progress" {
 			continue
 		}
 		call.Status = "incomplete"
 		c.calls[id] = call
-		if start.observeFunctions {
-			emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: "Bash", Stage: "after", Observation: &call})
-		}
+		emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: "Bash", Stage: "after", Observation: &call})
 	}
 }
diff --git a/apps/daemon/internal/agent/claudesdk/commands_session_test.go b/apps/daemon/internal/agent/claudesdk/commands_session_test.go
index 12becd34a..8ed414dc4 100644
--- a/apps/daemon/internal/agent/claudesdk/commands_session_test.go
+++ b/apps/daemon/internal/agent/claudesdk/commands_session_test.go
@@ -16,74 +16,56 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-func TestWorkspaceCommandsRequirePackagedFeatureOnlyWhenRequested(t *testing.T) {
-	for _, observed := range []bool{false, true} {
-		config := preparationFixture(t, "old-command-runtime")
-		req := preparationRequest()
-		req.ObserveToolObservations = observed
-		resource, err := NewExecutorFactory(config)(t.Context(), req)
-		if observed {
-			if err == nil || !strings.Contains(err.Error(), "workspace command observations") {
-				t.Fatal("old bridge accepted requested command observations", err)
-			}
-			if _, err := os.Stat(filepath.Join(config.StateDir, "launched")); !os.IsNotExist(err) {
-				t.Fatal("old bridge started execution before rejection")
-			}
-		} else {
-			if err != nil {
-				t.Fatal("old bridge changed opt-out behavior", err)
-			}
-			if err := resource.Close(t.Context()); err != nil {
-				t.Fatal(err)
-			}
-		}
+func TestWorkspaceCommandsRequirePackagedFeature(t *testing.T) {
+	config := preparationFixture(t, "old-command-runtime")
+	if _, err := NewExecutorFactory(config)(t.Context(), preparationRequest()); err == nil || !strings.Contains(err.Error(), "workspace preparation is unavailable") {
+		t.Fatal("old bridge accepted command observations", err)
+	}
+	if _, err := os.Stat(filepath.Join(config.StateDir, "launched")); !os.IsNotExist(err) {
+		t.Fatal("old bridge started execution before rejection")
 	}
 }
 
 func TestWorkspaceCommandFramesKeepStartIdentityAndObservedOutput(t *testing.T) {
-	for _, observed := range []bool{false, true} {
-		config := preparationFixture(t, "commands-success")
-		req := preparationRequest()
-		req.ObserveToolObservations = observed
-		resource, err := NewExecutorFactory(config)(t.Context(), req)
-		if err != nil {
-			t.Fatal(err)
-		}
-		defer resource.Close(context.Background())
-		if _, err := os.Stat(filepath.Join(config.StateDir, "start.json")); !os.IsNotExist(err) {
-			t.Fatal("preparation submitted a command")
-		}
-		out := make(chan proto.Envelope, 16)
-		s, err := resource.StartTurn(t.Context(), "actual-command-run", proto.TextInput("hello"), out)
-		if err != nil {
-			t.Fatal(err)
+	config := preparationFixture(t, "commands-success")
+	resource, err := NewExecutorFactory(config)(t.Context(), preparationRequest())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resource.Close(context.Background())
+	if _, err := os.Stat(filepath.Join(config.StateDir, "start.json")); !os.IsNotExist(err) {
+		t.Fatal("preparation submitted a command")
+	}
+	out := make(chan proto.Envelope, 16)
+	s, err := resource.StartTurn(t.Context(), "actual-command-run", proto.TextInput("hello"), out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s.Cancel(context.Background())
+	var frames []proto.ToolCallPayload
+	done := 0
+	for event := range out {
+		if event.ID != "actual-command-run" || event.Type == proto.TypeError || event.Type == proto.TypeCommandOutput {
+			t.Fatal("execution identity or final-only command behavior changed", event.Type)
 		}
-		defer s.Cancel(context.Background())
-		var frames []proto.ToolCallPayload
-		done := 0
-		for event := range out {
-			if event.ID != "actual-command-run" || event.Type == proto.TypeError || event.Type == proto.TypeCommandOutput {
-				t.Fatal("execution identity or final-only command behavior changed", event.Type)
-			}
-			if event.Type == proto.TypeToolCall {
-				var payload proto.ToolCallPayload
-				if err := event.DecodePayload(&payload); err != nil {
-					t.Fatal(err)
-				}
-				frames = append(frames, payload)
-			}
-			if event.Type == proto.TypeDone {
-				done++
+		if event.Type == proto.TypeToolCall {
+			var payload proto.ToolCallPayload
+			if err := event.DecodePayload(&payload); err != nil {
+				t.Fatal(err)
 			}
+			frames = append(frames, payload)
 		}
-		if done != 1 || observed && len(frames) != 2 || !observed && len(frames) != 0 {
-			t.Fatal("completion or observation opt-in changed", done, frames)
-		}
-		if observed && (frames[0].ID != "observed" || frames[1].ID != "observed" || frames[1].Observation.Status != "failed" ||
-			string(frames[1].Observation.Output) != `"Exit code 7\nretained"`) {
-			t.Fatal("native failure output was not retained", frames)
+		if event.Type == proto.TypeDone {
+			done++
 		}
 	}
+	if done != 1 || len(frames) != 2 {
+		t.Fatal("completion or observation changed", done, frames)
+	}
+	if frames[0].ID != "observed" || frames[1].ID != "observed" || frames[1].Observation.Status != "failed" ||
+		string(frames[1].Observation.Output) != `"Exit code 7\nretained"` {
+		t.Fatal("native failure output was not retained", frames)
+	}
 }
 
 func TestWorkspaceCommandCancellationAndBridgeFailuresCloseOnlyPendingCalls(t *testing.T) {
@@ -93,7 +75,7 @@ func TestWorkspaceCommandCancellationAndBridgeFailuresCloseOnlyPendingCalls(t *t
 			defer cancel()
 			config := preparationFixture(t, mode)
 			req := workspaceRequest()
-			req.AgentSessionID, req.ObserveToolObservations = "native-session", true
+			req.AgentSessionID = "native-session"
 			out := make(chan proto.Envelope, 32)
 			s, err := NewFactory(config)(ctx, req, out)
 			if err != nil {
diff --git a/apps/daemon/internal/agent/claudesdk/commands_test.go b/apps/daemon/internal/agent/claudesdk/commands_test.go
index 33b923c7f..f98129c51 100644
--- a/apps/daemon/internal/agent/claudesdk/commands_test.go
+++ b/apps/daemon/internal/agent/claudesdk/commands_test.go
@@ -13,53 +13,45 @@ func commandEvent(id, stage, status, command string) bridgeEvent {
 		Observation: &proto.ToolObservation{Kind: "command", Status: status, Command: command}}
 }
 
-func TestCommandObservationLifecycleAndOptIn(t *testing.T) {
-	for _, observed := range []bool{false, true} {
-		state := commandState{calls: map[string]proto.ToolObservation{}}
-		start := startRequest{Workspace: &workspaceProfile{}, observeFunctions: observed}
-		var events []proto.ToolCallPayload
-		emit := func(kind string, payload any) {
-			if kind != proto.TypeToolCall {
-				t.Fatal(kind)
-			}
-			events = append(events, payload.(proto.ToolCallPayload))
-		}
-		const command = "  printf 'failure\\n'; exit 7  "
-		before := commandEvent("native-call", "before", "in_progress", command)
-		if err := state.receive(before, start, "native-session", emit); err != nil || state.complete() {
-			t.Fatal("call was not pending", err)
-		}
-		if err := state.receive(before, start, "native-session", emit); err == nil {
-			t.Fatal("duplicate bridge call accepted")
-		}
-		after := commandEvent("native-call", "after", "failed", command)
-		after.Observation.Output = json.RawMessage(`"Exit code 7\nfailure"`)
-		if err := state.receive(after, start, "native-session", emit); err != nil || !state.complete() {
-			t.Fatal("native result did not complete the call", err)
-		}
-		if err := state.receive(after, start, "native-session", emit); err == nil {
-			t.Fatal("duplicate bridge result accepted")
-		}
-		if err := state.receive(commandEvent("pending", "before", "in_progress", "sleep 30"), start, "native-session", emit); err != nil {
-			t.Fatal(err)
-		}
-		state.close(start, emit)
-		state.close(start, emit)
-		if !state.complete() || state.calls["pending"].Status != "incomplete" || state.calls["native-call"].Status != "failed" {
-			t.Fatal("closure changed an observed result or lost an unfinished call")
-		}
-		if !observed {
-			if len(events) != 0 {
-				t.Fatal("opt-out emitted observations")
-			}
-			continue
-		}
-		if len(events) != 4 || events[0].ID != "native-call" || events[0].Name != "Bash" || events[0].Observation.Command != command ||
-			string(events[1].Observation.Output) != `"Exit code 7\nfailure"` || events[1].Observation.ExitCode != nil ||
-			events[1].Observation.Cwd != nil || events[1].Observation.DurationMS != nil || events[3].ID != "pending" ||
-			events[3].Observation.Status != "incomplete" || len(events[3].Observation.Output) != 0 {
-			t.Fatal("observation identity, output or unknown metadata changed", events)
+func TestCommandObservationLifecycle(t *testing.T) {
+	state := commandState{calls: map[string]proto.ToolObservation{}}
+	start := startRequest{Workspace: &workspaceProfile{}}
+	var events []proto.ToolCallPayload
+	emit := func(kind string, payload any) {
+		if kind != proto.TypeToolCall {
+			t.Fatal(kind)
 		}
+		events = append(events, payload.(proto.ToolCallPayload))
+	}
+	const command = "  printf 'failure\\n'; exit 7  "
+	before := commandEvent("native-call", "before", "in_progress", command)
+	if err := state.receive(before, start, "native-session", emit); err != nil || state.complete() {
+		t.Fatal("call was not pending", err)
+	}
+	if err := state.receive(before, start, "native-session", emit); err == nil {
+		t.Fatal("duplicate bridge call accepted")
+	}
+	after := commandEvent("native-call", "after", "failed", command)
+	after.Observation.Output = json.RawMessage(`"Exit code 7\nfailure"`)
+	if err := state.receive(after, start, "native-session", emit); err != nil || !state.complete() {
+		t.Fatal("native result did not complete the call", err)
+	}
+	if err := state.receive(after, start, "native-session", emit); err == nil {
+		t.Fatal("duplicate bridge result accepted")
+	}
+	if err := state.receive(commandEvent("pending", "before", "in_progress", "sleep 30"), start, "native-session", emit); err != nil {
+		t.Fatal(err)
+	}
+	state.close(emit)
+	state.close(emit)
+	if !state.complete() || state.calls["pending"].Status != "incomplete" || state.calls["native-call"].Status != "failed" {
+		t.Fatal("closure changed an observed result or lost an unfinished call")
+	}
+	if len(events) != 4 || events[0].ID != "native-call" || events[0].Name != "Bash" || events[0].Observation.Command != command ||
+		string(events[1].Observation.Output) != `"Exit code 7\nfailure"` || events[1].Observation.ExitCode != nil ||
+		events[1].Observation.Cwd != nil || events[1].Observation.DurationMS != nil || events[3].ID != "pending" ||
+		events[3].Observation.Status != "incomplete" || len(events[3].Observation.Output) != 0 {
+		t.Fatal("observation identity, output or unknown metadata changed", events)
 	}
 }
 
@@ -67,7 +59,7 @@ func TestCommandObservationsRejectUnqualifiedOrInconsistentEvents(t *testing.T)
 	for _, mode := range []string{"profile", "uninitialized", "session", "id", "nil", "kind", "empty-command", "name", "cwd", "exit", "duration", "arguments", "error", "output-object", "before-output", "before-status", "after-before", "changed-command", "after-status", "stage"} {
 		t.Run(mode, func(t *testing.T) {
 			state := commandState{calls: map[string]proto.ToolObservation{}}
-			start := startRequest{Workspace: &workspaceProfile{}, observeFunctions: true}
+			start := startRequest{Workspace: &workspaceProfile{}}
 			sessionID := "native-session"
 			event := commandEvent("call", "before", "in_progress", "pwd")
 			if strings.HasPrefix(mode, "after-") || mode == "changed-command" {
@@ -130,7 +122,7 @@ func TestCommandObservationUnknownAndEmptyOutputRemainDistinct(t *testing.T) {
 	for _, output := range []json.RawMessage{nil, json.RawMessage(`null`), json.RawMessage(`""`)} {
 		state := commandState{calls: map[string]proto.ToolObservation{}}
 		start := startRequest{Workspace: &workspaceProfile{}}
-		emit := func(string, any) { t.Fatal("opt-out emitted an observation") }
+		emit := func(string, any) {}
 		if err := state.receive(commandEvent("call", "before", "in_progress", "pwd"), start, "native-session", emit); err != nil {
 			t.Fatal(err)
 		}
diff --git a/apps/daemon/internal/agent/claudesdk/executor.go b/apps/daemon/internal/agent/claudesdk/executor.go
index 7ade50fba..664579186 100644
--- a/apps/daemon/internal/agent/claudesdk/executor.go
+++ b/apps/daemon/internal/agent/claudesdk/executor.go
@@ -48,7 +48,7 @@ func NewExecutorFactory(config Config) agent.ExecutorFactory {
 }
 
 func preparationOnly(req proto.PromptRequestPayload) error {
-	if req.RunID != "" || len(req.Input) != 0 || req.ConversationID != "" {
+	if req.RunID != "" || len(req.Input) != 0 {
 		return errors.New("claudesdk: Executor preparation cannot submit input")
 	}
 	return nil
@@ -104,9 +104,6 @@ func validateExecutorFeatures(info RuntimeInfo, start startRequest) error {
 	if start.Subagents != nil && !info.SupportsSubagents() {
 		return errors.New("claudesdk: subagent resources are unavailable")
 	}
-	if start.Workspace != nil && start.observeFunctions && !info.supportsWorkspaceCommands() {
-		return errors.New("claudesdk: packaged runtime does not support workspace command observations")
-	}
 	if start.Workspace != nil && len(start.Functions) > 0 && !info.SupportsWorkspaceFunctions() {
 		return errors.New("claudesdk: workspace functions are unavailable")
 	}
diff --git a/apps/daemon/internal/agent/claudesdk/executor_confirmation_test.go b/apps/daemon/internal/agent/claudesdk/executor_confirmation_test.go
index f4cb246bd..bba0b7099 100644
--- a/apps/daemon/internal/agent/claudesdk/executor_confirmation_test.go
+++ b/apps/daemon/internal/agent/claudesdk/executor_confirmation_test.go
@@ -27,6 +27,9 @@ func TestExecutorNativeConfirmationSurvivesCleanup(t *testing.T) {
 				t.Fatal("initial output missing")
 			}
 			if mode == "pending_function" || mode == "pending_function_unconfirmed" {
+				if event := <-out; event.Type != proto.TypeToolCall {
+					t.Fatal("function observation missing")
+				}
 				if event := <-out; event.Type != proto.TypeFunctionCall {
 					t.Fatal("function obligation missing")
 				}
diff --git a/apps/daemon/internal/agent/claudesdk/executor_live_linux_test.go b/apps/daemon/internal/agent/claudesdk/executor_live_linux_test.go
index 63ca1e998..175618428 100644
--- a/apps/daemon/internal/agent/claudesdk/executor_live_linux_test.go
+++ b/apps/daemon/internal/agent/claudesdk/executor_live_linux_test.go
@@ -82,7 +82,7 @@ func TestLiveClaudeExecutorReuseAndCancel(t *testing.T) {
 		_ = os.WriteFile(filepath.Join(proof, "executor-evidence.json"), raw, 0600)
 	}
 	defer persist()
-	request := proto.PromptRequestPayload{StrictResume: true, DisableExecutionEnvironment: true, DisableSubagents: true, ObserveMessages: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, Model: model, ModelProvider: provider, SystemPrompt: "Follow requested formats briefly. Remember the exact verification marker across the conversation. Use no tools."}
+	request := proto.PromptRequestPayload{DisableExecutionEnvironment: true, DisableSubagents: true, ObserveMessages: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, Model: model, ModelProvider: provider, SystemPrompt: "Follow requested formats briefly. Remember the exact verification marker across the conversation. Use no tools."}
 	factory := NewExecutorFactory(config)
 	prepared := time.Now()
 	owner, err := factory(ctx, request)
diff --git a/apps/daemon/internal/agent/claudesdk/executor_turn.go b/apps/daemon/internal/agent/claudesdk/executor_turn.go
index d1b9ce48c..97c6638cf 100644
--- a/apps/daemon/internal/agent/claudesdk/executor_turn.go
+++ b/apps/daemon/internal/agent/claudesdk/executor_turn.go
@@ -197,8 +197,8 @@ func (s *session) runTurn(start startRequest, out chan<- proto.Envelope) {
 	if !s.functionsComplete(cancelled && settlementConfirmed) || !s.steeringComplete() || !mcp.complete() || !commands.complete() {
 		settlementConfirmed, reusable, reason = false, false, "unsettled_native_operations"
 	}
-	mcp.close(start, emit)
-	commands.close(start, emit)
+	mcp.close(emit)
+	commands.close(emit)
 	s.stopSteering()
 	metadata := map[string]any{proto.DoneMetaAgentSessionType: "claude_session"}
 	if id := s.inputSessionID(); id != "" {
diff --git a/apps/daemon/internal/agent/claudesdk/functions.go b/apps/daemon/internal/agent/claudesdk/functions.go
index 80048c70b..752d1347f 100644
--- a/apps/daemon/internal/agent/claudesdk/functions.go
+++ b/apps/daemon/internal/agent/claudesdk/functions.go
@@ -84,13 +84,11 @@ func (s *session) receiveFunction(event bridgeEvent, start startRequest, emit fu
 	if err != nil {
 		return err
 	}
-	if start.observeFunctions {
-		id, stage := event.CallID, "after"
-		if call != nil {
-			id, stage = call.CallID, "before"
-		}
-		emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: observation.Name, Stage: stage, Observation: observation})
+	id, stage := event.CallID, "after"
+	if call != nil {
+		id, stage = call.CallID, "before"
 	}
+	emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: observation.Name, Stage: stage, Observation: observation})
 	if call != nil {
 		emit(proto.TypeFunctionCall, call)
 	} else {
diff --git a/apps/daemon/internal/agent/claudesdk/functions_test.go b/apps/daemon/internal/agent/claudesdk/functions_test.go
index 4e44dcc08..b1fe6f442 100644
--- a/apps/daemon/internal/agent/claudesdk/functions_test.go
+++ b/apps/daemon/internal/agent/claudesdk/functions_test.go
@@ -22,7 +22,7 @@ func TestFunctionFactoryNativeReceipts(t *testing.T) {
 			root := t.TempDir()
 			t.Setenv("OAC_RUNTIME_HOME", root)
 			config := Config{Node: os.Args[0], Entrypoint: filepath.Join(root, "worker"), StateDir: filepath.Join(root, "state"), Env: []string{"GO_CLAUDE_SDK_HELPER=1", "SDK_HELPER_MODE=" + mode, "GORACE=atexit_sleep_ms=0"}}
-			request := proto.PromptRequestPayload{ModelProvider: fixtureProvider(), RunID: "run", Input: proto.TextInput("hello"), AgentSessionID: "native-session", ObserveToolObservations: true, Model: "fake-model", SystemPrompt: "instructions", FunctionTools: []proto.FunctionTool{{Name: "lookup", Description: "Lookup.", Parameters: json.RawMessage(`{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}}}}`)}}}
+			request := proto.PromptRequestPayload{ModelProvider: fixtureProvider(), RunID: "run", Input: proto.TextInput("hello"), AgentSessionID: "native-session", Model: "fake-model", SystemPrompt: "instructions", FunctionTools: []proto.FunctionTool{{Name: "lookup", Description: "Lookup.", Parameters: json.RawMessage(`{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}}}}`)}}}
 			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 			defer cancel()
 			out := make(chan proto.Envelope, 16)
diff --git a/apps/daemon/internal/agent/claudesdk/live_linux_test.go b/apps/daemon/internal/agent/claudesdk/live_linux_test.go
index d14865c0e..bda17a491 100644
--- a/apps/daemon/internal/agent/claudesdk/live_linux_test.go
+++ b/apps/daemon/internal/agent/claudesdk/live_linux_test.go
@@ -138,9 +138,8 @@ func TestLiveClaudeSDKTextResume(t *testing.T) {
 		requestStart := len(requests)
 		mu.Unlock()
 		out := make(chan proto.Envelope, 64)
-		request := proto.PromptRequestPayload{RunID: uuid.NewString(), Input: proto.TextInput(prompt), AgentSessionID: resume, StrictResume: true, ReleaseOnCompletion: true, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, Model: "MiniMax-M3", ModelProvider: provider, SystemPrompt: "Answer briefly and preserve the exact verification value in the conversation. Use no tools."}
+		request := proto.PromptRequestPayload{RunID: uuid.NewString(), Input: proto.TextInput(prompt), AgentSessionID: resume, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, Model: "MiniMax-M3", ModelProvider: provider, SystemPrompt: "Answer briefly and preserve the exact verification value in the conversation. Use no tools."}
 		if success != nil {
-			request.ObserveToolObservations = true
 			request.SystemPrompt = "Call lookup exactly once as requested, then report both result parts and any prior verification value. Never retry a failed tool."
 			request.FunctionTools = []proto.FunctionTool{{Name: "lookup", Description: "Return a synthetic verification value.", Parameters: json.RawMessage(`{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}`)}}
 		}
diff --git a/apps/daemon/internal/agent/claudesdk/mcp.go b/apps/daemon/internal/agent/claudesdk/mcp.go
index a74da05d7..b193136d7 100644
--- a/apps/daemon/internal/agent/claudesdk/mcp.go
+++ b/apps/daemon/internal/agent/claudesdk/mcp.go
@@ -109,9 +109,7 @@ func (m *mcpState) receive(event bridgeEvent, start startRequest, emit func(stri
 		return fmt.Errorf("claudesdk: inconsistent MCP observation")
 	}
 	m.calls[event.ID] = *n
-	if start.observeFunctions {
-		emit(proto.TypeToolCall, proto.ToolCallPayload{ID: event.ID, Name: n.Name, Stage: event.Stage, Observation: n})
-	}
+	emit(proto.TypeToolCall, proto.ToolCallPayload{ID: event.ID, Name: n.Name, Stage: event.Stage, Observation: n})
 	return nil
 }
 
@@ -124,15 +122,13 @@ func (m *mcpState) complete() bool {
 	return true
 }
 
-func (m *mcpState) close(start startRequest, emit func(string, any)) {
+func (m *mcpState) close(emit func(string, any)) {
 	for id, call := range m.calls {
 		if call.Status != "in_progress" {
 			continue
 		}
 		call.Status = "incomplete"
 		m.calls[id] = call
-		if start.observeFunctions {
-			emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: call.Name, Stage: "after", Observation: &call})
-		}
+		emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: call.Name, Stage: "after", Observation: &call})
 	}
 }
diff --git a/apps/daemon/internal/agent/claudesdk/mcp_environment.go b/apps/daemon/internal/agent/claudesdk/mcp_environment.go
index 5c9e1db31..73720fe3c 100644
--- a/apps/daemon/internal/agent/claudesdk/mcp_environment.go
+++ b/apps/daemon/internal/agent/claudesdk/mcp_environment.go
@@ -21,6 +21,13 @@ func prepareRuntimeMCP(req proto.PromptRequestPayload) ([]environmentMCPServer,
 	if err != nil {
 		return nil, nil, err
 	}
+	return mcpServers(bindings, localworkspace.MCPStdioCommand)
+}
+
+// mcpServers renders resolved bindings, each stdio binding with the command
+// and arguments stdio gives it and each credential in a private environment
+// variable.
+func mcpServers(bindings []agent.MCPBinding, stdio func(proto.EnvironmentMCP) (string, []string)) ([]environmentMCPServer, []string, error) {
 	var servers []environmentMCPServer
 	var env []string
 	for _, binding := range bindings {
@@ -28,7 +35,7 @@ func prepareRuntimeMCP(req proto.PromptRequestPayload) ([]environmentMCPServer,
 			return nil, nil, fmt.Errorf("claudesdk: unsupported MCP identity")
 		}
 		if binding.Stdio != nil {
-			command, args := localworkspace.MCPStdioCommand(*binding.Stdio)
+			command, args := stdio(*binding.Stdio)
 			servers = append(servers, environmentMCPServer{mcpHTTPServer: mcpHTTPServer{ServerLabel: binding.ServerLabel}, Command: command, Args: args})
 			continue
 		}
diff --git a/apps/daemon/internal/agent/claudesdk/mcp_environment_test.go b/apps/daemon/internal/agent/claudesdk/mcp_environment_test.go
index 328674950..ab84b3b9e 100644
--- a/apps/daemon/internal/agent/claudesdk/mcp_environment_test.go
+++ b/apps/daemon/internal/agent/claudesdk/mcp_environment_test.go
@@ -73,7 +73,7 @@ func TestEnvironmentMCPRejectsUnqualifiedCombinations(t *testing.T) {
 }
 
 func TestEnvironmentMCPObservationsUseInstalledDeclarations(t *testing.T) {
-	start := startRequest{Workspace: &workspaceProfile{MCP: []environmentMCPServer{{mcpHTTPServer: mcpHTTPServer{ServerLabel: "installed"}}}}, observeFunctions: true}
+	start := startRequest{Workspace: &workspaceProfile{MCP: []environmentMCPServer{{mcpHTTPServer: mcpHTTPServer{ServerLabel: "installed"}}}}}
 	state := mcpState{calls: map[string]proto.ToolObservation{}}
 	observation := proto.ToolObservation{Kind: "mcp", Name: "echo", Server: "installed", Status: "in_progress", Arguments: json.RawMessage(`{}`), Output: json.RawMessage(`null`), Error: json.RawMessage(`null`)}
 	var emitted []proto.ToolCallPayload
@@ -81,7 +81,7 @@ func TestEnvironmentMCPObservationsUseInstalledDeclarations(t *testing.T) {
 	if err := state.receive(bridgeEvent{ID: "native-call", Stage: "before", Observation: &observation}, start, emit); err != nil {
 		t.Fatal(err)
 	}
-	state.close(start, emit)
+	state.close(emit)
 	if len(emitted) != 2 || emitted[1].ID != "native-call" || emitted[1].Observation.Status != "incomplete" {
 		t.Fatal("interrupted environment call lost identity")
 	}
diff --git a/apps/daemon/internal/agent/claudesdk/mcp_test.go b/apps/daemon/internal/agent/claudesdk/mcp_test.go
index f2d259979..1bbc8af5f 100644
--- a/apps/daemon/internal/agent/claudesdk/mcp_test.go
+++ b/apps/daemon/internal/agent/claudesdk/mcp_test.go
@@ -72,7 +72,7 @@ func TestHTTPMCPDeclaration(t *testing.T) {
 }
 
 func TestMCPObservationLifecycle(t *testing.T) {
-	start := startRequest{MCPHTTPServers: &[]mcpHTTPServer{{ServerLabel: "fixture"}}, observeFunctions: true}
+	start := startRequest{MCPHTTPServers: &[]mcpHTTPServer{{ServerLabel: "fixture"}}}
 	state := mcpState{calls: map[string]proto.ToolObservation{}}
 	var observations []proto.ToolCallPayload
 	emit := func(kind string, payload any) {
@@ -107,7 +107,7 @@ func TestMCPObservationLifecycle(t *testing.T) {
 	if err := state.receive(before, start, emit); err != nil {
 		t.Fatal(err)
 	}
-	state.close(start, emit)
+	state.close(emit)
 	if !state.complete() || observations[len(observations)-1].Observation.Status != "incomplete" {
 		t.Fatal("cancellation lost pending call")
 	}
diff --git a/apps/daemon/internal/agent/claudesdk/options.go b/apps/daemon/internal/agent/claudesdk/options.go
index d8532b944..d7e61beaa 100644
--- a/apps/daemon/internal/agent/claudesdk/options.go
+++ b/apps/daemon/internal/agent/claudesdk/options.go
@@ -39,7 +39,6 @@ type startRequest struct {
 	MCPHTTPServers     *[]mcpHTTPServer     `json:"mcp_http_servers,omitempty"`
 	Workspace          *workspaceProfile    `json:"workspace,omitempty"`
 	RequireHistory     bool                 `json:"require_history,omitempty"`
-	observeFunctions   bool
 }
 
 func prepare(config Config, req proto.PromptRequestPayload) (startRequest, []string, error) {
@@ -111,7 +110,7 @@ func prepareConfiguration(config Config, req proto.PromptRequestPayload) (startR
 // an agent-host view takes from its Session rather than the request.
 func prepareOptions(req proto.PromptRequestPayload, mcp bool) (startRequest, []string, error) {
 	skills := req.LocalEnvironment != nil && len(req.LocalEnvironment.Skills) != 0
-	start := startRequest{Type: "start", Resume: req.AgentSessionID, RequireHistory: req.RequireExistingNativeSession, ObserveMessages: req.ObserveMessages, Functions: req.FunctionTools, observeFunctions: req.ObserveToolObservations}
+	start := startRequest{Type: "start", Resume: req.AgentSessionID, RequireHistory: req.RequireExistingNativeSession, ObserveMessages: req.ObserveMessages, Functions: req.FunctionTools}
 	fail := func(reason string) (startRequest, []string, error) {
 		return startRequest{}, nil, fmt.Errorf("claudesdk: %s", reason)
 	}
diff --git a/apps/daemon/internal/agent/claudesdk/preparation_test.go b/apps/daemon/internal/agent/claudesdk/preparation_test.go
index 6a3086c68..e11848dcd 100644
--- a/apps/daemon/internal/agent/claudesdk/preparation_test.go
+++ b/apps/daemon/internal/agent/claudesdk/preparation_test.go
@@ -97,7 +97,7 @@ func TestPreparationWaitsForReceiptAndRetainsConfiguration(t *testing.T) {
 }
 
 func TestPreparationRejectsInputAndUnavailableProfilesBeforeLaunch(t *testing.T) {
-	for _, name := range []string{"run", "prompt", "conversation", "attachments", "subagents", "none", "functions", "mcp", "controls", "old-runtime"} {
+	for _, name := range []string{"run", "prompt", "attachments", "subagents", "none", "functions", "mcp", "controls", "old-runtime"} {
 		t.Run(name, func(t *testing.T) {
 			config := preparationFixture(t, name)
 			req := preparationRequest()
@@ -106,8 +106,6 @@ func TestPreparationRejectsInputAndUnavailableProfilesBeforeLaunch(t *testing.T)
 				req.RunID = "unexpected"
 			case "prompt":
 				req.Input = proto.TextInput("unexpected")
-			case "conversation":
-				req.ConversationID = "product"
 			case "attachments":
 				req.Input = proto.MessageInput{{Content: []proto.InputContent{{Type: "input_image"}}}}
 			case "subagents":
diff --git a/apps/daemon/internal/agent/claudesdk/readiness.go b/apps/daemon/internal/agent/claudesdk/readiness.go
index ab520bf04..33e24a426 100644
--- a/apps/daemon/internal/agent/claudesdk/readiness.go
+++ b/apps/daemon/internal/agent/claudesdk/readiness.go
@@ -75,16 +75,14 @@ func (info RuntimeInfo) supportsWorkspace() bool {
 	return slices.Contains(info.Features, "workspace_tools")
 }
 
+// Workspace execution always emits neutral command observations, so a bridge
+// without them cannot run a prepared workspace.
 func (info RuntimeInfo) supportsWorkspacePreparation() bool {
-	return info.supportsWorkspace() && slices.Contains(info.Features, "workspace_prepare")
-}
-
-func (info RuntimeInfo) supportsWorkspaceCommands() bool {
-	return info.supportsWorkspacePreparation() && slices.Contains(info.Features, "workspace_command_observations")
+	return info.supportsWorkspace() && slices.Contains(info.Features, "workspace_prepare") && slices.Contains(info.Features, "workspace_command_observations")
 }
 
 func (info RuntimeInfo) SupportsLocalRuntime() bool {
-	return info.supportsWorkspaceCommands() && slices.Contains(info.Features, "local_runtime_v2")
+	return info.supportsWorkspacePreparation() && slices.Contains(info.Features, "local_runtime_v2")
 }
 
 func (info RuntimeInfo) SupportsWorkspaceFunctions() bool {
@@ -116,10 +114,10 @@ func CheckRuntime(ctx context.Context, config Config) (RuntimeInfo, error) {
 	}
 	process, err := clirunner.Start(clirunner.StartOptions{
 		Parent: ctx, Binary: binary,
-		Args:            []string{filepath.Join(filepath.Dir(config.Entrypoint), "runtime_check.js"), config.Entrypoint},
-		Dir:             filepath.Dir(config.Entrypoint),
-		Env:             env,
-		OwnProcessGroup: true, KillTimeout: 250 * time.Millisecond,
+		Args:        []string{filepath.Join(filepath.Dir(config.Entrypoint), "runtime_check.js"), config.Entrypoint},
+		Dir:         filepath.Dir(config.Entrypoint),
+		Env:         env,
+		KillTimeout: 250 * time.Millisecond,
 	})
 	if err != nil {
 		return RuntimeInfo{}, fmt.Errorf("claudesdk: cannot start runtime check: %w", err)
diff --git a/apps/daemon/internal/agent/claudesdk/session.go b/apps/daemon/internal/agent/claudesdk/session.go
index 78003305a..0d8610264 100644
--- a/apps/daemon/internal/agent/claudesdk/session.go
+++ b/apps/daemon/internal/agent/claudesdk/session.go
@@ -37,7 +37,7 @@ func NewFactory(config Config) agent.Factory {
 	prepareExecutor := NewExecutorFactory(config)
 	return func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
 		run, input := req.RunID, req.Input
-		req.RunID, req.ConversationID, req.Input = "", "", nil
+		req.RunID, req.Input = "", nil
 		resource, err := prepareExecutor(ctx, req)
 		if err != nil {
 			return nil, err
@@ -86,7 +86,7 @@ func launch(ctx context.Context, config Config, start startRequest, env []string
 	if binary == "" {
 		binary = "node"
 	}
-	return startSession(clirunner.Start, clirunner.StartOptions{Parent: ctx, Binary: binary, Args: []string{config.Entrypoint}, Dir: start.Cwd, Env: env, NeedStdin: true, OwnProcessGroup: true})
+	return startSession(clirunner.Start, clirunner.StartOptions{Parent: ctx, Binary: binary, Args: []string{config.Entrypoint}, Dir: start.Cwd, Env: env, NeedStdin: true})
 }
 
 // startSession runs the bridge through start: clirunner.Start, or an agent-host
diff --git a/apps/daemon/internal/agent/claudesdk/view.go b/apps/daemon/internal/agent/claudesdk/view.go
index d9ca20e6e..8f0146c78 100644
--- a/apps/daemon/internal/agent/claudesdk/view.go
+++ b/apps/daemon/internal/agent/claudesdk/view.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io/fs"
 	"os"
+	"path"
 	"path/filepath"
 	"slices"
 	"strings"
@@ -83,12 +84,12 @@ func declareView(probe Config, info RuntimeInfo, node, root, bridge string, load
 		ForwardEnv: []string{"CLAUDECODE", "GIT_EDITOR"},
 		Proxy:      agent.ViewProxyEnv,
 		Capabilities: agent.ViewCapabilities{
-			EnvironmentNone:      proto.CapabilityUnsupported,
+			EnvironmentNone:      proto.CapabilitySupported,
 			Skills:               proto.CapabilityUnsupported,
 			FunctionTools:        proto.CapabilityFromBool(info.SupportsWorkspaceFunctions()),
 			FunctionResultImages: proto.CapabilityFromBool(info.SupportsFunctionResultImages()),
 			ToolSearch:           proto.CapabilityFromBool(info.SupportsWorkspaceToolSearch()),
-			StdioMCP:             proto.CapabilityUnsupported,
+			StdioMCP:             proto.CapabilitySupported,
 		},
 	}
 	loader.AddTo(view)
@@ -110,20 +111,23 @@ func newViewExecutorFactory(probe Config, layout viewLayout) agent.ViewExecutorF
 			return nil, err
 		}
 		return startExecutor(ctx, checked, probe, start, func() (*session, error) {
-			return startSession(view.Launch, clirunner.StartOptions{Parent: ctx, Binary: layout.node, Args: []string{layout.bridge}, Dir: start.Cwd, Env: env, NeedStdin: true, OwnProcessGroup: true})
+			return startSession(view.Launch, clirunner.StartOptions{Parent: ctx, Binary: layout.node, Args: []string{layout.bridge}, Dir: start.Cwd, Env: env, NeedStdin: true})
 		})
 	}
 }
 
-// prepareView builds the workspace profile for one Session from the request
-// and the view: the workspace is the sandbox's, MCP comes only from the view,
+// prepareView builds the start request for one Session from the request and
+// the view: the workspace profile in the sandbox's workspace, or no workspace
+// in the work directory with environment none. MCP comes only from the view,
 // and the environment is closed.
 func prepareView(layout viewLayout, req proto.PromptRequestPayload, view agent.ViewSession) (startRequest, []string, error) {
 	environment := req.LocalEnvironment
-	if environment == nil || !workspacePathSyntax(environment.WorkspaceRoot) || req.DisableExecutionEnvironment || view.Launch == nil || view.Proxy == "" {
-		return startRequest{}, nil, errors.New("claudesdk: a view Executor requires the sandbox workspace, Launch and the gateway proxy")
+	if (environment == nil) != req.DisableExecutionEnvironment || environment != nil && !workspacePathSyntax(environment.WorkspaceRoot) || view.Launch == nil || view.Proxy == "" {
+		return startRequest{}, nil, errors.New("claudesdk: a view Executor requires the sandbox workspace or environment none, Launch and the gateway proxy")
 	}
-	servers, err := viewMCP(view.MCP)
+	// The gateway adds each credential and header, and the Harness runs each
+	// stdio alias without arguments.
+	servers, _, err := mcpServers(view.MCP, func(stdio proto.EnvironmentMCP) (string, []string) { return stdio.Server.Command, nil })
 	if err != nil {
 		return startRequest{}, nil, err
 	}
@@ -134,33 +138,24 @@ func prepareView(layout viewLayout, req proto.PromptRequestPayload, view agent.V
 	if err := viewHome(view.Home); err != nil {
 		return startRequest{}, nil, err
 	}
-	profile, env := viewEnvironment(layout, view.Home.View, view.Proxy, provider)
+	profile, env := viewEnvironment(layout, view.Home.View, view.Proxy, provider, environment != nil)
+	if environment == nil {
+		// Environment none has no Environment MCP, so each server is HTTP.
+		start.Cwd = path.Join(view.Home.View, agent.ViewWorkName)
+		if len(servers) != 0 {
+			http := make([]mcpHTTPServer, 0, len(servers))
+			for _, server := range servers {
+				http = append(http, server.mcpHTTPServer)
+			}
+			start.MCPHTTPServers = &http
+		}
+		return start, env, nil
+	}
 	profile.NetworkAccess, profile.MCP = environment.NetworkAccess, servers
 	start.Workspace, start.Cwd = profile, environment.WorkspaceRoot
 	return start, env, nil
 }
 
-// viewMCP renders the gateway's HTTP endpoints. The gateway adds each
-// credential and header, so none is rendered here.
-func viewMCP(bindings []agent.MCPBinding) ([]environmentMCPServer, error) {
-	declarations := make([]proto.MCPHTTPServer, 0, len(bindings))
-	for _, binding := range bindings {
-		if binding.Transport != "http" || binding.Stdio != nil {
-			return nil, fmt.Errorf("%w: %s MCP in an agent-host view", agent.ErrUnsupportedOperation, binding.Transport)
-		}
-		declarations = append(declarations, proto.MCPHTTPServer{ServerLabel: binding.ServerLabel, ServerURL: binding.ServerURL, AllowedTools: binding.AllowedTools, Required: binding.Required})
-	}
-	if err := validateMCPServers(declarations); err != nil {
-		return nil, err
-	}
-	projected, _ := prepareMCPHTTP(&declarations)
-	servers := make([]environmentMCPServer, 0, len(*projected))
-	for _, server := range *projected {
-		servers = append(servers, environmentMCPServer{mcpHTTPServer: server})
-	}
-	return servers, nil
-}
-
 // viewHome lays out the native directories. A later Executor finds the tree
 // the Session uid has owned, so every operation stays inside one os.Root and
 // an existing entry must be a directory, not a link.
@@ -185,23 +180,28 @@ func viewHome(home agent.ViewDir) error {
 }
 
 // viewEnvironment is the complete Harness environment. home is the Session
-// home's view path.
-func viewEnvironment(layout viewLayout, home, proxy string, provider []string) (*workspaceProfile, []string) {
+// home's view path, and workspace adds what the workspace tools need.
+func viewEnvironment(layout viewLayout, home, proxy string, provider []string, workspace bool) (*workspaceProfile, []string) {
 	shims := agent.ViewPrivateRoot + "/" + agent.ViewShimName
 	profile := &workspaceProfile{Home: home + "/home", State: home + "/config", Scratch: home + "/tmp", EnvNames: []string{}, AllowedDomains: []string{}}
 	env := []string{
 		"PATH=" + shims, "HOME=" + profile.Home, "TMPDIR=" + profile.Scratch, "CLAUDE_CONFIG_DIR=" + profile.State,
 		// The messaging socket path stays local and short (C5).
 		"XDG_RUNTIME_DIR=" + home + "/xdg",
-		// Bash runs the sandbox shell through the shim (C3).
-		"SHELL=" + shims + "/bash", "CLAUDE_CODE_SHELL=" + shims + "/bash",
-		// The shell's cwd file must be at the same path on both sides (C4).
-		"CLAUDE_CODE_TMPDIR=/tmp/oac-claude-" + strings.ToLower(rand.Text()),
 		"CLAUDE_CODE_CERT_STORE=bundled",         // C2
-		"USE_BUILTIN_RIPGREP=0",                  // C7: rg runs through its shim
 		"CLAUDE_CODE_DISABLE_GIT_INSTRUCTIONS=1", // C9
 		"CLAUDE_CODE_TOOL_MEMORY_LIMIT=0",        // C13
 	}
+	if workspace {
+		env = append(env,
+			// Bash runs the sandbox shell through the shim (C3).
+			"SHELL="+shims+"/bash", "CLAUDE_CODE_SHELL="+shims+"/bash",
+			// The shell's cwd file must be at the same path on both sides
+			// (C4). An empty root has no /tmp, where Claude Code creates it.
+			"CLAUDE_CODE_TMPDIR=/tmp/oac-claude-"+strings.ToLower(rand.Text()),
+			"USE_BUILTIN_RIPGREP=0", // C7: rg runs through its shim
+		)
+	}
 	env = append(env, nativeFlags...)
 	if layout.libraries != "" {
 		env = append(env, "LD_LIBRARY_PATH="+layout.libraries)
diff --git a/apps/daemon/internal/agent/claudesdk/view_test.go b/apps/daemon/internal/agent/claudesdk/view_test.go
index 573aeb21c..ba6a24729 100644
--- a/apps/daemon/internal/agent/claudesdk/view_test.go
+++ b/apps/daemon/internal/agent/claudesdk/view_test.go
@@ -6,7 +6,6 @@ import (
 	"bufio"
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io"
 	"io/fs"
@@ -55,7 +54,7 @@ func TestViewExecutorLaunchesAClosedGatewayEnvironment(t *testing.T) {
 	defer executor.Close(ctx)
 	request := <-requests
 
-	if !slices.Contains(view.LocalExec, launched.Binary) || !slices.Equal(launched.Args, []string{agent.ViewPrivateRoot + "/claude-sdk/dist/main.js"}) || launched.Dir != "/workspace" || !launched.OwnProcessGroup {
+	if !slices.Contains(view.LocalExec, launched.Binary) || !slices.Equal(launched.Args, []string{agent.ViewPrivateRoot + "/claude-sdk/dist/main.js"}) || launched.Dir != "/workspace" {
 		t.Fatalf("launch = %+v, want the closure's node running the bridge in the workspace", launched)
 	}
 	env := map[string]string{}
@@ -106,10 +105,39 @@ func TestViewExecutorLaunchesAClosedGatewayEnvironment(t *testing.T) {
 		t.Fatal("the real key reached the view")
 	}
 
+	// The Harness runs a stdio binding's alias without arguments.
+	docs := session.MCP
 	session.MCP = []agent.MCPBinding{{ServerLabel: "local", Transport: "stdio", Stdio: &proto.EnvironmentMCP{
 		Server: agentplugin.MCPServer{Name: "local", Type: "stdio", Command: agent.ViewAlias(0)}}}}
-	if _, err := view.Executor(t.Context(), req, session); !errors.Is(err, agent.ErrUnsupportedOperation) {
-		t.Fatalf("stdio MCP = %v, want ErrUnsupportedOperation", err)
+	stdio, err := view.Executor(t.Context(), req, session)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer stdio.Close(ctx)
+	var stdioStart startRequest
+	if err := json.Unmarshal(<-requests, &stdioStart); err != nil || stdioStart.Workspace == nil || len(stdioStart.Workspace.MCP) != 1 ||
+		stdioStart.Workspace.MCP[0].Command != agent.ViewAlias(0) || stdioStart.Workspace.MCP[0].Args != nil {
+		t.Fatalf("stdio MCP = %+v, %v", stdioStart.Workspace, err)
+	}
+
+	// With environment none the bridge runs without a workspace in the work directory.
+	none := req
+	none.LocalEnvironment, none.DisableExecutionEnvironment = nil, true
+	session.MCP = docs
+	noneExecutor, err := view.Executor(t.Context(), none, session)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer noneExecutor.Close(ctx)
+	var noneStart startRequest
+	if err := json.Unmarshal(<-requests, &noneStart); err != nil || launched.Dir != "/.oac/home/work" || noneStart.Cwd != launched.Dir || noneStart.Workspace != nil ||
+		noneStart.MCPHTTPServers == nil || len(*noneStart.MCPHTTPServers) != 1 || (*noneStart.MCPHTTPServers)[0].ServerURL != "http://127.0.0.1:17102/mcp/docs" {
+		t.Fatalf("environment none launched in %q with %+v, %v", launched.Dir, noneStart, err)
+	}
+	for _, entry := range launched.Env {
+		if strings.HasPrefix(entry, "CLAUDE_CODE_TMPDIR=") || strings.HasPrefix(entry, "SHELL=") {
+			t.Errorf("environment none sets the workspace tools' %s", entry)
+		}
 	}
 
 	// A link the Session uid planted in its home is never followed.
diff --git a/apps/daemon/internal/agent/claudesdk/workspace_launch_test.go b/apps/daemon/internal/agent/claudesdk/workspace_launch_test.go
index 810bbd095..b95cda8fd 100644
--- a/apps/daemon/internal/agent/claudesdk/workspace_launch_test.go
+++ b/apps/daemon/internal/agent/claudesdk/workspace_launch_test.go
@@ -24,7 +24,7 @@ test -z "${ANTHROPIC_AUTH_TOKEN+x}" && test "$HTTPS_PROXY" = http://proxy.exampl
 test "$TMPDIR" != "$CLAUDE_CONFIG_DIR/tmp" || exit 24
 case "$1" in
   */runtime_check.js)
-    printf '%s\n' '{"type":"runtime_ready","protocol":3,"node":"fixture","sdk":"fixture","mcp":"fixture","native":"fixture","features":["workspace_tools","workspace_prepare"]}' ;;
+    printf '%s\n' '{"type":"runtime_ready","protocol":3,"node":"fixture","sdk":"fixture","mcp":"fixture","native":"fixture","features":["workspace_tools","workspace_prepare","workspace_command_observations"]}' ;;
   *)
     IFS= read -r request
     printf '%s\n' '{"type":"executor_ready","protocol":3}'
@@ -59,7 +59,7 @@ esac
 		t.Fatal("expected one settled completion")
 	}
 	// Feature checking must reject an older bridge without starting execution.
-	script = strings.ReplaceAll(script, `"features":["workspace_tools","workspace_prepare"]`, `"features":[]`)
+	script = strings.ReplaceAll(script, `"features":["workspace_tools","workspace_prepare","workspace_command_observations"]`, `"features":[]`)
 	script = strings.ReplaceAll(script, "IFS= read -r request", "touch '"+filepath.Join(config.StateDir, "unexpected-start")+"'")
 	if err := os.WriteFile(config.Node, []byte(script), 0o700); err != nil {
 		t.Fatal(err)
diff --git a/apps/daemon/internal/agent/claudesdk/workspace_live_linux_test.go b/apps/daemon/internal/agent/claudesdk/workspace_live_linux_test.go
index f391878a9..d9a7e3321 100644
--- a/apps/daemon/internal/agent/claudesdk/workspace_live_linux_test.go
+++ b/apps/daemon/internal/agent/claudesdk/workspace_live_linux_test.go
@@ -91,7 +91,7 @@ func TestLiveClaudeWorkspaceFactory(t *testing.T) {
 		out := make(chan proto.Envelope, 64)
 		req := workspaceRequest()
 		req.RunID, req.Input, req.AgentSessionID = uuid.NewString(), proto.TextInput(prompt), resume
-		req.StrictResume, req.ReleaseOnCompletion, req.ObserveMessages, req.ObserveToolObservations = true, true, true, true
+		req.ObserveMessages = true
 		req.Model, req.SystemPrompt = "MiniMax-M3", "Follow the exact verification instructions using the requested native tools. Preserve conversation facts. No other files, network operations or background work."
 		proof := evidence{RunID: req.RunID}
 		running, err := NewFactory(config)(ctx, req, out)
diff --git a/apps/daemon/internal/agent/clirunner/handle.go b/apps/daemon/internal/agent/clirunner/handle.go
index e331ec3ca..4c0ce3cf4 100644
--- a/apps/daemon/internal/agent/clirunner/handle.go
+++ b/apps/daemon/internal/agent/clirunner/handle.go
@@ -44,7 +44,7 @@ func FromHandle(h Handle, opts HandleOptions) (*Process, error) {
 		opts.KillTimeout = DefaultKillTimeout
 	}
 	ctx, cancel := context.WithCancel(opts.Parent)
-	p := &Process{Stdin: opts.Stdin, Stdout: opts.Stdout, Stderr: opts.Stderr, ctx: ctx, cancel: cancel, done: make(chan struct{}), killAfter: opts.KillTimeout}
+	p := &Process{Stdin: opts.Stdin, Stdout: opts.Stdout, Stderr: opts.Stderr, ctx: ctx, cancel: cancel, done: make(chan struct{})}
 	var terminateOnce sync.Once
 	var interrupted atomic.Bool
 	p.cancelProcess = func() error {
@@ -53,7 +53,7 @@ func FromHandle(h Handle, opts HandleOptions) (*Process, error) {
 			interrupted.Store(err == nil)
 			go func() {
 				if err == nil || errors.Is(err, os.ErrProcessDone) {
-					timer := time.NewTimer(p.killAfter)
+					timer := time.NewTimer(opts.KillTimeout)
 					defer timer.Stop()
 					select {
 					case <-p.done:
diff --git a/apps/daemon/internal/agent/clirunner/process.go b/apps/daemon/internal/agent/clirunner/process.go
index fa4064012..30bd5d5e9 100644
--- a/apps/daemon/internal/agent/clirunner/process.go
+++ b/apps/daemon/internal/agent/clirunner/process.go
@@ -5,9 +5,7 @@ import (
 	"fmt"
 	"io"
 	"os/exec"
-	"runtime"
 	"sync"
-	"syscall"
 	"time"
 )
 
@@ -23,8 +21,6 @@ type StartOptions struct {
 	Env         []string
 	NeedStdin   bool
 	KillTimeout time.Duration
-	// OwnProcessGroup bounds the lifetime of subprocess descendants on Unix.
-	OwnProcessGroup bool
 }
 
 type Process struct {
@@ -33,13 +29,11 @@ type Process struct {
 	Stdout io.ReadCloser
 	Stderr io.ReadCloser
 
-	ctx       context.Context
-	cancel    context.CancelFunc
-	done      chan struct{}
-	killAfter time.Duration
+	ctx    context.Context
+	cancel context.CancelFunc
+	done   chan struct{}
 
 	cancelOnce    sync.Once
-	waitOnce      sync.Once
 	cancelProcess func() error
 	waitProcess   func() error
 
@@ -59,54 +53,9 @@ func Start(opts StartOptions) (*Process, error) {
 		opts.KillTimeout = DefaultKillTimeout
 	}
 
-	if opts.OwnProcessGroup || runtime.GOOS == "windows" {
-		return startProcessGroup(opts)
-	}
-
-	ctx, cancel := context.WithCancel(opts.Parent)
-	cmd := exec.CommandContext(ctx, opts.Binary, opts.Args...)
-	cmd.Dir = opts.Dir
-	if len(opts.Env) > 0 {
-		cmd.Env = append([]string{}, opts.Env...)
-	}
-
-	var stdin io.WriteCloser
-	var err error
-	if opts.NeedStdin {
-		stdin, err = cmd.StdinPipe()
-		if err != nil {
-			cancel()
-			return nil, fmt.Errorf("clirunner: stdin pipe: %w", err)
-		}
-	}
-	stdout, err := cmd.StdoutPipe()
-	if err != nil {
-		closePipe(stdin)
-		cancel()
-		return nil, fmt.Errorf("clirunner: stdout pipe: %w", err)
-	}
-	stderr, err := cmd.StderrPipe()
-	if err != nil {
-		closePipe(stdin)
-		cancel()
-		return nil, fmt.Errorf("clirunner: stderr pipe: %w", err)
-	}
-	if err := cmd.Start(); err != nil {
-		closePipe(stdin)
-		cancel()
-		return nil, fmt.Errorf("clirunner: start %q: %w", opts.Binary, err)
-	}
-
-	return &Process{
-		Cmd:       cmd,
-		Stdin:     stdin,
-		Stdout:    stdout,
-		Stderr:    stderr,
-		ctx:       ctx,
-		cancel:    cancel,
-		done:      make(chan struct{}),
-		killAfter: opts.KillTimeout,
-	}, nil
+	// Every child owns its process group (a Job object on Windows), bounding the
+	// lifetime of its descendants.
+	return startProcessGroup(opts)
 }
 
 func (p *Process) Context() context.Context {
@@ -126,44 +75,20 @@ func (p *Process) Done() <-chan struct{} {
 }
 
 func (p *Process) Cancel() {
-	if p == nil {
+	if p == nil || p.cancelProcess == nil {
 		return
 	}
 	p.cancelOnce.Do(func() {
-		if p.cancelProcess != nil {
-			_ = p.cancelProcess()
-			p.cancel()
-			return
-		}
-		if p.Cmd != nil && p.Cmd.Process != nil {
-			_ = p.Cmd.Process.Signal(syscall.SIGTERM)
-			go func() {
-				select {
-				case <-p.done:
-				case <-time.After(p.killAfter):
-					_ = p.Cmd.Process.Signal(syscall.SIGKILL)
-				}
-			}()
-		}
-		if p.cancel != nil {
-			p.cancel()
-		}
+		_ = p.cancelProcess()
+		p.cancel()
 	})
 }
 
 func (p *Process) Wait() error {
-	if p == nil {
-		return nil
-	}
-	if p.waitProcess != nil {
-		return p.waitProcess()
-	}
-	if p.Cmd == nil {
+	if p == nil || p.waitProcess == nil {
 		return nil
 	}
-	err := p.Cmd.Wait()
-	p.waitOnce.Do(func() { close(p.done) })
-	return err
+	return p.waitProcess()
 }
 
 // ExitCode returns the exit code once Done is closed, or -1 when a signal ended the process. ok is false before then and when the exit is unknown.
diff --git a/apps/daemon/internal/agent/clirunner/process_group_other.go b/apps/daemon/internal/agent/clirunner/process_group_other.go
index d5763742b..796f8aa19 100644
--- a/apps/daemon/internal/agent/clirunner/process_group_other.go
+++ b/apps/daemon/internal/agent/clirunner/process_group_other.go
@@ -5,5 +5,5 @@ package clirunner
 import "errors"
 
 func startProcessGroup(StartOptions) (*Process, error) {
-	return nil, errors.New("clirunner: process-group ownership requires Unix")
+	return nil, errors.New("clirunner: process ownership requires Unix or Windows")
 }
diff --git a/apps/daemon/internal/agent/clirunner/process_group_unix_test.go b/apps/daemon/internal/agent/clirunner/process_group_unix_test.go
index 8a3cbf162..da3162be5 100644
--- a/apps/daemon/internal/agent/clirunner/process_group_unix_test.go
+++ b/apps/daemon/internal/agent/clirunner/process_group_unix_test.go
@@ -107,9 +107,9 @@ func startOwnedHelper(t *testing.T, ctx context.Context, mode, dir string) *Proc
 	t.Helper()
 	p, err := Start(StartOptions{
 		Parent: ctx, Binary: os.Args[0],
-		Args:            []string{"-test.run=^TestOwnedGroupHelper$", "--", "leader", mode, dir},
-		Env:             append(os.Environ(), "GO_WANT_OWNED_GROUP=1", "GORACE=atexit_sleep_ms=0"),
-		OwnProcessGroup: true, KillTimeout: 300 * time.Millisecond,
+		Args:        []string{"-test.run=^TestOwnedGroupHelper$", "--", "leader", mode, dir},
+		Env:         append(os.Environ(), "GO_WANT_OWNED_GROUP=1", "GORACE=atexit_sleep_ms=0"),
+		KillTimeout: 300 * time.Millisecond,
 	})
 	if err != nil {
 		t.Fatal(err)
diff --git a/apps/daemon/internal/agent/clirunner/process_group_windows_test.go b/apps/daemon/internal/agent/clirunner/process_group_windows_test.go
index b2d442b54..fee66f0f2 100644
--- a/apps/daemon/internal/agent/clirunner/process_group_windows_test.go
+++ b/apps/daemon/internal/agent/clirunner/process_group_windows_test.go
@@ -21,7 +21,7 @@ func TestWindowsOwnedTree(t *testing.T) {
 			dir := t.TempDir()
 			ctx, cancel := context.WithCancel(t.Context())
 			defer cancel()
-			p, err := Start(StartOptions{Parent: ctx, Binary: os.Args[0], Args: []string{"-test.run=^TestWindowsTreeHelper$", "--", "leader", mode, dir}, Env: append(os.Environ(), "OAC_TREE_HELPER=1"), OwnProcessGroup: true})
+			p, err := Start(StartOptions{Parent: ctx, Binary: os.Args[0], Args: []string{"-test.run=^TestWindowsTreeHelper$", "--", "leader", mode, dir}, Env: append(os.Environ(), "OAC_TREE_HELPER=1")})
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -129,7 +129,7 @@ func TestWindowsTreeHelper(t *testing.T) {
 			time.Sleep(10 * time.Millisecond)
 		}
 	case "owner":
-		p, err := Start(StartOptions{Parent: context.Background(), Binary: os.Args[0], Args: []string{"-test.run=^TestWindowsTreeHelper$", "--", "leader", mode, dir}, Env: os.Environ(), OwnProcessGroup: true})
+		p, err := Start(StartOptions{Parent: context.Background(), Binary: os.Args[0], Args: []string{"-test.run=^TestWindowsTreeHelper$", "--", "leader", mode, dir}, Env: os.Environ()})
 		if err != nil {
 			os.Exit(3)
 		}
diff --git a/apps/daemon/internal/agent/codex/environment.go b/apps/daemon/internal/agent/codex/environment.go
index 73e1e1c98..725e5ef58 100644
--- a/apps/daemon/internal/agent/codex/environment.go
+++ b/apps/daemon/internal/agent/codex/environment.go
@@ -38,8 +38,8 @@ func nativeEnvironmentStatus(ctx context.Context, rpc *JSONRPCClient, id string)
 }
 
 // Native still recognizes the retired transport variables. Reject them before
-// setup so an inherited environment cannot select a separate executor. The
-// explicit none selector remains part of native execution isolation.
+// setup so the inherited environment cannot select a separate executor.
+// The explicit none selector remains part of native execution isolation.
 func validateNativeTransportEnvironment() error {
 	for _, entry := range os.Environ() {
 		key, value, _ := strings.Cut(entry, "=")
diff --git a/apps/daemon/internal/agent/codex/execution_controls_test.go b/apps/daemon/internal/agent/codex/execution_controls_test.go
index ee97e44ed..182a48fb0 100644
--- a/apps/daemon/internal/agent/codex/execution_controls_test.go
+++ b/apps/daemon/internal/agent/codex/execution_controls_test.go
@@ -1,6 +1,7 @@
 package codex
 
 import (
+	"reflect"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
@@ -22,18 +23,10 @@ func TestExecutionControlsSelectNativeSettings(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
-			want := map[string]string{"web_search": `"` + search + `"`, "model_verbosity": `"` + verbosity + `"`}
-			for _, kv := range plan.ExtraConfig {
-				if v, ok := want[kv[0]]; ok {
-					if kv[1] != v {
-						t.Fatal("native control differs", kv)
-					}
-					delete(want, kv[0])
-				}
-			}
 			plan.Cleanup()
-			if len(want) != 0 {
-				t.Fatal("native settings omitted", want)
+			want := [][2]string{{"web_search", `"` + search + `"`}, {"model_verbosity", `"` + verbosity + `"`}, {"model_provider", `"` + oacProviderSlug + `"`}}
+			if !reflect.DeepEqual(plan.ExtraConfig, want) {
+				t.Fatalf("config = %v, want %v", plan.ExtraConfig, want)
 			}
 		}
 	}
diff --git a/apps/daemon/internal/agent/codex/executor.go b/apps/daemon/internal/agent/codex/executor.go
index 2f1e2eb09..75403c57d 100644
--- a/apps/daemon/internal/agent/codex/executor.go
+++ b/apps/daemon/internal/agent/codex/executor.go
@@ -69,8 +69,7 @@ func (e *Executor) StartTurn(ctx context.Context, runID string, input proto.Mess
 	functions := &functionCalls{definitions: base.functions.definitions, names: base.functions.names, pending: map[string]*pendingFunction{}}
 	turnCtx, cancel := context.WithCancel(base.cancelCtx)
 	s := &Session{executor: e, nativeHome: base.nativeHome,
-		functions: functions, observeMessages: base.observeMessages,
-		observeToolObservations: base.observeToolObservations, observeSubagentIdentities: base.observeSubagentIdentities,
+		functions: functions, observeMessages: base.observeMessages, observeSubagentIdentities: base.observeSubagentIdentities,
 		cfg: base.cfg, rpc: base.rpc, cancelCtx: turnCtx, cancelFn: cancel,
 		waitDone: make(chan struct{}), outputDone: make(chan struct{}), cleanup: func() {},
 		bufs: NewItemBuffers(), resolvedModel: base.resolvedModel, interactions: newPendingCodexInteractions(), runID: runID, out: out}
@@ -94,7 +93,7 @@ func (e *Executor) StartTurn(ctx context.Context, runID string, input proto.Mess
 	}
 	s.registerHandlers()
 	e.mu.Unlock()
-	req := proto.PromptRequestPayload{RunID: runID, Input: input, AgentSessionID: e.prepared.resumeID, StrictResume: e.prepared.strictResume, RequireExistingNativeSession: e.prepared.requireExistingNativeSession}
+	req := proto.PromptRequestPayload{RunID: runID, Input: input, AgentSessionID: e.prepared.resumeID, RequireExistingNativeSession: e.prepared.requireExistingNativeSession}
 	// Ownership precedes any native submission. Even an uncertain start returns the
 	// exact Turn so its caller can await settlement without replaying the input.
 	err := s.startNative(ctx, e.prepared.plan, req)
diff --git a/apps/daemon/internal/agent/codex/executor_native_test.go b/apps/daemon/internal/agent/codex/executor_native_test.go
index cb65df39a..9505d4b50 100644
--- a/apps/daemon/internal/agent/codex/executor_native_test.go
+++ b/apps/daemon/internal/agent/codex/executor_native_test.go
@@ -51,7 +51,7 @@ func TestExecutorNativeReuse(t *testing.T) {
 	cfg.logger = obslog.Discard()
 	req := proto.PromptRequestPayload{
 		AgentKind: "codex", AgentStateKey: "executor-native",
-		StrictResume: true, DisableExecutionEnvironment: true, DisableSubagents: true, ObserveMessages: true,
+		DisableExecutionEnvironment: true, DisableSubagents: true, ObserveMessages: true,
 		Model:         model,
 		ModelProvider: &modelprovider.Provider{BaseURL: endpoint, Protocol: modelprovider.Responses, APIKey: strings.TrimSpace(string(key))},
 		FunctionTools: []proto.FunctionTool{{Name: "hold", Description: "Wait until the host supplies a result.", Parameters: json.RawMessage("{\"type\":\"object\",\"properties\":{},\"additionalProperties\":false}")}},
diff --git a/apps/daemon/internal/agent/codex/executor_test.go b/apps/daemon/internal/agent/codex/executor_test.go
index dd8d4f518..954f00869 100644
--- a/apps/daemon/internal/agent/codex/executor_test.go
+++ b/apps/daemon/internal/agent/codex/executor_test.go
@@ -165,7 +165,7 @@ func TestExecutorStartErrorsRetainExactOwnership(t *testing.T) {
 }
 
 func TestExecutorCloseRetainsPlanUntilReaped(t *testing.T) {
-	process, err := clirunner.Start(clirunner.StartOptions{Parent: t.Context(), Binary: os.Args[0], Args: []string{"-test.run=^TestJSONRPCClientFakeCodexProcess$", "--"}, Env: append(os.Environ(), "CODEX_RPC_FAKE_PROCESS=1", "GORACE=atexit_sleep_ms=0"), NeedStdin: true, OwnProcessGroup: true})
+	process, err := clirunner.Start(clirunner.StartOptions{Parent: t.Context(), Binary: os.Args[0], Args: []string{"-test.run=^TestJSONRPCClientFakeCodexProcess$", "--"}, Env: append(os.Environ(), "CODEX_RPC_FAKE_PROCESS=1", "GORACE=atexit_sleep_ms=0"), NeedStdin: true})
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/agent/codex/mcp_http.go b/apps/daemon/internal/agent/codex/mcp_http.go
index c86df681f..0b1461a11 100644
--- a/apps/daemon/internal/agent/codex/mcp_http.go
+++ b/apps/daemon/internal/agent/codex/mcp_http.go
@@ -21,12 +21,13 @@ func runtimeMCPServers(req proto.PromptRequestPayload) (map[string]mcpServerConf
 	if bindings == nil {
 		return nil, nil, nil
 	}
-	return mcpServersFromBindings(bindings)
+	return mcpServersFromBindings(bindings, localworkspace.MCPStdioCommand)
 }
 
-// mcpServersFromBindings renders resolved bindings, with each credential in a
-// private environment variable.
-func mcpServersFromBindings(bindings []agent.MCPBinding) (map[string]mcpServerConfig, []string, error) {
+// mcpServersFromBindings renders resolved bindings, each stdio binding with
+// the command and arguments stdio gives it and each credential in a private
+// environment variable.
+func mcpServersFromBindings(bindings []agent.MCPBinding, stdio func(proto.EnvironmentMCP) (string, []string)) (map[string]mcpServerConfig, []string, error) {
 	servers := make(map[string]mcpServerConfig, len(bindings))
 	var env []string
 	for _, binding := range bindings {
@@ -35,7 +36,7 @@ func mcpServersFromBindings(bindings []agent.MCPBinding) (map[string]mcpServerCo
 		}
 		server := mcpServerConfig{Name: binding.ServerLabel, URL: binding.ServerURL, Required: binding.Required, EnabledTools: binding.AllowedTools, ApproveTools: binding.ConnectionOrigin == "environment"}
 		if binding.Stdio != nil {
-			server.Command, server.Args = localworkspace.MCPStdioCommand(*binding.Stdio)
+			server.Command, server.Args = stdio(*binding.Stdio)
 		}
 		if binding.BearerToken != nil {
 			server.BearerTokenEnvVar = "OAC_RUNTIME_MCP_BEARER_" + rand.Text()
@@ -71,7 +72,6 @@ func configureMCP(plan *SessionPlan, servers map[string]mcpServerConfig) error {
 		return errors.New("codex: cannot write public MCP configuration")
 	}
 	for _, feature := range []string{"plugins", "apps"} {
-		plan.EnableFeatures = slices.DeleteFunc(plan.EnableFeatures, func(value string) bool { return value == feature })
 		if !slices.Contains(plan.DisableFeatures, feature) {
 			plan.DisableFeatures = append(plan.DisableFeatures, feature)
 		}
diff --git a/apps/daemon/internal/agent/codex/mcp_http_test.go b/apps/daemon/internal/agent/codex/mcp_http_test.go
index 9a9a7732d..0b62c9b87 100644
--- a/apps/daemon/internal/agent/codex/mcp_http_test.go
+++ b/apps/daemon/internal/agent/codex/mcp_http_test.go
@@ -26,7 +26,7 @@ func TestPublicMCPHTTPPlanOwnsConfigurationAndPreservesHistory(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer plan.Cleanup()
-	if slices.Contains(plan.EnableFeatures, "apps") || !slices.Contains(plan.DisableFeatures, "apps") || !slices.Contains(plan.DisableFeatures, "plugins") || !slices.Contains(plan.ExtraConfig, [2]string{"mcp_oauth_credentials_store", `"file"`}) {
+	if !slices.Contains(plan.DisableFeatures, "apps") || !slices.Contains(plan.DisableFeatures, "plugins") || !slices.Contains(plan.ExtraConfig, [2]string{"mcp_oauth_credentials_store", `"file"`}) {
 		t.Fatal("native profile was not pinned")
 	}
 	home, err := allocCodexHome(req.AgentStateKey)
diff --git a/apps/daemon/internal/agent/codex/mcp_required_test.go b/apps/daemon/internal/agent/codex/mcp_required_test.go
index 70f126310..b488c4aae 100644
--- a/apps/daemon/internal/agent/codex/mcp_required_test.go
+++ b/apps/daemon/internal/agent/codex/mcp_required_test.go
@@ -17,7 +17,6 @@ func TestRequiredMCPWaitsForNativeThreadAndNeverRestartsFailedResume(t *testing.
 	for _, mode := range []string{"new ready", "new failed", "resume ready", "resume failed"} {
 		t.Run(mode, func(t *testing.T) {
 			req, cfg, root := preparationFixture(t)
-			req.StrictResume = true
 			req.ExecutionControls = nil
 			servers := []proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "docs", ServerURL: "https://docs.example/mcp", Required: true}}
 			req.MCPHTTPServers = &servers
diff --git a/apps/daemon/internal/agent/codex/options.go b/apps/daemon/internal/agent/codex/options.go
index b86683063..a8e904194 100644
--- a/apps/daemon/internal/agent/codex/options.go
+++ b/apps/daemon/internal/agent/codex/options.go
@@ -19,8 +19,9 @@ import (
 // the daemon's PromptRequestPayload.
 type SessionPlan struct {
 	// Cwd is the working directory passed to codex and the spawned
-	// app-server: the bound workspace root for an Environment request and
-	// the Session's private CODEX_HOME for environment:none.
+	// app-server: the bound workspace root for an Environment request and,
+	// for environment:none, the Session's private CODEX_HOME or a view's work
+	// directory.
 	Cwd string
 
 	// Env is the environment slice (KEY=value) the plan adds. A local
@@ -29,12 +30,11 @@ type SessionPlan struct {
 	Env []string
 
 	// ExtraConfig is a list of `-c key=value` overrides applied at the
-	// app-server CLI. Used to layer web_search, model_verbosity and
-	// model_reasoning_effort without editing config.toml.
+	// app-server CLI.
 	ExtraConfig [][2]string
 
 	// EnableFeatures / DisableFeatures forward to `--enable / --disable`
-	// flags.
+	// flags for the profiles the adapter configures.
 	EnableFeatures  []string
 	DisableFeatures []string
 
@@ -59,9 +59,6 @@ type SessionPlan struct {
 	// SystemPrompt is forwarded as developerInstructions on thread/start.
 	SystemPrompt string
 
-	// CollaborationMode selects Codex's default or plan tool surface.
-	CollaborationMode CollaborationModeKind
-
 	// ModelReasoningEffort is frozen for launch and every native Turn.
 	ModelReasoningEffort string
 
@@ -88,10 +85,9 @@ func BuildSessionPlan(req proto.PromptRequestPayload) (SessionPlan, error) {
 // only after the request validates.
 func buildSessionPlan(req proto.PromptRequestPayload, allocHome func() (agent.ViewDir, error)) (SessionPlan, error) {
 	plan := SessionPlan{
-		CollaborationMode: CollaborationModeDefault,
-		ApprovalPolicy:    AskForApproval{String: "never"},
-		Sandbox:           SandboxDangerFullAcces,
-		Cleanup:           func() {},
+		ApprovalPolicy: AskForApproval{String: "never"},
+		Sandbox:        SandboxDangerFullAcces,
+		Cleanup:        func() {},
 	}
 	prepared, err := harnessconfiguration.Configuration().Prepare(req)
 	if err != nil {
@@ -106,7 +102,7 @@ func buildSessionPlan(req proto.PromptRequestPayload, allocHome func() (agent.Vi
 		switch controls.TextVerbosity {
 		case "low", "medium", "high":
 		default:
-			return plan, fmt.Errorf("codex: model_verbosity must be low, medium or high")
+			return plan, fmt.Errorf("codex: text_verbosity must be low, medium or high")
 		}
 		plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"web_search", strconv(controls.WebSearch)}, [2]string{"model_verbosity", strconv(controls.TextVerbosity)})
 	}
@@ -122,6 +118,9 @@ func buildSessionPlan(req proto.PromptRequestPayload, allocHome func() (agent.Vi
 	}
 	plan.home = home
 	plan.Env = []string{"DISABLE_TELEMETRY=1", "CODEX_HOME=" + home.View}
+	if req.DisableExecutionEnvironment {
+		plan.Env = append(plan.Env, "CODEX_EXEC_SERVER_URL=none")
+	}
 	if err := writeCodexProviderConfig(home.Host, nativeProvider(prepared.Provider)); err != nil {
 		return plan, err
 	}
diff --git a/apps/daemon/internal/agent/codex/options_test.go b/apps/daemon/internal/agent/codex/options_test.go
index b0263b13e..f04f77ce9 100644
--- a/apps/daemon/internal/agent/codex/options_test.go
+++ b/apps/daemon/internal/agent/codex/options_test.go
@@ -79,7 +79,7 @@ func TestBuildSessionPlan_CarriesModelAndSystemPrompt(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer plan.Cleanup()
-	if plan.CollaborationMode != CollaborationModeDefault || plan.SystemPrompt != "current reference" || plan.Model != "MiniMax-M3" {
+	if plan.SystemPrompt != "current reference" || plan.Model != "MiniMax-M3" {
 		t.Fatalf("plan did not carry the default turn instructions: %+v", plan)
 	}
 }
diff --git a/apps/daemon/internal/agent/codex/permission_profile.go b/apps/daemon/internal/agent/codex/permission_profile.go
index 46911ca67..f5e7cb807 100644
--- a/apps/daemon/internal/agent/codex/permission_profile.go
+++ b/apps/daemon/internal/agent/codex/permission_profile.go
@@ -6,9 +6,9 @@ import (
 )
 
 // Runtime execution uses the current user; isolation belongs to its outer host.
-func runtimePermissionProfile(req proto.PromptRequestPayload) (string, error) {
+func validatePermissionProfile(req proto.PromptRequestPayload) error {
 	if req.LocalEnvironment != nil && (req.DisableExecutionEnvironment || req.WorkspaceReadOnly || req.LocalEnvironment.NetworkAccess != "enabled" || len(req.LocalEnvironment.AllowedDomains) != 0) {
-		return "", fmt.Errorf("codex: Runtime execution requires unrestricted host access")
+		return fmt.Errorf("codex: Runtime execution requires unrestricted host access")
 	}
-	return "", nil
+	return nil
 }
diff --git a/apps/daemon/internal/agent/codex/preparation.go b/apps/daemon/internal/agent/codex/preparation.go
index 3a072c808..402794dbf 100644
--- a/apps/daemon/internal/agent/codex/preparation.go
+++ b/apps/daemon/internal/agent/codex/preparation.go
@@ -16,7 +16,6 @@ func newSession(parent context.Context, req proto.PromptRequestPayload, out chan
 		return nil, errors.New("codex: nil out channel")
 	}
 	runID, prompt := req.RunID, req.Input
-	req.AgentStateKey = effectiveAgentStateKey(req)
 	req.RunID, req.Input = "", nil
 	prepared, err := newPreparation(parent, req, cfg)
 	if err != nil {
@@ -33,9 +32,6 @@ func newPreparation(parent context.Context, req proto.PromptRequestPayload, cfg
 	if req.WorkspaceReadOnly {
 		return nil, errors.New("codex: workspace reads use the local Runtime interface")
 	}
-	if req.RequireExistingNativeSession && (!req.StrictResume || req.AgentStateKey == "" || req.WorkspaceReadOnly) {
-		return nil, errors.New("codex: native-session recovery requires strict private state")
-	}
 	if req.RunID != "" || len(req.Input) != 0 {
 		return nil, errors.New("codex: preparation does not accept a run identity or prompt")
 	}
@@ -52,7 +48,6 @@ func newPreparation(parent context.Context, req proto.PromptRequestPayload, cfg
 	if err != nil {
 		return nil, err
 	}
-	req.AgentStateKey = effectiveAgentStateKey(req)
 	var plan SessionPlan
 	var skillRoots []string
 	if cfg.view != nil {
@@ -85,11 +80,9 @@ func newPreparation(parent context.Context, req proto.PromptRequestPayload, cfg
 	rpc := NewJSONRPCClient(rpcCfg)
 
 	s := &Session{
-		nativeHome:      plan.home,
-		functions:       functions,
-		observeMessages: req.ObserveMessages,
-
-		observeToolObservations:   req.ObserveToolObservations,
+		nativeHome:                plan.home,
+		functions:                 functions,
+		observeMessages:           req.ObserveMessages,
 		observeSubagentIdentities: req.ObserveSubagentIdentities && !req.DisableSubagents,
 		cfg:                       cfg,
 		rpc:                       rpc,
@@ -104,7 +97,7 @@ func newPreparation(parent context.Context, req proto.PromptRequestPayload, cfg
 	plan.Cleanup = s.cleanup
 	p := &Prepared{
 		session: s, plan: plan,
-		resumeID: req.AgentSessionID, strictResume: req.StrictResume, requireExistingNativeSession: req.RequireExistingNativeSession,
+		resumeID: req.AgentSessionID, requireExistingNativeSession: req.RequireExistingNativeSession,
 		transferred: make(chan struct{}),
 	}
 
diff --git a/apps/daemon/internal/agent/codex/preparation_helpers_test.go b/apps/daemon/internal/agent/codex/preparation_helpers_test.go
index f21fe49e3..3c950524f 100644
--- a/apps/daemon/internal/agent/codex/preparation_helpers_test.go
+++ b/apps/daemon/internal/agent/codex/preparation_helpers_test.go
@@ -43,7 +43,6 @@ func preparationFixture(t *testing.T) (proto.PromptRequestPayload, sessionConfig
 	cfg.codexBinary = binary
 	req := proto.PromptRequestPayload{
 		AgentKind: "codex", AgentStateKey: "prepared-session",
-		ReleaseOnCompletion: true, StrictResume: true,
 		Model:                       "fixture-model",
 		ModelProvider:               fixtureProvider(),
 		ExecutionControls:           &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"},
diff --git a/apps/daemon/internal/agent/codex/prepared.go b/apps/daemon/internal/agent/codex/prepared.go
index edae1d169..a8a57c30d 100644
--- a/apps/daemon/internal/agent/codex/prepared.go
+++ b/apps/daemon/internal/agent/codex/prepared.go
@@ -17,7 +17,6 @@ type Prepared struct {
 	session                      *Session
 	plan                         SessionPlan
 	resumeID                     string
-	strictResume                 bool
 	requireExistingNativeSession bool
 	claimed                      bool
 	closed                       bool
@@ -60,7 +59,7 @@ func (p *Prepared) start(ctx context.Context, runID string, prompt proto.Message
 	p.started = true
 	close(p.transferred)
 	transferred = true
-	req := proto.PromptRequestPayload{RunID: runID, Input: prompt, AgentSessionID: p.resumeID, StrictResume: p.strictResume, RequireExistingNativeSession: p.requireExistingNativeSession}
+	req := proto.PromptRequestPayload{RunID: runID, Input: prompt, AgentSessionID: p.resumeID, RequireExistingNativeSession: p.requireExistingNativeSession}
 	go s.run(p.plan, req)
 	return s, nil
 }
diff --git a/apps/daemon/internal/agent/codex/programmatic_tools.go b/apps/daemon/internal/agent/codex/programmatic_tools.go
index e0d377fa0..c2da9f9a1 100644
--- a/apps/daemon/internal/agent/codex/programmatic_tools.go
+++ b/apps/daemon/internal/agent/codex/programmatic_tools.go
@@ -16,7 +16,6 @@ func disableProgrammaticTools(plan *SessionPlan, controls *proto.ExecutionContro
 		return
 	}
 	for _, feature := range programmaticFeatures {
-		plan.EnableFeatures = slices.DeleteFunc(plan.EnableFeatures, func(value string) bool { return value == feature })
 		if !slices.Contains(plan.DisableFeatures, feature) {
 			plan.DisableFeatures = append(plan.DisableFeatures, feature)
 		}
diff --git a/apps/daemon/internal/agent/codex/programmatic_tools_test.go b/apps/daemon/internal/agent/codex/programmatic_tools_test.go
index df9064dc4..fd0aeee8a 100644
--- a/apps/daemon/internal/agent/codex/programmatic_tools_test.go
+++ b/apps/daemon/internal/agent/codex/programmatic_tools_test.go
@@ -3,7 +3,6 @@ package codex
 import (
 	"context"
 	"encoding/json"
-	"reflect"
 	"slices"
 	"testing"
 	"time"
@@ -12,16 +11,12 @@ import (
 )
 
 func TestProgrammaticToolsExplicitDisableOverridesNativeOptions(t *testing.T) {
-	plan := SessionPlan{EnableFeatures: []string{"code_mode", "unrelated", "code_mode_only", "code_mode_prewarm"}, ExtraConfig: [][2]string{{"features.code_mode", "true"}}}
-	before := slices.Clone(plan.EnableFeatures)
+	plan := SessionPlan{ExtraConfig: [][2]string{{"features.code_mode", "true"}}}
 	disableProgrammaticTools(&plan, nil)
-	if !reflect.DeepEqual(plan.EnableFeatures, before) {
+	if len(plan.DisableFeatures) != 0 || len(plan.ExtraConfig) != 1 {
 		t.Fatal("omission changed native configuration")
 	}
 	disableProgrammaticTools(&plan, &proto.ExecutionControls{DisableProgrammaticToolCalling: true})
-	if !slices.Equal(plan.EnableFeatures, []string{"unrelated"}) {
-		t.Fatal(plan.EnableFeatures)
-	}
 	for _, feature := range programmaticFeatures {
 		if !slices.Contains(plan.DisableFeatures, feature) {
 			t.Fatal("missing disable", feature)
diff --git a/apps/daemon/internal/agent/codex/protocol.go b/apps/daemon/internal/agent/codex/protocol.go
index 2aa988740..462c10f3e 100644
--- a/apps/daemon/internal/agent/codex/protocol.go
+++ b/apps/daemon/internal/agent/codex/protocol.go
@@ -238,10 +238,7 @@ type TurnStartParams struct {
 
 type CollaborationModeKind string
 
-const (
-	CollaborationModePlan    CollaborationModeKind = "plan"
-	CollaborationModeDefault CollaborationModeKind = "default"
-)
+const CollaborationModeDefault CollaborationModeKind = "default"
 
 type CollaborationMode struct {
 	Mode     CollaborationModeKind     `json:"mode"`
diff --git a/apps/daemon/internal/agent/codex/protocol_wire_test.go b/apps/daemon/internal/agent/codex/protocol_wire_test.go
index 5a513043b..d32590d7c 100644
--- a/apps/daemon/internal/agent/codex/protocol_wire_test.go
+++ b/apps/daemon/internal/agent/codex/protocol_wire_test.go
@@ -106,13 +106,13 @@ func TestThreadStartParams_ModelProviderIsCamelCaseField(t *testing.T) {
 	}
 }
 
-func TestTurnStartParams_CollaborationModeUsesPlanWireShape(t *testing.T) {
+func TestTurnStartParams_CollaborationModeWireShape(t *testing.T) {
 	developerInstructions := "stay within the configured workspace"
 	params := TurnStartParams{
 		ThreadID: "thread-1",
 		Input:    []UserInput{{Type: UserInputText, Text: "ask me a question"}},
 		CollaborationMode: &CollaborationMode{
-			Mode: CollaborationModePlan,
+			Mode: CollaborationModeDefault,
 			Settings: CollaborationModeSettings{
 				Model:                 "MiniMax-M3",
 				DeveloperInstructions: &developerInstructions,
@@ -124,7 +124,7 @@ func TestTurnStartParams_CollaborationModeUsesPlanWireShape(t *testing.T) {
 		t.Fatalf("marshal: %v", err)
 	}
 	body := string(raw)
-	if !strings.Contains(body, `"collaborationMode":{"mode":"plan","settings":{"model":"MiniMax-M3","developer_instructions":"stay within the configured workspace"}}`) {
+	if !strings.Contains(body, `"collaborationMode":{"mode":"default","settings":{"model":"MiniMax-M3","developer_instructions":"stay within the configured workspace"}}`) {
 		t.Fatalf("collaboration mode missing or malformed: %s", body)
 	}
 	if strings.Contains(body, `"collaboration_mode"`) {
diff --git a/apps/daemon/internal/agent/codex/recovery_test.go b/apps/daemon/internal/agent/codex/recovery_test.go
index 49713413e..97eff6936 100644
--- a/apps/daemon/internal/agent/codex/recovery_test.go
+++ b/apps/daemon/internal/agent/codex/recovery_test.go
@@ -47,7 +47,7 @@ func TestRequiredHistoryResolution(t *testing.T) {
 			case "wrong-home":
 				row["path"] = "/another/sessions/rollout.jsonl"
 			}
-			req := proto.PromptRequestPayload{StrictResume: true, RequireExistingNativeSession: true}
+			req := proto.PromptRequestPayload{RequireExistingNativeSession: true}
 			if scenario == "fresh" {
 				req.RequireExistingNativeSession = false
 			}
@@ -197,14 +197,12 @@ func TestPreparedRecoveryCannotStartWithoutExistingHistory(t *testing.T) {
 	}
 }
 
-func TestRecoveryRequiresStrictPrivateExecution(t *testing.T) {
-	for _, mode := range []string{"non-strict", "no-state", "read-only"} {
+func TestRecoveryRequiresWritableAgentState(t *testing.T) {
+	for _, mode := range []string{"no-state", "read-only"} {
 		t.Run(mode, func(t *testing.T) {
 			req, cfg, root := preparationFixture(t)
 			req.RequireExistingNativeSession = true
 			switch mode {
-			case "non-strict":
-				req.StrictResume = false
 			case "no-state":
 				req.AgentStateKey = ""
 			case "read-only":
diff --git a/apps/daemon/internal/agent/codex/resume.go b/apps/daemon/internal/agent/codex/resume.go
index 6ee852b1c..2bc3172e1 100644
--- a/apps/daemon/internal/agent/codex/resume.go
+++ b/apps/daemon/internal/agent/codex/resume.go
@@ -9,18 +9,12 @@ import (
 
 func (s *Session) resolveThread(req proto.PromptRequestPayload, plan SessionPlan) error {
 	if strings.TrimSpace(req.AgentSessionID) != "" {
-		if err := s.resumeThread(req.AgentSessionID, plan); err == nil {
-			return nil
-		} else if req.StrictResume {
+		if err := s.resumeThread(req.AgentSessionID, plan); err != nil {
 			return fmt.Errorf("codex: thread/resume: %w", err)
-		} else {
-			s.cfg.logger.Warn("codex: thread/resume failed; starting fresh", "run_id", s.runID, "thread_id", req.AgentSessionID, "err", err)
 		}
+		return nil
 	}
 	if req.RequireExistingNativeSession {
-		if !req.StrictResume {
-			return fmt.Errorf("codex: recovery requires strict resume")
-		}
 		id, err := s.recoverRoot(plan)
 		if err != nil {
 			return err
diff --git a/apps/daemon/internal/agent/codex/resume_test.go b/apps/daemon/internal/agent/codex/resume_test.go
index 1da859d76..698eb2cc7 100644
--- a/apps/daemon/internal/agent/codex/resume_test.go
+++ b/apps/daemon/internal/agent/codex/resume_test.go
@@ -10,53 +10,38 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/obs/log"
 )
 
-func TestStrictResumeDoesNotStartFresh(t *testing.T) {
-	for _, strict := range []bool{false, true} {
-		t.Run(map[bool]string{false: "legacy", true: "strict"}[strict], func(t *testing.T) {
-			client, server, cleanup := NewTestClient()
-			defer cleanup()
-			ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-			defer cancel()
-			s := &Session{rpc: client.JSONRPCClient, cancelCtx: ctx, cfg: sessionConfig{logger: log.With("component", "resume-test")}}
-			result := make(chan error, 1)
-			go func() {
-				result <- s.resolveThread(proto.PromptRequestPayload{AgentSessionID: "existing", StrictResume: strict}, SessionPlan{})
-			}()
-			var req struct {
-				ID     string `json:"id"`
-				Method string `json:"method"`
-			}
-			decoder := json.NewDecoder(server.FromClient)
-			encoder := json.NewEncoder(server.ToClient)
-			if err := decoder.Decode(&req); err != nil {
-				t.Fatal(err)
-			}
-			if req.Method != "thread/resume" {
-				t.Fatal(req.Method)
-			}
-			if err := encoder.Encode(map[string]any{"id": req.ID, "error": map[string]any{"code": -32600, "message": "native history unavailable"}}); err != nil {
-				t.Fatal(err)
-			}
-			if !strict {
-				if err := decoder.Decode(&req); err != nil {
-					t.Fatal(err)
-				}
-				if req.Method != "thread/start" {
-					t.Fatal(req.Method)
-				}
-				if err := encoder.Encode(map[string]any{"id": req.ID, "result": map[string]any{"thread": map[string]string{"id": "fresh"}}}); err != nil {
-					t.Fatal(err)
-				}
-			}
-			select {
-			case err := <-result:
-				if (err != nil) != strict {
-					t.Fatalf("strict=%v err=%v", strict, err)
-				}
-			case <-ctx.Done():
-				t.Fatal("thread resolution did not finish")
-			}
-		})
+func TestFailedResumeDoesNotStartFresh(t *testing.T) {
+	client, server, cleanup := NewTestClient()
+	defer cleanup()
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	s := &Session{rpc: client.JSONRPCClient, cancelCtx: ctx, cfg: sessionConfig{logger: log.With("component", "resume-test")}}
+	result := make(chan error, 1)
+	go func() {
+		result <- s.resolveThread(proto.PromptRequestPayload{AgentSessionID: "existing"}, SessionPlan{})
+	}()
+	var req struct {
+		ID     string `json:"id"`
+		Method string `json:"method"`
+	}
+	decoder := json.NewDecoder(server.FromClient)
+	encoder := json.NewEncoder(server.ToClient)
+	if err := decoder.Decode(&req); err != nil {
+		t.Fatal(err)
+	}
+	if req.Method != "thread/resume" {
+		t.Fatal(req.Method)
+	}
+	if err := encoder.Encode(map[string]any{"id": req.ID, "error": map[string]any{"code": -32600, "message": "native history unavailable"}}); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case err := <-result:
+		if err == nil {
+			t.Fatal("failed resume started a fresh thread")
+		}
+	case <-ctx.Done():
+		t.Fatal("thread resolution did not finish")
 	}
 }
 
diff --git a/apps/daemon/internal/agent/codex/rpc.go b/apps/daemon/internal/agent/codex/rpc.go
index 2d2eceb56..f3a99cf41 100644
--- a/apps/daemon/internal/agent/codex/rpc.go
+++ b/apps/daemon/internal/agent/codex/rpc.go
@@ -186,7 +186,7 @@ func (c *JSONRPCClient) Start(ctx context.Context, init InitializeParams) (Initi
 	}
 	process, err := launch(clirunner.StartOptions{
 		Parent: ctx, Binary: c.cfg.Binary, Args: args, Dir: c.cfg.Cwd, Env: c.cfg.Env,
-		NeedStdin: true, OwnProcessGroup: true, KillTimeout: 250 * time.Millisecond,
+		NeedStdin: true, KillTimeout: 250 * time.Millisecond,
 	})
 	if err != nil {
 		return InitializeResult{}, fmt.Errorf("codex rpc: spawn %q: %w", c.cfg.Binary, err)
diff --git a/apps/daemon/internal/agent/codex/rpc_close_test.go b/apps/daemon/internal/agent/codex/rpc_close_test.go
index 5fd3aaefd..fbd9c8175 100644
--- a/apps/daemon/internal/agent/codex/rpc_close_test.go
+++ b/apps/daemon/internal/agent/codex/rpc_close_test.go
@@ -15,7 +15,7 @@ import (
 )
 
 func TestJSONRPCClientCloseCanRetryUnreapedChild(t *testing.T) {
-	process, err := clirunner.Start(clirunner.StartOptions{Parent: t.Context(), Binary: os.Args[0], Args: []string{"-test.run=^TestJSONRPCClientFakeCodexProcess$", "--"}, Env: append(os.Environ(), "CODEX_RPC_FAKE_PROCESS=1", "GORACE=atexit_sleep_ms=0"), NeedStdin: true, OwnProcessGroup: true})
+	process, err := clirunner.Start(clirunner.StartOptions{Parent: t.Context(), Binary: os.Args[0], Args: []string{"-test.run=^TestJSONRPCClientFakeCodexProcess$", "--"}, Env: append(os.Environ(), "CODEX_RPC_FAKE_PROCESS=1", "GORACE=atexit_sleep_ms=0"), NeedStdin: true})
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/agent/codex/session.go b/apps/daemon/internal/agent/codex/session.go
index 0e5798581..27ab44063 100644
--- a/apps/daemon/internal/agent/codex/session.go
+++ b/apps/daemon/internal/agent/codex/session.go
@@ -40,9 +40,8 @@ func defaultSessionConfig() sessionConfig {
 }
 
 // Factory implements agent.Factory for agent_kind="codex". Spawns one
-// codex app-server child per prompt. The run stream closes when the turn
-// completes; the router retains the child until the conversation's idle
-// window expires or cancellation shuts it down sooner.
+// codex app-server child for one Turn. The run stream closes when the turn
+// completes; the child remains until the caller cancels the Session.
 func Factory(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
 	return newSession(ctx, req, out, defaultSessionConfig())
 }
@@ -73,11 +72,10 @@ type Session struct {
 	functions                 *functionCalls
 	observeMessages           bool
 
-	observeToolObservations bool
-	runID                   string
-	cfg                     sessionConfig
-	out                     chan<- proto.Envelope
-	rpc                     *JSONRPCClient
+	runID string
+	cfg   sessionConfig
+	out   chan<- proto.Envelope
+	rpc   *JSONRPCClient
 
 	cancelCtx context.Context
 	cancelFn  context.CancelFunc
diff --git a/apps/daemon/internal/agent/codex/session_command_output.go b/apps/daemon/internal/agent/codex/session_command_output.go
index 600e4fdad..1d5cd9f92 100644
--- a/apps/daemon/internal/agent/codex/session_command_output.go
+++ b/apps/daemon/internal/agent/codex/session_command_output.go
@@ -7,9 +7,6 @@ import (
 )
 
 func (s *Session) onCommandOutput(raw json.RawMessage) {
-	if !s.observeToolObservations {
-		return
-	}
 	var p AgentMessageDeltaNotification
 	if json.Unmarshal(raw, &p) != nil || !s.isRootTurn(p.ThreadID, p.TurnID) || p.ItemID == "" || p.Delta == "" {
 		return
diff --git a/apps/daemon/internal/agent/codex/session_command_output_test.go b/apps/daemon/internal/agent/codex/session_command_output_test.go
index 4f86ccbd0..a51fb6694 100644
--- a/apps/daemon/internal/agent/codex/session_command_output_test.go
+++ b/apps/daemon/internal/agent/codex/session_command_output_test.go
@@ -8,42 +8,34 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-func TestCommandOutputRequiresOptInAndRootTurn(t *testing.T) {
-	for _, enabled := range []bool{false, true} {
-		out := make(chan proto.Envelope, 10)
-		s := &Session{runID: "run", out: out, cancelCtx: context.Background(), cfg: defaultSessionConfig(), rpc: NewJSONRPCClient(JSONRPCConfig{}), observeToolObservations: enabled}
-		s.registerHandlers()
-		s.setThreadID("root")
-		s.beginRootTurn("root", "turn")
-		for _, raw := range []string{
-			`{"threadId":"child","turnId":"turn","itemId":"cmd","delta":"foreign"}`,
-			`{"threadId":"root","turnId":"old","itemId":"cmd","delta":"foreign"}`,
-			`{"threadId":"root","turnId":"turn","delta":"missing identity"}`,
-			`{"threadId":"root","turnId":"turn","itemId":"cmd","delta":null}`,
-			`{"threadId":42}`, `{}`,
-		} {
-			scopeNotification(t, s, "item/commandExecution/outputDelta", raw)
-		}
-		if len(out) != 0 {
-			t.Fatal("invalid output reached root")
+func TestCommandOutputRequiresRootTurn(t *testing.T) {
+	out := make(chan proto.Envelope, 10)
+	s := &Session{runID: "run", out: out, cancelCtx: context.Background(), cfg: defaultSessionConfig(), rpc: NewJSONRPCClient(JSONRPCConfig{})}
+	s.registerHandlers()
+	s.setThreadID("root")
+	s.beginRootTurn("root", "turn")
+	for _, raw := range []string{
+		`{"threadId":"child","turnId":"turn","itemId":"cmd","delta":"foreign"}`,
+		`{"threadId":"root","turnId":"old","itemId":"cmd","delta":"foreign"}`,
+		`{"threadId":"root","turnId":"turn","delta":"missing identity"}`,
+		`{"threadId":"root","turnId":"turn","itemId":"cmd","delta":null}`,
+		`{"threadId":42}`, `{}`,
+	} {
+		scopeNotification(t, s, "item/commandExecution/outputDelta", raw)
+	}
+	if len(out) != 0 {
+		t.Fatal("invalid output reached root")
+	}
+	for _, fragment := range []string{"same\n", "same\n", "结束\n"} {
+		raw, _ := json.Marshal(map[string]string{"threadId": "root", "turnId": "turn", "itemId": "cmd", "delta": fragment})
+		scopeNotification(t, s, "item/commandExecution/outputDelta", string(raw))
+		if len(out) != 1 {
+			t.Fatal("missing registered command notification")
 		}
-		for _, fragment := range []string{"same\n", "same\n", "结束\n"} {
-			raw, _ := json.Marshal(map[string]string{"threadId": "root", "turnId": "turn", "itemId": "cmd", "delta": fragment})
-			scopeNotification(t, s, "item/commandExecution/outputDelta", string(raw))
-			if !enabled {
-				if len(out) != 0 {
-					t.Fatal("product frame sequence changed")
-				}
-				continue
-			}
-			if len(out) != 1 {
-				t.Fatal("missing registered command notification")
-			}
-			env := <-out
-			var p proto.CommandOutputPayload
-			if env.DecodePayload(&p) != nil || env.Type != proto.TypeCommandOutput || env.ID != "run" || p.ID != "cmd" || p.Delta != fragment {
-				t.Fatal("command fragment changed", env)
-			}
+		env := <-out
+		var p proto.CommandOutputPayload
+		if env.DecodePayload(&p) != nil || env.Type != proto.TypeCommandOutput || env.ID != "run" || p.ID != "cmd" || p.Delta != fragment {
+			t.Fatal("command fragment changed", env)
 		}
 	}
 }
diff --git a/apps/daemon/internal/agent/codex/session_notifications_test.go b/apps/daemon/internal/agent/codex/session_notifications_test.go
index 0df73e0e1..0ee2a9b94 100644
--- a/apps/daemon/internal/agent/codex/session_notifications_test.go
+++ b/apps/daemon/internal/agent/codex/session_notifications_test.go
@@ -13,8 +13,7 @@ func TestRootNotificationIsolation(t *testing.T) {
 		t.Run(map[bool]string{false: "child without thread started", true: "child thread started"}[childStarted], func(t *testing.T) {
 			out := make(chan proto.Envelope, 64)
 			s := &Session{runID: "run", out: out, cancelCtx: context.Background(), cfg: defaultSessionConfig(),
-				rpc: NewJSONRPCClient(JSONRPCConfig{}), bufs: NewItemBuffers(), observeMessages: true,
-				observeToolObservations: true}
+				rpc: NewJSONRPCClient(JSONRPCConfig{}), bufs: NewItemBuffers(), observeMessages: true}
 			s.registerHandlers()
 			s.setThreadID("root")
 			notify := func(method, params string) { t.Helper(); scopeNotification(t, s, method, params) }
diff --git a/apps/daemon/internal/agent/codex/session_plan.go b/apps/daemon/internal/agent/codex/session_plan.go
index e4f3b9ea7..ea99f3174 100644
--- a/apps/daemon/internal/agent/codex/session_plan.go
+++ b/apps/daemon/internal/agent/codex/session_plan.go
@@ -13,8 +13,7 @@ func prepareSessionPlan(ctx context.Context, req proto.PromptRequestPayload, cfg
 	if err := validateNativeTransportEnvironment(); err != nil {
 		return SessionPlan{}, nil, err
 	}
-	_, err := runtimePermissionProfile(req)
-	if err != nil {
+	if err := validatePermissionProfile(req); err != nil {
 		return SessionPlan{}, nil, err
 	}
 	mcpServers, mcpEnv, err := runtimeMCPServers(req)
@@ -35,7 +34,7 @@ func prepareSessionPlan(ctx context.Context, req proto.PromptRequestPayload, cfg
 		plan.Sandbox = "danger-full-access"
 		plan.Permissions = ""
 		plan.ApprovalPolicy = AskForApproval{String: "never"}
-	} else if req.DisableExecutionEnvironment {
+	} else {
 		// environment:none has no workspace; the Session's private home is its cwd.
 		plan.Cwd = plan.home.View
 	}
@@ -71,9 +70,6 @@ func prepareSessionPlan(ctx context.Context, req proto.PromptRequestPayload, cfg
 		}
 	}
 
-	if req.DisableExecutionEnvironment {
-		plan.Env = append(plan.Env, "CODEX_EXEC_SERVER_URL=none")
-	}
 	var skillRoots []string
 	if req.LocalEnvironment != nil && len(req.LocalEnvironment.Skills) > 0 {
 		if err := verifyHostedSkills(req.LocalEnvironment.Skills); err != nil {
diff --git a/apps/daemon/internal/agent/codex/session_policy_test.go b/apps/daemon/internal/agent/codex/session_policy_test.go
index fcf9a0486..0d9be040a 100644
--- a/apps/daemon/internal/agent/codex/session_policy_test.go
+++ b/apps/daemon/internal/agent/codex/session_policy_test.go
@@ -16,7 +16,7 @@ func TestThreadRequestsApplyDeploymentPolicy(t *testing.T) {
 			for _, method := range []string{"thread/start", "thread/resume"} {
 				t.Run(method, func(t *testing.T) {
 					t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
-					plan, _, err := prepareSessionPlan(context.Background(), proto.PromptRequestPayload{Model: "fixture", ModelProvider: fixtureProvider(), AgentStateKey: "conv/agent/codex", DisableSubagents: true}, sessionConfig{})
+					plan, _, err := prepareSessionPlan(context.Background(), proto.PromptRequestPayload{Model: "fixture", ModelProvider: fixtureProvider(), AgentStateKey: "conv/agent/codex", DisableSubagents: true, DisableExecutionEnvironment: true}, sessionConfig{})
 					if err != nil {
 						t.Fatal(err)
 					}
diff --git a/apps/daemon/internal/agent/codex/session_run.go b/apps/daemon/internal/agent/codex/session_run.go
index 9051ea3c4..7517bfb98 100644
--- a/apps/daemon/internal/agent/codex/session_run.go
+++ b/apps/daemon/internal/agent/codex/session_run.go
@@ -47,23 +47,21 @@ func (s *Session) startNative(ctx context.Context, plan SessionPlan, req proto.P
 		ThreadID: s.currentThreadID(),
 		Input:    input,
 	}
-	if plan.CollaborationMode != "" {
-		model := strings.TrimSpace(s.resolvedModel)
-		if model == "" {
-			return fmt.Errorf("codex: collaboration mode requires a resolved model")
-		}
-		var developerInstructions *string
-		if plan.SystemPrompt != "" {
-			developerInstructions = &plan.SystemPrompt
-		}
-		turnParams.CollaborationMode = &CollaborationMode{
-			Mode: plan.CollaborationMode,
-			Settings: CollaborationModeSettings{
-				ReasoningEffort:       plan.ModelReasoningEffort,
-				Model:                 model,
-				DeveloperInstructions: developerInstructions,
-			},
-		}
+	model := strings.TrimSpace(s.resolvedModel)
+	if model == "" {
+		return fmt.Errorf("codex: collaboration mode requires a resolved model")
+	}
+	var developerInstructions *string
+	if plan.SystemPrompt != "" {
+		developerInstructions = &plan.SystemPrompt
+	}
+	turnParams.CollaborationMode = &CollaborationMode{
+		Mode: CollaborationModeDefault,
+		Settings: CollaborationModeSettings{
+			ReasoningEffort:       plan.ModelReasoningEffort,
+			Model:                 model,
+			DeveloperInstructions: developerInstructions,
+		},
 	}
 	turnCtx, turnCancel := context.WithTimeout(ctx, 10*time.Second)
 	_, ackErr := s.rpc.requestWithResult(turnCtx, "turn/start", turnParams, s.bindTurnResult)
diff --git a/apps/daemon/internal/agent/codex/session_steering_lifecycle_test.go b/apps/daemon/internal/agent/codex/session_steering_lifecycle_test.go
index c886439de..9b2bf38f0 100644
--- a/apps/daemon/internal/agent/codex/session_steering_lifecycle_test.go
+++ b/apps/daemon/internal/agent/codex/session_steering_lifecycle_test.go
@@ -84,7 +84,7 @@ func TestBlockedSteeringWriteEndsRunWithTerminalFrames(t *testing.T) {
 	defer cancel()
 	out := make(chan proto.Envelope, 8)
 	s := &Session{
-		runID: "run", rpc: client.JSONRPCClient, cancelCtx: ctx, out: out,
+		runID: "run", rpc: client.JSONRPCClient, cancelCtx: ctx, out: out, resolvedModel: "synthetic",
 		cfg: sessionConfig{logger: obslog.Bg()}, waitDone: make(chan struct{}), cleanup: func() {},
 		bufs: NewItemBuffers(), interactions: newPendingCodexInteractions(),
 	}
diff --git a/apps/daemon/internal/agent/codex/session_tools.go b/apps/daemon/internal/agent/codex/session_tools.go
index 5a40b45c3..d1d4b4c94 100644
--- a/apps/daemon/internal/agent/codex/session_tools.go
+++ b/apps/daemon/internal/agent/codex/session_tools.go
@@ -10,13 +10,11 @@ func (s *Session) sendItemEvents(events []proto.Envelope, notification json.RawM
 	var native struct {
 		Item json.RawMessage `json:"item"`
 	}
-	if s.observeToolObservations {
-		if err := json.Unmarshal(notification, &native); err != nil {
-			return
-		}
+	if err := json.Unmarshal(notification, &native); err != nil {
+		return
 	}
 	for _, event := range events {
-		if (s.observeToolObservations) && event.Type == proto.TypeToolCall {
+		if event.Type == proto.TypeToolCall {
 			var tool proto.ToolCallPayload
 			if err := event.DecodePayload(&tool); err != nil {
 				return
diff --git a/apps/daemon/internal/agent/codex/session_tools_test.go b/apps/daemon/internal/agent/codex/session_tools_test.go
index 2eff526bb..8d4e06c8d 100644
--- a/apps/daemon/internal/agent/codex/session_tools_test.go
+++ b/apps/daemon/internal/agent/codex/session_tools_test.go
@@ -21,47 +21,39 @@ func toolSnapshotFixtures() []string {
 	}
 }
 
-func TestToolObservationsOnlyWhenRequested(t *testing.T) {
-	for _, enabled := range []bool{false, true} {
-		for _, item := range toolSnapshotFixtures() {
-			var source struct{ ID string }
-			if err := json.Unmarshal([]byte(item), &source); err != nil {
-				t.Fatal(err)
+func TestToolObservations(t *testing.T) {
+	for _, item := range toolSnapshotFixtures() {
+		var source struct{ ID string }
+		if err := json.Unmarshal([]byte(item), &source); err != nil {
+			t.Fatal(err)
+		}
+		t.Run(source.ID, func(t *testing.T) {
+			out := make(chan proto.Envelope, 4)
+			s := &Session{runID: "run", out: out, cancelCtx: context.Background(), bufs: NewItemBuffers(), cfg: defaultSessionConfig()}
+			s.setThreadID("private-thread")
+			s.onTurnStarted(json.RawMessage(`{"threadId":"private-thread","turn":{"id":"private-turn"}}`))
+			raw := json.RawMessage(`{"threadId":"private-thread","turnId":"private-turn","item":` + item + `}`)
+			s.onItemStarted(raw)
+			s.onItemCompleted(raw)
+			if len(out) != 2 {
+				t.Fatalf("tool event count changed: %d", len(out))
 			}
-			t.Run(source.ID, func(t *testing.T) {
-				out := make(chan proto.Envelope, 4)
-				s := &Session{runID: "run", observeToolObservations: enabled, out: out, cancelCtx: context.Background(), bufs: NewItemBuffers(), cfg: defaultSessionConfig()}
-				s.setThreadID("private-thread")
-				s.onTurnStarted(json.RawMessage(`{"threadId":"private-thread","turn":{"id":"private-turn"}}`))
-				raw := json.RawMessage(`{"threadId":"private-thread","turnId":"private-turn","item":` + item + `}`)
-				s.onItemStarted(raw)
-				s.onItemCompleted(raw)
-				if len(out) != 2 {
-					t.Fatalf("tool event count changed: %d", len(out))
+			for _, stage := range []string{"before", "after"} {
+				event := <-out
+				var tool proto.ToolCallPayload
+				if event.DecodePayload(&tool) != nil || event.Type != proto.TypeToolCall || tool.ID != source.ID || tool.Stage != stage {
+					t.Fatal(event)
 				}
-				for _, stage := range []string{"before", "after"} {
-					event := <-out
-					var tool proto.ToolCallPayload
-					if event.DecodePayload(&tool) != nil || event.Type != proto.TypeToolCall || tool.ID != source.ID || tool.Stage != stage {
-						t.Fatal(event)
-					}
-					if bytes.Contains(event.Payload, []byte("native_item")) {
-						t.Fatal("engine-specific snapshot escaped adapter")
-					}
-					if !enabled {
-						if tool.Observation != nil {
-							t.Fatal("unrequested observation")
-						}
-						continue
-					}
-					if tool.Observation == nil || stage == "before" && tool.Observation.Status != "in_progress" {
-						t.Fatal(tool.Observation)
-					}
-					if source.ID == "mcp" && !bytes.Contains(tool.Observation.Output, []byte("9007199254740993")) {
-						t.Fatal("structured output precision lost")
-					}
+				if bytes.Contains(event.Payload, []byte("native_item")) {
+					t.Fatal("engine-specific snapshot escaped adapter")
 				}
-			})
-		}
+				if tool.Observation == nil || stage == "before" && tool.Observation.Status != "in_progress" {
+					t.Fatal(tool.Observation)
+				}
+				if source.ID == "mcp" && !bytes.Contains(tool.Observation.Output, []byte("9007199254740993")) {
+					t.Fatal("structured output precision lost")
+				}
+			}
+		})
 	}
 }
diff --git a/apps/daemon/internal/agent/codex/skills.go b/apps/daemon/internal/agent/codex/skills.go
index 69994f5ee..f7bdfe04a 100644
--- a/apps/daemon/internal/agent/codex/skills.go
+++ b/apps/daemon/internal/agent/codex/skills.go
@@ -1,24 +1,6 @@
 package codex
 
-import (
-	"context"
-	"strings"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-func effectiveAgentStateKey(req proto.PromptRequestPayload) string {
-	if strings.TrimSpace(req.AgentStateKey) != "" {
-		return req.AgentStateKey
-	}
-	if id := strings.TrimSpace(req.ConversationID); id != "" {
-		return "_legacy_conversation/" + id + "/codex"
-	}
-	if id := strings.TrimSpace(req.RunID); id != "" {
-		return "_legacy_run/" + id + "/codex"
-	}
-	return ""
-}
+import "context"
 
 func setSkillExtraRoots(ctx context.Context, rpc *JSONRPCClient, roots []string) error {
 	if len(roots) == 0 {
diff --git a/apps/daemon/internal/agent/codex/skills_test.go b/apps/daemon/internal/agent/codex/skills_test.go
index 1f90c574b..bc316eed9 100644
--- a/apps/daemon/internal/agent/codex/skills_test.go
+++ b/apps/daemon/internal/agent/codex/skills_test.go
@@ -4,8 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"testing"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
 func TestSetSkillExtraRootsUsesCodexRPC(t *testing.T) {
@@ -40,13 +38,3 @@ func TestSetSkillExtraRootsUsesCodexRPC(t *testing.T) {
 		t.Fatalf("setSkillExtraRoots: %v", err)
 	}
 }
-
-func TestEffectiveAgentStateKeyFallsBackToConversation(t *testing.T) {
-	got := effectiveAgentStateKey(proto.PromptRequestPayload{
-		ConversationID: "conv-legacy",
-		RunID:          "run-ignored",
-	})
-	if got != "_legacy_conversation/conv-legacy/codex" {
-		t.Fatalf("state key = %q", got)
-	}
-}
diff --git a/apps/daemon/internal/agent/codex/subagent_profile.go b/apps/daemon/internal/agent/codex/subagent_profile.go
index 6bf395c68..68afc9626 100644
--- a/apps/daemon/internal/agent/codex/subagent_profile.go
+++ b/apps/daemon/internal/agent/codex/subagent_profile.go
@@ -15,16 +15,12 @@ func configureSubagentObservations(plan *SessionPlan, req proto.PromptRequestPay
 		return nil
 	}
 	for _, feature := range []string{"hooks", "plugins", "code_mode", "code_mode_only", "code_mode_prewarm", "multi_agent_v2"} {
-		plan.EnableFeatures = slices.DeleteFunc(plan.EnableFeatures, func(value string) bool { return value == feature })
 		if !slices.Contains(plan.DisableFeatures, feature) {
 			plan.DisableFeatures = append(plan.DisableFeatures, feature)
 		}
 		plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"features." + feature, "false"})
 	}
-	plan.DisableFeatures = slices.DeleteFunc(plan.DisableFeatures, func(value string) bool { return value == "multi_agent" })
-	if !slices.Contains(plan.EnableFeatures, "multi_agent") {
-		plan.EnableFeatures = append(plan.EnableFeatures, "multi_agent")
-	}
+	plan.EnableFeatures = append(plan.EnableFeatures, "multi_agent")
 	plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"features.multi_agent", "true"}, [2]string{"agents.max_depth", "64"})
 	if req.MaxConcurrentSubagents != nil {
 		if *req.MaxConcurrentSubagents < 1 {
diff --git a/apps/daemon/internal/agent/codex/subagent_profile_test.go b/apps/daemon/internal/agent/codex/subagent_profile_test.go
index 5e9df85a0..14ee5aa5a 100644
--- a/apps/daemon/internal/agent/codex/subagent_profile_test.go
+++ b/apps/daemon/internal/agent/codex/subagent_profile_test.go
@@ -10,7 +10,7 @@ import (
 
 func TestSubagentProfileOverridesUnsafeNativeFeatures(t *testing.T) {
 	limit := 6
-	plan := SessionPlan{EnableFeatures: []string{"hooks", "code_mode", "plugins", "multi_agent_v2"}, DisableFeatures: []string{"multi_agent"}}
+	plan := SessionPlan{}
 	if err := configureSubagentObservations(&plan, proto.PromptRequestPayload{ObserveSubagentIdentities: true, MaxConcurrentSubagents: &limit}); err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/agent/codex/subagents.go b/apps/daemon/internal/agent/codex/subagents.go
index 710e12215..1c273779d 100644
--- a/apps/daemon/internal/agent/codex/subagents.go
+++ b/apps/daemon/internal/agent/codex/subagents.go
@@ -3,9 +3,8 @@ package codex
 import "slices"
 
 func disableSubagents(plan *SessionPlan) {
-	// Native v1 and v2 controls must override operator feature preferences.
+	// Disable both native Subagent feature versions.
 	for _, feature := range []string{"multi_agent", "multi_agent_v2"} {
-		plan.EnableFeatures = slices.DeleteFunc(plan.EnableFeatures, func(value string) bool { return value == feature })
 		if !slices.Contains(plan.DisableFeatures, feature) {
 			plan.DisableFeatures = append(plan.DisableFeatures, feature)
 		}
diff --git a/apps/daemon/internal/agent/codex/subagents_test.go b/apps/daemon/internal/agent/codex/subagents_test.go
index 9e725e0cf..b70d17d7c 100644
--- a/apps/daemon/internal/agent/codex/subagents_test.go
+++ b/apps/daemon/internal/agent/codex/subagents_test.go
@@ -5,14 +5,10 @@ import (
 	"testing"
 )
 
-func TestDisableSubagentsOverridesNativeFeaturePreferences(t *testing.T) {
-	plan := SessionPlan{
-		EnableFeatures:  []string{"multi_agent", "unrelated", "multi_agent_v2"},
-		DisableFeatures: []string{"another", "multi_agent"},
-	}
+func TestDisableSubagentsDisablesBothNativeFeatures(t *testing.T) {
+	plan := SessionPlan{DisableFeatures: []string{"another", "multi_agent"}}
 	disableSubagents(&plan)
-	if !reflect.DeepEqual(plan.EnableFeatures, []string{"unrelated"}) ||
-		!reflect.DeepEqual(plan.DisableFeatures, []string{"another", "multi_agent", "multi_agent_v2"}) {
-		t.Fatal(plan.EnableFeatures, plan.DisableFeatures)
+	if !reflect.DeepEqual(plan.DisableFeatures, []string{"another", "multi_agent", "multi_agent_v2"}) {
+		t.Fatal(plan.DisableFeatures)
 	}
 }
diff --git a/apps/daemon/internal/agent/codex/view.go b/apps/daemon/internal/agent/codex/view.go
index 1d7c41031..1f7d85bfa 100644
--- a/apps/daemon/internal/agent/codex/view.go
+++ b/apps/daemon/internal/agent/codex/view.go
@@ -87,12 +87,12 @@ func newView(binary string, codeModeHost bool) agent.View {
 		ForwardEnv: slices.Clone(viewForwardEnv),
 		Proxy:      agent.ViewProxyEnv,
 		Capabilities: agent.ViewCapabilities{
-			EnvironmentNone:      proto.CapabilityUnsupported,
+			EnvironmentNone:      proto.CapabilitySupported,
 			Skills:               proto.CapabilityUnsupported,
 			FunctionTools:        proto.CapabilitySupported,
 			FunctionResultImages: proto.CapabilitySupported,
 			ToolSearch:           proto.CapabilityUnsupported,
-			StdioMCP:             proto.CapabilityUnsupported,
+			StdioMCP:             proto.CapabilitySupported,
 		},
 		Executor: func(ctx context.Context, req proto.PromptRequestPayload, session agent.ViewSession) (agent.Executor, error) {
 			cfg := defaultSessionConfig()
@@ -129,26 +129,27 @@ func staticELF(name string) bool {
 }
 
 // prepareViewPlan builds the plan for codex in the view: the Environment's
-// workspace as cwd, CODEX_HOME and TMPDIR in the Session home, MCP only from
-// the Session, and a closed environment.
+// workspace as cwd, or the work directory with environment none, CODEX_HOME
+// and TMPDIR in the Session home, MCP only from the Session, and a closed
+// environment.
 func prepareViewPlan(ctx context.Context, req proto.PromptRequestPayload, cfg sessionConfig) (SessionPlan, error) {
 	view := cfg.view
-	local := req.LocalEnvironment
-	if local == nil || req.DisableExecutionEnvironment || !path.IsAbs(local.WorkspaceRoot) {
-		return SessionPlan{}, fmt.Errorf("%w: codex: a view runs in an Environment workspace", agent.ErrUnsupportedOperation)
-	}
 	if !filepath.IsAbs(view.Home.Host) || !path.IsAbs(view.Home.View) {
 		return SessionPlan{}, errors.New("codex: view home must be absolute")
 	}
-	if _, err := runtimePermissionProfile(req); err != nil {
-		return SessionPlan{}, err
+	cwd := path.Join(view.Home.View, agent.ViewWorkName)
+	if local := req.LocalEnvironment; local != nil {
+		cwd = local.WorkspaceRoot
 	}
-	for _, binding := range view.MCP {
-		if binding.Transport != "http" || binding.Stdio != nil {
-			return SessionPlan{}, fmt.Errorf("%w: codex: stdio MCP %q in a view", agent.ErrUnsupportedOperation, binding.ServerLabel)
-		}
+	if (req.LocalEnvironment == nil) != req.DisableExecutionEnvironment || !path.IsAbs(cwd) {
+		return SessionPlan{}, fmt.Errorf("%w: codex: a view runs in an Environment workspace or with environment none", agent.ErrUnsupportedOperation)
+	}
+	if err := validatePermissionProfile(req); err != nil {
+		return SessionPlan{}, err
 	}
-	servers, _, err := mcpServersFromBindings(view.MCP)
+	// The Harness runs each stdio alias without arguments, which the native
+	// configuration reports as an empty list.
+	servers, _, err := mcpServersFromBindings(view.MCP, func(stdio proto.EnvironmentMCP) (string, []string) { return stdio.Server.Command, []string{} })
 	if err != nil {
 		return SessionPlan{}, err
 	}
@@ -161,7 +162,7 @@ func prepareViewPlan(ctx context.Context, req proto.PromptRequestPayload, cfg se
 		return SessionPlan{}, err
 	}
 	disableProgrammaticTools(&plan, req.ExecutionControls)
-	plan.Cwd = local.WorkspaceRoot
+	plan.Cwd = cwd
 	plan.Sandbox = SandboxDangerFullAcces
 	plan.Permissions = ""
 	plan.ApprovalPolicy = AskForApproval{String: "never"}
@@ -182,7 +183,8 @@ func prepareViewPlan(ctx context.Context, req proto.PromptRequestPayload, cfg se
 		}
 	}
 	// No login shell, and no ancestor walk above the workspace over the
-	// mount. No trust entry is written, so the project stays untrusted.
+	// mount. The adapter writes no trust entry; Codex keeps its native
+	// project trust and records its own on thread/start.
 	plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"allow_login_shell", "false"}, [2]string{"project_root_markers", "[]"})
 	if req.ExecutionControls != nil {
 		// buildSessionPlan admitted the request's provider.
diff --git a/apps/daemon/internal/agent/codex/view_test.go b/apps/daemon/internal/agent/codex/view_test.go
index 326490432..a2a995f34 100644
--- a/apps/daemon/internal/agent/codex/view_test.go
+++ b/apps/daemon/internal/agent/codex/view_test.go
@@ -122,7 +122,14 @@ func TestViewExecutorLaunchesInTheSessionView(t *testing.T) {
 
 	session.MCP = []agent.MCPBinding{{ServerLabel: "local", ConnectionOrigin: "environment", CredentialAuthority: "none", Transport: "stdio", Stdio: &proto.EnvironmentMCP{
 		Server: agentplugin.MCPServer{Name: "local", Type: "stdio", Command: agent.ViewAlias(0)}}}}
-	if _, err := view.Executor(t.Context(), req, session); !errors.Is(err, agent.ErrUnsupportedOperation) || len(launched) != 1 {
-		t.Fatalf("stdio MCP: launches %d, err %v", len(launched), err)
+	req.LocalEnvironment, req.DisableExecutionEnvironment = nil, true
+	if _, err := view.Executor(t.Context(), req, session); err == nil || len(launched) != 2 {
+		t.Fatalf("environment none: launches %d, err %v", len(launched), err)
+	}
+	if launch := launched[1]; launch.Dir != "/.oac/home/work" || !slices.Contains(launch.Env, "CODEX_EXEC_SERVER_URL=none") {
+		t.Fatalf("environment none launched in %q with %v", launch.Dir, launch.Env)
+	}
+	if config, err := os.ReadFile(planted); err != nil || !strings.Contains(string(config), "command = \"/.oac/bin/oac-mcp-0\"\n\n") {
+		t.Fatalf("stdio alias config.toml: %v\n%s", err, config)
 	}
 }
diff --git a/apps/daemon/internal/agent/configuration_test.go b/apps/daemon/internal/agent/configuration_test.go
index a919b90a1..2e6455f31 100644
--- a/apps/daemon/internal/agent/configuration_test.go
+++ b/apps/daemon/internal/agent/configuration_test.go
@@ -27,11 +27,6 @@ func TestEveryRegistryEntryPreparesTheBoundModelConfiguration(t *testing.T) {
 		return nil, expected
 	})
 	configuration.Providers[0].Protocol = "anthropic"
-	copy, err := registry.Configuration("fixture")
-	if err != nil {
-		t.Fatal(err)
-	}
-	copy.Providers[0].Protocol = "anthropic"
 	factory, _ := registry.Resolve("fixture")
 	executor, _ := registry.ResolveExecutor("fixture")
 	entries := []func(proto.PromptRequestPayload) error{
@@ -59,9 +54,6 @@ func TestEveryRegistryEntryPreparesTheBoundModelConfiguration(t *testing.T) {
 	if calls != 2 {
 		t.Fatal("unexpected native calls", calls)
 	}
-	if _, err := registry.Configuration("missing"); err == nil {
-		t.Fatal("undeclared configuration inferred")
-	}
 }
 
 func TestRegistryRejectsInvalidConfigurationDeclaration(t *testing.T) {
diff --git a/apps/daemon/internal/agent/harness.go b/apps/daemon/internal/agent/harness.go
index 44f18f56b..cb7232fef 100644
--- a/apps/daemon/internal/agent/harness.go
+++ b/apps/daemon/internal/agent/harness.go
@@ -298,8 +298,8 @@ type ViewSession struct {
 	MCP []MCPBinding
 	// Launch replaces clirunner.Start. Each call builds one view and runs
 	// Binary, which must be a LocalExec path, in it. Dir is a world path, or
-	// the work directory in an empty-root view; OwnProcessGroup is true, and
-	// Env is the complete Harness environment.
+	// the work directory in an empty-root view, and Env is the complete
+	// Harness environment.
 	// Cancel sends TERM to every process in the view and closes the view after
 	// KillTimeout; a Cancel after the Harness exited leaves its exit as it was.
 	// When the Harness exits while other processes remain, the view sends them
@@ -565,8 +565,8 @@ type TurnSettlement struct {
 	Reason   string
 }
 
-// Session is the cancellation and outcome surface shared by direct prompt runs
-// and Turns. Every owner exposes observed state, including direct-call sessions.
+// Session is the cancellation and outcome surface shared by direct-call
+// sessions and Turns. Every owner exposes observed state.
 // For Executor-owned Turns, AwaitSettlement and Executor.Close define settlement
 // and resource retirement; Cancel alone does not transfer resource ownership.
 type Session interface {
@@ -645,11 +645,12 @@ type WorkspaceWriter interface {
 	WriteWorkspaceFile(context.Context, string, []byte) (WorkspaceWriteResult, error)
 }
 
-// Direct-call factory and registration. These use the existing Registry behavior.
+// Kind registration and the direct-call factory.
 
-// Factory builds a Session for one prompt_request. out is the upstream
-// channel the agent writes into and closes exactly once after terminal output.
-// ctx is cancelled by the router to wind the session down.
+// Factory builds a Session that runs req.Input as req.RunID without an
+// Executor; the router starts every Run through RegisterExecutor instead. out
+// is the channel the agent writes into and closes exactly once after terminal
+// output. ctx is cancelled to wind the session down.
 type Factory func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (Session, error)
 
 // RegisterKind installs f and the heartbeat descriptor for an
diff --git a/apps/daemon/internal/agent/installroot/probe.go b/apps/daemon/internal/agent/installroot/probe.go
index b185c31bc..21f50ed47 100644
--- a/apps/daemon/internal/agent/installroot/probe.go
+++ b/apps/daemon/internal/agent/installroot/probe.go
@@ -14,7 +14,7 @@ import (
 func Probe(parent context.Context, binary string, args, env []string, dir string) (string, error) {
 	ctx, cancel := context.WithTimeout(parent, 25*time.Second)
 	defer cancel()
-	p, err := clirunner.Start(clirunner.StartOptions{Parent: ctx, Binary: binary, Args: args, Env: env, Dir: dir, OwnProcessGroup: true, KillTimeout: 250 * time.Millisecond})
+	p, err := clirunner.Start(clirunner.StartOptions{Parent: ctx, Binary: binary, Args: args, Env: env, Dir: dir, KillTimeout: 250 * time.Millisecond})
 	if err != nil {
 		return "", errors.New("native component failed to start")
 	}
diff --git a/apps/daemon/internal/agent/mcode/environment_mcp.go b/apps/daemon/internal/agent/mcode/environment_mcp.go
index 7f388c803..78def82a3 100644
--- a/apps/daemon/internal/agent/mcode/environment_mcp.go
+++ b/apps/daemon/internal/agent/mcode/environment_mcp.go
@@ -15,26 +15,24 @@ func runtimeMCP(req proto.PromptRequestPayload) ([]map[string]any, []agent.MCPBi
 	if err != nil {
 		return nil, nil, err
 	}
-	servers, err := workspaceMCP(bindings, func(binding agent.MCPBinding) (map[string]any, error) {
-		command, args := localworkspace.MCPStdioCommand(*binding.Stdio)
-		return map[string]any{"name": binding.ServerLabel, "command": command, "args": args, "env": []map[string]string{}}, nil
-	})
+	servers, err := workspaceMCP(bindings, localworkspace.MCPStdioCommand)
 	return servers, bindings, err
 }
 
-// workspaceMCP renders the Session's MCP bindings as ACP servers; stdio
-// renders a stdio binding.
-func workspaceMCP(bindings []agent.MCPBinding, stdio func(agent.MCPBinding) (map[string]any, error)) ([]map[string]any, error) {
+// workspaceMCP renders the Session's MCP bindings as ACP servers, each stdio
+// binding with the command and arguments stdio gives it.
+func workspaceMCP(bindings []agent.MCPBinding, stdio func(proto.EnvironmentMCP) (string, []string)) ([]map[string]any, error) {
 	var servers []map[string]any
 	for _, binding := range bindings {
 		if binding.ServerLabel == "oac_workspace" || binding.ConnectionOrigin != "environment" || binding.AllowedTools != nil || binding.Required {
 			return nil, fmt.Errorf("mcode: unsupported MCP binding")
 		}
-		render := environmentHTTPMCP
 		if binding.Transport != "http" {
-			render = stdio
+			command, args := stdio(*binding.Stdio)
+			servers = append(servers, map[string]any{"name": binding.ServerLabel, "command": command, "args": args, "env": []map[string]string{}})
+			continue
 		}
-		server, err := render(binding)
+		server, err := environmentHTTPMCP(binding)
 		if err != nil {
 			return nil, err
 		}
diff --git a/apps/daemon/internal/agent/mcode/environment_mcp_test.go b/apps/daemon/internal/agent/mcode/environment_mcp_test.go
index f8ea52093..5ca8565f9 100644
--- a/apps/daemon/internal/agent/mcode/environment_mcp_test.go
+++ b/apps/daemon/internal/agent/mcode/environment_mcp_test.go
@@ -98,7 +98,7 @@ func TestEnvironmentMCPRejectsUnqualifiedAuthorityBeforePreparation(t *testing.T
 			case "reserved":
 				req.LocalEnvironment.MCP[0].Server.Name = "oac_workspace"
 			}
-			if _, err := prepareWorkspaceOptions(t.Context(), c, req); err == nil || strings.Contains(err.Error(), "confidential-http-token") {
+			if _, err := prepareWorkspaceOptions(c, req); err == nil || strings.Contains(err.Error(), "confidential-http-token") {
 				t.Fatal("unqualified declaration accepted or credential exposed")
 			}
 		})
@@ -109,7 +109,6 @@ func TestEnvironmentMCPCancelSettlesPendingObservationBeforeDone(t *testing.T) {
 	c, req, _ := workspaceFixture(t)
 	c.Network, req.LocalEnvironment.NetworkAccess = "enabled", "enabled"
 	req.LocalEnvironment.MCP = []proto.EnvironmentMCP{environmentMCPFixture()}
-	req.ObserveToolObservations = true
 	script, err := os.ReadFile(c.Binary)
 	if err != nil {
 		t.Fatal(err)
@@ -238,7 +237,7 @@ func TestPublicEnvironmentHTTPMCPKeepsCredentialTransient(t *testing.T) {
 	c.Network, req.LocalEnvironment.NetworkAccess = "enabled", "enabled"
 	token := "selected-public-vault-canary"
 	req.MCPHTTPServers = &[]proto.MCPHTTPServer{{ConnectionOrigin: "environment", ServerLabel: "remote", ServerURL: "https://example.test/mcp", BearerToken: &token}}
-	opts, err := prepareWorkspaceOptions(t.Context(), c, req)
+	opts, err := prepareWorkspaceOptions(c, req)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -267,12 +266,12 @@ func TestPublicEnvironmentHTTPMCPKeepsCredentialTransient(t *testing.T) {
 	}
 	empty := []string{}
 	(*req.MCPHTTPServers)[0].AllowedTools = &empty
-	if _, err := prepareWorkspaceOptions(t.Context(), c, req); err == nil {
+	if _, err := prepareWorkspaceOptions(c, req); err == nil {
 		t.Fatal("empty allowlist silently treated as all")
 	}
 	(*req.MCPHTTPServers)[0].AllowedTools = nil
 	(*req.MCPHTTPServers)[0].Required = true
-	if _, err := prepareWorkspaceOptions(t.Context(), c, req); err == nil {
+	if _, err := prepareWorkspaceOptions(c, req); err == nil {
 		t.Fatal("required initialization silently ignored")
 	}
 }
diff --git a/apps/daemon/internal/agent/mcode/events.go b/apps/daemon/internal/agent/mcode/events.go
index 0b04ce6dd..97bd1f8cd 100644
--- a/apps/daemon/internal/agent/mcode/events.go
+++ b/apps/daemon/internal/agent/mcode/events.go
@@ -59,7 +59,7 @@ func (s *Session) emitTool(update toolUpdate) error {
 	if update.ID == "" || s.completedTools[update.ID] {
 		return nil
 	}
-	previous, started := s.tools[update.ID]
+	previous := s.tools[update.ID]
 	if update.Name == "" {
 		update.Name = previous.Name
 	}
@@ -69,21 +69,18 @@ func (s *Session) emitTool(update toolUpdate) error {
 	if update.RawInput == nil {
 		update.RawInput = previous.RawInput
 	}
-	if s.req.ObserveToolObservations {
-		update.mcp = previous.mcp
-		if update.mcp != nil && update.Name != previous.Name {
-			return fmt.Errorf("mcode: native MCP call identity changed")
-		}
-		if update.mcp == nil {
-			var err error
-			update.mcp, err = s.environmentMCPIdentity(update.Name)
-			if err != nil {
-				return err
-			}
+	update.mcp = previous.mcp
+	if update.mcp != nil && update.Name != previous.Name {
+		return fmt.Errorf("mcode: native MCP call identity changed")
+	}
+	if update.mcp == nil {
+		var err error
+		update.mcp, err = s.environmentMCPIdentity(update.Name)
+		if err != nil {
+			return err
 		}
-		started = previous.mcp != nil || workspaceToolObservation(previous, "before") != nil
 	}
-	if !started {
+	if previous.mcp == nil && workspaceToolObservation(previous, "before") == nil {
 		if err := s.emitToolStage(update, "before"); err != nil {
 			return err
 		}
diff --git a/apps/daemon/internal/agent/mcode/execution.go b/apps/daemon/internal/agent/mcode/execution.go
index 2a1d36c14..7b2a93d93 100644
--- a/apps/daemon/internal/agent/mcode/execution.go
+++ b/apps/daemon/internal/agent/mcode/execution.go
@@ -7,7 +7,9 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-// SupportsExecution is an operator opt-in, separate from ordinary product availability.
+// SupportsExecution reports whether the daemon advertises MiniMax Code execution:
+// the operator sets OAC_RUNTIME_MCODE_AGENTS_API=1 and the native version is the
+// qualified one. Otherwise discovery reports only availability.
 func SupportsExecution(version string) bool {
 	return os.Getenv("OAC_RUNTIME_MCODE_AGENTS_API") == "1" && version == SupportedVersion
 }
@@ -37,12 +39,8 @@ func configureTextExecution(config map[string]any) {
 // Harness children use the daemon user's ordinary environment.
 func executionEnvironment() []string { return os.Environ() }
 
-// ACP commands are only recognized for a single text block. Public input must
-// remain user text; ordinary product Sessions retain their native command behavior.
-func promptContent(text string, public bool) []map[string]string {
-	blocks := []map[string]string{{"type": "text", "text": text}}
-	if public {
-		blocks = append(blocks, map[string]string{"type": "text", "text": ""})
-	}
-	return blocks
+// ACP commands are only recognized for a single text block. A second, empty
+// block keeps public input as user text.
+func promptContent(text string) []map[string]string {
+	return []map[string]string{{"type": "text", "text": text}, {"type": "text", "text": ""}}
 }
diff --git a/apps/daemon/internal/agent/mcode/execution_test.go b/apps/daemon/internal/agent/mcode/execution_test.go
index a49d3e6f4..9f188f97f 100644
--- a/apps/daemon/internal/agent/mcode/execution_test.go
+++ b/apps/daemon/internal/agent/mcode/execution_test.go
@@ -10,15 +10,8 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-func executionRequest(t *testing.T) proto.PromptRequestPayload {
-	r := testRequest(t)
-	r.StrictResume, r.ReleaseOnCompletion, r.DisableExecutionEnvironment, r.DisableSubagents = true, true, true, true
-	r.ExecutionControls = &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}
-	return r
-}
-
 func TestExecutionOptionsInheritUserEnvironment(t *testing.T) {
-	r := executionRequest(t)
+	r := testRequest(t)
 	t.Setenv("OAC_TEST_SECRET_CANARY", "secret")
 	t.Setenv("NODE_OPTIONS", "--import=untrusted")
 	opts, err := prepareOptions(r)
@@ -53,7 +46,7 @@ func TestExecutionRejectsUnqualifiedAuthority(t *testing.T) {
 		func(r *proto.PromptRequestPayload) { r.FunctionTools = []proto.FunctionTool{{Name: "f"}} },
 		func(r *proto.PromptRequestPayload) { r.ExecutionControls.WebSearch = "enabled" },
 	} {
-		r := executionRequest(t)
+		r := testRequest(t)
 		change(&r)
 		if _, err := prepareOptions(r); err == nil {
 			t.Fatal("unsupported execution accepted")
@@ -63,12 +56,9 @@ func TestExecutionRejectsUnqualifiedAuthority(t *testing.T) {
 
 func TestPublicTextDoesNotInvokeACPCommands(t *testing.T) {
 	for _, text := range []string{"/model", "/compact", "hello"} {
-		blocks := promptContent(text, true)
+		blocks := promptContent(text)
 		if len(blocks) != 2 || blocks[0]["text"] != text || blocks[1]["text"] != "" {
 			t.Fatal(blocks)
 		}
-		if blocks = promptContent(text, false); len(blocks) != 1 || blocks[0]["text"] != text {
-			t.Fatal("product prompt changed")
-		}
 	}
 }
diff --git a/apps/daemon/internal/agent/mcode/executor.go b/apps/daemon/internal/agent/mcode/executor.go
index 519a71baf..ac22cced5 100644
--- a/apps/daemon/internal/agent/mcode/executor.go
+++ b/apps/daemon/internal/agent/mcode/executor.go
@@ -40,25 +40,25 @@ func NewExecutorFactory(config *WorkspaceConfig) agent.ExecutorFactory {
 		if frozen != nil {
 			binary = frozen.Binary
 		}
-		return startExecutor(ctx, req, binary, func(ctx context.Context) (launchOptions, error) {
+		return startExecutor(ctx, req, binary, func() (launchOptions, error) {
 			if frozen == nil {
 				return prepareOptions(req)
 			}
-			return prepareWorkspaceOptions(ctx, *frozen, req)
+			return prepareWorkspaceOptions(*frozen, req)
 		})
 	}
 }
 
 // startExecutor prepares the native owner for req, which carries no Turn
 // input, and starts binary.
-func startExecutor(ctx context.Context, req proto.PromptRequestPayload, binary string, prepare func(context.Context) (launchOptions, error)) (agent.Executor, error) {
+func startExecutor(ctx context.Context, req proto.PromptRequestPayload, binary string, prepare func() (launchOptions, error)) (agent.Executor, error) {
 	if ctx == nil {
 		ctx = context.Background()
 	}
-	if req.RunID != "" || len(req.Input) != 0 || req.ConversationID != "" {
+	if req.RunID != "" || len(req.Input) != 0 {
 		return nil, fmt.Errorf("mcode: Executor configuration cannot contain Turn input")
 	}
-	opts, err := prepare(ctx)
+	opts, err := prepare()
 	if err != nil {
 		return nil, err
 	}
diff --git a/apps/daemon/internal/agent/mcode/executor_native_test.go b/apps/daemon/internal/agent/mcode/executor_native_test.go
index 637f32c4f..0daeb06e2 100644
--- a/apps/daemon/internal/agent/mcode/executor_native_test.go
+++ b/apps/daemon/internal/agent/mcode/executor_native_test.go
@@ -28,9 +28,8 @@ func TestNativeMCodeExecutorReuse(t *testing.T) {
 	if err != nil {
 		t.Fatal("private provider options unavailable")
 	}
-	req := executionRequest(t)
-	req.ReleaseOnCompletion = false
-	req.RunID, req.Input, req.ConversationID = "", nil, ""
+	req := testRequest(t)
+	req.RunID, req.Input = "", nil
 	if json.Unmarshal(raw, &req) != nil {
 		t.Fatal("invalid private provider options")
 	}
diff --git a/apps/daemon/internal/agent/mcode/executor_test.go b/apps/daemon/internal/agent/mcode/executor_test.go
index 3c949ab0a..a7aba62ed 100644
--- a/apps/daemon/internal/agent/mcode/executor_test.go
+++ b/apps/daemon/internal/agent/mcode/executor_test.go
@@ -15,8 +15,8 @@ import (
 
 func workspaceFixture(t *testing.T) (WorkspaceConfig, proto.PromptRequestPayload, string) {
 	t.Helper()
-	r := executionRequest(t)
-	r.RunID, r.Input, r.ConversationID = "", nil, ""
+	r := testRequest(t)
+	r.RunID, r.Input = "", nil
 	r.DisableExecutionEnvironment = false
 	r.LocalEnvironment = &proto.LocalEnvironment{ID: "environment", NetworkAccess: "enabled", WorkspaceRoot: t.TempDir()}
 	record := filepath.Join(t.TempDir(), "calls")
@@ -36,7 +36,6 @@ func workspaceFixture(t *testing.T) (WorkspaceConfig, proto.PromptRequestPayload
 func executorFixture(t *testing.T, scenario string, workspace bool) (*executor, string) {
 	t.Helper()
 	config, req, record := workspaceFixture(t)
-	req.ReleaseOnCompletion = false
 	script, err := os.ReadFile(config.Binary)
 	if err != nil {
 		t.Fatal(err)
@@ -48,9 +47,8 @@ func executorFixture(t *testing.T, scenario string, workspace bool) (*executor,
 	if workspace {
 		factory = NewExecutorFactory(&config)
 	} else {
-		req = executionRequest(t)
-		req.ReleaseOnCompletion = false
-		req.RunID, req.Input, req.ConversationID = "", nil, ""
+		req = testRequest(t)
+		req.RunID, req.Input = "", nil
 		t.Setenv("OAC_RUNTIME_MCODE_BIN", config.Binary)
 		factory = NewExecutorFactory(nil)
 	}
@@ -283,7 +281,6 @@ func TestExecutorCloseRetainsOwnerAfterDeadline(t *testing.T) {
 
 func TestExecutorFactoryPreparationFailureHasNoTypedNilOwner(t *testing.T) {
 	config, req, _ := workspaceFixture(t)
-	req.ReleaseOnCompletion = false
 	if err := os.WriteFile(config.Binary, []byte("#!/bin/sh\nexit 1\n"), 0700); err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/agent/mcode/executor_turn.go b/apps/daemon/internal/agent/mcode/executor_turn.go
index 3bf537374..1633f5f18 100644
--- a/apps/daemon/internal/agent/mcode/executor_turn.go
+++ b/apps/daemon/internal/agent/mcode/executor_turn.go
@@ -25,7 +25,7 @@ func (s *Session) runExecutorTurn() {
 	// Written steering requests retain their original receipt owner even after
 	// prompt completion. No successor starts until all callers have settled.
 	s.operations.Wait()
-	if s.req.StrictResume && !s.req.DisableSubagents && s.subagentHistoryReady {
+	if !s.req.DisableSubagents && s.subagentHistoryReady {
 		childErr := s.settleSubagents()
 		s.mu.Lock()
 		s.subagentSettlementError = childErr
@@ -82,7 +82,7 @@ func (s *Session) runExecutorTurn() {
 }
 
 func (s *Session) captureSubagentBaseline() error {
-	if !s.req.StrictResume || s.req.DisableSubagents {
+	if s.req.DisableSubagents {
 		return nil
 	}
 	snapshot, err := s.readSubagents(s.ctx)
@@ -135,7 +135,7 @@ func (s *Session) cancelTurn(ctx context.Context) error {
 		err = s.writeContext(ctx, rpcFrame{JSONRPC: "2.0", Method: "session/cancel", Params: raw})
 	}
 	if first {
-		if err == nil && s.req.StrictResume && !s.req.DisableSubagents {
+		if err == nil && !s.req.DisableSubagents {
 			err = s.stopSubagents(ctx)
 		}
 		if err != nil {
diff --git a/apps/daemon/internal/agent/mcode/mcp_observations_test.go b/apps/daemon/internal/agent/mcode/mcp_observations_test.go
index 240c8913d..78c94b467 100644
--- a/apps/daemon/internal/agent/mcode/mcp_observations_test.go
+++ b/apps/daemon/internal/agent/mcode/mcp_observations_test.go
@@ -16,7 +16,7 @@ func mcpObservationSession(t *testing.T) (*Session, chan proto.Envelope) {
 	t.Helper()
 	out := make(chan proto.Envelope, 16)
 	s := &Session{ctx: context.Background(), opts: launchOptions{DataDir: t.TempDir()},
-		req: proto.PromptRequestPayload{RunID: "run", ObserveToolObservations: true,
+		req: proto.PromptRequestPayload{RunID: "run",
 			LocalEnvironment: &proto.LocalEnvironment{NetworkAccess: "enabled", MCP: []proto.EnvironmentMCP{environmentMCPFixture()}}},
 		out: out, tools: map[string]toolUpdate{}, completedTools: map[string]bool{}, active: true, sessionID: "native-session"}
 	resolveTestBindings(s)
diff --git a/apps/daemon/internal/agent/mcode/native_history_test.go b/apps/daemon/internal/agent/mcode/native_history_test.go
index 5019a4f56..98c7c6a29 100644
--- a/apps/daemon/internal/agent/mcode/native_history_test.go
+++ b/apps/daemon/internal/agent/mcode/native_history_test.go
@@ -24,7 +24,7 @@ func TestNativeMCodeHistoryIsolation(t *testing.T) {
 	}
 	for name, id := range map[string]string{"foreign": foreign, "missing": "00000000-0000-4000-8000-000000000000"} {
 		t.Run(name, func(t *testing.T) {
-			req := executionRequest(t)
+			req := testRequest(t)
 			if json.Unmarshal(raw, &req) != nil {
 				t.Fatal("invalid private options")
 			}
diff --git a/apps/daemon/internal/agent/mcode/options.go b/apps/daemon/internal/agent/mcode/options.go
index 3717a159f..cd5da0d56 100644
--- a/apps/daemon/internal/agent/mcode/options.go
+++ b/apps/daemon/internal/agent/mcode/options.go
@@ -2,7 +2,6 @@ package mcode
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -52,7 +51,7 @@ func prepareOptionsWithTools(req proto.PromptRequestPayload, tools *workspaceToo
 	if err != nil {
 		return result, err
 	}
-	if req.StrictResume && !req.DisableSubagents {
+	if !req.DisableSubagents {
 		if _, _, err := subagentReader(); err != nil {
 			return result, err
 		}
@@ -88,10 +87,8 @@ func validateOptions(req proto.PromptRequestPayload) (harnessconfig.PreparedConf
 	if err != nil {
 		return prepared, err
 	}
-	if req.StrictResume {
-		if err := validateExecutionRequest(req); err != nil {
-			return prepared, err
-		}
+	if err := validateExecutionRequest(req); err != nil {
+		return prepared, err
 	}
 	if req.Input.HasImages() {
 		return prepared, fmt.Errorf("mcode: ACP does not support attachments")
@@ -112,15 +109,13 @@ func writeNativeConfig(req proto.PromptRequestPayload, prepared harnessconfig.Pr
 	}
 	config := map[string]any{"logLevel": "error", "skills": map[string]any{"external": map[string]any{"enabled": false}}}
 	config["custom_provider"] = map[string]any{"oac": modelProviderConfig(prepared.Provider, prepared.Model)}
-	if req.StrictResume {
-		configureTextExecution(config)
-		if !req.DisableSubagents {
-			config["agents"] = map[string]any{"default": map[string]any{
-				"tools":        []string{"task", "task_append", "task_query", "task_output", "task_stop"},
-				"builtinTools": []string{"task", "task_append", "task_query", "task_output", "task_stop"}, "skills": []string{},
-				"features": map[string]bool{"mavis": false, "delegation": true, "webSearch": false},
-			}}
-		}
+	configureTextExecution(config)
+	if !req.DisableSubagents {
+		config["agents"] = map[string]any{"default": map[string]any{
+			"tools":        []string{"task", "task_append", "task_query", "task_output", "task_stop"},
+			"builtinTools": []string{"task", "task_append", "task_query", "task_output", "task_stop"}, "skills": []string{},
+			"features": map[string]bool{"mavis": false, "delegation": true, "webSearch": false},
+		}}
 	}
 	config["permissionMode"] = "auto"
 	servers := map[string]any{}
@@ -155,35 +150,23 @@ func writeNativeConfig(req proto.PromptRequestPayload, prepared harnessconfig.Pr
 	if err := data.WriteFile("config.yaml", raw, 0o600); err != nil {
 		return err
 	}
-	if req.StrictResume {
-		if raw, err = json.Marshal(map[string]any{"mcpServers": servers}); err != nil {
-			return err
-		}
-		if err := data.WriteFile("mcp.json", raw, 0o600); err != nil {
-			return err
-		}
+	if raw, err = json.Marshal(map[string]any{"mcpServers": servers}); err != nil {
+		return err
 	}
-	return nil
+	return data.WriteFile("mcp.json", raw, 0o600)
 }
 
 // nativeEnvironment is the adapter's own native environment, with dataDir as
 // the native process sees its data directory. The adapter owns the native
 // state location, including after cold resume.
 func nativeEnvironment(req proto.PromptRequestPayload, dataDir string) []string {
-	var env []string
-	if req.StrictResume {
-		env = append(env, "OAC_RUNTIME_MCODE_TOOL_POLICY=protected-mcp-v1")
-		if !req.DisableSubagents {
-			env = append(env, "OAC_RUNTIME_MCODE_MAX_SUBAGENTS="+strconv.Itoa(*req.MaxConcurrentSubagents))
-		} else {
-			env = append(env, "OAC_RUNTIME_MCODE_MAX_SUBAGENTS=0")
-		}
+	env := []string{"OAC_RUNTIME_MCODE_TOOL_POLICY=protected-mcp-v1"}
+	if !req.DisableSubagents {
+		env = append(env, "OAC_RUNTIME_MCODE_MAX_SUBAGENTS="+strconv.Itoa(*req.MaxConcurrentSubagents))
+	} else {
+		env = append(env, "OAC_RUNTIME_MCODE_MAX_SUBAGENTS=0")
 	}
-	env = append(env, "MINIMAX_DATA_DIR="+dataDir)
-	if req.StrictResume {
-		env = append(env, "HOME="+dataDir, "USERPROFILE="+dataDir)
-	}
-	return env
+	return append(env, "MINIMAX_DATA_DIR="+dataDir, "HOME="+dataDir, "USERPROFILE="+dataDir)
 }
 
 // readData reads a file the native process wrote in its data directory,
@@ -212,26 +195,16 @@ func dataDirectory(req proto.PromptRequestPayload) (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("mcode: resolve data directory: %w", err)
 	}
-	base := filepath.Join(root, "runtime", "mcode")
-	if key := strings.TrimSpace(req.AgentStateKey); key != "" {
-		parts := []string{base, "state"}
-		for _, part := range strings.Split(key, "/") {
-			if safe := safePathPart(part); safe != "" {
-				parts = append(parts, safe)
-			}
+	parts := []string{root, "runtime", "mcode", "state"}
+	for _, part := range strings.Split(req.AgentStateKey, "/") {
+		if safe := safePathPart(part); safe != "" {
+			parts = append(parts, safe)
 		}
-		if len(parts) == 2 {
-			return "", fmt.Errorf("mcode: invalid agent state key %q", req.AgentStateKey)
-		}
-		return filepath.Join(parts...), nil
-	}
-	if id := safePathPart(req.ConversationID); id != "" {
-		return filepath.Join(base, "conv-"+id), nil
 	}
-	if id := safePathPart(req.RunID); id != "" {
-		return filepath.Join(base, "run-"+id), nil
+	if len(parts) == 4 {
+		return "", fmt.Errorf("mcode: invalid agent state key %q", req.AgentStateKey)
 	}
-	return "", errors.New("mcode: agent state key, conversation id, or run id is required")
+	return filepath.Join(parts...), nil
 }
 
 func safePathPart(value string) string {
diff --git a/apps/daemon/internal/agent/mcode/options_test.go b/apps/daemon/internal/agent/mcode/options_test.go
index 9c11b545a..13099f019 100644
--- a/apps/daemon/internal/agent/mcode/options_test.go
+++ b/apps/daemon/internal/agent/mcode/options_test.go
@@ -11,6 +11,7 @@ import (
 )
 
 func TestOptionsRefreshManagedState(t *testing.T) {
+	t.Setenv("MINIMAX_DATA_DIR", "/wrong")
 	req := testRequest(t)
 	opts, err := prepareOptions(req)
 	if err != nil {
@@ -19,7 +20,13 @@ func TestOptionsRefreshManagedState(t *testing.T) {
 	if !strings.HasPrefix(opts.Dir, os.Getenv("OAC_RUNTIME_HOME")+string(os.PathSeparator)) {
 		t.Fatalf("workdir escaped managed state: %s", opts.Dir)
 	}
-	if opts.Env[len(opts.Env)-1] != "MINIMAX_DATA_DIR="+opts.DataDir {
+	dataDir := ""
+	for _, entry := range opts.Env {
+		if value, ok := strings.CutPrefix(entry, "MINIMAX_DATA_DIR="); ok {
+			dataDir = value
+		}
+	}
+	if dataDir != opts.DataDir {
 		t.Fatal("native data directory is not the adapter's")
 	}
 	req.SystemPrompt = ""
@@ -97,11 +104,16 @@ func TestQuestionContentPreservesTypesAndValidates(t *testing.T) {
 	}
 }
 
-func TestDataDirectorySanitizesFallback(t *testing.T) {
+func TestDataDirectoryRequiresAgentState(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("OAC_RUNTIME_HOME", home)
-	got, err := dataDirectory(proto.PromptRequestPayload{ConversationID: "../conv name", RunID: "ignored"})
-	if want := filepath.Join(home, "runtime", "mcode", "conv-.._conv_name"); err != nil || got != want {
+	for _, key := range []string{"", " ", "../.."} {
+		if _, err := dataDirectory(proto.PromptRequestPayload{AgentStateKey: key, RunID: "ignored"}); err == nil {
+			t.Fatalf("state key %q accepted", key)
+		}
+	}
+	got, err := dataDirectory(proto.PromptRequestPayload{AgentStateKey: "../session-1/a b"})
+	if want := filepath.Join(home, "runtime", "mcode", "state", "session-1", "a_b"); err != nil || got != want {
 		t.Fatalf("data directory = %q, %v; want %q", got, err, want)
 	}
 }
diff --git a/apps/daemon/internal/agent/mcode/session.go b/apps/daemon/internal/agent/mcode/session.go
index fe6794a09..91766f1d5 100644
--- a/apps/daemon/internal/agent/mcode/session.go
+++ b/apps/daemon/internal/agent/mcode/session.go
@@ -87,7 +87,7 @@ func launch(ctx context.Context, req proto.PromptRequestPayload, opts launchOpti
 	if opts.script != "" {
 		args = []string{opts.script, "acp"}
 	}
-	process, err := start(clirunner.StartOptions{Parent: ctx, Binary: binary, Args: args, Dir: opts.Dir, Env: opts.Env, NeedStdin: true, OwnProcessGroup: req.StrictResume})
+	process, err := start(clirunner.StartOptions{Parent: ctx, Binary: binary, Args: args, Dir: opts.Dir, Env: opts.Env, NeedStdin: true})
 	if err != nil {
 		return nil, err
 	}
@@ -111,7 +111,7 @@ func (s *Session) run() {
 	defer close(s.finished)
 	err := s.prepareNative()
 	if err == nil {
-		if s.req.StrictResume && !s.req.DisableSubagents {
+		if !s.req.DisableSubagents {
 			var snapshot nativeSubagentSnapshot
 			snapshot, err = s.readSubagents(s.ctx)
 			s.subagentHistoryReady = err == nil
@@ -128,7 +128,7 @@ func (s *Session) run() {
 	if err == nil {
 		err = s.executePrompt()
 	}
-	if s.req.StrictResume && !s.req.DisableSubagents && s.subagentHistoryReady && s.out != nil {
+	if !s.req.DisableSubagents && s.subagentHistoryReady && s.out != nil {
 		observationErr := s.settleSubagents()
 		s.mu.Lock()
 		s.subagentSettlementError = observationErr
@@ -181,7 +181,7 @@ func (s *Session) prepareNative() error {
 	if initialized.ProtocolVersion != 1 {
 		return fmt.Errorf("mcode: unsupported ACP protocol version %d", initialized.ProtocolVersion)
 	}
-	if s.req.StrictResume && !s.req.DisableSubagents && (initialized.Meta.Subagents.Version != 1 || initialized.Meta.Subagents.WorkspaceTools != "protected-mcp-v1" || s.req.MaxConcurrentSubagents == nil || initialized.Meta.Subagents.MaxConcurrent != *s.req.MaxConcurrentSubagents) {
+	if !s.req.DisableSubagents && (initialized.Meta.Subagents.Version != 1 || initialized.Meta.Subagents.WorkspaceTools != "protected-mcp-v1" || s.req.MaxConcurrentSubagents == nil || initialized.Meta.Subagents.MaxConcurrent != *s.req.MaxConcurrentSubagents) {
 		return fmt.Errorf("mcode: native Subagent admission is unavailable")
 	}
 	params := map[string]any{"cwd": s.opts.Dir, "mcpServers": s.opts.MCP}
@@ -228,7 +228,7 @@ func (s *Session) executePrompt() error {
 	var result struct {
 		StopReason string `json:"stopReason"`
 	}
-	err = s.call("session/prompt", map[string]any{"sessionId": s.sessionID, "prompt": promptContent(prompt, s.req.StrictResume)}, &result, true)
+	err = s.call("session/prompt", map[string]any{"sessionId": s.sessionID, "prompt": promptContent(prompt)}, &result, true)
 	s.active = false
 	s.mu.Lock()
 	s.steeringReady = false
@@ -367,16 +367,13 @@ func (s *Session) Cancel(ctx context.Context) error {
 	if s.executor != nil {
 		return s.cancelTurn(ctx)
 	}
-	if s.req.StrictResume && !s.req.DisableSubagents {
+	if !s.req.DisableSubagents {
 		if err := s.cancelSubagents(ctx); err != nil {
 			s.process.Cancel()
 			return err
 		}
 	}
 	s.process.Cancel()
-	if !s.req.StrictResume {
-		return nil
-	}
 	select {
 	case <-s.exited:
 	case <-ctx.Done():
diff --git a/apps/daemon/internal/agent/mcode/session_test.go b/apps/daemon/internal/agent/mcode/session_test.go
index d075111a9..7e72086b8 100644
--- a/apps/daemon/internal/agent/mcode/session_test.go
+++ b/apps/daemon/internal/agent/mcode/session_test.go
@@ -19,17 +19,15 @@ import (
 func testRequest(t *testing.T) proto.PromptRequestPayload {
 	t.Helper()
 	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
-	return proto.PromptRequestPayload{RunID: "run-1", ConversationID: "conversation-1", AgentStateKey: "conversation-1/agent-1/mcode", Input: proto.TextInput("Hello"),
+	return proto.PromptRequestPayload{RunID: "run-1", AgentStateKey: "conversation-1/agent-1/mcode", Input: proto.TextInput("Hello"),
 		Model: "fixture", SystemPrompt: "Current instructions",
-		ModelProvider: &modelprovider.Provider{Protocol: modelprovider.Anthropic, BaseURL: "https://provider.example", APIKey: "fixture-key", ContextWindow: 64000, MaxOutputTokens: 4096}}
+		ModelProvider:               &modelprovider.Provider{Protocol: modelprovider.Anthropic, BaseURL: "https://provider.example", APIKey: "fixture-key", ContextWindow: 64000, MaxOutputTokens: 4096},
+		DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}}
 }
 
 func helperSession(t *testing.T, scenario string, resume bool) (*Session, <-chan proto.Envelope) {
 	t.Helper()
 	req := testRequest(t)
-	if scenario == "strict-cancel" {
-		req = executionRequest(t)
-	}
 	if resume {
 		req.AgentSessionID = "native-1"
 	}
@@ -273,7 +271,7 @@ func TestMCodeProcess(t *testing.T) {
 				Prompt []map[string]string `json:"prompt"`
 			}
 			_ = json.Unmarshal(frame.Params, &input)
-			if strict := scenario == "strict-cancel" || (strings.HasPrefix(scenario, "prepared") || strings.HasPrefix(scenario, "executor")); (strict && len(input.Prompt) != 2) || (!strict && len(input.Prompt) != 1) {
+			if len(input.Prompt) != 2 {
 				os.Exit(9)
 			}
 			if strings.HasPrefix(scenario, "executor") {
@@ -287,7 +285,7 @@ func TestMCodeProcess(t *testing.T) {
 					continue
 				}
 				update("agent_message_chunk", map[string]any{"content": map[string]string{"type": "text", "text": input.Prompt[0]["text"]}})
-				update("tool_call", map[string]any{"toolCallId": "repeated-call", "name": "Read", "status": "in_progress", "rawInput": map[string]any{}})
+				update("tool_call", map[string]any{"toolCallId": "repeated-call", "name": "mcp__oac_workspace__workspace_bash", "status": "in_progress", "rawInput": map[string]any{"command": "true"}})
 				update("tool_call_update", map[string]any{"toolCallId": "repeated-call", "status": "completed"})
 				raw, _ := json.Marshal(map[string]string{"stopReason": "end_turn"})
 				send(rpcFrame{JSONRPC: "2.0", ID: frame.ID, Result: raw})
@@ -303,7 +301,7 @@ func TestMCodeProcess(t *testing.T) {
 				update("tool_call", map[string]any{"toolCallId": "native-call", "name": "mcp__proof_server__read_status", "status": "in_progress", "rawInput": map[string]any{}})
 				continue
 			}
-			if scenario == "steering" || scenario == "steer-rejected" || scenario == "steer-lost" || scenario == "strict-cancel" {
+			if scenario == "steering" || scenario == "steer-rejected" || scenario == "steer-lost" || scenario == "cancel-wait" {
 				promptID = frame.ID
 				update("agent_message_chunk", map[string]any{"content": map[string]string{"type": "text", "text": "ready"}})
 				continue
@@ -326,7 +324,7 @@ func TestMCodeProcess(t *testing.T) {
 			}
 			update("agent_message_chunk", map[string]any{"content": map[string]string{"type": "text", "text": "Hello "}})
 			update("agent_message_chunk", map[string]any{"content": map[string]string{"type": "text", "text": "world"}})
-			update("tool_call", map[string]any{"toolCallId": "tool-1", "name": "Read", "status": "in_progress", "rawInput": map[string]any{"path": "fixture.txt"}})
+			update("tool_call", map[string]any{"toolCallId": "tool-1", "name": "mcp__oac_workspace__workspace_bash", "status": "in_progress", "rawInput": map[string]any{"command": "cat fixture.txt"}})
 			for range 2 {
 				update("tool_call_update", map[string]any{"toolCallId": "tool-1", "status": "completed", "rawOutput": "fixture"})
 			}
diff --git a/apps/daemon/internal/agent/mcode/steering_test.go b/apps/daemon/internal/agent/mcode/steering_test.go
index 2c4cc517a..1ecdb5af1 100644
--- a/apps/daemon/internal/agent/mcode/steering_test.go
+++ b/apps/daemon/internal/agent/mcode/steering_test.go
@@ -85,7 +85,7 @@ func TestTerminalFollowsAllNativeFrames(t *testing.T) {
 }
 
 func TestExecutionCancellationWaitsForOutputAndProcess(t *testing.T) {
-	s, out := helperSession(t, "strict-cancel", false)
+	s, out := helperSession(t, "cancel-wait", false)
 	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
 	defer cancel()
 	select {
diff --git a/apps/daemon/internal/agent/mcode/tool_environment_test.go b/apps/daemon/internal/agent/mcode/tool_environment_test.go
index 557ff5dfa..ab6accd5a 100644
--- a/apps/daemon/internal/agent/mcode/tool_environment_test.go
+++ b/apps/daemon/internal/agent/mcode/tool_environment_test.go
@@ -60,7 +60,7 @@ func TestWorkspaceCredentialsRemainInRuntimeSnapshotAcrossReconnect(t *testing.T
 		if err != nil {
 			t.Fatal(err)
 		}
-		opts, err := prepareWorkspaceOptions(t.Context(), config, prepared)
+		opts, err := prepareWorkspaceOptions(config, prepared)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -125,7 +125,7 @@ func TestWorkspaceRejectsInvalidToolEnvironment(t *testing.T) {
 	}
 	t.Setenv("OAC_RUNTIME_TOOL_ENV_FILE", file)
 	t.Setenv("OAC_RUNTIME_INITIALIZATION_DIRECTORY", t.TempDir())
-	if _, err := prepareWorkspaceOptions(t.Context(), config, req); err == nil {
+	if _, err := prepareWorkspaceOptions(config, req); err == nil {
 		t.Fatal("invalid explicit tool configuration was ignored")
 	}
 }
diff --git a/apps/daemon/internal/agent/mcode/tool_observations.go b/apps/daemon/internal/agent/mcode/tool_observations.go
index 7f6ba9f9c..1dbd6d643 100644
--- a/apps/daemon/internal/agent/mcode/tool_observations.go
+++ b/apps/daemon/internal/agent/mcode/tool_observations.go
@@ -11,20 +11,18 @@ func (s *Session) emitToolStage(update toolUpdate, stage string) error {
 	if stage == "after" {
 		payload.Result = map[string]any{"output": update.RawOutput, "status": update.Status}
 	}
-	if s.req.ObserveToolObservations {
-		payload.Observation = workspaceToolObservation(update, stage)
-		if payload.Observation == nil {
-			var err error
-			payload.Observation, err = environmentMCPObservation(update, stage)
-			if err != nil {
-				return err
-			}
-		}
-		// Native task/skill bookkeeping has no qualified public item mapping.
-		if payload.Observation == nil {
-			return nil
+	payload.Observation = workspaceToolObservation(update, stage)
+	if payload.Observation == nil {
+		var err error
+		payload.Observation, err = environmentMCPObservation(update, stage)
+		if err != nil {
+			return err
 		}
 	}
+	// Native task/skill bookkeeping has no qualified public item mapping.
+	if payload.Observation == nil {
+		return nil
+	}
 	s.emit(proto.TypeToolCall, payload)
 	return nil
 }
diff --git a/apps/daemon/internal/agent/mcode/tool_observations_test.go b/apps/daemon/internal/agent/mcode/tool_observations_test.go
index e9011d503..c7d1fa6da 100644
--- a/apps/daemon/internal/agent/mcode/tool_observations_test.go
+++ b/apps/daemon/internal/agent/mcode/tool_observations_test.go
@@ -12,7 +12,7 @@ func TestWorkspaceCommandObservationsWaitForArgumentsAndRetainOutcome(t *testing
 	for _, status := range []string{"completed", "failed"} {
 		t.Run(status, func(t *testing.T) {
 			out := make(chan proto.Envelope, 8)
-			s := &Session{ctx: context.Background(), req: proto.PromptRequestPayload{RunID: "run", ObserveToolObservations: true}, out: out, tools: map[string]toolUpdate{}, completedTools: map[string]bool{}}
+			s := &Session{ctx: context.Background(), req: proto.PromptRequestPayload{RunID: "run"}, out: out, tools: map[string]toolUpdate{}, completedTools: map[string]bool{}}
 			s.emitTool(toolUpdate{ID: "call", Name: "mcp__oac_workspace__workspace_bash"})
 			if len(out) != 0 {
 				t.Fatal("command item emitted before native arguments")
diff --git a/apps/daemon/internal/agent/mcode/view.go b/apps/daemon/internal/agent/mcode/view.go
index 6e32f6b8d..f6058f1f2 100644
--- a/apps/daemon/internal/agent/mcode/view.go
+++ b/apps/daemon/internal/agent/mcode/view.go
@@ -131,12 +131,12 @@ func (i viewInstall) view() agent.View {
 		ShimPaths: []string{"/bin/bash"},
 		Proxy:     agent.ViewProxyNone,
 		Capabilities: agent.ViewCapabilities{
-			EnvironmentNone:      proto.CapabilityUnsupported,
+			EnvironmentNone:      proto.CapabilitySupported,
 			Skills:               proto.CapabilityUnsupported,
 			FunctionTools:        proto.CapabilityUnsupported,
 			FunctionResultImages: proto.CapabilityUnsupported,
 			ToolSearch:           proto.CapabilityUnsupported,
-			StdioMCP:             proto.CapabilityUnsupported,
+			StdioMCP:             proto.CapabilitySupported,
 		},
 		Executor: i.executor,
 	}
@@ -145,26 +145,30 @@ func (i viewInstall) view() agent.View {
 }
 
 func (i viewInstall) executor(ctx context.Context, req proto.PromptRequestPayload, session agent.ViewSession) (agent.Executor, error) {
-	return startExecutor(ctx, req, i.node, func(ctx context.Context) (launchOptions, error) {
-		return i.prepare(ctx, req, session)
+	return startExecutor(ctx, req, i.node, func() (launchOptions, error) {
+		return i.prepare(req, session)
 	})
 }
 
 // prepare writes the native configuration into the Session home and renders
 // a closed environment. The CLI and its worker use the gateway the request
-// names and the MCP in session; the request's workspace is the sandbox's.
-func (i viewInstall) prepare(_ context.Context, req proto.PromptRequestPayload, session agent.ViewSession) (launchOptions, error) {
+// names and the MCP in session. The request's workspace is the sandbox's, and
+// the workspace tools present it; with environment none the CLI runs in the
+// work directory without them.
+func (i viewInstall) prepare(req proto.PromptRequestPayload, session agent.ViewSession) (launchOptions, error) {
 	local := req.LocalEnvironment
-	if !req.StrictResume || local == nil || req.DisableExecutionEnvironment || req.WorkspaceReadOnly {
-		return launchOptions{}, fmt.Errorf("%w: a MiniMax Code view runs Agents API execution in a writable Environment workspace", agent.ErrUnsupportedOperation)
+	if (local == nil) != req.DisableExecutionEnvironment || req.WorkspaceReadOnly {
+		return launchOptions{}, fmt.Errorf("%w: a MiniMax Code view runs Agents API execution in a writable Environment workspace or with environment none", agent.ErrUnsupportedOperation)
 	}
-	workspace := local.WorkspaceRoot
-	if !path.IsAbs(workspace) || path.Clean(workspace) != workspace || workspace == "/" {
+	dir := path.Join(session.Home.View, agent.ViewWorkName)
+	if local != nil {
+		dir = local.WorkspaceRoot
+	}
+	if !path.IsAbs(dir) || path.Clean(dir) != dir || dir == "/" {
 		return launchOptions{}, errors.New("mcode: the workspace is not a canonical absolute path")
 	}
-	servers, err := workspaceMCP(session.MCP, func(agent.MCPBinding) (map[string]any, error) {
-		return nil, fmt.Errorf("%w: a MiniMax Code view does not run stdio MCP", agent.ErrUnsupportedOperation)
-	})
+	// The Harness runs each stdio alias without arguments.
+	servers, err := workspaceMCP(session.MCP, func(stdio proto.EnvironmentMCP) (string, []string) { return stdio.Server.Command, []string{} })
 	if err != nil {
 		return launchOptions{}, err
 	}
@@ -191,15 +195,20 @@ func (i viewInstall) prepare(_ context.Context, req proto.PromptRequestPayload,
 		return launchOptions{}, err
 	}
 	defer data.Close()
-	opts := launchOptions{Dir: workspace, DataDir: filepath.Join(session.Home.Host, viewDataName), bindings: session.MCP,
+	opts := launchOptions{Dir: dir, DataDir: filepath.Join(session.Home.Host, viewDataName), bindings: session.MCP,
 		start: session.Launch, script: i.cli, home: session.Home.Host}
 	dataDir, tempDir := path.Join(session.Home.View, viewDataName), path.Join(session.Home.View, viewTempName)
-	tools := workspaceTools{node: i.node, bridge: i.bridge, profile: map[string]any{"workspace": workspace, "scratch": tempDir, "network": "enabled"}}
-	if err := writeNativeConfig(private, prepared, data, dataDir, &tools); err != nil {
+	var tools *workspaceTools
+	opts.MCP = []map[string]any{}
+	if local != nil {
+		tools = &workspaceTools{node: i.node, bridge: i.bridge, profile: map[string]any{"workspace": dir, "scratch": tempDir, "network": "enabled"}}
+		opts.MCP = append(opts.MCP, tools.server(dataDir))
+	}
+	if err := writeNativeConfig(private, prepared, data, dataDir, tools); err != nil {
 		return opts, err
 	}
 	opts.Model = prepared.Model
-	opts.MCP = append([]map[string]any{tools.server(dataDir)}, servers...)
+	opts.MCP = append(opts.MCP, servers...)
 	opts.Env = []string{
 		"PATH=" + path.Join(agent.ViewPrivateRoot, agent.ViewShimName),
 		"TMPDIR=" + tempDir,
@@ -213,6 +222,6 @@ func (i viewInstall) prepare(_ context.Context, req proto.PromptRequestPayload,
 	}
 	opts.Env = append(opts.Env, nativeEnvironment(private, dataDir)...)
 	opts.spawn = session.Spawn
-	opts.reader = clirunner.StartOptions{Binary: i.node, Args: []string{path.Join(path.Dir(i.bridge), "subagent-snapshot.mjs"), dataDir}, Dir: dataDir, Env: opts.Env, OwnProcessGroup: true}
+	opts.reader = clirunner.StartOptions{Binary: i.node, Args: []string{path.Join(path.Dir(i.bridge), "subagent-snapshot.mjs"), dataDir}, Dir: dataDir, Env: opts.Env}
 	return opts, nil
 }
diff --git a/apps/daemon/internal/agent/mcode/view_test.go b/apps/daemon/internal/agent/mcode/view_test.go
index 263b8f25c..7b6d3a953 100644
--- a/apps/daemon/internal/agent/mcode/view_test.go
+++ b/apps/daemon/internal/agent/mcode/view_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/clirunner"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/viewloader"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentplugin"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/modelprovider"
 )
 
@@ -55,8 +56,8 @@ func viewFixture(t *testing.T) (viewInstall, agent.View, proto.PromptRequestPayl
 
 	t.Setenv("OAC_TEST_VIEW_SENTINEL", "daemon-only")
 	t.Setenv("ANTHROPIC_API_KEY", viewRealKey)
-	req := executionRequest(t)
-	req.RunID, req.Input, req.ConversationID = "", nil, ""
+	req := testRequest(t)
+	req.RunID, req.Input = "", nil
 	req.DisableExecutionEnvironment = false
 	req.LocalEnvironment = &proto.LocalEnvironment{WorkspaceRoot: "/workspace", NetworkAccess: "enabled"}
 	req.ModelProvider = &modelprovider.Provider{Protocol: modelprovider.Anthropic, BaseURL: "http://127.0.0.1:4101", APIKey: modelprovider.Placeholder, ContextWindow: 64000, MaxOutputTokens: 4096}
@@ -119,6 +120,28 @@ func TestViewLaunchesNodeWithGatewayOnly(t *testing.T) {
 	}
 }
 
+// With environment none the CLI runs in the work directory without the
+// workspace tools, and it runs each stdio binding's alias without arguments.
+func TestViewRunsEnvironmentNoneAndStdioAliases(t *testing.T) {
+	install, _, req := viewFixture(t)
+	session := agent.ViewSession{Home: agent.ViewDir{Host: t.TempDir(), View: path.Join(agent.ViewPrivateRoot, agent.ViewHomeName)}}
+	none := req
+	none.LocalEnvironment, none.DisableExecutionEnvironment = nil, true
+	opts, err := install.prepare(none, session)
+	if err != nil || opts.Dir != "/.oac/home/work" || opts.MCP == nil || len(opts.MCP) != 0 {
+		t.Fatalf("environment none runs in %q with MCP %v: %v", opts.Dir, opts.MCP, err)
+	}
+
+	session.MCP = []agent.MCPBinding{{ServerLabel: "local", ConnectionOrigin: "environment", CredentialAuthority: "none", Transport: "stdio", Stdio: &proto.EnvironmentMCP{
+		Server: agentplugin.MCPServer{Name: "local", Type: "stdio", Command: agent.ViewAlias(0)}}}}
+	if opts, err = install.prepare(req, session); err != nil || len(opts.MCP) != 2 || opts.MCP[0]["name"] != "oac_workspace" || opts.MCP[1]["command"] != agent.ViewAlias(0) {
+		t.Fatalf("stdio MCP = %v: %v", opts.MCP, err)
+	}
+	if args, ok := opts.MCP[1]["args"].([]string); !ok || args == nil || len(args) != 0 {
+		t.Fatalf("the stdio alias runs with arguments %#v", opts.MCP[1]["args"])
+	}
+}
+
 func TestViewReadsSubagentsBesideTheCLI(t *testing.T) {
 	install, _, req := viewFixture(t)
 	req.DisableSubagents, req.MaxConcurrentSubagents = false, new(2)
@@ -129,7 +152,7 @@ func TestViewReadsSubagentsBesideTheCLI(t *testing.T) {
 		spawned = options
 		return clirunner.Start(clirunner.StartOptions{Parent: options.Parent, Binary: "/bin/echo", Args: []string{`{"version":1,"complete":true,"rootSessionId":"root"}`}})
 	}
-	opts, err := install.prepare(t.Context(), req, session)
+	opts, err := install.prepare(req, session)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -139,7 +162,7 @@ func TestViewReadsSubagentsBesideTheCLI(t *testing.T) {
 	}
 	data := path.Join(session.Home.View, viewDataName)
 	args := []string{"--disable-warning=ExperimentalWarning", path.Join(path.Dir(install.bridge), "subagent-snapshot.mjs"), data, "root"}
-	if spawned.Binary != install.node || !slices.Equal(spawned.Args, args) || spawned.Dir != data || !spawned.OwnProcessGroup || !slices.Contains(spawned.Env, "LD_LIBRARY_PATH="+install.loader.LibraryPath) {
+	if spawned.Binary != install.node || !slices.Equal(spawned.Args, args) || spawned.Dir != data || !slices.Contains(spawned.Env, "LD_LIBRARY_PATH="+install.loader.LibraryPath) {
 		t.Fatalf("spawned %+v", spawned)
 	}
 }
diff --git a/apps/daemon/internal/agent/mcode/workspace.go b/apps/daemon/internal/agent/mcode/workspace.go
index 459302897..61bcb719a 100644
--- a/apps/daemon/internal/agent/mcode/workspace.go
+++ b/apps/daemon/internal/agent/mcode/workspace.go
@@ -1,7 +1,6 @@
 package mcode
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -49,11 +48,11 @@ func ConfigureLocal(binary, node, bridge, root, workspace string, network agentn
 	return c, nil
 }
 
-func prepareWorkspaceOptions(ctx context.Context, c WorkspaceConfig, req proto.PromptRequestPayload) (launchOptions, error) {
+func prepareWorkspaceOptions(c WorkspaceConfig, req proto.PromptRequestPayload) (launchOptions, error) {
 	if c.Network != "enabled" || len(c.AllowedDomains) != 0 {
 		return launchOptions{}, fmt.Errorf("mcode: Runtime does not implement network isolation")
 	}
-	if !req.StrictResume || req.LocalEnvironment == nil || req.LocalEnvironment.WorkspaceRoot != c.Directory || req.DisableExecutionEnvironment || !(agentnetwork.Policy{Access: c.Network, AllowedDomains: c.AllowedDomains}).Equal(agentnetwork.Policy{Access: req.LocalEnvironment.NetworkAccess, AllowedDomains: req.LocalEnvironment.AllowedDomains}) || req.WorkspaceReadOnly {
+	if req.LocalEnvironment == nil || req.LocalEnvironment.WorkspaceRoot != c.Directory || req.DisableExecutionEnvironment || !(agentnetwork.Policy{Access: c.Network, AllowedDomains: c.AllowedDomains}).Equal(agentnetwork.Policy{Access: req.LocalEnvironment.NetworkAccess, AllowedDomains: req.LocalEnvironment.AllowedDomains}) || req.WorkspaceReadOnly {
 		return launchOptions{}, fmt.Errorf("mcode: execution does not match the dedicated workspace")
 	}
 	servers, bindings, err := runtimeMCP(req)
diff --git a/apps/daemon/internal/agent/mcode/workspace_network_test.go b/apps/daemon/internal/agent/mcode/workspace_network_test.go
index a42d387cd..83b3156ee 100644
--- a/apps/daemon/internal/agent/mcode/workspace_network_test.go
+++ b/apps/daemon/internal/agent/mcode/workspace_network_test.go
@@ -7,7 +7,7 @@ func TestWorkspaceRejectsInnerNetworkIsolation(t *testing.T) {
 		c, req, _ := workspaceFixture(t)
 		c.Network = access
 		req.LocalEnvironment.NetworkAccess = access
-		if _, err := prepareWorkspaceOptions(t.Context(), c, req); err == nil {
+		if _, err := prepareWorkspaceOptions(c, req); err == nil {
 			t.Fatal("unsupported network isolation accepted")
 		}
 	}
diff --git a/apps/daemon/internal/agent/mcode/workspace_readiness.go b/apps/daemon/internal/agent/mcode/workspace_readiness.go
index b730745b4..7f44d672a 100644
--- a/apps/daemon/internal/agent/mcode/workspace_readiness.go
+++ b/apps/daemon/internal/agent/mcode/workspace_readiness.go
@@ -16,7 +16,7 @@ import (
 func CheckWorkspace(ctx context.Context, c WorkspaceConfig) error {
 	ctx, cancel := context.WithTimeout(ctx, 15*time.Second)
 	defer cancel()
-	p, err := clirunner.Start(clirunner.StartOptions{Parent: ctx, Binary: c.Node, Args: []string{filepath.Join(filepath.Dir(c.Bridge), "check.mjs")}, Env: executionEnvironment(), OwnProcessGroup: true})
+	p, err := clirunner.Start(clirunner.StartOptions{Parent: ctx, Binary: c.Node, Args: []string{filepath.Join(filepath.Dir(c.Bridge), "check.mjs")}, Env: executionEnvironment()})
 	if err != nil {
 		return err
 	}
diff --git a/apps/daemon/internal/agent/mcode/workspace_skills_test.go b/apps/daemon/internal/agent/mcode/workspace_skills_test.go
index ed89e029f..0d7c9470d 100644
--- a/apps/daemon/internal/agent/mcode/workspace_skills_test.go
+++ b/apps/daemon/internal/agent/mcode/workspace_skills_test.go
@@ -28,7 +28,7 @@ func TestWorkspaceSkillsUseSelectedSnapshotAndNativeLoader(t *testing.T) {
 		Metadata: agentskill.Metadata{Name: "proof", Description: "Read a marker"},
 	}}
 	for range 2 {
-		opts, err := prepareWorkspaceOptions(t.Context(), c, req)
+		opts, err := prepareWorkspaceOptions(c, req)
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/apps/daemon/internal/agenthost/admit.go b/apps/daemon/internal/agenthost/admit.go
index cb1ab18b1..5dec68997 100644
--- a/apps/daemon/internal/agenthost/admit.go
+++ b/apps/daemon/internal/agenthost/admit.go
@@ -105,8 +105,6 @@ func admit(cfg Config, roots *x509.CertPool, req proto.PromptRequestPayload, env
 		return nil, unsupported("environment none")
 	case local != nil && !isViewPath(local.WorkspaceDirectory):
 		return nil, invalidSession("workspace %q is not absolute and clean", local.WorkspaceDirectory)
-	case !req.StrictResume:
-		return nil, unsupported("a Session without strict resume")
 	case local != nil && local.Capabilities && local.CapabilityRoot == "":
 		return nil, unsupported("installed Capabilities that no preparation resolved")
 	case local != nil && len(local.Skills) > 0 && !caps.Skills.IsSupported():
diff --git a/apps/daemon/internal/agenthost/admit_linux_test.go b/apps/daemon/internal/agenthost/admit_linux_test.go
index a6d6f7d3b..b9bda343a 100644
--- a/apps/daemon/internal/agenthost/admit_linux_test.go
+++ b/apps/daemon/internal/agenthost/admit_linux_test.go
@@ -85,7 +85,6 @@ func TestAdmissionRejectsBeforeAnyEffect(t *testing.T) {
 		"relative workspace":                 {"viewed", func(r *proto.PromptRequestPayload) { r.LocalEnvironment.WorkspaceDirectory = "workspace" }, []error{ErrInvalidSession}},
 		"no model provider":                  {"viewed", func(r *proto.PromptRequestPayload) { r.ModelProvider = nil }, []error{ErrUnsupported}},
 		// The typed rejections that hold whatever the view declares.
-		"no strict resume":        {"supporting", func(r *proto.PromptRequestPayload) { r.StrictResume = false }, unsupported},
 		"restricted network":      {"supporting", func(r *proto.PromptRequestPayload) { r.LocalEnvironment.NetworkAccess = "disabled" }, unsupported},
 		"allowed domains only":    {"supporting", func(r *proto.PromptRequestPayload) { r.LocalEnvironment.AllowedDomains = []string{"example.com"} }, unsupported},
 		"unprepared Capabilities": {"supporting", func(r *proto.PromptRequestPayload) { r.LocalEnvironment.Capabilities = true }, unsupported},
diff --git a/apps/daemon/internal/agenthost/agenthost_linux_test.go b/apps/daemon/internal/agenthost/agenthost_linux_test.go
index 7316189c3..09655db85 100644
--- a/apps/daemon/internal/agenthost/agenthost_linux_test.go
+++ b/apps/daemon/internal/agenthost/agenthost_linux_test.go
@@ -89,7 +89,6 @@ func declared(s proto.CapabilitySupport) agent.ViewCapabilities {
 func request(kind, workspace, baseURL, key string) proto.PromptRequestPayload {
 	return proto.PromptRequestPayload{
 		AgentKind:        kind,
-		StrictResume:     true,
 		Model:            "m",
 		ModelProvider:    &modelprovider.Provider{Protocol: modelprovider.Anthropic, BaseURL: baseURL, APIKey: key},
 		LocalEnvironment: &proto.LocalEnvironment{WorkspaceDirectory: workspace, NetworkAccess: "enabled"},
diff --git a/apps/daemon/internal/agenthost/launch_linux.go b/apps/daemon/internal/agenthost/launch_linux.go
index 3fde5e108..08456e20c 100644
--- a/apps/daemon/internal/agenthost/launch_linux.go
+++ b/apps/daemon/internal/agenthost/launch_linux.go
@@ -73,8 +73,6 @@ func (s *session) checkStart(opts clirunner.StartOptions) error {
 		return fmt.Errorf("%w: %w: %q", ErrLaunch, agent.ErrNotLocalExec, opts.Binary)
 	case !isViewPath(opts.Dir):
 		return fmt.Errorf("%w: directory %q is not absolute and clean", ErrLaunch, opts.Dir)
-	case !opts.OwnProcessGroup:
-		return fmt.Errorf("%w: a view process runs in its own process group", ErrLaunch)
 	}
 	return nil
 }
diff --git a/apps/daemon/internal/agenthost/session_linux_test.go b/apps/daemon/internal/agenthost/session_linux_test.go
index 19ca04298..f705fcdc9 100644
--- a/apps/daemon/internal/agenthost/session_linux_test.go
+++ b/apps/daemon/internal/agenthost/session_linux_test.go
@@ -145,7 +145,7 @@ func TestSpawnKeepsItsErrors(t *testing.T) {
 		s, _ := newOwnerSession(t)
 		s.plan = &plan{view: agent.View{LocalExec: []string{"/bin/true"}}}
 		s.live = &liveView{view: &fakeView{exit: make(chan struct{}), spawnErr: c.err}}
-		_, err := s.spawn(clirunner.StartOptions{Binary: "/bin/true", Dir: "/", OwnProcessGroup: true})
+		_, err := s.spawn(clirunner.StartOptions{Binary: "/bin/true", Dir: "/"})
 		if !errors.Is(err, c.err) || errors.Is(err, agent.ErrNoLiveView) != c.ended {
 			t.Errorf("Spawn failing with %v = %v; want that error, and ErrNoLiveView only for an ended view", c.err, err)
 		}
diff --git a/apps/daemon/internal/agenthost/view_linux_test.go b/apps/daemon/internal/agenthost/view_linux_test.go
index f4bac56cb..f99b145d3 100644
--- a/apps/daemon/internal/agenthost/view_linux_test.go
+++ b/apps/daemon/internal/agenthost/view_linux_test.go
@@ -159,10 +159,10 @@ func TestSessionRunsInAViewOverItsAttachment(t *testing.T) {
 		}
 		// The Turn waited for its Harness, so no view runs.
 		s := d.session(b)
-		if _, err := s.spawn(clirunner.StartOptions{Binary: harnessPath, Dir: workspace, OwnProcessGroup: true}); !errors.Is(err, agent.ErrNoLiveView) {
+		if _, err := s.spawn(clirunner.StartOptions{Binary: harnessPath, Dir: workspace}); !errors.Is(err, agent.ErrNoLiveView) {
 			t.Errorf("Spawn after the Harness exited = %v, want ErrNoLiveView", err)
 		}
-		if _, err := s.spawn(clirunner.StartOptions{Binary: "/bin/sh", Dir: workspace, OwnProcessGroup: true}); !errors.Is(err, agent.ErrNotLocalExec) {
+		if _, err := s.spawn(clirunner.StartOptions{Binary: "/bin/sh", Dir: workspace}); !errors.Is(err, agent.ErrNotLocalExec) {
 			t.Errorf("Spawn of a binary outside LocalExec = %v, want ErrNotLocalExec", err)
 		}
 		select {
@@ -266,7 +266,7 @@ func TestSessionRunsInAViewOverItsAttachment(t *testing.T) {
 		until(t, "the Harness to run", beating)
 		// A Subagent runs in the live view.
 		p, err := d.session(waiting).spawn(clirunner.StartOptions{Binary: harnessPath, Args: []string{"touch"}, Dir: workspace,
-			Env: []string{harnessEnv + "=1"}, OwnProcessGroup: true})
+			Env: []string{harnessEnv + "=1"}})
 		if err != nil {
 			t.Fatalf("Spawn in the live view: %v", err)
 		}
@@ -667,7 +667,7 @@ type testExecutor struct {
 func (e *testExecutor) StartTurn(_ context.Context, runID string, input proto.MessageInput, out chan<- proto.Envelope) (agent.Turn, error) {
 	mode := *input[0].Content[0].Text
 	p, err := e.session.Launch(clirunner.StartOptions{Binary: harnessPath, Args: []string{mode}, Dir: e.dir, Env: e.env,
-		OwnProcessGroup: true, KillTimeout: time.Second})
+		KillTimeout: time.Second})
 	if err != nil {
 		return nil, err
 	}
diff --git a/apps/daemon/internal/agenthostqualify/qualify_linux_test.go b/apps/daemon/internal/agenthostqualify/qualify_linux_test.go
index 5478627f1..f7e4b915d 100644
--- a/apps/daemon/internal/agenthostqualify/qualify_linux_test.go
+++ b/apps/daemon/internal/agenthostqualify/qualify_linux_test.go
@@ -19,6 +19,7 @@ import (
 	"image"
 	"image/png"
 	"io"
+	"io/fs"
 	"log/slog"
 	"math/big"
 	"net/http/httptest"
@@ -39,6 +40,7 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/sessionview"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/sessionview/sessionviewtest"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentplugin"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/sandboxbootstrap"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/sandboxfs"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/sandboxlink"
@@ -122,7 +124,11 @@ func TestHarnessSessionsAgainstTheSandbox(t *testing.T) {
 // the value and the status. A view that declares function tools runs a second
 // Turn in a new Executor, which resumes the Session's native history, and
 // calls a function there. A view that declares tool search runs a Turn in
-// another Session that finds the function, deferred, with tool search.
+// another Session that finds the function, deferred, with tool search. A view
+// that declares environment none answers a Turn in a Session without an
+// Environment, and its native state names the work directory.
+// A view that declares stdio MCP calls a tool of a stdio MCP server that runs
+// in the sandbox.
 func qualify(t *testing.T, h *agenthost.Host, cfg agenthost.Config, sb *sandbox, kind string, caps agent.ViewCapabilities, model proto.PromptRequestPayload) {
 	name := "qualify-" + kind + ".txt"
 	value, content := strings.ToLower(rand.Text()), "qualified "+strings.ToLower(rand.Text()[:12])
@@ -138,7 +144,7 @@ func qualify(t *testing.T, h *agenthost.Host, cfg agenthost.Config, sb *sandbox,
 		Sandbox: map[string]string{"PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "HOME": "/home/runtime", "LANG": "C.UTF-8"},
 		Tool:    map[string]string{"QUALIFY_VALUE": value, "QUALIFY_EXIT": fmt.Sprint(exit)},
 	}
-	configuration := proto.PromptRequestPayload{AgentKind: kind, StrictResume: true, DisableSubagents: true,
+	configuration := proto.PromptRequestPayload{AgentKind: kind, DisableSubagents: true,
 		Model: model.Model, ModelProvider: model.ModelProvider, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"},
 		LocalEnvironment: &proto.LocalEnvironment{WorkspaceDirectory: workspace, NetworkAccess: "enabled"}}
 	if caps.FunctionTools.IsSupported() {
@@ -175,8 +181,51 @@ func qualify(t *testing.T, h *agenthost.Host, cfg agenthost.Config, sb *sandbox,
 		done, calls := search.turn(t, "tool-search", k.prompt("Search your tools for the function that looks up support tickets"), k)
 		k.check(t, done, calls)
 	}
+	if caps.EnvironmentNone.IsSupported() {
+		none := configuration
+		none.LocalEnvironment, none.DisableExecutionEnvironment, none.FunctionTools, none.ToolSearch = nil, true, nil, false
+		s := sb.session(h, cfg, agenthost.Environment{}, none)
+		done, _ := s.turn(t, "environment-none", "What is 17 times 23? Answer with exactly one line: PRODUCT=<the number>", k)
+		if !strings.Contains(done.Content, "PRODUCT=391") {
+			t.Errorf("the answer %q does not report PRODUCT=391", done.Content)
+		}
+		s.checkCwd(t, agent.ViewPrivateRoot+"/"+agent.ViewHomeName+"/"+agent.ViewWorkName)
+	}
+	if caps.StdioMCP.IsSupported() {
+		code := strings.ToLower(rand.Text()[:12])
+		stdio := configuration
+		stdio.FunctionTools, stdio.ToolSearch = nil, false
+		s := sb.session(h, cfg, env, stdio)
+		s.mcp = []proto.EnvironmentMCP{{InstallationRoot: workspace, Server: agentplugin.MCPServer{Name: "qualify", Type: "stdio", Command: "python3", Args: []string{"-c", mcpServer, code}}}}
+		done, _ := s.turn(t, "stdio-mcp", "Call the reveal_code tool of the qualify MCP server once.\nAnswer with exactly one line: CODE=<the code it returns>", k)
+		if !strings.Contains(done.Content, "CODE="+code) {
+			t.Errorf("the answer %q does not report CODE=%s", done.Content, code)
+		}
+	}
 }
 
+// mcpServer is a stdio MCP server whose one tool returns the code in its
+// argument.
+const mcpServer = `import json, sys
+code = sys.argv[1]
+for line in iter(sys.stdin.readline, ""):
+    msg = json.loads(line) if line.strip() else {}
+    if "id" not in msg or "method" not in msg:
+        continue
+    method, reply = msg["method"], {"jsonrpc": "2.0", "id": msg["id"]}
+    if method == "initialize":
+        reply["result"] = {"protocolVersion": msg["params"]["protocolVersion"], "capabilities": {"tools": {}}, "serverInfo": {"name": "qualify", "version": "1"}}
+    elif method == "tools/list":
+        reply["result"] = {"tools": [{"name": "reveal_code", "description": "Returns the qualification code.", "inputSchema": {"type": "object", "properties": {}}}]}
+    elif method == "tools/call":
+        reply["result"] = {"content": [{"type": "text", "text": "The code is " + code + "."}]}
+    elif method == "ping":
+        reply["result"] = {}
+    else:
+        reply["error"] = {"code": -32601, "message": "method not found"}
+    print(json.dumps(reply), flush=True)
+`
+
 // lookupTicket is the function the function Turns call.
 var lookupTicket = proto.FunctionTool{Name: "lookup_ticket", Description: "Looks up a support ticket by its number.",
 	Parameters: json.RawMessage(`{"type":"object","properties":{"ticket":{"type":"string","description":"The ticket number"}},"required":["ticket"],"additionalProperties":false}`)}
@@ -227,6 +276,9 @@ type session struct {
 	env           agenthost.Environment
 	id            string
 	configuration proto.PromptRequestPayload
+	// mcp is the installed MCP that the Environment's preparation resolves
+	// into each request; the wire does not carry it.
+	mcp []proto.EnvironmentMCP
 }
 
 func (sb *sandbox) session(h *agenthost.Host, cfg agenthost.Config, env agenthost.Environment, configuration proto.PromptRequestPayload) *session {
@@ -242,10 +294,13 @@ func (sb *sandbox) session(h *agenthost.Host, cfg agenthost.Config, env agenthos
 func (s *session) turn(t *testing.T, run, prompt string, k ticket) (proto.DonePayload, []proto.FunctionCallPayload) {
 	t.Helper()
 	out := make(sender, 256)
-	router, err := dispatch.New(dispatch.Config{Sender: out, SessionEnvironments: true, Log: s.cfg.Log,
-		Registry: s.h.Registry(func(proto.PromptRequestPayload) (agenthost.Binding, agenthost.Environment, error) {
-			return s.binding, s.env, nil
-		})})
+	reg := s.h.Registry(func(proto.PromptRequestPayload) (agenthost.Binding, agenthost.Environment, error) {
+		return s.binding, s.env, nil
+	})
+	if s.mcp != nil {
+		reg = withMCP(t, reg, s.mcp)
+	}
+	router, err := dispatch.New(dispatch.Config{Sender: out, SessionEnvironments: true, Log: s.cfg.Log, Registry: reg})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -266,6 +321,51 @@ func (s *session) turn(t *testing.T, run, prompt string, k ticket) (proto.DonePa
 	return done, calls
 }
 
+// withMCP wraps reg so that each request's Environment carries mcp.
+func withMCP(t *testing.T, reg *agent.Registry, mcp []proto.EnvironmentMCP) *agent.Registry {
+	wrapped := agent.NewRegistry()
+	for _, info := range reg.SupportedAgentKinds() {
+		configuration, err := reg.Configuration(info.Kind)
+		direct, directErr := reg.Resolve(info.Kind)
+		factory, factoryErr := reg.ResolveExecutor(info.Kind)
+		if err := errors.Join(err, directErr, factoryErr); err != nil {
+			t.Fatal(err)
+		}
+		wrapped.RegisterKind(info, configuration, direct)
+		wrapped.RegisterExecutor(info.Kind, func(ctx context.Context, req proto.PromptRequestPayload) (agent.Executor, error) {
+			local := *req.LocalEnvironment
+			local.MCP = mcp
+			req.LocalEnvironment = &local
+			return factory(ctx, req)
+		})
+	}
+	return wrapped
+}
+
+// checkCwd checks that the Harness's native state in the Session home names
+// cwd, which the adapter writes into none of its files there.
+func (s *session) checkCwd(t *testing.T, cwd string) {
+	t.Helper()
+	want := []byte(cwd)
+	home := filepath.Join(s.cfg.StateDir, "sessions", s.binding.SessionID.String(), agent.ViewHomeName)
+	var found string
+	err := filepath.WalkDir(home, func(name string, entry fs.DirEntry, err error) error {
+		if err != nil || found != "" || !entry.Type().IsRegular() {
+			return err
+		}
+		if body, err := os.ReadFile(name); err != nil || bytes.Contains(body, want) {
+			found = name
+			return err
+		}
+		return nil
+	})
+	if err != nil || found == "" {
+		t.Errorf("no native state in %s names %s: %v", home, want, err)
+		return
+	}
+	t.Logf("%s names %s", found, want)
+}
+
 func handle(t *testing.T, router *dispatch.Router, typ, id string, payload any) {
 	t.Helper()
 	e, err := proto.NewEnvelope(typ, id, payload)
diff --git a/apps/daemon/internal/auth/store.go b/apps/daemon/internal/auth/store.go
index 0bef9bbf6..ec636f67e 100644
--- a/apps/daemon/internal/auth/store.go
+++ b/apps/daemon/internal/auth/store.go
@@ -1,6 +1,7 @@
-// Package auth reads the operator device profile that oac-core-device prints
-// into ~/.oac/daemon/<profile>/auth.json: the server URL, the device ID and
-// its runner credential.
+// Package auth reads the daemon credential profile written by
+// oac-core-device: server URL, runtime row id (= device_id), and the
+// long-lived runner_credential. Stored as JSON per-profile at
+// ~/.oac/daemon/<profile>/auth.json (0o600).
 package auth
 
 import (
@@ -12,15 +13,15 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/paths"
 )
 
-// Profile is the on-disk representation of one device profile.
+// Profile is the on-disk representation of one daemon credential.
 type Profile struct {
 	// ServerURL is the absolute base URL the daemon dials (no
 	// trailing slash). The daemon joins this with paths like
 	// /agent-daemon/bootstrap.
 	ServerURL string `json:"server_url"`
 
-	// RuntimeID is the device ID. The gateway uses it verbatim as
-	// device_id on WS upgrade.
+	// RuntimeID is the runtimes row id. The gateway uses it verbatim
+	// as device_id on WS upgrade.
 	RuntimeID string `json:"runtime_id"`
 
 	// RunnerCredential is the bearer presented on every
@@ -32,11 +33,11 @@ type Profile struct {
 	DeviceName string `json:"device_name,omitempty"`
 }
 
-// ErrNoProfile is returned by Load when no auth.json exists for the
+// ErrNotPaired is returned by Load when no auth.json exists for the
 // requested profile.
-var ErrNoProfile = errors.New("auth: no device profile — provision one with oac-core-device")
+var ErrNotPaired = errors.New("auth: no daemon credential profile — create one with oac-core-device")
 
-// Load reads the profile's auth.json. Returns ErrNoProfile wrapping
+// Load reads the profile's auth.json. Returns ErrNotPaired wrapping
 // fs.ErrNotExist when the file is missing.
 func Load(profile string) (Profile, error) {
 	authPath, err := paths.AuthFile(profile)
@@ -46,9 +47,9 @@ func Load(profile string) (Profile, error) {
 	raw, err := os.ReadFile(authPath)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			// Multi-%w so errors.Is matches both ErrNoProfile AND
+			// Multi-%w so errors.Is matches both ErrNotPaired AND
 			// fs.ErrNotExist.
-			return Profile{}, fmt.Errorf("%w (looked at %s): %w", ErrNoProfile, authPath, err)
+			return Profile{}, fmt.Errorf("%w (looked at %s): %w", ErrNotPaired, authPath, err)
 		}
 		return Profile{}, fmt.Errorf("auth: read: %w", err)
 	}
diff --git a/apps/daemon/internal/auth/store_test.go b/apps/daemon/internal/auth/store_test.go
index bc764daff..1d3bfffcc 100644
--- a/apps/daemon/internal/auth/store_test.go
+++ b/apps/daemon/internal/auth/store_test.go
@@ -1,6 +1,7 @@
 package auth_test
 
 import (
+	"encoding/json"
 	"errors"
 	"io/fs"
 	"os"
@@ -9,57 +10,117 @@ import (
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/auth"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/paths"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/runtimefs"
 )
 
-func writeProfile(t *testing.T, raw string) {
+func withTempHome(t *testing.T) string {
 	t.Helper()
-	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
-	path, err := paths.AuthFile("default")
+	dir := t.TempDir()
+	t.Setenv("OAC_RUNTIME_HOME", dir)
+	return dir
+}
+
+func profileDir(t *testing.T, profile string) string {
+	t.Helper()
+	dir, err := paths.ProfileDir(profile)
+	if err != nil {
+		t.Fatalf("ProfileDir: %v", err)
+	}
+	if err := runtimefs.EnsurePrivateDir(dir); err != nil {
+		t.Fatalf("EnsurePrivateDir: %v", err)
+	}
+	return dir
+}
+
+func writeProfile(t *testing.T, profile string, p auth.Profile) {
+	t.Helper()
+	dir := profileDir(t, profile)
+	raw, err := json.Marshal(p)
 	if err != nil {
-		t.Fatal(err)
+		t.Fatalf("marshal profile: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "auth.json"), raw, 0o600); err != nil {
+		t.Fatalf("write auth.json: %v", err)
+	}
+}
+
+func TestLoadReadsProfile(t *testing.T) {
+	_ = withTempHome(t)
+	want := auth.Profile{
+		ServerURL:        "https://core.example.com",
+		RuntimeID:        "rt_abc123",
+		RunnerCredential: "secret-credential",
+		DeviceName:       "alice-mac",
 	}
-	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
-		t.Fatal(err)
+	writeProfile(t, "test", want)
+	got, err := auth.Load("test")
+	if err != nil {
+		t.Fatalf("Load: %v", err)
 	}
-	if raw != "" {
-		if err := os.WriteFile(path, []byte(raw), 0o600); err != nil {
-			t.Fatal(err)
-		}
+	if got != want {
+		t.Fatalf("Load mismatch:\n got=%+v\nwant=%+v", got, want)
 	}
 }
 
-func TestLoadReadsTheDeviceProfile(t *testing.T) {
-	writeProfile(t, `{"server_url":"https://core.example.com/api/v1","runtime_id":"rt_abc123","runner_credential":"secret-credential","device_name":"engine host"}`)
-	got, err := auth.Load("default")
-	want := auth.Profile{ServerURL: "https://core.example.com/api/v1", RuntimeID: "rt_abc123", RunnerCredential: "secret-credential", DeviceName: "engine host"}
-	if err != nil || got != want {
-		t.Fatalf("Load = %+v, %v; want %+v", got, err, want)
+func TestLoadIgnoresLegacyProfileFields(t *testing.T) {
+	_ = withTempHome(t)
+	raw := `{"server_url":"https://core.example.com/api/v1","runtime_id":"rt","runner_credential":"c","device_name":"d",` +
+		`"hostname":"h","paired_at":"2026-06-04T12:00:00Z","runner_public_key":"pub","runner_private_key":"priv"}`
+	if err := os.WriteFile(filepath.Join(profileDir(t, "legacy"), "auth.json"), []byte(raw), 0o600); err != nil {
+		t.Fatalf("write auth.json: %v", err)
+	}
+	got, err := auth.Load("legacy")
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	want := auth.Profile{ServerURL: "https://core.example.com/api/v1", RuntimeID: "rt", RunnerCredential: "c", DeviceName: "d"}
+	if got != want {
+		t.Fatalf("Load = %+v, want %+v", got, want)
 	}
 }
 
-func TestLoadMissingReturnsErrNoProfile(t *testing.T) {
-	writeProfile(t, "")
+func TestLoadMissingReturnsErrNotPaired(t *testing.T) {
+	_ = withTempHome(t)
 	_, err := auth.Load("default")
-	if !errors.Is(err, auth.ErrNoProfile) || !errors.Is(err, fs.ErrNotExist) {
-		t.Fatalf("Load on missing profile returned %v, want ErrNoProfile wrapping fs.ErrNotExist", err)
+	if !errors.Is(err, auth.ErrNotPaired) {
+		t.Fatalf("Load on missing profile returned %v, want ErrNotPaired", err)
+	}
+	// ErrNotPaired must also wrap fs.ErrNotExist for the canonical
+	// "missing file" check.
+	if !errors.Is(err, fs.ErrNotExist) {
+		t.Fatalf("ErrNotPaired must wrap fs.ErrNotExist, got %v", err)
 	}
 }
 
 func TestLoadCorruptJSONReturnsError(t *testing.T) {
-	writeProfile(t, "{not valid json")
-	if _, err := auth.Load("default"); err == nil || errors.Is(err, auth.ErrNoProfile) {
-		t.Fatalf("Load on corrupt JSON = %v, want a parse error", err)
+	_ = withTempHome(t)
+	dir := profileDir(t, "default")
+	if err := os.WriteFile(filepath.Join(dir, "auth.json"), []byte("{not valid json"), 0o600); err != nil {
+		t.Fatalf("seed corrupt file: %v", err)
+	}
+	_, err := auth.Load("default")
+	if err == nil {
+		t.Fatal("Load returned nil error on corrupt JSON")
+	}
+	if errors.Is(err, auth.ErrNotPaired) {
+		t.Fatalf("Load on corrupt JSON should not be ErrNotPaired: %v", err)
 	}
 }
 
 func TestDeleteIsIdempotent(t *testing.T) {
-	writeProfile(t, `{"server_url":"https://x","runtime_id":"rt","runner_credential":"c"}`)
-	for range 2 {
-		if err := auth.Delete("default"); err != nil {
-			t.Fatalf("Delete: %v", err)
-		}
-	}
-	if _, err := auth.Load("default"); !errors.Is(err, auth.ErrNoProfile) {
-		t.Fatalf("Load after Delete = %v, want ErrNoProfile", err)
+	_ = withTempHome(t)
+	if err := auth.Delete("default"); err != nil {
+		t.Fatalf("Delete on missing profile returned %v, want nil (idempotent)", err)
+	}
+	writeProfile(t, "default", auth.Profile{ServerURL: "https://x", RuntimeID: "rt", RunnerCredential: "c"})
+	if err := auth.Delete("default"); err != nil {
+		t.Fatalf("Delete: %v", err)
+	}
+	if _, err := auth.Load("default"); !errors.Is(err, auth.ErrNotPaired) {
+		t.Fatalf("Load after Delete = %v, want ErrNotPaired", err)
+	}
+	// Second Delete must still succeed.
+	if err := auth.Delete("default"); err != nil {
+		t.Fatalf("Delete second call = %v, want nil", err)
 	}
 }
diff --git a/apps/daemon/internal/cli/claude_sdk_live_linux_test.go b/apps/daemon/internal/cli/claude_sdk_live_linux_test.go
index 78217d94b..19741a255 100644
--- a/apps/daemon/internal/cli/claude_sdk_live_linux_test.go
+++ b/apps/daemon/internal/cli/claude_sdk_live_linux_test.go
@@ -89,7 +89,7 @@ func TestLiveRegisteredClaudeSDK(t *testing.T) {
 		ctx, cancel := context.WithTimeout(t.Context(), 120*time.Second)
 		defer cancel()
 		id := uuid.NewString()
-		request := proto.PromptRequestPayload{AgentKind: "claude_sdk", AgentStateKey: prototest.StateKey, AgentSessionID: resume, RequireExistingNativeSession: resume != "", StrictResume: true, ReleaseOnCompletion: true, ObserveMessages: true, ObserveToolObservations: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, Model: "MiniMax-M3"}
+		request := proto.PromptRequestPayload{AgentKind: "claude_sdk", AgentStateKey: prototest.StateKey, AgentSessionID: resume, RequireExistingNativeSession: resume != "", ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, Model: "MiniMax-M3"}
 		if callFunction {
 			request.FunctionTools = []proto.FunctionTool{{Name: "lookup", Description: "Return a verification value.", Parameters: json.RawMessage(`{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}`)}}
 		}
diff --git a/apps/daemon/internal/cli/connect.go b/apps/daemon/internal/cli/connect.go
index 71c8fe2e5..f920318b3 100644
--- a/apps/daemon/internal/cli/connect.go
+++ b/apps/daemon/internal/cli/connect.go
@@ -30,9 +30,12 @@ const (
 
 // runConnect dials /agent-daemon/bootstrap, opens /agent-daemon/ws,
 // wires the dispatch router, and routes Envelope traffic both ways
-// until either SIGINT/SIGTERM or a permanent credential rejection. It
-// authenticates with a Runtime bootstrap file, self-hosted Environment
-// enrollment or the profile's operator device profile.
+// until either SIGINT/SIGTERM or a permanent credential rejection.
+//
+// The daemon credential comes from a Provider bootstrap file
+// (--bootstrap-file), self-hosted Environment enrollment
+// (--remote/--environment-id/--credential-file) or the saved profile
+// written by oac-core-device.
 //
 // -b re-execs the binary in the background with stdio redirected to
 // connect.log and the child PID written to connect.pid. The child
@@ -40,7 +43,7 @@ const (
 func runConnect(ctx *runContext, args []string) error {
 	fs := newFlagSet("connect")
 	var (
-		profile        = fs.String("profile", paths.DefaultProfile, "profile name for the device profile and pid/log files")
+		profile        = fs.String("profile", paths.DefaultProfile, "profile name for daemon credentials and pid/log files")
 		background     = fs.Bool("b", false, "fork into the background; writes connect.pid + connect.log")
 		remote         = fs.String("remote", "", "self-hosted Environment remote_url, unchanged")
 		environment    = fs.String("environment-id", "", "self-hosted Environment ID")
@@ -74,7 +77,7 @@ func runConnect(ctx *runContext, args []string) error {
 	}
 	if *remote != "" || *environment != "" || *credentialFile != "" {
 		if fs.NArg() != 0 {
-			return errors.New("connect: Environment enrollment takes no positional arguments")
+			return errors.New("connect: Environment enrollment cannot use positional arguments")
 		}
 		connectCtx, stop := daemonize.NotifyContext(context.Background())
 		defer stop()
@@ -92,11 +95,11 @@ func runConnect(ctx *runContext, args []string) error {
 				return fmt.Errorf("connect: %w", err)
 			}
 		}
-		return spawnBackground(context.Background(), ctx, *profile)
+		return spawnBackground(context.Background(), ctx, *profile, os.Args)
 	}
 
 	// Self-check before loading credentials so a machine with no
-	// supported agent CLI fails before it connects.
+	// supported agent CLI fails fast.
 	agentCLIs, err := preflightAgentCLIs(context.Background(), ctx, *profile)
 	if err != nil {
 		return err
@@ -105,8 +108,11 @@ func runConnect(ctx *runContext, args []string) error {
 	var prof auth.Profile
 	if bootstrapped != nil {
 		prof = *bootstrapped
-	} else if prof, err = auth.Load(*profile); err != nil {
-		return fmt.Errorf("connect: %w", err)
+	} else {
+		prof, err = auth.Load(*profile)
+		if err != nil {
+			return fmt.Errorf("connect: %w", err)
+		}
 	}
 
 	return mainLoop(ctx, *profile, prof, agentCLIs)
@@ -116,7 +122,7 @@ func runConnect(ctx *runContext, args []string) error {
 // returns after printing the child PID; child re-enters runConnect
 // with BackgroundSentinelEnv set so the same mainLoop runs in either
 // mode.
-func spawnBackground(ctx context.Context, rc *runContext, profile string) error {
+func spawnBackground(ctx context.Context, rc *runContext, profile string, argv []string) error {
 	logPath, err := paths.LogFile(profile)
 	if err != nil {
 		return fmt.Errorf("connect: %w", err)
@@ -155,7 +161,10 @@ func spawnBackground(ctx context.Context, rc *runContext, profile string) error
 	if err := ctx.Err(); err != nil {
 		return err
 	}
-	pid, err := daemonize.Spawn(os.Args, daemonize.ReExecOptions{LogPath: logPath, PIDPath: pidPath})
+	pid, err := daemonize.Spawn(argv, daemonize.ReExecOptions{
+		LogPath: logPath,
+		PIDPath: pidPath,
+	})
 	if err != nil {
 		return fmt.Errorf("connect: spawn background: %w", err)
 	}
@@ -273,7 +282,7 @@ func mainLoopRemote(parent context.Context, rc *runContext, profile string, prof
 				return nil
 			}
 			if errors.Is(err, transport.ErrPermanent) {
-				return fmt.Errorf("connect: permanent error (re-pair the daemon): %w", err)
+				return fmt.Errorf("connect: permanent error (reissue the daemon credential): %w", err)
 			}
 			return fmt.Errorf("connect: dial: %w", err)
 		}
@@ -298,7 +307,7 @@ func mainLoopRemote(parent context.Context, rc *runContext, profile string, prof
 		// Permanent error (e.g. runtime deleted) → exit instead of
 		// reconnecting.
 		if pumpErr != nil && errors.Is(pumpErr, transport.ErrPermanent) {
-			return fmt.Errorf("connect: runtime deleted (re-pair the daemon): %w", pumpErr)
+			return fmt.Errorf("connect: runtime deleted (reissue the daemon credential): %w", pumpErr)
 		}
 		// Small breather before redialing so a flapping server doesn't
 		// get a tight loop of upgrade requests.
diff --git a/apps/daemon/internal/cli/connect_bootstrap.go b/apps/daemon/internal/cli/connect_bootstrap.go
index 4092479dc..1e7848808 100644
--- a/apps/daemon/internal/cli/connect_bootstrap.go
+++ b/apps/daemon/internal/cli/connect_bootstrap.go
@@ -8,7 +8,7 @@ import (
 )
 
 // The launch file is the sole credential source for this connection. Reopening
-// it on process restart neither pairs again nor overwrites an auth profile.
+// it on process restart never reads or overwrites an auth profile.
 func bootstrapProfile(path string) (*auth.Profile, error) {
 	raw, err := runtimefs.ReadPrivatePath(path, runtimebootstrap.MaxBytes)
 	if err != nil {
diff --git a/apps/daemon/internal/cli/connect_bootstrap_test.go b/apps/daemon/internal/cli/connect_bootstrap_test.go
index be7cfad32..7f510d699 100644
--- a/apps/daemon/internal/cli/connect_bootstrap_test.go
+++ b/apps/daemon/internal/cli/connect_bootstrap_test.go
@@ -1,28 +1,34 @@
 package cli
 
 import (
-	"bytes"
+	"encoding/json"
 	"io"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/auth"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/paths"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/runtimebootstrap"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/runtimefs"
 )
 
 func TestBootstrapConnectionDoesNotReadOrOverwritePrivateProfile(t *testing.T) {
 	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
-	profile, err := paths.AuthFile("default")
+	prior := auth.Profile{ServerURL: "https://other.example/api/v1", RuntimeID: "retained", RunnerCredential: "retained-secret"}
+	profileDir, err := paths.ProfileDir("default")
 	if err != nil {
 		t.Fatal(err)
 	}
-	prior := []byte(`{"server_url":"https://other.example/api/v1","runtime_id":"retained","runner_credential":"retained-secret"}`)
-	if err = os.MkdirAll(filepath.Dir(profile), 0o700); err != nil {
+	if err = runtimefs.EnsurePrivateDir(profileDir); err != nil {
 		t.Fatal(err)
 	}
-	if err = os.WriteFile(profile, prior, 0o600); err != nil {
+	priorRaw, err := json.Marshal(prior)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = os.WriteFile(filepath.Join(profileDir, "auth.json"), priorRaw, 0600); err != nil {
 		t.Fatal(err)
 	}
 	input := runtimebootstrap.Connection{Version: runtimebootstrap.Version, CoreURL: "https://core.example/api/v1", DeviceID: "da912024-1543-4242-a2c1-5f4f7ebbc6c7", Credential: "bootstrap-secret"}
@@ -40,8 +46,8 @@ func TestBootstrapConnectionDoesNotReadOrOverwritePrivateProfile(t *testing.T) {
 			t.Fatal("failed bootstrap/restart", err)
 		}
 	}
-	got, err := os.ReadFile(profile)
-	if err != nil || !bytes.Equal(got, prior) {
+	got, err := auth.Load("default")
+	if err != nil || got != prior {
 		t.Fatal("private profile modified", err)
 	}
 	if err = os.WriteFile(path, []byte("bootstrap-secret"), 0600); err != nil {
diff --git a/apps/daemon/internal/cli/connect_cleanup_test.go b/apps/daemon/internal/cli/connect_cleanup_test.go
index c4658752d..e7d44e052 100644
--- a/apps/daemon/internal/cli/connect_cleanup_test.go
+++ b/apps/daemon/internal/cli/connect_cleanup_test.go
@@ -150,7 +150,7 @@ func testDisconnectedPumpCleanup(t *testing.T, suspend bool) {
 		t.Fatalf("bind = %+v", got)
 	}
 	env, err := proto.NewEnvelope(proto.TypeExecutionPrepare, "prepare", proto.ExecutionPreparePayload{SessionID: "cleanup",
-		Configuration: prototest.WithModel(proto.PromptRequestPayload{AgentKind: "cleanup", AgentStateKey: "agents-api-cleanup", StrictResume: true, DisableExecutionEnvironment: true})})
+		Configuration: prototest.WithModel(proto.PromptRequestPayload{AgentKind: "cleanup", AgentStateKey: "agents-api-cleanup", DisableExecutionEnvironment: true})})
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/cli/connect_environment.go b/apps/daemon/internal/cli/connect_environment.go
index 6eea718d7..0b1c3b4b1 100644
--- a/apps/daemon/internal/cli/connect_environment.go
+++ b/apps/daemon/internal/cli/connect_environment.go
@@ -9,6 +9,7 @@ import (
 	"io"
 	"net/http"
 	"net/url"
+	"os"
 	"strings"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/auth"
@@ -160,7 +161,7 @@ func runEnvironmentConnect(parent context.Context, rc *runContext, profile strin
 		return err
 	}
 	if background && !daemonize.IsBackgroundChild() {
-		return spawnBackground(parent, rc, profile)
+		return spawnBackground(parent, rc, profile, os.Args)
 	}
 	// Discovery consumes the immutable Runtime binding; it must follow enrollment.
 	discovery, err := preflightAgentCLIs(parent, rc, profile)
diff --git a/apps/daemon/internal/cli/root.go b/apps/daemon/internal/cli/root.go
index 28999d0be..cd77a7d2b 100644
--- a/apps/daemon/internal/cli/root.go
+++ b/apps/daemon/internal/cli/root.go
@@ -41,7 +41,7 @@ var commands = []command{
 	{name: "runtime-mcp-exec", summary: "Execute an installed MCP server", run: runRuntimeMCP},
 	{name: "placement", summary: "Enroll or retire an explicitly managed local execution placement", run: runPlacement},
 	{name: "connect", summary: "Open the reverse WebSocket and start serving prompts", run: runConnect},
-	{name: "status", summary: "Print the device profile and daemon state", run: runStatus},
+	{name: "status", summary: "Print the credential profile and daemon state", run: runStatus},
 	{name: "stop", summary: "Stop a background `connect -b` daemon", run: runStop},
 	{name: "logs", summary: "Tail the background daemon's log file", run: runLogs},
 	{name: "logout", summary: "Forget the credential for a profile", run: runLogout},
diff --git a/apps/daemon/internal/cli/status.go b/apps/daemon/internal/cli/status.go
index 319f62f5b..beb9e444d 100644
--- a/apps/daemon/internal/cli/status.go
+++ b/apps/daemon/internal/cli/status.go
@@ -31,12 +31,12 @@ func runStatus(ctx *runContext, args []string) error {
 
 	prof, err := auth.Load(*profile)
 	switch {
-	case errors.Is(err, auth.ErrNoProfile):
-		fmt.Fprintln(ctx.stdout, "device       : no device profile; check Host connection in Core for a self-hosted Runtime")
+	case errors.Is(err, auth.ErrNotPaired):
+		fmt.Fprintln(ctx.stdout, "paired       : no saved credential profile; check Host connection in Core for a self-hosted Runtime")
 	case err != nil:
-		fmt.Fprintf(ctx.stdout, "device       : ERROR — %v\n", err)
+		fmt.Fprintf(ctx.stdout, "paired       : ERROR — %v\n", err)
 	default:
-		fmt.Fprintln(ctx.stdout, "device       : profile present")
+		fmt.Fprintln(ctx.stdout, "paired       : yes")
 		fmt.Fprintf(ctx.stdout, "server_url   : %s\n", prof.ServerURL)
 		fmt.Fprintf(ctx.stdout, "runtime_id   : %s\n", prof.RuntimeID)
 		if prof.DeviceName != "" {
@@ -46,7 +46,7 @@ func runStatus(ctx *runContext, args []string) error {
 
 	// connect.pid existence is the cheap signal; the full liveness
 	// check (kill -0) would be more accurate but a bare existence
-	// check is honest enough for the "provisioned but not connected"
+	// check is honest enough for the "paired but not connected"
 	// diagnosis.
 	pidPath, err := paths.PIDFile(*profile)
 	if err != nil {
diff --git a/apps/daemon/internal/daemonize/fork_test.go b/apps/daemon/internal/daemonize/fork_test.go
index 7693a4918..a8f4fc5a6 100644
--- a/apps/daemon/internal/daemonize/fork_test.go
+++ b/apps/daemon/internal/daemonize/fork_test.go
@@ -12,12 +12,18 @@ func TestSpawnReExecsWithSentinelAndPIDFile(t *testing.T) {
 	dir := privateTempDir(t)
 	logPath := filepath.Join(dir, "child.log")
 	pidPath := filepath.Join(dir, "child.pid")
+	t.Setenv(spawnTestChildEnv, "1")
 
 	// argv[0] is ignored (Spawn uses os.Executable()); argv[1:]
 	// becomes child args. Placeholder subcommand so flag parsing
 	// wouldn't choke — runSpawnTestChild short-circuits anyway.
-	t.Setenv(spawnTestChildEnv, "1")
-	pid, err := Spawn([]string{"oac-daemon", "child-mode"}, ReExecOptions{LogPath: logPath, PIDPath: pidPath})
+	pid, err := Spawn(
+		[]string{"oac-daemon", "child-mode"},
+		ReExecOptions{
+			LogPath: logPath,
+			PIDPath: pidPath,
+		},
+	)
 	if err != nil {
 		t.Fatalf("Spawn: %v", err)
 	}
diff --git a/apps/daemon/internal/dispatch/assignment_test.go b/apps/daemon/internal/dispatch/assignment_test.go
index 665e99c7e..fbef907e8 100644
--- a/apps/daemon/internal/dispatch/assignment_test.go
+++ b/apps/daemon/internal/dispatch/assignment_test.go
@@ -64,7 +64,7 @@ func TestAssignmentRejectsStaleAndForeignFrames(t *testing.T) {
 	}
 	foreign := ref("s")
 	foreign.AssignmentID = "foreign"
-	prepare := proto.ExecutionPreparePayload{SessionID: "s", Configuration: proto.PromptRequestPayload{AgentKind: "fake_alpha", AgentStateKey: stateKey("s"), StrictResume: true, DisableExecutionEnvironment: true}}
+	prepare := noEnvironmentPreparation("s", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
 	for id, test := range map[string]struct {
 		ref  proto.AssignmentRef
 		code string
diff --git a/apps/daemon/internal/dispatch/cancellation_test.go b/apps/daemon/internal/dispatch/cancellation_test.go
new file mode 100644
index 000000000..7161b9ef5
--- /dev/null
+++ b/apps/daemon/internal/dispatch/cancellation_test.go
@@ -0,0 +1,121 @@
+package dispatch_test
+
+import (
+	"context"
+	"errors"
+	"reflect"
+	"testing"
+
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto/prototest"
+)
+
+type cancelReceiptSession struct {
+	*fakeSession
+	entered chan struct{}
+	release chan struct{}
+	err     error
+	outcome proto.DonePayload
+}
+
+func (s *cancelReceiptSession) CancellationOutcome() proto.DonePayload {
+	return s.outcome
+}
+
+func (s *cancelReceiptSession) Cancel(ctx context.Context) error {
+	if s.entered != nil {
+		close(s.entered)
+		<-s.release
+		s.entered = nil
+	}
+	_ = s.fakeSession.Cancel(ctx)
+	return s.err
+}
+
+func registerCancelReceiptKind(h *harness, sess *cancelReceiptSession) {
+	registerSession(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{})}, func(_ context.Context, _ proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+		sess.fakeSession = &fakeSession{out: out, closeOutOnCancel: true}
+		return sess, nil
+	})
+}
+
+func TestCompletionWaitsForNativeWriterRelease(t *testing.T) {
+	h := newHarness(t)
+	defer h.router.Shutdown(context.Background())
+	sess := &cancelReceiptSession{entered: make(chan struct{}), release: make(chan struct{})}
+	registerCancelReceiptKind(h, sess)
+	startRun(t, h.router, h.sender, "codex", "release")
+	sess.out <- mustEnv(t, proto.TypeDone, "release", proto.DonePayload{Content: "Finished"})
+	<-sess.entered
+	if len(h.sender.typesFor("release")) != 0 {
+		t.Fatal("completion acknowledged before native writer was released")
+	}
+	close(sess.release)
+	waitFor(t, func() bool { return hasFrame(h.sender, proto.TypeDone, "release") }, "release completion")
+	if frames := h.sender.typesFor("release"); len(frames) != 1 || frames[0] != proto.TypeDone || sess.cancels() != 1 {
+		t.Fatal("completion or native release missing")
+	}
+}
+
+func TestCancellationReceiptFollowsAdapterOutcome(t *testing.T) {
+	observed := proto.DonePayload{Content: "partial output", Metadata: map[string]any{proto.DoneMetaAgentSessionID: "native-cancelled"}}
+	for _, test := range []struct {
+		name    string
+		outcome proto.DonePayload
+		err     error
+	}{
+		{name: "observed", outcome: observed},
+		{name: "unknown"},
+		{name: "failed", outcome: observed, err: errors.New("adapter could not cancel")},
+		{name: "unsupported", outcome: observed, err: agent.ErrUnsupportedOperation},
+		{name: "deadline", outcome: observed, err: context.DeadlineExceeded},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			h := newHarness(t)
+			defer h.router.Shutdown(context.Background())
+			sess := &cancelReceiptSession{entered: make(chan struct{}), release: make(chan struct{}), outcome: test.outcome, err: test.err}
+			registerCancelReceiptKind(h, sess)
+			startRun(t, h.router, h.sender, "codex", "run")
+			if err := h.router.Handle(context.Background(), scoped(t, "run", proto.TypePromptCancel, "run", proto.PromptCancelPayload{DeliveryID: "cancel-1"})); err != nil {
+				t.Fatal(err)
+			}
+			<-sess.entered
+			if len(cancellationAcks(h.sender)) != 0 {
+				t.Fatal("cancellation acknowledged before adapter returned")
+			}
+			close(sess.release)
+			waitFor(t, func() bool { return len(cancellationAcks(h.sender)) != 0 }, "cancellation receipt")
+			acks := cancellationAcks(h.sender)
+			if len(acks) != 1 {
+				t.Fatalf("cancellation receipts: %+v", acks)
+			}
+			ack := acks[0]
+			if ack.Applied != (test.err == nil) || ack.DeliveryID != "cancel-1" {
+				t.Fatalf("wrong receipt: %+v", ack)
+			}
+			if test.err == nil {
+				if ack.ErrorCode != "" || ack.Outcome == nil || !reflect.DeepEqual(*ack.Outcome, test.outcome) {
+					t.Fatalf("cancellation receipt changed observed evidence: %+v", ack)
+				}
+			} else if ack.ErrorCode != "cancel_failed" || ack.Outcome != nil {
+				t.Fatalf("failed cancellation supplied a success outcome: %+v", ack)
+			}
+		})
+	}
+}
+
+func TestLegacyCancellationDoesNotEmitNewFrames(t *testing.T) {
+	h := newHarness(t)
+	defer h.router.Shutdown(context.Background())
+	startRun(t, h.router, h.sender, "fake_alpha", "legacy")
+	if err := h.router.Handle(context.Background(), scoped(t, "legacy", proto.TypePromptCancel, "legacy", proto.PromptCancelPayload{})); err != nil {
+		t.Fatal(err)
+	}
+	waitFor(t, func() bool { return hasFrame(h.sender, proto.TypeDone, "legacy") }, "cancellation settlement")
+	for _, env := range h.sender.snapshot() {
+		if env.Type == proto.TypeInteractionDecisionAck {
+			t.Fatal("legacy cancellation emitted new receipt")
+		}
+	}
+}
diff --git a/apps/daemon/internal/dispatch/environment.go b/apps/daemon/internal/dispatch/environment.go
index 3b0cb4b91..3f8991935 100644
--- a/apps/daemon/internal/dispatch/environment.go
+++ b/apps/daemon/internal/dispatch/environment.go
@@ -7,13 +7,16 @@ import (
 )
 
 func validateExecutionEnvironment(req proto.PromptRequestPayload, caps proto.AgentKindCapabilities) error {
+	if (req.LocalEnvironment != nil) == req.DisableExecutionEnvironment {
+		return errors.New("execution requires exactly one of local_environment and disable_execution_environment")
+	}
 	if err := req.ValidateProgrammaticToolCallingDisable(caps.ProgrammaticToolCallingDisable.IsSupported()); err != nil {
 		return err
 	}
 	if err := req.ValidateToolSearch(caps.ToolSearch.IsSupported()); err != nil {
 		return err
 	}
-	if req.LocalEnvironment != nil && (req.DisableExecutionEnvironment || !caps.LocalEnvironment.IsSupported()) {
+	if req.LocalEnvironment != nil && !caps.LocalEnvironment.IsSupported() {
 		return errors.New("engine does not support this local Environment configuration")
 	}
 	if req.DisableExecutionEnvironment && !caps.EnvironmentNone.IsSupported() {
diff --git a/apps/daemon/internal/dispatch/environment_test.go b/apps/daemon/internal/dispatch/environment_test.go
index 03e63552a..e8d87d7a6 100644
--- a/apps/daemon/internal/dispatch/environment_test.go
+++ b/apps/daemon/internal/dispatch/environment_test.go
@@ -3,6 +3,7 @@ package dispatch_test
 import (
 	"context"
 	"errors"
+	"sync/atomic"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
@@ -10,34 +11,82 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto/prototest"
 )
 
+// assertPreparationOutcome waits for the terminal admission status of id. An
+// admitted request fails in the controlled factory; a rejected one sends only
+// its rejection.
+func assertPreparationOutcome(t *testing.T, sender *recSender, id string, admitted bool) proto.PreparationStatusPayload {
+	t.Helper()
+	state, frames := "rejected", 1
+	if admitted {
+		state, frames = "failed", 2
+	}
+	status := waitPreparationStatus(t, sender, id, state, "")
+	if got := sender.typesFor(id); len(got) != frames {
+		t.Fatalf("preparation %s frames = %v, want %d status frames", id, got, frames)
+	}
+	return status
+}
+
+func TestNoEnvironmentRejectsOtherEngineBeforeFactory(t *testing.T) {
+	h := newHarness(t)
+	defer h.router.Shutdown(context.Background())
+	var called atomic.Bool
+	registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "fake_alpha", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{})}, func(context.Context, proto.PromptRequestPayload) (agent.Executor, error) {
+		called.Store(true)
+		return nil, errors.New("controlled factory stop")
+	})
+	assign(t, h.router, preparationSessionID, "")
+	err := h.router.Handle(context.Background(), mustEnv(t, proto.TypeExecutionPrepare, "none", noEnvironmentPreparation(preparationSessionID, proto.PromptRequestPayload{AgentKind: "fake_alpha"})))
+	if err == nil {
+		t.Fatal("unsupported engine was admitted")
+	}
+	if status := assertPreparationOutcome(t, h.sender, "none", false); status.ErrorCode != "unsupported_configuration" || called.Load() {
+		t.Fatalf("unsupported engine was started: status=%+v called=%t", status, called.Load())
+	}
+}
+
+func TestNoEnvironmentUsesAvailableCapability(t *testing.T) {
+	for _, available := range []bool{false, true} {
+		h := newHarness(t)
+		defer h.router.Shutdown(context.Background())
+		var called atomic.Bool
+		registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "claude_sdk", Available: available, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported})}, func(context.Context, proto.PromptRequestPayload) (agent.Executor, error) {
+			called.Store(true)
+			return nil, errors.New("controlled factory stop")
+		})
+		assign(t, h.router, preparationSessionID, "")
+		_ = h.router.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "sdk", noEnvironmentPreparation(preparationSessionID, proto.PromptRequestPayload{AgentKind: "claude_sdk"})))
+		assertPreparationOutcome(t, h.sender, "sdk", available)
+		if called.Load() != available {
+			t.Fatalf("factory called=%t, available=%t", called.Load(), available)
+		}
+	}
+}
+
 func TestLocalEnvironmentRequiresAvailableCapability(t *testing.T) {
 	for _, mode := range []string{"unsupported", "unavailable", "none conflict", "supported"} {
 		t.Run(mode, func(t *testing.T) {
 			h := localPreparationHarness(t)
 			defer h.router.Shutdown(context.Background())
-			called := false
-			h.reg.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: mode != "unavailable",
-				Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{LocalEnvironment: proto.CapabilityFromBool(mode != "unsupported"), EnvironmentNone: proto.CapabilitySupported})},
-				prototest.ModelConfiguration(), func(context.Context, proto.PromptRequestPayload, chan<- proto.Envelope) (agent.Session, error) {
-					return nil, errors.New("ordinary factory is forbidden")
+			var called atomic.Bool
+			registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: mode != "unavailable",
+				Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{LocalEnvironment: proto.CapabilityFromBool(mode != "unsupported")})},
+				func(_ context.Context, req proto.PromptRequestPayload) (agent.Executor, error) {
+					called.Store(true)
+					if req.LocalEnvironment == nil || req.LocalEnvironment.ID != preparationEnvironmentID {
+						t.Error("local descriptor lost before factory")
+					}
+					return nil, errors.New("controlled factory stop")
 				})
-			h.reg.RegisterExecutor("codex", func(_ context.Context, req proto.PromptRequestPayload) (agent.Executor, error) {
-				called = true
-				if req.LocalEnvironment == nil || req.LocalEnvironment.ID != preparationEnvironmentID {
-					t.Error("local descriptor lost before factory")
-				}
-				return nil, errors.New("controlled factory stop")
-			})
 			req := preparationRequest()
 			req.Configuration.AgentKind = "codex"
 			req.Configuration.DisableExecutionEnvironment = mode == "none conflict"
-			_ = h.router.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "local", req))
-			state := "rejected"
-			if mode == "supported" {
-				state = "failed"
+			err := h.router.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "local", req))
+			if (err == nil) != (mode == "supported") {
+				t.Fatalf("wrong admission for %s: %v", mode, err)
 			}
-			waitPreparationStatus(t, h.sender, "local", state, "")
-			if called != (mode == "supported") {
+			assertPreparationOutcome(t, h.sender, "local", mode == "supported")
+			if called.Load() != (mode == "supported") {
 				t.Fatalf("unexpected factory call for %s", mode)
 			}
 		})
diff --git a/apps/daemon/internal/dispatch/executor.go b/apps/daemon/internal/dispatch/executor.go
index 82c5d227e..9bf45b9e6 100644
--- a/apps/daemon/internal/dispatch/executor.go
+++ b/apps/daemon/internal/dispatch/executor.go
@@ -40,14 +40,13 @@ func executorFingerprint(req proto.PromptRequestPayload) ([32]byte, error) {
 	req.RunID, req.Input = "", nil
 	req.AgentSessionID = ""
 	req.RequireExistingNativeSession = false
-	req.ReleaseOnCompletion = false
 	data, err := json.Marshal(req)
 	return sha256.Sum256(data), err
 }
 
 func (r *Router) handleExecutorPrepare(ctx context.Context, env proto.Envelope, input proto.ExecutionPreparePayload) error {
 	req := input.Configuration
-	if strings.TrimSpace(input.SessionID) == "" || req.RunID != "" || len(req.Input) != 0 || req.ConversationID != "" || req.AgentStateKey != "agents-api-"+input.SessionID || !req.StrictResume {
+	if strings.TrimSpace(input.SessionID) == "" || req.RunID != "" || len(req.Input) != 0 || req.AgentStateKey != "agents-api-"+input.SessionID {
 		return r.rejectPreparation(env, "invalid_configuration")
 	}
 	caps, available := r.availableCapabilities(req.AgentKind)
@@ -287,19 +286,22 @@ func (r *Router) scheduleExecutorIdleLocked(owner *executorState) {
 	owner.idleLease++
 	lease := owner.idleLease
 	r.log.Info("executor owner_idle", "executor_id", owner.id, "session_id", owner.sessionID)
-	owner.timer = time.AfterFunc(r.idleTimeout, func() {
-		r.mu.Lock()
-		if r.executors[owner.sessionID] != owner || owner.idleLease != lease || owner.run != nil || owner.admission != nil || owner.invalid {
-			r.mu.Unlock()
-			return
-		}
-		owner.invalid = true
-		owner.closeReason = "idle_expired"
-		r.shutdownWG.Add(1)
+	owner.timer = time.AfterFunc(r.idleTimeout, func() { r.expireIdleExecutor(owner, lease) })
+}
+
+// expireIdleExecutor closes owner only while lease is its current idle lease.
+func (r *Router) expireIdleExecutor(owner *executorState, lease uint64) {
+	r.mu.Lock()
+	if r.executors[owner.sessionID] != owner || owner.idleLease != lease || owner.run != nil || owner.admission != nil || owner.invalid {
 		r.mu.Unlock()
-		defer r.shutdownWG.Done()
-		_ = r.closeExecutor(owner)
-	})
+		return
+	}
+	owner.invalid = true
+	owner.closeReason = "idle_expired"
+	r.shutdownWG.Add(1)
+	r.mu.Unlock()
+	defer r.shutdownWG.Done()
+	_ = r.closeExecutor(owner)
 }
 
 // Close failures keep the exact owner; a later call retries only settled failures.
diff --git a/apps/daemon/internal/dispatch/executor_handoff_test.go b/apps/daemon/internal/dispatch/executor_handoff_test.go
index 632edbde3..3db03edad 100644
--- a/apps/daemon/internal/dispatch/executor_handoff_test.go
+++ b/apps/daemon/internal/dispatch/executor_handoff_test.go
@@ -150,7 +150,7 @@ func TestPreparedDonePublishesAfterExecutorHandoff(t *testing.T) {
 					}
 				}
 			}
-			request := proto.ExecutionPreparePayload{SessionID: "session", Configuration: prototest.WithModel(proto.PromptRequestPayload{AgentKind: "handoff", AgentStateKey: "agents-api-session", StrictResume: true, DisableExecutionEnvironment: true})}
+			request := proto.ExecutionPreparePayload{SessionID: "session", Configuration: prototest.WithModel(proto.PromptRequestPayload{AgentKind: "handoff", AgentStateKey: "agents-api-session", DisableExecutionEnvironment: true})}
 			admit := func(id string) proto.PreparationStatusPayload {
 				t.Helper()
 				handle(proto.TypeExecutionPrepare, id, request)
diff --git a/apps/daemon/internal/dispatch/executor_test.go b/apps/daemon/internal/dispatch/executor_test.go
index affb5d60d..0a8080804 100644
--- a/apps/daemon/internal/dispatch/executor_test.go
+++ b/apps/daemon/internal/dispatch/executor_test.go
@@ -67,17 +67,28 @@ func (t *reusableTurn) AwaitSettlement(ctx context.Context) (agent.TurnSettlemen
 	}
 }
 
+// noEnvironmentPreparation prepares config for session without an execution
+// environment, with the fixture model and provider.
+func noEnvironmentPreparation(session string, config proto.PromptRequestPayload) proto.ExecutionPreparePayload {
+	config.AgentStateKey, config.DisableExecutionEnvironment = stateKey(session), true
+	return proto.ExecutionPreparePayload{SessionID: session, Configuration: prototest.WithModel(config)}
+}
 func executorRequest() proto.ExecutionPreparePayload {
-	return proto.ExecutionPreparePayload{SessionID: preparationSessionID, Configuration: prototest.WithModel(proto.PromptRequestPayload{AgentKind: "reusable", AgentStateKey: "agents-api-" + preparationSessionID, StrictResume: true, DisableExecutionEnvironment: true})}
+	return noEnvironmentPreparation(preparationSessionID, proto.PromptRequestPayload{AgentKind: "reusable"})
+}
+
+// registerExecutorKind registers info for prepared execution only.
+func registerExecutorKind(reg *agent.Registry, info proto.SupportedAgentKind, factory agent.ExecutorFactory) {
+	reg.RegisterKind(info, prototest.ModelConfiguration(), func(context.Context, proto.PromptRequestPayload, chan<- proto.Envelope) (agent.Session, error) {
+		return nil, errors.New("prepared execution must not use the direct Session factory")
+	})
+	reg.RegisterExecutor(info.Kind, factory)
 }
 func executorRouter(t *testing.T, owner *reusableExecutor, idle time.Duration) (*dispatch.Router, *recSender, *atomic.Int32) {
 	t.Helper()
 	calls := &atomic.Int32{}
 	reg := agent.NewRegistry()
-	reg.RegisterKind(proto.SupportedAgentKind{Kind: "reusable", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, prototest.ModelConfiguration(), func(context.Context, proto.PromptRequestPayload, chan<- proto.Envelope) (agent.Session, error) {
-		return nil, errors.New("ordinary factory is forbidden")
-	})
-	reg.RegisterExecutor("reusable", func(context.Context, proto.PromptRequestPayload) (agent.Executor, error) {
+	registerExecutorKind(reg, proto.SupportedAgentKind{Kind: "reusable", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, func(context.Context, proto.PromptRequestPayload) (agent.Executor, error) {
 		calls.Add(1)
 		return owner, nil
 	})
@@ -296,6 +307,18 @@ func TestExecutorRejectsSessionStateScopeMismatch(t *testing.T) {
 	}
 }
 
+func TestExecutorRejectsMissingEnvironmentBeforeFactory(t *testing.T) {
+	r, s, calls := executorRouter(t, &reusableExecutor{}, time.Minute)
+	req := executorRequest()
+	req.Configuration.DisableExecutionEnvironment = false
+	if err := r.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "request", req)); err == nil {
+		t.Fatal("unsupported configuration accepted")
+	}
+	if status := waitPreparationStatus(t, s, "request", "rejected", ""); status.ErrorCode != "unsupported_configuration" || calls.Load() != 0 {
+		t.Fatalf("status=%+v factory calls=%d", status, calls.Load())
+	}
+}
+
 func TestExecutorRejectsOutputFromAnotherTurn(t *testing.T) {
 	e := &reusableExecutor{starts: make(chan *reusableTurn, 1)}
 	r, s, _ := executorRouter(t, e, time.Minute)
diff --git a/apps/daemon/internal/dispatch/export_test.go b/apps/daemon/internal/dispatch/export_test.go
index 4c5e2a361..05d7011d7 100644
--- a/apps/daemon/internal/dispatch/export_test.go
+++ b/apps/daemon/internal/dispatch/export_test.go
@@ -36,3 +36,11 @@ func (r *Router) SteeringClosedForTest(runID string) bool {
 	state := r.sessions[runID]
 	return state != nil && state.steeringClosed
 }
+
+// RunStartedForTest reports whether runID's Turn accepts operations.
+func (r *Router) RunStartedForTest(runID string) bool {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	state := r.sessions[runID]
+	return state != nil && state.session != nil
+}
diff --git a/apps/daemon/internal/dispatch/functions_native_test.go b/apps/daemon/internal/dispatch/functions_native_test.go
new file mode 100644
index 000000000..8bae728de
--- /dev/null
+++ b/apps/daemon/internal/dispatch/functions_native_test.go
@@ -0,0 +1,222 @@
+package dispatch_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/codex"
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/dispatch"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto/prototest"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/modelprovider"
+)
+
+type nativeFunctionSender chan proto.Envelope
+
+func (s nativeFunctionSender) Send(ctx context.Context, e proto.Envelope) error {
+	select {
+	case s <- e:
+		return nil
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+func TestNativeFunctionBridge(t *testing.T) {
+	root := os.Getenv("OAC_TEST_NATIVE_PROOF_DIR")
+	if root == "" {
+		t.Skip("explicit native Codex binary and proof directory required")
+	}
+	home, err := os.MkdirTemp(root, "daemon-functions-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chmod(home, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("OAC_RUNTIME_HOME", home)
+	var count atomic.Int32
+	model := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var body map[string]any
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			t.Error(err)
+			return
+		}
+		n := count.Add(1)
+		raw, _ := json.MarshalIndent(body, "", "  ")
+		_ = os.WriteFile(filepath.Join(home, fmt.Sprintf("request-%d.json", n)), raw, 0600)
+		var item map[string]any
+		if n%2 == 1 {
+			if !strings.Contains(string(raw), "lookup_ticket") {
+				t.Error("tool was not registered")
+			}
+			item = map[string]any{"id": fmt.Sprintf("fc_%d", n), "type": "function_call", "call_id": fmt.Sprintf("call_%d", n), "name": "lookup_ticket", "arguments": `{"ticket":"42"}`, "status": "completed"}
+		} else {
+
+			var request struct {
+				Input []struct {
+					Type   string          `json:"type"`
+					CallID string          `json:"call_id"`
+					Output json.RawMessage `json:"output"`
+				} `json:"input"`
+			}
+			if err := json.Unmarshal(raw, &request); err != nil {
+				t.Error(err)
+			}
+			found := false
+			for _, entry := range request.Input {
+				if entry.Type != "function_call_output" || entry.CallID != fmt.Sprintf("call_%d", n-1) {
+					continue
+				}
+				found = true
+				var parts []proto.InputContent
+				if err := json.Unmarshal(entry.Output, &parts); err != nil {
+					t.Error(err)
+					continue
+				}
+				expected := functionResultContent("TICKET-RESULT")
+				if !reflect.DeepEqual(parts, expected) {
+					t.Errorf("native result lost text/image content or order: %s", entry.Output)
+				}
+			}
+			if !found {
+				t.Error("native model did not receive function result")
+			}
+			item = map[string]any{"id": fmt.Sprintf("msg_%d", n), "type": "message", "role": "assistant", "phase": "final_answer", "status": "completed", "content": []any{map[string]any{"type": "output_text", "text": "FUNCTION-OK", "annotations": []any{}}}}
+		}
+		w.Header().Set("Content-Type", "text/event-stream")
+		send := func(kind string, data map[string]any) {
+			data["type"] = kind
+			b, _ := json.Marshal(data)
+			fmt.Fprintf(w, "event: %s\ndata: %s\n\n", kind, b)
+			w.(http.Flusher).Flush()
+		}
+		send("response.created", map[string]any{"response": map[string]any{"id": fmt.Sprintf("r_%d", n), "status": "in_progress", "output": []any{}}})
+		send("response.output_item.added", map[string]any{"output_index": 0, "item": item})
+		send("response.output_item.done", map[string]any{"output_index": 0, "item": item})
+		send("response.completed", map[string]any{"response": map[string]any{"id": fmt.Sprintf("r_%d", n), "object": "response", "created_at": time.Now().Unix(), "status": "completed", "model": "gpt-5.5", "output": []any{item}}})
+	}))
+	defer model.Close()
+	reg := agent.NewRegistry()
+	registerExecutorKind(reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{FunctionTools: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported})}, codex.NewExecutorFactory())
+	sender := make(nativeFunctionSender, 256)
+	ctx, cancel := context.WithTimeout(t.Context(), 60*time.Second)
+	defer cancel()
+	await := func(kind string) proto.Envelope {
+		t.Helper()
+		for {
+			select {
+			case env := <-sender:
+				if env.Type == proto.TypeError {
+					t.Fatalf("native error: %s", env.Payload)
+				}
+				if env.Type == kind {
+					return env
+				}
+			case <-ctx.Done():
+				t.Fatalf("waiting for %s; evidence %s", kind, home)
+			}
+		}
+	}
+	awaitReady := func(id string) proto.PreparationStatusPayload {
+		t.Helper()
+		for {
+			env := await(proto.TypePreparationStatus)
+			var status proto.PreparationStatusPayload
+			if env.ID != id {
+				continue
+			}
+			if err := env.DecodePayload(&status); err != nil {
+				t.Fatal(env, err)
+			}
+			if status.State == "ready" {
+				return status
+			}
+			if status.State != "preparing" {
+				t.Fatalf("preparation %s: %+v", id, status)
+			}
+		}
+	}
+	const session = "native-functions"
+	nativeID := ""
+	// Each Run owns a fresh Router, so every resume starts a new native process.
+	run := func(index int) {
+		router, err := dispatch.New(dispatch.Config{Registry: reg, Sender: sender})
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer func() {
+			if err := router.Shutdown(ctx); err != nil {
+				t.Error(err)
+			}
+		}()
+		run := fmt.Sprintf("run-%d", index)
+		assign(t, router, session, "")
+		request := noEnvironmentPreparation(session, proto.PromptRequestPayload{AgentKind: "codex", AgentSessionID: nativeID,
+			FunctionTools: []proto.FunctionTool{{Name: "lookup_ticket", Description: "Read a synthetic ticket", Parameters: json.RawMessage(`{"type":"object","properties":{"ticket":{"type":"string"}},"required":["ticket"],"additionalProperties":false}`)}}})
+		request.Configuration.Model, request.Configuration.ModelProvider = "gpt-5.5", &modelprovider.Provider{Protocol: modelprovider.Responses, BaseURL: model.URL + "/v1", APIKey: "synthetic-local-token"}
+		if err := router.Handle(ctx, scoped(t, session, proto.TypeExecutionPrepare, run, request)); err != nil {
+			t.Fatal(err)
+		}
+		ready := awaitReady(run)
+		if err := router.Handle(ctx, scoped(t, session, proto.TypeExecutionStart, run, proto.ExecutionStartPayload{Handle: ready.Handle, ExecutorID: ready.ExecutorID, RunID: run, Input: proto.TextInput("Look up ticket 42.")})); err != nil {
+			t.Fatal(err)
+		}
+		call := await(proto.TypeFunctionCall)
+		var payload proto.FunctionCallPayload
+		if err := call.DecodePayload(&payload); err != nil || call.ID != run || payload.Name != "lookup_ticket" {
+			t.Fatal(call, err)
+		}
+		if index == 2 {
+			if err := router.Handle(ctx, scoped(t, session, proto.TypePromptCancel, run, proto.PromptCancelPayload{DeliveryID: "cancel"})); err != nil {
+				t.Fatal(err)
+			}
+			ack := await(proto.TypeInteractionDecisionAck)
+			var receipt proto.InteractionDecisionAckPayload
+			_ = ack.DecodePayload(&receipt)
+			if !receipt.Applied {
+				t.Fatal(receipt)
+			}
+			if err := router.Handle(ctx, scoped(t, session, proto.TypeFunctionResult, run, proto.FunctionResultPayload{CallID: payload.CallID, Success: true, Content: functionResultContent("late"), DeliveryID: "late"})); err != nil {
+				t.Fatal(err)
+			}
+			_ = await(proto.TypeInteractionDecisionAck).DecodePayload(&receipt)
+			if receipt.Applied || receipt.ErrorCode != "not_pending" {
+				t.Fatal(receipt)
+			}
+			return
+		}
+		if err := router.Handle(ctx, scoped(t, session, proto.TypeFunctionResult, run, proto.FunctionResultPayload{CallID: payload.CallID, Success: index == 0, Content: functionResultContent("TICKET-RESULT"), DeliveryID: "result"})); err != nil {
+			t.Fatal(err)
+		}
+		ack := await(proto.TypeInteractionDecisionAck)
+		var receipt proto.InteractionDecisionAckPayload
+		_ = ack.DecodePayload(&receipt)
+		if !receipt.Applied {
+			t.Fatal(receipt)
+		}
+		done := await(proto.TypeDone)
+		var output proto.DonePayload
+		_ = done.DecodePayload(&output)
+		id, _ := output.Metadata[proto.DoneMetaAgentSessionID].(string)
+		if output.Content != "FUNCTION-OK" || id == "" || (nativeID != "" && id != nativeID) {
+			t.Fatal(output)
+		}
+		nativeID = id
+	}
+	for index := range 3 {
+		run(index)
+	}
+	t.Logf("Native function success/failure, fresh-process resume, cancellation and late-result rejection passed; evidence %s", home)
+}
diff --git a/apps/daemon/internal/dispatch/functions_test.go b/apps/daemon/internal/dispatch/functions_test.go
index f44e8cac0..55fa0b339 100644
--- a/apps/daemon/internal/dispatch/functions_test.go
+++ b/apps/daemon/internal/dispatch/functions_test.go
@@ -10,6 +10,7 @@ import (
 	"image/color"
 	"image/png"
 	"sync"
+	"sync/atomic"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
@@ -143,29 +144,28 @@ func TestFunctionReceiptsScopeRetriesAndConflicts(t *testing.T) {
 }
 
 // rejectsBeforeFactory reports whether a Router rejects preparing req, whose
-// kind declares caps, before the kind's factory.
+// kind declares caps, as an unsupported configuration before the kind's
+// factory.
 func rejectsBeforeFactory(t *testing.T, caps proto.AgentKindCapabilities, req proto.PromptRequestPayload) bool {
 	t.Helper()
 	reg := agent.NewRegistry()
-	called := false
-	reg.RegisterKind(proto.SupportedAgentKind{Kind: req.AgentKind, Available: true, Capabilities: caps}, prototest.ModelConfiguration(), func(context.Context, proto.PromptRequestPayload, chan<- proto.Envelope) (agent.Session, error) {
-		return nil, errors.New("ordinary factory is forbidden")
+	var called atomic.Bool
+	registerExecutorKind(reg, proto.SupportedAgentKind{Kind: req.AgentKind, Available: true, Capabilities: caps}, func(context.Context, proto.PromptRequestPayload) (agent.Executor, error) {
+		called.Store(true)
+		return nil, errors.New("unexpected executor preparation")
 	})
-	reg.RegisterExecutor(req.AgentKind, func(context.Context, proto.PromptRequestPayload) (agent.Executor, error) {
-		called = true
-		return nil, errors.New("controlled factory stop")
-	})
-	router, _ := dispatch.New(dispatch.Config{Registry: reg, Sender: &recSender{}})
+	sender := &recSender{}
+	router, _ := dispatch.New(dispatch.Config{Registry: reg, Sender: sender})
 	defer router.Shutdown(context.Background())
 	assign(t, router, preparationSessionID, "")
-	req.AgentStateKey, req.StrictResume, req.DisableExecutionEnvironment = stateKey(preparationSessionID), true, true
-	err := router.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "prepare", proto.ExecutionPreparePayload{SessionID: preparationSessionID, Configuration: req}))
-	return err != nil && !called
+	err := router.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "prepare", noEnvironmentPreparation(preparationSessionID, req)))
+	status := waitPreparationStatus(t, sender, "prepare", "rejected", "")
+	return err != nil && status.ErrorCode == "unsupported_configuration" && !called.Load()
 }
 
 func TestFunctionToolsRequireAdvertisedSupport(t *testing.T) {
 	caps := prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported})
-	if !rejectsBeforeFactory(t, caps, prototest.WithModel(proto.PromptRequestPayload{AgentKind: "unsupported", FunctionTools: []proto.FunctionTool{{Name: "lookup", Parameters: json.RawMessage(`{}`)}}})) {
+	if !rejectsBeforeFactory(t, caps, proto.PromptRequestPayload{AgentKind: "unsupported", FunctionTools: []proto.FunctionTool{{Name: "lookup", Parameters: json.RawMessage(`{}`)}}}) {
 		t.Fatal("unsupported engine silently ignored tools")
 	}
 }
@@ -185,7 +185,7 @@ func functionResultContent(text string) []proto.InputContent {
 func TestDiscoveryCannotReachAnEagerOnlyAdapter(t *testing.T) {
 	caps := prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, FunctionTools: proto.CapabilitySupported})
 	for _, search := range []bool{false, true} {
-		if !rejectsBeforeFactory(t, caps, prototest.WithModel(proto.PromptRequestPayload{AgentKind: "eager-only", ToolSearch: search, FunctionTools: []proto.FunctionTool{{Name: "lookup", Parameters: json.RawMessage(`{"type":"object"}`), DeferLoading: true}}})) {
+		if !rejectsBeforeFactory(t, caps, proto.PromptRequestPayload{AgentKind: "eager-only", ToolSearch: search, FunctionTools: []proto.FunctionTool{{Name: "lookup", Parameters: json.RawMessage(`{"type":"object"}`), DeferLoading: true}}}) {
 			t.Fatal("deferred definitions reached an eager-only adapter")
 		}
 	}
diff --git a/apps/daemon/internal/dispatch/interaction_decisions.go b/apps/daemon/internal/dispatch/interaction_decisions.go
index 1e296e324..8bfb3337d 100644
--- a/apps/daemon/internal/dispatch/interaction_decisions.go
+++ b/apps/daemon/internal/dispatch/interaction_decisions.go
@@ -105,7 +105,7 @@ func (r *Router) dropPermission(s *sessionState, permissionID string) {
 // those entries linger until cleanupSession — acceptable because they
 // can't double-fire (the session's own pendingAskTable.Take already
 // guards that); cleanupSession removes the routing entry when the run
-// stream closes, even if the underlying CLI remains in the idle pool.
+// stream closes.
 func (r *Router) handlePromptForUserChoiceDecision(ctx context.Context, env proto.Envelope) error {
 	if env.ID == "" {
 		return errors.New("dispatch: prompt_for_user_choice_decision missing ask id (Envelope.ID empty)")
diff --git a/apps/daemon/internal/dispatch/local_directory_test.go b/apps/daemon/internal/dispatch/local_directory_test.go
index 1a0a786aa..03b2f69c2 100644
--- a/apps/daemon/internal/dispatch/local_directory_test.go
+++ b/apps/daemon/internal/dispatch/local_directory_test.go
@@ -43,7 +43,7 @@ func TestLocalDirectoryPreparationNeedsNoHarnessAndRejectsOtherOwners(t *testing
 	}
 	t.Cleanup(func() { _ = r.Shutdown(context.Background()) })
 	assign(t, r, session, environment)
-	request := proto.PromptRequestPayload{AgentKind: "native", LocalEnvironment: &proto.LocalEnvironment{ID: environment}, AgentStateKey: "agents-api-" + session, StrictResume: true, ReleaseOnCompletion: true, WorkspaceReadOnly: true}
+	request := proto.PromptRequestPayload{AgentKind: "native", LocalEnvironment: &proto.LocalEnvironment{ID: environment}, AgentStateKey: "agents-api-" + session, WorkspaceReadOnly: true}
 	if err := r.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "idle", proto.ExecutionPreparePayload{SessionID: session, Configuration: request})); err != nil {
 		t.Fatal(err)
 	}
@@ -124,7 +124,7 @@ func TestLocalDirectoryKeepsNotDirectorySeparateFromFailures(t *testing.T) {
 	}
 	t.Cleanup(func() { _ = r.Shutdown(context.Background()) })
 	assign(t, r, session, environment)
-	request := proto.PromptRequestPayload{AgentKind: "native", LocalEnvironment: &proto.LocalEnvironment{ID: environment}, AgentStateKey: "agents-api-" + session, StrictResume: true, ReleaseOnCompletion: true, WorkspaceReadOnly: true}
+	request := proto.PromptRequestPayload{AgentKind: "native", LocalEnvironment: &proto.LocalEnvironment{ID: environment}, AgentStateKey: "agents-api-" + session, WorkspaceReadOnly: true}
 	if err := r.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "idle", proto.ExecutionPreparePayload{SessionID: session, Configuration: request})); err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/dispatch/mcp_http_test.go b/apps/daemon/internal/dispatch/mcp_http_test.go
index f5ebe8431..f0e8b9112 100644
--- a/apps/daemon/internal/dispatch/mcp_http_test.go
+++ b/apps/daemon/internal/dispatch/mcp_http_test.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -14,33 +15,39 @@ import (
 )
 
 func TestMCPHTTPBearerRejectsUnsupportedRequestsBeforeFactory(t *testing.T) {
-	for _, mode := range []string{"supported", "claude", "claude old peer", "claude local", "no bearer capability", "no MCP capability", "unavailable", "no none capability", "local", "other engine", "HTTP", "credential-free", "product", "required", "required old peer", "optional old peer"} {
+	for _, mode := range []string{"supported", "claude", "claude old peer", "claude local", "no bearer capability", "no MCP capability", "unavailable", "no none capability", "local", "other engine", "HTTP", "credential-free", "no declaration", "required", "required old peer", "optional old peer"} {
 		t.Run(mode, func(t *testing.T) {
-			h := newHarness(t)
+			// Service-origin servers need a service execution host, never a local Environment.
+			var h *harness
+			prepare := noEnvironmentPreparation(preparationSessionID, proto.PromptRequestPayload{AgentKind: "codex"})
+			if strings.HasSuffix(mode, "local") {
+				h = localPreparationHarness(t)
+				prepare = preparationRequest()
+				prepare.Configuration.AgentKind = "codex"
+			} else {
+				h = newHarness(t)
+				assign(t, h.router, preparationSessionID, "")
+			}
 			defer h.router.Shutdown(context.Background())
 			token := "synthetic-private-token"
 			servers := []proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "tools", ServerURL: "https://tools.example/mcp", BearerToken: &token}}
-			req := prototest.WithModel(proto.PromptRequestPayload{AgentKind: "codex", AgentStateKey: stateKey(preparationSessionID), StrictResume: true, DisableExecutionEnvironment: true, MCPHTTPServers: &servers})
-			caps := prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, MCPHTTPTools: proto.CapabilitySupported, MCPHTTPBearerAuth: proto.CapabilitySupported})
+			req := &prepare.Configuration
+			req.MCPHTTPServers = &servers
+			caps := prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, LocalEnvironment: proto.CapabilitySupported, MCPHTTPTools: proto.CapabilitySupported, MCPHTTPBearerAuth: proto.CapabilitySupported})
 			switch mode {
 			case "claude", "claude old peer", "claude local":
 				req.AgentKind = "claude_sdk"
 				caps.MCPHTTPBearerAuth = proto.CapabilityFromBool(mode != "claude old peer")
-				if mode == "claude local" {
-					req.DisableExecutionEnvironment = false
-				}
 			case "required", "required old peer", "optional old peer":
 				servers[0].Required = mode != "optional old peer"
 				servers[0].BearerToken = nil
 				caps.MCPHTTPRequired = proto.CapabilityFromBool(mode == "required")
-			case "no bearer capability", "credential-free", "product":
+			case "no bearer capability", "credential-free", "no declaration":
 				caps.MCPHTTPBearerAuth = proto.CapabilityUnsupported
 			case "no MCP capability":
 				caps.MCPHTTPTools = proto.CapabilityUnsupported
 			case "no none capability":
 				caps.EnvironmentNone = proto.CapabilityUnsupported
-			case "local":
-				req.DisableExecutionEnvironment = false
 			case "other engine":
 				req.AgentKind = "other"
 			case "HTTP":
@@ -49,38 +56,30 @@ func TestMCPHTTPBearerRejectsUnsupportedRequestsBeforeFactory(t *testing.T) {
 			if mode == "credential-free" {
 				servers[0].BearerToken = nil
 			}
-			if mode == "product" {
-				req.MCPHTTPServers, req.DisableExecutionEnvironment = nil, false
+			if mode == "no declaration" {
+				req.MCPHTTPServers = nil
 			}
-			called := false
-			h.reg.RegisterKind(proto.SupportedAgentKind{Kind: req.AgentKind, Available: mode != "unavailable", Capabilities: caps},
-				prototest.ModelConfiguration(), func(context.Context, proto.PromptRequestPayload, chan<- proto.Envelope) (agent.Session, error) {
-					return nil, errors.New("ordinary factory is forbidden")
+			var called atomic.Bool
+			registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: req.AgentKind, Available: mode != "unavailable", Capabilities: caps},
+				func(_ context.Context, got proto.PromptRequestPayload) (agent.Executor, error) {
+					called.Store(true)
+					if mode == "required" && !(*got.MCPHTTPServers)[0].Required {
+						t.Error("required initialization lost before adapter")
+					}
+					if (mode == "supported" || mode == "claude") && (got.MCPHTTPServers == nil || (*got.MCPHTTPServers)[0].BearerToken == nil || *(*got.MCPHTTPServers)[0].BearerToken != token) {
+						t.Error("token lost before adapter")
+					}
+					return nil, errors.New("controlled factory stop")
 				})
-			h.reg.RegisterExecutor(req.AgentKind, func(_ context.Context, got proto.PromptRequestPayload) (agent.Executor, error) {
-				called = true
-				if mode == "required" && !(*got.MCPHTTPServers)[0].Required {
-					t.Error("required initialization lost before adapter")
-				}
-				if (mode == "supported" || mode == "claude") && (got.MCPHTTPServers == nil || (*got.MCPHTTPServers)[0].BearerToken == nil || *(*got.MCPHTTPServers)[0].BearerToken != token) {
-					t.Error("token lost before adapter")
-				}
-				return nil, errors.New("controlled factory stop")
-			})
-			assign(t, h.router, preparationSessionID, "")
-			err := h.router.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "mcp-bearer", proto.ExecutionPreparePayload{SessionID: preparationSessionID, Configuration: req}))
-			admitted := mode == "supported" || mode == "claude" || mode == "other engine" || mode == "credential-free" || mode == "product" || mode == "required" || mode == "optional old peer"
-			state := "rejected"
-			if admitted {
-				state = "failed"
-			}
-			waitPreparationStatus(t, h.sender, "mcp-bearer", state, "")
-			if called != admitted || (err == nil) != admitted {
+			err := h.router.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "mcp-bearer", prepare))
+			admitted := mode == "supported" || mode == "claude" || mode == "other engine" || mode == "credential-free" || mode == "no declaration" || mode == "required" || mode == "optional old peer"
+			assertPreparationOutcome(t, h.sender, "mcp-bearer", admitted)
+			if called.Load() != admitted || (err == nil) != admitted {
 				t.Fatal("wrong factory admission", err)
 			}
 			raw, _ := json.Marshal(h.sender.snapshot())
 			if err != nil && strings.Contains(err.Error(), token) || strings.Contains(string(raw), token) {
-				t.Fatal("rejection exposed the credential")
+				t.Fatal("terminal status exposed credential")
 			}
 		})
 	}
diff --git a/apps/daemon/internal/dispatch/optional_interactions_test.go b/apps/daemon/internal/dispatch/optional_interactions_test.go
new file mode 100644
index 000000000..b799480bc
--- /dev/null
+++ b/apps/daemon/internal/dispatch/optional_interactions_test.go
@@ -0,0 +1,43 @@
+package dispatch_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto/prototest"
+)
+
+// Wrapping Session proves that no responder stubs are required for a Session.
+type lifecycleOnly struct{ agent.Session }
+
+func TestOptionalInteractionResponders(t *testing.T) {
+	for _, ask := range []bool{false, true} {
+		t.Run(map[bool]string{false: "permission", true: "user choice"}[ask], func(t *testing.T) {
+			h := newHarness(t)
+			defer h.router.Shutdown(context.Background())
+			var output chan<- proto.Envelope
+			registerSession(h.reg, proto.SupportedAgentKind{Kind: "minimal", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{})}, func(_ context.Context, _ proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+				output = out
+				s := &fakeSession{out: out, closeOutOnCancel: true}
+				return lifecycleOnly{Session: s}, nil
+			})
+			startRun(t, h.router, h.sender, "minimal", "run")
+			event := mustEnv(t, proto.TypePermissionRequest, "run", proto.PermissionRequestPayload{RequestID: "interaction", Tool: "fixture"})
+			decision := scoped(t, "run", proto.TypePermissionDecision, "interaction", proto.PermissionDecisionPayload{DeliveryID: "decision", Approved: true})
+			if ask {
+				event = mustEnv(t, proto.TypePromptForUserChoice, "run", proto.PromptForUserChoicePayload{AskID: "interaction"})
+				decision = scoped(t, "run", proto.TypePromptForUserChoiceDecision, "interaction", proto.PromptForUserChoiceDecisionPayload{DeliveryID: "decision"})
+			}
+			// An inconsistent adapter emitted an interaction it cannot answer: reject it,
+			// never acknowledge application or call a fabricated responder.
+			output <- event
+			waitFor(t, func() bool { return hasFrame(h.sender, event.Type, "run") }, "interaction indexed")
+			if err := h.router.Handle(t.Context(), decision); err != nil {
+				t.Fatal(err)
+			}
+			assertDecisionAck(t, h.sender, "decision", false, "unsupported")
+		})
+	}
+}
diff --git a/apps/daemon/internal/dispatch/preparation.go b/apps/daemon/internal/dispatch/preparation.go
index 0bcbaa630..3dea80ef8 100644
--- a/apps/daemon/internal/dispatch/preparation.go
+++ b/apps/daemon/internal/dispatch/preparation.go
@@ -63,7 +63,7 @@ func (r *Router) handleExecutionPrepare(ctx context.Context, env proto.Envelope)
 	if err != nil {
 		return r.rejectPreparation(env, "invalid_configuration")
 	}
-	if req.RunID != "" || len(req.Input) != 0 || req.ConversationID != "" || req.EnvironmentID() == "" || strings.TrimSpace(req.AgentStateKey) == "" || !req.StrictResume || !req.ReleaseOnCompletion {
+	if req.RunID != "" || len(req.Input) != 0 || req.EnvironmentID() == "" || strings.TrimSpace(req.AgentStateKey) == "" {
 		return r.rejectPreparation(env, "invalid_configuration")
 	}
 	if validateExecutionEnvironment(req, caps) != nil || (len(req.FunctionTools) > 0 && !caps.FunctionTools.IsSupported()) {
diff --git a/apps/daemon/internal/dispatch/preparation_start.go b/apps/daemon/internal/dispatch/preparation_start.go
index 089338a70..2c09428c0 100644
--- a/apps/daemon/internal/dispatch/preparation_start.go
+++ b/apps/daemon/internal/dispatch/preparation_start.go
@@ -78,7 +78,7 @@ func (r *Router) handleExecutionStart(_ context.Context, env proto.Envelope) err
 	}
 	p.status.State, p.status.RunID, p.status.Revision = "starting", input.RunID, p.status.Revision+1
 	p.startFingerprint, p.busy = fingerprint, true
-	state := &sessionState{assignment: env.Assignment, capabilities: p.capabilities, runID: input.RunID, environmentID: p.environmentID, out: make(chan proto.Envelope, 64), ctx: p.ctx, ctxCancel: p.cancel, pendingIDs: make(map[string]struct{}), pendingAsks: make(map[string]struct{}), traceparent: env.Trace}
+	state := &sessionState{assignment: env.Assignment, capabilities: p.capabilities, runID: input.RunID, environmentID: p.environmentID, out: make(chan proto.Envelope, 64), ctx: p.ctx, pendingIDs: make(map[string]struct{}), pendingAsks: make(map[string]struct{}), traceparent: env.Trace}
 	state.preparedHandoff = newPreparedHandoff(p, owner.native)
 	p.handoff, owner.run = state.preparedHandoff, state
 	r.sessions[input.RunID] = state
diff --git a/apps/daemon/internal/dispatch/preparation_test.go b/apps/daemon/internal/dispatch/preparation_test.go
index 57e89950c..bd4fbe3ea 100644
--- a/apps/daemon/internal/dispatch/preparation_test.go
+++ b/apps/daemon/internal/dispatch/preparation_test.go
@@ -115,7 +115,7 @@ func localPreparationHarness(t *testing.T) *harness {
 func stateKey(session string) string { return "agents-api-" + session }
 
 func preparationRequest() proto.ExecutionPreparePayload {
-	return proto.ExecutionPreparePayload{SessionID: preparationSessionID, Configuration: prototest.WithModel(proto.PromptRequestPayload{AgentKind: "prepared", AgentStateKey: stateKey(preparationSessionID), StrictResume: true, ReleaseOnCompletion: true, LocalEnvironment: &proto.LocalEnvironment{ID: preparationEnvironmentID, NetworkAccess: "enabled", WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}})}
+	return proto.ExecutionPreparePayload{SessionID: preparationSessionID, Configuration: prototest.WithModel(proto.PromptRequestPayload{AgentKind: "prepared", AgentStateKey: stateKey(preparationSessionID), LocalEnvironment: &proto.LocalEnvironment{ID: preparationEnvironmentID, NetworkAccess: "enabled", WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}})}
 }
 
 func preparationRouter(t *testing.T, sender dispatch.Sender, timeout time.Duration, factory preparationFactory) *dispatch.Router {
@@ -371,14 +371,12 @@ func TestPreparationFailedReadyDeliveryAbandonsAdmission(t *testing.T) {
 
 func TestPreparationRejectsInputAndProductConfiguration(t *testing.T) {
 	for name, change := range map[string]func(*proto.PromptRequestPayload){
-		"run":          func(p *proto.PromptRequestPayload) { p.RunID = "run" },
-		"input":        func(p *proto.PromptRequestPayload) { p.Input = proto.TextInput("input") },
-		"conversation": func(p *proto.PromptRequestPayload) { p.ConversationID = "product" },
+		"run":   func(p *proto.PromptRequestPayload) { p.RunID = "run" },
+		"input": func(p *proto.PromptRequestPayload) { p.Input = proto.TextInput("input") },
 		"attachment": func(p *proto.PromptRequestPayload) {
 			p.Input = proto.MessageInput{{Content: []proto.InputContent{{Type: "input_image"}}}}
 		},
 		"missing environment": func(p *proto.PromptRequestPayload) { p.LocalEnvironment = nil },
-		"resume":              func(p *proto.PromptRequestPayload) { p.StrictResume = false },
 	} {
 		t.Run(name, func(t *testing.T) {
 			r := preparationRouter(t, &recSender{}, time.Minute, func(context.Context, proto.PromptRequestPayload) (preparedFixture, error) {
diff --git a/apps/daemon/internal/dispatch/prepared_handoff.go b/apps/daemon/internal/dispatch/prepared_handoff.go
index d4c232b18..16bed1669 100644
--- a/apps/daemon/internal/dispatch/prepared_handoff.go
+++ b/apps/daemon/internal/dispatch/prepared_handoff.go
@@ -77,14 +77,11 @@ func newPreparedHandoff(p *preparationState, target agent.Executor) *preparedHan
 // preparedOperationLocked admits one mutation at the same linearization point
 // used by release. The returned function must run after the native call, replay
 // bookkeeping and receipt send have all finished. Router.mu must be held.
-func (r *Router) preparedOperationLocked(state *sessionState) (agent.Session, func(), bool) {
+func (r *Router) preparedOperationLocked(state *sessionState) (agent.Turn, func(), bool) {
 	if state == nil || state.session == nil || state.steeringClosed {
 		return nil, nil, false
 	}
 	handoff := state.preparedHandoff
-	if handoff == nil {
-		return state.session, func() {}, true
-	}
 	if handoff.release != nil {
 		return nil, nil, false
 	}
@@ -93,13 +90,7 @@ func (r *Router) preparedOperationLocked(state *sessionState) (agent.Session, fu
 }
 
 func (r *Router) interactionRouteOpenLocked(state *sessionState) bool {
-	if state == nil || r.closed || state.ctx.Err() != nil || state.steeringClosed {
-		return false
-	}
-	if handoff := state.preparedHandoff; handoff != nil {
-		return handoff.release == nil
-	}
-	return state.session != nil
+	return state != nil && !r.closed && state.ctx.Err() == nil && !state.steeringClosed && state.preparedHandoff.release == nil
 }
 
 // claimPreparedReleaseLocked closes admission permanently and returns the
@@ -271,6 +262,11 @@ func (r *Router) runPreparedRelease(state *sessionState, handoff *preparedHandof
 	}
 	if !owner.invalid {
 		r.scheduleExecutorIdleLocked(owner)
+	} else if owner.closeDone == nil {
+		// Shutdown invalidated this owner after the reuse decision above and
+		// left its close to this Run, which held it.
+		r.shutdownWG.Add(1)
+		go func() { defer r.shutdownWG.Done(); _ = r.closeExecutor(owner) }()
 	}
 	r.mu.Unlock()
 
diff --git a/apps/daemon/internal/dispatch/receipt_order_test.go b/apps/daemon/internal/dispatch/receipt_order_test.go
new file mode 100644
index 000000000..2250c7c4d
--- /dev/null
+++ b/apps/daemon/internal/dispatch/receipt_order_test.go
@@ -0,0 +1,175 @@
+package dispatch_test
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/dispatch"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto/prototest"
+)
+
+type blockedReceiptSender struct {
+	recSender
+	once    sync.Once
+	entered chan struct{}
+	release chan struct{}
+	exited  chan struct{}
+	fail    bool
+}
+
+func (s *blockedReceiptSender) Send(ctx context.Context, env proto.Envelope) error {
+	blocked := false
+	if env.Type == proto.TypePromptSteerAck {
+		s.once.Do(func() { blocked = true })
+	}
+	if blocked {
+		close(s.entered)
+		defer close(s.exited)
+		select {
+		case <-s.release:
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+		if s.fail {
+			return errors.New("receipt transport failed")
+		}
+	}
+	return s.recSender.Send(ctx, env)
+}
+
+func TestDurableCompletionWaitsForSteeringReceiptSend(t *testing.T) {
+	for _, mode := range []string{"consumed", "unknown", "send_failure"} {
+		t.Run(mode, func(t *testing.T) {
+			sender := &blockedReceiptSender{entered: make(chan struct{}), release: make(chan struct{}), exited: make(chan struct{}), fail: mode == "send_failure"}
+			registry := agent.NewRegistry()
+			var session *fakeSession
+			var calls atomic.Int32
+			registerSession(registry, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, func(_ context.Context, _ proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+				session = &fakeSession{out: out, closeOutOnCancel: true}
+				return &steeringSession{fakeSession: session, steer: func(context.Context, proto.PromptSteerPayload) error {
+					calls.Add(1)
+					if mode == "unknown" {
+						return errors.New("native outcome unknown")
+					}
+					return nil
+				}}, nil
+			})
+			router, err := dispatch.New(dispatch.Config{Registry: registry, Sender: sender})
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer router.Shutdown(context.Background())
+			var release sync.Once
+			defer release.Do(func() { close(sender.release) })
+			handle := func(kind string, payload any) {
+				t.Helper()
+				if err := router.Handle(context.Background(), scoped(t, "ordered", kind, "ordered", payload)); err != nil {
+					t.Fatal(err)
+				}
+			}
+			startRun(t, router, &sender.recSender, "codex", "ordered")
+			base := len(sender.snapshot())
+			input := proto.PromptSteerPayload{InputID: "input-1", Input: proto.TextInput("original")}
+			handle(proto.TypePromptSteer, input)
+			<-sender.entered
+			session.out <- mustEnv(t, proto.TypeDone, "ordered", proto.DonePayload{Content: "finished"})
+			waitFor(t, func() bool { return router.SteeringClosedForTest("ordered") }, "closed steering admission")
+			// Native settlement precedes the receipt join; TestPreparedHandoffReleaseWaitsForMutationReceipt asserts that order.
+			if len(sender.snapshot()) != base {
+				t.Fatal("Done overtook receipt")
+			}
+			if mode != "send_failure" {
+				handle(proto.TypePromptSteer, input)
+				frames := sender.snapshot()[base:]
+				var ack proto.PromptSteerAckPayload
+				if len(frames) != 1 || frames[0].DecodePayload(&ack) != nil || ack.Accepted != (mode == "consumed") {
+					t.Fatalf("cached receipt lost: %+v", ack)
+				}
+				if mode == "unknown" && ack.ErrorCode != "outcome_unknown" {
+					t.Fatal("uncertainty lost")
+				}
+				input.Input = proto.TextInput("changed")
+				handle(proto.TypePromptSteer, input)
+				input.InputID = "new"
+				handle(proto.TypePromptSteer, input)
+				frames = sender.snapshot()[base:]
+				for i, want := range []string{"input_conflict", "run_inactive"} {
+					if frames[i+1].DecodePayload(&ack) != nil || ack.ErrorCode != want {
+						t.Fatalf("receipt %d: %+v", i, ack)
+					}
+				}
+			}
+			release.Do(func() { close(sender.release) })
+			waitFor(t, func() bool { return hasFrame(&sender.recSender, proto.TypeDone, "ordered") }, "durable completion")
+			frames := sender.snapshot()[base:]
+			if len(frames) == 0 || frames[len(frames)-1].Type != proto.TypeDone || calls.Load() != 1 || session.cancels() != 1 {
+				t.Fatalf("invalid terminal order/calls: %+v, calls=%d cancels=%d", frames, calls.Load(), session.cancels())
+			}
+			if mode == "send_failure" && len(frames) != 1 {
+				t.Fatal("failed send fabricated an applied receipt")
+			}
+		})
+	}
+}
+
+func TestShutdownReleasesSteeringWorkerAndReceiptJoin(t *testing.T) {
+	for _, phase := range []string{"native", "receipt_send"} {
+		t.Run(phase, func(t *testing.T) {
+			sender := &blockedReceiptSender{entered: make(chan struct{}), release: make(chan struct{}), exited: make(chan struct{})}
+			registry := agent.NewRegistry()
+			entered, exited := make(chan struct{}), make(chan struct{})
+			var session *fakeSession
+			registerSession(registry, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, func(_ context.Context, _ proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+				session = &fakeSession{out: out, closeOutOnCancel: true}
+				return &steeringSession{fakeSession: session, steer: func(ctx context.Context, _ proto.PromptSteerPayload) error {
+					close(entered)
+					defer close(exited)
+					if phase == "native" {
+						<-ctx.Done()
+						return ctx.Err()
+					}
+					return nil
+				}}, nil
+			})
+			router, err := dispatch.New(dispatch.Config{Registry: registry, Sender: sender})
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer router.Shutdown(context.Background())
+			startRun(t, router, &sender.recSender, "codex", "shutdown")
+			if err = router.Handle(context.Background(), scoped(t, "shutdown", proto.TypePromptSteer, "shutdown", proto.PromptSteerPayload{InputID: "one", Input: proto.TextInput("text")})); err != nil {
+				t.Fatal(err)
+			}
+			<-entered
+			if phase == "receipt_send" {
+				<-sender.entered
+				session.out <- mustEnv(t, proto.TypeDone, "shutdown", proto.DonePayload{})
+				waitFor(t, func() bool { return router.SteeringClosedForTest("shutdown") }, "receipt join")
+			}
+			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+			defer cancel()
+			if err = router.Shutdown(ctx); err != nil {
+				t.Fatal(err)
+			}
+			select {
+			case <-exited:
+			default:
+				t.Fatal("native receipt worker leaked")
+			}
+			select {
+			case <-sender.exited:
+			default:
+				t.Fatal("receipt send worker leaked")
+			}
+			if router.ActiveRuns() != 0 {
+				t.Fatal("run remained after shutdown")
+			}
+		})
+	}
+}
diff --git a/apps/daemon/internal/dispatch/receipt_shutdown_test.go b/apps/daemon/internal/dispatch/receipt_shutdown_test.go
new file mode 100644
index 000000000..76316068f
--- /dev/null
+++ b/apps/daemon/internal/dispatch/receipt_shutdown_test.go
@@ -0,0 +1,77 @@
+package dispatch_test
+
+import (
+	"context"
+	"errors"
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/dispatch"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto/prototest"
+	"testing"
+	"time"
+)
+
+type shutdownAllSendsBlockSender struct {
+	recSender
+	entered  chan struct{}
+	terminal chan context.Context
+	rescue   chan struct{}
+}
+
+func (s *shutdownAllSendsBlockSender) Send(ctx context.Context, env proto.Envelope) error {
+	if env.Type == proto.TypePromptSteerAck {
+		close(s.entered)
+		select {
+		case <-ctx.Done():
+			<-time.After(50 * time.Millisecond)
+			return ctx.Err()
+		case <-s.rescue:
+			return errors.New("test cleanup")
+		}
+	}
+	if env.Type == proto.TypeError {
+		s.terminal <- ctx
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-s.rescue:
+			return errors.New("test cleanup")
+		}
+	}
+	return s.recSender.Send(ctx, env)
+}
+
+func TestShutdownCancelsCompletionErrorSend(t *testing.T) {
+	sender := &shutdownAllSendsBlockSender{entered: make(chan struct{}), terminal: make(chan context.Context, 1), rescue: make(chan struct{})}
+	registry := agent.NewRegistry()
+	var session *fakeSession
+	registerSession(registry, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, func(_ context.Context, _ proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+		session = &fakeSession{out: out, closeOutOnCancel: true}
+		return &steeringSession{fakeSession: session, steer: func(context.Context, proto.PromptSteerPayload) error { return nil }}, nil
+	})
+	router, err := dispatch.New(dispatch.Config{Registry: registry, Sender: sender})
+	if err != nil {
+		t.Fatal(err)
+	}
+	startRun(t, router, &sender.recSender, "codex", "shutdown-terminal")
+	if err = router.Handle(context.Background(), scoped(t, "shutdown-terminal", proto.TypePromptSteer, "shutdown-terminal", proto.PromptSteerPayload{InputID: "one", Input: proto.TextInput("text")})); err != nil {
+		t.Fatal(err)
+	}
+	<-sender.entered
+	session.out <- mustEnv(t, proto.TypeDone, "shutdown-terminal", proto.DonePayload{})
+	waitFor(t, func() bool { return router.SteeringClosedForTest("shutdown-terminal") }, "receipt join")
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	shutdownErr := router.Shutdown(ctx)
+	active := router.ActiveRuns()
+	select {
+	case terminalCtx := <-sender.terminal:
+		t.Logf("error send context: Done is nil=%t, Err=%v", terminalCtx.Done() == nil, terminalCtx.Err())
+	default:
+	}
+	close(sender.rescue)
+	waitFor(t, func() bool { return router.ActiveRuns() == 0 }, "test cleanup")
+	if shutdownErr != nil || active != 0 {
+		t.Fatalf("cooperating receipt sender canceled, but shutdown failed: err=%v active_runs=%d", shutdownErr, active)
+	}
+}
diff --git a/apps/daemon/internal/dispatch/router.go b/apps/daemon/internal/dispatch/router.go
index 6b8a1caac..a9c59e368 100644
--- a/apps/daemon/internal/dispatch/router.go
+++ b/apps/daemon/internal/dispatch/router.go
@@ -1,8 +1,8 @@
 // Package dispatch wires inbound WebSocket frames to the agent layer.
-// It owns the Session assignments of its connection, one prepared run per
-// active RunID with a goroutine that forwards the run's events to the
-// transport, and a permission_id → run_id index so permission_decision
-// frames route back to the right run.
+// It owns the Session assignments of its connection, one Turn per active
+// RunID with a goroutine that forwards the Turn's events to the transport,
+// and a permission_id → run_id index so permission_decision frames route
+// back to the right run.
 //
 // Concurrency: Handle is safe for one goroutine (typically the read
 // loop). Each run has its own goroutines. Internal state is
@@ -70,19 +70,18 @@ type appliedInteractionDecision struct {
 }
 
 // sessionState is the dispatcher's per-run bookkeeping. The agent
-// owns the close of out; the dispatcher cancels ctxCancel to wind
-// down. traceparent captures the execution_start's W3C trace so every
-// outbound frame stamps env.Trace with the same value, completing
+// owns the close of out; preparedHandoff owns release. traceparent
+// captures the execution_start's W3C trace so every outbound frame
+// stamps env.Trace with the same value, completing
 // frontend → server → daemon → agent → server attribution.
 type sessionState struct {
 	assignment      proto.AssignmentRef
 	capabilities    proto.AgentKindCapabilities
 	runID           string
 	environmentID   string
-	session         agent.Session
+	session         agent.Turn
 	out             chan proto.Envelope
 	ctx             context.Context
-	ctxCancel       context.CancelFunc
 	pendingIDs      map[string]struct{}
 	pendingAsks     map[string]struct{}
 	traceparent     string
diff --git a/apps/daemon/internal/dispatch/router_test.go b/apps/daemon/internal/dispatch/router_test.go
index dc805e279..1d755905b 100644
--- a/apps/daemon/internal/dispatch/router_test.go
+++ b/apps/daemon/internal/dispatch/router_test.go
@@ -3,6 +3,7 @@ package dispatch_test
 import (
 	"context"
 	"errors"
+	"slices"
 	"sync"
 	"testing"
 	"time"
@@ -177,12 +178,12 @@ func registerSession(reg *agent.Registry, info proto.SupportedAgentKind, factory
 	}))
 }
 
-// startRun binds the Session run to r, prepares its Executor of kind and
-// starts run. sender records r's frames.
+// startRun binds the Session run to r, prepares its Executor of kind, starts
+// run and waits until it accepts operations. sender records r's frames.
 func startRun(t *testing.T, r *dispatch.Router, sender *recSender, kind, run string) {
 	t.Helper()
 	assign(t, r, run, "")
-	prepare := scoped(t, run, proto.TypeExecutionPrepare, "prepare-"+run, proto.ExecutionPreparePayload{SessionID: run, Configuration: prototest.WithModel(proto.PromptRequestPayload{AgentKind: kind, AgentStateKey: stateKey(run), StrictResume: true, DisableExecutionEnvironment: true})})
+	prepare := scoped(t, run, proto.TypeExecutionPrepare, "prepare-"+run, noEnvironmentPreparation(run, proto.PromptRequestPayload{AgentKind: kind}))
 	if err := r.Handle(t.Context(), prepare); err != nil {
 		t.Fatalf("execution_prepare: %v", err)
 	}
@@ -191,6 +192,7 @@ func startRun(t *testing.T, r *dispatch.Router, sender *recSender, kind, run str
 		t.Fatalf("execution_start: %v", err)
 	}
 	waitPreparationStatus(t, sender, prepare.ID, "started", "")
+	waitFor(t, func() bool { return r.RunStartedForTest(run) }, "run "+run+" to accept operations")
 }
 
 // ref is the assignment the tests bind session to.
@@ -228,6 +230,99 @@ func mustEnv(t *testing.T, typ, id string, payload any) proto.Envelope {
 // tests
 // ---------------------------------------------------------------------
 
+func TestExecutionStartRunsInputAndForwardsOutput(t *testing.T) {
+	h := newHarness(t)
+	defer h.router.Shutdown(context.Background())
+
+	startRun(t, h.router, h.sender, "fake_alpha", "run_1")
+	req := <-h.gotReq
+	sess := <-h.gotSess
+	if req.RunID != "run_1" || len(req.Input) != 1 || *req.Input[0].Content[0].Text != "input" {
+		t.Errorf("Turn got run %q input %+v, want run_1/input", req.RunID, req.Input)
+	}
+
+	// Session emits a delta + done; both should reach the sender.
+	sess.out <- mustEnv(t, proto.TypeDelta, "run_1", proto.DeltaPayload{Delta: "hello", Sequence: 1})
+	sess.out <- mustEnv(t, proto.TypeDone, "run_1", proto.DonePayload{Content: "hello"})
+
+	waitForTypes(t, h.sender, "run_1", []string{proto.TypeDelta, proto.TypeDone})
+
+	// Settlement should have removed the Run.
+	waitFor(t, func() bool { return h.router.ActiveRuns() == 0 }, "active runs to drop to 0")
+}
+
+func TestExecutionStartRejectsDuplicateRunID(t *testing.T) {
+	h := newHarness(t)
+	defer h.router.Shutdown(context.Background())
+
+	startRun(t, h.router, h.sender, "fake_alpha", "run_dup")
+	<-h.gotReq
+
+	// Another Executor must not start a second Turn for the same RunID.
+	assign(t, h.router, "session-dup", "")
+	second := executorAdmission(t, h.router, h.sender, "prepare-dup", noEnvironmentPreparation("session-dup", proto.PromptRequestPayload{AgentKind: "fake_alpha"}))
+	start := scoped(t, "session-dup", proto.TypeExecutionStart, "prepare-dup", proto.ExecutionStartPayload{Handle: second.Handle, ExecutorID: second.ExecutorID, RunID: "run_dup", Input: proto.TextInput("input")})
+	if err := h.router.Handle(context.Background(), start); err == nil {
+		t.Fatal("duplicate Run started")
+	}
+	if status := waitPreparationStatus(t, h.sender, "prepare-dup", "rejected", ""); status.ErrorCode != "run_conflict" {
+		t.Fatalf("duplicate start status = %+v, want run_conflict", status)
+	}
+	select {
+	case extra := <-h.gotReq:
+		t.Fatalf("Turn started twice for duplicate run, second run=%s", extra.RunID)
+	default:
+	}
+}
+
+func TestExecutionPrepareRejectsUnknownKind(t *testing.T) {
+	h := newHarness(t)
+	defer h.router.Shutdown(context.Background())
+
+	assign(t, h.router, "x", "")
+	env := scoped(t, "x", proto.TypeExecutionPrepare, "prepare_x", noEnvironmentPreparation("x", proto.PromptRequestPayload{AgentKind: "fake_beta"}))
+	if err := h.router.Handle(context.Background(), env); err == nil {
+		t.Error("unknown kind admitted")
+	}
+	if status := waitPreparationStatus(t, h.sender, "prepare_x", "rejected", ""); status.ErrorCode != "resource_unavailable" {
+		t.Errorf("unknown kind status = %+v, want resource_unavailable", status)
+	}
+	if got, want := h.sender.typesFor("prepare_x"), []string{proto.TypePreparationStatus}; !slices.Equal(got, want) {
+		t.Errorf("sender frames for prepare_x = %v, want %v", got, want)
+	}
+}
+
+func TestExecutionStartRequiresRunID(t *testing.T) {
+	h := newHarness(t)
+	defer h.router.Shutdown(context.Background())
+
+	assign(t, h.router, preparationSessionID, "")
+	ready := executorAdmission(t, h.router, h.sender, "prepare", noEnvironmentPreparation(preparationSessionID, proto.PromptRequestPayload{AgentKind: "fake_alpha"}))
+	start := mustEnv(t, proto.TypeExecutionStart, "prepare", proto.ExecutionStartPayload{Handle: ready.Handle, ExecutorID: ready.ExecutorID, Input: proto.TextInput("input")})
+	if err := h.router.Handle(context.Background(), start); err == nil {
+		t.Fatal("expected error on missing run id")
+	}
+	if status := waitPreparationStatus(t, h.sender, "prepare", "rejected", ""); status.ErrorCode != "invalid_start" {
+		t.Fatalf("missing run id status = %+v, want invalid_start", status)
+	}
+}
+
+func TestHandlePromptCancelInvokesSessionCancel(t *testing.T) {
+	h := newHarness(t)
+	defer h.router.Shutdown(context.Background())
+
+	startRun(t, h.router, h.sender, "fake_alpha", "run_2")
+	<-h.gotReq
+	sess := <-h.gotSess
+
+	if err := h.router.Handle(context.Background(), scoped(t, "run_2", proto.TypePromptCancel, "run_2", nil)); err != nil {
+		t.Fatalf("prompt_cancel: %v", err)
+	}
+
+	waitFor(t, func() bool { return sess.cancels() == 1 }, "session.Cancel to fire once")
+	waitFor(t, func() bool { return h.router.ActiveRuns() == 0 }, "session to be cleaned up")
+}
+
 func TestHandlePromptCancelUnknownRunIsNoop(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
@@ -285,6 +380,53 @@ func TestPermissionDecisionUnknownPermIsNoop(t *testing.T) {
 	assertDecisionAck(t, h.sender, "delivery-unknown-perm", false, "not_pending")
 }
 
+func TestPromptForUserChoiceDecisionRoutesToSession(t *testing.T) {
+	h := newHarness(t)
+	defer h.router.Shutdown(context.Background())
+
+	startRun(t, h.router, h.sender, "fake_alpha", "run_ask")
+	<-h.gotReq
+	sess := <-h.gotSess
+
+	// Envelope.ID is the run id (server-side dispatch fans on it); the
+	// ask id rides on the payload. Daemon's indexPermissionFrame reads
+	// payload.AskID to seed askIndex.
+	sess.out <- mustEnv(t, proto.TypePromptForUserChoice, "run_ask", proto.PromptForUserChoicePayload{
+		AskID:     "ask_abcd1234",
+		Questions: []proto.PromptForUserChoiceQuestion{{Question: "?", Options: []proto.PromptForUserChoiceOption{{Label: "yes"}, {Label: "no"}}}},
+		ToolUseID: "toolu_42",
+	})
+	waitFor(t, func() bool { return hasFrame(h.sender, proto.TypePromptForUserChoice, "run_ask") }, "prompt_for_user_choice forwarded")
+
+	dec := scoped(t, "run_ask", proto.TypePromptForUserChoiceDecision, "ask_abcd1234", proto.PromptForUserChoiceDecisionPayload{
+		DeliveryID: "delivery-ask-1", QuestionAnswers: []proto.PromptForUserChoiceQuestionAnswer{{QuestionID: "q0", Answers: []string{"yes"}}},
+	})
+	if err := h.router.Handle(context.Background(), dec); err != nil {
+		t.Fatalf("prompt_for_user_choice_decision: %v", err)
+	}
+
+	sess.askMu.Lock()
+	calls := append([]askCall(nil), sess.askCalls...)
+	sess.askMu.Unlock()
+	if len(calls) != 1 || calls[0].id != "ask_abcd1234" {
+		t.Fatalf("askCalls = %+v, want one ask_abcd1234", calls)
+	}
+	if len(calls[0].decision.QuestionAnswers[0].Answers) != 1 || calls[0].decision.QuestionAnswers[0].Answers[0] != "yes" {
+		t.Errorf("answer payload mismatch: %+v", calls[0].decision)
+	}
+	assertDecisionAck(t, h.sender, "delivery-ask-1", true, "")
+
+	// Cleanup contract: a successful decision drops the ask from both
+	// the router-level index and the session's pendingAsks set, so a
+	// stale retry short-circuits as "run gone".
+	if got := h.router.AskIndexLenForTest(); got != 0 {
+		t.Errorf("askIndex len = %d, want 0 after decision", got)
+	}
+	if got := h.router.PendingAsksLenForTest("run_ask"); got != 0 {
+		t.Errorf("pendingAsks len = %d, want 0 after decision", got)
+	}
+}
+
 // TestPromptForUserChoiceDecisionClearsIndexOnAgentUnknown locks in the
 // cleanup branch: when the session returns ErrUnknownAsk (timer already
 // consumed the entry), the router still drops the index so a retry doesn't
@@ -403,10 +545,49 @@ func TestHandleAfterShutdownReturnsErrRouterClosed(t *testing.T) {
 	}
 }
 
+func TestShutdownWaitsForPumpDrain(t *testing.T) {
+	h := newHarness(t)
+
+	startRun(t, h.router, h.sender, "fake_alpha", "rs")
+	<-h.gotReq
+	sess := <-h.gotSess
+	sess.closeOutOnCancel = false
+
+	// Background: emit one frame then close out shortly after
+	// shutdown is asked for.
+	go func() {
+		sess.out <- mustEnv(t, proto.TypeDelta, "rs", proto.DeltaPayload{Delta: "x"})
+		time.Sleep(20 * time.Millisecond)
+		close(sess.out)
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if err := h.router.Shutdown(ctx); err != nil {
+		t.Fatalf("Shutdown returned %v before pump drained", err)
+	}
+	if h.router.ActiveRuns() != 0 {
+		t.Errorf("ActiveRuns after Shutdown = %d, want 0", h.router.ActiveRuns())
+	}
+}
+
 // ---------------------------------------------------------------------
 // helpers
 // ---------------------------------------------------------------------
 
+func waitForTypes(t *testing.T, s *recSender, runID string, want []string) {
+	t.Helper()
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		got := s.typesFor(runID)
+		if slices.Equal(got, want) {
+			return
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	t.Fatalf("never observed types %v for run %s; got %v", want, runID, s.typesFor(runID))
+}
+
 func waitFor(t *testing.T, cond func() bool, what string) {
 	t.Helper()
 	deadline := time.Now().Add(2 * time.Second)
diff --git a/apps/daemon/internal/dispatch/shutdown.go b/apps/daemon/internal/dispatch/shutdown.go
index de4dd9133..ef27133b4 100644
--- a/apps/daemon/internal/dispatch/shutdown.go
+++ b/apps/daemon/internal/dispatch/shutdown.go
@@ -28,13 +28,8 @@ func (r *Router) Shutdown(ctx context.Context) error {
 		}
 	}
 
-	first := !r.closed
-	var victims []sessionCancellation
-	for _, state := range r.sessions {
-		release, attempt := r.claimPreparedReleaseLocked(state, true, "", true)
-		victims = append(victims, sessionCancellation{runID: state.runID, release: release, attempt: attempt})
-	}
-	if first {
+	victims := r.sessionCancellationsLocked()
+	if !r.closed {
 		r.closed = true
 		if r.runtimePreparation != nil {
 			r.runtimePreparation.cancel()
@@ -93,7 +88,11 @@ func (r *Router) runShutdownAttempt(attempt *shutdownAttempt, victims []sessionC
 		}
 	}
 	for _, owner := range r.executors {
-		attempt.err = errors.Join(attempt.err, fmt.Errorf("dispatch: executor %s cleanup unconfirmed: %w", owner.id, owner.closeErr))
+		cause := owner.closeErr
+		if cause == nil {
+			cause = errors.New("cleanup has not settled")
+		}
+		attempt.err = errors.Join(attempt.err, fmt.Errorf("dispatch: executor %s: %w", owner.id, cause))
 	}
 	close(attempt.done)
 	r.mu.Unlock()
@@ -117,6 +116,18 @@ func waitShutdown(ctx context.Context, attempt *shutdownAttempt) error {
 
 type sessionCancellation struct {
 	runID   string
+	handoff *preparedHandoff
 	release *preparedRelease
 	attempt *preparedReleaseAttempt
 }
+
+// sessionCancellationsLocked claims release of every active Run, retrying a
+// failed native attempt. Router.mu must be held.
+func (r *Router) sessionCancellationsLocked() []sessionCancellation {
+	victims := make([]sessionCancellation, 0, len(r.sessions))
+	for _, state := range r.sessions {
+		release, attempt := r.claimPreparedReleaseLocked(state, true, "", true)
+		victims = append(victims, sessionCancellation{runID: state.runID, handoff: state.preparedHandoff, release: release, attempt: attempt})
+	}
+	return victims
+}
diff --git a/apps/daemon/internal/dispatch/steering.go b/apps/daemon/internal/dispatch/steering.go
index b4cd28629..5a0ab04c3 100644
--- a/apps/daemon/internal/dispatch/steering.go
+++ b/apps/daemon/internal/dispatch/steering.go
@@ -102,12 +102,7 @@ func (r *Router) queueSteering(ctx context.Context, env proto.Envelope, input pr
 	}
 	session := state.session
 	steerer, supportsSteering := session.(agent.Steerer)
-	if input.DurableReceipt {
-		if _, ok := session.(agent.DurableSteerer); !ok {
-			ack.ErrorCode, ack.Error = "unsupported", "Durable input receipts require a supported Turn settlement contract."
-			return &ack
-		}
-	} else if !supportsSteering {
+	if !input.DurableReceipt && !supportsSteering {
 		ack.ErrorCode, ack.Error = "unsupported", "This engine does not support active-turn input."
 		return &ack
 	}
diff --git a/apps/daemon/internal/dispatch/steering_lifetime.go b/apps/daemon/internal/dispatch/steering_lifetime.go
index b696de6a4..adbfbe054 100644
--- a/apps/daemon/internal/dispatch/steering_lifetime.go
+++ b/apps/daemon/internal/dispatch/steering_lifetime.go
@@ -9,7 +9,7 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-func (r *Router) steerDurably(sendCtx context.Context, state *sessionState, session agent.Session, env proto.Envelope, input proto.PromptSteerPayload, fingerprint [32]byte) error {
+func (r *Router) steerDurably(sendCtx context.Context, state *sessionState, session agent.DurableSteerer, env proto.Envelope, input proto.PromptSteerPayload, fingerprint [32]byte) error {
 	ctx, cancel := context.WithCancel(state.ctx)
 	defer cancel()
 	stopShutdown := context.AfterFunc(sendCtx, cancel)
@@ -17,7 +17,7 @@ func (r *Router) steerDurably(sendCtx context.Context, state *sessionState, sess
 	timer := time.AfterFunc(steeringCallTimeout, cancel)
 	defer timer.Stop()
 	var once sync.Once
-	return session.(agent.DurableSteerer).SteerWithReceipt(ctx, input, func() {
+	return session.SteerWithReceipt(ctx, input, func() {
 		once.Do(func() {
 			if !timer.Stop() || ctx.Err() != nil {
 				return
diff --git a/apps/daemon/internal/dispatch/suspend_test.go b/apps/daemon/internal/dispatch/suspend_test.go
index 4ae654dd4..b71577e7a 100644
--- a/apps/daemon/internal/dispatch/suspend_test.go
+++ b/apps/daemon/internal/dispatch/suspend_test.go
@@ -3,6 +3,7 @@ package dispatch
 import (
 	"context"
 	"errors"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -23,6 +24,14 @@ func bindAssignment(r *Router, ref proto.AssignmentRef, environmentID string) {
 	r.mu.Unlock()
 }
 
+type suspendedExecutor struct{ closed atomic.Int32 }
+
+func (e *suspendedExecutor) StartTurn(context.Context, string, proto.MessageInput, chan<- proto.Envelope) (agent.Turn, error) {
+	return nil, errors.New("suspended executor must not start a Turn")
+}
+
+func (e *suspendedExecutor) Close(context.Context) error { e.closed.Add(1); return nil }
+
 func suspensionRouter(t *testing.T, sender Sender) *Router {
 	t.Helper()
 	r, err := New(Config{Registry: agent.NewRegistry(), Sender: sender, IdleTimeout: time.Hour})
@@ -40,7 +49,7 @@ func suspensionRouter(t *testing.T, sender Sender) *Router {
 
 func TestQuiesceRejectsEveryUnsettledResource(t *testing.T) {
 	cases := map[string]func(*Router){
-		"active":     func(r *Router) { r.sessions["run"] = &sessionState{ctxCancel: func() {}} },
+		"active":     func(r *Router) { r.sessions["run"] = &sessionState{} },
 		"preparing":  func(r *Router) { r.preparations["p"] = &preparationState{owns: true} },
 		"receipt":    func(r *Router) { r.preparations["p"] = &preparationState{busy: true} },
 		"read":       func(r *Router) { r.workspaceReads = map[string]struct{}{"read": {}} },
@@ -140,6 +149,36 @@ func TestResumeRequiresExactSuspensionAndAssignment(t *testing.T) {
 	}
 }
 
+func TestQuiescePreservesIdleExecutorAgainstExpiredTimer(t *testing.T) {
+	sender := suspendSender(func(context.Context, proto.Envelope) error { return nil })
+	r := suspensionRouter(t, sender)
+	native := &suspendedExecutor{}
+	owner := &executorState{id: "executor", sessionID: "session", environmentID: "env", native: native, cancel: func() {}}
+	r.mu.Lock()
+	r.executors[owner.sessionID] = owner
+	r.scheduleExecutorIdleLocked(owner)
+	oldLease := owner.idleLease
+	r.mu.Unlock()
+	request := proto.EnvironmentSuspendPayload{EnvironmentID: "env", SuspendID: "attempt"}
+	if err := r.Quiesce(context.Background(), suspendRef, request); err != nil {
+		t.Fatal(err)
+	}
+	r.expireIdleExecutor(owner, oldLease)
+	if native.closed.Load() != 0 {
+		t.Fatal("pre-snapshot timer closed retained owner")
+	}
+	if err := r.Resume(suspendRef, request, sender); err != nil {
+		t.Fatal(err)
+	}
+	r.mu.Lock()
+	newLease := owner.idleLease
+	r.mu.Unlock()
+	r.expireIdleExecutor(owner, newLease)
+	if native.closed.Load() != 1 {
+		t.Fatal("normal idle expiration was not restored")
+	}
+}
+
 func TestShutdownDestroysQuiescedOwnerAndCannotResume(t *testing.T) {
 	sender := suspendSender(func(context.Context, proto.Envelope) error { return nil })
 	r := suspensionRouter(t, sender)
diff --git a/apps/daemon/internal/localworkspace/binding.go b/apps/daemon/internal/localworkspace/binding.go
index e747ea41e..5ee7fbf31 100644
--- a/apps/daemon/internal/localworkspace/binding.go
+++ b/apps/daemon/internal/localworkspace/binding.go
@@ -69,8 +69,7 @@ func (b *Binding) Configure(r proto.PromptRequestPayload) (proto.PromptRequestPa
 		return r, nil
 	}
 	if b == nil || r.LocalEnvironment == nil || r.LocalEnvironment.ID != b.environment || r.AgentStateKey != b.stateKey ||
-		r.DisableExecutionEnvironment ||
-		r.ConversationID != "" || !r.StrictResume {
+		r.DisableExecutionEnvironment {
 		return r, errors.New("request does not match the dedicated local Environment")
 	}
 	if !r.WorkspaceReadOnly || r.LocalEnvironment.NetworkAccess != "" || len(r.LocalEnvironment.AllowedDomains) > 0 {
diff --git a/apps/daemon/internal/localworkspace/binding_test.go b/apps/daemon/internal/localworkspace/binding_test.go
index 2beb90e46..6d5bc80a5 100644
--- a/apps/daemon/internal/localworkspace/binding_test.go
+++ b/apps/daemon/internal/localworkspace/binding_test.go
@@ -26,7 +26,7 @@ func testBinding(t *testing.T) (*Binding, proto.PromptRequestPayload) {
 	}
 	b.networkAccess = "disabled"
 	b.capabilityRoot = t.TempDir()
-	return b, proto.PromptRequestPayload{LocalEnvironment: &proto.LocalEnvironment{ID: environment, NetworkAccess: "disabled", WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}, AgentStateKey: "agents-api-" + session, StrictResume: true, ReleaseOnCompletion: true}
+	return b, proto.PromptRequestPayload{LocalEnvironment: &proto.LocalEnvironment{ID: environment, NetworkAccess: "disabled", WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}, AgentStateKey: "agents-api-" + session}
 }
 
 func TestBindingRejectsScopeOverrides(t *testing.T) {
@@ -40,9 +40,8 @@ func TestBindingRejectsScopeOverrides(t *testing.T) {
 		"other Environment": func(r *proto.PromptRequestPayload) {
 			r.LocalEnvironment = &proto.LocalEnvironment{ID: uuid.NewString()}
 		},
-		"other Session":     func(r *proto.PromptRequestPayload) { r.AgentStateKey = "agents-api-" + uuid.NewString() },
-		"none":              func(r *proto.PromptRequestPayload) { r.DisableExecutionEnvironment = true },
-		"non-strict resume": func(r *proto.PromptRequestPayload) { r.StrictResume = false },
+		"other Session": func(r *proto.PromptRequestPayload) { r.AgentStateKey = "agents-api-" + uuid.NewString() },
+		"none":          func(r *proto.PromptRequestPayload) { r.DisableExecutionEnvironment = true },
 	} {
 		t.Run(name, func(t *testing.T) {
 			r := valid
@@ -96,14 +95,6 @@ func TestBindingPrepareRejectsOtherWorkspaceRoot(t *testing.T) {
 	}
 }
 
-func TestBindingAllowsRetainedExecutor(t *testing.T) {
-	b, req := testBinding(t)
-	req.ReleaseOnCompletion = false
-	if _, err := b.Configure(req); err != nil {
-		t.Fatal(err)
-	}
-}
-
 func TestCapabilityLayoutUsesOperatorDirectories(t *testing.T) {
 	b, _ := testBinding(t)
 	for _, directory := range []string{filepath.Join(b.workspace, "capabilities"), filepath.Join(os.Getenv("OAC_RUNTIME_HOME"), "capabilities")} {
diff --git a/apps/daemon/internal/localworkspace/runtime_initialization_process.go b/apps/daemon/internal/localworkspace/runtime_initialization_process.go
index e98dc070b..68174485d 100644
--- a/apps/daemon/internal/localworkspace/runtime_initialization_process.go
+++ b/apps/daemon/internal/localworkspace/runtime_initialization_process.go
@@ -110,7 +110,7 @@ func runInitializationProcess(ctx context.Context, binary string, args []string,
 		return &InitializationFailure{}
 	}
 	process, err := clirunner.Start(clirunner.StartOptions{Parent: operation, Binary: binary, Args: args,
-		Dir: directory, Env: env, OwnProcessGroup: true, KillTimeout: 250 * time.Millisecond})
+		Dir: directory, Env: env, KillTimeout: 250 * time.Millisecond})
 	if err != nil {
 		return ErrInitializationUnconfirmed
 	}
diff --git a/apps/daemon/internal/paths/paths.go b/apps/daemon/internal/paths/paths.go
index 50f01c100..6c835ae3d 100644
--- a/apps/daemon/internal/paths/paths.go
+++ b/apps/daemon/internal/paths/paths.go
@@ -1,6 +1,6 @@
 // Package paths resolves on-disk locations for oac-daemon state under
-// ~/.oac/daemon/<profile>/ — one subdir per profile so several
-// devices on one host never collide.
+// ~/.oac/daemon/<profile>/ — one subdir per profile so "test"
+// and "prod" servers can be connected in parallel without colliding.
 //
 // Files are 0o600, parent dir 0o700. These functions only resolve
 // paths — callers do the I/O.
@@ -50,7 +50,7 @@ func Root() (string, error) {
 	return filepath.Join(home, ".oac"), nil
 }
 
-// ProfileDir returns ~/.oac/daemon/<profile>. It is not created.
+// ProfileDir returns ~/.oac/daemon/<profile>. It is not created here.
 func ProfileDir(profile string) (string, error) {
 	if err := ValidateProfile(profile); err != nil {
 		return "", err
diff --git a/apps/daemon/internal/transport/ws.go b/apps/daemon/internal/transport/ws.go
index 8eedea2f5..e39411074 100644
--- a/apps/daemon/internal/transport/ws.go
+++ b/apps/daemon/internal/transport/ws.go
@@ -24,7 +24,7 @@ type DialOptions struct {
 	// WSURL is the absolute ws://... or wss://... URL.
 	WSURL string
 
-	// DeviceID is the runtime row id issued with the credential. Sent as
+	// DeviceID is the runtime row id from the daemon credential. Sent as
 	// device_id query param; the gateway uses it as the session key.
 	DeviceID string
 
diff --git a/apps/daemon/internal/transport/ws_test.go b/apps/daemon/internal/transport/ws_test.go
index 01cee4ff9..7e6b2fbf7 100644
--- a/apps/daemon/internal/transport/ws_test.go
+++ b/apps/daemon/internal/transport/ws_test.go
@@ -186,9 +186,9 @@ func TestRecvDeliversServerSentFrames(t *testing.T) {
 	}
 	defer conn.Close()
 
-	// Server pushes a prompt_request down to the daemon.
+	// Server pushes a prompt_cancel down to the daemon.
 	serverConn := <-gw.connCh
-	pushed, _ := proto.NewEnvelope("prompt_request", "run_abc", map[string]string{"prompt": "hi"})
+	pushed, _ := proto.NewEnvelope(proto.TypePromptCancel, "run_abc", proto.PromptCancelPayload{DeliveryID: "cancel"})
 	raw, _ := json.Marshal(pushed)
 	if err := serverConn.WriteMessage(websocket.TextMessage, raw); err != nil {
 		t.Fatalf("server write: %v", err)
@@ -196,8 +196,8 @@ func TestRecvDeliversServerSentFrames(t *testing.T) {
 
 	select {
 	case env := <-conn.Recv():
-		if env.Type != "prompt_request" || env.ID != "run_abc" {
-			t.Errorf("received %+v, want prompt_request/run_abc", env)
+		if env.Type != proto.TypePromptCancel || env.ID != "run_abc" {
+			t.Errorf("received %+v, want prompt_cancel/run_abc", env)
 		}
 	case <-time.After(2 * time.Second):
 		t.Fatal("never received the server-pushed frame")
diff --git a/apps/daemon/internal/wireconformance/wire_test.go b/apps/daemon/internal/wireconformance/wire_test.go
index 4d8dacb00..22667ed26 100644
--- a/apps/daemon/internal/wireconformance/wire_test.go
+++ b/apps/daemon/internal/wireconformance/wire_test.go
@@ -158,7 +158,7 @@ func connectRuntime(t *testing.T, peer *corePeer, setupErr error) *runtimeSide {
 	kinds := agent.NewRegistry()
 	kinds.RegisterKind(proto.SupportedAgentKind{Kind: prototest.HarnessKind, Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported})},
 		prototest.ModelConfiguration(), func(context.Context, proto.PromptRequestPayload, chan<- proto.Envelope) (agent.Session, error) {
-			return nil, errors.New("prepared execution must not use prompt_request")
+			return nil, errors.New("prepared execution must not use the direct Session factory")
 		})
 	kinds.RegisterExecutor(prototest.HarnessKind, func(context.Context, proto.PromptRequestPayload) (agent.Executor, error) {
 		return rt.executor, setupErr
diff --git a/apps/daemon/testdata/onboarding/main.go b/apps/daemon/testdata/onboarding/main.go
index 4c35cc0cc..5dbb2bdc3 100644
--- a/apps/daemon/testdata/onboarding/main.go
+++ b/apps/daemon/testdata/onboarding/main.go
@@ -38,10 +38,10 @@ type harness struct {
 }
 
 func (h *harness) prepare(_ context.Context, req proto.PromptRequestPayload) (agent.Executor, error) {
-	if req.RunID != "" || len(req.Input) != 0 || req.ConversationID != "" {
+	if req.RunID != "" || len(req.Input) != 0 {
 		return nil, errors.New("preparation submitted fixture input")
 	}
-	if !req.StrictResume || !req.DisableExecutionEnvironment || !req.DisableSubagents || len(req.FunctionTools) > 0 || req.MCPHTTPServers != nil {
+	if !req.DisableExecutionEnvironment || !req.DisableSubagents || len(req.FunctionTools) > 0 || req.MCPHTTPServers != nil {
 		return nil, errors.New("unsupported fixture operation")
 	}
 	h.mu.Lock()
diff --git a/apps/web/e2e/access.spec.ts b/apps/web/e2e/access.spec.ts
index d5a1a90ab..41149ef97 100644
--- a/apps/web/e2e/access.spec.ts
+++ b/apps/web/e2e/access.spec.ts
@@ -14,7 +14,7 @@ const browserStorage = (page: Page) => page.evaluate(() => JSON.stringify({ ...w
 test("signs in with the Core key, keeps it out of the browser, and signs out and back in", async ({ page, request }) => {
   await resetFixture(request, "login");
   await recordV1Requests(page);
-  await page.addInitScript(() => window.localStorage.setItem("agents-core-web.language", "en"));
+  await page.addInitScript(() => window.localStorage.setItem("oac-web.language", "en"));
   await page.goto("/");
 
   await expect(page.getByRole("heading", { name: "Sign in to OpenAgentCore" })).toBeVisible();
@@ -47,7 +47,7 @@ test("signs in with the Core key, keeps it out of the browser, and signs out and
 test("opens a fresh install on the Overview's Getting started: a project and its key shown once, then the step is done", async ({ page, request }) => {
   await resetFixture(request, "login", { fresh: true });
   await recordV1Requests(page);
-  await page.addInitScript(() => window.localStorage.setItem("agents-core-web.language", "en"));
+  await page.addInitScript(() => window.localStorage.setItem("oac-web.language", "en"));
   await page.goto("/");
   await signIn(page, FIXTURE_CORE_KEY);
 
diff --git a/apps/web/e2e/console.ts b/apps/web/e2e/console.ts
index 78000a332..1e50de4db 100644
--- a/apps/web/e2e/console.ts
+++ b/apps/web/e2e/console.ts
@@ -40,7 +40,7 @@ export async function openConsole(page: Page, request: APIRequestContext, hash =
   await resetFixture(request, "authenticated", options);
   await recordV1Requests(page);
   await page.context().addCookies([{ name: "core_console", value: "fixture-session", url: web }]);
-  await page.addInitScript(() => window.localStorage.setItem("agents-core-web.language", "en"));
+  await page.addInitScript(() => window.localStorage.setItem("oac-web.language", "en"));
   await page.goto(`/#${hash}`);
 }
 
diff --git a/apps/web/e2e/nodes.spec.ts b/apps/web/e2e/nodes.spec.ts
index 721bcf6a0..f404a5de6 100644
--- a/apps/web/e2e/nodes.spec.ts
+++ b/apps/web/e2e/nodes.spec.ts
@@ -35,12 +35,12 @@ test("adds a node: host requirements, a root/sudo command, a countdown, the same
   const field = add.getByLabel("One-time enrollment command", { exact: true });
   await expect(field).toHaveValue(/enroll_fixture_/);
   // The token goes on stdin to the checked installer, run with sudo unless the shell is root.
-  await expect(field).toHaveValue(/^ \(umask 077;.*\|\| s=sudo\n/);
-  await expect(field).toHaveValue(/\| \$s \$\{s:\+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY\} python3 "\$d\/node-install\.pyz" \$\{NO_COLOR\+--no-color\} --enrollment-token-stdin /);
+  await expect(field).toHaveValue(/^ \(umask 077\n/);
+  await expect(field).toHaveValue(/\| \$s \$\{s:\+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY\} python3 "\$installer" \$\{NO_COLOR\+--no-color\} --enrollment-token-stdin /);
   // It downloads from, and names as its source, the public URL, not the loopback address this browser uses.
   await expect(field).toHaveValue(/curl [^\n]* 'https:\/\/core\.example\.com\/node-install\/node-install\.pyz' /);
   await expect(field).toHaveValue(/ --source-url 'https:\/\/core\.example\.com' --core-url 'https:\/\/core\.example\.com' /);
-  await expect(add.getByText("If the command is interrupted or the download stalls, run the same command again: the download resumes.")).toBeVisible();
+  await expect(add.getByText("If the command is interrupted or the download stalls, run it again: unfinished downloads restart, and verified files are reused.")).toBeVisible();
   await expect(add.getByRole("timer")).toHaveText(/^Expires in (10:00|9:\d\d)$/);
   const progress = add.getByRole("status", { name: "Registration progress" });
   await expect(progress).toHaveText(/Waiting for registration.*Connect.*Docker check/);
@@ -155,7 +155,7 @@ test("removes a node after confirmation", async ({ page, request }) => {
   await expect(page.getByRole("table", { name: "Sandbox nodes" })).not.toContainText("edge-03");
   // Removing the Core record leaves the system service for root/sudo to uninstall on its host.
   const cleanup = page.getByRole("dialog", { name: "Clean up the host" });
-  await expect(cleanup.getByLabel("Uninstall command", { exact: true })).toHaveValue(/\| s=sudo\nexport http_proxy=[^\n]+\nexport HTTP_PROXY=[^\n]+\nprintf '\\n==> Downloading node installer\.\.\.\\n' &&\ncurl [^\n]* 'https:\/\/core\.example\.com\/node-install\/node-install\.pyz' [^]*\n\$s \$\{s:\+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY\} python3 "\$d\/node-install\.pyz" \$\{NO_COLOR\+--no-color\} --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f'\)$/);
+  await expect(cleanup.getByLabel("Uninstall command", { exact: true })).toHaveValue(/\| s=sudo\nexport http_proxy=[^\n]+\nexport HTTP_PROXY=[^\n]+\nprintf '\\n==> Downloading node installer\.\.\.\\n' &&\ncurl [^\n]* 'https:\/\/core\.example\.com\/node-install\/node-install\.pyz' [^]*\n\$s \$\{s:\+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY\} python3 "\$installer" \$\{NO_COLOR\+--no-color\} --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f'\)$/);
   await expect(cleanup.getByText("Installed without sudo?")).toHaveCount(0);
   await expect(cleanup.getByLabel("Uninstall command without sudo", { exact: true })).toHaveCount(0);
   // Nothing to force for a node on the current address; closing leaves focus on the page, as the row is gone.
diff --git a/apps/web/e2e/overview-readiness.spec.ts b/apps/web/e2e/overview-readiness.spec.ts
index 5f22542d5..540a37405 100644
--- a/apps/web/e2e/overview-readiness.spec.ts
+++ b/apps/web/e2e/overview-readiness.spec.ts
@@ -164,7 +164,7 @@ test("failed summary and Session refreshes preserve their previous evidence unti
 });
 
 test("installation failure cannot complete onboarding and its retry reveals local-only blockage", async ({ page, request }) => {
-  await page.addInitScript(() => window.localStorage.setItem("agents-core-web.getting-started.7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f", "open"));
+  await page.addInitScript(() => window.localStorage.setItem("oac-web.getting-started.7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f", "open"));
   await page.route("**/core/v1/installation", (route) => route.fulfill(reject));
   await openConsole(page, request, "overview", { installation: "local" });
   const step = page.locator(".getting-started-step").first();
diff --git a/apps/web/index.html b/apps/web/index.html
index b65773249..4bd5a5edd 100644
--- a/apps/web/index.html
+++ b/apps/web/index.html
@@ -13,7 +13,7 @@
     <title>OpenAgentCore</title>
     <script>
       ;(() => {
-        const stored = localStorage.getItem("agents-core-web.theme")
+        const stored = localStorage.getItem("oac-web.theme")
         const preference =
           stored === "light" || stored === "dark" || stored === "system" ? stored : "system"
         const resolved =
diff --git a/apps/web/src/features/overview/getting-started.test.ts b/apps/web/src/features/overview/getting-started.test.ts
index 356c075dc..56a9990a7 100644
--- a/apps/web/src/features/overview/getting-started.test.ts
+++ b/apps/web/src/features/overview/getting-started.test.ts
@@ -126,10 +126,10 @@ describe("Getting started visibility", () => {
     const stored = new Map<string, string>();
     vi.stubGlobal("window", { localStorage: { getItem: (key: string) => stored.get(key) ?? null, setItem: (key: string, value: string) => stored.set(key, value) } });
     const down: FleetState = { status: "failed", error: new Error("down") };
-    expect(checklistStorageKey(fleet(deployment({ installation_id: "inst-1" })))).toBe("agents-core-web.getting-started.inst-1");
-    expect(checklistStorageKey(down)).toBe("agents-core-web.getting-started");
+    expect(checklistStorageKey(fleet(deployment({ installation_id: "inst-1" })))).toBe("oac-web.getting-started.inst-1");
+    expect(checklistStorageKey(down)).toBe("oac-web.getting-started");
     rememberInstallation("inst-1");
-    expect(checklistStorageKey(down)).toBe("agents-core-web.getting-started.inst-1");
+    expect(checklistStorageKey(down)).toBe("oac-web.getting-started.inst-1");
     expect(checklistStorageKey({ status: "loading" })).toBeNull();
   });
 });
diff --git a/apps/web/src/features/overview/getting-started.ts b/apps/web/src/features/overview/getting-started.ts
index f1f803ce9..24d47382f 100644
--- a/apps/web/src/features/overview/getting-started.ts
+++ b/apps/web/src/features/overview/getting-started.ts
@@ -131,9 +131,9 @@ export function checklistView(states: readonly StepState[], memory: ChecklistMem
   return memory === "open" && states.some((state) => state !== null) ? "full" : "hidden";
 }
 
-const MEMORY_KEY = "agents-core-web.getting-started";
+const MEMORY_KEY = "oac-web.getting-started";
 /** The installation this browser last read, so the checklist keeps its entry while the deployment cannot be read. */
-const INSTALLATION_KEY = "agents-core-web.last-installation";
+const INSTALLATION_KEY = "oac-web.last-installation";
 
 /**
  * The storage entry for this installation, so a reinstall at the same origin
diff --git a/apps/web/src/features/sandbox/NodeEnrollment.tsx b/apps/web/src/features/sandbox/NodeEnrollment.tsx
index bd9cab55c..8bcc30e87 100644
--- a/apps/web/src/features/sandbox/NodeEnrollment.tsx
+++ b/apps/web/src/features/sandbox/NodeEnrollment.tsx
@@ -21,7 +21,7 @@ import { enrolledNode, enrollmentProgress, formatCountdown, progressSteps, type
 import { sandboxConsoleConfigQuery } from "./sandbox-queries";
 
 /** The host requirements open by default until this browser has shown them once. */
-const REQUIREMENTS_SEEN = "agents-core-web.node-requirements-seen";
+const REQUIREMENTS_SEEN = "oac-web.node-requirements-seen";
 function requirementsSeen(): boolean {
   try { return window.localStorage.getItem(REQUIREMENTS_SEEN) === "1"; } catch { return false; }
 }
@@ -293,7 +293,7 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
         {command ? <CommandBlock key={command} value={command} label={t("One-time enrollment command")} autoFocus
           extra={!registered ? <span className="sandbox-command-expiry" role="timer" title={new Date(enrollment.expires_at).toLocaleString(locale)}>{t("Expires in {{time}}", { time: formatCountdown(Date.parse(enrollment.expires_at) - now) })}</span> : null} /> : null}
         {/* The installer keeps partial downloads and exits 130 on Ctrl-C; the token lasts until the countdown ends. */}
-        {command ? <p className="sandbox-command-note">{t("If the command is interrupted or the download stalls, run the same command again: the download resumes.")}</p> : null}
+        {command ? <p className="sandbox-command-note">{t("If the command is interrupted or the download stalls, run it again: unfinished downloads restart, and verified files are reused.")}</p> : null}
         {/* One live region for the whole flow; only its contents change, so each change is announced. */}
         <div role="status" aria-label={t("Registration progress")}>
           {ready && node ? <div className="sandbox-enrollment-status connected"><span className="sandbox-status-dot" />{t("{{name}} · Connected", { name: node.name })}</div>
diff --git a/apps/web/src/features/sandbox/enrollment-command.test.ts b/apps/web/src/features/sandbox/enrollment-command.test.ts
index 180c4e1b9..d0d1a2405 100644
--- a/apps/web/src/features/sandbox/enrollment-command.test.ts
+++ b/apps/web/src/features/sandbox/enrollment-command.test.ts
@@ -7,37 +7,12 @@ import { join } from "node:path";
 import { nodeInstallCommand, nodeLogCommand, nodeUninstallCommand } from "./enrollment-command";
 
 describe("sandbox connection and enrollment", () => {
-  const digest = "a".repeat(64);
-  const install = () => nodeInstallCommand({ token: "secret'onetime", coreUrl: "https://core.example", sourceUrl: "https://console.example", provider: "docker", installationId: "7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f", scriptDigest: digest });
-  it("creates the exact sudo command: a leading space, the checked installer run as root, the token only on stdin", () => {
-    expect(install()).toBe(` (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT; s=; [ "$(id -u)" -eq 0 ] || s=sudo
-export http_proxy="\${http_proxy-\${HTTP_PROXY-}}" https_proxy="\${https_proxy-\${HTTPS_PROXY-}}" no_proxy="\${no_proxy-\${NO_PROXY-}}"
-export HTTP_PROXY="$http_proxy" HTTPS_PROXY="$https_proxy" NO_PROXY="$no_proxy"
-printf '\\n==> Downloading node installer...\\n' &&
-curl -fs --max-time 30 --max-filesize 1048576 'https://console.example/node-install/node-install.pyz' -o "$d/node-install.pyz" || { c=$?; printf 'Cannot download node installer; check the console URL, TLS and proxy settings.\\n' >&2; exit "$c"; }
-printf '==> Verifying node installer...\\n' &&
-printf '%s  %s\\n' '${digest}' "$d/node-install.pyz" | sha256sum -c --status &&
-printf '%s\\n' 'secret'\\''onetime' | $s \${s:+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY} python3 "$d/node-install.pyz" \${NO_COLOR+--no-color} --enrollment-token-stdin --source-url 'https://console.example' --core-url 'https://core.example' --provider 'docker' --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f')`);
-  });
-  it("creates the exact uninstall commands, with no token", () => {
-    const uninstall = () => nodeUninstallCommand({ sourceUrl: "https://console.example", installationId: "7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f", scriptDigest: digest });
-    expect(uninstall()).toBe(` (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT; s=; [ "$(id -u)" -eq 0 ] || s=sudo
-export http_proxy="\${http_proxy-\${HTTP_PROXY-}}" https_proxy="\${https_proxy-\${HTTPS_PROXY-}}" no_proxy="\${no_proxy-\${NO_PROXY-}}"
-export HTTP_PROXY="$http_proxy" HTTPS_PROXY="$https_proxy" NO_PROXY="$no_proxy"
-printf '\\n==> Downloading node installer...\\n' &&
-curl -fs --max-time 30 --max-filesize 1048576 'https://console.example/node-install/node-install.pyz' -o "$d/node-install.pyz" || { c=$?; printf 'Cannot download node installer; check the console URL, TLS and proxy settings.\\n' >&2; exit "$c"; }
-printf '==> Verifying node installer...\\n' &&
-printf '%s  %s\\n' '${digest}' "$d/node-install.pyz" | sha256sum -c --status &&
-$s \${s:+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY} python3 "$d/node-install.pyz" \${NO_COLOR+--no-color} --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f')`);
-    expect(nodeUninstallCommand({ sourceUrl: "https://console.example", installationId: "7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f", scriptDigest: digest, force: true }).split("\n").at(-1))
-      .toBe(`$s \${s:+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY} python3 "$d/node-install.pyz" \${NO_COLOR+--no-color} --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f' --force)`);
-  });
   it("points at the system node journal", () => {
     expect(nodeLogCommand("7f3c2a90-fixture")).toBe("sudo journalctl -u oac-node-7f3c2a90-fixture.service");
     expect(nodeLogCommand("a b")).toBe("sudo journalctl -u 'oac-node-a b.service'");
   });
   // "as root": a root shell runs the sudo command without sudo.
-  it.each(["success", "download failure", "checksum mismatch", "installer failure", "as root", "no color", "uppercase proxy", "lowercase proxy", "empty proxy", "root proxy"])("executes safely, passes the token only on stdin and cleans private downloads after %s", (scenario) => {
+  it.each(["success", "download failure", "checksum mismatch", "installer failure", "as root", "no color", "uppercase proxy", "lowercase proxy", "empty proxy", "root proxy", "unsupported platform", "old python", "uninstall", "killed download"])("executes safely, passes the token only on stdin and cleans private downloads after %s", (scenario) => {
     const parent = join(homedir(), ".oac", "tests");
     mkdirSync(parent, { recursive: true });
     const root = mkdtempSync(join(parent, "node-command-"));
@@ -55,12 +30,15 @@ $s \${s:+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,N
 if(process.env.SCENARIO==='download failure') process.exit(22);
 const args=process.argv.slice(2);
 if(args.includes('-L')||args.includes('--location')||args.includes('--insecure')) process.exit(90);
-fs.writeFileSync(args[args.indexOf('-o')+1],fs.readFileSync(process.env.FIXTURE));`);
+fs.writeFileSync(args[args.indexOf('-o')+1],fs.readFileSync(process.env.FIXTURE));
+if(process.env.SCENARIO==='killed download') process.kill(process.ppid,'SIGKILL');`);
     executable("sha256sum", `const fs=require('node:fs'), crypto=require('node:crypto');
 const line=fs.readFileSync(0,'utf8').trimEnd(), split=line.indexOf('  ');
 if(split!==64) process.exit(2);
 const actual=crypto.createHash('sha256').update(fs.readFileSync(line.slice(split+2))).digest('hex');
 process.exit(actual===line.slice(0,split)?0:1);`);
+    executable("flock", `process.exit(0);`);
+    executable("uname", `console.log(process.argv[2]==='-s'?(process.env.SCENARIO==='unsupported platform'?'Darwin':'Linux'):'x86_64');`);
     executable("id", `console.log((process.env.SCENARIO==='as root'||process.env.SCENARIO==='root proxy')?'0':'1000');`);
     // The shell's builtin printf feeds the token; an external one would put it in an argv.
     executable("printf", `require('node:fs').appendFileSync(process.env.PRINTF_REPORT,'called\\n');`);
@@ -71,19 +49,34 @@ const env={...process.env}; delete env.NO_COLOR;
 for(const key of Object.keys(env)) if(/_proxy$/i.test(key)&&!keep.includes(key)) delete env[key];
 process.exit(spawnSync(args[0],args.slice(1),{stdio:'inherit',env}).status ?? 1);`);
     executable("python3", `const fs=require('node:fs');
+if(process.argv[2]==='-c') process.exit(process.env.SCENARIO==='old python'?1:0);
 const stdin=fs.readFileSync(0,'utf8');
 fs.writeFileSync(process.env.REPORT,JSON.stringify({args:process.argv.slice(2),env:process.env,stdin,mode:fs.statSync(process.argv[2]).mode&511}));
 process.exit(process.env.SCENARIO==='installer failure'?7:0);`);
     const digest = scenario === "checksum mismatch" ? "0".repeat(64) : createHash("sha256").update(payload).digest("hex");
     const token = "fixture'one-time";
     try {
-      const command = nodeInstallCommand({ token, coreUrl: "http://127.0.0.1:8091", sourceUrl: "http://localhost:8080", provider: "docker", installationId: "fixture-installation", scriptDigest: digest });
+      const command = scenario === "uninstall" ? nodeUninstallCommand({ sourceUrl: "http://localhost:8080", installationId: "fixture-installation", scriptDigest: digest }) : nodeInstallCommand({ token, coreUrl: "http://127.0.0.1:8091", sourceUrl: "http://localhost:8080", provider: "docker", installationId: "fixture-installation", scriptDigest: digest });
       const proxy = "http://fixture:private%20password@proxy.example:3128";
       const proxyEnv: Record<string, string | undefined> = { http_proxy: undefined, https_proxy: undefined, no_proxy: undefined, HTTP_PROXY: undefined, HTTPS_PROXY: undefined, NO_PROXY: undefined, ALL_PROXY: undefined };
       if (["uppercase proxy", "root proxy", "empty proxy"].includes(scenario)) Object.assign(proxyEnv, { HTTP_PROXY: proxy, HTTPS_PROXY: proxy, NO_PROXY: "core.example,localhost" });
       if (scenario === "lowercase proxy") Object.assign(proxyEnv, { http_proxy: proxy, https_proxy: proxy, no_proxy: "core.example,localhost", HTTP_PROXY: "http://wrong.invalid" });
       if (scenario === "empty proxy") proxyEnv.http_proxy = "";
-      const result = spawnSync("sh", ["-c", command], { env: { ...process.env, ...proxyEnv, NO_COLOR: scenario === "no color" ? "" : undefined, PATH: `${bin}:${process.env.PATH}`, TMPDIR: temporary, SCENARIO: scenario, FIXTURE: fixture, REPORT: report, SUDO_REPORT: sudoReport, PRINTF_REPORT: printfReport }, encoding: "utf8" });
+      const options = { env: { ...process.env, ...proxyEnv, HOME: root, NO_COLOR: scenario === "no color" ? "" : undefined, PATH: `${bin}:${process.env.PATH}`, TMPDIR: temporary, SCENARIO: scenario, FIXTURE: fixture, REPORT: report, SUDO_REPORT: sudoReport, PRINTF_REPORT: printfReport }, encoding: "utf8" as const };
+      let result = spawnSync("sh", ["-c", command], options);
+      if (scenario === "killed download") {
+        expect(result.signal === "SIGKILL" || result.status === 137).toBe(true);
+        expect(readdirSync(join(root, ".oac/node-bootstrap"))).toContain("download.partial");
+        result = spawnSync("sh", ["-c", command], { ...options, env: { ...options.env, SCENARIO: "success" } });
+      }
+      if (["unsupported platform", "old python"].includes(scenario)) {
+        expect(result.status).toBe(1);
+        expect(result.stdout).not.toContain("Downloading");
+        expect(result.stderr).toContain(scenario === "old python" ? "Python 3.9" : "Linux amd64");
+        expect(readdirSync(root)).not.toContain("report.json");
+        expect(readdirSync(temporary)).toEqual([]);
+        return;
+      }
       expect(result.status).toBe(scenario === "installer failure" ? 7 : scenario === "download failure" ? 22 : scenario === "checksum mismatch" ? 1 : 0);
       expect(result.stdout).toContain("==> Downloading node installer...");
       expect(result.stdout.includes("==> Verifying node installer...")).toBe(scenario !== "download failure");
@@ -91,6 +84,7 @@ process.exit(process.env.SCENARIO==='installer failure'?7:0);`);
       expect(result.stdout + result.stderr).not.toContain("private%20password");
       expect(result.stdout + result.stderr).not.toContain("\u001b[");
       expect(readdirSync(temporary)).toEqual([]);
+      expect(readdirSync(join(root, ".oac/node-bootstrap"))).not.toContain("download.partial");
       expect(readdirSync(root)).not.toContain("printf.log");
       if (scenario === "download failure" || scenario === "checksum mismatch") {
         expect(readdirSync(root)).not.toContain("report.json");
@@ -106,10 +100,10 @@ process.exit(process.env.SCENARIO==='installer failure'?7:0);`);
         expect(invocation.env[key]).toBe(expected);
         expect(invocation.env[key.toUpperCase()]).toBe(expected);
       }
-      expect(invocation.stdin).toBe(`${token}\n`);
+      expect(invocation.stdin).toBe(scenario === "uninstall" ? "" : `${token}\n`);
       expect(invocation.args.some((arg) => arg.includes("one-time"))).toBe(false);
       expect(Object.values(invocation.env).some((value) => value.includes("one-time"))).toBe(false);
-      expect(invocation.args.slice(1)).toEqual([...(scenario === "no color" ? ["--no-color"] : []), "--enrollment-token-stdin", "--source-url", "http://localhost:8080", "--core-url", "http://127.0.0.1:8091", "--provider", "docker", "--installation-id", "fixture-installation"]);
+      expect(invocation.args.slice(1)).toEqual(scenario === "uninstall" ? ["--uninstall", "--installation-id", "fixture-installation"] : [...(scenario === "no color" ? ["--no-color"] : []), "--enrollment-token-stdin", "--source-url", "http://localhost:8080", "--core-url", "http://127.0.0.1:8091", "--provider", "docker", "--installation-id", "fixture-installation"]);
       expect(invocation.mode & 0o077).toBe(0);
       if (scenario === "as root" || scenario === "root proxy") {
         expect(readdirSync(root)).not.toContain("sudo.json");
diff --git a/apps/web/src/features/sandbox/enrollment-command.ts b/apps/web/src/features/sandbox/enrollment-command.ts
index f67f7d301..2663c1792 100644
--- a/apps/web/src/features/sandbox/enrollment-command.ts
+++ b/apps/web/src/features/sandbox/enrollment-command.ts
@@ -1,26 +1,41 @@
 const quote = (value: string) => `'${value.replaceAll("'", "'\\''")}'`;
 
 /**
- * The start the node commands share: a private directory removed on exit, then
- * the console's installer, checked against its digest before anything runs. The
- * leading space keeps the command out of shell history under
- * HISTCONTROL=ignorespace. In sudo mode `s` is set before the `&&` chain, so a
- * failed download or check stops the command. It ends where the installer's own
- * line begins.
+ * Download and verify into an immutable cache entry before invoking sudo.
+ * The download lock protects disposable files; verified entries remain usable
+ * by other running installers. A leading space supports HISTCONTROL=ignorespace.
  */
 function nodeInstaller(sourceUrl: string, scriptDigest: string): string {
-  return ` (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT; s=; [ "$(id -u)" -eq 0 ] || s=sudo
+  if (!/^[0-9a-f]{64}$/.test(scriptDigest)) throw new Error("Invalid node installer checksum");
+  return ` (umask 077
+[ "$(uname -s)/$(uname -m)" = Linux/x86_64 ] || { printf 'Node installation requires Linux amd64. Use a Linux host for Nodes, or a self-hosted Session for this machine.\\n' >&2; exit 1; }
+for tool in curl sha256sum python3 flock; do command -v "$tool" >/dev/null || { printf 'Required command missing: %s. Install it and rerun.\\n' "$tool" >&2; exit 1; }; done
+python3 -c 'import sys; sys.exit(sys.version_info < (3, 9))' || { printf 'Python 3.9 or newer is required.\\n' >&2; exit 1; }
+[ "$(id -u)" -eq 0 ] || command -v sudo >/dev/null || { printf 'sudo is required; ask the host administrator to run this command.\\n' >&2; exit 1; }
+d="$HOME/.oac/node-bootstrap"
+[ ! -L "$d" ] && mkdir -p "$d" && [ -d "$d" ] && [ -O "$d" ] && chmod 700 "$d" || { printf 'Cannot use the private node bootstrap directory.\\n' >&2; exit 1; }
+installer="$d"/${quote(scriptDigest + ".pyz")}
+for f in "$d/download.lock" "$d/download.partial" "$installer"; do [ ! -L "$f" ] && { [ ! -e "$f" ] || { [ -f "$f" ] && [ -O "$f" ]; }; } || { printf 'Invalid node bootstrap file.\\n' >&2; exit 1; }; done
+exec 9>>"$d/download.lock"
+flock -n 9 || { printf 'Another node download is running; wait and retry.\\n' >&2; exit 1; }
+rm -f "$d/download.partial" || exit
+trap 'rm -f "$d/download.partial"' EXIT
+s=; [ "$(id -u)" -eq 0 ] || s=sudo
 export http_proxy="\${http_proxy-\${HTTP_PROXY-}}" https_proxy="\${https_proxy-\${HTTPS_PROXY-}}" no_proxy="\${no_proxy-\${NO_PROXY-}}"
 export HTTP_PROXY="$http_proxy" HTTPS_PROXY="$https_proxy" NO_PROXY="$no_proxy"
 printf '\\n==> Downloading node installer...\\n' &&
-curl -fs --max-time 30 --max-filesize 1048576 ${quote(sourceUrl + "/node-install/node-install.pyz")} -o "$d/node-install.pyz" || { c=$?; printf 'Cannot download node installer; check the console URL, TLS and proxy settings.\\n' >&2; exit "$c"; }
+curl -fs --connect-timeout 15 --max-time 60 --retry 2 --retry-connrefused --retry-delay 1 --max-filesize 1048576 ${quote(sourceUrl + "/node-install/node-install.pyz")} -o "$d/download.partial" || { c=$?; printf 'Cannot download node installer; check the console URL, TLS and proxy settings.\\n' >&2; exit "$c"; }
 printf '==> Verifying node installer...\\n' &&
-printf '%s  %s\\n' ${quote(scriptDigest)} "$d/node-install.pyz" | sha256sum -c --status &&
+printf '%s  %s\\n' ${quote(scriptDigest)} "$d/download.partial" | sha256sum -c --status || { printf 'Node installer checksum mismatch; generate a fresh command in Web and retry.\\n' >&2; exit 1; }
+mv "$d/download.partial" "$installer" || exit
+trap - EXIT
+flock -u 9
+exec 9>&-
 `;
 }
 
 /** Runs the downloaded installer, as root in sudo mode. */
-const runInstaller = `$s \${s:+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY} python3 "$d/node-install.pyz" \${NO_COLOR+--no-color}`;
+const runInstaller = `$s \${s:+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY} python3 "$installer" \${NO_COLOR+--no-color}`;
 
 /**
  * Adds this host as a node. The one-time token reaches the installer only on
diff --git a/apps/web/src/features/sandbox/node-enrollment.ts b/apps/web/src/features/sandbox/node-enrollment.ts
index 49f7666e4..7e2f6678a 100644
--- a/apps/web/src/features/sandbox/node-enrollment.ts
+++ b/apps/web/src/features/sandbox/node-enrollment.ts
@@ -18,7 +18,7 @@ export interface HostPrerequisite {
  * What a host needs for the default command, which runs the installer as root
  * and the node as the `oac-node` system service (sudo mode), as the command
  * and deploy/node/node_install.py check it:
- * - the command runs curl, sha256sum and python3 (enrollment-command.ts), and
+ * - the command runs curl, sha256sum, flock and python3 (enrollment-command.ts), and
  *   `sudo` unless the shell is root; `host_checks` needs Python 3.9+, Linux amd64,
  *   systemd as the init system, and SELinux not enforcing; `other_node` refuses a
  *   host that already runs a sudo-mode node for another installation, since
@@ -42,7 +42,7 @@ export interface HostPrerequisite {
  */
 export function hostRequirements(provider: "docker" | "microsandbox", sized: boolean): HostPrerequisite[] {
   return [
-    { label: "Linux amd64 with systemd; Python 3.9+, curl and sha256sum; root or sudo" },
+    { label: "Linux amd64 with systemd; Python 3.9+, curl, sha256sum and flock; root or sudo" },
     { label: "SELinux is not enforcing" },
     { label: "In sudo mode, one Core per host: a host already running a sudo-mode node for another Core is refused." },
     provider === "docker"
diff --git a/apps/web/src/i18n/i18n.test.tsx b/apps/web/src/i18n/i18n.test.tsx
index f49befe07..59595904b 100644
--- a/apps/web/src/i18n/i18n.test.tsx
+++ b/apps/web/src/i18n/i18n.test.tsx
@@ -44,7 +44,7 @@ describe("Web internationalization", () => {
   });
 
   it("honors a saved choice and otherwise selects the first supported browser preference", () => {
-    expect(resolveLanguage("zh", ["en-US"])).toBe("zh-CN");
+    expect(resolveLanguage("zh-CN", ["en-US"])).toBe("zh-CN");
     expect(resolveLanguage("en", ["zh-CN"])).toBe("en");
     expect(resolveLanguage(null, ["en-US", "zh-CN"])).toBe("en");
     expect(resolveLanguage(null, ["fr-FR", "zh-Hans", "en-US"])).toBe("zh-CN");
diff --git a/apps/web/src/i18n/index.ts b/apps/web/src/i18n/index.ts
index baa7b0cfb..8837b0473 100644
--- a/apps/web/src/i18n/index.ts
+++ b/apps/web/src/i18n/index.ts
@@ -6,12 +6,10 @@ import { defaultNamespace, resources } from "./resources";
 export const supportedLanguages = ["en", "zh-CN"] as const;
 export type SupportedLanguage = (typeof supportedLanguages)[number];
 
-const LANGUAGE_STORAGE_KEY = "agents-core-web.language";
-const LEGACY_LANGUAGE_STORAGE_KEY = "agents-core-web.locale";
+const LANGUAGE_STORAGE_KEY = "oac-web.language";
 
 export function resolveLanguage(stored: string | null, languages: readonly string[]): SupportedLanguage {
   if (stored === "en" || stored === "zh-CN") return stored;
-  if (stored === "zh") return "zh-CN";
   for (const language of languages) {
     const normalized = language.toLowerCase();
     if (normalized.startsWith("zh")) return "zh-CN";
@@ -24,7 +22,7 @@ function browserLanguage(): SupportedLanguage {
   if (typeof window === "undefined") return "en";
   let stored: string | null = null;
   try {
-    stored = window.localStorage.getItem(LANGUAGE_STORAGE_KEY) ?? window.localStorage.getItem(LEGACY_LANGUAGE_STORAGE_KEY);
+    stored = window.localStorage.getItem(LANGUAGE_STORAGE_KEY);
   } catch {
     // Storage can be unavailable in privacy-restricted browser contexts.
   }
@@ -49,7 +47,6 @@ export function setLanguage(language: SupportedLanguage): Promise<unknown> {
   if (typeof window !== "undefined") {
     try {
       window.localStorage.setItem(LANGUAGE_STORAGE_KEY, language);
-      window.localStorage.removeItem(LEGACY_LANGUAGE_STORAGE_KEY);
     } catch {
       // Keep the in-memory choice when persistence is unavailable.
     }
diff --git a/apps/web/src/lib/locale-strings.ts b/apps/web/src/lib/locale-strings.ts
index 8e98ba65c..a9e7a6171 100644
--- a/apps/web/src/lib/locale-strings.ts
+++ b/apps/web/src/lib/locale-strings.ts
@@ -143,10 +143,10 @@ export const chinese = {
   "Change limits": "修改上限",
   "Add another node": "添加另一个节点",
   "Host requirements": "主机要求",
-  "Linux amd64 with systemd; Python 3.9+, curl and sha256sum; root or sudo": "Linux amd64，使用 systemd；装有 Python 3.9+、curl 和 sha256sum；有 root 或 sudo 权限",
+  "Linux amd64 with systemd; Python 3.9+, curl, sha256sum and flock; root or sudo": "Linux amd64，使用 systemd；装有 Python 3.9+、curl、sha256sum 和 flock；有 root 或 sudo 权限",
   "SELinux is not enforcing": "SELinux 不是 enforcing 模式",
   "In sudo mode, one Core per host: a host already running a sudo-mode node for another Core is refused.": "sudo 模式下，每台主机只能接入一个 Core：已为其他 Core 运行 sudo 模式节点的主机会被拒绝。",
-  "If the command is interrupted or the download stalls, run the same command again: the download resumes.": "如果命令被中断或下载卡住，重新运行同一条命令即可，下载会接着进行。",
+  "If the command is interrupted or the download stalls, run it again: unfinished downloads restart, and verified files are reused.": "如果命令被中断或下载卡住，重新运行即可：未完成的下载会从头开始，已校验的完整文件会复用。",
   "Rootful Docker Engine running, its socket owned by the docker group with mode 0660, enforcing CPU and memory limits (cgroup v2)": "Docker Engine 以 rootful 模式运行，套接字属于 docker 组、权限 0660，且能限制 CPU 和内存（cgroup v2）",
   "/dev/kvm in the kvm group (hardware or nested virtualization) and the libraries microsandbox links (glibc)": "属于 kvm 组的 /dev/kvm（硬件或嵌套虚拟化），以及 microsandbox 链接的库（glibc）",
   "Copy command with --force": "复制命令（--force）",
diff --git a/apps/web/src/lib/locale.test.ts b/apps/web/src/lib/locale.test.ts
index 18248783f..fc47a3e83 100644
--- a/apps/web/src/lib/locale.test.ts
+++ b/apps/web/src/lib/locale.test.ts
@@ -1,16 +1,9 @@
 import { describe, expect, it } from "vitest";
-import { resolveLocale } from "./locale";
 import { AgentCoreError } from "@oac/agents-client";
 import { sandboxRequestError, sandboxStateLabel } from "./sandbox-labels";
 import { sandboxDiagnosticMessage } from "./sandbox-diagnostic";
 
 describe("sandbox localization", () => {
-  it("uses saved choices and defaults to the browser's preferred language", () => {
-    expect(resolveLocale(null, ["zh-CN", "en-US"])).toBe("zh");
-    expect(resolveLocale("en", ["zh-TW"])).toBe("en");
-    expect(resolveLocale("zh", ["en-US"])).toBe("zh");
-    expect(resolveLocale("invalid", ["fr"])).toBe("en");
-  });
   it("localizes every persisted allocation and compute state without exposing unknown values", () => {
     for (const state of ["creating", "running", "cleanup_pending", "released", "disabled", "quiescing", "suspending", "suspended", "restoring", "waking"]) {
       expect(sandboxStateLabel(state, "zh")).toMatch(/[\u4e00-\u9fff]/);
diff --git a/apps/web/src/lib/locale.ts b/apps/web/src/lib/locale.ts
index 22d250fda..9f02335c9 100644
--- a/apps/web/src/lib/locale.ts
+++ b/apps/web/src/lib/locale.ts
@@ -1,10 +1,5 @@
 import { chinese, type MessageKey } from "./locale-strings";
 export type Locale = "en" | "zh";
-export const localeStorageKey = "agents-core-web.locale";
-export function resolveLocale(saved: string | null, languages: readonly string[]): Locale {
-  if (saved === "en" || saved === "zh") return saved;
-  return languages[0]?.toLowerCase().startsWith("zh") ? "zh" : "en";
-}
 export function translate(locale: Locale, key: MessageKey): string {
   return locale === "zh" ? chinese[key] : key;
 }
diff --git a/apps/web/src/lib/theme.ts b/apps/web/src/lib/theme.ts
index 0167777ce..b369a4ba8 100644
--- a/apps/web/src/lib/theme.ts
+++ b/apps/web/src/lib/theme.ts
@@ -9,7 +9,7 @@ export interface ThemeContextValue {
   setPreference: (preference: ThemePreference) => void;
 }
 
-export const themeStorageKey = "agents-core-web.theme";
+export const themeStorageKey = "oac-web.theme";
 export const defaultThemePreference: ThemePreference = "system";
 export const ThemeContext = createContext<ThemeContextValue | null>(null);
 
diff --git a/contracts/agents-api/harness-onboarding.md b/contracts/agents-api/harness-onboarding.md
index ff89d8592..38f679e45 100644
--- a/contracts/agents-api/harness-onboarding.md
+++ b/contracts/agents-api/harness-onboarding.md
@@ -248,7 +248,7 @@ The agent-host image uses the same contract. `deploy/distribution/AgentHost.Dock
 
 ## Native process ownership
 
-The daemon's `clirunner` offers opt-in Unix process-group ownership for adapters whose SDK launches a native child; unsupported hosts reject this mode before launch. Explicit and parent-context cancellation share a TERM grace period (three seconds by default) and a bounded KILL escalation. An internal reaper also cleans remaining group members when the direct process exits, even if a descendant still holds stdout open; during cancellation, surviving descendants keep the remaining grace after the leader exits. The daemon's `stop` command waits up to ten seconds for confirmed shutdown, which covers that grace period and the pipe and owner cleanup after it.
+The daemon's `clirunner` starts every native child in its own Unix process group (a Job object on Windows); other hosts reject the launch. Explicit and parent-context cancellation share a TERM grace period (three seconds by default) and a bounded KILL escalation. An internal reaper also cleans remaining group members when the direct process exits, even if a descendant still holds stdout open; during cancellation, surviving descendants keep the remaining grace after the leader exits. The daemon's `stop` command waits up to ten seconds for confirmed shutdown, which covers that grace period and the pipe and owner cleanup after it.
 
 Owned output pipes stay readable after the leader exits. Consumers drain stdout and stderr before calling `Wait`, which joins the cached process result and closes the readers. `Done` reports leader reaping and group cleanup signals; it is not a native execution receipt or proof of persisted history. SDK adapters settle each Turn and drain its observations before publishing completion, and Executor close also closes the query and awaits the native child. Process groups are lifecycle supervision, not isolation or containment of descendants that leave the group.
 
@@ -338,7 +338,7 @@ A stdio binding runs in the sandbox under its alias. The binding at index `i` of
 
 ### Launch
 
-`ViewSession.Launch` replaces `clirunner.Start`. Each call builds one view and runs `Binary` in it, and at most one view per Session is live at a time. `Dir` is a path in the sandbox, `OwnProcessGroup` is true and `Env` is the complete environment. The returned `clirunner.Process` follows [Native process ownership](#native-process-ownership):
+`ViewSession.Launch` replaces `clirunner.Start`. Each call builds one view and runs `Binary` in it, and at most one view per Session is live at a time. `Dir` is a path in the sandbox and `Env` is the complete environment. The returned `clirunner.Process` follows [Native process ownership](#native-process-ownership):
 
 - Cancel sends TERM to every process in the view and closes the view after `KillTimeout`. A Cancel that finds the Harness exited leaves its exit as it was, even while the processes it left still end.
 - When the Harness exits while other processes remain, the view sends them TERM unless Cancel already did, and ends once they exit or `KillTimeout` passes from the first TERM.
@@ -367,7 +367,7 @@ Run the adapter's Turns, cancellation and continuation in a view, then qualify e
 | `Home` | Native history and configuration stay under `/.oac/home`, and a later Executor in the same Session continues from them. |
 | `Capabilities` | Each supported feature runs a Turn through dispatch: environment none in the empty-root view, Skills, function calls and results, tool search, and each stdio binding under its alias. |
 
-`scripts/qualify-agent-host.sh` runs each Harness's Turns through the daemon's dispatch against the [agent-host and sandbox images](../../docs/maintainers.md#runtime-images-and-helpers). The `agenthostqualify` test binary runs as the agent host with the [agent-host container's flags](../../docs/configuration.md#agent-host-container), and the sandbox image serves the sandbox. The first Turn writes a file and reports the output and exit status of a failing command whose values only the sandbox's tool environment holds. When the view declares function tools, a second Turn runs in a new Executor that resumes the Session's native history and calls a function; the test returns a text, image and text result through dispatch, and the answer must report both texts. When the view declares tool search, a Turn in another Session finds the deferred function with tool search and calls it. The Link runs over WSS with a CA the test generates. The test also checks the cgroup v2 delegation: the container's own read-only cgroup fails with `ErrUnsupported`, and in a delegated directory the agent host ends a cgroup left behind with `cgroup.kill`. Set `OAC_AGENT_HOST_IMAGE` and `OAC_SANDBOX_IMAGE` to the two images, `OAC_QUALIFY_KEY_FILE` to the model key's file and, for each Harness to qualify, `OAC_QUALIFY_CLAUDE_SDK`, `OAC_QUALIFY_CODEX` or `OAC_QUALIFY_MCODE` to its `model` and `model_provider` without `api_key`. The gateway dials model providers directly, so on a host whose only egress is an HTTP proxy, set `OAC_QUALIFY_PROXY` to it and the test tunnels the providers' hosts through it.
+`scripts/qualify-agent-host.sh` runs each Harness's Turns through the daemon's dispatch against the [agent-host and sandbox images](../../docs/maintainers.md#runtime-images-and-helpers). The `agenthostqualify` test binary runs as the agent host with the [agent-host container's flags](../../docs/configuration.md#agent-host-container), and the sandbox image serves the sandbox. The first Turn writes a file and reports the output and exit status of a failing command whose values only the sandbox's tool environment holds. When the view declares function tools, a second Turn runs in a new Executor that resumes the Session's native history and calls a function; the test returns a text, image and text result through dispatch, and the answer must report both texts. When the view declares tool search, a Turn in another Session finds the deferred function with tool search and calls it. When the view declares environment none, a Turn in a Session without an Environment answers through the model, and the Harness's native state in the Session home must name its working directory, `/.oac/home/work`. When the view declares stdio MCP, the test gives a Session's Environment one installed stdio MCP server, a script that runs in the sandbox, and the answer must report the code its one tool returns. The Link runs over WSS with a CA the test generates. The test also checks the cgroup v2 delegation: the container's own read-only cgroup fails with `ErrUnsupported`, and in a delegated directory the agent host ends a cgroup left behind with `cgroup.kill`. Set `OAC_AGENT_HOST_IMAGE` and `OAC_SANDBOX_IMAGE` to the two images, `OAC_QUALIFY_KEY_FILE` to the model key's file and, for each Harness to qualify, `OAC_QUALIFY_CLAUDE_SDK`, `OAC_QUALIFY_CODEX` or `OAC_QUALIFY_MCODE` to its `model` and `model_provider` without `api_key`. The gateway dials model providers directly, so on a host whose only egress is an HTTP proxy, set `OAC_QUALIFY_PROXY` to it and the test tunnels the providers' hosts through it.
 
 ## Native references
 
diff --git a/contracts/agents-api/zh/harness-onboarding.md b/contracts/agents-api/zh/harness-onboarding.md
index d374f19dd..7309f4843 100644
--- a/contracts/agents-api/zh/harness-onboarding.md
+++ b/contracts/agents-api/zh/harness-onboarding.md
@@ -1,7 +1,7 @@
 ---
 title: "将原生 Harness 添加到 OpenAgentCore"
 source: contracts/agents-api/harness-onboarding.md
-source_hash: d23b13d16a6de898b81c94e07ed3b2c32a2ea36dd70caaf17479bf2bc824595c
+source_hash: d0b84eef91e766fb74e2acf8a767d1767f6a3f270adb1b72790b7c616ee63d05
 ---
 
 **Harness** 是一种运行模型和工具循环的原生代理引擎（Codex、Claude Code、MiniMax Code）。**Harness 适配器**将 Runtime 的 Executor 和 Turn 契约转换到该引擎的 SDK 或协议。本文档定义 Runtime–Harness 协议：适配器接口及其生命周期义务、注册、Core 资格认定和验收。[Harness capabilities](harness-capabilities.md) 记录了当前每个 Harness 支持的功能。
@@ -250,7 +250,7 @@ agent-host 镜像使用同一契约。`deploy/distribution/AgentHost.Dockerfile`
 
 ## 原生进程所有权 {#native-process-ownership}
 
-daemon 的 `clirunner` 为 SDK 会启动原生子进程的适配器提供可选的 Unix 进程组所有权；不支持的主机会在启动前拒绝此模式。显式取消和父上下文取消共享 TERM 宽限期（默认为三秒）以及有界的 KILL 升级过程。当直接进程退出时，内部回收器也会清理进程组的剩余成员，即使某个后代进程仍保持 stdout 打开；在取消过程中，主进程退出后，存活的后代进程仍会保留剩余宽限时间。daemon 的 `stop` 命令最多等待十秒以确认关闭，这涵盖该宽限期以及之后的管道和所有者清理。
+daemon 的 `clirunner` 让每个原生子进程在自己的 Unix 进程组中启动（Windows 上为 Job 对象）；其他主机会拒绝启动。显式取消和父上下文取消共享 TERM 宽限期（默认为三秒）以及有界的 KILL 升级过程。当直接进程退出时，内部回收器也会清理进程组的剩余成员，即使某个后代进程仍保持 stdout 打开；在取消过程中，主进程退出后，存活的后代进程仍会保留剩余宽限时间。daemon 的 `stop` 命令最多等待十秒以确认关闭，这涵盖该宽限期以及之后的管道和所有者清理。
 
 所属输出管道在主进程退出后仍可读取。消费者在调用 `Wait` 之前耗尽 stdout 和 stderr；`Wait` 会汇合缓存的进程结果并关闭读取器。`Done` 报告主进程回收和进程组清理信号；它不是原生执行回执，也不是历史已持久化的证据。SDK 适配器会结算每个 Turn，并在发布完成状态前耗尽其观察结果；Executor 关闭还会关闭 Query 并等待原生子进程。进程组用于生命周期监管，而不是隔离或遏制离开进程组的后代进程。
 
@@ -340,7 +340,7 @@ stdio 绑定在沙箱中以其别名运行。`ViewSession.MCP` 中索引为 `i`
 
 ### 启动 {#launch}
 
-`ViewSession.Launch` 取代 `clirunner.Start`。每次调用构建一个视图并在其中运行 `Binary`，每个 Session 同一时间至多有一个活动视图。`Dir` 是沙箱中的路径，`OwnProcessGroup` 为 true，`Env` 是完整环境。返回的 `clirunner.Process` 遵循[原生进程所有权](#native-process-ownership)：
+`ViewSession.Launch` 取代 `clirunner.Start`。每次调用构建一个视图并在其中运行 `Binary`，每个 Session 同一时间至多有一个活动视图。`Dir` 是沙箱中的路径，`Env` 是完整环境。返回的 `clirunner.Process` 遵循[原生进程所有权](#native-process-ownership)：
 
 - Cancel 向视图中的每个进程发送 TERM，并在 `KillTimeout` 后关闭视图。如果 Cancel 发现 Harness 已退出，即使它遗留的进程仍在结束中，也保持其退出结果不变。
 - Harness 退出而仍有其他进程时，除非 Cancel 已发送过 TERM，视图会向它们发送 TERM，并在它们退出或自首次 TERM 起经过 `KillTimeout` 后结束。
@@ -369,7 +369,7 @@ stdio 绑定在沙箱中以其别名运行。`ViewSession.MCP` 中索引为 `i`
 | `Home` | 原生历史和配置保存在 `/.oac/home` 下，同一 Session 中后续的 Executor 从中继续。 |
 | `Capabilities` | 每项受支持的功能都通过 dispatch 运行一个 Turn：空根视图中的 Environment none、Skills、函数调用及其结果、工具搜索，以及每个以别名运行的 stdio 绑定。 |
 
-`scripts/qualify-agent-host.sh` 针对 [agent-host 和沙箱镜像](../../../docs/zh/maintainers.md#runtime-images-and-helpers)，通过守护进程的 dispatch 运行每个 Harness 的 Turn。`agenthostqualify` 测试二进制以 [agent-host 容器的参数](../../../docs/zh/configuration.md#agent-host-container)作为 agent host 运行，沙箱镜像提供沙箱。第一个 Turn 写入一个文件，并报告一个失败命令的输出和退出状态，这两个值只存在于沙箱的工具环境中。视图声明函数工具时，第二个 Turn 在新的 Executor 中运行，该 Executor 恢复 Session 的原生历史并调用一个函数；测试通过 dispatch 返回文本、图片、文本组成的结果，回答必须报告两段文本。视图声明工具搜索时，另一个 Session 中的 Turn 用工具搜索找到延迟加载的函数并调用它。Link 通过 WSS 运行，使用测试生成的 CA。测试还会检查 cgroup v2 委派：容器自己的只读 cgroup 以 `ErrUnsupported` 失败；在委派目录中，agent host 用 `cgroup.kill` 结束遗留的 cgroup。将 `OAC_AGENT_HOST_IMAGE` 和 `OAC_SANDBOX_IMAGE` 设为这两个镜像，将 `OAC_QUALIFY_KEY_FILE` 设为模型密钥文件，并为每个要认定的 Harness 将 `OAC_QUALIFY_CLAUDE_SDK`、`OAC_QUALIFY_CODEX` 或 `OAC_QUALIFY_MCODE` 设为其 `model` 和不含 `api_key` 的 `model_provider`。网关直接连接模型提供商，因此在唯一出口是 HTTP 代理的主机上，将 `OAC_QUALIFY_PROXY` 设为该代理，测试会通过它为提供商的主机建立隧道。
+`scripts/qualify-agent-host.sh` 针对 [agent-host 和沙箱镜像](../../../docs/zh/maintainers.md#runtime-images-and-helpers)，通过守护进程的 dispatch 运行每个 Harness 的 Turn。`agenthostqualify` 测试二进制以 [agent-host 容器的参数](../../../docs/zh/configuration.md#agent-host-container)作为 agent host 运行，沙箱镜像提供沙箱。第一个 Turn 写入一个文件，并报告一个失败命令的输出和退出状态，这两个值只存在于沙箱的工具环境中。视图声明函数工具时，第二个 Turn 在新的 Executor 中运行，该 Executor 恢复 Session 的原生历史并调用一个函数；测试通过 dispatch 返回文本、图片、文本组成的结果，回答必须报告两段文本。视图声明工具搜索时，另一个 Session 中的 Turn 用工具搜索找到延迟加载的函数并调用它。视图声明 environment none 时，一个没有 Environment 的 Session 中的 Turn 通过模型作答，且 Session home 中 Harness 的原生状态必须写明其工作目录 `/.oac/home/work`。视图声明 stdio MCP 时，测试为一个 Session 的 Environment 提供一个已安装的 stdio MCP 服务器，即在沙箱中运行的脚本，回答必须报告其唯一工具返回的代码。Link 通过 WSS 运行，使用测试生成的 CA。测试还会检查 cgroup v2 委派：容器自己的只读 cgroup 以 `ErrUnsupported` 失败；在委派目录中，agent host 用 `cgroup.kill` 结束遗留的 cgroup。将 `OAC_AGENT_HOST_IMAGE` 和 `OAC_SANDBOX_IMAGE` 设为这两个镜像，将 `OAC_QUALIFY_KEY_FILE` 设为模型密钥文件，并为每个要认定的 Harness 将 `OAC_QUALIFY_CLAUDE_SDK`、`OAC_QUALIFY_CODEX` 或 `OAC_QUALIFY_MCODE` 设为其 `model` 和不含 `api_key` 的 `model_provider`。网关直接连接模型提供商，因此在唯一出口是 HTTP 代理的主机上，将 `OAC_QUALIFY_PROXY` 设为该代理，测试会通过它为提供商的主机建立隧道。
 
 ## 原生参考 {#native-references}
 
diff --git a/deploy/README.md b/deploy/README.md
index 5324b60ee..716971334 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -11,6 +11,8 @@
 
 `install.sh` downloads its release's `compose.yaml`, checks it against `compose-sha256sums.txt`, writes `.env`, and starts Compose. Core applies database migrations when it starts. The host needs Linux amd64 and Docker Compose 2.26 or newer. [Configuration](../docs/configuration.md) owns the installation layout and settings.
 
+The Core installer validates downloads and Compose in the private sibling `<install-dir>.staging` directory, and pulls all images before publishing the installation directory. A retry clears leftover staging only when its atomically created ownership link names this installation, including after the previous process was killed. An unrecognized nonempty staging directory is preserved. The staging log moves with the configuration and is removed on normal exit. Once published, failures retain configuration, containers and data. A retry verifies and starts that saved installation without replacing its Compose file, cached images or existing containers. Missing images are downloaded explicitly; Compose never pulls images implicitly. It refuses unrelated nonempty directories. `<install-dir>.install.lock` serializes directory preparation; `.oac.lock` serializes service changes with mutating `oac` commands. Both lock files remain after exit. Download failures have bounded retries and timeouts; service startup failures print Compose status and recent logs.
+
 `oac` is a Go command (`services/core/cmd/oac`) in the Core image and the ingress image. The host copy implements `apply`, `core-key` and `rotate-core-key`; `core-key --show` runs `oac-web core-key` in the Web container. Start, stop, logs and removal are `docker compose`. `apply` runs `oac-core check-config` before recreating services. The ingress image runs data initialization as `oac init`, verifies and copies its bundled node metadata without network access, and contains no Python. No service receives a Docker socket. Initialization writes structured logs to stderr for directory preparation, lock acquisition, existing-installation verification, bundled metadata verification and publication, credential generation or reuse, and receipt persistence. Each step records its start and completion; failures identify the current step, and completion records elapsed milliseconds. Credential values and digests are never logged. View these logs with `docker compose logs --timestamps init`.
 
 Web serves the console and forwards `/v1` and `/api/v1` to Core, so it is the only published service. HTTPS is terminated by the operator's reverse proxy or hosting platform, which routes to `web:8080`; `OAC_PUBLIC_URL` records that origin.
diff --git a/deploy/install.sh b/deploy/install.sh
index f862fb282..3746122fd 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -8,7 +8,8 @@ install_dir="${OAC_INSTALL_DIR_DEFAULT:-$HOME/.oac/core}"
 public_url=""
 host_address="0.0.0.0"
 web_port="8080"
-kept=0
+stage=""
+published=0
 
 usage() {
   cat <<'EOF'
@@ -38,23 +39,76 @@ if [[ "$(uname -s)" != Linux || "$(uname -m)" != x86_64 ]]; then
   echo "Core installs on Linux amd64." >&2
   exit 1
 fi
-command -v docker >/dev/null || { echo "Docker Engine with Compose 2.26 or newer is required." >&2; exit 1; }
-command -v curl >/dev/null || { echo "curl is required." >&2; exit 1; }
+fail() { printf '%s\n' "$*" >&2; exit 1; }
+for tool in docker curl sha256sum flock readlink od sed awk grep; do
+  command -v "$tool" >/dev/null || fail "Required command missing: $tool. Install it and rerun this command. Docker needs Compose 2.26 or newer."
+done
 compose_version="$(docker compose version --short 2>/dev/null | sed 's/^v//' || true)"
 major="${compose_version%%.*}"
 minor="${compose_version#*.}"
 minor="${minor%%.*}"
 if [[ ! "$major" =~ ^[0-9]+$ || ! "$minor" =~ ^[0-9]+$ ]] || (( major < 2 || (major == 2 && minor < 26) )); then
-  echo "Docker Compose 2.26 or newer is required (found ${compose_version:-none})." >&2
-  exit 1
+  fail "Docker Compose 2.26 or newer is required (found ${compose_version:-none})."
 fi
-if [[ "$install_dir" != /* ]]; then
-  echo "--install-dir must be absolute." >&2
-  exit 1
+docker info >/dev/null 2>&1 || fail "Cannot reach Docker. Start Docker and check this account's access, then rerun."
+[[ "$install_dir" == /* && "$install_dir" != / ]] || fail "--install-dir must be an absolute directory other than /."
+# These values are written as literal dotenv strings, never shell commands.
+for value in "$install_dir" "$public_url" "$host_address" "$version"; do
+  [[ "$value" != *$'\n'* && "$value" != *$'\r'* && "$value" != *"'"* && "$value" != *\\* ]] || fail "Installation options cannot contain newlines, quotes or backslashes."
+done
+[[ "$web_port" =~ ^[0-9]{1,5}$ ]] && (( 10#$web_port >= 1 && 10#$web_port <= 65535 )) || fail "--web-port must be between 1 and 65535."
+[[ ! -L "$install_dir" ]] || fail "Installation directory must not be a symbolic link."
+[[ ! -e "$install_dir" || -d "$install_dir" ]] || fail "Installation path must be a directory."
+case "$(basename "$install_dir")" in .|..) fail "--install-dir must name the installation directory, not . or ...";; esac
+umask 077
+parent="$(dirname "$install_dir")"
+mkdir -p "$parent"
+parent="$(cd "$parent" && pwd -P)"
+install_dir="$parent/$(basename "$install_dir")"
+lock="$install_dir.install.lock"
+[[ ! -L "$lock" && ( ! -e "$lock" || ( -f "$lock" && -O "$lock" ) ) ]] || fail "Invalid installation lock: $lock"
+exec 9>>"$lock"
+flock -n 9 || fail "Another installation is using this directory. Wait for it to finish and rerun."
+stage="$install_dir.staging"
+[[ ! -L "$stage" && ( ! -e "$stage" || ( -d "$stage" && -O "$stage" ) ) ]] || fail "Invalid installation staging directory: $stage"
+if [[ -d "$stage" && -n "$(ls -A "$stage")" ]]; then
+  [[ -L "$stage/.oac-installer" && "$(readlink "$stage/.oac-installer")" == "$install_dir" ]] || fail "Unrecognized staging directory; preserve it and choose another --install-dir: $stage"
 fi
-if [[ -e "$install_dir" ]] && [[ -n "$(ls -A "$install_dir" 2>/dev/null || true)" ]]; then
-  echo "Installation directory is not empty: $install_dir" >&2
-  exit 1
+rm -rf "$stage"
+mkdir "$stage"
+ln -s "$install_dir" "$stage/.oac-installer"
+log="$stage/install.log"
+: >"$log"
+cleanup() {
+  local status=$?
+  trap - EXIT
+  if [[ "$status" != 0 && "$published" == 1 ]]; then
+    printf '\nInstallation and data retained at %s.\n' "$install_dir" >&2
+    (cd "$install_dir" && docker compose ps --all && docker compose logs --no-color --tail 50) >&2 || true
+    printf 'Fix the reported problem, then rerun install.sh --install-dir %q.\n' "$install_dir" >&2
+  fi
+  [[ -z "$stage" ]] || rm -rf "$stage"
+  rm -f "$log"
+  exit "$status"
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM HUP
+
+# step DESCRIPTION COMMAND... prints the command's output only when it fails.
+step() {
+  printf '%s... ' "$1"
+  shift
+  if "$@" >"$log" 2>&1; then echo done; else echo failed; cat "$log" >&2; return 1; fi
+}
+
+resume=0
+if [[ -e "$install_dir" && -n "$(ls -A "$install_dir")" ]]; then
+  for file in compose.yaml compose-sha256sums.txt .env; do
+    [[ -f "$install_dir/$file" && ! -L "$install_dir/$file" ]] || fail "Directory is not a complete Core installation: $install_dir. Preserve it and choose another directory."
+  done
+  resume=1
+  published=1
 fi
 
 port_busy() {
@@ -67,37 +121,15 @@ port_busy() {
   fi
   (echo >/dev/tcp/127.0.0.1/"$port") >/dev/null 2>&1
 }
-if port_busy "$web_port"; then echo "Port $web_port is already in use." >&2; exit 1; fi
+if [[ "$resume" == 0 ]] && port_busy "$web_port"; then fail "Port $web_port is already in use. Choose another with --web-port."; fi
 asset_base="https://github.com/${repository}/releases/latest/download"
 if [[ "$version" != latest ]]; then
   asset_base="https://github.com/${repository}/releases/download/${version}"
 fi
 
-log="$(mktemp)"
-cleanup() {
-  if [[ "$kept" != 1 && -d "$install_dir" ]]; then
-    (
-      cd "$install_dir"
-      docker compose logs --no-color --tail 50 >&2 || true
-      docker compose down --remove-orphans
-      # Containers own data/; remove it from a container as well.
-      if [[ -d data ]]; then docker compose run --rm --no-deps --volume "$install_dir/data:/data" --entrypoint find database /data -mindepth 1 -delete; fi
-    ) >/dev/null 2>&1 || true
-    rm -rf "$install_dir"
-  fi
-  rm -f "$log"
-}
-trap cleanup EXIT
-
-# step DESCRIPTION COMMAND... prints the command's output only when it fails.
-step() {
-  printf '%s... ' "$1"
-  shift
-  if "$@" >"$log" 2>&1; then echo done; else echo failed; cat "$log" >&2; return 1; fi
-}
-
 # The source address of this host's default route, when it is a private one.
 private_address() {
+  command -v ip >/dev/null || return 0
   ip -4 route get 1.1.1.1 2>/dev/null | sed -n 's/.* src \([0-9.]*\).*/\1/p' |
     grep -E '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)' || true
 }
@@ -108,30 +140,70 @@ if [[ -z "$public_url" && "$host_address" == 0.0.0.0 ]]; then
 fi
 if [[ -z "$public_url" ]]; then public_url="http://localhost:$web_port"; local_only=1; fi
 
-mkdir -p "$install_dir"
-chmod 700 "$install_dir"
-curl --fail --silent --show-error --location "$asset_base/compose-sha256sums.txt" --output "$install_dir/compose-sha256sums.txt"
-curl --fail --silent --show-error --location "$asset_base/compose.yaml" --output "$install_dir/compose.yaml"
-(cd "$install_dir" && sha256sum --check --quiet compose-sha256sums.txt)
+if [[ "$resume" == 0 ]]; then
+  # Prepare configuration privately until downloads and image pulls succeed.
+  # Before publication only this invocation's private staging directory is removed.
+  download() {
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' \
+      --connect-timeout 15 --max-time 120 --retry 2 --retry-connrefused --retry-delay 1 \
+      --max-filesize 1048576 "$asset_base/$1" --output "$stage/$1"
+  }
+  step "Downloading release checksums" download compose-sha256sums.txt
+  step "Downloading Compose configuration" download compose.yaml
+  {
+    echo "COMPOSE_PROJECT_NAME=oac-$(od -An -N5 -tx1 /dev/urandom | tr -d ' \n')"
+    printf "OAC_INSTALL_DIR='%s'\nOAC_HOST='%s'\nOAC_WEB_PORT='%s'\nOAC_PUBLIC_URL='%s'\n" "$install_dir" "$host_address" "$web_port" "$public_url"
+  } >"$stage/.env"
+fi
 
-umask 077
-{
-  echo "COMPOSE_PROJECT_NAME=oac-$(od -An -N5 -tx1 /dev/urandom | tr -d ' \n')"
-  echo "OAC_INSTALL_DIR=$install_dir"
-  echo "OAC_HOST=$host_address"
-  echo "OAC_WEB_PORT=$web_port"
-  echo "OAC_PUBLIC_URL=$public_url"
-} >"$install_dir/.env"
-
-cd "$install_dir"
-copy_cli() { docker compose create core && docker compose cp core:/usr/local/bin/oac ./oac; }
-step "Pulling images" docker compose pull
-step "Installing the oac command" copy_cli
-step "Starting services" docker compose up -d --wait
-key="$(./oac core-key --show)"
-kept=1
-trap - EXIT
-rm -f "$log"
+if [[ "$resume" == 0 ]]; then cd "$stage"; else cd "$install_dir"; fi
+[[ ! -L .oac.lock && ( ! -e .oac.lock || ( -f .oac.lock && -O .oac.lock ) ) ]] || fail "Invalid installation lock: $install_dir/.oac.lock"
+exec 8>>.oac.lock
+flock -n 8 || fail "Another oac command is using this installation. Wait for it to finish and rerun."
+[[ ! -L install.log && ( ! -e install.log || ( -f install.log && -O install.log ) ) ]] || fail "Invalid installation log: $install_dir/install.log"
+log="$PWD/install.log"
+: >"$log"
+step "Verifying saved configuration" sha256sum --check --quiet compose-sha256sums.txt
+step "Checking Compose configuration" docker compose config --quiet
+if [[ "$resume" == 1 ]]; then
+  printf 'Using saved settings from .env; installation flags only apply to new directories. Existing data is preserved.\n'
+fi
+public_url="$(docker compose config --environment | sed -n 's/^OAC_PUBLIC_URL=//p')"
+local_only=0
+[[ "$public_url" != http://localhost:* && "$public_url" != http://127.0.0.1:* ]] || local_only=1
+pull_images() {
+  local images image
+  images="$(docker compose config --images)" || return
+  while IFS= read -r image; do
+    [[ -n "$image" ]] || continue
+    if [[ "$resume" == 0 ]] || ! docker image inspect "$image" >/dev/null 2>&1; then
+      docker pull --platform linux/amd64 "$image" || return
+    fi
+  done <<<"$images"
+}
+step "Checking and downloading images" pull_images
+if [[ "$resume" == 0 ]]; then
+  # An existing empty directory may be replaced, never a directory with user data.
+  if [[ -e "$install_dir" ]]; then rmdir "$install_dir"; fi
+  mv "$stage" "$install_dir"
+  stage=""
+  cd "$install_dir"
+  log="$install_dir/install.log"
+  published=1
+fi
+rm -f .oac-installer
+copy_cli() (
+  [[ ! -L ./oac.download ]] || fail "Temporary oac command must not be a symbolic link."
+  trap 'rm -f ./oac.download' EXIT
+  docker compose create --pull never --no-recreate core &&
+    docker compose cp core:/usr/local/bin/oac ./oac.download &&
+    mv ./oac.download ./oac
+)
+if [[ ! -x ./oac ]]; then step "Installing the oac command" copy_cli; fi
+step "Starting services" docker compose up -d --wait --wait-timeout 180 --pull never --no-recreate
+if ! key="$(./oac core-key --show)"; then
+  fail "Services started, but the Core key could not be read. Inspect Web's logs and retry; data is preserved."
+fi
 
 sudo=""
 if [[ "$EUID" == 0 && -n "${SUDO_USER:-}" ]]; then sudo="sudo "; fi
diff --git a/deploy/node/README.md b/deploy/node/README.md
index 0cd68fb95..74814031c 100644
--- a/deploy/node/README.md
+++ b/deploy/node/README.md
@@ -5,7 +5,7 @@ These modules are packaged as `node-install.pyz`, which Web serves at `/node-ins
 | Module | Role |
 | --- | --- |
 | `node_install.py`, `node_spec.py`, `node_generations.py` | Node installer and generation helper. `node_spec.py` is generated by `go run ./services/core/cmd/specification-contract -write` |
-| `distribution.py` | Checksums, release metadata and Docker image identity |
+| `distribution.py` | Verified artifacts, private temporary files, release metadata and Docker image identity |
 | `install_display.py`, `node_output.py` | Terminal output |
 | `provider_assets.py` | Node provider artifact names, generated by `go run ./services/core/cmd/provider-artifacts` |
 | `node_payload.py` | Publish a release's node files without replacing bytes already installed |
@@ -27,12 +27,16 @@ The node installer runs as root and prepares the host for one node per installat
 
 ## Download contract
 
+The generated command uses `~/.oac/node-bootstrap` in the invoking account's home. Under `download.lock`, it discards an unfinished `download.partial`, downloads and verifies the bootstrap, then publishes `<sha256>.pyz`. The lock is released before invoking sudo; verified files stay available to running installers. Node file writes share `distribution.temporary_file`: under the caller's installation lock, remove the previous temporary file, write privately, and publish atomically. The same lifecycle covers payloads, extraction, helpers, settings and enrollment tokens. Registration tokens are removed even when a rerun finds the node already registered.
+
+Configuration files are published only after their complete contents are written; a retry preserves an existing matching file and refuses conflicting contents. Generation leases are durable locks, not disposable temporary files: interruption between creating a lease and recording its inode identity requires operator inspection. A retry refuses that unrecorded lease instead of replacing an inode that a Runtime helper could still hold.
+
 The distribution manifest is the one download contract for nodes: flat versioned file names, and the compressed and unpacked size and SHA-256 of the Runtime.
 
 - A Compose installation keeps only the node metadata from its release archive; Core's image never acquires execution-only payloads.
 - A node obtains bootstrap metadata from the console that generated its command. Web serves artifacts it has locally and redirects missing declared execution artifacts to the versioned HTTPS release base in the verified manifest. Web never downloads or caches those bytes.
 - Only artifact requests may follow HTTPS redirects, and only without credentials or cookies. Metadata and enrollment requests stay on the configured console. The console publishes only fixed non-secret files and declared artifact names.
-- Download into private temporary files, verify size and SHA-256 before an atomic rename, resume interrupted transfers, and reuse only verified cache entries or exact image identities. Never select a release other than the pinned one.
+- Download into private temporary files, verify size and SHA-256 before an atomic rename, clear leftover temporary downloads and extracted files before retrying, and reuse only verified cache entries or exact image identities. Never select a release other than the pinned one.
 - Release downloads are anonymous. Never add repository credentials to installed node or Runtime configuration.
 - Manual builds use the `build-<full SHA>` release tag and tag builds the `v*` tag. The manifest's download base must match the release tag; artifact file names and source provenance keep the full source SHA.
 
diff --git a/deploy/node/distribution.py b/deploy/node/distribution.py
index 553177b2c..1aec341c4 100644
--- a/deploy/node/distribution.py
+++ b/deploy/node/distribution.py
@@ -9,7 +9,7 @@
 import socket
 import stat
 import subprocess
-import tempfile
+from contextlib import contextmanager
 import time
 import urllib.error
 import urllib.request
@@ -114,11 +114,8 @@ def redirect_request(self, request, fp, code, msg, headers, newurl):
         safe_url(newurl)
         if urlsplit(newurl).scheme != 'https' or request.get_method() not in ('GET', 'HEAD'):
             raise ArtifactError('Artifact redirects require HTTPS')
-        # Carry resume headers, never credentials or cookies, to a release/CDN host.
-        forwarded = {name: value for name, value in request.header_items()
-                     if name.lower() in ('range', 'if-range')}
-        return urllib.request.Request(newurl, headers=forwarded,
-                                      method=request.get_method(), unverifiable=True)
+        # Artifact redirects carry no credentials, cookies or custom headers.
+        return urllib.request.Request(newurl, method=request.get_method(), unverifiable=True)
 
 
 class NoRedirect(urllib.request.HTTPRedirectHandler):
@@ -162,47 +159,42 @@ def obtain_artifact(manifest, logical_path, destination, offline_root=None):
     if not isinstance(base, str) or not base or urlsplit(base).query:
         raise ArtifactError('No downloadable artifact source; use the matching offline bundle')
     url = safe_url(base.rstrip('/') + '/' + entry['filename'])
-    # A private partial file survives interruptions and reruns; the next attempt asks
-    # for the missing bytes only. The complete file is still verified as a whole.
-    partial = target.with_name('.' + target.name + '.partial')
-    for attempt in range(3):
-        try:
-            download_partial(url, partial, entry, logical_path)
-            break
-        except urllib.error.HTTPError as error:
-            if error.code == 416:
-                discard_partial(partial)
-            elif error.code not in (408, 429, 500, 502, 503, 504) or attempt == 2:
-                raise ArtifactError(f'Artifact download failed (HTTP {error.code}): {logical_path}. Check the console and retry.') from None
-        except (urllib.error.URLError, socket.timeout, ConnectionError, http.client.HTTPException):
-            if attempt == 2:
-                raise ArtifactError('Artifact transfer interrupted: ' + logical_path + '. Check network access and rerun; '
-                                        'the download resumes where it stopped.') from None
-        time.sleep(attempt + 1)
-    else:
-        raise ArtifactError('Artifact download did not complete')
-    if digest(partial) != entry['sha256']:
-        discard_partial(partial)
-        raise ArtifactError('Artifact checksum mismatch: ' + logical_path)
-    os.chmod(partial, 0o700 if logical_path.startswith('native/') else 0o600)
-    os.replace(partial, target)
-    validator_path(partial).unlink(missing_ok=True)
-    return target
-
-
-def validator_path(partial):
-    return partial.with_name(partial.name + '.validator')
+    with temporary_file(target) as partial:
+        for attempt in range(3):
+            try:
+                download_artifact(url, partial, entry, logical_path)
+                break
+            except urllib.error.HTTPError as error:
+                if error.code not in (408, 429, 500, 502, 503, 504) or attempt == 2:
+                    raise ArtifactError(f'Artifact download failed (HTTP {error.code}): {logical_path}. Check the console and retry.') from None
+            except (urllib.error.URLError, socket.timeout, ConnectionError, http.client.HTTPException):
+                if attempt == 2:
+                    raise ArtifactError('Artifact transfer interrupted: ' + logical_path + '. Check network access and rerun.') from None
+            time.sleep(attempt + 1)
+        if digest(partial) != entry['sha256']:
+            raise ArtifactError('Artifact checksum mismatch: ' + logical_path)
+        os.chmod(partial, 0o700 if logical_path.startswith('native/') else 0o600)
+        os.replace(partial, target)
+        return target
 
 
-def discard_partial(partial):
+@contextmanager
+def temporary_file(target):
+    """Clear unfinished work under the caller's installation lock."""
+    partial = target.with_name('.' + target.name + '.partial')
+    if partial.is_symlink() or (partial.exists() and
+            (not partial.is_file() or partial.stat().st_uid != os.getuid())):
+        raise DistributionError('Temporary file must be an owned regular file: ' + str(target))
     partial.unlink(missing_ok=True)
-    validator_path(partial).unlink(missing_ok=True)
+    try:
+        yield partial
+    finally:
+        partial.unlink(missing_ok=True)
 
 
 def copy_artifact(source, target, entry, logical_path):
-    fd, temporary = tempfile.mkstemp(prefix='.artifact-', dir=target.parent)
-    try:
-        with os.fdopen(fd, 'wb') as output, source.open('rb') as stream:
+    with temporary_file(target) as temporary:
+        with os.fdopen(os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), 'wb') as output, source.open('rb') as stream:
             count = 0
             for block in iter(lambda: stream.read(1024 * 1024), b''):
                 count += len(block)
@@ -214,52 +206,20 @@ def copy_artifact(source, target, entry, logical_path):
         os.chmod(temporary, 0o700 if logical_path.startswith('native/') else 0o600)
         os.replace(temporary, target)
         return target
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
 
 
-# A download that brings fewer bytes than this in a window stops; a rerun resumes it.
+# Stop downloads that bring fewer bytes than this in a window.
 SLOW_SECONDS, SLOW_BYTES = 60, 64 * 1024
 
 
-def download_partial(url, partial, entry, logical_path):
-    """Complete the partial file, asking only for the bytes it is missing."""
+def download_artifact(url, partial, entry, logical_path):
+    """Download a complete artifact into a disposable file."""
     size = entry['size']
-    offset = 0
-    if partial.is_symlink() or (partial.exists() and not partial.is_file()):
-        raise DistributionError('Partial download must be a regular file: ' + logical_path)
-    if partial.exists():
-        info = partial.stat()
-        if info.st_uid != os.getuid():
-            raise DistributionError('Partial download must be owned by this user: ' + logical_path)
-        offset = info.st_size if info.st_size <= size else 0
-    if offset == size:
-        return
-    headers = {}
-    if offset:
-        headers['Range'] = f'bytes={offset}-'
-        # If-Range makes a server whose file changed since the partial began send it whole.
-        try:
-            validator = validator_path(partial).read_text().strip()
-        except OSError:
-            validator = ''
-        if validator:
-            headers['If-Range'] = validator
-    request = urllib.request.Request(url, headers=headers)
-    with urllib.request.build_opener(ArtifactRedirect()).open(request, timeout=30) as stream:
-        if offset and (stream.status != 206 or not stream.headers.get('Content-Range', '').startswith(f'bytes {offset}-')):
-            offset = 0  # The server sent the whole file; start over.
-        if not offset:
-            validator = stream.headers.get('ETag') or stream.headers.get('Last-Modified') or ''
-            if validator and all(32 <= ord(c) < 127 for c in validator) and len(validator) < 200:
-                with os.fdopen(os.open(validator_path(partial), os.O_WRONLY | os.O_CREAT | os.O_TRUNC | os.O_NOFOLLOW, 0o600), 'w') as note:
-                    note.write(validator)
-            else:
-                validator_path(partial).unlink(missing_ok=True)
-        flags = os.O_WRONLY | os.O_CREAT | os.O_NOFOLLOW | (os.O_APPEND if offset else os.O_TRUNC)
-        with os.fdopen(os.open(partial, flags, 0o600), 'ab' if offset else 'wb') as output:
-            count, reported = offset, offset * 10 // size
+    opener = urllib.request.build_opener(ArtifactRedirect())
+    with opener.open(url, timeout=60) as stream:
+        flags = os.O_WRONLY | os.O_CREAT | os.O_NOFOLLOW | os.O_TRUNC
+        with os.fdopen(os.open(partial, flags, 0o600), 'wb') as output:
+            count, reported = 0, 0
             window, window_count = time.monotonic(), 0
             while True:
                 block = stream.read1(1024 * 1024)
@@ -267,16 +227,13 @@ def download_partial(url, partial, entry, logical_path):
                     break
                 count += len(block)
                 if count > size:
-                    output.close()
-                    discard_partial(partial)
                     raise ArtifactError('Artifact exceeds published size: ' + logical_path)
                 output.write(block)
                 window_count += len(block)
                 if time.monotonic() - window >= SLOW_SECONDS:
                     if window_count < SLOW_BYTES:
                         raise ArtifactError(f'Artifact download stalled (under {SLOW_BYTES // 1024} KiB in {SLOW_SECONDS} s): '
-                                                f'{logical_path}. The downloaded part is kept; check the network, then rerun '
-                                                'the command to resume.')
+                                                f'{logical_path}. Check the network, then rerun the command.')
                     window, window_count = time.monotonic(), 0
                 if size >= 50 * 1024 * 1024 and count * 10 // size > reported:
                     reported = count * 10 // size
@@ -303,23 +260,21 @@ def runtime_archive(manifest, cache_root, offline_root=None):
             raise ArtifactError('Cached Runtime archive differs; preserve state and inspect it')
         return target
     archive = obtain_artifact(manifest, 'images/runtime.tar.gz', root / 'images/runtime.tar.gz', offline_root)
-    fd, temporary = tempfile.mkstemp(prefix='.runtime-', dir=target.parent)
-    try:
-        with os.fdopen(fd, 'wb') as output, gzip.open(archive, 'rb') as stream:
-            count = 0
-            for block in iter(lambda: stream.read(1024 * 1024), b''):
-                count += len(block)
-                if count > expanded['size']:
-                    raise ArtifactError('Runtime archive exceeds published unpacked size')
-                output.write(block)
-        if not matches(Path(temporary), expanded):
-            raise ArtifactError('Unpacked Runtime checksum mismatch')
-        os.replace(temporary, target)
-    except (gzip.BadGzipFile, EOFError):
-        raise ArtifactError('Invalid compressed Runtime archive') from None
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
+    with temporary_file(target) as temporary:
+        try:
+            with os.fdopen(os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), 'wb') as output, gzip.open(archive, 'rb') as stream:
+                count = 0
+                for block in iter(lambda: stream.read(1024 * 1024), b''):
+                    count += len(block)
+                    if count > expanded['size']:
+                        raise ArtifactError('Runtime archive exceeds published unpacked size')
+                    output.write(block)
+            if not matches(temporary, expanded):
+                raise ArtifactError('Unpacked Runtime checksum mismatch')
+            os.replace(temporary, target)
+        except (gzip.BadGzipFile, EOFError):
+            raise ArtifactError('Invalid compressed Runtime archive') from None
+
     return target
 
 
diff --git a/deploy/node/node_generations.py b/deploy/node/node_generations.py
index 738c9b765..158eaf827 100644
--- a/deploy/node/node_generations.py
+++ b/deploy/node/node_generations.py
@@ -12,14 +12,14 @@
 import shutil
 import subprocess
 import sys
-import tempfile
-import zipapp
+import zipfile
+
+from distribution import temporary_file
 
 
 def atomic_json(path, value):
-    descriptor, temporary = tempfile.mkstemp(prefix=".generation-", dir=path.parent)
-    try:
-        with os.fdopen(descriptor, "w") as stream:
+    with temporary_file(path) as temporary:
+        with os.fdopen(os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "w") as stream:
             json.dump(value, stream, sort_keys=True)
             stream.write("\n")
             stream.flush()
@@ -30,9 +30,6 @@ def atomic_json(path, value):
             os.fsync(descriptor)
         finally:
             os.close(descriptor)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
 
 
 def helper_archive(args, installer):
@@ -42,14 +39,12 @@ def helper_archive(args, installer):
         source = args.bundle / "node-install.pyz"
     if source.suffix == ".pyz" and source.is_file() and not source.is_symlink():
         return source.read_bytes()
-    with tempfile.TemporaryDirectory() as directory:
-        package = Path(directory)
-        source_dir = Path(installer.__file__).parent
+    archive = io.BytesIO()
+    source_dir = Path(installer.__file__).parent
+    with zipfile.ZipFile(archive, "w", compression=zipfile.ZIP_DEFLATED) as package:
         for name in ("node_install.py", "node_spec.py", "distribution.py", "node_generations.py", "install_display.py", "node_output.py", "provider_assets.py"):
-            shutil.copyfile(source_dir / name, package / ("__main__.py" if name == "node_install.py" else name))
-        archive = io.BytesIO()
-        zipapp.create_archive(package, archive, compressed=True)
-        return archive.getvalue()
+            package.write(source_dir / name, "__main__.py" if name == "node_install.py" else name)
+    return archive.getvalue()
 
 
 def install_helper(root, args, installer, archive=None):
@@ -62,10 +57,9 @@ def install_helper(root, args, installer, archive=None):
     installer.existing_file(target)
     if archive is None:
         archive = helper_archive(args, installer)
-    with tempfile.TemporaryDirectory(dir=root) as directory:
-        staged = Path(directory) / "helper.pyz"
-        staged.write_bytes(archive)
-        os.chmod(staged, 0o600)
+    with temporary_file(target) as staged:
+        with os.fdopen(os.open(staged, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "wb") as output:
+            output.write(archive)
         os.replace(staged, target)
     atomic_json(settings, value)
 
diff --git a/deploy/node/node_install.py b/deploy/node/node_install.py
index cc3f6a211..7944db376 100644
--- a/deploy/node/node_install.py
+++ b/deploy/node/node_install.py
@@ -24,7 +24,6 @@
 import stat
 import subprocess
 import sys
-import tempfile
 import time
 import urllib.error
 import urllib.request
@@ -229,13 +228,18 @@ def existing_file(path):
 
 
 def write_once(path, value):
-    if existing_file(path):
-        if path.read_text() != value:
-            raise InstallError("Existing node configuration differs; preserve its state and use the upgrade guide")
-        return
-    descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
-    with os.fdopen(descriptor, "w") as stream:
-        stream.write(value)
+    # Callers hold the installation lock through comparison and publication.
+    with distribution.temporary_file(path) as temporary:
+        if existing_file(path):
+            if path.read_text() != value:
+                raise InstallError("Existing node configuration differs; preserve its state and use the upgrade guide")
+            return
+        descriptor = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
+        with os.fdopen(descriptor, "w") as stream:
+            stream.write(value)
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.replace(temporary, path)
 
 
 def json_text(value):
@@ -257,17 +261,13 @@ def download(source, name, root, expected, prefix=""):
         if file_digest(target) != expected:
             raise RuntimeDownloadError("Installed node payload differs; refusing to overwrite it")
         return
-    descriptor, temporary = tempfile.mkstemp(prefix=".download-", dir=target.parent)
-    try:
-        with os.fdopen(descriptor, "wb") as output, fetch(source, prefix + name) as response:
+    with distribution.temporary_file(target) as temporary:
+        with os.fdopen(os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "wb") as output, fetch(source, prefix + name) as response:
             for block in iter(lambda: response.read(1024 * 1024), b""):
                 output.write(block)
         if file_digest(Path(temporary)) != expected:
             raise RuntimeDownloadError("Node payload checksum mismatch: " + name)
         os.replace(temporary, target)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
     if name.startswith("native/"):
         os.chmod(target, 0o700)
 
@@ -343,10 +343,8 @@ def unit_name(installation_id):
     return "oac-node-" + installation_id + ".service"
 
 
-def open_node(args, token):
-    """Read the Core specification and check the host; returns the node's state directory."""
-    root = Path.home() / ".oac/nodes" / args.installation_id
-    safe_directory(root)
+def configure_node(root, args, token):
+    """Read the Core specification and check the host under the installation lock."""
     identity_file = root / "state/node/identity.json"
     retained = json.loads(identity_file.read_text()) if existing_file(identity_file) else None
     args.configuration = node_spec.fetch(args, token, retained, open_request, allow_enrollment=not (root / "registered.json").exists())
@@ -359,7 +357,6 @@ def open_node(args, token):
         if not owner.exists() and any(runtime_home.iterdir()):
             raise InstallError("Microsandbox home contains unowned state; refusing to adopt it")
         write_once(owner, json_text({"installation_id": args.installation_id}))
-    return root
 
 
 @contextlib.contextmanager
@@ -373,7 +370,7 @@ def install_lock(root):
         yield
 
 
-def register_node(root, args, token, helper_archive=None):
+def register_node(root, args, token, helper_archive=None, *, secret_path):
     """Download and verify the payload, prepare the Runtime and register; not the service."""
     install_display.step("Downloading and verifying node files")
     program_manifest, program_sums = metadata(args.source_url, getattr(args, "bundle", None))
@@ -426,31 +423,28 @@ def register_node(root, args, token, helper_archive=None):
     marker = root / "registered.json"
     if not existing_file(marker):
         # The one-time credential is never passed through process arguments or service environments.
-        descriptor, secret_path = tempfile.mkstemp(prefix=".enrollment-", dir=root)
+        with os.fdopen(os.open(secret_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "w") as secret:
+            secret.write(token)
+        install_display.step("Registering this node with Core")
         try:
-            with os.fdopen(descriptor, "w") as secret:
-                secret.write(token)
-            install_display.step("Registering this node with Core")
-            try:
-                checked([str(root / provider_assets.artifacts(args.provider, ("node",))[0]), "register", "--config", str(root / "provider.json"), "--state-dir", str(root / "state/node"),
-                         "--core-url", args.core_url, "--name", socket.gethostname(),
-                         "--enrollment-token-file", secret_path], REGISTRATION_UNCONFIRMED, explain=registration_failure)
-            except AddressChanged:
-                discard_unregistered(root)
-                raise
-            write_once(marker, json_text(state))
-        finally:
-            if os.path.exists(secret_path):
-                os.unlink(secret_path)
+            checked([str(root / provider_assets.artifacts(args.provider, ("node",))[0]), "register", "--config", str(root / "provider.json"), "--state-dir", str(root / "state/node"),
+                     "--core-url", args.core_url, "--name", socket.gethostname(),
+                     "--enrollment-token-file", str(secret_path)], REGISTRATION_UNCONFIRMED, explain=registration_failure)
+        except AddressChanged:
+            discard_unregistered(root)
+            raise
+        write_once(marker, json_text(state))
     elif marker.read_text() != json_text(state):
         raise InstallError("Registered node identity differs; refusing to replace it")
 
 
 def prepare_service_node(args, token, helper_archive):
     """Sudo mode, as the service user: everything but the root-owned system unit."""
-    root = open_node(args, token)
-    with install_lock(root):
-        register_node(root, args, token, helper_archive)
+    root = Path.home() / ".oac/nodes" / args.installation_id
+    safe_directory(root)
+    with install_lock(root), distribution.temporary_file(root / "enrollment-token") as secret_path:
+        configure_node(root, args, token)
+        register_node(root, args, token, helper_archive, secret_path=secret_path)
 
 
 # Sudo mode -----------------------------------------------------------------
@@ -727,15 +721,11 @@ def root_file(path, content, replace=False):
         # Set the root-owned unit and record mode independently of the caller's umask.
         path.parent.mkdir(parents=True, mode=0o755)
         os.chmod(path.parent, 0o755)
-    descriptor, temporary = tempfile.mkstemp(prefix=".oac-node-", dir=path.parent)
-    try:
-        with os.fdopen(descriptor, "w") as stream:
+    with distribution.temporary_file(path) as temporary:
+        with os.fdopen(os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "w") as stream:
             stream.write(content)
         os.chmod(temporary, 0o644)
         os.replace(temporary, path)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
 
 
 def read_root_json(path):
diff --git a/deploy/node/test_distribution.py b/deploy/node/test_distribution.py
index d10ea6d70..bee168ab9 100644
--- a/deploy/node/test_distribution.py
+++ b/deploy/node/test_distribution.py
@@ -8,6 +8,7 @@
 import tempfile
 import ssl
 import subprocess
+import sys
 import threading
 from types import SimpleNamespace
 import unittest
@@ -29,15 +30,15 @@ def setUp(self):
         self.if_ranges = []
         self.status = 200
         self.redirect_target = 'https://elsewhere.example'
-        self.resumable = False
+        self.interrupted_once = False
         test = self
         class Handler(http.server.BaseHTTPRequestHandler):
             def do_GET(self):
                 test.requests.append(self.path)
                 test.ranges.append(self.headers.get('Range'))
                 test.if_ranges.append(self.headers.get('If-Range'))
-                if test.resumable:
-                    # The first response breaks off halfway; a Range request gets the rest.
+                if test.interrupted_once and len(test.requests) == 1:
+                    # The first response breaks off halfway; the retry starts over.
                     start = int(self.headers['Range'][6:-1]) if self.headers.get('Range') else 0
                     self.send_response(206 if start else 200)
                     self.send_header('Last-Modified', 'Sat, 26 Sep 2026 00:00:00 GMT')
@@ -109,28 +110,26 @@ def test_truncated_transfer_can_be_rerun(self):
         self.data = self.data[:20]
         with patch.object(distribution.time, 'sleep'), self.assertRaisesRegex(distribution.DistributionError, 'interrupted'):
             distribution.obtain_artifact(self.manifest, 'native/bin/node', self.root / 'node')
-        # Only the private partial file stays, for the rerun to continue.
-        self.assertEqual([path.name for path in self.root.iterdir()], ['.node.partial'])
+        self.assertEqual(list(self.root.iterdir()), [])
         self.data = b'prebuilt artifact' * 1000
         distribution.obtain_artifact(self.manifest, 'native/bin/node', self.root / 'node')
         self.assertEqual([path.name for path in self.root.iterdir()], ['node'])
 
-    def test_interrupted_download_resumes_with_the_missing_bytes(self):
-        self.resumable = True
+    def test_interrupted_download_restarts_with_a_clean_file(self):
+        self.interrupted_once = True
         with patch.object(distribution.time, 'sleep'):
             distribution.obtain_artifact(self.manifest, 'native/bin/node', self.root / 'node')
         self.assertEqual((self.root / 'node').read_bytes(), self.data)
-        self.assertEqual(self.ranges, [None, f'bytes={len(self.data) // 2}-'])
-        # If-Range: a file that changed since the partial began comes back whole instead of mixed.
-        self.assertEqual(self.if_ranges, [None, 'Sat, 26 Sep 2026 00:00:00 GMT'])
+        self.assertEqual(self.ranges, [None, None])
+        self.assertEqual(self.if_ranges, [None, None])
         self.assertEqual([path.name for path in self.root.iterdir()], ['node'])
 
-    def test_a_stalled_download_stops_and_keeps_its_part(self):
+    def test_a_stalled_download_stops_and_removes_its_part(self):
         with patch.object(distribution, 'SLOW_SECONDS', 0), \
-                self.assertRaisesRegex(distribution.DistributionError, 'stalled.*rerun the command to resume'):
+                self.assertRaisesRegex(distribution.DistributionError, 'stalled.*rerun the command'):
             distribution.obtain_artifact(self.manifest, 'native/bin/node', self.root / 'node')
         self.assertEqual(len(self.requests), 1)  # Not retried as a network error.
-        self.assertEqual([path.name for path in self.root.iterdir()], ['.node.partial'])
+        self.assertEqual(list(self.root.iterdir()), [])
 
     def test_offline_and_runtime_expansion_are_verified(self):
         raw = b'synthetic tar contents' * 1000
@@ -148,6 +147,43 @@ def test_offline_and_runtime_expansion_are_verified(self):
         with self.assertRaisesRegex(distribution.DistributionError, 'differs'):
             distribution.runtime_archive(self.manifest, self.root / 'cache')
 
+    def test_retry_after_sigkill_discards_unfinished_artifact(self):
+        target = self.root / 'node'
+        script = """import os, signal, sys
+from pathlib import Path
+import distribution
+with distribution.temporary_file(Path(sys.argv[1])) as partial:
+    partial.write_bytes(b'unfinished bytes')
+    os.kill(os.getpid(), signal.SIGKILL)
+"""
+        killed = subprocess.run([sys.executable, '-c', script, str(target)],
+                                cwd=Path(distribution.__file__).parent)
+        self.assertEqual(killed.returncode, -9)
+        partial = target.with_name('.node.partial')
+        self.assertTrue(partial.exists())
+        distribution.obtain_artifact(self.manifest, 'native/bin/node', target)
+        self.assertEqual(target.read_bytes(), self.data)
+        self.assertFalse(partial.exists())
+        self.assertEqual(self.ranges, [None])
+
+    def test_expansion_discards_stale_temporary_and_preserves_verified_archive(self):
+        raw = b'complete runtime image' * 1000
+        self.data = gzip.compress(raw)
+        entry = self.entry('images/runtime.tar.gz', self.data)
+        entry.update(unpacked_size=len(raw), unpacked_sha256='0' * 64)
+        cache = self.root / 'images'
+        cache.mkdir()
+        partial = cache / '.runtime.tar.partial'
+        partial.write_bytes(b'interrupted expansion')
+        with self.assertRaisesRegex(distribution.ArtifactError, 'Unpacked Runtime checksum'):
+            distribution.runtime_archive(self.manifest, self.root)
+        self.assertFalse(partial.exists())
+        self.assertFalse((cache / 'runtime.tar').exists())
+        self.assertEqual((cache / 'runtime.tar.gz').read_bytes(), self.data)
+        entry['unpacked_sha256'] = hashlib.sha256(raw).hexdigest()
+        self.assertEqual(distribution.runtime_archive(self.manifest, self.root).read_bytes(), raw)
+        self.assertEqual(len(self.requests), 1)
+
     def test_url_and_path_boundaries(self):
         self.assertEqual(distribution.safe_url('http://core.example:8080/a'), 'http://core.example:8080/a')
         for value in ('ftp://example.com/a', 'https://user:secret@example.com/a', 'file:///tmp/a'):
@@ -173,7 +209,7 @@ def test_artifact_downgrades_and_metadata_redirects_are_refused(self):
         self.assertEqual(list(self.root.iterdir()), [])
 
 
-    def test_https_redirect_resumes_and_verifies_on_the_node(self):
+    def test_https_redirect_discards_stale_partial_and_verifies_on_the_node(self):
         certificate, key = self.root / 'cert.pem', self.root / 'key.pem'
         subprocess.run(['openssl', 'req', '-x509', '-newkey', 'rsa:2048', '-nodes',
                         '-keyout', str(key), '-out', str(certificate), '-days', '1',
@@ -203,7 +239,6 @@ def log_message(self, *args):
             self.redirect_target = f'https://localhost:{release.server_port}'
             target = self.root / 'node'
             target.with_name('.node.partial').write_bytes(self.data[:7])
-            target.with_name('.node.partial.validator').write_text('resume-etag')
             opener = distribution.urllib.request.build_opener
             trusted = distribution.urllib.request.HTTPSHandler(context=ssl.create_default_context(cafile=str(certificate)))
             with patch.object(distribution.urllib.request, 'build_opener', side_effect=lambda *handlers: opener(*handlers, trusted)):
@@ -211,14 +246,15 @@ def log_message(self, *args):
                 distribution.obtain_artifact(self.manifest, 'native/bin/node', target)
             self.assertEqual(target.read_bytes(), self.data)
             self.assertEqual(len(received), 1)
-            self.assertEqual(received[0]['Range'], 'bytes=7-')
-            self.assertEqual(received[0]['If-Range'], 'resume-etag')
+            self.assertNotIn('Range', received[0])
+            self.assertNotIn('If-Range', received[0])
+            self.assertFalse(target.with_name('.node.partial').exists())
         finally:
             release.shutdown()
             release.server_close()
             thread.join()
 
-    def test_artifact_redirect_preserves_resume_without_credentials(self):
+    def test_artifact_redirect_strips_credentials_and_custom_headers(self):
         request = distribution.urllib.request.Request('https://console.example/artifact', headers={
             'Range': 'bytes=123-', 'If-Range': 'etag', 'Authorization': 'Bearer secret',
             'Cookie': 'session=secret', 'X-Core-Key': 'secret'})
@@ -227,7 +263,7 @@ def test_artifact_redirect_preserves_resume_without_credentials(self):
         forwarded = redirect.redirect_request(request, None, 307, '', {}, target)
         self.assertEqual(forwarded.full_url, target)
         self.assertEqual(dict((k.lower(), v) for k, v in forwarded.header_items()),
-                         {'range': 'bytes=123-', 'if-range': 'etag'})
+                         {})
         for invalid in ('http://release.example/file', 'file:///tmp/file', 'https://user:secret@release.example/file'):
             with self.subTest(invalid=invalid), self.assertRaises(distribution.ArtifactError):
                 redirect.redirect_request(request, None, 302, '', {}, invalid)
diff --git a/deploy/node/test_node_install.py b/deploy/node/test_node_install.py
index 306588b6c..b17d6fd80 100644
--- a/deploy/node/test_node_install.py
+++ b/deploy/node/test_node_install.py
@@ -509,6 +509,85 @@ def test_repeat_preserves_registration_and_recovers_service_start_failure(self):
         self.assertFalse(any("register" in call for call, _ in self.calls))
         self.assertFalse(any("load" in call for call, _ in self.calls))
 
+    def test_policy_download_after_sigkill_starts_clean(self):
+        root = self.home / "policy"
+        payload = self.payloads["runtime/seccomp.json"]
+        expected = hashlib.sha256(payload).hexdigest()
+        class Interrupted(io.BytesIO):
+            def read(self, size=-1):
+                if self.tell():
+                    os.kill(os.getpid(), signal.SIGKILL)
+                return super().read(1)
+        child = os.fork()
+        if child == 0:
+            with mock.patch.object(installer, "fetch", return_value=Interrupted(payload)):
+                installer.download(self.args.source_url, "runtime/seccomp.json", root, expected)
+            os._exit(1)
+        _, status = os.waitpid(child, 0)
+        self.assertEqual(os.waitstatus_to_exitcode(status), -signal.SIGKILL)
+        partial = root / "runtime/.seccomp.json.partial"
+        self.assertTrue(partial.exists())
+        installer.download(self.args.source_url, "runtime/seccomp.json", root, expected)
+        self.assertFalse(partial.exists())
+        self.assertEqual((root / "runtime/seccomp.json").read_bytes(), payload)
+
+    def test_retry_after_configuration_write_sigkill_publishes_complete_files(self):
+        for name in ("installation.json", "provider.json", "registered.json"):
+            with self.subTest(name=name):
+                self.args.installation_id = name.replace(".json", "")
+                self.root = self.home / ".oac/nodes" / self.args.installation_id
+                partial = self.root / ("." + name + ".partial")
+                original_open = os.open
+                def interrupted_open(path, *args, **kwargs):
+                    descriptor = original_open(path, *args, **kwargs)
+                    if path == partial:
+                        os.write(descriptor, b'{')
+                        os.kill(os.getpid(), signal.SIGKILL)
+                    return descriptor
+                child = os.fork()
+                if child == 0:
+                    with mock.patch.object(installer.os, "open", side_effect=interrupted_open):
+                        self.install()
+                    os._exit(1)
+                _, status = os.waitpid(child, 0)
+                self.assertEqual(os.waitstatus_to_exitcode(status), -signal.SIGKILL)
+                self.assertTrue(partial.exists())
+                self.assertFalse((self.root / name).exists())
+                self.install()
+                self.assertFalse(partial.exists())
+                for target in ("installation.json", "provider.json", "registered.json"):
+                    self.assertEqual(json.loads((self.root / target).read_text())["installation_id"], self.args.installation_id)
+
+    def test_retry_after_registration_sigkill_removes_secret_and_helper_staging(self):
+        write_once = installer.write_once
+        def killed_after_registration(path, value):
+            write_once(path, value)
+            if path.name == "registered.json":
+                os.kill(os.getpid(), signal.SIGKILL)
+        child = os.fork()
+        if child == 0:
+            with mock.patch.object(installer, "write_once", side_effect=killed_after_registration):
+                self.install()
+            os._exit(1)
+        _, status = os.waitpid(child, 0)
+        self.assertEqual(os.waitstatus_to_exitcode(status), -signal.SIGKILL)
+        partial = self.root / ".enrollment-token.partial"
+        self.assertTrue(partial.exists())
+        identity = (self.root / "state/node/identity.json").read_bytes()
+        with mock.patch.object(installer.node_spec, "fetch", side_effect=installer.InstallError("Core unavailable")):
+            with self.assertRaisesRegex(installer.InstallError, "Core unavailable"):
+                self.install()
+        self.assertFalse(partial.exists())
+        self.assertEqual((self.root / "state/node/identity.json").read_bytes(), identity)
+        helper = self.root / ".generation-preparer.pyz.partial"
+        helper.write_bytes(b'unfinished helper')
+        helper.chmod(0o600)
+        self.install()
+        self.assertFalse(partial.exists())
+        self.assertFalse(helper.exists())
+        self.assertEqual((self.root / "state/node/identity.json").read_bytes(), identity)
+        self.assertFalse(any("register" in call for call, _ in self.calls))
+
     def test_unconfirmed_registration_retains_state_removes_token_and_does_not_start(self):
         self.fail_registration = True
         with self.assertRaisesRegex(installer.InstallError, "not confirmed"):
diff --git a/deploy/test_install.py b/deploy/test_install.py
index 6393b28fa..f4bb80cdd 100644
--- a/deploy/test_install.py
+++ b/deploy/test_install.py
@@ -1,5 +1,7 @@
 """install.sh writes .env and starts Compose without host Python."""
 import os
+import fcntl
+import sys
 from pathlib import Path
 import stat
 import subprocess
@@ -13,43 +15,60 @@
 
 
 class InstallScriptTests(unittest.TestCase):
-    def install(self, root, *args, compose_up=0, route="1.1.1.1 via 10.0.0.1 dev eth0 src 10.0.0.5 uid 0"):
+    def install(self, root, *args, compose_up=0, docker_info=0, key_status=0, download_status=0, kill_download=False, kill_start=False, pull_status=0, kill_pull=False, file_limit=False, missing_image="", route="1.1.1.1 via 10.0.0.1 dev eth0 src 10.0.0.5 uid 0"):
         bin_dir = root / "bin"
         bin_dir.mkdir(exist_ok=True)
         log = root / "docker.log"
         self.write_executable(bin_dir / "docker", textwrap.dedent(f"""\
             #!/bin/sh
-            printf '%s\\n' "$*" >> {log}
+            [ {1 if file_limit else 0} -eq 1 ] || printf '%s\\n' "$*" >> {log}
+            if [ "$1" = info ]; then exit {docker_info}; fi
+            if [ "$1" = pull ]; then {'kill -KILL "$PPID"' if kill_pull else ':'}; exit {pull_status}; fi
+            if [ "$1" = image ] && [ "$2" = inspect ] && [ "$3" = "{missing_image}" ]; then exit 1; fi
+            if [ "$1" = compose ] && [ "$2" = config ] && [ "$3" = --images ]; then printf 'fixture-core:latest\\nfixture-web:latest\\n'; fi
+            if [ "$1" = compose ] && [ "$2" = logs ]; then echo service-diagnostic >&2; fi
+            if [ "$1" = compose ] && [ "$2" = config ] && [ "$3" = --environment ]; then sed "s/'//g" .env; fi
             if [ "$1" = compose ] && [ "$2" = version ]; then printf 'v2.29.1\\n'; exit 0; fi
-            if [ "$1" = compose ] && [ "$2" = cp ]; then printf '#!/bin/sh\\necho oac_core_fixture\\n' > ./oac; chmod +x ./oac; exit 0; fi
-            if [ "$1" = compose ] && [ "$2" = up ]; then exit {compose_up}; fi
+            if [ "$1" = compose ] && [ "$2" = cp ]; then printf '#!/bin/sh\\necho oac_core_fixture\\nexit {key_status}\\n' > ./oac.download; chmod +x ./oac.download; exit 0; fi
+            if [ "$1" = compose ] && [ "$2" = up ]; then {'kill -KILL "$PPID"' if kill_start else ':'}; exit {compose_up}; fi
             exit 0
             """))
-        self.write_executable(bin_dir / "curl", textwrap.dedent("""\
+        self.write_executable(bin_dir / "curl", textwrap.dedent(f"""\
             #!/bin/sh
+            exit_status={download_status}
+            [ "$exit_status" = 0 ] || exit "$exit_status"
             output=""
             while [ $# -gt 0 ]; do
               if [ "$1" = --output ]; then output="$2"; shift 2; continue; fi
               shift
             done
             printf 'fixture\\n' > "$output"
+            {'kill -KILL "$PPID"' if kill_download else ':'}
             """))
         self.write_executable(bin_dir / "sha256sum", "#!/bin/sh\nexit 0\n")
+        self.write_executable(bin_dir / "uname", '#!/bin/sh\ncase "$1" in -s) echo Linux;; -m) echo x86_64;; esac\n')
+        self.write_executable(bin_dir / "flock", f'#!{sys.executable}\nimport fcntl, sys\ntry: fcntl.flock(int(sys.argv[-1]), fcntl.LOCK_EX | fcntl.LOCK_NB)\nexcept BlockingIOError: sys.exit(1)\n')
         self.write_executable(bin_dir / "ss", "#!/bin/sh\nexit 0\n")
         self.write_executable(bin_dir / "ip", f"#!/bin/sh\nprintf '%s\\n' '{route}'\n")
         env = dict(os.environ, PATH=str(bin_dir) + os.pathsep + os.environ["PATH"], HOME=str(root))
-        completed = subprocess.run(["bash", str(INSTALL), "--install-dir", str(root / "oac"), *args],
+        command = ["bash", str(INSTALL), "--install-dir", str(root / "oac"), *args]
+        if file_limit:
+            command = ["bash", "-c", 'ulimit -f 0; exec "$@"', "--", *command]
+        completed = subprocess.run(command,
                                    env=env, capture_output=True, text=True)
         return completed, log.read_text() if log.exists() else ""
 
-    def test_a_failed_first_start_stops_and_removes_the_directory(self):
+    def test_a_failed_start_preserves_configuration_and_reports_service_logs(self):
         with tempfile.TemporaryDirectory() as temporary:
             root = Path(temporary)
             completed, recorded = self.install(root, "--host", "127.0.0.1", "--web-port", "59991",
                                                "--public-url", "https://core.example", compose_up=1)
             self.assertNotEqual(completed.returncode, 0, completed.stderr)
-            self.assertFalse((root / "oac").exists(), "a failed first start must remove the directory")
-            self.assertIn("compose pull", recorded)
+            self.assertTrue((root / "oac/.env").exists())
+            self.assertNotIn("compose down", recorded)
+            self.assertIn("service-diagnostic", completed.stderr)
+            self.assertIn("data retained", completed.stderr)
+            self.assertIn("pull --platform linux/amd64 fixture-core:latest", recorded)
             self.assertIn("compose up -d --wait", recorded)
             self.assertIn("compose logs", recorded, "a failed start must show the services' logs")
 
@@ -58,7 +77,7 @@ def test_the_private_address_is_the_default_public_url(self):
             root = Path(temporary)
             completed, _ = self.install(root)
             self.assertEqual(completed.returncode, 0, completed.stderr)
-            self.assertIn("OAC_PUBLIC_URL=http://10.0.0.5:8080\n", (root / "oac/.env").read_text())
+            self.assertIn("OAC_PUBLIC_URL='http://10.0.0.5:8080'\n", (root / "oac/.env").read_text())
             self.assertIn("Console   http://10.0.0.5:8080", completed.stdout)
             self.assertIn("Core key  oac_core_fixture", completed.stdout)
             self.assertNotIn("Only this host", completed.stdout)
@@ -70,7 +89,7 @@ def test_without_a_private_address_only_this_host_reaches_web(self):
                 root = Path(temporary)
                 completed, _ = self.install(root, *args, route=route)
                 self.assertEqual(completed.returncode, 0, completed.stderr)
-                self.assertIn("OAC_PUBLIC_URL=http://localhost:59992\n", (root / "oac/.env").read_text())
+                self.assertIn("OAC_PUBLIC_URL='http://localhost:59992'\n", (root / "oac/.env").read_text())
                 self.assertIn("Only this host can open the console", completed.stdout)
 
     def test_env_holds_only_the_installation_choices(self):
@@ -78,10 +97,189 @@ def test_env_holds_only_the_installation_choices(self):
             root = Path(temporary)
             completed, _ = self.install(root, "--public-url", "https://core.example")
             self.assertEqual(completed.returncode, 0, completed.stderr)
-            env = dict(line.split("=", 1) for line in (root / "oac/.env").read_text().splitlines())
+            env = dict((lambda pair: (pair[0], pair[1].strip("'")))(line.split("=", 1)) for line in (root / "oac/.env").read_text().splitlines())
             self.assertEqual(env["OAC_PUBLIC_URL"], "https://core.example")
             self.assertEqual(sorted(env), ["COMPOSE_PROJECT_NAME", "OAC_HOST", "OAC_INSTALL_DIR", "OAC_PUBLIC_URL", "OAC_WEB_PORT"])
 
+    def test_key_failure_never_removes_a_started_installation(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            completed, recorded = self.install(root, key_status=1)
+            self.assertNotEqual(completed.returncode, 0)
+            self.assertTrue((root / "oac/.env").exists())
+            self.assertNotIn("compose down", recorded)
+            self.assertIn("Core key could not be read", completed.stderr)
+
+    def test_retry_reuses_saved_settings_and_keeps_data(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            failed, _ = self.install(root, "--public-url", "https://core.example", compose_up=1)
+            self.assertNotEqual(failed.returncode, 0)
+            configuration = (root / "oac/.env").read_bytes()
+            data = root / "oac/data"
+            data.mkdir()
+            (data / "keep").write_text("user data")
+            (root / "docker.log").unlink()
+            completed, recorded = self.install(root, download_status=22)
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            self.assertEqual((root / "oac/.env").read_bytes(), configuration)
+            self.assertEqual((data / "keep").read_text(), "user data")
+            self.assertIn("Console   https://core.example", completed.stdout)
+            self.assertNotIn("pull --platform", recorded)
+            self.assertNotIn("Only this host", completed.stdout)
+
+    def test_retry_downloads_only_missing_images_and_prevents_implicit_updates(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            failed, _ = self.install(root, compose_up=1)
+            self.assertNotEqual(failed.returncode, 0)
+            (root / "docker.log").unlink()
+            (root / "oac/oac").unlink()
+            completed, recorded = self.install(root, missing_image="fixture-web:latest")
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            self.assertNotIn("pull --platform linux/amd64 fixture-core:latest", recorded)
+            self.assertIn("pull --platform linux/amd64 fixture-web:latest", recorded)
+            for line in recorded.splitlines():
+                if line.startswith(("compose create", "compose up")):
+                    self.assertIn("--pull never", line)
+                    self.assertIn("--no-recreate", line)
+
+    def test_retry_after_file_size_limit_recovers_staging(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            failed, _ = self.install(root, file_limit=True)
+            self.assertNotEqual(failed.returncode, 0)
+            self.assertIn("Downloading release checksums", failed.stdout)
+            completed, _ = self.install(root)
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            self.assertFalse((root / "oac.staging").exists())
+
+    def test_failed_initial_pull_never_adopts_old_cached_images_on_retry(self):
+        for kill in (False, True):
+            with self.subTest(kill=kill), tempfile.TemporaryDirectory() as temporary:
+                root = Path(temporary)
+                failed, _ = self.install(root, pull_status=1, kill_pull=kill)
+                self.assertNotEqual(failed.returncode, 0)
+                self.assertFalse((root / "oac").exists())
+                (root / "docker.log").unlink()
+                # Every image inspect succeeds: another installation cached old tags.
+                completed, recorded = self.install(root)
+                self.assertEqual(completed.returncode, 0, completed.stderr)
+                for image in ("fixture-core:latest", "fixture-web:latest"):
+                    self.assertIn("pull --platform linux/amd64 " + image, recorded)
+                self.assertFalse((root / "oac.staging").exists())
+
+    def test_invalid_port_and_unavailable_docker_fail_before_installation(self):
+        for args, status in [(["--web-port", "0"], 0), (["--web-port", "70000"], 0), ([], 1)]:
+            with self.subTest(args=args, status=status), tempfile.TemporaryDirectory() as temporary:
+                root = Path(temporary)
+                completed, recorded = self.install(root, *args, docker_info=status)
+                self.assertNotEqual(completed.returncode, 0)
+                self.assertFalse((root / "oac").exists())
+                self.assertNotIn("pull --platform", recorded)
+
+    def test_failed_download_leaves_no_installation_or_staging(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            completed, recorded = self.install(root, download_status=22)
+            self.assertNotEqual(completed.returncode, 0)
+            self.assertFalse((root / "oac").exists())
+            self.assertFalse((root / "oac.staging").exists())
+            self.assertNotIn("compose down", recorded)
+
+    def test_retry_after_sigkill_cleans_unfinished_download(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            killed, _ = self.install(root, kill_download=True)
+            self.assertEqual(killed.returncode, -9, killed.stderr)
+            self.assertTrue((root / "oac.staging").exists())
+            self.assertFalse((root / "oac").exists())
+            completed, _ = self.install(root)
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            self.assertFalse((root / "oac.staging").exists())
+            self.assertTrue((root / "oac/oac").exists())
+
+    def test_retry_after_start_sigkill_cleans_published_log(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            killed, _ = self.install(root, kill_start=True)
+            self.assertEqual(killed.returncode, -9, killed.stderr)
+            self.assertTrue((root / "oac/install.log").exists())
+            completed, _ = self.install(root)
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            self.assertFalse((root / "oac/install.log").exists())
+            self.assertFalse((root / "oac.staging").exists())
+
+    def test_retry_clears_staging_from_an_interrupted_process(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            staging = root / "oac.staging"
+            staging.mkdir()
+            (staging / ".oac-installer").symlink_to((root / "oac").resolve())
+            (staging / "partial").write_text("unfinished download")
+            completed, _ = self.install(root)
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            self.assertFalse(staging.exists())
+            self.assertFalse((root / "oac/partial").exists())
+
+    def test_unrecognized_staging_directory_is_never_deleted(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            staging = root / "oac.staging"
+            staging.mkdir()
+            (staging / "keep").write_text("user data")
+            completed, recorded = self.install(root)
+            self.assertNotEqual(completed.returncode, 0)
+            self.assertIn("Unrecognized staging", completed.stderr)
+            self.assertEqual((staging / "keep").read_text(), "user data")
+            self.assertNotIn("compose up", recorded)
+
+    def test_existing_unrelated_directory_is_never_deleted(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            (root / "oac").mkdir()
+            (root / "oac/keep").write_text("user data")
+            completed, recorded = self.install(root)
+            self.assertNotEqual(completed.returncode, 0)
+            self.assertEqual((root / "oac/keep").read_text(), "user data")
+            self.assertNotIn("compose down", recorded)
+
+    def test_another_installation_holds_the_lock(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            with (root / "oac.install.lock").open("w") as lock:
+                fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                completed, recorded = self.install(root)
+            self.assertNotEqual(completed.returncode, 0)
+            self.assertIn("Another installation", completed.stderr)
+            self.assertFalse((root / "oac").exists())
+            self.assertNotIn("pull --platform", recorded)
+
+    def test_retry_does_not_overlap_an_oac_mutation(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            completed, _ = self.install(root)
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            (root / "docker.log").unlink()
+            with (root / "oac/.oac.lock").open("r+") as lock:
+                fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                completed, recorded = self.install(root)
+            self.assertNotEqual(completed.returncode, 0)
+            self.assertIn("Another oac command", completed.stderr)
+            self.assertNotIn("compose up", recorded)
+
+    def test_rerun_does_not_silently_replace_settings(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            completed, _ = self.install(root)
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            before = (root / "oac/.env").read_bytes()
+            completed, _ = self.install(root, "--web-port", "9000")
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            self.assertIn("Using saved settings", completed.stdout)
+            self.assertIn("only apply to new directories", completed.stdout)
+            self.assertEqual((root / "oac/.env").read_bytes(), before)
+
     def test_help_does_not_need_docker(self):
         help_text = subprocess.run(["bash", str(INSTALL), "--help"], capture_output=True, text=True, check=True)
         self.assertIn("--web-port", help_text.stdout)
diff --git a/docs/getting-started/install.md b/docs/getting-started/install.md
index 566cbc111..ea8fcced3 100644
--- a/docs/getting-started/install.md
+++ b/docs/getting-started/install.md
@@ -44,7 +44,13 @@ The script downloads that release's Compose files, checks their SHA-256, and:
 
 It saves no sandbox backend, adds no node, creates no Project or key and makes no model request. It ends by printing the console address and the Core key.
 
-If installation fails before the services become healthy, the installer removes the directory it created. Fix the reported cause and rerun the same command. Once the services have started, a later failure keeps the installation and its data. A new release is a new directory; see [version policy](./operations.md#installation-version-policy).
+Downloads and configuration checks happen before the installation directory is published. After that, failures preserve the configuration and data and show the service logs. Fix the reported cause and rerun the same command, or specify the installation directory:
+
+```bash
+curl -fsSL https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.sh | bash -s -- --install-dir "$HOME/.oac/core"
+```
+
+Use your chosen directory if it differs. A rerun uses the saved Compose file and settings; installation flags only apply to new directories. Existing images and containers are reused; missing images are downloaded. To change settings, edit `.env` and run `oac apply`. A new release needs a new directory; see [version policy](./operations.md#installation-version-policy).
 
 For insufficient space or quota, free space on the filesystem named by the error. Image-loading failures can also require space in Docker's storage, which may be on a different filesystem.
 
diff --git a/docs/getting-started/nodes.md b/docs/getting-started/nodes.md
index 7847678a1..fd99451cd 100644
--- a/docs/getting-started/nodes.md
+++ b/docs/getting-started/nodes.md
@@ -27,18 +27,9 @@ Node installation and removal require root. Web's command uses `sudo` unless the
 
 ### The command
 
-This is the command Web generates, with this installation's values:
-
-```sh
- (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT; s=; [ "$(id -u)" -eq 0 ] || s=sudo
-printf '\n==> Downloading node installer...\n' &&
-curl -fsS --max-time 30 --max-filesize 1048576 'https://core.example/node-install/node-install.pyz' -o "$d/node-install.pyz" &&
-printf '==> Verifying node installer...\n' &&
-printf '%s  %s\n' '<installer-sha256>' "$d/node-install.pyz" | sha256sum -c --status &&
-printf '%s\n' '<enrollment-token>' | $s python3 "$d/node-install.pyz" ${NO_COLOR+--no-color} --enrollment-token-stdin --source-url 'https://core.example' --core-url 'https://core.example' --provider 'docker' --installation-id '<installation-id>')
-```
-
-- It downloads the installer into a private temporary directory, checks its SHA-256, and runs it with `sudo`, or directly in a root shell.
+Copy the current command from **Nodes → Add node**. It includes this installation's address, checksum and enrollment token. Before downloading, it checks Linux amd64, Python 3.9+ and the required tools. Temporary download failures retry up to three attempts. If checksum verification fails, copy a fresh command from Web and retry.
+
+- It downloads into the invoking account's private `~/.oac/node-bootstrap` directory, checks SHA-256, and runs with `sudo`, or directly in a root shell. Each retry clears the unfinished download while holding a lock; verified `<sha256>.pyz` files remain available to installers.
 - The token reaches the installer on standard input, so it never appears in a process argument, an environment variable or sudo's log.
 - The leading space keeps the command out of the shell history where `HISTCONTROL` ignores such lines (the Debian and Ubuntu default).
 
@@ -46,7 +37,7 @@ The installer shows each phase as it runs and, once Core confirms the node, a su
 
 ### Host requirements
 
-- Linux amd64 with systemd; Python 3.9+, `curl` and `sha256sum`; root or sudo.
+- Linux amd64 with systemd; Python 3.9+, `curl`, `sha256sum` and `flock`; root or sudo.
 - SELinux not enforcing. The installer does not support hosts with enforcing SELinux.
 - Docker: rootful Docker Engine running, its socket `/var/run/docker.sock` owned by the `docker` group with mode `0660`, enforcing CPU and memory limits (cgroup v2).
 - microsandbox: `/dev/kvm` in the `kvm` group (hardware or nested virtualization), and the libraries microsandbox links (glibc).
@@ -88,7 +79,7 @@ Root only prepares the account, the group and the unit; everything else, the Doc
 - Rerunning the same command is safe. Once the node is registered, a rerun uses the node's own credential, changes nothing that already matches and needs no token. It refuses, without changing anything, when the node's retained identity belongs to another Core address or installation.
 - A command that already expired, or was used on another host, fails at once with `Core rejected the node configuration read (HTTP 401)`: generate a new command and run it within 10 minutes.
 - If the command expires during a slow download, registration fails with `The enrollment command expired or was already used`. The downloaded files are kept: generate a new command in Web and run it.
-- Downloads resume where they stopped. A download that brings less than 64 KiB in a minute stops, keeping what it has; run the command again.
+- Failed or interrupted downloads discard their temporary files. A rerun downloads missing files from the beginning and reuses verified complete files. A transfer that brings less than 64 KiB in a minute stops; check the network and retry.
 - The Docker Runtime image is about 500 MB. On a slow link, load it first: copy the release's `oac-<commit>-linux-amd64-runtime.tar.gz` asset to the host and run `sudo docker load -i` on it. The installer then finds the exact image and skips the download.
 - Interrupting the installer, or closing its terminal, stops it; run the command again to continue.
 
diff --git a/docs/getting-started/operations.md b/docs/getting-started/operations.md
index 09911618f..9759d4c4d 100644
--- a/docs/getting-started/operations.md
+++ b/docs/getting-started/operations.md
@@ -161,24 +161,19 @@ An installation runs one release for its whole life. In-place version upgrades a
 
 To move to a new release, install it into a new, empty directory, with its own database, Core key and nodes, and add nodes from its Web. Keep the old installation, its data and its nodes until their work is finished. Nodes run the program of the console that added them and are never upgraded in place; Core accepts only nodes that speak its own node protocol.
 
-`install.sh` refuses a directory that is not empty. If the first start fails, it deletes the directory it created, and the same command can be run again. An installation that has already started is left in place.
+An interrupted installation can [resume with its saved configuration](./install.md#install). An unrelated nonempty directory is refused.
 
-Mutating `oac` commands hold `.oac.lock`. If another command holds it, retry after that command finishes. Never delete `.oac.lock` to get past a busy installation.
+The installer and mutating `oac` commands hold `.oac.lock`. The installer also holds a sibling `<install-dir>.install.lock` while preparing the directory. If another command holds either lock, retry after it finishes. Never delete a lock file to get past a busy installation.
 
 ## Troubleshooting
 
 | Symptom | Cause and fix |
 | --- | --- |
-| `Core installation requires Linux amd64 with Docker access` | Use Linux amd64 and an account with Docker access; root and ordinary users are supported |
-| `Installation failed: inspect prerequisites and private deployment files` | A prerequisite failed without its own message, most often Docker: check that `docker info` and `docker compose version` work for this user |
-| `Docker Compose 2.26.0 or newer is required …` | Update the Docker Compose plugin |
 | `Port N is already in use.` | Another program holds that port. Stop it, or choose another `--web-port`. The installer does not move to a different port |
-| `Installation directory is not empty` | Use an empty `--install-dir`, or [uninstall](#uninstall) the existing installation first |
+| `Directory is not a complete Core installation` | Preserve the directory and choose another `--install-dir` |
 | `configuration check failed; no service was changed` | `.env` has a value Core rejects. The message names the variable and not the value. Fix `.env` and run `oac apply` again |
 | `Docker Compose 2.26 or newer is required` | Update the Docker Compose plugin |
-| `The services did not start: …` | A new installation's first start failed, and the installer [removed what it created](./install.md#install). Compose's or Core's error is printed above it; fix the cause and run the same command again |
-| `Removal did not finish. Left: …` | A failed first start could not remove everything. Run the printed commands to remove what is left, or fix the cause and run the same command again |
-| `This installation did not finish installing …` | The installer stopped before reporting that the services were running. Rerun the installer command, which [removes what is left](./install.md#install) and installs again, or [uninstall](#uninstall) it |
+| `Installation and data retained at …` | Read the service logs above it, fix the cause, then [resume installation](./install.md#install); keep the data |
 | Web answers 403 `Forbidden` | The browser host is not `OAC_PUBLIC_URL`. Open that origin; a reverse proxy must pass the original Host |
 | Web shows that Core is unavailable (502) | Core is stopped or failing: `docker compose ps`, then Core's log |
 | Session creation returns 400 `model_provider_required` | No model provider: set a [default model](../configuration.md#default-models) for the harness, or pass one |
diff --git a/docs/getting-started/self-hosted.md b/docs/getting-started/self-hosted.md
index 30827d897..e5b8382a0 100644
--- a/docs/getting-started/self-hosted.md
+++ b/docs/getting-started/self-hosted.md
@@ -25,7 +25,7 @@ The machine needs:
 - Python and pip when the Session's packages need them;
 - any system packages your setup needs. The daemon never runs apt, sudo or another elevation command, so install them through the host's normal administration.
 
-No administrator privileges or Docker are needed. The Unix download command also uses `curl`, `tar`, `gzip`, a SHA-256 tool and the system file-lock command (`flock` on Linux, `lockf` on macOS).
+No administrator privileges or Docker are needed. The Unix download command also uses `curl`, `tar`, `gzip`, a SHA-256 tool and the system file-lock command (`flock` on Linux, `lockf` on macOS). Windows needs its system `tar.exe`; the command checks for it before downloading. The Runtime home must allow executable files to run. On a Unix `noexec` mount, choose another absolute directory with `OAC_RUNTIME_HOME` before running the command.
 
 ## Connect a machine
 
diff --git a/docs/maintainers.md b/docs/maintainers.md
index 4918ab538..c1f75330e 100644
--- a/docs/maintainers.md
+++ b/docs/maintainers.md
@@ -13,7 +13,7 @@ Build on Linux x86_64 with a glibc compatible with Debian 12, Docker, the Go ver
 ```sh
 bash scripts/prepare-release-runtimes.sh
 inputs="$HOME/.oac/build/release-inputs/inputs.json"
-export AGENTS_RUNTIME_CODEX_PACKAGE="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["codex"])' "$inputs")"
+export CODEX_CLI_DIR="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["codex"])' "$inputs")"
 export MCODE_HARNESS_BUILD_DIR="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["mcode"])' "$inputs")"
 export CORE_DISTRIBUTION_RELEASE_BASE_URL=https://github.com/MiniMax-AI/OpenAgentCore/releases/download/v1.2.3
 make build-core-distribution
@@ -25,7 +25,7 @@ make build-core-distribution
 | --- | --- |
 | `CORE_DISTRIBUTION_RELEASE_BASE_URL` | Versioned HTTPS directory that will serve the generated asset file names (never `latest`). Required unless `CORE_DISTRIBUTION_OFFLINE=1` |
 | `CORE_DISTRIBUTION_OFFLINE` | `1` also builds the offline archive |
-| `AGENTS_RUNTIME_CODEX_PACKAGE`, `MCODE_HARNESS_BUILD_DIR` | Pinned Runtime inputs from `prepare-release-runtimes.sh` |
+| `CODEX_CLI_DIR`, `MCODE_HARNESS_BUILD_DIR` | Pinned Runtime inputs from `prepare-release-runtimes.sh` |
 | `CORE_DISTRIBUTION_CODEX_IMAGE`, `CORE_DISTRIBUTION_CLAUDE_IMAGE`, `CORE_DISTRIBUTION_MCODE_IMAGE` | Use existing Harness images, given as immutable `sha256:` image IDs, instead of building them; set all three or none. Each must contain the daemon built from this commit |
 | `OAC_NATIVE_INSTALLER_BUILD_DIR` | Native installer catalog directory; see [Native installers](#native-installers) |
 | `CORE_DISTRIBUTION_BUILD_DIR` | Output directory under `~/.oac`. Default: `~/.oac/build/core-distribution` |
@@ -59,9 +59,9 @@ The catalog records the commit, the Runtime protocol version, each archive's SHA
 **Codex Runtime image.** Extract the official npm package `@openai/codex@0.153.4-linux-x64` under `~/.oac` (for example with `npm pack --ignore-scripts` and `tar -xzf`), then:
 
 ```sh
-export AGENTS_RUNTIME_CODEX_PACKAGE=/absolute/path/to/package
-make build-agents-runtime
-docker build --platform linux/amd64 -t oac-runtime:codex "${OAC_DEV_HOME:-$HOME/.oac}/build/agents-runtime"
+export CODEX_CLI_DIR=/absolute/path/to/package
+make build-codex-runtime
+docker build --platform linux/amd64 -t oac-runtime:codex "${OAC_DEV_HOME:-$HOME/.oac}/build/codex-runtime"
 ```
 
 The script checks the package version, builds `oac-daemon` for Linux amd64 and prepares a context with only the daemon, the unmodified `codex` and `codex-code-mode-host` executables, their resources and `services/core/deploy/codex/Dockerfile`. The Runtime image leaves out `codex-code-mode-host`, which only the agent-host image installs.
@@ -93,7 +93,7 @@ The distribution combines the three Harness images into one Runtime image (`depl
 **Agent-host and sandbox images.** With the inputs of the three Harness images above:
 
 ```sh
-export AGENTS_RUNTIME_CODEX_PACKAGE=/absolute/path/to/package MCODE_HARNESS_BUILD_DIR=/absolute/mcode-harness
+export CODEX_CLI_DIR=/absolute/path/to/package MCODE_HARNESS_BUILD_DIR=/absolute/mcode-harness
 bash scripts/build-agent-host-images.sh
 ```
 
diff --git a/docs/runtime-protocol.md b/docs/runtime-protocol.md
index 472454db7..01c644f7e 100644
--- a/docs/runtime-protocol.md
+++ b/docs/runtime-protocol.md
@@ -53,21 +53,22 @@ A declaration describes what the Runtime can do. Core admits a public feature on
 
 `permissions` gates permission decisions inside the Runtime. Core has no admission rule for `usage` and `resume`.
 
-The configuration of `execution_prepare` carries the Session's model configuration and the opt-ins Core sets for each Run:
+The `execution_prepare` configuration carries the Session's model configuration and the opt-ins Core sets for each Run:
 
 | Field | Set by Core |
 | --- | --- |
 | `model`, `system_prompt`, `model_provider`, `harness_config` | From the Session's frozen configuration: the Agent's model and instructions, the Session's provider bundle, and the [native model parameters](../contracts/agents-api/model-execution.md#native-model-parameters). The Harness validates them before any native effect |
 | `execution_controls` | Always: web search `disabled`, the resolved text verbosity (default `medium`), an explicit programmatic-tool-calling disable and any `json_schema` output format. Native option names belong to the adapter |
-| `observe_tool_observations` | Always. Tool-call frames then carry the engine-neutral `observation` |
 | `observe_messages` | When the Runtime declares `message_items`. Text deltas then carry the native item ID, and `output_message` frames report message start, completion, phase and the completion text |
 | `observe_subagent_identities`, `disable_subagents` | From the Agent's `multi_agent.enabled` |
 | `disable_execution_environment` | For an Environment of type `none` |
 | `local_environment` | For `openai_hosted` and `self_hosted`, with the exact Environment binding. The request carries no working directory; the Runtime checks `workspace_directory` against its binding |
-| `strict_resume`, `require_existing_native_session` | Always strict; the second when a native Session must be recovered |
+| `require_existing_native_session` | When a native Session must be recovered |
 | `durable_receipt` on `prompt_steer` | For every active input Core delivers |
 
-Requests without an opt-in keep the frames and fields they had without it.
+An execution configuration requires exactly one of `local_environment` and `disable_execution_environment`; `execution_prepare` rejects neither or both with `unsupported_configuration`.
+
+Requests without an opt-in keep the frames and fields they had without it. A `tool_call` frame carries the engine-neutral `observation` whenever the adapter maps the native tool.
 
 ## Envelope and identity
 
@@ -151,7 +152,7 @@ Core delivers active input as `prompt_steer` with `durable_receipt: true`, one i
 | `written` acknowledgement | Core waits at most 30 seconds from delivery for `written`; otherwise the input outcome is unknown |
 | Receipt send | Each receipt send has its own 5-second, shutdown-aware budget |
 | Native acceptance | `accepted` arrives under the Turn lifetime, with no automatic redelivery |
-| Done | Before `done`, the Runtime waits at most 15 seconds (the write and send budgets) for an in-flight input |
+| Done | The Runtime sends `done` after native Turn settlement and after the receipt send of any in-flight input; the native write and receipt send budgets bound that input |
 
 Neither `written` nor a send failure advances Core's input cursor. Once cancellation is sent, its receipt owns the terminal outcome even if an input becomes unknown first; Core records `cancel_unconfirmed` when no cancellation confirmation arrives within 15 seconds. A cancellation receipt carries the stopped Turn's confirmed continuity snapshot when no `done` is emitted.
 
@@ -211,7 +212,7 @@ Core runs an idle directory read on the Worker's Session scheduling reservation
 
 ## MCP connection authority
 
-Every public `MCPHTTPServer` in an execution configuration carries an explicit `connection_origin`; a missing or unknown value rejects rather than selecting a default, and Core freezes the public default before dispatch. The Runtime validates the origin with the common validator before selecting a factory and resolves public and installed MCP into transient effective bindings. The [Environment contract](../contracts/agents-api/environments.md#public-mcp-connection-origin) owns the supported combinations, native limits and failure ownership.
+Every public `MCPHTTPServer` in an `execution_prepare` configuration carries an explicit `connection_origin`; a missing or unknown value rejects rather than selecting a default, and Core freezes the public default before dispatch. The Runtime validates the origin with the common validator before selecting a factory and resolves public and installed MCP into transient effective bindings. The [Environment contract](../contracts/agents-api/environments.md#public-mcp-connection-origin) owns the supported combinations, native limits and failure ownership.
 
 ## Contract verification
 
diff --git a/docs/zh/getting-started/install.md b/docs/zh/getting-started/install.md
index f45e2806b..40e140379 100644
--- a/docs/zh/getting-started/install.md
+++ b/docs/zh/getting-started/install.md
@@ -1,7 +1,7 @@
 ---
 title: "安装 Core 和 Web"
 source: docs/getting-started/install.md
-source_hash: d35808e863a229c231ad94b3be5077b15b7d2ae8950695cc86f205babe806653
+source_hash: 2389430601d1241a9d6fe376f6d3d1fbbf2900f65c152800e14ebd1959c9dcd7
 ---
 
 一条命令即可在 Linux 主机上安装 Core、Web 控制台和 PostgreSQL。用 Core 密钥登录 Web，设置默认模型并签发 Project API 密钥。应用使用这些密钥调用 Core。Session 在你添加的节点上的沙箱中运行，也可以在 E2B 上运行。
@@ -46,7 +46,13 @@ curl -fsSL https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/
 
 安装程序不保存沙箱后端，不添加节点，不创建 Project 或密钥，也不发起模型请求。完成后输出控制台地址和 Core 密钥。
 
-如果服务进入健康状态之前安装失败，安装程序会删除它创建的目录。修复报告的问题后，重新运行同一命令。服务已经启动之后，后续失败会保留安装和数据。新发布版使用新目录；见[版本策略](operations.md#installation-version-policy)。
+安装目录就位前，先完成下载和配置检查。之后的失败会保留配置与数据，并显示服务日志。修复报错后，重新执行同一命令，或指定安装目录即可继续：
+
+```bash
+curl -fsSL https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.sh | bash -s -- --install-dir "$HOME/.oac/core"
+```
+
+如果使用了其他目录，请替换路径。重新执行时沿用已保存的 Compose 文件和设置；安装参数只对新目录生效。已有镜像和容器直接复用，缺失镜像会重新下载。修改设置请编辑 `.env` 并运行 `oac apply`。新发布版使用新目录；见[版本策略](operations.md#installation-version-policy)。
 
 空间或配额不足时，请释放错误信息所指文件系统的空间。加载镜像失败还可能需要释放 Docker 存储空间，该存储可能位于另一个文件系统。
 
diff --git a/docs/zh/getting-started/nodes.md b/docs/zh/getting-started/nodes.md
index c0097dc89..ec1e69d0b 100644
--- a/docs/zh/getting-started/nodes.md
+++ b/docs/zh/getting-started/nodes.md
@@ -1,7 +1,7 @@
 ---
 title: "添加和管理节点"
 source: docs/getting-started/nodes.md
-source_hash: 863ce05f8cfbc5da7c9f05c35c361ebd15a99fc3cebc952e2c8076810ff3fe3b
+source_hash: f5bec50bf81ebf1d08faaa54432da6a9c6e3ddbf88d93e33244276546c74aaab
 ---
 
 节点是一台 Linux 主机，在沙箱后端为 Docker 或 microsandbox 时，为 Core 托管 Session 运行沙箱。Core 将新 Session 分配给有空余容量的节点；节点创建沙箱，沙箱回连 Core。E2B 不需要节点。应用为自己的 Session 连接的机器是[自托管执行器](self-hosted.md)，而不是节点。
@@ -29,18 +29,9 @@ Core 主机与其他主机一样加入：要在它上面运行沙箱，将它添
 
 ### 命令 {#the-command}
 
-Web 生成如下命令，填入本安装的值：
+从 **Nodes → Add node** 复制当前命令，其中已填入本安装的地址、校验和与注册令牌。命令先检查 Linux amd64、Python 3.9+ 和必要工具，再下载文件；临时网络故障最多尝试三次。校验失败时，从 Web 复制新命令重试。
 
-```sh
- (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT; s=; [ "$(id -u)" -eq 0 ] || s=sudo
-printf '\n==> Downloading node installer...\n' &&
-curl -fsS --max-time 30 --max-filesize 1048576 'https://core.example/node-install/node-install.pyz' -o "$d/node-install.pyz" &&
-printf '==> Verifying node installer...\n' &&
-printf '%s  %s\n' '<installer-sha256>' "$d/node-install.pyz" | sha256sum -c --status &&
-printf '%s\n' '<enrollment-token>' | $s python3 "$d/node-install.pyz" ${NO_COLOR+--no-color} --enrollment-token-stdin --source-url 'https://core.example' --core-url 'https://core.example' --provider 'docker' --installation-id '<installation-id>')
-```
-
-- 下载到私有临时目录、检查 SHA-256，再通过 `sudo` 执行；root shell 中则直接执行。
+- 下载到当前账号的私有 `~/.oac/node-bootstrap` 目录，检查 SHA-256，再通过 `sudo` 执行；root shell 中则直接执行。每次持锁清理下载残片后重试，已验证的 `<sha256>.pyz` 保留供安装程序使用。
 - 令牌通过标准输入传给安装程序，不出现在进程参数、环境变量或 sudo 日志中。
 - 当 `HISTCONTROL` 忽略以空格开头的行时（Debian 和 Ubuntu 默认如此），前导空格能避免命令进入 shell 历史。
 
@@ -48,7 +39,7 @@ printf '%s\n' '<enrollment-token>' | $s python3 "$d/node-install.pyz" ${NO_COLOR
 
 ### 主机要求 {#host-requirements}
 
-- Linux amd64 和 systemd；Python 3.9+、`curl` 和 `sha256sum`；root 或 sudo。
+- Linux amd64 和 systemd；Python 3.9+、`curl`、`sha256sum` 和 `flock`；root 或 sudo。
 - SELinux 不处于 enforcing 模式。安装程序不支持 enforcing SELinux 主机。
 - Docker：正在运行的 rootful Docker Engine，其 `/var/run/docker.sock` 套接字属于 `docker` 组，权限为 `0660`，并强制执行 CPU 和内存限制（cgroup v2）。
 - microsandbox：`/dev/kvm` 属于 `kvm` 组（硬件或嵌套虚拟化），并具有 microsandbox 链接的库（glibc）。
@@ -90,7 +81,7 @@ root 只准备账号、组和服务单元；其他操作（包括 Docker 网络
 - 重新执行同一命令是安全的。节点注册后，重新运行使用节点自身凭据，不改变已匹配的内容，也无需令牌。保留的节点身份属于其他 Core 地址或安装时，程序拒绝且不修改任何内容。
 - 已过期或已在其他主机使用的命令立即失败，显示 `Core rejected the node configuration read (HTTP 401)`：生成新命令并在 10 分钟内执行。
 - 慢速下载期间命令过期时，注册失败并显示 `The enrollment command expired or was already used`。下载文件保留：在 Web 生成新命令后执行。
-- 下载从断点继续。每分钟下载不足 64 KiB 时会停止并保留已有内容；重新执行命令即可。
+- 失败或中断时删除下载残片；重新执行时从头下载缺失文件，复用已校验的完整文件。每分钟下载不足 64 KiB 时会停止，请检查网络后重试。
 - Docker Runtime 镜像约 500 MB。网络较慢时可提前加载：将发行资产 `oac-<commit>-linux-amd64-runtime.tar.gz` 复制到主机并运行 `sudo docker load -i`。安装程序发现精确匹配的镜像后跳过下载。
 - 中断安装程序或关闭终端会停止程序；重新执行命令继续。
 
diff --git a/docs/zh/getting-started/operations.md b/docs/zh/getting-started/operations.md
index 032fad44d..2c984de19 100644
--- a/docs/zh/getting-started/operations.md
+++ b/docs/zh/getting-started/operations.md
@@ -1,7 +1,7 @@
 ---
 title: "管理你的安装"
 source: docs/getting-started/operations.md
-source_hash: c9df6b31ca54f1601aad360c3c3f8039ef35eb7bd4f6084b8495a18c131dcbfb
+source_hash: ca3c732922173605cc3ab78e6afce774cc910af67b9547bd7e3c9dfde7f5ce66
 ---
 
 安装运维人员负责 Core 主机、存储和可用性。节点主机运行各自的服务；参阅[节点](nodes.md)。设置见[配置参考](../configuration.md)。
@@ -164,24 +164,19 @@ cd && rm -rf ~/.oac/core
 
 迁移到新版本时，安装到全新的空目录，使用独立数据库、Core 密钥和节点，并从新 Web 添加节点。保留旧安装、数据和节点，直到工作完成。节点运行添加它的控制台所提供的程序，不原地升级；Core 仅接受使用自身节点协议的节点。
 
-`install.sh` 拒绝非空目录。首次启动失败时，它删除自己创建的目录，同一命令可以再运行。已经启动的安装会保留。
+中断的安装可以[沿用已保存配置继续](install.md#install)。与本安装无关的非空目录会被拒绝。
 
-会修改状态的 `oac` 命令持有 `.oac.lock`。其他命令持有锁时，等待其结束后重试。不要删除 `.oac.lock` 来绕过忙碌安装。
+安装程序和修改状态的 `oac` 命令持有 `.oac.lock`。安装程序准备目录时还持有同级的 `<install-dir>.install.lock`。其他命令持有锁时，等待其结束后重试。不要删除锁文件来绕过忙碌安装。
 
 ## 问题排查 {#troubleshooting}
 
 | 症状 | 原因与解决方法 |
 | --- | --- |
-| `Core installation requires Linux amd64 with Docker access` | 使用 Linux amd64 和有 Docker 访问权限的账号；支持 root 和普通用户 |
-| `Installation failed: inspect prerequisites and private deployment files` | 前置条件失败但未单独报告，通常是 Docker：检查此用户能运行 `docker info` 和 `docker compose version` |
-| `Docker Compose 2.26.0 or newer is required …` | 更新 Docker Compose 插件 |
 | `Port N is already in use.` | 其他程序占用该端口。停止它，或另选 `--web-port`。安装程序不会改用其他端口 |
-| `Installation directory is not empty` | 使用空的 `--install-dir`，或先[卸载](#uninstall)现有安装 |
+| `Directory is not a complete Core installation` | 保留目录内容，选择另一个 `--install-dir` |
 | `configuration check failed; no service was changed` | `.env` 中有 Core 拒绝的值。消息只包含变量名。修正 `.env` 后再次运行 `oac apply` |
 | `Docker Compose 2.26 or newer is required` | 更新 Docker Compose 插件 |
-| `The services did not start: …` | 新安装首次启动失败，安装程序[删除了所创建内容](install.md#install)。上方输出 Compose 或 Core 错误；修复后执行同一命令 |
-| `Removal did not finish. Left: …` | 首次启动失败后没能删干净。执行输出的命令移除残留，或修复原因后重新执行原命令 |
-| `This installation did not finish installing …` | 安装程序在报告服务运行前停止。重新执行安装命令，[清理残留](install.md#install)后重新安装，或[卸载](#uninstall) |
+| `Installation and data retained at …` | 查看上方服务日志，修复原因，再[继续安装](install.md#install)；不要删除数据 |
 | Web 返回 403 `Forbidden` | 浏览器主机名不是 `OAC_PUBLIC_URL`。打开该源地址；反向代理必须传递原始 Host |
 | Web 显示 Core 不可用（502） | Core 停止或失败：先 `docker compose ps`，再查看 Core 日志 |
 | 创建 Session 返回 400 `model_provider_required` | 缺少模型提供商：为 Harness 设置[默认模型](../configuration.md#default-models)，或显式提供 |
diff --git a/docs/zh/getting-started/self-hosted.md b/docs/zh/getting-started/self-hosted.md
index 010d57197..055fcb883 100644
--- a/docs/zh/getting-started/self-hosted.md
+++ b/docs/zh/getting-started/self-hosted.md
@@ -1,7 +1,7 @@
 ---
 title: "自托管执行器"
 source: docs/getting-started/self-hosted.md
-source_hash: 93c50f38d5f44bea3290e32359aeea3c5d196df4717e6c2a6893dc1242d13d25
+source_hash: 19506e4bab34b802e5c3c8a1818bcb5c8397aa91fdf9ace512b5aaeb99341b3a
 ---
 
 `self_hosted` Session 在应用拥有的机器上运行：工作站、虚拟机或你管理的沙箱。应用通过 `/v1` 创建 Session，并获得安装 `oac-daemon`、启动它并连接 Core 的命令。Web 在 Session 页面展示同一命令；Web 是可选的。Core 不创建、停止或回收这台机器。
@@ -27,7 +27,7 @@ Session 的模型提供商与其他 Session 一样解析，因此当 Session 及
 - Session 的软件包需要时，安装 Python 和 pip；
 - 环境设置所需的系统软件包。守护进程不运行 apt、sudo 或其他提权命令，请通过主机的常规管理方式安装。
 
-不需要管理员权限或 Docker。Unix 下载命令还使用 `curl`、`tar`、`gzip`、SHA-256 工具和系统文件锁命令（Linux 为 `flock`，macOS 为 `lockf`）。
+不需要管理员权限或 Docker。Unix 下载命令还使用 `curl`、`tar`、`gzip`、SHA-256 工具和系统文件锁命令（Linux 为 `flock`，macOS 为 `lockf`）。Windows 需要系统自带的 `tar.exe`，命令会在下载前检查。Runtime 主目录必须允许执行文件。如果 Unix 挂载点设为 `noexec`，请先用 `OAC_RUNTIME_HOME` 指定另一个允许执行的绝对目录，再运行命令。
 
 ## 连接机器 {#connect-a-machine}
 
diff --git a/docs/zh/maintainers.md b/docs/zh/maintainers.md
index ca436d3b6..0327a7a09 100644
--- a/docs/zh/maintainers.md
+++ b/docs/zh/maintainers.md
@@ -1,7 +1,7 @@
 ---
 title: "构建并发布 OpenAgentCore"
 source: docs/maintainers.md
-source_hash: a7a566c288258949acdded98e14dc14e102faaf453393bcfd95d43a25bef652d
+source_hash: 9c10ea0accfa7e2efe74e40e65e498f108d03fe4b09d7f78ea77ca78655aa2be
 ---
 
 本指南面向负责构建和发布 OpenAgentCore 的维护者。要安装 Core 和 Web，请使用 [安装指南](getting-started/install.md)。安装器代码遵循的规则见 [部署](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/README.md) 和 [节点安装器](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md)；必需检查见 [CONTRIBUTING](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#required-checks)。
@@ -15,7 +15,7 @@ source_hash: a7a566c288258949acdded98e14dc14e102faaf453393bcfd95d43a25bef652d
 ```sh
 bash scripts/prepare-release-runtimes.sh
 inputs="$HOME/.oac/build/release-inputs/inputs.json"
-export AGENTS_RUNTIME_CODEX_PACKAGE="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["codex"])' "$inputs")"
+export CODEX_CLI_DIR="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["codex"])' "$inputs")"
 export MCODE_HARNESS_BUILD_DIR="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["mcode"])' "$inputs")"
 export CORE_DISTRIBUTION_RELEASE_BASE_URL=https://github.com/MiniMax-AI/OpenAgentCore/releases/download/v1.2.3
 make build-core-distribution
@@ -27,7 +27,7 @@ make build-core-distribution
 | --- | --- |
 | `CORE_DISTRIBUTION_RELEASE_BASE_URL` | 用于提供生成的资源文件名的带版本 HTTPS 目录（绝不能使用 `latest`）。除非 `CORE_DISTRIBUTION_OFFLINE=1`，否则为必填项 |
 | `CORE_DISTRIBUTION_OFFLINE` | 设为 `1` 时还会构建离线归档 |
-| `AGENTS_RUNTIME_CODEX_PACKAGE`、`MCODE_HARNESS_BUILD_DIR` | `prepare-release-runtimes.sh` 固定的 Runtime 输入 |
+| `CODEX_CLI_DIR`、`MCODE_HARNESS_BUILD_DIR` | `prepare-release-runtimes.sh` 固定的 Runtime 输入 |
 | `CORE_DISTRIBUTION_CODEX_IMAGE`、`CORE_DISTRIBUTION_CLAUDE_IMAGE`、`CORE_DISTRIBUTION_MCODE_IMAGE` | 使用现有 Harness 镜像，而不是构建这些镜像；值必须是以不可变 `sha256:` 镜像 ID 表示的现有镜像。三个变量必须全部设置或全部不设置；每个镜像都必须包含由该提交构建的守护进程 |
 | `OAC_NATIVE_INSTALLER_BUILD_DIR` | 原生安装器目录；请参阅[原生安装器](#native-installers) |
 | `CORE_DISTRIBUTION_BUILD_DIR` | `~/.oac` 下的输出目录。默认值：`~/.oac/build/core-distribution` |
@@ -61,9 +61,9 @@ export OAC_NATIVE_INSTALLER_BUILD_DIR=OUTPUT_DIR
 **Codex Runtime 镜像。** 在 `~/.oac` 下解压官方 npm 包 `@openai/codex@0.153.4-linux-x64`（例如使用 `npm pack --ignore-scripts` 和 `tar -xzf`），然后执行：
 
 ```sh
-export AGENTS_RUNTIME_CODEX_PACKAGE=/absolute/path/to/package
-make build-agents-runtime
-docker build --platform linux/amd64 -t oac-runtime:codex "${OAC_DEV_HOME:-$HOME/.oac}/build/agents-runtime"
+export CODEX_CLI_DIR=/absolute/path/to/package
+make build-codex-runtime
+docker build --platform linux/amd64 -t oac-runtime:codex "${OAC_DEV_HOME:-$HOME/.oac}/build/codex-runtime"
 ```
 
 该脚本会检查软件包版本，为 Linux amd64 构建 `oac-daemon`，并准备一个仅包含守护进程、未修改的 `codex` 和 `codex-code-mode-host` 可执行文件、相关资源和 `services/core/deploy/codex/Dockerfile` 的上下文。Runtime 镜像不包含 `codex-code-mode-host`，只有 agent-host 镜像安装它。
@@ -95,7 +95,7 @@ docker build --platform linux/amd64 -t oac-runtime:mcode "${OAC_DEV_HOME:-$HOME/
 **Agent-host 和沙箱镜像。** 使用上述三个 Harness 镜像的输入：
 
 ```sh
-export AGENTS_RUNTIME_CODEX_PACKAGE=/absolute/path/to/package MCODE_HARNESS_BUILD_DIR=/absolute/mcode-harness
+export CODEX_CLI_DIR=/absolute/path/to/package MCODE_HARNESS_BUILD_DIR=/absolute/mcode-harness
 bash scripts/build-agent-host-images.sh
 ```
 
diff --git a/docs/zh/runtime-protocol.md b/docs/zh/runtime-protocol.md
index d3d75d540..2def15eb2 100644
--- a/docs/zh/runtime-protocol.md
+++ b/docs/zh/runtime-protocol.md
@@ -1,7 +1,7 @@
 ---
 title: "Core–Runtime 协议"
 source: docs/runtime-protocol.md
-source_hash: 6410b49f1b818f05409c87905301722ce0c8d60fc0073c0e554309288f4cdafd
+source_hash: 9ef338b2da6b53a2d5290527ebff5bb119c8c85f4fdeef8dd2cf8bde3ec16e0d
 ---
 
 此协议在 Runtime daemon 获取机器凭据后连接 Core 与 daemon，定义 daemon 连接上消息的含义和顺序。wire 类型、限制和验证器仅在 [`internal/agentdaemon/proto`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/internal/agentdaemon/proto) 中定义一次；Core 的 [gateway](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/runtimegateway) 与参考 Runtime 的 [dispatcher](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/apps/daemon/internal/dispatch) 都使用它们，因此无需同步第二套 payload schema。签发凭据和打开连接的 HTTP 路由见[机器连接 API](../../contracts/agents-api/zh/machine-api.md)。
@@ -61,15 +61,16 @@ wire 上每个字段都是 JSON boolean，所有字段都必须出现，包括 `
 | --- | --- |
 | `model`, `system_prompt`, `model_provider`, `harness_config` | 来自 Session 冻结的配置：Agent 的 model 和 instructions、Session 的 provider bundle，以及[原生模型参数](../../contracts/agents-api/zh/model-execution.md#native-model-parameters)。Harness 在产生任何原生效果之前验证它们 |
 | `execution_controls` | 始终设置：web search 为 `disabled`、解析后的 text verbosity（默认 `medium`）、明确禁用 programmatic tool calling，以及任何 `json_schema` 输出格式。原生选项名称由 adapter 负责 |
-| `observe_tool_observations` | 始终设置。tool-call frame 随后携带与 engine 无关的 `observation` |
 | `observe_messages` | Runtime 声明 `message_items` 时设置。文本 delta 随后携带原生 item ID，`output_message` frame 报告消息开始、完成、phase 和完成文本 |
 | `observe_subagent_identities`, `disable_subagents` | 根据 Agent 的 `multi_agent.enabled` 设置 |
 | `disable_execution_environment` | Environment 类型为 `none` 时设置 |
 | `local_environment` | 为 `openai_hosted` 和 `self_hosted` 设置，包含精确的 Environment 绑定。请求不携带 working directory；Runtime 按自身绑定检查 `workspace_directory` |
-| `strict_resume`, `require_existing_native_session` | 始终严格；需要恢复原生 Session 时设置第二项 |
+| `require_existing_native_session` | 需要恢复原生 Session 时设置 |
 | `prompt_steer` 上的 `durable_receipt` | Core 交付的每个活动输入都设置 |
 
-未携带显式启用项的请求保留未启用时的 frame 和字段。
+执行配置必须且只能包含 `local_environment` 和 `disable_execution_environment` 之一；两者都缺失或同时存在时，`execution_prepare` 以 `unsupported_configuration` 拒绝。
+
+未携带显式启用项的请求保留未启用时的 frame 和字段。只要 adapter 映射了原生工具，`tool_call` frame 就携带与 engine 无关的 `observation`。
 
 ## Envelope 与身份 {#envelope-and-identity}
 
@@ -153,7 +154,7 @@ Core 通过 `prompt_steer` 交付活动输入，设置 `durable_receipt: true`
 | `written` 确认 | Core 从交付开始最多等待 30 秒取得 `written`；否则输入结果未知 |
 | 回执发送 | 每次发送回执都有独立的 5 秒预算，并感知 shutdown |
 | 原生接受 | `accepted` 在 Turn 生命周期内到达，不自动重新交付 |
-| Done | `done` 前，Runtime 最多等待 15 秒（写入与发送预算），等待正在处理的输入 |
+| Done | Runtime 在原生 Turn 结算完成、且正在处理的输入的回执发送结束后才发送 `done`；该输入受原生写入与回执发送预算限制 |
 
 `written` 和发送失败都不会推进 Core 的 input cursor。取消发出后，即使输入先变为未知，终结结果也由取消回执负责；15 秒内没有取消确认时，Core 记录 `cancel_unconfirmed`。未发出 `done` 时，取消回执携带已停止 Turn 的已确认 continuity snapshot。
 
@@ -213,7 +214,7 @@ Core 在 Worker 的 Session 调度预约上运行空闲目录读取，活动执
 
 ## MCP 连接权限 {#mcp-connection-authority}
 
-执行配置中每个公开 `MCPHTTPServer` 都携带明确的 `connection_origin`；值缺失或未知时拒绝，不选择默认值，Core 在 dispatch 前冻结公开默认值。Runtime 在选择 factory 前用公共 validator 验证 origin，并将公开和已安装 MCP 解析为临时 effective binding。[Environment 契约](../../contracts/agents-api/zh/environments.md#public-mcp-connection-origin)负责支持的组合、原生限制和故障所有权。
+`execution_prepare` 配置中每个公开 `MCPHTTPServer` 都携带明确的 `connection_origin`；值缺失或未知时拒绝，不选择默认值，Core 在 dispatch 前冻结公开默认值。Runtime 在选择 factory 前用公共 validator 验证 origin，并将公开和已安装 MCP 解析为临时 effective binding。[Environment 契约](../../contracts/agents-api/zh/environments.md#public-mcp-connection-origin)负责支持的组合、原生限制和故障所有权。
 
 ## 契约验证 {#contract-verification}
 
diff --git a/internal/agentdaemon/proto/outbound.go b/internal/agentdaemon/proto/outbound.go
index f4bc5774e..8144051c1 100644
--- a/internal/agentdaemon/proto/outbound.go
+++ b/internal/agentdaemon/proto/outbound.go
@@ -24,22 +24,16 @@ const (
 	TypePromptForUserChoiceDecision = "prompt_for_user_choice_decision"
 )
 
-// PromptRequestPayload is the daemon-side view of a connector.PromptInput,
-// trimmed to fields a daemon agent actually needs. Kept separate from
-// PromptInput so future agent implementations can evolve the wire shape
-// without touching the connector surface.
+// PromptRequestPayload is the execution configuration that execution_prepare
+// carries. execution_start supplies the Run identity and input.
 type PromptRequestPayload struct {
 	MaxConcurrentSubagents *int `json:"max_concurrent_subagents,omitempty"`
 	// AgentKind selects which agent implementation the daemon
 	// dispatches to.
 	AgentKind string `json:"agent_kind"`
 
-	// ConversationID lets the daemon scope per-conversation state
-	// (Claude --resume session id, scratch dir).
-	ConversationID string `json:"conversation_id"`
-
-	// RunID is the ID of the Core Turn this prompt executes; mirrored
-	// back on every upstream frame via Envelope.ID.
+	// RunID and Input are empty in an execution_prepare configuration.
+	// Adapters set them from execution_start when they start a Turn.
 	RunID string `json:"run_id"`
 
 	// Input preserves ordered user messages and content.
@@ -66,20 +60,15 @@ type PromptRequestPayload struct {
 
 	// AgentStateKey is the stable daemon-side state directory key.
 	// WorkspaceReadOnly prepares temporary native state that cannot start a Run.
-	WorkspaceReadOnly bool   `json:"workspace_read_only,omitempty"`
-	AgentStateKey     string `json:"agent_state_key,omitempty"`
-	// ReleaseOnCompletion closes the native writer before acknowledging Done.
-	ReleaseOnCompletion          bool `json:"release_on_completion,omitempty"`
-	StrictResume                 bool `json:"strict_resume,omitempty"`
-	RequireExistingNativeSession bool `json:"require_existing_native_session,omitempty"`
-	ObserveMessages              bool `json:"observe_messages,omitempty"`
-
-	ObserveToolObservations     bool           `json:"observe_tool_observations,omitempty"`
-	ObserveSubagentIdentities   bool           `json:"observe_subagent_identities,omitempty"`
-	FunctionTools               []FunctionTool `json:"function_tools,omitempty"`
-	ToolSearch                  bool           `json:"tool_search,omitempty"`
-	DisableExecutionEnvironment bool           `json:"disable_execution_environment,omitempty"`
-	DisableSubagents            bool           `json:"disable_subagents,omitempty"`
+	WorkspaceReadOnly            bool           `json:"workspace_read_only,omitempty"`
+	AgentStateKey                string         `json:"agent_state_key,omitempty"`
+	RequireExistingNativeSession bool           `json:"require_existing_native_session,omitempty"`
+	ObserveMessages              bool           `json:"observe_messages,omitempty"`
+	ObserveSubagentIdentities    bool           `json:"observe_subagent_identities,omitempty"`
+	FunctionTools                []FunctionTool `json:"function_tools,omitempty"`
+	ToolSearch                   bool           `json:"tool_search,omitempty"`
+	DisableExecutionEnvironment  bool           `json:"disable_execution_environment,omitempty"`
+	DisableSubagents             bool           `json:"disable_subagents,omitempty"`
 
 	// Assignment is the assignment the request runs under: Core sends its
 	// frames under it, and the Runtime records the Envelope.Assignment it
diff --git a/internal/agentdaemon/proto/preparation.go b/internal/agentdaemon/proto/preparation.go
index e6a0d634b..99c1dba13 100644
--- a/internal/agentdaemon/proto/preparation.go
+++ b/internal/agentdaemon/proto/preparation.go
@@ -10,8 +10,8 @@ const (
 )
 
 // ExecutionPreparePayload reuses execution configuration without accepting
-// input. SessionID identifies the immutable configuration owner;
-// each request reserves a separate Turn admission on its Runtime Executor.
+// input. SessionID identifies the immutable configuration owner; each request
+// reserves a separate Turn admission on its Runtime Executor.
 type ExecutionPreparePayload struct {
 	SessionID     string               `json:"session_id"`
 	Configuration PromptRequestPayload `json:"configuration"`
diff --git a/internal/agentdaemon/proto/prototest/wire.go b/internal/agentdaemon/proto/prototest/wire.go
index 001fe6910..cfc5ed041 100644
--- a/internal/agentdaemon/proto/prototest/wire.go
+++ b/internal/agentdaemon/proto/prototest/wire.go
@@ -116,7 +116,7 @@ func WireScenarios() []WireScenario {
 	}
 	prepare := send(Core, proto.TypeExecutionPrepare, PreparationID, proto.ExecutionPreparePayload{
 		SessionID:     SessionID,
-		Configuration: WithModel(proto.PromptRequestPayload{AgentKind: HarnessKind, AgentStateKey: StateKey, StrictResume: true, DisableExecutionEnvironment: true}),
+		Configuration: WithModel(proto.PromptRequestPayload{AgentKind: HarnessKind, AgentStateKey: StateKey, DisableExecutionEnvironment: true}),
 	})
 	// Core binds the Session before its first Session-scoped frame.
 	bind := []Step{
diff --git a/internal/agentdaemon/proto/workspace_read_preparation.go b/internal/agentdaemon/proto/workspace_read_preparation.go
index d07702724..0ee0898d7 100644
--- a/internal/agentdaemon/proto/workspace_read_preparation.go
+++ b/internal/agentdaemon/proto/workspace_read_preparation.go
@@ -4,11 +4,10 @@ package proto
 // The native adapter supplies temporary state; this request cannot resume or start.
 func ValidWorkspaceReadPreparation(r PromptRequestPayload) bool {
 	return r.WorkspaceReadOnly && r.LocalEnvironment != nil && r.AgentStateKey != "" &&
-		r.StrictResume && r.ReleaseOnCompletion && r.RunID == "" && len(r.Input) == 0 &&
-		r.ConversationID == "" && r.AgentSessionID == "" &&
+		r.RunID == "" && len(r.Input) == 0 && r.AgentSessionID == "" &&
 		!r.RequireExistingNativeSession && !r.DisableExecutionEnvironment &&
 		r.Model == "" && r.SystemPrompt == "" && r.ModelProvider == nil && len(r.HarnessConfig) == 0 &&
 		r.ExecutionControls == nil && r.MCPHTTPServers == nil &&
 		len(r.FunctionTools) == 0 && !r.ToolSearch && !r.ObserveMessages &&
-		!r.ObserveToolObservations && !r.ObserveSubagentIdentities
+		!r.ObserveSubagentIdentities
 }
diff --git a/packages/claude-sdk-adapter/README.md b/packages/claude-sdk-adapter/README.md
index 3d449870a..329b832b9 100644
--- a/packages/claude-sdk-adapter/README.md
+++ b/packages/claude-sdk-adapter/README.md
@@ -48,7 +48,7 @@ Directory requests are bounded to 8 KiB and 1,000 immediate entries, with explic
 
 ### Command observations
 
-With `ObserveToolObservations`, private workspace execution requires the packaged `workspace_command_observations` feature and emits the neutral command snapshots. Match root, current-query native Bash call/result identities after input; ignore historical replay, synthetic and child work. Preserve exact command text and the native per-call textual result, including native rendering or truncation. This is final native output, not incremental stdout/stderr or reconstructed interleaving. Native error results are failed; unambiguous structured interruption is incomplete. Missing results close as incomplete after the observation drain; query cancellation does not overwrite an already observed native failure. Do not infer an exit code from rendered text or supply cwd/duration without qualified native fields. Preparation alone emits no command. Cold continuation must not reissue historical observations. This private translation does not enable public workspace admission, Read/Edit Items or Files ownership.
+Private workspace execution requires the packaged `workspace_command_observations` feature and emits the neutral command snapshots. Match root, current-query native Bash call/result identities after input; ignore historical replay, synthetic and child work. Preserve exact command text and the native per-call textual result, including native rendering or truncation. This is final native output, not incremental stdout/stderr or reconstructed interleaving. Native error results are failed; unambiguous structured interruption is incomplete. Missing results close as incomplete after the observation drain; query cancellation does not overwrite an already observed native failure. Do not infer an exit code from rendered text or supply cwd/duration without qualified native fields. Preparation alone emits no command. Cold continuation must not reissue historical observations. This private translation does not enable public workspace admission, Read/Edit Items or Files ownership.
 
 ### HTTP MCP
 
@@ -66,7 +66,7 @@ Workspace deferred-function discovery uses native ToolSearch alongside the norma
 
 For unmanaged bootstrap, daemon `connect` optionally registers this factory as `claude_sdk` when the operator sets `OAC_RUNTIME_CLAUDE_SDK_ENTRYPOINT` to the absolute packaged `dist/main.js`. `OAC_RUNTIME_CLAUDE_SDK_NODE` selects Node (default: `node` on PATH). Discovery resolves Node once and checks that exact configuration before connecting; the SDK's bounded runtime check is independent of CLI version probes. A ready SDK alone is sufficient to start the daemon. No configuration means no SDK probe or descriptor; failed readiness reports an unavailable descriptor with a rejecting factory. Runtime checks establish local readiness, not provider authentication. Installed daemons use `start` and their verified installation manifest for adapter selection and activation; ambient activation variables cannot extend that selection. See [the native installation contract](../../deploy/README.md#native-daemon-installer).
 
-SDK state lives under `paths.ProfileDir(profile)/runtime/claude-sdk`, independently of the replaceable runtime bundle. Both the entrypoint and managed state root must be absolute. Background re-execution inherits operator configuration; it does not persist provider credentials in device profiles. It accepts no caller-supplied environment variables or business write authority.
+SDK state lives under `paths.ProfileDir(profile)/runtime/claude-sdk`, independently of the replaceable runtime bundle. Both the entrypoint and managed state root must be absolute. Background re-execution inherits operator configuration; it does not persist provider credentials in credential profiles. It accepts no caller-supplied environment variables or business write authority.
 
 ### Descriptor and execution profile
 
@@ -78,7 +78,7 @@ The `none` profile accepts only text, explicit model/system instructions, manage
 
 ### Function server and results
 
-The internal SDK function-server helper uses the maintained MCP server's public request handlers and standard Tool/CallToolResult types. It snapshots definitions and forwards JSON Schema without a JSON Schema-to-Zod conversion; supplied tools are always loaded. Native call identity comes from the pinned harness's `claudecode/toolUseId` MCP metadata, independently of request IDs, names or arrival order. Missing identities and undeclared tools fail before invoking the host. Return content/error fields unchanged over MCP and forward its per-request abort signal. The private Go factory connects declared functions through this helper and reuses the daemon function-call/result interface and opt-in neutral observations. The native function-server registry must contain exactly those functions. SDK allowlisting admits only these host callbacks; the host still owns result decisions and any business permission checks. It grants no runtime-token business authority.
+The internal SDK function-server helper uses the maintained MCP server's public request handlers and standard Tool/CallToolResult types. It snapshots definitions and forwards JSON Schema without a JSON Schema-to-Zod conversion; supplied tools are always loaded. Native call identity comes from the pinned harness's `claudecode/toolUseId` MCP metadata, independently of request IDs, names or arrival order. Missing identities and undeclared tools fail before invoking the host. Return content/error fields unchanged over MCP and forward its per-request abort signal. The private Go factory connects declared functions through this helper and reuses the daemon function-call/result interface and neutral observations. The native function-server registry must contain exactly those functions. SDK allowlisting admits only these host callbacks; the host still owns result decisions and any business permission checks. It grants no runtime-token business authority.
 
 Function results remain pending after stdin/MCP delivery. A matching live, root native user tool_result confirms application only when its Session/call identity, error flag and ordered content match the submission. Text matches exactly; each submitted image position must remain a valid native base64 image. Native resizing or re-encoding may change image bytes. This acknowledges incorporation into native history, not byte/pixel fidelity or completed provider consumption. Public Items retain the original caller content; real image-dependent model responses separately qualify usability. Ignore replayed, synthetic and subagent messages. Native error text joins the submitted text parts with newlines; neutral observations retain their original order and separate failure status. Missing/mismatched receipts fail the execution; do not replay unknown delivery. Result submission waits at most ten seconds for a receipt and cancels uncertain execution on timeout. Invalid or unsupported image results fail before consuming a pending call. Function state belongs to one live Run and ends with it; the router owns receipt retry/conflict handling. This does not establish crash recovery or exactly-once effects.
 
diff --git a/packages/claude-sdk-adapter/src/mcp.ts b/packages/claude-sdk-adapter/src/mcp.ts
index 453122181..14270651c 100644
--- a/packages/claude-sdk-adapter/src/mcp.ts
+++ b/packages/claude-sdk-adapter/src/mcp.ts
@@ -80,7 +80,7 @@ export class MCPProfile {
     for (const server of declarations) {
       const prefix = `mcp__${server.server_label}__`;
       if ("command" in server) {
-        this.servers[server.server_label] = { type: "stdio", command: server.command, args: [...server.args], env: {}, alwaysLoad: true };
+        this.servers[server.server_label] = { type: "stdio", command: server.command, args: [...(server.args ?? [])], env: {}, alwaysLoad: true };
       } else {
         const reference = server.bearer_token_env_var;
         if (reference && !process.env[reference]) throw new Error("missing MCP credential environment");
diff --git a/packages/claude-sdk-adapter/src/mcp_environment.ts b/packages/claude-sdk-adapter/src/mcp_environment.ts
index b949b6e7c..8597eb1fe 100644
--- a/packages/claude-sdk-adapter/src/mcp_environment.ts
+++ b/packages/claude-sdk-adapter/src/mcp_environment.ts
@@ -4,12 +4,14 @@ import { parseHTTPServers, type HTTPServer } from "./mcp.js";
 export type StdioServer = {
   server_label: string;
   command: string;
-  args: string[];
+  // Absent for an agent-host view's alias, which runs without arguments.
+  args?: string[];
   allowed_tools: null;
 };
 export type EnvironmentMCPServer = HTTPServer | StdioServer;
 
 // The Runtime launcher resolves installed package identities and their commands.
+// In an agent-host view, the process broker resolves the alias instead.
 export function parseEnvironmentMCP(value: unknown): EnvironmentMCPServer[] | undefined {
   if (value === undefined) return undefined;
   if (!Array.isArray(value)) throw new Error("invalid_request");
@@ -19,11 +21,11 @@ export function parseEnvironmentMCP(value: unknown): EnvironmentMCPServer[] | un
     if ("command" in server) {
         if (Object.keys(server).some(key => !["server_label", "command", "args", "allowed_tools"].includes(key)) ||
             typeof server.server_label !== "string" || !/^[a-zA-Z0-9_-]+$/.test(server.server_label) || server.server_label === "functions" || server.allowed_tools !== null ||
-            typeof server.command !== "string" || !isAbsolute(server.command) || normalize(server.command) !== server.command ||
-            !Array.isArray(server.args) || server.args.length !== 4 || server.args[0] !== "runtime-mcp-exec" ||
+            typeof server.command !== "string" || !isAbsolute(server.command) || normalize(server.command) !== server.command || /[\x00-\x1f\x7f]/.test(server.command) ||
+            ("args" in server && (!Array.isArray(server.args) || server.args.length !== 4 || server.args[0] !== "runtime-mcp-exec" ||
             typeof server.args[1] !== "string" || !isAbsolute(server.args[1]) || normalize(server.args[1]) !== server.args[1] || server.args[1] === parse(server.args[1]).root ||
             typeof server.args[2] !== "string" || !server.args[2] || /[\\]/.test(server.args[2]) || server.args[2].split("/").some((part: string) => !part || part === "." || part === "..") ||
-            server.args[3] !== server.server_label || [server.command, ...server.args].some((part: string) => /[\x00-\x1f\x7f]/.test(part))) throw new Error("invalid_request");
+            server.args[3] !== server.server_label || server.args.some((part: string) => /[\x00-\x1f\x7f]/.test(part))))) throw new Error("invalid_request");
         labels.add(server.server_label);
 
     } else {
diff --git a/packages/claude-sdk-adapter/tests/mcp_workspace.test.mjs b/packages/claude-sdk-adapter/tests/mcp_workspace.test.mjs
index 14bb1e6d1..1d9563c2d 100644
--- a/packages/claude-sdk-adapter/tests/mcp_workspace.test.mjs
+++ b/packages/claude-sdk-adapter/tests/mcp_workspace.test.mjs
@@ -35,7 +35,11 @@ test("installed MCP projection uses the common Runtime launcher", t => {
     output_format: { type: "json_schema", schema: { type: "object" } } })), /invalid_request/);
   assert.equal(immediateInput(request), undefined);
   assert.deepEqual(parseEnvironmentMCP([stdio]), [stdio]);
-  for (const value of [[stdio, stdio], [{ ...stdio, command: "relative" }], [{ ...stdio, env: { TOKEN: "secret" } }],
+  // An agent-host view's alias runs without arguments.
+  const alias = { server_label: "installed", command: "/.oac/bin/oac-mcp-0", allowed_tools: null };
+  assert.deepEqual(parseEnvironmentMCP([alias]), [alias]);
+  assert.deepEqual(new MCPProfile([alias], []).servers.installed.args, []);
+  for (const value of [[stdio, stdio], [{ ...stdio, command: "relative" }], [{ ...stdio, command: "/bin/line\n" }], [{ ...stdio, env: { TOKEN: "secret" } }],
     [{ ...stdio, args: ["-c", "untrusted"] }], [{ ...stdio, allowed_tools: ["*"] }],
     [{ ...stdio, server_url: "https://example.invalid" }], [{ ...stdio, args: [...stdio.args.slice(0, 2), "../escape", "installed"] }]]) {
     assert.throws(() => parseEnvironmentMCP(value), /invalid_request/);
diff --git a/scripts/build-agent-host-images.sh b/scripts/build-agent-host-images.sh
index 1d65c3736..9c35bd12b 100755
--- a/scripts/build-agent-host-images.sh
+++ b/scripts/build-agent-host-images.sh
@@ -13,7 +13,7 @@ mkdir -p "$runtime_root/cache/oac-runtime-builds"
 context="$(mktemp -d "$runtime_root/cache/oac-runtime-builds/agent-host.XXXXXX")"
 trap 'rm -rf "$context"' EXIT
 # The Runtime image builders check their pinned inputs and prepare each Harness's payload.
-AGENTS_RUNTIME_BUILD_DIR="$context/codex" bash "$repo_root/scripts/build-agents-runtime.sh"
+AGENTS_RUNTIME_BUILD_DIR="$context/codex" bash "$repo_root/scripts/build-codex-runtime.sh"
 AGENTS_RUNTIME_BUILD_DIR="$context/claude" bash "$repo_root/scripts/build-claude-runtime.sh"
 AGENTS_RUNTIME_BUILD_DIR="$context/mcode" bash "$repo_root/scripts/build-mcode-runtime.sh"
 (
diff --git a/scripts/build-agents-runtime.sh b/scripts/build-codex-runtime.sh
similarity index 77%
rename from scripts/build-agents-runtime.sh
rename to scripts/build-codex-runtime.sh
index f3314c206..d2dd85eb0 100755
--- a/scripts/build-agents-runtime.sh
+++ b/scripts/build-codex-runtime.sh
@@ -3,9 +3,9 @@ set -euo pipefail
 
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 runtime_root="${OAC_DEV_HOME:-$HOME/.oac}"
-output_dir="${AGENTS_RUNTIME_BUILD_DIR:-$runtime_root/build/agents-runtime}"
+output_dir="${AGENTS_RUNTIME_BUILD_DIR:-$runtime_root/build/codex-runtime}"
 # Extract the official @openai/codex@0.153.4-linux-x64 npm package here.
-package_dir="${AGENTS_RUNTIME_CODEX_PACKAGE:?Set AGENTS_RUNTIME_CODEX_PACKAGE to the extracted pinned platform package}"
+package_dir="${CODEX_CLI_DIR:?Set CODEX_CLI_DIR to the extracted pinned platform package}"
 for directory in "$runtime_root" "$output_dir" "$package_dir"; do
   if [[ "$directory" != /* ]]; then
     printf 'Runtime build directories must be absolute: %s\n' "$directory" >&2
@@ -23,7 +23,7 @@ for executable in "$native_dir/bin/codex" "$native_dir/bin/codex-code-mode-host"
 done
 test -d "$native_dir/codex-resources"
 mkdir -p "$runtime_root/cache/oac-runtime-builds"
-context="$(mktemp -d "$runtime_root/cache/oac-runtime-builds/bundle.XXXXXX")"
+context="$(mktemp -d "$runtime_root/cache/oac-runtime-builds/codex.XXXXXX")"
 trap 'rm -rf "$context"' EXIT
 (
   cd "$repo_root"
@@ -36,5 +36,5 @@ cp "$repo_root/services/core/deploy/codex/Dockerfile" "$context/Dockerfile"
 # Preserve the previous bundle if compilation or validation failed.
 mkdir -p "$output_dir"
 cp -R "$context/." "$output_dir/"
-printf 'Runtime image context: %s\n' "$output_dir"
-printf 'Build with: docker build --platform linux/amd64 -t agents-runtime:local %q\n' "$output_dir"
+printf 'Codex Runtime image context: %s\n' "$output_dir"
+printf 'Build with: docker build --platform linux/amd64 -t oac-runtime:codex %q\n' "$output_dir"
diff --git a/scripts/build-core-distribution.sh b/scripts/build-core-distribution.sh
index bc661b251..e6635f418 100755
--- a/scripts/build-core-distribution.sh
+++ b/scripts/build-core-distribution.sh
@@ -160,14 +160,12 @@ if [[ -n "$codex_image$claude_image$mcode_image" ]]; then
     exit 1
   fi
 else
-  : "${AGENTS_RUNTIME_CODEX_PACKAGE:?Set the extracted pinned Codex Linux x64 package directory}"
+  : "${CODEX_CLI_DIR:?Set the extracted pinned Codex Linux x64 package directory}"
   : "${MCODE_HARNESS_BUILD_DIR:?Set the existing built pinned MiniMax Code companion directory}"
   export CLAUDE_SDK_BUILD_DIR="$stage/claude-sdk"
   scripts/build-claude-sdk-runtime.sh
   for harness in codex claude mcode; do
-    script="scripts/build-$harness-runtime.sh"
-    if [[ "$harness" == codex ]]; then script=scripts/build-agents-runtime.sh; fi
-    AGENTS_RUNTIME_BUILD_DIR="$stage/$harness" bash "$script"
+    AGENTS_RUNTIME_BUILD_DIR="$stage/$harness" bash "scripts/build-$harness-runtime.sh"
     build_image "$harness" "$stage/$harness"
   done
   codex_image="$(cat "$stage/codex.id")"
diff --git a/scripts/check-names.py b/scripts/check-names.py
index f2e3b00f0..d1fba0a4f 100644
--- a/scripts/check-names.py
+++ b/scripts/check-names.py
@@ -16,7 +16,7 @@
     r"(?i:parsar)|\bAGENTS_CORE_WEB_[A-Z][A-Z0-9_]*|\bAGENTS_API_[A-Z][A-Z0-9_]*|\bCORE_CONSOLE_[A-Z][A-Z0-9_]*"
     r"|\bagents-api(?:-(?:migrate|device|environment-key|e2b-provider|microsandbox-provider"
     r"|tool-root|codex-directory|codex-write|workspace-export|runtime-initialize|claude-shell-prefix))?\b"
-    r"|\bcore-console\b|\bagents-runtime-|(?i:\bAgents? Core(?: Web)?\b)|@agents-core-web/"
+    r"|\bcore-console\b|\bagents-runtime\b|(?i:\bAgents? Core(?: Web)?\b)|\bagents-core-web\b"
     r"|(?i:\bminimax-ai-dev\b)",
 )
 
diff --git a/scripts/ci_plan.py b/scripts/ci_plan.py
index b80f12d6b..d51bee462 100644
--- a/scripts/ci_plan.py
+++ b/scripts/ci_plan.py
@@ -80,7 +80,7 @@
     (("scripts/build-e2b-provider.sh",), (".sh",), ("backend", "api", "distribution")),
     (("scripts/build-claude", "scripts/check-claude", "scripts/build-mcode", "scripts/prepare-release-runtimes.sh"),
      SCRIPTS, ("harness", "native", "backend", "distribution")),
-    (("scripts/build-agents-runtime.sh",), (".sh",), ("backend", "native", "distribution")),
+    (("scripts/build-codex-runtime.sh",), (".sh",), ("backend", "native", "distribution")),
     (("scripts/build-agent-host-images.sh", "scripts/qualify-agent-host.sh"), (".sh",), ("distribution",)),
     (("scripts/generate-harness-catalog", "scripts/harness-catalog/", "scripts/openapi-split/", "scripts/patch-agents-openapi.py",
       "scripts/extract-agents-api-upstream.py"), SCRIPTS, JOBS),
diff --git a/scripts/name-allowlist.json b/scripts/name-allowlist.json
index ed449c8a4..a2e2a1432 100644
--- a/scripts/name-allowlist.json
+++ b/scripts/name-allowlist.json
@@ -224,6 +224,11 @@
     "regex": "\"agents-api-\"",
     "reason": "The test prepares executions through dispatch, whose admission requires the existing Core Session state-key prefix."
   },
+  {
+    "path": "services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go",
+    "regex": "\"agents-api-\"",
+    "reason": "Executor ownership validates the current Core and local-workspace AgentStateKey namespace; this change does not introduce an alternate identity or compatibility path."
+  },
   {
     "path": "apps/daemon/internal/localworkspace/capabilities.go",
     "regex": "\"agents-api-\"",
diff --git a/services/core/internal/api/handler_test.go b/services/core/internal/api/handler_test.go
index b768cb627..9539b46f1 100644
--- a/services/core/internal/api/handler_test.go
+++ b/services/core/internal/api/handler_test.go
@@ -149,6 +149,7 @@ func TestHTTPRejectsUntrustedOrUnsupportedRequests(t *testing.T) {
 		{"initial input", "Bearer test-api-key", "agents=v1", "/v1/agents/sessions", valid, 503},
 		{"stream unavailable", "Bearer test-api-key", "agents=v1", "/v1/agents/sessions", strings.Replace(valid, `"agent":`, `"stream":true,"agent":`, 1), 503},
 		{"unknown saved agent", "Bearer test-api-key", "agents=v1", "/v1/agents/sessions", strings.Replace(valid, `"agent":`, `"agent_id":"saved","agent":`, 1), 404},
+		{"saved agent without its model provider bundle", "Bearer test-api-key", "agents=v1", "/v1/agents/sessions", strings.Replace(valid, `"agent":`, `"agent_id":"saved","agent":`, 1), 500},
 		{"unknown agent option", "Bearer test-api-key", "agents=v1", "/v1/agents/sessions", strings.Replace(valid, `"model":`, `"tools":[{}],"model":`, 1), 400},
 		{"multiple objects", "Bearer test-api-key", "agents=v1", "/v1/agents/sessions", valid + `{}`, 400},
 		{"null body as empty object", "Bearer test-api-key", "agents=v1", "/v1/agents/sessions", `null`, 400},
@@ -158,10 +159,15 @@ func TestHTTPRejectsUntrustedOrUnsupportedRequests(t *testing.T) {
 			unavailable := 0
 			h, s, _ := testHandler(t, func(_ *Dependencies, f *testFakes) {
 				f.metrics.recordUnavailable = func() { unavailable++ }
-				if test.name == "unknown saved agent" {
+				switch test.name {
+				case "unknown saved agent":
 					f.agentsReader.getAgentWithModelProvider = func(context.Context, string, string) (agents.Agent, *v1.ModelProviderInput, error) {
 						return agents.Agent{}, nil, agents.ErrNotFound
 					}
+				case "saved agent without its model provider bundle":
+					f.agentsReader.getAgentWithModelProvider = func(context.Context, string, string) (agents.Agent, *v1.ModelProviderInput, error) {
+						return agents.Agent{ID: "saved", Configuration: json.RawMessage(`{"model":"example","x_agents_core":{"model_provider":{"protocol":"responses","base_url":"https://model.invalid"}}}`)}, nil, nil
+					}
 				}
 			})
 			r := httptest.NewRequest(http.MethodPost, test.path, strings.NewReader(test.body))
diff --git a/services/core/internal/api/session_model_defaults.go b/services/core/internal/api/session_model_defaults.go
index eb27ddf2e..82564df5e 100644
--- a/services/core/internal/api/session_model_defaults.go
+++ b/services/core/internal/api/session_model_defaults.go
@@ -7,7 +7,6 @@ import (
 
 	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/agents"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/credentialcrypto"
 	"github.com/google/uuid"
 )
 
@@ -34,7 +33,7 @@ func (h *Handler) sessionAgentDefaults(ctx context.Context, tenant string, input
 		return nil, nil, err
 	}
 	if inherit && saved.XAgentsCore != nil && saved.XAgentsCore.ModelProvider != nil && provider == nil {
-		return nil, nil, credentialcrypto.ErrUnavailable
+		return nil, nil, errors.New("saved agent model provider bundle is missing")
 	}
 	return saved, provider, nil
 }
diff --git a/services/core/internal/environmenttemplates/errors.go b/services/core/internal/environmenttemplates/errors.go
index 1591eaeee..7730fa274 100644
--- a/services/core/internal/environmenttemplates/errors.go
+++ b/services/core/internal/environmenttemplates/errors.go
@@ -7,6 +7,6 @@ var (
 	// the tenant. Missing, malformed and foreign IDs are indistinguishable.
 	ErrNotFound = errors.New("environment template not found")
 	// ErrInvalidInput reports input that is not a valid Template, or a saved
-	// Template whose configuration no longer decodes as one.
+	// Template whose configuration no longer passes validation.
 	ErrInvalidInput = errors.New("invalid environment template")
 )
diff --git a/services/core/internal/execution/delivery.go b/services/core/internal/execution/delivery.go
index fa04dbb4a..15bb619de 100644
--- a/services/core/internal/execution/delivery.go
+++ b/services/core/internal/execution/delivery.go
@@ -53,24 +53,24 @@ func abort(peer *runtimegateway.Session, ref proto.AssignmentRef, runID string)
 	_ = send(context.Background(), peer, ref, proto.TypePromptCancel, runID, proto.PromptCancelPayload{})
 }
 
-func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, peer *runtimegateway.Session, request proto.PromptRequestPayload, first int64, prepared *preparedStart) (result Result, status string) {
+func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, peer *runtimegateway.Session, request proto.PromptRequestPayload, runID string, input proto.MessageInput, first int64, prepared *preparedStart) (result Result, status string) {
 	changed, unsubscribeChanges := d.notifications.subscribe(tenantID, sessionID)
 	defer unsubscribeChanges()
 	status = sessions.TurnFailed
 	result.AppliedThrough = first
-	subscription, err := peer.SubscribeDurable(request.RunID, request.Assignment)
+	subscription, err := peer.SubscribeDurable(runID, request.Assignment)
 	if err != nil {
 		result.ErrorCode = "device_disconnected"
 		return
 	}
 	upstream := subscription.Events
-	defer peer.Unsubscribe(request.RunID)
+	defer peer.Unsubscribe(runID)
 	defer func() {
 		if status == sessions.TurnFailed {
-			abort(peer, request.Assignment, request.RunID)
+			abort(peer, request.Assignment, runID)
 		}
 	}()
-	journal := &journal{writer: d.sessionExecution, tenant: tenantID, session: sessionID, turn: request.RunID, next: 1,
+	journal := &journal{writer: d.sessionExecution, tenant: tenantID, session: sessionID, turn: runID, next: 1,
 		observeSubagents: request.ObserveSubagentIdentities}
 	defer func() {
 		finishCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
@@ -85,12 +85,11 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 			result.ErrorCode, status = "event_stream_incomplete", sessions.TurnFailed
 		}
 	}()
-	var preparationEvents <-chan proto.Envelope
+	preparationEvents := prepared.sub.Events
 	var executorRetried, nativeObserved bool
 	inputStarted := time.Now()
 	firstTextObserved := false
-	preparationEvents = prepared.sub.Events
-	if err = prepared.start(ctx, request); err != nil {
+	if err = prepared.start(ctx, runID, input); err != nil {
 		result.ErrorCode = "delivery_unknown"
 		return
 	}
@@ -103,7 +102,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 	var pending *pendingInput
 	var cancelSent time.Time
 	var cancelReply <-chan cancellationResult
-	functions := &functionExchange{assignment: request.Assignment, kind: request.AgentKind, turns: d.SessionsReader, sessions: d.sessionExecution, tenant: tenantID, session: sessionID, turn: request.RunID, tools: request.FunctionTools}
+	functions := &functionExchange{assignment: request.Assignment, kind: request.AgentKind, turns: d.SessionsReader, sessions: d.sessionExecution, tenant: tenantID, session: sessionID, turn: runID, tools: request.FunctionTools}
 	done := false
 	cancelCtx, stopCancellation := context.WithCancel(ctx)
 	defer stopCancellation()
@@ -122,7 +121,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 				result.ErrorCode = "preparation_interrupted"
 				return
 			}
-			started, err := prepared.started(env, request.RunID)
+			started, err := prepared.started(env, runID)
 			if err != nil {
 				var rejection *preparationRejection
 				if errors.As(err, &rejection) && rejection.operation == proto.TypeExecutionStart && rejection.code == "executor_unavailable" && !executorRetried && !nativeObserved && cancelReply == nil {
@@ -135,7 +134,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 						result.ErrorCode = "device_disconnected"
 						return
 					}
-					replacement, prepareErr := d.prepareTurnExecutor(ctx, peer, tenantID, sessionID, request.RunID, request, sessions.TurnInProgress)
+					replacement, prepareErr := d.prepareTurnExecutor(ctx, peer, tenantID, sessionID, runID, request, sessions.TurnInProgress)
 					if prepareErr != nil {
 						result.ErrorCode = "executor_recovery_failed"
 						return
@@ -143,7 +142,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 					prepared = replacement
 					defer prepared.close()
 					preparationEvents = prepared.sub.Events
-					if prepared.start(ctx, request) != nil {
+					if prepared.start(ctx, runID, input) != nil {
 						result.ErrorCode = "delivery_unknown"
 						return
 					}
@@ -199,7 +198,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 			nativeObserved = true
 			if !firstTextObserved && hasText(env) {
 				firstTextObserved = true
-				recordFirstText(ctx, sessionID, request.RunID, inputStarted)
+				recordFirstText(ctx, sessionID, runID, inputStarted)
 			}
 			writeErr := journal.observe(ctx, env)
 			if result.mergeObservation(env) != nil {
@@ -276,7 +275,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 				}
 				continue
 			}
-			turn, err := d.SessionsReader.GetTurn(ctx, tenantID, sessionID, request.RunID)
+			turn, err := d.SessionsReader.GetTurn(ctx, tenantID, sessionID, runID)
 			if err != nil {
 				result.ErrorCode = "execution_state_unavailable"
 				if ctx.Err() != nil {
@@ -289,7 +288,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 				return
 			}
 			if !turn.CancelRequestedAt.IsZero() {
-				cancelReply = requestCancellation(cancelCtx, peer, request.Assignment, request.RunID)
+				cancelReply = requestCancellation(cancelCtx, peer, request.Assignment, runID)
 				cancelSent = time.Now()
 				continue
 			}
@@ -301,7 +300,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 				continue
 			}
 			if pending == nil {
-				inputs, err := d.SessionsReader.ListTurnInputs(ctx, tenantID, sessionID, request.RunID, result.AppliedThrough, 1)
+				inputs, err := d.SessionsReader.ListTurnInputs(ctx, tenantID, sessionID, runID, result.AppliedThrough, 1)
 				if err != nil {
 					result.ErrorCode = "execution_state_unavailable"
 					if ctx.Err() != nil {
@@ -336,7 +335,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 					result.ErrorCode = "message_input_unsupported"
 					return
 				}
-				if send(ctx, peer, request.Assignment, proto.TypePromptSteer, request.RunID, proto.PromptSteerPayload{InputID: strconv.FormatInt(pending.sequence, 10), Input: pending.input, DurableReceipt: true}) != nil {
+				if send(ctx, peer, request.Assignment, proto.TypePromptSteer, runID, proto.PromptSteerPayload{InputID: strconv.FormatInt(pending.sequence, 10), Input: pending.input, DurableReceipt: true}) != nil {
 					result.ErrorCode = "input_outcome_unknown"
 					return
 				}
diff --git a/services/core/internal/execution/directory_preparation.go b/services/core/internal/execution/directory_preparation.go
index 586b208e8..52b8fc59c 100644
--- a/services/core/internal/execution/directory_preparation.go
+++ b/services/core/internal/execution/directory_preparation.go
@@ -25,7 +25,7 @@ func (d *Dispatcher) readPreparedDirectory(ctx context.Context, peer *runtimegat
 }
 
 func (d *Dispatcher) withPreparedWorkspace(owner context.Context, peer *runtimegateway.Session, session sessions.Session, environment sessions.Environment, bound sessions.ExecutionDevice, consume func(context.Context, string) error) error {
-	req := proto.PromptRequestPayload{Assignment: bound.Assignment, AgentKind: session.Engine, AgentStateKey: "agents-api-" + session.ID, StrictResume: true, ReleaseOnCompletion: true, WorkspaceReadOnly: true}
+	req := proto.PromptRequestPayload{Assignment: bound.Assignment, AgentKind: session.Engine, AgentStateKey: "agents-api-" + session.ID, WorkspaceReadOnly: true}
 	if err := d.configurePreparedEnvironment(session, environment, bound, &req); err != nil {
 		return ErrExecutionUnavailable
 	}
diff --git a/services/core/internal/execution/dispatcher.go b/services/core/internal/execution/dispatcher.go
index 8eaa489b2..3107832d3 100644
--- a/services/core/internal/execution/dispatcher.go
+++ b/services/core/internal/execution/dispatcher.go
@@ -120,13 +120,12 @@ func (d *Dispatcher) Run(ctx context.Context, tenantID, sessionID, turnID string
 	if _, err := d.sessionExecution.TransitionTurn(ctx, tenantID, sessionID, turnID, sessions.TurnTransition{ExpectedStatus: sessions.TurnQueued, Status: sessions.TurnInProgress}); err != nil {
 		return sessions.Turn{}, err
 	}
-	req.ConversationID, req.RunID, req.Input = sessionID, turnID, text
-	release, err := peer.TrackExecutionDelivery(req.RunID)
+	release, err := peer.TrackExecutionDelivery(turnID)
 	if err != nil {
 		return d.finishRun(tenantID, sessionID, turnID, snapshot.Agent.Model, Result{ErrorCode: "delivery_unknown", AppliedThrough: through}, sessions.TurnFailed)
 	}
 	defer release()
-	result, status := d.deliver(ctx, tenantID, sessionID, peer, req, through, prepared)
+	result, status := d.deliver(ctx, tenantID, sessionID, peer, req, turnID, text, through, prepared)
 	return d.finishRun(tenantID, sessionID, turnID, snapshot.Agent.Model, result, status)
 }
 
diff --git a/services/core/internal/execution/executor_preparation.go b/services/core/internal/execution/executor_preparation.go
index efce9c708..06fa77c9d 100644
--- a/services/core/internal/execution/executor_preparation.go
+++ b/services/core/internal/execution/executor_preparation.go
@@ -18,7 +18,6 @@ func (d *Dispatcher) prepareTurnExecutor(ctx context.Context, peer *runtimegatew
 	if err != nil {
 		return nil, err
 	}
-	request.RunID, request.ConversationID, request.Input = "", "", nil
 	if err = send(ctx, peer, request.Assignment, proto.TypeExecutionPrepare, prepared.requestID, proto.ExecutionPreparePayload{SessionID: session, Configuration: request}); err == nil {
 		err = d.awaitTurnExecutor(ctx, tenant, session, turn, expectedStatus, prepared)
 	}
diff --git a/services/core/internal/execution/preparation.go b/services/core/internal/execution/preparation.go
index 4f59b1916..0ccc4b1c9 100644
--- a/services/core/internal/execution/preparation.go
+++ b/services/core/internal/execution/preparation.go
@@ -129,9 +129,9 @@ func (d *Dispatcher) awaitPreparation(ctx context.Context, tenant, session strin
 	}
 }
 
-func (p *preparedStart) start(ctx context.Context, request proto.PromptRequestPayload) error {
+func (p *preparedStart) start(ctx context.Context, runID string, input proto.MessageInput) error {
 	p.startSentAt = time.Now()
-	return send(ctx, p.peer, p.assignment, proto.TypeExecutionStart, p.requestID, proto.ExecutionStartPayload{Handle: p.handle, ExecutorID: p.executorID, RunID: request.RunID, Input: request.Input})
+	return send(ctx, p.peer, p.assignment, proto.TypeExecutionStart, p.requestID, proto.ExecutionStartPayload{Handle: p.handle, ExecutorID: p.executorID, RunID: runID, Input: input})
 }
 
 func (p *preparedStart) started(env proto.Envelope, runID string) (bool, error) {
diff --git a/services/core/internal/execution/prepared_dispatch.go b/services/core/internal/execution/prepared_dispatch.go
index 0cd73dd90..a9190a335 100644
--- a/services/core/internal/execution/prepared_dispatch.go
+++ b/services/core/internal/execution/prepared_dispatch.go
@@ -110,17 +110,16 @@ func (d *Dispatcher) RunEnvironmentInput(ctx context.Context, lease Ownership, t
 	if run.Reservation.Receipts[0].Replayed {
 		return run, nil
 	}
-	req.RunID = run.Reservation.Receipts[0].TurnID
-	req.Input = messages
+	turnID := run.Reservation.Receipts[0].TurnID
 	through := run.Reservation.Receipts[len(run.Reservation.Receipts)-1].Sequence
-	releaseDelivery, err := peer.TrackExecutionDelivery(req.RunID)
+	releaseDelivery, err := peer.TrackExecutionDelivery(turnID)
 	if err != nil {
-		run.Turn, err = d.finishRun(tenantID, sessionID, req.RunID, snapshot.Agent.Model, Result{ErrorCode: "delivery_unknown", AppliedThrough: through}, sessions.TurnFailed)
+		run.Turn, err = d.finishRun(tenantID, sessionID, turnID, snapshot.Agent.Model, Result{ErrorCode: "delivery_unknown", AppliedThrough: through}, sessions.TurnFailed)
 		return run, err
 	}
 	defer releaseDelivery()
-	result, status := d.deliver(owner, tenantID, sessionID, peer, req, through, prepared)
-	result, status = d.captureCompletedArtifacts(owner, peer, session, environment, bound.Device, req.RunID, result, status)
-	run.Turn, err = d.finishRun(tenantID, sessionID, req.RunID, snapshot.Agent.Model, result, status)
+	result, status := d.deliver(owner, tenantID, sessionID, peer, req, turnID, messages, through, prepared)
+	result, status = d.captureCompletedArtifacts(owner, peer, session, environment, bound.Device, turnID, result, status)
+	run.Turn, err = d.finishRun(tenantID, sessionID, turnID, snapshot.Agent.Model, result, status)
 	return run, err
 }
diff --git a/services/core/internal/execution/recovery_test.go b/services/core/internal/execution/recovery_test.go
index 97af3a8a8..91065c4ca 100644
--- a/services/core/internal/execution/recovery_test.go
+++ b/services/core/internal/execution/recovery_test.go
@@ -20,7 +20,7 @@ func TestExistingSessionRecoveryRequiresVerifiedCapability(t *testing.T) {
 						}
 						continue
 					}
-					if err != nil || req.RequireExistingNativeSession != wantRecovery || req.AgentSessionID != nativeID || !req.StrictResume || req.AgentStateKey != "agents-api-session" {
+					if err != nil || req.RequireExistingNativeSession != wantRecovery || req.AgentSessionID != nativeID || req.AgentStateKey != "agents-api-session" {
 						t.Fatalf("engine=%s started=%v id=%s capability=%v request=%+v err=%v", engine, started, nativeID, capable, req, err)
 					}
 				}
diff --git a/services/core/internal/execution/request.go b/services/core/internal/execution/request.go
index 14301e1f1..e5159e0df 100644
--- a/services/core/internal/execution/request.go
+++ b/services/core/internal/execution/request.go
@@ -49,9 +49,8 @@ func (d *Dispatcher) executionRequest(ctx context.Context, session sessions.Sess
 	request := proto.PromptRequestPayload{AgentKind: session.Engine, FunctionTools: tools.Functions, ToolSearch: tools.Search,
 		Model: snapshot.Agent.Model, SystemPrompt: instructions, ModelProvider: provider, HarnessConfig: harnessConfig,
 		ExecutionControls: controls, AgentStateKey: "agents-api-" + session.ID,
-		AgentSessionID: bound.NativeSessionID, StrictResume: true,
-		RequireExistingNativeSession: recoverNativeSession,
-		ObserveMessages:              caps.MessageItems, ObserveToolObservations: true,
+		AgentSessionID: bound.NativeSessionID, RequireExistingNativeSession: recoverNativeSession,
+		ObserveMessages:           caps.MessageItems,
 		ObserveSubagentIdentities: snapshot.Agent.MultiAgent.Enabled,
 		MaxConcurrentSubagents:    snapshot.Agent.MultiAgent.MaxConcurrentSubagents,
 		DisableSubagents:          !snapshot.Agent.MultiAgent.Enabled}
diff --git a/services/core/internal/nativeinstaller/assets/bootstrap.ps1 b/services/core/internal/nativeinstaller/assets/bootstrap.ps1
index 92c0b8094..3a8cae90c 100644
--- a/services/core/internal/nativeinstaller/assets/bootstrap.ps1
+++ b/services/core/internal/nativeinstaller/assets/bootstrap.ps1
@@ -4,6 +4,8 @@ param(
   [Parameter(ValueFromRemainingArguments=$true)][string[]]$InstallArguments
 )
 $ErrorActionPreference = 'Stop'
+$tar = Join-Path $env:SystemRoot 'System32\tar.exe'
+if (!(Test-Path -LiteralPath $tar -PathType Leaf)) { throw 'Windows tar.exe is required. Install the Windows archive tools, then rerun this command.' }
 Add-Type -AssemblyName System.Net.Http
 if (!("OacNativeDownloadSpace" -as [type])) {
   Add-Type -TypeDefinition @'
@@ -158,7 +160,7 @@ try {
   $bundle = Join-Path $work 'bundle'
   [IO.Directory]::CreateDirectory($bundle) | Out-Null
   Write-Host 'Extracting the installer...'
-  & (Join-Path $env:SystemRoot 'System32\tar.exe') -xzf $archive -C $bundle
+  & $tar -xzf $archive -C $bundle
   if ($LASTEXITCODE -ne 0) { throw 'Installer extraction failed. Check disk space, quota and filesystem permissions.' }
   $endpoint = $Base -replace '/install/[^/]+$', '/installation'
   Write-Host 'Starting installation...'
diff --git a/services/core/internal/nativeinstaller/assets/bootstrap.sh b/services/core/internal/nativeinstaller/assets/bootstrap.sh
index e14d88759..c4bf10c9f 100644
--- a/services/core/internal/nativeinstaller/assets/bootstrap.sh
+++ b/services/core/internal/nativeinstaller/assets/bootstrap.sh
@@ -90,4 +90,13 @@ space "$unpacked"
 printf 'Extracting the installer...\n'
 mkdir "$work/bundle"
 run tar -xzf "$work/bundle.tar.gz" -C "$work/bundle" || fail 'Installer extraction failed. Check disk space, quota and filesystem permissions.'
-run "$work/bundle/oac-daemon" install --onboard-url "${base%/install/*}/installation" --authorization "$authorization" "$@"
+[ -x "$work/bundle/oac-daemon" ] || fail 'Cannot start the native installer. Check executable permissions and use a Runtime home that permits execution.'
+if run "$work/bundle/oac-daemon" install --onboard-url "${base%/install/*}/installation" --authorization "$authorization" "$@"; then
+  exit 0
+else
+  code=$?
+  case "$code" in
+    126|127) fail 'Cannot start the native installer. Check that the Runtime home permits execution (not a noexec mount) and that this host has the required native libraries.';;
+    *) exit "$code";;
+  esac
+fi
diff --git a/services/core/internal/nativeinstaller/bootstrap_recovery_test.go b/services/core/internal/nativeinstaller/bootstrap_recovery_test.go
index a0d112925..441e0d3c6 100644
--- a/services/core/internal/nativeinstaller/bootstrap_recovery_test.go
+++ b/services/core/internal/nativeinstaller/bootstrap_recovery_test.go
@@ -163,3 +163,64 @@ func TestBootstrapRejectsLowSpaceBeforeNetwork(t *testing.T) {
 		t.Fatal("low-space failure left staging")
 	}
 }
+
+func TestBootstrapExplainsUnexecutableInstaller(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("POSIX executable permissions")
+	}
+	var buffer bytes.Buffer
+	z := gzip.NewWriter(&buffer)
+	tw := tar.NewWriter(z)
+	data := []byte("#!/bin/sh\nexit 0\n")
+	if err := tw.WriteHeader(&tar.Header{Name: "oac-daemon", Mode: 0600, Size: int64(len(data))}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := tw.Write(data); err != nil {
+		t.Fatal(err)
+	}
+	if err := tw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := z.Close(); err != nil {
+		t.Fatal(err)
+	}
+	archive := buffer.Bytes()
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasSuffix(r.URL.Path, ".sha256") {
+			fmt.Fprintf(w, "%x\n", sha256.Sum256(archive))
+			return
+		}
+		w.Write(archive)
+	}))
+	defer server.Close()
+	home := t.TempDir()
+	output, err := bootstrapCommand(t, server.URL, home).CombinedOutput()
+	if err == nil || !bytes.Contains(output, []byte("Cannot start the native installer")) {
+		t.Fatalf("%v: %s", err, output)
+	}
+	if _, err := os.Stat(filepath.Join(home, "native-download", "staging")); !os.IsNotExist(err) {
+		t.Fatal("staging remains")
+	}
+}
+
+func TestWindowsBootstrapChecksArchiveToolBeforeDownload(t *testing.T) {
+	if runtime.GOOS != "windows" {
+		t.Skip("Windows archive prerequisite")
+	}
+	var requests atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { requests.Add(1); w.WriteHeader(500) }))
+	defer server.Close()
+	home := filepath.Join(t.TempDir(), "runtime")
+	command := bootstrapCommand(t, server.URL, home)
+	quote := func(value string) string { return "'" + strings.ReplaceAll(value, "'", "''") + "'" }
+	// Keep the real SystemRoot while PowerShell itself loads.
+	command.Args = []string{command.Path, "-NoProfile", "-NonInteractive", "-Command",
+		"$env:SystemRoot = " + quote(t.TempDir()) + "; & './assets/bootstrap.ps1' -Base " + quote(server.URL) + " -Authorization 'fixture-grant'"}
+	output, err := command.CombinedOutput()
+	if err == nil || !bytes.Contains(output, []byte("tar.exe is required")) || requests.Load() != 0 {
+		t.Fatalf("%v: %s", err, output)
+	}
+	if _, err := os.Stat(home); !os.IsNotExist(err) {
+		t.Fatal("home created before prerequisite check")
+	}
+}
diff --git a/services/core/internal/persistence/postgres/sessionpg/devices.go b/services/core/internal/persistence/postgres/sessionpg/devices.go
index ade3dfabe..f14e32ae4 100644
--- a/services/core/internal/persistence/postgres/sessionpg/devices.go
+++ b/services/core/internal/persistence/postgres/sessionpg/devices.go
@@ -17,7 +17,7 @@ import (
 )
 
 func (s *Store) GetSessionDevice(ctx context.Context, tenant, session string) (sessions.ExecutionDevice, error) {
-	lookup, err := DeviceLookup(tenant, session)
+	lookup, err := ResourceLookup(tenant, session)
 	if err != nil {
 		return sessions.ExecutionDevice{}, err
 	}
@@ -28,7 +28,7 @@ func (s *Store) GetSessionDevice(ctx context.Context, tenant, session string) (s
 }
 
 func (s *Store) GetSessionExecutionBinding(ctx context.Context, tenant, session string) (sessions.ExecutionBinding, error) {
-	lookup, err := DeviceLookup(tenant, session)
+	lookup, err := ResourceLookup(tenant, session)
 	if err != nil {
 		return sessions.ExecutionBinding{}, err
 	}
@@ -79,7 +79,7 @@ func (s *Store) ListExecutionDevices(ctx context.Context, tenant string) ([]sess
 }
 
 func (s *Store) GetSessionRuntimeDevice(ctx context.Context, tenant, session string) (sessions.ExecutionDevice, error) {
-	lookup, err := DeviceLookup(tenant, session)
+	lookup, err := ResourceLookup(tenant, session)
 	if err != nil {
 		return sessions.ExecutionDevice{}, err
 	}
@@ -188,7 +188,7 @@ func (s *Store) CreateDevice(ctx context.Context, tenant string, registration se
 }
 
 func (s *Store) RevokeDevice(ctx context.Context, tenant, device string) error {
-	lookup, err := DeviceLookup(tenant, device)
+	lookup, err := ResourceLookup(tenant, device)
 	if err != nil {
 		return err
 	}
@@ -235,7 +235,7 @@ func (s *Store) WithEnrollment(ctx context.Context, environment, credentialHash
 	if err != nil {
 		return err
 	}
-	lookup, err := DeviceLookup(tenant, current.ID)
+	lookup, err := ResourceLookup(tenant, current.ID)
 	if err != nil {
 		return err
 	}
diff --git a/services/core/internal/persistence/postgres/sessionpg/execution_environment.go b/services/core/internal/persistence/postgres/sessionpg/execution_environment.go
index bc2b8ed03..821171713 100644
--- a/services/core/internal/persistence/postgres/sessionpg/execution_environment.go
+++ b/services/core/internal/persistence/postgres/sessionpg/execution_environment.go
@@ -34,7 +34,7 @@ func (e *Execution) WithConnection(ctx context.Context, tenant, environment stri
 		if err != nil {
 			return err
 		}
-		lookup, err := DeviceLookup(tenant, current.SessionID)
+		lookup, err := ResourceLookup(tenant, current.SessionID)
 		if err != nil {
 			return err
 		}
@@ -45,7 +45,7 @@ func (e *Execution) WithConnection(ctx context.Context, tenant, environment stri
 }
 
 func (e *Execution) WithDeviceBinding(ctx context.Context, tenant, session string, apply func(context.Context, sessions.DeviceBindingTx, sessions.LockedSession) error) error {
-	lookup, err := DeviceLookup(tenant, session)
+	lookup, err := ResourceLookup(tenant, session)
 	if err != nil {
 		return err
 	}
diff --git a/services/core/internal/persistence/postgres/sessionpg/frozen.go b/services/core/internal/persistence/postgres/sessionpg/frozen.go
index 40e36f0ef..d7a638f78 100644
--- a/services/core/internal/persistence/postgres/sessionpg/frozen.go
+++ b/services/core/internal/persistence/postgres/sessionpg/frozen.go
@@ -19,7 +19,7 @@ import (
 // data that does not open, decode or validate is corrupt stored data, never
 // the caller's input, so it is an internal error.
 func (s *Store) ReadEnvironmentSetup(ctx context.Context, tenant, session string) (environmentconfig.Setup, error) {
-	lookup, err := DeviceLookup(tenant, session)
+	lookup, err := ResourceLookup(tenant, session)
 	if err != nil {
 		return environmentconfig.Setup{}, sessions.ErrNotFound
 	}
@@ -51,7 +51,7 @@ func (s *Store) ReadEnvironmentSetup(ctx context.Context, tenant, session string
 // position. A file that does not open or match its recorded size is corrupt
 // stored data, so it is an internal error.
 func (s *Store) ReadInitialEnvironmentFile(ctx context.Context, tenant, session string, position int) (environmentconfig.InitialFileMetadata, []byte, error) {
-	lookup, err := DeviceLookup(tenant, session)
+	lookup, err := ResourceLookup(tenant, session)
 	if err != nil {
 		return environmentconfig.InitialFileMetadata{}, nil, err
 	}
diff --git a/services/core/internal/persistence/postgres/sessionpg/rows.go b/services/core/internal/persistence/postgres/sessionpg/rows.go
index a07c5a342..d635b72bf 100644
--- a/services/core/internal/persistence/postgres/sessionpg/rows.go
+++ b/services/core/internal/persistence/postgres/sessionpg/rows.go
@@ -42,10 +42,10 @@ func TurnLookup(tenantID, sessionID, turnID string) (sqlc.GetTurnParams, error)
 	return p, err
 }
 
-// DeviceLookup parses a tenant and the internal identifier of one of its
+// ResourceLookup parses a tenant and the internal identifier of one of its
 // resources, such as a device, Session or Environment; a malformed one is
 // sessions.ErrInvalidInput.
-func DeviceLookup(tenantID, id string) (sqlc.GetDeviceParams, error) {
+func ResourceLookup(tenantID, id string) (sqlc.GetDeviceParams, error) {
 	var p sqlc.GetDeviceParams
 	var err error
 	if p.TenantID, err = parseID(tenantID); err != nil {
@@ -76,7 +76,7 @@ func sessionFromRow(row sqlc.Session) (sessions.Session, error) {
 	session.Creator = creator
 	configuration, err := jsonobject.Normalize(row.Configuration)
 	if err != nil {
-		return sessions.Session{}, fmt.Errorf("decode session configuration: %w: %w", sessions.ErrInvalidInput, err)
+		return sessions.Session{}, fmt.Errorf("decode session configuration: %w", err)
 	}
 	session.Configuration = configuration
 	if err := json.Unmarshal(row.Metadata, &session.Metadata); err != nil {
@@ -110,7 +110,7 @@ func environmentFromRow(row sqlc.Environment, tenant pgtype.UUID, configuration
 	}
 	configuration, err = jsonobject.Normalize(configuration)
 	if err != nil {
-		return sessions.Environment{}, fmt.Errorf("decode environment configuration: %w: %w", sessions.ErrInvalidInput, err)
+		return sessions.Environment{}, fmt.Errorf("decode environment configuration: %w", err)
 	}
 	return sessions.Environment{
 		ID: uuid.UUID(row.ID.Bytes).String(), SessionID: uuid.UUID(row.SessionID.Bytes).String(),
diff --git a/services/core/internal/persistence/postgres/templatepg/seal.go b/services/core/internal/persistence/postgres/templatepg/seal.go
index fd504ecbc..06b2f0749 100644
--- a/services/core/internal/persistence/postgres/templatepg/seal.go
+++ b/services/core/internal/persistence/postgres/templatepg/seal.go
@@ -2,6 +2,7 @@ package templatepg
 
 import (
 	"encoding/json"
+	"errors"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/credentialcrypto"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/environmentconfig"
@@ -87,7 +88,7 @@ func (s *Store) openSetup(tenant, id pgtype.UUID, field string, ciphertext []byt
 		return err
 	}
 	if environmentconfig.Decode(plaintext, output) != nil {
-		return environmenttemplates.ErrInvalidInput
+		return errors.New("invalid stored environment template " + field)
 	}
 	return nil
 }
diff --git a/services/core/internal/persistence/postgres/templatepg/store.go b/services/core/internal/persistence/postgres/templatepg/store.go
index 61f93bb4b..cb3d1d502 100644
--- a/services/core/internal/persistence/postgres/templatepg/store.go
+++ b/services/core/internal/persistence/postgres/templatepg/store.go
@@ -169,8 +169,10 @@ func (s *Store) List(ctx context.Context, tenantID string, query environmenttemp
 }
 
 // Resolve reads one row, so the metadata and every confidential field come
-// from the same committed version. Stored Skill and Plugin metadata must match
-// the sealed archives they describe. Any malformed ID resolves to ErrNotFound.
+// from the same committed version. Stored data that does not decode or match
+// its sealed contents is corrupt, an internal error; configuration that decodes
+// but fails current validation is ErrInvalidInput. Any malformed ID resolves to
+// ErrNotFound.
 func (s *Store) Resolve(ctx context.Context, tenantID, templateID string) (environmenttemplates.Resolved, error) {
 	tenant, err := pgunit.ParseID(tenantID)
 	if err != nil {
@@ -203,12 +205,15 @@ func (s *Store) Resolve(ctx context.Context, tenantID, templateID string) (envir
 			return environmenttemplates.Resolved{}, err
 		}
 	}
-	if !matches(metadata.Skills, resolved.Setup.SkillMetadata()) || !matches(metadata.Plugins, resolved.Setup.PluginMetadata()) || resolved.Setup.Validate() != nil {
+	if !matches(metadata.Skills, resolved.Setup.SkillMetadata()) || !matches(metadata.Plugins, resolved.Setup.PluginMetadata()) {
+		return environmenttemplates.Resolved{}, errors.New("stored environment template metadata does not match its sealed setup")
+	}
+	if resolved.Setup.Validate() != nil {
 		return environmenttemplates.Resolved{}, environmenttemplates.ErrInvalidInput
 	}
 	if len(row.FileContents) == 0 {
 		if len(metadata.Files) > 0 {
-			return environmenttemplates.Resolved{}, environmenttemplates.ErrInvalidInput
+			return environmenttemplates.Resolved{}, errors.New("stored environment template files have no contents")
 		}
 		return resolved, nil
 	}
@@ -219,7 +224,10 @@ func (s *Store) Resolve(ctx context.Context, tenantID, templateID string) (envir
 	if err != nil {
 		return environmenttemplates.Resolved{}, err
 	}
-	if json.Unmarshal(plaintext, &resolved.Files) != nil || environmentconfig.ValidateInitialFiles(resolved.Files) != nil {
+	if json.Unmarshal(plaintext, &resolved.Files) != nil {
+		return environmenttemplates.Resolved{}, errors.New("invalid stored environment template files")
+	}
+	if environmentconfig.ValidateInitialFiles(resolved.Files) != nil {
 		return environmenttemplates.Resolved{}, environmenttemplates.ErrInvalidInput
 	}
 	return resolved, nil
@@ -246,7 +254,7 @@ func template(row metadataRow) (environmenttemplates.Template, error) {
 		result.Name = &row.Name.String
 	}
 	if json.Unmarshal(row.Files, &result.Files) != nil || environmentconfig.Decode(row.Packages, &result.Packages) != nil || json.Unmarshal(row.Skills, &result.Skills) != nil || json.Unmarshal(row.Plugins, &result.Plugins) != nil {
-		return environmenttemplates.Template{}, environmenttemplates.ErrInvalidInput
+		return environmenttemplates.Template{}, errors.New("invalid stored environment template metadata")
 	}
 	return result, nil
 }
diff --git a/services/core/internal/persistence/postgres/templatepg/store_test.go b/services/core/internal/persistence/postgres/templatepg/store_test.go
index ee5b02b82..7710eb447 100644
--- a/services/core/internal/persistence/postgres/templatepg/store_test.go
+++ b/services/core/internal/persistence/postgres/templatepg/store_test.go
@@ -370,9 +370,10 @@ func TestMissingKeyIsUnavailable(t *testing.T) {
 	}
 }
 
-// Stored package metadata naming the removed system manager is rejected on
-// every read instead of being silently dropped.
-func TestStoredSystemPackagesRejected(t *testing.T) {
+// Stored package metadata naming the removed system manager no longer decodes,
+// so every read fails with an internal error instead of dropping it. Packages
+// that decode but fail current validation are an invalid Template.
+func TestStoredPackagesRejected(t *testing.T) {
 	f := newFixture(t, pgtest.Open(t))
 	ctx := t.Context()
 	tenant := uuid.NewString()
@@ -383,18 +384,23 @@ func TestStoredSystemPackagesRejected(t *testing.T) {
 			t.Fatal(err)
 		}
 	}
+	internal := func(err error) bool { return err != nil && !errors.Is(err, environmenttemplates.ErrInvalidInput) }
 	for _, value := range []string{`null`, `[]`, `["jq"]`} {
 		store(`{"npm":[],"python":[],"system":` + value + `}`)
-		if _, err := f.keyless.Get(ctx, tenant, template.ID); !errors.Is(err, environmenttemplates.ErrInvalidInput) {
-			t.Fatal("get silently ignored removed system packages", value, err)
+		if _, err := f.keyless.Get(ctx, tenant, template.ID); !internal(err) {
+			t.Fatal("get did not fail internally on removed system packages", value, err)
 		}
-		if _, err := f.keyless.List(ctx, tenant, environmenttemplates.ListQuery{Limit: 1}); !errors.Is(err, environmenttemplates.ErrInvalidInput) {
-			t.Fatal("list silently ignored removed system packages", value, err)
+		if _, err := f.keyless.List(ctx, tenant, environmenttemplates.ListQuery{Limit: 1}); !internal(err) {
+			t.Fatal("list did not fail internally on removed system packages", value, err)
 		}
-		if _, err := f.keyed.Resolve(ctx, tenant, template.ID); !errors.Is(err, environmenttemplates.ErrInvalidInput) {
-			t.Fatal("resolve silently ignored removed system packages", value, err)
+		if _, err := f.keyed.Resolve(ctx, tenant, template.ID); !internal(err) {
+			t.Fatal("resolve did not fail internally on removed system packages", value, err)
 		}
 	}
+	store(`{"npm":["-x"],"python":[]}`)
+	if _, err := f.keyed.Resolve(ctx, tenant, template.ID); !errors.Is(err, environmenttemplates.ErrInvalidInput) {
+		t.Fatal("resolve accepted packages that fail validation", err)
+	}
 	store(`{"npm":["semver"],"python":["packaging"]}`)
 	if got, err := f.keyless.Get(ctx, tenant, template.ID); err != nil || !reflect.DeepEqual(got.Packages, v1.EnvironmentPackages{NPM: []string{"semver"}, Python: []string{"packaging"}}) {
 		t.Fatal("supported stored package managers rejected", got.Packages, err)
diff --git a/services/core/internal/runtimegateway/auth.go b/services/core/internal/runtimegateway/auth.go
index af8c0efa3..40fa443f5 100644
--- a/services/core/internal/runtimegateway/auth.go
+++ b/services/core/internal/runtimegateway/auth.go
@@ -71,8 +71,8 @@ func (a *Authenticator) AuthenticateBearer(ctx context.Context, deviceID, bearer
 	}
 	storedHash := rt.CredentialHash
 	if storedHash == "" {
-		// No credential was issued, or someone wiped it out-of-band.
-		// Fail closed.
+		// No credential was issued, or someone wiped it
+		// out-of-band. Fail closed.
 		return AuthenticatedRuntime{}, ErrAuthBadCredential
 	}
 	presented := runtimedevice.HashCredential(bearer)
diff --git a/services/core/internal/runtimegateway/cancellation_test.go b/services/core/internal/runtimegateway/cancellation_test.go
index 217c482ef..a534277b5 100644
--- a/services/core/internal/runtimegateway/cancellation_test.go
+++ b/services/core/internal/runtimegateway/cancellation_test.go
@@ -58,7 +58,7 @@ func TestArchivedReceiptTracksDeliveryBeyondDoneAndRejectsNewWork(t *testing.T)
 	if _, err := peer.TrackExecutionDelivery("new-run"); err == nil {
 		t.Fatal("new delivery admitted while draining")
 	}
-	for _, kind := range []string{proto.TypePromptSteer, proto.TypeExecutionPrepare, proto.TypeRuntimePrepare, proto.TypeWorkspaceWrite, proto.TypeWorkspaceRead} {
+	for _, kind := range []string{proto.TypeExecutionStart, proto.TypePromptSteer, proto.TypeExecutionPrepare, proto.TypeRuntimePrepare, proto.TypeWorkspaceWrite, proto.TypeWorkspaceRead} {
 		env, _ := proto.NewEnvelope(kind, "run", nil)
 		if err := peer.Send(t.Context(), env); err == nil {
 			t.Fatal("drain permitted new operation", kind)
diff --git a/services/core/internal/runtimegateway/handler.go b/services/core/internal/runtimegateway/handler.go
index 3a7b61d16..291715528 100644
--- a/services/core/internal/runtimegateway/handler.go
+++ b/services/core/internal/runtimegateway/handler.go
@@ -15,7 +15,8 @@ import (
 )
 
 // HeartbeatTouch is the persistence interface the gateway uses to
-// bump last_heartbeat_at when a daemon connects.
+// bump last_heartbeat_at and mark the runtime online when a daemon
+// connects.
 type HeartbeatTouch interface {
 	TouchRuntimeHeartbeat(ctx context.Context, runtimeID string) (runtimedevice.HeartbeatStatus, error)
 	TouchAgentDaemonHeartbeat(ctx context.Context, input runtimedevice.Heartbeat) (runtimedevice.HeartbeatStatus, error)
@@ -31,7 +32,8 @@ type HandlerConfig struct {
 
 	Registry *Registry
 
-	// Heartbeat keeps last_heartbeat_at fresh. nil tracks liveness in-process only.
+	// Heartbeat marks the runtime online and keeps
+	// last_heartbeat_at fresh. nil tracks liveness in-process only.
 	Heartbeat HeartbeatTouch
 
 	// ArchivedCancellations reads the receipt that an archived Session's
@@ -118,6 +120,7 @@ func (h *Handler) WS(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if h.cfg.Heartbeat != nil {
+		// First inbound action — mark the runtime online.
 		// Best-effort; a transient DB blip shouldn't refuse the
 		// upgrade since we already accepted the credential.
 		if _, hbErr := h.cfg.Heartbeat.TouchRuntimeHeartbeat(r.Context(), auth.DeviceID); hbErr != nil {
@@ -138,7 +141,7 @@ func (h *Handler) WS(w http.ResponseWriter, r *http.Request) {
 	sess.Start()
 }
 
-// Bootstrap is the daemon's first HTTP call. Validating
+// Bootstrap is the daemon's first HTTP call with its credential. Validating
 // the bearer in a separate HTTP step (rather than folded into the WS
 // upgrade) lets the daemon fail fast on credential problems with a
 // real HTTP status rather than the opaque WS close code.
diff --git a/services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go b/services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go
index e059977d0..f89de9525 100644
--- a/services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go
+++ b/services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go
@@ -91,7 +91,7 @@ func TestLiveMCPBearerGatewayColdContinuation(t *testing.T) {
 		turn := &mcpBearerTurn{}
 		turns = append(turns, turn)
 		runID := uuid.NewString()
-		request := proto.PromptRequestPayload{AgentKind: "codex", AgentStateKey: "mcp-bearer-acceptance", AgentSessionID: resume, StrictResume: true, ReleaseOnCompletion: true, ObserveMessages: true, ObserveToolObservations: true, DisableExecutionEnvironment: true, DisableSubagents: true, MCPHTTPServers: &servers, Model: "MiniMax-M3", ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}}
+		request := proto.PromptRequestPayload{AgentKind: "codex", AgentStateKey: "agents-api-" + assignment.SessionID, AgentSessionID: resume, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, MCPHTTPServers: &servers, Model: "MiniMax-M3", ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}}
 		sub, err := peer.SubscribeDurable(runID, assignment)
 		if err != nil {
 			t.Fatal("cannot subscribe before real daemon dispatch")
diff --git a/services/core/internal/runtimegateway/mcp_bearer_process_linux_test.go b/services/core/internal/runtimegateway/mcp_bearer_process_linux_test.go
index d8d85d26e..e2d70ae89 100644
--- a/services/core/internal/runtimegateway/mcp_bearer_process_linux_test.go
+++ b/services/core/internal/runtimegateway/mcp_bearer_process_linux_test.go
@@ -197,7 +197,7 @@ func mcpBearerReleased(t *testing.T, root string) int {
 			return launches
 		}
 		if time.Now().After(deadline) {
-			t.Fatal("Done did not release the owned native process")
+			t.Fatal("the owned native process was not released")
 		}
 		time.Sleep(25 * time.Millisecond)
 	}
diff --git a/services/core/internal/runtimegateway/routes.go b/services/core/internal/runtimegateway/routes.go
index 4242222b0..d0c098c1e 100644
--- a/services/core/internal/runtimegateway/routes.go
+++ b/services/core/internal/runtimegateway/routes.go
@@ -11,8 +11,8 @@ import (
 //	POST /agent-daemon/bootstrap     — daemon first-call to fetch wsUrl + heartbeat cadence
 //	GET  /agent-daemon/device-status — daemon self-check
 //
-// All three accept the daemon credential that
-// contracts/agents-api/machine-api.md describes.
+// All three accept the daemon credential described in
+// contracts/agents-api/machine-api.md.
 func RegisterRoutes(r chi.Router, h *Handler) {
 	if h == nil {
 		panic("agentdaemon gateway: RegisterRoutes called with nil handler")
diff --git a/services/core/internal/runtimegateway/session.go b/services/core/internal/runtimegateway/session.go
index 6638e8276..1067da96d 100644
--- a/services/core/internal/runtimegateway/session.go
+++ b/services/core/internal/runtimegateway/session.go
@@ -93,7 +93,7 @@ type Session struct {
 
 	// supportedKinds is the latest daemon-advertised agent_kind snapshot,
 	// updated from heartbeat frames and read by the connector before
-	// dispatching prompt_request so unsupported engines fail on the server.
+	// sending execution_prepare so unsupported engines fail on the server.
 	kindsMu        sync.RWMutex
 	kindsSeen      bool
 	supportedKinds []runtimedevice.SupportedAgentKind
diff --git a/services/core/tests/integration/dispatch_test.go b/services/core/tests/integration/dispatch_test.go
index 44f5a9833..37ad16047 100644
--- a/services/core/tests/integration/dispatch_test.go
+++ b/services/core/tests/integration/dispatch_test.go
@@ -240,7 +240,7 @@ func TestExecutionDispatchSteeringAndNativeContinuity(t *testing.T) {
 	request := h.read(testExecutionRequest)
 	var prompt proto.PromptRequestPayload
 	_ = request.DecodePayload(&prompt)
-	if inputTextForTest(t, prompt.Input) != "Initial input" || prompt.ConversationID != h.session.ID || prompt.Model != "test-model" || prompt.SystemPrompt != "Keep this instruction." {
+	if inputTextForTest(t, prompt.Input) != "Initial input" || prompt.AgentStateKey != "agents-api-"+h.session.ID || prompt.Model != "test-model" || prompt.SystemPrompt != "Keep this instruction." {
 		t.Fatalf("wrong resolved request: %+v", prompt)
 	}
 	if _, err := h.bound().Run(ctx, uuid.NewString(), h.session.ID, first.TurnID); !errors.Is(err, sessions.ErrNotFound) {
diff --git a/services/core/tests/integration/execution_tools_test.go b/services/core/tests/integration/execution_tools_test.go
index d1cd4a85d..77cf4c88f 100644
--- a/services/core/tests/integration/execution_tools_test.go
+++ b/services/core/tests/integration/execution_tools_test.go
@@ -19,8 +19,8 @@ func TestExecutionNegotiatesAndPersistsToolObservations(t *testing.T) {
 	env := h.read(testExecutionRequest)
 	var request proto.PromptRequestPayload
 	_ = env.DecodePayload(&request)
-	if !request.ObserveToolObservations || request.ObserveMessages {
-		t.Fatal("advertised capability was not requested")
+	if request.ObserveMessages {
+		t.Fatal("unadvertised message items were requested")
 	}
 	start := json.RawMessage(`{"kind":"mcp","server":"reference","name":"lookup","arguments":{"key":"value"},"status":"in_progress","output":null,"error":null}`)
 	complete := json.RawMessage(`{"kind":"mcp","server":"reference","name":"lookup","arguments":{"key":"value"},"status":"completed","output":{"content":[{"type":"text","text":"answer"}],"structuredContent":{"version":9007199254740993}},"error":null}`)
diff --git a/services/core/tests/integration/executor_fixture_test.go b/services/core/tests/integration/executor_fixture_test.go
index 0cde028d1..ca39a966b 100644
--- a/services/core/tests/integration/executor_fixture_test.go
+++ b/services/core/tests/integration/executor_fixture_test.go
@@ -92,7 +92,7 @@ func (h *dispatchHarness) executionFrame(env proto.Envelope) (proto.Envelope, bo
 		}
 		h.write(env.ID, proto.TypePreparationStatus, proto.PreparationStatusPayload{Handle: admission.handle, ExecutorID: admission.executor, Revision: 2, State: "started", RunID: start.RunID})
 		request := admission.prepare.Configuration
-		request.RunID, request.ConversationID, request.Input = start.RunID, admission.prepare.SessionID, start.Input
+		request.RunID, request.Input = start.RunID, start.Input
 		projected, err := proto.NewEnvelope(testExecutionRequest, start.RunID, request)
 		if err != nil {
 			h.t.Fatal(err)
diff --git a/services/core/tests/integration/harness_onboarding_test.go b/services/core/tests/integration/harness_onboarding_test.go
index 9f120e8cf..f8ad10c66 100644
--- a/services/core/tests/integration/harness_onboarding_test.go
+++ b/services/core/tests/integration/harness_onboarding_test.go
@@ -117,7 +117,7 @@ func TestThirdHarnessPublicOnboarding(t *testing.T) {
 	}
 	request("POST", "/v1/agents/sessions/"+created.ID+"/events", `{"events":[{"type":"agent.session.input.message","input":[{"role":"user","content":[{"type":"input_text","text":"hold"}]}]}]}`, 202)
 	next := awaitOnboardingPrompt(t, started)
-	if next.RunID == first.RunID || next.AgentSessionID != bound.NativeSessionID || !next.StrictResume {
+	if next.RunID == first.RunID || next.AgentSessionID != bound.NativeSessionID {
 		t.Fatal(next)
 	}
 	request("POST", "/v1/agents/sessions/"+created.ID+"/events", `{"events":[{"type":"agent.session.input.cancel"}]}`, 202)
@@ -262,7 +262,7 @@ func startOnboardingPeer(t *testing.T, h *dispatchHarness) (<-chan proto.PromptR
 					return
 				}
 				request := p.Configuration
-				request.RunID, request.ConversationID, request.Input = start.RunID, p.SessionID, start.Input
+				request.RunID, request.Input = start.RunID, start.Input
 				started <- request
 			}
 			if e.Type == proto.TypeExecutionRelease {
diff --git a/services/core/tests/integration/prepared_dispatch_test.go b/services/core/tests/integration/prepared_dispatch_test.go
index ca874936a..f4bca9404 100644
--- a/services/core/tests/integration/prepared_dispatch_test.go
+++ b/services/core/tests/integration/prepared_dispatch_test.go
@@ -77,7 +77,7 @@ func TestPreparedDispatchPromotesOriginalBatchAndPersistsCompletion(t *testing.T
 	result := runPreparedDispatch(h, t.Context(), pending)
 	frame := h.read(proto.TypeExecutionPrepare)
 	var prepare proto.ExecutionPreparePayload
-	if frame.DecodePayload(&prepare) != nil || len(prepare.Configuration.Input) != 0 || prepare.Configuration.RunID != "" || prepare.Configuration.ConversationID != "" || prepare.Configuration.LocalEnvironment == nil || prepare.Configuration.LocalEnvironment.ID != h.device.EnvironmentID || prepare.Configuration.DisableExecutionEnvironment {
+	if frame.DecodePayload(&prepare) != nil || len(prepare.Configuration.Input) != 0 || prepare.Configuration.RunID != "" || prepare.Configuration.LocalEnvironment == nil || prepare.Configuration.LocalEnvironment.ID != h.device.EnvironmentID || prepare.Configuration.DisableExecutionEnvironment {
 		t.Fatal("invalid preparation configuration", prepare)
 	}
 	session, err := sessionAdapter(h.s).GetSession(t.Context(), h.tenant, h.session.ID)
diff --git a/services/core/tests/integration/session_reads_fixture_test.go b/services/core/tests/integration/session_reads_fixture_test.go
index 43f097c11..6dbc04a1b 100644
--- a/services/core/tests/integration/session_reads_fixture_test.go
+++ b/services/core/tests/integration/session_reads_fixture_test.go
@@ -24,7 +24,7 @@ func FixtureEnvironmentDevice(ctx context.Context, pool *pgxpool.Pool, tenant, e
 	if err != nil {
 		return sessions.ExecutionDevice{}, err
 	}
-	lookup, err := sessionpg.DeviceLookup(tenant, current.SessionID)
+	lookup, err := sessionpg.ResourceLookup(tenant, current.SessionID)
 	if err != nil {
 		return sessions.ExecutionDevice{}, err
 	}
diff --git a/services/core/tests/integration/turn_journal_reads_test.go b/services/core/tests/integration/turn_journal_reads_test.go
index 09ee32b68..1bb705a24 100644
--- a/services/core/tests/integration/turn_journal_reads_test.go
+++ b/services/core/tests/integration/turn_journal_reads_test.go
@@ -50,7 +50,7 @@ type SubagentIdentity struct {
 // GetSubagentIdentity reads a binding in its authorized, visible Session. Only
 // tests read bindings back.
 func (s *Store) GetSubagentIdentity(ctx context.Context, tenantID, sessionID, nativeID string) (SubagentIdentity, error) {
-	p, err := sessionpg.DeviceLookup(tenantID, sessionID)
+	p, err := sessionpg.ResourceLookup(tenantID, sessionID)
 	if err != nil {
 		return SubagentIdentity{}, err
 	}