From 16efc7cf33113b1c0c2f38bab5fe642ee95599bb Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 23 Sep 2026 16:25:26 -0700
Subject: [PATCH 01/16] Key WATCHING on the command a line waits on, and fix
 alert edge inputs

- WATCHING keys on the last command of a list, past transparent wrappers,
  with script runners keyed as `<runner> <script>`; a bare runner rule still
  covers every script.
- bash reports the whole submitted line when history proves it, and a
  `bind -x` key (fzf) is no longer a command on bash 4+.
- fish 4 / kitty command lines on OSC 133;C are read.
- ConEmu OSC 9;<n> subcommands no longer ring.
- Panes no longer inherit another terminal's identity variables.
- Overflowed Doors surface their rings and TODOs on the "N more" arrows.
- A helper promoted mid-command keeps its running command.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 docs/specs/alert.md                           |  20 +-
 docs/specs/alert.rationale.md                 |   8 +
 docs/specs/layout.md                          |   5 +-
 docs/specs/terminal-escapes.md                |  13 +-
 docs/specs/terminal-escapes.rationale.md      |   6 +
 docs/specs/terminal-state.md                  |   6 +-
 lib/src/components/Baseboard.test.tsx         |  67 +++++
 lib/src/components/Baseboard.tsx              | 106 +++++--
 .../components/wall/TerminalContext.test.tsx  |  26 +-
 lib/src/components/wall/TerminalContext.tsx   |  13 +-
 .../components/wall/TerminalContextView.tsx   |   4 +-
 lib/src/components/wall/tool-takeover.test.ts |   2 +-
 lib/src/lib/alert-manager.test.ts             | 188 ++++++++++--
 lib/src/lib/alert-manager.ts                  |  72 +++--
 lib/src/lib/terminal-protocol.test.ts         |  80 +++++
 lib/src/lib/terminal-protocol.ts              | 107 ++++++-
 lib/src/lib/terminal-registry.alert.test.ts   |   4 +-
 lib/src/lib/terminal-registry.ts              |   3 +-
 lib/src/lib/terminal-state-store.ts           |  14 +-
 lib/src/lib/terminal-state.test.ts            | 130 +++++++-
 lib/src/lib/terminal-state.ts                 | 278 ++++++++++++++++--
 lib/src/lib/watched-commands.test.ts          |  56 ++--
 lib/src/lib/watched-commands.ts               |  49 ++-
 lib/src/stories/SettingsDialog.stories.tsx    |   7 +-
 lib/src/stories/TerminalContext.stories.tsx   |   2 +-
 .../stories/TerminalPaneHeader.stories.tsx    |  10 +-
 scripts/spec-word-budgets.json                |   8 +-
 standalone/sidecar/pty-core.js                |  30 +-
 standalone/sidecar/pty-core.test.js           |  87 ++++++
 standalone/sidecar/shell-integration.test.js  | 145 ++++++++-
 .../bash/shellIntegration.bash                |  53 +++-
 vscode-ext/README.md                          |   4 +-
 website/src/lib/tut-detector.test.ts          |   2 +-
 website/src/lib/tut-detector.ts               |   6 +-
 34 files changed, 1376 insertions(+), 235 deletions(-)

diff --git a/docs/specs/alert.md b/docs/specs/alert.md
index 828c3aeb4..2ea04de16 100644
--- a/docs/specs/alert.md
+++ b/docs/specs/alert.md
@@ -146,7 +146,7 @@ Source of truth: `awaitCompletion` in `lib/src/lib/alert-manager.ts`; `alertAwai
 
 ## WATCHING Track
 
-**Must key WATCHING by foreground command name.** A Session is watched exactly while that name belongs to the watched set; edits reach every matching Session. **Never add per-Session enable or mute** (rationale).
+**Must key WATCHING by the foreground command's watch key** (Rules, below). A Session is watched exactly while a rule covers that key; edits reach every matching Session. **Never add per-Session enable or mute** (rationale).
 
 **The output/silence detector is always on.** Every Session runs one `QuiesceDetector` for its whole lifetime, fed by every output chunk and reset at every command boundary. It never latches and knows nothing about attention or rules; the rule set decides only whether its state is publicly visible and whether a settle — a busy Session that stayed quiet — may *ring*.
 
@@ -154,14 +154,15 @@ Source of truth: `awaitCompletion` in `lib/src/lib/alert-manager.ts`; `alertAwai
 
 Rules:
 
-- The key is `commandArgv0(rawCommandLine)`: everything before the first pipeline/compound boundary, skipping leading `VAR=value` assignments and a leading `env`, then argv[0] reduced to its basename minus any launcher suffix (`docs/specs/terminal-state.md`). So `foo | claude` keys on `foo`, matching what bash's `DEBUG` trap reports. Pinned by `lib/src/lib/watched-commands.test.ts`.
+- **The key is `commandWatchKey(rawCommandLine)`**: the last command of a list (`&&`, `||`, `;`, `&`, newline) and the first stage of its pipeline, grouping dropped, leading `VAR=value` words and transparent wrappers (`sudo`, `npx`, …) skipped, then argv[0]'s basename minus any launcher suffix (`docs/specs/terminal-state.md`). **An unknown wrapper flag stops the skip**, keying the wrapper itself. **A script runner keys as `<runner> <script>`**, a leading `run` dropped, so `cd web && pnpm run dev` keys on `pnpm dev`; a script that is no valid key (a path) keys the runner (rationale). Where bash's `E` falls back to a line's first simple command (`docs/specs/terminal-escapes.md` → Shell-integration injection), that command keys. Pinned by `WATCHING key` in `lib/src/lib/terminal-state.test.ts`.
+- **A rule covers a key it equals, and a bare runner rule covers every `<runner> <script>` key of that runner** (rationale). `watchRuleFor` is the one matcher, for WATCHING, rule-removal silencing, and the terminal context's row.
 - **Every command boundary resets the detector** — `commandStart`, `commandFinish`, `promptStart`, `promptEnd`, and PTY exit — even without a command watch. Pinned by `resets unwatched output history on %s without a command watch` in `lib/src/lib/alert-manager.test.ts`.
 - **Editing the rule set re-derives WATCHING across every live Session immediately**, so a mid-command enable shows what that command is doing *right now* rather than a fresh `NOTHING_TO_SHOW` (rationale).
 - **A WATCHING ring outlives the command that raised it.** Watching switches off when the watched command exits; its ring and originating command key remain in `watchingRingingCommand`.
-- **Removing a rule silences its WATCHING rings**, even after the command has exited; other dismissal paths follow Clearing And TODO. A command merely ending never clears the ring.
+- **Removing a rule silences its WATCHING rings**, even after the command has exited, unless another rule still covers the command; other dismissal paths follow Clearing And TODO. A command merely ending never clears the ring.
 - **The rule set is app-global and persisted** (`dormouse:watched-commands`), starting empty, so WATCHING is off everywhere until the user turns it on. **The host is authoritative wherever one serves several webviews** — the VS Code extension host, and the standalone sidecar — so a stale webview can neither replace unrelated rules nor keep reporting an obsolete list: the first webview's persisted copy is taken as the seed, an edit is a delta, and the host broadcasts its canonical snapshot back. The seed/mutation/broadcast wire contract is `docs/specs/transport.md`.
 
-**Limitation:** WATCHING needs the shell to report command boundaries (`OSC 633` / `OSC 133`). Shells without integration (`docs/specs/terminal-escapes.md`) never report a command name, so WATCHING never engages and the terminal context reports `No command running`. Terminal reports still work; command-exit alerting also requires semantic command boundaries. **Never route the keystroke fallback in `docs/specs/terminal-state.md` into the `AlertManager`** (rationale).
+**Limitation:** WATCHING needs the shell to report its command line — `OSC 633 ; E`, or `cmdline_url` / `cmdline` on `OSC 133 ; C` (fish ≥ 4) — beside the boundaries. A shell reporting bare `OSC 133` boundaries, or none (`docs/specs/terminal-escapes.md`), never names a command, so WATCHING never engages and the terminal context reports `No command running`. Terminal reports still work; command-exit alerting also requires semantic command boundaries. **Never route the keystroke fallback in `docs/specs/terminal-state.md` into the `AlertManager`** (rationale).
 
 | State | Meaning |
 |---|---|
@@ -183,7 +184,7 @@ Meaningful output excludes resize redraw noise during `T_RESIZE_DEBOUNCE`; theme
 - **Never reset the detector for attention alone**; settles must reach awaits. **Must reset to `NOTHING_TO_SHOW` when attending or dismissing a WATCHING ring**, preventing its output tail from settling again.
 - **Rings must be caused by a fresh transition** — a settle the detector just reported — never by rerender, theme change, remount, minimize, or reattach.
 
-Source of truth: `commandArgv0` in `lib/src/lib/terminal-state.ts`; `QuiesceDetector` in `lib/src/lib/quiesce-detector.ts`; `onSettled` / `withdrawResumedWatchingRing` in `lib/src/lib/alert-manager.ts` (pinned by `lib/src/lib/alert-resumed-output.test.ts`); renderer mirror `lib/src/lib/watched-commands.ts`, multi-renderer coordinator `lib/src/lib/watched-command-host.ts`.
+Source of truth: `commandWatchKey` / `watchRuleFor` in `lib/src/lib/terminal-state.ts`; `QuiesceDetector` in `lib/src/lib/quiesce-detector.ts`; `onSettled` / `withdrawResumedWatchingRing` in `lib/src/lib/alert-manager.ts` (pinned by `lib/src/lib/alert-resumed-output.test.ts`); renderer mirror `lib/src/lib/watched-commands.ts`, multi-renderer coordinator `lib/src/lib/watched-command-host.ts`.
 
 ## Terminal reports
 
@@ -192,7 +193,7 @@ Source of truth: `commandArgv0` in `lib/src/lib/terminal-state.ts`; `QuiesceDete
 Sequence syntax lives in `docs/specs/terminal-escapes.md`; what each means here:
 
 - **Standalone `BEL`** — stripped from visible output and creates `TERMINAL_BELL_NOTIFICATION`. If the same parse batch also holds a richer OSC notification or progress event, **drop the generic bells** so they cannot overwrite useful preview text; multiple bells in one batch collapse to one notification.
-- **`OSC 9`** — the message becomes the body, title null. Empty sanitized messages are ignored. It also feeds title-candidate derivation (`docs/specs/terminal-state.md`), with no alert effect.
+- **`OSC 9`** — the message becomes the body, title null. Empty sanitized messages are ignored. It also feeds title-candidate derivation (`docs/specs/terminal-state.md`), with no alert effect. **A number, alone or before `;`, is a ConEmu subcommand** (`9;12`, a bare `9;9`) yielding neither notification nor title — except `9;4` below and `9;9;<cwd>` (`docs/specs/terminal-state.md`).
 - **`OSC 777`** — only the `notify` subcommand is supported; unsupported subcommands and empty sanitized notifications are ignored.
 - **`OSC 99`** (kitty) — chunked notifications keyed by `i`; completion rings once if the sanitized title or body is nonempty. **Management payloads (`p=?`, `p=close`, `p=alive`) contribute no content.** Incomplete chunk state is capped and expired.
 - **`OSC 9;4` progress** — progress only: no title, body, urgency, id, app name, or action fields.
@@ -325,7 +326,7 @@ Source of truth: `watchPushRings` / `invalidatePushDeviceRefreshes` in `lib/src/
 Reached from the baseboard sliders; `docs/specs/layout.md` owns placement. The alarm sections sit under the theme and shell rows; when both are hidden (VS Code owns the theme and the shells), the rule list is first and drops its section divider.
 
 - **Must toggle only the clicked baseboard alarm setting**, as an override for that Workspace, showing the effective value. Components without a Workspace scope edit application defaults. **Must show its shared settings section for 2 seconds, then fade for 250ms**, anchored to the button and bounded by the viewport. The preview is inert, announces the resulting state, preserves keyboard focus and command dispatch, and omits test actions. Each click replaces the preview and restarts its lifetime; opening Settings or unmounting clears it. Reduced motion skips the fade. Pinned by `Baseboard.test.tsx`.
-- Lists every watched command with a remove control, and **cannot add one** — WATCHING is keyed on a running command's name, so creating a rule stays the terminal context of a Pane running it, and the empty state says so. **It is the only place a rule set on a since-closed Pane can be removed**, the terminal context reaching only the command its own Pane is running.
+- Lists every watched command with a remove control, and **cannot add one** — WATCHING is keyed on a running command's watch key, so creating a rule stays the terminal context of a Pane running it, and the empty state says so. **It is the only place a rule set on a since-closed Pane can be removed**, the terminal context reaching only the command its own Pane is running.
 - The watcher group carries the **Defer alerts until animation stops** switch and explains that a fully armed watcher delays terminal notifications and withdraws a ring once watched work resumes.
 - **Delays are committed on blur or `Enter`, never per keystroke** — typing `3` on the way to `30` must not briefly install a 3-second timer. They are shown in seconds; an out-of-range or empty entry snaps back to whatever the store clamped it to.
 - **The push group's device line names every device a push would reach**, and otherwise says why there is none — no Burrow enrolled, nothing subscribed yet, or the server could not be asked (rationale).
@@ -372,11 +373,11 @@ Where it surfaces is host-specific:
 The header shows a fixed-text `TODO` pill when `todo === true`, a hover/focus notification preview when TODO has `notification`, and the terminal context opened by right-click or by `a`. **Never tint a ringing Session's header**: the Pane overlay already outlines it. Placement, sizing, and width tiers belong to `docs/specs/layout.md`.
 
 - **`a` on the selected Pane in command mode dismisses a ringing Session and opens the terminal context, whatever the status; it never edits a WATCHING rule.**
-- **A WATCHING rule is created only in the terminal context** ("Watch all `<cmd>` commands"), which offers the row whenever a foreground command is running, and removed there or in Settings. Removing it anywhere drops it for every Session running that command.
+- **A WATCHING rule is created only in the terminal context** ("Watch all `<key>` commands"), which offers the row whenever a foreground command has a watch key — naming the bare runner rule instead when one already covers the running script — and removed there or in Settings. Removing it anywhere drops it for every Session running that command.
 - Right-click always opens the context. Pressing `t` toggles TODO.
 - **The mobile composition dismisses by attention alone** — a tap or a keystroke — and wears its ring as the alarm inset, never an icon (`docs/specs/mobile-terminal-ui.md`). A Client cannot dismiss yet (`docs/specs/remote-api.md` → Future).
 
-**Must keep context alert controls scoped to the source**, with TODO, running-command WATCHING, and notification detail. Settings owns the global watched-command list. **Must suppress helper alerting until promotion, including after exit**, covering BEL/notification protocols, watched commands, TODO, speech, push, and attention projections; semantic command/readiness state remains active. Promotion starts ordinary alert behavior without replaying suppressed events.
+**Must keep context alert controls scoped to the source**, with TODO, running-command WATCHING, and notification detail. Settings owns the global watched-command list. **Must suppress helper alerting until promotion, including after exit**: no completion dispatch (await, ring, TODO, speech, push), protocol report, attention, or TODO control, and only the default state published. **A helper still tracks its command and feeds its detector**, so one promoted mid-command is WATCHING what it runs; promotion publishes that state and never replays a suppressed event (rationale). Pinned by `helper Sessions` in `lib/src/lib/alert-manager.test.ts`.
 
 Source of truth: `TerminalContext` in `lib/src/components/wall/TerminalContext.tsx`; `setHelper` in `lib/src/lib/alert-manager.ts`, which every host calls at helper spawn, listing, and promotion.
 
@@ -394,6 +395,7 @@ A Door is display-only for alert state:
 - while ringing with no speech state, wear the ring `spoken` uses, unlabelled, named `needs attention`
 - while its Session is `speaking`, replace the compact TODO cluster with the explicit `SPEAKING` label and invert + pulse the whole Door — that state lasts one utterance. `spoken` persists until the ring is attended, so it keeps a static high-contrast inset and adds a speaker icon *beside* the TODO pill instead of replacing it; those are the baseboard's persistent signals and **must not go dark for an unbounded window**
 - do not expose a Door-specific alert menu
+- scrolled out of view, its overflow arrow carries its ring and TODO (`docs/specs/layout.md` → Baseboard responsive sizing)
 
 Click or `Enter` on a Door reattaches into passthrough and clears a ring; `d` reattaches in command mode and leaves the ring intact (Attention).
 
diff --git a/docs/specs/alert.rationale.md b/docs/specs/alert.rationale.md
index f089f620b..d90887ac2 100644
--- a/docs/specs/alert.rationale.md
+++ b/docs/specs/alert.rationale.md
@@ -54,6 +54,12 @@
 
 **Why the alert state is retired before the PTY is killed.** A data chunk is enough to create a Session's entry, so killing first leaves output already in flight to rebuild an entry — and a `QuiesceDetector` that nothing will ever dispose. Raw output and resizes are exactly what a dying PTY emits; a semantic or protocol event may revive an id, because an id may be handed to a replacement pane and its first reported command start is evidence that somebody is home.
 
+**Why the key is the last command of a list, past its wrappers.** The old key, argv[0] of the first simple command, named the set-up rather than the work: `cd web && pnpm dev` keyed on `cd`, `clear; claude` on `clear`, and `sudo make`, `time make`, `caffeinate -i claude` and `npx claude` on the wrapper, so a rule offered from those panes matched every other use of `cd` or `sudo` (audit, 2026-09-23). The last command of a list is the one still running when the line settles; a pipeline's first stage is the producer whose output the pane shows. An unknown wrapper flag keys the wrapper because guessing whether it swallowed the next word would key an argument as a program.
+
+**Why runners key by script.** `pnpm dev` never finishes and `pnpm test` does; one `pnpm` rule rang for both, so watching a dev server's pane also rang every test run. `run` is dropped because `npm run test` and `npm test` are one script under two spellings.
+
+**Why a bare runner rule still covers every script.** Rules stored before script keys are bare runner names, and a user who watched `pnpm` asked for all of it; a new rule never loses ground an old one had.
+
 **Why a mid-command enable shows the current state.** Starting a fresh detector when a rule is added would report `NOTHING_TO_SHOW` for a command that has been busy for ten minutes.
 
 **Why the keystroke fallback is not routed into the manager.** The fallback in `docs/specs/terminal-state.md` is renderer-side and lower confidence than a shell-reported command boundary. Wiring it in would buy integration-less shells a worse version of WATCHING at the price of a second command-tracking path to keep in sync.
@@ -104,6 +110,8 @@ Guarding only completion leaves a stale `start` free to replace the active utter
 
 ## Pane Header
 
+**Why a helper tracks its command before promotion.** A helper dropped every semantic event, so one promoted while running `claude` had no command watch until its next command: no WATCHING, and no command-exit arm (audit, 2026-09-23). Command state alerts no one by itself; only dispatch and publishing have to wait for promotion.
+
 **Why `SPEAKING` may pulse unbounded and `SPOKEN` may not.** An utterance is seconds long and stops on its own, so the pulse it carries is self-bounding. `SPOKEN` persists until the ring is attended, so animating it would be exactly the per-Session animation with no end that bounding the burst exists to remove.
 
 **Why `cfg.alert.ringingPaused` suppresses the pulse.** It is the visual-snapshot freeze that pins the alarm; even a bounded animation could otherwise snapshot at an arbitrary phase during its first 2.6 seconds.
diff --git a/docs/specs/layout.md b/docs/specs/layout.md
index d67164047..08e5a0317 100644
--- a/docs/specs/layout.md
+++ b/docs/specs/layout.md
@@ -144,7 +144,7 @@ Source of truth: `SurfacePaneHeader` in `lib/src/components/wall/SurfacePaneHead
 
 The baseboard (`h-7`, 28px) sits below content, with no top divider. A 2px theme-colored gap preserves pane corners; 7px horizontal padding aligns doors with panes. With no doors above 350px wide, it shows `LCmd → RCmd to enter command mode` on macOS and `LShift → RShift to enter command mode` elsewhere.
 
-**Must group the right-hand controls**: the `N more →` overflow arrow, the host-supplied `notice` slot, then three always-present 24px square Settings buttons with 2px gaps. Their 16px icons are speaker/slashed-speaker for spoken alarms, filled `VibrateIcon`/`DeviceMobileSlashIcon` for push, and sliders for Settings. **Must expose each state through shape and `aria-pressed`.** The status buttons toggle their respective alarm settings; sliders opens Settings (`docs/specs/alert.md` → Settings dialog). **Must use the shared `chromeButton` hover treatment** for Settings and overflow buttons.
+**Must group the right-hand controls**: the `N more →` overflow arrow, the host-supplied `notice` slot, then three always-present 24px square Settings buttons with 2px gaps. Their 16px icons are speaker/slashed-speaker for spoken alarms, filled `VibrateIcon`/`DeviceMobileSlashIcon` for push, and sliders for Settings. **Must expose each state through shape and `aria-pressed`.** The status buttons toggle their respective alarm settings; sliders opens Settings (`docs/specs/alert.md` → Settings dialog). **Must use the shared `chromeButton` hover treatment** for Settings and overflow buttons, except a flagged overflow arrow, which like a Door has none.
 
 A minimized session becomes a **door**, showing its label plus the alert/TODO/speech badge cluster (`docs/specs/alert.md` → Door owns which badge shows when; both speech states also name themselves in the Door's `title` and accessible name). **A Door's label is header-derived only for a terminal-backed Surface** (`hasTerminal`); any other keeps its stored title, and a browser Door adds the display glyphs from `docs/specs/dor-browser.md` → "Browser Chrome". A Door uses the window's bottom edge as its bottom border, with left, top, and right borders taking the shared terminal top radius from `lib/src/components/design.tsx` — a mouse hole matching pane rounding. Dimensions: `min-w-[68px] max-w-[220px] h-6`.
 
@@ -164,7 +164,8 @@ Doors are measured in a hidden off-screen container first, then fitted:
 
 - **Subtract the measured right cluster and its gap before fitting anything** — that space is never available to doors. Measure only its always-present part (notice + the three settings controls): **never the overflow arrow**, whose presence is an *output* of the fit.
 - Add doors until no more fit, reserving room for a `N more →` button whenever items remain after the current one. **At least one door is always shown**, even if it overflows.
-- If scrolled, show `← N more` on the left and/or `N more →` on the right. Overflow counts are assumed single-digit (the hidden measurement button is `9 more`).
+- If scrolled, show `← N more` on the left and/or `N more →` on the right. Overflow counts are assumed single-digit (the hidden measurement buttons are `9 more` and `9 more TODO`).
+- **An arrow hiding a ringing or TODO Door must say so**, since that Door is otherwise gone from the baseboard: it wears the Door ground, a static `door` alarm inset while one rings, and a `TODO` mark while one has TODO, and its accessible name counts them (`3 more, 1 ringing, 1 TODO`). **Must reserve the measured TODO arrow width** wherever the Doors an arrow would hide include a TODO. Pinned by `Baseboard overflow alerts` in `lib/src/components/Baseboard.test.tsx`.
 - Clicking an overflow arrow reveals one door in that direction; a longer title may push more doors off the opposite side. **Must reveal the selected Door when selection or membership changes**, without overriding manual overflow scrolling (`lib/src/components/Baseboard.test.tsx`).
 - Extreme case — one door with a very long title and more doors on both sides: show both arrows with counts and as much title as fits, ellipsis for the rest.
 
diff --git a/docs/specs/terminal-escapes.md b/docs/specs/terminal-escapes.md
index 465e8760a..57d16e520 100644
--- a/docs/specs/terminal-escapes.md
+++ b/docs/specs/terminal-escapes.md
@@ -22,7 +22,7 @@ State-driving and security-sensitive OSCs — plus the `CSI > q` query — are p
 
 **Must buffer an unterminated consumed OSC up to `OSC_INCOMPLETE_LIMIT` (16,384 UTF-16 code units), then discard through its terminator or cancellation**, retaining only a split `ESC`, never promoting payload to text or its terminating BEL to an alert (rationale). A complete sequence in a single read is parsed whole. Pinned by `discards an oversized consumed OSC through its %j terminator` in `lib/src/lib/terminal-protocol.test.ts`. **An unterminated OSC the parser will forward streams to xterm.js instead**, preserving a split `ESC \` terminator (rationale). **Route by the OSC id, and decide nothing while more digits could follow** — `133` becomes `1337` — for `1337` by the subcommand ([Inline graphics](#inline-graphics)).
 
-**Every semantic value `TerminalProtocolParser` *retains* is bounded and stripped of control characters before storage**, whatever the emitter: `TITLE_LIMIT` / `BODY_LIMIT` for titles and notification bodies, whose whitespace controls collapse to spaces before the trim; `COMMAND_LINE_LIMIT` for the OSC 633 `E` command line, bounded *before* the `\xNN` unescape and sanitized *after* it (rationale); `MAX_CWD_LENGTH` for every CWD source, interior whitespace preserved. **Every limit counts code points**, so a cut never splits a surrogate pair. **A value that reduces to nothing is dropped, never stored empty.**
+**Every semantic value `TerminalProtocolParser` *retains* is bounded and stripped of control characters before storage**, whatever the emitter: `TITLE_LIMIT` / `BODY_LIMIT` for titles and notification bodies, whose whitespace controls collapse to spaces before the trim; `COMMAND_LINE_LIMIT` for the command line (`OSC 633 ; E`, `OSC 133 ; C`), bounded *before* its decoding and sanitized *after* it (rationale); `MAX_CWD_LENGTH` for every CWD source, interior whitespace preserved. **Every limit counts code points**, so a cut never splits a surrogate pair. **A value that reduces to nothing is dropped, never stored empty.**
 
 **The owner alone acts on the events** its parse produced — writing the responses, recording the semantic state — and hands every consumer the same chunk ([remote-api.md](remote-api.md#terminal-surfaces)).
 
@@ -55,8 +55,9 @@ Replay (`pty:replay`) is the raw stream requiring re-parse: **the webview runs a
 | `OSC 9 ; <message> ST` | iTerm2 legacy notification | [alert.md](alert.md#terminal-reports) |
 | `OSC 9 ; 4 ; <state> [; <progress>] ST` | iTerm2 progress | [alert.md](alert.md#terminal-reports) |
 | `OSC 9 ; 9 ; <cwd> ST` | CWD (Windows Terminal / ConEmu) | [terminal-state.md](terminal-state.md#supported-osc-inputs) |
+| `OSC 9 ; <n> [; ...] ST` | Any other ConEmu subcommand — sleep, tab title, GuiMacro, the `9;12` prompt mark, a bare `9;9`; consumed and ignored | [alert.md](alert.md#terminal-reports) |
 | `OSC 99 ; <metadata> ; <payload> ST` | kitty desktop notification. Dormouse also **answers** the `p=?` capability query with `OSC 99 ; [i=<id>:]p=? ; o=always:p=title,body ST`. | [alert.md](alert.md#terminal-reports) |
-| `OSC 133 ; A/B/C/D [...] ST` | Prompt/command boundaries; command-exit alert input | [terminal-state.md](terminal-state.md#supported-osc-inputs), [alert.md](alert.md#command-exit-track) |
+| `OSC 133 ; A/B/C/D [...] ST` | Prompt/command boundaries, `C` optionally carrying the command line (`cmdline_url=` / `cmdline=`); command-exit alert input | [terminal-state.md](terminal-state.md#supported-osc-inputs), [alert.md](alert.md#command-exit-track) |
 | `OSC 633 ; A/B/C/D ST` | VS Code prompt/command boundaries; command-exit alert input | [terminal-state.md](terminal-state.md#supported-osc-inputs), [alert.md](alert.md#command-exit-track) |
 | `OSC 633 ; E ; <commandline> [; <nonce>] ST` | VS Code command line | [terminal-state.md](terminal-state.md#supported-osc-inputs) |
 | `OSC 633 ; P ; Cwd=<cwd> ST` | CWD (VS Code) | [terminal-state.md](terminal-state.md#supported-osc-inputs) |
@@ -160,6 +161,8 @@ Environment for spawned PTYs:
 
 **Never advertise** feature-specific support before the behavior exists; the device answer's shape is in [Supported CSI](#supported-csi).
 
+**Must strip another terminal's identity from the inherited environment before setting Dormouse's** — its session, version, and multiplexer variables — so a tool never drives a terminal that is not there (rationale). Source of truth: `FOREIGN_TERMINAL_ENV` in `standalone/sidecar/pty-core.js`, pinned by `standalone/sidecar/pty-core.test.js`.
+
 The identity provokes more iTerm2 escape codes than Dormouse implements, so **unsupported escape codes must fail inertly** — consumed or ignored, with no visible terminal garbage, privilege escalation, clipboard access, file access, or focus stealing; OSC and CSI alike ([Pass-through and fail-inertly](#pass-through-and-fail-inertly)).
 
 ## Shell-integration injection
@@ -171,7 +174,7 @@ The identity provokes more iTerm2 escape codes than Dormouse implements, so **un
 | Shell | Mechanism | Channel | Notes |
 |---|---|---|---|
 | zsh | `ZDOTDIR` → our dotfiles chain to the user's, then install `precmd`/`preexec` hooks | env (as reliable as the `PATH` prepend) | **Nothing may be written into our directory when shipped** — signed macOS app bundle (rationale). **A `HISTFILE` set inside it is redirected to `USER_ZDOTDIR`**; a user-set one is never touched. |
-| bash | `--init-file` → our script installs a `DEBUG`-trap / `PROMPT_COMMAND` hook | shellArgs | **Injected only when the launch args are *purely* interactive/login flags** (`-i`/`-l`/`--login`), so Git Bash's `--login -i` is covered and a specific `-c <cmd>` is not (rationale). **The whole argv is replaced with `--init-file <script>`** — `-l` and `-i` go with it, and the script replicates login startup itself. **`E` is a pipeline's first simple command**; boundaries and exit codes stay exact. |
+| bash | `--init-file` → our script installs a `DEBUG`-trap / `PROMPT_COMMAND` hook | shellArgs | **Injected only when the launch args are *purely* interactive/login flags** (`-i`/`-l`/`--login`), so Git Bash's `--login -i` is covered and a specific `-c <cmd>` is not (rationale). **The whole argv is replaced with `--init-file <script>`** — `-l` and `-i` go with it, and the script replicates login startup itself. **`E` is the submitted line, read back from history only when the last entry provably is it**, else its first simple command, `$BASH_COMMAND` (rationale). **From bash 4.0 a `bind -x` key is no command**; on 3.2 it still is (rationale). Boundaries and exit codes stay exact. |
 | PowerShell | dot-source a script that wraps the user's `prompt` and PSReadLine's `PSConsoleHostReadLine`; covers `pwsh` and `powershell.exe` | shellArgs | Injected for any **interactive** launch — a bare REPL gets `-NoExit -Command ". '<script>'"`, one already carrying a startup command gets our dot-source *appended* (rationale); non-interactive one-offs (`-Command`/`-File`/`-EncodedCommand` without `-NoExit`) are left untouched. **`-NoProfile` is never passed.** **Without PSReadLine the whole triple falls back to the next prompt**, boundaries and exit codes still exact (rationale). |
 | WSL | `wsl.exe -d <distro> -- sh -c <detector>` → the detector execs the distro's bash with our `--init-file`, referenced via its `/mnt/...` path | shellArgs (Windows-side injection cannot reach inside the distro) | **Injected only for the exact two-argument `-d <distro>` launch** the shell picker emits. The detector reads `/etc/passwd` and prefers bash, stepping aside only for an explicitly configured zsh or fish login shell (rationale). **bash is the only integrated WSL shell**; assumes the default `/mnt` automount root. |
 | cmd.exe | no per-command hook exists | — | Never gets real OSC 633; always uses the keystroke fallback below. |
@@ -183,7 +186,7 @@ Wired in `applyShellIntegration`, called from `resolveSpawnConfig` (`standalone/
 - **`E` (command line)** is escaped by `__dormouse_633_escape`: BEL, ESC and the C1 ST alongside `\`, `;`, LF and CR. The parser decodes `\xNN` back, so it still reports verbatim.
 - **`Cwd=`** is read verbatim, no `\xNN` decoding, so a Windows path's backslashes arrive intact — `__dormouse_633_safe_cwd` therefore *removes* control characters instead of escaping them, preserving backslashes and semicolons. **Under `LC_ALL=C` the scripts strip the C1 ST explicitly first**, `[[:cntrl:]]` not matching its two ordinary bytes.
 
-Source of truth: `__dormouse_633_escape` and `__dormouse_633_safe_cwd` in each of `standalone/sidecar/shell-integration/bash/shellIntegration.bash`, `standalone/sidecar/shell-integration/zsh/.zshrc`, `standalone/sidecar/shell-integration/pwsh/shellIntegration.ps1`; pinned by `standalone/sidecar/shell-integration.test.js`, which spawns real bash and zsh rather than mocking them, hard-fails if bash is absent, and names any uncovered shell out loud.
+Source of truth: `__dormouse_633_escape` and `__dormouse_633_safe_cwd` in each of `standalone/sidecar/shell-integration/bash/shellIntegration.bash`, `standalone/sidecar/shell-integration/zsh/.zshrc`, `standalone/sidecar/shell-integration/pwsh/shellIntegration.ps1`, and bash's `E` in `__dormouse_633_command_line`; pinned by `standalone/sidecar/shell-integration.test.js`, which spawns real bash (on a PTY for `E`) and zsh rather than mocking them, hard-fails if bash is absent, and names any uncovered shell out loud.
 
 ### Keystroke fallback
 
@@ -206,4 +209,4 @@ Two escape-aware consumers are **not** parse sites: `lib/src/lib/terminal-contro
 
 ## Future
 
-- **fish shell integration** — inject via `XDG_DATA_DIRS`: fish auto-sources `*/fish/vendor_conf.d/*.fish`, so the integration ships as a vendor conf file (env channel, as reliable as the `PATH` prepend). Until it lands, fish panes use the keystroke fallback above.
+- **fish shell integration** — inject via `XDG_DATA_DIRS`: fish auto-sources `*/fish/vendor_conf.d/*.fish`, so the integration ships as a vendor conf file (env channel, as reliable as the `PATH` prepend). Until it lands, fish ≥ 4 reports `OSC 133` itself, command line included, and older fish uses the keystroke fallback above.
diff --git a/docs/specs/terminal-escapes.rationale.md b/docs/specs/terminal-escapes.rationale.md
index 427347511..ae3809b34 100644
--- a/docs/specs/terminal-escapes.rationale.md
+++ b/docs/specs/terminal-escapes.rationale.md
@@ -76,6 +76,8 @@ Keying this on the disposition rather than on an IIP command list also fixes the
 
 **Why claim to be iTerm2.** Shells, build systems and agent clients gate their richest escape output on a terminal they recognize, and iTerm2 is the identity that unlocks the largest set of the sequences Dormouse actually implements; the fail-inertly rule pays for the ones it also provokes.
 
+**Why another terminal's identity is stripped.** A pane inherits the host's environment, and the host inherits whatever launched it. Fedora's `vte.sh` sees `VTE_VERSION` and emits an `OSC 777` notification after every command; `WT_SESSION`, `ConEmuANSI`, `TERM_FEATURES` and the Konsole and Ptyxis versions switch on cargo's `OSC 9;4` progress, so every build rang; `TMUX` / `STY` send tools to a multiplexer that is not there — Codex and Claude Code wrap their notifications in tmux's passthrough; and `CURSOR_TRACE_ID` makes Claude Code believe it runs in Cursor's terminal, which leaves it no notification channel (audit, 2026-09-23). `COLORFGBG` would contradict the background the OSC 11 answer reports.
+
 **Why `COLORTERM` is set even though it is not iTerm2's.** The PTY is spawned as `xterm-256color` with no other depth hint, so env-sniffing tools — `supports-color` and everything built on it — quantize RGB output to the nearest palette entry.
 
 ## Shell-integration injection
@@ -86,6 +88,10 @@ Keying this on the disposition rather than on an IIP command list also fixes the
 
 **Why bash injection keys on the launch args.** `--init-file` and login mode are mutually exclusive, so the script has to replace login-profile sourcing itself, which is only safe when the launch was a plain interactive/login shell — Git Bash's `--login -i` is why login flags stay in the allowed set, while anything with a specific `-c <cmd>` is a job, not a session.
 
+**Why bash reads `E` back from history, and when it declines.** In the `DEBUG` trap `$BASH_COMMAND` is only the simple command about to run, so `cd web && pnpm dev` reported `cd web` and keyed on `cd`. The last history entry is the line only if reading it added one: ignorespace, ignoredups, `HISTIGNORE`, `set +o history` and `HISTSIZE` all leave the previous entry in place, and that entry often contains the current first command (` cd /` after `cd / && echo hi`). A count taken at the prompt cannot tell: `HISTCMD` reads 1 inside traps and `PROMPT_COMMAND` before bash 5.1, and erasedups renumbers. `fc -l` skips the current line by bash's own did-this-line-add-an-entry flag, which is exact; bash 3.2 leaves that flag stale while history is off, hence the history-on check. A line that added nothing is still the last entry when only ignoredups (or a multi-line command's joined entry) explains it; under ignoreboth a leading space could explain it too, so a repeat falls back. The containment check against `$BASH_COMMAND` exists for traps fired outside a fresh line — a hook appended after ours, a `bind -x` key on 3.2 — which would otherwise re-report the previous line. Measured on bash 3.2.57 (macOS and Linux), 4.4.23, 5.0.18, 5.1.16, 5.2.37 and 5.3.20, 2026-09.
+
+**Why a `bind -x` key is recognized by `READLINE_LINE`.** The key's command runs through the same `DEBUG` trap while the prompt is armed, so it was reported as the command and spent the arming: the line it left, as fzf's Ctrl-R leaves the chosen command, ran with no `E`/`C` at all. From bash 4.0 `READLINE_LINE` is bound for exactly the key command's run and unbound after it. 3.2 binds nothing, and nothing else the trap can read differs from a submitted line — `BASH_SOURCE`, `BASH_LINENO`, `FUNCNAME`, `$-`, `BASH_SUBSHELL` — while its `READLINE_LINE` is an ordinary variable that a widget written for 4.x leaves set, which would silence every later line without the version check. Measured on bash 3.2.57 (macOS), 4.0.44, 4.4.23, 5.0.18, 5.2.37 and 5.3.20, 2026-09.
+
 **Why the PowerShell dot-source is appended, not prepended.** A launch that already carries a startup command — the VS "Developer PowerShell" arrives as `-NoExit -Command "& { Import-Module … }"` — is setting up an environment our wrapper should install *after*, or the wrapper wraps a `prompt` that the startup command then replaces.
 
 **Why PSReadLine matters.** PowerShell has no `preexec`, so the only hook that fires between submitting a command and running it is `PSConsoleHostReadLine`, which PSReadLine supplies; wrapping it is what makes the running command appear immediately, as it does under bash and zsh. The fallback reconstructs the `E`/`C`/`D` triple from the next prompt with the command line pulled from history, leaving the running command invisible until it finishes.
diff --git a/docs/specs/terminal-state.md b/docs/specs/terminal-state.md
index 6b40233f3..676f1bb06 100644
--- a/docs/specs/terminal-state.md
+++ b/docs/specs/terminal-state.md
@@ -53,7 +53,7 @@ Command lifecycle:
 |---|---|
 | `OSC 133 ; A ST` / `OSC 633 ; A ST` | `promptStart` |
 | `OSC 133 ; B ST` / `OSC 633 ; B ST` | `promptEnd` |
-| `OSC 133 ; C ST` | `commandStart(source: "osc133_boundaries")` |
+| `OSC 133 ; C [; <key>=<value> ...] ST` | `commandLine` when a command line is present — fish ≥ 4's percent-encoded UTF-8 `cmdline_url`, else kitty's `printf %q` `cmdline`, which runs to the end of the sequence — bounded and sanitized like `E`; then `commandStart(source: "osc133_boundaries")`. |
 | `OSC 633 ; E ; <commandline> [; <nonce>] ST` | `commandLine`; parses only the command field, decoding VS Code `\xAB` / `\\` escapes. Bounded and sanitized like every retained value; one reducing to nothing emits nothing ([terminal-escapes.md](terminal-escapes.md)). |
 | `OSC 633 ; C ST` | `commandStart(source: "osc633_boundaries")`. The reducer re-labels the stored run `osc633_E` when a command line is pending; the *event* source stays a boundary, which is what promotes the pane to OSC-driven ([Keystroke fallback](#keystroke-fallback)). |
 | `OSC 133 ; D ; <exitCode?> ST` / `OSC 633 ; D ; <exitCode?> ST` | `commandFinish` |
@@ -91,11 +91,11 @@ Source of truth: `cwdFromManualPath` in `lib/src/lib/terminal-state.ts`; `seedTe
 - `cwd` replaces the latest session CWD (no-op when both identity and source are unchanged).
 - `promptStart` sets `{ kind: "prompt" }`; `promptEnd` sets `{ kind: "editing" }`. **Both clear `currentCommand` and `pendingCommandLine`** (rationale).
 - `commandLine` stores `pendingCommandLine`.
-- `commandStart` creates `currentCommand`, snapshots `cwdAtStart`, uses `event.startedAt` when present, clears `pendingCommandLine`, and sets `{ kind: "running" }`. `displayCommand` is the summarized pending command line; with none pending (`OSC 133 ; C` carries no command) it falls back to the newest OSC 0/2/9 title candidate, then to the literal `shell`.
+- `commandStart` creates `currentCommand`, snapshots `cwdAtStart`, uses `event.startedAt` when present, clears `pendingCommandLine`, and sets `{ kind: "running" }`. `displayCommand` is the summarized pending command line; with none pending (a bare `OSC 133 ; C`) it falls back to the newest OSC 0/2/9 title candidate, then to the literal `shell`.
 - `commandFinish` moves `currentCommand` to `lastCommand`, stores `event.finishedAt` (otherwise reducer time) and `exitCode`, snapshots the latest in-run OSC 0/2/9 title into `lastCommand.finalTerminalTitle` (titles older than `startedAt` or younger than `finishedAt` excluded), clears `currentCommand`, and sets `{ kind: "finished", exitCode }`. **With no `currentCommand` it only sets the activity**, never inventing a `lastCommand`.
 - `title` updates the per-source entry in `titleCandidates`. **Later OSC title events never erase earlier candidates from other sources.**
 
-Command-line tokenizing is dialect-free: **`\` escapes exactly the set `shellEscapePosix` writes** (`POSIX_ESCAPABLE` in `lib/src/lib/posix-escape.ts`; both halves pinned by `terminal-state.test.ts`). **A leading `&` is PowerShell's call operator, never a POSIX background suffix**, and is dropped rather than read as a boundary. **An unquoted Windows path containing spaces stays split.** **A launcher suffix is not part of a program's name** — `npm.cmd` and `C:\tools\claude.exe` are `npm` and `claude` for the header, the WATCHING key, and the terminal context alike. Accepted: `foo.bat` and `foo.exe` in one directory cannot be watched separately. (rationale)
+Command-line tokenizing is dialect-free: **`\` escapes exactly the set `shellEscapePosix` writes** (`POSIX_ESCAPABLE` in `lib/src/lib/posix-escape.ts`; both halves pinned by `terminal-state.test.ts`). **A leading `&` is PowerShell's call operator, never a POSIX background suffix**, and is dropped rather than read as a boundary. **An unquoted newline separates commands like `;`**; a backslash-newline continues the line. **An unquoted Windows path containing spaces stays split.** **A launcher suffix is not part of a program's name** — `npm.cmd` and `C:\tools\claude.exe` are `npm` and `claude` for the header, the WATCHING key, and the terminal context alike. Accepted: `foo.bat` and `foo.exe` in one directory cannot be watched separately. (rationale)
 
 **`displayCommand` is a per-program summary of those tokens** — the program name plus a bounded argument count, suffixed `| ...` or ` ...` past a pipeline or compound boundary. Source of truth: `summarizeCommandLine` and `commandTitleTokens` in `lib/src/lib/terminal-state.ts`.
 
diff --git a/lib/src/components/Baseboard.test.tsx b/lib/src/components/Baseboard.test.tsx
index 78251a45c..978c686ff 100644
--- a/lib/src/components/Baseboard.test.tsx
+++ b/lib/src/components/Baseboard.test.tsx
@@ -28,6 +28,7 @@ import {
 import { resetShellStore, seedShellStore } from '../lib/shell-store';
 import { addPlainNote, clearAllNotepads } from '../lib/notepad/notepad-store';
 import { resetPushDevices, setPushDevices, setPushDevicesRefresher } from '../lib/push-devices';
+import { clearTerminalActivity, setTerminalActivity } from '../lib/session-activity-store';
 
 globalThis.IS_REACT_ACT_ENVIRONMENT = true;
 
@@ -386,6 +387,72 @@ describe('Baseboard Door notepad', () => {
 });
 
 
+describe('Baseboard overflow alerts', () => {
+  afterEach(() => act(() => clearTerminalActivity()));
+
+  const items = ['a', 'b', 'c', 'd'].map(id => ({ id, title: id, kind: 'terminal' as const }));
+  const renderSelected = (selected: string) => act(() => root.render(
+    <SelectedIdContext.Provider value={selected}><Baseboard items={items} onReattach={() => {}} /></SelectedIdContext.Provider>,
+  ));
+  const arrow = (direction: 'left' | 'right') => container.querySelector<HTMLButtonElement>(`[data-overflow-arrow="${direction}"]`);
+
+  it('marks an overflow arrow for the ringing and TODO Doors it hides', () => {
+    act(() => {
+      setTerminalActivity('b', { status: 'ALERT_RINGING' });
+      setTerminalActivity('c', { todo: true });
+      setTerminalActivity('d', { status: 'ALERT_RINGING', todo: true });
+    });
+    // The zero-width test viewport fits exactly one Door.
+    renderSelected('a');
+    const right = arrow('right');
+    expect(right?.getAttribute('aria-label')).toBe('3 more, 2 ringing, 2 TODO');
+    expect(right?.querySelector('[data-alert-ring-inset="door"]')).not.toBeNull();
+    expect(right?.textContent).toContain('TODO');
+    // Static: the arrow never replays the arrival burst.
+    expect(right?.querySelector('[data-alert-ring-inset]')?.className).not.toContain('animate');
+    expect(arrow('left')).toBeNull();
+
+    // The same on the other side, for exactly the Doors hidden there.
+    renderSelected('d');
+    expect(arrow('left')?.getAttribute('aria-label')).toBe('3 more, 1 ringing, 1 TODO');
+    expect(arrow('right')).toBeNull();
+  });
+
+  it('leaves an arrow plain while the Doors it hides owe nothing', () => {
+    act(() => setTerminalActivity('a', { status: 'ALERT_RINGING', todo: true }));
+    renderSelected('a');
+    const right = arrow('right');
+    expect(right?.getAttribute('aria-label')).toBe('3 more');
+    expect(right?.querySelector('[data-alert-ring-inset]')).toBeNull();
+    expect(right?.textContent).not.toContain('TODO');
+  });
+
+  it('reserves the wider arrow a hidden TODO Door needs', () => {
+    vi.stubGlobal('ResizeObserver', class {
+      constructor(private callback: ResizeObserverCallback) {}
+      observe(target: HTMLElement) {
+        const width = target.classList.contains('h-7') ? 244 : 72;
+        this.callback([{ target, contentRect: { width } } as ResizeObserverEntry], this as unknown as ResizeObserver);
+      }
+      disconnect() {}
+    });
+    // Budget 244 - 72 = 172: two 60px Doors fit beside a 20px arrow, not a 60px one.
+    vi.spyOn(HTMLElement.prototype, 'offsetWidth', 'get').mockImplementation(function (this: HTMLElement) {
+      if (this.getAttribute('role') === 'group') return 60;
+      if (this.tagName === 'BUTTON') return this.textContent?.includes('TODO') ? 60 : 20;
+      return 16;
+    });
+    const three = items.slice(0, 3);
+    const render = () => act(() => root.render(<Baseboard items={three} onReattach={() => {}} />));
+    render();
+    expect(container.querySelectorAll('[data-door-id]')).toHaveLength(2);
+    act(() => setTerminalActivity('c', { todo: true }));
+    render();
+    expect(container.querySelectorAll('[data-door-id]')).toHaveLength(1);
+    expect(arrow('right')?.getAttribute('aria-label')).toBe('2 more, 1 TODO');
+  });
+});
+
 describe('Baseboard Tool unsaved changes', () => {
   afterEach(() => act(() => resetToolDirty()));
 
diff --git a/lib/src/components/Baseboard.tsx b/lib/src/components/Baseboard.tsx
index e1801a5ca..bf5398809 100644
--- a/lib/src/components/Baseboard.tsx
+++ b/lib/src/components/Baseboard.tsx
@@ -1,7 +1,7 @@
 import { getToolDirtySnapshot, subscribeToToolDirty } from '../lib/tool-dirty-store';
 import { setWorkspaceAlertDelivery } from '../lib/workspace-store';
 import { useWorkspaceAlertPolicy } from './wall/use-workspace-alert-policy';
-import { useCallback, useRef, useState, useMemo, useLayoutEffect, useContext, useSyncExternalStore, type ReactNode } from 'react';
+import { useCallback, useRef, useState, useMemo, useLayoutEffect, useContext, useSyncExternalStore, type ReactNode, type Ref } from 'react';
 import {
   DeviceMobileSlashIcon,
   CaretLeftIcon,
@@ -11,7 +11,8 @@ import {
   SpeakerSlashIcon,
   VibrateIcon,
 } from '@phosphor-icons/react';
-import { chromeButton } from './design';
+import { chromeButton, TERMINAL_TOP_RADIUS_CLASS, TODO_PILL_TRACKING_CLASS } from './design';
+import { AlertRingInset } from './alert-ring';
 import { SettingsDialog, type AlarmSink } from './SettingsDialog';
 import { SettingsPreview } from './SettingsPreview';
 import { Door } from './Door';
@@ -46,11 +47,66 @@ const BASEBOARD_BUTTON_CLASS = chromeButton({
   kind: 'labeled',
   className: 'h-6 shrink-0 justify-center pb-px text-sm font-medium font-mono text-muted hover:text-foreground',
 });
+/** An overflow arrow hiding a ringing or TODO Door stands in for it, so it
+ *  wears a Door's ground — the one its alarm inset is contrast-picked for — and,
+ *  like a Door, no hover wash. */
+const FLAGGED_OVERFLOW_BUTTON_CLASS = chromeButton({
+  kind: 'labeled',
+  className: `relative h-6 shrink-0 justify-center overflow-hidden pb-px text-sm font-medium font-mono bg-door-bg text-door-fg hover:bg-door-bg rounded-b-none ${TERMINAL_TOP_RADIUS_CLASS}`,
+});
 const SETTINGS_BUTTON_CLASS = chromeButton({
   kind: 'icon',
   className: 'h-6 w-6 shrink-0 pb-px hover:text-foreground focus-visible:outline focus-visible:outline-1 focus-visible:outline-focus-ring',
 });
 
+/** What the Doors behind one overflow arrow owe the user. */
+interface OverflowAlerts {
+  ringing: number;
+  todo: number;
+}
+
+const NO_OVERFLOW_ALERTS: OverflowAlerts = { ringing: 0, todo: 0 };
+
+/**
+ * `← N more` / `N more →`. A ringing or TODO Door scrolled out of view must not
+ * vanish from the baseboard, so the arrow carries a static alarm inset and a
+ * TODO mark for what it hides, and says so in its name
+ * (`docs/specs/layout.md` → Baseboard responsive sizing).
+ */
+function OverflowArrow({ direction, count, alerts, onClick, measureRef }: {
+  direction: 'left' | 'right';
+  count: number;
+  alerts: OverflowAlerts;
+  onClick?: () => void;
+  /** Set on the hidden measurement copies, which the fitting pass reads. */
+  measureRef?: Ref<HTMLButtonElement>;
+}) {
+  const flagged = alerts.ringing > 0 || alerts.todo > 0;
+  const label = [
+    `${count} more`,
+    alerts.ringing > 0 && `${alerts.ringing} ringing`,
+    alerts.todo > 0 && `${alerts.todo} TODO`,
+  ].filter(Boolean).join(', ');
+  const Caret = direction === 'left' ? CaretLeftIcon : CaretRightIcon;
+  return (
+    <button
+      ref={measureRef}
+      className={flagged ? FLAGGED_OVERFLOW_BUTTON_CLASS : BASEBOARD_BUTTON_CLASS}
+      data-overflow-arrow={measureRef ? undefined : direction}
+      aria-label={measureRef ? undefined : label}
+      tabIndex={measureRef ? -1 : undefined}
+      title={flagged && !measureRef ? label : undefined}
+      onClick={onClick}
+    >
+      {direction === 'left' && <Caret size={10} weight="bold" />}
+      {count} more
+      {alerts.todo > 0 && <span className={`text-xs font-semibold ${TODO_PILL_TRACKING_CLASS}`}>TODO</span>}
+      {direction === 'right' && <Caret size={10} weight="bold" />}
+      {alerts.ringing > 0 && <AlertRingInset ground="door" burst={null} className={TERMINAL_TOP_RADIUS_CLASS} />}
+    </button>
+  );
+}
+
 export interface BaseboardProps {
   items: DoorChip[];
   onReattach: (item: DooredItem) => void;
@@ -89,9 +145,11 @@ export function Baseboard({ items, onReattach, notice, onDoorDragStart }: Basebo
   // than one on every activity notification.
   const [doorWidths, setDoorWidths] = useState<number[]>([]);
   const arrowMeasureEl = useRef<HTMLButtonElement>(null);
+  const todoArrowMeasureEl = useRef<HTMLButtonElement>(null);
   const rightClusterEl = useRef<HTMLDivElement>(null);
   const [rightClusterWidth, setRightClusterWidth] = useState(0);
-  const layoutMetrics = useRef({ doorGap: 0, arrowWidth: 0 });
+  // A hidden TODO Door widens its arrow by the mark, so both widths are measured.
+  const layoutMetrics = useRef({ doorGap: 0, arrowWidth: 0, todoArrowWidth: 0 });
   const [settingsOpen, setSettingsOpen] = useState(false);
   // Which Door's notepad popover is open, with the rect it was anchored on. The
   // rect is kept rather than re-read: a pin reattaches the Surface, so the Door
@@ -160,6 +218,9 @@ export function Baseboard({ items, onReattach, notice, onDoorDragStart }: Basebo
     if (arrowMeasureEl.current) {
       layoutMetrics.current.arrowWidth = arrowMeasureEl.current.offsetWidth;
     }
+    if (todoArrowMeasureEl.current) {
+      layoutMetrics.current.todoArrowWidth = todoArrowMeasureEl.current.offsetWidth;
+    }
   }, [items, activityStates, speechStates, terminalStates, notepadNotes, dirtyTools]);
 
   const itemKey = useMemo(() => items.map(i => i.id).join('\0'), [items]);
@@ -175,18 +236,28 @@ export function Baseboard({ items, onReattach, notice, onDoorDragStart }: Basebo
   let visibleCount = 0;
   let usedWidth = 0;
 
+  const alertsOf = (item: DoorChip): OverflowAlerts => {
+    const activity = activityStates.get(item.id) ?? DEFAULT_ACTIVITY_STATE;
+    return { ringing: activity.status === 'ALERT_RINGING' ? 1 : 0, todo: activity.todo ? 1 : 0 };
+  };
+  const overflowAlerts = (hidden: DoorChip[]): OverflowAlerts => hidden.reduce((sum, item) => {
+    const alerts = alertsOf(item);
+    return { ringing: sum.ringing + alerts.ringing, todo: sum.todo + alerts.todo };
+  }, NO_OVERFLOW_ALERTS);
+
   if (items.length > 0) {
     const widths = doorWidths;
-    const { doorGap, arrowWidth } = layoutMetrics.current;
+    const { doorGap, arrowWidth, todoArrowWidth } = layoutMetrics.current;
+    const arrowFor = (hidden: DoorChip[]) => (hidden.some((item) => alertsOf(item).todo > 0) ? todoArrowWidth : arrowWidth);
     const hasLeftOverflow = startIndex > 0;
     const budget = availableWidth
-      - (hasLeftOverflow ? arrowWidth : 0)
+      - (hasLeftOverflow ? arrowFor(items.slice(0, startIndex)) : 0)
       - (rightClusterWidth + doorGap);
 
     for (let i = startIndex; i < items.length; i++) {
       const doorW = (widths[i] || 100) + (visibleCount > 0 ? doorGap : 0);
       const needsRightArrow = i + 1 < items.length;
-      const rightReserve = needsRightArrow ? arrowWidth : 0;
+      const rightReserve = needsRightArrow ? arrowFor(items.slice(i + 1)) : 0;
 
       if (usedWidth + doorW + rightReserve > budget) break;
       usedWidth += doorW;
@@ -306,9 +377,10 @@ export function Baseboard({ items, onReattach, notice, onDoorDragStart }: Basebo
       <div ref={measureEl} className="absolute -left-[9999px] flex gap-1.5" aria-hidden>
         {items.map(item => <Door key={item.id} {...doorProps(item)} />)}
       </div>
-      <button ref={arrowMeasureEl} className={`absolute -left-[9999px] ${BASEBOARD_BUTTON_CLASS}`} aria-hidden tabIndex={-1}>
-        9 more <CaretRightIcon size={10} weight="bold" />
-      </button>
+      <div className="absolute -left-[9999px] flex" aria-hidden>
+        <OverflowArrow measureRef={arrowMeasureEl} direction="right" count={9} alerts={NO_OVERFLOW_ALERTS} />
+        <OverflowArrow measureRef={todoArrowMeasureEl} direction="right" count={9} alerts={{ ringing: 0, todo: 9 }} />
+      </div>
 
       {items.length === 0 && showHint && (
         <span className="truncate pb-1 text-sm font-mono text-muted">
@@ -317,13 +389,7 @@ export function Baseboard({ items, onReattach, notice, onDoorDragStart }: Basebo
       )}
 
       {hiddenLeft > 0 && (
-        <button
-          className={BASEBOARD_BUTTON_CLASS}
-          onClick={scrollLeft}
-        >
-          <CaretLeftIcon size={10} weight="bold" />
-          {hiddenLeft} more
-        </button>
+        <OverflowArrow direction="left" count={hiddenLeft} alerts={overflowAlerts(items.slice(0, startIndex))} onClick={scrollLeft} />
       )}
 
       {items.slice(startIndex, endIndex).map(item => (
@@ -344,13 +410,7 @@ export function Baseboard({ items, onReattach, notice, onDoorDragStart }: Basebo
           depends on the fitting result it feeds. */}
       <div className="ml-auto flex shrink-0 items-end gap-1.5">
         {hiddenRight > 0 && (
-          <button
-            className={BASEBOARD_BUTTON_CLASS}
-            onClick={scrollRight}
-          >
-            {hiddenRight} more
-            <CaretRightIcon size={10} weight="bold" />
-          </button>
+          <OverflowArrow direction="right" count={hiddenRight} alerts={overflowAlerts(items.slice(endIndex))} onClick={scrollRight} />
         )}
 
         <div ref={rightClusterEl} className="flex shrink-0 items-end gap-1.5">
diff --git a/lib/src/components/wall/TerminalContext.test.tsx b/lib/src/components/wall/TerminalContext.test.tsx
index ab7f79407..2d6788939 100644
--- a/lib/src/components/wall/TerminalContext.test.tsx
+++ b/lib/src/components/wall/TerminalContext.test.tsx
@@ -28,7 +28,7 @@ beforeEach(() => {
   setPlatform(new FakePtyAdapter()); ensureResizeObserver();
   container = document.createElement('div'); document.body.appendChild(container); root = createRoot(container);
   props = { title: 'pnpm dev', surfaceRef: 'surface:3', cwd: '~/repo', titleSources: [{ source: 'OSC 2', value: 'pnpm dev', note: 'Used' }], scan: { status: 'loaded', entries: [port(5173)] },
-    argv0: 'pnpm', watching: false, todo: false, status: 'completed', command: 'git status', explorerLabel: 'Open in Finder', canExplore: true, canAgent: true, canIframe: true,
+    watchRule: 'pnpm', watching: false, todo: false, status: 'completed', command: 'git status', explorerLabel: 'Open in Finder', canExplore: true, canAgent: true, canIframe: true,
     onClose: vi.fn(), onCopyRef: vi.fn(), onCopyPath: vi.fn(), onExplore: vi.fn(), onWatch: vi.fn(), onTodo: vi.fn(), onPort: vi.fn(), onModify: vi.fn(async () => {}), onReset: vi.fn(async () => {}), onPromote: vi.fn(async () => {}),
     children: <div data-helper-terminal="helper"><textarea aria-label="Helper input" /></div> };
 });
@@ -193,6 +193,30 @@ it('opens the parent notepad from the Helper control and keeps edits on that par
 });
 
 
+it('offers the rule covering the running script, else that script\'s own key', async () => {
+  const open = vi.spyOn(helpers, 'openHelper').mockResolvedValue({ id: 'helper', parentId: 'watch-row', command: '', status: 'off' });
+  terminalRegistry.applyTerminalSemanticEvents('watch-row', [
+    { type: 'commandLine', commandLine: 'cd web && pnpm run dev' },
+    { type: 'commandStart', source: 'osc633_boundaries' },
+  ]);
+  const watchSwitch = () => container.querySelector<HTMLButtonElement>('[role="switch"][aria-label^="Watch all"]');
+  try {
+    act(() => terminalRegistry.setCommandWatched('pnpm', true));
+    await act(async () => root.render(<TerminalContext id="watch-row" />));
+    // A bare runner rule already covers `pnpm dev`, so the row names — and turns off — that rule.
+    expect(watchSwitch()?.getAttribute('aria-label')).toBe('Watch all pnpm commands on');
+    await act(async () => watchSwitch()!.click());
+    expect(terminalRegistry.getWatchedCommands()).toEqual([]);
+    expect(watchSwitch()?.getAttribute('aria-label')).toBe('Watch all pnpm dev commands off');
+    await act(async () => watchSwitch()!.click());
+    expect(terminalRegistry.getWatchedCommands()).toEqual(['pnpm dev']);
+  } finally {
+    open.mockRestore();
+    act(() => { for (const name of terminalRegistry.getWatchedCommands()) terminalRegistry.setCommandWatched(name, false); });
+    terminalRegistry.removeTerminalPaneState('watch-row');
+  }
+});
+
 it('uses the Tool primary terminal without creating a helper or offering helper lifecycle actions', async () => {
   const openHelper = vi.spyOn(helpers, 'openHelper');
   const focusTerminal = vi.fn();
diff --git a/lib/src/components/wall/TerminalContext.tsx b/lib/src/components/wall/TerminalContext.tsx
index a3be289e1..59577eb3e 100644
--- a/lib/src/components/wall/TerminalContext.tsx
+++ b/lib/src/components/wall/TerminalContext.tsx
@@ -8,8 +8,8 @@ import { TerminalContextView, type ContextScan } from './TerminalContextView';
 import { TerminalContextContext, WallActionsContext, type TerminalContextState } from './wall-context';
 import { disposeHelper, getHelper, helperRevision, openHelper, setHelperVisible, subscribeHelpers } from '../../lib/helper-terminal';
 import { getPlatform, IS_MAC, IS_WINDOWS } from '../../lib/platform';
-import { buildAppTitleResolver, commandArgv0, createTerminalPaneState, cwdDisplay, deriveSurfaceLabel, explainTerminalTitle, type CwdState } from '../../lib/terminal-state';
-import { focusSession, getTerminalInstance, getActivitySnapshot, getTerminalPaneStateSnapshot, isCommandWatched, setCommandWatched, subscribeToActivity, subscribeToTerminalPaneState, subscribeToWatchedCommands, getWatchedCommandsSnapshot, toggleSessionTodo } from '../../lib/terminal-registry';
+import { buildAppTitleResolver, commandWatchKey, createTerminalPaneState, cwdDisplay, deriveSurfaceLabel, explainTerminalTitle, type CwdState } from '../../lib/terminal-state';
+import { commandWatchRule, focusSession, getTerminalInstance, getActivitySnapshot, getTerminalPaneStateSnapshot, setCommandWatched, subscribeToActivity, subscribeToTerminalPaneState, subscribeToWatchedCommands, getWatchedCommandsSnapshot, toggleSessionTodo } from '../../lib/terminal-registry';
 import { writeTextToClipboard } from '../../lib/clipboard';
 import { listenerUrlsByPort } from './port-url';
 import { DEFAULT_HELPER_COMMAND } from '../../lib/terminal-context-types';
@@ -31,7 +31,10 @@ export function TerminalContext({ id, title, closing, origin, warning: openWarni
   const cwd = state.cwd?.path ? state.cwd : undefined;
   const helperState = helper ? states.get(helper.id) : undefined;
   const helperCwd = helperState?.cwd?.path ? helperState.cwd : undefined;
-  const argv0 = state.currentCommand?.rawCommandLine ? commandArgv0(state.currentCommand.rawCommandLine) : null;
+  const watchKey = state.currentCommand?.rawCommandLine ? commandWatchKey(state.currentCommand.rawCommandLine) : null;
+  // A bare runner rule already covers this script, so the row offers that rule.
+  const watchRule = commandWatchRule(watchKey);
+  const offeredRule = watchRule ?? watchKey;
   const appTitleForPane = useMemo(() => buildAppTitleResolver(states, activities), [states, activities]);
   const titleSources = useMemo(() => explainTerminalTitle(state, { appTitleForPane }), [state, appTitleForPane]);
   const display = (location: CwdState) => cwdDisplay(location, { style: 'full', homePath: home });
@@ -54,13 +57,13 @@ export function TerminalContext({ id, title, closing, origin, warning: openWarni
   const warning = openWarning ?? (helperError || (helper && helper.status !== 'waiting' && (!cwd || !helperCwd) ? 'Directory comparison unavailable: a terminal has not reported its directory.' : undefined));
   return <TerminalContextView terminalRole={tool ? 'tool' : 'helper'} closing={closing} origin={origin} title={deriveSurfaceLabel(state, appTitleForPane, title ?? id)} surfaceRef={actions.resolveSurfaceRef(id)}
     titleSources={titleSources} cwd={cwd ? display(cwd) : 'Directory unknown'} helperCwd={helperCwd && display(helperCwd)} mismatch={mismatch}
-    scan={scan} argv0={argv0} watching={!!argv0 && isCommandWatched(argv0)} todo={activities.get(id)?.todo === true} notification={activities.get(id)?.notification}
+    scan={scan} watchRule={offeredRule} watching={watchRule !== null} todo={activities.get(id)?.todo === true} notification={activities.get(id)?.notification}
     status={tool ? (state.currentCommand ? 'running' : 'completed') : helper?.status ?? 'waiting'} command={tool ? state.currentCommand?.rawCommandLine ?? state.lastCommand?.rawCommandLine ?? '' : helper?.command ?? defaultCommand} defaultCommand={defaultCommand} warning={warning}
     explorerLabel={IS_MAC ? 'Open in Finder' : IS_WINDOWS ? 'Open in Explorer' : 'Open folder'} canExplore={!!platform.terminalContext && !!cwd && !cwd.isRemote}
     canAgent={!!platform.agentBrowserOpen} canIframe={!!platform.createIframeProxyUrl}
     onClose={onClose} onCopyRef={() => copy(actions.resolveSurfaceRef(id))} onCopyPath={() => copy(cwd?.path ?? '')}
     onExplore={async () => { if (platform.terminalContext && cwd) await platform.terminalContext({ op: 'openDirectory', id, path: cwd.path }); }}
-    onWatch={() => { if (argv0) setCommandWatched(argv0, !isCommandWatched(argv0)); }} onTodo={() => toggleSessionTodo(id)}
+    onWatch={() => { if (offeredRule) setCommandWatched(offeredRule, watchRule === null); }} onTodo={() => toggleSessionTodo(id)}
     onPort={(entry, mode) => context.openPort(id, entry, mode)}
     onModify={async command => { await platform.terminalContext?.({ op: 'settings', command }); setDefaultCommand(command); }}
     notepadAction={<NotepadHeaderButton surfaceId={id} />}
diff --git a/lib/src/components/wall/TerminalContextView.tsx b/lib/src/components/wall/TerminalContextView.tsx
index a2c7794aa..9b2fee2fd 100644
--- a/lib/src/components/wall/TerminalContextView.tsx
+++ b/lib/src/components/wall/TerminalContextView.tsx
@@ -50,7 +50,7 @@ export interface TerminalContextViewProps {
   origin?: { x: number; y: number };
   defaultCommand?: string; title: string; surfaceRef: string; cwd: string; helperCwd?: string; mismatch?: boolean;
   titleSources: { source: string; value: string; note?: string }[];
-  scan: ContextScan; argv0?: string | null; watching: boolean; todo: boolean;
+  scan: ContextScan; watchRule?: string | null; watching: boolean; todo: boolean;
   notification?: { title: string | null; body: string | null } | null;
   status: HelperStatus; command: string; warning?: string;
   explorerLabel: string; canExplore: boolean; canAgent: boolean; canIframe: boolean;
@@ -202,7 +202,7 @@ export function TerminalContextView(p: TerminalContextViewProps) {
               </div>
             </>}
           </div>
-          <span className="text-muted">Alerts</span><div className="flex h-6 items-center gap-2"><span>{p.argv0 ? `Watch all ${p.argv0} commands` : 'No command running'}</span>{p.argv0 && <OnOffSwitch on={p.watching} onEnable={p.onWatch} onDisable={p.onWatch} label={`Watch all ${p.argv0} commands`} />}<span className="mx-1 h-3 border-l border-border" /><span>TODO</span><OnOffSwitch on={p.todo} onEnable={p.onTodo} onDisable={p.onTodo} label="TODO" /></div>
+          <span className="text-muted">Alerts</span><div className="flex h-6 items-center gap-2"><span>{p.watchRule ? `Watch all ${p.watchRule} commands` : 'No command running'}</span>{p.watchRule && <OnOffSwitch on={p.watching} onEnable={p.onWatch} onDisable={p.onWatch} label={`Watch all ${p.watchRule} commands`} />}<span className="mx-1 h-3 border-l border-border" /><span>TODO</span><OnOffSwitch on={p.todo} onEnable={p.onTodo} onDisable={p.onTodo} label="TODO" /></div>
         </div>
         {p.notification && <div className="ml-16 mt-2 border-l-2 border-border py-1 pl-3"><div>{p.notification.title}</div><div className="whitespace-pre-wrap text-muted">{p.notification.body}</div></div>}
       </div>
diff --git a/lib/src/components/wall/tool-takeover.test.ts b/lib/src/components/wall/tool-takeover.test.ts
index 51624688c..7938e7e87 100644
--- a/lib/src/components/wall/tool-takeover.test.ts
+++ b/lib/src/components/wall/tool-takeover.test.ts
@@ -16,7 +16,7 @@ describe('isNakedToolInvocation', () => {
     expect(isNakedToolInvocation('dor tool --fresh storybook')).toBe(true);
     expect(isNakedToolInvocation('/usr/local/bin/dor tool storybook')).toBe(true);
     expect(isNakedToolInvocation('dor.cmd tool storybook')).toBe(true);
-    // The shared tokenizer skips a leading assignment, as `commandArgv0` does.
+    // The shared tokenizer skips a leading assignment, as `commandWatchKey` does.
     expect(isNakedToolInvocation('DEBUG=1 dor tool storybook')).toBe(true);
   });
 
diff --git a/lib/src/lib/alert-manager.test.ts b/lib/src/lib/alert-manager.test.ts
index 2a2818e82..b663c69a6 100644
--- a/lib/src/lib/alert-manager.test.ts
+++ b/lib/src/lib/alert-manager.test.ts
@@ -1,7 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AlertManager, AWAIT_GRACE_MS, DEFAULT_ALERT_STATE, MAX_AWAIT_TIMEOUT_MS } from './alert-manager';
 import type { AwaitHandle, AwaitOutcome, CompletionEvent } from './alert-manager';
-import { applyTerminalProtocolEvents } from './terminal-protocol';
+import { applyTerminalProtocolEvents, collectTerminalSemanticEvents, TerminalProtocolParser } from './terminal-protocol';
 
 describe('AlertManager in isolation', () => {
   let manager: AlertManager;
@@ -31,28 +31,115 @@ describe('AlertManager in isolation', () => {
     ]);
   }
 
-  it('drops every feed and control for a helper Session until it is promoted', () => {
-    const states: string[] = [];
-    manager.onStateChange((id) => states.push(id));
-    manager.setHelper('helper', true);
-    runWatchedCommand('helper');
-    manager.onData('helper');
-    applyTerminalProtocolEvents(manager, 'helper', [{ type: 'notification', notification: { title: 'done', body: null } }]);
-    manager.attend('helper');
-    manager.toggleTodo('helper');
-    manager.markTodo('helper');
-    manager.seed('helper', { todo: true });
-    manager.clearTodo('helper');
-    manager.onExit('helper', 0);
-    manager.onResize('helper');
-    applyTerminalProtocolEvents(manager, 'helper', [{ type: 'notification', notification: { title: 'late output', body: null } }]);
-    vi.advanceTimersByTime(10_000);
-    expect(states).toEqual([]);
-    expect(manager.getState('helper')).toEqual(DEFAULT_ALERT_STATE);
+  describe('helper Sessions', () => {
+    const HELPER = 'helper';
+
+    function startCommand(id: string, commandLine: string): void {
+      manager.applyTerminalSemanticEvents(id, [
+        { type: 'commandLine', commandLine },
+        { type: 'commandStart', source: 'osc633_boundaries' },
+      ]);
+    }
+
+    function outputFor(id: string, ms: number): void {
+      for (let t = 0; t < ms; t += 200) {
+        manager.onData(id);
+        vi.advanceTimersByTime(200);
+      }
+    }
+
+    it('alerts no one, publishes nothing, and accepts no report or control until promoted', () => {
+      const states: string[] = [];
+      manager.onStateChange((id) => states.push(id));
+      const seen = recordingClaimant(HELPER, true);
+      manager.setHelper(HELPER, true);
+      runWatchedCommand(HELPER);
+      outputFor(HELPER, 3_000);
+      settle();
+      applyTerminalProtocolEvents(manager, HELPER, [{ kind: 'notification', notification: { source: 'OSC 9', title: null, body: 'done' } }]);
+      applyTerminalProtocolEvents(manager, HELPER, [{ kind: 'progress', progress: { state: 'normal', percent: 40 } }]);
+      manager.attend(HELPER);
+      manager.toggleTodo(HELPER);
+      manager.markTodo(HELPER);
+      manager.seed(HELPER, { todo: true });
+      manager.onResize(HELPER);
+      manager.applyTerminalSemanticEvents(HELPER, [{ type: 'commandFinish', exitCode: 1 }]);
+      manager.onExit(HELPER, 0);
+      vi.advanceTimersByTime(10_000);
+
+      expect(states).toEqual([]);
+      expect(seen).toEqual([]);
+      expect(manager.getState(HELPER)).toEqual(DEFAULT_ALERT_STATE);
+      expect(manager.getAllStates().has(HELPER)).toBe(false);
+      // Removing a helper that never published tells subscribers nothing either.
+      manager.remove(HELPER);
+      expect(states).toEqual([]);
+    });
+
+    it('cancels an await on a helper', async () => {
+      manager.setHelper(HELPER, true);
+      await expect(manager.awaitCompletion(HELPER, { until: 'quiet', timeoutMs: 10_000 }).promise)
+        .resolves.toEqual({ kind: 'cancelled', waitedMs: 0 });
+    });
+
+    it('keeps the command a helper was running when it is promoted mid-command', () => {
+      manager.setWatchedCommands(['claude']);
+      manager.setHelper(HELPER, true);
+      startCommand(HELPER, 'claude');
+      outputFor(HELPER, 3_000);
+
+      const states: boolean[] = [];
+      manager.onStateChange((id, state) => { if (id === HELPER) states.push(state.watchingEnabled); });
+      manager.setHelper(HELPER, false);
+      // Promotion publishes what the helper built up: WATCHING on `claude`, now.
+      expect(states).toEqual([true]);
+      expect(manager.getState(HELPER)).toMatchObject({ watchingEnabled: true, status: 'BUSY' });
+
+      // Its next unattended settle rings like any watched Session's.
+      settle();
+      expect(manager.getState(HELPER).status).toBe('ALERT_RINGING');
+    });
+
+    it('never replays a completion suppressed before promotion', () => {
+      manager.setWatchedCommands(['claude']);
+      manager.setHelper(HELPER, true);
+      startCommand(HELPER, 'claude');
+      outputFor(HELPER, 3_000);
+      settle();
+      applyTerminalProtocolEvents(manager, HELPER, [{ kind: 'notification', notification: { source: 'OSC 9', title: null, body: 'done' } }]);
 
-    manager.setHelper('helper', false);
-    runWatchedCommand('helper');
-    expect(states).toContain('helper');
+      manager.setHelper(HELPER, false);
+      vi.advanceTimersByTime(10_000);
+      expect(manager.getState(HELPER)).toMatchObject({ status: 'NOTHING_TO_SHOW', todo: false, notification: null });
+    });
+
+    it('does not ring the exit of a command it never saw with attention', () => {
+      manager.setHelper(HELPER, true);
+      startCommand(HELPER, 'npm run build');
+      manager.setHelper(HELPER, false);
+      vi.advanceTimersByTime(30_000);
+      manager.applyTerminalSemanticEvents(HELPER, [{ type: 'commandFinish', exitCode: 0 }]);
+      expect(manager.getState(HELPER).status).toBe('WATCHING_DISABLED');
+
+      // The ordinary seen rule applies from promotion on.
+      startCommand(HELPER, 'npm run build');
+      manager.attend(HELPER);
+      manager.clearAttention(HELPER);
+      vi.advanceTimersByTime(30_000);
+      manager.applyTerminalSemanticEvents(HELPER, [{ type: 'commandFinish', exitCode: 0 }]);
+      expect(manager.getState(HELPER).status).toBe('ALERT_RINGING');
+    });
+
+    it('takes back what a Session published when a failed placement demotes it', () => {
+      manager.setHelper(HELPER, true);
+      manager.setHelper(HELPER, false);
+      manager.markTodo(HELPER);
+      const states: boolean[] = [];
+      manager.onStateChange((id, state) => { if (id === HELPER) states.push(state.todo); });
+      manager.setHelper(HELPER, true);
+      expect(states).toEqual([false]);
+      expect(manager.getState(HELPER)).toEqual(DEFAULT_ALERT_STATE);
+    });
   });
 
   it('state machine advances through silence to ALERT_RINGING', () => {
@@ -607,8 +694,8 @@ describe('AlertManager in isolation', () => {
     expect(watching).toContain(false);
   });
 
-  it('matches on the bare program name, not the whole command line', () => {
-    const id = 'rule-argv0';
+  it('matches on the watch key, not the whole command line', () => {
+    const id = 'rule-watch-key';
     manager.setWatchedCommands(['claude']);
 
     manager.applyTerminalSemanticEvents(id, [
@@ -618,6 +705,14 @@ describe('AlertManager in isolation', () => {
     expect(manager.getState(id).watchingEnabled).toBe(true);
   });
 
+  it('engages WATCHING for a command fish reports on OSC 133;C', () => {
+    const id = 'rule-fish';
+    manager.setWatchedCommands(['claude']);
+    const parsed = new TerminalProtocolParser().process('\x1b]133;C;cmdline_url=claude%20--resume\x1b\\');
+    manager.applyTerminalSemanticEvents(id, collectTerminalSemanticEvents(parsed.events));
+    expect(manager.getState(id).watchingEnabled).toBe(true);
+  });
+
   it('leaves an unwatched command alone', () => {
     const id = 'rule-miss';
     manager.setWatchedCommands(['claude']);
@@ -692,6 +787,45 @@ describe('AlertManager in isolation', () => {
     });
   });
 
+  it('rings a runner script only under a rule that covers it', () => {
+    const id = 'runner-script-rule';
+    const ringsUnder = (rules: string[]): boolean => {
+      manager.setWatchedCommands(rules);
+      manager.applyTerminalSemanticEvents(id, [
+        { type: 'commandLine', commandLine: 'pnpm run dev' },
+        { type: 'commandStart', source: 'osc633_boundaries' },
+      ]);
+      driveToBusy(id);
+      settle();
+      const ringing = manager.getState(id).status === 'ALERT_RINGING';
+      manager.clearTodo(id);
+      manager.applyTerminalSemanticEvents(id, [{ type: 'promptStart' }]);
+      return ringing;
+    };
+
+    expect(ringsUnder(['pnpm test'])).toBe(false);
+    expect(ringsUnder(['pnpm dev'])).toBe(true);
+    // A bare runner rule keeps matching every script of that runner.
+    expect(ringsUnder(['pnpm'])).toBe(true);
+  });
+
+  it('keeps a WATCHING ring whose command another rule still covers', () => {
+    const id = 'ring-survives-covered';
+    manager.setWatchedCommands(['pnpm', 'pnpm dev']);
+    manager.applyTerminalSemanticEvents(id, [
+      { type: 'commandLine', commandLine: 'pnpm dev' },
+      { type: 'commandStart', source: 'osc633_boundaries' },
+    ]);
+    driveToBusy(id);
+    settle();
+    expect(manager.getState(id).status).toBe('ALERT_RINGING');
+
+    manager.setWatchedCommands(['pnpm']);
+    expect(manager.getState(id).status).toBe('ALERT_RINGING');
+    manager.setWatchedCommands([]);
+    expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
+  });
+
   it('silences a latched WATCHING ring when its rule is removed after command exit', () => {
     const id = 'exited-ring-dies-with-rule';
     driveToRinging(id);
@@ -1220,7 +1354,7 @@ describe('AlertManager in isolation', () => {
       expect(seen).toEqual([{
         kind: 'commandFinished',
         displayCommand: 'npm test',
-        argv0: 'npm',
+        watchKey: 'npm test',
         exitCode: 0,
         ranMs: 1_000,
         armed: false,
@@ -1249,7 +1383,7 @@ describe('AlertManager in isolation', () => {
       expect(seen).toEqual([{
         kind: 'commandFinished',
         displayCommand: 'pnpm build',
-        argv0: 'pnpm',
+        watchKey: 'pnpm build',
         exitCode: 0,
         ranMs: 15_000,
         armed: true,
@@ -1367,7 +1501,7 @@ describe('AlertManager in isolation', () => {
         event: {
           kind: 'commandFinished',
           displayCommand: 'pnpm build',
-          argv0: 'pnpm',
+          watchKey: 'pnpm build',
           exitCode: 1,
           ranMs: 15_000,
           armed: true,
diff --git a/lib/src/lib/alert-manager.ts b/lib/src/lib/alert-manager.ts
index 51b504177..dfb6728f5 100644
--- a/lib/src/lib/alert-manager.ts
+++ b/lib/src/lib/alert-manager.ts
@@ -4,8 +4,9 @@ import { applyTerminalProtocolEvents, collectTerminalSemanticEvents, type Termin
 import { DEFAULT_ALERT_SETTINGS, type AlertSettings } from './alert-settings-model';
 import { cfg } from '../cfg';
 import {
-  commandArgv0,
+  commandWatchKey,
   resolveCommandStart,
+  watchRuleFor,
   DEFAULT_COMMAND_TITLE,
   type CommandRunSource,
   type TerminalSemanticEvent,
@@ -52,8 +53,8 @@ interface ActiveProtocolProgress {
 
 interface CommandExitWatch {
   displayCommand: string;
-  /** Bare program name the WATCHING rule set is keyed on; null without shell integration. */
-  argv0: string | null;
+  /** `commandWatchKey` of the command line; null without one to key on. */
+  watchKey: string | null;
   source: CommandRunSource;
   startedAt: number;
   seenWithAttentionAt: number | null;
@@ -87,7 +88,7 @@ export type CompletionEvent =
   | {
       kind: 'commandFinished';
       displayCommand: string;
-      argv0: string | null;
+      watchKey: string | null;
       exitCode: number | undefined;
       /** Wall time from commandStart to this finish. */
       ranMs: number;
@@ -178,7 +179,7 @@ interface AlertEntry {
   episode: AlertEpisode | null;
   /** Always-on output/silence detector. Never disposed before the entry is. */
   detector: QuiesceDetector;
-  /** Command rule that raised the latched WATCHING ring, even after command exit. */
+  /** Watch key of the command whose settle latched the WATCHING ring, kept after it exits. */
   watchingRingingCommand: string | null;
   /**
    * Has any output arrived since that ring latched? The detector cannot answer
@@ -222,9 +223,11 @@ export class AlertManager {
   private listeners = new Set<(id: string, state: AlertState) => void>();
   private lastEmitted = new Map<string, AlertState>();
   private watchedCommands = new Set<string>();
-  /** Helper Sessions never alert (docs/specs/alert.md → "suppress helper
-   *  alerting until promotion"): every ingestion and control entry point below
-   *  drops them here, so a host marks the id once instead of guarding each call. */
+  /** Helper Sessions alert no one until promotion (docs/specs/alert.md → Pane
+   *  Header). They still build command state and feed the detector, so one
+   *  promoted mid-command knows what it is running; everything else — reports,
+   *  controls, awaits, completion dispatch, publishing — drops them, so a host
+   *  marks the id once instead of guarding each call. */
   private helpers = new Set<string>();
   private inactivityTimeoutMs = cfg.alert.userAttention;
   /** The shipped default (platform-free module: this runs in both hosts), so a
@@ -272,6 +275,10 @@ export class AlertManager {
   setHelper(id: string, helper: boolean): void {
     if (helper) this.helpers.add(id);
     else this.helpers.delete(id);
+    // Promotion publishes the state the helper built up — nothing that was
+    // suppressed, since a helper's completions were never kept. A failed
+    // placement's demotion takes back whatever the Session had published.
+    if (this.entries.has(id)) this.notify(id);
   }
 
   // --- State change subscription ---
@@ -284,7 +291,6 @@ export class AlertManager {
   // --- Feed PTY events ---
 
   onData(id: string): void {
-    if (this.inert(id)) return;
     // The detector runs for every Session, including one that has never
     // produced a semantic or protocol event, so output creates the entry.
     const entry = this.streamEntry(id);
@@ -298,7 +304,7 @@ export class AlertManager {
   }
 
   onExit(id: string, exitCode?: number): void {
-    if (this.inert(id)) return;
+    if (this.suspendedForTransfer.has(id)) return;
     const entry = this.entries.get(id);
     if (entry && this.finishCommandExitWatch(id, entry, exitCode)) this.notify(id);
     // The command-exit dispatch above already resolved anything waiting on the
@@ -308,7 +314,6 @@ export class AlertManager {
   }
 
   onResize(id: string): void {
-    if (this.inert(id)) return;
     // Same reasoning as `onData`: the resize grace window is part of the
     // always-on detector, and a Pane's first fit usually beats any PTY event.
     this.streamEntry(id)?.detector.onResize();
@@ -317,7 +322,7 @@ export class AlertManager {
   // --- WATCHING rule set ---
 
   /**
-   * Replace the set of command names WATCHING applies to (`docs/specs/alert.md`).
+   * Replace the set of command keys WATCHING applies to (`docs/specs/alert.md`).
    * Pushed from the renderer, which owns the persisted copy — the extension host
    * has no `localStorage` of its own.
    */
@@ -330,11 +335,12 @@ export class AlertManager {
       // re-applies this rule wherever the snapshot lands.
       if (this.suspendedForTransfer.has(id)) continue;
       // Dropping a rule is an explicit "stop alerting on this", so it also
-      // silences the ring that rule already raised. The originating key stays
-      // latched after command exit precisely so this still works at a prompt.
+      // silences the ring that rule already raised — unless another rule still
+      // covers it. The originating key stays latched after command exit
+      // precisely so this still works at a prompt.
       if (
         entry.watchingRingingCommand !== null
-        && !this.watchedCommands.has(entry.watchingRingingCommand)
+        && watchRuleFor(this.watchedCommands, entry.watchingRingingCommand) === null
       ) {
         entry.watchingRingingCommand = null;
         entry.outputSinceWatchingRing = false;
@@ -360,13 +366,12 @@ export class AlertManager {
   }
 
   /**
-   * WATCHING follows the foreground command's name: on while a watched command
-   * runs, off at the prompt. The detector keeps running either way; this only
-   * decides whether its state is public and whether a settle rings.
+   * WATCHING follows the foreground command's watch key: on while a command a
+   * rule covers runs, off at the prompt. The detector keeps running either way;
+   * this only decides whether its state is public and whether a settle rings.
    */
   private isWatching(entry: AlertEntry): boolean {
-    const argv0 = entry.commandExitWatch?.argv0 ?? null;
-    return argv0 !== null && this.watchedCommands.has(argv0);
+    return watchRuleFor(this.watchedCommands, entry.commandExitWatch?.watchKey ?? null) !== null;
   }
 
   private createDetector(id: string): QuiesceDetector {
@@ -438,6 +443,8 @@ export class AlertManager {
    * have passed on it. Returns whether a claimant took the event.
    */
   private dispatchCompletion(id: string, entry: AlertEntry, event: CompletionEvent): boolean {
+    // A helper's completion reaches no one, and is not kept for promotion.
+    if (this.helpers.has(id)) return false;
     // Snapshot: a claimant may unregister itself (or register another) while
     // being offered this very event.
     const claimants = [...(this.claimants.get(id) ?? [])];
@@ -450,7 +457,7 @@ export class AlertManager {
         // outlives the command that raised it.
         if (!this.isWatching(entry) || this.hasAttention(id)) break;
         this.openEpisode(entry);
-        entry.watchingRingingCommand = entry.commandExitWatch?.argv0 ?? null;
+        entry.watchingRingingCommand = entry.commandExitWatch?.watchKey ?? null;
         entry.outputSinceWatchingRing = false;
         this.notify(id);
         break;
@@ -761,7 +768,7 @@ export class AlertManager {
   // --- Command-exit track ---
 
   applyTerminalSemanticEvents(id: string, events: TerminalSemanticEvent[]): void {
-    if (events.length === 0 || this.inert(id)) return;
+    if (events.length === 0 || this.suspendedForTransfer.has(id)) return;
     const entry = this.reportedEntry(id);
     let changed = false;
 
@@ -809,7 +816,7 @@ export class AlertManager {
     if (entry.commandExitStatus !== 'ALERT_RINGING') entry.commandExitStatus = 'IDLE';
     entry.commandExitWatch = {
       displayCommand: resolved.displayCommand,
-      argv0: resolved.rawCommandLine === null ? null : commandArgv0(resolved.rawCommandLine),
+      watchKey: resolved.rawCommandLine === null ? null : commandWatchKey(resolved.rawCommandLine),
       source: resolved.source,
       startedAt: resolved.startedAt,
       seenWithAttentionAt: this.hasAttention(id) ? Date.now() : null,
@@ -839,7 +846,7 @@ export class AlertManager {
       this.dispatchCompletion(id, entry, {
         kind: 'commandFinished',
         displayCommand: watch.displayCommand,
-        argv0: watch.argv0,
+        watchKey: watch.watchKey,
         exitCode,
         ranMs: Date.now() - watch.startedAt,
         armed: wasArmed,
@@ -1115,7 +1122,7 @@ export class AlertManager {
 
   getState(id: string): AlertState {
     const entry = this.entries.get(id);
-    if (!entry) return DEFAULT_ALERT_STATE;
+    if (!entry || this.helpers.has(id)) return DEFAULT_ALERT_STATE;
     return {
       status: this.getProjectedStatus(entry),
       watchingEnabled: this.isWatching(entry),
@@ -1129,16 +1136,17 @@ export class AlertManager {
   getAllStates(): Map<string, AlertState> {
     const result = new Map<string, AlertState>();
     for (const [id] of this.entries) {
-      result.set(id, this.getState(id));
+      if (!this.helpers.has(id)) result.set(id, this.getState(id));
     }
     return result;
   }
 
   /** Completely remove alert state for a PTY (used when PTY is destroyed) */
   remove(id: string): void {
+    // A helper that never published has nothing for subscribers to forget.
+    const unpublished = this.helpers.delete(id) && !this.lastEmitted.has(id);
     this.suspendedForTransfer.delete(id);
     this.liveReplay.delete(id);
-    this.helpers.delete(id);
     this.removed.add(id);
     // Nobody parked here has anything left to wait for.
     this.settleWaiters(id, 'died');
@@ -1154,7 +1162,7 @@ export class AlertManager {
       this.attentionId = null;
       this.clearAttentionTimer();
     }
-    this.notify(id);
+    if (!unpublished) this.notify(id);
   }
 
   /**
@@ -1181,7 +1189,8 @@ export class AlertManager {
     this.notify(id);
   }
 
-  /** A helper, or a Session suspended for a live handoff, accepts nothing. */
+  /** A Session suspended for a live handoff accepts nothing; a helper accepts
+   *  only what builds its command state. */
   private inert(id: string): boolean {
     return this.helpers.has(id) || this.suspendedForTransfer.has(id);
   }
@@ -1222,7 +1231,7 @@ export class AlertManager {
     entry.deferredNotificationTimer = null;
     entry.detector = this.createDetector(id);
     entry.detector.restore(detector);
-    if (entry.watchingRingingCommand !== null && !this.watchedCommands.has(entry.watchingRingingCommand)) {
+    if (entry.watchingRingingCommand !== null && watchRuleFor(this.watchedCommands, entry.watchingRingingCommand) === null) {
       entry.watchingRingingCommand = null;
       entry.outputSinceWatchingRing = false;
     }
@@ -1333,7 +1342,8 @@ export class AlertManager {
   private notify(id: string): void {
     const state = this.getState(id);
     const last = this.lastEmitted.get(id);
-    if (last && alertStatesEqual(last, state)) return;
+    // A helper publishes nothing, but takes back what it published before a demotion.
+    if (last ? alertStatesEqual(last, state) : this.helpers.has(id)) return;
     if (this.entries.has(id)) {
       this.lastEmitted.set(id, state);
     } else {
diff --git a/lib/src/lib/terminal-protocol.test.ts b/lib/src/lib/terminal-protocol.test.ts
index 53c8cc6c4..f030e5a49 100644
--- a/lib/src/lib/terminal-protocol.test.ts
+++ b/lib/src/lib/terminal-protocol.test.ts
@@ -85,6 +85,22 @@ describe('TerminalProtocolParser', () => {
     ]);
   });
 
+  // ConEmu's numbered subcommands (docs/specs/alert.md -> Terminal reports).
+  it.each([
+    '9;1;500', '9;2;msg', '9;3;my tab', '9;5', '9;6;Close(0)', '9;8;USERNAME', '9;10;1', '9;12', '9;9',
+  ])('consumes the ConEmu subcommand OSC %s with no notification or title', (payload) => {
+    const result = new TerminalProtocolParser().process(`a\x1b]${payload}\x07b`);
+    expect(result.visibleData).toBe('ab');
+    expect(result.events).toEqual([]);
+    expect(collectTerminalSemanticEvents(result.events)).toEqual([]);
+  });
+
+  it.each(['Build finished', '3 tests failed', '42%', '12 done'])('still notifies for the message OSC 9;%s', (body) => {
+    expect(new TerminalProtocolParser().process(`\x1b]9;${body}\x07`).events).toEqual([
+      { kind: 'notification', notification: { source: 'OSC 9', title: null, body } },
+    ]);
+  });
+
   it('keeps additional OSC 777 semicolons in the body', () => {
     const parser = new TerminalProtocolParser();
     const result = parser.process('\x1b]777;notify;Title;one;two;three\x07');
@@ -562,6 +578,70 @@ describe('TerminalProtocolParser', () => {
     expect(parser.process('\x1b]633;E;\\x01\\x02\x07').events).toEqual([]);
   });
 
+  // fish >= 4 (`cmdline_url`) and kitty's shell integration (`cmdline`, printf
+  // %q) report the command line on 133;C itself, staged before the start.
+  it.each([
+    ['cmdline_url=claude%20--resume', 'claude --resume'],
+    ['cmdline_url=echo%20%27hi%20there%27%20%7C%20cat%3B%20true%20%26%26%20ls', "echo 'hi there' | cat; true && ls"],
+    ['cmdline_url=echo%20%E2%9C%93', 'echo ✓'],
+    ['cmdline_url=echo%2', 'echo%2'],
+    ['cmdline_url=bad%E2%9Cbyte', 'bad�byte'],
+    ['k=v;cmdline_url=pnpm%20dev', 'pnpm dev'],
+    ['cmdline=claude\\ --resume', 'claude --resume'],
+    ['cmdline=echo\\ a\;\\ b', 'echo a; b'],
+    ["cmdline=printf\\ $'a;b\\tc'\\ \\'x\\'", "printf a;b c 'x'"],
+    ["cmdline=echo\\ ''", 'echo'],
+    ['cmdline_url=first;cmdline=second', 'first'],
+  ])('reads the OSC 133;C command line from %j', (params, commandLine) => {
+    const events = new TerminalProtocolParser().process(`\x1b]133;C;${params}\x1b\\`).events;
+    expect(events).toEqual([
+      { kind: 'semantic', event: { type: 'commandLine', commandLine } },
+      { kind: 'semantic', event: { type: 'commandStart', source: 'osc133_boundaries' } },
+    ]);
+  });
+
+  it('starts an OSC 133 command with no command line when C carries none', () => {
+    const parser = new TerminalProtocolParser();
+    for (const payload of ['133;C', '133;C;', '133;C;k=v', '133;C;cmdline_url=', '133;C;cmdline_url=%01%1b']) {
+      expect(parser.process(`\x1b]${payload}\x07`).events, payload).toEqual([
+        { kind: 'semantic', event: { type: 'commandStart', source: 'osc133_boundaries' } },
+      ]);
+    }
+  });
+
+  it('reads an OSC 133;C command line split across PTY reads', () => {
+    const parser = new TerminalProtocolParser();
+    expect(parser.process('\x1b]133;C;cmdline_url=pnpm%2').events).toEqual([]);
+    expect(parser.process('0dev\x1b\\').events).toEqual([
+      { kind: 'semantic', event: { type: 'commandLine', commandLine: 'pnpm dev' } },
+      { kind: 'semantic', event: { type: 'commandStart', source: 'osc133_boundaries' } },
+    ]);
+  });
+
+  it('bounds and sanitizes the OSC 133;C command line', () => {
+    const parser = new TerminalProtocolParser();
+    expect(parser.process('\x1b]133;C;cmdline_url=git%0A%1Bcommit\x07').events[0]).toEqual(
+      { kind: 'semantic', event: { type: 'commandLine', commandLine: 'git commit' } },
+    );
+    expect(parser.process("\x1b]133;C;cmdline=git$'\\n\\E'commit\x07").events[0]).toEqual(
+      { kind: 'semantic', event: { type: 'commandLine', commandLine: 'git commit' } },
+    );
+    for (const params of [`cmdline_url=${'%E2%9C%93'.repeat(30_000)}`, `cmdline=${'a'.repeat(100_000)}`]) {
+      const [event] = parser.process(`\x1b]133;C;${params}\x07`).events;
+      if (event?.kind !== 'semantic' || event.event.type !== 'commandLine') throw new Error('expected a commandLine');
+      expect(Array.from(event.event.commandLine)).toHaveLength(2048);
+    }
+  });
+
+  it('gives a fish pane its real command name in the header', () => {
+    const parser = new TerminalProtocolParser();
+    const events = collectTerminalSemanticEvents(parser.process('\x1b]133;A;click_events=1\x07$ \x1b]133;B\x07\x1b]133;C;cmdline_url=pnpm%20test%20--watch\x07').events);
+    let pane = createTerminalPaneState();
+    for (const event of events) pane = reduceTerminalState(pane, event);
+    expect(pane.currentCommand?.rawCommandLine).toBe('pnpm test --watch');
+    expect(deriveHeader(pane, [pane]).primary).toBe('pnpm test --watch');
+  });
+
   // W1: the OSC terminator scan runs on raw bytes, so a `Cwd=` payload holding
   // one ends the sequence early and everything after it parses as a fresh,
   // fully-trusted OSC. The parser cannot defend against this — by the time it
diff --git a/lib/src/lib/terminal-protocol.ts b/lib/src/lib/terminal-protocol.ts
index 307b569bf..0d4d8a02c 100644
--- a/lib/src/lib/terminal-protocol.ts
+++ b/lib/src/lib/terminal-protocol.ts
@@ -334,6 +334,11 @@ export class TerminalProtocolParser {
       return progress ? [{ kind: 'progress', progress }] : [];
     }
 
+    // ConEmu's numbered subcommands (sleep, tab title, GuiMacro, a bare `9;9`,
+    // the `9;12` prompt mark, ...) are not messages. A message only reaches
+    // here if it does not open with a number followed by `;` or its end.
+    if (/^9;\d+(?:;|$)/.test(content)) return [];
+
     const body = sanitizeText(content.slice(2), BODY_LIMIT);
     return body
       ? [{ kind: 'notification', notification: { source: 'OSC 9', title: null, body } }]
@@ -643,7 +648,107 @@ function parseOsc7(content: string): TerminalProtocolEvent[] {
 function parseOsc133(content: string): TerminalProtocolEvent[] {
   const fields = content.split(';');
   if (fields[0] !== '133') return [];
-  return parsePromptBoundary(fields, 'osc133_boundaries');
+  const boundary = parsePromptBoundary(fields, 'osc133_boundaries');
+  // Staged ahead of the start it names, exactly as `633;E` precedes `633;C`.
+  return fields[1] === 'C' ? [...parseOsc133CommandLine(content.slice('133;C'.length)), ...boundary] : boundary;
+}
+
+/**
+ * The command line fish ≥ 4 and kitty's shell integration put on `133;C`
+ * itself: `cmdline_url=` (percent-encoded UTF-8) or `cmdline=` (one word quoted
+ * by `printf %q`). `params` is everything after the `C`. `cmdline_url` wins when
+ * both are present, being unambiguous; unknown keys are ignored.
+ *
+ * `%q` can leave a raw `;` inside `$'…'`, so `cmdline=` runs to the end of the
+ * sequence, which is where both emitters put it. Bounded before decoding and
+ * sanitized after, like `633;E` — decoding is what re-introduces control
+ * characters.
+ */
+function parseOsc133CommandLine(params: string): TerminalProtocolEvent[] {
+  let url: string | null = null;
+  let quoted: string | null = null;
+  for (let from = 0; from < params.length && quoted === null;) {
+    const start = from + 1;
+    const end = params.indexOf(';', start);
+    const field = params.slice(start, end === -1 ? params.length : end);
+    if (field.startsWith('cmdline=')) quoted = params.slice(start + 'cmdline='.length);
+    else if (field.startsWith('cmdline_url=')) url ??= field.slice('cmdline_url='.length);
+    if (end === -1) break;
+    from = end;
+  }
+  const decoded = url !== null
+    // One code point is at most four UTF-8 bytes of three characters each.
+    ? decodePercentEncoded(truncateText(url, COMMAND_LINE_LIMIT * 12))
+    : quoted !== null
+      ? decodeShellQuotedWord(truncateText(quoted, COMMAND_LINE_LIMIT * 4))
+      : null;
+  const commandLine = decoded === null ? null : sanitizeText(decoded, COMMAND_LINE_LIMIT);
+  return commandLine === null ? [] : [{ kind: 'semantic', event: { type: 'commandLine', commandLine } }];
+}
+
+/** `%XX` runs decoded as UTF-8; a malformed escape stays literal and an invalid
+ *  byte sequence becomes U+FFFD, so a truncated tail never throws. */
+function decodePercentEncoded(value: string): string {
+  return value.replace(/(?:%[0-9a-fA-F]{2})+/g, (run) => {
+    const bytes = new Uint8Array(run.length / 3);
+    for (let i = 0; i < bytes.length; i += 1) bytes[i] = Number.parseInt(run.slice(i * 3 + 1, i * 3 + 3), 16);
+    return new TextDecoder().decode(bytes);
+  });
+}
+
+const ANSI_C_ESCAPES: Record<string, string> = {
+  a: '\x07', b: '\b', e: '\x1b', E: '\x1b', f: '\f', n: '\n', r: '\r', t: '\t', v: '\v',
+};
+const ANSI_C_NUMERIC_ESCAPE = /^(?:x([0-9a-fA-F]{1,2})|u([0-9a-fA-F]{1,4})|U([0-9a-fA-F]{1,8})|([0-7]{1,3}))/;
+
+/**
+ * Undo one `printf %q` word: `\x` escapes, `'…'`, and `$'…'` ANSI-C quoting
+ * (bash and zsh use it for control characters). An unterminated quote runs to
+ * the end. Double quotes are literal: `%q` never emits them unescaped.
+ */
+function decodeShellQuotedWord(value: string): string {
+  let out = '';
+  let i = 0;
+  while (i < value.length) {
+    const char = value[i]!;
+    if (char === '\\') {
+      out += value[i + 1] ?? '';
+      i += 2;
+    } else if (char === "'") {
+      const close = value.indexOf("'", i + 1);
+      const end = close === -1 ? value.length : close;
+      out += value.slice(i + 1, end);
+      i = end + 1;
+    } else if (char === '$' && value[i + 1] === "'") {
+      i += 2;
+      while (i < value.length && value[i] !== "'") {
+        if (value[i] !== '\\') {
+          out += value[i];
+          i += 1;
+          continue;
+        }
+        const rest = value.slice(i + 1, i + 10);
+        const numeric = ANSI_C_NUMERIC_ESCAPE.exec(rest);
+        if (numeric) {
+          const [whole, hex, u4, u8, octal] = numeric;
+          const code = Number.parseInt(hex ?? u4 ?? u8 ?? octal!, octal ? 8 : 16);
+          out += code <= 0x10ffff ? String.fromCodePoint(code) : '';
+          i += 1 + whole.length;
+        } else if (rest[0] === 'c' && rest.length > 1) {
+          out += String.fromCharCode(rest.charCodeAt(1) & 0x1f);
+          i += 3;
+        } else {
+          out += ANSI_C_ESCAPES[rest[0] ?? ''] ?? rest[0] ?? '';
+          i += 2;
+        }
+      }
+      i += 1;
+    } else {
+      out += char;
+      i += 1;
+    }
+  }
+  return out;
 }
 
 function parseOsc633(content: string): TerminalProtocolEvent[] {
diff --git a/lib/src/lib/terminal-registry.alert.test.ts b/lib/src/lib/terminal-registry.alert.test.ts
index e261991c4..bfb82c655 100644
--- a/lib/src/lib/terminal-registry.alert.test.ts
+++ b/lib/src/lib/terminal-registry.alert.test.ts
@@ -141,7 +141,7 @@ import {
 } from './terminal-registry';
 import { pasteFilePaths } from './clipboard';
 import { registry } from './terminal-store';
-import { commandArgv0 } from './terminal-state';
+import { commandWatchKey } from './terminal-state';
 import { REPLAY_MODE_RESET } from './terminal-report-filter';
 import { cfg } from '../cfg';
 import { TerminalWebglRenderer } from './terminal-webgl';
@@ -259,7 +259,7 @@ function runCommand(id: string, commandLine = 'longtask'): void {
 /** Run `commandLine` and turn its WATCHING rule on, as the terminal context would. */
 function enableAlert(id: string, commandLine = 'longtask'): void {
   runCommand(id, commandLine);
-  setCommandWatched(commandArgv0(commandLine), true);
+  setCommandWatched(commandWatchKey(commandLine)!, true);
   expect(getActivity(id).watchingEnabled).toBe(true);
 }
 
diff --git a/lib/src/lib/terminal-registry.ts b/lib/src/lib/terminal-registry.ts
index 8578f9ac4..e7012d713 100644
--- a/lib/src/lib/terminal-registry.ts
+++ b/lib/src/lib/terminal-registry.ts
@@ -59,6 +59,7 @@ export type { SurfaceFocusHandle } from './terminal-lifecycle';
 export { setDefaultShellOpts, getDefaultShellOpts } from './shell-defaults';
 
 export {
+  commandWatchRule,
   getWatchedCommands,
   getWatchedCommandsSnapshot,
   isCommandWatched,
@@ -99,7 +100,7 @@ export {
   countRunningSessionsIn,
   ensureTerminalPaneState,
   fillTerminalProcessCwd,
-  getRunningCommandArgv0,
+  getRunningCommandWatchKey,
   getInheritableCwd,
   getTerminalPaneState,
   getTerminalPaneStateSnapshot,
diff --git a/lib/src/lib/terminal-state-store.ts b/lib/src/lib/terminal-state-store.ts
index 0569ba358..2626fa229 100644
--- a/lib/src/lib/terminal-state-store.ts
+++ b/lib/src/lib/terminal-state-store.ts
@@ -1,7 +1,7 @@
 import { recordToolDirty } from './tool-dirty-store';
 import { registry } from './terminal-store';
 import {
-  commandArgv0,
+  commandWatchKey,
   createTerminalPaneState,
   cwdFromManualPath,
   cwdFromProcessPath,
@@ -73,15 +73,13 @@ export function getInheritableCwd(id: string): string | undefined {
 }
 
 /**
- * The bare program name of the pane's foreground command, or null when the pane
- * is at a prompt (or its shell reported no command line). This is the key the
- * WATCHING rule set is stored under, so the terminal context and the alert
- * dialog both use it to decide which rule they are toggling — see
- * `docs/specs/alert.md`.
+ * The `commandWatchKey` of the pane's foreground command, or null when the pane
+ * is at a prompt (or its shell reported no command line) — the key the WATCHING
+ * rule set is stored under (`docs/specs/alert.md`).
  */
-export function getRunningCommandArgv0(id: string): string | null {
+export function getRunningCommandWatchKey(id: string): string | null {
   const raw = paneStates.get(id)?.currentCommand?.rawCommandLine;
-  return raw ? commandArgv0(raw) : null;
+  return raw ? commandWatchKey(raw) : null;
 }
 
 // Count sessions whose latest activity is a live/running command (not an idle
diff --git a/lib/src/lib/terminal-state.test.ts b/lib/src/lib/terminal-state.test.ts
index 91abea6b5..194a0beb8 100644
--- a/lib/src/lib/terminal-state.test.ts
+++ b/lib/src/lib/terminal-state.test.ts
@@ -2,8 +2,10 @@ import { describe, expect, it } from 'vitest';
 import { POSIX_ESCAPABLE } from './posix-escape';
 import { shellEscapePosix } from './shell-escape';
 import {
-  commandArgv0,
+  commandWatchKey,
   createTerminalPaneState,
+  isWatchKey,
+  watchRuleFor,
   cwdDisplay,
   cwdFromManualPath,
   cwdFromOsc7,
@@ -336,6 +338,112 @@ describe('command title summarizer', () => {
   });
 });
 
+describe('WATCHING key', () => {
+  it.each([
+    ['claude', 'claude'],
+    ['claude --print hello', 'claude'],
+    ['/usr/local/bin/claude --resume', 'claude'],
+    ['FOO=1 env BAR=2 claude', 'claude'],
+    ['"/opt/my tools/claude" --print', 'claude'],
+    // The list's last command is what the line waits on; earlier ones set up.
+    ['cd web && pnpm dev', 'pnpm dev'],
+    ['clear; claude', 'claude'],
+    ['make || say failed', 'say'],
+    ['pnpm dev &', 'pnpm dev'],
+    ['cd web\npnpm dev', 'pnpm dev'],
+    ['pnpm \\\n  dev', 'pnpm dev'],
+    // A pipeline's first stage is the producer.
+    ['claude | tee log', 'claude'],
+    ['foo | claude', 'foo'],
+    // Grouping is lexical only.
+    ['(cd web && pnpm dev)', 'pnpm dev'],
+    ['{ cd web; pnpm dev; }', 'pnpm dev'],
+    ['(cd web && pnpm dev) | tee log', 'pnpm dev'],
+    // Transparent wrappers, with the flags they take.
+    ['sudo make', 'make'],
+    ['sudo -u root FOO=1 make install', 'make install'],
+    ['sudo --preserve-env=PATH make', 'make'],
+    ['doas -u root make', 'make'],
+    ['time make', 'make'],
+    ['time -p make', 'make'],
+    ['caffeinate -i claude', 'claude'],
+    ['caffeinate -dims -t 600 claude', 'claude'],
+    ['nohup x', 'x'],
+    ['nice -n 5 x', 'x'],
+    ['nice -5 x', 'x'],
+    ['env FOO=1 claude', 'claude'],
+    ['env -i PATH=/bin claude', 'claude'],
+    ['command claude', 'claude'],
+    ['builtin exec -a agent claude', 'claude'],
+    ['stdbuf -oL make', 'make'],
+    ['timeout -s KILL 5m cargo test', 'cargo test'],
+    ['npx claude', 'claude'],
+    ['npx -y claude@latest', 'claude'],
+    ['npx --package @anthropic-ai/claude-code claude', 'claude'],
+    ['bunx vite', 'vite'],
+    ['uvx --from ruff ruff', 'ruff'],
+    ['pnpm dlx x', 'x'],
+    ['yarn dlx create-vite', 'create-vite'],
+    ['npm exec -- vitest', 'vitest'],
+    ['sudo nice -n 5 time make all', 'make all'],
+    // A flag it does not know stops the skip rather than guessing.
+    ['sudo --bogus make', 'sudo'],
+    ['command -v claude', 'command'],
+    ['env -S "claude --x"', 'env'],
+    ['sudo', 'sudo'],
+    ['timeout 5m', 'timeout'],
+    // Runners key by script, sharing one key across both spellings.
+    ['npm run dev', 'npm dev'],
+    ['npm run-script dev', 'npm dev'],
+    ['npm test', 'npm test'],
+    ['npm run --silent test:unit', 'npm test:unit'],
+    ['pnpm dev', 'pnpm dev'],
+    ['pnpm run dev', 'pnpm dev'],
+    ['pnpm -C web dev', 'pnpm dev'],
+    ['pnpm --filter=web dev', 'pnpm dev'],
+    ['pnpm -r build', 'pnpm build'],
+    ['yarn --cwd web dev', 'yarn dev'],
+    ['bun run dev', 'bun dev'],
+    ['cargo +nightly build', 'cargo build'],
+    ['cargo --color always test', 'cargo test'],
+    ['make -j8 all', 'make all'],
+    ['make -j 8 all', 'make all'],
+    ['make -j all', 'make all'],
+    ['make -C web CC=clang all', 'make all'],
+    ['make', 'make'],
+    ['just --justfile x build', 'just build'],
+    ['pnpm', 'pnpm'],
+    ['pnpm run', 'pnpm'],
+    // A script that could not be a key keys as the runner.
+    ['make build/app.o', 'make'],
+    ['npm run "my script"', 'npm'],
+  ])('keys %j as %j', (raw, expected) => {
+    expect(commandWatchKey(raw)).toBe(expected);
+    expect(isWatchKey(expected)).toBe(true);
+  });
+
+  it.each(['', '   ', '|', 'FOO=1', ';', '"my tool" --flag'])('has no key for %j', (raw) => {
+    expect(commandWatchKey(raw)).toBeNull();
+  });
+
+  it('matches a rule exactly, and a bare runner rule for every script of that runner', () => {
+    expect(watchRuleFor(new Set(['pnpm']), 'pnpm dev')).toBe('pnpm');
+    expect(watchRuleFor(new Set(['pnpm']), 'pnpm')).toBe('pnpm');
+    expect(watchRuleFor(new Set(['pnpm test']), 'pnpm dev')).toBeNull();
+    expect(watchRuleFor(new Set(['pnpm test', 'pnpm']), 'pnpm test')).toBe('pnpm test');
+    expect(watchRuleFor(new Set(['pnpm dev']), 'pnpm')).toBeNull();
+    expect(watchRuleFor(new Set(['claude']), 'claude')).toBe('claude');
+    expect(watchRuleFor(new Set(['claude']), null)).toBeNull();
+  });
+
+  it('accepts a bare name or exactly one runner and script', () => {
+    for (const key of ['claude', 'foo:bar', 'pnpm dev', 'npm test:unit']) expect(isWatchKey(key), key).toBe(true);
+    for (const key of ['', 'pnpm  dev', 'a b c', ' pnpm', 'pnpm ', 'npm.cmd test', 'npm.cmd', 'C:foo', 'pnpm C:x', 'make build/x', '/usr/bin/claude', 'a\tb']) {
+      expect(isWatchKey(key), key).toBe(false);
+    }
+  });
+});
+
 describe('command tokenizer dialects', () => {
   // A backslash is a path separator unless it precedes something a shell really
   // escapes, so both dialects reduce to the bare program name.
@@ -343,32 +451,32 @@ describe('command tokenizer dialects', () => {
     // Windows: absolute paths, launchers, a quoted path with spaces.
     ['C:\\tools\\dor.cmd tool storybook', 'dor', 'dor tool storybook'],
     ['C:\\Users\\me\\.claude\\local\\claude', 'claude', 'claude'],
-    ['"C:\\Program Files\\nodejs\\npm.cmd" run dev', 'npm', 'npm run dev'],
+    ['"C:\\Program Files\\nodejs\\npm.cmd" run dev', 'npm dev', 'npm run dev'],
     ['\\\\build\\share\\tools\\claude.exe --print', 'claude', 'claude --print'],
-    ['FOO=1 "C:\\Program Files\\nodejs\\npm.cmd" run dev', 'npm', 'npm run dev'],
+    ['FOO=1 "C:\\Program Files\\nodejs\\npm.cmd" run dev', 'npm dev', 'npm run dev'],
     // PowerShell's call operator, the only way that shell runs a quoted path.
-    // Without the leading-`&` skip it reads as a boundary and argv0 is null.
-    ['& "C:\\Program Files\\nodejs\\npm.cmd" run dev', 'npm', 'npm run dev'],
+    // Without the leading-`&` skip it reads as a boundary and the key is null.
+    ['& "C:\\Program Files\\nodejs\\npm.cmd" run dev', 'npm dev', 'npm run dev'],
     ['& C:\\tools\\dor.cmd tool storybook', 'dor', 'dor tool storybook'],
     // POSIX escapes keep their meaning.
     ['/opt/my\\ tools/claude --print', 'claude', 'claude --print'],
     ['grep \\*.ts src', 'grep', 'grep *.ts src'],
     ['echo a\\\\b', 'echo', 'echo a\\b'],
-  ])('reduces %j to %j / %j', (raw, argv0, summary) => {
-    expect(commandArgv0(raw)).toBe(argv0);
+  ])('reduces %j to %j / %j', (raw, watchKey, summary) => {
+    expect(commandWatchKey(raw)).toBe(watchKey);
     expect(summarizeCommandLine(raw)).toBe(summary);
   });
 
   // An unquoted Windows path with spaces is undecidable without probing the
   // filesystem — `A\B C\D.cmd` is equally `A\B` plus an argument — so the
-  // tokenizer splits it and argv0 misses rather than naming the wrong program.
+  // tokenizer splits it and the key misses rather than naming the wrong program.
   it('leaves an unquoted Windows path with spaces split', () => {
-    expect(commandArgv0('C:\\Program Files\\nodejs\\npm.cmd run dev')).toBe('Program');
-    expect(commandArgv0('"C:\\Program Files\\Git\\bin\\bash" scripts\\bootstrap.cmd')).toBe('bash');
+    expect(commandWatchKey('C:\\Program Files\\nodejs\\npm.cmd run dev')).toBe('Program');
+    expect(commandWatchKey('"C:\\Program Files\\Git\\bin\\bash" scripts\\bootstrap.cmd')).toBe('bash');
   });
 
   it('pins the ordinary POSIX argv[0] escape cost of dialect-free tokenizing', () => {
-    expect(commandArgv0('foo\\-bar')).toBe('-bar');
+    expect(commandWatchKey('foo\\-bar')).toBe('-bar');
   });
 
   // `POSIX_ESCAPABLE` is `shellEscapePosix`'s set; the tokenizer unescapes it.
diff --git a/lib/src/lib/terminal-state.ts b/lib/src/lib/terminal-state.ts
index 7e36f81eb..179048348 100644
--- a/lib/src/lib/terminal-state.ts
+++ b/lib/src/lib/terminal-state.ts
@@ -376,31 +376,59 @@ export function summarizeCommandLine(raw: string): string {
 }
 
 /**
- * The first word of a command line, reduced to a bare program name: anything
- * after the first pipeline/compound boundary is dropped, leading `VAR=value`
- * assignments and a leading `env` are skipped, and argv[0] is taken as a
- * basename. `claude`, `/usr/bin/claude --print`, and `FOO=1 env BAR=2 claude`
- * all yield `claude`; `foo | claude` yields `foo`. Returns null when the line
- * holds no runnable word.
+ * The key WATCHING rules are stored under (`docs/specs/alert.md` -> WATCHING
+ * Track): the program the line is really waiting on, as a bare name, or
+ * `<runner> <script>` for a script runner. Returns null when the line holds no
+ * runnable word. Every key it returns passes {@link isWatchKey}.
  *
- * A Windows launcher suffix is not part of the name: `C:\tools\claude.exe`,
- * `npm.cmd` and `build.ps1` yield `claude`, `npm` and `build`. `.exe` / `.cmd`
- * is how one program spells itself when PATHEXT resolves it, so keeping the
- * suffix would leave `npm` and `npm.cmd` as two rules for one program — the
- * miss this whole path exists to close. Accepted: `foo.bat` and `foo.exe` in
- * one directory cannot be watched separately.
- *
- * This is the key WATCHING rules are stored under — see `docs/specs/alert.md`.
+ * - **The last command of a list** (`&&`, `||`, `;`, `&`, newline), since the
+ *   earlier ones are set-up (`cd web && pnpm dev`, `clear; claude`), and **the
+ *   first stage of its pipeline** (`claude | tee log`). Grouping parentheses and
+ *   braces are dropped, so `(cd web && pnpm dev)` is `pnpm dev`; a group
+ *   followed by more of the list keys on what follows it.
+ * - **Transparent wrappers are skipped** with the flags they are known to take
+ *   ({@link TRANSPARENT_WRAPPERS}), along with leading `VAR=value` words.
+ * - **A launcher suffix is not part of the name** — see
+ *   {@link commandProgramName}.
+ * - **Runners key by script** ({@link SCRIPT_RUNNERS}); a script that could not
+ *   be a key (a path, a quoted phrase) keys as the bare runner.
+ */
+export function commandWatchKey(raw: string): string | null {
+  const segments = splitCommandList(tokenizeCommand(raw.trim())).map(ungroupedWords);
+  const words = segments.reverse().find((segment) => segment.length > 0) ?? [];
+  const pipe = words.indexOf('|');
+  return watchKeyOfCommand(pipe === -1 ? words : words.slice(0, pipe));
+}
+
+/**
+ * Whether `name` is a WATCHING key some command line can produce: a bare
+ * program name, or exactly `<runner> <script>`. Neither part holds a path
+ * separator or a Windows drive prefix, and the program never ends in a launcher
+ * suffix — `commandProgramName` strips those.
+ */
+export function isWatchKey(name: string): boolean {
+  const parts = name.split(' ');
+  if (parts.length > 2 || parts.some((part) => !part || /[\\/\s]|^[A-Za-z]:/.test(part))) return false;
+  return !WINDOWS_EXECUTABLE_SUFFIX.test(parts[0]!);
+}
+
+/**
+ * The rule in `rules` that covers `key`, or null: the key itself, else — for a
+ * `<runner> <script>` key — a bare rule on its runner, which keeps matching
+ * every script of that runner.
  */
-export function commandArgv0(raw: string): string | null {
-  return commandProgramName(primaryCommandTokens(raw)[0] ?? '') || null;
+export function watchRuleFor(rules: ReadonlySet<string>, key: string | null): string | null {
+  if (key === null) return null;
+  if (rules.has(key)) return key;
+  const space = key.indexOf(' ');
+  const runner = space === -1 ? null : key.slice(0, space);
+  return runner !== null && rules.has(runner) ? runner : null;
 }
 
 /**
  * The tokens of the first command on a line: quote- and escape-aware, truncated
  * at the first pipeline/compound boundary, with leading `VAR=value` assignments
- * and a leading `env` skipped. `commandArgv0` is `commandProgramName` of the
- * first of these.
+ * and a leading `env` skipped.
  */
 export function primaryCommandTokens(raw: string): string[] {
   return takePrimaryCommandTokens(tokenizeCommand(raw.trim()));
@@ -883,7 +911,8 @@ function withRequiredHostPrefixes(
 /**
  * Split a command line into words, honoring quotes, POSIX backslash escapes,
  * and the pipeline/compound separators `| || && ; &`, which are emitted as
- * their own tokens.
+ * their own tokens. An unquoted newline separates commands like `;`, and a
+ * backslash-newline continues the line.
  *
  * A `\` escapes exactly the `POSIX_ESCAPABLE` set (`foo\ bar` is one token,
  * `\*.ts` passes a literal glob, and a path Dormouse escaped for paste reads
@@ -919,6 +948,10 @@ function tokenizeCommand(input: string): string[] {
     }
     if (char === '\\' && quote !== "'") {
       const next = input[i + 1];
+      if (next === '\n') {
+        i += 1;
+        continue;
+      }
       if (next !== undefined && POSIX_ESCAPABLE.test(next)) {
         escaping = true;
         continue;
@@ -935,6 +968,11 @@ function tokenizeCommand(input: string): string[] {
       quote = char;
       continue;
     }
+    if (char === '\n') {
+      push();
+      tokens.push(';');
+      continue;
+    }
     if (/\s/.test(char)) {
       push();
       continue;
@@ -984,19 +1022,215 @@ function isEnvAssignment(token: string | undefined): boolean {
   return !!token && /^[A-Za-z_][A-Za-z0-9_]*=/.test(token);
 }
 
+const LIST_SEPARATORS = new Set(['&&', '||', ';', '&']);
+
+/** Tokens split into the commands of a list; a pipeline stays in one piece. */
+function splitCommandList(tokens: string[]): string[][] {
+  const segments: string[][] = [[]];
+  for (const token of tokens) {
+    if (LIST_SEPARATORS.has(token)) segments.push([]);
+    else segments[segments.length - 1]!.push(token);
+  }
+  return segments;
+}
+
+/** One list segment without the `(` / `{` / `)` / `}` of a subshell or group
+ *  around it — lexical only, so a group's inner list is split like any other. */
+function ungroupedWords(segment: string[]): string[] {
+  return segment
+    .map((word, index) => (index === 0 ? word.replace(/^[({]+/, '') : word).replace(/\)+$/, ''))
+    .filter((word) => word !== '' && word !== '}');
+}
+
+interface FlagSpec {
+  /** Flags that take the next word as their value, or attached (`-uroot`, `--user=root`). */
+  value?: readonly string[];
+  /** Flags that stand alone; single letters may cluster (`-di`). */
+  bool?: readonly string[];
+  /** A stand-alone flag shape not worth listing (nice's `-5`). */
+  boolPattern?: RegExp;
+  /** Value flags whose value is optional and numeric (make's `-j` / `-j 8`). */
+  numeric?: readonly string[];
+  /** `VAR=value` words it accepts among its flags (`sudo FOO=1 make`). */
+  assignments?: boolean;
+}
+
+interface WrapperSpec extends FlagSpec {
+  /** Positional words before the command it runs (`timeout 5m make`). */
+  operands?: number;
+  /** The command is a package spec, whose `@version` is not part of the name. */
+  packageSpec?: boolean;
+}
+
+/**
+ * Programs that run the command named after their own flags, keyed as one word
+ * or as a launcher's two (`pnpm dlx`). Only the flags listed are understood: an
+ * unknown one stops the skip and the wrapper keys as itself, rather than
+ * guessing whether that flag swallowed the next word. `env -S` and
+ * `command -v` are unknown on purpose — neither runs its next word.
+ */
+const TRANSPARENT_WRAPPERS: ReadonlyMap<string, WrapperSpec> = new Map(Object.entries({
+  env: { value: ['-u', '--unset', '-C', '--chdir'], bool: ['-', '-i', '--ignore-environment', '-0', '--null', '-v', '--debug'], assignments: true },
+  sudo: {
+    value: ['-u', '--user', '-g', '--group', '-p', '--prompt', '-C', '--close-from', '-D', '--chdir', '-r', '--role', '-t', '--type', '-T', '--command-timeout', '-U', '--other-user'],
+    bool: ['-E', '--preserve-env', '-H', '--set-home', '-n', '--non-interactive', '-S', '--stdin', '-b', '--background', '-k', '--reset-timestamp', '-P', '--preserve-groups', '-A', '--askpass', '-B', '--bell', '-i', '--login', '-s', '--shell'],
+    assignments: true,
+  },
+  doas: { value: ['-u'], bool: ['-n'] },
+  time: { value: ['-o', '--output', '-f', '--format'], bool: ['-p', '--portability', '-v', '--verbose', '-a', '--append', '-l'] },
+  nice: { value: ['-n', '--adjustment'], boolPattern: /^-\d+$/ },
+  nohup: {},
+  caffeinate: { value: ['-t', '-w'], bool: ['-d', '-i', '-m', '-s', '-u'] },
+  command: { bool: ['-p'] },
+  builtin: {},
+  exec: { value: ['-a'], bool: ['-c', '-l'] },
+  stdbuf: { value: ['-i', '--input', '-o', '--output', '-e', '--error'] },
+  timeout: { value: ['-k', '--kill-after', '-s', '--signal'], bool: ['-v', '--verbose', '--foreground', '--preserve-status'], operands: 1 },
+  npx: { value: ['-p', '--package'], bool: ['-y', '--yes', '--no', '-q', '--quiet'], packageSpec: true },
+  pnpx: { value: ['--package'], bool: ['-s', '--silent'], packageSpec: true },
+  bunx: { value: ['-p', '--package'], bool: ['--bun', '-y'], packageSpec: true },
+  uvx: { value: ['--from', '--with', '-p', '--python'], bool: ['-q', '--quiet', '-v', '--verbose', '--isolated', '--offline'], packageSpec: true },
+  'pnpm dlx': { value: ['--package'], bool: ['-s', '--silent'], packageSpec: true },
+  'yarn dlx': { value: ['-p', '--package'], bool: ['-q', '--quiet'], packageSpec: true },
+  'npm exec': { value: ['-p', '--package', '-w', '--workspace'], bool: ['-y', '--yes', '--no', '-q', '--quiet', '-ws', '--workspaces'], packageSpec: true },
+  'bun x': { value: ['-p', '--package'], bool: ['--bun', '-y'], packageSpec: true },
+} satisfies Record<string, WrapperSpec>));
+
+interface RunnerSpec extends FlagSpec {
+  /** A verb both spellings of a script share, dropped (`npm run test` is `npm test`). */
+  drop?: readonly string[];
+  /** A leading `+toolchain` word (`cargo +nightly build`). */
+  toolchain?: boolean;
+}
+
+/**
+ * Runners whose script is part of the key, so `pnpm dev` and `pnpm test` are
+ * two rules. `value` lists the flags before the script that take a word; any
+ * other flag is skipped as standing alone.
+ */
+const SCRIPT_RUNNERS: ReadonlyMap<string, RunnerSpec> = new Map(Object.entries({
+  npm: { value: ['-C', '--prefix', '-w', '--workspace'], drop: ['run', 'run-script'] },
+  pnpm: { value: ['-C', '--dir', '-F', '--filter'], drop: ['run'] },
+  yarn: { value: ['--cwd'], drop: ['run'] },
+  bun: { value: ['--cwd', '-F', '--filter', '-c', '--config'], drop: ['run'] },
+  cargo: { value: ['-C', '--color', '--config', '-Z'], toolchain: true },
+  make: {
+    value: ['-C', '--directory', '-f', '--file', '--makefile', '-I', '--include-dir', '-o', '--old-file', '-W', '--what-if'],
+    numeric: ['-j', '--jobs', '-l', '--load-average'],
+    assignments: true,
+  },
+  just: { value: ['-f', '--justfile', '-d', '--working-directory', '--shell', '--dotenv-path', '--dotenv-filename', '--color'], assignments: true },
+} satisfies Record<string, RunnerSpec>));
+
+/** How many words a flag occupies under `spec`: 0 when it is not one it knows. */
+function flagWidth(words: readonly string[], index: number, spec: FlagSpec): number {
+  const word = words[index]!;
+  if (spec.bool?.includes(word) || spec.boolPattern?.test(word)) return 1;
+  if (spec.value?.includes(word)) return 2;
+  if (spec.numeric?.includes(word)) return /^\d+(?:\.\d+)?$/.test(words[index + 1] ?? '') ? 2 : 1;
+  const equals = word.indexOf('=');
+  if (word.startsWith('--')) {
+    const name = equals > 0 ? word.slice(0, equals) : null;
+    return name !== null && [spec.value, spec.bool, spec.numeric].some((list) => list?.includes(name)) ? 1 : 0;
+  }
+  if (word.length > 2) {
+    const short = word.slice(0, 2);
+    if (spec.value?.includes(short) || spec.numeric?.includes(short)) return 1;
+    if ([...word.slice(1)].every((letter) => spec.bool?.includes(`-${letter}`))) return 1;
+  }
+  return 0;
+}
+
+/**
+ * The index of the command a wrapper at `index` runs, or null when `words`
+ * holds no wrapper there, or one whose flags are not understood.
+ */
+function wrappedCommandIndex(words: readonly string[], index: number): { index: number; spec: WrapperSpec } | null {
+  const program = commandProgramName(words[index] ?? '');
+  const launcher = TRANSPARENT_WRAPPERS.get(`${program} ${words[index + 1] ?? ''}`);
+  const spec = launcher ?? TRANSPARENT_WRAPPERS.get(program);
+  if (!spec) return null;
+  let i = index + (launcher ? 2 : 1);
+  while (i < words.length) {
+    const word = words[i]!;
+    if (word === '--') {
+      i += 1;
+      break;
+    }
+    if (spec.assignments && isEnvAssignment(word)) {
+      i += 1;
+      continue;
+    }
+    if (!word.startsWith('-')) break;
+    const width = flagWidth(words, i, spec);
+    if (width === 0) return null;
+    i += width;
+  }
+  i += spec.operands ?? 0;
+  return i < words.length ? { index: i, spec } : null;
+}
+
+/** One simple command's watch key: wrappers and assignments skipped, runners keyed by script. */
+function watchKeyOfCommand(words: readonly string[]): string | null {
+  let index = 0;
+  let packageSpec = false;
+  for (;;) {
+    while (isEnvAssignment(words[index])) index += 1;
+    const wrapped = wrappedCommandIndex(words, index);
+    if (!wrapped) break;
+    index = wrapped.index;
+    packageSpec = !!wrapped.spec.packageSpec;
+  }
+  let program = commandProgramName(words[index] ?? '');
+  // `claude@latest`, but not a scope's leading `@`.
+  if (packageSpec) program = program.replace(/^(.+?)@[^@]*$/, '$1');
+  // A name with a space in it would read back as `<runner> <script>`.
+  if (program.includes(' ') || !isWatchKey(program)) return null;
+  const runner = SCRIPT_RUNNERS.get(program);
+  if (!runner) return program;
+  const script = runnerScript(words, index + 1, runner);
+  return script !== null && isWatchKey(`${program} ${script}`) ? `${program} ${script}` : program;
+}
+
+/** The first word after a runner's own flags (and its shared verb): its script or target. */
+function runnerScript(words: readonly string[], from: number, spec: RunnerSpec): string | null {
+  let i = from;
+  if (spec.toolchain && words[i]?.startsWith('+')) i += 1;
+  let dropped = false;
+  while (i < words.length) {
+    const word = words[i]!;
+    if (word.startsWith('-') && word !== '-') {
+      i += Math.max(1, flagWidth(words, i, spec));
+    } else if (spec.assignments && isEnvAssignment(word)) {
+      i += 1;
+    } else if (!dropped && spec.drop?.includes(word)) {
+      dropped = true;
+      i += 1;
+    } else {
+      return word;
+    }
+  }
+  return null;
+}
+
 /** A path reduced to its last segment, in either dialect. */
 function commandBasename(command: string): string {
   return command.replace(/^.*[\\/]/, '');
 }
 
-/** PATHEXT's spellings of one program. Exported for `watched-commands.ts`,
- *  which drops a stored key ending in one: `commandArgv0` cannot produce one. */
-export const WINDOWS_EXECUTABLE_SUFFIX = /\.(?:exe|cmd|bat|com|ps1)$/i;
+/** PATHEXT's spellings of one program. */
+const WINDOWS_EXECUTABLE_SUFFIX = /\.(?:exe|cmd|bat|com|ps1)$/i;
 
 /**
  * argv[0] reduced to the one name a program answers to: no path, no launcher
  * suffix. The single answer to "which program is this", so the header, the
  * WATCHING rule row and the terminal context cannot disagree about it.
+ *
+ * `C:\tools\claude.exe`, `npm.cmd` and `build.ps1` are `claude`, `npm` and
+ * `build`: `.exe` / `.cmd` is how one program spells itself when PATHEXT
+ * resolves it, so keeping the suffix would leave `npm` and `npm.cmd` as two
+ * WATCHING rules for one program. Accepted: `foo.bat` and `foo.exe` in one
+ * directory cannot be watched separately.
  */
 export function commandProgramName(command: string): string {
   return commandBasename(command).replace(WINDOWS_EXECUTABLE_SUFFIX, '');
diff --git a/lib/src/lib/watched-commands.test.ts b/lib/src/lib/watched-commands.test.ts
index ec44a8ac7..40e08c4a5 100644
--- a/lib/src/lib/watched-commands.test.ts
+++ b/lib/src/lib/watched-commands.test.ts
@@ -7,9 +7,9 @@ vi.mock('./platform', () => ({
   getPlatform: () => ({ alertSetWatchedCommands, alertSetCommandWatched }),
 }));
 
-import { commandArgv0 } from './terminal-state';
 import {
   applyWatchedCommandsFromHost,
+  commandWatchRule,
   getWatchedCommands,
   isCommandWatched,
   publishWatchedCommands,
@@ -27,32 +27,6 @@ afterEach(() => {
   alertSetCommandWatched.mockClear();
 });
 
-describe('commandArgv0', () => {
-  it.each([
-    ['claude', 'claude'],
-    ['claude --print hello', 'claude'],
-    ['/usr/local/bin/claude --resume', 'claude'],
-    ['FOO=1 claude', 'claude'],
-    ['FOO=1 env BAR=2 claude', 'claude'],
-    ['"/opt/my tools/claude" --print', 'claude'],
-    // Only the first simple command counts — this matches what bash's DEBUG
-    // trap reports for a pipeline (docs/specs/terminal-escapes.md).
-    ['foo | claude', 'foo'],
-    ['pnpm test && claude', 'pnpm'],
-  ])('reduces %j to %j', (raw, expected) => {
-    expect(commandArgv0(raw)).toBe(expected);
-  });
-
-  it.each(['', '   ', '|', 'FOO=1'])('returns null for %j', (raw) => {
-    expect(commandArgv0(raw)).toBeNull();
-  });
-
-  it('reduces a native Windows path to the bare name a rule is stored under', () => {
-    // The tokenizer's dialect handling is pinned in `terminal-state.test.ts`.
-    expect(commandArgv0('C:\\Users\\me\\.claude\\local\\claude')).toBe('claude');
-  });
-});
-
 describe('watched-commands store', () => {
   it('drops a key no command line can ever produce', () => {
     // Written by the pre-fix tokenizer, which ate the backslashes in
@@ -66,7 +40,7 @@ describe('watched-commands store', () => {
     ]);
     expect(getWatchedCommands()).toEqual(['claude', 'foo:bar']);
     // Same gate on the write path — a drive-relative invocation is the one
-    // shape `commandArgv0` can still return with a `:` in it.
+    // shape a program name can still arrive in with a `:` in it.
     setCommandWatched('C:foo.exe', true);
     expect(getWatchedCommands()).toEqual(['claude', 'foo:bar']);
     // A launcher suffix is the other tell: a relative invocation had no
@@ -83,6 +57,32 @@ describe('watched-commands store', () => {
     expect(getWatchedCommands()).toEqual(['claude', 'foo:bar']);
   });
 
+  it('keeps a runner and script key and drops a malformed one', () => {
+    applyWatchedCommandsFromHost([
+      'pnpm dev',
+      'npm test:unit',
+      'pnpm',
+      'pnpm  dev',
+      'npm run dev extra',
+      'npm.cmd test',
+      'make build/app.o',
+      ' pnpm',
+    ]);
+    expect(getWatchedCommands()).toEqual(['npm test:unit', 'pnpm', 'pnpm dev']);
+    setCommandWatched('npm.cmd dev', true);
+    setCommandWatched('cargo build', true);
+    expect(getWatchedCommands()).toEqual(['cargo build', 'npm test:unit', 'pnpm', 'pnpm dev']);
+  });
+
+  it('names the rule covering a running command, a bare runner covering its scripts', () => {
+    setCommandWatched('pnpm test', true);
+    expect(commandWatchRule('pnpm test')).toBe('pnpm test');
+    expect(commandWatchRule('pnpm dev')).toBeNull();
+    setCommandWatched('pnpm', true);
+    expect(commandWatchRule('pnpm dev')).toBe('pnpm');
+    expect(commandWatchRule(null)).toBeNull();
+  });
+
   it('adds, reports, and removes rules', () => {
     expect(getWatchedCommands()).toEqual([]);
     expect(isCommandWatched('claude')).toBe(false);
diff --git a/lib/src/lib/watched-commands.ts b/lib/src/lib/watched-commands.ts
index 2681f64d2..fa95e691c 100644
--- a/lib/src/lib/watched-commands.ts
+++ b/lib/src/lib/watched-commands.ts
@@ -1,9 +1,9 @@
 import { loadJson, saveJson } from './local-json-store';
 import { getPlatform } from './platform';
-import { WINDOWS_EXECUTABLE_SUFFIX } from './terminal-state';
+import { isWatchKey, watchRuleFor } from './terminal-state';
 
 /**
- * The WATCHING rule set: the bare program names (`commandArgv0` output) whose
+ * The WATCHING rule set: the command keys (`commandWatchKey` output) whose
  * Sessions run the output/silence monitor. WATCHING is a property of the
  * command, not of a Session — enabling it while `claude` runs enables it for
  * every Session running `claude`, now and later. See `docs/specs/alert.md`.
@@ -19,37 +19,22 @@ function isStringArray(value: unknown): value is string[] {
   return Array.isArray(value) && value.every((entry) => typeof entry === 'string');
 }
 
-/**
- * Whether a stored key is one `commandArgv0` can still produce. It is a bare
- * program name, so it holds no separator or legacy Windows drive prefix, and it
- * never ends in a launcher suffix — `commandProgramName` strips those. Keys
- * written before this module's fixes fail one test or the other: a full path
- * mangled to `C:toolsclaude.exe`, a relative one to `toolsdor.cmd`, and a bare
- * launcher stored cleanly as `npm.cmd`. Each can only sit in the rule list as
- * a row that matches nothing, so it is dropped rather than shown.
- *
- * Residual: a mangled *relative* path with no suffix (`bin\claude` ->
- * `binclaude`) is indistinguishable from a program actually named that, and
- * survives. The user deletes it from the rule list.
- */
-function isKeyableName(name: string): boolean {
-  return (
-    !/[\\/]/.test(name) &&
-    !/^[A-Za-z]:/.test(name) &&
-    !WINDOWS_EXECUTABLE_SUFFIX.test(name)
-  );
-}
-
 function readStored(): string[] {
   return normalize(loadJson<string[], string[]>(STORAGE_KEY, [], isStringArray));
 }
 
-// Dedupe and drop what can never be a rule: the key is user-visible in devtools
-// and in the rule list, so a malformed entry would otherwise sit there as a row
-// that matches nothing. Applied to both sources, `localStorage` and the host's
-// canonical snapshot, since a stale key reaches the mirror either way.
+// Dedupe and drop what can never be a rule — a key `commandWatchKey` cannot
+// produce (`isWatchKey`): the key is user-visible in devtools and in the rule
+// list, so a malformed entry would otherwise sit there as a row that matches
+// nothing. Keys written before earlier fixes fail it: a full path mangled to
+// `C:toolsclaude.exe`, a relative one to `toolsdor.cmd`, a bare launcher stored
+// cleanly as `npm.cmd`. Residual: a mangled *relative* path with no suffix
+// (`bin\claude` -> `binclaude`) is indistinguishable from a program actually
+// named that, and survives until the user deletes it. Applied to both sources,
+// `localStorage` and the host's canonical snapshot, since a stale key reaches
+// the mirror either way.
 function normalize(names: string[]): string[] {
-  return [...new Set(names.map((name) => name.trim()).filter(Boolean).filter(isKeyableName))].sort();
+  return [...new Set(names.map((name) => name.trim()).filter(Boolean).filter(isWatchKey))].sort();
 }
 
 let watched: string[] = readStored();
@@ -74,12 +59,18 @@ export function isCommandWatched(name: string | null | undefined): boolean {
   return watched.includes(name);
 }
 
+/** The rule covering a running command's `commandWatchKey`, or null — a bare
+ *  runner rule covers every script of that runner. */
+export function commandWatchRule(key: string | null): string | null {
+  return watchRuleFor(new Set(watched), key);
+}
+
 export function setCommandWatched(name: string, on: boolean): void {
   const trimmed = name.trim();
   // Same gate `normalize` applies on the way in, so a key that would be dropped
   // on the next reload is never stored: it would otherwise match for the rest of
   // the session and then vanish with nothing on screen to explain it.
-  if (!trimmed || !isKeyableName(trimmed)) return;
+  if (!trimmed || !isWatchKey(trimmed)) return;
   if (watched.includes(trimmed) === on) return;
   watched = on
     ? [...watched, trimmed].sort()
diff --git a/lib/src/stories/SettingsDialog.stories.tsx b/lib/src/stories/SettingsDialog.stories.tsx
index 26aff9089..93687a3e0 100644
--- a/lib/src/stories/SettingsDialog.stories.tsx
+++ b/lib/src/stories/SettingsDialog.stories.tsx
@@ -138,9 +138,10 @@ export const CustomTimings: Story = {
 };
 
 /**
- * A realistic accumulated rule set next to a long command name. argv0 is a
- * basename so it is normally short, but nothing enforces that — a pathological
- * name must truncate instead of widening the dialog.
+ * A realistic accumulated rule set next to a long command name. A watch key is
+ * a basename or `<runner> <script>`, so it is normally short, but nothing
+ * enforces that — a pathological name must truncate instead of widening the
+ * dialog.
  */
 export const ManyRules: Story = {
   parameters: {
diff --git a/lib/src/stories/TerminalContext.stories.tsx b/lib/src/stories/TerminalContext.stories.tsx
index a63ef1891..172f7dab9 100644
--- a/lib/src/stories/TerminalContext.stories.tsx
+++ b/lib/src/stories/TerminalContext.stories.tsx
@@ -100,7 +100,7 @@ function ContextPrototype({ scenario, initialDetail = null, paneWidth }: { scena
       <TerminalContextView title="pnpm dev" surfaceRef="surface:3" cwd={PARENT_DIR} helperCwd={HELPER_DIR} mismatch={scenario === 'differentDirectory'}
         titleSources={[{ source: 'User override', value: 'Not set' }, { source: 'OSC 2', value: 'pnpm dev', note: 'Used' }, { source: 'OSC 0', value: 'zsh', note: 'Not used' }, { source: 'Command', value: 'pnpm dev', note: 'Fallback' }]}
         scan={scenario === 'scanFailed' ? { status: 'failed' } : { status: 'loaded', entries: scenario === 'noPorts' ? [] : ports }}
-        argv0="pnpm" watching={watching} todo={todo} notification={scenario === 'notification' ? { title: 'Tests complete', body: '341 passed, 0 failed' } : null}
+        watchRule="pnpm" watching={watching} todo={todo} notification={scenario === 'notification' ? { title: 'Tests complete', body: '341 passed, 0 failed' } : null}
         status={preserved ? 'preserved' : scenario === 'running' ? 'running' : scenario === 'autorunOff' ? 'off' : 'completed'} command={command}
         explorerLabel="Open in Finder" canExplore canAgent canIframe initialDetail={initialDetail}
         notepadAction={<NotepadHeaderButton surfaceId="context-gallery" />} notepadPanel={<NotepadPanel surfaceId="context-gallery" pins={false} />}
diff --git a/lib/src/stories/TerminalPaneHeader.stories.tsx b/lib/src/stories/TerminalPaneHeader.stories.tsx
index f748662f4..3d11aa6ed 100644
--- a/lib/src/stories/TerminalPaneHeader.stories.tsx
+++ b/lib/src/stories/TerminalPaneHeader.stories.tsx
@@ -12,7 +12,7 @@ import {
 } from '../components/Wall';
 import type { ActivityNotification, SessionStatus } from '../lib/alert-manager';
 import { summarizeCommandLine, type SetTerminalUserTitleResult } from '../lib/terminal-registry';
-import { commandArgv0, cwdFromOsc633 } from '../lib/terminal-state';
+import { commandWatchKey, cwdFromOsc633 } from '../lib/terminal-state';
 import { flattenScenario, SCENARIO_SHELL_PROMPT } from '../lib/platform';
 import { removeMouseSelectionState, setMouseReporting, setOverride } from '../lib/mouse-selection';
 import { addPlainNote, clearAllNotepads } from '../lib/notepad/notepad-store';
@@ -87,8 +87,8 @@ interface PanePriming {
  */
 function primedPane({ status, todo = false, notification, command = 'pnpm dev', userTitle = 'build-server' }: PanePriming) {
   const watching = SHOWN_ONLY_WHILE_WATCHING[status];
-  const argv0 = command ? commandArgv0(command) : null;
-  if (watching && !argv0) throw new Error(`${status} is public only while a watched command runs`);
+  const watchKey = command ? commandWatchKey(command) : null;
+  if (watching && !watchKey) throw new Error(`${status} is public only while a watched command runs`);
   return {
     primedSessionState: {
       byId: {
@@ -114,7 +114,7 @@ function primedPane({ status, todo = false, notification, command = 'pnpm dev',
         },
       },
     },
-    primedWatchedCommands: watching && argv0 ? [argv0] : [],
+    primedWatchedCommands: watching && watchKey ? [watchKey] : [],
   };
 }
 
@@ -396,7 +396,7 @@ export const AlertRightClickDialog: Story = contextDialogStory({
   command: 'claude --resume',
 });
 
-/** A pane at a prompt: no argv0, so the dialog explains instead of offering a switch. */
+/** A pane at a prompt: no watch key, so the dialog explains instead of offering a switch. */
 export const AlertDialogNoCommandRunning: Story = contextDialogStory({
   status: 'WATCHING_DISABLED',
   command: null,
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 4d08266cc..b33645654 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -2,7 +2,7 @@
   "AGENTS.md": 3400,
   "SECURITY.md": 200,
   "SELF_HOST.md": 6100,
-  "docs/specs/alert.md": 6850,
+  "docs/specs/alert.md": 7050,
   "docs/specs/auto-update.md": 1150,
   "docs/specs/deploy.md": 1900,
   "docs/specs/dor-browser.md": 4550,
@@ -10,7 +10,7 @@
   "docs/specs/dor-tool.md": 4100,
   "docs/specs/glossary.md": 2950,
   "docs/specs/hosted.md": 1100,
-  "docs/specs/layout.md": 10250,
+  "docs/specs/layout.md": 10350,
   "docs/specs/mobile-terminal-ui.md": 2000,
   "docs/specs/mouse-and-clipboard.md": 3750,
   "docs/specs/notepad.md": 3850,
@@ -28,8 +28,8 @@
   "docs/specs/shortcuts.md": 1150,
   "docs/specs/standalone.md": 11500,
   "docs/specs/terminal-context.md": 1050,
-  "docs/specs/terminal-escapes.md": 3800,
-  "docs/specs/terminal-state.md": 2400,
+  "docs/specs/terminal-escapes.md": 3900,
+  "docs/specs/terminal-state.md": 2450,
   "docs/specs/theme.md": 2200,
   "docs/specs/tiling-engine.md": 4650,
   "docs/specs/transport.md": 5500,
diff --git a/standalone/sidecar/pty-core.js b/standalone/sidecar/pty-core.js
index b859a9b42..97410709a 100644
--- a/standalone/sidecar/pty-core.js
+++ b/standalone/sidecar/pty-core.js
@@ -135,6 +135,32 @@ function withPrependedPath(env, dir, platform = process.platform) {
   };
 }
 
+// Another terminal's identity, inherited when the host was launched from it.
+// Dormouse is the pane's terminal now, and tools read these to decide what to
+// emit (docs/specs/terminal-escapes.md -> "iTerm2 identity"). A `*` entry is a
+// prefix. Names compare case-insensitively on win32, like its environment.
+const FOREIGN_TERMINAL_ENV = [
+  'VTE_VERSION', 'WT_SESSION', 'WT_PROFILE_ID', 'TERM_FEATURES', 'TERM_SESSION_ID',
+  'ITERM_SESSION_ID', 'ITERM_PROFILE', 'ConEmu*', 'KONSOLE_VERSION', 'KONSOLE_DBUS_SERVICE',
+  'KONSOLE_DBUS_SESSION', 'KONSOLE_DBUS_WINDOW', 'PTYXIS_VERSION', 'KITTY_WINDOW_ID', 'KITTY_PID',
+  'KITTY_PUBLIC_KEY', 'KITTY_INSTALLATION_DIR', 'GHOSTTY_RESOURCES_DIR', 'GHOSTTY_BIN_DIR',
+  'GHOSTTY_SHELL_FEATURES', 'WEZTERM_*', 'ALACRITTY_WINDOW_ID', 'ALACRITTY_SOCKET', 'ALACRITTY_LOG',
+  'TERMINAL_EMULATOR', 'TERMINATOR_UUID', 'TILIX_ID', 'TMUX', 'TMUX_PANE', 'STY', 'COLORFGBG',
+  'CURSOR_TRACE_ID',
+];
+
+function isForeignTerminalEnv(key, platform) {
+  const name = platform === 'win32' ? key.toUpperCase() : key;
+  return FOREIGN_TERMINAL_ENV.some((entry) => {
+    const pattern = platform === 'win32' ? entry.toUpperCase() : entry;
+    return pattern.endsWith('*') ? name.startsWith(pattern.slice(0, -1)) : name === pattern;
+  });
+}
+
+function withoutForeignTerminalEnv(env, platform = process.platform) {
+  return Object.fromEntries(Object.entries(env).filter(([key]) => !isForeignTerminalEnv(key, platform)));
+}
+
 function withoutInternalDormouseEnv(env) {
   const next = { ...env };
   delete next.DORMOUSE_CLI_BIN;
@@ -291,11 +317,11 @@ function applyShellIntegration(shell, env, shellArgs, integrationDir, runtime =
 
 function resolveSpawnConfig(options, runtime = {}) {
   const { cols = 80, rows = 30, cwd: requestedCwd, shell: explicitShell, args: explicitArgs, surfaceId } = options || {};
+  const platform = runtime.platform || process.platform;
   const env = {
-    ...(runtime.env || process.env),
+    ...withoutForeignTerminalEnv(runtime.env || process.env, platform),
     ...(options?.env || {}),
   };
-  const platform = runtime.platform || process.platform;
   const osModule = runtime.osModule || os;
   const fsModule = runtime.fsModule || fs;
   // Normalize the requested cwd into a native spelling before it reaches the OS,
diff --git a/standalone/sidecar/pty-core.test.js b/standalone/sidecar/pty-core.test.js
index 2857e6f48..2a2f24c6e 100644
--- a/standalone/sidecar/pty-core.test.js
+++ b/standalone/sidecar/pty-core.test.js
@@ -151,6 +151,93 @@ test('resolveSpawnConfig keeps ORIGINAL_PATH on non-win32', () => {
   assert.equal(config.env.ORIGINAL_PATH, '/whatever');
 });
 
+// Inherited from whatever terminal launched the host. Each changes what tools
+// emit into the pane: vte.sh's per-command OSC 777, cargo's OSC 9;4, a tmux or
+// screen passthrough meant for a multiplexer that is not there.
+const FOREIGN_TERMINAL_IDENTITY = {
+  VTE_VERSION: '7803',
+  WT_SESSION: '8e3f0c1e-0000-0000-0000-000000000000',
+  WT_PROFILE_ID: '{61c54bbd-c2c6-5271-96e7-009a87ff44bf}',
+  TERM_FEATURES: 'T3LrMSc7UUw9Ts3BFGsSyHNoSxFP',
+  TERM_SESSION_ID: 'w0t0p0:1234',
+  ITERM_SESSION_ID: 'w0t0p0:1234',
+  ITERM_PROFILE: 'Default',
+  ConEmuANSI: 'ON',
+  ConEmuPID: '4242',
+  KONSOLE_VERSION: '240802',
+  KONSOLE_DBUS_SERVICE: ':1.42',
+  KONSOLE_DBUS_SESSION: '/Sessions/1',
+  KONSOLE_DBUS_WINDOW: '/Windows/1',
+  PTYXIS_VERSION: '47.0',
+  KITTY_WINDOW_ID: '1',
+  KITTY_PID: '4242',
+  KITTY_PUBLIC_KEY: '1:abc',
+  KITTY_INSTALLATION_DIR: '/Applications/kitty.app/Contents/Resources/kitty',
+  GHOSTTY_RESOURCES_DIR: '/Applications/Ghostty.app/Contents/Resources/ghostty',
+  GHOSTTY_BIN_DIR: '/Applications/Ghostty.app/Contents/MacOS',
+  GHOSTTY_SHELL_FEATURES: 'cursor,title',
+  WEZTERM_PANE: '0',
+  WEZTERM_UNIX_SOCKET: '/tmp/wezterm.sock',
+  ALACRITTY_WINDOW_ID: '1',
+  ALACRITTY_SOCKET: '/tmp/alacritty.sock',
+  ALACRITTY_LOG: '/tmp/alacritty.log',
+  TERMINAL_EMULATOR: 'JetBrains-JediTerm',
+  TERMINATOR_UUID: 'urn:uuid:1',
+  TILIX_ID: '1',
+  TMUX: '/private/tmp/tmux-501/default,4242,0',
+  TMUX_PANE: '%3',
+  STY: '4242.pts-0.host',
+  COLORFGBG: '15;0',
+  CURSOR_TRACE_ID: 'abc123',
+};
+
+test('resolveSpawnConfig strips another terminal\'s inherited identity', () => {
+  const config = resolveSpawnConfig(
+    { surfaceId: 'pane-1' },
+    {
+      platform: 'darwin',
+      env: {
+        ...FOREIGN_TERMINAL_IDENTITY,
+        PATH: '/usr/bin',
+        HOME: '/Users/tester',
+        VSCODE_PID: '4242',
+        TERMINAL: 'kitty',
+        MY_TMUX_SETTING: 'kept',
+      },
+      osModule: { homedir: () => '/Users/tester', tmpdir: () => '/tmp' },
+    },
+  );
+
+  for (const key of Object.keys(FOREIGN_TERMINAL_IDENTITY)) assert.equal(config.env[key], undefined, key);
+  // Dormouse's own identity still goes on after the strip.
+  assert.equal(config.env.TERM_PROGRAM, 'iTerm.app');
+  assert.equal(config.env.LC_TERMINAL, 'iTerm2');
+  assert.equal(config.env.DORMOUSE_SURFACE_ID, 'pane-1');
+  // Unrelated variables, including one that merely contains a stripped name.
+  assert.equal(config.env.VSCODE_PID, '4242');
+  assert.equal(config.env.TERMINAL, 'kitty');
+  assert.equal(config.env.MY_TMUX_SETTING, 'kept');
+  assert.equal(config.env.PATH, '/usr/bin');
+});
+
+test('resolveSpawnConfig strips foreign terminal identity case-insensitively on win32', () => {
+  const env = {
+    Path: 'C:\\Windows\\System32',
+    Wt_Session: 'abc',
+    CONEMUANSI: 'ON',
+    tmux: '/tmp/tmux',
+    ComSpec: 'C:\\Windows\\System32\\cmd.exe',
+  };
+  const osModule = { homedir: () => 'C:\\Users\\tester', tmpdir: () => 'C:\\Temp' };
+  const win32 = resolveSpawnConfig({ surfaceId: 'pane-1' }, { platform: 'win32', env, osModule });
+  for (const key of ['Wt_Session', 'CONEMUANSI', 'tmux']) assert.equal(win32.env[key], undefined, key);
+  assert.equal(win32.env.ComSpec, 'C:\\Windows\\System32\\cmd.exe');
+
+  // POSIX names are case-sensitive: a lowercase `tmux` is some other variable.
+  const linux = resolveSpawnConfig({ surfaceId: 'pane-1' }, { platform: 'linux', env, osModule });
+  assert.equal(linux.env.tmux, '/tmp/tmux');
+});
+
 test('resolveSpawnConfig drops the GUI node directory from a pane PATH on win32', () => {
   // `cargo run` puts the dev app's target dir on PATH, and the node.exe there
   // is patched to the GUI subsystem, so it never attaches to the pane's
diff --git a/standalone/sidecar/shell-integration.test.js b/standalone/sidecar/shell-integration.test.js
index 124a7f936..0c44eb88b 100644
--- a/standalone/sidecar/shell-integration.test.js
+++ b/standalone/sidecar/shell-integration.test.js
@@ -8,7 +8,8 @@
 const test = require('node:test');
 const assert = require('node:assert/strict');
 const { execFileSync, spawnSync } = require('node:child_process');
-const { existsSync } = require('node:fs');
+const { existsSync, mkdtempSync, rmSync } = require('node:fs');
+const os = require('node:os');
 const path = require('node:path');
 
 const dir = __dirname;
@@ -112,4 +113,146 @@ for (const [name, bin] of shells) {
   test(`${name}: escape still handles what it always did`, () => {
     assert.equal(callHelper(bin, '__dormouse_633_escape', 'a;b\\c'), 'a\\x3bb\\\\c');
   });
+
+  test(`${name}: escape keeps a multi-line command inside one sequence`, () => {
+    assert.equal(callHelper(bin, '__dormouse_633_escape', 'cat <<EOF\nhi\r\nEOF'), 'cat <<EOF\\x0ahi\\x0d\\x0aEOF');
+  });
 }
+
+// bash 4.0 is where a `bind -x` command runs with READLINE_LINE bound.
+const BASH_MAJOR = Number(execFileSync(BASH, ['-c', 'echo "${BASH_VERSINFO[0]}"'], { encoding: 'utf8' }).trim());
+
+/**
+ * Drive the real bash integration on a PTY, one submitted line at a time.
+ * `run` resolves with every `E` the line emitted (decoded as the parser decodes
+ * it) and the text the shell printed, once the next prompt is drawn.
+ */
+function interactiveBash() {
+  const pty = require('node-pty');
+  const home = mkdtempSync(path.join(os.tmpdir(), 'dormouse-bash-'));
+  const shell = pty.spawn(BASH, ['--init-file', path.join(dir, 'shell-integration/bash/shellIntegration.bash')], {
+    cols: 200,
+    rows: 50,
+    cwd: home,
+    // Bare on purpose: an exported HISTCONTROL, PROMPT_COMMAND or TERM_PROGRAM
+    // from the developer's shell would change what history keeps.
+    env: { PATH: process.env.PATH, HOME: home, TERM: 'xterm-256color' },
+  });
+  const exited = new Promise((resolve) => shell.onExit(resolve));
+  let output = '';
+  let prompts = 0;
+  let onPrompt = () => {};
+  shell.onData((data) => {
+    output += data;
+    // A prompt is ready at the `B` that follows an `A`: `B` rides PS1, which
+    // readline draws after taking the terminal raw, while input written at the
+    // bare `A` meets the cooked terminal, where macOS eats Ctrl-T as STATUS. A
+    // `bind -x` key redraws PS1, so a `B` with no fresh `A` is not a prompt.
+    const seen = (output.match(/\x1b\]633;A\x07[\s\S]*?\x1b\]633;B\x07/g) || []).length;
+    if (seen !== prompts) {
+      prompts = seen;
+      onPrompt();
+    }
+  });
+  const nextPrompt = (count) => new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(`no prompt ${count}; tail: ${JSON.stringify(output.slice(-300))}`)), 15_000);
+    onPrompt = () => {
+      if (prompts >= count) {
+        clearTimeout(timer);
+        resolve();
+      }
+    };
+    onPrompt();
+  });
+  const decode = (field) => field.replace(/\\(?:x([0-9a-fA-F]{2})|\\)/g, (_, hex) => (hex ? String.fromCharCode(parseInt(hex, 16)) : '\\'));
+  let ready = nextPrompt(1);
+  return {
+    async run(line) {
+      await ready;
+      const start = output.length;
+      shell.write(`${line}\r`);
+      ready = nextPrompt(prompts + 1);
+      await ready;
+      const chunk = output.slice(start);
+      return {
+        commands: [...chunk.matchAll(/\x1b\]633;E;([^\x07]*)\x07/g)].map((m) => decode(m[1])),
+        starts: chunk.split('\x1b]633;C\x07').length - 1,
+        printed: chunk,
+      };
+    },
+    async close() {
+      // `exit`, not a signal: SIGHUP intermittently left bash (5.2, in a Linux
+      // container) alive, and the live PTY kept the test process from exiting.
+      shell.write('exit\r');
+      const backstop = setTimeout(() => shell.kill('SIGKILL'), 5_000);
+      await exited;
+      clearTimeout(backstop);
+      rmSync(home, { recursive: true, force: true });
+    },
+  };
+}
+
+// $BASH_COMMAND is only a line's first simple command, so the bash preexec reads
+// the whole line back from history; this pins that it does, and that a line
+// history did not take never reports the stale entry left in its place. Both
+// hinge on bash's own line reader, which no `bash -c` reaches — hence the PTY.
+test('bash: E is the whole submitted line, and never a stale history entry', { timeout: 60_000 }, async () => {
+  const bash = interactiveBash();
+  try {
+    const expect = async (line, expected) => {
+      const { commands } = await bash.run(line);
+      assert.deepEqual(commands, [expected], `bash reported ${JSON.stringify(commands)} for ${JSON.stringify(line)}`);
+    };
+    // Seeds history: before 5.1, fc cannot vouch for a history's only entry.
+    await expect('true', 'true');
+    // $BASH_COMMAND reads `echo spaced`; the entry is matched whitespace aside.
+    await expect('echo  spaced  &&  echo x', 'echo  spaced  &&  echo x');
+    // Two physical lines, one joined entry: the last line appends, adding nothing.
+    await expect('echo m1 && \\\recho m2', 'echo m1 && echo m2');
+    await expect('HISTCONTROL=ignoredups', 'HISTCONTROL=ignoredups');
+    await expect('echo p && echo q', 'echo p && echo q');
+    // Kept out as a duplicate, so the last entry is still this very line.
+    await expect('echo p && echo q', 'echo p && echo q');
+    await expect('set +o history; echo a && echo b', 'set +o history; echo a && echo b');
+    // History is off; the last entry contains `echo a` and is not this line.
+    await expect('echo a', 'echo a');
+    await expect('set -o history', 'set -o history');
+    await expect("HISTIGNORE='cd /'", "HISTIGNORE='cd /'");
+    await expect('cd / && echo hi', 'cd / && echo hi');
+    // Kept out by HISTIGNORE; the last entry contains `cd /` but is the line before.
+    await expect('cd /', 'cd /');
+    await expect('unset HISTIGNORE; HISTCONTROL=ignorespace', 'unset HISTIGNORE; HISTCONTROL=ignorespace');
+    await expect('cd / && echo hi', 'cd / && echo hi');
+    // Kept out by its leading space, with the same stale entry.
+    await expect(' cd /', 'cd /');
+    // A widget the way fzf's Ctrl-R is one: a `bind -x` key that fills the line.
+    const widget = `__widget() { READLINE_LINE='echo widget'; READLINE_POINT=11; }; bind -x '"\\C-t": __widget'`;
+    await expect(widget, widget);
+    await expect('cd / && echo hi', 'cd / && echo hi');
+    // Ctrl-T, then Enter on the line it left.
+    const key = await bash.run('\x14');
+    if (BASH_MAJOR >= 4) {
+      // The key is no command; the line it filled is, with the one E/C pair.
+      assert.deepEqual(key.commands, ['echo widget']);
+      assert.equal(key.starts, 1);
+    } else {
+      // 3.2 gives a `bind -x` command no signal, so the key still reads as one.
+      // Its trap fires with the previous line last in history, which must not
+      // be reported again.
+      assert.ok(!key.commands.includes('cd / && echo hi'), `the previous line was re-reported: ${JSON.stringify(key.commands)}`);
+    }
+    // On 3.2 the widget left READLINE_LINE set; that must not silence a line.
+    await expect('echo after && echo key', 'echo after && echo key');
+    // The DEBUG trap leaves $_ as its own last word, so it passes the user's.
+    const { printed } = await bash.run('echo foo; echo "u=$_"');
+    assert.match(printed, /u=foo/);
+    // Last, since it leaves every later line without its E/C: a hook appended
+    // after ours in PROMPT_COMMAND fires the trap once the prompt is armed. The
+    // last entry is then the line just run, which must not be reported again.
+    await bash.run(`__sfx() { :; }; PROMPT_COMMAND="$PROMPT_COMMAND; __sfx"`);
+    const { commands: afterHook } = await bash.run('cd / && echo hi');
+    assert.ok(!afterHook.includes('cd / && echo hi'), `the previous line was re-reported: ${JSON.stringify(afterHook)}`);
+  } finally {
+    await bash.close();
+  }
+});
diff --git a/standalone/sidecar/shell-integration/bash/shellIntegration.bash b/standalone/sidecar/shell-integration/bash/shellIntegration.bash
index 3d6ee72b1..d0a3e75cb 100644
--- a/standalone/sidecar/shell-integration/bash/shellIntegration.bash
+++ b/standalone/sidecar/shell-integration/bash/shellIntegration.bash
@@ -88,19 +88,68 @@ __dormouse_633_prompt() {
   __dormouse_633_armed=1
 }
 
+# The submitted line, into __dormouse_633_out. $BASH_COMMAND is only the simple
+# command about to run (`cd web` of `cd web && pnpm dev`), so the line is read
+# back from history (one fork per line; HISTTIMEFORMAT is emptied inside it) and
+# used only when the last entry provably is this line, else $BASH_COMMAND stands:
+#  - History is on. Off, nothing is added, and 3.2 leaves the flag below stale.
+#  - `fc -l -1` stops one entry short of `history 1` exactly when bash's own
+#    flag says reading this line added an entry. No count taken at the prompt
+#    could stand in: erasedups renumbers, and HISTCMD is dead in traps before 5.1.
+#    A line that added nothing is still the last entry when neither ignorespace
+#    nor HISTIGNORE could have dropped it: ignoredups did, or the entry is a
+#    multi-line command's joined whole, whose flag covers its last line alone.
+#  - The entry contains $BASH_COMMAND, whitespace aside (bash re-renders it).
+#    This rejects a trap fired outside a fresh line (a hook appended after ours
+#    in PROMPT_COMMAND, a `bind -x` key on 3.2), which would re-report the
+#    previous line.
+# So an aliased first command, an entry spanning lines (a here-document), and a
+# repeat under ignoreboth fall back to $BASH_COMMAND.
+__dormouse_633_command_line() {
+  __dormouse_633_out=$BASH_COMMAND
+  [[ -o history ]] || return 0
+  local listing entry number
+  listing=$( { HISTTIMEFORMAT= && builtin history 1 && builtin fc -l -1; } 2>/dev/null )
+  entry=${listing%%$'\n'*}                      # history 1: "%5d%c %s"
+  entry=${entry#"${entry%%[! ]*}"}
+  number=${entry%%[!0-9]*}
+  [ -n "$number" ] || return 0
+  case ${listing#*$'\n'} in                     # fc -l: "%d\t%c%s"
+    "$((number - 1))"$'\t'*) ;;
+    "$number"$'\t'*)
+      [ -z "${HISTIGNORE:-}" ] || return 0
+      case :${HISTCONTROL:-}: in *:ignorespace:* | *:ignoreboth:*) return 0 ;; esac ;;
+    *) return 0 ;;
+  esac
+  entry=${entry:${#number}+2}                   # drop the number, flag and space
+  case ${entry//[[:space:]]/} in
+    *"${BASH_COMMAND//[[:space:]]/}"*) __dormouse_633_out=$entry ;;
+  esac
+  return 0
+}
+
 # preexec: the DEBUG trap fires before every command; emit E/C once per line.
+# The trap passes "$_" as its last word because bash leaves $_ set to the trap
+# command's last word; bash itself restores $?.
 __dormouse_633_preexec() {
   [ "$BASH_COMMAND" = "__dormouse_633_prompt" ] && return   # the PROMPT_COMMAND invocation itself
   [ -z "$__dormouse_633_armed" ] && return                 # inside PROMPT_COMMAND, or already fired this line
   [ -n "${COMP_LINE:-}" ] && return                        # tab-completion, not a submitted command
+  # A `bind -x` key (fzf's Ctrl-R/Ctrl-T) runs its command at the prompt, with
+  # READLINE_LINE bound for its duration from bash 4.0. Returning still armed
+  # lets the line the key leaves be reported when it is submitted. bash 3.2 binds
+  # nothing, so there the key still reads as a command, and its READLINE_LINE is
+  # an ordinary variable a widget may leave set, hence the version check.
+  [ -n "${READLINE_LINE+x}" ] && [ "${BASH_VERSINFO[0]}" -ge 4 ] && return
   __dormouse_633_armed=
   __dormouse_633_ran=1
-  __dormouse_633_escape "$BASH_COMMAND"
+  __dormouse_633_command_line
+  __dormouse_633_escape "$__dormouse_633_out"
   printf '\033]633;E;%s\007' "$__dormouse_633_out"
   printf '\033]633;C\007'
 }
 
-trap '__dormouse_633_preexec' DEBUG
+trap '__dormouse_633_preexec "$_"' DEBUG
 PROMPT_COMMAND='__dormouse_633_prompt'
 # Prompt-end / input-start (B) at the tail of PS1, wrapped in \[ \] so bash counts
 # it as zero width. Best-effort: a prompt rebuilt every render loses B, but
diff --git a/vscode-ext/README.md b/vscode-ext/README.md
index 14560d659..5fd3b9d82 100644
--- a/vscode-ext/README.md
+++ b/vscode-ext/README.md
@@ -34,7 +34,7 @@ Dormouse can owe you attention in three independent ways. Two of them need no se
 
 **A command finishes while you are away.** If a foreground command was running while you were watching, you left, and it exited after you had been gone a while, that pane is ringing when you come back. Also no configuration.
 
-**A watched command goes quiet.** This one is opt-in, and it is the one for coding agents. Right-click the header of a pane running `claude` — or press `a` in command mode — and turn on **Watch all claude commands**; Dormouse then watches *that command name*. Every pane running `claude` is then watched, the ones open now and the ones you open later. When a watched command's output goes busy and then falls quiet while you are not looking, it rings.
+**A watched command goes quiet.** This one is opt-in, and it is the one for coding agents. Right-click the header of a pane running `claude` — or press `a` in command mode — and turn on **Watch all claude commands**; Dormouse then watches *that command name*. Every pane running `claude` is then watched, the ones open now and the ones you open later. For a script runner the rule names the script: **Watch all pnpm dev commands** leaves `pnpm test` alone. When a watched command's output goes busy and then falls quiet while you are not looking, it rings.
 
 Dormouse never guesses which commands deserve an alert. Watching is a rule you create on a command name, and turning it off anywhere removes it everywhere.
 
@@ -44,7 +44,7 @@ Whichever way a pane rings, the ring becomes a **TODO** — a marker beside the
 
 Spoken alarms use your browser or system voice today. An optional [managed ElevenLabs voice](https://dormouse.sh/hosted/#voice) is coming for people who want something more natural without managing a separate voice account.
 
-Watching a command's output requires shell integration (`OSC 633` / `OSC 133`) so Dormouse can tell where one command ends and the next begins. Shells that do not report command boundaries — `cmd.exe`, `fish`, or any shell where the integration did not take — never engage watching. The protocol and command-exit alerts above work regardless.
+Watching a command's output requires shell integration (`OSC 633` / `OSC 133`) so Dormouse can tell where one command ends and the next begins. Shells that do not report their commands — `cmd.exe`, fish before 4, or any shell where the integration did not take — never engage watching. The protocol and command-exit alerts above work regardless.
 
 ## Browsers for you and your agents
 
diff --git a/website/src/lib/tut-detector.test.ts b/website/src/lib/tut-detector.test.ts
index d3ac7b1df..b406a1eaa 100644
--- a/website/src/lib/tut-detector.test.ts
+++ b/website/src/lib/tut-detector.test.ts
@@ -35,7 +35,7 @@ function makeDetectorHarness(initialActivitySnapshot = new Map<string, ActivityS
         };
       },
       getWatchedCommands: () => watchedCommands,
-      getRunningCommandArgv0: (id) => runningCommands.get(id) ?? null,
+      getRunningCommandWatchKey: (id) => runningCommands.get(id) ?? null,
       subscribeToWatchedCommands: (listener) => {
         watchedListener = listener;
         return () => {
diff --git a/website/src/lib/tut-detector.ts b/website/src/lib/tut-detector.ts
index 9ac902595..dc2931957 100644
--- a/website/src/lib/tut-detector.ts
+++ b/website/src/lib/tut-detector.ts
@@ -11,7 +11,7 @@ interface ActivityStoreModule {
   getActivitySnapshot: () => Map<string, ActivityState>;
   subscribeToWatchedCommands: (listener: () => void) => () => void;
   getWatchedCommands: () => string[];
-  getRunningCommandArgv0: (id: string) => string | null;
+  getRunningCommandWatchKey: (id: string) => string | null;
 }
 
 /** Notification sources a program emits for itself, as opposed to the ones
@@ -267,12 +267,12 @@ export class TutDetector {
       const commandCounts = new Map<string, number>();
       for (const [paneId, current] of snapshot) {
         if (!current.watchingEnabled) continue;
-        const command = this.activityStore.getRunningCommandArgv0(paneId);
+        const command = this.activityStore.getRunningCommandWatchKey(paneId);
         if (command) commandCounts.set(command, (commandCounts.get(command) ?? 0) + 1);
       }
       for (const paneId of this.pendingSpreadIds) {
         if (!snapshot.get(paneId)?.watchingEnabled) continue;
-        const command = this.activityStore.getRunningCommandArgv0(paneId);
+        const command = this.activityStore.getRunningCommandWatchKey(paneId);
         if (command && (commandCounts.get(command) ?? 0) > 1) {
           this.state.markComplete("al-spreads");
           break;

From 22ec72517c6cce6d49b3865292e6fbb36b7bcd62 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 23 Sep 2026 16:56:31 -0700
Subject: [PATCH 02/16] Simplify phase-1 alert inputs; keep command-line
 newlines for keying

- Command lines from OSC 633;E and 133;C share one bound/decode/sanitize
  path that keeps line breaks, so a multi-line command keys on its last
  command outside unit tests too.
- The tokenizer emits grouping parentheses and keeps command substitutions
  and array assignments whole, replacing a quote-blind regex pass.
- Rule lookup lives in one getter used by the terminal context and the
  tutorial detector; the overflow arrow reserves one measured width.
- Smaller cleanups: one OSC 9 subcommand switch, shared decoders and flag
  specs, one env-strip regex, test helpers, trimmed prose.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 docs/specs/layout.md                          |   4 +-
 docs/specs/terminal-escapes.md                |   4 +-
 docs/specs/terminal-escapes.rationale.md      |   2 +-
 docs/specs/terminal-state.md                  |   4 +-
 lib/src/components/Baseboard.test.tsx         |  87 +++++----
 lib/src/components/Baseboard.tsx              |  61 +++---
 lib/src/components/TodoPillBody.tsx           |  22 +--
 .../components/wall/TerminalContext.test.tsx  |   6 +
 lib/src/components/wall/TerminalContext.tsx   |  11 +-
 .../components/wall/TerminalContextView.tsx   |   3 +-
 lib/src/lib/alert-manager.test.ts             |  63 ++----
 lib/src/lib/alert-manager.ts                  |  27 +--
 lib/src/lib/osc-sanitize.ts                   |  18 +-
 lib/src/lib/terminal-protocol.test.ts         |  28 ++-
 lib/src/lib/terminal-protocol.ts              | 179 ++++++++++--------
 lib/src/lib/terminal-registry.ts              |   3 +-
 lib/src/lib/terminal-state.test.ts            |  22 +++
 lib/src/lib/terminal-state.ts                 | 126 ++++++------
 lib/src/lib/watched-commands.test.ts          |  49 ++---
 lib/src/lib/watched-commands.ts               |  33 ++--
 scripts/spec-word-budgets.json                |   2 +-
 standalone/sidecar/pty-core.js                |  30 ++-
 .../bash/shellIntegration.bash                |  32 +---
 website/src/lib/tut-detector.test.ts          |  29 ++-
 website/src/lib/tut-detector.ts               |  12 +-
 25 files changed, 465 insertions(+), 392 deletions(-)

diff --git a/docs/specs/layout.md b/docs/specs/layout.md
index 08e5a0317..e9d959985 100644
--- a/docs/specs/layout.md
+++ b/docs/specs/layout.md
@@ -164,8 +164,8 @@ Doors are measured in a hidden off-screen container first, then fitted:
 
 - **Subtract the measured right cluster and its gap before fitting anything** — that space is never available to doors. Measure only its always-present part (notice + the three settings controls): **never the overflow arrow**, whose presence is an *output* of the fit.
 - Add doors until no more fit, reserving room for a `N more →` button whenever items remain after the current one. **At least one door is always shown**, even if it overflows.
-- If scrolled, show `← N more` on the left and/or `N more →` on the right. Overflow counts are assumed single-digit (the hidden measurement buttons are `9 more` and `9 more TODO`).
-- **An arrow hiding a ringing or TODO Door must say so**, since that Door is otherwise gone from the baseboard: it wears the Door ground, a static `door` alarm inset while one rings, and a `TODO` mark while one has TODO, and its accessible name counts them (`3 more, 1 ringing, 1 TODO`). **Must reserve the measured TODO arrow width** wherever the Doors an arrow would hide include a TODO. Pinned by `Baseboard overflow alerts` in `lib/src/components/Baseboard.test.tsx`.
+- If scrolled, show `← N more` on the left and/or `N more →` on the right. Overflow counts are assumed single-digit (the hidden measurement button is `9 more TODO`).
+- **An arrow hiding a ringing or TODO Door must say so**, since that Door is otherwise gone from the baseboard: it wears the Door shape and ground, a static `door` alarm inset while one rings, and a static TODO pill while one has TODO, and its accessible name counts them (`3 more, 1 ringing, 1 TODO`). **Every arrow must reserve the measured width of the TODO one**, so the fit never depends on which Doors an arrow hides. Pinned by `Baseboard overflow alerts` in `lib/src/components/Baseboard.test.tsx`.
 - Clicking an overflow arrow reveals one door in that direction; a longer title may push more doors off the opposite side. **Must reveal the selected Door when selection or membership changes**, without overriding manual overflow scrolling (`lib/src/components/Baseboard.test.tsx`).
 - Extreme case — one door with a very long title and more doors on both sides: show both arrows with counts and as much title as fits, ellipsis for the rest.
 
diff --git a/docs/specs/terminal-escapes.md b/docs/specs/terminal-escapes.md
index 57d16e520..68f7e19df 100644
--- a/docs/specs/terminal-escapes.md
+++ b/docs/specs/terminal-escapes.md
@@ -22,7 +22,7 @@ State-driving and security-sensitive OSCs — plus the `CSI > q` query — are p
 
 **Must buffer an unterminated consumed OSC up to `OSC_INCOMPLETE_LIMIT` (16,384 UTF-16 code units), then discard through its terminator or cancellation**, retaining only a split `ESC`, never promoting payload to text or its terminating BEL to an alert (rationale). A complete sequence in a single read is parsed whole. Pinned by `discards an oversized consumed OSC through its %j terminator` in `lib/src/lib/terminal-protocol.test.ts`. **An unterminated OSC the parser will forward streams to xterm.js instead**, preserving a split `ESC \` terminator (rationale). **Route by the OSC id, and decide nothing while more digits could follow** — `133` becomes `1337` — for `1337` by the subcommand ([Inline graphics](#inline-graphics)).
 
-**Every semantic value `TerminalProtocolParser` *retains* is bounded and stripped of control characters before storage**, whatever the emitter: `TITLE_LIMIT` / `BODY_LIMIT` for titles and notification bodies, whose whitespace controls collapse to spaces before the trim; `COMMAND_LINE_LIMIT` for the command line (`OSC 633 ; E`, `OSC 133 ; C`), bounded *before* its decoding and sanitized *after* it (rationale); `MAX_CWD_LENGTH` for every CWD source, interior whitespace preserved. **Every limit counts code points**, so a cut never splits a surrogate pair. **A value that reduces to nothing is dropped, never stored empty.**
+**Every semantic value `TerminalProtocolParser` *retains* is bounded and stripped of control characters before storage**, whatever the emitter: `TITLE_LIMIT` / `BODY_LIMIT` for titles and notification bodies, whose whitespace controls collapse to spaces before the trim; `COMMAND_LINE_LIMIT` for the command line (`OSC 633 ; E`, `OSC 133 ; C`), bounded *before* its decoding and sanitized *after* it (rationale), **line breaks kept as `\n`**; `MAX_CWD_LENGTH` for every CWD source, interior whitespace preserved. **Every limit counts code points**, so a cut never splits a surrogate pair. **A value that reduces to nothing is dropped, never stored empty.**
 
 **The owner alone acts on the events** its parse produced — writing the responses, recording the semantic state — and hands every consumer the same chunk ([remote-api.md](remote-api.md#terminal-surfaces)).
 
@@ -186,7 +186,7 @@ Wired in `applyShellIntegration`, called from `resolveSpawnConfig` (`standalone/
 - **`E` (command line)** is escaped by `__dormouse_633_escape`: BEL, ESC and the C1 ST alongside `\`, `;`, LF and CR. The parser decodes `\xNN` back, so it still reports verbatim.
 - **`Cwd=`** is read verbatim, no `\xNN` decoding, so a Windows path's backslashes arrive intact — `__dormouse_633_safe_cwd` therefore *removes* control characters instead of escaping them, preserving backslashes and semicolons. **Under `LC_ALL=C` the scripts strip the C1 ST explicitly first**, `[[:cntrl:]]` not matching its two ordinary bytes.
 
-Source of truth: `__dormouse_633_escape` and `__dormouse_633_safe_cwd` in each of `standalone/sidecar/shell-integration/bash/shellIntegration.bash`, `standalone/sidecar/shell-integration/zsh/.zshrc`, `standalone/sidecar/shell-integration/pwsh/shellIntegration.ps1`, and bash's `E` in `__dormouse_633_command_line`; pinned by `standalone/sidecar/shell-integration.test.js`, which spawns real bash (on a PTY for `E`) and zsh rather than mocking them, hard-fails if bash is absent, and names any uncovered shell out loud.
+Source of truth: `__dormouse_633_escape` and `__dormouse_633_safe_cwd` in each of `standalone/sidecar/shell-integration/bash/shellIntegration.bash`, `standalone/sidecar/shell-integration/zsh/.zshrc`, `standalone/sidecar/shell-integration/pwsh/shellIntegration.ps1`, and bash's `E` in `__dormouse_633_command_line`; pinned by `standalone/sidecar/shell-integration.test.js`, which spawns real bash and zsh rather than mocking them, hard-fails if bash is absent, and names any uncovered shell out loud.
 
 ### Keystroke fallback
 
diff --git a/docs/specs/terminal-escapes.rationale.md b/docs/specs/terminal-escapes.rationale.md
index ae3809b34..318e4b0b1 100644
--- a/docs/specs/terminal-escapes.rationale.md
+++ b/docs/specs/terminal-escapes.rationale.md
@@ -88,7 +88,7 @@ Keying this on the disposition rather than on an IIP command list also fixes the
 
 **Why bash injection keys on the launch args.** `--init-file` and login mode are mutually exclusive, so the script has to replace login-profile sourcing itself, which is only safe when the launch was a plain interactive/login shell — Git Bash's `--login -i` is why login flags stay in the allowed set, while anything with a specific `-c <cmd>` is a job, not a session.
 
-**Why bash reads `E` back from history, and when it declines.** In the `DEBUG` trap `$BASH_COMMAND` is only the simple command about to run, so `cd web && pnpm dev` reported `cd web` and keyed on `cd`. The last history entry is the line only if reading it added one: ignorespace, ignoredups, `HISTIGNORE`, `set +o history` and `HISTSIZE` all leave the previous entry in place, and that entry often contains the current first command (` cd /` after `cd / && echo hi`). A count taken at the prompt cannot tell: `HISTCMD` reads 1 inside traps and `PROMPT_COMMAND` before bash 5.1, and erasedups renumbers. `fc -l` skips the current line by bash's own did-this-line-add-an-entry flag, which is exact; bash 3.2 leaves that flag stale while history is off, hence the history-on check. A line that added nothing is still the last entry when only ignoredups (or a multi-line command's joined entry) explains it; under ignoreboth a leading space could explain it too, so a repeat falls back. The containment check against `$BASH_COMMAND` exists for traps fired outside a fresh line — a hook appended after ours, a `bind -x` key on 3.2 — which would otherwise re-report the previous line. Measured on bash 3.2.57 (macOS and Linux), 4.4.23, 5.0.18, 5.1.16, 5.2.37 and 5.3.20, 2026-09.
+**Why bash reads `E` back from history, and when it declines.** In the `DEBUG` trap `$BASH_COMMAND` is only the simple command about to run, so `cd web && pnpm dev` reported `cd web` and keyed on `cd`. The last history entry is the line only if reading it added one: ignorespace, ignoredups, `HISTIGNORE`, `set +o history` and `HISTSIZE` all leave the previous entry in place, and that entry often contains the current first command (` cd /` after `cd / && echo hi`). A count taken at the prompt cannot tell: `HISTCMD` reads 1 inside traps and `PROMPT_COMMAND` before bash 5.1, and erasedups renumbers. `fc -l` skips the current line by bash's own did-this-line-add-an-entry flag, which is exact; bash 3.2 leaves that flag stale while history is off, hence the history-on check. A line that added nothing is still the last entry when only ignoredups (or a multi-line command's joined entry) explains it; under ignoreboth a leading space could explain it too, so a repeat falls back. The containment check against `$BASH_COMMAND` exists for traps fired outside a fresh line — a hook appended after ours, a `bind -x` key on 3.2 — which would otherwise re-report the previous line; an aliased first command fails it too, and an entry spanning lines (a here-document) fails the listing parse, so both fall back. Measured on bash 3.2.57 (macOS and Linux), 4.4.23, 5.0.18, 5.1.16, 5.2.37 and 5.3.20, 2026-09.
 
 **Why a `bind -x` key is recognized by `READLINE_LINE`.** The key's command runs through the same `DEBUG` trap while the prompt is armed, so it was reported as the command and spent the arming: the line it left, as fzf's Ctrl-R leaves the chosen command, ran with no `E`/`C` at all. From bash 4.0 `READLINE_LINE` is bound for exactly the key command's run and unbound after it. 3.2 binds nothing, and nothing else the trap can read differs from a submitted line — `BASH_SOURCE`, `BASH_LINENO`, `FUNCNAME`, `$-`, `BASH_SUBSHELL` — while its `READLINE_LINE` is an ordinary variable that a widget written for 4.x leaves set, which would silence every later line without the version check. Measured on bash 3.2.57 (macOS), 4.0.44, 4.4.23, 5.0.18, 5.2.37 and 5.3.20, 2026-09.
 
diff --git a/docs/specs/terminal-state.md b/docs/specs/terminal-state.md
index 676f1bb06..6751b6af8 100644
--- a/docs/specs/terminal-state.md
+++ b/docs/specs/terminal-state.md
@@ -95,9 +95,9 @@ Source of truth: `cwdFromManualPath` in `lib/src/lib/terminal-state.ts`; `seedTe
 - `commandFinish` moves `currentCommand` to `lastCommand`, stores `event.finishedAt` (otherwise reducer time) and `exitCode`, snapshots the latest in-run OSC 0/2/9 title into `lastCommand.finalTerminalTitle` (titles older than `startedAt` or younger than `finishedAt` excluded), clears `currentCommand`, and sets `{ kind: "finished", exitCode }`. **With no `currentCommand` it only sets the activity**, never inventing a `lastCommand`.
 - `title` updates the per-source entry in `titleCandidates`. **Later OSC title events never erase earlier candidates from other sources.**
 
-Command-line tokenizing is dialect-free: **`\` escapes exactly the set `shellEscapePosix` writes** (`POSIX_ESCAPABLE` in `lib/src/lib/posix-escape.ts`; both halves pinned by `terminal-state.test.ts`). **A leading `&` is PowerShell's call operator, never a POSIX background suffix**, and is dropped rather than read as a boundary. **An unquoted newline separates commands like `;`**; a backslash-newline continues the line. **An unquoted Windows path containing spaces stays split.** **A launcher suffix is not part of a program's name** — `npm.cmd` and `C:\tools\claude.exe` are `npm` and `claude` for the header, the WATCHING key, and the terminal context alike. Accepted: `foo.bat` and `foo.exe` in one directory cannot be watched separately. (rationale)
+Command-line tokenizing is dialect-free: **`\` escapes exactly the set `shellEscapePosix` writes** (`POSIX_ESCAPABLE` in `lib/src/lib/posix-escape.ts`; both halves pinned by `terminal-state.test.ts`). **A leading `&` is PowerShell's call operator, never a POSIX background suffix**, and is dropped rather than read as a boundary. **An unquoted newline separates commands like `;`**; a backslash-newline continues the line. **Grouping `(` `)` `{` `}` is dropped; a `$(…)`, `<(…)` or `>(…)` substitution or a `name=(…)` array is one word**, separators included. **An unquoted Windows path containing spaces stays split.** **A launcher suffix is not part of a program's name** — `npm.cmd` and `C:\tools\claude.exe` are `npm` and `claude` for the header, the WATCHING key, and the terminal context alike. Accepted: `foo.bat` and `foo.exe` in one directory cannot be watched separately. (rationale)
 
-**`displayCommand` is a per-program summary of those tokens** — the program name plus a bounded argument count, suffixed `| ...` or ` ...` past a pipeline or compound boundary. Source of truth: `summarizeCommandLine` and `commandTitleTokens` in `lib/src/lib/terminal-state.ts`.
+**`displayCommand` is a one-line, per-program summary of those tokens** — the program name plus a bounded argument count, suffixed `| ...` or ` ...` past a pipeline or compound boundary. Source of truth: `summarizeCommandLine` and `commandTitleTokens` in `lib/src/lib/terminal-state.ts`.
 
 ### Keystroke fallback
 
diff --git a/lib/src/components/Baseboard.test.tsx b/lib/src/components/Baseboard.test.tsx
index 978c686ff..3a205d5b7 100644
--- a/lib/src/components/Baseboard.test.tsx
+++ b/lib/src/components/Baseboard.test.tsx
@@ -18,6 +18,7 @@ import { Baseboard } from './Baseboard';
 import { installLocalStorageStub } from '../lib/test-local-storage';
 import { applyAlertSettingsFromHost, DEFAULT_ALERT_SETTINGS, getAlertSettings } from '../lib/alert-settings';
 import { DialogKeyboardContext, SelectedIdContext } from './wall/wall-context';
+import type { DoorChip } from './wall/wall-types';
 import {
   addInstalledTheme,
   getActiveThemeId,
@@ -63,6 +64,29 @@ beforeEach(() => {
   root = createRoot(container);
 });
 
+/** Render `doors`, with `selected` as the selected Door. */
+function renderBaseboard(doors: DoorChip[], selected: string | null = null): void {
+  act(() => root.render(
+    <SelectedIdContext.Provider value={selected}><Baseboard items={doors} onReattach={() => {}} /></SelectedIdContext.Provider>,
+  ));
+}
+
+/** A 244px baseboard whose always-present right cluster is 72px, every other
+ *  element measuring `widthOf` it. */
+function stubBaseboardWidths(widthOf: (element: HTMLElement) => number): void {
+  vi.stubGlobal('ResizeObserver', class {
+    constructor(private callback: ResizeObserverCallback) {}
+    observe(target: HTMLElement) {
+      const width = target.classList.contains('h-7') ? 244 : 72;
+      this.callback([{ target, contentRect: { width } } as ResizeObserverEntry], this as unknown as ResizeObserver);
+    }
+    disconnect() {}
+  });
+  vi.spyOn(HTMLElement.prototype, 'offsetWidth', 'get').mockImplementation(function (this: HTMLElement) {
+    return widthOf(this);
+  });
+}
+
 afterEach(() => {
   // Module state, so it outlives the component under test.
   setDefaultThemeId(null);
@@ -79,14 +103,11 @@ afterEach(() => {
 describe('Baseboard settings controls', () => {
   it('reveals a selected overflow Door and keeps it visible after its predecessor is deleted', () => {
     const items = ['a', 'b', 'c'].map(id => ({ id, title: id, kind: 'terminal' as const }));
-    const render = (selected: string, doors = items) => act(() => root.render(
-      <SelectedIdContext.Provider value={selected}><Baseboard items={doors} onReattach={() => {}} /></SelectedIdContext.Provider>,
-    ));
     // The zero-width test viewport fits exactly one Door.
-    render('a');
-    render('c');
+    renderBaseboard(items, 'a');
+    renderBaseboard(items, 'c');
     expect(container.querySelector('[data-door-id="c"]')).not.toBeNull();
-    render('c', items.slice(1));
+    renderBaseboard(items.slice(1), 'c');
     expect(container.querySelector('[data-door-id="c"]')).not.toBeNull();
     expect(container.querySelector('[data-door-id="b"]')).toBeNull();
   });
@@ -391,9 +412,6 @@ describe('Baseboard overflow alerts', () => {
   afterEach(() => act(() => clearTerminalActivity()));
 
   const items = ['a', 'b', 'c', 'd'].map(id => ({ id, title: id, kind: 'terminal' as const }));
-  const renderSelected = (selected: string) => act(() => root.render(
-    <SelectedIdContext.Provider value={selected}><Baseboard items={items} onReattach={() => {}} /></SelectedIdContext.Provider>,
-  ));
   const arrow = (direction: 'left' | 'right') => container.querySelector<HTMLButtonElement>(`[data-overflow-arrow="${direction}"]`);
 
   it('marks an overflow arrow for the ringing and TODO Doors it hides', () => {
@@ -403,7 +421,7 @@ describe('Baseboard overflow alerts', () => {
       setTerminalActivity('d', { status: 'ALERT_RINGING', todo: true });
     });
     // The zero-width test viewport fits exactly one Door.
-    renderSelected('a');
+    renderBaseboard(items, 'a');
     const right = arrow('right');
     expect(right?.getAttribute('aria-label')).toBe('3 more, 2 ringing, 2 TODO');
     expect(right?.querySelector('[data-alert-ring-inset="door"]')).not.toBeNull();
@@ -413,41 +431,34 @@ describe('Baseboard overflow alerts', () => {
     expect(arrow('left')).toBeNull();
 
     // The same on the other side, for exactly the Doors hidden there.
-    renderSelected('d');
+    renderBaseboard(items, 'd');
     expect(arrow('left')?.getAttribute('aria-label')).toBe('3 more, 1 ringing, 1 TODO');
     expect(arrow('right')).toBeNull();
   });
 
   it('leaves an arrow plain while the Doors it hides owe nothing', () => {
     act(() => setTerminalActivity('a', { status: 'ALERT_RINGING', todo: true }));
-    renderSelected('a');
+    renderBaseboard(items, 'a');
     const right = arrow('right');
     expect(right?.getAttribute('aria-label')).toBe('3 more');
     expect(right?.querySelector('[data-alert-ring-inset]')).toBeNull();
     expect(right?.textContent).not.toContain('TODO');
   });
 
-  it('reserves the wider arrow a hidden TODO Door needs', () => {
-    vi.stubGlobal('ResizeObserver', class {
-      constructor(private callback: ResizeObserverCallback) {}
-      observe(target: HTMLElement) {
-        const width = target.classList.contains('h-7') ? 244 : 72;
-        this.callback([{ target, contentRect: { width } } as ResizeObserverEntry], this as unknown as ResizeObserver);
-      }
-      disconnect() {}
-    });
-    // Budget 244 - 72 = 172: two 60px Doors fit beside a 20px arrow, not a 60px one.
-    vi.spyOn(HTMLElement.prototype, 'offsetWidth', 'get').mockImplementation(function (this: HTMLElement) {
-      if (this.getAttribute('role') === 'group') return 60;
-      if (this.tagName === 'BUTTON') return this.textContent?.includes('TODO') ? 60 : 20;
+  it('reserves the TODO arrow\'s width whatever an arrow hides', () => {
+    // Budget 244 - 72 = 172: two 60px Doors fit beside a 20px plain arrow, not
+    // beside the 60px TODO one.
+    stubBaseboardWidths((element) => {
+      if (element.getAttribute('role') === 'group') return 60;
+      if (element.tagName === 'BUTTON') return element.textContent?.includes('TODO') ? 60 : 20;
       return 16;
     });
     const three = items.slice(0, 3);
-    const render = () => act(() => root.render(<Baseboard items={three} onReattach={() => {}} />));
-    render();
-    expect(container.querySelectorAll('[data-door-id]')).toHaveLength(2);
+    renderBaseboard(three);
+    expect(container.querySelectorAll('[data-door-id]')).toHaveLength(1);
+    expect(arrow('right')?.getAttribute('aria-label')).toBe('2 more');
+    // A hidden TODO widens the arrow into the room already reserved for it.
     act(() => setTerminalActivity('c', { todo: true }));
-    render();
     expect(container.querySelectorAll('[data-door-id]')).toHaveLength(1);
     expect(arrow('right')?.getAttribute('aria-label')).toBe('2 more, 1 TODO');
   });
@@ -457,23 +468,15 @@ describe('Baseboard Tool unsaved changes', () => {
   afterEach(() => act(() => resetToolDirty()));
 
   it('refits Door overflow when a live dirty report changes a measured width', () => {
-    vi.stubGlobal('ResizeObserver', class {
-      constructor(private callback: ResizeObserverCallback) {}
-      observe(target: HTMLElement) {
-        const width = target.classList.contains('h-7') ? 244 : 72;
-        this.callback([{ target, contentRect: { width } } as ResizeObserverEntry], this as unknown as ResizeObserver);
-      }
-      disconnect() {}
-    });
-    vi.spyOn(HTMLElement.prototype, 'offsetWidth', 'get').mockImplementation(function (this: HTMLElement) {
-      if (this.getAttribute('role') !== 'group') return 16;
-      return this.querySelector('[aria-label="Unsaved changes"]') ? 94 : 80;
+    stubBaseboardWidths((element) => {
+      if (element.getAttribute('role') !== 'group') return 16;
+      return element.querySelector('[aria-label="Unsaved changes"]') ? 94 : 80;
     });
     const id = 'dirty-door-fit';
-    act(() => root.render(<Baseboard items={[
+    renderBaseboard([
       { id, kind: 'tool', title: 'Editor' },
       { id: 'other-door', kind: 'terminal', title: 'Shell' },
-    ]} onReattach={() => {}} />));
+    ]);
     expect(container.querySelectorAll('[data-door-id]')).toHaveLength(2);
     act(() => recordToolDirty(id, true));
     expect(container.querySelectorAll('[data-door-id]')).toHaveLength(1);
diff --git a/lib/src/components/Baseboard.tsx b/lib/src/components/Baseboard.tsx
index bf5398809..a292fb82a 100644
--- a/lib/src/components/Baseboard.tsx
+++ b/lib/src/components/Baseboard.tsx
@@ -11,8 +11,10 @@ import {
   SpeakerSlashIcon,
   VibrateIcon,
 } from '@phosphor-icons/react';
-import { chromeButton, TERMINAL_TOP_RADIUS_CLASS, TODO_PILL_TRACKING_CLASS } from './design';
+import { clsx } from 'clsx';
+import { chromeButton, DOOR_TAB_CLASS, TERMINAL_TOP_RADIUS_CLASS, TODO_PILL_TRACKING_CLASS } from './design';
 import { AlertRingInset } from './alert-ring';
+import { TODO_PILL_BODY } from './TodoPillBody';
 import { SettingsDialog, type AlarmSink } from './SettingsDialog';
 import { SettingsPreview } from './SettingsPreview';
 import { Door } from './Door';
@@ -42,17 +44,18 @@ import {
 } from '../lib/terminal-registry';
 import { createTerminalPaneState, deriveSurfaceLabel } from '../lib/terminal-state';
 
-/** Shared look for every baseboard-level button (DESIGN.md -> Navigation). */
+/** Shared by every baseboard-level button (DESIGN.md -> Navigation). */
+const BASEBOARD_BUTTON_BASE_CLASS = 'h-6 shrink-0 justify-center pb-px text-sm font-medium font-mono';
 const BASEBOARD_BUTTON_CLASS = chromeButton({
   kind: 'labeled',
-  className: 'h-6 shrink-0 justify-center pb-px text-sm font-medium font-mono text-muted hover:text-foreground',
+  className: `${BASEBOARD_BUTTON_BASE_CLASS} text-muted hover:text-foreground`,
 });
 /** An overflow arrow hiding a ringing or TODO Door stands in for it, so it
- *  wears a Door's ground — the one its alarm inset is contrast-picked for — and,
- *  like a Door, no hover wash. */
+ *  wears a Door's shape and ground — the one its alarm inset is contrast-picked
+ *  for — and, like a Door, no hover wash. */
 const FLAGGED_OVERFLOW_BUTTON_CLASS = chromeButton({
   kind: 'labeled',
-  className: `relative h-6 shrink-0 justify-center overflow-hidden pb-px text-sm font-medium font-mono bg-door-bg text-door-fg hover:bg-door-bg rounded-b-none ${TERMINAL_TOP_RADIUS_CLASS}`,
+  className: clsx(BASEBOARD_BUTTON_BASE_CLASS, DOOR_TAB_CLASS, 'rounded-b-none bg-door-bg text-door-fg hover:bg-door-bg'),
 });
 const SETTINGS_BUTTON_CLASS = chromeButton({
   kind: 'icon',
@@ -65,8 +68,6 @@ interface OverflowAlerts {
   todo: number;
 }
 
-const NO_OVERFLOW_ALERTS: OverflowAlerts = { ringing: 0, todo: 0 };
-
 /**
  * `← N more` / `N more →`. A ringing or TODO Door scrolled out of view must not
  * vanish from the baseboard, so the arrow carries a static alarm inset and a
@@ -78,7 +79,7 @@ function OverflowArrow({ direction, count, alerts, onClick, measureRef }: {
   count: number;
   alerts: OverflowAlerts;
   onClick?: () => void;
-  /** Set on the hidden measurement copies, which the fitting pass reads. */
+  /** Set on the hidden measurement copy, which the fitting pass reads. */
   measureRef?: Ref<HTMLButtonElement>;
 }) {
   const flagged = alerts.ringing > 0 || alerts.todo > 0;
@@ -93,14 +94,14 @@ function OverflowArrow({ direction, count, alerts, onClick, measureRef }: {
       ref={measureRef}
       className={flagged ? FLAGGED_OVERFLOW_BUTTON_CLASS : BASEBOARD_BUTTON_CLASS}
       data-overflow-arrow={measureRef ? undefined : direction}
-      aria-label={measureRef ? undefined : label}
+      aria-label={label}
       tabIndex={measureRef ? -1 : undefined}
-      title={flagged && !measureRef ? label : undefined}
+      title={flagged ? label : undefined}
       onClick={onClick}
     >
       {direction === 'left' && <Caret size={10} weight="bold" />}
       {count} more
-      {alerts.todo > 0 && <span className={`text-xs font-semibold ${TODO_PILL_TRACKING_CLASS}`}>TODO</span>}
+      {alerts.todo > 0 && <span className={`todo-pill-shell text-xs font-semibold ${TODO_PILL_TRACKING_CLASS}`}>{TODO_PILL_BODY}</span>}
       {direction === 'right' && <Caret size={10} weight="bold" />}
       {alerts.ringing > 0 && <AlertRingInset ground="door" burst={null} className={TERMINAL_TOP_RADIUS_CLASS} />}
     </button>
@@ -145,11 +146,9 @@ export function Baseboard({ items, onReattach, notice, onDoorDragStart }: Basebo
   // than one on every activity notification.
   const [doorWidths, setDoorWidths] = useState<number[]>([]);
   const arrowMeasureEl = useRef<HTMLButtonElement>(null);
-  const todoArrowMeasureEl = useRef<HTMLButtonElement>(null);
   const rightClusterEl = useRef<HTMLDivElement>(null);
   const [rightClusterWidth, setRightClusterWidth] = useState(0);
-  // A hidden TODO Door widens its arrow by the mark, so both widths are measured.
-  const layoutMetrics = useRef({ doorGap: 0, arrowWidth: 0, todoArrowWidth: 0 });
+  const layoutMetrics = useRef({ doorGap: 0, arrowWidth: 0 });
   const [settingsOpen, setSettingsOpen] = useState(false);
   // Which Door's notepad popover is open, with the rect it was anchored on. The
   // rect is kept rather than re-read: a pin reattaches the Surface, so the Door
@@ -218,9 +217,6 @@ export function Baseboard({ items, onReattach, notice, onDoorDragStart }: Basebo
     if (arrowMeasureEl.current) {
       layoutMetrics.current.arrowWidth = arrowMeasureEl.current.offsetWidth;
     }
-    if (todoArrowMeasureEl.current) {
-      layoutMetrics.current.todoArrowWidth = todoArrowMeasureEl.current.offsetWidth;
-    }
   }, [items, activityStates, speechStates, terminalStates, notepadNotes, dirtyTools]);
 
   const itemKey = useMemo(() => items.map(i => i.id).join('\0'), [items]);
@@ -236,28 +232,26 @@ export function Baseboard({ items, onReattach, notice, onDoorDragStart }: Basebo
   let visibleCount = 0;
   let usedWidth = 0;
 
-  const alertsOf = (item: DoorChip): OverflowAlerts => {
-    const activity = activityStates.get(item.id) ?? DEFAULT_ACTIVITY_STATE;
-    return { ringing: activity.status === 'ALERT_RINGING' ? 1 : 0, todo: activity.todo ? 1 : 0 };
-  };
-  const overflowAlerts = (hidden: DoorChip[]): OverflowAlerts => hidden.reduce((sum, item) => {
-    const alerts = alertsOf(item);
-    return { ringing: sum.ringing + alerts.ringing, todo: sum.todo + alerts.todo };
-  }, NO_OVERFLOW_ALERTS);
+  const activityOf = (item: DoorChip) => activityStates.get(item.id) ?? DEFAULT_ACTIVITY_STATE;
+  const overflowAlerts = (hidden: DoorChip[]): OverflowAlerts => ({
+    ringing: hidden.filter((item) => activityOf(item).status === 'ALERT_RINGING').length,
+    todo: hidden.filter((item) => activityOf(item).todo).length,
+  });
 
   if (items.length > 0) {
     const widths = doorWidths;
-    const { doorGap, arrowWidth, todoArrowWidth } = layoutMetrics.current;
-    const arrowFor = (hidden: DoorChip[]) => (hidden.some((item) => alertsOf(item).todo > 0) ? todoArrowWidth : arrowWidth);
+    // Every arrow reserves the widest one's width, so what it hides never
+    // changes the fit.
+    const { doorGap, arrowWidth } = layoutMetrics.current;
     const hasLeftOverflow = startIndex > 0;
     const budget = availableWidth
-      - (hasLeftOverflow ? arrowFor(items.slice(0, startIndex)) : 0)
+      - (hasLeftOverflow ? arrowWidth : 0)
       - (rightClusterWidth + doorGap);
 
     for (let i = startIndex; i < items.length; i++) {
       const doorW = (widths[i] || 100) + (visibleCount > 0 ? doorGap : 0);
       const needsRightArrow = i + 1 < items.length;
-      const rightReserve = needsRightArrow ? arrowFor(items.slice(i + 1)) : 0;
+      const rightReserve = needsRightArrow ? arrowWidth : 0;
 
       if (usedWidth + doorW + rightReserve > budget) break;
       usedWidth += doorW;
@@ -318,7 +312,7 @@ export function Baseboard({ items, onReattach, notice, onDoorDragStart }: Basebo
   // measure the visible one, so the two must draw a Door identically or the
   // widths it feeds go stale.
   const doorProps = (item: DoorChip) => {
-    const activity = activityStates.get(item.id) ?? DEFAULT_ACTIVITY_STATE;
+    const activity = activityOf(item);
     return {
       // Only a terminal-backed Surface has shell state to derive a label from;
       // anything else keeps the store-backed title it already carries.
@@ -373,13 +367,12 @@ export function Baseboard({ items, onReattach, notice, onDoorDragStart }: Basebo
       ref={containerRef}
       className="flex h-7 shrink-0 items-end gap-1.5 bg-app-bg px-1.75 pt-1"
     >
-      {/* Hidden measurement pass — doors + overflow arrow */}
+      {/* Hidden measurement pass — doors + the widest overflow arrow */}
       <div ref={measureEl} className="absolute -left-[9999px] flex gap-1.5" aria-hidden>
         {items.map(item => <Door key={item.id} {...doorProps(item)} />)}
       </div>
       <div className="absolute -left-[9999px] flex" aria-hidden>
-        <OverflowArrow measureRef={arrowMeasureEl} direction="right" count={9} alerts={NO_OVERFLOW_ALERTS} />
-        <OverflowArrow measureRef={todoArrowMeasureEl} direction="right" count={9} alerts={{ ringing: 0, todo: 9 }} />
+        <OverflowArrow measureRef={arrowMeasureEl} direction="right" count={9} alerts={{ ringing: 0, todo: 9 }} />
       </div>
 
       {items.length === 0 && showHint && (
diff --git a/lib/src/components/TodoPillBody.tsx b/lib/src/components/TodoPillBody.tsx
index a0525db71..57c433032 100644
--- a/lib/src/components/TodoPillBody.tsx
+++ b/lib/src/components/TodoPillBody.tsx
@@ -3,15 +3,22 @@ import type { TodoState } from '../lib/terminal-registry';
 
 const FLOURISH_MS = 500;
 
+/** The TODO pill's body, for a pill shell (`todo-pill-shell`). A grid-stacked
+ *  <letters, check>, so the pill width stays stable across steady/flourishing
+ *  states — the CSS drives the animation. */
+export const TODO_PILL_BODY: ReactNode = (
+  <span className="todo-pill-stack">
+    <span className="todo-pill-stack__letters">TODO</span>
+    <span className="todo-pill-stack__check" aria-hidden>✓</span>
+  </span>
+);
+
 /**
  * Shared render body + flourish state for the TODO pill.
  *
  * Returns `visible: false` when the pill should not render at all.
  * Returns `flourishing: true` briefly after a TODO clears so the
  * caller can set `data-flourishing="true"` on its pill shell.
- *
- * The body is a grid-stacked <letters, check> so the pill width stays
- * stable across steady/flourishing states — the CSS drives the animation.
  */
 export function useTodoPillContent(todo: TodoState): {
   visible: boolean;
@@ -44,12 +51,5 @@ export function useTodoPillContent(todo: TodoState): {
 
   const visible = todo || flourishing;
 
-  const body: ReactNode = visible ? (
-    <span className="todo-pill-stack">
-      <span className="todo-pill-stack__letters">TODO</span>
-      <span className="todo-pill-stack__check" aria-hidden>✓</span>
-    </span>
-  ) : null;
-
-  return { visible, flourishing, body };
+  return { visible, flourishing, body: visible ? TODO_PILL_BODY : null };
 }
diff --git a/lib/src/components/wall/TerminalContext.test.tsx b/lib/src/components/wall/TerminalContext.test.tsx
index 2d6788939..19b5eb5d6 100644
--- a/lib/src/components/wall/TerminalContext.test.tsx
+++ b/lib/src/components/wall/TerminalContext.test.tsx
@@ -217,6 +217,12 @@ it('offers the rule covering the running script, else that script\'s own key', a
   }
 });
 
+it('shows a running Tool command that spans lines on one', () => {
+  props = { ...props, terminalRole: 'tool', status: 'running', command: 'cd web\npnpm dev' };
+  render();
+  expect(container.querySelector('[title^="Running "]')?.getAttribute('title')).toBe('Running cd web pnpm dev…');
+});
+
 it('uses the Tool primary terminal without creating a helper or offering helper lifecycle actions', async () => {
   const openHelper = vi.spyOn(helpers, 'openHelper');
   const focusTerminal = vi.fn();
diff --git a/lib/src/components/wall/TerminalContext.tsx b/lib/src/components/wall/TerminalContext.tsx
index 59577eb3e..a825011c4 100644
--- a/lib/src/components/wall/TerminalContext.tsx
+++ b/lib/src/components/wall/TerminalContext.tsx
@@ -8,8 +8,8 @@ import { TerminalContextView, type ContextScan } from './TerminalContextView';
 import { TerminalContextContext, WallActionsContext, type TerminalContextState } from './wall-context';
 import { disposeHelper, getHelper, helperRevision, openHelper, setHelperVisible, subscribeHelpers } from '../../lib/helper-terminal';
 import { getPlatform, IS_MAC, IS_WINDOWS } from '../../lib/platform';
-import { buildAppTitleResolver, commandWatchKey, createTerminalPaneState, cwdDisplay, deriveSurfaceLabel, explainTerminalTitle, type CwdState } from '../../lib/terminal-state';
-import { commandWatchRule, focusSession, getTerminalInstance, getActivitySnapshot, getTerminalPaneStateSnapshot, setCommandWatched, subscribeToActivity, subscribeToTerminalPaneState, subscribeToWatchedCommands, getWatchedCommandsSnapshot, toggleSessionTodo } from '../../lib/terminal-registry';
+import { buildAppTitleResolver, createTerminalPaneState, cwdDisplay, deriveSurfaceLabel, explainTerminalTitle, type CwdState } from '../../lib/terminal-state';
+import { focusSession, getRunningCommandWatchKey, getRunningCommandWatchRule, getTerminalInstance, getActivitySnapshot, getTerminalPaneStateSnapshot, setCommandWatched, subscribeToActivity, subscribeToTerminalPaneState, subscribeToWatchedCommands, getWatchedCommandsSnapshot, toggleSessionTodo } from '../../lib/terminal-registry';
 import { writeTextToClipboard } from '../../lib/clipboard';
 import { listenerUrlsByPort } from './port-url';
 import { DEFAULT_HELPER_COMMAND } from '../../lib/terminal-context-types';
@@ -31,10 +31,9 @@ export function TerminalContext({ id, title, closing, origin, warning: openWarni
   const cwd = state.cwd?.path ? state.cwd : undefined;
   const helperState = helper ? states.get(helper.id) : undefined;
   const helperCwd = helperState?.cwd?.path ? helperState.cwd : undefined;
-  const watchKey = state.currentCommand?.rawCommandLine ? commandWatchKey(state.currentCommand.rawCommandLine) : null;
-  // A bare runner rule already covers this script, so the row offers that rule.
-  const watchRule = commandWatchRule(watchKey);
-  const offeredRule = watchRule ?? watchKey;
+  // A bare runner rule already covering the running script is the one the row offers.
+  const watchRule = getRunningCommandWatchRule(id);
+  const offeredRule = watchRule ?? getRunningCommandWatchKey(id);
   const appTitleForPane = useMemo(() => buildAppTitleResolver(states, activities), [states, activities]);
   const titleSources = useMemo(() => explainTerminalTitle(state, { appTitleForPane }), [state, appTitleForPane]);
   const display = (location: CwdState) => cwdDisplay(location, { style: 'full', homePath: home });
diff --git a/lib/src/components/wall/TerminalContextView.tsx b/lib/src/components/wall/TerminalContextView.tsx
index 9b2fee2fd..cf16d108f 100644
--- a/lib/src/components/wall/TerminalContextView.tsx
+++ b/lib/src/components/wall/TerminalContextView.tsx
@@ -168,7 +168,8 @@ export function TerminalContextView(p: TerminalContextViewProps) {
   const submit = async (action: Action) => { setBusy(true); if (await attempt(action)) setDetail(null); setBusy(false); };
   const status = HELPER_STATUS[p.status];
   const isTool = p.terminalRole === 'tool';
-  const statusLabel = isTool ? (p.status === 'running' ? `Running ${p.command}…` : 'At prompt') : status.label(p.command);
+  // A Tool's command is whatever its shell reported, line breaks included.
+  const statusLabel = isTool ? (p.status === 'running' ? `Running ${p.command.replace(/\s+/g, ' ')}…` : 'At prompt') : status.label(p.command);
   return <section ref={surface} aria-label="Terminal context" data-terminal-context tabIndex={-1} inert={p.closing} aria-hidden={p.closing || undefined} style={SURFACE_STYLE}
     className={`${TERMINAL_CONTEXT_SURFACE_CLASS} ${motionClass} ${p.closing ? 'pointer-events-none' : ''} absolute inset-4 flex flex-col overflow-hidden text-sm`}
     onContextMenu={event => event.preventDefault()}
diff --git a/lib/src/lib/alert-manager.test.ts b/lib/src/lib/alert-manager.test.ts
index b663c69a6..c8e21cdff 100644
--- a/lib/src/lib/alert-manager.test.ts
+++ b/lib/src/lib/alert-manager.test.ts
@@ -19,42 +19,33 @@ describe('AlertManager in isolation', () => {
   // Timing from cfg.alert:
   // busyCandidateGap=1500, busyConfirmGap=500, mightNeedAttention=2000, needsAttentionConfirm=3000
 
-  /**
-   * WATCHING is keyed on the foreground command's name, so the only way to turn
-   * it on is to run a watched command (`docs/specs/alert.md`).
-   */
-  function runWatchedCommand(id: string, commandLine = 'longtask'): void {
-    manager.setWatchedCommands(['longtask']);
+  /** Start `commandLine` the way shell integration reports it: the line, then its start. */
+  function runCommand(id: string, commandLine = 'pnpm build'): void {
     manager.applyTerminalSemanticEvents(id, [
       { type: 'commandLine', commandLine },
       { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
     ]);
   }
 
+  /**
+   * WATCHING is keyed on the foreground command's watch key, so the only way to
+   * turn it on is to run a watched command (`docs/specs/alert.md`).
+   */
+  function runWatchedCommand(id: string, commandLine = 'longtask'): void {
+    manager.setWatchedCommands(['longtask']);
+    runCommand(id, commandLine);
+  }
+
   describe('helper Sessions', () => {
     const HELPER = 'helper';
 
-    function startCommand(id: string, commandLine: string): void {
-      manager.applyTerminalSemanticEvents(id, [
-        { type: 'commandLine', commandLine },
-        { type: 'commandStart', source: 'osc633_boundaries' },
-      ]);
-    }
-
-    function outputFor(id: string, ms: number): void {
-      for (let t = 0; t < ms; t += 200) {
-        manager.onData(id);
-        vi.advanceTimersByTime(200);
-      }
-    }
-
     it('alerts no one, publishes nothing, and accepts no report or control until promoted', () => {
       const states: string[] = [];
       manager.onStateChange((id) => states.push(id));
       const seen = recordingClaimant(HELPER, true);
       manager.setHelper(HELPER, true);
       runWatchedCommand(HELPER);
-      outputFor(HELPER, 3_000);
+      driveToBusy(HELPER);
       settle();
       applyTerminalProtocolEvents(manager, HELPER, [{ kind: 'notification', notification: { source: 'OSC 9', title: null, body: 'done' } }]);
       applyTerminalProtocolEvents(manager, HELPER, [{ kind: 'progress', progress: { state: 'normal', percent: 40 } }]);
@@ -85,8 +76,8 @@ describe('AlertManager in isolation', () => {
     it('keeps the command a helper was running when it is promoted mid-command', () => {
       manager.setWatchedCommands(['claude']);
       manager.setHelper(HELPER, true);
-      startCommand(HELPER, 'claude');
-      outputFor(HELPER, 3_000);
+      runCommand(HELPER, 'claude');
+      driveToBusy(HELPER);
 
       const states: boolean[] = [];
       manager.onStateChange((id, state) => { if (id === HELPER) states.push(state.watchingEnabled); });
@@ -103,8 +94,8 @@ describe('AlertManager in isolation', () => {
     it('never replays a completion suppressed before promotion', () => {
       manager.setWatchedCommands(['claude']);
       manager.setHelper(HELPER, true);
-      startCommand(HELPER, 'claude');
-      outputFor(HELPER, 3_000);
+      runCommand(HELPER, 'claude');
+      driveToBusy(HELPER);
       settle();
       applyTerminalProtocolEvents(manager, HELPER, [{ kind: 'notification', notification: { source: 'OSC 9', title: null, body: 'done' } }]);
 
@@ -115,14 +106,14 @@ describe('AlertManager in isolation', () => {
 
     it('does not ring the exit of a command it never saw with attention', () => {
       manager.setHelper(HELPER, true);
-      startCommand(HELPER, 'npm run build');
+      runCommand(HELPER, 'npm run build');
       manager.setHelper(HELPER, false);
       vi.advanceTimersByTime(30_000);
       manager.applyTerminalSemanticEvents(HELPER, [{ type: 'commandFinish', exitCode: 0 }]);
       expect(manager.getState(HELPER).status).toBe('WATCHING_DISABLED');
 
       // The ordinary seen rule applies from promotion on.
-      startCommand(HELPER, 'npm run build');
+      runCommand(HELPER, 'npm run build');
       manager.attend(HELPER);
       manager.clearAttention(HELPER);
       vi.advanceTimersByTime(30_000);
@@ -791,10 +782,7 @@ describe('AlertManager in isolation', () => {
     const id = 'runner-script-rule';
     const ringsUnder = (rules: string[]): boolean => {
       manager.setWatchedCommands(rules);
-      manager.applyTerminalSemanticEvents(id, [
-        { type: 'commandLine', commandLine: 'pnpm run dev' },
-        { type: 'commandStart', source: 'osc633_boundaries' },
-      ]);
+      runCommand(id, 'pnpm run dev');
       driveToBusy(id);
       settle();
       const ringing = manager.getState(id).status === 'ALERT_RINGING';
@@ -812,10 +800,7 @@ describe('AlertManager in isolation', () => {
   it('keeps a WATCHING ring whose command another rule still covers', () => {
     const id = 'ring-survives-covered';
     manager.setWatchedCommands(['pnpm', 'pnpm dev']);
-    manager.applyTerminalSemanticEvents(id, [
-      { type: 'commandLine', commandLine: 'pnpm dev' },
-      { type: 'commandStart', source: 'osc633_boundaries' },
-    ]);
+    runCommand(id, 'pnpm dev');
     driveToBusy(id);
     settle();
     expect(manager.getState(id).status).toBe('ALERT_RINGING');
@@ -1547,14 +1532,6 @@ describe('AlertManager in isolation', () => {
       };
     }
 
-    /** A command start with no WATCHING rule behind it, so nothing settles into a ring. */
-    function runCommand(id: string, commandLine = 'pnpm build'): void {
-      manager.applyTerminalSemanticEvents(id, [
-        { type: 'commandLine', commandLine },
-        { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-      ]);
-    }
-
     // 1. Already ringing at call time.
 
     it('resolves on a protocol ring already latched, consuming only that track', async () => {
diff --git a/lib/src/lib/alert-manager.ts b/lib/src/lib/alert-manager.ts
index dfb6728f5..277647eb3 100644
--- a/lib/src/lib/alert-manager.ts
+++ b/lib/src/lib/alert-manager.ts
@@ -1143,8 +1143,6 @@ export class AlertManager {
 
   /** Completely remove alert state for a PTY (used when PTY is destroyed) */
   remove(id: string): void {
-    // A helper that never published has nothing for subscribers to forget.
-    const unpublished = this.helpers.delete(id) && !this.lastEmitted.has(id);
     this.suspendedForTransfer.delete(id);
     this.liveReplay.delete(id);
     this.removed.add(id);
@@ -1154,15 +1152,19 @@ export class AlertManager {
     // nothing, so holding their closures would only leak them.
     this.claimants.delete(id);
     const entry = this.entries.get(id);
-    if (!entry) return;
-    this.clearDeferredNotification(entry);
-    entry.detector.dispose();
-    this.entries.delete(id);
-    if (this.attentionId === id) {
-      this.attentionId = null;
-      this.clearAttentionTimer();
+    if (entry) {
+      this.clearDeferredNotification(entry);
+      entry.detector.dispose();
+      this.entries.delete(id);
+      if (this.attentionId === id) {
+        this.attentionId = null;
+        this.clearAttentionTimer();
+      }
+      this.notify(id);
     }
-    if (!unpublished) this.notify(id);
+    // Last, so `notify` still knows a helper that never published has nothing
+    // for subscribers to forget.
+    this.helpers.delete(id);
   }
 
   /**
@@ -1189,8 +1191,9 @@ export class AlertManager {
     this.notify(id);
   }
 
-  /** A Session suspended for a live handoff accepts nothing; a helper accepts
-   *  only what builds its command state. */
+  /** Whether `id` drops reports, controls and awaits: a helper, or a Session
+   *  suspended for a live handoff. The output and command-state feeds, which a
+   *  helper keeps, check the suspension alone. */
   private inert(id: string): boolean {
     return this.helpers.has(id) || this.suspendedForTransfer.has(id);
   }
diff --git a/lib/src/lib/osc-sanitize.ts b/lib/src/lib/osc-sanitize.ts
index eaf8530d7..ba3499346 100644
--- a/lib/src/lib/osc-sanitize.ts
+++ b/lib/src/lib/osc-sanitize.ts
@@ -1,7 +1,8 @@
 /**
  * The shared sanitizer for untrusted OSC payload text — OSC 9/99/777
- * notifications and the OSC 367 tool announcement, all arbitrary process output
- * that reaches UI (`docs/specs/alert.md` -> notification protocols).
+ * notifications, the OSC 367 tool announcement, and the shell-reported command
+ * line, all arbitrary process output that reaches UI (`docs/specs/alert.md` ->
+ * notification protocols, `docs/specs/terminal-escapes.md`).
  */
 
 /** Clamp by code point, so a truncation cannot split a surrogate pair. */
@@ -20,3 +21,16 @@ export function sanitizeText(input: string, limit: number): string | null {
   if (!collapsed) return null;
   return truncateText(collapsed, limit);
 }
+
+/** {@link sanitizeText} for a shell command line, which keeps its line breaks:
+ *  a whitespace run holding one (`\r\n` and `\r` included) collapses to `\n`,
+ *  since an unquoted newline separates commands the way `;` does. */
+export function sanitizeCommandLine(input: string, limit: number): string | null {
+  const collapsed = input
+    .replace(/\r\n?/g, '\n')
+    .replace(/[\x00-\x09\x0b-\x1f\x7f-\x9f]+/g, ' ')
+    .replace(/\s+/g, (run) => (run.includes('\n') ? '\n' : ' '))
+    .trim();
+  if (!collapsed) return null;
+  return truncateText(collapsed, limit);
+}
diff --git a/lib/src/lib/terminal-protocol.test.ts b/lib/src/lib/terminal-protocol.test.ts
index f030e5a49..8d1421fb3 100644
--- a/lib/src/lib/terminal-protocol.test.ts
+++ b/lib/src/lib/terminal-protocol.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it, vi } from 'vitest';
 import { collectTerminalSemanticEvents, formatOscColorResponse, ITERM2_DEVICE_ATTRIBUTES_RESPONSE, TerminalProtocolParser } from './terminal-protocol';
-import { createTerminalPaneState, deriveHeader, reduceTerminalState, type TerminalSemanticEvent } from './terminal-state';
+import { commandWatchKey, createTerminalPaneState, deriveHeader, reduceTerminalState, type TerminalSemanticEvent } from './terminal-state';
 
 describe('TerminalProtocolParser', () => {
   it('parses and strips standalone terminal bells', () => {
@@ -561,11 +561,15 @@ describe('TerminalProtocolParser', () => {
   // derivation, and the key `dor ensure --restart` matches on — so it is bounded
   // and sanitized like a title rather than stored as it arrived. The `\xNN`
   // unescape is what puts control characters back, so the sanitize runs after it.
+  // Its line breaks survive, since a newline separates commands.
   it('bounds and sanitizes the OSC 633 command line', () => {
     const parser = new TerminalProtocolParser();
 
-    expect(parser.process('\x1b]633;E;git\\x0a\\x1bcommit\x07').events).toEqual([
-      { kind: 'semantic', event: { type: 'commandLine', commandLine: 'git commit' } },
+    expect(parser.process('\x1b]633;E;git\\x0a\\x1bcommit\\x07now\x07').events).toEqual([
+      { kind: 'semantic', event: { type: 'commandLine', commandLine: 'git\ncommit now' } },
+    ]);
+    expect(parser.process('\x1b]633;E;cat <<EOF\\x0d\\x0a  hi\\x0d\\x0dEOF \x07').events).toEqual([
+      { kind: 'semantic', event: { type: 'commandLine', commandLine: 'cat <<EOF\nhi\nEOF' } },
     ]);
 
     const long = parser.process(`\x1b]633;E;${'a'.repeat(100_000)}\x07`).events;
@@ -621,10 +625,10 @@ describe('TerminalProtocolParser', () => {
   it('bounds and sanitizes the OSC 133;C command line', () => {
     const parser = new TerminalProtocolParser();
     expect(parser.process('\x1b]133;C;cmdline_url=git%0A%1Bcommit\x07').events[0]).toEqual(
-      { kind: 'semantic', event: { type: 'commandLine', commandLine: 'git commit' } },
+      { kind: 'semantic', event: { type: 'commandLine', commandLine: 'git\ncommit' } },
     );
     expect(parser.process("\x1b]133;C;cmdline=git$'\\n\\E'commit\x07").events[0]).toEqual(
-      { kind: 'semantic', event: { type: 'commandLine', commandLine: 'git commit' } },
+      { kind: 'semantic', event: { type: 'commandLine', commandLine: 'git\ncommit' } },
     );
     for (const params of [`cmdline_url=${'%E2%9C%93'.repeat(30_000)}`, `cmdline=${'a'.repeat(100_000)}`]) {
       const [event] = parser.process(`\x1b]133;C;${params}\x07`).events;
@@ -635,13 +639,21 @@ describe('TerminalProtocolParser', () => {
 
   it('gives a fish pane its real command name in the header', () => {
     const parser = new TerminalProtocolParser();
-    const events = collectTerminalSemanticEvents(parser.process('\x1b]133;A;click_events=1\x07$ \x1b]133;B\x07\x1b]133;C;cmdline_url=pnpm%20test%20--watch\x07').events);
-    let pane = createTerminalPaneState();
-    for (const event of events) pane = reduceTerminalState(pane, event);
+    const pane = reduceSemanticEvents(collectTerminalSemanticEvents(parser.process('\x1b]133;A;click_events=1\x07$ \x1b]133;B\x07\x1b]133;C;cmdline_url=pnpm%20test%20--watch\x07').events));
     expect(pane.currentCommand?.rawCommandLine).toBe('pnpm test --watch');
     expect(deriveHeader(pane, [pane]).primary).toBe('pnpm test --watch');
   });
 
+  // zsh's `E` escapes a newline as `\x0a`, fish's `cmdline_url` as `%0A`.
+  it.each([
+    ['\x1b]633;E;cd web\\x0apnpm dev\x07\x1b]633;C\x07'],
+    ['\x1b]133;C;cmdline_url=cd%20web%0Apnpm%20dev\x07'],
+  ])('keys a multi-line command line %j on its last command', (stream) => {
+    const pane = reduceSemanticEvents(collectTerminalSemanticEvents(new TerminalProtocolParser().process(stream).events));
+    expect(commandWatchKey(pane.currentCommand?.rawCommandLine ?? '')).toBe('pnpm dev');
+    expect(pane.currentCommand?.displayCommand).toBe('cd web ...');
+  });
+
   // W1: the OSC terminator scan runs on raw bytes, so a `Cwd=` payload holding
   // one ends the sequence early and everything after it parses as a fresh,
   // fully-trusted OSC. The parser cannot defend against this — by the time it
diff --git a/lib/src/lib/terminal-protocol.ts b/lib/src/lib/terminal-protocol.ts
index 0d4d8a02c..18c46a988 100644
--- a/lib/src/lib/terminal-protocol.ts
+++ b/lib/src/lib/terminal-protocol.ts
@@ -1,7 +1,7 @@
 import { parseToolState, type ToolState } from './tool-state';
 import type { ActivityNotification, ProtocolProgressUpdate } from './alert-manager';
 import { parseColor } from './css-color';
-import { sanitizeText, truncateText } from './osc-sanitize';
+import { sanitizeCommandLine, sanitizeText, truncateText } from './osc-sanitize';
 import { isProtocolCommandStart, recordToolEvents } from './tool-events';
 import { parseToolAnnounce, type ToolAnnounce } from './tool-announce';
 import {
@@ -84,11 +84,12 @@ const OSC99_PENDING_TTL_MS = 60_000;
 const OSC99_MAX_PENDING_IDS = 64;
 const TITLE_LIMIT = 256;
 const BODY_LIMIT = 4096;
-// The OSC 633 `E` command line. Bounded and sanitized like every other value
-// that comes off the wire and is then *retained*: it is re-tokenized on every
-// header derivation and is the key `dor ensure --restart` matches on, and
-// `decodeOsc633Value` actively re-introduces control characters that the
-// emit-side escaping had removed (`docs/specs/terminal-escapes.md`).
+// The shell-reported command line (`OSC 633 ; E`, `OSC 133 ; C`). Bounded and
+// sanitized like every other value that comes off the wire and is then
+// *retained*: it is re-tokenized on every header derivation and is the key
+// `dor ensure --restart` matches on, and its decoding actively re-introduces
+// control characters that the emit-side escaping had removed
+// (`docs/specs/terminal-escapes.md`). See `commandLineEvents`.
 const COMMAND_LINE_LIMIT = 2048;
 const OSC99_PENDING_TITLE_LIMIT = 2048;
 const OSC99_PENDING_BODY_LIMIT = 16_384;
@@ -322,27 +323,28 @@ export class TerminalProtocolParser {
   }
 
   private parseOsc9(content: string): TerminalProtocolEvent[] {
-    if (!content.startsWith('9;')) return [];
-
-    if (content.startsWith('9;9;')) {
-      const cwd = cwdFromOsc9_9(content.slice('9;9;'.length));
-      return cwd ? [{ kind: 'semantic', event: { type: 'cwd', cwd } }] : [];
+    // A number alone or before `;` is a ConEmu subcommand, never a message.
+    const subcommand = /^9;(\d+)(?:;|$)/.exec(content);
+    if (!subcommand) {
+      const body = sanitizeText(content.slice('9;'.length), BODY_LIMIT);
+      return body
+        ? [{ kind: 'notification', notification: { source: 'OSC 9', title: null, body } }]
+        : [];
     }
-
-    if (content === '9;4' || content.startsWith('9;4;')) {
-      const progress = parseOsc94(content);
-      return progress ? [{ kind: 'progress', progress }] : [];
+    switch (subcommand[1]) {
+      case '4': {
+        const progress = parseOsc94(content);
+        return progress ? [{ kind: 'progress', progress }] : [];
+      }
+      case '9': {
+        // `9;9;<cwd>`; a bare `9;9` carries none.
+        const cwd = cwdFromOsc9_9(content.slice(subcommand[0].length));
+        return cwd ? [{ kind: 'semantic', event: { type: 'cwd', cwd } }] : [];
+      }
+      default:
+        // Sleep, tab title, GuiMacro, the `9;12` prompt mark, ...
+        return [];
     }
-
-    // ConEmu's numbered subcommands (sleep, tab title, GuiMacro, a bare `9;9`,
-    // the `9;12` prompt mark, ...) are not messages. A message only reaches
-    // here if it does not open with a number followed by `;` or its end.
-    if (/^9;\d+(?:;|$)/.test(content)) return [];
-
-    const body = sanitizeText(content.slice(2), BODY_LIMIT);
-    return body
-      ? [{ kind: 'notification', notification: { source: 'OSC 9', title: null, body } }]
-      : [];
   }
 
   /**
@@ -649,8 +651,9 @@ function parseOsc133(content: string): TerminalProtocolEvent[] {
   const fields = content.split(';');
   if (fields[0] !== '133') return [];
   const boundary = parsePromptBoundary(fields, 'osc133_boundaries');
+  if (fields[1] !== 'C') return boundary;
   // Staged ahead of the start it names, exactly as `633;E` precedes `633;C`.
-  return fields[1] === 'C' ? [...parseOsc133CommandLine(content.slice('133;C'.length)), ...boundary] : boundary;
+  return [...parseOsc133CommandLine(content.slice('133;C'.length)), ...boundary];
 }
 
 /**
@@ -660,39 +663,49 @@ function parseOsc133(content: string): TerminalProtocolEvent[] {
  * both are present, being unambiguous; unknown keys are ignored.
  *
  * `%q` can leave a raw `;` inside `$'…'`, so `cmdline=` runs to the end of the
- * sequence, which is where both emitters put it. Bounded before decoding and
- * sanitized after, like `633;E` — decoding is what re-introduces control
- * characters.
+ * sequence, which is where both emitters put it.
  */
 function parseOsc133CommandLine(params: string): TerminalProtocolEvent[] {
-  let url: string | null = null;
-  let quoted: string | null = null;
-  for (let from = 0; from < params.length && quoted === null;) {
-    const start = from + 1;
-    const end = params.indexOf(';', start);
-    const field = params.slice(start, end === -1 ? params.length : end);
-    if (field.startsWith('cmdline=')) quoted = params.slice(start + 'cmdline='.length);
-    else if (field.startsWith('cmdline_url=')) url ??= field.slice('cmdline_url='.length);
-    if (end === -1) break;
-    from = end;
-  }
-  const decoded = url !== null
-    // One code point is at most four UTF-8 bytes of three characters each.
-    ? decodePercentEncoded(truncateText(url, COMMAND_LINE_LIMIT * 12))
-    : quoted !== null
-      ? decodeShellQuotedWord(truncateText(quoted, COMMAND_LINE_LIMIT * 4))
-      : null;
-  const commandLine = decoded === null ? null : sanitizeText(decoded, COMMAND_LINE_LIMIT);
+  const quoted = params.indexOf(';cmdline=');
+  const url = (quoted === -1 ? params : params.slice(0, quoted))
+    .split(';')
+    .find((field) => field.startsWith('cmdline_url='));
+  // One code point is at most four UTF-8 bytes of three characters each.
+  if (url !== undefined) return commandLineEvents(url.slice('cmdline_url='.length), 12, decodePercentEncoded);
+  if (quoted !== -1) return commandLineEvents(params.slice(quoted + ';cmdline='.length), 4, decodeShellQuotedWord);
+  return [];
+}
+
+/**
+ * The `commandLine` event for a shell-reported command line, from `OSC 633 ; E`
+ * or `OSC 133 ; C` alike (`docs/specs/terminal-escapes.md`): bounded *before*
+ * `decode` to `COMMAND_LINE_LIMIT` code points of at most `encodedWidth`
+ * characters each, so a megabyte of escapes is never decoded to be thrown away,
+ * and sanitized *after* it, because decoding is what puts control characters
+ * back. One that reduces to nothing is dropped rather than stored empty.
+ */
+function commandLineEvents(
+  encoded: string,
+  encodedWidth: number,
+  decode: (value: string) => string,
+): TerminalProtocolEvent[] {
+  const commandLine = sanitizeCommandLine(
+    decode(truncateText(encoded, COMMAND_LINE_LIMIT * encodedWidth)),
+    COMMAND_LINE_LIMIT,
+  );
   return commandLine === null ? [] : [{ kind: 'semantic', event: { type: 'commandLine', commandLine } }];
 }
 
+/** Shared by every UTF-8 decode here; `decode` without `stream` keeps no state. */
+const UTF8_DECODER = new TextDecoder();
+
 /** `%XX` runs decoded as UTF-8; a malformed escape stays literal and an invalid
  *  byte sequence becomes U+FFFD, so a truncated tail never throws. */
 function decodePercentEncoded(value: string): string {
   return value.replace(/(?:%[0-9a-fA-F]{2})+/g, (run) => {
     const bytes = new Uint8Array(run.length / 3);
     for (let i = 0; i < bytes.length; i += 1) bytes[i] = Number.parseInt(run.slice(i * 3 + 1, i * 3 + 3), 16);
-    return new TextDecoder().decode(bytes);
+    return UTF8_DECODER.decode(bytes);
   });
 }
 
@@ -720,29 +733,9 @@ function decodeShellQuotedWord(value: string): string {
       out += value.slice(i + 1, end);
       i = end + 1;
     } else if (char === '$' && value[i + 1] === "'") {
-      i += 2;
-      while (i < value.length && value[i] !== "'") {
-        if (value[i] !== '\\') {
-          out += value[i];
-          i += 1;
-          continue;
-        }
-        const rest = value.slice(i + 1, i + 10);
-        const numeric = ANSI_C_NUMERIC_ESCAPE.exec(rest);
-        if (numeric) {
-          const [whole, hex, u4, u8, octal] = numeric;
-          const code = Number.parseInt(hex ?? u4 ?? u8 ?? octal!, octal ? 8 : 16);
-          out += code <= 0x10ffff ? String.fromCodePoint(code) : '';
-          i += 1 + whole.length;
-        } else if (rest[0] === 'c' && rest.length > 1) {
-          out += String.fromCharCode(rest.charCodeAt(1) & 0x1f);
-          i += 3;
-        } else {
-          out += ANSI_C_ESCAPES[rest[0] ?? ''] ?? rest[0] ?? '';
-          i += 2;
-        }
-      }
-      i += 1;
+      const quoted = decodeAnsiCQuote(value, i + 2);
+      out += quoted.text;
+      i = quoted.end;
     } else {
       out += char;
       i += 1;
@@ -751,6 +744,37 @@ function decodeShellQuotedWord(value: string): string {
   return out;
 }
 
+/** The body of a `$'…'` word starting at `from` (past its `$'`), escapes
+ *  decoded, and where reading resumes past its closing quote. */
+function decodeAnsiCQuote(value: string, from: number): { text: string; end: number } {
+  let text = '';
+  let i = from;
+  while (i < value.length && value[i] !== "'") {
+    if (value[i] === '\\') {
+      const escape = decodeAnsiCEscape(value.slice(i + 1, i + 10));
+      text += escape.text;
+      i += 1 + escape.width;
+    } else {
+      text += value[i];
+      i += 1;
+    }
+  }
+  return { text, end: i + 1 };
+}
+
+/** One ANSI-C escape, `rest` being what follows its backslash: the text it
+ *  stands for and how many characters of `rest` it spans. */
+function decodeAnsiCEscape(rest: string): { text: string; width: number } {
+  const numeric = ANSI_C_NUMERIC_ESCAPE.exec(rest);
+  if (numeric) {
+    const [whole, hex, u4, u8, octal] = numeric;
+    const code = Number.parseInt(hex ?? u4 ?? u8 ?? octal!, octal ? 8 : 16);
+    return { text: code <= 0x10ffff ? String.fromCodePoint(code) : '', width: whole.length };
+  }
+  if (rest[0] === 'c' && rest.length > 1) return { text: String.fromCharCode(rest.charCodeAt(1) & 0x1f), width: 2 };
+  return { text: ANSI_C_ESCAPES[rest[0] ?? ''] ?? rest[0] ?? '', width: 1 };
+}
+
 function parseOsc633(content: string): TerminalProtocolEvent[] {
   const fields = content.split(';');
   if (fields[0] !== '633') return [];
@@ -763,16 +787,7 @@ function parseOsc633(content: string): TerminalProtocolEvent[] {
     // that send raw, unescaped semicolons will see their command truncated; this
     // matches VS Code's contract rather than guessing a delimiter.
     const rawCommand = content.slice(prefix.length).split(';', 1)[0] ?? '';
-    // Bounded *before* the unescape, so a megabyte of `\xNN` is not decoded to
-    // be thrown away, and sanitized after it, because the unescape is what puts
-    // control characters back. An all-control command line reduces to nothing
-    // and is dropped rather than stored empty.
-    const commandLine = sanitizeText(
-      decodeOsc633Value(truncateText(rawCommand, COMMAND_LINE_LIMIT * 4)),
-      COMMAND_LINE_LIMIT,
-    );
-    if (commandLine === null) return [];
-    return [{ kind: 'semantic', event: { type: 'commandLine', commandLine } }];
+    return commandLineEvents(rawCommand, 4, decodeOsc633Value);
   }
   if (fields[1] === 'P') {
     return parseOsc633Property(content.slice('633;P;'.length));
@@ -968,7 +983,7 @@ function decodeBase64(input: string): string | null {
     const binary = atob(normalized);
     const bytes = new Uint8Array(binary.length);
     for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
-    return new TextDecoder().decode(bytes);
+    return UTF8_DECODER.decode(bytes);
   } catch {
     return null;
   }
diff --git a/lib/src/lib/terminal-registry.ts b/lib/src/lib/terminal-registry.ts
index e7012d713..5b3d2833e 100644
--- a/lib/src/lib/terminal-registry.ts
+++ b/lib/src/lib/terminal-registry.ts
@@ -59,10 +59,9 @@ export type { SurfaceFocusHandle } from './terminal-lifecycle';
 export { setDefaultShellOpts, getDefaultShellOpts } from './shell-defaults';
 
 export {
-  commandWatchRule,
+  getRunningCommandWatchRule,
   getWatchedCommands,
   getWatchedCommandsSnapshot,
-  isCommandWatched,
   setCommandWatched,
   subscribeToWatchedCommands,
 } from './watched-commands';
diff --git a/lib/src/lib/terminal-state.test.ts b/lib/src/lib/terminal-state.test.ts
index 194a0beb8..db0fc2a4e 100644
--- a/lib/src/lib/terminal-state.test.ts
+++ b/lib/src/lib/terminal-state.test.ts
@@ -336,6 +336,19 @@ describe('command title summarizer', () => {
     expect(summarizeCommandLine('cd lib && pnpm test')).toBe('cd lib ...');
     expect(summarizeCommandLine('"my command" "quoted arg"')).toBe('my command quoted arg');
   });
+
+  it('names a grouped command without its grouping, and keeps a substitution whole', () => {
+    expect(summarizeCommandLine('(cd web && pnpm dev)')).toBe('cd web ...');
+    expect(summarizeCommandLine('{ cd web; pnpm dev; }')).toBe('cd web ...');
+    expect(summarizeCommandLine('echo $(date +%s) a b')).toBe('echo $(date +%s) a');
+    expect(summarizeCommandLine('diff <(ls a) <(ls b) c')).toBe('diff <(ls a) <(ls b)');
+    expect(summarizeCommandLine('cat $(ls | head -1)')).toBe('cat $(ls | head -1)');
+  });
+
+  it('keeps a summary on one line when an argument spans several', () => {
+    expect(summarizeCommandLine('echo "one\ntwo"')).toBe('echo one two');
+    expect(summarizeCommandLine('echo $(\n  date\n)')).toBe('echo $( date )');
+  });
 });
 
 describe('WATCHING key', () => {
@@ -358,6 +371,15 @@ describe('WATCHING key', () => {
     // Grouping is lexical only.
     ['(cd web && pnpm dev)', 'pnpm dev'],
     ['{ cd web; pnpm dev; }', 'pnpm dev'],
+    ['( cd web ; pnpm dev )', 'pnpm dev'],
+    // A substitution's or an array's parentheses are not grouping.
+    ['echo $(date) && claude', 'claude'],
+    ['GH_TOKEN=$(gh auth token) claude', 'claude'],
+    ['x=$(cd a && pwd) claude', 'claude'],
+    ['claude $(cat prompt.txt)', 'claude'],
+    ['arr=(1 2); claude', 'claude'],
+    ['arr=(1 2) claude', 'claude'],
+    ['npm run "build(prod)"', 'npm build(prod)'],
     ['(cd web && pnpm dev) | tee log', 'pnpm dev'],
     // Transparent wrappers, with the flags they take.
     ['sudo make', 'make'],
diff --git a/lib/src/lib/terminal-state.ts b/lib/src/lib/terminal-state.ts
index 179048348..78a8efc08 100644
--- a/lib/src/lib/terminal-state.ts
+++ b/lib/src/lib/terminal-state.ts
@@ -369,32 +369,24 @@ export function summarizeCommandLine(raw: string): string {
   if (commandTokens.length === 0) return DEFAULT_COMMAND_TITLE;
 
   const hasPipeline = tokens.includes('|');
-  const hasCompound = tokens.some((token) => token === '&&' || token === '||' || token === ';');
+  // A lone `&` backgrounds the line, or leading it is PowerShell's call
+  // operator; neither makes a second command worth the ` ...`.
+  const hasCompound = tokens.some((token) => token !== '&' && LIST_SEPARATORS.has(token));
   const visibleTokens = commandTitleTokens(commandTokens);
   const suffix = hasPipeline ? ' | ...' : hasCompound ? ' ...' : '';
-  return truncateCommandTitle(`${visibleTokens.join(' ')}${suffix}`);
+  // One line, though a quoted argument or a substitution may span several.
+  return truncateCommandTitle(`${visibleTokens.join(' ')}${suffix}`.replace(/\s*\n\s*/g, ' '));
 }
 
 /**
- * The key WATCHING rules are stored under (`docs/specs/alert.md` -> WATCHING
- * Track): the program the line is really waiting on, as a bare name, or
- * `<runner> <script>` for a script runner. Returns null when the line holds no
- * runnable word. Every key it returns passes {@link isWatchKey}.
- *
- * - **The last command of a list** (`&&`, `||`, `;`, `&`, newline), since the
- *   earlier ones are set-up (`cd web && pnpm dev`, `clear; claude`), and **the
- *   first stage of its pipeline** (`claude | tee log`). Grouping parentheses and
- *   braces are dropped, so `(cd web && pnpm dev)` is `pnpm dev`; a group
- *   followed by more of the list keys on what follows it.
- * - **Transparent wrappers are skipped** with the flags they are known to take
- *   ({@link TRANSPARENT_WRAPPERS}), along with leading `VAR=value` words.
- * - **A launcher suffix is not part of the name** — see
- *   {@link commandProgramName}.
- * - **Runners key by script** ({@link SCRIPT_RUNNERS}); a script that could not
- *   be a key (a path, a quoted phrase) keys as the bare runner.
+ * The key WATCHING rules are stored under: the program a command line waits on,
+ * as a bare name or `<runner> <script>`, or null when the line holds no
+ * runnable word. Every key it returns passes {@link isWatchKey}. The rules that
+ * derive it are `docs/specs/alert.md` -> WATCHING Track.
  */
 export function commandWatchKey(raw: string): string | null {
-  const segments = splitCommandList(tokenizeCommand(raw.trim())).map(ungroupedWords);
+  const segments = splitCommandList(tokenizeCommand(raw.trim()))
+    .map((segment) => segment.filter((token) => !GROUPING_TOKENS.has(token)));
   const words = segments.reverse().find((segment) => segment.length > 0) ?? [];
   const pipe = words.indexOf('|');
   return watchKeyOfCommand(pipe === -1 ? words : words.slice(0, pipe));
@@ -912,7 +904,10 @@ function withRequiredHostPrefixes(
  * Split a command line into words, honoring quotes, POSIX backslash escapes,
  * and the pipeline/compound separators `| || && ; &`, which are emitted as
  * their own tokens. An unquoted newline separates commands like `;`, and a
- * backslash-newline continues the line.
+ * backslash-newline continues the line. An unquoted `(` or `)` is a token of its
+ * own too, except that a `$(…)` / `<(…)` / `>(…)` substitution or a `name=(…)`
+ * array stays inside its word, whitespace and separators included; `{` and `}`
+ * are grouping only as whole words, which the split already makes them.
  *
  * A `\` escapes exactly the `POSIX_ESCAPABLE` set (`foo\ bar` is one token,
  * `\*.ts` passes a literal glob, and a path Dormouse escaped for paste reads
@@ -931,6 +926,11 @@ function tokenizeCommand(input: string): string[] {
   let current = '';
   let quote: '"' | "'" | null = null;
   let escaping = false;
+  // Open parentheses of the substitution or array being read.
+  let wordParens = 0;
+  // Whether the last character was an unquoted, unescaped `$`, `<` or `>`,
+  // which makes a `(` right after it open a substitution.
+  let substitutionPrefix = false;
 
   const push = () => {
     if (!current) return;
@@ -940,6 +940,8 @@ function tokenizeCommand(input: string): string[] {
 
   for (let i = 0; i < input.length; i += 1) {
     const char = input[i];
+    const opensSubstitution = substitutionPrefix;
+    substitutionPrefix = false;
 
     if (escaping) {
       current += char;
@@ -968,6 +970,13 @@ function tokenizeCommand(input: string): string[] {
       quote = char;
       continue;
     }
+    // A substitution or array is one word, through the `)` closing its first `(`.
+    if (wordParens > 0 || (char === '(' && (opensSubstitution || ARRAY_ASSIGNMENT_PREFIX.test(current)))) {
+      if (char === '(') wordParens += 1;
+      else if (char === ')') wordParens -= 1;
+      current += char;
+      continue;
+    }
     if (char === '\n') {
       push();
       tokens.push(';');
@@ -977,6 +986,11 @@ function tokenizeCommand(input: string): string[] {
       push();
       continue;
     }
+    if (char === '(' || char === ')') {
+      push();
+      tokens.push(char);
+      continue;
+    }
     if (char === '&' && input[i + 1] === '&') {
       push();
       tokens.push('&&');
@@ -995,20 +1009,25 @@ function tokenizeCommand(input: string): string[] {
       continue;
     }
     current += char;
+    substitutionPrefix = char === '$' || char === '<' || char === '>';
   }
 
   push();
   return tokens;
 }
 
+/** A word that opens a `name=(…)` / `name+=(…)` array assignment at its `(`. */
+const ARRAY_ASSIGNMENT_PREFIX = /^[A-Za-z_][A-Za-z0-9_]*\+?=$/;
+
 function takePrimaryCommandTokens(tokens: string[]): string[] {
   // PowerShell's call operator. `& "C:\Program Files\nodejs\npm.cmd" run dev`
   // is the only way that shell runs a quoted program path, and a leading `&` is
   // never a POSIX background suffix, so drop it rather than read it as a
   // boundary that leaves no command at all.
   const words = tokens[0] === '&' ? tokens.slice(1) : tokens;
-  const firstBoundary = words.findIndex((token) => token === '|' || token === '&&' || token === '||' || token === ';' || token === '&');
-  const command = (firstBoundary === -1 ? words : words.slice(0, firstBoundary)).filter(Boolean);
+  const firstBoundary = words.findIndex((token) => token === '|' || LIST_SEPARATORS.has(token));
+  const command = (firstBoundary === -1 ? words : words.slice(0, firstBoundary))
+    .filter((token) => !GROUPING_TOKENS.has(token));
   let index = 0;
   while (isEnvAssignment(command[index])) index += 1;
   if (command[index] === 'env') {
@@ -1023,6 +1042,9 @@ function isEnvAssignment(token: string | undefined): boolean {
 }
 
 const LIST_SEPARATORS = new Set(['&&', '||', ';', '&']);
+/** The subshell and group operators `tokenizeCommand` emits; lexical only, so a
+ *  group's inner list is split like any other. */
+const GROUPING_TOKENS = new Set(['(', ')', '{', '}']);
 
 /** Tokens split into the commands of a list; a pipeline stays in one piece. */
 function splitCommandList(tokens: string[]): string[][] {
@@ -1034,34 +1056,28 @@ function splitCommandList(tokens: string[]): string[][] {
   return segments;
 }
 
-/** One list segment without the `(` / `{` / `)` / `}` of a subshell or group
- *  around it — lexical only, so a group's inner list is split like any other. */
-function ungroupedWords(segment: string[]): string[] {
-  return segment
-    .map((word, index) => (index === 0 ? word.replace(/^[({]+/, '') : word).replace(/\)+$/, ''))
-    .filter((word) => word !== '' && word !== '}');
-}
-
 interface FlagSpec {
-  /** Flags that take the next word as their value, or attached (`-uroot`, `--user=root`). */
+  /** Flags that take the next word as their value. */
   value?: readonly string[];
-  /** Flags that stand alone; single letters may cluster (`-di`). */
-  bool?: readonly string[];
-  /** A stand-alone flag shape not worth listing (nice's `-5`). */
-  boolPattern?: RegExp;
-  /** Value flags whose value is optional and numeric (make's `-j` / `-j 8`). */
-  numeric?: readonly string[];
   /** `VAR=value` words it accepts among its flags (`sudo FOO=1 make`). */
   assignments?: boolean;
 }
 
 interface WrapperSpec extends FlagSpec {
+  /** Flags that stand alone; single letters may cluster (`-di`). A `value` flag
+   *  may also carry its value attached (`-uroot`, `--user=root`). */
+  bool?: readonly string[];
+  /** A stand-alone flag shape not worth listing (nice's `-5`). */
+  boolPattern?: RegExp;
   /** Positional words before the command it runs (`timeout 5m make`). */
   operands?: number;
   /** The command is a package spec, whose `@version` is not part of the name. */
   packageSpec?: boolean;
 }
 
+const PNPM_DLX: WrapperSpec = { value: ['--package'], bool: ['-s', '--silent'], packageSpec: true };
+const BUN_X: WrapperSpec = { value: ['-p', '--package'], bool: ['--bun', '-y'], packageSpec: true };
+
 /**
  * Programs that run the command named after their own flags, keyed as one word
  * or as a launcher's two (`pnpm dlx`). Only the flags listed are understood: an
@@ -1087,16 +1103,18 @@ const TRANSPARENT_WRAPPERS: ReadonlyMap<string, WrapperSpec> = new Map(Object.en
   stdbuf: { value: ['-i', '--input', '-o', '--output', '-e', '--error'] },
   timeout: { value: ['-k', '--kill-after', '-s', '--signal'], bool: ['-v', '--verbose', '--foreground', '--preserve-status'], operands: 1 },
   npx: { value: ['-p', '--package'], bool: ['-y', '--yes', '--no', '-q', '--quiet'], packageSpec: true },
-  pnpx: { value: ['--package'], bool: ['-s', '--silent'], packageSpec: true },
-  bunx: { value: ['-p', '--package'], bool: ['--bun', '-y'], packageSpec: true },
+  pnpx: PNPM_DLX,
+  bunx: BUN_X,
   uvx: { value: ['--from', '--with', '-p', '--python'], bool: ['-q', '--quiet', '-v', '--verbose', '--isolated', '--offline'], packageSpec: true },
-  'pnpm dlx': { value: ['--package'], bool: ['-s', '--silent'], packageSpec: true },
+  'pnpm dlx': PNPM_DLX,
   'yarn dlx': { value: ['-p', '--package'], bool: ['-q', '--quiet'], packageSpec: true },
   'npm exec': { value: ['-p', '--package', '-w', '--workspace'], bool: ['-y', '--yes', '--no', '-q', '--quiet', '-ws', '--workspaces'], packageSpec: true },
-  'bun x': { value: ['-p', '--package'], bool: ['--bun', '-y'], packageSpec: true },
+  'bun x': BUN_X,
 } satisfies Record<string, WrapperSpec>));
 
 interface RunnerSpec extends FlagSpec {
+  /** Value flags whose value is optional and numeric (make's `-j` / `-j 8`). */
+  numeric?: readonly string[];
   /** A verb both spellings of a script share, dropped (`npm run test` is `npm test`). */
   drop?: readonly string[];
   /** A leading `+toolchain` word (`cargo +nightly build`). */
@@ -1122,30 +1140,29 @@ const SCRIPT_RUNNERS: ReadonlyMap<string, RunnerSpec> = new Map(Object.entries({
   just: { value: ['-f', '--justfile', '-d', '--working-directory', '--shell', '--dotenv-path', '--dotenv-filename', '--color'], assignments: true },
 } satisfies Record<string, RunnerSpec>));
 
-/** How many words a flag occupies under `spec`: 0 when it is not one it knows. */
-function flagWidth(words: readonly string[], index: number, spec: FlagSpec): number {
+/** How many words a wrapper flag occupies under `spec`: 0 when it is not one it knows. */
+function flagWidth(words: readonly string[], index: number, spec: WrapperSpec): number {
   const word = words[index]!;
   if (spec.bool?.includes(word) || spec.boolPattern?.test(word)) return 1;
   if (spec.value?.includes(word)) return 2;
-  if (spec.numeric?.includes(word)) return /^\d+(?:\.\d+)?$/.test(words[index + 1] ?? '') ? 2 : 1;
   const equals = word.indexOf('=');
   if (word.startsWith('--')) {
     const name = equals > 0 ? word.slice(0, equals) : null;
-    return name !== null && [spec.value, spec.bool, spec.numeric].some((list) => list?.includes(name)) ? 1 : 0;
+    return name !== null && [spec.value, spec.bool].some((list) => list?.includes(name)) ? 1 : 0;
   }
   if (word.length > 2) {
-    const short = word.slice(0, 2);
-    if (spec.value?.includes(short) || spec.numeric?.includes(short)) return 1;
+    if (spec.value?.includes(word.slice(0, 2))) return 1;
     if ([...word.slice(1)].every((letter) => spec.bool?.includes(`-${letter}`))) return 1;
   }
   return 0;
 }
 
 /**
- * The index of the command a wrapper at `index` runs, or null when `words`
- * holds no wrapper there, or one whose flags are not understood.
+ * Where the command a wrapper at `index` runs starts, and whether that command
+ * is a package spec; null when `words` holds no wrapper there, or one whose
+ * flags are not understood.
  */
-function wrappedCommandIndex(words: readonly string[], index: number): { index: number; spec: WrapperSpec } | null {
+function wrappedCommandIndex(words: readonly string[], index: number): { index: number; packageSpec: boolean } | null {
   const program = commandProgramName(words[index] ?? '');
   const launcher = TRANSPARENT_WRAPPERS.get(`${program} ${words[index + 1] ?? ''}`);
   const spec = launcher ?? TRANSPARENT_WRAPPERS.get(program);
@@ -1167,7 +1184,7 @@ function wrappedCommandIndex(words: readonly string[], index: number): { index:
     i += width;
   }
   i += spec.operands ?? 0;
-  return i < words.length ? { index: i, spec } : null;
+  return i < words.length ? { index: i, packageSpec: spec.packageSpec === true } : null;
 }
 
 /** One simple command's watch key: wrappers and assignments skipped, runners keyed by script. */
@@ -1178,8 +1195,7 @@ function watchKeyOfCommand(words: readonly string[]): string | null {
     while (isEnvAssignment(words[index])) index += 1;
     const wrapped = wrappedCommandIndex(words, index);
     if (!wrapped) break;
-    index = wrapped.index;
-    packageSpec = !!wrapped.spec.packageSpec;
+    ({ index, packageSpec } = wrapped);
   }
   let program = commandProgramName(words[index] ?? '');
   // `claude@latest`, but not a scope's leading `@`.
@@ -1200,7 +1216,9 @@ function runnerScript(words: readonly string[], from: number, spec: RunnerSpec):
   while (i < words.length) {
     const word = words[i]!;
     if (word.startsWith('-') && word !== '-') {
-      i += Math.max(1, flagWidth(words, i, spec));
+      // Any flag it does not list as taking a word stands alone.
+      const takesWord = spec.value?.includes(word) || (spec.numeric?.includes(word) && /^\d+(?:\.\d+)?$/.test(words[i + 1] ?? ''));
+      i += takesWord ? 2 : 1;
     } else if (spec.assignments && isEnvAssignment(word)) {
       i += 1;
     } else if (!dropped && spec.drop?.includes(word)) {
diff --git a/lib/src/lib/watched-commands.test.ts b/lib/src/lib/watched-commands.test.ts
index 40e08c4a5..5b304f452 100644
--- a/lib/src/lib/watched-commands.test.ts
+++ b/lib/src/lib/watched-commands.test.ts
@@ -9,20 +9,30 @@ vi.mock('./platform', () => ({
 
 import {
   applyWatchedCommandsFromHost,
-  commandWatchRule,
+  getRunningCommandWatchRule,
   getWatchedCommands,
-  isCommandWatched,
   publishWatchedCommands,
   setCommandWatched,
   subscribeToWatchedCommands,
 } from './watched-commands';
+import { applyTerminalSemanticEvents, removeTerminalPaneState } from './terminal-state-store';
+
+const PANE = 'watched-commands-pane';
 
 function clearRules(): void {
   for (const name of getWatchedCommands()) setCommandWatched(name, false);
 }
 
+function run(commandLine: string): void {
+  applyTerminalSemanticEvents(PANE, [
+    { type: 'commandLine', commandLine },
+    { type: 'commandStart', source: 'osc633_boundaries' },
+  ]);
+}
+
 afterEach(() => {
   clearRules();
+  removeTerminalPaneState(PANE);
   alertSetWatchedCommands.mockClear();
   alertSetCommandWatched.mockClear();
 });
@@ -74,26 +84,18 @@ describe('watched-commands store', () => {
     expect(getWatchedCommands()).toEqual(['cargo build', 'npm test:unit', 'pnpm', 'pnpm dev']);
   });
 
-  it('names the rule covering a running command, a bare runner covering its scripts', () => {
-    setCommandWatched('pnpm test', true);
-    expect(commandWatchRule('pnpm test')).toBe('pnpm test');
-    expect(commandWatchRule('pnpm dev')).toBeNull();
-    setCommandWatched('pnpm', true);
-    expect(commandWatchRule('pnpm dev')).toBe('pnpm');
-    expect(commandWatchRule(null)).toBeNull();
-  });
-
-  it('adds, reports, and removes rules', () => {
+  it('adds, reports, and removes the rule covering a running command', () => {
+    run('cd web && pnpm dev');
     expect(getWatchedCommands()).toEqual([]);
-    expect(isCommandWatched('claude')).toBe(false);
+    expect(getRunningCommandWatchRule(PANE)).toBeNull();
 
-    setCommandWatched('claude', true);
-    expect(getWatchedCommands()).toEqual(['claude']);
-    expect(isCommandWatched('claude')).toBe(true);
+    setCommandWatched('pnpm', true);
+    expect(getWatchedCommands()).toEqual(['pnpm']);
+    expect(getRunningCommandWatchRule(PANE)).toBe('pnpm');
 
-    setCommandWatched('claude', false);
+    setCommandWatched('pnpm', false);
     expect(getWatchedCommands()).toEqual([]);
-    expect(isCommandWatched('claude')).toBe(false);
+    expect(getRunningCommandWatchRule(PANE)).toBeNull();
   });
 
   it('keeps the rule set sorted and free of duplicates and blanks', () => {
@@ -105,11 +107,12 @@ describe('watched-commands store', () => {
     expect(getWatchedCommands()).toEqual(['claude', 'pnpm']);
   });
 
-  it('treats a null or empty name as unwatched', () => {
+  it('names no rule for a Session at a prompt or never seen', () => {
     setCommandWatched('claude', true);
-    expect(isCommandWatched(null)).toBe(false);
-    expect(isCommandWatched(undefined)).toBe(false);
-    expect(isCommandWatched('')).toBe(false);
+    expect(getRunningCommandWatchRule('no-such-pane')).toBeNull();
+    run('claude');
+    applyTerminalSemanticEvents(PANE, [{ type: 'commandFinish', exitCode: 0 }]);
+    expect(getRunningCommandWatchRule(PANE)).toBeNull();
   });
 
   it('sends mutations as deltas and offers the full rule set only as a startup seed', () => {
@@ -132,9 +135,11 @@ describe('watched-commands store', () => {
     setCommandWatched('npm', true);
     listener.mockClear();
 
+    run('claude');
     applyWatchedCommandsFromHost(['claude', 'npm', 'claude']);
 
     expect(getWatchedCommands()).toEqual(['claude', 'npm']);
+    expect(getRunningCommandWatchRule(PANE)).toBe('claude');
     expect(listener).toHaveBeenCalledTimes(1);
     expect(alertSetCommandWatched).toHaveBeenCalledTimes(1);
   });
diff --git a/lib/src/lib/watched-commands.ts b/lib/src/lib/watched-commands.ts
index fa95e691c..573113436 100644
--- a/lib/src/lib/watched-commands.ts
+++ b/lib/src/lib/watched-commands.ts
@@ -1,6 +1,7 @@
 import { loadJson, saveJson } from './local-json-store';
 import { getPlatform } from './platform';
 import { isWatchKey, watchRuleFor } from './terminal-state';
+import { getRunningCommandWatchKey } from './terminal-state-store';
 
 /**
  * The WATCHING rule set: the command keys (`commandWatchKey` output) whose
@@ -38,8 +39,16 @@ function normalize(names: string[]): string[] {
 }
 
 let watched: string[] = readStored();
+/** `watched` as the set `watchRuleFor` matches against, rebuilt with it. */
+let watchedSet = new Set(watched);
 const listeners = new Set<() => void>();
 
+function replaceWatched(next: string[]): void {
+  watched = next;
+  watchedSet = new Set(next);
+  saveJson(STORAGE_KEY, watched);
+}
+
 export function getWatchedCommands(): string[] {
   return watched;
 }
@@ -54,15 +63,11 @@ export function subscribeToWatchedCommands(listener: () => void): () => void {
   return () => listeners.delete(listener);
 }
 
-export function isCommandWatched(name: string | null | undefined): boolean {
-  if (!name) return false;
-  return watched.includes(name);
-}
-
-/** The rule covering a running command's `commandWatchKey`, or null — a bare
- *  runner rule covers every script of that runner. */
-export function commandWatchRule(key: string | null): string | null {
-  return watchRuleFor(new Set(watched), key);
+/** The rule covering the command Session `id` is running (`watchRuleFor` of
+ *  its `commandWatchKey`), or null — a bare runner rule covers every script of
+ *  that runner. */
+export function getRunningCommandWatchRule(id: string): string | null {
+  return watchRuleFor(watchedSet, getRunningCommandWatchKey(id));
 }
 
 export function setCommandWatched(name: string, on: boolean): void {
@@ -71,11 +76,10 @@ export function setCommandWatched(name: string, on: boolean): void {
   // on the next reload is never stored: it would otherwise match for the rest of
   // the session and then vanish with nothing on screen to explain it.
   if (!trimmed || !isWatchKey(trimmed)) return;
-  if (watched.includes(trimmed) === on) return;
-  watched = on
+  if (watchedSet.has(trimmed) === on) return;
+  replaceWatched(on
     ? [...watched, trimmed].sort()
-    : watched.filter((entry) => entry !== trimmed);
-  saveJson(STORAGE_KEY, watched);
+    : watched.filter((entry) => entry !== trimmed));
   getPlatform().alertSetCommandWatched(trimmed, on);
   listeners.forEach((listener) => listener());
 }
@@ -84,8 +88,7 @@ export function setCommandWatched(name: string, on: boolean): void {
 export function applyWatchedCommandsFromHost(names: string[]): void {
   const next = normalize(names);
   if (next.length === watched.length && next.every((name, index) => name === watched[index])) return;
-  watched = next;
-  saveJson(STORAGE_KEY, watched);
+  replaceWatched(next);
   listeners.forEach((listener) => listener());
 }
 
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index b33645654..09e9963f4 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -29,7 +29,7 @@
   "docs/specs/standalone.md": 11500,
   "docs/specs/terminal-context.md": 1050,
   "docs/specs/terminal-escapes.md": 3900,
-  "docs/specs/terminal-state.md": 2450,
+  "docs/specs/terminal-state.md": 2500,
   "docs/specs/theme.md": 2200,
   "docs/specs/tiling-engine.md": 4650,
   "docs/specs/transport.md": 5500,
diff --git a/standalone/sidecar/pty-core.js b/standalone/sidecar/pty-core.js
index 97410709a..80760005d 100644
--- a/standalone/sidecar/pty-core.js
+++ b/standalone/sidecar/pty-core.js
@@ -137,28 +137,22 @@ function withPrependedPath(env, dir, platform = process.platform) {
 
 // Another terminal's identity, inherited when the host was launched from it.
 // Dormouse is the pane's terminal now, and tools read these to decide what to
-// emit (docs/specs/terminal-escapes.md -> "iTerm2 identity"). A `*` entry is a
-// prefix. Names compare case-insensitively on win32, like its environment.
-const FOREIGN_TERMINAL_ENV = [
+// emit (docs/specs/terminal-escapes.md -> "iTerm2 identity"). Names match
+// case-insensitively on win32, like its environment.
+const FOREIGN_TERMINAL_ENV = new RegExp(`^(?:${[
   'VTE_VERSION', 'WT_SESSION', 'WT_PROFILE_ID', 'TERM_FEATURES', 'TERM_SESSION_ID',
-  'ITERM_SESSION_ID', 'ITERM_PROFILE', 'ConEmu*', 'KONSOLE_VERSION', 'KONSOLE_DBUS_SERVICE',
+  'ITERM_SESSION_ID', 'ITERM_PROFILE', 'ConEmu.*', 'KONSOLE_VERSION', 'KONSOLE_DBUS_SERVICE',
   'KONSOLE_DBUS_SESSION', 'KONSOLE_DBUS_WINDOW', 'PTYXIS_VERSION', 'KITTY_WINDOW_ID', 'KITTY_PID',
   'KITTY_PUBLIC_KEY', 'KITTY_INSTALLATION_DIR', 'GHOSTTY_RESOURCES_DIR', 'GHOSTTY_BIN_DIR',
-  'GHOSTTY_SHELL_FEATURES', 'WEZTERM_*', 'ALACRITTY_WINDOW_ID', 'ALACRITTY_SOCKET', 'ALACRITTY_LOG',
+  'GHOSTTY_SHELL_FEATURES', 'WEZTERM_.*', 'ALACRITTY_WINDOW_ID', 'ALACRITTY_SOCKET', 'ALACRITTY_LOG',
   'TERMINAL_EMULATOR', 'TERMINATOR_UUID', 'TILIX_ID', 'TMUX', 'TMUX_PANE', 'STY', 'COLORFGBG',
   'CURSOR_TRACE_ID',
-];
-
-function isForeignTerminalEnv(key, platform) {
-  const name = platform === 'win32' ? key.toUpperCase() : key;
-  return FOREIGN_TERMINAL_ENV.some((entry) => {
-    const pattern = platform === 'win32' ? entry.toUpperCase() : entry;
-    return pattern.endsWith('*') ? name.startsWith(pattern.slice(0, -1)) : name === pattern;
-  });
-}
+].join('|')})$`);
+const FOREIGN_TERMINAL_ENV_WIN32 = new RegExp(FOREIGN_TERMINAL_ENV.source, 'i');
 
-function withoutForeignTerminalEnv(env, platform = process.platform) {
-  return Object.fromEntries(Object.entries(env).filter(([key]) => !isForeignTerminalEnv(key, platform)));
+function withoutForeignTerminalEnv(env, platform) {
+  const foreign = platform === 'win32' ? FOREIGN_TERMINAL_ENV_WIN32 : FOREIGN_TERMINAL_ENV;
+  return Object.fromEntries(Object.entries(env).filter(([key]) => !foreign.test(key)));
 }
 
 function withoutInternalDormouseEnv(env) {
@@ -319,7 +313,7 @@ function resolveSpawnConfig(options, runtime = {}) {
   const { cols = 80, rows = 30, cwd: requestedCwd, shell: explicitShell, args: explicitArgs, surfaceId } = options || {};
   const platform = runtime.platform || process.platform;
   const env = {
-    ...withoutForeignTerminalEnv(runtime.env || process.env, platform),
+    ...(runtime.env || process.env),
     ...(options?.env || {}),
   };
   const osModule = runtime.osModule || os;
@@ -346,7 +340,7 @@ function resolveSpawnConfig(options, runtime = {}) {
     platform,
   );
   const childEnv = {
-    ...envWithCliPath,
+    ...withoutForeignTerminalEnv(envWithCliPath, platform),
     TERM_PROGRAM: 'iTerm.app',
     TERM_PROGRAM_VERSION: ITERM2_COMPAT_VERSION,
     LC_TERMINAL: 'iTerm2',
diff --git a/standalone/sidecar/shell-integration/bash/shellIntegration.bash b/standalone/sidecar/shell-integration/bash/shellIntegration.bash
index d0a3e75cb..af22f696f 100644
--- a/standalone/sidecar/shell-integration/bash/shellIntegration.bash
+++ b/standalone/sidecar/shell-integration/bash/shellIntegration.bash
@@ -88,23 +88,13 @@ __dormouse_633_prompt() {
   __dormouse_633_armed=1
 }
 
-# The submitted line, into __dormouse_633_out. $BASH_COMMAND is only the simple
-# command about to run (`cd web` of `cd web && pnpm dev`), so the line is read
-# back from history (one fork per line; HISTTIMEFORMAT is emptied inside it) and
-# used only when the last entry provably is this line, else $BASH_COMMAND stands:
-#  - History is on. Off, nothing is added, and 3.2 leaves the flag below stale.
-#  - `fc -l -1` stops one entry short of `history 1` exactly when bash's own
-#    flag says reading this line added an entry. No count taken at the prompt
-#    could stand in: erasedups renumbers, and HISTCMD is dead in traps before 5.1.
-#    A line that added nothing is still the last entry when neither ignorespace
-#    nor HISTIGNORE could have dropped it: ignoredups did, or the entry is a
-#    multi-line command's joined whole, whose flag covers its last line alone.
-#  - The entry contains $BASH_COMMAND, whitespace aside (bash re-renders it).
-#    This rejects a trap fired outside a fresh line (a hook appended after ours
-#    in PROMPT_COMMAND, a `bind -x` key on 3.2), which would re-report the
-#    previous line.
-# So an aliased first command, an entry spanning lines (a here-document), and a
-# repeat under ignoreboth fall back to $BASH_COMMAND.
+# The submitted line, into __dormouse_633_out: the last history entry (one fork;
+# HISTTIMEFORMAT emptied inside it) when that provably is this line, else
+# $BASH_COMMAND, only the simple command about to run. Provably: history is on;
+# `fc -l -1` stops one short of `history 1` (bash's own flag that this line
+# added an entry), or it added none and neither ignorespace nor HISTIGNORE
+# could be why; and the entry contains $BASH_COMMAND, whitespace aside. Why
+# each check: docs/specs/terminal-escapes.rationale.md -> Shell-integration injection.
 __dormouse_633_command_line() {
   __dormouse_633_out=$BASH_COMMAND
   [[ -o history ]] || return 0
@@ -135,11 +125,9 @@ __dormouse_633_preexec() {
   [ "$BASH_COMMAND" = "__dormouse_633_prompt" ] && return   # the PROMPT_COMMAND invocation itself
   [ -z "$__dormouse_633_armed" ] && return                 # inside PROMPT_COMMAND, or already fired this line
   [ -n "${COMP_LINE:-}" ] && return                        # tab-completion, not a submitted command
-  # A `bind -x` key (fzf's Ctrl-R/Ctrl-T) runs its command at the prompt, with
-  # READLINE_LINE bound for its duration from bash 4.0. Returning still armed
-  # lets the line the key leaves be reported when it is submitted. bash 3.2 binds
-  # nothing, so there the key still reads as a command, and its READLINE_LINE is
-  # an ordinary variable a widget may leave set, hence the version check.
+  # A `bind -x` key (fzf's Ctrl-R) runs with READLINE_LINE bound from bash 4.0;
+  # staying armed reports the line it leaves instead. 3.2 binds nothing (see
+  # docs/specs/terminal-escapes.rationale.md -> Shell-integration injection).
   [ -n "${READLINE_LINE+x}" ] && [ "${BASH_VERSINFO[0]}" -ge 4 ] && return
   __dormouse_633_armed=
   __dormouse_633_ran=1
diff --git a/website/src/lib/tut-detector.test.ts b/website/src/lib/tut-detector.test.ts
index b406a1eaa..ca6c3e855 100644
--- a/website/src/lib/tut-detector.test.ts
+++ b/website/src/lib/tut-detector.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from "vitest";
 import { DEFAULT_MOUSE_SELECTION_STATE, type MouseSelectionState } from "dormouse-lib/lib/mouse-selection";
 import type { ActivityState } from "dormouse-lib/lib/terminal-registry";
+import { watchRuleFor } from "dormouse-lib/lib/terminal-state";
 import { DESKTOP_SECTIONS } from "./tut-items";
 import { TutDetector } from "./tut-detector";
 import { TutorialState } from "./tutorial-state";
@@ -35,7 +36,7 @@ function makeDetectorHarness(initialActivitySnapshot = new Map<string, ActivityS
         };
       },
       getWatchedCommands: () => watchedCommands,
-      getRunningCommandWatchKey: (id) => runningCommands.get(id) ?? null,
+      getRunningCommandWatchRule: (id) => watchRuleFor(new Set(watchedCommands), runningCommands.get(id) ?? null),
       subscribeToWatchedCommands: (listener) => {
         watchedListener = listener;
         return () => {
@@ -189,7 +190,8 @@ describe("TutDetector", () => {
   });
 
   it("credits al-spreads only when a second pane lights up from the same rule", async () => {
-    const { state, setActivitySnapshot, setRunningCommand } = makeDetectorHarness();
+    const { state, setActivitySnapshot, setRunningCommand, setWatchedCommands } = makeDetectorHarness();
+    setWatchedCommands(["longtask"]);
     setRunningCommand("pane-a", "longtask");
     setRunningCommand("pane-b", "longtask");
 
@@ -213,8 +215,26 @@ describe("TutDetector", () => {
   });
 
 
+  it("credits al-spreads for two scripts one bare runner rule covers", async () => {
+    const { state, setActivitySnapshot, setRunningCommand, setWatchedCommands } = makeDetectorHarness();
+    setWatchedCommands(["pnpm"]);
+    setRunningCommand("pane-a", "pnpm dev");
+    setRunningCommand("pane-b", "pnpm test");
+    setActivitySnapshot(new Map([
+      ["pane-a", activity("NOTHING_TO_SHOW")],
+      ["pane-b", activity("WATCHING_DISABLED")],
+    ]));
+    setActivitySnapshot(new Map([
+      ["pane-a", activity("NOTHING_TO_SHOW")],
+      ["pane-b", activity("NOTHING_TO_SHOW")],
+    ]));
+    await Promise.resolve();
+    expect(state.isComplete("al-spreads")).toBe(true);
+  });
+
   it("does not credit different watched commands, including a command updated after Activity", async () => {
-    const { state, setActivitySnapshot, setRunningCommand } = makeDetectorHarness();
+    const { state, setActivitySnapshot, setRunningCommand, setWatchedCommands } = makeDetectorHarness();
+    setWatchedCommands(["longtask", "other-task"]);
     setRunningCommand("pane-a", "longtask");
     setRunningCommand("pane-b", "longtask");
     setActivitySnapshot(new Map([
@@ -232,7 +252,8 @@ describe("TutDetector", () => {
   });
 
   it("does not credit a queued spread after disposal", async () => {
-    const { state, detector, setActivitySnapshot, setRunningCommand } = makeDetectorHarness();
+    const { state, detector, setActivitySnapshot, setRunningCommand, setWatchedCommands } = makeDetectorHarness();
+    setWatchedCommands(["longtask"]);
     setRunningCommand("pane-a", "longtask");
     setRunningCommand("pane-b", "longtask");
     setActivitySnapshot(new Map([
diff --git a/website/src/lib/tut-detector.ts b/website/src/lib/tut-detector.ts
index dc2931957..228a02f6b 100644
--- a/website/src/lib/tut-detector.ts
+++ b/website/src/lib/tut-detector.ts
@@ -11,7 +11,7 @@ interface ActivityStoreModule {
   getActivitySnapshot: () => Map<string, ActivityState>;
   subscribeToWatchedCommands: (listener: () => void) => () => void;
   getWatchedCommands: () => string[];
-  getRunningCommandWatchKey: (id: string) => string | null;
+  getRunningCommandWatchRule: (id: string) => string | null;
 }
 
 /** Notification sources a program emits for itself, as opposed to the ones
@@ -264,16 +264,16 @@ export class TutDetector {
       this.spreadCheckQueued = false;
       if (this.pendingSpreadIds.size === 0) return;
       const snapshot = this.activityStore.getActivitySnapshot();
-      const commandCounts = new Map<string, number>();
+      const ruleCounts = new Map<string, number>();
       for (const [paneId, current] of snapshot) {
         if (!current.watchingEnabled) continue;
-        const command = this.activityStore.getRunningCommandWatchKey(paneId);
-        if (command) commandCounts.set(command, (commandCounts.get(command) ?? 0) + 1);
+        const rule = this.activityStore.getRunningCommandWatchRule(paneId);
+        if (rule) ruleCounts.set(rule, (ruleCounts.get(rule) ?? 0) + 1);
       }
       for (const paneId of this.pendingSpreadIds) {
         if (!snapshot.get(paneId)?.watchingEnabled) continue;
-        const command = this.activityStore.getRunningCommandWatchKey(paneId);
-        if (command && (commandCounts.get(command) ?? 0) > 1) {
+        const rule = this.activityStore.getRunningCommandWatchRule(paneId);
+        if (rule && (ruleCounts.get(rule) ?? 0) > 1) {
           this.state.markComplete("al-spreads");
           break;
         }

From cf2013e077fc78cb02eb55565385e03d71193914 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 23 Sep 2026 17:26:39 -0700
Subject: [PATCH 03/16] Give every alert one ring record with uniform TODO
 rules

- WATCHING, terminal reports and command exits are sources on one ring:
  every ring sets TODO when it opens, and an await, resumed work or rule
  removal takes back only the TODO and detail that ring set.
- Notification detail follows one richness order, so a bell never
  replaces an OSC 9 message or an exit code.
- A report about a state the user already acknowledged, with no output
  since, updates the TODO instead of summoning again.
- Progress is its own sub-state: updates never take a ring away, command
  boundaries end abandoned cycles silently, titles name the command.
- Deferral behind animation is capped at 30 s; the command-exit minimum
  runtime is its own constant; hosts apply one chunk's events in order.
- WATCHING detail is never persisted, so older builds keep restoring.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 docs/specs/alert.md                         | 127 +++--
 docs/specs/alert.rationale.md               |  32 +-
 docs/specs/terminal-escapes.md              |   4 +-
 docs/specs/tutorial.md                      |   6 +-
 docs/specs/tutorial.rationale.md            |   2 +-
 lib/src/cfg.ts                              |   4 +
 lib/src/lib/alert-manager.test.ts           | 364 +++++++++++--
 lib/src/lib/alert-manager.ts                | 557 +++++++++++---------
 lib/src/lib/alert-resumed-output.test.ts    |   5 +-
 lib/src/lib/alert-runtime-transfer.test.ts  |   2 +
 lib/src/lib/platform/fake-adapter.test.ts   |  12 +
 lib/src/lib/platform/fake-adapter.ts        |  10 +-
 lib/src/lib/platform/types.ts               |   1 -
 lib/src/lib/platform/vscode-adapter.ts      |   4 -
 lib/src/lib/reconnect.test.ts               |   1 -
 lib/src/lib/session-activity-store.ts       |   8 -
 lib/src/lib/session-restore.test.ts         |   1 -
 lib/src/lib/session-save.test.ts            |   1 -
 lib/src/lib/session-types.ts                |   4 +-
 lib/src/lib/terminal-protocol.test.ts       |  10 +
 lib/src/lib/terminal-protocol.ts            |  11 +-
 lib/src/lib/terminal-registry.alert.test.ts |  70 +--
 lib/src/lib/terminal-registry.ts            |   1 -
 lib/src/remote/client/remote-adapter.ts     |   1 -
 scripts/spec-word-budgets.json              |   2 +-
 standalone/src/browser-sidecar-adapter.ts   |   1 -
 standalone/src/tauri-adapter.ts             |   4 -
 vscode-ext/src/message-router.ts            |  21 +-
 vscode-ext/src/message-types.ts             |   1 -
 vscode-ext/test/message-router.test.ts      |  19 +
 website/src/lib/tut-detector.test.ts        |  14 +
 website/src/lib/tut-detector.ts             |  16 +-
 website/src/lib/tut-items.ts                |   2 +-
 website/src/lib/tut-runner.ts               |   7 +-
 34 files changed, 862 insertions(+), 463 deletions(-)

diff --git a/docs/specs/alert.md b/docs/specs/alert.md
index 2ea04de16..0bca533d0 100644
--- a/docs/specs/alert.md
+++ b/docs/specs/alert.md
@@ -2,21 +2,21 @@
 
 > See `docs/specs/glossary.md` for Session / Pane / Door vocabulary.
 >
-> Owns the Session Activity layer — the three alert tracks, attention, TODO, notification text and its sanitization, the two alarm sinks, and the Workspace union projection. `docs/specs/layout.md` defers here for all alert/TODO behavior.
+> Owns the Session Activity layer — the ring and its three sources, attention, TODO, notification text and its sanitization, the two alarm sinks, and the Workspace union projection. `docs/specs/layout.md` defers here for all alert/TODO behavior.
 >
 > Defers placement and sizing to `docs/specs/layout.md`, the alert-store relay messages (`alert:state` / `alert:settings` / `alert:watchedCommands`) to `docs/specs/transport.md`, and push sealing to `docs/specs/remote-security-model.md`; the `alert:await*` contract is stated here.
 
 **Must preserve Activity across minimize/reattach** (glossary I3). **A browser Surface has no Activity machine** — it can never ring, and carries only a user-set TODO flag, destroyed with that Surface.
 
-Dormouse can owe the user attention in three ways, each an independent track that runs IDLE -> busy/armed -> ringing without entangling the others and latches its own ring until cleared:
+Dormouse can owe the user attention in three ways. Each is a **source** of the Session's one **ring**, a latch held until cleared (Clearing And TODO):
 
-| Track | Rings when | State |
+| Source | Rings when | Detail |
 |---|---|---|
-| **WATCHING** | a watched command's output went busy, then quiet, unattended | `watchingRingingCommand`, `outputSinceWatchingRing` |
-| **Terminal report** | the PTY emitted `BEL`, `OSC 9`, `OSC 9;4`, `OSC 99`, or `OSC 777` | `protocolStatus`, `progress` |
-| **Command exit** | a command seen while attended kept running, attention was lost, and it exited after at least `T_USER_ATTENTION` | `commandExitStatus`, `commandExitWatch` |
+| `watching` (WATCHING Track) | a watched command's output went busy, then quiet, unattended | `WATCHING`: `<watch key> went quiet` |
+| `report` (Terminal reports) | the PTY emitted `BEL`, `OSC 9`, `OSC 99`, or `OSC 777`, or ended an `OSC 9;4` cycle | the sanitized report |
+| `exit` (Command-exit Track) | a command seen while attended kept running, attention was lost, and it exited after at least `cfg.alert.commandExitMinRuntime` | `COMMAND_EXIT` |
 
-The last two do not require WATCHING. **All three obey one suppression rule — never ring while the user is actively attending that Session** at the completion moment — applied at the single seam every completion passes through (Completion events). The output/silence detector (`QuiesceDetector`) is not a track: it is an always-on observer the WATCHING track reads.
+Only `watching` requires WATCHING. **Every source obeys one suppression rule — never ring while the user is actively attending that Session** at the completion moment — applied at the single seam every completion passes through (Completion events). The output/silence detector (`QuiesceDetector`) is not a source: it is an always-on observer WATCHING reads.
 
 ## Non-goals
 
@@ -30,21 +30,21 @@ The last two do not require WATCHING. **All three obey one suppression rule —
 
 Public `status` is a projection — first match wins:
 
-1. `ALERT_RINGING` if any of the three tracks is ringing.
-2. `OSC_NOTIF_BUSY` if protocol progress is active.
+1. `ALERT_RINGING` if the ring is active.
+2. `OSC_NOTIF_BUSY` if a progress cycle is active.
 3. The output/silence detector's own state if WATCHING is on. The detector runs regardless; the rule only makes its state public. **Never reorder 3 and 4** (rationale).
 4. `COMMAND_EXIT_ARMED` if command-exit alerting is armed.
 5. Otherwise `WATCHING_DISABLED`.
 
-**Must identify each uninterrupted ringing interval with an `episode` id and start time.** The first track to latch creates it; the last track clearing ends it. Additional track latches join the episode; they never start another delivery episode. **Never persist episodes.** Older host snapshots receive a renderer-local identity on their first ringing transition. Tests: `a second track latching mid-episode keeps the episode id` and `re-latching after all tracks clear starts a new episode` in `lib/src/lib/alert-manager.test.ts`.
+**Must identify each uninterrupted ringing interval with an `episode` id and start time.** Opening the ring creates it; the ring clearing ends it. A source joining an active ring joins its episode and never starts another delivery episode. **Never persist episodes.** Older host snapshots receive a renderer-local identity on their first ringing transition. Tests: `a second source joining mid-episode keeps the episode id` and `re-latching after the ring clears starts a new episode` in `lib/src/lib/alert-manager.test.ts`.
 
 `awaited` sits beside `status`: true while at least one `dor await` is parked on the Session (Await). It is derived from live waiters and **never persisted**.
 
-**Persist only** `todo` and the sanitized `notification` (plus `status` for diagnostics); restore replays those two and **must not** recreate a ring, protocol progress, or a command-exit arm. **WATCHING is never persisted per Session** — it is re-derived from the rule set below at the next command start. Replay filtering in `docs/specs/terminal-escapes.md` keeps old terminal output from firing notification side effects again.
+**Persist only** `todo` and the sanitized `notification` (plus `status` for diagnostics); restore replays those two and **must not** recreate a ring, a progress cycle, or a command-exit arm. **Never persist a `WATCHING` notification** — its TODO persists without detail (rationale). **WATCHING is never persisted per Session** — it is re-derived from the rule set below at the next command start. Replay filtering in `docs/specs/terminal-escapes.md` keeps old terminal output from firing notification side effects again.
 
 **Must retain host Activity before xterm initialization and clear it on Session disposal.** Test: `preserves pre-registration activity through terminal creation and orphaning` in `lib/src/lib/terminal-registry.alert.test.ts`.
 
-Source of truth: `AlertState` / `ActivityNotification` / `SessionStatus` in `lib/src/lib/alert-manager.ts`; `QuiesceStatus` in `lib/src/lib/quiesce-detector.ts`; `ActivityState` in `lib/src/lib/session-activity-store.ts`.
+Source of truth: `AlertState` / `ActivityNotification` / `SessionStatus` in `lib/src/lib/alert-manager.ts`; `QuiesceStatus` in `lib/src/lib/quiesce-detector.ts`; `ActivityState` in `lib/src/lib/session-activity-store.ts`; `toPersistedAlertState` in `lib/src/lib/session-types.ts`.
 
 ## Attention
 
@@ -54,7 +54,7 @@ Source of truth: `AlertState` / `ActivityNotification` / `SessionStatus` in `lib
 
 Attention is lost when the attention timer expires, the app loses focus, the attended Session is minimized or destroyed, or another Session becomes attended.
 
-`T_USER_ATTENTION` is the user-facing **inactivity timeout** (Alarm settings) and also the **minimum runtime for a command-exit ring** — a command shorter than the walk-away window was probably watched. It is instance state on the `AlertManager`, not a module constant, and both uses follow the configured value; changing it re-arms a live attention timer from that moment, so a shortened window applies immediately.
+`T_USER_ATTENTION` is the user-facing **inactivity timeout** (Alarm settings). It is instance state on the `AlertManager`, not a module constant; changing it re-arms a live attention timer from that moment, so a shortened window applies immediately.
 
 Source of truth: `cfg.alert` in `lib/src/cfg.ts`; `setInactivityTimeoutMs` in `lib/src/lib/alert-manager.ts`; `wireXtermHandlers` in `lib/src/lib/terminal-lifecycle.ts`, pinned by `lib/src/lib/terminal-registry.alert.test.ts`.
 
@@ -66,19 +66,20 @@ Claimants get first refusal per Session in registration order; the first to retu
 
 With `deferAlertsUntilQuiet` enabled:
 
-- **Must defer an eligible unattended terminal-notification ring while the private detector is fully armed** — `BUSY` or `MIGHT_NEED_ATTENTION`, including when WATCHING is off or another track masks that projection (rationale).
+- **Must defer an eligible unattended terminal-notification ring while the private detector is fully armed** — `BUSY` or `MIGHT_NEED_ATTENTION`, including when WATCHING is off or a progress cycle masks that projection (rationale).
 - **Never defer `MIGHT_BE_BUSY`, a detector settle, or a command-finish ring** — unconfirmed, already quiet, and authoritative respectively (rationale).
 - **Must fold a pending terminal notification into an eligible command-finish ring immediately**, so protocol detail enriches that ring instead of publishing stale later.
 - **Must defer after claimants and ring eligibility, never redispatch the historical `CompletionEvent`** (rationale).
 - **Keep pending intent live-only and bounded** to the latest protocol notification. Meaningful output moves its quiet deadline; command-boundary detector resets do not drop it.
-- **Cancel pending delivery on attendance, a dismissal that clears a ring, TODO changes, removal, seeding, or teardown.** A dismiss on a quiet Session keeps it: a cancelled deferral was never visible to dismiss. Disabling the setting releases it immediately; otherwise confirmed quiet latches the protocol track in one fresh ring, after which speech/push begin their own delays. Continuous output may defer forever.
+- **Cancel pending delivery on attendance, a dismissal that clears a ring, TODO changes, removal, seeding, or teardown.** A dismiss on a quiet Session keeps it: a cancelled deferral was never visible to dismiss. Disabling the setting releases it immediately; otherwise confirmed quiet raises one fresh ring, after which speech/push begin their own delays.
+- **Must ring a deferral by `cfg.alert.deferCeiling` (30 s) after the first notification deferred**, quiet or not; a latest-wins replacement keeps that start, and a live transfer carries it (rationale).
 
 Two ordering rules:
 
 - **Clear the progress cycle *before* dispatch**, so a completion or error ends the cycle whether or not the event is claimed and `OSC_NOTIF_BUSY` falls back either way.
 - **Dispatch a command finish for every watch that existed**, including the short, unarmed, and attended ones the ring rule then discards.
 
-Source of truth: `registerCompletionClaimant` / `dispatchCompletion` / `deferOrDeliverNotification` / `flushDeferredNotification` in `lib/src/lib/alert-manager.ts`; `quietAt` in `lib/src/lib/quiesce-detector.ts`.
+Source of truth: `registerCompletionClaimant` / `dispatchCompletion` / `deferOrDeliverNotification` / `scheduleDeferredNotification` / `flushDeferredNotification` in `lib/src/lib/alert-manager.ts`; `quietAt` in `lib/src/lib/quiesce-detector.ts`.
 
 ## Await
 
@@ -104,19 +105,19 @@ An **await** parks on one Session until it finishes what it is doing, then repor
 
 **`idle` is a resolution, not a failure** (rationale). Absent shell integration "is a command running" is unanswerable, so an `exit` await there falls back to the grace window and resolves `idle` rather than erroring.
 
-**Resolution consumes only the ring it resolved on**, its `cause` from *that ring's own source*: protocol → `bell`, command-exit → `exit`, WATCHING → `quiet`. An await arriving mid-ring resolves immediately; under `exit` only a command-exit ring counts and the await keeps waiting on the others. Two are gated:
+**Resolution consumes only the ring source it resolved on**, its `cause` from *that source*: `report` → `bell`, `exit` → `exit`, `watching` → `quiet`. An await arriving mid-ring resolves immediately; under `exit` only the `exit` source counts and the await keeps waiting on the others. Two are gated:
 
-- **Skip a command-exit ring while a foreground command is running** (rationale).
-- **Skip a WATCHING ring once output has resumed since it latched** (`outputSinceWatchingRing`), and **never stand the detector in for that flag** (rationale).
-- **Never skip the bell** — an `OSC 9` stays true until it is answered.
-- **Consuming releases that one track's latch and nothing else** — no `ActivityNotification` is dropped and `attentionId` is never set.
+- **Skip the `exit` source while a foreground command is running** (rationale).
+- **Skip the `watching` source once output has resumed since it joined the ring** (`outputSinceWatchingRing`), and **never stand the detector in for that flag** (rationale).
+- **Never skip a report** — an `OSC 9` stays true until it is answered.
+- **Consuming withdraws that one source and never sets `attentionId`**; a ring it leaves empty is withdrawn (Clearing And TODO).
 
 **Absorption: absorb the summons, keep the receipt.**
 
 - **A consumed completion never latches a ring** — no alarm treatment, no spoken alarm, no push; nothing quieter is substituted (rationale).
 - **Absorption is per-signal, not per-Session** — a human's own WATCHING rule on that Session still rings on the next settle.
 - **A failed await absorbs nothing.** A timeout, a death, or a cancel claims no completion, so a crashed orchestration cannot silently eat the human's signal.
-- **An await never sets TODO, and never clears a pre-existing one** (rationale).
+- **An await never leaves a TODO, and never clears a pre-existing one**, whether it parked before the report or after (rationale). Pinned by `leaves no TODO whether the report arrived before or after the await parked` in `lib/src/lib/alert-manager.test.ts`.
 - **Claiming is delivery.** Once handed to an await the wait is settled and a later `cancel()` is a no-op — no release-after-claim, so the claim-to-read window is unacknowledged (rationale).
 
 **Timing.** Every window derives from `cfg.alert`:
@@ -158,8 +159,8 @@ Rules:
 - **A rule covers a key it equals, and a bare runner rule covers every `<runner> <script>` key of that runner** (rationale). `watchRuleFor` is the one matcher, for WATCHING, rule-removal silencing, and the terminal context's row.
 - **Every command boundary resets the detector** — `commandStart`, `commandFinish`, `promptStart`, `promptEnd`, and PTY exit — even without a command watch. Pinned by `resets unwatched output history on %s without a command watch` in `lib/src/lib/alert-manager.test.ts`.
 - **Editing the rule set re-derives WATCHING across every live Session immediately**, so a mid-command enable shows what that command is doing *right now* rather than a fresh `NOTHING_TO_SHOW` (rationale).
-- **A WATCHING ring outlives the command that raised it.** Watching switches off when the watched command exits; its ring and originating command key remain in `watchingRingingCommand`.
-- **Removing a rule silences its WATCHING rings**, even after the command has exited, unless another rule still covers the command; other dismissal paths follow Clearing And TODO. A command merely ending never clears the ring.
+- **A WATCHING ring outlives the command that raised it.** Watching switches off when the watched command exits; the ring keeps its `watching` source and the originating key in `watchKey`.
+- **Removing a rule withdraws the `watching` source it raised**, even after the command has exited, unless another rule still covers `watchKey`; other clearing paths follow Clearing And TODO. A command merely ending never clears the ring.
 - **The rule set is app-global and persisted** (`dormouse:watched-commands`), starting empty, so WATCHING is off everywhere until the user turns it on. **The host is authoritative wherever one serves several webviews** — the VS Code extension host, and the standalone sidecar — so a stale webview can neither replace unrelated rules nor keep reporting an obsolete list: the first webview's persisted copy is taken as the seed, an edit is a delta, and the host broadcasts its canonical snapshot back. The seed/mutation/broadcast wire contract is `docs/specs/transport.md`.
 
 **Limitation:** WATCHING needs the shell to report its command line — `OSC 633 ; E`, or `cmdline_url` / `cmdline` on `OSC 133 ; C` (fish ≥ 4) — beside the boundaries. A shell reporting bare `OSC 133` boundaries, or none (`docs/specs/terminal-escapes.md`), never names a command, so WATCHING never engages and the terminal context reports `No command running`. Terminal reports still work; command-exit alerting also requires semantic command boundaries. **Never route the keystroke fallback in `docs/specs/terminal-state.md` into the `AlertManager`** (rationale).
@@ -178,73 +179,87 @@ Meaningful output excludes resize redraw noise during `T_RESIZE_DEBOUNCE`; theme
 - Output drives the detector up `NOTHING_TO_SHOW` -> `MIGHT_BE_BUSY` -> `BUSY`; silence drives it down `BUSY` -> `MIGHT_NEED_ATTENTION` -> settled. The `MIGHT_*` states are debounce windows in both directions.
 - First output starts candidate tracking without changing status; unconfirmed `MIGHT_BE_BUSY` returns to `NOTHING_TO_SHOW`.
 - **Must discard unconfirmed candidate history after an output gap beyond `busyCandidateGap + busyConfirmGap`, including when a timer runs late** (rationale). Pinned by `forgets stale candidate history` and `expires candidate history even when the confirmation timer has not run` in `lib/src/lib/quiesce-detector.test.ts`.
-- **The detector never holds `ALERT_RINGING`.** It reports each settle once and returns to `NOTHING_TO_SHOW`; rings latch in `watchingRingingCommand`.
-- **With `deferAlertsUntilQuiet`, withdraw a WATCHING ring when watched work resumes confirmed BUSY.** Preserve the detector, TODO, notification detail, and other tracks. The next unattended settle restarts speech/push delays. Short redraws and post-exit output retain the ring (rationale).
+- **The detector never holds `ALERT_RINGING`.** It reports each settle once and returns to `NOTHING_TO_SHOW`; the ring latches instead.
+- **With `deferAlertsUntilQuiet`, withdraw the `watching` source when watched work resumes confirmed BUSY.** Preserve the detector and other sources; a ring left empty is withdrawn (Clearing And TODO). The next unattended settle restarts speech/push delays. Short redraws and post-exit output retain the ring (rationale).
 - **A settle rings only if** a rule matches the foreground command *and* the Session lacks attention at the confirmation moment.
-- **Never reset the detector for attention alone**; settles must reach awaits. **Must reset to `NOTHING_TO_SHOW` when attending or dismissing a WATCHING ring**, preventing its output tail from settling again.
+- **Never reset the detector for attention alone**; settles must reach awaits. **Must reset to `NOTHING_TO_SHOW` when a user verb or an await clears a ring with a `watching` source**, preventing its output tail from settling again; resumed work and rule removal leave it running.
 - **Rings must be caused by a fresh transition** — a settle the detector just reported — never by rerender, theme change, remount, minimize, or reattach.
 
 Source of truth: `commandWatchKey` / `watchRuleFor` in `lib/src/lib/terminal-state.ts`; `QuiesceDetector` in `lib/src/lib/quiesce-detector.ts`; `onSettled` / `withdrawResumedWatchingRing` in `lib/src/lib/alert-manager.ts` (pinned by `lib/src/lib/alert-resumed-output.test.ts`); renderer mirror `lib/src/lib/watched-commands.ts`, multi-renderer coordinator `lib/src/lib/watched-command-host.ts`.
 
 ## Terminal reports
 
-**Terminal notifications are independent of WATCHING** and follow the deferral policy in Completion events. **Never ring an attended Session**; suppression leaves unrelated protocol progress alone. A ring sets `todo = true`, stores the latest sanitized `ActivityNotification`, and sets `protocolStatus = ALERT_RINGING`; clearing returns it to `IDLE` and public status falls back to the other tracks.
+**Terminal notifications are independent of WATCHING** and follow the deferral policy in Completion events. **Never ring an attended Session**; suppression leaves a progress cycle alone. A report raises the ring's `report` source (Clearing And TODO).
+
+**Must apply a parse batch's reports and command boundaries in stream order** (`applyTerminalEvents`), as the VS Code host and fake adapter do; standalone, receiving them as two events, still applies reports first. Pinned by `judges a notification written after a command finish against the reset detector` in `lib/src/lib/alert-manager.test.ts`.
 
 Sequence syntax lives in `docs/specs/terminal-escapes.md`; what each means here:
 
-- **Standalone `BEL`** — stripped from visible output and creates `TERMINAL_BELL_NOTIFICATION`. If the same parse batch also holds a richer OSC notification or progress event, **drop the generic bells** so they cannot overwrite useful preview text; multiple bells in one batch collapse to one notification.
+- **Standalone `BEL`** — stripped from visible output and creates `TERMINAL_BELL_NOTIFICATION`. **Drop the generic bells only beside a text-bearing notification in the same parse batch, never for a progress event** (rationale). Multiple bells in one batch collapse to one notification. Pinned by `keeps a bell that shares its batch with %s` in `lib/src/lib/terminal-protocol.test.ts`.
 - **`OSC 9`** — the message becomes the body, title null. Empty sanitized messages are ignored. It also feeds title-candidate derivation (`docs/specs/terminal-state.md`), with no alert effect. **A number, alone or before `;`, is a ConEmu subcommand** (`9;12`, a bare `9;9`) yielding neither notification nor title — except `9;4` below and `9;9;<cwd>` (`docs/specs/terminal-state.md`).
 - **`OSC 777`** — only the `notify` subcommand is supported; unsupported subcommands and empty sanitized notifications are ignored.
 - **`OSC 99`** (kitty) — chunked notifications keyed by `i`; completion rings once if the sanitized title or body is nonempty. **Management payloads (`p=?`, `p=close`, `p=alive`) contribute no content.** Incomplete chunk state is capped and expired.
-- **`OSC 9;4` progress** — progress only: no title, body, urgency, id, app name, or action fields.
+- **`OSC 9;4` progress** — progress only: no title, body, urgency, id, app name, or action fields. **A cycle is an independent sub-state: it never touches the ring, and the ring never touches it** (rationale).
 
   | Input | Behavior |
   |---|---|
-  | active normal / warning / indeterminate | `protocolStatus = OSC_NOTIF_BUSY`, no TODO; never rings from silence |
-  | `state=1, progress=100` | rings as completion, unattended only |
-  | `state=2` | rings as error, unattended only |
-  | clear | rings as completion only if a cycle was active, else ignored |
-  | completing a *warning* cycle | rings with a generated warning title |
+  | active normal / warning / indeterminate | starts or updates the cycle, no TODO; never rings from silence |
+  | `state=1, progress=100` | ends the cycle; a report completion |
+  | `state=2` | ends the cycle; a report error |
+  | clear | a report completion only if a cycle was active, else ignored |
+  | completing a *warning* cycle | a report completion with the warning title |
   | invalid state, missing percent for `1`/`4`, out-of-range percent | ignored |
-  | completion or error while attended | clears the progress, no TODO or ring |
+  | a command boundary — start, finish, prompt, PTY exit | ends the cycle silently |
+  | completion or error while attended | ends the cycle, no TODO or ring |
+
+  **Titles name the running command** (watch key, else display command): `<command> finished`, `… finished with a warning`, `… reported an error`; with none running, `Progress complete`, `Progress warning`, `Progress error`. The body is `Progress <percent>%`, or none.
 
-Source of truth: the OSC 777 and OSC 99 grammars, parsing, sanitization limits, and OSC 99 chunk state in `lib/src/lib/terminal-protocol.ts`; `completeProtocolProgress` / `finishProtocolProgressCycle` in `lib/src/lib/alert-manager.ts`.
+Source of truth: the OSC 777 and OSC 99 grammars, parsing, sanitization limits, and OSC 99 chunk state in `lib/src/lib/terminal-protocol.ts`; `updateProtocolProgress` / `finishProtocolProgressCycle` in `lib/src/lib/alert-manager.ts`. Pinned by `silently ends a progress cycle the program abandoned` and `names the running command in a progress %s title` in `lib/src/lib/alert-manager.test.ts`.
 
 ## Command-exit Track
 
-The command-exit track consumes normalized semantic command events from `docs/specs/terminal-state.md` (`OSC 133`, `OSC 633`, or equivalent) and **must not parse raw OSC itself**.
+Command-exit alerting consumes normalized semantic command events from `docs/specs/terminal-state.md` (`OSC 133`, `OSC 633`, or equivalent) and **must not parse raw OSC itself**.
 
 Rules:
 
 - A command start creates `commandExitWatch` for the current foreground command. **Mark the command as seen** if the Session has attention then, or if the user attends while it is already running.
 - If attention is later lost while that same seen command is still running, set `commandExitStatus = COMMAND_EXIT_ARMED`.
-- If the same command finishes, or the PTY exits before a finish event, **ring only when all three hold**: it was armed, the Session still lacks attention, and runtime is at least `T_USER_ATTENTION`.
-- A command-exit ring sets `todo = true` and stores the COMMAND_EXIT notification (title "Command finished", body = summarized command + exit code).
+- If the same command finishes, or the PTY exits before a finish event, **ring only when all three hold**: it was armed, the Session still lacks attention, and runtime is at least `cfg.alert.commandExitMinRuntime` (15 s). **Never tie that minimum to the inactivity timeout** (rationale).
+- The `exit` source carries the `COMMAND_EXIT` notification (title "Command finished", body = summarized command + exit code).
 - Returning to the Session before finish disarms the watch. A quick finish, a different command start, or Session destruction clears it without ringing.
 - **Race rule:** attention must be lost before the finish event is observed.
-- **Precedence rule:** a protocol ring keeps its richer `ActivityNotification`; command-exit must not overwrite it.
 
-Command starts and finishes also drive the WATCHING rule above, so the two tracks share one `commandExitWatch` record and one `resolveCommandStart` helper with the terminal-state reducer.
+Command starts and finishes also drive the WATCHING rule above, so both sources share one `commandExitWatch` record and one `resolveCommandStart` helper with the terminal-state reducer.
 
-Source of truth: `applyCommandExitRinging` / `formatCommandExitBody` in `lib/src/lib/alert-manager.ts`; `resolveCommandStart` in `lib/src/lib/terminal-state.ts`.
+Source of truth: `dispatchCompletion` / `formatCommandExitBody` in `lib/src/lib/alert-manager.ts`; `resolveCommandStart` in `lib/src/lib/terminal-state.ts`.
 
 ## Clearing And TODO
 
-`todo` is a boolean reminder. Protocol and command-exit rings create it immediately. **WATCHING rings create it when the user attends, dismisses, or marks TODO**, so a dismissed ring does not disappear without a trace.
+`todo` is a boolean reminder. **Every ring sets it the moment it opens, whatever its source**, recording whether it did and which notification it replaced (rationale). Pinned by `a %s ring sets TODO the moment it opens` in `lib/src/lib/alert-manager.test.ts`.
 
-Clearing behavior:
+**Detail follows one richness order:** a text report (`OSC 9`, `OSC 99`, `OSC 777`) > `COMMAND_EXIT` > `OSC 9;4` > `WATCHING` > `BEL`. A new ring shows its own detail; a source joining an active ring replaces the shown detail only at an equal or higher rank, so the latest wins among equals (rationale).
 
-- Attending a ringing Session clears active rings on all three tracks and sets `todo = true`.
-- Dismissing the ring from the alert button or `a` (Pane Header) sets `todo = true` and opens the terminal context. **Dismissing a Session with nothing ringing changes nothing and notifies no one.**
-- Marking TODO clears any active ring and leaves the WATCHING rule in place for future cycles.
-- **Must clear notification and active rings when clearing TODO, even if `todo` is already false.** Pinned by `clears a WATCHING ring before it has created a TODO` in `lib/src/lib/alert-manager.test.ts`.
-- Passthrough `Enter` typed into the Session clears TODO. Command-mode `Enter` that only enters passthrough does not.
-- Removing a WATCHING rule turns watching off wherever it matched and silences the WATCHING rings it raised. It does not stop the detector, nor clear protocol progress, command-exit arms, TODO, or notification detail.
-- Destroying the Session clears all alert, TODO, notification, attention, protocol, and command-exit state.
+| Verb | Effect |
+|---|---|
+| attend (Attention) | clears the ring; `todo` stays |
+| dismiss (`a`, Pane Header) | clears the ring; `todo` stays. **With nothing ringing: no change, no notify, a deferred notification kept** |
+| toggle TODO (`t`) | clears the ring; `todo` flips, off dropping the notification |
+| clear TODO (pill click, passthrough `Enter`) | clears the ring and a deferred notification; `todo` off, notification dropped, even if already off |
+| an await consumes a source (Await) | withdraws that source |
+| watched work resumes (WATCHING Track) | withdraws `watching` |
+| a rule stops covering the ring's `watchKey` | withdraws `watching` |
+
+- **The four user verbs acknowledge; a withdrawal never does.** A ring a withdrawal empties takes back the TODO it set, never one it found, and the notification it replaced.
+- **Never summon twice for an acknowledged state.** After a user verb clears a ring, a report arriving before any output opens no ring: it sets `todo`, takes the notification by the richness order, and publishes. Settles and exits ring as usual, and opening a ring forgets the acknowledgement (rationale). Pinned by `a report about a state acknowledged by %s updates the TODO without summoning again` in `lib/src/lib/alert-manager.test.ts`.
+- Command-mode `Enter` that only enters passthrough does not clear TODO.
+- Removing a WATCHING rule turns watching off wherever it matched. It does not stop the detector, nor clear a progress cycle or a command-exit arm.
+- Destroying the Session clears all alert, TODO, notification, attention, progress, and command-exit state.
+
+Source of truth: `raiseRing` / `withdrawRingSource` / `clearRingForUser` in `lib/src/lib/alert-manager.ts`.
 
 ## Live Workspace transfer
 
-- **Must transfer live alert state separately from persisted reminders:** track latches, episode, command watch, deferred notification, and detector history/deadlines travel in the marked transfer content. **Never read this content on cold restore.**
+- **Must transfer live alert state separately from persisted reminders:** the ring and its episode, the progress cycle, the acknowledgement, command watch, deferred notification with its start, and detector history/deadlines travel in the marked transfer content. **Never read this content on cold restore.**
 - **Must suspend source delivery before handing ownership to the host**, freezing its detector, rule walk, and controls at content capture, and **must await host hand-back when source content capture fails**, holding that suspension until routing returns. The destination restores receipts after persisted seeding and before the runtime publishes, and enables delivery only after `adopt_done` succeeds; refusal restores the source runtime and its pending deadlines. Transaction order is `docs/specs/standalone.md` → "Arrival queue".
 - **Must discard imported runtime, Activity, and pane state before releasing the delivery guards on any target failure**, mount or no mount, so a watcher never re-arms on a Workspace this window never owned. A receipt forgotten on an episode already observed is consumed, never fresh.
 - **Must carry per-sink receipts with the episode:** pending/queued work retains its original deadline; engine-admitted speech and dispatched push are consumed and never replayed. Suspending cuts current speech; a partially heard utterance is not restarted after a move or refusal.
@@ -259,7 +274,7 @@ Application alarm defaults live beside the WATCHING rule set, edited in **Settin
 
 | Field | Meaning |
 |---|---|
-| `inactivityTimeoutMs` | `T_USER_ATTENTION` — the walk-away window defined under Attention. |
+| `inactivityTimeoutMs` | `T_USER_ATTENTION` — the walk-away window defined under Attention, and nothing else. |
 | `deferAlertsUntilQuiet` | Gates animation deferral (Completion events) and resumed-ring withdrawal (WATCHING Track). Default on. (rationale) |
 | `speakEnabled` / `speakDelayMs` | Spoken alarms, below. |
 | `pushEnabled` / `pushDelayMs` | Push notifications, below. |
@@ -385,7 +400,7 @@ The TODO pill always displays `TODO`; remote notification text belongs in previe
 
 **Must wear the alarm treatment on every ringing terminal Pane**, labelled only once the speech sink acts. **Must bound the unlabelled pulse to one finite burst per episode, never replayed by a remount; `SPEAKING` pulses for its utterance, `SPOKEN` never** (rationale). **`prefers-reduced-motion` keeps the strong static treatment and suppresses only the pulse**, as does `cfg.alert.ringingPaused` (rationale). The three rows, their layers, strengths, and sizing are inventoried by `docs/specs/layout.md` → Alarm overlay.
 
-Source of truth: `openEpisode` in `lib/src/lib/alert-manager.ts`; `dismissSessionAlert` in `lib/src/lib/session-activity-store.ts`; `TerminalContext` in `lib/src/components/wall/TerminalContext.tsx`; `lib/src/components/TodoPillBody.tsx`; `AlertRingIndicator` in `lib/src/components/wall/AlertRingIndicator.tsx`; `alertRingRow`, `useAlertRingBurst`, `AlertRingInset` in `lib/src/components/alert-ring.tsx`.
+Source of truth: `raiseRing` in `lib/src/lib/alert-manager.ts`; `dismissSessionAlert` in `lib/src/lib/session-activity-store.ts`; `TerminalContext` in `lib/src/components/wall/TerminalContext.tsx`; `lib/src/components/TodoPillBody.tsx`; `AlertRingIndicator` in `lib/src/components/wall/AlertRingIndicator.tsx`; `alertRingRow`, `useAlertRingBurst`, `AlertRingInset` in `lib/src/components/alert-ring.tsx`.
 
 ### Door
 
@@ -404,7 +419,7 @@ Click or `Enter` on a Door reattaches into passthrough and clears a ring; `d` re
 Notification text is untrusted terminal output.
 
 - Treat all text as plain text: never interpret ANSI, OSC, HTML, Markdown, URLs, paths, or emoji shortcodes as markup.
-- **Sanitize at protocol-parse time** (`sanitizeText` in `lib/src/lib/terminal-protocol.ts`), bounded and control-stripped like every retained value (`docs/specs/terminal-escapes.md` → Parsing location); every notification stored from a live PTY has been through that pass. `normalizeActivityNotification` in `lib/src/lib/alert-manager.ts` is only a *shape* check on top — known `source`, string-or-null fields, trimmed, at least one non-empty — so the cold-restore path (`seed`) re-accepts a persisted blob without re-applying the cap or the control strip (rationale).
+- **Sanitize at protocol-parse time** (`sanitizeText` in `lib/src/lib/terminal-protocol.ts`), bounded and control-stripped like every retained value (`docs/specs/terminal-escapes.md` → Parsing location); every notification stored from a live PTY has been through that pass, generated `WATCHING` and progress titles included via the sanitized command line. `normalizeActivityNotification` in `lib/src/lib/alert-manager.ts` is only a *shape* check on top — known `source`, string-or-null fields, trimmed, at least one non-empty — so the cold-restore path (`seed`) re-accepts a persisted blob without re-applying the cap or the control strip (rationale).
 - Keep only the latest `ActivityNotification` rather than unbounded history, and cap/expire incomplete OSC 99 parser state.
 - **Never** execute commands, open URLs, copy to clipboard, read files, focus outside Dormouse, or render protocol-supplied icons/buttons/actions.
 - Wherever notification text appears in visible UI or accessible labels, it is plain text, and layout must tolerate long text, CJK, RTL, combining marks, and emoji without pushing fixed controls out of bounds. Sanitized terminal-supplied `OSC 0` / `OSC 2` / `OSC 9` text also participates in normal Pane-label derivation, and that label may reach the opt-in speech and push channels — **each after its own second pass**, because a label safe to *render* is not automatically safe to hand a speech engine or an OS notification, and those two fail in different ways. See `toSpokenText` under Spoken alarms and `toPushText` under Push notifications.
diff --git a/docs/specs/alert.rationale.md b/docs/specs/alert.rationale.md
index d90887ac2..29290cdda 100644
--- a/docs/specs/alert.rationale.md
+++ b/docs/specs/alert.rationale.md
@@ -4,6 +4,10 @@
 
 ## Public State
 
+**Why one ring instead of three tracks.** Each track stored its ring differently and doubled as other state: the protocol ring shared `protocolStatus` with progress, the command-exit ring shared `commandExitStatus` with the arm, and WATCHING kept a command key. Every clearing verb, await, and restart then treated them differently — the TODO asymmetries under Clearing And TODO, progress un-ringing a report, a bell overwriting an exit code (audit, 2026-09-23). One latch with a list of sources gives every rule one place to act.
+
+**Why a `WATCHING` notification is never persisted.** Builds before that source validate every persisted pane's notification against their own source list, and one unknown source rejects the whole session, not just the detail (`isPersistedSessionV3`). A development build and an installed one share one session file, so persisting it would empty the older build's restore. The TODO survives; only the generated `<key> went quiet` detail stays live.
+
 **Why the detector outranks the command-exit arm.** A watched command is by definition running, so a WATCHING Session is almost always also command-exit armed; ranking the arm first would mask the detector's busy/quiet states for the whole run, and the detector's state is the one derived from real output.
 
 ## Attention
@@ -18,6 +22,8 @@
 
 **Why command finishes bypass animation deferral.** A shell-reported exit is a lifecycle event; animation detection is only a recent-output heuristic. Letting the heuristic overrule the event would add latency and let unrelated background output defer a certain completion indefinitely.
 
+**Why deferral has a ceiling.** Unbounded, it held an `OSC 9` behind any output that never went quiet for five seconds: a `watch -n1` pane redrawing once a second, or a dev server's heartbeat line every three seconds after its startup burst, deferred it indefinitely (audit probes, 2026-09-23). Thirty seconds is far past an agent's final spinner frames, which deferral exists to wait out, and short enough that a report behind a ticking clock still reaches its user.
+
 **Why a deferred event is not dispatched again.** Claimants already had first refusal when the completion happened; re-offering it at quiet time would let a later-registered await consume history, and would report one completion twice.
 
 ## Await
@@ -36,7 +42,7 @@
 
 **Why a WATCHING ring is gated on `outputSinceWatchingRing`.** The ring legitimately describes a long-running watched command going quiet — what `--until quiet` exists for — but it is an inference from silence, and a brief burst does not clear it when the peer starts talking again; consuming it mid-turn would make the documented `await && read` idiom read a half-drawn screen. The detector cannot stand in for the flag because it never latches: it reports how output looks *now*, and its post-output `NOTHING_TO_SHOW` window (`busyCandidateGap`) is longer than the two CLI round trips between a `dor send` and the await behind it, so it would still read as settled.
 
-**Why an await never sets TODO.** TODO means a human owes this pane attention; after an await nobody does — a program asked to be told, was told, and acted. A stranded TODO also leaks: the last await of an orchestration would mark a fully handled event, and because TODO feeds the Workspace union, an orchestration awaiting across several panes would light the whole Workspace up. A TODO from an *unrelated* earlier event is a different debt and stays owed.
+**Why an await never leaves a TODO.** TODO means a human owes this pane attention; after an await nobody does — a program asked to be told, was told, and acted. A stranded TODO also leaks: the last await of an orchestration would mark a fully handled event, and because TODO feeds the Workspace union, an orchestration awaiting across several panes would light the whole Workspace up. Before rings set TODO uniformly, the answer depended on a race: a report claimed by an await parked first left nothing, while the same report landing a moment before the await stranded its TODO (audit, 2026-09-23). Withdrawal now takes back the TODO the ring set, so both orders agree. A TODO from an *unrelated* earlier event is a different debt and stays owed.
 
 **Why nothing quieter is substituted for the absorbed ring.** A receipt the human must clear by hand is the same noise in a smaller font, and forensics after a failure come from the pane's own scrollback anyway.
 
@@ -66,9 +72,29 @@
 
 **Why resumed work withdraws an inferred WATCHING ring.** The marked `ttr.pgstencil-adopt` speech (2026-09-09 18:17:03) followed a WATCHING settle, resumed output, and confirmed BUSY before the speech deadline; the latched ring masked that activity, so the renderer spoke while the terminal was still animating. Withdrawing the ring lets the existing sink cancellation and fresh-ring delays follow the new busy/quiet cycle. Only the inference goes: explicit reports and command exits stay authoritative, and a redraw too brief to confirm BUSY never invalidates completion.
 
+## Terminal reports
+
+**Why progress is independent of the ring.** Progress and the report ring shared one field: an active `9;4` update while a report rang silently un-rang it, ending the episode and restarting speech and push, and a ring nulled the cycle, so the cycle's own end never rang. A cycle the program abandoned — a build killed with `Ctrl-C` — left the Session at `OSC_NOTIF_BUSY` forever, and the next program's defensive `9;4;0` then rang a phantom `Progress complete 40%` (audit, 2026-09-23). A command boundary is the one point where a cycle certainly belongs to a dead run.
+
+**Why a progress event no longer drops a bell.** A mid-cycle update or a clear that ends no cycle summons nobody, so dropping the batch's lone `BEL` beside one lost the only ring (audit, 2026-09-23). Richness now decides detail for the batches that do both ring.
+
+**Why the titles name the command.** The generic `Progress complete` said nothing about which run finished; the watch key is the name the user already knows the pane by, and the watch record is live exactly while a cycle can end.
+
+## Command-exit Track
+
+**Why the minimum runtime is not the inactivity timeout.** The two answer different questions — how long "looking at this pane" lasts, and how short a run the user probably watched. Shared, a user who shortened the timeout to three seconds was rung for every four-second `git status` they turned away from, and one who lengthened it lost exit alerts for every build shorter than the new window (2026-09-23).
+
+## Clearing And TODO
+
+**Why every ring sets TODO when it opens.** WATCHING rings used to create TODO only when attended or dismissed, while report and exit rings created it at once. Every verb then diverged by source: `t` on a ringing WATCHING pane turned TODO on and on a report ring turned it off; an `Enter` as the first key kept one and cleared the other; a restart dropped an unattended WATCHING ring without trace while a report ring came back as TODO (audit, 2026-09-23). Setting it at ring time makes the verbs identical. Recording whether the ring set it lets a withdrawal take back only its own TODO.
+
+**Why detail goes by richness.** The last writer used to win, with one special case keeping a report's text over an exit: an `OSC 9` reading `Build finished: 3 warnings` followed by a bell in the next PTY read showed `Terminal bell`, and `make; printf '\a'` showed `Terminal bell` over `make exited 2` (audit, 2026-09-23). One order covers every pair; equal ranks still take the newer text.
+
+**Why an acknowledged state is not summoned again.** Claude Code sends an idle notification about a minute after a turn ends unless it saw input (captured from Claude Code 2.1, 2026-09-23). A user who acknowledged the WATCHING ring with a click, `a`, or a Door was summoned a second time, in a second episode, for the same completion. Output since the acknowledgement is the evidence that something new happened; settles and command exits are fresh by construction, so only reports are held to it.
+
 ## Alarm settings
 
-**Why animation deferral defaults on.** Coding agents (`claude`, `codex`) send their notification OSC while their TUI is still redrawing its spinner, so an undeferred ring summons the user to a pane that is still animating (2026-09). The gate engages only while the private detector is fully armed, so a BEL from an otherwise quiet shell still rings at once. Deferral is unbounded, so continuous output can hold a ring indefinitely; turning the switch off is the escape hatch that restores the protocols' literal timing. Installs that saved any settings blob keep the old value: the blob has no version field, and a persisted `false` cannot be told from a deliberate opt-out, so dropping it on read would leave the off position unpersistable.
+**Why animation deferral defaults on.** Coding agents (`claude`, `codex`) send their notification OSC while their TUI is still redrawing its spinner, so an undeferred ring summons the user to a pane that is still animating (2026-09). The gate engages only while the private detector is fully armed, so a BEL from an otherwise quiet shell still rings at once. The deferral ceiling bounds the wait (Completion events); turning the switch off restores the protocols' literal timing. Installs that saved any settings blob keep the old value: the blob has no version field, and a persisted `false` cannot be told from a deliberate opt-out, so dropping it on read would leave the off position unpersistable.
 
 **Why the settings ride the WATCHING rule set's seed/broadcast shape.** Each VS Code webview has its own origin and therefore its own `localStorage`, while the `AlertManager` is shared; without a host-authoritative copy, two webviews would each believe their own blob. The one difference is the whole-blob relay: an alarm setting is not a set of independent keys the way a rule list is.
 
@@ -116,7 +142,7 @@ Guarding only completion leaves a stale `start` free to replace the active utter
 
 **Why `cfg.alert.ringingPaused` suppresses the pulse.** It is the visual-snapshot freeze that pins the alarm; even a bounded animation could otherwise snapshot at an arbitrary phase during its first 2.6 seconds.
 
-**Why the unlabelled treatment pulses once per episode.** An infinite per-Session animation is expensive, and the whole-Pane treatment covers far more surface than the retired bell icon did. With four focused panes wearing an infinite animation, three minutes cost 6.89 MB of embedder memory, 1,127 style recalculations, and 3.99 seconds of renderer CPU; pausing only those animations in the same loaded document reduced that to 0.13 MB, two recalculations, and 0.025 seconds. After bounding the burst, two consecutive three-minute windows each had zero live animations, one recalculation, under 0.40 MB of non-cumulative embedder drift, and at most 0.024 seconds of renderer CPU (measured in Chrome 150, 2026-09). A handful of cycles preserves the entry cue without leaving an animation running for the lifetime of an unattended alert. The episode — not a track latch — is the key because the episode is the summons the sinks already work from: a second track latching inside one enriches an alarm the user was already shown, and re-flashing the whole Pane for it would read as a new alarm. Running the burst off `episode.startedAt` rather than from mount makes the CSS clock a property of the episode, so minimize → reattach or a Workspace switch lands past an expired burst instead of replaying it. A Session BEL-ing in a loop still cannot restart the burst, because a track that is already latched does not re-latch.
+**Why the unlabelled treatment pulses once per episode.** An infinite per-Session animation is expensive, and the whole-Pane treatment covers far more surface than the retired bell icon did. With four focused panes wearing an infinite animation, three minutes cost 6.89 MB of embedder memory, 1,127 style recalculations, and 3.99 seconds of renderer CPU; pausing only those animations in the same loaded document reduced that to 0.13 MB, two recalculations, and 0.025 seconds. After bounding the burst, two consecutive three-minute windows each had zero live animations, one recalculation, under 0.40 MB of non-cumulative embedder drift, and at most 0.024 seconds of renderer CPU (measured in Chrome 150, 2026-09). A handful of cycles preserves the entry cue without leaving an animation running for the lifetime of an unattended alert. The episode — not a ring source — is the key because the episode is the summons the sinks already work from: a second source joining the ring enriches an alarm the user was already shown, and re-flashing the whole Pane for it would read as a new alarm. Running the burst off `episode.startedAt` rather than from mount makes the CSS clock a property of the episode, so minimize → reattach or a Workspace switch lands past an expired burst instead of replaying it. A Session BEL-ing in a loop still cannot restart the burst, because a source joining an active ring does not open a new one.
 
 ## Text And Security
 
diff --git a/docs/specs/terminal-escapes.md b/docs/specs/terminal-escapes.md
index 68f7e19df..c9319b3fb 100644
--- a/docs/specs/terminal-escapes.md
+++ b/docs/specs/terminal-escapes.md
@@ -36,7 +36,7 @@ Source of truth: `oscDispositionAt` in `lib/src/lib/terminal-protocol.ts`, `boun
 
 **Supported semantic sequences are consumed and never re-emitted** — empty or unparseable payloads, unrecognized `OSC 1337` subcommands and `OSC 50` / `OSC 52` included. **`OSC 8` and the recognized ImageAddon `OSC 1337` forms are the exceptions**: they stay in `pty:data` so xterm.js owns hyperlink regions and inline graphics. Dormouse supplies only the hyperlink activation-confirmation handler. Every other OSC family passes through unchanged, so xterm.js handles standard behavior Dormouse does not model.
 
-**`textData` is the same chunk with every string-control payload removed**, for consumers reading output as text; every other control is left for `stripTerminalControls`. The webview receives them apart: `pty:data` (the stripped output; feeds xterm.js) and `terminal:semanticEvents` (normalized CWD / prompt-command / title events; feeds `TerminalPaneState`, command boundaries also feeding the command-exit alert track in [alert.md](alert.md#command-exit-track)). **Notification-derived state never travels as `pty:data`**: it reaches whichever process holds the `AlertManager` — direct calls in VS Code, `terminal:protocolEvents` in standalone.
+**`textData` is the same chunk with every string-control payload removed**, for consumers reading output as text; every other control is left for `stripTerminalControls`. The webview receives them apart: `pty:data` (the stripped output; feeds xterm.js) and `terminal:semanticEvents` (normalized CWD / prompt-command / title events; feeds `TerminalPaneState`, command boundaries also feeding command-exit alerting in [alert.md](alert.md#command-exit-track)). **Notification-derived state never travels as `pty:data`**: it reaches whichever process holds the `AlertManager` — direct calls in VS Code, `terminal:protocolEvents` in standalone.
 
 Each chunk is also classified for the quiesce detector: **the activity monitor's `onData()` fires only when `visibleData` is non-empty**, so a chunk of nothing but notification/progress OSCs is not meaningful output, while one carrying visible output alongside them is.
 
@@ -46,7 +46,7 @@ Replay (`pty:replay`) is the raw stream requiring re-parse: **the webview runs a
 
 | Sequence | Purpose | Spec |
 |---|---|---|
-| `BEL` (standalone, outside an OSC) | Generic terminal-bell notification | [alert.md](alert.md#terminal-reports) |
+| `BEL` (standalone, outside an OSC) | Generic terminal-bell notification, collapsed per batch | [alert.md](alert.md#terminal-reports) |
 | `OSC 0 ; <title> ST` | Window/icon title | [terminal-state.md](terminal-state.md#supported-osc-inputs) |
 | `OSC 2 ; <title> ST` | Window title | [terminal-state.md](terminal-state.md#supported-osc-inputs) |
 | `OSC 7 ; file://host/path ST` | CWD (xterm-style URI) | [terminal-state.md](terminal-state.md#supported-osc-inputs) |
diff --git a/docs/specs/tutorial.md b/docs/specs/tutorial.md
index 24875b48f..46c961d9f 100644
--- a/docs/specs/tutorial.md
+++ b/docs/specs/tutorial.md
@@ -47,11 +47,11 @@ Extras: `Starred on GitHub` (persisted separately, `onOpenGithub`), `🐭 Flappy
 
 ### Runner-local intercepts
 
-**`TutRunner` intercepts four keys while a specific section is open; they are not real Dormouse shortcuts.** The three alert demos report fake commands as `OSC 633 ; E / C / D` through `FakePtyAdapter.sendOutput`, which the real `TerminalProtocolParser` strips from visible output (rationale). **Must snapshot the live inactivity timeout at demo launch; the run outlasts it and the BUSY-confirm floor.** Each demo's countdown, page timer, and re-press guard run the same snapshotted duration — longer for `s`, whose fake command must outlive WATCHING's silence chain. Pinned by `website/src/lib/tut-runner.test.ts`.
+**`TutRunner` intercepts four keys while a specific section is open; they are not real Dormouse shortcuts.** The three alert demos report fake commands as `OSC 633 ; E / C / D` through `FakePtyAdapter.sendOutput`, which the real `TerminalProtocolParser` strips from visible output (rationale). **Must snapshot the live inactivity timeout at demo launch; the run outlasts it and the BUSY-confirm floor**, and `x` also outlasts `cfg.alert.commandExitMinRuntime`. Each demo's countdown, page timer, and re-press guard run the same snapshotted duration — longer for `s`, whose fake command must outlive WATCHING's silence chain. Pinned by `website/src/lib/tut-runner.test.ts`.
 
 - **`s`** (Alerts) — reports `longtask` on both alert panes so command-keyed WATCHING demonstrates `al-spreads`, pumping only the quiet `tut-boxed` (rationale), keeping the command alive through WATCHING’s silence chain. **A press while that command is still running is ignored**, and **the page cancels any prior pump and exit timer** — the runner's guard is per instance, so a re-run `tut` would otherwise stack them; on exit `TutorialShell.reportRunningCommand()` restores each pane's real command.
-- **`n`** (Alerts) — writes a raw `OSC 777` notification to `tut-boxed`, exercising the terminal-report track, which needs no WATCHING rule.
-- **`x`** (Alerts) — starts a fake `slowbuild` on `tut-splash` and reports its exit after the captured duration. **The command name must stay unwatched**, so the command-exit track rather than WATCHING owns the ring (rationale). **The page must cancel the prior exit timer across runner instances.**
+- **`n`** (Alerts) — writes a raw `OSC 777` notification to `tut-boxed`, exercising a terminal report, which needs no WATCHING rule.
+- **`x`** (Alerts) — starts a fake `slowbuild` on `tut-splash` and reports its exit after the captured duration. **The command name must stay unwatched**, so a command exit rather than WATCHING raises the ring (rationale). **The page must cancel the prior exit timer across runner instances.**
 - **`p`** (Copy paste) — toggles the **Place To Paste** scratch modal (`website/src/components/PlaceToPaste.tsx`) via `onTogglePlaceToPaste`. Desktop only — Pocket omits the callback, and the runner hides the prompt line without it.
 
 ### Pocket Copy paste specifics
diff --git a/docs/specs/tutorial.rationale.md b/docs/specs/tutorial.rationale.md
index 38a5050e8..23d625077 100644
--- a/docs/specs/tutorial.rationale.md
+++ b/docs/specs/tutorial.rationale.md
@@ -26,7 +26,7 @@
 
 **Why `s` pumps only `tut-boxed`.** `tut-splash` animates continuously and so is never silent; only the quiet pane needs pumping for WATCHING's silence chain to be worth watching.
 
-**Why the `x` demo uses an unwatched command name.** WATCHING and the command-exit track both end at a ring, so a watched name would leave the user unable to tell which fired. `slowbuild` sits outside the WATCHING rule set, leaving the command-exit track as the only source — and that track arms only once the user has attended the pane and left it, which is what the demo asks for.
+**Why the `x` demo uses an unwatched command name.** WATCHING and a command exit both raise the ring, so a watched name would leave the user unable to tell which fired. `slowbuild` sits outside the WATCHING rule set, leaving the command exit as the only source — and command-exit alerting arms only once the user has attended the pane and left it, which is what the demo asks for.
 
 ## Fake shell behavior
 
diff --git a/lib/src/cfg.ts b/lib/src/cfg.ts
index 9c78711da..220cd5212 100644
--- a/lib/src/cfg.ts
+++ b/lib/src/cfg.ts
@@ -26,6 +26,10 @@ export const cfg = {
     resizeDebounce: 500,
     /** ms — attention idle expiry. How long before "looking at this pane" wears off. */
     userAttention: 15_000,
+    /** ms — shortest run a command-exit ring reports; anything quicker was probably watched. */
+    commandExitMinRuntime: 15_000,
+    /** ms — longest a terminal notification may wait behind animation before it rings anyway. */
+    deferCeiling: 30_000,
     /** When true, the ALERT_RINGING alarm pulse animations are frozen at T=0 (for deterministic Chromatic snapshots). */
     ringingPaused: false,
   },
diff --git a/lib/src/lib/alert-manager.test.ts b/lib/src/lib/alert-manager.test.ts
index c8e21cdff..a4749074e 100644
--- a/lib/src/lib/alert-manager.test.ts
+++ b/lib/src/lib/alert-manager.test.ts
@@ -2,6 +2,8 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AlertManager, AWAIT_GRACE_MS, DEFAULT_ALERT_STATE, MAX_AWAIT_TIMEOUT_MS } from './alert-manager';
 import type { AwaitHandle, AwaitOutcome, CompletionEvent } from './alert-manager';
 import { applyTerminalProtocolEvents, collectTerminalSemanticEvents, TerminalProtocolParser } from './terminal-protocol';
+import { cfg } from '../cfg';
+import { toPersistedAlertState } from './session-types';
 
 describe('AlertManager in isolation', () => {
   let manager: AlertManager;
@@ -51,7 +53,7 @@ describe('AlertManager in isolation', () => {
       applyTerminalProtocolEvents(manager, HELPER, [{ kind: 'progress', progress: { state: 'normal', percent: 40 } }]);
       manager.attend(HELPER);
       manager.toggleTodo(HELPER);
-      manager.markTodo(HELPER);
+      manager.clearTodo(HELPER);
       manager.seed(HELPER, { todo: true });
       manager.onResize(HELPER);
       manager.applyTerminalSemanticEvents(HELPER, [{ type: 'commandFinish', exitCode: 1 }]);
@@ -124,7 +126,7 @@ describe('AlertManager in isolation', () => {
     it('takes back what a Session published when a failed placement demotes it', () => {
       manager.setHelper(HELPER, true);
       manager.setHelper(HELPER, false);
-      manager.markTodo(HELPER);
+      manager.toggleTodo(HELPER);
       const states: boolean[] = [];
       manager.onStateChange((id, state) => { if (id === HELPER) states.push(state.todo); });
       manager.setHelper(HELPER, true);
@@ -277,18 +279,125 @@ describe('AlertManager in isolation', () => {
     expect(manager.getState(id).status).toBe('ALERT_RINGING');
   }
 
-  it('attending a ringing alert turns TODO on', () => {
-    const id = 'attend-turns-todo-on';
-    driveToRinging(id);
-    manager.attend(id);
+  // --- One ring latch (`docs/specs/alert.md` -> Clearing And TODO) ---
+
+  /** Raise a ring from `source` on a fresh Session, unattended. */
+  function ringFrom(id: string, source: 'watching' | 'report' | 'exit'): void {
+    if (source === 'watching') {
+      driveToRinging(id);
+    } else if (source === 'report') {
+      manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'needs input' });
+    } else {
+      manager.attend(id);
+      runCommand(id);
+      manager.clearAttention(id);
+      vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
+      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+    }
+    expect(manager.getState(id).status).toBe('ALERT_RINGING');
+  }
+
+  it.each(['watching', 'report', 'exit'] as const)('a %s ring sets TODO the moment it opens', (source) => {
+    const id = `ring-sets-todo-${source}`;
+    ringFrom(id, source);
     expect(manager.getState(id).todo).toBe(true);
   });
 
-  it('dismissing a ringing alert turns TODO on', () => {
-    const id = 'dismiss-turns-todo-on';
+  it('a WATCHING ring carries its own detail', () => {
+    const id = 'watching-detail';
     driveToRinging(id);
+    expect(manager.getState(id).notification).toEqual({ source: 'WATCHING', title: 'longtask went quiet', body: null });
+  });
+
+  it.each(['watching', 'report', 'exit'] as const)('attending or dismissing a %s ring leaves its TODO', (source) => {
+    for (const verb of ['attend', 'dismissAlert'] as const) {
+      const id = `ring-leaves-todo-${source}-${verb}`;
+      ringFrom(id, source);
+      manager[verb](id);
+      expect(manager.getState(id)).toMatchObject({ episode: null, todo: true });
+      expect(manager.getState(id).notification).not.toBeNull();
+    }
+  });
+
+  it.each(['watching', 'report', 'exit'] as const)('toggling TODO on a %s ring turns it off with its detail', (source) => {
+    const id = `toggle-ringing-${source}`;
+    ringFrom(id, source);
+    manager.toggleTodo(id);
+    expect(manager.getState(id)).toMatchObject({ episode: null, todo: false, notification: null });
+  });
+
+  it('an unattended WATCHING ring leaves its TODO across a restart, without its live-only detail', () => {
+    const id = 'watching-restart';
+    driveToRinging(id);
+    const persisted = JSON.parse(JSON.stringify(toPersistedAlertState(manager.getState(id))));
+    expect(persisted).toEqual({ status: 'ALERT_RINGING', todo: true, notification: null });
+
+    const restarted = new AlertManager();
+    try {
+      restarted.seed(id, persisted);
+      expect(restarted.getState(id)).toMatchObject({ episode: null, todo: true });
+    } finally {
+      restarted.dispose();
+    }
+  });
+
+  it('a later generic BEL never replaces richer detail on the ring', () => {
+    const id = 'bel-after-osc9';
+    manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Build finished: 3 warnings' });
+    manager.notifyFromProtocol(id, { source: 'BEL', title: 'Terminal bell', body: null });
+    expect(manager.getState(id).notification).toEqual({ source: 'OSC 9', title: null, body: 'Build finished: 3 warnings' });
+  });
+
+  it('an exit joining a generic BEL shows the exit code', () => {
+    const id = 'exit-after-bel';
+    manager.attend(id);
+    runCommand(id, 'make');
+    manager.clearAttention(id);
+    vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
+    manager.notifyFromProtocol(id, { source: 'BEL', title: 'Terminal bell', body: null });
+    manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 2 }]);
+    expect(manager.getState(id).notification).toEqual({ source: 'COMMAND_EXIT', title: 'Command finished', body: 'make exited 2' });
+  });
+
+  it('equally rich detail joining a ring replaces what it shows', () => {
+    const id = 'latest-at-equal-rank';
+    manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'First' });
+    manager.notifyFromProtocol(id, { source: 'OSC 777', title: 'Second', body: null });
+    expect(manager.getState(id).notification).toEqual({ source: 'OSC 777', title: 'Second', body: null });
+  });
+
+  it.each(['attend', 'dismissAlert'] as const)(
+    'a report about a state acknowledged by %s updates the TODO without summoning again',
+    (verb) => {
+      // Claude Code: the turn settles and WATCHING rings; the user acknowledges
+      // it without typing; a minute later Claude sends its idle notification.
+      const id = `acknowledged-${verb}`;
+      const episodes = new Set<string>();
+      manager.onStateChange((changed, state) => {
+        if (changed === id && state.episode) episodes.add(state.episode.id);
+      });
+      driveToRinging(id);
+      manager[verb](id);
+      vi.advanceTimersByTime(60_000);
+
+      manager.notifyFromProtocol(id, { source: 'OSC 99', title: 'Claude Code', body: 'Claude is waiting for your input' });
+
+      expect(episodes.size).toBe(1);
+      expect(manager.getState(id)).toMatchObject({
+        episode: null,
+        todo: true,
+        notification: { source: 'OSC 99', title: 'Claude Code', body: 'Claude is waiting for your input' },
+      });
+    },
+  );
+
+  it('rings a report again once output follows the acknowledgement', () => {
+    const id = 'acknowledged-then-output';
+    manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'first' });
     manager.dismissAlert(id);
-    expect(manager.getState(id).todo).toBe(true);
+    manager.onData(id);
+    manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'second' });
+    expect(manager.getState(id).status).toBe('ALERT_RINGING');
   });
 
   it('toggleTodo flips on and off', () => {
@@ -300,14 +409,6 @@ describe('AlertManager in isolation', () => {
     expect(manager.getState(id).todo).toBe(false);
   });
 
-  it('markTodo sets true; clearTodo sets false', () => {
-    const id = 'mark-clear-todo';
-    manager.markTodo(id);
-    expect(manager.getState(id).todo).toBe(true);
-    manager.clearTodo(id);
-    expect(manager.getState(id).todo).toBe(false);
-  });
-
   it('protocol notifications ring and create TODO detail even when WATCHING is disabled', () => {
     const id = 'osc-notification';
 
@@ -348,7 +449,7 @@ describe('AlertManager in isolation', () => {
     });
   });
 
-  it('OSC progress cocks the protocol alarm without participating in visual timers', () => {
+  it('an OSC progress cycle shows busy without visual timers and rings when it ends', () => {
     const id = 'osc-progress';
 
     manager.updateProtocolProgress(id, { state: 'normal', percent: 25 });
@@ -370,7 +471,7 @@ describe('AlertManager in isolation', () => {
     });
   });
 
-  it('dropping the rule only turns WATCHING off, leaving protocol progress armed', () => {
+  it('dropping the rule only turns WATCHING off, leaving the progress cycle running', () => {
     const id = 'osc-progress-drop-rule';
 
     runWatchedCommand(id);
@@ -387,6 +488,66 @@ describe('AlertManager in isolation', () => {
     });
   });
 
+  // --- Progress: an independent sub-state (`docs/specs/alert.md` -> Terminal reports) ---
+
+  it('a progress update never takes a ring away', () => {
+    const id = 'progress-keeps-ring';
+    manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'needs permission' });
+    const ringing = manager.getState(id);
+
+    manager.updateProtocolProgress(id, { state: 'indeterminate', percent: null });
+
+    expect(manager.getState(id)).toMatchObject({ status: 'ALERT_RINGING', episode: ringing.episode });
+  });
+
+  it('a ring leaves the progress cycle running, so its end still rings', () => {
+    const id = 'ring-keeps-progress';
+    manager.updateProtocolProgress(id, { state: 'indeterminate', percent: null });
+    manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'needs permission' });
+    manager.attend(id);
+    manager.clearAttention(id);
+    expect(manager.getState(id).status).toBe('OSC_NOTIF_BUSY');
+
+    // The run goes on after the answer, then its cycle ends.
+    manager.onData(id);
+    manager.updateProtocolProgress(id, { state: 'clear', percent: null });
+
+    expect(manager.getState(id)).toMatchObject({
+      status: 'ALERT_RINGING',
+      notification: { source: 'OSC 9;4', title: 'Progress complete' },
+    });
+  });
+
+  it.each([
+    ['commandStart', (id: string) => runCommand(id, 'other-tool')],
+    ['commandFinish', (id: string) => manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 130 }])],
+    ['promptStart', (id: string) => manager.applyTerminalSemanticEvents(id, [{ type: 'promptStart' }])],
+    ['PTY exit', (id: string) => manager.onExit(id, 137)],
+  ] as const)('%s silently ends a progress cycle the program abandoned', (boundary, cross) => {
+    const id = `abandoned-progress-${boundary}`;
+    runCommand(id, 'cargo build');
+    manager.updateProtocolProgress(id, { state: 'normal', percent: 40 });
+    expect(manager.getState(id).status).toBe('OSC_NOTIF_BUSY');
+
+    cross(id);
+    expect(manager.getState(id).status).not.toBe('OSC_NOTIF_BUSY');
+
+    // A later defensive clear finds no cycle to complete.
+    manager.updateProtocolProgress(id, { state: 'clear', percent: null });
+    expect(manager.getState(id)).toMatchObject({ episode: null, todo: false, notification: null });
+  });
+
+  it.each([
+    ['complete', [{ state: 'normal', percent: 40 }, { state: 'clear', percent: null }], 'cargo build finished'],
+    ['warning', [{ state: 'warning', percent: 40 }, { state: 'normal', percent: 100 }], 'cargo build finished with a warning'],
+    ['error', [{ state: 'normal', percent: 40 }, { state: 'error', percent: null }], 'cargo build reported an error'],
+  ] as const)('names the running command in a progress %s title', (_outcome, updates, title) => {
+    const id = `progress-title-${_outcome}`;
+    runCommand(id, 'cargo build --release');
+    for (const update of updates) manager.updateProtocolProgress(id, update);
+    expect(manager.getState(id).notification).toMatchObject({ source: 'OSC 9;4', title });
+  });
+
   it('attending a ring clears it and leaves the TODO behind', () => {
     const id = 'attention-clears-ring';
 
@@ -509,7 +670,7 @@ describe('AlertManager in isolation', () => {
   });
 
   // `docs/specs/alert.md` -> Public State.
-  it('a second track latching mid-episode keeps the episode id', () => {
+  it('a second source joining mid-episode keeps the episode id', () => {
     const id = 'episode-cross-track';
     const seen: string[] = [];
     manager.onStateChange((_id, state) => {
@@ -530,17 +691,17 @@ describe('AlertManager in isolation', () => {
     expect(rung.status).toBe('ALERT_RINGING');
     expect(rung.episode?.id).toBeTruthy();
 
-    // The command-exit track latches behind the protocol one: one enriched
-    // summons, so no consumer keyed on the episode may deliver a second time.
+    // The exit joins the ring the bell opened: one enriched summons, so no
+    // consumer keyed on the episode may deliver a second time.
     manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
     const again = manager.getState(id);
     expect(again.status).toBe(rung.status);
-    expect(again.notification).toEqual(rung.notification);
+    expect(again.notification).toMatchObject({ source: 'COMMAND_EXIT' });
     expect(again.episode?.id).toBe(rung.episode?.id);
     expect(new Set(seen)).toEqual(new Set([rung.episode!.id]));
   });
 
-  it('re-latching after all tracks clear starts a new episode', () => {
+  it('re-latching after the ring clears starts a new episode', () => {
     const id = 'episode-restart';
     const bell = { source: 'BEL', title: 'Terminal bell', body: null } as const;
 
@@ -548,7 +709,7 @@ describe('AlertManager in isolation', () => {
     const first = manager.getState(id).episode;
     expect(first?.id).toBeTruthy();
 
-    // Bell spam on a track that is already ringing enriches the standing
+    // Bell spam on a ring that is already active enriches the standing
     // summons; it cannot raise a new episode, so nothing keyed on one replays.
     applyTerminalProtocolEvents(manager, id, [{ kind: 'notification', notification: bell }]);
     expect(manager.getState(id).episode?.id).toBe(first!.id);
@@ -556,6 +717,8 @@ describe('AlertManager in isolation', () => {
     manager.clearTodo(id);
     expect(manager.getState(id).episode).toBeNull();
 
+    // Output since the clear: the next bell is news, not the acknowledged state.
+    manager.onData(id);
     applyTerminalProtocolEvents(manager, id, [{ kind: 'notification', notification: bell }]);
     const second = manager.getState(id).episode;
     expect(second?.id).toBeTruthy();
@@ -849,10 +1012,10 @@ describe('AlertManager in isolation', () => {
     expect(completions).toEqual([{ kind: 'settled' }]);
   });
 
-  it('clears a WATCHING ring before it has created a TODO', () => {
+  it('clearing TODO clears a WATCHING ring with it', () => {
     const id = 'clear-unattended-watching';
     driveToRinging(id);
-    expect(manager.getState(id)).toMatchObject({ status: 'ALERT_RINGING', todo: false });
+    expect(manager.getState(id)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
 
     manager.clearTodo(id);
     expect(manager.getState(id)).toMatchObject({
@@ -963,7 +1126,7 @@ describe('AlertManager in isolation', () => {
     expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
   });
 
-  it('preserves richer protocol detail when protocol and command exit both ring', () => {
+  it('keeps richer protocol detail when a command exit joins its ring', () => {
     const id = 'command-exit-protocol-wins';
 
     manager.attend(id);
@@ -1003,21 +1166,23 @@ describe('AlertManager in isolation', () => {
       expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
     });
 
-    it('gates the command-exit minimum runtime on the same window', () => {
+    it('leaves the command-exit minimum runtime where it was', () => {
       const id = 'short-runtime-gate';
       manager.setInactivityTimeoutMs(3_000);
 
       manager.attend(id);
-      manager.applyTerminalSemanticEvents(id, [
-        { type: 'commandLine', commandLine: 'git status' },
-        { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-      ]);
+      runCommand(id, 'git status');
       manager.clearAttention(id);
 
-      // Under the default 15s window this runtime would be too short to ring.
       vi.advanceTimersByTime(4_000);
       manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+      expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
 
+      runCommand(id, 'git status');
+      manager.attend(id);
+      manager.clearAttention(id);
+      vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
+      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
       expect(manager.getState(id)).toMatchObject({
         status: 'ALERT_RINGING',
         notification: { source: 'COMMAND_EXIT', body: 'git status exited 0' },
@@ -1245,6 +1410,65 @@ describe('AlertManager in isolation', () => {
       expect(manager.getState(id).status).toBe('ALERT_RINGING');
     });
 
+    it('rings a deferred notification at the ceiling when output never goes quiet', () => {
+      const id = 'defer-ceiling';
+      driveToBusy(id);
+      manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'build failed' });
+
+      // A heartbeat every second keeps moving the quiet deadline.
+      for (let t = 1_000; t < cfg.alert.deferCeiling; t += 1_000) {
+        vi.advanceTimersByTime(1_000);
+        manager.onData(id);
+      }
+      vi.advanceTimersByTime(999);
+      expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
+      vi.advanceTimersByTime(1);
+      expect(manager.getState(id)).toMatchObject({
+        status: 'ALERT_RINGING',
+        notification: { source: 'OSC 9', title: null, body: 'build failed' },
+      });
+    });
+
+    it('keeps the first deferral time when a later notification replaces the detail', () => {
+      const id = 'defer-ceiling-latest';
+      driveToBusy(id);
+      manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'First' });
+      for (let t = 1_000; t < cfg.alert.deferCeiling; t += 1_000) {
+        vi.advanceTimersByTime(1_000);
+        manager.onData(id);
+        if (t === 20_000) manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Second' });
+      }
+      vi.advanceTimersByTime(1_000);
+      expect(manager.getState(id)).toMatchObject({
+        status: 'ALERT_RINGING',
+        notification: { source: 'OSC 9', title: null, body: 'Second' },
+      });
+    });
+
+    it('carries the deferral ceiling across a live transfer', () => {
+      const id = 'defer-ceiling-transfer';
+      driveToBusy(id);
+      manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Done' });
+      for (let t = 0; t < 20_000; t += 1_000) {
+        vi.advanceTimersByTime(1_000);
+        manager.onData(id);
+      }
+      const snapshot = manager.pauseForTransfer(id)!;
+      const target = new AlertManager();
+      try {
+        target.resumeFromTransfer(id, JSON.parse(JSON.stringify(snapshot)));
+        for (let t = 20_000; t < cfg.alert.deferCeiling - 1_000; t += 1_000) {
+          vi.advanceTimersByTime(1_000);
+          target.onData(id);
+        }
+        expect(target.getState(id).status).toBe('WATCHING_DISABLED');
+        vi.advanceTimersByTime(1_000);
+        expect(target.getState(id).status).toBe('ALERT_RINGING');
+      } finally {
+        target.dispose();
+      }
+    });
+
     it('coalesces repeated protocol alerts to the latest detail', () => {
       const id = 'defer-latest-protocol';
       driveToBusy(id);
@@ -1289,6 +1513,30 @@ describe('AlertManager in isolation', () => {
     });
   });
 
+  // --- Ordered ingestion ---
+
+  it('judges a notification written after a command finish against the reset detector', () => {
+    const id = 'ordered-ingestion';
+    const parser = new TerminalProtocolParser();
+    const feed = (chunk: string): void => {
+      const parsed = parser.process(chunk);
+      manager.applyTerminalEvents(id, parsed.events);
+      if (parsed.visibleData.length > 0) manager.onData(id);
+    };
+    feed('\x1b]633;E;./build.sh\x07\x1b]633;C\x07');
+    for (let t = 0; t < 3_000; t += 200) {
+      feed('compiling...\r\n');
+      vi.advanceTimersByTime(200);
+    }
+    // A precmd hook reports after the shell's D and A, in the same read.
+    feed('done\r\n\x1b]633;D;0\x07\x1b]633;A\x07\x1b]777;notify;Command completed;./build.sh\x1b\\$ ');
+
+    expect(manager.getState(id)).toMatchObject({
+      status: 'ALERT_RINGING',
+      notification: { source: 'OSC 777', title: 'Command completed', body: './build.sh' },
+    });
+  });
+
   // --- Completion events (`docs/specs/alert.md` -> Completion events) ---
 
   describe('completion events', () => {
@@ -1534,7 +1782,7 @@ describe('AlertManager in isolation', () => {
 
     // 1. Already ringing at call time.
 
-    it('resolves on a protocol ring already latched, consuming only that track', async () => {
+    it('resolves on a protocol ring already latched, withdrawing the TODO it set', async () => {
       const id = 'await-standing-bell';
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Build finished' });
       expect(manager.getState(id)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
@@ -1542,19 +1790,49 @@ describe('AlertManager in isolation', () => {
       const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
 
       expect(await handle.promise).toEqual({ kind: 'resolved', cause: 'bell', waitedMs: 0 });
-      // The ring is gone; the human's TODO and its detail are not the await's to take.
       expect(manager.getState(id)).toMatchObject({
         status: 'WATCHING_DISABLED',
-        todo: true,
-        notification: { source: 'OSC 9', title: null, body: 'Build finished' },
+        todo: false,
+        notification: null,
         awaited: false,
       });
     });
 
-    it('resolves on a latched WATCHING ring without inventing a TODO', async () => {
+    it('leaves a TODO the human already had when it consumes a ring', async () => {
+      const id = 'await-keeps-earlier-todo';
+      manager.notifyFromProtocol(id, { source: 'OSC 777', title: 'earlier', body: null });
+      manager.dismissAlert(id);
+      manager.onData(id);
+      manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'later' });
+      expect(manager.getState(id).notification?.body).toBe('later');
+
+      const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
+
+      expect(await handle.promise).toMatchObject({ kind: 'resolved', cause: 'bell' });
+      expect(manager.getState(id)).toMatchObject({
+        episode: null,
+        todo: true,
+        notification: { source: 'OSC 777', title: 'earlier', body: null },
+      });
+    });
+
+    it('leaves no TODO whether the report arrived before or after the await parked', async () => {
+      const parked = manager.awaitCompletion('await-first', { until: 'quiet', timeoutMs: NEVER });
+      manager.notifyFromProtocol('await-first', { source: 'OSC 9', title: null, body: 'done' });
+      expect(await parked.promise).toMatchObject({ kind: 'resolved', cause: 'bell' });
+
+      manager.notifyFromProtocol('bell-first', { source: 'OSC 9', title: null, body: 'done' });
+      const consumed = manager.awaitCompletion('bell-first', { until: 'quiet', timeoutMs: NEVER });
+      expect(await consumed.promise).toMatchObject({ kind: 'resolved', cause: 'bell' });
+
+      expect(manager.getState('await-first').todo).toBe(false);
+      expect(manager.getState('bell-first').todo).toBe(false);
+    });
+
+    it('resolves on a latched WATCHING ring and withdraws its TODO', async () => {
       const id = 'await-standing-quiet';
       driveToRinging(id);
-      expect(manager.getState(id).todo).toBe(false);
+      expect(manager.getState(id).todo).toBe(true);
 
       const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
 
@@ -1579,11 +1857,7 @@ describe('AlertManager in isolation', () => {
         const handle = manager.awaitCompletion(id, { until, timeoutMs: NEVER });
 
         expect(await handle.promise).toEqual({ kind: 'resolved', cause: 'exit', waitedMs: 0 });
-        expect(manager.getState(id)).toMatchObject({
-          status: 'WATCHING_DISABLED',
-          todo: true,
-          notification: { source: 'COMMAND_EXIT', title: 'Command finished', body: 'pnpm build exited 0' },
-        });
+        expect(manager.getState(id)).toMatchObject({ status: 'WATCHING_DISABLED', todo: false, notification: null });
       }
     });
 
diff --git a/lib/src/lib/alert-manager.ts b/lib/src/lib/alert-manager.ts
index 277647eb3..406782cb2 100644
--- a/lib/src/lib/alert-manager.ts
+++ b/lib/src/lib/alert-manager.ts
@@ -1,6 +1,11 @@
 import { createAlertEpisode, type AlertEpisode } from './alert-episode';
 import { QuiesceDetector, type QuiesceStatus, type QuiesceSnapshot } from './quiesce-detector';
-import { applyTerminalProtocolEvents, collectTerminalSemanticEvents, type TerminalProtocolParseResult } from './terminal-protocol';
+import {
+  applyTerminalProtocolEvents,
+  collectTerminalSemanticEvents,
+  type TerminalProtocolEvent,
+  type TerminalProtocolParseResult,
+} from './terminal-protocol';
 import { DEFAULT_ALERT_SETTINGS, type AlertSettings } from './alert-settings-model';
 import { cfg } from '../cfg';
 import {
@@ -26,7 +31,7 @@ export type SessionStatus =
 /** Boolean TODO state: on (true) or off (false). */
 export type TodoState = boolean;
 
-export const ACTIVITY_NOTIFICATION_SOURCES = ['OSC 9', 'OSC 9;4', 'OSC 99', 'OSC 777', 'BEL', 'COMMAND_EXIT'] as const;
+export const ACTIVITY_NOTIFICATION_SOURCES = ['OSC 9', 'OSC 9;4', 'OSC 99', 'OSC 777', 'BEL', 'COMMAND_EXIT', 'WATCHING'] as const;
 export type ActivityNotificationSource = typeof ACTIVITY_NOTIFICATION_SOURCES[number];
 
 export interface ActivityNotification {
@@ -35,6 +40,21 @@ export interface ActivityNotification {
   body: string | null;
 }
 
+/**
+ * How much a notification says, by its source (`docs/specs/alert.md` ->
+ * Clearing And TODO). While a ring is active, joining detail replaces the shown
+ * detail only at an equal or higher rank.
+ */
+const DETAIL_RANK: Record<ActivityNotificationSource, number> = {
+  'OSC 9': 4,
+  'OSC 99': 4,
+  'OSC 777': 4,
+  COMMAND_EXIT: 3,
+  'OSC 9;4': 2,
+  WATCHING: 1,
+  BEL: 0,
+};
+
 export type ProtocolProgressState = 'clear' | 'normal' | 'warning' | 'indeterminate' | 'error';
 
 export interface ProtocolProgressUpdate {
@@ -42,8 +62,7 @@ export interface ProtocolProgressUpdate {
   percent: number | null;
 }
 
-type ProtocolStatus = 'IDLE' | 'OSC_NOTIF_BUSY' | 'ALERT_RINGING';
-type CommandExitStatus = 'IDLE' | 'COMMAND_EXIT_ARMED' | 'ALERT_RINGING';
+type CommandExitStatus = 'IDLE' | 'COMMAND_EXIT_ARMED';
 type ActiveProtocolProgressState = 'normal' | 'warning' | 'indeterminate';
 
 interface ActiveProtocolProgress {
@@ -51,6 +70,24 @@ interface ActiveProtocolProgress {
   percent: number | null;
 }
 
+/** What raised a ring: a watched settle, a terminal report, or a command exit. */
+type RingSource = 'watching' | 'report' | 'exit';
+
+/** The one ring latch a Session holds (`docs/specs/alert.md` -> Public State). */
+interface Ring {
+  episode: AlertEpisode;
+  /** An array, not a Set: the live-transfer snapshot crosses IPC as JSON. */
+  sources: RingSource[];
+  /** Rule key that raised the `watching` source; removing its rule silences it. */
+  watchKey: string | null;
+  /** This ring turned `todo` on, so a withdrawal that empties it turns it off. */
+  setTodo: boolean;
+  /** The notification this ring replaced, restored by a withdrawal that empties it. */
+  priorNotification: ActivityNotification | null;
+  /** `DETAIL_RANK` of the notification this ring currently shows. */
+  detailRank: number;
+}
+
 interface CommandExitWatch {
   displayCommand: string;
   /** `commandWatchKey` of the command line; null without one to key on. */
@@ -92,7 +129,7 @@ export type CompletionEvent =
       exitCode: number | undefined;
       /** Wall time from commandStart to this finish. */
       ranMs: number;
-      /** The command-exit track was armed (attention was lost mid-run) when it finished. */
+      /** Command-exit alerting was armed (attention was lost mid-run) when it finished. */
       armed: boolean;
     }
   | { kind: 'notification'; notification: ActivityNotification };
@@ -173,23 +210,28 @@ export const DEFAULT_ALERT_STATE: AlertState = {
   awaited: false,
 };
 
-/** Three independent alarm tracks plus an always-on, non-latching detector.
- * WATCHING gates detector projection; its ring latches separately. */
+/** One ring latch fed by three sources, an independent progress cycle, and an
+ * always-on, non-latching detector. WATCHING gates detector projection. */
 interface AlertEntry {
-  episode: AlertEpisode | null;
   /** Always-on output/silence detector. Never disposed before the entry is. */
   detector: QuiesceDetector;
-  /** Watch key of the command whose settle latched the WATCHING ring, kept after it exits. */
-  watchingRingingCommand: string | null;
+  ring: Ring | null;
   /**
-   * Has any output arrived since that ring latched? The detector cannot answer
-   * this — it never latches, so it reports how output looks *now*, and it stays
-   * `NOTHING_TO_SHOW` for a full `busyCandidateGap` after output resumes (and
-   * returns there when a burst was too sparse to confirm BUSY). The question is
-   * about the interval since the ring, which is only observable here.
+   * Has any output arrived since the ring gained its `watching` source? The
+   * detector cannot answer this — it never latches, so it reports how output
+   * looks *now*, and it stays `NOTHING_TO_SHOW` for a full `busyCandidateGap`
+   * after output resumes (and returns there when a burst was too sparse to
+   * confirm BUSY). The question is about the interval since the ring, which is
+   * only observable here.
    */
   outputSinceWatchingRing: boolean;
-  protocolStatus: ProtocolStatus;
+  /**
+   * A user verb cleared a ring, and whether output has arrived since. A report
+   * about that acknowledged state updates the receipt instead of summoning
+   * again. Cleared when a ring opens.
+   */
+  acked: { outputSince: boolean } | null;
+  /** The live `OSC 9;4` cycle. Never touches the ring, and the ring never touches it. */
   progress: ActiveProtocolProgress | null;
   commandExitStatus: CommandExitStatus;
   commandExitWatch: CommandExitWatch | null;
@@ -198,6 +240,8 @@ interface AlertEntry {
   notification: ActivityNotification | null;
   /** Latest terminal notification deferred behind animation; never public or persisted. */
   deferredNotification: ActivityNotification | null;
+  /** When the pending deferral began. A replacement keeps it, so the ceiling bounds the whole hold. */
+  deferredSince: number | null;
   deferredNotificationTimer: ReturnType<typeof setTimeout> | null;
 }
 
@@ -247,7 +291,7 @@ export class AlertManager {
     this.setDeferAlertsUntilQuiet(settings.deferAlertsUntilQuiet);
   }
 
-  /** Walk-away and command-exit minimum-runtime window. Revalidate at this timer sink. */
+  /** Walk-away window for attention. Revalidate at this timer sink. */
   setInactivityTimeoutMs(ms: number): void {
     if (!Number.isFinite(ms) || ms <= 0 || ms === this.inactivityTimeoutMs) return;
     this.inactivityTimeoutMs = ms;
@@ -296,10 +340,11 @@ export class AlertManager {
     const entry = this.streamEntry(id);
     if (!entry) return;
     entry.detector.onData();
-    // Only meaningful while a ring is latched: `consumeAwaitableRing` reads it
-    // to tell a ring that still describes the present from one whose quiet has
-    // already ended.
-    if (entry.watchingRingingCommand !== null) entry.outputSinceWatchingRing = true;
+    // Only meaningful while a WATCHING ring is latched: `consumeAwaitableRing`
+    // reads it to tell a ring that still describes the present from one whose
+    // quiet has already ended.
+    if (entry.ring?.sources.includes('watching')) entry.outputSinceWatchingRing = true;
+    if (entry.acked !== null) entry.acked.outputSince = true;
     this.eachWaiter(id, (waiter) => waiter.onOutput());
   }
 
@@ -334,17 +379,7 @@ export class AlertManager {
       // A suspended Session is frozen at its snapshot; `resumeFromTransfer`
       // re-applies this rule wherever the snapshot lands.
       if (this.suspendedForTransfer.has(id)) continue;
-      // Dropping a rule is an explicit "stop alerting on this", so it also
-      // silences the ring that rule already raised — unless another rule still
-      // covers it. The originating key stays latched after command exit
-      // precisely so this still works at a prompt.
-      if (
-        entry.watchingRingingCommand !== null
-        && watchRuleFor(this.watchedCommands, entry.watchingRingingCommand) === null
-      ) {
-        entry.watchingRingingCommand = null;
-        entry.outputSinceWatchingRing = false;
-      }
+      this.withdrawUncoveredWatchingRing(entry);
       // WATCHING is derived from the rule set, so every entry may have changed.
       this.notify(id);
     }
@@ -390,15 +425,26 @@ export class AlertManager {
 
   /**
    * Watched work that resumed invalidates a ring inferred from silence, so the
-   * next settle raises a fresh one on fresh delivery delays. Not `releaseRing`:
-   * that resets the detector, which would stop this run from settling again.
-   * Callers are the WATCHING-only paths; this adds no rule-set check of its own.
+   * next settle raises a fresh one on fresh delivery delays. The detector is
+   * left alone: resetting it would stop this run from settling again. Callers
+   * are the WATCHING-only paths; this adds no rule-set check of its own.
    */
   private withdrawResumedWatchingRing(entry: AlertEntry): void {
-    if (!this.deferAlertsUntilQuiet || entry.watchingRingingCommand === null) return;
-    if (!entry.detector.isConfirmedBusy()) return;
-    entry.watchingRingingCommand = null;
-    entry.outputSinceWatchingRing = false;
+    if (!this.deferAlertsUntilQuiet || !entry.detector.isConfirmedBusy()) return;
+    this.withdrawRingSource(entry, 'watching');
+  }
+
+  /**
+   * Dropping a rule is an explicit "stop alerting on this", so it also silences
+   * the `watching` source that rule raised — unless another rule still covers
+   * it. The ring keeps its key after command exit precisely so this still works
+   * at a prompt.
+   */
+  private withdrawUncoveredWatchingRing(entry: AlertEntry): void {
+    const ring = entry.ring;
+    if (ring === null || !ring.sources.includes('watching')) return;
+    if (watchRuleFor(this.watchedCommands, ring.watchKey) !== null) return;
+    this.withdrawRingSource(entry, 'watching');
   }
 
   /** A busy Session went quiet. Whether that rings is decided downstream. */
@@ -437,10 +483,10 @@ export class AlertManager {
   }
 
   /**
-   * Observe -> claim -> ring rule, for all three tracks. Every ring rule lives
-   * here and nowhere else, so a track's emit site only has to describe what
-   * happened; the decision to bother a human is made once, after the claimants
-   * have passed on it. Returns whether a claimant took the event.
+   * Observe -> claim -> ring rule, for every ring source. Every ring rule lives
+   * here and nowhere else, so an emit site only has to describe what happened;
+   * the decision to bother a human is made once, after the claimants have
+   * passed on it. Returns whether a claimant took the event.
    */
   private dispatchCompletion(id: string, entry: AlertEntry, event: CompletionEvent): boolean {
     // A helper's completion reaches no one, and is not kept for promotion.
@@ -451,21 +497,25 @@ export class AlertManager {
     if (claimants.some((claimant) => claimant(event))) return true;
 
     switch (event.kind) {
-      case 'settled':
+      case 'settled': {
         // Only a watched command rings, and only if the user is not looking at
-        // it right now. The originating command key latches here so the ring
+        // it right now. The originating command key latches on the ring so it
         // outlives the command that raised it.
-        if (!this.isWatching(entry) || this.hasAttention(id)) break;
-        this.openEpisode(entry);
-        entry.watchingRingingCommand = entry.commandExitWatch?.watchKey ?? null;
-        entry.outputSinceWatchingRing = false;
+        const watchKey = entry.commandExitWatch?.watchKey;
+        if (!watchKey || !this.isWatching(entry) || this.hasAttention(id)) break;
+        this.raiseRing(entry, 'watching', { source: 'WATCHING', title: `${watchKey} went quiet`, body: null }, watchKey);
         this.notify(id);
         break;
+      }
       case 'commandFinished':
-        if (!event.armed || this.hasAttention(id) || event.ranMs < this.inactivityTimeoutMs) break;
+        if (!event.armed || this.hasAttention(id) || event.ranMs < cfg.alert.commandExitMinRuntime) break;
         // A shell-reported exit is authoritative, so recent animation never
         // delays it. The detector only gates in-band terminal notifications.
-        this.applyCommandExitRinging(entry, event.displayCommand, event.exitCode);
+        this.raiseRing(entry, 'exit', {
+          source: 'COMMAND_EXIT',
+          title: 'Command finished',
+          body: formatCommandExitBody(event.displayCommand, event.exitCode),
+        });
         // If a terminal notification was already waiting, it can enrich this
         // ring immediately; keeping its timer would publish stale detail later.
         if (entry.deferredNotification !== null) this.flushDeferredNotification(id, entry);
@@ -493,8 +543,8 @@ export class AlertManager {
    * instead of ringing anyone.
    *
    * Resolves immediately when the Session is already ringing, consuming only
-   * the one latch it resolved on and leaving TODO, notification detail, and
-   * attention exactly as they were.
+   * the one ring source it resolved on. That withdraws the TODO the ring
+   * itself set, never a TODO that was already there, and never sets attention.
    */
   awaitCompletion(id: string, options: AwaitOptions): AwaitHandle {
     if (this.inert(id)) return settledAwait({ kind: 'cancelled', waitedMs: 0 });
@@ -594,46 +644,47 @@ export class AlertManager {
   }
 
   /**
-   * Consume the ring an await arriving right now would resolve on, if any.
-   * Only that track's latch is released: TODO and its notification detail are
-   * the human's and stay untouched.
+   * Consume the ring source an await arriving right now would resolve on, if
+   * any. Only that source is withdrawn; the TODO it set goes with the ring only
+   * once the ring is empty.
    *
-   * Two of the three are gated, because their latches outlive the fact they
+   * Two of the three are gated, because the ring outlives the fact they
    * describe.
    *
-   * The command-exit ring outlives the run that raised it —
-   * `startCommandExitWatch` deliberately preserves `ALERT_RINGING` — so once a
-   * *new* foreground command is running it can only describe a previous one,
-   * and consuming it would answer "the command exited" about the command still
-   * running. That is precisely the misreport `dor send` followed by `dor await
-   * --until exit` would act on, so a running `commandExitWatch` suppresses it
-   * and the await parks for the real exit instead.
+   * The `exit` source outlives the run that raised it — a command start
+   * deliberately leaves the ring alone — so once a *new* foreground command is
+   * running it can only describe a previous one, and consuming it would answer
+   * "the command exited" about the command still running. That is precisely
+   * the misreport `dor send` followed by `dor await --until exit` would act on,
+   * so a running `commandExitWatch` suppresses it and the await parks for the
+   * real exit instead.
    *
-   * The WATCHING ring is the same hazard one level down. It legitimately
+   * The `watching` source is the same hazard one level down. It legitimately
    * describes the command still running — a long-running watched command going
    * quiet is the `claude` case `--until quiet` exists for — but it is an
    * *inference from silence*, not a discrete event, and nothing clears it when
-   * output resumes. Consuming a latched ring after a `dor send` restarted the
-   * peer would answer "output stopped" about a turn that is mid-flight, and the
-   * documented `await && read` idiom would read a half-drawn screen. So it is
-   * consumed only while `outputSinceWatchingRing` is still false; once output
-   * has resumed the await parks for the real settle. The detector cannot stand
-   * in for that flag — it stays `NOTHING_TO_SHOW` for a full `busyCandidateGap`
-   * after output resumes, which is longer than the two CLI round trips between
-   * a `dor send` and the await that follows it.
+   * output resumes. Consuming it after a `dor send` restarted the peer would
+   * answer "output stopped" about a turn that is mid-flight, and the documented
+   * `await && read` idiom would read a half-drawn screen. So it is consumed only
+   * while `outputSinceWatchingRing` is still false; once output has resumed the
+   * await parks for the real settle. The detector cannot stand in for that flag
+   * — it stays `NOTHING_TO_SHOW` for a full `busyCandidateGap` after output
+   * resumes, which is longer than the two CLI round trips between a `dor send`
+   * and the await that follows it.
    *
-   * The protocol ring is ungated: `OSC 9` is a discrete "I need input" that
+   * The `report` source is ungated: `OSC 9` is a discrete "I need input" that
    * stays true until it is answered, so a peer ringing mid-run still means what
    * it said whenever the await arrives.
    */
   private consumeAwaitableRing(entry: AlertEntry, until: AwaitUntil): AwaitCause | null {
-    if (until === 'quiet' && this.releaseRing(entry, 'protocol')) return 'bell';
-    if (entry.commandExitWatch === null && this.releaseRing(entry, 'commandExit')) return 'exit';
-    if (
-      until === 'quiet'
-      && !entry.outputSinceWatchingRing
-      && this.releaseRing(entry, 'watching')
-    ) return 'quiet';
+    if (until === 'quiet' && this.withdrawRingSource(entry, 'report')) return 'bell';
+    if (entry.commandExitWatch === null && this.withdrawRingSource(entry, 'exit')) return 'exit';
+    if (until === 'quiet' && !entry.outputSinceWatchingRing && entry.ring?.sources.includes('watching')) {
+      this.withdrawRingSource(entry, 'watching');
+      // The tail of the run that rang must not settle again straight away.
+      entry.detector.reset();
+      return 'quiet';
+    }
     return null;
   }
 
@@ -678,7 +729,33 @@ export class AlertManager {
     this.eachWaiter(id, (waiter) => (how === 'died' ? waiter.die() : waiter.cancel()));
   }
 
-  // --- Terminal-report protocol track ---
+  // --- Terminal reports ---
+
+  /**
+   * Apply one parse batch's notification, progress, and semantic events in
+   * stream order, so a report written after a command boundary is judged after
+   * it. Every other event kind is not the manager's.
+   */
+  applyTerminalEvents(id: string, events: readonly TerminalProtocolEvent[]): void {
+    let semantic: TerminalSemanticEvent[] = [];
+    const flushSemantic = (): void => {
+      if (semantic.length === 0) return;
+      this.applyTerminalSemanticEvents(id, semantic);
+      semantic = [];
+    };
+    for (const event of events) {
+      if (event.kind === 'semantic') {
+        semantic.push(event.event);
+      } else if (event.kind === 'notification') {
+        flushSemantic();
+        this.notifyFromProtocol(id, event.notification);
+      } else if (event.kind === 'progress') {
+        flushSemantic();
+        this.updateProtocolProgress(id, event.progress);
+      }
+    }
+    flushSemantic();
+  }
 
   notifyFromProtocol(id: string, notification: ActivityNotification): void {
     if (this.inert(id)) return;
@@ -689,47 +766,33 @@ export class AlertManager {
     this.dispatchCompletion(id, entry, { kind: 'notification', notification: normalized });
   }
 
+  /** `OSC 9;4`: active updates move the cycle; its end is a report completion. */
   updateProtocolProgress(id: string, progress: ProtocolProgressUpdate): void {
     if (this.inert(id)) return;
     const entry = this.reportedEntry(id);
 
     if (progress.state === 'clear') {
+      // A clear with no live cycle ends nothing: programs clear defensively.
       if (!entry.progress) return;
-      this.completeProtocolProgress(id, entry, entry.progress);
+      this.finishProtocolProgressCycle(id, entry, entry.progress.state === 'warning' ? 'warning' : 'complete', entry.progress.percent);
       return;
     }
 
     if (progress.state === 'error') {
-      this.finishProtocolProgressCycle(id, entry, 'Progress error', progress.percent);
+      this.finishProtocolProgressCycle(id, entry, 'error', progress.percent);
       return;
     }
 
     if (progress.state === 'normal' && progress.percent === 100) {
-      this.completeProtocolProgress(id, entry, {
-        state: entry.progress?.state === 'warning' ? 'warning' : 'normal',
-        percent: progress.percent,
-      });
-      return;
-    }
-
-    if (
-      entry.protocolStatus === 'OSC_NOTIF_BUSY'
-      && entry.progress?.state === progress.state
-      && entry.progress?.percent === progress.percent
-    ) {
+      this.finishProtocolProgressCycle(id, entry, entry.progress?.state === 'warning' ? 'warning' : 'complete', progress.percent);
       return;
     }
 
+    if (entry.progress?.state === progress.state && entry.progress.percent === progress.percent) return;
     entry.progress = { state: progress.state, percent: progress.percent };
-    entry.protocolStatus = 'OSC_NOTIF_BUSY';
     this.notify(id);
   }
 
-  private completeProtocolProgress(id: string, entry: AlertEntry, progress: ActiveProtocolProgress): void {
-    const title = progress.state === 'warning' ? 'Progress warning' : 'Progress complete';
-    this.finishProtocolProgressCycle(id, entry, title, progress.percent);
-  }
-
   /**
    * End of a progress cycle (completion or error). The cycle is over whether or
    * not anyone claims the event, so it is cleared *before* dispatch — a
@@ -739,16 +802,15 @@ export class AlertManager {
   private finishProtocolProgressCycle(
     id: string,
     entry: AlertEntry,
-    title: string,
+    outcome: 'complete' | 'warning' | 'error',
     percent: number | null,
   ): void {
     entry.progress = null;
-    if (entry.protocolStatus === 'OSC_NOTIF_BUSY') entry.protocolStatus = 'IDLE';
     const claimed = this.dispatchCompletion(id, entry, {
       kind: 'notification',
       notification: {
         source: 'OSC 9;4',
-        title,
+        title: progressTitle(entry.commandExitWatch, outcome),
         body: percent === null ? null : `Progress ${Math.round(percent)}%`,
       },
     });
@@ -757,15 +819,7 @@ export class AlertManager {
     if (claimed) this.notify(id);
   }
 
-  private applyProtocolRinging(entry: AlertEntry, notification: ActivityNotification): void {
-    this.openEpisode(entry);
-    entry.notification = notification;
-    entry.todo = true;
-    entry.protocolStatus = 'ALERT_RINGING';
-    entry.progress = null;
-  }
-
-  // --- Command-exit track ---
+  // --- Command-exit ---
 
   applyTerminalSemanticEvents(id: string, events: TerminalSemanticEvent[]): void {
     if (events.length === 0 || this.suspendedForTransfer.has(id)) return;
@@ -790,15 +844,10 @@ export class AlertManager {
         case 'promptStart':
         case 'promptEnd':
           // A prompt means nothing is in the foreground any more, so WATCHING
-          // stops here even if the shell never sent a finish event.
-          if (entry.pendingCommandLine !== null || entry.commandExitWatch !== null) {
-            this.finishCommandExitWatch(id, entry, undefined);
-            changed = true;
-          } else {
-            // Prompt rendering can produce busy output even without a reported
-            // command. Its history ends at this boundary too.
-            entry.detector.reset();
-          }
+          // stops here even if the shell never sent a finish event. Prompt
+          // rendering can produce busy output even without a reported command,
+          // so its history ends at this boundary too.
+          changed = this.finishCommandExitWatch(id, entry, undefined) || changed;
           break;
       }
     }
@@ -813,7 +862,10 @@ export class AlertManager {
   ): void {
     const resolved = resolveCommandStart(entry.pendingCommandLine, event);
     entry.pendingCommandLine = null;
-    if (entry.commandExitStatus !== 'ALERT_RINGING') entry.commandExitStatus = 'IDLE';
+    entry.commandExitStatus = 'IDLE';
+    // Every command boundary silently ends a progress cycle the program never
+    // closed, so a later stray clear finds nothing to complete.
+    entry.progress = null;
     entry.commandExitWatch = {
       displayCommand: resolved.displayCommand,
       watchKey: resolved.rawCommandLine === null ? null : commandWatchKey(resolved.rawCommandLine),
@@ -836,9 +888,10 @@ export class AlertManager {
     entry.commandExitWatch = null;
     entry.pendingCommandLine = null;
     const wasArmed = entry.commandExitStatus === 'COMMAND_EXIT_ARMED';
-    if (entry.commandExitStatus !== 'ALERT_RINGING') {
-      entry.commandExitStatus = 'IDLE';
-    }
+    entry.commandExitStatus = 'IDLE';
+    // The boundary silently ends a progress cycle, like a command start.
+    const endedProgress = entry.progress !== null;
+    entry.progress = null;
 
     // Every finish is observable, including the short, unarmed, and attended
     // ones that can never ring — the ring rule is what filters them.
@@ -860,7 +913,7 @@ export class AlertManager {
     // Clearing the watch turns WATCHING off, which flips `watchingEnabled` and
     // the status even when command-exit never armed, so subscribers must hear
     // about any finish — `notify` dedupes if nothing is visible.
-    return watch !== null;
+    return watch !== null || endedProgress;
   }
 
   private markCommandExitSeen(entry: AlertEntry): void {
@@ -879,25 +932,6 @@ export class AlertManager {
     return true;
   }
 
-  /** The watch record is already gone by the time this runs, so it takes the text it needs. */
-  private applyCommandExitRinging(
-    entry: AlertEntry,
-    displayCommand: string,
-    exitCode: number | undefined,
-  ): void {
-    this.openEpisode(entry);
-    entry.commandExitStatus = 'ALERT_RINGING';
-    entry.todo = true;
-    // A protocol ring carries richer text; never overwrite it with the generic one.
-    if (entry.protocolStatus !== 'ALERT_RINGING') {
-      entry.notification = {
-        source: 'COMMAND_EXIT',
-        title: 'Command finished',
-        body: formatCommandExitBody(displayCommand, exitCode),
-      };
-    }
-  }
-
   // --- Deferred terminal notifications ---
 
   private deferOrDeliverNotification(
@@ -905,23 +939,27 @@ export class AlertManager {
     entry: AlertEntry,
     notification: ActivityNotification,
   ): void {
-    // Once any track rings, another source only enriches the same summons. There
-    // is no fresh transition left for animation deferral to suppress. An already
-    // pending deferral keeps deferring: a command boundary resets the detector,
-    // so `isConfirmedBusy` alone could release a notification before quiet.
+    // Once a ring is active, another source only enriches the same summons.
+    // There is no fresh transition left for animation deferral to suppress, and
+    // none for an absorbed report either. An already pending deferral keeps
+    // deferring: a command boundary resets the detector, so `isConfirmedBusy`
+    // alone could release a notification before quiet.
     if (
       this.deferAlertsUntilQuiet
-      && !this.hasActiveRing(entry)
+      && entry.ring === null
+      && !reportIsAcknowledged(entry)
       && (entry.deferredNotification !== null || entry.detector.isConfirmedBusy())
     ) {
-      // Latest wins, matching repeated notifications on an already-ringing track.
+      // Latest wins, matching repeated notifications on a ring; the ceiling
+      // still counts from the first.
       entry.deferredNotification = notification;
+      entry.deferredSince ??= Date.now();
       this.scheduleDeferredNotification(id, entry);
     } else {
       // An existing ring means this is enrichment, not a fresh summons. Cancel
       // any older pending detail so it cannot overwrite this notification later.
       this.clearDeferredNotification(entry);
-      this.applyProtocolRinging(entry, notification);
+      this.raiseRing(entry, 'report', notification);
     }
     // The caller may have cleared a publicly visible cycle and delegated the
     // publish to the ring rules; deferring the ring must not swallow it.
@@ -929,19 +967,24 @@ export class AlertManager {
   }
 
   /**
-   * Wake at the detector's quiet deadline, re-arming for the remainder if
-   * output moved it — so continuing output costs one timer per quiet window
-   * rather than one per PTY chunk. Mostly the detector's own settle gets there
-   * first and this is a no-op; it is load-bearing only after a command boundary
-   * resets the detector, which kills the settle that would have flushed.
+   * Wake at the earlier of the detector's quiet deadline and the deferral
+   * ceiling, re-arming for the remainder if output moved the former — so
+   * continuing output costs one timer per quiet window rather than one per PTY
+   * chunk. Mostly the detector's own settle gets there first; the timer is
+   * load-bearing after a command boundary resets the detector, which kills the
+   * settle that would have flushed, and for output that never goes quiet.
    */
   private scheduleDeferredNotification(id: string, entry: AlertEntry): void {
     if (entry.deferredNotificationTimer !== null) clearTimeout(entry.deferredNotificationTimer);
+    const dueAt = (): number => Math.min(
+      entry.detector.quietAt(),
+      (entry.deferredSince ?? Date.now()) + cfg.alert.deferCeiling,
+    );
     entry.deferredNotificationTimer = setTimeout(() => {
       entry.deferredNotificationTimer = null;
-      if (entry.detector.quietAt() > Date.now()) this.scheduleDeferredNotification(id, entry);
+      if (dueAt() > Date.now()) this.scheduleDeferredNotification(id, entry);
       else this.flushDeferredNotification(id, entry);
-    }, Math.max(0, entry.detector.quietAt() - Date.now()));
+    }, Math.max(0, dueAt() - Date.now()));
   }
 
   private flushDeferredNotification(id: string, entry: AlertEntry): void {
@@ -953,7 +996,7 @@ export class AlertManager {
     // timer-side safety rule shared by every delayed alarm path.
     if (this.hasAttention(id)) return;
 
-    this.applyProtocolRinging(entry, notification);
+    this.raiseRing(entry, 'report', notification);
     this.notify(id);
   }
 
@@ -963,60 +1006,93 @@ export class AlertManager {
       entry.deferredNotificationTimer = null;
     }
     entry.deferredNotification = null;
+    entry.deferredSince = null;
   }
 
   /**
-   * Release every latched ring across the three tracks, plus any delivery still
-   * deferred behind animation — a path that stops summoning the user must never
-   * leave a timer that summons them a second later. Returns whether a ring was
-   * actually active; a cancelled deferral was never visible and does not count.
+   * The one path every ring takes (`docs/specs/alert.md` -> Clearing And TODO).
+   * Opening a ring starts an episode and sets TODO whatever the source; a
+   * source joining an active ring enriches that same summons, its detail shown
+   * only if at least as rich as what is shown. A report about a state the user
+   * already acknowledged, with no output since, updates the receipt and opens
+   * nothing.
    */
-  private clearAllRingsIfActive(entry: AlertEntry): boolean {
-    this.clearDeferredNotification(entry);
-    // Release all three, no short-circuit.
-    const released = [
-      this.releaseRing(entry, 'protocol'),
-      this.releaseRing(entry, 'commandExit'),
-      this.releaseRing(entry, 'watching'),
-    ];
-    return released.includes(true);
-  }
-
-  private hasActiveRing(entry: AlertEntry): boolean {
-    return entry.protocolStatus === 'ALERT_RINGING'
-      || entry.commandExitStatus === 'ALERT_RINGING'
-      || entry.watchingRingingCommand !== null;
+  private raiseRing(
+    entry: AlertEntry,
+    source: RingSource,
+    detail: ActivityNotification,
+    watchKey: string | null = null,
+  ): void {
+    const rank = DETAIL_RANK[detail.source];
+    let ring = entry.ring;
+    if (ring === null && source === 'report' && reportIsAcknowledged(entry)) {
+      entry.todo = true;
+      if (entry.notification === null || rank >= DETAIL_RANK[entry.notification.source]) entry.notification = detail;
+      return;
+    }
+    if (ring === null) {
+      ring = {
+        episode: createAlertEpisode(),
+        sources: [],
+        watchKey: null,
+        setTodo: !entry.todo,
+        priorNotification: entry.notification,
+        detailRank: -1,
+      };
+      entry.ring = ring;
+      entry.todo = true;
+      entry.acked = null;
+    }
+    if (!ring.sources.includes(source)) ring.sources.push(source);
+    if (rank >= ring.detailRank) {
+      ring.detailRank = rank;
+      entry.notification = detail;
+    }
+    if (source === 'watching') {
+      ring.watchKey = watchKey;
+      entry.outputSinceWatchingRing = false;
+    }
   }
 
   /**
-   * Open a delivery episode only when no track is ringing yet, so a track
-   * latching behind an already-ringing one enriches that same summons. Nothing
-   * closes one: `getState` masks a stale episode to `null` while no track rings.
+   * Take one source off the ring — an await consumed it, watched work resumed,
+   * or its rule was removed. A ring left empty takes back what it did to TODO:
+   * the TODO it set, and the notification it replaced. Never an acknowledgement.
+   * Returns whether the source was there.
    */
-  private openEpisode(entry: AlertEntry): void {
-    if (!this.hasActiveRing(entry)) entry.episode = createAlertEpisode();
+  private withdrawRingSource(entry: AlertEntry, source: RingSource): boolean {
+    const ring = entry.ring;
+    if (ring === null || !ring.sources.includes(source)) return false;
+    ring.sources = ring.sources.filter((candidate) => candidate !== source);
+    if (source === 'watching') {
+      ring.watchKey = null;
+      entry.outputSinceWatchingRing = false;
+    }
+    if (ring.sources.length === 0) {
+      entry.ring = null;
+      if (ring.setTodo) entry.todo = false;
+      entry.notification = ring.priorNotification;
+    }
+    return true;
   }
 
-  /** Release one track's latched ring. Returns whether it was ringing. */
-  private releaseRing(entry: AlertEntry, track: 'protocol' | 'commandExit' | 'watching'): boolean {
-    switch (track) {
-      case 'protocol':
-        if (entry.protocolStatus !== 'ALERT_RINGING') return false;
-        entry.protocolStatus = 'IDLE';
-        entry.progress = null;
-        return true;
-      case 'commandExit':
-        if (entry.commandExitStatus !== 'ALERT_RINGING') return false;
-        entry.commandExitStatus = 'IDLE';
-        return true;
-      case 'watching':
-        if (entry.watchingRingingCommand === null) return false;
-        entry.watchingRingingCommand = null;
-        entry.outputSinceWatchingRing = false;
-        // Releasing a WATCHING ring starts the detector over, so the tail of
-        // the run that just rang cannot immediately settle again.
-        entry.detector.reset();
-        return true;
+  /**
+   * A user verb stops the summons: the whole ring goes, with any delivery still
+   * deferred behind animation — a path that stops summoning the user must never
+   * leave a timer that summons them a second later. TODO is the caller's to
+   * decide. Only clearing an actual ring records an acknowledgement.
+   */
+  private clearRingForUser(entry: AlertEntry): void {
+    this.clearDeferredNotification(entry);
+    const ring = entry.ring;
+    if (ring === null) return;
+    entry.ring = null;
+    entry.acked = { outputSince: false };
+    if (ring.sources.includes('watching')) {
+      entry.outputSinceWatchingRing = false;
+      // Starting the detector over keeps the tail of the run that just rang
+      // from settling again straight away.
+      entry.detector.reset();
     }
   }
 
@@ -1055,8 +1131,8 @@ export class AlertManager {
     if (this.inert(id)) return;
     const entry = this.getOrCreateEntry(id);
     this.setAttention(id);
-
-    if (this.clearAllRingsIfActive(entry)) entry.todo = true;
+    // A ring already set TODO, so clearing it leaves the TODO behind.
+    this.clearRingForUser(entry);
     this.markCommandExitSeen(entry);
     this.notify(id);
   }
@@ -1078,12 +1154,11 @@ export class AlertManager {
     const entry = this.entries.get(id);
     if (!entry) return;
 
-    // Dismissing a ring leaves the TODO behind, so the summons is not lost. A
+    // Dismissing a ring leaves its TODO behind, so the summons is not lost. A
     // Session with nothing ringing has nothing to dismiss, and must keep any
     // notification still deferred behind animation.
-    if (!this.hasActiveRing(entry)) return;
-    this.clearAllRingsIfActive(entry);
-    entry.todo = true;
+    if (entry.ring === null) return;
+    this.clearRingForUser(entry);
     this.notify(id);
   }
 
@@ -1094,16 +1169,7 @@ export class AlertManager {
     const entry = this.getOrCreateEntry(id);
     entry.todo = !entry.todo;
     if (!entry.todo) entry.notification = null;
-    this.clearAllRingsIfActive(entry);
-    this.notify(id);
-  }
-
-  markTodo(id: string): void {
-    if (this.inert(id)) return;
-    const entry = this.getOrCreateEntry(id);
-    const cleared = this.clearAllRingsIfActive(entry);
-    if (entry.todo && !cleared) return;
-    entry.todo = true;
+    this.clearRingForUser(entry);
     this.notify(id);
   }
 
@@ -1112,9 +1178,8 @@ export class AlertManager {
     const entry = this.getOrCreateEntry(id);
     entry.todo = false;
     entry.notification = null;
-    // A WATCHING ring may not have created TODO yet; clearing must still
-    // release it and any deferred notification. `notify` dedupes unchanged state.
-    this.clearAllRingsIfActive(entry);
+    // Also releases any deferred notification. `notify` dedupes unchanged state.
+    this.clearRingForUser(entry);
     this.notify(id);
   }
 
@@ -1129,7 +1194,7 @@ export class AlertManager {
       todo: entry.todo,
       notification: entry.notification,
       awaited: (this.awaits.get(id)?.waiters.size ?? 0) > 0,
-      episode: this.hasActiveRing(entry) ? entry.episode : null,
+      episode: entry.ring?.episode ?? null,
     };
   }
 
@@ -1178,9 +1243,9 @@ export class AlertManager {
     const entry = this.getOrCreateEntry(id);
     entry.todo = state.todo === true;
     entry.notification = entry.todo ? normalizeActivityNotification(state.notification) : null;
-    entry.watchingRingingCommand = null;
+    entry.ring = null;
     entry.outputSinceWatchingRing = false;
-    entry.protocolStatus = 'IDLE';
+    entry.acked = null;
     entry.progress = null;
     entry.commandExitStatus = 'IDLE';
     entry.commandExitWatch = null;
@@ -1217,8 +1282,8 @@ export class AlertManager {
     return snapshot;
   }
 
-  /** Resume live state before replay; unlike seed, this preserves track and
-   *  episode identity. `replayRequestId` names the one since-mark replay that
+  /** Resume live state before replay; unlike seed, this preserves the ring and
+   *  its episode identity. `replayRequestId` names the one since-mark replay that
    *  `applyReplay` treats as live output. */
   resumeFromTransfer(id: string, snapshot: AlertRuntimeSnapshot, replayRequestId?: string): void {
     if (this.helpers.has(id)) return;
@@ -1234,10 +1299,7 @@ export class AlertManager {
     entry.deferredNotificationTimer = null;
     entry.detector = this.createDetector(id);
     entry.detector.restore(detector);
-    if (entry.watchingRingingCommand !== null && watchRuleFor(this.watchedCommands, entry.watchingRingingCommand) === null) {
-      entry.watchingRingingCommand = null;
-      entry.outputSinceWatchingRing = false;
-    }
+    this.withdrawUncoveredWatchingRing(entry);
     if (entry.deferredNotification) {
       if (this.deferAlertsUntilQuiet) this.scheduleDeferredNotification(id, entry);
       else this.flushDeferredNotification(id, entry);
@@ -1308,8 +1370,8 @@ export class AlertManager {
   }
 
   private getProjectedStatus(entry: AlertEntry): SessionStatus {
-    if (this.hasActiveRing(entry)) return 'ALERT_RINGING';
-    if (entry.protocolStatus === 'OSC_NOTIF_BUSY') return 'OSC_NOTIF_BUSY';
+    if (entry.ring !== null) return 'ALERT_RINGING';
+    if (entry.progress !== null) return 'OSC_NOTIF_BUSY';
     // WATCHING outranks the command-exit arm: a watched command is by
     // definition running, so COMMAND_EXIT_ARMED would otherwise mask the
     // detector's busy/quiet states for the entire run. The detector is derived
@@ -1324,10 +1386,9 @@ export class AlertManager {
     if (!entry) {
       entry = {
         detector: this.createDetector(id),
-        watchingRingingCommand: null,
+        ring: null,
         outputSinceWatchingRing: false,
-        episode: null,
-        protocolStatus: 'IDLE',
+        acked: null,
         progress: null,
         commandExitStatus: 'IDLE',
         commandExitWatch: null,
@@ -1335,6 +1396,7 @@ export class AlertManager {
         todo: false,
         notification: null,
         deferredNotification: null,
+        deferredSince: null,
         deferredNotificationTimer: null,
       };
       this.entries.set(id, entry);
@@ -1390,6 +1452,23 @@ function settledAwait(outcome: AwaitOutcome): AwaitHandle {
   return { promise: Promise.resolve(outcome), cancel: () => {} };
 }
 
+/** The user cleared a ring and nothing has been output since, so a report now
+ *  describes the state they already acknowledged. */
+function reportIsAcknowledged(entry: AlertEntry): boolean {
+  return entry.acked !== null && !entry.acked.outputSince;
+}
+
+/** Names the running command when there is one (`docs/specs/alert.md` -> Terminal reports). */
+function progressTitle(watch: CommandExitWatch | null, outcome: 'complete' | 'warning' | 'error'): string {
+  const command = watch === null ? null : watch.watchKey ?? watch.displayCommand;
+  if (command === null) {
+    return outcome === 'error' ? 'Progress error' : outcome === 'warning' ? 'Progress warning' : 'Progress complete';
+  }
+  return outcome === 'error'
+    ? `${command} reported an error`
+    : outcome === 'warning' ? `${command} finished with a warning` : `${command} finished`;
+}
+
 function formatCommandExitBody(displayCommand: string, exitCode: number | undefined): string {
   const command = displayCommand.trim() || DEFAULT_COMMAND_TITLE;
   if (exitCode === undefined) return command;
diff --git a/lib/src/lib/alert-resumed-output.test.ts b/lib/src/lib/alert-resumed-output.test.ts
index a065c63fc..814f41529 100644
--- a/lib/src/lib/alert-resumed-output.test.ts
+++ b/lib/src/lib/alert-resumed-output.test.ts
@@ -9,6 +9,7 @@ import { watchUnattendedRings } from './alert-ring-watch';
 import { startAlertSpeech } from './alert-speech';
 import { applyAlertSettingsFromHost, DEFAULT_ALERT_SETTINGS } from './alert-settings';
 import { clearTerminalActivity, setTerminalActivity } from './session-activity-store';
+import { cfg } from '../cfg';
 
 const ID = 'resumed-watched-work';
 const DELAY = 10_000;
@@ -126,10 +127,10 @@ describe('WATCHING output resuming before alarm delivery', () => {
     expect(manager.getState(ID)).toMatchObject({ status: 'BUSY', todo: true, notification: receipt.notification });
   });
 
-  it.each(['protocol', 'command-exit'] as const)('preserves an authoritative %s ring behind WATCHING', (track) => {
-    manager.setInactivityTimeoutMs(3_000);
+  it.each(['protocol', 'command-exit'] as const)('preserves an authoritative %s source behind WATCHING', (track) => {
     manager.attend(ID);
     manager.clearAttention(ID);
+    vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
     busy();
     settle();
     if (track === 'protocol') {
diff --git a/lib/src/lib/alert-runtime-transfer.test.ts b/lib/src/lib/alert-runtime-transfer.test.ts
index b9286923a..830250ac3 100644
--- a/lib/src/lib/alert-runtime-transfer.test.ts
+++ b/lib/src/lib/alert-runtime-transfer.test.ts
@@ -21,7 +21,9 @@ describe('live alert handoff', () => {
     target.notifyFromProtocol('pane', { source: 'BEL', title: 'More detail', body: null });
     expect(target.getState('pane').episode).toEqual(first.episode);
     target.dismissAlert('pane');
+    target.onData('pane');
     target.notifyFromProtocol('pane', { source: 'BEL', title: 'Next', body: null });
+    expect(target.getState('pane').episode?.id).toBeTruthy();
     expect(target.getState('pane').episode?.id).not.toBe(first.episode?.id);
     target.seed('pane', snapshot);
     expect(target.getState('pane')).toMatchObject({ todo: true, episode: null });
diff --git a/lib/src/lib/platform/fake-adapter.test.ts b/lib/src/lib/platform/fake-adapter.test.ts
index 37b263298..a66e7af91 100644
--- a/lib/src/lib/platform/fake-adapter.test.ts
+++ b/lib/src/lib/platform/fake-adapter.test.ts
@@ -81,6 +81,18 @@ describe('FakePtyAdapter', () => {
     });
   });
 
+  it('judges a report after the command boundary written before it', async () => {
+    const { adapter } = createAdapter();
+    adapter.spawnPty('t1');
+    adapter.sendOutput('t1', '\x1b]633;E;./build.sh\x07\x1b]633;C\x07');
+    const handle = adapter.alertAwait('t1', { until: 'quiet', timeoutMs: 600_000 });
+
+    // A precmd hook reports after the shell's finish, in the same read.
+    adapter.sendOutput('t1', '\x1b]633;D;0\x07\x1b]777;notify;Command completed;./build.sh\x1b\\');
+
+    await expect(handle.promise).resolves.toMatchObject({ kind: 'resolved', cause: 'exit' });
+  });
+
   it('parses terminal bell output into alert state without forwarding the bell byte', () => {
     const { adapter, dataEvents } = createAdapter();
     const alertEvents: unknown[] = [];
diff --git a/lib/src/lib/platform/fake-adapter.ts b/lib/src/lib/platform/fake-adapter.ts
index f18ab9ccf..b0c7f2b3f 100644
--- a/lib/src/lib/platform/fake-adapter.ts
+++ b/lib/src/lib/platform/fake-adapter.ts
@@ -10,7 +10,6 @@ import {
   type MemoryNotepadArchivePort,
 } from '../notepad/memory-archive-port';
 import {
-  applyTerminalProtocolEvents,
   collectTerminalSemanticEvents,
   collectTerminalProtocolResponses,
   TerminalProtocolParser,
@@ -19,6 +18,7 @@ import {
 import {
   applyTerminalSemanticEvents,
 } from '../terminal-state-store';
+import { recordToolEvents } from '../tool-events';
 import { themeColorProvider } from '../terminal-theme';
 
 export interface FakeScenario {
@@ -340,7 +340,6 @@ export class FakePtyAdapter implements PlatformAdapter {
   alertResize(id: string): void { this.alertManager.onResize(id); }
   alertClearAttention(id?: string): void { this.alertManager.clearAttention(id); }
   alertToggleTodo(id: string): void { this.alertManager.toggleTodo(id); }
-  alertMarkTodo(id: string): void { this.alertManager.markTodo(id); }
   alertClearTodo(id: string): void { this.alertManager.clearTodo(id); }
   alertAwait(id: string, options: AwaitOptions): AwaitHandle { return this.alertManager.awaitCompletion(id, options); }
   onAlertState(handler: (detail: AlertStateDetail) => void): void { this.alertStateHandlers.add(handler); }
@@ -460,10 +459,9 @@ export class FakePtyAdapter implements PlatformAdapter {
 
   private emitPtyData(id: string, data: string, options: { skipActivity?: boolean } = {}): void {
     const parsed = this.getProtocolParser(id).process(data);
-    applyTerminalProtocolEvents(this.alertManager, id, parsed.events);
-    const semanticEvents = collectTerminalSemanticEvents(parsed.events);
-    this.alertManager.applyTerminalSemanticEvents(id, semanticEvents);
-    applyTerminalSemanticEvents(id, semanticEvents);
+    recordToolEvents(id, parsed.events);
+    this.alertManager.applyTerminalEvents(id, parsed.events);
+    applyTerminalSemanticEvents(id, collectTerminalSemanticEvents(parsed.events));
     const inputHandler = this.inputHandlers.get(id);
     for (const response of collectTerminalProtocolResponses(parsed.events)) {
       inputHandler?.(response);
diff --git a/lib/src/lib/platform/types.ts b/lib/src/lib/platform/types.ts
index aec194dd4..6090f2af5 100644
--- a/lib/src/lib/platform/types.ts
+++ b/lib/src/lib/platform/types.ts
@@ -475,7 +475,6 @@ export interface PlatformAdapter {
   alertResize(id: string): void;
   alertClearAttention(id?: string): void;
   alertToggleTodo(id: string): void;
-  alertMarkTodo(id: string): void;
   alertClearTodo(id: string): void;
   /**
    * Park until the Session finishes what it is doing (`docs/specs/alert.md` ->
diff --git a/lib/src/lib/platform/vscode-adapter.ts b/lib/src/lib/platform/vscode-adapter.ts
index a364db942..e1c032ba2 100644
--- a/lib/src/lib/platform/vscode-adapter.ts
+++ b/lib/src/lib/platform/vscode-adapter.ts
@@ -602,10 +602,6 @@ export class VSCodeAdapter implements PlatformAdapter {
     this.vscode.postMessage({ type: 'alert:toggleTodo', id });
   }
 
-  alertMarkTodo(id: string): void {
-    this.vscode.postMessage({ type: 'alert:markTodo', id });
-  }
-
   alertClearTodo(id: string): void {
     this.vscode.postMessage({ type: 'alert:clearTodo', id });
   }
diff --git a/lib/src/lib/reconnect.test.ts b/lib/src/lib/reconnect.test.ts
index 735e4e6e2..c9ae36a14 100644
--- a/lib/src/lib/reconnect.test.ts
+++ b/lib/src/lib/reconnect.test.ts
@@ -76,7 +76,6 @@ function createPlatform(ptys: PtyInfo[], savedState: PersistedSession | null): P
     alertResize: vi.fn(),
     alertClearAttention: vi.fn(),
     alertToggleTodo: vi.fn(),
-    alertMarkTodo: vi.fn(),
     alertClearTodo: vi.fn(),
     onAlertState: vi.fn(),
     onWatchedCommands: vi.fn(),
diff --git a/lib/src/lib/session-activity-store.ts b/lib/src/lib/session-activity-store.ts
index 6c29cbe7b..67a760f3b 100644
--- a/lib/src/lib/session-activity-store.ts
+++ b/lib/src/lib/session-activity-store.ts
@@ -165,14 +165,6 @@ export function toggleSessionTodo(id: string): void {
   getPlatform().alertToggleTodo(id);
 }
 
-export function markSessionTodo(id: string): void {
-  if (!registry.has(id)) {
-    setLocalSurfaceTodo(id, true);
-    return;
-  }
-  getPlatform().alertMarkTodo(id);
-}
-
 export function clearSessionTodo(id: string): void {
   if (!registry.has(id)) {
     setLocalSurfaceTodo(id, false);
diff --git a/lib/src/lib/session-restore.test.ts b/lib/src/lib/session-restore.test.ts
index 9763db83d..69e7998dd 100644
--- a/lib/src/lib/session-restore.test.ts
+++ b/lib/src/lib/session-restore.test.ts
@@ -52,7 +52,6 @@ function createPlatform(
     alertResize: vi.fn(),
     alertClearAttention: vi.fn(),
     alertToggleTodo: vi.fn(),
-    alertMarkTodo: vi.fn(),
     alertClearTodo: vi.fn(),
     onAlertState: vi.fn(),
     onWatchedCommands: vi.fn(),
diff --git a/lib/src/lib/session-save.test.ts b/lib/src/lib/session-save.test.ts
index 385408b7c..ead773a58 100644
--- a/lib/src/lib/session-save.test.ts
+++ b/lib/src/lib/session-save.test.ts
@@ -53,7 +53,6 @@ function createPlatform(savedState: PersistedSession | null): PlatformAdapter {
     alertResize: () => {},
     alertClearAttention: () => {},
     alertToggleTodo: () => {},
-    alertMarkTodo: () => {},
     alertClearTodo: () => {},
     onAlertState: () => {},
     onWatchedCommands: () => {},
diff --git a/lib/src/lib/session-types.ts b/lib/src/lib/session-types.ts
index d0b71d412..e0ba37db6 100644
--- a/lib/src/lib/session-types.ts
+++ b/lib/src/lib/session-types.ts
@@ -54,7 +54,9 @@ export function toPersistedAlertState(state: PersistedAlertState): PersistedAler
   return {
     status: state.status,
     todo: state.todo,
-    notification: state.notification ?? null,
+    // Builds before the `WATCHING` source reject a whole session that carries
+    // it, so that detail stays live-only (`docs/specs/alert.md` -> Public State).
+    notification: state.notification?.source === 'WATCHING' ? null : state.notification ?? null,
   };
 }
 
diff --git a/lib/src/lib/terminal-protocol.test.ts b/lib/src/lib/terminal-protocol.test.ts
index 8d1421fb3..54cd27a01 100644
--- a/lib/src/lib/terminal-protocol.test.ts
+++ b/lib/src/lib/terminal-protocol.test.ts
@@ -59,6 +59,16 @@ describe('TerminalProtocolParser', () => {
     ]);
   });
 
+  it.each([
+    ['a mid-cycle progress update', '\x1b]9;4;1;40\x07\x07'],
+    ['a progress clear', '\x07\x1b]9;4;0;\x07'],
+  ])('keeps a bell that shares its batch with %s', (_label, chunk) => {
+    const result = new TerminalProtocolParser().process(chunk);
+    expect(result.events).toContainEqual(
+      { kind: 'notification', notification: { source: 'BEL', title: 'Terminal bell', body: null } },
+    );
+  });
+
   it('handles chunked OSC sequences terminated by ST', () => {
     const parser = new TerminalProtocolParser();
 
diff --git a/lib/src/lib/terminal-protocol.ts b/lib/src/lib/terminal-protocol.ts
index 18c46a988..d4531b50c 100644
--- a/lib/src/lib/terminal-protocol.ts
+++ b/lib/src/lib/terminal-protocol.ts
@@ -567,16 +567,17 @@ function stripStandaloneBells(segment: string, events: TerminalProtocolEvent[]):
   return segment.replace(/\x07/g, '');
 }
 
+/** Only text-bearing notification detail suppresses the batch's bells: a
+ *  progress event may carry no summons at all (`docs/specs/alert.md` ->
+ *  Terminal reports). Several bells still collapse to one. */
 function filterTerminalBellEvents(events: TerminalProtocolEvent[]): TerminalProtocolEvent[] {
   if (events.length === 0) return events;
   let bellCount = 0;
   let hasRicher = false;
   for (const event of events) {
-    if (event.kind === 'progress') hasRicher = true;
-    else if (event.kind === 'notification') {
-      if (event.notification.source === 'BEL') bellCount += 1;
-      else hasRicher = true;
-    }
+    if (event.kind !== 'notification') continue;
+    if (event.notification.source === 'BEL') bellCount += 1;
+    else hasRicher = true;
   }
   if (bellCount === 0) return events;
   if (!hasRicher && bellCount === 1) return events;
diff --git a/lib/src/lib/terminal-registry.alert.test.ts b/lib/src/lib/terminal-registry.alert.test.ts
index bfb82c655..c6de392a9 100644
--- a/lib/src/lib/terminal-registry.alert.test.ts
+++ b/lib/src/lib/terminal-registry.alert.test.ts
@@ -131,7 +131,6 @@ import {
   setCommandWatched,
   isUntouched,
   markSessionAttention,
-  markSessionTodo,
   setTerminalActivity,
   resumeTerminal,
   restoreTerminal,
@@ -435,7 +434,7 @@ describe('terminal-registry alert behavior', () => {
     initAlertStateReceiver();
     initAlertStateReceiver();
     const unsubscribe = subscribeToActivity(listener);
-    platformModule.getPlatform().alertMarkTodo(id);
+    platformModule.getPlatform().alertToggleTodo(id);
 
     expect(listener).toHaveBeenCalledTimes(1);
     expect(getActivity(id).todo).toBe(true);
@@ -625,7 +624,7 @@ describe('terminal-registry alert behavior', () => {
     advance(3_000);
     expect(getActivity(id)).toMatchObject({
       status: 'ALERT_RINGING',
-      todo: false,
+      todo: true,
     });
   });
 
@@ -659,7 +658,7 @@ describe('terminal-registry alert behavior', () => {
     });
   });
 
-  it('Story 5: user attends to a ringing pane — turns TODO on', () => {
+  it('Story 5: user attends to a ringing pane — its TODO stays', () => {
     const id = 'story-5';
     createSession(id);
     enableAlert(id);
@@ -673,7 +672,7 @@ describe('terminal-registry alert behavior', () => {
     });
   });
 
-  it('Story 6: dismiss resets to NOTHING_TO_SHOW and turns TODO on; can ring again later', () => {
+  it('Story 6: dismiss resets to NOTHING_TO_SHOW and keeps the TODO; can ring again later', () => {
     const id = 'story-6';
     createSession(id);
     enableAlert(id);
@@ -697,17 +696,18 @@ describe('terminal-registry alert behavior', () => {
     });
   });
 
-  it('Story 7: marking TODO clears ring and resets status, leaves alerts enabled', () => {
+  it('Story 7: toggling TODO on a ringing pane clears both, leaves alerts enabled', () => {
     const id = 'story-7';
     createSession(id);
     enableAlert(id);
 
     driveToRingingNeedsAttention(id);
-    markSessionTodo(id);
+    toggleSessionTodo(id);
 
     expect(getActivity(id)).toMatchObject({
       status: 'NOTHING_TO_SHOW',
-      todo: true,
+      watchingEnabled: true,
+      todo: false,
     });
   });
 
@@ -832,7 +832,7 @@ describe('terminal-registry alert behavior', () => {
 
     expect(getActivity(id)).toMatchObject({
       status: 'ALERT_RINGING',
-      todo: false,
+      todo: true,
     });
   });
 
@@ -882,12 +882,7 @@ describe('terminal-registry alert behavior', () => {
     createSession(id);
     enableAlert(id);
     driveToRingingNeedsAttention(id);
-    toggleSessionTodo(id);
-
-    expect(getActivity(id)).toMatchObject({
-      status: 'NOTHING_TO_SHOW',
-      todo: true,
-    });
+    expect(getActivity(id).todo).toBe(true);
 
     disposeSession(id);
     expect(getActivity(id)).toEqual(DEFAULT_ACTIVITY_STATE);
@@ -903,7 +898,7 @@ describe('terminal-registry alert behavior', () => {
 
     expect(getActivity(id)).toMatchObject({
       status: 'ALERT_RINGING',
-      todo: false,
+      todo: true,
     });
   });
 
@@ -915,7 +910,7 @@ describe('terminal-registry alert behavior', () => {
     driveToRingingNeedsAttention(id);
     entry.terminal.emitInput('x');
 
-    // Typing while ringing: attend clears ring, turns TODO on.
+    // Typing while ringing: attend clears the ring and leaves its TODO.
     // Plain 'x' is not Enter, so TODO stays on.
     expect(getActivity(id).status).toBe('NOTHING_TO_SHOW');
     expect(getActivity(id).todo).toBe(true);
@@ -970,27 +965,13 @@ describe('terminal-registry alert behavior', () => {
       entry.terminal.emitInput(input);
       expect(write).toHaveBeenCalledWith(id, input);
       expect(attend).not.toHaveBeenCalled();
-      expect(getActivity(id)).toMatchObject({ status: 'ALERT_RINGING', todo: false });
+      expect(getActivity(id)).toMatchObject({ status: 'ALERT_RINGING' });
     } finally {
       attend.mockRestore();
       write.mockRestore();
     }
   });
 
-  it('Enter that dismisses a ringing alert leaves the auto-created TODO visible', () => {
-    const id = 'enter-dismisses-ringing';
-    const entry = createSession(id);
-    enableAlert(id);
-
-    driveToRingingNeedsAttention(id);
-    entry.terminal.emitInput('\r');
-
-    expect(getActivity(id)).toMatchObject({
-      status: 'NOTHING_TO_SHOW',
-      todo: true,
-    });
-  });
-
   it('no monitor is created until alert is enabled', () => {
     const id = 'no-monitor';
     createSession(id);
@@ -1137,31 +1118,18 @@ describe('terminal-registry alert behavior', () => {
     expect(getActivity(id).todo).toBe(false);
   });
 
-  it('new output while ringing without attention does not turn TODO on', () => {
-    const id = 'ringing-output-no-todo';
-    createSession(id);
-    enableAlert(id);
-
-    driveToRingingNeedsAttention(id);
-    emitOutput(id, 'next task');
-
-    expect(getActivity(id)).toMatchObject({
-      status: 'ALERT_RINGING',
-      todo: false,
-    });
-  });
-
-  it('removing the rule while ringing does not turn TODO on', () => {
-    const id = 'disable-no-todo';
+  it('removing the rule while ringing keeps a TODO the pane already had', () => {
+    const id = 'disable-keeps-todo';
     createSession(id);
     enableAlert(id);
+    toggleSessionTodo(id);
 
     driveToRingingNeedsAttention(id);
     setCommandWatched('longtask', false);
 
     expect(getActivity(id)).toMatchObject({
       status: 'WATCHING_DISABLED',
-      todo: false,
+      todo: true,
     });
   });
 
@@ -1207,7 +1175,7 @@ describe('terminal-registry alert behavior', () => {
     expect(getWatchedCommands()).toEqual([]);
   });
 
-  it('the alert action dismisses ringing alerts and turns TODO on', () => {
+  it('the alert action dismisses ringing alerts and keeps their TODO', () => {
     const id = 'alert-action-dismiss';
     createSession(id);
     enableAlert(id);
@@ -1273,7 +1241,7 @@ describe('terminal-registry alert behavior', () => {
 
     expect(getActivity(id)).toMatchObject({
       status: 'ALERT_RINGING',
-      todo: false,
+      todo: true,
     });
   });
 
diff --git a/lib/src/lib/terminal-registry.ts b/lib/src/lib/terminal-registry.ts
index 5b3d2833e..5c2554b43 100644
--- a/lib/src/lib/terminal-registry.ts
+++ b/lib/src/lib/terminal-registry.ts
@@ -26,7 +26,6 @@ export {
   getLivePersistedAlertState,
   initAlertStateReceiver,
   markSessionAttention,
-  markSessionTodo,
   setTerminalActivity,
   restoreBrowserSurfaceTodo,
   subscribeToActivity,
diff --git a/lib/src/remote/client/remote-adapter.ts b/lib/src/remote/client/remote-adapter.ts
index 4739d4c8e..27bcfee5f 100644
--- a/lib/src/remote/client/remote-adapter.ts
+++ b/lib/src/remote/client/remote-adapter.ts
@@ -352,7 +352,6 @@ export class RemotePtyAdapter implements PlatformAdapter {
   alertResize(): void {}
   alertClearAttention(): void {}
   alertToggleTodo(): void {}
-  alertMarkTodo(): void {}
   alertClearTodo(): void {}
   /**
    * There is no `dor` on the phone and protocol-v1 carries no await, so a
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 09e9963f4..3ae8ecd81 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -2,7 +2,7 @@
   "AGENTS.md": 3400,
   "SECURITY.md": 200,
   "SELF_HOST.md": 6100,
-  "docs/specs/alert.md": 7050,
+  "docs/specs/alert.md": 7400,
   "docs/specs/auto-update.md": 1150,
   "docs/specs/deploy.md": 1900,
   "docs/specs/dor-browser.md": 4550,
diff --git a/standalone/src/browser-sidecar-adapter.ts b/standalone/src/browser-sidecar-adapter.ts
index e20701609..a43b270fd 100644
--- a/standalone/src/browser-sidecar-adapter.ts
+++ b/standalone/src/browser-sidecar-adapter.ts
@@ -382,7 +382,6 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
   alertResize(id: string): void { this.alertManager.onResize(id); }
   alertClearAttention(id?: string): void { this.alertManager.clearAttention(id); }
   alertToggleTodo(id: string): void { this.alertManager.toggleTodo(id); }
-  alertMarkTodo(id: string): void { this.alertManager.markTodo(id); }
   alertClearTodo(id: string): void { this.alertManager.clearTodo(id); }
   alertAwait(id: string, options: AwaitOptions): AwaitHandle { return this.alertManager.awaitCompletion(id, options); }
   onAlertState(handler: (detail: AlertStateDetail) => void): void { this.alertStateHandlers.add(handler); }
diff --git a/standalone/src/tauri-adapter.ts b/standalone/src/tauri-adapter.ts
index 36fcb9721..6b0245572 100644
--- a/standalone/src/tauri-adapter.ts
+++ b/standalone/src/tauri-adapter.ts
@@ -757,10 +757,6 @@ export class TauriAdapter implements PlatformAdapter {
     this.alertManager.toggleTodo(id);
   }
 
-  alertMarkTodo(id: string): void {
-    this.alertManager.markTodo(id);
-  }
-
   alertClearTodo(id: string): void {
     this.alertManager.clearTodo(id);
   }
diff --git a/vscode-ext/src/message-router.ts b/vscode-ext/src/message-router.ts
index 63567bd14..01f04ca3d 100644
--- a/vscode-ext/src/message-router.ts
+++ b/vscode-ext/src/message-router.ts
@@ -5,12 +5,10 @@ import { AlertManager, type AwaitHandle, type AwaitOutcome } from '../../lib/src
 import { WatchedCommandHost } from '../../lib/src/lib/watched-command-host';
 import { AlertSettingsHost } from '../../lib/src/lib/alert-settings-host';
 import {
-  applyTerminalProtocolEvents,
   collectTerminalSemanticEvents,
   collectTerminalProtocolResponses,
   type TerminalColorProvider,
   type TerminalColors,
-  type TerminalProtocolEvent,
 } from '../../lib/src/lib/terminal-protocol';
 import { isProtocolCommandStart } from '../../lib/src/lib/tool-events';
 import {
@@ -292,14 +290,13 @@ function createOwnerPtyStream(id: string): ProcessedPtyStream {
   return createProcessedPtyStream({
     colorProvider: themeColorProvider,
     onEvents(events) {
-      // `applyTerminalProtocolEvents` records announcements into renderer state
-      // this process cannot reach, so the router withholds them and forwards
-      // them to the webviews instead — and only the rare chunk that carries one
-      // pays for the filtered copy.
-      const isToolEvent = (event: TerminalProtocolEvent) => event.kind === 'toolAnnounce' || event.kind === 'toolState';
-      applyTerminalProtocolEvents(alertManager, id, events.some(isToolEvent) ? events.filter(event => !isToolEvent(event)) : events);
-      // A start retires the previous command's announcement and state in the
-      // owning webview (null). Keep starts and reports in parse order, including one chunk.
+      // Reports and command boundaries in stream order, so a precmd
+      // notification is judged after the finish written before it.
+      alertManager.applyTerminalEvents(id, events);
+      // Tool announcements belong to renderer state this process cannot reach,
+      // so the router forwards them to the webviews. A start retires the
+      // previous command's announcement and state in the owning webview (null).
+      // Keep starts and reports in parse order, including one chunk.
       for (const event of events) {
         const start = isProtocolCommandStart(event);
         if (event.kind === 'toolState' || start) {
@@ -310,7 +307,6 @@ function createOwnerPtyStream(id: string): ProcessedPtyStream {
         }
       }
       const semanticEvents = collectTerminalSemanticEvents(events);
-      alertManager.applyTerminalSemanticEvents(id, semanticEvents);
       if (semanticEvents.length > 0) {
         for (const listener of semanticEventsListeners) listener(id, semanticEvents);
       }
@@ -993,9 +989,6 @@ export function attachRouter(
       case 'alert:toggleTodo':
         alertManager.toggleTodo(msg.id);
         break;
-      case 'alert:markTodo':
-        alertManager.markTodo(msg.id);
-        break;
       case 'alert:clearTodo':
         alertManager.clearTodo(msg.id);
         break;
diff --git a/vscode-ext/src/message-types.ts b/vscode-ext/src/message-types.ts
index 50bde4c96..69390b101 100644
--- a/vscode-ext/src/message-types.ts
+++ b/vscode-ext/src/message-types.ts
@@ -71,7 +71,6 @@ export type WebviewMessage =
   | { type: 'alert:resize'; id: string }
   | { type: 'alert:clearAttention'; id?: string }
   | { type: 'alert:toggleTodo'; id: string }
-  | { type: 'alert:markTodo'; id: string }
   | { type: 'alert:clearTodo'; id: string }
   // `dor await`: the AlertManager lives here, so the wait is parked in the
   // extension host and only its outcome crosses back (docs/specs/alert.md → Await).
diff --git a/vscode-ext/test/message-router.test.ts b/vscode-ext/test/message-router.test.ts
index de934e871..11995e7a8 100644
--- a/vscode-ext/test/message-router.test.ts
+++ b/vscode-ext/test/message-router.test.ts
@@ -561,6 +561,25 @@ describe('await requests', () => {
     }
   });
 
+  it('judges a report after the command boundary written before it', async () => {
+    const webview = fakeWebview();
+    const disposable = router.attachRouter(webview.channel);
+    try {
+      ptys.callbacks!.onData('pty-ordered', '\x1b]633;E;./build.sh\x07\x1b]633;C\x07');
+      webview.send({ type: 'alert:await', requestId: 'await-ordered', id: 'pty-ordered', until: 'quiet', timeoutMs: 600_000 });
+
+      // A precmd hook reports after the shell's finish, in the same read.
+      ptys.callbacks!.onData('pty-ordered', '\x1b]633;D;0\x07\x1b]777;notify;Command completed;./build.sh\x1b\\');
+      await Promise.resolve();
+
+      expect(outcomes(webview)).toEqual([
+        { type: 'alert:awaitResult', requestId: 'await-ordered', outcome: expect.objectContaining({ kind: 'resolved', cause: 'exit' }) },
+      ]);
+    } finally {
+      disposable.dispose();
+    }
+  });
+
   it('cancels what is still parked when the webview goes away', async () => {
     const webview = fakeWebview();
     const disposable = router.attachRouter(webview.channel);
diff --git a/website/src/lib/tut-detector.test.ts b/website/src/lib/tut-detector.test.ts
index ca6c3e855..25f48b982 100644
--- a/website/src/lib/tut-detector.test.ts
+++ b/website/src/lib/tut-detector.test.ts
@@ -181,6 +181,20 @@ describe("TutDetector", () => {
     expect(state.isComplete("al-ring")).toBe(true);
   });
 
+  it("credits al-todo-auto when a ring is dismissed and its TODO stays", () => {
+    const { state, setActivitySnapshot } = makeDetectorHarness();
+    const watching = { source: "WATCHING", title: "longtask went quiet", body: null } as const;
+
+    setActivitySnapshot(new Map([["pane-a", activity("BUSY")]]));
+    // The ring sets TODO itself as it opens.
+    setActivitySnapshot(new Map([["pane-a", { ...activity("ALERT_RINGING", true), notification: watching }]]));
+    expect(state.isComplete("al-todo-auto")).toBe(false);
+    expect(state.isComplete("al-todo-manual")).toBe(false);
+
+    setActivitySnapshot(new Map([["pane-a", { ...activity("NOTHING_TO_SHOW", true), notification: watching }]]));
+    expect(state.isComplete("al-todo-auto")).toBe(true);
+  });
+
   it("credits al-watch-cmd once a rule exists", () => {
     const { state, setWatchedCommands } = makeDetectorHarness();
 
diff --git a/website/src/lib/tut-detector.ts b/website/src/lib/tut-detector.ts
index 228a02f6b..c2503ae27 100644
--- a/website/src/lib/tut-detector.ts
+++ b/website/src/lib/tut-detector.ts
@@ -229,14 +229,14 @@ export class TutDetector {
         else if (TERMINAL_REPORT_SOURCES.has(source)) this.state.markComplete("al-notif");
       }
 
-      if (!prev.todo && current.todo) {
-        if (prev.status === "ALERT_RINGING") {
-          this.state.markComplete("al-todo-auto");
-        } else if (!source) {
-          // A protocol or command-exit ring sets TODO itself; only a bare
-          // TODO with no notification behind it was added by hand.
-          this.state.markComplete("al-todo-manual");
-        }
+      // Every ring sets TODO when it opens, so the dismissal is the ring
+      // ending with that TODO still standing.
+      if (prev.status === "ALERT_RINGING" && current.status !== "ALERT_RINGING" && current.todo) {
+        this.state.markComplete("al-todo-auto");
+      }
+      // Only a bare TODO with no notification behind it was added by hand.
+      if (!prev.todo && current.todo && !source) {
+        this.state.markComplete("al-todo-manual");
       }
       if (prev.todo && !current.todo) {
         this.state.markComplete("al-todo-clear");
diff --git a/website/src/lib/tut-items.ts b/website/src/lib/tut-items.ts
index a95140aac..384a70376 100644
--- a/website/src/lib/tut-items.ts
+++ b/website/src/lib/tut-items.ts
@@ -233,7 +233,7 @@ export const DESKTOP_SECTIONS: readonly Section[] = [
         id: 'al-cmd-exit',
         title: 'A long command that finished while you were away',
         hint:
-          `Press \`x\` to start a slow build in another pane, click into that pane, then click back here and wait. Dormouse rings for any command that ran longer than the inactivity timeout in Alarm settings and finished after you walked away — again, no rule needed.`,
+          `Press \`x\` to start a slow build in another pane, click into that pane, then click back here and wait. Dormouse rings for any command that ran longer than 15 seconds and finished after you walked away — again, no rule needed.`,
       },
     ],
     prose: [
diff --git a/website/src/lib/tut-runner.ts b/website/src/lib/tut-runner.ts
index 30f06a6a7..003dac843 100644
--- a/website/src/lib/tut-runner.ts
+++ b/website/src/lib/tut-runner.ts
@@ -30,6 +30,11 @@ function getDemoDurationMs(inactivityTimeoutMs: number): number {
   ) + 250;
 }
 
+/** A command-exit ring also needs the command to outlast the minimum runtime. */
+function getCommandExitDemoDurationMs(inactivityTimeoutMs: number): number {
+  return Math.max(getDemoDurationMs(inactivityTimeoutMs), cfg.alert.commandExitMinRuntime + 250);
+}
+
 /** Must stay below `busyCandidateGap` to form one activity burst. */
 export const BUSY_DEMO_INTERVAL_MS = Math.floor(cfg.alert.busyCandidateGap / 2);
 
@@ -610,7 +615,7 @@ export class TutRunner implements InteractiveProgram {
 
   private startCommandExitDemo(): void {
     this.commandExitDemoStart = Date.now();
-    this.commandExitDemoDurationMs = getDemoDurationMs(this.getInactivityTimeoutMs());
+    this.commandExitDemoDurationMs = getCommandExitDemoDurationMs(this.getInactivityTimeoutMs());
     this.onTriggerCommandExitDemo?.(this.commandExitDemoDurationMs);
     this.startSpinnerTicks();
     this.render();

From 5ac4ee218fd63ca2fecaeb9a9a1eb276420d6d01 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 23 Sep 2026 17:57:47 -0700
Subject: [PATCH 04/16] Simplify the ring record and dispatch alert events in
 one ordered pass

- Persisted sessions tolerate an unknown notification source (dropping
  only that detail); the writer strips to the sources strict older builds
  know, as a frozen allowlist.
- The ring keeps one richness helper (also used by deferral, which now
  keeps the richer report), a watching record, and the receipt it replaced;
  derived and duplicated flags are gone.
- The acknowledged-report rule lives in the completion dispatcher; the
  withdrawal reason decides whether the detector resets.
- One ordered, timestamping event dispatcher serves the VS Code host, the
  fake adapter, and live replay.
- Tests share arm/finish/heartbeat helpers; stale "track" wording fixed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 docs/specs/alert.md                           |  40 +-
 docs/specs/alert.rationale.md                 |   8 +-
 docs/specs/website-docs.md                    |   8 +-
 lib/src/components/alert-ring.tsx             |   2 +-
 .../wall/AlertRingIndicator.test.tsx          |   4 +-
 lib/src/lib/alert-manager.test.ts             | 469 +++++++-----------
 lib/src/lib/alert-manager.ts                  | 433 +++++++---------
 lib/src/lib/alert-resumed-output.test.ts      |  33 +-
 lib/src/lib/alert-runtime-transfer.test.ts    |  26 +
 lib/src/lib/platform/fake-adapter.ts          |   7 +-
 lib/src/lib/session-restore.test.ts           |  21 +
 lib/src/lib/session-types.ts                  |  43 +-
 lib/src/lib/terminal-protocol.ts              |  77 ++-
 lib/src/lib/terminal-state.ts                 |   2 +-
 vscode-ext/src/message-router.ts              |  13 +-
 website/src/lib/tut-items.ts                  |   4 +-
 website/src/pages/PlaygroundDesktop.tsx       |   2 +-
 17 files changed, 566 insertions(+), 626 deletions(-)

diff --git a/docs/specs/alert.md b/docs/specs/alert.md
index 0bca533d0..396067d3e 100644
--- a/docs/specs/alert.md
+++ b/docs/specs/alert.md
@@ -40,11 +40,11 @@ Public `status` is a projection — first match wins:
 
 `awaited` sits beside `status`: true while at least one `dor await` is parked on the Session (Await). It is derived from live waiters and **never persisted**.
 
-**Persist only** `todo` and the sanitized `notification` (plus `status` for diagnostics); restore replays those two and **must not** recreate a ring, a progress cycle, or a command-exit arm. **Never persist a `WATCHING` notification** — its TODO persists without detail (rationale). **WATCHING is never persisted per Session** — it is re-derived from the rule set below at the next command start. Replay filtering in `docs/specs/terminal-escapes.md` keeps old terminal output from firing notification side effects again.
+**Persist only** `todo` and the sanitized `notification` (plus `status` for diagnostics); restore replays those two and **must not** recreate a ring, a progress cycle, or a command-exit arm. **Must read a notification this build cannot validate as none, keeping the pane** (pinned by `keeps a pane whose notification this build cannot read, seeding its TODO without the detail` in `lib/src/lib/session-restore.test.ts`), and **never write a source outside `STRICT_READER_NOTIFICATION_SOURCES`** until no strict pre-tolerant build reads the file (rationale). **WATCHING is never persisted per Session** — it is re-derived from the rule set below at the next command start. Replay filtering in `docs/specs/terminal-escapes.md` keeps old terminal output from firing notification side effects again.
 
 **Must retain host Activity before xterm initialization and clear it on Session disposal.** Test: `preserves pre-registration activity through terminal creation and orphaning` in `lib/src/lib/terminal-registry.alert.test.ts`.
 
-Source of truth: `AlertState` / `ActivityNotification` / `SessionStatus` in `lib/src/lib/alert-manager.ts`; `QuiesceStatus` in `lib/src/lib/quiesce-detector.ts`; `ActivityState` in `lib/src/lib/session-activity-store.ts`; `toPersistedAlertState` in `lib/src/lib/session-types.ts`.
+Source of truth: `AlertState` / `ActivityNotification` / `SessionStatus` in `lib/src/lib/alert-manager.ts`; `QuiesceStatus` in `lib/src/lib/quiesce-detector.ts`; `ActivityState` in `lib/src/lib/session-activity-store.ts`; `toPersistedAlertState` / `normalizePersistedAlert` in `lib/src/lib/session-types.ts`.
 
 ## Attention
 
@@ -60,7 +60,7 @@ Source of truth: `cfg.alert` in `lib/src/cfg.ts`; `setInactivityTimeoutMs` in `l
 
 ## Completion events
 
-Every completion — a detector settle, a command finish, a direct notification, and the end of a protocol progress cycle (completion or error) — is **dispatched as a `CompletionEvent` before any suppression runs**, so an observer sees even a completion that would never have rung anyone (rationale).
+Every completion — a detector settle, a command finish, a direct notification, and the end of a protocol progress cycle (completion or error) — is **dispatched as a `CompletionEvent` before any suppression runs** (rationale).
 
 Claimants get first refusal per Session in registration order; the first to return `true` claims the event and the rest are not offered it. **A claimed event never rings, never sets TODO, and never stores an `ActivityNotification`** — it stops before the ring rules, where attention suppression and the command-exit armed and minimum-runtime checks live.
 
@@ -70,9 +70,9 @@ With `deferAlertsUntilQuiet` enabled:
 - **Never defer `MIGHT_BE_BUSY`, a detector settle, or a command-finish ring** — unconfirmed, already quiet, and authoritative respectively (rationale).
 - **Must fold a pending terminal notification into an eligible command-finish ring immediately**, so protocol detail enriches that ring instead of publishing stale later.
 - **Must defer after claimants and ring eligibility, never redispatch the historical `CompletionEvent`** (rationale).
-- **Keep pending intent live-only and bounded** to the latest protocol notification. Meaningful output moves its quiet deadline; command-boundary detector resets do not drop it.
+- **Keep pending intent live-only and bounded** to one protocol notification, chosen by richness (Clearing And TODO). Meaningful output moves its quiet deadline; command-boundary detector resets do not drop it.
 - **Cancel pending delivery on attendance, a dismissal that clears a ring, TODO changes, removal, seeding, or teardown.** A dismiss on a quiet Session keeps it: a cancelled deferral was never visible to dismiss. Disabling the setting releases it immediately; otherwise confirmed quiet raises one fresh ring, after which speech/push begin their own delays.
-- **Must ring a deferral by `cfg.alert.deferCeiling` (30 s) after the first notification deferred**, quiet or not; a latest-wins replacement keeps that start, and a live transfer carries it (rationale).
+- **Must ring a deferral by `cfg.alert.deferCeiling` (30 s) after the first notification deferred**, quiet or not; a replacement keeps that start, and a live transfer carries it (rationale).
 
 Two ordering rules:
 
@@ -108,7 +108,7 @@ An **await** parks on one Session until it finishes what it is doing, then repor
 **Resolution consumes only the ring source it resolved on**, its `cause` from *that source*: `report` → `bell`, `exit` → `exit`, `watching` → `quiet`. An await arriving mid-ring resolves immediately; under `exit` only the `exit` source counts and the await keeps waiting on the others. Two are gated:
 
 - **Skip the `exit` source while a foreground command is running** (rationale).
-- **Skip the `watching` source once output has resumed since it joined the ring** (`outputSinceWatchingRing`), and **never stand the detector in for that flag** (rationale).
+- **Skip the `watching` source once output has resumed since it joined the ring** (`outputSince`), and **never stand the detector in for that flag** (rationale).
 - **Never skip a report** — an `OSC 9` stays true until it is answered.
 - **Consuming withdraws that one source and never sets `attentionId`**; a ring it leaves empty is withdrawn (Clearing And TODO).
 
@@ -158,9 +158,9 @@ Rules:
 - **The key is `commandWatchKey(rawCommandLine)`**: the last command of a list (`&&`, `||`, `;`, `&`, newline) and the first stage of its pipeline, grouping dropped, leading `VAR=value` words and transparent wrappers (`sudo`, `npx`, …) skipped, then argv[0]'s basename minus any launcher suffix (`docs/specs/terminal-state.md`). **An unknown wrapper flag stops the skip**, keying the wrapper itself. **A script runner keys as `<runner> <script>`**, a leading `run` dropped, so `cd web && pnpm run dev` keys on `pnpm dev`; a script that is no valid key (a path) keys the runner (rationale). Where bash's `E` falls back to a line's first simple command (`docs/specs/terminal-escapes.md` → Shell-integration injection), that command keys. Pinned by `WATCHING key` in `lib/src/lib/terminal-state.test.ts`.
 - **A rule covers a key it equals, and a bare runner rule covers every `<runner> <script>` key of that runner** (rationale). `watchRuleFor` is the one matcher, for WATCHING, rule-removal silencing, and the terminal context's row.
 - **Every command boundary resets the detector** — `commandStart`, `commandFinish`, `promptStart`, `promptEnd`, and PTY exit — even without a command watch. Pinned by `resets unwatched output history on %s without a command watch` in `lib/src/lib/alert-manager.test.ts`.
-- **Editing the rule set re-derives WATCHING across every live Session immediately**, so a mid-command enable shows what that command is doing *right now* rather than a fresh `NOTHING_TO_SHOW` (rationale).
-- **A WATCHING ring outlives the command that raised it.** Watching switches off when the watched command exits; the ring keeps its `watching` source and the originating key in `watchKey`.
-- **Removing a rule withdraws the `watching` source it raised**, even after the command has exited, unless another rule still covers `watchKey`; other clearing paths follow Clearing And TODO. A command merely ending never clears the ring.
+- **Editing the rule set re-derives WATCHING across every live Session immediately**, never restarting the detector (rationale).
+- **A WATCHING ring outlives the command that raised it.** Watching switches off when the watched command exits; the ring's `watching` source keeps the originating key.
+- **Removing a rule withdraws the `watching` source it raised**, even after the command has exited, unless another rule still covers that key; other clearing paths follow Clearing And TODO. A command merely ending never clears the ring.
 - **The rule set is app-global and persisted** (`dormouse:watched-commands`), starting empty, so WATCHING is off everywhere until the user turns it on. **The host is authoritative wherever one serves several webviews** — the VS Code extension host, and the standalone sidecar — so a stale webview can neither replace unrelated rules nor keep reporting an obsolete list: the first webview's persisted copy is taken as the seed, an edit is a delta, and the host broadcasts its canonical snapshot back. The seed/mutation/broadcast wire contract is `docs/specs/transport.md`.
 
 **Limitation:** WATCHING needs the shell to report its command line — `OSC 633 ; E`, or `cmdline_url` / `cmdline` on `OSC 133 ; C` (fish ≥ 4) — beside the boundaries. A shell reporting bare `OSC 133` boundaries, or none (`docs/specs/terminal-escapes.md`), never names a command, so WATCHING never engages and the terminal context reports `No command running`. Terminal reports still work; command-exit alerting also requires semantic command boundaries. **Never route the keystroke fallback in `docs/specs/terminal-state.md` into the `AlertManager`** (rationale).
@@ -191,7 +191,7 @@ Source of truth: `commandWatchKey` / `watchRuleFor` in `lib/src/lib/terminal-sta
 
 **Terminal notifications are independent of WATCHING** and follow the deferral policy in Completion events. **Never ring an attended Session**; suppression leaves a progress cycle alone. A report raises the ring's `report` source (Clearing And TODO).
 
-**Must apply a parse batch's reports and command boundaries in stream order** (`applyTerminalEvents`), as the VS Code host and fake adapter do; standalone, receiving them as two events, still applies reports first. Pinned by `judges a notification written after a command finish against the reset detector` in `lib/src/lib/alert-manager.test.ts`.
+**Must apply a parse batch's reports and command boundaries in stream order, timestamping its semantic events once** for both the `AlertManager` and the terminal-state store; standalone, receiving them as two events, still applies reports first. Pinned by `judges a notification written after a command finish against the reset detector` in `lib/src/lib/alert-manager.test.ts`.
 
 Sequence syntax lives in `docs/specs/terminal-escapes.md`; what each means here:
 
@@ -212,9 +212,9 @@ Sequence syntax lives in `docs/specs/terminal-escapes.md`; what each means here:
   | a command boundary — start, finish, prompt, PTY exit | ends the cycle silently |
   | completion or error while attended | ends the cycle, no TODO or ring |
 
-  **Titles name the running command** (watch key, else display command): `<command> finished`, `… finished with a warning`, `… reported an error`; with none running, `Progress complete`, `Progress warning`, `Progress error`. The body is `Progress <percent>%`, or none.
+  **Titles name the running command** — its watch key, else its display command — and fall back to a generic title with none running; the body is `Progress <percent>%`, or none.
 
-Source of truth: the OSC 777 and OSC 99 grammars, parsing, sanitization limits, and OSC 99 chunk state in `lib/src/lib/terminal-protocol.ts`; `updateProtocolProgress` / `finishProtocolProgressCycle` in `lib/src/lib/alert-manager.ts`. Pinned by `silently ends a progress cycle the program abandoned` and `names the running command in a progress %s title` in `lib/src/lib/alert-manager.test.ts`.
+Source of truth: the OSC 777 and OSC 99 grammars, parsing, sanitization limits, OSC 99 chunk state, and `applyTerminalEvents` in `lib/src/lib/terminal-protocol.ts`; `updateProtocolProgress` / `finishProtocolProgressCycle` / `PROGRESS_TITLES` in `lib/src/lib/alert-manager.ts`. Pinned by `silently ends a progress cycle the program abandoned` and `names the running command in a progress %s title` in `lib/src/lib/alert-manager.test.ts`.
 
 ## Command-exit Track
 
@@ -223,7 +223,7 @@ Command-exit alerting consumes normalized semantic command events from `docs/spe
 Rules:
 
 - A command start creates `commandExitWatch` for the current foreground command. **Mark the command as seen** if the Session has attention then, or if the user attends while it is already running.
-- If attention is later lost while that same seen command is still running, set `commandExitStatus = COMMAND_EXIT_ARMED`.
+- If attention is later lost while that same seen command is still running, arm it (`commandExitWatch.armed`; public `COMMAND_EXIT_ARMED`).
 - If the same command finishes, or the PTY exits before a finish event, **ring only when all three hold**: it was armed, the Session still lacks attention, and runtime is at least `cfg.alert.commandExitMinRuntime` (15 s). **Never tie that minimum to the inactivity timeout** (rationale).
 - The `exit` source carries the `COMMAND_EXIT` notification (title "Command finished", body = summarized command + exit code).
 - Returning to the Session before finish disarms the watch. A quick finish, a different command start, or Session destruction clears it without ringing.
@@ -235,9 +235,9 @@ Source of truth: `dispatchCompletion` / `formatCommandExitBody` in `lib/src/lib/
 
 ## Clearing And TODO
 
-`todo` is a boolean reminder. **Every ring sets it the moment it opens, whatever its source**, recording whether it did and which notification it replaced (rationale). Pinned by `a %s ring sets TODO the moment it opens` in `lib/src/lib/alert-manager.test.ts`.
+`todo` is a boolean reminder. **Every ring sets it the moment it opens, whatever its source**, recording the TODO and notification it found (rationale). Pinned by `a WATCHING ring sets TODO the moment it opens, with its own detail` in `lib/src/lib/alert-manager.test.ts`.
 
-**Detail follows one richness order:** a text report (`OSC 9`, `OSC 99`, `OSC 777`) > `COMMAND_EXIT` > `OSC 9;4` > `WATCHING` > `BEL`. A new ring shows its own detail; a source joining an active ring replaces the shown detail only at an equal or higher rank, so the latest wins among equals (rationale).
+**Detail follows one richness order:** a text report (`OSC 9`, `OSC 99`, `OSC 777`) > `COMMAND_EXIT` > `OSC 9;4` > `WATCHING` > `BEL`. A new ring shows its own detail; a source joining an active ring, a deferred notification, and an acknowledged receipt each replace the detail only at an equal or higher rank (rationale). Pinned by `detail joining a ring` in `lib/src/lib/alert-manager.test.ts`.
 
 | Verb | Effect |
 |---|---|
@@ -247,10 +247,10 @@ Source of truth: `dispatchCompletion` / `formatCommandExitBody` in `lib/src/lib/
 | clear TODO (pill click, passthrough `Enter`) | clears the ring and a deferred notification; `todo` off, notification dropped, even if already off |
 | an await consumes a source (Await) | withdraws that source |
 | watched work resumes (WATCHING Track) | withdraws `watching` |
-| a rule stops covering the ring's `watchKey` | withdraws `watching` |
+| a rule stops covering the `watching` key | withdraws `watching` |
 
-- **The four user verbs acknowledge; a withdrawal never does.** A ring a withdrawal empties takes back the TODO it set, never one it found, and the notification it replaced.
-- **Never summon twice for an acknowledged state.** After a user verb clears a ring, a report arriving before any output opens no ring: it sets `todo`, takes the notification by the richness order, and publishes. Settles and exits ring as usual, and opening a ring forgets the acknowledgement (rationale). Pinned by `a report about a state acknowledged by %s updates the TODO without summoning again` in `lib/src/lib/alert-manager.test.ts`.
+- **The four user verbs acknowledge; a withdrawal never does.** A ring a withdrawal empties restores the TODO and notification it found.
+- **Never summon twice for an acknowledged state.** After a user verb clears a ring, a report arriving before any output opens no ring: it sets `todo`, updates the notification, and publishes. Settles and exits ring as usual, and opening a ring forgets the acknowledgement (rationale). Pinned by `a report about a state acknowledged by %s updates the TODO without summoning again` in `lib/src/lib/alert-manager.test.ts`.
 - Command-mode `Enter` that only enters passthrough does not clear TODO.
 - Removing a WATCHING rule turns watching off wherever it matched. It does not stop the detector, nor clear a progress cycle or a command-exit arm.
 - Destroying the Session clears all alert, TODO, notification, attention, progress, and command-exit state.
@@ -315,7 +315,7 @@ Source of truth: `AlertSettings` in `lib/src/lib/alert-settings.ts` (renderer mi
 ### Spoken alarms
 
 - **Must replace high-entropy ASCII tokens with `REDACTED` locally before punctuation cleanup and truncation**, including trailing padding but preserving `=` separators (rationale). Hex candidates include embedded hyphen/underscore groups. False positives and negatives remain possible; word-passphrase detection is excluded. Pinned by `lib/src/lib/redact-high-entropy.test.ts` and `redacts whole tokens before punctuation cleanup and truncation` in `lib/src/lib/alert-speech.test.ts`.
-- **The label must be sanitized before it reaches the engine** (`toSpokenText`): all Unicode punctuation, symbols, and `Other` characters (including controls, bidi controls, and zero-width formats) become spaces, except apostrophes, which are elided so contractions survive; letters, numbers, and their combining marks from every script remain. Whitespace collapses, the result is capped in code points, and an empty result falls back to `terminal`. **Security, not tidiness:** WebKit wedges its synthesizer on angle brackets, and terminal-supplied text reaches Pane labels (rationale).
+- **The label must be sanitized before it reaches the engine** (`toSpokenText`): all Unicode punctuation, symbols, and `Other` characters (including controls, bidi controls, and zero-width formats) become spaces, except apostrophes, which are elided so contractions survive; letters, numbers, and their combining marks from every script remain. Whitespace collapses, the result is capped in code points, and an empty result falls back to `terminal`. **Security, not tidiness** (rationale).
 - **Delivery state follows actual engine callbacks, not queue admission.** `AlertSpeechState` is a renderer-local `speaking | spoken` map keyed by Session: `start` publishes `speaking`; `end`, or `error` after a real start, publishes `spoken`; an utterance that never starts publishes neither. **Must check delivery identity before accepting `start` or completion**, including after cancellation, timeout, or teardown. Pinned by `ignores an older ring starting after a newer ring has begun speaking` and `recovers from a callback-less engine without accepting its later callbacks` in `lib/src/lib/alert-speech.test.ts`.
 - **Nothing in the settle path may assume the callback arrives after `speak()` returns** — an engine may dispatch `start` then `end`/`error` *synchronously* inside `speechSynthesis.speak()` (rationale). Handlers therefore close over the utterance itself and registration happens before dispatch. A dispatch the engine refuses outright settles too.
 - **Attending mid-sentence cuts the utterance off** — silence the engine, not merely un-render the overlay. "Mid-sentence" is the sink's own record that an utterance started — its generation token — never the rendered `speaking` state.
@@ -420,7 +420,7 @@ Notification text is untrusted terminal output.
 
 - Treat all text as plain text: never interpret ANSI, OSC, HTML, Markdown, URLs, paths, or emoji shortcodes as markup.
 - **Sanitize at protocol-parse time** (`sanitizeText` in `lib/src/lib/terminal-protocol.ts`), bounded and control-stripped like every retained value (`docs/specs/terminal-escapes.md` → Parsing location); every notification stored from a live PTY has been through that pass, generated `WATCHING` and progress titles included via the sanitized command line. `normalizeActivityNotification` in `lib/src/lib/alert-manager.ts` is only a *shape* check on top — known `source`, string-or-null fields, trimmed, at least one non-empty — so the cold-restore path (`seed`) re-accepts a persisted blob without re-applying the cap or the control strip (rationale).
-- Keep only the latest `ActivityNotification` rather than unbounded history, and cap/expire incomplete OSC 99 parser state.
+- Keep only one `ActivityNotification` rather than unbounded history, and cap/expire incomplete OSC 99 parser state.
 - **Never** execute commands, open URLs, copy to clipboard, read files, focus outside Dormouse, or render protocol-supplied icons/buttons/actions.
 - Wherever notification text appears in visible UI or accessible labels, it is plain text, and layout must tolerate long text, CJK, RTL, combining marks, and emoji without pushing fixed controls out of bounds. Sanitized terminal-supplied `OSC 0` / `OSC 2` / `OSC 9` text also participates in normal Pane-label derivation, and that label may reach the opt-in speech and push channels — **each after its own second pass**, because a label safe to *render* is not automatically safe to hand a speech engine or an OS notification, and those two fail in different ways. See `toSpokenText` under Spoken alarms and `toPushText` under Push notifications.
 
diff --git a/docs/specs/alert.rationale.md b/docs/specs/alert.rationale.md
index 29290cdda..9ca2faea8 100644
--- a/docs/specs/alert.rationale.md
+++ b/docs/specs/alert.rationale.md
@@ -6,7 +6,7 @@
 
 **Why one ring instead of three tracks.** Each track stored its ring differently and doubled as other state: the protocol ring shared `protocolStatus` with progress, the command-exit ring shared `commandExitStatus` with the arm, and WATCHING kept a command key. Every clearing verb, await, and restart then treated them differently — the TODO asymmetries under Clearing And TODO, progress un-ringing a report, a bell overwriting an exit code (audit, 2026-09-23). One latch with a list of sources gives every rule one place to act.
 
-**Why a `WATCHING` notification is never persisted.** Builds before that source validate every persisted pane's notification against their own source list, and one unknown source rejects the whole session, not just the detail (`isPersistedSessionV3`). A development build and an installed one share one session file, so persisting it would empty the older build's restore. The TODO survives; only the generated `<key> went quiet` detail stays live.
+**Why the reader drops what it cannot validate, and the writer keeps to the strict sources.** Builds before the tolerant reader validate every persisted pane's notification against their own source list, and one unknown source rejects the whole session, not just the detail (`isPersistedSessionV3`). A development build and an installed one share one session file, so a source added later — `WATCHING` was the first — would empty the older build's restore. The reader now drops only the detail. The writer's allowlist is transitional: it protects the strict builds still installed, and goes once none reads the file. Until then a `WATCHING` TODO survives a restart, and only its generated `<key> went quiet` detail stays live.
 
 **Why the detector outranks the command-exit arm.** A watched command is by definition running, so a WATCHING Session is almost always also command-exit armed; ranking the arm first would mask the detector's busy/quiet states for the whole run, and the detector's state is the one derived from real output.
 
@@ -40,7 +40,7 @@
 
 **Why a command-exit ring is gated on nothing running.** The ring latches past the run that raised it, so once another command has started it can only describe the previous one — exactly the misreport a `dor send` followed by `dor await --until exit` would act on.
 
-**Why a WATCHING ring is gated on `outputSinceWatchingRing`.** The ring legitimately describes a long-running watched command going quiet — what `--until quiet` exists for — but it is an inference from silence, and a brief burst does not clear it when the peer starts talking again; consuming it mid-turn would make the documented `await && read` idiom read a half-drawn screen. The detector cannot stand in for the flag because it never latches: it reports how output looks *now*, and its post-output `NOTHING_TO_SHOW` window (`busyCandidateGap`) is longer than the two CLI round trips between a `dor send` and the await behind it, so it would still read as settled.
+**Why the `watching` source is gated on output since it joined.** The source legitimately describes a long-running watched command going quiet — what `--until quiet` exists for — but it is an inference from silence, and a brief burst does not clear it when the peer starts talking again; consuming it mid-turn would make the documented `await && read` idiom read a half-drawn screen. The detector cannot stand in for `outputSince` because it never latches: it reports how output looks *now*, its post-output `NOTHING_TO_SHOW` window (`busyCandidateGap`) is longer than the two CLI round trips between a `dor send` and the await behind it, and a burst too sparse to confirm BUSY returns it there, so it would still read as settled.
 
 **Why an await never leaves a TODO.** TODO means a human owes this pane attention; after an await nobody does — a program asked to be told, was told, and acted. A stranded TODO also leaks: the last await of an orchestration would mark a fully handled event, and because TODO feeds the Workspace union, an orchestration awaiting across several panes would light the whole Workspace up. Before rings set TODO uniformly, the answer depended on a race: a report claimed by an await parked first left nothing, while the same report landing a moment before the await stranded its TODO (audit, 2026-09-23). Withdrawal now takes back the TODO the ring set, so both orders agree. A TODO from an *unrelated* earlier event is a different debt and stays owed.
 
@@ -86,9 +86,9 @@
 
 ## Clearing And TODO
 
-**Why every ring sets TODO when it opens.** WATCHING rings used to create TODO only when attended or dismissed, while report and exit rings created it at once. Every verb then diverged by source: `t` on a ringing WATCHING pane turned TODO on and on a report ring turned it off; an `Enter` as the first key kept one and cleared the other; a restart dropped an unattended WATCHING ring without trace while a report ring came back as TODO (audit, 2026-09-23). Setting it at ring time makes the verbs identical. Recording whether the ring set it lets a withdrawal take back only its own TODO.
+**Why every ring sets TODO when it opens.** WATCHING rings used to create TODO only when attended or dismissed, while report and exit rings created it at once. Every verb then diverged by source: `t` on a ringing WATCHING pane turned TODO on and on a report ring turned it off; an `Enter` as the first key kept one and cleared the other; a restart dropped an unattended WATCHING ring without trace while a report ring came back as TODO (audit, 2026-09-23). Setting it at ring time makes the verbs identical. Recording the TODO the ring found lets a withdrawal take back only its own.
 
-**Why detail goes by richness.** The last writer used to win, with one special case keeping a report's text over an exit: an `OSC 9` reading `Build finished: 3 warnings` followed by a bell in the next PTY read showed `Terminal bell`, and `make; printf '\a'` showed `Terminal bell` over `make exited 2` (audit, 2026-09-23). One order covers every pair; equal ranks still take the newer text.
+**Why detail goes by richness.** The last writer used to win, with one special case keeping a report's text over an exit: an `OSC 9` reading `Build finished: 3 warnings` followed by a bell in the next PTY read showed `Terminal bell`, and `make; printf '\a'` showed `Terminal bell` over `make exited 2` (audit, 2026-09-23). One order covers every pair; equal ranks still take the newer text. A notification deferred behind animation used to be replaced by whatever came next, so the same bell in the next read replaced the message it followed; the deferral now keeps the richer of the two.
 
 **Why an acknowledged state is not summoned again.** Claude Code sends an idle notification about a minute after a turn ends unless it saw input (captured from Claude Code 2.1, 2026-09-23). A user who acknowledged the WATCHING ring with a click, `a`, or a Door was summoned a second time, in a second episode, for the same completion. Output since the acknowledgement is the evidence that something new happened; settles and command exits are fresh by construction, so only reports are held to it.
 
diff --git a/docs/specs/website-docs.md b/docs/specs/website-docs.md
index 4d1050c8c..b50c73d0c 100644
--- a/docs/specs/website-docs.md
+++ b/docs/specs/website-docs.md
@@ -71,10 +71,10 @@ Content invariants, enforced by the public-doc lint where mechanically
 checkable and by review otherwise:
 
 - The alert explanation matches [alert.md](alert.md). Terminal notification
-  protocols and unattended command exit are independent, zero-configuration
-  tracks; WATCHING is opt-in per command name and needs `OSC 633` / `OSC 133`
-  shell integration. The guide must not promise that every quiet Pane is
-  automatically marked done after a fixed interval.
+  protocols and unattended command exit ring with zero configuration,
+  independent of WATCHING, which is opt-in per command name and needs
+  `OSC 633` / `OSC 133` shell integration. The guide must not promise that
+  every quiet Pane is automatically marked done after a fixed interval.
 - Pocket is described only as shipped or explicitly in development, and never
   presents WebRTC staged in [remote-api.md](remote-api.md) as available.
 - Browser Surfaces are explained to match [dor-browser.md](dor-browser.md)
diff --git a/lib/src/components/alert-ring.tsx b/lib/src/components/alert-ring.tsx
index d683eb353..4f0f9c70a 100644
--- a/lib/src/components/alert-ring.tsx
+++ b/lib/src/components/alert-ring.tsx
@@ -53,7 +53,7 @@ function animationClockStyle(startedAt: number): CSSProperties {
 
 interface AlertRingBurstProps {
   /** A fresh episode is a fresh summons, so remounting on it replays the burst;
-   *  a second track latching inside one keeps the key and only enriches. */
+   *  a second source joining the ring inside one keeps the key and only enriches. */
   key: string;
   className: string;
   style?: CSSProperties;
diff --git a/lib/src/components/wall/AlertRingIndicator.test.tsx b/lib/src/components/wall/AlertRingIndicator.test.tsx
index 787bdb174..a86be26fd 100644
--- a/lib/src/components/wall/AlertRingIndicator.test.tsx
+++ b/lib/src/components/wall/AlertRingIndicator.test.tsx
@@ -122,8 +122,8 @@ describe('AlertRingIndicator', () => {
 
   /**
    * The burst is the summons, and the episode is what the alert sinks already
-   * treat as one summons: a second track latching inside it enriches rather than
-   * re-summons, so only a fresh episode may replay.
+   * treat as one summons: a second source joining the ring inside it enriches
+   * rather than re-summons, so only a fresh episode may replay.
    */
   it('replays the burst for a new episode and not for a re-emit inside one', () => {
     const first: AlertEpisode = { id: 'episode-1', startedAt: Date.now() };
diff --git a/lib/src/lib/alert-manager.test.ts b/lib/src/lib/alert-manager.test.ts
index a4749074e..ddaaa2771 100644
--- a/lib/src/lib/alert-manager.test.ts
+++ b/lib/src/lib/alert-manager.test.ts
@@ -1,7 +1,12 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AlertManager, AWAIT_GRACE_MS, DEFAULT_ALERT_STATE, MAX_AWAIT_TIMEOUT_MS } from './alert-manager';
-import type { AwaitHandle, AwaitOutcome, CompletionEvent } from './alert-manager';
-import { applyTerminalProtocolEvents, collectTerminalSemanticEvents, TerminalProtocolParser } from './terminal-protocol';
+import type { ActivityNotification, AwaitHandle, AwaitOutcome, CompletionEvent } from './alert-manager';
+import {
+  applyTerminalEvents,
+  applyTerminalProtocolEvents,
+  collectTerminalSemanticEvents,
+  TerminalProtocolParser,
+} from './terminal-protocol';
 import { cfg } from '../cfg';
 import { toPersistedAlertState } from './session-types';
 
@@ -29,6 +34,18 @@ describe('AlertManager in isolation', () => {
     ]);
   }
 
+  /** Run `commandLine` seen and then left: armed, so its exit rings once it
+   *  has outlasted `cfg.alert.commandExitMinRuntime`. */
+  function armCommandExit(id: string, commandLine = 'pnpm build'): void {
+    manager.attend(id);
+    runCommand(id, commandLine);
+    manager.clearAttention(id);
+  }
+
+  function finishCommand(id: string, exitCode = 0): void {
+    manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode }]);
+  }
+
   /**
    * WATCHING is keyed on the foreground command's watch key, so the only way to
    * turn it on is to run a watched command (`docs/specs/alert.md`).
@@ -56,7 +73,7 @@ describe('AlertManager in isolation', () => {
       manager.clearTodo(HELPER);
       manager.seed(HELPER, { todo: true });
       manager.onResize(HELPER);
-      manager.applyTerminalSemanticEvents(HELPER, [{ type: 'commandFinish', exitCode: 1 }]);
+      finishCommand(HELPER, 1);
       manager.onExit(HELPER, 0);
       vi.advanceTimersByTime(10_000);
 
@@ -111,7 +128,7 @@ describe('AlertManager in isolation', () => {
       runCommand(HELPER, 'npm run build');
       manager.setHelper(HELPER, false);
       vi.advanceTimersByTime(30_000);
-      manager.applyTerminalSemanticEvents(HELPER, [{ type: 'commandFinish', exitCode: 0 }]);
+      finishCommand(HELPER);
       expect(manager.getState(HELPER).status).toBe('WATCHING_DISABLED');
 
       // The ordinary seen rule applies from promotion on.
@@ -119,7 +136,7 @@ describe('AlertManager in isolation', () => {
       manager.attend(HELPER);
       manager.clearAttention(HELPER);
       vi.advanceTimersByTime(30_000);
-      manager.applyTerminalSemanticEvents(HELPER, [{ type: 'commandFinish', exitCode: 0 }]);
+      finishCommand(HELPER);
       expect(manager.getState(HELPER).status).toBe('ALERT_RINGING');
     });
 
@@ -261,6 +278,14 @@ describe('AlertManager in isolation', () => {
     vi.advanceTimersByTime(3_000);
   }
 
+  /** One output chunk a second for `ms`, which never lets the Session go quiet. */
+  function heartbeat(id: string, ms: number): void {
+    for (let elapsed = 0; elapsed < ms; elapsed += 1_000) {
+      vi.advanceTimersByTime(1_000);
+      manager.onData(id);
+    }
+  }
+
   /** Register a claimant that records every event it is offered and answers `claims`. */
   function recordingClaimant(id: string, claims: boolean): CompletionEvent[] {
     const seen: CompletionEvent[] = [];
@@ -288,25 +313,20 @@ describe('AlertManager in isolation', () => {
     } else if (source === 'report') {
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'needs input' });
     } else {
-      manager.attend(id);
-      runCommand(id);
-      manager.clearAttention(id);
+      armCommandExit(id);
       vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
-      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+      finishCommand(id);
     }
     expect(manager.getState(id).status).toBe('ALERT_RINGING');
   }
 
-  it.each(['watching', 'report', 'exit'] as const)('a %s ring sets TODO the moment it opens', (source) => {
-    const id = `ring-sets-todo-${source}`;
-    ringFrom(id, source);
-    expect(manager.getState(id).todo).toBe(true);
-  });
-
-  it('a WATCHING ring carries its own detail', () => {
-    const id = 'watching-detail';
+  it('a WATCHING ring sets TODO the moment it opens, with its own detail', () => {
+    const id = 'watching-sets-todo';
     driveToRinging(id);
-    expect(manager.getState(id).notification).toEqual({ source: 'WATCHING', title: 'longtask went quiet', body: null });
+    expect(manager.getState(id)).toMatchObject({
+      todo: true,
+      notification: { source: 'WATCHING', title: 'longtask went quiet', body: null },
+    });
   });
 
   it.each(['watching', 'report', 'exit'] as const)('attending or dismissing a %s ring leaves its TODO', (source) => {
@@ -315,15 +335,19 @@ describe('AlertManager in isolation', () => {
       ringFrom(id, source);
       manager[verb](id);
       expect(manager.getState(id)).toMatchObject({ episode: null, todo: true });
+      expect(manager.getState(id).status).not.toBe('ALERT_RINGING');
       expect(manager.getState(id).notification).not.toBeNull();
     }
   });
 
-  it.each(['watching', 'report', 'exit'] as const)('toggling TODO on a %s ring turns it off with its detail', (source) => {
-    const id = `toggle-ringing-${source}`;
-    ringFrom(id, source);
-    manager.toggleTodo(id);
-    expect(manager.getState(id)).toMatchObject({ episode: null, todo: false, notification: null });
+  it.each(['watching', 'report', 'exit'] as const)('toggling or clearing TODO on a %s ring turns it off with its detail', (source) => {
+    for (const verb of ['toggleTodo', 'clearTodo'] as const) {
+      const id = `todo-off-ringing-${source}-${verb}`;
+      ringFrom(id, source);
+      manager[verb](id);
+      expect(manager.getState(id)).toMatchObject({ episode: null, todo: false, notification: null });
+      expect(manager.getState(id).status).not.toBe('ALERT_RINGING');
+    }
   });
 
   it('an unattended WATCHING ring leaves its TODO across a restart, without its live-only detail', () => {
@@ -341,29 +365,27 @@ describe('AlertManager in isolation', () => {
     }
   });
 
-  it('a later generic BEL never replaces richer detail on the ring', () => {
-    const id = 'bel-after-osc9';
-    manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Build finished: 3 warnings' });
-    manager.notifyFromProtocol(id, { source: 'BEL', title: 'Terminal bell', body: null });
-    expect(manager.getState(id).notification).toEqual({ source: 'OSC 9', title: null, body: 'Build finished: 3 warnings' });
-  });
-
-  it('an exit joining a generic BEL shows the exit code', () => {
-    const id = 'exit-after-bel';
-    manager.attend(id);
-    runCommand(id, 'make');
-    manager.clearAttention(id);
-    vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
-    manager.notifyFromProtocol(id, { source: 'BEL', title: 'Terminal bell', body: null });
-    manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 2 }]);
-    expect(manager.getState(id).notification).toEqual({ source: 'COMMAND_EXIT', title: 'Command finished', body: 'make exited 2' });
-  });
+  describe('detail joining a ring', () => {
+    const text: ActivityNotification = { source: 'OSC 9', title: null, body: 'Build finished: 3 warnings' };
+    const otherText: ActivityNotification = { source: 'OSC 777', title: 'Second', body: null };
+    const bell: ActivityNotification = { source: 'BEL', title: 'Terminal bell', body: null };
+    const exit: ActivityNotification = { source: 'COMMAND_EXIT', title: 'Command finished', body: 'make exited 2' };
 
-  it('equally rich detail joining a ring replaces what it shows', () => {
-    const id = 'latest-at-equal-rank';
-    manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'First' });
-    manager.notifyFromProtocol(id, { source: 'OSC 777', title: 'Second', body: null });
-    expect(manager.getState(id).notification).toEqual({ source: 'OSC 777', title: 'Second', body: null });
+    it.each([
+      ['a bell never replaces text', text, bell, text],
+      ['an exit code replaces a bell', bell, exit, exit],
+      ['an exit code never replaces text', text, exit, text],
+      ['equally rich text replaces the older', text, otherText, otherText],
+    ] as const)('%s', (_label, first, joining, shown) => {
+      const id = `detail-rank-${_label}`;
+      armCommandExit(id, 'make');
+      vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
+      for (const detail of [first, joining]) {
+        if (detail.source === 'COMMAND_EXIT') finishCommand(id, 2);
+        else manager.notifyFromProtocol(id, detail);
+      }
+      expect(manager.getState(id)).toMatchObject({ status: 'ALERT_RINGING', notification: shown });
+    });
   });
 
   it.each(['attend', 'dismissAlert'] as const)(
@@ -520,7 +542,7 @@ describe('AlertManager in isolation', () => {
 
   it.each([
     ['commandStart', (id: string) => runCommand(id, 'other-tool')],
-    ['commandFinish', (id: string) => manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 130 }])],
+    ['commandFinish', (id: string) => finishCommand(id, 130)],
     ['promptStart', (id: string) => manager.applyTerminalSemanticEvents(id, [{ type: 'promptStart' }])],
     ['PTY exit', (id: string) => manager.onExit(id, 137)],
   ] as const)('%s silently ends a progress cycle the program abandoned', (boundary, cross) => {
@@ -548,18 +570,6 @@ describe('AlertManager in isolation', () => {
     expect(manager.getState(id).notification).toMatchObject({ source: 'OSC 9;4', title });
   });
 
-  it('attending a ring clears it and leaves the TODO behind', () => {
-    const id = 'attention-clears-ring';
-
-    // A protocol ring needs no WATCHING, so status falls back to
-    // WATCHING_DISABLED once attention clears the latch.
-    manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Build finished' });
-    expect(manager.getState(id).status).toBe('ALERT_RINGING');
-
-    manager.attend(id);
-    expect(manager.getState(id)).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
-  });
-
   it('dismissing a Session with nothing ringing changes nothing and notifies no one', () => {
     const id = 'dismiss-without-ring';
     manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Build finished' });
@@ -652,16 +662,11 @@ describe('AlertManager in isolation', () => {
   it('arms and rings when an attended command loses attention before exiting', () => {
     const id = 'command-exit';
 
-    manager.attend(id);
-    manager.applyTerminalSemanticEvents(id, [
-      { type: 'commandLine', commandLine: 'pnpm build' },
-      { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-    ]);
-
-    vi.advanceTimersByTime(15_000);
+    armCommandExit(id);
     expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
 
-    manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+    vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
+    finishCommand(id);
     expect(manager.getState(id)).toMatchObject({
       status: 'ALERT_RINGING',
       todo: true,
@@ -677,12 +682,8 @@ describe('AlertManager in isolation', () => {
       if (_id === id && state.episode) seen.push(state.episode.id);
     });
 
-    manager.attend(id);
-    manager.applyTerminalSemanticEvents(id, [
-      { type: 'commandLine', commandLine: 'pnpm build' },
-      { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-    ]);
-    vi.advanceTimersByTime(15_000);
+    armCommandExit(id);
+    vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
 
     applyTerminalProtocolEvents(manager, id, [
       { kind: 'notification', notification: { source: 'BEL', title: 'Terminal bell', body: null } },
@@ -693,10 +694,9 @@ describe('AlertManager in isolation', () => {
 
     // The exit joins the ring the bell opened: one enriched summons, so no
     // consumer keyed on the episode may deliver a second time.
-    manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+    finishCommand(id);
     const again = manager.getState(id);
     expect(again.status).toBe(rung.status);
-    expect(again.notification).toMatchObject({ source: 'COMMAND_EXIT' });
     expect(again.episode?.id).toBe(rung.episode?.id);
     expect(new Set(seen)).toEqual(new Set([rung.episode!.id]));
   });
@@ -728,13 +728,8 @@ describe('AlertManager in isolation', () => {
   it('finishes an armed command-exit watch when the PTY exits without commandFinish', () => {
     const id = 'command-exit-pty-exit';
 
-    manager.attend(id);
-    manager.applyTerminalSemanticEvents(id, [
-      { type: 'commandLine', commandLine: 'exec pnpm build' },
-      { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-    ]);
-
-    vi.advanceTimersByTime(15_000);
+    armCommandExit(id, 'exec pnpm build');
+    vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
     expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
 
     manager.onExit(id, 1);
@@ -749,13 +744,10 @@ describe('AlertManager in isolation', () => {
     const id = 'command-exit-pty-exit-unarmed';
 
     manager.attend(id);
-    manager.applyTerminalSemanticEvents(id, [
-      { type: 'commandLine', commandLine: 'exec true' },
-      { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-    ]);
+    runCommand(id, 'exec true');
 
     manager.onExit(id, 0);
-    vi.advanceTimersByTime(15_000);
+    vi.advanceTimersByTime(cfg.alert.userAttention);
 
     expect(manager.getState(id)).toMatchObject({
       status: 'WATCHING_DISABLED',
@@ -764,20 +756,14 @@ describe('AlertManager in isolation', () => {
     });
   });
 
-  it('does not ring command-exit alerts for commands shorter than the attention window', () => {
+  it('does not ring the exit of a command shorter than the minimum runtime', () => {
     const id = 'quick-command-exit';
 
-    manager.attend(id);
-    manager.applyTerminalSemanticEvents(id, [
-      { type: 'commandLine', commandLine: 'git status' },
-      { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-    ]);
-    manager.clearAttention(id);
-
-    vi.advanceTimersByTime(1_000);
+    armCommandExit(id, 'git status');
+    vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime - 1);
     expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
 
-    manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+    finishCommand(id);
     expect(manager.getState(id)).toMatchObject({
       status: 'WATCHING_DISABLED',
       todo: false,
@@ -788,19 +774,15 @@ describe('AlertManager in isolation', () => {
   it('disarms command-exit alerts when the user returns before finish', () => {
     const id = 'command-exit-return';
 
-    manager.attend(id);
-    manager.applyTerminalSemanticEvents(id, [
-      { type: 'commandLine', commandLine: 'pnpm test' },
-      { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-    ]);
-    vi.advanceTimersByTime(15_000);
+    armCommandExit(id, 'pnpm test');
+    vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
     expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
 
     manager.attend(id);
     expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
 
     vi.advanceTimersByTime(1_000);
-    manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+    finishCommand(id);
     expect(manager.getState(id)).toMatchObject({
       status: 'WATCHING_DISABLED',
       todo: false,
@@ -815,13 +797,10 @@ describe('AlertManager in isolation', () => {
     manager.setWatchedCommands(['claude']);
     expect(manager.getState(id).watchingEnabled).toBe(false);
 
-    manager.applyTerminalSemanticEvents(id, [
-      { type: 'commandLine', commandLine: 'claude --print hello' },
-      { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-    ]);
+    runCommand(id, 'claude --print hello');
     expect(manager.getState(id).watchingEnabled).toBe(true);
 
-    manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+    finishCommand(id);
     expect(manager.getState(id).watchingEnabled).toBe(false);
   });
 
@@ -829,10 +808,7 @@ describe('AlertManager in isolation', () => {
     const id = 'rule-finish-notify';
     manager.setWatchedCommands(['claude']);
 
-    manager.applyTerminalSemanticEvents(id, [
-      { type: 'commandLine', commandLine: 'claude' },
-      { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-    ]);
+    runCommand(id, 'claude');
     expect(manager.getState(id).watchingEnabled).toBe(true);
 
     // Subscribe after the command has started so we only capture the finish.
@@ -841,7 +817,7 @@ describe('AlertManager in isolation', () => {
       if (_id === id) watching.push(state.watchingEnabled);
     });
 
-    manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+    finishCommand(id);
 
     expect(manager.getState(id).watchingEnabled).toBe(false);
     // The off-transition must reach subscribers, not just live getState reads.
@@ -852,10 +828,7 @@ describe('AlertManager in isolation', () => {
     const id = 'rule-watch-key';
     manager.setWatchedCommands(['claude']);
 
-    manager.applyTerminalSemanticEvents(id, [
-      { type: 'commandLine', commandLine: 'FOO=1 env BAR=2 /usr/local/bin/claude --resume' },
-      { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-    ]);
+    runCommand(id, 'FOO=1 env BAR=2 /usr/local/bin/claude --resume');
     expect(manager.getState(id).watchingEnabled).toBe(true);
   });
 
@@ -871,10 +844,7 @@ describe('AlertManager in isolation', () => {
     const id = 'rule-miss';
     manager.setWatchedCommands(['claude']);
 
-    manager.applyTerminalSemanticEvents(id, [
-      { type: 'commandLine', commandLine: 'git status' },
-      { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-    ]);
+    runCommand(id, 'git status');
     expect(manager.getState(id).watchingEnabled).toBe(false);
   });
 
@@ -890,12 +860,7 @@ describe('AlertManager in isolation', () => {
   it('applies a newly added rule to every session already running that command', () => {
     const a = 'rule-live-a';
     const b = 'rule-live-b';
-    for (const id of [a, b]) {
-      manager.applyTerminalSemanticEvents(id, [
-        { type: 'commandLine', commandLine: 'claude' },
-        { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-      ]);
-    }
+    for (const id of [a, b]) runCommand(id, 'claude');
     expect(manager.getState(a).watchingEnabled).toBe(false);
     expect(manager.getState(b).watchingEnabled).toBe(false);
 
@@ -914,7 +879,7 @@ describe('AlertManager in isolation', () => {
 
     // The command exiting turns WATCHING off; the ring it already raised is
     // the whole point of watching, so it has to survive.
-    manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+    finishCommand(id);
     expect(manager.getState(id)).toMatchObject({
       status: 'ALERT_RINGING',
       watchingEnabled: false,
@@ -977,7 +942,7 @@ describe('AlertManager in isolation', () => {
   it('silences a latched WATCHING ring when its rule is removed after command exit', () => {
     const id = 'exited-ring-dies-with-rule';
     driveToRinging(id);
-    manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+    finishCommand(id);
 
     expect(manager.getState(id)).toMatchObject({
       status: 'ALERT_RINGING',
@@ -1012,27 +977,22 @@ describe('AlertManager in isolation', () => {
     expect(completions).toEqual([{ kind: 'settled' }]);
   });
 
-  it('clearing TODO clears a WATCHING ring with it', () => {
-    const id = 'clear-unattended-watching';
+  it('dismissing a WATCHING ring keeps the tail of its run from ringing again', () => {
+    const id = 'dismiss-resets-tail';
+    // Keep the ring through the tail's output: deferral would withdraw it.
+    manager.setDeferAlertsUntilQuiet(false);
     driveToRinging(id);
-    expect(manager.getState(id)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
-
-    manager.clearTodo(id);
-    expect(manager.getState(id)).toMatchObject({
-      status: 'NOTHING_TO_SHOW', watchingEnabled: true, todo: false, notification: null,
-    });
     driveToBusy(id);
+
+    manager.dismissAlert(id);
     settle();
-    expect(manager.getState(id).status).toBe('ALERT_RINGING');
+    expect(manager.getState(id)).toMatchObject({ status: 'NOTHING_TO_SHOW', episode: null });
   });
 
   it('drives the detector on an unwatched Session without showing it or ringing', () => {
     const id = 'unwatched-detector';
     manager.setWatchedCommands(['claude']);
-    manager.applyTerminalSemanticEvents(id, [
-      { type: 'commandLine', commandLine: 'git log' },
-      { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-    ]);
+    runCommand(id, 'git log');
     manager.clearAttention(id);
 
     driveToBusy(id);
@@ -1053,10 +1013,7 @@ describe('AlertManager in isolation', () => {
 
   it('shows the live detector state when a rule is enabled mid-command', () => {
     const id = 'enable-rule-mid-busy';
-    manager.applyTerminalSemanticEvents(id, [
-      { type: 'commandLine', commandLine: 'claude' },
-      { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-    ]);
+    runCommand(id, 'claude');
     manager.clearAttention(id);
 
     driveToBusy(id);
@@ -1093,7 +1050,7 @@ describe('AlertManager in isolation', () => {
   it('keeps a latched ring through post-exit output and drops it with the rule', () => {
     const id = 'latched-ring-vs-live-detector';
     driveToRinging(id);
-    manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+    finishCommand(id);
 
     // The detector keeps running after the command ends, so shell-prompt output
     // can drive a whole extra busy/settle cycle. Neither the output nor the
@@ -1126,26 +1083,6 @@ describe('AlertManager in isolation', () => {
     expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
   });
 
-  it('keeps richer protocol detail when a command exit joins its ring', () => {
-    const id = 'command-exit-protocol-wins';
-
-    manager.attend(id);
-    manager.applyTerminalSemanticEvents(id, [
-      { type: 'commandLine', commandLine: 'pnpm build' },
-      { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-    ]);
-    vi.advanceTimersByTime(15_000);
-
-    manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Build finished' });
-    manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
-
-    expect(manager.getState(id)).toMatchObject({
-      status: 'ALERT_RINGING',
-      todo: true,
-      notification: { source: 'OSC 9', title: null, body: 'Build finished' },
-    });
-  });
-
   // --- Configurable inactivity timeout (`docs/specs/alert.md` -> Alarm settings) ---
 
   describe('setInactivityTimeoutMs', () => {
@@ -1154,10 +1091,7 @@ describe('AlertManager in isolation', () => {
       manager.setInactivityTimeoutMs(3_000);
 
       manager.attend(id);
-      manager.applyTerminalSemanticEvents(id, [
-        { type: 'commandLine', commandLine: 'pnpm build' },
-        { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-      ]);
+      runCommand(id);
 
       vi.advanceTimersByTime(2_999);
       expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
@@ -1170,19 +1104,14 @@ describe('AlertManager in isolation', () => {
       const id = 'short-runtime-gate';
       manager.setInactivityTimeoutMs(3_000);
 
-      manager.attend(id);
-      runCommand(id, 'git status');
-      manager.clearAttention(id);
-
+      armCommandExit(id, 'git status');
       vi.advanceTimersByTime(4_000);
-      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+      finishCommand(id);
       expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
 
-      runCommand(id, 'git status');
-      manager.attend(id);
-      manager.clearAttention(id);
+      armCommandExit(id, 'git status');
       vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
-      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+      finishCommand(id);
       expect(manager.getState(id)).toMatchObject({
         status: 'ALERT_RINGING',
         notification: { source: 'COMMAND_EXIT', body: 'git status exited 0' },
@@ -1193,10 +1122,7 @@ describe('AlertManager in isolation', () => {
       const id = 're-arm';
 
       manager.attend(id);
-      manager.applyTerminalSemanticEvents(id, [
-        { type: 'commandLine', commandLine: 'pnpm build' },
-        { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-      ]);
+      runCommand(id);
 
       vi.advanceTimersByTime(10_000);
       expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
@@ -1218,12 +1144,9 @@ describe('AlertManager in isolation', () => {
       manager.setInactivityTimeoutMs(-1);
 
       manager.attend(id);
-      manager.applyTerminalSemanticEvents(id, [
-        { type: 'commandLine', commandLine: 'pnpm build' },
-        { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-      ]);
+      runCommand(id);
 
-      vi.advanceTimersByTime(14_999);
+      vi.advanceTimersByTime(cfg.alert.userAttention - 1);
       expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
       vi.advanceTimersByTime(1);
       expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
@@ -1324,15 +1247,11 @@ describe('AlertManager in isolation', () => {
 
     it('does not defer an authoritative command-exit alert', () => {
       const id = 'immediate-command-exit';
-      manager.attend(id);
-      manager.applyTerminalSemanticEvents(id, [
-        { type: 'commandLine', commandLine: 'pnpm build' },
-        { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-      ]);
-      vi.advanceTimersByTime(15_000);
+      armCommandExit(id);
+      vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
       driveToBusy(id);
 
-      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+      finishCommand(id);
       expect(manager.getState(id)).toMatchObject({
         status: 'ALERT_RINGING',
         todo: true,
@@ -1342,16 +1261,12 @@ describe('AlertManager in isolation', () => {
 
     it('folds a pending terminal notification into an immediate command-exit ring', () => {
       const id = 'command-exit-with-pending-notification';
-      manager.attend(id);
-      manager.applyTerminalSemanticEvents(id, [
-        { type: 'commandLine', commandLine: 'pnpm build' },
-        { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-      ]);
-      vi.advanceTimersByTime(15_000);
+      armCommandExit(id);
+      vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
       driveToBusy(id);
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Build done' });
 
-      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+      finishCommand(id);
 
       expect(manager.getState(id)).toMatchObject({
         status: 'ALERT_RINGING',
@@ -1363,16 +1278,13 @@ describe('AlertManager in isolation', () => {
 
     it('carries a deferred terminal notification across a command-boundary reset', () => {
       const id = 'defer-notification-across-finish';
-      manager.applyTerminalSemanticEvents(id, [
-        { type: 'commandLine', commandLine: 'pnpm build' },
-        { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-      ]);
+      runCommand(id);
       driveToBusy(id);
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Done' });
 
       // This unarmed command finish resets the detector but is not itself an
       // alert; the pending terminal notification still owns its quiet deadline.
-      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+      finishCommand(id);
       expect(manager.getState(id)).toMatchObject({
         status: 'WATCHING_DISABLED',
         todo: false,
@@ -1415,11 +1327,7 @@ describe('AlertManager in isolation', () => {
       driveToBusy(id);
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'build failed' });
 
-      // A heartbeat every second keeps moving the quiet deadline.
-      for (let t = 1_000; t < cfg.alert.deferCeiling; t += 1_000) {
-        vi.advanceTimersByTime(1_000);
-        manager.onData(id);
-      }
+      heartbeat(id, cfg.alert.deferCeiling - 1_000);
       vi.advanceTimersByTime(999);
       expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
       vi.advanceTimersByTime(1);
@@ -1433,11 +1341,9 @@ describe('AlertManager in isolation', () => {
       const id = 'defer-ceiling-latest';
       driveToBusy(id);
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'First' });
-      for (let t = 1_000; t < cfg.alert.deferCeiling; t += 1_000) {
-        vi.advanceTimersByTime(1_000);
-        manager.onData(id);
-        if (t === 20_000) manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Second' });
-      }
+      heartbeat(id, 20_000);
+      manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Second' });
+      heartbeat(id, cfg.alert.deferCeiling - 21_000);
       vi.advanceTimersByTime(1_000);
       expect(manager.getState(id)).toMatchObject({
         status: 'ALERT_RINGING',
@@ -1445,30 +1351,6 @@ describe('AlertManager in isolation', () => {
       });
     });
 
-    it('carries the deferral ceiling across a live transfer', () => {
-      const id = 'defer-ceiling-transfer';
-      driveToBusy(id);
-      manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Done' });
-      for (let t = 0; t < 20_000; t += 1_000) {
-        vi.advanceTimersByTime(1_000);
-        manager.onData(id);
-      }
-      const snapshot = manager.pauseForTransfer(id)!;
-      const target = new AlertManager();
-      try {
-        target.resumeFromTransfer(id, JSON.parse(JSON.stringify(snapshot)));
-        for (let t = 20_000; t < cfg.alert.deferCeiling - 1_000; t += 1_000) {
-          vi.advanceTimersByTime(1_000);
-          target.onData(id);
-        }
-        expect(target.getState(id).status).toBe('WATCHING_DISABLED');
-        vi.advanceTimersByTime(1_000);
-        expect(target.getState(id).status).toBe('ALERT_RINGING');
-      } finally {
-        target.dispose();
-      }
-    });
-
     it('coalesces repeated protocol alerts to the latest detail', () => {
       const id = 'defer-latest-protocol';
       driveToBusy(id);
@@ -1483,6 +1365,20 @@ describe('AlertManager in isolation', () => {
       });
     });
 
+    it('keeps richer deferred detail over a later bell', () => {
+      const id = 'defer-richer-protocol';
+      driveToBusy(id);
+      // An agent's message, then a bell in the next read while it still animates.
+      manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Build finished: 3 warnings' });
+      manager.notifyFromProtocol(id, { source: 'BEL', title: 'Terminal bell', body: null });
+
+      vi.advanceTimersByTime(5_000);
+      expect(manager.getState(id)).toMatchObject({
+        status: 'ALERT_RINGING',
+        notification: { source: 'OSC 9', title: null, body: 'Build finished: 3 warnings' },
+      });
+    });
+
     it('offers a completion once and queues nothing when a claimant takes it', () => {
       const id = 'defer-claimed';
       driveToBusy(id);
@@ -1520,7 +1416,7 @@ describe('AlertManager in isolation', () => {
     const parser = new TerminalProtocolParser();
     const feed = (chunk: string): void => {
       const parsed = parser.process(chunk);
-      manager.applyTerminalEvents(id, parsed.events);
+      applyTerminalEvents(manager, id, parsed.events);
       if (parsed.visibleData.length > 0) manager.onData(id);
     };
     feed('\x1b]633;E;./build.sh\x07\x1b]633;C\x07');
@@ -1577,12 +1473,9 @@ describe('AlertManager in isolation', () => {
       const seen = recordingClaimant(id, false);
 
       manager.attend(id);
-      manager.applyTerminalSemanticEvents(id, [
-        { type: 'commandLine', commandLine: 'npm test' },
-        { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-      ]);
+      runCommand(id, 'npm test');
       vi.advanceTimersByTime(1_000);
-      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+      finishCommand(id);
 
       expect(seen).toEqual([{
         kind: 'commandFinished',
@@ -1603,22 +1496,18 @@ describe('AlertManager in isolation', () => {
       const id = 'claim-command-exit';
       const seen = recordingClaimant(id, true);
 
-      manager.attend(id);
-      manager.applyTerminalSemanticEvents(id, [
-        { type: 'commandLine', commandLine: 'pnpm build' },
-        { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-      ]);
-      vi.advanceTimersByTime(15_000);
+      armCommandExit(id);
+      vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
       expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
 
-      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+      finishCommand(id);
 
       expect(seen).toEqual([{
         kind: 'commandFinished',
         displayCommand: 'pnpm build',
         watchKey: 'pnpm build',
         exitCode: 0,
-        ranMs: 15_000,
+        ranMs: cfg.alert.commandExitMinRuntime,
         armed: true,
       }]);
       expect(manager.getState(id)).toMatchObject({
@@ -1720,12 +1609,8 @@ describe('AlertManager in isolation', () => {
         return false;
       });
 
-      manager.attend(id);
-      manager.applyTerminalSemanticEvents(id, [
-        { type: 'commandLine', commandLine: 'pnpm build' },
-        { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-      ]);
-      vi.advanceTimersByTime(15_000);
+      armCommandExit(id);
+      vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
       expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
 
       manager.onExit(id, 1);
@@ -1736,7 +1621,7 @@ describe('AlertManager in isolation', () => {
           displayCommand: 'pnpm build',
           watchKey: 'pnpm build',
           exitCode: 1,
-          ranMs: 15_000,
+          ranMs: cfg.alert.commandExitMinRuntime,
           armed: true,
         },
         ringing: false,
@@ -1782,22 +1667,6 @@ describe('AlertManager in isolation', () => {
 
     // 1. Already ringing at call time.
 
-    it('resolves on a protocol ring already latched, withdrawing the TODO it set', async () => {
-      const id = 'await-standing-bell';
-      manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Build finished' });
-      expect(manager.getState(id)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
-
-      const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
-
-      expect(await handle.promise).toEqual({ kind: 'resolved', cause: 'bell', waitedMs: 0 });
-      expect(manager.getState(id)).toMatchObject({
-        status: 'WATCHING_DISABLED',
-        todo: false,
-        notification: null,
-        awaited: false,
-      });
-    });
-
     it('leaves a TODO the human already had when it consumes a ring', async () => {
       const id = 'await-keeps-earlier-todo';
       manager.notifyFromProtocol(id, { source: 'OSC 777', title: 'earlier', body: null });
@@ -1821,12 +1690,21 @@ describe('AlertManager in isolation', () => {
       manager.notifyFromProtocol('await-first', { source: 'OSC 9', title: null, body: 'done' });
       expect(await parked.promise).toMatchObject({ kind: 'resolved', cause: 'bell' });
 
+      // Already latched when the await arrives: it resolves on the spot and
+      // withdraws the ring with the TODO it set.
       manager.notifyFromProtocol('bell-first', { source: 'OSC 9', title: null, body: 'done' });
+      expect(manager.getState('bell-first')).toMatchObject({ status: 'ALERT_RINGING', todo: true });
       const consumed = manager.awaitCompletion('bell-first', { until: 'quiet', timeoutMs: NEVER });
-      expect(await consumed.promise).toMatchObject({ kind: 'resolved', cause: 'bell' });
-
-      expect(manager.getState('await-first').todo).toBe(false);
-      expect(manager.getState('bell-first').todo).toBe(false);
+      expect(await consumed.promise).toEqual({ kind: 'resolved', cause: 'bell', waitedMs: 0 });
+
+      for (const id of ['await-first', 'bell-first']) {
+        expect(manager.getState(id)).toMatchObject({
+          status: 'WATCHING_DISABLED',
+          todo: false,
+          notification: null,
+          awaited: false,
+        });
+      }
     });
 
     it('resolves on a latched WATCHING ring and withdraws its TODO', async () => {
@@ -1848,11 +1726,8 @@ describe('AlertManager in isolation', () => {
     it('resolves on a latched command-exit ring under either wake condition', async () => {
       for (const until of ['quiet', 'exit'] as const) {
         const id = `await-standing-exit-${until}`;
-        manager.attend(id);
-        runCommand(id);
-        vi.advanceTimersByTime(15_000);
-        manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
-        expect(manager.getState(id)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
+        ringFrom(id, 'exit');
+        expect(manager.getState(id).todo).toBe(true);
 
         const handle = manager.awaitCompletion(id, { until, timeoutMs: NEVER });
 
@@ -1863,11 +1738,7 @@ describe('AlertManager in isolation', () => {
 
     it('leaves a stale command-exit ring alone while a new command is running', async () => {
       const id = 'await-stale-exit-ring';
-      manager.attend(id);
-      runCommand(id);
-      vi.advanceTimersByTime(15_000);
-      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
-      expect(manager.getState(id).status).toBe('ALERT_RINGING');
+      ringFrom(id, 'exit');
 
       // A second command starts. The latched ring above belongs to the first —
       // `startCommandExitWatch` preserves `ALERT_RINGING` on purpose — so it
@@ -1880,7 +1751,7 @@ describe('AlertManager in isolation', () => {
       // Not consumed either: the ring is still the human's.
       expect(manager.getState(id).status).toBe('ALERT_RINGING');
 
-      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+      finishCommand(id);
       expect(await outcome()).toMatchObject({ kind: 'resolved', cause: 'exit' });
     });
 
@@ -2018,7 +1889,7 @@ describe('AlertManager in isolation', () => {
 
       const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
       vi.advanceTimersByTime(4_000);
-      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 2 }]);
+      finishCommand(id, 2);
 
       expect(await handle.promise).toEqual({ kind: 'resolved', cause: 'exit', waitedMs: 4_000 });
     });
@@ -2068,7 +1939,7 @@ describe('AlertManager in isolation', () => {
       settle();
       expect(await outcome()).toBeNull();
 
-      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+      finishCommand(id);
       expect(await outcome()).toMatchObject({ kind: 'resolved', cause: 'exit' });
     });
 
@@ -2112,7 +1983,7 @@ describe('AlertManager in isolation', () => {
       vi.advanceTimersByTime(AWAIT_GRACE_MS);
       expect(await outcome()).toBeNull();
 
-      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+      finishCommand(id);
       expect(await outcome()).toMatchObject({ kind: 'resolved', cause: 'exit' });
     });
 
@@ -2128,7 +1999,7 @@ describe('AlertManager in isolation', () => {
       vi.advanceTimersByTime(AWAIT_GRACE_MS * 2);
       expect(await outcome()).toBeNull();
 
-      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+      finishCommand(id);
       expect(await outcome()).toMatchObject({ kind: 'resolved', cause: 'exit' });
     });
 
@@ -2288,7 +2159,7 @@ describe('AlertManager in isolation', () => {
       expect(await secondOutcome()).toBeNull();
       expect(manager.getState(id).awaited).toBe(true);
 
-      manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode: 0 }]);
+      finishCommand(id);
       expect(await secondOutcome()).toMatchObject({ kind: 'resolved', cause: 'exit' });
       expect(manager.getState(id).awaited).toBe(false);
     });
diff --git a/lib/src/lib/alert-manager.ts b/lib/src/lib/alert-manager.ts
index 406782cb2..ffdacf10e 100644
--- a/lib/src/lib/alert-manager.ts
+++ b/lib/src/lib/alert-manager.ts
@@ -1,9 +1,8 @@
 import { createAlertEpisode, type AlertEpisode } from './alert-episode';
 import { QuiesceDetector, type QuiesceStatus, type QuiesceSnapshot } from './quiesce-detector';
 import {
-  applyTerminalProtocolEvents,
+  applyTerminalEvents,
   collectTerminalSemanticEvents,
-  type TerminalProtocolEvent,
   type TerminalProtocolParseResult,
 } from './terminal-protocol';
 import { DEFAULT_ALERT_SETTINGS, type AlertSettings } from './alert-settings-model';
@@ -42,8 +41,7 @@ export interface ActivityNotification {
 
 /**
  * How much a notification says, by its source (`docs/specs/alert.md` ->
- * Clearing And TODO). While a ring is active, joining detail replaces the shown
- * detail only at an equal or higher rank.
+ * Clearing And TODO). Read through `richer`, never compared by hand.
  */
 const DETAIL_RANK: Record<ActivityNotificationSource, number> = {
   'OSC 9': 4,
@@ -55,6 +53,11 @@ const DETAIL_RANK: Record<ActivityNotificationSource, number> = {
   BEL: 0,
 };
 
+/** `next`, unless `current` says more: equal ranks take the newer detail. */
+function richer(current: ActivityNotification | null, next: ActivityNotification): ActivityNotification {
+  return current !== null && DETAIL_RANK[current.source] > DETAIL_RANK[next.source] ? current : next;
+}
+
 export type ProtocolProgressState = 'clear' | 'normal' | 'warning' | 'indeterminate' | 'error';
 
 export interface ProtocolProgressUpdate {
@@ -62,7 +65,6 @@ export interface ProtocolProgressUpdate {
   percent: number | null;
 }
 
-type CommandExitStatus = 'IDLE' | 'COMMAND_EXIT_ARMED';
 type ActiveProtocolProgressState = 'normal' | 'warning' | 'indeterminate';
 
 interface ActiveProtocolProgress {
@@ -70,22 +72,45 @@ interface ActiveProtocolProgress {
   percent: number | null;
 }
 
+/** How a progress cycle ended. */
+type ProgressOutcome = 'complete' | 'warning' | 'error';
+
+/** A progress title by outcome: after the running command, or on its own
+ *  (`docs/specs/alert.md` -> Terminal reports). */
+const PROGRESS_TITLES: Record<ProgressOutcome, { afterCommand: string; alone: string }> = {
+  complete: { afterCommand: 'finished', alone: 'Progress complete' },
+  warning: { afterCommand: 'finished with a warning', alone: 'Progress warning' },
+  error: { afterCommand: 'reported an error', alone: 'Progress error' },
+};
+
 /** What raised a ring: a watched settle, a terminal report, or a command exit. */
 type RingSource = 'watching' | 'report' | 'exit';
 
+/** A source `Ring.sources` lists; `watching` carries state of its own. */
+type ListedRingSource = Exclude<RingSource, 'watching'>;
+
+/** The `watching` source: the rule key that raised it, and whether output has
+ *  arrived since it joined, which the detector cannot tell
+ *  (`docs/specs/alert.md` -> Await). */
+interface WatchingSource {
+  key: string;
+  outputSince: boolean;
+}
+
+/** Why a source leaves the ring: `answered` by an await, as a user verb
+ *  answers the whole ring, or `invalidated` by resumed work or rule removal
+ *  (`watchingLeft`). */
+type RingWithdrawal = 'answered' | 'invalidated';
+
 /** The one ring latch a Session holds (`docs/specs/alert.md` -> Public State). */
 interface Ring {
   episode: AlertEpisode;
   /** An array, not a Set: the live-transfer snapshot crosses IPC as JSON. */
-  sources: RingSource[];
-  /** Rule key that raised the `watching` source; removing its rule silences it. */
-  watchKey: string | null;
-  /** This ring turned `todo` on, so a withdrawal that empties it turns it off. */
-  setTodo: boolean;
-  /** The notification this ring replaced, restored by a withdrawal that empties it. */
-  priorNotification: ActivityNotification | null;
-  /** `DETAIL_RANK` of the notification this ring currently shows. */
-  detailRank: number;
+  sources: ListedRingSource[];
+  /** Removing the rule that covers its key withdraws it. */
+  watching: WatchingSource | null;
+  /** What this ring found, restored whole when a withdrawal empties it. */
+  prior: { todo: TodoState; notification: ActivityNotification | null };
 }
 
 interface CommandExitWatch {
@@ -95,6 +120,8 @@ interface CommandExitWatch {
   source: CommandRunSource;
   startedAt: number;
   seenWithAttentionAt: number | null;
+  /** Attention was lost after the command was seen, so its exit may ring. */
+  armed: boolean;
 }
 
 export function normalizeActivityNotification(value: unknown): ActivityNotification | null {
@@ -217,36 +244,28 @@ interface AlertEntry {
   detector: QuiesceDetector;
   ring: Ring | null;
   /**
-   * Has any output arrived since the ring gained its `watching` source? The
-   * detector cannot answer this — it never latches, so it reports how output
-   * looks *now*, and it stays `NOTHING_TO_SHOW` for a full `busyCandidateGap`
-   * after output resumes (and returns there when a burst was too sparse to
-   * confirm BUSY). The question is about the interval since the ring, which is
-   * only observable here.
+   * A user verb cleared a ring and no output has arrived since, so a report
+   * describes the state the user already acknowledged (`dispatchCompletion`).
+   * Opening a ring forgets it.
    */
-  outputSinceWatchingRing: boolean;
-  /**
-   * A user verb cleared a ring, and whether output has arrived since. A report
-   * about that acknowledged state updates the receipt instead of summoning
-   * again. Cleared when a ring opens.
-   */
-  acked: { outputSince: boolean } | null;
+  ackedQuiet: boolean;
   /** The live `OSC 9;4` cycle. Never touches the ring, and the ring never touches it. */
   progress: ActiveProtocolProgress | null;
-  commandExitStatus: CommandExitStatus;
   commandExitWatch: CommandExitWatch | null;
   pendingCommandLine: string | null;
   todo: TodoState;
   notification: ActivityNotification | null;
-  /** Latest terminal notification deferred behind animation; never public or persisted. */
-  deferredNotification: ActivityNotification | null;
-  /** When the pending deferral began. A replacement keeps it, so the ceiling bounds the whole hold. */
-  deferredSince: number | null;
-  deferredNotificationTimer: ReturnType<typeof setTimeout> | null;
+  /**
+   * The terminal notification held behind animation, never public or
+   * persisted, and when the hold began: a replacement keeps that start, so the
+   * ceiling bounds the whole hold.
+   */
+  deferred: { notification: ActivityNotification; since: number } | null;
+  deferredTimer: ReturnType<typeof setTimeout> | null;
 }
 
 /** Explicit live handoff only: timers are deadlines, and no caller closures travel. */
-export interface AlertRuntimeSnapshot extends Omit<AlertEntry, 'detector' | 'deferredNotificationTimer'> {
+export interface AlertRuntimeSnapshot extends Omit<AlertEntry, 'detector' | 'deferredTimer'> {
   detector: QuiesceSnapshot;
 }
 
@@ -340,11 +359,8 @@ export class AlertManager {
     const entry = this.streamEntry(id);
     if (!entry) return;
     entry.detector.onData();
-    // Only meaningful while a WATCHING ring is latched: `consumeAwaitableRing`
-    // reads it to tell a ring that still describes the present from one whose
-    // quiet has already ended.
-    if (entry.ring?.sources.includes('watching')) entry.outputSinceWatchingRing = true;
-    if (entry.acked !== null) entry.acked.outputSince = true;
+    if (entry.ring?.watching) entry.ring.watching.outputSince = true;
+    entry.ackedQuiet = false;
     this.eachWaiter(id, (waiter) => waiter.onOutput());
   }
 
@@ -431,20 +447,18 @@ export class AlertManager {
    */
   private withdrawResumedWatchingRing(entry: AlertEntry): void {
     if (!this.deferAlertsUntilQuiet || !entry.detector.isConfirmedBusy()) return;
-    this.withdrawRingSource(entry, 'watching');
+    this.withdrawRingSource(entry, 'watching', 'invalidated');
   }
 
   /**
    * Dropping a rule is an explicit "stop alerting on this", so it also silences
    * the `watching` source that rule raised — unless another rule still covers
-   * it. The ring keeps its key after command exit precisely so this still works
-   * at a prompt.
+   * it. The source keeps its key after command exit precisely so this still
+   * works at a prompt.
    */
   private withdrawUncoveredWatchingRing(entry: AlertEntry): void {
-    const ring = entry.ring;
-    if (ring === null || !ring.sources.includes('watching')) return;
-    if (watchRuleFor(this.watchedCommands, ring.watchKey) !== null) return;
-    this.withdrawRingSource(entry, 'watching');
+    if (watchRuleFor(this.watchedCommands, entry.ring?.watching?.key ?? null) !== null) return;
+    this.withdrawRingSource(entry, 'watching', 'invalidated');
   }
 
   /** A busy Session went quiet. Whether that rings is decided downstream. */
@@ -501,9 +515,9 @@ export class AlertManager {
         // Only a watched command rings, and only if the user is not looking at
         // it right now. The originating command key latches on the ring so it
         // outlives the command that raised it.
-        const watchKey = entry.commandExitWatch?.watchKey;
-        if (!watchKey || !this.isWatching(entry) || this.hasAttention(id)) break;
-        this.raiseRing(entry, 'watching', { source: 'WATCHING', title: `${watchKey} went quiet`, body: null }, watchKey);
+        const key = entry.commandExitWatch?.watchKey;
+        if (!key || !this.isWatching(entry) || this.hasAttention(id)) break;
+        this.raiseRing(entry, { key, outputSince: false }, { source: 'WATCHING', title: `${key} went quiet`, body: null });
         this.notify(id);
         break;
       }
@@ -518,7 +532,7 @@ export class AlertManager {
         });
         // If a terminal notification was already waiting, it can enrich this
         // ring immediately; keeping its timer would publish stale detail later.
-        if (entry.deferredNotification !== null) this.flushDeferredNotification(id, entry);
+        if (entry.deferred !== null) this.flushDeferredNotification(id, entry);
         else this.notify(id);
         break;
       case 'notification':
@@ -528,6 +542,15 @@ export class AlertManager {
           this.notify(id);
           break;
         }
+        if (entry.ring === null && entry.ackedQuiet) {
+          // A report about the state the user just acknowledged updates the
+          // receipt instead of summoning again. Nothing is deferred while
+          // acknowledged: no output has arrived to animate.
+          entry.todo = true;
+          entry.notification = richer(entry.notification, event.notification);
+          this.notify(id);
+          break;
+        }
         this.deferOrDeliverNotification(id, entry, event.notification);
         break;
     }
@@ -645,46 +668,19 @@ export class AlertManager {
 
   /**
    * Consume the ring source an await arriving right now would resolve on, if
-   * any. Only that source is withdrawn; the TODO it set goes with the ring only
-   * once the ring is empty.
-   *
-   * Two of the three are gated, because the ring outlives the fact they
-   * describe.
-   *
-   * The `exit` source outlives the run that raised it — a command start
-   * deliberately leaves the ring alone — so once a *new* foreground command is
-   * running it can only describe a previous one, and consuming it would answer
-   * "the command exited" about the command still running. That is precisely
-   * the misreport `dor send` followed by `dor await --until exit` would act on,
-   * so a running `commandExitWatch` suppresses it and the await parks for the
-   * real exit instead.
-   *
-   * The `watching` source is the same hazard one level down. It legitimately
-   * describes the command still running — a long-running watched command going
-   * quiet is the `claude` case `--until quiet` exists for — but it is an
-   * *inference from silence*, not a discrete event, and nothing clears it when
-   * output resumes. Consuming it after a `dor send` restarted the peer would
-   * answer "output stopped" about a turn that is mid-flight, and the documented
-   * `await && read` idiom would read a half-drawn screen. So it is consumed only
-   * while `outputSinceWatchingRing` is still false; once output has resumed the
-   * await parks for the real settle. The detector cannot stand in for that flag
-   * — it stays `NOTHING_TO_SHOW` for a full `busyCandidateGap` after output
-   * resumes, which is longer than the two CLI round trips between a `dor send`
-   * and the await that follows it.
-   *
-   * The `report` source is ungated: `OSC 9` is a discrete "I need input" that
-   * stays true until it is answered, so a peer ringing mid-run still means what
-   * it said whenever the await arrives.
+   * any: only that source is withdrawn. Gated because the ring outlives the
+   * fact a source describes (`docs/specs/alert.md` -> Await, rationale): `exit`
+   * only with nothing running, `watching` only with no output since it joined,
+   * a report always.
    */
   private consumeAwaitableRing(entry: AlertEntry, until: AwaitUntil): AwaitCause | null {
-    if (until === 'quiet' && this.withdrawRingSource(entry, 'report')) return 'bell';
-    if (entry.commandExitWatch === null && this.withdrawRingSource(entry, 'exit')) return 'exit';
-    if (until === 'quiet' && !entry.outputSinceWatchingRing && entry.ring?.sources.includes('watching')) {
-      this.withdrawRingSource(entry, 'watching');
-      // The tail of the run that rang must not settle again straight away.
-      entry.detector.reset();
-      return 'quiet';
-    }
+    if (until === 'quiet' && this.withdrawRingSource(entry, 'report', 'answered')) return 'bell';
+    if (entry.commandExitWatch === null && this.withdrawRingSource(entry, 'exit', 'answered')) return 'exit';
+    if (
+      until === 'quiet'
+      && entry.ring?.watching?.outputSince === false
+      && this.withdrawRingSource(entry, 'watching', 'answered')
+    ) return 'quiet';
     return null;
   }
 
@@ -731,32 +727,6 @@ export class AlertManager {
 
   // --- Terminal reports ---
 
-  /**
-   * Apply one parse batch's notification, progress, and semantic events in
-   * stream order, so a report written after a command boundary is judged after
-   * it. Every other event kind is not the manager's.
-   */
-  applyTerminalEvents(id: string, events: readonly TerminalProtocolEvent[]): void {
-    let semantic: TerminalSemanticEvent[] = [];
-    const flushSemantic = (): void => {
-      if (semantic.length === 0) return;
-      this.applyTerminalSemanticEvents(id, semantic);
-      semantic = [];
-    };
-    for (const event of events) {
-      if (event.kind === 'semantic') {
-        semantic.push(event.event);
-      } else if (event.kind === 'notification') {
-        flushSemantic();
-        this.notifyFromProtocol(id, event.notification);
-      } else if (event.kind === 'progress') {
-        flushSemantic();
-        this.updateProtocolProgress(id, event.progress);
-      }
-    }
-    flushSemantic();
-  }
-
   notifyFromProtocol(id: string, notification: ActivityNotification): void {
     if (this.inert(id)) return;
     const entry = this.reportedEntry(id);
@@ -770,11 +740,12 @@ export class AlertManager {
   updateProtocolProgress(id: string, progress: ProtocolProgressUpdate): void {
     if (this.inert(id)) return;
     const entry = this.reportedEntry(id);
+    // A cycle that completes keeps the warning it ran under.
+    const completed: ProgressOutcome = entry.progress?.state === 'warning' ? 'warning' : 'complete';
 
     if (progress.state === 'clear') {
       // A clear with no live cycle ends nothing: programs clear defensively.
-      if (!entry.progress) return;
-      this.finishProtocolProgressCycle(id, entry, entry.progress.state === 'warning' ? 'warning' : 'complete', entry.progress.percent);
+      if (entry.progress) this.finishProtocolProgressCycle(id, entry, completed, entry.progress.percent);
       return;
     }
 
@@ -784,7 +755,7 @@ export class AlertManager {
     }
 
     if (progress.state === 'normal' && progress.percent === 100) {
-      this.finishProtocolProgressCycle(id, entry, entry.progress?.state === 'warning' ? 'warning' : 'complete', progress.percent);
+      this.finishProtocolProgressCycle(id, entry, completed, progress.percent);
       return;
     }
 
@@ -802,7 +773,7 @@ export class AlertManager {
   private finishProtocolProgressCycle(
     id: string,
     entry: AlertEntry,
-    outcome: 'complete' | 'warning' | 'error',
+    outcome: ProgressOutcome,
     percent: number | null,
   ): void {
     entry.progress = null;
@@ -862,7 +833,6 @@ export class AlertManager {
   ): void {
     const resolved = resolveCommandStart(entry.pendingCommandLine, event);
     entry.pendingCommandLine = null;
-    entry.commandExitStatus = 'IDLE';
     // Every command boundary silently ends a progress cycle the program never
     // closed, so a later stray clear finds nothing to complete.
     entry.progress = null;
@@ -872,6 +842,7 @@ export class AlertManager {
       source: resolved.source,
       startedAt: resolved.startedAt,
       seenWithAttentionAt: this.hasAttention(id) ? Date.now() : null,
+      armed: false,
     };
     // Every command boundary starts the detector over, so one command's output
     // history can never leak into the next one's busy/quiet reading.
@@ -887,8 +858,6 @@ export class AlertManager {
     const watch = entry.commandExitWatch;
     entry.commandExitWatch = null;
     entry.pendingCommandLine = null;
-    const wasArmed = entry.commandExitStatus === 'COMMAND_EXIT_ARMED';
-    entry.commandExitStatus = 'IDLE';
     // The boundary silently ends a progress cycle, like a command start.
     const endedProgress = entry.progress !== null;
     entry.progress = null;
@@ -902,7 +871,7 @@ export class AlertManager {
         watchKey: watch.watchKey,
         exitCode,
         ranMs: Date.now() - watch.startedAt,
-        armed: wasArmed,
+        armed: watch.armed,
       });
     }
 
@@ -919,16 +888,14 @@ export class AlertManager {
   private markCommandExitSeen(entry: AlertEntry): void {
     const watch = entry.commandExitWatch;
     if (!watch) return;
-    if (watch.seenWithAttentionAt === null) watch.seenWithAttentionAt = Date.now();
-    if (entry.commandExitStatus === 'COMMAND_EXIT_ARMED') entry.commandExitStatus = 'IDLE';
+    watch.seenWithAttentionAt ??= Date.now();
+    watch.armed = false;
   }
 
   private armCommandExitOnAttentionLoss(id: string): boolean {
-    const entry = this.entries.get(id);
-    if (!entry?.commandExitWatch) return false;
-    if (entry.commandExitStatus !== 'IDLE') return false;
-    if (entry.commandExitWatch.seenWithAttentionAt === null) return false;
-    entry.commandExitStatus = 'COMMAND_EXIT_ARMED';
+    const watch = this.entries.get(id)?.commandExitWatch;
+    if (!watch || watch.armed || watch.seenWithAttentionAt === null) return false;
+    watch.armed = true;
     return true;
   }
 
@@ -940,20 +907,19 @@ export class AlertManager {
     notification: ActivityNotification,
   ): void {
     // Once a ring is active, another source only enriches the same summons.
-    // There is no fresh transition left for animation deferral to suppress, and
-    // none for an absorbed report either. An already pending deferral keeps
-    // deferring: a command boundary resets the detector, so `isConfirmedBusy`
-    // alone could release a notification before quiet.
+    // There is no fresh transition left for animation deferral to suppress. An
+    // already pending deferral keeps deferring: a command boundary resets the
+    // detector, so `isConfirmedBusy` alone could release a notification before
+    // quiet.
     if (
       this.deferAlertsUntilQuiet
       && entry.ring === null
-      && !reportIsAcknowledged(entry)
-      && (entry.deferredNotification !== null || entry.detector.isConfirmedBusy())
+      && (entry.deferred !== null || entry.detector.isConfirmedBusy())
     ) {
-      // Latest wins, matching repeated notifications on a ring; the ceiling
-      // still counts from the first.
-      entry.deferredNotification = notification;
-      entry.deferredSince ??= Date.now();
+      // The richer detail waits, as it would show on a ring; the ceiling still
+      // counts from the first.
+      if (entry.deferred === null) entry.deferred = { notification, since: Date.now() };
+      else entry.deferred.notification = richer(entry.deferred.notification, notification);
       this.scheduleDeferredNotification(id, entry);
     } else {
       // An existing ring means this is enrichment, not a fresh summons. Cancel
@@ -970,109 +936,98 @@ export class AlertManager {
    * Wake at the earlier of the detector's quiet deadline and the deferral
    * ceiling, re-arming for the remainder if output moved the former — so
    * continuing output costs one timer per quiet window rather than one per PTY
-   * chunk. Mostly the detector's own settle gets there first; the timer is
-   * load-bearing after a command boundary resets the detector, which kills the
-   * settle that would have flushed, and for output that never goes quiet.
+   * chunk. A timer already waiting stays: the due time only moves later, and
+   * the wake re-checks it. Mostly the detector's own settle gets there first;
+   * the timer is load-bearing after a command boundary resets the detector,
+   * which kills the settle that would have flushed, and for output that never
+   * goes quiet.
    */
   private scheduleDeferredNotification(id: string, entry: AlertEntry): void {
-    if (entry.deferredNotificationTimer !== null) clearTimeout(entry.deferredNotificationTimer);
-    const dueAt = (): number => Math.min(
-      entry.detector.quietAt(),
-      (entry.deferredSince ?? Date.now()) + cfg.alert.deferCeiling,
-    );
-    entry.deferredNotificationTimer = setTimeout(() => {
-      entry.deferredNotificationTimer = null;
-      if (dueAt() > Date.now()) this.scheduleDeferredNotification(id, entry);
+    if (entry.deferredTimer !== null) return;
+    entry.deferredTimer = setTimeout(() => {
+      entry.deferredTimer = null;
+      if (this.deferredDueAt(entry) > Date.now()) this.scheduleDeferredNotification(id, entry);
       else this.flushDeferredNotification(id, entry);
-    }, Math.max(0, dueAt() - Date.now()));
+    }, Math.max(0, this.deferredDueAt(entry) - Date.now()));
+  }
+
+  /** Quiet, or the deferral ceiling, whichever comes first. */
+  private deferredDueAt(entry: AlertEntry): number {
+    return Math.min(entry.detector.quietAt(), (entry.deferred?.since ?? Date.now()) + cfg.alert.deferCeiling);
   }
 
   private flushDeferredNotification(id: string, entry: AlertEntry): void {
-    const notification = entry.deferredNotification;
-    if (notification === null) return;
+    const deferred = entry.deferred;
+    if (deferred === null) return;
     this.clearDeferredNotification(entry);
 
     // Attending the Session clears this eagerly too; retain the recheck as the
     // timer-side safety rule shared by every delayed alarm path.
     if (this.hasAttention(id)) return;
 
-    this.raiseRing(entry, 'report', notification);
+    this.raiseRing(entry, 'report', deferred.notification);
     this.notify(id);
   }
 
   private clearDeferredNotification(entry: AlertEntry): void {
-    if (entry.deferredNotificationTimer !== null) {
-      clearTimeout(entry.deferredNotificationTimer);
-      entry.deferredNotificationTimer = null;
+    if (entry.deferredTimer !== null) {
+      clearTimeout(entry.deferredTimer);
+      entry.deferredTimer = null;
     }
-    entry.deferredNotification = null;
-    entry.deferredSince = null;
+    entry.deferred = null;
   }
 
   /**
-   * The one path every ring takes (`docs/specs/alert.md` -> Clearing And TODO).
-   * Opening a ring starts an episode and sets TODO whatever the source; a
-   * source joining an active ring enriches that same summons, its detail shown
-   * only if at least as rich as what is shown. A report about a state the user
-   * already acknowledged, with no output since, updates the receipt and opens
-   * nothing.
+   * The one path every ring takes (`docs/specs/alert.md` -> Clearing And TODO),
+   * whatever the source. Opening a ring starts an episode, sets TODO and shows
+   * its own detail; a source joining an active ring enriches that same
+   * summons, its detail shown only if at least as rich as what is shown.
    */
   private raiseRing(
     entry: AlertEntry,
-    source: RingSource,
+    source: ListedRingSource | WatchingSource,
     detail: ActivityNotification,
-    watchKey: string | null = null,
   ): void {
-    const rank = DETAIL_RANK[detail.source];
     let ring = entry.ring;
-    if (ring === null && source === 'report' && reportIsAcknowledged(entry)) {
-      entry.todo = true;
-      if (entry.notification === null || rank >= DETAIL_RANK[entry.notification.source]) entry.notification = detail;
-      return;
-    }
     if (ring === null) {
       ring = {
         episode: createAlertEpisode(),
         sources: [],
-        watchKey: null,
-        setTodo: !entry.todo,
-        priorNotification: entry.notification,
-        detailRank: -1,
+        watching: null,
+        prior: { todo: entry.todo, notification: entry.notification },
       };
       entry.ring = ring;
       entry.todo = true;
-      entry.acked = null;
-    }
-    if (!ring.sources.includes(source)) ring.sources.push(source);
-    if (rank >= ring.detailRank) {
-      ring.detailRank = rank;
       entry.notification = detail;
+      entry.ackedQuiet = false;
+    } else {
+      entry.notification = richer(entry.notification, detail);
     }
-    if (source === 'watching') {
-      ring.watchKey = watchKey;
-      entry.outputSinceWatchingRing = false;
-    }
+    if (typeof source !== 'string') ring.watching = source;
+    else if (!ring.sources.includes(source)) ring.sources.push(source);
   }
 
   /**
-   * Take one source off the ring — an await consumed it, watched work resumed,
-   * or its rule was removed. A ring left empty takes back what it did to TODO:
-   * the TODO it set, and the notification it replaced. Never an acknowledgement.
+   * Take one source off the ring. A ring left empty restores what it found —
+   * the TODO, and the notification it replaced. Never an acknowledgement.
    * Returns whether the source was there.
    */
-  private withdrawRingSource(entry: AlertEntry, source: RingSource): boolean {
+  private withdrawRingSource(entry: AlertEntry, source: RingSource, why: RingWithdrawal): boolean {
     const ring = entry.ring;
-    if (ring === null || !ring.sources.includes(source)) return false;
-    ring.sources = ring.sources.filter((candidate) => candidate !== source);
+    if (ring === null) return false;
     if (source === 'watching') {
-      ring.watchKey = null;
-      entry.outputSinceWatchingRing = false;
+      if (ring.watching === null) return false;
+      ring.watching = null;
+    } else {
+      if (!ring.sources.includes(source)) return false;
+      ring.sources = ring.sources.filter((candidate) => candidate !== source);
     }
-    if (ring.sources.length === 0) {
+    if (ring.sources.length === 0 && ring.watching === null) {
       entry.ring = null;
-      if (ring.setTodo) entry.todo = false;
-      entry.notification = ring.priorNotification;
+      entry.todo = ring.prior.todo;
+      entry.notification = ring.prior.notification;
     }
+    if (source === 'watching') this.watchingLeft(entry, why);
     return true;
   }
 
@@ -1087,13 +1042,17 @@ export class AlertManager {
     const ring = entry.ring;
     if (ring === null) return;
     entry.ring = null;
-    entry.acked = { outputSince: false };
-    if (ring.sources.includes('watching')) {
-      entry.outputSinceWatchingRing = false;
-      // Starting the detector over keeps the tail of the run that just rang
-      // from settling again straight away.
-      entry.detector.reset();
-    }
+    entry.ackedQuiet = true;
+    if (ring.watching !== null) this.watchingLeft(entry, 'answered');
+  }
+
+  /**
+   * The ring's `watching` source is gone. An answer starts the detector over,
+   * so the tail of the run that rang cannot settle again straight away; an
+   * invalidation leaves it running. Last in its caller: the reset publishes.
+   */
+  private watchingLeft(entry: AlertEntry, why: RingWithdrawal): void {
+    if (why === 'answered') entry.detector.reset();
   }
 
   // --- Attention tracking ---
@@ -1167,18 +1126,19 @@ export class AlertManager {
   toggleTodo(id: string): void {
     if (this.inert(id)) return;
     const entry = this.getOrCreateEntry(id);
-    entry.todo = !entry.todo;
-    if (!entry.todo) entry.notification = null;
-    this.clearRingForUser(entry);
-    this.notify(id);
+    this.setTodoForUser(id, entry, !entry.todo);
   }
 
   clearTodo(id: string): void {
     if (this.inert(id)) return;
-    const entry = this.getOrCreateEntry(id);
-    entry.todo = false;
-    entry.notification = null;
-    // Also releases any deferred notification. `notify` dedupes unchanged state.
+    this.setTodoForUser(id, this.getOrCreateEntry(id), false);
+  }
+
+  /** A TODO verb: off drops the notification, and either way the ring goes
+   *  with any deferred notification. `notify` dedupes unchanged state. */
+  private setTodoForUser(id: string, entry: AlertEntry, todo: TodoState): void {
+    entry.todo = todo;
+    if (!todo) entry.notification = null;
     this.clearRingForUser(entry);
     this.notify(id);
   }
@@ -1244,10 +1204,8 @@ export class AlertManager {
     entry.todo = state.todo === true;
     entry.notification = entry.todo ? normalizeActivityNotification(state.notification) : null;
     entry.ring = null;
-    entry.outputSinceWatchingRing = false;
-    entry.acked = null;
+    entry.ackedQuiet = false;
     entry.progress = null;
-    entry.commandExitStatus = 'IDLE';
     entry.commandExitWatch = null;
     entry.pendingCommandLine = null;
     this.clearDeferredNotification(entry);
@@ -1274,11 +1232,11 @@ export class AlertManager {
       this.armCommandExitOnAttentionLoss(id);
     }
     this.suspendedForTransfer.add(id);
-    const { detector, deferredNotificationTimer: _timer, ...state } = entry;
+    const { detector, deferredTimer: _timer, ...state } = entry;
     const snapshot = structuredClone({ ...state, detector: detector.snapshot() });
     detector.dispose();
-    if (entry.deferredNotificationTimer !== null) clearTimeout(entry.deferredNotificationTimer);
-    entry.deferredNotificationTimer = null;
+    if (entry.deferredTimer !== null) clearTimeout(entry.deferredTimer);
+    entry.deferredTimer = null;
     return snapshot;
   }
 
@@ -1293,14 +1251,14 @@ export class AlertManager {
     else this.liveReplay.set(id, replayRequestId);
     const entry = this.getOrCreateEntry(id);
     entry.detector.dispose();
-    if (entry.deferredNotificationTimer !== null) clearTimeout(entry.deferredNotificationTimer);
+    if (entry.deferredTimer !== null) clearTimeout(entry.deferredTimer);
     const { detector, ...state } = structuredClone(snapshot);
     Object.assign(entry, state);
-    entry.deferredNotificationTimer = null;
+    entry.deferredTimer = null;
     entry.detector = this.createDetector(id);
     entry.detector.restore(detector);
     this.withdrawUncoveredWatchingRing(entry);
-    if (entry.deferredNotification) {
+    if (entry.deferred) {
       if (this.deferAlertsUntilQuiet) this.scheduleDeferredNotification(id, entry);
       else this.flushDeferredNotification(id, entry);
     }
@@ -1318,7 +1276,8 @@ export class AlertManager {
     if (requestId !== undefined && this.liveReplay.get(id) === requestId) {
       this.liveReplay.delete(id);
       if (parsed.visibleData.length) this.onData(id);
-      applyTerminalProtocolEvents(this, id, parsed.events);
+      // The caller records the replay's Tool reports for either kind.
+      return applyTerminalEvents(this, id, parsed.events);
     }
     const events = collectTerminalSemanticEvents(parsed.events);
     this.applyTerminalSemanticEvents(id, events);
@@ -1377,7 +1336,7 @@ export class AlertManager {
     // detector's busy/quiet states for the entire run. The detector is derived
     // from real output, so it is the more informative of the two.
     if (this.isWatching(entry)) return entry.detector.getStatus();
-    if (entry.commandExitStatus === 'COMMAND_EXIT_ARMED') return 'COMMAND_EXIT_ARMED';
+    if (entry.commandExitWatch?.armed) return 'COMMAND_EXIT_ARMED';
     return 'WATCHING_DISABLED';
   }
 
@@ -1387,17 +1346,14 @@ export class AlertManager {
       entry = {
         detector: this.createDetector(id),
         ring: null,
-        outputSinceWatchingRing: false,
-        acked: null,
+        ackedQuiet: false,
         progress: null,
-        commandExitStatus: 'IDLE',
         commandExitWatch: null,
         pendingCommandLine: null,
         todo: false,
         notification: null,
-        deferredNotification: null,
-        deferredSince: null,
-        deferredNotificationTimer: null,
+        deferred: null,
+        deferredTimer: null,
       };
       this.entries.set(id, entry);
     }
@@ -1452,21 +1408,10 @@ function settledAwait(outcome: AwaitOutcome): AwaitHandle {
   return { promise: Promise.resolve(outcome), cancel: () => {} };
 }
 
-/** The user cleared a ring and nothing has been output since, so a report now
- *  describes the state they already acknowledged. */
-function reportIsAcknowledged(entry: AlertEntry): boolean {
-  return entry.acked !== null && !entry.acked.outputSince;
-}
-
-/** Names the running command when there is one (`docs/specs/alert.md` -> Terminal reports). */
-function progressTitle(watch: CommandExitWatch | null, outcome: 'complete' | 'warning' | 'error'): string {
-  const command = watch === null ? null : watch.watchKey ?? watch.displayCommand;
-  if (command === null) {
-    return outcome === 'error' ? 'Progress error' : outcome === 'warning' ? 'Progress warning' : 'Progress complete';
-  }
-  return outcome === 'error'
-    ? `${command} reported an error`
-    : outcome === 'warning' ? `${command} finished with a warning` : `${command} finished`;
+/** Names the running command when there is one: its watch key, else its display command. */
+function progressTitle(watch: CommandExitWatch | null, outcome: ProgressOutcome): string {
+  const titles = PROGRESS_TITLES[outcome];
+  return watch === null ? titles.alone : `${watch.watchKey ?? watch.displayCommand} ${titles.afterCommand}`;
 }
 
 function formatCommandExitBody(displayCommand: string, exitCode: number | undefined): string {
diff --git a/lib/src/lib/alert-resumed-output.test.ts b/lib/src/lib/alert-resumed-output.test.ts
index 814f41529..bd91f9e97 100644
--- a/lib/src/lib/alert-resumed-output.test.ts
+++ b/lib/src/lib/alert-resumed-output.test.ts
@@ -30,6 +30,22 @@ function settle(): void {
   vi.advanceTimersByTime(5_000);
 }
 
+/** Start the watched command the way shell integration reports it. */
+function runCommand(): void {
+  manager.applyTerminalSemanticEvents(ID, [
+    { type: 'commandLine', commandLine: 'longtask' },
+    { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
+  ]);
+}
+
+/** Run it seen and then left: armed, so its exit rings once it has outlasted
+ *  `cfg.alert.commandExitMinRuntime`. */
+function armCommandExit(): void {
+  manager.attend(ID);
+  runCommand();
+  manager.clearAttention(ID);
+}
+
 beforeEach(() => {
   vi.useFakeTimers();
   clearTerminalActivity();
@@ -44,10 +60,7 @@ beforeEach(() => {
   manager.setDeferAlertsUntilQuiet(true);
   manager.onStateChange(setTerminalActivity);
   manager.setWatchedCommands(['longtask']);
-  manager.applyTerminalSemanticEvents(ID, [
-    { type: 'commandLine', commandLine: 'longtask' },
-    { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-  ]);
+  runCommand();
   stopSpeech = startAlertSpeech();
   // Push shares the ring watcher; exercise its delivery decision without a Relay.
   stopPush = watchUnattendedRings({ sink: 'push', subscribe: () => () => {}, enabled: () => true, delayMs: () => DELAY, fire: pushed });
@@ -127,21 +140,17 @@ describe('WATCHING output resuming before alarm delivery', () => {
     expect(manager.getState(ID)).toMatchObject({ status: 'BUSY', todo: true, notification: receipt.notification });
   });
 
-  it.each(['protocol', 'command-exit'] as const)('preserves an authoritative %s source behind WATCHING', (track) => {
-    manager.attend(ID);
-    manager.clearAttention(ID);
+  it.each(['report', 'exit'] as const)('preserves an authoritative %s source behind WATCHING', (source) => {
+    armCommandExit();
     vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
     busy();
     settle();
-    if (track === 'protocol') {
+    if (source === 'report') {
       manager.notifyFromProtocol(ID, { source: 'OSC 9', title: 'input needed', body: null });
     } else {
       manager.applyTerminalSemanticEvents(ID, [{ type: 'commandFinish', exitCode: 0 }]);
       expect(manager.getState(ID).notification?.source).toBe('COMMAND_EXIT');
-      manager.applyTerminalSemanticEvents(ID, [
-        { type: 'commandLine', commandLine: 'longtask' },
-        { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-      ]);
+      runCommand();
     }
     const episode = manager.getState(ID).episode;
     busy();
diff --git a/lib/src/lib/alert-runtime-transfer.test.ts b/lib/src/lib/alert-runtime-transfer.test.ts
index 830250ac3..0ab51107e 100644
--- a/lib/src/lib/alert-runtime-transfer.test.ts
+++ b/lib/src/lib/alert-runtime-transfer.test.ts
@@ -6,6 +6,14 @@ import { cfg } from '../cfg';
 beforeEach(() => vi.useFakeTimers());
 afterEach(() => vi.useRealTimers());
 
+/** One output chunk a second for `ms`, which never lets the pane go quiet. */
+function heartbeat(target: AlertManager, ms: number): void {
+  for (let elapsed = 0; elapsed < ms; elapsed += 1_000) {
+    vi.advanceTimersByTime(1_000);
+    target.onData('pane');
+  }
+}
+
 describe('live alert handoff', () => {
   it('preserves an episode across live handoff, while cold restore remains silent', () => {
     const source = new AlertManager();
@@ -30,6 +38,24 @@ describe('live alert handoff', () => {
     source.dispose(); target.dispose();
   });
 
+  it('carries the deferral ceiling across a live transfer', () => {
+    const source = new AlertManager();
+    source.onData('pane');
+    vi.advanceTimersByTime(cfg.alert.busyCandidateGap);
+    source.onData('pane'); source.onData('pane');
+    // Confirmed busy, so the report waits behind the animation.
+    source.notifyFromProtocol('pane', { source: 'OSC 9', title: null, body: 'Done' });
+    heartbeat(source, 20_000);
+    const snapshot = source.pauseForTransfer('pane')!;
+    const target = new AlertManager();
+    target.resumeFromTransfer('pane', JSON.parse(JSON.stringify(snapshot)));
+    heartbeat(target, cfg.alert.deferCeiling - 21_000);
+    expect(target.getState('pane').status).toBe('WATCHING_DISABLED');
+    vi.advanceTimersByTime(1_000);
+    expect(target.getState('pane').status).toBe('ALERT_RINGING');
+    source.dispose(); target.dispose();
+  });
+
   it('preserves the original confirmed-busy quiet deadline across a suspended interval', () => {
     const settled = vi.fn();
     const source = new QuiesceDetector();
diff --git a/lib/src/lib/platform/fake-adapter.ts b/lib/src/lib/platform/fake-adapter.ts
index b0c7f2b3f..f68520641 100644
--- a/lib/src/lib/platform/fake-adapter.ts
+++ b/lib/src/lib/platform/fake-adapter.ts
@@ -10,7 +10,7 @@ import {
   type MemoryNotepadArchivePort,
 } from '../notepad/memory-archive-port';
 import {
-  collectTerminalSemanticEvents,
+  applyTerminalEvents,
   collectTerminalProtocolResponses,
   TerminalProtocolParser,
   textProjectionOf,
@@ -18,7 +18,6 @@ import {
 import {
   applyTerminalSemanticEvents,
 } from '../terminal-state-store';
-import { recordToolEvents } from '../tool-events';
 import { themeColorProvider } from '../terminal-theme';
 
 export interface FakeScenario {
@@ -459,9 +458,7 @@ export class FakePtyAdapter implements PlatformAdapter {
 
   private emitPtyData(id: string, data: string, options: { skipActivity?: boolean } = {}): void {
     const parsed = this.getProtocolParser(id).process(data);
-    recordToolEvents(id, parsed.events);
-    this.alertManager.applyTerminalEvents(id, parsed.events);
-    applyTerminalSemanticEvents(id, collectTerminalSemanticEvents(parsed.events));
+    applyTerminalSemanticEvents(id, applyTerminalEvents(this.alertManager, id, parsed.events, { recordTools: true }));
     const inputHandler = this.inputHandlers.get(id);
     for (const response of collectTerminalProtocolResponses(parsed.events)) {
       inputHandler?.(response);
diff --git a/lib/src/lib/session-restore.test.ts b/lib/src/lib/session-restore.test.ts
index 69e7998dd..3408fd2ee 100644
--- a/lib/src/lib/session-restore.test.ts
+++ b/lib/src/lib/session-restore.test.ts
@@ -415,6 +415,27 @@ describe('restoreSession alert seeding', () => {
     expect(alertSeed.mock.calls).toEqual([['shell', alert]]);
   });
 
+  it('keeps a pane whose notification this build cannot read, seeding its TODO without the detail', () => {
+    const saved = {
+      version: 3,
+      panes: [
+        {
+          id: 'newer',
+          title: 'Newer',
+          cwd: '/tmp',
+          untouched: false,
+          alert: { status: 'ALERT_RINGING', todo: true, notification: { source: 'FROM_A_NEWER_BUILD', title: 'x', body: null } },
+        },
+      ],
+    } as unknown as PersistedSession;
+    const platform = createPlatform(saved);
+    const alertSeed = vi.fn();
+    platform.alertSeed = alertSeed;
+
+    expect(restoreSession(platform)?.paneIds).toEqual(['newer']);
+    expect(alertSeed.mock.calls).toEqual([['newer', { status: 'ALERT_RINGING', todo: true, notification: null }]]);
+  });
+
   it('restores without a seeding host', () => {
     const saved: PersistedSession = {
       version: 3,
diff --git a/lib/src/lib/session-types.ts b/lib/src/lib/session-types.ts
index e0ba37db6..14962e1da 100644
--- a/lib/src/lib/session-types.ts
+++ b/lib/src/lib/session-types.ts
@@ -3,7 +3,12 @@ import { isRecord } from './is-record';
 import { isToolKeyScope, type ToolKeyScope } from './platform/tool-types';
 import type { SessionStatus } from './alert-manager';
 import { hasShellInputControls } from 'dor/commands/shell-quote';
-import { ACTIVITY_NOTIFICATION_SOURCES, type ActivityNotification, type TodoState } from './alert-manager';
+import {
+  ACTIVITY_NOTIFICATION_SOURCES,
+  type ActivityNotification,
+  type ActivityNotificationSource,
+  type TodoState,
+} from './alert-manager';
 
 /** Only TODO/detail restore; `status` is diagnostic and never resurrects a ring. */
 export interface PersistedAlertState {
@@ -44,6 +49,16 @@ export interface PersistedPane {
   tool?: PersistedToolMetadata;
 }
 
+/**
+ * The notification sources a build from before the tolerant reader knows. Such
+ * a build rejects a whole session that carries any other, so the writer keeps
+ * to these until no strict pre-tolerant build reads the file
+ * (`docs/specs/alert.md` -> Public State).
+ */
+const STRICT_READER_NOTIFICATION_SOURCES: readonly ActivityNotificationSource[] = Object.freeze([
+  'OSC 9', 'OSC 9;4', 'OSC 99', 'OSC 777', 'BEL', 'COMMAND_EXIT',
+]);
+
 /**
  * Narrow Activity down to what may reach disk. The parameter deliberately uses
  * the persisted shape: live `AlertState` is structurally assignable to it, and
@@ -51,12 +66,13 @@ export interface PersistedPane {
  * stale fields (`docs/specs/alert.md` -> Public State, "Persist only").
  */
 export function toPersistedAlertState(state: PersistedAlertState): PersistedAlertState {
+  const notification = state.notification ?? null;
   return {
     status: state.status,
     todo: state.todo,
-    // Builds before the `WATCHING` source reject a whole session that carries
-    // it, so that detail stays live-only (`docs/specs/alert.md` -> Public State).
-    notification: state.notification?.source === 'WATCHING' ? null : state.notification ?? null,
+    notification: notification !== null && STRICT_READER_NOTIFICATION_SOURCES.includes(notification.source)
+      ? notification
+      : null,
   };
 }
 
@@ -149,12 +165,19 @@ interface PersistedSessionV3Input {
 
 // --- Validation guards (reject untrusted blobs) ---
 
+// `status` is diagnostic and `notification` optional detail: an unknown value
+// of either — a newer build's — never rejects the pane (`normalizePersistedAlert`).
 function isPersistedAlertShape(value: unknown): boolean {
   if (value === null) return true;
   if (!isRecord(value)) return false;
-  if (typeof value.status !== 'string') return false;
-  if (typeof value.todo !== 'boolean') return false;
-  return value.notification === undefined || value.notification === null || isActivityNotificationShape(value.notification);
+  return typeof value.status === 'string' && typeof value.todo === 'boolean';
+}
+
+/** Read a notification this build cannot validate as none, keeping the TODO. */
+function normalizePersistedAlert(alert: PersistedAlertState): PersistedAlertState {
+  const notification: unknown = alert.notification;
+  if (notification === undefined || notification === null || isActivityNotificationShape(notification)) return alert;
+  return { ...alert, notification: null };
 }
 
 function isActivityNotificationShape(value: unknown): boolean {
@@ -274,7 +297,11 @@ function normalizeSessionV3(session: PersistedSessionV3Input): PersistedSession
       resumeCommand: _retiredResumeCommand,
       ...carried
     } = pane as PersistedPaneInput & { scrollback?: unknown; resumeCommand?: unknown };
-    return { ...carried, untouched: pane.untouched ?? false };
+    return {
+      ...carried,
+      untouched: pane.untouched ?? false,
+      ...(carried.alert ? { alert: normalizePersistedAlert(carried.alert) } : {}),
+    };
   });
   return {
     ...(rest as Omit<PersistedSession, 'panes' | 'surfaceRefs' | 'surfaceRefsNext'>),
diff --git a/lib/src/lib/terminal-protocol.ts b/lib/src/lib/terminal-protocol.ts
index d4531b50c..e70579942 100644
--- a/lib/src/lib/terminal-protocol.ts
+++ b/lib/src/lib/terminal-protocol.ts
@@ -48,6 +48,11 @@ export interface TerminalProtocolAlertSink {
   updateProtocolProgress(id: string, progress: ProtocolProgressUpdate): void;
 }
 
+/** A sink that also takes a parse batch's semantic events, ordered among its reports. */
+export interface TerminalEventSink extends TerminalProtocolAlertSink {
+  applyTerminalSemanticEvents(id: string, events: TerminalSemanticEvent[]): void;
+}
+
 export interface TerminalProtocolParseResult {
   visibleData: string;
   events: TerminalProtocolEvent[];
@@ -474,19 +479,58 @@ export function textProjectionOf(
   return parsed.textData === parsed.visibleData ? undefined : parsed.textData;
 }
 
+/**
+ * Apply a batch's reports and Tool reports alone — standalone's protocol
+ * channel, whose semantic events arrive on a channel of their own. Everything
+ * else takes {@link applyTerminalEvents}.
+ */
 export function applyTerminalProtocolEvents(
   sink: TerminalProtocolAlertSink,
   id: string,
   events: TerminalProtocolEvent[],
 ): void {
   recordToolEvents(id, events);
+  for (const event of events) applyTerminalReport(sink, id, event);
+}
+
+/**
+ * Apply one parse batch in stream order, so a report written after a command
+ * boundary is judged after it (`docs/specs/alert.md` -> Terminal reports).
+ * Semantic events are timestamped once, handed to the sink in the runs between
+ * reports, and returned for the terminal-state store. `recordTools` also
+ * records the batch's Tool reports, for an owner whose renderer state is
+ * reachable from here.
+ */
+export function applyTerminalEvents(
+  sink: TerminalEventSink,
+  id: string,
+  events: readonly TerminalProtocolEvent[],
+  options: { recordTools?: boolean } = {},
+): TerminalSemanticEvent[] {
+  if (events.length === 0) return [];
+  if (options.recordTools) recordToolEvents(id, events);
+  const semanticEvents: TerminalSemanticEvent[] = [];
+  let applied = 0;
+  const applySemantic = (): void => {
+    if (applied === semanticEvents.length) return;
+    sink.applyTerminalSemanticEvents(id, semanticEvents.slice(applied));
+    applied = semanticEvents.length;
+  };
   for (const event of events) {
-    if (event.kind === 'notification') {
-      sink.notifyFromProtocol(id, event.notification);
-    } else if (event.kind === 'progress') {
-      sink.updateProtocolProgress(id, event.progress);
+    const semantic = semanticEventOf(event, nextSemanticTimestamp);
+    if (semantic) semanticEvents.push(semantic);
+    if (event.kind === 'notification' || event.kind === 'progress') {
+      applySemantic();
+      applyTerminalReport(sink, id, event);
     }
   }
+  applySemantic();
+  return semanticEvents;
+}
+
+function applyTerminalReport(sink: TerminalProtocolAlertSink, id: string, event: TerminalProtocolEvent): void {
+  if (event.kind === 'notification') sink.notifyFromProtocol(id, event.notification);
+  else if (event.kind === 'progress') sink.updateProtocolProgress(id, event.progress);
 }
 
 /**
@@ -517,21 +561,24 @@ export function collectTerminalSemanticEvents(
   const semanticEvents: TerminalSemanticEvent[] = [];
   const nextTimestamp = options.now ? createOrderedEventTimestamp(options.now) : nextSemanticTimestamp;
   for (const event of events) {
-    if (event.kind === 'semantic') {
-      semanticEvents.push(timestampSemanticEvent(event.event, nextTimestamp));
-      continue;
-    }
-    if (event.kind !== 'notification') continue;
-    const title = terminalTitleFromNotification(event.notification, nextTimestamp());
-    if (!title) continue;
-    semanticEvents.push({
-      type: 'title',
-      title,
-    });
+    const semantic = semanticEventOf(event, nextTimestamp);
+    if (semantic) semanticEvents.push(semantic);
   }
   return semanticEvents;
 }
 
+/** The timestamped semantic event a protocol event carries: its own, or a
+ *  notification's title candidate. */
+function semanticEventOf(
+  event: TerminalProtocolEvent,
+  nextTimestamp: () => number,
+): TerminalSemanticEvent | null {
+  if (event.kind === 'semantic') return timestampSemanticEvent(event.event, nextTimestamp);
+  if (event.kind !== 'notification') return null;
+  const title = terminalTitleFromNotification(event.notification, nextTimestamp());
+  return title ? { type: 'title', title } : null;
+}
+
 function createOrderedEventTimestamp(now: () => number): () => number {
   let lastTimestamp = Number.NEGATIVE_INFINITY;
   return () => {
diff --git a/lib/src/lib/terminal-state.ts b/lib/src/lib/terminal-state.ts
index 78a8efc08..dda2eac92 100644
--- a/lib/src/lib/terminal-state.ts
+++ b/lib/src/lib/terminal-state.ts
@@ -436,7 +436,7 @@ export interface ResolvedCommandStart {
 /**
  * Turn a `commandStart` event plus the command line staged by the preceding
  * `commandLine` event into the fields a command run needs. Shared by the
- * terminal-state reducer and the alert manager's command-exit track so the
+ * terminal-state reducer and the alert manager's command-exit alerting so the
  * source resolution and display summarization exist in one place.
  *
  * `fallbackTitle` supplies the display label when the shell reported no command
diff --git a/vscode-ext/src/message-router.ts b/vscode-ext/src/message-router.ts
index 01f04ca3d..8cb7523fe 100644
--- a/vscode-ext/src/message-router.ts
+++ b/vscode-ext/src/message-router.ts
@@ -5,7 +5,7 @@ import { AlertManager, type AwaitHandle, type AwaitOutcome } from '../../lib/src
 import { WatchedCommandHost } from '../../lib/src/lib/watched-command-host';
 import { AlertSettingsHost } from '../../lib/src/lib/alert-settings-host';
 import {
-  collectTerminalSemanticEvents,
+  applyTerminalEvents,
   collectTerminalProtocolResponses,
   type TerminalColorProvider,
   type TerminalColors,
@@ -236,12 +236,7 @@ alertManager.onStateChange((id, state) => {
 // This is module-level so it runs regardless of webview visibility.
 ptyManager.addCallbacks({
   onData(id: string, data: string) {
-    const before = alertManager.getState(id).status;
     getOwnerPtyStream(id).write(data);
-    const after = alertManager.getState(id).status;
-    if (before !== after) {
-      log.info(`[alert-feed] ${id}: ${before} → ${after}`);
-    }
   },
   onExit(id: string, exitCode: number) {
     log.info(`[alert-feed] ${id}: PTY exited`);
@@ -291,8 +286,9 @@ function createOwnerPtyStream(id: string): ProcessedPtyStream {
     colorProvider: themeColorProvider,
     onEvents(events) {
       // Reports and command boundaries in stream order, so a precmd
-      // notification is judged after the finish written before it.
-      alertManager.applyTerminalEvents(id, events);
+      // notification is judged after the finish written before it; the
+      // webviews get the same timestamped semantic events.
+      const semanticEvents = applyTerminalEvents(alertManager, id, events);
       // Tool announcements belong to renderer state this process cannot reach,
       // so the router forwards them to the webviews. A start retires the
       // previous command's announcement and state in the owning webview (null).
@@ -306,7 +302,6 @@ function createOwnerPtyStream(id: string): ProcessedPtyStream {
           for (const listener of toolAnnounceListeners) listener(id, event.kind === 'toolAnnounce' ? event.announce : null);
         }
       }
-      const semanticEvents = collectTerminalSemanticEvents(events);
       if (semanticEvents.length > 0) {
         for (const listener of semanticEventsListeners) listener(id, semanticEvents);
       }
diff --git a/website/src/lib/tut-items.ts b/website/src/lib/tut-items.ts
index 384a70376..9c2e37f0c 100644
--- a/website/src/lib/tut-items.ts
+++ b/website/src/lib/tut-items.ts
@@ -1,3 +1,5 @@
+import { cfg } from "dormouse-lib/cfg";
+
 // Item ids are the persistence key — keep them stable across releases.
 const THEME_ITEM_IDS = ["th-theme"] as const;
 
@@ -233,7 +235,7 @@ export const DESKTOP_SECTIONS: readonly Section[] = [
         id: 'al-cmd-exit',
         title: 'A long command that finished while you were away',
         hint:
-          `Press \`x\` to start a slow build in another pane, click into that pane, then click back here and wait. Dormouse rings for any command that ran longer than 15 seconds and finished after you walked away — again, no rule needed.`,
+          `Press \`x\` to start a slow build in another pane, click into that pane, then click back here and wait. Dormouse rings for any command that ran longer than ${cfg.alert.commandExitMinRuntime / 1000} seconds and finished after you walked away — again, no rule needed.`,
       },
     ],
     prose: [
diff --git a/website/src/pages/PlaygroundDesktop.tsx b/website/src/pages/PlaygroundDesktop.tsx
index e71735dbf..effc82c12 100644
--- a/website/src/pages/PlaygroundDesktop.tsx
+++ b/website/src/pages/PlaygroundDesktop.tsx
@@ -227,7 +227,7 @@ function PlaygroundDesktopExperience() {
                   "\x1b]777;notify;Build finished;3 packages rebuilt\x07",
                 );
               },
-              // An unwatched command, so the command-exit track owns the ring:
+              // An unwatched command, so its exit, not WATCHING, raises the ring:
               // the user attends the pane, leaves, and the exit rings.
               onTriggerCommandExitDemo: (durationMs) => {
                 if (commandExitDemoFinishTimerRef.current !== null) {

From f316b236be770ce419a78914465ee60cf0a36ff0 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 23 Sep 2026 18:43:03 -0700
Subject: [PATCH 05/16] Replace attention with presence, focus, and
 acknowledgement

- The renderer reports presence (window focused and visible, with typing,
  mouse, or wheel input within the inactivity timeout) and focus (the
  passthrough pane, or a context's source); a Session is engaged when both
  point at it. VS Code webviews and standalone windows are separate viewers.
- A completion while engaged is held, not dropped: acknowledging or
  leaving drops it, going idle rings it. The walk-away permission prompt
  now reaches the user.
- Only acknowledgement clears a ring. Any keystroke, paste, or drop into a
  pane clears its TODO (Windows, kitty, and one-key answers included); a
  click, Door, or tap keeps it. `dor` reveals move focus without
  acknowledging; browser panes never acknowledge.
- The user's own keystroke echo no longer counts as work.
- Mobile taps and input acknowledge through the mobile composition.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwN55bUVmCNmPiX7vHGCVF
---
 DESIGN.md                                     |   2 +-
 docs/specs/alert.md                           | 116 +++---
 docs/specs/alert.rationale.md                 |  26 +-
 docs/specs/glossary.md                        |   2 +-
 docs/specs/layout.md                          |   2 +-
 docs/specs/mobile-terminal-ui.md              |   7 +-
 docs/specs/remote-api.md                      |   2 +-
 docs/specs/terminal-escapes.md                |   4 +-
 docs/specs/tutorial.rationale.md              |   2 +-
 docs/specs/vscode.md                          |   1 +
 lib/src/cfg.ts                                |   4 +-
 lib/src/components/Door.tsx                   |   2 +-
 lib/src/components/MobileTerminalUi.tsx       |  15 +-
 lib/src/components/MobileWall.test.tsx        |  17 -
 lib/src/components/MobileWall.tsx             |  12 +-
 lib/src/components/SettingsDialog.tsx         |   3 +-
 lib/src/components/Wall.test.tsx              | 154 ++++++++
 lib/src/components/Wall.tsx                   |  53 +--
 .../components/mobile-acknowledge.test.tsx    | 155 ++++++++
 .../wall/AlertRingIndicator.test.tsx          |   2 +-
 .../components/wall/use-engagement-focus.ts   |  18 +
 lib/src/lib/alert-engagement.test.ts          | 356 ++++++++++++++++++
 lib/src/lib/alert-manager.test.ts             | 224 +++++------
 lib/src/lib/alert-manager.ts                  | 326 ++++++++++------
 lib/src/lib/alert-resumed-output.test.ts      |   4 +-
 lib/src/lib/alert-runtime-transfer.test.ts    |  22 +-
 lib/src/lib/alert-settings-model.ts           |   2 +-
 lib/src/lib/alert-speech.test.ts              |   4 +-
 lib/src/lib/clipboard.test.ts                 |   4 +-
 lib/src/lib/clipboard.ts                      |   9 +-
 lib/src/lib/engagement.test.ts                |  95 +++++
 lib/src/lib/engagement.ts                     |  69 ++++
 lib/src/lib/platform/fake-adapter.ts          |   9 +-
 lib/src/lib/platform/types.ts                 |  11 +-
 lib/src/lib/platform/vscode-adapter.ts        |  14 +-
 lib/src/lib/presence.test.ts                  | 129 +++++++
 lib/src/lib/presence.ts                       | 119 ++++++
 lib/src/lib/reconnect.test.ts                 |   4 +-
 lib/src/lib/session-activity-store.ts         |  14 +-
 lib/src/lib/session-restore.test.ts           |   4 +-
 lib/src/lib/session-save.test.ts              |   4 +-
 lib/src/lib/terminal-lifecycle.ts             |  53 +--
 lib/src/lib/terminal-registry.alert.test.ts   | 142 ++++---
 lib/src/lib/terminal-registry.ts              |   4 +-
 lib/src/lib/terminal-report-filter.ts         |   4 -
 lib/src/remote/client/remote-adapter.ts       |   4 +-
 scripts/spec-word-budgets.json                |   4 +-
 standalone/src/browser-sidecar-adapter.ts     |   7 +-
 standalone/src/tauri-adapter.ts               |  16 +-
 vscode-ext/README.md                          |   4 +-
 vscode-ext/src/message-router.ts              |  21 +-
 vscode-ext/src/message-types.ts               |   6 +-
 vscode-ext/test/message-router.test.ts        |  76 ++++
 .../lib/__snapshots__/tut-runner.test.ts.snap |   5 +-
 website/src/lib/tut-items.ts                  |   8 +-
 website/src/lib/tut-runner.test.ts            |   5 +-
 website/src/lib/tut-runner.ts                 |   2 +-
 website/src/pages/PlaygroundDesktop.tsx       |   2 +-
 58 files changed, 1853 insertions(+), 532 deletions(-)
 create mode 100644 lib/src/components/mobile-acknowledge.test.tsx
 create mode 100644 lib/src/components/wall/use-engagement-focus.ts
 create mode 100644 lib/src/lib/alert-engagement.test.ts
 create mode 100644 lib/src/lib/engagement.test.ts
 create mode 100644 lib/src/lib/engagement.ts
 create mode 100644 lib/src/lib/presence.test.ts
 create mode 100644 lib/src/lib/presence.ts

diff --git a/DESIGN.md b/DESIGN.md
index 2dd91b8d2..602bc2e8d 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -200,7 +200,7 @@ Doors are the pane-header indicators on the baseboard. The most signature compon
 - **Dimensions:** `h-6` (24px), `min-w-[68px]`, `max-w-[220px]`; the title button pads `pl-2.5` (10px), `gap-2` between its glyph, title, and badges, ending `pr-2.5` alone or `pr-1` when the notepad button follows it. The notepad button carries the trailing inset itself (`pl-0.5 pr-2`).
 - **Type:** `text-sm font-medium font-mono`.
 - **Content:** leading browser-display icon cluster on a browser Surface (`size={12}` each, `gap-0.5` — a wide robot plus the presentation glyph, or the presentation glyph alone for `iframe`; named in the Door's accessible name, `docs/specs/dor-browser.md` → Browser Chrome); truncated title; optional TODO pill (`text-xs font-semibold tracking-[0.08em]`, success-tinted when flourishing); trailing notepad button (`size={12}`, `weight="fill"`) when the minimized Surface holds notes.
-- **Alarm:** one 2px inset overlay (`--color-alarm-vs-door`) draws the edge for both the unlabelled ring, where it flashes once on arrival, and `SPOKEN`, which persists until the ring is attended and adds a speaker icon *beside* the TODO pill instead of evicting it. `SPEAKING` instead inverts and pulses the whole Door and takes the badge slot for its speaker-plus-label, for one utterance. Both speech states carry a speaker icon (shape, not color); all three name the state in the accessible name. The row inventory is `docs/specs/layout.md` → Alarm overlay.
+- **Alarm:** one 2px inset overlay (`--color-alarm-vs-door`) draws the edge for both the unlabelled ring, where it flashes once on arrival, and `SPOKEN`, which persists until the ring clears and adds a speaker icon *beside* the TODO pill instead of evicting it. `SPEAKING` instead inverts and pulses the whole Door and takes the badge slot for its speaker-plus-label, for one utterance. Both speech states carry a speaker icon (shape, not color); all three name the state in the accessible name. The row inventory is `docs/specs/layout.md` → Alarm overlay.
 - **Hover/Focus:** no decorative hover on the door itself; the focus state is conveyed by the parent pane's selection ring, not by a per-door treatment. The door is a labelled `role="group"` wrapper holding one or two buttons rather than one button — the title button reattaches, the notepad button opens the popover and does not (`docs/specs/notepad.md` → Notepad UI) — and only the notepad button takes the standard `hover:bg-current/10` wash.
 
 ### Buttons
diff --git a/docs/specs/alert.md b/docs/specs/alert.md
index 396067d3e..c0af0ddbd 100644
--- a/docs/specs/alert.md
+++ b/docs/specs/alert.md
@@ -2,7 +2,7 @@
 
 > See `docs/specs/glossary.md` for Session / Pane / Door vocabulary.
 >
-> Owns the Session Activity layer — the ring and its three sources, attention, TODO, notification text and its sanitization, the two alarm sinks, and the Workspace union projection. `docs/specs/layout.md` defers here for all alert/TODO behavior.
+> Owns the Session Activity layer — the ring and its three sources, engagement, TODO, notification text and its sanitization, the two alarm sinks, and the Workspace union projection. `docs/specs/layout.md` defers here for all alert/TODO behavior.
 >
 > Defers placement and sizing to `docs/specs/layout.md`, the alert-store relay messages (`alert:state` / `alert:settings` / `alert:watchedCommands`) to `docs/specs/transport.md`, and push sealing to `docs/specs/remote-security-model.md`; the `alert:await*` contract is stated here.
 
@@ -12,11 +12,11 @@ Dormouse can owe the user attention in three ways. Each is a **source** of the S
 
 | Source | Rings when | Detail |
 |---|---|---|
-| `watching` (WATCHING Track) | a watched command's output went busy, then quiet, unattended | `WATCHING`: `<watch key> went quiet` |
+| `watching` (WATCHING Track) | a watched command's output went busy, then quiet | `WATCHING`: `<watch key> went quiet` |
 | `report` (Terminal reports) | the PTY emitted `BEL`, `OSC 9`, `OSC 99`, or `OSC 777`, or ended an `OSC 9;4` cycle | the sanitized report |
-| `exit` (Command-exit Track) | a command seen while attended kept running, attention was lost, and it exited after at least `cfg.alert.commandExitMinRuntime` | `COMMAND_EXIT` |
+| `exit` (Command-exit Track) | a seen command exited after at least `cfg.alert.commandExitMinRuntime` | `COMMAND_EXIT` |
 
-Only `watching` requires WATCHING. **Every source obeys one suppression rule — never ring while the user is actively attending that Session** at the completion moment — applied at the single seam every completion passes through (Completion events). The output/silence detector (`QuiesceDetector`) is not a source: it is an always-on observer WATCHING reads.
+Only `watching` requires WATCHING. **Every source obeys one engagement rule — a completion on an engaged Session is held, never rung** (Engagement), applied at the single seam every completion passes through (Completion events). The output/silence detector (`QuiesceDetector`) is not a source: it is an always-on observer WATCHING reads.
 
 ## Non-goals
 
@@ -46,40 +46,67 @@ Public `status` is a projection — first match wins:
 
 Source of truth: `AlertState` / `ActivityNotification` / `SessionStatus` in `lib/src/lib/alert-manager.ts`; `QuiesceStatus` in `lib/src/lib/quiesce-detector.ts`; `ActivityState` in `lib/src/lib/session-activity-store.ts`; `toPersistedAlertState` / `normalizePersistedAlert` in `lib/src/lib/session-types.ts`.
 
-## Attention
+## Engagement
 
-**Must set `attentionId` only for Pane body/header clicks, entering passthrough, typing in passthrough (including CSI/SS3 keyboard encodings), or a Door click or `Enter` on one** — both reattach into passthrough. **Never treat terminal replies or mouse-only report chunks as keyboard input or attention** (rationale).
+Three separate signals, never one lease (rationale):
 
-**Never count** visibility, command-mode selection, hover, a Door existing in the baseboard, or reattaching a Door with `d` into command mode.
+| Signal | Of | Holds while |
+|---|---|---|
+| **Presence** | a viewer — one renderer realm: a VS Code webview, a standalone window, the fake adapter | its window is focused and visible, with typing, pointer (down or move), wheel, or IME composition anywhere in it within `inactivityTimeoutMs` |
+| **Focus** | a viewer | the terminal Session its visible Wall points at: the passthrough pane, or the source of an open terminal context — **never** a command-mode selection, a Door, a browser Surface, or a hidden Workspace |
+| **Acknowledge** | a Session | a human gesture on it, below |
+
+**A Session is engaged while some present viewer focuses it**, and engagement alone decides holding over ringing.
 
-Attention is lost when the attention timer expires, the app loses focus, the attended Session is minimized or destroyed, or another Session becomes attended.
+- **Must compute presence in the renderer and report transitions only**: an input event only stamps a time, and the host keeps no presence timer. **An end of presence names its lapse** — `idle` when the timeout ran out, `leave` on a window blur or hide. **A blur is a leave only when `document.hasFocus()` is false** (`docs/specs/layout.md` → Corner cases #2). Focus or visibility returning counts as input.
+- **Must keep engagement per viewer**, deduped at the renderer, so one viewer's leave never disengages a Session another viewer engages. VS Code gives each webview its own viewer (`docs/specs/vscode.md`); a standalone window and the fake adapter are their local manager's one viewer. The mobile composition only acknowledges.
+
+| Gesture | Acknowledges |
+|---|---|
+| typing into the pane (CSI/SS3 key encodings included), a paste, a file drop, the mobile input bar or a gesture key | with input |
+| a Pane body or header click, entering passthrough by keyboard, a Door click or `Enter`, a mobile tap | without input |
+| a terminal reply, a mouse-only report chunk, `d` reattach, a `dor` reveal, an embed focusing itself, DOM focus alone | nothing |
 
-`T_USER_ATTENTION` is the user-facing **inactivity timeout** (Alarm settings). It is instance state on the `AlertManager`, not a module constant; changing it re-arms a live attention timer from that moment, so a shortened window applies immediately.
+- **Never treat terminal replies or mouse-only report chunks as keyboard input** (rationale).
+- **Must acknowledge every human-originated PTY write before writing it**: `writeUserInput` for keys, pastes, and drops; `MobileTerminalUi` for its own input bar and gestures.
+- **Never create an Activity entry to acknowledge**: a browser Surface has none, and keeps its own TODO.
+- **Input opens the echo window** (`cfg.alert.echoWindow`). Output inside it is ignored entirely — detector, `outputSince`, the acknowledged state, awaits — and a completion inside it neither rings nor is held (rationale).
 
-Source of truth: `cfg.alert` in `lib/src/cfg.ts`; `setInactivityTimeoutMs` in `lib/src/lib/alert-manager.ts`; `wireXtermHandlers` in `lib/src/lib/terminal-lifecycle.ts`, pinned by `lib/src/lib/terminal-registry.alert.test.ts`.
+Source of truth: `setViewer` / `acknowledge` in `lib/src/lib/alert-manager.ts`; `createPresenceTracker` in `lib/src/lib/presence.ts`; `retainEngagementReporter` in `lib/src/lib/engagement.ts`, fed by `useEngagementFocus` in `lib/src/components/wall/use-engagement-focus.ts`; `writeUserInput` in `lib/src/lib/terminal-lifecycle.ts`; `acknowledgeSession` in `lib/src/lib/session-activity-store.ts`. Pinned by `lib/src/lib/alert-engagement.test.ts`, `lib/src/lib/presence.test.ts`, `lib/src/lib/engagement.test.ts`, `lib/src/lib/terminal-registry.alert.test.ts`, `lib/src/components/mobile-acknowledge.test.tsx`, and `engagement` in `lib/src/components/Wall.test.tsx`.
 
 ## Completion events
 
 Every completion — a detector settle, a command finish, a direct notification, and the end of a protocol progress cycle (completion or error) — is **dispatched as a `CompletionEvent` before any suppression runs** (rationale).
 
-Claimants get first refusal per Session in registration order; the first to return `true` claims the event and the rest are not offered it. **A claimed event never rings, never sets TODO, and never stores an `ActivityNotification`** — it stops before the ring rules, where attention suppression and the command-exit armed and minimum-runtime checks live.
+Claimants get first refusal per Session in registration order; the first to return `true` claims the event and the rest are not offered it. **A claimed event never rings, never sets TODO, and never stores an `ActivityNotification`** — it stops before the ring rules, where the echo window, holding, and the command-exit seen and minimum-runtime checks live.
+
+**Must hold a completion that would ring an engaged Session**: the sources it would raise and the richest detail (Clearing And TODO), repeated holds merging, never public. A deferred report that comes due while engaged is held too. How engagement ends decides the rest (rationale):
+
+| Released by | What was held |
+|---|---|
+| an acknowledgement, or any user verb that clears a ring | dropped, as acknowledged |
+| focus moving away, or the viewer leaving (blur, hide, removal) | dropped |
+| presence lapsing `idle` with focus unchanged | rings: a report through the acknowledged check and deferral, a settle or exit directly |
+| live-transfer suspension, seeding, removal, teardown | dropped |
+
+**Dropping on an explicit disengage may be a mistake** (rationale). Resumed watched work and rule removal withdraw a held `watching` source as they withdraw a ringing one (WATCHING Track).
 
 With `deferAlertsUntilQuiet` enabled:
 
-- **Must defer an eligible unattended terminal-notification ring while the private detector is fully armed** — `BUSY` or `MIGHT_NEED_ATTENTION`, including when WATCHING is off or a progress cycle masks that projection (rationale).
+- **Must defer an eligible unengaged terminal-notification ring while the private detector is fully armed** — `BUSY` or `MIGHT_NEED_ATTENTION`, including when WATCHING is off or a progress cycle masks that projection (rationale).
 - **Never defer `MIGHT_BE_BUSY`, a detector settle, or a command-finish ring** — unconfirmed, already quiet, and authoritative respectively (rationale).
 - **Must fold a pending terminal notification into an eligible command-finish ring immediately**, so protocol detail enriches that ring instead of publishing stale later.
 - **Must defer after claimants and ring eligibility, never redispatch the historical `CompletionEvent`** (rationale).
 - **Keep pending intent live-only and bounded** to one protocol notification, chosen by richness (Clearing And TODO). Meaningful output moves its quiet deadline; command-boundary detector resets do not drop it.
-- **Cancel pending delivery on attendance, a dismissal that clears a ring, TODO changes, removal, seeding, or teardown.** A dismiss on a quiet Session keeps it: a cancelled deferral was never visible to dismiss. Disabling the setting releases it immediately; otherwise confirmed quiet raises one fresh ring, after which speech/push begin their own delays.
+- **Cancel pending delivery on an acknowledgement, a dismissal that clears a ring, TODO changes, removal, seeding, or teardown.** A dismiss on a quiet Session keeps it: a cancelled deferral was never visible to dismiss. Disabling the setting releases it immediately; otherwise confirmed quiet raises one fresh ring, after which speech/push begin their own delays.
 - **Must ring a deferral by `cfg.alert.deferCeiling` (30 s) after the first notification deferred**, quiet or not; a replacement keeps that start, and a live transfer carries it (rationale).
 
 Two ordering rules:
 
 - **Clear the progress cycle *before* dispatch**, so a completion or error ends the cycle whether or not the event is claimed and `OSC_NOTIF_BUSY` falls back either way.
-- **Dispatch a command finish for every watch that existed**, including the short, unarmed, and attended ones the ring rule then discards.
+- **Dispatch a command finish for every watch that existed**, including the short, unseen, and engaged ones the ring rule then discards or holds.
 
-Source of truth: `registerCompletionClaimant` / `dispatchCompletion` / `deferOrDeliverNotification` / `scheduleDeferredNotification` / `flushDeferredNotification` in `lib/src/lib/alert-manager.ts`; `quietAt` in `lib/src/lib/quiesce-detector.ts`.
+Source of truth: `registerCompletionClaimant` / `dispatchCompletion` / `deferOrDeliverNotification` / `scheduleDeferredNotification` / `flushDeferredNotification` / `escalateHeld` in `lib/src/lib/alert-manager.ts`; `quietAt` in `lib/src/lib/quiesce-detector.ts`. Pinned by `held completions` in `lib/src/lib/alert-engagement.test.ts`.
 
 ## Await
 
@@ -110,7 +137,7 @@ An **await** parks on one Session until it finishes what it is doing, then repor
 - **Skip the `exit` source while a foreground command is running** (rationale).
 - **Skip the `watching` source once output has resumed since it joined the ring** (`outputSince`), and **never stand the detector in for that flag** (rationale).
 - **Never skip a report** — an `OSC 9` stays true until it is answered.
-- **Consuming withdraws that one source and never sets `attentionId`**; a ring it leaves empty is withdrawn (Clearing And TODO).
+- **Consuming withdraws that one source and never acknowledges**; a ring it leaves empty is withdrawn (Clearing And TODO).
 
 **Absorption: absorb the summons, keep the receipt.**
 
@@ -149,7 +176,7 @@ Source of truth: `awaitCompletion` in `lib/src/lib/alert-manager.ts`; `alertAwai
 
 **Must key WATCHING by the foreground command's watch key** (Rules, below). A Session is watched exactly while a rule covers that key; edits reach every matching Session. **Never add per-Session enable or mute** (rationale).
 
-**The output/silence detector is always on.** Every Session runs one `QuiesceDetector` for its whole lifetime, fed by every output chunk and reset at every command boundary. It never latches and knows nothing about attention or rules; the rule set decides only whether its state is publicly visible and whether a settle — a busy Session that stayed quiet — may *ring*.
+**The output/silence detector is always on.** Every Session runs one `QuiesceDetector` for its whole lifetime, fed by every output chunk outside the echo window and reset at every command boundary. It never latches and knows nothing about engagement or rules; the rule set decides only whether its state is publicly visible and whether a settle — a busy Session that stayed quiet — may *ring*.
 
 **A retired id must stay retired.** `disposeSession` retires the alert state and only *then* kills the PTY. **Raw output and resizes never revive a retired id**; a semantic or protocol event may (rationale).
 
@@ -172,7 +199,7 @@ Rules:
 | `MIGHT_BE_BUSY` | Output may be turning into ongoing work. Debounce. |
 | `BUSY` | Enough output to treat the Session as doing work. |
 | `MIGHT_NEED_ATTENTION` | A busy Session went quiet. Debounce. |
-| `ALERT_RINGING` | Likely completion observed while the Session lacked attention. |
+| `ALERT_RINGING` | Likely completion observed while the Session was not engaged. |
 
 Meaningful output excludes resize redraw noise during `T_RESIZE_DEBOUNCE`; theme changes, remounts, DOM reparenting, selection, and focus changes are not output. Invariants:
 
@@ -180,16 +207,16 @@ Meaningful output excludes resize redraw noise during `T_RESIZE_DEBOUNCE`; theme
 - First output starts candidate tracking without changing status; unconfirmed `MIGHT_BE_BUSY` returns to `NOTHING_TO_SHOW`.
 - **Must discard unconfirmed candidate history after an output gap beyond `busyCandidateGap + busyConfirmGap`, including when a timer runs late** (rationale). Pinned by `forgets stale candidate history` and `expires candidate history even when the confirmation timer has not run` in `lib/src/lib/quiesce-detector.test.ts`.
 - **The detector never holds `ALERT_RINGING`.** It reports each settle once and returns to `NOTHING_TO_SHOW`; the ring latches instead.
-- **With `deferAlertsUntilQuiet`, withdraw the `watching` source when watched work resumes confirmed BUSY.** Preserve the detector and other sources; a ring left empty is withdrawn (Clearing And TODO). The next unattended settle restarts speech/push delays. Short redraws and post-exit output retain the ring (rationale).
-- **A settle rings only if** a rule matches the foreground command *and* the Session lacks attention at the confirmation moment.
-- **Never reset the detector for attention alone**; settles must reach awaits. **Must reset to `NOTHING_TO_SHOW` when a user verb or an await clears a ring with a `watching` source**, preventing its output tail from settling again; resumed work and rule removal leave it running.
+- **With `deferAlertsUntilQuiet`, withdraw the `watching` source, ringing or held, when watched work resumes confirmed BUSY.** Preserve the detector and other sources; a ring left empty is withdrawn (Clearing And TODO). The next unengaged settle restarts speech/push delays. Short redraws and post-exit output retain the ring (rationale).
+- **A settle rings only if** a rule matches the foreground command; an engaged Session holds it (Completion events).
+- **Never reset the detector for engagement alone**; settles must reach awaits. **Must reset to `NOTHING_TO_SHOW` when a user verb or an await clears a ring with a `watching` source**, preventing its output tail from settling again; resumed work and rule removal leave it running.
 - **Rings must be caused by a fresh transition** — a settle the detector just reported — never by rerender, theme change, remount, minimize, or reattach.
 
 Source of truth: `commandWatchKey` / `watchRuleFor` in `lib/src/lib/terminal-state.ts`; `QuiesceDetector` in `lib/src/lib/quiesce-detector.ts`; `onSettled` / `withdrawResumedWatchingRing` in `lib/src/lib/alert-manager.ts` (pinned by `lib/src/lib/alert-resumed-output.test.ts`); renderer mirror `lib/src/lib/watched-commands.ts`, multi-renderer coordinator `lib/src/lib/watched-command-host.ts`.
 
 ## Terminal reports
 
-**Terminal notifications are independent of WATCHING** and follow the deferral policy in Completion events. **Never ring an attended Session**; suppression leaves a progress cycle alone. A report raises the ring's `report` source (Clearing And TODO).
+**Terminal notifications are independent of WATCHING** and follow the deferral policy in Completion events. **An engaged Session holds a report** (Completion events); holding leaves a progress cycle alone. A report raises the ring's `report` source (Clearing And TODO).
 
 **Must apply a parse batch's reports and command boundaries in stream order, timestamping its semantic events once** for both the `AlertManager` and the terminal-state store; standalone, receiving them as two events, still applies reports first. Pinned by `judges a notification written after a command finish against the reset detector` in `lib/src/lib/alert-manager.test.ts`.
 
@@ -210,7 +237,7 @@ Sequence syntax lives in `docs/specs/terminal-escapes.md`; what each means here:
   | completing a *warning* cycle | a report completion with the warning title |
   | invalid state, missing percent for `1`/`4`, out-of-range percent | ignored |
   | a command boundary — start, finish, prompt, PTY exit | ends the cycle silently |
-  | completion or error while attended | ends the cycle, no TODO or ring |
+  | completion or error while engaged | ends the cycle; the report is held |
 
   **Titles name the running command** — its watch key, else its display command — and fall back to a generic title with none running; the body is `Progress <percent>%`, or none.
 
@@ -222,16 +249,15 @@ Command-exit alerting consumes normalized semantic command events from `docs/spe
 
 Rules:
 
-- A command start creates `commandExitWatch` for the current foreground command. **Mark the command as seen** if the Session has attention then, or if the user attends while it is already running.
-- If attention is later lost while that same seen command is still running, arm it (`commandExitWatch.armed`; public `COMMAND_EXIT_ARMED`).
-- If the same command finishes, or the PTY exits before a finish event, **ring only when all three hold**: it was armed, the Session still lacks attention, and runtime is at least `cfg.alert.commandExitMinRuntime` (15 s). **Never tie that minimum to the inactivity timeout** (rationale).
+- A command start creates `commandExitWatch` for the current foreground command. **Mark it seen** when the Session is engaged at its start, becomes engaged, or is acknowledged while it runs.
+- **Armed is derived, never stored**: a seen command running while the Session is not engaged — public `COMMAND_EXIT_ARMED`, published on every engagement edge.
+- When the same command finishes, or the PTY exits before a finish event, **ring only when** it was seen, ran at least `cfg.alert.commandExitMinRuntime` (15 s), and the Session is not engaged; engaged, the exit is held (Completion events). **Never tie that minimum to the inactivity timeout** (rationale).
 - The `exit` source carries the `COMMAND_EXIT` notification (title "Command finished", body = summarized command + exit code).
-- Returning to the Session before finish disarms the watch. A quick finish, a different command start, or Session destruction clears it without ringing.
-- **Race rule:** attention must be lost before the finish event is observed.
+- A quick finish, a different command start, or Session destruction clears the watch without ringing.
 
 Command starts and finishes also drive the WATCHING rule above, so both sources share one `commandExitWatch` record and one `resolveCommandStart` helper with the terminal-state reducer.
 
-Source of truth: `dispatchCompletion` / `formatCommandExitBody` in `lib/src/lib/alert-manager.ts`; `resolveCommandStart` in `lib/src/lib/terminal-state.ts`.
+Source of truth: `dispatchCompletion` / `setViewer` / `formatCommandExitBody` in `lib/src/lib/alert-manager.ts`; `resolveCommandStart` in `lib/src/lib/terminal-state.ts`.
 
 ## Clearing And TODO
 
@@ -241,19 +267,21 @@ Source of truth: `dispatchCompletion` / `formatCommandExitBody` in `lib/src/lib/
 
 | Verb | Effect |
 |---|---|
-| attend (Attention) | clears the ring; `todo` stays |
+| acknowledge without input (Engagement) | clears the ring; `todo` stays |
+| acknowledge with input — any keystroke, paste, or drop | clears the ring; `todo` off, notification dropped |
 | dismiss (`a`, Pane Header) | clears the ring; `todo` stays. **With nothing ringing: no change, no notify, a deferred notification kept** |
 | toggle TODO (`t`) | clears the ring; `todo` flips, off dropping the notification |
-| clear TODO (pill click, passthrough `Enter`) | clears the ring and a deferred notification; `todo` off, notification dropped, even if already off |
+| clear TODO (pill click) | clears the ring; `todo` off, notification dropped, even if already off |
 | an await consumes a source (Await) | withdraws that source |
 | watched work resumes (WATCHING Track) | withdraws `watching` |
 | a rule stops covering the `watching` key | withdraws `watching` |
 
-- **The four user verbs acknowledge; a withdrawal never does.** A ring a withdrawal empties restores the TODO and notification it found.
-- **Never summon twice for an acknowledged state.** After a user verb clears a ring, a report arriving before any output opens no ring: it sets `todo`, updates the notification, and publishes. Settles and exits ring as usual, and opening a ring forgets the acknowledgement (rationale). Pinned by `a report about a state acknowledged by %s updates the TODO without summoning again` in `lib/src/lib/alert-manager.test.ts`.
+- **The user verbs acknowledge; a withdrawal never does.** Each also drops whatever was held or deferred, except a dismiss with nothing ringing. A ring a withdrawal empties restores the TODO and notification it found.
+- **Any keystroke into the pane clears TODO** (rationale).
+- **Never summon twice for an acknowledged state.** After a user verb clears a ring or drops a held completion, a report arriving before any output opens no ring: it sets `todo`, updates the notification, and publishes. Settles and exits ring as usual, and opening a ring forgets the acknowledgement (rationale). Pinned by `a report about a state acknowledged by %s updates the TODO without summoning again` in `lib/src/lib/alert-manager.test.ts`.
 - Command-mode `Enter` that only enters passthrough does not clear TODO.
 - Removing a WATCHING rule turns watching off wherever it matched. It does not stop the detector, nor clear a progress cycle or a command-exit arm.
-- Destroying the Session clears all alert, TODO, notification, attention, progress, and command-exit state.
+- Destroying the Session clears all alert, TODO, notification, held, progress, and command-exit state.
 
 Source of truth: `raiseRing` / `withdrawRingSource` / `clearRingForUser` in `lib/src/lib/alert-manager.ts`.
 
@@ -263,7 +291,7 @@ Source of truth: `raiseRing` / `withdrawRingSource` / `clearRingForUser` in `lib
 - **Must suspend source delivery before handing ownership to the host**, freezing its detector, rule walk, and controls at content capture, and **must await host hand-back when source content capture fails**, holding that suspension until routing returns. The destination restores receipts after persisted seeding and before the runtime publishes, and enables delivery only after `adopt_done` succeeds; refusal restores the source runtime and its pending deadlines. Transaction order is `docs/specs/standalone.md` → "Arrival queue".
 - **Must discard imported runtime, Activity, and pane state before releasing the delivery guards on any target failure**, mount or no mount, so a watcher never re-arms on a Workspace this window never owned. A receipt forgotten on an episode already observed is consumed, never fresh.
 - **Must carry per-sink receipts with the episode:** pending/queued work retains its original deadline; engine-admitted speech and dispatched push are consumed and never replayed. Suspending cuts current speech; a partially heard utterance is not restarted after a move or refusal.
-- **Must cancel parked await callers at suspension**, carrying no claimant closures or attention lease. Source attention loss arms a running command; destination interaction establishes its own attention.
+- **Must cancel parked await callers at suspension**, carrying no claimant closures and nothing held. A seen command stays seen, so it arrives armed; the destination's viewers establish their own engagement.
 - **Must process notification events and visible output from the one since-mark replay that carries the arrival's request token, once.** Any other replay, whatever its token, stays historical and silent; query responses are never replayed. The parser boundary limitation follows `docs/specs/transport.md` → Transferring a Workspace.
 
 Source of truth: `pauseForTransfer` / `resumeFromTransfer` / `applyReplay` in `lib/src/lib/alert-manager.ts`; `snapshot` / `restore` in `lib/src/lib/quiesce-detector.ts`; `snapshotAlertDelivery` / `restoreAlertDelivery` in `lib/src/lib/alert-delivery-state.ts`; `planArrival` / `discardArrival` in `standalone/src/workspace-move.ts`. Pinned by `lib/src/lib/alert-runtime-transfer.test.ts`, `lib/src/lib/alert-delivery-policy.test.ts`, and `standalone/src/workspace-move.test.ts`.
@@ -274,7 +302,7 @@ Application alarm defaults live beside the WATCHING rule set, edited in **Settin
 
 | Field | Meaning |
 |---|---|
-| `inactivityTimeoutMs` | `T_USER_ATTENTION` — the walk-away window defined under Attention, and nothing else. |
+| `inactivityTimeoutMs` | The presence window (Engagement), and nothing else; only the renderer's presence tracker reads it. |
 | `deferAlertsUntilQuiet` | Gates animation deferral (Completion events) and resumed-ring withdrawal (WATCHING Track). Default on. (rationale) |
 | `speakEnabled` / `speakDelayMs` | Spoken alarms, below. |
 | `pushEnabled` / `pushDelayMs` | Push notifications, below. |
@@ -306,7 +334,7 @@ Source of truth: `normalizeAlertDeliveryOverrides` / `resolveAlertDeliveryPolicy
 | Payload | Pane label via `toSpokenText`; fallback `terminal`. | Same label via `toPushText`, plus a fixed body; fallback `terminal`. |
 | Never payload | The ringing `ActivityNotification`. | The ringing `ActivityNotification`. |
 | Delivery identity | Episode receipt plus native attempt identity; renderer-local `speaking` / `spoken`. | HTTP push tagged by Session id, so a newer ring replaces the prior notification. |
-| After delivery | Attending cuts off speech. | **Never recall** — another push would only replace one stale notice with another. |
+| After delivery | Clearing the ring cuts off speech. | **Never recall** — another push would only replace one stale notice with another. |
 | Failure | A refused or unavailable engine produces no marker. | Warn on non-2xx, partial, or zero delivery; **never retry** stale alarms. |
 | Authority | The renderer invokes `window.speechSynthesis`. | The webview names Session/title; the Burrow selects active ACL devices, the Relay intersects subscriptions. |
 
@@ -318,7 +346,7 @@ Source of truth: `AlertSettings` in `lib/src/lib/alert-settings.ts` (renderer mi
 - **The label must be sanitized before it reaches the engine** (`toSpokenText`): all Unicode punctuation, symbols, and `Other` characters (including controls, bidi controls, and zero-width formats) become spaces, except apostrophes, which are elided so contractions survive; letters, numbers, and their combining marks from every script remain. Whitespace collapses, the result is capped in code points, and an empty result falls back to `terminal`. **Security, not tidiness** (rationale).
 - **Delivery state follows actual engine callbacks, not queue admission.** `AlertSpeechState` is a renderer-local `speaking | spoken` map keyed by Session: `start` publishes `speaking`; `end`, or `error` after a real start, publishes `spoken`; an utterance that never starts publishes neither. **Must check delivery identity before accepting `start` or completion**, including after cancellation, timeout, or teardown. Pinned by `ignores an older ring starting after a newer ring has begun speaking` and `recovers from a callback-less engine without accepting its later callbacks` in `lib/src/lib/alert-speech.test.ts`.
 - **Nothing in the settle path may assume the callback arrives after `speak()` returns** — an engine may dispatch `start` then `end`/`error` *synchronously* inside `speechSynthesis.speak()` (rationale). Handlers therefore close over the utterance itself and registration happens before dispatch. A dispatch the engine refuses outright settles too.
-- **Attending mid-sentence cuts the utterance off** — silence the engine, not merely un-render the overlay. "Mid-sentence" is the sink's own record that an utterance started — its generation token — never the rendered `speaking` state.
+- **Clearing the ring mid-sentence cuts the utterance off** — silence the engine, not merely un-render the overlay. "Mid-sentence" is the sink's own record that an utterance started — its generation token — never the rendered `speaking` state.
 - **Must admit only one utterance at a time to Web Speech per renderer**, Settings tests included, and **must remove resolved, disabled, or suspended pending jobs before engine admission** without cutting another pane's current utterance. Pinned by `never admits a resolved queued alarm to the speech engine` in `lib/src/lib/alert-speech.test.ts`.
 - **Must bound pending jobs and cancel a stalled engine attempt**, advancing the queue and revoking callback identity before every cancel, and **never retry a failed, expired, or overflowed delivery**. Teardown cancels the current engine utterance and drops pending jobs. The bound, the timeout, and the revocation mechanism live at `SpeechQueue`.
 - `speaking` / `spoken` remains only while the originating Session is still `ALERT_RINGING`: any action that resolves the ring (Clearing And TODO) clears it, killing the Session included, while visibility, hover, and command-mode selection do not. **Never persist it or send it to the host**, so restore/reconnect cannot recreate it.
@@ -366,7 +394,7 @@ Source of truth: `lib/src/components/SettingsDialog.tsx`; `WorkspaceAlarmSetting
 | `count` | Number of members ringing or TODO; each Surface counts once. |
 | `ringingSince` | The earliest ringing member's episode start, else `null`. |
 
-**Must key the hidden tab's arrival burst on `ringingSince`**, held only for that ringing interval, so no later member, attended member, or Workspace switch replays it (rationale). Pinned by `keeps one burst while a Workspace stays ringing` and `clocks the burst from the ring that began while the Workspace was visible` in `lib/src/components/WorkspaceStrip.test.tsx`.
+**Must key the hidden tab's arrival burst on `ringingSince`**, held only for that ringing interval, so no later member, acknowledged member, or Workspace switch replays it (rationale). Pinned by `keeps one burst while a Workspace stays ringing` and `clocks the burst from the ring that began while the Workspace was visible` in `lib/src/components/WorkspaceStrip.test.tsx`.
 
 **Must keep the projection display-only:** it never enters the Activity machine or fires its own ring. A Surface with no activity entry contributes nothing. Callers **must include** minimized (`Doored`) Surfaces.
 
@@ -390,9 +418,9 @@ The header shows a fixed-text `TODO` pill when `todo === true`, a hover/focus no
 - **`a` on the selected Pane in command mode dismisses a ringing Session and opens the terminal context, whatever the status; it never edits a WATCHING rule.**
 - **A WATCHING rule is created only in the terminal context** ("Watch all `<key>` commands"), which offers the row whenever a foreground command has a watch key — naming the bare runner rule instead when one already covers the running script — and removed there or in Settings. Removing it anywhere drops it for every Session running that command.
 - Right-click always opens the context. Pressing `t` toggles TODO.
-- **The mobile composition dismisses by attention alone** — a tap or a keystroke — and wears its ring as the alarm inset, never an icon (`docs/specs/mobile-terminal-ui.md`). A Client cannot dismiss yet (`docs/specs/remote-api.md` → Future).
+- **The mobile composition dismisses by acknowledgement alone** — a tap, or a keystroke that also clears TODO — and wears its ring as the alarm inset, never an icon (`docs/specs/mobile-terminal-ui.md`). A Client cannot dismiss yet (`docs/specs/remote-api.md` → Future).
 
-**Must keep context alert controls scoped to the source**, with TODO, running-command WATCHING, and notification detail. Settings owns the global watched-command list. **Must suppress helper alerting until promotion, including after exit**: no completion dispatch (await, ring, TODO, speech, push), protocol report, attention, or TODO control, and only the default state published. **A helper still tracks its command and feeds its detector**, so one promoted mid-command is WATCHING what it runs; promotion publishes that state and never replays a suppressed event (rationale). Pinned by `helper Sessions` in `lib/src/lib/alert-manager.test.ts`.
+**Must keep context alert controls scoped to the source**, with TODO, running-command WATCHING, and notification detail. Settings owns the global watched-command list. **Must suppress helper alerting until promotion, including after exit**: no completion dispatch (await, ring, TODO, speech, push), protocol report, acknowledgement, or TODO control, and only the default state published. **A helper still tracks its command and feeds its detector**, so one promoted mid-command is WATCHING what it runs; promotion publishes that state and never replays a suppressed event (rationale). Pinned by `helper Sessions` in `lib/src/lib/alert-manager.test.ts`.
 
 Source of truth: `TerminalContext` in `lib/src/components/wall/TerminalContext.tsx`; `setHelper` in `lib/src/lib/alert-manager.ts`, which every host calls at helper spawn, listing, and promotion.
 
@@ -408,11 +436,11 @@ A Door is display-only for alert state:
 
 - show the TODO pill when `todo === true`
 - while ringing with no speech state, wear the ring `spoken` uses, unlabelled, named `needs attention`
-- while its Session is `speaking`, replace the compact TODO cluster with the explicit `SPEAKING` label and invert + pulse the whole Door — that state lasts one utterance. `spoken` persists until the ring is attended, so it keeps a static high-contrast inset and adds a speaker icon *beside* the TODO pill instead of replacing it; those are the baseboard's persistent signals and **must not go dark for an unbounded window**
+- while its Session is `speaking`, replace the compact TODO cluster with the explicit `SPEAKING` label and invert + pulse the whole Door — that state lasts one utterance. `spoken` persists until the ring clears, so it keeps a static high-contrast inset and adds a speaker icon *beside* the TODO pill instead of replacing it; those are the baseboard's persistent signals and **must not go dark for an unbounded window**
 - do not expose a Door-specific alert menu
 - scrolled out of view, its overflow arrow carries its ring and TODO (`docs/specs/layout.md` → Baseboard responsive sizing)
 
-Click or `Enter` on a Door reattaches into passthrough and clears a ring; `d` reattaches in command mode and leaves the ring intact (Attention).
+Click or `Enter` on a Door reattaches into passthrough and clears a ring; `d` reattaches in command mode and leaves the ring intact (Engagement).
 
 ## Text And Security
 
@@ -424,4 +452,4 @@ Notification text is untrusted terminal output.
 - **Never** execute commands, open URLs, copy to clipboard, read files, focus outside Dormouse, or render protocol-supplied icons/buttons/actions.
 - Wherever notification text appears in visible UI or accessible labels, it is plain text, and layout must tolerate long text, CJK, RTL, combining marks, and emoji without pushing fixed controls out of bounds. Sanitized terminal-supplied `OSC 0` / `OSC 2` / `OSC 9` text also participates in normal Pane-label derivation, and that label may reach the opt-in speech and push channels — **each after its own second pass**, because a label safe to *render* is not automatically safe to hand a speech engine or an OS notification, and those two fail in different ways. See `toSpokenText` under Spoken alarms and `toPushText` under Push notifications.
 
-Robustness: Sessions ring independently; minimize, reattach, rerender, resize, and theme changes preserve alert state without creating rings (WATCHING Track, glossary I3); an exited Session may keep ringing until attended, dismissed, or destroyed; ringing must not rely on color alone and must respect `prefers-reduced-motion`.
+Robustness: Sessions ring independently; minimize, reattach, rerender, resize, and theme changes preserve alert state without creating rings (WATCHING Track, glossary I3); an exited Session may keep ringing until acknowledged, dismissed, or destroyed; ringing must not rely on color alone and must respect `prefers-reduced-motion`.
diff --git a/docs/specs/alert.rationale.md b/docs/specs/alert.rationale.md
index 9ca2faea8..13d8b0ef8 100644
--- a/docs/specs/alert.rationale.md
+++ b/docs/specs/alert.rationale.md
@@ -10,12 +10,30 @@
 
 **Why the detector outranks the command-exit arm.** A watched command is by definition running, so a WATCHING Session is almost always also command-exit armed; ranking the arm first would mask the detector's busy/quiet states for the whole run, and the detector's state is the one derived from real output.
 
-## Attention
+## Engagement
 
-**Why attention uses the narrow reply classifier.** The prompt recorder filters every CSI/SS3 sequence because it cannot interpret them as command text. Reusing that filter for attention ignored real encoded keys, while its omission of DCS let device-query replies attend background panes; regression tests reproduced both failures in September 2026. The narrower reply classifier already used for replay and untouched-session tracking separates keys from replies without changing live PTY forwarding. Mouse-only chunks need a separate guard: the narrower classifier does not include mouse encodings, and inside programs can request hover and wheel reports without a click. Those reports otherwise dismiss a ring and cancel its pending alarms. Actual clicks already attend through the Pane’s DOM handler.
+**Why three signals instead of one attention lease.** `attend()` used to acknowledge the Session, stand in for presence, and name the focus all at once, as a 15-second keystroke lease read once at completion time. Each merge failed on its own (audit, 2026-09-23): a user who pressed `Enter` and sat back watching a build had the pane they were staring at ring 15 seconds later; a Claude Code permission prompt arriving 8 seconds after the user submitted a prompt was dropped outright because the lease was still running, and nothing re-raised it after they walked away; a click that attended one pane armed another; and a browser Surface click created a manager entry that masked its local TODO. Presence belongs to a window, focus to a Wall, acknowledgement to a Session, so each is reported where it is known.
+
+**Why pointer movement and the wheel count as presence.** Reading output is the common way to watch a pane, and it involves scrolling and moving the mouse but no typing; only keystrokes counted before, so reading a scrolling build for 15 seconds counted as walking away.
+
+**Why a command-mode selection is not focus.** Command mode is navigation: the selection passes over panes while the user looks for one, and none of them receives the keyboard. Treating it as focus would hold completions on whatever pane the cursor was left on.
+
+**Why the renderer computes presence.** It is the only side that sees input events, and a presence timer in the host would need an IPC message per event to refresh it; one message per transition carries the same information.
+
+**Why each VS Code webview is its own viewer.** The webviews share one manager. With one attention slot, a webview's window blur sent an id-less clear that wiped the attention another webview had just set, arming its running build (audit, 2026-09-23).
+
+**Why the reply classifier is the narrow one.** The prompt recorder filters every CSI/SS3 sequence because it cannot interpret them as command text. Reusing that filter here ignored real encoded keys, while its omission of DCS let device-query replies acknowledge background panes; regression tests reproduced both failures in September 2026. The narrower reply classifier already used for replay and untouched-session tracking separates keys from replies without changing live PTY forwarding. Mouse-only chunks need a separate guard: the narrower classifier does not include mouse encodings, and inside programs can request hover and wheel reports without a click. Those reports otherwise dismiss a ring and cancel its pending alarms. Actual clicks already acknowledge through the Pane's DOM handler.
+
+**Why the echo window.** The detector cannot tell a program's output from the echo of the user's own keys: typing a draft into a watched `claude` pane at seven keys a second built BUSY from echo alone, so leaving the pane mid-draft rang it, and a parked `dor await --until quiet` resolved on the half-typed draft (audit probes, 2026-09-23). A recorded Claude Code 2.1 session echoed each key within 10 ms; 250 ms covers a TUI's redraw of its input box and still leaves a program's real response to `Enter` counted from its first quarter second.
+
+**Why a completion inside the echo window neither rings nor holds.** It answers the keystroke: a bell on a failed Tab completion, the exit `Ctrl-C` just caused, a `q` quitting a pager. Held, it would ring the pane the user is looking at the moment they sat back for the inactivity timeout.
 
 ## Completion events
 
+**Why hold instead of drop.** A completion on an engaged Session used to be discarded, so a report the user never acted on was lost once they walked away — the permission prompt under Engagement is the recorded case. Holding keeps the summons owed without ringing a pane the user is looking at: acting on it answers it, and walking away rings it.
+
+**Why dropping on an explicit disengage may be a mistake.** Moving focus to another pane, or leaving the window, is a deliberate act by someone who was looking at the completion, so ringing it then would summon them for something they just saw (decision, 2026-09-23). It also forgets a prompt the user glanced at and clicked away from to look something up. If that proves common, escalating on every disengage and letting the acknowledged-state check absorb the repeat is the alternative.
+
 **Why nothing is decided at the point of detection.** Dispatching before suppression lets an observer see the three-second `npm test` that finished attended and would never have rung anyone. A seam firing only the events a human would have been shown could not serve `dor await` at all.
 
 **Why the gate reads private detector state.** The detector runs for unwatched commands, and other tracks can mask it in the public projection; the gate needs the underlying evidence, not whichever state wins display precedence.
@@ -86,6 +104,8 @@
 
 ## Clearing And TODO
 
+**Why any keystroke clears TODO.** The rule was `Enter` only, and missed `Enter` sent as a win32-input-mode or kitty `CSI 13 u` sequence and a one-key answer such as `y`; it also read the renderer's copy of TODO before the attend it had just sent had come back, so a TODO that attend created survived the key (audit, 2026-09-23). Typing into the pane is dealing with it.
+
 **Why every ring sets TODO when it opens.** WATCHING rings used to create TODO only when attended or dismissed, while report and exit rings created it at once. Every verb then diverged by source: `t` on a ringing WATCHING pane turned TODO on and on a report ring turned it off; an `Enter` as the first key kept one and cleared the other; a restart dropped an unattended WATCHING ring without trace while a report ring came back as TODO (audit, 2026-09-23). Setting it at ring time makes the verbs identical. Recording the TODO the ring found lets a withdrawal take back only its own.
 
 **Why detail goes by richness.** The last writer used to win, with one special case keeping a report's text over an exit: an `OSC 9` reading `Build finished: 3 warnings` followed by a bell in the next PTY read showed `Terminal bell`, and `make; printf '\a'` showed `Terminal bell` over `make exited 2` (audit, 2026-09-23). One order covers every pair; equal ranks still take the newer text. A notification deferred behind animation used to be replaced by whatever came next, so the same bell in the next read replaced the message it followed; the deferral now keeps the richer of the two.
@@ -138,7 +158,7 @@ Guarding only completion leaves a stale `start` free to replace the active utter
 
 **Why a helper tracks its command before promotion.** A helper dropped every semantic event, so one promoted while running `claude` had no command watch until its next command: no WATCHING, and no command-exit arm (audit, 2026-09-23). Command state alerts no one by itself; only dispatch and publishing have to wait for promotion.
 
-**Why `SPEAKING` may pulse unbounded and `SPOKEN` may not.** An utterance is seconds long and stops on its own, so the pulse it carries is self-bounding. `SPOKEN` persists until the ring is attended, so animating it would be exactly the per-Session animation with no end that bounding the burst exists to remove.
+**Why `SPEAKING` may pulse unbounded and `SPOKEN` may not.** An utterance is seconds long and stops on its own, so the pulse it carries is self-bounding. `SPOKEN` persists until the ring clears, so animating it would be exactly the per-Session animation with no end that bounding the burst exists to remove.
 
 **Why `cfg.alert.ringingPaused` suppresses the pulse.** It is the visual-snapshot freeze that pins the alarm; even a bounded animation could otherwise snapshot at an arbitrary phase during its first 2.6 seconds.
 
diff --git a/docs/specs/glossary.md b/docs/specs/glossary.md
index 50dcb5465..4d5b494ca 100644
--- a/docs/specs/glossary.md
+++ b/docs/specs/glossary.md
@@ -117,7 +117,7 @@ A Wall is always in exactly one input mode; `docs/specs/layout.md` owns the swit
 | **Registry** | xterm.js Terminal + persistent DOM element | `lib/src/lib/terminal-registry.ts` facade over `terminal-store.ts`, `terminal-lifecycle.ts` |
 | **View** | Where and how a Surface renders | `lib/src/components/Wall.tsx` plus `lib/src/components/wall/` |
 | **Link** | Webview ↔ host relationship | `lib/src/lib/reconnect.ts` |
-| **Activity** | Alert / attention state machine + renderer cache | `lib/src/lib/alert-manager.ts`, `lib/src/lib/session-activity-store.ts` |
+| **Activity** | Alert / engagement state machine + renderer cache | `lib/src/lib/alert-manager.ts`, `lib/src/lib/session-activity-store.ts` |
 | **Snapshot** | Persisted-to-disk projection: cwd, title, `untouched`, alert — never scrollback (`docs/specs/transport.md`) | `lib/src/lib/session-save.ts` / `session-restore.ts` |
 
 A **Session** is the tuple of its `SessionId` plus one state per layer (I1).
diff --git a/docs/specs/layout.md b/docs/specs/layout.md
index e9d959985..acc604662 100644
--- a/docs/specs/layout.md
+++ b/docs/specs/layout.md
@@ -537,7 +537,7 @@ A store commit that empties the tree (last pane killed or minimized) triggers th
 
 > Numbered for cross-spec reference; the numbers are stable, so append rather than renumber and leave a retired one retired.
 
-- **#2 — A focused iframe surface is not a window blur**: it blurs the window while `document.hasFocus()` stays true, so **cross-session attention is cleared only on a *real* blur** — otherwise focusing an embed would wipe attention across the Wall.
+- **#2 — A focused iframe surface is not a window blur**: it blurs the window while `document.hasFocus()` stays true, so **presence ends only on a *real* blur** (`docs/specs/alert.md` → Engagement) — otherwise focusing an embed would end it across the window.
 - **#6 — Focus-neutral surface creation (`dor ensure` / `dor iframe` / `dor ab`)**: unlike `dor split`, these open in the background without moving focus off the caller (`docs/specs/dor-cli.md`, `docs/specs/dor-browser.md`). An add never re-parents the caller's subtree or steals activation, and the create does not call `selectPane` (`settleAddSelection` returns false for a focus-neutral, non-selection-replacing add). **The one exception**: `dor iframe` / `dor ab` replacing the pane the user is *currently selected on* moves selection to the replacement, else it would dangle on the removed leaf; any other pane, or a door selection, is left untouched. Cleanup of a `dor ensure` temporary Surface follows `docs/specs/notepad.md` → "Closure"; any completed teardown preserves the caller's live selection.
 
 ## Future
diff --git a/docs/specs/mobile-terminal-ui.md b/docs/specs/mobile-terminal-ui.md
index 76310c746..1bba9a5fb 100644
--- a/docs/specs/mobile-terminal-ui.md
+++ b/docs/specs/mobile-terminal-ui.md
@@ -42,9 +42,10 @@ Chrome rules:
   radius. Order: title, secondary detail, TODO pill, minimize, kill (suppressed
   by `showKillButton={false}`, as Pocket does). Both consumers wire minimize to
   the Sessions reserve, not a desktop Door. A ring shows as the alarm inset on
-  the bar and on its session-list row, and **a tap on the terminal attends the
-  Session**, which is how it is dismissed here (`docs/specs/alert.md` -> Pane
-  Header).
+  the bar and on its session-list row. **`MobileTerminalUi` acknowledges the
+  active Session itself** — a touch in the host's capture phase, before any
+  touch mode consumes it, and each input-bar or gesture key with input — since
+  its writes bypass xterm (`docs/specs/alert.md` -> Engagement).
 * **Must install `useDynamicPalette` in `MobileTerminalUi`** for gesture tokens;
   it never mounts the desktop `Wall`. `docs/specs/theme.md` owns publication
   and the CSS baselines available before the effect runs.
diff --git a/docs/specs/remote-api.md b/docs/specs/remote-api.md
index be1806b63..3f615a8e4 100644
--- a/docs/specs/remote-api.md
+++ b/docs/specs/remote-api.md
@@ -360,7 +360,7 @@ The wire half, as new event names:
 { event: 'terminal.semantic'; data: TerminalSemanticEvent }
 ```
 
-`terminal.resize` lets an attached viewer show its own tether state instead of rendering garbled wrap until re-attach; `terminal.semantic` frees the attached pane's header from the coalesced `directory.snapshot` cadence. Attention rides the same stage — a `terminal.attend` on touch, without which a Client cannot put a ring out (`alertAttend` is inert today).
+`terminal.resize` lets an attached viewer show its own tether state instead of rendering garbled wrap until re-attach; `terminal.semantic` frees the attached pane's header from the coalesced `directory.snapshot` cadence. Acknowledgement rides the same stage — a `terminal.acknowledge` on touch, without which a Client cannot put a ring out (`alertAcknowledge` is inert today).
 
 ### 6. Graded grants and layout mutations
 
diff --git a/docs/specs/terminal-escapes.md b/docs/specs/terminal-escapes.md
index c9319b3fb..d8494a001 100644
--- a/docs/specs/terminal-escapes.md
+++ b/docs/specs/terminal-escapes.md
@@ -127,9 +127,9 @@ Source of truth: `getWebviewHtml` in `vscode-ext/src/webview-html.ts`, `app.secu
 
 `onData` includes xterm.js *replies*. **Both classifiers require every chunk token to match**, so a report glued onto real keystrokes is never mistaken for one.
 
-- **`inputIsReplayTerminalReport`** — dropped outright while `isReplaying` (rationale). Shapes: cursor-position / device-status (`CSI [?]<params> R` / `n`), device attributes (`CSI [?>=]<params> c`), window-manipulation reports (`CSI <params> t` / `x`), DECRQSS and XTSMGRAPHICS reports (`CSI [?]<params> $y` and `CSI ? <params> S`), focus in/out (`CSI I` / `CSI O`), kitty keyboard-query replies (`CSI ? <flags> u`), and OSC, DCS, or APC replies of any shape. Also gates recording, attention ([alert.md](alert.md)), and untouched state ([layout.md](layout.md)).
+- **`inputIsReplayTerminalReport`** — dropped outright while `isReplaying` (rationale). Shapes: cursor-position / device-status (`CSI [?]<params> R` / `n`), device attributes (`CSI [?>=]<params> c`), window-manipulation reports (`CSI <params> t` / `x`), DECRQSS and XTSMGRAPHICS reports (`CSI [?]<params> $y` and `CSI ? <params> S`), focus in/out (`CSI I` / `CSI O`), kitty keyboard-query replies (`CSI ? <flags> u`), and OSC, DCS, or APC replies of any shape. Also gates recording, acknowledgement ([alert.md](alert.md)), and untouched state ([layout.md](layout.md)).
 - **`inputIsSyntheticTerminalReport`** — the broader prompt-recording guard (any chunk built only of CSI, SS3 `ESC O <final>`, OSC, or APC tokens). **Never dropped, and must suppress input recording alone** — these sequences can encode real keys.
-- **`stripMouseReportsFromInput`** — removes X10 (`CSI M <3 bytes>`), SGR (`CSI < b;x;y M/m`) and urxvt (`CSI b;x;y M`) mouse reports during mouse-mode override, so reports bypassing DOM interception never reach the PTY ([mouse-and-clipboard.md](mouse-and-clipboard.md)). Keyboard-attention gating: `docs/specs/alert.md` → Attention.
+- **`stripMouseReportsFromInput`** — removes X10 (`CSI M <3 bytes>`), SGR (`CSI < b;x;y M/m`) and urxvt (`CSI b;x;y M`) mouse reports during mouse-mode override, so reports bypassing DOM interception never reach the PTY ([mouse-and-clipboard.md](mouse-and-clipboard.md)). Acknowledgement gating: `docs/specs/alert.md` → Engagement.
 
 **No filter may swallow user keyboard escape sequences** — arrows, function keys, bracketed paste, kitty modified-key reports, win32-input-mode key records (`CSI …_`). Source of truth: `lib/src/lib/terminal-report-filter.ts`.
 
diff --git a/docs/specs/tutorial.rationale.md b/docs/specs/tutorial.rationale.md
index 23d625077..e4334cc61 100644
--- a/docs/specs/tutorial.rationale.md
+++ b/docs/specs/tutorial.rationale.md
@@ -26,7 +26,7 @@
 
 **Why `s` pumps only `tut-boxed`.** `tut-splash` animates continuously and so is never silent; only the quiet pane needs pumping for WATCHING's silence chain to be worth watching.
 
-**Why the `x` demo uses an unwatched command name.** WATCHING and a command exit both raise the ring, so a watched name would leave the user unable to tell which fired. `slowbuild` sits outside the WATCHING rule set, leaving the command exit as the only source — and command-exit alerting arms only once the user has attended the pane and left it, which is what the demo asks for.
+**Why the `x` demo uses an unwatched command name.** WATCHING and a command exit both raise the ring, so a watched name would leave the user unable to tell which fired. `slowbuild` sits outside the WATCHING rule set, leaving the command exit as the only source — and command-exit alerting arms only once the user has clicked into the pane and left it, which is what the demo asks for.
 
 ## Fake shell behavior
 
diff --git a/docs/specs/vscode.md b/docs/specs/vscode.md
index 9dcb92dd1..c04ca90c9 100644
--- a/docs/specs/vscode.md
+++ b/docs/specs/vscode.md
@@ -28,6 +28,7 @@ The webview is the shared `lib/` frontend, unmodified for this host (`docs/specs
 
 - **Capture, then save, then kill.** `deactivate()` runs the agent-recovery capture *first* and both kills *last*, the state flush and live-PTY refresh in between. Source of truth: `deactivate()` in `vscode-ext/src/extension.ts`.
 - **Alert state is global.** One module-level `AlertManager` in `message-router.ts` is shared across all routers, survives router disposal, and is fed by PTY data regardless of webview visibility.
+- **Each router is one engagement viewer** of it (`docs/specs/alert.md` → Engagement), set by `alert:engagement`. **Must remove the viewer on router disposal and on a `dormouse:init` re-init**, which also cancels that router's parked awaits: recreated content is a new realm. Pinned by `engagement viewers` in `vscode-ext/test/message-router.test.ts`.
 - **WATCHING rules are host-authoritative.** The first webview after extension-host startup seeds the shared host rule set and **no later webview may replace it**.
 - **Never let a resuming router steal another webview's PTYs.** Each router tracks its PTYs in `ownedPtyIds`; a module-level `globalOwnedPtyIds` set enforces it.
 - **Every save path must merge current alert states through the shared persistence projection.** The frontend periodic save (`onSaveState`) and the backend deactivate refresh (`refreshSavedSessionStateFromPtys`) both narrow alerts with `toPersistedAlertState`; missing the merge reverts alert state on restore, while passing live state through persists transient fields.
diff --git a/lib/src/cfg.ts b/lib/src/cfg.ts
index 220cd5212..164555b24 100644
--- a/lib/src/cfg.ts
+++ b/lib/src/cfg.ts
@@ -24,8 +24,10 @@ export const cfg = {
     needsAttentionConfirm: 3_000,
     /** ms — ignore resize redraw noise. */
     resizeDebounce: 500,
-    /** ms — attention idle expiry. How long before "looking at this pane" wears off. */
+    /** ms — default inactivity timeout: presence lapses this long after the last typing, mouse, or scroll input. */
     userAttention: 15_000,
+    /** ms — output and completions this soon after a keystroke into a Session answer that keystroke and are ignored. */
+    echoWindow: 250,
     /** ms — shortest run a command-exit ring reports; anything quicker was probably watched. */
     commandExitMinRuntime: 15_000,
     /** ms — longest a terminal notification may wait behind animation before it rings anyway. */
diff --git a/lib/src/components/Door.tsx b/lib/src/components/Door.tsx
index 15cc68a9f..de7d52217 100644
--- a/lib/src/components/Door.tsx
+++ b/lib/src/components/Door.tsx
@@ -129,7 +129,7 @@ export function Door({
         <span className="min-w-0 flex-1 truncate">
           {title}
         </span>
-        {/* `spoken` is unbounded (it lasts until the ring is attended), so it joins
+        {/* `spoken` is unbounded (it lasts until the ring clears), so it joins
             the badge cluster instead of replacing it — see docs/specs/layout.md. */}
         {speaking ? (
           <span className={clsx('flex shrink-0 items-center gap-1 text-xs font-bold', ALERT_SPEECH_TRACKING_CLASS)}>
diff --git a/lib/src/components/MobileTerminalUi.tsx b/lib/src/components/MobileTerminalUi.tsx
index 0fca1cca4..d6bc15d0e 100644
--- a/lib/src/components/MobileTerminalUi.tsx
+++ b/lib/src/components/MobileTerminalUi.tsx
@@ -42,6 +42,7 @@ import { TouchUiContext } from './touch-ui-context';
 import { AlertRingInset, alertRingRow, useAlertRingBurst } from './alert-ring';
 import type { AlertEpisode } from '../lib/alert-episode';
 import type { SessionStatus } from '../lib/terminal-registry';
+import { acknowledgeSession } from '../lib/session-activity-store';
 import type { MouseTrackingMode, OverrideState } from '../lib/mouse-selection';
 
 export type MobileTerminalKeyboardMode = 'sessions' | 'recent' | 'type' | 'draft';
@@ -513,11 +514,19 @@ export function MobileTerminalUi({
   const [gestureState, setGestureState] = useState<MobileGestureTrackingState>(MOBILE_GESTURE_IDLE_STATE);
   const [pendingGestureConfirmation, setPendingGestureConfirmation] = useState<MobileGestureConfirmationAction | null>(null);
   const [inputValue, setInputValue] = useState('');
+  // The composition's own input bar and gestures write around xterm, so it
+  // acknowledges the Session they reach itself (`docs/specs/alert.md` ->
+  // Engagement): a keystroke with input, a touch without.
+  const activeSessionId = sessions.find((session) => session.active)?.id ?? null;
+  const acknowledgeActive = useCallback((input: boolean) => {
+    if (activeSessionId !== null) acknowledgeSession(activeSessionId, input);
+  }, [activeSessionId]);
 
   const sendInput = useCallback((data: string) => {
     if (!interactive || data.length === 0) return;
+    acknowledgeActive(true);
     onSendInput?.(data);
-  }, [interactive, onSendInput]);
+  }, [acknowledgeActive, interactive, onSendInput]);
 
   const commitGestureState = useCallback((nextState: MobileGestureTrackingState) => {
     gestureStateRef.current = nextState;
@@ -713,6 +722,8 @@ export function MobileTerminalUi({
 
   const handlePanePointerDownCapture = useCallback((event: PointerEvent<HTMLDivElement>) => {
     if (isGestureDialogTarget(event.target)) return;
+    // Capture on the host runs before any mode below consumes the touch.
+    if (interactive) acknowledgeActive(false);
     blurPaneTextInputs();
     if (interactive && touchMode === 'cursor' && isTouchLikePrimaryPointer(event)) {
       event.preventDefault();
@@ -738,7 +749,7 @@ export function MobileTerminalUi({
       origin,
       displayOriginAwayFromThumb(origin, event.currentTarget.getBoundingClientRect()),
     ));
-  }, [blurPaneTextInputs, clearGestureCompletionTimer, commitGestureState, interactive, touchMode]);
+  }, [acknowledgeActive, blurPaneTextInputs, clearGestureCompletionTimer, commitGestureState, interactive, touchMode]);
 
   const handlePanePointerMoveCapture = useCallback((event: PointerEvent<HTMLDivElement>) => {
     if (touchMode === 'cursor' && cursorPointerIdRef.current === event.pointerId && isTouchLikePrimaryPointer(event)) {
diff --git a/lib/src/components/MobileWall.test.tsx b/lib/src/components/MobileWall.test.tsx
index 4d2caeea2..d75624e6e 100644
--- a/lib/src/components/MobileWall.test.tsx
+++ b/lib/src/components/MobileWall.test.tsx
@@ -16,7 +16,6 @@ const registry = vi.hoisted(() => ({
   getOrCreateTerminal: vi.fn(),
   terminalPaneStateSnapshot: new Map(),
   getTerminalPaneStateSnapshot: vi.fn(),
-  markSessionAttention: vi.fn(),
   setTerminalUserTitle: vi.fn(),
   subscribeToActivity: vi.fn(() => () => {}),
   subscribeToTerminalPaneState: vi.fn(() => () => {}),
@@ -72,10 +71,6 @@ function headerInset(): string | null {
     ?.getAttribute('data-alert-ring-inset') ?? null;
 }
 
-function terminalPane(): HTMLElement {
-  return container.querySelector<HTMLElement>('[data-testid="terminal-pane"]')!.parentElement!;
-}
-
 describe('MobileWall', () => {
   it('shows the Kill control by default', () => {
     renderWall();
@@ -107,16 +102,4 @@ describe('MobileWall', () => {
       registry.activitySnapshot.clear();
     }
   });
-
-  /** Mobile has no terminal context and no right-click, so attention is the
-   *  whole dismissal (`docs/specs/alert.md` -> Pane Header). */
-  it('attends the Session when the terminal is touched', () => {
-    renderWall();
-
-    act(() => {
-      terminalPane().dispatchEvent(new MouseEvent('pointerdown', { bubbles: true }));
-    });
-
-    expect(registry.markSessionAttention).toHaveBeenCalledWith('pane-a');
-  });
 });
diff --git a/lib/src/components/MobileWall.tsx b/lib/src/components/MobileWall.tsx
index c6cac2c77..0b0e0b796 100644
--- a/lib/src/components/MobileWall.tsx
+++ b/lib/src/components/MobileWall.tsx
@@ -16,7 +16,6 @@ import {
   getActivitySnapshot,
   getOrCreateTerminal,
   getTerminalPaneStateSnapshot,
-  markSessionAttention,
   setTerminalUserTitle,
   subscribeToActivity,
   subscribeToTerminalPaneState,
@@ -154,14 +153,9 @@ export function MobileWall({
         onKill={() => killSession(activeItem.id)}
         showKillButton={showKillButton}
       />
-      {/* Touching the pane attends it, which is what puts a ring out here:
-          mobile has no terminal context and no right-click
-          (`docs/specs/alert.md` -> Pane Header). Keystrokes already attend
-          through `wireXtermHandlers`. */}
-      <div
-        className="min-h-0 flex-1 overflow-hidden bg-terminal-bg"
-        onPointerDown={() => markSessionAttention(activeItem.id)}
-      >
+      {/* `MobileTerminalUi` acknowledges a touch or keystroke on this pane —
+          the only way a ring goes out here (`docs/specs/alert.md` -> Pane Header). */}
+      <div className="min-h-0 flex-1 overflow-hidden bg-terminal-bg">
         <TerminalPane id={activeItem.id} isFocused />
       </div>
     </div>
diff --git a/lib/src/components/SettingsDialog.tsx b/lib/src/components/SettingsDialog.tsx
index 641e0bdd3..ab723b566 100644
--- a/lib/src/components/SettingsDialog.tsx
+++ b/lib/src/components/SettingsDialog.tsx
@@ -200,7 +200,8 @@ export function SettingsDialog({ onClose }: { onClose: () => void }) {
           onCommit={(inactivityTimeoutMs) => updateAlertSettings({ inactivityTimeoutMs })}
         />
         <div className="mt-1 text-sm leading-relaxed text-muted">
-          User has walked away after this much inactivity.
+          You count as away after this long without typing, moving the mouse,
+          or scrolling in Dormouse.
         </div>
       </section>
 
diff --git a/lib/src/components/Wall.test.tsx b/lib/src/components/Wall.test.tsx
index 3f45f1224..d5cc6e144 100644
--- a/lib/src/components/Wall.test.tsx
+++ b/lib/src/components/Wall.test.tsx
@@ -3798,3 +3798,157 @@ it('leaves a reveal for a hidden Workspace unanswered', async () => {
   expect(refit).not.toHaveBeenCalled();
   expect(container.querySelector('[data-terminal-context]')).toBeNull();
 });
+
+/**
+ * Engagement (`docs/specs/alert.md` -> Engagement): the Wall reports which
+ * terminal Session it points the realm at, and which gestures acknowledge.
+ */
+describe('engagement', () => {
+  function reportedFocus(report: ReturnType<typeof vi.spyOn>): string | null | undefined {
+    return (report.mock.calls.at(-1)?.[0] as { focusId: string | null } | undefined)?.focusId;
+  }
+
+  async function commandMode(): Promise<void> {
+    await act(async () => {
+      window.dispatchEvent(new KeyboardEvent('keydown', { key: 'Shift', location: 1, bubbles: true }));
+      window.dispatchEvent(new KeyboardEvent('keydown', { key: 'Shift', location: 2, bubbles: true }));
+    });
+  }
+
+  it('points at the passthrough pane, and at nothing from command mode or a Door', async () => {
+    const report = vi.spyOn(fake, 'alertEngagement');
+    await act(async () => root.render(<Wall initialPaneIds={['pane-a', 'pane-b']} initialMode="passthrough" />));
+    await flush();
+    expect(reportedFocus(report)).toBe('pane-a');
+
+    await commandMode();
+    expect(reportedFocus(report)).toBeNull();
+
+    await act(async () => {
+      container.querySelector('[data-lath-leaf="pane-b"] [data-session-id="pane-b"]')!
+        .dispatchEvent(new MouseEvent('mousedown', { bubbles: true }));
+    });
+    expect(reportedFocus(report)).toBe('pane-b');
+
+    await act(async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: 'm', bubbles: true })); });
+    await commandMode();
+    await act(async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: 'm', bubbles: true })); });
+    await flush();
+    expect(container.querySelector('[data-door-id="pane-b"]')).not.toBeNull();
+    expect(reportedFocus(report)).toBeNull();
+  });
+
+  it('points at the source while its terminal context is open, even from command mode', async () => {
+    const report = vi.spyOn(fake, 'alertEngagement');
+    await act(async () => root.render(<Wall initialPaneIds={['pane-a']} initialMode="command" />));
+    await flush();
+    expect(reportedFocus(report)).toBeUndefined();
+
+    const header = container.querySelector<HTMLElement>('[data-pane-header-for="pane-a"]')!;
+    await act(async () => { header.dispatchEvent(new MouseEvent('contextmenu', { bubbles: true, cancelable: true, clientX: 120, clientY: 90 })); });
+    expect(reportedFocus(report)).toBe('pane-a');
+  });
+
+  it('points at nothing from a browser Surface in passthrough', async () => {
+    const report = vi.spyOn(fake, 'alertEngagement');
+    await act(async () => root.render(<Wall
+      restoredLathLayout={{
+        version: 1,
+        tree: { root: { kind: 'leaf', id: 'browser-a' } },
+        leafMeta: {
+          'browser-a': {
+            component: 'browser',
+            tabComponent: 'browser',
+            title: 'example.com',
+            params: { surfaceType: 'browser', renderMode: 'iframe', url: 'https://example.com' },
+          },
+        },
+      }}
+      initialMode="passthrough"
+    />));
+    await flush();
+    expect(reportedFocus(report) ?? null).toBeNull();
+  });
+
+  it('points at nothing from a hidden Workspace', async () => {
+    const report = vi.spyOn(fake, 'alertEngagement');
+    await act(async () => root.render(<Wall initialPaneIds={['pane-a']} initialMode="passthrough" active={false} />));
+    await flush();
+    expect(reportedFocus(report) ?? null).toBeNull();
+  });
+
+  it('acknowledges a click on a pane and a Door, but not a `d` reattach', async () => {
+    const acknowledge = vi.spyOn(terminalRegistry, 'acknowledgeSession');
+    await act(async () => root.render(
+      <Wall initialPaneIds={['pane-a']} initialDoors={[{ id: 'door-a', title: 'A' }]} initialMode="command" />,
+    ));
+    await flush();
+
+    await act(async () => {
+      container.querySelector('[data-session-id="pane-a"]')!.dispatchEvent(new MouseEvent('mousedown', { bubbles: true }));
+    });
+    expect(acknowledge.mock.calls).toEqual([['pane-a', false]]);
+
+    await act(async () => { container.querySelector<HTMLElement>('[data-door-id="door-a"] button')!.click(); });
+    await flush();
+    expect(container.querySelector('[data-lath-leaf="door-a"]')).not.toBeNull();
+    expect(acknowledge.mock.calls.at(-1)).toEqual(['door-a', false]);
+
+    // `m` leaves the new Door selected in command mode; `d` brings it back there.
+    await commandMode();
+    await act(async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: 'm', bubbles: true })); });
+    await flush();
+    expect(container.querySelector('[data-door-id="door-a"]')).not.toBeNull();
+    acknowledge.mockClear();
+    await act(async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: 'd', bubbles: true })); });
+    await flush();
+    expect(container.querySelector('[data-door-id="door-a"]')).toBeNull();
+    expect(acknowledge).not.toHaveBeenCalled();
+  });
+
+  it('moves focus to a Surface `dor` reveals without acknowledging it', async () => {
+    const toolId = 'tool-revealed';
+    terminalRegistry.applyTerminalSemanticEvents(toolId, [
+      { type: 'commandLine', commandLine: 'pnpm storybook' },
+      { type: 'commandStart' },
+    ]);
+    (fake as FakePtyAdapter & Pick<PlatformAdapter, 'toolControl'>).toolControl = vi.fn(async () => okToolLookup(['/repo']));
+    const acknowledge = vi.spyOn(terminalRegistry, 'acknowledgeSession');
+    const report = vi.spyOn(fake, 'alertEngagement');
+    try {
+      await act(async () => root.render(
+        <Wall
+          initialPaneIds={['pane-a']}
+          initialDoors={[{
+            id: toolId,
+            title: 'storybook',
+            component: 'tool',
+            tabComponent: 'tool',
+            params: {
+              surfaceType: 'tool', command: 'pnpm storybook', cwd: '/repo', toolName: 'storybook',
+              toolRender: 'iframe', toolPort: 'announced', toolKey: ['storybook', '/repo'],
+            },
+          }]}
+          initialMode="command"
+        />,
+      ));
+      await flush();
+      await act(async () => {
+        window.dispatchEvent(new CustomEvent('dormouse:control-request', {
+          detail: {
+            method: SURFACE_CONTROL_METHODS.tool,
+            params: { name: 'storybook', cwd: '/repo', minimized: false, fresh: false },
+            respond: () => {},
+          },
+        }));
+      });
+      await flush();
+
+      expect(container.querySelector(`[data-lath-leaf="${toolId}"]`)).not.toBeNull();
+      expect(reportedFocus(report)).toBe(toolId);
+      expect(acknowledge).not.toHaveBeenCalled();
+    } finally {
+      act(() => terminalRegistry.removeTerminalPaneState(toolId));
+    }
+  });
+});
diff --git a/lib/src/components/Wall.tsx b/lib/src/components/Wall.tsx
index 27da6a064..85655f4fc 100644
--- a/lib/src/components/Wall.tsx
+++ b/lib/src/components/Wall.tsx
@@ -33,13 +33,12 @@ import { messageOf } from '../lib/errors';
 import { archiveSurfaceNotes } from '../lib/notepad/close-coordinator';
 import { beginClosing, isSurfaceClosing, registerNotepadSurfaceMetaResolver, removeSurface, transferNotepad } from '../lib/notepad/notepad-store';
 import {
-  clearSessionAttention,
+  acknowledgeSession,
   clearLocalSurfaceActivity,
   deriveSessionLabel,
   disposeSession,
   focusSession,
   refitSession,
-  markSessionAttention,
   toggleSessionTodo,
   setPendingShellOpts,
   getDefaultShellOpts,
@@ -109,6 +108,7 @@ import { useAlertSpeech } from './wall/use-alert-speech';
 import { queueToolSpawn, restartSurfaceInPlace, toolRunCommand, useDorControl, waitForNewToolCommand } from './wall/use-dor-control';
 import { errorText } from './wall/dor-control-shared';
 import { useWindowFocused } from './wall/use-window-focused';
+import { useEngagementFocus } from './wall/use-engagement-focus';
 import {
   DialogKeyboardContext,
   DoorElementsContext,
@@ -843,12 +843,14 @@ export function Wall({
     confirmTimerRef.current = setTimeout(() => setConfirmKill(null), KILL_CONFIRM_MS);
   }, [closeSurface]);
 
-  /** Enter terminal mode for the given panel */
-  const enterTerminalMode = useCallback((id: string) => {
+  /** Enter terminal mode for the given panel. A human gesture acknowledges the
+   *  Session; `acknowledge: false` only moves focus there — a `dor` reveal, an
+   *  embed focusing itself (`docs/specs/alert.md` -> Engagement). */
+  const enterTerminalMode = useCallback((id: string, options?: { acknowledge?: boolean }) => {
     selectPane(id);
     modeRef.current = 'passthrough';
     setMode('passthrough');
-    markSessionAttention(id);
+    if (options?.acknowledge !== false) acknowledgeSession(id, false);
     // Defer focus so it happens after the mousedown/click event finishes.
     requestAnimationFrame(() => focusSession(id, true));
   }, [selectPane]);
@@ -871,7 +873,6 @@ export function Wall({
     // the store (it keeps changing while minimized).
     const { token } = lath.store.doorLeaf(id, { park: shouldParkOnMinimize(meta) });
     if (!token) return;
-    clearSessionAttention(id);
     // The runtime Door is identity + the core restore payload only
     // (docs/specs/tiling-engine.md → "Restore tokens"); its metadata stays in the
     // store, and the persisted row is materialized from there at save time.
@@ -951,20 +952,6 @@ export function Wall({
   const anyArchiveFailure = archiveFailures.length > 0;
   useDialogKeyboardOwner(anyArchiveFailure, acquireDialogKeyboard);
 
-  useEffect(() => {
-    // An iframe surface taking focus blurs this window without backgrounding the
-    // app (document.hasFocus() stays true). Only clear cross-session attention
-    // on a real blur, else focusing an iframe wipes attention
-    // (docs/specs/layout.md → Corner cases #2).
-    const handleBlur = () => {
-      if (!activeRef.current) return;
-      if (document.hasFocus()) return;
-      clearSessionAttention();
-    };
-    window.addEventListener('blur', handleBlur);
-    return () => window.removeEventListener('blur', handleBlur);
-  }, []);
-
   // --- Lath seed + auto-spawn ---
   const lathSeededRef = useRef(false);
   // The leaf-id set as of the last commit, so the store subscription can fire
@@ -1032,6 +1019,17 @@ export function Wall({
     [lath],
   );
 
+  // The terminal Session this Wall points its realm at (`docs/specs/alert.md` ->
+  // Engagement): an open terminal context's source, else the passthrough pane —
+  // never a command-mode selection, a Door, a browser Surface, or a hidden Wall.
+  const contextSourceId = terminalContext && !terminalContext.closing ? terminalContext.id : null;
+  const focusCandidate = contextSourceId ?? (mode === 'passthrough' && selectedType === 'pane' ? selectedId : null);
+  useEngagementFocus(
+    active && focusCandidate !== null && surfaceHasTerminal(focusCandidate)
+      ? focusCandidate
+      : null,
+  );
+
   /** Whether a Surface belongs to this Wall — the membership test in the hot
    *  paths (a PTY chunk per Session per Wall), so it asks the store rather than
    *  building a projection. Stable, so a listener can close over it. */
@@ -1178,7 +1176,7 @@ export function Wall({
 
   const handleReattach = useCallback((
     item: DooredItem,
-    options?: { enterPassthrough?: boolean; afterRestore?: DoorAfterRestoreAction },
+    options?: { enterPassthrough?: boolean; afterRestore?: DoorAfterRestoreAction; acknowledge?: boolean },
   ) => {
     const enterPassthrough = options?.enterPassthrough ?? true;
     const afterRestore = options?.afterRestore;
@@ -1200,7 +1198,7 @@ export function Wall({
 
     removeDoorAndSelect(item.id);
     if (enterPassthrough) {
-      enterTerminalMode(item.id);
+      enterTerminalMode(item.id, { acknowledge: options?.acknowledge });
     } else {
       modeRef.current = 'command';
       setMode('command');
@@ -1235,7 +1233,9 @@ export function Wall({
   /** Focus a surface for the human half of the context's port actions: activating
    *  a port row is an explicit request to look at and control that browser. A visible pane
    *  enters passthrough in place; a minimized one reattaches on the same terms
-   *  as clicking its Door chip. This is deliberately unlike `dor ab`, whose
+   *  as clicking its Door chip, except that a reveal moves focus without
+   *  acknowledging — `dor` reveals too, and an agent showing a pane is not the
+   *  human answering it. This is deliberately unlike `dor ab`, whose
    *  agent-initiated control path remains focus-neutral.
    *
    *  Returns whether the Surface ended up visible, so `dor` can report the
@@ -1243,11 +1243,11 @@ export function Wall({
    *  returns, and `nav.hasPane` reads the store, not React state. */
   const revealSurface = useCallback((id: string): boolean => {
     if (nav.hasPane(id)) {
-      enterTerminalMode(id);
+      enterTerminalMode(id, { acknowledge: false });
       return true;
     }
     const door = doorsRef.current.find((item) => item.id === id);
-    if (door) handleReattachRef.current(door);
+    if (door) handleReattachRef.current(door, { acknowledge: false });
     return nav.hasPane(id);
   }, [nav, enterTerminalMode]);
 
@@ -2234,7 +2234,8 @@ export function Wall({
   // command → move selection onto it.
   const onLeafFocused = useCallback((id: string) => {
     if (modeRef.current === 'passthrough') {
-      if (selectedIdRef.current !== id) enterTerminalMode(id);
+      // The embed moved DOM focus; no human gesture reached this Session.
+      if (selectedIdRef.current !== id) enterTerminalMode(id, { acknowledge: false });
       return;
     }
     if (selectedTypeRef.current !== 'pane' || selectedIdRef.current !== id) selectPane(id);
diff --git a/lib/src/components/mobile-acknowledge.test.tsx b/lib/src/components/mobile-acknowledge.test.tsx
new file mode 100644
index 000000000..9f4e3f659
--- /dev/null
+++ b/lib/src/components/mobile-acknowledge.test.tsx
@@ -0,0 +1,155 @@
+/**
+ * @vitest-environment jsdom
+ *
+ * The mobile composition as Pocket and the website playground ship it —
+ * `MobileTerminalUi` around `MobileWall` around the real `TerminalPane` and its
+ * xterm mouse router — so a touch meets every capture handler a real one
+ * does (`docs/specs/alert.md` -> Engagement).
+ */
+import { act, StrictMode, useState } from 'react';
+import { createRoot, type Root } from 'react-dom/client';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { MobileTerminalUi, type MobileTerminalTouchMode } from './MobileTerminalUi';
+import { MobileWall, useMobileWallSessionItems } from './MobileWall';
+import { FakePtyAdapter, setPlatform } from '../lib/platform';
+import { clearTerminalActivity, disposeAllSessions, getActivity, initAlertStateReceiver } from '../lib/terminal-registry';
+
+globalThis.IS_REACT_ACT_ENVIRONMENT = true;
+
+// jsdom has no canvas to measure glyphs with, so only the xterm engine is a
+// stand-in; the registry, `TerminalPane`, and the mouse router's capture
+// listeners on the Session's element are the real ones.
+vi.mock('@xterm/xterm', () => {
+  class Terminal {
+    element: HTMLElement | undefined;
+    cols = 80;
+    rows = 24;
+    options: Record<string, unknown> = {};
+    modes = { mouseTrackingMode: 'none', bracketedPasteMode: false };
+    parser = { registerCsiHandler: () => ({ dispose() {} }) };
+    buffer = { active: { getLine: () => undefined, baseY: 0, cursorY: 0, cursorX: 0, viewportY: 0 } };
+    private dataListeners = new Set<(data: string) => void>();
+    loadAddon(): void {}
+    open(host: HTMLElement): void {
+      this.element = document.createElement('div');
+      this.element.className = 'xterm';
+      host.appendChild(this.element);
+    }
+    write(_data: string, callback?: () => void): void { callback?.(); }
+    onData(listener: (data: string) => void) {
+      this.dataListeners.add(listener);
+      return { dispose: () => this.dataListeners.delete(listener) };
+    }
+    onResize() { return { dispose() {} }; }
+    onRender() { return { dispose() {} }; }
+    attachCustomKeyEventHandler(): void {}
+    focus(): void {}
+    blur(): void {}
+    clearSelection(): void {}
+    dispose(): void {}
+  }
+  return { Terminal };
+});
+vi.mock('@xterm/addon-fit', () => ({
+  FitAddon: class { fit() {} proposeDimensions() { return { cols: 80, rows: 24 }; } },
+}));
+vi.mock('@xterm/addon-image', () => ({ ImageAddon: class {} }));
+vi.mock('@xterm/addon-unicode-graphemes', () => ({ UnicodeGraphemesAddon: class {} }));
+
+const PANE = 'pane-a';
+const SESSIONS = [{ id: PANE, title: 'remote shell' }];
+
+let platform: FakePtyAdapter;
+let container: HTMLDivElement;
+let root: Root;
+
+function touchDown(): PointerEvent {
+  const event = new Event('pointerdown', { bubbles: true, cancelable: true }) as PointerEvent;
+  const values: Partial<PointerEvent> = {
+    pointerId: 7, pointerType: 'touch', isPrimary: true, button: 0, buttons: 1,
+    clientX: 10, clientY: 12, screenX: 110, screenY: 112,
+    ctrlKey: false, shiftKey: false, altKey: false, metaKey: false,
+  };
+  for (const [key, value] of Object.entries(values)) {
+    Object.defineProperty(event, key, { configurable: true, get: () => value });
+  }
+  return event;
+}
+
+function Composition({ touchMode }: { touchMode: MobileTerminalTouchMode }) {
+  const [active, setActive] = useState(PANE);
+  const sessions = useMobileWallSessionItems(SESSIONS, active);
+  return (
+    <MobileTerminalUi
+      interactive
+      activeTouchMode={touchMode}
+      activeKeyboardMode="type"
+      cursorTouchAvailable
+      sessions={sessions}
+      onSendInput={(data) => platform.writePty(active, data)}
+      terminal={<MobileWall sessions={SESSIONS} activeSessionId={active} onActiveSessionChange={setActive} showKillButton={false} />}
+    />
+  );
+}
+
+function render(touchMode: MobileTerminalTouchMode): void {
+  act(() => {
+    root.render(<StrictMode><Composition touchMode={touchMode} /></StrictMode>);
+  });
+}
+
+/** Ring the pane: a bell from the program. */
+function ring(): void {
+  act(() => platform.sendOutput(PANE, '\x07'));
+  expect(getActivity(PANE)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
+}
+
+beforeEach(() => {
+  platform = new FakePtyAdapter();
+  platform.setDefaultScenario({ name: 'none', chunks: [] });
+  setPlatform(platform);
+  initAlertStateReceiver();
+  Object.defineProperty(HTMLElement.prototype, 'setPointerCapture', { configurable: true, value: vi.fn() });
+  Object.defineProperty(HTMLElement.prototype, 'releasePointerCapture', { configurable: true, value: vi.fn() });
+  Object.defineProperty(document, 'elementFromPoint', { configurable: true, value: vi.fn(() => document.body) });
+  vi.stubGlobal('ResizeObserver', class { observe() {} unobserve() {} disconnect() {} });
+  Object.defineProperty(HTMLCanvasElement.prototype, 'getContext', { configurable: true, value: vi.fn(() => null) });
+  container = document.createElement('div');
+  document.body.appendChild(container);
+  root = createRoot(container);
+});
+
+afterEach(() => {
+  act(() => root.unmount());
+  container.remove();
+  disposeAllSessions();
+  clearTerminalActivity();
+  delete (document as Document & { elementFromPoint?: unknown }).elementFromPoint;
+  vi.unstubAllGlobals();
+  vi.restoreAllMocks();
+});
+
+describe('mobile acknowledge', () => {
+  it.each<MobileTerminalTouchMode>(['gestures', 'selection', 'cursor'])(
+    'a tap on the terminal puts out a ring and keeps its TODO in %s mode',
+    (mode) => {
+      render(mode);
+      ring();
+      const screen = container.querySelector('.xterm');
+      expect(screen).not.toBeNull();
+      act(() => { screen!.dispatchEvent(touchDown()); });
+      expect(getActivity(PANE)).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
+    },
+  );
+
+  it('a keystroke from the input bar acknowledges with input, clearing the TODO', () => {
+    render('gestures');
+    ring();
+    const bar = container.querySelector<HTMLTextAreaElement>('textarea[data-mobile-terminal-input], textarea');
+    expect(bar).not.toBeNull();
+    act(() => {
+      bar!.dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter', bubbles: true, cancelable: true }));
+    });
+    expect(getActivity(PANE)).toMatchObject({ status: 'WATCHING_DISABLED', todo: false });
+  });
+});
diff --git a/lib/src/components/wall/AlertRingIndicator.test.tsx b/lib/src/components/wall/AlertRingIndicator.test.tsx
index a86be26fd..6a4679ce6 100644
--- a/lib/src/components/wall/AlertRingIndicator.test.tsx
+++ b/lib/src/components/wall/AlertRingIndicator.test.tsx
@@ -99,7 +99,7 @@ describe('AlertRingIndicator', () => {
   });
 
   /**
-   * `spoken` lasts until the ring is attended, which is unbounded, so it goes
+   * `spoken` lasts until the ring clears, which is unbounded, so it goes
    * static and keeps a wash lighter than the speaking one — present enough to
    * read as an unhandled alarm, light enough not to fight terminal text for that
    * whole window.
diff --git a/lib/src/components/wall/use-engagement-focus.ts b/lib/src/components/wall/use-engagement-focus.ts
new file mode 100644
index 000000000..9d3639d2a
--- /dev/null
+++ b/lib/src/components/wall/use-engagement-focus.ts
@@ -0,0 +1,18 @@
+import { useEffect, useState } from 'react';
+import { publishEngagementFocus, retainEngagementReporter, withdrawEngagementFocus } from '../../lib/engagement';
+
+/**
+ * Report the terminal Session this Wall points its realm at (`docs/specs/alert.md`
+ * -> Engagement), holding the realm's engagement reporter while mounted.
+ */
+export function useEngagementFocus(focusId: string | null): void {
+  const [slot] = useState(() => ({}));
+  useEffect(() => {
+    const release = retainEngagementReporter();
+    return () => {
+      withdrawEngagementFocus(slot);
+      release();
+    };
+  }, [slot]);
+  useEffect(() => publishEngagementFocus(slot, focusId), [slot, focusId]);
+}
diff --git a/lib/src/lib/alert-engagement.test.ts b/lib/src/lib/alert-engagement.test.ts
new file mode 100644
index 000000000..db74bc286
--- /dev/null
+++ b/lib/src/lib/alert-engagement.test.ts
@@ -0,0 +1,356 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { AlertManager, type ActivityNotification, type AwaitOutcome } from './alert-manager';
+import { applyTerminalProtocolEvents, TerminalProtocolParser } from './terminal-protocol';
+import { cfg } from '../cfg';
+
+/**
+ * Engagement (`docs/specs/alert.md` -> Engagement): presence and focus arrive
+ * per viewer, a completion on an engaged Session is held, and what ends the
+ * engagement decides whether the held completion rings or is dropped.
+ */
+
+const PANE = 'pane';
+const OTHER = 'other';
+const VIEWER = 'viewer';
+
+const PERMISSION: ActivityNotification = { source: 'OSC 9', title: null, body: 'Claude needs your permission' };
+const BELL: ActivityNotification = { source: 'BEL', title: 'Terminal bell', body: null };
+
+let manager: AlertManager;
+
+beforeEach(() => {
+  vi.useFakeTimers();
+  manager = new AlertManager();
+});
+
+afterEach(() => {
+  manager.dispose();
+  vi.useRealTimers();
+});
+
+function engage(id: string, viewer = VIEWER): void {
+  manager.setViewer(viewer, { present: true, focusId: id });
+}
+
+/** Focus moved off, or the window blurred or hid. */
+function leave(viewer = VIEWER): void {
+  manager.setViewer(viewer, { present: false, focusId: null }, 'leave');
+}
+
+/** No input for the inactivity timeout; focus unchanged. */
+function goIdle(id: string, viewer = VIEWER): void {
+  manager.setViewer(viewer, { present: false, focusId: id }, 'idle');
+}
+
+function runCommand(id: string, commandLine: string): void {
+  manager.applyTerminalSemanticEvents(id, [
+    { type: 'commandLine', commandLine },
+    { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
+  ]);
+}
+
+function finishCommand(id: string, exitCode = 0): void {
+  manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode }, { type: 'promptStart' }]);
+}
+
+/** Output every `everyMs` for `ms`. */
+function output(id: string, ms: number, everyMs = 100): void {
+  for (let t = 0; t < ms; t += everyMs) {
+    vi.advanceTimersByTime(everyMs);
+    manager.onData(id);
+  }
+}
+
+/** One keystroke into the pane, echoed a few ms later. */
+function keystroke(id: string): void {
+  manager.acknowledge(id, { input: true });
+  vi.advanceTimersByTime(8);
+  manager.onData(id);
+}
+
+/** Type at ~7 keys a second for `ms`. */
+function typeFor(id: string, ms: number): void {
+  for (let t = 0; t < ms; t += 140) {
+    keystroke(id);
+    vi.advanceTimersByTime(132);
+  }
+}
+
+function ringing(id: string): boolean {
+  return manager.getState(id).status === 'ALERT_RINGING';
+}
+
+/** A watched command, busy and then quiet: the settle a WATCHING ring needs. */
+function watchedTurn(id: string): void {
+  manager.setWatchedCommands(['claude']);
+  runCommand(id, 'claude');
+  output(id, 3_000);
+  vi.advanceTimersByTime(5_000);
+}
+
+/** A seen command that outlasted the minimum runtime, finished while engaged. */
+function longRunFinishedEngaged(id: string): void {
+  engage(id);
+  runCommand(id, 'pnpm build');
+  vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
+  finishCommand(id, 2);
+}
+
+describe('held completions', () => {
+  it.each([
+    ['report', (id: string) => manager.notifyFromProtocol(id, PERMISSION)],
+    ['settle', (id: string) => watchedTurn(id)],
+    ['exit', (id: string) => { runCommand(id, 'pnpm build'); vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime); finishCommand(id); }],
+  ] as const)('holds a %s while engaged and rings it once presence lapses from inactivity', (_kind, complete) => {
+    manager.onData(PANE);
+    engage(PANE);
+    complete(PANE);
+    expect(ringing(PANE)).toBe(false);
+    expect(manager.getState(PANE).todo).toBe(false);
+
+    goIdle(PANE);
+    expect(manager.getState(PANE)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
+  });
+
+  it.each([
+    ['the window leaving', () => leave()],
+    ['focus moving to another pane', () => engage(OTHER)],
+    ['focus moving away while presence lapses', () => manager.setViewer(VIEWER, { present: false, focusId: OTHER }, 'idle')],
+    ['the viewer going away', () => manager.removeViewer(VIEWER)],
+  ] as const)('drops a held completion on an explicit disengage: %s', (_how, disengage) => {
+    manager.onData(PANE);
+    engage(PANE);
+    manager.notifyFromProtocol(PANE, PERMISSION);
+
+    disengage();
+    vi.advanceTimersByTime(120_000);
+    goIdle(PANE);
+    expect(manager.getState(PANE)).toMatchObject({ status: 'WATCHING_DISABLED', todo: false, notification: null });
+  });
+
+  it('rings a held exit with its exit code', () => {
+    longRunFinishedEngaged(PANE);
+    expect(ringing(PANE)).toBe(false);
+    goIdle(PANE);
+    expect(manager.getState(PANE).notification).toEqual({
+      source: 'COMMAND_EXIT', title: 'Command finished', body: 'pnpm build exited 2',
+    });
+  });
+
+  it('escalates with the richest detail it held', () => {
+    manager.onData(PANE);
+    engage(PANE);
+    manager.notifyFromProtocol(PANE, PERMISSION);
+    manager.notifyFromProtocol(PANE, BELL);
+    goIdle(PANE);
+    expect(manager.getState(PANE).notification).toEqual(PERMISSION);
+  });
+
+  it('sends an escalated report through animation deferral', () => {
+    output(PANE, 3_000);
+    engage(PANE);
+    manager.notifyFromProtocol(PANE, PERMISSION);
+    output(PANE, 1_000);
+
+    goIdle(PANE);
+    // Still animating: the report waits for quiet, like any other.
+    expect(ringing(PANE)).toBe(false);
+    vi.advanceTimersByTime(5_000);
+    expect(manager.getState(PANE)).toMatchObject({ status: 'ALERT_RINGING', notification: PERMISSION });
+  });
+
+  it('holds a deferred report that comes due while engaged', () => {
+    output(PANE, 3_000);
+    manager.notifyFromProtocol(PANE, PERMISSION);
+    engage(PANE);
+    vi.advanceTimersByTime(5_000);
+    expect(ringing(PANE)).toBe(false);
+
+    goIdle(PANE);
+    expect(manager.getState(PANE)).toMatchObject({ status: 'ALERT_RINGING', notification: PERMISSION });
+  });
+
+  it('acknowledging drops what was held and records it as answered', () => {
+    manager.setWatchedCommands(['claude']);
+    engage(PANE);
+    watchedTurn(PANE);
+    manager.acknowledge(PANE, { input: false });
+    goIdle(PANE);
+    expect(ringing(PANE)).toBe(false);
+
+    // Claude's idle ping about the same turn is a receipt, not a second summons.
+    manager.notifyFromProtocol(PANE, { source: 'OSC 99', title: 'Claude Code', body: 'Claude is waiting for your input' });
+    expect(manager.getState(PANE)).toMatchObject({ status: 'NOTHING_TO_SHOW', todo: true });
+  });
+
+  it('withdraws a held settle once watched work resumes', () => {
+    engage(PANE);
+    watchedTurn(PANE);
+    output(PANE, 3_000);
+    goIdle(PANE);
+    expect(ringing(PANE)).toBe(false);
+  });
+});
+
+describe('viewers', () => {
+  it('lets no viewer disengage a Session another viewer engages', () => {
+    // Two VS Code webviews on one manager: the user clicks into webview B,
+    // and webview A's blur arrives after.
+    engage('p1', 'webview-a');
+    runCommand('p2', 'cargo build');
+    engage('p2', 'webview-b');
+    leave('webview-a');
+
+    vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
+    finishCommand('p2');
+    expect(ringing('p2')).toBe(false);
+  });
+
+  it('derives the command-exit arm from engagement, publishing each edge', () => {
+    const statuses: string[] = [];
+    manager.onStateChange((id, state) => { if (id === PANE) statuses.push(state.status); });
+    engage(PANE);
+    runCommand(PANE, 'pnpm build');
+    expect(manager.getState(PANE).status).toBe('WATCHING_DISABLED');
+
+    leave();
+    expect(manager.getState(PANE).status).toBe('COMMAND_EXIT_ARMED');
+    engage(PANE);
+    expect(manager.getState(PANE).status).toBe('WATCHING_DISABLED');
+    expect(statuses).toEqual(['WATCHING_DISABLED', 'COMMAND_EXIT_ARMED', 'WATCHING_DISABLED']);
+  });
+
+  it('counts an acknowledgement as seeing the running command', () => {
+    runCommand(PANE, 'pnpm build');
+    expect(manager.getState(PANE).status).toBe('WATCHING_DISABLED');
+    manager.acknowledge(PANE, { input: false });
+    expect(manager.getState(PANE).status).toBe('COMMAND_EXIT_ARMED');
+  });
+});
+
+describe('acknowledge', () => {
+  it('turns TODO off on any keystroke, and leaves it on for a click', () => {
+    manager.onData(PANE);
+    manager.toggleTodo(PANE);
+    manager.acknowledge(PANE, { input: false });
+    expect(manager.getState(PANE).todo).toBe(true);
+
+    manager.acknowledge(PANE, { input: true });
+    expect(manager.getState(PANE)).toMatchObject({ todo: false, notification: null });
+  });
+
+  it('never creates an entry for an id it does not know', () => {
+    manager.acknowledge('browser-1', { input: false });
+    manager.acknowledge('browser-1', { input: true });
+    manager.dismissAlert('browser-1');
+    expect(manager.getAllStates().has('browser-1')).toBe(false);
+  });
+});
+
+describe('echo window', () => {
+  it('never builds BUSY from the echo of the user typing', () => {
+    manager.setWatchedCommands(['claude']);
+    runCommand(PANE, 'claude');
+    engage(PANE);
+    typeFor(PANE, 3_000);
+    expect(manager.getState(PANE).status).toBe('NOTHING_TO_SHOW');
+
+    // The draft is left unsubmitted and the user clicks another pane.
+    engage(OTHER);
+    vi.advanceTimersByTime(10_000);
+    expect(ringing(PANE)).toBe(false);
+  });
+
+  it('does not resolve a quiet await on a half-typed draft', async () => {
+    runCommand(PANE, 'claude');
+    const handle = manager.awaitCompletion(PANE, { until: 'quiet', timeoutMs: 600_000 });
+    let outcome: AwaitOutcome | undefined;
+    void handle.promise.then((value) => { outcome = value; });
+    typeFor(PANE, 3_000);
+    vi.advanceTimersByTime(6_000);
+    await Promise.resolve();
+    expect(outcome).toBeUndefined();
+    handle.cancel();
+  });
+
+  it('counts output once the window has passed', () => {
+    manager.acknowledge(PANE, { input: false });
+    manager.onData(PANE);
+    manager.acknowledge(PANE, { input: true });
+    vi.advanceTimersByTime(cfg.alert.echoWindow);
+    output(PANE, 2_000);
+    // Confirmed busy, so a report now waits for quiet.
+    manager.notifyFromProtocol(PANE, BELL);
+    expect(ringing(PANE)).toBe(false);
+  });
+
+  it.each([
+    ['the exit Ctrl-C caused', () => { vi.advanceTimersByTime(20); finishCommand(PANE, 130); }],
+    ['a bell answering Tab', () => { vi.advanceTimersByTime(5); manager.notifyFromProtocol(PANE, BELL); }],
+  ] as const)('neither rings nor holds %s', (_what, answer) => {
+    engage(PANE);
+    runCommand(PANE, 'pnpm build');
+    vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
+    manager.acknowledge(PANE, { input: true });
+    answer();
+    goIdle(PANE);
+    expect(ringing(PANE)).toBe(false);
+    expect(manager.getState(PANE)).toMatchObject({ todo: false, notification: null });
+  });
+});
+
+/**
+ * A synthetic timeline with the timings of a recorded Claude Code 2.1 session
+ * (2026-09-23, under `TERM_PROGRAM=iTerm.app`): the user types a prompt,
+ * submits it, and sits back without touching anything; Claude asks for
+ * permission eight seconds later, then redraws its prompt cursor every 600ms.
+ */
+describe('walking away from a permission prompt', () => {
+  const OSC99 = '\x1b]99;i=6875:d=0:p=title;Claude Code\x1b\\\x1b]99;i=6875:p=body;Claude needs your permission\x1b\\\x1b]99;i=6875:d=1:a=focus;\x1b\\';
+  const ENTER_AT = 9_300;
+
+  function replay(untilMs: number): void {
+    const parser = new TerminalProtocolParser();
+    const timeline: { at: number; step: () => void }[] = [];
+    timeline.push({ at: 0, step: () => { engage(PANE); runCommand(PANE, 'claude'); } });
+    // First paint.
+    for (let at = 230; at < 830; at += 100) timeline.push({ at, step: () => manager.onData(PANE) });
+    // The prompt, typed at 40ms a key, each key echoed.
+    for (let at = 6_000; at <= 9_000; at += 40) {
+      timeline.push({ at, step: () => manager.acknowledge(PANE, { input: true }) });
+      timeline.push({ at: at + 7, step: () => manager.onData(PANE) });
+    }
+    timeline.push({ at: ENTER_AT, step: () => manager.acknowledge(PANE, { input: true }) });
+    // Working, then the permission prompt drawn.
+    for (let at = 9_390; at < 11_960; at += 110) timeline.push({ at, step: () => manager.onData(PANE) });
+    timeline.push({ at: 17_960, step: () => applyTerminalProtocolEvents(manager, PANE, parser.process(OSC99).events) });
+    // The idle prompt's cursor redraw.
+    for (let at = 12_415; at < untilMs; at += 605) timeline.push({ at, step: () => manager.onData(PANE) });
+    // The renderer's presence lapses 15s after the last input.
+    timeline.push({ at: ENTER_AT + cfg.alert.userAttention, step: () => goIdle(PANE) });
+
+    timeline.sort((a, b) => a.at - b.at);
+    let now = 0;
+    for (const { at, step } of timeline) {
+      if (at > untilMs) break;
+      vi.advanceTimersByTime(at - now);
+      now = at;
+      step();
+    }
+    vi.advanceTimersByTime(untilMs - now);
+  }
+
+  it('holds the permission request while the user is still there', () => {
+    replay(ENTER_AT + cfg.alert.userAttention - 1);
+    expect(manager.getState(PANE)).toMatchObject({ todo: false, notification: null });
+  });
+
+  it('rings it once the user has gone quiet, through the redraw that never stops', () => {
+    replay(120_000);
+    expect(manager.getState(PANE)).toMatchObject({
+      status: 'ALERT_RINGING',
+      todo: true,
+      notification: { body: 'Claude needs your permission' },
+    });
+  });
+});
diff --git a/lib/src/lib/alert-manager.test.ts b/lib/src/lib/alert-manager.test.ts
index ddaaa2771..5fbb9332a 100644
--- a/lib/src/lib/alert-manager.test.ts
+++ b/lib/src/lib/alert-manager.test.ts
@@ -34,12 +34,30 @@ describe('AlertManager in isolation', () => {
     ]);
   }
 
+  /** The one viewer these tests report for: a single renderer realm. */
+  const VIEWER = 'viewer';
+
+  /** The user is present, pointing at `id` (`docs/specs/alert.md` -> Engagement). */
+  function engage(id: string): void {
+    manager.setViewer(VIEWER, { present: true, focusId: id });
+  }
+
+  /** An explicit disengage: focus moved off, or the window left. */
+  function disengage(): void {
+    manager.setViewer(VIEWER, { present: false, focusId: null }, 'leave');
+  }
+
+  /** Presence lapses from inactivity while `id` keeps the focus. */
+  function goIdle(id: string): void {
+    manager.setViewer(VIEWER, { present: false, focusId: id }, 'idle');
+  }
+
   /** Run `commandLine` seen and then left: armed, so its exit rings once it
    *  has outlasted `cfg.alert.commandExitMinRuntime`. */
   function armCommandExit(id: string, commandLine = 'pnpm build'): void {
-    manager.attend(id);
+    engage(id);
     runCommand(id, commandLine);
-    manager.clearAttention(id);
+    disengage();
   }
 
   function finishCommand(id: string, exitCode = 0): void {
@@ -68,7 +86,9 @@ describe('AlertManager in isolation', () => {
       settle();
       applyTerminalProtocolEvents(manager, HELPER, [{ kind: 'notification', notification: { source: 'OSC 9', title: null, body: 'done' } }]);
       applyTerminalProtocolEvents(manager, HELPER, [{ kind: 'progress', progress: { state: 'normal', percent: 40 } }]);
-      manager.attend(HELPER);
+      engage(HELPER);
+      manager.acknowledge(HELPER, { input: true });
+      disengage();
       manager.toggleTodo(HELPER);
       manager.clearTodo(HELPER);
       manager.seed(HELPER, { todo: true });
@@ -123,7 +143,7 @@ describe('AlertManager in isolation', () => {
       expect(manager.getState(HELPER)).toMatchObject({ status: 'NOTHING_TO_SHOW', todo: false, notification: null });
     });
 
-    it('does not ring the exit of a command it never saw with attention', () => {
+    it('does not ring the exit of a command it never saw engaged', () => {
       manager.setHelper(HELPER, true);
       runCommand(HELPER, 'npm run build');
       manager.setHelper(HELPER, false);
@@ -133,8 +153,8 @@ describe('AlertManager in isolation', () => {
 
       // The ordinary seen rule applies from promotion on.
       runCommand(HELPER, 'npm run build');
-      manager.attend(HELPER);
-      manager.clearAttention(HELPER);
+      engage(HELPER);
+      disengage();
       vi.advanceTimersByTime(30_000);
       finishCommand(HELPER);
       expect(manager.getState(HELPER).status).toBe('ALERT_RINGING');
@@ -168,9 +188,6 @@ describe('AlertManager in isolation', () => {
     manager.onData(id);
     expect(manager.getState(id).status).toBe('BUSY');
 
-    // Clear attention so alert can ring
-    manager.clearAttention(id);
-
     // Now silence — task finished. Advance past mightNeedAttention (2000ms)
     vi.advanceTimersByTime(2_000);
     expect(manager.getState(id).status).toBe('MIGHT_NEED_ATTENTION');
@@ -184,7 +201,6 @@ describe('AlertManager in isolation', () => {
     const id = 'user-scenario';
 
     runWatchedCommand(id);
-    manager.clearAttention(id);
 
     for (let t = 0; t < 5_000; t += 200) {
       manager.onData(id);
@@ -197,13 +213,12 @@ describe('AlertManager in isolation', () => {
     expect(manager.getState(id).status).toBe('ALERT_RINGING');
   });
 
-  it('ALERT_RINGING latches when user has no attention (view hidden)', () => {
+  it('ALERT_RINGING latches through output until acknowledged', () => {
     const id = 'latch-test';
     // Deferral ships on and withdraws a WATCHING ring once output resumes
     // confirmed BUSY; latching through output is the switched-off timing.
     manager.setDeferAlertsUntilQuiet(false);
     runWatchedCommand(id);
-    manager.clearAttention(id);
 
     driveToBusy(id);
     expect(manager.getState(id).status).toBe('BUSY');
@@ -220,23 +235,24 @@ describe('AlertManager in isolation', () => {
     }
     expect(manager.getState(id).status).toBe('ALERT_RINGING');
 
-    manager.attend(id);
+    manager.acknowledge(id, { input: false });
     manager.onData(id);
     expect(manager.getState(id).status).not.toBe('ALERT_RINGING');
   });
 
-  it('ALERT_RINGING resets on data when user has attention', () => {
+  it('rings a watched settle once the user has left, and acknowledging puts it out', () => {
     const id = 'reset-test';
     runWatchedCommand(id);
 
-    manager.attend(id);
+    engage(id);
     driveToBusy(id);
 
-    manager.clearAttention(id);
+    disengage();
     settle();
     expect(manager.getState(id).status).toBe('ALERT_RINGING');
 
-    manager.attend(id);
+    engage(id);
+    manager.acknowledge(id, { input: false });
     manager.onData(id);
     expect(manager.getState(id).status).not.toBe('ALERT_RINGING');
   });
@@ -249,7 +265,6 @@ describe('AlertManager in isolation', () => {
     });
 
     runWatchedCommand(id);
-    manager.clearAttention(id);
 
     driveToBusy(id);
 
@@ -298,7 +313,6 @@ describe('AlertManager in isolation', () => {
 
   function driveToRinging(id: string): void {
     runWatchedCommand(id);
-    manager.clearAttention(id);
     driveToBusy(id);
     settle();
     expect(manager.getState(id).status).toBe('ALERT_RINGING');
@@ -329,22 +343,33 @@ describe('AlertManager in isolation', () => {
     });
   });
 
-  it.each(['watching', 'report', 'exit'] as const)('attending or dismissing a %s ring leaves its TODO', (source) => {
-    for (const verb of ['attend', 'dismissAlert'] as const) {
+  /** The verbs that clear a ring and leave its TODO. */
+  const leaveTodoVerbs = {
+    acknowledge: (id: string) => manager.acknowledge(id, { input: false }),
+    dismissAlert: (id: string) => manager.dismissAlert(id),
+  };
+
+  it.each(['watching', 'report', 'exit'] as const)('acknowledging without input or dismissing a %s ring leaves its TODO', (source) => {
+    for (const verb of ['acknowledge', 'dismissAlert'] as const) {
       const id = `ring-leaves-todo-${source}-${verb}`;
       ringFrom(id, source);
-      manager[verb](id);
+      leaveTodoVerbs[verb](id);
       expect(manager.getState(id)).toMatchObject({ episode: null, todo: true });
       expect(manager.getState(id).status).not.toBe('ALERT_RINGING');
       expect(manager.getState(id).notification).not.toBeNull();
     }
   });
 
-  it.each(['watching', 'report', 'exit'] as const)('toggling or clearing TODO on a %s ring turns it off with its detail', (source) => {
-    for (const verb of ['toggleTodo', 'clearTodo'] as const) {
+  it.each(['watching', 'report', 'exit'] as const)('typing, toggling, or clearing TODO on a %s ring turns it off with its detail', (source) => {
+    const verbs = {
+      acknowledgeInput: (id: string) => manager.acknowledge(id, { input: true }),
+      toggleTodo: (id: string) => manager.toggleTodo(id),
+      clearTodo: (id: string) => manager.clearTodo(id),
+    };
+    for (const verb of ['acknowledgeInput', 'toggleTodo', 'clearTodo'] as const) {
       const id = `todo-off-ringing-${source}-${verb}`;
       ringFrom(id, source);
-      manager[verb](id);
+      verbs[verb](id);
       expect(manager.getState(id)).toMatchObject({ episode: null, todo: false, notification: null });
       expect(manager.getState(id).status).not.toBe('ALERT_RINGING');
     }
@@ -388,7 +413,7 @@ describe('AlertManager in isolation', () => {
     });
   });
 
-  it.each(['attend', 'dismissAlert'] as const)(
+  it.each(['acknowledge', 'dismissAlert'] as const)(
     'a report about a state acknowledged by %s updates the TODO without summoning again',
     (verb) => {
       // Claude Code: the turn settles and WATCHING rings; the user acknowledges
@@ -399,7 +424,7 @@ describe('AlertManager in isolation', () => {
         if (changed === id && state.episode) episodes.add(state.episode.id);
       });
       driveToRinging(id);
-      manager[verb](id);
+      leaveTodoVerbs[verb](id);
       vi.advanceTimersByTime(60_000);
 
       manager.notifyFromProtocol(id, { source: 'OSC 99', title: 'Claude Code', body: 'Claude is waiting for your input' });
@@ -526,8 +551,7 @@ describe('AlertManager in isolation', () => {
     const id = 'ring-keeps-progress';
     manager.updateProtocolProgress(id, { state: 'indeterminate', percent: null });
     manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'needs permission' });
-    manager.attend(id);
-    manager.clearAttention(id);
+    manager.acknowledge(id, { input: false });
     expect(manager.getState(id).status).toBe('OSC_NOTIF_BUSY');
 
     // The run goes on after the answer, then its cycle ends.
@@ -600,10 +624,10 @@ describe('AlertManager in isolation', () => {
     });
   });
 
-  it('protocol completion is suppressed while the user has attention', () => {
+  it('protocol completion is held while the Session is engaged', () => {
     const id = 'osc-progress-attention';
 
-    manager.attend(id);
+    engage(id);
     manager.updateProtocolProgress(id, { state: 'normal', percent: 25 });
     expect(manager.getState(id).status).toBe('OSC_NOTIF_BUSY');
 
@@ -615,10 +639,10 @@ describe('AlertManager in isolation', () => {
     });
   });
 
-  it('direct protocol notifications are suppressed while the user has attention', () => {
+  it('direct protocol notifications are held while the Session is engaged', () => {
     const id = 'osc-notification-attention';
 
-    manager.attend(id);
+    engage(id);
     manager.notifyFromProtocol(id, { source: 'OSC 777', title: 'done', body: 'Build finished' });
 
     expect(manager.getState(id)).toMatchObject({
@@ -628,13 +652,13 @@ describe('AlertManager in isolation', () => {
     });
   });
 
-  it('attended direct notifications do not clear active protocol progress', () => {
+  it('engaged direct notifications do not clear active protocol progress', () => {
     const id = 'osc-progress-with-attended-notification';
 
     manager.updateProtocolProgress(id, { state: 'normal', percent: 25 });
     expect(manager.getState(id).status).toBe('OSC_NOTIF_BUSY');
 
-    manager.attend(id);
+    engage(id);
     manager.notifyFromProtocol(id, { source: 'OSC 777', title: 'done', body: 'Build finished' });
 
     expect(manager.getState(id)).toMatchObject({
@@ -644,10 +668,10 @@ describe('AlertManager in isolation', () => {
     });
   });
 
-  it('terminal bell notifications are suppressed while the user has attention', () => {
+  it('terminal bell notifications are held while the Session is engaged', () => {
     const id = 'terminal-bell-attention';
 
-    manager.attend(id);
+    engage(id);
     applyTerminalProtocolEvents(manager, id, [
       { kind: 'notification', notification: { source: 'BEL', title: 'Terminal bell', body: null } },
     ]);
@@ -659,7 +683,7 @@ describe('AlertManager in isolation', () => {
     });
   });
 
-  it('arms and rings when an attended command loses attention before exiting', () => {
+  it('arms and rings when an engaged command is left before exiting', () => {
     const id = 'command-exit';
 
     armCommandExit(id);
@@ -740,14 +764,14 @@ describe('AlertManager in isolation', () => {
     });
   });
 
-  it('clears an unarmed command-exit watch when the PTY exits before attention loss', () => {
+  it('clears a command-exit watch whose quick PTY exit was engaged', () => {
     const id = 'command-exit-pty-exit-unarmed';
 
-    manager.attend(id);
+    engage(id);
     runCommand(id, 'exec true');
 
     manager.onExit(id, 0);
-    vi.advanceTimersByTime(cfg.alert.userAttention);
+    goIdle(id);
 
     expect(manager.getState(id)).toMatchObject({
       status: 'WATCHING_DISABLED',
@@ -771,14 +795,14 @@ describe('AlertManager in isolation', () => {
     });
   });
 
-  it('disarms command-exit alerts when the user returns before finish', () => {
+  it('disarms command-exit alerts while the user is back, holding the finish', () => {
     const id = 'command-exit-return';
 
     armCommandExit(id, 'pnpm test');
     vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
     expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
 
-    manager.attend(id);
+    engage(id);
     expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
 
     vi.advanceTimersByTime(1_000);
@@ -993,7 +1017,6 @@ describe('AlertManager in isolation', () => {
     const id = 'unwatched-detector';
     manager.setWatchedCommands(['claude']);
     runCommand(id, 'git log');
-    manager.clearAttention(id);
 
     driveToBusy(id);
     // The detector is BUSY underneath, but no rule matches, so nothing shows.
@@ -1014,7 +1037,6 @@ describe('AlertManager in isolation', () => {
   it('shows the live detector state when a rule is enabled mid-command', () => {
     const id = 'enable-rule-mid-busy';
     runCommand(id, 'claude');
-    manager.clearAttention(id);
 
     driveToBusy(id);
     expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
@@ -1028,17 +1050,16 @@ describe('AlertManager in isolation', () => {
     });
   });
 
-  it('suppresses a WATCHING ring when the user is attending at the settle', () => {
+  it('holds a WATCHING ring when the Session is engaged at the settle', () => {
     const id = 'settle-while-attended';
     runWatchedCommand(id);
-    manager.attend(id);
+    engage(id);
 
     driveToBusy(id);
     expect(manager.getState(id).status).toBe('BUSY');
 
     settle();
-    // Total elapsed is under the 15s attention window, so the user is still
-    // looking: no ring, and the detector simply starts over.
+    // The user is looking: no ring yet, and the detector simply starts over.
     expect(manager.getState(id)).toMatchObject({
       status: 'NOTHING_TO_SHOW',
       watchingEnabled: true,
@@ -1073,8 +1094,8 @@ describe('AlertManager in isolation', () => {
   it('keeps the command-exit arm hidden while WATCHING owns the display', () => {
     const id = 'arm-under-watching';
     runWatchedCommand(id);
-    manager.attend(id);
-    manager.clearAttention(id);
+    engage(id);
+    disengage();
 
     // Armed underneath, but the monitor's own state is what is published.
     expect(manager.getState(id).status).toBe('NOTHING_TO_SHOW');
@@ -1083,76 +1104,6 @@ describe('AlertManager in isolation', () => {
     expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
   });
 
-  // --- Configurable inactivity timeout (`docs/specs/alert.md` -> Alarm settings) ---
-
-  describe('setInactivityTimeoutMs', () => {
-    it('expires attention on the configured window instead of the default 15s', () => {
-      const id = 'short-window';
-      manager.setInactivityTimeoutMs(3_000);
-
-      manager.attend(id);
-      runCommand(id);
-
-      vi.advanceTimersByTime(2_999);
-      expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
-
-      vi.advanceTimersByTime(1);
-      expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
-    });
-
-    it('leaves the command-exit minimum runtime where it was', () => {
-      const id = 'short-runtime-gate';
-      manager.setInactivityTimeoutMs(3_000);
-
-      armCommandExit(id, 'git status');
-      vi.advanceTimersByTime(4_000);
-      finishCommand(id);
-      expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
-
-      armCommandExit(id, 'git status');
-      vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
-      finishCommand(id);
-      expect(manager.getState(id)).toMatchObject({
-        status: 'ALERT_RINGING',
-        notification: { source: 'COMMAND_EXIT', body: 'git status exited 0' },
-      });
-    });
-
-    it('re-arms a live attention timer so a shortened window applies immediately', () => {
-      const id = 're-arm';
-
-      manager.attend(id);
-      runCommand(id);
-
-      vi.advanceTimersByTime(10_000);
-      expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
-
-      // Shortening mid-window restarts the countdown from now rather than
-      // firing instantly or waiting out the original 15s.
-      manager.setInactivityTimeoutMs(3_000);
-      vi.advanceTimersByTime(2_999);
-      expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
-
-      vi.advanceTimersByTime(1);
-      expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
-    });
-
-    it('ignores a nonsensical value rather than installing a broken timer', () => {
-      const id = 'bad-value';
-      manager.setInactivityTimeoutMs(Number.NaN);
-      manager.setInactivityTimeoutMs(0);
-      manager.setInactivityTimeoutMs(-1);
-
-      manager.attend(id);
-      runCommand(id);
-
-      vi.advanceTimersByTime(cfg.alert.userAttention - 1);
-      expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
-      vi.advanceTimersByTime(1);
-      expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
-    });
-  });
-
   it('defers a protocol alert with no settings call, because deferral ships on', () => {
     const id = 'defer-shipped-default';
     driveToBusy(id);
@@ -1299,12 +1250,12 @@ describe('AlertManager in isolation', () => {
       });
     });
 
-    it('cancels deferred delivery when the user attends, even after attention expires', () => {
+    it('cancels deferred delivery when the user acknowledges', () => {
       const id = 'defer-attended';
       driveToBusy(id);
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Done' });
 
-      manager.attend(id);
+      manager.acknowledge(id, { input: false });
       vi.advanceTimersByTime(60_000);
       expect(manager.getState(id)).toMatchObject({
         status: 'WATCHING_DISABLED',
@@ -1441,7 +1392,6 @@ describe('AlertManager in isolation', () => {
       const seen = recordingClaimant(id, true);
 
       runWatchedCommand(id);
-      manager.clearAttention(id);
       driveToBusy(id);
       settle();
 
@@ -1460,7 +1410,6 @@ describe('AlertManager in isolation', () => {
       const seen = recordingClaimant(id, false);
 
       runWatchedCommand(id);
-      manager.clearAttention(id);
       driveToBusy(id);
       settle();
 
@@ -1468,11 +1417,11 @@ describe('AlertManager in isolation', () => {
       expect(manager.getState(id).status).toBe('ALERT_RINGING');
     });
 
-    it('reports a short attended command finish that could never ring', () => {
+    it('reports a short engaged command finish that could never ring', () => {
       const id = 'observe-quick-command';
       const seen = recordingClaimant(id, false);
 
-      manager.attend(id);
+      engage(id);
       runCommand(id, 'npm test');
       vi.advanceTimersByTime(1_000);
       finishCommand(id);
@@ -1483,7 +1432,7 @@ describe('AlertManager in isolation', () => {
         watchKey: 'npm test',
         exitCode: 0,
         ranMs: 1_000,
-        armed: false,
+        seen: true,
       }]);
       expect(manager.getState(id)).toMatchObject({
         status: 'WATCHING_DISABLED',
@@ -1492,7 +1441,7 @@ describe('AlertManager in isolation', () => {
       });
     });
 
-    it('claiming an armed command finish suppresses the COMMAND_EXIT ring', () => {
+    it('claiming a seen command finish suppresses the COMMAND_EXIT ring', () => {
       const id = 'claim-command-exit';
       const seen = recordingClaimant(id, true);
 
@@ -1508,7 +1457,7 @@ describe('AlertManager in isolation', () => {
         watchKey: 'pnpm build',
         exitCode: 0,
         ranMs: cfg.alert.commandExitMinRuntime,
-        armed: true,
+        seen: true,
       }]);
       expect(manager.getState(id)).toMatchObject({
         status: 'WATCHING_DISABLED',
@@ -1622,7 +1571,7 @@ describe('AlertManager in isolation', () => {
           watchKey: 'pnpm build',
           exitCode: 1,
           ranMs: cfg.alert.commandExitMinRuntime,
-          armed: true,
+          seen: true,
         },
         ringing: false,
         todo: false,
@@ -1826,14 +1775,14 @@ describe('AlertManager in isolation', () => {
       expect(manager.getState(id)).toMatchObject({ status: 'ALERT_RINGING', todo: true, awaited: true });
     });
 
-    it('never sets attention, so the next completion still rings the human', async () => {
+    it('never acknowledges, so the next completion still rings the human', async () => {
       const id = 'await-does-not-attend';
       driveToRinging(id);
 
       const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
       expect(await handle.promise).toMatchObject({ kind: 'resolved', cause: 'quiet' });
 
-      // Attention would suppress this second ring for the whole 15s window.
+      // An acknowledgement would record the settle as answered.
       driveToBusy(id);
       settle();
       expect(manager.getState(id).status).toBe('ALERT_RINGING');
@@ -1844,7 +1793,6 @@ describe('AlertManager in isolation', () => {
     it('resolves quiet on a settle, claiming it before any ring rule runs', async () => {
       const id = 'await-quiet-settle';
       runWatchedCommand(id);
-      manager.clearAttention(id);
 
       const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
       driveToBusy(id);
@@ -1863,17 +1811,17 @@ describe('AlertManager in isolation', () => {
     it.each([
       ['BUSY', 0, 5_000],
       ['MIGHT_NEED_ATTENTION', 2_000, 3_000],
-    ] as const)('keeps a parked quiet await armed when attention arrives during %s', async (_status, beforeAttendMs, afterAttendMs) => {
+    ] as const)('keeps a parked quiet await armed when the user engages and acknowledges during %s', async (_status, beforeAttendMs, afterAttendMs) => {
       const id = `await-quiet-attended-${_status}`;
       runWatchedCommand(id);
-      manager.clearAttention(id);
 
       const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
       driveToBusy(id);
       vi.advanceTimersByTime(beforeAttendMs);
       expect(manager.getState(id).status).toBe(_status);
 
-      manager.attend(id);
+      engage(id);
+      manager.acknowledge(id, { input: false });
       vi.advanceTimersByTime(afterAttendMs);
 
       expect(await handle.promise).toEqual({
@@ -1925,7 +1873,6 @@ describe('AlertManager in isolation', () => {
     it('ignores a bell and a settle under --until exit, then resolves on the finish', async () => {
       const id = 'await-exit-strict';
       runWatchedCommand(id);
-      manager.clearAttention(id);
 
       const handle = manager.awaitCompletion(id, { until: 'exit', timeoutMs: NEVER });
       const outcome = watch(handle);
@@ -2143,7 +2090,6 @@ describe('AlertManager in isolation', () => {
     it('delivers one completion to every await parked on the Session', async () => {
       const id = 'await-two-waiters';
       runWatchedCommand(id);
-      manager.clearAttention(id);
 
       const first = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
       vi.advanceTimersByTime(1_000);
diff --git a/lib/src/lib/alert-manager.ts b/lib/src/lib/alert-manager.ts
index ffdacf10e..b05cf683c 100644
--- a/lib/src/lib/alert-manager.ts
+++ b/lib/src/lib/alert-manager.ts
@@ -113,17 +113,40 @@ interface Ring {
   prior: { todo: TodoState; notification: ActivityNotification | null };
 }
 
+/**
+ * Completions withheld because the Session was engaged when they happened
+ * (`docs/specs/alert.md` -> Completion events): the sources they would have
+ * raised, and the richest detail among them.
+ */
+interface HeldCompletion {
+  sources: ListedRingSource[];
+  watching: WatchingSource | null;
+  detail: ActivityNotification;
+}
+
 interface CommandExitWatch {
   displayCommand: string;
   /** `commandWatchKey` of the command line; null without one to key on. */
   watchKey: string | null;
   source: CommandRunSource;
   startedAt: number;
-  seenWithAttentionAt: number | null;
-  /** Attention was lost after the command was seen, so its exit may ring. */
-  armed: boolean;
+  /** Engaged at its start, or engaged or acknowledged since: its exit may ring. */
+  seen: boolean;
+}
+
+/** One renderer realm's report (`docs/specs/alert.md` -> Engagement). */
+export interface Engagement {
+  present: boolean;
+  /** The terminal Session this viewer points at, or null. */
+  focusId: string | null;
 }
 
+/** Why a viewer stopped being present: its inactivity timeout ran out
+ *  (`idle`), or its window blurred or hid (`leave`). */
+export type EngagementLapse = 'idle' | 'leave';
+
+const NOT_ENGAGED: Engagement = { present: false, focusId: null };
+
 export function normalizeActivityNotification(value: unknown): ActivityNotification | null {
   if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
   const record = value as Record<string, unknown>;
@@ -156,8 +179,8 @@ export type CompletionEvent =
       exitCode: number | undefined;
       /** Wall time from commandStart to this finish. */
       ranMs: number;
-      /** Command-exit alerting was armed (attention was lost mid-run) when it finished. */
-      armed: boolean;
+      /** The run was seen: engaged at its start, or engaged or acknowledged since. */
+      seen: boolean;
     }
   | { kind: 'notification'; notification: ActivityNotification };
 
@@ -262,6 +285,10 @@ interface AlertEntry {
    */
   deferred: { notification: ActivityNotification; since: number } | null;
   deferredTimer: ReturnType<typeof setTimeout> | null;
+  /** Completions withheld while engaged: escalated or dropped as engagement ends (`setViewer`), dropped by a user verb. */
+  held: HeldCompletion | null;
+  /** Output and completions before this instant answer the user's own input (`acknowledge`). */
+  echoUntil: number;
 }
 
 /** Explicit live handoff only: timers are deadlines, and no caller closures travel. */
@@ -281,8 +308,8 @@ export class AlertManager {
   private removed = new Set<string>();
   private claimants = new Map<string, Set<CompletionClaimant>>();
   private awaits = new Map<string, AwaitGroup>();
-  private attentionId: string | null = null;
-  private attentionTimer: ReturnType<typeof setTimeout> | null = null;
+  /** Renderer realms by viewer id; a default (absent, unfocused) viewer is not kept. */
+  private viewers = new Map<string, Engagement>();
   private listeners = new Set<(id: string, state: AlertState) => void>();
   private lastEmitted = new Map<string, AlertState>();
   private watchedCommands = new Set<string>();
@@ -292,7 +319,6 @@ export class AlertManager {
    *  controls, awaits, completion dispatch, publishing — drops them, so a host
    *  marks the id once instead of guarding each call. */
   private helpers = new Set<string>();
-  private inactivityTimeoutMs = cfg.alert.userAttention;
   /** The shipped default (platform-free module: this runs in both hosts), so a
    *  manager that never receives a settings blob behaves like one that does. */
   private deferAlertsUntilQuiet = DEFAULT_ALERT_SETTINGS.deferAlertsUntilQuiet;
@@ -306,21 +332,11 @@ export class AlertManager {
    * already-normalized blob; the sinks below revalidate anyway.
    */
   applySettings(settings: AlertSettings): void {
-    this.setInactivityTimeoutMs(settings.inactivityTimeoutMs);
+    // `inactivityTimeoutMs` is the renderer's presence window: presence arrives
+    // here already computed (`setViewer`), so the manager keeps no timer for it.
     this.setDeferAlertsUntilQuiet(settings.deferAlertsUntilQuiet);
   }
 
-  /** Walk-away window for attention. Revalidate at this timer sink. */
-  setInactivityTimeoutMs(ms: number): void {
-    if (!Number.isFinite(ms) || ms <= 0 || ms === this.inactivityTimeoutMs) return;
-    this.inactivityTimeoutMs = ms;
-    // Re-arm from now so a shortened window takes effect immediately instead of
-    // waiting out the window that was already running.
-    if (this.attentionTimer !== null && this.attentionId !== null) {
-      this.setAttention(this.attentionId);
-    }
-  }
-
   /** Let confirmed terminal activity finish before terminal-notification rings. */
   setDeferAlertsUntilQuiet(enabled: boolean): void {
     if (enabled === this.deferAlertsUntilQuiet) return;
@@ -358,8 +374,11 @@ export class AlertManager {
     // produced a semantic or protocol event, so output creates the entry.
     const entry = this.streamEntry(id);
     if (!entry) return;
+    // The echo of the user's own keystroke is not the program working.
+    if (this.inEchoWindow(entry)) return;
     entry.detector.onData();
     if (entry.ring?.watching) entry.ring.watching.outputSince = true;
+    if (entry.held?.watching) entry.held.watching.outputSince = true;
     entry.ackedQuiet = false;
     this.eachWaiter(id, (waiter) => waiter.onOutput());
   }
@@ -448,6 +467,7 @@ export class AlertManager {
   private withdrawResumedWatchingRing(entry: AlertEntry): void {
     if (!this.deferAlertsUntilQuiet || !entry.detector.isConfirmedBusy()) return;
     this.withdrawRingSource(entry, 'watching', 'invalidated');
+    this.withdrawHeldWatching(entry);
   }
 
   /**
@@ -457,8 +477,20 @@ export class AlertManager {
    * works at a prompt.
    */
   private withdrawUncoveredWatchingRing(entry: AlertEntry): void {
-    if (watchRuleFor(this.watchedCommands, entry.ring?.watching?.key ?? null) !== null) return;
-    this.withdrawRingSource(entry, 'watching', 'invalidated');
+    if (watchRuleFor(this.watchedCommands, entry.ring?.watching?.key ?? null) === null) {
+      this.withdrawRingSource(entry, 'watching', 'invalidated');
+    }
+    if (watchRuleFor(this.watchedCommands, entry.held?.watching?.key ?? null) === null) {
+      this.withdrawHeldWatching(entry);
+    }
+  }
+
+  /** The held twin of a `watching` withdrawal: the settle it kept is void. */
+  private withdrawHeldWatching(entry: AlertEntry): void {
+    const held = entry.held;
+    if (held?.watching == null) return;
+    held.watching = null;
+    if (held.sources.length === 0) entry.held = null;
   }
 
   /** A busy Session went quiet. Whether that rings is decided downstream. */
@@ -510,53 +542,68 @@ export class AlertManager {
     const claimants = [...(this.claimants.get(id) ?? [])];
     if (claimants.some((claimant) => claimant(event))) return true;
 
+    // A completion inside the echo window answers the keystroke that opened
+    // it — a bell on Tab, the exit `Ctrl-C` caused — so it neither rings nor
+    // holds. A cleared progress cycle still publishes (see below).
+    if (this.inEchoWindow(entry)) {
+      this.notify(id);
+      return false;
+    }
+
     switch (event.kind) {
       case 'settled': {
-        // Only a watched command rings, and only if the user is not looking at
-        // it right now. The originating command key latches on the ring so it
-        // outlives the command that raised it.
+        // Only a watched command rings. The originating command key latches on
+        // the ring so it outlives the command that raised it.
         const key = entry.commandExitWatch?.watchKey;
-        if (!key || !this.isWatching(entry) || this.hasAttention(id)) break;
-        this.raiseRing(entry, { key, outputSince: false }, { source: 'WATCHING', title: `${key} went quiet`, body: null });
+        if (!key || !this.isWatching(entry)) break;
+        this.raiseOrHold(id, entry, { key, outputSince: false }, { source: 'WATCHING', title: `${key} went quiet`, body: null });
         this.notify(id);
         break;
       }
       case 'commandFinished':
-        if (!event.armed || this.hasAttention(id) || event.ranMs < cfg.alert.commandExitMinRuntime) break;
+        if (!event.seen || event.ranMs < cfg.alert.commandExitMinRuntime) break;
         // A shell-reported exit is authoritative, so recent animation never
         // delays it. The detector only gates in-band terminal notifications.
-        this.raiseRing(entry, 'exit', {
+        this.raiseOrHold(id, entry, 'exit', {
           source: 'COMMAND_EXIT',
           title: 'Command finished',
           body: formatCommandExitBody(event.displayCommand, event.exitCode),
         });
         // If a terminal notification was already waiting, it can enrich this
-        // ring immediately; keeping its timer would publish stale detail later.
+        // ring (or hold) immediately; keeping its timer would publish stale
+        // detail later.
         if (entry.deferred !== null) this.flushDeferredNotification(id, entry);
         else this.notify(id);
         break;
       case 'notification':
-        if (this.hasAttention(id)) {
+        if (this.engaged(id)) {
+          this.hold(entry, 'report', event.notification);
           // A progress cycle was already cleared before dispatch, so publish
           // that; a plain direct notification changes nothing and dedupes away.
           this.notify(id);
           break;
         }
-        if (entry.ring === null && entry.ackedQuiet) {
-          // A report about the state the user just acknowledged updates the
-          // receipt instead of summoning again. Nothing is deferred while
-          // acknowledged: no output has arrived to animate.
-          entry.todo = true;
-          entry.notification = richer(entry.notification, event.notification);
-          this.notify(id);
-          break;
-        }
-        this.deferOrDeliverNotification(id, entry, event.notification);
+        this.deliverReport(id, entry, event.notification);
         break;
     }
     return false;
   }
 
+  /** A report reaching the ring rules unengaged: the acknowledged-state check,
+   *  then animation deferral. The one path for a live report and a held one. */
+  private deliverReport(id: string, entry: AlertEntry, notification: ActivityNotification): void {
+    if (entry.ring === null && entry.ackedQuiet) {
+      // A report about the state the user just acknowledged updates the
+      // receipt instead of summoning again. Nothing is deferred while
+      // acknowledged: no output has arrived to animate.
+      entry.todo = true;
+      entry.notification = richer(entry.notification, notification);
+      this.notify(id);
+      return;
+    }
+    this.deferOrDeliverNotification(id, entry, notification);
+  }
+
   // --- Await ---
 
   /**
@@ -567,7 +614,7 @@ export class AlertManager {
    *
    * Resolves immediately when the Session is already ringing, consuming only
    * the one ring source it resolved on. That withdraws the TODO the ring
-   * itself set, never a TODO that was already there, and never sets attention.
+   * itself set, never a TODO that was already there, and never acknowledges.
    */
   awaitCompletion(id: string, options: AwaitOptions): AwaitHandle {
     if (this.inert(id)) return settledAwait({ kind: 'cancelled', waitedMs: 0 });
@@ -841,8 +888,7 @@ export class AlertManager {
       watchKey: resolved.rawCommandLine === null ? null : commandWatchKey(resolved.rawCommandLine),
       source: resolved.source,
       startedAt: resolved.startedAt,
-      seenWithAttentionAt: this.hasAttention(id) ? Date.now() : null,
-      armed: false,
+      seen: this.engaged(id),
     };
     // Every command boundary starts the detector over, so one command's output
     // history can never leak into the next one's busy/quiet reading.
@@ -862,7 +908,7 @@ export class AlertManager {
     const endedProgress = entry.progress !== null;
     entry.progress = null;
 
-    // Every finish is observable, including the short, unarmed, and attended
+    // Every finish is observable, including the short, unseen, and engaged
     // ones that can never ring — the ring rule is what filters them.
     if (watch !== null) {
       this.dispatchCompletion(id, entry, {
@@ -871,7 +917,7 @@ export class AlertManager {
         watchKey: watch.watchKey,
         exitCode,
         ranMs: Date.now() - watch.startedAt,
-        armed: watch.armed,
+        seen: watch.seen,
       });
     }
 
@@ -885,20 +931,6 @@ export class AlertManager {
     return watch !== null || endedProgress;
   }
 
-  private markCommandExitSeen(entry: AlertEntry): void {
-    const watch = entry.commandExitWatch;
-    if (!watch) return;
-    watch.seenWithAttentionAt ??= Date.now();
-    watch.armed = false;
-  }
-
-  private armCommandExitOnAttentionLoss(id: string): boolean {
-    const watch = this.entries.get(id)?.commandExitWatch;
-    if (!watch || watch.armed || watch.seenWithAttentionAt === null) return false;
-    watch.armed = true;
-    return true;
-  }
-
   // --- Deferred terminal notifications ---
 
   private deferOrDeliverNotification(
@@ -960,12 +992,8 @@ export class AlertManager {
     const deferred = entry.deferred;
     if (deferred === null) return;
     this.clearDeferredNotification(entry);
-
-    // Attending the Session clears this eagerly too; retain the recheck as the
-    // timer-side safety rule shared by every delayed alarm path.
-    if (this.hasAttention(id)) return;
-
-    this.raiseRing(entry, 'report', deferred.notification);
+    // Due while engaged, it waits on engagement instead of animation.
+    this.raiseOrHold(id, entry, 'report', deferred.notification);
     this.notify(id);
   }
 
@@ -1039,11 +1067,12 @@ export class AlertManager {
    */
   private clearRingForUser(entry: AlertEntry): void {
     this.clearDeferredNotification(entry);
-    const ring = entry.ring;
-    if (ring === null) return;
+    const { ring, held } = entry;
+    entry.held = null;
+    if (ring === null && held === null) return;
     entry.ring = null;
     entry.ackedQuiet = true;
-    if (ring.watching !== null) this.watchingLeft(entry, 'answered');
+    if (ring?.watching || held?.watching) this.watchingLeft(entry, 'answered');
   }
 
   /**
@@ -1055,55 +1084,118 @@ export class AlertManager {
     if (why === 'answered') entry.detector.reset();
   }
 
-  // --- Attention tracking ---
+  // --- Engagement (`docs/specs/alert.md` -> Engagement) ---
 
-  private hasAttention(id: string): boolean {
-    return this.attentionId === id;
+  /** Some present viewer points at `id`. The only thing the ring rules read. */
+  private engaged(id: string): boolean {
+    for (const viewer of this.viewers.values()) {
+      if (viewer.present && viewer.focusId === id) return true;
+    }
+    return false;
   }
 
-  private clearAttentionTimer(): void {
-    if (this.attentionTimer !== null) {
-      clearTimeout(this.attentionTimer);
-      this.attentionTimer = null;
+  /**
+   * One renderer realm's presence and focus, as its reporter computed them.
+   * `lapse` says why presence ended, and decides what a Session that stops
+   * being engaged does with the completions it held: an `idle` lapse with focus
+   * unchanged escalates them, anything else drops them.
+   */
+  setViewer(viewerId: string, state: Engagement, lapse?: EngagementLapse): void {
+    const previous = this.viewers.get(viewerId) ?? NOT_ENGAGED;
+    const next: Engagement = {
+      present: state.present === true,
+      focusId: typeof state.focusId === 'string' ? state.focusId : null,
+    };
+    if (previous.present === next.present && previous.focusId === next.focusId) return;
+    // Only this viewer moved, so only the two Sessions it pointed at can change.
+    const touched = [...new Set([previous.focusId, next.focusId])]
+      .filter((id): id is string => id !== null)
+      .map((id) => ({ id, was: this.engaged(id) }));
+    if (next.present || next.focusId !== null) this.viewers.set(viewerId, next);
+    else this.viewers.delete(viewerId);
+
+    for (const { id, was } of touched) {
+      const entry = this.entries.get(id);
+      if (!entry || this.inert(id) || this.engaged(id) === was) continue;
+      if (!was) {
+        this.markSeen(entry);
+      } else if (lapse === 'idle' && previous.focusId === id && next.focusId === id) {
+        this.escalateHeld(id, entry);
+      } else {
+        // An explicit disengage: focus moved, or the window left.
+        entry.held = null;
+      }
+      // COMMAND_EXIT_ARMED is derived from engagement.
+      this.notify(id);
     }
   }
 
-  private setAttention(id: string): void {
-    const previousAttentionId = this.attentionId;
-    if (previousAttentionId && previousAttentionId !== id && this.armCommandExitOnAttentionLoss(previousAttentionId)) {
-      this.notify(previousAttentionId);
-    }
-    this.attentionId = id;
-    this.clearAttentionTimer();
-    this.attentionTimer = setTimeout(() => {
-      if (this.attentionId === id) {
-        this.attentionId = null;
-        if (this.armCommandExitOnAttentionLoss(id)) {
-          this.notify(id);
-        }
-      }
-      this.attentionTimer = null;
-    }, this.inactivityTimeoutMs);
+  /** The realm is gone: a disengage for whatever it pointed at. */
+  removeViewer(viewerId: string): void {
+    this.setViewer(viewerId, NOT_ENGAGED, 'leave');
   }
 
-  attend(id: string): void {
+  /**
+   * A human interacted with the Session. Both kinds clear the ring and whatever
+   * it held or deferred, and mark the running command seen; `input` (keys,
+   * paste, drop) also turns TODO off and opens the echo window. Never creates
+   * an entry: an id with none — a browser Surface — has nothing to clear.
+   */
+  acknowledge(id: string, options: { input: boolean }): void {
     if (this.inert(id)) return;
-    const entry = this.getOrCreateEntry(id);
-    this.setAttention(id);
-    // A ring already set TODO, so clearing it leaves the TODO behind.
+    const entry = this.entries.get(id);
+    if (!entry) return;
+    this.markSeen(entry);
+    if (options.input) {
+      entry.echoUntil = Date.now() + cfg.alert.echoWindow;
+      this.setTodoForUser(id, entry, false);
+      return;
+    }
     this.clearRingForUser(entry);
-    this.markCommandExitSeen(entry);
     this.notify(id);
   }
 
-  clearAttention(id?: string): void {
-    if (id !== undefined && (this.attentionId !== id || this.helpers.has(id))) return;
-    const lostAttentionId = this.attentionId;
-    this.attentionId = null;
-    this.clearAttentionTimer();
-    if (lostAttentionId && this.armCommandExitOnAttentionLoss(lostAttentionId)) {
-      this.notify(lostAttentionId);
-    }
+  private markSeen(entry: AlertEntry): void {
+    if (entry.commandExitWatch) entry.commandExitWatch.seen = true;
+  }
+
+  private inEchoWindow(entry: AlertEntry): boolean {
+    return Date.now() < entry.echoUntil;
+  }
+
+  /** Ring, unless the Session is engaged: then hold for engagement to end. */
+  private raiseOrHold(
+    id: string,
+    entry: AlertEntry,
+    source: ListedRingSource | WatchingSource,
+    detail: ActivityNotification,
+  ): void {
+    if (this.engaged(id)) this.hold(entry, source, detail);
+    else this.raiseRing(entry, source, detail);
+  }
+
+  private hold(entry: AlertEntry, source: ListedRingSource | WatchingSource, detail: ActivityNotification): void {
+    const held = entry.held ??= { sources: [], watching: null, detail };
+    held.detail = richer(held.detail, detail);
+    if (typeof source !== 'string') held.watching = source;
+    else if (!held.sources.includes(source)) held.sources.push(source);
+  }
+
+  /**
+   * Presence lapsed from inactivity with focus unchanged: what was held rings
+   * now, through the ordinary raise path — a report through the acknowledged
+   * check and animation deferral, a settle or exit directly — with the richest
+   * held detail.
+   */
+  private escalateHeld(id: string, entry: AlertEntry): void {
+    const held = entry.held;
+    if (held === null) return;
+    entry.held = null;
+    if (held.watching !== null) this.raiseRing(entry, held.watching, held.detail);
+    if (held.sources.includes('exit')) this.raiseRing(entry, 'exit', held.detail);
+    if (held.sources.includes('report')) this.deliverReport(id, entry, held.detail);
+    // A ring is open now, so a notification still waiting on animation joins it.
+    if (entry.ring !== null && entry.deferred !== null) this.flushDeferredNotification(id, entry);
   }
 
   // --- Alert controls ---
@@ -1149,7 +1241,7 @@ export class AlertManager {
     const entry = this.entries.get(id);
     if (!entry || this.helpers.has(id)) return DEFAULT_ALERT_STATE;
     return {
-      status: this.getProjectedStatus(entry),
+      status: this.getProjectedStatus(id, entry),
       watchingEnabled: this.isWatching(entry),
       todo: entry.todo,
       notification: entry.notification,
@@ -1181,10 +1273,6 @@ export class AlertManager {
       this.clearDeferredNotification(entry);
       entry.detector.dispose();
       this.entries.delete(id);
-      if (this.attentionId === id) {
-        this.attentionId = null;
-        this.clearAttentionTimer();
-      }
       this.notify(id);
     }
     // Last, so `notify` still knows a helper that never published has nothing
@@ -1204,6 +1292,7 @@ export class AlertManager {
     entry.todo = state.todo === true;
     entry.notification = entry.todo ? normalizeActivityNotification(state.notification) : null;
     entry.ring = null;
+    entry.held = null;
     entry.ackedQuiet = false;
     entry.progress = null;
     entry.commandExitWatch = null;
@@ -1226,11 +1315,9 @@ export class AlertManager {
     const entry = this.entries.get(id);
     if (!entry) return null;
     this.settleWaiters(id, 'cancelled');
-    if (this.attentionId === id) {
-      this.attentionId = null;
-      this.clearAttentionTimer();
-      this.armCommandExitOnAttentionLoss(id);
-    }
+    // Leaving this window is an explicit disengage, and a seen command stays
+    // seen: unengaged at the destination, it is armed there.
+    entry.held = null;
     this.suspendedForTransfer.add(id);
     const { detector, deferredTimer: _timer, ...state } = entry;
     const snapshot = structuredClone({ ...state, detector: detector.snapshot() });
@@ -1299,9 +1386,9 @@ export class AlertManager {
     this.helpers.clear();
     this.awaits.clear();
     this.claimants.clear();
+    this.viewers.clear();
     this.listeners.clear();
     this.lastEmitted.clear();
-    this.clearAttentionTimer();
   }
 
   // --- Internals ---
@@ -1328,7 +1415,7 @@ export class AlertManager {
     return this.getOrCreateEntry(id);
   }
 
-  private getProjectedStatus(entry: AlertEntry): SessionStatus {
+  private getProjectedStatus(id: string, entry: AlertEntry): SessionStatus {
     if (entry.ring !== null) return 'ALERT_RINGING';
     if (entry.progress !== null) return 'OSC_NOTIF_BUSY';
     // WATCHING outranks the command-exit arm: a watched command is by
@@ -1336,7 +1423,8 @@ export class AlertManager {
     // detector's busy/quiet states for the entire run. The detector is derived
     // from real output, so it is the more informative of the two.
     if (this.isWatching(entry)) return entry.detector.getStatus();
-    if (entry.commandExitWatch?.armed) return 'COMMAND_EXIT_ARMED';
+    // Armed: a seen command running while nobody engages it.
+    if (entry.commandExitWatch?.seen && !this.engaged(id)) return 'COMMAND_EXIT_ARMED';
     return 'WATCHING_DISABLED';
   }
 
@@ -1354,6 +1442,8 @@ export class AlertManager {
         notification: null,
         deferred: null,
         deferredTimer: null,
+        held: null,
+        echoUntil: 0,
       };
       this.entries.set(id, entry);
     }
diff --git a/lib/src/lib/alert-resumed-output.test.ts b/lib/src/lib/alert-resumed-output.test.ts
index bd91f9e97..a24baa463 100644
--- a/lib/src/lib/alert-resumed-output.test.ts
+++ b/lib/src/lib/alert-resumed-output.test.ts
@@ -41,9 +41,9 @@ function runCommand(): void {
 /** Run it seen and then left: armed, so its exit rings once it has outlasted
  *  `cfg.alert.commandExitMinRuntime`. */
 function armCommandExit(): void {
-  manager.attend(ID);
+  manager.setViewer('viewer', { present: true, focusId: ID });
   runCommand();
-  manager.clearAttention(ID);
+  manager.setViewer('viewer', { present: false, focusId: null }, 'leave');
 }
 
 beforeEach(() => {
diff --git a/lib/src/lib/alert-runtime-transfer.test.ts b/lib/src/lib/alert-runtime-transfer.test.ts
index 0ab51107e..236235a6e 100644
--- a/lib/src/lib/alert-runtime-transfer.test.ts
+++ b/lib/src/lib/alert-runtime-transfer.test.ts
@@ -20,7 +20,7 @@ describe('live alert handoff', () => {
     source.notifyFromProtocol('pane', { source: 'OSC 9', title: 'Done', body: null });
     const first = source.getState('pane');
     const snapshot = source.pauseForTransfer('pane')!;
-    source.attend('pane');
+    source.acknowledge('pane', { input: true });
     source.clearTodo('pane');
     expect(source.getState('pane')).toEqual(first);
     const target = new AlertManager();
@@ -38,6 +38,26 @@ describe('live alert handoff', () => {
     source.dispose(); target.dispose();
   });
 
+  it('leaves behind what the source held, and arms the command it saw', () => {
+    const source = new AlertManager();
+    source.setViewer('source', { present: true, focusId: 'pane' });
+    source.applyTerminalSemanticEvents('pane', [
+      { type: 'commandLine', commandLine: 'pnpm build' },
+      { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
+    ]);
+    source.notifyFromProtocol('pane', { source: 'OSC 9', title: null, body: 'needs input' });
+    const snapshot = source.pauseForTransfer('pane')!;
+
+    const target = new AlertManager();
+    target.resumeFromTransfer('pane', JSON.parse(JSON.stringify(snapshot)));
+    expect(target.getState('pane').status).toBe('COMMAND_EXIT_ARMED');
+    // Leaving the source window disengaged it: nothing it held escalates here.
+    target.setViewer('target', { present: true, focusId: 'pane' });
+    target.setViewer('target', { present: false, focusId: 'pane' }, 'idle');
+    expect(target.getState('pane')).toMatchObject({ todo: false, notification: null });
+    source.dispose(); target.dispose();
+  });
+
   it('carries the deferral ceiling across a live transfer', () => {
     const source = new AlertManager();
     source.onData('pane');
diff --git a/lib/src/lib/alert-settings-model.ts b/lib/src/lib/alert-settings-model.ts
index 31fdd587a..09fd1c6fd 100644
--- a/lib/src/lib/alert-settings-model.ts
+++ b/lib/src/lib/alert-settings-model.ts
@@ -11,7 +11,7 @@ import { cfg } from '../cfg';
  * drag in. `alert-settings.ts` is the renderer's own mirror over the top.
  */
 export interface AlertSettings {
-  /** ms — how long "looking at this pane" lasts before the user counts as away. */
+  /** ms — how long without typing, pointer, or wheel input before the user counts as away (the renderer's presence window). */
   inactivityTimeoutMs: number;
   /** Delay terminal-notification rings behind confirmed animation. */
   deferAlertsUntilQuiet: boolean;
diff --git a/lib/src/lib/alert-speech.test.ts b/lib/src/lib/alert-speech.test.ts
index 8d7dd67c1..5d16a7148 100644
--- a/lib/src/lib/alert-speech.test.ts
+++ b/lib/src/lib/alert-speech.test.ts
@@ -274,7 +274,7 @@ describe('spoken alarms', () => {
     expect(getAlertSpeechState('pty-1')).toBe('spoken');
   });
 
-  it('cuts the utterance off and clears delivery state when the ring is attended', () => {
+  it('cuts the utterance off and clears delivery state when the ring clears', () => {
     start();
     ring('pty-1');
     vi.advanceTimersByTime(SPEAK_DELAY_MS);
@@ -288,7 +288,7 @@ describe('spoken alarms', () => {
     expect(getAlertSpeechState('pty-1')).toBeNull();
 
     // The engine reports the cut, and can also finish an utterance after the
-    // user attends. Either stale callback must not resurrect HAS SPOKEN.
+    // ring clears. Either stale callback must not resurrect HAS SPOKEN.
     utterances[0].onend?.();
     expect(getAlertSpeechState('pty-1')).toBeNull();
   });
diff --git a/lib/src/lib/clipboard.test.ts b/lib/src/lib/clipboard.test.ts
index c5d6498d7..ad7ad7e40 100644
--- a/lib/src/lib/clipboard.test.ts
+++ b/lib/src/lib/clipboard.test.ts
@@ -30,7 +30,9 @@ vi.mock('./terminal-registry', () => ({
   getDefaultShellOpts: () => ({ shell: '/bin/bash' }),
   getTerminalShellKind: () => mocks.shellKind,
   getTerminalInstance: () => null,
-  markSessionTouched: vi.fn(),
+  // The acknowledging write every human-originated input takes; the registry
+  // test pins what it does.
+  writeUserInput: (id: string, data: string) => mocks.writePty(id, data),
 }));
 
 import { doPaste } from './clipboard';
diff --git a/lib/src/lib/clipboard.ts b/lib/src/lib/clipboard.ts
index 7b7f42763..63593d899 100644
--- a/lib/src/lib/clipboard.ts
+++ b/lib/src/lib/clipboard.ts
@@ -4,7 +4,7 @@ import { rewrap } from './rewrap';
 import { extractSelectionText } from './selection-text';
 import { getPlatform, PLATFORM_STRING } from './platform';
 import { shellEscapePath } from './shell-escape';
-import { getDefaultShellOpts, getTerminalInstance, getTerminalShellKind, markSessionTouched } from './terminal-registry';
+import { getDefaultShellOpts, getTerminalInstance, getTerminalShellKind, writeUserInput } from './terminal-registry';
 
 /** Report failure without throwing so callers retain the selection for retry. */
 export async function writeTextToClipboard(text: string): Promise<boolean> {
@@ -48,10 +48,9 @@ function writePasteToPty(terminalId: string, text: string): void {
   if (!text) return;
   const bracketed = getMouseSelectionState(terminalId).bracketedPaste;
   const payload = bracketed ? `\x1b[200~${defangPasteEscapes(text)}\x1b[201~` : text;
-  // Paste and file-drop input bypass xterm's onData handler, so the touch has to
-  // be marked here rather than by the keystroke path.
-  markSessionTouched(terminalId);
-  getPlatform().writePty(terminalId, payload);
+  // Paste and file-drop input bypass xterm's onData handler, so they take the
+  // keystroke path's write here: touched, acknowledged, then written.
+  writeUserInput(terminalId, payload);
 }
 
 /**
diff --git a/lib/src/lib/engagement.test.ts b/lib/src/lib/engagement.test.ts
new file mode 100644
index 000000000..d634ce964
--- /dev/null
+++ b/lib/src/lib/engagement.test.ts
@@ -0,0 +1,95 @@
+/** @vitest-environment jsdom */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { FakePtyAdapter, setPlatform } from './platform';
+import { publishEngagementFocus, retainEngagementReporter, withdrawEngagementFocus } from './engagement';
+import { getAlertSettings } from './alert-settings';
+
+let platform: FakePtyAdapter;
+let report: ReturnType<typeof vi.spyOn>;
+let release: () => void;
+const wall = {};
+
+beforeEach(() => {
+  vi.useFakeTimers();
+  vi.spyOn(document, 'hasFocus').mockReturnValue(true);
+  platform = new FakePtyAdapter();
+  setPlatform(platform);
+  report = vi.spyOn(platform, 'alertEngagement');
+  release = retainEngagementReporter();
+});
+
+afterEach(() => {
+  withdrawEngagementFocus(wall);
+  release();
+  platform.shutdown();
+  vi.restoreAllMocks();
+  vi.useRealTimers();
+});
+
+describe('engagement reporter', () => {
+  it('holds a watched settle while the user only moves the mouse, and rings once they stop', () => {
+    const states: string[] = [];
+    platform.onAlertState(({ id, status }) => { if (id === 'pane-a') states.push(status); });
+    platform.alertSetWatchedCommands(['claude']);
+    platform.setScenario('pane-a', { name: 'none', chunks: [] });
+    platform.spawnPty('pane-a');
+    publishEngagementFocus(wall, 'pane-a');
+    window.dispatchEvent(new Event('keydown'));
+    platform.sendOutput('pane-a', '\x1b]633;E;claude\x07\x1b]633;C\x07');
+    // Claude works for three seconds and goes quiet; the user reads along,
+    // moving the mouse now and then but never typing.
+    for (let t = 0; t < 3_000; t += 100) {
+      vi.advanceTimersByTime(100);
+      platform.sendOutput('pane-a', 'thinking…');
+    }
+    for (let t = 0; t < 60_000; t += 5_000) {
+      vi.advanceTimersByTime(5_000);
+      window.dispatchEvent(new Event('pointermove'));
+    }
+    expect(states).toContain('BUSY');
+    expect(states).not.toContain('ALERT_RINGING');
+
+    vi.advanceTimersByTime(getAlertSettings().inactivityTimeoutMs);
+    expect(states.at(-1)).toBe('ALERT_RINGING');
+  });
+
+  it('reports changes only, never each input event', () => {
+    publishEngagementFocus(wall, 'pane-a');
+    for (let i = 0; i < 50; i++) window.dispatchEvent(new Event('pointermove'));
+    publishEngagementFocus(wall, 'pane-a');
+
+    expect(report.mock.calls).toEqual([
+      [{ present: false, focusId: 'pane-a' }, undefined],
+      [{ present: true, focusId: 'pane-a' }, undefined],
+    ]);
+  });
+
+  it('names an inactivity lapse as idle, keeping the focus', () => {
+    publishEngagementFocus(wall, 'pane-a');
+    window.dispatchEvent(new Event('keydown'));
+    report.mockClear();
+
+    vi.advanceTimersByTime(getAlertSettings().inactivityTimeoutMs);
+    expect(report.mock.calls).toEqual([[{ present: false, focusId: 'pane-a' }, 'idle']]);
+  });
+
+  it('reports a focus change while present without a lapse', () => {
+    window.dispatchEvent(new Event('keydown'));
+    publishEngagementFocus(wall, 'pane-a');
+    publishEngagementFocus(wall, null);
+    expect(report.mock.calls.at(-1)).toEqual([{ present: true, focusId: null }, undefined]);
+  });
+
+  it('reports the realm gone once the last holder releases', () => {
+    const second = retainEngagementReporter();
+    window.dispatchEvent(new Event('keydown'));
+    publishEngagementFocus(wall, 'pane-a');
+    second();
+    expect(report.mock.calls.at(-1)).toEqual([{ present: true, focusId: 'pane-a' }, undefined]);
+
+    withdrawEngagementFocus(wall);
+    release();
+    expect(report.mock.calls.at(-1)).toEqual([{ present: false, focusId: null }, 'leave']);
+    release = retainEngagementReporter();
+  });
+});
diff --git a/lib/src/lib/engagement.ts b/lib/src/lib/engagement.ts
new file mode 100644
index 000000000..89ef18ab2
--- /dev/null
+++ b/lib/src/lib/engagement.ts
@@ -0,0 +1,69 @@
+import type { Engagement, EngagementLapse } from './alert-manager';
+import { getAlertSettings, subscribeToAlertSettings } from './alert-settings';
+import { getPlatformOrNull } from './platform';
+import { createPresenceTracker, type PresenceTracker } from './presence';
+
+/**
+ * This renderer realm's engagement reporter (`docs/specs/alert.md` ->
+ * Engagement): presence from the one `PresenceTracker`, focus from whichever
+ * mounted Wall is the visible one, sent to the host only when either changes —
+ * never per input event.
+ */
+
+/** Each mounted Wall's focus; only the visible Wall's is ever non-null. */
+const focusBySlot = new Map<object, string | null>();
+let holders = 0;
+let presence: PresenceTracker | null = null;
+let releasePresence: (() => void) | null = null;
+let reported: Engagement = { present: false, focusId: null };
+
+function currentFocus(): string | null {
+  for (const focusId of focusBySlot.values()) {
+    if (focusId !== null) return focusId;
+  }
+  return null;
+}
+
+function report(lapse?: EngagementLapse): void {
+  const next: Engagement = { present: presence?.present ?? false, focusId: currentFocus() };
+  if (next.present === reported.present && next.focusId === reported.focusId) return;
+  reported = next;
+  getPlatformOrNull()?.alertEngagement(next, next.present ? undefined : lapse);
+}
+
+/** Hold the reporter while a Wall is mounted; the first holder starts presence
+ *  tracking, the last one's release reports the realm gone. */
+export function retainEngagementReporter(): () => void {
+  if (holders++ === 0) {
+    const tracker = createPresenceTracker({ timeoutMs: () => getAlertSettings().inactivityTimeoutMs });
+    const unsubscribe = tracker.subscribe((_present, lapse) => report(lapse));
+    const unsubscribeSettings = subscribeToAlertSettings(() => tracker.refresh());
+    presence = tracker;
+    releasePresence = () => {
+      unsubscribe();
+      unsubscribeSettings();
+      tracker.dispose();
+    };
+  }
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    if (--holders > 0) return;
+    releasePresence?.();
+    releasePresence = null;
+    presence = null;
+    report('leave');
+  };
+}
+
+/** Publish one Wall's focus: the terminal Session it points the realm at, or null. */
+export function publishEngagementFocus(slot: object, focusId: string | null): void {
+  focusBySlot.set(slot, focusId);
+  report();
+}
+
+export function withdrawEngagementFocus(slot: object): void {
+  if (!focusBySlot.delete(slot)) return;
+  report();
+}
diff --git a/lib/src/lib/platform/fake-adapter.ts b/lib/src/lib/platform/fake-adapter.ts
index f68520641..3e065b103 100644
--- a/lib/src/lib/platform/fake-adapter.ts
+++ b/lib/src/lib/platform/fake-adapter.ts
@@ -2,7 +2,7 @@ import type { AlertRuntimeSnapshot } from '../alert-manager';
 import { DEFAULT_HELPER_COMMAND, type HelperIdentity, type TerminalContextRequest, type TerminalContextInfo } from '../terminal-context-types';
 import type { AlertStateDetail, OpenPort, PlatformAdapter, PtyDataDetail, PtyInfo, BurrowLink } from './types';
 import { AlertManager } from '../alert-manager';
-import type { AwaitHandle, AwaitOptions } from '../alert-manager';
+import type { AwaitHandle, AwaitOptions, Engagement, EngagementLapse } from '../alert-manager';
 import type { AlertSettings } from '../alert-settings';
 import { normalizeExternalUri } from '../external-links';
 import {
@@ -41,6 +41,9 @@ export interface FakePtyResizeDetail extends FakePtySize {
 
 const DEFAULT_PTY_SIZE: FakePtySize = { cols: 80, rows: 30 };
 
+/** This adapter's local manager serves one renderer realm, so one viewer. */
+const FAKE_VIEWER = 'fake';
+
 export class FakePtyAdapter implements PlatformAdapter {
   private dataHandlers = new Set<(detail: PtyDataDetail) => void>();
   private exitHandlers = new Set<(detail: { id: string; exitCode: number }) => void>();
@@ -335,9 +338,9 @@ export class FakePtyAdapter implements PlatformAdapter {
   alertSetCommandWatched(name: string, watched: boolean): void { this.alertManager.setCommandWatched(name, watched); }
   alertPublishSettings(settings: AlertSettings): void { this.alertManager.applySettings(settings); }
   alertDismiss(id: string): void { this.alertManager.dismissAlert(id); }
-  alertAttend(id: string): void { this.alertManager.attend(id); }
+  alertEngagement(state: Engagement, lapse?: EngagementLapse): void { this.alertManager.setViewer(FAKE_VIEWER, state, lapse); }
+  alertAcknowledge(id: string, options: { input: boolean }): void { this.alertManager.acknowledge(id, options); }
   alertResize(id: string): void { this.alertManager.onResize(id); }
-  alertClearAttention(id?: string): void { this.alertManager.clearAttention(id); }
   alertToggleTodo(id: string): void { this.alertManager.toggleTodo(id); }
   alertClearTodo(id: string): void { this.alertManager.clearTodo(id); }
   alertAwait(id: string, options: AwaitOptions): AwaitHandle { return this.alertManager.awaitCompletion(id, options); }
diff --git a/lib/src/lib/platform/types.ts b/lib/src/lib/platform/types.ts
index 6090f2af5..140fff32b 100644
--- a/lib/src/lib/platform/types.ts
+++ b/lib/src/lib/platform/types.ts
@@ -1,6 +1,6 @@
 import type { AlertRuntimeSnapshot } from '../alert-manager';
 import type { HelperIdentity, TerminalContextRequest, TerminalContextInfo } from '../terminal-context-types';
-import type { AlertState, AwaitHandle, AwaitOptions } from '../alert-manager';
+import type { AlertState, AwaitHandle, AwaitOptions, Engagement, EngagementLapse } from '../alert-manager';
 import type { AlertSettings } from '../alert-settings';
 import type { VSCodeWorkbenchCommand } from '../vscode-keybindings';
 import type { ShellEntry } from '../shell-defaults';
@@ -471,9 +471,14 @@ export interface PlatformAdapter {
    */
   alertPublishSettings(settings: AlertSettings, opts: { seed: boolean }): void;
   alertDismiss(id: string): void;
-  alertAttend(id: string): void;
+  /**
+   * This renderer realm's presence and focus (`docs/specs/alert.md` ->
+   * Engagement), sent only when it changes; `lapse` says why presence ended.
+   */
+  alertEngagement(state: Engagement, lapse?: EngagementLapse): void;
+  /** A human interacted with the Session; `input` when they typed, pasted, or dropped into it. */
+  alertAcknowledge(id: string, options: { input: boolean }): void;
   alertResize(id: string): void;
-  alertClearAttention(id?: string): void;
   alertToggleTodo(id: string): void;
   alertClearTodo(id: string): void;
   /**
diff --git a/lib/src/lib/platform/vscode-adapter.ts b/lib/src/lib/platform/vscode-adapter.ts
index e1c032ba2..224578094 100644
--- a/lib/src/lib/platform/vscode-adapter.ts
+++ b/lib/src/lib/platform/vscode-adapter.ts
@@ -5,7 +5,7 @@ import type { HelperIdentity, TerminalContextRequest, TerminalContextInfo } from
 import type { AgentBrowserCommandResult, AgentBrowserEditOp, AgentBrowserEditResult, AgentBrowserOpenResult, AgentBrowserPopResult, AgentBrowserScreenshotResult, AgentBrowserStreamStatusResult, AlertStateDetail, IframeProxyResult, OpenPort, PlatformAdapter, PtyDataDetail, PtyInfo, BurrowLink, ToolControlResult, ToolHostRequest, WritePtyOptions } from './types';
 import { openPortRequestTimeoutMs } from './types';
 import { createBurrowLinkClient } from '../../host/remote/link-client';
-import type { AwaitHandle, AwaitOptions, AwaitOutcome } from '../alert-manager';
+import type { AwaitHandle, AwaitOptions, AwaitOutcome, Engagement, EngagementLapse } from '../alert-manager';
 import type { AlertSettings } from '../alert-settings';
 import type {
   NotepadArchiveLoadResult,
@@ -586,16 +586,16 @@ export class VSCodeAdapter implements PlatformAdapter {
     this.vscode.postMessage({ type: 'alert:dismiss', id });
   }
 
-  alertAttend(id: string): void {
-    this.vscode.postMessage({ type: 'alert:attend', id });
+  alertEngagement(state: Engagement, lapse?: EngagementLapse): void {
+    this.vscode.postMessage({ type: 'alert:engagement', present: state.present, focusId: state.focusId, lapse });
   }
 
-  alertResize(id: string): void {
-    this.vscode.postMessage({ type: 'alert:resize', id });
+  alertAcknowledge(id: string, options: { input: boolean }): void {
+    this.vscode.postMessage({ type: 'alert:acknowledge', id, input: options.input });
   }
 
-  alertClearAttention(id?: string): void {
-    this.vscode.postMessage({ type: 'alert:clearAttention', id });
+  alertResize(id: string): void {
+    this.vscode.postMessage({ type: 'alert:resize', id });
   }
 
   alertToggleTodo(id: string): void {
diff --git a/lib/src/lib/presence.test.ts b/lib/src/lib/presence.test.ts
new file mode 100644
index 000000000..e1aa74ddc
--- /dev/null
+++ b/lib/src/lib/presence.test.ts
@@ -0,0 +1,129 @@
+/** @vitest-environment jsdom */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { createPresenceTracker, type PresenceTracker } from './presence';
+import type { EngagementLapse } from './alert-manager';
+
+const TIMEOUT = 15_000;
+
+let tracker: PresenceTracker;
+let timeoutMs: number;
+let focused: boolean;
+let visibility: DocumentVisibilityState;
+let transitions: Array<[boolean, EngagementLapse | undefined]>;
+
+beforeEach(() => {
+  vi.useFakeTimers();
+  timeoutMs = TIMEOUT;
+  focused = true;
+  visibility = 'visible';
+  vi.spyOn(document, 'hasFocus').mockImplementation(() => focused);
+  vi.spyOn(document, 'visibilityState', 'get').mockImplementation(() => visibility);
+  tracker = createPresenceTracker({ timeoutMs: () => timeoutMs });
+  transitions = [];
+  tracker.subscribe((present, lapse) => transitions.push([present, lapse]));
+});
+
+afterEach(() => {
+  tracker.dispose();
+  vi.restoreAllMocks();
+  vi.useRealTimers();
+});
+
+function input(type: string): void {
+  window.dispatchEvent(new Event(type));
+}
+
+describe('presence', () => {
+  it('starts absent and arrives on the first input', () => {
+    expect(tracker.present).toBe(false);
+    input('keydown');
+    expect(tracker.present).toBe(true);
+    expect(transitions).toEqual([[true, undefined]]);
+  });
+
+  it.each(['keydown', 'pointerdown', 'pointermove', 'wheel', 'compositionupdate'])('counts %s as input', (type) => {
+    input(type);
+    expect(tracker.present).toBe(true);
+  });
+
+  it('lapses as idle one timeout after the last input', () => {
+    input('keydown');
+    vi.advanceTimersByTime(TIMEOUT - 1);
+    expect(tracker.present).toBe(true);
+    vi.advanceTimersByTime(1);
+    expect(transitions).toEqual([[true, undefined], [false, 'idle']]);
+  });
+
+  it('stays present while the mouse keeps moving, with no typing at all', () => {
+    input('keydown');
+    for (let t = 0; t < 60_000; t += 5_000) {
+      vi.advanceTimersByTime(5_000);
+      input('pointermove');
+    }
+    expect(tracker.present).toBe(true);
+    expect(transitions).toEqual([[true, undefined]]);
+  });
+
+  it('sees input a handler below stops, since it listens in the capture phase', () => {
+    const target = document.createElement('div');
+    document.body.appendChild(target);
+    target.addEventListener('keydown', (event) => event.stopPropagation());
+    try {
+      target.dispatchEvent(new Event('keydown', { bubbles: true }));
+      expect(tracker.present).toBe(true);
+    } finally {
+      target.remove();
+    }
+  });
+
+  it('leaves on a real window blur, but not when an iframe Surface takes focus', () => {
+    input('keydown');
+    // An iframe inside the document took focus: the document still has it.
+    input('blur');
+    expect(tracker.present).toBe(true);
+
+    focused = false;
+    input('blur');
+    expect(transitions).toEqual([[true, undefined], [false, 'leave']]);
+    // No idle lapse follows the leave.
+    vi.advanceTimersByTime(TIMEOUT * 2);
+    expect(transitions).toHaveLength(2);
+  });
+
+  it('leaves when hidden and comes back when shown', () => {
+    input('keydown');
+    visibility = 'hidden';
+    document.dispatchEvent(new Event('visibilitychange'));
+    expect(transitions.at(-1)).toEqual([false, 'leave']);
+
+    visibility = 'visible';
+    document.dispatchEvent(new Event('visibilitychange'));
+    expect(tracker.present).toBe(true);
+  });
+
+  it('ignores input reaching a window that does not have focus', () => {
+    focused = false;
+    input('pointermove');
+    expect(tracker.present).toBe(false);
+    focused = true;
+    input('focus');
+    expect(tracker.present).toBe(true);
+  });
+
+  it('applies a shortened timeout from the last input once refreshed', () => {
+    input('keydown');
+    vi.advanceTimersByTime(4_000);
+    timeoutMs = 5_000;
+    tracker.refresh();
+    vi.advanceTimersByTime(999);
+    expect(tracker.present).toBe(true);
+    vi.advanceTimersByTime(1);
+    expect(transitions.at(-1)).toEqual([false, 'idle']);
+  });
+
+  it('stops listening once disposed', () => {
+    tracker.dispose();
+    input('keydown');
+    expect(tracker.present).toBe(false);
+  });
+});
diff --git a/lib/src/lib/presence.ts b/lib/src/lib/presence.ts
new file mode 100644
index 000000000..d8fa74c92
--- /dev/null
+++ b/lib/src/lib/presence.ts
@@ -0,0 +1,119 @@
+import type { EngagementLapse } from './alert-manager';
+
+/** What counts as a human at this window (`docs/specs/alert.md` -> Engagement). */
+const INPUT_EVENTS = ['keydown', 'pointerdown', 'pointermove', 'wheel', 'compositionupdate'] as const;
+
+/** Every input listener is a capture-phase, passive stamp: it sees input a
+ *  terminal or dialog stops, and never delays it. */
+const LISTENER_OPTIONS: AddEventListenerOptions = { capture: true, passive: true };
+
+/**
+ * Whether a human is at this renderer realm: its window focused and visible,
+ * with typing, pointer, or wheel input inside the inactivity timeout. Emits
+ * transitions only, each end of presence with why it ended.
+ */
+export interface PresenceTracker {
+  readonly present: boolean;
+  subscribe(listener: (present: boolean, lapse?: EngagementLapse) => void): () => void;
+  /** The timeout changed: re-arm against the new value from the last input. */
+  refresh(): void;
+  dispose(): void;
+}
+
+export interface PresenceTrackerOptions {
+  /** Read at every deadline, so a settings edit needs only `refresh`. */
+  timeoutMs: () => number;
+  target?: Window;
+  doc?: Document;
+}
+
+export function createPresenceTracker({
+  timeoutMs,
+  target = window,
+  doc = document,
+}: PresenceTrackerOptions): PresenceTracker {
+  let lastInputAt = Number.NEGATIVE_INFINITY;
+  let present = false;
+  let timer: ReturnType<typeof setTimeout> | null = null;
+  const listeners = new Set<(present: boolean, lapse?: EngagementLapse) => void>();
+
+  const windowActive = (): boolean => doc.hasFocus() && doc.visibilityState === 'visible';
+
+  const set = (next: boolean, lapse?: EngagementLapse): void => {
+    if (next === present) return;
+    present = next;
+    for (const listener of [...listeners]) listener(present, present ? undefined : lapse);
+  };
+
+  const clearTimer = (): void => {
+    if (timer === null) return;
+    clearTimeout(timer);
+    timer = null;
+  };
+
+  // One timer per idle window, not one per event: input only stamps a time,
+  // and the wake re-arms for whatever remains.
+  const arm = (): void => {
+    if (timer !== null || !present) return;
+    timer = setTimeout(expire, Math.max(0, lastInputAt + timeoutMs() - Date.now()));
+  };
+
+  function expire(): void {
+    timer = null;
+    if (!present) return;
+    if (Date.now() - lastInputAt >= timeoutMs()) set(false, 'idle');
+    else arm();
+  }
+
+  const onInput = (): void => {
+    lastInputAt = Date.now();
+    if (!present && windowActive()) set(true);
+    arm();
+  };
+
+  const leave = (): void => {
+    clearTimer();
+    set(false, 'leave');
+  };
+
+  // An iframe Surface taking focus blurs this window while the document keeps
+  // it (`docs/specs/layout.md` -> Corner cases #2): not a leave.
+  const onBlur = (): void => {
+    if (!doc.hasFocus()) leave();
+  };
+
+  // Bringing the window back is a human act, so it counts as input.
+  const onVisibility = (): void => {
+    if (doc.visibilityState === 'visible') onInput();
+    else leave();
+  };
+
+  for (const type of INPUT_EVENTS) target.addEventListener(type, onInput, LISTENER_OPTIONS);
+  target.addEventListener('focus', onInput);
+  target.addEventListener('blur', onBlur);
+  doc.addEventListener('visibilitychange', onVisibility);
+
+  return {
+    get present() {
+      return present;
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    refresh() {
+      clearTimer();
+      arm();
+    },
+    dispose() {
+      clearTimer();
+      listeners.clear();
+      for (const type of INPUT_EVENTS) target.removeEventListener(type, onInput, LISTENER_OPTIONS);
+      target.removeEventListener('focus', onInput);
+      target.removeEventListener('blur', onBlur);
+      doc.removeEventListener('visibilitychange', onVisibility);
+    },
+  };
+}
diff --git a/lib/src/lib/reconnect.test.ts b/lib/src/lib/reconnect.test.ts
index c9ae36a14..f8784dfde 100644
--- a/lib/src/lib/reconnect.test.ts
+++ b/lib/src/lib/reconnect.test.ts
@@ -72,9 +72,9 @@ function createPlatform(ptys: PtyInfo[], savedState: PersistedSession | null): P
     alertSetWatchedCommands: vi.fn(),
     alertSetCommandWatched: vi.fn(),
     alertDismiss: vi.fn(),
-    alertAttend: vi.fn(),
+    alertEngagement: vi.fn(),
     alertResize: vi.fn(),
-    alertClearAttention: vi.fn(),
+    alertAcknowledge: vi.fn(),
     alertToggleTodo: vi.fn(),
     alertClearTodo: vi.fn(),
     onAlertState: vi.fn(),
diff --git a/lib/src/lib/session-activity-store.ts b/lib/src/lib/session-activity-store.ts
index 67a760f3b..7d3825830 100644
--- a/lib/src/lib/session-activity-store.ts
+++ b/lib/src/lib/session-activity-store.ts
@@ -149,12 +149,14 @@ export function dismissSessionAlert(id: string): void {
   getPlatform().alertDismiss(id);
 }
 
-export function markSessionAttention(id: string): void {
-  getPlatform().alertAttend(id);
-}
-
-export function clearSessionAttention(id?: string): void {
-  getPlatform().alertClearAttention(id);
+/**
+ * A human interacted with this Session (`docs/specs/alert.md` -> Engagement):
+ * `input` for keys, a paste, or a drop, else a click, tap, or reattach. Only a
+ * terminal Session is acknowledged — a browser Surface has no Activity machine.
+ */
+export function acknowledgeSession(id: string, input: boolean): void {
+  if (!registry.has(id)) return;
+  getPlatform().alertAcknowledge(id, { input });
 }
 
 export function toggleSessionTodo(id: string): void {
diff --git a/lib/src/lib/session-restore.test.ts b/lib/src/lib/session-restore.test.ts
index 3408fd2ee..476390731 100644
--- a/lib/src/lib/session-restore.test.ts
+++ b/lib/src/lib/session-restore.test.ts
@@ -48,9 +48,9 @@ function createPlatform(
     alertSetWatchedCommands: vi.fn(),
     alertSetCommandWatched: vi.fn(),
     alertDismiss: vi.fn(),
-    alertAttend: vi.fn(),
+    alertEngagement: vi.fn(),
     alertResize: vi.fn(),
-    alertClearAttention: vi.fn(),
+    alertAcknowledge: vi.fn(),
     alertToggleTodo: vi.fn(),
     alertClearTodo: vi.fn(),
     onAlertState: vi.fn(),
diff --git a/lib/src/lib/session-save.test.ts b/lib/src/lib/session-save.test.ts
index ead773a58..0394e525c 100644
--- a/lib/src/lib/session-save.test.ts
+++ b/lib/src/lib/session-save.test.ts
@@ -49,9 +49,9 @@ function createPlatform(savedState: PersistedSession | null): PlatformAdapter {
     alertSetWatchedCommands: () => {},
     alertSetCommandWatched: () => {},
     alertDismiss: () => {},
-    alertAttend: () => {},
+    alertEngagement: () => {},
     alertResize: () => {},
-    alertClearAttention: () => {},
+    alertAcknowledge: () => {},
     alertToggleTodo: () => {},
     alertClearTodo: () => {},
     onAlertState: () => {},
diff --git a/lib/src/lib/terminal-lifecycle.ts b/lib/src/lib/terminal-lifecycle.ts
index 82a4d3508..0240d6614 100644
--- a/lib/src/lib/terminal-lifecycle.ts
+++ b/lib/src/lib/terminal-lifecycle.ts
@@ -32,10 +32,9 @@ import {
   type TerminalEntry,
   type TerminalOverlayDims,
 } from './terminal-store';
-import { clearTerminalActivity, getActivity, notifyActivityListeners } from './session-activity-store';
+import { acknowledgeSession, clearTerminalActivity, notifyActivityListeners } from './session-activity-store';
 import { attachTerminalMouseRouter } from './terminal-mouse-router';
 import {
-  inputContainsEnter,
   inputIsReplayTerminalReport,
   inputIsSyntheticTerminalReport,
   REPLAY_MODE_RESET,
@@ -251,25 +250,22 @@ function wireXtermHandlers(
 
     if (isReplayTerminalReport && registry.get(id)?.isReplaying) return;
 
-    // Forwarded mouse interaction still counts as touched for kill confirmation.
-    if (!isReplayTerminalReport) markSessionTouched(id);
-
     // Inside programs can request hover and wheel reports. Mouse-only chunks
-    // are not keystrokes; actual clicks attend through the Pane's DOM handler.
-    if (!isReplayTerminalReport && withoutMouseReports.length > 0) {
-      // CSI/SS3 can encode real keys. The broader filter protects the prompt
-      // recorder only; terminal replies must neither record input nor attend.
-      if (!inputIsSyntheticTerminalReport(input)) {
-        recordTerminalUserInput(id, input, makePromptLineReader(terminal));
-      }
-      const hadTodo = getActivity(id).todo;
-      getPlatform().alertAttend(id);
-      if (hadTodo && inputContainsEnter(input)) {
-        getPlatform().alertClearTodo(id);
-      }
+    // are not keystrokes; actual clicks acknowledge through the Pane's DOM
+    // handler. Terminal replies are never keystrokes either.
+    if (isReplayTerminalReport || withoutMouseReports.length === 0) {
+      // Forwarded mouse interaction still counts as touched for kill confirmation.
+      if (!isReplayTerminalReport) markSessionTouched(id);
+      getPlatform().writePty(id, input);
+      return;
     }
 
-    getPlatform().writePty(id, input);
+    // CSI/SS3 can encode real keys. The broader filter protects the prompt
+    // recorder only.
+    if (!inputIsSyntheticTerminalReport(input)) {
+      recordTerminalUserInput(id, input, makePromptLineReader(terminal));
+    }
+    writeUserInput(id, input);
   });
 
   const resizeDisposable = terminal.onResize(({ cols, rows }) => {
@@ -718,6 +714,17 @@ export function isUntouched(id: string): boolean {
   return registry.get(id)?.untouched ?? false;
 }
 
+/**
+ * Write human-originated input — a keystroke, a paste, a file drop — so every
+ * path acknowledges alike (`docs/specs/alert.md` -> Engagement). Acknowledged
+ * before the write, so the echo window is open before any echo can arrive.
+ */
+export function writeUserInput(id: string, data: string): void {
+  markSessionTouched(id);
+  acknowledgeSession(id, true);
+  getPlatform().writePty(id, data);
+}
+
 export function markSessionTouched(id: string): void {
   const entry = registry.get(id);
   if (!entry) return;
@@ -759,10 +766,8 @@ export function focusSession(id: string, focused: boolean, target: 'surface' | '
   const entry = registry.get(id);
   if (!entry) return;
 
-  if (focused) {
-    entry.terminal.focus();
-  } else {
-    entry.terminal.blur();
-    getPlatform().alertClearAttention(id);
-  }
+  // DOM focus is never engagement: the Wall reports that from its mode and
+  // selection (`docs/specs/alert.md` -> Engagement).
+  if (focused) entry.terminal.focus();
+  else entry.terminal.blur();
 }
diff --git a/lib/src/lib/terminal-registry.alert.test.ts b/lib/src/lib/terminal-registry.alert.test.ts
index c6de392a9..110e66732 100644
--- a/lib/src/lib/terminal-registry.alert.test.ts
+++ b/lib/src/lib/terminal-registry.alert.test.ts
@@ -110,9 +110,9 @@ import {
   isPaneOscDriven,
   mountElement,
   refitSession,
+  acknowledgeSession,
   clearLocalSurfaceActivity,
   clearTerminalActivity,
-  clearSessionAttention,
   restoreBrowserSurfaceTodo,
   disposeAllSessions,
   disposeSession,
@@ -130,7 +130,6 @@ import {
   initAlertStateReceiver,
   setCommandWatched,
   isUntouched,
-  markSessionAttention,
   setTerminalActivity,
   resumeTerminal,
   restoreTerminal,
@@ -138,7 +137,7 @@ import {
   subscribeToActivity,
   toggleSessionTodo,
 } from './terminal-registry';
-import { pasteFilePaths } from './clipboard';
+import { doPaste, pasteFilePaths } from './clipboard';
 import { registry } from './terminal-store';
 import { commandWatchKey } from './terminal-state';
 import { REPLAY_MODE_RESET } from './terminal-report-filter';
@@ -223,22 +222,29 @@ function emitOutput(id: string, data = 'output'): void {
   fakePlatform.writePty(id, data);
 }
 
-function attendSession(id: string): void {
-  markSessionAttention(id);
+/** The user is present with `id` focused, as the Wall's reporter says it. */
+function engageSession(id: string): void {
+  fakePlatform.alertEngagement({ present: true, focusId: id });
 }
 
-function expireAttention(id?: string): void {
-  clearSessionAttention(id);
+/** Focus moved off, or the window left. */
+function leaveSession(): void {
+  fakePlatform.alertEngagement({ present: false, focusId: null }, 'leave');
+}
+
+/** A click on the pane, or a Door reattach into passthrough. */
+function clickSession(id: string): void {
+  acknowledgeSession(id, false);
 }
 
 function minimizeSession(id: string): void {
   unmountElement(id);
-  clearSessionAttention(id);
+  leaveSession();
 }
 
 function reattachDoorViaEnter(id: string): void {
   mountElement(id, createContainer() as unknown as HTMLElement);
-  markSessionAttention(id);
+  clickSession(id);
 }
 
 function reattachDoorViaD(id: string): void {
@@ -280,7 +286,7 @@ function driveToBusy(id: string): void {
 
 function driveToRingingNeedsAttention(id: string): void {
   driveToBusy(id);
-  expireAttention(id);
+  leaveSession();
   advance(2_000);
   expect(getActivity(id).status).toBe('MIGHT_NEED_ATTENTION');
   advance(3_000);
@@ -393,12 +399,12 @@ describe('terminal-registry alert behavior', () => {
     expect(getActivitySnapshot().has(id)).toBe(false);
   });
 
-  it('keeps the TODO an early attention dismissal left behind', () => {
+  it('keeps the TODO an early acknowledgement left behind', () => {
     const id = 'early-attention-dismissal';
     fakePlatform.spawnPty(id);
     fakePlatform.sendOutput(id, '\x07');
     expect(getActivity(id).status).toBe('ALERT_RINGING');
-    fakePlatform.alertAttend(id);
+    fakePlatform.alertAcknowledge(id, { input: false });
     expect(getActivity(id)).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
 
     resumeTerminal(id, null, { alive: true });
@@ -591,7 +597,7 @@ describe('terminal-registry alert behavior', () => {
       }),
     );
     enableAlert(id);
-    attendSession(id);
+    engageSession(id);
 
     advance(12_000);
 
@@ -612,12 +618,12 @@ describe('terminal-registry alert behavior', () => {
       ], { name: 'long-running' }),
     );
     enableAlert(id);
-    attendSession(id);
+    engageSession(id);
 
     advance(1_800);
     expect(getActivity(id)).toMatchObject({ status: 'BUSY' });
 
-    expireAttention(id);
+    leaveSession();
     advance(2_000);
     expect(getActivity(id).status).toBe('MIGHT_NEED_ATTENTION');
 
@@ -642,11 +648,11 @@ describe('terminal-registry alert behavior', () => {
     expect(getActivity(id)).toMatchObject({ status: 'BUSY' });
   });
 
-  it('Story 4: completion while still attended does not ring', () => {
+  it('Story 4: completion while still engaged does not ring', () => {
     const id = 'story-4';
     createSession(id);
     enableAlert(id);
-    attendSession(id);
+    engageSession(id);
 
     driveToBusy(id);
     advance(2_000);
@@ -658,13 +664,13 @@ describe('terminal-registry alert behavior', () => {
     });
   });
 
-  it('Story 5: user attends to a ringing pane — its TODO stays', () => {
+  it('Story 5: user clicks a ringing pane — its TODO stays', () => {
     const id = 'story-5';
     createSession(id);
     enableAlert(id);
 
     driveToRingingNeedsAttention(id);
-    attendSession(id);
+    clickSession(id);
 
     expect(getActivity(id)).toMatchObject({
       status: 'NOTHING_TO_SHOW',
@@ -686,7 +692,7 @@ describe('terminal-registry alert behavior', () => {
     });
 
     driveToBusy(id);
-    expireAttention(id);
+    leaveSession();
     advance(2_000);
     advance(3_000);
 
@@ -782,7 +788,7 @@ describe('terminal-registry alert behavior', () => {
     });
   });
 
-  it('Story 9: new output while ringing latches until user attends', () => {
+  it('Story 9: new output while ringing latches until the user acknowledges', () => {
     const id = 'story-9';
     createSession(id);
     enableAlert(id);
@@ -791,7 +797,7 @@ describe('terminal-registry alert behavior', () => {
     emitOutput(id, 'shell prompt');
     expect(getActivity(id).status).toBe('ALERT_RINGING');
 
-    attendSession(id);
+    clickSession(id);
     expect(getActivity(id).status).toBe('NOTHING_TO_SHOW');
 
     emitOutput(id, 'next task');
@@ -805,7 +811,7 @@ describe('terminal-registry alert behavior', () => {
     const id = 'story-10';
     createSession(id);
     enableAlert(id);
-    attendSession(id);
+    engageSession(id);
 
     minimizeSession(id);
     driveToRingingNeedsAttention(id);
@@ -824,7 +830,7 @@ describe('terminal-registry alert behavior', () => {
     const id = 'story-11';
     createSession(id);
     enableAlert(id);
-    attendSession(id);
+    engageSession(id);
 
     minimizeSession(id);
     driveToRingingNeedsAttention(id);
@@ -865,7 +871,7 @@ describe('terminal-registry alert behavior', () => {
     driveToRingingNeedsAttention(beta);
 
     dismissSessionAlert(alpha);
-    attendSession(beta);
+    clickSession(beta);
 
     expect(getActivity(alpha)).toMatchObject({
       status: 'NOTHING_TO_SHOW',
@@ -877,7 +883,7 @@ describe('terminal-registry alert behavior', () => {
     });
   });
 
-  it('Story 14: destroying a session clears alert, TODO, and attention state', () => {
+  it('Story 14: destroying a session clears alert and TODO state', () => {
     const id = 'story-14';
     createSession(id);
     enableAlert(id);
@@ -892,7 +898,7 @@ describe('terminal-registry alert behavior', () => {
     runCommand(id);
     expect(getActivity(id).watchingEnabled).toBe(true);
     driveToBusy(id);
-    expireAttention(id);
+    leaveSession();
     advance(2_000);
     advance(3_000);
 
@@ -902,7 +908,7 @@ describe('terminal-registry alert behavior', () => {
     });
   });
 
-  it('marks attention from terminal input and clears ringing immediately', () => {
+  it('acknowledges terminal input, clearing the ring and its TODO at once', () => {
     const id = 'input-attention';
     const entry = createSession(id);
     enableAlert(id);
@@ -910,10 +916,7 @@ describe('terminal-registry alert behavior', () => {
     driveToRingingNeedsAttention(id);
     entry.terminal.emitInput('x');
 
-    // Typing while ringing: attend clears the ring and leaves its TODO.
-    // Plain 'x' is not Enter, so TODO stays on.
-    expect(getActivity(id).status).toBe('NOTHING_TO_SHOW');
-    expect(getActivity(id).todo).toBe(true);
+    expect(getActivity(id)).toMatchObject({ status: 'NOTHING_TO_SHOW', todo: false });
   });
 
   it.each([
@@ -923,7 +926,7 @@ describe('terminal-registry alert behavior', () => {
     ['arrow key', '\x1b[A'],
     ['SS3 key', '\x1bOA'],
     ['mouse report with a real key', '\x1b[<35;10;20Mx'],
-  ])('counts a %s as attention and forwards it unchanged', (_name, input) => {
+  ])('counts a %s as a keystroke and forwards it unchanged', (_name, input) => {
     const id = 'encoded-input-attention';
     const entry = createSession(id);
     enableAlert(id);
@@ -932,7 +935,7 @@ describe('terminal-registry alert behavior', () => {
     try {
       entry.terminal.emitInput(input);
       expect(write).toHaveBeenCalledWith(id, input);
-      expect(getActivity(id)).toMatchObject({ status: 'NOTHING_TO_SHOW', todo: true });
+      expect(getActivity(id)).toMatchObject({ status: 'NOTHING_TO_SHOW', todo: false });
     } finally {
       write.mockRestore();
     }
@@ -952,22 +955,20 @@ describe('terminal-registry alert behavior', () => {
     ['urxvt mouse report', '\x1b[64;10;20M'],
     ['X10 mouse report', '\x1b[M@!!'],
     ['combined mouse reports', '\x1b[<35;10;20M\x1b[64;10;20M\x1b[M@!!'],
-  ])('forwards a live %s without taking attention from another pane', (_name, input) => {
+  ])('forwards a live %s without acknowledging it', (_name, input) => {
     const id = 'reply-attention';
     const entry = createSession(id);
     enableAlert(id);
     driveToRingingNeedsAttention(id);
-    createSession('attended-pane');
-    attendSession('attended-pane');
-    const attend = vi.spyOn(fakePlatform, 'alertAttend');
+    const acknowledge = vi.spyOn(fakePlatform, 'alertAcknowledge');
     const write = vi.spyOn(fakePlatform, 'writePty');
     try {
       entry.terminal.emitInput(input);
       expect(write).toHaveBeenCalledWith(id, input);
-      expect(attend).not.toHaveBeenCalled();
+      expect(acknowledge).not.toHaveBeenCalled();
       expect(getActivity(id)).toMatchObject({ status: 'ALERT_RINGING' });
     } finally {
-      attend.mockRestore();
+      acknowledge.mockRestore();
       write.mockRestore();
     }
   });
@@ -1006,30 +1007,51 @@ describe('terminal-registry alert behavior', () => {
     expect(getActivity(id).status).toBe('BUSY');
   });
 
-  it('Enter (\\r) in passthrough clears an on-TODO', () => {
-    const id = 'enter-clears-todo';
+  it.each([
+    ['Enter', '\r'],
+    ['kitty Enter', '\x1b[13u'],
+    ['win32-input-mode Enter', '\x1b[13;28;13;1;0;1_'],
+    ['one-key answer', 'y'],
+  ])('clears a TODO on any keystroke: %s', (_name, input) => {
+    const id = 'keystroke-clears-todo';
     const entry = createSession(id);
     enableAlert(id);
 
     driveToRingingNeedsAttention(id);
-    attendSession(id);
+    clickSession(id);
     expect(getActivity(id).todo).toBe(true);
 
-    entry.terminal.emitInput('\r');
-    expect(getActivity(id).todo).toBe(false);
+    entry.terminal.emitInput(input);
+    expect(getActivity(id)).toMatchObject({ todo: false, notification: null });
   });
 
-  it('printable input without Enter does not clear a TODO', () => {
-    const id = 'printable-keeps-todo';
-    const entry = createSession(id);
-    enableAlert(id);
-
-    driveToRingingNeedsAttention(id);
-    attendSession(id);
-    expect(getActivity(id).todo).toBe(true);
+  it.each([
+    ['a file drop', async (id: string) => pasteFilePaths(id, ['/tmp/a.txt'])],
+    ['a text paste', async (id: string) => {
+      fakePlatform.readClipboardText = async () => 'please review';
+      try { await doPaste(id); } finally { delete fakePlatform.readClipboardText; }
+    }],
+  ])('acknowledges %s like typed input', async (_name, paste) => {
+    const id = 'paste-acknowledges';
+    createSession(id);
+    fakePlatform.sendOutput(id, '\x07');
+    expect(getActivity(id)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
+    await paste(id);
+    expect(getActivity(id)).toMatchObject({ status: 'WATCHING_DISABLED', todo: false });
+  });
 
-    entry.terminal.emitInput('hello');
-    expect(getActivity(id).todo).toBe(true);
+  it('acknowledges nothing for a click on a browser Surface, keeping its TODO', () => {
+    const browserId = 'pane-browser-click';
+    const acknowledge = vi.spyOn(fakePlatform, 'alertAcknowledge');
+    try {
+      toggleSessionTodo(browserId);
+      acknowledgeSession(browserId, false);
+      expect(acknowledge).not.toHaveBeenCalled();
+      expect(getActivity(browserId).todo).toBe(true);
+    } finally {
+      acknowledge.mockRestore();
+      clearLocalSurfaceActivity(browserId);
+    }
   });
 
   it('focus-report control sequences do not clear a TODO', () => {
@@ -1038,7 +1060,7 @@ describe('terminal-registry alert behavior', () => {
     enableAlert(id);
 
     driveToRingingNeedsAttention(id);
-    attendSession(id);
+    clickSession(id);
     expect(getActivity(id).todo).toBe(true);
 
     entry.terminal.emitInput('\x1b[I');
@@ -1189,13 +1211,13 @@ describe('terminal-registry alert behavior', () => {
     });
   });
 
-  it('the alert action leaves a Session attention already quieted alone', () => {
+  it('the alert action leaves a Session an acknowledgement already quieted alone', () => {
     const id = 'displayed-ringing-dismiss';
     createSession(id);
     enableAlert(id);
 
     driveToRingingNeedsAttention(id);
-    markSessionAttention(id);
+    clickSession(id);
 
     expect(getActivity(id)).toMatchObject({
       status: 'NOTHING_TO_SHOW',
@@ -1231,7 +1253,7 @@ describe('terminal-registry alert behavior', () => {
     } finally { unregister(); }
   });
 
-  it('programmatic terminal focus does not count as attention', () => {
+  it('programmatic terminal focus acknowledges nothing', () => {
     const id = 'focus-without-attention';
     createSession(id);
     enableAlert(id);
@@ -1249,7 +1271,7 @@ describe('terminal-registry alert behavior', () => {
     const id = 'resize-debounce';
     const session = createSession(id);
     enableAlert(id);
-    markSessionAttention(id);
+    engageSession(id);
 
     session.terminal.emitResize(120, 30);
     emitOutput(id, 'prompt redraw');
diff --git a/lib/src/lib/terminal-registry.ts b/lib/src/lib/terminal-registry.ts
index 5c2554b43..fce86166b 100644
--- a/lib/src/lib/terminal-registry.ts
+++ b/lib/src/lib/terminal-registry.ts
@@ -15,9 +15,9 @@ export type {
 } from './terminal-state';
 
 export {
+  acknowledgeSession,
   clearLocalSurfaceActivity,
   clearTerminalActivity,
-  clearSessionAttention,
   clearSessionTodo,
   DEFAULT_ACTIVITY_STATE,
   dismissSessionAlert,
@@ -25,7 +25,6 @@ export {
   getActivitySnapshot,
   getLivePersistedAlertState,
   initAlertStateReceiver,
-  markSessionAttention,
   setTerminalActivity,
   restoreBrowserSurfaceTodo,
   subscribeToActivity,
@@ -43,6 +42,7 @@ export {
   isUntouched,
   markSessionTouched,
   mountElement,
+  writeUserInput,
   refitSession,
   registerSurfaceFocusHandle,
   releaseSession,
diff --git a/lib/src/lib/terminal-report-filter.ts b/lib/src/lib/terminal-report-filter.ts
index 1f5b0a769..7af2633df 100644
--- a/lib/src/lib/terminal-report-filter.ts
+++ b/lib/src/lib/terminal-report-filter.ts
@@ -1,10 +1,6 @@
 import { ESC, RESET } from './ansi';
 import type { TerminalEntry } from './terminal-store';
 
-export function inputContainsEnter(data: string): boolean {
-  return data.includes('\r');
-}
-
 const REPORT_CSI = /\x1b\[[0-?]*[ -/]*[@-~]/;
 const REPORT_SS3 = /\x1bO[@-~]/;
 const REPORT_OSC = /\x1b\][\s\S]*?(?:\x07|\x1b\\)/;
diff --git a/lib/src/remote/client/remote-adapter.ts b/lib/src/remote/client/remote-adapter.ts
index 27bcfee5f..3a98f5777 100644
--- a/lib/src/remote/client/remote-adapter.ts
+++ b/lib/src/remote/client/remote-adapter.ts
@@ -348,9 +348,9 @@ export class RemotePtyAdapter implements PlatformAdapter {
   alertSetCommandWatched(): void {}
   alertPublishSettings(): void {}
   alertDismiss(): void {}
-  alertAttend(): void {}
+  alertEngagement(): void {}
+  alertAcknowledge(): void {}
   alertResize(): void {}
-  alertClearAttention(): void {}
   alertToggleTodo(): void {}
   alertClearTodo(): void {}
   /**
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 3ae8ecd81..b9fc6333c 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -2,7 +2,7 @@
   "AGENTS.md": 3400,
   "SECURITY.md": 200,
   "SELF_HOST.md": 6100,
-  "docs/specs/alert.md": 7400,
+  "docs/specs/alert.md": 7850,
   "docs/specs/auto-update.md": 1150,
   "docs/specs/deploy.md": 1900,
   "docs/specs/dor-browser.md": 4550,
@@ -34,7 +34,7 @@
   "docs/specs/tiling-engine.md": 4650,
   "docs/specs/transport.md": 5500,
   "docs/specs/tutorial.md": 1900,
-  "docs/specs/vscode.md": 7250,
+  "docs/specs/vscode.md": 7300,
   "docs/specs/webgl-text.md": 1200,
   "docs/specs/website-docs.md": 4800
 }
diff --git a/standalone/src/browser-sidecar-adapter.ts b/standalone/src/browser-sidecar-adapter.ts
index a43b270fd..0e78b9b16 100644
--- a/standalone/src/browser-sidecar-adapter.ts
+++ b/standalone/src/browser-sidecar-adapter.ts
@@ -39,7 +39,7 @@ import {
 } from "dormouse-lib/host/remote/service-protocol";
 import { embedderOrigins } from "dormouse-lib/lib/embedder-origins";
 import { AlertManager } from "dormouse-lib/lib/alert-manager";
-import type { AwaitHandle, AwaitOptions } from "dormouse-lib/lib/alert-manager";
+import type { AwaitHandle, AwaitOptions, Engagement, EngagementLapse } from "dormouse-lib/lib/alert-manager";
 import type { AlertSettings } from "dormouse-lib/lib/alert-settings";
 import { normalizeExternalUri } from "dormouse-lib/lib/external-links";
 import { createMemoryNotepadArchivePort } from "dormouse-lib/lib/notepad/memory-archive-port";
@@ -378,9 +378,10 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
     this.host.send("alert_command", { payload });
   }
   alertDismiss(id: string): void { this.alertManager.dismissAlert(id); }
-  alertAttend(id: string): void { this.alertManager.attend(id); }
+  // The page is the local manager's one viewer, as in `TauriAdapter`.
+  alertEngagement(state: Engagement, lapse?: EngagementLapse): void { this.alertManager.setViewer("window", state, lapse); }
+  alertAcknowledge(id: string, options: { input: boolean }): void { this.alertManager.acknowledge(id, options); }
   alertResize(id: string): void { this.alertManager.onResize(id); }
-  alertClearAttention(id?: string): void { this.alertManager.clearAttention(id); }
   alertToggleTodo(id: string): void { this.alertManager.toggleTodo(id); }
   alertClearTodo(id: string): void { this.alertManager.clearTodo(id); }
   alertAwait(id: string, options: AwaitOptions): AwaitHandle { return this.alertManager.awaitCompletion(id, options); }
diff --git a/standalone/src/tauri-adapter.ts b/standalone/src/tauri-adapter.ts
index 6b0245572..f851a8169 100644
--- a/standalone/src/tauri-adapter.ts
+++ b/standalone/src/tauri-adapter.ts
@@ -48,7 +48,7 @@ import {
 } from "dormouse-lib/host/remote/service-protocol";
 import { embedderOrigins } from "dormouse-lib/lib/embedder-origins";
 import { AlertManager } from "dormouse-lib/lib/alert-manager";
-import type { AwaitHandle, AwaitOptions } from "dormouse-lib/lib/alert-manager";
+import type { AwaitHandle, AwaitOptions, Engagement, EngagementLapse } from "dormouse-lib/lib/alert-manager";
 import type { AlertSettings } from "dormouse-lib/lib/alert-settings";
 import { normalizeExternalUri } from "dormouse-lib/lib/external-links";
 import type { PersistedAlertState, PersistedWindow } from "dormouse-lib/lib/session-types";
@@ -741,16 +741,18 @@ export class TauriAdapter implements PlatformAdapter {
     this.alertManager.dismissAlert(id);
   }
 
-  alertAttend(id: string): void {
-    this.alertManager.attend(id);
+  // This window's webview is the manager's one viewer until the manager moves
+  // to the sidecar (docs/specs/alert.md -> Engagement).
+  alertEngagement(state: Engagement, lapse?: EngagementLapse): void {
+    this.alertManager.setViewer("window", state, lapse);
   }
 
-  alertResize(id: string): void {
-    this.alertManager.onResize(id);
+  alertAcknowledge(id: string, options: { input: boolean }): void {
+    this.alertManager.acknowledge(id, options);
   }
 
-  alertClearAttention(id?: string): void {
-    this.alertManager.clearAttention(id);
+  alertResize(id: string): void {
+    this.alertManager.onResize(id);
   }
 
   alertToggleTodo(id: string): void {
diff --git a/vscode-ext/README.md b/vscode-ext/README.md
index 5fd3b9d82..3f75b0790 100644
--- a/vscode-ext/README.md
+++ b/vscode-ext/README.md
@@ -38,9 +38,9 @@ Dormouse can owe you attention in three independent ways. Two of them need no se
 
 Dormouse never guesses which commands deserve an alert. Watching is a rule you create on a command name, and turning it off anywhere removes it everywhere.
 
-A ringing pane is outlined and washed in the alarm color until you attend it, so one glance across a full wall finds it. Attending the pane — or pressing `a` — puts the alarm out.
+A ringing pane is outlined and washed in the alarm color until you answer it, so one glance across a full wall finds it. Clicking or typing into the pane — or pressing `a` — puts the alarm out. Nothing rings while you are working in that pane; if you walk away from it instead, it rings then.
 
-Whichever way a pane rings, the ring becomes a **TODO** — a marker beside the pane's title that outlives the alert, so a ring you dismissed does not disappear without a trace. Clear it by clicking it or pressing `t` in command mode.
+Whichever way a pane rings, the ring becomes a **TODO** — a marker beside the pane's title that outlives the alert, so a ring you dismissed does not disappear without a trace. Clear it by typing into the pane, clicking it, or pressing `t` in command mode.
 
 Spoken alarms use your browser or system voice today. An optional [managed ElevenLabs voice](https://dormouse.sh/hosted/#voice) is coming for people who want something more natural without managing a separate voice account.
 
diff --git a/vscode-ext/src/message-router.ts b/vscode-ext/src/message-router.ts
index 8cb7523fe..3d283ff78 100644
--- a/vscode-ext/src/message-router.ts
+++ b/vscode-ext/src/message-router.ts
@@ -179,6 +179,8 @@ let nextFlushRequestId = 0;
 /** Tags each router's contribution to the volatile notepad mirror. Per
  *  extension-host lifetime, like the mirror itself (`notepad-volatile.ts`). */
 let nextNotepadRouterId = 0;
+/** Tags each router's engagement viewer in the shared alert manager. */
+let nextViewerId = 0;
 const ALLOWED_WORKBENCH_COMMANDS = new Set<string>(VSCODE_WORKBENCH_COMMANDS);
 
 // Shared alert manager — survives router disposal so alert state persists
@@ -377,6 +379,9 @@ export function attachRouter(
   const reconnect = options?.reconnect ?? false;
   const killOnDispose = options?.killOnDispose ?? false;
   const notepadRouterId = `notepad-router-${++nextNotepadRouterId}`;
+  // This webview is one engagement viewer of the shared manager, so one
+  // webview's blur never touches another's (docs/specs/alert.md → Engagement).
+  const viewerId = `viewer-${++nextViewerId}`;
 
   // The router's only send path — it stamps this webview's message token, which
   // the webview requires (docs/specs/vscode.md → "Webview message
@@ -845,6 +850,10 @@ export function attachRouter(
         // Tear down previous subscriptions first (webview was destroyed and recreated).
         disconnectWebview?.();
         disconnectWebview = connectWebview();
+        // Recreated content is a new realm: the old one's engagement and the
+        // awaits it parked went with it.
+        alertManager.removeViewer(viewerId);
+        cancelAllPendingAwaits();
 
         // Re-publish the currently-selected shell so split-spawns in the
         // freshly-mounted webview know what to use.
@@ -972,15 +981,16 @@ export function attachRouter(
       case 'alert:dismiss':
         alertManager.dismissAlert(msg.id);
         break;
-      case 'alert:attend':
-        alertManager.attend(msg.id);
+      case 'alert:engagement':
+        // `setViewer` revalidates the shape: only a literal `idle` escalates.
+        alertManager.setViewer(viewerId, { present: msg.present, focusId: msg.focusId }, msg.lapse);
+        break;
+      case 'alert:acknowledge':
+        alertManager.acknowledge(msg.id, { input: msg.input === true });
         break;
       case 'alert:resize':
         alertManager.onResize(msg.id);
         break;
-      case 'alert:clearAttention':
-        alertManager.clearAttention(msg.id);
-        break;
       case 'alert:toggleTodo':
         alertManager.toggleTodo(msg.id);
         break;
@@ -1039,6 +1049,7 @@ export function attachRouter(
         if (request.pending.size === 0) request.settle();
       }
       cancelAllPendingAwaits();
+      alertManager.removeViewer(viewerId);
       removeWatchedCommandListener();
       removeAlertSettingsListener();
       resolveAllFlushRequests();
diff --git a/vscode-ext/src/message-types.ts b/vscode-ext/src/message-types.ts
index 69390b101..7787e7871 100644
--- a/vscode-ext/src/message-types.ts
+++ b/vscode-ext/src/message-types.ts
@@ -3,6 +3,7 @@ import type { HelperIdentity, TerminalContextRequest, TerminalContextInfo } from
 import type {
   AwaitOutcome,
   AwaitUntil,
+  EngagementLapse,
 } from '../../lib/src/lib/alert-manager';
 import type { AlertSettings } from '../../lib/src/lib/alert-settings';
 import type { TerminalSemanticEvent } from '../../lib/src/lib/terminal-state';
@@ -67,9 +68,10 @@ export type WebviewMessage =
   | { type: 'alert:initializeSettings'; settings: AlertSettings }
   | { type: 'alert:updateSettings'; settings: AlertSettings }
   | { type: 'alert:dismiss'; id: string }
-  | { type: 'alert:attend'; id: string }
+  // This webview is one engagement viewer (docs/specs/alert.md → Engagement).
+  | { type: 'alert:engagement'; present: boolean; focusId: string | null; lapse?: EngagementLapse }
+  | { type: 'alert:acknowledge'; id: string; input: boolean }
   | { type: 'alert:resize'; id: string }
-  | { type: 'alert:clearAttention'; id?: string }
   | { type: 'alert:toggleTodo'; id: string }
   | { type: 'alert:clearTodo'; id: string }
   // `dor await`: the AlertManager lives here, so the wait is parked in the
diff --git a/vscode-ext/test/message-router.test.ts b/vscode-ext/test/message-router.test.ts
index 11995e7a8..1fdb3755f 100644
--- a/vscode-ext/test/message-router.test.ts
+++ b/vscode-ext/test/message-router.test.ts
@@ -613,3 +613,79 @@ describe('await requests', () => {
     });
   });
 });
+
+/**
+ * Each webview is one engagement viewer of the shared alert manager
+ * (docs/specs/alert.md → Engagement), so what one webview reports can never
+ * disengage a Session another one is showing.
+ */
+describe('engagement viewers', () => {
+  const REPORT = '\x1b]9;needs input\x07';
+
+  function status(id: string): string | undefined {
+    return router.getAlertStates().get(id)?.status;
+  }
+
+  it('keeps one webview blurring from disengaging another', () => {
+    const a = fakeWebview();
+    const b = fakeWebview();
+    const disposeA = router.attachRouter(a.channel);
+    const disposeB = router.attachRouter(b.channel);
+    try {
+      a.send({ type: 'alert:engagement', present: true, focusId: 'pty-a' });
+      b.send({ type: 'alert:engagement', present: true, focusId: 'pty-b' });
+      a.send({ type: 'alert:engagement', present: false, focusId: null, lapse: 'leave' });
+
+      ptys.callbacks!.onData('pty-b', REPORT);
+      expect(status('pty-b')).not.toBe('ALERT_RINGING');
+    } finally {
+      disposeA.dispose();
+      disposeB.dispose();
+    }
+  });
+
+  it('acknowledges for the webview that sent it', () => {
+    const webview = fakeWebview();
+    const disposable = router.attachRouter(webview.channel);
+    try {
+      ptys.callbacks!.onData('pty-ack', REPORT);
+      expect(status('pty-ack')).toBe('ALERT_RINGING');
+      webview.send({ type: 'alert:acknowledge', id: 'pty-ack', input: false });
+      expect(router.getAlertStates().get('pty-ack')).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
+    } finally {
+      disposable.dispose();
+    }
+  });
+
+  it('stops engaging anything once its webview is disposed', () => {
+    const webview = fakeWebview();
+    const disposable = router.attachRouter(webview.channel);
+    webview.send({ type: 'alert:engagement', present: true, focusId: 'pty-gone' });
+    disposable.dispose();
+
+    ptys.callbacks!.onData('pty-gone', REPORT);
+    expect(status('pty-gone')).toBe('ALERT_RINGING');
+  });
+
+  it('treats recreated webview content as a new realm', async () => {
+    const webview = fakeWebview();
+    const disposable = router.attachRouter(webview.channel);
+    try {
+      webview.send({ type: 'dormouse:init' });
+      webview.send({ type: 'alert:engagement', present: true, focusId: 'pty-init' });
+      webview.send({ type: 'alert:await', requestId: 'await-init', id: 'pty-init', until: 'exit', timeoutMs: 600_000 });
+
+      // The content was destroyed and rebuilt; the old one's engagement and
+      // parked awaits went with it.
+      webview.send({ type: 'dormouse:init' });
+      await Promise.resolve();
+      expect(webview.posted).toContainEqual(expect.objectContaining({
+        type: 'alert:awaitResult', requestId: 'await-init', outcome: expect.objectContaining({ kind: 'cancelled' }),
+      }));
+      ptys.callbacks!.onData('pty-init', REPORT);
+      expect(status('pty-init')).toBe('ALERT_RINGING');
+    } finally {
+      disposable.dispose();
+    }
+  });
+});
diff --git a/website/src/lib/__snapshots__/tut-runner.test.ts.snap b/website/src/lib/__snapshots__/tut-runner.test.ts.snap
index e41e67974..feccefb4c 100644
--- a/website/src/lib/__snapshots__/tut-runner.test.ts.snap
+++ b/website/src/lib/__snapshots__/tut-runner.test.ts.snap
@@ -70,14 +70,15 @@ exports[`TutRunner snapshots > renders the alert section with all items incomple
    ·  The rule covers every pane running that command
    ·  It rings when the command goes quiet
    ·  Dismissing a ringing alert leaves a TODO behind
-   ·  Press Enter inside the pane to clear the TODO
+   ·  Type anything inside the pane to clear the TODO
    ·  Add a TODO by hand
    ·  A program can ring on its own
    ·  A long command that finished while you were away
 
   Three different things can make a pane ring: a rule you set on a command name,
   a notification the program sends, and a long command finishing while you were
-  elsewhere. None of them ring while you are actually looking at the pane.
+  elsewhere. None of them ring while you are looking at the pane — they wait
+  until you go idle.
 
   Press s to start a fake longtask.
   Press n for a program that rings on its own.
diff --git a/website/src/lib/tut-items.ts b/website/src/lib/tut-items.ts
index 9c2e37f0c..c53380279 100644
--- a/website/src/lib/tut-items.ts
+++ b/website/src/lib/tut-items.ts
@@ -210,16 +210,16 @@ export const DESKTOP_SECTIONS: readonly Section[] = [
         id: 'al-ring',
         title: 'It rings when the command goes quiet',
         hint:
-          `Don't type! If you type, Dormouse will think you are paying attention to this task and the pane will not ring. It waits until you attend another pane or stop interacting for the inactivity timeout in Alarm settings.`,
+          `It rings when the command goes quiet, unless you are looking at that pane. The pane you are typing in or clicked into counts as looked at while you keep using Dormouse; stop for the inactivity timeout in Alarm settings and it rings.`,
       },
       {
         id: 'al-todo-auto',
         title: 'Dismissing a ringing alert leaves a TODO behind',
-        hint: 'Interact with the pane, or press `a`, to dismiss. The TODO is there so a ring you waved away does not vanish without a trace.',
+        hint: 'Click the pane, or press `a`, to dismiss. The TODO is there so a ring you waved away does not vanish without a trace.',
       },
       {
         id: 'al-todo-clear',
-        title: 'Press `Enter` inside the pane to clear the TODO',
+        title: 'Type anything inside the pane to clear the TODO',
       },
       {
         id: 'al-todo-manual',
@@ -239,7 +239,7 @@ export const DESKTOP_SECTIONS: readonly Section[] = [
       },
     ],
     prose: [
-      'Three different things can make a pane ring: a rule you set on a command name, a notification the program sends, and a long command finishing while you were elsewhere. None of them ring while you are actually looking at the pane.',
+      'Three different things can make a pane ring: a rule you set on a command name, a notification the program sends, and a long command finishing while you were elsewhere. None of them ring while you are looking at the pane — they wait until you go idle.',
     ],
   },
   COPY_PASTE_SECTION,
diff --git a/website/src/lib/tut-runner.test.ts b/website/src/lib/tut-runner.test.ts
index eb04fbee7..5b3ed671c 100644
--- a/website/src/lib/tut-runner.test.ts
+++ b/website/src/lib/tut-runner.test.ts
@@ -129,8 +129,9 @@ describe("TutRunner snapshots", () => {
       onTriggerCommandExitDemo: (duration) => {
         durationMs = duration;
         adapter.sendOutput(demoId, "\x1b]633;E;slowbuild\x07\x1b]633;C\x07");
-        adapter.alertAttend(demoId);
-        adapter.alertClearAttention(demoId);
+        // The user clicks into the demo pane, then back to the tutorial.
+        adapter.alertEngagement({ present: true, focusId: demoId });
+        adapter.alertEngagement({ present: true, focusId: "test-pane" });
         finishTimer = setTimeout(() => adapter.sendOutput(demoId, "\x1b]633;D;0\x07"), duration);
       },
     });
diff --git a/website/src/lib/tut-runner.ts b/website/src/lib/tut-runner.ts
index 003dac843..6a2ae10b2 100644
--- a/website/src/lib/tut-runner.ts
+++ b/website/src/lib/tut-runner.ts
@@ -21,7 +21,7 @@ import {
 import type { TutorialState } from "./tutorial-state";
 
 /** Snapshot each launch: both the countdown and the fake command use this
- *  duration. The floor keeps a shortened attention setting from ending output
+ *  duration. The floor keeps a shortened inactivity setting from ending output
  *  before the WATCHING detector can confirm BUSY. */
 function getDemoDurationMs(inactivityTimeoutMs: number): number {
   return Math.max(
diff --git a/website/src/pages/PlaygroundDesktop.tsx b/website/src/pages/PlaygroundDesktop.tsx
index effc82c12..95e7a8070 100644
--- a/website/src/pages/PlaygroundDesktop.tsx
+++ b/website/src/pages/PlaygroundDesktop.tsx
@@ -228,7 +228,7 @@ function PlaygroundDesktopExperience() {
                 );
               },
               // An unwatched command, so its exit, not WATCHING, raises the ring:
-              // the user attends the pane, leaves, and the exit rings.
+              // the user clicks into the pane, clicks away, and the exit rings.
               onTriggerCommandExitDemo: (durationMs) => {
                 if (commandExitDemoFinishTimerRef.current !== null) {
                   window.clearTimeout(commandExitDemoFinishTimerRef.current);

From ea418ce9b912db6bce1b2e4985d0dbb658abc785 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 23 Sep 2026 19:47:22 -0700
Subject: [PATCH 06/16] Acknowledge only at human gestures, and write user
 input atomically
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Entering passthrough no longer acknowledges on its own: pane clicks,
  zoom, the dev-server chip, Doors, and keyboard Enter acknowledge at their
  handlers, so spawns, splits, promotions, `dor` reveals and a raw frame
  taking focus can never clear a ring.
- User input is one `writePty(…, { userInput })`: the host clears the
  ring and TODO and opens the echo window before writing (one message per
  keystroke in VS Code). Mobile input uses the same helper.
- Rings and held completions share one source-set shape and one
  hold-or-deliver path; viewers store only present focus.
- Shared window-focus source, ref-counted engagement reporter, one VS Code
  realm teardown, `inactivityTimeout` naming, shared test utilities.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwN55bUVmCNmPiX7vHGCVF
---
 docs/specs/alert.md                           |  33 +-
 docs/specs/dor-browser.md                     |   7 +-
 docs/specs/layout.md                          |   2 +-
 docs/specs/mobile-terminal-ui.md              |   8 +-
 docs/specs/vscode.md                          |   2 +-
 lib/src/cfg.ts                                |   2 +-
 lib/src/components/MobileTerminalUi.test.tsx  |  33 +-
 lib/src/components/MobileTerminalUi.tsx       |  18 +-
 lib/src/components/Wall.test.tsx              | 135 +++++-
 lib/src/components/Wall.tsx                   |  56 ++-
 .../components/mobile-acknowledge.test.tsx    |  65 +--
 lib/src/components/wall/IframePanel.test.tsx  |  15 +-
 lib/src/components/wall/IframePanel.tsx       |   3 +-
 lib/src/components/wall/TerminalPanel.tsx     |   9 +-
 .../keyboard/handle-pane-shortcuts.test.ts    |  25 +-
 .../wall/keyboard/handle-pane-shortcuts.ts    |   8 +-
 .../components/wall/use-engagement-focus.ts   |   4 +-
 lib/src/components/wall/use-window-focused.ts |  18 +-
 lib/src/components/wall/wall-context.tsx      |   8 +
 lib/src/components/wall/wall-test-utils.ts    |  27 ++
 lib/src/lib/alert-engagement.test.ts          | 113 ++----
 lib/src/lib/alert-manager-test-utils.ts       |  81 ++++
 lib/src/lib/alert-manager.test.ts             | 384 ++++++++----------
 lib/src/lib/alert-manager.ts                  | 272 +++++++------
 lib/src/lib/alert-resumed-output.test.ts      |  67 +--
 lib/src/lib/alert-runtime-transfer.test.ts    |  24 +-
 lib/src/lib/alert-settings-model.ts           |   2 +-
 lib/src/lib/alert-settings.test.ts            |   2 +-
 lib/src/lib/engagement.test.ts                |  18 +-
 lib/src/lib/engagement.ts                     |  62 ++-
 lib/src/lib/platform/fake-adapter.ts          |  14 +-
 lib/src/lib/platform/types.ts                 |   7 +-
 lib/src/lib/platform/vscode-adapter.ts        |   8 +-
 lib/src/lib/presence.test.ts                  |   6 +-
 lib/src/lib/presence.ts                       |  46 +--
 lib/src/lib/session-activity-store.ts         |  12 +-
 .../lib/terminal-lifecycle.release.test.ts    |  31 +-
 lib/src/lib/terminal-lifecycle.ts             |  11 +-
 lib/src/lib/terminal-registry.alert.test.ts   | 124 +-----
 lib/src/lib/terminal-registry.ts              |   1 -
 lib/src/lib/window-focus.ts                   |  18 +
 lib/src/lib/xterm-test-mock.ts                |  92 +++++
 lib/src/remote/pocket-app/PocketWall.tsx      |   6 +-
 .../stories/BrowserChromeHeader.stories.tsx   |   1 +
 lib/src/stories/MobileTerminalUi.stories.tsx  |   3 +-
 lib/src/stories/MouseHeaderIcon.stories.tsx   |   1 +
 lib/src/stories/ShellCwd.stories.tsx          |   1 +
 .../stories/TerminalPaneHeader.stories.tsx    |   1 +
 lib/tsconfig.app.json                         |   4 +-
 .../src/browser-sidecar-adapter.test.ts       |  14 +
 standalone/src/browser-sidecar-adapter.ts     |   8 +-
 standalone/src/tauri-adapter.test.ts          |  22 +
 standalone/src/tauri-adapter.ts               |   9 +-
 vscode-ext/src/message-router.ts              |  45 +-
 vscode-ext/src/message-types.ts               |   7 +-
 vscode-ext/test/message-router.test.ts        |  36 +-
 .../components/PocketTerminalExperience.tsx   |   3 +-
 website/src/lib/tut-runner.ts                 |   2 +-
 58 files changed, 1093 insertions(+), 943 deletions(-)
 create mode 100644 lib/src/lib/alert-manager-test-utils.ts
 create mode 100644 lib/src/lib/window-focus.ts
 create mode 100644 lib/src/lib/xterm-test-mock.ts

diff --git a/docs/specs/alert.md b/docs/specs/alert.md
index c0af0ddbd..f18e3af89 100644
--- a/docs/specs/alert.md
+++ b/docs/specs/alert.md
@@ -59,20 +59,21 @@ Three separate signals, never one lease (rationale):
 **A Session is engaged while some present viewer focuses it**, and engagement alone decides holding over ringing.
 
 - **Must compute presence in the renderer and report transitions only**: an input event only stamps a time, and the host keeps no presence timer. **An end of presence names its lapse** — `idle` when the timeout ran out, `leave` on a window blur or hide. **A blur is a leave only when `document.hasFocus()` is false** (`docs/specs/layout.md` → Corner cases #2). Focus or visibility returning counts as input.
-- **Must keep engagement per viewer**, deduped at the renderer, so one viewer's leave never disengages a Session another viewer engages. VS Code gives each webview its own viewer (`docs/specs/vscode.md`); a standalone window and the fake adapter are their local manager's one viewer. The mobile composition only acknowledges.
+- **Must keep engagement per viewer**, deduped at the renderer, so one viewer's leave never disengages a Session another viewer engages. **An absent viewer reports no focus change.** VS Code gives each webview its own viewer (`docs/specs/vscode.md`); any other manager has one, `LOCAL_VIEWER`.
 
 | Gesture | Acknowledges |
 |---|---|
 | typing into the pane (CSI/SS3 key encodings included), a paste, a file drop, the mobile input bar or a gesture key | with input |
-| a Pane body or header click, entering passthrough by keyboard, a Door click or `Enter`, a mobile tap | without input |
-| a terminal reply, a mouse-only report chunk, `d` reattach, a `dor` reveal, an embed focusing itself, DOM focus alone | nothing |
+| a Pane body or header click, zoom, the dev-server chip, entering passthrough by keyboard, a Door click or `Enter`, a mobile tap | without input |
+| a terminal reply, a mouse-only report chunk, `d` reattach, a spawn, split, or promotion, a `dor` reveal, an embed focusing itself, DOM focus alone | nothing |
 
+- **Must acknowledge at each gesture's handler, never in the passthrough entry the silent paths share.**
 - **Never treat terminal replies or mouse-only report chunks as keyboard input** (rationale).
-- **Must acknowledge every human-originated PTY write before writing it**: `writeUserInput` for keys, pastes, and drops; `MobileTerminalUi` for its own input bar and gestures.
-- **Never create an Activity entry to acknowledge**: a browser Surface has none, and keeps its own TODO.
-- **Input opens the echo window** (`cfg.alert.echoWindow`). Output inside it is ignored entirely — detector, `outputSince`, the acknowledged state, awaits — and a completion inside it neither rings nor is held (rationale).
+- **Must write all human-originated PTY input through `writeUserInput`**, the mobile input bar's included: it carries `userInput`, and the host acknowledges it with input before writing it, in the one message.
+- **Never create an Activity entry to acknowledge**, the host's one check, so a browser Surface keeps its own TODO.
+- **User input opens the echo window** (`cfg.alert.echoWindow`) even when acknowledging clears nothing, a helper's included. Output inside it is ignored entirely — detector, `outputSince`, the acknowledged state, awaits — and a completion inside it neither rings nor is held (rationale).
 
-Source of truth: `setViewer` / `acknowledge` in `lib/src/lib/alert-manager.ts`; `createPresenceTracker` in `lib/src/lib/presence.ts`; `retainEngagementReporter` in `lib/src/lib/engagement.ts`, fed by `useEngagementFocus` in `lib/src/components/wall/use-engagement-focus.ts`; `writeUserInput` in `lib/src/lib/terminal-lifecycle.ts`; `acknowledgeSession` in `lib/src/lib/session-activity-store.ts`. Pinned by `lib/src/lib/alert-engagement.test.ts`, `lib/src/lib/presence.test.ts`, `lib/src/lib/engagement.test.ts`, `lib/src/lib/terminal-registry.alert.test.ts`, `lib/src/components/mobile-acknowledge.test.tsx`, and `engagement` in `lib/src/components/Wall.test.tsx`.
+Source of truth: `setViewer` / `acknowledge` in `lib/src/lib/alert-manager.ts`; `createPresenceTracker` in `lib/src/lib/presence.ts`; `retainEngagementReporter` in `lib/src/lib/engagement.ts`; `writeUserInput` in `lib/src/lib/terminal-lifecycle.ts`. Pinned by `lib/src/lib/alert-engagement.test.ts`.
 
 ## Completion events
 
@@ -80,16 +81,7 @@ Every completion — a detector settle, a command finish, a direct notification,
 
 Claimants get first refusal per Session in registration order; the first to return `true` claims the event and the rest are not offered it. **A claimed event never rings, never sets TODO, and never stores an `ActivityNotification`** — it stops before the ring rules, where the echo window, holding, and the command-exit seen and minimum-runtime checks live.
 
-**Must hold a completion that would ring an engaged Session**: the sources it would raise and the richest detail (Clearing And TODO), repeated holds merging, never public. A deferred report that comes due while engaged is held too. How engagement ends decides the rest (rationale):
-
-| Released by | What was held |
-|---|---|
-| an acknowledgement, or any user verb that clears a ring | dropped, as acknowledged |
-| focus moving away, or the viewer leaving (blur, hide, removal) | dropped |
-| presence lapsing `idle` with focus unchanged | rings: a report through the acknowledged check and deferral, a settle or exit directly |
-| live-transfer suspension, seeding, removal, teardown | dropped |
-
-**Dropping on an explicit disengage may be a mistake** (rationale). Resumed watched work and rule removal withdraw a held `watching` source as they withdraw a ringing one (WATCHING Track).
+**Must hold a completion that would ring an engaged Session**: the sources it would raise and the richest detail (Clearing And TODO), repeated holds merging, never public. A deferred report that comes due while engaged is held too. **Presence lapsing `idle` with focus unchanged rings what was held**, each source by its unengaged path; any other end drops it — a user verb (Clearing And TODO), focus moving away, the viewer leaving, live-transfer suspension, seeding, removal, or teardown (rationale). **Dropping on an explicit disengage may be a mistake** (rationale). Resumed watched work and rule removal withdraw a held `watching` source as they withdraw a ringing one (WATCHING Track).
 
 With `deferAlertsUntilQuiet` enabled:
 
@@ -106,7 +98,7 @@ Two ordering rules:
 - **Clear the progress cycle *before* dispatch**, so a completion or error ends the cycle whether or not the event is claimed and `OSC_NOTIF_BUSY` falls back either way.
 - **Dispatch a command finish for every watch that existed**, including the short, unseen, and engaged ones the ring rule then discards or holds.
 
-Source of truth: `registerCompletionClaimant` / `dispatchCompletion` / `deferOrDeliverNotification` / `scheduleDeferredNotification` / `flushDeferredNotification` / `escalateHeld` in `lib/src/lib/alert-manager.ts`; `quietAt` in `lib/src/lib/quiesce-detector.ts`. Pinned by `held completions` in `lib/src/lib/alert-engagement.test.ts`.
+Source of truth: `registerCompletionClaimant` / `dispatchCompletion` / `holdOrDeliver` / `deferOrDeliverNotification` / `scheduleDeferredNotification` / `flushDeferredNotification` / `escalateHeld` in `lib/src/lib/alert-manager.ts`; `quietAt` in `lib/src/lib/quiesce-detector.ts`. Pinned by `held completions` in `lib/src/lib/alert-engagement.test.ts`.
 
 ## Await
 
@@ -268,10 +260,9 @@ Source of truth: `dispatchCompletion` / `setViewer` / `formatCommandExitBody` in
 | Verb | Effect |
 |---|---|
 | acknowledge without input (Engagement) | clears the ring; `todo` stays |
-| acknowledge with input — any keystroke, paste, or drop | clears the ring; `todo` off, notification dropped |
+| acknowledge with input — any keystroke, paste, or drop — or clear TODO (pill click) | clears the ring; `todo` off, notification dropped, even if already off |
 | dismiss (`a`, Pane Header) | clears the ring; `todo` stays. **With nothing ringing: no change, no notify, a deferred notification kept** |
 | toggle TODO (`t`) | clears the ring; `todo` flips, off dropping the notification |
-| clear TODO (pill click) | clears the ring; `todo` off, notification dropped, even if already off |
 | an await consumes a source (Await) | withdraws that source |
 | watched work resumes (WATCHING Track) | withdraws `watching` |
 | a rule stops covering the `watching` key | withdraws `watching` |
@@ -440,7 +431,7 @@ A Door is display-only for alert state:
 - do not expose a Door-specific alert menu
 - scrolled out of view, its overflow arrow carries its ring and TODO (`docs/specs/layout.md` → Baseboard responsive sizing)
 
-Click or `Enter` on a Door reattaches into passthrough and clears a ring; `d` reattaches in command mode and leaves the ring intact (Engagement).
+Reattaching by click or `Enter` acknowledges; `d` does not (Engagement).
 
 ## Text And Security
 
diff --git a/docs/specs/dor-browser.md b/docs/specs/dor-browser.md
index 35f29bb00..7aaf3cbba 100644
--- a/docs/specs/dor-browser.md
+++ b/docs/specs/dor-browser.md
@@ -501,8 +501,9 @@ Source of truth: `lib/src/host/iframe-proxy-rewrite.ts` (`iframeShim`),
 
 - Cross-origin iframe focus blurs the parent window while `document.hasFocus()`
   remains true; **focus code must distinguish this from app backgrounding**.
-- Proxied frames adopt clicks from shim `pointerdown`; the raw fallback uses the
-  older `window.blur` + active iframe heuristic.
+- Proxied frames adopt clicks from shim `pointerdown`; the raw fallback adopts
+  focus alone, acknowledging nothing, by the older `window.blur` + active iframe
+  heuristic.
 - **`IframePanel` must apply `transform: translateZ(0)` to its immediate
   container**, or Chromium offsets out-of-process iframe pointer events from a
   far-away compositing ancestor.
@@ -511,7 +512,7 @@ Source of truth: `lib/src/host/iframe-proxy-rewrite.ts` (`iframeShim`),
 - **The `allow` attribute grants no device or clipboard-read permission** —
   `autoplay`, `clipboard-write`, `fullscreen` only. (rationale)
 
-Source of truth: `lib/src/components/wall/IframePanel.tsx`, `lib/src/components/wall/use-window-focused.ts`,
+Source of truth: `lib/src/components/wall/IframePanel.tsx`, `subscribeWindowFocus` in `lib/src/lib/window-focus.ts`,
 `lib/src/lib/terminal-lifecycle.ts` (`registerSurfaceFocusHandle`, which
 focuses/blurs the iframe element like other surfaces).
 
diff --git a/docs/specs/layout.md b/docs/specs/layout.md
index acc604662..32c999a24 100644
--- a/docs/specs/layout.md
+++ b/docs/specs/layout.md
@@ -537,7 +537,7 @@ A store commit that empties the tree (last pane killed or minimized) triggers th
 
 > Numbered for cross-spec reference; the numbers are stable, so append rather than renumber and leave a retired one retired.
 
-- **#2 — A focused iframe surface is not a window blur**: it blurs the window while `document.hasFocus()` stays true, so **presence ends only on a *real* blur** (`docs/specs/alert.md` → Engagement) — otherwise focusing an embed would end it across the window.
+- **#2 — A focused iframe surface is not a window blur**: it blurs the window while `document.hasFocus()` stays true, so **presence ends only on a *real* blur** (`docs/specs/alert.md` → Engagement) — otherwise focusing an embed would end it across the window. Source of truth: `subscribeWindowFocus` in `lib/src/lib/window-focus.ts`.
 - **#6 — Focus-neutral surface creation (`dor ensure` / `dor iframe` / `dor ab`)**: unlike `dor split`, these open in the background without moving focus off the caller (`docs/specs/dor-cli.md`, `docs/specs/dor-browser.md`). An add never re-parents the caller's subtree or steals activation, and the create does not call `selectPane` (`settleAddSelection` returns false for a focus-neutral, non-selection-replacing add). **The one exception**: `dor iframe` / `dor ab` replacing the pane the user is *currently selected on* moves selection to the replacement, else it would dangle on the removed leaf; any other pane, or a door selection, is left untouched. Cleanup of a `dor ensure` temporary Surface follows `docs/specs/notepad.md` → "Closure"; any completed teardown preserves the caller's live selection.
 
 ## Future
diff --git a/docs/specs/mobile-terminal-ui.md b/docs/specs/mobile-terminal-ui.md
index 1bba9a5fb..b6bd11ecc 100644
--- a/docs/specs/mobile-terminal-ui.md
+++ b/docs/specs/mobile-terminal-ui.md
@@ -42,10 +42,10 @@ Chrome rules:
   radius. Order: title, secondary detail, TODO pill, minimize, kill (suppressed
   by `showKillButton={false}`, as Pocket does). Both consumers wire minimize to
   the Sessions reserve, not a desktop Door. A ring shows as the alarm inset on
-  the bar and on its session-list row. **`MobileTerminalUi` acknowledges the
-  active Session itself** — a touch in the host's capture phase, before any
-  touch mode consumes it, and each input-bar or gesture key with input — since
-  its writes bypass xterm (`docs/specs/alert.md` -> Engagement).
+  the bar and on its session-list row. **A touch acknowledges the active
+  Session in `MobileTerminalUi`'s capture phase**, before any touch mode
+  consumes it; both consumers route its input bar and gesture keys through
+  `writeUserInput` (`docs/specs/alert.md` -> Engagement).
 * **Must install `useDynamicPalette` in `MobileTerminalUi`** for gesture tokens;
   it never mounts the desktop `Wall`. `docs/specs/theme.md` owns publication
   and the CSS baselines available before the effect runs.
diff --git a/docs/specs/vscode.md b/docs/specs/vscode.md
index c04ca90c9..463b35c2f 100644
--- a/docs/specs/vscode.md
+++ b/docs/specs/vscode.md
@@ -28,7 +28,7 @@ The webview is the shared `lib/` frontend, unmodified for this host (`docs/specs
 
 - **Capture, then save, then kill.** `deactivate()` runs the agent-recovery capture *first* and both kills *last*, the state flush and live-PTY refresh in between. Source of truth: `deactivate()` in `vscode-ext/src/extension.ts`.
 - **Alert state is global.** One module-level `AlertManager` in `message-router.ts` is shared across all routers, survives router disposal, and is fed by PTY data regardless of webview visibility.
-- **Each router is one engagement viewer** of it (`docs/specs/alert.md` → Engagement), set by `alert:engagement`. **Must remove the viewer on router disposal and on a `dormouse:init` re-init**, which also cancels that router's parked awaits: recreated content is a new realm. Pinned by `engagement viewers` in `vscode-ext/test/message-router.test.ts`.
+- **Each router is one engagement viewer** of it (`docs/specs/alert.md` → Engagement), set by `alert:engagement`. **Must remove the viewer on router disposal and on a `dormouse:init` re-init**, which also cancels that router's parked awaits: recreated content is a new realm (`endRealm` in `vscode-ext/src/message-router.ts`). Pinned by `engagement viewers` in `vscode-ext/test/message-router.test.ts`.
 - **WATCHING rules are host-authoritative.** The first webview after extension-host startup seeds the shared host rule set and **no later webview may replace it**.
 - **Never let a resuming router steal another webview's PTYs.** Each router tracks its PTYs in `ownedPtyIds`; a module-level `globalOwnedPtyIds` set enforces it.
 - **Every save path must merge current alert states through the shared persistence projection.** The frontend periodic save (`onSaveState`) and the backend deactivate refresh (`refreshSavedSessionStateFromPtys`) both narrow alerts with `toPersistedAlertState`; missing the merge reverts alert state on restore, while passing live state through persists transient fields.
diff --git a/lib/src/cfg.ts b/lib/src/cfg.ts
index 164555b24..2ff42ad6f 100644
--- a/lib/src/cfg.ts
+++ b/lib/src/cfg.ts
@@ -25,7 +25,7 @@ export const cfg = {
     /** ms — ignore resize redraw noise. */
     resizeDebounce: 500,
     /** ms — default inactivity timeout: presence lapses this long after the last typing, mouse, or scroll input. */
-    userAttention: 15_000,
+    inactivityTimeout: 15_000,
     /** ms — output and completions this soon after a keystroke into a Session answer that keystroke and are ignored. */
     echoWindow: 250,
     /** ms — shortest run a command-exit ring reports; anything quicker was probably watched. */
diff --git a/lib/src/components/MobileTerminalUi.test.tsx b/lib/src/components/MobileTerminalUi.test.tsx
index 991931e21..d1346f8d7 100644
--- a/lib/src/components/MobileTerminalUi.test.tsx
+++ b/lib/src/components/MobileTerminalUi.test.tsx
@@ -6,43 +6,12 @@ import { createRoot, type Root } from 'react-dom/client';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { MobileTerminalUi, paneMouseOverride, type MobileTerminalSessionItem, type MobileTerminalTouchMode, type MobileTerminalUiProps } from './MobileTerminalUi';
 import { setNativeFieldValue } from '../lib/dom';
+import { pointerEvent } from './wall/wall-test-utils';
 
 const EPISODE = { id: 'episode-1', startedAt: Date.now() };
 
 globalThis.IS_REACT_ACT_ENVIRONMENT = true;
 
-function pointerEvent(
-  type: string,
-  overrides: Partial<PointerEvent> = {},
-): PointerEvent {
-  const event = new Event(type, { bubbles: true, cancelable: true }) as PointerEvent;
-  const values: Partial<PointerEvent> = {
-    pointerId: 7,
-    pointerType: 'touch',
-    isPrimary: true,
-    button: 0,
-    buttons: type === 'pointerup' || type === 'pointercancel' ? 0 : 1,
-    clientX: 10,
-    clientY: 12,
-    screenX: 110,
-    screenY: 112,
-    ctrlKey: false,
-    shiftKey: false,
-    altKey: false,
-    metaKey: false,
-    ...overrides,
-  };
-
-  for (const [key, value] of Object.entries(values)) {
-    Object.defineProperty(event, key, {
-      configurable: true,
-      get: () => value,
-    });
-  }
-
-  return event;
-}
-
 function renderMobileTerminal({
   touchMode,
   onMouseEvent,
diff --git a/lib/src/components/MobileTerminalUi.tsx b/lib/src/components/MobileTerminalUi.tsx
index d6bc15d0e..78f042dd8 100644
--- a/lib/src/components/MobileTerminalUi.tsx
+++ b/lib/src/components/MobileTerminalUi.tsx
@@ -514,19 +514,11 @@ export function MobileTerminalUi({
   const [gestureState, setGestureState] = useState<MobileGestureTrackingState>(MOBILE_GESTURE_IDLE_STATE);
   const [pendingGestureConfirmation, setPendingGestureConfirmation] = useState<MobileGestureConfirmationAction | null>(null);
   const [inputValue, setInputValue] = useState('');
-  // The composition's own input bar and gestures write around xterm, so it
-  // acknowledges the Session they reach itself (`docs/specs/alert.md` ->
-  // Engagement): a keystroke with input, a touch without.
-  const activeSessionId = sessions.find((session) => session.active)?.id ?? null;
-  const acknowledgeActive = useCallback((input: boolean) => {
-    if (activeSessionId !== null) acknowledgeSession(activeSessionId, input);
-  }, [activeSessionId]);
 
   const sendInput = useCallback((data: string) => {
     if (!interactive || data.length === 0) return;
-    acknowledgeActive(true);
     onSendInput?.(data);
-  }, [acknowledgeActive, interactive, onSendInput]);
+  }, [interactive, onSendInput]);
 
   const commitGestureState = useCallback((nextState: MobileGestureTrackingState) => {
     gestureStateRef.current = nextState;
@@ -722,8 +714,10 @@ export function MobileTerminalUi({
 
   const handlePanePointerDownCapture = useCallback((event: PointerEvent<HTMLDivElement>) => {
     if (isGestureDialogTarget(event.target)) return;
-    // Capture on the host runs before any mode below consumes the touch.
-    if (interactive) acknowledgeActive(false);
+    // A tap acknowledges the active Session (`docs/specs/alert.md` ->
+    // Engagement); capture on the host runs before any mode below consumes it.
+    const active = interactive ? sessions.find((session) => session.active) : undefined;
+    if (active) acknowledgeSession(active.id);
     blurPaneTextInputs();
     if (interactive && touchMode === 'cursor' && isTouchLikePrimaryPointer(event)) {
       event.preventDefault();
@@ -749,7 +743,7 @@ export function MobileTerminalUi({
       origin,
       displayOriginAwayFromThumb(origin, event.currentTarget.getBoundingClientRect()),
     ));
-  }, [acknowledgeActive, blurPaneTextInputs, clearGestureCompletionTimer, commitGestureState, interactive, touchMode]);
+  }, [blurPaneTextInputs, clearGestureCompletionTimer, commitGestureState, interactive, sessions, touchMode]);
 
   const handlePanePointerMoveCapture = useCallback((event: PointerEvent<HTMLDivElement>) => {
     if (touchMode === 'cursor' && cursorPointerIdRef.current === event.pointerId && isTouchLikePrimaryPointer(event)) {
diff --git a/lib/src/components/Wall.test.tsx b/lib/src/components/Wall.test.tsx
index d5cc6e144..c86e417a2 100644
--- a/lib/src/components/Wall.test.tsx
+++ b/lib/src/components/Wall.test.tsx
@@ -14,6 +14,7 @@ import { sessionForKey } from 'dor-lib-common/agent-browser';
 import { Wall } from './Wall';
 import * as helpers from '../lib/helper-terminal';
 import { getAgentBrowserScreenController } from './wall/agent-browser-screen';
+import { setDevServerResolution } from './wall/agent-browser-ports';
 import { setPlatform } from '../lib/platform';
 import { FakePtyAdapter } from '../lib/platform/fake-adapter';
 import type { PlatformAdapter } from '../lib/platform/types';
@@ -3808,6 +3809,15 @@ describe('engagement', () => {
     return (report.mock.calls.at(-1)?.[0] as { focusId: string | null } | undefined)?.focusId;
   }
 
+  /** A human at the window: the reporter sends focus only while present. */
+  async function present(): Promise<void> {
+    await act(async () => { window.dispatchEvent(new Event('pointermove')); });
+  }
+
+  async function key(name: string): Promise<void> {
+    await act(async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: name, bubbles: true })); });
+  }
+
   async function commandMode(): Promise<void> {
     await act(async () => {
       window.dispatchEvent(new KeyboardEvent('keydown', { key: 'Shift', location: 1, bubbles: true }));
@@ -3815,10 +3825,15 @@ describe('engagement', () => {
     });
   }
 
+  beforeEach(() => {
+    vi.spyOn(document, 'hasFocus').mockReturnValue(true);
+  });
+
   it('points at the passthrough pane, and at nothing from command mode or a Door', async () => {
     const report = vi.spyOn(fake, 'alertEngagement');
     await act(async () => root.render(<Wall initialPaneIds={['pane-a', 'pane-b']} initialMode="passthrough" />));
     await flush();
+    await present();
     expect(reportedFocus(report)).toBe('pane-a');
 
     await commandMode();
@@ -3830,9 +3845,9 @@ describe('engagement', () => {
     });
     expect(reportedFocus(report)).toBe('pane-b');
 
-    await act(async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: 'm', bubbles: true })); });
+    await key('m');
     await commandMode();
-    await act(async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: 'm', bubbles: true })); });
+    await key('m');
     await flush();
     expect(container.querySelector('[data-door-id="pane-b"]')).not.toBeNull();
     expect(reportedFocus(report)).toBeNull();
@@ -3842,7 +3857,8 @@ describe('engagement', () => {
     const report = vi.spyOn(fake, 'alertEngagement');
     await act(async () => root.render(<Wall initialPaneIds={['pane-a']} initialMode="command" />));
     await flush();
-    expect(reportedFocus(report)).toBeUndefined();
+    await present();
+    expect(reportedFocus(report)).toBeNull();
 
     const header = container.querySelector<HTMLElement>('[data-pane-header-for="pane-a"]')!;
     await act(async () => { header.dispatchEvent(new MouseEvent('contextmenu', { bubbles: true, cancelable: true, clientX: 120, clientY: 90 })); });
@@ -3858,7 +3874,7 @@ describe('engagement', () => {
         leafMeta: {
           'browser-a': {
             component: 'browser',
-            tabComponent: 'browser',
+            tabComponent: 'surface',
             title: 'example.com',
             params: { surfaceType: 'browser', renderMode: 'iframe', url: 'https://example.com' },
           },
@@ -3867,14 +3883,16 @@ describe('engagement', () => {
       initialMode="passthrough"
     />));
     await flush();
-    expect(reportedFocus(report) ?? null).toBeNull();
+    await present();
+    expect(reportedFocus(report)).toBeNull();
   });
 
   it('points at nothing from a hidden Workspace', async () => {
     const report = vi.spyOn(fake, 'alertEngagement');
     await act(async () => root.render(<Wall initialPaneIds={['pane-a']} initialMode="passthrough" active={false} />));
     await flush();
-    expect(reportedFocus(report) ?? null).toBeNull();
+    await present();
+    expect(reportedFocus(report)).toBeNull();
   });
 
   it('acknowledges a click on a pane and a Door, but not a `d` reattach', async () => {
@@ -3887,25 +3905,121 @@ describe('engagement', () => {
     await act(async () => {
       container.querySelector('[data-session-id="pane-a"]')!.dispatchEvent(new MouseEvent('mousedown', { bubbles: true }));
     });
-    expect(acknowledge.mock.calls).toEqual([['pane-a', false]]);
+    expect(acknowledge.mock.calls).toEqual([['pane-a']]);
 
     await act(async () => { container.querySelector<HTMLElement>('[data-door-id="door-a"] button')!.click(); });
     await flush();
     expect(container.querySelector('[data-lath-leaf="door-a"]')).not.toBeNull();
-    expect(acknowledge.mock.calls.at(-1)).toEqual(['door-a', false]);
+    expect(acknowledge.mock.calls.at(-1)).toEqual(['door-a']);
 
     // `m` leaves the new Door selected in command mode; `d` brings it back there.
     await commandMode();
-    await act(async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: 'm', bubbles: true })); });
+    await key('m');
     await flush();
     expect(container.querySelector('[data-door-id="door-a"]')).not.toBeNull();
     acknowledge.mockClear();
-    await act(async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: 'd', bubbles: true })); });
+    await key('d');
     await flush();
     expect(container.querySelector('[data-door-id="door-a"]')).toBeNull();
     expect(acknowledge).not.toHaveBeenCalled();
   });
 
+  it('acknowledges Enter into a pane or through its Door, and zoom', async () => {
+    const acknowledge = vi.spyOn(terminalRegistry, 'acknowledgeSession');
+    await act(async () => root.render(<Wall initialPaneIds={['pane-a', 'pane-b']} initialMode="command" />));
+    await flush();
+
+    await key('Enter');
+    expect(acknowledge.mock.calls).toEqual([['pane-a']]);
+
+    // `m` leaves the new Door selected; `Enter` reattaches it into passthrough.
+    await commandMode();
+    await key('m');
+    await flush();
+    expect(container.querySelector('[data-door-id="pane-a"]')).not.toBeNull();
+    acknowledge.mockClear();
+    await key('Enter');
+    await flush();
+    expect(container.querySelector('[data-lath-leaf="pane-a"]')).not.toBeNull();
+    expect(acknowledge.mock.calls).toEqual([['pane-a']]);
+
+    await commandMode();
+    acknowledge.mockClear();
+    await key('z');
+    await flush();
+    expect(container.querySelector('[data-lath-leaf="pane-a"] button[aria-label="Unzoom"]')).not.toBeNull();
+    expect(acknowledge.mock.calls).toEqual([['pane-a']]);
+  });
+
+  it('acknowledges the dev-server chip jumping to the terminal it names', async () => {
+    const acknowledge = vi.spyOn(terminalRegistry, 'acknowledgeSession');
+    await act(async () => root.render(<Wall
+      restoredLathLayout={{
+        version: 1,
+        tree: { root: { kind: 'split', dir: 'row', children: [
+          { node: { kind: 'leaf', id: 'pane-a' }, weight: 0.5 },
+          { node: { kind: 'leaf', id: 'browser-a' }, weight: 0.5 },
+        ] } },
+        leafMeta: {
+          'pane-a': { component: 'terminal', tabComponent: 'terminal', title: 'pnpm dev' },
+          'browser-a': {
+            component: 'browser',
+            tabComponent: 'surface',
+            title: 'localhost:5173',
+            params: { surfaceType: 'browser', renderMode: 'iframe', url: 'http://localhost:5173/' },
+          },
+        },
+      }}
+      initialMode="command"
+    />));
+    await flush();
+    await act(async () => { setDevServerResolution(5173, { paneId: 'pane-a', label: 'pnpm dev' }); });
+    try {
+      const chip = container.querySelector<HTMLButtonElement>('button[aria-label^="Focus pnpm dev"]');
+      expect(chip).not.toBeNull();
+
+      await act(async () => { chip!.click(); });
+      expect(acknowledge.mock.calls).toEqual([['pane-a']]);
+    } finally {
+      setDevServerResolution(5173, null);
+    }
+  });
+
+  it('acknowledges no spawn, no split, and no raw frame taking focus', async () => {
+    const acknowledge = vi.spyOn(terminalRegistry, 'acknowledgeSession');
+    await act(async () => root.render(<Wall
+      restoredLathLayout={{
+        version: 1,
+        tree: { root: { kind: 'leaf', id: 'browser-a' } },
+        leafMeta: {
+          'browser-a': {
+            component: 'browser',
+            tabComponent: 'surface',
+            title: 'example.com',
+            params: { surfaceType: 'browser', renderMode: 'iframe', url: 'https://example.com' },
+          },
+        },
+      }}
+      initialMode="command"
+    />));
+    await flush();
+
+    // Focus alone reaching a frame with no shim enters it, and is no gesture.
+    const frame = container.querySelector('iframe')!;
+    const activeElement = vi.spyOn(document, 'activeElement', 'get').mockReturnValue(frame);
+    await act(async () => { window.dispatchEvent(new Event('blur')); });
+    activeElement.mockRestore();
+    expect(container.querySelector('[data-lath-leaf="browser-a"]')).not.toBeNull();
+    await commandMode();
+
+    await key('|');
+    await flush();
+    await act(async () => { window.dispatchEvent(new CustomEvent('dormouse:new-terminal', { detail: {} })); });
+    await flush();
+    expect(container.querySelectorAll('[data-lath-leaf]')).toHaveLength(3);
+    expect(acknowledge).not.toHaveBeenCalled();
+  });
+
   it('moves focus to a Surface `dor` reveals without acknowledging it', async () => {
     const toolId = 'tool-revealed';
     terminalRegistry.applyTerminalSemanticEvents(toolId, [
@@ -3933,6 +4047,7 @@ describe('engagement', () => {
         />,
       ));
       await flush();
+      await present();
       await act(async () => {
         window.dispatchEvent(new CustomEvent('dormouse:control-request', {
           detail: {
diff --git a/lib/src/components/Wall.tsx b/lib/src/components/Wall.tsx
index 85655f4fc..03791e543 100644
--- a/lib/src/components/Wall.tsx
+++ b/lib/src/components/Wall.tsx
@@ -117,6 +117,7 @@ import {
   WorkspaceIdContext,
   PaneElementsContext,
   PaneWriteContext,
+  PassthroughPaneIdContext,
   WallActionsContext,
   RenamingIdContext,
   SelectedIdContext,
@@ -414,6 +415,10 @@ export function Wall({
   const [mode, setMode] = useState<WallMode>(initialMode);
   const [selectedId, setSelectedId] = useState<string | null>(null);
   const [selectedType, setSelectedType] = useState<WallSelectionKind>('pane');
+  /** The Session an open terminal context holds — null while none is open or one is exiting. */
+  const contextSourceId = terminalContext && !terminalContext.closing ? terminalContext.id : null;
+  /** The pane whose Surface takes the keyboard in passthrough. */
+  const passthroughPaneId = mode === 'passthrough' && selectedType === 'pane' ? selectedId : null;
   const lastPaneIdRef = useRef<string | null>(null);
   const doorKillReturnRef = useRef<{ id: string; neighbors: string[] } | null>(null);
 
@@ -843,14 +848,13 @@ export function Wall({
     confirmTimerRef.current = setTimeout(() => setConfirmKill(null), KILL_CONFIRM_MS);
   }, [closeSurface]);
 
-  /** Enter terminal mode for the given panel. A human gesture acknowledges the
-   *  Session; `acknowledge: false` only moves focus there — a `dor` reveal, an
-   *  embed focusing itself (`docs/specs/alert.md` -> Engagement). */
-  const enterTerminalMode = useCallback((id: string, options?: { acknowledge?: boolean }) => {
+  /** Enter terminal mode for the given panel. This only moves focus there: the
+   *  human gestures acknowledge at their own handlers, and spawns, reveals, and
+   *  embeds focusing themselves never do (`docs/specs/alert.md` -> Engagement). */
+  const enterTerminalMode = useCallback((id: string) => {
     selectPane(id);
     modeRef.current = 'passthrough';
     setMode('passthrough');
-    if (options?.acknowledge !== false) acknowledgeSession(id, false);
     // Defer focus so it happens after the mousedown/click event finishes.
     requestAnimationFrame(() => focusSession(id, true));
   }, [selectPane]);
@@ -1022,8 +1026,7 @@ export function Wall({
   // The terminal Session this Wall points its realm at (`docs/specs/alert.md` ->
   // Engagement): an open terminal context's source, else the passthrough pane —
   // never a command-mode selection, a Door, a browser Surface, or a hidden Wall.
-  const contextSourceId = terminalContext && !terminalContext.closing ? terminalContext.id : null;
-  const focusCandidate = contextSourceId ?? (mode === 'passthrough' && selectedType === 'pane' ? selectedId : null);
+  const focusCandidate = contextSourceId ?? passthroughPaneId;
   useEngagementFocus(
     active && focusCandidate !== null && surfaceHasTerminal(focusCandidate)
       ? focusCandidate
@@ -1176,7 +1179,7 @@ export function Wall({
 
   const handleReattach = useCallback((
     item: DooredItem,
-    options?: { enterPassthrough?: boolean; afterRestore?: DoorAfterRestoreAction; acknowledge?: boolean },
+    options?: { enterPassthrough?: boolean; afterRestore?: DoorAfterRestoreAction },
   ) => {
     const enterPassthrough = options?.enterPassthrough ?? true;
     const afterRestore = options?.afterRestore;
@@ -1198,7 +1201,7 @@ export function Wall({
 
     removeDoorAndSelect(item.id);
     if (enterPassthrough) {
-      enterTerminalMode(item.id, { acknowledge: options?.acknowledge });
+      enterTerminalMode(item.id);
     } else {
       modeRef.current = 'command';
       setMode('command');
@@ -1230,6 +1233,13 @@ export function Wall({
   const handleReattachRef = useRef(handleReattach);
   handleReattachRef.current = handleReattach;
 
+  /** A Door click, or a pin in its popover: reattach into passthrough, a human
+   *  gesture that acknowledges the Session. */
+  const reattachFromDoor = useCallback((item: DooredItem) => {
+    handleReattach(item);
+    acknowledgeSession(item.id);
+  }, [handleReattach]);
+
   /** Focus a surface for the human half of the context's port actions: activating
    *  a port row is an explicit request to look at and control that browser. A visible pane
    *  enters passthrough in place; a minimized one reattaches on the same terms
@@ -1243,11 +1253,11 @@ export function Wall({
    *  returns, and `nav.hasPane` reads the store, not React state. */
   const revealSurface = useCallback((id: string): boolean => {
     if (nav.hasPane(id)) {
-      enterTerminalMode(id, { acknowledge: false });
+      enterTerminalMode(id);
       return true;
     }
     const door = doorsRef.current.find((item) => item.id === id);
-    if (door) handleReattachRef.current(door, { acknowledge: false });
+    if (door) handleReattachRef.current(door);
     return nav.hasPane(id);
   }, [nav, enterTerminalMode]);
 
@@ -1927,12 +1937,18 @@ export function Wall({
         selectedIdRef.current !== id
       ) {
         enterTerminalMode(id);
+        acknowledgeSession(id);
       }
       lath.store.setZoomed(id);
     },
     onClickPanel: (id: string) => {
       setConfirmKill(null);
       enterTerminalMode(id);
+      acknowledgeSession(id);
+    },
+    onEnterPanel: (id: string) => {
+      setConfirmKill(null);
+      enterTerminalMode(id);
     },
     onFocusPane: (id: string) => {
       setConfirmKill(null);
@@ -1940,10 +1956,12 @@ export function Wall({
       const visible = nav.hasPane(id);
       if (visible) {
         enterTerminalMode(id);
-        return;
+      } else {
+        const door = doorsRef.current.find((item) => item.id === id);
+        if (!door) return;
+        handleReattachRef.current(door, { enterPassthrough: true });
       }
-      const door = doorsRef.current.find((item) => item.id === id);
-      if (door) handleReattachRef.current(door, { enterPassthrough: true });
+      acknowledgeSession(id);
     },
     onStartRename: (id: string) => {
       setRenamingPaneId(id);
@@ -2159,7 +2177,7 @@ export function Wall({
     try { await operation; } finally { contextPortLaunches.current.delete(key); }
   }, [buildDorSurfaces, findSurfaceByParams, createContentSurface, enterTerminalMode, closeSurface, lath, revealSurface, updateSurfaceParams]);
   const contextActions = useMemo(() => ({
-    id: terminalContext && !terminalContext.closing ? terminalContext.id : null,
+    id: contextSourceId,
     mounted: terminalContext,
     open: (id: string, options?: TerminalContextOpenOptions) => { if (toolPendingFromParams(lath.getMeta(id)?.params) || isHelperSession(id) || isSurfaceClosing(id) || lath.isDying(id)) return; setTerminalContext({ id, ...options }); },
     close: () => {
@@ -2185,7 +2203,7 @@ export function Wall({
       enterTerminalMode(helper.id);
     },
     openPort: openContextPort,
-  }), [terminalContext, lath, nav, surfaceRefForId, enterTerminalMode, openContextPort]);
+  }), [contextSourceId, terminalContext, lath, nav, surfaceRefForId, enterTerminalMode, openContextPort]);
 
   const wallActionsRef = useRef(wallActions);
   wallActionsRef.current = wallActions;
@@ -2235,7 +2253,7 @@ export function Wall({
   const onLeafFocused = useCallback((id: string) => {
     if (modeRef.current === 'passthrough') {
       // The embed moved DOM focus; no human gesture reached this Session.
-      if (selectedIdRef.current !== id) enterTerminalMode(id, { acknowledge: false });
+      if (selectedIdRef.current !== id) enterTerminalMode(id);
       return;
     }
     if (selectedTypeRef.current !== 'pane' || selectedIdRef.current !== id) selectPane(id);
@@ -2302,6 +2320,7 @@ export function Wall({
     <WorkspaceActiveContext.Provider value={active}>
     <ModeContext.Provider value={mode}>
       <SelectedIdContext.Provider value={selectedId}>
+      <PassthroughPaneIdContext.Provider value={passthroughPaneId}>
         <WallActionsContext.Provider value={wallActions}>
           <TerminalContextContext.Provider value={contextActions}>
           <PaneWriteContext.Provider value={paneWrite}>
@@ -2333,7 +2352,7 @@ export function Wall({
             {/* Baseboard — always present; the mobile composition is `MobileWall`, not a baseboard-less Wall. */}
             <Baseboard
               items={doorChips}
-              onReattach={handleReattach}
+              onReattach={reattachFromDoor}
               notice={baseboardNotice}
               onDoorDragStart={onDoorDragStart}
             />
@@ -2401,6 +2420,7 @@ export function Wall({
           </PaneWriteContext.Provider>
           </TerminalContextContext.Provider>
         </WallActionsContext.Provider>
+      </PassthroughPaneIdContext.Provider>
       </SelectedIdContext.Provider>
     </ModeContext.Provider>
     </WorkspaceActiveContext.Provider>
diff --git a/lib/src/components/mobile-acknowledge.test.tsx b/lib/src/components/mobile-acknowledge.test.tsx
index 9f4e3f659..1b0fa7a4b 100644
--- a/lib/src/components/mobile-acknowledge.test.tsx
+++ b/lib/src/components/mobile-acknowledge.test.tsx
@@ -12,49 +12,18 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { MobileTerminalUi, type MobileTerminalTouchMode } from './MobileTerminalUi';
 import { MobileWall, useMobileWallSessionItems } from './MobileWall';
 import { FakePtyAdapter, setPlatform } from '../lib/platform';
-import { clearTerminalActivity, disposeAllSessions, getActivity, initAlertStateReceiver } from '../lib/terminal-registry';
+import { clearTerminalActivity, disposeAllSessions, getActivity, initAlertStateReceiver, writeUserInput } from '../lib/terminal-registry';
+import { ensureResizeObserver, pointerEvent } from './wall/wall-test-utils';
 
 globalThis.IS_REACT_ACT_ENVIRONMENT = true;
 
 // jsdom has no canvas to measure glyphs with, so only the xterm engine is a
 // stand-in; the registry, `TerminalPane`, and the mouse router's capture
 // listeners on the Session's element are the real ones.
-vi.mock('@xterm/xterm', () => {
-  class Terminal {
-    element: HTMLElement | undefined;
-    cols = 80;
-    rows = 24;
-    options: Record<string, unknown> = {};
-    modes = { mouseTrackingMode: 'none', bracketedPasteMode: false };
-    parser = { registerCsiHandler: () => ({ dispose() {} }) };
-    buffer = { active: { getLine: () => undefined, baseY: 0, cursorY: 0, cursorX: 0, viewportY: 0 } };
-    private dataListeners = new Set<(data: string) => void>();
-    loadAddon(): void {}
-    open(host: HTMLElement): void {
-      this.element = document.createElement('div');
-      this.element.className = 'xterm';
-      host.appendChild(this.element);
-    }
-    write(_data: string, callback?: () => void): void { callback?.(); }
-    onData(listener: (data: string) => void) {
-      this.dataListeners.add(listener);
-      return { dispose: () => this.dataListeners.delete(listener) };
-    }
-    onResize() { return { dispose() {} }; }
-    onRender() { return { dispose() {} }; }
-    attachCustomKeyEventHandler(): void {}
-    focus(): void {}
-    blur(): void {}
-    clearSelection(): void {}
-    dispose(): void {}
-  }
-  return { Terminal };
-});
-vi.mock('@xterm/addon-fit', () => ({
-  FitAddon: class { fit() {} proposeDimensions() { return { cols: 80, rows: 24 }; } },
-}));
-vi.mock('@xterm/addon-image', () => ({ ImageAddon: class {} }));
-vi.mock('@xterm/addon-unicode-graphemes', () => ({ UnicodeGraphemesAddon: class {} }));
+vi.mock('@xterm/xterm', () => import('../lib/xterm-test-mock'));
+vi.mock('@xterm/addon-fit', () => import('../lib/xterm-test-mock'));
+vi.mock('@xterm/addon-image', () => import('../lib/xterm-test-mock'));
+vi.mock('@xterm/addon-unicode-graphemes', () => import('../lib/xterm-test-mock'));
 
 const PANE = 'pane-a';
 const SESSIONS = [{ id: PANE, title: 'remote shell' }];
@@ -63,19 +32,6 @@ let platform: FakePtyAdapter;
 let container: HTMLDivElement;
 let root: Root;
 
-function touchDown(): PointerEvent {
-  const event = new Event('pointerdown', { bubbles: true, cancelable: true }) as PointerEvent;
-  const values: Partial<PointerEvent> = {
-    pointerId: 7, pointerType: 'touch', isPrimary: true, button: 0, buttons: 1,
-    clientX: 10, clientY: 12, screenX: 110, screenY: 112,
-    ctrlKey: false, shiftKey: false, altKey: false, metaKey: false,
-  };
-  for (const [key, value] of Object.entries(values)) {
-    Object.defineProperty(event, key, { configurable: true, get: () => value });
-  }
-  return event;
-}
-
 function Composition({ touchMode }: { touchMode: MobileTerminalTouchMode }) {
   const [active, setActive] = useState(PANE);
   const sessions = useMobileWallSessionItems(SESSIONS, active);
@@ -86,7 +42,7 @@ function Composition({ touchMode }: { touchMode: MobileTerminalTouchMode }) {
       activeKeyboardMode="type"
       cursorTouchAvailable
       sessions={sessions}
-      onSendInput={(data) => platform.writePty(active, data)}
+      onSendInput={(data) => writeUserInput(active, data)}
       terminal={<MobileWall sessions={SESSIONS} activeSessionId={active} onActiveSessionChange={setActive} showKillButton={false} />}
     />
   );
@@ -112,7 +68,7 @@ beforeEach(() => {
   Object.defineProperty(HTMLElement.prototype, 'setPointerCapture', { configurable: true, value: vi.fn() });
   Object.defineProperty(HTMLElement.prototype, 'releasePointerCapture', { configurable: true, value: vi.fn() });
   Object.defineProperty(document, 'elementFromPoint', { configurable: true, value: vi.fn(() => document.body) });
-  vi.stubGlobal('ResizeObserver', class { observe() {} unobserve() {} disconnect() {} });
+  ensureResizeObserver();
   Object.defineProperty(HTMLCanvasElement.prototype, 'getContext', { configurable: true, value: vi.fn(() => null) });
   container = document.createElement('div');
   document.body.appendChild(container);
@@ -125,7 +81,6 @@ afterEach(() => {
   disposeAllSessions();
   clearTerminalActivity();
   delete (document as Document & { elementFromPoint?: unknown }).elementFromPoint;
-  vi.unstubAllGlobals();
   vi.restoreAllMocks();
 });
 
@@ -137,7 +92,7 @@ describe('mobile acknowledge', () => {
       ring();
       const screen = container.querySelector('.xterm');
       expect(screen).not.toBeNull();
-      act(() => { screen!.dispatchEvent(touchDown()); });
+      act(() => { screen!.dispatchEvent(pointerEvent('pointerdown')); });
       expect(getActivity(PANE)).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
     },
   );
@@ -145,7 +100,7 @@ describe('mobile acknowledge', () => {
   it('a keystroke from the input bar acknowledges with input, clearing the TODO', () => {
     render('gestures');
     ring();
-    const bar = container.querySelector<HTMLTextAreaElement>('textarea[data-mobile-terminal-input], textarea');
+    const bar = container.querySelector<HTMLTextAreaElement>('textarea[aria-label="Terminal input"]');
     expect(bar).not.toBeNull();
     act(() => {
       bar!.dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter', bubbles: true, cancelable: true }));
diff --git a/lib/src/components/wall/IframePanel.test.tsx b/lib/src/components/wall/IframePanel.test.tsx
index ee7191865..40393ff88 100644
--- a/lib/src/components/wall/IframePanel.test.tsx
+++ b/lib/src/components/wall/IframePanel.test.tsx
@@ -168,9 +168,10 @@ describe('IframePanel', () => {
     expect(getAgentBrowserScreenController('iframe-bare-nav')?.chrome().url).toBe('http://localhost:5173/app');
   });
 
-  it('adopts clicks into the raw iframe fallback via window blur focus', async () => {
+  it('enters the raw iframe fallback on window blur focus, as focus alone and never a click', async () => {
     const onClickPanel = vi.fn();
-    const actions = stubActions({ onClickPanel });
+    const onEnterPanel = vi.fn();
+    const actions = stubActions({ onClickPanel, onEnterPanel });
     const iframe = await renderPanel(actions);
 
     vi.spyOn(document, 'hasFocus').mockReturnValue(true);
@@ -180,12 +181,14 @@ describe('IframePanel', () => {
       window.dispatchEvent(new Event('blur'));
     });
 
-    expect(onClickPanel).toHaveBeenCalledWith('iframe-raw');
+    expect(onEnterPanel).toHaveBeenCalledWith('iframe-raw');
+    // A click acknowledges the Session; DOM focus never does (docs/specs/alert.md -> Engagement).
+    expect(onClickPanel).not.toHaveBeenCalled();
   });
 
   it('does not adopt a raw iframe blur when the app itself lost focus', async () => {
-    const onClickPanel = vi.fn();
-    const actions = stubActions({ onClickPanel });
+    const onEnterPanel = vi.fn();
+    const actions = stubActions({ onEnterPanel });
     const iframe = await renderPanel(actions);
 
     vi.spyOn(document, 'hasFocus').mockReturnValue(false);
@@ -195,7 +198,7 @@ describe('IframePanel', () => {
       window.dispatchEvent(new Event('blur'));
     });
 
-    expect(onClickPanel).not.toHaveBeenCalled();
+    expect(onEnterPanel).not.toHaveBeenCalled();
   });
 
   it('drives iframe back and forward from the registered chrome actions', async () => {
diff --git a/lib/src/components/wall/IframePanel.tsx b/lib/src/components/wall/IframePanel.tsx
index 0a59bdf67..9017a2816 100644
--- a/lib/src/components/wall/IframePanel.tsx
+++ b/lib/src/components/wall/IframePanel.tsx
@@ -322,11 +322,12 @@ export function IframePanel({ id, title, params }: PaneProps) {
   // iframe still blurs the parent window while the document itself remains
   // focused. Adopt that as entering the pane so hosts without a proxy keep the
   // same click/focus behavior, albeit without the proxied leader side-channel.
+  // Focus alone is no gesture, so it acknowledges nothing.
   useEffect(() => {
     if (resolution.kind !== 'raw') return;
     const onWindowBlur = () => {
       if (document.hasFocus() && document.activeElement === iframeRef.current) {
-        actions.onClickPanel(id);
+        actions.onEnterPanel(id);
       }
     };
     window.addEventListener('blur', onWindowBlur);
diff --git a/lib/src/components/wall/TerminalPanel.tsx b/lib/src/components/wall/TerminalPanel.tsx
index 01c94c2e2..8f97d3ada 100644
--- a/lib/src/components/wall/TerminalPanel.tsx
+++ b/lib/src/components/wall/TerminalPanel.tsx
@@ -6,18 +6,17 @@ import { getMouseSelectionState } from '../../lib/mouse-selection';
 import type { PaneProps } from './pane-props';
 import { usePaneChrome } from './use-pane-chrome';
 import {
-  ModeContext,
+  PassthroughPaneIdContext,
   TerminalContextContext,
   WallActionsContext,
-  SelectedIdContext,
 } from './wall-context';
 
 export function TerminalPanel(props: PaneProps & { renderNotepad?: boolean; renderTerminal?: boolean }) {
   const context = useContext(TerminalContextContext);
-  const mode = useContext(ModeContext);
-  const selectedId = useContext(SelectedIdContext);
+  const passthroughPaneId = useContext(PassthroughPaneIdContext);
   const actions = useContext(WallActionsContext);
-  const isFocused = !props.parked && mode === 'passthrough' && selectedId === props.id && context.id !== props.id;
+  // The context's source gives the keyboard to the context instead.
+  const isFocused = !props.parked && passthroughPaneId === props.id && context.id !== props.id;
   const elRef = useRef<HTMLDivElement>(null);
   usePaneChrome(props.id, elRef);
 
diff --git a/lib/src/components/wall/keyboard/handle-pane-shortcuts.test.ts b/lib/src/components/wall/keyboard/handle-pane-shortcuts.test.ts
index 5ef08c93d..4034dedd5 100644
--- a/lib/src/components/wall/keyboard/handle-pane-shortcuts.test.ts
+++ b/lib/src/components/wall/keyboard/handle-pane-shortcuts.test.ts
@@ -9,14 +9,12 @@ import { useWallKeyboard } from '../use-wall-keyboard';
 import type { WallKeyboardCtx } from './types';
 
 const terminalRegistryMocks = vi.hoisted(() => ({
+  acknowledgeSession: vi.fn(),
   dismissSessionAlert: vi.fn(),
   toggleSessionTodo: vi.fn(),
 }));
 
-vi.mock('../../../lib/terminal-registry', () => ({
-  dismissSessionAlert: terminalRegistryMocks.dismissSessionAlert,
-  toggleSessionTodo: terminalRegistryMocks.toggleSessionTodo,
-}));
+vi.mock('../../../lib/terminal-registry', () => terminalRegistryMocks);
 
 vi.mock('./handle-mouse-selection-keys', () => ({ handleMouseSelectionKeys: () => false }));
 
@@ -85,6 +83,25 @@ describe('handlePaneShortcuts kill behavior', () => {
   });
 });
 
+/** Entering passthrough is a human gesture; `d` only reattaches
+ *  (`docs/specs/alert.md` -> Engagement). */
+describe('handlePaneShortcuts acknowledgement', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it.each(['pane', 'door'] as const)('acknowledges the Session Enter takes a %s into', (selectedType) => {
+    const ctx = makeCtx({ selectedTypeRef: { current: selectedType } });
+    expect(handlePaneShortcuts(keydown('Enter'), ctx, { current: null })).toBe(true);
+    expect(terminalRegistryMocks.acknowledgeSession.mock.calls).toEqual([['pane-a']]);
+  });
+
+  it('acknowledges nothing for `d` bringing a Door back in command mode', () => {
+    const ctx = makeCtx({ selectedTypeRef: { current: 'door' } });
+    expect(handlePaneShortcuts(keydown('d'), ctx, { current: null })).toBe(true);
+    expect(ctx.handleReattachRef.current).toHaveBeenCalledWith(expect.objectContaining({ id: 'pane-a' }), { enterPassthrough: false });
+    expect(terminalRegistryMocks.acknowledgeSession).not.toHaveBeenCalled();
+  });
+});
+
 describe('comma rename eligibility', () => {
   beforeEach(() => vi.clearAllMocks());
 
diff --git a/lib/src/components/wall/keyboard/handle-pane-shortcuts.ts b/lib/src/components/wall/keyboard/handle-pane-shortcuts.ts
index ee8cce991..d508da334 100644
--- a/lib/src/components/wall/keyboard/handle-pane-shortcuts.ts
+++ b/lib/src/components/wall/keyboard/handle-pane-shortcuts.ts
@@ -1,4 +1,4 @@
-import { dismissSessionAlert, toggleSessionTodo } from '../../../lib/terminal-registry';
+import { acknowledgeSession, dismissSessionAlert, toggleSessionTodo } from '../../../lib/terminal-registry';
 import { hasTerminal } from 'dor/commands/types';
 import { surfaceKindFromParams } from '../browser-surface';
 import { isWorkspaceSelection } from '../wall-types';
@@ -36,15 +36,19 @@ export function handlePaneShortcuts(
     return true;
   }
 
+  // Entering passthrough, from a pane or through its Door, is a human gesture
+  // that acknowledges the Session (`docs/specs/alert.md` -> Engagement).
   if (e.key === 'Enter' && sid) {
     e.preventDefault();
     e.stopPropagation();
     if (ctx.selectedTypeRef.current === 'door') {
       const item = ctx.doorsRef.current.find((d) => d.id === sid);
-      if (item) ctx.handleReattachRef.current(item);
+      if (!item) return true;
+      ctx.handleReattachRef.current(item);
     } else {
       ctx.enterTerminalMode(sid);
     }
+    acknowledgeSession(sid);
     return true;
   }
 
diff --git a/lib/src/components/wall/use-engagement-focus.ts b/lib/src/components/wall/use-engagement-focus.ts
index 9d3639d2a..219d2ac1f 100644
--- a/lib/src/components/wall/use-engagement-focus.ts
+++ b/lib/src/components/wall/use-engagement-focus.ts
@@ -1,5 +1,5 @@
 import { useEffect, useState } from 'react';
-import { publishEngagementFocus, retainEngagementReporter, withdrawEngagementFocus } from '../../lib/engagement';
+import { publishEngagementFocus, retainEngagementReporter } from '../../lib/engagement';
 
 /**
  * Report the terminal Session this Wall points its realm at (`docs/specs/alert.md`
@@ -10,7 +10,7 @@ export function useEngagementFocus(focusId: string | null): void {
   useEffect(() => {
     const release = retainEngagementReporter();
     return () => {
-      withdrawEngagementFocus(slot);
+      publishEngagementFocus(slot, null);
       release();
     };
   }, [slot]);
diff --git a/lib/src/components/wall/use-window-focused.ts b/lib/src/components/wall/use-window-focused.ts
index 0078aeda1..ceddad02f 100644
--- a/lib/src/components/wall/use-window-focused.ts
+++ b/lib/src/components/wall/use-window-focused.ts
@@ -1,21 +1,9 @@
 import { useEffect, useState } from 'react';
+import { subscribeWindowFocus } from '../../lib/window-focus';
 
+/** Whether this window has focus, an iframe Surface holding it included. */
 export function useWindowFocused(): boolean {
   const [focused, setFocused] = useState(() => document.hasFocus());
-  useEffect(() => {
-    const onFocus = () => setFocused(true);
-    // Focusing one of our own iframe surfaces fires `blur` on this window even
-    // though the app hasn't been backgrounded — the focused element is just an
-    // <iframe> *inside* this document, so `document.hasFocus()` stays true.
-    // Reading it instead of blindly setting false keeps headers/attention live
-    // when an iframe takes focus (docs/specs/dor-browser.md → "Iframe Focus And Rendering Notes").
-    const onBlur = () => setFocused(document.hasFocus());
-    window.addEventListener('focus', onFocus);
-    window.addEventListener('blur', onBlur);
-    return () => {
-      window.removeEventListener('focus', onFocus);
-      window.removeEventListener('blur', onBlur);
-    };
-  }, []);
+  useEffect(() => subscribeWindowFocus(setFocused), []);
   return focused;
 }
diff --git a/lib/src/components/wall/wall-context.tsx b/lib/src/components/wall/wall-context.tsx
index 2456081e0..bf7624f30 100644
--- a/lib/src/components/wall/wall-context.tsx
+++ b/lib/src/components/wall/wall-context.tsx
@@ -15,6 +15,8 @@ export interface PaneElementsState {
 
 export const ModeContext = createContext<WallMode>('command');
 export const SelectedIdContext = createContext<string | null>(null);
+/** The pane whose Surface takes the keyboard in passthrough, else null. */
+export const PassthroughPaneIdContext = createContext<string | null>(null);
 
 /** The last visible ring frame, carried between active Walls in one Window. */
 export const RingHandoffContext = createContext<RefObject<RingFrame | null> | null>(null);
@@ -45,7 +47,12 @@ export interface WallActions {
   onSplitH: (id: string | null, source?: 'keyboard' | 'mouse') => void;
   onSplitV: (id: string | null, source?: 'keyboard' | 'mouse') => void;
   onZoom: (id: string) => void;
+  /** A click on a pane's body or header: enter passthrough on it, acknowledging
+   *  its Session (`docs/specs/alert.md` -> Engagement). */
   onClickPanel: (id: string) => void;
+  /** DOM focus reached a pane with no gesture seen — a raw cross-origin frame:
+   *  enter passthrough on it, acknowledging nothing. */
+  onEnterPanel: (id: string) => void;
   /** Jump to/focus an arbitrary pane by id (visible or minimized). Used by the
    *  browser header's dev-server chip to surface the terminal serving a port. */
   onFocusPane: (id: string) => void;
@@ -78,6 +85,7 @@ export const WallActionsContext = createContext<WallActions>({
   onSplitV: () => {},
   onZoom: () => {},
   onClickPanel: () => {},
+  onEnterPanel: () => {},
   onFocusPane: () => {},
   onStartRename: () => {},
   onFinishRename: () => ({ accepted: true }),
diff --git a/lib/src/components/wall/wall-test-utils.ts b/lib/src/components/wall/wall-test-utils.ts
index 6d05216a2..d19368fc6 100644
--- a/lib/src/components/wall/wall-test-utils.ts
+++ b/lib/src/components/wall/wall-test-utils.ts
@@ -20,6 +20,7 @@ export function stubWallActions(overrides: Partial<WallActions> = {}): WallActio
     onSplitV: vi.fn(),
     onZoom: vi.fn(),
     onClickPanel: vi.fn(),
+    onEnterPanel: vi.fn(),
     onFocusPane: vi.fn(),
     onStartRename: vi.fn(),
     onFinishRename: vi.fn(() => ({ accepted: true })),
@@ -39,6 +40,32 @@ export function ensureResizeObserver(): void {
   } as unknown as typeof ResizeObserver;
 }
 
+/** A dispatchable `PointerEvent`: jsdom has none, so its fields are defined on
+ *  a plain event — a primary touch with one button down unless overridden. */
+export function pointerEvent(type: string, overrides: Partial<PointerEvent> = {}): PointerEvent {
+  const event = new Event(type, { bubbles: true, cancelable: true }) as PointerEvent;
+  const values: Partial<PointerEvent> = {
+    pointerId: 7,
+    pointerType: 'touch',
+    isPrimary: true,
+    button: 0,
+    buttons: type === 'pointerup' || type === 'pointercancel' ? 0 : 1,
+    clientX: 10,
+    clientY: 12,
+    screenX: 110,
+    screenY: 112,
+    ctrlKey: false,
+    shiftKey: false,
+    altKey: false,
+    metaKey: false,
+    ...overrides,
+  };
+  for (const [key, value] of Object.entries(values)) {
+    Object.defineProperty(event, key, { configurable: true, get: () => value });
+  }
+  return event;
+}
+
 /** jsdom lacks the native modal `<dialog>` API that `NativeModalDialog` calls. */
 export function ensureDialogModal(): void {
   HTMLDialogElement.prototype.showModal ??= function showModal(this: HTMLDialogElement) {
diff --git a/lib/src/lib/alert-engagement.test.ts b/lib/src/lib/alert-engagement.test.ts
index db74bc286..2694cab05 100644
--- a/lib/src/lib/alert-engagement.test.ts
+++ b/lib/src/lib/alert-engagement.test.ts
@@ -2,6 +2,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AlertManager, type ActivityNotification, type AwaitOutcome } from './alert-manager';
 import { applyTerminalProtocolEvents, TerminalProtocolParser } from './terminal-protocol';
 import { cfg } from '../cfg';
+import { engage, finishCommand, goIdle, leave, runCommand, VIEWER } from './alert-manager-test-utils';
 
 /**
  * Engagement (`docs/specs/alert.md` -> Engagement): presence and focus arrive
@@ -11,7 +12,6 @@ import { cfg } from '../cfg';
 
 const PANE = 'pane';
 const OTHER = 'other';
-const VIEWER = 'viewer';
 
 const PERMISSION: ActivityNotification = { source: 'OSC 9', title: null, body: 'Claude needs your permission' };
 const BELL: ActivityNotification = { source: 'BEL', title: 'Terminal bell', body: null };
@@ -28,31 +28,6 @@ afterEach(() => {
   vi.useRealTimers();
 });
 
-function engage(id: string, viewer = VIEWER): void {
-  manager.setViewer(viewer, { present: true, focusId: id });
-}
-
-/** Focus moved off, or the window blurred or hid. */
-function leave(viewer = VIEWER): void {
-  manager.setViewer(viewer, { present: false, focusId: null }, 'leave');
-}
-
-/** No input for the inactivity timeout; focus unchanged. */
-function goIdle(id: string, viewer = VIEWER): void {
-  manager.setViewer(viewer, { present: false, focusId: id }, 'idle');
-}
-
-function runCommand(id: string, commandLine: string): void {
-  manager.applyTerminalSemanticEvents(id, [
-    { type: 'commandLine', commandLine },
-    { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-  ]);
-}
-
-function finishCommand(id: string, exitCode = 0): void {
-  manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode }, { type: 'promptStart' }]);
-}
-
 /** Output every `everyMs` for `ms`. */
 function output(id: string, ms: number, everyMs = 100): void {
   for (let t = 0; t < ms; t += everyMs) {
@@ -83,55 +58,55 @@ function ringing(id: string): boolean {
 /** A watched command, busy and then quiet: the settle a WATCHING ring needs. */
 function watchedTurn(id: string): void {
   manager.setWatchedCommands(['claude']);
-  runCommand(id, 'claude');
+  runCommand(manager, id, 'claude');
   output(id, 3_000);
   vi.advanceTimersByTime(5_000);
 }
 
 /** A seen command that outlasted the minimum runtime, finished while engaged. */
 function longRunFinishedEngaged(id: string): void {
-  engage(id);
-  runCommand(id, 'pnpm build');
+  engage(manager, id);
+  runCommand(manager, id, 'pnpm build');
   vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
-  finishCommand(id, 2);
+  finishCommand(manager, id, 2, { promptStart: true });
 }
 
 describe('held completions', () => {
   it.each([
     ['report', (id: string) => manager.notifyFromProtocol(id, PERMISSION)],
     ['settle', (id: string) => watchedTurn(id)],
-    ['exit', (id: string) => { runCommand(id, 'pnpm build'); vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime); finishCommand(id); }],
+    ['exit', (id: string) => { runCommand(manager, id, 'pnpm build'); vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime); finishCommand(manager, id, 0, { promptStart: true }); }],
   ] as const)('holds a %s while engaged and rings it once presence lapses from inactivity', (_kind, complete) => {
     manager.onData(PANE);
-    engage(PANE);
+    engage(manager, PANE);
     complete(PANE);
     expect(ringing(PANE)).toBe(false);
     expect(manager.getState(PANE).todo).toBe(false);
 
-    goIdle(PANE);
+    goIdle(manager, PANE);
     expect(manager.getState(PANE)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
   });
 
   it.each([
-    ['the window leaving', () => leave()],
-    ['focus moving to another pane', () => engage(OTHER)],
+    ['the window leaving', () => leave(manager)],
+    ['focus moving to another pane', () => engage(manager, OTHER)],
     ['focus moving away while presence lapses', () => manager.setViewer(VIEWER, { present: false, focusId: OTHER }, 'idle')],
     ['the viewer going away', () => manager.removeViewer(VIEWER)],
   ] as const)('drops a held completion on an explicit disengage: %s', (_how, disengage) => {
     manager.onData(PANE);
-    engage(PANE);
+    engage(manager, PANE);
     manager.notifyFromProtocol(PANE, PERMISSION);
 
     disengage();
     vi.advanceTimersByTime(120_000);
-    goIdle(PANE);
+    goIdle(manager, PANE);
     expect(manager.getState(PANE)).toMatchObject({ status: 'WATCHING_DISABLED', todo: false, notification: null });
   });
 
   it('rings a held exit with its exit code', () => {
     longRunFinishedEngaged(PANE);
     expect(ringing(PANE)).toBe(false);
-    goIdle(PANE);
+    goIdle(manager, PANE);
     expect(manager.getState(PANE).notification).toEqual({
       source: 'COMMAND_EXIT', title: 'Command finished', body: 'pnpm build exited 2',
     });
@@ -139,20 +114,20 @@ describe('held completions', () => {
 
   it('escalates with the richest detail it held', () => {
     manager.onData(PANE);
-    engage(PANE);
+    engage(manager, PANE);
     manager.notifyFromProtocol(PANE, PERMISSION);
     manager.notifyFromProtocol(PANE, BELL);
-    goIdle(PANE);
+    goIdle(manager, PANE);
     expect(manager.getState(PANE).notification).toEqual(PERMISSION);
   });
 
   it('sends an escalated report through animation deferral', () => {
     output(PANE, 3_000);
-    engage(PANE);
+    engage(manager, PANE);
     manager.notifyFromProtocol(PANE, PERMISSION);
     output(PANE, 1_000);
 
-    goIdle(PANE);
+    goIdle(manager, PANE);
     // Still animating: the report waits for quiet, like any other.
     expect(ringing(PANE)).toBe(false);
     vi.advanceTimersByTime(5_000);
@@ -162,20 +137,20 @@ describe('held completions', () => {
   it('holds a deferred report that comes due while engaged', () => {
     output(PANE, 3_000);
     manager.notifyFromProtocol(PANE, PERMISSION);
-    engage(PANE);
+    engage(manager, PANE);
     vi.advanceTimersByTime(5_000);
     expect(ringing(PANE)).toBe(false);
 
-    goIdle(PANE);
+    goIdle(manager, PANE);
     expect(manager.getState(PANE)).toMatchObject({ status: 'ALERT_RINGING', notification: PERMISSION });
   });
 
   it('acknowledging drops what was held and records it as answered', () => {
     manager.setWatchedCommands(['claude']);
-    engage(PANE);
+    engage(manager, PANE);
     watchedTurn(PANE);
     manager.acknowledge(PANE, { input: false });
-    goIdle(PANE);
+    goIdle(manager, PANE);
     expect(ringing(PANE)).toBe(false);
 
     // Claude's idle ping about the same turn is a receipt, not a second summons.
@@ -184,10 +159,10 @@ describe('held completions', () => {
   });
 
   it('withdraws a held settle once watched work resumes', () => {
-    engage(PANE);
+    engage(manager, PANE);
     watchedTurn(PANE);
     output(PANE, 3_000);
-    goIdle(PANE);
+    goIdle(manager, PANE);
     expect(ringing(PANE)).toBe(false);
   });
 });
@@ -196,32 +171,32 @@ describe('viewers', () => {
   it('lets no viewer disengage a Session another viewer engages', () => {
     // Two VS Code webviews on one manager: the user clicks into webview B,
     // and webview A's blur arrives after.
-    engage('p1', 'webview-a');
-    runCommand('p2', 'cargo build');
-    engage('p2', 'webview-b');
-    leave('webview-a');
+    engage(manager, 'p1', 'webview-a');
+    runCommand(manager, 'p2', 'cargo build');
+    engage(manager, 'p2', 'webview-b');
+    leave(manager, 'webview-a');
 
     vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
-    finishCommand('p2');
+    finishCommand(manager, 'p2', 0, { promptStart: true });
     expect(ringing('p2')).toBe(false);
   });
 
   it('derives the command-exit arm from engagement, publishing each edge', () => {
     const statuses: string[] = [];
     manager.onStateChange((id, state) => { if (id === PANE) statuses.push(state.status); });
-    engage(PANE);
-    runCommand(PANE, 'pnpm build');
+    engage(manager, PANE);
+    runCommand(manager, PANE, 'pnpm build');
     expect(manager.getState(PANE).status).toBe('WATCHING_DISABLED');
 
-    leave();
+    leave(manager);
     expect(manager.getState(PANE).status).toBe('COMMAND_EXIT_ARMED');
-    engage(PANE);
+    engage(manager, PANE);
     expect(manager.getState(PANE).status).toBe('WATCHING_DISABLED');
     expect(statuses).toEqual(['WATCHING_DISABLED', 'COMMAND_EXIT_ARMED', 'WATCHING_DISABLED']);
   });
 
   it('counts an acknowledgement as seeing the running command', () => {
-    runCommand(PANE, 'pnpm build');
+    runCommand(manager, PANE, 'pnpm build');
     expect(manager.getState(PANE).status).toBe('WATCHING_DISABLED');
     manager.acknowledge(PANE, { input: false });
     expect(manager.getState(PANE).status).toBe('COMMAND_EXIT_ARMED');
@@ -250,19 +225,19 @@ describe('acknowledge', () => {
 describe('echo window', () => {
   it('never builds BUSY from the echo of the user typing', () => {
     manager.setWatchedCommands(['claude']);
-    runCommand(PANE, 'claude');
-    engage(PANE);
+    runCommand(manager, PANE, 'claude');
+    engage(manager, PANE);
     typeFor(PANE, 3_000);
     expect(manager.getState(PANE).status).toBe('NOTHING_TO_SHOW');
 
     // The draft is left unsubmitted and the user clicks another pane.
-    engage(OTHER);
+    engage(manager, OTHER);
     vi.advanceTimersByTime(10_000);
     expect(ringing(PANE)).toBe(false);
   });
 
   it('does not resolve a quiet await on a half-typed draft', async () => {
-    runCommand(PANE, 'claude');
+    runCommand(manager, PANE, 'claude');
     const handle = manager.awaitCompletion(PANE, { until: 'quiet', timeoutMs: 600_000 });
     let outcome: AwaitOutcome | undefined;
     void handle.promise.then((value) => { outcome = value; });
@@ -285,15 +260,15 @@ describe('echo window', () => {
   });
 
   it.each([
-    ['the exit Ctrl-C caused', () => { vi.advanceTimersByTime(20); finishCommand(PANE, 130); }],
+    ['the exit Ctrl-C caused', () => { vi.advanceTimersByTime(20); finishCommand(manager, PANE, 130, { promptStart: true }); }],
     ['a bell answering Tab', () => { vi.advanceTimersByTime(5); manager.notifyFromProtocol(PANE, BELL); }],
   ] as const)('neither rings nor holds %s', (_what, answer) => {
-    engage(PANE);
-    runCommand(PANE, 'pnpm build');
+    engage(manager, PANE);
+    runCommand(manager, PANE, 'pnpm build');
     vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
     manager.acknowledge(PANE, { input: true });
     answer();
-    goIdle(PANE);
+    goIdle(manager, PANE);
     expect(ringing(PANE)).toBe(false);
     expect(manager.getState(PANE)).toMatchObject({ todo: false, notification: null });
   });
@@ -312,7 +287,7 @@ describe('walking away from a permission prompt', () => {
   function replay(untilMs: number): void {
     const parser = new TerminalProtocolParser();
     const timeline: { at: number; step: () => void }[] = [];
-    timeline.push({ at: 0, step: () => { engage(PANE); runCommand(PANE, 'claude'); } });
+    timeline.push({ at: 0, step: () => { engage(manager, PANE); runCommand(manager, PANE, 'claude'); } });
     // First paint.
     for (let at = 230; at < 830; at += 100) timeline.push({ at, step: () => manager.onData(PANE) });
     // The prompt, typed at 40ms a key, each key echoed.
@@ -327,7 +302,7 @@ describe('walking away from a permission prompt', () => {
     // The idle prompt's cursor redraw.
     for (let at = 12_415; at < untilMs; at += 605) timeline.push({ at, step: () => manager.onData(PANE) });
     // The renderer's presence lapses 15s after the last input.
-    timeline.push({ at: ENTER_AT + cfg.alert.userAttention, step: () => goIdle(PANE) });
+    timeline.push({ at: ENTER_AT + cfg.alert.inactivityTimeout, step: () => goIdle(manager, PANE) });
 
     timeline.sort((a, b) => a.at - b.at);
     let now = 0;
@@ -341,7 +316,7 @@ describe('walking away from a permission prompt', () => {
   }
 
   it('holds the permission request while the user is still there', () => {
-    replay(ENTER_AT + cfg.alert.userAttention - 1);
+    replay(ENTER_AT + cfg.alert.inactivityTimeout - 1);
     expect(manager.getState(PANE)).toMatchObject({ todo: false, notification: null });
   });
 
diff --git a/lib/src/lib/alert-manager-test-utils.ts b/lib/src/lib/alert-manager-test-utils.ts
new file mode 100644
index 000000000..5bb55fdfb
--- /dev/null
+++ b/lib/src/lib/alert-manager-test-utils.ts
@@ -0,0 +1,81 @@
+/**
+ * Drivers the suites that feed an `AlertManager` directly share
+ * (`alert-manager.test.ts`, `alert-engagement.test.ts`,
+ * `alert-resumed-output.test.ts`, `alert-runtime-transfer.test.ts`). Each takes
+ * the manager it drives, since a transfer test drives two, and runs under fake
+ * timers.
+ *
+ * Timing from cfg.alert: busyCandidateGap=1500, busyConfirmGap=500,
+ * mightNeedAttention=2000, needsAttentionConfirm=3000.
+ */
+import { vi } from 'vitest';
+import type { AlertManager } from './alert-manager';
+
+/** The viewer a suite reports for when one renderer realm is enough. */
+export const VIEWER = 'viewer';
+
+/** The user is present, `viewer` pointing at `id` (`docs/specs/alert.md` -> Engagement). */
+export function engage(manager: AlertManager, id: string, viewer = VIEWER): void {
+  manager.setViewer(viewer, { present: true, focusId: id });
+}
+
+/** An explicit disengage: focus moved off, or the window left. */
+export function leave(manager: AlertManager, viewer = VIEWER): void {
+  manager.setViewer(viewer, { present: false, focusId: null }, 'leave');
+}
+
+/** Presence lapses from inactivity while `id` keeps the focus. */
+export function goIdle(manager: AlertManager, id: string, viewer = VIEWER): void {
+  manager.setViewer(viewer, { present: false, focusId: id }, 'idle');
+}
+
+/** Start `commandLine` the way shell integration reports it: the line, then its start. */
+export function runCommand(manager: AlertManager, id: string, commandLine = 'pnpm build'): void {
+  manager.applyTerminalSemanticEvents(id, [
+    { type: 'commandLine', commandLine },
+    { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
+  ]);
+}
+
+/** The foreground command finishes; `promptStart` also draws the next prompt. */
+export function finishCommand(
+  manager: AlertManager,
+  id: string,
+  exitCode = 0,
+  { promptStart = false }: { promptStart?: boolean } = {},
+): void {
+  manager.applyTerminalSemanticEvents(id, [
+    { type: 'commandFinish', exitCode },
+    ...(promptStart ? [{ type: 'promptStart' as const }] : []),
+  ]);
+}
+
+/** Run `commandLine` seen and then left: armed, so its exit rings once it has
+ *  outlasted `cfg.alert.commandExitMinRuntime`. */
+export function armCommandExit(manager: AlertManager, id: string, commandLine = 'pnpm build'): void {
+  engage(manager, id);
+  runCommand(manager, id, commandLine);
+  leave(manager);
+}
+
+/** Two output bursts across the busy-candidate gap: NOTHING_TO_SHOW -> BUSY. */
+export function driveToBusy(manager: AlertManager, id: string): void {
+  manager.onData(id);
+  vi.advanceTimersByTime(1_600);
+  manager.onData(id);
+  manager.onData(id);
+}
+
+/** Silence through both quiet windows: BUSY -> MIGHT_NEED_ATTENTION -> settled. */
+export function settle(): void {
+  vi.advanceTimersByTime(2_000);
+  vi.advanceTimersByTime(3_000);
+}
+
+/** One output chunk a second for `ms`, which never lets the Session go quiet. */
+export function heartbeat(manager: AlertManager, id: string, ms: number): void {
+  for (let elapsed = 0; elapsed < ms; elapsed += 1_000) {
+    vi.advanceTimersByTime(1_000);
+    manager.onData(id);
+  }
+}
diff --git a/lib/src/lib/alert-manager.test.ts b/lib/src/lib/alert-manager.test.ts
index 5fbb9332a..79b9115b0 100644
--- a/lib/src/lib/alert-manager.test.ts
+++ b/lib/src/lib/alert-manager.test.ts
@@ -9,6 +9,17 @@ import {
 } from './terminal-protocol';
 import { cfg } from '../cfg';
 import { toPersistedAlertState } from './session-types';
+import {
+  armCommandExit,
+  driveToBusy,
+  engage,
+  finishCommand,
+  goIdle,
+  heartbeat,
+  leave,
+  runCommand,
+  settle,
+} from './alert-manager-test-utils';
 
 describe('AlertManager in isolation', () => {
   let manager: AlertManager;
@@ -23,54 +34,13 @@ describe('AlertManager in isolation', () => {
     vi.useRealTimers();
   });
 
-  // Timing from cfg.alert:
-  // busyCandidateGap=1500, busyConfirmGap=500, mightNeedAttention=2000, needsAttentionConfirm=3000
-
-  /** Start `commandLine` the way shell integration reports it: the line, then its start. */
-  function runCommand(id: string, commandLine = 'pnpm build'): void {
-    manager.applyTerminalSemanticEvents(id, [
-      { type: 'commandLine', commandLine },
-      { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-    ]);
-  }
-
-  /** The one viewer these tests report for: a single renderer realm. */
-  const VIEWER = 'viewer';
-
-  /** The user is present, pointing at `id` (`docs/specs/alert.md` -> Engagement). */
-  function engage(id: string): void {
-    manager.setViewer(VIEWER, { present: true, focusId: id });
-  }
-
-  /** An explicit disengage: focus moved off, or the window left. */
-  function disengage(): void {
-    manager.setViewer(VIEWER, { present: false, focusId: null }, 'leave');
-  }
-
-  /** Presence lapses from inactivity while `id` keeps the focus. */
-  function goIdle(id: string): void {
-    manager.setViewer(VIEWER, { present: false, focusId: id }, 'idle');
-  }
-
-  /** Run `commandLine` seen and then left: armed, so its exit rings once it
-   *  has outlasted `cfg.alert.commandExitMinRuntime`. */
-  function armCommandExit(id: string, commandLine = 'pnpm build'): void {
-    engage(id);
-    runCommand(id, commandLine);
-    disengage();
-  }
-
-  function finishCommand(id: string, exitCode = 0): void {
-    manager.applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode }]);
-  }
-
   /**
    * WATCHING is keyed on the foreground command's watch key, so the only way to
    * turn it on is to run a watched command (`docs/specs/alert.md`).
    */
   function runWatchedCommand(id: string, commandLine = 'longtask'): void {
     manager.setWatchedCommands(['longtask']);
-    runCommand(id, commandLine);
+    runCommand(manager, id, commandLine);
   }
 
   describe('helper Sessions', () => {
@@ -82,18 +52,18 @@ describe('AlertManager in isolation', () => {
       const seen = recordingClaimant(HELPER, true);
       manager.setHelper(HELPER, true);
       runWatchedCommand(HELPER);
-      driveToBusy(HELPER);
+      driveToBusy(manager, HELPER);
       settle();
       applyTerminalProtocolEvents(manager, HELPER, [{ kind: 'notification', notification: { source: 'OSC 9', title: null, body: 'done' } }]);
       applyTerminalProtocolEvents(manager, HELPER, [{ kind: 'progress', progress: { state: 'normal', percent: 40 } }]);
-      engage(HELPER);
+      engage(manager, HELPER);
       manager.acknowledge(HELPER, { input: true });
-      disengage();
+      leave(manager);
       manager.toggleTodo(HELPER);
       manager.clearTodo(HELPER);
       manager.seed(HELPER, { todo: true });
       manager.onResize(HELPER);
-      finishCommand(HELPER, 1);
+      finishCommand(manager, HELPER, 1);
       manager.onExit(HELPER, 0);
       vi.advanceTimersByTime(10_000);
 
@@ -115,8 +85,8 @@ describe('AlertManager in isolation', () => {
     it('keeps the command a helper was running when it is promoted mid-command', () => {
       manager.setWatchedCommands(['claude']);
       manager.setHelper(HELPER, true);
-      runCommand(HELPER, 'claude');
-      driveToBusy(HELPER);
+      runCommand(manager, HELPER, 'claude');
+      driveToBusy(manager, HELPER);
 
       const states: boolean[] = [];
       manager.onStateChange((id, state) => { if (id === HELPER) states.push(state.watchingEnabled); });
@@ -130,11 +100,27 @@ describe('AlertManager in isolation', () => {
       expect(manager.getState(HELPER).status).toBe('ALERT_RINGING');
     });
 
+    it('never counts the echo of input into a helper as work', () => {
+      manager.setWatchedCommands(['claude']);
+      manager.setHelper(HELPER, true);
+      runCommand(manager, HELPER, 'claude');
+      manager.onData(HELPER);
+      // Typing a draft at ~7 keys a second, each key echoed.
+      for (let t = 0; t < 3_000; t += 140) {
+        manager.acknowledge(HELPER, { input: true });
+        vi.advanceTimersByTime(8);
+        manager.onData(HELPER);
+        vi.advanceTimersByTime(132);
+      }
+      manager.setHelper(HELPER, false);
+      expect(manager.getState(HELPER).status).toBe('NOTHING_TO_SHOW');
+    });
+
     it('never replays a completion suppressed before promotion', () => {
       manager.setWatchedCommands(['claude']);
       manager.setHelper(HELPER, true);
-      runCommand(HELPER, 'claude');
-      driveToBusy(HELPER);
+      runCommand(manager, HELPER, 'claude');
+      driveToBusy(manager, HELPER);
       settle();
       applyTerminalProtocolEvents(manager, HELPER, [{ kind: 'notification', notification: { source: 'OSC 9', title: null, body: 'done' } }]);
 
@@ -145,18 +131,18 @@ describe('AlertManager in isolation', () => {
 
     it('does not ring the exit of a command it never saw engaged', () => {
       manager.setHelper(HELPER, true);
-      runCommand(HELPER, 'npm run build');
+      runCommand(manager, HELPER, 'npm run build');
       manager.setHelper(HELPER, false);
       vi.advanceTimersByTime(30_000);
-      finishCommand(HELPER);
+      finishCommand(manager, HELPER);
       expect(manager.getState(HELPER).status).toBe('WATCHING_DISABLED');
 
       // The ordinary seen rule applies from promotion on.
-      runCommand(HELPER, 'npm run build');
-      engage(HELPER);
-      disengage();
+      runCommand(manager, HELPER, 'npm run build');
+      engage(manager, HELPER);
+      leave(manager);
       vi.advanceTimersByTime(30_000);
-      finishCommand(HELPER);
+      finishCommand(manager, HELPER);
       expect(manager.getState(HELPER).status).toBe('ALERT_RINGING');
     });
 
@@ -220,7 +206,7 @@ describe('AlertManager in isolation', () => {
     manager.setDeferAlertsUntilQuiet(false);
     runWatchedCommand(id);
 
-    driveToBusy(id);
+    driveToBusy(manager, id);
     expect(manager.getState(id).status).toBe('BUSY');
 
     settle();
@@ -244,14 +230,14 @@ describe('AlertManager in isolation', () => {
     const id = 'reset-test';
     runWatchedCommand(id);
 
-    engage(id);
-    driveToBusy(id);
+    engage(manager, id);
+    driveToBusy(manager, id);
 
-    disengage();
+    leave(manager);
     settle();
     expect(manager.getState(id).status).toBe('ALERT_RINGING');
 
-    engage(id);
+    engage(manager, id);
     manager.acknowledge(id, { input: false });
     manager.onData(id);
     expect(manager.getState(id).status).not.toBe('ALERT_RINGING');
@@ -266,7 +252,7 @@ describe('AlertManager in isolation', () => {
 
     runWatchedCommand(id);
 
-    driveToBusy(id);
+    driveToBusy(manager, id);
 
     settle();
 
@@ -279,28 +265,6 @@ describe('AlertManager in isolation', () => {
   // (The previous soft-TODO bucket tests — 4-keypress letter-striking, per-letter
   //  recovery timers — were removed when TODO was simplified to a plain boolean.)
 
-  /** Two output bursts across the busy-candidate gap: NOTHING_TO_SHOW -> BUSY. */
-  function driveToBusy(id: string): void {
-    manager.onData(id);
-    vi.advanceTimersByTime(1_600);
-    manager.onData(id);
-    manager.onData(id);
-  }
-
-  /** Silence through both quiet windows: BUSY -> MIGHT_NEED_ATTENTION -> settled. */
-  function settle(): void {
-    vi.advanceTimersByTime(2_000);
-    vi.advanceTimersByTime(3_000);
-  }
-
-  /** One output chunk a second for `ms`, which never lets the Session go quiet. */
-  function heartbeat(id: string, ms: number): void {
-    for (let elapsed = 0; elapsed < ms; elapsed += 1_000) {
-      vi.advanceTimersByTime(1_000);
-      manager.onData(id);
-    }
-  }
-
   /** Register a claimant that records every event it is offered and answers `claims`. */
   function recordingClaimant(id: string, claims: boolean): CompletionEvent[] {
     const seen: CompletionEvent[] = [];
@@ -313,7 +277,7 @@ describe('AlertManager in isolation', () => {
 
   function driveToRinging(id: string): void {
     runWatchedCommand(id);
-    driveToBusy(id);
+    driveToBusy(manager, id);
     settle();
     expect(manager.getState(id).status).toBe('ALERT_RINGING');
   }
@@ -327,9 +291,9 @@ describe('AlertManager in isolation', () => {
     } else if (source === 'report') {
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'needs input' });
     } else {
-      armCommandExit(id);
+      armCommandExit(manager, id);
       vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
-      finishCommand(id);
+      finishCommand(manager, id);
     }
     expect(manager.getState(id).status).toBe('ALERT_RINGING');
   }
@@ -403,10 +367,10 @@ describe('AlertManager in isolation', () => {
       ['equally rich text replaces the older', text, otherText, otherText],
     ] as const)('%s', (_label, first, joining, shown) => {
       const id = `detail-rank-${_label}`;
-      armCommandExit(id, 'make');
+      armCommandExit(manager, id, 'make');
       vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
       for (const detail of [first, joining]) {
-        if (detail.source === 'COMMAND_EXIT') finishCommand(id, 2);
+        if (detail.source === 'COMMAND_EXIT') finishCommand(manager, id, 2);
         else manager.notifyFromProtocol(id, detail);
       }
       expect(manager.getState(id)).toMatchObject({ status: 'ALERT_RINGING', notification: shown });
@@ -565,13 +529,13 @@ describe('AlertManager in isolation', () => {
   });
 
   it.each([
-    ['commandStart', (id: string) => runCommand(id, 'other-tool')],
-    ['commandFinish', (id: string) => finishCommand(id, 130)],
+    ['commandStart', (id: string) => runCommand(manager, id, 'other-tool')],
+    ['commandFinish', (id: string) => finishCommand(manager, id, 130)],
     ['promptStart', (id: string) => manager.applyTerminalSemanticEvents(id, [{ type: 'promptStart' }])],
     ['PTY exit', (id: string) => manager.onExit(id, 137)],
   ] as const)('%s silently ends a progress cycle the program abandoned', (boundary, cross) => {
     const id = `abandoned-progress-${boundary}`;
-    runCommand(id, 'cargo build');
+    runCommand(manager, id, 'cargo build');
     manager.updateProtocolProgress(id, { state: 'normal', percent: 40 });
     expect(manager.getState(id).status).toBe('OSC_NOTIF_BUSY');
 
@@ -589,7 +553,7 @@ describe('AlertManager in isolation', () => {
     ['error', [{ state: 'normal', percent: 40 }, { state: 'error', percent: null }], 'cargo build reported an error'],
   ] as const)('names the running command in a progress %s title', (_outcome, updates, title) => {
     const id = `progress-title-${_outcome}`;
-    runCommand(id, 'cargo build --release');
+    runCommand(manager, id, 'cargo build --release');
     for (const update of updates) manager.updateProtocolProgress(id, update);
     expect(manager.getState(id).notification).toMatchObject({ source: 'OSC 9;4', title });
   });
@@ -610,7 +574,7 @@ describe('AlertManager in isolation', () => {
 
   it('leaves a notification still deferred behind animation pending when dismissed', () => {
     const id = 'dismiss-keeps-deferral';
-    driveToBusy(id);
+    driveToBusy(manager, id);
     manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Build finished' });
     expect(manager.getState(id)).toMatchObject({ status: 'WATCHING_DISABLED', todo: false, notification: null });
 
@@ -625,9 +589,9 @@ describe('AlertManager in isolation', () => {
   });
 
   it('protocol completion is held while the Session is engaged', () => {
-    const id = 'osc-progress-attention';
+    const id = 'osc-progress-held';
 
-    engage(id);
+    engage(manager, id);
     manager.updateProtocolProgress(id, { state: 'normal', percent: 25 });
     expect(manager.getState(id).status).toBe('OSC_NOTIF_BUSY');
 
@@ -640,9 +604,9 @@ describe('AlertManager in isolation', () => {
   });
 
   it('direct protocol notifications are held while the Session is engaged', () => {
-    const id = 'osc-notification-attention';
+    const id = 'osc-notification-held';
 
-    engage(id);
+    engage(manager, id);
     manager.notifyFromProtocol(id, { source: 'OSC 777', title: 'done', body: 'Build finished' });
 
     expect(manager.getState(id)).toMatchObject({
@@ -653,12 +617,12 @@ describe('AlertManager in isolation', () => {
   });
 
   it('engaged direct notifications do not clear active protocol progress', () => {
-    const id = 'osc-progress-with-attended-notification';
+    const id = 'osc-progress-with-held-notification';
 
     manager.updateProtocolProgress(id, { state: 'normal', percent: 25 });
     expect(manager.getState(id).status).toBe('OSC_NOTIF_BUSY');
 
-    engage(id);
+    engage(manager, id);
     manager.notifyFromProtocol(id, { source: 'OSC 777', title: 'done', body: 'Build finished' });
 
     expect(manager.getState(id)).toMatchObject({
@@ -669,9 +633,9 @@ describe('AlertManager in isolation', () => {
   });
 
   it('terminal bell notifications are held while the Session is engaged', () => {
-    const id = 'terminal-bell-attention';
+    const id = 'terminal-bell-held';
 
-    engage(id);
+    engage(manager, id);
     applyTerminalProtocolEvents(manager, id, [
       { kind: 'notification', notification: { source: 'BEL', title: 'Terminal bell', body: null } },
     ]);
@@ -686,11 +650,11 @@ describe('AlertManager in isolation', () => {
   it('arms and rings when an engaged command is left before exiting', () => {
     const id = 'command-exit';
 
-    armCommandExit(id);
+    armCommandExit(manager, id);
     expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
 
     vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
-    finishCommand(id);
+    finishCommand(manager, id);
     expect(manager.getState(id)).toMatchObject({
       status: 'ALERT_RINGING',
       todo: true,
@@ -706,7 +670,7 @@ describe('AlertManager in isolation', () => {
       if (_id === id && state.episode) seen.push(state.episode.id);
     });
 
-    armCommandExit(id);
+    armCommandExit(manager, id);
     vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
 
     applyTerminalProtocolEvents(manager, id, [
@@ -718,7 +682,7 @@ describe('AlertManager in isolation', () => {
 
     // The exit joins the ring the bell opened: one enriched summons, so no
     // consumer keyed on the episode may deliver a second time.
-    finishCommand(id);
+    finishCommand(manager, id);
     const again = manager.getState(id);
     expect(again.status).toBe(rung.status);
     expect(again.episode?.id).toBe(rung.episode?.id);
@@ -752,7 +716,7 @@ describe('AlertManager in isolation', () => {
   it('finishes an armed command-exit watch when the PTY exits without commandFinish', () => {
     const id = 'command-exit-pty-exit';
 
-    armCommandExit(id, 'exec pnpm build');
+    armCommandExit(manager, id, 'exec pnpm build');
     vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
     expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
 
@@ -767,11 +731,11 @@ describe('AlertManager in isolation', () => {
   it('clears a command-exit watch whose quick PTY exit was engaged', () => {
     const id = 'command-exit-pty-exit-unarmed';
 
-    engage(id);
-    runCommand(id, 'exec true');
+    engage(manager, id);
+    runCommand(manager, id, 'exec true');
 
     manager.onExit(id, 0);
-    goIdle(id);
+    goIdle(manager, id);
 
     expect(manager.getState(id)).toMatchObject({
       status: 'WATCHING_DISABLED',
@@ -783,11 +747,11 @@ describe('AlertManager in isolation', () => {
   it('does not ring the exit of a command shorter than the minimum runtime', () => {
     const id = 'quick-command-exit';
 
-    armCommandExit(id, 'git status');
+    armCommandExit(manager, id, 'git status');
     vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime - 1);
     expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
 
-    finishCommand(id);
+    finishCommand(manager, id);
     expect(manager.getState(id)).toMatchObject({
       status: 'WATCHING_DISABLED',
       todo: false,
@@ -798,15 +762,15 @@ describe('AlertManager in isolation', () => {
   it('disarms command-exit alerts while the user is back, holding the finish', () => {
     const id = 'command-exit-return';
 
-    armCommandExit(id, 'pnpm test');
+    armCommandExit(manager, id, 'pnpm test');
     vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
     expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
 
-    engage(id);
+    engage(manager, id);
     expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
 
     vi.advanceTimersByTime(1_000);
-    finishCommand(id);
+    finishCommand(manager, id);
     expect(manager.getState(id)).toMatchObject({
       status: 'WATCHING_DISABLED',
       todo: false,
@@ -821,10 +785,10 @@ describe('AlertManager in isolation', () => {
     manager.setWatchedCommands(['claude']);
     expect(manager.getState(id).watchingEnabled).toBe(false);
 
-    runCommand(id, 'claude --print hello');
+    runCommand(manager, id, 'claude --print hello');
     expect(manager.getState(id).watchingEnabled).toBe(true);
 
-    finishCommand(id);
+    finishCommand(manager, id);
     expect(manager.getState(id).watchingEnabled).toBe(false);
   });
 
@@ -832,7 +796,7 @@ describe('AlertManager in isolation', () => {
     const id = 'rule-finish-notify';
     manager.setWatchedCommands(['claude']);
 
-    runCommand(id, 'claude');
+    runCommand(manager, id, 'claude');
     expect(manager.getState(id).watchingEnabled).toBe(true);
 
     // Subscribe after the command has started so we only capture the finish.
@@ -841,7 +805,7 @@ describe('AlertManager in isolation', () => {
       if (_id === id) watching.push(state.watchingEnabled);
     });
 
-    finishCommand(id);
+    finishCommand(manager, id);
 
     expect(manager.getState(id).watchingEnabled).toBe(false);
     // The off-transition must reach subscribers, not just live getState reads.
@@ -852,7 +816,7 @@ describe('AlertManager in isolation', () => {
     const id = 'rule-watch-key';
     manager.setWatchedCommands(['claude']);
 
-    runCommand(id, 'FOO=1 env BAR=2 /usr/local/bin/claude --resume');
+    runCommand(manager, id, 'FOO=1 env BAR=2 /usr/local/bin/claude --resume');
     expect(manager.getState(id).watchingEnabled).toBe(true);
   });
 
@@ -868,7 +832,7 @@ describe('AlertManager in isolation', () => {
     const id = 'rule-miss';
     manager.setWatchedCommands(['claude']);
 
-    runCommand(id, 'git status');
+    runCommand(manager, id, 'git status');
     expect(manager.getState(id).watchingEnabled).toBe(false);
   });
 
@@ -884,7 +848,7 @@ describe('AlertManager in isolation', () => {
   it('applies a newly added rule to every session already running that command', () => {
     const a = 'rule-live-a';
     const b = 'rule-live-b';
-    for (const id of [a, b]) runCommand(id, 'claude');
+    for (const id of [a, b]) runCommand(manager, id, 'claude');
     expect(manager.getState(a).watchingEnabled).toBe(false);
     expect(manager.getState(b).watchingEnabled).toBe(false);
 
@@ -903,7 +867,7 @@ describe('AlertManager in isolation', () => {
 
     // The command exiting turns WATCHING off; the ring it already raised is
     // the whole point of watching, so it has to survive.
-    finishCommand(id);
+    finishCommand(manager, id);
     expect(manager.getState(id)).toMatchObject({
       status: 'ALERT_RINGING',
       watchingEnabled: false,
@@ -934,8 +898,8 @@ describe('AlertManager in isolation', () => {
     const id = 'runner-script-rule';
     const ringsUnder = (rules: string[]): boolean => {
       manager.setWatchedCommands(rules);
-      runCommand(id, 'pnpm run dev');
-      driveToBusy(id);
+      runCommand(manager, id, 'pnpm run dev');
+      driveToBusy(manager, id);
       settle();
       const ringing = manager.getState(id).status === 'ALERT_RINGING';
       manager.clearTodo(id);
@@ -952,8 +916,8 @@ describe('AlertManager in isolation', () => {
   it('keeps a WATCHING ring whose command another rule still covers', () => {
     const id = 'ring-survives-covered';
     manager.setWatchedCommands(['pnpm', 'pnpm dev']);
-    runCommand(id, 'pnpm dev');
-    driveToBusy(id);
+    runCommand(manager, id, 'pnpm dev');
+    driveToBusy(manager, id);
     settle();
     expect(manager.getState(id).status).toBe('ALERT_RINGING');
 
@@ -966,7 +930,7 @@ describe('AlertManager in isolation', () => {
   it('silences a latched WATCHING ring when its rule is removed after command exit', () => {
     const id = 'exited-ring-dies-with-rule';
     driveToRinging(id);
-    finishCommand(id);
+    finishCommand(manager, id);
 
     expect(manager.getState(id)).toMatchObject({
       status: 'ALERT_RINGING',
@@ -990,13 +954,13 @@ describe('AlertManager in isolation', () => {
       completions.push(event);
       return false;
     });
-    driveToBusy(id);
+    driveToBusy(manager, id);
     manager.applyTerminalSemanticEvents(id, [{ type }]);
     settle();
     expect(completions).toEqual([]);
 
     // The prompt reset forgets old work but keeps observing subsequent output.
-    driveToBusy(id);
+    driveToBusy(manager, id);
     settle();
     expect(completions).toEqual([{ kind: 'settled' }]);
   });
@@ -1006,7 +970,7 @@ describe('AlertManager in isolation', () => {
     // Keep the ring through the tail's output: deferral would withdraw it.
     manager.setDeferAlertsUntilQuiet(false);
     driveToRinging(id);
-    driveToBusy(id);
+    driveToBusy(manager, id);
 
     manager.dismissAlert(id);
     settle();
@@ -1016,9 +980,9 @@ describe('AlertManager in isolation', () => {
   it('drives the detector on an unwatched Session without showing it or ringing', () => {
     const id = 'unwatched-detector';
     manager.setWatchedCommands(['claude']);
-    runCommand(id, 'git log');
+    runCommand(manager, id, 'git log');
 
-    driveToBusy(id);
+    driveToBusy(manager, id);
     // The detector is BUSY underneath, but no rule matches, so nothing shows.
     expect(manager.getState(id)).toMatchObject({
       status: 'WATCHING_DISABLED',
@@ -1036,9 +1000,9 @@ describe('AlertManager in isolation', () => {
 
   it('shows the live detector state when a rule is enabled mid-command', () => {
     const id = 'enable-rule-mid-busy';
-    runCommand(id, 'claude');
+    runCommand(manager, id, 'claude');
 
-    driveToBusy(id);
+    driveToBusy(manager, id);
     expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
 
     // Turning the rule on mid-run reveals what the detector already knows
@@ -1051,11 +1015,11 @@ describe('AlertManager in isolation', () => {
   });
 
   it('holds a WATCHING ring when the Session is engaged at the settle', () => {
-    const id = 'settle-while-attended';
+    const id = 'settle-while-engaged';
     runWatchedCommand(id);
-    engage(id);
+    engage(manager, id);
 
-    driveToBusy(id);
+    driveToBusy(manager, id);
     expect(manager.getState(id).status).toBe('BUSY');
 
     settle();
@@ -1071,12 +1035,12 @@ describe('AlertManager in isolation', () => {
   it('keeps a latched ring through post-exit output and drops it with the rule', () => {
     const id = 'latched-ring-vs-live-detector';
     driveToRinging(id);
-    finishCommand(id);
+    finishCommand(manager, id);
 
     // The detector keeps running after the command ends, so shell-prompt output
     // can drive a whole extra busy/settle cycle. Neither the output nor the
     // unwatched settle may disturb the ring the watched run already raised.
-    driveToBusy(id);
+    driveToBusy(manager, id);
     vi.advanceTimersByTime(5_000);
     expect(manager.getState(id)).toMatchObject({
       status: 'ALERT_RINGING',
@@ -1094,8 +1058,8 @@ describe('AlertManager in isolation', () => {
   it('keeps the command-exit arm hidden while WATCHING owns the display', () => {
     const id = 'arm-under-watching';
     runWatchedCommand(id);
-    engage(id);
-    disengage();
+    engage(manager, id);
+    leave(manager);
 
     // Armed underneath, but the monitor's own state is what is published.
     expect(manager.getState(id).status).toBe('NOTHING_TO_SHOW');
@@ -1106,7 +1070,7 @@ describe('AlertManager in isolation', () => {
 
   it('defers a protocol alert with no settings call, because deferral ships on', () => {
     const id = 'defer-shipped-default';
-    driveToBusy(id);
+    driveToBusy(manager, id);
 
     manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Done' });
     expect(manager.getState(id)).toMatchObject({ todo: false, notification: null });
@@ -1122,7 +1086,7 @@ describe('AlertManager in isolation', () => {
 
     it('defers a protocol alert behind an unwatched confirmed-busy detector', () => {
       const id = 'defer-unwatched-protocol';
-      driveToBusy(id);
+      driveToBusy(manager, id);
       // The detector is private while no WATCHING rule matches.
       expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
 
@@ -1149,7 +1113,7 @@ describe('AlertManager in isolation', () => {
       manager.onStateChange((_id, state) => {
         if (_id === id) seen.push(state.status);
       });
-      driveToBusy(id);
+      driveToBusy(manager, id);
 
       manager.updateProtocolProgress(id, { state: 'normal', percent: 40 });
       expect(manager.getState(id).status).toBe('OSC_NOTIF_BUSY');
@@ -1163,7 +1127,7 @@ describe('AlertManager in isolation', () => {
 
     it('counts MIGHT_NEED_ATTENTION as confirmed busy and keeps its remaining deadline', () => {
       const id = 'defer-might-need-attention';
-      driveToBusy(id);
+      driveToBusy(manager, id);
       vi.advanceTimersByTime(2_000);
 
       manager.notifyFromProtocol(id, { source: 'OSC 777', title: 'Done', body: null });
@@ -1185,7 +1149,7 @@ describe('AlertManager in isolation', () => {
 
     it('extends the quiet deadline when meaningful output resumes', () => {
       const id = 'defer-output-extension';
-      driveToBusy(id);
+      driveToBusy(manager, id);
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Done' });
 
       vi.advanceTimersByTime(4_000);
@@ -1198,11 +1162,11 @@ describe('AlertManager in isolation', () => {
 
     it('does not defer an authoritative command-exit alert', () => {
       const id = 'immediate-command-exit';
-      armCommandExit(id);
+      armCommandExit(manager, id);
       vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
-      driveToBusy(id);
+      driveToBusy(manager, id);
 
-      finishCommand(id);
+      finishCommand(manager, id);
       expect(manager.getState(id)).toMatchObject({
         status: 'ALERT_RINGING',
         todo: true,
@@ -1212,12 +1176,12 @@ describe('AlertManager in isolation', () => {
 
     it('folds a pending terminal notification into an immediate command-exit ring', () => {
       const id = 'command-exit-with-pending-notification';
-      armCommandExit(id);
+      armCommandExit(manager, id);
       vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
-      driveToBusy(id);
+      driveToBusy(manager, id);
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Build done' });
 
-      finishCommand(id);
+      finishCommand(manager, id);
 
       expect(manager.getState(id)).toMatchObject({
         status: 'ALERT_RINGING',
@@ -1229,13 +1193,13 @@ describe('AlertManager in isolation', () => {
 
     it('carries a deferred terminal notification across a command-boundary reset', () => {
       const id = 'defer-notification-across-finish';
-      runCommand(id);
-      driveToBusy(id);
+      runCommand(manager, id);
+      driveToBusy(manager, id);
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Done' });
 
       // This unarmed command finish resets the detector but is not itself an
       // alert; the pending terminal notification still owns its quiet deadline.
-      finishCommand(id);
+      finishCommand(manager, id);
       expect(manager.getState(id)).toMatchObject({
         status: 'WATCHING_DISABLED',
         todo: false,
@@ -1251,8 +1215,8 @@ describe('AlertManager in isolation', () => {
     });
 
     it('cancels deferred delivery when the user acknowledges', () => {
-      const id = 'defer-attended';
-      driveToBusy(id);
+      const id = 'defer-acknowledged';
+      driveToBusy(manager, id);
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Done' });
 
       manager.acknowledge(id, { input: false });
@@ -1266,7 +1230,7 @@ describe('AlertManager in isolation', () => {
 
     it('releases rather than drops deferred delivery when the setting is disabled', () => {
       const id = 'defer-disable';
-      driveToBusy(id);
+      driveToBusy(manager, id);
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Done' });
 
       manager.setDeferAlertsUntilQuiet(false);
@@ -1275,10 +1239,10 @@ describe('AlertManager in isolation', () => {
 
     it('rings a deferred notification at the ceiling when output never goes quiet', () => {
       const id = 'defer-ceiling';
-      driveToBusy(id);
+      driveToBusy(manager, id);
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'build failed' });
 
-      heartbeat(id, cfg.alert.deferCeiling - 1_000);
+      heartbeat(manager, id, cfg.alert.deferCeiling - 1_000);
       vi.advanceTimersByTime(999);
       expect(manager.getState(id).status).toBe('WATCHING_DISABLED');
       vi.advanceTimersByTime(1);
@@ -1290,11 +1254,11 @@ describe('AlertManager in isolation', () => {
 
     it('keeps the first deferral time when a later notification replaces the detail', () => {
       const id = 'defer-ceiling-latest';
-      driveToBusy(id);
+      driveToBusy(manager, id);
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'First' });
-      heartbeat(id, 20_000);
+      heartbeat(manager, id, 20_000);
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Second' });
-      heartbeat(id, cfg.alert.deferCeiling - 21_000);
+      heartbeat(manager, id, cfg.alert.deferCeiling - 21_000);
       vi.advanceTimersByTime(1_000);
       expect(manager.getState(id)).toMatchObject({
         status: 'ALERT_RINGING',
@@ -1304,7 +1268,7 @@ describe('AlertManager in isolation', () => {
 
     it('coalesces repeated protocol alerts to the latest detail', () => {
       const id = 'defer-latest-protocol';
-      driveToBusy(id);
+      driveToBusy(manager, id);
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'First' });
       manager.notifyFromProtocol(id, { source: 'OSC 777', title: 'Second', body: null });
 
@@ -1318,7 +1282,7 @@ describe('AlertManager in isolation', () => {
 
     it('keeps richer deferred detail over a later bell', () => {
       const id = 'defer-richer-protocol';
-      driveToBusy(id);
+      driveToBusy(manager, id);
       // An agent's message, then a bell in the next read while it still animates.
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Build finished: 3 warnings' });
       manager.notifyFromProtocol(id, { source: 'BEL', title: 'Terminal bell', body: null });
@@ -1332,7 +1296,7 @@ describe('AlertManager in isolation', () => {
 
     it('offers a completion once and queues nothing when a claimant takes it', () => {
       const id = 'defer-claimed';
-      driveToBusy(id);
+      driveToBusy(manager, id);
       const seen = recordingClaimant(id, true);
 
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Done' });
@@ -1351,7 +1315,7 @@ describe('AlertManager in isolation', () => {
 
     it('drops deferred delivery when the Session is removed', () => {
       const id = 'defer-remove';
-      driveToBusy(id);
+      driveToBusy(manager, id);
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'Done' });
 
       manager.remove(id);
@@ -1392,7 +1356,7 @@ describe('AlertManager in isolation', () => {
       const seen = recordingClaimant(id, true);
 
       runWatchedCommand(id);
-      driveToBusy(id);
+      driveToBusy(manager, id);
       settle();
 
       expect(seen).toEqual([{ kind: 'settled' }]);
@@ -1410,7 +1374,7 @@ describe('AlertManager in isolation', () => {
       const seen = recordingClaimant(id, false);
 
       runWatchedCommand(id);
-      driveToBusy(id);
+      driveToBusy(manager, id);
       settle();
 
       expect(seen).toEqual([{ kind: 'settled' }]);
@@ -1421,10 +1385,10 @@ describe('AlertManager in isolation', () => {
       const id = 'observe-quick-command';
       const seen = recordingClaimant(id, false);
 
-      engage(id);
-      runCommand(id, 'npm test');
+      engage(manager, id);
+      runCommand(manager, id, 'npm test');
       vi.advanceTimersByTime(1_000);
-      finishCommand(id);
+      finishCommand(manager, id);
 
       expect(seen).toEqual([{
         kind: 'commandFinished',
@@ -1445,11 +1409,11 @@ describe('AlertManager in isolation', () => {
       const id = 'claim-command-exit';
       const seen = recordingClaimant(id, true);
 
-      armCommandExit(id);
+      armCommandExit(manager, id);
       vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
       expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
 
-      finishCommand(id);
+      finishCommand(manager, id);
 
       expect(seen).toEqual([{
         kind: 'commandFinished',
@@ -1558,7 +1522,7 @@ describe('AlertManager in isolation', () => {
         return false;
       });
 
-      armCommandExit(id);
+      armCommandExit(manager, id);
       vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
       expect(manager.getState(id).status).toBe('COMMAND_EXIT_ARMED');
 
@@ -1692,7 +1656,7 @@ describe('AlertManager in isolation', () => {
       // A second command starts. The latched ring above belongs to the first —
       // `startCommandExitWatch` preserves `ALERT_RINGING` on purpose — so it
       // cannot be an answer about the one now running.
-      runCommand(id, 'npm test');
+      runCommand(manager, id, 'npm test');
 
       const handle = manager.awaitCompletion(id, { until: 'exit', timeoutMs: NEVER });
       const outcome = watch(handle);
@@ -1700,7 +1664,7 @@ describe('AlertManager in isolation', () => {
       // Not consumed either: the ring is still the human's.
       expect(manager.getState(id).status).toBe('ALERT_RINGING');
 
-      finishCommand(id);
+      finishCommand(manager, id);
       expect(await outcome()).toMatchObject({ kind: 'resolved', cause: 'exit' });
     });
 
@@ -1736,7 +1700,7 @@ describe('AlertManager in isolation', () => {
       expect(manager.getState(id).status).toBe('ALERT_RINGING');
 
       // The turn finishes for real, and that is what answers the caller.
-      driveToBusy(id);
+      driveToBusy(manager, id);
       settle();
       expect(await outcome()).toMatchObject({ kind: 'resolved', cause: 'quiet' });
     });
@@ -1757,14 +1721,14 @@ describe('AlertManager in isolation', () => {
       const outcome = watch(handle);
       expect(await outcome()).toBeNull();
 
-      driveToBusy(id);
+      driveToBusy(manager, id);
       settle();
       expect(await outcome()).toMatchObject({ kind: 'resolved', cause: 'quiet' });
     });
 
     it('leaves a standing bell alone under --until exit and keeps waiting', async () => {
       const id = 'await-exit-ignores-standing-bell';
-      runCommand(id);
+      runCommand(manager, id);
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'warning' });
 
       const handle = manager.awaitCompletion(id, { until: 'exit', timeoutMs: NEVER });
@@ -1776,14 +1740,14 @@ describe('AlertManager in isolation', () => {
     });
 
     it('never acknowledges, so the next completion still rings the human', async () => {
-      const id = 'await-does-not-attend';
+      const id = 'await-does-not-acknowledge';
       driveToRinging(id);
 
       const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
       expect(await handle.promise).toMatchObject({ kind: 'resolved', cause: 'quiet' });
 
       // An acknowledgement would record the settle as answered.
-      driveToBusy(id);
+      driveToBusy(manager, id);
       settle();
       expect(manager.getState(id).status).toBe('ALERT_RINGING');
     });
@@ -1795,7 +1759,7 @@ describe('AlertManager in isolation', () => {
       runWatchedCommand(id);
 
       const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
-      driveToBusy(id);
+      driveToBusy(manager, id);
       settle();
 
       expect(await handle.promise).toEqual({ kind: 'resolved', cause: 'quiet', waitedMs: 6_600 });
@@ -1811,18 +1775,18 @@ describe('AlertManager in isolation', () => {
     it.each([
       ['BUSY', 0, 5_000],
       ['MIGHT_NEED_ATTENTION', 2_000, 3_000],
-    ] as const)('keeps a parked quiet await armed when the user engages and acknowledges during %s', async (_status, beforeAttendMs, afterAttendMs) => {
-      const id = `await-quiet-attended-${_status}`;
+    ] as const)('keeps a parked quiet await armed when the user engages and acknowledges during %s', async (_status, beforeAcknowledgeMs, afterAcknowledgeMs) => {
+      const id = `await-quiet-acknowledged-${_status}`;
       runWatchedCommand(id);
 
       const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
-      driveToBusy(id);
-      vi.advanceTimersByTime(beforeAttendMs);
+      driveToBusy(manager, id);
+      vi.advanceTimersByTime(beforeAcknowledgeMs);
       expect(manager.getState(id).status).toBe(_status);
 
-      engage(id);
+      engage(manager, id);
       manager.acknowledge(id, { input: false });
-      vi.advanceTimersByTime(afterAttendMs);
+      vi.advanceTimersByTime(afterAcknowledgeMs);
 
       expect(await handle.promise).toEqual({
         kind: 'resolved',
@@ -1833,18 +1797,18 @@ describe('AlertManager in isolation', () => {
 
     it('resolves exit on a command finish under --until quiet', async () => {
       const id = 'await-quiet-finish';
-      runCommand(id);
+      runCommand(manager, id);
 
       const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
       vi.advanceTimersByTime(4_000);
-      finishCommand(id, 2);
+      finishCommand(manager, id, 2);
 
       expect(await handle.promise).toEqual({ kind: 'resolved', cause: 'exit', waitedMs: 4_000 });
     });
 
     it('resolves bell on an OSC 9 notification under --until quiet', async () => {
       const id = 'await-quiet-bell';
-      runCommand(id);
+      runCommand(manager, id);
 
       const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
       manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'needs input' });
@@ -1855,7 +1819,7 @@ describe('AlertManager in isolation', () => {
 
     it('resolves bell on a progress completion and still clears the cycle', async () => {
       const id = 'await-quiet-progress';
-      runCommand(id);
+      runCommand(manager, id);
       manager.updateProtocolProgress(id, { state: 'normal', percent: 25 });
       expect(manager.getState(id).status).toBe('OSC_NOTIF_BUSY');
 
@@ -1882,11 +1846,11 @@ describe('AlertManager in isolation', () => {
       expect(await outcome()).toBeNull();
 
       // ...and neither must falling silent mid-run.
-      driveToBusy(id);
+      driveToBusy(manager, id);
       settle();
       expect(await outcome()).toBeNull();
 
-      finishCommand(id);
+      finishCommand(manager, id);
       expect(await outcome()).toMatchObject({ kind: 'resolved', cause: 'exit' });
     });
 
@@ -1926,11 +1890,11 @@ describe('AlertManager in isolation', () => {
       const handle = manager.awaitCompletion(id, { until: 'exit', timeoutMs: NEVER });
       const outcome = watch(handle);
 
-      runCommand(id);
+      runCommand(manager, id);
       vi.advanceTimersByTime(AWAIT_GRACE_MS);
       expect(await outcome()).toBeNull();
 
-      finishCommand(id);
+      finishCommand(manager, id);
       expect(await outcome()).toMatchObject({ kind: 'resolved', cause: 'exit' });
     });
 
@@ -1942,17 +1906,17 @@ describe('AlertManager in isolation', () => {
       // The window's usual test under `quiet` is output, but a command that
       // starts silently is still running — `idle` would report "nothing was
       // running" about a live foreground command.
-      runCommand(id);
+      runCommand(manager, id);
       vi.advanceTimersByTime(AWAIT_GRACE_MS * 2);
       expect(await outcome()).toBeNull();
 
-      finishCommand(id);
+      finishCommand(manager, id);
       expect(await outcome()).toMatchObject({ kind: 'resolved', cause: 'exit' });
     });
 
     it('runs no grace window at all while a foreground command is running', async () => {
       const id = 'await-grace-suppressed';
-      runCommand(id);
+      runCommand(manager, id);
 
       const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
       const outcome = watch(handle);
@@ -1975,7 +1939,7 @@ describe('AlertManager in isolation', () => {
 
     it('times out host-side on the caller ceiling', async () => {
       const id = 'await-timeout';
-      runCommand(id);
+      runCommand(manager, id);
 
       const handle = manager.awaitCompletion(id, { until: 'exit', timeoutMs: 10_000 });
       const outcome = watch(handle);
@@ -2003,7 +1967,7 @@ describe('AlertManager in isolation', () => {
 
     it('reports the command exit first when the PTY dies mid-run', async () => {
       const id = 'await-pty-exit-running';
-      runCommand(id);
+      runCommand(manager, id);
 
       const handle = manager.awaitCompletion(id, { until: 'exit', timeoutMs: NEVER });
       vi.advanceTimersByTime(3_000);
@@ -2045,7 +2009,7 @@ describe('AlertManager in isolation', () => {
 
     it('reports death when the Session is removed', async () => {
       const id = 'await-removed';
-      runCommand(id);
+      runCommand(manager, id);
 
       const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
       vi.advanceTimersByTime(1_000);
@@ -2056,7 +2020,7 @@ describe('AlertManager in isolation', () => {
 
     it('cancels everything still parked when the manager is disposed', async () => {
       const id = 'await-disposed';
-      runCommand(id);
+      runCommand(manager, id);
       const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
 
       manager.dispose();
@@ -2069,7 +2033,7 @@ describe('AlertManager in isolation', () => {
 
     it('cancels a parked await and ignores a cancel after it settled', async () => {
       const id = 'await-cancel';
-      runCommand(id);
+      runCommand(manager, id);
 
       const cancelled = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
       vi.advanceTimersByTime(750);
@@ -2097,7 +2061,7 @@ describe('AlertManager in isolation', () => {
       const secondOutcome = watch(second);
       expect(manager.getState(id).awaited).toBe(true);
 
-      driveToBusy(id);
+      driveToBusy(manager, id);
       settle();
 
       // Each wakes on the first signal that qualifies for *its* condition.
@@ -2105,14 +2069,14 @@ describe('AlertManager in isolation', () => {
       expect(await secondOutcome()).toBeNull();
       expect(manager.getState(id).awaited).toBe(true);
 
-      finishCommand(id);
+      finishCommand(manager, id);
       expect(await secondOutcome()).toMatchObject({ kind: 'resolved', cause: 'exit' });
       expect(manager.getState(id).awaited).toBe(false);
     });
 
     it('wakes two identical awaits on the same completion', async () => {
       const id = 'await-two-identical';
-      runCommand(id);
+      runCommand(manager, id);
 
       const first = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
       const second = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
@@ -2130,7 +2094,7 @@ describe('AlertManager in isolation', () => {
       manager.onStateChange((_id, state) => {
         if (_id === id) flags.push(state.awaited);
       });
-      runCommand(id);
+      runCommand(manager, id);
       expect(flags.at(-1)).toBe(false);
 
       const timedOut = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: 5_000 });
diff --git a/lib/src/lib/alert-manager.ts b/lib/src/lib/alert-manager.ts
index b05cf683c..63cdecb1f 100644
--- a/lib/src/lib/alert-manager.ts
+++ b/lib/src/lib/alert-manager.ts
@@ -86,9 +86,13 @@ const PROGRESS_TITLES: Record<ProgressOutcome, { afterCommand: string; alone: st
 /** What raised a ring: a watched settle, a terminal report, or a command exit. */
 type RingSource = 'watching' | 'report' | 'exit';
 
-/** A source `Ring.sources` lists; `watching` carries state of its own. */
+/** A source `SourceSet.sources` lists; `watching` carries state of its own. */
 type ListedRingSource = Exclude<RingSource, 'watching'>;
 
+/** The listed sources in escalation order: a report last, so it joins the
+ *  ring an exit opened rather than opening one the exit then joins. */
+const LISTED_RING_SOURCES: readonly ListedRingSource[] = ['exit', 'report'];
+
 /** The `watching` source: the rule key that raised it, and whether output has
  *  arrived since it joined, which the detector cannot tell
  *  (`docs/specs/alert.md` -> Await). */
@@ -97,18 +101,33 @@ interface WatchingSource {
   outputSince: boolean;
 }
 
-/** Why a source leaves the ring: `answered` by an await, as a user verb
- *  answers the whole ring, or `invalidated` by resumed work or rule removal
- *  (`watchingLeft`). */
-type RingWithdrawal = 'answered' | 'invalidated';
-
-/** The one ring latch a Session holds (`docs/specs/alert.md` -> Public State). */
-interface Ring {
-  episode: AlertEpisode;
+/** The sources a ring holds, or held completions would raise. */
+interface SourceSet {
   /** An array, not a Set: the live-transfer snapshot crosses IPC as JSON. */
   sources: ListedRingSource[];
   /** Removing the rule that covers its key withdraws it. */
   watching: WatchingSource | null;
+}
+
+function addSource(set: SourceSet, source: ListedRingSource | WatchingSource): void {
+  if (typeof source !== 'string') set.watching = source;
+  else if (!set.sources.includes(source)) set.sources.push(source);
+}
+
+/** Take `watching` off a set. Returns whether that left it empty. */
+function dropWatching(set: SourceSet): boolean {
+  set.watching = null;
+  return set.sources.length === 0;
+}
+
+/** Output arrived: a settle this set carries no longer describes the Session. */
+function noteOutput(set: SourceSet | null): void {
+  if (set?.watching) set.watching.outputSince = true;
+}
+
+/** The one ring latch a Session holds (`docs/specs/alert.md` -> Public State). */
+interface Ring extends SourceSet {
+  episode: AlertEpisode;
   /** What this ring found, restored whole when a withdrawal empties it. */
   prior: { todo: TodoState; notification: ActivityNotification | null };
 }
@@ -118,9 +137,7 @@ interface Ring {
  * (`docs/specs/alert.md` -> Completion events): the sources they would have
  * raised, and the richest detail among them.
  */
-interface HeldCompletion {
-  sources: ListedRingSource[];
-  watching: WatchingSource | null;
+interface HeldCompletion extends SourceSet {
   detail: ActivityNotification;
 }
 
@@ -147,6 +164,10 @@ export type EngagementLapse = 'idle' | 'leave';
 
 const NOT_ENGAGED: Engagement = { present: false, focusId: null };
 
+/** The one viewer of a manager that serves a single renderer realm: the fake
+ *  adapter's, a standalone window's, the browser-sidecar page's. */
+export const LOCAL_VIEWER = 'local';
+
 export function normalizeActivityNotification(value: unknown): ActivityNotification | null {
   if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
   const record = value as Record<string, unknown>;
@@ -308,8 +329,8 @@ export class AlertManager {
   private removed = new Set<string>();
   private claimants = new Map<string, Set<CompletionClaimant>>();
   private awaits = new Map<string, AwaitGroup>();
-  /** Renderer realms by viewer id; a default (absent, unfocused) viewer is not kept. */
-  private viewers = new Map<string, Engagement>();
+  /** Each present viewer's focus. An absent viewer engages nothing, so it is not kept. */
+  private viewers = new Map<string, string | null>();
   private listeners = new Set<(id: string, state: AlertState) => void>();
   private lastEmitted = new Map<string, AlertState>();
   private watchedCommands = new Set<string>();
@@ -332,8 +353,7 @@ export class AlertManager {
    * already-normalized blob; the sinks below revalidate anyway.
    */
   applySettings(settings: AlertSettings): void {
-    // `inactivityTimeoutMs` is the renderer's presence window: presence arrives
-    // here already computed (`setViewer`), so the manager keeps no timer for it.
+    // `inactivityTimeoutMs` is read only by the renderer's presence tracker.
     this.setDeferAlertsUntilQuiet(settings.deferAlertsUntilQuiet);
   }
 
@@ -377,8 +397,7 @@ export class AlertManager {
     // The echo of the user's own keystroke is not the program working.
     if (this.inEchoWindow(entry)) return;
     entry.detector.onData();
-    if (entry.ring?.watching) entry.ring.watching.outputSince = true;
-    if (entry.held?.watching) entry.held.watching.outputSince = true;
+    for (const set of [entry.ring, entry.held]) noteOutput(set);
     entry.ackedQuiet = false;
     this.eachWaiter(id, (waiter) => waiter.onOutput());
   }
@@ -466,8 +485,7 @@ export class AlertManager {
    */
   private withdrawResumedWatchingRing(entry: AlertEntry): void {
     if (!this.deferAlertsUntilQuiet || !entry.detector.isConfirmedBusy()) return;
-    this.withdrawRingSource(entry, 'watching', 'invalidated');
-    this.withdrawHeldWatching(entry);
+    this.invalidateWatching(entry, () => true);
   }
 
   /**
@@ -477,20 +495,18 @@ export class AlertManager {
    * works at a prompt.
    */
   private withdrawUncoveredWatchingRing(entry: AlertEntry): void {
-    if (watchRuleFor(this.watchedCommands, entry.ring?.watching?.key ?? null) === null) {
-      this.withdrawRingSource(entry, 'watching', 'invalidated');
-    }
-    if (watchRuleFor(this.watchedCommands, entry.held?.watching?.key ?? null) === null) {
-      this.withdrawHeldWatching(entry);
-    }
+    this.invalidateWatching(entry, (key) => watchRuleFor(this.watchedCommands, key) === null);
   }
 
-  /** The held twin of a `watching` withdrawal: the settle it kept is void. */
-  private withdrawHeldWatching(entry: AlertEntry): void {
-    const held = entry.held;
-    if (held?.watching == null) return;
-    held.watching = null;
-    if (held.sources.length === 0) entry.held = null;
+  /**
+   * Void the `watching` source whose key `voids` names, ringing or held alike,
+   * leaving the detector running. Never an acknowledgement: a ring left empty
+   * restores what it found, a hold left empty goes.
+   */
+  private invalidateWatching(entry: AlertEntry, voids: (key: string) => boolean): void {
+    const { ring, held } = entry;
+    if (ring?.watching && voids(ring.watching.key) && dropWatching(ring)) this.closeRing(entry, ring);
+    if (held?.watching && voids(held.watching.key) && dropWatching(held)) entry.held = null;
   }
 
   /** A busy Session went quiet. Whether that rings is decided downstream. */
@@ -556,41 +572,56 @@ export class AlertManager {
         // the ring so it outlives the command that raised it.
         const key = entry.commandExitWatch?.watchKey;
         if (!key || !this.isWatching(entry)) break;
-        this.raiseOrHold(id, entry, { key, outputSince: false }, { source: 'WATCHING', title: `${key} went quiet`, body: null });
-        this.notify(id);
+        this.holdOrDeliver(id, entry, { key, outputSince: false }, { source: 'WATCHING', title: `${key} went quiet`, body: null });
         break;
       }
       case 'commandFinished':
         if (!event.seen || event.ranMs < cfg.alert.commandExitMinRuntime) break;
         // A shell-reported exit is authoritative, so recent animation never
         // delays it. The detector only gates in-band terminal notifications.
-        this.raiseOrHold(id, entry, 'exit', {
+        this.holdOrDeliver(id, entry, 'exit', {
           source: 'COMMAND_EXIT',
           title: 'Command finished',
           body: formatCommandExitBody(event.displayCommand, event.exitCode),
         });
-        // If a terminal notification was already waiting, it can enrich this
-        // ring (or hold) immediately; keeping its timer would publish stale
-        // detail later.
-        if (entry.deferred !== null) this.flushDeferredNotification(id, entry);
-        else this.notify(id);
         break;
       case 'notification':
-        if (this.engaged(id)) {
-          this.hold(entry, 'report', event.notification);
-          // A progress cycle was already cleared before dispatch, so publish
-          // that; a plain direct notification changes nothing and dedupes away.
-          this.notify(id);
-          break;
-        }
-        this.deliverReport(id, entry, event.notification);
+        this.holdOrDeliver(id, entry, 'report', event.notification);
         break;
     }
     return false;
   }
 
-  /** A report reaching the ring rules unengaged: the acknowledged-state check,
-   *  then animation deferral. The one path for a live report and a held one. */
+  /**
+   * The one path from a completion that may ring to the ring: a live one, a
+   * deferred report coming due (`deferrable` false — its deferral is over),
+   * and an escalated hold alike. Engaged, it is held for engagement to end;
+   * otherwise a report goes through the acknowledged-state check and animation
+   * deferral, and anything else rings. Publishes, including a progress cycle
+   * the caller cleared before dispatch.
+   */
+  private holdOrDeliver(
+    id: string,
+    entry: AlertEntry,
+    source: ListedRingSource | WatchingSource,
+    detail: ActivityNotification,
+    deferrable = true,
+  ): void {
+    if (this.engaged(id)) {
+      this.hold(entry, source, detail);
+    } else if (source === 'report' && deferrable) {
+      this.deliverReport(id, entry, detail);
+      return;
+    } else {
+      this.raiseRing(entry, source, detail);
+    }
+    // A terminal notification already waiting on animation joins the exit's
+    // ring (or hold) now; keeping its timer would publish stale detail later.
+    if (source === 'exit' && entry.deferred !== null) this.flushDeferredNotification(id, entry);
+    else this.notify(id);
+  }
+
+  /** An unengaged report: the acknowledged-state check, then animation deferral. */
   private deliverReport(id: string, entry: AlertEntry, notification: ActivityNotification): void {
     if (entry.ring === null && entry.ackedQuiet) {
       // A report about the state the user just acknowledged updates the
@@ -721,12 +752,12 @@ export class AlertManager {
    * a report always.
    */
   private consumeAwaitableRing(entry: AlertEntry, until: AwaitUntil): AwaitCause | null {
-    if (until === 'quiet' && this.withdrawRingSource(entry, 'report', 'answered')) return 'bell';
-    if (entry.commandExitWatch === null && this.withdrawRingSource(entry, 'exit', 'answered')) return 'exit';
+    if (until === 'quiet' && this.withdrawRingSource(entry, 'report')) return 'bell';
+    if (entry.commandExitWatch === null && this.withdrawRingSource(entry, 'exit')) return 'exit';
     if (
       until === 'quiet'
       && entry.ring?.watching?.outputSince === false
-      && this.withdrawRingSource(entry, 'watching', 'answered')
+      && this.withdrawRingSource(entry, 'watching')
     ) return 'quiet';
     return null;
   }
@@ -992,9 +1023,8 @@ export class AlertManager {
     const deferred = entry.deferred;
     if (deferred === null) return;
     this.clearDeferredNotification(entry);
-    // Due while engaged, it waits on engagement instead of animation.
-    this.raiseOrHold(id, entry, 'report', deferred.notification);
-    this.notify(id);
+    // Never deferred again; due while engaged, it waits on engagement instead.
+    this.holdOrDeliver(id, entry, 'report', deferred.notification, false);
   }
 
   private clearDeferredNotification(entry: AlertEntry): void {
@@ -1031,65 +1061,69 @@ export class AlertManager {
     } else {
       entry.notification = richer(entry.notification, detail);
     }
-    if (typeof source !== 'string') ring.watching = source;
-    else if (!ring.sources.includes(source)) ring.sources.push(source);
+    addSource(ring, source);
   }
 
   /**
-   * Take one source off the ring. A ring left empty restores what it found —
-   * the TODO, and the notification it replaced. Never an acknowledgement.
-   * Returns whether the source was there.
+   * An await answers one source, taking it off the ring. Never an
+   * acknowledgement: a ring left empty restores what it found. Returns whether
+   * the source was there.
    */
-  private withdrawRingSource(entry: AlertEntry, source: RingSource, why: RingWithdrawal): boolean {
+  private withdrawRingSource(entry: AlertEntry, source: RingSource): boolean {
     const ring = entry.ring;
     if (ring === null) return false;
+    let empty: boolean;
     if (source === 'watching') {
       if (ring.watching === null) return false;
-      ring.watching = null;
+      empty = dropWatching(ring);
     } else {
       if (!ring.sources.includes(source)) return false;
       ring.sources = ring.sources.filter((candidate) => candidate !== source);
+      empty = ring.sources.length === 0 && ring.watching === null;
     }
-    if (ring.sources.length === 0 && ring.watching === null) {
-      entry.ring = null;
-      entry.todo = ring.prior.todo;
-      entry.notification = ring.prior.notification;
-    }
-    if (source === 'watching') this.watchingLeft(entry, why);
+    if (empty) this.closeRing(entry, ring);
+    if (source === 'watching') this.answeredWatching(entry);
     return true;
   }
 
+  /** A ring left empty is withdrawn, restoring the TODO and notification it found. */
+  private closeRing(entry: AlertEntry, ring: Ring): void {
+    entry.ring = null;
+    entry.todo = ring.prior.todo;
+    entry.notification = ring.prior.notification;
+  }
+
   /**
-   * A user verb stops the summons: the whole ring goes, with any delivery still
-   * deferred behind animation — a path that stops summoning the user must never
-   * leave a timer that summons them a second later. TODO is the caller's to
-   * decide. Only clearing an actual ring records an acknowledgement.
+   * A user verb stops the summons: the whole ring goes, with whatever was held
+   * or deferred behind animation — a path that stops summoning the user must
+   * never leave a timer that summons them a second later. TODO is the caller's
+   * to decide. Only clearing a ring or a hold records an acknowledgement.
    */
   private clearRingForUser(entry: AlertEntry): void {
     this.clearDeferredNotification(entry);
-    const { ring, held } = entry;
-    entry.held = null;
-    if (ring === null && held === null) return;
+    const sets = [entry.ring, entry.held];
+    if (sets.every((set) => set === null)) return;
     entry.ring = null;
+    entry.held = null;
     entry.ackedQuiet = true;
-    if (ring?.watching || held?.watching) this.watchingLeft(entry, 'answered');
+    if (sets.some((set) => set?.watching)) this.answeredWatching(entry);
   }
 
   /**
-   * The ring's `watching` source is gone. An answer starts the detector over,
-   * so the tail of the run that rang cannot settle again straight away; an
-   * invalidation leaves it running. Last in its caller: the reset publishes.
+   * A `watching` source was answered: start the detector over, so the tail of
+   * the run that rang cannot settle again straight away. Last in its caller:
+   * the reset publishes.
    */
-  private watchingLeft(entry: AlertEntry, why: RingWithdrawal): void {
-    if (why === 'answered') entry.detector.reset();
+  private answeredWatching(entry: AlertEntry): void {
+    entry.detector.reset();
   }
 
   // --- Engagement (`docs/specs/alert.md` -> Engagement) ---
 
   /** Some present viewer points at `id`. The only thing the ring rules read. */
   private engaged(id: string): boolean {
-    for (const viewer of this.viewers.values()) {
-      if (viewer.present && viewer.focusId === id) return true;
+    for (const focusId of this.viewers.values()) {
+      if (focusId === id) return true;
     }
     return false;
   }
@@ -1101,25 +1135,24 @@ export class AlertManager {
    * unchanged escalates them, anything else drops them.
    */
   setViewer(viewerId: string, state: Engagement, lapse?: EngagementLapse): void {
-    const previous = this.viewers.get(viewerId) ?? NOT_ENGAGED;
-    const next: Engagement = {
-      present: state.present === true,
-      focusId: typeof state.focusId === 'string' ? state.focusId : null,
-    };
-    if (previous.present === next.present && previous.focusId === next.focusId) return;
-    // Only this viewer moved, so only the two Sessions it pointed at can change.
-    const touched = [...new Set([previous.focusId, next.focusId])]
-      .filter((id): id is string => id !== null)
+    // Revalidated: in VS Code the shape crosses from the webview.
+    const focusId = typeof state?.focusId === 'string' ? state.focusId : null;
+    const before = this.viewers.get(viewerId);
+    const after = state?.present === true ? focusId : undefined;
+    if (before === after) return;
+    // Only this viewer moved, so only the Sessions it pointed at can change.
+    const touched = [...new Set([before, after])]
+      .filter((id): id is string => typeof id === 'string')
       .map((id) => ({ id, was: this.engaged(id) }));
-    if (next.present || next.focusId !== null) this.viewers.set(viewerId, next);
-    else this.viewers.delete(viewerId);
+    if (after === undefined) this.viewers.delete(viewerId);
+    else this.viewers.set(viewerId, after);
 
     for (const { id, was } of touched) {
       const entry = this.entries.get(id);
       if (!entry || this.inert(id) || this.engaged(id) === was) continue;
       if (!was) {
         this.markSeen(entry);
-      } else if (lapse === 'idle' && previous.focusId === id && next.focusId === id) {
+      } else if (lapse === 'idle' && focusId === id) {
         this.escalateHeld(id, entry);
       } else {
         // An explicit disengage: focus moved, or the window left.
@@ -1137,17 +1170,19 @@ export class AlertManager {
 
   /**
    * A human interacted with the Session. Both kinds clear the ring and whatever
-   * it held or deferred, and mark the running command seen; `input` (keys,
-   * paste, drop) also turns TODO off and opens the echo window. Never creates
-   * an entry: an id with none — a browser Surface — has nothing to clear.
+   * it held or deferred, and mark the running command seen; `input` — keys, a
+   * paste, a drop, acknowledged as the host writes them — also turns TODO off
+   * and opens the echo window, a helper's included, since its detector runs.
+   * Never creates an entry: an id with none — a browser Surface — has nothing
+   * to clear.
    */
-  acknowledge(id: string, options: { input: boolean }): void {
-    if (this.inert(id)) return;
+  acknowledge(id: string, { input }: { input: boolean }): void {
     const entry = this.entries.get(id);
-    if (!entry) return;
+    if (!entry || this.suspendedForTransfer.has(id)) return;
+    if (input) entry.echoUntil = Date.now() + cfg.alert.echoWindow;
+    if (this.helpers.has(id)) return;
     this.markSeen(entry);
-    if (options.input) {
-      entry.echoUntil = Date.now() + cfg.alert.echoWindow;
+    if (input) {
       this.setTodoForUser(id, entry, false);
       return;
     }
@@ -1163,39 +1198,24 @@ export class AlertManager {
     return Date.now() < entry.echoUntil;
   }
 
-  /** Ring, unless the Session is engaged: then hold for engagement to end. */
-  private raiseOrHold(
-    id: string,
-    entry: AlertEntry,
-    source: ListedRingSource | WatchingSource,
-    detail: ActivityNotification,
-  ): void {
-    if (this.engaged(id)) this.hold(entry, source, detail);
-    else this.raiseRing(entry, source, detail);
-  }
-
   private hold(entry: AlertEntry, source: ListedRingSource | WatchingSource, detail: ActivityNotification): void {
     const held = entry.held ??= { sources: [], watching: null, detail };
     held.detail = richer(held.detail, detail);
-    if (typeof source !== 'string') held.watching = source;
-    else if (!held.sources.includes(source)) held.sources.push(source);
+    addSource(held, source);
   }
 
   /**
-   * Presence lapsed from inactivity with focus unchanged: what was held rings
-   * now, through the ordinary raise path — a report through the acknowledged
-   * check and animation deferral, a settle or exit directly — with the richest
-   * held detail.
+   * Presence lapsed from inactivity with focus unchanged: each held source takes
+   * the path it would have taken unengaged, with the richest held detail.
    */
   private escalateHeld(id: string, entry: AlertEntry): void {
     const held = entry.held;
     if (held === null) return;
     entry.held = null;
-    if (held.watching !== null) this.raiseRing(entry, held.watching, held.detail);
-    if (held.sources.includes('exit')) this.raiseRing(entry, 'exit', held.detail);
-    if (held.sources.includes('report')) this.deliverReport(id, entry, held.detail);
-    // A ring is open now, so a notification still waiting on animation joins it.
-    if (entry.ring !== null && entry.deferred !== null) this.flushDeferredNotification(id, entry);
+    if (held.watching !== null) this.holdOrDeliver(id, entry, held.watching, held.detail);
+    for (const source of LISTED_RING_SOURCES) {
+      if (held.sources.includes(source)) this.holdOrDeliver(id, entry, source, held.detail);
+    }
   }
 
   // --- Alert controls ---
diff --git a/lib/src/lib/alert-resumed-output.test.ts b/lib/src/lib/alert-resumed-output.test.ts
index a24baa463..f9d738e4e 100644
--- a/lib/src/lib/alert-resumed-output.test.ts
+++ b/lib/src/lib/alert-resumed-output.test.ts
@@ -10,8 +10,10 @@ import { startAlertSpeech } from './alert-speech';
 import { applyAlertSettingsFromHost, DEFAULT_ALERT_SETTINGS } from './alert-settings';
 import { clearTerminalActivity, setTerminalActivity } from './session-activity-store';
 import { cfg } from '../cfg';
+import { armCommandExit, driveToBusy, finishCommand, runCommand, settle } from './alert-manager-test-utils';
 
 const ID = 'resumed-watched-work';
+const WATCHED = 'longtask';
 const DELAY = 10_000;
 let manager: AlertManager;
 let stopSpeech: () => void;
@@ -19,33 +21,6 @@ let stopPush: () => void;
 let spoken: ReturnType<typeof vi.fn>;
 let pushed: ReturnType<typeof vi.fn>;
 
-function busy(): void {
-  manager.onData(ID);
-  vi.advanceTimersByTime(1_600);
-  manager.onData(ID);
-  manager.onData(ID);
-}
-
-function settle(): void {
-  vi.advanceTimersByTime(5_000);
-}
-
-/** Start the watched command the way shell integration reports it. */
-function runCommand(): void {
-  manager.applyTerminalSemanticEvents(ID, [
-    { type: 'commandLine', commandLine: 'longtask' },
-    { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-  ]);
-}
-
-/** Run it seen and then left: armed, so its exit rings once it has outlasted
- *  `cfg.alert.commandExitMinRuntime`. */
-function armCommandExit(): void {
-  manager.setViewer('viewer', { present: true, focusId: ID });
-  runCommand();
-  manager.setViewer('viewer', { present: false, focusId: null }, 'leave');
-}
-
 beforeEach(() => {
   vi.useFakeTimers();
   clearTerminalActivity();
@@ -59,8 +34,8 @@ beforeEach(() => {
   manager = new AlertManager();
   manager.setDeferAlertsUntilQuiet(true);
   manager.onStateChange(setTerminalActivity);
-  manager.setWatchedCommands(['longtask']);
-  runCommand();
+  manager.setWatchedCommands([WATCHED]);
+  runCommand(manager, ID, WATCHED);
   stopSpeech = startAlertSpeech();
   // Push shares the ring watcher; exercise its delivery decision without a Relay.
   stopPush = watchUnattendedRings({ sink: 'push', subscribe: () => () => {}, enabled: () => true, delayMs: () => DELAY, fire: pushed });
@@ -78,13 +53,13 @@ afterEach(() => {
 
 describe('WATCHING output resuming before alarm delivery', () => {
   it('cancels pending speech and push during animation, then gives the next settle a fresh delay', () => {
-    busy();
+    driveToBusy(manager, ID);
     settle();
     const firstEpisode = manager.getState(ID).episode;
     expect(firstEpisode?.id).toBeTruthy();
     expect(manager.getState(ID).status).toBe('ALERT_RINGING');
     vi.advanceTimersByTime(1_000);
-    busy();
+    driveToBusy(manager, ID);
     expect(manager.getState(ID)).toMatchObject({ status: 'BUSY', todo: false, episode: null });
 
     // Keep animating across the old speech deadline, as in the marked incident.
@@ -109,7 +84,7 @@ describe('WATCHING output resuming before alarm delivery', () => {
   });
 
   it('keeps an inferred ring through a short redraw that never confirms BUSY', () => {
-    busy();
+    driveToBusy(manager, ID);
     settle();
     manager.onData(ID);
     vi.advanceTimersByTime(62);
@@ -121,9 +96,9 @@ describe('WATCHING output resuming before alarm delivery', () => {
 
   it('retains the latched ring with animation deferral disabled', () => {
     manager.setDeferAlertsUntilQuiet(false);
-    busy();
+    driveToBusy(manager, ID);
     settle();
-    busy();
+    driveToBusy(manager, ID);
     expect(manager.getState(ID).status).toBe('ALERT_RINGING');
     vi.advanceTimersByTime(DELAY);
     expect(spoken).toHaveBeenCalledOnce();
@@ -134,43 +109,43 @@ describe('WATCHING output resuming before alarm delivery', () => {
     manager.dismissAlert(ID);
     const receipt = manager.getState(ID);
     expect(receipt.todo).toBe(true);
-    busy();
+    driveToBusy(manager, ID);
     settle();
-    busy();
+    driveToBusy(manager, ID);
     expect(manager.getState(ID)).toMatchObject({ status: 'BUSY', todo: true, notification: receipt.notification });
   });
 
   it.each(['report', 'exit'] as const)('preserves an authoritative %s source behind WATCHING', (source) => {
-    armCommandExit();
+    armCommandExit(manager, ID, WATCHED);
     vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
-    busy();
+    driveToBusy(manager, ID);
     settle();
     if (source === 'report') {
       manager.notifyFromProtocol(ID, { source: 'OSC 9', title: 'input needed', body: null });
     } else {
-      manager.applyTerminalSemanticEvents(ID, [{ type: 'commandFinish', exitCode: 0 }]);
+      finishCommand(manager, ID);
       expect(manager.getState(ID).notification?.source).toBe('COMMAND_EXIT');
-      runCommand();
+      runCommand(manager, ID, WATCHED);
     }
     const episode = manager.getState(ID).episode;
-    busy();
+    driveToBusy(manager, ID);
     expect(manager.getState(ID)).toMatchObject({ status: 'ALERT_RINGING', episode });
     vi.advanceTimersByTime(DELAY);
     expect(spoken).toHaveBeenCalledOnce();
   });
 
   it('keeps a WATCHING ring through output after the watched command exits', () => {
-    busy();
+    driveToBusy(manager, ID);
     settle();
-    manager.applyTerminalSemanticEvents(ID, [{ type: 'commandFinish', exitCode: 0 }]);
-    busy();
+    finishCommand(manager, ID);
+    driveToBusy(manager, ID);
     expect(manager.getState(ID)).toMatchObject({ status: 'ALERT_RINGING', watchingEnabled: false });
   });
 
   it('keeps the resumed detector alive so an await can claim its next settle', async () => {
-    busy();
+    driveToBusy(manager, ID);
     settle();
-    busy();
+    driveToBusy(manager, ID);
     const handle = manager.awaitCompletion(ID, { until: 'quiet', timeoutMs: 60_000 });
     settle();
     expect(await handle.promise).toMatchObject({ kind: 'resolved', cause: 'quiet' });
diff --git a/lib/src/lib/alert-runtime-transfer.test.ts b/lib/src/lib/alert-runtime-transfer.test.ts
index 236235a6e..a3b5c6360 100644
--- a/lib/src/lib/alert-runtime-transfer.test.ts
+++ b/lib/src/lib/alert-runtime-transfer.test.ts
@@ -2,18 +2,11 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AlertManager } from './alert-manager';
 import { QuiesceDetector } from './quiesce-detector';
 import { cfg } from '../cfg';
+import { engage, goIdle, heartbeat, runCommand } from './alert-manager-test-utils';
 
 beforeEach(() => vi.useFakeTimers());
 afterEach(() => vi.useRealTimers());
 
-/** One output chunk a second for `ms`, which never lets the pane go quiet. */
-function heartbeat(target: AlertManager, ms: number): void {
-  for (let elapsed = 0; elapsed < ms; elapsed += 1_000) {
-    vi.advanceTimersByTime(1_000);
-    target.onData('pane');
-  }
-}
-
 describe('live alert handoff', () => {
   it('preserves an episode across live handoff, while cold restore remains silent', () => {
     const source = new AlertManager();
@@ -40,11 +33,8 @@ describe('live alert handoff', () => {
 
   it('leaves behind what the source held, and arms the command it saw', () => {
     const source = new AlertManager();
-    source.setViewer('source', { present: true, focusId: 'pane' });
-    source.applyTerminalSemanticEvents('pane', [
-      { type: 'commandLine', commandLine: 'pnpm build' },
-      { type: 'commandStart', source: 'osc633_E', startedAt: Date.now() },
-    ]);
+    engage(source, 'pane');
+    runCommand(source, 'pane');
     source.notifyFromProtocol('pane', { source: 'OSC 9', title: null, body: 'needs input' });
     const snapshot = source.pauseForTransfer('pane')!;
 
@@ -52,8 +42,8 @@ describe('live alert handoff', () => {
     target.resumeFromTransfer('pane', JSON.parse(JSON.stringify(snapshot)));
     expect(target.getState('pane').status).toBe('COMMAND_EXIT_ARMED');
     // Leaving the source window disengaged it: nothing it held escalates here.
-    target.setViewer('target', { present: true, focusId: 'pane' });
-    target.setViewer('target', { present: false, focusId: 'pane' }, 'idle');
+    engage(target, 'pane');
+    goIdle(target, 'pane');
     expect(target.getState('pane')).toMatchObject({ todo: false, notification: null });
     source.dispose(); target.dispose();
   });
@@ -65,11 +55,11 @@ describe('live alert handoff', () => {
     source.onData('pane'); source.onData('pane');
     // Confirmed busy, so the report waits behind the animation.
     source.notifyFromProtocol('pane', { source: 'OSC 9', title: null, body: 'Done' });
-    heartbeat(source, 20_000);
+    heartbeat(source, 'pane', 20_000);
     const snapshot = source.pauseForTransfer('pane')!;
     const target = new AlertManager();
     target.resumeFromTransfer('pane', JSON.parse(JSON.stringify(snapshot)));
-    heartbeat(target, cfg.alert.deferCeiling - 21_000);
+    heartbeat(target, 'pane', cfg.alert.deferCeiling - 21_000);
     expect(target.getState('pane').status).toBe('WATCHING_DISABLED');
     vi.advanceTimersByTime(1_000);
     expect(target.getState('pane').status).toBe('ALERT_RINGING');
diff --git a/lib/src/lib/alert-settings-model.ts b/lib/src/lib/alert-settings-model.ts
index 09fd1c6fd..5bfc37c93 100644
--- a/lib/src/lib/alert-settings-model.ts
+++ b/lib/src/lib/alert-settings-model.ts
@@ -31,7 +31,7 @@ export const MAX_DELAY_MS = 600_000;
 
 export const DEFAULT_ALERT_SETTINGS: AlertSettings = {
   // cfg.ts stays the single source of the shipped default.
-  inactivityTimeoutMs: cfg.alert.userAttention,
+  inactivityTimeoutMs: cfg.alert.inactivityTimeout,
   deferAlertsUntilQuiet: true,
   speakEnabled: false,
   speakDelayMs: 10_000,
diff --git a/lib/src/lib/alert-settings.test.ts b/lib/src/lib/alert-settings.test.ts
index 930b95fd4..18dcb3096 100644
--- a/lib/src/lib/alert-settings.test.ts
+++ b/lib/src/lib/alert-settings.test.ts
@@ -47,7 +47,7 @@ describe('normalizeAlertSettings', () => {
   });
 
   it('seeds the inactivity timeout from cfg so cfg.ts stays the shipped default', () => {
-    expect(DEFAULT_ALERT_SETTINGS.inactivityTimeoutMs).toBe(cfg.alert.userAttention);
+    expect(DEFAULT_ALERT_SETTINGS.inactivityTimeoutMs).toBe(cfg.alert.inactivityTimeout);
   });
 
   it('ships animation deferral on', () => {
diff --git a/lib/src/lib/engagement.test.ts b/lib/src/lib/engagement.test.ts
index d634ce964..e5f35a2c6 100644
--- a/lib/src/lib/engagement.test.ts
+++ b/lib/src/lib/engagement.test.ts
@@ -1,7 +1,7 @@
 /** @vitest-environment jsdom */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { FakePtyAdapter, setPlatform } from './platform';
-import { publishEngagementFocus, retainEngagementReporter, withdrawEngagementFocus } from './engagement';
+import { publishEngagementFocus, retainEngagementReporter } from './engagement';
 import { getAlertSettings } from './alert-settings';
 
 let platform: FakePtyAdapter;
@@ -19,7 +19,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
-  withdrawEngagementFocus(wall);
+  publishEngagementFocus(wall, null);
   release();
   platform.shutdown();
   vi.restoreAllMocks();
@@ -54,16 +54,26 @@ describe('engagement reporter', () => {
   });
 
   it('reports changes only, never each input event', () => {
+    window.dispatchEvent(new Event('pointermove'));
     publishEngagementFocus(wall, 'pane-a');
     for (let i = 0; i < 50; i++) window.dispatchEvent(new Event('pointermove'));
     publishEngagementFocus(wall, 'pane-a');
 
     expect(report.mock.calls).toEqual([
-      [{ present: false, focusId: 'pane-a' }, undefined],
+      [{ present: true, focusId: null }, undefined],
       [{ present: true, focusId: 'pane-a' }, undefined],
     ]);
   });
 
+  it('sends no focus change while absent, and the focus it has once present', () => {
+    publishEngagementFocus(wall, 'pane-a');
+    publishEngagementFocus(wall, 'pane-b');
+    expect(report).not.toHaveBeenCalled();
+
+    window.dispatchEvent(new Event('keydown'));
+    expect(report.mock.calls).toEqual([[{ present: true, focusId: 'pane-b' }, undefined]]);
+  });
+
   it('names an inactivity lapse as idle, keeping the focus', () => {
     publishEngagementFocus(wall, 'pane-a');
     window.dispatchEvent(new Event('keydown'));
@@ -87,7 +97,7 @@ describe('engagement reporter', () => {
     second();
     expect(report.mock.calls.at(-1)).toEqual([{ present: true, focusId: 'pane-a' }, undefined]);
 
-    withdrawEngagementFocus(wall);
+    publishEngagementFocus(wall, null);
     release();
     expect(report.mock.calls.at(-1)).toEqual([{ present: false, focusId: null }, 'leave']);
     release = retainEngagementReporter();
diff --git a/lib/src/lib/engagement.ts b/lib/src/lib/engagement.ts
index 89ef18ab2..17b1fc288 100644
--- a/lib/src/lib/engagement.ts
+++ b/lib/src/lib/engagement.ts
@@ -2,6 +2,7 @@ import type { Engagement, EngagementLapse } from './alert-manager';
 import { getAlertSettings, subscribeToAlertSettings } from './alert-settings';
 import { getPlatformOrNull } from './platform';
 import { createPresenceTracker, type PresenceTracker } from './presence';
+import { createRefCount } from './ref-count';
 
 /**
  * This renderer realm's engagement reporter (`docs/specs/alert.md` ->
@@ -10,60 +11,49 @@ import { createPresenceTracker, type PresenceTracker } from './presence';
  * never per input event.
  */
 
-/** Each mounted Wall's focus; only the visible Wall's is ever non-null. */
-const focusBySlot = new Map<object, string | null>();
-let holders = 0;
+/** Each mounted Wall's focus; only the visible Wall ever publishes one. */
+const focusBySlot = new Map<object, string>();
+/** Presence tracking while any Wall holds the reporter. */
 let presence: PresenceTracker | null = null;
-let releasePresence: (() => void) | null = null;
 let reported: Engagement = { present: false, focusId: null };
 
 function currentFocus(): string | null {
-  for (const focusId of focusBySlot.values()) {
-    if (focusId !== null) return focusId;
-  }
+  for (const focusId of focusBySlot.values()) return focusId;
   return null;
 }
 
 function report(lapse?: EngagementLapse): void {
-  const next: Engagement = { present: presence?.present ?? false, focusId: currentFocus() };
-  if (next.present === reported.present && next.focusId === reported.focusId) return;
-  reported = next;
-  getPlatformOrNull()?.alertEngagement(next, next.present ? undefined : lapse);
+  const present = presence?.present ?? false;
+  const focusId = currentFocus();
+  // An absent realm engages nothing, so its focus moving is no news.
+  if (present === reported.present && (focusId === reported.focusId || !present)) return;
+  reported = { present, focusId };
+  getPlatformOrNull()?.alertEngagement(reported, present ? undefined : lapse);
 }
 
 /** Hold the reporter while a Wall is mounted; the first holder starts presence
  *  tracking, the last one's release reports the realm gone. */
-export function retainEngagementReporter(): () => void {
-  if (holders++ === 0) {
-    const tracker = createPresenceTracker({ timeoutMs: () => getAlertSettings().inactivityTimeoutMs });
-    const unsubscribe = tracker.subscribe((_present, lapse) => report(lapse));
+export const retainEngagementReporter = createRefCount({
+  onFirst: () => {
+    const tracker = createPresenceTracker({
+      timeoutMs: () => getAlertSettings().inactivityTimeoutMs,
+      onChange: (_present, lapse) => report(lapse),
+    });
     const unsubscribeSettings = subscribeToAlertSettings(() => tracker.refresh());
     presence = tracker;
-    releasePresence = () => {
-      unsubscribe();
+    return () => {
       unsubscribeSettings();
       tracker.dispose();
+      presence = null;
+      report('leave');
     };
-  }
-  let released = false;
-  return () => {
-    if (released) return;
-    released = true;
-    if (--holders > 0) return;
-    releasePresence?.();
-    releasePresence = null;
-    presence = null;
-    report('leave');
-  };
-}
+  },
+});
 
-/** Publish one Wall's focus: the terminal Session it points the realm at, or null. */
+/** Publish one Wall's focus: the terminal Session it points the realm at, or
+ *  null — as it publishes on unmount, to withdraw. */
 export function publishEngagementFocus(slot: object, focusId: string | null): void {
-  focusBySlot.set(slot, focusId);
-  report();
-}
-
-export function withdrawEngagementFocus(slot: object): void {
-  if (!focusBySlot.delete(slot)) return;
+  if (focusId === null) focusBySlot.delete(slot);
+  else focusBySlot.set(slot, focusId);
   report();
 }
diff --git a/lib/src/lib/platform/fake-adapter.ts b/lib/src/lib/platform/fake-adapter.ts
index 3e065b103..1c4c2f78b 100644
--- a/lib/src/lib/platform/fake-adapter.ts
+++ b/lib/src/lib/platform/fake-adapter.ts
@@ -1,7 +1,7 @@
 import type { AlertRuntimeSnapshot } from '../alert-manager';
 import { DEFAULT_HELPER_COMMAND, type HelperIdentity, type TerminalContextRequest, type TerminalContextInfo } from '../terminal-context-types';
-import type { AlertStateDetail, OpenPort, PlatformAdapter, PtyDataDetail, PtyInfo, BurrowLink } from './types';
-import { AlertManager } from '../alert-manager';
+import type { AlertStateDetail, OpenPort, PlatformAdapter, PtyDataDetail, PtyInfo, BurrowLink, WritePtyOptions } from './types';
+import { AlertManager, LOCAL_VIEWER } from '../alert-manager';
 import type { AwaitHandle, AwaitOptions, Engagement, EngagementLapse } from '../alert-manager';
 import type { AlertSettings } from '../alert-settings';
 import { normalizeExternalUri } from '../external-links';
@@ -41,9 +41,6 @@ export interface FakePtyResizeDetail extends FakePtySize {
 
 const DEFAULT_PTY_SIZE: FakePtySize = { cols: 80, rows: 30 };
 
-/** This adapter's local manager serves one renderer realm, so one viewer. */
-const FAKE_VIEWER = 'fake';
-
 export class FakePtyAdapter implements PlatformAdapter {
   private dataHandlers = new Set<(detail: PtyDataDetail) => void>();
   private exitHandlers = new Set<(detail: { id: string; exitCode: number }) => void>();
@@ -212,7 +209,8 @@ export class FakePtyAdapter implements PlatformAdapter {
     return this.scenarioMap.get(id) ?? this.defaultScenario;
   }
 
-  writePty(id: string, data: string): void {
+  writePty(id: string, data: string, options?: WritePtyOptions): void {
+    if (options?.userInput) this.alertManager.acknowledge(id, { input: true });
     if (!this.terminals.has(id)) return;
     // Only echo if no scenario is actively playing
     if (this.activeTimers.has(id)) return;
@@ -338,8 +336,8 @@ export class FakePtyAdapter implements PlatformAdapter {
   alertSetCommandWatched(name: string, watched: boolean): void { this.alertManager.setCommandWatched(name, watched); }
   alertPublishSettings(settings: AlertSettings): void { this.alertManager.applySettings(settings); }
   alertDismiss(id: string): void { this.alertManager.dismissAlert(id); }
-  alertEngagement(state: Engagement, lapse?: EngagementLapse): void { this.alertManager.setViewer(FAKE_VIEWER, state, lapse); }
-  alertAcknowledge(id: string, options: { input: boolean }): void { this.alertManager.acknowledge(id, options); }
+  alertEngagement(state: Engagement, lapse?: EngagementLapse): void { this.alertManager.setViewer(LOCAL_VIEWER, state, lapse); }
+  alertAcknowledge(id: string): void { this.alertManager.acknowledge(id, { input: false }); }
   alertResize(id: string): void { this.alertManager.onResize(id); }
   alertToggleTodo(id: string): void { this.alertManager.toggleTodo(id); }
   alertClearTodo(id: string): void { this.alertManager.clearTodo(id); }
diff --git a/lib/src/lib/platform/types.ts b/lib/src/lib/platform/types.ts
index 140fff32b..ef1153d47 100644
--- a/lib/src/lib/platform/types.ts
+++ b/lib/src/lib/platform/types.ts
@@ -229,6 +229,9 @@ export interface SessionFlushRequest {
 export interface WritePtyOptions {
   /** Deliver at typing pace (`docs/specs/transport.md` → "Paced input"). */
   paced?: boolean;
+  /** A human typed, pasted, or dropped this: the host acknowledges it with
+   *  input before writing (`docs/specs/alert.md` -> Engagement). */
+  userInput?: true;
 }
 
 export interface PlatformAdapter {
@@ -476,8 +479,8 @@ export interface PlatformAdapter {
    * Engagement), sent only when it changes; `lapse` says why presence ended.
    */
   alertEngagement(state: Engagement, lapse?: EngagementLapse): void;
-  /** A human interacted with the Session; `input` when they typed, pasted, or dropped into it. */
-  alertAcknowledge(id: string, options: { input: boolean }): void;
+  /** A human gesture reached the Session without input; input rides `writePty`'s `userInput`. */
+  alertAcknowledge(id: string): void;
   alertResize(id: string): void;
   alertToggleTodo(id: string): void;
   alertClearTodo(id: string): void;
diff --git a/lib/src/lib/platform/vscode-adapter.ts b/lib/src/lib/platform/vscode-adapter.ts
index 224578094..d9d2a5fef 100644
--- a/lib/src/lib/platform/vscode-adapter.ts
+++ b/lib/src/lib/platform/vscode-adapter.ts
@@ -352,7 +352,7 @@ export class VSCodeAdapter implements PlatformAdapter {
   }
 
   writePty(id: string, data: string, options?: WritePtyOptions): void {
-    this.vscode.postMessage({ type: 'pty:input', id, data, paced: options?.paced });
+    this.vscode.postMessage({ type: 'pty:input', id, data, paced: options?.paced, userInput: options?.userInput });
   }
 
   resizePty(id: string, cols: number, rows: number): void {
@@ -587,11 +587,11 @@ export class VSCodeAdapter implements PlatformAdapter {
   }
 
   alertEngagement(state: Engagement, lapse?: EngagementLapse): void {
-    this.vscode.postMessage({ type: 'alert:engagement', present: state.present, focusId: state.focusId, lapse });
+    this.vscode.postMessage({ type: 'alert:engagement', state, lapse });
   }
 
-  alertAcknowledge(id: string, options: { input: boolean }): void {
-    this.vscode.postMessage({ type: 'alert:acknowledge', id, input: options.input });
+  alertAcknowledge(id: string): void {
+    this.vscode.postMessage({ type: 'alert:acknowledge', id });
   }
 
   alertResize(id: string): void {
diff --git a/lib/src/lib/presence.test.ts b/lib/src/lib/presence.test.ts
index e1aa74ddc..bcc6e30f6 100644
--- a/lib/src/lib/presence.test.ts
+++ b/lib/src/lib/presence.test.ts
@@ -18,9 +18,11 @@ beforeEach(() => {
   visibility = 'visible';
   vi.spyOn(document, 'hasFocus').mockImplementation(() => focused);
   vi.spyOn(document, 'visibilityState', 'get').mockImplementation(() => visibility);
-  tracker = createPresenceTracker({ timeoutMs: () => timeoutMs });
   transitions = [];
-  tracker.subscribe((present, lapse) => transitions.push([present, lapse]));
+  tracker = createPresenceTracker({
+    timeoutMs: () => timeoutMs,
+    onChange: (present, lapse) => transitions.push([present, lapse]),
+  });
 });
 
 afterEach(() => {
diff --git a/lib/src/lib/presence.ts b/lib/src/lib/presence.ts
index d8fa74c92..f4728cf49 100644
--- a/lib/src/lib/presence.ts
+++ b/lib/src/lib/presence.ts
@@ -1,4 +1,5 @@
 import type { EngagementLapse } from './alert-manager';
+import { subscribeWindowFocus } from './window-focus';
 
 /** What counts as a human at this window (`docs/specs/alert.md` -> Engagement). */
 const INPUT_EVENTS = ['keydown', 'pointerdown', 'pointermove', 'wheel', 'compositionupdate'] as const;
@@ -14,7 +15,6 @@ const LISTENER_OPTIONS: AddEventListenerOptions = { capture: true, passive: true
  */
 export interface PresenceTracker {
   readonly present: boolean;
-  subscribe(listener: (present: boolean, lapse?: EngagementLapse) => void): () => void;
   /** The timeout changed: re-arm against the new value from the last input. */
   refresh(): void;
   dispose(): void;
@@ -23,26 +23,21 @@ export interface PresenceTracker {
 export interface PresenceTrackerOptions {
   /** Read at every deadline, so a settings edit needs only `refresh`. */
   timeoutMs: () => number;
-  target?: Window;
-  doc?: Document;
+  /** Each transition; an end of presence names its lapse. */
+  onChange: (present: boolean, lapse?: EngagementLapse) => void;
 }
 
-export function createPresenceTracker({
-  timeoutMs,
-  target = window,
-  doc = document,
-}: PresenceTrackerOptions): PresenceTracker {
+export function createPresenceTracker({ timeoutMs, onChange }: PresenceTrackerOptions): PresenceTracker {
   let lastInputAt = Number.NEGATIVE_INFINITY;
   let present = false;
   let timer: ReturnType<typeof setTimeout> | null = null;
-  const listeners = new Set<(present: boolean, lapse?: EngagementLapse) => void>();
 
-  const windowActive = (): boolean => doc.hasFocus() && doc.visibilityState === 'visible';
+  const windowActive = (): boolean => document.hasFocus() && document.visibilityState === 'visible';
 
   const set = (next: boolean, lapse?: EngagementLapse): void => {
     if (next === present) return;
     present = next;
-    for (const listener of [...listeners]) listener(present, present ? undefined : lapse);
+    onChange(present, lapse);
   };
 
   const clearTimer = (): void => {
@@ -76,44 +71,29 @@ export function createPresenceTracker({
     set(false, 'leave');
   };
 
-  // An iframe Surface taking focus blurs this window while the document keeps
-  // it (`docs/specs/layout.md` -> Corner cases #2): not a leave.
-  const onBlur = (): void => {
-    if (!doc.hasFocus()) leave();
-  };
-
   // Bringing the window back is a human act, so it counts as input.
   const onVisibility = (): void => {
-    if (doc.visibilityState === 'visible') onInput();
+    if (document.visibilityState === 'visible') onInput();
     else leave();
   };
 
-  for (const type of INPUT_EVENTS) target.addEventListener(type, onInput, LISTENER_OPTIONS);
-  target.addEventListener('focus', onInput);
-  target.addEventListener('blur', onBlur);
-  doc.addEventListener('visibilitychange', onVisibility);
+  for (const type of INPUT_EVENTS) window.addEventListener(type, onInput, LISTENER_OPTIONS);
+  const unsubscribeFocus = subscribeWindowFocus((focused) => (focused ? onInput() : leave()));
+  document.addEventListener('visibilitychange', onVisibility);
 
   return {
     get present() {
       return present;
     },
-    subscribe(listener) {
-      listeners.add(listener);
-      return () => {
-        listeners.delete(listener);
-      };
-    },
     refresh() {
       clearTimer();
       arm();
     },
     dispose() {
       clearTimer();
-      listeners.clear();
-      for (const type of INPUT_EVENTS) target.removeEventListener(type, onInput, LISTENER_OPTIONS);
-      target.removeEventListener('focus', onInput);
-      target.removeEventListener('blur', onBlur);
-      doc.removeEventListener('visibilitychange', onVisibility);
+      for (const type of INPUT_EVENTS) window.removeEventListener(type, onInput, LISTENER_OPTIONS);
+      unsubscribeFocus();
+      document.removeEventListener('visibilitychange', onVisibility);
     },
   };
 }
diff --git a/lib/src/lib/session-activity-store.ts b/lib/src/lib/session-activity-store.ts
index 7d3825830..0740b331a 100644
--- a/lib/src/lib/session-activity-store.ts
+++ b/lib/src/lib/session-activity-store.ts
@@ -150,13 +150,13 @@ export function dismissSessionAlert(id: string): void {
 }
 
 /**
- * A human interacted with this Session (`docs/specs/alert.md` -> Engagement):
- * `input` for keys, a paste, or a drop, else a click, tap, or reattach. Only a
- * terminal Session is acknowledged — a browser Surface has no Activity machine.
+ * A human gesture reached this Session without input — a click, a Door
+ * reattach, a tap (`docs/specs/alert.md` -> Engagement). Input acknowledges
+ * through `writeUserInput`. The host acknowledges nothing it has no Activity
+ * for, a browser Surface included.
  */
-export function acknowledgeSession(id: string, input: boolean): void {
-  if (!registry.has(id)) return;
-  getPlatform().alertAcknowledge(id, { input });
+export function acknowledgeSession(id: string): void {
+  getPlatform().alertAcknowledge(id);
 }
 
 export function toggleSessionTodo(id: string): void {
diff --git a/lib/src/lib/terminal-lifecycle.release.test.ts b/lib/src/lib/terminal-lifecycle.release.test.ts
index 261871f31..098eaf027 100644
--- a/lib/src/lib/terminal-lifecycle.release.test.ts
+++ b/lib/src/lib/terminal-lifecycle.release.test.ts
@@ -7,32 +7,11 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
  * (`docs/specs/transport.md` → "Transferring a Workspace").
  */
 
-vi.mock('@xterm/addon-fit', () => ({
-  FitAddon: class {
-    fit(): void {}
-    proposeDimensions(): { cols: number; rows: number } { return { cols: 80, rows: 24 }; }
-  },
-}));
-vi.mock('@xterm/addon-image', () => ({ ImageAddon: class {} }));
-vi.mock('@xterm/addon-serialize', () => ({ SerializeAddon: class { serialize(): string { return ''; } } }));
-vi.mock('@xterm/addon-unicode-graphemes', () => ({ UnicodeGraphemesAddon: class {} }));
-vi.mock('@xterm/xterm', () => ({
-  Terminal: class {
-    parser = { registerCsiHandler: () => ({ dispose: () => {} }) };
-    modes = { mouseTrackingMode: 'none' as const, bracketedPasteMode: false };
-    unicode = { activeVersion: '11' };
-    disposed = false;
-    loadAddon(): void {}
-    open(): void {}
-    write(): void {}
-    focus(): void {}
-    blur(): void {}
-    onData(): { dispose: () => void } { return { dispose: () => {} }; }
-    onResize(): { dispose: () => void } { return { dispose: () => {} }; }
-    onRender(): { dispose: () => void } { return { dispose: () => {} }; }
-    dispose(): void { this.disposed = true; }
-  },
-}));
+vi.mock('@xterm/xterm', () => import('./xterm-test-mock'));
+vi.mock('@xterm/addon-fit', () => import('./xterm-test-mock'));
+vi.mock('@xterm/addon-image', () => import('./xterm-test-mock'));
+vi.mock('@xterm/addon-serialize', () => import('./xterm-test-mock'));
+vi.mock('@xterm/addon-unicode-graphemes', () => import('./xterm-test-mock'));
 
 vi.mock('./platform', async () => {
   const actual = await vi.importActual<typeof import('./platform')>('./platform');
diff --git a/lib/src/lib/terminal-lifecycle.ts b/lib/src/lib/terminal-lifecycle.ts
index 0240d6614..7398ceb6c 100644
--- a/lib/src/lib/terminal-lifecycle.ts
+++ b/lib/src/lib/terminal-lifecycle.ts
@@ -32,7 +32,7 @@ import {
   type TerminalEntry,
   type TerminalOverlayDims,
 } from './terminal-store';
-import { acknowledgeSession, clearTerminalActivity, notifyActivityListeners } from './session-activity-store';
+import { clearTerminalActivity, notifyActivityListeners } from './session-activity-store';
 import { attachTerminalMouseRouter } from './terminal-mouse-router';
 import {
   inputIsReplayTerminalReport,
@@ -715,14 +715,13 @@ export function isUntouched(id: string): boolean {
 }
 
 /**
- * Write human-originated input — a keystroke, a paste, a file drop — so every
- * path acknowledges alike (`docs/specs/alert.md` -> Engagement). Acknowledged
- * before the write, so the echo window is open before any echo can arrive.
+ * Write human-originated input — a keystroke, a paste, a file drop, the mobile
+ * input bar — so every path acknowledges alike (`docs/specs/alert.md` ->
+ * Engagement): the host acknowledges it with input as it writes it.
  */
 export function writeUserInput(id: string, data: string): void {
   markSessionTouched(id);
-  acknowledgeSession(id, true);
-  getPlatform().writePty(id, data);
+  getPlatform().writePty(id, data, { userInput: true });
 }
 
 export function markSessionTouched(id: string): void {
diff --git a/lib/src/lib/terminal-registry.alert.test.ts b/lib/src/lib/terminal-registry.alert.test.ts
index 110e66732..a5f8ca593 100644
--- a/lib/src/lib/terminal-registry.alert.test.ts
+++ b/lib/src/lib/terminal-registry.alert.test.ts
@@ -1,95 +1,9 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
-vi.mock('@xterm/addon-fit', () => {
-  class FitAddon {
-    fit(): void {}
-
-    proposeDimensions(): { cols: number; rows: number } {
-      return { cols: 80, rows: 24 };
-    }
-  }
-
-  return { FitAddon };
-});
-
-vi.mock('@xterm/addon-image', () => {
-  class ImageAddon {
-    constructor(readonly options: Record<string, unknown>) {}
-  }
-
-  return { ImageAddon };
-});
-
-vi.mock('@xterm/addon-unicode-graphemes', () => {
-  class UnicodeGraphemesAddon {}
-
-  return { UnicodeGraphemesAddon };
-});
-
-vi.mock('@xterm/xterm', () => {
-  class MockTerminal {
-    writes: string[] = [];
-    addons: unknown[] = [];
-    private dataListeners = new Set<(data: string) => void>();
-    private resizeListeners = new Set<(size: { cols: number; rows: number }) => void>();
-
-    parser = {
-      registerCsiHandler: () => ({ dispose: () => {} }),
-    };
-    modes = {
-      mouseTrackingMode: 'none' as const,
-      bracketedPasteMode: false,
-    };
-
-    loadAddon(addon: unknown): void {
-      this.addons.push(addon);
-    }
-
-    open(): void {}
-
-    write(data: string, _callback?: () => void): void {
-      this.writes.push(data);
-    }
-
-    onData(listener: (data: string) => void): { dispose: () => void } {
-      this.dataListeners.add(listener);
-      return {
-        dispose: () => {
-          this.dataListeners.delete(listener);
-        },
-      };
-    }
-
-    onResize(listener: (size: { cols: number; rows: number }) => void): { dispose: () => void } {
-      this.resizeListeners.add(listener);
-      return {
-        dispose: () => {
-          this.resizeListeners.delete(listener);
-        },
-      };
-    }
-
-    onRender(): { dispose: () => void } {
-      return { dispose: () => {} };
-    }
-
-    focus(): void {}
-
-    blur(): void {}
-
-    dispose(): void {}
-
-    emitInput(data: string): void {
-      this.dataListeners.forEach((listener) => listener(data));
-    }
-
-    emitResize(cols: number, rows: number): void {
-      this.resizeListeners.forEach((listener) => listener({ cols, rows }));
-    }
-  }
-
-  return { Terminal: MockTerminal };
-});
+vi.mock('@xterm/xterm', () => import('./xterm-test-mock'));
+vi.mock('@xterm/addon-fit', () => import('./xterm-test-mock'));
+vi.mock('@xterm/addon-image', () => import('./xterm-test-mock'));
+vi.mock('@xterm/addon-unicode-graphemes', () => import('./xterm-test-mock'));
 
 vi.mock('./platform', async () => {
   const actual = await vi.importActual<typeof import('./platform')>('./platform');
@@ -234,7 +148,7 @@ function leaveSession(): void {
 
 /** A click on the pane, or a Door reattach into passthrough. */
 function clickSession(id: string): void {
-  acknowledgeSession(id, false);
+  acknowledgeSession(id);
 }
 
 function minimizeSession(id: string): void {
@@ -400,11 +314,11 @@ describe('terminal-registry alert behavior', () => {
   });
 
   it('keeps the TODO an early acknowledgement left behind', () => {
-    const id = 'early-attention-dismissal';
+    const id = 'early-acknowledgement';
     fakePlatform.spawnPty(id);
     fakePlatform.sendOutput(id, '\x07');
     expect(getActivity(id).status).toBe('ALERT_RINGING');
-    fakePlatform.alertAcknowledge(id, { input: false });
+    fakePlatform.alertAcknowledge(id);
     expect(getActivity(id)).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
 
     resumeTerminal(id, null, { alive: true });
@@ -909,7 +823,7 @@ describe('terminal-registry alert behavior', () => {
   });
 
   it('acknowledges terminal input, clearing the ring and its TODO at once', () => {
-    const id = 'input-attention';
+    const id = 'input-acknowledges';
     const entry = createSession(id);
     enableAlert(id);
 
@@ -927,14 +841,14 @@ describe('terminal-registry alert behavior', () => {
     ['SS3 key', '\x1bOA'],
     ['mouse report with a real key', '\x1b[<35;10;20Mx'],
   ])('counts a %s as a keystroke and forwards it unchanged', (_name, input) => {
-    const id = 'encoded-input-attention';
+    const id = 'encoded-input-acknowledges';
     const entry = createSession(id);
     enableAlert(id);
     driveToRingingNeedsAttention(id);
     const write = vi.spyOn(fakePlatform, 'writePty');
     try {
       entry.terminal.emitInput(input);
-      expect(write).toHaveBeenCalledWith(id, input);
+      expect(write.mock.calls).toEqual([[id, input, { userInput: true }]]);
       expect(getActivity(id)).toMatchObject({ status: 'NOTHING_TO_SHOW', todo: false });
     } finally {
       write.mockRestore();
@@ -956,19 +870,17 @@ describe('terminal-registry alert behavior', () => {
     ['X10 mouse report', '\x1b[M@!!'],
     ['combined mouse reports', '\x1b[<35;10;20M\x1b[64;10;20M\x1b[M@!!'],
   ])('forwards a live %s without acknowledging it', (_name, input) => {
-    const id = 'reply-attention';
+    const id = 'reply-acknowledges-nothing';
     const entry = createSession(id);
     enableAlert(id);
     driveToRingingNeedsAttention(id);
-    const acknowledge = vi.spyOn(fakePlatform, 'alertAcknowledge');
     const write = vi.spyOn(fakePlatform, 'writePty');
     try {
       entry.terminal.emitInput(input);
-      expect(write).toHaveBeenCalledWith(id, input);
-      expect(acknowledge).not.toHaveBeenCalled();
+      // Written as it came, and not as user input.
+      expect(write.mock.calls).toEqual([[id, input]]);
       expect(getActivity(id)).toMatchObject({ status: 'ALERT_RINGING' });
     } finally {
-      acknowledge.mockRestore();
       write.mockRestore();
     }
   });
@@ -1042,14 +954,12 @@ describe('terminal-registry alert behavior', () => {
 
   it('acknowledges nothing for a click on a browser Surface, keeping its TODO', () => {
     const browserId = 'pane-browser-click';
-    const acknowledge = vi.spyOn(fakePlatform, 'alertAcknowledge');
     try {
       toggleSessionTodo(browserId);
-      acknowledgeSession(browserId, false);
-      expect(acknowledge).not.toHaveBeenCalled();
-      expect(getActivity(browserId).todo).toBe(true);
+      acknowledgeSession(browserId);
+      // The host has no Activity for it, so it creates none.
+      expect(getActivity(browserId)).toEqual({ ...DEFAULT_ACTIVITY_STATE, todo: true });
     } finally {
-      acknowledge.mockRestore();
       clearLocalSurfaceActivity(browserId);
     }
   });
@@ -1254,7 +1164,7 @@ describe('terminal-registry alert behavior', () => {
   });
 
   it('programmatic terminal focus acknowledges nothing', () => {
-    const id = 'focus-without-attention';
+    const id = 'focus-acknowledges-nothing';
     createSession(id);
     enableAlert(id);
 
diff --git a/lib/src/lib/terminal-registry.ts b/lib/src/lib/terminal-registry.ts
index fce86166b..cbae8646d 100644
--- a/lib/src/lib/terminal-registry.ts
+++ b/lib/src/lib/terminal-registry.ts
@@ -40,7 +40,6 @@ export {
   getTerminalInstance,
   getTerminalOverlayDims,
   isUntouched,
-  markSessionTouched,
   mountElement,
   writeUserInput,
   refitSession,
diff --git a/lib/src/lib/window-focus.ts b/lib/src/lib/window-focus.ts
new file mode 100644
index 000000000..cdef2fcf6
--- /dev/null
+++ b/lib/src/lib/window-focus.ts
@@ -0,0 +1,18 @@
+/**
+ * Follow this window's focus. A `blur` is real only when `document.hasFocus()`
+ * is false: focusing one of our own iframe Surfaces blurs the window while the
+ * document keeps focus (`docs/specs/layout.md` -> Corner cases #2), so that
+ * blur reports nothing. Returns the unsubscribe.
+ */
+export function subscribeWindowFocus(onChange: (focused: boolean) => void): () => void {
+  const onFocus = () => onChange(true);
+  const onBlur = () => {
+    if (!document.hasFocus()) onChange(false);
+  };
+  window.addEventListener('focus', onFocus);
+  window.addEventListener('blur', onBlur);
+  return () => {
+    window.removeEventListener('focus', onFocus);
+    window.removeEventListener('blur', onBlur);
+  };
+}
diff --git a/lib/src/lib/xterm-test-mock.ts b/lib/src/lib/xterm-test-mock.ts
new file mode 100644
index 000000000..431525f81
--- /dev/null
+++ b/lib/src/lib/xterm-test-mock.ts
@@ -0,0 +1,92 @@
+/**
+ * A stand-in for `@xterm/xterm` and the addons the terminal registry loads, for
+ * suites that run the real registry where no canvas can measure glyphs. Point
+ * each module at it: `vi.mock('@xterm/xterm', () => import('./xterm-test-mock'))`.
+ */
+
+type Listener<T> = (value: T) => void;
+
+function listen<T>(listeners: Set<Listener<T>>, listener: Listener<T>): { dispose: () => void } {
+  listeners.add(listener);
+  return { dispose: () => { listeners.delete(listener); } };
+}
+
+export class Terminal {
+  element: HTMLElement | undefined;
+  cols = 80;
+  rows = 24;
+  options: Record<string, unknown> = {};
+  /** Everything written to the screen, in order. */
+  writes: string[] = [];
+  addons: unknown[] = [];
+  parser = { registerCsiHandler: () => ({ dispose: () => {} }) };
+  modes = { mouseTrackingMode: 'none' as const, bracketedPasteMode: false };
+  unicode = { activeVersion: '11' };
+  buffer = { active: { getLine: () => undefined, baseY: 0, cursorY: 0, cursorX: 0, viewportY: 0 } };
+  private dataListeners = new Set<Listener<string>>();
+  private resizeListeners = new Set<Listener<{ cols: number; rows: number }>>();
+
+  loadAddon(addon: unknown): void {
+    this.addons.push(addon);
+  }
+
+  /** A DOM host gets xterm's `.xterm` root, so listeners on it see real events. */
+  open(host: HTMLElement): void {
+    if (typeof HTMLElement === 'undefined' || !(host instanceof HTMLElement)) return;
+    this.element = document.createElement('div');
+    this.element.className = 'xterm';
+    host.appendChild(this.element);
+  }
+
+  /** Never parses, so a write never completes: its callback is not called. */
+  write(data: string): void {
+    this.writes.push(data);
+  }
+
+  onData(listener: Listener<string>): { dispose: () => void } {
+    return listen(this.dataListeners, listener);
+  }
+
+  onResize(listener: Listener<{ cols: number; rows: number }>): { dispose: () => void } {
+    return listen(this.resizeListeners, listener);
+  }
+
+  onRender(): { dispose: () => void } {
+    return { dispose: () => {} };
+  }
+
+  attachCustomKeyEventHandler(): void {}
+  focus(): void {}
+  blur(): void {}
+  clearSelection(): void {}
+  dispose(): void {}
+
+  /** The user typed `data`: what xterm's `onData` hands the registry. */
+  emitInput(data: string): void {
+    this.dataListeners.forEach((listener) => listener(data));
+  }
+
+  emitResize(cols: number, rows: number): void {
+    this.resizeListeners.forEach((listener) => listener({ cols, rows }));
+  }
+}
+
+export class FitAddon {
+  fit(): void {}
+
+  proposeDimensions(): { cols: number; rows: number } {
+    return { cols: 80, rows: 24 };
+  }
+}
+
+export class ImageAddon {
+  constructor(readonly options?: Record<string, unknown>) {}
+}
+
+export class UnicodeGraphemesAddon {}
+
+export class SerializeAddon {
+  serialize(): string {
+    return '';
+  }
+}
diff --git a/lib/src/remote/pocket-app/PocketWall.tsx b/lib/src/remote/pocket-app/PocketWall.tsx
index f1247c0d6..ef8a46ef1 100644
--- a/lib/src/remote/pocket-app/PocketWall.tsx
+++ b/lib/src/remote/pocket-app/PocketWall.tsx
@@ -20,7 +20,7 @@ import {
   setOverride as setMouseOverride,
   subscribeToMouseSelection,
 } from '../../lib/mouse-selection';
-import { getTerminalInstance, refitSession } from '../../lib/terminal-registry';
+import { getTerminalInstance, refitSession, writeUserInput } from '../../lib/terminal-registry';
 import { doPaste } from '../../lib/clipboard';
 import type { RemotePtyAdapter } from '../client/remote-adapter';
 import { usePocketTheme } from './pocket-theme';
@@ -100,9 +100,9 @@ export function PocketWall({ adapter, onError }: {
 
   const handleSendInput = useCallback(
     (data: string) => {
-      if (activePaneId) adapter.writePty(activePaneId, data);
+      if (activePaneId) writeUserInput(activePaneId, data);
     },
-    [adapter, activePaneId],
+    [activePaneId],
   );
 
   const handlePaste = useCallback(async () => {
diff --git a/lib/src/stories/BrowserChromeHeader.stories.tsx b/lib/src/stories/BrowserChromeHeader.stories.tsx
index 2d0f9ba9b..976882864 100644
--- a/lib/src/stories/BrowserChromeHeader.stories.tsx
+++ b/lib/src/stories/BrowserChromeHeader.stories.tsx
@@ -42,6 +42,7 @@ const loggingActions: WallActions = {
   onSplitV: () => console.log('[story] split top/bottom'),
   onZoom: () => console.log('[story] zoom'),
   onClickPanel: () => console.log('[story] click panel'),
+  onEnterPanel: () => console.log('[story] enter panel'),
   onFocusPane: (id) => console.log('[story] focus pane', id),
   onStartRename: () => {},
   onFinishRename: () => ({ accepted: true }),
diff --git a/lib/src/stories/MobileTerminalUi.stories.tsx b/lib/src/stories/MobileTerminalUi.stories.tsx
index 42f4ab5fb..2e90cbc4e 100644
--- a/lib/src/stories/MobileTerminalUi.stories.tsx
+++ b/lib/src/stories/MobileTerminalUi.stories.tsx
@@ -32,6 +32,7 @@ import {
   type MobileGesturePoint,
   type MobileGestureTrackingState,
 } from '../lib/mobile-gesture-menu';
+import { writeUserInput } from '../lib/terminal-registry';
 import { settleTerminals } from './settle-terminals';
 
 const meta: Meta<typeof MobileTerminalUi> = {
@@ -169,7 +170,7 @@ function PocketWallFrame(args: MobileTerminalUiProps) {
         onSessionSelect={setActivePaneId}
         onSendInput={(data) => {
           args.onSendInput?.(data);
-          adapterRef.current?.writePty(activePaneId, data);
+          writeUserInput(activePaneId, data);
         }}
         onPaste={() => {
           void args.onPaste?.();
diff --git a/lib/src/stories/MouseHeaderIcon.stories.tsx b/lib/src/stories/MouseHeaderIcon.stories.tsx
index a77cd1b86..522aa4a8b 100644
--- a/lib/src/stories/MouseHeaderIcon.stories.tsx
+++ b/lib/src/stories/MouseHeaderIcon.stories.tsx
@@ -27,6 +27,7 @@ const noopActions: WallActions = {
   onSplitV: () => {},
   onZoom: () => {},
   onClickPanel: () => {},
+  onEnterPanel: () => {},
   onFocusPane: () => {},
   onStartRename: () => {},
   onFinishRename: () => ({ accepted: true }),
diff --git a/lib/src/stories/ShellCwd.stories.tsx b/lib/src/stories/ShellCwd.stories.tsx
index 82e07127e..72b515ac1 100644
--- a/lib/src/stories/ShellCwd.stories.tsx
+++ b/lib/src/stories/ShellCwd.stories.tsx
@@ -50,6 +50,7 @@ const noopActions: WallActions = {
   onSplitV: () => {},
   onZoom: () => {},
   onClickPanel: () => {},
+  onEnterPanel: () => {},
   onFocusPane: () => {},
   onStartRename: () => {},
   onFinishRename: () => ({ accepted: true }),
diff --git a/lib/src/stories/TerminalPaneHeader.stories.tsx b/lib/src/stories/TerminalPaneHeader.stories.tsx
index 3d11aa6ed..e3b0e21e6 100644
--- a/lib/src/stories/TerminalPaneHeader.stories.tsx
+++ b/lib/src/stories/TerminalPaneHeader.stories.tsx
@@ -29,6 +29,7 @@ const noopActions: WallActions = {
   onSplitV: () => {},
   onZoom: () => {},
   onClickPanel: () => {},
+  onEnterPanel: () => {},
   onFocusPane: () => {},
   onStartRename: () => {},
   onFinishRename: () => ({ accepted: true }),
diff --git a/lib/tsconfig.app.json b/lib/tsconfig.app.json
index 2261411a3..85119379d 100644
--- a/lib/tsconfig.app.json
+++ b/lib/tsconfig.app.json
@@ -23,6 +23,6 @@
   "include": ["src"],
   // The pure rewrite helpers typecheck here (DOM provides URL); the Node proxy
   // server is esbuild-only (bundled per host), like the rest of our host code.
-  // wall-test-utils imports vitest, so it lives with the tests, not the app.
-  "exclude": ["src/**/*.test.ts", "src/**/*.test.tsx", "src/components/wall/wall-test-utils.ts", "src/host/iframe-proxy.ts", "src/host/agent-browser-host.ts"]
+  // The test utils import vitest, so they live with the tests, not the app.
+  "exclude": ["src/**/*.test.ts", "src/**/*.test.tsx", "src/components/wall/wall-test-utils.ts", "src/lib/alert-manager-test-utils.ts", "src/host/iframe-proxy.ts", "src/host/agent-browser-host.ts"]
 }
diff --git a/standalone/src/browser-sidecar-adapter.test.ts b/standalone/src/browser-sidecar-adapter.test.ts
index 59b447900..e92059e7e 100644
--- a/standalone/src/browser-sidecar-adapter.test.ts
+++ b/standalone/src/browser-sidecar-adapter.test.ts
@@ -161,6 +161,20 @@ describe("BrowserSidecarAdapter terminal stream", () => {
     expect(send.mock.calls.filter(([cmd]) => cmd === "pty_write")).toEqual([]);
   });
 
+  it("acknowledges user input before writing it", async () => {
+    const { adapter, send, manager } = await listening();
+    manager.notifyFromProtocol("typed", { source: "OSC 9", title: null, body: "needs input" });
+    let atWrite: string | undefined;
+    send.mockImplementation(() => { atWrite = manager.getState("typed").status; });
+
+    adapter.writePty("typed", "\x1b[I");
+    expect(atWrite).toBe("ALERT_RINGING");
+    adapter.writePty("typed", "y", { userInput: true });
+    expect(send).toHaveBeenLastCalledWith("pty_write", { id: "typed", data: "y", paced: undefined });
+    expect(atWrite).toBe("WATCHING_DISABLED");
+    expect(manager.getState("typed").todo).toBe(false);
+  });
+
   it("routes the alert stores through the sidecar and applies their broadcasts", async () => {
     const { adapter, manager, alertCommands, deliver } = await listening();
     const quiet: AlertSettings = { ...DEFAULT_ALERT_SETTINGS, speakEnabled: false };
diff --git a/standalone/src/browser-sidecar-adapter.ts b/standalone/src/browser-sidecar-adapter.ts
index 0e78b9b16..8bc6bb031 100644
--- a/standalone/src/browser-sidecar-adapter.ts
+++ b/standalone/src/browser-sidecar-adapter.ts
@@ -38,7 +38,7 @@ import {
   type BurrowResult,
 } from "dormouse-lib/host/remote/service-protocol";
 import { embedderOrigins } from "dormouse-lib/lib/embedder-origins";
-import { AlertManager } from "dormouse-lib/lib/alert-manager";
+import { AlertManager, LOCAL_VIEWER } from "dormouse-lib/lib/alert-manager";
 import type { AwaitHandle, AwaitOptions, Engagement, EngagementLapse } from "dormouse-lib/lib/alert-manager";
 import type { AlertSettings } from "dormouse-lib/lib/alert-settings";
 import { normalizeExternalUri } from "dormouse-lib/lib/external-links";
@@ -186,6 +186,7 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
   }
 
   writePty(id: string, data: string, options?: WritePtyOptions): void {
+    if (options?.userInput) this.alertManager.acknowledge(id, { input: true });
     this.host.send("pty_write", { id, data, paced: options?.paced });
   }
 
@@ -378,9 +379,8 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
     this.host.send("alert_command", { payload });
   }
   alertDismiss(id: string): void { this.alertManager.dismissAlert(id); }
-  // The page is the local manager's one viewer, as in `TauriAdapter`.
-  alertEngagement(state: Engagement, lapse?: EngagementLapse): void { this.alertManager.setViewer("window", state, lapse); }
-  alertAcknowledge(id: string, options: { input: boolean }): void { this.alertManager.acknowledge(id, options); }
+  alertEngagement(state: Engagement, lapse?: EngagementLapse): void { this.alertManager.setViewer(LOCAL_VIEWER, state, lapse); }
+  alertAcknowledge(id: string): void { this.alertManager.acknowledge(id, { input: false }); }
   alertResize(id: string): void { this.alertManager.onResize(id); }
   alertToggleTodo(id: string): void { this.alertManager.toggleTodo(id); }
   alertClearTodo(id: string): void { this.alertManager.clearTodo(id); }
diff --git a/standalone/src/tauri-adapter.test.ts b/standalone/src/tauri-adapter.test.ts
index d7f347b5f..7f99d510a 100644
--- a/standalone/src/tauri-adapter.test.ts
+++ b/standalone/src/tauri-adapter.test.ts
@@ -478,6 +478,28 @@ describe("TauriAdapter terminal stream", () => {
   // A transferred pane's new window sees nothing but the replay: Rust drops the
   // gap's semantic events because this path re-derives them, so it must rebuild
   // both halves — pane state and the AlertManager's watch.
+  it("acknowledges user input with its echo window before writing it", async () => {
+    const { adapter, deliver, invoke } = await listening();
+    const alerts: AlertStateDetail[] = [];
+    adapter.onAlertState((detail) => void alerts.push(detail));
+    const ring = { kind: "notification", notification: { source: "OSC 9", title: null, body: "needs input" } };
+    deliver("terminal:protocolEvents", { id: "typed-pty", events: [ring] });
+    expect(alerts[alerts.length - 1]).toMatchObject({ status: "ALERT_RINGING", todo: true });
+
+    // A write that is not user input leaves the ring alone.
+    adapter.writePty("typed-pty", "\x1b[I");
+    expect(alerts[alerts.length - 1]?.status).toBe("ALERT_RINGING");
+
+    let atWrite: AlertStateDetail | undefined;
+    invoke.mockImplementation(async () => { atWrite = alerts[alerts.length - 1]; });
+    adapter.writePty("typed-pty", "y", { userInput: true });
+    expect(invoke).toHaveBeenLastCalledWith("pty_write", { id: "typed-pty", data: "y", paced: undefined });
+    expect(atWrite).toMatchObject({ status: "WATCHING_DISABLED", todo: false });
+    // The echo window is open: a bell answering the key rings no one.
+    deliver("terminal:protocolEvents", { id: "typed-pty", events: [ring] });
+    expect(alerts[alerts.length - 1]?.status).not.toBe("ALERT_RINGING");
+  });
+
   it("rebuilds alert state from a replay, not only pane state", async () => {
     const { adapter, deliver } = await listening();
     const alerts: AlertStateDetail[] = [];
diff --git a/standalone/src/tauri-adapter.ts b/standalone/src/tauri-adapter.ts
index f851a8169..0a11c9603 100644
--- a/standalone/src/tauri-adapter.ts
+++ b/standalone/src/tauri-adapter.ts
@@ -47,7 +47,7 @@ import {
   type BurrowResult,
 } from "dormouse-lib/host/remote/service-protocol";
 import { embedderOrigins } from "dormouse-lib/lib/embedder-origins";
-import { AlertManager } from "dormouse-lib/lib/alert-manager";
+import { AlertManager, LOCAL_VIEWER } from "dormouse-lib/lib/alert-manager";
 import type { AwaitHandle, AwaitOptions, Engagement, EngagementLapse } from "dormouse-lib/lib/alert-manager";
 import type { AlertSettings } from "dormouse-lib/lib/alert-settings";
 import { normalizeExternalUri } from "dormouse-lib/lib/external-links";
@@ -350,6 +350,7 @@ export class TauriAdapter implements PlatformAdapter {
   }
 
   writePty(id: string, data: string, options?: WritePtyOptions): void {
+    if (options?.userInput) this.alertManager.acknowledge(id, { input: true });
     invoke("pty_write", { id, data, paced: options?.paced });
   }
 
@@ -744,11 +745,11 @@ export class TauriAdapter implements PlatformAdapter {
   // This window's webview is the manager's one viewer until the manager moves
   // to the sidecar (docs/specs/alert.md -> Engagement).
   alertEngagement(state: Engagement, lapse?: EngagementLapse): void {
-    this.alertManager.setViewer("window", state, lapse);
+    this.alertManager.setViewer(LOCAL_VIEWER, state, lapse);
   }
 
-  alertAcknowledge(id: string, options: { input: boolean }): void {
-    this.alertManager.acknowledge(id, options);
+  alertAcknowledge(id: string): void {
+    this.alertManager.acknowledge(id, { input: false });
   }
 
   alertResize(id: string): void {
diff --git a/vscode-ext/src/message-router.ts b/vscode-ext/src/message-router.ts
index 3d283ff78..8c622ad8f 100644
--- a/vscode-ext/src/message-router.ts
+++ b/vscode-ext/src/message-router.ts
@@ -176,11 +176,10 @@ function broadcastToWebviews(message: ExtensionMessage): void {
 
 const activeRouters = new Set<ActiveRouter>();
 let nextFlushRequestId = 0;
-/** Tags each router's contribution to the volatile notepad mirror. Per
- *  extension-host lifetime, like the mirror itself (`notepad-volatile.ts`). */
-let nextNotepadRouterId = 0;
-/** Tags each router's engagement viewer in the shared alert manager. */
-let nextViewerId = 0;
+/** Tags each router's contribution to the volatile notepad mirror and its
+ *  engagement viewer in the shared alert manager. Per extension-host lifetime,
+ *  like the mirror itself (`notepad-volatile.ts`). */
+let nextRouterId = 0;
 const ALLOWED_WORKBENCH_COMMANDS = new Set<string>(VSCODE_WORKBENCH_COMMANDS);
 
 // Shared alert manager — survives router disposal so alert state persists
@@ -378,10 +377,9 @@ export function attachRouter(
 ): vscode.Disposable {
   const reconnect = options?.reconnect ?? false;
   const killOnDispose = options?.killOnDispose ?? false;
-  const notepadRouterId = `notepad-router-${++nextNotepadRouterId}`;
-  // This webview is one engagement viewer of the shared manager, so one
-  // webview's blur never touches another's (docs/specs/alert.md → Engagement).
-  const viewerId = `viewer-${++nextViewerId}`;
+  // Also this webview's engagement viewer, so one webview's blur never touches
+  // another's (docs/specs/alert.md → Engagement).
+  const routerId = `router-${++nextRouterId}`;
 
   // The router's only send path — it stamps this webview's message token, which
   // the webview requires (docs/specs/vscode.md → "Webview message
@@ -472,6 +470,13 @@ export function attachRouter(
     }
   }
 
+  /** This webview's content is gone — disposed, or destroyed and recreated:
+   *  its engagement and the awaits it parked go with it (docs/specs/vscode.md). */
+  function endRealm(): void {
+    cancelAllPendingAwaits();
+    alertManager.removeViewer(routerId);
+  }
+
   function flushSessionSave(timeoutMs = 1000): Promise<void> {
     if (disposed || !disconnectWebview) return Promise.resolve();
 
@@ -624,6 +629,9 @@ export function attachRouter(
         break;
       }
       case 'pty:input':
+        // Acknowledged before the write, so the echo window is open before any
+        // echo can arrive (docs/specs/alert.md → Engagement).
+        if (msg.userInput === true) alertManager.acknowledge(msg.id, { input: true });
         ptyManager.write(msg.id, msg.data, { paced: msg.paced });
         break;
       case 'pty:resize':
@@ -839,7 +847,7 @@ export function attachRouter(
       case 'notepad:volatile':
         // Memory only, and nothing to answer: the mirror exists so a teardown
         // that finds no webview left can still archive (docs/specs/notepad.md).
-        setVolatileForRouter(notepadRouterId, msg.snapshot);
+        setVolatileForRouter(routerId, msg.snapshot);
         break;
       case 'dormouse:themeColors':
         // Webview reports its resolved terminal theme; cache for OSC color replies.
@@ -850,10 +858,8 @@ export function attachRouter(
         // Tear down previous subscriptions first (webview was destroyed and recreated).
         disconnectWebview?.();
         disconnectWebview = connectWebview();
-        // Recreated content is a new realm: the old one's engagement and the
-        // awaits it parked went with it.
-        alertManager.removeViewer(viewerId);
-        cancelAllPendingAwaits();
+        // Recreated content is a new realm.
+        endRealm();
 
         // Re-publish the currently-selected shell so split-spawns in the
         // freshly-mounted webview know what to use.
@@ -983,10 +989,10 @@ export function attachRouter(
         break;
       case 'alert:engagement':
         // `setViewer` revalidates the shape: only a literal `idle` escalates.
-        alertManager.setViewer(viewerId, { present: msg.present, focusId: msg.focusId }, msg.lapse);
+        alertManager.setViewer(routerId, msg.state, msg.lapse);
         break;
       case 'alert:acknowledge':
-        alertManager.acknowledge(msg.id, { input: msg.input === true });
+        alertManager.acknowledge(msg.id, { input: false });
         break;
       case 'alert:resize':
         alertManager.onResize(msg.id);
@@ -1048,8 +1054,7 @@ export function attachRouter(
         if (!request.pending.delete(router)) continue;
         if (request.pending.size === 0) request.settle();
       }
-      cancelAllPendingAwaits();
-      alertManager.removeViewer(viewerId);
+      endRealm();
       removeWatchedCommandListener();
       removeAlertSettingsListener();
       resolveAllFlushRequests();
@@ -1087,11 +1092,11 @@ export function attachRouter(
         ? Promise.resolve()
         : killOnDispose
           ? refreshMirrorCwds(
-            takeVolatileForRouter(notepadRouterId),
+            takeVolatileForRouter(routerId),
             ptyManager.getCwd,
             TEARDOWN_CWD_REFRESH_MS,
           ).then((refreshed) => archiveVolatileMirror(notepadContext, refreshed))
-          : mutateNotepadArchive(notepadContext, takeStagedForRouter(notepadRouterId));
+          : mutateNotepadArchive(notepadContext, takeStagedForRouter(routerId));
       void write
         .catch((err) => {
           log.error('[notepad] could not commit a disposed webview\'s archive write:', String(err));
diff --git a/vscode-ext/src/message-types.ts b/vscode-ext/src/message-types.ts
index 7787e7871..70d8d77ad 100644
--- a/vscode-ext/src/message-types.ts
+++ b/vscode-ext/src/message-types.ts
@@ -3,6 +3,7 @@ import type { HelperIdentity, TerminalContextRequest, TerminalContextInfo } from
 import type {
   AwaitOutcome,
   AwaitUntil,
+  Engagement,
   EngagementLapse,
 } from '../../lib/src/lib/alert-manager';
 import type { AlertSettings } from '../../lib/src/lib/alert-settings';
@@ -18,7 +19,7 @@ import type { VolatileNotepadSnapshot } from '../../lib/src/lib/notepad/types';
 export type WebviewMessage =
   | { type: 'pty:context'; request: TerminalContextRequest; requestId: string }
   | { type: 'pty:spawn'; id: string; options?: { cols?: number; rows?: number; cwd?: string; shell?: string; args?: string[]; helper?: HelperIdentity } }
-  | { type: 'pty:input'; id: string; data: string; paced?: boolean }
+  | { type: 'pty:input'; id: string; data: string; paced?: boolean; userInput?: true }
   | { type: 'pty:resize'; id: string; cols: number; rows: number }
   | { type: 'pty:kill'; id: string }
   | { type: 'pty:getCwd'; id: string; requestId?: string }
@@ -69,8 +70,8 @@ export type WebviewMessage =
   | { type: 'alert:updateSettings'; settings: AlertSettings }
   | { type: 'alert:dismiss'; id: string }
   // This webview is one engagement viewer (docs/specs/alert.md → Engagement).
-  | { type: 'alert:engagement'; present: boolean; focusId: string | null; lapse?: EngagementLapse }
-  | { type: 'alert:acknowledge'; id: string; input: boolean }
+  | { type: 'alert:engagement'; state: Engagement; lapse?: EngagementLapse }
+  | { type: 'alert:acknowledge'; id: string }
   | { type: 'alert:resize'; id: string }
   | { type: 'alert:toggleTodo'; id: string }
   | { type: 'alert:clearTodo'; id: string }
diff --git a/vscode-ext/test/message-router.test.ts b/vscode-ext/test/message-router.test.ts
index 1fdb3755f..1d91d91fb 100644
--- a/vscode-ext/test/message-router.test.ts
+++ b/vscode-ext/test/message-router.test.ts
@@ -41,6 +41,8 @@ const ptys = vi.hoisted(() => ({
   buffered: new Map<string, { alive: boolean }>(),
   /** `'write'` and `'kill <id>'`, in the order they happened. */
   order: [] as string[],
+  /** Called on each PTY write, as the pty host receives it. */
+  onWrite: null as ((id: string, data: string) => void) | null,
 }));
 
 vi.mock('../src/pty-manager', async (importOriginal) => ({
@@ -60,6 +62,7 @@ vi.mock('../src/pty-manager', async (importOriginal) => ({
     ptys.order.push(`kill ${id}`);
     ptys.buffered.delete(id);
   },
+  write: (id: string, data: string) => ptys.onWrite?.(id, data),
 }));
 
 vi.mock('../src/burrow', () => ({
@@ -117,6 +120,7 @@ beforeEach(async () => {
   ptys.cwdWait = null;
   ptys.buffered.clear();
   ptys.order = [];
+  ptys.onWrite = null;
   router = (await import('../src/message-router')) as RouterModule;
   // The same instance the router holds — `resetModules` gave this test its own
   // extension host, and both imports land in that one registry.
@@ -632,9 +636,9 @@ describe('engagement viewers', () => {
     const disposeA = router.attachRouter(a.channel);
     const disposeB = router.attachRouter(b.channel);
     try {
-      a.send({ type: 'alert:engagement', present: true, focusId: 'pty-a' });
-      b.send({ type: 'alert:engagement', present: true, focusId: 'pty-b' });
-      a.send({ type: 'alert:engagement', present: false, focusId: null, lapse: 'leave' });
+      a.send({ type: 'alert:engagement', state: { present: true, focusId: 'pty-a' } });
+      b.send({ type: 'alert:engagement', state: { present: true, focusId: 'pty-b' } });
+      a.send({ type: 'alert:engagement', state: { present: false, focusId: null }, lapse: 'leave' });
 
       ptys.callbacks!.onData('pty-b', REPORT);
       expect(status('pty-b')).not.toBe('ALERT_RINGING');
@@ -650,17 +654,37 @@ describe('engagement viewers', () => {
     try {
       ptys.callbacks!.onData('pty-ack', REPORT);
       expect(status('pty-ack')).toBe('ALERT_RINGING');
-      webview.send({ type: 'alert:acknowledge', id: 'pty-ack', input: false });
+      webview.send({ type: 'alert:acknowledge', id: 'pty-ack' });
       expect(router.getAlertStates().get('pty-ack')).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
     } finally {
       disposable.dispose();
     }
   });
 
+  it('acknowledges user input, echo window included, before writing it', () => {
+    const webview = fakeWebview();
+    const disposable = router.attachRouter(webview.channel);
+    try {
+      ptys.callbacks!.onData('pty-typed', REPORT);
+      const atWrite: Array<string | undefined> = [];
+      ptys.onWrite = (id) => void atWrite.push(status(id));
+      webview.send({ type: 'pty:input', id: 'pty-typed', data: '\x1b[I' });
+      webview.send({ type: 'pty:input', id: 'pty-typed', data: 'y', userInput: true });
+      expect(atWrite).toEqual(['ALERT_RINGING', 'WATCHING_DISABLED']);
+      expect(router.getAlertStates().get('pty-typed')?.todo).toBe(false);
+
+      // A bell answering the key rings no one.
+      ptys.callbacks!.onData('pty-typed', REPORT);
+      expect(status('pty-typed')).not.toBe('ALERT_RINGING');
+    } finally {
+      disposable.dispose();
+    }
+  });
+
   it('stops engaging anything once its webview is disposed', () => {
     const webview = fakeWebview();
     const disposable = router.attachRouter(webview.channel);
-    webview.send({ type: 'alert:engagement', present: true, focusId: 'pty-gone' });
+    webview.send({ type: 'alert:engagement', state: { present: true, focusId: 'pty-gone' } });
     disposable.dispose();
 
     ptys.callbacks!.onData('pty-gone', REPORT);
@@ -672,7 +696,7 @@ describe('engagement viewers', () => {
     const disposable = router.attachRouter(webview.channel);
     try {
       webview.send({ type: 'dormouse:init' });
-      webview.send({ type: 'alert:engagement', present: true, focusId: 'pty-init' });
+      webview.send({ type: 'alert:engagement', state: { present: true, focusId: 'pty-init' } });
       webview.send({ type: 'alert:await', requestId: 'await-init', id: 'pty-init', until: 'exit', timeoutMs: 600_000 });
 
       // The content was destroyed and rebuilt; the old one's engagement and
diff --git a/website/src/components/PocketTerminalExperience.tsx b/website/src/components/PocketTerminalExperience.tsx
index f530e2200..522ac2449 100644
--- a/website/src/components/PocketTerminalExperience.tsx
+++ b/website/src/components/PocketTerminalExperience.tsx
@@ -1,6 +1,7 @@
 import { useCallback, useEffect, useRef, useState, useSyncExternalStore } from "react";
 import { MobileTerminalUi, paneMouseOverride, type MobileTerminalKeyboardMode, type MobileTerminalTouchMode } from "dormouse-lib/components/MobileTerminalUi";
 import { MobileWall, useMobileWallSessionItems, type MobileWallSession } from "dormouse-lib/components/MobileWall";
+import { writeUserInput } from "dormouse-lib/lib/terminal-registry";
 import {
   getMouseSelectionSnapshot,
   setOverride as setMouseOverride,
@@ -255,7 +256,7 @@ export function PocketTerminalExperience({
       cursorTouchAvailable={cursorTouchAvailable}
       sessions={sessionItems}
       onSessionSelect={setActivePaneId}
-      onSendInput={(data) => adapterRef.current?.writePty(activePaneId, data)}
+      onSendInput={(data) => { if (adapterRef.current) writeUserInput(activePaneId, data); }}
       onGestureInput={handleGestureInput}
       onPaste={async () => {
         const { doPaste } = await import("dormouse-lib/lib/clipboard");
diff --git a/website/src/lib/tut-runner.ts b/website/src/lib/tut-runner.ts
index 6a2ae10b2..893f06a9f 100644
--- a/website/src/lib/tut-runner.ts
+++ b/website/src/lib/tut-runner.ts
@@ -185,7 +185,7 @@ export class TutRunner implements InteractiveProgram {
     this.state = options.state;
     this.profile = options.profile ?? DESKTOP_TUTORIAL_PROFILE;
     this.onExit = options.onExit;
-    this.getInactivityTimeoutMs = options.getInactivityTimeoutMs ?? (() => cfg.alert.userAttention);
+    this.getInactivityTimeoutMs = options.getInactivityTimeoutMs ?? (() => cfg.alert.inactivityTimeout);
     this.onTriggerBusyDemo = options.onTriggerBusyDemo;
     this.onTriggerNotifyDemo = options.onTriggerNotifyDemo;
     this.onTriggerCommandExitDemo = options.onTriggerCommandExitDemo;

From a0ab7708e82bcac0c383082607ecca0ef2e5311b Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 23 Sep 2026 20:31:12 -0700
Subject: [PATCH 07/16] Move standalone's alert manager into the sidecar

- One AlertManager per app, beside the PTYs and the parse site, fed in
  stream order; windows are viewers (stamped by label) that send commands
  and render `alert:state`, exactly like VS Code's extension host.
- A window reload keeps its rings and TODOs; alert timers no longer run
  in a throttled webview; awaits survive a Workspace transfer and the
  per-window transfer snapshot machinery is deleted.
- User input rides the PTY write so the sidecar acknowledges before the
  echo; remote Client writes acknowledge and remote resizes get the resize
  grace in both hosts; a killed VS Code panel removes its entries.
- Exited PTYs stay owned until killed, so clearing their TODO still
  reaches the window.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwN55bUVmCNmPiX7vHGCVF
---
 .gitignore                                    |   7 +-
 docs/specs/alert.md                           |  49 ++--
 docs/specs/alert.rationale.md                 |   4 +-
 docs/specs/dor-tool.md                        |   2 +-
 docs/specs/layout.md                          |   2 +-
 docs/specs/remote-api.md                      |   2 +-
 docs/specs/standalone.md                      |  94 ++++--
 docs/specs/standalone.rationale.md            |  13 +-
 docs/specs/terminal-escapes.md                |   6 +-
 docs/specs/transport.md                       |  11 +-
 docs/specs/vscode.md                          |   3 +-
 lib/src/components/wall/workspace-transfer.ts |   4 +-
 lib/src/host/alert-client.test.ts             | 162 +++++++++++
 lib/src/host/alert-client.ts                  | 153 ++++++++++
 lib/src/host/alert-host.test.ts               | 270 ++++++++++++++++++
 lib/src/host/alert-host.ts                    | 205 +++++++++++++
 lib/src/host/alert-protocol.ts                |  40 +++
 lib/src/host/alert-store-host.test.ts         |  95 ------
 lib/src/host/alert-store-host.ts              | 106 -------
 lib/src/host/remote/sidecar-entry.test.ts     |  87 +++++-
 lib/src/host/remote/sidecar-entry.ts          |  52 +++-
 lib/src/lib/alert-engagement.test.ts          |   4 +-
 lib/src/lib/alert-manager-test-utils.ts       |   5 +-
 lib/src/lib/alert-manager.test.ts             |  19 +-
 lib/src/lib/alert-manager.ts                  | 116 ++------
 lib/src/lib/alert-runtime-transfer.test.ts    | 107 -------
 lib/src/lib/alert-settings.ts                 |   2 +-
 lib/src/lib/platform/fake-adapter.ts          |   8 +-
 lib/src/lib/platform/types.ts                 |  16 +-
 lib/src/lib/quiesce-detector.ts               |  40 +--
 lib/src/lib/session-restore.ts                |   9 +-
 .../lib/terminal-lifecycle.release.test.ts    |  16 ++
 lib/src/lib/terminal-lifecycle.ts             |  13 +-
 lib/src/lib/terminal-protocol.ts              |  29 +-
 lib/src/lib/tool-announce.test.ts             |  15 +-
 lib/src/lib/tool-state.test.ts                |  11 +-
 scripts/spec-word-budgets.json                |   4 +-
 standalone/scripts/build-sidecar-proxy.mjs    |  11 +-
 standalone/scripts/dev-agent-browser.mjs      |  18 +-
 standalone/scripts/dev-agent-browser.test.mjs |  25 ++
 standalone/sidecar/helper-terminal.test.js    |   4 +
 standalone/sidecar/main-wiring.test.js        |  36 +++
 standalone/sidecar/main.js                    |  59 ++--
 standalone/sidecar/pty-core.js                |   8 +-
 standalone/src-tauri/src/lib.rs               | 151 ++++++++--
 standalone/src-tauri/src/routing.rs           |  49 ++--
 .../src/browser-sidecar-adapter.test.ts       |  75 +++--
 standalone/src/browser-sidecar-adapter.ts     | 124 +++-----
 standalone/src/tauri-adapter.test.ts          | 153 ++++++----
 standalone/src/tauri-adapter.ts               | 193 ++++---------
 standalone/src/workspace-move.test.ts         |  65 ++---
 standalone/src/workspace-move.ts              |  46 +--
 vscode-ext/src/message-router.ts              |  32 ++-
 vscode-ext/test/message-router.test.ts        |  37 ++-
 54 files changed, 1793 insertions(+), 1074 deletions(-)
 create mode 100644 lib/src/host/alert-client.test.ts
 create mode 100644 lib/src/host/alert-client.ts
 create mode 100644 lib/src/host/alert-host.test.ts
 create mode 100644 lib/src/host/alert-host.ts
 create mode 100644 lib/src/host/alert-protocol.ts
 delete mode 100644 lib/src/host/alert-store-host.test.ts
 delete mode 100644 lib/src/host/alert-store-host.ts
 delete mode 100644 lib/src/lib/alert-runtime-transfer.test.ts

diff --git a/.gitignore b/.gitignore
index 07ab9e96f..b9114d7d1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -36,10 +36,11 @@ standalone/sidecar/iframe-proxy.cjs
 standalone/sidecar/recovery.cjs
 standalone/sidecar/agent-browser-host.cjs
 standalone/sidecar/burrow.cjs
-standalone/sidecar/alert-store.cjs
-# Kept beside it: a checkout that built before the Burrow rename still holds
-# the old bundle, and `bundle.resources` would ship it.
+# Kept beside it: a checkout that built before the Burrow rename, or before the
+# alerts joined its bundle, still holds the old bundle, and `bundle.resources`
+# would ship it.
 standalone/sidecar/remote-host.cjs
+standalone/sidecar/alert-store.cjs
 standalone/sidecar/tool-host.cjs
 standalone/sidecar/git-info.cjs
 standalone/sidecar/node_modules/
diff --git a/docs/specs/alert.md b/docs/specs/alert.md
index f18e3af89..97465ee42 100644
--- a/docs/specs/alert.md
+++ b/docs/specs/alert.md
@@ -59,17 +59,17 @@ Three separate signals, never one lease (rationale):
 **A Session is engaged while some present viewer focuses it**, and engagement alone decides holding over ringing.
 
 - **Must compute presence in the renderer and report transitions only**: an input event only stamps a time, and the host keeps no presence timer. **An end of presence names its lapse** — `idle` when the timeout ran out, `leave` on a window blur or hide. **A blur is a leave only when `document.hasFocus()` is false** (`docs/specs/layout.md` → Corner cases #2). Focus or visibility returning counts as input.
-- **Must keep engagement per viewer**, deduped at the renderer, so one viewer's leave never disengages a Session another viewer engages. **An absent viewer reports no focus change.** VS Code gives each webview its own viewer (`docs/specs/vscode.md`); any other manager has one, `LOCAL_VIEWER`.
+- **Must keep engagement per viewer**, deduped at the renderer, so one viewer's leave never disengages a Session another viewer engages. **An absent viewer reports no focus change.** VS Code gives each webview its own viewer (`docs/specs/vscode.md`), standalone each window, by its label (`docs/specs/standalone.md` → Alerts); the fake adapter has one, `LOCAL_VIEWER`.
 
 | Gesture | Acknowledges |
 |---|---|
-| typing into the pane (CSI/SS3 key encodings included), a paste, a file drop, the mobile input bar or a gesture key | with input |
+| typing into the pane (CSI/SS3 key encodings included), a paste, a file drop, the mobile input bar or a gesture key, a remote Client's write | with input |
 | a Pane body or header click, zoom, the dev-server chip, entering passthrough by keyboard, a Door click or `Enter`, a mobile tap | without input |
 | a terminal reply, a mouse-only report chunk, `d` reattach, a spawn, split, or promotion, a `dor` reveal, an embed focusing itself, DOM focus alone | nothing |
 
 - **Must acknowledge at each gesture's handler, never in the passthrough entry the silent paths share.**
 - **Never treat terminal replies or mouse-only report chunks as keyboard input** (rationale).
-- **Must write all human-originated PTY input through `writeUserInput`**, the mobile input bar's included: it carries `userInput`, and the host acknowledges it with input before writing it, in the one message.
+- **Must write all human-originated PTY input through `writeUserInput`**, the mobile input bar's included: it carries `userInput`, and the host acknowledges it with input before writing it, in the one message. **A remote Client's write acknowledges with input at the host's Burrow provider**, the Burrow having dropped a mirror's terminal replies.
 - **Never create an Activity entry to acknowledge**, the host's one check, so a browser Surface keeps its own TODO.
 - **User input opens the echo window** (`cfg.alert.echoWindow`) even when acknowledging clears nothing, a helper's included. Output inside it is ignored entirely — detector, `outputSince`, the acknowledged state, awaits — and a completion inside it neither rings nor is held (rationale).
 
@@ -81,7 +81,7 @@ Every completion — a detector settle, a command finish, a direct notification,
 
 Claimants get first refusal per Session in registration order; the first to return `true` claims the event and the rest are not offered it. **A claimed event never rings, never sets TODO, and never stores an `ActivityNotification`** — it stops before the ring rules, where the echo window, holding, and the command-exit seen and minimum-runtime checks live.
 
-**Must hold a completion that would ring an engaged Session**: the sources it would raise and the richest detail (Clearing And TODO), repeated holds merging, never public. A deferred report that comes due while engaged is held too. **Presence lapsing `idle` with focus unchanged rings what was held**, each source by its unengaged path; any other end drops it — a user verb (Clearing And TODO), focus moving away, the viewer leaving, live-transfer suspension, seeding, removal, or teardown (rationale). **Dropping on an explicit disengage may be a mistake** (rationale). Resumed watched work and rule removal withdraw a held `watching` source as they withdraw a ringing one (WATCHING Track).
+**Must hold a completion that would ring an engaged Session**: the sources it would raise and the richest detail (Clearing And TODO), repeated holds merging, never public. A deferred report that comes due while engaged is held too. **Presence lapsing `idle` with focus unchanged rings what was held**, each source by its unengaged path; any other end drops it — a user verb (Clearing And TODO), focus moving away, the viewer leaving, seeding, removal, or teardown (rationale). **Dropping on an explicit disengage may be a mistake** (rationale). Resumed watched work and rule removal withdraw a held `watching` source as they withdraw a ringing one (WATCHING Track).
 
 With `deferAlertsUntilQuiet` enabled:
 
@@ -91,7 +91,7 @@ With `deferAlertsUntilQuiet` enabled:
 - **Must defer after claimants and ring eligibility, never redispatch the historical `CompletionEvent`** (rationale).
 - **Keep pending intent live-only and bounded** to one protocol notification, chosen by richness (Clearing And TODO). Meaningful output moves its quiet deadline; command-boundary detector resets do not drop it.
 - **Cancel pending delivery on an acknowledgement, a dismissal that clears a ring, TODO changes, removal, seeding, or teardown.** A dismiss on a quiet Session keeps it: a cancelled deferral was never visible to dismiss. Disabling the setting releases it immediately; otherwise confirmed quiet raises one fresh ring, after which speech/push begin their own delays.
-- **Must ring a deferral by `cfg.alert.deferCeiling` (30 s) after the first notification deferred**, quiet or not; a replacement keeps that start, and a live transfer carries it (rationale).
+- **Must ring a deferral by `cfg.alert.deferCeiling` (30 s) after the first notification deferred**, quiet or not; a replacement keeps that start (rationale).
 
 Two ordering rules:
 
@@ -153,16 +153,17 @@ An **await** parks on one Session until it finishes what it is doing, then repor
 
 **Several awaits may park on one Session**, sharing one claimant: a completion goes to every await whose condition it satisfies, each resolving on the first qualifying signal after it registered.
 
-**In VS Code an await crosses the webview -> extension-host boundary**, and the wait itself never leaves the host:
+**In VS Code and standalone an await crosses from the renderer to the host process that holds the manager**, and the wait itself never leaves the host:
 
-- The webview posts `alert:await` and, if it gives up, `alert:awaitCancel`; **the host answers exactly one `alert:awaitResult` per request**, a cancel included.
-- **A disposing webview must cancel everything it had parked, and must answer those requests itself *synchronously*** (rationale).
-- `cancelled` has no wire outcome of its own: the webview reports it to `dor` as an error, which is also what forgets the in-flight control request.
-- Other hosts call `awaitCompletion` in-process. The Pocket phone adapter has no `dor` and protocol-v1 carries no await, so it settles every request `cancelled` at once.
+- The renderer asks to park and, if it gives up, to cancel; **the host answers exactly one result per await**, a cancel included — VS Code over `alert:await` / `alert:awaitCancel` / `alert:awaitResult` by `requestId`, standalone per `docs/specs/standalone.md` → Alerts.
+- **A realm that ends — a disposed or recreated webview, a reloaded or closed window — has everything it parked cancelled and answered by the host, *synchronously*** (rationale); a disposing standalone adapter settles its own.
+- `cancelled` has no wire outcome of its own: the renderer reports it to `dor` as an error, which is also what forgets the in-flight control request.
+- The fake adapter calls `awaitCompletion` in-process. The Pocket phone adapter has no `dor` and protocol-v1 carries no await, so it settles every request `cancelled` at once.
+- **An await survives a Workspace transfer**: the manager never moves (Live Workspace transfer).
 
-**A PTY exit or Session removal resolves every waiter still parked as `died`**, after command-finish dispatch gets first chance to resolve normally. Manager disposal and live transfer suspension resolve every waiter as `cancelled`.
+**A PTY exit or Session removal resolves every waiter still parked as `died`**, after command-finish dispatch gets first chance to resolve normally. Manager disposal resolves every waiter as `cancelled`.
 
-Source of truth: `awaitCompletion` in `lib/src/lib/alert-manager.ts`; `alertAwait` in `lib/src/lib/platform/types.ts` and `lib/src/lib/platform/vscode-adapter.ts`; `vscode-ext/src/message-router.ts`.
+Source of truth: `awaitCompletion` in `lib/src/lib/alert-manager.ts`; `alertAwait` in `lib/src/lib/platform/types.ts`, `lib/src/lib/platform/vscode-adapter.ts` and `lib/src/host/alert-client.ts`; `vscode-ext/src/message-router.ts`; `createSidecarAlerts` in `lib/src/host/alert-host.ts`.
 
 ## WATCHING Track
 
@@ -210,7 +211,7 @@ Source of truth: `commandWatchKey` / `watchRuleFor` in `lib/src/lib/terminal-sta
 
 **Terminal notifications are independent of WATCHING** and follow the deferral policy in Completion events. **An engaged Session holds a report** (Completion events); holding leaves a progress cycle alone. A report raises the ring's `report` source (Clearing And TODO).
 
-**Must apply a parse batch's reports and command boundaries in stream order, timestamping its semantic events once** for both the `AlertManager` and the terminal-state store; standalone, receiving them as two events, still applies reports first. Pinned by `judges a notification written after a command finish against the reset detector` in `lib/src/lib/alert-manager.test.ts`.
+**Must apply a parse batch's reports and command boundaries in stream order, timestamping its semantic events once** for both the `AlertManager` and the terminal-state store, at the host's parse site in both hosts. Pinned by `judges a notification written after a command finish against the reset detector` in `lib/src/lib/alert-manager.test.ts`.
 
 Sequence syntax lives in `docs/specs/terminal-escapes.md`; what each means here:
 
@@ -278,18 +279,20 @@ Source of truth: `raiseRing` / `withdrawRingSource` / `clearRingForUser` in `lib
 
 ## Live Workspace transfer
 
-- **Must transfer live alert state separately from persisted reminders:** the ring and its episode, the progress cycle, the acknowledgement, command watch, deferred notification with its start, and detector history/deadlines travel in the marked transfer content. **Never read this content on cold restore.**
-- **Must suspend source delivery before handing ownership to the host**, freezing its detector, rule walk, and controls at content capture, and **must await host hand-back when source content capture fails**, holding that suspension until routing returns. The destination restores receipts after persisted seeding and before the runtime publishes, and enables delivery only after `adopt_done` succeeds; refusal restores the source runtime and its pending deadlines. Transaction order is `docs/specs/standalone.md` → "Arrival queue".
-- **Must discard imported runtime, Activity, and pane state before releasing the delivery guards on any target failure**, mount or no mount, so a watcher never re-arms on a Workspace this window never owned. A receipt forgotten on an episode already observed is consumed, never fresh.
+**A Session's alert state never moves**: the host's one manager holds it (`docs/specs/standalone.md` → Alerts), and a transfer moves only where its `alert:state` is routed — the source until the mark, then the target, whose collection is answered with every listed Session's state (rationale).
+
+- **Never remove or seed an entry on a departure, a refused arrival, or a hand-back**: releasing a Session is not ending it. Only a kill removes one.
+- **A replay never feeds the manager**, whose host parse already did.
+- **Awaits survive a transfer**; a seen command stays seen, so it arrives armed; the destination's viewers establish their own engagement.
+- **Must suspend the source's alarm delivery before handing ownership to the host**, and **must await host hand-back when source content capture fails**, holding that suspension until routing returns. The destination restores receipts before its collection, and enables delivery only after `adopt_done` succeeds; refusal resumes the source's. Transaction order is `docs/specs/standalone.md` → "Arrival queue".
+- **Must discard this window's Activity and pane state before releasing the delivery guards on any target failure**, mount or no mount, so a watcher never re-arms on a Workspace this window never owned. A receipt forgotten on an episode already observed is consumed, never fresh.
 - **Must carry per-sink receipts with the episode:** pending/queued work retains its original deadline; engine-admitted speech and dispatched push are consumed and never replayed. Suspending cuts current speech; a partially heard utterance is not restarted after a move or refusal.
-- **Must cancel parked await callers at suspension**, carrying no claimant closures and nothing held. A seen command stays seen, so it arrives armed; the destination's viewers establish their own engagement.
-- **Must process notification events and visible output from the one since-mark replay that carries the arrival's request token, once.** Any other replay, whatever its token, stays historical and silent; query responses are never replayed. The parser boundary limitation follows `docs/specs/transport.md` → Transferring a Workspace.
 
-Source of truth: `pauseForTransfer` / `resumeFromTransfer` / `applyReplay` in `lib/src/lib/alert-manager.ts`; `snapshot` / `restore` in `lib/src/lib/quiesce-detector.ts`; `snapshotAlertDelivery` / `restoreAlertDelivery` in `lib/src/lib/alert-delivery-state.ts`; `planArrival` / `discardArrival` in `standalone/src/workspace-move.ts`. Pinned by `lib/src/lib/alert-runtime-transfer.test.ts`, `lib/src/lib/alert-delivery-policy.test.ts`, and `standalone/src/workspace-move.test.ts`.
+Source of truth: `teardownSession` in `lib/src/lib/terminal-lifecycle.ts`; `snapshotAlertDelivery` / `restoreAlertDelivery` in `lib/src/lib/alert-delivery-state.ts`; `planArrival` / `discardArrival` in `standalone/src/workspace-move.ts`. Pinned by `lib/src/lib/terminal-lifecycle.release.test.ts`, `lib/src/lib/alert-delivery-policy.test.ts`, and `standalone/src/workspace-move.test.ts`.
 
 ## Alarm settings
 
-Application alarm defaults live beside the WATCHING rule set, edited in **Settings** (below). **Every other store reached from Settings stays its own — never fold one into `AlertSettings`**, which is relayed wholesale to the host. **A host revalidates the blob before installing it** (`normalizeAlertSettings`): a webview must never be able to hand it a NaN or an absurd timer. Both stores run the same two classes in either host (`lib/src/lib/watched-command-host.ts`, `lib/src/lib/alert-settings-host.ts`), bound for standalone by `lib/src/host/alert-store-host.ts`; the shape, its defaults and its validation are the platform-free `lib/src/lib/alert-settings-model.ts`.
+Application alarm defaults live beside the WATCHING rule set, edited in **Settings** (below). **Every other store reached from Settings stays its own — never fold one into `AlertSettings`**, which is relayed wholesale to the host. **A host revalidates the blob before installing it** (`normalizeAlertSettings`): a webview must never be able to hand it a NaN or an absurd timer. Both stores run the same two classes in either host (`lib/src/lib/watched-command-host.ts`, `lib/src/lib/alert-settings-host.ts`), bound to standalone's sidecar manager by `lib/src/host/alert-host.ts`; the shape, its defaults and its validation are the platform-free `lib/src/lib/alert-settings-model.ts`.
 
 | Field | Meaning |
 |---|---|
@@ -305,7 +308,7 @@ Rules:
 
 - **Validate and clamp every field on read *and* on write** (`normalizeAlertSettings`), so a hand-edited `localStorage` blob or a hostile message can never install a `NaN` or absurd timer. Unknown keys are dropped and missing keys defaulted, so the blob evolves additively with no version field. `cfg.alert` owns the inactivity default; `DEFAULT_ALERT_SETTINGS` owns the sink and boolean defaults.
 - **Distribution follows the WATCHING rule set's seed/broadcast shape** (rationale), except that an edit **relays the whole blob** rather than a per-command delta, so every webview resolves workspace overrides against the same defaults. Wire contract and host revalidation: `docs/specs/transport.md`.
-- **Must keep detection settings application-wide.** Standalone and browser-sidecar renderers apply detector settings to their local manager; VS Code applies them in the extension host.
+- **Must keep detection settings application-wide**, applied to each host's one manager: the standalone sidecar's and the VS Code extension host's.
 
 **Must resolve delivery policy from application defaults, then sparse Workspace overrides.** Speech/push enable and delay can override independently; `speakVoice` selects a local engine voice URI, missing inherits the system-voice default, and explicit null selects the system voice. Missing or unavailable voices fall back to the engine default without erasing the saved choice. Unknown/invalid overrides are dropped; finite delays share the application clamp.
 
@@ -409,11 +412,11 @@ The header shows a fixed-text `TODO` pill when `todo === true`, a hover/focus no
 - **`a` on the selected Pane in command mode dismisses a ringing Session and opens the terminal context, whatever the status; it never edits a WATCHING rule.**
 - **A WATCHING rule is created only in the terminal context** ("Watch all `<key>` commands"), which offers the row whenever a foreground command has a watch key — naming the bare runner rule instead when one already covers the running script — and removed there or in Settings. Removing it anywhere drops it for every Session running that command.
 - Right-click always opens the context. Pressing `t` toggles TODO.
-- **The mobile composition dismisses by acknowledgement alone** — a tap, or a keystroke that also clears TODO — and wears its ring as the alarm inset, never an icon (`docs/specs/mobile-terminal-ui.md`). A Client cannot dismiss yet (`docs/specs/remote-api.md` → Future).
+- **The mobile composition dismisses by acknowledgement alone** — a tap, or a keystroke that also clears TODO — and wears its ring as the alarm inset, never an icon (`docs/specs/mobile-terminal-ui.md`). In Pocket only the keystroke reaches the host, as a Client's write (Engagement); a Client cannot dismiss yet (`docs/specs/remote-api.md` → Future).
 
 **Must keep context alert controls scoped to the source**, with TODO, running-command WATCHING, and notification detail. Settings owns the global watched-command list. **Must suppress helper alerting until promotion, including after exit**: no completion dispatch (await, ring, TODO, speech, push), protocol report, acknowledgement, or TODO control, and only the default state published. **A helper still tracks its command and feeds its detector**, so one promoted mid-command is WATCHING what it runs; promotion publishes that state and never replays a suppressed event (rationale). Pinned by `helper Sessions` in `lib/src/lib/alert-manager.test.ts`.
 
-Source of truth: `TerminalContext` in `lib/src/components/wall/TerminalContext.tsx`; `setHelper` in `lib/src/lib/alert-manager.ts`, which every host calls at helper spawn, listing, and promotion.
+Source of truth: `TerminalContext` in `lib/src/components/wall/TerminalContext.tsx`; `setHelper` in `lib/src/lib/alert-manager.ts`, which every host calls at helper spawn and promotion.
 
 The TODO pill always displays `TODO`; remote notification text belongs in preview/detail surfaces, not inside the pill. Clicking the pill clears TODO, and on clear the pill briefly shows the success flourish before unmounting.
 
diff --git a/docs/specs/alert.rationale.md b/docs/specs/alert.rationale.md
index 13d8b0ef8..8d578d6b5 100644
--- a/docs/specs/alert.rationale.md
+++ b/docs/specs/alert.rationale.md
@@ -68,7 +68,7 @@
 
 **Why the timeout ceiling exists at all.** `timeoutMs` is a safety rail on a blocking call inside an agent loop, not an alert-tuning knob. Like the inactivity timeout it originates a process away and ends up in `setTimeout`, whose delay is a signed 32-bit millisecond count. Anything past ~24.9 days overflows and fires immediately, turning a long park into an instant `timeout`.
 
-**Why a disposing VS Code webview answers its own parked requests synchronously.** A caller that can no longer be answered would otherwise go on absorbing completions the human would have been shown. Synchronously, because the cancelled outcome would arrive a microtask after the router stopped posting and be dropped, leaving `dor` blocked on a reply that never comes.
+**Why an ended realm's awaits are cancelled, and answered synchronously.** A caller that can no longer be answered would otherwise go on absorbing completions the human would have been shown. Synchronously, because in VS Code the cancelled outcome would arrive a microtask after the router stopped posting and be dropped, leaving `dor` blocked on a reply that never comes. Standalone's sidecar answers the same way for one rule across both hosts; a standalone reload keeps its window label, so the window says `hello` rather than the host inferring a new realm from a label list that never changed.
 
 ## WATCHING Track
 
@@ -170,7 +170,7 @@ Guarding only completion leaves a stale `start` free to replace the active utter
 
 ## Live Workspace transfer
 
-A persisted reminder intentionally forgets rings and detector history. Reusing it for a live move erased alert episodes and pending delivery; recreating them from public status could instead speak twice. The live snapshot and per-sink receipt distinguish this handoff from cold restore. Receipt consumption occurs at sink admission because there is no transactional acknowledgement tying audible sound or phone display to Workspace ownership (2026-09).
+The manager used to live in each standalone window, so a move had to snapshot its runtime — the ring and its episode, detector deadlines, the deferred notification — into the transfer content, resume it in the target, and bind a replay token so the since-mark replay's reports fired once; a reused persisted reminder had erased episodes and pending delivery instead, and a release removed the entry the other window still showed. With one manager in the host process nothing moves, and all of that went (2026-09). Per-sink receipts still travel because ring delivery is still scheduled in the renderer. Receipt consumption occurs at sink admission because there is no transactional acknowledgement tying audible sound or phone display to Workspace ownership (2026-09).
 
 ## Workspace union
 
diff --git a/docs/specs/dor-tool.md b/docs/specs/dor-tool.md
index c4acbc770..2b049ca18 100644
--- a/docs/specs/dor-tool.md
+++ b/docs/specs/dor-tool.md
@@ -211,7 +211,7 @@ Source of truth: `toolTakesOverCaller` / `toolRerunsInCaller` / `callerStillPlac
 - Reserved: **Must retain `name`, `dehydrate`, and `persist` as inert parsed fields**, serving the announced-name and D1/D2 items under [Future](#future). Neither `persist: never` nor a `dehydrate` verb changes current persistence.
 - Reserved: **Never assign an OSC 367 verb beyond `serve`, `state`, and `dehydrate`**; `dehydrate` belongs to D2 under [Future](#future), while existing title/progress protocols keep those roles.
 
-Source of truth: `TerminalProtocolParser` / `collectTerminalProtocolAlerts` in `lib/src/lib/terminal-protocol.ts`; `parseToolAnnounce` in `lib/src/lib/tool-announce.ts`; `recordToolAnnounce` in `lib/src/lib/tool-announce-store.ts`; `recordToolEvents` in `lib/src/lib/tool-events.ts`; `createOwnerPtyStream` in `vscode-ext/src/message-router.ts`; `ownerStream` in `lib/src/host/remote/sidecar-entry.ts`. Tests: `lib/src/lib/tool-announce.test.ts`, `standalone/scripts/dev-agent-browser-announce.test.mjs`.
+Source of truth: `TerminalProtocolParser` / `collectTerminalToolEvents` in `lib/src/lib/terminal-protocol.ts`; `parseToolAnnounce` in `lib/src/lib/tool-announce.ts`; `recordToolAnnounce` in `lib/src/lib/tool-announce-store.ts`; `recordToolEvents` in `lib/src/lib/tool-events.ts`; `createOwnerPtyStream` in `vscode-ext/src/message-router.ts`; `ownerStream` in `lib/src/host/remote/sidecar-entry.ts`. Tests: `lib/src/lib/tool-announce.test.ts`, `standalone/scripts/dev-agent-browser-announce.test.mjs`.
 
 ## Unsaved changes
 
diff --git a/docs/specs/layout.md b/docs/specs/layout.md
index 32c999a24..8d0e32077 100644
--- a/docs/specs/layout.md
+++ b/docs/specs/layout.md
@@ -483,7 +483,7 @@ Startup recovery is priority-based:
 **A Window plans once per Workspace off one live-PTY list**: `collectLivePtys` runs the single PTY-list round trip for the whole webview, and each Workspace takes the slice its own saved panes name, so one host answer restores N Workspaces (`docs/specs/standalone.md` → Persistence). A single-Wall host reaches the same behavior through `resumeOrRestore`.
 
 1. **Resume** (webview recreated, retained Live or Exited PTYs): request PTY list + replay data from the platform, `resumeTerminal()` each (500ms timeout). **Saved pane and door titles are seeded back via `setTerminalUserTitle()`** (`docs/specs/transport.md`), so persisted placeholder labels never replay as user pins. If the saved session covers every retained PTY, restore the saved Lath layout when its leaf set matches and reattach saved minimized items as doors. **Never fall through to cold restore just because the visible `paneIds` list is empty** — a wall whose retained sessions are all minimized is still a resume.
-2. **Restore** (app restart, cold start): the Wall's `seed` hydrates from the restored Lath layout, else falls to (3); `restoreTerminal()` per pane with its saved cwd and title, plus the single-use agent resume invocation the host captured (`docs/specs/transport.md` → "Consuming it") and, on a host whose AlertManager lives in the webview, the pane's persisted TODO through `PlatformAdapter.alertSeed`. Browser surfaces are rebuilt from their persisted params instead.
+2. **Restore** (app restart, cold start): the Wall's `seed` hydrates from the restored Lath layout, else falls to (3); `restoreTerminal()` per pane with its saved cwd and title, plus the single-use agent resume invocation the host captured (`docs/specs/transport.md` → "Consuming it") and, on a host that cannot seed itself (standalone), the pane's persisted TODO through `PlatformAdapter.alertSeed`, sent after the spawn. Browser surfaces are rebuilt from their persisted params instead.
 3. **Fallback/manual pane creation**: with no saved layout safely applicable, add panes as splits from the previous pane.
 4. **Empty state**: one new pane.
 
diff --git a/docs/specs/remote-api.md b/docs/specs/remote-api.md
index 3f615a8e4..f48678487 100644
--- a/docs/specs/remote-api.md
+++ b/docs/specs/remote-api.md
@@ -360,7 +360,7 @@ The wire half, as new event names:
 { event: 'terminal.semantic'; data: TerminalSemanticEvent }
 ```
 
-`terminal.resize` lets an attached viewer show its own tether state instead of rendering garbled wrap until re-attach; `terminal.semantic` frees the attached pane's header from the coalesced `directory.snapshot` cadence. Acknowledgement rides the same stage — a `terminal.acknowledge` on touch, without which a Client cannot put a ring out (`alertAcknowledge` is inert today).
+`terminal.resize` lets an attached viewer show its own tether state instead of rendering garbled wrap until re-attach; `terminal.semantic` frees the attached pane's header from the coalesced `directory.snapshot` cadence. Acknowledgement rides the same stage — a `terminal.acknowledge` on touch, without which only a Client's write puts a ring out (`alertAcknowledge` is inert today).
 
 ### 6. Graded grants and layout mutations
 
diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index e961bd318..d23c4fefc 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -209,7 +209,8 @@ rather than being dropped (`docs/specs/remote-api.md` → Directory).
 (`docs/specs/terminal-escapes.md` → Parsing location, which owns the rules): a
 `pty-core` `data` event reaches the webview as the `pty:data`,
 `terminal:semanticEvents` and `terminal:protocolEvents` the bridge emits, never
-raw, and every attached Client reads the same parse. **The webview pushes its
+raw, and every attached Client and the app's `AlertManager` (§Alerts) read the
+same parse. **The webview pushes its
 resolved terminal colours** (`pty_theme_colors` → `pty:themeColors`) because this
 process has no DOM; **null before the first push falls a colour query through to
 xterm.js**, and **a malformed push is ignored, never half-applied.**
@@ -230,6 +231,52 @@ Source of truth: `lib/src/host/remote/service.ts`,
 `burrow_command` / `burrow_state_dir` / `pty_theme_colors` in
 `standalone/src-tauri/src/lib.rs`.
 
+### Alerts
+
+The app's one `AlertManager` runs **in the sidecar**, beside the PTYs and the
+parse that feeds it, as VS Code's runs in its extension host
+(`docs/specs/vscode.md`); every window is one of its viewers
+(`docs/specs/alert.md` → Engagement) (rationale).
+
+- **Must feed it at the parse**, per batch: reports and command boundaries in
+  stream order (`applyTerminalEvents`), then visible output, and each exit. The
+  webview gets the semantic and Tool events alone; **never apply a report in a
+  webview**.
+- **Must start a respawned id's alert state over at `pty:spawn`**, ahead of the
+  cold-restore seed the webview sends after the spawn. Helper status mirrors
+  `pty-core` after each spawn and promotion (`isHelper`).
+- **Webview → sidecar is one passthrough, `alert_command(payload)`**, carrying
+  every `alert*` platform verb as an op (`AlertCommand` in
+  `lib/src/host/alert-protocol.ts`). **Rust stamps the invoking window's label**
+  on it as `window`, exactly as on `burrow_command`: the label is the viewer id
+  and the owner of the awaits a window parks.
+- **Human input rides its write**: `pty_write` carries `userInput`, and the
+  sidecar acknowledges before writing — never a separate `alert_command`. A
+  Client's write through the Burrow acknowledges the same way, and a Client's
+  repaint resize gets the resize grace.
+- **`hello` ends a label's previous realm** — sent at adapter init, a reload
+  keeping the label: its viewer is removed, its parked awaits cancelled and
+  answered. **A label gone from `burrow:windows` gets the same.**
+- **Sidecar → webview**: `alert:state {id, …}` on every change, routed to the
+  Session's owner (§Routing); `alert:awaitResult {awaitId, window, outcome}`,
+  broadcast and matched by the asking adapter's own random `awaitId` — **never
+  carrying a Session `id`**, which would route it to that Session's owner, **nor
+  a `requestId`**, which Rust swallows; and the two app-global stores' snapshots
+  (`docs/specs/alert.md` → Alarm settings).
+- **Must re-send each listed Session's `alert:state` behind the answer to
+  `pty:requestInit`**: a reloaded window and an arriving Workspace learn their
+  rings and TODOs nowhere else, since a live resume seeds nothing.
+- **A disposing adapter settles its own parked awaits `cancelled`.**
+
+Source of truth: `createSidecarAlerts` in `lib/src/host/alert-host.ts`;
+`createSidecarAlertClient` in `lib/src/host/alert-client.ts`;
+`createSidecarSurfaceBridge` in `lib/src/host/remote/sidecar-entry.ts`;
+`alert_command` / `pty_input_message` / `stamp_window` in
+`standalone/src-tauri/src/lib.rs`; the `pty:spawn`, `pty:input` and
+`pty:requestInit` cases in `standalone/sidecar/main.js`. Pinned by
+`lib/src/host/alert-host.test.ts`, `lib/src/host/alert-client.test.ts` and
+`standalone/sidecar/main-wiring.test.js`.
+
 ### Windows node subsystem
 
 On Windows the app carries **two** subsystem variants of the same `node.exe`,
@@ -273,7 +320,7 @@ ordered**:
    headed Chrome window, and a hung agent-browser must not wedge the exit (as in
    the VS Code host's `deactivate()`; `docs/specs/dor-browser.md`).
 2. Close the dor control socket.
-3. `alertStore.dispose()`.
+3. `alerts.dispose()` (§Alerts).
 4. Dispose the Burrow service, dropping the relay socket and settling every
    outstanding ask so nothing waits on a webview that is going away.
 5. `mgr.killAll()` (all PTYs), then `process.exit(0)`.
@@ -434,24 +481,26 @@ Source of truth: `route` in `standalone/src-tauri/src/routing.rs`,
 | Sidecar event | Key | Goes to |
 |---|---|---|
 | `pty:data` | `data.id` | its owner; the source until the id's mark passes, then dropped until its replay, its bytes being in it |
-| `terminal:semanticEvents` | `data.id` | its owner; the source until the id's mark passes, then dropped until its replay — the window receiving the replay re-derives them from it, feeding both pane state and its `AlertManager` (rationale) |
-| `terminal:protocolEvents` | `data.id` | its owner; the source until the id's mark passes, then **held** and delivered, in order, behind the replay, which rebuilds none of them; at most `HELD_EVENTS_MAX` (256) per id, the oldest dropped past it (`held_events_come_back_in_order_and_bounded`) |
+| `terminal:semanticEvents` | `data.id` | its owner; the source until the id's mark passes, then dropped until its replay — the window receiving the replay re-derives them from it (rationale) |
+| `terminal:protocolEvents` | `data.id` | its owner; the source until the id's mark passes, then **held** and delivered, in order, behind the replay — or by a fail-open sweep, which sends none; at most `HELD_EVENTS_MAX` (256) per id, the oldest dropped past it (`held_events_come_back_in_order_and_bounded`) |
 | `pty:exit` | `data.id` | its owner, never suppressed |
 | `pty:replay` | `data.forWindow`, then `data.id` | the requesting window, including exited buffers; without an address, its owner; never suppressed |
 | `pty:marked` | `data.id` | the source still consuming the id, which then falls silent until its replay; otherwise its owner |
 | `pty:list` | `data.forWindow` | the window that asked |
-| `alert:*` carrying `data.id` | `data.id` | its owner |
+| `alert:*` carrying `data.id` | `data.id` | its owner; the source until the id's mark passes (`an_exited_pty_stays_owned_until_it_is_killed`) |
 | `dor:controlRequest` | `params.workspace`, `params.window`, `data.surfaceId` | in that precedence: the window holding the named Workspace (§Workspace registry), the named window, the caller's Surface's owner; none → the focused window |
 | `dor:controlCancel` | `data.requestId` | the window its request went to; unknown → every window |
 | `burrow:ask` | `data.params.surfaceId` | its owner; a Surface with no PTY here, or an ask naming none, → every window (§Burrow service) |
 | everything else | — | every window |
 
-- **Ownership is minted only in `pty_spawn`**, dropped by `pty_kill`, an exit,
-  or the window going away, and reassigned by a transfer. Minting also clears any
-  suppression left under that id: no replay is coming for a fresh PTY.
+- **Ownership is minted only in `pty_spawn`**, dropped by `pty_kill` or the
+  window going away, and reassigned by a transfer. **Never dropped by an exit**:
+  the exited pane is still shown, and its `alert:state` must still reach it.
+  Minting also clears any suppression left under that id: no replay is coming
+  for a fresh PTY.
 - **A PTY event no window owns is dropped, and the shell is reaped.** Every PTY
-  is minted with an owner, so an unowned id is one whose window went away;
-  broadcasting rang every sibling's AlertManager for a pane none of them shows.
+  is owned until killed, so an unowned id is one whose window went away, and a
+  broadcast would hand every sibling state for a pane none of them shows.
   `Destroyed` SIGTERMs whatever the departing window still owned, which is what
   the close ack-timeout path never killed.
 - **A `dor` request naming a Surface no window owns is answered with an error**
@@ -619,7 +668,7 @@ Source of truth: `prepareWorkspaceTransfer` in
 
 Tool transfer follows `docs/specs/dor-tool.md` → Persistence and hosts.
 
-Live Activity and alarm delivery follow `docs/specs/alert.md` → Live Workspace transfer.
+Alert state and alarm delivery follow `docs/specs/alert.md` → Live Workspace transfer.
 
 ### Tear-out
 
@@ -657,8 +706,10 @@ below reads that record rather than inferring itself from the suppression map.
    `pty:requestInit` with **that arrival's ids and no others**; `pty:list` and
    each `pty:replay` echo the collector's token. The target resumes over them,
    hydrates the notes and mounts the Workspace at the payload’s index, else the drop index.
-   **Must seed alert state before requesting replay**, preferring explicit live
-   transfer content to persisted reminders, so older state cannot erase WATCHING rebuilt by replay (`standalone/src/workspace-move.test.ts`).
+   **Never seeds or removes alert state**: it never left the sidecar, whose
+   answer to that `pty:requestInit` re-sends it (§Alerts; `never seeds or
+   removes the host's alert state for an arrival` in
+   `standalone/src/workspace-move.test.ts`).
 4. **Target adopted** invokes `adopt_done(workspaceId)`. Rust retires the record,
    clears pending marks and suppression so live output routes to the target,
    and emits `workspace-departed` for
@@ -683,8 +734,10 @@ below reads that record rather than inferring itself from the suppression map.
   already handed the shells back and the source kept the Workspace, so the
   target releases its Sessions (never kills them), drops the notes, and closes
   the Workspace rather than leaving it live and persisted in two windows. **Must unwind from the received payload without preparing another move.**
-- **Must remove unmounted semantic and alert state when arrival collection times out.**
-  Source of truth: `planArrival` in `standalone/src/workspace-move.ts`.
+- **Must remove this window's unmounted semantic and Activity state when arrival
+  collection times out**, and never the host's alert entries, which the source
+  goes on showing. Source of truth: `discardArrival` in
+  `standalone/src/workspace-move.ts`.
 - **A refused arrival hands the shells back.** The target's `adopt_failed`
   (a `planArrival` timeout, a missing list, a mount error) and a target
   `Destroyed` with the arrival still queued both return `terminalIds` to the
@@ -703,14 +756,15 @@ below reads that record rather than inferring itself from the suppression map.
   returns each id the content marked to the source *suppressed* and asks the
   sidecar for `outputSince(mark)` scoped to the source (`requestId`
   `handback-<workspaceId>`); that replay lifts the suppression and lands in the
-  existing xterms (`acceptHandBackReplay`), the held protocol events behind it.
+  existing xterms (`acceptHandBackReplay`), the held Tool events behind it.
   **Must record source cuts at `pty:marked`, retaining them through target
   replay and natural PTY exit until settlement, and carry replay ids in the failure event**; content
   submission and the source invoke reply may both still be pending. **Must discard
-  cuts on explicit kill and never recreate an exited PTY’s owner on hand-back.**
+  cuts on explicit kill**; an exited PTY is still owned, so a hand-back returns
+  it to the source like a live one (`a_pty_exit_keeps_its_cut_until_the_arrival_settles`).
   **Must apply a handed-back PTY’s exit status after its replay**, leaving its
-  existing pane dead with no running command or active watch
-  (`settles the replayed watch when a marked buffer belongs to an exited PTY` in
+  existing pane dead with no running command
+  (`settles the replayed command when a marked buffer belongs to an exited PTY` in
   `standalone/src/tauri-adapter.test.ts`). An id the
   sidecar never stamped goes straight back: a whole-buffer
   replay would paint it twice (`a_hand_back_replays_only_the_marked_ids`;
@@ -1289,6 +1343,6 @@ The bridge is a transport shim over the same sidecar protocol, not a second PTY
 
 **A CORS preflight is the one carve-out**: an `OPTIONS` answers `204` carrying those headers *before* the token check, since it can never present the non-GET content type the gate demands. **Any other unauthorized caller gets the same `404 not found` as an unknown path**, so the port does not identify itself. The harness prints the token and a ready-made `curl` on startup.
 
-The harness **may omit** native-only desktop chrome (window controls, update checks) but **must preserve** every `PlatformAdapter` contract the app uses — PTY, control-request, clipboard, iframe-proxy, Burrow, agent-browser, and the sidecar-hosted alert stores (`alert_command` in, their broadcasts back; `docs/specs/alert.md`) — so a rule that only holds across the host boundary is exercised rather than answered by a private copy. **`BrowserSidecarHost.init()` resolves on the SSE stream being open, not on its construction**, so a seed cannot precede the stream that carries its reply; **must let retryable connection failures reconnect within the open timeout**; after a reconnect the adapter re-sends its last seeds so the stores republish (`resolves on the stream's open event, not on construction` in `standalone/src/browser-sidecar-host.test.ts`; `re-sends its last seeds when the event stream reconnects` in `standalone/src/browser-sidecar-adapter.test.ts`). Fatal startup handling follows §Boot sequence. It **must mirror** standalone's Session-persistence answer (`docs/specs/transport.md` → "The governing rule"): one `PersistedWindow` per window, in `localStorage` rather than the Rust file store, and the same agent-recovery *claim* against a per-run temp state directory. **The harness must never capture**: a reload there is a live resume over PTYs that survive it, and capture is a quit-only step (§Agent recovery). **Tauri APIs must not be required at static module-evaluation time** when `VITE_DORMOUSE_BROWSER_DEV_HOST` is set — a normal browser loads the page, not the Tauri WebView.
+The harness **may omit** native-only desktop chrome (window controls, update checks) but **must preserve** every `PlatformAdapter` contract the app uses — PTY, control-request, clipboard, iframe-proxy, Burrow, agent-browser, and the sidecar's alerts (`alert_command` in, stamped with the one window label the harness simulates, `main`; their events back; §Alerts) — so a rule that only holds across the host boundary is exercised rather than answered by a private copy. **`BrowserSidecarHost.init()` resolves on the SSE stream being open, not on its construction**, so a seed cannot precede the stream that carries its reply; **must let retryable connection failures reconnect within the open timeout**; after a reconnect the adapter re-sends its last seeds so the stores republish (`resolves on the stream's open event, not on construction` in `standalone/src/browser-sidecar-host.test.ts`; `re-sends its last seeds when the event stream reconnects` in `standalone/src/browser-sidecar-adapter.test.ts`). Fatal startup handling follows §Boot sequence. It **must mirror** standalone's Session-persistence answer (`docs/specs/transport.md` → "The governing rule"): one `PersistedWindow` per window, in `localStorage` rather than the Rust file store, and the same agent-recovery *claim* against a per-run temp state directory. **The harness must never capture**: a reload there is a live resume over PTYs that survive it, and capture is a quit-only step (§Agent recovery). **Tauri APIs must not be required at static module-evaluation time** when `VITE_DORMOUSE_BROWSER_DEV_HOST` is set — a normal browser loads the page, not the Tauri WebView.
 
 Source of truth: `standalone/scripts/dev-agent-browser.mjs`, `standalone/scripts/dev-run.mjs`, `standalone/scripts/dev-host-guard.mjs`, `standalone/src/browser-sidecar-host.ts`, `standalone/src/browser-sidecar-adapter.ts`; `stepBurrow` in `scripts/pairing-walkthrough/steps.mjs`; `sessionForKey` in `dor-lib-common/src/agent-browser.ts`.
diff --git a/docs/specs/standalone.rationale.md b/docs/specs/standalone.rationale.md
index 17a3bb5e6..867a37215 100644
--- a/docs/specs/standalone.rationale.md
+++ b/docs/specs/standalone.rationale.md
@@ -6,6 +6,16 @@
 
 **What a sync blocking command cost.** A cold `agent-browser open` froze the webview for ~3 s — long enough to look like a pane that never appeared — and a hung one would have held it for the full 30 s `AGENT_BROWSER_TIMEOUT`; `(async)` moves the same blocking body onto a runtime worker. The incident is recorded at the `request_from_sidecar_timeout` invariant comment in `standalone/src-tauri/src/lib.rs`.
 
+## Alerts
+
+**Why one manager per host process, beside the PTYs.** Each window used to run its own `AlertManager` in its webview, fed from events the sidecar had already parsed. Three failures followed from where it lived (audit, 2026-09-23): WKWebView throttles a background window's timers, so the detector, deferral and await timers of a window the user was not looking at ran late — exactly the window a completion should summon them back to; a reload started the webview with an empty manager and a live resume seeds nothing, so every ring and TODO in the window vanished; and a Workspace transfer had to freeze one window's manager and thaw it in another (alert.md → Live Workspace transfer). VS Code never had these, because its manager lives in the extension host beside the PTYs and the parse. Moving standalone's there makes the two hosts one shape: the parse feeds one manager in stream order, the Burrow's remote writes reach it in the same process, and a window is only a viewer whose state is routed to it.
+
+**Why `userInput` rides the write.** The echo of a keystroke comes back from the PTY within milliseconds, so the acknowledgement that opens the echo window has to be in effect before the bytes are written. As a second command it would race the write through Rust and the sidecar's stdin, and an echo that won would count as the program working.
+
+**Why an exited PTY stays owned.** Ownership used to end at the exit, since nothing more was emitted for a dead PTY. The sidecar's manager now publishes `alert:state` for it whenever the user acts on the exited pane — a dismiss, a TODO cleared — and a line for an unowned id is dropped, so the pane would ring until it was closed.
+
+**Why an await's result is broadcast.** Routed by the Session's `id` it would reach the Session's owner, not the window that parked it, and a `requestId` is what Rust's invoke matcher swallows. Each adapter mints a random `awaitId`, so a broadcast reaches the one that asked and no other can mistake it — the argument `burrowRequestId` makes for the Burrow's results.
+
 ## Windows node subsystem
 
 **The two Windows Node variants.** `CREATE_NO_WINDOW`, `DETACHED_PROCESS`, and `STARTUPINFO` hiding all failed to suppress Windows 11's DefTerm handoff from a GUI parent (verified 2026-08): Windows launches Windows Terminal to host the console-subsystem child, flashing a stray WT window behind Dormouse. Should a current spawn-time option suppress it, both variants collapse back to the stock console-subsystem Node under `DORMOUSE_NODE`. `dor`'s opposite requirement comes from running inside a shell's ConPTY, where its stdout/stderr are console handles rather than pipes.
@@ -55,7 +65,8 @@ is not idempotent — it mints a fresh id and consumes the pending command line
 so a transfer that split a command's `commandLine` from its `commandStart` left
 the arriving window with a derived title for a command whose real line the
 replay had already recovered. What the replay path genuinely did not rebuild was
-the AlertManager's copy, and that is a listener fix, not a routing one.
+the AlertManager's copy, and that was a listener fix, not a routing one — until
+the manager moved into the sidecar, whose own parse feeds it (§Alerts, 2026-09).
 
 ## What a window's `Destroyed` settles
 
diff --git a/docs/specs/terminal-escapes.md b/docs/specs/terminal-escapes.md
index d8494a001..d5776b9bb 100644
--- a/docs/specs/terminal-escapes.md
+++ b/docs/specs/terminal-escapes.md
@@ -24,7 +24,7 @@ State-driving and security-sensitive OSCs — plus the `CSI > q` query — are p
 
 **Every semantic value `TerminalProtocolParser` *retains* is bounded and stripped of control characters before storage**, whatever the emitter: `TITLE_LIMIT` / `BODY_LIMIT` for titles and notification bodies, whose whitespace controls collapse to spaces before the trim; `COMMAND_LINE_LIMIT` for the command line (`OSC 633 ; E`, `OSC 133 ; C`), bounded *before* its decoding and sanitized *after* it (rationale), **line breaks kept as `\n`**; `MAX_CWD_LENGTH` for every CWD source, interior whitespace preserved. **Every limit counts code points**, so a cut never splits a surrogate pair. **A value that reduces to nothing is dropped, never stored empty.**
 
-**The owner alone acts on the events** its parse produced — writing the responses, recording the semantic state — and hands every consumer the same chunk ([remote-api.md](remote-api.md#terminal-surfaces)).
+**The owner alone acts on the events** its parse produced — writing the responses, feeding its `AlertManager`, recording the semantic state — and hands every consumer the same chunk ([remote-api.md](remote-api.md#terminal-surfaces)).
 
 **A sink that subscribes inside a forwarded string control starts at the next ground byte**, a cancel releasing it as surely as a terminator (rationale); only a late attachment is ever held, the owner's renderer being there from spawn.
 
@@ -36,11 +36,11 @@ Source of truth: `oscDispositionAt` in `lib/src/lib/terminal-protocol.ts`, `boun
 
 **Supported semantic sequences are consumed and never re-emitted** — empty or unparseable payloads, unrecognized `OSC 1337` subcommands and `OSC 50` / `OSC 52` included. **`OSC 8` and the recognized ImageAddon `OSC 1337` forms are the exceptions**: they stay in `pty:data` so xterm.js owns hyperlink regions and inline graphics. Dormouse supplies only the hyperlink activation-confirmation handler. Every other OSC family passes through unchanged, so xterm.js handles standard behavior Dormouse does not model.
 
-**`textData` is the same chunk with every string-control payload removed**, for consumers reading output as text; every other control is left for `stripTerminalControls`. The webview receives them apart: `pty:data` (the stripped output; feeds xterm.js) and `terminal:semanticEvents` (normalized CWD / prompt-command / title events; feeds `TerminalPaneState`, command boundaries also feeding command-exit alerting in [alert.md](alert.md#command-exit-track)). **Notification-derived state never travels as `pty:data`**: it reaches whichever process holds the `AlertManager` — direct calls in VS Code, `terminal:protocolEvents` in standalone.
+**`textData` is the same chunk with every string-control payload removed**, for consumers reading output as text; every other control is left for `stripTerminalControls`. The webview receives them apart: `pty:data` (the stripped output; feeds xterm.js) and `terminal:semanticEvents` (normalized CWD / prompt-command / title events; feeds `TerminalPaneState`, command boundaries also feeding command-exit alerting in [alert.md](alert.md#command-exit-track)). **Notification-derived state never travels as `pty:data`**: the parse site feeds its own process's `AlertManager`.
 
 Each chunk is also classified for the quiesce detector: **the activity monitor's `onData()` fires only when `visibleData` is non-empty**, so a chunk of nothing but notification/progress OSCs is not meaningful output, while one carrying visible output alongside them is.
 
-Replay (`pty:replay`) is the raw stream requiring re-parse: **the webview runs a one-shot parser over the buffered bytes**, so semantic state repopulates and OSCs are stripped before xterm sees them. **Historical replay must not re-fire** alerts, quiesce events, protocol notifications, or query responses — it applies the semantic events and drops the rest (rationale). Live since-mark alert replay follows `docs/specs/alert.md` → Live Workspace transfer. **Every parser in a realm holding the theme takes `themeColorProvider`**, one-shot replay parsers included: a *declined* query stays in `visibleData` for the receiving renderer to answer, and answering is the owner's alone (rationale).
+Replay (`pty:replay`) is the raw stream requiring re-parse: **the webview runs a one-shot parser over the buffered bytes**, so semantic state repopulates and OSCs are stripped before xterm sees them. **Historical replay must not re-fire** alerts, quiesce events, protocol notifications, or query responses — it applies the semantic and Tool events and drops the rest (rationale). **Every parser in a realm holding the theme takes `themeColorProvider`**, one-shot replay parsers included: a *declined* query stays in `visibleData` for the receiving renderer to answer, and answering is the owner's alone (rationale).
 
 ## Supported OSCs
 
diff --git a/docs/specs/transport.md b/docs/specs/transport.md
index 2e96a91ab..00c48d84a 100644
--- a/docs/specs/transport.md
+++ b/docs/specs/transport.md
@@ -117,8 +117,9 @@ running (`docs/specs/standalone.md` → Transfer). It is a resume, not a restore
 with these transfer rules:
 
 - **Release, never dispose, and only once the target has adopted the Workspace.**
-  The source detaches its half of each Session — the alert, the pins, the
-  listeners, the element, the xterm instance — and **does not kill the PTY**
+  The source detaches its half of each Session — the pins, the listeners, the
+  element, the xterm instance — and **neither kills the PTY nor removes its
+  host alert entry**
   (`releaseSession` in `lib/src/lib/terminal-lifecycle.ts`). **Never reachable
   from a webview unmount**: a Wall unmounts on a reload and on a StrictMode
   double-mount, and releasing there would strand every PTY the window still owns.
@@ -156,7 +157,7 @@ with these transfer rules:
   in `lib/src/lib/terminal-transfer.test.ts` and `drains replay before adopting even when no note has a pin`
   in `standalone/src/workspace-move.test.ts`.
 - Tool browser bindings and announcements follow `docs/specs/dor-tool.md` → Persistence and hosts.
-- Live Activity and delivery handoff follows `docs/specs/alert.md` → Live Workspace transfer.
+- Alert state and delivery handoff follow `docs/specs/alert.md` → Live Workspace transfer.
 - Semantic-state transfer follows `docs/specs/terminal-state.md` → Core Model.
 - Source-pin limitations belong to `docs/specs/notepad.md` → Source links.
 
@@ -201,12 +202,12 @@ Transport constraints:
 | Host → webview | `pty:openPorts` | `ports: OpenPort[]` (`{ protocol, family, address, port, pid, processName }`), de-duplicated by `(family, address, port)`, sorted by port then address. Empty when the PTY is gone or enumeration fails. |
 | Host → webview | `pty:data` | PTY output after state-driving supported OSCs are parsed/stripped; `OSC 8` and ImageAddon's inline-image `OSC 1337` forms are preserved for xterm.js, routed only to the owning router. **Carries an optional `textData`** (string-control payloads removed, for the prompt heuristic), **omitted when it would equal `data`**. |
 | Host → webview | `terminal:semanticEvents` | Normalized CWD / prompt-command / title events the owner's parser derived, in stream order. |
-| Host → webview | `terminal:protocolEvents` | Standalone notification/progress delivery and ordered Tool announcements/state/resets (`docs/specs/dor-tool.md` → OSC 367). VS Code keeps its `AlertManager` in the extension host. |
+| Host → webview | `terminal:protocolEvents` | Standalone's ordered Tool announcements/state/resets (`docs/specs/dor-tool.md` → OSC 367). |
 | Webview → host | `dormouse:themeColors` (VS Code) / `pty_theme_colors` (standalone) | Resolved foreground / background / cursor, so the owner's parser can answer OSC 10/11/12. |
 | Host → webview | `pty:replay` | Buffered raw output since spawn; the webview runs a one-shot parser over it, the only re-parse there is. |
 | Host → webview | `dormouse:newTerminal` | May carry `shell`, `args`, display `name`, `replaceUntouched`, `announce`. The webview replaces the selected untouched terminal in place only when `replaceUntouched` is true, otherwise spawns a new pane. |
 
-**Two app-global stores relay on one pattern**: WATCHING rules (`alert:initializeWatchedCommands`, `alert:setCommandWatched` → host; `alert:watchedCommands` → webview) and alarm settings (`alert:initializeSettings`, `alert:updateSettings` → host; `alert:settings` → webview; `docs/specs/alert.md` → Alarm settings). An `initialize*` offers the renderer's persisted copy as a startup seed, and **a multi-webview host accepts only the first seed of its lifetime**. A mutation replaces the host's copy — `setCommandWatched` adds or removes one bare command key without touching unrelated rules, `updateSettings` sends the whole blob, renderer-only fields included, so every webview agrees. Either way the host broadcasts a canonical snapshot, and **every renderer replaces and persists its local mirror from it**. **In standalone both directions ride one opaque passthrough**, the `alert_command` invoke to a `alert:command` sidecar line, where the stores live so N windows share one answer; the snapshot comes back as a broadcast `alert:settings` / `alert:watchedCommands` (`docs/specs/standalone.md` → "Windows").
+**Two app-global stores relay on one pattern**: WATCHING rules (`alert:initializeWatchedCommands`, `alert:setCommandWatched` → host; `alert:watchedCommands` → webview) and alarm settings (`alert:initializeSettings`, `alert:updateSettings` → host; `alert:settings` → webview; `docs/specs/alert.md` → Alarm settings). An `initialize*` offers the renderer's persisted copy as a startup seed, and **a multi-webview host accepts only the first seed of its lifetime**. A mutation replaces the host's copy — `setCommandWatched` adds or removes one bare command key without touching unrelated rules, `updateSettings` sends the whole blob, renderer-only fields included, so every webview agrees. Either way the host broadcasts a canonical snapshot, and **every renderer replaces and persists its local mirror from it**. **In standalone both directions ride one opaque passthrough**, the `alert_command` invoke to an `alert:command` sidecar line, where the stores live beside the one `AlertManager`; the snapshot comes back as a broadcast. The passthrough carries every other `alert*` verb too (`docs/specs/standalone.md` → "Alerts").
 
 **The host must revalidate renderer-supplied settings, never trust them** — they become host timers. `AlertSettingsHost` runs every inbound blob through `normalizeAlertSettings`, which drops unknown keys, defaults missing ones, and clamps each delay into range. Both directions share one adapter method, `alertPublishSettings(settings, { seed })`: seed vs replace picks a message type, not a payload.
 
diff --git a/docs/specs/vscode.md b/docs/specs/vscode.md
index 463b35c2f..cc727cbb3 100644
--- a/docs/specs/vscode.md
+++ b/docs/specs/vscode.md
@@ -32,7 +32,8 @@ The webview is the shared `lib/` frontend, unmodified for this host (`docs/specs
 - **WATCHING rules are host-authoritative.** The first webview after extension-host startup seeds the shared host rule set and **no later webview may replace it**.
 - **Never let a resuming router steal another webview's PTYs.** Each router tracks its PTYs in `ownedPtyIds`; a module-level `globalOwnedPtyIds` set enforces it.
 - **Every save path must merge current alert states through the shared persistence projection.** The frontend periodic save (`onSaveState`) and the backend deactivate refresh (`refreshSavedSessionStateFromPtys`) both narrow alerts with `toPersistedAlertState`; missing the merge reverts alert state on restore, while passing live state through persists transient fields.
-- **Must reserve a closing router's PTYs until its deferred kills finish**, so another router cannot claim them during archive/CWD work; pinned by `vscode-ext/test/message-router.test.ts`.
+- **Must reserve a closing router's PTYs until its deferred kills finish**, so another router cannot claim them during archive/CWD work, then **remove the alert entry of each PTY it kills**, its webview being gone. Pinned by `vscode-ext/test/message-router.test.ts`.
+- **A remote Client's write acknowledges with input before it is written**, whichever Burrow tier it came through (`docs/specs/alert.md` → Engagement; `writeClientInput` in `vscode-ext/src/message-router.ts`).
 - **retainContextWhenHidden.** Set on both `WebviewPanel` and `WebviewView` so xterm.js DOM, scrollback, and PTY subscriptions survive panel hide/show without a resume.
 - **Two save sources must produce consistent state**: the frontend's periodic `dormouse:saveState` and the backend's deactivate flush-then-refresh.
 - **Every host → webview send carries the message token**, and **never add a `message` listener that skips `isHostMessage`**.
diff --git a/lib/src/components/wall/workspace-transfer.ts b/lib/src/components/wall/workspace-transfer.ts
index 29c85ab77..9dfd75a28 100644
--- a/lib/src/components/wall/workspace-transfer.ts
+++ b/lib/src/components/wall/workspace-transfer.ts
@@ -2,7 +2,6 @@ import { getToolDirty } from '../../lib/tool-dirty-store';
 import type { TransferredTools } from './tool-transfer';
 import { getToolAnnounce } from '../../lib/tool-announce-store';
 import type { ToolAnnounce } from '../../lib/tool-announce';
-import type { AlertRuntimeSnapshot } from '../../lib/alert-manager';
 import type { AlertDeliveryHandoff } from '../../lib/alert-delivery-state';
 import { snapshotTerminalState, type TransferredTerminalState } from '../../lib/terminal-state-store';
 import { dismissWorkspaceUi } from '../../lib/workspace-ui-store';
@@ -136,7 +135,8 @@ export async function prepareWorkspaceTransfer(
 /** One terminal's half of a transfer's content: what the target writes before
  *  it attaches, and where the host's replay picks up. */
 export interface TransferredTerminal {
-  alertRuntime?: AlertRuntimeSnapshot;
+  /** The speech and push receipts; the Session's alert state itself never
+   *  moves, since the host's one manager holds it. */
   alertDelivery?: AlertDeliveryHandoff;
   /** The buffer as the escape stream that rebuilds it; `''` for a Session this
    *  Window no longer held. */
diff --git a/lib/src/host/alert-client.test.ts b/lib/src/host/alert-client.test.ts
new file mode 100644
index 000000000..a6608043e
--- /dev/null
+++ b/lib/src/host/alert-client.test.ts
@@ -0,0 +1,162 @@
+import { describe, expect, it } from 'vitest';
+import { createSidecarAlertClient } from './alert-client';
+import { createSidecarAlerts } from './alert-host';
+import type { AlertCommand } from './alert-protocol';
+import type { AlertStateDetail } from '../lib/platform/types';
+import { DEFAULT_ALERT_SETTINGS } from '../lib/alert-settings-model';
+
+/**
+ * A standalone window's end of the sidecar's alerts: every `alert*` platform
+ * method is one command, and every answer comes back as a sidecar event
+ * (`docs/specs/standalone.md` → "Alerts").
+ */
+
+function client() {
+  const commands: AlertCommand[] = [];
+  const alerts = createSidecarAlertClient((command) => void commands.push(command));
+  return { alerts, commands };
+}
+
+describe('commands', () => {
+  it('sends each alert verb as one command naming its op', () => {
+    const { alerts, commands } = client();
+    alerts.alertDismiss('p');
+    alerts.alertAcknowledge('p');
+    alerts.alertResize('p');
+    alerts.alertToggleTodo('p');
+    alerts.alertClearTodo('p');
+    alerts.alertRemove('p');
+    alerts.alertSeed('p', { status: 'WATCHING_DISABLED', todo: true, notification: null });
+    alerts.alertEngagement({ present: true, focusId: 'p' });
+    alerts.alertEngagement({ present: false, focusId: 'p' }, 'idle');
+    alerts.alertSetCommandWatched('cargo', true);
+    alerts.hello();
+    expect(commands).toEqual([
+      { op: 'dismiss', id: 'p' },
+      { op: 'acknowledge', id: 'p' },
+      { op: 'resize', id: 'p' },
+      { op: 'toggleTodo', id: 'p' },
+      { op: 'clearTodo', id: 'p' },
+      { op: 'remove', id: 'p' },
+      { op: 'seed', id: 'p', state: { status: 'WATCHING_DISABLED', todo: true, notification: null } },
+      { op: 'engagement', state: { present: true, focusId: 'p' } },
+      { op: 'engagement', state: { present: false, focusId: 'p' }, lapse: 'idle' },
+      { op: 'setCommandWatched', name: 'cargo', watched: true },
+      { op: 'hello' },
+    ]);
+  });
+
+  // The stream is the only path a store's snapshot takes back; a repeat seed is
+  // refused as a seed but still answered (`lib/src/lib/watched-command-host.ts`).
+  it('re-offers only its last seeds', () => {
+    const { alerts, commands } = client();
+    const quiet = { ...DEFAULT_ALERT_SETTINGS, speakEnabled: false };
+    alerts.alertSetWatchedCommands(['cargo']);
+    alerts.alertPublishSettings(quiet, { seed: true });
+    // Neither a mutation nor a non-seed publish is a seed.
+    alerts.alertSetCommandWatched('make', true);
+    alerts.alertPublishSettings({ ...quiet, pushEnabled: true }, { seed: false });
+    commands.length = 0;
+
+    alerts.reofferSeeds();
+    expect(commands).toEqual([
+      { op: 'initializeWatchedCommands', names: ['cargo'] },
+      { op: 'initializeSettings', settings: quiet },
+    ]);
+  });
+});
+
+describe('events', () => {
+  it('hands the host\'s state and store snapshots to the renderer, and claims nothing else', () => {
+    const { alerts } = client();
+    const seen: unknown[] = [];
+    alerts.onAlertState((detail) => void seen.push(['state', detail]));
+    alerts.onWatchedCommands((names) => void seen.push(['watched', names]));
+    alerts.onAlertSettings((settings) => void seen.push(['settings', settings]));
+
+    const detail = { id: 'p', status: 'ALERT_RINGING', todo: true } as unknown as AlertStateDetail;
+    expect(alerts.onEvent('alert:state', detail)).toBe(true);
+    expect(alerts.onEvent('alert:watchedCommands', { names: ['make'] })).toBe(true);
+    expect(alerts.onEvent('alert:settings', { settings: DEFAULT_ALERT_SETTINGS })).toBe(true);
+    // A broadcast with no blob is dropped, not applied as "no settings".
+    expect(alerts.onEvent('alert:settings', {})).toBe(true);
+    expect(alerts.onEvent('pty:data', { id: 'p', data: 'x' })).toBe(false);
+
+    expect(seen).toEqual([['state', detail], ['watched', ['make']], ['settings', DEFAULT_ALERT_SETTINGS]]);
+  });
+});
+
+describe('awaits', () => {
+  it('parks in the host and resolves on its own awaitId alone', async () => {
+    const { alerts, commands } = client();
+    const handle = alerts.alertAwait('p', { until: 'quiet', timeoutMs: 600_000 });
+    const [parked] = commands as Array<Extract<AlertCommand, { op: 'await' }>>;
+    expect(parked).toMatchObject({ op: 'await', id: 'p', until: 'quiet', timeoutMs: 600_000 });
+    expect(parked!.awaitId).toMatch(/^await-/);
+
+    let outcome: unknown = null;
+    void handle.promise.then((value) => { outcome = value; });
+    // Another window's await, broadcast to this one too.
+    alerts.onEvent('alert:awaitResult', { awaitId: 'await-other', window: 'ws-2', outcome: { kind: 'timeout', waitedMs: 1 } });
+    await Promise.resolve();
+    expect(outcome).toBeNull();
+
+    alerts.onEvent('alert:awaitResult', { awaitId: parked!.awaitId, window: 'main', outcome: { kind: 'resolved', cause: 'quiet', waitedMs: 7 } });
+    await Promise.resolve();
+    expect(outcome).toEqual({ kind: 'resolved', cause: 'quiet', waitedMs: 7 });
+  });
+
+  it('asks the host to cancel, and takes the answer the host sends', async () => {
+    const { alerts, commands } = client();
+    const handle = alerts.alertAwait('p', { until: 'exit', timeoutMs: 600_000 });
+    const awaitId = (commands[0] as { awaitId: string }).awaitId;
+    handle.cancel();
+    expect(commands[1]).toEqual({ op: 'awaitCancel', awaitId });
+
+    alerts.onEvent('alert:awaitResult', { awaitId, window: 'main', outcome: { kind: 'cancelled', waitedMs: 3 } });
+    await expect(handle.promise).resolves.toEqual({ kind: 'cancelled', waitedMs: 3 });
+    // Settled: a late cancel asks nothing more.
+    handle.cancel();
+    expect(commands).toHaveLength(2);
+  });
+
+  it('settles what it parked cancelled when disposed, since no answer can reach it', async () => {
+    const { alerts } = client();
+    const handle = alerts.alertAwait('p', { until: 'exit', timeoutMs: 600_000 });
+    alerts.dispose();
+    await expect(handle.promise).resolves.toMatchObject({ kind: 'cancelled' });
+  });
+});
+
+/**
+ * The whole path a reload takes, host and client wired as Rust wires them: the
+ * manager never lived in the webview, so a reloaded window gets its rings and
+ * TODOs back from the sidecar's answer to its collection, without seeding.
+ */
+it('gives a reloaded window its rings and TODOs back', () => {
+  // The window's current realm: a reload replaces it under the same label.
+  let realm: ReturnType<typeof createSidecarAlertClient> | null = null;
+  const host = createSidecarAlerts({ send: (event, data) => realm?.onEvent(event, data) });
+  const open = () => {
+    realm = createSidecarAlertClient((command) => host.handle({ ...command, window: 'main' }));
+    return realm;
+  };
+  try {
+    const before = open();
+    before.alertEngagement({ present: true, focusId: 'watched' });
+    host.manager.notifyFromProtocol('ringing', { source: 'OSC 9', title: null, body: 'done' });
+    before.alertToggleTodo('flagged');
+
+    const after = open();
+    const seen = new Map<string, AlertStateDetail>();
+    after.onAlertState((detail) => void seen.set(detail.id, detail));
+    after.hello();
+    // What `pty:requestInit` makes the sidecar send behind its list.
+    host.publish(['ringing', 'flagged']);
+
+    expect(seen.get('ringing')).toMatchObject({ status: 'ALERT_RINGING', todo: true });
+    expect(seen.get('flagged')).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
+  } finally {
+    host.dispose();
+  }
+});
diff --git a/lib/src/host/alert-client.ts b/lib/src/host/alert-client.ts
new file mode 100644
index 000000000..138694875
--- /dev/null
+++ b/lib/src/host/alert-client.ts
@@ -0,0 +1,153 @@
+import type { AwaitHandle, AwaitOptions, AwaitOutcome, Engagement, EngagementLapse } from '../lib/alert-manager';
+import type { AlertSettings } from '../lib/alert-settings-model';
+import type { AlertStateDetail, PlatformAdapter } from '../lib/platform/types';
+import type { PersistedAlertState } from '../lib/session-types';
+import {
+  ALERT_AWAIT_RESULT_EVENT,
+  ALERT_STATE_EVENT,
+  type AlertAwaitResult,
+  type AlertCommand,
+} from './alert-protocol';
+
+/**
+ * A standalone window's end of the sidecar's alerts (`lib/src/host/alert-host.ts`):
+ * every `alert*` platform method as one command, and the sidecar's events back
+ * to the renderer's handlers. Shared by both standalone adapters, which differ
+ * only in how a command travels and an event arrives.
+ *
+ * Every method is a closure, so an adapter may take them as its own members.
+ */
+export type SidecarAlertMethods = Required<Pick<
+  PlatformAdapter,
+  | 'alertRemove'
+  | 'alertSetWatchedCommands'
+  | 'alertSetCommandWatched'
+  | 'alertPublishSettings'
+  | 'alertDismiss'
+  | 'alertEngagement'
+  | 'alertAcknowledge'
+  | 'alertResize'
+  | 'alertToggleTodo'
+  | 'alertClearTodo'
+  | 'alertAwait'
+  | 'alertSeed'
+  | 'onAlertState'
+  | 'onWatchedCommands'
+  | 'onAlertSettings'
+>>;
+
+export interface SidecarAlertClient extends SidecarAlertMethods {
+  /** One sidecar event. Returns whether it was an alert event. */
+  onEvent(event: string, data: unknown): boolean;
+  /** This realm is new — a boot or a reload: what the window's previous realm
+   *  engaged or parked is gone (`hello`). */
+  hello(): void;
+  /** Offer the last startup seeds again, so the sidecar republishes both
+   *  stores to a stream that dropped their broadcasts. */
+  reofferSeeds(): void;
+  /** Settle every await this realm parked `cancelled`, synchronously: nothing
+   *  will deliver their outcomes once the adapter is gone. */
+  dispose(): void;
+}
+
+export function createSidecarAlertClient(send: (command: AlertCommand) => void): SidecarAlertClient {
+  const stateHandlers = new Set<(detail: AlertStateDetail) => void>();
+  const watchedHandlers = new Set<(names: string[]) => void>();
+  const settingsHandlers = new Set<(settings: AlertSettings) => void>();
+  const awaits = new Map<string, { resolve: (outcome: AwaitOutcome) => void; startedAt: number }>();
+  const seeds = new Map<string, AlertCommand>();
+
+  const seed = (command: AlertCommand): void => {
+    seeds.set(command.op, command);
+    send(command);
+  };
+
+  return {
+    alertRemove: (id) => send({ op: 'remove', id }),
+    alertSeed: (id: string, state: PersistedAlertState) => send({ op: 'seed', id, state }),
+    alertSetWatchedCommands: (names) => seed({ op: 'initializeWatchedCommands', names }),
+    // A delta, never a replacement, so a window that has not heard about a
+    // rule cannot drop it.
+    alertSetCommandWatched: (name, watched) => send({ op: 'setCommandWatched', name, watched }),
+    alertPublishSettings: (settings, opts) => {
+      if (opts.seed) seed({ op: 'initializeSettings', settings });
+      else send({ op: 'updateSettings', settings });
+    },
+    alertDismiss: (id) => send({ op: 'dismiss', id }),
+    alertEngagement: (state: Engagement, lapse?: EngagementLapse) => send({ op: 'engagement', state, ...(lapse ? { lapse } : {}) }),
+    alertAcknowledge: (id) => send({ op: 'acknowledge', id }),
+    alertResize: (id) => send({ op: 'resize', id }),
+    alertToggleTodo: (id) => send({ op: 'toggleTodo', id }),
+    alertClearTodo: (id) => send({ op: 'clearTodo', id }),
+
+    /**
+     * Parked in the sidecar, which owns the wake condition and the ceiling; only
+     * the outcome crosses back, broadcast under this adapter's own random id.
+     * `cancel()` asks rather than answers: the `cancelled` outcome arrives on
+     * the same result as every other, so a claim is never released twice.
+     */
+    alertAwait(id: string, options: AwaitOptions): AwaitHandle {
+      const awaitId = `await-${crypto.randomUUID()}`;
+      const promise = new Promise<AwaitOutcome>((resolve) => {
+        awaits.set(awaitId, { resolve, startedAt: Date.now() });
+      });
+      send({ op: 'await', awaitId, id, until: options.until, timeoutMs: options.timeoutMs });
+      return {
+        promise,
+        cancel: () => {
+          if (awaits.has(awaitId)) send({ op: 'awaitCancel', awaitId });
+        },
+      };
+    },
+
+    onAlertState: (handler) => void stateHandlers.add(handler),
+    onWatchedCommands: (handler) => void watchedHandlers.add(handler),
+    onAlertSettings: (handler) => void settingsHandlers.add(handler),
+
+    onEvent(event, data) {
+      switch (event) {
+        case ALERT_STATE_EVENT: {
+          const detail = data as AlertStateDetail;
+          if (typeof detail?.id !== 'string') return true;
+          for (const handler of stateHandlers) handler(detail);
+          return true;
+        }
+        case ALERT_AWAIT_RESULT_EVENT: {
+          const result = data as Partial<AlertAwaitResult> | null;
+          const parked = typeof result?.awaitId === 'string' ? awaits.get(result.awaitId) : undefined;
+          // Another window's await, or one this realm already settled.
+          if (!parked || !result?.outcome) return true;
+          awaits.delete(result.awaitId!);
+          parked.resolve(result.outcome);
+          return true;
+        }
+        case 'alert:watchedCommands': {
+          const names = (data as { names?: string[] } | null)?.names ?? [];
+          for (const handler of watchedHandlers) handler(names);
+          return true;
+        }
+        case 'alert:settings': {
+          const settings = (data as { settings?: AlertSettings } | null)?.settings;
+          // A broadcast with no blob is dropped, not applied as "no settings".
+          if (settings) for (const handler of settingsHandlers) handler(settings);
+          return true;
+        }
+        default:
+          return false;
+      }
+    },
+
+    hello: () => send({ op: 'hello' }),
+
+    reofferSeeds() {
+      for (const command of seeds.values()) send(command);
+    },
+
+    dispose() {
+      for (const [awaitId, parked] of [...awaits]) {
+        awaits.delete(awaitId);
+        parked.resolve({ kind: 'cancelled', waitedMs: Date.now() - parked.startedAt });
+      }
+    },
+  };
+}
diff --git a/lib/src/host/alert-host.test.ts b/lib/src/host/alert-host.test.ts
new file mode 100644
index 000000000..92b6f0619
--- /dev/null
+++ b/lib/src/host/alert-host.test.ts
@@ -0,0 +1,270 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { createSidecarAlerts, type SidecarAlerts } from './alert-host';
+import type { AlertAwaitResult } from './alert-protocol';
+import { DEFAULT_ALERT_SETTINGS } from '../lib/alert-settings-model';
+import type { AlertState } from '../lib/alert-manager';
+
+/**
+ * Standalone's one `AlertManager`, in the sidecar (`docs/specs/standalone.md` →
+ * "Alerts"). Every window is a viewer of it by its label, which Rust stamps on
+ * each command as `window`; what matters is that one window's realm ending
+ * never touches another's, that every await is answered exactly once, and
+ * that a window collecting its PTYs gets their state back.
+ */
+
+let sent: Array<{ event: string; data: unknown }>;
+let alerts: SidecarAlerts;
+
+const REPORT = { source: 'OSC 9', title: null, body: 'needs input' } as const;
+
+const watched = (): string[][] =>
+  sent.filter((message) => message.event === 'alert:watchedCommands')
+    .map((message) => (message.data as { names: string[] }).names);
+const settings = () =>
+  sent.filter((message) => message.event === 'alert:settings')
+    .map((message) => (message.data as { settings: Record<string, unknown> }).settings);
+const states = (id: string) =>
+  sent.filter((message) => message.event === 'alert:state' && (message.data as { id: string }).id === id)
+    .map((message) => message.data as { id: string } & AlertState);
+const results = () =>
+  sent.filter((message) => message.event === 'alert:awaitResult').map((message) => message.data as AlertAwaitResult);
+
+/** One command as Rust forwards it: stamped with the window that sent it. */
+const from = (window: string, command: Record<string, unknown>) => alerts.handle({ ...command, window });
+
+beforeEach(() => {
+  sent = [];
+  alerts = createSidecarAlerts({ send: (event, data) => sent.push({ event, data }) });
+});
+
+afterEach(() => {
+  alerts.dispose();
+  vi.useRealTimers();
+});
+
+describe('the WATCHING rule set', () => {
+  it('takes the first window\'s seed, corrects every later one, and watches with it', () => {
+    from('main', { op: 'initializeWatchedCommands', names: ['npm test'] });
+    expect(watched().at(-1)).toEqual(['npm test']);
+
+    // A second window offering its own persisted copy is answered with the
+    // canonical set, not allowed to replace it.
+    from('ws-2', { op: 'initializeWatchedCommands', names: ['cargo build'] });
+    expect(watched().at(-1)).toEqual(['npm test']);
+    expect(alerts.manager.getWatchedCommands()).toEqual(['npm test']);
+  });
+
+  it('applies an edit as a delta, so a stale window cannot drop other rules', () => {
+    from('main', { op: 'initializeWatchedCommands', names: ['npm test'] });
+    from('ws-2', { op: 'setCommandWatched', name: 'cargo build', watched: true });
+    expect(watched().at(-1)).toEqual(['cargo build', 'npm test']);
+
+    from('main', { op: 'setCommandWatched', name: 'npm test', watched: false });
+    expect(watched().at(-1)).toEqual(['cargo build']);
+  });
+
+  it('ignores a malformed edit rather than installing it', () => {
+    from('main', { op: 'initializeWatchedCommands', names: ['npm test', 42, null, ''] });
+    expect(watched().at(-1)).toEqual(['npm test']);
+    const before = sent.length;
+    from('main', { op: 'setCommandWatched', name: 7, watched: 'yes' });
+    from('main', { op: 'nonsense' });
+    alerts.handle(null);
+    expect(sent).toHaveLength(before);
+  });
+});
+
+describe('the alarm settings', () => {
+  it('takes the first seed and corrects every later one', () => {
+    from('main', { op: 'initializeSettings', settings: { ...DEFAULT_ALERT_SETTINGS, speakEnabled: true } });
+    expect(settings().at(-1)).toMatchObject({ speakEnabled: true });
+
+    from('ws-2', { op: 'initializeSettings', settings: { ...DEFAULT_ALERT_SETTINGS, speakEnabled: false } });
+    expect(settings().at(-1)).toMatchObject({ speakEnabled: true });
+  });
+
+  it('takes an explicit edit from any window', () => {
+    from('main', { op: 'initializeSettings', settings: DEFAULT_ALERT_SETTINGS });
+    from('ws-2', { op: 'updateSettings', settings: { ...DEFAULT_ALERT_SETTINGS, pushEnabled: true } });
+    expect(settings().at(-1)).toMatchObject({ pushEnabled: true });
+  });
+
+  it('revalidates whatever a renderer sends', () => {
+    // A NaN or an absurd timer must never reach a host because a webview asked.
+    from('main', { op: 'initializeSettings', settings: { speakDelayMs: Number.NaN, pushDelayMs: 1e12 } });
+    const installed = settings().at(-1)!;
+    expect(installed.speakDelayMs).toBe(DEFAULT_ALERT_SETTINGS.speakDelayMs);
+    expect(installed.pushDelayMs).toBeLessThanOrEqual(600_000);
+  });
+});
+
+describe('Session state', () => {
+  it('publishes every change as alert:state, for the host to route by owner', () => {
+    alerts.manager.notifyFromProtocol('pty-1', REPORT);
+    expect(states('pty-1').at(-1)).toMatchObject({ id: 'pty-1', status: 'ALERT_RINGING', todo: true });
+  });
+
+  it('carries each verb a window sends to the one manager', () => {
+    alerts.manager.notifyFromProtocol('pty-1', REPORT);
+    from('main', { op: 'dismiss', id: 'pty-1' });
+    expect(states('pty-1').at(-1)).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
+    from('main', { op: 'clearTodo', id: 'pty-1' });
+    expect(states('pty-1').at(-1)).toMatchObject({ todo: false });
+    from('main', { op: 'toggleTodo', id: 'pty-1' });
+    expect(states('pty-1').at(-1)).toMatchObject({ todo: true });
+
+    alerts.manager.notifyFromProtocol('pty-2', REPORT);
+    from('main', { op: 'acknowledge', id: 'pty-2' });
+    expect(states('pty-2').at(-1)).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
+
+    from('main', { op: 'seed', id: 'pty-3', state: { status: 'ALERT_RINGING', todo: true, notification: REPORT } });
+    // A seed restores the reminder, never the ring.
+    expect(states('pty-3').at(-1)).toMatchObject({ status: 'WATCHING_DISABLED', todo: true, notification: REPORT });
+
+    from('main', { op: 'remove', id: 'pty-3' });
+    expect(states('pty-3').at(-1)).toMatchObject({ status: 'WATCHING_DISABLED', todo: false });
+    expect(alerts.manager.getAllStates().has('pty-3')).toBe(false);
+  });
+
+  it('acknowledges human input with its echo window before the write it rides', () => {
+    alerts.manager.notifyFromProtocol('pty-1', REPORT);
+    alerts.acknowledgeInput('pty-1');
+    expect(states('pty-1').at(-1)).toMatchObject({ status: 'WATCHING_DISABLED', todo: false });
+    // A bell answering the key rings no one.
+    alerts.manager.notifyFromProtocol('pty-1', REPORT);
+    expect(states('pty-1').at(-1)?.status).not.toBe('ALERT_RINGING');
+  });
+
+  it('mirrors a helper, which publishes nothing until promotion', () => {
+    alerts.setHelper('pty-h', true);
+    alerts.manager.notifyFromProtocol('pty-h', REPORT);
+    expect(states('pty-h')).toEqual([]);
+  });
+
+  // What `pty:requestInit` sends behind its list: a window that reloaded or is
+  // taking a Workspace over has no other way to learn its Sessions' state.
+  it('re-sends the listed Sessions\' state, and every Session\'s when none are listed', () => {
+    alerts.manager.notifyFromProtocol('pty-1', REPORT);
+    from('main', { op: 'toggleTodo', id: 'pty-2' });
+    alerts.setHelper('pty-h', true);
+    alerts.manager.onData('pty-h');
+    sent = [];
+
+    alerts.publish(['pty-1', 'never-seen']);
+    expect(sent).toEqual([
+      { event: 'alert:state', data: expect.objectContaining({ id: 'pty-1', status: 'ALERT_RINGING', todo: true }) },
+    ]);
+
+    sent = [];
+    alerts.publish(undefined);
+    expect(sent.map((message) => (message.data as { id: string }).id).sort()).toEqual(['pty-1', 'pty-2']);
+  });
+});
+
+describe('viewers', () => {
+  const engaged = (window: string, focusId: string | null) =>
+    from(window, { op: 'engagement', state: { present: true, focusId } });
+
+  it('keeps engagement per window label, so one window leaving never disengages another', () => {
+    engaged('main', 'pty-a');
+    engaged('ws-2', 'pty-b');
+    from('main', { op: 'engagement', state: { present: false, focusId: null }, lapse: 'leave' });
+
+    alerts.manager.notifyFromProtocol('pty-b', REPORT);
+    expect(alerts.manager.getState('pty-b').status).not.toBe('ALERT_RINGING');
+    alerts.manager.notifyFromProtocol('pty-a', REPORT);
+    expect(alerts.manager.getState('pty-a').status).toBe('ALERT_RINGING');
+  });
+
+  it('ends a window\'s previous realm on hello, and no other window\'s', () => {
+    engaged('main', 'pty-a');
+    engaged('ws-2', 'pty-b');
+    from('main', { op: 'await', awaitId: 'await-main', id: 'pty-c', until: 'exit', timeoutMs: 600_000 });
+    from('ws-2', { op: 'await', awaitId: 'await-ws2', id: 'pty-c', until: 'exit', timeoutMs: 600_000 });
+
+    // `main` reloaded: same label, new realm.
+    from('main', { op: 'hello' });
+    expect(results()).toEqual([{ awaitId: 'await-main', window: 'main', outcome: expect.objectContaining({ kind: 'cancelled' }) }]);
+    alerts.manager.notifyFromProtocol('pty-a', REPORT);
+    expect(alerts.manager.getState('pty-a').status).toBe('ALERT_RINGING');
+    alerts.manager.notifyFromProtocol('pty-b', REPORT);
+    expect(alerts.manager.getState('pty-b').status).not.toBe('ALERT_RINGING');
+    expect(alerts.manager.getState('pty-c').awaited).toBe(true);
+  });
+
+  it('drops a window that went away, and keeps the ones still open', () => {
+    engaged('main', 'pty-a');
+    engaged('ws-2', 'pty-b');
+    from('ws-2', { op: 'await', awaitId: 'await-ws2', id: 'pty-c', until: 'quiet', timeoutMs: 600_000 });
+
+    alerts.setWindows(['main']);
+    expect(results()).toEqual([{ awaitId: 'await-ws2', window: 'ws-2', outcome: expect.objectContaining({ kind: 'cancelled' }) }]);
+    alerts.manager.notifyFromProtocol('pty-b', REPORT);
+    expect(alerts.manager.getState('pty-b').status).toBe('ALERT_RINGING');
+    alerts.manager.notifyFromProtocol('pty-a', REPORT);
+    expect(alerts.manager.getState('pty-a').status).not.toBe('ALERT_RINGING');
+
+    // Not a label list: nothing to act on.
+    alerts.setWindows(undefined);
+    alerts.manager.notifyFromProtocol('pty-a', REPORT);
+    expect(alerts.manager.getState('pty-a').status).not.toBe('ALERT_RINGING');
+  });
+});
+
+describe('awaits', () => {
+  it('answers each await once, broadcast-shaped: no Session id, no requestId', async () => {
+    from('ws-2', { op: 'await', awaitId: 'await-1', id: 'pty-1', until: 'quiet', timeoutMs: 600_000 });
+    expect(alerts.manager.getState('pty-1').awaited).toBe(true);
+
+    alerts.manager.notifyFromProtocol('pty-1', REPORT);
+    await Promise.resolve();
+    expect(results()).toEqual([
+      { awaitId: 'await-1', window: 'ws-2', outcome: expect.objectContaining({ kind: 'resolved', cause: 'bell' }) },
+    ]);
+    const [message] = sent.filter((line) => line.event === 'alert:awaitResult');
+    expect(Object.keys(message!.data as object).sort()).toEqual(['awaitId', 'outcome', 'window']);
+    // Claimed: the bell reached the program, not the human.
+    expect(alerts.manager.getState('pty-1').status).not.toBe('ALERT_RINGING');
+  });
+
+  it('answers a cancel once, with the host outcome', async () => {
+    from('main', { op: 'await', awaitId: 'await-1', id: 'pty-1', until: 'exit', timeoutMs: 600_000 });
+    from('main', { op: 'awaitCancel', awaitId: 'await-1' });
+    await Promise.resolve();
+    from('main', { op: 'awaitCancel', awaitId: 'await-1' });
+    await Promise.resolve();
+    expect(results()).toEqual([{ awaitId: 'await-1', window: 'main', outcome: expect.objectContaining({ kind: 'cancelled' }) }]);
+    expect(alerts.manager.getState('pty-1').awaited).toBe(false);
+  });
+
+  it('refuses a malformed await with an answer rather than parking it', async () => {
+    from('main', { op: 'await', awaitId: 'await-bad', id: 'pty-1', until: 'soon', timeoutMs: 600_000 });
+    from('main', { op: 'await', awaitId: 'await-nan', id: 'pty-1', until: 'exit', timeoutMs: 'forever' });
+    // Nothing to answer to.
+    from('main', { op: 'await', id: 'pty-1', until: 'exit', timeoutMs: 600_000 });
+    await Promise.resolve();
+    expect(results().map((result) => [result.awaitId, result.outcome.kind])).toEqual([
+      ['await-bad', 'cancelled'],
+      ['await-nan', 'cancelled'],
+    ]);
+    expect(alerts.manager.getState('pty-1').awaited).toBe(false);
+  });
+
+  it('survives a Workspace moving between windows: the manager never moves', async () => {
+    from('main', { op: 'await', awaitId: 'await-1', id: 'pty-1', until: 'quiet', timeoutMs: 600_000 });
+    // Ownership moves in Rust; the sidecar hears nothing of it, and `main` is
+    // still open to hear the outcome.
+    alerts.setWindows(['main', 'ws-2']);
+    alerts.manager.notifyFromProtocol('pty-1', REPORT);
+    await Promise.resolve();
+    expect(results()).toEqual([
+      { awaitId: 'await-1', window: 'main', outcome: expect.objectContaining({ kind: 'resolved', cause: 'bell' }) },
+    ]);
+  });
+});
+
+it('stops publishing once disposed', () => {
+  alerts.dispose();
+  from('main', { op: 'initializeWatchedCommands', names: ['npm test'] });
+  expect(sent).toEqual([]);
+});
diff --git a/lib/src/host/alert-host.ts b/lib/src/host/alert-host.ts
new file mode 100644
index 000000000..a9e93b8c6
--- /dev/null
+++ b/lib/src/host/alert-host.ts
@@ -0,0 +1,205 @@
+import { AlertManager, type AwaitHandle, type AwaitOutcome, type Engagement } from '../lib/alert-manager';
+import { AlertSettingsHost } from '../lib/alert-settings-host';
+import { WatchedCommandHost } from '../lib/watched-command-host';
+import type { PersistedAlertState } from '../lib/session-types';
+import { ALERT_AWAIT_RESULT_EVENT, ALERT_STATE_EVENT, type AlertAwaitResult } from './alert-protocol';
+
+/**
+ * Standalone's one `AlertManager`, in the Node sidecar beside the PTYs and the
+ * parse site, exactly as VS Code keeps one in its extension host
+ * (`docs/specs/standalone.md` → "Alerts"). Windows are its viewers: each
+ * reports engagement, sends the user's verbs, and renders the `alert:state` it
+ * is routed. The two app-global stores run the same classes VS Code runs
+ * (`vscode-ext/src/message-router.ts`), bound to this manager.
+ */
+
+export interface SidecarAlerts {
+  /** The one manager. The parse site feeds it (`createSidecarSurfaceBridge`). */
+  readonly manager: AlertManager;
+  /** One `alert:command` line. */
+  handle(command: unknown): void;
+  /** Every live window label, pushed on each create and destroy: a window
+   *  that is gone engages nothing and waits on nothing. */
+  setWindows(labels: unknown): void;
+  /** A PTY's helper status as `pty-core` holds it, after a spawn or a promotion. */
+  setHelper(id: unknown, helper: boolean): void;
+  /** Human input about to be written, in the same message as the write:
+   *  acknowledged, echo window opened, before the bytes reach the PTY. */
+  acknowledgeInput(id: unknown): void;
+  /** Re-send each listed Session's state, every Session when `ids` is absent:
+   *  a window collecting its PTYs has no other way to learn it. */
+  publish(ids: unknown): void;
+  dispose(): void;
+}
+
+/** The label a command carries when no host stamped one (a test). */
+const UNNAMED_WINDOW = '';
+
+const isId = (value: unknown): value is string => typeof value === 'string' && value.length > 0;
+
+export function createSidecarAlerts(options: {
+  /** Writes one event line; the host routes it (`docs/specs/standalone.md` → "Routing"). */
+  send: (event: string, data: unknown) => void;
+}): SidecarAlerts {
+  const { send } = options;
+  const manager = new AlertManager();
+  const watched = new WatchedCommandHost(manager);
+  const settings = new AlertSettingsHost(manager);
+
+  // `dor await`s parked here, by the random id the asking adapter minted.
+  const awaits = new Map<string, { handle: AwaitHandle; window: string; startedAt: number }>();
+  /** Labels that have reported engagement, so a departed one can be dropped. */
+  const viewers = new Set<string>();
+
+  const stops = [
+    watched.subscribe((names) => send('alert:watchedCommands', { names })),
+    settings.subscribe((value) => send('alert:settings', { settings: value })),
+    manager.onStateChange((id, state) => send(ALERT_STATE_EVENT, { id, ...state })),
+  ];
+
+  function answer(awaitId: string, window: string, outcome: AwaitOutcome): void {
+    send(ALERT_AWAIT_RESULT_EVENT, { awaitId, window, outcome } satisfies AlertAwaitResult);
+  }
+
+  function parkAwait(window: string, message: Record<string, unknown>): void {
+    const { awaitId, id, until, timeoutMs } = message;
+    // A repeated id would owe two answers to one caller; the first keeps it.
+    if (!isId(awaitId) || awaits.has(awaitId)) return;
+    if (!isId(id) || (until !== 'quiet' && until !== 'exit')) {
+      answer(awaitId, window, { kind: 'cancelled', waitedMs: 0 });
+      return;
+    }
+    // `timeoutMs` is revalidated by `awaitCompletion`, which settles nonsense
+    // `cancelled` rather than installing it.
+    const handle = manager.awaitCompletion(id, { until, timeoutMs: Number(timeoutMs) });
+    awaits.set(awaitId, { handle, window, startedAt: Date.now() });
+    void handle.promise.then((outcome) => {
+      // Gone from the map means `endRealm` already answered it.
+      if (awaits.delete(awaitId)) answer(awaitId, window, outcome);
+    });
+  }
+
+  /**
+   * A window's content is gone — reloaded, or the window closed: its
+   * engagement ends, and what it parked is cancelled and answered here, once,
+   * so no await absorbs completions for a caller that cannot hear the outcome.
+   */
+  function endRealm(window: string): void {
+    viewers.delete(window);
+    manager.removeViewer(window);
+    for (const [awaitId, parked] of [...awaits]) {
+      if (parked.window !== window) continue;
+      awaits.delete(awaitId);
+      parked.handle.cancel();
+      answer(awaitId, window, { kind: 'cancelled', waitedMs: Date.now() - parked.startedAt });
+    }
+  }
+
+  return {
+    manager,
+
+    handle(command) {
+      if (!command || typeof command !== 'object') return;
+      const message = command as Record<string, unknown>;
+      const window = typeof message.window === 'string' ? message.window : UNNAMED_WINDOW;
+      const id = message.id;
+      switch (message.op) {
+        case 'hello':
+          endRealm(window);
+          return;
+        case 'initializeWatchedCommands':
+          // Only the first window's offer is taken; every later one is answered
+          // with what the host already holds.
+          watched.initialize(Array.isArray(message.names) ? message.names.filter(isId) : []);
+          return;
+        case 'setCommandWatched': {
+          const name = typeof message.name === 'string' ? message.name.trim() : '';
+          if (!name || typeof message.watched !== 'boolean') return;
+          watched.setCommandWatched(name, message.watched);
+          return;
+        }
+        // Revalidated by `normalizeAlertSettings`: a webview must never install a
+        // NaN or an absurd timer (`docs/specs/transport.md`).
+        case 'initializeSettings':
+          settings.initialize(message.settings);
+          return;
+        case 'updateSettings':
+          settings.update(message.settings);
+          return;
+        case 'engagement': {
+          viewers.add(window);
+          // `setViewer` revalidates the shape: only a literal `idle` escalates.
+          const lapse = message.lapse === 'idle' || message.lapse === 'leave' ? message.lapse : undefined;
+          manager.setViewer(window, message.state as Engagement, lapse);
+          return;
+        }
+        case 'await':
+          parkAwait(window, message);
+          return;
+        case 'awaitCancel':
+          // The cancelled outcome arrives as `alert:awaitResult` like any other.
+          if (isId(message.awaitId)) awaits.get(message.awaitId)?.handle.cancel();
+          return;
+      }
+      if (!isId(id)) return;
+      switch (message.op) {
+        case 'acknowledge':
+          manager.acknowledge(id, { input: false });
+          return;
+        case 'dismiss':
+          manager.dismissAlert(id);
+          return;
+        case 'toggleTodo':
+          manager.toggleTodo(id);
+          return;
+        case 'clearTodo':
+          manager.clearTodo(id);
+          return;
+        case 'resize':
+          manager.onResize(id);
+          return;
+        case 'remove':
+          manager.remove(id);
+          return;
+        case 'seed':
+          if (message.state && typeof message.state === 'object') {
+            manager.seed(id, message.state as PersistedAlertState);
+          }
+          return;
+      }
+    },
+
+    setWindows(labels) {
+      if (!Array.isArray(labels)) return;
+      const live = new Set(labels.filter((label): label is string => typeof label === 'string'));
+      const known = new Set([...viewers, ...[...awaits.values()].map((parked) => parked.window)]);
+      for (const window of known) {
+        if (!live.has(window)) endRealm(window);
+      }
+    },
+
+    setHelper(id, helper) {
+      if (isId(id)) manager.setHelper(id, helper);
+    },
+
+    acknowledgeInput(id) {
+      if (isId(id)) manager.acknowledge(id, { input: true });
+    },
+
+    publish(ids) {
+      const states = manager.getAllStates();
+      const wanted = Array.isArray(ids) ? ids.filter(isId) : [...states.keys()];
+      for (const id of wanted) {
+        const state = states.get(id);
+        if (state) send(ALERT_STATE_EVENT, { id, ...state });
+      }
+    },
+
+    dispose() {
+      for (const stop of stops) stop();
+      awaits.clear();
+      viewers.clear();
+      manager.dispose();
+    },
+  };
+}
diff --git a/lib/src/host/alert-protocol.ts b/lib/src/host/alert-protocol.ts
new file mode 100644
index 000000000..ffd3dec89
--- /dev/null
+++ b/lib/src/host/alert-protocol.ts
@@ -0,0 +1,40 @@
+import type { AwaitOutcome, AwaitUntil, Engagement, EngagementLapse } from '../lib/alert-manager';
+import type { AlertSettings } from '../lib/alert-settings-model';
+import type { PersistedAlertState } from '../lib/session-types';
+
+/**
+ * The wire between a standalone window and the sidecar's alerts: the commands
+ * a window sends (`lib/src/host/alert-client.ts`) and the events the sidecar
+ * answers with (`lib/src/host/alert-host.ts`).
+ */
+
+/**
+ * What a window asks, on the one `alert_command` passthrough. The host stamps
+ * the asking window's label as `window`; a webview never names itself.
+ */
+export type AlertCommand =
+  /** A window (re)initialized: whatever its previous realm engaged or parked is gone. */
+  | { op: 'hello' }
+  | { op: 'initializeWatchedCommands'; names: string[] }
+  | { op: 'setCommandWatched'; name: string; watched: boolean }
+  | { op: 'initializeSettings' | 'updateSettings'; settings: AlertSettings }
+  | { op: 'engagement'; state: Engagement; lapse?: EngagementLapse }
+  | { op: 'acknowledge' | 'dismiss' | 'toggleTodo' | 'clearTodo' | 'resize' | 'remove'; id: string }
+  | { op: 'seed'; id: string; state: PersistedAlertState }
+  | { op: 'await'; awaitId: string; id: string; until: AwaitUntil; timeoutMs: number }
+  | { op: 'awaitCancel'; awaitId: string };
+
+export const ALERT_STATE_EVENT = 'alert:state';
+export const ALERT_AWAIT_RESULT_EVENT = 'alert:awaitResult';
+
+/**
+ * One await's outcome, broadcast to every window: the asking adapter matches
+ * its own random `awaitId`. **Never carries a Session `id`**, which would route
+ * it to that Session's owner rather than the window that asked, and **never a
+ * `requestId`**, which Rust swallows to resolve its own invokes.
+ */
+export interface AlertAwaitResult {
+  awaitId: string;
+  window: string;
+  outcome: AwaitOutcome;
+}
diff --git a/lib/src/host/alert-store-host.test.ts b/lib/src/host/alert-store-host.test.ts
deleted file mode 100644
index b3cad9842..000000000
--- a/lib/src/host/alert-store-host.test.ts
+++ /dev/null
@@ -1,95 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { createAlertStoreHost, type AlertStoreHost } from './alert-store-host';
-import { DEFAULT_ALERT_SETTINGS } from '../lib/alert-settings-model';
-
-/**
- * One WATCHING rule set and one alarm-settings blob for every window
- * (`docs/specs/alert.md` → "Alarm settings"). What matters is that a second
- * window is *corrected* rather than allowed to replace shared state, and that
- * nothing a renderer sends is installed without revalidation.
- */
-
-let sent: Array<{ event: string; data: unknown }>;
-let host: AlertStoreHost;
-
-const watched = (): string[][] =>
-  sent.filter((message) => message.event === 'alert:watchedCommands')
-    .map((message) => (message.data as { names: string[] }).names);
-const settings = () =>
-  sent.filter((message) => message.event === 'alert:settings')
-    .map((message) => (message.data as { settings: Record<string, unknown> }).settings);
-
-beforeEach(() => {
-  sent = [];
-  host = createAlertStoreHost({ send: (event, data) => sent.push({ event, data }) });
-});
-
-describe('the WATCHING rule set', () => {
-  it('takes the first window\'s seed and corrects every later one', () => {
-    host.handle({ op: 'initializeWatchedCommands', names: ['npm test'] });
-    expect(watched().at(-1)).toEqual(['npm test']);
-
-    // A second window offering its own persisted copy is answered with the
-    // canonical set, not allowed to replace it.
-    host.handle({ op: 'initializeWatchedCommands', names: ['cargo build'] });
-    expect(watched().at(-1)).toEqual(['npm test']);
-  });
-
-  it('applies an edit as a delta, so a stale window cannot drop other rules', () => {
-    host.handle({ op: 'initializeWatchedCommands', names: ['npm test'] });
-    host.handle({ op: 'setCommandWatched', name: 'cargo build', watched: true });
-    expect(watched().at(-1)).toEqual(['npm test', 'cargo build']);
-
-    host.handle({ op: 'setCommandWatched', name: 'npm test', watched: false });
-    expect(watched().at(-1)).toEqual(['cargo build']);
-  });
-
-  it('ignores a malformed edit rather than installing it', () => {
-    host.handle({ op: 'initializeWatchedCommands', names: ['npm test', 42, null] });
-    expect(watched().at(-1)).toEqual(['npm test']);
-    const before = sent.length;
-    host.handle({ op: 'setCommandWatched', name: 7, watched: 'yes' });
-    host.handle({ op: 'nonsense' });
-    host.handle(null);
-    expect(sent).toHaveLength(before);
-  });
-});
-
-describe('the alarm settings', () => {
-  it('takes the first seed and corrects every later one', () => {
-    host.handle({ op: 'initializeSettings', settings: { ...DEFAULT_ALERT_SETTINGS, speakEnabled: true } });
-    expect(settings().at(-1)).toMatchObject({ speakEnabled: true });
-
-    host.handle({ op: 'initializeSettings', settings: { ...DEFAULT_ALERT_SETTINGS, speakEnabled: false } });
-    expect(settings().at(-1)).toMatchObject({ speakEnabled: true });
-  });
-
-  it('takes an explicit edit from any window', () => {
-    host.handle({ op: 'initializeSettings', settings: DEFAULT_ALERT_SETTINGS });
-    host.handle({ op: 'updateSettings', settings: { ...DEFAULT_ALERT_SETTINGS, pushEnabled: true } });
-    expect(settings().at(-1)).toMatchObject({ pushEnabled: true });
-  });
-
-  it('revalidates whatever a renderer sends', () => {
-    // A NaN or an absurd timer must never reach a host because a webview asked.
-    host.handle({ op: 'initializeSettings', settings: { speakDelayMs: Number.NaN, pushDelayMs: 1e12 } });
-    const installed = settings().at(-1)!;
-    expect(installed.speakDelayMs).toBe(DEFAULT_ALERT_SETTINGS.speakDelayMs);
-    expect(installed.pushDelayMs).toBeLessThanOrEqual(600_000);
-  });
-});
-
-it('stops broadcasting once disposed', () => {
-  host.dispose();
-  host.handle({ op: 'initializeWatchedCommands', names: ['npm test'] });
-  expect(sent).toEqual([]);
-});
-
-it('never rings anything: the sidecar has no AlertManager', () => {
-  // The stores are memory plus a broadcast; every window applies the snapshot
-  // to its own manager.
-  const send = vi.fn();
-  const bare = createAlertStoreHost({ send });
-  bare.handle({ op: 'initializeSettings', settings: DEFAULT_ALERT_SETTINGS });
-  expect(send).toHaveBeenCalledWith('alert:settings', { settings: DEFAULT_ALERT_SETTINGS });
-});
diff --git a/lib/src/host/alert-store-host.ts b/lib/src/host/alert-store-host.ts
deleted file mode 100644
index 6b1c1c9a1..000000000
--- a/lib/src/host/alert-store-host.ts
+++ /dev/null
@@ -1,106 +0,0 @@
-import { AlertSettingsHost, type AlertSettingsTarget } from '../lib/alert-settings-host';
-import { WatchedCommandHost, type WatchedCommandTarget } from '../lib/watched-command-host';
-import type { AlertSettings } from '../lib/alert-settings';
-
-/**
- * The two app-global alert stores, hosted where every window can see them
- * (`docs/specs/alert.md` → "Alarm settings"; `docs/specs/transport.md` → the
- * two-store rule). Standalone became a multi-webview host, so each window can
- * no longer keep its own `localStorage` mirror and call it canonical: the
- * WATCHING rule set and the alarm settings are one per machine.
- *
- * Nothing here rings anything. The sidecar has no `AlertManager` — that lives
- * in each webview — so the targets below are plain memory, and every window
- * applies the broadcast to its own manager.
- *
- * Same classes the VS Code extension host runs
- * (`vscode-ext/src/message-router.ts`), so the two hosts cannot drift.
- */
-
-/** What a renderer asks of the two stores. Mirrors the VS Code message names. */
-export type AlertStoreCommand =
-  | { op: 'initializeWatchedCommands'; names?: unknown }
-  | { op: 'setCommandWatched'; name?: unknown; watched?: unknown }
-  | { op: 'initializeSettings'; settings?: unknown }
-  | { op: 'updateSettings'; settings?: unknown };
-
-export interface AlertStoreHost {
-  /** One `alert:command` line from a webview. */
-  handle(command: unknown): void;
-  dispose(): void;
-}
-
-/** The WATCHING rule set, with no manager behind it. */
-class WatchedCommandMemory implements WatchedCommandTarget {
-  private names: string[] = [];
-
-  getWatchedCommands(): string[] {
-    return [...this.names];
-  }
-
-  setWatchedCommands(names: string[]): void {
-    this.names = [...new Set(names.filter((name) => typeof name === 'string' && name.length > 0))];
-  }
-
-  /** A delta, never a replacement: a stale window must not drop the rules it
-   *  has not heard about yet. */
-  setCommandWatched(name: string, watched: boolean): void {
-    const next = new Set(this.names);
-    if (watched) next.add(name);
-    else next.delete(name);
-    this.names = [...next];
-  }
-}
-
-/** The alarm settings blob, with no manager behind it. `AlertSettingsHost`
- *  revalidates through `normalizeAlertSettings` before this ever sees it. */
-class AlertSettingsMemory implements AlertSettingsTarget {
-  settings: AlertSettings | null = null;
-
-  applySettings(settings: AlertSettings): void {
-    this.settings = settings;
-  }
-}
-
-export function createAlertStoreHost(options: {
-  /** Writes one event to every window. */
-  send: (event: string, data: unknown) => void;
-}): AlertStoreHost {
-  const watched = new WatchedCommandHost(new WatchedCommandMemory());
-  const settings = new AlertSettingsHost(new AlertSettingsMemory());
-
-  const stopWatched = watched.subscribe((names) => options.send('alert:watchedCommands', { names }));
-  const stopSettings = settings.subscribe((value) => options.send('alert:settings', { settings: value }));
-
-  return {
-    handle(command) {
-      const message = command as AlertStoreCommand | null;
-      if (!message || typeof message.op !== 'string') return;
-      switch (message.op) {
-        case 'initializeWatchedCommands':
-          // Only the first window's offer is taken; every later one is answered
-          // with what the host already holds.
-          watched.initialize(Array.isArray(message.names) ? message.names.filter(
-            (name): name is string => typeof name === 'string',
-          ) : []);
-          return;
-        case 'setCommandWatched':
-          if (typeof message.name !== 'string' || typeof message.watched !== 'boolean') return;
-          watched.setCommandWatched(message.name, message.watched);
-          return;
-        case 'initializeSettings':
-          settings.initialize(message.settings);
-          return;
-        case 'updateSettings':
-          settings.update(message.settings);
-          return;
-        default:
-          return;
-      }
-    },
-    dispose() {
-      stopWatched();
-      stopSettings();
-    },
-  };
-}
diff --git a/lib/src/host/remote/sidecar-entry.test.ts b/lib/src/host/remote/sidecar-entry.test.ts
index a5d6a0035..d8c08440b 100644
--- a/lib/src/host/remote/sidecar-entry.test.ts
+++ b/lib/src/host/remote/sidecar-entry.test.ts
@@ -7,6 +7,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import type { ProcessedPtyChunk, PtySink } from '../../remote/burrow/burrow-surface-provider';
 import { createSidecarSurfaceBridge, type SidecarSurfaceBridge } from './sidecar-entry';
 import { ASK_BUDGET_MS, type BurrowAsk } from './service-protocol';
+import { AlertManager } from '../../lib/alert-manager';
 
 let sent: Array<{ event: string; data: unknown }>;
 let written: Array<{ id: string; data: string }>;
@@ -15,6 +16,10 @@ let livePtys: Set<string>;
 /** A PTY that died between the read and a reply write. */
 let writeThrows: boolean;
 let bridge: SidecarSurfaceBridge;
+/** The app's one manager, which the parse feeds. */
+let alerts: AlertManager;
+/** Called as each PTY write lands, to observe what preceded it. */
+let onWrite: ((id: string) => void) | null;
 
 /** The ask the bridge is waiting on, most recent last. */
 function asks(): BurrowAsk[] {
@@ -53,11 +58,15 @@ beforeEach(() => {
   resized = [];
   livePtys = new Set(['pty-1', 'pty-2']);
   writeThrows = false;
+  alerts = new AlertManager();
+  onWrite = null;
   bridge = createSidecarSurfaceBridge({
+    alerts,
     send: (event, data) => sent.push({ event, data }),
     mgr: {
       write: (id, data) => {
         if (writeThrows) throw new Error('write EIO');
+        onWrite?.(id);
         written.push({ id, data });
       },
       resize: (id, cols, rows, repaint) => void resized.push({
@@ -70,6 +79,7 @@ beforeEach(() => {
 
 afterEach(() => {
   bridge.dispose();
+  alerts.dispose();
   vi.useRealTimers();
 });
 
@@ -306,6 +316,30 @@ describe('resolveSurface', () => {
 });
 
 describe('PTYs', () => {
+  // A Client's keystrokes are a human's input like a local one's, and the host
+  // acknowledges them before the write, echo window included
+  // (docs/specs/alert.md → Engagement).
+  it('acknowledges a Client\'s input before writing it', () => {
+    alerts.notifyFromProtocol('pty-1', { source: 'OSC 9', title: null, body: 'needs input' });
+    const atWrite: unknown[] = [];
+    onWrite = (id) => {
+      const { status, todo } = alerts.getState(id);
+      atWrite.push({ status, todo });
+    };
+    bridge.provider.writePty('pty-1', 'y');
+    expect(atWrite).toEqual([{ status: 'WATCHING_DISABLED', todo: false }]);
+    // A bell answering the key rings no one.
+    alerts.notifyFromProtocol('pty-1', { source: 'OSC 9', title: null, body: 'needs input' });
+    expect(alerts.getState('pty-1').status).not.toBe('ALERT_RINGING');
+  });
+
+  it('gives a Client\'s repaint bounce the resize grace', () => {
+    const onResize = vi.spyOn(alerts, 'onResize');
+    bridge.provider.resizePty('pty-1', 80, 24, true);
+    expect(onResize).toHaveBeenCalledWith('pty-1');
+    expect(resized).toEqual([{ id: 'pty-1', cols: 80, rows: 24, repaint: true }]);
+  });
+
   it('writes and resizes straight through to the manager', () => {
     bridge.provider.writePty('pty-1', 'ls\r');
     bridge.provider.resizePty('pty-1', 80, 24);
@@ -470,21 +504,48 @@ describe('the webview’s half of the parse', () => {
     expect(emitted<{ id: string; events: unknown[] }>('terminal:semanticEvents')).toHaveLength(1);
   });
 
-  it('forwards the alert half of a parse, and the semantic half, in that order', () => {
+  it('keeps a report for the manager, forwarding only the semantic state it carries', () => {
     bridge.onPtyEvent('data', { id: 'pty-1', data: `\x1b]9;Build finished\x07` });
 
-    expect(sent.map((message) => message.event)).toEqual([
-      'terminal:protocolEvents',
-      'terminal:semanticEvents',
-    ]);
-    expect(emitted('terminal:protocolEvents')).toEqual([
-      {
-        id: 'pty-1',
-        events: [
-          { kind: 'notification', notification: { source: 'OSC 9', title: null, body: 'Build finished' } },
-        ],
-      },
-    ]);
+    // The notification's title candidate is pane state; the report itself
+    // rang the sidecar's manager and reaches no webview as an event.
+    expect(sent.map((message) => message.event)).toEqual(['terminal:semanticEvents']);
+    expect(alerts.getState('pty-1')).toMatchObject({
+      status: 'ALERT_RINGING',
+      notification: { source: 'OSC 9', title: null, body: 'Build finished' },
+    });
+  });
+
+  it('feeds reports to the manager in stream order with the boundaries around them', async () => {
+    // A precmd hook reports after the shell's finish, in the same read: judged
+    // after the finish, the await resolves on the exit rather than the bell.
+    bridge.onPtyEvent('data', { id: 'pty-1', data: '\x1b]633;E;./build.sh\x07\x1b]633;C\x07' });
+    const parked = alerts.awaitCompletion('pty-1', { until: 'quiet', timeoutMs: 600_000 });
+    bridge.onPtyEvent('data', { id: 'pty-1', data: '\x1b]633;D;0\x07\x1b]777;notify;Command completed;./build.sh\x1b\\' });
+    await expect(parked.promise).resolves.toMatchObject({ kind: 'resolved', cause: 'exit' });
+  });
+
+  it('counts visible output as the Session working, and protocol alone as nothing', () => {
+    const onData = vi.spyOn(alerts, 'onData');
+    bridge.onPtyEvent('data', { id: 'pty-1', data: '\x1b]7;file:///tmp\x07' });
+    expect(onData).not.toHaveBeenCalled();
+    bridge.onPtyEvent('data', { id: 'pty-1', data: 'compiling…' });
+    expect(onData).toHaveBeenCalledWith('pty-1');
+  });
+
+  it('tells the manager a PTY exited, stream or none', () => {
+    const onExit = vi.spyOn(alerts, 'onExit');
+    bridge.onPtyEvent('exit', { id: 'pty-9', exitCode: 3 });
+    expect(onExit).toHaveBeenCalledWith('pty-9', 3);
+  });
+
+  it('starts a respawned Session\'s alert state over', () => {
+    alerts.notifyFromProtocol('pty-1', { source: 'OSC 9', title: null, body: 'old run' });
+    bridge.onPtySpawn('pty-1');
+    expect(alerts.getState('pty-1')).toMatchObject({ status: 'WATCHING_DISABLED', todo: false });
+    // No tombstone: the new generation's output is its own Session's.
+    bridge.onPtyEvent('data', { id: 'pty-1', data: 'fresh' });
+    expect(alerts.getAllStates().has('pty-1')).toBe(true);
   });
 
   it('forwards dirty state and command resets separately from serve metadata', () => {
diff --git a/lib/src/host/remote/sidecar-entry.ts b/lib/src/host/remote/sidecar-entry.ts
index af9ffdb00..cdd0fe365 100644
--- a/lib/src/host/remote/sidecar-entry.ts
+++ b/lib/src/host/remote/sidecar-entry.ts
@@ -4,18 +4,20 @@
  * the JSON-lines bridge, so all logging goes to stderr.
  *
  * The sidecar owns the PTYs, so it is also standalone's terminal-protocol parse
- * site: one parser per PTY generation feeds the webview's `pty:data` and every
- * attached Client alike (`docs/specs/terminal-escapes.md` → "Parsing location").
+ * site: one parser per PTY generation feeds the webview's `pty:data`, every
+ * attached Client, and the app's one `AlertManager` alike
+ * (`docs/specs/terminal-escapes.md` → "Parsing location").
  */
 
 import {
   createProcessedPtyStream,
   type ProcessedPtyStream,
 } from '../../lib/processed-pty-stream';
+import type { AlertManager } from '../../lib/alert-manager';
 import {
-  collectTerminalProtocolAlerts,
+  applyTerminalEvents,
   collectTerminalProtocolResponses,
-  collectTerminalSemanticEvents,
+  collectTerminalToolEvents,
   type TerminalColorProvider,
   type TerminalColors,
 } from '../../lib/terminal-protocol';
@@ -39,6 +41,10 @@ import {
   type AnswerParams,
 } from './service-protocol';
 
+// The sidecar's alerts ride this bundle, so the parse site and the manager it
+// feeds are one module graph (`standalone/scripts/build-sidecar-proxy.mjs`).
+export { createSidecarAlerts, type SidecarAlerts } from '../alert-host';
+
 /** The slice of `pty-core`'s manager the Burrow drives. */
 export interface SidecarPtyManager {
   write(id: string, data: string): void;
@@ -51,6 +57,8 @@ export interface SidecarSurfaceBridgeOptions {
   /** Writes one JSON line to the Rust bridge, which emits it to the webview. */
   send: (event: string, data: unknown) => void;
   mgr: SidecarPtyManager;
+  /** The app's one manager (`createSidecarAlerts`), fed from the parse below. */
+  alerts: AlertManager;
 }
 
 export interface SidecarSurfaceBridge {
@@ -73,7 +81,8 @@ export interface SidecarSurfaceBridge {
    * as the events this emits, so `main.js` must not forward it itself.
    */
   onPtyEvent(event: string, data: unknown): void;
-  /** A `pty:spawn` command: the id now names a new PTY generation. */
+  /** A `pty:spawn` command: the id now names a new PTY generation, whose
+   *  Session starts its alert state over. */
   onPtySpawn(id: unknown): void;
   /**
    * A `pty:themeColors` push. The sidecar has no DOM, so the webview reports its
@@ -161,9 +170,10 @@ export function createSidecarSurfaceBridge(
   const exits = new Map<string, number>();
 
   /**
-   * The parse site for one PTY, feeding the webview and every Client from the
-   * same pass. Order matches the webview's own former order: alerts, then
-   * semantic state, then the responses this process writes, then the output.
+   * The parse site for one PTY, feeding the alerts, the webview and every
+   * Client from the same pass: reports and command boundaries to the manager
+   * in stream order, then Tool events and semantic state to the webview, then
+   * the responses this process writes, then the output.
    */
   function ownerStream(id: string): Stream {
     let stream = streams.get(id);
@@ -171,9 +181,11 @@ export function createSidecarSurfaceBridge(
     const parsed = createProcessedPtyStream({
       colorProvider: themeColorProvider,
       onEvents(events) {
-        const alerts = collectTerminalProtocolAlerts(events);
-        if (alerts.length > 0) options.send('terminal:protocolEvents', { id, events: alerts });
-        const semanticEvents = collectTerminalSemanticEvents(events);
+        // `recordTools` stays off: the Tool stores are the renderer's, so their
+        // events travel to it instead.
+        const semanticEvents = applyTerminalEvents(options.alerts, id, events);
+        const toolEvents = collectTerminalToolEvents(events);
+        if (toolEvents.length > 0) options.send('terminal:protocolEvents', { id, events: toolEvents });
         if (semanticEvents.length > 0) {
           options.send('terminal:semanticEvents', { id, events: semanticEvents });
         }
@@ -192,6 +204,7 @@ export function createSidecarSurfaceBridge(
         }
       },
       onChunk(chunk) {
+        options.alerts.onData(id);
         options.send('pty:data', { id, ...chunk });
       },
     });
@@ -201,8 +214,17 @@ export function createSidecarSurfaceBridge(
   }
 
   const { provider, notifyDirectoryChanged } = createAskSurfaceProvider(ask, {
-    writePty: (ptyId, data) => options.mgr.write(ptyId, data),
-    resizePty: (ptyId, cols, rows, repaint) => options.mgr.resize(ptyId, cols, rows, repaint),
+    // A Client's keystrokes are human input like a local one's: acknowledged,
+    // echo window opened, before the write (`docs/specs/alert.md` → Engagement).
+    writePty: (ptyId, data) => {
+      options.alerts.acknowledge(ptyId, { input: true });
+      options.mgr.write(ptyId, data);
+    },
+    // The repaint bounce's output is a resize's, never the program working.
+    resizePty: (ptyId, cols, rows, repaint) => {
+      options.alerts.onResize(ptyId);
+      options.mgr.resize(ptyId, cols, rows, repaint);
+    },
 
     streamPty(ptyId, sink) {
       const subscribed = ownerStream(ptyId);
@@ -343,6 +365,7 @@ export function createSidecarSurfaceBridge(
       if (event !== 'exit') return;
       const reported = (detail as { exitCode?: unknown }).exitCode;
       const exitCode = typeof reported === 'number' ? reported : 0;
+      options.alerts.onExit(id, exitCode);
       // Durable: a surface resolution may already be in flight without a sink.
       exits.set(id, exitCode);
       const stream = streams.get(id);
@@ -359,6 +382,9 @@ export function createSidecarSurfaceBridge(
       // one's half-read sequence into its first bytes, and the new PTY has not
       // exited whatever the old one did.
       if (typeof id !== 'string') return;
+      // At the spawn command: a cold restore seeds after it, so the seed lands
+      // on the new Session rather than being wiped by it.
+      options.alerts.restart(id);
       const stream = streams.get(id);
       const exitCode = exits.get(id) ?? 0;
       exits.delete(id);
diff --git a/lib/src/lib/alert-engagement.test.ts b/lib/src/lib/alert-engagement.test.ts
index 2694cab05..7c2692b81 100644
--- a/lib/src/lib/alert-engagement.test.ts
+++ b/lib/src/lib/alert-engagement.test.ts
@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AlertManager, type ActivityNotification, type AwaitOutcome } from './alert-manager';
-import { applyTerminalProtocolEvents, TerminalProtocolParser } from './terminal-protocol';
+import { applyTerminalEvents, TerminalProtocolParser } from './terminal-protocol';
 import { cfg } from '../cfg';
 import { engage, finishCommand, goIdle, leave, runCommand, VIEWER } from './alert-manager-test-utils';
 
@@ -298,7 +298,7 @@ describe('walking away from a permission prompt', () => {
     timeline.push({ at: ENTER_AT, step: () => manager.acknowledge(PANE, { input: true }) });
     // Working, then the permission prompt drawn.
     for (let at = 9_390; at < 11_960; at += 110) timeline.push({ at, step: () => manager.onData(PANE) });
-    timeline.push({ at: 17_960, step: () => applyTerminalProtocolEvents(manager, PANE, parser.process(OSC99).events) });
+    timeline.push({ at: 17_960, step: () => applyTerminalEvents(manager, PANE, parser.process(OSC99).events) });
     // The idle prompt's cursor redraw.
     for (let at = 12_415; at < untilMs; at += 605) timeline.push({ at, step: () => manager.onData(PANE) });
     // The renderer's presence lapses 15s after the last input.
diff --git a/lib/src/lib/alert-manager-test-utils.ts b/lib/src/lib/alert-manager-test-utils.ts
index 5bb55fdfb..e02efd24a 100644
--- a/lib/src/lib/alert-manager-test-utils.ts
+++ b/lib/src/lib/alert-manager-test-utils.ts
@@ -1,9 +1,8 @@
 /**
  * Drivers the suites that feed an `AlertManager` directly share
  * (`alert-manager.test.ts`, `alert-engagement.test.ts`,
- * `alert-resumed-output.test.ts`, `alert-runtime-transfer.test.ts`). Each takes
- * the manager it drives, since a transfer test drives two, and runs under fake
- * timers.
+ * `alert-resumed-output.test.ts`). Each takes the manager it drives and runs
+ * under fake timers.
  *
  * Timing from cfg.alert: busyCandidateGap=1500, busyConfirmGap=500,
  * mightNeedAttention=2000, needsAttentionConfirm=3000.
diff --git a/lib/src/lib/alert-manager.test.ts b/lib/src/lib/alert-manager.test.ts
index 79b9115b0..a21db01c2 100644
--- a/lib/src/lib/alert-manager.test.ts
+++ b/lib/src/lib/alert-manager.test.ts
@@ -3,7 +3,6 @@ import { AlertManager, AWAIT_GRACE_MS, DEFAULT_ALERT_STATE, MAX_AWAIT_TIMEOUT_MS
 import type { ActivityNotification, AwaitHandle, AwaitOutcome, CompletionEvent } from './alert-manager';
 import {
   applyTerminalEvents,
-  applyTerminalProtocolEvents,
   collectTerminalSemanticEvents,
   TerminalProtocolParser,
 } from './terminal-protocol';
@@ -54,8 +53,8 @@ describe('AlertManager in isolation', () => {
       runWatchedCommand(HELPER);
       driveToBusy(manager, HELPER);
       settle();
-      applyTerminalProtocolEvents(manager, HELPER, [{ kind: 'notification', notification: { source: 'OSC 9', title: null, body: 'done' } }]);
-      applyTerminalProtocolEvents(manager, HELPER, [{ kind: 'progress', progress: { state: 'normal', percent: 40 } }]);
+      applyTerminalEvents(manager, HELPER, [{ kind: 'notification', notification: { source: 'OSC 9', title: null, body: 'done' } }]);
+      applyTerminalEvents(manager, HELPER, [{ kind: 'progress', progress: { state: 'normal', percent: 40 } }]);
       engage(manager, HELPER);
       manager.acknowledge(HELPER, { input: true });
       leave(manager);
@@ -122,7 +121,7 @@ describe('AlertManager in isolation', () => {
       runCommand(manager, HELPER, 'claude');
       driveToBusy(manager, HELPER);
       settle();
-      applyTerminalProtocolEvents(manager, HELPER, [{ kind: 'notification', notification: { source: 'OSC 9', title: null, body: 'done' } }]);
+      applyTerminalEvents(manager, HELPER, [{ kind: 'notification', notification: { source: 'OSC 9', title: null, body: 'done' } }]);
 
       manager.setHelper(HELPER, false);
       vi.advanceTimersByTime(10_000);
@@ -449,7 +448,7 @@ describe('AlertManager in isolation', () => {
   it('terminal bell notifications ring and create TODO detail even when WATCHING is disabled', () => {
     const id = 'terminal-bell';
 
-    applyTerminalProtocolEvents(manager, id, [
+    applyTerminalEvents(manager, id, [
       { kind: 'notification', notification: { source: 'BEL', title: 'Terminal bell', body: null } },
     ]);
 
@@ -636,7 +635,7 @@ describe('AlertManager in isolation', () => {
     const id = 'terminal-bell-held';
 
     engage(manager, id);
-    applyTerminalProtocolEvents(manager, id, [
+    applyTerminalEvents(manager, id, [
       { kind: 'notification', notification: { source: 'BEL', title: 'Terminal bell', body: null } },
     ]);
 
@@ -673,7 +672,7 @@ describe('AlertManager in isolation', () => {
     armCommandExit(manager, id);
     vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
 
-    applyTerminalProtocolEvents(manager, id, [
+    applyTerminalEvents(manager, id, [
       { kind: 'notification', notification: { source: 'BEL', title: 'Terminal bell', body: null } },
     ]);
     const rung = manager.getState(id);
@@ -693,13 +692,13 @@ describe('AlertManager in isolation', () => {
     const id = 'episode-restart';
     const bell = { source: 'BEL', title: 'Terminal bell', body: null } as const;
 
-    applyTerminalProtocolEvents(manager, id, [{ kind: 'notification', notification: bell }]);
+    applyTerminalEvents(manager, id, [{ kind: 'notification', notification: bell }]);
     const first = manager.getState(id).episode;
     expect(first?.id).toBeTruthy();
 
     // Bell spam on a ring that is already active enriches the standing
     // summons; it cannot raise a new episode, so nothing keyed on one replays.
-    applyTerminalProtocolEvents(manager, id, [{ kind: 'notification', notification: bell }]);
+    applyTerminalEvents(manager, id, [{ kind: 'notification', notification: bell }]);
     expect(manager.getState(id).episode?.id).toBe(first!.id);
 
     manager.clearTodo(id);
@@ -707,7 +706,7 @@ describe('AlertManager in isolation', () => {
 
     // Output since the clear: the next bell is news, not the acknowledged state.
     manager.onData(id);
-    applyTerminalProtocolEvents(manager, id, [{ kind: 'notification', notification: bell }]);
+    applyTerminalEvents(manager, id, [{ kind: 'notification', notification: bell }]);
     const second = manager.getState(id).episode;
     expect(second?.id).toBeTruthy();
     expect(second?.id).not.toBe(first!.id);
diff --git a/lib/src/lib/alert-manager.ts b/lib/src/lib/alert-manager.ts
index 63cdecb1f..93344fc80 100644
--- a/lib/src/lib/alert-manager.ts
+++ b/lib/src/lib/alert-manager.ts
@@ -1,10 +1,5 @@
 import { createAlertEpisode, type AlertEpisode } from './alert-episode';
-import { QuiesceDetector, type QuiesceStatus, type QuiesceSnapshot } from './quiesce-detector';
-import {
-  applyTerminalEvents,
-  collectTerminalSemanticEvents,
-  type TerminalProtocolParseResult,
-} from './terminal-protocol';
+import { QuiesceDetector, type QuiesceStatus } from './quiesce-detector';
 import { DEFAULT_ALERT_SETTINGS, type AlertSettings } from './alert-settings-model';
 import { cfg } from '../cfg';
 import {
@@ -103,7 +98,6 @@ interface WatchingSource {
 
 /** The sources a ring holds, or held completions would raise. */
 interface SourceSet {
-  /** An array, not a Set: the live-transfer snapshot crosses IPC as JSON. */
   sources: ListedRingSource[];
   /** Removing the rule that covers its key withdraws it. */
   watching: WatchingSource | null;
@@ -165,7 +159,7 @@ export type EngagementLapse = 'idle' | 'leave';
 const NOT_ENGAGED: Engagement = { present: false, focusId: null };
 
 /** The one viewer of a manager that serves a single renderer realm: the fake
- *  adapter's, a standalone window's, the browser-sidecar page's. */
+ *  adapter's. */
 export const LOCAL_VIEWER = 'local';
 
 export function normalizeActivityNotification(value: unknown): ActivityNotification | null {
@@ -312,18 +306,10 @@ interface AlertEntry {
   echoUntil: number;
 }
 
-/** Explicit live handoff only: timers are deadlines, and no caller closures travel. */
-export interface AlertRuntimeSnapshot extends Omit<AlertEntry, 'detector' | 'deferredTimer'> {
-  detector: QuiesceSnapshot;
-}
-
 /** Portable Session Activity manager. `dispatchCompletion` is the single
  * observe→claim→ring seam, so await can claim completions before suppression. */
 export class AlertManager {
   private entries = new Map<string, AlertEntry>();
-  private suspendedForTransfer = new Set<string>();
-  /** Session → request token of the one replay that counts as live (`applyReplay`). */
-  private liveReplay = new Map<string, string>();
   /** Blocks late output/resize from recreating a removed entry. Only a semantic
    * or protocol event proves a reused id belongs to a live replacement. */
   private removed = new Set<string>();
@@ -365,9 +351,7 @@ export class AlertManager {
 
     // Turning the gate off releases news it was holding; dropping it would turn
     // a timing preference into alert loss.
-    for (const [id, entry] of this.entries) {
-      if (!this.suspendedForTransfer.has(id)) this.flushDeferredNotification(id, entry);
-    }
+    for (const [id, entry] of this.entries) this.flushDeferredNotification(id, entry);
   }
 
   /** Mark (or, on promotion, unmark) a helper Session. */
@@ -403,7 +387,6 @@ export class AlertManager {
   }
 
   onExit(id: string, exitCode?: number): void {
-    if (this.suspendedForTransfer.has(id)) return;
     const entry = this.entries.get(id);
     if (entry && this.finishCommandExitWatch(id, entry, exitCode)) this.notify(id);
     // The command-exit dispatch above already resolved anything waiting on the
@@ -430,9 +413,6 @@ export class AlertManager {
     if (next.size === this.watchedCommands.size && [...next].every((name) => this.watchedCommands.has(name))) return;
     this.watchedCommands = next;
     for (const [id, entry] of this.entries) {
-      // A suspended Session is frozen at its snapshot; `resumeFromTransfer`
-      // re-applies this rule wherever the snapshot lands.
-      if (this.suspendedForTransfer.has(id)) continue;
       this.withdrawUncoveredWatchingRing(entry);
       // WATCHING is derived from the rule set, so every entry may have changed.
       this.notify(id);
@@ -871,7 +851,7 @@ export class AlertManager {
   // --- Command-exit ---
 
   applyTerminalSemanticEvents(id: string, events: TerminalSemanticEvent[]): void {
-    if (events.length === 0 || this.suspendedForTransfer.has(id)) return;
+    if (events.length === 0) return;
     const entry = this.reportedEntry(id);
     let changed = false;
 
@@ -1178,7 +1158,7 @@ export class AlertManager {
    */
   acknowledge(id: string, { input }: { input: boolean }): void {
     const entry = this.entries.get(id);
-    if (!entry || this.suspendedForTransfer.has(id)) return;
+    if (!entry) return;
     if (input) entry.echoUntil = Date.now() + cfg.alert.echoWindow;
     if (this.helpers.has(id)) return;
     this.markSeen(entry);
@@ -1221,7 +1201,6 @@ export class AlertManager {
   // --- Alert controls ---
 
   dismissAlert(id: string): void {
-    if (this.suspendedForTransfer.has(id)) return;
     const entry = this.entries.get(id);
     if (!entry) return;
 
@@ -1280,8 +1259,6 @@ export class AlertManager {
 
   /** Completely remove alert state for a PTY (used when PTY is destroyed) */
   remove(id: string): void {
-    this.suspendedForTransfer.delete(id);
-    this.liveReplay.delete(id);
     this.removed.add(id);
     // Nobody parked here has anything left to wait for.
     this.settleWaiters(id, 'died');
@@ -1300,6 +1277,17 @@ export class AlertManager {
     this.helpers.delete(id);
   }
 
+  /**
+   * A new PTY generation under `id`: what the old one left goes as on
+   * `remove`, but no tombstone, since the output about to arrive is the new
+   * Session's own. A host whose restore seeds after the spawn calls this at
+   * the spawn; one that seeds before it must not.
+   */
+  restart(id: string): void {
+    this.remove(id);
+    this.removed.delete(id);
+  }
+
   /**
    * Seed alert state from a persisted session (cold-start restore). Only the
    * TODO reminder and its notification detail survive a restart — WATCHING is
@@ -1323,72 +1311,10 @@ export class AlertManager {
     this.notify(id);
   }
 
-  /** Whether `id` drops reports, controls and awaits: a helper, or a Session
-   *  suspended for a live handoff. The output and command-state feeds, which a
-   *  helper keeps, check the suspension alone. */
+  /** Whether `id` drops reports, controls and awaits: a helper. The output and
+   *  command-state feeds, which a helper keeps, never check it. */
   private inert(id: string): boolean {
-    return this.helpers.has(id) || this.suspendedForTransfer.has(id);
-  }
-
-  /** Suspend at the output mark. Parked await callers receive an explicit cancellation. */
-  pauseForTransfer(id: string): AlertRuntimeSnapshot | null {
-    const entry = this.entries.get(id);
-    if (!entry) return null;
-    this.settleWaiters(id, 'cancelled');
-    // Leaving this window is an explicit disengage, and a seen command stays
-    // seen: unengaged at the destination, it is armed there.
-    entry.held = null;
-    this.suspendedForTransfer.add(id);
-    const { detector, deferredTimer: _timer, ...state } = entry;
-    const snapshot = structuredClone({ ...state, detector: detector.snapshot() });
-    detector.dispose();
-    if (entry.deferredTimer !== null) clearTimeout(entry.deferredTimer);
-    entry.deferredTimer = null;
-    return snapshot;
-  }
-
-  /** Resume live state before replay; unlike seed, this preserves the ring and
-   *  its episode identity. `replayRequestId` names the one since-mark replay that
-   *  `applyReplay` treats as live output. */
-  resumeFromTransfer(id: string, snapshot: AlertRuntimeSnapshot, replayRequestId?: string): void {
-    if (this.helpers.has(id)) return;
-    this.suspendedForTransfer.delete(id);
-    this.removed.delete(id);
-    if (replayRequestId === undefined) this.liveReplay.delete(id);
-    else this.liveReplay.set(id, replayRequestId);
-    const entry = this.getOrCreateEntry(id);
-    entry.detector.dispose();
-    if (entry.deferredTimer !== null) clearTimeout(entry.deferredTimer);
-    const { detector, ...state } = structuredClone(snapshot);
-    Object.assign(entry, state);
-    entry.deferredTimer = null;
-    entry.detector = this.createDetector(id);
-    entry.detector.restore(detector);
-    this.withdrawUncoveredWatchingRing(entry);
-    if (entry.deferred) {
-      if (this.deferAlertsUntilQuiet) this.scheduleDeferredNotification(id, entry);
-      else this.flushDeferredNotification(id, entry);
-    }
-    this.notify(id);
-  }
-
-  /**
-   * Feed a `pty:replay` chunk. Historical replay applies semantic events alone;
-   * only the live since-mark replay of a Workspace handoff, matched by its
-   * request token, counts as output and fires notification events
-   * (`docs/specs/alert.md` → Live Workspace transfer). Returns the semantic
-   * events for the terminal-state store.
-   */
-  applyReplay(id: string, requestId: string | undefined, parsed: TerminalProtocolParseResult): TerminalSemanticEvent[] {
-    if (requestId !== undefined && this.liveReplay.get(id) === requestId) {
-      this.liveReplay.delete(id);
-      if (parsed.visibleData.length) this.onData(id);
-      // The caller records the replay's Tool reports for either kind.
-      return applyTerminalEvents(this, id, parsed.events);
-    }
-    const events = collectTerminalSemanticEvents(parsed.events);
-    this.applyTerminalSemanticEvents(id, events);
-    return events;
+    return this.helpers.has(id);
   }
 
   dispose(): void {
@@ -1400,8 +1326,6 @@ export class AlertManager {
       entry.detector.dispose();
     }
     this.entries.clear();
-    this.suspendedForTransfer.clear();
-    this.liveReplay.clear();
     this.removed.clear();
     this.helpers.clear();
     this.awaits.clear();
@@ -1421,7 +1345,7 @@ export class AlertManager {
    * was killed (see `removed`).
    */
   private streamEntry(id: string): AlertEntry | null {
-    if (this.removed.has(id) || this.suspendedForTransfer.has(id)) return null;
+    if (this.removed.has(id)) return null;
     return this.getOrCreateEntry(id);
   }
 
diff --git a/lib/src/lib/alert-runtime-transfer.test.ts b/lib/src/lib/alert-runtime-transfer.test.ts
deleted file mode 100644
index a3b5c6360..000000000
--- a/lib/src/lib/alert-runtime-transfer.test.ts
+++ /dev/null
@@ -1,107 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { AlertManager } from './alert-manager';
-import { QuiesceDetector } from './quiesce-detector';
-import { cfg } from '../cfg';
-import { engage, goIdle, heartbeat, runCommand } from './alert-manager-test-utils';
-
-beforeEach(() => vi.useFakeTimers());
-afterEach(() => vi.useRealTimers());
-
-describe('live alert handoff', () => {
-  it('preserves an episode across live handoff, while cold restore remains silent', () => {
-    const source = new AlertManager();
-    source.notifyFromProtocol('pane', { source: 'OSC 9', title: 'Done', body: null });
-    const first = source.getState('pane');
-    const snapshot = source.pauseForTransfer('pane')!;
-    source.acknowledge('pane', { input: true });
-    source.clearTodo('pane');
-    expect(source.getState('pane')).toEqual(first);
-    const target = new AlertManager();
-    target.resumeFromTransfer('pane', JSON.parse(JSON.stringify(snapshot)));
-    expect(target.getState('pane')).toEqual(first);
-    target.notifyFromProtocol('pane', { source: 'BEL', title: 'More detail', body: null });
-    expect(target.getState('pane').episode).toEqual(first.episode);
-    target.dismissAlert('pane');
-    target.onData('pane');
-    target.notifyFromProtocol('pane', { source: 'BEL', title: 'Next', body: null });
-    expect(target.getState('pane').episode?.id).toBeTruthy();
-    expect(target.getState('pane').episode?.id).not.toBe(first.episode?.id);
-    target.seed('pane', snapshot);
-    expect(target.getState('pane')).toMatchObject({ todo: true, episode: null });
-    source.dispose(); target.dispose();
-  });
-
-  it('leaves behind what the source held, and arms the command it saw', () => {
-    const source = new AlertManager();
-    engage(source, 'pane');
-    runCommand(source, 'pane');
-    source.notifyFromProtocol('pane', { source: 'OSC 9', title: null, body: 'needs input' });
-    const snapshot = source.pauseForTransfer('pane')!;
-
-    const target = new AlertManager();
-    target.resumeFromTransfer('pane', JSON.parse(JSON.stringify(snapshot)));
-    expect(target.getState('pane').status).toBe('COMMAND_EXIT_ARMED');
-    // Leaving the source window disengaged it: nothing it held escalates here.
-    engage(target, 'pane');
-    goIdle(target, 'pane');
-    expect(target.getState('pane')).toMatchObject({ todo: false, notification: null });
-    source.dispose(); target.dispose();
-  });
-
-  it('carries the deferral ceiling across a live transfer', () => {
-    const source = new AlertManager();
-    source.onData('pane');
-    vi.advanceTimersByTime(cfg.alert.busyCandidateGap);
-    source.onData('pane'); source.onData('pane');
-    // Confirmed busy, so the report waits behind the animation.
-    source.notifyFromProtocol('pane', { source: 'OSC 9', title: null, body: 'Done' });
-    heartbeat(source, 'pane', 20_000);
-    const snapshot = source.pauseForTransfer('pane')!;
-    const target = new AlertManager();
-    target.resumeFromTransfer('pane', JSON.parse(JSON.stringify(snapshot)));
-    heartbeat(target, 'pane', cfg.alert.deferCeiling - 21_000);
-    expect(target.getState('pane').status).toBe('WATCHING_DISABLED');
-    vi.advanceTimersByTime(1_000);
-    expect(target.getState('pane').status).toBe('ALERT_RINGING');
-    source.dispose(); target.dispose();
-  });
-
-  it('preserves the original confirmed-busy quiet deadline across a suspended interval', () => {
-    const settled = vi.fn();
-    const source = new QuiesceDetector();
-    source.onData();
-    vi.advanceTimersByTime(cfg.alert.busyCandidateGap);
-    source.onData(); source.onData();
-    expect(source.isConfirmedBusy()).toBe(true);
-    const snapshot = source.snapshot();
-    source.dispose();
-    vi.advanceTimersByTime(cfg.alert.mightNeedAttention + cfg.alert.needsAttentionConfirm + 100);
-    const target = new QuiesceDetector({ onSettled: settled });
-    target.restore(JSON.parse(JSON.stringify(snapshot)));
-    vi.advanceTimersByTime(1);
-    expect(settled).toHaveBeenCalledTimes(1);
-    target.dispose();
-  });
-
-  it('accepts output right after restoring an expired resize grace', () => {
-    const source = new QuiesceDetector();
-    source.onResize();
-    const snapshot = source.snapshot();
-    source.dispose();
-    vi.advanceTimersByTime(cfg.alert.resizeDebounce + 1);
-    const target = new QuiesceDetector();
-    target.restore(JSON.parse(JSON.stringify(snapshot)));
-    target.onData();
-    expect(target.snapshot()).toMatchObject({ resizeGrace: false, outputCountSinceReset: 1 });
-    target.dispose();
-  });
-
-  it('cancels parked await callers at the handoff boundary', async () => {
-    const source = new AlertManager();
-    source.onData('pane');
-    const handle = source.awaitCompletion('pane', { until: 'exit', timeoutMs: 60_000 });
-    source.pauseForTransfer('pane');
-    expect(await handle.promise).toMatchObject({ kind: 'cancelled' });
-    source.dispose();
-  });
-});
diff --git a/lib/src/lib/alert-settings.ts b/lib/src/lib/alert-settings.ts
index e67fc89aa..b29aea6c6 100644
--- a/lib/src/lib/alert-settings.ts
+++ b/lib/src/lib/alert-settings.ts
@@ -10,7 +10,7 @@ import {
  * The renderer's copy of the app-global alarm settings: what the dialog edits
  * and what `localStorage` holds. The shape, its defaults and its validation are
  * the platform-free `alert-settings-model.ts`, so a host can run them beside
- * the PTYs (`lib/src/host/alert-store-host.ts`) without dragging a renderer in.
+ * the PTYs (`lib/src/host/alert-host.ts`) without dragging a renderer in.
  *
  * Re-exported here so every existing importer keeps one name to reach for.
  */
diff --git a/lib/src/lib/platform/fake-adapter.ts b/lib/src/lib/platform/fake-adapter.ts
index 1c4c2f78b..8122821d6 100644
--- a/lib/src/lib/platform/fake-adapter.ts
+++ b/lib/src/lib/platform/fake-adapter.ts
@@ -1,4 +1,3 @@
-import type { AlertRuntimeSnapshot } from '../alert-manager';
 import { DEFAULT_HELPER_COMMAND, type HelperIdentity, type TerminalContextRequest, type TerminalContextInfo } from '../terminal-context-types';
 import type { AlertStateDetail, OpenPort, PlatformAdapter, PtyDataDetail, PtyInfo, BurrowLink, WritePtyOptions } from './types';
 import { AlertManager, LOCAL_VIEWER } from '../alert-manager';
@@ -325,12 +324,7 @@ export class FakePtyAdapter implements PlatformAdapter {
   offRequestSessionFlush(_handler: (detail: { requestId: string }) => void): void {}
   notifySessionFlushComplete(_requestId: string): void {}
 
-  // Alert management (local AlertManager, same as TauriAdapter)
-  alertPauseForTransfer(id: string): AlertRuntimeSnapshot | null { return this.alertManager.pauseForTransfer(id); }
-  alertResumeFromTransfer(id: string, snapshot: AlertRuntimeSnapshot, replayRequestId?: string): void {
-    this.alertManager.resumeFromTransfer(id, snapshot, replayRequestId);
-  }
-
+  // Alert management (a local AlertManager: this renderer is its one viewer)
   alertRemove(id: string): void { this.alertManager.remove(id); }
   alertSetWatchedCommands(names: string[]): void { this.alertManager.setWatchedCommands(names); }
   alertSetCommandWatched(name: string, watched: boolean): void { this.alertManager.setCommandWatched(name, watched); }
diff --git a/lib/src/lib/platform/types.ts b/lib/src/lib/platform/types.ts
index ef1153d47..b8b49d7d5 100644
--- a/lib/src/lib/platform/types.ts
+++ b/lib/src/lib/platform/types.ts
@@ -1,4 +1,3 @@
-import type { AlertRuntimeSnapshot } from '../alert-manager';
 import type { HelperIdentity, TerminalContextRequest, TerminalContextInfo } from '../terminal-context-types';
 import type { AlertState, AwaitHandle, AwaitOptions, Engagement, EngagementLapse } from '../alert-manager';
 import type { AlertSettings } from '../alert-settings';
@@ -304,20 +303,15 @@ export interface PlatformAdapter {
    */
   requestAppRestart?(requester?: string): Promise<boolean>;
 
-  /** Explicit live Workspace handoff, never a persistence reader. */
-  alertPauseForTransfer?(id: string): AlertRuntimeSnapshot | null;
-  /** `replayRequestId` names the one since-mark `pty:replay` whose notification
-   *  events and visible output count as live; every other replay stays silent. */
-  alertResumeFromTransfer?(id: string, snapshot: AlertRuntimeSnapshot, replayRequestId?: string): void;
   /**
    * Seed a cold-restored Surface's persisted TODO/alert into the host's
    * `AlertManager`, so the freshly spawned PTY inherits the state its saved pane
-   * carried (`docs/specs/alert.md` -> "Persist only").
+   * carried (`docs/specs/alert.md` -> "Persist only"). Called after the spawn.
    *
-   * Present only where the adapter owns the manager: standalone runs it in the
-   * webview, so the restore path is the only thing that can seed it. VS Code
-   * omits it — its extension host seeds its own manager while answering the
-   * webview's boot (`vscode-ext/src/message-router.ts`).
+   * Present only on standalone, whose sidecar holds no persisted session, so
+   * the restore path is the only thing that can seed it. VS Code omits it — its
+   * extension host seeds its own manager while answering the webview's boot
+   * (`vscode-ext/src/message-router.ts`).
    */
   alertSeed?(id: string, state: PersistedAlertState): void;
 
diff --git a/lib/src/lib/quiesce-detector.ts b/lib/src/lib/quiesce-detector.ts
index df78f46f4..11f5a3494 100644
--- a/lib/src/lib/quiesce-detector.ts
+++ b/lib/src/lib/quiesce-detector.ts
@@ -33,6 +33,8 @@ const QUIESCE_AFTER_OUTPUT_MS = T_MIGHT_NEED_ATTENTION + T_SETTLED_CONFIRM;
 /** Longest silence unconfirmed candidate history can span and still count. */
 const CANDIDATE_HISTORY_TTL_MS = T_BUSY_CANDIDATE_GAP + T_BUSY_CONFIRM_GAP;
 
+type DetectorTimer = 'busyCandidate' | 'busyConfirm' | 'mightNeedAttention' | 'settledConfirm' | 'resize';
+
 /**
  * Watches one Session's PTY output and reports busy/quiet transitions.
  *
@@ -40,17 +42,6 @@ const CANDIDATE_HISTORY_TTL_MS = T_BUSY_CANDIDATE_GAP + T_BUSY_CONFIRM_GAP;
  * observer, not an alarm. It never latches: a settle is announced through
  * `onSettled` and the detector immediately starts over.
  */
-type DetectorTimer = 'busyCandidate' | 'busyConfirm' | 'mightNeedAttention' | 'settledConfirm' | 'resize';
-export interface QuiesceSnapshot {
-  status: QuiesceStatus;
-  resizeGrace: boolean;
-  firstOutputAt: number | null;
-  lastOutputAt: number | null;
-  lastAcceptedOutputAt: number | null;
-  outputCountSinceReset: number;
-  deadlines: Partial<Record<DetectorTimer, number>>;
-}
-
 export class QuiesceDetector {
   private status: QuiesceStatus = 'NOTHING_TO_SHOW';
   private resizeGrace = false;
@@ -139,33 +130,6 @@ export class QuiesceDetector {
     this.schedule('resize', T_RESIZE_DEBOUNCE);
   }
 
-  /** Freeze timers at a live ownership boundary. Cold restore never reads this. */
-  snapshot(): QuiesceSnapshot {
-    return {
-      status: this.status, resizeGrace: this.resizeGrace,
-      firstOutputAt: this.firstOutputAt, lastOutputAt: this.lastOutputAt,
-      lastAcceptedOutputAt: this.lastAcceptedOutputAt,
-      outputCountSinceReset: this.outputCountSinceReset,
-      deadlines: Object.fromEntries([...this.timers].map(([key, value]) => [key, value.dueAt])),
-    };
-  }
-
-  restore(snapshot: QuiesceSnapshot): void {
-    this.dispose();
-    this.disposed = false;
-    this.status = snapshot.status;
-    this.resizeGrace = snapshot.resizeGrace;
-    this.firstOutputAt = snapshot.firstOutputAt;
-    this.lastOutputAt = snapshot.lastOutputAt;
-    this.lastAcceptedOutputAt = snapshot.lastAcceptedOutputAt;
-    this.outputCountSinceReset = snapshot.outputCountSinceReset;
-    for (const [key, dueAt] of Object.entries(snapshot.deadlines)) {
-      // An expired grace must not swallow the output that follows restore.
-      if (key === 'resize' && dueAt <= Date.now()) { this.resizeGrace = false; continue; }
-      this.schedule(key as DetectorTimer, dueAt - Date.now());
-    }
-  }
-
   dispose(): void {
     this.disposed = true;
     for (const { timer } of this.timers.values()) clearTimeout(timer);
diff --git a/lib/src/lib/session-restore.ts b/lib/src/lib/session-restore.ts
index bba166857..46924a577 100644
--- a/lib/src/lib/session-restore.ts
+++ b/lib/src/lib/session-restore.ts
@@ -109,10 +109,11 @@ export function restoreSession(platform: PlatformAdapter, sources: RestoreSource
         ? { command: pane.command ?? null, requireIntegration: true, resumeCommand: null }
         : { resumeCommand: recoveryCommands[pane.id] ?? null }),
     });
-    // The fresh PTY inherits the pane's persisted TODO/alert, on the hosts whose
-    // AlertManager lives in the webview. Seeded after `restoreTerminal` so the
-    // state change lands on a registered pane. Restore-only: a live resume still
-    // has the manager's own state (docs/specs/alert.md -> "Persist only").
+    // The fresh PTY inherits the pane's persisted TODO/alert, on the host that
+    // cannot seed itself (standalone: its sidecar holds no persisted session).
+    // After `restoreTerminal`, whose spawn starts the Session's alert state over
+    // host-side, so the seed lands on the new Session. Restore-only: a live
+    // resume still has the manager's own state (docs/specs/alert.md -> "Persist only").
     if (pane.alert) platform.alertSeed?.(pane.id, pane.alert);
   }
 
diff --git a/lib/src/lib/terminal-lifecycle.release.test.ts b/lib/src/lib/terminal-lifecycle.release.test.ts
index 098eaf027..55938403d 100644
--- a/lib/src/lib/terminal-lifecycle.release.test.ts
+++ b/lib/src/lib/terminal-lifecycle.release.test.ts
@@ -37,6 +37,7 @@ import {
 const platform = (platformModule as unknown as { __fakePlatform: FakePtyAdapter }).__fakePlatform;
 
 let killed: string[];
+let removedAlerts: string[];
 
 /** A pin, without a real xterm buffer behind it: what the notepad holds is two
  *  markers it must be able to dispose. */
@@ -51,6 +52,8 @@ function fakeSource(terminalId: string) {
 beforeEach(() => {
   killed = [];
   vi.spyOn(platform, 'killPty').mockImplementation((id: string) => void killed.push(id));
+  removedAlerts = [];
+  vi.spyOn(platform, 'alertRemove').mockImplementation((id: string) => void removedAlerts.push(id));
   for (const id of ['pane-1', 'pane-2']) removeSurface(id);
 });
 
@@ -65,6 +68,19 @@ describe('releaseSession', () => {
     expect(killed).toEqual(['pane-2']);
   });
 
+  // The host's alert entry is the Session's, not this Window's: a departure or
+  // a refused arrival that removed it would wipe a ring or TODO the other
+  // Window is showing (docs/specs/alert.md → Live Workspace transfer).
+  it('leaves the host alert entry, which only a kill removes', () => {
+    getOrCreateTerminal('pane-1');
+    releaseSession('pane-1');
+    expect(removedAlerts).toEqual([]);
+
+    getOrCreateTerminal('pane-2');
+    disposeSession('pane-2');
+    expect(removedAlerts).toEqual(['pane-2']);
+  });
+
   it("drops this webview's half of the Session", () => {
     getOrCreateTerminal('pane-1');
     expect(getTerminalInstance('pane-1')).not.toBeNull();
diff --git a/lib/src/lib/terminal-lifecycle.ts b/lib/src/lib/terminal-lifecycle.ts
index 7398ceb6c..142b20047 100644
--- a/lib/src/lib/terminal-lifecycle.ts
+++ b/lib/src/lib/terminal-lifecycle.ts
@@ -617,17 +617,20 @@ export function disposeAllSessions(): void {
 }
 
 /**
- * Tear this webview's half of a Session down: the alert, the notepad pins, the
- * listeners, the element and the xterm instance, plus the registry, pane,
- * selection and activity state keyed to it.
+ * Tear this webview's half of a Session down: the notepad pins, the listeners,
+ * the element and the xterm instance, plus the registry, pane, selection and
+ * activity state keyed to it.
  *
  * `kill` is the only difference between the two verbs below, and it is the
- * whole difference between ending a Session and letting another Window take it.
+ * whole difference between ending a Session and letting another Window take it:
+ * a kill also removes the host's alert entry, which a release leaves to the
+ * Window that takes the Session over (`docs/specs/alert.md` → Live Workspace
+ * transfer).
  */
 function teardownSession(id: string, { kill }: { kill: boolean }): void {
   const entry = registry.get(id);
   if (!entry) return;
-  getPlatform().alertRemove(id);
+  if (kill) getPlatform().alertRemove(id);
   // Before the xterm instance goes: its markers are what notepad pins hold, and
   // a disposed marker cannot be dropped cleanly afterwards. The notes stay.
   dropSourcesForTerminal(id);
diff --git a/lib/src/lib/terminal-protocol.ts b/lib/src/lib/terminal-protocol.ts
index e70579942..01e182945 100644
--- a/lib/src/lib/terminal-protocol.ts
+++ b/lib/src/lib/terminal-protocol.ts
@@ -479,20 +479,6 @@ export function textProjectionOf(
   return parsed.textData === parsed.visibleData ? undefined : parsed.textData;
 }
 
-/**
- * Apply a batch's reports and Tool reports alone — standalone's protocol
- * channel, whose semantic events arrive on a channel of their own. Everything
- * else takes {@link applyTerminalEvents}.
- */
-export function applyTerminalProtocolEvents(
-  sink: TerminalProtocolAlertSink,
-  id: string,
-  events: TerminalProtocolEvent[],
-): void {
-  recordToolEvents(id, events);
-  for (const event of events) applyTerminalReport(sink, id, event);
-}
-
 /**
  * Apply one parse batch in stream order, so a report written after a command
  * boundary is judged after it (`docs/specs/alert.md` -> Terminal reports).
@@ -534,16 +520,15 @@ function applyTerminalReport(sink: TerminalProtocolAlertSink, id: string, event:
 }
 
 /**
- * The notification, progress, Tool announcement and command-start events {@link applyTerminalProtocolEvents} acts
- * on. An owner whose `AlertManager` lives in another process — standalone's
- * sidecar, whose webview holds it — forwards exactly these; every other kind is
- * the owner's own to settle, a response above all.
+ * The Tool announcement, Tool state and command-start events `recordToolEvents`
+ * acts on, in stream order: what a parse site forwards to the renderer that
+ * holds the Tool stores. Reports stay with the owner's `AlertManager`, and a
+ * response is the owner's alone to write.
  */
-export function collectTerminalProtocolAlerts(
-  events: TerminalProtocolEvent[],
+export function collectTerminalToolEvents(
+  events: readonly TerminalProtocolEvent[],
 ): TerminalProtocolEvent[] {
-  return events.filter((event) => event.kind === 'notification' || event.kind === 'progress' || event.kind === 'toolAnnounce' || event.kind === 'toolState'
-    || isProtocolCommandStart(event));
+  return events.filter((event) => event.kind === 'toolAnnounce' || event.kind === 'toolState' || isProtocolCommandStart(event));
 }
 
 export function collectTerminalProtocolResponses(events: TerminalProtocolEvent[]): string[] {
diff --git a/lib/src/lib/tool-announce.test.ts b/lib/src/lib/tool-announce.test.ts
index 236b9016a..acf292536 100644
--- a/lib/src/lib/tool-announce.test.ts
+++ b/lib/src/lib/tool-announce.test.ts
@@ -1,9 +1,8 @@
 import { describe, expect, it } from 'vitest';
 import { parseToolAnnounce } from './tool-announce';
-import { collectTerminalProtocolAlerts, collectTerminalProtocolResponses, TerminalProtocolParser } from './terminal-protocol';
+import { collectTerminalToolEvents, collectTerminalProtocolResponses, TerminalProtocolParser } from './terminal-protocol';
 import { getToolAnnounce, resetToolAnnounces } from './tool-announce-store';
 import { recordToolEvents } from './tool-events';
-import { applyTerminalProtocolEvents } from './terminal-protocol';
 
 const serve = (payload: unknown) => `serve;${JSON.stringify(payload)}`;
 
@@ -92,13 +91,11 @@ describe('parseToolAnnounce', () => {
 });
 
 describe('OSC 367 at the PTY boundary', () => {
-  const sink = { notifyFromProtocol: () => {}, updateProtocolProgress: () => {} };
-
-  it.each(['live', 'replay', 'forwarded'] as const)('isolates successive commands without losing same-chunk serves (%s)', mode => {
+  // A live or replayed parse records the whole batch; the sidecar forwards its Tool events.
+  it.each(['parsed', 'forwarded'] as const)('isolates successive commands without losing same-chunk serves (%s)', mode => {
     const record = (data: string) => {
       const events = new TerminalProtocolParser().process(data).events;
-      if (mode === 'replay') recordToolEvents('epoch', events);
-      else applyTerminalProtocolEvents(sink, 'epoch', mode === 'forwarded' ? collectTerminalProtocolAlerts(events) : events);
+      recordToolEvents('epoch', mode === 'forwarded' ? collectTerminalToolEvents(events) : events);
     };
     const oldServe = '\x1b]367;serve;{"port":6006,"key":["old"]}\x07';
     const start = '\x1b]633;C\x07';
@@ -115,7 +112,7 @@ describe('OSC 367 at the PTY boundary', () => {
   function feed(id: string, data: string) {
     const parser = new TerminalProtocolParser();
     const result = parser.process(data);
-    applyTerminalProtocolEvents(sink, id, result.events);
+    recordToolEvents(id, result.events);
     return result;
   }
 
@@ -159,7 +156,7 @@ it('consumes chunked OSC 367 and forwards the announcement without a terminal re
   expect(parser.process('before\x1b]367;serve;{"port":').visibleData).toBe('before');
   const parsed = parser.process('6006}\x1b\\after');
   expect(parsed.visibleData).toBe('after');
-  expect(collectTerminalProtocolAlerts(parsed.events)).toEqual([
+  expect(collectTerminalToolEvents(parsed.events)).toEqual([
     { kind: 'toolAnnounce', announce: { port: 6006, name: null, key: null, dehydrate: false, persist: null } },
   ]);
   expect(collectTerminalProtocolResponses(parsed.events)).toEqual([]);
diff --git a/lib/src/lib/tool-state.test.ts b/lib/src/lib/tool-state.test.ts
index ea584c80f..927d5ea87 100644
--- a/lib/src/lib/tool-state.test.ts
+++ b/lib/src/lib/tool-state.test.ts
@@ -3,14 +3,13 @@ import { parseToolState } from './tool-state';
 import { clearToolDirty, getToolDirty, recordToolDirty, resetToolDirty, subscribeToToolDirty } from './tool-dirty-store';
 import { getToolAnnounce, resetToolAnnounces } from './tool-announce-store';
 import { recordToolEvents } from './tool-events';
-import { applyTerminalProtocolEvents, collectTerminalProtocolAlerts, collectTerminalProtocolResponses, collectTerminalSemanticEvents, TerminalProtocolParser } from './terminal-protocol';
+import { collectTerminalProtocolResponses, collectTerminalSemanticEvents, collectTerminalToolEvents, TerminalProtocolParser } from './terminal-protocol';
 import { applyTerminalSemanticEvents, removeTerminalPaneState, seedLaunchedCommand } from './terminal-state-store';
 
 const id = 'dirty-state-test';
 const state = (dirty: boolean) => `\x1b]367;state;${JSON.stringify({ v: 1, dirty })}\x07`;
 const start = '\x1b]633;C\x07';
 const serve = '\x1b]367;serve;{"port":6006}\x07';
-const sink = { notifyFromProtocol() {}, updateProtocolProgress() {} };
 afterEach(() => { removeTerminalPaneState(id); resetToolAnnounces(); resetToolDirty(); });
 
 it.each([true, false])('parses strict v1 dirty=%s without a response, including split/ST output', dirty => {
@@ -27,7 +26,7 @@ it.each([null, [], {}, { dirty: true }, { v: 2, dirty: true }, { v: '1', dirty:
   { v: 1 }, { v: 1, dirty: 'false' }, { v: 1, dirty: 0 }, { v: 1, dirty: null }])('ignores invalid state payload %j without assuming clean', value => {
   recordToolDirty(id, true);
   const parsed = new TerminalProtocolParser().process(`before\x1b]367;state;${JSON.stringify(value)}\x07after`);
-  applyTerminalProtocolEvents(sink, id, parsed.events);
+  recordToolEvents(id, parsed.events);
   expect(parsed.visibleData).toBe('beforeafter');
   expect(parsed.events).toEqual([]);
   expect(getToolDirty(id)).toBe(true);
@@ -39,11 +38,11 @@ it('bounds malformed/oversized payloads before JSON parsing', () => {
   }
 });
 
-it.each(['live', 'forwarded', 'replay'] as const)('preserves serve/state/start order and retains exit reports through %s', mode => {
+// A live or replayed parse records the whole batch; the sidecar forwards its Tool events.
+it.each(['parsed', 'forwarded'] as const)('preserves serve/state/start order and retains exit reports through %s', mode => {
   const feed = (data: string) => {
     const events = new TerminalProtocolParser().process(data).events;
-    if (mode === 'replay') recordToolEvents(id, events);
-    else applyTerminalProtocolEvents(sink, id, mode === 'forwarded' ? collectTerminalProtocolAlerts(events) : events);
+    recordToolEvents(id, mode === 'forwarded' ? collectTerminalToolEvents(events) : events);
     // Adapters deliver semantic batches after protocol reports. This must not
     // erase a state that followed the start inside the same read.
     applyTerminalSemanticEvents(id, collectTerminalSemanticEvents(events));
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index b9fc6333c..032889c07 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -2,7 +2,7 @@
   "AGENTS.md": 3400,
   "SECURITY.md": 200,
   "SELF_HOST.md": 6100,
-  "docs/specs/alert.md": 7850,
+  "docs/specs/alert.md": 7900,
   "docs/specs/auto-update.md": 1150,
   "docs/specs/deploy.md": 1900,
   "docs/specs/dor-browser.md": 4550,
@@ -26,7 +26,7 @@
   "docs/specs/security-supply-chain.md": 1150,
   "docs/specs/security.md": 1900,
   "docs/specs/shortcuts.md": 1150,
-  "docs/specs/standalone.md": 11500,
+  "docs/specs/standalone.md": 11950,
   "docs/specs/terminal-context.md": 1050,
   "docs/specs/terminal-escapes.md": 3900,
   "docs/specs/terminal-state.md": 2500,
diff --git a/standalone/scripts/build-sidecar-proxy.mjs b/standalone/scripts/build-sidecar-proxy.mjs
index 5471235ad..40681410e 100644
--- a/standalone/scripts/build-sidecar-proxy.mjs
+++ b/standalone/scripts/build-sidecar-proxy.mjs
@@ -5,9 +5,8 @@
 //   - lib/src/host/agent-browser-host.ts  → sidecar/agent-browser-host.cjs
 //   - lib/src/host/tool-host.ts           → sidecar/tool-host.cjs
 //   - lib/src/host/git-info.ts            → sidecar/git-info.cjs
-//   - lib/src/host/remote/sidecar-entry.ts → sidecar/burrow.cjs
+//   - lib/src/host/remote/sidecar-entry.ts → sidecar/burrow.cjs (the alerts too)
 //   - lib/src/host/recovery.ts             → sidecar/recovery.cjs
-//   - lib/src/host/alert-store-host.ts     → sidecar/alert-store.cjs
 // See docs/specs/dor-browser.md, docs/specs/remote-api.md,
 // docs/specs/standalone.md -> "Agent recovery", and docs/specs/alert.md.
 import { build } from 'esbuild';
@@ -64,7 +63,6 @@ const bundles = [
   { entry: 'tool-host.ts', out: 'tool-host.cjs' },
   { entry: 'git-info.ts', out: 'git-info.cjs' },
   { entry: 'recovery.ts', out: 'recovery.cjs' },
-  { entry: 'alert-store-host.ts', out: 'alert-store.cjs' },
   {
     entry: 'remote/sidecar-entry.ts',
     out: 'burrow.cjs',
@@ -111,8 +109,11 @@ function assertNothingInlined(metafile, outfile, names) {
 
 // `tauri.conf.json`'s `bundle.resources` globs this whole directory, so a
 // pre-rename `remote-host.cjs` left in an older checkout would ship inside the
-// app — a dead Burrow with its own baked connect-src allowlist.
-await rm(path.resolve(sidecar, 'remote-host.cjs'), { force: true });
+// app — a dead Burrow with its own baked connect-src allowlist — and so would
+// an `alert-store.cjs` from before the alerts joined `burrow.cjs`.
+for (const retired of ['remote-host.cjs', 'alert-store.cjs']) {
+  await rm(path.resolve(sidecar, retired), { force: true });
+}
 
 for (const { entry, out, define, assertBaked, external } of bundles) {
   const outfile = path.resolve(sidecar, out);
diff --git a/standalone/scripts/dev-agent-browser.mjs b/standalone/scripts/dev-agent-browser.mjs
index d605ce5d0..5e19f6703 100644
--- a/standalone/scripts/dev-agent-browser.mjs
+++ b/standalone/scripts/dev-agent-browser.mjs
@@ -100,9 +100,14 @@ function requestSidecar(event, data, responseEvent, pick, timeoutMs = 10000) {
   });
 }
 
+/** The one window this harness simulates: its alert viewer id and registry label. */
+const HARNESS_WINDOW = 'main';
+
 const fireAndForget = {
   pty_spawn: ({ id, options }) => writeSidecar('pty:spawn', { id, options }),
-  pty_write: ({ id, data, paced }) => writeSidecar('pty:input', { id, data, paced }),
+  // `userInput` rides the write, as `pty_write` in src-tauri/src/lib.rs carries it.
+  pty_write: ({ id, data, paced, userInput }) =>
+    writeSidecar('pty:input', { id, data, paced, ...(userInput === true ? { userInput: true } : {}) }),
   pty_resize: ({ id, cols, rows }) => writeSidecar('pty:resize', { id, cols, rows }),
   pty_theme_colors: ({ colors }) => writeSidecar('pty:themeColors', colors),
   pty_kill: ({ id }) => writeSidecar('pty:kill', { id }),
@@ -111,10 +116,11 @@ const fireAndForget = {
   // The Burrow's whole bridge rides one passthrough, exactly as it does
   // through Rust (`burrow_command` in src-tauri/src/lib.rs).
   burrow_command: ({ payload }) => writeSidecar('burrow:command', payload),
-  // The app-global alert stores live in the sidecar; their broadcasts come back
-  // over the event stream like every other sidecar line (`alert_command` in
-  // src-tauri/src/lib.rs).
-  alert_command: ({ payload }) => writeSidecar('alert:command', payload),
+  // The app's one AlertManager lives in the sidecar; its answers come back over
+  // the event stream like every other sidecar line. Stamped with the one window
+  // label this harness simulates, as Rust stamps the invoking window's
+  // (`alert_command` in src-tauri/src/lib.rs).
+  alert_command: ({ payload }) => writeSidecar('alert:command', { ...payload, window: HARNESS_WINDOW }),
   kill_sidecar_now: () => shutdown(),
 };
 
@@ -196,7 +202,7 @@ function registrySnapshot() {
     name: entry.name,
     active: Boolean(entry.active),
   }));
-  return { revision: registryRevision, windows: [{ label: 'main', workspaces }] };
+  return { revision: registryRevision, windows: [{ label: HARNESS_WINDOW, workspaces }] };
 }
 
 async function readJson(req) {
diff --git a/standalone/scripts/dev-agent-browser.test.mjs b/standalone/scripts/dev-agent-browser.test.mjs
index 279c0681f..169818ce9 100644
--- a/standalone/scripts/dev-agent-browser.test.mjs
+++ b/standalone/scripts/dev-agent-browser.test.mjs
@@ -22,6 +22,7 @@ async function fixture(t) {
     const { createInterface } = require('node:readline');
     createInterface({ input: process.stdin }).on('line', line => {
       const { event, data } = JSON.parse(line);
+      if (event === 'alert:command' || event === 'pty:input') console.error('SIDECAR_LINE ' + line);
       if (event === 'pty:getCwd') console.log(JSON.stringify({
         event: 'pty:cwd', data: { requestId: data.requestId, cwd: process.env.VITE_DORMOUSE_BROWSER_DEV_HOST || process.cwd() }
       }));
@@ -85,6 +86,14 @@ async function invoke(run, token = run.token, origin = run.app, cmd = 'pty_get_c
   });
 }
 
+async function send(run, cmd, args) {
+  return fetch(`${run.bridge}/__dormouse_dev_host/send?t=${run.token}`, {
+    method: 'POST', headers: { 'content-type': 'application/json', origin: run.app },
+    body: JSON.stringify({ cmd, args }),
+    signal: AbortSignal.timeout(5000),
+  });
+}
+
 async function assertClosed(run) {
   for (const url of [run.app, run.bridge]) {
     await assert.rejects(fetch(url, { signal: AbortSignal.timeout(1000) }));
@@ -154,6 +163,22 @@ test('parallel worktrees own ports, browser identities and bridges; stopping one
   assert.equal(restarted.session, sessionForKey(one.session));
 });
 
+// The harness speaks the same sidecar protocol Rust does: one fixed window
+// label stamped on every alert command, over anything the page claimed, and a
+// write's `userInput` riding the write (docs/specs/standalone.md -> "Alerts").
+test('stamps its one window on alert commands and carries userInput on the write', { timeout: 60000 }, async t => {
+  const run = await (await fixture(t)).start().ready();
+  const line = async (pattern) => JSON.parse((await run.wait(pattern))[1]);
+  assert.equal((await send(run, 'alert_command', { payload: { op: 'hello', window: 'ws-9' } })).status, 200);
+  assert.deepEqual(await line(/SIDECAR_LINE (\{"event":"alert:command".*\})/), {
+    event: 'alert:command', data: { op: 'hello', window: 'main' },
+  });
+  assert.equal((await send(run, 'pty_write', { id: 'p1', data: 'y', userInput: true })).status, 200);
+  assert.deepEqual(await line(/SIDECAR_LINE (\{"event":"pty:input".*\})/), {
+    event: 'pty:input', data: { id: 'p1', data: 'y', userInput: true },
+  });
+});
+
 test('explicit ports and raw browser sessions are honored; occupied ports fail without adopting a peer', { timeout: 60000 }, async t => {
   const a = await fixture(t);
   const one = await a.start().ready();
diff --git a/standalone/sidecar/helper-terminal.test.js b/standalone/sidecar/helper-terminal.test.js
index f07a8ebe6..85f2a17a5 100644
--- a/standalone/sidecar/helper-terminal.test.js
+++ b/standalone/sidecar/helper-terminal.test.js
@@ -67,11 +67,15 @@ test('helper ownership survives a live listing and promotion preserves the PTY a
   }, { replay: true });
   manager.spawn('parent');
   manager.spawn('helper', { helper: { parentId: 'parent', command: 'git status' } });
+  // What the host's alerts mirror after each spawn and promotion.
+  assert.equal(manager.isHelper('parent'), false);
+  assert.equal(manager.isHelper('helper'), true);
   spawned[1].output('unsaved editor text');
   manager.list();
   assert.deepEqual(events.findLast(e => e.event === 'list').data.ptys[1].helper, { parentId: 'parent', command: 'git status' });
   assert.equal(events.findLast(e => e.event === 'replay').data.data, 'unsaved editor text');
   manager.context({ op: 'promote', id: 'helper' }, 'promote-1');
+  assert.equal(manager.isHelper('helper'), false);
   manager.list();
   assert.equal(events.findLast(e => e.event === 'list').data.ptys[1].helper, undefined);
   assert.equal(spawned.length, 2);
diff --git a/standalone/sidecar/main-wiring.test.js b/standalone/sidecar/main-wiring.test.js
index d848fdafb..4080a4a23 100644
--- a/standalone/sidecar/main-wiring.test.js
+++ b/standalone/sidecar/main-wiring.test.js
@@ -19,3 +19,39 @@ test('recovery capture and the record take are answered from pty-core marks', ()
   assert.match(source, /receivedChars:\s*\(id\)\s*=>\s*mgr\.receivedChars\(id\)/);
   assert.match(source, /outputSince:\s*\(id,\s*mark\)\s*=>\s*mgr\.outputSince\(id,\s*mark\)/);
 });
+
+// The sidecar's one AlertManager (docs/specs/standalone.md -> "Alerts"). Each
+// check below pins a call whose absence would fail silently: a window would
+// render stale rings, or ring on its own typing.
+const handler = (event) => {
+  const start = source.indexOf(`case '${event}':`);
+  assert.ok(start >= 0, `main.js handles ${event}`);
+  const end = source.indexOf('case ', start + 6);
+  return source.slice(start, end);
+};
+
+test('the Burrow parse feeds the same manager the alert commands drive', () => {
+  assert.match(source, /const alerts = createSidecarAlerts\(\{ send \}\)/);
+  assert.match(source, /createSidecarBurrow\(\{[^}]*alerts: alerts\.manager,[^}]*\}\)/);
+  assert.match(handler('alert:command'), /alerts\.handle\(data\)/);
+});
+
+test('human input is acknowledged in its own write message, before the write', () => {
+  const body = handler('pty:input');
+  const ack = body.indexOf('alerts.acknowledgeInput(data.id)');
+  assert.ok(ack >= 0 && ack < body.indexOf('mgr.write('), 'acknowledged before mgr.write');
+  assert.match(body, /data\.userInput === true/);
+});
+
+test('a window collecting its PTYs gets their alert state behind the list', () => {
+  const body = handler('pty:requestInit');
+  const publish = body.indexOf('alerts.publish(data?.ids)');
+  assert.ok(publish > body.indexOf('mgr.list('), 'published after the list');
+});
+
+test('helpers mirror pty-core at spawn and promotion, and closed windows stop being viewers', () => {
+  const spawn = handler('pty:spawn');
+  assert.ok(spawn.indexOf('alerts.setHelper(data.id, mgr.isHelper(data.id))') > spawn.indexOf('mgr.spawn('));
+  assert.match(handler('pty:context'), /data\.op === 'promote'\) alerts\.setHelper\(data\.id, mgr\.isHelper\(data\.id\)\)/);
+  assert.match(handler('burrow:windows'), /alerts\.setWindows\(data\?\.labels\)/);
+});
diff --git a/standalone/sidecar/main.js b/standalone/sidecar/main.js
index c5b88e8b2..d6be031c7 100644
--- a/standalone/sidecar/main.js
+++ b/standalone/sidecar/main.js
@@ -22,17 +22,14 @@ const { gitInfo } = require('./git-info.cjs');
 const { createAgentBrowserHost } = require('./agent-browser-host.cjs');
 // Same pattern again: lib/src/host/remote/sidecar-entry.ts is the Burrow —
 // the relay socket, the enrollment, the ACL, and remote-api v1 — running next to
-// the PTYs it serves. See docs/specs/remote-api.md.
-const { createSidecarBurrow } = require('./burrow.cjs');
+// the PTYs it serves. See docs/specs/remote-api.md. The same bundle carries the
+// app's one AlertManager (lib/src/host/alert-host.ts), which its parse feeds,
+// and the two app-global alert stores bound to it. See docs/specs/alert.md.
+const { createSidecarBurrow, createSidecarAlerts } = require('./burrow.cjs');
 // Same pattern again: lib/src/host/recovery.ts is the agent-recovery capture
 // machine (shared with the VS Code extension host) plus the single-use record
 // store. See docs/specs/standalone.md -> "Agent recovery".
 const { captureAgentRecovery, createRecoveryStore, sliceSince } = require('./recovery.cjs');
-// Same pattern again: lib/src/host/alert-store-host.ts holds the two
-// app-global alert stores — one WATCHING rule set and one alarm-settings blob
-// for every window — running the same classes the VS Code extension host runs.
-// See docs/specs/alert.md.
-const { createAlertStoreHost } = require('./alert-store.cjs');
 
 const agentBrowser = createAgentBrowserHost({
   writeClipboardText: (text) => clipboard.writeClipboardText(text),
@@ -68,10 +65,16 @@ const mgr = create((event, data) => {
   // buffers through one implementation.
 }, nodePty, { replay: true, sliceSince });
 
+// One per app, like VS Code's extension host: every window is a viewer of it,
+// and its `alert:state` is routed to each Session's owner (docs/specs/standalone.md
+// -> "Alerts").
+const alerts = createSidecarAlerts({ send });
+
 const burrow = createSidecarBurrow({
   send,
   stateDir: process.env.DORMOUSE_STATE_DIR,
   mgr,
+  alerts: alerts.manager,
 });
 
 // Dor Tools. Shares the app's state directory, so an approved repo stays
@@ -88,10 +91,6 @@ const dorControlToken = process.env.DORMOUSE_CONTROL_TOKEN;
 delete process.env.DORMOUSE_CONTROL_TOKEN;
 delete process.env.DORMOUSE_CONTROL_SOCKET;
 
-// Broadcast, never addressed: both stores are one per machine, so every window
-// gets the same canonical snapshot (docs/specs/standalone.md -> "Windows").
-const alertStore = createAlertStoreHost({ send });
-
 const dorControl = createDorControlServer({
   token: dorControlToken,
   send,
@@ -149,15 +148,34 @@ function handleLine(line) {
     switch (event) {
       // Told before the spawn: the id may be a live PTY's, and the parser for
       // that generation must not carry a half-read sequence into the new one.
-      case 'pty:spawn':   burrow.onPtySpawn(data.id); mgr.spawn(data.id, data.options); break;
-      case 'pty:input':   mgr.write(data.id, data.data, { paced: data.paced === true }); break;
+      // pty-core validates a helper, so the alerts mirror its answer.
+      case 'pty:spawn':
+        burrow.onPtySpawn(data.id);
+        mgr.spawn(data.id, data.options);
+        alerts.setHelper(data.id, mgr.isHelper(data.id));
+        break;
+      // Human input is acknowledged in the same message as its write, so the
+      // echo window is open before any echo can arrive (docs/specs/alert.md ->
+      // Engagement).
+      case 'pty:input':
+        if (data.userInput === true) alerts.acknowledgeInput(data.id);
+        mgr.write(data.id, data.data, { paced: data.paced === true });
+        break;
       case 'pty:resize':  mgr.resize(data.id, data.cols, data.rows); break;
       case 'pty:kill':    mgr.kill(data.id); break;
       // One window's own PTYs, and the answer names it so the host can route
       // the list and every replay behind it back (docs/specs/standalone.md).
-      case 'pty:requestInit': mgr.list(data?.ids, data?.forWindow, data?.requestId, data?.marks); break;
+      // Their alert state follows, routed to each owner: a reloaded or arriving
+      // window has no other way to learn it.
+      case 'pty:requestInit':
+        mgr.list(data?.ids, data?.forWindow, data?.requestId, data?.marks);
+        alerts.publish(data?.ids);
+        break;
       case 'pty:mark': mgr.mark(data?.ids, data?.requestId); break;
-      case 'pty:context': mgr.context(data, data.requestId); break;
+      case 'pty:context':
+        mgr.context(data, data.requestId);
+        if (data.op === 'promote') alerts.setHelper(data.id, mgr.isHelper(data.id));
+        break;
       case 'pty:getCwd':  mgr.getCwd(data.id, data.requestId); break;
       case 'pty:getCwds': mgr.getCwds(data.ids, data.requestId); break;
       case 'pty:getOpenPorts': mgr.getOpenPorts(data.id, data.requestId); break;
@@ -196,13 +214,16 @@ function handleLine(line) {
       // The webview's resolved terminal theme, so the parser here can answer
       // OSC 10/11/12 (docs/specs/terminal-escapes.md → Supported OSCs).
       // Which webviews will answer a Burrow ask (docs/specs/standalone.md
-      // -> "Burrow service").
-      case 'burrow:windows': burrow.setWindows(data?.labels); break;
+      // -> "Burrow service"), and which are still alert viewers.
+      case 'burrow:windows':
+        burrow.setWindows(data?.labels);
+        alerts.setWindows(data?.labels);
+        break;
       // Which windows an ask actually reached. Only the host knows: one naming
       // a Surface goes to its owner alone (docs/specs/standalone.md ->
       // "Burrow service").
       case 'burrow:askDelivered': burrow.setAskDelivery(data); break;
-      case 'alert:command': alertStore.handle(data); break;
+      case 'alert:command': alerts.handle(data); break;
       case 'pty:themeColors': burrow.setThemeColors(data); break;
       case 'sidecar:shutdown': shutdown(); break;
       case 'dor:controlResponse': dorControl?.respond(data); break;
@@ -308,7 +329,7 @@ async function shutdown() {
     ]);
   } catch {}
   dorControl?.close();
-  alertStore.dispose();
+  alerts.dispose();
   burrow.dispose();
   mgr.killAll();
   process.exit(0);
diff --git a/standalone/sidecar/pty-core.js b/standalone/sidecar/pty-core.js
index 80760005d..49f96ea4b 100644
--- a/standalone/sidecar/pty-core.js
+++ b/standalone/sidecar/pty-core.js
@@ -1504,6 +1504,12 @@ module.exports.create = function create(send, ptyModule, { replay = false, slice
     return ptys.has(id);
   }
 
+  /** Whether `id` is a helper, as validated at its spawn or promotion: the
+   *  host's alerts mirror this after each (docs/specs/alert.md -> Pane Header). */
+  function isHelper(id) {
+    return helpers.has(id);
+  }
+
   function kill(id) {
     helpers.delete(id);
     sessions.delete(id);
@@ -1759,7 +1765,7 @@ module.exports.create = function create(send, ptyModule, { replay = false, slice
     send('shells', { shells: detectAvailableShells(), requestId });
   }
 
-  return { spawn, write, resize, hasPty, kill, killAll, list, context,
+  return { spawn, write, resize, hasPty, isHelper, kill, killAll, list, context,
     getCwd, getCwds, getOpenPorts, getOpenPortsMany, interrupt, gracefulKill, getShells,
     liveIds, receivedChars, outputSince, mark };
 };
diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index fe0c44328..4b4efb607 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -79,7 +79,8 @@ fn guard<T>(lock: &Mutex<T>) -> MutexGuard<'_, T> {
 #[derive(Default)]
 struct RoutingState {
     /// ptyId -> window label. Minted only in `pty_spawn`, dropped by
-    /// `pty_kill`, an exit, or a window going away; reassigned by a transfer.
+    /// `pty_kill` or a window going away — never by an exit; reassigned by a
+    /// transfer.
     owners: HashMap<String, String>,
     /// Ids whose output is suppressed until the replay their new owner is about
     /// to be sent has been emitted, each with the instant it began.
@@ -87,8 +88,8 @@ struct RoutingState {
     /// dor requestId -> the window handling it, so a cancel reaches the window
     /// holding the subscription, watch or completion claim it releases.
     dor_targets: HashMap<String, String>,
-    /// Protocol events that arrived while their id was suppressed, delivered
-    /// to the new owner behind its replay (`routing::Route::Hold`). Only ever
+    /// Tool events that arrived while their id was suppressed, delivered to
+    /// the new owner behind its replay (`routing::Route::Hold`). Only ever
     /// emptied together with `awaiting_replay` (`lift_suppression`).
     held: HashMap<String, Vec<routing::HeldEvent>>,
     /// Ids between a transfer's invoke and the sidecar's `marked` line, each
@@ -222,16 +223,28 @@ impl WindowState {
         JsonValue::Object(marks)
     }
 
-    fn forget_pty(&self, id: &str) { self.remove_pty(id, false); }
-    fn exited_pty(&self, id: &str) { self.remove_pty(id, true); }
-
-    fn remove_pty(&self, id: &str, keep_cut: bool) {
+    /// The Session is gone (`pty_kill`, or its window went away): ownership and
+    /// every transfer record with it, the cut included, since a kill discards
+    /// the buffer it indexes.
+    fn forget_pty(&self, id: &str) {
         let mut routing = guard(&self.routing);
         routing.owners.remove(id);
+        routing.transfer_marks.remove(id);
+        self.end_transfer_routing(&mut routing, id);
+    }
+
+    /// The PTY exited on its own. **Ownership stays until the Session is
+    /// killed**: the pane still shows it, and the sidecar's `alert:state` for it
+    /// — a dismiss, a TODO cleared — must still reach that window (§Alerts). The
+    /// cut stays too: the sidecar retains the buffer a replay reads.
+    fn exited_pty(&self, id: &str) {
+        let mut routing = guard(&self.routing);
+        self.end_transfer_routing(&mut routing, id);
+    }
+
+    fn end_transfer_routing(&self, routing: &mut RoutingState, id: &str) {
         routing.lift_suppression(id);
         routing.marking.remove(id);
-        // Natural exit retains the sidecar buffer; explicit kill discards it.
-        if !keep_cut { routing.transfer_marks.remove(id); }
         self.suppressed.store(routing.awaiting_replay.len(), Ordering::Relaxed);
     }
 
@@ -1092,13 +1105,37 @@ fn pty_spawn(
 }
 
 #[tauri::command]
-fn pty_write(state: tauri::State<'_, SidecarState>, id: String, data: String, paced: Option<bool>) {
+fn pty_write(
+    state: tauri::State<'_, SidecarState>,
+    id: String,
+    data: String,
+    paced: Option<bool>,
+    user_input: Option<bool>,
+) {
+    send_to_sidecar(&state, pty_input_message(id, data, paced, user_input).to_string());
+}
+
+/// One `pty:input` line. **Human input carries `userInput` on the write itself**,
+/// never a separate alert command racing it: the sidecar acknowledges it and
+/// opens the echo window before the bytes reach the PTY (docs/specs/alert.md
+/// → Engagement).
+fn pty_input_message(id: String, data: String, paced: Option<bool>, user_input: Option<bool>) -> JsonValue {
     let mut input = serde_json::json!({ "id": id, "data": data });
     if paced == Some(true) {
         input["paced"] = true.into();
     }
-    let msg = serde_json::json!({ "event": "pty:input", "data": input });
-    send_to_sidecar(&state, msg.to_string());
+    if user_input == Some(true) {
+        input["userInput"] = true.into();
+    }
+    serde_json::json!({ "event": "pty:input", "data": input })
+}
+
+/// Stamp the invoking window's label onto a webview's opaque command: the one
+/// field Rust adds, because a webview cannot name itself to the sidecar.
+fn stamp_window(payload: &mut JsonValue, label: &str) {
+    if let Some(command) = payload.as_object_mut() {
+        command.insert("window".to_string(), JsonValue::String(label.to_string()));
+    }
 }
 
 #[tauri::command]
@@ -1177,15 +1214,9 @@ fn burrow_command(
     state: tauri::State<'_, SidecarState>,
     mut payload: JsonValue,
 ) {
-    // The one field Rust adds: which webview this came from. An ask fans out to
-    // every window and settles on having heard from each, and a webview cannot
-    // name itself to the Burrow (§Burrow service).
-    if let Some(command) = payload.as_object_mut() {
-        command.insert(
-            "window".to_string(),
-            JsonValue::String(window.label().to_string()),
-        );
-    }
+    // Which webview this came from: an ask fans out to every window and settles
+    // on having heard from each (§Burrow service).
+    stamp_window(&mut payload, window.label());
     let msg = serde_json::json!({
         "event": "burrow:command",
         "data": payload,
@@ -1193,13 +1224,18 @@ fn burrow_command(
     send_to_sidecar(&state, msg.to_string());
 }
 
-// The two app-global alert stores live in the sidecar so N windows share one
-// answer (docs/specs/alert.md -> "Alarm settings"). One opaque passthrough, like
-// `burrow_command`: the payload names its own op, and the shape belongs to
-// `lib/src/host/alert-store-host.ts` at the other end. The canonical snapshot
-// comes back as a broadcast `alert:settings` / `alert:watchedCommands`.
+// The app's one AlertManager lives in the sidecar, and every window is one of
+// its viewers (§Alerts). One opaque passthrough, like `burrow_command`: the
+// payload names its own op, and the shape belongs to
+// `lib/src/host/alert-protocol.ts`. The window label is stamped, because it is
+// the viewer id engagement is kept under and the owner of the awaits it parks.
 #[tauri::command]
-fn alert_command(state: tauri::State<'_, SidecarState>, payload: JsonValue) {
+fn alert_command(
+    window: tauri::Window,
+    state: tauri::State<'_, SidecarState>,
+    mut payload: JsonValue,
+) {
+    stamp_window(&mut payload, window.label());
     let msg = serde_json::json!({ "event": "alert:command", "data": payload });
     send_to_sidecar(&state, msg.to_string());
 }
@@ -3086,7 +3122,7 @@ fn spawn_arrival_watchdog(app: AppHandle, arrival: &routing::Arrival) {
 /// From its mark to now every byte went to the target, or nowhere, and the
 /// source's xterm stands at the mark; so the sidecar is asked for
 /// `outputSince(mark)` scoped to the source, and that replay lifts the
-/// suppression on its way out (`dispatch_sidecar_event`), the held protocol
+/// suppression on its way out (`dispatch_sidecar_event`), the held Tool
 /// events behind it. Marks come from the routing state at `pty:marked`, never
 /// from the later serialized content. Only an id the sidecar never stamped
 /// goes straight back.
@@ -4752,8 +4788,63 @@ mod tests {
         assert_eq!(windows.hand_back(&["t1".to_string()], "main")["t1"], 42);
         let routing = guard(&windows.routing);
         assert!(!routing.transfer_marks.contains_key("t1"));
-        assert!(!routing.owners.contains_key("t1"));
-        assert!(!routing.awaiting_replay.contains_key("t1"));
+        // The source shows the exited pane again, behind the replay of its cut.
+        assert_eq!(routing.owners.get("t1").map(String::as_str), Some("main"));
+        assert!(routing.awaiting_replay.contains_key("t1"));
+    }
+
+    /// An exited Session is still on screen, and a dismiss or a TODO cleared on
+    /// it comes back as `alert:state`: dropped as unowned, the pane would ring
+    /// forever. Only a kill forgets the owner.
+    #[test]
+    fn an_exited_pty_stays_owned_until_it_is_killed() {
+        let windows = super::WindowState::default();
+        windows.mint("t1", "main");
+        windows.exited_pty("t1");
+        {
+            let state = guard(&windows.routing);
+            let registry = super::workspaces::Registry::default();
+            let view = super::RouteView {
+                owners: &state.owners, awaiting_replay: &state.awaiting_replay,
+                dor_targets: &state.dor_targets, registry: &registry, marking: &state.marking,
+            };
+            assert_eq!(
+                super::routing::route("alert:state", &serde_json::json!({"id": "t1"}), &view),
+                super::routing::Route::EmitTo("main")
+            );
+        }
+        windows.forget_pty("t1");
+        assert!(!guard(&windows.routing).owners.contains_key("t1"));
+    }
+
+    /// The window label is the alert viewer id and the owner of the awaits a
+    /// window parks, and a webview cannot name itself: Rust stamps it on both
+    /// opaque passthroughs, over anything the payload claimed.
+    #[test]
+    fn both_webview_passthroughs_stamp_the_invoking_window() {
+        let mut forged = serde_json::json!({ "op": "hello", "window": "main" });
+        super::stamp_window(&mut forged, "ws-2");
+        assert_eq!(forged, serde_json::json!({ "op": "hello", "window": "ws-2" }));
+
+        let src = include_str!("lib.rs").split("#[cfg(test)]").next().unwrap();
+        for command in ["fn alert_command(", "fn burrow_command("] {
+            let body = src.split(command).nth(1).unwrap().split("\n}\n").next().unwrap();
+            assert!(body.contains("stamp_window(&mut payload, window.label());"), "{command} must stamp");
+        }
+    }
+
+    /// Human input is acknowledged by the sidecar before it writes, so the flag
+    /// rides the write itself rather than a second message that could lose the race.
+    #[test]
+    fn user_input_rides_the_write_it_describes() {
+        assert_eq!(
+            super::pty_input_message("t1".into(), "y".into(), None, Some(true)),
+            serde_json::json!({ "event": "pty:input", "data": { "id": "t1", "data": "y", "userInput": true } })
+        );
+        assert_eq!(
+            super::pty_input_message("t1".into(), "\x1b[I".into(), Some(true), None),
+            serde_json::json!({ "event": "pty:input", "data": { "id": "t1", "data": "\x1b[I", "paced": true } })
+        );
     }
 
     #[test]
diff --git a/standalone/src-tauri/src/routing.rs b/standalone/src-tauri/src/routing.rs
index 5fc2c9c54..06e27b283 100644
--- a/standalone/src-tauri/src/routing.rs
+++ b/standalone/src-tauri/src/routing.rs
@@ -43,11 +43,12 @@ pub enum Route<'a> {
     /// Nothing is delivered: the id is mid-transfer and what this carries is
     /// already in the replay the new owner is about to receive (its bytes, or
     /// the semantic events the owner re-derives from them), or no window owns it
-    /// at all and every window would otherwise ring for a pane none of them shows.
+    /// at all and every window would otherwise take state for a pane none of
+    /// them shows.
     Drop,
-    /// Kept for the id's next owner: the id is mid-transfer and this event is
-    /// in no replay and re-derived from none. The caller queues it and delivers
-    /// the queue, in order, right after the replay that lifts the suppression.
+    /// Kept for the id's next owner: the id is mid-transfer. The caller queues
+    /// it and delivers the queue, in order, right after the replay that lifts
+    /// the suppression — or when a fail-open sweep lifts it with no replay.
     Hold,
     /// A `dor` request naming no Surface belongs to whichever window the user
     /// is looking at. Resolved by the caller, which alone holds the focus order.
@@ -90,10 +91,10 @@ fn lookup<'a>(map: &'a HashMap<String, String>, key: &str) -> Route<'a> {
 }
 
 /// Route by PTY ownership. **An id no window owns is dropped, never broadcast**:
-/// ownership is minted for every PTY this app spawns, so an unowned id is one
-/// whose window went away — and a broadcast would ring every other window's
-/// AlertManager for a pane none of them shows. The caller reaps the process
-/// (`Destroyed` in `standalone/src-tauri/src/lib.rs`).
+/// ownership is minted for every PTY this app spawns and held until it is
+/// killed, so an unowned id is one whose window went away — and a broadcast
+/// would hand every other window state for a pane none of them shows. The
+/// caller reaps the process (`Destroyed` in `standalone/src-tauri/src/lib.rs`).
 fn owner<'a>(map: &'a HashMap<String, String>, id: &str) -> Route<'a> {
     match map.get(id) {
         Some(label) => Route::EmitTo(label.as_str()),
@@ -136,8 +137,11 @@ pub fn route<'a>(event: &str, data: &'a JsonValue, view: &RouteView<'a>) -> Rout
             }
             owner(view.owners, id)
         }
-        // A protocol event (a notification, a progress bar) is carried by no
-        // replay, so it outlives its chunk's drop: held for the id's next owner.
+        // The Tool half of a parse (announcements, state, command-start resets;
+        // reports stay with the sidecar's AlertManager): held for the id's next
+        // owner and delivered behind its replay. The replay re-derives the same
+        // events, and applying that ordered run again leaves the state it left;
+        // the hold is what a fail-open sweep, which sends no replay, delivers.
         "terminal:protocolEvents" => {
             let Some(id) = str_field(data, "id") else {
                 return Route::Broadcast;
@@ -230,10 +234,15 @@ pub fn route<'a>(event: &str, data: &'a JsonValue, view: &RouteView<'a>) -> Rout
             Some(surface_id) => lookup(view.owners, surface_id),
             None => Route::Broadcast,
         },
-        // `alert:*` carrying an id is about one Session; the two app-global
-        // stores (settings, watched commands) carry none and reach everyone.
+        // `alert:*` carrying an id is about one Session, and goes where its
+        // output does until the mark: the source still shows it. After the mark
+        // the new owner's collection re-sends it (§Alerts). What carries none —
+        // the two app-global stores, an await's result — reaches everyone.
         _ if event.starts_with("alert:") => match str_field(data, "id") {
-            Some(id) => owner(view.owners, id),
+            Some(id) => match view.marking.get(id) {
+                Some(source) => Route::EmitTo(source.as_str()),
+                None => owner(view.owners, id),
+            },
             None => Route::Broadcast,
         },
         _ => Route::Broadcast,
@@ -712,6 +721,13 @@ mod tests {
             ("pty:list", json!({"ptys":[]}), Route::Broadcast),
             ("alert:state", json!({"id":"a"}), Route::EmitTo("main")),
             ("alert:settings", json!({"speech":true}), Route::Broadcast),
+            // An await's result names the window that asked, never a Session:
+            // every adapter hears it and matches its own `awaitId`.
+            (
+                "alert:awaitResult",
+                json!({"awaitId":"await-1","window":"ws-2","outcome":{"kind":"cancelled","waitedMs":0}}),
+                Route::Broadcast,
+            ),
             (
                 "dor:controlRequest",
                 json!({"requestId":"dor-1","surfaceId":"b"}),
@@ -853,14 +869,15 @@ mod tests {
             Route::EmitTo("main")
         );
         assert_eq!(route("pty:marked", &json!({"id":"a"}), &marking_view), Route::EmitTo("main"));
+        // Its alert state goes with its output: the source is still showing it.
+        assert_eq!(route("alert:state", &json!({"id":"a"}), &marking_view), Route::EmitTo("main"));
         // A chunk's semantic events are re-derived from the replay by whoever
-        // receives it: dropped with the chunk. Its protocol events are in no
-        // replay: held, not dropped.
+        // receives it: dropped with the chunk. Its Tool events are held, which
+        // is all a fail-open sweep has to deliver.
         assert_eq!(
             route("terminal:semanticEvents", &json!({"id":"a"}), &suppressed),
             Route::Drop
         );
-        // Protocol events are rebuilt by no replay path: held, not dropped.
         assert_eq!(
             route("terminal:protocolEvents", &json!({"id":"a"}), &suppressed),
             Route::Hold
diff --git a/standalone/src/browser-sidecar-adapter.test.ts b/standalone/src/browser-sidecar-adapter.test.ts
index e92059e7e..32026dec9 100644
--- a/standalone/src/browser-sidecar-adapter.test.ts
+++ b/standalone/src/browser-sidecar-adapter.test.ts
@@ -14,7 +14,6 @@ vi.mock("@tauri-apps/plugin-shell", () => ({ open: vi.fn(async () => {}) }));
 import { BrowserSidecarAdapter } from "./browser-sidecar-adapter";
 import { BrowserSidecarHost } from "./browser-sidecar-host";
 import { TauriAdapter } from "./tauri-adapter";
-import type { AlertManager } from "dormouse-lib/lib/alert-manager";
 import type { AlertSettings } from "dormouse-lib/lib/alert-settings";
 import { DEFAULT_ALERT_SETTINGS } from "dormouse-lib/lib/alert-settings-model";
 
@@ -117,14 +116,13 @@ describe("BrowserSidecarAdapter terminal stream", () => {
 
     const adapter = new BrowserSidecarAdapter(host);
     await adapter.init();
+    // The page's realm is new on every load: the sidecar hears it at init.
+    expect(send).toHaveBeenCalledWith("alert_command", { payload: { op: "hello" } });
     send.mockClear();
-    // The manager is where a broadcast has to land for the rule to bite; the
-    // handler fan-out alone would pass with a private copy of the store.
-    const manager = (adapter as unknown as { alertManager: AlertManager }).alertManager;
     const alertCommands = () =>
       send.mock.calls.filter(([cmd]) => cmd === "alert_command").map(([, args]) => args);
     return {
-      adapter, send, manager, alertCommands,
+      adapter, send, alertCommands,
       reconnect: () => reconnect(),
       deliver: (event: string, data: unknown) => emit({ event, data }),
     };
@@ -161,52 +159,56 @@ describe("BrowserSidecarAdapter terminal stream", () => {
     expect(send.mock.calls.filter(([cmd]) => cmd === "pty_write")).toEqual([]);
   });
 
-  it("acknowledges user input before writing it", async () => {
-    const { adapter, send, manager } = await listening();
-    manager.notifyFromProtocol("typed", { source: "OSC 9", title: null, body: "needs input" });
-    let atWrite: string | undefined;
-    send.mockImplementation(() => { atWrite = manager.getState("typed").status; });
-
+  it("writes user input with its acknowledgement in one message", async () => {
+    const { adapter, send, alertCommands } = await listening();
     adapter.writePty("typed", "\x1b[I");
-    expect(atWrite).toBe("ALERT_RINGING");
     adapter.writePty("typed", "y", { userInput: true });
-    expect(send).toHaveBeenLastCalledWith("pty_write", { id: "typed", data: "y", paced: undefined });
-    expect(atWrite).toBe("WATCHING_DISABLED");
-    expect(manager.getState("typed").todo).toBe(false);
+    expect(send.mock.calls).toEqual([
+      ["pty_write", { id: "typed", data: "\x1b[I", paced: undefined, userInput: undefined }],
+      ["pty_write", { id: "typed", data: "y", paced: undefined, userInput: true }],
+    ]);
+    expect(alertCommands()).toEqual([]);
   });
 
-  it("routes the alert stores through the sidecar and applies their broadcasts", async () => {
-    const { adapter, manager, alertCommands, deliver } = await listening();
+  it("routes every alert verb through the sidecar and renders what comes back", async () => {
+    const { adapter, alertCommands, deliver } = await listening();
     const quiet: AlertSettings = { ...DEFAULT_ALERT_SETTINGS, speakEnabled: false };
     adapter.alertSetCommandWatched("cargo", true);
     adapter.alertPublishSettings(quiet, { seed: true });
+    adapter.alertDismiss("b1");
     expect(alertCommands()).toEqual([
       { payload: { op: "setCommandWatched", name: "cargo", watched: true } },
       { payload: { op: "initializeSettings", settings: quiet } },
+      { payload: { op: "dismiss", id: "b1" } },
     ]);
 
-    const setWatched = vi.spyOn(manager, "setWatchedCommands");
-    const applySettings = vi.spyOn(manager, "applySettings");
     const names: string[][] = [];
     const settings: AlertSettings[] = [];
+    const states: AlertStateDetail[] = [];
     adapter.onWatchedCommands((next) => void names.push(next));
     adapter.onAlertSettings((next) => void settings.push(next));
+    adapter.onAlertState((next) => void states.push(next));
 
     deliver("alert:watchedCommands", { names: ["cargo", "make"] });
-    expect(setWatched).toHaveBeenCalledWith(["cargo", "make"]);
     expect(names).toEqual([["cargo", "make"]]);
-
-    // Not the default blob, so the assertion still distinguishes "forwarded what
-    // it was handed" from "emitted DEFAULT_ALERT_SETTINGS".
     const canonical: AlertSettings = { ...DEFAULT_ALERT_SETTINGS, deferAlertsUntilQuiet: false };
     deliver("alert:settings", { settings: canonical });
-    expect(applySettings).toHaveBeenCalledWith(canonical);
     expect(settings).toEqual([canonical]);
+    const ringing = { id: "b1", status: "ALERT_RINGING", watchingEnabled: false, todo: true, notification: null, awaited: false };
+    deliver("alert:state", ringing);
+    expect(states).toEqual([ringing]);
+  });
 
-    // A broadcast with no blob is dropped, not applied as "no settings".
-    deliver("alert:settings", {});
-    expect(applySettings).toHaveBeenCalledTimes(1);
-    expect(settings).toEqual([canonical]);
+  it("resolves an await from the broadcast result, and settles it when shut down", async () => {
+    const { adapter, alertCommands, deliver } = await listening();
+    const answered = adapter.alertAwait("b1", { until: "quiet", timeoutMs: 600_000 });
+    const { awaitId } = (alertCommands()[0] as { payload: { awaitId: string } }).payload;
+    deliver("alert:awaitResult", { awaitId, window: "main", outcome: { kind: "resolved", cause: "quiet", waitedMs: 9 } });
+    await expect(answered.promise).resolves.toEqual({ kind: "resolved", cause: "quiet", waitedMs: 9 });
+
+    const parked = adapter.alertAwait("b1", { until: "exit", timeoutMs: 600_000 });
+    adapter.shutdown();
+    await expect(parked.promise).resolves.toMatchObject({ kind: "cancelled" });
   });
 
   // The stream is the only path a store's snapshot takes back, and a dropped
@@ -230,21 +232,18 @@ describe("BrowserSidecarAdapter terminal stream", () => {
     ]);
   });
 
-  // Same contract as TauriAdapter: the replay is all a transferred pane's new
-  // window sees, so it rebuilds the AlertManager's half too.
-  it("rebuilds alert state from a replay, not only pane state", async () => {
-    const { adapter, deliver } = await listening();
+  // Same contract as TauriAdapter: the sidecar's parse already fed its manager,
+  // so a replay rebuilds pane state and nothing of the alerts.
+  it("rebuilds pane state from a replay, and asks nothing of the alerts", async () => {
+    const { adapter, deliver, alertCommands } = await listening();
     const alerts: AlertStateDetail[] = [];
     adapter.onAlertState((detail) => void alerts.push(detail));
-    // The rule set lives in the sidecar here: the seed goes out, its snapshot
-    // comes back, and only then does this manager watch anything.
-    adapter.alertSetWatchedCommands(["sleep"]);
-    deliver("alert:watchedCommands", { names: ["sleep"] });
 
-    deliver("pty:replay", { id: "replay-b", data: "\x1b]633;E;sleep 5\x07\x1b]633;C\x07" });
+    deliver("pty:replay", { id: "replay-b", data: "\x1b]633;E;sleep 5\x07\x1b]633;C\x07\x1b]9;Historical\x07" });
 
     expect(getTerminalPaneState("replay-b").currentCommand?.rawCommandLine).toBe("sleep 5");
-    expect(alerts.some((detail) => detail.id === "replay-b" && detail.watchingEnabled)).toBe(true);
+    expect(alerts).toEqual([]);
+    expect(alertCommands()).toEqual([]);
   });
 
   it("pushes the resolved theme so the sidecar can answer a colour query", async () => {
diff --git a/standalone/src/browser-sidecar-adapter.ts b/standalone/src/browser-sidecar-adapter.ts
index 8bc6bb031..8a0fa5397 100644
--- a/standalone/src/browser-sidecar-adapter.ts
+++ b/standalone/src/browser-sidecar-adapter.ts
@@ -1,5 +1,4 @@
 import { recordToolEvents } from '../../lib/src/lib/tool-events';
-import type { AlertRuntimeSnapshot } from 'dormouse-lib/lib/alert-manager';
 import type { HelperIdentity, TerminalContextRequest, TerminalContextInfo } from '../../lib/src/lib/terminal-context-types';
 import { installWorkspaceRegistry, type WorkspaceRegistrySnapshot } from "./workspace-registry";
 import type {
@@ -10,7 +9,6 @@ import type {
   AgentBrowserPopResult,
   AgentBrowserScreenshotResult,
   AgentBrowserStreamStatusResult,
-  AlertStateDetail,
   IframeProxyResult,
   OpenPort,
   PlatformAdapter,
@@ -38,16 +36,15 @@ import {
   type BurrowResult,
 } from "dormouse-lib/host/remote/service-protocol";
 import { embedderOrigins } from "dormouse-lib/lib/embedder-origins";
-import { AlertManager, LOCAL_VIEWER } from "dormouse-lib/lib/alert-manager";
-import type { AwaitHandle, AwaitOptions, Engagement, EngagementLapse } from "dormouse-lib/lib/alert-manager";
-import type { AlertSettings } from "dormouse-lib/lib/alert-settings";
+import { createSidecarAlertClient } from "dormouse-lib/host/alert-client";
+import type { AlertCommand } from "dormouse-lib/host/alert-protocol";
 import { normalizeExternalUri } from "dormouse-lib/lib/external-links";
 import { createMemoryNotepadArchivePort } from "dormouse-lib/lib/notepad/memory-archive-port";
-import type { PersistedAlertState, PersistedWindow } from "dormouse-lib/lib/session-types";
+import type { PersistedWindow } from "dormouse-lib/lib/session-types";
 import { claimRecoveryCommands, windowStateSlot } from "./window-recovery";
 import { coalesceCwds } from "./coalesce-cwds";
 import {
-  applyTerminalProtocolEvents,
+  collectTerminalSemanticEvents,
   TerminalProtocolParser,
   type TerminalProtocolEvent,
 } from "dormouse-lib/lib/terminal-protocol";
@@ -76,19 +73,9 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
   private listHandlers = new Set<(detail: PtyListDetail) => void>();
   private replayHandlers = new Set<(detail: PtyReplayDetail) => void>();
   private markedHandlers = new Set<(detail: PtyMarkedDetail) => void>();
-  private alertStateHandlers = new Set<(detail: AlertStateDetail) => void>();
-  private watchedCommandHandlers = new Set<(names: string[]) => void>();
-  private alertSettingsHandlers = new Set<(settings: AlertSettings) => void>();
-  private alertManager = new AlertManager();
   private unlistenHost: (() => void) | null = null;
   private unlistenReconnect: (() => void) | null = null;
   private unlistenRegistry: (() => void) | null = null;
-  // The seeds this renderer last offered, keyed by op. The SSE stream is the
-  // only way a store's snapshot reaches this adapter, and a dropped stream
-  // takes the bridge's fan-out entry with it; re-offering the seeds after a
-  // reconnect makes the sidecar republish both stores (a repeat seed is
-  // ignored as a seed but still answered with the canonical snapshot).
-  private readonly alertSeeds = new Map<string, Record<string, unknown>>();
   private onRegistrySnapshot: ((snapshot: WorkspaceRegistrySnapshot) => void) | null = null;
   private static STATE_KEY = 'dormouse.browser-sidecar.session';
   private windowSlot = windowStateSlot(localStorage, BrowserSidecarAdapter.STATE_KEY, 'browser-sidecar');
@@ -102,11 +89,28 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
 
   readonly burrow: BurrowLink = this.burrowClient.link;
 
-  constructor(private readonly host: BrowserSidecarHost) {
-    this.alertManager.onStateChange((id, state) => {
-      for (const handler of this.alertStateHandlers) handler({ id, ...state });
-    });
+  // The sidecar's alerts, through the same client TauriAdapter uses; the dev
+  // host stamps this page's one fixed window label on each command.
+  private readonly alerts = createSidecarAlertClient((payload: AlertCommand) => {
+    this.host.send("alert_command", { payload });
+  });
+  readonly alertRemove = this.alerts.alertRemove;
+  readonly alertSeed = this.alerts.alertSeed;
+  readonly alertSetWatchedCommands = this.alerts.alertSetWatchedCommands;
+  readonly alertSetCommandWatched = this.alerts.alertSetCommandWatched;
+  readonly alertPublishSettings = this.alerts.alertPublishSettings;
+  readonly alertDismiss = this.alerts.alertDismiss;
+  readonly alertEngagement = this.alerts.alertEngagement;
+  readonly alertAcknowledge = this.alerts.alertAcknowledge;
+  readonly alertResize = this.alerts.alertResize;
+  readonly alertToggleTodo = this.alerts.alertToggleTodo;
+  readonly alertClearTodo = this.alerts.alertClearTodo;
+  readonly alertAwait = this.alerts.alertAwait;
+  readonly onAlertState = this.alerts.onAlertState;
+  readonly onWatchedCommands = this.alerts.onWatchedCommands;
+  readonly onAlertSettings = this.alerts.onAlertSettings;
 
+  constructor(private readonly host: BrowserSidecarHost) {
     // See TauriAdapter: the sidecar parses and has no DOM, so it is told the
     // resolved terminal colors whenever they change.
     onTerminalThemeChange(() => this.pushThemeColors());
@@ -129,9 +133,13 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
   async init(): Promise<void> {
     await this.host.init();
     this.unlistenHost = this.host.onEvent(({ event, data }) => this.handleHostEvent(event, data));
-    this.unlistenReconnect = this.host.onReconnect(() => {
-      for (const payload of this.alertSeeds.values()) this.host.send("alert_command", { payload });
-    });
+    // The SSE stream is the only way a store's snapshot reaches this adapter,
+    // and a dropped stream takes the bridge's fan-out entry with it; re-offering
+    // the seeds makes the sidecar republish both stores (a repeat seed is
+    // ignored as a seed but still answered with the canonical snapshot).
+    this.unlistenReconnect = this.host.onReconnect(() => this.alerts.reofferSeeds());
+    // A reload is a new realm under the same label; see TauriAdapter.
+    this.alerts.hello();
     this.installConsoleForwarder();
     this.unlistenRegistry = await installWorkspaceRegistry({
       invoke: (cmd, args) => this.host.invoke(cmd, args),
@@ -150,7 +158,7 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
   }
 
   shutdown(): void {
-    this.alertManager.dispose();
+    this.alerts.dispose();
     this.unlistenHost?.();
     this.unlistenHost = null;
     this.unlistenReconnect?.();
@@ -177,17 +185,15 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
   async terminalContext(request: TerminalContextRequest): Promise<TerminalContextInfo> {
     const result = await this.host.invoke<TerminalContextInfo>('pty_context', { request });
     if (result.error) throw new Error(result.error);
-    if (request.op === 'promote') this.alertManager.setHelper(request.id, !!request.restore);
     return result;
   }
   spawnPty(id: string, options?: { cols?: number; rows?: number; cwd?: string; shell?: string; args?: string[]; helper?: HelperIdentity }): void {
-    if (options?.helper) this.alertManager.setHelper(id, true);
     this.host.send("pty_spawn", { id, options });
   }
 
+  /** See TauriAdapter: `userInput` rides the write itself. */
   writePty(id: string, data: string, options?: WritePtyOptions): void {
-    if (options?.userInput) this.alertManager.acknowledge(id, { input: true });
-    this.host.send("pty_write", { id, data, paced: options?.paced });
+    this.host.send("pty_write", { id, data, paced: options?.paced, userInput: options?.userInput });
   }
 
   resizePty(id: string, cols: number, rows: number): void {
@@ -227,10 +233,6 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
   // a reload does exercise is the claim above, against whatever the app's own
   // quit last wrote (docs/specs/standalone.md -> "Agent recovery").
 
-  alertSeed(id: string, state: PersistedAlertState): void {
-    this.alertManager.seed(id, state);
-  }
-
   async getOpenPorts(id: string): Promise<OpenPort[]> {
     try { return await this.host.invoke("pty_get_open_ports", { id }); } catch { return []; }
   }
@@ -355,40 +357,6 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
   offRequestSessionFlush(_handler: (detail: { requestId: string }) => void): void {}
   notifySessionFlushComplete(_requestId: string): void {}
 
-  alertPauseForTransfer(id: string): AlertRuntimeSnapshot | null { return this.alertManager.pauseForTransfer(id); }
-  alertResumeFromTransfer(id: string, snapshot: AlertRuntimeSnapshot, replayRequestId?: string): void {
-    this.alertManager.resumeFromTransfer(id, snapshot, replayRequestId);
-  }
-
-  alertRemove(id: string): void { this.alertManager.remove(id); }
-  // Through the sidecar's app-global stores and back as their broadcasts, the
-  // path the shipped app takes (see TauriAdapter), so the harness exercises
-  // the seed-once and delta rules rather than a private copy of the state.
-  alertSetWatchedCommands(names: string[]): void {
-    this.sendAlertSeed({ op: "initializeWatchedCommands", names });
-  }
-  alertSetCommandWatched(name: string, watched: boolean): void {
-    this.host.send("alert_command", { payload: { op: "setCommandWatched", name, watched } });
-  }
-  alertPublishSettings(settings: AlertSettings, opts: { seed: boolean }): void {
-    if (opts.seed) this.sendAlertSeed({ op: "initializeSettings", settings });
-    else this.host.send("alert_command", { payload: { op: "updateSettings", settings } });
-  }
-  private sendAlertSeed(payload: { op: string } & Record<string, unknown>): void {
-    this.alertSeeds.set(payload.op, payload);
-    this.host.send("alert_command", { payload });
-  }
-  alertDismiss(id: string): void { this.alertManager.dismissAlert(id); }
-  alertEngagement(state: Engagement, lapse?: EngagementLapse): void { this.alertManager.setViewer(LOCAL_VIEWER, state, lapse); }
-  alertAcknowledge(id: string): void { this.alertManager.acknowledge(id, { input: false }); }
-  alertResize(id: string): void { this.alertManager.onResize(id); }
-  alertToggleTodo(id: string): void { this.alertManager.toggleTodo(id); }
-  alertClearTodo(id: string): void { this.alertManager.clearTodo(id); }
-  alertAwait(id: string, options: AwaitOptions): AwaitHandle { return this.alertManager.awaitCompletion(id, options); }
-  onAlertState(handler: (detail: AlertStateDetail) => void): void { this.alertStateHandlers.add(handler); }
-  onWatchedCommands(handler: (names: string[]) => void): void { this.watchedCommandHandlers.add(handler); }
-  onAlertSettings(handler: (settings: AlertSettings) => void): void { this.alertSettingsHandlers.add(handler); }
-
   // See TauriAdapter: no bare-Session slot on this host. The harness mirrors the
   // shipped persistence answer, so a reload here exercises what the app does
   // (docs/specs/transport.md -> "The governing rule").
@@ -421,38 +389,22 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
       this.onRegistrySnapshot?.(data as WorkspaceRegistrySnapshot);
       return;
     }
-    if (event === "alert:watchedCommands") {
-      const names = (data as { names?: string[] } | undefined)?.names ?? [];
-      this.alertManager.setWatchedCommands(names);
-      for (const handler of this.watchedCommandHandlers) handler(names);
-      return;
-    }
-    if (event === "alert:settings") {
-      const settings = (data as { settings?: AlertSettings } | undefined)?.settings;
-      if (!settings) return;
-      this.alertManager.applySettings(settings);
-      for (const handler of this.alertSettingsHandlers) handler(settings);
-      return;
-    }
+    if (this.alerts.onEvent(event, data)) return;
     if (event === "pty:data") {
       // Already parsed by the sidecar, which owns the PTY; its events arrive as
       // the two messages below (docs/specs/terminal-escapes.md).
       const payload = data as PtyDataDetail;
-      this.alertManager.onData(payload.id);
       for (const handler of this.dataHandlers) handler(payload);
     } else if (event === "terminal:protocolEvents") {
       const payload = data as { id: string; events: TerminalProtocolEvent[] };
-      applyTerminalProtocolEvents(this.alertManager, payload.id, payload.events);
+      recordToolEvents(payload.id, payload.events);
     } else if (event === "terminal:semanticEvents") {
       const { id, events } = data as { id: string; events: TerminalSemanticEvent[] };
-      this.alertManager.applyTerminalSemanticEvents(id, events);
       applyTerminalSemanticEvents(id, events);
     } else if (event === "pty:exit") {
       const payload = data as { id: string; exitCode: number };
-      this.alertManager.onExit(payload.id, payload.exitCode);
       for (const handler of this.exitHandlers) handler(payload);
     } else if (event === "pty:list") {
-      for (const pty of (data as PtyListDetail).ptys) if (pty.helper) this.alertManager.setHelper(pty.id, true);
       for (const handler of this.listHandlers) handler(data as PtyListDetail);
     } else if (event === "pty:marked") {
       for (const handler of this.markedHandlers) handler(data as PtyMarkedDetail);
@@ -462,7 +414,7 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
       const { id, data: text, requestId } = data as PtyReplayDetail;
       const parsed = new TerminalProtocolParser(themeColorProvider).process(text);
       recordToolEvents(id, parsed.events);
-      applyTerminalSemanticEvents(id, this.alertManager.applyReplay(id, requestId, parsed));
+      applyTerminalSemanticEvents(id, collectTerminalSemanticEvents(parsed.events));
       for (const handler of this.replayHandlers) handler({ id, data: parsed.visibleData, requestId });
     } else if (event === BURROW_RESULT_EVENT) {
       this.burrowClient.onResult(data as BurrowResult);
diff --git a/standalone/src/tauri-adapter.test.ts b/standalone/src/tauri-adapter.test.ts
index 7f99d510a..517c722a0 100644
--- a/standalone/src/tauri-adapter.test.ts
+++ b/standalone/src/tauri-adapter.test.ts
@@ -444,8 +444,8 @@ describe("TauriAdapter terminal stream", () => {
     expect(invoke.mock.calls.filter(([cmd]) => cmd === "pty_write")).toEqual([]);
   });
 
-  it("applies the semantic and alert events the sidecar derived", async () => {
-    const { adapter, deliver } = await listening();
+  it("applies the semantic and Tool events the sidecar derived, and no report", async () => {
+    const { adapter, deliver, invoke } = await listening();
     const alerts: AlertStateDetail[] = [];
     adapter.onAlertState((detail) => void alerts.push(detail));
 
@@ -464,6 +464,7 @@ describe("TauriAdapter terminal stream", () => {
         },
       ],
     });
+    // A report reaching this window is inert: the sidecar's manager judged it.
     deliver("terminal:protocolEvents", {
       id: "sem-pty",
       events: [
@@ -472,79 +473,54 @@ describe("TauriAdapter terminal stream", () => {
     });
 
     expect(getTerminalPaneState("sem-pty").cwd?.path).toBe("/tmp/here");
-    expect(alerts.some((detail) => detail.id === "sem-pty")).toBe(true);
+    expect(alerts).toEqual([]);
+    expect(invoke).not.toHaveBeenCalled();
   });
 
-  // A transferred pane's new window sees nothing but the replay: Rust drops the
-  // gap's semantic events because this path re-derives them, so it must rebuild
-  // both halves — pane state and the AlertManager's watch.
-  it("acknowledges user input with its echo window before writing it", async () => {
-    const { adapter, deliver, invoke } = await listening();
+  it("renders the alert state the sidecar routes to this window", async () => {
+    const { adapter, deliver } = await listening();
     const alerts: AlertStateDetail[] = [];
     adapter.onAlertState((detail) => void alerts.push(detail));
-    const ring = { kind: "notification", notification: { source: "OSC 9", title: null, body: "needs input" } };
-    deliver("terminal:protocolEvents", { id: "typed-pty", events: [ring] });
-    expect(alerts[alerts.length - 1]).toMatchObject({ status: "ALERT_RINGING", todo: true });
+    const ringing = { id: "ring-pty", status: "ALERT_RINGING", watchingEnabled: false, todo: true, notification: null, awaited: false, episode: { id: "e1", startedAt: 1 } };
+    deliver("alert:state", ringing);
+    expect(alerts).toEqual([ringing]);
+  });
 
-    // A write that is not user input leaves the ring alone.
+  // The sidecar acknowledges it and opens the echo window before it writes, so
+  // the flag must ride the write itself — a separate command could lose the race.
+  it("writes user input with its acknowledgement in one message", async () => {
+    const { adapter, invoke } = await listening();
     adapter.writePty("typed-pty", "\x1b[I");
-    expect(alerts[alerts.length - 1]?.status).toBe("ALERT_RINGING");
-
-    let atWrite: AlertStateDetail | undefined;
-    invoke.mockImplementation(async () => { atWrite = alerts[alerts.length - 1]; });
     adapter.writePty("typed-pty", "y", { userInput: true });
-    expect(invoke).toHaveBeenLastCalledWith("pty_write", { id: "typed-pty", data: "y", paced: undefined });
-    expect(atWrite).toMatchObject({ status: "WATCHING_DISABLED", todo: false });
-    // The echo window is open: a bell answering the key rings no one.
-    deliver("terminal:protocolEvents", { id: "typed-pty", events: [ring] });
-    expect(alerts[alerts.length - 1]?.status).not.toBe("ALERT_RINGING");
+    expect(invoke.mock.calls).toEqual([
+      ["pty_write", { id: "typed-pty", data: "\x1b[I", paced: undefined, userInput: undefined }],
+      ["pty_write", { id: "typed-pty", data: "y", paced: undefined, userInput: true }],
+    ]);
   });
 
-  it("rebuilds alert state from a replay, not only pane state", async () => {
-    const { adapter, deliver } = await listening();
+  it("rebuilds pane state from a replay, and asks nothing of the alerts", async () => {
+    const { adapter, deliver, invoke } = await listening();
     const alerts: AlertStateDetail[] = [];
     adapter.onAlertState((detail) => void alerts.push(detail));
-    // The rule set is the sidecar's; this window hears it as a broadcast.
-    deliver("alert:watchedCommands", { names: ["sleep"] });
 
     deliver("pty:replay", {
       id: "replay-pty",
-      data: "\x1b]633;E;sleep 5\x07\x1b]633;C\x07",
+      data: "\x1b]633;E;sleep 5\x07\x1b]633;C\x07\x1b]9;Historical\x07",
     });
 
     expect(getTerminalPaneState("replay-pty").currentCommand?.rawCommandLine).toBe("sleep 5");
-    expect(alerts.some((detail) => detail.id === "replay-pty" && detail.watchingEnabled)).toBe(true);
+    expect(alerts).toEqual([]);
+    expect(invoke).not.toHaveBeenCalled();
   });
 
-  it("applies notification side effects only to the marked live handoff replay", async () => {
-    const { adapter, deliver } = await listening();
-    const alerts: AlertStateDetail[] = [];
-    adapter.onAlertState((detail) => void alerts.push(detail));
-    adapter.alertSeed('marked-alert', { status: 'WATCHING_DISABLED', todo: false, notification: null });
-    const runtime = adapter.alertPauseForTransfer('marked-alert')!;
-    adapter.alertResumeFromTransfer('marked-alert', runtime, 'init-live');
-    // A historical replay racing the since-mark one carries another token: inert, and it does not consume the permission.
-    deliver('pty:replay', { id: 'marked-alert', data: '\x1b]9;Historical replay\x07', requestId: 'init-boot' });
-    expect(alerts[alerts.length - 1]?.status).not.toBe('ALERT_RINGING');
-    deliver('pty:replay', { id: 'marked-alert', data: '\x1b]9;Finished in transit\x07', requestId: 'init-live' });
-    expect(alerts[alerts.length - 1]?.status).toBe('ALERT_RINGING');
-    adapter.alertDismiss('marked-alert');
-    deliver('pty:replay', { id: 'marked-alert', data: '\x1b]9;Later replay\x07', requestId: 'init-live' });
-    expect(alerts[alerts.length - 1]?.status).not.toBe('ALERT_RINGING');
-  });
-
-  it("settles the replayed watch when a marked buffer belongs to an exited PTY", async () => {
-    const { adapter, deliver } = await listening();
-    const alerts: AlertStateDetail[] = [];
-    adapter.onAlertState((detail) => void alerts.push(detail));
-    deliver("alert:watchedCommands", { names: ["sleep"] });
+  it("settles the replayed command when a marked buffer belongs to an exited PTY", async () => {
+    const { deliver } = await listening();
     deliver("pty:list", { ptys: [{ id: "exited-replay", alive: false, exitCode: 7 }], requestId: "handback-1" });
     deliver("pty:replay", {
       id: "exited-replay", requestId: "handback-1",
       data: "\x1b]633;E;sleep 5\x07\x1b]633;C\x07",
     });
     expect(getTerminalPaneState("exited-replay").currentCommand).toBeNull();
-    expect(alerts[alerts.length - 1]?.watchingEnabled).toBe(false);
   });
 
   it("pushes the resolved theme so the sidecar can answer a colour query", async () => {
@@ -562,3 +538,80 @@ describe("TauriAdapter terminal stream", () => {
     });
   });
 });
+
+// The app's one AlertManager is the sidecar's (docs/specs/standalone.md →
+// "Alerts"); this window is a viewer of it. The command shapes and the await
+// wiring are the shared client's (lib/src/host/alert-client.test.ts); covered
+// here is this transport: one `alert_command` invoke, and the events back.
+describe("TauriAdapter alerts", () => {
+  async function wired() {
+    const handlers = new Map<string, (event: { payload: unknown }) => void>();
+    const order: string[] = [];
+    vi.mocked(listen).mockImplementation((async (
+      event: string,
+      handler: (e: { payload: unknown }) => void,
+    ) => {
+      order.push(`listen ${event}`);
+      handlers.set(event, handler);
+      return () => {};
+    }) as unknown as typeof listen);
+    const invoke = vi.mocked(rawInvoke);
+    invoke.mockClear();
+    invoke.mockImplementation((async (cmd: string, args?: { payload?: { op?: string } }) => {
+      if (cmd === "alert_command") order.push(`alert ${args?.payload?.op}`);
+      return undefined;
+    }) as unknown as typeof rawInvoke);
+
+    const adapter = new TauriAdapter();
+    await adapter.init();
+    const commands = () =>
+      invoke.mock.calls.filter(([cmd]) => cmd === "alert_command").map(([, args]) => (args as { payload: unknown }).payload);
+    const deliver = (event: string, payload: unknown) => void handlers.get(event)?.({ payload });
+    return { adapter, commands, deliver, order };
+  }
+
+  // A reload keeps the window label, so only this tells the sidecar the old
+  // realm's engagement and parked awaits are gone — and only once this realm
+  // can hear the answers.
+  it("says hello once its listeners are installed", async () => {
+    const { commands, order } = await wired();
+    expect(commands()).toEqual([{ op: "hello" }]);
+    const hello = order.indexOf("alert hello");
+    for (const event of ["alert:state", "alert:awaitResult"]) {
+      expect(order.indexOf(`listen ${event}`)).toBeGreaterThanOrEqual(0);
+      expect(order.indexOf(`listen ${event}`)).toBeLessThan(hello);
+    }
+  });
+
+  it("sends its alert verbs as commands and resolves an await from the broadcast result", async () => {
+    const { adapter, commands, deliver } = await wired();
+    adapter.alertEngagement({ present: true, focusId: "p" });
+    adapter.alertSeed!("p", { status: "WATCHING_DISABLED", todo: true, notification: null });
+    const handle = adapter.alertAwait("p", { until: "exit", timeoutMs: 600_000 });
+    const sent = commands();
+    const parked = sent[sent.length - 1] as { op: string; awaitId: string };
+    expect(commands()).toEqual([
+      { op: "hello" },
+      { op: "engagement", state: { present: true, focusId: "p" } },
+      { op: "seed", id: "p", state: { status: "WATCHING_DISABLED", todo: true, notification: null } },
+      { op: "await", awaitId: parked.awaitId, id: "p", until: "exit", timeoutMs: 600_000 },
+    ]);
+    deliver("alert:awaitResult", { awaitId: parked.awaitId, window: "main", outcome: { kind: "resolved", cause: "exit", waitedMs: 4 } });
+    await expect(handle.promise).resolves.toEqual({ kind: "resolved", cause: "exit", waitedMs: 4 });
+  });
+
+  it("settles what it parked when it shuts down", async () => {
+    const { adapter } = await wired();
+    const handle = adapter.alertAwait("p", { until: "quiet", timeoutMs: 600_000 });
+    adapter.shutdown();
+    await expect(handle.promise).resolves.toMatchObject({ kind: "cancelled" });
+  });
+
+  it("hands the stores' broadcasts to the renderer mirrors", async () => {
+    const { adapter, deliver } = await wired();
+    const names: string[][] = [];
+    adapter.onWatchedCommands((next) => void names.push(next));
+    deliver("alert:watchedCommands", { names: ["cargo"] });
+    expect(names).toEqual([["cargo"]]);
+  });
+});
diff --git a/standalone/src/tauri-adapter.ts b/standalone/src/tauri-adapter.ts
index 0a11c9603..c95e1e26a 100644
--- a/standalone/src/tauri-adapter.ts
+++ b/standalone/src/tauri-adapter.ts
@@ -1,5 +1,4 @@
 import { recordToolEvents } from '../../lib/src/lib/tool-events';
-import type { AlertRuntimeSnapshot } from 'dormouse-lib/lib/alert-manager';
 import type { HelperIdentity, TerminalContextRequest, TerminalContextInfo } from '../../lib/src/lib/terminal-context-types';
 import { invoke as rawInvoke } from "@tauri-apps/api/core";
 import { open } from "@tauri-apps/plugin-shell";
@@ -12,7 +11,6 @@ import type {
   AgentBrowserPopResult,
   AgentBrowserScreenshotResult,
   AgentBrowserStreamStatusResult,
-  AlertStateDetail,
   IframeProxyResult,
   OpenPort,
   PlatformAdapter,
@@ -47,18 +45,17 @@ import {
   type BurrowResult,
 } from "dormouse-lib/host/remote/service-protocol";
 import { embedderOrigins } from "dormouse-lib/lib/embedder-origins";
-import { AlertManager, LOCAL_VIEWER } from "dormouse-lib/lib/alert-manager";
-import type { AwaitHandle, AwaitOptions, Engagement, EngagementLapse } from "dormouse-lib/lib/alert-manager";
-import type { AlertSettings } from "dormouse-lib/lib/alert-settings";
+import { createSidecarAlertClient } from "dormouse-lib/host/alert-client";
+import type { AlertCommand } from "dormouse-lib/host/alert-protocol";
 import { normalizeExternalUri } from "dormouse-lib/lib/external-links";
-import type { PersistedAlertState, PersistedWindow } from "dormouse-lib/lib/session-types";
+import type { PersistedWindow } from "dormouse-lib/lib/session-types";
 import { TauriSessionStore } from "./tauri-session-store";
 import { claimRecoveryCommands, windowStateSlot } from "./window-recovery";
 import { listenToWindow } from "./window-label";
 import { installWorkspaceRegistry, type WorkspaceRegistrySnapshot } from "./workspace-registry";
 import { withTimeout } from "./with-timeout";
 import {
-  applyTerminalProtocolEvents,
+  collectTerminalSemanticEvents,
   TerminalProtocolParser,
   type TerminalProtocolEvent,
 } from "dormouse-lib/lib/terminal-protocol";
@@ -101,13 +98,7 @@ export class TauriAdapter implements PlatformAdapter {
   private replayHandlers = new Set<(detail: PtyReplayDetail) => void>();
   private markedHandlers = new Set<(detail: PtyMarkedDetail) => void>();
   private filesDroppedHandlers = new Set<(paths: string[]) => void>();
-  private alertStateHandlers = new Set<(detail: AlertStateDetail) => void>();
-  // The two app-global stores are the sidecar's, so this window applies what
-  // comes back rather than what it sent (docs/specs/alert.md → "Alarm settings").
-  private watchedCommandHandlers = new Set<(names: string[]) => void>();
-  private alertSettingsHandlers = new Set<(settings: AlertSettings) => void>();
   private unlistenFns: Array<() => void> = [];
-  private alertManager = new AlertManager();
   private static STATE_KEY = 'dormouse.session';
   private sessionStore = new TauriSessionStore();
   private windowSlot = windowStateSlot(this.sessionStore, TauriAdapter.STATE_KEY, 'tauri-adapter');
@@ -134,13 +125,31 @@ export class TauriAdapter implements PlatformAdapter {
 
   readonly burrow: BurrowLink = this.burrowClient.link;
 
-  constructor() {
-    this.alertManager.onStateChange((id, state) => {
-      for (const handler of this.alertStateHandlers) {
-        handler({ id, ...state });
-      }
-    });
+  // --- Alerts (docs/specs/standalone.md → "Alerts") ---
+  //
+  // The app's one AlertManager is the sidecar's; this window is one of its
+  // viewers. Every `alert*` method is one `alert_command`, which Rust stamps
+  // with this window's label, and the answers come back as sidecar events.
+  private readonly alerts = createSidecarAlertClient((payload: AlertCommand) => {
+    invoke("alert_command", { payload });
+  });
+  readonly alertRemove = this.alerts.alertRemove;
+  readonly alertSeed = this.alerts.alertSeed;
+  readonly alertSetWatchedCommands = this.alerts.alertSetWatchedCommands;
+  readonly alertSetCommandWatched = this.alerts.alertSetCommandWatched;
+  readonly alertPublishSettings = this.alerts.alertPublishSettings;
+  readonly alertDismiss = this.alerts.alertDismiss;
+  readonly alertEngagement = this.alerts.alertEngagement;
+  readonly alertAcknowledge = this.alerts.alertAcknowledge;
+  readonly alertResize = this.alerts.alertResize;
+  readonly alertToggleTodo = this.alerts.alertToggleTodo;
+  readonly alertClearTodo = this.alerts.alertClearTodo;
+  readonly alertAwait = this.alerts.alertAwait;
+  readonly onAlertState = this.alerts.onAlertState;
+  readonly onWatchedCommands = this.alerts.onWatchedCommands;
+  readonly onAlertSettings = this.alerts.onAlertSettings;
 
+  constructor() {
     // The sidecar parses, and it has no DOM to read the theme from, so push the
     // resolved colors up whenever they change (the initial push is in
     // requestInit) — mirroring VSCodeAdapter.pushThemeColors.
@@ -159,25 +168,22 @@ export class TauriAdapter implements PlatformAdapter {
       // (docs/specs/terminal-escapes.md → "Parsing location").
       listenToWindow<PtyDataDetail>("pty:data", (event) => {
         const { id, data, textData } = event.payload;
-        // Feed visible data to alert manager for visual activity monitoring.
-        this.alertManager.onData(id);
         for (const handler of this.dataHandlers) {
           handler({ id, data, textData });
         }
       }),
 
+      // The Tool half of the sidecar's parse; its reports stayed with the
+      // sidecar's AlertManager.
       listenToWindow<{ id: string; events: TerminalProtocolEvent[] }>("terminal:protocolEvents", (event) => {
-        applyTerminalProtocolEvents(this.alertManager, event.payload.id, event.payload.events);
+        recordToolEvents(event.payload.id, event.payload.events);
       }),
 
       listenToWindow<{ id: string; events: TerminalSemanticEvent[] }>("terminal:semanticEvents", (event) => {
-        const { id, events } = event.payload;
-        this.alertManager.applyTerminalSemanticEvents(id, events);
-        applyTerminalSemanticEvents(id, events);
+        applyTerminalSemanticEvents(event.payload.id, event.payload.events);
       }),
 
       listenToWindow<{ id: string; exitCode: number }>("pty:exit", (event) => {
-        this.alertManager.onExit(event.payload.id, event.payload.exitCode);
         for (const handler of this.exitHandlers) {
           handler(event.payload);
         }
@@ -189,7 +195,6 @@ export class TauriAdapter implements PlatformAdapter {
           if (!pty.alive) replayExits.set(key, pty.exitCode ?? -1);
           else replayExits.delete(key);
         }
-        for (const pty of event.payload.ptys) if (pty.helper) this.alertManager.setHelper(pty.id, true);
         for (const handler of this.listHandlers) {
           handler(event.payload);
         }
@@ -197,27 +202,27 @@ export class TauriAdapter implements PlatformAdapter {
 
       listenToWindow<{ id: string; data: string; requestId?: string }>("pty:replay", (event) => {
         // Replay arrives as raw buffered output, the one stream the sidecar does
-        // not parse. A one-shot parser here repopulates semantic state and
-        // strips OSCs before xterm sees them; its responses are dropped, since
-        // the asker is long gone (docs/specs/terminal-escapes.md). It still
-        // needs the theme: a *declined* colour query is not consumed, so it
-        // reaches xterm.js instead, and answering is the owner's alone.
-        // Both consumers of the live `terminal:semanticEvents` path, because a
-        // replay is the whole of what a transferred pane's new window has: Rust
-        // drops the gap's semantic events rather than holding them
-        // (docs/specs/standalone.md → "Routing").
+        // not parse for this window. A one-shot parser here repopulates the
+        // renderer's semantic and Tool state and strips OSCs before xterm sees
+        // them; its reports and responses are dropped — the sidecar's own parse
+        // already fed its AlertManager, and the asker is long gone
+        // (docs/specs/terminal-escapes.md). It still needs the theme: a
+        // *declined* colour query is not consumed, so it reaches xterm.js
+        // instead, and answering is the owner's alone. A replay is the whole of
+        // what a transferred pane's new window has: Rust drops the gap's
+        // semantic events rather than holding them (docs/specs/standalone.md →
+        // "Routing").
         const { id, data, requestId } = event.payload;
         const parsed = new TerminalProtocolParser(themeColorProvider).process(data);
         recordToolEvents(id, parsed.events);
-        applyTerminalSemanticEvents(id, this.alertManager.applyReplay(id, requestId, parsed));
+        applyTerminalSemanticEvents(id, collectTerminalSemanticEvents(parsed.events));
         // A listed exited buffer can contain a command-start with no finish.
-        // Apply its exit after rebuilding the replay's watch, for either target
-        // adoption or source hand-back.
+        // Apply its exit after rebuilding the replay's command state, for
+        // either target adoption or source hand-back.
         const key = replayKey(id, requestId);
         const exitCode = replayExits.get(key);
         if (exitCode !== undefined) {
           replayExits.delete(key);
-          this.alertManager.onExit(id, exitCode);
           applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode }]);
         }
         for (const handler of this.replayHandlers) {
@@ -271,21 +276,15 @@ export class TauriAdapter implements PlatformAdapter {
         cancelDorControlRequest(event.payload.requestId);
       }),
 
-      // The sidecar's canonical snapshots, broadcast to every window. This
-      // window's own `AlertManager` is one more consumer of them.
-      listenToWindow<{ names?: string[] }>("alert:watchedCommands", (event) => {
-        const names = event.payload?.names ?? [];
-        this.alertManager.setWatchedCommands(names);
-        for (const handler of this.watchedCommandHandlers) handler(names);
-      }),
-
-      listenToWindow<{ settings?: AlertSettings }>("alert:settings", (event) => {
-        const settings = event.payload?.settings;
-        if (!settings) return;
-        this.alertManager.applySettings(settings);
-        for (const handler of this.alertSettingsHandlers) handler(settings);
-      }),
+      // The sidecar's alerts: this window's Sessions' state, routed here by
+      // ownership, and the two stores' canonical snapshots and every await's
+      // result, broadcast to every window.
+      ...["alert:state", "alert:awaitResult", "alert:watchedCommands", "alert:settings"].map((name) =>
+        listenToWindow<unknown>(name, (event) => void this.alerts.onEvent(name, event.payload))),
     ])));
+    // This realm is new, whether the window just opened or reloaded: the
+    // engagement and awaits of the one before it are gone (same label).
+    this.alerts.hello();
 
     await this.hydrateSessionStore();
     // Before restore too: a fresh Window mints its first Workspace id from
@@ -321,7 +320,7 @@ export class TauriAdapter implements PlatformAdapter {
   }
 
   shutdown(): void {
-    this.alertManager.dispose();
+    this.alerts.dispose();
     for (const unlisten of this.unlistenFns) {
       unlisten();
     }
@@ -340,18 +339,17 @@ export class TauriAdapter implements PlatformAdapter {
   async terminalContext(request: TerminalContextRequest): Promise<TerminalContextInfo> {
     const result = await rawInvoke<TerminalContextInfo>('pty_context', { request });
     if (result.error) throw new Error(result.error);
-    if (request.op === 'promote') this.alertManager.setHelper(request.id, !!request.restore);
     return result;
   }
 
   spawnPty(id: string, options?: { cols?: number; rows?: number; cwd?: string; shell?: string; args?: string[]; helper?: HelperIdentity }): void {
-    if (options?.helper) this.alertManager.setHelper(id, true);
     invoke("pty_spawn", { id, options });
   }
 
+  /** `userInput` rides the write itself: the sidecar acknowledges it and opens
+   *  the echo window before writing (docs/specs/alert.md → Engagement). */
   writePty(id: string, data: string, options?: WritePtyOptions): void {
-    if (options?.userInput) this.alertManager.acknowledge(id, { input: true });
-    invoke("pty_write", { id, data, paced: options?.paced });
+    invoke("pty_write", { id, data, paced: options?.paced, userInput: options?.userInput });
   }
 
   resizePty(id: string, cols: number, rows: number): void {
@@ -371,12 +369,6 @@ export class TauriAdapter implements PlatformAdapter {
     return this.recoveryCommands;
   }
 
-  /** Seed a cold-restored Surface's persisted TODO/alert; the manager lives here,
-   *  so the restore path is the only thing that can. */
-  alertSeed(id: string, state: PersistedAlertState): void {
-    this.alertManager.seed(id, state);
-  }
-
   /**
    * Interrupt the live PTYs so each agent prints its resume invocation, and let
    * the sidecar record what it detects. Warn-and-proceed: a quit must never wedge
@@ -709,77 +701,6 @@ export class TauriAdapter implements PlatformAdapter {
     );
   }
 
-  // --- Alert management (local AlertManager) ---
-
-  alertPauseForTransfer(id: string): AlertRuntimeSnapshot | null { return this.alertManager.pauseForTransfer(id); }
-  alertResumeFromTransfer(id: string, snapshot: AlertRuntimeSnapshot, replayRequestId?: string): void {
-    this.alertManager.resumeFromTransfer(id, snapshot, replayRequestId);
-  }
-
-  alertRemove(id: string): void {
-    this.alertManager.remove(id);
-  }
-
-  /** Offer this window's persisted rule set as the host's startup seed; only
-   *  the first window's offer is taken. */
-  alertSetWatchedCommands(names: string[]): void {
-    invoke("alert_command", { payload: { op: "initializeWatchedCommands", names } });
-  }
-
-  /** A delta, never a replacement, so a window that has not heard about a rule
-   *  cannot drop it. */
-  alertSetCommandWatched(name: string, watched: boolean): void {
-    invoke("alert_command", { payload: { op: "setCommandWatched", name, watched } });
-  }
-
-  alertPublishSettings(settings: AlertSettings, opts: { seed: boolean }): void {
-    invoke("alert_command", {
-      payload: { op: opts.seed ? "initializeSettings" : "updateSettings", settings },
-    });
-  }
-
-  alertDismiss(id: string): void {
-    this.alertManager.dismissAlert(id);
-  }
-
-  // This window's webview is the manager's one viewer until the manager moves
-  // to the sidecar (docs/specs/alert.md -> Engagement).
-  alertEngagement(state: Engagement, lapse?: EngagementLapse): void {
-    this.alertManager.setViewer(LOCAL_VIEWER, state, lapse);
-  }
-
-  alertAcknowledge(id: string): void {
-    this.alertManager.acknowledge(id, { input: false });
-  }
-
-  alertResize(id: string): void {
-    this.alertManager.onResize(id);
-  }
-
-  alertToggleTodo(id: string): void {
-    this.alertManager.toggleTodo(id);
-  }
-
-  alertClearTodo(id: string): void {
-    this.alertManager.clearTodo(id);
-  }
-
-  alertAwait(id: string, options: AwaitOptions): AwaitHandle {
-    return this.alertManager.awaitCompletion(id, options);
-  }
-
-  onAlertState(handler: (detail: AlertStateDetail) => void): void {
-    this.alertStateHandlers.add(handler);
-  }
-
-  onWatchedCommands(handler: (names: string[]) => void): void {
-    this.watchedCommandHandlers.add(handler);
-  }
-
-  onAlertSettings(handler: (settings: AlertSettings) => void): void {
-    this.alertSettingsHandlers.add(handler);
-  }
-
   // --- State persistence ---
 
   // No bare-Session slot on this host: the stored blob is a Window, and
diff --git a/standalone/src/workspace-move.test.ts b/standalone/src/workspace-move.test.ts
index 99bdd03fd..90cc43751 100644
--- a/standalone/src/workspace-move.test.ts
+++ b/standalone/src/workspace-move.test.ts
@@ -88,7 +88,7 @@ import { getTerminalInstance } from "dormouse-lib/lib/terminal-registry";
 import { setPlatform } from "dormouse-lib/lib/platform";
 import { disposeAllSessions, getOrCreateTerminal } from "dormouse-lib/lib/terminal-registry";
 import { FakePtyAdapter } from "dormouse-lib/lib/platform/fake-adapter";
-import { AlertManager } from "dormouse-lib/lib/alert-manager";
+import { createAlertEpisode } from "dormouse-lib/lib/alert-episode";
 import { getAlertDeliveryReceipts, isAlertDeliveryPaused } from "dormouse-lib/lib/alert-delivery-state";
 import { watchUnattendedRings } from "dormouse-lib/lib/alert-ring-watch";
 import { clearTerminalActivity, getActivitySnapshot, setTerminalActivity } from "dormouse-lib/lib/session-activity-store";
@@ -177,8 +177,8 @@ function fakePlatform(
   vi.spyOn(platform, "requestInit").mockImplementation(() => {
     throw new Error("an arrival must never ask for the whole Window");
   });
-  // The fake adapter has no AlertManager, so give it the optional hook the
-  // arrival seeds a persisted TODO through.
+  // The optional seed hook standalone has, so a test can show an arrival
+  // never reaches for it.
   (platform as unknown as { alertSeed: unknown }).alertSeed = vi.fn();
   mocks.invoke.mockImplementation(async (cmd: string, args?: unknown) => {
     order.push(cmd);
@@ -643,16 +643,20 @@ describe("the target half", () => {
     expect(getNotes("pane-a").map((note) => note.content)).toEqual([{ kind: "plain", text: "keep me" }]);
   });
 
-  it("seeds the persisted alert before asking for the replay that rebuilds WATCHING", async () => {
-    const order: string[] = [];
-    const platform = fakePlatform(order);
-    vi.mocked(platform.alertSeed!).mockImplementation(() => { order.push("seed"); });
+  // The Sessions' alert state never left the sidecar's one manager, which
+  // re-sends it to whichever window collects them: an arrival that seeded or
+  // removed it would overwrite a live ring or TODO (docs/specs/alert.md →
+  // Live Workspace transfer).
+  it("never seeds or removes the host's alert state for an arrival", async () => {
+    const platform = fakePlatform();
+    const remove = vi.spyOn(platform, "alertRemove");
     arrivals = [payload()];
     arrivals[0].workspace.session.panes[0].alert = { status: "WATCHING_DISABLED", todo: true, notification: null };
     initWorkspaceMoves(platform);
     await settle();
-    expect(order.indexOf("seed")).toBeGreaterThan(-1);
-    expect(order.indexOf("seed")).toBeLessThan(order.indexOf("adopt_ready"));
+    expect(getWorkspaceBootPlan(WORKSPACE_ID)?.initialPaneIds).toEqual(["pane-a"]);
+    expect(platform.alertSeed).not.toHaveBeenCalled();
+    expect(remove).not.toHaveBeenCalled();
   });
 
   it("resumes each of two simultaneous arrivals over its own PTYs", async () => {
@@ -729,19 +733,6 @@ describe("the target half", () => {
     expect(getWorkspacesSnapshot().workspaces[0]?.id).toBe(WORKSPACE_ID);
   });
 
-  it("seeds a persisted TODO into this window's own AlertManager", async () => {
-    const platform = fakePlatform();
-    const alert = { kind: "todo" } as never;
-    const moving = payload();
-    moving.workspace.session.panes[0]!.alert = alert;
-    arrivals = [moving];
-
-    initWorkspaceMoves(platform);
-    await settle();
-
-    expect(platform.alertSeed).toHaveBeenCalledWith("pane-a", alert);
-  });
-
   it("hands the Workspace back when the host never answers, rather than restarting live shells", async () => {
     // A timed-out collection is not a collection that found no PTYs: those
     // shells are still running, and a cold restore would start a second set.
@@ -749,15 +740,14 @@ describe("the target half", () => {
     try {
       const platform = fakePlatform([], { answer: false });
       const moving = payload();
-      const alert = { kind: "todo" } as never;
-      moving.workspace.session.panes.push({ ...moving.workspace.session.panes[0]!, id: "browser-1", alert });
+      moving.workspace.session.panes.push({ ...moving.workspace.session.panes[0]!, id: "browser-1", surfaceType: "browser" });
       moving.allIds.push("browser-1");
       const removeAlert = vi.spyOn(platform, "alertRemove");
       arrivals = [moving];
       initWorkspaceMoves(platform);
       await vi.advanceTimersByTimeAsync(5000);
-      expect(platform.alertSeed).toHaveBeenCalledWith("browser-1", alert);
-      expect(removeAlert).toHaveBeenCalledWith("browser-1");
+      // The source still shows these Sessions: their alert entries are its.
+      expect(removeAlert).not.toHaveBeenCalled();
 
       expect(getWorkspacesSnapshot().workspaces.map((w) => w.name)).not.toContain("Deploys");
       expect(getWorkspaceBootPlan(WORKSPACE_ID)).toEqual({});
@@ -804,23 +794,25 @@ describe("the target half", () => {
     expect(mocks.invoke).not.toHaveBeenCalledWith("adopt_failed", expect.anything());
   });
 
-  it("discards imported alert state when adopt_done is refused before the Wall mounts", async () => {
-    const platform = fakePlatform();
-    platform.onAlertState((detail) => setTerminalActivity(detail.id, detail));
+  it("discards this window's copy of the alert state when adopt_done is refused before the Wall mounts", async () => {
+    // The source's live ring, as the sidecar's snapshot delivers it to the
+    // collecting window, and its still-pending speech receipt riding along.
+    const episode = createAlertEpisode();
+    const platform = fakePlatform([], {
+      beforeReplay: () => setTerminalActivity("pane-a", {
+        status: "ALERT_RINGING", todo: true, episode, notification: { source: "OSC 9", title: "Done", body: null },
+      }),
+    });
+    const removeAlert = vi.spyOn(platform, "alertRemove");
     const host = mocks.invoke.getMockImplementation()!;
     mocks.invoke.mockImplementation(async (cmd: string, args?: unknown) => {
       if (cmd === "adopt_done") arrivals = [];
       return host(cmd, args);
     });
-    // The source's live ring and its still-pending speech receipt ride along.
-    const source = new AlertManager();
-    source.notifyFromProtocol("pane-a", { source: "OSC 9", title: "Done", body: null });
-    const episode = source.getState("pane-a").episode!;
-    const alertRuntime = source.pauseForTransfer("pane-a")!;
     const fire = vi.fn();
     const stopWatch = watchUnattendedRings({ sink: "speech", subscribe: () => () => {}, enabled: () => true, delayMs: () => 0, fire });
     arrivals = [payload({
-      terminals: { "pane-a": { serialized: "", alertRuntime, alertDelivery: { speech: { episodeId: episode.id, dueAt: 0, phase: "pending" } } } },
+      terminals: { "pane-a": { serialized: "", alertDelivery: { speech: { episodeId: episode.id, dueAt: 0, phase: "pending" } } } },
     } as Partial<WorkspaceTransferPayload>)];
     try {
       // No Wall handle: React never mounted the arrival before the refusal.
@@ -831,11 +823,12 @@ describe("the target half", () => {
       expect(getActivitySnapshot().has("pane-a")).toBe(false);
       expect(isAlertDeliveryPaused("pane-a")).toBe(false);
       expect(getAlertDeliveryReceipts("speech").has("pane-a")).toBe(false);
+      // The ring is the source's again, still live in the sidecar.
+      expect(removeAlert).not.toHaveBeenCalled();
       await settle();
       expect(fire).not.toHaveBeenCalled();
     } finally {
       stopWatch();
-      source.dispose();
     }
   });
 
diff --git a/standalone/src/workspace-move.ts b/standalone/src/workspace-move.ts
index e2fc2eea0..7e6ee81e8 100644
--- a/standalone/src/workspace-move.ts
+++ b/standalone/src/workspace-move.ts
@@ -4,7 +4,6 @@ import { restoreToolParams } from 'dormouse-lib/components/wall/tool-transfer';
 import { recordToolAnnounce } from 'dormouse-lib/lib/tool-announce-store';
 import { pauseAlertDelivery, resumeAlertDelivery, snapshotAlertDelivery, restoreAlertDelivery, forgetAlertDelivery } from 'dormouse-lib/lib/alert-delivery-state';
 import { setIncomingAlertPolicy } from 'dormouse-lib/lib/alert-delivery-policy';
-import type { AlertRuntimeSnapshot } from 'dormouse-lib/lib/alert-manager';
 import { invoke } from "@tauri-apps/api/core";
 import { clearTerminalActivity, flushTerminal, releaseSession } from "dormouse-lib/lib/terminal-registry";
 import { forgetHelper } from "dormouse-lib/lib/helper-terminal";
@@ -98,7 +97,6 @@ export type MoveOutcome = { moved: true } | { moved: false; reason: string };
 
 interface InFlightMove {
   prepared: PreparedWorkspaceTransfer;
-  alertRuntime?: Map<string, AlertRuntimeSnapshot>;
   /** Releases the pending guard and settles the caller's promise:
    *  `handleDeparted` with `moved`, `handleArrivalFailed` with the host's reason. */
   settle: (outcome: MoveOutcome) => void;
@@ -196,14 +194,9 @@ async function handOff(
       const content = await captureTransferContent(terminalIds, marks);
       if (prepared.tools) content.tools = prepared.tools;
       if (inFlight.get(workspaceId)?.prepared === prepared) { // else handed back while serializing
-        const alertRuntime = new Map<string, AlertRuntimeSnapshot>();
-        inFlight.get(workspaceId)!.alertRuntime = alertRuntime;
+        // The alert state stays in the sidecar's one manager, routed to
+        // whichever window owns the Session; only the delivery receipts move.
         for (const id of terminalIds) {
-          const runtime = movePlatform?.alertPauseForTransfer?.(id);
-          if (runtime) {
-            alertRuntime.set(id, runtime);
-            content.terminals[id].alertRuntime = runtime;
-          }
           const delivery = snapshotAlertDelivery(id);
           if (Object.keys(delivery).length) content.terminals[id].alertDelivery = delivery;
         }
@@ -219,7 +212,7 @@ async function handOff(
   } catch (err) {
     // Rust already owns the transaction. Its ARRIVAL_MAX watchdog hands back
     // an arrival with no content; keep the guard and delivery pause until that
-    // event restores routing, replay, runtime, and receipts together. Clearing
+    // event restores routing, replay, and receipts together. Clearing
     // them locally would permit another move while this one still owns PTYs.
     console.warn("[workspace-move] content capture failed; awaiting host hand-back", err);
   }
@@ -333,9 +326,6 @@ function handleArrivalFailed(workspaceId: WorkspaceId, reason: string, replayIds
   if (!move) return;
   inFlight.delete(workspaceId);
   clearWorkspaceTransferring(workspaceId);
-  for (const [id, runtime] of move.alertRuntime ?? []) {
-    movePlatform?.alertResumeFromTransfer?.(id, runtime, replayIds.includes(id) ? handBackRequestId(workspaceId) : undefined);
-  }
   resumeAlertDelivery(move.prepared.payload.terminalIds);
   console.warn(`[workspace-move] ${workspaceId} was not adopted (${reason}); it stays here`);
   if (replayIds.length) acceptHandBackReplay(workspaceId, replayIds);
@@ -346,7 +336,7 @@ function handleArrivalFailed(workspaceId: WorkspaceId, reason: string, replayIds
  *  stdio; the same room an arrival gets. */
 const HAND_BACK_REPLAY_TIMEOUT_MS = ARRIVAL_TIMEOUT_MS;
 
-/** The token Rust echoes on a hand-back's replay; the live alert permission is bound to it. */
+/** The token Rust echoes on a hand-back's replay. */
 const handBackRequestId = (workspaceId: WorkspaceId): string => `handback-${workspaceId}`;
 
 /**
@@ -420,11 +410,8 @@ async function planArrival(
 ): Promise<WallBootPlans[string]> {
   pauseAlertDelivery(payload.terminalIds);
   setIncomingAlertPolicy(payload.terminalIds, payload.workspace.session.alertDelivery ?? {});
-  // TODO has no replay event: seed it in the receiving webview before replay
-  // re-derives the running watch (seeding afterwards would clear that watch).
-  for (const pane of payload.workspace.session.panes) {
-    if (pane.alert) platform.alertSeed?.(pane.id, pane.alert);
-  }
+  // No alert seeding: the Sessions' alert state never left the sidecar, and
+  // its answer to the `pty:requestInit` below re-sends it to this window.
   const ptyIds = new Set(payload.terminalIds);
   const transferred = Object.entries(payload.terminals ?? {}).filter(([id]) => ptyIds.has(id));
   for (const [id, terminal] of transferred) {
@@ -436,12 +423,7 @@ async function planArrival(
   const live = await collectLivePtys(platform, {
     // The token rides through Rust to the sidecar's `list` and comes back on the
     // answer, so two Workspaces arriving at once cannot finish on each other's.
-    // The live alert runtime installs here, ahead of the replay it names: only
-    // the since-mark replay carrying this token fires notification side effects.
     trigger: (requestId) => {
-      for (const [id, terminal] of transferred) {
-        if (terminal.alertRuntime) platform.alertResumeFromTransfer?.(id, terminal.alertRuntime, terminal.mark !== undefined ? requestId : undefined);
-      }
       void invoke("adopt_ready", { workspaceId: payload.workspaceId, requestId }).catch((err) =>
         console.error("[workspace-move] adopt_ready failed", err));
     },
@@ -483,16 +465,16 @@ async function planArrival(
  * Take an arrival this window will not keep back out, whether or not its Wall
  * mounted: Sessions released, **never killed** (the shells are the source's
  * again), notes and helpers dropped, the record and parked plan forgotten.
- * **Imported alert state goes before the delivery guards**: forgetting the
- * pause first would let a watcher re-arm on the still ringing Activity of a
+ * **Never removes the host's alert entry**, which the source goes on showing.
+ * **This window's Activity copy goes before the delivery guards**: forgetting
+ * the pause first would let a watcher re-arm on the still ringing Activity of a
  * Workspace this window never owned.
  */
-function discardArrival(platform: PlatformAdapter, payload: MovePayload): void {
+function discardArrival(payload: MovePayload): void {
   dismissWorkspaceUi(payload.workspaceId);
   for (const id of payload.allIds) { removeSurface(id); forgetHelper(id); }
   for (const id of new Set([...payload.terminalIds, ...payload.workspace.session.panes.map((pane) => pane.id)])) {
     if (terminalRegistry.has(id)) releaseSession(id);
-    else platform.alertRemove(id);
     clearTerminalActivity(id);
     removeTerminalPaneState(id);
     clearToolDirty(id);
@@ -549,11 +531,11 @@ async function adoptWorkspace(platform: PlatformAdapter, payload: MovePayload):
       // or unmounted arrival releases from the received payload: preparing a
       // new move here can fail on a Tool that is still starting.
       console.error("[workspace-move] adopt_done refused; unwinding the mount", err);
-      discardArrival(platform, payload);
+      discardArrival(payload);
     }
   } catch (err) {
     console.error("[workspace-move] adoption failed; handing the Workspace back", err);
-    discardArrival(platform, payload);
+    discardArrival(payload);
     settle("adopt_failed", id, reasonOf(err));
   } finally {
     adopting.delete(id);
@@ -625,7 +607,7 @@ export async function bootFromTearOut(platform: PlatformAdapter): Promise<WallBo
     // is a window the user can use rather than a blank one. Anything else in
     // the queue is left for `initWorkspaceMoves` to drain over it.
     console.error("[workspace-move] the torn-out Workspace could not be resumed", err);
-    discardArrival(platform, first);
+    discardArrival(first);
     settle("adopt_failed", id, reasonOf(err));
     adopting.delete(id);
     return null;
@@ -634,7 +616,7 @@ export async function bootFromTearOut(platform: PlatformAdapter): Promise<WallBo
     await invoke("adopt_done", { workspaceId: id });
   } catch (err) {
     console.error("[workspace-move] torn-out adoption refused; starting fresh", err);
-    discardArrival(platform, first);
+    discardArrival(first);
     adopting.delete(id);
     return null;
   }
diff --git a/vscode-ext/src/message-router.ts b/vscode-ext/src/message-router.ts
index 8c622ad8f..8508521fe 100644
--- a/vscode-ext/src/message-router.ts
+++ b/vscode-ext/src/message-router.ts
@@ -97,8 +97,8 @@ configurePeerLink({
   brokerRequest,
   invalidateDirectory: notifyDirectoryChanged,
   streamPty: processedPtyStreams.streamPty,
-  writePty: (ptyId, data) => ptyManager.write(ptyId, data),
-  resizePty: (ptyId, cols, rows, repaint) => ptyManager.resize(ptyId, cols, rows, repaint),
+  writePty: writeClientInput,
+  resizePty: resizeForClient,
   // Peer PTYs use generated provider-local route handles. Keep those handles
   // outside this window's real PTY namespace so local ids always fall through
   // to the manager that owns them.
@@ -116,10 +116,28 @@ configureBurrow({
   brokerRequest,
   broadcastToWebviews,
   streamPty: processedPtyStreams.streamPty,
-  writePty: (ptyId, data) => ptyManager.write(ptyId, data),
-  resizePty: (ptyId, cols, rows, repaint) => ptyManager.resize(ptyId, cols, rows, repaint),
+  writePty: writeClientInput,
+  resizePty: resizeForClient,
 });
 
+/**
+ * A remote Client's keystrokes, reaching this window's PTY from its own Burrow
+ * or over the peer link from the broker's: a human's input like a webview's,
+ * so acknowledged before the write, echo window included (`docs/specs/alert.md`
+ * → Engagement). The Burrow has already dropped a mirror's terminal replies.
+ */
+function writeClientInput(ptyId: string, data: string): void {
+  alertManager.acknowledge(ptyId, { input: true });
+  ptyManager.write(ptyId, data);
+}
+
+/** A Client's resize — the repaint bounce included — whose output is the
+ *  resize's, never the program working. */
+function resizeForClient(ptyId: string, cols: number, rows: number, repaint?: boolean): void {
+  alertManager.onResize(ptyId);
+  ptyManager.resize(ptyId, cols, rows, repaint);
+}
+
 /**
  * Put one question to every webview in this window and settle with everything
  * they answered.
@@ -1106,7 +1124,11 @@ export function attachRouter(
         .finally(() => {
           for (const id of toKill) {
             try { ptyManager.kill(id); }
-            finally { globalOwnedPtyIds.delete(id); }
+            finally {
+              globalOwnedPtyIds.delete(id);
+              // Its webview, which would have sent `alert:remove`, is gone.
+              alertManager.remove(id);
+            }
           }
         });
     },
diff --git a/vscode-ext/test/message-router.test.ts b/vscode-ext/test/message-router.test.ts
index 1d91d91fb..dc93b23cc 100644
--- a/vscode-ext/test/message-router.test.ts
+++ b/vscode-ext/test/message-router.test.ts
@@ -15,11 +15,13 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
 import type { ExtensionMessage, WebviewMessage } from '../src/message-types';
 import type { PeerLinkDeps } from '../src/peer-link';
+import type { BurrowDeps } from '../src/burrow';
 import type { WebviewChannel } from '../src/webview-messaging';
 
 /** What `message-router.ts` hands the two modules it configures at load. */
 const wiring = vi.hoisted(() => ({
   peer: null as PeerLinkDeps | null,
+  burrow: null as BurrowDeps | null,
   /** Every `notifyDirectoryChanged()` the router made. */
   invalidations: 0,
 }));
@@ -66,7 +68,9 @@ vi.mock('../src/pty-manager', async (importOriginal) => ({
 }));
 
 vi.mock('../src/burrow', () => ({
-  configureBurrow: () => {},
+  configureBurrow: (deps: BurrowDeps) => {
+    wiring.burrow = deps;
+  },
   deliverCommandResult: () => {},
   deliverUiEvent: () => {},
   dropForwardedCommands: () => {},
@@ -114,6 +118,7 @@ let mirror: MirrorModule;
 beforeEach(async () => {
   vi.resetModules();
   wiring.peer = null;
+  wiring.burrow = null;
   wiring.invalidations = 0;
   ptys.cwd = null;
   ptys.cwdAsked = [];
@@ -681,6 +686,22 @@ describe('engagement viewers', () => {
     }
   });
 
+  // A remote Client's keystrokes reach the PTY through this window's own
+  // Burrow or over the peer link from the broker's, never through a webview:
+  // the host acknowledges them itself (docs/specs/alert.md → Engagement).
+  it.each(['burrow', 'peer'] as const)('acknowledges a Client\'s input before writing it (%s)', (path) => {
+    const deps = path === 'burrow' ? wiring.burrow! : wiring.peer!;
+    ptys.callbacks!.onData('pty-remote', REPORT);
+    const atWrite: Array<string | undefined> = [];
+    ptys.onWrite = (id) => void atWrite.push(status(id));
+    deps.writePty('pty-remote', 'y');
+    expect(atWrite).toEqual(['WATCHING_DISABLED']);
+    expect(router.getAlertStates().get('pty-remote')?.todo).toBe(false);
+    // A bell answering the key rings no one.
+    ptys.callbacks!.onData('pty-remote', REPORT);
+    expect(status('pty-remote')).not.toBe('ALERT_RINGING');
+  });
+
   it('stops engaging anything once its webview is disposed', () => {
     const webview = fakeWebview();
     const disposable = router.attachRouter(webview.channel);
@@ -713,3 +734,17 @@ describe('engagement viewers', () => {
     }
   });
 });
+
+// An editor panel's disposal kills its PTYs, and the webview that would have
+// sent `alert:remove` for them is already gone: the host removes their entries.
+it('removes the alert state of the PTYs a closing panel kills', async () => {
+  const webview = fakeWebview();
+  const disposable = router.attachRouter(webview.channel, { killOnDispose: true });
+  webview.send({ type: 'pty:spawn', id: 'panel-pty', options: { cwd: '/repo' } });
+  ptys.callbacks!.onData('panel-pty', '\x1b]9;needs input\x07');
+  expect(router.getAlertStates().has('panel-pty')).toBe(true);
+
+  disposable.dispose();
+  await vi.waitFor(() => expect(ptys.order).toContain('kill panel-pty'));
+  expect(router.getAlertStates().has('panel-pty')).toBe(false);
+});

From 8943e716c2012bbe5dc3b950616958d4c1eabd62 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 23 Sep 2026 21:34:24 -0700
Subject: [PATCH 08/16] Share one alert host and client between VS Code and
 standalone

- One host module (commands, per-realm awaits with synchronous answers on
  realm end, validation, store binding) and one client serve both hosts
  over one `alert:command` wire; the fake adapter runs the real host.
- One owner PTY stream and one Client-input wrapper feed the manager in
  both hosts; the resize grace rides the PTY resize and the persisted
  alert rides the spawn, so no separate resize, seed or remove calls.
- Alert entries go when ownership drops (kill, orphan reap), fixing the
  leak on window close; a `sync` command re-syncs a reconnected viewer.
- Rust: the tool-event hold is gone, one "showing" route covers every
  id-keyed event (fixing an exit before a transfer's mark), await results
  go to their window, and stamping/serialization are shared.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwN55bUVmCNmPiX7vHGCVF
---
 docs/specs/alert.md                           |  46 +--
 docs/specs/alert.rationale.md                 |   6 +-
 docs/specs/dor-tool.md                        |   4 +-
 docs/specs/layout.md                          |   2 +-
 docs/specs/standalone.md                      | 151 ++++----
 docs/specs/standalone.rationale.md            |  21 +-
 docs/specs/terminal-escapes.md                |  10 +-
 docs/specs/terminal-escapes.rationale.md      |   2 +-
 docs/specs/transport.md                       |  20 +-
 docs/specs/transport.rationale.md             |   2 +-
 docs/specs/vscode.md                          |  25 +-
 lib/src/host/alert-client.test.ts             | 192 +++++-----
 lib/src/host/alert-client.ts                  | 132 ++++---
 lib/src/host/alert-host.test.ts               | 334 ++++++++--------
 lib/src/host/alert-host.ts                    | 207 +++++-----
 lib/src/host/alert-protocol.ts                |  58 +--
 lib/src/host/owner-pty.ts                     |  86 +++++
 lib/src/host/remote/sidecar-entry.test.ts     | 229 ++++++++++-
 lib/src/host/remote/sidecar-entry.ts          | 293 +++++++++-----
 lib/src/lib/alert-manager-test-utils.ts       |  11 +-
 lib/src/lib/alert-manager.test.ts             |   5 +-
 lib/src/lib/alert-manager.ts                  |  18 +-
 lib/src/lib/alert-settings-host.ts            |   5 +-
 lib/src/lib/platform/fake-adapter.ts          | 101 +++--
 lib/src/lib/platform/replay-parse.ts          |  21 +
 lib/src/lib/platform/types.ts                 |  33 +-
 lib/src/lib/platform/vscode-adapter.test.ts   |  88 ++---
 lib/src/lib/platform/vscode-adapter.ts        | 153 ++------
 lib/src/lib/quiesce-detector.ts               |  18 +-
 lib/src/lib/reconnect.test.ts                 |   2 -
 lib/src/lib/session-restore.test.ts           |  28 +-
 lib/src/lib/session-restore.ts                |  10 +-
 lib/src/lib/session-save.test.ts              |   2 -
 .../lib/terminal-lifecycle.release.test.ts    |  20 +-
 lib/src/lib/terminal-lifecycle.ts             |  12 +-
 lib/src/lib/terminal-protocol.ts              |   8 +-
 lib/src/lib/terminal-registry.alert.test.ts   |   8 +
 lib/src/lib/watched-command-host.ts           |   5 +-
 lib/src/remote/client/remote-adapter.ts       |   2 -
 scripts/spec-word-budgets.json                |   4 +-
 standalone/sidecar/helper-terminal.test.js    |  14 +-
 standalone/sidecar/main-wiring.test.js        |  38 +-
 standalone/sidecar/main.js                    |  74 +---
 standalone/sidecar/pty-core.js                |  16 +-
 standalone/src-tauri/src/lib.rs               | 361 +++++++++---------
 standalone/src-tauri/src/routing.rs           | 338 +++++-----------
 .../src/browser-sidecar-adapter.test.ts       | 173 +--------
 standalone/src/browser-sidecar-adapter.ts     |  56 +--
 standalone/src/sidecar-adapters.test.ts       | 202 ++++++++++
 standalone/src/tauri-adapter.test.ts          | 181 +--------
 standalone/src/tauri-adapter.ts               |  66 +---
 standalone/src/window-restore.test.ts         |   1 -
 standalone/src/workspace-move.test.ts         |  29 +-
 vscode-ext/src/extension.ts                   |   1 -
 vscode-ext/src/message-router.ts              | 272 +++----------
 vscode-ext/src/message-types.ts               |  47 +--
 vscode-ext/src/webview-view-provider.ts       |   1 -
 vscode-ext/test/message-router.test.ts        | 170 +++++----
 website/src/lib/tut-runner.test.ts            |   2 +-
 59 files changed, 2066 insertions(+), 2350 deletions(-)
 create mode 100644 lib/src/host/owner-pty.ts
 create mode 100644 lib/src/lib/platform/replay-parse.ts
 create mode 100644 standalone/src/sidecar-adapters.test.ts

diff --git a/docs/specs/alert.md b/docs/specs/alert.md
index 97465ee42..b3ffaa0e2 100644
--- a/docs/specs/alert.md
+++ b/docs/specs/alert.md
@@ -4,7 +4,7 @@
 >
 > Owns the Session Activity layer — the ring and its three sources, engagement, TODO, notification text and its sanitization, the two alarm sinks, and the Workspace union projection. `docs/specs/layout.md` defers here for all alert/TODO behavior.
 >
-> Defers placement and sizing to `docs/specs/layout.md`, the alert-store relay messages (`alert:state` / `alert:settings` / `alert:watchedCommands`) to `docs/specs/transport.md`, and push sealing to `docs/specs/remote-security-model.md`; the `alert:await*` contract is stated here.
+> Defers placement and sizing to `docs/specs/layout.md`, the renderer ↔ host wire (`alert:command` and the `alert:*` events) to `docs/specs/transport.md`, and push sealing to `docs/specs/remote-security-model.md`; the await's own messages are stated here.
 
 **Must preserve Activity across minimize/reattach** (glossary I3). **A browser Surface has no Activity machine** — it can never ring, and carries only a user-set TODO flag, destroyed with that Surface.
 
@@ -21,7 +21,7 @@ Only `watching` requires WATCHING. **Every source obeys one engagement rule —
 ## Non-goals
 
 - **No process heuristics.** WATCHING applies only to command names the user explicitly asked for — never a guess that `vim`, `npm dev`, agents, or test runners deserve alerts.
-- **No native OS notifications on the machine Dormouse runs on**, and no progress-bar widget. The one local audible channel is the opt-in spoken alarm below, which says a Pane name and nothing else; Dormouse plays no sound effects. Push is the exception and goes only to a *remote* paired phone — the point is reaching a user who walked away.
+- **No native OS notifications on the machine Dormouse runs on**, and no progress-bar widget. The one local audible channel is the opt-in spoken alarm below, which says a Pane name and nothing else; Dormouse plays no sound effects. Push is the exception and goes only to a *remote* paired phone.
 - **No process-tree introspection** for command-exit alerts; normalized terminal semantic events are the reliable input.
 - No HTML, Markdown, ANSI styling, clickable actions, custom icons, or remote-controlled buttons in notification previews.
 - No Door-specific alert menu that changes the Door actions in `docs/specs/layout.md`.
@@ -40,11 +40,11 @@ Public `status` is a projection — first match wins:
 
 `awaited` sits beside `status`: true while at least one `dor await` is parked on the Session (Await). It is derived from live waiters and **never persisted**.
 
-**Persist only** `todo` and the sanitized `notification` (plus `status` for diagnostics); restore replays those two and **must not** recreate a ring, a progress cycle, or a command-exit arm. **Must read a notification this build cannot validate as none, keeping the pane** (pinned by `keeps a pane whose notification this build cannot read, seeding its TODO without the detail` in `lib/src/lib/session-restore.test.ts`), and **never write a source outside `STRICT_READER_NOTIFICATION_SOURCES`** until no strict pre-tolerant build reads the file (rationale). **WATCHING is never persisted per Session** — it is re-derived from the rule set below at the next command start. Replay filtering in `docs/specs/terminal-escapes.md` keeps old terminal output from firing notification side effects again.
+**Persist only** `todo` and the sanitized `notification` (plus `status` for diagnostics). Every spawn starts the id's alert state over; **a cold restore carries those two on the pane's spawn** (`SpawnPtyOptions.alert`), seeded **before the PTY spawns**; a live resume keeps the host's. Restore **must not** recreate a ring, a progress cycle, or a command-exit arm. Pinned by `restores a pane's persisted TODO through its spawn` in `lib/src/lib/terminal-registry.alert.test.ts`. **Must read a notification this build cannot validate as none, keeping the pane** (pinned by `keeps a pane whose notification this build cannot read, seeding its TODO without the detail` in `lib/src/lib/session-restore.test.ts`), and **never write a source outside `STRICT_READER_NOTIFICATION_SOURCES`** until no strict pre-tolerant build reads the file (rationale). **WATCHING is never persisted per Session** — it is re-derived from the rule set below at the next command start. Replay filtering in `docs/specs/terminal-escapes.md` keeps old terminal output from firing notification side effects again.
 
 **Must retain host Activity before xterm initialization and clear it on Session disposal.** Test: `preserves pre-registration activity through terminal creation and orphaning` in `lib/src/lib/terminal-registry.alert.test.ts`.
 
-Source of truth: `AlertState` / `ActivityNotification` / `SessionStatus` in `lib/src/lib/alert-manager.ts`; `QuiesceStatus` in `lib/src/lib/quiesce-detector.ts`; `ActivityState` in `lib/src/lib/session-activity-store.ts`; `toPersistedAlertState` / `normalizePersistedAlert` in `lib/src/lib/session-types.ts`.
+Source of truth: `AlertState` / `ActivityNotification` / `SessionStatus` in `lib/src/lib/alert-manager.ts`; `QuiesceStatus` in `lib/src/lib/quiesce-detector.ts`; `ActivityState` in `lib/src/lib/session-activity-store.ts`; `toPersistedAlertState` / `normalizePersistedAlert` in `lib/src/lib/session-types.ts`; `respawn` in `lib/src/host/alert-host.ts`.
 
 ## Engagement
 
@@ -59,7 +59,7 @@ Three separate signals, never one lease (rationale):
 **A Session is engaged while some present viewer focuses it**, and engagement alone decides holding over ringing.
 
 - **Must compute presence in the renderer and report transitions only**: an input event only stamps a time, and the host keeps no presence timer. **An end of presence names its lapse** — `idle` when the timeout ran out, `leave` on a window blur or hide. **A blur is a leave only when `document.hasFocus()` is false** (`docs/specs/layout.md` → Corner cases #2). Focus or visibility returning counts as input.
-- **Must keep engagement per viewer**, deduped at the renderer, so one viewer's leave never disengages a Session another viewer engages. **An absent viewer reports no focus change.** VS Code gives each webview its own viewer (`docs/specs/vscode.md`), standalone each window, by its label (`docs/specs/standalone.md` → Alerts); the fake adapter has one, `LOCAL_VIEWER`.
+- **Must keep engagement per viewer**, deduped at the renderer, so one viewer's leave never disengages a Session another viewer engages. **An absent viewer reports no focus change.**
 
 | Gesture | Acknowledges |
 |---|---|
@@ -69,11 +69,11 @@ Three separate signals, never one lease (rationale):
 
 - **Must acknowledge at each gesture's handler, never in the passthrough entry the silent paths share.**
 - **Never treat terminal replies or mouse-only report chunks as keyboard input** (rationale).
-- **Must write all human-originated PTY input through `writeUserInput`**, the mobile input bar's included: it carries `userInput`, and the host acknowledges it with input before writing it, in the one message. **A remote Client's write acknowledges with input at the host's Burrow provider**, the Burrow having dropped a mirror's terminal replies.
+- **Must write all human-originated PTY input through `writeUserInput`**, the mobile input bar's included: it carries `userInput`, and **the host acknowledges it with input before the bytes reach the PTY**, in the one message (rationale). **A remote Client's write acknowledges the same way**, the Burrow having dropped a mirror's terminal replies.
 - **Never create an Activity entry to acknowledge**, the host's one check, so a browser Surface keeps its own TODO.
 - **User input opens the echo window** (`cfg.alert.echoWindow`) even when acknowledging clears nothing, a helper's included. Output inside it is ignored entirely — detector, `outputSince`, the acknowledged state, awaits — and a completion inside it neither rings nor is held (rationale).
 
-Source of truth: `setViewer` / `acknowledge` in `lib/src/lib/alert-manager.ts`; `createPresenceTracker` in `lib/src/lib/presence.ts`; `retainEngagementReporter` in `lib/src/lib/engagement.ts`; `writeUserInput` in `lib/src/lib/terminal-lifecycle.ts`. Pinned by `lib/src/lib/alert-engagement.test.ts`.
+Source of truth: `setViewer` / `acknowledge` in `lib/src/lib/alert-manager.ts`; `createPresenceTracker` in `lib/src/lib/presence.ts`; `retainEngagementReporter` in `lib/src/lib/engagement.ts`; `writeUserInput` in `lib/src/lib/terminal-lifecycle.ts`; `alertedPty` in `lib/src/host/owner-pty.ts`. Pinned by `lib/src/lib/alert-engagement.test.ts`.
 
 ## Completion events
 
@@ -148,22 +148,22 @@ An **await** parks on one Session until it finishes what it is doing, then repor
 | Ceiling | `timeoutMs` | `dor await`'s `--timeout` (seconds, default 600), the only number not derived from `cfg.alert` |
 
 - **Enforce all three host-side**, so no hop reaps a parked await early and no caller parks forever by lying about its deadline.
-- The host's `MAX_AWAIT_TIMEOUT_MS` matches the CLI's 1–86400 whole-second range (`docs/specs/dor-cli.md`); a ceiling exists at all because `setTimeout` overflows past ~24.9 days (rationale).
+- The host's `MAX_AWAIT_TIMEOUT_MS` matches the CLI's 1–86400 whole-second range (`docs/specs/dor-cli.md`) (rationale).
 - **Reject a non-finite, non-positive, or over-ceiling request rather than clamping it** — it settles `cancelled`, absorbing nothing; the webview handler rejects the same values with a visible error.
 
 **Several awaits may park on one Session**, sharing one claimant: a completion goes to every await whose condition it satisfies, each resolving on the first qualifying signal after it registered.
 
-**In VS Code and standalone an await crosses from the renderer to the host process that holds the manager**, and the wait itself never leaves the host:
+**An await crosses from the renderer to the host process that holds the manager**, and the wait itself never leaves the host:
 
-- The renderer asks to park and, if it gives up, to cancel; **the host answers exactly one result per await**, a cancel included — VS Code over `alert:await` / `alert:awaitCancel` / `alert:awaitResult` by `requestId`, standalone per `docs/specs/standalone.md` → Alerts.
-- **A realm that ends — a disposed or recreated webview, a reloaded or closed window — has everything it parked cancelled and answered by the host, *synchronously*** (rationale); a disposing standalone adapter settles its own.
+- The renderer asks to park (`await`, under an `awaitId` its client mints) and, if it gives up, to cancel (`awaitCancel`); **the host answers exactly one `alert:awaitResult {awaitId, outcome}` per await, to the realm that parked it**, a cancel included. **A realm's repeated `awaitId` is ignored, never answered twice**; a malformed `id` or `until` is answered `cancelled`.
+- **A realm that ends — a disposed or recreated webview, a reloaded or closed window — has everything it parked cancelled and answered by the host, *synchronously*** (rationale); a disposing adapter settles its own.
 - `cancelled` has no wire outcome of its own: the renderer reports it to `dor` as an error, which is also what forgets the in-flight control request.
-- The fake adapter calls `awaitCompletion` in-process. The Pocket phone adapter has no `dor` and protocol-v1 carries no await, so it settles every request `cancelled` at once.
+- The fake adapter runs the same host in process. The Pocket phone adapter has no `dor` and protocol-v1 carries no await, so it settles every request `cancelled` at once.
 - **An await survives a Workspace transfer**: the manager never moves (Live Workspace transfer).
 
 **A PTY exit or Session removal resolves every waiter still parked as `died`**, after command-finish dispatch gets first chance to resolve normally. Manager disposal resolves every waiter as `cancelled`.
 
-Source of truth: `awaitCompletion` in `lib/src/lib/alert-manager.ts`; `alertAwait` in `lib/src/lib/platform/types.ts`, `lib/src/lib/platform/vscode-adapter.ts` and `lib/src/host/alert-client.ts`; `vscode-ext/src/message-router.ts`; `createSidecarAlerts` in `lib/src/host/alert-host.ts`.
+Source of truth: `awaitCompletion` in `lib/src/lib/alert-manager.ts`; `AlertCommand` / `AlertAwaitResult` in `lib/src/host/alert-protocol.ts`; `alertAwait` in `lib/src/host/alert-client.ts`; `createAlertHost` in `lib/src/host/alert-host.ts`. Pinned by `lib/src/host/alert-host.test.ts` and `lib/src/host/alert-client.test.ts`.
 
 ## WATCHING Track
 
@@ -171,7 +171,7 @@ Source of truth: `awaitCompletion` in `lib/src/lib/alert-manager.ts`; `alertAwai
 
 **The output/silence detector is always on.** Every Session runs one `QuiesceDetector` for its whole lifetime, fed by every output chunk outside the echo window and reset at every command boundary. It never latches and knows nothing about engagement or rules; the rule set decides only whether its state is publicly visible and whether a settle — a busy Session that stayed quiet — may *ring*.
 
-**A retired id must stay retired.** `disposeSession` retires the alert state and only *then* kills the PTY. **Raw output and resizes never revive a retired id**; a semantic or protocol event may (rationale).
+**A retired id must stay retired.** A host removes the alert entry in the same turn as its kill, ahead of any output still in flight. **Raw output and resizes never revive a retired id**; a semantic or protocol event may (rationale).
 
 Rules:
 
@@ -181,7 +181,7 @@ Rules:
 - **Editing the rule set re-derives WATCHING across every live Session immediately**, never restarting the detector (rationale).
 - **A WATCHING ring outlives the command that raised it.** Watching switches off when the watched command exits; the ring's `watching` source keeps the originating key.
 - **Removing a rule withdraws the `watching` source it raised**, even after the command has exited, unless another rule still covers that key; other clearing paths follow Clearing And TODO. A command merely ending never clears the ring.
-- **The rule set is app-global and persisted** (`dormouse:watched-commands`), starting empty, so WATCHING is off everywhere until the user turns it on. **The host is authoritative wherever one serves several webviews** — the VS Code extension host, and the standalone sidecar — so a stale webview can neither replace unrelated rules nor keep reporting an obsolete list: the first webview's persisted copy is taken as the seed, an edit is a delta, and the host broadcasts its canonical snapshot back. The seed/mutation/broadcast wire contract is `docs/specs/transport.md`.
+- **The rule set is app-global and persisted** (`dormouse:watched-commands`), starting empty, so WATCHING is off everywhere until the user turns it on. **The host is authoritative**, serving several webviews, so a stale webview can neither replace unrelated rules nor keep reporting an obsolete list; the seed / delta / broadcast wire is `docs/specs/transport.md` → Message protocol.
 
 **Limitation:** WATCHING needs the shell to report its command line — `OSC 633 ; E`, or `cmdline_url` / `cmdline` on `OSC 133 ; C` (fish ≥ 4) — beside the boundaries. A shell reporting bare `OSC 133` boundaries, or none (`docs/specs/terminal-escapes.md`), never names a command, so WATCHING never engages and the terminal context reports `No command running`. Terminal reports still work; command-exit alerting also requires semantic command boundaries. **Never route the keystroke fallback in `docs/specs/terminal-state.md` into the `AlertManager`** (rationale).
 
@@ -194,7 +194,7 @@ Rules:
 | `MIGHT_NEED_ATTENTION` | A busy Session went quiet. Debounce. |
 | `ALERT_RINGING` | Likely completion observed while the Session was not engaged. |
 
-Meaningful output excludes resize redraw noise during `T_RESIZE_DEBOUNCE`; theme changes, remounts, DOM reparenting, selection, and focus changes are not output. Invariants:
+Meaningful output excludes resize redraw noise during `T_RESIZE_DEBOUNCE`, **a grace the host opens before it resizes the PTY**, a Client's resize included; theme changes, remounts, DOM reparenting, selection, and focus changes are not output. Invariants:
 
 - Output drives the detector up `NOTHING_TO_SHOW` -> `MIGHT_BE_BUSY` -> `BUSY`; silence drives it down `BUSY` -> `MIGHT_NEED_ATTENTION` -> settled. The `MIGHT_*` states are debounce windows in both directions.
 - First output starts candidate tracking without changing status; unconfirmed `MIGHT_BE_BUSY` returns to `NOTHING_TO_SHOW`.
@@ -234,7 +234,7 @@ Sequence syntax lives in `docs/specs/terminal-escapes.md`; what each means here:
 
   **Titles name the running command** — its watch key, else its display command — and fall back to a generic title with none running; the body is `Progress <percent>%`, or none.
 
-Source of truth: the OSC 777 and OSC 99 grammars, parsing, sanitization limits, OSC 99 chunk state, and `applyTerminalEvents` in `lib/src/lib/terminal-protocol.ts`; `updateProtocolProgress` / `finishProtocolProgressCycle` / `PROGRESS_TITLES` in `lib/src/lib/alert-manager.ts`. Pinned by `silently ends a progress cycle the program abandoned` and `names the running command in a progress %s title` in `lib/src/lib/alert-manager.test.ts`.
+Source of truth: the OSC 777 and OSC 99 grammars, parsing, sanitization limits, OSC 99 chunk state, and `applyTerminalEvents` in `lib/src/lib/terminal-protocol.ts`; `createOwnerPtyStream` in `lib/src/host/owner-pty.ts`; `updateProtocolProgress` / `finishProtocolProgressCycle` / `PROGRESS_TITLES` in `lib/src/lib/alert-manager.ts`. Pinned by `silently ends a progress cycle the program abandoned` and `names the running command in a progress %s title` in `lib/src/lib/alert-manager.test.ts`.
 
 ## Command-exit Track
 
@@ -281,7 +281,7 @@ Source of truth: `raiseRing` / `withdrawRingSource` / `clearRingForUser` in `lib
 
 **A Session's alert state never moves**: the host's one manager holds it (`docs/specs/standalone.md` → Alerts), and a transfer moves only where its `alert:state` is routed — the source until the mark, then the target, whose collection is answered with every listed Session's state (rationale).
 
-- **Never remove or seed an entry on a departure, a refused arrival, or a hand-back**: releasing a Session is not ending it. Only a kill removes one.
+- **Never spawn or kill over a departure, a refused arrival, or a hand-back**: a spawn starts the host's entry over and a kill or reap removes it, and releasing a Session is neither. Pinned by `never spawns or kills over an arrival's live Sessions` in `standalone/src/workspace-move.test.ts`.
 - **A replay never feeds the manager**, whose host parse already did.
 - **Awaits survive a transfer**; a seen command stays seen, so it arrives armed; the destination's viewers establish their own engagement.
 - **Must suspend the source's alarm delivery before handing ownership to the host**, and **must await host hand-back when source content capture fails**, holding that suspension until routing returns. The destination restores receipts before its collection, and enables delivery only after `adopt_done` succeeds; refusal resumes the source's. Transaction order is `docs/specs/standalone.md` → "Arrival queue".
@@ -292,7 +292,7 @@ Source of truth: `teardownSession` in `lib/src/lib/terminal-lifecycle.ts`; `snap
 
 ## Alarm settings
 
-Application alarm defaults live beside the WATCHING rule set, edited in **Settings** (below). **Every other store reached from Settings stays its own — never fold one into `AlertSettings`**, which is relayed wholesale to the host. **A host revalidates the blob before installing it** (`normalizeAlertSettings`): a webview must never be able to hand it a NaN or an absurd timer. Both stores run the same two classes in either host (`lib/src/lib/watched-command-host.ts`, `lib/src/lib/alert-settings-host.ts`), bound to standalone's sidecar manager by `lib/src/host/alert-host.ts`; the shape, its defaults and its validation are the platform-free `lib/src/lib/alert-settings-model.ts`.
+Application alarm defaults live beside the WATCHING rule set, edited in **Settings** (below). **Every other store reached from Settings stays its own — never fold one into `AlertSettings`**, which is relayed wholesale to the host. **A host revalidates the blob before installing it** (`normalizeAlertSettings`): a webview must never be able to hand it a NaN or an absurd timer. Both stores run the same two classes in either host (`lib/src/lib/watched-command-host.ts`, `lib/src/lib/alert-settings-host.ts`), bound to its manager by `createAlertHost`; the shape, its defaults and its validation are the platform-free `lib/src/lib/alert-settings-model.ts`.
 
 | Field | Meaning |
 |---|---|
@@ -351,9 +351,9 @@ Source of truth: `toSpokenText` in `lib/src/lib/alert-speech.ts`, armed by `lib/
 
 **The two halves run in different processes.** Ring *detection* is webview state, so `watchPushRings` stays in the webview and fires one `push { sessionId, title }` command at the Burrow service. *Delivery* needs the enrollment and the ACL, which only the Burrow holds, so `sendPush` runs in the service's process and touches no DOM or store. **A webview cannot choose recipients:** it names the Session and what to call it; the service reads its own active ACL at send time. **Arm watching only while the service reports an enrollment** (`enrolled-gate.ts`), so an un-enrolled machine pays no activity-store subscription; a `push` arriving with no Burrow running is not sent. **Keep both halves under `remote/burrow/`**, inside the lazily-imported `RemotePairingModalHost` chunk, so a host without `enableBurrow` never fetches it (rationale).
 
-- **The label is sanitized by `toPushText` at send time, in the delivery half, and not by `toSpokenText`'s rule** (rationale). It keeps angle brackets and instead strips control characters and the Unicode bidi and zero-width format characters (including the Arabic letter mark), which can visually reorder or hide text in an OS notification; the cap counts code points, so a cut never ships half a surrogate pair. `toPushText` is only this sink's limit and fallback over `boundedPushText` in `remote-lib-common/src/security/push.ts`.
+- **The label is sanitized by `toPushText` at send time, in the delivery half, and not by `toSpokenText`'s rule** (rationale). It keeps angle brackets and instead strips control characters and the Unicode bidi and zero-width format characters (including the Arabic letter mark); the cap counts code points, so a cut never ships half a surrogate pair. `toPushText` is only this sink's limit and fallback over `boundedPushText` in `remote-lib-common/src/security/push.ts`.
 - **The Burrow bounds, then seals; the worker re-bounds at the render sink.** Title, body, and tag are sealed to each recipient's own Client static and the Relay forwards ciphertext, so the second pass runs in `lib/src/remote/pocket-app/sw.ts`, which imports the *same* `boundedPushText` rather than mirroring it (`docs/specs/remote-security-model.md` -> Push sealing).
-- **The Burrow names its targets; the Relay rejects a send that does not.** Targets are the Burrow's *active* ACL records, read at send time so a revocation during the delay takes effect, and the Relay intersects them with its own subscriptions. **One sealed envelope per recipient** — a Client static is not a group key — so a send names each `deliveryId` beside the ciphertext only that phone can open, **clamped to `MAX_PUSH_QUERY_DELIVERY_IDS`** because the route refuses the whole POST past it. Nothing propagates a revocation today (`docs/specs/remote-security-model.md` -> Future), so a Relay that chose recipients itself would keep pushing to a de-authorized phone (rationale). The Burrow does **not** ask which devices are subscribed first (rationale).
+- **The Burrow names its targets; the Relay rejects a send that does not.** Targets are the Burrow's *active* ACL records, read at send time so a revocation during the delay takes effect, and the Relay intersects them with its own subscriptions (rationale). **One sealed envelope per recipient** — a Client static is not a group key — so a send names each `deliveryId` beside the ciphertext only that phone can open, **clamped to `MAX_PUSH_QUERY_DELIVERY_IDS`** because the route refuses the whole POST past it. The Burrow does **not** ask which devices are subscribed first (rationale).
 - **The settings dialog re-reads the device list when it opens; the transient preview never refreshes.** The list is the Burrow's join of the Relay's subscriptions against its own ACL labels. **A disarmed enrolled gate invalidates every in-flight refresh and clears the list**, so nothing already on the wire can repopulate the dialog with phones there is no longer anything to push to.
 
 Source of truth: `watchPushRings` / `invalidatePushDeviceRefreshes` in `lib/src/remote/burrow/alert-push.ts`; `sendPush` / `toPushText` in `lib/src/remote/burrow/push-delivery.ts`; `refreshPushDevicesNow` / `clearPushDevices` / `resetPushDevices` in `lib/src/lib/push-devices.ts`.
@@ -444,6 +444,6 @@ Notification text is untrusted terminal output.
 - **Sanitize at protocol-parse time** (`sanitizeText` in `lib/src/lib/terminal-protocol.ts`), bounded and control-stripped like every retained value (`docs/specs/terminal-escapes.md` → Parsing location); every notification stored from a live PTY has been through that pass, generated `WATCHING` and progress titles included via the sanitized command line. `normalizeActivityNotification` in `lib/src/lib/alert-manager.ts` is only a *shape* check on top — known `source`, string-or-null fields, trimmed, at least one non-empty — so the cold-restore path (`seed`) re-accepts a persisted blob without re-applying the cap or the control strip (rationale).
 - Keep only one `ActivityNotification` rather than unbounded history, and cap/expire incomplete OSC 99 parser state.
 - **Never** execute commands, open URLs, copy to clipboard, read files, focus outside Dormouse, or render protocol-supplied icons/buttons/actions.
-- Wherever notification text appears in visible UI or accessible labels, it is plain text, and layout must tolerate long text, CJK, RTL, combining marks, and emoji without pushing fixed controls out of bounds. Sanitized terminal-supplied `OSC 0` / `OSC 2` / `OSC 9` text also participates in normal Pane-label derivation, and that label may reach the opt-in speech and push channels — **each after its own second pass**, because a label safe to *render* is not automatically safe to hand a speech engine or an OS notification, and those two fail in different ways. See `toSpokenText` under Spoken alarms and `toPushText` under Push notifications.
+- Wherever notification text appears in visible UI or accessible labels, it is plain text, and layout must tolerate long text, CJK, RTL, combining marks, and emoji without pushing fixed controls out of bounds. Sanitized terminal-supplied `OSC 0` / `OSC 2` / `OSC 9` text also participates in normal Pane-label derivation, and that label may reach the opt-in speech and push channels — **each after its own second pass**, since the two fail in different ways (`toSpokenText` under Spoken alarms, `toPushText` under Push notifications).
 
-Robustness: Sessions ring independently; minimize, reattach, rerender, resize, and theme changes preserve alert state without creating rings (WATCHING Track, glossary I3); an exited Session may keep ringing until acknowledged, dismissed, or destroyed; ringing must not rely on color alone and must respect `prefers-reduced-motion`.
+Robustness: Sessions ring independently; an exited Session may keep ringing until acknowledged, dismissed, or destroyed; ringing must not rely on color alone.
diff --git a/docs/specs/alert.rationale.md b/docs/specs/alert.rationale.md
index 8d578d6b5..d8728d982 100644
--- a/docs/specs/alert.rationale.md
+++ b/docs/specs/alert.rationale.md
@@ -24,6 +24,8 @@
 
 **Why the reply classifier is the narrow one.** The prompt recorder filters every CSI/SS3 sequence because it cannot interpret them as command text. Reusing that filter here ignored real encoded keys, while its omission of DCS let device-query replies acknowledge background panes; regression tests reproduced both failures in September 2026. The narrower reply classifier already used for replay and untouched-session tracking separates keys from replies without changing live PTY forwarding. Mouse-only chunks need a separate guard: the narrower classifier does not include mouse encodings, and inside programs can request hover and wheel reports without a click. Those reports otherwise dismiss a ring and cancel its pending alarms. Actual clicks already acknowledge through the Pane's DOM handler.
 
+**Why human input rides its write.** The echo of a keystroke comes back from the PTY within milliseconds, so the acknowledgement that opens the echo window has to be in effect before the bytes are written. As a separate command it would race the write across the host boundary, and an echo that won would count as the program working.
+
 **Why the echo window.** The detector cannot tell a program's output from the echo of the user's own keys: typing a draft into a watched `claude` pane at seven keys a second built BUSY from echo alone, so leaving the pane mid-draft rang it, and a parked `dor await --until quiet` resolved on the half-typed draft (audit probes, 2026-09-23). A recorded Claude Code 2.1 session echoed each key within 10 ms; 250 ms covers a TUI's redraw of its input box and still leaves a program's real response to `Enter` counted from its first quarter second.
 
 **Why a completion inside the echo window neither rings nor holds.** It answers the keystroke: a bell on a failed Tab completion, the exit `Ctrl-C` just caused, a `q` quitting a pager. Held, it would ring the pane the user is looking at the moment they sat back for the inactivity timeout.
@@ -68,7 +70,7 @@
 
 **Why the timeout ceiling exists at all.** `timeoutMs` is a safety rail on a blocking call inside an agent loop, not an alert-tuning knob. Like the inactivity timeout it originates a process away and ends up in `setTimeout`, whose delay is a signed 32-bit millisecond count. Anything past ~24.9 days overflows and fires immediately, turning a long park into an instant `timeout`.
 
-**Why an ended realm's awaits are cancelled, and answered synchronously.** A caller that can no longer be answered would otherwise go on absorbing completions the human would have been shown. Synchronously, because in VS Code the cancelled outcome would arrive a microtask after the router stopped posting and be dropped, leaving `dor` blocked on a reply that never comes. Standalone's sidecar answers the same way for one rule across both hosts; a standalone reload keeps its window label, so the window says `hello` rather than the host inferring a new realm from a label list that never changed.
+**Why an ended realm's awaits are cancelled, and answered synchronously.** A caller that can no longer be answered would otherwise go on absorbing completions the human would have been shown. Synchronously, because in VS Code the cancelled outcome would arrive a microtask after the router stopped posting and be dropped, leaving `dor` blocked on a reply that never comes. A standalone reload keeps its window label, so the window says `hello` rather than the host inferring a new realm from a label list that never changed.
 
 ## WATCHING Track
 
@@ -170,7 +172,7 @@ Guarding only completion leaves a stale `start` free to replace the active utter
 
 ## Live Workspace transfer
 
-The manager used to live in each standalone window, so a move had to snapshot its runtime — the ring and its episode, detector deadlines, the deferred notification — into the transfer content, resume it in the target, and bind a replay token so the since-mark replay's reports fired once; a reused persisted reminder had erased episodes and pending delivery instead, and a release removed the entry the other window still showed. With one manager in the host process nothing moves, and all of that went (2026-09). Per-sink receipts still travel because ring delivery is still scheduled in the renderer. Receipt consumption occurs at sink admission because there is no transactional acknowledgement tying audible sound or phone display to Workspace ownership (2026-09).
+Nothing moves because the manager left the standalone windows for the host process (`docs/specs/standalone.rationale.md` → Alerts). Per-sink receipts still travel because ring delivery is still scheduled in the renderer. Receipt consumption occurs at sink admission because there is no transactional acknowledgement tying audible sound or phone display to Workspace ownership (2026-09).
 
 ## Workspace union
 
diff --git a/docs/specs/dor-tool.md b/docs/specs/dor-tool.md
index 2b049ca18..9c4ae1295 100644
--- a/docs/specs/dor-tool.md
+++ b/docs/specs/dor-tool.md
@@ -206,12 +206,12 @@ Source of truth: `toolTakesOverCaller` / `toolRerunsInCaller` / `callerStillPlac
 - **Must sanitize and bound the payload before retaining it.** `ToolAnnounce` / `parseToolAnnounce` and `ToolState` / `parseToolState` own the field shapes and validation limits.
 - **Must reject a payload naming a version this contract does not speak.** `state` requires `v: 1`; `serve` reads an omitted `v` as 1 and refuses any other value — a future v2's rejection path.
 - **Must treat an optional serve `path` as a path/query on the discovered port, never as another authority.** Accept at most 2,048 characters starting with one `/`, with no backslash, ASCII whitespace/control, or DEL; invalid paths are ignored and the default is `/`. The port still must belong to the designated Session's process tree. Live binding memory includes the path; durable saves omit it.
-- **Must forward parsed announcements, state reports, and command-start resets in stream order to the owning renderer.** A start clears the previous command's announcement and unsaved state; later reports in that chunk survive. Standalone uses `terminal:protocolEvents`; VS Code uses nullable `terminal:toolAnnounce` and `terminal:toolState` scoped to the owning webview, with null clearing the corresponding record. The fake adapter applies locally.
+- **Must forward parsed announcements, state reports, and command-start resets in stream order to the owning renderer.** A start clears the previous command's announcement and unsaved state; later reports in that chunk survive. Both hosts forward each parse's as one `terminal:toolEvents`, which the owning renderer applies with `recordToolEvents`; the fake adapter applies locally.
 - **Must reconstruct announcements, state, and resets from raw replay without emitting replies**, preserving transferred announcements when since-mark replay has no command start, and clear the renderer record on Session disposal. Ordinary terminal announcements stay inert.
 - Reserved: **Must retain `name`, `dehydrate`, and `persist` as inert parsed fields**, serving the announced-name and D1/D2 items under [Future](#future). Neither `persist: never` nor a `dehydrate` verb changes current persistence.
 - Reserved: **Never assign an OSC 367 verb beyond `serve`, `state`, and `dehydrate`**; `dehydrate` belongs to D2 under [Future](#future), while existing title/progress protocols keep those roles.
 
-Source of truth: `TerminalProtocolParser` / `collectTerminalToolEvents` in `lib/src/lib/terminal-protocol.ts`; `parseToolAnnounce` in `lib/src/lib/tool-announce.ts`; `recordToolAnnounce` in `lib/src/lib/tool-announce-store.ts`; `recordToolEvents` in `lib/src/lib/tool-events.ts`; `createOwnerPtyStream` in `vscode-ext/src/message-router.ts`; `ownerStream` in `lib/src/host/remote/sidecar-entry.ts`. Tests: `lib/src/lib/tool-announce.test.ts`, `standalone/scripts/dev-agent-browser-announce.test.mjs`.
+Source of truth: `TerminalProtocolParser` / `collectTerminalToolEvents` in `lib/src/lib/terminal-protocol.ts`; `parseToolAnnounce` in `lib/src/lib/tool-announce.ts`; `recordToolAnnounce` in `lib/src/lib/tool-announce-store.ts`; `recordToolEvents` in `lib/src/lib/tool-events.ts`; `createOwnerPtyStream` in `lib/src/host/owner-pty.ts`. Tests: `lib/src/lib/tool-announce.test.ts`, `lib/src/host/remote/sidecar-entry.test.ts`, `vscode-ext/test/message-router.test.ts`, `standalone/scripts/dev-agent-browser-announce.test.mjs`.
 
 ## Unsaved changes
 
diff --git a/docs/specs/layout.md b/docs/specs/layout.md
index 8d0e32077..0ba107494 100644
--- a/docs/specs/layout.md
+++ b/docs/specs/layout.md
@@ -483,7 +483,7 @@ Startup recovery is priority-based:
 **A Window plans once per Workspace off one live-PTY list**: `collectLivePtys` runs the single PTY-list round trip for the whole webview, and each Workspace takes the slice its own saved panes name, so one host answer restores N Workspaces (`docs/specs/standalone.md` → Persistence). A single-Wall host reaches the same behavior through `resumeOrRestore`.
 
 1. **Resume** (webview recreated, retained Live or Exited PTYs): request PTY list + replay data from the platform, `resumeTerminal()` each (500ms timeout). **Saved pane and door titles are seeded back via `setTerminalUserTitle()`** (`docs/specs/transport.md`), so persisted placeholder labels never replay as user pins. If the saved session covers every retained PTY, restore the saved Lath layout when its leaf set matches and reattach saved minimized items as doors. **Never fall through to cold restore just because the visible `paneIds` list is empty** — a wall whose retained sessions are all minimized is still a resume.
-2. **Restore** (app restart, cold start): the Wall's `seed` hydrates from the restored Lath layout, else falls to (3); `restoreTerminal()` per pane with its saved cwd and title, plus the single-use agent resume invocation the host captured (`docs/specs/transport.md` → "Consuming it") and, on a host that cannot seed itself (standalone), the pane's persisted TODO through `PlatformAdapter.alertSeed`, sent after the spawn. Browser surfaces are rebuilt from their persisted params instead.
+2. **Restore** (app restart, cold start): the Wall's `seed` hydrates from the restored Lath layout, else falls to (3); `restoreTerminal()` per pane with its saved cwd and title, plus the single-use agent resume invocation the host captured (`docs/specs/transport.md` → "Consuming it") and the pane's persisted TODO, which rides the spawn (`docs/specs/alert.md` → Public State). Browser surfaces are rebuilt from their persisted params instead.
 3. **Fallback/manual pane creation**: with no saved layout safely applicable, add panes as splits from the previous pane.
 4. **Empty state**: one new pane.
 
diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index d23c4fefc..0674d3861 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -175,7 +175,7 @@ Source of truth: `standalone/sidecar/package.json`,
 
 **The bridge.** Webview → sidecar is one generic passthrough invoke,
 `burrow_command(payload)`, writing `{"event":"burrow:command",
-"data":payload}` to stdin for the dispatch table's `handleCommand`. Sidecar →
+"data":payload}` to stdin for `createSidecarHost`. Sidecar →
 webview is three ordinary stdout events — `burrow:result`, `burrow:ask`,
 `burrow:event` — forwarded by Rust's generic `handle.emit`. **The correlation
 field is `burrowRequestId`, never `requestId`**: Rust swallows any sidecar line whose
@@ -208,7 +208,7 @@ rather than being dropped (`docs/specs/remote-api.md` → Directory).
 **The sidecar owns the parse**, standalone's only one
 (`docs/specs/terminal-escapes.md` → Parsing location, which owns the rules): a
 `pty-core` `data` event reaches the webview as the `pty:data`,
-`terminal:semanticEvents` and `terminal:protocolEvents` the bridge emits, never
+`terminal:semanticEvents` and `terminal:toolEvents` the bridge emits, never
 raw, and every attached Client and the app's `AlertManager` (§Alerts) read the
 same parse. **The webview pushes its
 resolved terminal colours** (`pty_theme_colors` → `pty:themeColors`) because this
@@ -226,56 +226,49 @@ before attach acknowledgement, and **a spawn or an exit retires that PTY
 generation's parser** so a half-read sequence cannot splice onto the next one.
 
 Source of truth: `lib/src/host/remote/service.ts`,
-`createSidecarSurfaceBridge` in `lib/src/host/remote/sidecar-entry.ts`,
-`standalone/sidecar/main.js` (the tap and the `burrow:command` case),
+`createSidecarSurfaceBridge` / `createSidecarHost` in
+`lib/src/host/remote/sidecar-entry.ts`, `standalone/sidecar/main.js` (the tap),
 `burrow_command` / `burrow_state_dir` / `pty_theme_colors` in
 `standalone/src-tauri/src/lib.rs`.
 
 ### Alerts
 
-The app's one `AlertManager` runs **in the sidecar**, beside the PTYs and the
-parse that feeds it, as VS Code's runs in its extension host
-(`docs/specs/vscode.md`); every window is one of its viewers
-(`docs/specs/alert.md` → Engagement) (rationale).
-
-- **Must feed it at the parse**, per batch: reports and command boundaries in
-  stream order (`applyTerminalEvents`), then visible output, and each exit. The
-  webview gets the semantic and Tool events alone; **never apply a report in a
-  webview**.
-- **Must start a respawned id's alert state over at `pty:spawn`**, ahead of the
-  cold-restore seed the webview sends after the spawn. Helper status mirrors
-  `pty-core` after each spawn and promotion (`isHelper`).
-- **Webview → sidecar is one passthrough, `alert_command(payload)`**, carrying
-  every `alert*` platform verb as an op (`AlertCommand` in
-  `lib/src/host/alert-protocol.ts`). **Rust stamps the invoking window's label**
-  on it as `window`, exactly as on `burrow_command`: the label is the viewer id
-  and the owner of the awaits a window parks.
-- **Human input rides its write**: `pty_write` carries `userInput`, and the
-  sidecar acknowledges before writing — never a separate `alert_command`. A
-  Client's write through the Burrow acknowledges the same way, and a Client's
-  repaint resize gets the resize grace.
-- **`hello` ends a label's previous realm** — sent at adapter init, a reload
-  keeping the label: its viewer is removed, its parked awaits cancelled and
-  answered. **A label gone from `burrow:windows` gets the same.**
-- **Sidecar → webview**: `alert:state {id, …}` on every change, routed to the
-  Session's owner (§Routing); `alert:awaitResult {awaitId, window, outcome}`,
-  broadcast and matched by the asking adapter's own random `awaitId` — **never
-  carrying a Session `id`**, which would route it to that Session's owner, **nor
-  a `requestId`**, which Rust swallows; and the two app-global stores' snapshots
-  (`docs/specs/alert.md` → Alarm settings).
+The sidecar runs the alerts' host role (`docs/specs/alert.md`), the same
+`createAlertHost` VS Code's extension host runs, beside the PTYs and the parse
+that feeds it: one `AlertManager`, every window a realm under its label
+(rationale).
+
+- **Must offer every stdin line to `createSidecarHost`'s `handleCommand` before
+  `main.js` dispatches it**: it owns the PTY commands the alerts must see —
+  spawn, input, resize, kill, reap, `pty:requestInit` — every alert and Burrow
+  command, the theme push.
+- **Webview → sidecar is one passthrough, `alert_command(payload)`**, and **Rust
+  stamps the invoking window's label on it as `window`**, over any the payload
+  claimed, exactly as on `burrow_command`. **An unstamped `alert:command` is
+  ignored.** Human input rides `pty_write`'s `userInput` instead
+  (`docs/specs/alert.md` → Engagement).
+- **`hello` at adapter init ends the label's previous realm**, a reload keeping
+  the label; **a label gone from `burrow:windows` ends its realm too.**
+- **An await's answer carries `forWindow`**, the label that parked it, which
+  Rust routes it to — **never a Session `id`**, which would route it to that
+  Session's owner, **nor a `requestId`**, which Rust swallows (rationale).
 - **Must re-send each listed Session's `alert:state` behind the answer to
   `pty:requestInit`**: a reloaded window and an arriving Workspace learn their
-  rings and TODOs nowhere else, since a live resume seeds nothing.
-- **A disposing adapter settles its own parked awaits `cancelled`.**
-
-Source of truth: `createSidecarAlerts` in `lib/src/host/alert-host.ts`;
-`createSidecarAlertClient` in `lib/src/host/alert-client.ts`;
-`createSidecarSurfaceBridge` in `lib/src/host/remote/sidecar-entry.ts`;
-`alert_command` / `pty_input_message` / `stamp_window` in
-`standalone/src-tauri/src/lib.rs`; the `pty:spawn`, `pty:input` and
-`pty:requestInit` cases in `standalone/sidecar/main.js`. Pinned by
-`lib/src/host/alert-host.test.ts`, `lib/src/host/alert-client.test.ts` and
-`standalone/sidecar/main-wiring.test.js`.
+  rings and TODOs nowhere else. A `sync` re-sends every Session's, and Rust
+  routes each to its owner.
+- **Rust passes a spawn's `options.alert` through opaque**
+  (`a_spawn_carries_its_persisted_alert_to_the_sidecar`); the sidecar seeds from
+  it (`docs/specs/alert.md` → Public State) and strips it before `pty-core`.
+- **`pty-core` is the one source of helper status**, reporting each spawn's
+  validation and each successful promotion through `onHelper`.
+
+Source of truth: `createSidecarHost` in `lib/src/host/remote/sidecar-entry.ts`;
+`create` in `standalone/sidecar/pty-core.js`; `alert_command` /
+`forward_stamped` / `stamped_message` / `pty_input_message` /
+`pty_spawn_message` in
+`standalone/src-tauri/src/lib.rs`. Pinned by `the sidecar host` in
+`lib/src/host/remote/sidecar-entry.test.ts` and
+`standalone/src/sidecar-adapters.test.ts`.
 
 ### Windows node subsystem
 
@@ -320,10 +313,10 @@ ordered**:
    headed Chrome window, and a hung agent-browser must not wedge the exit (as in
    the VS Code host's `deactivate()`; `docs/specs/dor-browser.md`).
 2. Close the dor control socket.
-3. `alerts.dispose()` (§Alerts).
-4. Dispose the Burrow service, dropping the relay socket and settling every
-   outstanding ask so nothing waits on a webview that is going away.
-5. `mgr.killAll()` (all PTYs), then `process.exit(0)`.
+3. `host.dispose()`: the alerts (§Alerts), then the Burrow service, dropping
+   the relay socket and settling every outstanding ask so nothing waits on a
+   webview that is going away.
+4. `mgr.killAll()` (all PTYs), then `process.exit(0)`.
 
 **A parent-PID watchdog polls every 2s** and self-triggers shutdown if the Tauri
 process disappears: stdin EOF is not always delivered when the host is
@@ -475,34 +468,37 @@ Source of truth: `standalone/src-tauri/src/workspaces.rs`;
 
 ### Routing
 
-Source of truth: `route` in `standalone/src-tauri/src/routing.rs`,
-`dispatch_sidecar_event` in `standalone/src-tauri/src/lib.rs`.
+*Showing* an id is the source still consuming it until its transfer mark, otherwise its owner.
 
 | Sidecar event | Key | Goes to |
 |---|---|---|
-| `pty:data` | `data.id` | its owner; the source until the id's mark passes, then dropped until its replay, its bytes being in it |
-| `terminal:semanticEvents` | `data.id` | its owner; the source until the id's mark passes, then dropped until its replay — the window receiving the replay re-derives them from it (rationale) |
-| `terminal:protocolEvents` | `data.id` | its owner; the source until the id's mark passes, then **held** and delivered, in order, behind the replay — or by a fail-open sweep, which sends none; at most `HELD_EVENTS_MAX` (256) per id, the oldest dropped past it (`held_events_come_back_in_order_and_bounded`) |
-| `pty:exit` | `data.id` | its owner, never suppressed |
+| `pty:data`, `terminal:semanticEvents`, `terminal:toolEvents` | `data.id` | the window showing it; after the mark, dropped until its replay, which carries the bytes and from which the receiving window re-derives the events (rationale) |
+| `pty:exit` | `data.id` | the window showing it, never suppressed |
 | `pty:replay` | `data.forWindow`, then `data.id` | the requesting window, including exited buffers; without an address, its owner; never suppressed |
-| `pty:marked` | `data.id` | the source still consuming the id, which then falls silent until its replay; otherwise its owner |
+| `pty:marked` | `data.id` | the window showing it; the id then falls silent until its replay |
 | `pty:list` | `data.forWindow` | the window that asked |
-| `alert:*` carrying `data.id` | `data.id` | its owner; the source until the id's mark passes (`an_exited_pty_stays_owned_until_it_is_killed`) |
+| `alert:*` | `data.forWindow`, then `data.id` | that window; else the window showing the Session; neither → every window |
 | `dor:controlRequest` | `params.workspace`, `params.window`, `data.surfaceId` | in that precedence: the window holding the named Workspace (§Workspace registry), the named window, the caller's Surface's owner; none → the focused window |
 | `dor:controlCancel` | `data.requestId` | the window its request went to; unknown → every window |
 | `burrow:ask` | `data.params.surfaceId` | its owner; a Surface with no PTY here, or an ask naming none, → every window (§Burrow service) |
 | everything else | — | every window |
 
 - **Ownership is minted only in `pty_spawn`**, dropped by `pty_kill` or the
-  window going away, and reassigned by a transfer. **Never dropped by an exit**:
-  the exited pane is still shown, and its `alert:state` must still reach it.
-  Minting also clears any suppression left under that id: no replay is coming
-  for a fresh PTY.
-- **A PTY event no window owns is dropped, and the shell is reaped.** Every PTY
-  is owned until killed, so an unowned id is one whose window went away, and a
-  broadcast would hand every sibling state for a pane none of them shows.
-  `Destroyed` SIGTERMs whatever the departing window still owned, which is what
-  the close ack-timeout path never killed.
+  window going away, and reassigned by a transfer. **Never dropped by an exit,
+  nor does an exit end a transfer's marking phase**: the exited pane is still
+  shown, its `alert:state` must still reach it, and the sidecar marks an exited
+  id like a live one (rationale; `an_exited_pty_stays_owned_until_it_is_killed`,
+  `an_exit_before_the_mark_leaves_the_transfer_to_finish`). Minting also clears
+  any suppression left under that id: no replay is coming for a fresh PTY.
+  `pty_kill` drops the owner before the sidecar removes the Session's alert
+  entry, so the removal's state reaches no window.
+- **A PTY event no window owns is dropped, and the shell is reaped.** An
+  unowned id is one whose window went away, and a broadcast would hand every
+  sibling state for a pane none of them shows. `Destroyed` sends `pty:reap` for
+  whatever the departing window still owned — the close ack-timeout path killed
+  nothing — and the sidecar removes those Sessions' alert entries and SIGTERMs
+  them. **The quit teardown's `pty:gracefulKill` removes no entry**: windows
+  still show those PTYs (`an_orphan_reap_removes_the_sessions_it_kills`).
 - **A `dor` request naming a Surface no window owns is answered with an error**
   — `No Dormouse window owns surface '<id>'` — never handed to a sibling, since
   acting on the wrong terminal is worse than failing.
@@ -523,6 +519,9 @@ Source of truth: `route` in `standalone/src-tauri/src/routing.rs`,
 - **The focus order is the fallback owner** for a `dor` request naming no
   Surface, and the drag hit test's stand-in for a z-order the OS does not expose.
 
+Source of truth: `route` / `showing` in `standalone/src-tauri/src/routing.rs`;
+`dispatch_sidecar_event` / `pty_reap_message` in `standalone/src-tauri/src/lib.rs`.
+
 ### Boot and geometry
 
 **Boot reopens every window `sessions/` names**, `main` first (already up from
@@ -706,10 +705,9 @@ below reads that record rather than inferring itself from the suppression map.
    `pty:requestInit` with **that arrival's ids and no others**; `pty:list` and
    each `pty:replay` echo the collector's token. The target resumes over them,
    hydrates the notes and mounts the Workspace at the payload’s index, else the drop index.
-   **Never seeds or removes alert state**: it never left the sidecar, whose
-   answer to that `pty:requestInit` re-sends it (§Alerts; `never seeds or
-   removes the host's alert state for an arrival` in
-   `standalone/src/workspace-move.test.ts`).
+   **Never spawns or kills**: the Sessions' alert state never left the
+   sidecar, whose answer to that `pty:requestInit` re-sends it (§Alerts;
+   `docs/specs/alert.md` → Live Workspace transfer).
 4. **Target adopted** invokes `adopt_done(workspaceId)`. Rust retires the record,
    clears pending marks and suppression so live output routes to the target,
    and emits `workspace-departed` for
@@ -735,8 +733,8 @@ below reads that record rather than inferring itself from the suppression map.
   target releases its Sessions (never kills them), drops the notes, and closes
   the Workspace rather than leaving it live and persisted in two windows. **Must unwind from the received payload without preparing another move.**
 - **Must remove this window's unmounted semantic and Activity state when arrival
-  collection times out**, and never the host's alert entries, which the source
-  goes on showing. Source of truth: `discardArrival` in
+  collection times out**, and kill nothing: the source goes on showing those
+  Sessions. Source of truth: `discardArrival` in
   `standalone/src/workspace-move.ts`.
 - **A refused arrival hands the shells back.** The target's `adopt_failed`
   (a `planArrival` timeout, a missing list, a mount error) and a target
@@ -756,12 +754,13 @@ below reads that record rather than inferring itself from the suppression map.
   returns each id the content marked to the source *suppressed* and asks the
   sidecar for `outputSince(mark)` scoped to the source (`requestId`
   `handback-<workspaceId>`); that replay lifts the suppression and lands in the
-  existing xterms (`acceptHandBackReplay`), the held Tool events behind it.
+  existing xterms (`acceptHandBackReplay`).
   **Must record source cuts at `pty:marked`, retaining them through target
   replay and natural PTY exit until settlement, and carry replay ids in the failure event**; content
   submission and the source invoke reply may both still be pending. **Must discard
-  cuts on explicit kill**; an exited PTY is still owned, so a hand-back returns
-  it to the source like a live one (`a_pty_exit_keeps_its_cut_until_the_arrival_settles`).
+  cuts on explicit kill**; an exited PTY is still owned (§Routing), so a
+  hand-back returns it to the source like a live one
+  (`a_pty_exit_keeps_its_cut_until_the_arrival_settles`).
   **Must apply a handed-back PTY’s exit status after its replay**, leaving its
   existing pane dead with no running command
   (`settles the replayed command when a marked buffer belongs to an exited PTY` in
@@ -1343,6 +1342,6 @@ The bridge is a transport shim over the same sidecar protocol, not a second PTY
 
 **A CORS preflight is the one carve-out**: an `OPTIONS` answers `204` carrying those headers *before* the token check, since it can never present the non-GET content type the gate demands. **Any other unauthorized caller gets the same `404 not found` as an unknown path**, so the port does not identify itself. The harness prints the token and a ready-made `curl` on startup.
 
-The harness **may omit** native-only desktop chrome (window controls, update checks) but **must preserve** every `PlatformAdapter` contract the app uses — PTY, control-request, clipboard, iframe-proxy, Burrow, agent-browser, and the sidecar's alerts (`alert_command` in, stamped with the one window label the harness simulates, `main`; their events back; §Alerts) — so a rule that only holds across the host boundary is exercised rather than answered by a private copy. **`BrowserSidecarHost.init()` resolves on the SSE stream being open, not on its construction**, so a seed cannot precede the stream that carries its reply; **must let retryable connection failures reconnect within the open timeout**; after a reconnect the adapter re-sends its last seeds so the stores republish (`resolves on the stream's open event, not on construction` in `standalone/src/browser-sidecar-host.test.ts`; `re-sends its last seeds when the event stream reconnects` in `standalone/src/browser-sidecar-adapter.test.ts`). Fatal startup handling follows §Boot sequence. It **must mirror** standalone's Session-persistence answer (`docs/specs/transport.md` → "The governing rule"): one `PersistedWindow` per window, in `localStorage` rather than the Rust file store, and the same agent-recovery *claim* against a per-run temp state directory. **The harness must never capture**: a reload there is a live resume over PTYs that survive it, and capture is a quit-only step (§Agent recovery). **Tauri APIs must not be required at static module-evaluation time** when `VITE_DORMOUSE_BROWSER_DEV_HOST` is set — a normal browser loads the page, not the Tauri WebView.
+The harness **may omit** native-only desktop chrome (window controls, update checks) but **must preserve** every `PlatformAdapter` contract the app uses — PTY, control-request, clipboard, iframe-proxy, Burrow, agent-browser, and the sidecar's alerts (`alert_command` in, stamped with the one window label the harness simulates, `main`; their events back; §Alerts) — so a rule that only holds across the host boundary is exercised rather than answered by a private copy. **`BrowserSidecarHost.init()` resolves on the SSE stream being open, not on its construction**, so a seed cannot precede the stream that carries its reply; **must let retryable connection failures reconnect within the open timeout**; after a reconnect the adapter sends `sync`, since whatever the sidecar sent while the stream was down is gone (`resolves on the stream's open event, not on construction` in `standalone/src/browser-sidecar-host.test.ts`; `asks the sidecar to sync when the event stream reconnects` in `standalone/src/browser-sidecar-adapter.test.ts`). Fatal startup handling follows §Boot sequence. It **must mirror** standalone's Session-persistence answer (`docs/specs/transport.md` → "The governing rule"): one `PersistedWindow` per window, in `localStorage` rather than the Rust file store, and the same agent-recovery *claim* against a per-run temp state directory. **The harness must never capture**: a reload there is a live resume over PTYs that survive it, and capture is a quit-only step (§Agent recovery). **Tauri APIs must not be required at static module-evaluation time** when `VITE_DORMOUSE_BROWSER_DEV_HOST` is set — a normal browser loads the page, not the Tauri WebView.
 
 Source of truth: `standalone/scripts/dev-agent-browser.mjs`, `standalone/scripts/dev-run.mjs`, `standalone/scripts/dev-host-guard.mjs`, `standalone/src/browser-sidecar-host.ts`, `standalone/src/browser-sidecar-adapter.ts`; `stepBurrow` in `scripts/pairing-walkthrough/steps.mjs`; `sessionForKey` in `dor-lib-common/src/agent-browser.ts`.
diff --git a/docs/specs/standalone.rationale.md b/docs/specs/standalone.rationale.md
index 867a37215..f57e68fe1 100644
--- a/docs/specs/standalone.rationale.md
+++ b/docs/specs/standalone.rationale.md
@@ -8,13 +8,9 @@
 
 ## Alerts
 
-**Why one manager per host process, beside the PTYs.** Each window used to run its own `AlertManager` in its webview, fed from events the sidecar had already parsed. Three failures followed from where it lived (audit, 2026-09-23): WKWebView throttles a background window's timers, so the detector, deferral and await timers of a window the user was not looking at ran late — exactly the window a completion should summon them back to; a reload started the webview with an empty manager and a live resume seeds nothing, so every ring and TODO in the window vanished; and a Workspace transfer had to freeze one window's manager and thaw it in another (alert.md → Live Workspace transfer). VS Code never had these, because its manager lives in the extension host beside the PTYs and the parse. Moving standalone's there makes the two hosts one shape: the parse feeds one manager in stream order, the Burrow's remote writes reach it in the same process, and a window is only a viewer whose state is routed to it.
+**Why one manager per host process, beside the PTYs.** Each window used to run its own `AlertManager` in its webview, fed from events the sidecar had already parsed. Three failures followed from where it lived (audit, 2026-09-23): WKWebView throttles a background window's timers, so the detector, deferral and await timers of a window the user was not looking at ran late — exactly the window a completion should summon them back to; a reload started the webview with an empty manager and a live resume seeds nothing, so every ring and TODO in the window vanished; and a Workspace transfer had to snapshot the ring, its episode, the detector deadlines and the deferred notification into the transfer content, resume them in the target, and bind a replay token so the since-mark replay's reports fired once. VS Code never had these, because its manager lives in the extension host beside the PTYs and the parse. Moving standalone's there made the two hosts one shape, now one module (`createAlertHost`): the parse feeds one manager in stream order, the Burrow's remote writes reach it in the same process, and a window is only a viewer whose state is routed to it.
 
-**Why `userInput` rides the write.** The echo of a keystroke comes back from the PTY within milliseconds, so the acknowledgement that opens the echo window has to be in effect before the bytes are written. As a second command it would race the write through Rust and the sidecar's stdin, and an echo that won would count as the program working.
-
-**Why an exited PTY stays owned.** Ownership used to end at the exit, since nothing more was emitted for a dead PTY. The sidecar's manager now publishes `alert:state` for it whenever the user acts on the exited pane — a dismiss, a TODO cleared — and a line for an unowned id is dropped, so the pane would ring until it was closed.
-
-**Why an await's result is broadcast.** Routed by the Session's `id` it would reach the Session's owner, not the window that parked it, and a `requestId` is what Rust's invoke matcher swallows. Each adapter mints a random `awaitId`, so a broadcast reaches the one that asked and no other can mistake it — the argument `burrowRequestId` makes for the Burrow's results.
+**Why an await's answer names its window.** Routed by the Session's `id` it would reach the Session's owner, not the window that parked it, and a `requestId` is what Rust's invoke matcher swallows. It was broadcast at first, each adapter matching its own random `awaitId`; `forWindow` routes it the way `pty:list` is routed, so no other window sees it (2026-09).
 
 ## Windows node subsystem
 
@@ -57,16 +53,9 @@ minted in `pty_spawn`, so an unowned id is one whose window went away, and the
 broadcast reached every sibling's AlertManager — which rang, and offered a TODO,
 for a pane none of them showed.
 
-The first hold queued both derived streams, on the premise that neither is in
-any replay. Semantic events are: the replay is the raw bytes, OSCs included, and
-the target's replay listener re-parses them. The flushed queue then re-applied
-`commandStart` on top of state the replay had just rebuilt, and `commandStart`
-is not idempotent — it mints a fresh id and consumes the pending command line —
-so a transfer that split a command's `commandLine` from its `commandStart` left
-the arriving window with a derived title for a command whose real line the
-replay had already recovered. What the replay path genuinely did not rebuild was
-the AlertManager's copy, and that was a listener fix, not a routing one — until
-the manager moved into the sidecar, whose own parse feeds it (§Alerts, 2026-09).
+**Why an exited PTY stays owned.** Ownership used to end at the exit, since nothing more was emitted for a dead PTY. The sidecar's manager publishes `alert:state` for it whenever the user acts on the exited pane — a dismiss, a TODO cleared — and a line for an unowned id is dropped, so the pane would ring until it was closed. An exit before a transfer's mark used to end the marking phase and go to the target, so the `pty:marked` behind it went there too, and the source — which serializes the pane at that line — never saw its mark (2026-09).
+
+**Why the derived streams are dropped, never held.** The first hold queued both, on the premise that neither is in any replay. They are: the replay is the raw bytes, OSCs included, and the receiving window re-parses them. The flushed queue re-applied `commandStart` on top of state the replay had just rebuilt, and `commandStart` is not idempotent — it mints a fresh id and consumes the pending command line — so a transfer that split a command's `commandLine` from its `commandStart` left the arriving window with a derived title for a command whose real line the replay had already recovered. A hold kept for the Tool events alone served only the fail-open sweep, which fires only for suppressions no arrival claims (§Arrival queue), and it went (2026-09).
 
 ## What a window's `Destroyed` settles
 
diff --git a/docs/specs/terminal-escapes.md b/docs/specs/terminal-escapes.md
index d5776b9bb..c517d8930 100644
--- a/docs/specs/terminal-escapes.md
+++ b/docs/specs/terminal-escapes.md
@@ -18,29 +18,29 @@
 
 ## Parsing location
 
-State-driving and security-sensitive OSCs — plus the `CSI > q` query — are parsed by the process that owns the PTY: **one parser per PTY generation, fed from spawn, never one per consumer**, because **a second over the same bytes answers every query twice and writes the duplicate into the PTY's input**. One site per host — the VS Code extension host (`ptyManager.addCallbacks`), the standalone sidecar (`main.js`'s `pty-core` tap) — each ahead of `pty:data`; the fake adapter is the same rule with the owner in the browser.
+State-driving and security-sensitive OSCs — plus the `CSI > q` query — are parsed by the process that owns the PTY: **one parser per PTY generation, fed from spawn, never one per consumer**, because **a second over the same bytes answers every query twice and writes the duplicate into the PTY's input**. One site per host, the same `createOwnerPtyStream` in both — the VS Code extension host and the standalone sidecar — each ahead of `pty:data`; the fake adapter is the same rule with the owner in the browser.
 
 **Must buffer an unterminated consumed OSC up to `OSC_INCOMPLETE_LIMIT` (16,384 UTF-16 code units), then discard through its terminator or cancellation**, retaining only a split `ESC`, never promoting payload to text or its terminating BEL to an alert (rationale). A complete sequence in a single read is parsed whole. Pinned by `discards an oversized consumed OSC through its %j terminator` in `lib/src/lib/terminal-protocol.test.ts`. **An unterminated OSC the parser will forward streams to xterm.js instead**, preserving a split `ESC \` terminator (rationale). **Route by the OSC id, and decide nothing while more digits could follow** — `133` becomes `1337` — for `1337` by the subcommand ([Inline graphics](#inline-graphics)).
 
 **Every semantic value `TerminalProtocolParser` *retains* is bounded and stripped of control characters before storage**, whatever the emitter: `TITLE_LIMIT` / `BODY_LIMIT` for titles and notification bodies, whose whitespace controls collapse to spaces before the trim; `COMMAND_LINE_LIMIT` for the command line (`OSC 633 ; E`, `OSC 133 ; C`), bounded *before* its decoding and sanitized *after* it (rationale), **line breaks kept as `\n`**; `MAX_CWD_LENGTH` for every CWD source, interior whitespace preserved. **Every limit counts code points**, so a cut never splits a surrogate pair. **A value that reduces to nothing is dropped, never stored empty.**
 
-**The owner alone acts on the events** its parse produced — writing the responses, feeding its `AlertManager`, recording the semantic state — and hands every consumer the same chunk ([remote-api.md](remote-api.md#terminal-surfaces)).
+**The owner alone acts on the events** its parse produced — writing the responses, feeding its `AlertManager`, forwarding the semantic and Tool events to the owning renderer — and hands every consumer the same chunk ([remote-api.md](remote-api.md#terminal-surfaces)).
 
 **A sink that subscribes inside a forwarded string control starts at the next ground byte**, a cancel releasing it as surely as a terminator (rationale); only a late attachment is ever held, the owner's renderer being there from spawn.
 
 **The owner splits a PTY read above `MAX_PARSER_INPUT_CHARS` (64 Ki UTF-16 code units) before parsing it, and never through a surrogate pair**, so **both** projections — one message, not two — fit the 1 MiB application-message cap after base64url and JSON framing (rationale; [remote-api.md](remote-api.md)).
 
-Source of truth: `oscDispositionAt` in `lib/src/lib/terminal-protocol.ts`, `boundedCwdValue` in `lib/src/lib/terminal-state.ts`, `createProcessedPtyStream` in `lib/src/lib/processed-pty-stream.ts`, `lib/src/host/remote/sidecar-entry.ts`.
+Source of truth: `oscDispositionAt` in `lib/src/lib/terminal-protocol.ts`, `boundedCwdValue` in `lib/src/lib/terminal-state.ts`, `createProcessedPtyStream` in `lib/src/lib/processed-pty-stream.ts`, `createOwnerPtyStream` in `lib/src/host/owner-pty.ts`.
 
 ### `pty:data` strip semantics
 
 **Supported semantic sequences are consumed and never re-emitted** — empty or unparseable payloads, unrecognized `OSC 1337` subcommands and `OSC 50` / `OSC 52` included. **`OSC 8` and the recognized ImageAddon `OSC 1337` forms are the exceptions**: they stay in `pty:data` so xterm.js owns hyperlink regions and inline graphics. Dormouse supplies only the hyperlink activation-confirmation handler. Every other OSC family passes through unchanged, so xterm.js handles standard behavior Dormouse does not model.
 
-**`textData` is the same chunk with every string-control payload removed**, for consumers reading output as text; every other control is left for `stripTerminalControls`. The webview receives them apart: `pty:data` (the stripped output; feeds xterm.js) and `terminal:semanticEvents` (normalized CWD / prompt-command / title events; feeds `TerminalPaneState`, command boundaries also feeding command-exit alerting in [alert.md](alert.md#command-exit-track)). **Notification-derived state never travels as `pty:data`**: the parse site feeds its own process's `AlertManager`.
+**`textData` is the same chunk with every string-control payload removed**, for consumers reading output as text; every other control is left for `stripTerminalControls`. The webview receives them apart: `pty:data` (the stripped output; feeds xterm.js), `terminal:semanticEvents` (normalized CWD / prompt-command / title events; feeds `TerminalPaneState`), and `terminal:toolEvents` (OSC 367, [dor-tool.md](dor-tool.md#osc-367)). **Notification-derived state never travels as `pty:data`**: the parse site feeds its own process's `AlertManager`.
 
 Each chunk is also classified for the quiesce detector: **the activity monitor's `onData()` fires only when `visibleData` is non-empty**, so a chunk of nothing but notification/progress OSCs is not meaningful output, while one carrying visible output alongside them is.
 
-Replay (`pty:replay`) is the raw stream requiring re-parse: **the webview runs a one-shot parser over the buffered bytes**, so semantic state repopulates and OSCs are stripped before xterm sees them. **Historical replay must not re-fire** alerts, quiesce events, protocol notifications, or query responses — it applies the semantic and Tool events and drops the rest (rationale). **Every parser in a realm holding the theme takes `themeColorProvider`**, one-shot replay parsers included: a *declined* query stays in `visibleData` for the receiving renderer to answer, and answering is the owner's alone (rationale).
+Replay (`pty:replay`) is the raw stream requiring re-parse: **the webview runs a one-shot parser over the buffered bytes** (`parseReplay` in `lib/src/lib/platform/replay-parse.ts`), so semantic state repopulates and OSCs are stripped before xterm sees them. **Historical replay must not re-fire** alerts, quiesce events, protocol notifications, or query responses — it applies the semantic and Tool events and drops the rest (rationale). **Every parser in a realm holding the theme takes `themeColorProvider`**, one-shot replay parsers included: a *declined* query stays in `visibleData` for the receiving renderer to answer, and answering is the owner's alone (rationale).
 
 ## Supported OSCs
 
diff --git a/docs/specs/terminal-escapes.rationale.md b/docs/specs/terminal-escapes.rationale.md
index 318e4b0b1..fb9a3041c 100644
--- a/docs/specs/terminal-escapes.rationale.md
+++ b/docs/specs/terminal-escapes.rationale.md
@@ -14,7 +14,7 @@
 
 **Why `COMMAND_LINE_LIMIT` is applied on both sides of the unescape.** Bounding first stops a hostile command line from making the unescape allocate; sanitizing after catches the `\xNN` decoding, which is precisely what puts control characters back into a value that looked clean going in.
 
-**Why the sidecar no longer parses a second time.** It used to: standalone stripped in the frontend adapter, which the sidecar's stream to the phone never passed through, so without a second strip-only pass the phone saw OSC sequences the laptop never rendered. That pass needed a fake colour provider — "discarded" and "not parsed" are different things, and a *declined* OSC 10/11/12 survives in `visibleData` for the phone's xterm to answer a second time — and it began at first attach, so it could start mid-sequence. One parse at the process that owns the PTY removes the duplicate, the workaround, and the mid-sequence start together. What it costs is the theme push, since the sidecar has no DOM, and a webview that is told the semantic and notification events rather than deriving them.
+**Why the sidecar no longer parses a second time.** It used to: standalone stripped in the frontend adapter, which the sidecar's stream to the phone never passed through, so without a second strip-only pass the phone saw OSC sequences the laptop never rendered. That pass needed a fake colour provider — "discarded" and "not parsed" are different things, and a *declined* OSC 10/11/12 survives in `visibleData` for the phone's xterm to answer a second time — and it began at first attach, so it could start mid-sequence. One parse at the process that owns the PTY removes the duplicate, the workaround, and the mid-sequence start together. What it costs is the theme push, since the sidecar has no DOM, and a webview that is told the semantic and Tool events rather than deriving them.
 
 **Why a late sink waits for ground.** An image is many PTY reads, and the renderer behind a sink is a real xterm: handed `AAAA…BEL` with no `OSC 1337;File=` in front of it, it paints the base64. Holding that sink to the next ground byte costs it the one image it landed inside and nothing else — the alternative, replaying the payload from its introducer, means retaining megabytes per PTY against the chance that someone attaches.
 
diff --git a/docs/specs/transport.md b/docs/specs/transport.md
index 00c48d84a..41ea6b08f 100644
--- a/docs/specs/transport.md
+++ b/docs/specs/transport.md
@@ -41,9 +41,10 @@ Platform host (always running while the adapter is active)
     └── message-router: owns pty-3
 ```
 
-**Every host is multi-webview.** Ownership is what keeps one webview's traffic
-out of another's, and each host owns the map: `docs/specs/vscode.md` → "Peer
-surfaces across windows", `docs/specs/standalone.md` → Routing.
+**Every host is multi-webview**, and **a router never takes a PTY another
+owns**: ownership keeps one webview's traffic out of another's, and each host
+owns the map (`docs/specs/vscode.md` → "Peer surfaces across windows",
+`docs/specs/standalone.md` → Routing).
 
 - **Hiding a webview does not kill its PTYs**, and becoming visible again resumes over the still-owned ones ("Reconnection protocol").
 - **A naturally exited PTY may stay mounted as an exited pane**; frontend semantic state — CWD, title candidates, last command — is retained until the Session is disposed.
@@ -118,8 +119,7 @@ with these transfer rules:
 
 - **Release, never dispose, and only once the target has adopted the Workspace.**
   The source detaches its half of each Session — the pins, the listeners, the
-  element, the xterm instance — and **neither kills the PTY nor removes its
-  host alert entry**
+  element, the xterm instance — and **never kills the PTY**
   (`releaseSession` in `lib/src/lib/terminal-lifecycle.ts`). **Never reachable
   from a webview unmount**: a Wall unmounts on a reload and on a StrictMode
   double-mount, and releasing there would strand every PTY the window still owns.
@@ -202,14 +202,17 @@ Transport constraints:
 | Host → webview | `pty:openPorts` | `ports: OpenPort[]` (`{ protocol, family, address, port, pid, processName }`), de-duplicated by `(family, address, port)`, sorted by port then address. Empty when the PTY is gone or enumeration fails. |
 | Host → webview | `pty:data` | PTY output after state-driving supported OSCs are parsed/stripped; `OSC 8` and ImageAddon's inline-image `OSC 1337` forms are preserved for xterm.js, routed only to the owning router. **Carries an optional `textData`** (string-control payloads removed, for the prompt heuristic), **omitted when it would equal `data`**. |
 | Host → webview | `terminal:semanticEvents` | Normalized CWD / prompt-command / title events the owner's parser derived, in stream order. |
-| Host → webview | `terminal:protocolEvents` | Standalone's ordered Tool announcements/state/resets (`docs/specs/dor-tool.md` → OSC 367). |
+| Host → webview | `terminal:toolEvents` | Ordered Tool announcements, state, and command-start resets (`docs/specs/dor-tool.md` → OSC 367). |
+| Webview → host | `pty:spawn` | `options.alert`: a cold-restored pane's persisted alert state (`docs/specs/alert.md` → Public State). |
 | Webview → host | `dormouse:themeColors` (VS Code) / `pty_theme_colors` (standalone) | Resolved foreground / background / cursor, so the owner's parser can answer OSC 10/11/12. |
 | Host → webview | `pty:replay` | Buffered raw output since spawn; the webview runs a one-shot parser over it, the only re-parse there is. |
 | Host → webview | `dormouse:newTerminal` | May carry `shell`, `args`, display `name`, `replaceUntouched`, `announce`. The webview replaces the selected untouched terminal in place only when `replaceUntouched` is true, otherwise spawns a new pane. |
 
-**Two app-global stores relay on one pattern**: WATCHING rules (`alert:initializeWatchedCommands`, `alert:setCommandWatched` → host; `alert:watchedCommands` → webview) and alarm settings (`alert:initializeSettings`, `alert:updateSettings` → host; `alert:settings` → webview; `docs/specs/alert.md` → Alarm settings). An `initialize*` offers the renderer's persisted copy as a startup seed, and **a multi-webview host accepts only the first seed of its lifetime**. A mutation replaces the host's copy — `setCommandWatched` adds or removes one bare command key without touching unrelated rules, `updateSettings` sends the whole blob, renderer-only fields included, so every webview agrees. Either way the host broadcasts a canonical snapshot, and **every renderer replaces and persists its local mirror from it**. **In standalone both directions ride one opaque passthrough**, the `alert_command` invoke to an `alert:command` sidecar line, where the stores live beside the one `AlertManager`; the snapshot comes back as a broadcast. The passthrough carries every other `alert*` verb too (`docs/specs/standalone.md` → "Alerts").
+**Every `alert*` verb is one `alert:command { command }` to the host** — in standalone the `alert_command` invoke, stamped with its window (`docs/specs/standalone.md` → "Alerts") — and **every answer one of the `alert:*` events, named and shaped alike in both hosts** (`AlertCommand` / `AlertEvents` in `lib/src/host/alert-protocol.ts`). **The host revalidates every command**, the settings blob that becomes its timers included (`normalizeAlertSettings`). An await's messages are `docs/specs/alert.md` → Await. **`sync` re-sends the realm its Sessions' `alert:state` and both stores' snapshots, ending nothing.**
 
-**The host must revalidate renderer-supplied settings, never trust them** — they become host timers. `AlertSettingsHost` runs every inbound blob through `normalizeAlertSettings`, which drops unknown keys, defaults missing ones, and clamps each delay into range. Both directions share one adapter method, `alertPublishSettings(settings, { seed })`: seed vs replace picks a message type, not a payload.
+**Two app-global stores relay on one pattern**: WATCHING rules (`initializeWatchedCommands`, `setCommandWatched` → host; `alert:watchedCommands` → webview) and alarm settings (`initializeSettings`, `updateSettings` → host; `alert:settings` → webview; `docs/specs/alert.md` → Alarm settings). An `initialize*` offers the renderer's persisted copy as a startup seed, and **a host accepts only the first seed of its lifetime**. A mutation replaces the host's copy — `setCommandWatched` adds or removes one bare command key without touching unrelated rules, `updateSettings` sends the whole blob, renderer-only fields included, so every webview agrees. Either way the host broadcasts a canonical snapshot, and **every renderer replaces and persists its local mirror from it**. **A host sends no snapshot before the first seed**, so a `sync` never pushes defaults over a renderer's persisted copy.
+
+Both settings directions share one adapter method, `alertPublishSettings(settings, { seed })`: seed vs replace picks an op, not a payload.
 
 **Never add a third app-global store on this pattern** — a third collapses them into one keyed channel with a host-side key→normalizer registry (rationale).
 
@@ -325,7 +328,6 @@ prompt** (rationale).
 - **Replay drops terminal replies only** — never a user keyboard escape sequence (`docs/specs/terminal-escapes.md` → "Report filtering on the input side").
 - **Replaying a dead pane resets its modes; replaying a live one does not** — the `REPLAY_MODE_RESET` tail (`docs/specs/terminal-escapes.md` → Replay-time mode-reset tail).
 - **Untouched defaults conservatively.** New saved panes include `untouched`; a pane read without the field defaults to `untouched: false`, so it still requires kill confirmation.
-- **PTY ownership.** Each message router tracks the PTY ids it owns. A PTY routed to one webview must not be stolen by another router; new routers attaching to a host must respect existing ownership.
 - **Replay filtering does not re-fire alerts**, quiesce-detector events, or protocol notifications (`docs/specs/terminal-escapes.md` → "`pty:data` strip semantics").
 
 Source of truth: `getScrollbackReceived` / `getScrollbackSince` in `vscode-ext/src/pty-manager.ts`; the replay filter in `lib/src/lib/terminal-report-filter.ts`.
diff --git a/docs/specs/transport.rationale.md b/docs/specs/transport.rationale.md
index d996b2356..ca35aaa4a 100644
--- a/docs/specs/transport.rationale.md
+++ b/docs/specs/transport.rationale.md
@@ -51,7 +51,7 @@ moving a Workspace and losing it.
 
 **What the broadcast buys.** Unambiguous settling is only half of it: the same fan-out lets a losing window forward a command to the broker window and receive the answer back (`docs/specs/vscode.md` → "Peer surfaces across windows").
 
-**The per-store tax.** Each app-global store relayed webview↔host this way costs one `PlatformAdapter` push method, an on/off listener pair, three message types, and a host coordinator with its own subscribe/unsubscribe. Two are worth paying that twice for the directness; at a third, the keyed channel + key→normalizer registry is cheaper than another copy of the plumbing.
+**The per-store tax.** Each app-global store relayed webview↔host this way costs one `PlatformAdapter` push method, an on/off listener pair, two `AlertCommand` ops and an event, and a host coordinator with its own subscribe/unsubscribe. Two are worth paying that twice for the directness; at a third, the keyed channel + key→normalizer registry is cheaper than another copy of the plumbing.
 
 ## Persisted session types
 
diff --git a/docs/specs/vscode.md b/docs/specs/vscode.md
index cc727cbb3..5c5368d7d 100644
--- a/docs/specs/vscode.md
+++ b/docs/specs/vscode.md
@@ -27,13 +27,12 @@ The webview is the shared `lib/` frontend, unmodified for this host (`docs/specs
 ### Invariants (VS Code-specific)
 
 - **Capture, then save, then kill.** `deactivate()` runs the agent-recovery capture *first* and both kills *last*, the state flush and live-PTY refresh in between. Source of truth: `deactivate()` in `vscode-ext/src/extension.ts`.
-- **Alert state is global.** One module-level `AlertManager` in `message-router.ts` is shared across all routers, survives router disposal, and is fed by PTY data regardless of webview visibility.
-- **Each router is one engagement viewer** of it (`docs/specs/alert.md` → Engagement), set by `alert:engagement`. **Must remove the viewer on router disposal and on a `dormouse:init` re-init**, which also cancels that router's parked awaits: recreated content is a new realm (`endRealm` in `vscode-ext/src/message-router.ts`). Pinned by `engagement viewers` in `vscode-ext/test/message-router.test.ts`.
-- **WATCHING rules are host-authoritative.** The first webview after extension-host startup seeds the shared host rule set and **no later webview may replace it**.
+- **Alert state is global.** One module-level alert host (`createAlertHost`) in `message-router.ts` is shared across all routers, survives router disposal, and is fed by PTY data regardless of webview visibility.
+- **Each router is one realm of it**, under its `routerId` (`docs/specs/alert.md` → Engagement). **Must end the realm on router disposal and on a `dormouse:init` re-init** (`endRealm`): recreated content is a new realm. Pinned by `engagement viewers` and `await requests` in `vscode-ext/test/message-router.test.ts`.
 - **Never let a resuming router steal another webview's PTYs.** Each router tracks its PTYs in `ownedPtyIds`; a module-level `globalOwnedPtyIds` set enforces it.
 - **Every save path must merge current alert states through the shared persistence projection.** The frontend periodic save (`onSaveState`) and the backend deactivate refresh (`refreshSavedSessionStateFromPtys`) both narrow alerts with `toPersistedAlertState`; missing the merge reverts alert state on restore, while passing live state through persists transient fields.
-- **Must reserve a closing router's PTYs until its deferred kills finish**, so another router cannot claim them during archive/CWD work, then **remove the alert entry of each PTY it kills**, its webview being gone. Pinned by `vscode-ext/test/message-router.test.ts`.
-- **A remote Client's write acknowledges with input before it is written**, whichever Burrow tier it came through (`docs/specs/alert.md` → Engagement; `writeClientInput` in `vscode-ext/src/message-router.ts`).
+- **A Session's alert state follows its PTY**: `pty:spawn` claims the id before starting its alert state over from `options.alert`, so the seeded state reaches the claiming webview, and **every kill removes the entry**. **Must reserve a closing router's PTYs until its deferred kills finish**, so another router cannot claim them during archive/CWD work. Pinned by `vscode-ext/test/message-router.test.ts`.
+- **Every webview and Client write and resize goes through `alertedPty`**, a remote Client's from either Burrow tier included (`writeClientInput`), so input is acknowledged and a resize's grace opened first (`docs/specs/alert.md` → Engagement).
 - **retainContextWhenHidden.** Set on both `WebviewPanel` and `WebviewView` so xterm.js DOM, scrollback, and PTY subscriptions survive panel hide/show without a resume.
 - **Two save sources must produce consistent state**: the frontend's periodic `dormouse:saveState` and the backend's deactivate flush-then-refresh.
 - **Every host → webview send carries the message token**, and **never add a `message` listener that skips `isHostMessage`**.
@@ -84,15 +83,13 @@ Each hosting primitive uses the chrome it has, following the in-app `<title> [TO
 Reflection updates on every owned-PTY `AlertManager.onStateChange` and on `claim` / `release`. Source of truth: `computeWorkspaceUnion` in `lib/src/lib/workspace-union.ts`, `notifyUnion` in `vscode-ext/src/message-router.ts`, `workspaceTitle` / `workspaceBadge` in `vscode-ext/src/workspace-chrome.ts`, `setupPanel` in `vscode-ext/src/extension.ts`, `DormouseViewProvider` in `vscode-ext/src/webview-view-provider.ts`.
 
 WATCHING rules and the alarm settings (`docs/specs/alert.md` → Alarm settings)
-are app-global rather than per-Workspace, so both ride the host-authoritative
-seed / mutate / broadcast channel `docs/specs/transport.md` → Message protocol
-specifies. One thing is this host's: **the seeding offer is the first one
-after extension-host startup**. The settings a shared `AlertManager` consumes
-are `AlertManager.applySettings`'s own list, not this host's choice.
+are app-global rather than per-Workspace, riding the seed / mutate / broadcast
+channel of `docs/specs/transport.md` → Message protocol; the settings the
+shared manager consumes are `AlertManager.applySettings`'s own list.
 
 Source of truth: `WatchedCommandHost` in `lib/src/lib/watched-command-host.ts`,
-`AlertSettingsHost` in `lib/src/lib/alert-settings-host.ts`, the alert cases in
-`vscode-ext/src/message-router.ts`.
+`AlertSettingsHost` in `lib/src/lib/alert-settings-host.ts`, the `alert:command`
+case in `vscode-ext/src/message-router.ts`.
 
 ### Shell selection
 
@@ -144,8 +141,8 @@ commands — **a `WebviewView` re-resolve only, never a deserialized panel and n
 a cold restore** (`docs/specs/notepad.md` → "Live resume").
 
 **On activate**, saved state loads through `readPersistedSession()`
-(`docs/specs/transport.md` → "Persisted session types") and is passed to routers
-for cold-start restore. The WebviewView and each deserialized WebviewPanel then
+(`docs/specs/transport.md` → "Persisted session types") and is injected into
+the webview for cold-start restore. The WebviewView and each deserialized WebviewPanel then
 claim their own pane ids' recovery commands out of the single record, under
 `docs/specs/transport.md` → "Consuming it". **A panel's pane ids come from the
 `vscode.setState()` blob returned at `deserializeWebviewPanel`**, so recovery
diff --git a/lib/src/host/alert-client.test.ts b/lib/src/host/alert-client.test.ts
index a6608043e..1b935b6ff 100644
--- a/lib/src/host/alert-client.test.ts
+++ b/lib/src/host/alert-client.test.ts
@@ -1,85 +1,72 @@
 import { describe, expect, it } from 'vitest';
-import { createSidecarAlertClient } from './alert-client';
-import { createSidecarAlerts } from './alert-host';
-import type { AlertCommand } from './alert-protocol';
+import { createAlertClient } from './alert-client';
+import { createAlertHost } from './alert-host';
+import { ALERT_EVENTS, type AlertCommand } from './alert-protocol';
 import type { AlertStateDetail } from '../lib/platform/types';
 import { DEFAULT_ALERT_SETTINGS } from '../lib/alert-settings-model';
+import { REPORT } from '../lib/alert-manager-test-utils';
 
 /**
- * A standalone window's end of the sidecar's alerts: every `alert*` platform
- * method is one command, and every answer comes back as a sidecar event
- * (`docs/specs/standalone.md` → "Alerts").
+ * A renderer realm's end of its host's alerts, shared by every adapter whose
+ * host holds the manager: every `alert*` platform method is one command, and
+ * every answer comes back as a host event (`docs/specs/alert.md`).
  */
 
 function client() {
   const commands: AlertCommand[] = [];
-  const alerts = createSidecarAlertClient((command) => void commands.push(command));
-  return { alerts, commands };
+  const alerts = createAlertClient((command) => void commands.push(command));
+  return { alerts, methods: alerts.methods, commands };
 }
 
-describe('commands', () => {
-  it('sends each alert verb as one command naming its op', () => {
-    const { alerts, commands } = client();
-    alerts.alertDismiss('p');
-    alerts.alertAcknowledge('p');
-    alerts.alertResize('p');
-    alerts.alertToggleTodo('p');
-    alerts.alertClearTodo('p');
-    alerts.alertRemove('p');
-    alerts.alertSeed('p', { status: 'WATCHING_DISABLED', todo: true, notification: null });
-    alerts.alertEngagement({ present: true, focusId: 'p' });
-    alerts.alertEngagement({ present: false, focusId: 'p' }, 'idle');
-    alerts.alertSetCommandWatched('cargo', true);
-    alerts.hello();
-    expect(commands).toEqual([
-      { op: 'dismiss', id: 'p' },
-      { op: 'acknowledge', id: 'p' },
-      { op: 'resize', id: 'p' },
-      { op: 'toggleTodo', id: 'p' },
-      { op: 'clearTodo', id: 'p' },
-      { op: 'remove', id: 'p' },
-      { op: 'seed', id: 'p', state: { status: 'WATCHING_DISABLED', todo: true, notification: null } },
-      { op: 'engagement', state: { present: true, focusId: 'p' } },
-      { op: 'engagement', state: { present: false, focusId: 'p' }, lapse: 'idle' },
-      { op: 'setCommandWatched', name: 'cargo', watched: true },
-      { op: 'hello' },
-    ]);
-  });
-
-  // The stream is the only path a store's snapshot takes back; a repeat seed is
-  // refused as a seed but still answered (`lib/src/lib/watched-command-host.ts`).
-  it('re-offers only its last seeds', () => {
-    const { alerts, commands } = client();
-    const quiet = { ...DEFAULT_ALERT_SETTINGS, speakEnabled: false };
-    alerts.alertSetWatchedCommands(['cargo']);
-    alerts.alertPublishSettings(quiet, { seed: true });
-    // Neither a mutation nor a non-seed publish is a seed.
-    alerts.alertSetCommandWatched('make', true);
-    alerts.alertPublishSettings({ ...quiet, pushEnabled: true }, { seed: false });
-    commands.length = 0;
-
-    alerts.reofferSeeds();
-    expect(commands).toEqual([
-      { op: 'initializeWatchedCommands', names: ['cargo'] },
-      { op: 'initializeSettings', settings: quiet },
-    ]);
-  });
+it('sends each alert verb as one command naming its op', () => {
+  const { alerts, methods, commands } = client();
+  methods.alertDismiss('p');
+  methods.alertAcknowledge('p');
+  methods.alertToggleTodo('p');
+  methods.alertClearTodo('p');
+  methods.alertEngagement({ present: true, focusId: 'p' });
+  methods.alertEngagement({ present: false, focusId: 'p' }, 'idle');
+  methods.alertSetWatchedCommands(['cargo']);
+  // A delta, never a replacement.
+  methods.alertSetCommandWatched('cargo', true);
+  methods.alertPublishSettings(DEFAULT_ALERT_SETTINGS, { seed: true });
+  methods.alertPublishSettings(DEFAULT_ALERT_SETTINGS, { seed: false });
+  alerts.hello();
+  alerts.sync();
+  expect(commands).toEqual([
+    { op: 'dismiss', id: 'p' },
+    { op: 'acknowledge', id: 'p' },
+    { op: 'toggleTodo', id: 'p' },
+    { op: 'clearTodo', id: 'p' },
+    { op: 'engagement', state: { present: true, focusId: 'p' } },
+    { op: 'engagement', state: { present: false, focusId: 'p' }, lapse: 'idle' },
+    { op: 'initializeWatchedCommands', names: ['cargo'] },
+    { op: 'setCommandWatched', name: 'cargo', watched: true },
+    { op: 'initializeSettings', settings: DEFAULT_ALERT_SETTINGS },
+    { op: 'updateSettings', settings: DEFAULT_ALERT_SETTINGS },
+    { op: 'hello' },
+    { op: 'sync' },
+  ]);
 });
 
 describe('events', () => {
+  it.each(ALERT_EVENTS)('claims %s, which every host sends', (event) => {
+    expect(client().alerts.onEvent(event, null)).toBe(true);
+  });
+
   it('hands the host\'s state and store snapshots to the renderer, and claims nothing else', () => {
-    const { alerts } = client();
+    const { alerts, methods } = client();
     const seen: unknown[] = [];
-    alerts.onAlertState((detail) => void seen.push(['state', detail]));
-    alerts.onWatchedCommands((names) => void seen.push(['watched', names]));
-    alerts.onAlertSettings((settings) => void seen.push(['settings', settings]));
+    methods.onAlertState((detail) => void seen.push(['state', detail]));
+    methods.onWatchedCommands((names) => void seen.push(['watched', names]));
+    methods.onAlertSettings((settings) => void seen.push(['settings', settings]));
 
     const detail = { id: 'p', status: 'ALERT_RINGING', todo: true } as unknown as AlertStateDetail;
-    expect(alerts.onEvent('alert:state', detail)).toBe(true);
-    expect(alerts.onEvent('alert:watchedCommands', { names: ['make'] })).toBe(true);
-    expect(alerts.onEvent('alert:settings', { settings: DEFAULT_ALERT_SETTINGS })).toBe(true);
-    // A broadcast with no blob is dropped, not applied as "no settings".
-    expect(alerts.onEvent('alert:settings', {})).toBe(true);
+    alerts.onEvent('alert:state', detail);
+    alerts.onEvent('alert:watchedCommands', { names: ['make'] });
+    alerts.onEvent('alert:settings', { settings: DEFAULT_ALERT_SETTINGS });
+    // A snapshot with no blob is dropped, not applied as "no settings".
+    alerts.onEvent('alert:settings', {});
     expect(alerts.onEvent('pty:data', { id: 'p', data: 'x' })).toBe(false);
 
     expect(seen).toEqual([['state', detail], ['watched', ['make']], ['settings', DEFAULT_ALERT_SETTINGS]]);
@@ -88,32 +75,39 @@ describe('events', () => {
 
 describe('awaits', () => {
   it('parks in the host and resolves on its own awaitId alone', async () => {
-    const { alerts, commands } = client();
-    const handle = alerts.alertAwait('p', { until: 'quiet', timeoutMs: 600_000 });
+    const { alerts, methods, commands } = client();
+    const handle = methods.alertAwait('p', { until: 'quiet', timeoutMs: 600_000 });
     const [parked] = commands as Array<Extract<AlertCommand, { op: 'await' }>>;
     expect(parked).toMatchObject({ op: 'await', id: 'p', until: 'quiet', timeoutMs: 600_000 });
-    expect(parked!.awaitId).toMatch(/^await-/);
 
     let outcome: unknown = null;
     void handle.promise.then((value) => { outcome = value; });
-    // Another window's await, broadcast to this one too.
-    alerts.onEvent('alert:awaitResult', { awaitId: 'await-other', window: 'ws-2', outcome: { kind: 'timeout', waitedMs: 1 } });
+    alerts.onEvent('alert:awaitResult', { awaitId: 'await-other', outcome: { kind: 'timeout', waitedMs: 1 } });
     await Promise.resolve();
     expect(outcome).toBeNull();
 
-    alerts.onEvent('alert:awaitResult', { awaitId: parked!.awaitId, window: 'main', outcome: { kind: 'resolved', cause: 'quiet', waitedMs: 7 } });
+    alerts.onEvent('alert:awaitResult', { awaitId: parked!.awaitId, outcome: { kind: 'resolved', cause: 'quiet', waitedMs: 7 } });
     await Promise.resolve();
     expect(outcome).toEqual({ kind: 'resolved', cause: 'quiet', waitedMs: 7 });
   });
 
+  it('never mints an id another realm has', () => {
+    const a = client();
+    const b = client();
+    a.methods.alertAwait('p', { until: 'exit', timeoutMs: 600_000 });
+    b.methods.alertAwait('p', { until: 'exit', timeoutMs: 600_000 });
+    const ids = [...a.commands, ...b.commands].map((command) => (command as { awaitId: string }).awaitId);
+    expect(new Set(ids).size).toBe(2);
+  });
+
   it('asks the host to cancel, and takes the answer the host sends', async () => {
-    const { alerts, commands } = client();
-    const handle = alerts.alertAwait('p', { until: 'exit', timeoutMs: 600_000 });
+    const { alerts, methods, commands } = client();
+    const handle = methods.alertAwait('p', { until: 'exit', timeoutMs: 600_000 });
     const awaitId = (commands[0] as { awaitId: string }).awaitId;
     handle.cancel();
     expect(commands[1]).toEqual({ op: 'awaitCancel', awaitId });
 
-    alerts.onEvent('alert:awaitResult', { awaitId, window: 'main', outcome: { kind: 'cancelled', waitedMs: 3 } });
+    alerts.onEvent('alert:awaitResult', { awaitId, outcome: { kind: 'cancelled', waitedMs: 3 } });
     await expect(handle.promise).resolves.toEqual({ kind: 'cancelled', waitedMs: 3 });
     // Settled: a late cancel asks nothing more.
     handle.cancel();
@@ -121,42 +115,26 @@ describe('awaits', () => {
   });
 
   it('settles what it parked cancelled when disposed, since no answer can reach it', async () => {
-    const { alerts } = client();
-    const handle = alerts.alertAwait('p', { until: 'exit', timeoutMs: 600_000 });
+    const { alerts, methods } = client();
+    const handle = methods.alertAwait('p', { until: 'exit', timeoutMs: 600_000 });
     alerts.dispose();
     await expect(handle.promise).resolves.toMatchObject({ kind: 'cancelled' });
   });
-});
 
-/**
- * The whole path a reload takes, host and client wired as Rust wires them: the
- * manager never lived in the webview, so a reloaded window gets its rings and
- * TODOs back from the sidecar's answer to its collection, without seeding.
- */
-it('gives a reloaded window its rings and TODOs back', () => {
-  // The window's current realm: a reload replaces it under the same label.
-  let realm: ReturnType<typeof createSidecarAlertClient> | null = null;
-  const host = createSidecarAlerts({ send: (event, data) => realm?.onEvent(event, data) });
-  const open = () => {
-    realm = createSidecarAlertClient((command) => host.handle({ ...command, window: 'main' }));
-    return realm;
-  };
-  try {
-    const before = open();
-    before.alertEngagement({ present: true, focusId: 'watched' });
-    host.manager.notifyFromProtocol('ringing', { source: 'OSC 9', title: null, body: 'done' });
-    before.alertToggleTodo('flagged');
-
-    const after = open();
-    const seen = new Map<string, AlertStateDetail>();
-    after.onAlertState((detail) => void seen.set(detail.id, detail));
-    after.hello();
-    // What `pty:requestInit` makes the sidecar send behind its list.
-    host.publish(['ringing', 'flagged']);
-
-    expect(seen.get('ringing')).toMatchObject({ status: 'ALERT_RINGING', todo: true });
-    expect(seen.get('flagged')).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
-  } finally {
-    host.dispose();
-  }
+  it('takes the host\'s answer through the real host, a claim included', async () => {
+    const host = createAlertHost();
+    const realm = createAlertClient((command) => host.handle('main', command, {
+      answer: (result) => void realm.onEvent('alert:awaitResult', result),
+      resendStates: () => {},
+    }));
+    try {
+      const handle = realm.methods.alertAwait('p', { until: 'quiet', timeoutMs: 600_000 });
+      host.manager.notifyFromProtocol('p', REPORT);
+      await expect(handle.promise).resolves.toMatchObject({ kind: 'resolved', cause: 'bell' });
+      // Claimed: the bell reached the program, not the human.
+      expect(host.manager.getState('p').status).not.toBe('ALERT_RINGING');
+    } finally {
+      host.dispose();
+    }
+  });
 });
diff --git a/lib/src/host/alert-client.ts b/lib/src/host/alert-client.ts
index 138694875..3bd910c5b 100644
--- a/lib/src/host/alert-client.ts
+++ b/lib/src/host/alert-client.ts
@@ -1,93 +1,88 @@
 import type { AwaitHandle, AwaitOptions, AwaitOutcome, Engagement, EngagementLapse } from '../lib/alert-manager';
 import type { AlertSettings } from '../lib/alert-settings-model';
 import type { AlertStateDetail, PlatformAdapter } from '../lib/platform/types';
-import type { PersistedAlertState } from '../lib/session-types';
-import {
-  ALERT_AWAIT_RESULT_EVENT,
-  ALERT_STATE_EVENT,
-  type AlertAwaitResult,
-  type AlertCommand,
-} from './alert-protocol';
+import { isAlertEvent, type AlertAwaitResult, type AlertCommand, type AlertEvents } from './alert-protocol';
 
 /**
- * A standalone window's end of the sidecar's alerts (`lib/src/host/alert-host.ts`):
- * every `alert*` platform method as one command, and the sidecar's events back
- * to the renderer's handlers. Shared by both standalone adapters, which differ
- * only in how a command travels and an event arrives.
- *
- * Every method is a closure, so an adapter may take them as its own members.
+ * A renderer realm's end of its host's alerts (`lib/src/host/alert-host.ts`),
+ * shared by every adapter whose host holds the `AlertManager` — VS Code and
+ * both standalone adapters, which differ only in how a command travels and an
+ * event arrives: each `alert*` platform verb is one `AlertCommand`, and the
+ * host's events reach the renderer's handlers.
  */
-export type SidecarAlertMethods = Required<Pick<
+export type AlertClientMethods = Required<Pick<
   PlatformAdapter,
-  | 'alertRemove'
   | 'alertSetWatchedCommands'
   | 'alertSetCommandWatched'
   | 'alertPublishSettings'
   | 'alertDismiss'
   | 'alertEngagement'
   | 'alertAcknowledge'
-  | 'alertResize'
   | 'alertToggleTodo'
   | 'alertClearTodo'
   | 'alertAwait'
-  | 'alertSeed'
   | 'onAlertState'
   | 'onWatchedCommands'
   | 'onAlertSettings'
 >>;
 
-export interface SidecarAlertClient extends SidecarAlertMethods {
-  /** One sidecar event. Returns whether it was an alert event. */
+export interface AlertClient {
+  /** Every `alert*` platform method, each a closure, so an adapter can take
+   *  them as its own members (`Object.assign(this, client.methods)`). */
+  readonly methods: AlertClientMethods;
+  /** One host event. Returns whether it was an alert event. */
   onEvent(event: string, data: unknown): boolean;
-  /** This realm is new — a boot or a reload: what the window's previous realm
-   *  engaged or parked is gone (`hello`). */
+  /** This realm is new — a boot or a reload: what the previous realm under
+   *  the same name engaged or parked is gone. */
   hello(): void;
-  /** Offer the last startup seeds again, so the sidecar republishes both
-   *  stores to a stream that dropped their broadcasts. */
-  reofferSeeds(): void;
+  /** Ask the host to re-send this realm's Sessions' state and both stores,
+   *  for a transport that may have dropped them. */
+  sync(): void;
   /** Settle every await this realm parked `cancelled`, synchronously: nothing
    *  will deliver their outcomes once the adapter is gone. */
   dispose(): void;
 }
 
-export function createSidecarAlertClient(send: (command: AlertCommand) => void): SidecarAlertClient {
+/**
+ * A short random component for this realm's `awaitId`s: a standalone host
+ * answers from one process for every window, so a plain counter would let two
+ * realms mint the same id.
+ */
+function randomTag(): string {
+  const uuid = globalThis.crypto?.randomUUID?.();
+  return uuid ? uuid.slice(0, 8) : Math.random().toString(36).slice(2, 10);
+}
+
+export function createAlertClient(send: (command: AlertCommand) => void): AlertClient {
   const stateHandlers = new Set<(detail: AlertStateDetail) => void>();
   const watchedHandlers = new Set<(names: string[]) => void>();
   const settingsHandlers = new Set<(settings: AlertSettings) => void>();
   const awaits = new Map<string, { resolve: (outcome: AwaitOutcome) => void; startedAt: number }>();
-  const seeds = new Map<string, AlertCommand>();
+  const tag = randomTag();
+  let awaitSeq = 0;
 
-  const seed = (command: AlertCommand): void => {
-    seeds.set(command.op, command);
-    send(command);
-  };
-
-  return {
-    alertRemove: (id) => send({ op: 'remove', id }),
-    alertSeed: (id: string, state: PersistedAlertState) => send({ op: 'seed', id, state }),
-    alertSetWatchedCommands: (names) => seed({ op: 'initializeWatchedCommands', names }),
-    // A delta, never a replacement, so a window that has not heard about a
-    // rule cannot drop it.
+  const methods: AlertClientMethods = {
+    alertSetWatchedCommands: (names) => send({ op: 'initializeWatchedCommands', names }),
+    // A delta, never a replacement, so a realm that has not heard about a rule
+    // cannot drop it.
     alertSetCommandWatched: (name, watched) => send({ op: 'setCommandWatched', name, watched }),
-    alertPublishSettings: (settings, opts) => {
-      if (opts.seed) seed({ op: 'initializeSettings', settings });
-      else send({ op: 'updateSettings', settings });
-    },
+    alertPublishSettings: (settings, opts) =>
+      send({ op: opts.seed ? 'initializeSettings' : 'updateSettings', settings }),
     alertDismiss: (id) => send({ op: 'dismiss', id }),
-    alertEngagement: (state: Engagement, lapse?: EngagementLapse) => send({ op: 'engagement', state, ...(lapse ? { lapse } : {}) }),
+    alertEngagement: (state: Engagement, lapse?: EngagementLapse) =>
+      send({ op: 'engagement', state, ...(lapse ? { lapse } : {}) }),
     alertAcknowledge: (id) => send({ op: 'acknowledge', id }),
-    alertResize: (id) => send({ op: 'resize', id }),
     alertToggleTodo: (id) => send({ op: 'toggleTodo', id }),
     alertClearTodo: (id) => send({ op: 'clearTodo', id }),
 
     /**
-     * Parked in the sidecar, which owns the wake condition and the ceiling; only
-     * the outcome crosses back, broadcast under this adapter's own random id.
-     * `cancel()` asks rather than answers: the `cancelled` outcome arrives on
-     * the same result as every other, so a claim is never released twice.
+     * Parked in the host, which owns the wake condition and the ceiling; only
+     * the outcome crosses back, under this realm's own id. `cancel()` asks
+     * rather than answers: the `cancelled` outcome arrives like every other, so
+     * a claim is never released twice.
      */
     alertAwait(id: string, options: AwaitOptions): AwaitHandle {
-      const awaitId = `await-${crypto.randomUUID()}`;
+      const awaitId = `await-${tag}-${++awaitSeq}`;
       const promise = new Promise<AwaitOutcome>((resolve) => {
         awaits.set(awaitId, { resolve, startedAt: Date.now() });
       });
@@ -103,45 +98,48 @@ export function createSidecarAlertClient(send: (command: AlertCommand) => void):
     onAlertState: (handler) => void stateHandlers.add(handler),
     onWatchedCommands: (handler) => void watchedHandlers.add(handler),
     onAlertSettings: (handler) => void settingsHandlers.add(handler),
+  };
+
+  return {
+    methods,
 
     onEvent(event, data) {
+      if (!isAlertEvent(event)) return false;
       switch (event) {
-        case ALERT_STATE_EVENT: {
-          const detail = data as AlertStateDetail;
-          if (typeof detail?.id !== 'string') return true;
-          for (const handler of stateHandlers) handler(detail);
-          return true;
+        case 'alert:state': {
+          // Forwarded whole, so a new `AlertState` field needs no edit here.
+          const detail = data as AlertEvents['alert:state'] | null;
+          if (typeof detail?.id === 'string') for (const handler of stateHandlers) handler(detail);
+          break;
         }
-        case ALERT_AWAIT_RESULT_EVENT: {
+        case 'alert:awaitResult': {
           const result = data as Partial<AlertAwaitResult> | null;
           const parked = typeof result?.awaitId === 'string' ? awaits.get(result.awaitId) : undefined;
-          // Another window's await, or one this realm already settled.
-          if (!parked || !result?.outcome) return true;
+          // Another realm's await, or one this realm already settled.
+          if (!parked || !result?.outcome) break;
           awaits.delete(result.awaitId!);
           parked.resolve(result.outcome);
-          return true;
+          break;
         }
         case 'alert:watchedCommands': {
-          const names = (data as { names?: string[] } | null)?.names ?? [];
+          const names = (data as Partial<AlertEvents['alert:watchedCommands']> | null)?.names ?? [];
           for (const handler of watchedHandlers) handler(names);
-          return true;
+          break;
         }
         case 'alert:settings': {
-          const settings = (data as { settings?: AlertSettings } | null)?.settings;
-          // A broadcast with no blob is dropped, not applied as "no settings".
+          const settings = (data as Partial<AlertEvents['alert:settings']> | null)?.settings;
+          // A snapshot with no blob is dropped, not applied as "no settings".
           if (settings) for (const handler of settingsHandlers) handler(settings);
-          return true;
+          break;
         }
         default:
-          return false;
+          event satisfies never;
       }
+      return true;
     },
 
     hello: () => send({ op: 'hello' }),
-
-    reofferSeeds() {
-      for (const command of seeds.values()) send(command);
-    },
+    sync: () => send({ op: 'sync' }),
 
     dispose() {
       for (const [awaitId, parked] of [...awaits]) {
diff --git a/lib/src/host/alert-host.test.ts b/lib/src/host/alert-host.test.ts
index 92b6f0619..6dde31f79 100644
--- a/lib/src/host/alert-host.test.ts
+++ b/lib/src/host/alert-host.test.ts
@@ -1,270 +1,274 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { createSidecarAlerts, type SidecarAlerts } from './alert-host';
+import { createAlertHost, type AlertHost, type AlertRealm } from './alert-host';
 import type { AlertAwaitResult } from './alert-protocol';
 import { DEFAULT_ALERT_SETTINGS } from '../lib/alert-settings-model';
-import type { AlertState } from '../lib/alert-manager';
+import { REPORT } from '../lib/alert-manager-test-utils';
 
 /**
- * Standalone's one `AlertManager`, in the sidecar (`docs/specs/standalone.md` →
- * "Alerts"). Every window is a viewer of it by its label, which Rust stamps on
- * each command as `window`; what matters is that one window's realm ending
- * never touches another's, that every await is answered exactly once, and
- * that a window collecting its PTYs gets their state back.
+ * The alerts' host role, as both hosts run it (`docs/specs/alert.md`). Every
+ * renderer realm is a viewer of the one manager: what matters is that one
+ * realm's end never touches another's, that every await is answered exactly
+ * once and only to the realm that parked it, and that nothing a renderer sends
+ * is installed unchecked.
  */
 
-let sent: Array<{ event: string; data: unknown }>;
-let alerts: SidecarAlerts;
+let host: AlertHost;
+/** Every await outcome, by the realm it was answered to. */
+let answers: Array<{ realm: string } & AlertAwaitResult>;
+let resent: string[];
+let watched: string[][];
+let settings: Array<Record<string, unknown>>;
 
-const REPORT = { source: 'OSC 9', title: null, body: 'needs input' } as const;
+function realmFor(name: string): AlertRealm {
+  return {
+    answer: (result) => void answers.push({ realm: name, ...result }),
+    resendStates: () => void resent.push(name),
+  };
+}
 
-const watched = (): string[][] =>
-  sent.filter((message) => message.event === 'alert:watchedCommands')
-    .map((message) => (message.data as { names: string[] }).names);
-const settings = () =>
-  sent.filter((message) => message.event === 'alert:settings')
-    .map((message) => (message.data as { settings: Record<string, unknown> }).settings);
-const states = (id: string) =>
-  sent.filter((message) => message.event === 'alert:state' && (message.data as { id: string }).id === id)
-    .map((message) => message.data as { id: string } & AlertState);
-const results = () =>
-  sent.filter((message) => message.event === 'alert:awaitResult').map((message) => message.data as AlertAwaitResult);
-
-/** One command as Rust forwards it: stamped with the window that sent it. */
-const from = (window: string, command: Record<string, unknown>) => alerts.handle({ ...command, window });
+/** One command from realm `name`. */
+const from = (name: string, command: unknown) => host.handle(name, command, realmFor(name));
 
 beforeEach(() => {
-  sent = [];
-  alerts = createSidecarAlerts({ send: (event, data) => sent.push({ event, data }) });
+  host = createAlertHost();
+  answers = [];
+  resent = [];
+  watched = [];
+  settings = [];
+  host.watched.subscribe((names) => void watched.push(names));
+  host.settings.subscribe((value) => void settings.push(value as unknown as Record<string, unknown>));
 });
 
 afterEach(() => {
-  alerts.dispose();
+  host.dispose();
   vi.useRealTimers();
 });
 
 describe('the WATCHING rule set', () => {
-  it('takes the first window\'s seed, corrects every later one, and watches with it', () => {
+  it('takes the first realm\'s seed, corrects every later one, and watches with it', () => {
     from('main', { op: 'initializeWatchedCommands', names: ['npm test'] });
-    expect(watched().at(-1)).toEqual(['npm test']);
+    expect(watched.at(-1)).toEqual(['npm test']);
 
-    // A second window offering its own persisted copy is answered with the
+    // A second realm offering its own persisted copy is answered with the
     // canonical set, not allowed to replace it.
     from('ws-2', { op: 'initializeWatchedCommands', names: ['cargo build'] });
-    expect(watched().at(-1)).toEqual(['npm test']);
-    expect(alerts.manager.getWatchedCommands()).toEqual(['npm test']);
+    expect(watched.at(-1)).toEqual(['npm test']);
+    expect(host.manager.getWatchedCommands()).toEqual(['npm test']);
   });
 
-  it('applies an edit as a delta, so a stale window cannot drop other rules', () => {
+  it('applies an edit as a delta, so a stale realm cannot drop other rules', () => {
     from('main', { op: 'initializeWatchedCommands', names: ['npm test'] });
-    from('ws-2', { op: 'setCommandWatched', name: 'cargo build', watched: true });
-    expect(watched().at(-1)).toEqual(['cargo build', 'npm test']);
+    from('ws-2', { op: 'setCommandWatched', name: ' cargo build ', watched: true });
+    expect(watched.at(-1)).toEqual(['cargo build', 'npm test']);
 
     from('main', { op: 'setCommandWatched', name: 'npm test', watched: false });
-    expect(watched().at(-1)).toEqual(['cargo build']);
+    expect(watched.at(-1)).toEqual(['cargo build']);
   });
 
   it('ignores a malformed edit rather than installing it', () => {
     from('main', { op: 'initializeWatchedCommands', names: ['npm test', 42, null, ''] });
-    expect(watched().at(-1)).toEqual(['npm test']);
-    const before = sent.length;
+    expect(watched.at(-1)).toEqual(['npm test']);
+    const before = watched.length;
     from('main', { op: 'setCommandWatched', name: 7, watched: 'yes' });
+    from('main', { op: 'setCommandWatched', name: '  ', watched: true });
     from('main', { op: 'nonsense' });
-    alerts.handle(null);
-    expect(sent).toHaveLength(before);
+    from('main', null);
+    expect(watched).toHaveLength(before);
   });
 });
 
 describe('the alarm settings', () => {
-  it('takes the first seed and corrects every later one', () => {
+  it('takes the first seed and corrects every later one, and any realm\'s edit', () => {
     from('main', { op: 'initializeSettings', settings: { ...DEFAULT_ALERT_SETTINGS, speakEnabled: true } });
-    expect(settings().at(-1)).toMatchObject({ speakEnabled: true });
-
     from('ws-2', { op: 'initializeSettings', settings: { ...DEFAULT_ALERT_SETTINGS, speakEnabled: false } });
-    expect(settings().at(-1)).toMatchObject({ speakEnabled: true });
-  });
+    expect(settings.at(-1)).toMatchObject({ speakEnabled: true });
 
-  it('takes an explicit edit from any window', () => {
-    from('main', { op: 'initializeSettings', settings: DEFAULT_ALERT_SETTINGS });
     from('ws-2', { op: 'updateSettings', settings: { ...DEFAULT_ALERT_SETTINGS, pushEnabled: true } });
-    expect(settings().at(-1)).toMatchObject({ pushEnabled: true });
+    expect(settings.at(-1)).toMatchObject({ pushEnabled: true });
   });
 
   it('revalidates whatever a renderer sends', () => {
-    // A NaN or an absurd timer must never reach a host because a webview asked.
+    // A NaN or an absurd timer must never reach a host because a renderer asked.
     from('main', { op: 'initializeSettings', settings: { speakDelayMs: Number.NaN, pushDelayMs: 1e12 } });
-    const installed = settings().at(-1)!;
+    const installed = settings.at(-1)!;
     expect(installed.speakDelayMs).toBe(DEFAULT_ALERT_SETTINGS.speakDelayMs);
     expect(installed.pushDelayMs).toBeLessThanOrEqual(600_000);
   });
 });
 
-describe('Session state', () => {
-  it('publishes every change as alert:state, for the host to route by owner', () => {
-    alerts.manager.notifyFromProtocol('pty-1', REPORT);
-    expect(states('pty-1').at(-1)).toMatchObject({ id: 'pty-1', status: 'ALERT_RINGING', todo: true });
-  });
-
-  it('carries each verb a window sends to the one manager', () => {
-    alerts.manager.notifyFromProtocol('pty-1', REPORT);
-    from('main', { op: 'dismiss', id: 'pty-1' });
-    expect(states('pty-1').at(-1)).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
-    from('main', { op: 'clearTodo', id: 'pty-1' });
-    expect(states('pty-1').at(-1)).toMatchObject({ todo: false });
-    from('main', { op: 'toggleTodo', id: 'pty-1' });
-    expect(states('pty-1').at(-1)).toMatchObject({ todo: true });
-
-    alerts.manager.notifyFromProtocol('pty-2', REPORT);
-    from('main', { op: 'acknowledge', id: 'pty-2' });
-    expect(states('pty-2').at(-1)).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
-
-    from('main', { op: 'seed', id: 'pty-3', state: { status: 'ALERT_RINGING', todo: true, notification: REPORT } });
-    // A seed restores the reminder, never the ring.
-    expect(states('pty-3').at(-1)).toMatchObject({ status: 'WATCHING_DISABLED', todo: true, notification: REPORT });
-
-    from('main', { op: 'remove', id: 'pty-3' });
-    expect(states('pty-3').at(-1)).toMatchObject({ status: 'WATCHING_DISABLED', todo: false });
-    expect(alerts.manager.getAllStates().has('pty-3')).toBe(false);
-  });
-
-  it('acknowledges human input with its echo window before the write it rides', () => {
-    alerts.manager.notifyFromProtocol('pty-1', REPORT);
-    alerts.acknowledgeInput('pty-1');
-    expect(states('pty-1').at(-1)).toMatchObject({ status: 'WATCHING_DISABLED', todo: false });
-    // A bell answering the key rings no one.
-    alerts.manager.notifyFromProtocol('pty-1', REPORT);
-    expect(states('pty-1').at(-1)?.status).not.toBe('ALERT_RINGING');
-  });
+it('carries each verb a realm sends to the one manager', () => {
+  host.manager.notifyFromProtocol('pty-1', REPORT);
+  from('main', { op: 'dismiss', id: 'pty-1' });
+  expect(host.manager.getState('pty-1')).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
+  from('main', { op: 'clearTodo', id: 'pty-1' });
+  expect(host.manager.getState('pty-1').todo).toBe(false);
+  from('main', { op: 'toggleTodo', id: 'pty-1' });
+  expect(host.manager.getState('pty-1').todo).toBe(true);
+
+  host.manager.notifyFromProtocol('pty-2', REPORT);
+  from('main', { op: 'acknowledge', id: 'pty-2' });
+  expect(host.manager.getState('pty-2')).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
+
+  // Nothing to act on without a Session.
+  from('main', { op: 'toggleTodo', id: '' });
+  expect(host.manager.getAllStates().has('')).toBe(false);
+});
 
-  it('mirrors a helper, which publishes nothing until promotion', () => {
-    alerts.setHelper('pty-h', true);
-    alerts.manager.notifyFromProtocol('pty-h', REPORT);
-    expect(states('pty-h')).toEqual([]);
-  });
+it('starts a respawned Session over, from the persisted state it was spawned with', () => {
+  host.manager.notifyFromProtocol('pty-1', REPORT);
+  host.respawn('pty-1', { status: 'ALERT_RINGING', todo: true, notification: REPORT });
+  // A seed restores the reminder, never the ring.
+  expect(host.manager.getState('pty-1')).toMatchObject({ status: 'WATCHING_DISABLED', todo: true, notification: REPORT });
+
+  host.manager.notifyFromProtocol('pty-2', REPORT);
+  host.respawn('pty-2');
+  expect(host.manager.getState('pty-2')).toMatchObject({ status: 'WATCHING_DISABLED', todo: false });
+  // No tombstone: the new generation's output is its own Session's.
+  host.manager.onData('pty-2');
+  expect(host.manager.has('pty-2')).toBe(true);
+});
 
-  // What `pty:requestInit` sends behind its list: a window that reloaded or is
-  // taking a Workspace over has no other way to learn its Sessions' state.
-  it('re-sends the listed Sessions\' state, and every Session\'s when none are listed', () => {
-    alerts.manager.notifyFromProtocol('pty-1', REPORT);
-    from('main', { op: 'toggleTodo', id: 'pty-2' });
-    alerts.setHelper('pty-h', true);
-    alerts.manager.onData('pty-h');
-    sent = [];
-
-    alerts.publish(['pty-1', 'never-seen']);
-    expect(sent).toEqual([
-      { event: 'alert:state', data: expect.objectContaining({ id: 'pty-1', status: 'ALERT_RINGING', todo: true }) },
-    ]);
+it('re-sends the asking realm its state and both stores on sync, ending nothing', () => {
+  from('main', { op: 'initializeWatchedCommands', names: ['npm test'] });
+  from('main', { op: 'initializeSettings', settings: DEFAULT_ALERT_SETTINGS });
+  from('main', { op: 'engagement', state: { present: true, focusId: 'pty-a' } });
+  watched = [];
+  settings = [];
+
+  from('main', { op: 'sync' });
+  expect(resent).toEqual(['main']);
+  expect(watched).toEqual([['npm test']]);
+  expect(settings).toHaveLength(1);
+  expect(host.manager.viewerIds()).toEqual(['main']);
+});
 
-    sent = [];
-    alerts.publish(undefined);
-    expect(sent.map((message) => (message.data as { id: string }).id).sort()).toEqual(['pty-1', 'pty-2']);
-  });
+it('never snapshots a store no realm has seeded', () => {
+  // It would replace the renderers' persisted copies with the defaults.
+  from('main', { op: 'sync' });
+  expect(watched).toEqual([]);
+  expect(settings).toEqual([]);
 });
 
-describe('viewers', () => {
-  const engaged = (window: string, focusId: string | null) =>
-    from(window, { op: 'engagement', state: { present: true, focusId } });
+describe('realms', () => {
+  const engaged = (name: string, focusId: string | null) =>
+    from(name, { op: 'engagement', state: { present: true, focusId } });
 
-  it('keeps engagement per window label, so one window leaving never disengages another', () => {
+  it('keeps engagement per realm, so one leaving never disengages another', () => {
     engaged('main', 'pty-a');
     engaged('ws-2', 'pty-b');
     from('main', { op: 'engagement', state: { present: false, focusId: null }, lapse: 'leave' });
 
-    alerts.manager.notifyFromProtocol('pty-b', REPORT);
-    expect(alerts.manager.getState('pty-b').status).not.toBe('ALERT_RINGING');
-    alerts.manager.notifyFromProtocol('pty-a', REPORT);
-    expect(alerts.manager.getState('pty-a').status).toBe('ALERT_RINGING');
+    host.manager.notifyFromProtocol('pty-b', REPORT);
+    expect(host.manager.getState('pty-b').status).not.toBe('ALERT_RINGING');
+    host.manager.notifyFromProtocol('pty-a', REPORT);
+    expect(host.manager.getState('pty-a').status).toBe('ALERT_RINGING');
   });
 
-  it('ends a window\'s previous realm on hello, and no other window\'s', () => {
+  it('ends a realm on hello, answering what it parked, and no other realm\'s', () => {
     engaged('main', 'pty-a');
     engaged('ws-2', 'pty-b');
     from('main', { op: 'await', awaitId: 'await-main', id: 'pty-c', until: 'exit', timeoutMs: 600_000 });
     from('ws-2', { op: 'await', awaitId: 'await-ws2', id: 'pty-c', until: 'exit', timeoutMs: 600_000 });
 
-    // `main` reloaded: same label, new realm.
     from('main', { op: 'hello' });
-    expect(results()).toEqual([{ awaitId: 'await-main', window: 'main', outcome: expect.objectContaining({ kind: 'cancelled' }) }]);
-    alerts.manager.notifyFromProtocol('pty-a', REPORT);
-    expect(alerts.manager.getState('pty-a').status).toBe('ALERT_RINGING');
-    alerts.manager.notifyFromProtocol('pty-b', REPORT);
-    expect(alerts.manager.getState('pty-b').status).not.toBe('ALERT_RINGING');
-    expect(alerts.manager.getState('pty-c').awaited).toBe(true);
+    // Synchronously: a disposing webview stops listening right after.
+    expect(answers).toEqual([{ realm: 'main', awaitId: 'await-main', outcome: expect.objectContaining({ kind: 'cancelled' }) }]);
+    host.manager.notifyFromProtocol('pty-a', REPORT);
+    expect(host.manager.getState('pty-a').status).toBe('ALERT_RINGING');
+    host.manager.notifyFromProtocol('pty-b', REPORT);
+    expect(host.manager.getState('pty-b').status).not.toBe('ALERT_RINGING');
+    expect(host.manager.getState('pty-c').awaited).toBe(true);
   });
 
-  it('drops a window that went away, and keeps the ones still open', () => {
+  it('answers once when the manager settles an await its realm\'s end already answered', async () => {
+    from('main', { op: 'await', awaitId: 'await-1', id: 'pty-1', until: 'quiet', timeoutMs: 600_000 });
+    host.endRealm('main');
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(answers).toHaveLength(1);
+  });
+
+  it('keeps answering while a torn-down realm refuses its answer', () => {
+    host.handle('main', { op: 'await', awaitId: 'await-1', id: 'pty-1', until: 'exit', timeoutMs: 600_000 }, {
+      answer: () => { throw new Error('webview disposed'); },
+      resendStates: () => {},
+    });
+    from('main', { op: 'await', awaitId: 'await-2', id: 'pty-2', until: 'exit', timeoutMs: 600_000 });
+    host.endRealm('main');
+    expect(answers.map((answer) => answer.awaitId)).toEqual(['await-2']);
+    expect(host.manager.getState('pty-1').awaited).toBe(false);
+  });
+
+  it('ends every realm that is no longer live, and keeps the ones that are', () => {
     engaged('main', 'pty-a');
     engaged('ws-2', 'pty-b');
-    from('ws-2', { op: 'await', awaitId: 'await-ws2', id: 'pty-c', until: 'quiet', timeoutMs: 600_000 });
-
-    alerts.setWindows(['main']);
-    expect(results()).toEqual([{ awaitId: 'await-ws2', window: 'ws-2', outcome: expect.objectContaining({ kind: 'cancelled' }) }]);
-    alerts.manager.notifyFromProtocol('pty-b', REPORT);
-    expect(alerts.manager.getState('pty-b').status).toBe('ALERT_RINGING');
-    alerts.manager.notifyFromProtocol('pty-a', REPORT);
-    expect(alerts.manager.getState('pty-a').status).not.toBe('ALERT_RINGING');
-
-    // Not a label list: nothing to act on.
-    alerts.setWindows(undefined);
-    alerts.manager.notifyFromProtocol('pty-a', REPORT);
-    expect(alerts.manager.getState('pty-a').status).not.toBe('ALERT_RINGING');
+    // A realm known only by what it parked.
+    from('ws-3', { op: 'await', awaitId: 'await-ws3', id: 'pty-c', until: 'quiet', timeoutMs: 600_000 });
+
+    host.retainRealms(['main']);
+    expect(answers).toEqual([{ realm: 'ws-3', awaitId: 'await-ws3', outcome: expect.objectContaining({ kind: 'cancelled' }) }]);
+    expect(host.manager.viewerIds()).toEqual(['main']);
+    host.manager.notifyFromProtocol('pty-b', REPORT);
+    expect(host.manager.getState('pty-b').status).toBe('ALERT_RINGING');
   });
 });
 
 describe('awaits', () => {
-  it('answers each await once, broadcast-shaped: no Session id, no requestId', async () => {
+  it('answers each await once, to the realm that parked it', async () => {
     from('ws-2', { op: 'await', awaitId: 'await-1', id: 'pty-1', until: 'quiet', timeoutMs: 600_000 });
-    expect(alerts.manager.getState('pty-1').awaited).toBe(true);
+    expect(host.manager.getState('pty-1').awaited).toBe(true);
 
-    alerts.manager.notifyFromProtocol('pty-1', REPORT);
+    host.manager.notifyFromProtocol('pty-1', REPORT);
     await Promise.resolve();
-    expect(results()).toEqual([
-      { awaitId: 'await-1', window: 'ws-2', outcome: expect.objectContaining({ kind: 'resolved', cause: 'bell' }) },
+    expect(answers).toEqual([
+      { realm: 'ws-2', awaitId: 'await-1', outcome: expect.objectContaining({ kind: 'resolved', cause: 'bell' }) },
     ]);
-    const [message] = sent.filter((line) => line.event === 'alert:awaitResult');
-    expect(Object.keys(message!.data as object).sort()).toEqual(['awaitId', 'outcome', 'window']);
     // Claimed: the bell reached the program, not the human.
-    expect(alerts.manager.getState('pty-1').status).not.toBe('ALERT_RINGING');
+    expect(host.manager.getState('pty-1').status).not.toBe('ALERT_RINGING');
   });
 
-  it('answers a cancel once, with the host outcome', async () => {
+  it('answers a cancel once, with the host outcome, and only the parking realm may cancel', async () => {
     from('main', { op: 'await', awaitId: 'await-1', id: 'pty-1', until: 'exit', timeoutMs: 600_000 });
+    from('ws-2', { op: 'awaitCancel', awaitId: 'await-1' });
+    await Promise.resolve();
+    expect(answers).toEqual([]);
+
     from('main', { op: 'awaitCancel', awaitId: 'await-1' });
     await Promise.resolve();
     from('main', { op: 'awaitCancel', awaitId: 'await-1' });
     await Promise.resolve();
-    expect(results()).toEqual([{ awaitId: 'await-1', window: 'main', outcome: expect.objectContaining({ kind: 'cancelled' }) }]);
-    expect(alerts.manager.getState('pty-1').awaited).toBe(false);
+    expect(answers).toEqual([{ realm: 'main', awaitId: 'await-1', outcome: expect.objectContaining({ kind: 'cancelled' }) }]);
+    expect(host.manager.getState('pty-1').awaited).toBe(false);
   });
 
   it('refuses a malformed await with an answer rather than parking it', async () => {
     from('main', { op: 'await', awaitId: 'await-bad', id: 'pty-1', until: 'soon', timeoutMs: 600_000 });
     from('main', { op: 'await', awaitId: 'await-nan', id: 'pty-1', until: 'exit', timeoutMs: 'forever' });
+    from('main', { op: 'await', awaitId: 'await-noid', until: 'exit', timeoutMs: 600_000 });
     // Nothing to answer to.
     from('main', { op: 'await', id: 'pty-1', until: 'exit', timeoutMs: 600_000 });
     await Promise.resolve();
-    expect(results().map((result) => [result.awaitId, result.outcome.kind])).toEqual([
+    expect(answers.map((answer) => [answer.awaitId, answer.outcome.kind])).toEqual([
       ['await-bad', 'cancelled'],
+      ['await-noid', 'cancelled'],
       ['await-nan', 'cancelled'],
     ]);
-    expect(alerts.manager.getState('pty-1').awaited).toBe(false);
+    expect(host.manager.getState('pty-1').awaited).toBe(false);
   });
 
-  it('survives a Workspace moving between windows: the manager never moves', async () => {
-    from('main', { op: 'await', awaitId: 'await-1', id: 'pty-1', until: 'quiet', timeoutMs: 600_000 });
-    // Ownership moves in Rust; the sidecar hears nothing of it, and `main` is
-    // still open to hear the outcome.
-    alerts.setWindows(['main', 'ws-2']);
-    alerts.manager.notifyFromProtocol('pty-1', REPORT);
-    await Promise.resolve();
-    expect(results()).toEqual([
-      { awaitId: 'await-1', window: 'main', outcome: expect.objectContaining({ kind: 'resolved', cause: 'bell' }) },
-    ]);
+  it('refuses a repeated id, which would owe one caller two answers', async () => {
+    from('main', { op: 'await', awaitId: 'await-1', id: 'pty-1', until: 'exit', timeoutMs: 600_000 });
+    from('main', { op: 'await', awaitId: 'await-1', id: 'pty-2', until: 'exit', timeoutMs: 600_000 });
+    expect(host.manager.getState('pty-2').awaited).toBe(false);
+    // Another realm's ids are its own.
+    from('ws-2', { op: 'await', awaitId: 'await-1', id: 'pty-2', until: 'exit', timeoutMs: 600_000 });
+    expect(host.manager.getState('pty-2').awaited).toBe(true);
   });
 });
 
-it('stops publishing once disposed', () => {
-  alerts.dispose();
-  from('main', { op: 'initializeWatchedCommands', names: ['npm test'] });
-  expect(sent).toEqual([]);
+it('answers nothing once disposed', async () => {
+  from('main', { op: 'await', awaitId: 'await-1', id: 'pty-1', until: 'exit', timeoutMs: 600_000 });
+  host.dispose();
+  await Promise.resolve();
+  expect(answers).toEqual([]);
 });
diff --git a/lib/src/host/alert-host.ts b/lib/src/host/alert-host.ts
index a9e93b8c6..898bf9c71 100644
--- a/lib/src/host/alert-host.ts
+++ b/lib/src/host/alert-host.ts
@@ -1,114 +1,123 @@
-import { AlertManager, type AwaitHandle, type AwaitOutcome, type Engagement } from '../lib/alert-manager';
+import { AlertManager, type AwaitHandle, type Engagement } from '../lib/alert-manager';
 import { AlertSettingsHost } from '../lib/alert-settings-host';
 import { WatchedCommandHost } from '../lib/watched-command-host';
 import type { PersistedAlertState } from '../lib/session-types';
-import { ALERT_AWAIT_RESULT_EVENT, ALERT_STATE_EVENT, type AlertAwaitResult } from './alert-protocol';
+import type { AlertAwaitResult } from './alert-protocol';
 
 /**
- * Standalone's one `AlertManager`, in the Node sidecar beside the PTYs and the
- * parse site, exactly as VS Code keeps one in its extension host
- * (`docs/specs/standalone.md` → "Alerts"). Windows are its viewers: each
- * reports engagement, sends the user's verbs, and renders the `alert:state` it
- * is routed. The two app-global stores run the same classes VS Code runs
- * (`vscode-ext/src/message-router.ts`), bound to this manager.
+ * The host role of the alerts, run beside the PTYs by both hosts: VS Code's
+ * extension host (`vscode-ext/src/message-router.ts`) and standalone's sidecar
+ * (`lib/src/host/remote/sidecar-entry.ts`). One `AlertManager`, the two
+ * app-global stores bound to it, and every renderer realm one of its viewers,
+ * driving it with `AlertCommand`s (`lib/src/host/alert-protocol.ts`). How
+ * state and snapshots reach the realms is each host's own.
  */
 
-export interface SidecarAlerts {
-  /** The one manager. The parse site feeds it (`createSidecarSurfaceBridge`). */
+/** Where the host answers the realm a command came from. */
+export interface AlertRealm {
+  /** One await's outcome. May throw from a realm being torn down. */
+  answer(result: AlertAwaitResult): void;
+  /** `sync`: re-send this realm the state of the Sessions it shows. */
+  resendStates(): void;
+}
+
+export interface AlertHost {
   readonly manager: AlertManager;
-  /** One `alert:command` line. */
-  handle(command: unknown): void;
-  /** Every live window label, pushed on each create and destroy: a window
-   *  that is gone engages nothing and waits on nothing. */
-  setWindows(labels: unknown): void;
-  /** A PTY's helper status as `pty-core` holds it, after a spawn or a promotion. */
-  setHelper(id: unknown, helper: boolean): void;
-  /** Human input about to be written, in the same message as the write:
-   *  acknowledged, echo window opened, before the bytes reach the PTY. */
-  acknowledgeInput(id: unknown): void;
-  /** Re-send each listed Session's state, every Session when `ids` is absent:
-   *  a window collecting its PTYs has no other way to learn it. */
-  publish(ids: unknown): void;
+  readonly watched: WatchedCommandHost;
+  readonly settings: AlertSettingsHost;
+  /** One command from `realmId`, revalidated: nothing a renderer sends is trusted. */
+  handle(realmId: string, command: unknown, realm: AlertRealm): void;
+  /**
+   * The realm's content is gone — disposed, recreated, reloaded, closed: its
+   * engagement ends, and what it parked is cancelled and answered here,
+   * **synchronously** and once (`docs/specs/alert.md` → Await).
+   */
+  endRealm(realmId: string): void;
+  /** End every realm that is not `live`. */
+  retainRealms(live: Iterable<string>): void;
+  /**
+   * A new PTY generation under `id`: its alert state starts over, from the
+   * persisted state a cold restore spawned it with. Before the PTY spawns, so
+   * nothing it emits lands on the previous generation's state.
+   */
+  respawn(id: string, persisted?: unknown): void;
   dispose(): void;
 }
 
-/** The label a command carries when no host stamped one (a test). */
-const UNNAMED_WINDOW = '';
+interface Parked {
+  handle: AwaitHandle;
+  realm: AlertRealm;
+  startedAt: number;
+}
 
 const isId = (value: unknown): value is string => typeof value === 'string' && value.length > 0;
 
-export function createSidecarAlerts(options: {
-  /** Writes one event line; the host routes it (`docs/specs/standalone.md` → "Routing"). */
-  send: (event: string, data: unknown) => void;
-}): SidecarAlerts {
-  const { send } = options;
+export function createAlertHost(): AlertHost {
   const manager = new AlertManager();
   const watched = new WatchedCommandHost(manager);
   const settings = new AlertSettingsHost(manager);
+  /** Each realm's parked `dor await`s, by the id its client minted. */
+  const parked = new Map<string, Map<string, Parked>>();
 
-  // `dor await`s parked here, by the random id the asking adapter minted.
-  const awaits = new Map<string, { handle: AwaitHandle; window: string; startedAt: number }>();
-  /** Labels that have reported engagement, so a departed one can be dropped. */
-  const viewers = new Set<string>();
-
-  const stops = [
-    watched.subscribe((names) => send('alert:watchedCommands', { names })),
-    settings.subscribe((value) => send('alert:settings', { settings: value })),
-    manager.onStateChange((id, state) => send(ALERT_STATE_EVENT, { id, ...state })),
-  ];
-
-  function answer(awaitId: string, window: string, outcome: AwaitOutcome): void {
-    send(ALERT_AWAIT_RESULT_EVENT, { awaitId, window, outcome } satisfies AlertAwaitResult);
-  }
-
-  function parkAwait(window: string, message: Record<string, unknown>): void {
+  function park(realmId: string, realm: AlertRealm, message: Record<string, unknown>): void {
     const { awaitId, id, until, timeoutMs } = message;
+    let awaits = parked.get(realmId);
     // A repeated id would owe two answers to one caller; the first keeps it.
-    if (!isId(awaitId) || awaits.has(awaitId)) return;
+    if (!isId(awaitId) || awaits?.has(awaitId)) return;
     if (!isId(id) || (until !== 'quiet' && until !== 'exit')) {
-      answer(awaitId, window, { kind: 'cancelled', waitedMs: 0 });
+      realm.answer({ awaitId, outcome: { kind: 'cancelled', waitedMs: 0 } });
       return;
     }
     // `timeoutMs` is revalidated by `awaitCompletion`, which settles nonsense
     // `cancelled` rather than installing it.
     const handle = manager.awaitCompletion(id, { until, timeoutMs: Number(timeoutMs) });
-    awaits.set(awaitId, { handle, window, startedAt: Date.now() });
+    const entry: Parked = { handle, realm, startedAt: Date.now() };
+    if (!awaits) parked.set(realmId, awaits = new Map());
+    awaits.set(awaitId, entry);
     void handle.promise.then((outcome) => {
-      // Gone from the map means `endRealm` already answered it.
-      if (awaits.delete(awaitId)) answer(awaitId, window, outcome);
+      // Gone, or replaced, means `endRealm` already answered it.
+      const current = parked.get(realmId);
+      if (current?.get(awaitId) !== entry) return;
+      current.delete(awaitId);
+      if (current.size === 0) parked.delete(realmId);
+      realm.answer({ awaitId, outcome });
     });
   }
 
-  /**
-   * A window's content is gone — reloaded, or the window closed: its
-   * engagement ends, and what it parked is cancelled and answered here, once,
-   * so no await absorbs completions for a caller that cannot hear the outcome.
-   */
-  function endRealm(window: string): void {
-    viewers.delete(window);
-    manager.removeViewer(window);
-    for (const [awaitId, parked] of [...awaits]) {
-      if (parked.window !== window) continue;
-      awaits.delete(awaitId);
-      parked.handle.cancel();
-      answer(awaitId, window, { kind: 'cancelled', waitedMs: Date.now() - parked.startedAt });
+  function endRealm(realmId: string): void {
+    manager.removeViewer(realmId);
+    const awaits = parked.get(realmId);
+    if (!awaits) return;
+    parked.delete(realmId);
+    for (const [awaitId, { handle, realm, startedAt }] of awaits) {
+      handle.cancel();
+      try {
+        realm.answer({ awaitId, outcome: { kind: 'cancelled', waitedMs: Date.now() - startedAt } });
+      } catch {
+        // A realm being torn down can refuse the answer. Keep cancelling.
+      }
     }
   }
 
   return {
     manager,
+    watched,
+    settings,
 
-    handle(command) {
+    handle(realmId, command, realm) {
       if (!command || typeof command !== 'object') return;
       const message = command as Record<string, unknown>;
-      const window = typeof message.window === 'string' ? message.window : UNNAMED_WINDOW;
-      const id = message.id;
       switch (message.op) {
         case 'hello':
-          endRealm(window);
+          endRealm(realmId);
+          return;
+        case 'sync':
+          realm.resendStates();
+          watched.publish();
+          settings.publish();
           return;
         case 'initializeWatchedCommands':
-          // Only the first window's offer is taken; every later one is answered
+          // Only the first realm's offer is taken; every later one is answered
           // with what the host already holds.
           watched.initialize(Array.isArray(message.names) ? message.names.filter(isId) : []);
           return;
@@ -118,8 +127,8 @@ export function createSidecarAlerts(options: {
           watched.setCommandWatched(name, message.watched);
           return;
         }
-        // Revalidated by `normalizeAlertSettings`: a webview must never install a
-        // NaN or an absurd timer (`docs/specs/transport.md`).
+        // Revalidated by `normalizeAlertSettings`: a renderer must never install
+        // a NaN or an absurd timer (`docs/specs/transport.md`).
         case 'initializeSettings':
           settings.initialize(message.settings);
           return;
@@ -127,20 +136,20 @@ export function createSidecarAlerts(options: {
           settings.update(message.settings);
           return;
         case 'engagement': {
-          viewers.add(window);
           // `setViewer` revalidates the shape: only a literal `idle` escalates.
           const lapse = message.lapse === 'idle' || message.lapse === 'leave' ? message.lapse : undefined;
-          manager.setViewer(window, message.state as Engagement, lapse);
+          manager.setViewer(realmId, message.state as Engagement, lapse);
           return;
         }
         case 'await':
-          parkAwait(window, message);
+          park(realmId, realm, message);
           return;
         case 'awaitCancel':
-          // The cancelled outcome arrives as `alert:awaitResult` like any other.
-          if (isId(message.awaitId)) awaits.get(message.awaitId)?.handle.cancel();
+          // The cancelled outcome is answered like any other.
+          if (isId(message.awaitId)) parked.get(realmId)?.get(message.awaitId)?.handle.cancel();
           return;
       }
+      const id = message.id;
       if (!isId(id)) return;
       switch (message.op) {
         case 'acknowledge':
@@ -155,50 +164,26 @@ export function createSidecarAlerts(options: {
         case 'clearTodo':
           manager.clearTodo(id);
           return;
-        case 'resize':
-          manager.onResize(id);
-          return;
-        case 'remove':
-          manager.remove(id);
-          return;
-        case 'seed':
-          if (message.state && typeof message.state === 'object') {
-            manager.seed(id, message.state as PersistedAlertState);
-          }
-          return;
       }
     },
 
-    setWindows(labels) {
-      if (!Array.isArray(labels)) return;
-      const live = new Set(labels.filter((label): label is string => typeof label === 'string'));
-      const known = new Set([...viewers, ...[...awaits.values()].map((parked) => parked.window)]);
-      for (const window of known) {
-        if (!live.has(window)) endRealm(window);
-      }
-    },
-
-    setHelper(id, helper) {
-      if (isId(id)) manager.setHelper(id, helper);
-    },
+    endRealm,
 
-    acknowledgeInput(id) {
-      if (isId(id)) manager.acknowledge(id, { input: true });
+    retainRealms(live) {
+      const keep = new Set(live);
+      for (const realmId of new Set([...manager.viewerIds(), ...parked.keys()])) {
+        if (!keep.has(realmId)) endRealm(realmId);
+      }
     },
 
-    publish(ids) {
-      const states = manager.getAllStates();
-      const wanted = Array.isArray(ids) ? ids.filter(isId) : [...states.keys()];
-      for (const id of wanted) {
-        const state = states.get(id);
-        if (state) send(ALERT_STATE_EVENT, { id, ...state });
-      }
+    respawn(id, persisted) {
+      manager.restart(id);
+      if (persisted && typeof persisted === 'object') manager.seed(id, persisted as PersistedAlertState);
     },
 
     dispose() {
-      for (const stop of stops) stop();
-      awaits.clear();
-      viewers.clear();
+      // Cleared first: nothing is answered for a host that is going away.
+      parked.clear();
       manager.dispose();
     },
   };
diff --git a/lib/src/host/alert-protocol.ts b/lib/src/host/alert-protocol.ts
index ffd3dec89..ce5a32d43 100644
--- a/lib/src/host/alert-protocol.ts
+++ b/lib/src/host/alert-protocol.ts
@@ -1,40 +1,54 @@
 import type { AwaitOutcome, AwaitUntil, Engagement, EngagementLapse } from '../lib/alert-manager';
 import type { AlertSettings } from '../lib/alert-settings-model';
-import type { PersistedAlertState } from '../lib/session-types';
+import type { AlertStateDetail } from '../lib/platform/types';
 
 /**
- * The wire between a standalone window and the sidecar's alerts: the commands
- * a window sends (`lib/src/host/alert-client.ts`) and the events the sidecar
- * answers with (`lib/src/host/alert-host.ts`).
- */
-
-/**
- * What a window asks, on the one `alert_command` passthrough. The host stamps
- * the asking window's label as `window`; a webview never names itself.
+ * The wire between a renderer realm and its host's alerts, the same in both
+ * hosts: the commands a realm sends (`lib/src/host/alert-client.ts`) and the
+ * events the host answers with (`lib/src/host/alert-host.ts`). VS Code carries
+ * a command as `alert:command {command}`; standalone as the `alert_command`
+ * passthrough, which Rust stamps with the asking window's label.
  */
 export type AlertCommand =
-  /** A window (re)initialized: whatever its previous realm engaged or parked is gone. */
+  /** A realm (re)initialized: whatever its previous realm engaged or parked is gone. */
   | { op: 'hello' }
+  /** Re-send this realm its Sessions' state and both stores, ending nothing. */
+  | { op: 'sync' }
   | { op: 'initializeWatchedCommands'; names: string[] }
   | { op: 'setCommandWatched'; name: string; watched: boolean }
   | { op: 'initializeSettings' | 'updateSettings'; settings: AlertSettings }
   | { op: 'engagement'; state: Engagement; lapse?: EngagementLapse }
-  | { op: 'acknowledge' | 'dismiss' | 'toggleTodo' | 'clearTodo' | 'resize' | 'remove'; id: string }
-  | { op: 'seed'; id: string; state: PersistedAlertState }
+  | { op: 'acknowledge' | 'dismiss' | 'toggleTodo' | 'clearTodo'; id: string }
   | { op: 'await'; awaitId: string; id: string; until: AwaitUntil; timeoutMs: number }
   | { op: 'awaitCancel'; awaitId: string };
 
-export const ALERT_STATE_EVENT = 'alert:state';
-export const ALERT_AWAIT_RESULT_EVENT = 'alert:awaitResult';
-
-/**
- * One await's outcome, broadcast to every window: the asking adapter matches
- * its own random `awaitId`. **Never carries a Session `id`**, which would route
- * it to that Session's owner rather than the window that asked, and **never a
- * `requestId`**, which Rust swallows to resolve its own invokes.
- */
+/** One await's outcome, to the realm that parked it, under the id it minted. */
 export interface AlertAwaitResult {
   awaitId: string;
-  window: string;
   outcome: AwaitOutcome;
 }
+
+/** Every event a host's alerts send a realm, by name. */
+export interface AlertEvents {
+  /** One Session's state, to the realm that shows it. */
+  'alert:state': AlertStateDetail;
+  /** `forWindow`: standalone names the window that parked the await, which
+   *  Rust routes it to (`docs/specs/standalone.md` → "Routing"). */
+  'alert:awaitResult': AlertAwaitResult & { forWindow?: string };
+  /** The app-global stores' canonical snapshots, to every realm. */
+  'alert:watchedCommands': { names: string[] };
+  'alert:settings': { settings: AlertSettings };
+}
+
+export const ALERT_EVENTS = [
+  'alert:state',
+  'alert:awaitResult',
+  'alert:watchedCommands',
+  'alert:settings',
+] as const satisfies ReadonlyArray<keyof AlertEvents>;
+
+export type AlertEventName = (typeof ALERT_EVENTS)[number];
+
+export function isAlertEvent(event: string): event is AlertEventName {
+  return (ALERT_EVENTS as readonly string[]).includes(event);
+}
diff --git a/lib/src/host/owner-pty.ts b/lib/src/host/owner-pty.ts
new file mode 100644
index 000000000..0e423095f
--- /dev/null
+++ b/lib/src/host/owner-pty.ts
@@ -0,0 +1,86 @@
+import type { AlertManager } from '../lib/alert-manager';
+import {
+  createProcessedPtyStream,
+  type ProcessedPtyChunk,
+  type ProcessedPtyStream,
+} from '../lib/processed-pty-stream';
+import {
+  applyTerminalEvents,
+  collectTerminalProtocolResponses,
+  collectTerminalToolEvents,
+  type TerminalColorProvider,
+  type TerminalProtocolEvent,
+} from '../lib/terminal-protocol';
+import type { TerminalSemanticEvent } from '../lib/terminal-state';
+
+/**
+ * What the process that owns a PTY does with it on behalf of its alerts, the
+ * same in both hosts: VS Code's extension host (`vscode-ext/src/message-router.ts`)
+ * and standalone's sidecar (`lib/src/host/remote/sidecar-entry.ts`).
+ */
+
+export interface OwnerPtyStreamOptions {
+  /** The host's one manager (`lib/src/host/alert-host.ts`). */
+  alerts: AlertManager;
+  colorProvider: TerminalColorProvider;
+  /** The Tool announcements, state and command-start resets of one parse, in
+   *  stream order, for the renderer that holds the Tool stores. */
+  onToolEvents(events: TerminalProtocolEvent[]): void;
+  /** The timestamped semantic events of one parse, for the renderer's
+   *  terminal-state store. */
+  onSemanticEvents(events: TerminalSemanticEvent[]): void;
+  /** A reply to a query. Written by the owner alone, never a viewer: it is the
+   *  sole reply authority (`docs/specs/remote-api.md` → Terminal surfaces). */
+  writeResponse(data: string): void;
+  /** One chunk of visible output, for the owner's renderer. */
+  onChunk(chunk: ProcessedPtyChunk): void;
+}
+
+/**
+ * One PTY generation's parse site, feeding the alerts and the renderer from the
+ * same pass: per batch, reports and command boundaries to the manager in stream
+ * order (`applyTerminalEvents`), then the Tool and semantic events, then the
+ * replies; then each visible chunk counts as the Session working, ahead of the
+ * renderer (`docs/specs/terminal-escapes.md` → "Parsing location").
+ */
+export function createOwnerPtyStream(id: string, options: OwnerPtyStreamOptions): ProcessedPtyStream {
+  return createProcessedPtyStream({
+    colorProvider: options.colorProvider,
+    onEvents(events) {
+      const semanticEvents = applyTerminalEvents(options.alerts, id, events);
+      const toolEvents = collectTerminalToolEvents(events);
+      if (toolEvents.length > 0) options.onToolEvents(toolEvents);
+      if (semanticEvents.length > 0) options.onSemanticEvents(semanticEvents);
+      for (const response of collectTerminalProtocolResponses(events)) options.writeResponse(response);
+    },
+    onChunk(chunk) {
+      options.alerts.onData(id);
+      options.onChunk(chunk);
+    },
+  });
+}
+
+/** The slice of a host's PTY manager that input and size changes reach. */
+export interface PtyWriteTarget {
+  write(id: string, data: string, options?: { paced?: boolean }): void;
+  resize(id: string, cols: number, rows: number, repaint?: boolean): void;
+}
+
+/**
+ * A host's PTY writes and resizes as its alerts must see them, whoever asked —
+ * a local renderer or a remote Client: **human input is acknowledged, echo
+ * window opened, before its bytes reach the PTY**, and a resize opens its grace
+ * window before the program repaints (`docs/specs/alert.md` → Engagement).
+ */
+export function alertedPty(alerts: AlertManager, pty: PtyWriteTarget) {
+  return {
+    write(id: string, data: string, options: { paced?: boolean; userInput?: boolean } = {}): void {
+      if (options.userInput) alerts.acknowledge(id, { input: true });
+      pty.write(id, data, options.paced ? { paced: true } : undefined);
+    },
+    resize(id: string, cols: number, rows: number, repaint?: boolean): void {
+      alerts.onResize(id);
+      pty.resize(id, cols, rows, repaint);
+    },
+  };
+}
diff --git a/lib/src/host/remote/sidecar-entry.test.ts b/lib/src/host/remote/sidecar-entry.test.ts
index d8c08440b..2799d7d54 100644
--- a/lib/src/host/remote/sidecar-entry.test.ts
+++ b/lib/src/host/remote/sidecar-entry.test.ts
@@ -5,9 +5,17 @@
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import type { ProcessedPtyChunk, PtySink } from '../../remote/burrow/burrow-surface-provider';
-import { createSidecarSurfaceBridge, type SidecarSurfaceBridge } from './sidecar-entry';
+import {
+  createSidecarHost,
+  createSidecarSurfaceBridge,
+  type SidecarHost,
+  type SidecarSurfaceBridge,
+} from './sidecar-entry';
 import { ASK_BUDGET_MS, type BurrowAsk } from './service-protocol';
-import { AlertManager } from '../../lib/alert-manager';
+import { AlertManager, type AlertState } from '../../lib/alert-manager';
+import { REPORT } from '../../lib/alert-manager-test-utils';
+import { createAlertClient } from '../alert-client';
+import type { AlertStateDetail } from '../../lib/platform/types';
 
 let sent: Array<{ event: string; data: unknown }>;
 let written: Array<{ id: string; data: string }>;
@@ -320,7 +328,7 @@ describe('PTYs', () => {
   // acknowledges them before the write, echo window included
   // (docs/specs/alert.md → Engagement).
   it('acknowledges a Client\'s input before writing it', () => {
-    alerts.notifyFromProtocol('pty-1', { source: 'OSC 9', title: null, body: 'needs input' });
+    alerts.notifyFromProtocol('pty-1', REPORT);
     const atWrite: unknown[] = [];
     onWrite = (id) => {
       const { status, todo } = alerts.getState(id);
@@ -328,9 +336,6 @@ describe('PTYs', () => {
     };
     bridge.provider.writePty('pty-1', 'y');
     expect(atWrite).toEqual([{ status: 'WATCHING_DISABLED', todo: false }]);
-    // A bell answering the key rings no one.
-    alerts.notifyFromProtocol('pty-1', { source: 'OSC 9', title: null, body: 'needs input' });
-    expect(alerts.getState('pty-1').status).not.toBe('ALERT_RINGING');
   });
 
   it('gives a Client\'s repaint bounce the resize grace', () => {
@@ -539,18 +544,9 @@ describe('the webview’s half of the parse', () => {
     expect(onExit).toHaveBeenCalledWith('pty-9', 3);
   });
 
-  it('starts a respawned Session\'s alert state over', () => {
-    alerts.notifyFromProtocol('pty-1', { source: 'OSC 9', title: null, body: 'old run' });
-    bridge.onPtySpawn('pty-1');
-    expect(alerts.getState('pty-1')).toMatchObject({ status: 'WATCHING_DISABLED', todo: false });
-    // No tombstone: the new generation's output is its own Session's.
-    bridge.onPtyEvent('data', { id: 'pty-1', data: 'fresh' });
-    expect(alerts.getAllStates().has('pty-1')).toBe(true);
-  });
-
   it('forwards dirty state and command resets separately from serve metadata', () => {
     bridge.onPtyEvent('data', { id: 'pty-1', data: '\x1b]367;state;{"v":1,"dirty":true}\x07\x1b]633;C\x07\x1b]367;state;{"v":1,"dirty":false}\x07' });
-    expect(emitted<{ events: unknown[] }>('terminal:protocolEvents')[0]?.events).toEqual([
+    expect(emitted<{ events: unknown[] }>('terminal:toolEvents')[0]?.events).toEqual([
       { kind: 'toolState', state: { dirty: true } },
       { kind: 'semantic', event: { type: 'commandStart', source: 'osc633_boundaries' } },
       { kind: 'toolState', state: { dirty: false } },
@@ -559,7 +555,7 @@ describe('the webview’s half of the parse', () => {
 
   it('preserves command-start resets between forwarded Tool announcements', () => {
     bridge.onPtyEvent('data', { id: 'pty-1', data: '\x1b]367;serve;{"port":6006}\x07\x1b]633;C\x07\x1b]367;serve;{"port":6007}\x07' });
-    expect(emitted<{ events: unknown[] }>('terminal:protocolEvents')[0]?.events).toEqual([
+    expect(emitted<{ events: unknown[] }>('terminal:toolEvents')[0]?.events).toEqual([
       { kind: 'toolAnnounce', announce: { port: 6006, name: null, key: null, dehydrate: false, persist: null } },
       { kind: 'semantic', event: { type: 'commandStart', source: 'osc633_boundaries' } },
       { kind: 'toolAnnounce', announce: { port: 6007, name: null, key: null, dehydrate: false, persist: null } },
@@ -638,3 +634,202 @@ describe('the webview’s half of the parse', () => {
     expect(emitted('pty:data')).toEqual([{ id: 'pty-1', data: 'plain' }]);
   });
 });
+
+/**
+ * Every PTY, alert and Burrow command the sidecar's bundle owns, as `main.js`
+ * hands them over: the alerts see each PTY change in the order a host must
+ * make it (`docs/specs/standalone.md` → "Alerts").
+ */
+describe('the sidecar host', () => {
+  let host: SidecarHost;
+  let out: Array<{ event: string; data: unknown }>;
+  /** Each PTY-manager call, with the Session's alert state as the call landed. */
+  let calls: Array<{ op: string; args: unknown[]; state?: Pick<AlertState, 'status' | 'todo'> }>;
+  /** Run inside `mgr.spawn`, as `pty-core` reports a helper decision there. */
+  let duringSpawn: ((id: string) => void) | null;
+
+  const stateOf = (id: unknown) => {
+    const { status, todo } = host.alerts.getState(id as string);
+    return { status, todo };
+  };
+  const record = (op: string, id?: unknown) => (...args: unknown[]) =>
+    void calls.push({ op, args, ...(id === undefined ? {} : { state: stateOf(args[0]) }) });
+  const states = (id: string) => out
+    .filter((line) => line.event === 'alert:state' && (line.data as { id: string }).id === id)
+    .map((line) => line.data as AlertStateDetail);
+  const command = (window: string | undefined, body: Record<string, unknown>) =>
+    host.handleCommand('alert:command', window === undefined ? body : { ...body, window });
+
+  beforeEach(() => {
+    out = [];
+    calls = [];
+    duringSpawn = null;
+    // The Burrow's memory-only store says so once.
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+    host = createSidecarHost({
+      send: (event, data) => void out.push({ event, data }),
+      mgr: {
+        spawn: (id, options) => {
+          calls.push({ op: 'spawn', args: [id, options], state: stateOf(id) });
+          duringSpawn?.(id);
+        },
+        write: record('write', true),
+        resize: record('resize', true),
+        kill: record('kill'),
+        gracefulKill: record('gracefulKill'),
+        list: record('list'),
+        hasPty: () => true,
+      },
+    });
+  });
+
+  afterEach(() => {
+    host.dispose();
+    vi.restoreAllMocks();
+  });
+
+  it('starts a spawned Session over from its persisted TODO, before the PTY spawns', () => {
+    host.alerts.notifyFromProtocol('pty-1', REPORT);
+    host.handleCommand('pty:spawn', {
+      id: 'pty-1',
+      options: { cols: 80, alert: { status: 'ALERT_RINGING', todo: true, notification: REPORT } },
+    });
+    // The reminder, never the ring; and `pty-core` never sees the alert.
+    expect(calls).toEqual([{ op: 'spawn', args: ['pty-1', { cols: 80 }], state: { status: 'WATCHING_DISABLED', todo: true } }]);
+    // The window learns it the way it learns every change.
+    expect(states('pty-1').at(-1)).toMatchObject({ todo: true, notification: REPORT });
+  });
+
+  it('keeps a helper `pty-core` reports at its spawn inert', () => {
+    duringSpawn = (id) => host.alerts.setHelper(id, true);
+    host.handleCommand('pty:spawn', { id: 'helper-1', options: { helper: { parentId: 'pty-1', command: 'git status' } } });
+    host.alerts.notifyFromProtocol('helper-1', REPORT);
+    expect(states('helper-1')).toEqual([]);
+  });
+
+  it('acknowledges human input before its write, and nothing else that is written', () => {
+    host.alerts.notifyFromProtocol('pty-1', REPORT);
+    host.handleCommand('pty:input', { id: 'pty-1', data: '\x1b[I', paced: true });
+    host.handleCommand('pty:input', { id: 'pty-1', data: 'y', userInput: true });
+    expect(calls).toEqual([
+      { op: 'write', args: ['pty-1', '\x1b[I', { paced: true }], state: { status: 'ALERT_RINGING', todo: true } },
+      { op: 'write', args: ['pty-1', 'y', undefined], state: { status: 'WATCHING_DISABLED', todo: false } },
+    ]);
+  });
+
+  it('opens the resize grace before the PTY resizes', () => {
+    const graced: string[] = [];
+    vi.spyOn(host.alerts, 'onResize').mockImplementation((id) => void graced.push(`grace ${id} after ${calls.length} calls`));
+    host.handleCommand('pty:resize', { id: 'pty-1', cols: 100, rows: 30 });
+    expect(graced).toEqual(['grace pty-1 after 0 calls']);
+    expect(calls.map((call) => [call.op, call.args])).toEqual([['resize', ['pty-1', 100, 30, undefined]]]);
+  });
+
+  it('removes a killed Session\'s alert state', () => {
+    host.alerts.notifyFromProtocol('pty-1', REPORT);
+    host.handleCommand('pty:kill', { id: 'pty-1' });
+    expect(host.alerts.has('pty-1')).toBe(false);
+    expect(calls.map((call) => [call.op, call.args])).toEqual([['kill', ['pty-1']]]);
+  });
+
+  // Rust reaps what a closed window left behind. Its alert state goes with it,
+  // and all that goes out for those Sessions is the empty state, which no
+  // window can persist as a TODO — Rust drops it anyway, owner gone.
+  it('leaves no alert state for the PTYs a closed window left, and kills them gracefully', () => {
+    host.alerts.notifyFromProtocol('left-1', REPORT);
+    host.alerts.toggleTodo('left-2');
+    host.alerts.notifyFromProtocol('kept', REPORT);
+    out = [];
+
+    host.handleCommand('pty:reap', { ids: ['left-1', 'left-2', 7], timeout: 2000 });
+    expect(host.alerts.has('left-1')).toBe(false);
+    expect(host.alerts.has('left-2')).toBe(false);
+    expect(host.alerts.has('kept')).toBe(true);
+    expect(calls.map((call) => [call.op, call.args])).toEqual([['gracefulKill', [['left-1', 'left-2'], 2000]]]);
+    for (const line of out) expect(line.data).toMatchObject({ todo: false, notification: null, status: 'WATCHING_DISABLED' });
+
+    // The quit flush's kill is not a reap: its windows still own their PTYs.
+    expect(host.handleCommand('pty:gracefulKill', { ids: ['kept'] })).toBe(false);
+  });
+
+  it('answers a window collecting its PTYs with their state, behind the list', () => {
+    host.alerts.notifyFromProtocol('pty-1', REPORT);
+    host.alerts.toggleTodo('pty-2');
+    host.alerts.setHelper('helper-1', true);
+    host.alerts.onData('helper-1');
+    out = [];
+
+    host.handleCommand('pty:requestInit', { ids: ['pty-1', 'never-seen', 'helper-1'], forWindow: 'main', requestId: 'r1' });
+    expect(calls.map((call) => [call.op, call.args])).toEqual([['list', [['pty-1', 'never-seen', 'helper-1'], 'main', 'r1', undefined]]]);
+    expect(out.map((line) => (line.data as { id: string }).id)).toEqual(['pty-1']);
+
+    out = [];
+    host.handleCommand('pty:requestInit', {});
+    expect(out.map((line) => (line.data as { id: string }).id).sort()).toEqual(['pty-1', 'pty-2']);
+  });
+
+  it('answers an await to the window that parked it, by name', async () => {
+    command('ws-2', { op: 'await', awaitId: 'await-1', id: 'pty-1', until: 'quiet', timeoutMs: 600_000 });
+    host.alerts.notifyFromProtocol('pty-1', REPORT);
+    await Promise.resolve();
+    const [result] = out.filter((line) => line.event === 'alert:awaitResult').map((line) => line.data);
+    // Routed like `pty:list`: never by a Session `id`, never a `requestId`.
+    expect(result).toEqual({ awaitId: 'await-1', forWindow: 'ws-2', outcome: expect.objectContaining({ cause: 'bell' }) });
+  });
+
+  it('ignores an alert command no host stamped', () => {
+    command(undefined, { op: 'engagement', state: { present: true, focusId: 'pty-1' } });
+    expect(host.alerts.viewerIds()).toEqual([]);
+  });
+
+  it('ends the realms of windows that went away', () => {
+    command('main', { op: 'engagement', state: { present: true, focusId: 'pty-a' } });
+    command('ws-2', { op: 'await', awaitId: 'await-ws2', id: 'pty-c', until: 'quiet', timeoutMs: 600_000 });
+    host.handleCommand('burrow:windows', { labels: ['main'] });
+    expect(out.filter((line) => line.event === 'alert:awaitResult').map((line) => line.data)).toEqual([
+      { awaitId: 'await-ws2', forWindow: 'ws-2', outcome: expect.objectContaining({ kind: 'cancelled' }) },
+    ]);
+    expect(host.alerts.viewerIds()).toEqual(['main']);
+  });
+
+  it('re-sends every Session\'s state and both stores to a window that asks to sync', () => {
+    command('main', { op: 'initializeWatchedCommands', names: ['npm test'] });
+    command('main', { op: 'initializeSettings', settings: {} });
+    host.alerts.notifyFromProtocol('pty-1', REPORT);
+    out = [];
+    command('main', { op: 'sync' });
+    expect(out.map((line) => line.event).sort()).toEqual(['alert:settings', 'alert:state', 'alert:watchedCommands']);
+  });
+
+  /**
+   * The whole path a reload takes, with a real client: the manager never lived
+   * in the webview, so a reloaded window gets its rings and TODOs back from the
+   * answer to its collection, without seeding.
+   */
+  it('gives a reloaded window its rings and TODOs back', () => {
+    const open = () => {
+      const realm = createAlertClient((body) => command('main', body as Record<string, unknown>));
+      const seen = new Map<string, AlertStateDetail>();
+      realm.methods.onAlertState((detail) => void seen.set(detail.id, detail));
+      return { realm, seen };
+    };
+    const before = open();
+    before.realm.methods.alertEngagement({ present: true, focusId: 'watched' });
+    host.alerts.notifyFromProtocol('ringing', REPORT);
+    before.realm.methods.alertToggleTodo('flagged');
+
+    const after = open();
+    after.realm.hello();
+    out = [];
+    host.handleCommand('pty:requestInit', { ids: ['ringing', 'flagged'], forWindow: 'main' });
+    for (const line of out) after.realm.onEvent(line.event, line.data);
+
+    expect(after.seen.get('ringing')).toMatchObject({ status: 'ALERT_RINGING', todo: true });
+    expect(after.seen.get('flagged')).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
+  });
+
+  it('leaves every other command to main.js', () => {
+    expect(host.handleCommand('pty:getCwd', { id: 'pty-1' })).toBe(false);
+    expect(calls).toEqual([]);
+  });
+});
diff --git a/lib/src/host/remote/sidecar-entry.ts b/lib/src/host/remote/sidecar-entry.ts
index cdd0fe365..ae751417d 100644
--- a/lib/src/host/remote/sidecar-entry.ts
+++ b/lib/src/host/remote/sidecar-entry.ts
@@ -1,7 +1,8 @@
 /**
- * Tauri-sidecar binding of {@link BurrowService}; see
- * `docs/specs/standalone.md` → "Burrow service". Stdout is reserved for
- * the JSON-lines bridge, so all logging goes to stderr.
+ * What the Tauri sidecar runs beside its PTYs from this bundle: the binding of
+ * {@link BurrowService} (`docs/specs/standalone.md` → "Burrow service") and the
+ * app's alerts (§Alerts). Stdout is reserved for the JSON-lines bridge, so all
+ * logging goes to stderr.
  *
  * The sidecar owns the PTYs, so it is also standalone's terminal-protocol parse
  * site: one parser per PTY generation feeds the webview's `pty:data`, every
@@ -9,18 +10,12 @@
  * (`docs/specs/terminal-escapes.md` → "Parsing location").
  */
 
-import {
-  createProcessedPtyStream,
-  type ProcessedPtyStream,
-} from '../../lib/processed-pty-stream';
-import type { AlertManager } from '../../lib/alert-manager';
-import {
-  applyTerminalEvents,
-  collectTerminalProtocolResponses,
-  collectTerminalToolEvents,
-  type TerminalColorProvider,
-  type TerminalColors,
-} from '../../lib/terminal-protocol';
+import type { ProcessedPtyStream } from '../../lib/processed-pty-stream';
+import type { AlertManager, AlertState } from '../../lib/alert-manager';
+import type { TerminalColorProvider, TerminalColors } from '../../lib/terminal-protocol';
+import { createAlertHost, type AlertRealm } from '../alert-host';
+import type { AlertEvents } from '../alert-protocol';
+import { alertedPty, createOwnerPtyStream } from '../owner-pty';
 import type {
   BurrowSurfaceProvider,
   PtySink,
@@ -41,13 +36,9 @@ import {
   type AnswerParams,
 } from './service-protocol';
 
-// The sidecar's alerts ride this bundle, so the parse site and the manager it
-// feeds are one module graph (`standalone/scripts/build-sidecar-proxy.mjs`).
-export { createSidecarAlerts, type SidecarAlerts } from '../alert-host';
-
 /** The slice of `pty-core`'s manager the Burrow drives. */
 export interface SidecarPtyManager {
-  write(id: string, data: string): void;
+  write(id: string, data: string, options?: { paced?: boolean }): void;
   resize(id: string, cols: number, rows: number, repaint?: boolean): void;
   /** Whether the current PTY generation still has a live process. */
   hasPty(id: string): boolean;
@@ -57,7 +48,7 @@ export interface SidecarSurfaceBridgeOptions {
   /** Writes one JSON line to the Rust bridge, which emits it to the webview. */
   send: (event: string, data: unknown) => void;
   mgr: SidecarPtyManager;
-  /** The app's one manager (`createSidecarAlerts`), fed from the parse below. */
+  /** The app's one manager (`createSidecarHost`), fed from the parse below. */
   alerts: AlertManager;
 }
 
@@ -81,8 +72,7 @@ export interface SidecarSurfaceBridge {
    * as the events this emits, so `main.js` must not forward it itself.
    */
   onPtyEvent(event: string, data: unknown): void;
-  /** A `pty:spawn` command: the id now names a new PTY generation, whose
-   *  Session starts its alert state over. */
+  /** A `pty:spawn` command: the id now names a new PTY generation. */
   onPtySpawn(id: unknown): void;
   /**
    * A `pty:themeColors` push. The sidecar has no DOM, so the webview reports its
@@ -94,7 +84,7 @@ export interface SidecarSurfaceBridge {
 
 /**
  * The provider half: PTYs answered locally, everything about the *view* of them
- * asked of the webview. Separate from {@link createSidecarBurrow} so it can
+ * asked of the webview. Separate from {@link createSidecarHost} so it can
  * be driven directly by tests, and so the next Burrow to move into its own process
  * can reuse the ask machinery without the sidecar's file store.
  */
@@ -169,62 +159,42 @@ export function createSidecarSurfaceBridge(
   /** Natural exits outlive their process so a late subscription can replay one. */
   const exits = new Map<string, number>();
 
-  /**
-   * The parse site for one PTY, feeding the alerts, the webview and every
-   * Client from the same pass: reports and command boundaries to the manager
-   * in stream order, then Tool events and semantic state to the webview, then
-   * the responses this process writes, then the output.
-   */
+  /** The parse site for one PTY (`createOwnerPtyStream`), its renderer's share
+   *  sent to the webview. */
   function ownerStream(id: string): Stream {
     let stream = streams.get(id);
     if (stream) return stream;
-    const parsed = createProcessedPtyStream({
+    const parsed = createOwnerPtyStream(id, {
+      alerts: options.alerts,
       colorProvider: themeColorProvider,
-      onEvents(events) {
-        // `recordTools` stays off: the Tool stores are the renderer's, so their
-        // events travel to it instead.
-        const semanticEvents = applyTerminalEvents(options.alerts, id, events);
-        const toolEvents = collectTerminalToolEvents(events);
-        if (toolEvents.length > 0) options.send('terminal:protocolEvents', { id, events: toolEvents });
-        if (semanticEvents.length > 0) {
-          options.send('terminal:semanticEvents', { id, events: semanticEvents });
+      onToolEvents: (events) => options.send('terminal:toolEvents', { id, events }),
+      onSemanticEvents: (events) => options.send('terminal:semanticEvents', { id, events }),
+      // Guarded because a PTY that died between the read and this write throws
+      // — `pty-core`'s own `interrupt` wraps the same call — and this runs ahead
+      // of the `pty:data` below. Losing the reply is survivable; losing the
+      // chunk the webview is about to render is not.
+      writeResponse(response) {
+        try {
+          options.mgr.write(id, response);
+        } catch (error) {
+          console.error(`[burrow] response write failed for ${id}: ${String(error)}`);
         }
-        // Written from here, never from a viewer: the owner is the sole reply
-        // authority (`docs/specs/remote-api.md` → Terminal surfaces). Guarded
-        // because a PTY that died between the read and this write throws —
-        // `pty-core`'s own `interrupt` wraps the same call — and this runs ahead
-        // of the `pty:data` below. Losing the reply is survivable; losing the
-        // chunk the webview is about to render is not.
-        for (const response of collectTerminalProtocolResponses(events)) {
-          try {
-            options.mgr.write(id, response);
-          } catch (error) {
-            console.error(`[burrow] response write failed for ${id}: ${String(error)}`);
-          }
-        }
-      },
-      onChunk(chunk) {
-        options.alerts.onData(id);
-        options.send('pty:data', { id, ...chunk });
       },
+      onChunk: (chunk) => options.send('pty:data', { id, ...chunk }),
     });
     stream = { parsed, sinks: new Map() };
     streams.set(id, stream);
     return stream;
   }
 
+  // A Client's keystrokes and resizes reach the PTY as a local renderer's do.
+  const pty = alertedPty(options.alerts, options.mgr);
+
   const { provider, notifyDirectoryChanged } = createAskSurfaceProvider(ask, {
-    // A Client's keystrokes are human input like a local one's: acknowledged,
-    // echo window opened, before the write (`docs/specs/alert.md` → Engagement).
-    writePty: (ptyId, data) => {
-      options.alerts.acknowledge(ptyId, { input: true });
-      options.mgr.write(ptyId, data);
-    },
-    // The repaint bounce's output is a resize's, never the program working.
-    resizePty: (ptyId, cols, rows, repaint) => {
-      options.alerts.onResize(ptyId);
-      options.mgr.resize(ptyId, cols, rows, repaint);
-    },
+    // The Burrow has already dropped a mirror's terminal replies, so what
+    // reaches here is a human's input.
+    writePty: (ptyId, data) => pty.write(ptyId, data, { userInput: true }),
+    resizePty: pty.resize,
 
     streamPty(ptyId, sink) {
       const subscribed = ownerStream(ptyId);
@@ -382,9 +352,6 @@ export function createSidecarSurfaceBridge(
       // one's half-read sequence into its first bytes, and the new PTY has not
       // exited whatever the old one did.
       if (typeof id !== 'string') return;
-      // At the spawn command: a cold restore seeds after it, so the seed lands
-      // on the new Session rather than being wiped by it.
-      options.alerts.restart(id);
       const stream = streams.get(id);
       const exitCode = exits.get(id) ?? 0;
       exits.delete(id);
@@ -415,7 +382,19 @@ export function createSidecarSurfaceBridge(
   };
 }
 
-export interface SidecarBurrowOptions extends SidecarSurfaceBridgeOptions {
+/** The slice of `pty-core`'s manager the host's own commands drive. */
+export interface SidecarHostPtyManager extends SidecarPtyManager {
+  spawn(id: string, options?: unknown): void;
+  kill(id: string): void;
+  gracefulKill(ids: string[], timeout?: unknown): void;
+  list(ids: unknown, forWindow: unknown, requestId: unknown, marks: unknown): void;
+}
+
+export interface SidecarHostOptions {
+  /** Writes one JSON line to the Rust bridge, which routes it
+   *  (`docs/specs/standalone.md` → "Routing"). */
+  send: (event: string, data: unknown) => void;
+  mgr: SidecarHostPtyManager;
   /**
    * Where the enrollment + ACL file lives. The browser dev harness passes a
    * per-run temp dir; standalone passes an empty value only when Rust could not
@@ -424,18 +403,63 @@ export interface SidecarBurrowOptions extends SidecarSurfaceBridgeOptions {
   stateDir?: string;
 }
 
-export interface SidecarBurrow {
-  /** One `burrow:command` line from the webview. */
-  handleCommand(data: unknown): void;
+export interface SidecarHost {
+  /** The app's one `AlertManager` (`docs/specs/standalone.md` → "Alerts").
+   *  `pty-core` reports each helper decision to it. */
+  readonly alerts: AlertManager;
+  /**
+   * One stdin command, if it is this module's — the PTY commands the alerts
+   * must see, and every alert and Burrow command. Returns whether it was.
+   */
+  handleCommand(event: string, data: unknown): boolean;
+  /**
+   * A `pty-core` event. A `data` event is parsed here and reaches the webview
+   * as the events this emits, so `main.js` must not forward it itself.
+   */
   onPtyEvent(event: string, data: unknown): void;
-  onPtySpawn(id: unknown): void;
-  setWindows(labels: unknown): void;
-  setAskDelivery(detail: unknown): void;
-  setThemeColors(colors: unknown): void;
   dispose(): void;
 }
 
-export function createSidecarBurrow(options: SidecarBurrowOptions): SidecarBurrow {
+const isString = (value: unknown): value is string => typeof value === 'string';
+
+/**
+ * Everything the sidecar runs beside its PTYs in this bundle: the parse site,
+ * the Burrow, and the app's alerts in the host role VS Code's extension host
+ * runs too (`lib/src/host/alert-host.ts`), with every window one of its
+ * viewers under its label.
+ */
+export function createSidecarHost(options: SidecarHostOptions): SidecarHost {
+  const { send, mgr } = options;
+  const alertHost = createAlertHost();
+  const alerts = alertHost.manager;
+
+  const sendAlert = <E extends keyof AlertEvents>(event: E, data: AlertEvents[E]) => send(event, data);
+  const publishState = (id: string, state: AlertState) => sendAlert('alert:state', { id, ...state });
+  const stops = [
+    alertHost.watched.subscribe((names) => sendAlert('alert:watchedCommands', { names })),
+    alertHost.settings.subscribe((settings) => sendAlert('alert:settings', { settings })),
+    alerts.onStateChange(publishState),
+  ];
+
+  /** Re-send the listed Sessions' state, every Session's when none are listed;
+   *  Rust routes each to its owner. */
+  function publish(ids: unknown): void {
+    if (!Array.isArray(ids)) {
+      for (const [id, state] of alerts.getAllStates()) publishState(id, state);
+      return;
+    }
+    for (const id of ids) {
+      if (isString(id) && alerts.has(id)) publishState(id, alerts.getState(id));
+    }
+  }
+
+  /** An await's outcome goes to the window that parked it; a `sync` re-sends
+   *  every Session's state, which reaches only the windows that own them. */
+  const realmOf = (window: string): AlertRealm => ({
+    answer: (result) => sendAlert('alert:awaitResult', { ...result, forWindow: window }),
+    resendStates: () => publish(undefined),
+  });
+
   const store = options.stateDir
     ? new FileBurrowStateStore(options.stateDir)
     : createEphemeralBurrowStateStore((message) => console.error(message));
@@ -443,13 +467,14 @@ export function createSidecarBurrow(options: SidecarBurrowOptions): SidecarBurro
   // deletes (`burrow-state-store.ts`).
   if (options.stateDir) void forgetRetiredState(options.stateDir);
 
-  const bridge = createSidecarSurfaceBridge(options);
+  const bridge = createSidecarSurfaceBridge({ send, mgr, alerts });
+  const pty = alertedPty(alerts, mgr);
 
   const service = new BurrowService({
     store,
     provider: bridge.provider,
     kind: 'standalone',
-    sendToUi: options.send,
+    sendToUi: send,
     connectSrc: bakedConnectSrc(),
     // The one host that answers a `direct-offer` today. Building the factory
     // loads nothing: the addon is opened inside the first offer, if one ever
@@ -460,24 +485,104 @@ export function createSidecarBurrow(options: SidecarBurrowOptions): SidecarBurro
     console.error(`[burrow] failed to start: ${String(error)}`);
   });
 
+  function handleBurrowCommand(data: unknown): void {
+    if (!isBurrowCommand(data)) return;
+    const command = data;
+    // Both of these feed something already waiting on this side, so they
+    // answer nothing and never reach the service's dispatch.
+    if (command.cmd === 'answer') {
+      return bridge.onAnswer(command.params as AnswerParams, command.window);
+    }
+    if (command.cmd === 'notify') return bridge.onNotify();
+    void service.handleCommand(command);
+  }
+
   return {
-    handleCommand(data) {
-      if (!isBurrowCommand(data)) return;
-      const command = data;
-      // Both of these feed something already waiting on this side, so they
-      // answer nothing and never reach the service's dispatch.
-      if (command.cmd === 'answer') {
-        return bridge.onAnswer(command.params as AnswerParams, command.window);
+    alerts,
+
+    handleCommand(event, data) {
+      const detail = (data && typeof data === 'object' ? data : {}) as Record<string, unknown>;
+      const { id } = detail;
+      switch (event) {
+        case 'pty:spawn': {
+          if (!isString(id)) return true;
+          const { alert, ...spawnOptions } = (detail.options ?? {}) as Record<string, unknown>;
+          // Before the spawn: the id may be a live PTY's, and nothing the new
+          // generation emits may land on the old one's parser or alert state.
+          // A cold restore's persisted TODO rides the spawn.
+          bridge.onPtySpawn(id);
+          alertHost.respawn(id, alert);
+          mgr.spawn(id, spawnOptions);
+          return true;
+        }
+        case 'pty:input':
+          pty.write(id as string, detail.data as string, {
+            paced: detail.paced === true,
+            userInput: detail.userInput === true,
+          });
+          return true;
+        case 'pty:resize':
+          pty.resize(id as string, detail.cols as number, detail.rows as number);
+          return true;
+        // Reached only after Rust dropped the id's owner, so the removal's
+        // state reaches no window.
+        case 'pty:kill':
+          if (isString(id)) alerts.remove(id);
+          mgr.kill(id as string);
+          return true;
+        // A closed window's leftover PTYs: gone like a kill, but gracefully.
+        // Never `pty:gracefulKill`, which the quit flush sends while windows
+        // still own their PTYs.
+        case 'pty:reap': {
+          const ids = Array.isArray(detail.ids) ? detail.ids.filter(isString) : [];
+          for (const reaped of ids) alerts.remove(reaped);
+          mgr.gracefulKill(ids, detail.timeout);
+          return true;
+        }
+        // One window's own PTYs, and the answer names it so the host can route
+        // the list and every replay behind it back (docs/specs/standalone.md).
+        // Their alert state follows, routed to each owner: a reloaded or
+        // arriving window has no other way to learn it.
+        case 'pty:requestInit':
+          mgr.list(detail.ids, detail.forWindow, detail.requestId, detail.marks);
+          publish(detail.ids);
+          return true;
+        case 'alert:command': {
+          // Unstamped: there is no window to be a viewer of, or to answer.
+          if (!isString(detail.window)) return true;
+          const { window, ...command } = detail;
+          alertHost.handle(window, command, realmOf(window));
+          return true;
+        }
+        // Which webviews will answer a Burrow ask, and which are still alert
+        // viewers (docs/specs/standalone.md -> "Burrow service").
+        case 'burrow:windows':
+          bridge.setWindows(detail.labels);
+          if (Array.isArray(detail.labels)) alertHost.retainRealms(detail.labels.filter(isString));
+          return true;
+        // Which windows an ask actually reached. Only the host knows: one naming
+        // a Surface goes to its owner alone.
+        case 'burrow:askDelivered':
+          bridge.setAskDelivery(data);
+          return true;
+        case 'burrow:command':
+          handleBurrowCommand(data);
+          return true;
+        // The webview's resolved terminal theme, so the parser here can answer
+        // OSC 10/11/12 (docs/specs/terminal-escapes.md → Supported OSCs).
+        case 'pty:themeColors':
+          bridge.setThemeColors(data);
+          return true;
+        default:
+          return false;
       }
-      if (command.cmd === 'notify') return bridge.onNotify();
-      void service.handleCommand(command);
     },
+
     onPtyEvent: bridge.onPtyEvent,
-    onPtySpawn: bridge.onPtySpawn,
-    setWindows: bridge.setWindows,
-    setAskDelivery: bridge.setAskDelivery,
-    setThemeColors: bridge.setThemeColors,
+
     dispose() {
+      for (const stop of stops) stop();
+      alertHost.dispose();
       service.dispose();
       bridge.dispose();
       // After the service, so no session is still holding a channel: the addon's
diff --git a/lib/src/lib/alert-manager-test-utils.ts b/lib/src/lib/alert-manager-test-utils.ts
index e02efd24a..06624f57e 100644
--- a/lib/src/lib/alert-manager-test-utils.ts
+++ b/lib/src/lib/alert-manager-test-utils.ts
@@ -1,18 +1,21 @@
 /**
- * Drivers the suites that feed an `AlertManager` directly share
+ * Drivers and fixtures the suites that feed an `AlertManager` share
  * (`alert-manager.test.ts`, `alert-engagement.test.ts`,
- * `alert-resumed-output.test.ts`). Each takes the manager it drives and runs
- * under fake timers.
+ * `alert-resumed-output.test.ts`, the host suites). Each driver takes the
+ * manager it drives and runs under fake timers.
  *
  * Timing from cfg.alert: busyCandidateGap=1500, busyConfirmGap=500,
  * mightNeedAttention=2000, needsAttentionConfirm=3000.
  */
 import { vi } from 'vitest';
-import type { AlertManager } from './alert-manager';
+import type { ActivityNotification, AlertManager } from './alert-manager';
 
 /** The viewer a suite reports for when one renderer realm is enough. */
 export const VIEWER = 'viewer';
 
+/** A terminal report asking for the human, as `OSC 9` parses. */
+export const REPORT: ActivityNotification = { source: 'OSC 9', title: null, body: 'needs input' };
+
 /** The user is present, `viewer` pointing at `id` (`docs/specs/alert.md` -> Engagement). */
 export function engage(manager: AlertManager, id: string, viewer = VIEWER): void {
   manager.setViewer(viewer, { present: true, focusId: id });
diff --git a/lib/src/lib/alert-manager.test.ts b/lib/src/lib/alert-manager.test.ts
index a21db01c2..3c63b016c 100644
--- a/lib/src/lib/alert-manager.test.ts
+++ b/lib/src/lib/alert-manager.test.ts
@@ -16,6 +16,7 @@ import {
   goIdle,
   heartbeat,
   leave,
+  REPORT,
   runCommand,
   settle,
 } from './alert-manager-test-utils';
@@ -288,7 +289,7 @@ describe('AlertManager in isolation', () => {
     if (source === 'watching') {
       driveToRinging(id);
     } else if (source === 'report') {
-      manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'needs input' });
+      manager.notifyFromProtocol(id, REPORT);
     } else {
       armCommandExit(manager, id);
       vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
@@ -1810,7 +1811,7 @@ describe('AlertManager in isolation', () => {
       runCommand(manager, id);
 
       const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
-      manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'needs input' });
+      manager.notifyFromProtocol(id, REPORT);
 
       expect(await handle.promise).toEqual({ kind: 'resolved', cause: 'bell', waitedMs: 0 });
       expect(manager.getState(id)).toMatchObject({ todo: false, notification: null });
diff --git a/lib/src/lib/alert-manager.ts b/lib/src/lib/alert-manager.ts
index 93344fc80..82e173ab4 100644
--- a/lib/src/lib/alert-manager.ts
+++ b/lib/src/lib/alert-manager.ts
@@ -158,10 +158,6 @@ export type EngagementLapse = 'idle' | 'leave';
 
 const NOT_ENGAGED: Engagement = { present: false, focusId: null };
 
-/** The one viewer of a manager that serves a single renderer realm: the fake
- *  adapter's. */
-export const LOCAL_VIEWER = 'local';
-
 export function normalizeActivityNotification(value: unknown): ActivityNotification | null {
   if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
   const record = value as Record<string, unknown>;
@@ -1148,6 +1144,11 @@ export class AlertManager {
     this.setViewer(viewerId, NOT_ENGAGED, 'leave');
   }
 
+  /** Every present viewer. An absent one engages nothing, so it is not kept. */
+  viewerIds(): string[] {
+    return [...this.viewers.keys()];
+  }
+
   /**
    * A human interacted with the Session. Both kinds clear the ring and whatever
    * it held or deferred, and mark the running command seen; `input` — keys, a
@@ -1249,6 +1250,12 @@ export class AlertManager {
     };
   }
 
+  /** Whether `id` has state to publish: an entry that is not a helper's.
+   *  Exactly the ids {@link getAllStates} answers. */
+  has(id: string): boolean {
+    return this.entries.has(id) && !this.helpers.has(id);
+  }
+
   getAllStates(): Map<string, AlertState> {
     const result = new Map<string, AlertState>();
     for (const [id] of this.entries) {
@@ -1280,8 +1287,7 @@ export class AlertManager {
   /**
    * A new PTY generation under `id`: what the old one left goes as on
    * `remove`, but no tombstone, since the output about to arrive is the new
-   * Session's own. A host whose restore seeds after the spawn calls this at
-   * the spawn; one that seeds before it must not.
+   * Session's own.
    */
   restart(id: string): void {
     this.remove(id);
diff --git a/lib/src/lib/alert-settings-host.ts b/lib/src/lib/alert-settings-host.ts
index 5c3a35443..82f76e43c 100644
--- a/lib/src/lib/alert-settings-host.ts
+++ b/lib/src/lib/alert-settings-host.ts
@@ -54,7 +54,10 @@ export class AlertSettingsHost {
     this.target.applySettings(this.settings);
   }
 
-  private publish(): void {
+  /** The canonical blob to every subscriber, once there is one: a snapshot
+   *  sent before any renderer seeded would replace their persisted settings. */
+  publish(): void {
+    if (!this.initialized) return;
     for (const listener of this.listeners) listener(this.settings);
   }
 }
diff --git a/lib/src/lib/platform/fake-adapter.ts b/lib/src/lib/platform/fake-adapter.ts
index 8122821d6..74a846141 100644
--- a/lib/src/lib/platform/fake-adapter.ts
+++ b/lib/src/lib/platform/fake-adapter.ts
@@ -1,8 +1,8 @@
-import { DEFAULT_HELPER_COMMAND, type HelperIdentity, type TerminalContextRequest, type TerminalContextInfo } from '../terminal-context-types';
-import type { AlertStateDetail, OpenPort, PlatformAdapter, PtyDataDetail, PtyInfo, BurrowLink, WritePtyOptions } from './types';
-import { AlertManager, LOCAL_VIEWER } from '../alert-manager';
-import type { AwaitHandle, AwaitOptions, Engagement, EngagementLapse } from '../alert-manager';
-import type { AlertSettings } from '../alert-settings';
+import { DEFAULT_HELPER_COMMAND, type TerminalContextRequest, type TerminalContextInfo } from '../terminal-context-types';
+import type { OpenPort, PlatformAdapter, PtyDataDetail, PtyInfo, BurrowLink, SpawnPtyOptions, WritePtyOptions } from './types';
+import type { AlertManager } from '../alert-manager';
+import { createAlertHost, type AlertHost, type AlertRealm } from '../../host/alert-host';
+import { createAlertClient, type AlertClientMethods } from '../../host/alert-client';
 import { normalizeExternalUri } from '../external-links';
 import {
   createMemoryNotepadArchivePort,
@@ -18,6 +18,10 @@ import {
   applyTerminalSemanticEvents,
 } from '../terminal-state-store';
 import { themeColorProvider } from '../terminal-theme';
+import { recordToolEvents } from '../tool-events';
+
+/** This renderer is its host's one realm. */
+const LOCAL_VIEWER = 'local';
 
 export interface FakeScenario {
   name: string;
@@ -40,11 +44,13 @@ export interface FakePtyResizeDetail extends FakePtySize {
 
 const DEFAULT_PTY_SIZE: FakePtySize = { cols: 80, rows: 30 };
 
+/** The `alert*` platform methods, taken from the shared client in the constructor. */
+export interface FakePtyAdapter extends AlertClientMethods {}
+
 export class FakePtyAdapter implements PlatformAdapter {
   private dataHandlers = new Set<(detail: PtyDataDetail) => void>();
   private exitHandlers = new Set<(detail: { id: string; exitCode: number }) => void>();
   private resizeHandlers = new Set<(detail: FakePtyResizeDetail) => void>();
-  private alertStateHandlers = new Set<(detail: AlertStateDetail) => void>();
   private spawnHandlers = new Set<(detail: { id: string }) => void>();
   private terminals = new Set<string>();
   /** The deterministic demo shell behind each helper (docs/specs/terminal-context.md). */
@@ -57,7 +63,25 @@ export class FakePtyAdapter implements PlatformAdapter {
   private inputHandlers = new Map<string, (data: string) => void>();
   private protocolParsers = new Map<string, TerminalProtocolParser>();
   private openPortsMap = new Map<string, OpenPort[]>();
-  private alertManager = new AlertManager();
+  /**
+   * The alerts' host role, in process: the renderer's verbs reach it through
+   * the client every host shares, and its events come straight back, as they
+   * would over a real host's transport (`lib/src/host/alert-host.ts`).
+   */
+  private alertHost!: AlertHost;
+  private stopAlertHost: () => void = () => {};
+  private readonly alerts = createAlertClient((command) => this.alertHost.handle(LOCAL_VIEWER, command, this.alertRealm));
+  private readonly alertRealm: AlertRealm = {
+    answer: (result) => void this.alerts.onEvent('alert:awaitResult', result),
+    resendStates: () => {
+      for (const [id, state] of this.alertManager.getAllStates()) this.alerts.onEvent('alert:state', { id, ...state });
+    },
+  };
+
+  /** The PTY side feeds the manager directly, as a host's own PTYs do. */
+  private get alertManager(): AlertManager {
+    return this.alertHost.manager;
+  }
 
   // Host-capability flags: mutable and public because the Storybook preview
   // decorator toggles them per story to simulate a host (VS Code) that owns the
@@ -84,11 +108,22 @@ export class FakePtyAdapter implements PlatformAdapter {
   browserReservesNotepadChord?: boolean;
 
   constructor() {
-    this.alertManager.onStateChange((id, state) => {
-      for (const handler of this.alertStateHandlers) {
-        handler({ id, ...state });
-      }
-    });
+    Object.assign(this, this.alerts.methods);
+    this.startAlertHost();
+  }
+
+  private startAlertHost(): void {
+    const host = createAlertHost();
+    const stops = [
+      host.manager.onStateChange((id, state) => void this.alerts.onEvent('alert:state', { id, ...state })),
+      host.watched.subscribe((names) => void this.alerts.onEvent('alert:watchedCommands', { names })),
+      host.settings.subscribe((settings) => void this.alerts.onEvent('alert:settings', { settings })),
+    ];
+    this.alertHost = host;
+    this.stopAlertHost = () => {
+      for (const stop of stops) stop();
+      host.dispose();
+    };
   }
 
   async init(): Promise<void> {}
@@ -129,20 +164,20 @@ export class FakePtyAdapter implements PlatformAdapter {
     this.inputHandlers.clear();
     this.protocolParsers.clear();
     this.openPortsMap.clear();
-    this.alertManager.dispose();
-    this.alertManager = new AlertManager();
-    this.alertManager.onStateChange((id, state) => {
-      for (const handler of this.alertStateHandlers) {
-        handler({ id, ...state });
-      }
-    });
+    // What this realm parked settles `cancelled`, as a disposing adapter's does.
+    this.alerts.dispose();
+    this.stopAlertHost();
+    this.startAlertHost();
   }
 
   async getAvailableShells(): Promise<{ name: string; path: string; args?: string[] }[]> {
     return [{ name: 'fake-shell', path: '/bin/fake', args: [] }];
   }
 
-  spawnPty(id: string, options?: { cols?: number; rows?: number; cwd?: string; helper?: HelperIdentity }): void {
+  spawnPty(id: string, options?: SpawnPtyOptions): void {
+    // A new generation starts its alert state over, from what a cold restore
+    // persisted, as every host's spawn does.
+    this.alertHost.respawn(id, options?.alert);
     if (options?.helper) {
       this.helpers.set(id, { cwd: options.cwd ?? '/home/demo/projects/dormouse', busy: false });
       this.alertManager.setHelper(id, true);
@@ -223,6 +258,7 @@ export class FakePtyAdapter implements PlatformAdapter {
   }
 
   resizePty(id: string, cols: number, rows: number): void {
+    this.alertManager.onResize(id);
     if (!this.terminals.has(id)) return;
     const next = { cols, rows };
     const prev = this.terminalSizes.get(id);
@@ -244,7 +280,8 @@ export class FakePtyAdapter implements PlatformAdapter {
     this.inputHandlers.delete(id);
     this.protocolParsers.delete(id);
     this.openPortsMap.delete(id);
-    this.alertManager.onExit(id, 0);
+    // The Session is over, so its alert state goes with it.
+    this.alertManager.remove(id);
     this.helpers.delete(id);
     for (const handler of this.exitHandlers) {
       handler({ id, exitCode: 0 });
@@ -324,24 +361,6 @@ export class FakePtyAdapter implements PlatformAdapter {
   offRequestSessionFlush(_handler: (detail: { requestId: string }) => void): void {}
   notifySessionFlushComplete(_requestId: string): void {}
 
-  // Alert management (a local AlertManager: this renderer is its one viewer)
-  alertRemove(id: string): void { this.alertManager.remove(id); }
-  alertSetWatchedCommands(names: string[]): void { this.alertManager.setWatchedCommands(names); }
-  alertSetCommandWatched(name: string, watched: boolean): void { this.alertManager.setCommandWatched(name, watched); }
-  alertPublishSettings(settings: AlertSettings): void { this.alertManager.applySettings(settings); }
-  alertDismiss(id: string): void { this.alertManager.dismissAlert(id); }
-  alertEngagement(state: Engagement, lapse?: EngagementLapse): void { this.alertManager.setViewer(LOCAL_VIEWER, state, lapse); }
-  alertAcknowledge(id: string): void { this.alertManager.acknowledge(id, { input: false }); }
-  alertResize(id: string): void { this.alertManager.onResize(id); }
-  alertToggleTodo(id: string): void { this.alertManager.toggleTodo(id); }
-  alertClearTodo(id: string): void { this.alertManager.clearTodo(id); }
-  alertAwait(id: string, options: AwaitOptions): AwaitHandle { return this.alertManager.awaitCompletion(id, options); }
-  onAlertState(handler: (detail: AlertStateDetail) => void): void { this.alertStateHandlers.add(handler); }
-  // Single renderer owning the AlertManager, so localStorage is the only store
-  // and there is no canonical snapshot to broadcast back.
-  onWatchedCommands(_handler: (names: string[]) => void): void {}
-  onAlertSettings(_handler: (settings: AlertSettings) => void): void {}
-
   private savedState: unknown = null;
   saveState(state: unknown): void { this.savedState = state; }
   getState(): unknown { return this.savedState; }
@@ -453,7 +472,9 @@ export class FakePtyAdapter implements PlatformAdapter {
 
   private emitPtyData(id: string, data: string, options: { skipActivity?: boolean } = {}): void {
     const parsed = this.getProtocolParser(id).process(data);
-    applyTerminalSemanticEvents(id, applyTerminalEvents(this.alertManager, id, parsed.events, { recordTools: true }));
+    // The Tool stores are this renderer's own.
+    recordToolEvents(id, parsed.events);
+    applyTerminalSemanticEvents(id, applyTerminalEvents(this.alertManager, id, parsed.events));
     const inputHandler = this.inputHandlers.get(id);
     for (const response of collectTerminalProtocolResponses(parsed.events)) {
       inputHandler?.(response);
diff --git a/lib/src/lib/platform/replay-parse.ts b/lib/src/lib/platform/replay-parse.ts
new file mode 100644
index 000000000..696b434bc
--- /dev/null
+++ b/lib/src/lib/platform/replay-parse.ts
@@ -0,0 +1,21 @@
+import { collectTerminalSemanticEvents, TerminalProtocolParser } from '../terminal-protocol';
+import { applyTerminalSemanticEvents } from '../terminal-state-store';
+import { themeColorProvider } from '../terminal-theme';
+import { recordToolEvents } from '../tool-events';
+
+/**
+ * One `pty:replay`, parsed where it lands. Replay arrives as raw buffered
+ * output, the one stream its host does not parse for the renderer, so a
+ * one-shot parser rebuilds the renderer's Tool and semantic state from it and
+ * strips what xterm.js must not see; the visible text is returned. Its reports
+ * and responses are dropped: the host's own parse already fed its alerts and
+ * answered (`docs/specs/terminal-escapes.md` → "Parsing location"). It still
+ * takes the theme, because a *declined* colour query is not consumed and would
+ * reach xterm.js instead, and answering is the owner's alone.
+ */
+export function parseReplay(id: string, data: string): string {
+  const parsed = new TerminalProtocolParser(themeColorProvider).process(data);
+  recordToolEvents(id, parsed.events);
+  applyTerminalSemanticEvents(id, collectTerminalSemanticEvents(parsed.events));
+  return parsed.visibleData;
+}
diff --git a/lib/src/lib/platform/types.ts b/lib/src/lib/platform/types.ts
index b8b49d7d5..ff93b91b5 100644
--- a/lib/src/lib/platform/types.ts
+++ b/lib/src/lib/platform/types.ts
@@ -225,6 +225,16 @@ export interface SessionFlushRequest {
   probeCwd?: boolean;
 }
 
+export interface SpawnPtyOptions {
+  cols?: number;
+  rows?: number;
+  cwd?: string;
+  shell?: string;
+  args?: string[];
+  helper?: HelperIdentity;
+  alert?: PersistedAlertState;
+}
+
 export interface WritePtyOptions {
   /** Deliver at typing pace (`docs/specs/transport.md` → "Paced input"). */
   paced?: boolean;
@@ -252,7 +262,12 @@ export interface PlatformAdapter {
   terminalContext?(request: TerminalContextRequest): Promise<TerminalContextInfo>;
 
   // PTY operations
-  spawnPty(id: string, options?: { cols?: number; rows?: number; cwd?: string; shell?: string; args?: string[]; helper?: HelperIdentity }): void;
+  /**
+   * `alert` is a cold-restored pane's persisted TODO: the host starts the id's
+   * alert state over at every spawn, then seeds it from this
+   * (`docs/specs/alert.md` -> "Persist only").
+   */
+  spawnPty(id: string, options?: SpawnPtyOptions): void;
   writePty(id: string, data: string, options?: WritePtyOptions): void;
   resizePty(id: string, cols: number, rows: number): void;
   killPty(id: string): void;
@@ -303,17 +318,6 @@ export interface PlatformAdapter {
    */
   requestAppRestart?(requester?: string): Promise<boolean>;
 
-  /**
-   * Seed a cold-restored Surface's persisted TODO/alert into the host's
-   * `AlertManager`, so the freshly spawned PTY inherits the state its saved pane
-   * carried (`docs/specs/alert.md` -> "Persist only"). Called after the spawn.
-   *
-   * Present only on standalone, whose sidecar holds no persisted session, so
-   * the restore path is the only thing that can seed it. VS Code omits it — its
-   * extension host seeds its own manager while answering the webview's boot
-   * (`vscode-ext/src/message-router.ts`).
-   */
-  alertSeed?(id: string, state: PersistedAlertState): void;
 
   // PTY queries
   getCwd(id: string): Promise<string | null>;
@@ -455,8 +459,8 @@ export interface PlatformAdapter {
   offRequestSessionFlush(handler: (detail: SessionFlushRequest) => void): void;
   notifySessionFlushComplete(requestId: string): void;
 
-  // Alert management
-  alertRemove(id: string): void;
+  // Alert management: a Session's alert state follows its PTY — `writePty`'s
+  // `userInput` acknowledges, a resize opens its grace window, a kill removes it.
   /** Offer persisted WATCHING rules as the host's startup seed. */
   alertSetWatchedCommands(names: string[]): void;
   /** Mutate one bare-command WATCHING rule without replacing unrelated rules. */
@@ -475,7 +479,6 @@ export interface PlatformAdapter {
   alertEngagement(state: Engagement, lapse?: EngagementLapse): void;
   /** A human gesture reached the Session without input; input rides `writePty`'s `userInput`. */
   alertAcknowledge(id: string): void;
-  alertResize(id: string): void;
   alertToggleTodo(id: string): void;
   alertClearTodo(id: string): void;
   /**
diff --git a/lib/src/lib/platform/vscode-adapter.test.ts b/lib/src/lib/platform/vscode-adapter.test.ts
index a4fe1b271..2fd6db7d0 100644
--- a/lib/src/lib/platform/vscode-adapter.test.ts
+++ b/lib/src/lib/platform/vscode-adapter.test.ts
@@ -157,81 +157,39 @@ describe('VSCodeAdapter PTY exit handling', () => {
     });
   });
 
-  it('sends watched-command initialization and mutations as distinct messages', () => {
-    const adapter = new VSCodeAdapter();
-
-    adapter.alertSetWatchedCommands(['claude']);
-    adapter.alertSetCommandWatched('npm', true);
-
-    expect(postMessage).toHaveBeenCalledWith({
-      type: 'alert:initializeWatchedCommands',
-      names: ['claude'],
-    });
-    expect(postMessage).toHaveBeenCalledWith({
-      type: 'alert:setCommandWatched',
-      name: 'npm',
-      watched: true,
-    });
-  });
-
-  // The AlertManager lives in the extension host, so `dor await` parks there
-  // and only the outcome crosses back (docs/specs/alert.md → Await).
-  it('parks an await in the extension host and settles it from the result message', async () => {
+  // The shared client's own suite covers what each verb sends; this is the
+  // transport: one `alert:command` message out, the host's events back in.
+  it('carries every alert verb as one alert:command and hands the host\'s events to the client', async () => {
     const adapter = new VSCodeAdapter();
+    const states: unknown[] = [];
+    adapter.onAlertState((detail) => void states.push(detail));
 
     const handle = adapter.alertAwait('pane-1', { until: 'quiet', timeoutMs: 600_000 });
-    const [request] = postMessage.mock.calls[0] as [{ type: string; requestId: string }];
-    expect(request).toMatchObject({
-      type: 'alert:await',
-      id: 'pane-1',
-      until: 'quiet',
-      timeoutMs: 600_000,
-    });
+    const [request] = postMessage.mock.calls[0] as [{ type: string; command: { op: string; awaitId: string } }];
+    expect(request).toMatchObject({ type: 'alert:command', command: { op: 'await', id: 'pane-1', until: 'quiet' } });
 
     windowTarget.dispatchEvent(hostMessage({
       type: 'alert:awaitResult',
-      requestId: request.requestId,
+      awaitId: request.command.awaitId,
       outcome: { kind: 'resolved', cause: 'quiet', waitedMs: 12_345 },
     }));
-
     expect(await handle.promise).toEqual({ kind: 'resolved', cause: 'quiet', waitedMs: 12_345 });
-  });
-
-  it('asks the host to cancel and still takes the outcome from the result message', async () => {
-    const adapter = new VSCodeAdapter();
-
-    const handle = adapter.alertAwait('pane-1', { until: 'exit', timeoutMs: 1_000 });
-    const [request] = postMessage.mock.calls[0] as [{ requestId: string }];
-    handle.cancel();
-
-    expect(postMessage).toHaveBeenCalledWith({ type: 'alert:awaitCancel', requestId: request.requestId });
-
-    // The host answers the cancel through the same channel, so a claim is never
-    // released locally and then again remotely.
-    windowTarget.dispatchEvent(hostMessage({
-      type: 'alert:awaitResult',
-      requestId: request.requestId,
-      outcome: { kind: 'cancelled', waitedMs: 40 },
-    }));
-    expect(await handle.promise).toEqual({ kind: 'cancelled', waitedMs: 40 });
-  });
-
-  it('forwards the host canonical watched-command snapshot', () => {
-    const adapter = new VSCodeAdapter();
-    const snapshots: string[][] = [];
-    adapter.onWatchedCommands((names) => snapshots.push(names));
-
-    windowTarget.dispatchEvent(hostMessage({ type: 'alert:watchedCommands', names: ['claude', 'npm'] }));
 
-    expect(snapshots).toEqual([['claude', 'npm']]);
+    // Handed over without the envelope: neither the type nor the host token.
+    windowTarget.dispatchEvent(hostMessage({ type: 'alert:state', id: 'pane-1', status: 'ALERT_RINGING', todo: true }));
+    expect(states).toEqual([{ id: 'pane-1', status: 'ALERT_RINGING', todo: true }]);
   });
 
   it('receives dirty state/reset messages and retains ordered replay reports through the semantic batch', () => {
     new VSCodeAdapter();
     const id = 'dirty-vscode';
-    windowTarget.dispatchEvent(hostMessage({ type: 'terminal:toolState', id, dirty: true }));
+    windowTarget.dispatchEvent(hostMessage({ type: 'terminal:toolEvents', id, events: [
+      { kind: 'toolState', state: { dirty: true } },
+    ] }));
     expect(getToolDirty(id)).toBe(true);
-    windowTarget.dispatchEvent(hostMessage({ type: 'terminal:toolState', id, dirty: null }));
+    windowTarget.dispatchEvent(hostMessage({ type: 'terminal:toolEvents', id, events: [
+      { kind: 'semantic', event: { type: 'commandStart', source: 'osc633_boundaries' } },
+    ] }));
     expect(getToolDirty(id)).toBeNull();
     const before = postMessage.mock.calls.length;
     windowTarget.dispatchEvent(hostMessage({ type: 'pty:replay', id, data: '\x1b]633;C\x07\x1b]367;state;{"v":1,"dirty":false}\x07\x1b]633;D;0\x07' }));
@@ -246,9 +204,17 @@ describe('VSCodeAdapter PTY exit handling', () => {
   it('receives owner-parsed Tool announcements and reconstructs them on replay', () => {
     resetToolAnnounces();
     const adapter = new VSCodeAdapter();
-    windowTarget.dispatchEvent(hostMessage({ type: 'terminal:toolAnnounce', id: 'tool-1', announce: { port: 6006, name: null, key: null, dehydrate: false, persist: null } }));
+    // In stream order: a start retires the run before it, and a report later
+    // in the same batch belongs to the new run.
+    windowTarget.dispatchEvent(hostMessage({ type: 'terminal:toolEvents', id: 'tool-1', events: [
+      { kind: 'toolAnnounce', announce: { port: 6005, name: null, key: null, dehydrate: false, persist: null } },
+      { kind: 'semantic', event: { type: 'commandStart', source: 'osc633_boundaries' } },
+      { kind: 'toolAnnounce', announce: { port: 6006, name: null, key: null, dehydrate: false, persist: null } },
+    ] }));
     expect(getToolAnnounce('tool-1')?.port).toBe(6006);
-    windowTarget.dispatchEvent(hostMessage({ type: 'terminal:toolAnnounce', id: 'tool-1', announce: null }));
+    windowTarget.dispatchEvent(hostMessage({ type: 'terminal:toolEvents', id: 'tool-1', events: [
+      { kind: 'semantic', event: { type: 'commandStart', source: 'osc633_boundaries' } },
+    ] }));
     expect(getToolAnnounce('tool-1')).toBeNull();
     const repliesBeforeReplay = postMessage.mock.calls.length;
     windowTarget.dispatchEvent(hostMessage({ type: 'pty:replay', id: 'tool-1', data: '\x1b]367;serve;{"port":6007}\x1b\\' }));
diff --git a/lib/src/lib/platform/vscode-adapter.ts b/lib/src/lib/platform/vscode-adapter.ts
index d9d2a5fef..1b2aa673c 100644
--- a/lib/src/lib/platform/vscode-adapter.ts
+++ b/lib/src/lib/platform/vscode-adapter.ts
@@ -1,12 +1,10 @@
-import { recordToolDirty } from '../tool-dirty-store';
-import { recordToolAnnounce } from '../tool-announce-store';
 import { recordToolEvents } from '../tool-events';
-import type { HelperIdentity, TerminalContextRequest, TerminalContextInfo } from '../terminal-context-types';
-import type { AgentBrowserCommandResult, AgentBrowserEditOp, AgentBrowserEditResult, AgentBrowserOpenResult, AgentBrowserPopResult, AgentBrowserScreenshotResult, AgentBrowserStreamStatusResult, AlertStateDetail, IframeProxyResult, OpenPort, PlatformAdapter, PtyDataDetail, PtyInfo, BurrowLink, ToolControlResult, ToolHostRequest, WritePtyOptions } from './types';
+import type { TerminalContextRequest, TerminalContextInfo } from '../terminal-context-types';
+import type { AgentBrowserCommandResult, AgentBrowserEditOp, AgentBrowserEditResult, AgentBrowserOpenResult, AgentBrowserPopResult, AgentBrowserScreenshotResult, AgentBrowserStreamStatusResult, IframeProxyResult, OpenPort, PlatformAdapter, PtyDataDetail, PtyInfo, BurrowLink, SpawnPtyOptions, ToolControlResult, ToolHostRequest, WritePtyOptions } from './types';
 import { openPortRequestTimeoutMs } from './types';
 import { createBurrowLinkClient } from '../../host/remote/link-client';
-import type { AwaitHandle, AwaitOptions, AwaitOutcome, Engagement, EngagementLapse } from '../alert-manager';
-import type { AlertSettings } from '../alert-settings';
+import { createAlertClient, type AlertClientMethods } from '../../host/alert-client';
+import { isAlertEvent } from '../../host/alert-protocol';
 import type {
   NotepadArchiveLoadResult,
   NotepadArchivePort,
@@ -17,15 +15,12 @@ import { readInjectedRecoveryCommands } from '../vscode-recovery-global';
 import { readInjectedVolatileNotepad } from '../vscode-notepad-global';
 import { setDefaultShellOpts } from '../shell-defaults';
 import { embedderOrigins } from '../embedder-origins';
-import {
-  collectTerminalSemanticEvents,
-  TerminalProtocolParser,
-} from '../terminal-protocol';
 import {
   applyTerminalSemanticEvents,
 } from '../terminal-state-store';
-import { getTerminalTheme, onTerminalThemeChange, themeColorProvider } from '../terminal-theme';
-import { isHostMessage, readHostMessageToken } from '../vscode-message-token';
+import { getTerminalTheme, onTerminalThemeChange } from '../terminal-theme';
+import { HOST_MESSAGE_TOKEN_FIELD, isHostMessage, readHostMessageToken } from '../vscode-message-token';
+import { parseReplay } from './replay-parse';
 import { cancelDorControlRequest, dispatchDorControlRequest } from './dor-control-dispatch';
 import type { VSCodeWorkbenchCommand } from '../vscode-keybindings';
 
@@ -37,8 +32,8 @@ import type { VSCodeWorkbenchCommand } from '../vscode-keybindings';
  */
 const DETACHED = Symbol('detached');
 
-/** The outcome a VS Code await handle reports when it can never be answered. */
-const CANCELLED_AWAIT: AwaitOutcome = { kind: 'cancelled', waitedMs: 0 };
+/** The `alert*` platform methods, taken from the shared client in the constructor. */
+export interface VSCodeAdapter extends AlertClientMethods {}
 
 export class VSCodeAdapter implements PlatformAdapter {
   // VS Code owns the theme here: it provides --vscode-* itself and has its own
@@ -58,9 +53,9 @@ export class VSCodeAdapter implements PlatformAdapter {
   private listHandlers = new Set<(detail: { ptys: PtyInfo[] }) => void>();
   private replayHandlers = new Set<(detail: { id: string; data: string }) => void>();
   private flushRequestHandlers = new Set<(detail: { requestId: string }) => void>();
-  private alertStateHandlers = new Set<(detail: AlertStateDetail) => void>();
-  private watchedCommandHandlers = new Set<(names: string[]) => void>();
-  private alertSettingsHandlers = new Set<(settings: AlertSettings) => void>();
+  // The alerts live in the extension host (`lib/src/host/alert-host.ts`); this
+  // webview is one of their viewers, through the client every host shares.
+  private readonly alerts = createAlertClient((command) => this.vscode.postMessage({ type: 'alert:command', command }));
   // --- Remote host bridge (docs/specs/remote-api.md) ---
   //
   // The Burrow lives in the extension host, next to the PTYs, in whichever VS
@@ -120,6 +115,7 @@ export class VSCodeAdapter implements PlatformAdapter {
 
   constructor() {
     this.vscode = acquireVsCodeApi();
+    Object.assign(this, this.alerts.methods);
 
     // These get called through detached references in the agent-browser panel
     // (e.g. `getPlatform().agentBrowserScreenshot`), which would otherwise drop
@@ -171,46 +167,23 @@ export class VSCodeAdapter implements PlatformAdapter {
           handler({ ptys: msg.ptys });
         }
       } else if (msg.type === 'pty:replay') {
-        // Replay arrives as raw buffered output in a single chunk. Live pty:data
-        // is pre-parsed by the extension host, so we only need a one-shot parser
-        // here to reconstruct semantic state from the buffered bytes and strip
-        // OSCs before xterm sees them. See docs/specs/vscode.md. It gets the
-        // theme for the same reason every other parser does: a *declined* query
-        // is not consumed, so it reaches xterm.js, and answering is the owner's
-        // alone. The replay report filter catches the reply that provokes — a
-        // backstop, not the contract.
-        const parser = new TerminalProtocolParser(themeColorProvider);
-        const parsed = parser.process(msg.data);
-        recordToolEvents(msg.id, parsed.events);
-        applyTerminalSemanticEvents(msg.id, collectTerminalSemanticEvents(parsed.events));
+        // The replay report filter catches the reply a declined colour query
+        // provokes — a backstop, not the contract.
+        const data = parseReplay(msg.id, msg.data);
         for (const handler of this.replayHandlers) {
-          handler({ id: msg.id, data: parsed.visibleData });
+          handler({ id: msg.id, data });
         }
-      } else if (msg.type === 'terminal:toolState') {
-        recordToolDirty(msg.id, msg.dirty);
-      } else if (msg.type === 'terminal:toolAnnounce') {
-        recordToolAnnounce(msg.id, msg.announce);
+      } else if (msg.type === 'terminal:toolEvents') {
+        recordToolEvents(msg.id, msg.events ?? []);
       } else if (msg.type === 'terminal:semanticEvents') {
         applyTerminalSemanticEvents(msg.id, msg.events ?? []);
       } else if (msg.type === 'dormouse:flushSessionSave') {
         for (const handler of this.flushRequestHandlers) {
           handler({ requestId: msg.requestId });
         }
-      } else if (msg.type === 'alert:state') {
-        // The host posts the whole `AlertState`; forwarding it wholesale is what
-        // keeps a new alert field from needing an edit on this path alone.
-        const { type: _type, ...detail } = msg;
-        for (const handler of this.alertStateHandlers) {
-          handler(detail);
-        }
-      } else if (msg.type === 'alert:watchedCommands') {
-        for (const handler of this.watchedCommandHandlers) {
-          handler(msg.names);
-        }
-      } else if (msg.type === 'alert:settings') {
-        for (const handler of this.alertSettingsHandlers) {
-          handler(msg.settings);
-        }
+      } else if (isAlertEvent(msg.type)) {
+        const { type, [HOST_MESSAGE_TOKEN_FIELD]: _token, ...data } = msg;
+        this.alerts.onEvent(type, data);
       } else if (msg.type === 'dormouse:newTerminal') {
         window.dispatchEvent(new CustomEvent('dormouse:new-terminal', {
           detail: {
@@ -328,8 +301,9 @@ export class VSCodeAdapter implements PlatformAdapter {
 
   shutdown(): void {
     // The extension host handles PTY cleanup, but nothing there will answer a
-    // command this webview is still holding once it goes away.
+    // command or an await this webview is still holding once it goes away.
     this.burrowClient.dispose();
+    this.alerts.dispose();
   }
 
   async getAvailableShells(): Promise<{ name: string; path: string; args?: string[] }[]> {
@@ -347,7 +321,7 @@ export class VSCodeAdapter implements PlatformAdapter {
     return result;
   }
 
-  spawnPty(id: string, options?: { cols?: number; rows?: number; cwd?: string; shell?: string; args?: string[]; helper?: HelperIdentity }): void {
+  spawnPty(id: string, options?: SpawnPtyOptions): void {
     this.vscode.postMessage({ type: 'pty:spawn', id, options });
   }
 
@@ -561,83 +535,6 @@ export class VSCodeAdapter implements PlatformAdapter {
     this.vscode.postMessage({ type: 'dormouse:flushSessionSaveDone', requestId });
   }
 
-  // --- Alert management (proxied to extension host) ---
-
-  alertRemove(id: string): void {
-    this.vscode.postMessage({ type: 'alert:remove', id });
-  }
-
-  alertSetWatchedCommands(names: string[]): void {
-    this.vscode.postMessage({ type: 'alert:initializeWatchedCommands', names });
-  }
-
-  alertSetCommandWatched(name: string, watched: boolean): void {
-    this.vscode.postMessage({ type: 'alert:setCommandWatched', name, watched });
-  }
-
-  alertPublishSettings(settings: AlertSettings, opts: { seed: boolean }): void {
-    this.vscode.postMessage({
-      type: opts.seed ? 'alert:initializeSettings' : 'alert:updateSettings',
-      settings,
-    });
-  }
-
-  alertDismiss(id: string): void {
-    this.vscode.postMessage({ type: 'alert:dismiss', id });
-  }
-
-  alertEngagement(state: Engagement, lapse?: EngagementLapse): void {
-    this.vscode.postMessage({ type: 'alert:engagement', state, lapse });
-  }
-
-  alertAcknowledge(id: string): void {
-    this.vscode.postMessage({ type: 'alert:acknowledge', id });
-  }
-
-  alertResize(id: string): void {
-    this.vscode.postMessage({ type: 'alert:resize', id });
-  }
-
-  alertToggleTodo(id: string): void {
-    this.vscode.postMessage({ type: 'alert:toggleTodo', id });
-  }
-
-  alertClearTodo(id: string): void {
-    this.vscode.postMessage({ type: 'alert:clearTodo', id });
-  }
-
-  /**
-   * The `AlertManager` lives in the extension host, so the wait parks there and
-   * only its outcome crosses back. Unlike `requestResponse` this has no local
-   * deadline — the ceiling is `timeoutMs`, enforced host-side — and `cancel()`
-   * asks rather than answers: the `cancelled` outcome arrives on the same
-   * result message as every other, so a claim is never released twice.
-   */
-  alertAwait(id: string, options: AwaitOptions): AwaitHandle {
-    const requestId = `req-${++this.nextRequestId}`;
-    const { promise } = this.awaitHostReply('alert:awaitResult', requestId, (msg) => msg.outcome as AwaitOutcome);
-    this.vscode.postMessage({ type: 'alert:await', requestId, id, until: options.until, timeoutMs: options.timeoutMs });
-    return {
-      // Nothing detaches this reply — the host answers exactly one
-      // `alert:awaitResult` per request, a cancel included — but the mapping
-      // keeps the handle's `AwaitOutcome` contract without a cast.
-      promise: promise.then((outcome) => (outcome === DETACHED ? CANCELLED_AWAIT : outcome)),
-      cancel: () => this.vscode.postMessage({ type: 'alert:awaitCancel', requestId }),
-    };
-  }
-
-  onAlertState(handler: (detail: AlertStateDetail) => void): void {
-    this.alertStateHandlers.add(handler);
-  }
-
-  onWatchedCommands(handler: (names: string[]) => void): void {
-    this.watchedCommandHandlers.add(handler);
-  }
-
-  onAlertSettings(handler: (settings: AlertSettings) => void): void {
-    this.alertSettingsHandlers.add(handler);
-  }
-
   // --- State persistence ---
 
   saveState(state: unknown): void {
diff --git a/lib/src/lib/quiesce-detector.ts b/lib/src/lib/quiesce-detector.ts
index 11f5a3494..c1dee9f17 100644
--- a/lib/src/lib/quiesce-detector.ts
+++ b/lib/src/lib/quiesce-detector.ts
@@ -46,7 +46,7 @@ export class QuiesceDetector {
   private status: QuiesceStatus = 'NOTHING_TO_SHOW';
   private resizeGrace = false;
   private disposed = false;
-  private timers = new Map<DetectorTimer, { timer: ReturnType<typeof setTimeout>; dueAt: number }>();
+  private timers = new Map<DetectorTimer, ReturnType<typeof setTimeout>>();
   private firstOutputAt: number | null = null;
   private lastOutputAt: number | null = null;
   /**
@@ -96,8 +96,9 @@ export class QuiesceDetector {
     if (this.disposed || this.resizeGrace) return;
 
     const now = Date.now();
-    // Candidate history only describes one run of output. Timer callbacks can
-    // be delayed in hidden views, so expire it against the clock on arrival.
+    // Candidate history only describes one run of output. A timer callback can
+    // run late — a busy event loop, a suspended process — so expire it against
+    // the clock on arrival.
     if (
       !this.isConfirmedBusy() && this.lastOutputAt !== null
       && now - this.lastOutputAt > CANDIDATE_HISTORY_TTL_MS
@@ -132,7 +133,7 @@ export class QuiesceDetector {
 
   dispose(): void {
     this.disposed = true;
-    for (const { timer } of this.timers.values()) clearTimeout(timer);
+    for (const timer of this.timers.values()) clearTimeout(timer);
     this.timers.clear();
   }
 
@@ -173,8 +174,7 @@ export class QuiesceDetector {
   }
 
   private schedule(kind: DetectorTimer, delay: number): void {
-    const previous = this.timers.get(kind);
-    if (previous) clearTimeout(previous.timer);
+    clearTimeout(this.timers.get(kind));
     const dueAt = Date.now() + delay;
     const timer = setTimeout(() => {
       this.timers.delete(kind);
@@ -192,7 +192,7 @@ export class QuiesceDetector {
         case 'mightNeedAttention':
           if (this.status !== 'BUSY') break;
           this.setStatus('MIGHT_NEED_ATTENTION');
-          // Carry the original deadline through a suspended renderer.
+          // Carry the original deadline through a callback that ran late.
           this.schedule('settledConfirm', Math.max(0, dueAt + T_SETTLED_CONFIRM - Date.now()));
           break;
         case 'settledConfirm':
@@ -203,11 +203,11 @@ export class QuiesceDetector {
           break;
       }
     }, delay);
-    this.timers.set(kind, { timer, dueAt });
+    this.timers.set(kind, timer);
   }
 
   private clearActivityTimers(): void {
-    for (const [kind, { timer }] of this.timers) {
+    for (const [kind, timer] of this.timers) {
       if (kind === 'resize') continue;
       clearTimeout(timer);
       this.timers.delete(kind);
diff --git a/lib/src/lib/reconnect.test.ts b/lib/src/lib/reconnect.test.ts
index f8784dfde..20e17cb87 100644
--- a/lib/src/lib/reconnect.test.ts
+++ b/lib/src/lib/reconnect.test.ts
@@ -68,12 +68,10 @@ function createPlatform(ptys: PtyInfo[], savedState: PersistedSession | null): P
     onRequestSessionFlush: vi.fn(),
     offRequestSessionFlush: vi.fn(),
     notifySessionFlushComplete: vi.fn(),
-    alertRemove: vi.fn(),
     alertSetWatchedCommands: vi.fn(),
     alertSetCommandWatched: vi.fn(),
     alertDismiss: vi.fn(),
     alertEngagement: vi.fn(),
-    alertResize: vi.fn(),
     alertAcknowledge: vi.fn(),
     alertToggleTodo: vi.fn(),
     alertClearTodo: vi.fn(),
diff --git a/lib/src/lib/session-restore.test.ts b/lib/src/lib/session-restore.test.ts
index 476390731..d8a7c0ead 100644
--- a/lib/src/lib/session-restore.test.ts
+++ b/lib/src/lib/session-restore.test.ts
@@ -44,12 +44,10 @@ function createPlatform(
     onRequestSessionFlush: vi.fn(),
     offRequestSessionFlush: vi.fn(),
     notifySessionFlushComplete: vi.fn(),
-    alertRemove: vi.fn(),
     alertSetWatchedCommands: vi.fn(),
     alertSetCommandWatched: vi.fn(),
     alertDismiss: vi.fn(),
     alertEngagement: vi.fn(),
-    alertResize: vi.fn(),
     alertAcknowledge: vi.fn(),
     alertToggleTodo: vi.fn(),
     alertClearTodo: vi.fn(),
@@ -396,7 +394,11 @@ describe('restoreSession alert seeding', () => {
 
   const alert = { status: 'WATCHING_DISABLED' as const, todo: true, notification: null };
 
-  it('seeds a terminal pane\'s persisted TODO and leaves browser panes to the todo restore', () => {
+  /** What each restored terminal's spawn will carry as its persisted alert. */
+  const spawnedAlerts = () => terminalRegistryMocks.restoreTerminal.mock.calls
+    .map(([id, options]) => [id, (options as { alert?: unknown }).alert]);
+
+  it('spawns a terminal pane with its persisted TODO and leaves browser panes to the todo restore', () => {
     const saved: PersistedSession = {
       version: 3,
       panes: [
@@ -406,13 +408,12 @@ describe('restoreSession alert seeding', () => {
       ],
     };
     const platform = createPlatform(saved);
-    const alertSeed = vi.fn();
-    platform.alertSeed = alertSeed;
 
     restoreSession(platform);
 
-    // Only the terminal pane that carried one, and only that pane's blob.
-    expect(alertSeed.mock.calls).toEqual([['shell', alert]]);
+    // Only the terminal pane that carried one, and only that pane's blob: the
+    // host seeds it at the spawn.
+    expect(spawnedAlerts()).toEqual([['shell', alert], ['quiet', undefined]]);
   });
 
   it('keeps a pane whose notification this build cannot read, seeding its TODO without the detail', () => {
@@ -429,20 +430,9 @@ describe('restoreSession alert seeding', () => {
       ],
     } as unknown as PersistedSession;
     const platform = createPlatform(saved);
-    const alertSeed = vi.fn();
-    platform.alertSeed = alertSeed;
 
     expect(restoreSession(platform)?.paneIds).toEqual(['newer']);
-    expect(alertSeed.mock.calls).toEqual([['newer', { status: 'ALERT_RINGING', todo: true, notification: null }]]);
-  });
-
-  it('restores without a seeding host', () => {
-    const saved: PersistedSession = {
-      version: 3,
-      panes: [{ id: 'shell', title: 'Shell', cwd: '/tmp', untouched: false, alert }],
-    };
-    // VS Code omits `alertSeed`; its extension host seeds its own manager.
-    expect(restoreSession(createPlatform(saved))?.paneIds).toEqual(['shell']);
+    expect(spawnedAlerts()).toEqual([['newer', { status: 'ALERT_RINGING', todo: true, notification: null }]]);
   });
 
   it('restores the record it is handed with the commands it is handed', () => {
diff --git a/lib/src/lib/session-restore.ts b/lib/src/lib/session-restore.ts
index 46924a577..689ce2179 100644
--- a/lib/src/lib/session-restore.ts
+++ b/lib/src/lib/session-restore.ts
@@ -103,18 +103,16 @@ export function restoreSession(platform: PlatformAdapter, sources: RestoreSource
       shell: shellOpts?.shell,
       args: shellOpts?.args,
       untouched: pane.untouched,
+      // The fresh PTY inherits the pane's persisted TODO: the host seeds it at
+      // the spawn. Restore-only: a live resume still has the host's own state
+      // (docs/specs/alert.md -> "Persist only").
+      alert: pane.alert,
       // A tool command is durable, approved Session state and wins over the
       // host's unrelated single-use agent recovery channel.
       ...(pane.surfaceType === 'tool'
         ? { command: pane.command ?? null, requireIntegration: true, resumeCommand: null }
         : { resumeCommand: recoveryCommands[pane.id] ?? null }),
     });
-    // The fresh PTY inherits the pane's persisted TODO/alert, on the host that
-    // cannot seed itself (standalone: its sidecar holds no persisted session).
-    // After `restoreTerminal`, whose spawn starts the Session's alert state over
-    // host-side, so the seed lands on the new Session. Restore-only: a live
-    // resume still has the manager's own state (docs/specs/alert.md -> "Persist only").
-    if (pane.alert) platform.alertSeed?.(pane.id, pane.alert);
   }
 
   return {
diff --git a/lib/src/lib/session-save.test.ts b/lib/src/lib/session-save.test.ts
index 0394e525c..09ee34ae7 100644
--- a/lib/src/lib/session-save.test.ts
+++ b/lib/src/lib/session-save.test.ts
@@ -45,12 +45,10 @@ function createPlatform(savedState: PersistedSession | null): PlatformAdapter {
     onRequestSessionFlush: () => {},
     offRequestSessionFlush: () => {},
     notifySessionFlushComplete: () => {},
-    alertRemove: () => {},
     alertSetWatchedCommands: () => {},
     alertSetCommandWatched: () => {},
     alertDismiss: () => {},
     alertEngagement: () => {},
-    alertResize: () => {},
     alertAcknowledge: () => {},
     alertToggleTodo: () => {},
     alertClearTodo: () => {},
diff --git a/lib/src/lib/terminal-lifecycle.release.test.ts b/lib/src/lib/terminal-lifecycle.release.test.ts
index 55938403d..36b0cccd0 100644
--- a/lib/src/lib/terminal-lifecycle.release.test.ts
+++ b/lib/src/lib/terminal-lifecycle.release.test.ts
@@ -37,7 +37,6 @@ import {
 const platform = (platformModule as unknown as { __fakePlatform: FakePtyAdapter }).__fakePlatform;
 
 let killed: string[];
-let removedAlerts: string[];
 
 /** A pin, without a real xterm buffer behind it: what the notepad holds is two
  *  markers it must be able to dispose. */
@@ -52,12 +51,14 @@ function fakeSource(terminalId: string) {
 beforeEach(() => {
   killed = [];
   vi.spyOn(platform, 'killPty').mockImplementation((id: string) => void killed.push(id));
-  removedAlerts = [];
-  vi.spyOn(platform, 'alertRemove').mockImplementation((id: string) => void removedAlerts.push(id));
   for (const id of ['pane-1', 'pane-2']) removeSurface(id);
 });
 
 describe('releaseSession', () => {
+  // The kill is also what removes the host's alert entry, which is the
+  // Session's, not this Window's: a departure or a refused arrival that removed
+  // it would wipe a ring or TODO the other Window is showing
+  // (docs/specs/alert.md → Live Workspace transfer).
   it('never kills the PTY, unlike disposeSession', () => {
     getOrCreateTerminal('pane-1');
     releaseSession('pane-1');
@@ -68,19 +69,6 @@ describe('releaseSession', () => {
     expect(killed).toEqual(['pane-2']);
   });
 
-  // The host's alert entry is the Session's, not this Window's: a departure or
-  // a refused arrival that removed it would wipe a ring or TODO the other
-  // Window is showing (docs/specs/alert.md → Live Workspace transfer).
-  it('leaves the host alert entry, which only a kill removes', () => {
-    getOrCreateTerminal('pane-1');
-    releaseSession('pane-1');
-    expect(removedAlerts).toEqual([]);
-
-    getOrCreateTerminal('pane-2');
-    disposeSession('pane-2');
-    expect(removedAlerts).toEqual(['pane-2']);
-  });
-
   it("drops this webview's half of the Session", () => {
     getOrCreateTerminal('pane-1');
     expect(getTerminalInstance('pane-1')).not.toBeNull();
diff --git a/lib/src/lib/terminal-lifecycle.ts b/lib/src/lib/terminal-lifecycle.ts
index 142b20047..838ab965e 100644
--- a/lib/src/lib/terminal-lifecycle.ts
+++ b/lib/src/lib/terminal-lifecycle.ts
@@ -11,6 +11,7 @@ import { shellCommandKind, type ShellCommandKind } from 'dor/commands/shell-quot
 import { getPlatform, IS_MAC, IS_WINDOWS, PLATFORM_STRING } from './platform';
 import type { PtyDataDetail } from './platform/types';
 import type { HelperIdentity } from './terminal-context-types';
+import type { PersistedAlertState } from './session-types';
 import { DIM, RESET } from './ansi';
 import { cfg } from '../cfg';
 import { requestExternalLinkConfirmation } from './external-link-confirmation';
@@ -269,7 +270,6 @@ function wireXtermHandlers(
   });
 
   const resizeDisposable = terminal.onResize(({ cols, rows }) => {
-    getPlatform().alertResize(id);
     getPlatform().resizePty(id, cols, rows);
     bumpRenderTick();
     if (getMouseSelectionState(id).selection) setMouseSelection(id, null);
@@ -497,6 +497,8 @@ export function restoreTerminal(
     resumeCommand?: string | null;
     command?: string | null;
     requireIntegration?: boolean;
+    /** The pane's persisted TODO, seeded by the host at the spawn. */
+    alert?: PersistedAlertState | null;
   },
 ): TerminalEntry {
   const existing = registry.get(id);
@@ -520,6 +522,7 @@ export function restoreTerminal(
     cwd: opts.cwd ?? undefined,
     shell: opts.shell,
     args: opts.args,
+    ...(opts.alert ? { alert: opts.alert } : {}),
   });
   seedProcessCwdAfterSpawn(id);
 
@@ -623,14 +626,13 @@ export function disposeAllSessions(): void {
  *
  * `kill` is the only difference between the two verbs below, and it is the
  * whole difference between ending a Session and letting another Window take it:
- * a kill also removes the host's alert entry, which a release leaves to the
- * Window that takes the Session over (`docs/specs/alert.md` → Live Workspace
- * transfer).
+ * the host removes a killed Session's alert entry, and keeps a released one's
+ * for the Window that takes the Session over (`docs/specs/alert.md` → Live
+ * Workspace transfer).
  */
 function teardownSession(id: string, { kill }: { kill: boolean }): void {
   const entry = registry.get(id);
   if (!entry) return;
-  if (kill) getPlatform().alertRemove(id);
   // Before the xterm instance goes: its markers are what notepad pins hold, and
   // a disposed marker cannot be dropped cleanly afterwards. The notes stay.
   dropSourcesForTerminal(id);
diff --git a/lib/src/lib/terminal-protocol.ts b/lib/src/lib/terminal-protocol.ts
index 01e182945..0697af3b5 100644
--- a/lib/src/lib/terminal-protocol.ts
+++ b/lib/src/lib/terminal-protocol.ts
@@ -2,7 +2,7 @@ import { parseToolState, type ToolState } from './tool-state';
 import type { ActivityNotification, ProtocolProgressUpdate } from './alert-manager';
 import { parseColor } from './css-color';
 import { sanitizeCommandLine, sanitizeText, truncateText } from './osc-sanitize';
-import { isProtocolCommandStart, recordToolEvents } from './tool-events';
+import { isProtocolCommandStart } from './tool-events';
 import { parseToolAnnounce, type ToolAnnounce } from './tool-announce';
 import {
   STRING_CONTROL_INTRODUCER,
@@ -483,18 +483,14 @@ export function textProjectionOf(
  * Apply one parse batch in stream order, so a report written after a command
  * boundary is judged after it (`docs/specs/alert.md` -> Terminal reports).
  * Semantic events are timestamped once, handed to the sink in the runs between
- * reports, and returned for the terminal-state store. `recordTools` also
- * records the batch's Tool reports, for an owner whose renderer state is
- * reachable from here.
+ * reports, and returned for the terminal-state store.
  */
 export function applyTerminalEvents(
   sink: TerminalEventSink,
   id: string,
   events: readonly TerminalProtocolEvent[],
-  options: { recordTools?: boolean } = {},
 ): TerminalSemanticEvent[] {
   if (events.length === 0) return [];
-  if (options.recordTools) recordToolEvents(id, events);
   const semanticEvents: TerminalSemanticEvent[] = [];
   let applied = 0;
   const applySemantic = (): void => {
diff --git a/lib/src/lib/terminal-registry.alert.test.ts b/lib/src/lib/terminal-registry.alert.test.ts
index a5f8ca593..76c3213d8 100644
--- a/lib/src/lib/terminal-registry.alert.test.ts
+++ b/lib/src/lib/terminal-registry.alert.test.ts
@@ -480,6 +480,14 @@ describe('terminal-registry alert behavior', () => {
     expect(entry.terminal.writes.join('')).toContain('codex resume 01JCX8ZK');
   });
 
+  // The host seeds it at the spawn, having started the id over: the reminder
+  // comes back, never the ring (docs/specs/alert.md -> "Persist only").
+  it('restores a pane\'s persisted TODO through its spawn', () => {
+    const notification = { source: 'OSC 9' as const, title: null, body: 'needs input' };
+    restoreTerminal('restore-todo', { alert: { status: 'ALERT_RINGING', todo: true, notification } });
+    expect(getActivity('restore-todo')).toMatchObject({ status: 'WATCHING_DISABLED', todo: true, notification });
+  });
+
   it('seeds untouched state on resume and restore while defaulting missing state to touched', () => {
     resumeTerminal('resume-untouched', null, { alive: true, untouched: true });
     resumeTerminal('resume-legacy', null, { alive: true });
diff --git a/lib/src/lib/watched-command-host.ts b/lib/src/lib/watched-command-host.ts
index 44e21876c..650ffddc6 100644
--- a/lib/src/lib/watched-command-host.ts
+++ b/lib/src/lib/watched-command-host.ts
@@ -38,7 +38,10 @@ export class WatchedCommandHost {
     };
   }
 
-  private publish(): void {
+  /** The canonical set to every subscriber, once there is one: a snapshot
+   *  sent before any renderer seeded would replace their persisted rules. */
+  publish(): void {
+    if (!this.initialized) return;
     const names = this.target.getWatchedCommands();
     for (const listener of this.listeners) listener(names);
   }
diff --git a/lib/src/remote/client/remote-adapter.ts b/lib/src/remote/client/remote-adapter.ts
index 3a98f5777..c382627ea 100644
--- a/lib/src/remote/client/remote-adapter.ts
+++ b/lib/src/remote/client/remote-adapter.ts
@@ -343,14 +343,12 @@ export class RemotePtyAdapter implements PlatformAdapter {
 
   // Alerts are Burrow-authoritative (surfaced via the directory snapshot), so the
   // phone-side alert controls are inert.
-  alertRemove(): void {}
   alertSetWatchedCommands(): void {}
   alertSetCommandWatched(): void {}
   alertPublishSettings(): void {}
   alertDismiss(): void {}
   alertEngagement(): void {}
   alertAcknowledge(): void {}
-  alertResize(): void {}
   alertToggleTodo(): void {}
   alertClearTodo(): void {}
   /**
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 032889c07..5d161bead 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -2,7 +2,7 @@
   "AGENTS.md": 3400,
   "SECURITY.md": 200,
   "SELF_HOST.md": 6100,
-  "docs/specs/alert.md": 7900,
+  "docs/specs/alert.md": 7850,
   "docs/specs/auto-update.md": 1150,
   "docs/specs/deploy.md": 1900,
   "docs/specs/dor-browser.md": 4550,
@@ -26,7 +26,7 @@
   "docs/specs/security-supply-chain.md": 1150,
   "docs/specs/security.md": 1900,
   "docs/specs/shortcuts.md": 1150,
-  "docs/specs/standalone.md": 11950,
+  "docs/specs/standalone.md": 11850,
   "docs/specs/terminal-context.md": 1050,
   "docs/specs/terminal-escapes.md": 3900,
   "docs/specs/terminal-state.md": 2500,
diff --git a/standalone/sidecar/helper-terminal.test.js b/standalone/sidecar/helper-terminal.test.js
index 85f2a17a5..c6664a59c 100644
--- a/standalone/sidecar/helper-terminal.test.js
+++ b/standalone/sidecar/helper-terminal.test.js
@@ -59,23 +59,23 @@ test('strict inspection requires the terminal process to appear in the process t
 test('helper ownership survives a live listing and promotion preserves the PTY and replay', () => {
   const events = [];
   const spawned = [];
+  // Every helper decision, as the host's alerts hear it.
+  const decisions = [];
   const manager = create((event, data) => events.push({ event, data }), {
     spawn() {
       const terminal = { pid: 42, write() {}, resize() {}, kill() {}, onData(callback) { this.output = callback; }, onExit() {} };
       spawned.push(terminal); return terminal;
     },
-  }, { replay: true });
+  }, { replay: true, onHelper: (id, helper) => decisions.push([id, helper]) });
   manager.spawn('parent');
   manager.spawn('helper', { helper: { parentId: 'parent', command: 'git status' } });
-  // What the host's alerts mirror after each spawn and promotion.
-  assert.equal(manager.isHelper('parent'), false);
-  assert.equal(manager.isHelper('helper'), true);
+  assert.deepEqual(decisions, [['parent', false], ['helper', true]]);
   spawned[1].output('unsaved editor text');
   manager.list();
   assert.deepEqual(events.findLast(e => e.event === 'list').data.ptys[1].helper, { parentId: 'parent', command: 'git status' });
   assert.equal(events.findLast(e => e.event === 'replay').data.data, 'unsaved editor text');
   manager.context({ op: 'promote', id: 'helper' }, 'promote-1');
-  assert.equal(manager.isHelper('helper'), false);
+  assert.deepEqual(decisions.at(-1), ['helper', false]);
   manager.list();
   assert.equal(events.findLast(e => e.event === 'list').data.ptys[1].helper, undefined);
   assert.equal(spawned.length, 2);
@@ -83,8 +83,12 @@ test('helper ownership survives a live listing and promotion preserves the PTY a
   manager.context({ op: 'promote', id: 'helper', restore: { parentId: 'parent', command: 'git status' } }, 'restore-1');
   manager.list();
   assert.equal(events.findLast(e => e.event === 'list').data.ptys[1].helper.parentId, 'parent');
+  assert.deepEqual(decisions.at(-1), ['helper', true]);
+  const decided = decisions.length;
   manager.context({ op: 'promote', id: 'parent', restore: { parentId: 'parent', command: '' } }, 'invalid-self');
   assert.match(events.at(-1).data.error, /Invalid helper owner/);
+  // A refused promotion decides nothing.
+  assert.equal(decisions.length, decided);
   manager.spawn('other');
   manager.context({ op: 'promote', id: 'other', restore: { parentId: 'parent', command: '' } }, 'invalid-duplicate');
   assert.match(events.at(-1).data.error, /Invalid helper owner/);
diff --git a/standalone/sidecar/main-wiring.test.js b/standalone/sidecar/main-wiring.test.js
index 4080a4a23..8e008814e 100644
--- a/standalone/sidecar/main-wiring.test.js
+++ b/standalone/sidecar/main-wiring.test.js
@@ -12,46 +12,10 @@ test('pty-core is created with the shared sliceSince, so recovery capture reads
   // Without it `outputSince` answers '' and `captureAgentRecovery` records
   // nothing, with no error anywhere (pty-core.js -> outputSince).
   assert.match(source, /\{\s*captureAgentRecovery,\s*createRecoveryStore,\s*sliceSince\s*\}\s*=\s*require\('\.\/recovery\.cjs'\)/);
-  assert.match(source, /nodePty,\s*\{\s*replay:\s*true,\s*sliceSince\s*\}\)/);
+  assert.match(source, /nodePty,\s*\{\s*replay:\s*true,\s*sliceSince\b/);
 });
 
 test('recovery capture and the record take are answered from pty-core marks', () => {
   assert.match(source, /receivedChars:\s*\(id\)\s*=>\s*mgr\.receivedChars\(id\)/);
   assert.match(source, /outputSince:\s*\(id,\s*mark\)\s*=>\s*mgr\.outputSince\(id,\s*mark\)/);
 });
-
-// The sidecar's one AlertManager (docs/specs/standalone.md -> "Alerts"). Each
-// check below pins a call whose absence would fail silently: a window would
-// render stale rings, or ring on its own typing.
-const handler = (event) => {
-  const start = source.indexOf(`case '${event}':`);
-  assert.ok(start >= 0, `main.js handles ${event}`);
-  const end = source.indexOf('case ', start + 6);
-  return source.slice(start, end);
-};
-
-test('the Burrow parse feeds the same manager the alert commands drive', () => {
-  assert.match(source, /const alerts = createSidecarAlerts\(\{ send \}\)/);
-  assert.match(source, /createSidecarBurrow\(\{[^}]*alerts: alerts\.manager,[^}]*\}\)/);
-  assert.match(handler('alert:command'), /alerts\.handle\(data\)/);
-});
-
-test('human input is acknowledged in its own write message, before the write', () => {
-  const body = handler('pty:input');
-  const ack = body.indexOf('alerts.acknowledgeInput(data.id)');
-  assert.ok(ack >= 0 && ack < body.indexOf('mgr.write('), 'acknowledged before mgr.write');
-  assert.match(body, /data\.userInput === true/);
-});
-
-test('a window collecting its PTYs gets their alert state behind the list', () => {
-  const body = handler('pty:requestInit');
-  const publish = body.indexOf('alerts.publish(data?.ids)');
-  assert.ok(publish > body.indexOf('mgr.list('), 'published after the list');
-});
-
-test('helpers mirror pty-core at spawn and promotion, and closed windows stop being viewers', () => {
-  const spawn = handler('pty:spawn');
-  assert.ok(spawn.indexOf('alerts.setHelper(data.id, mgr.isHelper(data.id))') > spawn.indexOf('mgr.spawn('));
-  assert.match(handler('pty:context'), /data\.op === 'promote'\) alerts\.setHelper\(data\.id, mgr\.isHelper\(data\.id\)\)/);
-  assert.match(handler('burrow:windows'), /alerts\.setWindows\(data\?\.labels\)/);
-});
diff --git a/standalone/sidecar/main.js b/standalone/sidecar/main.js
index d6be031c7..7bada0a0b 100644
--- a/standalone/sidecar/main.js
+++ b/standalone/sidecar/main.js
@@ -22,10 +22,11 @@ const { gitInfo } = require('./git-info.cjs');
 const { createAgentBrowserHost } = require('./agent-browser-host.cjs');
 // Same pattern again: lib/src/host/remote/sidecar-entry.ts is the Burrow —
 // the relay socket, the enrollment, the ACL, and remote-api v1 — running next to
-// the PTYs it serves. See docs/specs/remote-api.md. The same bundle carries the
-// app's one AlertManager (lib/src/host/alert-host.ts), which its parse feeds,
-// and the two app-global alert stores bound to it. See docs/specs/alert.md.
-const { createSidecarBurrow, createSidecarAlerts } = require('./burrow.cjs');
+// the PTYs it serves (docs/specs/remote-api.md), and the app's one
+// AlertManager, which its parse feeds, in the host role VS Code's extension
+// host runs too (docs/specs/standalone.md -> "Alerts"). It handles every PTY
+// command the alerts must see.
+const { createSidecarHost } = require('./burrow.cjs');
 // Same pattern again: lib/src/host/recovery.ts is the agent-recovery capture
 // machine (shared with the VS Code extension host) plus the single-use record
 // store. See docs/specs/standalone.md -> "Agent recovery".
@@ -55,26 +56,21 @@ const mgr = create((event, data) => {
   // `pty:data` the host emits, never raw. A remote sink runs only after that
   // send, and the whole tap is wrapped so a throw is logged rather than fatal.
   try {
-    burrow.onPtyEvent(event, data);
+    host.onPtyEvent(event, data);
   } catch (err) {
     console.error(`[sidecar] burrow ${event} tap failed:`, err && err.message || err);
   }
   if (event !== 'data') send(`pty:${event}`, data);
   // `sliceSince` comes from the shared bundle above rather than living in
   // pty-core, so this host and the VS Code extension host read their replay
-  // buffers through one implementation.
-}, nodePty, { replay: true, sliceSince });
+  // buffers through one implementation. Each helper decision pty-core makes
+  // reaches the alerts, which keep a helper inert (docs/specs/alert.md).
+}, nodePty, { replay: true, sliceSince, onHelper: (id, helper) => host.alerts.setHelper(id, helper) });
 
-// One per app, like VS Code's extension host: every window is a viewer of it,
-// and its `alert:state` is routed to each Session's owner (docs/specs/standalone.md
-// -> "Alerts").
-const alerts = createSidecarAlerts({ send });
-
-const burrow = createSidecarBurrow({
+const host = createSidecarHost({
   send,
   stateDir: process.env.DORMOUSE_STATE_DIR,
   mgr,
-  alerts: alerts.manager,
 });
 
 // Dor Tools. Shares the app's state directory, so an approved repo stays
@@ -145,37 +141,11 @@ rl.on('line', (line) => {
 function handleLine(line) {
   try {
     const { event, data } = JSON.parse(line);
+    // The PTY lifecycle and I/O, the alerts and the Burrow.
+    if (host.handleCommand(event, data)) return;
     switch (event) {
-      // Told before the spawn: the id may be a live PTY's, and the parser for
-      // that generation must not carry a half-read sequence into the new one.
-      // pty-core validates a helper, so the alerts mirror its answer.
-      case 'pty:spawn':
-        burrow.onPtySpawn(data.id);
-        mgr.spawn(data.id, data.options);
-        alerts.setHelper(data.id, mgr.isHelper(data.id));
-        break;
-      // Human input is acknowledged in the same message as its write, so the
-      // echo window is open before any echo can arrive (docs/specs/alert.md ->
-      // Engagement).
-      case 'pty:input':
-        if (data.userInput === true) alerts.acknowledgeInput(data.id);
-        mgr.write(data.id, data.data, { paced: data.paced === true });
-        break;
-      case 'pty:resize':  mgr.resize(data.id, data.cols, data.rows); break;
-      case 'pty:kill':    mgr.kill(data.id); break;
-      // One window's own PTYs, and the answer names it so the host can route
-      // the list and every replay behind it back (docs/specs/standalone.md).
-      // Their alert state follows, routed to each owner: a reloaded or arriving
-      // window has no other way to learn it.
-      case 'pty:requestInit':
-        mgr.list(data?.ids, data?.forWindow, data?.requestId, data?.marks);
-        alerts.publish(data?.ids);
-        break;
       case 'pty:mark': mgr.mark(data?.ids, data?.requestId); break;
-      case 'pty:context':
-        mgr.context(data, data.requestId);
-        if (data.op === 'promote') alerts.setHelper(data.id, mgr.isHelper(data.id));
-        break;
+      case 'pty:context': mgr.context(data, data.requestId); break;
       case 'pty:getCwd':  mgr.getCwd(data.id, data.requestId); break;
       case 'pty:getCwds': mgr.getCwds(data.ids, data.requestId); break;
       case 'pty:getOpenPorts': mgr.getOpenPorts(data.id, data.requestId); break;
@@ -211,23 +181,8 @@ function handleLine(line) {
         }));
         break;
       case 'pty:gracefulKill': mgr.gracefulKill(data.ids, data.timeout, data.requestId); break;
-      // The webview's resolved terminal theme, so the parser here can answer
-      // OSC 10/11/12 (docs/specs/terminal-escapes.md → Supported OSCs).
-      // Which webviews will answer a Burrow ask (docs/specs/standalone.md
-      // -> "Burrow service"), and which are still alert viewers.
-      case 'burrow:windows':
-        burrow.setWindows(data?.labels);
-        alerts.setWindows(data?.labels);
-        break;
-      // Which windows an ask actually reached. Only the host knows: one naming
-      // a Surface goes to its owner alone (docs/specs/standalone.md ->
-      // "Burrow service").
-      case 'burrow:askDelivered': burrow.setAskDelivery(data); break;
-      case 'alert:command': alerts.handle(data); break;
-      case 'pty:themeColors': burrow.setThemeColors(data); break;
       case 'sidecar:shutdown': shutdown(); break;
       case 'dor:controlResponse': dorControl?.respond(data); break;
-      case 'burrow:command': burrow.handleCommand(data); break;
       case 'tool:control':
         respondAsync('tool:result', data.requestId, async () => ({
           result: await toolHost.handle(data.request),
@@ -329,8 +284,7 @@ async function shutdown() {
     ]);
   } catch {}
   dorControl?.close();
-  alerts.dispose();
-  burrow.dispose();
+  host.dispose();
   mgr.killAll();
   process.exit(0);
 }
diff --git a/standalone/sidecar/pty-core.js b/standalone/sidecar/pty-core.js
index 49f96ea4b..b6eedfe82 100644
--- a/standalone/sidecar/pty-core.js
+++ b/standalone/sidecar/pty-core.js
@@ -1265,7 +1265,11 @@ module.exports.pacedInputSegments = pacedInputSegments;
 // which reaches this process only as the generated `recovery.cjs` bundle. Taking
 // it as an option keeps this file — and its `node --test` suite — free of any
 // build artifact. `main.js` supplies the real one.
-module.exports.create = function create(send, ptyModule, { replay = false, sliceSince = null } = {}) {
+//
+// `onHelper(id, isHelper)` hears every helper decision — each spawn and each
+// promotion that succeeds — so the host's alerts, which keep a helper inert,
+// read this map's answer rather than keeping their own (docs/specs/alert.md).
+module.exports.create = function create(send, ptyModule, { replay = false, sliceSince = null, onHelper = () => {} } = {}) {
   if (!ptyModule || typeof ptyModule.spawn !== 'function') {
     throw new TypeError('create() requires a node-pty compatible module');
   }
@@ -1351,6 +1355,7 @@ module.exports.create = function create(send, ptyModule, { replay = false, slice
       send("exit", { id, exitCode: 1 });
       return;
     } else helpers.delete(id);
+    onHelper(id, helpers.has(id));
 
     let p;
     try {
@@ -1504,12 +1509,6 @@ module.exports.create = function create(send, ptyModule, { replay = false, slice
     return ptys.has(id);
   }
 
-  /** Whether `id` is a helper, as validated at its spawn or promotion: the
-   *  host's alerts mirror this after each (docs/specs/alert.md -> Pane Header). */
-  function isHelper(id) {
-    return helpers.has(id);
-  }
-
   function kill(id) {
     helpers.delete(id);
     sessions.delete(id);
@@ -1623,6 +1622,7 @@ module.exports.create = function create(send, ptyModule, { replay = false, slice
           if (!sessions.has(request.id) || !validHelperOwner(request.id, request.restore)) throw new Error('Invalid helper owner');
           helpers.set(request.id, { parentId: request.restore.parentId, command: request.restore.command });
         } else helpers.delete(request.id);
+        onHelper(request.id, helpers.has(request.id));
       } else if (request.op === 'openDirectory') {
         if (typeof request.path !== 'string' || !path.isAbsolute(request.path) || request.path.includes('\0') || !directoryExists(request.path)) throw new Error('Directory is unavailable');
         const nativePath = fs.realpathSync(request.path);
@@ -1765,7 +1765,7 @@ module.exports.create = function create(send, ptyModule, { replay = false, slice
     send('shells', { shells: detectAvailableShells(), requestId });
   }
 
-  return { spawn, write, resize, hasPty, isHelper, kill, killAll, list, context,
+  return { spawn, write, resize, hasPty, kill, killAll, list, context,
     getCwd, getCwds, getOpenPorts, getOpenPortsMany, interrupt, gracefulKill, getShells,
     liveIds, receivedChars, outputSince, mark };
 };
diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index 4b4efb607..13305561f 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -72,9 +72,9 @@ fn guard<T>(lock: &Mutex<T>) -> MutexGuard<'_, T> {
 // The sidecar has no window concept, so Rust keeps the map from PTY to window
 // and routes every stdout line through `routing::route`.
 
-/// The three maps a sidecar line is routed against, behind **one** lock: they
-/// are always read together, so a PTY chunk costs one acquisition rather than
-/// three, and every label the routing table hands back stays borrowed out of
+/// The maps a sidecar line is routed against, behind **one** lock: they are
+/// always read together, so a PTY chunk costs one acquisition rather than one
+/// per map, and every label the routing table hands back stays borrowed out of
 /// this guard instead of being cloned per line.
 #[derive(Default)]
 struct RoutingState {
@@ -88,10 +88,6 @@ struct RoutingState {
     /// dor requestId -> the window handling it, so a cancel reaches the window
     /// holding the subscription, watch or completion claim it releases.
     dor_targets: HashMap<String, String>,
-    /// Tool events that arrived while their id was suppressed, delivered to
-    /// the new owner behind its replay (`routing::Route::Hold`). Only ever
-    /// emptied together with `awaiting_replay` (`lift_suppression`).
-    held: HashMap<String, Vec<routing::HeldEvent>>,
     /// Ids between a transfer's invoke and the sidecar's `marked` line, each
     /// with the source still consuming (`routing::RouteView::marking`).
     marking: HashMap<String, String>,
@@ -108,10 +104,15 @@ impl RoutingState {
         }
     }
 
-    /// `routing::lift_suppression` over this state's two halves. The caller
-    /// republishes `WindowState::suppressed` after it, still under the lock.
-    fn lift_suppression(&mut self, id: &str) -> Vec<routing::HeldEvent> {
-        routing::lift_suppression(&mut self.awaiting_replay, &mut self.held, id)
+    /// What `routing::route` reads, borrowed out of this state.
+    fn view<'a>(&'a self, registry: &'a workspaces::Registry) -> RouteView<'a> {
+        RouteView {
+            owners: &self.owners,
+            awaiting_replay: &self.awaiting_replay,
+            dor_targets: &self.dor_targets,
+            registry,
+            marking: &self.marking,
+        }
     }
 }
 
@@ -173,8 +174,7 @@ impl WindowState {
         let mut routing = guard(&self.routing);
         routing.owners.insert(id.to_string(), label.to_string());
         routing.transfer_marks.remove(id);
-        // Whatever was held belonged to the PTY that never arrived, not this one.
-        routing.lift_suppression(id);
+        routing.awaiting_replay.remove(id);
         self.suppressed
             .store(routing.awaiting_replay.len(), Ordering::Relaxed);
     }
@@ -197,15 +197,16 @@ impl WindowState {
             if let Some(owner) = routing.owners.get_mut(id) {
                 *owner = target.to_string();
             }
-            routing.lift_suppression(id);
+            routing.awaiting_replay.remove(id);
             routing.transfer_marks.remove(id);
             routing.marking.insert(id.clone(), source.to_string());
         }
         self.suppressed.store(routing.awaiting_replay.len(), Ordering::Relaxed);
     }
 
-    /// Drain the source cuts and return only still-live ownership. An exited
-    /// id gets its retained replay by explicit address, never a phantom owner.
+    /// Give every id still owned back to `source` — an exited one too, since
+    /// only a kill drops ownership — suppressed behind a replay of its cut when
+    /// it has one, otherwise straight back. Returns the cuts it drained, by id.
     fn hand_back(&self, ids: &[String], source: &str) -> JsonValue {
         let mut routing = guard(&self.routing);
         let mut marks = serde_json::Map::new();
@@ -216,7 +217,7 @@ impl WindowState {
             if let Some(owner) = routing.owners.get_mut(id) {
                 *owner = source.to_string();
                 if mark.is_some() { routing.awaiting_replay.insert(id.clone(), Instant::now()); }
-                else { routing.lift_suppression(id); }
+                else { routing.awaiting_replay.remove(id); }
             }
         }
         self.suppressed.store(routing.awaiting_replay.len(), Ordering::Relaxed);
@@ -230,21 +231,20 @@ impl WindowState {
         let mut routing = guard(&self.routing);
         routing.owners.remove(id);
         routing.transfer_marks.remove(id);
-        self.end_transfer_routing(&mut routing, id);
+        routing.awaiting_replay.remove(id);
+        routing.marking.remove(id);
+        self.suppressed.store(routing.awaiting_replay.len(), Ordering::Relaxed);
     }
 
     /// The PTY exited on its own. **Ownership stays until the Session is
     /// killed**: the pane still shows it, and the sidecar's `alert:state` for it
     /// — a dismiss, a TODO cleared — must still reach that window (§Alerts). The
-    /// cut stays too: the sidecar retains the buffer a replay reads.
+    /// cut stays too: the sidecar retains the buffer a replay reads. **So does
+    /// a transfer's marking phase**: the sidecar marks an exited id like a live
+    /// one, and that `pty:marked` belongs to the source serializing the pane.
     fn exited_pty(&self, id: &str) {
         let mut routing = guard(&self.routing);
-        self.end_transfer_routing(&mut routing, id);
-    }
-
-    fn end_transfer_routing(&self, routing: &mut RoutingState, id: &str) {
-        routing.lift_suppression(id);
-        routing.marking.remove(id);
+        routing.awaiting_replay.remove(id);
         self.suppressed.store(routing.awaiting_replay.len(), Ordering::Relaxed);
     }
 
@@ -254,7 +254,7 @@ impl WindowState {
     fn clear_suppression(&self, ids: &[String]) {
         let mut routing = guard(&self.routing);
         for id in ids {
-            routing.lift_suppression(id);
+            routing.awaiting_replay.remove(id);
             routing.transfer_marks.remove(id);
             routing.marking.remove(id);
         }
@@ -279,7 +279,7 @@ impl WindowState {
             let mut routing = guard(&self.routing);
             for id in lost.iter().flat_map(|arrival| &arrival.terminal_ids) {
                 routing.owners.remove(id);
-                routing.lift_suppression(id);
+                routing.awaiting_replay.remove(id);
             }
             let owned = routing.owned_by(label);
             for id in &owned {
@@ -339,8 +339,6 @@ fn dispatch_sidecar_event(app: &AppHandle, event: &str, data: JsonValue) {
     };
 
     let mut released: Vec<String> = Vec::new();
-    // Held events an expired suppression releases, flushed to the owner below.
-    let mut flushed: Vec<(String, Vec<routing::HeldEvent>)> = Vec::new();
     let delivery = {
         // Before the routing lock, never inside it (§`arrivals`). Nothing is
         // transferring in the steady state, so this second acquisition is paid
@@ -359,43 +357,19 @@ fn dispatch_sidecar_event(app: &AppHandle, event: &str, data: JsonValue) {
         };
         let mut routing = guard(&state.routing);
         if state.suppressed.load(Ordering::Relaxed) > 0 {
-            let RoutingState { awaiting_replay, held, .. } = &mut *routing;
-            let swept = routing::sweep_awaiting(
-                awaiting_replay,
-                held,
+            released = routing::sweep_awaiting(
+                &mut routing.awaiting_replay,
                 Instant::now(),
                 routing::AWAITING_REPLAY_MAX,
                 &arriving,
             );
-            if !swept.is_empty() {
+            if !released.is_empty() {
                 state.suppressed.store(routing.awaiting_replay.len(), Ordering::Relaxed);
-                for (id, queue) in swept {
-                    if let (false, Some(label)) = (queue.is_empty(), routing.owners.get(&id)) {
-                        flushed.push((label.clone(), queue));
-                    }
-                    released.push(id);
-                }
             }
         }
 
-        match routing::route(
-            event,
-            &data,
-            &RouteView {
-                owners: &routing.owners,
-                awaiting_replay: &routing.awaiting_replay,
-                dor_targets: &routing.dor_targets,
-                registry: &registry,
-                marking: &routing.marking,
-            },
-        ) {
+        match routing::route(event, &data, &routing.view(registry)) {
             Route::Drop => Delivery::Nowhere,
-            Route::Hold => {
-                if let Some(id) = data.get("id").and_then(JsonValue::as_str) {
-                    routing::hold_event(&mut routing.held, id, event, data.clone());
-                }
-                Delivery::Nowhere
-            }
             Route::Broadcast => Delivery::Broadcast,
             Route::EmitTo(label) => Delivery::To(label.to_string()),
             // Resolved here, where the focus order is a sibling of the map the
@@ -414,12 +388,6 @@ fn dispatch_sidecar_event(app: &AppHandle, event: &str, data: JsonValue) {
         }
     };
 
-    for (label, queue) in flushed {
-        for (held_event, held_data) in queue {
-            let _ = app.emit_to(label.as_str(), held_event.as_str(), &held_data);
-        }
-    }
-
     let mut delivered: Option<&str> = None;
     match &delivery {
         Delivery::Nowhere => {}
@@ -451,8 +419,8 @@ fn dispatch_sidecar_event(app: &AppHandle, event: &str, data: JsonValue) {
     }
 
     // Bookkeeping strictly after the emit, so a replay lifts its own suppression
-    // only once the new owner has actually been sent it. Only these four events
-    // pay a second acquisition; a PTY chunk takes the lock once and is done.
+    // only once the new owner has actually been sent it. Only these events pay
+    // a second acquisition; a PTY chunk takes the lock once and is done.
     let id = || data.get("id").and_then(JsonValue::as_str);
     let request_id = || data.get("requestId").and_then(JsonValue::as_str);
     match event {
@@ -476,21 +444,11 @@ fn dispatch_sidecar_event(app: &AppHandle, event: &str, data: JsonValue) {
         }
         "pty:replay" => {
             if let Some(id) = id() {
-                let queue = {
-                    let mut routing = guard(&state.routing);
-                    let queue = routing.lift_suppression(id);
-                    state
-                        .suppressed
-                        .store(routing.awaiting_replay.len(), Ordering::Relaxed);
-                    queue
-                };
-                // Behind the replay, to the window that just received it: the
-                // events describe bytes the replay carried.
-                if let Some(label) = delivered {
-                    for (held_event, held_data) in queue {
-                        let _ = app.emit_to(label, held_event.as_str(), &held_data);
-                    }
-                }
+                let mut routing = guard(&state.routing);
+                routing.awaiting_replay.remove(id);
+                state
+                    .suppressed
+                    .store(routing.awaiting_replay.len(), Ordering::Relaxed);
             }
         }
         "dor:controlRequest" => {
@@ -855,7 +813,8 @@ fn finish_window_close(app: &AppHandle, label: &str) {
     }
 }
 
-/// SIGTERM the PTYs a window left behind.
+/// SIGTERM the PTYs a window left behind, and drop their Sessions' alert
+/// entries with them: no window will ever show those Sessions again.
 ///
 /// Reached whenever a window goes away still owning shells — the close
 /// ack-timeout path ran no teardown at all, and a teardown that overran its
@@ -872,14 +831,13 @@ fn reap_orphaned_ptys(app: &AppHandle, label: &str, ids: Vec<String>) {
         "[window] {label} left {} PTY(s) with no owner; killing them",
         ids.len()
     ));
-    send_to_sidecar(
-        &sidecar,
-        serde_json::json!({
-            "event": "pty:gracefulKill",
-            "data": { "ids": ids, "timeout": 2000 },
-        })
-        .to_string(),
-    );
+    send_to_sidecar(&sidecar, pty_reap_message(&ids));
+}
+
+/// The `pty:reap` line `reap_orphaned_ptys` sends. Not `pty:gracefulKill`,
+/// which the quit teardown sends for PTYs whose windows still show them.
+fn pty_reap_message(ids: &[String]) -> String {
+    sidecar_line("pty:reap", serde_json::json!({ "ids": ids, "timeout": 2000 }))
 }
 
 const LOG_FILE_ENV: &str = "DORMOUSE_LOG_FILE";
@@ -995,6 +953,9 @@ struct PtySpawnOptions {
     cwd: Option<String>,
     shell: Option<String>,
     args: Option<Vec<String>>,
+    /// A cold restore's persisted alert state, seeded by the sidecar's
+    /// AlertManager behind the spawn. Opaque here, like `helper`.
+    alert: Option<JsonValue>,
 }
 
 #[derive(Serialize, Deserialize, Clone)]
@@ -1018,6 +979,17 @@ fn send_to_sidecar(state: &SidecarState, line: String) {
     let _ = state.tx.send(line);
 }
 
+/// One sidecar line, `{event, data}`, serialized straight from `data`: no
+/// intermediate `JsonValue`, so a payload is never deep-cloned on its way out.
+fn sidecar_line(event: &str, data: impl Serialize) -> String {
+    #[derive(Serialize)]
+    struct Line<'a, T> {
+        event: &'a str,
+        data: T,
+    }
+    serde_json::to_string(&Line { event, data }).expect("a sidecar line is plain JSON")
+}
+
 fn request_from_sidecar(
     state: &SidecarState,
     event: &str,
@@ -1097,11 +1069,12 @@ fn pty_spawn(
     options: Option<PtySpawnOptions>,
 ) {
     windows.mint(&id, window.label());
-    let msg = serde_json::json!({
-        "event": "pty:spawn",
-        "data": { "id": id, "options": options }
-    });
-    send_to_sidecar(&state, msg.to_string());
+    send_to_sidecar(&state, pty_spawn_message(&id, options.as_ref()));
+}
+
+/// One `pty:spawn` line. The options ride whole, a persisted `alert` included.
+fn pty_spawn_message(id: &str, options: Option<&PtySpawnOptions>) -> String {
+    sidecar_line("pty:spawn", serde_json::json!({ "id": id, "options": options }))
 }
 
 #[tauri::command]
@@ -1112,30 +1085,44 @@ fn pty_write(
     paced: Option<bool>,
     user_input: Option<bool>,
 ) {
-    send_to_sidecar(&state, pty_input_message(id, data, paced, user_input).to_string());
+    send_to_sidecar(&state, pty_input_message(&id, &data, paced, user_input));
 }
 
 /// One `pty:input` line. **Human input carries `userInput` on the write itself**,
 /// never a separate alert command racing it: the sidecar acknowledges it and
 /// opens the echo window before the bytes reach the PTY (docs/specs/alert.md
-/// → Engagement).
-fn pty_input_message(id: String, data: String, paced: Option<bool>, user_input: Option<bool>) -> JsonValue {
-    let mut input = serde_json::json!({ "id": id, "data": data });
-    if paced == Some(true) {
-        input["paced"] = true.into();
-    }
-    if user_input == Some(true) {
-        input["userInput"] = true.into();
-    }
-    serde_json::json!({ "event": "pty:input", "data": input })
+/// → Engagement). Each flag is present only when true.
+fn pty_input_message(id: &str, data: &str, paced: Option<bool>, user_input: Option<bool>) -> String {
+    #[derive(Serialize)]
+    #[serde(rename_all = "camelCase")]
+    struct PtyInput<'a> {
+        id: &'a str,
+        data: &'a str,
+        #[serde(skip_serializing_if = "std::ops::Not::not")]
+        paced: bool,
+        #[serde(skip_serializing_if = "std::ops::Not::not")]
+        user_input: bool,
+    }
+    sidecar_line(
+        "pty:input",
+        PtyInput { id, data, paced: paced == Some(true), user_input: user_input == Some(true) },
+    )
 }
 
-/// Stamp the invoking window's label onto a webview's opaque command: the one
-/// field Rust adds, because a webview cannot name itself to the sidecar.
-fn stamp_window(payload: &mut JsonValue, label: &str) {
+/// Forward a webview's opaque command to the sidecar as `event`, stamped with
+/// the invoking window (`stamped_message`).
+fn forward_stamped(state: &SidecarState, label: &str, event: &str, payload: JsonValue) {
+    send_to_sidecar(state, stamped_message(label, event, payload));
+}
+
+/// A webview's opaque command with the invoking window's label stamped on it
+/// as `window`, over any it claimed: the one field Rust adds, because a
+/// webview cannot name itself to the sidecar.
+fn stamped_message(label: &str, event: &str, mut payload: JsonValue) -> String {
     if let Some(command) = payload.as_object_mut() {
         command.insert("window".to_string(), JsonValue::String(label.to_string()));
     }
+    sidecar_line(event, payload)
 }
 
 #[tauri::command]
@@ -1212,16 +1199,11 @@ fn pty_request_init(
 fn burrow_command(
     window: tauri::Window,
     state: tauri::State<'_, SidecarState>,
-    mut payload: JsonValue,
+    payload: JsonValue,
 ) {
     // Which webview this came from: an ask fans out to every window and settles
     // on having heard from each (§Burrow service).
-    stamp_window(&mut payload, window.label());
-    let msg = serde_json::json!({
-        "event": "burrow:command",
-        "data": payload,
-    });
-    send_to_sidecar(&state, msg.to_string());
+    forward_stamped(&state, window.label(), "burrow:command", payload);
 }
 
 // The app's one AlertManager lives in the sidecar, and every window is one of
@@ -1233,11 +1215,9 @@ fn burrow_command(
 fn alert_command(
     window: tauri::Window,
     state: tauri::State<'_, SidecarState>,
-    mut payload: JsonValue,
+    payload: JsonValue,
 ) {
-    stamp_window(&mut payload, window.label());
-    let msg = serde_json::json!({ "event": "alert:command", "data": payload });
-    send_to_sidecar(&state, msg.to_string());
+    forward_stamped(&state, window.label(), "alert:command", payload);
 }
 
 #[tauri::command]
@@ -3122,10 +3102,9 @@ fn spawn_arrival_watchdog(app: AppHandle, arrival: &routing::Arrival) {
 /// From its mark to now every byte went to the target, or nowhere, and the
 /// source's xterm stands at the mark; so the sidecar is asked for
 /// `outputSince(mark)` scoped to the source, and that replay lifts the
-/// suppression on its way out (`dispatch_sidecar_event`), the held Tool
-/// events behind it. Marks come from the routing state at `pty:marked`, never
-/// from the later serialized content. Only an id the sidecar never stamped
-/// goes straight back.
+/// suppression on its way out (`dispatch_sidecar_event`). Marks come from the
+/// routing state at `pty:marked`, never from the later serialized content. Only
+/// an id the sidecar never stamped goes straight back.
 ///
 /// The record must already be out of the queue; the caller took it.
 fn hand_back_arrival(
@@ -4793,6 +4772,28 @@ mod tests {
         assert!(routing.awaiting_replay.contains_key("t1"));
     }
 
+    /// An exit between a transfer's invoke and its mark belongs to the source,
+    /// which still shows the pane and is about to serialize it, and so does the
+    /// mark behind it: the target lists an exited id only when it has a cut.
+    #[test]
+    fn an_exit_before_the_mark_leaves_the_transfer_to_finish() {
+        let windows = super::WindowState::default();
+        let registry = super::workspaces::Registry::default();
+        let exit = serde_json::json!({"id": "t1", "exitCode": 0});
+        let marked = serde_json::json!({"id": "t1", "mark": 42});
+        windows.mint("t1", "main");
+        windows.begin_transfer(&["t1".to_string()], "main", "ws-2");
+        let routed = |event: &str, data: &JsonValue| {
+            let state = guard(&windows.routing);
+            super::routing::route(event, data, &state.view(&registry)) == super::routing::Route::EmitTo("main")
+        };
+        assert!(routed("pty:exit", &exit));
+        windows.exited_pty("t1");
+        assert!(routed("pty:marked", &marked));
+        guard(&windows.routing).mark_transfer("t1", 42);
+        assert_eq!(guard(&windows.routing).transfer_marks.get("t1"), Some(&42));
+    }
+
     /// An exited Session is still on screen, and a dismiss or a TODO cleared on
     /// it comes back as `alert:state`: dropped as unowned, the pane would ring
     /// forever. Only a kill forgets the owner.
@@ -4804,12 +4805,8 @@ mod tests {
         {
             let state = guard(&windows.routing);
             let registry = super::workspaces::Registry::default();
-            let view = super::RouteView {
-                owners: &state.owners, awaiting_replay: &state.awaiting_replay,
-                dor_targets: &state.dor_targets, registry: &registry, marking: &state.marking,
-            };
             assert_eq!(
-                super::routing::route("alert:state", &serde_json::json!({"id": "t1"}), &view),
+                super::routing::route("alert:state", &serde_json::json!({"id": "t1"}), &state.view(&registry)),
                 super::routing::Route::EmitTo("main")
             );
         }
@@ -4817,20 +4814,20 @@ mod tests {
         assert!(!guard(&windows.routing).owners.contains_key("t1"));
     }
 
+    fn parse_line(line: &str) -> JsonValue {
+        serde_json::from_str(line).expect("a sidecar line is JSON")
+    }
+
     /// The window label is the alert viewer id and the owner of the awaits a
-    /// window parks, and a webview cannot name itself: Rust stamps it on both
-    /// opaque passthroughs, over anything the payload claimed.
+    /// window parks, and a webview cannot name itself: Rust stamps it on the
+    /// opaque command, over anything the payload claimed.
     #[test]
-    fn both_webview_passthroughs_stamp_the_invoking_window() {
-        let mut forged = serde_json::json!({ "op": "hello", "window": "main" });
-        super::stamp_window(&mut forged, "ws-2");
-        assert_eq!(forged, serde_json::json!({ "op": "hello", "window": "ws-2" }));
-
-        let src = include_str!("lib.rs").split("#[cfg(test)]").next().unwrap();
-        for command in ["fn alert_command(", "fn burrow_command("] {
-            let body = src.split(command).nth(1).unwrap().split("\n}\n").next().unwrap();
-            assert!(body.contains("stamp_window(&mut payload, window.label());"), "{command} must stamp");
-        }
+    fn a_forwarded_command_carries_the_invoking_window_over_its_claim() {
+        let forged = serde_json::json!({ "op": "hello", "window": "main" });
+        assert_eq!(
+            parse_line(&super::stamped_message("ws-2", "alert:command", forged)),
+            serde_json::json!({ "event": "alert:command", "data": { "op": "hello", "window": "ws-2" } })
+        );
     }
 
     /// Human input is acknowledged by the sidecar before it writes, so the flag
@@ -4838,15 +4835,40 @@ mod tests {
     #[test]
     fn user_input_rides_the_write_it_describes() {
         assert_eq!(
-            super::pty_input_message("t1".into(), "y".into(), None, Some(true)),
+            parse_line(&super::pty_input_message("t1", "y", None, Some(true))),
             serde_json::json!({ "event": "pty:input", "data": { "id": "t1", "data": "y", "userInput": true } })
         );
         assert_eq!(
-            super::pty_input_message("t1".into(), "\x1b[I".into(), Some(true), None),
+            parse_line(&super::pty_input_message("t1", "\x1b[I", Some(true), Some(false))),
             serde_json::json!({ "event": "pty:input", "data": { "id": "t1", "data": "\x1b[I", "paced": true } })
         );
     }
 
+    /// A window gone for good takes its Sessions' alert entries with its shells,
+    /// unlike the quit teardown's `pty:gracefulKill`, sent while windows still
+    /// show their PTYs.
+    #[test]
+    fn an_orphan_reap_removes_the_sessions_it_kills() {
+        assert_eq!(
+            parse_line(&super::pty_reap_message(&["t1".to_string(), "t2".to_string()])),
+            serde_json::json!({ "event": "pty:reap", "data": { "ids": ["t1", "t2"], "timeout": 2000 } })
+        );
+    }
+
+    /// A cold restore seeds the pane's persisted alert through its spawn, so
+    /// the sidecar starts the Session over and seeds it in one step.
+    #[test]
+    fn a_spawn_carries_its_persisted_alert_to_the_sidecar() {
+        let alert = serde_json::json!({ "status": "ALERT_RINGING", "todo": true, "notification": null });
+        let options: super::PtySpawnOptions =
+            serde_json::from_value(serde_json::json!({ "cols": 80, "rows": 24, "alert": alert })).unwrap();
+        let line = parse_line(&super::pty_spawn_message("t1", Some(&options)));
+        assert_eq!(line["event"], "pty:spawn");
+        assert_eq!(line["data"]["id"], "t1");
+        assert_eq!(line["data"]["options"]["cols"], 80);
+        assert_eq!(line["data"]["options"]["alert"], alert);
+    }
+
     #[test]
     fn adoption_without_a_mark_routes_live_output_to_the_target() {
         let windows = super::WindowState::default();
@@ -4861,11 +4883,7 @@ mod tests {
         assert!(state.awaiting_replay.is_empty());
         assert!(state.transfer_marks.is_empty());
         let registry = super::workspaces::Registry::default();
-        let view = super::RouteView {
-            owners: &state.owners, awaiting_replay: &state.awaiting_replay,
-            dor_targets: &state.dor_targets, registry: &registry, marking: &state.marking,
-        };
-        assert!(matches!(super::routing::route("pty:data", &serde_json::json!({"id": "t1", "data": "live"}), &view), super::routing::Route::EmitTo("ws-2")));
+        assert!(matches!(super::routing::route("pty:data", &serde_json::json!({"id": "t1", "data": "live"}), &state.view(&registry)), super::routing::Route::EmitTo("ws-2")));
     }
 
     #[test]
@@ -4874,13 +4892,9 @@ mod tests {
         windows.mint("t1", "main");
         windows.begin_transfer(&["t1".to_string()], "main", "ws-2");
         let state = guard(&windows.routing);
-        let view = super::RouteView {
-            owners: &state.owners, awaiting_replay: &state.awaiting_replay,
-            dor_targets: &state.dor_targets, registry: &super::workspaces::Registry::default(),
-            marking: &state.marking,
-        };
+        let registry = super::workspaces::Registry::default();
         assert_eq!(state.owners.get("t1").map(String::as_str), Some("ws-2"));
-        assert!(matches!(super::routing::route("pty:data", &serde_json::json!({"id": "t1", "data": "before-mark"}), &view), super::routing::Route::EmitTo("main")));
+        assert!(matches!(super::routing::route("pty:data", &serde_json::json!({"id": "t1", "data": "before-mark"}), &state.view(&registry)), super::routing::Route::EmitTo("main")));
     }
 
     #[test]
@@ -4900,7 +4914,7 @@ mod tests {
         state.mark_transfer("t1", 42);
         assert!(state.awaiting_replay.contains_key("t1"));
         assert_eq!(state.transfer_marks.get("t1"), Some(&42));
-        state.lift_suppression("t1");
+        state.awaiting_replay.remove("t1"); // what the target's replay lifts
         assert_eq!(state.transfer_marks.get("t1"), Some(&42));
         state.mark_transfer("t2", 99); // a late mark after hand-back is inert
         assert!(!state.transfer_marks.contains_key("t2"));
@@ -5709,54 +5723,35 @@ mod tests {
         queue_test_suppression(&state, "pane-a");
         assert_eq!(state.suppressed.load(Ordering::Relaxed), 1);
 
-        super::routing::hold_event(
-            &mut guard(&state.routing).held,
-            "pane-a",
-            "terminal:protocolEvents",
-            serde_json::json!({"n": 1}),
-        );
-
         state.mint("pane-a", "main");
         assert!(guard(&state.routing).awaiting_replay.is_empty());
-        // Nothing held for the PTY that never arrived survives under its id.
-        assert!(guard(&state.routing).held.is_empty());
         assert_eq!(state.suppressed.load(Ordering::Relaxed), 0);
         assert_eq!(state.owned_by("main"), vec!["pane-a".to_string()]);
     }
 
-    /// Every way out of a suppression takes the held queue with it: a queue
-    /// left behind would be flushed ahead of the *next* transfer's own gap.
+    /// Every way out of a suppression lifts it and republishes the count the
+    /// hot path reads: an id left in `awaiting_replay` stays silent until the
+    /// sweep, and a stale count sends every chunk through the sweep.
     #[test]
-    fn every_lift_of_a_suppression_takes_its_held_queue() {
+    fn every_way_out_of_a_suppression_lifts_it() {
         let state = super::WindowState::default();
         let ids = ["pane-a".to_string()];
-        let queue_up = || {
-            queue_test_suppression(&state, "pane-a");
-            super::routing::hold_event(
-                &mut guard(&state.routing).held,
-                "pane-a",
-                "terminal:protocolEvents",
-                serde_json::json!({"n": 1}),
-            );
-            assert_eq!(state.suppressed.load(Ordering::Relaxed), 1);
-        };
         let lifted = || {
-            let routing = guard(&state.routing);
-            routing.awaiting_replay.is_empty() && routing.held.is_empty()
+            guard(&state.routing).awaiting_replay.is_empty()
+                && state.suppressed.load(Ordering::Relaxed) == 0
         };
 
-        queue_up();
+        queue_test_suppression(&state, "pane-a");
         state.clear_suppression(&ids);
         assert!(lifted());
-        assert_eq!(state.suppressed.load(Ordering::Relaxed), 0);
 
-        queue_up();
-        // An unmarked hand-back releases its queue without requesting replay.
+        queue_test_suppression(&state, "pane-a");
+        // An unmarked hand-back goes straight back, with no replay to wait for.
         guard(&state.routing).transfer_marks.remove("pane-a");
         state.hand_back(&ids, "main");
         assert!(lifted());
 
-        queue_up();
+        queue_test_suppression(&state, "pane-a");
         state.forget_pty("pane-a");
         assert!(lifted());
     }
diff --git a/standalone/src-tauri/src/routing.rs b/standalone/src-tauri/src/routing.rs
index 06e27b283..513f5aaa3 100644
--- a/standalone/src-tauri/src/routing.rs
+++ b/standalone/src-tauri/src/routing.rs
@@ -42,14 +42,10 @@ pub enum Route<'a> {
     Broadcast,
     /// Nothing is delivered: the id is mid-transfer and what this carries is
     /// already in the replay the new owner is about to receive (its bytes, or
-    /// the semantic events the owner re-derives from them), or no window owns it
-    /// at all and every window would otherwise take state for a pane none of
-    /// them shows.
+    /// the semantic and Tool events the owner re-derives from them), or no
+    /// window owns it at all and every window would otherwise take state for a
+    /// pane none of them shows.
     Drop,
-    /// Kept for the id's next owner: the id is mid-transfer. The caller queues
-    /// it and delivers the queue, in order, right after the replay that lifts
-    /// the suppression — or when a fail-open sweep lifts it with no replay.
-    Hold,
     /// A `dor` request naming no Surface belongs to whichever window the user
     /// is looking at. Resolved by the caller, which alone holds the focus order.
     Focused,
@@ -74,7 +70,9 @@ pub struct RouteView<'a> {
     /// Every window's Workspaces, for a request naming one explicitly.
     pub registry: &'a crate::workspaces::Registry,
     /// Ids whose transfer is between the invoke and the sidecar's `marked`
-    /// line, each with the source still consuming its output.
+    /// line, each with the source still consuming its output. An id is in at
+    /// most one of `marking` and `awaiting_replay`: its mark ends the one and
+    /// begins the other.
     pub marking: &'a HashMap<String, String>,
 }
 
@@ -102,65 +100,34 @@ fn owner<'a>(map: &'a HashMap<String, String>, id: &str) -> Route<'a> {
     }
 }
 
+/// The window showing `id`: the source still consuming it until its mark
+/// passes, otherwise its owner.
+fn showing<'a>(view: &RouteView<'a>, id: &str) -> Route<'a> {
+    match view.marking.get(id) {
+        Some(source) => Route::EmitTo(source.as_str()),
+        None => owner(view.owners, id),
+    }
+}
+
 /// The one decision every sidecar stdout line passes through.
 pub fn route<'a>(event: &str, data: &'a JsonValue, view: &RouteView<'a>) -> Route<'a> {
     match event {
         // Terminal traffic, keyed by the PTY it came from. Until the sidecar's
         // `marked` line passes, the source keeps consuming: it serializes what
         // it holds at that line, and the target replays only what follows.
-        "pty:data" => {
-            let Some(id) = str_field(data, "id") else {
-                return Route::Broadcast;
-            };
-            if let Some(source) = view.marking.get(id) {
-                return Route::EmitTo(source.as_str());
-            }
-            if view.awaiting_replay.contains_key(id) {
-                return Route::Drop;
-            }
-            owner(view.owners, id)
-        }
-        // Derived once at the sidecar's parse site. The replay is the raw bytes,
-        // OSCs included, and the window receiving it re-derives these from it —
-        // a held copy would apply on top of what the replay rebuilt, and
-        // `commandStart` is not idempotent — so a semantic event goes with its
-        // chunk: to the source until the mark, dropped while suppressed.
-        "terminal:semanticEvents" => {
-            let Some(id) = str_field(data, "id") else {
-                return Route::Broadcast;
-            };
-            if let Some(source) = view.marking.get(id) {
-                return Route::EmitTo(source.as_str());
-            }
-            if view.awaiting_replay.contains_key(id) {
-                return Route::Drop;
-            }
-            owner(view.owners, id)
-        }
-        // The Tool half of a parse (announcements, state, command-start resets;
-        // reports stay with the sidecar's AlertManager): held for the id's next
-        // owner and delivered behind its replay. The replay re-derives the same
-        // events, and applying that ordered run again leaves the state it left;
-        // the hold is what a fail-open sweep, which sends no replay, delivers.
-        "terminal:protocolEvents" => {
-            let Some(id) = str_field(data, "id") else {
-                return Route::Broadcast;
-            };
-            if let Some(source) = view.marking.get(id) {
-                return Route::EmitTo(source.as_str());
-            }
-            if view.awaiting_replay.contains_key(id) {
-                return Route::Hold;
-            }
-            owner(view.owners, id)
-        }
+        // After it, dropped until the replay: the replay is the raw bytes, OSCs
+        // included, and the window receiving it re-derives the semantic and
+        // Tool events from them — a held copy would apply on top of what the
+        // replay rebuilt, and `commandStart` is not idempotent.
+        "pty:data" | "terminal:semanticEvents" | "terminal:toolEvents" => match str_field(data, "id") {
+            Some(id) if view.awaiting_replay.contains_key(id) => Route::Drop,
+            Some(id) => showing(view, id),
+            None => Route::Broadcast,
+        },
         // The split point itself goes to the window still consuming; the
         // caller then turns the id's suppression on behind it.
         "pty:marked" => match str_field(data, "id") {
-            Some(id) => match view.marking.get(id) {
-                Some(source) => Route::EmitTo(source.as_str()),
-                None => owner(view.owners, id),
-            },
+            Some(id) => showing(view, id),
             None => Route::Broadcast,
         },
         // Never suppressed: a replay is exactly what the suppression is waiting
@@ -168,10 +135,17 @@ pub fn route<'a>(event: &str, data: &'a JsonValue, view: &RouteView<'a>) -> Rout
         "pty:replay" if str_field(data, "forWindow").is_some() => {
             Route::EmitTo(str_field(data, "forWindow").unwrap())
         }
-        "pty:exit" | "pty:replay" => match str_field(data, "id") {
+        "pty:replay" => match str_field(data, "id") {
             Some(id) => owner(view.owners, id),
             None => Route::Broadcast,
         },
+        // Never suppressed either: no replay carries an exit — the list ahead
+        // of it does. Before the mark it goes to the source, which serializes
+        // the pane it holds.
+        "pty:exit" => match str_field(data, "id") {
+            Some(id) => showing(view, id),
+            None => Route::Broadcast,
+        },
         // The list answers one window's `pty:requestInit`, which named itself.
         "pty:list" => match str_field(data, "forWindow") {
             Some(label) => Route::EmitTo(label),
@@ -234,17 +208,19 @@ pub fn route<'a>(event: &str, data: &'a JsonValue, view: &RouteView<'a>) -> Rout
             Some(surface_id) => lookup(view.owners, surface_id),
             None => Route::Broadcast,
         },
-        // `alert:*` carrying an id is about one Session, and goes where its
-        // output does until the mark: the source still shows it. After the mark
-        // the new owner's collection re-sends it (§Alerts). What carries none —
-        // the two app-global stores, an await's result — reaches everyone.
-        _ if event.starts_with("alert:") => match str_field(data, "id") {
-            Some(id) => match view.marking.get(id) {
-                Some(source) => Route::EmitTo(source.as_str()),
-                None => owner(view.owners, id),
-            },
-            None => Route::Broadcast,
-        },
+        // `alert:*` naming a window (an await's result) goes to it. One
+        // carrying an id is about one Session, and goes to the window showing
+        // it: after the mark the new owner's collection re-sends it (§Alerts).
+        // What carries neither — the two app-global stores — reaches everyone.
+        _ if event.starts_with("alert:") => {
+            if let Some(label) = str_field(data, "forWindow") {
+                return Route::EmitTo(label);
+            }
+            match str_field(data, "id") {
+                Some(id) => showing(view, id),
+                None => Route::Broadcast,
+            }
+        }
         _ => Route::Broadcast,
     }
 }
@@ -422,7 +398,7 @@ pub fn boot_list_ids(owned: Vec<String>, arrivals: &Arrivals) -> Vec<String> {
 }
 
 /// Release every suppression older than `max` that **no arrival claims**,
-/// returning each released id and its held events together.
+/// returning each released id.
 ///
 /// Fail open, but only defensively: a suppression whose arrival record is gone
 /// is bookkeeping nothing will ever lift, while a real arrival's is lifted by
@@ -430,61 +406,19 @@ pub fn boot_list_ids(owned: Vec<String>, arrivals: &Arrivals) -> Vec<String> {
 /// have its shells unsilenced into a window that has not resumed them yet.
 pub fn sweep_awaiting(
     map: &mut HashMap<String, Instant>,
-    held: &mut HashMap<String, Vec<HeldEvent>>,
     now: Instant,
     max: Duration,
     arriving: &HashSet<String>,
-) -> Vec<(String, Vec<HeldEvent>)> {
-    // The steady state: nothing is transferring, so this costs one branch.
-    if map.is_empty() {
-        return Vec::new();
-    }
-    let stale: Vec<String> = map
-        .iter()
-        .filter(|(id, at)| now.duration_since(**at) >= max && !arriving.contains(*id))
-        .map(|(id, _)| id.clone())
-        .collect();
-    stale.into_iter().map(|id| {
-        let queue = lift_suppression(map, held, &id);
-        (id, queue)
-    }).collect()
-}
-
-/// One event held for an id mid-transfer, in arrival order.
-pub type HeldEvent = (String, JsonValue);
-
-/// Queue an event for an id whose suppression is up. Bounded per id: a
-/// transfer lasts seconds, and an id that outruns the bound is one whose
-/// arrival is wedged, which the arrival watchdog hands back anyway. Past the
-/// bound the oldest goes, so a long gap delivers its suffix.
-pub fn hold_event(
-    held: &mut HashMap<String, Vec<HeldEvent>>,
-    id: &str,
-    event: &str,
-    data: JsonValue,
-) {
-    let queue = held.entry(id.to_string()).or_default();
-    if queue.len() >= HELD_EVENTS_MAX {
-        queue.remove(0);
-    }
-    queue.push((event.to_string(), data));
-}
-
-/// Cap on events held per id.
-pub const HELD_EVENTS_MAX: usize = 256;
-
-/// Lift `id`'s transfer suppression. The suppression and what was held under
-/// it go together — one site clearing the map and leaving the queue would
-/// deliver a stale gap ahead of the next transfer's own — so this is the one
-/// way out of both, and the caller decides whether the queue is delivered
-/// (behind the replay) or discarded (a hand-back, a reuse, an exit).
-pub fn lift_suppression(
-    awaiting_replay: &mut HashMap<String, Instant>,
-    held: &mut HashMap<String, Vec<HeldEvent>>,
-    id: &str,
-) -> Vec<HeldEvent> {
-    awaiting_replay.remove(id);
-    held.remove(id).unwrap_or_default()
+) -> Vec<String> {
+    let mut released = Vec::new();
+    map.retain(|id, at| {
+        let stale = now.duration_since(*at) >= max && !arriving.contains(id);
+        if stale {
+            released.push(id.clone());
+        }
+        !stale
+    });
+    released
 }
 
 /// The next `ws-<n>`, above every label given — live windows and saved
@@ -620,14 +554,16 @@ mod tests {
         ids.iter().map(|id| ((*id).to_string(), now)).collect()
     }
 
+    /// A routing state whose `owners` are exactly these pairs.
+    fn owning(pairs: &[(&str, &str)]) -> crate::RoutingState {
+        crate::RoutingState { owners: labels(pairs), ..Default::default() }
+    }
+
     /// An explicit target crosses windows; an unplaceable one falls through to
     /// the caller's window, which refuses it by name.
     #[test]
     fn an_explicit_target_routes_to_the_window_holding_it() {
-        let owned = labels(&[("a", "main"), ("b", "ws-2")]);
-        let none = awaiting(&[]);
-        let no_dor = HashMap::new();
-        let no_marking: HashMap<String, String> = HashMap::new();
+        let state = owning(&[("a", "main"), ("b", "ws-2")]);
         let mut registry = crate::workspaces::Registry::default();
         crate::workspaces::report(
             &mut registry,
@@ -639,13 +575,7 @@ mod tests {
             "ws-2",
             vec![crate::workspaces::Entry { id: "workspace-5".into(), name: "Docs".into(), active: true }],
         );
-        let view = RouteView {
-            owners: &owned,
-            awaiting_replay: &none,
-            dor_targets: &no_dor,
-            registry: &registry,
-            marking: &no_marking,
-        };
+        let view = state.view(&registry);
         let from_main = |params: JsonValue| json!({ "surfaceId": "a", "params": params });
         assert_eq!(
             route("dor:controlRequest", &from_main(json!({ "workspace": "workspace:5" })), &view),
@@ -678,18 +608,12 @@ mod tests {
     /// Every row of the routing table (docs/specs/standalone.md -> "Windows").
     #[test]
     fn routes_every_sidecar_event_to_its_window() {
-        let owned = labels(&[("a", "main"), ("b", "ws-2")]);
-        let none = awaiting(&[]);
-        let dor = labels(&[("dor-7", "ws-2")]);
-        let no_registry = crate::workspaces::Registry::default();
-        let no_marking: HashMap<String, String> = HashMap::new();
-        let view = RouteView {
-            owners: &owned,
-            awaiting_replay: &none,
-            dor_targets: &dor,
-            registry: &no_registry,
-            marking: &no_marking,
+        let state = crate::RoutingState {
+            dor_targets: labels(&[("dor-7", "ws-2")]),
+            ..owning(&[("a", "main"), ("b", "ws-2")])
         };
+        let no_registry = crate::workspaces::Registry::default();
+        let view = state.view(&no_registry);
         let cases: &[(&str, JsonValue, Route)] = &[
             ("pty:data", json!({"id":"a"}), Route::EmitTo("main")),
             ("pty:data", json!({"id":"b"}), Route::EmitTo("ws-2")),
@@ -704,7 +628,7 @@ mod tests {
                 Route::EmitTo("ws-2"),
             ),
             (
-                "terminal:protocolEvents",
+                "terminal:toolEvents",
                 json!({"id":"a"}),
                 Route::EmitTo("main"),
             ),
@@ -721,12 +645,12 @@ mod tests {
             ("pty:list", json!({"ptys":[]}), Route::Broadcast),
             ("alert:state", json!({"id":"a"}), Route::EmitTo("main")),
             ("alert:settings", json!({"speech":true}), Route::Broadcast),
-            // An await's result names the window that asked, never a Session:
-            // every adapter hears it and matches its own `awaitId`.
+            // An await's result goes to the window that parked it, never to a
+            // Session's owner.
             (
                 "alert:awaitResult",
-                json!({"awaitId":"await-1","window":"ws-2","outcome":{"kind":"cancelled","waitedMs":0}}),
-                Route::Broadcast,
+                json!({"awaitId":"await-1","forWindow":"ws-2","outcome":{"kind":"cancelled","waitedMs":0}}),
+                Route::EmitTo("ws-2"),
             ),
             (
                 "dor:controlRequest",
@@ -780,18 +704,9 @@ mod tests {
 
     #[test]
     fn an_unowned_dor_surface_is_an_error_never_a_sibling() {
-        let owned = labels(&[("a", "main")]);
-        let none = awaiting(&[]);
-        let no_dor = HashMap::new();
+        let state = owning(&[("a", "main")]);
         let no_registry = crate::workspaces::Registry::default();
-        let no_marking: HashMap<String, String> = HashMap::new();
-        let view = RouteView {
-            owners: &owned,
-            awaiting_replay: &none,
-            dor_targets: &no_dor,
-            registry: &no_registry,
-            marking: &no_marking,
-        };
+        let view = state.view(&no_registry);
         assert_eq!(
             route(
                 "dor:controlRequest",
@@ -805,82 +720,44 @@ mod tests {
         );
     }
 
-    #[test]
-    fn held_events_come_back_in_order_and_bounded() {
-        let mut awaiting = awaiting(&["a", "b", "c"]);
-        let mut held = HashMap::new();
-        hold_event(&mut held, "a", "terminal:protocolEvents", json!({"n":1}));
-        hold_event(&mut held, "a", "terminal:protocolEvents", json!({"n":2}));
-        hold_event(&mut held, "b", "terminal:protocolEvents", json!({"n":3}));
-        assert_eq!(
-            lift_suppression(&mut awaiting, &mut held, "a"),
-            vec![
-                ("terminal:protocolEvents".to_string(), json!({"n":1})),
-                ("terminal:protocolEvents".to_string(), json!({"n":2})),
-            ]
-        );
-        // Both halves went together, and nothing of "b" went with them.
-        assert!(!awaiting.contains_key("a"));
-        assert!(awaiting.contains_key("b"));
-        assert!(lift_suppression(&mut awaiting, &mut held, "a").is_empty());
-        assert_eq!(held.len(), 1);
-
-        for n in 0..(HELD_EVENTS_MAX + 5) {
-            hold_event(&mut held, "c", "terminal:protocolEvents", json!({"n":n}));
-        }
-        let queue = lift_suppression(&mut awaiting, &mut held, "c");
-        assert_eq!(queue.len(), HELD_EVENTS_MAX);
-        assert_eq!(queue[0].1, json!({"n":5}));
-    }
-
     #[test]
     fn a_transferring_pty_is_suppressed_until_its_replay() {
-        let owned = labels(&[("a", "ws-2")]);
-        let held = awaiting(&["a"]);
-        let none = awaiting(&[]);
-        let no_dor = HashMap::new();
         let no_registry = crate::workspaces::Registry::default();
-        let no_marking: HashMap<String, String> = HashMap::new();
-        let suppressed = RouteView {
-            owners: &owned,
-            awaiting_replay: &held,
-            dor_targets: &no_dor,
-            registry: &no_registry,
-            marking: &no_marking,
+        let suppressed = crate::RoutingState {
+            awaiting_replay: awaiting(&["a"]),
+            ..owning(&[("a", "ws-2")])
         };
+        let suppressed = suppressed.view(&no_registry);
         assert_eq!(route("pty:data", &json!({"id":"a"}), &suppressed), Route::Drop);
         // Before the mark passes, the source still consumes — and the mark
         // itself goes to it, so it knows where it stands.
-        let marking = labels(&[("a", "main")]);
-        let marking_view = RouteView {
-            owners: &owned,
-            awaiting_replay: &none,
-            dor_targets: &no_dor,
-            registry: &no_registry,
-            marking: &marking,
+        let marking = crate::RoutingState {
+            marking: labels(&[("a", "main")]),
+            ..owning(&[("a", "ws-2")])
         };
+        let marking_view = marking.view(&no_registry);
         assert_eq!(route("pty:data", &json!({"id":"a"}), &marking_view), Route::EmitTo("main"));
         assert_eq!(
             route("terminal:semanticEvents", &json!({"id":"a"}), &marking_view),
             Route::EmitTo("main")
         );
         assert_eq!(
-            route("terminal:protocolEvents", &json!({"id":"a"}), &marking_view),
+            route("terminal:toolEvents", &json!({"id":"a"}), &marking_view),
             Route::EmitTo("main")
         );
         assert_eq!(route("pty:marked", &json!({"id":"a"}), &marking_view), Route::EmitTo("main"));
+        assert_eq!(route("pty:exit", &json!({"id":"a"}), &marking_view), Route::EmitTo("main"));
         // Its alert state goes with its output: the source is still showing it.
         assert_eq!(route("alert:state", &json!({"id":"a"}), &marking_view), Route::EmitTo("main"));
-        // A chunk's semantic events are re-derived from the replay by whoever
-        // receives it: dropped with the chunk. Its Tool events are held, which
-        // is all a fail-open sweep has to deliver.
+        // A chunk's semantic and Tool events are re-derived from the replay by
+        // whoever receives it: dropped with the chunk.
         assert_eq!(
             route("terminal:semanticEvents", &json!({"id":"a"}), &suppressed),
             Route::Drop
         );
         assert_eq!(
-            route("terminal:protocolEvents", &json!({"id":"a"}), &suppressed),
-            Route::Hold
+            route("terminal:toolEvents", &json!({"id":"a"}), &suppressed),
+            Route::Drop
         );
         // The replay itself is never suppressed — it is what is being waited for.
         assert_eq!(
@@ -889,15 +766,9 @@ mod tests {
         );
         // Once the replay has been emitted the suppression is lifted and live
         // data reaches the new owner, behind the replay it belongs after.
-        let released = RouteView {
-            owners: &owned,
-            awaiting_replay: &none,
-            dor_targets: &no_dor,
-            registry: &no_registry,
-            marking: &no_marking,
-        };
+        let released = owning(&[("a", "ws-2")]);
         assert_eq!(
-            route("pty:data", &json!({"id":"a"}), &released),
+            route("pty:data", &json!({"id":"a"}), &released.view(&no_registry)),
             Route::EmitTo("ws-2")
         );
     }
@@ -908,19 +779,10 @@ mod tests {
         let now = Instant::now();
         map.insert("old".to_string(), now - Duration::from_secs(9));
         map.insert("fresh".to_string(), now);
-        let mut held = HashMap::new();
-        let event = ("pty:exit".to_string(), json!({"id": "old", "exitCode": 0}));
-        held.insert("old".to_string(), vec![event.clone()]);
-        held.insert("fresh".to_string(), vec![("pty:title".into(), json!({"id": "fresh"}))]);
-        let swept = sweep_awaiting(&mut map, &mut held, now, AWAITING_REPLAY_MAX, &HashSet::new());
-        assert_eq!(swept, vec![("old".to_string(), vec![event])]);
+        let swept = sweep_awaiting(&mut map, now, AWAITING_REPLAY_MAX, &HashSet::new());
+        assert_eq!(swept, vec!["old".to_string()]);
         assert!(!map.contains_key("old"));
-        assert!(!held.contains_key("old"));
         assert!(map.contains_key("fresh"));
-        assert!(held.contains_key("fresh"));
-        // Reusing this id cannot flush the previous gap's events.
-        map.insert("old".to_string(), now);
-        assert!(lift_suppression(&mut map, &mut held, "old").is_empty());
     }
 
     /// A cold boot slower than `AWAITING_REPLAY_MAX` must not have its shells
@@ -935,19 +797,15 @@ mod tests {
         let mut arrivals = Arrivals::new();
         queue_arrival(&mut arrivals, arrival("w1", "main", "ws-2", &["arriving"]));
 
-        let mut held = HashMap::new();
-        let event = ("pty:title".to_string(), json!({"id": "arriving"}));
-        held.insert("arriving".to_string(), vec![event.clone()]);
-        let swept = sweep_awaiting(&mut map, &mut held, now, AWAITING_REPLAY_MAX, &arrival_ids(&arrivals));
-        assert_eq!(swept, vec![("orphan".to_string(), vec![])]);
-        assert_eq!(held.get("arriving"), Some(&vec![event.clone()]));
+        let swept = sweep_awaiting(&mut map, now, AWAITING_REPLAY_MAX, &arrival_ids(&arrivals));
+        assert_eq!(swept, vec!["orphan".to_string()]);
         assert!(map.contains_key("arriving"));
 
         // Its record settled: the suppression is ordinary bookkeeping again.
         take_arrival(&mut arrivals, "w1", "ws-2").unwrap();
         assert_eq!(
-            sweep_awaiting(&mut map, &mut held, now, AWAITING_REPLAY_MAX, &arrival_ids(&arrivals)),
-            vec![("arriving".to_string(), vec![event])]
+            sweep_awaiting(&mut map, now, AWAITING_REPLAY_MAX, &arrival_ids(&arrivals)),
+            vec!["arriving".to_string()]
         );
     }
 
diff --git a/standalone/src/browser-sidecar-adapter.test.ts b/standalone/src/browser-sidecar-adapter.test.ts
index 32026dec9..ec2ee0272 100644
--- a/standalone/src/browser-sidecar-adapter.test.ts
+++ b/standalone/src/browser-sidecar-adapter.test.ts
@@ -1,7 +1,5 @@
-import { getToolDirty, resetToolDirty } from 'dormouse-lib/lib/tool-dirty-store';
-import { afterEach, describe, expect, it, vi } from "vitest";
-import type { AlertStateDetail, PlatformAdapter, PtyDataDetail } from "dormouse-lib/lib/platform/types";
-import { getTerminalPaneState } from "dormouse-lib/lib/terminal-state-store";
+import { describe, expect, it, vi } from "vitest";
+import type { PlatformAdapter } from "dormouse-lib/lib/platform/types";
 
 // Stub the Tauri modules so `./tauri-adapter` imports and constructs outside a
 // Tauri webview — same reason as tauri-adapter.test.ts. Nothing here exercises
@@ -14,8 +12,6 @@ vi.mock("@tauri-apps/plugin-shell", () => ({ open: vi.fn(async () => {}) }));
 import { BrowserSidecarAdapter } from "./browser-sidecar-adapter";
 import { BrowserSidecarHost } from "./browser-sidecar-host";
 import { TauriAdapter } from "./tauri-adapter";
-import type { AlertSettings } from "dormouse-lib/lib/alert-settings";
-import { DEFAULT_ALERT_SETTINGS } from "dormouse-lib/lib/alert-settings-model";
 
 // Both adapters are viewed as `PlatformAdapter` here on purpose: `onFilesDropped`
 // is optional precisely so consumers can probe for it
@@ -92,20 +88,18 @@ describe("BrowserSidecarAdapter session persistence", () => {
   });
 });
 
-// The harness rides the same sidecar, so the parse boundary is the same one
-// TauriAdapter has: forward the pair, apply the events, push the theme.
-describe("BrowserSidecarAdapter terminal stream", () => {
-  afterEach(resetToolDirty);
-
-  async function listening() {
+// The parse boundary and the alert transport both sidecar adapters share are
+// pinned once, for both, in `sidecar-adapters.test.ts`.
+describe("BrowserSidecarAdapter event stream", () => {
+  // The SSE stream is the only path the alerts' events take here, and whatever
+  // the sidecar sent while it was down is gone: `sync` has the sidecar re-send
+  // this window's state and both stores, ending nothing.
+  it("asks the sidecar to sync when the event stream reconnects", async () => {
     const host = new BrowserSidecarHost("http://localhost:1234");
-    let emit: (event: { event: string; data: unknown }) => void = () => {};
     let reconnect: () => void = () => {};
     vi.spyOn(host, "init").mockResolvedValue(undefined);
-    vi.spyOn(host, "onEvent").mockImplementation((listener) => {
-      emit = listener;
-      return () => {};
-    });
+    vi.spyOn(host, "invoke").mockResolvedValue(undefined);
+    vi.spyOn(host, "onEvent").mockReturnValue(() => {});
     vi.spyOn(host, "onReconnect").mockImplementation((listener) => {
       reconnect = listener;
       return () => {};
@@ -113,151 +107,10 @@ describe("BrowserSidecarAdapter terminal stream", () => {
     const send = vi.spyOn(host, "send").mockImplementation(() => {});
     (window as typeof window & { __DORMOUSE_BROWSER_CONSOLE_PATCHED__?: boolean })
       .__DORMOUSE_BROWSER_CONSOLE_PATCHED__ = true;
-
-    const adapter = new BrowserSidecarAdapter(host);
-    await adapter.init();
-    // The page's realm is new on every load: the sidecar hears it at init.
-    expect(send).toHaveBeenCalledWith("alert_command", { payload: { op: "hello" } });
-    send.mockClear();
-    const alertCommands = () =>
-      send.mock.calls.filter(([cmd]) => cmd === "alert_command").map(([, args]) => args);
-    return {
-      adapter, send, alertCommands,
-      reconnect: () => reconnect(),
-      deliver: (event: string, data: unknown) => emit({ event, data }),
-    };
-  }
-
-  it("applies dirty live/replay reports in order and preserves explicit clean across exit", async () => {
-    const { deliver } = await listening();
-    const id = 'dirty-stream';
-    deliver('terminal:protocolEvents', { id, events: [
-      { kind: 'toolState', state: { dirty: true } },
-      { kind: 'semantic', event: { type: 'commandStart', source: 'osc633_boundaries' } },
-      { kind: 'toolState', state: { dirty: false } },
-    ] });
-    deliver('terminal:semanticEvents', { id, events: [{ type: 'commandStart', source: 'osc633_boundaries' }] });
-    expect(getToolDirty(id)).toBe(false);
-    deliver('pty:exit', { id, exitCode: 0 });
-    expect(getToolDirty(id)).toBe(false);
-    deliver('pty:replay', { id, data: '\x1b]633;C\x07\x1b]367;state;{"v":1,"dirty":true}\x07' });
-    expect(getToolDirty(id)).toBe(true);
-    deliver('pty:replay', { id, data: 'since-mark output without a new command' });
-    expect(getToolDirty(id)).toBe(true);
-    deliver('pty:replay', { id, data: '\x1b]633;C\x07' });
-    expect(getToolDirty(id)).toBeNull();
-  });
-
-  it("forwards the projection pair it was handed, parsing nothing again", async () => {
-    const { adapter, send, deliver } = await listening();
-    const seen: PtyDataDetail[] = [];
-    adapter.onPtyData((detail) => void seen.push(detail));
-
-    deliver("pty:data", { id: "b1", data: "\x1b]11;?\x07tail", textData: "tail" });
-
-    expect(seen).toEqual([{ id: "b1", data: "\x1b]11;?\x07tail", textData: "tail" }]);
-    expect(send.mock.calls.filter(([cmd]) => cmd === "pty_write")).toEqual([]);
-  });
-
-  it("writes user input with its acknowledgement in one message", async () => {
-    const { adapter, send, alertCommands } = await listening();
-    adapter.writePty("typed", "\x1b[I");
-    adapter.writePty("typed", "y", { userInput: true });
-    expect(send.mock.calls).toEqual([
-      ["pty_write", { id: "typed", data: "\x1b[I", paced: undefined, userInput: undefined }],
-      ["pty_write", { id: "typed", data: "y", paced: undefined, userInput: true }],
-    ]);
-    expect(alertCommands()).toEqual([]);
-  });
-
-  it("routes every alert verb through the sidecar and renders what comes back", async () => {
-    const { adapter, alertCommands, deliver } = await listening();
-    const quiet: AlertSettings = { ...DEFAULT_ALERT_SETTINGS, speakEnabled: false };
-    adapter.alertSetCommandWatched("cargo", true);
-    adapter.alertPublishSettings(quiet, { seed: true });
-    adapter.alertDismiss("b1");
-    expect(alertCommands()).toEqual([
-      { payload: { op: "setCommandWatched", name: "cargo", watched: true } },
-      { payload: { op: "initializeSettings", settings: quiet } },
-      { payload: { op: "dismiss", id: "b1" } },
-    ]);
-
-    const names: string[][] = [];
-    const settings: AlertSettings[] = [];
-    const states: AlertStateDetail[] = [];
-    adapter.onWatchedCommands((next) => void names.push(next));
-    adapter.onAlertSettings((next) => void settings.push(next));
-    adapter.onAlertState((next) => void states.push(next));
-
-    deliver("alert:watchedCommands", { names: ["cargo", "make"] });
-    expect(names).toEqual([["cargo", "make"]]);
-    const canonical: AlertSettings = { ...DEFAULT_ALERT_SETTINGS, deferAlertsUntilQuiet: false };
-    deliver("alert:settings", { settings: canonical });
-    expect(settings).toEqual([canonical]);
-    const ringing = { id: "b1", status: "ALERT_RINGING", watchingEnabled: false, todo: true, notification: null, awaited: false };
-    deliver("alert:state", ringing);
-    expect(states).toEqual([ringing]);
-  });
-
-  it("resolves an await from the broadcast result, and settles it when shut down", async () => {
-    const { adapter, alertCommands, deliver } = await listening();
-    const answered = adapter.alertAwait("b1", { until: "quiet", timeoutMs: 600_000 });
-    const { awaitId } = (alertCommands()[0] as { payload: { awaitId: string } }).payload;
-    deliver("alert:awaitResult", { awaitId, window: "main", outcome: { kind: "resolved", cause: "quiet", waitedMs: 9 } });
-    await expect(answered.promise).resolves.toEqual({ kind: "resolved", cause: "quiet", waitedMs: 9 });
-
-    const parked = adapter.alertAwait("b1", { until: "exit", timeoutMs: 600_000 });
-    adapter.shutdown();
-    await expect(parked.promise).resolves.toMatchObject({ kind: "cancelled" });
-  });
-
-  // The stream is the only path a store's snapshot takes back, and a dropped
-  // stream loses the bridge's fan-out entry with it. Re-offering the seeds is
-  // what makes the sidecar republish; a repeat seed is refused as a seed but
-  // still answered (lib/src/lib/watched-command-host.ts `initialize`).
-  it("re-sends its last seeds when the event stream reconnects", async () => {
-    const { adapter, alertCommands, reconnect, send } = await listening();
-    const quiet: AlertSettings = { ...DEFAULT_ALERT_SETTINGS, speakEnabled: false };
-    adapter.alertSetWatchedCommands(["cargo"]);
-    adapter.alertPublishSettings(quiet, { seed: true });
-    // Neither a mutation nor a non-seed publish is a seed; neither is replayed.
-    adapter.alertSetCommandWatched("make", true);
-    adapter.alertPublishSettings({ ...quiet, pushEnabled: true }, { seed: false });
+    await new BrowserSidecarAdapter(host).init();
     send.mockClear();
 
     reconnect();
-    expect(alertCommands()).toEqual([
-      { payload: { op: "initializeWatchedCommands", names: ["cargo"] } },
-      { payload: { op: "initializeSettings", settings: quiet } },
-    ]);
-  });
-
-  // Same contract as TauriAdapter: the sidecar's parse already fed its manager,
-  // so a replay rebuilds pane state and nothing of the alerts.
-  it("rebuilds pane state from a replay, and asks nothing of the alerts", async () => {
-    const { adapter, deliver, alertCommands } = await listening();
-    const alerts: AlertStateDetail[] = [];
-    adapter.onAlertState((detail) => void alerts.push(detail));
-
-    deliver("pty:replay", { id: "replay-b", data: "\x1b]633;E;sleep 5\x07\x1b]633;C\x07\x1b]9;Historical\x07" });
-
-    expect(getTerminalPaneState("replay-b").currentCommand?.rawCommandLine).toBe("sleep 5");
-    expect(alerts).toEqual([]);
-    expect(alertCommands()).toEqual([]);
-  });
-
-  it("pushes the resolved theme so the sidecar can answer a colour query", async () => {
-    const { adapter, send } = await listening();
-    adapter.requestInit();
-
-    const pushed = send.mock.calls.filter(([cmd]) => cmd === "pty_theme_colors");
-    expect(pushed).toHaveLength(1);
-    expect(pushed[0]![1]).toEqual({
-      colors: {
-        foreground: expect.any(String),
-        background: expect.any(String),
-        cursor: expect.any(String),
-      },
-    });
+    expect(send.mock.calls).toEqual([["alert_command", { payload: { op: "sync" } }]]);
   });
 });
diff --git a/standalone/src/browser-sidecar-adapter.ts b/standalone/src/browser-sidecar-adapter.ts
index 8a0fa5397..f945e90e0 100644
--- a/standalone/src/browser-sidecar-adapter.ts
+++ b/standalone/src/browser-sidecar-adapter.ts
@@ -1,5 +1,5 @@
 import { recordToolEvents } from '../../lib/src/lib/tool-events';
-import type { HelperIdentity, TerminalContextRequest, TerminalContextInfo } from '../../lib/src/lib/terminal-context-types';
+import type { TerminalContextRequest, TerminalContextInfo } from '../../lib/src/lib/terminal-context-types';
 import { installWorkspaceRegistry, type WorkspaceRegistrySnapshot } from "./workspace-registry";
 import type {
   AgentBrowserCommandResult,
@@ -20,6 +20,7 @@ import type {
   GitInfoResult,
   ToolControlResult,
   ToolHostRequest,
+  SpawnPtyOptions,
   WritePtyOptions,
 } from "dormouse-lib/lib/platform/types";
 import {
@@ -36,19 +37,16 @@ import {
   type BurrowResult,
 } from "dormouse-lib/host/remote/service-protocol";
 import { embedderOrigins } from "dormouse-lib/lib/embedder-origins";
-import { createSidecarAlertClient } from "dormouse-lib/host/alert-client";
+import { createAlertClient, type AlertClientMethods } from "dormouse-lib/host/alert-client";
 import type { AlertCommand } from "dormouse-lib/host/alert-protocol";
 import { normalizeExternalUri } from "dormouse-lib/lib/external-links";
 import { createMemoryNotepadArchivePort } from "dormouse-lib/lib/notepad/memory-archive-port";
 import type { PersistedWindow } from "dormouse-lib/lib/session-types";
 import { claimRecoveryCommands, windowStateSlot } from "./window-recovery";
 import { coalesceCwds } from "./coalesce-cwds";
-import {
-  collectTerminalSemanticEvents,
-  TerminalProtocolParser,
-  type TerminalProtocolEvent,
-} from "dormouse-lib/lib/terminal-protocol";
-import { getTerminalTheme, onTerminalThemeChange, themeColorProvider } from "dormouse-lib/lib/terminal-theme";
+import type { TerminalProtocolEvent } from "dormouse-lib/lib/terminal-protocol";
+import { getTerminalTheme, onTerminalThemeChange } from "dormouse-lib/lib/terminal-theme";
+import { parseReplay } from "dormouse-lib/lib/platform/replay-parse";
 import type { TerminalSemanticEvent } from "dormouse-lib/lib/terminal-state";
 import { applyTerminalSemanticEvents } from "dormouse-lib/lib/terminal-state-store";
 import type { DorControlCancelPayload, DorControlRequestPayload } from "dor/protocol";
@@ -67,6 +65,9 @@ function decodeBase64Bytes(base64: string): Uint8Array {
   return bytes;
 }
 
+/** The `alert*` platform methods, taken from the shared client in the constructor. */
+export interface BrowserSidecarAdapter extends AlertClientMethods {}
+
 export class BrowserSidecarAdapter implements PlatformAdapter {
   private dataHandlers = new Set<(detail: PtyDataDetail) => void>();
   private exitHandlers = new Set<(detail: { id: string; exitCode: number }) => void>();
@@ -91,26 +92,12 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
 
   // The sidecar's alerts, through the same client TauriAdapter uses; the dev
   // host stamps this page's one fixed window label on each command.
-  private readonly alerts = createSidecarAlertClient((payload: AlertCommand) => {
+  private readonly alerts = createAlertClient((payload: AlertCommand) => {
     this.host.send("alert_command", { payload });
   });
-  readonly alertRemove = this.alerts.alertRemove;
-  readonly alertSeed = this.alerts.alertSeed;
-  readonly alertSetWatchedCommands = this.alerts.alertSetWatchedCommands;
-  readonly alertSetCommandWatched = this.alerts.alertSetCommandWatched;
-  readonly alertPublishSettings = this.alerts.alertPublishSettings;
-  readonly alertDismiss = this.alerts.alertDismiss;
-  readonly alertEngagement = this.alerts.alertEngagement;
-  readonly alertAcknowledge = this.alerts.alertAcknowledge;
-  readonly alertResize = this.alerts.alertResize;
-  readonly alertToggleTodo = this.alerts.alertToggleTodo;
-  readonly alertClearTodo = this.alerts.alertClearTodo;
-  readonly alertAwait = this.alerts.alertAwait;
-  readonly onAlertState = this.alerts.onAlertState;
-  readonly onWatchedCommands = this.alerts.onWatchedCommands;
-  readonly onAlertSettings = this.alerts.onAlertSettings;
 
   constructor(private readonly host: BrowserSidecarHost) {
+    Object.assign(this, this.alerts.methods);
     // See TauriAdapter: the sidecar parses and has no DOM, so it is told the
     // resolved terminal colors whenever they change.
     onTerminalThemeChange(() => this.pushThemeColors());
@@ -133,11 +120,10 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
   async init(): Promise<void> {
     await this.host.init();
     this.unlistenHost = this.host.onEvent(({ event, data }) => this.handleHostEvent(event, data));
-    // The SSE stream is the only way a store's snapshot reaches this adapter,
-    // and a dropped stream takes the bridge's fan-out entry with it; re-offering
-    // the seeds makes the sidecar republish both stores (a repeat seed is
-    // ignored as a seed but still answered with the canonical snapshot).
-    this.unlistenReconnect = this.host.onReconnect(() => this.alerts.reofferSeeds());
+    // The SSE stream is the only way the alerts' events reach this adapter,
+    // and whatever the sidecar sent while it was down is lost: `sync` has the
+    // sidecar re-send this window's Sessions' state and both stores.
+    this.unlistenReconnect = this.host.onReconnect(() => this.alerts.sync());
     // A reload is a new realm under the same label; see TauriAdapter.
     this.alerts.hello();
     this.installConsoleForwarder();
@@ -187,7 +173,7 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
     if (result.error) throw new Error(result.error);
     return result;
   }
-  spawnPty(id: string, options?: { cols?: number; rows?: number; cwd?: string; shell?: string; args?: string[]; helper?: HelperIdentity }): void {
+  spawnPty(id: string, options?: SpawnPtyOptions): void {
     this.host.send("pty_spawn", { id, options });
   }
 
@@ -395,7 +381,7 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
       // the two messages below (docs/specs/terminal-escapes.md).
       const payload = data as PtyDataDetail;
       for (const handler of this.dataHandlers) handler(payload);
-    } else if (event === "terminal:protocolEvents") {
+    } else if (event === "terminal:toolEvents") {
       const payload = data as { id: string; events: TerminalProtocolEvent[] };
       recordToolEvents(payload.id, payload.events);
     } else if (event === "terminal:semanticEvents") {
@@ -409,13 +395,9 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
     } else if (event === "pty:marked") {
       for (const handler of this.markedHandlers) handler(data as PtyMarkedDetail);
     } else if (event === "pty:replay") {
-      // The one stream the sidecar does not parse; see TauriAdapter, including
-      // why the one-shot parser still needs the theme.
       const { id, data: text, requestId } = data as PtyReplayDetail;
-      const parsed = new TerminalProtocolParser(themeColorProvider).process(text);
-      recordToolEvents(id, parsed.events);
-      applyTerminalSemanticEvents(id, collectTerminalSemanticEvents(parsed.events));
-      for (const handler of this.replayHandlers) handler({ id, data: parsed.visibleData, requestId });
+      const visibleData = parseReplay(id, text);
+      for (const handler of this.replayHandlers) handler({ id, data: visibleData, requestId });
     } else if (event === BURROW_RESULT_EVENT) {
       this.burrowClient.onResult(data as BurrowResult);
     } else if (event === BURROW_ASK_EVENT) {
diff --git a/standalone/src/sidecar-adapters.test.ts b/standalone/src/sidecar-adapters.test.ts
new file mode 100644
index 000000000..aac6214ee
--- /dev/null
+++ b/standalone/src/sidecar-adapters.test.ts
@@ -0,0 +1,202 @@
+import { getToolDirty, resetToolDirty } from "dormouse-lib/lib/tool-dirty-store";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+// Stub the Tauri modules so both adapters import and construct outside a Tauri
+// webview; the Tauri harness below drives the two mocks.
+vi.mock("@tauri-apps/api/core", () => ({ invoke: vi.fn(async () => undefined) }));
+vi.mock("@tauri-apps/api/event", () => ({ listen: vi.fn(async () => () => {}) }));
+vi.mock("@tauri-apps/plugin-shell", () => ({ open: vi.fn(async () => {}) }));
+
+import { invoke as rawInvoke } from "@tauri-apps/api/core";
+import { listen } from "@tauri-apps/api/event";
+import { ALERT_EVENTS } from "dormouse-lib/host/alert-protocol";
+import type { AlertStateDetail, PlatformAdapter, PtyDataDetail } from "dormouse-lib/lib/platform/types";
+import { getTerminalPaneState } from "dormouse-lib/lib/terminal-state-store";
+import { BrowserSidecarAdapter } from "./browser-sidecar-adapter";
+import { BrowserSidecarHost } from "./browser-sidecar-host";
+import { TauriAdapter } from "./tauri-adapter";
+
+/**
+ * The two adapters over standalone's sidecar — the Tauri webview's and the
+ * browser harness's — differ only in their transport, so the parse boundary
+ * and the alert transport are pinned once, for both: forward the pair, apply
+ * the events, carry every alert verb as one `alert_command`, and hand the
+ * sidecar's events to the shared client (`lib/src/host/alert-client.test.ts`
+ * covers what each verb sends).
+ */
+
+interface Harness {
+  adapter: PlatformAdapter;
+  /** One sidecar event, as this adapter's transport delivers it. */
+  deliver(event: string, payload: unknown): void;
+  /** Every `[command, args]` sent since init. */
+  sent(): Array<[string, unknown]>;
+  /** Whether the adapter was listening for `event` when it said hello. */
+  listeningAtHello(event: string): boolean;
+}
+
+async function tauri(): Promise<Harness> {
+  const handlers = new Map<string, (event: { payload: unknown }) => void>();
+  const heardAtHello = new Set<string>();
+  vi.mocked(listen).mockImplementation((async (event: string, handler: (e: { payload: unknown }) => void) => {
+    handlers.set(event, handler);
+    return () => {};
+  }) as unknown as typeof listen);
+  const invoke = vi.mocked(rawInvoke);
+  invoke.mockClear();
+  invoke.mockImplementation((async (cmd: string, args?: { payload?: { op?: string } }) => {
+    if (cmd === "alert_command" && args?.payload?.op === "hello") for (const event of handlers.keys()) heardAtHello.add(event);
+    return undefined;
+  }) as unknown as typeof rawInvoke);
+  const adapter = new TauriAdapter();
+  await adapter.init();
+  const since = invoke.mock.calls.length;
+  return {
+    adapter,
+    deliver: (event, payload) => void handlers.get(event)?.({ payload }),
+    sent: () => invoke.mock.calls.slice(since).map(([cmd, args]) => [cmd, args]),
+    listeningAtHello: (event) => heardAtHello.has(event),
+  };
+}
+
+async function browser(): Promise<Harness> {
+  const host = new BrowserSidecarHost("http://localhost:1234");
+  let emit: ((event: { event: string; data: unknown }) => void) | null = null;
+  let listeningAtHello = false;
+  vi.spyOn(host, "init").mockResolvedValue(undefined);
+  vi.spyOn(host, "invoke").mockResolvedValue(undefined);
+  vi.spyOn(host, "onReconnect").mockReturnValue(() => {});
+  vi.spyOn(host, "onEvent").mockImplementation((listener) => {
+    emit = listener;
+    return () => {};
+  });
+  const send = vi.spyOn(host, "send").mockImplementation((cmd, args) => {
+    if (cmd === "alert_command" && (args as { payload: { op: string } }).payload.op === "hello") listeningAtHello = emit !== null;
+  });
+  // Claim the console-forwarder flag so init() leaves the shared jsdom console alone.
+  (window as typeof window & { __DORMOUSE_BROWSER_CONSOLE_PATCHED__?: boolean })
+    .__DORMOUSE_BROWSER_CONSOLE_PATCHED__ = true;
+  const adapter = new BrowserSidecarAdapter(host);
+  await adapter.init();
+  const since = send.mock.calls.length;
+  return {
+    adapter,
+    deliver: (event, data) => emit?.({ event, data }),
+    sent: () => send.mock.calls.slice(since).map(([cmd, args]) => [cmd, args]),
+    // One subscription carries every event.
+    listeningAtHello: () => listeningAtHello,
+  };
+}
+
+const alertCommands = (harness: Harness) =>
+  harness.sent().filter(([cmd]) => cmd === "alert_command").map(([, args]) => (args as { payload: unknown }).payload);
+
+describe.each([
+  ["TauriAdapter", tauri],
+  ["BrowserSidecarAdapter", browser],
+])("%s over the sidecar", (_name, open) => {
+  afterEach(() => {
+    resetToolDirty();
+    vi.restoreAllMocks();
+  });
+
+  it("applies dirty live/replay reports in order and preserves explicit clean across exit", async () => {
+    const { deliver } = await open();
+    const id = "dirty-stream";
+    deliver("terminal:toolEvents", { id, events: [
+      { kind: "toolState", state: { dirty: true } },
+      { kind: "semantic", event: { type: "commandStart", source: "osc633_boundaries" } },
+      { kind: "toolState", state: { dirty: false } },
+    ] });
+    deliver("terminal:semanticEvents", { id, events: [{ type: "commandStart", source: "osc633_boundaries" }] });
+    expect(getToolDirty(id)).toBe(false);
+    deliver("pty:exit", { id, exitCode: 0 });
+    expect(getToolDirty(id)).toBe(false);
+    deliver("pty:replay", { id, data: "\x1b]633;C\x07\x1b]367;state;{\"v\":1,\"dirty\":true}\x07" });
+    expect(getToolDirty(id)).toBe(true);
+    deliver("pty:replay", { id, data: "since-mark output without a new command" });
+    expect(getToolDirty(id)).toBe(true);
+    deliver("pty:replay", { id, data: "\x1b]633;C\x07" });
+    expect(getToolDirty(id)).toBeNull();
+  });
+
+  it("forwards the projection pair it was handed, parsing nothing again", async () => {
+    const { adapter, deliver, sent } = await open();
+    const seen: PtyDataDetail[] = [];
+    adapter.onPtyData((detail) => void seen.push(detail));
+
+    // A colour query: a second parse here would answer it twice.
+    deliver("pty:data", { id: "t1", data: "pre\x1b]1337;File=inline=1:AAAA\x07post", textData: "prepost" });
+    deliver("pty:data", { id: "t1", data: "\x1b]11;?\x07" });
+
+    expect(seen).toEqual([
+      { id: "t1", data: "pre\x1b]1337;File=inline=1:AAAA\x07post", textData: "prepost" },
+      { id: "t1", data: "\x1b]11;?\x07" },
+    ]);
+    expect(sent()).toEqual([]);
+  });
+
+  it("rebuilds pane state from a replay, and asks nothing of the alerts", async () => {
+    const { adapter, deliver, sent } = await open();
+    const alerts: AlertStateDetail[] = [];
+    adapter.onAlertState((detail) => void alerts.push(detail));
+
+    deliver("pty:replay", { id: "replay-pty", data: "\x1b]633;E;sleep 5\x07\x1b]633;C\x07\x1b]9;Historical\x07" });
+
+    expect(getTerminalPaneState("replay-pty").currentCommand?.rawCommandLine).toBe("sleep 5");
+    expect(alerts).toEqual([]);
+    expect(sent()).toEqual([]);
+  });
+
+  // The sidecar acknowledges it and opens the echo window before it writes, so
+  // the flag must ride the write itself — a separate command could lose the race.
+  it("writes user input with its acknowledgement in one message", async () => {
+    const { adapter, sent } = await open();
+    adapter.writePty("typed", "\x1b[I");
+    adapter.writePty("typed", "y", { userInput: true });
+    expect(sent()).toEqual([
+      ["pty_write", { id: "typed", data: "\x1b[I", paced: undefined, userInput: undefined }],
+      ["pty_write", { id: "typed", data: "y", paced: undefined, userInput: true }],
+    ]);
+  });
+
+  // A reload keeps the window label, so only this tells the sidecar the old
+  // realm's engagement and parked awaits are gone — and only once this realm
+  // can hear the answers.
+  it("says hello once it can hear every alert event", async () => {
+    const harness = await open();
+    for (const event of ALERT_EVENTS) expect(harness.listeningAtHello(event)).toBe(true);
+  });
+
+  it("carries each alert verb as one alert_command and hands the sidecar's events to the client", async () => {
+    const harness = await open();
+    const { adapter, deliver } = harness;
+    const states: AlertStateDetail[] = [];
+    adapter.onAlertState((detail) => void states.push(detail));
+
+    const handle = adapter.alertAwait("p", { until: "exit", timeoutMs: 600_000 });
+    const [parked] = alertCommands(harness) as Array<{ op: string; awaitId: string }>;
+    expect(parked).toMatchObject({ op: "await", id: "p", until: "exit" });
+    deliver("alert:awaitResult", { awaitId: parked!.awaitId, forWindow: "main", outcome: { kind: "resolved", cause: "exit", waitedMs: 4 } });
+    await expect(handle.promise).resolves.toEqual({ kind: "resolved", cause: "exit", waitedMs: 4 });
+
+    const ringing = { id: "p", status: "ALERT_RINGING", todo: true } as unknown as AlertStateDetail;
+    deliver("alert:state", ringing);
+    expect(states).toEqual([ringing]);
+  });
+
+  it("settles what it parked when it shuts down", async () => {
+    const { adapter } = await open();
+    const handle = adapter.alertAwait("p", { until: "quiet", timeoutMs: 600_000 });
+    adapter.shutdown();
+    await expect(handle.promise).resolves.toMatchObject({ kind: "cancelled" });
+  });
+
+  it("pushes the resolved theme so the sidecar can answer a colour query", async () => {
+    const { adapter, sent } = await open();
+    adapter.requestInit();
+    expect(sent().filter(([cmd]) => cmd === "pty_theme_colors")).toEqual([["pty_theme_colors", {
+      colors: { foreground: expect.any(String), background: expect.any(String), cursor: expect.any(String) },
+    }]]);
+  });
+});
diff --git a/standalone/src/tauri-adapter.test.ts b/standalone/src/tauri-adapter.test.ts
index 517c722a0..71fc2e757 100644
--- a/standalone/src/tauri-adapter.test.ts
+++ b/standalone/src/tauri-adapter.test.ts
@@ -1,5 +1,4 @@
-import { getToolDirty, resetToolDirty } from 'dormouse-lib/lib/tool-dirty-store';
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 
 // The in-process session-flush handshake and drain wrappers on TauriAdapter are
 // pure webview-side logic — they never invoke Tauri — so we only need to stub the
@@ -18,7 +17,7 @@ vi.mock("@tauri-apps/plugin-shell", () => ({
 import { invoke as rawInvoke } from "@tauri-apps/api/core";
 import { listen } from "@tauri-apps/api/event";
 import type { NotepadArchiveV1 } from "dormouse-lib/lib/notepad/types";
-import type { AlertStateDetail, PtyDataDetail } from "dormouse-lib/lib/platform/types";
+import type { AlertStateDetail } from "dormouse-lib/lib/platform/types";
 import { getTerminalPaneState } from "dormouse-lib/lib/terminal-state-store";
 import { TauriAdapter } from "./tauri-adapter";
 
@@ -375,9 +374,9 @@ describe("TauriAdapter remote host link", () => {
 // The sidecar owns the parse (docs/specs/terminal-escapes.md → "Parsing
 // location"), so this adapter forwards what it is given and never re-derives
 // it. What is covered here is exactly that boundary.
+// The parse boundary both sidecar adapters share is pinned once, for both, in
+// `sidecar-adapters.test.ts`; what is Tauri's alone is here.
 describe("TauriAdapter terminal stream", () => {
-  afterEach(resetToolDirty);
-
   async function listening() {
     const handlers = new Map<string, (event: { payload: unknown }) => void>();
     vi.mocked(listen).mockImplementation((async (
@@ -402,48 +401,6 @@ describe("TauriAdapter terminal stream", () => {
     };
   }
 
-  it("applies dirty live/replay reports in order and preserves explicit clean across exit", async () => {
-    const { deliver } = await listening();
-    const id = 'dirty-stream';
-    deliver('terminal:protocolEvents', { id, events: [
-      { kind: 'toolState', state: { dirty: true } },
-      { kind: 'semantic', event: { type: 'commandStart', source: 'osc633_boundaries' } },
-      { kind: 'toolState', state: { dirty: false } },
-    ] });
-    deliver('terminal:semanticEvents', { id, events: [{ type: 'commandStart', source: 'osc633_boundaries' }] });
-    expect(getToolDirty(id)).toBe(false);
-    deliver('pty:exit', { id, exitCode: 0 });
-    expect(getToolDirty(id)).toBe(false);
-    deliver('pty:replay', { id, data: '\x1b]633;C\x07\x1b]367;state;{"v":1,"dirty":true}\x07' });
-    expect(getToolDirty(id)).toBe(true);
-    deliver('pty:replay', { id, data: 'since-mark output without a new command' });
-    expect(getToolDirty(id)).toBe(true);
-    deliver('pty:replay', { id, data: '\x1b]633;C\x07' });
-    expect(getToolDirty(id)).toBeNull();
-  });
-
-  it("forwards the projection pair it was handed, parsing nothing again", async () => {
-    const { adapter, deliver, invoke } = await listening();
-    const seen: PtyDataDetail[] = [];
-    adapter.onPtyData((detail) => void seen.push(detail));
-
-    // An image sequence: a second parse here would strip nothing but would
-    // answer the query below twice.
-    deliver("pty:data", {
-      id: "t1",
-      data: "pre\x1b]1337;File=inline=1:AAAA\x07post",
-      textData: "prepost",
-    });
-    deliver("pty:data", { id: "t1", data: "\x1b]11;?\x07" });
-
-    expect(seen).toEqual([
-      { id: "t1", data: "pre\x1b]1337;File=inline=1:AAAA\x07post", textData: "prepost" },
-      { id: "t1", data: "\x1b]11;?\x07", textData: undefined },
-    ]);
-    // No reply written back: the owner answered, or deliberately did not.
-    expect(invoke.mock.calls.filter(([cmd]) => cmd === "pty_write")).toEqual([]);
-  });
-
   it("applies the semantic and Tool events the sidecar derived, and no report", async () => {
     const { adapter, deliver, invoke } = await listening();
     const alerts: AlertStateDetail[] = [];
@@ -465,7 +422,7 @@ describe("TauriAdapter terminal stream", () => {
       ],
     });
     // A report reaching this window is inert: the sidecar's manager judged it.
-    deliver("terminal:protocolEvents", {
+    deliver("terminal:toolEvents", {
       id: "sem-pty",
       events: [
         { kind: "notification", notification: { source: "OSC 9", title: null, body: "done" } },
@@ -477,42 +434,6 @@ describe("TauriAdapter terminal stream", () => {
     expect(invoke).not.toHaveBeenCalled();
   });
 
-  it("renders the alert state the sidecar routes to this window", async () => {
-    const { adapter, deliver } = await listening();
-    const alerts: AlertStateDetail[] = [];
-    adapter.onAlertState((detail) => void alerts.push(detail));
-    const ringing = { id: "ring-pty", status: "ALERT_RINGING", watchingEnabled: false, todo: true, notification: null, awaited: false, episode: { id: "e1", startedAt: 1 } };
-    deliver("alert:state", ringing);
-    expect(alerts).toEqual([ringing]);
-  });
-
-  // The sidecar acknowledges it and opens the echo window before it writes, so
-  // the flag must ride the write itself — a separate command could lose the race.
-  it("writes user input with its acknowledgement in one message", async () => {
-    const { adapter, invoke } = await listening();
-    adapter.writePty("typed-pty", "\x1b[I");
-    adapter.writePty("typed-pty", "y", { userInput: true });
-    expect(invoke.mock.calls).toEqual([
-      ["pty_write", { id: "typed-pty", data: "\x1b[I", paced: undefined, userInput: undefined }],
-      ["pty_write", { id: "typed-pty", data: "y", paced: undefined, userInput: true }],
-    ]);
-  });
-
-  it("rebuilds pane state from a replay, and asks nothing of the alerts", async () => {
-    const { adapter, deliver, invoke } = await listening();
-    const alerts: AlertStateDetail[] = [];
-    adapter.onAlertState((detail) => void alerts.push(detail));
-
-    deliver("pty:replay", {
-      id: "replay-pty",
-      data: "\x1b]633;E;sleep 5\x07\x1b]633;C\x07\x1b]9;Historical\x07",
-    });
-
-    expect(getTerminalPaneState("replay-pty").currentCommand?.rawCommandLine).toBe("sleep 5");
-    expect(alerts).toEqual([]);
-    expect(invoke).not.toHaveBeenCalled();
-  });
-
   it("settles the replayed command when a marked buffer belongs to an exited PTY", async () => {
     const { deliver } = await listening();
     deliver("pty:list", { ptys: [{ id: "exited-replay", alive: false, exitCode: 7 }], requestId: "handback-1" });
@@ -522,96 +443,4 @@ describe("TauriAdapter terminal stream", () => {
     });
     expect(getTerminalPaneState("exited-replay").currentCommand).toBeNull();
   });
-
-  it("pushes the resolved theme so the sidecar can answer a colour query", async () => {
-    const { adapter, invoke } = await listening();
-    adapter.requestInit();
-
-    const pushed = invoke.mock.calls.filter(([cmd]) => cmd === "pty_theme_colors");
-    expect(pushed).toHaveLength(1);
-    expect(pushed[0]![1]).toEqual({
-      colors: {
-        foreground: expect.any(String),
-        background: expect.any(String),
-        cursor: expect.any(String),
-      },
-    });
-  });
-});
-
-// The app's one AlertManager is the sidecar's (docs/specs/standalone.md →
-// "Alerts"); this window is a viewer of it. The command shapes and the await
-// wiring are the shared client's (lib/src/host/alert-client.test.ts); covered
-// here is this transport: one `alert_command` invoke, and the events back.
-describe("TauriAdapter alerts", () => {
-  async function wired() {
-    const handlers = new Map<string, (event: { payload: unknown }) => void>();
-    const order: string[] = [];
-    vi.mocked(listen).mockImplementation((async (
-      event: string,
-      handler: (e: { payload: unknown }) => void,
-    ) => {
-      order.push(`listen ${event}`);
-      handlers.set(event, handler);
-      return () => {};
-    }) as unknown as typeof listen);
-    const invoke = vi.mocked(rawInvoke);
-    invoke.mockClear();
-    invoke.mockImplementation((async (cmd: string, args?: { payload?: { op?: string } }) => {
-      if (cmd === "alert_command") order.push(`alert ${args?.payload?.op}`);
-      return undefined;
-    }) as unknown as typeof rawInvoke);
-
-    const adapter = new TauriAdapter();
-    await adapter.init();
-    const commands = () =>
-      invoke.mock.calls.filter(([cmd]) => cmd === "alert_command").map(([, args]) => (args as { payload: unknown }).payload);
-    const deliver = (event: string, payload: unknown) => void handlers.get(event)?.({ payload });
-    return { adapter, commands, deliver, order };
-  }
-
-  // A reload keeps the window label, so only this tells the sidecar the old
-  // realm's engagement and parked awaits are gone — and only once this realm
-  // can hear the answers.
-  it("says hello once its listeners are installed", async () => {
-    const { commands, order } = await wired();
-    expect(commands()).toEqual([{ op: "hello" }]);
-    const hello = order.indexOf("alert hello");
-    for (const event of ["alert:state", "alert:awaitResult"]) {
-      expect(order.indexOf(`listen ${event}`)).toBeGreaterThanOrEqual(0);
-      expect(order.indexOf(`listen ${event}`)).toBeLessThan(hello);
-    }
-  });
-
-  it("sends its alert verbs as commands and resolves an await from the broadcast result", async () => {
-    const { adapter, commands, deliver } = await wired();
-    adapter.alertEngagement({ present: true, focusId: "p" });
-    adapter.alertSeed!("p", { status: "WATCHING_DISABLED", todo: true, notification: null });
-    const handle = adapter.alertAwait("p", { until: "exit", timeoutMs: 600_000 });
-    const sent = commands();
-    const parked = sent[sent.length - 1] as { op: string; awaitId: string };
-    expect(commands()).toEqual([
-      { op: "hello" },
-      { op: "engagement", state: { present: true, focusId: "p" } },
-      { op: "seed", id: "p", state: { status: "WATCHING_DISABLED", todo: true, notification: null } },
-      { op: "await", awaitId: parked.awaitId, id: "p", until: "exit", timeoutMs: 600_000 },
-    ]);
-    deliver("alert:awaitResult", { awaitId: parked.awaitId, window: "main", outcome: { kind: "resolved", cause: "exit", waitedMs: 4 } });
-    await expect(handle.promise).resolves.toEqual({ kind: "resolved", cause: "exit", waitedMs: 4 });
-  });
-
-  it("settles what it parked when it shuts down", async () => {
-    const { adapter } = await wired();
-    const handle = adapter.alertAwait("p", { until: "quiet", timeoutMs: 600_000 });
-    adapter.shutdown();
-    await expect(handle.promise).resolves.toMatchObject({ kind: "cancelled" });
-  });
-
-  it("hands the stores' broadcasts to the renderer mirrors", async () => {
-    const { adapter, deliver } = await wired();
-    const names: string[][] = [];
-    adapter.onWatchedCommands((next) => void names.push(next));
-    deliver("alert:watchedCommands", { names: ["cargo"] });
-    expect(names).toEqual([["cargo"]]);
-  });
 });
diff --git a/standalone/src/tauri-adapter.ts b/standalone/src/tauri-adapter.ts
index c95e1e26a..2ed17ef81 100644
--- a/standalone/src/tauri-adapter.ts
+++ b/standalone/src/tauri-adapter.ts
@@ -1,5 +1,5 @@
 import { recordToolEvents } from '../../lib/src/lib/tool-events';
-import type { HelperIdentity, TerminalContextRequest, TerminalContextInfo } from '../../lib/src/lib/terminal-context-types';
+import type { TerminalContextRequest, TerminalContextInfo } from '../../lib/src/lib/terminal-context-types';
 import { invoke as rawInvoke } from "@tauri-apps/api/core";
 import { open } from "@tauri-apps/plugin-shell";
 import { coalesceCwds } from "./coalesce-cwds";
@@ -24,6 +24,7 @@ import type {
   ToolControlResult,
   ToolHostRequest,
   SessionFlushRequest,
+  SpawnPtyOptions,
   WritePtyOptions,
 } from "dormouse-lib/lib/platform/types";
 import type {
@@ -45,8 +46,8 @@ import {
   type BurrowResult,
 } from "dormouse-lib/host/remote/service-protocol";
 import { embedderOrigins } from "dormouse-lib/lib/embedder-origins";
-import { createSidecarAlertClient } from "dormouse-lib/host/alert-client";
-import type { AlertCommand } from "dormouse-lib/host/alert-protocol";
+import { createAlertClient, type AlertClientMethods } from "dormouse-lib/host/alert-client";
+import { ALERT_EVENTS, type AlertCommand } from "dormouse-lib/host/alert-protocol";
 import { normalizeExternalUri } from "dormouse-lib/lib/external-links";
 import type { PersistedWindow } from "dormouse-lib/lib/session-types";
 import { TauriSessionStore } from "./tauri-session-store";
@@ -54,12 +55,9 @@ import { claimRecoveryCommands, windowStateSlot } from "./window-recovery";
 import { listenToWindow } from "./window-label";
 import { installWorkspaceRegistry, type WorkspaceRegistrySnapshot } from "./workspace-registry";
 import { withTimeout } from "./with-timeout";
-import {
-  collectTerminalSemanticEvents,
-  TerminalProtocolParser,
-  type TerminalProtocolEvent,
-} from "dormouse-lib/lib/terminal-protocol";
-import { getTerminalTheme, onTerminalThemeChange, themeColorProvider } from "dormouse-lib/lib/terminal-theme";
+import type { TerminalProtocolEvent } from "dormouse-lib/lib/terminal-protocol";
+import { getTerminalTheme, onTerminalThemeChange } from "dormouse-lib/lib/terminal-theme";
+import { parseReplay } from "dormouse-lib/lib/platform/replay-parse";
 import type { TerminalSemanticEvent } from "dormouse-lib/lib/terminal-state";
 import {
   applyTerminalSemanticEvents,
@@ -79,6 +77,9 @@ function invoke(cmd: string, args?: Record<string, unknown>): void {
 const errMessage = (err: unknown): string =>
   err instanceof Error ? err.message : String(err);
 
+/** The `alert*` platform methods, taken from the shared client in the constructor. */
+export interface TauriAdapter extends AlertClientMethods {}
+
 /**
  * Platform adapter for the Tauri standalone app.
  *
@@ -130,26 +131,12 @@ export class TauriAdapter implements PlatformAdapter {
   // The app's one AlertManager is the sidecar's; this window is one of its
   // viewers. Every `alert*` method is one `alert_command`, which Rust stamps
   // with this window's label, and the answers come back as sidecar events.
-  private readonly alerts = createSidecarAlertClient((payload: AlertCommand) => {
+  private readonly alerts = createAlertClient((payload: AlertCommand) => {
     invoke("alert_command", { payload });
   });
-  readonly alertRemove = this.alerts.alertRemove;
-  readonly alertSeed = this.alerts.alertSeed;
-  readonly alertSetWatchedCommands = this.alerts.alertSetWatchedCommands;
-  readonly alertSetCommandWatched = this.alerts.alertSetCommandWatched;
-  readonly alertPublishSettings = this.alerts.alertPublishSettings;
-  readonly alertDismiss = this.alerts.alertDismiss;
-  readonly alertEngagement = this.alerts.alertEngagement;
-  readonly alertAcknowledge = this.alerts.alertAcknowledge;
-  readonly alertResize = this.alerts.alertResize;
-  readonly alertToggleTodo = this.alerts.alertToggleTodo;
-  readonly alertClearTodo = this.alerts.alertClearTodo;
-  readonly alertAwait = this.alerts.alertAwait;
-  readonly onAlertState = this.alerts.onAlertState;
-  readonly onWatchedCommands = this.alerts.onWatchedCommands;
-  readonly onAlertSettings = this.alerts.onAlertSettings;
 
   constructor() {
+    Object.assign(this, this.alerts.methods);
     // The sidecar parses, and it has no DOM to read the theme from, so push the
     // resolved colors up whenever they change (the initial push is in
     // requestInit) — mirroring VSCodeAdapter.pushThemeColors.
@@ -175,7 +162,7 @@ export class TauriAdapter implements PlatformAdapter {
 
       // The Tool half of the sidecar's parse; its reports stayed with the
       // sidecar's AlertManager.
-      listenToWindow<{ id: string; events: TerminalProtocolEvent[] }>("terminal:protocolEvents", (event) => {
+      listenToWindow<{ id: string; events: TerminalProtocolEvent[] }>("terminal:toolEvents", (event) => {
         recordToolEvents(event.payload.id, event.payload.events);
       }),
 
@@ -201,21 +188,11 @@ export class TauriAdapter implements PlatformAdapter {
       }),
 
       listenToWindow<{ id: string; data: string; requestId?: string }>("pty:replay", (event) => {
-        // Replay arrives as raw buffered output, the one stream the sidecar does
-        // not parse for this window. A one-shot parser here repopulates the
-        // renderer's semantic and Tool state and strips OSCs before xterm sees
-        // them; its reports and responses are dropped — the sidecar's own parse
-        // already fed its AlertManager, and the asker is long gone
-        // (docs/specs/terminal-escapes.md). It still needs the theme: a
-        // *declined* colour query is not consumed, so it reaches xterm.js
-        // instead, and answering is the owner's alone. A replay is the whole of
-        // what a transferred pane's new window has: Rust drops the gap's
-        // semantic events rather than holding them (docs/specs/standalone.md →
-        // "Routing").
+        // A replay is the whole of what a transferred pane's new window has:
+        // Rust drops the gap's semantic and Tool events rather than holding
+        // them (docs/specs/standalone.md → "Routing").
         const { id, data, requestId } = event.payload;
-        const parsed = new TerminalProtocolParser(themeColorProvider).process(data);
-        recordToolEvents(id, parsed.events);
-        applyTerminalSemanticEvents(id, collectTerminalSemanticEvents(parsed.events));
+        const visibleData = parseReplay(id, data);
         // A listed exited buffer can contain a command-start with no finish.
         // Apply its exit after rebuilding the replay's command state, for
         // either target adoption or source hand-back.
@@ -226,7 +203,7 @@ export class TauriAdapter implements PlatformAdapter {
           applyTerminalSemanticEvents(id, [{ type: 'commandFinish', exitCode }]);
         }
         for (const handler of this.replayHandlers) {
-          handler({ id, data: parsed.visibleData, requestId });
+          handler({ id, data: visibleData, requestId });
         }
       }),
 
@@ -277,9 +254,8 @@ export class TauriAdapter implements PlatformAdapter {
       }),
 
       // The sidecar's alerts: this window's Sessions' state, routed here by
-      // ownership, and the two stores' canonical snapshots and every await's
-      // result, broadcast to every window.
-      ...["alert:state", "alert:awaitResult", "alert:watchedCommands", "alert:settings"].map((name) =>
+      // ownership, its awaits' results, and the two stores' snapshots.
+      ...ALERT_EVENTS.map((name) =>
         listenToWindow<unknown>(name, (event) => void this.alerts.onEvent(name, event.payload))),
     ])));
     // This realm is new, whether the window just opened or reloaded: the
@@ -342,7 +318,7 @@ export class TauriAdapter implements PlatformAdapter {
     return result;
   }
 
-  spawnPty(id: string, options?: { cols?: number; rows?: number; cwd?: string; shell?: string; args?: string[]; helper?: HelperIdentity }): void {
+  spawnPty(id: string, options?: SpawnPtyOptions): void {
     invoke("pty_spawn", { id, options });
   }
 
diff --git a/standalone/src/window-restore.test.ts b/standalone/src/window-restore.test.ts
index bbebef318..286ce7992 100644
--- a/standalone/src/window-restore.test.ts
+++ b/standalone/src/window-restore.test.ts
@@ -67,7 +67,6 @@ function fakePlatform(ptys: PtyInfo[], saved: PersistedWindow | null) {
     offPtyReplay: (handler: (detail: { id: string; data: string }) => void) => { replayHandlers.delete(handler); },
     spawnPty: vi.fn(),
     killPty: vi.fn(),
-    alertSeed: vi.fn(),
   } as unknown as PlatformAdapter;
   setPlatform(platform);
   return { platform, saves };
diff --git a/standalone/src/workspace-move.test.ts b/standalone/src/workspace-move.test.ts
index 90cc43751..ded60dbf6 100644
--- a/standalone/src/workspace-move.test.ts
+++ b/standalone/src/workspace-move.test.ts
@@ -177,9 +177,6 @@ function fakePlatform(
   vi.spyOn(platform, "requestInit").mockImplementation(() => {
     throw new Error("an arrival must never ask for the whole Window");
   });
-  // The optional seed hook standalone has, so a test can show an arrival
-  // never reaches for it.
-  (platform as unknown as { alertSeed: unknown }).alertSeed = vi.fn();
   mocks.invoke.mockImplementation(async (cmd: string, args?: unknown) => {
     order.push(cmd);
     const workspaceId = (args as { workspaceId?: string; payload?: { workspaceId?: string } } | undefined)?.workspaceId
@@ -644,19 +641,20 @@ describe("the target half", () => {
   });
 
   // The Sessions' alert state never left the sidecar's one manager, which
-  // re-sends it to whichever window collects them: an arrival that seeded or
-  // removed it would overwrite a live ring or TODO (docs/specs/alert.md →
-  // Live Workspace transfer).
-  it("never seeds or removes the host's alert state for an arrival", async () => {
+  // re-sends it to whichever window collects them. A spawn starts it over and a
+  // kill removes it, so an arrival that did either would overwrite a live ring
+  // or TODO (docs/specs/alert.md → Live Workspace transfer).
+  it("never spawns or kills over an arrival's live Sessions", async () => {
     const platform = fakePlatform();
-    const remove = vi.spyOn(platform, "alertRemove");
+    const spawn = vi.spyOn(platform, "spawnPty");
+    const kill = vi.spyOn(platform, "killPty");
     arrivals = [payload()];
     arrivals[0].workspace.session.panes[0].alert = { status: "WATCHING_DISABLED", todo: true, notification: null };
     initWorkspaceMoves(platform);
     await settle();
     expect(getWorkspaceBootPlan(WORKSPACE_ID)?.initialPaneIds).toEqual(["pane-a"]);
-    expect(platform.alertSeed).not.toHaveBeenCalled();
-    expect(remove).not.toHaveBeenCalled();
+    expect(spawn).not.toHaveBeenCalled();
+    expect(kill).not.toHaveBeenCalled();
   });
 
   it("resumes each of two simultaneous arrivals over its own PTYs", async () => {
@@ -742,12 +740,13 @@ describe("the target half", () => {
       const moving = payload();
       moving.workspace.session.panes.push({ ...moving.workspace.session.panes[0]!, id: "browser-1", surfaceType: "browser" });
       moving.allIds.push("browser-1");
-      const removeAlert = vi.spyOn(platform, "alertRemove");
+      const kill = vi.spyOn(platform, "killPty");
       arrivals = [moving];
       initWorkspaceMoves(platform);
       await vi.advanceTimersByTimeAsync(5000);
-      // The source still shows these Sessions: their alert entries are its.
-      expect(removeAlert).not.toHaveBeenCalled();
+      // The source still shows these Sessions: their processes and alert
+      // entries are its.
+      expect(kill).not.toHaveBeenCalled();
 
       expect(getWorkspacesSnapshot().workspaces.map((w) => w.name)).not.toContain("Deploys");
       expect(getWorkspaceBootPlan(WORKSPACE_ID)).toEqual({});
@@ -803,7 +802,7 @@ describe("the target half", () => {
         status: "ALERT_RINGING", todo: true, episode, notification: { source: "OSC 9", title: "Done", body: null },
       }),
     });
-    const removeAlert = vi.spyOn(platform, "alertRemove");
+    const kill = vi.spyOn(platform, "killPty");
     const host = mocks.invoke.getMockImplementation()!;
     mocks.invoke.mockImplementation(async (cmd: string, args?: unknown) => {
       if (cmd === "adopt_done") arrivals = [];
@@ -824,7 +823,7 @@ describe("the target half", () => {
       expect(isAlertDeliveryPaused("pane-a")).toBe(false);
       expect(getAlertDeliveryReceipts("speech").has("pane-a")).toBe(false);
       // The ring is the source's again, still live in the sidecar.
-      expect(removeAlert).not.toHaveBeenCalled();
+      expect(kill).not.toHaveBeenCalled();
       await settle();
       expect(fire).not.toHaveBeenCalled();
     } finally {
diff --git a/vscode-ext/src/extension.ts b/vscode-ext/src/extension.ts
index 3c308e28f..89a247df2 100644
--- a/vscode-ext/src/extension.ts
+++ b/vscode-ext/src/extension.ts
@@ -69,7 +69,6 @@ function setupPanel(
   const router = attachRouter(channel, {
     reconnect: !!savedState,
     killOnDispose: true,
-    savedSession,
     getSelectedShell,
     context,
     // Reflect this panel's Workspace union onto the editor-tab title
diff --git a/vscode-ext/src/message-router.ts b/vscode-ext/src/message-router.ts
index 8508521fe..bc21c3e1f 100644
--- a/vscode-ext/src/message-router.ts
+++ b/vscode-ext/src/message-router.ts
@@ -1,27 +1,18 @@
-import type { ToolAnnounce } from '../../lib/src/lib/tool-announce';
 import * as vscode from 'vscode';
 import * as ptyManager from './pty-manager';
-import { AlertManager, type AwaitHandle, type AwaitOutcome } from '../../lib/src/lib/alert-manager';
-import { WatchedCommandHost } from '../../lib/src/lib/watched-command-host';
-import { AlertSettingsHost } from '../../lib/src/lib/alert-settings-host';
-import {
-  applyTerminalEvents,
-  collectTerminalProtocolResponses,
-  type TerminalColorProvider,
-  type TerminalColors,
+import { createAlertHost, type AlertRealm } from '../../lib/src/host/alert-host';
+import { alertedPty, createOwnerPtyStream } from '../../lib/src/host/owner-pty';
+import type {
+  TerminalColorProvider,
+  TerminalColors,
+  TerminalProtocolEvent,
 } from '../../lib/src/lib/terminal-protocol';
-import { isProtocolCommandStart } from '../../lib/src/lib/tool-events';
-import {
-  createProcessedPtyStream,
-  type ProcessedPtyChunk,
-  type ProcessedPtyStream,
-} from '../../lib/src/lib/processed-pty-stream';
+import type { ProcessedPtyChunk, ProcessedPtyStream } from '../../lib/src/lib/processed-pty-stream';
 import { normalizeExternalUri } from '../../lib/src/lib/external-links';
 import { VSCODE_WORKBENCH_COMMANDS } from '../../lib/src/lib/vscode-keybindings';
 import { computeWorkspaceUnion, type WorkspaceUnion } from '../../lib/src/lib/workspace-union';
 import type { ActivityState } from '../../lib/src/lib/session-activity-store';
 import type { TerminalSemanticEvent } from '../../lib/src/lib/terminal-state';
-import type { PersistedSession } from '../../lib/src/lib/session-types';
 import type { WebviewMessage, ExtensionMessage } from './message-types';
 import type { DorControlRequest } from './pty-manager';
 import { dorWorkspaceRefusal } from './dor-workspace-guard';
@@ -122,20 +113,15 @@ configureBurrow({
 
 /**
  * A remote Client's keystrokes, reaching this window's PTY from its own Burrow
- * or over the peer link from the broker's: a human's input like a webview's,
- * so acknowledged before the write, echo window included (`docs/specs/alert.md`
- * → Engagement). The Burrow has already dropped a mirror's terminal replies.
+ * or over the peer link from the broker's: a human's input like a webview's.
+ * The Burrow has already dropped a mirror's terminal replies.
  */
 function writeClientInput(ptyId: string, data: string): void {
-  alertManager.acknowledge(ptyId, { input: true });
-  ptyManager.write(ptyId, data);
+  alertedPtys.write(ptyId, data, { userInput: true });
 }
 
-/** A Client's resize — the repaint bounce included — whose output is the
- *  resize's, never the program working. */
 function resizeForClient(ptyId: string, cols: number, rows: number, repaint?: boolean): void {
-  alertManager.onResize(ptyId);
-  ptyManager.resize(ptyId, cols, rows, repaint);
+  alertedPtys.resize(ptyId, cols, rows, repaint);
 }
 
 /**
@@ -200,11 +186,13 @@ let nextFlushRequestId = 0;
 let nextRouterId = 0;
 const ALLOWED_WORKBENCH_COMMANDS = new Set<string>(VSCODE_WORKBENCH_COMMANDS);
 
-// Shared alert manager — survives router disposal so alert state persists
-// across webview collapse/expand cycles.
-const alertManager = new AlertManager();
-const watchedCommandHost = new WatchedCommandHost(alertManager);
-const alertSettingsHost = new AlertSettingsHost(alertManager);
+// This window's alerts, in the host role standalone's sidecar runs too
+// (`lib/src/host/alert-host.ts`). They survive router disposal, so alert state
+// persists across webview collapse/expand cycles; each router is one realm.
+const alertHost = createAlertHost();
+const alertManager = alertHost.manager;
+/** Every PTY write and resize, as the alerts must see it. */
+const alertedPtys = alertedPty(alertManager, ptyManager);
 /**
  * This window's parse sites: one per PTY generation, created at spawn and fed
  * every chunk from there, so the extension host answers each query once and both
@@ -229,8 +217,7 @@ type ProcessedExitListener = (id: string, exitCode: number) => void;
 const processedExitListeners = new Set<ProcessedExitListener>();
 type SemanticEventsListener = (id: string, events: TerminalSemanticEvent[]) => void;
 const semanticEventsListeners = new Set<SemanticEventsListener>();
-const toolStateListeners = new Set<(id: string, dirty: boolean | null) => void>();
-const toolAnnounceListeners = new Set<(id: string, announce: ToolAnnounce | null) => void>();
+const toolEventsListeners = new Set<(id: string, events: TerminalProtocolEvent[]) => void>();
 
 export function onProcessedPtyData(listener: ProcessedDataListener): () => void {
   processedDataListeners.add(listener);
@@ -300,45 +287,17 @@ ptyManager.onDorControlCancel((cancel) => {
   broadcastToWebviews({ type: 'dor:controlCancel', requestId: cancel.requestId });
 });
 
-function createOwnerPtyStream(id: string): ProcessedPtyStream {
-  return createProcessedPtyStream({
-    colorProvider: themeColorProvider,
-    onEvents(events) {
-      // Reports and command boundaries in stream order, so a precmd
-      // notification is judged after the finish written before it; the
-      // webviews get the same timestamped semantic events.
-      const semanticEvents = applyTerminalEvents(alertManager, id, events);
-      // Tool announcements belong to renderer state this process cannot reach,
-      // so the router forwards them to the webviews. A start retires the
-      // previous command's announcement and state in the owning webview (null).
-      // Keep starts and reports in parse order, including one chunk.
-      for (const event of events) {
-        const start = isProtocolCommandStart(event);
-        if (event.kind === 'toolState' || start) {
-          for (const listener of toolStateListeners) listener(id, event.kind === 'toolState' ? event.state.dirty : null);
-        }
-        if (event.kind === 'toolAnnounce' || start) {
-          for (const listener of toolAnnounceListeners) listener(id, event.kind === 'toolAnnounce' ? event.announce : null);
-        }
-      }
-      if (semanticEvents.length > 0) {
-        for (const listener of semanticEventsListeners) listener(id, semanticEvents);
-      }
-      for (const response of collectTerminalProtocolResponses(events)) {
-        ptyManager.write(id, response);
-      }
-    },
-    onChunk(chunk) {
-      alertManager.onData(id);
-      for (const listener of processedDataListeners) listener(id, chunk.data, chunk.textData);
-    },
-  });
-}
-
 function getOwnerPtyStream(id: string): ProcessedPtyStream {
   let stream = ownerPtyStreams.get(id);
   if (!stream) {
-    stream = createOwnerPtyStream(id);
+    stream = createOwnerPtyStream(id, {
+      alerts: alertManager,
+      colorProvider: themeColorProvider,
+      onToolEvents: (events) => { for (const listener of toolEventsListeners) listener(id, events); },
+      onSemanticEvents: (events) => { for (const listener of semanticEventsListeners) listener(id, events); },
+      writeResponse: (response) => ptyManager.write(id, response),
+      onChunk: (chunk) => { for (const listener of processedDataListeners) listener(id, chunk.data, chunk.textData); },
+    });
     ownerPtyStreams.set(id, stream);
   }
   return stream;
@@ -381,7 +340,6 @@ export function attachRouter(
     reconnect?: boolean;
     killOnDispose?: boolean;
     onSaveState?: (state: unknown) => void | PromiseLike<void>;
-    savedSession?: PersistedSession | null;
     getSelectedShell?: () => { shell?: string; args?: string[] } | null;
     // Called with this webview's Workspace union status whenever it changes
     // (owned-PTY alert state, or a PTY claimed/released). The host reflects it
@@ -395,8 +353,8 @@ export function attachRouter(
 ): vscode.Disposable {
   const reconnect = options?.reconnect ?? false;
   const killOnDispose = options?.killOnDispose ?? false;
-  // Also this webview's engagement viewer, so one webview's blur never touches
-  // another's (docs/specs/alert.md → Engagement).
+  // Also this webview's realm of the alerts, so one webview's blur never
+  // touches another's (docs/specs/alert.md → Engagement).
   const routerId = `router-${++nextRouterId}`;
 
   // The router's only send path — it stamps this webview's message token, which
@@ -408,26 +366,25 @@ export function attachRouter(
   const ownedPtyIds = new Set<string>();
   const pendingFlushRequests = new Map<string, { resolve: () => void; timeout: ReturnType<typeof setTimeout> }>();
   let pendingSave = Promise.resolve();
-  // `dor await`s this webview has parked in the shared alert manager, keyed by
-  // the requestId that will carry the outcome back.
-  const pendingAwaits = new Map<string, { handle: AwaitHandle; startedAt: number }>();
   let disposed = false;
 
   // Webview-facing subscriptions — only active when the webview has live content.
   // Subscribed on dormouse:init, unsubscribed when webview content is gone.
   let disconnectWebview: (() => void) | null = null;
-  const removeWatchedCommandListener = watchedCommandHost.subscribe((names) => {
-    void post({
-      type: 'alert:watchedCommands',
-      names,
-    } satisfies ExtensionMessage);
+  const removeWatchedCommandListener = alertHost.watched.subscribe((names) => {
+    void post({ type: 'alert:watchedCommands', names } satisfies ExtensionMessage);
   });
-  const removeAlertSettingsListener = alertSettingsHost.subscribe((settings) => {
-    void post({
-      type: 'alert:settings',
-      settings,
-    } satisfies ExtensionMessage);
+  const removeAlertSettingsListener = alertHost.settings.subscribe((settings) => {
+    void post({ type: 'alert:settings', settings } satisfies ExtensionMessage);
   });
+  /** Where the alerts answer this webview. Posted even while it is being
+   *  disposed: a realm's end answers what it parked synchronously. */
+  const realm: AlertRealm = {
+    answer: (result) => void post({ type: 'alert:awaitResult', ...result } satisfies ExtensionMessage),
+    resendStates: () => {
+      for (const id of ownedPtyIds) post({ type: 'alert:state', id, ...alertManager.getState(id) } satisfies ExtensionMessage);
+    },
+  };
 
   function claim(id: string): void {
     ownedPtyIds.add(id);
@@ -466,35 +423,6 @@ export function attachRouter(
     }
   }
 
-  // A webview that went away cannot deliver an outcome, and an await that
-  // delivers nothing must not hold a completion claim open.
-  //
-  // The result is posted from here rather than left to `handle.promise`: that
-  // callback runs a microtask later, by which time `disposed` suppresses it, and
-  // the contract is exactly one `alert:awaitResult` per request (a cancel
-  // included — `docs/specs/alert.md` -> Await). Deleting the entry first makes
-  // the later callback a no-op, so the answer is still sent exactly once.
-  function cancelAllPendingAwaits(): void {
-    for (const [requestId, { handle, startedAt }] of [...pendingAwaits]) {
-      pendingAwaits.delete(requestId);
-      handle.cancel();
-      const outcome: AwaitOutcome = { kind: 'cancelled', waitedMs: Date.now() - startedAt };
-      try {
-        void post({ type: 'alert:awaitResult', requestId, outcome } satisfies ExtensionMessage);
-      } catch {
-        // The usual reason to be here is the webview being torn down, which can
-        // make `postMessage` throw. Nothing left to tell — keep cancelling.
-      }
-    }
-  }
-
-  /** This webview's content is gone — disposed, or destroyed and recreated:
-   *  its engagement and the awaits it parked go with it (docs/specs/vscode.md). */
-  function endRealm(): void {
-    cancelAllPendingAwaits();
-    alertManager.removeViewer(routerId);
-  }
-
   function flushSessionSave(timeoutMs = 1000): Promise<void> {
     if (disposed || !disconnectWebview) return Promise.resolve();
 
@@ -582,14 +510,10 @@ export function attachRouter(
       if (!ownedPtyIds.has(id)) return;
       post({ type: 'pty:data', id, data: visibleData, textData } satisfies ExtensionMessage);
     });
-    const onToolAnnounce = (id: string, announce: ToolAnnounce | null) => {
-      if (ownedPtyIds.has(id)) post({ type: 'terminal:toolAnnounce', id, announce } satisfies ExtensionMessage);
-    };
-    toolAnnounceListeners.add(onToolAnnounce);
-    const onToolState = (id: string, dirty: boolean | null) => {
-      if (ownedPtyIds.has(id)) post({ type: 'terminal:toolState', id, dirty } satisfies ExtensionMessage);
+    const onToolEvents = (id: string, events: TerminalProtocolEvent[]) => {
+      if (ownedPtyIds.has(id)) post({ type: 'terminal:toolEvents', id, events } satisfies ExtensionMessage);
     };
-    toolStateListeners.add(onToolState);
+    toolEventsListeners.add(onToolEvents);
     const removeSemanticListener = onTerminalSemanticEvents((id, events) => {
       if (!ownedPtyIds.has(id)) return;
       post({ type: 'terminal:semanticEvents', id, events } satisfies ExtensionMessage);
@@ -608,8 +532,7 @@ export function attachRouter(
     return () => {
       removeProcessedListener();
       removeSemanticListener();
-      toolAnnounceListeners.delete(onToolAnnounce);
-      toolStateListeners.delete(onToolState);
+      toolEventsListeners.delete(onToolEvents);
       removeExitListener();
       removeAlertListener();
     };
@@ -634,12 +557,16 @@ export function attachRouter(
           post({ type: 'pty:exit', id: msg.id, exitCode: 1 });
           break;
         }
-        if (msg.options?.helper) alertManager.setHelper(msg.id, true);
+        const { alert, ...spawnOptions } = msg.options ?? {};
+        // Claimed first, so the state a cold restore's persisted TODO seeds
+        // reaches this webview.
         claim(msg.id);
-        // A fresh generation under this id: retire the parser rather than let
-        // its half-read sequence splice onto the new PTY's first bytes.
+        // A fresh generation under this id: its alert state starts over, and
+        // the parser is retired rather than let its half-read sequence splice
+        // onto the new PTY's first bytes.
+        alertHost.respawn(msg.id, alert);
+        if (msg.options?.helper) alertManager.setHelper(msg.id, true);
         ownerPtyStreams.delete(msg.id);
-        const spawnOptions = { ...msg.options };
         if (!spawnOptions.cwd) {
           spawnOptions.cwd = vscode.workspace.workspaceFolders?.[0]?.uri.fsPath;
         }
@@ -647,16 +574,15 @@ export function attachRouter(
         break;
       }
       case 'pty:input':
-        // Acknowledged before the write, so the echo window is open before any
-        // echo can arrive (docs/specs/alert.md → Engagement).
-        if (msg.userInput === true) alertManager.acknowledge(msg.id, { input: true });
-        ptyManager.write(msg.id, msg.data, { paced: msg.paced });
+        alertedPtys.write(msg.id, msg.data, { paced: msg.paced, userInput: msg.userInput === true });
         break;
       case 'pty:resize':
-        ptyManager.resize(msg.id, msg.cols, msg.rows);
+        alertedPtys.resize(msg.id, msg.cols, msg.rows);
         break;
       case 'pty:kill':
         release(msg.id);
+        // The Session is over: its alert state goes, as a closing panel's does.
+        alertManager.remove(msg.id);
         ownerPtyStreams.delete(msg.id);
         ptyManager.kill(msg.id);
         break;
@@ -877,7 +803,7 @@ export function attachRouter(
         disconnectWebview?.();
         disconnectWebview = connectWebview();
         // Recreated content is a new realm.
-        endRealm();
+        alertHost.endRealm(routerId);
 
         // Re-publish the currently-selected shell so split-spawns in the
         // freshly-mounted webview know what to use.
@@ -919,23 +845,6 @@ export function attachRouter(
           }
         }
 
-        // Cold-start restore: this router has no live PTYs to reconnect,
-        // but has a saved session. Seed the AlertManager so freshly-spawned
-        // PTYs get the right alert state. Check reconnectable (not ptys)
-        // because other routers may own PTYs in the global pool.
-        if (reconnectable.size === 0 && options?.savedSession) {
-          for (const pane of options.savedSession.panes) {
-            if (pane.surfaceType === 'browser') continue;
-            if (!globalOwnedPtyIds.has(pane.id)) {
-              claim(pane.id);
-            }
-            if (pane.alert) {
-              ownerPtyStreams.delete(pane.id);
-              alertManager.seed(pane.id, pane.alert);
-            }
-          }
-        }
-
         const list: ExtensionMessage = {
           type: 'pty:list',
           ptys: Array.from(reconnectable.entries()).map(([id, info]) => ({
@@ -984,65 +893,8 @@ export function attachRouter(
         });
         break;
 
-      // Alert actions — proxy to the shared alert manager
-      case 'alert:remove':
-        alertManager.remove(msg.id);
-        break;
-      case 'alert:initializeWatchedCommands':
-        watchedCommandHost.initialize(msg.names);
-        break;
-      case 'alert:setCommandWatched':
-        watchedCommandHost.setCommandWatched(msg.name, msg.watched);
-        break;
-      // The host revalidates and clamps: a webview must never be able to install
-      // a NaN or absurd timer (`docs/specs/transport.md`).
-      case 'alert:initializeSettings':
-        alertSettingsHost.initialize(msg.settings);
-        break;
-      case 'alert:updateSettings':
-        alertSettingsHost.update(msg.settings);
-        break;
-      case 'alert:dismiss':
-        alertManager.dismissAlert(msg.id);
-        break;
-      case 'alert:engagement':
-        // `setViewer` revalidates the shape: only a literal `idle` escalates.
-        alertManager.setViewer(routerId, msg.state, msg.lapse);
-        break;
-      case 'alert:acknowledge':
-        alertManager.acknowledge(msg.id, { input: false });
-        break;
-      case 'alert:resize':
-        alertManager.onResize(msg.id);
-        break;
-      case 'alert:toggleTodo':
-        alertManager.toggleTodo(msg.id);
-        break;
-      case 'alert:clearTodo':
-        alertManager.clearTodo(msg.id);
-        break;
-      // The wait itself is parked host-side (`docs/specs/alert.md` → Await), so
-      // only the outcome crosses back. `timeoutMs` is revalidated by
-      // `awaitCompletion`, which rejects nonsense rather than installing it.
-      case 'alert:await': {
-        const handle = alertManager.awaitCompletion(msg.id, {
-          until: msg.until,
-          timeoutMs: msg.timeoutMs,
-        });
-        const requestId = msg.requestId;
-        pendingAwaits.set(requestId, { handle, startedAt: Date.now() });
-        void handle.promise.then((outcome) => {
-          // Gone from the map means `cancelAllPendingAwaits` already answered
-          // this request synchronously; anything else is the ordinary path.
-          if (!pendingAwaits.delete(requestId)) return;
-          void post({ type: 'alert:awaitResult', requestId, outcome } satisfies ExtensionMessage);
-        });
-        break;
-      }
-      case 'alert:awaitCancel':
-        // The cancelled outcome comes back through `alert:awaitResult` like any
-        // other, so there is nothing to answer here.
-        pendingAwaits.get(msg.requestId)?.handle.cancel();
+      case 'alert:command':
+        alertHost.handle(routerId, msg.command, realm);
         break;
     }
   });
@@ -1072,7 +924,7 @@ export function attachRouter(
         if (!request.pending.delete(router)) continue;
         if (request.pending.size === 0) request.settle();
       }
-      endRealm();
+      alertHost.endRealm(routerId);
       removeWatchedCommandListener();
       removeAlertSettingsListener();
       resolveAllFlushRequests();
@@ -1126,7 +978,7 @@ export function attachRouter(
             try { ptyManager.kill(id); }
             finally {
               globalOwnedPtyIds.delete(id);
-              // Its webview, which would have sent `alert:remove`, is gone.
+              // A killed Session's alert state goes, as on `pty:kill`.
               alertManager.remove(id);
             }
           }
diff --git a/vscode-ext/src/message-types.ts b/vscode-ext/src/message-types.ts
index 70d8d77ad..d8e67586d 100644
--- a/vscode-ext/src/message-types.ts
+++ b/vscode-ext/src/message-types.ts
@@ -1,16 +1,10 @@
-import type { ToolAnnounce } from '../../lib/src/lib/tool-announce';
 import type { HelperIdentity, TerminalContextRequest, TerminalContextInfo } from '../../lib/src/lib/terminal-context-types';
-import type {
-  AwaitOutcome,
-  AwaitUntil,
-  Engagement,
-  EngagementLapse,
-} from '../../lib/src/lib/alert-manager';
-import type { AlertSettings } from '../../lib/src/lib/alert-settings';
 import type { TerminalSemanticEvent } from '../../lib/src/lib/terminal-state';
-import type { TerminalColors } from '../../lib/src/lib/terminal-protocol';
+import type { TerminalColors, TerminalProtocolEvent } from '../../lib/src/lib/terminal-protocol';
+import type { AlertCommand, AlertEvents } from '../../lib/src/host/alert-protocol';
+import type { PersistedAlertState } from '../../lib/src/lib/session-types';
 import type { DorControlCancelPayload, DorControlRequestPayload, DorControlResponsePayload } from '../../dor/src/protocol';
-import type { AgentBrowserStreamStatusResult, AlertStateDetail, IframeProxyResult, OpenPort, ToolControlResult, ToolHostRequest } from '../../lib/src/lib/platform/types';
+import type { AgentBrowserStreamStatusResult, IframeProxyResult, OpenPort, ToolControlResult, ToolHostRequest } from '../../lib/src/lib/platform/types';
 import type { VSCodeWorkbenchCommand } from '../../lib/src/lib/vscode-keybindings';
 import type { BurrowCommand, BurrowResult } from '../../lib/src/host/remote/service-protocol';
 import type { VolatileNotepadSnapshot } from '../../lib/src/lib/notepad/types';
@@ -18,7 +12,7 @@ import type { VolatileNotepadSnapshot } from '../../lib/src/lib/notepad/types';
 // Messages from webview → extension host
 export type WebviewMessage =
   | { type: 'pty:context'; request: TerminalContextRequest; requestId: string }
-  | { type: 'pty:spawn'; id: string; options?: { cols?: number; rows?: number; cwd?: string; shell?: string; args?: string[]; helper?: HelperIdentity } }
+  | { type: 'pty:spawn'; id: string; options?: { cols?: number; rows?: number; cwd?: string; shell?: string; args?: string[]; helper?: HelperIdentity; alert?: PersistedAlertState } }
   | { type: 'pty:input'; id: string; data: string; paced?: boolean; userInput?: true }
   | { type: 'pty:resize'; id: string; cols: number; rows: number }
   | { type: 'pty:kill'; id: string }
@@ -62,23 +56,8 @@ export type WebviewMessage =
   | { type: 'dormouse:saveState'; state: unknown }
   | { type: 'dormouse:flushSessionSaveDone'; requestId: string }
   | ({ type: 'dor:controlResponse' } & DorControlResponsePayload)
-  // Alert actions
-  | { type: 'alert:remove'; id: string }
-  | { type: 'alert:initializeWatchedCommands'; names: string[] }
-  | { type: 'alert:setCommandWatched'; name: string; watched: boolean }
-  | { type: 'alert:initializeSettings'; settings: AlertSettings }
-  | { type: 'alert:updateSettings'; settings: AlertSettings }
-  | { type: 'alert:dismiss'; id: string }
-  // This webview is one engagement viewer (docs/specs/alert.md → Engagement).
-  | { type: 'alert:engagement'; state: Engagement; lapse?: EngagementLapse }
-  | { type: 'alert:acknowledge'; id: string }
-  | { type: 'alert:resize'; id: string }
-  | { type: 'alert:toggleTodo'; id: string }
-  | { type: 'alert:clearTodo'; id: string }
-  // `dor await`: the AlertManager lives here, so the wait is parked in the
-  // extension host and only its outcome crosses back (docs/specs/alert.md → Await).
-  | { type: 'alert:await'; requestId: string; id: string; until: AwaitUntil; timeoutMs: number }
-  | { type: 'alert:awaitCancel'; requestId: string };
+  // Every alert verb, in the wire both hosts share (`lib/src/host/alert-protocol.ts`).
+  | { type: 'alert:command'; command: AlertCommand };
 
 export interface PtyInfo {
   helper?: HelperIdentity;
@@ -96,8 +75,8 @@ export type ExtensionMessage =
   // so this never doubles the bytes on the wire (docs/specs/transport.md).
   | { type: 'pty:data'; id: string; data: string; textData?: string }
   | { type: 'pty:exit'; id: string; exitCode: number }
-  | { type: 'terminal:toolAnnounce'; id: string; announce: ToolAnnounce | null }
-  | { type: 'terminal:toolState'; id: string; dirty: boolean | null }
+  // A parse's Tool announcements, state and command-start resets, in stream order.
+  | { type: 'terminal:toolEvents'; id: string; events: TerminalProtocolEvent[] }
   | { type: 'terminal:semanticEvents'; id: string; events: TerminalSemanticEvent[] }
   | { type: 'pty:list'; ptys: PtyInfo[] }
   | { type: 'pty:replay'; id: string; data: string }
@@ -137,9 +116,5 @@ export type ExtensionMessage =
   | { type: 'dormouse:flushSessionSave'; requestId: string }
   | ({ type: 'dor:controlRequest' } & DorControlRequestPayload)
   | ({ type: 'dor:controlCancel' } & DorControlCancelPayload)
-  // Alert state updates. The whole `AlertState` crosses as one piece, so a new
-  // alert field needs no edit here — the other three adapters already spread it.
-  | ({ type: 'alert:state' } & AlertStateDetail)
-  | { type: 'alert:awaitResult'; requestId: string; outcome: AwaitOutcome }
-  | { type: 'alert:watchedCommands'; names: string[] }
-  | { type: 'alert:settings'; settings: AlertSettings };
+  // The alerts' events, named and shaped as in every host.
+  | { [Event in keyof AlertEvents]: { type: Event } & AlertEvents[Event] }[keyof AlertEvents];
diff --git a/vscode-ext/src/webview-view-provider.ts b/vscode-ext/src/webview-view-provider.ts
index 01f78a7f3..de1e4d069 100644
--- a/vscode-ext/src/webview-view-provider.ts
+++ b/vscode-ext/src/webview-view-provider.ts
@@ -95,7 +95,6 @@ export class DormouseViewProvider implements vscode.WebviewViewProvider {
     this.routerDisposable?.dispose();
     this.routerDisposable = attachRouter(this.channel, {
       reconnect: true,
-      savedSession,
       context: this.context,
       onSaveState: (state) => {
         return saveSessionState(this.context, mergeAlertStates(state, getAlertStates()));
diff --git a/vscode-ext/test/message-router.test.ts b/vscode-ext/test/message-router.test.ts
index dc93b23cc..22a087006 100644
--- a/vscode-ext/test/message-router.test.ts
+++ b/vscode-ext/test/message-router.test.ts
@@ -14,6 +14,7 @@ import { ARCHIVE_FILE } from '../src/notepad-archive-file';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
 import type { ExtensionMessage, WebviewMessage } from '../src/message-types';
+import type { AlertCommand } from '../../lib/src/host/alert-protocol';
 import type { PeerLinkDeps } from '../src/peer-link';
 import type { BurrowDeps } from '../src/burrow';
 import type { WebviewChannel } from '../src/webview-messaging';
@@ -41,7 +42,7 @@ const ptys = vi.hoisted(() => ({
   cwdAsked: [] as string[],
   cwdWait: null as Promise<void> | null,
   buffered: new Map<string, { alive: boolean }>(),
-  /** `'write'` and `'kill <id>'`, in the order they happened. */
+  /** `'write'`, `'kill <id>'` and `'resize <id>'`, in the order they happened. */
   order: [] as string[],
   /** Called on each PTY write, as the pty host receives it. */
   onWrite: null as ((id: string, data: string) => void) | null,
@@ -65,6 +66,7 @@ vi.mock('../src/pty-manager', async (importOriginal) => ({
     ptys.buffered.delete(id);
   },
   write: (id: string, data: string) => ptys.onWrite?.(id, data),
+  resize: (id: string) => void ptys.order.push(`resize ${id}`),
 }));
 
 vi.mock('../src/burrow', () => ({
@@ -115,6 +117,11 @@ function fakeWebview() {
 let router: RouterModule;
 let mirror: MirrorModule;
 
+/** One alert verb, as every adapter's shared client sends it. */
+function alert(webview: ReturnType<typeof fakeWebview>, command: AlertCommand): void {
+  webview.send({ type: 'alert:command', command });
+}
+
 beforeEach(async () => {
   vi.resetModules();
   wiring.peer = null;
@@ -145,22 +152,9 @@ it('reports rejected helper creation as an exited terminal', () => {
   } finally { disposable.dispose(); }
 });
 
-it('forwards dirty reports and command resets in order only to the PTY owner', () => {
-  const owner = fakeWebview();
-  const other = fakeWebview();
-  const first = router.attachRouter(owner.channel, {});
-  const second = router.attachRouter(other.channel, {});
-  try {
-    owner.send({ type: 'dormouse:init' });
-    other.send({ type: 'dormouse:init' });
-    owner.send({ type: 'pty:spawn', id: 'dirty-owner', options: { cwd: '/repo' } });
-    ptys.callbacks!.onData('dirty-owner', '\x1b]367;state;{"v":1,"dirty":true}\x07\x1b]633;C\x07\x1b]367;state;{"v":1,"dirty":false}\x07\x1b]367;serve;{"port":6006}\x07\x1b]633;D;0\x07');
-    expect(owner.posted.filter(message => message.type === 'terminal:toolState').map(message => message.dirty)).toEqual([true, null, false]);
-    expect(other.posted.filter(message => message.type === 'terminal:toolState')).toEqual([]);
-  } finally { first.dispose(); second.dispose(); }
-});
-
-it('forwards command-start resets and Tool announcements in stream order only to the owning webview', () => {
+// The Tool stores are the owning renderer's, so a parse's announcements, state
+// reports and command-start resets reach it, in stream order (docs/specs/dor-tool.md).
+it('forwards a parse\'s Tool events in stream order only to the PTY owner', () => {
   const owner = fakeWebview();
   const other = fakeWebview();
   const first = router.attachRouter(owner.channel, {});
@@ -169,10 +163,17 @@ it('forwards command-start resets and Tool announcements in stream order only to
     owner.send({ type: 'dormouse:init' });
     other.send({ type: 'dormouse:init' });
     owner.send({ type: 'pty:spawn', id: 'tool-epoch', options: { cwd: '/repo' } });
-    ptys.callbacks!.onData('tool-epoch', '\x1b]367;serve;{"port":6006}\x07\x1b]633;C\x07\x1b]367;serve;{"port":6007}\x07');
-    const announcements = owner.posted.filter(message => message.type === 'terminal:toolAnnounce');
-    expect(announcements.map(message => message.announce?.port ?? null)).toEqual([6006, null, 6007]);
-    expect(other.posted.filter(message => message.type === 'terminal:toolAnnounce')).toEqual([]);
+    ptys.callbacks!.onData('tool-epoch', '\x1b]367;state;{"v":1,"dirty":true}\x07\x1b]633;C\x07\x1b]367;serve;{"port":6007}\x07\x1b]633;D;0\x07');
+    expect(owner.posted.filter(message => message.type === 'terminal:toolEvents')).toEqual([{
+      type: 'terminal:toolEvents',
+      id: 'tool-epoch',
+      events: [
+        { kind: 'toolState', state: { dirty: true } },
+        { kind: 'semantic', event: { type: 'commandStart', source: 'osc633_boundaries' } },
+        { kind: 'toolAnnounce', announce: { port: 6007, name: null, key: null, dehydrate: false, persist: null } },
+      ],
+    }]);
+    expect(other.posted.filter(message => message.type === 'terminal:toolEvents')).toEqual([]);
   } finally {
     first.dispose();
     second.dispose();
@@ -530,59 +531,33 @@ describe('notepad archive requests', () => {
 });
 
 /**
- * `dor await` parks in the shared alert manager, which lives here rather than in
- * the webview (docs/specs/alert.md → Await). What this side owns is the
- * requestId bookkeeping: one outcome message per request, and nothing left
- * holding a completion claim when the webview goes away.
+ * `dor await` parks in the shared alert host, which lives here rather than in
+ * the webview (docs/specs/alert.md → Await); its own suite covers the
+ * bookkeeping. What this side owns is the wiring: the outcome reaches the
+ * webview that asked, and nothing is left holding a completion claim when that
+ * webview goes away.
  */
 describe('await requests', () => {
   /** Every await outcome this webview was sent, in order. */
   function outcomes(webview: ReturnType<typeof fakeWebview>) {
     return webview.posted
       .filter((message) => message.type === 'alert:awaitResult')
-      .map((message) => message as { requestId: string; outcome: unknown });
+      .map((message) => message as { awaitId: string; outcome: unknown });
   }
 
-  it('answers a cancelled await once, with the host outcome', async () => {
-    const webview = fakeWebview();
-    const disposable = router.attachRouter(webview.channel);
-    try {
-      webview.send({ type: 'alert:await', requestId: 'await-1', id: 'pty-1', until: 'quiet', timeoutMs: 600_000 });
-      expect(outcomes(webview)).toEqual([]);
-
-      webview.send({ type: 'alert:awaitCancel', requestId: 'await-1' });
-      await Promise.resolve();
-
-      // Real timers here, so `waitedMs` is whatever the clock says; the
-      // measurement itself is the alert manager's own test.
-      expect(outcomes(webview)).toHaveLength(1);
-      expect(outcomes(webview)[0]).toMatchObject({
-        requestId: 'await-1',
-        outcome: { kind: 'cancelled' },
-      });
-
-      // The request is gone, so a repeat cancel finds nothing to answer twice.
-      webview.send({ type: 'alert:awaitCancel', requestId: 'await-1' });
-      await Promise.resolve();
-      expect(outcomes(webview)).toHaveLength(1);
-    } finally {
-      disposable.dispose();
-    }
-  });
-
   it('judges a report after the command boundary written before it', async () => {
     const webview = fakeWebview();
     const disposable = router.attachRouter(webview.channel);
     try {
       ptys.callbacks!.onData('pty-ordered', '\x1b]633;E;./build.sh\x07\x1b]633;C\x07');
-      webview.send({ type: 'alert:await', requestId: 'await-ordered', id: 'pty-ordered', until: 'quiet', timeoutMs: 600_000 });
+      alert(webview, { op: 'await', awaitId: 'await-ordered', id: 'pty-ordered', until: 'quiet', timeoutMs: 600_000 });
 
       // A precmd hook reports after the shell's finish, in the same read.
       ptys.callbacks!.onData('pty-ordered', '\x1b]633;D;0\x07\x1b]777;notify;Command completed;./build.sh\x1b\\');
       await Promise.resolve();
 
       expect(outcomes(webview)).toEqual([
-        { type: 'alert:awaitResult', requestId: 'await-ordered', outcome: expect.objectContaining({ kind: 'resolved', cause: 'exit' }) },
+        { type: 'alert:awaitResult', awaitId: 'await-ordered', outcome: expect.objectContaining({ kind: 'resolved', cause: 'exit' }) },
       ]);
     } finally {
       disposable.dispose();
@@ -592,7 +567,7 @@ describe('await requests', () => {
   it('cancels what is still parked when the webview goes away', async () => {
     const webview = fakeWebview();
     const disposable = router.attachRouter(webview.channel);
-    webview.send({ type: 'alert:await', requestId: 'await-2', id: 'pty-2', until: 'exit', timeoutMs: 600_000 });
+    alert(webview, { op: 'await', awaitId: 'await-2', id: 'pty-2', until: 'exit', timeoutMs: 600_000 });
     expect(router.getAlertStates().get('pty-2')?.awaited).toBe(true);
 
     // A webview that cannot deliver an outcome must not hold a claim open, so
@@ -606,7 +581,7 @@ describe('await requests', () => {
   it('still answers an await it cancels on the way out', async () => {
     const webview = fakeWebview();
     const disposable = router.attachRouter(webview.channel);
-    webview.send({ type: 'alert:await', requestId: 'await-3', id: 'pty-3', until: 'quiet', timeoutMs: 600_000 });
+    alert(webview, { op: 'await', awaitId: 'await-3', id: 'pty-3', until: 'quiet', timeoutMs: 600_000 });
 
     // `handle.cancel()`'s outcome lands a microtask later, after the router has
     // stopped posting — so dispose answers synchronously instead. Without that
@@ -617,7 +592,7 @@ describe('await requests', () => {
 
     expect(outcomes(webview)).toHaveLength(1);
     expect(outcomes(webview)[0]).toMatchObject({
-      requestId: 'await-3',
+      awaitId: 'await-3',
       outcome: { kind: 'cancelled' },
     });
   });
@@ -641,9 +616,9 @@ describe('engagement viewers', () => {
     const disposeA = router.attachRouter(a.channel);
     const disposeB = router.attachRouter(b.channel);
     try {
-      a.send({ type: 'alert:engagement', state: { present: true, focusId: 'pty-a' } });
-      b.send({ type: 'alert:engagement', state: { present: true, focusId: 'pty-b' } });
-      a.send({ type: 'alert:engagement', state: { present: false, focusId: null }, lapse: 'leave' });
+      alert(a, { op: 'engagement', state: { present: true, focusId: 'pty-a' } });
+      alert(b, { op: 'engagement', state: { present: true, focusId: 'pty-b' } });
+      alert(a, { op: 'engagement', state: { present: false, focusId: null }, lapse: 'leave' });
 
       ptys.callbacks!.onData('pty-b', REPORT);
       expect(status('pty-b')).not.toBe('ALERT_RINGING');
@@ -659,7 +634,7 @@ describe('engagement viewers', () => {
     try {
       ptys.callbacks!.onData('pty-ack', REPORT);
       expect(status('pty-ack')).toBe('ALERT_RINGING');
-      webview.send({ type: 'alert:acknowledge', id: 'pty-ack' });
+      alert(webview, { op: 'acknowledge', id: 'pty-ack' });
       expect(router.getAlertStates().get('pty-ack')).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
     } finally {
       disposable.dispose();
@@ -677,10 +652,6 @@ describe('engagement viewers', () => {
       webview.send({ type: 'pty:input', id: 'pty-typed', data: 'y', userInput: true });
       expect(atWrite).toEqual(['ALERT_RINGING', 'WATCHING_DISABLED']);
       expect(router.getAlertStates().get('pty-typed')?.todo).toBe(false);
-
-      // A bell answering the key rings no one.
-      ptys.callbacks!.onData('pty-typed', REPORT);
-      expect(status('pty-typed')).not.toBe('ALERT_RINGING');
     } finally {
       disposable.dispose();
     }
@@ -697,15 +668,12 @@ describe('engagement viewers', () => {
     deps.writePty('pty-remote', 'y');
     expect(atWrite).toEqual(['WATCHING_DISABLED']);
     expect(router.getAlertStates().get('pty-remote')?.todo).toBe(false);
-    // A bell answering the key rings no one.
-    ptys.callbacks!.onData('pty-remote', REPORT);
-    expect(status('pty-remote')).not.toBe('ALERT_RINGING');
   });
 
   it('stops engaging anything once its webview is disposed', () => {
     const webview = fakeWebview();
     const disposable = router.attachRouter(webview.channel);
-    webview.send({ type: 'alert:engagement', state: { present: true, focusId: 'pty-gone' } });
+    alert(webview, { op: 'engagement', state: { present: true, focusId: 'pty-gone' } });
     disposable.dispose();
 
     ptys.callbacks!.onData('pty-gone', REPORT);
@@ -717,15 +685,15 @@ describe('engagement viewers', () => {
     const disposable = router.attachRouter(webview.channel);
     try {
       webview.send({ type: 'dormouse:init' });
-      webview.send({ type: 'alert:engagement', state: { present: true, focusId: 'pty-init' } });
-      webview.send({ type: 'alert:await', requestId: 'await-init', id: 'pty-init', until: 'exit', timeoutMs: 600_000 });
+      alert(webview, { op: 'engagement', state: { present: true, focusId: 'pty-init' } });
+      alert(webview, { op: 'await', awaitId: 'await-init', id: 'pty-init', until: 'exit', timeoutMs: 600_000 });
 
       // The content was destroyed and rebuilt; the old one's engagement and
       // parked awaits went with it.
       webview.send({ type: 'dormouse:init' });
       await Promise.resolve();
       expect(webview.posted).toContainEqual(expect.objectContaining({
-        type: 'alert:awaitResult', requestId: 'await-init', outcome: expect.objectContaining({ kind: 'cancelled' }),
+        type: 'alert:awaitResult', awaitId: 'await-init', outcome: expect.objectContaining({ kind: 'cancelled' }),
       }));
       ptys.callbacks!.onData('pty-init', REPORT);
       expect(status('pty-init')).toBe('ALERT_RINGING');
@@ -735,8 +703,62 @@ describe('engagement viewers', () => {
   });
 });
 
+/**
+ * A Session's alert state follows its PTY here, whoever asked
+ * (docs/specs/alert.md): started over, and seeded, at the spawn; given the
+ * resize grace at the resize; removed at the kill.
+ */
+describe('alert state follows the PTY', () => {
+  it('spawns a cold-restored pane with its persisted TODO, and tells its webview', () => {
+    const webview = fakeWebview();
+    const disposable = router.attachRouter(webview.channel);
+    try {
+      webview.send({ type: 'dormouse:init' });
+      ptys.callbacks!.onData('restored', '\x1b]9;last run\x07');
+      webview.send({
+        type: 'pty:spawn',
+        id: 'restored',
+        options: { cwd: '/repo', alert: { status: 'ALERT_RINGING', todo: true, notification: null } },
+      });
+      // The reminder, never the ring: the previous generation's state is gone.
+      expect(router.getAlertStates().get('restored')).toMatchObject({ status: 'WATCHING_DISABLED', todo: true, notification: null });
+      expect(webview.posted.filter((message) => message.type === 'alert:state').at(-1)).toMatchObject({ id: 'restored', todo: true });
+    } finally {
+      disposable.dispose();
+    }
+  });
+
+  it('opens the resize grace before the PTY resizes', async () => {
+    // The router's own instance: `resetModules` gave this test one registry.
+    const { AlertManager } = await import('../../lib/src/lib/alert-manager');
+    vi.spyOn(AlertManager.prototype, 'onResize').mockImplementation((id) => void ptys.order.push(`grace ${id}`));
+    const webview = fakeWebview();
+    const disposable = router.attachRouter(webview.channel);
+    try {
+      webview.send({ type: 'pty:resize', id: 'pty-sized', cols: 100, rows: 30 });
+      expect(ptys.order).toEqual(['grace pty-sized', 'resize pty-sized']);
+    } finally {
+      disposable.dispose();
+    }
+  });
+
+  it('removes a killed Session\'s alert state', () => {
+    const webview = fakeWebview();
+    const disposable = router.attachRouter(webview.channel);
+    try {
+      webview.send({ type: 'pty:spawn', id: 'pty-killed', options: { cwd: '/repo' } });
+      ptys.callbacks!.onData('pty-killed', '\x1b]9;needs input\x07');
+      webview.send({ type: 'pty:kill', id: 'pty-killed' });
+      expect(router.getAlertStates().has('pty-killed')).toBe(false);
+      expect(ptys.order).toContain('kill pty-killed');
+    } finally {
+      disposable.dispose();
+    }
+  });
+});
+
 // An editor panel's disposal kills its PTYs, and the webview that would have
-// sent `alert:remove` for them is already gone: the host removes their entries.
+// sent `pty:kill` for them is already gone: the host removes their entries.
 it('removes the alert state of the PTYs a closing panel kills', async () => {
   const webview = fakeWebview();
   const disposable = router.attachRouter(webview.channel, { killOnDispose: true });
diff --git a/website/src/lib/tut-runner.test.ts b/website/src/lib/tut-runner.test.ts
index 5b3ed671c..4f24e5714 100644
--- a/website/src/lib/tut-runner.test.ts
+++ b/website/src/lib/tut-runner.test.ts
@@ -139,7 +139,7 @@ describe("TutRunner snapshots", () => {
       adapter.setScenario(demoId, { name: "none", chunks: [] });
       adapter.spawnPty(demoId);
       currentTimeoutMs = inactivityTimeoutMs;
-      adapter.alertPublishSettings(settings);
+      adapter.alertPublishSettings(settings, { seed: false });
       adapter.onAlertState((event) => { if (event.id === demoId) events.push(event); });
       sendKeys(sectionRow("alert") + ENTER + "x");
       expect(durationMs).toBeGreaterThan(inactivityTimeoutMs);

From 6107fa2223736b5f10953198c288363760e870ae Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 23 Sep 2026 22:10:45 -0700
Subject: [PATCH 09/16] Schedule spoken alarms and pushes in the host, gated on
 presence

- One delivery scheduler inside the shared alert host (VS Code extension
  host, standalone sidecar, fake adapter): once per sink per episode, the
  deadline fixed at the episode's start, rechecked at the deadline.
- Speech needs the user not engaged with that pane; push needs every
  viewer away. A failed gate consumes the delivery.
- Realms publish their Sessions' Workspace overrides; the host resolves
  them against the settings it holds and sends `alert:deliver` to the
  owning viewer, which speaks or pushes with the pane's label.
- Deletes the renderer ring watcher, its receipts, and the Workspace
  transfer's delivery pause/resume/snapshot machinery.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwN55bUVmCNmPiX7vHGCVF
---
 docs/specs/alert.md                           |  37 ++--
 docs/specs/alert.rationale.md                 |   8 +-
 docs/specs/standalone.md                      |   7 +-
 docs/specs/transport.md                       |   4 +-
 docs/specs/vscode.md                          |   7 +-
 lib/src/components/Baseboard.test.tsx         |   4 +-
 lib/src/components/SettingsDialog.tsx         |   6 +-
 lib/src/components/Wall.tsx                   |   6 +-
 lib/src/components/wall/use-alert-delivery.ts |  18 ++
 lib/src/components/wall/use-alert-speech.ts   |  19 --
 .../wall/window-singletons.test.tsx           |  28 +--
 lib/src/components/wall/workspace-transfer.ts |   4 -
 lib/src/host/alert-client.test.ts             |  14 +-
 lib/src/host/alert-client.ts                  |  15 ++
 lib/src/host/alert-host.test.ts               |  55 ++++-
 lib/src/host/alert-host.ts                    |  28 ++-
 lib/src/host/alert-protocol.ts                |   8 +
 lib/src/host/remote/service.ts                |   2 +-
 lib/src/host/remote/sidecar-entry.test.ts     |  18 ++
 lib/src/host/remote/sidecar-entry.ts          |   5 +-
 lib/src/lib/alert-delivery-model.ts           |  14 ++
 lib/src/lib/alert-delivery-policy.test.ts     | 101 ++-------
 lib/src/lib/alert-delivery-policy.ts          |  27 +--
 lib/src/lib/alert-delivery-scheduler.test.ts  | 173 +++++++++++++++
 lib/src/lib/alert-delivery-scheduler.ts       | 152 +++++++++++++
 lib/src/lib/alert-delivery-state.ts           |  60 -----
 lib/src/lib/alert-delivery.test.ts            |  94 ++++++++
 lib/src/lib/alert-delivery.ts                 |  55 +++++
 lib/src/lib/alert-manager.ts                  |  25 ++-
 lib/src/lib/alert-resumed-output.test.ts      |  39 +---
 lib/src/lib/alert-ring-watch.test.ts          | 209 ------------------
 lib/src/lib/alert-ring-watch.ts               |  72 ------
 lib/src/lib/alert-settings-host.ts            |   9 +-
 lib/src/lib/alert-settings-model.ts           |   8 +-
 lib/src/lib/alert-speech.test.ts              | 103 ++++-----
 lib/src/lib/alert-speech.ts                   |  75 ++++---
 lib/src/lib/platform/fake-adapter.ts          |   2 +-
 lib/src/lib/platform/types.ts                 |  10 +
 lib/src/lib/session-activity-store.ts         |   2 +-
 lib/src/lib/speech-queue.ts                   |   3 +-
 lib/src/remote/burrow/activation.test.ts      |  34 +--
 lib/src/remote/burrow/activation.ts           |  10 +-
 lib/src/remote/burrow/alert-push.test.ts      | 146 +++---------
 lib/src/remote/burrow/alert-push.ts           |  45 +---
 lib/src/remote/burrow/burrow-status-store.ts  |   2 +-
 lib/src/remote/burrow/enrolled-gate.ts        |   5 +-
 lib/src/remote/burrow/push-delivery.ts        |  10 +-
 lib/src/remote/client/remote-adapter.ts       |   2 +
 scripts/spec-word-budgets.json                |   8 +-
 standalone/src/workspace-move.test.ts         |  38 +---
 standalone/src/workspace-move.ts              |  39 +---
 vscode-ext/src/message-router.ts              |  24 +-
 vscode-ext/test/message-router.test.ts        |  59 ++++-
 53 files changed, 1030 insertions(+), 918 deletions(-)
 create mode 100644 lib/src/components/wall/use-alert-delivery.ts
 delete mode 100644 lib/src/components/wall/use-alert-speech.ts
 create mode 100644 lib/src/lib/alert-delivery-scheduler.test.ts
 create mode 100644 lib/src/lib/alert-delivery-scheduler.ts
 delete mode 100644 lib/src/lib/alert-delivery-state.ts
 create mode 100644 lib/src/lib/alert-delivery.test.ts
 create mode 100644 lib/src/lib/alert-delivery.ts
 delete mode 100644 lib/src/lib/alert-ring-watch.test.ts
 delete mode 100644 lib/src/lib/alert-ring-watch.ts

diff --git a/docs/specs/alert.md b/docs/specs/alert.md
index b3ffaa0e2..8ee6c1aac 100644
--- a/docs/specs/alert.md
+++ b/docs/specs/alert.md
@@ -279,16 +279,14 @@ Source of truth: `raiseRing` / `withdrawRingSource` / `clearRingForUser` in `lib
 
 ## Live Workspace transfer
 
-**A Session's alert state never moves**: the host's one manager holds it (`docs/specs/standalone.md` → Alerts), and a transfer moves only where its `alert:state` is routed — the source until the mark, then the target, whose collection is answered with every listed Session's state (rationale).
+**A Session's alert state never moves**: the host's one manager and its delivery scheduler hold it (`docs/specs/standalone.md` → Alerts), and a transfer moves only where its `alert:state` and `alert:deliver` are routed — the source until the mark, then the target, whose collection is answered with every listed Session's state (rationale).
 
 - **Never spawn or kill over a departure, a refused arrival, or a hand-back**: a spawn starts the host's entry over and a kill or reap removes it, and releasing a Session is neither. Pinned by `never spawns or kills over an arrival's live Sessions` in `standalone/src/workspace-move.test.ts`.
 - **A replay never feeds the manager**, whose host parse already did.
-- **Awaits survive a transfer**; a seen command stays seen, so it arrives armed; the destination's viewers establish their own engagement.
-- **Must suspend the source's alarm delivery before handing ownership to the host**, and **must await host hand-back when source content capture fails**, holding that suspension until routing returns. The destination restores receipts before its collection, and enables delivery only after `adopt_done` succeeds; refusal resumes the source's. Transaction order is `docs/specs/standalone.md` → "Arrival queue".
-- **Must discard this window's Activity and pane state before releasing the delivery guards on any target failure**, mount or no mount, so a watcher never re-arms on a Workspace this window never owned. A receipt forgotten on an episode already observed is consumed, never fresh.
-- **Must carry per-sink receipts with the episode:** pending/queued work retains its original deadline; engine-admitted speech and dispatched push are consumed and never replayed. Suspending cuts current speech; a partially heard utterance is not restarted after a move or refusal.
+- **Awaits and pending deliveries survive a transfer**; a seen command stays seen, so it arrives armed; the destination's viewers establish their own engagement, and its Wall publishes the Workspace's overrides (Alarm settings).
+- **Must discard this window's Activity copy on any target failure**, mount or no mount: the source goes on showing the Session. Pinned by `discards this window's copy of the alert state when adopt_done is refused before the Wall mounts` in `standalone/src/workspace-move.test.ts`.
 
-Source of truth: `teardownSession` in `lib/src/lib/terminal-lifecycle.ts`; `snapshotAlertDelivery` / `restoreAlertDelivery` in `lib/src/lib/alert-delivery-state.ts`; `planArrival` / `discardArrival` in `standalone/src/workspace-move.ts`. Pinned by `lib/src/lib/terminal-lifecycle.release.test.ts`, `lib/src/lib/alert-delivery-policy.test.ts`, and `standalone/src/workspace-move.test.ts`.
+Source of truth: `teardownSession` in `lib/src/lib/terminal-lifecycle.ts`; `planArrival` / `discardArrival` in `standalone/src/workspace-move.ts`. Pinned by `lib/src/lib/terminal-lifecycle.release.test.ts` and `standalone/src/workspace-move.test.ts`.
 
 ## Alarm settings
 
@@ -314,25 +312,27 @@ Rules:
 
 **Must persist overrides in the Workspace's `PersistedSession.alertDelivery` in both hosts**, preserving them through rename, reorder, save, and live move. Reset removes overrides, restoring inheritance. A pane resolves its current parent Workspace; a pane without membership uses application defaults.
 
-Both sinks use `watchUnattendedRings`:
+**The host decides when to deliver, in `createAlertHost` beside the manager; the realm showing the Session performs it** (rationale):
 
-- **Must deliver at most once per sink per episode**, independently per Session, with a deadline fixed when the fresh episode is observed.
-- **Must recheck episode identity and effective policy before delivery.** Disabling consumes pending work immediately, suspended for a move included; enabling never replays the same episode. Delay edits do not move existing deadlines; speech reads the current voice at engine admission.
-- **Must seed first-observed ringing snapshots silently**, except explicitly transferred pending receipts (Live Workspace transfer). Receipts outlive a watcher; a restarting watcher prunes those of Sessions that left unpaused.
+- **Must deliver at most once per sink per episode**, independently per Session, due at the episode's start plus the Session's delay; a source joining the episode delivers nothing, and the ring clearing consumes what it had pending.
+- **Must recheck at the deadline, and consume a deadline that fails, never retrying it**: the sink still on; **speech only while the Session is not engaged** (Engagement); **push only while no viewer is present** (rationale).
+- **Disabling consumes pending work immediately; enabling never replays an episode**, one that began disabled included. Delay edits do not move existing deadlines; speech reads the current voice at engine admission.
+- **Each realm publishes every Session it shows with its Workspace's overrides** (`deliveryPolicy`) on each membership or override change. The host revalidates them, resolves them over its settings, and keeps each Session's last publisher's; an unpublished Session uses the defaults. **A realm's end keeps a live Session's overrides**, so a reload or a disposed VS Code view loses none.
+- **Must hand a due delivery to the realm showing its Session** as `alert:deliver { sink, id, episodeId }`, which speaks or pushes the Pane label (below). **With no such realm — a disposed VS Code view whose PTYs live on — the host pushes, titled by the Session's running or last command, and skips speech** (`docs/specs/vscode.md` → Workspaces); standalone reaps a PTY no window owns.
 
-Source of truth: `normalizeAlertDeliveryOverrides` / `resolveAlertDeliveryPolicy` in `lib/src/lib/alert-delivery-model.ts`; `getSessionAlertPolicy` in `lib/src/lib/alert-delivery-policy.ts`; `setWorkspaceAlertDelivery` in `lib/src/lib/workspace-store.ts`. Pinned by `lib/src/lib/alert-delivery-policy.test.ts`.
+Source of truth: `normalizeAlertDeliveryOverrides` / `resolveAlertDeliveryPolicy` in `lib/src/lib/alert-delivery-model.ts`; `createAlertDeliveryScheduler` in `lib/src/lib/alert-delivery-scheduler.ts`; `startAlertDelivery` in `lib/src/lib/alert-delivery.ts`; `getSessionAlertPolicy` / `collectDeliveryOverrides` in `lib/src/lib/alert-delivery-policy.ts`; `setWorkspaceAlertDelivery` in `lib/src/lib/workspace-store.ts`. Pinned by `lib/src/lib/alert-delivery-scheduler.test.ts`, `lib/src/lib/alert-delivery.test.ts`, and `delivery` in `lib/src/host/alert-host.test.ts`.
 
 | Contract | Speech | Push |
 |---|---|---|
-| Gate | Desktop shell, after `speakDelayMs`; a missing backend is a silent no-op. | Desktop shell with an enrolled Burrow, after `pushDelayMs`. |
+| Gate | After `speakDelayMs`, the Session not engaged; a missing backend is a silent no-op. | After `pushDelayMs`, no viewer present; sent only by an enrolled Burrow. |
 | Payload | Pane label via `toSpokenText`; fallback `terminal`. | Same label via `toPushText`, plus a fixed body; fallback `terminal`. |
 | Never payload | The ringing `ActivityNotification`. | The ringing `ActivityNotification`. |
-| Delivery identity | Episode receipt plus native attempt identity; renderer-local `speaking` / `spoken`. | HTTP push tagged by Session id, so a newer ring replaces the prior notification. |
+| Delivery identity | The host's episode receipt plus native attempt identity; renderer-local `speaking` / `spoken`. | HTTP push tagged by Session id, so a newer ring replaces the prior notification. |
 | After delivery | Clearing the ring cuts off speech. | **Never recall** — another push would only replace one stale notice with another. |
 | Failure | A refused or unavailable engine produces no marker. | Warn on non-2xx, partial, or zero delivery; **never retry** stale alarms. |
 | Authority | The renderer invokes `window.speechSynthesis`. | The webview names Session/title; the Burrow selects active ACL devices, the Relay intersects subscriptions. |
 
-Source of truth: `AlertSettings` in `lib/src/lib/alert-settings.ts` (renderer mirror, persisted at `dormouse:alert-settings`); `lib/src/lib/alert-settings-host.ts`; `watchUnattendedRings` in `lib/src/lib/alert-ring-watch.ts`.
+Source of truth: `AlertSettings` in `lib/src/lib/alert-settings.ts` (renderer mirror, persisted at `dormouse:alert-settings`); `lib/src/lib/alert-settings-host.ts`.
 
 ### Spoken alarms
 
@@ -341,22 +341,22 @@ Source of truth: `AlertSettings` in `lib/src/lib/alert-settings.ts` (renderer mi
 - **Delivery state follows actual engine callbacks, not queue admission.** `AlertSpeechState` is a renderer-local `speaking | spoken` map keyed by Session: `start` publishes `speaking`; `end`, or `error` after a real start, publishes `spoken`; an utterance that never starts publishes neither. **Must check delivery identity before accepting `start` or completion**, including after cancellation, timeout, or teardown. Pinned by `ignores an older ring starting after a newer ring has begun speaking` and `recovers from a callback-less engine without accepting its later callbacks` in `lib/src/lib/alert-speech.test.ts`.
 - **Nothing in the settle path may assume the callback arrives after `speak()` returns** — an engine may dispatch `start` then `end`/`error` *synchronously* inside `speechSynthesis.speak()` (rationale). Handlers therefore close over the utterance itself and registration happens before dispatch. A dispatch the engine refuses outright settles too.
 - **Clearing the ring mid-sentence cuts the utterance off** — silence the engine, not merely un-render the overlay. "Mid-sentence" is the sink's own record that an utterance started — its generation token — never the rendered `speaking` state.
-- **Must admit only one utterance at a time to Web Speech per renderer**, Settings tests included, and **must remove resolved, disabled, or suspended pending jobs before engine admission** without cutting another pane's current utterance. Pinned by `never admits a resolved queued alarm to the speech engine` in `lib/src/lib/alert-speech.test.ts`.
+- **Must admit only one utterance at a time to Web Speech per renderer**, Settings tests included, and **must remove resolved or disabled pending jobs before engine admission**, a delivery that crossed either included, without cutting another pane's current utterance. Pinned by `never admits a resolved queued alarm to the speech engine` in `lib/src/lib/alert-speech.test.ts`.
 - **Must bound pending jobs and cancel a stalled engine attempt**, advancing the queue and revoking callback identity before every cancel, and **never retry a failed, expired, or overflowed delivery**. Teardown cancels the current engine utterance and drops pending jobs. The bound, the timeout, and the revocation mechanism live at `SpeechQueue`.
 - `speaking` / `spoken` remains only while the originating Session is still `ALERT_RINGING`: any action that resolves the ring (Clearing And TODO) clears it, killing the Session included, while visibility, hover, and command-mode selection do not. **Never persist it or send it to the host**, so restore/reconnect cannot recreate it.
 
-Source of truth: `toSpokenText` in `lib/src/lib/alert-speech.ts`, armed by `lib/src/components/wall/use-alert-speech.ts`; `SpeechQueue` in `lib/src/lib/speech-queue.ts`; `redactHighEntropyTokens` in `lib/src/lib/redact-high-entropy.ts`; label derivation in `lib/src/lib/session-label.ts`; `AlertSpeechState` in `lib/src/lib/alert-speech-state.ts`.
+Source of truth: `toSpokenText` / `startAlertSpeech` in `lib/src/lib/alert-speech.ts`, armed by `lib/src/components/wall/use-alert-delivery.ts`; `SpeechQueue` in `lib/src/lib/speech-queue.ts`; `redactHighEntropyTokens` in `lib/src/lib/redact-high-entropy.ts`; label derivation in `lib/src/lib/session-label.ts`; `AlertSpeechState` in `lib/src/lib/alert-speech-state.ts`.
 
 ### Push notifications
 
-**The two halves run in different processes.** Ring *detection* is webview state, so `watchPushRings` stays in the webview and fires one `push { sessionId, title }` command at the Burrow service. *Delivery* needs the enrollment and the ACL, which only the Burrow holds, so `sendPush` runs in the service's process and touches no DOM or store. **A webview cannot choose recipients:** it names the Session and what to call it; the service reads its own active ACL at send time. **Arm watching only while the service reports an enrollment** (`enrolled-gate.ts`), so an un-enrolled machine pays no activity-store subscription; a `push` arriving with no Burrow running is not sent. **Keep both halves under `remote/burrow/`**, inside the lazily-imported `RemotePairingModalHost` chunk, so a host without `enableBurrow` never fetches it (rationale).
+**A due push is one `push { sessionId, title }` command from the realm showing the Session to the Burrow service**, titled by the Pane label; *sending* needs the enrollment and the ACL, which only the Burrow holds, so `sendPush` runs in the service's process and touches no DOM or store. **A webview cannot choose recipients:** it names the Session and what to call it; the service reads its own active ACL at send time. A `push` arriving with no Burrow running is not sent. **Keep the device list under `remote/burrow/`**, inside the lazily-imported `RemotePairingModalHost` chunk, so a host without `enableBurrow` never fetches it (rationale).
 
 - **The label is sanitized by `toPushText` at send time, in the delivery half, and not by `toSpokenText`'s rule** (rationale). It keeps angle brackets and instead strips control characters and the Unicode bidi and zero-width format characters (including the Arabic letter mark); the cap counts code points, so a cut never ships half a surrogate pair. `toPushText` is only this sink's limit and fallback over `boundedPushText` in `remote-lib-common/src/security/push.ts`.
 - **The Burrow bounds, then seals; the worker re-bounds at the render sink.** Title, body, and tag are sealed to each recipient's own Client static and the Relay forwards ciphertext, so the second pass runs in `lib/src/remote/pocket-app/sw.ts`, which imports the *same* `boundedPushText` rather than mirroring it (`docs/specs/remote-security-model.md` -> Push sealing).
 - **The Burrow names its targets; the Relay rejects a send that does not.** Targets are the Burrow's *active* ACL records, read at send time so a revocation during the delay takes effect, and the Relay intersects them with its own subscriptions (rationale). **One sealed envelope per recipient** — a Client static is not a group key — so a send names each `deliveryId` beside the ciphertext only that phone can open, **clamped to `MAX_PUSH_QUERY_DELIVERY_IDS`** because the route refuses the whole POST past it. The Burrow does **not** ask which devices are subscribed first (rationale).
 - **The settings dialog re-reads the device list when it opens; the transient preview never refreshes.** The list is the Burrow's join of the Relay's subscriptions against its own ACL labels. **A disarmed enrolled gate invalidates every in-flight refresh and clears the list**, so nothing already on the wire can repopulate the dialog with phones there is no longer anything to push to.
 
-Source of truth: `watchPushRings` / `invalidatePushDeviceRefreshes` in `lib/src/remote/burrow/alert-push.ts`; `sendPush` / `toPushText` in `lib/src/remote/burrow/push-delivery.ts`; `refreshPushDevicesNow` / `clearPushDevices` / `resetPushDevices` in `lib/src/lib/push-devices.ts`.
+Source of truth: `commitPushDevices` / `invalidatePushDeviceRefreshes` in `lib/src/remote/burrow/alert-push.ts`; `sendPush` / `toPushText` in `lib/src/remote/burrow/push-delivery.ts`; `refreshPushDevicesNow` / `clearPushDevices` / `resetPushDevices` in `lib/src/lib/push-devices.ts`.
 
 ### Settings dialog
 
@@ -365,6 +365,7 @@ Reached from the baseboard sliders; `docs/specs/layout.md` owns placement. The a
 - **Must toggle only the clicked baseboard alarm setting**, as an override for that Workspace, showing the effective value. Components without a Workspace scope edit application defaults. **Must show its shared settings section for 2 seconds, then fade for 250ms**, anchored to the button and bounded by the viewport. The preview is inert, announces the resulting state, preserves keyboard focus and command dispatch, and omits test actions. Each click replaces the preview and restarts its lifetime; opening Settings or unmounting clears it. Reduced motion skips the fade. Pinned by `Baseboard.test.tsx`.
 - Lists every watched command with a remove control, and **cannot add one** — WATCHING is keyed on a running command's watch key, so creating a rule stays the terminal context of a Pane running it, and the empty state says so. **It is the only place a rule set on a since-closed Pane can be removed**, the terminal context reaching only the command its own Pane is running.
 - The watcher group carries the **Defer alerts until animation stops** switch and explains that a fully armed watcher delays terminal notifications and withdraws a ring once watched work resumes.
+- Each sink's switch names its gate: not looking at that pane, or away from Dormouse.
 - **Delays are committed on blur or `Enter`, never per keystroke** — typing `3` on the way to `30` must not briefly install a 3-second timer. They are shown in seconds; an out-of-range or empty entry snaps back to whatever the store clamped it to.
 - **The push group's device line names every device a push would reach**, and otherwise says why there is none — no Burrow enrolled, nothing subscribed yet, or the server could not be asked (rationale).
 - **Must separate application defaults from this Workspace’s overrides** and offer per-field inheritance plus reset-all. The local voice picker follows engine voice availability. Pinned by `lib/src/components/WorkspaceAlarmSettings.test.tsx`.
diff --git a/docs/specs/alert.rationale.md b/docs/specs/alert.rationale.md
index d8728d982..fe52ca5c2 100644
--- a/docs/specs/alert.rationale.md
+++ b/docs/specs/alert.rationale.md
@@ -120,9 +120,9 @@
 
 **Why the settings ride the WATCHING rule set's seed/broadcast shape.** Each VS Code webview has its own origin and therefore its own `localStorage`, while the `AlertManager` is shared; without a host-authoritative copy, two webviews would each believe their own blob. The one difference is the whole-blob relay: an alarm setting is not a set of independent keys the way a rule list is.
 
-**Why both sinks share one ring machine.** "Fresh unattended ring, re-checked after the delay, once per ring, never on first observation" is a small pile of rules subtle enough to drift if speech and push each carried a copy.
+**Why the host schedules delivery.** Each renderer used to run its own watcher over its activity mirror, and every realm boundary cost an alarm (audit, 2026-09-23). A recreated VS Code webview saw a latched ring go quiet-then-ringing and fired it at once, while one still inside its delay was first-observed in the new realm, seeded consumed, and never delivered; a disposed view whose PTYs lived on delivered nothing; standalone's WKWebView throttles or suspends timers when hidden; and a Workspace transfer had to carry, pause and resume receipts. The host sees every episode from its start and outlives every renderer, so first-observation seeding and receipt transfer went away. Only speaking and naming the Pane need a renderer.
 
-**Why a first-observation ring never fires.** A restore or a reconnect replays a latched ring, and a persisted session blob can carry one from days ago. Treating that as fresh would buzz the paired phone at every launch.
+**Why presence gates delivery.** The watcher rechecked only the episode and the setting, so a push went out while the user typed in the next pane, and speech named the pane they were reading (audit, 2026-09-23). Speech is heard in the room, so it only has to spare the pane being looked at; a push reaches a phone, so it waits until the user has left every viewer.
 
 ## Spoken alarms
 
@@ -144,7 +144,7 @@ Guarding only completion leaves a stale `start` free to replace the active utter
 
 ## Push notifications
 
-**Why both halves live under `remote/burrow/`.** The sink rides the lazily-imported `RemotePairingModalHost` chunk; the shared ring machine and the device store stay in the common bundle instead, since speech and the settings dialog need them everywhere.
+**Why the device list lives under `remote/burrow/`.** It rides the lazily-imported `RemotePairingModalHost` chunk. Performing a push is one Burrow command beside speech in the common bundle, and the device store stays common too, since the settings dialog needs it everywhere.
 
 **Why `toPushText` is not `toSpokenText`.** The angle-bracket rule exists only because WebKit's synthesizer wedges on them (Spoken alarms); an OS notification has no such failure, and instead has bidi and zero-width formatting that can visually reorder or hide text.
 
@@ -172,7 +172,7 @@ Guarding only completion leaves a stale `start` free to replace the active utter
 
 ## Live Workspace transfer
 
-Nothing moves because the manager left the standalone windows for the host process (`docs/specs/standalone.rationale.md` → Alerts). Per-sink receipts still travel because ring delivery is still scheduled in the renderer. Receipt consumption occurs at sink admission because there is no transactional acknowledgement tying audible sound or phone display to Workspace ownership (2026-09).
+Nothing moves because the manager and the delivery scheduler left the standalone windows for the host process (`docs/specs/standalone.rationale.md` → Alerts; Alarm settings). Until the scheduler moved, per-sink receipts travelled in the transfer payload, paused on the source and resumed on the target's `adopt_done`, and a refused arrival had to drop its Activity copy before releasing that pause or its watcher re-armed on a Workspace the window never owned (2026-09).
 
 ## Workspace union
 
diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index 0674d3861..31045da5d 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -252,6 +252,8 @@ that feeds it: one `AlertManager`, every window a realm under its label
 - **An await's answer carries `forWindow`**, the label that parked it, which
   Rust routes it to — **never a Session `id`**, which would route it to that
   Session's owner, **nor a `requestId`**, which Rust swallows (rationale).
+- **`alert:deliver` carries its Session's `id`**, so Rust routes a due alarm
+  to the window showing it (`docs/specs/alert.md` → Alarm settings).
 - **Must re-send each listed Session's `alert:state` behind the answer to
   `pty:requestInit`**: a reloaded window and an arriving Workspace learn their
   rings and TODOs nowhere else. A `sync` re-sends every Session's, and Rust
@@ -748,7 +750,10 @@ below reads that record rather than inferring itself from the suppression map.
 - **Must reject a repeated move while that Workspace is in flight**, preserving
   the first attempt’s content and recovery state. Async continuations act only
   on their own attempt (`keeps the first move recoverable when the same tab is
-  dropped twice` in `standalone/src/workspace-move.test.ts`).
+  dropped twice` in `standalone/src/workspace-move.test.ts`). **Must await the
+  host's hand-back when source content capture fails**, keeping the Workspace
+  in flight until routing returns (`recovers serialization failure through host
+  hand-back before another move`).
 - **A hand-back replays what the marked ids missed.** From an id's mark to the
   hand-back every byte went to the target, or nowhere, so `hand_back_arrival`
   returns each id the content marked to the source *suppressed* and asks the
diff --git a/docs/specs/transport.md b/docs/specs/transport.md
index 41ea6b08f..a67d656e9 100644
--- a/docs/specs/transport.md
+++ b/docs/specs/transport.md
@@ -157,7 +157,7 @@ with these transfer rules:
   in `lib/src/lib/terminal-transfer.test.ts` and `drains replay before adopting even when no note has a pin`
   in `standalone/src/workspace-move.test.ts`.
 - Tool browser bindings and announcements follow `docs/specs/dor-tool.md` → Persistence and hosts.
-- Alert state and delivery handoff follow `docs/specs/alert.md` → Live Workspace transfer.
+- Alert state and alarm delivery follow `docs/specs/alert.md` → Live Workspace transfer.
 - Semantic-state transfer follows `docs/specs/terminal-state.md` → Core Model.
 - Source-pin limitations belong to `docs/specs/notepad.md` → Source links.
 
@@ -208,7 +208,7 @@ Transport constraints:
 | Host → webview | `pty:replay` | Buffered raw output since spawn; the webview runs a one-shot parser over it, the only re-parse there is. |
 | Host → webview | `dormouse:newTerminal` | May carry `shell`, `args`, display `name`, `replaceUntouched`, `announce`. The webview replaces the selected untouched terminal in place only when `replaceUntouched` is true, otherwise spawns a new pane. |
 
-**Every `alert*` verb is one `alert:command { command }` to the host** — in standalone the `alert_command` invoke, stamped with its window (`docs/specs/standalone.md` → "Alerts") — and **every answer one of the `alert:*` events, named and shaped alike in both hosts** (`AlertCommand` / `AlertEvents` in `lib/src/host/alert-protocol.ts`). **The host revalidates every command**, the settings blob that becomes its timers included (`normalizeAlertSettings`). An await's messages are `docs/specs/alert.md` → Await. **`sync` re-sends the realm its Sessions' `alert:state` and both stores' snapshots, ending nothing.**
+**Every `alert*` verb is one `alert:command { command }` to the host** — in standalone the `alert_command` invoke, stamped with its window (`docs/specs/standalone.md` → "Alerts") — and **every answer one of the `alert:*` events, named and shaped alike in both hosts** (`AlertCommand` / `AlertEvents` in `lib/src/host/alert-protocol.ts`). **The host revalidates every command**, the settings blob that becomes its timers included (`normalizeAlertSettings`). An await's messages are `docs/specs/alert.md` → Await. **`sync` re-sends the realm its Sessions' `alert:state` and both stores' snapshots, ending nothing.** Alarm delivery adds `deliveryPolicy` → host and `alert:deliver` → the realm showing the Session (`docs/specs/alert.md` → Alarm settings).
 
 **Two app-global stores relay on one pattern**: WATCHING rules (`initializeWatchedCommands`, `setCommandWatched` → host; `alert:watchedCommands` → webview) and alarm settings (`initializeSettings`, `updateSettings` → host; `alert:settings` → webview; `docs/specs/alert.md` → Alarm settings). An `initialize*` offers the renderer's persisted copy as a startup seed, and **a host accepts only the first seed of its lifetime**. A mutation replaces the host's copy — `setCommandWatched` adds or removes one bare command key without touching unrelated rules, `updateSettings` sends the whole blob, renderer-only fields included, so every webview agrees. Either way the host broadcasts a canonical snapshot, and **every renderer replaces and persists its local mirror from it**. **A host sends no snapshot before the first seed**, so a `sync` never pushes defaults over a renderer's persisted copy.
 
diff --git a/docs/specs/vscode.md b/docs/specs/vscode.md
index 5c5368d7d..463a05678 100644
--- a/docs/specs/vscode.md
+++ b/docs/specs/vscode.md
@@ -87,9 +87,14 @@ are app-global rather than per-Workspace, riding the seed / mutate / broadcast
 channel of `docs/specs/transport.md` → Message protocol; the settings the
 shared manager consumes are `AlertManager.applySettings`'s own list.
 
+**A due alarm goes to the router whose `ownedPtyIds` hold its Session**; the
+owner-less push goes through `handleBurrowCommand` (`docs/specs/alert.md` →
+Alarm settings).
+
 Source of truth: `WatchedCommandHost` in `lib/src/lib/watched-command-host.ts`,
 `AlertSettingsHost` in `lib/src/lib/alert-settings-host.ts`, the `alert:command`
-case in `vscode-ext/src/message-router.ts`.
+case and `deliverAlert` in `vscode-ext/src/message-router.ts`. Pinned by
+`alarm delivery` in `vscode-ext/test/message-router.test.ts`.
 
 ### Shell selection
 
diff --git a/lib/src/components/Baseboard.test.tsx b/lib/src/components/Baseboard.test.tsx
index 3a205d5b7..23f6b0801 100644
--- a/lib/src/components/Baseboard.test.tsx
+++ b/lib/src/components/Baseboard.test.tsx
@@ -144,8 +144,8 @@ describe('Baseboard settings controls', () => {
   });
 
   it.each([
-    ['speech', 'speakEnabled', 'Speak out loud if not attended', 'Delay before speaking:'],
-    ['push', 'pushEnabled', 'Send push notification if not attended', 'Delay before push:'],
+    ['speech', 'speakEnabled', "Speak out loud when you're not looking at that pane", 'Delay before speaking:'],
+    ['push', 'pushEnabled', "Send push notification when you're away from Dormouse", 'Delay before push:'],
   ] as const)('toggles only %s and previews its stored setting without taking the keyboard', (sink, field, label, delay) => {
     vi.useFakeTimers();
     const setDialogKeyboardActive = vi.fn();
diff --git a/lib/src/components/SettingsDialog.tsx b/lib/src/components/SettingsDialog.tsx
index ab723b566..10684f020 100644
--- a/lib/src/components/SettingsDialog.tsx
+++ b/lib/src/components/SettingsDialog.tsx
@@ -1,6 +1,6 @@
 import { SecondsField, SwitchRow } from './AlarmSettingsControls';
 import { WorkspaceAlarmSettings } from './WorkspaceAlarmSettings';
-import type { AlertSink } from '../lib/alert-delivery-state';
+import type { AlertSink } from '../lib/alert-delivery-model';
 import { useWorkspaceAlertPolicy } from './wall/use-workspace-alert-policy';
 import { useCallback, useEffect, useRef, useState, useSyncExternalStore } from 'react';
 import {
@@ -255,7 +255,7 @@ export function AlarmSettingsSection({ sink, preview = false }: { sink: AlarmSin
   return sink === 'speech' ? (
     <AlarmSinkSection
       className={preview ? '' : SECTION}
-      switchLabel="Speak out loud if not attended"
+      switchLabel="Speak out loud when you're not looking at that pane"
       delayLabel="Delay before speaking:"
       enabled={settings.speakEnabled}
       delayMs={settings.speakDelayMs}
@@ -271,7 +271,7 @@ export function AlarmSettingsSection({ sink, preview = false }: { sink: AlarmSin
   ) : (
     <AlarmSinkSection
       className={preview ? '' : SECTION}
-      switchLabel="Send push notification if not attended"
+      switchLabel="Send push notification when you're away from Dormouse"
       delayLabel="Delay before push:"
       enabled={settings.pushEnabled}
       delayMs={settings.pushDelayMs}
diff --git a/lib/src/components/Wall.tsx b/lib/src/components/Wall.tsx
index 03791e543..5ae8f5a02 100644
--- a/lib/src/components/Wall.tsx
+++ b/lib/src/components/Wall.tsx
@@ -104,7 +104,7 @@ import type { WallNav } from './wall/keyboard/types';
 import { useWallKeyboard } from './wall/use-wall-keyboard';
 import { useSessionPersistence } from './wall/use-session-persistence';
 import { useDevServerPortCorrelation } from './wall/use-dev-server-ports';
-import { useAlertSpeech } from './wall/use-alert-speech';
+import { useAlertDelivery } from './wall/use-alert-delivery';
 import { queueToolSpawn, restartSurfaceInPlace, toolRunCommand, useDorControl, waitForNewToolCommand } from './wall/use-dor-control';
 import { errorText } from './wall/dor-control-shared';
 import { useWindowFocused } from './wall/use-window-focused';
@@ -1172,8 +1172,8 @@ export function Wall({
   // --- Dev-server port → pane correlation (browser header connection chip) ---
   useDevServerPortCorrelation({ lath, doorsRef });
 
-  // --- Spoken alarms (`docs/specs/alert.md` -> Alarm settings) ---
-  useAlertSpeech();
+  // --- Spoken alarms and pushes (`docs/specs/alert.md` -> Alarm settings) ---
+  useAlertDelivery();
 
   // --- Reattach ---
 
diff --git a/lib/src/components/wall/use-alert-delivery.ts b/lib/src/components/wall/use-alert-delivery.ts
new file mode 100644
index 000000000..10295e206
--- /dev/null
+++ b/lib/src/components/wall/use-alert-delivery.ts
@@ -0,0 +1,18 @@
+import { useEffect } from 'react';
+import { startAlertDelivery } from '../../lib/alert-delivery';
+import { createRefCount } from '../../lib/ref-count';
+
+/**
+ * Arm this realm's spoken alarms and pushes for the lifetime of the desktop
+ * shell (`docs/specs/alert.md` -> Alarm settings).
+ *
+ * One performer per WINDOW, not per Wall: `startAlertDelivery` publishes every
+ * Workspace's policy and clears every Session's speech state, so N Walls would
+ * speak each delivery N times and reset each other's delivery state. Reference
+ * counted, so the first mounted Wall arms it and the last one disarms it.
+ */
+const acquire = createRefCount({ onFirst: () => startAlertDelivery() });
+
+export function useAlertDelivery(): void {
+  useEffect(acquire, []);
+}
diff --git a/lib/src/components/wall/use-alert-speech.ts b/lib/src/components/wall/use-alert-speech.ts
deleted file mode 100644
index 35b2f8aa3..000000000
--- a/lib/src/components/wall/use-alert-speech.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import { useEffect } from 'react';
-import { startAlertSpeech } from '../../lib/alert-speech';
-import { createRefCount } from '../../lib/ref-count';
-
-/**
- * Arm spoken alarms for the lifetime of the desktop shell. The settings that
- * gate it live in the Alarm settings dialog (`docs/specs/alert.md` -> Alarm
- * settings).
- *
- * One watcher per WINDOW, not per Wall: `startAlertSpeech` installs a global
- * activity handler and clears every Session's speech state, so N Walls would
- * speak each ring N times and reset each other's delivery state. Reference
- * counted, so the first mounted Wall arms it and the last one disarms it.
- */
-const acquire = createRefCount({ onFirst: () => startAlertSpeech() });
-
-export function useAlertSpeech(): void {
-  useEffect(acquire, []);
-}
diff --git a/lib/src/components/wall/window-singletons.test.tsx b/lib/src/components/wall/window-singletons.test.tsx
index 8ecb40a23..4ab919eb3 100644
--- a/lib/src/components/wall/window-singletons.test.tsx
+++ b/lib/src/components/wall/window-singletons.test.tsx
@@ -1,19 +1,19 @@
 /**
  * @vitest-environment jsdom
  *
- * Two hooks a Wall mounts that own WINDOW-level machinery — the spoken-alarm
- * watcher and the dynamic palette — so N mounted Walls must still run one each
+ * Two hooks a Wall mounts that own WINDOW-level machinery — the alarm
+ * delivery performer and the dynamic palette — so N mounted Walls must still run one each
  * (docs/specs/layout.md → "Workspaces").
  */
 import { act } from 'react';
 import { createRoot, type Root } from 'react-dom/client';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { useAlertSpeech } from './use-alert-speech';
+import { useAlertDelivery } from './use-alert-delivery';
 import { useDynamicPalette } from '../../lib/themes/use-dynamic-palette';
 
-const stopSpeech = vi.fn();
-const startSpeech = vi.fn(() => stopSpeech);
-vi.mock('../../lib/alert-speech', () => ({ startAlertSpeech: () => startSpeech() }));
+const stopDelivery = vi.fn();
+const startDelivery = vi.fn(() => stopDelivery);
+vi.mock('../../lib/alert-delivery', () => ({ startAlertDelivery: () => startDelivery() }));
 vi.mock('../../lib/themes/dynamic-palette', () => ({
   computeDynamicPalette: () => ({ '--color-door-bg': 'rgb(1, 2, 3)' }),
 }));
@@ -25,14 +25,14 @@ let root: Root;
 let observers: number;
 
 function Consumer() {
-  useAlertSpeech();
+  useAlertDelivery();
   useDynamicPalette();
   return null;
 }
 
 beforeEach(() => {
-  startSpeech.mockClear();
-  stopSpeech.mockClear();
+  startDelivery.mockClear();
+  stopDelivery.mockClear();
   observers = 0;
   class CountingObserver {
     constructor() { observers += 1; }
@@ -59,19 +59,19 @@ afterEach(() => {
 describe('window-singleton Wall hooks', () => {
   it('arms once for N Walls and disarms only when the last one goes', async () => {
     await act(async () => { root.render(<><Consumer /><Consumer /><Consumer /></>); });
-    // One spoken-alarm watcher (it installs a global handler and clears every
-    // Session's speech state) and one palette observer for the document.
-    expect(startSpeech).toHaveBeenCalledTimes(1);
+    // One delivery performer (it publishes every Workspace's policy and clears
+    // every Session's speech state) and one palette observer for the document.
+    expect(startDelivery).toHaveBeenCalledTimes(1);
     expect(observers).toBe(1);
     expect(document.body.style.getPropertyValue('--color-door-bg')).toBe('rgb(1, 2, 3)');
 
     // Dropping one Wall must not silence the survivors or strip the variables.
     await act(async () => { root.render(<><Consumer /></>); });
-    expect(stopSpeech).not.toHaveBeenCalled();
+    expect(stopDelivery).not.toHaveBeenCalled();
     expect(document.body.style.getPropertyValue('--color-door-bg')).toBe('rgb(1, 2, 3)');
 
     await act(async () => { root.render(<></>); });
-    expect(stopSpeech).toHaveBeenCalledTimes(1);
+    expect(stopDelivery).toHaveBeenCalledTimes(1);
     expect(document.body.style.getPropertyValue('--color-door-bg')).toBe('');
   });
 });
diff --git a/lib/src/components/wall/workspace-transfer.ts b/lib/src/components/wall/workspace-transfer.ts
index 9dfd75a28..c858bd62b 100644
--- a/lib/src/components/wall/workspace-transfer.ts
+++ b/lib/src/components/wall/workspace-transfer.ts
@@ -2,7 +2,6 @@ import { getToolDirty } from '../../lib/tool-dirty-store';
 import type { TransferredTools } from './tool-transfer';
 import { getToolAnnounce } from '../../lib/tool-announce-store';
 import type { ToolAnnounce } from '../../lib/tool-announce';
-import type { AlertDeliveryHandoff } from '../../lib/alert-delivery-state';
 import { snapshotTerminalState, type TransferredTerminalState } from '../../lib/terminal-state-store';
 import { dismissWorkspaceUi } from '../../lib/workspace-ui-store';
 import { snapshotNotepadForTransfer, removeSurface } from '../../lib/notepad/notepad-store';
@@ -135,9 +134,6 @@ export async function prepareWorkspaceTransfer(
 /** One terminal's half of a transfer's content: what the target writes before
  *  it attaches, and where the host's replay picks up. */
 export interface TransferredTerminal {
-  /** The speech and push receipts; the Session's alert state itself never
-   *  moves, since the host's one manager holds it. */
-  alertDelivery?: AlertDeliveryHandoff;
   /** The buffer as the escape stream that rebuilds it; `''` for a Session this
    *  Window no longer held. */
   serialized: string;
diff --git a/lib/src/host/alert-client.test.ts b/lib/src/host/alert-client.test.ts
index 1b935b6ff..88193521b 100644
--- a/lib/src/host/alert-client.test.ts
+++ b/lib/src/host/alert-client.test.ts
@@ -26,6 +26,7 @@ it('sends each alert verb as one command naming its op', () => {
   methods.alertClearTodo('p');
   methods.alertEngagement({ present: true, focusId: 'p' });
   methods.alertEngagement({ present: false, focusId: 'p' }, 'idle');
+  methods.alertPublishDeliveryPolicy({ p: { speakEnabled: true } });
   methods.alertSetWatchedCommands(['cargo']);
   // A delta, never a replacement.
   methods.alertSetCommandWatched('cargo', true);
@@ -40,6 +41,7 @@ it('sends each alert verb as one command naming its op', () => {
     { op: 'clearTodo', id: 'p' },
     { op: 'engagement', state: { present: true, focusId: 'p' } },
     { op: 'engagement', state: { present: false, focusId: 'p' }, lapse: 'idle' },
+    { op: 'deliveryPolicy', overrides: { p: { speakEnabled: true } } },
     { op: 'initializeWatchedCommands', names: ['cargo'] },
     { op: 'setCommandWatched', name: 'cargo', watched: true },
     { op: 'initializeSettings', settings: DEFAULT_ALERT_SETTINGS },
@@ -60,6 +62,7 @@ describe('events', () => {
     methods.onAlertState((detail) => void seen.push(['state', detail]));
     methods.onWatchedCommands((names) => void seen.push(['watched', names]));
     methods.onAlertSettings((settings) => void seen.push(['settings', settings]));
+    methods.onAlertDeliver((delivery) => void seen.push(['deliver', delivery]));
 
     const detail = { id: 'p', status: 'ALERT_RINGING', todo: true } as unknown as AlertStateDetail;
     alerts.onEvent('alert:state', detail);
@@ -67,9 +70,16 @@ describe('events', () => {
     alerts.onEvent('alert:settings', { settings: DEFAULT_ALERT_SETTINGS });
     // A snapshot with no blob is dropped, not applied as "no settings".
     alerts.onEvent('alert:settings', {});
+    // A delivery the renderer cannot perform is dropped, and only its fields cross.
+    alerts.onEvent('alert:deliver', { sink: 'push', id: 'p', episodeId: 'e-1', forWindow: 'main' });
+    alerts.onEvent('alert:deliver', { sink: 'bell', id: 'p', episodeId: 'e-1' });
+    alerts.onEvent('alert:deliver', { sink: 'speech', id: 'p' });
     expect(alerts.onEvent('pty:data', { id: 'p', data: 'x' })).toBe(false);
 
-    expect(seen).toEqual([['state', detail], ['watched', ['make']], ['settings', DEFAULT_ALERT_SETTINGS]]);
+    expect(seen).toEqual([
+      ['state', detail], ['watched', ['make']], ['settings', DEFAULT_ALERT_SETTINGS],
+      ['deliver', { sink: 'push', id: 'p', episodeId: 'e-1' }],
+    ]);
   });
 });
 
@@ -122,7 +132,7 @@ describe('awaits', () => {
   });
 
   it('takes the host\'s answer through the real host, a claim included', async () => {
-    const host = createAlertHost();
+    const host = createAlertHost({ deliver: () => {} });
     const realm = createAlertClient((command) => host.handle('main', command, {
       answer: (result) => void realm.onEvent('alert:awaitResult', result),
       resendStates: () => {},
diff --git a/lib/src/host/alert-client.ts b/lib/src/host/alert-client.ts
index 3bd910c5b..cd8b979b8 100644
--- a/lib/src/host/alert-client.ts
+++ b/lib/src/host/alert-client.ts
@@ -1,4 +1,6 @@
 import type { AwaitHandle, AwaitOptions, AwaitOutcome, Engagement, EngagementLapse } from '../lib/alert-manager';
+import { ALERT_SINKS } from '../lib/alert-delivery-model';
+import type { AlertDelivery } from '../lib/alert-delivery-scheduler';
 import type { AlertSettings } from '../lib/alert-settings-model';
 import type { AlertStateDetail, PlatformAdapter } from '../lib/platform/types';
 import { isAlertEvent, type AlertAwaitResult, type AlertCommand, type AlertEvents } from './alert-protocol';
@@ -17,6 +19,7 @@ export type AlertClientMethods = Required<Pick<
   | 'alertPublishSettings'
   | 'alertDismiss'
   | 'alertEngagement'
+  | 'alertPublishDeliveryPolicy'
   | 'alertAcknowledge'
   | 'alertToggleTodo'
   | 'alertClearTodo'
@@ -24,6 +27,7 @@ export type AlertClientMethods = Required<Pick<
   | 'onAlertState'
   | 'onWatchedCommands'
   | 'onAlertSettings'
+  | 'onAlertDeliver'
 >>;
 
 export interface AlertClient {
@@ -57,6 +61,7 @@ export function createAlertClient(send: (command: AlertCommand) => void): AlertC
   const stateHandlers = new Set<(detail: AlertStateDetail) => void>();
   const watchedHandlers = new Set<(names: string[]) => void>();
   const settingsHandlers = new Set<(settings: AlertSettings) => void>();
+  const deliverHandlers = new Set<(delivery: AlertDelivery) => void>();
   const awaits = new Map<string, { resolve: (outcome: AwaitOutcome) => void; startedAt: number }>();
   const tag = randomTag();
   let awaitSeq = 0;
@@ -71,6 +76,7 @@ export function createAlertClient(send: (command: AlertCommand) => void): AlertC
     alertDismiss: (id) => send({ op: 'dismiss', id }),
     alertEngagement: (state: Engagement, lapse?: EngagementLapse) =>
       send({ op: 'engagement', state, ...(lapse ? { lapse } : {}) }),
+    alertPublishDeliveryPolicy: (overrides) => send({ op: 'deliveryPolicy', overrides }),
     alertAcknowledge: (id) => send({ op: 'acknowledge', id }),
     alertToggleTodo: (id) => send({ op: 'toggleTodo', id }),
     alertClearTodo: (id) => send({ op: 'clearTodo', id }),
@@ -98,6 +104,7 @@ export function createAlertClient(send: (command: AlertCommand) => void): AlertC
     onAlertState: (handler) => void stateHandlers.add(handler),
     onWatchedCommands: (handler) => void watchedHandlers.add(handler),
     onAlertSettings: (handler) => void settingsHandlers.add(handler),
+    onAlertDeliver: (handler) => void deliverHandlers.add(handler),
   };
 
   return {
@@ -132,6 +139,14 @@ export function createAlertClient(send: (command: AlertCommand) => void): AlertC
           if (settings) for (const handler of settingsHandlers) handler(settings);
           break;
         }
+        case 'alert:deliver': {
+          const delivery = data as Partial<AlertDelivery> | null;
+          if (!delivery || !ALERT_SINKS.includes(delivery.sink as AlertDelivery['sink'])) break;
+          if (typeof delivery.id !== 'string' || typeof delivery.episodeId !== 'string') break;
+          const { sink, id, episodeId } = delivery as AlertDelivery;
+          for (const handler of deliverHandlers) handler({ sink, id, episodeId });
+          break;
+        }
         default:
           event satisfies never;
       }
diff --git a/lib/src/host/alert-host.test.ts b/lib/src/host/alert-host.test.ts
index 6dde31f79..0bde06122 100644
--- a/lib/src/host/alert-host.test.ts
+++ b/lib/src/host/alert-host.test.ts
@@ -1,6 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { createAlertHost, type AlertHost, type AlertRealm } from './alert-host';
 import type { AlertAwaitResult } from './alert-protocol';
+import type { AlertDelivery } from '../lib/alert-delivery-scheduler';
 import { DEFAULT_ALERT_SETTINGS } from '../lib/alert-settings-model';
 import { REPORT } from '../lib/alert-manager-test-utils';
 
@@ -18,6 +19,7 @@ let answers: Array<{ realm: string } & AlertAwaitResult>;
 let resent: string[];
 let watched: string[][];
 let settings: Array<Record<string, unknown>>;
+let delivered: AlertDelivery[];
 
 function realmFor(name: string): AlertRealm {
   return {
@@ -30,7 +32,8 @@ function realmFor(name: string): AlertRealm {
 const from = (name: string, command: unknown) => host.handle(name, command, realmFor(name));
 
 beforeEach(() => {
-  host = createAlertHost();
+  delivered = [];
+  host = createAlertHost({ deliver: (delivery) => void delivered.push(delivery) });
   answers = [];
   resent = [];
   watched = [];
@@ -213,6 +216,56 @@ describe('realms', () => {
   });
 });
 
+/**
+ * The scheduler runs in the host so that no realm's end can lose or repeat a
+ * delivery (`docs/specs/alert.md` -> Alarm settings).
+ */
+describe('delivery', () => {
+  const SPEECH_OFF = { ...DEFAULT_ALERT_SETTINGS, speakEnabled: false, speakDelayMs: 5_000 };
+
+  beforeEach(() => {
+    vi.useFakeTimers();
+    from('main', { op: 'initializeSettings', settings: SPEECH_OFF });
+  });
+
+  it('takes each realm\'s published overrides over the settings the host holds', () => {
+    from('main', { op: 'deliveryPolicy', overrides: { 'pty-1': { speakEnabled: true } } });
+    host.manager.notifyFromProtocol('pty-1', REPORT);
+    host.manager.notifyFromProtocol('pty-2', REPORT);
+    vi.advanceTimersByTime(5_000);
+    expect(delivered).toEqual([{ sink: 'speech', id: 'pty-1', episodeId: host.manager.getState('pty-1').episode!.id }]);
+  });
+
+  it('delivers once across its realm\'s reload, whose overrides outlive the gap', () => {
+    from('main', { op: 'deliveryPolicy', overrides: { 'pty-1': { speakEnabled: true } } });
+    host.manager.notifyFromProtocol('pty-1', REPORT);
+    vi.advanceTimersByTime(4_000);
+    // The reload: the old realm ends, and the new one publishes after the deadline.
+    from('main', { op: 'hello' });
+    vi.advanceTimersByTime(2_000);
+    from('main', { op: 'deliveryPolicy', overrides: { 'pty-1': { speakEnabled: true } } });
+    vi.advanceTimersByTime(60_000);
+    expect(delivered.map((delivery) => delivery.sink)).toEqual(['speech']);
+  });
+
+  it('rechecks pending work when the settings change', () => {
+    from('main', { op: 'updateSettings', settings: { ...SPEECH_OFF, speakEnabled: true } });
+    host.manager.notifyFromProtocol('pty-1', REPORT);
+    from('main', { op: 'updateSettings', settings: SPEECH_OFF });
+    from('main', { op: 'updateSettings', settings: { ...SPEECH_OFF, speakEnabled: true } });
+    vi.advanceTimersByTime(60_000);
+    expect(delivered).toEqual([]);
+  });
+
+  it('leaves nothing pending once disposed', () => {
+    from('main', { op: 'updateSettings', settings: { ...SPEECH_OFF, speakEnabled: true } });
+    host.manager.notifyFromProtocol('pty-1', REPORT);
+    host.dispose();
+    expect(vi.getTimerCount()).toBe(0);
+    host = createAlertHost({ deliver: () => {} });
+  });
+});
+
 describe('awaits', () => {
   it('answers each await once, to the realm that parked it', async () => {
     from('ws-2', { op: 'await', awaitId: 'await-1', id: 'pty-1', until: 'quiet', timeoutMs: 600_000 });
diff --git a/lib/src/host/alert-host.ts b/lib/src/host/alert-host.ts
index 898bf9c71..ec106d372 100644
--- a/lib/src/host/alert-host.ts
+++ b/lib/src/host/alert-host.ts
@@ -1,4 +1,5 @@
 import { AlertManager, type AwaitHandle, type Engagement } from '../lib/alert-manager';
+import { createAlertDeliveryScheduler, type AlertDelivery } from '../lib/alert-delivery-scheduler';
 import { AlertSettingsHost } from '../lib/alert-settings-host';
 import { WatchedCommandHost } from '../lib/watched-command-host';
 import type { PersistedAlertState } from '../lib/session-types';
@@ -9,8 +10,9 @@ import type { AlertAwaitResult } from './alert-protocol';
  * extension host (`vscode-ext/src/message-router.ts`) and standalone's sidecar
  * (`lib/src/host/remote/sidecar-entry.ts`). One `AlertManager`, the two
  * app-global stores bound to it, and every renderer realm one of its viewers,
- * driving it with `AlertCommand`s (`lib/src/host/alert-protocol.ts`). How
- * state and snapshots reach the realms is each host's own.
+ * driving it with `AlertCommand`s (`lib/src/host/alert-protocol.ts`), and the
+ * scheduler that decides when a ring is spoken or pushed. How state,
+ * snapshots and deliveries reach the realms is each host's own.
  */
 
 /** Where the host answers the realm a command came from. */
@@ -21,6 +23,14 @@ export interface AlertRealm {
   resendStates(): void;
 }
 
+export interface AlertHostOptions {
+  /**
+   * One due spoken alarm or push, for the realm showing its Session to
+   * perform (`docs/specs/alert.md` -> Alarm settings).
+   */
+  deliver(delivery: AlertDelivery): void;
+}
+
 export interface AlertHost {
   readonly manager: AlertManager;
   readonly watched: WatchedCommandHost;
@@ -52,10 +62,12 @@ interface Parked {
 
 const isId = (value: unknown): value is string => typeof value === 'string' && value.length > 0;
 
-export function createAlertHost(): AlertHost {
+export function createAlertHost(options: AlertHostOptions): AlertHost {
   const manager = new AlertManager();
   const watched = new WatchedCommandHost(manager);
   const settings = new AlertSettingsHost(manager);
+  const delivery = createAlertDeliveryScheduler({ manager, defaults: () => settings.current, deliver: options.deliver });
+  const stopSettings = settings.subscribe(() => delivery.recheck());
   /** Each realm's parked `dor await`s, by the id its client minted. */
   const parked = new Map<string, Map<string, Parked>>();
 
@@ -86,6 +98,7 @@ export function createAlertHost(): AlertHost {
 
   function endRealm(realmId: string): void {
     manager.removeViewer(realmId);
+    delivery.endRealm(realmId);
     const awaits = parked.get(realmId);
     if (!awaits) return;
     parked.delete(realmId);
@@ -141,6 +154,10 @@ export function createAlertHost(): AlertHost {
           manager.setViewer(realmId, message.state as Engagement, lapse);
           return;
         }
+        case 'deliveryPolicy':
+          // Revalidated field by field, like the Workspace's persisted copy.
+          delivery.publish(realmId, message.overrides);
+          return;
         case 'await':
           park(realmId, realm, message);
           return;
@@ -182,8 +199,11 @@ export function createAlertHost(): AlertHost {
     },
 
     dispose() {
-      // Cleared first: nothing is answered for a host that is going away.
+      // Cleared first: nothing is answered, or delivered, for a host that is
+      // going away.
       parked.clear();
+      stopSettings();
+      delivery.dispose();
       manager.dispose();
     },
   };
diff --git a/lib/src/host/alert-protocol.ts b/lib/src/host/alert-protocol.ts
index ce5a32d43..c4fdb1f0b 100644
--- a/lib/src/host/alert-protocol.ts
+++ b/lib/src/host/alert-protocol.ts
@@ -1,4 +1,6 @@
 import type { AwaitOutcome, AwaitUntil, Engagement, EngagementLapse } from '../lib/alert-manager';
+import type { AlertDeliveryOverrides } from '../lib/alert-delivery-model';
+import type { AlertDelivery } from '../lib/alert-delivery-scheduler';
 import type { AlertSettings } from '../lib/alert-settings-model';
 import type { AlertStateDetail } from '../lib/platform/types';
 
@@ -18,6 +20,9 @@ export type AlertCommand =
   | { op: 'setCommandWatched'; name: string; watched: boolean }
   | { op: 'initializeSettings' | 'updateSettings'; settings: AlertSettings }
   | { op: 'engagement'; state: Engagement; lapse?: EngagementLapse }
+  /** Every Session this realm shows, each with its Workspace's sparse
+   *  overrides: what the host's delivery scheduler cannot know itself. */
+  | { op: 'deliveryPolicy'; overrides: Record<string, AlertDeliveryOverrides> }
   | { op: 'acknowledge' | 'dismiss' | 'toggleTodo' | 'clearTodo'; id: string }
   | { op: 'await'; awaitId: string; id: string; until: AwaitUntil; timeoutMs: number }
   | { op: 'awaitCancel'; awaitId: string };
@@ -38,6 +43,8 @@ export interface AlertEvents {
   /** The app-global stores' canonical snapshots, to every realm. */
   'alert:watchedCommands': { names: string[] };
   'alert:settings': { settings: AlertSettings };
+  /** A spoken alarm or push now due, to the realm that shows its Session. */
+  'alert:deliver': AlertDelivery;
 }
 
 export const ALERT_EVENTS = [
@@ -45,6 +52,7 @@ export const ALERT_EVENTS = [
   'alert:awaitResult',
   'alert:watchedCommands',
   'alert:settings',
+  'alert:deliver',
 ] as const satisfies ReadonlyArray<keyof AlertEvents>;
 
 export type AlertEventName = (typeof ALERT_EVENTS)[number];
diff --git a/lib/src/host/remote/service.ts b/lib/src/host/remote/service.ts
index 03e850353..86ec46563 100644
--- a/lib/src/host/remote/service.ts
+++ b/lib/src/host/remote/service.ts
@@ -639,7 +639,7 @@ export class BurrowService {
   /**
    * Tell the webviews whether there is a Burrow at all. Everything they do *for*
    * one — announcing that the directory may have changed on every pane-state,
-   * activity, and focus change, watching for unattended rings — costs a
+   * activity, and focus change — costs a
    * crossing per event on a machine that may never enroll, so they arm on this
    * and idle without it (`lib/src/remote/burrow/enrolled-gate.ts`).
    *
diff --git a/lib/src/host/remote/sidecar-entry.test.ts b/lib/src/host/remote/sidecar-entry.test.ts
index 2799d7d54..b33932463 100644
--- a/lib/src/host/remote/sidecar-entry.test.ts
+++ b/lib/src/host/remote/sidecar-entry.test.ts
@@ -777,6 +777,24 @@ describe('the sidecar host', () => {
     expect(result).toEqual({ awaitId: 'await-1', forWindow: 'ws-2', outcome: expect.objectContaining({ cause: 'bell' }) });
   });
 
+  // A delivery carries its Session's `id`, so Rust routes it to the window
+  // showing that Session; the policy it was due under is each window's own.
+  it('sends a due delivery naming its Session, under the policy its window published', () => {
+    vi.useFakeTimers();
+    try {
+      command('main', { op: 'initializeSettings', settings: { speakDelayMs: 1_000 } });
+      command('main', { op: 'deliveryPolicy', overrides: { 'pty-1': { speakEnabled: true } } });
+      host.alerts.notifyFromProtocol('pty-1', REPORT);
+      host.alerts.notifyFromProtocol('pty-2', REPORT);
+      vi.advanceTimersByTime(1_000);
+      expect(out.filter((line) => line.event === 'alert:deliver').map((line) => line.data)).toEqual([
+        { sink: 'speech', id: 'pty-1', episodeId: host.alerts.getState('pty-1').episode!.id },
+      ]);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it('ignores an alert command no host stamped', () => {
     command(undefined, { op: 'engagement', state: { present: true, focusId: 'pty-1' } });
     expect(host.alerts.viewerIds()).toEqual([]);
diff --git a/lib/src/host/remote/sidecar-entry.ts b/lib/src/host/remote/sidecar-entry.ts
index ae751417d..bc31ea339 100644
--- a/lib/src/host/remote/sidecar-entry.ts
+++ b/lib/src/host/remote/sidecar-entry.ts
@@ -430,10 +430,11 @@ const isString = (value: unknown): value is string => typeof value === 'string';
  */
 export function createSidecarHost(options: SidecarHostOptions): SidecarHost {
   const { send, mgr } = options;
-  const alertHost = createAlertHost();
+  const sendAlert = <E extends keyof AlertEvents>(event: E, data: AlertEvents[E]) => send(event, data);
+  // A delivery names its Session, so Rust routes it to the window showing it.
+  const alertHost = createAlertHost({ deliver: (delivery) => sendAlert('alert:deliver', delivery) });
   const alerts = alertHost.manager;
 
-  const sendAlert = <E extends keyof AlertEvents>(event: E, data: AlertEvents[E]) => send(event, data);
   const publishState = (id: string, state: AlertState) => sendAlert('alert:state', { id, ...state });
   const stops = [
     alertHost.watched.subscribe((names) => sendAlert('alert:watchedCommands', { names })),
diff --git a/lib/src/lib/alert-delivery-model.ts b/lib/src/lib/alert-delivery-model.ts
index 5bf16e3e8..e87fff07b 100644
--- a/lib/src/lib/alert-delivery-model.ts
+++ b/lib/src/lib/alert-delivery-model.ts
@@ -1,5 +1,9 @@
 import { clampAlertDelayMs, type AlertSettings } from './alert-settings-model';
 
+/** The two alarm sinks (`docs/specs/alert.md` -> Alarm settings). */
+export type AlertSink = 'speech' | 'push';
+export const ALERT_SINKS: readonly AlertSink[] = ['speech', 'push'];
+
 /** Missing fields inherit the application default; null voice selects the system voice. */
 export type AlertDeliveryOverrides = Partial<Pick<AlertSettings, 'speakEnabled' | 'speakDelayMs' | 'pushEnabled' | 'pushDelayMs'>> & {
   /** A local engine voice URI; the engine default when missing or unavailable. */
@@ -30,3 +34,13 @@ export function resolveAlertDeliveryPolicy(defaults: AlertSettings, overrides: A
     ...overrides,
   };
 }
+
+/** Whether `policy` turns `sink` on. */
+export function sinkEnabled(policy: AlertDeliveryPolicy, sink: AlertSink): boolean {
+  return sink === 'speech' ? policy.speakEnabled : policy.pushEnabled;
+}
+
+/** How long after an episode starts `policy` delivers to `sink`. */
+export function sinkDelayMs(policy: AlertDeliveryPolicy, sink: AlertSink): number {
+  return sink === 'speech' ? policy.speakDelayMs : policy.pushDelayMs;
+}
diff --git a/lib/src/lib/alert-delivery-policy.test.ts b/lib/src/lib/alert-delivery-policy.test.ts
index 5cc3b6e94..3baa6e3c1 100644
--- a/lib/src/lib/alert-delivery-policy.test.ts
+++ b/lib/src/lib/alert-delivery-policy.test.ts
@@ -1,30 +1,24 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
 vi.mock('./platform', () => ({ getPlatform: () => ({ alertPublishSettings: vi.fn() }) }));
 import { normalizeAlertDeliveryOverrides, resolveAlertDeliveryPolicy } from './alert-delivery-model';
-import { getSessionAlertPolicy, subscribeToAlertDeliveryPolicy } from './alert-delivery-policy';
+import { collectDeliveryOverrides, getSessionAlertPolicy } from './alert-delivery-policy';
 import { applyAlertSettingsFromHost, DEFAULT_ALERT_SETTINGS } from './alert-settings';
 import { createWorkspace, renameWorkspace, resetWorkspaces, setWorkspaceAlertDelivery } from './workspace-store';
 import { resetWorkspaceSurfaces, setWorkspaceSurfaces } from './workspace-surfaces';
-import { clearTerminalActivity, setTerminalActivity } from './session-activity-store';
-import { watchUnattendedRings } from './alert-ring-watch';
-import { forgetAlertDelivery, getAlertDeliveryReceipts, markAlertConsumed, pauseAlertDelivery, restoreAlertDelivery, resumeAlertDelivery, snapshotAlertDelivery } from './alert-delivery-state';
 import { readPersistedSession, readPersistedWindow } from './session-types';
 import { getWindowSnapshot, publishWorkspaceSession, resetWindowSessionAggregator } from './window-session-aggregator';
 
-let stop: (() => void) | undefined;
+/**
+ * A Workspace's sparse delivery overrides (`docs/specs/alert.md` -> Alarm
+ * settings): how they persist, how a Session resolves them, and what the
+ * renderer publishes to the host's scheduler. The scheduling itself is
+ * `alert-delivery-scheduler.test.ts`.
+ */
+
 beforeEach(() => {
-  vi.useFakeTimers(); resetWorkspaces(); resetWorkspaceSurfaces(); clearTerminalActivity();
-  resetWindowSessionAggregator(); forgetAlertDelivery(['pane']);
+  resetWorkspaces(); resetWorkspaceSurfaces(); resetWindowSessionAggregator();
   applyAlertSettingsFromHost(DEFAULT_ALERT_SETTINGS);
 });
-afterEach(() => { stop?.(); stop = undefined; clearTerminalActivity(); forgetAlertDelivery(['pane']); vi.useRealTimers(); });
-const ring = () => { setTerminalActivity('pane', { status: 'NOTHING_TO_SHOW' }); setTerminalActivity('pane', { status: 'ALERT_RINGING' }); };
-function watch() {
-  const fire = vi.fn();
-  stop = watchUnattendedRings({ sink: 'speech', enabled: id => getSessionAlertPolicy(id).speakEnabled,
-    delayMs: id => getSessionAlertPolicy(id).speakDelayMs, subscribe: subscribeToAlertDeliveryPolicy, fire });
-  return fire;
-}
 function workspace() {
   const ws = createWorkspace({ id: 'ws' });
   setWorkspaceSurfaces(ws.id, ['pane']);
@@ -50,66 +44,19 @@ describe('workspace delivery policy', () => {
     setWorkspaceAlertDelivery(id, {});
     expect(getWindowSnapshot().workspaces[0].session).not.toHaveProperty('alertDelivery');
   });
-  it('cancels immediately on disable and never replays when enabled again', () => {
-    const id = workspace(); const fire = watch(); ring();
-    vi.advanceTimersByTime(500);
-    setWorkspaceAlertDelivery(id, { speakEnabled: false });
-    setWorkspaceAlertDelivery(id, { speakEnabled: true });
-    vi.advanceTimersByTime(60_000);
-    expect(fire).not.toHaveBeenCalled();
-  });
-  it('keeps an admitted deadline through later delay edits', () => {
-    const id = workspace(); const fire = watch(); ring();
-    vi.advanceTimersByTime(500);
-    setWorkspaceAlertDelivery(id, { speakEnabled: true, speakDelayMs: 50_000 });
-    vi.advanceTimersByTime(500);
-    expect(fire).toHaveBeenCalledTimes(1);
-  });
-  it('suspends pending delivery and restores its deadline on hand-back', () => {
-    workspace(); const fire = watch(); ring();
-    vi.advanceTimersByTime(500); pauseAlertDelivery(['pane']);
-    vi.advanceTimersByTime(5000);
-    expect(fire).not.toHaveBeenCalled();
-    resumeAlertDelivery(['pane']); vi.advanceTimersByTime(0);
-    expect(fire).toHaveBeenCalledTimes(1);
-  });
-  it('consumes a suspended receipt when its sink is disabled, so hand-back never replays it', () => {
-    const id = workspace(); const fire = watch(); ring();
-    vi.advanceTimersByTime(500); pauseAlertDelivery(['pane']);
-    setWorkspaceAlertDelivery(id, { speakEnabled: false, speakDelayMs: 1000 });
-    setWorkspaceAlertDelivery(id, { speakEnabled: true, speakDelayMs: 1000 });
-    resumeAlertDelivery(['pane']); vi.advanceTimersByTime(60_000);
-    expect(fire).not.toHaveBeenCalled();
-  });
-  it('never re-arms a receipt forgotten on the same episode', () => {
-    workspace(); const fire = watch(); ring();
-    vi.advanceTimersByTime(500);
-    forgetAlertDelivery(['pane']);
-    vi.advanceTimersByTime(60_000);
-    expect(fire).not.toHaveBeenCalled();
-    expect(getAlertDeliveryReceipts('speech').get('pane')?.phase).toBe('consumed');
-  });
-  it('prunes receipts of Sessions that left while no watcher ran', () => {
-    workspace(); watch(); ring();
-    stop!(); stop = undefined;
-    clearTerminalActivity();
-    expect(getAlertDeliveryReceipts('speech').has('pane')).toBe(true);
-    watch();
-    expect(getAlertDeliveryReceipts('speech').has('pane')).toBe(false);
-  });
-  it('continues an unadmitted queue item in a fresh watcher, but never a delivered receipt', () => {
-    workspace(); const fire = watch(); ring(); vi.advanceTimersByTime(1000);
-    expect(fire).toHaveBeenCalledTimes(1);
-    pauseAlertDelivery(['pane']);
-    const handoff = snapshotAlertDelivery('pane');
-    stop!(); restoreAlertDelivery('pane', handoff);
-    const destination = watch(); resumeAlertDelivery(['pane']); vi.advanceTimersByTime(0);
-    expect(destination).toHaveBeenCalledTimes(1);
-    const receipt = getAlertDeliveryReceipts('speech').get('pane')!;
-    markAlertConsumed('speech', 'pane', receipt.episodeId);
-    const delivered = snapshotAlertDelivery('pane');
-    stop!(); restoreAlertDelivery('pane', delivered);
-    const third = watch(); vi.advanceTimersByTime(60_000);
-    expect(third).not.toHaveBeenCalled();
+  it('resolves a member Session under its Workspace, and one without membership under the defaults', () => {
+    workspace();
+    expect(getSessionAlertPolicy('pane')).toMatchObject({ speakEnabled: true, speakDelayMs: 1000, pushEnabled: false });
+    expect(getSessionAlertPolicy('elsewhere')).toMatchObject({ speakEnabled: false, speakDelayMs: DEFAULT_ALERT_SETTINGS.speakDelayMs });
+  });
+  it('publishes every member Session with its Workspace\'s overrides, an empty one included', () => {
+    workspace();
+    createWorkspace({ id: 'plain' });
+    setWorkspaceSurfaces('plain', ['a', 'b']);
+    expect(collectDeliveryOverrides()).toEqual({
+      pane: { speakEnabled: true, speakDelayMs: 1000 },
+      a: {},
+      b: {},
+    });
   });
 });
diff --git a/lib/src/lib/alert-delivery-policy.ts b/lib/src/lib/alert-delivery-policy.ts
index 083c8a54e..8d37836a5 100644
--- a/lib/src/lib/alert-delivery-policy.ts
+++ b/lib/src/lib/alert-delivery-policy.ts
@@ -10,24 +10,25 @@ function sessionWorkspaceId(sessionId: string): string | null {
   return null;
 }
 
-const incoming = new Map<string, AlertDeliveryOverrides>();
-/** Policy during the interval before the arriving Workspace mounts. */
-export function setIncomingAlertPolicy(ids: readonly string[], overrides?: AlertDeliveryOverrides): void {
-  for (const id of ids) {
-    if (overrides) incoming.set(id, overrides);
-    else incoming.delete(id);
-  }
-}
-
-/** Application defaults under the sparse overrides of the Session's Workspace
- *  (staged, else current); a Session with neither uses the defaults. */
+/** Application defaults under the sparse overrides of the Session's
+ *  Workspace; a Session with none uses the defaults. */
 export function getSessionAlertPolicy(sessionId: string): AlertDeliveryPolicy {
   const workspaceId = sessionWorkspaceId(sessionId);
-  const overrides = incoming.get(sessionId) ?? (workspaceId === null ? undefined : getWorkspace(workspaceId)?.alertDelivery);
-  return resolveAlertDeliveryPolicy(getAlertSettings(), overrides);
+  return resolveAlertDeliveryPolicy(getAlertSettings(), workspaceId === null ? undefined : getWorkspace(workspaceId)?.alertDelivery);
 }
 
 export function subscribeToAlertDeliveryPolicy(listener: () => void): () => void {
   const stops = [subscribeToAlertSettings(listener), subscribeToWorkspaces(listener), subscribeToWorkspaceSurfaces(listener)];
   return () => stops.forEach((stop) => stop());
 }
+
+/** Every member Surface of this realm's Workspaces, with its Workspace's
+ *  sparse overrides: what the host's delivery scheduler is told. */
+export function collectDeliveryOverrides(): Record<string, AlertDeliveryOverrides> {
+  const overrides: Record<string, AlertDeliveryOverrides> = {};
+  for (const [workspaceId, ids] of getWorkspaceSurfacesSnapshot()) {
+    const workspace = getWorkspace(workspaceId)?.alertDelivery ?? {};
+    for (const id of ids) overrides[id] = workspace;
+  }
+  return overrides;
+}
diff --git a/lib/src/lib/alert-delivery-scheduler.test.ts b/lib/src/lib/alert-delivery-scheduler.test.ts
new file mode 100644
index 000000000..fb55eba92
--- /dev/null
+++ b/lib/src/lib/alert-delivery-scheduler.test.ts
@@ -0,0 +1,173 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { AlertManager } from './alert-manager';
+import { createAlertDeliveryScheduler, type AlertDelivery, type AlertDeliveryScheduler } from './alert-delivery-scheduler';
+import { DEFAULT_ALERT_SETTINGS, type AlertSettings } from './alert-settings-model';
+import { engage, leave, REPORT } from './alert-manager-test-utils';
+
+/**
+ * When a ring is spoken or pushed (`docs/specs/alert.md` -> Alarm settings):
+ * decided beside the manager, once per sink per episode, at the episode's start
+ * plus the delay, and only if the user is not looking (speech) or not here at
+ * all (push) when it comes due.
+ */
+
+const PANE = 'pane';
+const OTHER = 'other';
+const SPEAK_MS = 10_000;
+const PUSH_MS = 20_000;
+
+let manager: AlertManager;
+let scheduler: AlertDeliveryScheduler;
+let settings: AlertSettings;
+let delivered: AlertDelivery[];
+
+const sinks = () => delivered.map((delivery) => delivery.sink);
+const ring = (id = PANE) => manager.notifyFromProtocol(id, REPORT);
+/** Clear the ring with a click, then ring again on fresh output. */
+const ringAgain = () => {
+  manager.acknowledge(PANE, { input: false });
+  manager.onData(PANE);
+  ring();
+};
+
+beforeEach(() => {
+  vi.useFakeTimers();
+  manager = new AlertManager();
+  settings = { ...DEFAULT_ALERT_SETTINGS, speakEnabled: true, speakDelayMs: SPEAK_MS, pushEnabled: true, pushDelayMs: PUSH_MS };
+  delivered = [];
+  scheduler = createAlertDeliveryScheduler({
+    manager,
+    defaults: () => settings,
+    deliver: (delivery) => void delivered.push(delivery),
+  });
+});
+
+afterEach(() => {
+  scheduler.dispose();
+  manager.dispose();
+  vi.useRealTimers();
+});
+
+describe('the delivery scheduler', () => {
+  it('delivers each sink once per episode, its delay after the episode started', () => {
+    ring();
+    const episodeId = manager.getState(PANE).episode!.id;
+    vi.advanceTimersByTime(SPEAK_MS - 1);
+    expect(delivered).toEqual([]);
+    vi.advanceTimersByTime(1);
+    expect(delivered).toEqual([{ sink: 'speech', id: PANE, episodeId }]);
+    vi.advanceTimersByTime(PUSH_MS - SPEAK_MS);
+    expect(delivered.at(-1)).toEqual({ sink: 'push', id: PANE, episodeId });
+
+    // A second report joining the episode publishes its detail, and delivers
+    // nothing more.
+    manager.notifyFromProtocol(PANE, { source: 'OSC 9', title: null, body: 'deploy failed' });
+    expect(manager.getState(PANE)).toMatchObject({ episode: { id: episodeId }, notification: { body: 'deploy failed' } });
+    vi.advanceTimersByTime(10 * PUSH_MS);
+    expect(sinks()).toEqual(['speech', 'push']);
+  });
+
+  it('never speaks at the pane the user is looking at, nor pushes to a user who is here', () => {
+    ring();
+    // Looking at it does not clear the ring; only a gesture acknowledges.
+    engage(manager, PANE);
+    vi.advanceTimersByTime(PUSH_MS);
+    expect(manager.getState(PANE).status).toBe('ALERT_RINGING');
+    expect(delivered).toEqual([]);
+
+    // A deadline that failed is consumed, never retried.
+    leave(manager);
+    vi.advanceTimersByTime(10 * PUSH_MS);
+    expect(delivered).toEqual([]);
+  });
+
+  it('speaks at a pane the user is not looking at, and pushes only once they are away', () => {
+    ring();
+    engage(manager, OTHER);
+    vi.advanceTimersByTime(PUSH_MS);
+    expect(sinks()).toEqual(['speech']);
+
+    ringAgain();
+    leave(manager);
+    vi.advanceTimersByTime(PUSH_MS);
+    expect(sinks()).toEqual(['speech', 'speech', 'push']);
+  });
+
+  it('cancels what a cleared ring had pending, and gives the next episode its own delay', () => {
+    ring();
+    vi.advanceTimersByTime(SPEAK_MS / 2);
+    ringAgain();
+    vi.advanceTimersByTime(SPEAK_MS - 1);
+    expect(delivered).toEqual([]);
+    vi.advanceTimersByTime(1);
+    expect(delivered).toEqual([{ sink: 'speech', id: PANE, episodeId: manager.getState(PANE).episode!.id }]);
+  });
+
+  it('consumes pending work when a sink turns off, and never replays it when it turns back on', () => {
+    ring();
+    vi.advanceTimersByTime(SPEAK_MS / 2);
+    scheduler.publish('main', { [PANE]: { speakEnabled: false } });
+    scheduler.publish('main', { [PANE]: { speakEnabled: true } });
+    settings = { ...settings, pushEnabled: false };
+    scheduler.recheck();
+    settings = { ...settings, pushEnabled: true };
+    vi.advanceTimersByTime(10 * PUSH_MS);
+    expect(delivered).toEqual([]);
+  });
+
+  it('keeps a deadline through a later delay edit', () => {
+    ring();
+    vi.advanceTimersByTime(SPEAK_MS / 2);
+    scheduler.publish('main', { [PANE]: { speakDelayMs: 60_000 } });
+    vi.advanceTimersByTime(SPEAK_MS / 2);
+    expect(sinks()).toEqual(['speech']);
+  });
+
+  it('never delivers an episode that began with its sink off', () => {
+    settings = { ...settings, speakEnabled: false, pushEnabled: false };
+    ring();
+    settings = { ...settings, speakEnabled: true, pushEnabled: true };
+    scheduler.recheck();
+    vi.advanceTimersByTime(10 * PUSH_MS);
+    expect(delivered).toEqual([]);
+  });
+});
+
+describe('published policy', () => {
+  it('resolves a Session\'s Workspace overrides over the defaults, delay included', () => {
+    settings = { ...settings, speakEnabled: false, pushEnabled: false };
+    scheduler.publish('main', { [PANE]: { speakEnabled: true, speakDelayMs: 2_000 }, [OTHER]: {} });
+    ring();
+    ring(OTHER);
+    vi.advanceTimersByTime(2_000);
+    expect(delivered).toEqual([{ sink: 'speech', id: PANE, episodeId: manager.getState(PANE).episode!.id }]);
+  });
+
+  it('keeps the last realm to publish a Session, whichever of the two publishes next', () => {
+    scheduler.publish('source', { [PANE]: { speakEnabled: true } });
+    scheduler.publish('target', { [PANE]: { speakEnabled: false } });
+    // The source lets it go after the target took it: the target's stands.
+    scheduler.publish('source', {});
+    expect(scheduler.policy(PANE).speakEnabled).toBe(false);
+    // A realm dropping a Session it last published returns it to the defaults.
+    scheduler.publish('target', {});
+    expect(scheduler.policy(PANE).speakEnabled).toBe(true);
+  });
+
+  it('keeps a live Session\'s overrides past its realm\'s end, and drops a gone one\'s', () => {
+    ring();
+    scheduler.publish('main', { [PANE]: { pushEnabled: false }, [OTHER]: { pushEnabled: false } });
+    scheduler.endRealm('main');
+    expect(scheduler.policy(PANE).pushEnabled).toBe(false);
+    expect(scheduler.policy(OTHER).pushEnabled).toBe(true);
+  });
+
+  it('revalidates what a realm publishes', () => {
+    scheduler.publish('main', { [PANE]: { speakEnabled: false } });
+    scheduler.publish('main', null);
+    scheduler.publish('main', [{ speakEnabled: true }]);
+    expect(scheduler.policy(PANE).speakEnabled).toBe(false);
+    scheduler.publish('main', { [PANE]: { speakEnabled: 'no', speakDelayMs: Number.NaN, pushDelayMs: -5 } });
+    expect(scheduler.policy(PANE)).toMatchObject({ speakEnabled: true, speakDelayMs: SPEAK_MS, pushDelayMs: 1_000 });
+  });
+});
diff --git a/lib/src/lib/alert-delivery-scheduler.ts b/lib/src/lib/alert-delivery-scheduler.ts
new file mode 100644
index 000000000..699e18a5f
--- /dev/null
+++ b/lib/src/lib/alert-delivery-scheduler.ts
@@ -0,0 +1,152 @@
+import type { AlertManager, AlertState } from './alert-manager';
+import {
+  ALERT_SINKS,
+  normalizeAlertDeliveryOverrides,
+  resolveAlertDeliveryPolicy,
+  sinkDelayMs,
+  sinkEnabled,
+  type AlertDeliveryOverrides,
+  type AlertDeliveryPolicy,
+  type AlertSink,
+} from './alert-delivery-model';
+import type { AlertSettings } from './alert-settings-model';
+
+/**
+ * When a ring is spoken or pushed (`docs/specs/alert.md` -> Alarm settings),
+ * decided in the host beside the `AlertManager`, which sees every episode from
+ * its start and outlives every renderer. The renderer only performs a delivery:
+ * speech needs `window.speechSynthesis`, and both need the Pane's label.
+ * Platform-free, like the manager: both hosts run it inside `createAlertHost`.
+ */
+
+/** One due delivery, for the realm showing its Session to perform. `id` is the
+ *  Session, named so standalone routes it to the window showing it. */
+export interface AlertDelivery {
+  sink: AlertSink;
+  id: string;
+  episodeId: string;
+}
+
+export interface AlertDeliverySchedulerOptions {
+  manager: Pick<AlertManager, 'onStateChange' | 'has' | 'isEngaged' | 'viewerIds'>;
+  /** The application defaults, read at every decision. */
+  defaults: () => AlertSettings;
+  deliver: (delivery: AlertDelivery) => void;
+}
+
+export interface AlertDeliveryScheduler {
+  /**
+   * One realm's Sessions, each with its Workspace's sparse overrides,
+   * revalidated. Replaces what that realm published before, except a Session
+   * another realm has published since.
+   */
+  publish(realmId: string, overrides: unknown): void;
+  /** The realm is gone: what it published for Sessions that are gone too goes. */
+  endRealm(realmId: string): void;
+  /** The defaults changed. */
+  recheck(): void;
+  /** The Session's effective policy: the defaults under its published overrides. */
+  policy(id: string): AlertDeliveryPolicy;
+  dispose(): void;
+}
+
+/** One sink's record of one episode: pending while it has a timer, consumed after. */
+interface Receipt {
+  episodeId: string;
+  timer: ReturnType<typeof setTimeout> | null;
+}
+
+export function createAlertDeliveryScheduler(options: AlertDeliverySchedulerOptions): AlertDeliveryScheduler {
+  const { manager } = options;
+  const receipts: Record<AlertSink, Map<string, Receipt>> = { speech: new Map(), push: new Map() };
+  /** Each Session's overrides, and the realm that last published them. */
+  const published = new Map<string, { realmId: string; overrides: AlertDeliveryOverrides }>();
+
+  const policy = (id: string): AlertDeliveryPolicy =>
+    resolveAlertDeliveryPolicy(options.defaults(), published.get(id)?.overrides);
+
+  const consume = (receipt: Receipt | undefined): void => {
+    if (receipt?.timer) clearTimeout(receipt.timer);
+    if (receipt) receipt.timer = null;
+  };
+
+  /** The deadline of an episode still ringing (its end consumed the receipt):
+   *  still on, and still owed. A deadline that fails is consumed, never
+   *  retried. */
+  function due(sink: AlertSink, id: string, receipt: Receipt): void {
+    receipt.timer = null;
+    if (!sinkEnabled(policy(id), sink)) return;
+    // Speech never talks over the pane the user is looking at; a push goes
+    // only to a user away from every viewer (rationale).
+    if (sink === 'speech' ? manager.isEngaged(id) : manager.viewerIds().length > 0) return;
+    options.deliver({ sink, id, episodeId: receipt.episodeId });
+  }
+
+  function onState(id: string, state: AlertState): void {
+    const episode = state.status === 'ALERT_RINGING' ? state.episode ?? null : null;
+    for (const sink of ALERT_SINKS) {
+      const current = receipts[sink].get(id);
+      if (!episode) {
+        consume(current);
+        receipts[sink].delete(id);
+        continue;
+      }
+      // At most once per sink per episode: a source joining it delivers nothing.
+      if (current?.episodeId === episode.id) continue;
+      consume(current);
+      const effective = policy(id);
+      const receipt: Receipt = { episodeId: episode.id, timer: null };
+      receipts[sink].set(id, receipt);
+      // Off at the start consumes it: turning the sink on never replays it.
+      if (!sinkEnabled(effective, sink)) continue;
+      // Fixed here, so a later delay edit never moves it.
+      const dueAt = episode.startedAt + sinkDelayMs(effective, sink);
+      receipt.timer = setTimeout(() => due(sink, id, receipt), Math.max(0, dueAt - Date.now()));
+    }
+  }
+
+  function recheck(): void {
+    for (const sink of ALERT_SINKS) {
+      for (const [id, receipt] of receipts[sink]) {
+        if (receipt.timer && !sinkEnabled(policy(id), sink)) consume(receipt);
+      }
+    }
+  }
+
+  const stop = manager.onStateChange(onState);
+
+  return {
+    publish(realmId, raw) {
+      if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return;
+      const next = new Map<string, AlertDeliveryOverrides>();
+      for (const [id, value] of Object.entries(raw)) {
+        if (id) next.set(id, normalizeAlertDeliveryOverrides(value));
+      }
+      for (const [id, entry] of published) {
+        if (entry.realmId === realmId && !next.has(id)) published.delete(id);
+      }
+      for (const [id, overrides] of next) published.set(id, { realmId, overrides });
+      recheck();
+    },
+
+    endRealm(realmId) {
+      // A live Session keeps them: a reloading or recreated realm publishes
+      // again, and a VS Code view's Sessions outlive its disposal.
+      for (const [id, entry] of published) {
+        if (entry.realmId === realmId && !manager.has(id)) published.delete(id);
+      }
+    },
+
+    recheck,
+    policy,
+
+    dispose() {
+      stop();
+      for (const sink of ALERT_SINKS) {
+        for (const receipt of receipts[sink].values()) consume(receipt);
+        receipts[sink].clear();
+      }
+      published.clear();
+    },
+  };
+}
diff --git a/lib/src/lib/alert-delivery-state.ts b/lib/src/lib/alert-delivery-state.ts
deleted file mode 100644
index 86696b1a2..000000000
--- a/lib/src/lib/alert-delivery-state.ts
+++ /dev/null
@@ -1,60 +0,0 @@
-/** Volatile delivery receipts. They travel only in an explicit live handoff. */
-export type AlertSink = 'speech' | 'push';
-const SINKS = ['speech', 'push'] as const;
-export interface AlertDeliveryReceipt {
-  episodeId: string;
-  dueAt: number;
-  /** `queued` is fired but not yet admitted to the sink; `consumed` never replays. */
-  phase: 'pending' | 'queued' | 'consumed';
-}
-export type AlertDeliveryHandoff = Partial<Record<AlertSink, AlertDeliveryReceipt>>;
-const receipts: Record<AlertSink, Map<string, AlertDeliveryReceipt>> = { speech: new Map(), push: new Map() };
-const paused = new Set<string>();
-const listeners = new Set<() => void>();
-const notify = () => listeners.forEach((listener) => listener());
-export const getAlertDeliveryReceipts = (sink: AlertSink) => receipts[sink];
-export const isAlertDeliveryPaused = (id: string) => paused.has(id);
-/** Fires on pause, resume, and forget; a phase change is read at the next scan. */
-export function subscribeToAlertDeliveryOwnership(listener: () => void): () => void {
-  listeners.add(listener);
-  return () => { listeners.delete(listener); };
-}
-export function pauseAlertDelivery(ids: readonly string[]): void {
-  for (const id of ids) paused.add(id);
-  notify();
-}
-export function resumeAlertDelivery(ids: readonly string[]): void {
-  for (const id of ids) {
-    paused.delete(id);
-    for (const sink of SINKS) {
-      const receipt = receipts[sink].get(id);
-      if (receipt?.phase === 'queued') receipt.phase = 'pending';
-    }
-  }
-  notify();
-}
-export function snapshotAlertDelivery(id: string): AlertDeliveryHandoff {
-  return Object.fromEntries(SINKS.flatMap((sink) => {
-    const receipt = receipts[sink].get(id);
-    return receipt ? [[sink, { ...receipt }]] : [];
-  }));
-}
-export function restoreAlertDelivery(id: string, handoff: AlertDeliveryHandoff): void {
-  for (const sink of SINKS) {
-    const receipt = handoff[sink];
-    if (receipt) receipts[sink].set(id, { ...receipt, phase: receipt.phase === 'queued' ? 'pending' : receipt.phase });
-    else receipts[sink].delete(id);
-  }
-}
-/** Admitted to the sink, or dropped for good: either way this episode never replays. */
-export function markAlertConsumed(sink: AlertSink, id: string, episodeId: string): void {
-  const receipt = receipts[sink].get(id);
-  if (receipt?.episodeId === episodeId) receipt.phase = 'consumed';
-}
-export function forgetAlertDelivery(ids: readonly string[]): void {
-  for (const id of ids) {
-    paused.delete(id);
-    for (const sink of SINKS) receipts[sink].delete(id);
-  }
-  notify();
-}
diff --git a/lib/src/lib/alert-delivery.test.ts b/lib/src/lib/alert-delivery.test.ts
new file mode 100644
index 000000000..dfac089d0
--- /dev/null
+++ b/lib/src/lib/alert-delivery.test.ts
@@ -0,0 +1,94 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { FakePtyAdapter, setPlatform } from './platform';
+import type { BurrowLink } from './platform/types';
+import { startAlertDelivery } from './alert-delivery';
+import { speechQueue } from './speech-queue';
+import { DEFAULT_ALERT_SETTINGS, updateAlertSettings } from './alert-settings';
+import { clearTerminalActivity, initAlertStateReceiver } from './session-activity-store';
+import { createWorkspace, resetWorkspaces, setWorkspaceAlertDelivery } from './workspace-store';
+import { resetWorkspaceSurfaces, setWorkspaceSurfaces } from './workspace-surfaces';
+
+/**
+ * A realm's half of ring delivery (`docs/specs/alert.md` -> Alarm settings),
+ * against the fake adapter's real in-process host: the realm publishes its
+ * Workspaces' overrides, the host decides when, and the realm performs.
+ */
+
+const PANE = 'pane';
+let platform: FakePtyAdapter;
+let spoken: string[];
+let stop: (() => void) | null;
+
+function ring(): void {
+  platform.sendOutput(PANE, '\x1b]9;build finished\x07');
+}
+
+beforeEach(() => {
+  vi.useFakeTimers();
+  spoken = [];
+  vi.stubGlobal('speechSynthesis', { speak: (utterance: { text: string }) => void spoken.push(utterance.text), cancel: () => {} });
+  vi.stubGlobal('SpeechSynthesisUtterance', class { constructor(readonly text: string) {} });
+  resetWorkspaces();
+  resetWorkspaceSurfaces();
+  clearTerminalActivity();
+  platform = new FakePtyAdapter();
+  setPlatform(platform);
+  initAlertStateReceiver();
+  updateAlertSettings({ ...DEFAULT_ALERT_SETTINGS, speakEnabled: true, speakDelayMs: 1_000 });
+  platform.setScenario(PANE, { name: 'none', chunks: [] });
+  platform.spawnPty(PANE);
+  stop = startAlertDelivery();
+});
+
+afterEach(() => {
+  stop?.();
+  speechQueue.clear();
+  updateAlertSettings(DEFAULT_ALERT_SETTINGS);
+  platform.shutdown();
+  clearTerminalActivity();
+  vi.unstubAllGlobals();
+  vi.useRealTimers();
+});
+
+describe('alert delivery', () => {
+  it('speaks the pane label when the host says a ring is due', () => {
+    ring();
+    vi.advanceTimersByTime(999);
+    expect(spoken).toEqual([]);
+    vi.advanceTimersByTime(1);
+    expect(spoken).toEqual(['terminal']);
+  });
+
+  it('tells the host its Workspaces\' overrides, once per change', () => {
+    const publish = vi.spyOn(platform, 'alertPublishDeliveryPolicy');
+    updateAlertSettings({ speakEnabled: false });
+    const workspace = createWorkspace({ id: 'ws' });
+    setWorkspaceSurfaces(workspace.id, [PANE]);
+    setWorkspaceAlertDelivery(workspace.id, { speakEnabled: true, speakDelayMs: 3_000 });
+    // A Lath commit with the same members is no news.
+    setWorkspaceSurfaces(workspace.id, [PANE]);
+    expect(publish.mock.calls.at(-1)).toEqual([{ [PANE]: { speakEnabled: true, speakDelayMs: 3_000 } }]);
+    expect(publish).toHaveBeenCalledTimes(2);
+
+    ring();
+    vi.advanceTimersByTime(3_000);
+    expect(spoken).toEqual(['terminal']);
+  });
+
+  it('pushes through the Burrow with the pane label', async () => {
+    const command = vi.fn(async () => ({}));
+    platform.burrow = { command } as unknown as BurrowLink;
+    updateAlertSettings({ speakEnabled: false, pushEnabled: true, pushDelayMs: 1_000 });
+    ring();
+    vi.advanceTimersByTime(1_000);
+    expect(command).toHaveBeenCalledExactlyOnceWith('push', { sessionId: PANE, title: 'terminal' });
+  });
+
+  it('performs nothing once stopped', () => {
+    stop!();
+    stop = null;
+    ring();
+    vi.advanceTimersByTime(60_000);
+    expect(spoken).toEqual([]);
+  });
+});
diff --git a/lib/src/lib/alert-delivery.ts b/lib/src/lib/alert-delivery.ts
new file mode 100644
index 000000000..4d134e9e3
--- /dev/null
+++ b/lib/src/lib/alert-delivery.ts
@@ -0,0 +1,55 @@
+import type { AlertDelivery } from './alert-delivery-scheduler';
+import { collectDeliveryOverrides } from './alert-delivery-policy';
+import { startAlertSpeech } from './alert-speech';
+import { getPlatform } from './platform';
+import { deriveSessionLabel } from './session-label';
+import { subscribeToWorkspaces } from './workspace-store';
+import { subscribeToWorkspaceSurfaces } from './workspace-surfaces';
+
+/**
+ * This realm's half of ring delivery (`docs/specs/alert.md` -> Alarm
+ * settings). The host decides when a ring is spoken or pushed; the realm tells
+ * it what only the renderer knows — which Workspace each Session is in, and
+ * that Workspace's overrides — and performs what it is handed, which needs the
+ * Pane's label and, for speech, `window.speechSynthesis`.
+ */
+
+/** The running performer, if any. The platform keeps its handlers for the
+ *  renderer's lifetime, so this stable one is registered and never removed. */
+let perform: ((delivery: AlertDelivery) => void) | null = null;
+const onDeliver = (delivery: AlertDelivery): void => perform?.(delivery);
+
+export function startAlertDelivery(): () => void {
+  const platform = getPlatform();
+  const speaker = startAlertSpeech();
+
+  let published: string | null = null;
+  const publish = (): void => {
+    const overrides = collectDeliveryOverrides();
+    // Every Lath commit and Workspace edit lands here; only a change is news.
+    const key = JSON.stringify(overrides);
+    if (key === published) return;
+    published = key;
+    platform.alertPublishDeliveryPolicy(overrides);
+  };
+  const stops = [subscribeToWorkspaces(publish), subscribeToWorkspaceSurfaces(publish)];
+  publish();
+
+  platform.onAlertDeliver(onDeliver);
+  perform = (delivery) => {
+    if (delivery.sink === 'speech') {
+      speaker.speak(delivery.id, delivery.episodeId);
+      return;
+    }
+    // The Burrow's service reads its own ACL at send time; a host with none
+    // has no link, and an un-enrolled one sends nothing.
+    void platform.burrow?.command('push', { sessionId: delivery.id, title: deriveSessionLabel(delivery.id) })
+      .catch(() => {});
+  };
+
+  return () => {
+    perform = null;
+    stops.forEach((stop) => stop());
+    speaker.stop();
+  };
+}
diff --git a/lib/src/lib/alert-manager.ts b/lib/src/lib/alert-manager.ts
index 82e173ab4..ea4a82f15 100644
--- a/lib/src/lib/alert-manager.ts
+++ b/lib/src/lib/alert-manager.ts
@@ -287,6 +287,9 @@ interface AlertEntry {
   progress: ActiveProtocolProgress | null;
   commandExitWatch: CommandExitWatch | null;
   pendingCommandLine: string | null;
+  /** The running or last command's display text: all a host with no renderer
+   *  can call the Session (`docs/specs/alert.md` -> Alarm settings). */
+  lastCommand: string | null;
   todo: TodoState;
   notification: ActivityNotification | null;
   /**
@@ -583,7 +586,7 @@ export class AlertManager {
     detail: ActivityNotification,
     deferrable = true,
   ): void {
-    if (this.engaged(id)) {
+    if (this.isEngaged(id)) {
       this.hold(entry, source, detail);
     } else if (source === 'report' && deferrable) {
       this.deliverReport(id, entry, detail);
@@ -890,12 +893,13 @@ export class AlertManager {
     // Every command boundary silently ends a progress cycle the program never
     // closed, so a later stray clear finds nothing to complete.
     entry.progress = null;
+    entry.lastCommand = resolved.displayCommand;
     entry.commandExitWatch = {
       displayCommand: resolved.displayCommand,
       watchKey: resolved.rawCommandLine === null ? null : commandWatchKey(resolved.rawCommandLine),
       source: resolved.source,
       startedAt: resolved.startedAt,
-      seen: this.engaged(id),
+      seen: this.isEngaged(id),
     };
     // Every command boundary starts the detector over, so one command's output
     // history can never leak into the next one's busy/quiet reading.
@@ -1096,8 +1100,9 @@ export class AlertManager {
 
   // --- Engagement (`docs/specs/alert.md` -> Engagement) ---
 
-  /** Some present viewer points at `id`. The only thing the ring rules read. */
-  private engaged(id: string): boolean {
+  /** Some present viewer points at `id`: all the ring rules read, and what
+   *  keeps a spoken alarm from the pane the user is looking at. */
+  isEngaged(id: string): boolean {
     for (const focusId of this.viewers.values()) {
       if (focusId === id) return true;
     }
@@ -1119,13 +1124,13 @@ export class AlertManager {
     // Only this viewer moved, so only the Sessions it pointed at can change.
     const touched = [...new Set([before, after])]
       .filter((id): id is string => typeof id === 'string')
-      .map((id) => ({ id, was: this.engaged(id) }));
+      .map((id) => ({ id, was: this.isEngaged(id) }));
     if (after === undefined) this.viewers.delete(viewerId);
     else this.viewers.set(viewerId, after);
 
     for (const { id, was } of touched) {
       const entry = this.entries.get(id);
-      if (!entry || this.inert(id) || this.engaged(id) === was) continue;
+      if (!entry || this.inert(id) || this.isEngaged(id) === was) continue;
       if (!was) {
         this.markSeen(entry);
       } else if (lapse === 'idle' && focusId === id) {
@@ -1250,6 +1255,11 @@ export class AlertManager {
     };
   }
 
+  /** The running or last command's display text, else null. */
+  lastCommand(id: string): string | null {
+    return this.entries.get(id)?.lastCommand ?? null;
+  }
+
   /** Whether `id` has state to publish: an entry that is not a helper's.
    *  Exactly the ids {@link getAllStates} answers. */
   has(id: string): boolean {
@@ -1374,7 +1384,7 @@ export class AlertManager {
     // from real output, so it is the more informative of the two.
     if (this.isWatching(entry)) return entry.detector.getStatus();
     // Armed: a seen command running while nobody engages it.
-    if (entry.commandExitWatch?.seen && !this.engaged(id)) return 'COMMAND_EXIT_ARMED';
+    if (entry.commandExitWatch?.seen && !this.isEngaged(id)) return 'COMMAND_EXIT_ARMED';
     return 'WATCHING_DISABLED';
   }
 
@@ -1388,6 +1398,7 @@ export class AlertManager {
         progress: null,
         commandExitWatch: null,
         pendingCommandLine: null,
+        lastCommand: null,
         todo: false,
         notification: null,
         deferred: null,
diff --git a/lib/src/lib/alert-resumed-output.test.ts b/lib/src/lib/alert-resumed-output.test.ts
index f9d738e4e..d5aaf94a9 100644
--- a/lib/src/lib/alert-resumed-output.test.ts
+++ b/lib/src/lib/alert-resumed-output.test.ts
@@ -1,14 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-vi.mock('./platform', () => ({
-  getPlatform: () => ({ alertPublishSettings: vi.fn() }),
-}));
-
 import { AlertManager } from './alert-manager';
-import { watchUnattendedRings } from './alert-ring-watch';
-import { startAlertSpeech } from './alert-speech';
-import { applyAlertSettingsFromHost, DEFAULT_ALERT_SETTINGS } from './alert-settings';
-import { clearTerminalActivity, setTerminalActivity } from './session-activity-store';
+import { createAlertDeliveryScheduler, type AlertDeliveryScheduler } from './alert-delivery-scheduler';
+import { DEFAULT_ALERT_SETTINGS } from './alert-settings-model';
 import { cfg } from '../cfg';
 import { armCommandExit, driveToBusy, finishCommand, runCommand, settle } from './alert-manager-test-utils';
 
@@ -16,38 +9,30 @@ const ID = 'resumed-watched-work';
 const WATCHED = 'longtask';
 const DELAY = 10_000;
 let manager: AlertManager;
-let stopSpeech: () => void;
-let stopPush: () => void;
+let scheduler: AlertDeliveryScheduler;
+/** The host's deliveries, one call per sink. */
 let spoken: ReturnType<typeof vi.fn>;
 let pushed: ReturnType<typeof vi.fn>;
 
 beforeEach(() => {
   vi.useFakeTimers();
-  clearTerminalActivity();
   spoken = vi.fn();
   pushed = vi.fn();
-  vi.stubGlobal('speechSynthesis', { speak: spoken, cancel: vi.fn() });
-  vi.stubGlobal('SpeechSynthesisUtterance', class {
-    constructor(readonly text: string) {}
-  });
-  applyAlertSettingsFromHost({ ...DEFAULT_ALERT_SETTINGS, speakEnabled: true, speakDelayMs: DELAY });
   manager = new AlertManager();
   manager.setDeferAlertsUntilQuiet(true);
-  manager.onStateChange(setTerminalActivity);
   manager.setWatchedCommands([WATCHED]);
   runCommand(manager, ID, WATCHED);
-  stopSpeech = startAlertSpeech();
-  // Push shares the ring watcher; exercise its delivery decision without a Relay.
-  stopPush = watchUnattendedRings({ sink: 'push', subscribe: () => () => {}, enabled: () => true, delayMs: () => DELAY, fire: pushed });
+  const settings = { ...DEFAULT_ALERT_SETTINGS, speakEnabled: true, speakDelayMs: DELAY, pushEnabled: true, pushDelayMs: DELAY };
+  scheduler = createAlertDeliveryScheduler({
+    manager,
+    defaults: () => settings,
+    deliver: ({ sink, id, episodeId }) => (sink === 'speech' ? spoken : pushed)(id, episodeId),
+  });
 });
 
 afterEach(() => {
-  stopPush();
-  stopSpeech();
+  scheduler.dispose();
   manager.dispose();
-  clearTerminalActivity();
-  applyAlertSettingsFromHost(DEFAULT_ALERT_SETTINGS);
-  vi.unstubAllGlobals();
   vi.useRealTimers();
 });
 
@@ -80,7 +65,7 @@ describe('WATCHING output resuming before alarm delivery', () => {
     expect(pushed).not.toHaveBeenCalled();
     vi.advanceTimersByTime(1);
     expect(spoken).toHaveBeenCalledOnce();
-    expect(pushed).toHaveBeenCalledExactlyOnceWith(ID, manager.getState(ID).episode);
+    expect(pushed).toHaveBeenCalledExactlyOnceWith(ID, manager.getState(ID).episode!.id);
   });
 
   it('keeps an inferred ring through a short redraw that never confirms BUSY', () => {
diff --git a/lib/src/lib/alert-ring-watch.test.ts b/lib/src/lib/alert-ring-watch.test.ts
deleted file mode 100644
index 8bdd898b3..000000000
--- a/lib/src/lib/alert-ring-watch.test.ts
+++ /dev/null
@@ -1,209 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-vi.mock('./platform', () => ({
-  getPlatform: () => ({ alertPublishSettings: vi.fn() }),
-}));
-
-import { watchUnattendedRings } from './alert-ring-watch';
-import { clearTerminalActivity, setTerminalActivity } from './session-activity-store';
-import type { SessionStatus } from './alert-manager';
-
-const DELAY_MS = 10_000;
-
-/** Session ids handed to the sink, in order. */
-let fired: string[];
-let stop: (() => void) | null = null;
-let enabled = true;
-let delayMs = DELAY_MS;
-
-/** Drive one Session's projected status through the activity store. */
-function setStatus(id: string, status: SessionStatus): void {
-  setTerminalActivity(id, { status });
-}
-
-/**
- * Ring a Session the store already knows about. A real pane is in the activity
- * store from the moment it is created and only reaches ALERT_RINGING later, so
- * a ring is always a transition from some earlier status — which is exactly
- * what the watcher keys on.
- */
-function ring(id: string): void {
-  setStatus(id, 'NOTHING_TO_SHOW');
-  setStatus(id, 'ALERT_RINGING');
-}
-
-/** Start the watcher after any pre-existing state has been staged. */
-function start(): void {
-  stop = watchUnattendedRings({
-    sink: 'speech',
-    subscribe: () => () => {},
-    enabled: () => enabled,
-    delayMs: () => delayMs,
-    fire: (id) => fired.push(id),
-  });
-}
-
-beforeEach(() => {
-  vi.useFakeTimers();
-  fired = [];
-  enabled = true;
-  delayMs = DELAY_MS;
-  clearTerminalActivity();
-});
-
-afterEach(() => {
-  stop?.();
-  stop = null;
-  clearTerminalActivity();
-  vi.useRealTimers();
-});
-
-/**
- * The machine behind every alarm sink (`docs/specs/alert.md` -> Alarm
- * settings). Spoken alarms and push notifications share it, so these are the
- * rules both inherit; each sink's own test covers only its payload and its
- * settings field.
- */
-describe('watchUnattendedRings', () => {
-  it('fires once the delay elapses with the ring unattended', () => {
-    start();
-    ring('pty-1');
-
-    vi.advanceTimersByTime(DELAY_MS - 1);
-    expect(fired).toEqual([]);
-
-    vi.advanceTimersByTime(1);
-    expect(fired).toEqual(['pty-1']);
-  });
-
-  it('cancels when the user attends before the delay elapses', () => {
-    start();
-    ring('pty-1');
-
-    vi.advanceTimersByTime(DELAY_MS - 1);
-    setStatus('pty-1', 'NOTHING_TO_SHOW');
-
-    vi.advanceTimersByTime(60_000);
-    expect(fired).toEqual([]);
-  });
-
-  it('cancels when the pane is killed during the delay', () => {
-    start();
-    ring('pty-1');
-
-    vi.advanceTimersByTime(DELAY_MS - 1);
-    clearTerminalActivity('pty-1');
-
-    vi.advanceTimersByTime(60_000);
-    expect(fired).toEqual([]);
-  });
-
-  it('does not schedule anything while the sink is disabled', () => {
-    enabled = false;
-    start();
-    ring('pty-1');
-
-    vi.advanceTimersByTime(60_000);
-    expect(fired).toEqual([]);
-  });
-
-  it('drops a scheduled fire if the sink is switched off during the delay', () => {
-    start();
-    ring('pty-1');
-
-    vi.advanceTimersByTime(DELAY_MS - 1);
-    enabled = false;
-
-    vi.advanceTimersByTime(60_000);
-    expect(fired).toEqual([]);
-  });
-
-  it('fires exactly once per ring, not once per store notification', () => {
-    start();
-    ring('pty-1');
-    // Unrelated churn in the store — a rerender, a TODO toggle, another pane.
-    setTerminalActivity('pty-1', { status: 'ALERT_RINGING', todo: true });
-    setStatus('pty-2', 'BUSY');
-
-    vi.advanceTimersByTime(60_000);
-    expect(fired).toEqual(['pty-1']);
-  });
-
-  it('fires again after a ring is cleared and a fresh one arrives', () => {
-    start();
-    ring('pty-1');
-    vi.advanceTimersByTime(DELAY_MS);
-
-    setStatus('pty-1', 'NOTHING_TO_SHOW');
-    setStatus('pty-1', 'ALERT_RINGING');
-    vi.advanceTimersByTime(DELAY_MS);
-
-    expect(fired).toEqual(['pty-1', 'pty-1']);
-  });
-
-  it('is silent for a Session first seen already ringing (restore / reconnect)', () => {
-    // `docs/specs/alert.md`: a ring must come from a fresh transition, never
-    // from a remount or a restored snapshot. For push this is the difference
-    // between "works" and "buzzes your phone every time you open your laptop".
-    setStatus('restored', 'ALERT_RINGING');
-    start();
-
-    vi.advanceTimersByTime(60_000);
-    expect(fired).toEqual([]);
-  });
-
-  it('is silent for a whole restored session blob, not just one pane', () => {
-    // Standalone restores its session blob at launch, so several panes can
-    // arrive already latched at once.
-    for (const id of ['restored-1', 'restored-2', 'restored-3']) {
-      setStatus(id, 'ALERT_RINGING');
-    }
-    start();
-
-    vi.advanceTimersByTime(60_000);
-    expect(fired).toEqual([]);
-  });
-
-  it('fires for each ringing Session independently', () => {
-    start();
-    ring('pty-1');
-    vi.advanceTimersByTime(4_000);
-    ring('pty-2');
-
-    vi.advanceTimersByTime(DELAY_MS - 4_000);
-    expect(fired).toEqual(['pty-1']);
-
-    vi.advanceTimersByTime(4_000);
-    expect(fired).toEqual(['pty-1', 'pty-2']);
-  });
-
-  it('fires for every pane that rings at the same moment', () => {
-    start();
-    ring('pty-1');
-    ring('pty-2');
-    ring('pty-3');
-
-    vi.advanceTimersByTime(DELAY_MS);
-    expect(fired.sort()).toEqual(['pty-1', 'pty-2', 'pty-3']);
-  });
-
-  it('reads the delay when the ring is scheduled', () => {
-    delayMs = 2_000;
-    start();
-    ring('pty-1');
-
-    vi.advanceTimersByTime(2_000);
-    expect(fired).toEqual(['pty-1']);
-  });
-
-  it('cancels everything pending when disposed', () => {
-    start();
-    ring('pty-1');
-
-    stop?.();
-    stop = null;
-
-    vi.advanceTimersByTime(60_000);
-    expect(fired).toEqual([]);
-  });
-});
diff --git a/lib/src/lib/alert-ring-watch.ts b/lib/src/lib/alert-ring-watch.ts
deleted file mode 100644
index 90352d94d..000000000
--- a/lib/src/lib/alert-ring-watch.ts
+++ /dev/null
@@ -1,72 +0,0 @@
-import type { AlertEpisode } from './alert-episode';
-import { getActivity, getActivitySnapshot, subscribeToActivity } from './session-activity-store';
-import { getAlertDeliveryReceipts, isAlertDeliveryPaused, subscribeToAlertDeliveryOwnership, type AlertSink } from './alert-delivery-state';
-
-/** Shared renderer-side episode→delay→recheck machine for alarm sinks. */
-export interface UnattendedRingWatch {
-  readonly sink: AlertSink;
-  readonly enabled: (sessionId: string) => boolean;
-  /** Read on admission; changing a delay never moves an existing deadline. */
-  readonly delayMs: (sessionId: string) => number;
-  readonly fire: (sessionId: string, episode: AlertEpisode) => void;
-  /** Policy changes that must re-run the scan, beside activity and ownership. */
-  readonly subscribe: (listener: () => void) => () => void;
-  /** Runs after every scan, on the same notifications, so a sink needs no subscriptions of its own. */
-  readonly afterScan?: () => void;
-}
-
-export function watchUnattendedRings(watch: UnattendedRingWatch): () => void {
-  const observed = new Map<string, string | null>();
-  const receipts = getAlertDeliveryReceipts(watch.sink);
-  const pending = new Map<string, ReturnType<typeof setTimeout>>();
-  const cancel = (id: string): void => {
-    const timer = pending.get(id);
-    if (timer !== undefined) clearTimeout(timer);
-    pending.delete(id);
-  };
-  const onActivityChange = (): void => {
-    const snapshot = getActivitySnapshot();
-    for (const [id, state] of snapshot) {
-      const episode = state.status === 'ALERT_RINGING' ? state.episode : null;
-      const previous = observed.get(id);
-      observed.set(id, episode?.id ?? null);
-      if (!episode) { cancel(id); receipts.delete(id); continue; }
-      let receipt = receipts.get(id);
-      if (receipt?.episodeId !== episode.id) {
-        cancel(id);
-        // Fresh means observed after a different episode. First sight seeds
-        // silently, and a forgotten receipt on the same episode never re-arms.
-        const fresh = previous !== undefined && previous !== episode.id;
-        receipt = { episodeId: episode.id, dueAt: episode.startedAt + watch.delayMs(id),
-          phase: fresh && watch.enabled(id) ? 'pending' : 'consumed' };
-        receipts.set(id, receipt);
-      }
-      // Disabling consumes the receipt even while suspended for a move.
-      if (!watch.enabled(id)) { receipt.phase = 'consumed'; cancel(id); continue; }
-      if (isAlertDeliveryPaused(id)) { cancel(id); continue; }
-      if (receipt.phase !== 'pending' || pending.has(id)) continue;
-      const delivery = receipt;
-      pending.set(id, setTimeout(() => {
-        pending.delete(id);
-        if (getActivity(id).episode?.id !== episode.id || !watch.enabled(id) || isAlertDeliveryPaused(id)) return;
-        delivery.phase = 'queued';
-        watch.fire(id, episode);
-      }, Math.max(0, receipt.dueAt - Date.now())));
-    }
-    // Receipts outlive a watcher, so prune ids that left while none ran too.
-    for (const id of new Set([...observed.keys(), ...receipts.keys()])) {
-      if (snapshot.has(id)) continue;
-      observed.delete(id);
-      cancel(id);
-      if (!isAlertDeliveryPaused(id)) receipts.delete(id);
-    }
-    watch.afterScan?.();
-  };
-  onActivityChange();
-  const stops = [subscribeToActivity(onActivityChange), subscribeToAlertDeliveryOwnership(onActivityChange), watch.subscribe(onActivityChange)];
-  return () => {
-    stops.forEach((stop) => stop());
-    for (const timer of pending.values()) clearTimeout(timer);
-    pending.clear();
-  };
-}
diff --git a/lib/src/lib/alert-settings-host.ts b/lib/src/lib/alert-settings-host.ts
index 82f76e43c..7968c5bf7 100644
--- a/lib/src/lib/alert-settings-host.ts
+++ b/lib/src/lib/alert-settings-host.ts
@@ -13,8 +13,8 @@ export type AlertSettingsTarget = Pick<AlertManager, 'applySettings'>;
  * The first renderer seeds persisted settings after a fresh host start; later
  * renderers receive that canonical state instead of replacing it.
  *
- * `AlertManager.applySettings` takes the host-owned fields. Renderer-only sink
- * fields are held so every webview reads back the same values
+ * `AlertManager.applySettings` takes the detection fields; the sink fields are
+ * the delivery scheduler's defaults, read through `current`
  * (`docs/specs/alert.md` -> Alarm settings).
  */
 export class AlertSettingsHost {
@@ -40,6 +40,11 @@ export class AlertSettingsHost {
     this.publish();
   }
 
+  /** The blob in force: the shipped defaults until a renderer seeds one. */
+  get current(): AlertSettings {
+    return this.settings;
+  }
+
   subscribe(listener: (settings: AlertSettings) => void): () => void {
     this.listeners.add(listener);
     return () => {
diff --git a/lib/src/lib/alert-settings-model.ts b/lib/src/lib/alert-settings-model.ts
index 5bfc37c93..4f38c75b0 100644
--- a/lib/src/lib/alert-settings-model.ts
+++ b/lib/src/lib/alert-settings-model.ts
@@ -15,13 +15,13 @@ export interface AlertSettings {
   inactivityTimeoutMs: number;
   /** Delay terminal-notification rings behind confirmed animation. */
   deferAlertsUntilQuiet: boolean;
-  /** Speak an unattended alarm out loud after `speakDelayMs`. */
+  /** Speak a ring out loud after `speakDelayMs`, unless its pane is the one being looked at. */
   speakEnabled: boolean;
-  /** ms after a ring before speaking, if the ring is still unattended. */
+  /** ms after a ring starts before speaking, if it is still ringing. */
   speakDelayMs: number;
-  /** Push an unattended alarm to paired phones after `pushDelayMs`. */
+  /** Push a ring to paired phones after `pushDelayMs`, if the user is away from Dormouse. */
   pushEnabled: boolean;
-  /** ms after a ring before pushing, if the ring is still unattended. */
+  /** ms after a ring starts before pushing, if it is still ringing. */
   pushDelayMs: number;
 }
 
diff --git a/lib/src/lib/alert-speech.test.ts b/lib/src/lib/alert-speech.test.ts
index 5d16a7148..28e7ba0ba 100644
--- a/lib/src/lib/alert-speech.test.ts
+++ b/lib/src/lib/alert-speech.test.ts
@@ -5,21 +5,19 @@ vi.mock('./platform', () => ({
   getPlatform: () => ({ alertPublishSettings: vi.fn() }),
 }));
 
-import { startAlertSpeech, toSpokenText } from './alert-speech';
+import { startAlertSpeech, toSpokenText, type AlertSpeaker } from './alert-speech';
 import { getAlertSpeechState } from './alert-speech-state';
 import { applyAlertSettingsFromHost, DEFAULT_ALERT_SETTINGS } from './alert-settings';
-import { clearTerminalActivity, setTerminalActivity } from './session-activity-store';
+import { clearTerminalActivity, getActivity, setTerminalActivity } from './session-activity-store';
 import type { SessionStatus } from './alert-manager';
 import { removeTerminalPaneState, resetTerminalPaneState } from './terminal-state-store';
 import type { TerminalTitleSource } from './terminal-state';
 
-const SPEAK_DELAY_MS = 10_000;
-
 /** Utterances passed to the stubbed Web Speech API, in order. */
 let spoken: string[];
 let utterances: StubUtterance[];
 let cancelCount: number;
-let stopSpeech: (() => void) | null = null;
+let speaker: AlertSpeaker | null = null;
 
 interface StubUtterance {
   text: string;
@@ -58,26 +56,26 @@ function setStatus(id: string, status: SessionStatus): void {
   setTerminalActivity(id, { status });
 }
 
-/**
- * Ring a Session that the store already knows about. A real pane is in the
- * activity store from the moment it is created and only reaches ALERT_RINGING
- * later, so a ring is always a transition from some earlier status — that is
- * exactly what the watcher keys on.
- */
+/** Open a new ring, and with it a new episode. */
 function ring(id: string): void {
   setStatus(id, 'NOTHING_TO_SHOW');
   setStatus(id, 'ALERT_RINGING');
 }
 
+/** The host's speech deliveries come due for each Session's current episode. */
+function due(...ids: string[]): void {
+  for (const id of ids) speaker!.speak(id, getActivity(id).episode!.id);
+}
+
 /**
- * Two Sessions ring inside one speak window: the first is being read aloud, the
+ * Two Sessions' deliveries arrive together: the first is being read aloud, the
  * second waits in Dormouse's queue behind it.
  */
 function ringTwoWithFirstSpeaking(): void {
   start();
   ring('pty-1');
   ring('pty-2');
-  vi.advanceTimersByTime(SPEAK_DELAY_MS);
+  due('pty-1', 'pty-2');
   utterances[0].onstart?.();
 }
 
@@ -85,12 +83,12 @@ beforeEach(() => {
   vi.useFakeTimers();
   stubSpeechSynthesis();
   clearTerminalActivity();
-  applyAlertSettingsFromHost({ ...DEFAULT_ALERT_SETTINGS, speakEnabled: true, speakDelayMs: SPEAK_DELAY_MS });
+  applyAlertSettingsFromHost({ ...DEFAULT_ALERT_SETTINGS, speakEnabled: true });
 });
 
 afterEach(() => {
-  stopSpeech?.();
-  stopSpeech = null;
+  speaker?.stop();
+  speaker = null;
   speechQueue.clear();
   for (const id of ['osc0-title', 'osc2-title', 'osc9-title']) removeTerminalPaneState(id);
   clearTerminalActivity();
@@ -99,9 +97,9 @@ afterEach(() => {
   vi.unstubAllGlobals();
 });
 
-/** Start the watcher after any pre-existing state has been staged. */
+/** Start the performer after any pre-existing state has been staged. */
 function start(): void {
-  stopSpeech = startAlertSpeech();
+  speaker = startAlertSpeech();
 }
 
 /**
@@ -165,19 +163,17 @@ describe('toSpokenText', () => {
 });
 
 /**
- * Only the speech-specific half lives here: the payload that reaches the
- * engine, and that the sink is wired to `speakEnabled`. The ring/delay/cancel
- * rules are shared with push and covered in `alert-ring-watch.test.ts`.
+ * The performer: what reaches the engine once the host hands this realm a
+ * delivery, and what cuts it off. When a delivery comes due is the host's
+ * (`alert-delivery-scheduler.test.ts`).
  */
 describe('spoken alarms', () => {
-  it('speaks the pane label once the delay elapses with the ring unattended', () => {
+  it('speaks the pane label of the episode the host hands it', () => {
     start();
     ring('pty-1');
-
-    vi.advanceTimersByTime(SPEAK_DELAY_MS - 1);
     expect(spoken).toEqual([]);
 
-    vi.advanceTimersByTime(1);
+    due('pty-1');
     expect(spoken).toEqual(['terminal']);
   });
 
@@ -216,7 +212,7 @@ describe('spoken alarms', () => {
         setStatus(id, 'ALERT_RINGING');
       }
     }
-    vi.advanceTimersByTime(SPEAK_DELAY_MS);
+    due(...sources.map((source) => `${source}-title`));
 
     utterances[0].onend?.();
     utterances[1].onend?.();
@@ -227,32 +223,27 @@ describe('spoken alarms', () => {
     ]);
   });
 
-  it('speaks nothing while speakEnabled is off', () => {
+  it('drops a delivery that crossed speakEnabled turning off', () => {
     applyAlertSettingsFromHost({ ...DEFAULT_ALERT_SETTINGS, speakEnabled: false });
     start();
     ring('pty-1');
-
-    vi.advanceTimersByTime(60_000);
+    due('pty-1');
     expect(spoken).toEqual([]);
   });
 
-  it('uses speakDelayMs as the delay', () => {
-    applyAlertSettingsFromHost({
-      ...DEFAULT_ALERT_SETTINGS,
-      speakEnabled: true,
-      speakDelayMs: 3_000,
-    });
+  it('drops a delivery for an episode that already ended', () => {
     start();
     ring('pty-1');
-
-    vi.advanceTimersByTime(3_000);
-    expect(spoken).toEqual(['terminal']);
+    const stale = getActivity('pty-1').episode!.id;
+    ring('pty-1');
+    speaker!.speak('pty-1', stale);
+    expect(spoken).toEqual([]);
   });
 
   it('publishes SPEAKING on actual start, then SPOKEN on end', () => {
     start();
     ring('pty-1');
-    vi.advanceTimersByTime(SPEAK_DELAY_MS);
+    due('pty-1');
 
     expect(getAlertSpeechState('pty-1')).toBeNull();
     utterances[0].onstart?.();
@@ -265,7 +256,7 @@ describe('spoken alarms', () => {
   it('keeps SPOKEN through unrelated churn while the ring remains unresolved', () => {
     start();
     ring('pty-1');
-    vi.advanceTimersByTime(SPEAK_DELAY_MS);
+    due('pty-1');
     utterances[0].onstart?.();
     utterances[0].onend?.();
 
@@ -277,7 +268,7 @@ describe('spoken alarms', () => {
   it('cuts the utterance off and clears delivery state when the ring clears', () => {
     start();
     ring('pty-1');
-    vi.advanceTimersByTime(SPEAK_DELAY_MS);
+    due('pty-1');
     utterances[0].onstart?.();
     expect(getAlertSpeechState('pty-1')).toBe('speaking');
 
@@ -307,17 +298,15 @@ describe('spoken alarms', () => {
     ringTwoWithFirstSpeaking();
 
     // Resolve pty-2 while its first utterance is still queued, then ring it
-    // again. The new ring must serve its own delay rather than inheriting the
-    // old queued entry when pty-1 is cut off.
+    // again. The new ring waits for its own delivery rather than inheriting
+    // the old queued entry when pty-1 is cut off.
     setStatus('pty-2', 'NOTHING_TO_SHOW');
     ring('pty-2');
     setStatus('pty-1', 'NOTHING_TO_SHOW');
 
     expect(cancelCount).toBe(1);
     expect(spoken).toHaveLength(1);
-    vi.advanceTimersByTime(SPEAK_DELAY_MS - 1);
-    expect(spoken).toHaveLength(1);
-    vi.advanceTimersByTime(1);
+    due('pty-2');
     expect(spoken).toHaveLength(2);
   });
 
@@ -345,7 +334,7 @@ describe('spoken alarms', () => {
   it('does not publish a queued utterance that starts after the ring was resolved', () => {
     start();
     ring('pty-1');
-    vi.advanceTimersByTime(SPEAK_DELAY_MS);
+    due('pty-1');
 
     setStatus('pty-1', 'NOTHING_TO_SHOW');
     utterances[0].onstart?.();
@@ -356,7 +345,7 @@ describe('spoken alarms', () => {
   it('records SPOKEN after an engine error if the utterance really began', () => {
     start();
     ring('pty-1');
-    vi.advanceTimersByTime(SPEAK_DELAY_MS);
+    due('pty-1');
     utterances[0].onstart?.();
     utterances[0].onerror?.();
 
@@ -366,11 +355,11 @@ describe('spoken alarms', () => {
   it('ignores an older ring starting after a newer ring has begun speaking', () => {
     start();
     ring('pty-1');
-    vi.advanceTimersByTime(SPEAK_DELAY_MS);
+    due('pty-1');
     const oldStart = utterances[0].onstart;
     const oldEnd = utterances[0].onend;
     ring('pty-1');
-    vi.advanceTimersByTime(SPEAK_DELAY_MS);
+    due('pty-1');
     const current = utterances[1];
     current.onstart?.();
     oldStart?.();
@@ -394,7 +383,7 @@ describe('spoken alarms', () => {
     start();
     ring('pty-1');
 
-    expect(() => vi.advanceTimersByTime(60_000)).not.toThrow();
+    expect(() => due('pty-1')).not.toThrow();
     expect(getAlertSpeechState('pty-1')).toBeNull();
   });
 
@@ -412,7 +401,7 @@ describe('spoken alarms', () => {
     };
     start();
     ring('pty-1');
-    vi.advanceTimersByTime(SPEAK_DELAY_MS);
+    due('pty-1');
 
     expect(getAlertSpeechState('pty-1')).toBe('spoken');
   });
@@ -425,12 +414,12 @@ describe('spoken alarms', () => {
   it('silences the engine on dispose, not just its callbacks', () => {
     start();
     ring('pty-1');
-    vi.advanceTimersByTime(SPEAK_DELAY_MS);
+    due('pty-1');
     utterances[0].onstart?.();
     expect(getAlertSpeechState('pty-1')).toBe('speaking');
 
-    stopSpeech?.();
-    stopSpeech = null;
+    speaker?.stop();
+    speaker = null;
 
     expect(cancelCount).toBe(1);
     expect(getAlertSpeechState('pty-1')).toBeNull();
@@ -443,7 +432,7 @@ describe('spoken alarms', () => {
     start();
     ring('pty-1');
     ring('pty-2');
-    vi.advanceTimersByTime(SPEAK_DELAY_MS);
+    due('pty-1', 'pty-2');
     const lateStart = utterances[0].onstart;
     const lateEnd = utterances[0].onend;
     expect(spoken).toHaveLength(1);
@@ -460,7 +449,7 @@ describe('spoken alarms', () => {
   it('bounds the pending queue without feeding an unbounded browser backlog', () => {
     start();
     for (let i = 0; i < 100; i++) ring(`pty-${i}`);
-    vi.advanceTimersByTime(SPEAK_DELAY_MS);
+    for (let i = 0; i < 100; i++) due(`pty-${i}`);
     expect(spoken).toHaveLength(1);
     for (let i = 0; i < 65; i++) utterances[i].onend?.();
     expect(spoken).toHaveLength(65);
diff --git a/lib/src/lib/alert-speech.ts b/lib/src/lib/alert-speech.ts
index 2569f0bea..f1f5b53ae 100644
--- a/lib/src/lib/alert-speech.ts
+++ b/lib/src/lib/alert-speech.ts
@@ -1,19 +1,18 @@
-import { isAlertDeliveryPaused, markAlertConsumed } from './alert-delivery-state';
 import { getSessionAlertPolicy, subscribeToAlertDeliveryPolicy } from './alert-delivery-policy';
 import { speechQueue } from './speech-queue';
-import { watchUnattendedRings } from './alert-ring-watch';
 import {
   clearAlertSpeechState,
   clearAllAlertSpeechStates,
   getAlertSpeechSnapshot,
   setAlertSpeechState,
 } from './alert-speech-state';
-import { getActivity } from './session-activity-store';
+import { getActivity, subscribeToActivity } from './session-activity-store';
 import { deriveSessionLabel } from './session-label';
 import { redactHighEntropyTokens } from './redact-high-entropy';
 
-// Speech sink and sanitizer; alert-ring-watch owns ring timing/cancellation.
-// Engine callbacks publish transient renderer-local delivery state.
+// The speech sink and its sanitizer. The host decides when to speak
+// (`alert-delivery-scheduler.ts`); this performs it, publishing transient
+// renderer-local delivery state from the engine's callbacks.
 
 /** Longest utterance we will produce. A pane title has no useful upper bound. */
 const SPEECH_LIMIT = 120;
@@ -47,50 +46,50 @@ export function speakTestUtterance(voice?: string | null): boolean {
   });
 }
 
-/** One coordinator per renderer; Workspace policy is resolved per originating Session. */
-export function startAlertSpeech(): () => void {
+/** This realm's speech performer (`docs/specs/alert.md` -> Spoken alarms). */
+export interface AlertSpeaker {
+  /** Queue the Session's label for the episode the host scheduled. */
+  speak(id: string, episodeId: string): void;
+  stop(): void;
+}
+
+/** One per renderer; the voice and the enable are the Session's Workspace policy. */
+export function startAlertSpeech(): AlertSpeaker {
   clearAllAlertSpeechStates();
   const renderedEpisodes = new Map<string, string>();
   const eligible = (id: string, episodeId: string): boolean =>
-    !isAlertDeliveryPaused(id) && getActivity(id).episode?.id === episodeId && getSessionAlertPolicy(id).speakEnabled;
-  const stopRingWatch = watchUnattendedRings({
-    sink: 'speech',
-    enabled: (id) => getSessionAlertPolicy(id).speakEnabled,
-    delayMs: (id) => getSessionAlertPolicy(id).speakDelayMs,
-    subscribe: subscribeToAlertDeliveryPolicy,
-    fire: (id, episode) => {
-      const queued = speechQueue.enqueue({
-        key: episode.id,
+    getActivity(id).episode?.id === episodeId && getSessionAlertPolicy(id).speakEnabled;
+  // Drop pending work the ring clearing or the policy just resolved, cutting
+  // the current utterance off, and un-render speech whose episode ended.
+  const refresh = (): void => {
+    speechQueue.refresh();
+    for (const id of getAlertSpeechSnapshot().keys()) {
+      if (getActivity(id).episode?.id !== renderedEpisodes.get(id)) {
+        renderedEpisodes.delete(id);
+        clearAlertSpeechState(id);
+      }
+    }
+  };
+  const stops = [subscribeToActivity(refresh), subscribeToAlertDeliveryPolicy(refresh)];
+  return {
+    speak(id, episodeId) {
+      speechQueue.enqueue({
+        key: episodeId,
         text: () => toSpokenText(deriveSessionLabel(id)),
         voice: () => getSessionAlertPolicy(id).speakVoice,
-        eligible: () => eligible(id, episode.id),
-        // Consumed at admission: no acknowledgement ties audible sound to ownership (rationale).
-        onAdmit: () => markAlertConsumed('speech', id, episode.id),
-        onStart: () => { renderedEpisodes.set(id, episode.id); setAlertSpeechState(id, 'speaking'); },
+        eligible: () => eligible(id, episodeId),
+        onStart: () => { renderedEpisodes.set(id, episodeId); setAlertSpeechState(id, 'speaking'); },
         onFinish: (started) => {
-          if (!started) markAlertConsumed('speech', id, episode.id);
-          if (started && eligible(id, episode.id)) { setAlertSpeechState(id, 'spoken'); return; }
+          if (started && eligible(id, episodeId)) { setAlertSpeechState(id, 'spoken'); return; }
           renderedEpisodes.delete(id);
           clearAlertSpeechState(id);
         },
       });
-      if (!queued) markAlertConsumed('speech', id, episode.id);
     },
-    // Same notifications as the scan: drop pending work the scan just resolved,
-    // and un-render speech whose episode ended.
-    afterScan: () => {
-      speechQueue.refresh();
-      for (const id of getAlertSpeechSnapshot().keys()) {
-        if (getActivity(id).episode?.id !== renderedEpisodes.get(id)) {
-          renderedEpisodes.delete(id);
-          clearAlertSpeechState(id);
-        }
-      }
+    stop() {
+      stops.forEach((stop) => stop());
+      speechQueue.clear();
+      clearAllAlertSpeechStates();
     },
-  });
-  return () => {
-    stopRingWatch();
-    speechQueue.clear();
-    clearAllAlertSpeechStates();
   };
 }
diff --git a/lib/src/lib/platform/fake-adapter.ts b/lib/src/lib/platform/fake-adapter.ts
index 74a846141..af3e627cb 100644
--- a/lib/src/lib/platform/fake-adapter.ts
+++ b/lib/src/lib/platform/fake-adapter.ts
@@ -113,7 +113,7 @@ export class FakePtyAdapter implements PlatformAdapter {
   }
 
   private startAlertHost(): void {
-    const host = createAlertHost();
+    const host = createAlertHost({ deliver: (delivery) => void this.alerts.onEvent('alert:deliver', delivery) });
     const stops = [
       host.manager.onStateChange((id, state) => void this.alerts.onEvent('alert:state', { id, ...state })),
       host.watched.subscribe((names) => void this.alerts.onEvent('alert:watchedCommands', { names })),
diff --git a/lib/src/lib/platform/types.ts b/lib/src/lib/platform/types.ts
index ff93b91b5..88a96f110 100644
--- a/lib/src/lib/platform/types.ts
+++ b/lib/src/lib/platform/types.ts
@@ -1,6 +1,8 @@
 import type { HelperIdentity, TerminalContextRequest, TerminalContextInfo } from '../terminal-context-types';
 import type { AlertState, AwaitHandle, AwaitOptions, Engagement, EngagementLapse } from '../alert-manager';
 import type { AlertSettings } from '../alert-settings';
+import type { AlertDeliveryOverrides } from '../alert-delivery-model';
+import type { AlertDelivery } from '../alert-delivery-scheduler';
 import type { VSCodeWorkbenchCommand } from '../vscode-keybindings';
 import type { ShellEntry } from '../shell-defaults';
 // Defined in its own dependency-free file so the Node proxy in lib/src/host can
@@ -477,6 +479,12 @@ export interface PlatformAdapter {
    * Engagement), sent only when it changes; `lapse` says why presence ended.
    */
   alertEngagement(state: Engagement, lapse?: EngagementLapse): void;
+  /**
+   * Every Session this realm shows, each with its Workspace's sparse delivery
+   * overrides, for the host's delivery scheduler (`docs/specs/alert.md` ->
+   * Alarm settings). Replaces what this realm published before.
+   */
+  alertPublishDeliveryPolicy(overrides: Record<string, AlertDeliveryOverrides>): void;
   /** A human gesture reached the Session without input; input rides `writePty`'s `userInput`. */
   alertAcknowledge(id: string): void;
   alertToggleTodo(id: string): void;
@@ -499,6 +507,8 @@ export interface PlatformAdapter {
   onWatchedCommands(handler: (names: string[]) => void): void;
   /** Receive the host's canonical alarm settings. */
   onAlertSettings(handler: (settings: AlertSettings) => void): void;
+  /** Receive a spoken alarm or push the host scheduled, to perform. */
+  onAlertDeliver(handler: (delivery: AlertDelivery) => void): void;
 
   // State persistence
   saveState(state: unknown): void;
diff --git a/lib/src/lib/session-activity-store.ts b/lib/src/lib/session-activity-store.ts
index 0740b331a..4553a20fc 100644
--- a/lib/src/lib/session-activity-store.ts
+++ b/lib/src/lib/session-activity-store.ts
@@ -67,7 +67,7 @@ export function getLivePersistedAlertState(id: string): PersistedAlertState | nu
 export function setTerminalActivity(id: string, state: Partial<AlertState>): void {
   const previous = terminalActivity.get(id);
   // Older hosts and local fixtures have no episode field. Hydrate their status
-  // edges here; consumers still seed first-observed rings without delivery.
+  // edges here, so the ring burst still keys on one.
   const episode = state.status === 'ALERT_RINGING'
     ? state.episode ?? (previous?.status === 'ALERT_RINGING' ? previous.episode : null) ?? createAlertEpisode()
     : null;
diff --git a/lib/src/lib/speech-queue.ts b/lib/src/lib/speech-queue.ts
index 0165c8012..7f7313a61 100644
--- a/lib/src/lib/speech-queue.ts
+++ b/lib/src/lib/speech-queue.ts
@@ -4,7 +4,6 @@ export interface SpeechJob {
   text: () => string;
   voice?: () => string | null;
   eligible: () => boolean;
-  onAdmit?: () => void;
   onStart?: () => void;
   onFinish?: (started: boolean) => void;
 }
@@ -104,7 +103,7 @@ export class SpeechQueue {
           job.onStart?.();
         };
         utterance.onend = utterance.onerror = () => this.finish(attempt);
-        try { job.onAdmit?.(); synth.speak(utterance); }
+        try { synth.speak(utterance); }
         catch { this.finish(attempt); }
         // Synchronous completion clears active; loop advances without recursion.
       }
diff --git a/lib/src/remote/burrow/activation.test.ts b/lib/src/remote/burrow/activation.test.ts
index b2ed3e01b..27c695817 100644
--- a/lib/src/remote/burrow/activation.test.ts
+++ b/lib/src/remote/burrow/activation.test.ts
@@ -1,6 +1,7 @@
 /**
  * The webview's end of the Burrow service (`lib/src/host/remote/service.ts`): it
- * forwards console commands, mirrors the pairing queue, and reports rings. It
+ * forwards console commands, mirrors the pairing queue, and keeps the push
+ * device list. It
  * starts no `BurrowRuntime` of its own and holds no Burrow state — there is no
  * webview-resident mode left to fall back to, so a host with no service behind
  * it gets nothing at all.
@@ -10,19 +11,10 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import type { BurrowLink } from '../../lib/platform/types';
 
 const pushWatch = vi.hoisted(() => ({
-  fire: undefined as ((sessionId: string, title: string) => void) | undefined,
-  stopped: 0,
   invalidated: 0,
   loads: [] as Array<() => Promise<unknown>>,
 }));
 vi.mock('./alert-push', () => ({
-  watchPushRings: (fire: (sessionId: string, title: string) => void) => {
-    pushWatch.fire = fire;
-    return () => {
-      pushWatch.fire = undefined;
-      pushWatch.stopped += 1;
-    };
-  },
   commitPushDevices: async (load: () => Promise<unknown>) => {
     pushWatch.loads.push(load);
     await load();
@@ -48,8 +40,6 @@ vi.mock('../../lib/platform', () => ({
 
 beforeEach(() => {
   burrowLink = undefined;
-  pushWatch.fire = undefined;
-  pushWatch.stopped = 0;
   pushWatch.invalidated = 0;
   pushWatch.loads.length = 0;
   pushRefreshers.current.length = 0;
@@ -107,7 +97,7 @@ async function installBridge(link: FakeLink) {
   const mod = await import('./activation');
   const pairing = await import('./pairing-approval');
   mod.installBurrowConsoleHook();
-  // The `status` seed gates the ring watch and the queue seed behind it.
+  // The `status` seed gates the device fetch and the queue seed behind it.
   await settle();
   return { mod, pairing };
 }
@@ -311,17 +301,6 @@ describe('burrow bridge mode', () => {
     expect(link.commands.filter((c) => c.cmd === 'pairingQueue')).toHaveLength(1);
   });
 
-  it('reports rings with the label the webview derived', async () => {
-    const link = fakeLink();
-    await installBridge(link);
-
-    pushWatch.fire!('pty-1', 'pnpm dev');
-    expect(link.commands.at(-1)).toEqual({
-      cmd: 'push',
-      params: { sessionId: 'pty-1', title: 'pnpm dev' },
-    });
-  });
-
   it('asks the service for the device list the dialog names', async () => {
     const link = fakeLink();
     await installBridge(link);
@@ -335,13 +314,13 @@ describe('burrow bridge mode', () => {
   });
 
   it('arms nothing at all on a burrow that never enrolled', async () => {
-    // The common case: no ring watch, no device fetch, and no crossing per
+    // The common case: no device fetch, no queue seed, and no crossing per
     // activity change — only the one `status` that says so.
     const link = fakeLink();
     link.results.status = { enrolled: false };
     await installBridge(link);
 
-    expect(pushWatch.fire).toBeUndefined();
+    expect(link.commands.some((c) => c.cmd === 'pairingQueue')).toBe(false);
     expect(link.commands.some((c) => c.cmd === 'pushDevices')).toBe(false);
     expect(link.commands.some((c) => c.cmd === 'status')).toBe(true);
   });
@@ -354,13 +333,10 @@ describe('burrow bridge mode', () => {
     // An enroll from any webview reaches every webview as this event.
     link.emit('status', { name: 'status', enrolled: true });
     await settle();
-    expect(pushWatch.fire).toBeDefined();
     expect(link.commands.some((c) => c.cmd === 'pushDevices')).toBe(true);
 
     // `clearEnrollment` announces the same way.
     link.emit('status', { name: 'status', enrolled: false });
-    expect(pushWatch.fire).toBeUndefined();
-    expect(pushWatch.stopped).toBe(1);
     // The dialog must stop naming devices nothing can push to — including any
     // list still on the wire, which would otherwise put them back on arrival.
     expect(pushWatch.invalidated).toBe(1);
diff --git a/lib/src/remote/burrow/activation.ts b/lib/src/remote/burrow/activation.ts
index a3982287f..5399ab29b 100644
--- a/lib/src/remote/burrow/activation.ts
+++ b/lib/src/remote/burrow/activation.ts
@@ -6,7 +6,7 @@
  * The Burrow itself is a service in the process that owns the PTYs
  * (`lib/src/host/remote/service.ts`) — the Tauri sidecar, the VS Code extension
  * host. This module is its client: it forwards console commands, mirrors the
- * pairing queue, and reports rings. It starts no Burrow, holds no relay socket,
+ * pairing queue, and keeps the push device list. It starts no Burrow, holds no relay socket,
  * and reads no ACL. A host with no service behind it (the website) gets nothing
  * at all, which is why every entry point here tolerates a missing link.
  *
@@ -28,7 +28,7 @@ import type {
 import { getPlatform } from '../../lib/platform';
 import type { BurrowLink } from '../../lib/platform/types';
 import { clearPushDevices, setPushDevicesRefresher } from '../../lib/push-devices';
-import { commitPushDevices, invalidatePushDeviceRefreshes, watchPushRings } from './alert-push';
+import { commitPushDevices, invalidatePushDeviceRefreshes } from './alert-push';
 import { armWhileEnrolled } from './enrolled-gate';
 import {
   enqueuePairingApproval,
@@ -79,11 +79,6 @@ function installBridgeMode(link: BurrowLink): void {
   setPushDevicesRefresher(refresh);
 
   armWhileEnrolled(link, () => {
-    // Rings are detected here — the activity store and the pane labels are
-    // webview state — and delivered there, where the ACL is.
-    const stopRings = watchPushRings((sessionId, title) => {
-      void link.command('push', { sessionId, title }).catch(() => {});
-    });
     refresh();
     // Seeded on every transition to enrolled, not once at install: the service
     // pushes the queue only when it changes, so a webview that joins — or a
@@ -94,7 +89,6 @@ function installBridgeMode(link: BurrowLink): void {
       .then((queue) => mirrorPairingQueue(link, (queue ?? []) as PairingQueueItem[]))
       .catch(() => {});
     return () => {
-      stopRings();
       // The Burrow is gone, so the dialog must stop naming devices nothing can
       // reach — including any list still on the wire, which would otherwise put
       // them back the moment it lands. The refresher stays installed: the dialog
diff --git a/lib/src/remote/burrow/alert-push.test.ts b/lib/src/remote/burrow/alert-push.test.ts
index e18d8cedb..3a948b255 100644
--- a/lib/src/remote/burrow/alert-push.test.ts
+++ b/lib/src/remote/burrow/alert-push.test.ts
@@ -1,9 +1,5 @@
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
 
-vi.mock('../../lib/platform', () => ({
-  getPlatform: () => ({ alertPublishSettings: vi.fn() }),
-}));
-
 import {
   MAX_PUSH_QUERY_DELIVERY_IDS,
   fromBase64Url,
@@ -16,15 +12,11 @@ import {
   type NoiseKeyPair,
   type PushSendRequest,
 } from 'remote-lib-common';
-import { commitPushDevices, invalidatePushDeviceRefreshes, watchPushRings } from './alert-push';
+import { commitPushDevices, invalidatePushDeviceRefreshes } from './alert-push';
 // Delivery — the Relay calls, the recipient rule, the title bounds — runs in
 // the Burrow's process, so it lives beside neither webview nor sidecar.
 import { loadPushDevices, sendPush, toPushText, type AlertPushDeps } from './push-delivery';
-import { applyAlertSettingsFromHost, DEFAULT_ALERT_SETTINGS } from '../../lib/alert-settings';
 import { getPushDevices, resetPushDevices } from '../../lib/push-devices';
-import { clearTerminalActivity, setTerminalActivity } from '../../lib/session-activity-store';
-
-const PUSH_DELAY_MS = 20_000;
 
 const ENROLLMENT = { relayUrl: 'https://relay.example', burrowToken: 'burrow-token' };
 
@@ -76,8 +68,8 @@ function aclRecord(deliveryId: string, label: string): BurrowAclRecord {
 
 /**
  * A stand-in for the Burrow's seal: shape-correct, distinct per recipient, and
- * free of WebCrypto, so the ring-delay cases below stay deterministic under
- * fake timers. The real construction is driven with real keys in `sealed push`.
+ * free of WebCrypto, so the alarm cases below stay deterministic under fake
+ * timers. The real construction is driven with real keys in `sealed push`.
  */
 function fakeSeal(): AlertPushDeps['seal'] {
   let n = 0;
@@ -99,7 +91,6 @@ const realSeal: AlertPushDeps['seal'] = (clientStaticPublicKey, plaintext) =>
 let requests: Array<{ url: string; init?: RequestInit }>;
 let subscribed: string[];
 let records: BurrowAclRecord[];
-let stop: (() => void) | null = null;
 
 function fakeFetch(): typeof globalThis.fetch {
   return (async (input: RequestInfo | URL, init?: RequestInit) => {
@@ -131,17 +122,13 @@ function deps(overrides: Partial<AlertPushDeps> = {}): AlertPushDeps {
 }
 
 /**
- * The two shipped halves joined: the webview watches for rings and names the
- * Session (`watchPushRings`, in `activation.ts`), and the Burrow delivers with
- * its own ACL and swallows failures so a dead push never breaks the alert path
- * (`BurrowService.#push`). Wired here because they only meet across a
- * process boundary.
+ * One due push as the Burrow runs it (`BurrowService.#push`): with its own ACL,
+ * swallowing a failure so a dead push never breaks the alert path. When it is
+ * due is the host's scheduler's (`lib/src/lib/alert-delivery-scheduler.ts`).
  */
-function startPush(pushDeps: AlertPushDeps): () => void {
-  return watchPushRings((id, title) => {
-    void sendPush(pushDeps, id, title).catch((error: unknown) => {
-      console.warn('burrow: push notification failed', error);
-    });
+async function push(pushDeps: AlertPushDeps): Promise<void> {
+  await sendPush(pushDeps, 'pty-1', 'terminal').catch((error: unknown) => {
+    console.warn('burrow: push notification failed', error);
   });
 }
 
@@ -150,11 +137,6 @@ function refreshPushDevices(pushDeps: AlertPushDeps): Promise<void> {
   return commitPushDevices(() => loadPushDevices(pushDeps));
 }
 
-function ring(id: string): void {
-  setTerminalActivity(id, { status: 'NOTHING_TO_SHOW' });
-  setTerminalActivity(id, { status: 'ALERT_RINGING' });
-}
-
 /** The body of the last `push/send` request, parsed. */
 function lastSend(): PushSendRequest | null {
   const send = requests.filter((r) => r.url.endsWith('/api/push/send')).at(-1);
@@ -171,21 +153,11 @@ beforeEach(() => {
   requests = [];
   subscribed = [PHONE];
   records = [aclRecord(PHONE, 'iPhone Safari')];
-  clearTerminalActivity();
   resetPushDevices();
-  applyAlertSettingsFromHost({
-    ...DEFAULT_ALERT_SETTINGS,
-    pushEnabled: true,
-    pushDelayMs: PUSH_DELAY_MS,
-  });
 });
 
 afterEach(() => {
-  stop?.();
-  stop = null;
-  clearTerminalActivity();
   resetPushDevices();
-  applyAlertSettingsFromHost(DEFAULT_ALERT_SETTINGS);
   vi.useRealTimers();
 });
 
@@ -238,14 +210,8 @@ describe('toPushText', () => {
 });
 
 describe('alarm push', () => {
-  it('sends the pane label after the delay, tagged per Session', async () => {
-    stop = startPush(deps());
-    ring('pty-1');
-
-    await vi.advanceTimersByTimeAsync(PUSH_DELAY_MS - 1);
-    expect(lastSend()).toBeNull();
-
-    await vi.advanceTimersByTimeAsync(1);
+  it('sends the label sealed, tagged per Session', async () => {
+    await push(deps());
     expect(lastRecipients()).toEqual([PHONE]);
     // The label and the collapse tag are sealed, so nothing readable rides on
     // the request the Relay sees.
@@ -254,38 +220,14 @@ describe('alarm push', () => {
     expect(body).not.toContain('pty-1');
   });
 
-  it('sends nothing while pushEnabled is off', async () => {
-    applyAlertSettingsFromHost({ ...DEFAULT_ALERT_SETTINGS, pushEnabled: false });
-    stop = startPush(deps());
-    ring('pty-1');
-
-    await vi.advanceTimersByTimeAsync(60_000);
-    expect(lastSend()).toBeNull();
-  });
-
-  it('uses pushDelayMs as the delay', async () => {
-    applyAlertSettingsFromHost({
-      ...DEFAULT_ALERT_SETTINGS,
-      pushEnabled: true,
-      pushDelayMs: 5_000,
-    });
-    stop = startPush(deps());
-    ring('pty-1');
-
-    await vi.advanceTimersByTimeAsync(5_000);
-    expect(lastSend()).not.toBeNull();
-  });
-
-  it('names only devices still active in the ACL', async () => {
+  it('names only devices still active in the ACL when it sends', async () => {
     // The Relay still holds a subscription for a revoked client — nothing
     // propagates a revocation — so the Burrow must not address it. It stays out
-    // of the request because the ACL, not the Relay's list, chooses targets.
+    // of the request because the ACL, read now rather than when the ring
+    // began, chooses targets.
     subscribed = [PHONE, REVOKED];
     records = [aclRecord(PHONE, 'iPhone Safari')];
-    stop = startPush(deps());
-    ring('pty-1');
-
-    await vi.advanceTimersByTimeAsync(PUSH_DELAY_MS);
+    await push(deps());
     expect(lastRecipients()).toEqual([PHONE]);
   });
 
@@ -293,10 +235,7 @@ describe('alarm push', () => {
     // The ACL is local, and the Relay intersects the names it is given with
     // its own subscriptions anyway — so asking it first would only add a round
     // trip to the one path whose whole value is timeliness.
-    stop = startPush(deps());
-    ring('pty-1');
-
-    await vi.advanceTimersByTimeAsync(PUSH_DELAY_MS);
+    await push(deps());
     expect(requests).toHaveLength(1);
     expect(requests[0]!.url).toContain('/api/push/send');
   });
@@ -314,17 +253,12 @@ describe('alarm push', () => {
     // The send route answers 200 with counts even when every delivery failed —
     // a rotated VAPID key or a wedged push service must not be silent.
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    stop = startPush(
-      deps({
-        fetch: (async () => ({
-          ok: true,
-          json: async () => ({ delivered: 0, expired: 0, unknown: 0, failed: 1 }),
-        })) as unknown as typeof globalThis.fetch,
-      }),
-    );
-    ring('pty-1');
-
-    await vi.advanceTimersByTimeAsync(PUSH_DELAY_MS);
+    await push(deps({
+      fetch: (async () => ({
+        ok: true,
+        json: async () => ({ delivered: 0, expired: 0, unknown: 0, failed: 1 }),
+      })) as unknown as typeof globalThis.fetch,
+    }));
     expect(warn).toHaveBeenCalled();
     warn.mockRestore();
   });
@@ -333,48 +267,26 @@ describe('alarm push', () => {
     // A 401 from a revoked burrow token would otherwise resolve normally and
     // leave push permanently broken with nothing in the console.
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    stop = startPush(
-      deps({
-        fetch: (async () => ({ ok: false, status: 401 })) as unknown as typeof globalThis.fetch,
-      }),
-    );
-    ring('pty-1');
-
-    await vi.advanceTimersByTimeAsync(PUSH_DELAY_MS);
+    await push(deps({
+      fetch: (async () => ({ ok: false, status: 401 })) as unknown as typeof globalThis.fetch,
+    }));
     expect(warn).toHaveBeenCalled();
     warn.mockRestore();
   });
 
   it('sends nothing when no subscribed device is still authorized', async () => {
     records = [];
-    stop = startPush(deps());
-    ring('pty-1');
-
-    await vi.advanceTimersByTimeAsync(PUSH_DELAY_MS);
-    expect(lastSend()).toBeNull();
-  });
-
-  it('re-reads the target list at send time, not at schedule time', async () => {
-    stop = startPush(deps());
-    ring('pty-1');
-    // Revoked during the delay.
-    records = [];
-
-    await vi.advanceTimersByTimeAsync(PUSH_DELAY_MS);
+    await push(deps());
     expect(lastSend()).toBeNull();
   });
 
   it('survives a Relay that cannot be reached', async () => {
-    const failing = deps({
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    await expect(push(deps({
       fetch: (async () => {
         throw new Error('network down');
       }) as unknown as typeof globalThis.fetch,
-    });
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    stop = startPush(failing);
-    ring('pty-1');
-
-    await expect(vi.advanceTimersByTimeAsync(60_000)).resolves.not.toThrow();
+    }))).resolves.toBeUndefined();
     expect(warn).toHaveBeenCalled();
     warn.mockRestore();
   });
diff --git a/lib/src/remote/burrow/alert-push.ts b/lib/src/remote/burrow/alert-push.ts
index fd37044ba..13c12b314 100644
--- a/lib/src/remote/burrow/alert-push.ts
+++ b/lib/src/remote/burrow/alert-push.ts
@@ -1,24 +1,16 @@
-import { markAlertConsumed } from '../../lib/alert-delivery-state';
 /**
- * Push notifications for unattended alarms (`docs/specs/alert.md` -> Push
- * notifications). When a Session rings and stays unattended for `pushDelayMs`,
- * send that Pane's name to the paired phones.
+ * The push device list the Settings dialog names (`docs/specs/alert.md` ->
+ * Settings dialog): each refresh fenced so a stale answer never overwrites a
+ * newer one, or a Burrow that went away. When a ring is pushed is the host's
+ * delivery scheduler's (`lib/src/lib/alert-delivery-scheduler.ts`); the Relay
+ * calls are `push-delivery.ts`, which a Node-resident Burrow runs.
  *
- * The ring detection, delay, and cancellation rules are shared with spoken
- * alarms (`lib/src/lib/alert-ring-watch.ts`); this module is the webview half of
- * the push sink — the watch, the pane label, and the settings dialog's device
- * list. The Relay calls themselves are in `push-delivery.ts`, which a
- * Node-resident Burrow runs without any of this.
- *
- * It lives under `remote/burrow/` rather than `lib/` because it is only meaningful
- * with a Burrow behind it, and because that keeps it inside the lazily-imported
- * `RemotePairingModalHost` chunk — so a host that never sets `enableBurrow`
- * never fetches it.
+ * It lives under `remote/burrow/` rather than `lib/` because it is only
+ * meaningful with a Burrow behind it, and because that keeps it inside the
+ * lazily-imported `RemotePairingModalHost` chunk — so a host that never sets
+ * `enableBurrow` never fetches it.
  */
 
-import { getSessionAlertPolicy, subscribeToAlertDeliveryPolicy } from '../../lib/alert-delivery-policy';
-import { watchUnattendedRings } from '../../lib/alert-ring-watch';
-import { deriveSessionLabel } from '../../lib/session-label';
 import { setPushDevices, type PushDevice, type PushDevicesState } from '../../lib/push-devices';
 
 let pushDevicesRefreshSequence = 0;
@@ -66,22 +58,3 @@ export async function commitPushDevices(
 export function invalidatePushDeviceRefreshes(): void {
   pushDevicesRefreshSequence += 1;
 }
-
-/**
- * Watch the activity store for fresh rings and hand the unattended ones to
- * `fire`, with the Session's display label already derived. Returns a disposer
- * that cancels everything pending.
- *
- * The label is derived here, in the webview, because that is where the pane
- * stores are — a Burrow in another process is told what the Session is called
- * rather than guessing (`push-delivery.ts`).
- */
-export function watchPushRings(fire: (sessionId: string, title: string) => void): () => void {
-  return watchUnattendedRings({
-    sink: 'push',
-    enabled: (id) => getSessionAlertPolicy(id).pushEnabled,
-    delayMs: (id) => getSessionAlertPolicy(id).pushDelayMs,
-    subscribe: subscribeToAlertDeliveryPolicy,
-    fire: (id, episode) => { markAlertConsumed('push', id, episode.id); fire(id, deriveSessionLabel(id)); },
-  });
-}
diff --git a/lib/src/remote/burrow/burrow-status-store.ts b/lib/src/remote/burrow/burrow-status-store.ts
index 5b9817d2b..12f7a2bb3 100644
--- a/lib/src/remote/burrow/burrow-status-store.ts
+++ b/lib/src/remote/burrow/burrow-status-store.ts
@@ -383,7 +383,7 @@ export function subscribeToInvitation(
  * break an alarm (`docs/specs/relay.md` -> Web Push). A test button is the one
  * caller that needs the failure.
  *
- * Lives here rather than beside the ring watcher in `alert-push.ts`: that
+ * Lives here rather than beside the device list in `alert-push.ts`: that
  * module is deliberately inside the lazily-imported `RemotePairingModalHost`
  * chunk, and importing it from the Settings dialog would pull the whole
  * Burrow stack into the main bundle on every host.
diff --git a/lib/src/remote/burrow/enrolled-gate.ts b/lib/src/remote/burrow/enrolled-gate.ts
index 7a6913e2f..49f31e622 100644
--- a/lib/src/remote/burrow/enrolled-gate.ts
+++ b/lib/src/remote/burrow/enrolled-gate.ts
@@ -4,9 +4,8 @@
  * Answering the Burrow is free — a webview replies to an ask and goes back to
  * sleep — but *volunteering* is not: announcing that the directory may have
  * changed costs a crossing into the Burrow's process on every pane-state change,
- * every activity change, and every focus move, and watching for unattended
- * rings costs a subscription to the activity store, forever, on a machine whose
- * owner may never enroll a Burrow at all.
+ * every activity change, and every focus move, on a machine whose owner may
+ * never enroll a Burrow at all.
  *
  * So the outbound half is gated on the service's own answer: it announces
  * `{ name: 'status', enrolled }` whenever its lifecycle changes that
diff --git a/lib/src/remote/burrow/push-delivery.ts b/lib/src/remote/burrow/push-delivery.ts
index 8a38f15c5..a2db08b5c 100644
--- a/lib/src/remote/burrow/push-delivery.ts
+++ b/lib/src/remote/burrow/push-delivery.ts
@@ -4,11 +4,11 @@
  * is reached. The transport those calls run under is `burrow-fetch.ts`, shared
  * with the setup-token mint.
  *
- * Split from `alert-push.ts` because the two halves run in different processes
- * once the Burrow is Node-resident: ring *detection* is webview state (the
- * activity store, the alarm settings, the pane's label), while *delivery* needs
- * the enrollment and the ACL, which only the Burrow holds. Nothing here touches
- * the DOM or a store, so it runs unchanged in a webview or in the sidecar.
+ * Only the send lives here: *when* is the host's delivery scheduler
+ * (`lib/src/lib/alert-delivery-scheduler.ts`), and *what the Session is
+ * called* the renderer's pane label, while the send needs the enrollment and
+ * the ACL, which only the Burrow holds. Nothing here touches the DOM or a
+ * store, so it runs unchanged in a webview or in the sidecar.
  *
  * Delivery is an HTTP POST to the Relay rather than a relay frame: the relay
  * routes between two live sockets, and the whole point of a push is reaching a
diff --git a/lib/src/remote/client/remote-adapter.ts b/lib/src/remote/client/remote-adapter.ts
index c382627ea..bd2b6c90f 100644
--- a/lib/src/remote/client/remote-adapter.ts
+++ b/lib/src/remote/client/remote-adapter.ts
@@ -348,6 +348,7 @@ export class RemotePtyAdapter implements PlatformAdapter {
   alertPublishSettings(): void {}
   alertDismiss(): void {}
   alertEngagement(): void {}
+  alertPublishDeliveryPolicy(): void {}
   alertAcknowledge(): void {}
   alertToggleTodo(): void {}
   alertClearTodo(): void {}
@@ -362,6 +363,7 @@ export class RemotePtyAdapter implements PlatformAdapter {
   onAlertState(): void {}
   onWatchedCommands(): void {}
   onAlertSettings(): void {}
+  onAlertDeliver(): void {}
 
   saveState(state: unknown): void {
     this.#savedState = state;
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 5d161bead..0feec409e 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -2,7 +2,7 @@
   "AGENTS.md": 3400,
   "SECURITY.md": 200,
   "SELF_HOST.md": 6100,
-  "docs/specs/alert.md": 7850,
+  "docs/specs/alert.md": 7950,
   "docs/specs/auto-update.md": 1150,
   "docs/specs/deploy.md": 1900,
   "docs/specs/dor-browser.md": 4550,
@@ -26,15 +26,15 @@
   "docs/specs/security-supply-chain.md": 1150,
   "docs/specs/security.md": 1900,
   "docs/specs/shortcuts.md": 1150,
-  "docs/specs/standalone.md": 11850,
+  "docs/specs/standalone.md": 11900,
   "docs/specs/terminal-context.md": 1050,
   "docs/specs/terminal-escapes.md": 3900,
   "docs/specs/terminal-state.md": 2500,
   "docs/specs/theme.md": 2200,
   "docs/specs/tiling-engine.md": 4650,
-  "docs/specs/transport.md": 5500,
+  "docs/specs/transport.md": 5550,
   "docs/specs/tutorial.md": 1900,
-  "docs/specs/vscode.md": 7300,
+  "docs/specs/vscode.md": 7350,
   "docs/specs/webgl-text.md": 1200,
   "docs/specs/website-docs.md": 4800
 }
diff --git a/standalone/src/workspace-move.test.ts b/standalone/src/workspace-move.test.ts
index ded60dbf6..6e67098f4 100644
--- a/standalone/src/workspace-move.test.ts
+++ b/standalone/src/workspace-move.test.ts
@@ -89,8 +89,6 @@ import { setPlatform } from "dormouse-lib/lib/platform";
 import { disposeAllSessions, getOrCreateTerminal } from "dormouse-lib/lib/terminal-registry";
 import { FakePtyAdapter } from "dormouse-lib/lib/platform/fake-adapter";
 import { createAlertEpisode } from "dormouse-lib/lib/alert-episode";
-import { getAlertDeliveryReceipts, isAlertDeliveryPaused } from "dormouse-lib/lib/alert-delivery-state";
-import { watchUnattendedRings } from "dormouse-lib/lib/alert-ring-watch";
 import { clearTerminalActivity, getActivitySnapshot, setTerminalActivity } from "dormouse-lib/lib/session-activity-store";
 
 const WORKSPACE_ID = "ws-moving";
@@ -508,7 +506,7 @@ describe("the source half", () => {
     expect(getWorkspacesSnapshot().workspaces.map((w) => w.id)).toContain("ws-b");
   });
 
-  it("recovers serialization failure through host hand-back before resuming delivery or another move", async () => {
+  it("recovers serialization failure through host hand-back before another move", async () => {
     initWorkspaceMoves(fakePlatform());
     getOrCreateTerminal("pane-a");
     createWorkspace({ id: WORKSPACE_ID });
@@ -524,7 +522,6 @@ describe("the source half", () => {
     await vi.waitFor(() => expect(mocks.serialize).toHaveBeenCalled());
     await settle();
     expect(finished).toBe(false);
-    expect(isAlertDeliveryPaused("pane-a")).toBe(true);
     expect(isWorkspaceTransferPending(WORKSPACE_ID)).toBe(true);
     expect(getWindowSnapshot().workspaces.map(w => w.id)).not.toContain(WORKSPACE_ID);
     expect(mocks.invoke).not.toHaveBeenCalledWith("transfer_workspace_content", expect.anything());
@@ -537,7 +534,6 @@ describe("the source half", () => {
     });
     deliverReplay({ id: "pane-a", data: "missed output", requestId: `handback-${WORKSPACE_ID}` });
     await expect(moving).resolves.toEqual({ moved: false, reason: "arrival timed out" });
-    expect(isAlertDeliveryPaused("pane-a")).toBe(false);
     expect(isWorkspaceTransferPending(WORKSPACE_ID)).toBe(false);
     expect(getWindowSnapshot().workspaces.map(w => w.id)).toContain(WORKSPACE_ID);
     expect(mocks.writes).toContain("missed output");
@@ -795,7 +791,7 @@ describe("the target half", () => {
 
   it("discards this window's copy of the alert state when adopt_done is refused before the Wall mounts", async () => {
     // The source's live ring, as the sidecar's snapshot delivers it to the
-    // collecting window, and its still-pending speech receipt riding along.
+    // collecting window.
     const episode = createAlertEpisode();
     const platform = fakePlatform([], {
       beforeReplay: () => setTerminalActivity("pane-a", {
@@ -808,27 +804,15 @@ describe("the target half", () => {
       if (cmd === "adopt_done") arrivals = [];
       return host(cmd, args);
     });
-    const fire = vi.fn();
-    const stopWatch = watchUnattendedRings({ sink: "speech", subscribe: () => () => {}, enabled: () => true, delayMs: () => 0, fire });
-    arrivals = [payload({
-      terminals: { "pane-a": { serialized: "", alertDelivery: { speech: { episodeId: episode.id, dueAt: 0, phase: "pending" } } } },
-    } as Partial<WorkspaceTransferPayload>)];
-    try {
-      // No Wall handle: React never mounted the arrival before the refusal.
-      initWorkspaceMoves(platform);
-      await settle();
-      await settle();
-      expect(mocks.invoke).toHaveBeenCalledWith("adopt_done", { workspaceId: WORKSPACE_ID });
-      expect(getActivitySnapshot().has("pane-a")).toBe(false);
-      expect(isAlertDeliveryPaused("pane-a")).toBe(false);
-      expect(getAlertDeliveryReceipts("speech").has("pane-a")).toBe(false);
-      // The ring is the source's again, still live in the sidecar.
-      expect(kill).not.toHaveBeenCalled();
-      await settle();
-      expect(fire).not.toHaveBeenCalled();
-    } finally {
-      stopWatch();
-    }
+    arrivals = [payload({ terminals: { "pane-a": { serialized: "" } } } as Partial<WorkspaceTransferPayload>)];
+    // No Wall handle: React never mounted the arrival before the refusal.
+    initWorkspaceMoves(platform);
+    await settle();
+    await settle();
+    expect(mocks.invoke).toHaveBeenCalledWith("adopt_done", { workspaceId: WORKSPACE_ID });
+    expect(getActivitySnapshot().has("pane-a")).toBe(false);
+    // The ring is the source's again, still live in the sidecar.
+    expect(kill).not.toHaveBeenCalled();
   });
 
   it("closes the window when its last Workspace leaves, instead of emptying it", async () => {
diff --git a/standalone/src/workspace-move.ts b/standalone/src/workspace-move.ts
index 7e6ee81e8..8c7d30d01 100644
--- a/standalone/src/workspace-move.ts
+++ b/standalone/src/workspace-move.ts
@@ -2,8 +2,6 @@ import { clearToolDirty, recordToolDirty } from 'dormouse-lib/lib/tool-dirty-sto
 import { dismissWorkspaceUi } from 'dormouse-lib/lib/workspace-ui-store';
 import { restoreToolParams } from 'dormouse-lib/components/wall/tool-transfer';
 import { recordToolAnnounce } from 'dormouse-lib/lib/tool-announce-store';
-import { pauseAlertDelivery, resumeAlertDelivery, snapshotAlertDelivery, restoreAlertDelivery, forgetAlertDelivery } from 'dormouse-lib/lib/alert-delivery-state';
-import { setIncomingAlertPolicy } from 'dormouse-lib/lib/alert-delivery-policy';
 import { invoke } from "@tauri-apps/api/core";
 import { clearTerminalActivity, flushTerminal, releaseSession } from "dormouse-lib/lib/terminal-registry";
 import { forgetHelper } from "dormouse-lib/lib/helper-terminal";
@@ -160,7 +158,6 @@ async function handOff(
   args: Record<string, unknown>,
 ): Promise<MoveOutcome> {
   const { workspaceId, terminalIds } = prepared.payload;
-  pauseAlertDelivery(terminalIds);
   // Armed before the invoke: Rust asks the sidecar to stamp the marks inside
   // `begin_arrival`, so a `marked` line can arrive ahead of the invoke's reply.
   const pendingMarks = marksFor(terminalIds, `mark-${workspaceId}`);
@@ -176,7 +173,6 @@ async function handOff(
   } catch (err) {
     if (inFlight.get(workspaceId)?.prepared === prepared) {
       inFlight.delete(workspaceId);
-      resumeAlertDelivery(terminalIds);
       setWorkspaceTransferPending(workspaceId, false); // else `settle` already did
     }
     console.warn(`[workspace-move] ${command} refused; the Workspace stays here`, err);
@@ -194,12 +190,6 @@ async function handOff(
       const content = await captureTransferContent(terminalIds, marks);
       if (prepared.tools) content.tools = prepared.tools;
       if (inFlight.get(workspaceId)?.prepared === prepared) { // else handed back while serializing
-        // The alert state stays in the sidecar's one manager, routed to
-        // whichever window owns the Session; only the delivery receipts move.
-        for (const id of terminalIds) {
-          const delivery = snapshotAlertDelivery(id);
-          if (Object.keys(delivery).length) content.terminals[id].alertDelivery = delivery;
-        }
         try {
           await invoke("transfer_workspace_content", { workspaceId, content });
         } catch (err) {
@@ -211,9 +201,9 @@ async function handOff(
     }
   } catch (err) {
     // Rust already owns the transaction. Its ARRIVAL_MAX watchdog hands back
-    // an arrival with no content; keep the guard and delivery pause until that
-    // event restores routing, replay, and receipts together. Clearing
-    // them locally would permit another move while this one still owns PTYs.
+    // an arrival with no content; keep the guard until that event restores
+    // routing and replay together. Clearing it locally would permit another
+    // move while this one still owns PTYs.
     console.warn("[workspace-move] content capture failed; awaiting host hand-back", err);
   }
   return outcome;
@@ -295,7 +285,6 @@ async function handleDeparted(workspaceId: WorkspaceId): Promise<void> {
   inFlight.delete(workspaceId);
   await collapseWorkspace(workspaceId);
   move.prepared.commit();
-  forgetAlertDelivery(move.prepared.payload.terminalIds);
   move.settle({ moved: true });
   // Moving a Window's last Workspace away closes it — without confirming,
   // archiving or killing, because nothing ended: the Surfaces are alive
@@ -326,7 +315,6 @@ function handleArrivalFailed(workspaceId: WorkspaceId, reason: string, replayIds
   if (!move) return;
   inFlight.delete(workspaceId);
   clearWorkspaceTransferring(workspaceId);
-  resumeAlertDelivery(move.prepared.payload.terminalIds);
   console.warn(`[workspace-move] ${workspaceId} was not adopted (${reason}); it stays here`);
   if (replayIds.length) acceptHandBackReplay(workspaceId, replayIds);
   move.settle({ moved: false, reason });
@@ -408,14 +396,11 @@ async function planArrival(
   platform: PlatformAdapter,
   payload: MovePayload,
 ): Promise<WallBootPlans[string]> {
-  pauseAlertDelivery(payload.terminalIds);
-  setIncomingAlertPolicy(payload.terminalIds, payload.workspace.session.alertDelivery ?? {});
   // No alert seeding: the Sessions' alert state never left the sidecar, and
   // its answer to the `pty:requestInit` below re-sends it to this window.
   const ptyIds = new Set(payload.terminalIds);
   const transferred = Object.entries(payload.terminals ?? {}).filter(([id]) => ptyIds.has(id));
   for (const [id, terminal] of transferred) {
-    if (terminal.alertDelivery) restoreAlertDelivery(id, terminal.alertDelivery);
     if (terminal.semanticState) restoreTransferredTerminalState(id, terminal.semanticState);
     if (terminal.toolAnnounce) recordToolAnnounce(id, terminal.toolAnnounce);
     recordToolDirty(id, terminal.toolDirty ?? null);
@@ -466,9 +451,6 @@ async function planArrival(
  * mounted: Sessions released, **never killed** (the shells are the source's
  * again), notes and helpers dropped, the record and parked plan forgotten.
  * **Never removes the host's alert entry**, which the source goes on showing.
- * **This window's Activity copy goes before the delivery guards**: forgetting
- * the pause first would let a watcher re-arm on the still ringing Activity of a
- * Workspace this window never owned.
  */
 function discardArrival(payload: MovePayload): void {
   dismissWorkspaceUi(payload.workspaceId);
@@ -482,14 +464,6 @@ function discardArrival(payload: MovePayload): void {
   closeWorkspace(payload.workspaceId);
   forgetWorkspaceSession(payload.workspaceId);
   forgetWorkspaceBootPlan(payload.workspaceId);
-  forgetAlertDelivery(payload.terminalIds);
-  setIncomingAlertPolicy(payload.terminalIds);
-}
-
-/** The arrival is this window's: delivery resumes under the mounted Workspace's own policy. */
-function acceptArrival(payload: MovePayload): void {
-  resumeAlertDelivery(payload.terminalIds);
-  setIncomingAlertPolicy(payload.terminalIds);
 }
 
 /** Settle one arrival with Rust, whichever way it went. */
@@ -523,7 +497,6 @@ async function adoptWorkspace(platform: PlatformAdapter, payload: MovePayload):
     // retired underneath this window.
     try {
       await invoke("adopt_done", { workspaceId: id });
-      acceptArrival(payload);
     } catch (err) {
       // The `ARRIVAL_MAX` watchdog had already expired the record and handed
       // the shells back, and the source kept the Workspace. Left mounted here
@@ -625,7 +598,6 @@ export async function bootFromTearOut(platform: PlatformAdapter): Promise<WallBo
   // plan, so a refused arrival leaves no half-installed Window behind.
   installWindowPersistence(platform, { version: 1, workspaces: [{ id, name, nameIsAuto, session }], activeWorkspaceId: id });
   publishWorkspaceSession(id, session);
-  acceptArrival(first);
   adopting.delete(id);
   // A second Workspace dropped on this window between the tear-out and this
   // drain rides in the same queue.
@@ -635,10 +607,7 @@ export async function bootFromTearOut(platform: PlatformAdapter): Promise<WallBo
 
 /** @internal Forget what this window is moving (tests). */
 export function _resetWorkspaceMovesForTesting(): void {
-  for (const [id, move] of inFlight) {
-    forgetAlertDelivery(move.prepared.payload.terminalIds);
-    setWorkspaceTransferPending(id, false);
-  }
+  for (const id of inFlight.keys()) setWorkspaceTransferPending(id, false);
   inFlight.clear();
   adopting.clear();
 }
diff --git a/vscode-ext/src/message-router.ts b/vscode-ext/src/message-router.ts
index bc21c3e1f..58d198823 100644
--- a/vscode-ext/src/message-router.ts
+++ b/vscode-ext/src/message-router.ts
@@ -1,6 +1,7 @@
 import * as vscode from 'vscode';
 import * as ptyManager from './pty-manager';
 import { createAlertHost, type AlertRealm } from '../../lib/src/host/alert-host';
+import type { AlertDelivery } from '../../lib/src/lib/alert-delivery-scheduler';
 import { alertedPty, createOwnerPtyStream } from '../../lib/src/host/owner-pty';
 import type {
   TerminalColorProvider,
@@ -189,8 +190,29 @@ const ALLOWED_WORKBENCH_COMMANDS = new Set<string>(VSCODE_WORKBENCH_COMMANDS);
 // This window's alerts, in the host role standalone's sidecar runs too
 // (`lib/src/host/alert-host.ts`). They survive router disposal, so alert state
 // persists across webview collapse/expand cycles; each router is one realm.
-const alertHost = createAlertHost();
+const alertHost = createAlertHost({ deliver: deliverAlert });
 const alertManager = alertHost.manager;
+let nextFallbackPushId = 0;
+
+/**
+ * One due spoken alarm or push, to the webview that owns its Session. With
+ * none — a disposed view whose PTYs live on — a push goes from here, titled by
+ * the command, and speech is skipped: it needs a renderer
+ * (`docs/specs/alert.md` -> Alarm settings).
+ */
+function deliverAlert(delivery: AlertDelivery): void {
+  const owner = [...activeRouters].find((router) => router.ownsPty(delivery.id));
+  if (owner) {
+    owner.send({ type: 'alert:deliver', ...delivery });
+    return;
+  }
+  if (delivery.sink !== 'push') return;
+  handleBurrowCommand({
+    burrowRequestId: `alert-push-${++nextFallbackPushId}`,
+    cmd: 'push',
+    params: { sessionId: delivery.id, title: alertManager.lastCommand(delivery.id) ?? '' },
+  });
+}
 /** Every PTY write and resize, as the alerts must see it. */
 const alertedPtys = alertedPty(alertManager, ptyManager);
 /**
diff --git a/vscode-ext/test/message-router.test.ts b/vscode-ext/test/message-router.test.ts
index 22a087006..1da5fe600 100644
--- a/vscode-ext/test/message-router.test.ts
+++ b/vscode-ext/test/message-router.test.ts
@@ -25,6 +25,8 @@ const wiring = vi.hoisted(() => ({
   burrow: null as BurrowDeps | null,
   /** Every `notifyDirectoryChanged()` the router made. */
   invalidations: 0,
+  /** Every Burrow command the router sent on its own account. */
+  burrowCommands: [] as unknown[],
 }));
 
 vi.mock('../src/peer-link', () => ({
@@ -78,7 +80,7 @@ vi.mock('../src/burrow', () => ({
   dropForwardedCommands: () => {},
   greetPeerWindow: () => {},
   handleForwardedCommand: () => {},
-  handleBurrowCommand: () => {},
+  handleBurrowCommand: (payload: unknown) => void wiring.burrowCommands.push(payload),
   notifyDirectoryChanged: () => {
     wiring.invalidations += 1;
   },
@@ -127,6 +129,7 @@ beforeEach(async () => {
   wiring.peer = null;
   wiring.burrow = null;
   wiring.invalidations = 0;
+  wiring.burrowCommands = [];
   ptys.cwd = null;
   ptys.cwdAsked = [];
   ptys.cwdWait = null;
@@ -703,6 +706,60 @@ describe('engagement viewers', () => {
   });
 });
 
+/**
+ * A due spoken alarm or push goes to the webview that owns its Session; with
+ * none, a push goes from the host (docs/specs/alert.md → Alarm settings).
+ */
+describe('alarm delivery', () => {
+  const REPORT = '\x1b]9;needs input\x07';
+
+  beforeEach(() => {
+    vi.useFakeTimers();
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it('hands a due delivery to the webview that owns the Session, and no other', () => {
+    const other = fakeWebview();
+    const owner = fakeWebview();
+    const first = router.attachRouter(other.channel);
+    const second = router.attachRouter(owner.channel);
+    try {
+      alert(owner, { op: 'initializeSettings', settings: { speakEnabled: true, speakDelayMs: 1_000 } as never });
+      owner.send({ type: 'pty:spawn', id: 'pty-owned', options: { cwd: '/repo' } });
+      ptys.callbacks!.onData('pty-owned', REPORT);
+      vi.advanceTimersByTime(1_000);
+      const episodeId = router.getAlertStates().get('pty-owned')!.episode!.id;
+      expect(owner.posted.filter((message) => message.type === 'alert:deliver'))
+        .toEqual([{ type: 'alert:deliver', sink: 'speech', id: 'pty-owned', episodeId }]);
+      expect(other.posted.filter((message) => message.type === 'alert:deliver')).toEqual([]);
+    } finally {
+      first.dispose();
+      second.dispose();
+    }
+  });
+
+  it('pushes from the host, titled by the command, when no webview owns the Session', () => {
+    const webview = fakeWebview();
+    const disposable = router.attachRouter(webview.channel);
+    alert(webview, { op: 'initializeSettings', settings: { speakEnabled: true, pushEnabled: true, pushDelayMs: 1_000 } as never });
+    webview.send({ type: 'pty:spawn', id: 'pty-orphan', options: { cwd: '/repo' } });
+    ptys.callbacks!.onData('pty-orphan', '\x1b]633;E;pnpm build\x07\x1b]633;C\x07');
+    // The view goes away; its PTYs live on.
+    disposable.dispose();
+    ptys.callbacks!.onData('pty-orphan', REPORT);
+    vi.advanceTimersByTime(60_000);
+    expect(webview.posted.filter((message) => message.type === 'alert:deliver')).toEqual([]);
+    expect(wiring.burrowCommands).toEqual([{
+      burrowRequestId: expect.any(String),
+      cmd: 'push',
+      params: { sessionId: 'pty-orphan', title: 'pnpm build' },
+    }]);
+  });
+});
+
 /**
  * A Session's alert state follows its PTY here, whoever asked
  * (docs/specs/alert.md): started over, and seeded, at the spawn; given the

From 25a2f7b115d5987e2810a8a1b227b807b4ef65b6 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 23 Sep 2026 22:52:02 -0700
Subject: [PATCH 10/16] Push from the host, speak from the window, and reset
 acknowledgement per command

- The shared alert host sends push itself (standalone: the sidecar's
  Burrow service; VS Code: this window's service or the broker over the
  peer link), titled by labels each window publishes with its Workspace
  overrides on a throttle; windows only speak (`alert:speak`), so a
  suspended window no longer delays the walked-away channel.
- A VS Code window in active use counts as presence for push.
- A command start ends the "already acknowledged" state, so a command
  that stays silent until its notification rings again.
- One scheduler map and per-sink table; the push-device fence lives with
  the device list; shared speech test stub; routing and gates stated once.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwN55bUVmCNmPiX7vHGCVF
---
 docs/specs/alert.md                           |  48 +++--
 docs/specs/alert.rationale.md                 |  12 +-
 docs/specs/standalone.md                      |   3 +-
 docs/specs/transport.md                       |   2 +-
 docs/specs/vscode.md                          |  15 +-
 docs/specs/vscode.rationale.md                |   4 +
 lib/.storybook/preview.ts                     |  19 +-
 lib/src/components/AlarmTestButtons.test.tsx  |  12 +-
 lib/src/components/Baseboard.test.tsx         |   7 +-
 lib/src/components/Baseboard.tsx              |   7 +-
 lib/src/components/SettingsDialog.tsx         |   4 +-
 lib/src/components/SettingsPreview.tsx        |   5 +-
 lib/src/components/Wall.test.tsx              |   3 +-
 lib/src/components/Wall.tsx                   |   2 +-
 .../WorkspaceAlarmSettings.test.tsx           |   7 +-
 lib/src/components/WorkspaceStrip.test.tsx    |   5 +-
 lib/src/components/WorkspaceWindow.test.tsx   |   3 +-
 .../wall/AlertRingIndicator.test.tsx          |   6 +-
 .../components/wall/AlertRingIndicator.tsx    |   4 +-
 .../wall/TerminalPaneHeader.test.tsx          |   3 +-
 lib/src/components/wall/use-alert-delivery.ts |  11 +-
 .../wall/window-singletons.test.tsx           |   6 +-
 .../components/wall/workspace-control.test.ts |   3 +-
 lib/src/host/alert-client.test.ts             |  19 +-
 lib/src/host/alert-client.ts                  |  30 +--
 lib/src/host/alert-host.test.ts               |  49 +++--
 lib/src/host/alert-host.ts                    |  38 ++--
 lib/src/host/alert-protocol.ts                |  29 ++-
 lib/src/host/remote/service-protocol.ts       |   6 -
 lib/src/host/remote/service.test.ts           |  31 ++-
 lib/src/host/remote/service.ts                |  33 ++-
 lib/src/host/remote/sidecar-entry.test.ts     |  28 ++-
 lib/src/host/remote/sidecar-entry.ts          |   9 +-
 lib/src/lib/alert-delivery-model.ts           |  15 +-
 lib/src/lib/alert-delivery-policy.test.ts     |  16 +-
 lib/src/lib/alert-delivery-policy.ts          |  13 +-
 lib/src/lib/alert-delivery-scheduler.test.ts  | 103 +++++----
 lib/src/lib/alert-delivery-scheduler.ts       | 203 ++++++++++--------
 lib/src/lib/alert-delivery.test.ts            |  85 +++++---
 lib/src/lib/alert-delivery.ts                 | 131 +++++++----
 lib/src/lib/alert-manager.test.ts             |  11 +
 lib/src/lib/alert-manager.ts                  |  15 +-
 lib/src/lib/alert-resumed-output.test.ts      |  12 +-
 lib/src/lib/alert-settings-host.ts            |   7 +-
 lib/src/lib/alert-speech.test.ts              | 172 ++++++---------
 lib/src/lib/platform/fake-adapter.ts          |   7 +-
 lib/src/lib/platform/types.ts                 |  16 +-
 lib/src/lib/push-devices.ts                   |  37 +++-
 lib/src/lib/session-activity-store.ts         |   9 +-
 lib/src/lib/session-label.ts                  |  26 ++-
 lib/src/lib/speech-synthesis-test-utils.ts    |  50 +++++
 lib/src/lib/terminal-registry.alert.test.ts   |   3 +-
 lib/src/lib/workspace-store.ts                |  10 +-
 lib/src/remote/burrow/activation.test.ts      |  48 ++---
 lib/src/remote/burrow/activation.ts           |  11 +-
 lib/src/remote/burrow/alert-push.ts           |  60 ------
 lib/src/remote/burrow/burrow-status-store.ts  |   2 +-
 lib/src/remote/burrow/peer-surfaces.test.ts   |  13 +-
 ...ert-push.test.ts => push-delivery.test.ts} |  91 ++++----
 lib/src/remote/burrow/push-delivery.ts        |  17 +-
 lib/src/remote/client/remote-adapter.ts       |   6 +-
 scripts/spec-word-budgets.json                |   4 +-
 vscode-ext/src/burrow.ts                      |  23 +-
 vscode-ext/src/extension.ts                   |   6 +-
 vscode-ext/src/message-router.ts              |  43 ++--
 vscode-ext/src/peer-link-protocol.ts          |   4 +-
 vscode-ext/src/peer-link.ts                   |  18 ++
 vscode-ext/test/burrow.test.ts                |  54 +++++
 vscode-ext/test/helpers.ts                    |   3 +
 vscode-ext/test/message-router.test.ts        |  82 ++++---
 70 files changed, 1072 insertions(+), 817 deletions(-)
 create mode 100644 lib/src/lib/speech-synthesis-test-utils.ts
 delete mode 100644 lib/src/remote/burrow/alert-push.ts
 rename lib/src/remote/burrow/{alert-push.test.ts => push-delivery.test.ts} (87%)

diff --git a/docs/specs/alert.md b/docs/specs/alert.md
index 8ee6c1aac..50282afba 100644
--- a/docs/specs/alert.md
+++ b/docs/specs/alert.md
@@ -270,7 +270,7 @@ Source of truth: `dispatchCompletion` / `setViewer` / `formatCommandExitBody` in
 
 - **The user verbs acknowledge; a withdrawal never does.** Each also drops whatever was held or deferred, except a dismiss with nothing ringing. A ring a withdrawal empties restores the TODO and notification it found.
 - **Any keystroke into the pane clears TODO** (rationale).
-- **Never summon twice for an acknowledged state.** After a user verb clears a ring or drops a held completion, a report arriving before any output opens no ring: it sets `todo`, updates the notification, and publishes. Settles and exits ring as usual, and opening a ring forgets the acknowledgement (rationale). Pinned by `a report about a state acknowledged by %s updates the TODO without summoning again` in `lib/src/lib/alert-manager.test.ts`.
+- **Never summon twice for an acknowledged state.** After a user verb clears a ring or drops a held completion, a report arriving before any output opens no ring: it sets `todo`, updates the notification, and publishes. Settles and exits ring as usual, and opening a ring or starting a command forgets the acknowledgement (rationale). Pinned by `a report about a state acknowledged by %s updates the TODO without summoning again` and `rings a report again once a command starts after the acknowledgement` in `lib/src/lib/alert-manager.test.ts`.
 - Command-mode `Enter` that only enters passthrough does not clear TODO.
 - Removing a WATCHING rule turns watching off wherever it matched. It does not stop the detector, nor clear a progress cycle or a command-exit arm.
 - Destroying the Session clears all alert, TODO, notification, held, progress, and command-exit state.
@@ -279,18 +279,18 @@ Source of truth: `raiseRing` / `withdrawRingSource` / `clearRingForUser` in `lib
 
 ## Live Workspace transfer
 
-**A Session's alert state never moves**: the host's one manager and its delivery scheduler hold it (`docs/specs/standalone.md` → Alerts), and a transfer moves only where its `alert:state` and `alert:deliver` are routed — the source until the mark, then the target, whose collection is answered with every listed Session's state (rationale).
+**A Session's alert state never moves**: the host's one manager and its delivery scheduler hold it (`docs/specs/standalone.md` → Alerts), and a transfer moves only where its `alert:state` and `alert:speak` are routed — the source until the mark, then the target, whose collection is answered with every listed Session's state (rationale).
 
 - **Never spawn or kill over a departure, a refused arrival, or a hand-back**: a spawn starts the host's entry over and a kill or reap removes it, and releasing a Session is neither. Pinned by `never spawns or kills over an arrival's live Sessions` in `standalone/src/workspace-move.test.ts`.
 - **A replay never feeds the manager**, whose host parse already did.
-- **Awaits and pending deliveries survive a transfer**; a seen command stays seen, so it arrives armed; the destination's viewers establish their own engagement, and its Wall publishes the Workspace's overrides (Alarm settings).
+- **Awaits survive a transfer**; a seen command stays seen, so it arrives armed; the destination's viewers establish their own engagement.
 - **Must discard this window's Activity copy on any target failure**, mount or no mount: the source goes on showing the Session. Pinned by `discards this window's copy of the alert state when adopt_done is refused before the Wall mounts` in `standalone/src/workspace-move.test.ts`.
 
 Source of truth: `teardownSession` in `lib/src/lib/terminal-lifecycle.ts`; `planArrival` / `discardArrival` in `standalone/src/workspace-move.ts`. Pinned by `lib/src/lib/terminal-lifecycle.release.test.ts` and `standalone/src/workspace-move.test.ts`.
 
 ## Alarm settings
 
-Application alarm defaults live beside the WATCHING rule set, edited in **Settings** (below). **Every other store reached from Settings stays its own — never fold one into `AlertSettings`**, which is relayed wholesale to the host. **A host revalidates the blob before installing it** (`normalizeAlertSettings`): a webview must never be able to hand it a NaN or an absurd timer. Both stores run the same two classes in either host (`lib/src/lib/watched-command-host.ts`, `lib/src/lib/alert-settings-host.ts`), bound to its manager by `createAlertHost`; the shape, its defaults and its validation are the platform-free `lib/src/lib/alert-settings-model.ts`.
+Application alarm defaults live beside the WATCHING rule set, edited in **Settings** (below). **Every other store reached from Settings stays its own — never fold one into `AlertSettings`**, which is relayed wholesale to the host. Both stores run the same two classes in either host (`lib/src/lib/watched-command-host.ts`, `lib/src/lib/alert-settings-host.ts`), bound to its manager by `createAlertHost`; the shape, its defaults and its validation are the platform-free `lib/src/lib/alert-settings-model.ts`.
 
 | Field | Meaning |
 |---|---|
@@ -304,33 +304,34 @@ The speech row's managed-voice link follows
 
 Rules:
 
-- **Validate and clamp every field on read *and* on write** (`normalizeAlertSettings`), so a hand-edited `localStorage` blob or a hostile message can never install a `NaN` or absurd timer. Unknown keys are dropped and missing keys defaulted, so the blob evolves additively with no version field. `cfg.alert` owns the inactivity default; `DEFAULT_ALERT_SETTINGS` owns the sink and boolean defaults.
+- **Validate and clamp every field on read *and* on write, the host included** (`normalizeAlertSettings`), so a hand-edited `localStorage` blob or a hostile message can never install a `NaN` or absurd timer. Unknown keys are dropped and missing keys defaulted, so the blob evolves additively with no version field. `cfg.alert` owns the inactivity default; `DEFAULT_ALERT_SETTINGS` owns the sink and boolean defaults.
 - **Distribution follows the WATCHING rule set's seed/broadcast shape** (rationale), except that an edit **relays the whole blob** rather than a per-command delta, so every webview resolves workspace overrides against the same defaults. Wire contract and host revalidation: `docs/specs/transport.md`.
-- **Must keep detection settings application-wide**, applied to each host's one manager: the standalone sidecar's and the VS Code extension host's.
+- **Must keep detection settings application-wide**, applied to each host's one manager.
 
 **Must resolve delivery policy from application defaults, then sparse Workspace overrides.** Speech/push enable and delay can override independently; `speakVoice` selects a local engine voice URI, missing inherits the system-voice default, and explicit null selects the system voice. Missing or unavailable voices fall back to the engine default without erasing the saved choice. Unknown/invalid overrides are dropped; finite delays share the application clamp.
 
 **Must persist overrides in the Workspace's `PersistedSession.alertDelivery` in both hosts**, preserving them through rename, reorder, save, and live move. Reset removes overrides, restoring inheritance. A pane resolves its current parent Workspace; a pane without membership uses application defaults.
 
-**The host decides when to deliver, in `createAlertHost` beside the manager; the realm showing the Session performs it** (rationale):
+**The host decides when to deliver, in `createAlertHost` beside the manager** (rationale):
 
-- **Must deliver at most once per sink per episode**, independently per Session, due at the episode's start plus the Session's delay; a source joining the episode delivers nothing, and the ring clearing consumes what it had pending.
-- **Must recheck at the deadline, and consume a deadline that fails, never retrying it**: the sink still on; **speech only while the Session is not engaged** (Engagement); **push only while no viewer is present** (rationale).
-- **Disabling consumes pending work immediately; enabling never replays an episode**, one that began disabled included. Delay edits do not move existing deadlines; speech reads the current voice at engine admission.
-- **Each realm publishes every Session it shows with its Workspace's overrides** (`deliveryPolicy`) on each membership or override change. The host revalidates them, resolves them over its settings, and keeps each Session's last publisher's; an unpublished Session uses the defaults. **A realm's end keeps a live Session's overrides**, so a reload or a disposed VS Code view loses none.
-- **Must hand a due delivery to the realm showing its Session** as `alert:deliver { sink, id, episodeId }`, which speaks or pushes the Pane label (below). **With no such realm — a disposed VS Code view whose PTYs live on — the host pushes, titled by the Session's running or last command, and skips speech** (`docs/specs/vscode.md` → Workspaces); standalone reaps a PTY no window owns.
+- **Must deliver at most once per sink per episode**, due at the episode's start plus the Session's delay; a source joining the episode delivers nothing, and the ring clearing consumes what it had pending.
+- **Must recheck at the deadline, and consume a deadline that fails, never retrying it**: **speech only while the Session is not engaged** (Engagement); **push only while no viewer is present**, VS Code's focused, active window counting as one (`docs/specs/vscode.md` → Workspaces; rationale).
+- **Disabling consumes pending work immediately; enabling never replays an episode**, one that began disabled included. Delay edits never move a deadline; speech reads the current voice at engine admission.
+- **Each realm publishes every Session it shows** — Pane label and Workspace overrides — as one `sessions` op replacing its last: membership and override changes at the end of their task, label changes on a `LABEL_PUBLISH_THROTTLE_MS` trailing throttle (rationale), nothing unchanged resent. **The host keeps each Session's last publisher's entry until the Session is removed**, a realm's end included; an unpublished Session uses the defaults.
+- **A due push goes from the host's own Burrow** (Push notifications), titled by the published label, whether or not a realm still shows the Session; **a due spoken alarm goes to the realm showing it** as `alert:speak`, and with none is not spoken.
 
-Source of truth: `normalizeAlertDeliveryOverrides` / `resolveAlertDeliveryPolicy` in `lib/src/lib/alert-delivery-model.ts`; `createAlertDeliveryScheduler` in `lib/src/lib/alert-delivery-scheduler.ts`; `startAlertDelivery` in `lib/src/lib/alert-delivery.ts`; `getSessionAlertPolicy` / `collectDeliveryOverrides` in `lib/src/lib/alert-delivery-policy.ts`; `setWorkspaceAlertDelivery` in `lib/src/lib/workspace-store.ts`. Pinned by `lib/src/lib/alert-delivery-scheduler.test.ts`, `lib/src/lib/alert-delivery.test.ts`, and `delivery` in `lib/src/host/alert-host.test.ts`.
+Source of truth: `normalizeAlertDeliveryOverrides` / `resolveAlertDeliveryPolicy` in `lib/src/lib/alert-delivery-model.ts`; `createAlertDeliveryScheduler` in `lib/src/lib/alert-delivery-scheduler.ts`; `startAlertDelivery` / `LABEL_PUBLISH_THROTTLE_MS` in `lib/src/lib/alert-delivery.ts`; `getSessionAlertPolicy` in `lib/src/lib/alert-delivery-policy.ts`; `setWorkspaceAlertDelivery` in `lib/src/lib/workspace-store.ts`. Pinned by `lib/src/lib/alert-delivery-scheduler.test.ts`, `lib/src/lib/alert-delivery.test.ts`, and `delivery` in `lib/src/host/alert-host.test.ts`.
+
+Neither sink ever carries the ringing `ActivityNotification`.
 
 | Contract | Speech | Push |
 |---|---|---|
-| Gate | After `speakDelayMs`, the Session not engaged; a missing backend is a silent no-op. | After `pushDelayMs`, no viewer present; sent only by an enrolled Burrow. |
-| Payload | Pane label via `toSpokenText`; fallback `terminal`. | Same label via `toPushText`, plus a fixed body; fallback `terminal`. |
-| Never payload | The ringing `ActivityNotification`. | The ringing `ActivityNotification`. |
-| Delivery identity | The host's episode receipt plus native attempt identity; renderer-local `speaking` / `spoken`. | HTTP push tagged by Session id, so a newer ring replaces the prior notification. |
+| Performed by | The realm showing the Session; a missing backend is a silent no-op. | The host's own Burrow, only while enrolled. |
+| Payload | Pane label via `toSpokenText`; fallback `terminal`. | The label the realm last published, via `toPushText`, plus a fixed body; fallback `terminal`. |
+| Delivery identity | The episode the host named, rechecked at engine admission, plus native attempt identity; renderer-local `speaking` / `spoken`. | HTTP push tagged by Session id, so a newer ring replaces the prior notification. |
 | After delivery | Clearing the ring cuts off speech. | **Never recall** — another push would only replace one stale notice with another. |
 | Failure | A refused or unavailable engine produces no marker. | Warn on non-2xx, partial, or zero delivery; **never retry** stale alarms. |
-| Authority | The renderer invokes `window.speechSynthesis`. | The webview names Session/title; the Burrow selects active ACL devices, the Relay intersects subscriptions. |
+| Authority | The renderer invokes `window.speechSynthesis`. | The host names Session and title; the Burrow selects active ACL devices, the Relay intersects subscriptions. |
 
 Source of truth: `AlertSettings` in `lib/src/lib/alert-settings.ts` (renderer mirror, persisted at `dormouse:alert-settings`); `lib/src/lib/alert-settings-host.ts`.
 
@@ -349,14 +350,14 @@ Source of truth: `toSpokenText` / `startAlertSpeech` in `lib/src/lib/alert-speec
 
 ### Push notifications
 
-**A due push is one `push { sessionId, title }` command from the realm showing the Session to the Burrow service**, titled by the Pane label; *sending* needs the enrollment and the ACL, which only the Burrow holds, so `sendPush` runs in the service's process and touches no DOM or store. **A webview cannot choose recipients:** it names the Session and what to call it; the service reads its own active ACL at send time. A `push` arriving with no Burrow running is not sent. **Keep the device list under `remote/burrow/`**, inside the lazily-imported `RemotePairingModalHost` chunk, so a host without `enableBurrow` never fetches it (rationale).
+**A due push is one `BurrowService.push` call in the host's process** (VS Code: `docs/specs/vscode.md` → Workspaces). `sendPush` touches no DOM or store. **No webview sends a push or picks its recipients.** Without a Burrow nothing is sent; a failure is warned, never thrown. **The device-list fetch rides the lazily-imported `RemotePairingModalHost` chunk** (`activation.ts`); its store and refresh fence stay common (rationale).
 
-- **The label is sanitized by `toPushText` at send time, in the delivery half, and not by `toSpokenText`'s rule** (rationale). It keeps angle brackets and instead strips control characters and the Unicode bidi and zero-width format characters (including the Arabic letter mark); the cap counts code points, so a cut never ships half a surrogate pair. `toPushText` is only this sink's limit and fallback over `boundedPushText` in `remote-lib-common/src/security/push.ts`.
+- **The label is sanitized by `toPushText` at send time, in the Burrow, and not by `toSpokenText`'s rule** (rationale). It keeps angle brackets and instead strips control characters and the Unicode bidi and zero-width format characters (including the Arabic letter mark); the cap counts code points, so a cut never ships half a surrogate pair. `toPushText` is only this sink's limit and fallback over `boundedPushText` in `remote-lib-common/src/security/push.ts`.
 - **The Burrow bounds, then seals; the worker re-bounds at the render sink.** Title, body, and tag are sealed to each recipient's own Client static and the Relay forwards ciphertext, so the second pass runs in `lib/src/remote/pocket-app/sw.ts`, which imports the *same* `boundedPushText` rather than mirroring it (`docs/specs/remote-security-model.md` -> Push sealing).
 - **The Burrow names its targets; the Relay rejects a send that does not.** Targets are the Burrow's *active* ACL records, read at send time so a revocation during the delay takes effect, and the Relay intersects them with its own subscriptions (rationale). **One sealed envelope per recipient** — a Client static is not a group key — so a send names each `deliveryId` beside the ciphertext only that phone can open, **clamped to `MAX_PUSH_QUERY_DELIVERY_IDS`** because the route refuses the whole POST past it. The Burrow does **not** ask which devices are subscribed first (rationale).
 - **The settings dialog re-reads the device list when it opens; the transient preview never refreshes.** The list is the Burrow's join of the Relay's subscriptions against its own ACL labels. **A disarmed enrolled gate invalidates every in-flight refresh and clears the list**, so nothing already on the wire can repopulate the dialog with phones there is no longer anything to push to.
 
-Source of truth: `commitPushDevices` / `invalidatePushDeviceRefreshes` in `lib/src/remote/burrow/alert-push.ts`; `sendPush` / `toPushText` in `lib/src/remote/burrow/push-delivery.ts`; `refreshPushDevicesNow` / `clearPushDevices` / `resetPushDevices` in `lib/src/lib/push-devices.ts`.
+Source of truth: `push` in `lib/src/host/remote/service.ts`; `pushAlert` in `vscode-ext/src/burrow.ts`; `sendPush` / `toPushText` in `lib/src/remote/burrow/push-delivery.ts`; `commitPushDevices` / `refreshPushDevicesNow` / `clearPushDevices` / `resetPushDevices` in `lib/src/lib/push-devices.ts`.
 
 ### Settings dialog
 
@@ -448,3 +449,8 @@ Notification text is untrusted terminal output.
 - Wherever notification text appears in visible UI or accessible labels, it is plain text, and layout must tolerate long text, CJK, RTL, combining marks, and emoji without pushing fixed controls out of bounds. Sanitized terminal-supplied `OSC 0` / `OSC 2` / `OSC 9` text also participates in normal Pane-label derivation, and that label may reach the opt-in speech and push channels — **each after its own second pass**, since the two fail in different ways (`toSpokenText` under Spoken alarms, `toPushText` under Push notifications).
 
 Robustness: Sessions ring independently; an exited Session may keep ringing until acknowledged, dismissed, or destroyed; ringing must not rely on color alone.
+
+## Future
+
+- **Presence across VS Code windows.** A window's presence holds back only its own extension host's pushes; the peer link could share it.
+- **OS-level idle time.** A user working in another application counts as away; the machine's input idle time could hold a push until they leave the computer.
diff --git a/docs/specs/alert.rationale.md b/docs/specs/alert.rationale.md
index fe52ca5c2..07342d6a4 100644
--- a/docs/specs/alert.rationale.md
+++ b/docs/specs/alert.rationale.md
@@ -112,7 +112,7 @@
 
 **Why detail goes by richness.** The last writer used to win, with one special case keeping a report's text over an exit: an `OSC 9` reading `Build finished: 3 warnings` followed by a bell in the next PTY read showed `Terminal bell`, and `make; printf '\a'` showed `Terminal bell` over `make exited 2` (audit, 2026-09-23). One order covers every pair; equal ranks still take the newer text. A notification deferred behind animation used to be replaced by whatever came next, so the same bell in the next read replaced the message it followed; the deferral now keeps the richer of the two.
 
-**Why an acknowledged state is not summoned again.** Claude Code sends an idle notification about a minute after a turn ends unless it saw input (captured from Claude Code 2.1, 2026-09-23). A user who acknowledged the WATCHING ring with a click, `a`, or a Door was summoned a second time, in a second episode, for the same completion. Output since the acknowledgement is the evidence that something new happened; settles and command exits are fresh by construction, so only reports are held to it.
+**Why an acknowledged state is not summoned again.** Claude Code sends an idle notification about a minute after a turn ends unless it saw input (captured from Claude Code 2.1, 2026-09-23). A user who acknowledged the WATCHING ring with a click, `a`, or a Door was summoned a second time, in a second episode, for the same completion. Output since the acknowledgement is the evidence that something new happened; settles and command exits are fresh by construction, so only reports are held to it. A command start is evidence too: a new command's echo falls in the echo window, so one silent until its report produced no output, and its report only updated TODO (2026-09-23).
 
 ## Alarm settings
 
@@ -120,7 +120,11 @@
 
 **Why the settings ride the WATCHING rule set's seed/broadcast shape.** Each VS Code webview has its own origin and therefore its own `localStorage`, while the `AlertManager` is shared; without a host-authoritative copy, two webviews would each believe their own blob. The one difference is the whole-blob relay: an alarm setting is not a set of independent keys the way a rule list is.
 
-**Why the host schedules delivery.** Each renderer used to run its own watcher over its activity mirror, and every realm boundary cost an alarm (audit, 2026-09-23). A recreated VS Code webview saw a latched ring go quiet-then-ringing and fired it at once, while one still inside its delay was first-observed in the new realm, seeded consumed, and never delivered; a disposed view whose PTYs lived on delivered nothing; standalone's WKWebView throttles or suspends timers when hidden; and a Workspace transfer had to carry, pause and resume receipts. The host sees every episode from its start and outlives every renderer, so first-observation seeding and receipt transfer went away. Only speaking and naming the Pane need a renderer.
+**Why the host schedules delivery.** Each renderer used to run its own watcher over its activity mirror, and every realm boundary cost an alarm (audit, 2026-09-23). A recreated VS Code webview saw a latched ring go quiet-then-ringing and fired it at once, while one still inside its delay was first-observed in the new realm, seeded consumed, and never delivered; a disposed view whose PTYs lived on delivered nothing; standalone's WKWebView throttles or suspends timers when hidden; and a Workspace transfer had to carry, pause and resume receipts, and drop a refused arrival's Activity copy before releasing that pause. The host sees every episode from its start and outlives every renderer, so first-observation seeding and receipt transfer went away.
+
+**Why a push goes from the host, and only speech from a realm.** A push is the walked-away channel, yet performing it in the renderer made it depend on the realm the user had walked away from — suspended when hidden, or disposed, when a VS Code view fell back to titling the push by its command line (2026-09-23). Only `window.speechSynthesis` needs a renderer; a push needs only the Pane label, which the realm publishes ahead of time.
+
+**Why labels wait on a throttle and overrides do not.** Claude Code animates its terminal title about ten times a second (2026-09), and each frame changes the label: publishing every one would cross into the host ten times a second per Session for a value read only when a push comes due. An override change goes at once because disabling a sink must consume its pending push before it fires.
 
 **Why presence gates delivery.** The watcher rechecked only the episode and the setting, so a push went out while the user typed in the next pane, and speech named the pane they were reading (audit, 2026-09-23). Speech is heard in the room, so it only has to spare the pane being looked at; a push reaches a phone, so it waits until the user has left every viewer.
 
@@ -144,7 +148,7 @@ Guarding only completion leaves a stale `start` free to replace the active utter
 
 ## Push notifications
 
-**Why the device list lives under `remote/burrow/`.** It rides the lazily-imported `RemotePairingModalHost` chunk. Performing a push is one Burrow command beside speech in the common bundle, and the device store stays common too, since the settings dialog needs it everywhere.
+**Why the device-list fetch is lazy and its store is not.** The fetch is Burrow machinery and rides the lazily-imported `RemotePairingModalHost` chunk; the store and its refresh fence stay in the common bundle because the Settings dialog reads them in every host, so disarming is one call on the store.
 
 **Why `toPushText` is not `toSpokenText`.** The angle-bracket rule exists only because WebKit's synthesizer wedges on them (Spoken alarms); an OS notification has no such failure, and instead has bidi and zero-width formatting that can visually reorder or hide text.
 
@@ -172,7 +176,7 @@ Guarding only completion leaves a stale `start` free to replace the active utter
 
 ## Live Workspace transfer
 
-Nothing moves because the manager and the delivery scheduler left the standalone windows for the host process (`docs/specs/standalone.rationale.md` → Alerts; Alarm settings). Until the scheduler moved, per-sink receipts travelled in the transfer payload, paused on the source and resumed on the target's `adopt_done`, and a refused arrival had to drop its Activity copy before releasing that pause or its watcher re-armed on a Workspace the window never owned (2026-09).
+Nothing moves because the manager and the delivery scheduler left the standalone windows for the host process (`docs/specs/standalone.rationale.md` → Alerts; Alarm settings).
 
 ## Workspace union
 
diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index 31045da5d..5010b9ad4 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -252,8 +252,7 @@ that feeds it: one `AlertManager`, every window a realm under its label
 - **An await's answer carries `forWindow`**, the label that parked it, which
   Rust routes it to — **never a Session `id`**, which would route it to that
   Session's owner, **nor a `requestId`**, which Rust swallows (rationale).
-- **`alert:deliver` carries its Session's `id`**, so Rust routes a due alarm
-  to the window showing it (`docs/specs/alert.md` → Alarm settings).
+- **`alert:speak` carries its Session's `id`**, which Rust routes it by.
 - **Must re-send each listed Session's `alert:state` behind the answer to
   `pty:requestInit`**: a reloaded window and an arriving Workspace learn their
   rings and TODOs nowhere else. A `sync` re-sends every Session's, and Rust
diff --git a/docs/specs/transport.md b/docs/specs/transport.md
index a67d656e9..8d372d52a 100644
--- a/docs/specs/transport.md
+++ b/docs/specs/transport.md
@@ -208,7 +208,7 @@ Transport constraints:
 | Host → webview | `pty:replay` | Buffered raw output since spawn; the webview runs a one-shot parser over it, the only re-parse there is. |
 | Host → webview | `dormouse:newTerminal` | May carry `shell`, `args`, display `name`, `replaceUntouched`, `announce`. The webview replaces the selected untouched terminal in place only when `replaceUntouched` is true, otherwise spawns a new pane. |
 
-**Every `alert*` verb is one `alert:command { command }` to the host** — in standalone the `alert_command` invoke, stamped with its window (`docs/specs/standalone.md` → "Alerts") — and **every answer one of the `alert:*` events, named and shaped alike in both hosts** (`AlertCommand` / `AlertEvents` in `lib/src/host/alert-protocol.ts`). **The host revalidates every command**, the settings blob that becomes its timers included (`normalizeAlertSettings`). An await's messages are `docs/specs/alert.md` → Await. **`sync` re-sends the realm its Sessions' `alert:state` and both stores' snapshots, ending nothing.** Alarm delivery adds `deliveryPolicy` → host and `alert:deliver` → the realm showing the Session (`docs/specs/alert.md` → Alarm settings).
+**Every `alert*` verb is one `alert:command { command }` to the host** — in standalone the `alert_command` invoke, stamped with its window (`docs/specs/standalone.md` → "Alerts") — and **every answer one of the `alert:*` events, named and shaped alike in both hosts** (`AlertCommand` / `AlertEvents` in `lib/src/host/alert-protocol.ts`). **The host revalidates every command**, the settings blob that becomes its timers included (`normalizeAlertSettings`). An await's messages are `docs/specs/alert.md` → Await. **`sync` re-sends the realm its Sessions' `alert:state` and both stores' snapshots, ending nothing.**
 
 **Two app-global stores relay on one pattern**: WATCHING rules (`initializeWatchedCommands`, `setCommandWatched` → host; `alert:watchedCommands` → webview) and alarm settings (`initializeSettings`, `updateSettings` → host; `alert:settings` → webview; `docs/specs/alert.md` → Alarm settings). An `initialize*` offers the renderer's persisted copy as a startup seed, and **a host accepts only the first seed of its lifetime**. A mutation replaces the host's copy — `setCommandWatched` adds or removes one bare command key without touching unrelated rules, `updateSettings` sends the whole blob, renderer-only fields included, so every webview agrees. Either way the host broadcasts a canonical snapshot, and **every renderer replaces and persists its local mirror from it**. **A host sends no snapshot before the first seed**, so a `sync` never pushes defaults over a renderer's persisted copy.
 
diff --git a/docs/specs/vscode.md b/docs/specs/vscode.md
index 463a05678..bc82e9dad 100644
--- a/docs/specs/vscode.md
+++ b/docs/specs/vscode.md
@@ -87,14 +87,19 @@ are app-global rather than per-Workspace, riding the seed / mutate / broadcast
 channel of `docs/specs/transport.md` → Message protocol; the settings the
 shared manager consumes are `AlertManager.applySettings`'s own list.
 
-**A due alarm goes to the router whose `ownedPtyIds` hold its Session**; the
-owner-less push goes through `handleBurrowCommand` (`docs/specs/alert.md` →
-Alarm settings).
+**`alert:speak` goes only to a connected router whose `ownedPtyIds` hold its
+Session**; a due push goes to `pushAlert`: this window's service, else the
+broker's as an unanswered `push` peer frame, else dropped, never held. **This
+window is one more alert viewer, with no focus, present while `WindowState`
+reports it `focused` and `active`**; one that never reports `active` adds none
+(rationale).
 
 Source of truth: `WatchedCommandHost` in `lib/src/lib/watched-command-host.ts`,
 `AlertSettingsHost` in `lib/src/lib/alert-settings-host.ts`, the `alert:command`
-case and `deliverAlert` in `vscode-ext/src/message-router.ts`. Pinned by
-`alarm delivery` in `vscode-ext/test/message-router.test.ts`.
+case, `connectWebview`, and `reportWindowPresence` in
+`vscode-ext/src/message-router.ts`; `pushAlert` in `vscode-ext/src/burrow.ts`.
+Pinned by `alarm delivery` in `vscode-ext/test/message-router.test.ts` and
+`vscode-ext/test/burrow.test.ts`.
 
 ### Shell selection
 
diff --git a/docs/specs/vscode.rationale.md b/docs/specs/vscode.rationale.md
index d5febf23c..4ac2d2797 100644
--- a/docs/specs/vscode.rationale.md
+++ b/docs/specs/vscode.rationale.md
@@ -2,6 +2,10 @@
 
 > Informative companion to [vscode.md](vscode.md): the evidence, measurements, and dead-approach history behind its rules, keyed by that spec's headings (AGENTS.md → "What, not why"). Nothing here is normative.
 
+## Workspaces
+
+**Why this window counts as a viewer, and only when `active`.** Only Dormouse webviews were viewers, so a push reached the phone while the user worked in VS Code outside the webview — the editor, VS Code's own terminal (2026-09-23). Focus alone never lapses: a user who walked away from a focused VS Code would never be pushed. `WindowState.active`, which lapses after a short time without input, was finalized in VS Code 1.89 (April 2024); the supported range starts at 1.85, where only the webviews' own presence counts.
+
 ## Surfacing union status on native chrome
 
 **Why `view.title` cannot carry the status.** The view's own title never surfaces on a single-view bottom-panel container, which leaves the badge as the only runtime indicator this hosting primitive exposes — hence presence-only where the editor tab can spell out `🔔` and `[TODO]`.
diff --git a/lib/.storybook/preview.ts b/lib/.storybook/preview.ts
index bf6a54b6e..8732e1ea7 100644
--- a/lib/.storybook/preview.ts
+++ b/lib/.storybook/preview.ts
@@ -25,6 +25,7 @@ import {
   type PushDevicesState,
   type TerminalPaneState,
 } from '../src/lib/terminal-registry';
+import { createAlertEpisode } from '../src/lib/alert-episode';
 import { computeDynamicPalette } from '../src/lib/themes/dynamic-palette';
 import {
   clearAllAlertSpeechStates,
@@ -224,6 +225,20 @@ function resolveStorybookTheme(requestedThemeName: string | undefined) {
   return DEFAULT_STORYBOOK_THEME;
 }
 
+/**
+ * Prime one Session's Activity as its host would publish it: ringing always
+ * carries an episode. An id already ringing keeps its own, so a re-prime does
+ * not restart the arrival burst.
+ */
+function primeActivity(id: string, state: Partial<ActivityState>): void {
+  const current = getActivity(id);
+  const next = { ...current, ...state };
+  const episode = next.status !== 'ALERT_RINGING'
+    ? null
+    : state.episode ?? (current.status === 'ALERT_RINGING' ? current.episode : null) ?? createAlertEpisode();
+  setTerminalActivity(id, { ...next, episode });
+}
+
 const preview: Preview = {
   parameters: {
     layout: 'fullscreen',
@@ -406,14 +421,14 @@ const preview: Preview = {
           }
 
           for (const [id, state] of Object.entries(primedSessionState?.byId ?? {})) {
-            setTerminalActivity(id, { ...getActivity(id), ...state });
+            primeActivity(id, state);
           }
 
           const sessionIds = [...getActivitySnapshot().keys()];
           primedSessionState?.byIndex?.forEach((state, index) => {
             const id = sessionIds[index];
             if (id) {
-              setTerminalActivity(id, { ...getActivity(id), ...state });
+              primeActivity(id, state);
             }
           });
 
diff --git a/lib/src/components/AlarmTestButtons.test.tsx b/lib/src/components/AlarmTestButtons.test.tsx
index 6528692e6..cdcd40424 100644
--- a/lib/src/components/AlarmTestButtons.test.tsx
+++ b/lib/src/components/AlarmTestButtons.test.tsx
@@ -13,6 +13,7 @@ vi.mock('../lib/platform', () => ({
 }));
 
 import { PushTestButton, SpeakTestButton } from './AlarmTestButtons';
+import { stubSpeechSynthesis } from '../lib/speech-synthesis-test-utils';
 
 globalThis.IS_REACT_ACT_ENVIRONMENT = true;
 
@@ -45,19 +46,12 @@ afterEach(async () => {
 
 describe('SpeakTestButton', () => {
   it('speaks and says so when the webview has a speech engine', async () => {
-    const speak = vi.fn();
-    vi.stubGlobal('speechSynthesis', { speak, cancel: vi.fn() });
-    vi.stubGlobal(
-      'SpeechSynthesisUtterance',
-      class {
-        constructor(public text: string) {}
-      },
-    );
+    const engine = stubSpeechSynthesis();
 
     await act(async () => root.render(<SpeakTestButton />));
     await act(async () => button().click());
 
-    expect(speak).toHaveBeenCalledTimes(1);
+    expect(engine.spoken).toHaveLength(1);
     expect(text()).toContain('Test sound queued');
   });
 
diff --git a/lib/src/components/Baseboard.test.tsx b/lib/src/components/Baseboard.test.tsx
index 23f6b0801..a9d32a0fc 100644
--- a/lib/src/components/Baseboard.test.tsx
+++ b/lib/src/components/Baseboard.test.tsx
@@ -30,6 +30,7 @@ import { resetShellStore, seedShellStore } from '../lib/shell-store';
 import { addPlainNote, clearAllNotepads } from '../lib/notepad/notepad-store';
 import { resetPushDevices, setPushDevices, setPushDevicesRefresher } from '../lib/push-devices';
 import { clearTerminalActivity, setTerminalActivity } from '../lib/session-activity-store';
+import { createAlertEpisode } from '../lib/alert-episode';
 
 globalThis.IS_REACT_ACT_ENVIRONMENT = true;
 
@@ -416,9 +417,9 @@ describe('Baseboard overflow alerts', () => {
 
   it('marks an overflow arrow for the ringing and TODO Doors it hides', () => {
     act(() => {
-      setTerminalActivity('b', { status: 'ALERT_RINGING' });
+      setTerminalActivity('b', { status: 'ALERT_RINGING', episode: createAlertEpisode() });
       setTerminalActivity('c', { todo: true });
-      setTerminalActivity('d', { status: 'ALERT_RINGING', todo: true });
+      setTerminalActivity('d', { status: 'ALERT_RINGING', episode: createAlertEpisode(), todo: true });
     });
     // The zero-width test viewport fits exactly one Door.
     renderBaseboard(items, 'a');
@@ -437,7 +438,7 @@ describe('Baseboard overflow alerts', () => {
   });
 
   it('leaves an arrow plain while the Doors it hides owe nothing', () => {
-    act(() => setTerminalActivity('a', { status: 'ALERT_RINGING', todo: true }));
+    act(() => setTerminalActivity('a', { status: 'ALERT_RINGING', episode: createAlertEpisode(), todo: true }));
     renderBaseboard(items, 'a');
     const right = arrow('right');
     expect(right?.getAttribute('aria-label')).toBe('3 more');
diff --git a/lib/src/components/Baseboard.tsx b/lib/src/components/Baseboard.tsx
index a292fb82a..19aeb44c1 100644
--- a/lib/src/components/Baseboard.tsx
+++ b/lib/src/components/Baseboard.tsx
@@ -15,7 +15,8 @@ import { clsx } from 'clsx';
 import { chromeButton, DOOR_TAB_CLASS, TERMINAL_TOP_RADIUS_CLASS, TODO_PILL_TRACKING_CLASS } from './design';
 import { AlertRingInset } from './alert-ring';
 import { TODO_PILL_BODY } from './TodoPillBody';
-import { SettingsDialog, type AlarmSink } from './SettingsDialog';
+import { SettingsDialog } from './SettingsDialog';
+import type { AlertSink } from '../lib/alert-delivery-model';
 import { SettingsPreview } from './SettingsPreview';
 import { Door } from './Door';
 import { DoorNotepadPopover } from './DoorNotepadPopover';
@@ -156,10 +157,10 @@ export function Baseboard({ items, onReattach, notice, onDoorDragStart }: Basebo
   const [doorNotepad, setDoorNotepad] = useState<
     { id: string; rect: DOMRect; sourceNotice: SourceNotice | null } | null
   >(null);
-  const [settingsPreview, setSettingsPreview] = useState<{ sink: AlarmSink; anchor: HTMLElement; sequence: number } | null>(null);
+  const [settingsPreview, setSettingsPreview] = useState<{ sink: AlertSink; anchor: HTMLElement; sequence: number } | null>(null);
   const previewSequence = useRef(0);
   const closeSettingsPreview = useCallback(() => setSettingsPreview(null), []);
-  const toggleAlarm = (sink: AlarmSink, anchor: HTMLElement) => {
+  const toggleAlarm = (sink: AlertSink, anchor: HTMLElement) => {
     const patch = sink === 'speech'
       ? { speakEnabled: !settings.speakEnabled }
       : { pushEnabled: !settings.pushEnabled };
diff --git a/lib/src/components/SettingsDialog.tsx b/lib/src/components/SettingsDialog.tsx
index 10684f020..2194a1bb6 100644
--- a/lib/src/components/SettingsDialog.tsx
+++ b/lib/src/components/SettingsDialog.tsx
@@ -237,10 +237,8 @@ export function SettingsDialog({ onClose }: { onClose: () => void }) {
   );
 }
 
-export type AlarmSink = AlertSink;
-
 /** Shared by the full dialog and the brief, inert baseboard confirmation. */
-export function AlarmSettingsSection({ sink, preview = false }: { sink: AlarmSink; preview?: boolean }) {
+export function AlarmSettingsSection({ sink, preview = false }: { sink: AlertSink; preview?: boolean }) {
   // The dialog edits application defaults; only the baseboard preview shows the Workspace's effective value.
   const { policy: settings } = useWorkspaceAlertPolicy(preview);
   const push = useSyncExternalStore(subscribeToPushDevices, getPushDevices);
diff --git a/lib/src/components/SettingsPreview.tsx b/lib/src/components/SettingsPreview.tsx
index edf2daf8c..b9bca214d 100644
--- a/lib/src/components/SettingsPreview.tsx
+++ b/lib/src/components/SettingsPreview.tsx
@@ -2,7 +2,8 @@ import { useWorkspaceAlertPolicy } from './wall/use-workspace-alert-policy';
 import { useEffect, useLayoutEffect, useState } from 'react';
 import { createPortal } from 'react-dom';
 import { POPUP_SURFACE_CLASS } from './design';
-import { AlarmSettingsSection, type AlarmSink } from './SettingsDialog';
+import { AlarmSettingsSection } from './SettingsDialog';
+import type { AlertSink } from '../lib/alert-delivery-model';
 import { useAnchoredMenu } from './use-anchored-menu';
 import { OVERLAY_VIEWPORT_MARGIN_PX } from '../lib/ui-geometry';
 
@@ -13,7 +14,7 @@ export function SettingsPreview({
   anchor,
   onClose,
 }: {
-  sink: AlarmSink;
+  sink: AlertSink;
   anchor: HTMLElement;
   onClose: () => void;
 }) {
diff --git a/lib/src/components/Wall.test.tsx b/lib/src/components/Wall.test.tsx
index c86e417a2..bffc4aab0 100644
--- a/lib/src/components/Wall.test.tsx
+++ b/lib/src/components/Wall.test.tsx
@@ -30,6 +30,7 @@ import { getWallHandle, listWallHandles } from './wall/wall-handles';
 import { mountWallHarness, type WallHarness } from './wall/wall-test-utils';
 import { DEFAULT_WORKSPACE_ID } from '../lib/session-types';
 import { clearTerminalActivity, setTerminalActivity } from '../lib/session-activity-store';
+import { createAlertEpisode } from '../lib/alert-episode';
 import { resetTerminalPaneState } from '../lib/terminal-state-store';
 import { setWindowLabel } from '../lib/workspace-store';
 
@@ -119,7 +120,7 @@ describe('Wall on the Lath engine', () => {
     await flush();
     expect(container.querySelector('[data-alert-ring-state]')).toBeNull();
 
-    await act(async () => { setTerminalActivity('pane-a', { status: 'ALERT_RINGING' }); });
+    await act(async () => { setTerminalActivity('pane-a', { status: 'ALERT_RINGING', episode: createAlertEpisode() }); });
 
     const overlays = container.querySelectorAll('[data-alert-ring-state="ringing"]');
     expect(overlays).toHaveLength(1);
diff --git a/lib/src/components/Wall.tsx b/lib/src/components/Wall.tsx
index 5ae8f5a02..6cb08d177 100644
--- a/lib/src/components/Wall.tsx
+++ b/lib/src/components/Wall.tsx
@@ -1172,7 +1172,7 @@ export function Wall({
   // --- Dev-server port → pane correlation (browser header connection chip) ---
   useDevServerPortCorrelation({ lath, doorsRef });
 
-  // --- Spoken alarms and pushes (`docs/specs/alert.md` -> Alarm settings) ---
+  // --- Alarm delivery: this realm's Sessions and speech (`docs/specs/alert.md` -> Alarm settings) ---
   useAlertDelivery();
 
   // --- Reattach ---
diff --git a/lib/src/components/WorkspaceAlarmSettings.test.tsx b/lib/src/components/WorkspaceAlarmSettings.test.tsx
index 1206bc80b..58271ae58 100644
--- a/lib/src/components/WorkspaceAlarmSettings.test.tsx
+++ b/lib/src/components/WorkspaceAlarmSettings.test.tsx
@@ -6,15 +6,14 @@ import { WorkspaceAlarmSettings } from './WorkspaceAlarmSettings';
 import { WorkspaceIdContext } from './wall/wall-context';
 import { createWorkspace, getWorkspacesSnapshot, resetWorkspaces } from '../lib/workspace-store';
 import { speechQueue } from '../lib/speech-queue';
+import { stubSpeechSynthesis } from '../lib/speech-synthesis-test-utils';
 
 globalThis.IS_REACT_ACT_ENVIRONMENT = true;
 afterEach(() => { speechQueue.clear(); resetWorkspaces(); vi.unstubAllGlobals(); });
 
 it('selects and tests a workspace voice, then resets to inheritance', async () => {
   const voice = { voiceURI: 'voice-1', name: 'Samantha', lang: 'en-US' };
-  const speak = vi.fn();
-  vi.stubGlobal('speechSynthesis', { getVoices: () => [voice], speak, cancel: vi.fn() });
-  vi.stubGlobal('SpeechSynthesisUtterance', class { constructor(public text: string) {} });
+  const engine = stubSpeechSynthesis([voice]);
   createWorkspace({ id: 'voice-workspace', name: 'Builds' });
   const container = document.createElement('div'); document.body.appendChild(container);
   const root = createRoot(container);
@@ -25,7 +24,7 @@ it('selects and tests a workspace voice, then resets to inheritance', async () =
     expect(getWorkspacesSnapshot().workspaces.find(ws => ws.id === 'voice-workspace')?.alertDelivery).toEqual({ speakVoice: 'voice-1' });
     const button = (text: string) => [...container.querySelectorAll('button')].find(item => item.textContent === text)!;
     await act(async () => button('Play test sound').click());
-    expect(speak.mock.calls[0][0].voice).toBe(voice);
+    expect(engine.utterances[0].voice).toBe(voice);
     await act(async () => button('Use application defaults').click());
     expect(select.value).toBe('inherit');
   } finally { await act(async () => root.unmount()); container.remove(); }
diff --git a/lib/src/components/WorkspaceStrip.test.tsx b/lib/src/components/WorkspaceStrip.test.tsx
index f506b87eb..b73da6a6e 100644
--- a/lib/src/components/WorkspaceStrip.test.tsx
+++ b/lib/src/components/WorkspaceStrip.test.tsx
@@ -11,6 +11,7 @@ import { ensureResizeObserver } from './wall/wall-test-utils';
 import { requestWorkspaceClose, requestWorkspaceRename } from './wall/workspace-lifecycle';
 import { resetWorkspaceSurfaces, setWorkspaceSurfaces } from '../lib/workspace-surfaces';
 import { clearTerminalActivity, setTerminalActivity } from '../lib/terminal-registry';
+import { createAlertEpisode } from '../lib/alert-episode';
 import { resetWindowSessionAggregator, setWorkspaceTransferPending } from '../lib/window-session-aggregator';
 import {
   getWorkspaceUiSnapshot,
@@ -122,9 +123,9 @@ describe('WorkspaceStrip', () => {
     await act(async () => { createWorkspace({ id: 'ws-2' }); });
     setWorkspaceSurfaces(first, ['pane-a', 'pane-b']);
     setWorkspaceSurfaces('ws-2', ['pane-c']);
-    setTerminalActivity('pane-a', { status: 'ALERT_RINGING' });
+    setTerminalActivity('pane-a', { status: 'ALERT_RINGING', episode: createAlertEpisode() });
     setTerminalActivity('pane-b', { todo: true });
-    setTerminalActivity('pane-c', { status: 'ALERT_RINGING' });
+    setTerminalActivity('pane-c', { status: 'ALERT_RINGING', episode: createAlertEpisode() });
     await render();
 
     expect(activateButton(first).getAttribute('aria-label')).toBe('Workspace 1, 2 needing attention');
diff --git a/lib/src/components/WorkspaceWindow.test.tsx b/lib/src/components/WorkspaceWindow.test.tsx
index 21173d480..4cc1b01c4 100644
--- a/lib/src/components/WorkspaceWindow.test.tsx
+++ b/lib/src/components/WorkspaceWindow.test.tsx
@@ -22,6 +22,7 @@ import { FakePtyAdapter } from '../lib/platform/fake-adapter';
 import { clearAllNotepads, addPlainNote } from '../lib/notepad/notepad-store';
 import { __resetArchiveServiceForTests } from '../lib/notepad/archive-service';
 import { getActivitySnapshot, setTerminalActivity } from '../lib/terminal-registry';
+import { createAlertEpisode } from '../lib/alert-episode';
 import { getWallHandle, listWallHandles, resetWallHandles } from './wall/wall-handles';
 import { resetWorkspaceBootPlans, setWorkspaceBootPlan } from './wall/workspace-boot-plans';
 import { mountWallHarness, type WallHarness } from './wall/wall-test-utils';
@@ -372,7 +373,7 @@ describe('WorkspaceWindow', () => {
   it('costs a Session nothing to switch: the leaf is never remounted and no ring replays', async () => {
     const first = getWorkspacesSnapshot().workspaces[0].id;
     await render();
-    setTerminalActivity('pane-a', { status: 'ALERT_RINGING' });
+    setTerminalActivity('pane-a', { status: 'ALERT_RINGING', episode: createAlertEpisode() });
     const episodeBefore = getActivitySnapshot().get('pane-a')!.episode;
     expect(episodeBefore?.id).toBeTruthy();
     const leafBefore = wallFor(first).querySelector('[data-lath-leaf="pane-a"]');
diff --git a/lib/src/components/wall/AlertRingIndicator.test.tsx b/lib/src/components/wall/AlertRingIndicator.test.tsx
index 6a4679ce6..74dc378ec 100644
--- a/lib/src/components/wall/AlertRingIndicator.test.tsx
+++ b/lib/src/components/wall/AlertRingIndicator.test.tsx
@@ -9,7 +9,7 @@ import {
   clearAllAlertSpeechStates,
   setAlertSpeechState,
 } from '../../lib/alert-speech-state';
-import type { AlertEpisode } from '../../lib/alert-episode';
+import { createAlertEpisode, type AlertEpisode } from '../../lib/alert-episode';
 import { clearTerminalActivity, setTerminalActivity } from '../../lib/session-activity-store';
 import { AlertRingIndicator } from './AlertRingIndicator';
 
@@ -18,8 +18,8 @@ globalThis.IS_REACT_ACT_ENVIRONMENT = true;
 let container: HTMLDivElement;
 let root: Root;
 
-/** The store hydrates a missing episode itself; a test that needs a stable id says so. */
-function ring(episode?: AlertEpisode): void {
+/** A new ring, as the host publishes it; a test that needs a stable id passes its episode. */
+function ring(episode: AlertEpisode = createAlertEpisode()): void {
   act(() => setTerminalActivity('pty-1', { status: 'ALERT_RINGING', episode }));
 }
 
diff --git a/lib/src/components/wall/AlertRingIndicator.tsx b/lib/src/components/wall/AlertRingIndicator.tsx
index cfa259e89..ad9a62a11 100644
--- a/lib/src/components/wall/AlertRingIndicator.tsx
+++ b/lib/src/components/wall/AlertRingIndicator.tsx
@@ -40,8 +40,8 @@ export function AlertRingIndicator({ sessionId }: { sessionId: string }) {
   );
   const row = alertRingRow(activity.status, speech);
   const burst = useAlertRingBurst(row, activity.episode);
-  // `setTerminalActivity` opens an episode on every ringing transition, so a row
-  // always arrives with one; the pair is what the treatment renders from.
+  // The host's ringing state always carries its episode, so a row arrives with
+  // one; the pair is what the treatment renders from.
   if (!row || !burst) return null;
 
   const speaking = row === 'speaking';
diff --git a/lib/src/components/wall/TerminalPaneHeader.test.tsx b/lib/src/components/wall/TerminalPaneHeader.test.tsx
index c15c5f102..1d8590b93 100644
--- a/lib/src/components/wall/TerminalPaneHeader.test.tsx
+++ b/lib/src/components/wall/TerminalPaneHeader.test.tsx
@@ -12,6 +12,7 @@ import { FakePtyAdapter } from '../../lib/platform/fake-adapter';
 import { setPlatform } from '../../lib/platform';
 import { setNativeFieldValue } from '../../lib/dom';
 import { clearTerminalActivity, removeTerminalPaneState, setTerminalActivity } from '../../lib/terminal-registry';
+import { createAlertEpisode } from '../../lib/alert-episode';
 import { removeMouseSelectionState, setMouseReporting } from '../../lib/mouse-selection';
 import { recordToolDirty, resetToolDirty } from '../../lib/tool-dirty-store';
 import {
@@ -73,7 +74,7 @@ describe('TerminalPaneHeader — alert state', () => {
     renderHeader(stubActions(), null);
     const quiet = container.querySelector<HTMLElement>('[data-pane-header-for="term-1"]')!.className;
 
-    act(() => { setTerminalActivity('term-1', { status: 'ALERT_RINGING' }); });
+    act(() => { setTerminalActivity('term-1', { status: 'ALERT_RINGING', episode: createAlertEpisode() }); });
 
     const header = container.querySelector<HTMLElement>('[data-pane-header-for="term-1"]')!;
     expect(header.className).toBe(quiet);
diff --git a/lib/src/components/wall/use-alert-delivery.ts b/lib/src/components/wall/use-alert-delivery.ts
index 10295e206..73e3d76fb 100644
--- a/lib/src/components/wall/use-alert-delivery.ts
+++ b/lib/src/components/wall/use-alert-delivery.ts
@@ -3,12 +3,13 @@ import { startAlertDelivery } from '../../lib/alert-delivery';
 import { createRefCount } from '../../lib/ref-count';
 
 /**
- * Arm this realm's spoken alarms and pushes for the lifetime of the desktop
- * shell (`docs/specs/alert.md` -> Alarm settings).
+ * Arm this realm's half of alarm delivery for the lifetime of the desktop
+ * shell: publishing its Sessions to the host and speaking what the host says
+ * is due (`docs/specs/alert.md` -> Alarm settings).
  *
- * One performer per WINDOW, not per Wall: `startAlertDelivery` publishes every
- * Workspace's policy and clears every Session's speech state, so N Walls would
- * speak each delivery N times and reset each other's delivery state. Reference
+ * One per WINDOW, not per Wall: `startAlertDelivery` publishes every Session
+ * the realm shows and clears every Session's speech state, so N Walls would
+ * speak each alarm N times and reset each other's delivery state. Reference
  * counted, so the first mounted Wall arms it and the last one disarms it.
  */
 const acquire = createRefCount({ onFirst: () => startAlertDelivery() });
diff --git a/lib/src/components/wall/window-singletons.test.tsx b/lib/src/components/wall/window-singletons.test.tsx
index 4ab919eb3..e156791c2 100644
--- a/lib/src/components/wall/window-singletons.test.tsx
+++ b/lib/src/components/wall/window-singletons.test.tsx
@@ -1,8 +1,8 @@
 /**
  * @vitest-environment jsdom
  *
- * Two hooks a Wall mounts that own WINDOW-level machinery — the alarm
- * delivery performer and the dynamic palette — so N mounted Walls must still run one each
+ * Two hooks a Wall mounts that own WINDOW-level machinery — alarm delivery
+ * and the dynamic palette — so N mounted Walls must still run one each
  * (docs/specs/layout.md → "Workspaces").
  */
 import { act } from 'react';
@@ -59,7 +59,7 @@ afterEach(() => {
 describe('window-singleton Wall hooks', () => {
   it('arms once for N Walls and disarms only when the last one goes', async () => {
     await act(async () => { root.render(<><Consumer /><Consumer /><Consumer /></>); });
-    // One delivery performer (it publishes every Workspace's policy and clears
+    // One alarm delivery (it publishes every Session to the host and clears
     // every Session's speech state) and one palette observer for the document.
     expect(startDelivery).toHaveBeenCalledTimes(1);
     expect(observers).toBe(1);
diff --git a/lib/src/components/wall/workspace-control.test.ts b/lib/src/components/wall/workspace-control.test.ts
index 4380cd3d9..b3d3b40ae 100644
--- a/lib/src/components/wall/workspace-control.test.ts
+++ b/lib/src/components/wall/workspace-control.test.ts
@@ -14,6 +14,7 @@ import {
   resetWorkspaceIdPool,
 } from '../../lib/workspace-store';
 import { clearTerminalActivity, setTerminalActivity } from '../../lib/session-activity-store';
+import { createAlertEpisode } from '../../lib/alert-episode';
 import { resetWorkspaceSurfaces, setWorkspaceSurfaces } from '../../lib/workspace-surfaces';
 import { resetWindowSessionAggregator } from '../../lib/window-session-aggregator';
 import { setPlatform } from '../../lib/platform';
@@ -61,7 +62,7 @@ describe('workspace.list', () => {
     const second = createWorkspace({ id: 'ws-2', name: 'build', activate: false }).id;
     setWorkspaceSurfaces(first, ['a']);
     setWorkspaceSurfaces(second, ['b', 'c']);
-    setTerminalActivity('b', { status: 'ALERT_RINGING' });
+    setTerminalActivity('b', { status: 'ALERT_RINGING', episode: createAlertEpisode() });
     setTerminalActivity('c', { todo: true });
 
     const detail = request('workspace.list');
diff --git a/lib/src/host/alert-client.test.ts b/lib/src/host/alert-client.test.ts
index 88193521b..2d82eea98 100644
--- a/lib/src/host/alert-client.test.ts
+++ b/lib/src/host/alert-client.test.ts
@@ -26,7 +26,7 @@ it('sends each alert verb as one command naming its op', () => {
   methods.alertClearTodo('p');
   methods.alertEngagement({ present: true, focusId: 'p' });
   methods.alertEngagement({ present: false, focusId: 'p' }, 'idle');
-  methods.alertPublishDeliveryPolicy({ p: { speakEnabled: true } });
+  methods.alertPublishSessions({ p: { label: 'pnpm build', overrides: { speakEnabled: true } } });
   methods.alertSetWatchedCommands(['cargo']);
   // A delta, never a replacement.
   methods.alertSetCommandWatched('cargo', true);
@@ -41,7 +41,7 @@ it('sends each alert verb as one command naming its op', () => {
     { op: 'clearTodo', id: 'p' },
     { op: 'engagement', state: { present: true, focusId: 'p' } },
     { op: 'engagement', state: { present: false, focusId: 'p' }, lapse: 'idle' },
-    { op: 'deliveryPolicy', overrides: { p: { speakEnabled: true } } },
+    { op: 'sessions', sessions: { p: { label: 'pnpm build', overrides: { speakEnabled: true } } } },
     { op: 'initializeWatchedCommands', names: ['cargo'] },
     { op: 'setCommandWatched', name: 'cargo', watched: true },
     { op: 'initializeSettings', settings: DEFAULT_ALERT_SETTINGS },
@@ -62,7 +62,7 @@ describe('events', () => {
     methods.onAlertState((detail) => void seen.push(['state', detail]));
     methods.onWatchedCommands((names) => void seen.push(['watched', names]));
     methods.onAlertSettings((settings) => void seen.push(['settings', settings]));
-    methods.onAlertDeliver((delivery) => void seen.push(['deliver', delivery]));
+    const stopSpeaking = methods.onAlertSpeak((speak) => void seen.push(['speak', speak]));
 
     const detail = { id: 'p', status: 'ALERT_RINGING', todo: true } as unknown as AlertStateDetail;
     alerts.onEvent('alert:state', detail);
@@ -70,15 +70,16 @@ describe('events', () => {
     alerts.onEvent('alert:settings', { settings: DEFAULT_ALERT_SETTINGS });
     // A snapshot with no blob is dropped, not applied as "no settings".
     alerts.onEvent('alert:settings', {});
-    // A delivery the renderer cannot perform is dropped, and only its fields cross.
-    alerts.onEvent('alert:deliver', { sink: 'push', id: 'p', episodeId: 'e-1', forWindow: 'main' });
-    alerts.onEvent('alert:deliver', { sink: 'bell', id: 'p', episodeId: 'e-1' });
-    alerts.onEvent('alert:deliver', { sink: 'speech', id: 'p' });
+    // Only a speak's own fields reach the handler; one missing either is dropped.
+    alerts.onEvent('alert:speak', { id: 'p', episodeId: 'e-1', forWindow: 'main' });
+    alerts.onEvent('alert:speak', { id: 'p' });
+    stopSpeaking();
+    alerts.onEvent('alert:speak', { id: 'p', episodeId: 'e-2' });
     expect(alerts.onEvent('pty:data', { id: 'p', data: 'x' })).toBe(false);
 
     expect(seen).toEqual([
       ['state', detail], ['watched', ['make']], ['settings', DEFAULT_ALERT_SETTINGS],
-      ['deliver', { sink: 'push', id: 'p', episodeId: 'e-1' }],
+      ['speak', { id: 'p', episodeId: 'e-1' }],
     ]);
   });
 });
@@ -132,7 +133,7 @@ describe('awaits', () => {
   });
 
   it('takes the host\'s answer through the real host, a claim included', async () => {
-    const host = createAlertHost({ deliver: () => {} });
+    const host = createAlertHost({ push: () => {} });
     const realm = createAlertClient((command) => host.handle('main', command, {
       answer: (result) => void realm.onEvent('alert:awaitResult', result),
       resendStates: () => {},
diff --git a/lib/src/host/alert-client.ts b/lib/src/host/alert-client.ts
index cd8b979b8..ff356198a 100644
--- a/lib/src/host/alert-client.ts
+++ b/lib/src/host/alert-client.ts
@@ -1,9 +1,7 @@
 import type { AwaitHandle, AwaitOptions, AwaitOutcome, Engagement, EngagementLapse } from '../lib/alert-manager';
-import { ALERT_SINKS } from '../lib/alert-delivery-model';
-import type { AlertDelivery } from '../lib/alert-delivery-scheduler';
 import type { AlertSettings } from '../lib/alert-settings-model';
 import type { AlertStateDetail, PlatformAdapter } from '../lib/platform/types';
-import { isAlertEvent, type AlertAwaitResult, type AlertCommand, type AlertEvents } from './alert-protocol';
+import { isAlertEvent, type AlertAwaitResult, type AlertCommand, type AlertEvents, type AlertSpeak } from './alert-protocol';
 
 /**
  * A renderer realm's end of its host's alerts (`lib/src/host/alert-host.ts`),
@@ -19,7 +17,7 @@ export type AlertClientMethods = Required<Pick<
   | 'alertPublishSettings'
   | 'alertDismiss'
   | 'alertEngagement'
-  | 'alertPublishDeliveryPolicy'
+  | 'alertPublishSessions'
   | 'alertAcknowledge'
   | 'alertToggleTodo'
   | 'alertClearTodo'
@@ -27,7 +25,7 @@ export type AlertClientMethods = Required<Pick<
   | 'onAlertState'
   | 'onWatchedCommands'
   | 'onAlertSettings'
-  | 'onAlertDeliver'
+  | 'onAlertSpeak'
 >>;
 
 export interface AlertClient {
@@ -61,7 +59,7 @@ export function createAlertClient(send: (command: AlertCommand) => void): AlertC
   const stateHandlers = new Set<(detail: AlertStateDetail) => void>();
   const watchedHandlers = new Set<(names: string[]) => void>();
   const settingsHandlers = new Set<(settings: AlertSettings) => void>();
-  const deliverHandlers = new Set<(delivery: AlertDelivery) => void>();
+  const speakHandlers = new Set<(speak: AlertSpeak) => void>();
   const awaits = new Map<string, { resolve: (outcome: AwaitOutcome) => void; startedAt: number }>();
   const tag = randomTag();
   let awaitSeq = 0;
@@ -76,7 +74,7 @@ export function createAlertClient(send: (command: AlertCommand) => void): AlertC
     alertDismiss: (id) => send({ op: 'dismiss', id }),
     alertEngagement: (state: Engagement, lapse?: EngagementLapse) =>
       send({ op: 'engagement', state, ...(lapse ? { lapse } : {}) }),
-    alertPublishDeliveryPolicy: (overrides) => send({ op: 'deliveryPolicy', overrides }),
+    alertPublishSessions: (sessions) => send({ op: 'sessions', sessions }),
     alertAcknowledge: (id) => send({ op: 'acknowledge', id }),
     alertToggleTodo: (id) => send({ op: 'toggleTodo', id }),
     alertClearTodo: (id) => send({ op: 'clearTodo', id }),
@@ -104,7 +102,11 @@ export function createAlertClient(send: (command: AlertCommand) => void): AlertC
     onAlertState: (handler) => void stateHandlers.add(handler),
     onWatchedCommands: (handler) => void watchedHandlers.add(handler),
     onAlertSettings: (handler) => void settingsHandlers.add(handler),
-    onAlertDeliver: (handler) => void deliverHandlers.add(handler),
+    // The one handler a realm drops before it goes: the speech performer's.
+    onAlertSpeak: (handler) => {
+      speakHandlers.add(handler);
+      return () => void speakHandlers.delete(handler);
+    },
   };
 
   return {
@@ -139,12 +141,12 @@ export function createAlertClient(send: (command: AlertCommand) => void): AlertC
           if (settings) for (const handler of settingsHandlers) handler(settings);
           break;
         }
-        case 'alert:deliver': {
-          const delivery = data as Partial<AlertDelivery> | null;
-          if (!delivery || !ALERT_SINKS.includes(delivery.sink as AlertDelivery['sink'])) break;
-          if (typeof delivery.id !== 'string' || typeof delivery.episodeId !== 'string') break;
-          const { sink, id, episodeId } = delivery as AlertDelivery;
-          for (const handler of deliverHandlers) handler({ sink, id, episodeId });
+        case 'alert:speak': {
+          const speak = data as Partial<AlertSpeak> | null;
+          if (typeof speak?.id !== 'string' || typeof speak.episodeId !== 'string') break;
+          // Only its own fields reach the handler, whatever else rode along.
+          const { id, episodeId } = speak;
+          for (const handler of speakHandlers) handler({ id, episodeId });
           break;
         }
         default:
diff --git a/lib/src/host/alert-host.test.ts b/lib/src/host/alert-host.test.ts
index 0bde06122..b757144af 100644
--- a/lib/src/host/alert-host.test.ts
+++ b/lib/src/host/alert-host.test.ts
@@ -1,7 +1,6 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { createAlertHost, type AlertHost, type AlertRealm } from './alert-host';
-import type { AlertAwaitResult } from './alert-protocol';
-import type { AlertDelivery } from '../lib/alert-delivery-scheduler';
+import type { AlertAwaitResult, AlertSpeak } from './alert-protocol';
 import { DEFAULT_ALERT_SETTINGS } from '../lib/alert-settings-model';
 import { REPORT } from '../lib/alert-manager-test-utils';
 
@@ -19,7 +18,8 @@ let answers: Array<{ realm: string } & AlertAwaitResult>;
 let resent: string[];
 let watched: string[][];
 let settings: Array<Record<string, unknown>>;
-let delivered: AlertDelivery[];
+let spoken: AlertSpeak[];
+let pushed: Array<[string, string]>;
 
 function realmFor(name: string): AlertRealm {
   return {
@@ -32,8 +32,10 @@ function realmFor(name: string): AlertRealm {
 const from = (name: string, command: unknown) => host.handle(name, command, realmFor(name));
 
 beforeEach(() => {
-  delivered = [];
-  host = createAlertHost({ deliver: (delivery) => void delivered.push(delivery) });
+  spoken = [];
+  pushed = [];
+  host = createAlertHost({ push: (sessionId, title) => void pushed.push([sessionId, title]) });
+  host.onSpeak((speak) => void spoken.push(speak));
   answers = [];
   resent = [];
   watched = [];
@@ -218,51 +220,54 @@ describe('realms', () => {
 
 /**
  * The scheduler runs in the host so that no realm's end can lose or repeat a
- * delivery (`docs/specs/alert.md` -> Alarm settings).
+ * delivery (`docs/specs/alert.md` -> Alarm settings); what it resolves is
+ * `alert-delivery-scheduler.test.ts`.
  */
 describe('delivery', () => {
-  const SPEECH_OFF = { ...DEFAULT_ALERT_SETTINGS, speakEnabled: false, speakDelayMs: 5_000 };
+  const OFF = { ...DEFAULT_ALERT_SETTINGS, speakEnabled: false, speakDelayMs: 5_000, pushEnabled: false, pushDelayMs: 5_000 };
+  const SPEAK_AND_PUSH = { 'pty-1': { label: 'pnpm build', overrides: { speakEnabled: true, pushEnabled: true } } };
 
   beforeEach(() => {
     vi.useFakeTimers();
-    from('main', { op: 'initializeSettings', settings: SPEECH_OFF });
+    from('main', { op: 'initializeSettings', settings: OFF });
   });
 
-  it('takes each realm\'s published overrides over the settings the host holds', () => {
-    from('main', { op: 'deliveryPolicy', overrides: { 'pty-1': { speakEnabled: true } } });
+  it('takes a realm\'s published Sessions, speaks to its listeners, and pushes through its capability', () => {
+    from('main', { op: 'sessions', sessions: SPEAK_AND_PUSH });
     host.manager.notifyFromProtocol('pty-1', REPORT);
-    host.manager.notifyFromProtocol('pty-2', REPORT);
     vi.advanceTimersByTime(5_000);
-    expect(delivered).toEqual([{ sink: 'speech', id: 'pty-1', episodeId: host.manager.getState('pty-1').episode!.id }]);
+    expect(spoken).toEqual([{ id: 'pty-1', episodeId: host.manager.getState('pty-1').episode!.id }]);
+    expect(pushed).toEqual([['pty-1', 'pnpm build']]);
   });
 
-  it('delivers once across its realm\'s reload, whose overrides outlive the gap', () => {
-    from('main', { op: 'deliveryPolicy', overrides: { 'pty-1': { speakEnabled: true } } });
+  it('delivers once across its realm\'s reload, whose publication outlives the gap', () => {
+    from('main', { op: 'sessions', sessions: SPEAK_AND_PUSH });
     host.manager.notifyFromProtocol('pty-1', REPORT);
     vi.advanceTimersByTime(4_000);
     // The reload: the old realm ends, and the new one publishes after the deadline.
     from('main', { op: 'hello' });
     vi.advanceTimersByTime(2_000);
-    from('main', { op: 'deliveryPolicy', overrides: { 'pty-1': { speakEnabled: true } } });
+    from('main', { op: 'sessions', sessions: SPEAK_AND_PUSH });
     vi.advanceTimersByTime(60_000);
-    expect(delivered.map((delivery) => delivery.sink)).toEqual(['speech']);
+    expect(spoken).toHaveLength(1);
+    expect(pushed).toHaveLength(1);
   });
 
   it('rechecks pending work when the settings change', () => {
-    from('main', { op: 'updateSettings', settings: { ...SPEECH_OFF, speakEnabled: true } });
+    from('main', { op: 'updateSettings', settings: { ...OFF, speakEnabled: true } });
     host.manager.notifyFromProtocol('pty-1', REPORT);
-    from('main', { op: 'updateSettings', settings: SPEECH_OFF });
-    from('main', { op: 'updateSettings', settings: { ...SPEECH_OFF, speakEnabled: true } });
+    from('main', { op: 'updateSettings', settings: OFF });
+    from('main', { op: 'updateSettings', settings: { ...OFF, speakEnabled: true } });
     vi.advanceTimersByTime(60_000);
-    expect(delivered).toEqual([]);
+    expect(spoken).toEqual([]);
   });
 
   it('leaves nothing pending once disposed', () => {
-    from('main', { op: 'updateSettings', settings: { ...SPEECH_OFF, speakEnabled: true } });
+    from('main', { op: 'updateSettings', settings: { ...OFF, speakEnabled: true } });
     host.manager.notifyFromProtocol('pty-1', REPORT);
     host.dispose();
     expect(vi.getTimerCount()).toBe(0);
-    host = createAlertHost({ deliver: () => {} });
+    host = createAlertHost({ push: () => {} });
   });
 });
 
diff --git a/lib/src/host/alert-host.ts b/lib/src/host/alert-host.ts
index ec106d372..2ac560c64 100644
--- a/lib/src/host/alert-host.ts
+++ b/lib/src/host/alert-host.ts
@@ -1,9 +1,9 @@
 import { AlertManager, type AwaitHandle, type Engagement } from '../lib/alert-manager';
-import { createAlertDeliveryScheduler, type AlertDelivery } from '../lib/alert-delivery-scheduler';
+import { createAlertDeliveryScheduler } from '../lib/alert-delivery-scheduler';
 import { AlertSettingsHost } from '../lib/alert-settings-host';
 import { WatchedCommandHost } from '../lib/watched-command-host';
 import type { PersistedAlertState } from '../lib/session-types';
-import type { AlertAwaitResult } from './alert-protocol';
+import type { AlertAwaitResult, AlertSpeak } from './alert-protocol';
 
 /**
  * The host role of the alerts, run beside the PTYs by both hosts: VS Code's
@@ -12,7 +12,7 @@ import type { AlertAwaitResult } from './alert-protocol';
  * app-global stores bound to it, and every renderer realm one of its viewers,
  * driving it with `AlertCommand`s (`lib/src/host/alert-protocol.ts`), and the
  * scheduler that decides when a ring is spoken or pushed. How state,
- * snapshots and deliveries reach the realms is each host's own.
+ * snapshots and speech reach the realms is each host's own.
  */
 
 /** Where the host answers the realm a command came from. */
@@ -25,16 +25,18 @@ export interface AlertRealm {
 
 export interface AlertHostOptions {
   /**
-   * One due spoken alarm or push, for the realm showing its Session to
-   * perform (`docs/specs/alert.md` -> Alarm settings).
+   * Send one due push to the paired phones, through this process's Burrow:
+   * fire and forget, never retried (`docs/specs/alert.md` -> Alarm settings).
    */
-  deliver(delivery: AlertDelivery): void;
+  push(sessionId: string, title: string): void;
 }
 
 export interface AlertHost {
   readonly manager: AlertManager;
   readonly watched: WatchedCommandHost;
   readonly settings: AlertSettingsHost;
+  /** Each due spoken alarm, for the realm showing its Session to speak. */
+  onSpeak(listener: (speak: AlertSpeak) => void): () => void;
   /** One command from `realmId`, revalidated: nothing a renderer sends is trusted. */
   handle(realmId: string, command: unknown, realm: AlertRealm): void;
   /**
@@ -66,8 +68,13 @@ export function createAlertHost(options: AlertHostOptions): AlertHost {
   const manager = new AlertManager();
   const watched = new WatchedCommandHost(manager);
   const settings = new AlertSettingsHost(manager);
-  const delivery = createAlertDeliveryScheduler({ manager, defaults: () => settings.current, deliver: options.deliver });
-  const stopSettings = settings.subscribe(() => delivery.recheck());
+  const speakers = new Set<(speak: AlertSpeak) => void>();
+  const delivery = createAlertDeliveryScheduler({
+    manager,
+    speak: (id, episodeId) => { for (const speaker of speakers) speaker({ id, episodeId }); },
+    push: options.push,
+  });
+  const stopSettings = settings.subscribe((next) => delivery.setDefaults(next));
   /** Each realm's parked `dor await`s, by the id its client minted. */
   const parked = new Map<string, Map<string, Parked>>();
 
@@ -98,7 +105,6 @@ export function createAlertHost(options: AlertHostOptions): AlertHost {
 
   function endRealm(realmId: string): void {
     manager.removeViewer(realmId);
-    delivery.endRealm(realmId);
     const awaits = parked.get(realmId);
     if (!awaits) return;
     parked.delete(realmId);
@@ -117,6 +123,11 @@ export function createAlertHost(options: AlertHostOptions): AlertHost {
     watched,
     settings,
 
+    onSpeak(listener) {
+      speakers.add(listener);
+      return () => void speakers.delete(listener);
+    },
+
     handle(realmId, command, realm) {
       if (!command || typeof command !== 'object') return;
       const message = command as Record<string, unknown>;
@@ -154,9 +165,9 @@ export function createAlertHost(options: AlertHostOptions): AlertHost {
           manager.setViewer(realmId, message.state as Engagement, lapse);
           return;
         }
-        case 'deliveryPolicy':
+        case 'sessions':
           // Revalidated field by field, like the Workspace's persisted copy.
-          delivery.publish(realmId, message.overrides);
+          delivery.publish(realmId, message.sessions);
           return;
         case 'await':
           park(realmId, realm, message);
@@ -199,9 +210,10 @@ export function createAlertHost(options: AlertHostOptions): AlertHost {
     },
 
     dispose() {
-      // Cleared first: nothing is answered, or delivered, for a host that is
-      // going away.
+      // Cleared first: nothing is answered, spoken or pushed for a host that
+      // is going away.
       parked.clear();
+      speakers.clear();
       stopSettings();
       delivery.dispose();
       manager.dispose();
diff --git a/lib/src/host/alert-protocol.ts b/lib/src/host/alert-protocol.ts
index c4fdb1f0b..bf54436b5 100644
--- a/lib/src/host/alert-protocol.ts
+++ b/lib/src/host/alert-protocol.ts
@@ -1,6 +1,5 @@
 import type { AwaitOutcome, AwaitUntil, Engagement, EngagementLapse } from '../lib/alert-manager';
 import type { AlertDeliveryOverrides } from '../lib/alert-delivery-model';
-import type { AlertDelivery } from '../lib/alert-delivery-scheduler';
 import type { AlertSettings } from '../lib/alert-settings-model';
 import type { AlertStateDetail } from '../lib/platform/types';
 
@@ -20,13 +19,29 @@ export type AlertCommand =
   | { op: 'setCommandWatched'; name: string; watched: boolean }
   | { op: 'initializeSettings' | 'updateSettings'; settings: AlertSettings }
   | { op: 'engagement'; state: Engagement; lapse?: EngagementLapse }
-  /** Every Session this realm shows, each with its Workspace's sparse
-   *  overrides: what the host's delivery scheduler cannot know itself. */
-  | { op: 'deliveryPolicy'; overrides: Record<string, AlertDeliveryOverrides> }
+  /** Every Session this realm shows, by id: what the host's delivery
+   *  scheduler cannot know itself. Replaces what the realm published before. */
+  | { op: 'sessions'; sessions: Record<string, AlertSessionInfo> }
   | { op: 'acknowledge' | 'dismiss' | 'toggleTodo' | 'clearTodo'; id: string }
   | { op: 'await'; awaitId: string; id: string; until: AwaitUntil; timeoutMs: number }
   | { op: 'awaitCancel'; awaitId: string };
 
+/** One Session as the realm showing it publishes it (`docs/specs/alert.md` ->
+ *  Alarm settings). */
+export interface AlertSessionInfo {
+  /** The Pane label, which titles its push. */
+  label: string;
+  /** Its Workspace's sparse delivery overrides. */
+  overrides: AlertDeliveryOverrides;
+}
+
+/** A spoken alarm now due. `id` is the Session, so standalone routes it to the
+ *  window showing it. */
+export interface AlertSpeak {
+  id: string;
+  episodeId: string;
+}
+
 /** One await's outcome, to the realm that parked it, under the id it minted. */
 export interface AlertAwaitResult {
   awaitId: string;
@@ -43,8 +58,8 @@ export interface AlertEvents {
   /** The app-global stores' canonical snapshots, to every realm. */
   'alert:watchedCommands': { names: string[] };
   'alert:settings': { settings: AlertSettings };
-  /** A spoken alarm or push now due, to the realm that shows its Session. */
-  'alert:deliver': AlertDelivery;
+  /** A spoken alarm now due, to the realm that shows its Session. */
+  'alert:speak': AlertSpeak;
 }
 
 export const ALERT_EVENTS = [
@@ -52,7 +67,7 @@ export const ALERT_EVENTS = [
   'alert:awaitResult',
   'alert:watchedCommands',
   'alert:settings',
-  'alert:deliver',
+  'alert:speak',
 ] as const satisfies ReadonlyArray<keyof AlertEvents>;
 
 export type AlertEventName = (typeof ALERT_EVENTS)[number];
diff --git a/lib/src/host/remote/service-protocol.ts b/lib/src/host/remote/service-protocol.ts
index 1a301ff2b..e5230185f 100644
--- a/lib/src/host/remote/service-protocol.ts
+++ b/lib/src/host/remote/service-protocol.ts
@@ -176,12 +176,6 @@ export interface DenyParams {
   pairingId: string;
 }
 
-/** The webview names the Session and what to call it; recipients are never its call. */
-export interface PushParams {
-  sessionId: string;
-  title: string;
-}
-
 /** Answers an outstanding {@link BurrowAsk}; `burrowRequestId` is the ask's, not a new one. */
 export interface AnswerParams {
   burrowRequestId: string;
diff --git a/lib/src/host/remote/service.test.ts b/lib/src/host/remote/service.test.ts
index 5083fb8b5..4e1936470 100644
--- a/lib/src/host/remote/service.test.ts
+++ b/lib/src/host/remote/service.test.ts
@@ -1040,6 +1040,10 @@ describe('setup QR', () => {
   });
 });
 
+/**
+ * One due alarm push, from the alert host in the service's own process
+ * (`docs/specs/alert.md` -> Push notifications). No webview can ask for one.
+ */
 describe('push', () => {
   const rawSendBody = (): string | null =>
     (requests.filter((r) => r.url.endsWith('/api/push/send')).at(-1)?.init?.body as string) ?? null;
@@ -1050,14 +1054,14 @@ describe('push', () => {
       : [];
   };
 
-  it('addresses the Burrow’s own ACL, not anything the webview sent', async () => {
+  it('addresses the Burrow’s own ACL', async () => {
     createService({
       enrollment: ENROLLMENT,
       acl: { [BURROW_ID]: [aclRecord('device-1'), aclRecord('device-2', 'iPad')] },
     });
     await service.start();
 
-    await command('push', { sessionId: 'pty-1', title: 'pnpm dev' });
+    await service.push('pty-1', 'pnpm dev');
 
     // One sealed envelope per active record, in ACL order.
     expect(sendRecipients().map((r) => r.deliveryId)).toEqual([
@@ -1066,28 +1070,27 @@ describe('push', () => {
     ]);
   });
 
-  it('seals what the webview named rather than posting it', async () => {
+  it('seals the title rather than posting it', async () => {
     // The Relay forwards this body and can read none of it
     // (docs/specs/remote-security-model.md -> Push sealing). That the label is
-    // bounded *before* it is sealed is `lib/src/remote/burrow/alert-push.test.ts`,
+    // bounded *before* it is sealed is `lib/src/remote/burrow/push-delivery.test.ts`,
     // which holds the key to open one.
     createService({ enrollment: ENROLLMENT, acl: { [BURROW_ID]: [aclRecord('device-1')] } });
     await service.start();
 
-    await command('push', { sessionId: 'pty-1', title: 'build\u0000finished\u001b' });
+    await service.push('pty-1', 'build\u0000finished\u001b');
     const body = rawSendBody()!;
     expect(body).not.toContain('finished');
     expect(body).not.toContain('pty-1');
   });
 
-  it('is a silent no-op with no Burrow running', async () => {
+  it('sends nothing with no Burrow running', async () => {
     createService();
-    const result = await command('push', { sessionId: 'pty-1', title: 'x' });
-    expect(result.error).toBeUndefined();
+    await service.push('pty-1', 'x');
     expect(requests).toEqual([]);
   });
 
-  it('warns rather than failing the command when the Relay rejects it', async () => {
+  it('warns rather than rejecting when the Relay refuses the send', async () => {
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
     store = memoryStore({ enrollment: ENROLLMENT, acl: { [BURROW_ID]: [aclRecord('device-1')] } });
     service = new BurrowService({
@@ -1101,10 +1104,18 @@ describe('push', () => {
     });
     await service.start();
 
-    expect((await command('push', { sessionId: 'pty-1', title: 'x' })).error).toBeUndefined();
+    await expect(service.push('pty-1', 'x')).resolves.toBeUndefined();
     expect(warn).toHaveBeenCalled();
     warn.mockRestore();
   });
+
+  it('is no command a webview can send', async () => {
+    createService({ enrollment: ENROLLMENT, acl: { [BURROW_ID]: [aclRecord('device-1')] } });
+    await service.start();
+
+    expect((await command('push', { sessionId: 'pty-1', title: 'x' })).error).toBe('unknown burrow command: push');
+    expect(rawSendBody()).toBeNull();
+  });
 });
 
 describe('pushDevices', () => {
diff --git a/lib/src/host/remote/service.ts b/lib/src/host/remote/service.ts
index 86ec46563..4406c9c0a 100644
--- a/lib/src/host/remote/service.ts
+++ b/lib/src/host/remote/service.ts
@@ -56,7 +56,6 @@ import {
   type PairingQueueEvent,
   type PairingQueueItem,
   type PushDevicesResult,
-  type PushParams,
   type PushSendSummary,
   type BurrowConsoleStatus,
   type SetupQrResult,
@@ -272,8 +271,6 @@ export class BurrowService {
         return this.#serialize(() => this.#approve(params as ApproveParams));
       case 'deny':
         return this.#deny(params as DenyParams);
-      case 'push':
-        return this.#push(params as PushParams);
       case 'pushTest':
         return this.#pushTest();
       case 'pushDevices':
@@ -500,23 +497,25 @@ export class BurrowService {
     return pending;
   }
 
-  async #push(params: PushParams): Promise<Record<string, never>> {
+  /**
+   * One due alarm push, from the alert host in this same process — the
+   * sidecar's, or VS Code's through `pushAlert` in `vscode-ext/src/burrow.ts`
+   * (`docs/specs/alert.md` -> Push notifications). No Burrow means no ACL and
+   * no Relay to post to, so nothing is sent. Never rejects: a push that fails is
+   * logged, since a dead push must never break the alert path.
+   */
+  async push(sessionId: string, title: string): Promise<void> {
     const deps = this.#pushDeps();
-    // No Burrow means no ACL and no Relay to post to; the ring is simply not
-    // pushed. Nothing to report to the webview, which cannot act on it either.
-    if (deps) {
-      // A push that fails must never break the alert path.
-      await sendPush(deps, params.sessionId, params.title).catch((error: unknown) => {
-        console.warn('[burrow] push notification failed', error);
-      });
-    }
-    return {};
+    if (!deps) return;
+    await sendPush(deps, sessionId, title).catch((error: unknown) => {
+      console.warn('[burrow] push notification failed', error);
+    });
   }
 
   /**
    * The Settings dialog's "Send test push".
    *
-   * The inverse of {@link #push} in the one way that matters: nothing is
+   * The inverse of {@link push} in the one way that matters: nothing is
    * swallowed. A test whose whole purpose is to report an outcome must let the
    * failure through, so an unenrolled machine, an unreachable Relay, and a
    * fan-out that reached nobody all read differently at the button.
@@ -639,9 +638,9 @@ export class BurrowService {
   /**
    * Tell the webviews whether there is a Burrow at all. Everything they do *for*
    * one — announcing that the directory may have changed on every pane-state,
-   * activity, and focus change — costs a
-   * crossing per event on a machine that may never enroll, so they arm on this
-   * and idle without it (`lib/src/remote/burrow/enrolled-gate.ts`).
+   * activity, and focus change — costs a crossing per event on a machine that
+   * may never enroll, so they arm on this and idle without it
+   * (`lib/src/remote/burrow/enrolled-gate.ts`).
    *
    * `enrolled` means the same thing as the `status` command's field of that
    * name, which is how a webview seeds before any event arrives.
diff --git a/lib/src/host/remote/sidecar-entry.test.ts b/lib/src/host/remote/sidecar-entry.test.ts
index b33932463..84faf39a4 100644
--- a/lib/src/host/remote/sidecar-entry.test.ts
+++ b/lib/src/host/remote/sidecar-entry.test.ts
@@ -12,6 +12,7 @@ import {
   type SidecarSurfaceBridge,
 } from './sidecar-entry';
 import { ASK_BUDGET_MS, type BurrowAsk } from './service-protocol';
+import { BurrowService } from './service';
 import { AlertManager, type AlertState } from '../../lib/alert-manager';
 import { REPORT } from '../../lib/alert-manager-test-utils';
 import { createAlertClient } from '../alert-client';
@@ -777,22 +778,19 @@ describe('the sidecar host', () => {
     expect(result).toEqual({ awaitId: 'await-1', forWindow: 'ws-2', outcome: expect.objectContaining({ cause: 'bell' }) });
   });
 
-  // A delivery carries its Session's `id`, so Rust routes it to the window
-  // showing that Session; the policy it was due under is each window's own.
-  it('sends a due delivery naming its Session, under the policy its window published', () => {
+  // A spoken alarm names its Session, so Rust routes it to the window showing
+  // it; a push goes to this process's Burrow, whichever window shows it.
+  it('sends a due spoken alarm naming its Session, and a due push to its own Burrow', () => {
     vi.useFakeTimers();
-    try {
-      command('main', { op: 'initializeSettings', settings: { speakDelayMs: 1_000 } });
-      command('main', { op: 'deliveryPolicy', overrides: { 'pty-1': { speakEnabled: true } } });
-      host.alerts.notifyFromProtocol('pty-1', REPORT);
-      host.alerts.notifyFromProtocol('pty-2', REPORT);
-      vi.advanceTimersByTime(1_000);
-      expect(out.filter((line) => line.event === 'alert:deliver').map((line) => line.data)).toEqual([
-        { sink: 'speech', id: 'pty-1', episodeId: host.alerts.getState('pty-1').episode!.id },
-      ]);
-    } finally {
-      vi.useRealTimers();
-    }
+    const push = vi.spyOn(BurrowService.prototype, 'push').mockResolvedValue();
+    command('main', { op: 'initializeSettings', settings: { speakEnabled: true, speakDelayMs: 1_000, pushEnabled: true, pushDelayMs: 1_000 } });
+    command('main', { op: 'sessions', sessions: { 'pty-1': { label: 'pnpm build', overrides: {} } } });
+    host.alerts.notifyFromProtocol('pty-1', REPORT);
+    vi.advanceTimersByTime(1_000);
+    expect(out.filter((line) => line.event === 'alert:speak').map((line) => line.data)).toEqual([
+      { id: 'pty-1', episodeId: host.alerts.getState('pty-1').episode!.id },
+    ]);
+    expect(push).toHaveBeenCalledExactlyOnceWith('pty-1', 'pnpm build');
   });
 
   it('ignores an alert command no host stamped', () => {
diff --git a/lib/src/host/remote/sidecar-entry.ts b/lib/src/host/remote/sidecar-entry.ts
index bc31ea339..4da87c8a6 100644
--- a/lib/src/host/remote/sidecar-entry.ts
+++ b/lib/src/host/remote/sidecar-entry.ts
@@ -431,12 +431,17 @@ const isString = (value: unknown): value is string => typeof value === 'string';
 export function createSidecarHost(options: SidecarHostOptions): SidecarHost {
   const { send, mgr } = options;
   const sendAlert = <E extends keyof AlertEvents>(event: E, data: AlertEvents[E]) => send(event, data);
-  // A delivery names its Session, so Rust routes it to the window showing it.
-  const alertHost = createAlertHost({ deliver: (delivery) => sendAlert('alert:deliver', delivery) });
+  const alertHost = createAlertHost({
+    // Late-bound: the service below is built on this manager's bridge, and a
+    // push comes due only on a timer, once both exist.
+    push: (sessionId, title) => void service.push(sessionId, title),
+  });
   const alerts = alertHost.manager;
 
   const publishState = (id: string, state: AlertState) => sendAlert('alert:state', { id, ...state });
   const stops = [
+    // It names its Session, so Rust routes it to the window showing it.
+    alertHost.onSpeak((speak) => sendAlert('alert:speak', speak)),
     alertHost.watched.subscribe((names) => sendAlert('alert:watchedCommands', { names })),
     alertHost.settings.subscribe((settings) => sendAlert('alert:settings', { settings })),
     alerts.onStateChange(publishState),
diff --git a/lib/src/lib/alert-delivery-model.ts b/lib/src/lib/alert-delivery-model.ts
index e87fff07b..c7973d3bb 100644
--- a/lib/src/lib/alert-delivery-model.ts
+++ b/lib/src/lib/alert-delivery-model.ts
@@ -2,7 +2,6 @@ import { clampAlertDelayMs, type AlertSettings } from './alert-settings-model';
 
 /** The two alarm sinks (`docs/specs/alert.md` -> Alarm settings). */
 export type AlertSink = 'speech' | 'push';
-export const ALERT_SINKS: readonly AlertSink[] = ['speech', 'push'];
 
 /** Missing fields inherit the application default; null voice selects the system voice. */
 export type AlertDeliveryOverrides = Partial<Pick<AlertSettings, 'speakEnabled' | 'speakDelayMs' | 'pushEnabled' | 'pushDelayMs'>> & {
@@ -35,12 +34,10 @@ export function resolveAlertDeliveryPolicy(defaults: AlertSettings, overrides: A
   };
 }
 
-/** Whether `policy` turns `sink` on. */
-export function sinkEnabled(policy: AlertDeliveryPolicy, sink: AlertSink): boolean {
-  return sink === 'speech' ? policy.speakEnabled : policy.pushEnabled;
-}
-
-/** How long after an episode starts `policy` delivers to `sink`. */
-export function sinkDelayMs(policy: AlertDeliveryPolicy, sink: AlertSink): number {
-  return sink === 'speech' ? policy.speakDelayMs : policy.pushDelayMs;
+/** Field by field: the realm's publish dedupe, the host's recheck, and a
+ *  Workspace edit that changes nothing all compare this way. */
+export function sameAlertDeliveryOverrides(a: AlertDeliveryOverrides, b: AlertDeliveryOverrides): boolean {
+  const keys = new Set([...Object.keys(a), ...Object.keys(b)]) as Set<keyof AlertDeliveryOverrides>;
+  for (const key of keys) if (a[key] !== b[key]) return false;
+  return true;
 }
diff --git a/lib/src/lib/alert-delivery-policy.test.ts b/lib/src/lib/alert-delivery-policy.test.ts
index 3baa6e3c1..8e24ac3c1 100644
--- a/lib/src/lib/alert-delivery-policy.test.ts
+++ b/lib/src/lib/alert-delivery-policy.test.ts
@@ -1,7 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 vi.mock('./platform', () => ({ getPlatform: () => ({ alertPublishSettings: vi.fn() }) }));
 import { normalizeAlertDeliveryOverrides, resolveAlertDeliveryPolicy } from './alert-delivery-model';
-import { collectDeliveryOverrides, getSessionAlertPolicy } from './alert-delivery-policy';
+import { getSessionAlertPolicy } from './alert-delivery-policy';
 import { applyAlertSettingsFromHost, DEFAULT_ALERT_SETTINGS } from './alert-settings';
 import { createWorkspace, renameWorkspace, resetWorkspaces, setWorkspaceAlertDelivery } from './workspace-store';
 import { resetWorkspaceSurfaces, setWorkspaceSurfaces } from './workspace-surfaces';
@@ -10,8 +10,8 @@ import { getWindowSnapshot, publishWorkspaceSession, resetWindowSessionAggregato
 
 /**
  * A Workspace's sparse delivery overrides (`docs/specs/alert.md` -> Alarm
- * settings): how they persist, how a Session resolves them, and what the
- * renderer publishes to the host's scheduler. The scheduling itself is
+ * settings): how they persist and how a Session resolves them in the renderer.
+ * What the host is told is `alert-delivery.test.ts`; the scheduling itself is
  * `alert-delivery-scheduler.test.ts`.
  */
 
@@ -49,14 +49,4 @@ describe('workspace delivery policy', () => {
     expect(getSessionAlertPolicy('pane')).toMatchObject({ speakEnabled: true, speakDelayMs: 1000, pushEnabled: false });
     expect(getSessionAlertPolicy('elsewhere')).toMatchObject({ speakEnabled: false, speakDelayMs: DEFAULT_ALERT_SETTINGS.speakDelayMs });
   });
-  it('publishes every member Session with its Workspace\'s overrides, an empty one included', () => {
-    workspace();
-    createWorkspace({ id: 'plain' });
-    setWorkspaceSurfaces('plain', ['a', 'b']);
-    expect(collectDeliveryOverrides()).toEqual({
-      pane: { speakEnabled: true, speakDelayMs: 1000 },
-      a: {},
-      b: {},
-    });
-  });
 });
diff --git a/lib/src/lib/alert-delivery-policy.ts b/lib/src/lib/alert-delivery-policy.ts
index 8d37836a5..51aeffb72 100644
--- a/lib/src/lib/alert-delivery-policy.ts
+++ b/lib/src/lib/alert-delivery-policy.ts
@@ -1,4 +1,4 @@
-import { resolveAlertDeliveryPolicy, type AlertDeliveryPolicy, type AlertDeliveryOverrides } from './alert-delivery-model';
+import { resolveAlertDeliveryPolicy, type AlertDeliveryPolicy } from './alert-delivery-model';
 import { getAlertSettings, subscribeToAlertSettings } from './alert-settings';
 import { getWorkspace, subscribeToWorkspaces } from './workspace-store';
 import { getWorkspaceSurfacesSnapshot, subscribeToWorkspaceSurfaces } from './workspace-surfaces';
@@ -21,14 +21,3 @@ export function subscribeToAlertDeliveryPolicy(listener: () => void): () => void
   const stops = [subscribeToAlertSettings(listener), subscribeToWorkspaces(listener), subscribeToWorkspaceSurfaces(listener)];
   return () => stops.forEach((stop) => stop());
 }
-
-/** Every member Surface of this realm's Workspaces, with its Workspace's
- *  sparse overrides: what the host's delivery scheduler is told. */
-export function collectDeliveryOverrides(): Record<string, AlertDeliveryOverrides> {
-  const overrides: Record<string, AlertDeliveryOverrides> = {};
-  for (const [workspaceId, ids] of getWorkspaceSurfacesSnapshot()) {
-    const workspace = getWorkspace(workspaceId)?.alertDelivery ?? {};
-    for (const id of ids) overrides[id] = workspace;
-  }
-  return overrides;
-}
diff --git a/lib/src/lib/alert-delivery-scheduler.test.ts b/lib/src/lib/alert-delivery-scheduler.test.ts
index fb55eba92..0ea30c32c 100644
--- a/lib/src/lib/alert-delivery-scheduler.test.ts
+++ b/lib/src/lib/alert-delivery-scheduler.test.ts
@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AlertManager } from './alert-manager';
-import { createAlertDeliveryScheduler, type AlertDelivery, type AlertDeliveryScheduler } from './alert-delivery-scheduler';
+import { createAlertDeliveryScheduler, type AlertDeliveryScheduler } from './alert-delivery-scheduler';
 import { DEFAULT_ALERT_SETTINGS, type AlertSettings } from './alert-settings-model';
 import { engage, leave, REPORT } from './alert-manager-test-utils';
 
@@ -15,13 +15,16 @@ const PANE = 'pane';
 const OTHER = 'other';
 const SPEAK_MS = 10_000;
 const PUSH_MS = 20_000;
+const SETTINGS: AlertSettings = { ...DEFAULT_ALERT_SETTINGS, speakEnabled: true, speakDelayMs: SPEAK_MS, pushEnabled: true, pushDelayMs: PUSH_MS };
+
+type Delivered = { sink: 'speech'; id: string; episodeId: string } | { sink: 'push'; id: string; title: string };
 
 let manager: AlertManager;
 let scheduler: AlertDeliveryScheduler;
-let settings: AlertSettings;
-let delivered: AlertDelivery[];
+let delivered: Delivered[];
 
 const sinks = () => delivered.map((delivery) => delivery.sink);
+const episodeId = (id = PANE) => manager.getState(id).episode!.id;
 const ring = (id = PANE) => manager.notifyFromProtocol(id, REPORT);
 /** Clear the ring with a click, then ring again on fresh output. */
 const ringAgain = () => {
@@ -29,17 +32,18 @@ const ringAgain = () => {
   manager.onData(PANE);
   ring();
 };
+const session = (overrides: object, label = 'pnpm build') => ({ label, overrides });
 
 beforeEach(() => {
   vi.useFakeTimers();
   manager = new AlertManager();
-  settings = { ...DEFAULT_ALERT_SETTINGS, speakEnabled: true, speakDelayMs: SPEAK_MS, pushEnabled: true, pushDelayMs: PUSH_MS };
   delivered = [];
   scheduler = createAlertDeliveryScheduler({
     manager,
-    defaults: () => settings,
-    deliver: (delivery) => void delivered.push(delivery),
+    speak: (id, episode) => void delivered.push({ sink: 'speech', id, episodeId: episode }),
+    push: (id, title) => void delivered.push({ sink: 'push', id, title }),
   });
+  scheduler.setDefaults(SETTINGS);
 });
 
 afterEach(() => {
@@ -51,18 +55,19 @@ afterEach(() => {
 describe('the delivery scheduler', () => {
   it('delivers each sink once per episode, its delay after the episode started', () => {
     ring();
-    const episodeId = manager.getState(PANE).episode!.id;
+    const episode = episodeId();
     vi.advanceTimersByTime(SPEAK_MS - 1);
     expect(delivered).toEqual([]);
     vi.advanceTimersByTime(1);
-    expect(delivered).toEqual([{ sink: 'speech', id: PANE, episodeId }]);
+    expect(delivered).toEqual([{ sink: 'speech', id: PANE, episodeId: episode }]);
     vi.advanceTimersByTime(PUSH_MS - SPEAK_MS);
-    expect(delivered.at(-1)).toEqual({ sink: 'push', id: PANE, episodeId });
+    // Unpublished, the Session is called what its label falls back to.
+    expect(delivered.at(-1)).toEqual({ sink: 'push', id: PANE, title: 'terminal' });
 
     // A second report joining the episode publishes its detail, and delivers
     // nothing more.
     manager.notifyFromProtocol(PANE, { source: 'OSC 9', title: null, body: 'deploy failed' });
-    expect(manager.getState(PANE)).toMatchObject({ episode: { id: episodeId }, notification: { body: 'deploy failed' } });
+    expect(manager.getState(PANE)).toMatchObject({ episode: { id: episode }, notification: { body: 'deploy failed' } });
     vi.advanceTimersByTime(10 * PUSH_MS);
     expect(sinks()).toEqual(['speech', 'push']);
   });
@@ -100,17 +105,16 @@ describe('the delivery scheduler', () => {
     vi.advanceTimersByTime(SPEAK_MS - 1);
     expect(delivered).toEqual([]);
     vi.advanceTimersByTime(1);
-    expect(delivered).toEqual([{ sink: 'speech', id: PANE, episodeId: manager.getState(PANE).episode!.id }]);
+    expect(delivered).toEqual([{ sink: 'speech', id: PANE, episodeId: episodeId() }]);
   });
 
   it('consumes pending work when a sink turns off, and never replays it when it turns back on', () => {
     ring();
     vi.advanceTimersByTime(SPEAK_MS / 2);
-    scheduler.publish('main', { [PANE]: { speakEnabled: false } });
-    scheduler.publish('main', { [PANE]: { speakEnabled: true } });
-    settings = { ...settings, pushEnabled: false };
-    scheduler.recheck();
-    settings = { ...settings, pushEnabled: true };
+    scheduler.publish('main', { [PANE]: session({ speakEnabled: false }) });
+    scheduler.publish('main', { [PANE]: session({ speakEnabled: true }) });
+    scheduler.setDefaults({ ...SETTINGS, pushEnabled: false });
+    scheduler.setDefaults(SETTINGS);
     vi.advanceTimersByTime(10 * PUSH_MS);
     expect(delivered).toEqual([]);
   });
@@ -118,56 +122,77 @@ describe('the delivery scheduler', () => {
   it('keeps a deadline through a later delay edit', () => {
     ring();
     vi.advanceTimersByTime(SPEAK_MS / 2);
-    scheduler.publish('main', { [PANE]: { speakDelayMs: 60_000 } });
+    scheduler.publish('main', { [PANE]: session({ speakDelayMs: 60_000 }) });
     vi.advanceTimersByTime(SPEAK_MS / 2);
     expect(sinks()).toEqual(['speech']);
   });
 
   it('never delivers an episode that began with its sink off', () => {
-    settings = { ...settings, speakEnabled: false, pushEnabled: false };
+    scheduler.setDefaults({ ...SETTINGS, speakEnabled: false, pushEnabled: false });
     ring();
-    settings = { ...settings, speakEnabled: true, pushEnabled: true };
-    scheduler.recheck();
+    scheduler.setDefaults(SETTINGS);
     vi.advanceTimersByTime(10 * PUSH_MS);
     expect(delivered).toEqual([]);
   });
 });
 
-describe('published policy', () => {
-  it('resolves a Session\'s Workspace overrides over the defaults, delay included', () => {
-    settings = { ...settings, speakEnabled: false, pushEnabled: false };
-    scheduler.publish('main', { [PANE]: { speakEnabled: true, speakDelayMs: 2_000 }, [OTHER]: {} });
+describe('published Sessions', () => {
+  it('resolves a Session\'s Workspace overrides over the defaults, delay included, and titles its push', () => {
+    scheduler.setDefaults({ ...SETTINGS, speakEnabled: false, pushEnabled: false });
+    scheduler.publish('main', { [PANE]: session({ pushEnabled: true, pushDelayMs: 2_000 }), [OTHER]: session({}) });
     ring();
     ring(OTHER);
     vi.advanceTimersByTime(2_000);
-    expect(delivered).toEqual([{ sink: 'speech', id: PANE, episodeId: manager.getState(PANE).episode!.id }]);
+    expect(delivered).toEqual([{ sink: 'push', id: PANE, title: 'pnpm build' }]);
   });
 
   it('keeps the last realm to publish a Session, whichever of the two publishes next', () => {
-    scheduler.publish('source', { [PANE]: { speakEnabled: true } });
-    scheduler.publish('target', { [PANE]: { speakEnabled: false } });
+    scheduler.setDefaults({ ...SETTINGS, pushEnabled: false });
+    scheduler.publish('source', { [PANE]: session({ speakEnabled: false }) });
+    scheduler.publish('target', { [PANE]: session({}) });
     // The source lets it go after the target took it: the target's stands.
     scheduler.publish('source', {});
-    expect(scheduler.policy(PANE).speakEnabled).toBe(false);
+    ring();
+    vi.advanceTimersByTime(SPEAK_MS);
+    expect(sinks()).toEqual(['speech']);
+
     // A realm dropping a Session it last published returns it to the defaults.
+    scheduler.publish('target', { [PANE]: session({ speakEnabled: false }) });
     scheduler.publish('target', {});
-    expect(scheduler.policy(PANE).speakEnabled).toBe(true);
+    ringAgain();
+    vi.advanceTimersByTime(SPEAK_MS);
+    expect(sinks()).toEqual(['speech', 'speech']);
   });
 
-  it('keeps a live Session\'s overrides past its realm\'s end, and drops a gone one\'s', () => {
+  it('keeps a live Session\'s publication past its realm, and forgets a removed one\'s', () => {
+    scheduler.publish('main', { [PANE]: session({ pushEnabled: false }), [OTHER]: session({ pushEnabled: false }) });
+    ring(OTHER);
+    manager.remove(OTHER);
+    // The realm is gone, and never published again; a Session reusing the id
+    // is not the one it described.
     ring();
-    scheduler.publish('main', { [PANE]: { pushEnabled: false }, [OTHER]: { pushEnabled: false } });
-    scheduler.endRealm('main');
-    expect(scheduler.policy(PANE).pushEnabled).toBe(false);
-    expect(scheduler.policy(OTHER).pushEnabled).toBe(true);
+    ring(OTHER);
+    vi.advanceTimersByTime(PUSH_MS);
+    expect(delivered.filter((delivery) => delivery.sink === 'push')).toEqual([{ sink: 'push', id: OTHER, title: 'terminal' }]);
   });
 
   it('revalidates what a realm publishes', () => {
-    scheduler.publish('main', { [PANE]: { speakEnabled: false } });
+    scheduler.publish('main', { [PANE]: session({ speakEnabled: false }) });
     scheduler.publish('main', null);
-    scheduler.publish('main', [{ speakEnabled: true }]);
-    expect(scheduler.policy(PANE).speakEnabled).toBe(false);
-    scheduler.publish('main', { [PANE]: { speakEnabled: 'no', speakDelayMs: Number.NaN, pushDelayMs: -5 } });
-    expect(scheduler.policy(PANE)).toMatchObject({ speakEnabled: true, speakDelayMs: SPEAK_MS, pushDelayMs: 1_000 });
+    scheduler.publish('main', [session({ speakEnabled: true })]);
+    ring();
+    vi.advanceTimersByTime(SPEAK_MS);
+    expect(delivered).toEqual([]);
+
+    scheduler.publish('main', {
+      [PANE]: { label: 42, overrides: { speakEnabled: 'no', speakDelayMs: Number.NaN, pushDelayMs: -5 } },
+    });
+    ringAgain();
+    vi.advanceTimersByTime(SPEAK_MS);
+    // The push delay clamps to its floor; the rest fall back to the defaults.
+    expect(delivered).toEqual([
+      { sink: 'push', id: PANE, title: 'terminal' },
+      { sink: 'speech', id: PANE, episodeId: episodeId() },
+    ]);
   });
 });
diff --git a/lib/src/lib/alert-delivery-scheduler.ts b/lib/src/lib/alert-delivery-scheduler.ts
index 699e18a5f..bd69aa5a7 100644
--- a/lib/src/lib/alert-delivery-scheduler.ts
+++ b/lib/src/lib/alert-delivery-scheduler.ts
@@ -1,115 +1,124 @@
 import type { AlertManager, AlertState } from './alert-manager';
 import {
-  ALERT_SINKS,
   normalizeAlertDeliveryOverrides,
   resolveAlertDeliveryPolicy,
-  sinkDelayMs,
-  sinkEnabled,
+  sameAlertDeliveryOverrides,
   type AlertDeliveryOverrides,
   type AlertDeliveryPolicy,
   type AlertSink,
 } from './alert-delivery-model';
-import type { AlertSettings } from './alert-settings-model';
+import { DEFAULT_ALERT_SETTINGS, type AlertSettings } from './alert-settings-model';
 
 /**
  * When a ring is spoken or pushed (`docs/specs/alert.md` -> Alarm settings),
  * decided in the host beside the `AlertManager`, which sees every episode from
- * its start and outlives every renderer. The renderer only performs a delivery:
- * speech needs `window.speechSynthesis`, and both need the Pane's label.
+ * its start and outlives every renderer. A push goes from here; speech needs
+ * `window.speechSynthesis`, so it goes to the realm showing the Session.
  * Platform-free, like the manager: both hosts run it inside `createAlertHost`.
  */
 
-/** One due delivery, for the realm showing its Session to perform. `id` is the
- *  Session, named so standalone routes it to the window showing it. */
-export interface AlertDelivery {
-  sink: AlertSink;
-  id: string;
-  episodeId: string;
-}
-
 export interface AlertDeliverySchedulerOptions {
   manager: Pick<AlertManager, 'onStateChange' | 'has' | 'isEngaged' | 'viewerIds'>;
-  /** The application defaults, read at every decision. */
-  defaults: () => AlertSettings;
-  deliver: (delivery: AlertDelivery) => void;
+  /** A spoken alarm is due, for the realm showing the Session to speak. */
+  speak(id: string, episodeId: string): void;
+  /** A push is due, titled by the Session's published Pane label. */
+  push(id: string, title: string): void;
 }
 
 export interface AlertDeliveryScheduler {
   /**
-   * One realm's Sessions, each with its Workspace's sparse overrides,
-   * revalidated. Replaces what that realm published before, except a Session
-   * another realm has published since.
+   * One realm's Sessions, `{ label, overrides }` by id, revalidated. Replaces
+   * what that realm published before, except a Session another realm has
+   * published since.
    */
-  publish(realmId: string, overrides: unknown): void;
-  /** The realm is gone: what it published for Sessions that are gone too goes. */
-  endRealm(realmId: string): void;
-  /** The defaults changed. */
-  recheck(): void;
-  /** The Session's effective policy: the defaults under its published overrides. */
-  policy(id: string): AlertDeliveryPolicy;
+  publish(realmId: string, sessions: unknown): void;
+  /** The application defaults, from the host's settings store. */
+  setDefaults(settings: AlertSettings): void;
   dispose(): void;
 }
 
-/** One sink's record of one episode: pending while it has a timer, consumed after. */
-interface Receipt {
-  episodeId: string;
-  timer: ReturnType<typeof setTimeout> | null;
+/** Longest label the host keeps. `toPushText` cuts far shorter at send time;
+ *  this only bounds what a renderer can make the host hold. */
+const LABEL_LIMIT = 1_024;
+
+interface Published {
+  realmId: string;
+  label: string;
+  overrides: AlertDeliveryOverrides;
 }
 
 export function createAlertDeliveryScheduler(options: AlertDeliverySchedulerOptions): AlertDeliveryScheduler {
   const { manager } = options;
-  const receipts: Record<AlertSink, Map<string, Receipt>> = { speech: new Map(), push: new Map() };
-  /** Each Session's overrides, and the realm that last published them. */
-  const published = new Map<string, { realmId: string; overrides: AlertDeliveryOverrides }>();
-
-  const policy = (id: string): AlertDeliveryPolicy =>
-    resolveAlertDeliveryPolicy(options.defaults(), published.get(id)?.overrides);
-
-  const consume = (receipt: Receipt | undefined): void => {
-    if (receipt?.timer) clearTimeout(receipt.timer);
-    if (receipt) receipt.timer = null;
+  let defaults = DEFAULT_ALERT_SETTINGS;
+  /** Each ringing Session's episode, and the sinks whose deadline is still to
+   *  come; a sink missing from `timers` is consumed for that episode. */
+  const episodes = new Map<string, { episodeId: string; timers: Map<AlertSink, ReturnType<typeof setTimeout>> }>();
+  /** Each Session's last publication, and the realm that made it. */
+  const published = new Map<string, Published>();
+
+  /** Speech spares the pane the user is looking at; a push waits until the
+   *  user has left every viewer (rationale). */
+  const sinks: Record<AlertSink, {
+    enabled(policy: AlertDeliveryPolicy): boolean;
+    delayMs(policy: AlertDeliveryPolicy): number;
+    blocked(id: string): boolean;
+    deliver(id: string, episodeId: string): void;
+  }> = {
+    speech: {
+      enabled: (policy) => policy.speakEnabled,
+      delayMs: (policy) => policy.speakDelayMs,
+      blocked: (id) => manager.isEngaged(id),
+      deliver: (id, episodeId) => options.speak(id, episodeId),
+    },
+    push: {
+      enabled: (policy) => policy.pushEnabled,
+      delayMs: (policy) => policy.pushDelayMs,
+      blocked: () => manager.viewerIds().length > 0,
+      deliver: (id) => options.push(id, published.get(id)?.label || 'terminal'),
+    },
   };
 
-  /** The deadline of an episode still ringing (its end consumed the receipt):
-   *  still on, and still owed. A deadline that fails is consumed, never
-   *  retried. */
-  function due(sink: AlertSink, id: string, receipt: Receipt): void {
-    receipt.timer = null;
-    if (!sinkEnabled(policy(id), sink)) return;
-    // Speech never talks over the pane the user is looking at; a push goes
-    // only to a user away from every viewer (rationale).
-    if (sink === 'speech' ? manager.isEngaged(id) : manager.viewerIds().length > 0) return;
-    options.deliver({ sink, id, episodeId: receipt.episodeId });
+  const policy = (id: string): AlertDeliveryPolicy =>
+    resolveAlertDeliveryPolicy(defaults, published.get(id)?.overrides);
+
+  /** A sink turned off consumes its pending deadline; one turned on never
+   *  replays it. */
+  function recheck(id: string): void {
+    const timers = episodes.get(id)?.timers;
+    if (!timers) return;
+    const effective = policy(id);
+    for (const [sink, timer] of timers) {
+      if (sinks[sink].enabled(effective)) continue;
+      clearTimeout(timer);
+      timers.delete(sink);
+    }
   }
 
   function onState(id: string, state: AlertState): void {
-    const episode = state.status === 'ALERT_RINGING' ? state.episode ?? null : null;
-    for (const sink of ALERT_SINKS) {
-      const current = receipts[sink].get(id);
-      if (!episode) {
-        consume(current);
-        receipts[sink].delete(id);
-        continue;
-      }
-      // At most once per sink per episode: a source joining it delivers nothing.
-      if (current?.episodeId === episode.id) continue;
-      consume(current);
-      const effective = policy(id);
-      const receipt: Receipt = { episodeId: episode.id, timer: null };
-      receipts[sink].set(id, receipt);
-      // Off at the start consumes it: turning the sink on never replays it.
-      if (!sinkEnabled(effective, sink)) continue;
-      // Fixed here, so a later delay edit never moves it.
-      const dueAt = episode.startedAt + sinkDelayMs(effective, sink);
-      receipt.timer = setTimeout(() => due(sink, id, receipt), Math.max(0, dueAt - Date.now()));
+    if (!manager.has(id)) published.delete(id);
+    const episode = state.episode ?? null;
+    const current = episodes.get(id);
+    // At most once per sink per episode: a source joining it delivers nothing.
+    if (current && current.episodeId === episode?.id) return;
+    if (current) {
+      for (const timer of current.timers.values()) clearTimeout(timer);
+      episodes.delete(id);
     }
-  }
-
-  function recheck(): void {
-    for (const sink of ALERT_SINKS) {
-      for (const [id, receipt] of receipts[sink]) {
-        if (receipt.timer && !sinkEnabled(policy(id), sink)) consume(receipt);
-      }
+    if (!episode) return;
+    const effective = policy(id);
+    const timers = new Map<AlertSink, ReturnType<typeof setTimeout>>();
+    episodes.set(id, { episodeId: episode.id, timers });
+    for (const sink of Object.keys(sinks) as AlertSink[]) {
+      const rule = sinks[sink];
+      // Off at the start consumes it: turning the sink on never replays it.
+      if (!rule.enabled(effective)) continue;
+      // Fixed here, so a later delay edit never moves it. A deadline that
+      // fails is consumed, never retried.
+      const dueAt = episode.startedAt + rule.delayMs(effective);
+      timers.set(sink, setTimeout(() => {
+        timers.delete(sink);
+        if (!rule.blocked(id)) rule.deliver(id, episode.id);
+      }, Math.max(0, dueAt - Date.now())));
     }
   }
 
@@ -118,34 +127,40 @@ export function createAlertDeliveryScheduler(options: AlertDeliverySchedulerOpti
   return {
     publish(realmId, raw) {
       if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return;
-      const next = new Map<string, AlertDeliveryOverrides>();
+      const next = new Map<string, Omit<Published, 'realmId'>>();
       for (const [id, value] of Object.entries(raw)) {
-        if (id) next.set(id, normalizeAlertDeliveryOverrides(value));
+        if (!id || !value || typeof value !== 'object') continue;
+        const { label, overrides } = value as Record<string, unknown>;
+        next.set(id, {
+          label: typeof label === 'string' ? label.slice(0, LABEL_LIMIT) : '',
+          overrides: normalizeAlertDeliveryOverrides(overrides),
+        });
       }
+      const changed: string[] = [];
       for (const [id, entry] of published) {
-        if (entry.realmId === realmId && !next.has(id)) published.delete(id);
+        if (entry.realmId !== realmId || next.has(id)) continue;
+        published.delete(id);
+        if (Object.keys(entry.overrides).length > 0) changed.push(id);
       }
-      for (const [id, overrides] of next) published.set(id, { realmId, overrides });
-      recheck();
-    },
-
-    endRealm(realmId) {
-      // A live Session keeps them: a reloading or recreated realm publishes
-      // again, and a VS Code view's Sessions outlive its disposal.
-      for (const [id, entry] of published) {
-        if (entry.realmId === realmId && !manager.has(id)) published.delete(id);
+      for (const [id, entry] of next) {
+        const prior = published.get(id)?.overrides ?? {};
+        published.set(id, { realmId, ...entry });
+        if (!sameAlertDeliveryOverrides(prior, entry.overrides)) changed.push(id);
       }
+      for (const id of changed) recheck(id);
     },
 
-    recheck,
-    policy,
+    setDefaults(settings) {
+      defaults = settings;
+      for (const id of episodes.keys()) recheck(id);
+    },
 
     dispose() {
       stop();
-      for (const sink of ALERT_SINKS) {
-        for (const receipt of receipts[sink].values()) consume(receipt);
-        receipts[sink].clear();
+      for (const { timers } of episodes.values()) {
+        for (const timer of timers.values()) clearTimeout(timer);
       }
+      episodes.clear();
       published.clear();
     },
   };
diff --git a/lib/src/lib/alert-delivery.test.ts b/lib/src/lib/alert-delivery.test.ts
index dfac089d0..ad6160678 100644
--- a/lib/src/lib/alert-delivery.test.ts
+++ b/lib/src/lib/alert-delivery.test.ts
@@ -1,33 +1,41 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { FakePtyAdapter, setPlatform } from './platform';
-import type { BurrowLink } from './platform/types';
-import { startAlertDelivery } from './alert-delivery';
+import { LABEL_PUBLISH_THROTTLE_MS, startAlertDelivery } from './alert-delivery';
 import { speechQueue } from './speech-queue';
 import { DEFAULT_ALERT_SETTINGS, updateAlertSettings } from './alert-settings';
 import { clearTerminalActivity, initAlertStateReceiver } from './session-activity-store';
+import { removeTerminalPaneState, setTerminalUserTitle } from './terminal-state-store';
 import { createWorkspace, resetWorkspaces, setWorkspaceAlertDelivery } from './workspace-store';
 import { resetWorkspaceSurfaces, setWorkspaceSurfaces } from './workspace-surfaces';
+import { stubSpeechSynthesis, type SpeechSynthesisStub } from './speech-synthesis-test-utils';
 
 /**
  * A realm's half of ring delivery (`docs/specs/alert.md` -> Alarm settings),
  * against the fake adapter's real in-process host: the realm publishes its
- * Workspaces' overrides, the host decides when, and the realm performs.
+ * Sessions' labels and Workspace overrides, the host decides when, and the
+ * realm speaks what it is handed.
  */
 
 const PANE = 'pane';
 let platform: FakePtyAdapter;
-let spoken: string[];
+let engine: SpeechSynthesisStub;
 let stop: (() => void) | null;
 
 function ring(): void {
   platform.sendOutput(PANE, '\x1b]9;build finished\x07');
 }
 
+/** `PANE` a member of Workspace `ws`, published. */
+function showPane(): string {
+  const workspace = createWorkspace({ id: 'ws' });
+  setWorkspaceSurfaces(workspace.id, [PANE]);
+  vi.advanceTimersByTime(0);
+  return workspace.id;
+}
+
 beforeEach(() => {
   vi.useFakeTimers();
-  spoken = [];
-  vi.stubGlobal('speechSynthesis', { speak: (utterance: { text: string }) => void spoken.push(utterance.text), cancel: () => {} });
-  vi.stubGlobal('SpeechSynthesisUtterance', class { constructor(readonly text: string) {} });
+  engine = stubSpeechSynthesis();
   resetWorkspaces();
   resetWorkspaceSurfaces();
   clearTerminalActivity();
@@ -46,49 +54,68 @@ afterEach(() => {
   updateAlertSettings(DEFAULT_ALERT_SETTINGS);
   platform.shutdown();
   clearTerminalActivity();
+  removeTerminalPaneState(PANE);
   vi.unstubAllGlobals();
   vi.useRealTimers();
 });
 
 describe('alert delivery', () => {
-  it('speaks the pane label when the host says a ring is due', () => {
+  it('speaks once when the host says a ring is due', () => {
     ring();
     vi.advanceTimersByTime(999);
-    expect(spoken).toEqual([]);
-    vi.advanceTimersByTime(1);
-    expect(spoken).toEqual(['terminal']);
+    expect(engine.spoken).toEqual([]);
+    vi.advanceTimersByTime(60_000);
+    expect(engine.spoken).toEqual(['terminal']);
   });
 
-  it('tells the host its Workspaces\' overrides, once per change', () => {
-    const publish = vi.spyOn(platform, 'alertPublishDeliveryPolicy');
-    updateAlertSettings({ speakEnabled: false });
-    const workspace = createWorkspace({ id: 'ws' });
-    setWorkspaceSurfaces(workspace.id, [PANE]);
-    setWorkspaceAlertDelivery(workspace.id, { speakEnabled: true, speakDelayMs: 3_000 });
-    // A Lath commit with the same members is no news.
-    setWorkspaceSurfaces(workspace.id, [PANE]);
-    expect(publish.mock.calls.at(-1)).toEqual([{ [PANE]: { speakEnabled: true, speakDelayMs: 3_000 } }]);
-    expect(publish).toHaveBeenCalledTimes(2);
+  it('publishes each Session with its label and Workspace overrides, once per change', () => {
+    const publish = vi.spyOn(platform, 'alertPublishSessions');
+    const workspaceId = showPane();
+    setWorkspaceAlertDelivery(workspaceId, { speakDelayMs: 3_000 });
+    vi.advanceTimersByTime(0);
+    expect(publish.mock.calls).toEqual([
+      [{ [PANE]: { label: 'terminal', overrides: {} } }],
+      [{ [PANE]: { label: 'terminal', overrides: { speakDelayMs: 3_000 } } }],
+    ]);
 
+    // A Lath commit with the same members, a settings edit, and a ring that
+    // leaves the label as it was are no news.
+    setWorkspaceSurfaces(workspaceId, [PANE]);
+    updateAlertSettings({ pushDelayMs: 5_000 });
     ring();
-    vi.advanceTimersByTime(3_000);
-    expect(spoken).toEqual(['terminal']);
+    vi.advanceTimersByTime(LABEL_PUBLISH_THROTTLE_MS);
+    expect(publish).toHaveBeenCalledTimes(2);
+  });
+
+  it('publishes a label change on a trailing throttle, the latest one only', () => {
+    const publish = vi.spyOn(platform, 'alertPublishSessions');
+    showPane();
+    publish.mockClear();
+    setTerminalUserTitle(PANE, 'one');
+    setTerminalUserTitle(PANE, 'two');
+    vi.advanceTimersByTime(LABEL_PUBLISH_THROTTLE_MS - 1);
+    expect(publish).not.toHaveBeenCalled();
+    vi.advanceTimersByTime(1);
+    expect(publish.mock.calls).toEqual([[{ [PANE]: { label: 'two', overrides: {} } }]]);
   });
 
-  it('pushes through the Burrow with the pane label', async () => {
-    const command = vi.fn(async () => ({}));
-    platform.burrow = { command } as unknown as BurrowLink;
+  it('has the host push titled by the label it published', () => {
+    const pushed: Array<[string, string]> = [];
+    platform.onAlertPush = (sessionId, title) => void pushed.push([sessionId, title]);
     updateAlertSettings({ speakEnabled: false, pushEnabled: true, pushDelayMs: 1_000 });
+    showPane();
+    setTerminalUserTitle(PANE, 'Builds');
+    vi.advanceTimersByTime(LABEL_PUBLISH_THROTTLE_MS);
     ring();
     vi.advanceTimersByTime(1_000);
-    expect(command).toHaveBeenCalledExactlyOnceWith('push', { sessionId: PANE, title: 'terminal' });
+    expect(pushed).toEqual([[PANE, 'Builds']]);
   });
 
-  it('performs nothing once stopped', () => {
+  it('speaks nothing once stopped', () => {
     stop!();
     stop = null;
     ring();
     vi.advanceTimersByTime(60_000);
-    expect(spoken).toEqual([]);
+    expect(engine.spoken).toEqual([]);
   });
 });
diff --git a/lib/src/lib/alert-delivery.ts b/lib/src/lib/alert-delivery.ts
index 4d134e9e3..47f087c4d 100644
--- a/lib/src/lib/alert-delivery.ts
+++ b/lib/src/lib/alert-delivery.ts
@@ -1,55 +1,112 @@
-import type { AlertDelivery } from './alert-delivery-scheduler';
-import { collectDeliveryOverrides } from './alert-delivery-policy';
+import type { AlertSessionInfo } from '../host/alert-protocol';
+import { sameAlertDeliveryOverrides, type AlertDeliveryOverrides } from './alert-delivery-model';
+import { subscribeToAlertDeliveryPolicy } from './alert-delivery-policy';
 import { startAlertSpeech } from './alert-speech';
 import { getPlatform } from './platform';
-import { deriveSessionLabel } from './session-label';
-import { subscribeToWorkspaces } from './workspace-store';
-import { subscribeToWorkspaceSurfaces } from './workspace-surfaces';
+import { getActivitySnapshot, subscribeToActivity } from './session-activity-store';
+import { deriveSessionLabels } from './session-label';
+import { getTerminalPaneStateSnapshot, subscribeToTerminalPaneState } from './terminal-state-store';
+import { getWorkspace, getWorkspacesSnapshot } from './workspace-store';
+import { getWorkspaceSurfacesSnapshot } from './workspace-surfaces';
 
 /**
  * This realm's half of ring delivery (`docs/specs/alert.md` -> Alarm
- * settings). The host decides when a ring is spoken or pushed; the realm tells
- * it what only the renderer knows — which Workspace each Session is in, and
- * that Workspace's overrides — and performs what it is handed, which needs the
- * Pane's label and, for speech, `window.speechSynthesis`.
+ * settings). The host decides when a ring is spoken or pushed, and sends the
+ * push itself; the realm tells it what only the renderer knows — each
+ * Session's Pane label and its Workspace's overrides — and speaks what it is
+ * handed, which needs `window.speechSynthesis`.
  */
 
-/** The running performer, if any. The platform keeps its handlers for the
- *  renderer's lifetime, so this stable one is registered and never removed. */
-let perform: ((delivery: AlertDelivery) => void) | null = null;
-const onDeliver = (delivery: AlertDelivery): void => perform?.(delivery);
+/** How long a label change waits to be published: Claude Code animates its
+ *  title about ten times a second, and only a due push reads the label. */
+export const LABEL_PUBLISH_THROTTLE_MS = 2_000;
+
+const NO_OVERRIDES: AlertDeliveryOverrides = {};
 
 export function startAlertDelivery(): () => void {
   const platform = getPlatform();
   const speaker = startAlertSpeech();
-
-  let published: string | null = null;
-  const publish = (): void => {
-    const overrides = collectDeliveryOverrides();
-    // Every Lath commit and Workspace edit lands here; only a change is news.
-    const key = JSON.stringify(overrides);
-    if (key === published) return;
-    published = key;
-    platform.alertPublishDeliveryPolicy(overrides);
+  const stopPublishing = publishAlertSessions((sessions) => platform.alertPublishSessions(sessions));
+  const stopSpeaking = platform.onAlertSpeak(({ id, episodeId }) => speaker.speak(id, episodeId));
+  return () => {
+    stopSpeaking();
+    stopPublishing();
+    speaker.stop();
   };
-  const stops = [subscribeToWorkspaces(publish), subscribeToWorkspaceSurfaces(publish)];
-  publish();
-
-  platform.onAlertDeliver(onDeliver);
-  perform = (delivery) => {
-    if (delivery.sink === 'speech') {
-      speaker.speak(delivery.id, delivery.episodeId);
-      return;
+}
+
+/**
+ * Publish every member Session whenever what the host reads of it changed: a
+ * membership or override change at the end of the task that made it, so
+ * disabling a sink consumes its pending work at once, and a label change on a
+ * trailing throttle.
+ */
+function publishAlertSessions(send: (sessions: Record<string, AlertSessionInfo>) => void): () => void {
+  let sent = new Map<string, AlertSessionInfo>();
+  /** The snapshots the last pass read; the same four mean nothing changed. */
+  let inputs: readonly unknown[] = [];
+  /** Sessions whose label may have changed since that pass; `null` for all. */
+  let stale: Set<string> | null = null;
+  let timer: ReturnType<typeof setTimeout> | null = null;
+  let dueAt = 0;
+
+  function schedule(delayMs: number): void {
+    const at = Date.now() + delayMs;
+    if (timer !== null) {
+      if (dueAt <= at) return;
+      clearTimeout(timer);
     }
-    // The Burrow's service reads its own ACL at send time; a host with none
-    // has no link, and an un-enrolled one sends nothing.
-    void platform.burrow?.command('push', { sessionId: delivery.id, title: deriveSessionLabel(delivery.id) })
-      .catch(() => {});
-  };
+    dueAt = at;
+    timer = setTimeout(flush, delayMs);
+  }
+
+  function labelMayChange(changedId?: string): void {
+    if (changedId === undefined) stale = null;
+    else stale?.add(changedId);
+    schedule(LABEL_PUBLISH_THROTTLE_MS);
+  }
+
+  function flush(): void {
+    timer = null;
+    const surfaces = getWorkspaceSurfacesSnapshot();
+    const next = [surfaces, getWorkspacesSnapshot(), getTerminalPaneStateSnapshot(), getActivitySnapshot()];
+    if (next.every((input, index) => input === inputs[index])) return;
+    inputs = next;
+
+    const derive: string[] = [];
+    for (const ids of surfaces.values()) {
+      for (const id of ids) if (!stale || stale.has(id) || !sent.has(id)) derive.push(id);
+    }
+    const labels = deriveSessionLabels(derive);
+    stale = new Set();
+
+    const published = new Map<string, AlertSessionInfo>();
+    let changed = false;
+    for (const [workspaceId, ids] of surfaces) {
+      const overrides = getWorkspace(workspaceId)?.alertDelivery ?? NO_OVERRIDES;
+      for (const id of ids) {
+        const prior = sent.get(id);
+        const label = labels.get(id) ?? prior!.label;
+        const same = prior !== undefined && prior.label === label && sameAlertDeliveryOverrides(prior.overrides, overrides);
+        published.set(id, same ? prior : { label, overrides });
+        if (!same) changed = true;
+      }
+    }
+    if (!changed && published.size === sent.size) return;
+    sent = published;
+    send(Object.fromEntries(published));
+  }
 
+  const stops = [
+    subscribeToAlertDeliveryPolicy(() => schedule(0)),
+    subscribeToTerminalPaneState(labelMayChange),
+    subscribeToActivity(labelMayChange),
+  ];
+  // Folded into the first membership change when the Wall is still mounting.
+  schedule(0);
   return () => {
-    perform = null;
     stops.forEach((stop) => stop());
-    speaker.stop();
+    if (timer !== null) clearTimeout(timer);
+    timer = null;
   };
 }
diff --git a/lib/src/lib/alert-manager.test.ts b/lib/src/lib/alert-manager.test.ts
index 3c63b016c..6d207b0c3 100644
--- a/lib/src/lib/alert-manager.test.ts
+++ b/lib/src/lib/alert-manager.test.ts
@@ -411,6 +411,17 @@ describe('AlertManager in isolation', () => {
     expect(manager.getState(id).status).toBe('ALERT_RINGING');
   });
 
+  it('rings a report again once a command starts after the acknowledgement', () => {
+    // The user clears the ring and types a new command, whose echo falls in
+    // the echo window; the command stays silent until its report.
+    const id = 'acknowledged-then-command';
+    manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'first' });
+    manager.dismissAlert(id);
+    runCommand(manager, id, 'pnpm deploy');
+    manager.notifyFromProtocol(id, { source: 'OSC 9', title: null, body: 'deployed' });
+    expect(manager.getState(id)).toMatchObject({ status: 'ALERT_RINGING', notification: { body: 'deployed' } });
+  });
+
   it('toggleTodo flips on and off', () => {
     const id = 'toggle-todo';
     expect(manager.getState(id).todo).toBe(false);
diff --git a/lib/src/lib/alert-manager.ts b/lib/src/lib/alert-manager.ts
index ea4a82f15..b6615be38 100644
--- a/lib/src/lib/alert-manager.ts
+++ b/lib/src/lib/alert-manager.ts
@@ -280,16 +280,13 @@ interface AlertEntry {
   /**
    * A user verb cleared a ring and no output has arrived since, so a report
    * describes the state the user already acknowledged (`dispatchCompletion`).
-   * Opening a ring forgets it.
+   * Opening a ring or starting a command forgets it.
    */
   ackedQuiet: boolean;
   /** The live `OSC 9;4` cycle. Never touches the ring, and the ring never touches it. */
   progress: ActiveProtocolProgress | null;
   commandExitWatch: CommandExitWatch | null;
   pendingCommandLine: string | null;
-  /** The running or last command's display text: all a host with no renderer
-   *  can call the Session (`docs/specs/alert.md` -> Alarm settings). */
-  lastCommand: string | null;
   todo: TodoState;
   notification: ActivityNotification | null;
   /**
@@ -893,7 +890,9 @@ export class AlertManager {
     // Every command boundary silently ends a progress cycle the program never
     // closed, so a later stray clear finds nothing to complete.
     entry.progress = null;
-    entry.lastCommand = resolved.displayCommand;
+    // A new command is news the acknowledgement never saw, even when it stays
+    // silent until its report: its echo fell in the echo window, not output.
+    entry.ackedQuiet = false;
     entry.commandExitWatch = {
       displayCommand: resolved.displayCommand,
       watchKey: resolved.rawCommandLine === null ? null : commandWatchKey(resolved.rawCommandLine),
@@ -1255,11 +1254,6 @@ export class AlertManager {
     };
   }
 
-  /** The running or last command's display text, else null. */
-  lastCommand(id: string): string | null {
-    return this.entries.get(id)?.lastCommand ?? null;
-  }
-
   /** Whether `id` has state to publish: an entry that is not a helper's.
    *  Exactly the ids {@link getAllStates} answers. */
   has(id: string): boolean {
@@ -1398,7 +1392,6 @@ export class AlertManager {
         progress: null,
         commandExitWatch: null,
         pendingCommandLine: null,
-        lastCommand: null,
         todo: false,
         notification: null,
         deferred: null,
diff --git a/lib/src/lib/alert-resumed-output.test.ts b/lib/src/lib/alert-resumed-output.test.ts
index d5aaf94a9..a2a0eab0f 100644
--- a/lib/src/lib/alert-resumed-output.test.ts
+++ b/lib/src/lib/alert-resumed-output.test.ts
@@ -22,12 +22,8 @@ beforeEach(() => {
   manager.setDeferAlertsUntilQuiet(true);
   manager.setWatchedCommands([WATCHED]);
   runCommand(manager, ID, WATCHED);
-  const settings = { ...DEFAULT_ALERT_SETTINGS, speakEnabled: true, speakDelayMs: DELAY, pushEnabled: true, pushDelayMs: DELAY };
-  scheduler = createAlertDeliveryScheduler({
-    manager,
-    defaults: () => settings,
-    deliver: ({ sink, id, episodeId }) => (sink === 'speech' ? spoken : pushed)(id, episodeId),
-  });
+  scheduler = createAlertDeliveryScheduler({ manager, speak: spoken, push: pushed });
+  scheduler.setDefaults({ ...DEFAULT_ALERT_SETTINGS, speakEnabled: true, speakDelayMs: DELAY, pushEnabled: true, pushDelayMs: DELAY });
 });
 
 afterEach(() => {
@@ -64,8 +60,8 @@ describe('WATCHING output resuming before alarm delivery', () => {
     expect(spoken).not.toHaveBeenCalled();
     expect(pushed).not.toHaveBeenCalled();
     vi.advanceTimersByTime(1);
-    expect(spoken).toHaveBeenCalledOnce();
-    expect(pushed).toHaveBeenCalledExactlyOnceWith(ID, manager.getState(ID).episode!.id);
+    expect(spoken).toHaveBeenCalledExactlyOnceWith(ID, manager.getState(ID).episode!.id);
+    expect(pushed).toHaveBeenCalledOnce();
   });
 
   it('keeps an inferred ring through a short redraw that never confirms BUSY', () => {
diff --git a/lib/src/lib/alert-settings-host.ts b/lib/src/lib/alert-settings-host.ts
index 7968c5bf7..ea908cb10 100644
--- a/lib/src/lib/alert-settings-host.ts
+++ b/lib/src/lib/alert-settings-host.ts
@@ -14,7 +14,7 @@ export type AlertSettingsTarget = Pick<AlertManager, 'applySettings'>;
  * renderers receive that canonical state instead of replacing it.
  *
  * `AlertManager.applySettings` takes the detection fields; the sink fields are
- * the delivery scheduler's defaults, read through `current`
+ * the delivery scheduler's defaults, handed over by `createAlertHost`
  * (`docs/specs/alert.md` -> Alarm settings).
  */
 export class AlertSettingsHost {
@@ -40,11 +40,6 @@ export class AlertSettingsHost {
     this.publish();
   }
 
-  /** The blob in force: the shipped defaults until a renderer seeds one. */
-  get current(): AlertSettings {
-    return this.settings;
-  }
-
   subscribe(listener: (settings: AlertSettings) => void): () => void {
     this.listeners.add(listener);
     return () => {
diff --git a/lib/src/lib/alert-speech.test.ts b/lib/src/lib/alert-speech.test.ts
index 28e7ba0ba..31ecdd3e2 100644
--- a/lib/src/lib/alert-speech.test.ts
+++ b/lib/src/lib/alert-speech.test.ts
@@ -8,58 +8,26 @@ vi.mock('./platform', () => ({
 import { startAlertSpeech, toSpokenText, type AlertSpeaker } from './alert-speech';
 import { getAlertSpeechState } from './alert-speech-state';
 import { applyAlertSettingsFromHost, DEFAULT_ALERT_SETTINGS } from './alert-settings';
+import { createAlertEpisode } from './alert-episode';
 import { clearTerminalActivity, getActivity, setTerminalActivity } from './session-activity-store';
-import type { SessionStatus } from './alert-manager';
+import type { AlertState, SessionStatus } from './alert-manager';
 import { removeTerminalPaneState, resetTerminalPaneState } from './terminal-state-store';
 import type { TerminalTitleSource } from './terminal-state';
+import { stubSpeechSynthesis, type SpeechSynthesisStub } from './speech-synthesis-test-utils';
 
-/** Utterances passed to the stubbed Web Speech API, in order. */
-let spoken: string[];
-let utterances: StubUtterance[];
-let cancelCount: number;
+/** The stubbed Web Speech engine this test drives. */
+let engine: SpeechSynthesisStub;
 let speaker: AlertSpeaker | null = null;
 
-interface StubUtterance {
-  text: string;
-  onstart: (() => void) | null;
-  onend: (() => void) | null;
-  onerror: (() => void) | null;
-}
-
-/** Extra engine behavior a single test wants from the stub's `speak`. */
-let onSpeak: ((utterance: StubUtterance) => void) | null = null;
-
-function stubSpeechSynthesis(): void {
-  spoken = [];
-  utterances = [];
-  cancelCount = 0;
-  onSpeak = null;
-  vi.stubGlobal('speechSynthesis', {
-    speak: (utterance: StubUtterance) => {
-      spoken.push(utterance.text);
-      utterances.push(utterance);
-      onSpeak?.(utterance);
-    },
-    cancel: () => { cancelCount++; },
-  });
-  vi.stubGlobal('SpeechSynthesisUtterance', class {
-    text: string;
-    onstart: (() => void) | null = null;
-    onend: (() => void) | null = null;
-    onerror: (() => void) | null = null;
-    constructor(text: string) { this.text = text; }
-  });
-}
-
-/** Drive one Session's projected status through the activity store. */
-function setStatus(id: string, status: SessionStatus): void {
+/** Move one Session to a status that is not ringing. */
+function setStatus(id: string, status: Exclude<SessionStatus, 'ALERT_RINGING'>): void {
   setTerminalActivity(id, { status });
 }
 
-/** Open a new ring, and with it a new episode. */
-function ring(id: string): void {
+/** Open a new ring, and with it a new episode, as the host publishes one. */
+function ring(id: string, state: Partial<AlertState> = {}): void {
   setStatus(id, 'NOTHING_TO_SHOW');
-  setStatus(id, 'ALERT_RINGING');
+  setTerminalActivity(id, { status: 'ALERT_RINGING', episode: createAlertEpisode(), ...state });
 }
 
 /** The host's speech deliveries come due for each Session's current episode. */
@@ -76,12 +44,12 @@ function ringTwoWithFirstSpeaking(): void {
   ring('pty-1');
   ring('pty-2');
   due('pty-1', 'pty-2');
-  utterances[0].onstart?.();
+  engine.utterances[0].onstart?.();
 }
 
 beforeEach(() => {
   vi.useFakeTimers();
-  stubSpeechSynthesis();
+  engine = stubSpeechSynthesis();
   clearTerminalActivity();
   applyAlertSettingsFromHost({ ...DEFAULT_ALERT_SETTINGS, speakEnabled: true });
 });
@@ -168,15 +136,6 @@ describe('toSpokenText', () => {
  * (`alert-delivery-scheduler.test.ts`).
  */
 describe('spoken alarms', () => {
-  it('speaks the pane label of the episode the host hands it', () => {
-    start();
-    ring('pty-1');
-    expect(spoken).toEqual([]);
-
-    due('pty-1');
-    expect(spoken).toEqual(['terminal']);
-  });
-
   it('speaks terminal-supplied OSC 0/2/9 titles when they are the pane label', () => {
     const sources: TerminalTitleSource[] = ['osc0', 'osc2', 'osc9'];
     for (const [index, source] of sources.entries()) {
@@ -201,22 +160,15 @@ describe('spoken alarms', () => {
 
     start();
     for (const source of sources) {
-      const id = `${source}-title`;
-      setStatus(id, 'NOTHING_TO_SHOW');
-      if (source === 'osc9') {
-        setTerminalActivity(id, {
-          status: 'ALERT_RINGING',
-          notification: { source: 'OSC 9', title: null, body: 'program title osc9' },
-        });
-      } else {
-        setStatus(id, 'ALERT_RINGING');
-      }
+      ring(`${source}-title`, source === 'osc9'
+        ? { notification: { source: 'OSC 9', title: null, body: 'program title osc9' } }
+        : {});
     }
     due(...sources.map((source) => `${source}-title`));
 
-    utterances[0].onend?.();
-    utterances[1].onend?.();
-    expect(spoken).toEqual([
+    engine.utterances[0].onend?.();
+    engine.utterances[1].onend?.();
+    expect(engine.spoken).toEqual([
       'program title osc0',
       'program title osc2',
       'program title osc9',
@@ -228,7 +180,7 @@ describe('spoken alarms', () => {
     start();
     ring('pty-1');
     due('pty-1');
-    expect(spoken).toEqual([]);
+    expect(engine.spoken).toEqual([]);
   });
 
   it('drops a delivery for an episode that already ended', () => {
@@ -237,7 +189,7 @@ describe('spoken alarms', () => {
     const stale = getActivity('pty-1').episode!.id;
     ring('pty-1');
     speaker!.speak('pty-1', stale);
-    expect(spoken).toEqual([]);
+    expect(engine.spoken).toEqual([]);
   });
 
   it('publishes SPEAKING on actual start, then SPOKEN on end', () => {
@@ -246,10 +198,10 @@ describe('spoken alarms', () => {
     due('pty-1');
 
     expect(getAlertSpeechState('pty-1')).toBeNull();
-    utterances[0].onstart?.();
+    engine.utterances[0].onstart?.();
     expect(getAlertSpeechState('pty-1')).toBe('speaking');
 
-    utterances[0].onend?.();
+    engine.utterances[0].onend?.();
     expect(getAlertSpeechState('pty-1')).toBe('spoken');
   });
 
@@ -257,10 +209,10 @@ describe('spoken alarms', () => {
     start();
     ring('pty-1');
     due('pty-1');
-    utterances[0].onstart?.();
-    utterances[0].onend?.();
+    engine.utterances[0].onstart?.();
+    engine.utterances[0].onend?.();
 
-    setTerminalActivity('pty-1', { status: 'ALERT_RINGING', todo: true });
+    setTerminalActivity('pty-1', { ...getActivity('pty-1'), todo: true });
     setStatus('another-pane', 'BUSY');
     expect(getAlertSpeechState('pty-1')).toBe('spoken');
   });
@@ -269,28 +221,28 @@ describe('spoken alarms', () => {
     start();
     ring('pty-1');
     due('pty-1');
-    utterances[0].onstart?.();
+    engine.utterances[0].onstart?.();
     expect(getAlertSpeechState('pty-1')).toBe('speaking');
 
     setStatus('pty-1', 'NOTHING_TO_SHOW');
     // The announcement exists to summon the user, who is now here — the engine
     // is silenced, not merely un-rendered.
-    expect(cancelCount).toBe(1);
+    expect(engine.cancels).toBe(1);
     expect(getAlertSpeechState('pty-1')).toBeNull();
 
     // The engine reports the cut, and can also finish an utterance after the
     // ring clears. Either stale callback must not resurrect HAS SPOKEN.
-    utterances[0].onend?.();
+    engine.utterances[0].onend?.();
     expect(getAlertSpeechState('pty-1')).toBeNull();
   });
 
   it('admits the next still-ringing Session when the active alarm is cut off', () => {
     ringTwoWithFirstSpeaking();
-    expect(spoken).toHaveLength(1);
+    expect(engine.spoken).toHaveLength(1);
     setStatus('pty-1', 'NOTHING_TO_SHOW');
-    expect(cancelCount).toBe(1);
-    expect(spoken).toHaveLength(2);
-    utterances[1].onstart?.();
+    expect(engine.cancels).toBe(1);
+    expect(engine.spoken).toHaveLength(2);
+    engine.utterances[1].onstart?.();
     expect(getAlertSpeechState('pty-2')).toBe('speaking');
   });
 
@@ -304,10 +256,10 @@ describe('spoken alarms', () => {
     ring('pty-2');
     setStatus('pty-1', 'NOTHING_TO_SHOW');
 
-    expect(cancelCount).toBe(1);
-    expect(spoken).toHaveLength(1);
+    expect(engine.cancels).toBe(1);
+    expect(engine.spoken).toHaveLength(1);
     due('pty-2');
-    expect(spoken).toHaveLength(2);
+    expect(engine.spoken).toHaveLength(2);
   });
 
   /** Turning delivery off discards pending work before native admission. */
@@ -317,8 +269,8 @@ describe('spoken alarms', () => {
 
     setStatus('pty-1', 'NOTHING_TO_SHOW');
 
-    expect(cancelCount).toBe(1);
-    expect(spoken).toHaveLength(1);
+    expect(engine.cancels).toBe(1);
+    expect(engine.spoken).toHaveLength(1);
   });
 
   /** Only the Session being read aloud is cut; a queued one has nothing to stop. */
@@ -327,7 +279,7 @@ describe('spoken alarms', () => {
 
     setStatus('pty-2', 'NOTHING_TO_SHOW');
 
-    expect(cancelCount).toBe(0);
+    expect(engine.cancels).toBe(0);
     expect(getAlertSpeechState('pty-1')).toBe('speaking');
   });
 
@@ -337,8 +289,8 @@ describe('spoken alarms', () => {
     due('pty-1');
 
     setStatus('pty-1', 'NOTHING_TO_SHOW');
-    utterances[0].onstart?.();
-    utterances[0].onend?.();
+    engine.utterances[0].onstart?.();
+    engine.utterances[0].onend?.();
     expect(getAlertSpeechState('pty-1')).toBeNull();
   });
 
@@ -346,8 +298,8 @@ describe('spoken alarms', () => {
     start();
     ring('pty-1');
     due('pty-1');
-    utterances[0].onstart?.();
-    utterances[0].onerror?.();
+    engine.utterances[0].onstart?.();
+    engine.utterances[0].onerror?.();
 
     expect(getAlertSpeechState('pty-1')).toBe('spoken');
   });
@@ -356,11 +308,11 @@ describe('spoken alarms', () => {
     start();
     ring('pty-1');
     due('pty-1');
-    const oldStart = utterances[0].onstart;
-    const oldEnd = utterances[0].onend;
+    const oldStart = engine.utterances[0].onstart;
+    const oldEnd = engine.utterances[0].onend;
     ring('pty-1');
     due('pty-1');
-    const current = utterances[1];
+    const current = engine.utterances[1];
     current.onstart?.();
     oldStart?.();
     oldEnd?.();
@@ -372,9 +324,9 @@ describe('spoken alarms', () => {
   it('never admits a resolved queued alarm to the speech engine', () => {
     ringTwoWithFirstSpeaking();
     setStatus('pty-2', 'NOTHING_TO_SHOW');
-    expect(cancelCount).toBe(0);
-    utterances[0].onend?.();
-    expect(spoken).toHaveLength(1);
+    expect(engine.cancels).toBe(0);
+    engine.utterances[0].onend?.();
+    expect(engine.spoken).toHaveLength(1);
     expect(getAlertSpeechState('pty-2')).toBeNull();
   });
 
@@ -395,7 +347,7 @@ describe('spoken alarms', () => {
    * SPEAKING for the life of the ring.
    */
   it('settles an utterance the engine resolves synchronously inside speak()', () => {
-    onSpeak = (utterance) => {
+    engine.onSpeak = (utterance) => {
       utterance.onstart?.();
       utterance.onerror?.();
     };
@@ -415,16 +367,16 @@ describe('spoken alarms', () => {
     start();
     ring('pty-1');
     due('pty-1');
-    utterances[0].onstart?.();
+    engine.utterances[0].onstart?.();
     expect(getAlertSpeechState('pty-1')).toBe('speaking');
 
     speaker?.stop();
     speaker = null;
 
-    expect(cancelCount).toBe(1);
+    expect(engine.cancels).toBe(1);
     expect(getAlertSpeechState('pty-1')).toBeNull();
     // A callback the engine still dispatches afterward finds nothing to touch.
-    utterances[0].onend?.();
+    engine.utterances[0].onend?.();
     expect(getAlertSpeechState('pty-1')).toBeNull();
   });
 
@@ -433,13 +385,13 @@ describe('spoken alarms', () => {
     ring('pty-1');
     ring('pty-2');
     due('pty-1', 'pty-2');
-    const lateStart = utterances[0].onstart;
-    const lateEnd = utterances[0].onend;
-    expect(spoken).toHaveLength(1);
+    const lateStart = engine.utterances[0].onstart;
+    const lateEnd = engine.utterances[0].onend;
+    expect(engine.spoken).toHaveLength(1);
     vi.advanceTimersByTime(SPEECH_ENGINE_TIMEOUT_MS);
-    expect(cancelCount).toBe(1);
-    expect(spoken).toHaveLength(2);
-    utterances[1].onstart?.();
+    expect(engine.cancels).toBe(1);
+    expect(engine.spoken).toHaveLength(2);
+    engine.utterances[1].onstart?.();
     lateStart?.();
     lateEnd?.();
     expect(getAlertSpeechState('pty-1')).toBeNull();
@@ -450,9 +402,9 @@ describe('spoken alarms', () => {
     start();
     for (let i = 0; i < 100; i++) ring(`pty-${i}`);
     for (let i = 0; i < 100; i++) due(`pty-${i}`);
-    expect(spoken).toHaveLength(1);
-    for (let i = 0; i < 65; i++) utterances[i].onend?.();
-    expect(spoken).toHaveLength(65);
-    expect(utterances.every(utterance => utterance.onend === null)).toBe(true);
+    expect(engine.spoken).toHaveLength(1);
+    for (let i = 0; i < 65; i++) engine.utterances[i].onend?.();
+    expect(engine.spoken).toHaveLength(65);
+    expect(engine.utterances.every(utterance => utterance.onend === null)).toBe(true);
   });
 });
diff --git a/lib/src/lib/platform/fake-adapter.ts b/lib/src/lib/platform/fake-adapter.ts
index af3e627cb..364b4e3ec 100644
--- a/lib/src/lib/platform/fake-adapter.ts
+++ b/lib/src/lib/platform/fake-adapter.ts
@@ -107,14 +107,19 @@ export class FakePtyAdapter implements PlatformAdapter {
    *  and the selection-popup stories toggle it per story. */
   browserReservesNotepadChord?: boolean;
 
+  /** Where a due push goes. There is no Burrow here, so by default it reaches
+   *  no phone; a test sets this to see what would have been sent. */
+  onAlertPush?: (sessionId: string, title: string) => void;
+
   constructor() {
     Object.assign(this, this.alerts.methods);
     this.startAlertHost();
   }
 
   private startAlertHost(): void {
-    const host = createAlertHost({ deliver: (delivery) => void this.alerts.onEvent('alert:deliver', delivery) });
+    const host = createAlertHost({ push: (sessionId, title) => this.onAlertPush?.(sessionId, title) });
     const stops = [
+      host.onSpeak((speak) => void this.alerts.onEvent('alert:speak', speak)),
       host.manager.onStateChange((id, state) => void this.alerts.onEvent('alert:state', { id, ...state })),
       host.watched.subscribe((names) => void this.alerts.onEvent('alert:watchedCommands', { names })),
       host.settings.subscribe((settings) => void this.alerts.onEvent('alert:settings', { settings })),
diff --git a/lib/src/lib/platform/types.ts b/lib/src/lib/platform/types.ts
index 88a96f110..520afc7b7 100644
--- a/lib/src/lib/platform/types.ts
+++ b/lib/src/lib/platform/types.ts
@@ -1,8 +1,7 @@
 import type { HelperIdentity, TerminalContextRequest, TerminalContextInfo } from '../terminal-context-types';
 import type { AlertState, AwaitHandle, AwaitOptions, Engagement, EngagementLapse } from '../alert-manager';
 import type { AlertSettings } from '../alert-settings';
-import type { AlertDeliveryOverrides } from '../alert-delivery-model';
-import type { AlertDelivery } from '../alert-delivery-scheduler';
+import type { AlertSessionInfo, AlertSpeak } from '../../host/alert-protocol';
 import type { VSCodeWorkbenchCommand } from '../vscode-keybindings';
 import type { ShellEntry } from '../shell-defaults';
 // Defined in its own dependency-free file so the Node proxy in lib/src/host can
@@ -480,11 +479,12 @@ export interface PlatformAdapter {
    */
   alertEngagement(state: Engagement, lapse?: EngagementLapse): void;
   /**
-   * Every Session this realm shows, each with its Workspace's sparse delivery
-   * overrides, for the host's delivery scheduler (`docs/specs/alert.md` ->
-   * Alarm settings). Replaces what this realm published before.
+   * Every Session this realm shows, with its Pane label and its Workspace's
+   * sparse delivery overrides, for the host's delivery scheduler
+   * (`docs/specs/alert.md` -> Alarm settings). Replaces what this realm
+   * published before.
    */
-  alertPublishDeliveryPolicy(overrides: Record<string, AlertDeliveryOverrides>): void;
+  alertPublishSessions(sessions: Record<string, AlertSessionInfo>): void;
   /** A human gesture reached the Session without input; input rides `writePty`'s `userInput`. */
   alertAcknowledge(id: string): void;
   alertToggleTodo(id: string): void;
@@ -507,8 +507,8 @@ export interface PlatformAdapter {
   onWatchedCommands(handler: (names: string[]) => void): void;
   /** Receive the host's canonical alarm settings. */
   onAlertSettings(handler: (settings: AlertSettings) => void): void;
-  /** Receive a spoken alarm or push the host scheduled, to perform. */
-  onAlertDeliver(handler: (delivery: AlertDelivery) => void): void;
+  /** Receive each spoken alarm the host scheduled, to speak. */
+  onAlertSpeak(handler: (speak: AlertSpeak) => void): () => void;
 
   // State persistence
   saveState(state: unknown): void;
diff --git a/lib/src/lib/push-devices.ts b/lib/src/lib/push-devices.ts
index 0335eae03..bb3f92866 100644
--- a/lib/src/lib/push-devices.ts
+++ b/lib/src/lib/push-devices.ts
@@ -42,6 +42,8 @@ const EMPTY: PushDevicesState = { status: 'no-burrow', devices: [] };
 
 let state: PushDevicesState = EMPTY;
 let refresh: (() => void) | null = null;
+/** Bumped by every refresh and every clear; a refresh commits only while it is current. */
+let refreshSequence = 0;
 const listeners = new Set<() => void>();
 
 /** Stable-identity snapshot for `useSyncExternalStore`. */
@@ -80,21 +82,48 @@ export function refreshPushDevicesNow(): void {
   refresh?.();
 }
 
+/**
+ * Run `load` and publish its result, fenced on request order: overlapping
+ * refreshes are latest-request-wins, so a slow startup refresh cannot overwrite
+ * a newer dialog refresh, and a {@link clearPushDevices} since the request
+ * discards it. `load` is the Burrow's `pushDevices` command
+ * (`lib/src/remote/burrow/activation.ts`), which answers `null` when no Burrow
+ * is running — "nowhere to push", rendered `no-burrow`, not an empty list. A
+ * failure is `error`: "we could not ask" and "no devices are subscribed" are
+ * different things to show a user.
+ */
+export async function commitPushDevices(load: () => Promise<PushDevice[] | null>): Promise<void> {
+  const sequence = ++refreshSequence;
+  const commit = (next: PushDevicesState) => {
+    if (refreshSequence === sequence) setPushDevices(next);
+  };
+  commit({ status: 'loading', devices: [] });
+  try {
+    const devices = await load();
+    commit(devices ? { status: 'ready', devices } : { status: 'no-burrow', devices: [] });
+  } catch {
+    commit({ status: 'error', devices: [] });
+  }
+}
+
 /**
  * Back to `no-burrow`, keeping the refresher: the enrolled gate's disarm when the
  * Burrow goes away, where the dialog must stop naming devices nothing can reach
  * but may still be opened and told `no-burrow` (`lib/src/remote/burrow/activation.ts`).
+ * Every refresh in flight is discarded too: one already on the wire would
+ * otherwise land afterwards and name phones the Burrow behind them is gone for.
  */
 export function clearPushDevices(): void {
+  refreshSequence += 1;
   setPushDevices(EMPTY);
 }
 
 /**
- * Full teardown: back to `no-burrow` *and* no refresher — a story or a test that
- * finished, where the closure that would answer is going away too. Anything that
- * only means "the Burrow is gone" wants {@link clearPushDevices}.
+ * Full teardown: {@link clearPushDevices} *and* no refresher — a story or a test
+ * that finished, where the closure that would answer is going away too. Anything
+ * that only means "the Burrow is gone" wants {@link clearPushDevices}.
  */
 export function resetPushDevices(): void {
   refresh = null;
-  setPushDevices(EMPTY);
+  clearPushDevices();
 }
diff --git a/lib/src/lib/session-activity-store.ts b/lib/src/lib/session-activity-store.ts
index 4553a20fc..e8f9efeee 100644
--- a/lib/src/lib/session-activity-store.ts
+++ b/lib/src/lib/session-activity-store.ts
@@ -1,4 +1,3 @@
-import { createAlertEpisode } from './alert-episode';
 import { DEFAULT_ALERT_STATE, type AlertState } from './alert-manager';
 import type { AlertStateDetail } from './platform/types';
 import { applyAlertSettingsFromHost, publishAlertSettings } from './alert-settings';
@@ -65,13 +64,7 @@ export function getLivePersistedAlertState(id: string): PersistedAlertState | nu
 
 /** Install a host snapshot, including one received before xterm initialization. */
 export function setTerminalActivity(id: string, state: Partial<AlertState>): void {
-  const previous = terminalActivity.get(id);
-  // Older hosts and local fixtures have no episode field. Hydrate their status
-  // edges here, so the ring burst still keys on one.
-  const episode = state.status === 'ALERT_RINGING'
-    ? state.episode ?? (previous?.status === 'ALERT_RINGING' ? previous.episode : null) ?? createAlertEpisode()
-    : null;
-  terminalActivity.set(id, { ...DEFAULT_ACTIVITY_STATE, ...state, episode });
+  terminalActivity.set(id, { ...DEFAULT_ACTIVITY_STATE, ...state });
   notifyActivityListeners(id);
 }
 
diff --git a/lib/src/lib/session-label.ts b/lib/src/lib/session-label.ts
index f37b55888..ad3ddabd3 100644
--- a/lib/src/lib/session-label.ts
+++ b/lib/src/lib/session-label.ts
@@ -1,5 +1,5 @@
 import { getActivitySnapshot } from './session-activity-store';
-import { buildAppTitleResolver, deriveSurfaceLabel, DEFAULT_IDLE_TITLE } from './terminal-state';
+import { buildAppTitleResolver, deriveSurfaceLabel, DEFAULT_IDLE_TITLE, type TerminalPaneState } from './terminal-state';
 import { getTerminalPaneStateSnapshot } from './terminal-state-store';
 
 /**
@@ -11,15 +11,31 @@ import { getTerminalPaneStateSnapshot } from './terminal-state-store';
  * `deriveSurfaceLabel` in `terminal-state.ts` is the pure derivation. This is
  * the id-keyed wrapper over the live stores, kept in one place because every
  * caller needs the same "an idle pane is called `terminal`" fallback. Spoken
- * alarms intentionally say this exact derived label, including a terminal-
- * supplied OSC 0/2/9 title when it wins the normal display priority
+ * alarms and pushes intentionally say this exact derived label, including a
+ * terminal-supplied OSC 0/2/9 title when it wins the normal display priority
  * (`docs/specs/alert.md` -> Spoken alarms).
  */
 export function deriveSessionLabel(id: string, fallbackTitle: string | null = null): string {
   const states = getTerminalPaneStateSnapshot();
-  const state = states.get(id);
+  return labelOf(states.get(id), buildAppTitleResolver(states, getActivitySnapshot()), fallbackTitle);
+}
+
+/** {@link deriveSessionLabel} for many ids, reading the stores and building the
+ *  app-title resolver once rather than once per id. */
+export function deriveSessionLabels(ids: Iterable<string>): Map<string, string> {
+  const states = getTerminalPaneStateSnapshot();
+  const appTitleForPane = buildAppTitleResolver(states, getActivitySnapshot());
+  const labels = new Map<string, string>();
+  for (const id of ids) labels.set(id, labelOf(states.get(id), appTitleForPane, null));
+  return labels;
+}
+
+function labelOf(
+  state: TerminalPaneState | undefined,
+  appTitleForPane: (pane: TerminalPaneState) => string | null,
+  fallbackTitle: string | null,
+): string {
   if (state) {
-    const appTitleForPane = buildAppTitleResolver(states, getActivitySnapshot());
     const primary = deriveSurfaceLabel(state, appTitleForPane, fallbackTitle);
     if (primary && primary !== DEFAULT_IDLE_TITLE) return primary;
   }
diff --git a/lib/src/lib/speech-synthesis-test-utils.ts b/lib/src/lib/speech-synthesis-test-utils.ts
new file mode 100644
index 000000000..6d38d3f4a
--- /dev/null
+++ b/lib/src/lib/speech-synthesis-test-utils.ts
@@ -0,0 +1,50 @@
+/**
+ * A stand-in for Web Speech, shared by the suites that drive speech
+ * (`alert-speech.test.ts`, `alert-delivery.test.ts`, the Settings tests).
+ * `vi.unstubAllGlobals()` removes it.
+ */
+import { vi } from 'vitest';
+
+/** What `SpeechQueue` sets on an utterance before handing it to the engine. */
+export interface StubUtterance {
+  text: string;
+  voice: unknown;
+  onstart: (() => void) | null;
+  onend: (() => void) | null;
+  onerror: (() => void) | null;
+}
+
+/** The stubbed engine's record, updated as it is driven. */
+export interface SpeechSynthesisStub {
+  /** Each utterance's text, in the order `speak` received it. */
+  spoken: string[];
+  utterances: StubUtterance[];
+  /** Calls to `cancel`. */
+  cancels: number;
+  /** Extra engine behavior a single test wants from `speak`. */
+  onSpeak: ((utterance: StubUtterance) => void) | null;
+}
+
+/** Stub `speechSynthesis` and `SpeechSynthesisUtterance`, offering `voices`. */
+export function stubSpeechSynthesis(voices: readonly unknown[] = []): SpeechSynthesisStub {
+  const engine: SpeechSynthesisStub = { spoken: [], utterances: [], cancels: 0, onSpeak: null };
+  vi.stubGlobal('speechSynthesis', {
+    getVoices: () => [...voices],
+    speak: (utterance: StubUtterance) => {
+      engine.spoken.push(utterance.text);
+      engine.utterances.push(utterance);
+      engine.onSpeak?.(utterance);
+    },
+    cancel: () => {
+      engine.cancels += 1;
+    },
+  });
+  vi.stubGlobal('SpeechSynthesisUtterance', class implements StubUtterance {
+    voice: unknown = null;
+    onstart: (() => void) | null = null;
+    onend: (() => void) | null = null;
+    onerror: (() => void) | null = null;
+    constructor(public text: string) {}
+  });
+  return engine;
+}
diff --git a/lib/src/lib/terminal-registry.alert.test.ts b/lib/src/lib/terminal-registry.alert.test.ts
index 76c3213d8..eee711ca7 100644
--- a/lib/src/lib/terminal-registry.alert.test.ts
+++ b/lib/src/lib/terminal-registry.alert.test.ts
@@ -51,6 +51,7 @@ import {
   subscribeToActivity,
   toggleSessionTodo,
 } from './terminal-registry';
+import { createAlertEpisode } from './alert-episode';
 import { doPaste, pasteFilePaths } from './clipboard';
 import { registry } from './terminal-store';
 import { commandWatchKey } from './terminal-state';
@@ -278,7 +279,7 @@ describe('terminal-registry alert behavior', () => {
 
   it('preserves pre-registration activity through terminal creation and orphaning', () => {
     const id = 'early-host-state';
-    setTerminalActivity(id, { status: 'ALERT_RINGING', todo: true, awaited: true });
+    setTerminalActivity(id, { status: 'ALERT_RINGING', episode: createAlertEpisode(), todo: true, awaited: true });
     const activity = getActivity(id);
     expect(getLivePersistedAlertState(id)).toBeNull();
 
diff --git a/lib/src/lib/workspace-store.ts b/lib/src/lib/workspace-store.ts
index 401bc52f2..b35f9f6c9 100644
--- a/lib/src/lib/workspace-store.ts
+++ b/lib/src/lib/workspace-store.ts
@@ -1,4 +1,4 @@
-import { normalizeAlertDeliveryOverrides, type AlertDeliveryOverrides } from './alert-delivery-model';
+import { normalizeAlertDeliveryOverrides, sameAlertDeliveryOverrides, type AlertDeliveryOverrides } from './alert-delivery-model';
 import { parseWorkspaceRef } from 'dor/protocol';
 import { DEFAULT_WORKSPACE_ID, DEFAULT_WORKSPACE_NAME, isDefaultWorkspaceName, type WorkspaceId } from './session-types';
 
@@ -353,16 +353,10 @@ export function resetWorkspaces(): void {
 export function setWorkspaceAlertDelivery(id: WorkspaceId, value: AlertDeliveryOverrides): void {
   const alertDelivery = normalizeAlertDeliveryOverrides(value);
   const current = getWorkspace(id);
-  if (!current || sameOverrides(current.alertDelivery ?? {}, alertDelivery)) return;
+  if (!current || sameAlertDeliveryOverrides(current.alertDelivery ?? {}, alertDelivery)) return;
   emit({ ...state, workspaces: state.workspaces.map((workspace) => {
     if (workspace.id !== id) return workspace;
     const { alertDelivery: _old, ...rest } = workspace;
     return Object.keys(alertDelivery).length ? { ...rest, alertDelivery } : rest;
   }) });
 }
-
-function sameOverrides(a: AlertDeliveryOverrides, b: AlertDeliveryOverrides): boolean {
-  const keys = new Set([...Object.keys(a), ...Object.keys(b)]) as Set<keyof AlertDeliveryOverrides>;
-  for (const key of keys) if (a[key] !== b[key]) return false;
-  return true;
-}
diff --git a/lib/src/remote/burrow/activation.test.ts b/lib/src/remote/burrow/activation.test.ts
index 27c695817..ff030a473 100644
--- a/lib/src/remote/burrow/activation.test.ts
+++ b/lib/src/remote/burrow/activation.test.ts
@@ -1,33 +1,26 @@
 /**
  * The webview's end of the Burrow service (`lib/src/host/remote/service.ts`): it
- * forwards console commands, mirrors the pairing queue, and keeps the push
- * device list. It
- * starts no `BurrowRuntime` of its own and holds no Burrow state — there is no
- * webview-resident mode left to fall back to, so a host with no service behind
- * it gets nothing at all.
+ * forwards console commands, mirrors the pairing queue, and refreshes the push
+ * device list. It starts no `BurrowRuntime` of its own and holds no Burrow state
+ * — there is no webview-resident mode left to fall back to, so a host with no
+ * service behind it gets nothing at all.
  */
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import type { BurrowLink } from '../../lib/platform/types';
 
-const pushWatch = vi.hoisted(() => ({
-  invalidated: 0,
-  loads: [] as Array<() => Promise<unknown>>,
+/** The dialog's device store, as this module drives it. */
+const devices = vi.hoisted(() => ({
+  /** Every refresher installed, latest last. */
+  refreshers: [] as Array<() => void>,
+  /** Every `clearPushDevices()`: the disarm's one call. */
+  cleared: 0,
 }));
-vi.mock('./alert-push', () => ({
-  commitPushDevices: async (load: () => Promise<unknown>) => {
-    pushWatch.loads.push(load);
-    await load();
-  },
-  invalidatePushDeviceRefreshes: () => {
-    pushWatch.invalidated += 1;
-  },
-}));
-const pushRefreshers = vi.hoisted(() => ({ current: [] as Array<() => void>, cleared: 0 }));
 vi.mock('../../lib/push-devices', () => ({
-  setPushDevicesRefresher: (refresh: () => void) => void pushRefreshers.current.push(refresh),
+  commitPushDevices: async (load: () => Promise<unknown>) => void (await load()),
+  setPushDevicesRefresher: (refresh: () => void) => void devices.refreshers.push(refresh),
   clearPushDevices: () => {
-    pushRefreshers.cleared += 1;
+    devices.cleared += 1;
   },
 }));
 
@@ -40,10 +33,8 @@ vi.mock('../../lib/platform', () => ({
 
 beforeEach(() => {
   burrowLink = undefined;
-  pushWatch.invalidated = 0;
-  pushWatch.loads.length = 0;
-  pushRefreshers.current.length = 0;
-  pushRefreshers.cleared = 0;
+  devices.refreshers.length = 0;
+  devices.cleared = 0;
   // The console hook lives on globalThis and outlives `vi.resetModules()`;
   // leaving it set would make the next test call the previous module's closure.
   delete (globalThis as { dormouseBurrow?: unknown }).dormouseBurrow;
@@ -308,7 +299,7 @@ describe('burrow bridge mode', () => {
     expect(link.commands.some((c) => c.cmd === 'pushDevices')).toBe(true);
     // And the dialog can ask again later.
     link.commands.length = 0;
-    pushRefreshers.current.at(-1)!();
+    devices.refreshers.at(-1)!();
     await Promise.resolve();
     expect(link.commands.map((c) => c.cmd)).toEqual(['pushDevices']);
   });
@@ -339,14 +330,13 @@ describe('burrow bridge mode', () => {
     link.emit('status', { name: 'status', enrolled: false });
     // The dialog must stop naming devices nothing can push to — including any
     // list still on the wire, which would otherwise put them back on arrival.
-    expect(pushWatch.invalidated).toBe(1);
-    expect(pushRefreshers.cleared).toBe(1);
+    expect(devices.cleared).toBe(1);
     // The refresher stays installed rather than being dropped and put back: the
     // dialog may still open on an un-enrolled machine, where asking is one
     // command that answers `no-burrow`.
-    expect(pushRefreshers.current).toHaveLength(1);
+    expect(devices.refreshers).toHaveLength(1);
     link.commands.length = 0;
-    pushRefreshers.current.at(-1)!();
+    devices.refreshers.at(-1)!();
     await settle();
     expect(link.commands.map((c) => c.cmd)).toEqual(['pushDevices']);
   });
diff --git a/lib/src/remote/burrow/activation.ts b/lib/src/remote/burrow/activation.ts
index 5399ab29b..53a91ddce 100644
--- a/lib/src/remote/burrow/activation.ts
+++ b/lib/src/remote/burrow/activation.ts
@@ -6,9 +6,10 @@
  * The Burrow itself is a service in the process that owns the PTYs
  * (`lib/src/host/remote/service.ts`) — the Tauri sidecar, the VS Code extension
  * host. This module is its client: it forwards console commands, mirrors the
- * pairing queue, and keeps the push device list. It starts no Burrow, holds no relay socket,
- * and reads no ACL. A host with no service behind it (the website) gets nothing
- * at all, which is why every entry point here tolerates a missing link.
+ * pairing queue, and refreshes the push device list. It starts no Burrow, holds
+ * no relay socket, and reads no ACL. A host with no service behind it (the
+ * website) gets nothing at all, which is why every entry point here tolerates a
+ * missing link.
  *
  * Enroll from the devtools console:
  *
@@ -27,8 +28,7 @@ import type {
 } from '../../host/remote/service-protocol';
 import { getPlatform } from '../../lib/platform';
 import type { BurrowLink } from '../../lib/platform/types';
-import { clearPushDevices, setPushDevicesRefresher } from '../../lib/push-devices';
-import { commitPushDevices, invalidatePushDeviceRefreshes } from './alert-push';
+import { clearPushDevices, commitPushDevices, setPushDevicesRefresher } from '../../lib/push-devices';
 import { armWhileEnrolled } from './enrolled-gate';
 import {
   enqueuePairingApproval,
@@ -94,7 +94,6 @@ function installBridgeMode(link: BurrowLink): void {
       // them back the moment it lands. The refresher stays installed: the dialog
       // may still open on an un-enrolled machine, where asking is one command
       // that answers `no-burrow`.
-      invalidatePushDeviceRefreshes();
       clearPushDevices();
     };
   });
diff --git a/lib/src/remote/burrow/alert-push.ts b/lib/src/remote/burrow/alert-push.ts
deleted file mode 100644
index 13c12b314..000000000
--- a/lib/src/remote/burrow/alert-push.ts
+++ /dev/null
@@ -1,60 +0,0 @@
-/**
- * The push device list the Settings dialog names (`docs/specs/alert.md` ->
- * Settings dialog): each refresh fenced so a stale answer never overwrites a
- * newer one, or a Burrow that went away. When a ring is pushed is the host's
- * delivery scheduler's (`lib/src/lib/alert-delivery-scheduler.ts`); the Relay
- * calls are `push-delivery.ts`, which a Node-resident Burrow runs.
- *
- * It lives under `remote/burrow/` rather than `lib/` because it is only
- * meaningful with a Burrow behind it, and because that keeps it inside the
- * lazily-imported `RemotePairingModalHost` chunk — so a host that never sets
- * `enableBurrow` never fetches it.
- */
-
-import { setPushDevices, type PushDevice, type PushDevicesState } from '../../lib/push-devices';
-
-let pushDevicesRefreshSequence = 0;
-
-/**
- * Run `load` and publish its result to the dialog's store, fenced as below.
- * `load` goes over the service bridge (`activation.ts`) as a `pushDevices`
- * command, because the ACL the list is joined against is the Burrow's — and it
- * answers `null` when no Burrow is running, which is "nowhere to push"
- * (rendered `no-burrow`), not an empty list. Failure is reported as `error`
- * rather than an empty list: "we could not ask" and "no devices are
- * subscribed" are different things to show a user.
- */
-export async function commitPushDevices(
-  load: () => Promise<PushDevice[] | null>,
-): Promise<void> {
-  // Writes are fenced on request order: overlapping requests are
-  // latest-request-wins, so a slow startup refresh cannot overwrite a newer
-  // dialog refresh. Which Burrow answered needs no fence of its own — the service
-  // reads its own ACL at request time, and a Burrow that stopped answers
-  // `no-burrow` like any other state.
-  const sequence = ++pushDevicesRefreshSequence;
-  const commit = (next: PushDevicesState) => {
-    if (pushDevicesRefreshSequence === sequence) setPushDevices(next);
-  };
-  // The same fence covers {@link invalidatePushDeviceRefreshes}: a Burrow that
-  // went away is not a newer request, but it has the same claim on the result.
-  commit({ status: 'loading', devices: [] });
-  try {
-    const devices = await load();
-    commit(devices ? { status: 'ready', devices } : { status: 'no-burrow', devices: [] });
-  } catch {
-    commit({ status: 'error', devices: [] });
-  }
-}
-
-/**
- * Discard every refresh currently in flight.
- *
- * Called when the Burrow goes away (`activation.ts`, the enrolled gate's disarm).
- * A request that was already on the wire resolves afterwards and would otherwise
- * repopulate the dialog with devices there is no longer anything to push to —
- * the list would name phones and the Burrow behind them would be gone.
- */
-export function invalidatePushDeviceRefreshes(): void {
-  pushDevicesRefreshSequence += 1;
-}
diff --git a/lib/src/remote/burrow/burrow-status-store.ts b/lib/src/remote/burrow/burrow-status-store.ts
index 12f7a2bb3..a9fdad903 100644
--- a/lib/src/remote/burrow/burrow-status-store.ts
+++ b/lib/src/remote/burrow/burrow-status-store.ts
@@ -383,7 +383,7 @@ export function subscribeToInvitation(
  * break an alarm (`docs/specs/relay.md` -> Web Push). A test button is the one
  * caller that needs the failure.
  *
- * Lives here rather than beside the device list in `alert-push.ts`: that
+ * Lives here rather than beside the device refresh in `activation.ts`: that
  * module is deliberately inside the lazily-imported `RemotePairingModalHost`
  * chunk, and importing it from the Settings dialog would pull the whole
  * Burrow stack into the main bundle on every host.
diff --git a/lib/src/remote/burrow/peer-surfaces.test.ts b/lib/src/remote/burrow/peer-surfaces.test.ts
index 29b69ef5c..d4b92f613 100644
--- a/lib/src/remote/burrow/peer-surfaces.test.ts
+++ b/lib/src/remote/burrow/peer-surfaces.test.ts
@@ -12,6 +12,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { FakePtyAdapter, setPlatform, type PlatformAdapter } from '../../lib/platform';
 import { setTerminalActivity, clearTerminalActivity } from '../../lib/session-activity-store';
+import { createAlertEpisode } from '../../lib/alert-episode';
 import { registry, type TerminalEntry } from '../../lib/terminal-store';
 import { installPeerSurfaceResponder } from './peer-surfaces';
 
@@ -159,7 +160,7 @@ describe('surface responder', () => {
     // The Burrow has no view of the activity store, so a ring that changes an
     // entry is only visible to it if this webview says so.
     await armed();
-    setTerminalActivity('pty-1', { status: 'ALERT_RINGING' });
+    setTerminalActivity('pty-1', { status: 'ALERT_RINGING', episode: createAlertEpisode() });
     await Promise.resolve();
     expect(platform.notified).toBe(1);
   });
@@ -169,15 +170,15 @@ describe('surface responder', () => {
     // with an activity change. The Burrow re-collects the whole directory either
     // way, so the burst is worth exactly one notify.
     await armed();
-    setTerminalActivity('pty-1', { status: 'ALERT_RINGING' });
-    setTerminalActivity('pty-2', { status: 'ALERT_RINGING' });
+    setTerminalActivity('pty-1', { status: 'ALERT_RINGING', episode: createAlertEpisode() });
+    setTerminalActivity('pty-2', { status: 'ALERT_RINGING', episode: createAlertEpisode() });
     expect(platform.notified).toBe(0);
 
     await Promise.resolve();
     expect(platform.notified).toBe(1);
 
     // And the next burst is announced on its own.
-    setTerminalActivity('pty-3', { status: 'ALERT_RINGING' });
+    setTerminalActivity('pty-3', { status: 'ALERT_RINGING', episode: createAlertEpisode() });
     await Promise.resolve();
     expect(platform.notified).toBe(2);
   });
@@ -191,7 +192,7 @@ describe('surface responder', () => {
     installPeerSurfaceResponder();
     await armed();
 
-    setTerminalActivity('pty-1', { status: 'ALERT_RINGING' });
+    setTerminalActivity('pty-1', { status: 'ALERT_RINGING', episode: createAlertEpisode() });
     await Promise.resolve();
     expect(platform.notified).toBe(1);
     // And answering still works after the extra calls.
@@ -209,7 +210,7 @@ describe('surface responder', () => {
     installPeerSurfaceResponder();
     await armed();
 
-    setTerminalActivity('pty-2', { status: 'ALERT_RINGING' });
+    setTerminalActivity('pty-2', { status: 'ALERT_RINGING', episode: createAlertEpisode() });
     await Promise.resolve();
     expect(quiet.notified).toBe(0);
     // Answering still works: it costs nothing until the Burrow asks.
diff --git a/lib/src/remote/burrow/alert-push.test.ts b/lib/src/remote/burrow/push-delivery.test.ts
similarity index 87%
rename from lib/src/remote/burrow/alert-push.test.ts
rename to lib/src/remote/burrow/push-delivery.test.ts
index 3a948b255..38308cee6 100644
--- a/lib/src/remote/burrow/alert-push.test.ts
+++ b/lib/src/remote/burrow/push-delivery.test.ts
@@ -1,4 +1,4 @@
-import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
 
 import {
   MAX_PUSH_QUERY_DELIVERY_IDS,
@@ -12,11 +12,15 @@ import {
   type NoiseKeyPair,
   type PushSendRequest,
 } from 'remote-lib-common';
-import { commitPushDevices, invalidatePushDeviceRefreshes } from './alert-push';
-// Delivery — the Relay calls, the recipient rule, the title bounds — runs in
-// the Burrow's process, so it lives beside neither webview nor sidecar.
 import { loadPushDevices, sendPush, toPushText, type AlertPushDeps } from './push-delivery';
-import { getPushDevices, resetPushDevices } from '../../lib/push-devices';
+import { clearPushDevices, commitPushDevices, getPushDevices, resetPushDevices } from '../../lib/push-devices';
+
+/**
+ * The Burrow's Relay calls (`docs/specs/alert.md` -> Push notifications): the
+ * recipient rule, the title bounds, the seal, and the device list the Settings
+ * dialog names. When a push is due is the host's delivery scheduler's, and
+ * swallowing a failed one is `BurrowService.push`'s (`service.test.ts`).
+ */
 
 const ENROLLMENT = { relayUrl: 'https://relay.example', burrowToken: 'burrow-token' };
 
@@ -68,8 +72,8 @@ function aclRecord(deliveryId: string, label: string): BurrowAclRecord {
 
 /**
  * A stand-in for the Burrow's seal: shape-correct, distinct per recipient, and
- * free of WebCrypto, so the alarm cases below stay deterministic under fake
- * timers. The real construction is driven with real keys in `sealed push`.
+ * free of WebCrypto, so the cases below mint no keys. The real construction is
+ * driven with real keys in `sealed push`.
  */
 function fakeSeal(): AlertPushDeps['seal'] {
   let n = 0;
@@ -87,7 +91,7 @@ const realSeal: AlertPushDeps['seal'] = (clientStaticPublicKey, plaintext) =>
     plaintext,
   });
 
-/** Requests the sink made, in order. */
+/** Requests made of the Relay, in order. */
 let requests: Array<{ url: string; init?: RequestInit }>;
 let subscribed: string[];
 let records: BurrowAclRecord[];
@@ -121,17 +125,6 @@ function deps(overrides: Partial<AlertPushDeps> = {}): AlertPushDeps {
   };
 }
 
-/**
- * One due push as the Burrow runs it (`BurrowService.#push`): with its own ACL,
- * swallowing a failure so a dead push never breaks the alert path. When it is
- * due is the host's scheduler's (`lib/src/lib/alert-delivery-scheduler.ts`).
- */
-async function push(pushDeps: AlertPushDeps): Promise<void> {
-  await sendPush(pushDeps, 'pty-1', 'terminal').catch((error: unknown) => {
-    console.warn('burrow: push notification failed', error);
-  });
-}
-
 /** As the settings dialog asks for it, over the bridge (`activation.ts`). */
 function refreshPushDevices(pushDeps: AlertPushDeps): Promise<void> {
   return commitPushDevices(() => loadPushDevices(pushDeps));
@@ -149,7 +142,6 @@ function lastRecipients(): string[] {
 }
 
 beforeEach(() => {
-  vi.useFakeTimers();
   requests = [];
   subscribed = [PHONE];
   records = [aclRecord(PHONE, 'iPhone Safari')];
@@ -158,7 +150,6 @@ beforeEach(() => {
 
 afterEach(() => {
   resetPushDevices();
-  vi.useRealTimers();
 });
 
 /**
@@ -209,9 +200,9 @@ describe('toPushText', () => {
   });
 });
 
-describe('alarm push', () => {
+describe('sendPush', () => {
   it('sends the label sealed, tagged per Session', async () => {
-    await push(deps());
+    await sendPush(deps(), 'pty-1', 'terminal');
     expect(lastRecipients()).toEqual([PHONE]);
     // The label and the collapse tag are sealed, so nothing readable rides on
     // the request the Relay sees.
@@ -223,11 +214,10 @@ describe('alarm push', () => {
   it('names only devices still active in the ACL when it sends', async () => {
     // The Relay still holds a subscription for a revoked client — nothing
     // propagates a revocation — so the Burrow must not address it. It stays out
-    // of the request because the ACL, read now rather than when the ring
-    // began, chooses targets.
+    // of the request because the ACL, read at the send, chooses targets.
     subscribed = [PHONE, REVOKED];
     records = [aclRecord(PHONE, 'iPhone Safari')];
-    await push(deps());
+    await sendPush(deps(), 'pty-1', 'terminal');
     expect(lastRecipients()).toEqual([PHONE]);
   });
 
@@ -235,7 +225,7 @@ describe('alarm push', () => {
     // The ACL is local, and the Relay intersects the names it is given with
     // its own subscriptions anyway — so asking it first would only add a round
     // trip to the one path whose whole value is timeliness.
-    await push(deps());
+    await sendPush(deps(), 'pty-1', 'terminal');
     expect(requests).toHaveLength(1);
     expect(requests[0]!.url).toContain('/api/push/send');
   });
@@ -253,42 +243,36 @@ describe('alarm push', () => {
     // The send route answers 200 with counts even when every delivery failed —
     // a rotated VAPID key or a wedged push service must not be silent.
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    await push(deps({
+    const summary = await sendPush(deps({
       fetch: (async () => ({
         ok: true,
         json: async () => ({ delivered: 0, expired: 0, unknown: 0, failed: 1 }),
       })) as unknown as typeof globalThis.fetch,
-    }));
+    }), 'pty-1', 'terminal');
+    expect(summary).toEqual({ targeted: 1, delivered: 0, failed: 1 });
     expect(warn).toHaveBeenCalled();
     warn.mockRestore();
   });
 
-  it('warns rather than failing silently when the Relay rejects the send', async () => {
-    // A 401 from a revoked burrow token would otherwise resolve normally and
-    // leave push permanently broken with nothing in the console.
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    await push(deps({
+  it('rejects when the Relay refuses the send', async () => {
+    // A 401 from a revoked burrow token must not resolve as if it were sent.
+    await expect(sendPush(deps({
       fetch: (async () => ({ ok: false, status: 401 })) as unknown as typeof globalThis.fetch,
-    }));
-    expect(warn).toHaveBeenCalled();
-    warn.mockRestore();
-  });
-
-  it('sends nothing when no subscribed device is still authorized', async () => {
-    records = [];
-    await push(deps());
-    expect(lastSend()).toBeNull();
+    }), 'pty-1', 'terminal')).rejects.toThrow();
   });
 
-  it('survives a Relay that cannot be reached', async () => {
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    await expect(push(deps({
+  it('rejects when the Relay cannot be reached', async () => {
+    await expect(sendPush(deps({
       fetch: (async () => {
         throw new Error('network down');
       }) as unknown as typeof globalThis.fetch,
-    }))).resolves.toBeUndefined();
-    expect(warn).toHaveBeenCalled();
-    warn.mockRestore();
+    }), 'pty-1', 'terminal')).rejects.toThrow('network down');
+  });
+
+  it('sends nothing when no subscribed device is still authorized', async () => {
+    records = [];
+    expect(await sendPush(deps(), 'pty-1', 'terminal')).toEqual({ targeted: 0, delivered: 0, failed: 0 });
+    expect(lastSend()).toBeNull();
   });
 });
 
@@ -434,9 +418,9 @@ describe('push device list', () => {
   });
 
   it('discards a refresh that lands after the Burrow went away', async () => {
-    // The enrolled gate disarms on `clearEnrollment` and resets the store to
-    // `no-burrow`. A request already on the wire resolves afterwards and would
-    // otherwise repopulate the dialog with phones there is nothing to push to.
+    // The enrolled gate disarms on `clearEnrollment` with one clear. A request
+    // already on the wire resolves afterwards and would otherwise repopulate
+    // the dialog with phones there is nothing to push to.
     let land: (response: Response) => void = () => {};
     const inFlight = refreshPushDevices(
       deps({
@@ -447,8 +431,7 @@ describe('push device list', () => {
       }),
     );
 
-    invalidatePushDeviceRefreshes();
-    resetPushDevices();
+    clearPushDevices();
 
     land({
       ok: true,
diff --git a/lib/src/remote/burrow/push-delivery.ts b/lib/src/remote/burrow/push-delivery.ts
index a2db08b5c..11f3c6664 100644
--- a/lib/src/remote/burrow/push-delivery.ts
+++ b/lib/src/remote/burrow/push-delivery.ts
@@ -4,11 +4,12 @@
  * is reached. The transport those calls run under is `burrow-fetch.ts`, shared
  * with the setup-token mint.
  *
- * Only the send lives here: *when* is the host's delivery scheduler
- * (`lib/src/lib/alert-delivery-scheduler.ts`), and *what the Session is
- * called* the renderer's pane label, while the send needs the enrollment and
- * the ACL, which only the Burrow holds. Nothing here touches the DOM or a
- * store, so it runs unchanged in a webview or in the sidecar.
+ * Only the send lives here, because it needs the enrollment and the ACL, which
+ * only the Burrow holds. *When* is the host's delivery scheduler
+ * (`lib/src/lib/alert-delivery-scheduler.ts`), which hands a due push to the
+ * Burrow in its own process; *what the Session is called* is the Pane label the
+ * realm showing it published to that host. Nothing here touches the DOM or a
+ * store.
  *
  * Delivery is an HTTP POST to the Relay rather than a relay frame: the relay
  * routes between two live sockets, and the whole point of a push is reaching a
@@ -127,9 +128,9 @@ export async function loadPushDevices(deps: AlertPushDeps): Promise<PushDevice[]
 /**
  * Push `title` for one Session to every device the ACL still authorizes.
  *
- * The label is passed in rather than derived: it comes from the pane stores,
- * which live in the webview, so a Burrow in another process is told what the
- * Session is called and never guesses.
+ * `title` is the Pane label the realm showing the Session published to its host,
+ * passed in by the host's delivery scheduler: the pane stores live in the
+ * renderer, so the Burrow is told what the Session is called and never guesses.
  *
  * **One ciphertext per recipient**, sealed to that ACL record's own Client
  * static (`docs/specs/remote-security-model.md` -> Push sealing).
diff --git a/lib/src/remote/client/remote-adapter.ts b/lib/src/remote/client/remote-adapter.ts
index bd2b6c90f..b0a586cb6 100644
--- a/lib/src/remote/client/remote-adapter.ts
+++ b/lib/src/remote/client/remote-adapter.ts
@@ -348,7 +348,7 @@ export class RemotePtyAdapter implements PlatformAdapter {
   alertPublishSettings(): void {}
   alertDismiss(): void {}
   alertEngagement(): void {}
-  alertPublishDeliveryPolicy(): void {}
+  alertPublishSessions(): void {}
   alertAcknowledge(): void {}
   alertToggleTodo(): void {}
   alertClearTodo(): void {}
@@ -363,7 +363,9 @@ export class RemotePtyAdapter implements PlatformAdapter {
   onAlertState(): void {}
   onWatchedCommands(): void {}
   onAlertSettings(): void {}
-  onAlertDeliver(): void {}
+  onAlertSpeak(): () => void {
+    return () => {};
+  }
 
   saveState(state: unknown): void {
     this.#savedState = state;
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 0feec409e..67c5063fc 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -2,7 +2,7 @@
   "AGENTS.md": 3400,
   "SECURITY.md": 200,
   "SELF_HOST.md": 6100,
-  "docs/specs/alert.md": 7950,
+  "docs/specs/alert.md": 7900,
   "docs/specs/auto-update.md": 1150,
   "docs/specs/deploy.md": 1900,
   "docs/specs/dor-browser.md": 4550,
@@ -32,7 +32,7 @@
   "docs/specs/terminal-state.md": 2500,
   "docs/specs/theme.md": 2200,
   "docs/specs/tiling-engine.md": 4650,
-  "docs/specs/transport.md": 5550,
+  "docs/specs/transport.md": 5500,
   "docs/specs/tutorial.md": 1900,
   "docs/specs/vscode.md": 7350,
   "docs/specs/webgl-text.md": 1200,
diff --git a/vscode-ext/src/burrow.ts b/vscode-ext/src/burrow.ts
index e91d09d70..60dc2e9c3 100644
--- a/vscode-ext/src/burrow.ts
+++ b/vscode-ext/src/burrow.ts
@@ -34,6 +34,7 @@ import {
   broadcastUiEvent,
   ensurePeerNet,
   forwardCommand,
+  forwardPush,
   isPeerLinkSettled,
   isRemotePtyHandle,
   onPeerLinkSettled,
@@ -420,6 +421,24 @@ export function deliverUiEvent(payload: unknown): void {
   deps?.broadcastToWebviews({ type: 'burrow:event', payload });
 }
 
+/**
+ * One due alarm push from this window's alert host (`docs/specs/alert.md` ->
+ * Push notifications): sent by this window's service, or handed to the
+ * broker's over the link. Fire and forget, with no answer route: nothing
+ * waits on it. Dropped when there is neither, never queued for a role that
+ * may yet settle, because stale alarms are never retried.
+ */
+export function pushAlert(sessionId: string, title: string): void {
+  if (service) void service.push(sessionId, title);
+  else forwardPush(sessionId, title);
+}
+
+/** Broker side: a push another window's alert host forwarded. Never
+ *  forwarded again. */
+export function handleForwardedPush(sessionId: string, title: string): void {
+  void service?.push(sessionId, title);
+}
+
 /**
  * A window just joined this broker. Hand it the Burrow state its webviews gate
  * themselves on.
@@ -427,8 +446,8 @@ export function deliverUiEvent(payload: unknown): void {
  * Without this a window that opened after the enrollment is told nothing:
  * `status` events are emitted on change, and nothing about the Burrow changes
  * because a window connected. Its webviews would sit disarmed — announcing no
- * directory changes, watching for no rings — until the user reloaded the whole
- * window (`lib/src/remote/burrow/enrolled-gate.ts`).
+ * directory changes, seeding no pairing queue — until the user reloaded the
+ * whole window (`lib/src/remote/burrow/enrolled-gate.ts`).
  */
 export function greetPeerWindow(client: PeerLinkClient): void {
   if (!service) return;
diff --git a/vscode-ext/src/extension.ts b/vscode-ext/src/extension.ts
index 89a247df2..f286d6dd5 100644
--- a/vscode-ext/src/extension.ts
+++ b/vscode-ext/src/extension.ts
@@ -2,7 +2,7 @@ import * as vscode from 'vscode';
 import * as path from 'path';
 import * as ptyManager from './pty-manager';
 import { DormouseViewProvider } from './webview-view-provider';
-import { attachRouter, flushAllSessions, getAlertStates } from './message-router';
+import { attachRouter, flushAllSessions, getAlertStates, reportWindowPresence } from './message-router';
 import { closePoppedOutSessions } from './agent-browser-host';
 import { serveWebview } from './webview-messaging';
 import { log } from './log';
@@ -91,6 +91,10 @@ export function activate(context: vscode.ExtensionContext) {
   // The Burrow runs here, in the extension host that owns the PTYs — in
   // whichever window wins the bind (burrow.ts).
   context.subscriptions.push(initBurrow(context));
+  // Whether the user is at this window, for the alerts' push gate
+  // (message-router.ts).
+  reportWindowPresence(vscode.window.state);
+  context.subscriptions.push(vscode.window.onDidChangeWindowState(reportWindowPresence));
   initToolHost(context.globalStorageUri?.fsPath);
   log.init();
   extensionContext = context;
diff --git a/vscode-ext/src/message-router.ts b/vscode-ext/src/message-router.ts
index 58d198823..1ca8ac00a 100644
--- a/vscode-ext/src/message-router.ts
+++ b/vscode-ext/src/message-router.ts
@@ -1,7 +1,6 @@
 import * as vscode from 'vscode';
 import * as ptyManager from './pty-manager';
 import { createAlertHost, type AlertRealm } from '../../lib/src/host/alert-host';
-import type { AlertDelivery } from '../../lib/src/lib/alert-delivery-scheduler';
 import { alertedPty, createOwnerPtyStream } from '../../lib/src/host/owner-pty';
 import type {
   TerminalColorProvider,
@@ -39,8 +38,10 @@ import {
   dropForwardedCommands,
   greetPeerWindow,
   handleForwardedCommand,
+  handleForwardedPush,
   handleBurrowCommand,
   notifyDirectoryChanged,
+  pushAlert,
 } from './burrow';
 import { log } from './log';
 import type { WebviewChannel } from './webview-messaging';
@@ -99,6 +100,7 @@ configurePeerLink({
   // window landed on, and the link is what knows that.
   handleForwardedCommand,
   dropForwardedCommands,
+  handleForwardedPush,
   deliverCommandResult,
   deliverUiEvent,
   onClientAuthenticated: greetPeerWindow,
@@ -189,29 +191,24 @@ const ALLOWED_WORKBENCH_COMMANDS = new Set<string>(VSCODE_WORKBENCH_COMMANDS);
 
 // This window's alerts, in the host role standalone's sidecar runs too
 // (`lib/src/host/alert-host.ts`). They survive router disposal, so alert state
-// persists across webview collapse/expand cycles; each router is one realm.
-const alertHost = createAlertHost({ deliver: deliverAlert });
+// persists across webview collapse/expand cycles; each router is one realm. A
+// due push goes from here, whether or not a webview shows its Session.
+const alertHost = createAlertHost({ push: pushAlert });
 const alertManager = alertHost.manager;
-let nextFallbackPushId = 0;
 
 /**
- * One due spoken alarm or push, to the webview that owns its Session. With
- * none — a disposed view whose PTYs live on — a push goes from here, titled by
- * the command, and speech is skipped: it needs a renderer
- * (`docs/specs/alert.md` -> Alarm settings).
+ * This VS Code window's state, as `activate` reports it. Focused and recently
+ * active, the window is one more viewer — with no focus, so it engages no
+ * Session — which holds back a push: the user may be working outside the
+ * Dormouse webview (`docs/specs/alert.md` -> Alarm
+ * settings). `WindowState.active` is finalized in 1.89, after the supported
+ * 1.85; an older VS Code never reports it, and focus alone must not count, or
+ * a focused window left behind would silence the walked-away channel.
  */
-function deliverAlert(delivery: AlertDelivery): void {
-  const owner = [...activeRouters].find((router) => router.ownsPty(delivery.id));
-  if (owner) {
-    owner.send({ type: 'alert:deliver', ...delivery });
-    return;
-  }
-  if (delivery.sink !== 'push') return;
-  handleBurrowCommand({
-    burrowRequestId: `alert-push-${++nextFallbackPushId}`,
-    cmd: 'push',
-    params: { sessionId: delivery.id, title: alertManager.lastCommand(delivery.id) ?? '' },
-  });
+const WINDOW_VIEWER = 'vscode-window';
+export function reportWindowPresence(state: vscode.WindowState): void {
+  const active = (state as { active?: unknown }).active === true;
+  alertManager.setViewer(WINDOW_VIEWER, { present: state.focused && active, focusId: null });
 }
 /** Every PTY write and resize, as the alerts must see it. */
 const alertedPtys = alertedPty(alertManager, ptyManager);
@@ -550,6 +547,11 @@ export function attachRouter(
       post({ type: 'alert:state', id, ...state } satisfies ExtensionMessage);
       notifyUnion();
     });
+    // Speech needs a renderer, so a Session no connected webview shows is not
+    // spoken (`docs/specs/alert.md` -> Alarm settings).
+    const removeSpeakListener = alertHost.onSpeak((speak) => {
+      if (ownedPtyIds.has(speak.id)) post({ type: 'alert:speak', ...speak } satisfies ExtensionMessage);
+    });
 
     return () => {
       removeProcessedListener();
@@ -557,6 +559,7 @@ export function attachRouter(
       toolEventsListeners.delete(onToolEvents);
       removeExitListener();
       removeAlertListener();
+      removeSpeakListener();
     };
   }
 
diff --git a/vscode-ext/src/peer-link-protocol.ts b/vscode-ext/src/peer-link-protocol.ts
index 44972a67d..0ca0ab850 100644
--- a/vscode-ext/src/peer-link-protocol.ts
+++ b/vscode-ext/src/peer-link-protocol.ts
@@ -36,7 +36,9 @@ export type PeerLinkResponse =
   | { kind: 'data'; ptyId: string; data: string; textData?: string }
   | { kind: 'exit'; ptyId: string; exitCode: number }
   | { kind: 'notify' }
-  | { kind: 'command'; payload: BurrowCommand };
+  | { kind: 'command'; payload: BurrowCommand }
+  /** A due alarm push for the broker's Burrow to send; nothing answers it. */
+  | { kind: 'push'; sessionId: string; title: string };
 
 export type PeerLinkFrame = PeerLinkRequest | PeerLinkResponse;
 
diff --git a/vscode-ext/src/peer-link.ts b/vscode-ext/src/peer-link.ts
index 64ab6712b..7720ecc48 100644
--- a/vscode-ext/src/peer-link.ts
+++ b/vscode-ext/src/peer-link.ts
@@ -72,6 +72,8 @@ export interface PeerLinkDeps {
   handleForwardedCommand(payload: BurrowCommand, from: PeerLinkClient): void;
   /** Broker side: that window is gone, so nothing it asked can be answered. */
   dropForwardedCommands(from: PeerLinkClient): void;
+  /** Broker side: a due alarm push another window's alert host forwarded. */
+  handleForwardedPush(sessionId: string, title: string): void;
   /** Client side: the broker answered a command this window forwarded. */
   deliverCommandResult(payload: BurrowResult): void;
   /** Client side: a Burrow UI event, for this window's webviews to render. */
@@ -723,6 +725,12 @@ function onServerFrame(client: PeerLinkClient, frame: unknown): void {
     deps?.handleForwardedCommand(response.payload, client);
     return;
   }
+  if (response.kind === 'push') {
+    if (typeof response.sessionId === 'string' && typeof response.title === 'string') {
+      deps?.handleForwardedPush(response.sessionId, response.title);
+    }
+    return;
+  }
   if ('id' in response) {
     // Only from the window it was put to: request ids are minted per broker, so
     // a window answering another's id would settle a collection it was never
@@ -864,6 +872,16 @@ export function forwardCommand(payload: BurrowCommand): boolean {
   return true;
 }
 
+/**
+ * Hand one due alarm push to the broker's Burrow. Nothing answers it, and with
+ * no broker it is dropped rather than held: a push late enough to wait for one
+ * is stale (`docs/specs/alert.md` -> Push notifications).
+ */
+export function forwardPush(sessionId: string, title: string): void {
+  if (!client || client.destroyed) return;
+  respond({ kind: 'push', sessionId, title });
+}
+
 async function onClientFrame(socket: Socket, frame: unknown): Promise<void> {
   if (!isFrameObject(frame)) {
     log.error('[peer-link] ignored a broker frame that is not an object');
diff --git a/vscode-ext/test/burrow.test.ts b/vscode-ext/test/burrow.test.ts
index 8ce978843..f8610702f 100644
--- a/vscode-ext/test/burrow.test.ts
+++ b/vscode-ext/test/burrow.test.ts
@@ -223,6 +223,7 @@ function bridgeLinkToBurrow(
     resizePty: local.resizePty,
     handleForwardedCommand: mod.handleForwardedCommand,
     dropForwardedCommands: mod.dropForwardedCommands,
+    handleForwardedPush: mod.handleForwardedPush,
     deliverCommandResult: mod.deliverCommandResult,
     deliverUiEvent: mod.deliverUiEvent,
     onClientAuthenticated: mod.greetPeerWindow,
@@ -1118,6 +1119,59 @@ describe('serving the other windows', () => {
     expect(far.uiEvents).toEqual([{ name: 'status', enrolled: false }]);
   });
 
+  // A due alarm push is fire and forget: nothing waits on an answer, and a
+  // push late enough to wait for a broker is stale (docs/specs/alert.md).
+  it('sends a push another window forwarded on its own Burrow, answering nothing', async () => {
+    const mod = await freshBurrow();
+    const bound = fakeDeps();
+    mod.configureBurrow(bound.deps());
+    bridgeLinkToBurrow(mod, opened!, bound);
+    mod.initBurrow(fakeContext().context);
+    mod.handleBurrowCommand({
+      burrowRequestId: 'rh-0',
+      cmd: 'enroll',
+      params: { relayUrl: 'https://evil.example', password: 'p', label: 'Laptop' },
+    });
+    await waitFor(() => opened!.isPeerBroker());
+    const { BurrowService } = await import('../../lib/src/host/remote/service');
+    const push = vi.spyOn(BurrowService.prototype, 'push');
+
+    const far = fakeWindow();
+    const link = await openFarWindow(far);
+    link.forwardPush('pty-1', 'pnpm build');
+    await waitFor(() => push.mock.calls.length > 0);
+    expect(push).toHaveBeenCalledExactlyOnceWith('pty-1', 'pnpm build');
+
+    // This window's own alert host reaches the same service directly.
+    mod.pushAlert('pty-2', 'cargo test');
+    expect(push).toHaveBeenLastCalledWith('pty-2', 'cargo test');
+    expect(far.results).toEqual([]);
+    push.mockRestore();
+  });
+
+  it('hands a due push to the window that holds the Burrow, and drops it before there is one', async () => {
+    const squat = await otherWindowHoldsTheBurrow();
+    const mod = await freshBurrow();
+    const bound = fakeDeps();
+    mod.configureBurrow(bound.deps());
+    mod.initBurrow(fakeContext().context);
+    // Not contending yet: no service and no broker, and nothing is held for
+    // a role that may settle later.
+    mod.pushAlert('pty-1', 'stale');
+
+    mod.handleBurrowCommand({
+      burrowRequestId: 'rh-1',
+      cmd: 'enroll',
+      params: { relayUrl: 'https://relay.dormouse.sh', password: 'p', label: 'Laptop' },
+    });
+    await waitFor(() => squat.frames.some((frame) => frame.kind === 'command'));
+    mod.pushAlert('pty-1', 'pnpm build');
+    await waitFor(() => squat.frames.some((frame) => frame.kind === 'push'));
+    expect(squat.frames.filter((frame) => frame.kind === 'push'))
+      .toEqual([{ kind: 'push', sessionId: 'pty-1', title: 'pnpm build' }]);
+    expect(bound.posted).toEqual([]);
+  });
+
   it('answers a forwarded command over the link and nowhere else', async () => {
     const mod = await freshBurrow();
     const bound = fakeDeps();
diff --git a/vscode-ext/test/helpers.ts b/vscode-ext/test/helpers.ts
index d198a4461..594d53a6a 100644
--- a/vscode-ext/test/helpers.ts
+++ b/vscode-ext/test/helpers.ts
@@ -127,6 +127,8 @@ export function fakeWindow(
     forwarded: [] as Array<{ payload: BurrowCommand; from: PeerLinkClient }>,
     /** Windows whose sockets closed with commands still outstanding. */
     dropped: [] as PeerLinkClient[],
+    /** Due alarm pushes another window forwarded to this one's Burrow. */
+    pushes: [] as Array<{ sessionId: string; title: string }>,
     /** What came back for commands this window forwarded to its broker. */
     results: [] as BurrowResult[],
     uiEvents: [] as unknown[],
@@ -162,6 +164,7 @@ export function fakeWindow(
         }),
         handleForwardedCommand: (payload, from) => void this.forwarded.push({ payload, from }),
         dropForwardedCommands: (from) => void this.dropped.push(from),
+        handleForwardedPush: (sessionId, title) => void this.pushes.push({ sessionId, title }),
         deliverCommandResult: (payload) => void this.results.push(payload),
         deliverUiEvent: (payload) => void this.uiEvents.push(payload),
         onClientAuthenticated: (client) => void this.joined.push(client),
diff --git a/vscode-ext/test/message-router.test.ts b/vscode-ext/test/message-router.test.ts
index 1da5fe600..44031b2f9 100644
--- a/vscode-ext/test/message-router.test.ts
+++ b/vscode-ext/test/message-router.test.ts
@@ -25,8 +25,8 @@ const wiring = vi.hoisted(() => ({
   burrow: null as BurrowDeps | null,
   /** Every `notifyDirectoryChanged()` the router made. */
   invalidations: 0,
-  /** Every Burrow command the router sent on its own account. */
-  burrowCommands: [] as unknown[],
+  /** Every due push the router's alert host sent. */
+  pushes: [] as Array<[string, string]>,
 }));
 
 vi.mock('../src/peer-link', () => ({
@@ -80,13 +80,18 @@ vi.mock('../src/burrow', () => ({
   dropForwardedCommands: () => {},
   greetPeerWindow: () => {},
   handleForwardedCommand: () => {},
-  handleBurrowCommand: (payload: unknown) => void wiring.burrowCommands.push(payload),
+  handleForwardedPush: () => {},
+  handleBurrowCommand: () => {},
+  pushAlert: (sessionId: string, title: string) => void wiring.pushes.push([sessionId, title]),
   notifyDirectoryChanged: () => {
     wiring.invalidations += 1;
   },
 }));
 
 type RouterModule = typeof import('../src/message-router');
+
+/** A terminal report asking for the human, as `OSC 9` carries it. */
+const REPORT = '\x1b]9;needs input\x07';
 type MirrorModule = typeof import('../src/notepad-volatile');
 
 /** One webview: what it was sent, and a way to make it say something back. */
@@ -129,7 +134,7 @@ beforeEach(async () => {
   wiring.peer = null;
   wiring.burrow = null;
   wiring.invalidations = 0;
-  wiring.burrowCommands = [];
+  wiring.pushes = [];
   ptys.cwd = null;
   ptys.cwdAsked = [];
   ptys.cwdWait = null;
@@ -607,8 +612,6 @@ describe('await requests', () => {
  * disengage a Session another one is showing.
  */
 describe('engagement viewers', () => {
-  const REPORT = '\x1b]9;needs input\x07';
-
   function status(id: string): string | undefined {
     return router.getAlertStates().get(id)?.status;
   }
@@ -707,11 +710,12 @@ describe('engagement viewers', () => {
 });
 
 /**
- * A due spoken alarm or push goes to the webview that owns its Session; with
- * none, a push goes from the host (docs/specs/alert.md → Alarm settings).
+ * The host decides when a ring is spoken or pushed (docs/specs/alert.md →
+ * Alarm settings): speech to the connected webview showing the Session, a push
+ * from here, held back while this VS Code window is in use.
  */
 describe('alarm delivery', () => {
-  const REPORT = '\x1b]9;needs input\x07';
+  const SESSIONS = { 'pty-1': { label: 'pnpm build', overrides: {} } };
 
   beforeEach(() => {
     vi.useFakeTimers();
@@ -721,42 +725,64 @@ describe('alarm delivery', () => {
     vi.useRealTimers();
   });
 
-  it('hands a due delivery to the webview that owns the Session, and no other', () => {
+  it('speaks a due alarm only in the connected webview that shows the Session', () => {
     const other = fakeWebview();
     const owner = fakeWebview();
     const first = router.attachRouter(other.channel);
     const second = router.attachRouter(owner.channel);
     try {
+      other.send({ type: 'dormouse:init' });
+      owner.send({ type: 'dormouse:init' });
       alert(owner, { op: 'initializeSettings', settings: { speakEnabled: true, speakDelayMs: 1_000 } as never });
-      owner.send({ type: 'pty:spawn', id: 'pty-owned', options: { cwd: '/repo' } });
-      ptys.callbacks!.onData('pty-owned', REPORT);
+      owner.send({ type: 'pty:spawn', id: 'pty-1', options: { cwd: '/repo' } });
+      ptys.callbacks!.onData('pty-1', REPORT);
       vi.advanceTimersByTime(1_000);
-      const episodeId = router.getAlertStates().get('pty-owned')!.episode!.id;
-      expect(owner.posted.filter((message) => message.type === 'alert:deliver'))
-        .toEqual([{ type: 'alert:deliver', sink: 'speech', id: 'pty-owned', episodeId }]);
-      expect(other.posted.filter((message) => message.type === 'alert:deliver')).toEqual([]);
+      const episodeId = router.getAlertStates().get('pty-1')!.episode!.id;
+      expect(owner.posted.filter((message) => message.type === 'alert:speak'))
+        .toEqual([{ type: 'alert:speak', id: 'pty-1', episodeId }]);
+      expect(other.posted.filter((message) => message.type === 'alert:speak')).toEqual([]);
     } finally {
       first.dispose();
       second.dispose();
     }
   });
 
-  it('pushes from the host, titled by the command, when no webview owns the Session', () => {
+  it('pushes from the host, titled by the label its view published, after the view is gone', () => {
     const webview = fakeWebview();
     const disposable = router.attachRouter(webview.channel);
-    alert(webview, { op: 'initializeSettings', settings: { speakEnabled: true, pushEnabled: true, pushDelayMs: 1_000 } as never });
-    webview.send({ type: 'pty:spawn', id: 'pty-orphan', options: { cwd: '/repo' } });
-    ptys.callbacks!.onData('pty-orphan', '\x1b]633;E;pnpm build\x07\x1b]633;C\x07');
+    alert(webview, { op: 'initializeSettings', settings: { pushEnabled: true, pushDelayMs: 1_000 } as never });
+    webview.send({ type: 'pty:spawn', id: 'pty-1', options: { cwd: '/repo' } });
+    alert(webview, { op: 'sessions', sessions: SESSIONS });
     // The view goes away; its PTYs live on.
     disposable.dispose();
-    ptys.callbacks!.onData('pty-orphan', REPORT);
-    vi.advanceTimersByTime(60_000);
-    expect(webview.posted.filter((message) => message.type === 'alert:deliver')).toEqual([]);
-    expect(wiring.burrowCommands).toEqual([{
-      burrowRequestId: expect.any(String),
-      cmd: 'push',
-      params: { sessionId: 'pty-orphan', title: 'pnpm build' },
-    }]);
+    ptys.callbacks!.onData('pty-1', REPORT);
+    vi.advanceTimersByTime(1_000);
+    expect(wiring.pushes).toEqual([['pty-1', 'pnpm build']]);
+  });
+
+  it('holds a push back while this VS Code window is focused and active', () => {
+    const moveWindow = (state: { focused: boolean; active?: boolean }) =>
+      router.reportWindowPresence(state as never);
+    const webview = fakeWebview();
+    const disposable = router.attachRouter(webview.channel);
+    try {
+      alert(webview, { op: 'initializeSettings', settings: { pushEnabled: true, pushDelayMs: 1_000 } as never });
+      webview.send({ type: 'pty:spawn', id: 'pty-1', options: { cwd: '/repo' } });
+      moveWindow({ focused: true, active: true });
+      ptys.callbacks!.onData('pty-1', REPORT);
+      vi.advanceTimersByTime(1_000);
+      expect(wiring.pushes).toEqual([]);
+
+      // Focus alone is not presence: an older VS Code reports no `active`.
+      alert(webview, { op: 'dismiss', id: 'pty-1' });
+      ptys.callbacks!.onData('pty-1', 'output');
+      moveWindow({ focused: true });
+      ptys.callbacks!.onData('pty-1', REPORT);
+      vi.advanceTimersByTime(1_000);
+      expect(wiring.pushes).toEqual([['pty-1', 'terminal']]);
+    } finally {
+      disposable.dispose();
+    }
   });
 });
 

From e5f4cfdd02b0e2ac4c7bc320915ee99272134ebc Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 23 Sep 2026 23:13:07 -0700
Subject: [PATCH 11/16] Advertise iTerm2 3.6.6 and keep delivery policy across
 a respawn

- 3.6.6 is the newest iTerm2 whose escape-code additions Dormouse fully
  supports (OSC 9;4 progress, color-scheme reporting); Claude Code now
  reports each turn as a progress cycle, so a turn ending on a pane the
  user isn't engaged with rings "claude finished".
- Color-scheme queries are answered explicitly and classified as
  terminal reports, never input.
- A regression suite replays a recorded Claude Code turn through the real
  host parse site for all four engagement outcomes.
- The delivery scheduler keeps a Session's published policy and label
  through a respawn and drops it only on removal.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwN55bUVmCNmPiX7vHGCVF
---
 docs/specs/alert.md                          |   4 +-
 docs/specs/alert.rationale.md                |   2 +
 docs/specs/terminal-escapes.md               |   5 +-
 docs/specs/terminal-escapes.rationale.md     |   2 +
 lib/src/lib/alert-delivery-scheduler.test.ts |  18 ++-
 lib/src/lib/alert-delivery-scheduler.ts      |  12 +-
 lib/src/lib/alert-engagement.test.ts         | 151 +++++++++++++++++++
 lib/src/lib/alert-manager.ts                 |  36 +++--
 lib/src/lib/terminal-color-scheme.test.ts    |  46 ++++++
 lib/src/lib/terminal-lifecycle.ts            |  27 ++--
 lib/src/lib/terminal-protocol.ts             |   2 +-
 lib/src/lib/terminal-registry.alert.test.ts  |   1 +
 scripts/spec-word-budgets.json               |   4 +-
 standalone/sidecar/pty-core.js               |   2 +-
 standalone/sidecar/pty-core.test.js          |   8 +-
 15 files changed, 285 insertions(+), 35 deletions(-)
 create mode 100644 lib/src/lib/terminal-color-scheme.test.ts

diff --git a/docs/specs/alert.md b/docs/specs/alert.md
index 50282afba..c5ac572d6 100644
--- a/docs/specs/alert.md
+++ b/docs/specs/alert.md
@@ -234,6 +234,8 @@ Sequence syntax lives in `docs/specs/terminal-escapes.md`; what each means here:
 
   **Titles name the running command** — its watch key, else its display command — and fall back to a generic title with none running; the body is `Progress <percent>%`, or none.
 
+  Claude Code runs one cycle per turn under the advertised iTerm2 version, so **a turn ending on an unengaged Session rings `claude finished`** (rationale). Pinned by `a Claude Code turn` in `lib/src/lib/alert-engagement.test.ts`.
+
 Source of truth: the OSC 777 and OSC 99 grammars, parsing, sanitization limits, OSC 99 chunk state, and `applyTerminalEvents` in `lib/src/lib/terminal-protocol.ts`; `createOwnerPtyStream` in `lib/src/host/owner-pty.ts`; `updateProtocolProgress` / `finishProtocolProgressCycle` / `PROGRESS_TITLES` in `lib/src/lib/alert-manager.ts`. Pinned by `silently ends a progress cycle the program abandoned` and `names the running command in a progress %s title` in `lib/src/lib/alert-manager.test.ts`.
 
 ## Command-exit Track
@@ -317,7 +319,7 @@ Rules:
 - **Must deliver at most once per sink per episode**, due at the episode's start plus the Session's delay; a source joining the episode delivers nothing, and the ring clearing consumes what it had pending.
 - **Must recheck at the deadline, and consume a deadline that fails, never retrying it**: **speech only while the Session is not engaged** (Engagement); **push only while no viewer is present**, VS Code's focused, active window counting as one (`docs/specs/vscode.md` → Workspaces; rationale).
 - **Disabling consumes pending work immediately; enabling never replays an episode**, one that began disabled included. Delay edits never move a deadline; speech reads the current voice at engine admission.
-- **Each realm publishes every Session it shows** — Pane label and Workspace overrides — as one `sessions` op replacing its last: membership and override changes at the end of their task, label changes on a `LABEL_PUBLISH_THROTTLE_MS` trailing throttle (rationale), nothing unchanged resent. **The host keeps each Session's last publisher's entry until the Session is removed**, a realm's end included; an unpublished Session uses the defaults.
+- **Each realm publishes every Session it shows** — Pane label and Workspace overrides — as one `sessions` op replacing its last: membership and override changes at the end of their task, label changes on a `LABEL_PUBLISH_THROTTLE_MS` trailing throttle (rationale), nothing unchanged resent. **The host keeps each Session's last publisher's entry until the Session is removed**, through its realm's end and a respawn under its id; an unpublished Session uses the defaults.
 - **A due push goes from the host's own Burrow** (Push notifications), titled by the published label, whether or not a realm still shows the Session; **a due spoken alarm goes to the realm showing it** as `alert:speak`, and with none is not spoken.
 
 Source of truth: `normalizeAlertDeliveryOverrides` / `resolveAlertDeliveryPolicy` in `lib/src/lib/alert-delivery-model.ts`; `createAlertDeliveryScheduler` in `lib/src/lib/alert-delivery-scheduler.ts`; `startAlertDelivery` / `LABEL_PUBLISH_THROTTLE_MS` in `lib/src/lib/alert-delivery.ts`; `getSessionAlertPolicy` in `lib/src/lib/alert-delivery-policy.ts`; `setWorkspaceAlertDelivery` in `lib/src/lib/workspace-store.ts`. Pinned by `lib/src/lib/alert-delivery-scheduler.test.ts`, `lib/src/lib/alert-delivery.test.ts`, and `delivery` in `lib/src/host/alert-host.test.ts`.
diff --git a/docs/specs/alert.rationale.md b/docs/specs/alert.rationale.md
index 07342d6a4..cc56a17c3 100644
--- a/docs/specs/alert.rationale.md
+++ b/docs/specs/alert.rationale.md
@@ -100,6 +100,8 @@
 
 **Why the titles name the command.** The generic `Progress complete` said nothing about which run finished; the watch key is the name the user already knows the pane by, and the watch record is live exactly while a cycle can end.
 
+**Why every Claude turn may ring.** Advertising iTerm2 3.6.6 turns on Claude Code's progress reports, so its turn end is a report completion, and reports are independent of WATCHING. Gating a cycle's end on a watched command was rejected: engagement is what spares the user who is watching, and a user who left wants the turn's end (product decision, 2026-09-23). Recorded the same day (Claude Code 2.1.281, a one-sentence answer): `9;4;3` 47ms after Enter, a frame about every 110ms, `9;4;0` 1.8s after Enter with one trailing frame, then silence until the idle `OSC 99` 60s later. A turn that short never confirms BUSY, so its end rings at once; a longer one is deferred until quiet.
+
 ## Command-exit Track
 
 **Why the minimum runtime is not the inactivity timeout.** The two answer different questions — how long "looking at this pane" lasts, and how short a run the user probably watched. Shared, a user who shortened the timeout to three seconds was rung for every four-second `git status` they turned away from, and one who lengthened it lost exit alerts for every build shorter than the new window (2026-09-23).
diff --git a/docs/specs/terminal-escapes.md b/docs/specs/terminal-escapes.md
index c517d8930..9dbbf20d9 100644
--- a/docs/specs/terminal-escapes.md
+++ b/docs/specs/terminal-escapes.md
@@ -104,6 +104,7 @@ Source of truth: `normalizeExternalUri` in `lib/src/lib/external-links.ts` (pinn
 | `CSI ? ... h` (DECSET) / `CSI ? ... l` (DECRST) | Private-mode set/reset, including mouse tracking and bracketed paste | Observed via xterm.js parser hooks returning false, so xterm still handles the sequence; the mouse-selection store reads `terminal.modes` in a microtask. | [mouse-and-clipboard.md](mouse-and-clipboard.md), `lib/src/lib/mouse-mode-observer.ts` |
 | Kitty keyboard protocol | Disambiguated key-event reporting (CSI u with modifiers, e.g. Shift+Enter distinguishable from Enter) | Enabled by `vtExtensions: { kittyKeyboard: true }` on the xterm.js `Terminal` constructor; xterm.js handles the push/pop (`CSI > u` / `CSI < u`) and the modified key reports. | `lib/src/lib/terminal-lifecycle.ts` |
 | `CSI ? 9001 h/l` (win32-input-mode) | Faithful Win32 `INPUT_RECORD` key reporting for ConPTY apps reading via the Console API — Codex on Windows, which cannot negotiate the kitty protocol there (rationale) | Advertised **only on Windows** (`vtExtensions: { win32InputMode: IS_WINDOWS }`); xterm.js then emits `CSI Vk;Sc;Uc;Kd;Cs;Rc _` key records. **Mutually exclusive with the kitty protocol**, so a per-pane arbiter watches `CSI > … u` / `CSI < … u` — counting nested pushes, honoring the pop count — and toggles the option off while any kitty consumer is on the stack (rationale). | `lib/src/lib/keyboard-protocol-arbiter.ts` |
+| `CSI ? 996 n` / `CSI ? 2031 h/l` | Color-scheme query; change reports on/off | Answered by the owner's xterm.js (`colorSchemeQuery`): `CSI ? 997 ; 1 n` dark, `; 2 n` light, unsolicited on a theme change while 2031 is set — a [terminal reply](#report-filtering-on-the-input-side). Pinned by `lib/src/lib/terminal-color-scheme.test.ts`. | `xtermVtExtensions` in `lib/src/lib/terminal-lifecycle.ts` |
 | `CSI c` | Primary device-attributes query | The owner's ImageAddon answers `CSI ? 62 ; 4 ; 9 ; 22 c`, advertising SIXEL. | [Inline graphics](#inline-graphics) |
 | `CSI 14 t` / `CSI 16 t` / `CSI 18 t` | Window-pixel, cell-pixel, and window-character size queries | Enabled and answered by the owner's xterm.js for image preparation. | [Inline graphics](#inline-graphics) |
 | `CSI ? 80 h/l` | SIXEL scrolling off/on | Observed by ImageAddon; xterm.js continues handling the private mode. | [Inline graphics](#inline-graphics) |
@@ -147,7 +148,9 @@ Unknown CSI sequences pass through to xterm.js, like unknown OSC families, and *
 
 ## iTerm2 identity
 
-Dormouse reports an iTerm2-compatible identity to unlock the iTerm2-style escape codes this spec set supports (rationale). **One compatibility version spans env and device responses**: `ITERM2_COMPAT_VERSION`, currently `3.5.0`, defined twice — in `standalone/sidecar/pty-core.js` and `lib/src/lib/terminal-protocol.ts` — pinned together by `lib/src/lib/mirrored-constants.test.ts`.
+Dormouse reports an iTerm2-compatible identity to unlock the iTerm2-style escape codes this spec set supports (rationale). **One compatibility version spans env and device responses**: `ITERM2_COMPAT_VERSION`, currently `3.6.6`, defined twice — in `standalone/sidecar/pty-core.js` and `lib/src/lib/terminal-protocol.ts` — pinned together by `lib/src/lib/mirrored-constants.test.ts`.
+
+**Must advertise the newest iTerm2 version whose escape-code additions Dormouse all supports** — 3.6.6 added `OSC 9;4` progress and color-scheme reporting, 3.6.7 `OSC 8`'s unsupported `target=` (rationale).
 
 Environment for spawned PTYs:
 
diff --git a/docs/specs/terminal-escapes.rationale.md b/docs/specs/terminal-escapes.rationale.md
index fb9a3041c..3e60a2721 100644
--- a/docs/specs/terminal-escapes.rationale.md
+++ b/docs/specs/terminal-escapes.rationale.md
@@ -76,6 +76,8 @@ Keying this on the disposition rather than on an IIP command list also fixes the
 
 **Why claim to be iTerm2.** Shells, build systems and agent clients gate their richest escape output on a terminal they recognize, and iTerm2 is the identity that unlocks the largest set of the sequences Dormouse actually implements; the fail-inertly rule pays for the ones it also provokes.
 
+**Why 3.6.6, and not newer.** Tools gate features on the version, not just the name: Claude Code 2.1.281 turns on `OSC 9;4` progress only at iTerm2 3.6.6 or later (its version check, read from the binary, 2026-09-23). Recorded the same day under each identity, Claude emitted no progress at 3.5.0; at 3.6.6 it sent `9;4;3` 47ms after Enter and `9;4;0` at turn end, and set DECSET 2031 at startup. iTerm2's changelogs (read 2026-09-23): 3.6.6 (released 2025-11-17) added `OSC 9;4` progress bars, DSR 996/997 with DECSET 2031 dark-mode reporting — xterm.js 6.1's `colorSchemeQuery`, on by default — and `OSC 52` in its DA reply, which Dormouse does not claim and a DA reader only misses. 3.6.7 (built 2026-02-19) adds `OSC 8`'s `target=`, reusing an in-app browser, which Dormouse ignores (the link still opens); 3.6.8 through 3.6.11 add no escape code. 3.7.0 (built 2026-06-08) adds dual-mode `SGR 38:12` colors, `OSC 21337` session status, `OSC 1337` `Button=` and `SetProfileProperty=`, and `OSC 72` drag-and-drop, none of which Dormouse supports. The price, accepted: every Claude turn ending on a Session the user is not engaged with now rings `claude finished` (`docs/specs/alert.md` → Terminal reports).
+
 **Why another terminal's identity is stripped.** A pane inherits the host's environment, and the host inherits whatever launched it. Fedora's `vte.sh` sees `VTE_VERSION` and emits an `OSC 777` notification after every command; `WT_SESSION`, `ConEmuANSI`, `TERM_FEATURES` and the Konsole and Ptyxis versions switch on cargo's `OSC 9;4` progress, so every build rang; `TMUX` / `STY` send tools to a multiplexer that is not there — Codex and Claude Code wrap their notifications in tmux's passthrough; and `CURSOR_TRACE_ID` makes Claude Code believe it runs in Cursor's terminal, which leaves it no notification channel (audit, 2026-09-23). `COLORFGBG` would contradict the background the OSC 11 answer reports.
 
 **Why `COLORTERM` is set even though it is not iTerm2's.** The PTY is spawned as `xterm-256color` with no other depth hint, so env-sniffing tools — `supports-color` and everything built on it — quantize RGB output to the nearest palette entry.
diff --git a/lib/src/lib/alert-delivery-scheduler.test.ts b/lib/src/lib/alert-delivery-scheduler.test.ts
index 0ea30c32c..d8f006f2e 100644
--- a/lib/src/lib/alert-delivery-scheduler.test.ts
+++ b/lib/src/lib/alert-delivery-scheduler.test.ts
@@ -164,9 +164,13 @@ describe('published Sessions', () => {
     expect(sinks()).toEqual(['speech', 'speech']);
   });
 
-  it('keeps a live Session\'s publication past its realm, and forgets a removed one\'s', () => {
+  it.each([
+    ['ringing', () => ring(OTHER)],
+    // Nothing to publish on its way out: its last state was the default.
+    ['answered', () => { ring(OTHER); manager.acknowledge(OTHER, { input: true }); }],
+  ] as const)('keeps a live Session\'s publication past its realm, and forgets one removed %s', (_state, before) => {
     scheduler.publish('main', { [PANE]: session({ pushEnabled: false }), [OTHER]: session({ pushEnabled: false }) });
-    ring(OTHER);
+    before();
     manager.remove(OTHER);
     // The realm is gone, and never published again; a Session reusing the id
     // is not the one it described.
@@ -176,6 +180,16 @@ describe('published Sessions', () => {
     expect(delivered.filter((delivery) => delivery.sink === 'push')).toEqual([{ sink: 'push', id: OTHER, title: 'terminal' }]);
   });
 
+  it('keeps a Session\'s publication through a respawn under its id', () => {
+    // The realm sends a Session again only once its label or overrides change.
+    scheduler.publish('main', { [PANE]: session({ speakEnabled: false }, 'claude') });
+    ring();
+    manager.restart(PANE);
+    ring();
+    vi.advanceTimersByTime(PUSH_MS);
+    expect(delivered).toEqual([{ sink: 'push', id: PANE, title: 'claude' }]);
+  });
+
   it('revalidates what a realm publishes', () => {
     scheduler.publish('main', { [PANE]: session({ speakEnabled: false }) });
     scheduler.publish('main', null);
diff --git a/lib/src/lib/alert-delivery-scheduler.ts b/lib/src/lib/alert-delivery-scheduler.ts
index bd69aa5a7..ffe6ca72a 100644
--- a/lib/src/lib/alert-delivery-scheduler.ts
+++ b/lib/src/lib/alert-delivery-scheduler.ts
@@ -18,7 +18,7 @@ import { DEFAULT_ALERT_SETTINGS, type AlertSettings } from './alert-settings-mod
  */
 
 export interface AlertDeliverySchedulerOptions {
-  manager: Pick<AlertManager, 'onStateChange' | 'has' | 'isEngaged' | 'viewerIds'>;
+  manager: Pick<AlertManager, 'onStateChange' | 'onRemove' | 'isEngaged' | 'viewerIds'>;
   /** A spoken alarm is due, for the realm showing the Session to speak. */
   speak(id: string, episodeId: string): void;
   /** A push is due, titled by the Session's published Pane label. */
@@ -95,7 +95,6 @@ export function createAlertDeliveryScheduler(options: AlertDeliverySchedulerOpti
   }
 
   function onState(id: string, state: AlertState): void {
-    if (!manager.has(id)) published.delete(id);
     const episode = state.episode ?? null;
     const current = episodes.get(id);
     // At most once per sink per episode: a source joining it delivers nothing.
@@ -122,7 +121,12 @@ export function createAlertDeliveryScheduler(options: AlertDeliverySchedulerOpti
     }
   }
 
-  const stop = manager.onStateChange(onState);
+  const stops = [
+    manager.onStateChange(onState),
+    // Only a Session gone for good: a respawn under the same id keeps what its
+    // realm published, which the realm never sends again unchanged.
+    manager.onRemove((id) => void published.delete(id)),
+  ];
 
   return {
     publish(realmId, raw) {
@@ -156,7 +160,7 @@ export function createAlertDeliveryScheduler(options: AlertDeliverySchedulerOpti
     },
 
     dispose() {
-      stop();
+      for (const stop of stops) stop();
       for (const { timers } of episodes.values()) {
         for (const timer of timers.values()) clearTimeout(timer);
       }
diff --git a/lib/src/lib/alert-engagement.test.ts b/lib/src/lib/alert-engagement.test.ts
index 7c2692b81..53111bfff 100644
--- a/lib/src/lib/alert-engagement.test.ts
+++ b/lib/src/lib/alert-engagement.test.ts
@@ -3,6 +3,7 @@ import { AlertManager, type ActivityNotification, type AwaitOutcome } from './al
 import { applyTerminalEvents, TerminalProtocolParser } from './terminal-protocol';
 import { cfg } from '../cfg';
 import { engage, finishCommand, goIdle, leave, runCommand, VIEWER } from './alert-manager-test-utils';
+import { alertedPty, createOwnerPtyStream } from '../host/owner-pty';
 
 /**
  * Engagement (`docs/specs/alert.md` -> Engagement): presence and focus arrive
@@ -329,3 +330,153 @@ describe('walking away from a permission prompt', () => {
     });
   });
 });
+
+/**
+ * One Claude Code 2.1.281 turn, recorded under the iTerm2 3.6.6 identity
+ * (2026-09-23, `claude --model haiku`, a one-sentence answer), which Claude
+ * answers with progress reports: `OSC 9;4;3` 47ms after Enter, a frame about
+ * every 110ms, `OSC 9;4;0` 1.8s after Enter and one trailing frame, then
+ * silence until its idle `OSC 99` 60s later. Replayed as bytes through the
+ * host's parse site and input path; a longer answer only adds frames.
+ */
+describe('a Claude Code turn', () => {
+  const ENTER_AT = 8_236;
+  const RECORDED_TURN_MS = 1_785;
+  const LONG_TURN_MS = 8_000;
+  const IDLE_NOTICE_AFTER_MS = 60_011;
+  const QUIET_MS = cfg.alert.mightNeedAttention + cfg.alert.needsAttentionConfirm;
+  const IDLE_NOTICE = '\x1b]99;i=3319:d=0:p=title;Claude Code\x07\x1b]99;i=3319:p=body;Claude is waiting for your input\x07\x1b]99;i=3319:d=1:a=focus;\x07';
+  const FINISHED: ActivityNotification = { source: 'OSC 9;4', title: 'claude finished', body: null };
+
+  interface Step { at: number; step: () => void }
+  let emit: (at: number, data: string) => Step;
+  let key: (at: number, data: string) => Step;
+  let episodes: Set<string>;
+
+  beforeEach(() => {
+    const stream = createOwnerPtyStream(PANE, {
+      alerts: manager,
+      colorProvider: () => null,
+      onToolEvents() {},
+      onSemanticEvents() {},
+      writeResponse() {},
+      onChunk() {},
+    });
+    const pty = alertedPty(manager, { write() {}, resize() {} });
+    emit = (at, data) => ({ at, step: () => stream.write(data) });
+    key = (at, data) => ({ at, step: () => pty.write(PANE, data, { userInput: true }) });
+    episodes = new Set();
+    manager.onStateChange((id, state) => { if (id === PANE && state.episode) episodes.add(state.episode.id); });
+  });
+
+  const at = (ms: number, step: () => void): Step => ({ at: ms, step });
+
+  /** The turn's bytes and keystrokes: the prompt typed and submitted, then Claude working for `turnMs`. */
+  function turn(turnMs: number): Step[] {
+    const endAt = ENTER_AT + turnMs;
+    const steps = [
+      // Shell integration names the command; Claude paints and clears any stale progress.
+      emit(0, '\x1b]633;E;claude\x07\x1b]633;C\x07'),
+      emit(358, 'Claude Code'),
+      emit(715, '\x1b]9;4;0;\x07'),
+      emit(945, '> '),
+      key(ENTER_AT, '\r'),
+      emit(ENTER_AT + 47, '\x1b]9;4;3;\x07'),
+      emit(endAt, '\x1b]9;4;0;\x07'),
+      emit(endAt + 3, 'Worked for 1s'),
+      emit(endAt + IDLE_NOTICE_AFTER_MS, IDLE_NOTICE),
+    ];
+    // The prompt, a key every 42ms, each echoed.
+    for (let t = 6_003; t < 7_900; t += 42) steps.push(key(t, 'x'), emit(t + 12, 'x'));
+    for (let t = ENTER_AT + 49; t < endAt; t += 110) steps.push(emit(t, 'frame'));
+    return steps;
+  }
+
+  /** Runs `steps` in time order (ties in list order), advancing the clock between them. */
+  function player(steps: Step[]): { to(ms: number): void } {
+    const queue = [...steps].sort((a, b) => a.at - b.at);
+    let now = 0;
+    return {
+      to(ms) {
+        while (queue.length > 0 && queue[0].at <= ms) {
+          const next = queue.shift()!;
+          vi.advanceTimersByTime(next.at - now);
+          now = next.at;
+          next.step();
+        }
+        vi.advanceTimersByTime(ms - now);
+        now = ms;
+      },
+    };
+  }
+
+  it('holds the finish while the user watches, and drops it once they type', () => {
+    const endAt = ENTER_AT + RECORDED_TURN_MS;
+    const typedAt = endAt + 2_000;
+    const run = player([
+      at(0, () => engage(manager, PANE)),
+      ...turn(RECORDED_TURN_MS),
+      key(typedAt, 'x'),
+      at(typedAt + cfg.alert.inactivityTimeout, () => goIdle(manager, PANE)),
+    ]);
+
+    run.to(typedAt - 1);
+    expect(manager.getState(PANE)).toMatchObject({ todo: false, notification: null });
+    run.to(endAt + IDLE_NOTICE_AFTER_MS - 1);
+    expect(episodes.size).toBe(0);
+    expect(manager.getState(PANE)).toMatchObject({ todo: false, notification: null });
+  });
+
+  it.each([
+    ['at the end of the recorded turn, too short to look busy', RECORDED_TURN_MS, 0],
+    ['once a longer turn has gone quiet', LONG_TURN_MS, 3 + QUIET_MS],
+  ] as const)('rings "claude finished" once when the user moved away mid-turn: %s', (_when, turnMs, afterEndMs) => {
+    const ringAt = ENTER_AT + turnMs + afterEndMs;
+    const run = player([
+      at(0, () => engage(manager, PANE)),
+      at(ENTER_AT + 600, () => engage(manager, OTHER)),
+      ...turn(turnMs),
+    ]);
+
+    run.to(ringAt - 1);
+    expect(ringing(PANE)).toBe(false);
+    run.to(ringAt);
+    expect(manager.getState(PANE)).toMatchObject({ status: 'ALERT_RINGING', todo: true, notification: FINISHED });
+    run.to(ringAt + 30_000);
+    expect(episodes.size).toBe(1);
+  });
+
+  it('records the idle notice after a click on the ring as TODO, without a second summons', () => {
+    const endAt = ENTER_AT + RECORDED_TURN_MS;
+    const clickAt = endAt + 5_000;
+    const run = player([
+      at(0, () => engage(manager, PANE)),
+      at(ENTER_AT + 600, () => engage(manager, OTHER)),
+      ...turn(RECORDED_TURN_MS),
+      at(clickAt, () => { engage(manager, PANE); manager.acknowledge(PANE, { input: false }); }),
+      at(clickAt + cfg.alert.inactivityTimeout, () => goIdle(manager, PANE)),
+    ]);
+
+    run.to(endAt + IDLE_NOTICE_AFTER_MS);
+    expect(ringing(PANE)).toBe(false);
+    expect(manager.getState(PANE)).toMatchObject({
+      todo: true,
+      notification: { source: 'OSC 99', title: 'Claude Code', body: 'Claude is waiting for your input' },
+    });
+    expect(episodes.size).toBe(1);
+  });
+
+  it('rings once the user, still focused on the pane, has gone idle', () => {
+    const idleAt = ENTER_AT + cfg.alert.inactivityTimeout;
+    const run = player([
+      at(0, () => engage(manager, PANE)),
+      ...turn(RECORDED_TURN_MS),
+      at(idleAt, () => goIdle(manager, PANE)),
+    ]);
+
+    run.to(idleAt - 1);
+    expect(manager.getState(PANE)).toMatchObject({ todo: false, notification: null });
+    run.to(idleAt);
+    expect(manager.getState(PANE)).toMatchObject({ status: 'ALERT_RINGING', todo: true, notification: FINISHED });
+  });
+});
diff --git a/lib/src/lib/alert-manager.ts b/lib/src/lib/alert-manager.ts
index b6615be38..7251655ce 100644
--- a/lib/src/lib/alert-manager.ts
+++ b/lib/src/lib/alert-manager.ts
@@ -314,6 +314,7 @@ export class AlertManager {
   /** Each present viewer's focus. An absent viewer engages nothing, so it is not kept. */
   private viewers = new Map<string, string | null>();
   private listeners = new Set<(id: string, state: AlertState) => void>();
+  private removeListeners = new Set<(id: string) => void>();
   private lastEmitted = new Map<string, AlertState>();
   private watchedCommands = new Set<string>();
   /** Helper Sessions alert no one until promotion (docs/specs/alert.md → Pane
@@ -367,6 +368,15 @@ export class AlertManager {
     return () => this.listeners.delete(listener);
   }
 
+  /**
+   * A Session gone for good: every `remove`, whatever state it left, and never
+   * a `restart`, whose Session goes on under the same id.
+   */
+  onRemove(listener: (id: string) => void): () => void {
+    this.removeListeners.add(listener);
+    return () => this.removeListeners.delete(listener);
+  }
+
   // --- Feed PTY events ---
 
   onData(id: string): void {
@@ -1270,6 +1280,21 @@ export class AlertManager {
 
   /** Completely remove alert state for a PTY (used when PTY is destroyed) */
   remove(id: string): void {
+    this.discard(id);
+    for (const listener of this.removeListeners) listener(id);
+  }
+
+  /**
+   * A new PTY generation under `id`: what the old one left goes as on
+   * `remove`, but no tombstone, since the output about to arrive is the new
+   * Session's own, and no removal, since the Session lives on.
+   */
+  restart(id: string): void {
+    this.discard(id);
+    this.removed.delete(id);
+  }
+
+  private discard(id: string): void {
     this.removed.add(id);
     // Nobody parked here has anything left to wait for.
     this.settleWaiters(id, 'died');
@@ -1288,16 +1313,6 @@ export class AlertManager {
     this.helpers.delete(id);
   }
 
-  /**
-   * A new PTY generation under `id`: what the old one left goes as on
-   * `remove`, but no tombstone, since the output about to arrive is the new
-   * Session's own.
-   */
-  restart(id: string): void {
-    this.remove(id);
-    this.removed.delete(id);
-  }
-
   /**
    * Seed alert state from a persisted session (cold-start restore). Only the
    * TODO reminder and its notification detail survive a restart — WATCHING is
@@ -1342,6 +1357,7 @@ export class AlertManager {
     this.claimants.clear();
     this.viewers.clear();
     this.listeners.clear();
+    this.removeListeners.clear();
     this.lastEmitted.clear();
   }
 
diff --git a/lib/src/lib/terminal-color-scheme.test.ts b/lib/src/lib/terminal-color-scheme.test.ts
new file mode 100644
index 000000000..618b6ff02
--- /dev/null
+++ b/lib/src/lib/terminal-color-scheme.test.ts
@@ -0,0 +1,46 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { Terminal } from '@xterm/xterm';
+import { xtermVtExtensions } from './terminal-lifecycle';
+import { inputIsReplayTerminalReport } from './terminal-report-filter';
+
+/**
+ * The advertised iTerm2 version promises dark-mode reporting
+ * (`docs/specs/terminal-escapes.md` -> iTerm2 identity). A real xterm.js with
+ * Dormouse's extensions answers the query, and the answer is a terminal reply
+ * on the input side, never a keystroke.
+ */
+async function colorSchemeReply(theme: { background: string; foreground: string }): Promise<string[]> {
+  const terminal = new Terminal({ allowProposedApi: true, theme, vtExtensions: xtermVtExtensions() });
+  // xterm.js answers from its theme service, which exists only once opened.
+  terminal.open(document.body.appendChild(document.createElement('div')));
+  const replies: string[] = [];
+  terminal.onData((data) => replies.push(data));
+  await new Promise<void>((resolve) => terminal.write('\x1b[?996n', resolve));
+  terminal.dispose();
+  return replies;
+}
+
+describe('color-scheme query (DSR 996)', () => {
+  // `open()` needs a media query and a 2D canvas, which jsdom lacks.
+  beforeEach(() => {
+    vi.stubGlobal('matchMedia', () => ({ matches: false, addEventListener() {}, removeEventListener() {}, addListener() {}, removeListener() {} }));
+    const context = new Proxy({}, { get: (_target, key) => (key === 'measureText' ? () => ({ width: 8 }) : () => {}) });
+    vi.spyOn(HTMLCanvasElement.prototype, 'getContext').mockReturnValue(context as CanvasRenderingContext2D);
+  });
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+  });
+
+  it.each([
+    ['dark', { background: '#1e1e1e', foreground: '#d4d4d4' }, '\x1b[?997;1n'],
+    ['light', { background: '#ffffff', foreground: '#333333' }, '\x1b[?997;2n'],
+  ] as const)('answers a %s theme with a reply the input filter treats as a terminal report', async (_scheme, theme, expected) => {
+    const replies = await colorSchemeReply(theme);
+    expect(replies).toEqual([expected]);
+    expect(inputIsReplayTerminalReport(expected)).toBe(true);
+  });
+});
diff --git a/lib/src/lib/terminal-lifecycle.ts b/lib/src/lib/terminal-lifecycle.ts
index 838ab965e..cafdb4689 100644
--- a/lib/src/lib/terminal-lifecycle.ts
+++ b/lib/src/lib/terminal-lifecycle.ts
@@ -1,7 +1,7 @@
 import { clearToolAnnounce } from './tool-announce-store';
 import { clearToolDirty } from './tool-dirty-store';
 import { serializeTransferTerminal, type TerminalGrid } from './terminal-transfer';
-import { Terminal, type IBufferRange } from '@xterm/xterm';
+import { Terminal, type IBufferRange, type ITerminalOptions } from '@xterm/xterm';
 import { FitAddon } from '@xterm/addon-fit';
 import { SerializeAddon } from '@xterm/addon-serialize';
 import { ImageAddon, type IImageAddonOptions } from '@xterm/addon-image';
@@ -136,6 +136,22 @@ function readDisplayTextFromBuffer(terminal: Terminal, range: IBufferRange): str
   }
 }
 
+/**
+ * The negotiated VT extensions every terminal offers. kittyKeyboard
+ * disambiguates Shift+Enter from Enter for TUIs that read raw VT (Claude Code
+ * everywhere; Codex on macOS/Linux). win32InputMode covers Windows TUIs that
+ * read via the Console API behind ConPTY (Codex), which can't negotiate the
+ * kitty protocol there: when conhost enables it (CSI ? 9001 h), xterm sends
+ * faithful Win32 INPUT_RECORD key events so Shift+Enter and Ctrl+J reach the
+ * app intact. Both are opt-in/negotiated, so they coexist — each program turns
+ * on whichever it understands. colorSchemeQuery answers DSR 996 and DECSET
+ * 2031, which the advertised iTerm2 version promises
+ * (docs/specs/terminal-escapes.md -> iTerm2 identity).
+ */
+export function xtermVtExtensions(): ITerminalOptions['vtExtensions'] {
+  return { kittyKeyboard: true, win32InputMode: IS_WINDOWS, colorSchemeQuery: true };
+}
+
 function createXtermHost(grid?: TerminalGrid): { terminal: Terminal; fit: FitAddon; serialize: SerializeAddon; element: HTMLDivElement } {
   const styles = getComputedStyle(document.body);
   const editorFontSize = parseInt(styles.getPropertyValue('--vscode-editor-font-size'), 10) || 12;
@@ -149,14 +165,7 @@ function createXtermHost(grid?: TerminalGrid): { terminal: Terminal; fit: FitAdd
     fontFamily: editorFontFamily,
     cursorBlink: cfg.terminal.cursorBlink,
     theme,
-    // kittyKeyboard disambiguates Shift+Enter from Enter for TUIs that read
-    // raw VT (Claude Code everywhere; Codex on macOS/Linux). win32InputMode
-    // covers Windows TUIs that read via the Console API behind ConPTY (Codex),
-    // which can't negotiate the kitty protocol there: when conhost enables it
-    // (CSI ? 9001 h), xterm sends faithful Win32 INPUT_RECORD key events so
-    // Shift+Enter and Ctrl+J reach the app intact. Both are opt-in/negotiated,
-    // so they coexist — each program turns on whichever it understands.
-    vtExtensions: { kittyKeyboard: true, win32InputMode: IS_WINDOWS },
+    vtExtensions: xtermVtExtensions(),
     linkHandler: {
       activate: (event, uri, range) => {
         event.preventDefault();
diff --git a/lib/src/lib/terminal-protocol.ts b/lib/src/lib/terminal-protocol.ts
index 0697af3b5..a834ae3c0 100644
--- a/lib/src/lib/terminal-protocol.ts
+++ b/lib/src/lib/terminal-protocol.ts
@@ -109,7 +109,7 @@ const TERMINAL_BELL_NOTIFICATION: ActivityNotification = { source: 'BEL', title:
 // Mirrors ITERM2_COMPAT_VERSION in standalone/sidecar/pty-core.js — pinned by
 // mirrored-constants.test.ts (terminal-escapes.md: one compatibility version
 // across env and device responses).
-export const ITERM2_COMPAT_VERSION = '3.5.0';
+export const ITERM2_COMPAT_VERSION = '3.6.6';
 export const ITERM2_DEVICE_ATTRIBUTES_RESPONSE = `\x1bP>|iTerm2 ${ITERM2_COMPAT_VERSION}\x1b\\`;
 
 export class TerminalProtocolParser {
diff --git a/lib/src/lib/terminal-registry.alert.test.ts b/lib/src/lib/terminal-registry.alert.test.ts
index eee711ca7..733023255 100644
--- a/lib/src/lib/terminal-registry.alert.test.ts
+++ b/lib/src/lib/terminal-registry.alert.test.ts
@@ -870,6 +870,7 @@ describe('terminal-registry alert behavior', () => {
     ['kitty keyboard query reply', '\x1b[?0u'],
     ['kitty keyboard flags reply', '\x1b[?31u'],
     ['kitty support probe replies', '\x1b[?0u\x1b[?1;2c'],
+    ['color-scheme report', '\x1b[?997;1n'],
     ['focus report', '\x1b[I'],
     ['combined replies', '\x1bP1$r0m\x1b\\\x1b[?1;2c'],
     ['SGR hover report', '\x1b[<35;10;20M'],
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 67c5063fc..c76b6e7fc 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -2,7 +2,7 @@
   "AGENTS.md": 3400,
   "SECURITY.md": 200,
   "SELF_HOST.md": 6100,
-  "docs/specs/alert.md": 7900,
+  "docs/specs/alert.md": 7950,
   "docs/specs/auto-update.md": 1150,
   "docs/specs/deploy.md": 1900,
   "docs/specs/dor-browser.md": 4550,
@@ -28,7 +28,7 @@
   "docs/specs/shortcuts.md": 1150,
   "docs/specs/standalone.md": 11900,
   "docs/specs/terminal-context.md": 1050,
-  "docs/specs/terminal-escapes.md": 3900,
+  "docs/specs/terminal-escapes.md": 4000,
   "docs/specs/terminal-state.md": 2500,
   "docs/specs/theme.md": 2200,
   "docs/specs/tiling-engine.md": 4650,
diff --git a/standalone/sidecar/pty-core.js b/standalone/sidecar/pty-core.js
index b6eedfe82..c32ae7c98 100644
--- a/standalone/sidecar/pty-core.js
+++ b/standalone/sidecar/pty-core.js
@@ -27,7 +27,7 @@ const LOGIN_ARG_UNSUPPORTED_SHELLS = new Set(['csh', 'tcsh']);
 // Mirrors ITERM2_COMPAT_VERSION in lib/src/lib/terminal-protocol.ts — pinned by
 // lib/src/lib/mirrored-constants.test.ts (terminal-escapes.md: one
 // compatibility version across env and device responses).
-const ITERM2_COMPAT_VERSION = '3.5.0';
+const ITERM2_COMPAT_VERSION = '3.6.6';
 
 // bash flags that merely select an interactive and/or login shell. When the args
 // are only these, OSC 633 injection can safely replace them: it spawns an
diff --git a/standalone/sidecar/pty-core.test.js b/standalone/sidecar/pty-core.test.js
index 2a2f24c6e..55a6dcdc3 100644
--- a/standalone/sidecar/pty-core.test.js
+++ b/standalone/sidecar/pty-core.test.js
@@ -47,9 +47,9 @@ test('resolveSpawnConfig uses POSIX shell and home defaults', () => {
   assert.equal(config.cols, 80);
   assert.equal(config.rows, 30);
   assert.equal(config.env.TERM_PROGRAM, 'iTerm.app');
-  assert.equal(config.env.TERM_PROGRAM_VERSION, '3.5.0');
+  assert.equal(config.env.TERM_PROGRAM_VERSION, '3.6.6');
   assert.equal(config.env.LC_TERMINAL, 'iTerm2');
-  assert.equal(config.env.LC_TERMINAL_VERSION, '3.5.0');
+  assert.equal(config.env.LC_TERMINAL_VERSION, '3.6.6');
   assert.equal(config.env.COLORTERM, 'truecolor');
   assert.deepEqual(config.shellArgs, ['-l']);
 });
@@ -320,9 +320,9 @@ test('resolveSpawnConfig uses Windows shell and profile defaults', () => {
   assert.equal(config.cwd, 'C:\\Users\\tester');
   assert.equal(config.cwdWarning, null);
   assert.equal(config.env.TERM_PROGRAM, 'iTerm.app');
-  assert.equal(config.env.TERM_PROGRAM_VERSION, '3.5.0');
+  assert.equal(config.env.TERM_PROGRAM_VERSION, '3.6.6');
   assert.equal(config.env.LC_TERMINAL, 'iTerm2');
-  assert.equal(config.env.LC_TERMINAL_VERSION, '3.5.0');
+  assert.equal(config.env.LC_TERMINAL_VERSION, '3.6.6');
   assert.equal(config.env.COLORTERM, 'truecolor');
   assert.deepEqual(config.shellArgs, []);
 });

From 287e8330ee3182354b54cae8398871264c564748 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Wed, 23 Sep 2026 23:25:05 -0700
Subject: [PATCH 12/16] State why 3.6.6 precisely, and share the timeline test
 runner

- The identity rule advertises the lowest iTerm2 version that unlocks the
  version-gated behavior Dormouse supports, never one whose additions it
  would mishandle; the recorded Claude turn is described once, in its test.
- One step runner and episode collector serve the engagement and manager
  tests; the VT extension options live in their own module.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwN55bUVmCNmPiX7vHGCVF
---
 docs/specs/alert.md                       |   4 +-
 docs/specs/alert.rationale.md             |   2 +-
 docs/specs/terminal-escapes.md            |   8 +-
 docs/specs/terminal-escapes.rationale.md  |   2 +-
 lib/src/lib/alert-engagement.test.ts      | 114 ++++++++++------------
 lib/src/lib/alert-manager-test-utils.ts   |   9 ++
 lib/src/lib/alert-manager.test.ts         |  13 +--
 lib/src/lib/terminal-color-scheme.test.ts |  14 +--
 lib/src/lib/terminal-lifecycle.ts         |  19 +---
 lib/src/lib/xterm-options.ts              |  18 ++++
 10 files changed, 95 insertions(+), 108 deletions(-)
 create mode 100644 lib/src/lib/xterm-options.ts

diff --git a/docs/specs/alert.md b/docs/specs/alert.md
index c5ac572d6..67c91138e 100644
--- a/docs/specs/alert.md
+++ b/docs/specs/alert.md
@@ -234,9 +234,7 @@ Sequence syntax lives in `docs/specs/terminal-escapes.md`; what each means here:
 
   **Titles name the running command** — its watch key, else its display command — and fall back to a generic title with none running; the body is `Progress <percent>%`, or none.
 
-  Claude Code runs one cycle per turn under the advertised iTerm2 version, so **a turn ending on an unengaged Session rings `claude finished`** (rationale). Pinned by `a Claude Code turn` in `lib/src/lib/alert-engagement.test.ts`.
-
-Source of truth: the OSC 777 and OSC 99 grammars, parsing, sanitization limits, OSC 99 chunk state, and `applyTerminalEvents` in `lib/src/lib/terminal-protocol.ts`; `createOwnerPtyStream` in `lib/src/host/owner-pty.ts`; `updateProtocolProgress` / `finishProtocolProgressCycle` / `PROGRESS_TITLES` in `lib/src/lib/alert-manager.ts`. Pinned by `silently ends a progress cycle the program abandoned` and `names the running command in a progress %s title` in `lib/src/lib/alert-manager.test.ts`.
+Source of truth: the OSC 777 and OSC 99 grammars, parsing, sanitization limits, OSC 99 chunk state, and `applyTerminalEvents` in `lib/src/lib/terminal-protocol.ts`; `createOwnerPtyStream` in `lib/src/host/owner-pty.ts`; `updateProtocolProgress` / `finishProtocolProgressCycle` / `PROGRESS_TITLES` in `lib/src/lib/alert-manager.ts`. Pinned by `silently ends a progress cycle the program abandoned` and `names the running command in a progress %s title` in `lib/src/lib/alert-manager.test.ts`; `a Claude Code turn` in `lib/src/lib/alert-engagement.test.ts`.
 
 ## Command-exit Track
 
diff --git a/docs/specs/alert.rationale.md b/docs/specs/alert.rationale.md
index cc56a17c3..2a25906ca 100644
--- a/docs/specs/alert.rationale.md
+++ b/docs/specs/alert.rationale.md
@@ -100,7 +100,7 @@
 
 **Why the titles name the command.** The generic `Progress complete` said nothing about which run finished; the watch key is the name the user already knows the pane by, and the watch record is live exactly while a cycle can end.
 
-**Why every Claude turn may ring.** Advertising iTerm2 3.6.6 turns on Claude Code's progress reports, so its turn end is a report completion, and reports are independent of WATCHING. Gating a cycle's end on a watched command was rejected: engagement is what spares the user who is watching, and a user who left wants the turn's end (product decision, 2026-09-23). Recorded the same day (Claude Code 2.1.281, a one-sentence answer): `9;4;3` 47ms after Enter, a frame about every 110ms, `9;4;0` 1.8s after Enter with one trailing frame, then silence until the idle `OSC 99` 60s later. A turn that short never confirms BUSY, so its end rings at once; a longer one is deferred until quiet.
+**Why every Claude turn may ring.** Advertising iTerm2 3.6.6 turns on Claude Code's progress reports, one cycle per turn (the recorded turn, `a Claude Code turn` in `lib/src/lib/alert-engagement.test.ts`), so its turn end is a report completion, and reports are independent of WATCHING. Gating a cycle's end on a watched command was rejected: engagement is what spares the user who is watching, and a user who left wants the turn's end (product decision, 2026-09-23).
 
 ## Command-exit Track
 
diff --git a/docs/specs/terminal-escapes.md b/docs/specs/terminal-escapes.md
index 9dbbf20d9..b3ca94556 100644
--- a/docs/specs/terminal-escapes.md
+++ b/docs/specs/terminal-escapes.md
@@ -102,9 +102,9 @@ Source of truth: `normalizeExternalUri` in `lib/src/lib/external-links.ts` (pinn
 |---|---|---|---|
 | `CSI > q` | iTerm2 extended device-attributes query | Answered `DCS > \| iTerm2 <version> ST` at the PTY boundary and stripped, never forwarded to xterm.js. Both `ESC [ > q` and the C1 `U+009B > q` are recognized, **in ground text only** (rationale). | [iTerm2 identity](#iterm2-identity) |
 | `CSI ? ... h` (DECSET) / `CSI ? ... l` (DECRST) | Private-mode set/reset, including mouse tracking and bracketed paste | Observed via xterm.js parser hooks returning false, so xterm still handles the sequence; the mouse-selection store reads `terminal.modes` in a microtask. | [mouse-and-clipboard.md](mouse-and-clipboard.md), `lib/src/lib/mouse-mode-observer.ts` |
-| Kitty keyboard protocol | Disambiguated key-event reporting (CSI u with modifiers, e.g. Shift+Enter distinguishable from Enter) | Enabled by `vtExtensions: { kittyKeyboard: true }` on the xterm.js `Terminal` constructor; xterm.js handles the push/pop (`CSI > u` / `CSI < u`) and the modified key reports. | `lib/src/lib/terminal-lifecycle.ts` |
+| Kitty keyboard protocol | Disambiguated key-event reporting (CSI u with modifiers, e.g. Shift+Enter distinguishable from Enter) | Enabled by `vtExtensions: { kittyKeyboard: true }` on the xterm.js `Terminal` constructor; xterm.js handles the push/pop (`CSI > u` / `CSI < u`) and the modified key reports. | `xtermVtExtensions` in `lib/src/lib/xterm-options.ts` |
 | `CSI ? 9001 h/l` (win32-input-mode) | Faithful Win32 `INPUT_RECORD` key reporting for ConPTY apps reading via the Console API — Codex on Windows, which cannot negotiate the kitty protocol there (rationale) | Advertised **only on Windows** (`vtExtensions: { win32InputMode: IS_WINDOWS }`); xterm.js then emits `CSI Vk;Sc;Uc;Kd;Cs;Rc _` key records. **Mutually exclusive with the kitty protocol**, so a per-pane arbiter watches `CSI > … u` / `CSI < … u` — counting nested pushes, honoring the pop count — and toggles the option off while any kitty consumer is on the stack (rationale). | `lib/src/lib/keyboard-protocol-arbiter.ts` |
-| `CSI ? 996 n` / `CSI ? 2031 h/l` | Color-scheme query; change reports on/off | Answered by the owner's xterm.js (`colorSchemeQuery`): `CSI ? 997 ; 1 n` dark, `; 2 n` light, unsolicited on a theme change while 2031 is set — a [terminal reply](#report-filtering-on-the-input-side). Pinned by `lib/src/lib/terminal-color-scheme.test.ts`. | `xtermVtExtensions` in `lib/src/lib/terminal-lifecycle.ts` |
+| `CSI ? 996 n` / `CSI ? 2031 h/l` | Color-scheme query; change reports on/off | Answered by the owner's xterm.js (`colorSchemeQuery`): `CSI ? 997 ; 1 n` dark, `; 2 n` light, unsolicited on a theme change while 2031 is set — a [terminal reply](#report-filtering-on-the-input-side). Pinned by `lib/src/lib/terminal-color-scheme.test.ts`, the reply's filtering by `color-scheme report` in `lib/src/lib/terminal-registry.alert.test.ts`. | `xtermVtExtensions` in `lib/src/lib/xterm-options.ts` |
 | `CSI c` | Primary device-attributes query | The owner's ImageAddon answers `CSI ? 62 ; 4 ; 9 ; 22 c`, advertising SIXEL. | [Inline graphics](#inline-graphics) |
 | `CSI 14 t` / `CSI 16 t` / `CSI 18 t` | Window-pixel, cell-pixel, and window-character size queries | Enabled and answered by the owner's xterm.js for image preparation. | [Inline graphics](#inline-graphics) |
 | `CSI ? 80 h/l` | SIXEL scrolling off/on | Observed by ImageAddon; xterm.js continues handling the private mode. | [Inline graphics](#inline-graphics) |
@@ -150,8 +150,6 @@ Unknown CSI sequences pass through to xterm.js, like unknown OSC families, and *
 
 Dormouse reports an iTerm2-compatible identity to unlock the iTerm2-style escape codes this spec set supports (rationale). **One compatibility version spans env and device responses**: `ITERM2_COMPAT_VERSION`, currently `3.6.6`, defined twice — in `standalone/sidecar/pty-core.js` and `lib/src/lib/terminal-protocol.ts` — pinned together by `lib/src/lib/mirrored-constants.test.ts`.
 
-**Must advertise the newest iTerm2 version whose escape-code additions Dormouse all supports** — 3.6.6 added `OSC 9;4` progress and color-scheme reporting, 3.6.7 `OSC 8`'s unsupported `target=` (rationale).
-
 Environment for spawned PTYs:
 
 | Variable | Value |
@@ -162,7 +160,7 @@ Environment for spawned PTYs:
 | `LC_TERMINAL_VERSION` | the same compatibility version |
 | `COLORTERM` | `truecolor` — a color-*depth* signal, **independent** of the light/dark *background* detection the OSC color queries above drive, and not iTerm2-specific (rationale) |
 
-**Never advertise** feature-specific support before the behavior exists; the device answer's shape is in [Supported CSI](#supported-csi).
+**Must advertise the lowest iTerm2 version that unlocks every version-gated behavior Dormouse supports** — today Claude Code's `OSC 9;4` progress, gated at 3.6.6 — **and never a version adding sequences that programs would then send and Dormouse mishandles** (rationale). **Never advertise** feature-specific support before the behavior exists; the device answer's shape is in [Supported CSI](#supported-csi).
 
 **Must strip another terminal's identity from the inherited environment before setting Dormouse's** — its session, version, and multiplexer variables — so a tool never drives a terminal that is not there (rationale). Source of truth: `FOREIGN_TERMINAL_ENV` in `standalone/sidecar/pty-core.js`, pinned by `standalone/sidecar/pty-core.test.js`.
 
diff --git a/docs/specs/terminal-escapes.rationale.md b/docs/specs/terminal-escapes.rationale.md
index 3e60a2721..20a273c8d 100644
--- a/docs/specs/terminal-escapes.rationale.md
+++ b/docs/specs/terminal-escapes.rationale.md
@@ -76,7 +76,7 @@ Keying this on the disposition rather than on an IIP command list also fixes the
 
 **Why claim to be iTerm2.** Shells, build systems and agent clients gate their richest escape output on a terminal they recognize, and iTerm2 is the identity that unlocks the largest set of the sequences Dormouse actually implements; the fail-inertly rule pays for the ones it also provokes.
 
-**Why 3.6.6, and not newer.** Tools gate features on the version, not just the name: Claude Code 2.1.281 turns on `OSC 9;4` progress only at iTerm2 3.6.6 or later (its version check, read from the binary, 2026-09-23). Recorded the same day under each identity, Claude emitted no progress at 3.5.0; at 3.6.6 it sent `9;4;3` 47ms after Enter and `9;4;0` at turn end, and set DECSET 2031 at startup. iTerm2's changelogs (read 2026-09-23): 3.6.6 (released 2025-11-17) added `OSC 9;4` progress bars, DSR 996/997 with DECSET 2031 dark-mode reporting — xterm.js 6.1's `colorSchemeQuery`, on by default — and `OSC 52` in its DA reply, which Dormouse does not claim and a DA reader only misses. 3.6.7 (built 2026-02-19) adds `OSC 8`'s `target=`, reusing an in-app browser, which Dormouse ignores (the link still opens); 3.6.8 through 3.6.11 add no escape code. 3.7.0 (built 2026-06-08) adds dual-mode `SGR 38:12` colors, `OSC 21337` session status, `OSC 1337` `Button=` and `SetProfileProperty=`, and `OSC 72` drag-and-drop, none of which Dormouse supports. The price, accepted: every Claude turn ending on a Session the user is not engaged with now rings `claude finished` (`docs/specs/alert.md` → Terminal reports).
+**Why 3.6.6, and not newer.** Tools gate features on the version, not just the name: Claude Code 2.1.281 turns on `OSC 9;4` progress only at iTerm2 3.6.6 or later (its version check, read from the binary, 2026-09-23). Recorded the same day under each identity, Claude emitted no progress at 3.5.0; at 3.6.6 it ran one cycle per turn (the recorded turn, `a Claude Code turn` in `lib/src/lib/alert-engagement.test.ts`) and set DECSET 2031 at startup. iTerm2's changelogs (read 2026-09-23): 3.6.6 (released 2025-11-17) added `OSC 9;4` progress bars, DSR 996/997 with DECSET 2031 dark-mode reporting — xterm.js 6.1's `colorSchemeQuery`, on by default — and `OSC 52` in its DA reply, which Dormouse does not claim and a DA reader only misses. A newer version only invites more sequences: 3.6.7's `OSC 8` `target=` (built 2026-02-19) happens to fail inertly, the link still opening, but 3.7.0 (built 2026-06-08) adds dual-mode `SGR 38:12` colors, which programs would then send and Dormouse mishandles.
 
 **Why another terminal's identity is stripped.** A pane inherits the host's environment, and the host inherits whatever launched it. Fedora's `vte.sh` sees `VTE_VERSION` and emits an `OSC 777` notification after every command; `WT_SESSION`, `ConEmuANSI`, `TERM_FEATURES` and the Konsole and Ptyxis versions switch on cargo's `OSC 9;4` progress, so every build rang; `TMUX` / `STY` send tools to a multiplexer that is not there — Codex and Claude Code wrap their notifications in tmux's passthrough; and `CURSOR_TRACE_ID` makes Claude Code believe it runs in Cursor's terminal, which leaves it no notification channel (audit, 2026-09-23). `COLORFGBG` would contradict the background the OSC 11 answer reports.
 
diff --git a/lib/src/lib/alert-engagement.test.ts b/lib/src/lib/alert-engagement.test.ts
index 53111bfff..7f2d5651e 100644
--- a/lib/src/lib/alert-engagement.test.ts
+++ b/lib/src/lib/alert-engagement.test.ts
@@ -2,7 +2,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AlertManager, type ActivityNotification, type AwaitOutcome } from './alert-manager';
 import { applyTerminalEvents, TerminalProtocolParser } from './terminal-protocol';
 import { cfg } from '../cfg';
-import { engage, finishCommand, goIdle, leave, runCommand, VIEWER } from './alert-manager-test-utils';
+import { collectEpisodes, engage, finishCommand, goIdle, leave, runCommand, VIEWER } from './alert-manager-test-utils';
 import { alertedPty, createOwnerPtyStream } from '../host/owner-pty';
 
 /**
@@ -56,6 +56,34 @@ function ringing(id: string): boolean {
   return manager.getState(id).status === 'ALERT_RINGING';
 }
 
+/** One step of a replayed timeline, due `at` ms in. */
+interface Step { at: number; step: () => void }
+
+function at(ms: number, step: () => void): Step {
+  return { at: ms, step };
+}
+
+/**
+ * Runs `steps` in time order, ties in list order, advancing the clock between
+ * them; each `to` resumes where the last one stopped.
+ */
+function player(steps: Step[]): { to(ms: number): void } {
+  const queue = [...steps].sort((a, b) => a.at - b.at);
+  let now = 0;
+  return {
+    to(ms) {
+      while (queue.length > 0 && queue[0].at <= ms) {
+        const next = queue.shift()!;
+        vi.advanceTimersByTime(next.at - now);
+        now = next.at;
+        next.step();
+      }
+      vi.advanceTimersByTime(ms - now);
+      now = ms;
+    },
+  };
+}
+
 /** A watched command, busy and then quiet: the settle a WATCHING ring needs. */
 function watchedTurn(id: string): void {
   manager.setWatchedCommands(['claude']);
@@ -287,33 +315,22 @@ describe('walking away from a permission prompt', () => {
 
   function replay(untilMs: number): void {
     const parser = new TerminalProtocolParser();
-    const timeline: { at: number; step: () => void }[] = [];
-    timeline.push({ at: 0, step: () => { engage(manager, PANE); runCommand(manager, PANE, 'claude'); } });
+    const steps = [at(0, () => { engage(manager, PANE); runCommand(manager, PANE, 'claude'); })];
     // First paint.
-    for (let at = 230; at < 830; at += 100) timeline.push({ at, step: () => manager.onData(PANE) });
+    for (let t = 230; t < 830; t += 100) steps.push(at(t, () => manager.onData(PANE)));
     // The prompt, typed at 40ms a key, each key echoed.
-    for (let at = 6_000; at <= 9_000; at += 40) {
-      timeline.push({ at, step: () => manager.acknowledge(PANE, { input: true }) });
-      timeline.push({ at: at + 7, step: () => manager.onData(PANE) });
+    for (let t = 6_000; t <= 9_000; t += 40) {
+      steps.push(at(t, () => manager.acknowledge(PANE, { input: true })), at(t + 7, () => manager.onData(PANE)));
     }
-    timeline.push({ at: ENTER_AT, step: () => manager.acknowledge(PANE, { input: true }) });
+    steps.push(at(ENTER_AT, () => manager.acknowledge(PANE, { input: true })));
     // Working, then the permission prompt drawn.
-    for (let at = 9_390; at < 11_960; at += 110) timeline.push({ at, step: () => manager.onData(PANE) });
-    timeline.push({ at: 17_960, step: () => applyTerminalEvents(manager, PANE, parser.process(OSC99).events) });
+    for (let t = 9_390; t < 11_960; t += 110) steps.push(at(t, () => manager.onData(PANE)));
+    steps.push(at(17_960, () => applyTerminalEvents(manager, PANE, parser.process(OSC99).events)));
     // The idle prompt's cursor redraw.
-    for (let at = 12_415; at < untilMs; at += 605) timeline.push({ at, step: () => manager.onData(PANE) });
+    for (let t = 12_415; t < untilMs; t += 605) steps.push(at(t, () => manager.onData(PANE)));
     // The renderer's presence lapses 15s after the last input.
-    timeline.push({ at: ENTER_AT + cfg.alert.inactivityTimeout, step: () => goIdle(manager, PANE) });
-
-    timeline.sort((a, b) => a.at - b.at);
-    let now = 0;
-    for (const { at, step } of timeline) {
-      if (at > untilMs) break;
-      vi.advanceTimersByTime(at - now);
-      now = at;
-      step();
-    }
-    vi.advanceTimersByTime(untilMs - now);
+    steps.push(at(ENTER_AT + cfg.alert.inactivityTimeout, () => goIdle(manager, PANE)));
+    player(steps).to(untilMs);
   }
 
   it('holds the permission request while the user is still there', () => {
@@ -347,10 +364,11 @@ describe('a Claude Code turn', () => {
   const QUIET_MS = cfg.alert.mightNeedAttention + cfg.alert.needsAttentionConfirm;
   const IDLE_NOTICE = '\x1b]99;i=3319:d=0:p=title;Claude Code\x07\x1b]99;i=3319:p=body;Claude is waiting for your input\x07\x1b]99;i=3319:d=1:a=focus;\x07';
   const FINISHED: ActivityNotification = { source: 'OSC 9;4', title: 'claude finished', body: null };
+  /** The user clicks another pane mid-turn. */
+  const MOVED_AWAY = at(ENTER_AT + 600, () => engage(manager, OTHER));
 
-  interface Step { at: number; step: () => void }
-  let emit: (at: number, data: string) => Step;
-  let key: (at: number, data: string) => Step;
+  let emit: (ms: number, data: string) => Step;
+  let key: (ms: number, data: string) => Step;
   let episodes: Set<string>;
 
   beforeEach(() => {
@@ -363,18 +381,16 @@ describe('a Claude Code turn', () => {
       onChunk() {},
     });
     const pty = alertedPty(manager, { write() {}, resize() {} });
-    emit = (at, data) => ({ at, step: () => stream.write(data) });
-    key = (at, data) => ({ at, step: () => pty.write(PANE, data, { userInput: true }) });
-    episodes = new Set();
-    manager.onStateChange((id, state) => { if (id === PANE && state.episode) episodes.add(state.episode.id); });
+    emit = (ms, data) => at(ms, () => stream.write(data));
+    key = (ms, data) => at(ms, () => pty.write(PANE, data, { userInput: true }));
+    episodes = collectEpisodes(manager, PANE);
   });
 
-  const at = (ms: number, step: () => void): Step => ({ at: ms, step });
-
-  /** The turn's bytes and keystrokes: the prompt typed and submitted, then Claude working for `turnMs`. */
+  /** The turn on the pane the user starts at: the prompt typed and submitted, then Claude working for `turnMs`. */
   function turn(turnMs: number): Step[] {
     const endAt = ENTER_AT + turnMs;
     const steps = [
+      at(0, () => engage(manager, PANE)),
       // Shell integration names the command; Claude paints and clears any stale progress.
       emit(0, '\x1b]633;E;claude\x07\x1b]633;C\x07'),
       emit(358, 'Claude Code'),
@@ -392,29 +408,10 @@ describe('a Claude Code turn', () => {
     return steps;
   }
 
-  /** Runs `steps` in time order (ties in list order), advancing the clock between them. */
-  function player(steps: Step[]): { to(ms: number): void } {
-    const queue = [...steps].sort((a, b) => a.at - b.at);
-    let now = 0;
-    return {
-      to(ms) {
-        while (queue.length > 0 && queue[0].at <= ms) {
-          const next = queue.shift()!;
-          vi.advanceTimersByTime(next.at - now);
-          now = next.at;
-          next.step();
-        }
-        vi.advanceTimersByTime(ms - now);
-        now = ms;
-      },
-    };
-  }
-
   it('holds the finish while the user watches, and drops it once they type', () => {
     const endAt = ENTER_AT + RECORDED_TURN_MS;
     const typedAt = endAt + 2_000;
     const run = player([
-      at(0, () => engage(manager, PANE)),
       ...turn(RECORDED_TURN_MS),
       key(typedAt, 'x'),
       at(typedAt + cfg.alert.inactivityTimeout, () => goIdle(manager, PANE)),
@@ -432,11 +429,7 @@ describe('a Claude Code turn', () => {
     ['once a longer turn has gone quiet', LONG_TURN_MS, 3 + QUIET_MS],
   ] as const)('rings "claude finished" once when the user moved away mid-turn: %s', (_when, turnMs, afterEndMs) => {
     const ringAt = ENTER_AT + turnMs + afterEndMs;
-    const run = player([
-      at(0, () => engage(manager, PANE)),
-      at(ENTER_AT + 600, () => engage(manager, OTHER)),
-      ...turn(turnMs),
-    ]);
+    const run = player([...turn(turnMs), MOVED_AWAY]);
 
     run.to(ringAt - 1);
     expect(ringing(PANE)).toBe(false);
@@ -450,9 +443,8 @@ describe('a Claude Code turn', () => {
     const endAt = ENTER_AT + RECORDED_TURN_MS;
     const clickAt = endAt + 5_000;
     const run = player([
-      at(0, () => engage(manager, PANE)),
-      at(ENTER_AT + 600, () => engage(manager, OTHER)),
       ...turn(RECORDED_TURN_MS),
+      MOVED_AWAY,
       at(clickAt, () => { engage(manager, PANE); manager.acknowledge(PANE, { input: false }); }),
       at(clickAt + cfg.alert.inactivityTimeout, () => goIdle(manager, PANE)),
     ]);
@@ -468,11 +460,7 @@ describe('a Claude Code turn', () => {
 
   it('rings once the user, still focused on the pane, has gone idle', () => {
     const idleAt = ENTER_AT + cfg.alert.inactivityTimeout;
-    const run = player([
-      at(0, () => engage(manager, PANE)),
-      ...turn(RECORDED_TURN_MS),
-      at(idleAt, () => goIdle(manager, PANE)),
-    ]);
+    const run = player([...turn(RECORDED_TURN_MS), at(idleAt, () => goIdle(manager, PANE))]);
 
     run.to(idleAt - 1);
     expect(manager.getState(PANE)).toMatchObject({ todo: false, notification: null });
diff --git a/lib/src/lib/alert-manager-test-utils.ts b/lib/src/lib/alert-manager-test-utils.ts
index 06624f57e..fb2ffe6b2 100644
--- a/lib/src/lib/alert-manager-test-utils.ts
+++ b/lib/src/lib/alert-manager-test-utils.ts
@@ -52,6 +52,15 @@ export function finishCommand(
   ]);
 }
 
+/** Every episode id `id` publishes from now on, added as it is published. */
+export function collectEpisodes(manager: AlertManager, id: string): Set<string> {
+  const episodes = new Set<string>();
+  manager.onStateChange((changed, state) => {
+    if (changed === id && state.episode) episodes.add(state.episode.id);
+  });
+  return episodes;
+}
+
 /** Run `commandLine` seen and then left: armed, so its exit rings once it has
  *  outlasted `cfg.alert.commandExitMinRuntime`. */
 export function armCommandExit(manager: AlertManager, id: string, commandLine = 'pnpm build'): void {
diff --git a/lib/src/lib/alert-manager.test.ts b/lib/src/lib/alert-manager.test.ts
index 6d207b0c3..6ddc65f5d 100644
--- a/lib/src/lib/alert-manager.test.ts
+++ b/lib/src/lib/alert-manager.test.ts
@@ -10,6 +10,7 @@ import { cfg } from '../cfg';
 import { toPersistedAlertState } from './session-types';
 import {
   armCommandExit,
+  collectEpisodes,
   driveToBusy,
   engage,
   finishCommand,
@@ -383,10 +384,7 @@ describe('AlertManager in isolation', () => {
       // Claude Code: the turn settles and WATCHING rings; the user acknowledges
       // it without typing; a minute later Claude sends its idle notification.
       const id = `acknowledged-${verb}`;
-      const episodes = new Set<string>();
-      manager.onStateChange((changed, state) => {
-        if (changed === id && state.episode) episodes.add(state.episode.id);
-      });
+      const episodes = collectEpisodes(manager, id);
       driveToRinging(id);
       leaveTodoVerbs[verb](id);
       vi.advanceTimersByTime(60_000);
@@ -676,10 +674,7 @@ describe('AlertManager in isolation', () => {
   // `docs/specs/alert.md` -> Public State.
   it('a second source joining mid-episode keeps the episode id', () => {
     const id = 'episode-cross-track';
-    const seen: string[] = [];
-    manager.onStateChange((_id, state) => {
-      if (_id === id && state.episode) seen.push(state.episode.id);
-    });
+    const episodes = collectEpisodes(manager, id);
 
     armCommandExit(manager, id);
     vi.advanceTimersByTime(cfg.alert.commandExitMinRuntime);
@@ -697,7 +692,7 @@ describe('AlertManager in isolation', () => {
     const again = manager.getState(id);
     expect(again.status).toBe(rung.status);
     expect(again.episode?.id).toBe(rung.episode?.id);
-    expect(new Set(seen)).toEqual(new Set([rung.episode!.id]));
+    expect(episodes).toEqual(new Set([rung.episode!.id]));
   });
 
   it('re-latching after the ring clears starts a new episode', () => {
diff --git a/lib/src/lib/terminal-color-scheme.test.ts b/lib/src/lib/terminal-color-scheme.test.ts
index 618b6ff02..f2f1145b7 100644
--- a/lib/src/lib/terminal-color-scheme.test.ts
+++ b/lib/src/lib/terminal-color-scheme.test.ts
@@ -3,14 +3,12 @@
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { Terminal } from '@xterm/xterm';
-import { xtermVtExtensions } from './terminal-lifecycle';
-import { inputIsReplayTerminalReport } from './terminal-report-filter';
+import { xtermVtExtensions } from './xterm-options';
 
 /**
  * The advertised iTerm2 version promises dark-mode reporting
- * (`docs/specs/terminal-escapes.md` -> iTerm2 identity). A real xterm.js with
- * Dormouse's extensions answers the query, and the answer is a terminal reply
- * on the input side, never a keystroke.
+ * (`docs/specs/terminal-escapes.md` -> iTerm2 identity): a real xterm.js with
+ * Dormouse's extensions answers the query.
  */
 async function colorSchemeReply(theme: { background: string; foreground: string }): Promise<string[]> {
   const terminal = new Terminal({ allowProposedApi: true, theme, vtExtensions: xtermVtExtensions() });
@@ -38,9 +36,7 @@ describe('color-scheme query (DSR 996)', () => {
   it.each([
     ['dark', { background: '#1e1e1e', foreground: '#d4d4d4' }, '\x1b[?997;1n'],
     ['light', { background: '#ffffff', foreground: '#333333' }, '\x1b[?997;2n'],
-  ] as const)('answers a %s theme with a reply the input filter treats as a terminal report', async (_scheme, theme, expected) => {
-    const replies = await colorSchemeReply(theme);
-    expect(replies).toEqual([expected]);
-    expect(inputIsReplayTerminalReport(expected)).toBe(true);
+  ] as const)('answers a %s theme', async (_scheme, theme, expected) => {
+    expect(await colorSchemeReply(theme)).toEqual([expected]);
   });
 });
diff --git a/lib/src/lib/terminal-lifecycle.ts b/lib/src/lib/terminal-lifecycle.ts
index cafdb4689..a8712b8a3 100644
--- a/lib/src/lib/terminal-lifecycle.ts
+++ b/lib/src/lib/terminal-lifecycle.ts
@@ -1,7 +1,7 @@
 import { clearToolAnnounce } from './tool-announce-store';
 import { clearToolDirty } from './tool-dirty-store';
 import { serializeTransferTerminal, type TerminalGrid } from './terminal-transfer';
-import { Terminal, type IBufferRange, type ITerminalOptions } from '@xterm/xterm';
+import { Terminal, type IBufferRange } from '@xterm/xterm';
 import { FitAddon } from '@xterm/addon-fit';
 import { SerializeAddon } from '@xterm/addon-serialize';
 import { ImageAddon, type IImageAddonOptions } from '@xterm/addon-image';
@@ -17,6 +17,7 @@ import { cfg } from '../cfg';
 import { requestExternalLinkConfirmation } from './external-link-confirmation';
 import { attachMouseModeObserver } from './mouse-mode-observer';
 import { attachKeyboardProtocolArbiter } from './keyboard-protocol-arbiter';
+import { xtermVtExtensions } from './xterm-options';
 import {
   bumpRenderTick,
   getMouseSelectionState,
@@ -136,22 +137,6 @@ function readDisplayTextFromBuffer(terminal: Terminal, range: IBufferRange): str
   }
 }
 
-/**
- * The negotiated VT extensions every terminal offers. kittyKeyboard
- * disambiguates Shift+Enter from Enter for TUIs that read raw VT (Claude Code
- * everywhere; Codex on macOS/Linux). win32InputMode covers Windows TUIs that
- * read via the Console API behind ConPTY (Codex), which can't negotiate the
- * kitty protocol there: when conhost enables it (CSI ? 9001 h), xterm sends
- * faithful Win32 INPUT_RECORD key events so Shift+Enter and Ctrl+J reach the
- * app intact. Both are opt-in/negotiated, so they coexist — each program turns
- * on whichever it understands. colorSchemeQuery answers DSR 996 and DECSET
- * 2031, which the advertised iTerm2 version promises
- * (docs/specs/terminal-escapes.md -> iTerm2 identity).
- */
-export function xtermVtExtensions(): ITerminalOptions['vtExtensions'] {
-  return { kittyKeyboard: true, win32InputMode: IS_WINDOWS, colorSchemeQuery: true };
-}
-
 function createXtermHost(grid?: TerminalGrid): { terminal: Terminal; fit: FitAddon; serialize: SerializeAddon; element: HTMLDivElement } {
   const styles = getComputedStyle(document.body);
   const editorFontSize = parseInt(styles.getPropertyValue('--vscode-editor-font-size'), 10) || 12;
diff --git a/lib/src/lib/xterm-options.ts b/lib/src/lib/xterm-options.ts
new file mode 100644
index 000000000..f15e53abb
--- /dev/null
+++ b/lib/src/lib/xterm-options.ts
@@ -0,0 +1,18 @@
+import type { ITerminalOptions } from '@xterm/xterm';
+import { IS_WINDOWS } from './platform';
+
+/**
+ * The negotiated VT extensions every terminal offers. kittyKeyboard
+ * disambiguates Shift+Enter from Enter for TUIs that read raw VT (Claude Code
+ * everywhere; Codex on macOS/Linux). win32InputMode covers Windows TUIs that
+ * read via the Console API behind ConPTY (Codex), which can't negotiate the
+ * kitty protocol there: when conhost enables it (CSI ? 9001 h), xterm sends
+ * faithful Win32 INPUT_RECORD key events so Shift+Enter and Ctrl+J reach the
+ * app intact. Both are opt-in/negotiated, so they coexist — each program turns
+ * on whichever it understands. colorSchemeQuery answers DSR 996 and DECSET
+ * 2031, which the advertised iTerm2 version promises
+ * (docs/specs/terminal-escapes.md -> iTerm2 identity).
+ */
+export function xtermVtExtensions(): ITerminalOptions['vtExtensions'] {
+  return { kittyKeyboard: true, win32InputMode: IS_WINDOWS, colorSchemeQuery: true };
+}

From 0636e35d8475267f2cf9607b19a4fd99a0b47556 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 24 Sep 2026 00:05:36 -0700
Subject: [PATCH 13/16] Fix review findings across WATCHING keys, presence,
 delivery, and mobile

- WATCHING keys skip here-document bodies and treat shell reserved words
  as grammar, so heredocs and loops key on the command they run.
- Presence does not lapse while an iframe browser pane holds focus (its
  input is invisible to the window), so push waits for a real absence.
- A partial publication no longer drops a Session's delivery overrides
  and silently cancels its pending speech or push.
- Mobile acknowledges a tap, not a scroll swipe or radial drag; zoom and
  unzoom always acknowledge.
- A viewer's `sync` re-sends only its own Sessions and stores to it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwN55bUVmCNmPiX7vHGCVF
---
 docs/specs/alert.md                           |   8 +-
 docs/specs/alert.rationale.md                 |   6 +
 docs/specs/mobile-terminal-ui.md              |  15 +-
 docs/specs/standalone.md                      |   5 +-
 docs/specs/terminal-state.md                  |   2 +-
 docs/specs/transport.md                       |   4 +-
 lib/src/components/MobileTerminalUi.tsx       |  49 +++++-
 lib/src/components/Wall.test.tsx              |  16 ++
 lib/src/components/Wall.tsx                   |  19 ++-
 .../components/mobile-acknowledge.test.tsx    |  40 ++++-
 lib/src/host/alert-client.test.ts             |   5 +-
 lib/src/host/alert-client.ts                  |  12 +-
 lib/src/host/alert-host.test.ts               |  33 ++--
 lib/src/host/alert-host.ts                    |  18 ++-
 lib/src/host/alert-protocol.ts                |  15 +-
 lib/src/host/remote/sidecar-entry.test.ts     |  11 +-
 lib/src/host/remote/sidecar-entry.ts          |   9 +-
 lib/src/lib/alert-delivery-scheduler.test.ts  |  32 +++-
 lib/src/lib/alert-delivery-scheduler.ts       |  39 +++--
 lib/src/lib/alert-settings-host.ts            |   9 +-
 lib/src/lib/platform/fake-adapter.ts          |   8 +-
 lib/src/lib/presence.test.ts                  |  24 +++
 lib/src/lib/presence.ts                       |  15 +-
 lib/src/lib/terminal-mouse-router.test.ts     |  24 ++-
 lib/src/lib/terminal-mouse-router.ts          |  19 +++
 lib/src/lib/terminal-state.test.ts            |  22 ++-
 lib/src/lib/terminal-state.ts                 | 152 ++++++++++++++++--
 lib/src/lib/watched-command-host.ts           |   9 +-
 scripts/spec-word-budgets.json                |   4 +-
 standalone/src-tauri/src/routing.rs           |  15 +-
 .../src/browser-sidecar-adapter.test.ts       |   2 +-
 vscode-ext/src/message-router.ts              |   8 +-
 vscode-ext/test/message-router.test.ts        |  26 +++
 33 files changed, 556 insertions(+), 119 deletions(-)

diff --git a/docs/specs/alert.md b/docs/specs/alert.md
index 67c91138e..bd21f8172 100644
--- a/docs/specs/alert.md
+++ b/docs/specs/alert.md
@@ -58,13 +58,13 @@ Three separate signals, never one lease (rationale):
 
 **A Session is engaged while some present viewer focuses it**, and engagement alone decides holding over ringing.
 
-- **Must compute presence in the renderer and report transitions only**: an input event only stamps a time, and the host keeps no presence timer. **An end of presence names its lapse** — `idle` when the timeout ran out, `leave` on a window blur or hide. **A blur is a leave only when `document.hasFocus()` is false** (`docs/specs/layout.md` → Corner cases #2). Focus or visibility returning counts as input.
+- **Must compute presence in the renderer and report transitions only**: an input event only stamps a time, and the host keeps no presence timer. **An end of presence names its lapse** — `idle` when the timeout ran out, `leave` on a window blur or hide. **A blur is a leave only when `document.hasFocus()` is false** (`docs/specs/layout.md` → Corner cases #2). Focus or visibility returning counts as input. **An iframe Surface holding focus keeps presence from lapsing `idle`**, its input never reaching the window; a blur behind it is a `leave` at the next deadline (rationale).
 - **Must keep engagement per viewer**, deduped at the renderer, so one viewer's leave never disengages a Session another viewer engages. **An absent viewer reports no focus change.**
 
 | Gesture | Acknowledges |
 |---|---|
 | typing into the pane (CSI/SS3 key encodings included), a paste, a file drop, the mobile input bar or a gesture key, a remote Client's write | with input |
-| a Pane body or header click, zoom, the dev-server chip, entering passthrough by keyboard, a Door click or `Enter`, a mobile tap | without input |
+| a Pane body or header click, zoom or unzoom, the dev-server chip, entering passthrough by keyboard, a Door click or `Enter`, a mobile tap | without input |
 | a terminal reply, a mouse-only report chunk, `d` reattach, a spawn, split, or promotion, a `dor` reveal, an embed focusing itself, DOM focus alone | nothing |
 
 - **Must acknowledge at each gesture's handler, never in the passthrough entry the silent paths share.**
@@ -175,7 +175,7 @@ Source of truth: `awaitCompletion` in `lib/src/lib/alert-manager.ts`; `AlertComm
 
 Rules:
 
-- **The key is `commandWatchKey(rawCommandLine)`**: the last command of a list (`&&`, `||`, `;`, `&`, newline) and the first stage of its pipeline, grouping dropped, leading `VAR=value` words and transparent wrappers (`sudo`, `npx`, …) skipped, then argv[0]'s basename minus any launcher suffix (`docs/specs/terminal-state.md`). **An unknown wrapper flag stops the skip**, keying the wrapper itself. **A script runner keys as `<runner> <script>`**, a leading `run` dropped, so `cd web && pnpm run dev` keys on `pnpm dev`; a script that is no valid key (a path) keys the runner (rationale). Where bash's `E` falls back to a line's first simple command (`docs/specs/terminal-escapes.md` → Shell-integration injection), that command keys. Pinned by `WATCHING key` in `lib/src/lib/terminal-state.test.ts`.
+- **The key is `commandWatchKey(rawCommandLine)`**: the last command of a list (`&&`, `||`, `;`, `&`, newline) and the first stage of its pipeline, grouping dropped, leading `VAR=value` words and transparent wrappers (`sudo`, `npx`, …) skipped, then argv[0]'s basename minus any launcher suffix (`docs/specs/terminal-state.md`). **Reserved words are grammar**: a leading `do`, `then`, `if`, `!`, … is stripped, a segment a closer (`done`, `fi`, `esac`) leads is skipped with its redirection or pipe, and a `for` header and case pattern are dropped, so `for f in *; do make; done` keys on `make` (rationale). **An unknown wrapper flag stops the skip**, keying the wrapper itself. **A script runner keys as `<runner> <script>`**, a leading `run` dropped, so `cd web && pnpm run dev` keys on `pnpm dev`; a script that is no valid key (a path) keys the runner (rationale). Where bash's `E` falls back to a line's first simple command (`docs/specs/terminal-escapes.md` → Shell-integration injection), that command keys. Pinned by `WATCHING key` in `lib/src/lib/terminal-state.test.ts`.
 - **A rule covers a key it equals, and a bare runner rule covers every `<runner> <script>` key of that runner** (rationale). `watchRuleFor` is the one matcher, for WATCHING, rule-removal silencing, and the terminal context's row.
 - **Every command boundary resets the detector** — `commandStart`, `commandFinish`, `promptStart`, `promptEnd`, and PTY exit — even without a command watch. Pinned by `resets unwatched output history on %s without a command watch` in `lib/src/lib/alert-manager.test.ts`.
 - **Editing the rule set re-derives WATCHING across every live Session immediately**, never restarting the detector (rationale).
@@ -317,7 +317,7 @@ Rules:
 - **Must deliver at most once per sink per episode**, due at the episode's start plus the Session's delay; a source joining the episode delivers nothing, and the ring clearing consumes what it had pending.
 - **Must recheck at the deadline, and consume a deadline that fails, never retrying it**: **speech only while the Session is not engaged** (Engagement); **push only while no viewer is present**, VS Code's focused, active window counting as one (`docs/specs/vscode.md` → Workspaces; rationale).
 - **Disabling consumes pending work immediately; enabling never replays an episode**, one that began disabled included. Delay edits never move a deadline; speech reads the current voice at engine admission.
-- **Each realm publishes every Session it shows** — Pane label and Workspace overrides — as one `sessions` op replacing its last: membership and override changes at the end of their task, label changes on a `LABEL_PUBLISH_THROTTLE_MS` trailing throttle (rationale), nothing unchanged resent. **The host keeps each Session's last publisher's entry until the Session is removed**, through its realm's end and a respawn under its id; an unpublished Session uses the defaults.
+- **Each realm publishes every Session it shows** — Pane label and Workspace overrides — as one `sessions` op: membership and override changes at the end of their task, label changes on a `LABEL_PUBLISH_THROTTLE_MS` trailing throttle (rationale), nothing unchanged resent. **A publication overwrites each Session it names, whichever realm published it last, and never drops one the manager holds state for**; one its realm omits with none is forgotten (rationale). **The host keeps each Session's entry until the Session is removed**, through its realm's end and a respawn under its id; an unpublished Session uses the defaults.
 - **A due push goes from the host's own Burrow** (Push notifications), titled by the published label, whether or not a realm still shows the Session; **a due spoken alarm goes to the realm showing it** as `alert:speak`, and with none is not spoken.
 
 Source of truth: `normalizeAlertDeliveryOverrides` / `resolveAlertDeliveryPolicy` in `lib/src/lib/alert-delivery-model.ts`; `createAlertDeliveryScheduler` in `lib/src/lib/alert-delivery-scheduler.ts`; `startAlertDelivery` / `LABEL_PUBLISH_THROTTLE_MS` in `lib/src/lib/alert-delivery.ts`; `getSessionAlertPolicy` in `lib/src/lib/alert-delivery-policy.ts`; `setWorkspaceAlertDelivery` in `lib/src/lib/workspace-store.ts`. Pinned by `lib/src/lib/alert-delivery-scheduler.test.ts`, `lib/src/lib/alert-delivery.test.ts`, and `delivery` in `lib/src/host/alert-host.test.ts`.
diff --git a/docs/specs/alert.rationale.md b/docs/specs/alert.rationale.md
index 2a25906ca..68ec73974 100644
--- a/docs/specs/alert.rationale.md
+++ b/docs/specs/alert.rationale.md
@@ -18,6 +18,8 @@
 
 **Why a command-mode selection is not focus.** Command mode is navigation: the selection passes over panes while the user looks for one, and none of them receives the keyboard. Treating it as focus would hold completions on whatever pane the cursor was left on.
 
+**Why a focused iframe holds presence.** Input typed into an iframe browser Surface goes to the frame's own document, so a user typing in a browser pane lapsed `idle` after the inactivity timeout and was pushed while at the keyboard (review, 2026-09-23). The accepted cost: walking away with a browser pane focused keeps the viewer present, so a push waits until the window blurs or hides. Speech is unaffected, since a browser Surface is never focus. An application switch with the frame focused blurs only the frame, which is why the next deadline checks the window itself.
+
 **Why the renderer computes presence.** It is the only side that sees input events, and a presence timer in the host would need an IPC message per event to refresh it; one message per transition carries the same information.
 
 **Why each VS Code webview is its own viewer.** The webviews share one manager. With one attention slot, a webview's window blur sent an id-less clear that wiped the attention another webview had just set, arming its running build (audit, 2026-09-23).
@@ -82,6 +84,8 @@
 
 **Why the key is the last command of a list, past its wrappers.** The old key, argv[0] of the first simple command, named the set-up rather than the work: `cd web && pnpm dev` keyed on `cd`, `clear; claude` on `clear`, and `sudo make`, `time make`, `caffeinate -i claude` and `npx claude` on the wrapper, so a rule offered from those panes matched every other use of `cd` or `sudo` (audit, 2026-09-23). The last command of a list is the one still running when the line settles; a pipeline's first stage is the producer whose output the pane shows. An unknown wrapper flag keys the wrapper because guessing whether it swallowed the next word would key an argument as a program.
 
+**Why reserved words and here-documents are grammar.** Command lines keep their newlines and bash reports a whole history entry, so a compound entry's last word was its closer: `for f in *; do make; done` keyed on `done`, `if x; then make; fi` on `fi`, and `python3 - <<'EOF' … EOF` on its delimiter, splitting the script's own `&&` and `;` on the way (review, 2026-09-23). A rule offered from those panes matched nothing anyone runs. The body a loop or conditional runs is what the entry waits on, as a list's last command is; a closer's trailing `< list` or `| tee log` belongs to the whole compound command, whose producer is that body.
+
 **Why runners key by script.** `pnpm dev` never finishes and `pnpm test` does; one `pnpm` rule rang for both, so watching a dev server's pane also rang every test run. `run` is dropped because `npm run test` and `npm test` are one script under two spellings.
 
 **Why a bare runner rule still covers every script.** Rules stored before script keys are bare runner names, and a user who watched `pnpm` asked for all of it; a new rule never loses ground an old one had.
@@ -126,6 +130,8 @@
 
 **Why a push goes from the host, and only speech from a realm.** A push is the walked-away channel, yet performing it in the renderer made it depend on the realm the user had walked away from — suspended when hidden, or disposed, when a VS Code view fell back to titling the push by its command line (2026-09-23). Only `window.speechSynthesis` needs a renderer; a push needs only the Pane label, which the realm publishes ahead of time.
 
+**Why a publication never drops a Session with state.** Dropping an entry rechecked it against the defaults, consuming a sink only its override enabled, and enabling never replays an episode, so the realm's next, whole publication could not re-arm it. A reload, or a window mounting its Walls one at a time, publishes a partial set first (review, 2026-09-23). A Session with no state has no episode to consume; forgetting it keeps the host's copy bounded by what realms show, browser Surfaces included, which the manager never removes.
+
 **Why labels wait on a throttle and overrides do not.** Claude Code animates its terminal title about ten times a second (2026-09), and each frame changes the label: publishing every one would cross into the host ten times a second per Session for a value read only when a push comes due. An override change goes at once because disabling a sink must consume its pending push before it fires.
 
 **Why presence gates delivery.** The watcher rechecked only the episode and the setting, so a push went out while the user typed in the next pane, and speech named the pane they were reading (audit, 2026-09-23). Speech is heard in the room, so it only has to spare the pane being looked at; a push reaches a phone, so it waits until the user has left every viewer.
diff --git a/docs/specs/mobile-terminal-ui.md b/docs/specs/mobile-terminal-ui.md
index b6bd11ecc..a7203b47b 100644
--- a/docs/specs/mobile-terminal-ui.md
+++ b/docs/specs/mobile-terminal-ui.md
@@ -42,10 +42,13 @@ Chrome rules:
   radius. Order: title, secondary detail, TODO pill, minimize, kill (suppressed
   by `showKillButton={false}`, as Pocket does). Both consumers wire minimize to
   the Sessions reserve, not a desktop Door. A ring shows as the alarm inset on
-  the bar and on its session-list row. **A touch acknowledges the active
-  Session in `MobileTerminalUi`'s capture phase**, before any touch mode
-  consumes it; both consumers route its input bar and gesture keys through
-  `writeUserInput` (`docs/specs/alert.md` -> Engagement).
+  the bar and on its session-list row. **A tap acknowledges the active
+  Session; a drag never does.** `MobileTerminalUi` tracks each press in its
+  capture phase, before any touch mode consumes it, and acknowledges a release
+  that never strayed past `RADIUS_FADE_START`. **Select mode's router consumes
+  a touch it owns**, so it announces one that never became a drag as
+  `TERMINAL_TAP_EVENT`. Both consumers route the input bar and gesture keys
+  through `writeUserInput` (`docs/specs/alert.md` -> Engagement).
 * **Must install `useDynamicPalette` in `MobileTerminalUi`** for gesture tokens;
   it never mounts the desktop `Wall`. `docs/specs/theme.md` owns publication
   and the CSS baselines available before the effect runs.
@@ -56,6 +59,10 @@ Chrome rules:
 CSS height and the root `h-screen` (when `fillViewport`) or `h-full`, so the
 terminal region does not bounce as the OS keyboard animates (rationale).
 
+Source of truth: `withinTapSlop` in `lib/src/components/MobileTerminalUi.tsx`;
+`TERMINAL_TAP_EVENT` in `lib/src/lib/terminal-mouse-router.ts`. Pinned by
+`lib/src/components/mobile-acknowledge.test.tsx`.
+
 ## Touch mode selector
 
 The touch selector controls what a pane-content touch does. **Always visible**,
diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index 5010b9ad4..ecd1bd819 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -255,8 +255,9 @@ that feeds it: one `AlertManager`, every window a realm under its label
 - **`alert:speak` carries its Session's `id`**, which Rust routes it by.
 - **Must re-send each listed Session's `alert:state` behind the answer to
   `pty:requestInit`**: a reloaded window and an arriving Workspace learn their
-  rings and TODOs nowhere else. A `sync` re-sends every Session's, and Rust
-  routes each to its owner.
+  rings and TODOs nowhere else. **A `sync` re-sends only the Sessions its
+  window names**, each to its owner, and both stores' snapshots **with
+  `forWindow`**.
 - **Rust passes a spawn's `options.alert` through opaque**
   (`a_spawn_carries_its_persisted_alert_to_the_sidecar`); the sidecar seeds from
   it (`docs/specs/alert.md` → Public State) and strips it before `pty-core`.
diff --git a/docs/specs/terminal-state.md b/docs/specs/terminal-state.md
index 6751b6af8..9851220b8 100644
--- a/docs/specs/terminal-state.md
+++ b/docs/specs/terminal-state.md
@@ -95,7 +95,7 @@ Source of truth: `cwdFromManualPath` in `lib/src/lib/terminal-state.ts`; `seedTe
 - `commandFinish` moves `currentCommand` to `lastCommand`, stores `event.finishedAt` (otherwise reducer time) and `exitCode`, snapshots the latest in-run OSC 0/2/9 title into `lastCommand.finalTerminalTitle` (titles older than `startedAt` or younger than `finishedAt` excluded), clears `currentCommand`, and sets `{ kind: "finished", exitCode }`. **With no `currentCommand` it only sets the activity**, never inventing a `lastCommand`.
 - `title` updates the per-source entry in `titleCandidates`. **Later OSC title events never erase earlier candidates from other sources.**
 
-Command-line tokenizing is dialect-free: **`\` escapes exactly the set `shellEscapePosix` writes** (`POSIX_ESCAPABLE` in `lib/src/lib/posix-escape.ts`; both halves pinned by `terminal-state.test.ts`). **A leading `&` is PowerShell's call operator, never a POSIX background suffix**, and is dropped rather than read as a boundary. **An unquoted newline separates commands like `;`**; a backslash-newline continues the line. **Grouping `(` `)` `{` `}` is dropped; a `$(…)`, `<(…)` or `>(…)` substitution or a `name=(…)` array is one word**, separators included. **An unquoted Windows path containing spaces stays split.** **A launcher suffix is not part of a program's name** — `npm.cmd` and `C:\tools\claude.exe` are `npm` and `claude` for the header, the WATCHING key, and the terminal context alike. Accepted: `foo.bat` and `foo.exe` in one directory cannot be watched separately. (rationale)
+Command-line tokenizing is dialect-free: **`\` escapes exactly the set `shellEscapePosix` writes** (`POSIX_ESCAPABLE` in `lib/src/lib/posix-escape.ts`; both halves pinned by `terminal-state.test.ts`). **A leading `&` is PowerShell's call operator, never a POSIX background suffix**, and is dropped rather than read as a boundary. **An unquoted newline separates commands like `;`**; a backslash-newline continues the line. **A here-document's body is skipped**: after an unquoted `<<` or `<<-` (not `<<<`), the lines through its delimiter, quotes removed and leading tabs stripped under `<<-`. **Grouping `(` `)` `{` `}` is dropped; a `$(…)`, `<(…)` or `>(…)` substitution or a `name=(…)` array is one word**, separators included. **An unquoted Windows path containing spaces stays split.** **A launcher suffix is not part of a program's name** — `npm.cmd` and `C:\tools\claude.exe` are `npm` and `claude` for the header, the WATCHING key, and the terminal context alike. Accepted: `foo.bat` and `foo.exe` in one directory cannot be watched separately. (rationale)
 
 **`displayCommand` is a one-line, per-program summary of those tokens** — the program name plus a bounded argument count, suffixed `| ...` or ` ...` past a pipeline or compound boundary. Source of truth: `summarizeCommandLine` and `commandTitleTokens` in `lib/src/lib/terminal-state.ts`.
 
diff --git a/docs/specs/transport.md b/docs/specs/transport.md
index 8d372d52a..d420f863b 100644
--- a/docs/specs/transport.md
+++ b/docs/specs/transport.md
@@ -208,9 +208,9 @@ Transport constraints:
 | Host → webview | `pty:replay` | Buffered raw output since spawn; the webview runs a one-shot parser over it, the only re-parse there is. |
 | Host → webview | `dormouse:newTerminal` | May carry `shell`, `args`, display `name`, `replaceUntouched`, `announce`. The webview replaces the selected untouched terminal in place only when `replaceUntouched` is true, otherwise spawns a new pane. |
 
-**Every `alert*` verb is one `alert:command { command }` to the host** — in standalone the `alert_command` invoke, stamped with its window (`docs/specs/standalone.md` → "Alerts") — and **every answer one of the `alert:*` events, named and shaped alike in both hosts** (`AlertCommand` / `AlertEvents` in `lib/src/host/alert-protocol.ts`). **The host revalidates every command**, the settings blob that becomes its timers included (`normalizeAlertSettings`). An await's messages are `docs/specs/alert.md` → Await. **`sync` re-sends the realm its Sessions' `alert:state` and both stores' snapshots, ending nothing.**
+**Every `alert*` verb is one `alert:command { command }` to the host** — in standalone the `alert_command` invoke, stamped with its window (`docs/specs/standalone.md` → "Alerts") — and **every answer one of the `alert:*` events, named and shaped alike in both hosts** (`AlertCommand` / `AlertEvents` in `lib/src/host/alert-protocol.ts`). **The host revalidates every command**, the settings blob that becomes its timers included (`normalizeAlertSettings`). An await's messages are `docs/specs/alert.md` → Await. **`sync` re-sends only the realm its named Sessions' `alert:state` and both stores' snapshots, ending nothing.**
 
-**Two app-global stores relay on one pattern**: WATCHING rules (`initializeWatchedCommands`, `setCommandWatched` → host; `alert:watchedCommands` → webview) and alarm settings (`initializeSettings`, `updateSettings` → host; `alert:settings` → webview; `docs/specs/alert.md` → Alarm settings). An `initialize*` offers the renderer's persisted copy as a startup seed, and **a host accepts only the first seed of its lifetime**. A mutation replaces the host's copy — `setCommandWatched` adds or removes one bare command key without touching unrelated rules, `updateSettings` sends the whole blob, renderer-only fields included, so every webview agrees. Either way the host broadcasts a canonical snapshot, and **every renderer replaces and persists its local mirror from it**. **A host sends no snapshot before the first seed**, so a `sync` never pushes defaults over a renderer's persisted copy.
+**Two app-global stores relay on one pattern**: WATCHING rules (`initializeWatchedCommands`, `setCommandWatched` → host; `alert:watchedCommands` → webview) and alarm settings (`initializeSettings`, `updateSettings` → host; `alert:settings` → webview; `docs/specs/alert.md` → Alarm settings). An `initialize*` offers the renderer's persisted copy as a seed, and **a host accepts only the first seed of its lifetime**. A mutation replaces the host's copy — `setCommandWatched` adds or removes one bare command key without touching unrelated rules, `updateSettings` sends the whole blob, renderer-only fields included, so every webview agrees. Either way the host broadcasts a canonical snapshot, and **every renderer replaces and persists its local mirror from it**. **A host sends no snapshot before the first seed**, so a `sync` never pushes defaults over a renderer's persisted copy.
 
 Both settings directions share one adapter method, `alertPublishSettings(settings, { seed })`: seed vs replace picks an op, not a payload.
 
diff --git a/lib/src/components/MobileTerminalUi.tsx b/lib/src/components/MobileTerminalUi.tsx
index 78f042dd8..e262c9d4d 100644
--- a/lib/src/components/MobileTerminalUi.tsx
+++ b/lib/src/components/MobileTerminalUi.tsx
@@ -30,6 +30,7 @@ import {
   finishMobileGesture,
   MOBILE_GESTURE_COMPLETE_MS,
   MOBILE_GESTURE_IDLE_STATE,
+  RADIUS_FADE_START,
   updateMobileGesture,
   type MobileGestureAction,
   type MobileGestureInputId,
@@ -44,6 +45,7 @@ import type { AlertEpisode } from '../lib/alert-episode';
 import type { SessionStatus } from '../lib/terminal-registry';
 import { acknowledgeSession } from '../lib/session-activity-store';
 import type { MouseTrackingMode, OverrideState } from '../lib/mouse-selection';
+import { TERMINAL_TAP_EVENT, type TerminalTapDetail } from '../lib/terminal-mouse-router';
 
 export type MobileTerminalKeyboardMode = 'sessions' | 'recent' | 'type' | 'draft';
 export type MobileTerminalTouchMode = 'gestures' | 'selection' | 'cursor';
@@ -406,6 +408,20 @@ function localPointerPoint(event: PointerEvent<HTMLElement>): MobileGesturePoint
   };
 }
 
+/** A press that may yet end as a tap, and the Session it would acknowledge. */
+interface PendingTap {
+  pointerId: number;
+  clientX: number;
+  clientY: number;
+  sessionId: string;
+}
+
+/** Whether a press's pointer is still where a tap stays: inside the radial
+ *  menu's `RADIUS_FADE_START`, before any direction has begun to steer. */
+function withinTapSlop(tap: PendingTap, event: PointerEvent<HTMLElement>): boolean {
+  return Math.hypot(event.clientX - tap.clientX, event.clientY - tap.clientY) <= RADIUS_FADE_START;
+}
+
 function isGestureDialogTarget(target: EventTarget | null): boolean {
   return target instanceof Element && target.closest('[data-mobile-gesture-dialog]') !== null;
 }
@@ -508,6 +524,7 @@ export function MobileTerminalUi({
   const gestureCompletionTimerRef = useRef<number | null>(null);
   const cursorPointerIdRef = useRef<number | null>(null);
   const cursorPointerTargetRef = useRef<EventTarget | null>(null);
+  const pendingTapRef = useRef<PendingTap | null>(null);
   // Cancelled on unmount, including after test DOM teardown.
   const [blurRetries] = useState(() => new RetrySchedule());
   const [focusRetries] = useState(() => new RetrySchedule());
@@ -712,12 +729,30 @@ export function MobileTerminalUi({
 
   useEffect(() => blurRetries.cancel, [blurRetries]);
 
+  // Select mode's router owns a touch on the terminal and consumes its release,
+  // so it reports the tap itself.
+  useEffect(() => {
+    const host = terminalHostRef.current;
+    if (!host) return;
+    const onTap = (event: Event) => {
+      const tap = pendingTapRef.current;
+      if (tap?.pointerId !== (event as CustomEvent<TerminalTapDetail>).detail?.pointerId) return;
+      pendingTapRef.current = null;
+      acknowledgeSession(tap.sessionId);
+    };
+    host.addEventListener(TERMINAL_TAP_EVENT, onTap);
+    return () => host.removeEventListener(TERMINAL_TAP_EVENT, onTap);
+  }, []);
+
   const handlePanePointerDownCapture = useCallback((event: PointerEvent<HTMLDivElement>) => {
     if (isGestureDialogTarget(event.target)) return;
-    // A tap acknowledges the active Session (`docs/specs/alert.md` ->
-    // Engagement); capture on the host runs before any mode below consumes it.
+    // A tap acknowledges the active Session, a drag or swipe never
+    // (`docs/specs/alert.md` -> Engagement): judged on release, and tracked in
+    // capture on the host, before any mode below consumes the press.
     const active = interactive ? sessions.find((session) => session.active) : undefined;
-    if (active) acknowledgeSession(active.id);
+    pendingTapRef.current = active
+      ? { pointerId: event.pointerId, clientX: event.clientX, clientY: event.clientY, sessionId: active.id }
+      : null;
     blurPaneTextInputs();
     if (interactive && touchMode === 'cursor' && isTouchLikePrimaryPointer(event)) {
       event.preventDefault();
@@ -746,6 +781,8 @@ export function MobileTerminalUi({
   }, [blurPaneTextInputs, clearGestureCompletionTimer, commitGestureState, interactive, sessions, touchMode]);
 
   const handlePanePointerMoveCapture = useCallback((event: PointerEvent<HTMLDivElement>) => {
+    const tap = pendingTapRef.current;
+    if (tap?.pointerId === event.pointerId && !withinTapSlop(tap, event)) pendingTapRef.current = null;
     if (touchMode === 'cursor' && cursorPointerIdRef.current === event.pointerId && isTouchLikePrimaryPointer(event)) {
       event.preventDefault();
       event.stopPropagation();
@@ -773,6 +810,11 @@ export function MobileTerminalUi({
   }, [commitGestureState, executeGestureAction, scheduleGestureCompletionClear, touchMode]);
 
   const handlePanePointerUpCapture = useCallback((event: PointerEvent<HTMLDivElement>) => {
+    const tap = pendingTapRef.current;
+    if (tap?.pointerId === event.pointerId) {
+      pendingTapRef.current = null;
+      if (withinTapSlop(tap, event)) acknowledgeSession(tap.sessionId);
+    }
     if (cursorPointerIdRef.current === event.pointerId && isTouchLikePrimaryPointer(event)) {
       event.preventDefault();
       event.stopPropagation();
@@ -817,6 +859,7 @@ export function MobileTerminalUi({
   }, [blurPaneTextInputs]);
 
   const handlePanePointerCancelCapture = useCallback((event: PointerEvent<HTMLDivElement>) => {
+    if (pendingTapRef.current?.pointerId === event.pointerId) pendingTapRef.current = null;
     if (cursorPointerIdRef.current === event.pointerId && isTouchLikePrimaryPointer(event)) {
       event.preventDefault();
       event.stopPropagation();
diff --git a/lib/src/components/Wall.test.tsx b/lib/src/components/Wall.test.tsx
index bffc4aab0..4f262cef0 100644
--- a/lib/src/components/Wall.test.tsx
+++ b/lib/src/components/Wall.test.tsx
@@ -3952,6 +3952,22 @@ describe('engagement', () => {
     expect(acknowledge.mock.calls).toEqual([['pane-a']]);
   });
 
+  it('acknowledges a zoom and an unzoom from the pane already in passthrough', async () => {
+    const acknowledge = vi.spyOn(terminalRegistry, 'acknowledgeSession');
+    await act(async () => root.render(<Wall initialPaneIds={['pane-a', 'pane-b']} initialMode="passthrough" />));
+    await flush();
+
+    await act(async () => { container.querySelector<HTMLElement>('[data-lath-leaf="pane-a"] button[aria-label="Zoom"]')!.click(); });
+    await flush();
+    expect(container.querySelector('[data-lath-leaf="pane-a"] button[aria-label="Unzoom"]')).not.toBeNull();
+    expect(acknowledge.mock.calls).toEqual([['pane-a']]);
+
+    await act(async () => { container.querySelector<HTMLElement>('[data-lath-leaf="pane-a"] button[aria-label="Unzoom"]')!.click(); });
+    await flush();
+    expect(container.querySelector('[data-lath-leaf="pane-a"] button[aria-label="Zoom"]')).not.toBeNull();
+    expect(acknowledge.mock.calls).toEqual([['pane-a'], ['pane-a']]);
+  });
+
   it('acknowledges the dev-server chip jumping to the terminal it names', async () => {
     const acknowledge = vi.spyOn(terminalRegistry, 'acknowledgeSession');
     await act(async () => root.render(<Wall
diff --git a/lib/src/components/Wall.tsx b/lib/src/components/Wall.tsx
index 6cb08d177..fe425e493 100644
--- a/lib/src/components/Wall.tsx
+++ b/lib/src/components/Wall.tsx
@@ -1926,20 +1926,19 @@ export function Wall({
       // over rather than merely unzoom the owner. Acquiring zoom first enters
       // passthrough on this pane (unless it already owns focus); selectPane's
       // `releaseZoomExcept` drops the previous owner on the way through.
-      const currentZoom = lath.store.getSnapshot().zoomedId;
-      if (currentZoom === id) {
-        lath.store.setZoomed(null);
-        return;
-      }
+      const unzoom = lath.store.getSnapshot().zoomedId === id;
       if (
-        modeRef.current !== 'passthrough' ||
-        selectedTypeRef.current !== 'pane' ||
-        selectedIdRef.current !== id
+        !unzoom && (
+          modeRef.current !== 'passthrough' ||
+          selectedTypeRef.current !== 'pane' ||
+          selectedIdRef.current !== id
+        )
       ) {
         enterTerminalMode(id);
-        acknowledgeSession(id);
       }
-      lath.store.setZoomed(id);
+      // A gesture on this Session whichever way it goes, in passthrough or not.
+      acknowledgeSession(id);
+      lath.store.setZoomed(unzoom ? null : id);
     },
     onClickPanel: (id: string) => {
       setConfirmKill(null);
diff --git a/lib/src/components/mobile-acknowledge.test.tsx b/lib/src/components/mobile-acknowledge.test.tsx
index 1b0fa7a4b..13145201a 100644
--- a/lib/src/components/mobile-acknowledge.test.tsx
+++ b/lib/src/components/mobile-acknowledge.test.tsx
@@ -14,6 +14,7 @@ import { MobileWall, useMobileWallSessionItems } from './MobileWall';
 import { FakePtyAdapter, setPlatform } from '../lib/platform';
 import { clearTerminalActivity, disposeAllSessions, getActivity, initAlertStateReceiver, writeUserInput } from '../lib/terminal-registry';
 import { ensureResizeObserver, pointerEvent } from './wall/wall-test-utils';
+import { RADIUS_FADE_START, RADIUS_SELECT } from '../lib/mobile-gesture-menu';
 
 globalThis.IS_REACT_ACT_ENVIRONMENT = true;
 
@@ -84,19 +85,52 @@ afterEach(() => {
   vi.restoreAllMocks();
 });
 
+type Point = { clientX: number; clientY: number };
+
+/** One press on the terminal: down, a move to each of `moves`, then up at `up`. */
+function press(down: Point, moves: Point[], up: Point): void {
+  const screen = container.querySelector('.xterm');
+  expect(screen).not.toBeNull();
+  act(() => {
+    screen!.dispatchEvent(pointerEvent('pointerdown', down));
+    for (const point of moves) screen!.dispatchEvent(pointerEvent('pointermove', point));
+    screen!.dispatchEvent(pointerEvent('pointerup', up));
+  });
+}
+
+const ORIGIN = { clientX: 10, clientY: 12 };
+/** Past a tap's slop, short of any radial selection, so no gesture key fires. */
+const AWAY = { clientX: 10, clientY: 12 + (RADIUS_FADE_START + RADIUS_SELECT) / 2 };
+
 describe('mobile acknowledge', () => {
   it.each<MobileTerminalTouchMode>(['gestures', 'selection', 'cursor'])(
     'a tap on the terminal puts out a ring and keeps its TODO in %s mode',
     (mode) => {
       render(mode);
       ring();
-      const screen = container.querySelector('.xterm');
-      expect(screen).not.toBeNull();
-      act(() => { screen!.dispatchEvent(pointerEvent('pointerdown')); });
+      const screen = container.querySelector('.xterm')!;
+      act(() => { screen.dispatchEvent(pointerEvent('pointerdown', ORIGIN)); });
+      // Judged on release: the press may yet become a drag.
+      expect(getActivity(PANE)).toMatchObject({ status: 'ALERT_RINGING' });
+      // A little jitter is still a tap.
+      act(() => { screen.dispatchEvent(pointerEvent('pointerup', { clientX: 11, clientY: 12 })); });
       expect(getActivity(PANE)).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
     },
   );
 
+  it.each<MobileTerminalTouchMode>(['gestures', 'selection', 'cursor'])(
+    'a drag across the terminal leaves the ring in %s mode, even one that comes back',
+    (mode) => {
+      render(mode);
+      ring();
+      press(ORIGIN, [AWAY], AWAY);
+      press(ORIGIN, [AWAY, ORIGIN], ORIGIN);
+      // Lifted away with no move reported between.
+      press(ORIGIN, [], AWAY);
+      expect(getActivity(PANE)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
+    },
+  );
+
   it('a keystroke from the input bar acknowledges with input, clearing the TODO', () => {
     render('gestures');
     ring();
diff --git a/lib/src/host/alert-client.test.ts b/lib/src/host/alert-client.test.ts
index 2d82eea98..911c5195f 100644
--- a/lib/src/host/alert-client.test.ts
+++ b/lib/src/host/alert-client.test.ts
@@ -47,7 +47,8 @@ it('sends each alert verb as one command naming its op', () => {
     { op: 'initializeSettings', settings: DEFAULT_ALERT_SETTINGS },
     { op: 'updateSettings', settings: DEFAULT_ALERT_SETTINGS },
     { op: 'hello' },
-    { op: 'sync' },
+    // The Sessions the realm last published are the ones it shows.
+    { op: 'sync', ids: ['p'] },
   ]);
 });
 
@@ -137,6 +138,8 @@ describe('awaits', () => {
     const realm = createAlertClient((command) => host.handle('main', command, {
       answer: (result) => void realm.onEvent('alert:awaitResult', result),
       resendStates: () => {},
+      resendWatchedCommands: () => {},
+      resendSettings: () => {},
     }));
     try {
       const handle = realm.methods.alertAwait('p', { until: 'quiet', timeoutMs: 600_000 });
diff --git a/lib/src/host/alert-client.ts b/lib/src/host/alert-client.ts
index ff356198a..e77c3c44b 100644
--- a/lib/src/host/alert-client.ts
+++ b/lib/src/host/alert-client.ts
@@ -38,7 +38,8 @@ export interface AlertClient {
    *  the same name engaged or parked is gone. */
   hello(): void;
   /** Ask the host to re-send this realm's Sessions' state and both stores,
-   *  for a transport that may have dropped them. */
+   *  for a transport that may have dropped them: the Sessions its last
+   *  `alertPublishSessions` named. */
   sync(): void;
   /** Settle every await this realm parked `cancelled`, synchronously: nothing
    *  will deliver their outcomes once the adapter is gone. */
@@ -63,6 +64,8 @@ export function createAlertClient(send: (command: AlertCommand) => void): AlertC
   const awaits = new Map<string, { resolve: (outcome: AwaitOutcome) => void; startedAt: number }>();
   const tag = randomTag();
   let awaitSeq = 0;
+  /** The Sessions this realm shows, as it last published them. */
+  let shown: string[] = [];
 
   const methods: AlertClientMethods = {
     alertSetWatchedCommands: (names) => send({ op: 'initializeWatchedCommands', names }),
@@ -74,7 +77,10 @@ export function createAlertClient(send: (command: AlertCommand) => void): AlertC
     alertDismiss: (id) => send({ op: 'dismiss', id }),
     alertEngagement: (state: Engagement, lapse?: EngagementLapse) =>
       send({ op: 'engagement', state, ...(lapse ? { lapse } : {}) }),
-    alertPublishSessions: (sessions) => send({ op: 'sessions', sessions }),
+    alertPublishSessions: (sessions) => {
+      shown = Object.keys(sessions);
+      send({ op: 'sessions', sessions });
+    },
     alertAcknowledge: (id) => send({ op: 'acknowledge', id }),
     alertToggleTodo: (id) => send({ op: 'toggleTodo', id }),
     alertClearTodo: (id) => send({ op: 'clearTodo', id }),
@@ -156,7 +162,7 @@ export function createAlertClient(send: (command: AlertCommand) => void): AlertC
     },
 
     hello: () => send({ op: 'hello' }),
-    sync: () => send({ op: 'sync' }),
+    sync: () => send({ op: 'sync', ids: shown }),
 
     dispose() {
       for (const [awaitId, parked] of [...awaits]) {
diff --git a/lib/src/host/alert-host.test.ts b/lib/src/host/alert-host.test.ts
index b757144af..a53e9fa94 100644
--- a/lib/src/host/alert-host.test.ts
+++ b/lib/src/host/alert-host.test.ts
@@ -15,7 +15,8 @@ import { REPORT } from '../lib/alert-manager-test-utils';
 let host: AlertHost;
 /** Every await outcome, by the realm it was answered to. */
 let answers: Array<{ realm: string } & AlertAwaitResult>;
-let resent: string[];
+/** Each realm's `sync` answer: the Session ids re-sent, and the store snapshots. */
+let resent: Array<{ realm: string; ids?: readonly string[]; names?: string[]; settings?: unknown }>;
 let watched: string[][];
 let settings: Array<Record<string, unknown>>;
 let spoken: AlertSpeak[];
@@ -24,7 +25,9 @@ let pushed: Array<[string, string]>;
 function realmFor(name: string): AlertRealm {
   return {
     answer: (result) => void answers.push({ realm: name, ...result }),
-    resendStates: () => void resent.push(name),
+    resendStates: (ids) => void resent.push({ realm: name, ids }),
+    resendWatchedCommands: (names) => void resent.push({ realm: name, names }),
+    resendSettings: (value) => void resent.push({ realm: name, settings: value }),
   };
 }
 
@@ -133,25 +136,33 @@ it('starts a respawned Session over, from the persisted state it was spawned wit
   expect(host.manager.has('pty-2')).toBe(true);
 });
 
-it('re-sends the asking realm its state and both stores on sync, ending nothing', () => {
+it('re-sends the asking realm its own Sessions and both stores on sync, to it alone, ending nothing', () => {
   from('main', { op: 'initializeWatchedCommands', names: ['npm test'] });
   from('main', { op: 'initializeSettings', settings: DEFAULT_ALERT_SETTINGS });
   from('main', { op: 'engagement', state: { present: true, focusId: 'pty-a' } });
   watched = [];
   settings = [];
 
-  from('main', { op: 'sync' });
-  expect(resent).toEqual(['main']);
-  expect(watched).toEqual([['npm test']]);
-  expect(settings).toHaveLength(1);
+  from('main', { op: 'sync', ids: ['pty-a', 42, ''] });
+  expect(resent).toEqual([
+    { realm: 'main', ids: ['pty-a'] },
+    { realm: 'main', names: ['npm test'] },
+    { realm: 'main', settings: DEFAULT_ALERT_SETTINGS },
+  ]);
+  // No broadcast: every other realm's copies are intact.
+  expect(watched).toEqual([]);
+  expect(settings).toEqual([]);
   expect(host.manager.viewerIds()).toEqual(['main']);
+
+  resent = [];
+  from('main', { op: 'sync' });
+  expect(resent[0]).toEqual({ realm: 'main', ids: [] });
 });
 
 it('never snapshots a store no realm has seeded', () => {
   // It would replace the renderers' persisted copies with the defaults.
-  from('main', { op: 'sync' });
-  expect(watched).toEqual([]);
-  expect(settings).toEqual([]);
+  from('main', { op: 'sync', ids: [] });
+  expect(resent).toEqual([{ realm: 'main', ids: [] }]);
 });
 
 describe('realms', () => {
@@ -197,6 +208,8 @@ describe('realms', () => {
     host.handle('main', { op: 'await', awaitId: 'await-1', id: 'pty-1', until: 'exit', timeoutMs: 600_000 }, {
       answer: () => { throw new Error('webview disposed'); },
       resendStates: () => {},
+      resendWatchedCommands: () => {},
+      resendSettings: () => {},
     });
     from('main', { op: 'await', awaitId: 'await-2', id: 'pty-2', until: 'exit', timeoutMs: 600_000 });
     host.endRealm('main');
diff --git a/lib/src/host/alert-host.ts b/lib/src/host/alert-host.ts
index 2ac560c64..9a7588c07 100644
--- a/lib/src/host/alert-host.ts
+++ b/lib/src/host/alert-host.ts
@@ -3,6 +3,7 @@ import { createAlertDeliveryScheduler } from '../lib/alert-delivery-scheduler';
 import { AlertSettingsHost } from '../lib/alert-settings-host';
 import { WatchedCommandHost } from '../lib/watched-command-host';
 import type { PersistedAlertState } from '../lib/session-types';
+import type { AlertSettings } from '../lib/alert-settings-model';
 import type { AlertAwaitResult, AlertSpeak } from './alert-protocol';
 
 /**
@@ -19,8 +20,13 @@ import type { AlertAwaitResult, AlertSpeak } from './alert-protocol';
 export interface AlertRealm {
   /** One await's outcome. May throw from a realm being torn down. */
   answer(result: AlertAwaitResult): void;
-  /** `sync`: re-send this realm the state of the Sessions it shows. */
-  resendStates(): void;
+  /** `sync`: re-send this realm the state of these Sessions, the ones it
+   *  shows, each the host has state for. */
+  resendStates(ids: readonly string[]): void;
+  /** `sync`: the WATCHING rule set's snapshot, to this realm alone. */
+  resendWatchedCommands(names: string[]): void;
+  /** `sync`: the alarm settings' snapshot, to this realm alone. */
+  resendSettings(settings: AlertSettings): void;
 }
 
 export interface AlertHostOptions {
@@ -135,10 +141,12 @@ export function createAlertHost(options: AlertHostOptions): AlertHost {
         case 'hello':
           endRealm(realmId);
           return;
+        // Answered to the asking realm alone, never a broadcast: every other
+        // realm's copies are intact.
         case 'sync':
-          realm.resendStates();
-          watched.publish();
-          settings.publish();
+          realm.resendStates(Array.isArray(message.ids) ? message.ids.filter(isId) : []);
+          watched.publish((names) => realm.resendWatchedCommands(names));
+          settings.publish((value) => realm.resendSettings(value));
           return;
         case 'initializeWatchedCommands':
           // Only the first realm's offer is taken; every later one is answered
diff --git a/lib/src/host/alert-protocol.ts b/lib/src/host/alert-protocol.ts
index bf54436b5..ea873bc4a 100644
--- a/lib/src/host/alert-protocol.ts
+++ b/lib/src/host/alert-protocol.ts
@@ -13,14 +13,16 @@ import type { AlertStateDetail } from '../lib/platform/types';
 export type AlertCommand =
   /** A realm (re)initialized: whatever its previous realm engaged or parked is gone. */
   | { op: 'hello' }
-  /** Re-send this realm its Sessions' state and both stores, ending nothing. */
-  | { op: 'sync' }
+  /** Re-send this realm the state of the Sessions it shows, `ids`, and both
+   *  stores' snapshots, to it alone, ending nothing. */
+  | { op: 'sync'; ids: string[] }
   | { op: 'initializeWatchedCommands'; names: string[] }
   | { op: 'setCommandWatched'; name: string; watched: boolean }
   | { op: 'initializeSettings' | 'updateSettings'; settings: AlertSettings }
   | { op: 'engagement'; state: Engagement; lapse?: EngagementLapse }
   /** Every Session this realm shows, by id: what the host's delivery
-   *  scheduler cannot know itself. Replaces what the realm published before. */
+   *  scheduler cannot know itself. Overwrites each one's last publication
+   *  (`createAlertDeliveryScheduler`). */
   | { op: 'sessions'; sessions: Record<string, AlertSessionInfo> }
   | { op: 'acknowledge' | 'dismiss' | 'toggleTodo' | 'clearTodo'; id: string }
   | { op: 'await'; awaitId: string; id: string; until: AwaitUntil; timeoutMs: number }
@@ -55,9 +57,10 @@ export interface AlertEvents {
   /** `forWindow`: standalone names the window that parked the await, which
    *  Rust routes it to (`docs/specs/standalone.md` → "Routing"). */
   'alert:awaitResult': AlertAwaitResult & { forWindow?: string };
-  /** The app-global stores' canonical snapshots, to every realm. */
-  'alert:watchedCommands': { names: string[] };
-  'alert:settings': { settings: AlertSettings };
+  /** The app-global stores' canonical snapshots, to every realm, or to the
+   *  one that asked to `sync`, which standalone names in `forWindow`. */
+  'alert:watchedCommands': { names: string[]; forWindow?: string };
+  'alert:settings': { settings: AlertSettings; forWindow?: string };
   /** A spoken alarm now due, to the realm that shows its Session. */
   'alert:speak': AlertSpeak;
 }
diff --git a/lib/src/host/remote/sidecar-entry.test.ts b/lib/src/host/remote/sidecar-entry.test.ts
index 84faf39a4..7465cbf23 100644
--- a/lib/src/host/remote/sidecar-entry.test.ts
+++ b/lib/src/host/remote/sidecar-entry.test.ts
@@ -808,13 +808,18 @@ describe('the sidecar host', () => {
     expect(host.alerts.viewerIds()).toEqual(['main']);
   });
 
-  it('re-sends every Session\'s state and both stores to a window that asks to sync', () => {
+  it('re-sends a window that asks to sync its own Sessions\' state, and both stores to it alone', () => {
     command('main', { op: 'initializeWatchedCommands', names: ['npm test'] });
     command('main', { op: 'initializeSettings', settings: {} });
     host.alerts.notifyFromProtocol('pty-1', REPORT);
+    host.alerts.notifyFromProtocol('pty-2', REPORT);
     out = [];
-    command('main', { op: 'sync' });
-    expect(out.map((line) => line.event).sort()).toEqual(['alert:settings', 'alert:state', 'alert:watchedCommands']);
+    command('main', { op: 'sync', ids: ['pty-1'] });
+    expect(out.map((line) => [line.event, (line.data as { id?: string; forWindow?: string }).id ?? (line.data as { forWindow?: string }).forWindow])).toEqual([
+      ['alert:state', 'pty-1'],
+      ['alert:watchedCommands', 'main'],
+      ['alert:settings', 'main'],
+    ]);
   });
 
   /**
diff --git a/lib/src/host/remote/sidecar-entry.ts b/lib/src/host/remote/sidecar-entry.ts
index 4da87c8a6..7379d02e4 100644
--- a/lib/src/host/remote/sidecar-entry.ts
+++ b/lib/src/host/remote/sidecar-entry.ts
@@ -459,11 +459,14 @@ export function createSidecarHost(options: SidecarHostOptions): SidecarHost {
     }
   }
 
-  /** An await's outcome goes to the window that parked it; a `sync` re-sends
-   *  every Session's state, which reaches only the windows that own them. */
+  /** An await's outcome and a `sync`'s store snapshots go to the window that
+   *  asked; a `sync` re-sends only the Sessions that window names, each routed
+   *  to its owner. */
   const realmOf = (window: string): AlertRealm => ({
     answer: (result) => sendAlert('alert:awaitResult', { ...result, forWindow: window }),
-    resendStates: () => publish(undefined),
+    resendStates: (ids) => publish(ids),
+    resendWatchedCommands: (names) => sendAlert('alert:watchedCommands', { names, forWindow: window }),
+    resendSettings: (settings) => sendAlert('alert:settings', { settings, forWindow: window }),
   });
 
   const store = options.stateDir
diff --git a/lib/src/lib/alert-delivery-scheduler.test.ts b/lib/src/lib/alert-delivery-scheduler.test.ts
index d8f006f2e..c1f8217e6 100644
--- a/lib/src/lib/alert-delivery-scheduler.test.ts
+++ b/lib/src/lib/alert-delivery-scheduler.test.ts
@@ -155,13 +155,39 @@ describe('published Sessions', () => {
     ring();
     vi.advanceTimersByTime(SPEAK_MS);
     expect(sinks()).toEqual(['speech']);
+  });
 
-    // A realm dropping a Session it last published returns it to the defaults.
+  it('keeps a Session a partial publication omits, and the alarm its override armed', () => {
+    scheduler.setDefaults({ ...SETTINGS, speakEnabled: false, pushEnabled: false });
+    scheduler.publish('main', { [PANE]: session({ speakEnabled: true }), [OTHER]: session({}) });
+    ring();
+    // A reload publishes its first Wall before the one showing the ring.
+    scheduler.publish('main', { [OTHER]: session({}) });
+    scheduler.publish('main', { [PANE]: session({ speakEnabled: true }), [OTHER]: session({}) });
+    vi.advanceTimersByTime(SPEAK_MS);
+    expect(delivered).toEqual([{ sink: 'speech', id: PANE, episodeId: episodeId() }]);
+  });
+
+  it('gives a Session that moved its new owner\'s overrides', () => {
+    scheduler.setDefaults({ ...SETTINGS, pushEnabled: false });
+    scheduler.publish('source', { [PANE]: session({}) });
+    ring();
     scheduler.publish('target', { [PANE]: session({ speakEnabled: false }) });
-    scheduler.publish('target', {});
+    scheduler.publish('source', {});
+    vi.advanceTimersByTime(SPEAK_MS);
+    expect(delivered).toEqual([]);
+  });
+
+  it('forgets an omitted Session only while it has no alert state', () => {
+    scheduler.setDefaults({ ...SETTINGS, pushEnabled: false });
+    scheduler.publish('main', { [PANE]: session({ speakEnabled: false }), [OTHER]: session({ speakEnabled: false }) });
+    ring();
+    scheduler.publish('main', {});
+    // OTHER had none, so nothing was pending on it: it is back on the defaults.
+    ring(OTHER);
     ringAgain();
     vi.advanceTimersByTime(SPEAK_MS);
-    expect(sinks()).toEqual(['speech', 'speech']);
+    expect(delivered).toEqual([{ sink: 'speech', id: OTHER, episodeId: episodeId(OTHER) }]);
   });
 
   it.each([
diff --git a/lib/src/lib/alert-delivery-scheduler.ts b/lib/src/lib/alert-delivery-scheduler.ts
index ffe6ca72a..2fd073d4d 100644
--- a/lib/src/lib/alert-delivery-scheduler.ts
+++ b/lib/src/lib/alert-delivery-scheduler.ts
@@ -18,7 +18,7 @@ import { DEFAULT_ALERT_SETTINGS, type AlertSettings } from './alert-settings-mod
  */
 
 export interface AlertDeliverySchedulerOptions {
-  manager: Pick<AlertManager, 'onStateChange' | 'onRemove' | 'isEngaged' | 'viewerIds'>;
+  manager: Pick<AlertManager, 'onStateChange' | 'onRemove' | 'isEngaged' | 'viewerIds' | 'has'>;
   /** A spoken alarm is due, for the realm showing the Session to speak. */
   speak(id: string, episodeId: string): void;
   /** A push is due, titled by the Session's published Pane label. */
@@ -27,9 +27,11 @@ export interface AlertDeliverySchedulerOptions {
 
 export interface AlertDeliveryScheduler {
   /**
-   * One realm's Sessions, `{ label, overrides }` by id, revalidated. Replaces
-   * what that realm published before, except a Session another realm has
-   * published since.
+   * The Sessions one realm shows, `{ label, overrides }` by id, revalidated.
+   * Each overwrites its Session's record, whichever realm made it. One the
+   * realm published before and omits now is forgotten only while it has no
+   * alert state, which nothing can be pending on: a partial publication must
+   * never consume what an override armed.
    */
   publish(realmId: string, sessions: unknown): void;
   /** The application defaults, from the host's settings store. */
@@ -131,27 +133,24 @@ export function createAlertDeliveryScheduler(options: AlertDeliverySchedulerOpti
   return {
     publish(realmId, raw) {
       if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return;
-      const next = new Map<string, Omit<Published, 'realmId'>>();
+      const named = new Set<string>();
       for (const [id, value] of Object.entries(raw)) {
         if (!id || !value || typeof value !== 'object') continue;
-        const { label, overrides } = value as Record<string, unknown>;
-        next.set(id, {
-          label: typeof label === 'string' ? label.slice(0, LABEL_LIMIT) : '',
-          overrides: normalizeAlertDeliveryOverrides(overrides),
-        });
+        named.add(id);
+        const { label, overrides: rawOverrides } = value as Record<string, unknown>;
+        const overrides = normalizeAlertDeliveryOverrides(rawOverrides);
+        const prior = published.get(id)?.overrides ?? {};
+        published.set(id, { realmId, label: typeof label === 'string' ? label.slice(0, LABEL_LIMIT) : '', overrides });
+        if (!sameAlertDeliveryOverrides(prior, overrides)) recheck(id);
       }
-      const changed: string[] = [];
+      // Never a record a ring could be pending on: dropping it would consume
+      // that ring's sinks, and the realm's next, whole publication could never
+      // re-arm them. One with no alert state (a browser Surface, a terminal
+      // that has printed nothing) goes, so the host holds no more than realms
+      // show.
       for (const [id, entry] of published) {
-        if (entry.realmId !== realmId || next.has(id)) continue;
-        published.delete(id);
-        if (Object.keys(entry.overrides).length > 0) changed.push(id);
-      }
-      for (const [id, entry] of next) {
-        const prior = published.get(id)?.overrides ?? {};
-        published.set(id, { realmId, ...entry });
-        if (!sameAlertDeliveryOverrides(prior, entry.overrides)) changed.push(id);
+        if (entry.realmId === realmId && !named.has(id) && !manager.has(id)) published.delete(id);
       }
-      for (const id of changed) recheck(id);
     },
 
     setDefaults(settings) {
diff --git a/lib/src/lib/alert-settings-host.ts b/lib/src/lib/alert-settings-host.ts
index ea908cb10..6b8b8d26b 100644
--- a/lib/src/lib/alert-settings-host.ts
+++ b/lib/src/lib/alert-settings-host.ts
@@ -54,10 +54,11 @@ export class AlertSettingsHost {
     this.target.applySettings(this.settings);
   }
 
-  /** The canonical blob to every subscriber, once there is one: a snapshot
-   *  sent before any renderer seeded would replace their persisted settings. */
-  publish(): void {
+  /** The canonical blob to every subscriber, or to `to` alone, once there is
+   *  one: a snapshot sent before any renderer seeded would replace their
+   *  persisted settings. */
+  publish(to?: (settings: AlertSettings) => void): void {
     if (!this.initialized) return;
-    for (const listener of this.listeners) listener(this.settings);
+    for (const listener of to ? [to] : this.listeners) listener(this.settings);
   }
 }
diff --git a/lib/src/lib/platform/fake-adapter.ts b/lib/src/lib/platform/fake-adapter.ts
index 364b4e3ec..413c8ceff 100644
--- a/lib/src/lib/platform/fake-adapter.ts
+++ b/lib/src/lib/platform/fake-adapter.ts
@@ -73,9 +73,13 @@ export class FakePtyAdapter implements PlatformAdapter {
   private readonly alerts = createAlertClient((command) => this.alertHost.handle(LOCAL_VIEWER, command, this.alertRealm));
   private readonly alertRealm: AlertRealm = {
     answer: (result) => void this.alerts.onEvent('alert:awaitResult', result),
-    resendStates: () => {
-      for (const [id, state] of this.alertManager.getAllStates()) this.alerts.onEvent('alert:state', { id, ...state });
+    resendStates: (ids) => {
+      for (const id of ids) {
+        if (this.alertManager.has(id)) this.alerts.onEvent('alert:state', { id, ...this.alertManager.getState(id) });
+      }
     },
+    resendWatchedCommands: (names) => void this.alerts.onEvent('alert:watchedCommands', { names }),
+    resendSettings: (settings) => void this.alerts.onEvent('alert:settings', { settings }),
   };
 
   /** The PTY side feeds the manager directly, as a host's own PTYs do. */
diff --git a/lib/src/lib/presence.test.ts b/lib/src/lib/presence.test.ts
index bcc6e30f6..a5484c8ce 100644
--- a/lib/src/lib/presence.test.ts
+++ b/lib/src/lib/presence.test.ts
@@ -92,6 +92,30 @@ describe('presence', () => {
     expect(transitions).toHaveLength(2);
   });
 
+  it('never lapses idle while an iframe Surface holds focus, whose input never reaches this window', () => {
+    const frame = document.createElement('iframe');
+    const activeElement = vi.spyOn(document, 'activeElement', 'get').mockReturnValue(frame);
+    input('keydown');
+    input('blur');
+    vi.advanceTimersByTime(TIMEOUT * 2);
+    expect(transitions).toEqual([[true, undefined]]);
+
+    // Focus back in the document: the idle clock runs from the frame's last check.
+    activeElement.mockReturnValue(document.body);
+    vi.advanceTimersByTime(TIMEOUT);
+    expect(transitions).toEqual([[true, undefined], [false, 'idle']]);
+  });
+
+  it('leaves at the next deadline when the window loses focus while an iframe holds it', () => {
+    const frame = document.createElement('iframe');
+    vi.spyOn(document, 'activeElement', 'get').mockReturnValue(frame);
+    input('keydown');
+    // No blur reaches this window: it already blurred into the frame.
+    focused = false;
+    vi.advanceTimersByTime(TIMEOUT);
+    expect(transitions).toEqual([[true, undefined], [false, 'leave']]);
+  });
+
   it('leaves when hidden and comes back when shown', () => {
     input('keydown');
     visibility = 'hidden';
diff --git a/lib/src/lib/presence.ts b/lib/src/lib/presence.ts
index f4728cf49..c50b3daa3 100644
--- a/lib/src/lib/presence.ts
+++ b/lib/src/lib/presence.ts
@@ -10,8 +10,9 @@ const LISTENER_OPTIONS: AddEventListenerOptions = { capture: true, passive: true
 
 /**
  * Whether a human is at this renderer realm: its window focused and visible,
- * with typing, pointer, or wheel input inside the inactivity timeout. Emits
- * transitions only, each end of presence with why it ended.
+ * with typing, pointer, or wheel input inside the inactivity timeout, or an
+ * iframe Surface holding focus. Emits transitions only, each end of presence
+ * with why it ended.
  */
 export interface PresenceTracker {
   readonly present: boolean;
@@ -33,6 +34,10 @@ export function createPresenceTracker({ timeoutMs, onChange }: PresenceTrackerOp
   let timer: ReturnType<typeof setTimeout> | null = null;
 
   const windowActive = (): boolean => document.hasFocus() && document.visibilityState === 'visible';
+  // A focused iframe Surface keeps the input typed into it from these
+  // listeners, so its focus stands in for input (`docs/specs/alert.md` ->
+  // Engagement).
+  const iframeHoldsFocus = (): boolean => document.activeElement?.tagName === 'IFRAME';
 
   const set = (next: boolean, lapse?: EngagementLapse): void => {
     if (next === present) return;
@@ -56,6 +61,12 @@ export function createPresenceTracker({ timeoutMs, onChange }: PresenceTrackerOp
   function expire(): void {
     timer = null;
     if (!present) return;
+    // Left while an iframe held focus, so no blur reached this window.
+    if (!windowActive()) {
+      set(false, 'leave');
+      return;
+    }
+    if (iframeHoldsFocus()) lastInputAt = Date.now();
     if (Date.now() - lastInputAt >= timeoutMs()) set(false, 'idle');
     else arm();
   }
diff --git a/lib/src/lib/terminal-mouse-router.test.ts b/lib/src/lib/terminal-mouse-router.test.ts
index 7705f0768..a74f69943 100644
--- a/lib/src/lib/terminal-mouse-router.test.ts
+++ b/lib/src/lib/terminal-mouse-router.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { attachTerminalMouseRouter } from './terminal-mouse-router';
+import { attachTerminalMouseRouter, TERMINAL_TAP_EVENT } from './terminal-mouse-router';
 import {
   __resetMouseSelectionForTests,
   beginDrag,
@@ -35,6 +35,7 @@ class FakeElement extends ListenerHost {
   setPointerCapture = vi.fn();
   releasePointerCapture = vi.fn();
   querySelector = vi.fn();
+  dispatchEvent = vi.fn();
 
   getBoundingClientRect(): Pick<DOMRect, 'left' | 'top'> {
     return { left: 0, top: 0 };
@@ -287,6 +288,27 @@ describe('terminal-mouse-router: override suppression', () => {
     cleanup();
   });
 
+  it('announces a touch press it owns that ends as a tap, and never a drag', () => {
+    const { cleanup, element } = createHarness(windowHost);
+    const taps = () => element.dispatchEvent.mock.calls
+      .map(([event]) => event as CustomEvent)
+      .filter((event) => event.type === TERMINAL_TAP_EVENT)
+      .map((event) => [event.bubbles, event.detail]);
+
+    element.emit('pointerdown', pointerEvent({ pointerId: 3, clientX: 5, clientY: 5 }));
+    windowHost.emit('pointerup', pointerEvent({ pointerId: 3, clientX: 6, clientY: 5 }));
+    expect(taps()).toEqual([[true, { pointerId: 3 }]]);
+
+    element.emit('pointerdown', pointerEvent({ clientX: 5, clientY: 5 }));
+    windowHost.emit('pointermove', pointerEvent({ clientX: 25, clientY: 15 }));
+    windowHost.emit('pointerup', pointerEvent({ clientX: 25, clientY: 15 }));
+    // Released away with no move reported between.
+    element.emit('pointerdown', pointerEvent({ clientX: 5, clientY: 5 }));
+    windowHost.emit('pointerup', pointerEvent({ clientX: 25, clientY: 15 }));
+    expect(taps()).toHaveLength(1);
+    cleanup();
+  });
+
   it('clears a finalized selection as soon as a new touch starts, before movement', () => {
     const { cleanup, element } = createHarness(windowHost);
     beginDrag('t1', { row: 0, col: 0, altKey: false, startedInScrollback: false });
diff --git a/lib/src/lib/terminal-mouse-router.ts b/lib/src/lib/terminal-mouse-router.ts
index b98d918e5..ce294d0d6 100644
--- a/lib/src/lib/terminal-mouse-router.ts
+++ b/lib/src/lib/terminal-mouse-router.ts
@@ -15,6 +15,17 @@ import { detectTokenInBufferLine } from './smart-token';
 import { extractSelectionText } from './selection-text';
 import type { TerminalOverlayDims } from './terminal-store';
 
+/**
+ * Dispatched on a terminal's element, bubbling, when a touch or pen press the
+ * router owns ends where it began without becoming a selection drag. The router
+ * consumes such a press's moves and release at `window`, so this is how a
+ * composition around the terminal learns of the tap (`MobileTerminalUi`).
+ */
+export const TERMINAL_TAP_EVENT = 'dormouse:terminal-tap';
+export interface TerminalTapDetail {
+  pointerId: number;
+}
+
 const OVERRIDE_MOUSE_EVENTS = ['mousemove', 'mouseup', 'wheel', 'click', 'dblclick', 'auxclick', 'contextmenu'] as const;
 
 function consumePointerEvent(ev: MouseEvent | PointerEvent, stopImmediate = false): void {
@@ -198,6 +209,14 @@ export function attachTerminalMouseRouter({
       // so the next press can be recognized as a double-tap (block selection).
       if (pendingDrag.touchLike) {
         lastTouchTap = { time: Date.now(), x: ev.clientX, y: ev.clientY };
+        const dx = ev.clientX - pendingDrag.clientX;
+        const dy = ev.clientY - pendingDrag.clientY;
+        if ('pointerId' in ev && dx * dx + dy * dy < DRAG_THRESHOLD_PX_SQ) {
+          element.dispatchEvent(new CustomEvent<TerminalTapDetail>(TERMINAL_TAP_EVENT, {
+            bubbles: true,
+            detail: { pointerId: ev.pointerId },
+          }));
+        }
       }
       clearTemporaryOverrideAfterMouseDispatch(id);
       pendingDrag = null;
diff --git a/lib/src/lib/terminal-state.test.ts b/lib/src/lib/terminal-state.test.ts
index db0fc2a4e..32aa5b4d1 100644
--- a/lib/src/lib/terminal-state.test.ts
+++ b/lib/src/lib/terminal-state.test.ts
@@ -381,6 +381,26 @@ describe('WATCHING key', () => {
     ['arr=(1 2) claude', 'claude'],
     ['npm run "build(prod)"', 'npm build(prod)'],
     ['(cd web && pnpm dev) | tee log', 'pnpm dev'],
+    // A here-document's body is text, never commands.
+    ["python3 - <<'EOF'\nimport os\nprint(os.getcwd())\nEOF", 'python3'],
+    ['cat <<EOF\nmake && deploy; rm -rf x\nEOF', 'cat'],
+    ['cat << "END" | claude\nhi\nEND', 'cat'],
+    ['cat <<-EOF\n\tone; two\n\tEOF\nclaude', 'claude'],
+    ['cat <<A <<\\B\na; x\nA\nb; y\nB\nclaude', 'claude'],
+    ['cat <<<x\nclaude', 'claude'],
+    // Reserved words are grammar: the key is the command a clause runs.
+    ['for f in *; do make; done', 'make'],
+    ['for f in *\ndo\n  claude "$f"\ndone', 'claude'],
+    ['if test -f x; then make; fi', 'make'],
+    ['if x; then a; else make; fi', 'make'],
+    ['while true; do claude; done', 'claude'],
+    ['while read -r f; do claude; done < list', 'claude'],
+    ['for f in *; do make; done | tee log', 'make'],
+    ['{ make; } > log', 'make'],
+    ['! make', 'make'],
+    ['echo done', 'echo'],
+    ['case $x in a|b) make;; esac', 'make'],
+    ['case $x in\n  a)\n    make\n    ;;\n  (*) claude ;;\nesac', 'claude'],
     // Transparent wrappers, with the flags they take.
     ['sudo make', 'make'],
     ['sudo -u root FOO=1 make install', 'make install'],
@@ -444,7 +464,7 @@ describe('WATCHING key', () => {
     expect(isWatchKey(expected)).toBe(true);
   });
 
-  it.each(['', '   ', '|', 'FOO=1', ';', '"my tool" --flag'])('has no key for %j', (raw) => {
+  it.each(['', '   ', '|', 'FOO=1', ';', '"my tool" --flag', 'done', 'fi', 'for f in *', 'case $x in'])('has no key for %j', (raw) => {
     expect(commandWatchKey(raw)).toBeNull();
   });
 
diff --git a/lib/src/lib/terminal-state.ts b/lib/src/lib/terminal-state.ts
index dda2eac92..f4b342c68 100644
--- a/lib/src/lib/terminal-state.ts
+++ b/lib/src/lib/terminal-state.ts
@@ -385,9 +385,8 @@ export function summarizeCommandLine(raw: string): string {
  * derive it are `docs/specs/alert.md` -> WATCHING Track.
  */
 export function commandWatchKey(raw: string): string | null {
-  const segments = splitCommandList(tokenizeCommand(raw.trim()))
-    .map((segment) => segment.filter((token) => !GROUPING_TOKENS.has(token)));
-  const words = segments.reverse().find((segment) => segment.length > 0) ?? [];
+  const commands = listCommands(tokenizeCommand(raw.trim()));
+  const words = commands[commands.length - 1] ?? [];
   const pipe = words.indexOf('|');
   return watchKeyOfCommand(pipe === -1 ? words : words.slice(0, pipe));
 }
@@ -902,9 +901,12 @@ function withRequiredHostPrefixes(
 
 /**
  * Split a command line into words, honoring quotes, POSIX backslash escapes,
- * and the pipeline/compound separators `| || && ; &`, which are emitted as
- * their own tokens. An unquoted newline separates commands like `;`, and a
- * backslash-newline continues the line. An unquoted `(` or `)` is a token of its
+ * and the pipeline/compound separators `| || && ; &` (and a case item's
+ * `;; ;& ;;&`), which are emitted as their own tokens. An unquoted newline
+ * separates commands like `;`, and a backslash-newline continues the line. A
+ * here-document's body — the lines after an unquoted `<<` / `<<-`'s own line,
+ * through the one equal to its delimiter word with quotes removed — is
+ * skipped, never read as commands. An unquoted `(` or `)` is a token of its
  * own too, except that a `$(…)` / `<(…)` / `>(…)` substitution or a `name=(…)`
  * array stays inside its word, whitespace and separators included; `{` and `}`
  * are grouping only as whole words, which the split already makes them.
@@ -931,6 +933,8 @@ function tokenizeCommand(input: string): string[] {
   // Whether the last character was an unquoted, unescaped `$`, `<` or `>`,
   // which makes a `(` right after it open a substitution.
   let substitutionPrefix = false;
+  // Here-documents opened on the current line, whose bodies follow it in order.
+  const hereDocuments: HereDocument[] = [];
 
   const push = () => {
     if (!current) return;
@@ -980,6 +984,8 @@ function tokenizeCommand(input: string): string[] {
     if (char === '\n') {
       push();
       tokens.push(';');
+      // The lines after it are the bodies of the here-documents it opened.
+      if (hereDocuments.length > 0) i = skipHereDocumentBodies(input, i + 1, hereDocuments.splice(0)) - 1;
       continue;
     }
     if (/\s/.test(char)) {
@@ -1003,11 +1009,24 @@ function tokenizeCommand(input: string): string[] {
       i += 1;
       continue;
     }
+    // A case item's end: `;;`, `;&`, `;;&`.
+    if (char === ';' && (input[i + 1] === ';' || input[i + 1] === '&')) {
+      push();
+      const end = input.startsWith(';;&', i) ? ';;&' : input.slice(i, i + 2);
+      tokens.push(end);
+      i += end.length - 1;
+      continue;
+    }
     if (char === '|' || char === ';' || char === '&') {
       push();
       tokens.push(char);
       continue;
     }
+    // `<<` or `<<-`, never the here-string `<<<`.
+    if (char === '<' && input[i + 1] === '<' && input[i + 2] !== '<' && input[i - 1] !== '<') {
+      const hereDocument = readHereDocumentDelimiter(input, i + 2);
+      if (hereDocument) hereDocuments.push(hereDocument);
+    }
     current += char;
     substitutionPrefix = char === '$' || char === '<' || char === '>';
   }
@@ -1016,6 +1035,56 @@ function tokenizeCommand(input: string): string[] {
   return tokens;
 }
 
+interface HereDocument {
+  /** The delimiter word, quotes removed: its body ends at a line equal to it. */
+  delimiter: string;
+  /** `<<-`: leading tabs are stripped from each body line, the delimiter's included. */
+  stripTabs: boolean;
+}
+
+/** The here-document a `<<` whose word starts at `from` opens, or null when no word follows it. */
+function readHereDocumentDelimiter(input: string, from: number): HereDocument | null {
+  let i = from;
+  const stripTabs = input[i] === '-';
+  if (stripTabs) i += 1;
+  while (input[i] === ' ' || input[i] === '\t') i += 1;
+  let delimiter = '';
+  let quote: '"' | "'" | null = null;
+  for (; i < input.length; i += 1) {
+    const char = input[i]!;
+    if (quote) {
+      if (char === quote) quote = null;
+      else delimiter += char;
+    } else if (char === '"' || char === "'") {
+      quote = char;
+    } else if (char === '\\' && i + 1 < input.length) {
+      i += 1;
+      delimiter += input[i];
+    } else if (/\s/.test(char) || ';&|()<>'.includes(char)) {
+      break;
+    } else {
+      delimiter += char;
+    }
+  }
+  return delimiter ? { delimiter, stripTabs } : null;
+}
+
+/** Where the bodies of `hereDocuments`, one after another from `from`, end:
+ *  past each one's delimiter line, or at the end of input. */
+function skipHereDocumentBodies(input: string, from: number, hereDocuments: readonly HereDocument[]): number {
+  let at = from;
+  for (const { delimiter, stripTabs } of hereDocuments) {
+    while (at < input.length) {
+      const newline = input.indexOf('\n', at);
+      const lineEnd = newline === -1 ? input.length : newline;
+      const line = input.slice(at, lineEnd);
+      at = lineEnd + 1;
+      if ((stripTabs ? line.replace(/^\t+/, '') : line) === delimiter) break;
+    }
+  }
+  return Math.min(at, input.length);
+}
+
 /** A word that opens a `name=(…)` / `name+=(…)` array assignment at its `(`. */
 const ARRAY_ASSIGNMENT_PREFIX = /^[A-Za-z_][A-Za-z0-9_]*\+?=$/;
 
@@ -1041,19 +1110,76 @@ function isEnvAssignment(token: string | undefined): boolean {
   return !!token && /^[A-Za-z_][A-Za-z0-9_]*=/.test(token);
 }
 
-const LIST_SEPARATORS = new Set(['&&', '||', ';', '&']);
+/** The operators that end a case item. */
+const CASE_ITEM_ENDS = new Set([';;', ';&', ';;&']);
+const LIST_SEPARATORS = new Set(['&&', '||', ';', '&', ...CASE_ITEM_ENDS]);
 /** The subshell and group operators `tokenizeCommand` emits; lexical only, so a
  *  group's inner list is split like any other. */
 const GROUPING_TOKENS = new Set(['(', ')', '{', '}']);
+/** Words that close a compound command. A segment one leads holds only that
+ *  command's redirections or pipeline (`done < list`, `fi | tee log`). */
+const CLOSING_WORDS = new Set(['done', 'fi', 'esac', '}', ')']);
+/** Words that open a compound command or one of its clauses, or negate: the
+ *  rest of their segment is the command they run. */
+const OPENING_WORDS = new Set(['if', 'elif', 'then', 'else', 'while', 'until', 'do', '!', '(', '{']);
+/** Loop headers: a name and a word list, never a command. */
+const LOOP_HEADERS = new Set(['for', 'select']);
+
+/**
+ * The simple commands of a list, in order, with the shell's grammar around them
+ * taken out: separators, grouping, a compound command's reserved words, a loop
+ * header, and a case item's pattern; a pipeline stays in one piece. Lexical,
+ * like the tokenizer, and a reserved word counts only where a command starts,
+ * so `for f in *; do make; done` and `if x; then make; fi` run `make`.
+ */
+function listCommands(tokens: readonly string[]): string[][] {
+  const commands: string[][] = [];
+  /** The next command starts with a case item's `pattern)`. */
+  let casePattern = false;
+  let segment: string[] = [];
+
+  const end = (): void => {
+    let words = segment;
+    segment = [];
+    if (words.length === 0) return;
+    if (CLOSING_WORDS.has(words[0]!)) {
+      if (words[0] === 'esac') casePattern = false;
+      return;
+    }
+    for (;;) {
+      if (words.length === 0) return;
+      const first = words[0]!;
+      if (OPENING_WORDS.has(first)) {
+        words = words.slice(1);
+      } else if (casePattern) {
+        casePattern = false;
+        const close = words.indexOf(')');
+        if (close === -1) break;
+        words = words.slice(close + 1);
+      } else if (first === 'case') {
+        // `case WORD in`, then the first item's pattern.
+        casePattern = true;
+        const inAt = words.indexOf('in', 2);
+        words = inAt === -1 ? [] : words.slice(inAt + 1);
+      } else if (LOOP_HEADERS.has(first)) {
+        return;
+      } else {
+        break;
+      }
+    }
+    commands.push(words.filter((token) => !GROUPING_TOKENS.has(token)));
+  };
 
-/** Tokens split into the commands of a list; a pipeline stays in one piece. */
-function splitCommandList(tokens: string[]): string[][] {
-  const segments: string[][] = [[]];
   for (const token of tokens) {
-    if (LIST_SEPARATORS.has(token)) segments.push([]);
-    else segments[segments.length - 1]!.push(token);
+    if (!LIST_SEPARATORS.has(token)) {
+      segment.push(token);
+      continue;
+    }
+    end();
+    if (CASE_ITEM_ENDS.has(token)) casePattern = true;
   }
-  return segments;
+  end();
+  return commands.filter((words) => words.length > 0);
 }
 
 interface FlagSpec {
diff --git a/lib/src/lib/watched-command-host.ts b/lib/src/lib/watched-command-host.ts
index 650ffddc6..09220191a 100644
--- a/lib/src/lib/watched-command-host.ts
+++ b/lib/src/lib/watched-command-host.ts
@@ -38,11 +38,12 @@ export class WatchedCommandHost {
     };
   }
 
-  /** The canonical set to every subscriber, once there is one: a snapshot
-   *  sent before any renderer seeded would replace their persisted rules. */
-  publish(): void {
+  /** The canonical set to every subscriber, or to `to` alone, once there is
+   *  one: a snapshot sent before any renderer seeded would replace their
+   *  persisted rules. */
+  publish(to?: (names: string[]) => void): void {
     if (!this.initialized) return;
     const names = this.target.getWatchedCommands();
-    for (const listener of this.listeners) listener(names);
+    for (const listener of to ? [to] : this.listeners) listener(names);
   }
 }
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index c76b6e7fc..9dab1c9c9 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -2,7 +2,7 @@
   "AGENTS.md": 3400,
   "SECURITY.md": 200,
   "SELF_HOST.md": 6100,
-  "docs/specs/alert.md": 7950,
+  "docs/specs/alert.md": 8050,
   "docs/specs/auto-update.md": 1150,
   "docs/specs/deploy.md": 1900,
   "docs/specs/dor-browser.md": 4550,
@@ -11,7 +11,7 @@
   "docs/specs/glossary.md": 2950,
   "docs/specs/hosted.md": 1100,
   "docs/specs/layout.md": 10350,
-  "docs/specs/mobile-terminal-ui.md": 2000,
+  "docs/specs/mobile-terminal-ui.md": 2050,
   "docs/specs/mouse-and-clipboard.md": 3750,
   "docs/specs/notepad.md": 3850,
   "docs/specs/pocket-app.md": 4900,
diff --git a/standalone/src-tauri/src/routing.rs b/standalone/src-tauri/src/routing.rs
index 513f5aaa3..6c58d5091 100644
--- a/standalone/src-tauri/src/routing.rs
+++ b/standalone/src-tauri/src/routing.rs
@@ -208,10 +208,11 @@ pub fn route<'a>(event: &str, data: &'a JsonValue, view: &RouteView<'a>) -> Rout
             Some(surface_id) => lookup(view.owners, surface_id),
             None => Route::Broadcast,
         },
-        // `alert:*` naming a window (an await's result) goes to it. One
-        // carrying an id is about one Session, and goes to the window showing
-        // it: after the mark the new owner's collection re-sends it (§Alerts).
-        // What carries neither — the two app-global stores — reaches everyone.
+        // `alert:*` naming a window (an await's result, a `sync`'s store
+        // snapshots) goes to it. One carrying an id is about one Session, and
+        // goes to the window showing it: after the mark the new owner's
+        // collection re-sends it (§Alerts). What carries neither — the two
+        // app-global stores' broadcasts — reaches everyone.
         _ if event.starts_with("alert:") => {
             if let Some(label) = str_field(data, "forWindow") {
                 return Route::EmitTo(label);
@@ -645,6 +646,12 @@ mod tests {
             ("pty:list", json!({"ptys":[]}), Route::Broadcast),
             ("alert:state", json!({"id":"a"}), Route::EmitTo("main")),
             ("alert:settings", json!({"speech":true}), Route::Broadcast),
+            // A `sync`'s snapshot answers only the window that asked.
+            (
+                "alert:settings",
+                json!({"settings":{},"forWindow":"ws-2"}),
+                Route::EmitTo("ws-2"),
+            ),
             // An await's result goes to the window that parked it, never to a
             // Session's owner.
             (
diff --git a/standalone/src/browser-sidecar-adapter.test.ts b/standalone/src/browser-sidecar-adapter.test.ts
index ec2ee0272..bb90642d1 100644
--- a/standalone/src/browser-sidecar-adapter.test.ts
+++ b/standalone/src/browser-sidecar-adapter.test.ts
@@ -111,6 +111,6 @@ describe("BrowserSidecarAdapter event stream", () => {
     send.mockClear();
 
     reconnect();
-    expect(send.mock.calls).toEqual([["alert_command", { payload: { op: "sync" } }]]);
+    expect(send.mock.calls).toEqual([["alert_command", { payload: { op: "sync", ids: [] } }]]);
   });
 });
diff --git a/vscode-ext/src/message-router.ts b/vscode-ext/src/message-router.ts
index 1ca8ac00a..a29b274a9 100644
--- a/vscode-ext/src/message-router.ts
+++ b/vscode-ext/src/message-router.ts
@@ -400,9 +400,13 @@ export function attachRouter(
    *  disposed: a realm's end answers what it parked synchronously. */
   const realm: AlertRealm = {
     answer: (result) => void post({ type: 'alert:awaitResult', ...result } satisfies ExtensionMessage),
-    resendStates: () => {
-      for (const id of ownedPtyIds) post({ type: 'alert:state', id, ...alertManager.getState(id) } satisfies ExtensionMessage);
+    resendStates: (ids) => {
+      for (const id of ids) {
+        if (ownedPtyIds.has(id)) post({ type: 'alert:state', id, ...alertManager.getState(id) } satisfies ExtensionMessage);
+      }
     },
+    resendWatchedCommands: (names) => void post({ type: 'alert:watchedCommands', names } satisfies ExtensionMessage),
+    resendSettings: (settings) => void post({ type: 'alert:settings', settings } satisfies ExtensionMessage),
   };
 
   function claim(id: string): void {
diff --git a/vscode-ext/test/message-router.test.ts b/vscode-ext/test/message-router.test.ts
index 44031b2f9..98befddb7 100644
--- a/vscode-ext/test/message-router.test.ts
+++ b/vscode-ext/test/message-router.test.ts
@@ -676,6 +676,32 @@ describe('engagement viewers', () => {
     expect(router.getAlertStates().get('pty-remote')?.todo).toBe(false);
   });
 
+  it('answers a sync with its own Sessions named and both stores, to that webview alone', () => {
+    const asking = fakeWebview();
+    const other = fakeWebview();
+    const first = router.attachRouter(asking.channel);
+    const second = router.attachRouter(other.channel);
+    try {
+      alert(asking, { op: 'initializeWatchedCommands', names: ['make'] });
+      alert(asking, { op: 'initializeSettings', settings: {} as never });
+      asking.send({ type: 'pty:spawn', id: 'pty-mine', options: { cwd: '/repo' } });
+      other.send({ type: 'pty:spawn', id: 'pty-theirs', options: { cwd: '/repo' } });
+      asking.posted.length = 0;
+      other.posted.length = 0;
+
+      alert(asking, { op: 'sync', ids: ['pty-mine', 'pty-theirs'] });
+      expect(asking.posted.map((message) => [message.type, (message as { id?: string }).id])).toEqual([
+        ['alert:state', 'pty-mine'],
+        ['alert:watchedCommands', undefined],
+        ['alert:settings', undefined],
+      ]);
+      expect(other.posted).toEqual([]);
+    } finally {
+      first.dispose();
+      second.dispose();
+    }
+  });
+
   it('stops engaging anything once its webview is disposed', () => {
     const webview = fakeWebview();
     const disposable = router.attachRouter(webview.channel);

From 7fce3be8ad84b270ae18c75515876812b8a765c7 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 24 Sep 2026 00:51:06 -0700
Subject: [PATCH 14/16] Fix review round 1: WATCHING key lexing, Client mouse
 input, deferral bound, hand-back ownership

- The command tokenizer keeps a redirection's `&` or `|` in its word
  (`2>&1`, `<&3`, `>|`, `&>`, `&>>`), reads `|&` and fish's `&|` as pipes,
  and drops a comment (`#` starting a word) through the end of its line; the
  watch key skips redirections, so `make 2>&1 | tee log`, `pnpm build &> log`
  and `claude # x; then deploy` key on the program they run.
- fish's grammar words are grammar: `end` closes, `and` / `or` / `not` /
  `begin` open, and a fish `case` line is patterns alone; POSIX's `case WORD`
  newline `in` still works.
- `isWatchKey` checks the drive prefix on the program only, so
  `npm run b:dev` keys `npm b:dev` instead of falling back to `npm`.
- A remote Client's write acknowledges only when it holds more than mouse
  reports, in both hosts, through `alertedPty.writeClientInput`.
- A held report whose deferral already came due rings on idle escalation
  instead of starting a fresh deferral ceiling.
- `hand_back` returns a transferring id to its source even after the target
  window's close dropped its owner; a killed id stays unowned.
- Drop the stale renderer-local episode claims; `AlertState.episode` is
  required. Restore the original inactivity-timeout helper copy.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwN55bUVmCNmPiX7vHGCVF
---
 docs/specs/alert.md                       |   8 +-
 docs/specs/alert.rationale.md             |   8 +-
 docs/specs/remote-api.md                  |   2 +-
 docs/specs/standalone.md                  |   3 +-
 docs/specs/terminal-state.md              |   2 +-
 docs/specs/terminal-state.rationale.md    |   2 +
 lib/src/components/SettingsDialog.tsx     |   3 +-
 lib/src/host/owner-pty.ts                 |  16 ++-
 lib/src/host/remote/sidecar-entry.test.ts |   8 ++
 lib/src/host/remote/sidecar-entry.ts      |   4 +-
 lib/src/lib/alert-engagement.test.ts      |  14 +++
 lib/src/lib/alert-manager.ts              |  19 ++--
 lib/src/lib/terminal-state.test.ts        |  54 +++++++++-
 lib/src/lib/terminal-state.ts             | 119 ++++++++++++++++------
 scripts/spec-word-budgets.json            |   2 +-
 standalone/src-tauri/src/lib.rs           |  48 +++++++--
 vscode-ext/src/message-router.ts          |   7 +-
 vscode-ext/test/message-router.test.ts    |   4 +-
 website/src/lib/tut-detector.test.ts      |   2 +-
 19 files changed, 248 insertions(+), 77 deletions(-)

diff --git a/docs/specs/alert.md b/docs/specs/alert.md
index bd21f8172..a718fbfec 100644
--- a/docs/specs/alert.md
+++ b/docs/specs/alert.md
@@ -36,7 +36,7 @@ Public `status` is a projection — first match wins:
 4. `COMMAND_EXIT_ARMED` if command-exit alerting is armed.
 5. Otherwise `WATCHING_DISABLED`.
 
-**Must identify each uninterrupted ringing interval with an `episode` id and start time.** Opening the ring creates it; the ring clearing ends it. A source joining an active ring joins its episode and never starts another delivery episode. **Never persist episodes.** Older host snapshots receive a renderer-local identity on their first ringing transition. Tests: `a second source joining mid-episode keeps the episode id` and `re-latching after the ring clears starts a new episode` in `lib/src/lib/alert-manager.test.ts`.
+**Must identify each uninterrupted ringing interval with an `episode` id and start time.** Opening the ring creates it; the ring clearing ends it. A source joining an active ring joins its episode and never starts another delivery episode. **Never persist episodes.** Tests: `a second source joining mid-episode keeps the episode id` and `re-latching after the ring clears starts a new episode` in `lib/src/lib/alert-manager.test.ts`.
 
 `awaited` sits beside `status`: true while at least one `dor await` is parked on the Session (Await). It is derived from live waiters and **never persisted**.
 
@@ -69,7 +69,7 @@ Three separate signals, never one lease (rationale):
 
 - **Must acknowledge at each gesture's handler, never in the passthrough entry the silent paths share.**
 - **Never treat terminal replies or mouse-only report chunks as keyboard input** (rationale).
-- **Must write all human-originated PTY input through `writeUserInput`**, the mobile input bar's included: it carries `userInput`, and **the host acknowledges it with input before the bytes reach the PTY**, in the one message (rationale). **A remote Client's write acknowledges the same way**, the Burrow having dropped a mirror's terminal replies.
+- **Must write all human-originated PTY input through `writeUserInput`**, the mobile input bar's included: it carries `userInput`, and **the host acknowledges it with input before the bytes reach the PTY**, in the one message (rationale). **A remote Client's write acknowledges the same way unless it holds only mouse reports**, the Burrow having dropped a mirror's terminal replies (rationale).
 - **Never create an Activity entry to acknowledge**, the host's one check, so a browser Surface keeps its own TODO.
 - **User input opens the echo window** (`cfg.alert.echoWindow`) even when acknowledging clears nothing, a helper's included. Output inside it is ignored entirely — detector, `outputSince`, the acknowledged state, awaits — and a completion inside it neither rings nor is held (rationale).
 
@@ -81,7 +81,7 @@ Every completion — a detector settle, a command finish, a direct notification,
 
 Claimants get first refusal per Session in registration order; the first to return `true` claims the event and the rest are not offered it. **A claimed event never rings, never sets TODO, and never stores an `ActivityNotification`** — it stops before the ring rules, where the echo window, holding, and the command-exit seen and minimum-runtime checks live.
 
-**Must hold a completion that would ring an engaged Session**: the sources it would raise and the richest detail (Clearing And TODO), repeated holds merging, never public. A deferred report that comes due while engaged is held too. **Presence lapsing `idle` with focus unchanged rings what was held**, each source by its unengaged path; any other end drops it — a user verb (Clearing And TODO), focus moving away, the viewer leaving, seeding, removal, or teardown (rationale). **Dropping on an explicit disengage may be a mistake** (rationale). Resumed watched work and rule removal withdraw a held `watching` source as they withdraw a ringing one (WATCHING Track).
+**Must hold a completion that would ring an engaged Session**: the sources it would raise and the richest detail (Clearing And TODO), repeated holds merging, never public. A deferred report that comes due while engaged is held too, and **never deferred again on escalation** (rationale). **Presence lapsing `idle` with focus unchanged rings what was held**, each source by its unengaged path; any other end drops it — a user verb (Clearing And TODO), focus moving away, the viewer leaving, seeding, removal, or teardown (rationale). **Dropping on an explicit disengage may be a mistake** (rationale). Resumed watched work and rule removal withdraw a held `watching` source as they withdraw a ringing one (WATCHING Track).
 
 With `deferAlertsUntilQuiet` enabled:
 
@@ -175,7 +175,7 @@ Source of truth: `awaitCompletion` in `lib/src/lib/alert-manager.ts`; `AlertComm
 
 Rules:
 
-- **The key is `commandWatchKey(rawCommandLine)`**: the last command of a list (`&&`, `||`, `;`, `&`, newline) and the first stage of its pipeline, grouping dropped, leading `VAR=value` words and transparent wrappers (`sudo`, `npx`, …) skipped, then argv[0]'s basename minus any launcher suffix (`docs/specs/terminal-state.md`). **Reserved words are grammar**: a leading `do`, `then`, `if`, `!`, … is stripped, a segment a closer (`done`, `fi`, `esac`) leads is skipped with its redirection or pipe, and a `for` header and case pattern are dropped, so `for f in *; do make; done` keys on `make` (rationale). **An unknown wrapper flag stops the skip**, keying the wrapper itself. **A script runner keys as `<runner> <script>`**, a leading `run` dropped, so `cd web && pnpm run dev` keys on `pnpm dev`; a script that is no valid key (a path) keys the runner (rationale). Where bash's `E` falls back to a line's first simple command (`docs/specs/terminal-escapes.md` → Shell-integration injection), that command keys. Pinned by `WATCHING key` in `lib/src/lib/terminal-state.test.ts`.
+- **The key is `commandWatchKey(rawCommandLine)`**: the last command of a list (`&&`, `||`, `;`, `&`, newline) and the first stage of its pipeline, grouping dropped, leading `VAR=value` words and transparent wrappers (`sudo`, `npx`, …) skipped, then argv[0]'s basename minus any launcher suffix (`docs/specs/terminal-state.md`). **Reserved words are grammar, fish's included**: a leading `do`, `then`, `if`, `!`, `and`, `not`, `begin`, … is stripped, a segment a closer (`done`, `fi`, `esac`, `end`) leads is skipped with its redirection or pipe, and a `for` header, a case pattern, and fish's `case` line are dropped, so `for f in *; do make; done` keys on `make` (rationale). **A redirection is never the program or a runner's script**, a separate target skipped with it (rationale). **An unknown wrapper flag stops the skip**, keying the wrapper itself. **A script runner keys as `<runner> <script>`**, a leading `run` dropped, so `cd web && pnpm run dev` keys on `pnpm dev`; a script that is no valid key (a path) keys the runner (rationale). Where bash's `E` falls back to a line's first simple command (`docs/specs/terminal-escapes.md` → Shell-integration injection), that command keys. Pinned by `WATCHING key` in `lib/src/lib/terminal-state.test.ts`.
 - **A rule covers a key it equals, and a bare runner rule covers every `<runner> <script>` key of that runner** (rationale). `watchRuleFor` is the one matcher, for WATCHING, rule-removal silencing, and the terminal context's row.
 - **Every command boundary resets the detector** — `commandStart`, `commandFinish`, `promptStart`, `promptEnd`, and PTY exit — even without a command watch. Pinned by `resets unwatched output history on %s without a command watch` in `lib/src/lib/alert-manager.test.ts`.
 - **Editing the rule set re-derives WATCHING across every live Session immediately**, never restarting the detector (rationale).
diff --git a/docs/specs/alert.rationale.md b/docs/specs/alert.rationale.md
index 68ec73974..58f1dc912 100644
--- a/docs/specs/alert.rationale.md
+++ b/docs/specs/alert.rationale.md
@@ -24,7 +24,7 @@
 
 **Why each VS Code webview is its own viewer.** The webviews share one manager. With one attention slot, a webview's window blur sent an id-less clear that wiped the attention another webview had just set, arming its running build (audit, 2026-09-23).
 
-**Why the reply classifier is the narrow one.** The prompt recorder filters every CSI/SS3 sequence because it cannot interpret them as command text. Reusing that filter here ignored real encoded keys, while its omission of DCS let device-query replies acknowledge background panes; regression tests reproduced both failures in September 2026. The narrower reply classifier already used for replay and untouched-session tracking separates keys from replies without changing live PTY forwarding. Mouse-only chunks need a separate guard: the narrower classifier does not include mouse encodings, and inside programs can request hover and wheel reports without a click. Those reports otherwise dismiss a ring and cancel its pending alarms. Actual clicks already acknowledge through the Pane's DOM handler.
+**Why the reply classifier is the narrow one.** The prompt recorder filters every CSI/SS3 sequence because it cannot interpret them as command text. Reusing that filter here ignored real encoded keys, while its omission of DCS let device-query replies acknowledge background panes; regression tests reproduced both failures in September 2026. The narrower reply classifier already used for replay and untouched-session tracking separates keys from replies without changing live PTY forwarding. Mouse-only chunks need a separate guard: the narrower classifier does not include mouse encodings, and inside programs can request hover and wheel reports without a click. Those reports otherwise dismiss a ring and cancel its pending alarms. Actual clicks already acknowledge through the Pane's DOM handler. A Client's write carries no mark — protocol-v1's `terminal.write` is bytes alone — so a Pocket scroll in tmux or `vim` cleared the ring and TODO until the host classified the bytes itself (review, 2026-09-24).
 
 **Why human input rides its write.** The echo of a keystroke comes back from the PTY within milliseconds, so the acknowledgement that opens the echo window has to be in effect before the bytes are written. As a separate command it would race the write across the host boundary, and an echo that won would count as the program working.
 
@@ -44,7 +44,7 @@
 
 **Why command finishes bypass animation deferral.** A shell-reported exit is a lifecycle event; animation detection is only a recent-output heuristic. Letting the heuristic overrule the event would add latency and let unrelated background output defer a certain completion indefinitely.
 
-**Why deferral has a ceiling.** Unbounded, it held an `OSC 9` behind any output that never went quiet for five seconds: a `watch -n1` pane redrawing once a second, or a dev server's heartbeat line every three seconds after its startup burst, deferred it indefinitely (audit probes, 2026-09-23). Thirty seconds is far past an agent's final spinner frames, which deferral exists to wait out, and short enough that a report behind a ticking clock still reaches its user.
+**Why deferral has a ceiling.** Unbounded, it held an `OSC 9` behind any output that never went quiet for five seconds: a `watch -n1` pane redrawing once a second, or a dev server's heartbeat line every three seconds after its startup burst, deferred it indefinitely (audit probes, 2026-09-23). Thirty seconds is far past an agent's final spinner frames, which deferral exists to wait out, and short enough that a report behind a ticking clock still reaches its user. An escalated hold that deferred again restarted the ceiling: an `OSC 9` deferred at 0 s, held when it came due at 30 s, and escalated at 45 s while the pane still animated rang near 75 s (review, 2026-09-24).
 
 **Why a deferred event is not dispatched again.** Claimants already had first refusal when the completion happened; re-offering it at quiet time would let a later-registered await consume history, and would report one completion twice.
 
@@ -84,7 +84,9 @@
 
 **Why the key is the last command of a list, past its wrappers.** The old key, argv[0] of the first simple command, named the set-up rather than the work: `cd web && pnpm dev` keyed on `cd`, `clear; claude` on `clear`, and `sudo make`, `time make`, `caffeinate -i claude` and `npx claude` on the wrapper, so a rule offered from those panes matched every other use of `cd` or `sudo` (audit, 2026-09-23). The last command of a list is the one still running when the line settles; a pipeline's first stage is the producer whose output the pane shows. An unknown wrapper flag keys the wrapper because guessing whether it swallowed the next word would key an argument as a program.
 
-**Why reserved words and here-documents are grammar.** Command lines keep their newlines and bash reports a whole history entry, so a compound entry's last word was its closer: `for f in *; do make; done` keyed on `done`, `if x; then make; fi` on `fi`, and `python3 - <<'EOF' … EOF` on its delimiter, splitting the script's own `&&` and `;` on the way (review, 2026-09-23). A rule offered from those panes matched nothing anyone runs. The body a loop or conditional runs is what the entry waits on, as a list's last command is; a closer's trailing `< list` or `| tee log` belongs to the whole compound command, whose producer is that body.
+**Why reserved words and here-documents are grammar.** Command lines keep their newlines and bash reports a whole history entry, so a compound entry's last word was its closer: `for f in *; do make; done` keyed on `done`, `if x; then make; fi` on `fi`, and `python3 - <<'EOF' … EOF` on its delimiter, splitting the script's own `&&` and `;` on the way (review, 2026-09-23). A rule offered from those panes matched nothing anyone runs. The body a loop or conditional runs is what the entry waits on, as a list's last command is; a closer's trailing `< list` or `| tee log` belongs to the whole compound command, whose producer is that body. fish ≥ 4 reports its command line too, so `while true; pnpm test; end` keyed on `end` — a rule matching every fish block — and `pnpm build; and pnpm start` on `and` (review, 2026-09-24).
+
+**Why a redirection is no word of the key.** `make > log` keyed `make >`, the operator read as a runner's script, and `make 2>&1`, its `&` kept whole, would have keyed `make 2>&1` (review, 2026-09-24).
 
 **Why runners key by script.** `pnpm dev` never finishes and `pnpm test` does; one `pnpm` rule rang for both, so watching a dev server's pane also rang every test run. `run` is dropped because `npm run test` and `npm test` are one script under two spellings.
 
diff --git a/docs/specs/remote-api.md b/docs/specs/remote-api.md
index f48678487..edadee613 100644
--- a/docs/specs/remote-api.md
+++ b/docs/specs/remote-api.md
@@ -360,7 +360,7 @@ The wire half, as new event names:
 { event: 'terminal.semantic'; data: TerminalSemanticEvent }
 ```
 
-`terminal.resize` lets an attached viewer show its own tether state instead of rendering garbled wrap until re-attach; `terminal.semantic` frees the attached pane's header from the coalesced `directory.snapshot` cadence. Acknowledgement rides the same stage — a `terminal.acknowledge` on touch, without which only a Client's write puts a ring out (`alertAcknowledge` is inert today).
+`terminal.resize` lets an attached viewer show its own tether state instead of rendering garbled wrap until re-attach; `terminal.semantic` frees the attached pane's header from the coalesced `directory.snapshot` cadence. Acknowledgement rides the same stage — a `terminal.acknowledge` on touch, without which only a Client's keystrokes put a ring out (`alertAcknowledge` is inert today).
 
 ### 6. Graded grants and layout mutations
 
diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index ecd1bd819..24b04207c 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -741,7 +741,8 @@ below reads that record rather than inferring itself from the suppression map.
 - **A refused arrival hands the shells back.** The target's `adopt_failed`
   (a `planArrival` timeout, a missing list, a mount error) and a target
   `Destroyed` with the arrival still queued both return `terminalIds` to the
-  source unsuppressed, drop the record, and emit `workspace-arrival-failed`; the
+  source unsuppressed (`a_target_closing_mid_arrival_hands_its_shells_back`),
+  drop the record, and emit `workspace-arrival-failed`; the
   source clears **transferring** and the Workspace is simply still there. With
   both ends gone the shells are reaped rather than left owned by a dead label.
 - **Must change transfer ownership and source routing under one routing lock**,
diff --git a/docs/specs/terminal-state.md b/docs/specs/terminal-state.md
index 9851220b8..deeab08bc 100644
--- a/docs/specs/terminal-state.md
+++ b/docs/specs/terminal-state.md
@@ -95,7 +95,7 @@ Source of truth: `cwdFromManualPath` in `lib/src/lib/terminal-state.ts`; `seedTe
 - `commandFinish` moves `currentCommand` to `lastCommand`, stores `event.finishedAt` (otherwise reducer time) and `exitCode`, snapshots the latest in-run OSC 0/2/9 title into `lastCommand.finalTerminalTitle` (titles older than `startedAt` or younger than `finishedAt` excluded), clears `currentCommand`, and sets `{ kind: "finished", exitCode }`. **With no `currentCommand` it only sets the activity**, never inventing a `lastCommand`.
 - `title` updates the per-source entry in `titleCandidates`. **Later OSC title events never erase earlier candidates from other sources.**
 
-Command-line tokenizing is dialect-free: **`\` escapes exactly the set `shellEscapePosix` writes** (`POSIX_ESCAPABLE` in `lib/src/lib/posix-escape.ts`; both halves pinned by `terminal-state.test.ts`). **A leading `&` is PowerShell's call operator, never a POSIX background suffix**, and is dropped rather than read as a boundary. **An unquoted newline separates commands like `;`**; a backslash-newline continues the line. **A here-document's body is skipped**: after an unquoted `<<` or `<<-` (not `<<<`), the lines through its delimiter, quotes removed and leading tabs stripped under `<<-`. **Grouping `(` `)` `{` `}` is dropped; a `$(…)`, `<(…)` or `>(…)` substitution or a `name=(…)` array is one word**, separators included. **An unquoted Windows path containing spaces stays split.** **A launcher suffix is not part of a program's name** — `npm.cmd` and `C:\tools\claude.exe` are `npm` and `claude` for the header, the WATCHING key, and the terminal context alike. Accepted: `foo.bat` and `foo.exe` in one directory cannot be watched separately. (rationale)
+Command-line tokenizing is dialect-free: **`\` escapes exactly the set `shellEscapePosix` writes** (`POSIX_ESCAPABLE` in `lib/src/lib/posix-escape.ts`; both halves pinned by `terminal-state.test.ts`). **A leading `&` is PowerShell's call operator, never a POSIX background suffix**, and is dropped rather than read as a boundary. **A redirection keeps its `&` or `|`** — `2>&1`, `<&3`, `>|`, `&>`, `&>>` separate nothing — and **`|&`, like fish's `&|`, is a pipe**. **An unquoted `#` starting a word comments out the rest of its line.** **An unquoted newline separates commands like `;`**; a backslash-newline continues the line. **A here-document's body is skipped**: after an unquoted `<<` or `<<-` (not `<<<`), the lines through its delimiter, quotes removed and leading tabs stripped under `<<-`. **Grouping `(` `)` `{` `}` is dropped; a `$(…)`, `<(…)` or `>(…)` substitution or a `name=(…)` array is one word**, separators included. **An unquoted Windows path containing spaces stays split.** **A launcher suffix is not part of a program's name** — `npm.cmd` and `C:\tools\claude.exe` are `npm` and `claude` for the header, the WATCHING key, and the terminal context alike. Accepted: `foo.bat` and `foo.exe` in one directory cannot be watched separately. (rationale)
 
 **`displayCommand` is a one-line, per-program summary of those tokens** — the program name plus a bounded argument count, suffixed `| ...` or ` ...` past a pipeline or compound boundary. Source of truth: `summarizeCommandLine` and `commandTitleTokens` in `lib/src/lib/terminal-state.ts`.
 
diff --git a/docs/specs/terminal-state.rationale.md b/docs/specs/terminal-state.rationale.md
index 28d9340d2..4c914f8ea 100644
--- a/docs/specs/terminal-state.rationale.md
+++ b/docs/specs/terminal-state.rationale.md
@@ -16,6 +16,8 @@ Native path payloads are not URLs: decoding `%20` or trimming edge spaces change
 
 **Why the tokenizer is dialect-free rather than shell-aware.** Matching `shellEscapePosix` exactly keeps POSIX escapes meaning what they meant while leaving a native Windows path with the separators the basename step splits on. The two halves disagreed once, about `~`: a path Dormouse itself had escaped rendered with a stray backslash in the pane header, hence `terminal-state.test.ts` → "command tokenizer dialects" pinning both directions character by character.
 
+**Why a redirection's `&` and a comment are lexed.** bash now reports its whole history line rather than `$BASH_COMMAND`, which strips comments, and WATCHING keys a list's last command, so a redirection's bare `&` and a comment's words decided the key: `make 2>&1 | tee build.log` keyed on `1`, and `claude # fix auth; then deploy` on `deploy` (review, 2026-09-24).
+
 **Why an unquoted Windows path with spaces stays split.** Which token ends the program name is undecidable without asking the filesystem, and the tokenizer has no filesystem.
 
 **What the launcher-suffix rule prevents.** PATHEXT gives one program several spellings (`npm`, `npm.cmd`, `npm.exe`); keying the header, WATCHING rule row, and terminal context on the suffixed name would split one program into two rules and let the three disagree about which is running.
diff --git a/lib/src/components/SettingsDialog.tsx b/lib/src/components/SettingsDialog.tsx
index 2194a1bb6..77f3259f9 100644
--- a/lib/src/components/SettingsDialog.tsx
+++ b/lib/src/components/SettingsDialog.tsx
@@ -200,8 +200,7 @@ export function SettingsDialog({ onClose }: { onClose: () => void }) {
           onCommit={(inactivityTimeoutMs) => updateAlertSettings({ inactivityTimeoutMs })}
         />
         <div className="mt-1 text-sm leading-relaxed text-muted">
-          You count as away after this long without typing, moving the mouse,
-          or scrolling in Dormouse.
+          User has walked away after this much inactivity.
         </div>
       </section>
 
diff --git a/lib/src/host/owner-pty.ts b/lib/src/host/owner-pty.ts
index 0e423095f..45116b8ce 100644
--- a/lib/src/host/owner-pty.ts
+++ b/lib/src/host/owner-pty.ts
@@ -12,6 +12,7 @@ import {
   type TerminalProtocolEvent,
 } from '../lib/terminal-protocol';
 import type { TerminalSemanticEvent } from '../lib/terminal-state';
+import { stripMouseReportsFromInput } from '../lib/terminal-report-filter';
 
 /**
  * What the process that owns a PTY does with it on behalf of its alerts, the
@@ -73,10 +74,19 @@ export interface PtyWriteTarget {
  * window before the program repaints (`docs/specs/alert.md` → Engagement).
  */
 export function alertedPty(alerts: AlertManager, pty: PtyWriteTarget) {
+  const write = (id: string, data: string, options: { paced?: boolean; userInput?: boolean } = {}): void => {
+    if (options.userInput) alerts.acknowledge(id, { input: true });
+    pty.write(id, data, options.paced ? { paced: true } : undefined);
+  };
   return {
-    write(id: string, data: string, options: { paced?: boolean; userInput?: boolean } = {}): void {
-      if (options.userInput) alerts.acknowledge(id, { input: true });
-      pty.write(id, data, options.paced ? { paced: true } : undefined);
+    write,
+    /**
+     * A remote Client's write, the Burrow having dropped a mirror's terminal
+     * replies: human input unless it holds only mouse reports, which a Client
+     * sends unmarked and the desktop never acknowledges.
+     */
+    writeClientInput(id: string, data: string): void {
+      write(id, data, { userInput: stripMouseReportsFromInput(data).length > 0 });
     },
     resize(id: string, cols: number, rows: number, repaint?: boolean): void {
       alerts.onResize(id);
diff --git a/lib/src/host/remote/sidecar-entry.test.ts b/lib/src/host/remote/sidecar-entry.test.ts
index 7465cbf23..87f4cc460 100644
--- a/lib/src/host/remote/sidecar-entry.test.ts
+++ b/lib/src/host/remote/sidecar-entry.test.ts
@@ -339,6 +339,14 @@ describe('PTYs', () => {
     expect(atWrite).toEqual([{ status: 'WATCHING_DISABLED', todo: false }]);
   });
 
+  // A phone's tap or scroll in tmux or vim reaches the PTY, as the desktop's does.
+  it.each(['\x1b[<64;10;5M', '\x1b[M`!!', '\x1b[64;10;5M'])('acknowledges nothing for a Client\'s mouse report %j', (report) => {
+    alerts.notifyFromProtocol('pty-1', REPORT);
+    bridge.provider.writePty('pty-1', report);
+    expect(written).toEqual([{ id: 'pty-1', data: report }]);
+    expect(alerts.getState('pty-1')).toMatchObject({ status: 'ALERT_RINGING', todo: true });
+  });
+
   it('gives a Client\'s repaint bounce the resize grace', () => {
     const onResize = vi.spyOn(alerts, 'onResize');
     bridge.provider.resizePty('pty-1', 80, 24, true);
diff --git a/lib/src/host/remote/sidecar-entry.ts b/lib/src/host/remote/sidecar-entry.ts
index 7379d02e4..45c3c0c4a 100644
--- a/lib/src/host/remote/sidecar-entry.ts
+++ b/lib/src/host/remote/sidecar-entry.ts
@@ -191,9 +191,7 @@ export function createSidecarSurfaceBridge(
   const pty = alertedPty(options.alerts, options.mgr);
 
   const { provider, notifyDirectoryChanged } = createAskSurfaceProvider(ask, {
-    // The Burrow has already dropped a mirror's terminal replies, so what
-    // reaches here is a human's input.
-    writePty: (ptyId, data) => pty.write(ptyId, data, { userInput: true }),
+    writePty: pty.writeClientInput,
     resizePty: pty.resize,
 
     streamPty(ptyId, sink) {
diff --git a/lib/src/lib/alert-engagement.test.ts b/lib/src/lib/alert-engagement.test.ts
index 7f2d5651e..b86c0fd35 100644
--- a/lib/src/lib/alert-engagement.test.ts
+++ b/lib/src/lib/alert-engagement.test.ts
@@ -174,6 +174,20 @@ describe('held completions', () => {
     expect(manager.getState(PANE)).toMatchObject({ status: 'ALERT_RINGING', notification: PERMISSION });
   });
 
+  // Its deferral already ran from the first report; escalating it must not start another.
+  it('rings a held report whose deferral came due while engaged, still animating', () => {
+    output(PANE, 3_000);
+    manager.notifyFromProtocol(PANE, PERMISSION);
+    output(PANE, 10_000);
+    engage(manager, PANE);
+    output(PANE, cfg.alert.deferCeiling);
+    expect(ringing(PANE)).toBe(false);
+
+    output(PANE, 5_000);
+    goIdle(manager, PANE);
+    expect(manager.getState(PANE)).toMatchObject({ status: 'ALERT_RINGING', notification: PERMISSION });
+  });
+
   it('acknowledging drops what was held and records it as answered', () => {
     manager.setWatchedCommands(['claude']);
     engage(manager, PANE);
diff --git a/lib/src/lib/alert-manager.ts b/lib/src/lib/alert-manager.ts
index 7251655ce..0f19c2aed 100644
--- a/lib/src/lib/alert-manager.ts
+++ b/lib/src/lib/alert-manager.ts
@@ -133,6 +133,9 @@ interface Ring extends SourceSet {
  */
 interface HeldCompletion extends SourceSet {
   detail: ActivityNotification;
+  /** Its report came due from an animation deferral: escalating rings it,
+   *  never defers it again. */
+  reportDeferred: boolean;
 }
 
 interface CommandExitWatch {
@@ -252,8 +255,8 @@ interface AwaitGroup {
 }
 
 export interface AlertState {
-  /** Live delivery identity; absent only on older host snapshots. */
-  episode?: AlertEpisode | null;
+  /** The ringing interval's delivery identity; null while not ringing. */
+  episode: AlertEpisode | null;
   status: SessionStatus;
   watchingEnabled: boolean;
   todo: TodoState;
@@ -594,7 +597,7 @@ export class AlertManager {
     deferrable = true,
   ): void {
     if (this.isEngaged(id)) {
-      this.hold(entry, source, detail);
+      this.hold(entry, source, detail, !deferrable);
     } else if (source === 'report' && deferrable) {
       this.deliverReport(id, entry, detail);
       return;
@@ -1193,15 +1196,17 @@ export class AlertManager {
     return Date.now() < entry.echoUntil;
   }
 
-  private hold(entry: AlertEntry, source: ListedRingSource | WatchingSource, detail: ActivityNotification): void {
-    const held = entry.held ??= { sources: [], watching: null, detail };
+  private hold(entry: AlertEntry, source: ListedRingSource | WatchingSource, detail: ActivityNotification, deferred: boolean): void {
+    const held = entry.held ??= { sources: [], watching: null, detail, reportDeferred: false };
     held.detail = richer(held.detail, detail);
+    held.reportDeferred ||= deferred;
     addSource(held, source);
   }
 
   /**
    * Presence lapsed from inactivity with focus unchanged: each held source takes
-   * the path it would have taken unengaged, with the richest held detail.
+   * the path it would have taken unengaged, with the richest held detail — a
+   * report whose deferral already came due skipping deferral.
    */
   private escalateHeld(id: string, entry: AlertEntry): void {
     const held = entry.held;
@@ -1209,7 +1214,7 @@ export class AlertManager {
     entry.held = null;
     if (held.watching !== null) this.holdOrDeliver(id, entry, held.watching, held.detail);
     for (const source of LISTED_RING_SOURCES) {
-      if (held.sources.includes(source)) this.holdOrDeliver(id, entry, source, held.detail);
+      if (held.sources.includes(source)) this.holdOrDeliver(id, entry, source, held.detail, !held.reportDeferred);
     }
   }
 
diff --git a/lib/src/lib/terminal-state.test.ts b/lib/src/lib/terminal-state.test.ts
index 32aa5b4d1..a24d7d44b 100644
--- a/lib/src/lib/terminal-state.test.ts
+++ b/lib/src/lib/terminal-state.test.ts
@@ -345,6 +345,16 @@ describe('command title summarizer', () => {
     expect(summarizeCommandLine('cat $(ls | head -1)')).toBe('cat $(ls | head -1)');
   });
 
+  it('drops a comment', () => {
+    expect(summarizeCommandLine('claude --resume # the auth fix')).toBe('claude --resume');
+    expect(summarizeCommandLine('echo a#b $#')).toBe('echo a#b $#');
+  });
+
+  it('keeps a redirection whole', () => {
+    expect(summarizeCommandLine('make 2>&1 | tee build.log')).toBe('make 2>&1 | ...');
+    expect(summarizeCommandLine('make >| build.log')).toBe('make >| build.log');
+  });
+
   it('keeps a summary on one line when an argument spans several', () => {
     expect(summarizeCommandLine('echo "one\ntwo"')).toBe('echo one two');
     expect(summarizeCommandLine('echo $(\n  date\n)')).toBe('echo $( date )');
@@ -401,6 +411,43 @@ describe('WATCHING key', () => {
     ['echo done', 'echo'],
     ['case $x in a|b) make;; esac', 'make'],
     ['case $x in\n  a)\n    make\n    ;;\n  (*) claude ;;\nesac', 'claude'],
+    ['case $x\nin a) make;; esac', 'make'],
+    // fish's grammar words, now that fish 4 reports its command line.
+    ['while true; pnpm test; end', 'pnpm test'],
+    ['begin pnpm test; end', 'pnpm test'],
+    ['pnpm build; and pnpm start', 'pnpm start'],
+    ['pnpm test; or echo fail', 'echo'],
+    ['not pnpm test', 'pnpm test'],
+    ['echo end', 'echo'],
+    ['switch $os\ncase Darwin\n  claude (cat prompt)\nend', 'claude'],
+    // A redirection's `&` or `|` is no separator; `|&` and fish's `&|` are pipes.
+    ['make 2>&1 | tee build.log', 'make'],
+    ['pnpm dev > out.log 2>&1', 'pnpm dev'],
+    ['echo hi >&2', 'echo'],
+    ['make <&3', 'make'],
+    ['pnpm build &> log', 'pnpm build'],
+    ['pnpm build &>> log', 'pnpm build'],
+    ['pnpm build&>log', 'pnpm build'],
+    ['make |& tee log', 'make'],
+    ['pnpm build &| tee log', 'pnpm build'],
+    // A comment is no command, but a `#` inside a word is no comment.
+    ['claude # fix auth; then deploy', 'claude'],
+    ['claude\t#x | y', 'claude'],
+    ['make;# then deploy', 'make'],
+    ['claude # a && b\npnpm dev', 'pnpm dev'],
+    ['cat <<EOF # x; y\na; b\nEOF', 'cat'],
+    ['pnpm dev &# note; claude', 'pnpm dev'],
+    ['x a#b; claude', 'claude'],
+    ['x ""#b; claude', 'claude'],
+    ['x \\ #b; claude', 'claude'],
+    ['claude "#"; make', 'make'],
+    // A redirection is never the program or a runner's script.
+    ['make > build.log', 'make'],
+    ['make >build.log all', 'make all'],
+    ['make &> build.log', 'make'],
+    ['make >| build.log', 'make'],
+    ['2>/dev/null make all', 'make all'],
+    ['make -f <(gen) all', 'make all'],
     // Transparent wrappers, with the flags they take.
     ['sudo make', 'make'],
     ['sudo -u root FOO=1 make install', 'make install'],
@@ -439,6 +486,7 @@ describe('WATCHING key', () => {
     ['npm run-script dev', 'npm dev'],
     ['npm test', 'npm test'],
     ['npm run --silent test:unit', 'npm test:unit'],
+    ['npm run b:dev', 'npm b:dev'],
     ['pnpm dev', 'pnpm dev'],
     ['pnpm run dev', 'pnpm dev'],
     ['pnpm -C web dev', 'pnpm dev'],
@@ -464,7 +512,7 @@ describe('WATCHING key', () => {
     expect(isWatchKey(expected)).toBe(true);
   });
 
-  it.each(['', '   ', '|', 'FOO=1', ';', '"my tool" --flag', 'done', 'fi', 'for f in *', 'case $x in'])('has no key for %j', (raw) => {
+  it.each(['', '   ', '|', 'FOO=1', ';', '"my tool" --flag', 'done', 'fi', 'end', 'for f in *', 'case $x in', '# pnpm dev; claude'])('has no key for %j', (raw) => {
     expect(commandWatchKey(raw)).toBeNull();
   });
 
@@ -479,8 +527,8 @@ describe('WATCHING key', () => {
   });
 
   it('accepts a bare name or exactly one runner and script', () => {
-    for (const key of ['claude', 'foo:bar', 'pnpm dev', 'npm test:unit']) expect(isWatchKey(key), key).toBe(true);
-    for (const key of ['', 'pnpm  dev', 'a b c', ' pnpm', 'pnpm ', 'npm.cmd test', 'npm.cmd', 'C:foo', 'pnpm C:x', 'make build/x', '/usr/bin/claude', 'a\tb']) {
+    for (const key of ['claude', 'foo:bar', 'pnpm dev', 'npm test:unit', 'npm b:dev']) expect(isWatchKey(key), key).toBe(true);
+    for (const key of ['', 'pnpm  dev', 'a b c', ' pnpm', 'pnpm ', 'npm.cmd test', 'npm.cmd', 'C:foo', 'C:foo dev', 'make build/x', '/usr/bin/claude', 'a\tb']) {
       expect(isWatchKey(key), key).toBe(false);
     }
   });
diff --git a/lib/src/lib/terminal-state.ts b/lib/src/lib/terminal-state.ts
index f4b342c68..510eea3ed 100644
--- a/lib/src/lib/terminal-state.ts
+++ b/lib/src/lib/terminal-state.ts
@@ -394,13 +394,14 @@ export function commandWatchKey(raw: string): string | null {
 /**
  * Whether `name` is a WATCHING key some command line can produce: a bare
  * program name, or exactly `<runner> <script>`. Neither part holds a path
- * separator or a Windows drive prefix, and the program never ends in a launcher
- * suffix — `commandProgramName` strips those.
+ * separator, and the program never starts with a Windows drive prefix or ends
+ * in a launcher suffix — `commandProgramName` strips those. A script may look
+ * like a drive prefix (`npm run b:dev`).
  */
 export function isWatchKey(name: string): boolean {
   const parts = name.split(' ');
-  if (parts.length > 2 || parts.some((part) => !part || /[\\/\s]|^[A-Za-z]:/.test(part))) return false;
-  return !WINDOWS_EXECUTABLE_SUFFIX.test(parts[0]!);
+  if (parts.length > 2 || parts.some((part) => !part || /[\\/\s]/.test(part))) return false;
+  return !/^[A-Za-z]:/.test(parts[0]!) && !WINDOWS_EXECUTABLE_SUFFIX.test(parts[0]!);
 }
 
 /**
@@ -902,7 +903,11 @@ function withRequiredHostPrefixes(
 /**
  * Split a command line into words, honoring quotes, POSIX backslash escapes,
  * and the pipeline/compound separators `| || && ; &` (and a case item's
- * `;; ;& ;;&`), which are emitted as their own tokens. An unquoted newline
+ * `;; ;& ;;&`), which are emitted as their own tokens; `|&`, and fish's `&|`,
+ * pipe both streams and are emitted as `|`. A redirection's `&` or `|` stays
+ * in its word — `2>&1`, `<&3`, `>|`, and `&>` / `&>>`, which start a word of
+ * their own — so none of them reads as a separator. An unquoted `#` starting a
+ * word comments out the rest of its line. An unquoted newline
  * separates commands like `;`, and a backslash-newline continues the line. A
  * here-document's body — the lines after an unquoted `<<` / `<<-`'s own line,
  * through the one equal to its delimiter word with quotes removed — is
@@ -930,9 +935,10 @@ function tokenizeCommand(input: string): string[] {
   let escaping = false;
   // Open parentheses of the substitution or array being read.
   let wordParens = 0;
-  // Whether the last character was an unquoted, unescaped `$`, `<` or `>`,
-  // which makes a `(` right after it open a substitution.
-  let substitutionPrefix = false;
+  // The last character when it was an unquoted, unescaped `$`, `<` or `>`: a
+  // `(` right after it opens a substitution, and an `&` right after a `<` or
+  // `>` (or a `|` after a `>`) belongs to that redirection.
+  let operatorPrefix: string | null = null;
   // Here-documents opened on the current line, whose bodies follow it in order.
   const hereDocuments: HereDocument[] = [];
 
@@ -944,8 +950,8 @@ function tokenizeCommand(input: string): string[] {
 
   for (let i = 0; i < input.length; i += 1) {
     const char = input[i];
-    const opensSubstitution = substitutionPrefix;
-    substitutionPrefix = false;
+    const prefix = operatorPrefix;
+    operatorPrefix = null;
 
     if (escaping) {
       current += char;
@@ -975,7 +981,7 @@ function tokenizeCommand(input: string): string[] {
       continue;
     }
     // A substitution or array is one word, through the `)` closing its first `(`.
-    if (wordParens > 0 || (char === '(' && (opensSubstitution || ARRAY_ASSIGNMENT_PREFIX.test(current)))) {
+    if (wordParens > 0 || (char === '(' && (prefix !== null || ARRAY_ASSIGNMENT_PREFIX.test(current)))) {
       if (char === '(') wordParens += 1;
       else if (char === ')') wordParens -= 1;
       current += char;
@@ -997,6 +1003,23 @@ function tokenizeCommand(input: string): string[] {
       tokens.push(char);
       continue;
     }
+    // `2>&1`, `<&3`, `>&-`, `>|`: the redirection it continues.
+    if ((char === '&' && (prefix === '<' || prefix === '>')) || (char === '|' && prefix === '>')) {
+      current += char;
+      continue;
+    }
+    // `&>` / `&>>` redirect both streams, a word of their own.
+    if (char === '&' && input[i + 1] === '>') {
+      push();
+      current = char;
+      continue;
+    }
+    if ((char === '|' && input[i + 1] === '&') || (char === '&' && input[i + 1] === '|')) {
+      push();
+      tokens.push('|');
+      i += 1;
+      continue;
+    }
     if (char === '&' && input[i + 1] === '&') {
       push();
       tokens.push('&&');
@@ -1022,13 +1045,20 @@ function tokenizeCommand(input: string): string[] {
       tokens.push(char);
       continue;
     }
+    // A `#` starting a word comments out the rest of its line.
+    if (char === '#' && current === '' && (i === 0 || /[\s;&|()]/.test(input[i - 1]!))) {
+      const newline = input.indexOf('\n', i);
+      if (newline === -1) break;
+      i = newline - 1;
+      continue;
+    }
     // `<<` or `<<-`, never the here-string `<<<`.
     if (char === '<' && input[i + 1] === '<' && input[i + 2] !== '<' && input[i - 1] !== '<') {
       const hereDocument = readHereDocumentDelimiter(input, i + 2);
       if (hereDocument) hereDocuments.push(hereDocument);
     }
     current += char;
-    substitutionPrefix = char === '$' || char === '<' || char === '>';
+    if (char === '$' || char === '<' || char === '>') operatorPrefix = char;
   }
 
   push();
@@ -1116,26 +1146,29 @@ const LIST_SEPARATORS = new Set(['&&', '||', ';', '&', ...CASE_ITEM_ENDS]);
 /** The subshell and group operators `tokenizeCommand` emits; lexical only, so a
  *  group's inner list is split like any other. */
 const GROUPING_TOKENS = new Set(['(', ')', '{', '}']);
-/** Words that close a compound command. A segment one leads holds only that
- *  command's redirections or pipeline (`done < list`, `fi | tee log`). */
-const CLOSING_WORDS = new Set(['done', 'fi', 'esac', '}', ')']);
-/** Words that open a compound command or one of its clauses, or negate: the
- *  rest of their segment is the command they run. */
-const OPENING_WORDS = new Set(['if', 'elif', 'then', 'else', 'while', 'until', 'do', '!', '(', '{']);
+/** Words that close a compound command, fish's `end` among them. A segment one
+ *  leads holds only that command's redirections or pipeline (`done < list`,
+ *  `fi | tee log`). */
+const CLOSING_WORDS = new Set(['done', 'fi', 'esac', 'end', '}', ')']);
+/** Words that open a compound command or one of its clauses, negate, or — fish's
+ *  `and` / `or` — chain: the rest of their segment is the command they run. */
+const OPENING_WORDS = new Set(['if', 'elif', 'then', 'else', 'while', 'until', 'do', '!', '(', '{', 'begin', 'and', 'or', 'not']);
 /** Loop headers: a name and a word list, never a command. */
 const LOOP_HEADERS = new Set(['for', 'select']);
 
 /**
  * The simple commands of a list, in order, with the shell's grammar around them
- * taken out: separators, grouping, a compound command's reserved words, a loop
- * header, and a case item's pattern; a pipeline stays in one piece. Lexical,
- * like the tokenizer, and a reserved word counts only where a command starts,
- * so `for f in *; do make; done` and `if x; then make; fi` run `make`.
+ * taken out: separators, grouping, a compound command's reserved words (POSIX
+ * and fish), a loop header, and a case item's pattern; a pipeline stays in one
+ * piece. Lexical, like the tokenizer, and a reserved word counts only where a
+ * command starts, so `for f in *; do make; done`, `if x; then make; fi` and
+ * fish's `while x; make; end` run `make`.
  */
 function listCommands(tokens: readonly string[]): string[][] {
   const commands: string[][] = [];
-  /** The next command starts with a case item's `pattern)`. */
-  let casePattern = false;
+  /** The next command starts with a case item's `pattern)`, or — after a line
+   *  `case WORD` — maybe with the `in` POSIX lets it put there. */
+  let caseNext: 'pattern' | 'in' | null = null;
   let segment: string[] = [];
 
   const end = (): void => {
@@ -1143,23 +1176,27 @@ function listCommands(tokens: readonly string[]): string[][] {
     segment = [];
     if (words.length === 0) return;
     if (CLOSING_WORDS.has(words[0]!)) {
-      if (words[0] === 'esac') casePattern = false;
+      if (words[0] === 'esac') caseNext = null;
       return;
     }
     for (;;) {
       if (words.length === 0) return;
       const first = words[0]!;
-      if (OPENING_WORDS.has(first)) {
+      if (caseNext === 'in') {
+        // Without it, the line was fish's `case PATTERN…`: patterns alone.
+        caseNext = first === 'in' ? 'pattern' : null;
+        if (caseNext !== null) words = words.slice(1);
+      } else if (OPENING_WORDS.has(first)) {
         words = words.slice(1);
-      } else if (casePattern) {
-        casePattern = false;
+      } else if (caseNext === 'pattern') {
+        caseNext = null;
         const close = words.indexOf(')');
         if (close === -1) break;
         words = words.slice(close + 1);
       } else if (first === 'case') {
         // `case WORD in`, then the first item's pattern.
-        casePattern = true;
         const inAt = words.indexOf('in', 2);
+        caseNext = inAt === -1 ? 'in' : 'pattern';
         words = inAt === -1 ? [] : words.slice(inAt + 1);
       } else if (LOOP_HEADERS.has(first)) {
         return;
@@ -1176,7 +1213,7 @@ function listCommands(tokens: readonly string[]): string[][] {
       continue;
     }
     end();
-    if (CASE_ITEM_ENDS.has(token)) casePattern = true;
+    if (CASE_ITEM_ENDS.has(token)) caseNext = 'pattern';
   }
   end();
   return commands.filter((words) => words.length > 0);
@@ -1313,8 +1350,26 @@ function wrappedCommandIndex(words: readonly string[], index: number): { index:
   return i < words.length ? { index: i, packageSpec: spec.packageSpec === true } : null;
 }
 
-/** One simple command's watch key: wrappers and assignments skipped, runners keyed by script. */
-function watchKeyOfCommand(words: readonly string[]): string | null {
+/** A redirection word: its operator after an optional fd (`2>&1`, `>log`), or
+ *  the operator alone, its target the next word. A `<(…)` / `>(…)`
+ *  substitution is a word, not one. */
+const REDIRECTION = /^\d*(?:&>>?|[<>]&|>\||<>|>>?|<<<|<<-?|<)(?!\()/;
+
+/** `words` without their redirections, each with its target. */
+function withoutRedirections(words: readonly string[]): string[] {
+  const kept: string[] = [];
+  for (let i = 0; i < words.length; i += 1) {
+    const word = words[i]!;
+    const operator = REDIRECTION.exec(word)?.[0];
+    if (operator === undefined) kept.push(word);
+    else if (operator === word) i += 1;
+  }
+  return kept;
+}
+
+/** One simple command's watch key: redirections, wrappers and assignments skipped, runners keyed by script. */
+function watchKeyOfCommand(command: readonly string[]): string | null {
+  const words = withoutRedirections(command);
   let index = 0;
   let packageSpec = false;
   for (;;) {
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index bac047cad..a8c03dbbe 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -29,7 +29,7 @@
   "docs/specs/standalone.md": 11900,
   "docs/specs/terminal-context.md": 1050,
   "docs/specs/terminal-escapes.md": 4000,
-  "docs/specs/terminal-state.md": 2500,
+  "docs/specs/terminal-state.md": 2550,
   "docs/specs/theme.md": 2200,
   "docs/specs/tiling-engine.md": 4650,
   "docs/specs/transport.md": 5500,
diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index 13305561f..616a914e9 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -204,8 +204,9 @@ impl WindowState {
         self.suppressed.store(routing.awaiting_replay.len(), Ordering::Relaxed);
     }
 
-    /// Give every id still owned back to `source` — an exited one too, since
-    /// only a kill drops ownership — suppressed behind a replay of its cut when
+    /// Give every id back to `source` that no kill dropped — an exited one too,
+    /// and one whose target window went away (`drop_window` drops its owner,
+    /// never its transfer records) — suppressed behind a replay of its cut when
     /// it has one, otherwise straight back. Returns the cuts it drained, by id.
     fn hand_back(&self, ids: &[String], source: &str) -> JsonValue {
         let mut routing = guard(&self.routing);
@@ -213,12 +214,12 @@ impl WindowState {
         for id in ids {
             let mark = routing.transfer_marks.remove(id);
             if let Some(mark) = mark { marks.insert(id.clone(), JsonValue::from(mark)); }
-            routing.marking.remove(id);
-            if let Some(owner) = routing.owners.get_mut(id) {
-                *owner = source.to_string();
-                if mark.is_some() { routing.awaiting_replay.insert(id.clone(), Instant::now()); }
-                else { routing.awaiting_replay.remove(id); }
-            }
+            let transferring = routing.marking.remove(id).is_some() || mark.is_some();
+            // A kill drops the owner and the transfer records alike.
+            if !transferring && !routing.owners.contains_key(id) { continue; }
+            routing.owners.insert(id.clone(), source.to_string());
+            if mark.is_some() { routing.awaiting_replay.insert(id.clone(), Instant::now()); }
+            else { routing.awaiting_replay.remove(id); }
         }
         self.suppressed.store(routing.awaiting_replay.len(), Ordering::Relaxed);
         JsonValue::Object(marks)
@@ -268,8 +269,9 @@ impl WindowState {
     /// ids it owned outright, which the caller reaps.
     fn drop_window(&self, label: &str) -> (Vec<routing::Arrival>, Vec<String>) {
         // Taken first, and their ids dropped from `owners` before `owned_by`
-        // reads it: an arriving shell belongs to its source again, and reaping
-        // it here would kill a terminal the source is still showing.
+        // reads it: an arriving shell belongs to its source again, which
+        // `hand_back` returns it to, and reaping it here would kill a terminal
+        // the source is still showing.
         let lost = {
             let mut arrivals = guard(&self.arrivals);
             arrivals.forget_deferred_close(label);
@@ -4756,6 +4758,32 @@ mod tests {
         );
     }
 
+    /// The target going away drops the arriving shells' owner so they are not
+    /// reaped with it; the hand-back must give them to the source again, or the
+    /// panes it still shows receive no output, exit or alert state. A shell
+    /// killed mid-transfer stays unowned.
+    #[test]
+    fn a_target_closing_mid_arrival_hands_its_shells_back() {
+        let windows = super::WindowState::default();
+        let ids = ["t1".to_string(), "t2".to_string(), "t3".to_string()];
+        for id in &ids { windows.mint(id, "main"); }
+        windows.begin_transfer(&ids, "main", "ws-2");
+        guard(&windows.routing).mark_transfer("t1", 42);
+        windows.forget_pty("t3");
+        let mut arrival = arrival_of("workspace-7", "main", "ws-2");
+        arrival.terminal_ids = ids.to_vec();
+        guard(&windows.arrivals).push(arrival);
+
+        let (lost, orphaned) = windows.drop_window("ws-2");
+        assert!(orphaned.is_empty());
+        assert_eq!(windows.hand_back(&lost[0].terminal_ids, "main")["t1"], 42);
+        let routing = guard(&windows.routing);
+        assert_eq!(routing.owners.get("t1").map(String::as_str), Some("main"));
+        assert!(routing.awaiting_replay.contains_key("t1"));
+        assert_eq!(routing.owners.get("t2").map(String::as_str), Some("main"));
+        assert!(!routing.owners.contains_key("t3"));
+    }
+
     #[test]
     fn a_pty_exit_keeps_its_cut_until_the_arrival_settles() {
         let windows = super::WindowState::default();
diff --git a/vscode-ext/src/message-router.ts b/vscode-ext/src/message-router.ts
index a29b274a9..2fd909eb4 100644
--- a/vscode-ext/src/message-router.ts
+++ b/vscode-ext/src/message-router.ts
@@ -115,12 +115,11 @@ configureBurrow({
 });
 
 /**
- * A remote Client's keystrokes, reaching this window's PTY from its own Burrow
- * or over the peer link from the broker's: a human's input like a webview's.
- * The Burrow has already dropped a mirror's terminal replies.
+ * A remote Client's input, reaching this window's PTY from its own Burrow or
+ * over the peer link from the broker's.
  */
 function writeClientInput(ptyId: string, data: string): void {
-  alertedPtys.write(ptyId, data, { userInput: true });
+  alertedPtys.writeClientInput(ptyId, data);
 }
 
 function resizeForClient(ptyId: string, cols: number, rows: number, repaint?: boolean): void {
diff --git a/vscode-ext/test/message-router.test.ts b/vscode-ext/test/message-router.test.ts
index 98befddb7..ba98e842d 100644
--- a/vscode-ext/test/message-router.test.ts
+++ b/vscode-ext/test/message-router.test.ts
@@ -671,8 +671,10 @@ describe('engagement viewers', () => {
     ptys.callbacks!.onData('pty-remote', REPORT);
     const atWrite: Array<string | undefined> = [];
     ptys.onWrite = (id) => void atWrite.push(status(id));
+    // A phone's scroll in tmux reaches the PTY, acknowledging nothing, as the desktop's does.
+    deps.writePty('pty-remote', '\x1b[<64;10;5M');
     deps.writePty('pty-remote', 'y');
-    expect(atWrite).toEqual(['WATCHING_DISABLED']);
+    expect(atWrite).toEqual(['ALERT_RINGING', 'WATCHING_DISABLED']);
     expect(router.getAlertStates().get('pty-remote')?.todo).toBe(false);
   });
 
diff --git a/website/src/lib/tut-detector.test.ts b/website/src/lib/tut-detector.test.ts
index 25f48b982..e5df1fe10 100644
--- a/website/src/lib/tut-detector.test.ts
+++ b/website/src/lib/tut-detector.test.ts
@@ -11,7 +11,7 @@ function activity(
   todo = false,
   watchingEnabled = status !== "WATCHING_DISABLED",
 ): ActivityState {
-  return { status, watchingEnabled, todo, notification: null, awaited: false };
+  return { episode: null, status, watchingEnabled, todo, notification: null, awaited: false };
 }
 
 function makeDetectorHarness(initialActivitySnapshot = new Map<string, ActivityState>()) {

From b0d6dd771c2fa49ce48bdbe7b3d7ed9ee7e2129b Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 24 Sep 2026 01:05:16 -0700
Subject: [PATCH 15/16] Make TODO a two-step: a ring never sets it, a look does

- Opening a ring no longer sets `todo`; the ring shows its own detail, and
  public `notification` is the ring's detail while ringing, else the TODO's.
- Acknowledging without input (click, Door, zoom, tap), dismissing (`a`), or
  `t` on a ringing Session turns the ring into a TODO carrying its detail;
  typing, a paste or drop, and the pill clear both. `t` on a standing TODO
  still turns it off.
- A withdrawal (await, resumed work, rule removal) takes only the ring and
  its detail; the prior-TODO restore machinery is gone. A dropped hold or
  deferral leaves no TODO.
- An unacknowledged ring persists as the TODO a look would leave, with its
  detail, within the strict-reader source allowlist.
- Specs, the VS Code README, the tutorial hint and detector comment, and the
  stories and fixtures that primed a fresh ring with TODO follow.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwN55bUVmCNmPiX7vHGCVF
---
 docs/specs/alert.md                           |  18 +--
 docs/specs/alert.rationale.md                 |   4 +-
 .../components/mobile-acknowledge.test.tsx    |   6 +-
 .../wall/AlertRingIndicator.test.tsx          |   2 +-
 lib/src/host/remote/sidecar-entry.test.ts     |   6 +-
 lib/src/lib/alert-engagement.test.ts          |   8 +-
 lib/src/lib/alert-manager.test.ts             | 105 +++++++++++-------
 lib/src/lib/alert-manager.ts                  |  90 +++++++--------
 lib/src/lib/platform/fake-adapter.test.ts     |   4 +-
 lib/src/lib/session-types.ts                  |   5 +-
 lib/src/lib/terminal-registry.alert.test.ts   |  22 ++--
 lib/src/stories/Baseboard.stories.tsx         |   2 +-
 lib/src/stories/Door.stories.tsx              |   3 +-
 .../stories/TerminalPaneHeader.stories.tsx    |   4 +-
 lib/src/stories/WorkspaceStrip.stories.tsx    |   2 +-
 scripts/spec-word-budgets.json                |   2 +-
 standalone/src/workspace-move.test.ts         |   2 +-
 vscode-ext/README.md                          |   2 +-
 website/src/lib/tut-detector.test.ts          |  14 +--
 website/src/lib/tut-detector.ts               |   4 +-
 website/src/lib/tut-items.ts                  |   2 +-
 21 files changed, 165 insertions(+), 142 deletions(-)

diff --git a/docs/specs/alert.md b/docs/specs/alert.md
index a718fbfec..dcc8212b3 100644
--- a/docs/specs/alert.md
+++ b/docs/specs/alert.md
@@ -40,7 +40,7 @@ Public `status` is a projection — first match wins:
 
 `awaited` sits beside `status`: true while at least one `dor await` is parked on the Session (Await). It is derived from live waiters and **never persisted**.
 
-**Persist only** `todo` and the sanitized `notification` (plus `status` for diagnostics). Every spawn starts the id's alert state over; **a cold restore carries those two on the pane's spawn** (`SpawnPtyOptions.alert`), seeded **before the PTY spawns**; a live resume keeps the host's. Restore **must not** recreate a ring, a progress cycle, or a command-exit arm. Pinned by `restores a pane's persisted TODO through its spawn` in `lib/src/lib/terminal-registry.alert.test.ts`. **Must read a notification this build cannot validate as none, keeping the pane** (pinned by `keeps a pane whose notification this build cannot read, seeding its TODO without the detail` in `lib/src/lib/session-restore.test.ts`), and **never write a source outside `STRICT_READER_NOTIFICATION_SOURCES`** until no strict pre-tolerant build reads the file (rationale). **WATCHING is never persisted per Session** — it is re-derived from the rule set below at the next command start. Replay filtering in `docs/specs/terminal-escapes.md` keeps old terminal output from firing notification side effects again.
+**Persist only** `todo` and the sanitized `notification` (plus `status` for diagnostics); **an unacknowledged ring persists as the TODO a look would leave**, with its detail (pinned by `persists an unacknowledged %s ring as the TODO a look would leave` in `lib/src/lib/alert-manager.test.ts`). Every spawn starts the id's alert state over; **a cold restore carries those two on the pane's spawn** (`SpawnPtyOptions.alert`), seeded **before the PTY spawns**; a live resume keeps the host's. Restore **must not** recreate a ring, a progress cycle, or a command-exit arm. Pinned by `restores a pane's persisted TODO through its spawn` in `lib/src/lib/terminal-registry.alert.test.ts`. **Must read a notification this build cannot validate as none, keeping the pane** (pinned by `keeps a pane whose notification this build cannot read, seeding its TODO without the detail` in `lib/src/lib/session-restore.test.ts`), and **never write a source outside `STRICT_READER_NOTIFICATION_SOURCES`** until no strict pre-tolerant build reads the file (rationale). **WATCHING is never persisted per Session** — it is re-derived from the rule set below at the next command start. Replay filtering in `docs/specs/terminal-escapes.md` keeps old terminal output from firing notification side effects again.
 
 **Must retain host Activity before xterm initialization and clear it on Session disposal.** Test: `preserves pre-registration activity through terminal creation and orphaning` in `lib/src/lib/terminal-registry.alert.test.ts`.
 
@@ -254,28 +254,28 @@ Source of truth: `dispatchCompletion` / `setViewer` / `formatCommandExitBody` in
 
 ## Clearing And TODO
 
-`todo` is a boolean reminder. **Every ring sets it the moment it opens, whatever its source**, recording the TODO and notification it found (rationale). Pinned by `a WATCHING ring sets TODO the moment it opens, with its own detail` in `lib/src/lib/alert-manager.test.ts`.
+`todo` is a boolean reminder. **A ring never sets it**: a look at a ring without typing turns it into a TODO carrying the ring's detail, and dealing with it — typing, the pill — clears it (rationale). **`notification` is the ring's detail while ringing, else the TODO's.** Pinned by `a %s ring shows its own detail and never sets TODO` and `acknowledging without input, dismissing, or toggling TODO on a %s ring leaves a TODO with its detail` in `lib/src/lib/alert-manager.test.ts`.
 
 **Detail follows one richness order:** a text report (`OSC 9`, `OSC 99`, `OSC 777`) > `COMMAND_EXIT` > `OSC 9;4` > `WATCHING` > `BEL`. A new ring shows its own detail; a source joining an active ring, a deferred notification, and an acknowledged receipt each replace the detail only at an equal or higher rank (rationale). Pinned by `detail joining a ring` in `lib/src/lib/alert-manager.test.ts`.
 
 | Verb | Effect |
 |---|---|
-| acknowledge without input (Engagement) | clears the ring; `todo` stays |
+| acknowledge without input (Engagement) | clears the ring, leaving `todo` on with its detail |
 | acknowledge with input — any keystroke, paste, or drop — or clear TODO (pill click) | clears the ring; `todo` off, notification dropped, even if already off |
-| dismiss (`a`, Pane Header) | clears the ring; `todo` stays. **With nothing ringing: no change, no notify, a deferred notification kept** |
-| toggle TODO (`t`) | clears the ring; `todo` flips, off dropping the notification |
+| dismiss (`a`, Pane Header) | clears the ring, leaving `todo` on with its detail. **With nothing ringing: no change, no notify, a deferred notification kept** |
+| toggle TODO (`t`) | clears the ring; `todo` flips, on keeping the ring's detail, off dropping the notification |
 | an await consumes a source (Await) | withdraws that source |
 | watched work resumes (WATCHING Track) | withdraws `watching` |
 | a rule stops covering the `watching` key | withdraws `watching` |
 
-- **The user verbs acknowledge; a withdrawal never does.** Each also drops whatever was held or deferred, except a dismiss with nothing ringing. A ring a withdrawal empties restores the TODO and notification it found.
+- **The user verbs acknowledge; a withdrawal never does.** Each also drops whatever was held or deferred, except a dismiss with nothing ringing, and **a dropped hold or deferral leaves no TODO**. A ring a withdrawal empties goes with its detail, leaving `todo` and its notification as they stood.
 - **Any keystroke into the pane clears TODO** (rationale).
 - **Never summon twice for an acknowledged state.** After a user verb clears a ring or drops a held completion, a report arriving before any output opens no ring: it sets `todo`, updates the notification, and publishes. Settles and exits ring as usual, and opening a ring or starting a command forgets the acknowledgement (rationale). Pinned by `a report about a state acknowledged by %s updates the TODO without summoning again` and `rings a report again once a command starts after the acknowledgement` in `lib/src/lib/alert-manager.test.ts`.
 - Command-mode `Enter` that only enters passthrough does not clear TODO.
 - Removing a WATCHING rule turns watching off wherever it matched. It does not stop the detector, nor clear a progress cycle or a command-exit arm.
 - Destroying the Session clears all alert, TODO, notification, held, progress, and command-exit state.
 
-Source of truth: `raiseRing` / `withdrawRingSource` / `clearRingForUser` in `lib/src/lib/alert-manager.ts`.
+Source of truth: `raiseRing` / `withdrawRingSource` / `clearRingForUser` / `ringToTodo` in `lib/src/lib/alert-manager.ts`; `toPersistedAlertState` in `lib/src/lib/session-types.ts`.
 
 ## Live Workspace transfer
 
@@ -414,7 +414,7 @@ The header shows a fixed-text `TODO` pill when `todo === true`, a hover/focus no
 - **`a` on the selected Pane in command mode dismisses a ringing Session and opens the terminal context, whatever the status; it never edits a WATCHING rule.**
 - **A WATCHING rule is created only in the terminal context** ("Watch all `<key>` commands"), which offers the row whenever a foreground command has a watch key — naming the bare runner rule instead when one already covers the running script — and removed there or in Settings. Removing it anywhere drops it for every Session running that command.
 - Right-click always opens the context. Pressing `t` toggles TODO.
-- **The mobile composition dismisses by acknowledgement alone** — a tap, or a keystroke that also clears TODO — and wears its ring as the alarm inset, never an icon (`docs/specs/mobile-terminal-ui.md`). In Pocket only the keystroke reaches the host, as a Client's write (Engagement); a Client cannot dismiss yet (`docs/specs/remote-api.md` → Future).
+- **The mobile composition dismisses by acknowledgement alone** — a tap, leaving a TODO, or a keystroke, clearing it — and wears its ring as the alarm inset, never an icon (`docs/specs/mobile-terminal-ui.md`). In Pocket only the keystroke reaches the host, as a Client's write (Engagement); a Client cannot dismiss yet (`docs/specs/remote-api.md` → Future).
 
 **Must keep context alert controls scoped to the source**, with TODO, running-command WATCHING, and notification detail. Settings owns the global watched-command list. **Must suppress helper alerting until promotion, including after exit**: no completion dispatch (await, ring, TODO, speech, push), protocol report, acknowledgement, or TODO control, and only the default state published. **A helper still tracks its command and feeds its detector**, so one promoted mid-command is WATCHING what it runs; promotion publishes that state and never replays a suppressed event (rationale). Pinned by `helper Sessions` in `lib/src/lib/alert-manager.test.ts`.
 
@@ -432,7 +432,7 @@ A Door is display-only for alert state:
 
 - show the TODO pill when `todo === true`
 - while ringing with no speech state, wear the ring `spoken` uses, unlabelled, named `needs attention`
-- while its Session is `speaking`, replace the compact TODO cluster with the explicit `SPEAKING` label and invert + pulse the whole Door — that state lasts one utterance. `spoken` persists until the ring clears, so it keeps a static high-contrast inset and adds a speaker icon *beside* the TODO pill instead of replacing it; those are the baseboard's persistent signals and **must not go dark for an unbounded window**
+- while its Session is `speaking`, replace the compact TODO cluster with the explicit `SPEAKING` label and invert + pulse the whole Door — that state lasts one utterance. `spoken` persists until the ring clears, so it keeps a static high-contrast inset and adds a speaker icon *beside* any TODO pill instead of replacing it; those are the baseboard's persistent signals and **must not go dark for an unbounded window**
 - do not expose a Door-specific alert menu
 - scrolled out of view, its overflow arrow carries its ring and TODO (`docs/specs/layout.md` → Baseboard responsive sizing)
 
diff --git a/docs/specs/alert.rationale.md b/docs/specs/alert.rationale.md
index 58f1dc912..d50be456b 100644
--- a/docs/specs/alert.rationale.md
+++ b/docs/specs/alert.rationale.md
@@ -64,7 +64,7 @@
 
 **Why the `watching` source is gated on output since it joined.** The source legitimately describes a long-running watched command going quiet — what `--until quiet` exists for — but it is an inference from silence, and a brief burst does not clear it when the peer starts talking again; consuming it mid-turn would make the documented `await && read` idiom read a half-drawn screen. The detector cannot stand in for `outputSince` because it never latches: it reports how output looks *now*, its post-output `NOTHING_TO_SHOW` window (`busyCandidateGap`) is longer than the two CLI round trips between a `dor send` and the await behind it, and a burst too sparse to confirm BUSY returns it there, so it would still read as settled.
 
-**Why an await never leaves a TODO.** TODO means a human owes this pane attention; after an await nobody does — a program asked to be told, was told, and acted. A stranded TODO also leaks: the last await of an orchestration would mark a fully handled event, and because TODO feeds the Workspace union, an orchestration awaiting across several panes would light the whole Workspace up. Before rings set TODO uniformly, the answer depended on a race: a report claimed by an await parked first left nothing, while the same report landing a moment before the await stranded its TODO (audit, 2026-09-23). Withdrawal now takes back the TODO the ring set, so both orders agree. A TODO from an *unrelated* earlier event is a different debt and stays owed.
+**Why an await never leaves a TODO.** TODO means a human owes this pane attention; after an await nobody does — a program asked to be told, was told, and acted. A stranded TODO also leaks: the last await of an orchestration would mark a fully handled event, and because TODO feeds the Workspace union, an orchestration awaiting across several panes would light the whole Workspace up. The answer once depended on a race: a report claimed by an await parked first left nothing, while the same report landing a moment before the await stranded its TODO (audit, 2026-09-23). A ring now sets no TODO, only a look does, so both orders agree. A TODO from an *unrelated* earlier event is a different debt and stays owed.
 
 **Why nothing quieter is substituted for the absorbed ring.** A receipt the human must clear by hand is the same noise in a smaller font, and forensics after a failure come from the pane's own scrollback anyway.
 
@@ -116,7 +116,7 @@
 
 **Why any keystroke clears TODO.** The rule was `Enter` only, and missed `Enter` sent as a win32-input-mode or kitty `CSI 13 u` sequence and a one-key answer such as `y`; it also read the renderer's copy of TODO before the attend it had just sent had come back, so a TODO that attend created survived the key (audit, 2026-09-23). Typing into the pane is dealing with it.
 
-**Why every ring sets TODO when it opens.** WATCHING rings used to create TODO only when attended or dismissed, while report and exit rings created it at once. Every verb then diverged by source: `t` on a ringing WATCHING pane turned TODO on and on a report ring turned it off; an `Enter` as the first key kept one and cleared the other; a restart dropped an unattended WATCHING ring without trace while a report ring came back as TODO (audit, 2026-09-23). Setting it at ring time makes the verbs identical. Recording the TODO the ring found lets a withdrawal take back only its own.
+**Why TODO waits for acknowledgement.** Every ring set TODO as it opened (audit, 2026-09-23), so the pill sat beside an alarm nobody had seen yet, and ringing and TODO said the same thing twice. The model is two steps (product decision, 2026-09-24): the ring summons; a look without typing turns it into a TODO, "seen, still owed"; dealing with it clears that. Before the audit, WATCHING rings made TODO only when attended while report and exit rings made it at once, so every verb diverged by source; one rule for every source keeps them identical. A restart writes an unacknowledged ring as the TODO a look would leave, so an unseen alarm is not lost. With no TODO of its own to take back, a withdrawal needs no record of what the ring found.
 
 **Why detail goes by richness.** The last writer used to win, with one special case keeping a report's text over an exit: an `OSC 9` reading `Build finished: 3 warnings` followed by a bell in the next PTY read showed `Terminal bell`, and `make; printf '\a'` showed `Terminal bell` over `make exited 2` (audit, 2026-09-23). One order covers every pair; equal ranks still take the newer text. A notification deferred behind animation used to be replaced by whatever came next, so the same bell in the next read replaced the message it followed; the deferral now keeps the richer of the two.
 
diff --git a/lib/src/components/mobile-acknowledge.test.tsx b/lib/src/components/mobile-acknowledge.test.tsx
index 13145201a..88516f3cc 100644
--- a/lib/src/components/mobile-acknowledge.test.tsx
+++ b/lib/src/components/mobile-acknowledge.test.tsx
@@ -58,7 +58,7 @@ function render(touchMode: MobileTerminalTouchMode): void {
 /** Ring the pane: a bell from the program. */
 function ring(): void {
   act(() => platform.sendOutput(PANE, '\x07'));
-  expect(getActivity(PANE)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
+  expect(getActivity(PANE)).toMatchObject({ status: 'ALERT_RINGING', todo: false });
 }
 
 beforeEach(() => {
@@ -104,7 +104,7 @@ const AWAY = { clientX: 10, clientY: 12 + (RADIUS_FADE_START + RADIUS_SELECT) /
 
 describe('mobile acknowledge', () => {
   it.each<MobileTerminalTouchMode>(['gestures', 'selection', 'cursor'])(
-    'a tap on the terminal puts out a ring and keeps its TODO in %s mode',
+    'a tap on the terminal turns a ring into a TODO in %s mode',
     (mode) => {
       render(mode);
       ring();
@@ -127,7 +127,7 @@ describe('mobile acknowledge', () => {
       press(ORIGIN, [AWAY, ORIGIN], ORIGIN);
       // Lifted away with no move reported between.
       press(ORIGIN, [], AWAY);
-      expect(getActivity(PANE)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
+      expect(getActivity(PANE)).toMatchObject({ status: 'ALERT_RINGING', todo: false });
     },
   );
 
diff --git a/lib/src/components/wall/AlertRingIndicator.test.tsx b/lib/src/components/wall/AlertRingIndicator.test.tsx
index 74dc378ec..7ece17684 100644
--- a/lib/src/components/wall/AlertRingIndicator.test.tsx
+++ b/lib/src/components/wall/AlertRingIndicator.test.tsx
@@ -130,7 +130,7 @@ describe('AlertRingIndicator', () => {
     ring(first);
     const before = ringLayer();
 
-    act(() => setTerminalActivity('pty-1', { status: 'ALERT_RINGING', episode: first, todo: true }));
+    act(() => setTerminalActivity('pty-1', { status: 'ALERT_RINGING', episode: first, awaited: true }));
     expect(ringLayer()).toBe(before);
 
     ring({ id: 'episode-2', startedAt: Date.now() });
diff --git a/lib/src/host/remote/sidecar-entry.test.ts b/lib/src/host/remote/sidecar-entry.test.ts
index 87f4cc460..401b73873 100644
--- a/lib/src/host/remote/sidecar-entry.test.ts
+++ b/lib/src/host/remote/sidecar-entry.test.ts
@@ -344,7 +344,7 @@ describe('PTYs', () => {
     alerts.notifyFromProtocol('pty-1', REPORT);
     bridge.provider.writePty('pty-1', report);
     expect(written).toEqual([{ id: 'pty-1', data: report }]);
-    expect(alerts.getState('pty-1')).toMatchObject({ status: 'ALERT_RINGING', todo: true });
+    expect(alerts.getState('pty-1')).toMatchObject({ status: 'ALERT_RINGING', todo: false });
   });
 
   it('gives a Client\'s repaint bounce the resize grace', () => {
@@ -721,7 +721,7 @@ describe('the sidecar host', () => {
     host.handleCommand('pty:input', { id: 'pty-1', data: '\x1b[I', paced: true });
     host.handleCommand('pty:input', { id: 'pty-1', data: 'y', userInput: true });
     expect(calls).toEqual([
-      { op: 'write', args: ['pty-1', '\x1b[I', { paced: true }], state: { status: 'ALERT_RINGING', todo: true } },
+      { op: 'write', args: ['pty-1', '\x1b[I', { paced: true }], state: { status: 'ALERT_RINGING', todo: false } },
       { op: 'write', args: ['pty-1', 'y', undefined], state: { status: 'WATCHING_DISABLED', todo: false } },
     ]);
   });
@@ -853,7 +853,7 @@ describe('the sidecar host', () => {
     host.handleCommand('pty:requestInit', { ids: ['ringing', 'flagged'], forWindow: 'main' });
     for (const line of out) after.realm.onEvent(line.event, line.data);
 
-    expect(after.seen.get('ringing')).toMatchObject({ status: 'ALERT_RINGING', todo: true });
+    expect(after.seen.get('ringing')).toMatchObject({ status: 'ALERT_RINGING', todo: false });
     expect(after.seen.get('flagged')).toMatchObject({ status: 'WATCHING_DISABLED', todo: true });
   });
 
diff --git a/lib/src/lib/alert-engagement.test.ts b/lib/src/lib/alert-engagement.test.ts
index b86c0fd35..49fea4988 100644
--- a/lib/src/lib/alert-engagement.test.ts
+++ b/lib/src/lib/alert-engagement.test.ts
@@ -113,7 +113,7 @@ describe('held completions', () => {
     expect(manager.getState(PANE).todo).toBe(false);
 
     goIdle(manager, PANE);
-    expect(manager.getState(PANE)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
+    expect(manager.getState(PANE)).toMatchObject({ status: 'ALERT_RINGING', todo: false });
   });
 
   it.each([
@@ -356,7 +356,7 @@ describe('walking away from a permission prompt', () => {
     replay(120_000);
     expect(manager.getState(PANE)).toMatchObject({
       status: 'ALERT_RINGING',
-      todo: true,
+      todo: false,
       notification: { body: 'Claude needs your permission' },
     });
   });
@@ -448,7 +448,7 @@ describe('a Claude Code turn', () => {
     run.to(ringAt - 1);
     expect(ringing(PANE)).toBe(false);
     run.to(ringAt);
-    expect(manager.getState(PANE)).toMatchObject({ status: 'ALERT_RINGING', todo: true, notification: FINISHED });
+    expect(manager.getState(PANE)).toMatchObject({ status: 'ALERT_RINGING', todo: false, notification: FINISHED });
     run.to(ringAt + 30_000);
     expect(episodes.size).toBe(1);
   });
@@ -479,6 +479,6 @@ describe('a Claude Code turn', () => {
     run.to(idleAt - 1);
     expect(manager.getState(PANE)).toMatchObject({ todo: false, notification: null });
     run.to(idleAt);
-    expect(manager.getState(PANE)).toMatchObject({ status: 'ALERT_RINGING', todo: true, notification: FINISHED });
+    expect(manager.getState(PANE)).toMatchObject({ status: 'ALERT_RINGING', todo: false, notification: FINISHED });
   });
 });
diff --git a/lib/src/lib/alert-manager.test.ts b/lib/src/lib/alert-manager.test.ts
index 6ddc65f5d..cea50a6ce 100644
--- a/lib/src/lib/alert-manager.test.ts
+++ b/lib/src/lib/alert-manager.test.ts
@@ -299,40 +299,50 @@ describe('AlertManager in isolation', () => {
     expect(manager.getState(id).status).toBe('ALERT_RINGING');
   }
 
-  it('a WATCHING ring sets TODO the moment it opens, with its own detail', () => {
-    const id = 'watching-sets-todo';
-    driveToRinging(id);
-    expect(manager.getState(id)).toMatchObject({
-      todo: true,
-      notification: { source: 'WATCHING', title: 'longtask went quiet', body: null },
-    });
+  /** The detail `ringFrom` raises from each source. */
+  const RING_DETAIL = {
+    watching: { source: 'WATCHING', title: 'longtask went quiet', body: null },
+    report: REPORT,
+    exit: { source: 'COMMAND_EXIT', title: 'Command finished', body: 'pnpm build exited 0' },
+  } as const;
+
+  it.each(['watching', 'report', 'exit'] as const)('a %s ring shows its own detail and never sets TODO', (source) => {
+    const id = `ring-no-todo-${source}`;
+    ringFrom(id, source);
+    expect(manager.getState(id)).toMatchObject({ todo: false, notification: RING_DETAIL[source] });
+
+    // A TODO already standing stays as it was, the ring showing its own detail.
+    const flagged = `ring-over-todo-${source}`;
+    manager.toggleTodo(flagged);
+    ringFrom(flagged, source);
+    expect(manager.getState(flagged)).toMatchObject({ todo: true, notification: RING_DETAIL[source] });
   });
 
-  /** The verbs that clear a ring and leave its TODO. */
-  const leaveTodoVerbs = {
+  /** The verbs that turn a ring into a TODO: a look without typing. */
+  const lookVerbs = {
     acknowledge: (id: string) => manager.acknowledge(id, { input: false }),
     dismissAlert: (id: string) => manager.dismissAlert(id),
+    toggleTodo: (id: string) => manager.toggleTodo(id),
   };
 
-  it.each(['watching', 'report', 'exit'] as const)('acknowledging without input or dismissing a %s ring leaves its TODO', (source) => {
-    for (const verb of ['acknowledge', 'dismissAlert'] as const) {
+  it.each(['watching', 'report', 'exit'] as const)('acknowledging without input, dismissing, or toggling TODO on a %s ring leaves a TODO with its detail', (source) => {
+    for (const verb of ['acknowledge', 'dismissAlert', 'toggleTodo'] as const) {
       const id = `ring-leaves-todo-${source}-${verb}`;
       ringFrom(id, source);
-      leaveTodoVerbs[verb](id);
-      expect(manager.getState(id)).toMatchObject({ episode: null, todo: true });
+      lookVerbs[verb](id);
+      expect(manager.getState(id)).toMatchObject({ episode: null, todo: true, notification: RING_DETAIL[source] });
       expect(manager.getState(id).status).not.toBe('ALERT_RINGING');
-      expect(manager.getState(id).notification).not.toBeNull();
     }
   });
 
-  it.each(['watching', 'report', 'exit'] as const)('typing, toggling, or clearing TODO on a %s ring turns it off with its detail', (source) => {
+  it.each(['watching', 'report', 'exit'] as const)('typing or clearing TODO on a %s ring leaves no TODO and no detail', (source) => {
     const verbs = {
       acknowledgeInput: (id: string) => manager.acknowledge(id, { input: true }),
-      toggleTodo: (id: string) => manager.toggleTodo(id),
       clearTodo: (id: string) => manager.clearTodo(id),
     };
-    for (const verb of ['acknowledgeInput', 'toggleTodo', 'clearTodo'] as const) {
+    for (const verb of ['acknowledgeInput', 'clearTodo'] as const) {
       const id = `todo-off-ringing-${source}-${verb}`;
+      manager.toggleTodo(id);
       ringFrom(id, source);
       verbs[verb](id);
       expect(manager.getState(id)).toMatchObject({ episode: null, todo: false, notification: null });
@@ -340,16 +350,28 @@ describe('AlertManager in isolation', () => {
     }
   });
 
-  it('an unattended WATCHING ring leaves its TODO across a restart, without its live-only detail', () => {
-    const id = 'watching-restart';
-    driveToRinging(id);
+  it('toggles a TODO that was already standing off when its ring is toggled', () => {
+    const id = 'toggle-ring-over-todo';
+    manager.toggleTodo(id);
+    ringFrom(id, 'report');
+    manager.toggleTodo(id);
+    expect(manager.getState(id)).toMatchObject({ episode: null, todo: false, notification: null });
+  });
+
+  it.each([
+    ['WATCHING', 'watching', null],
+    ['report', 'report', REPORT],
+  ] as const)('persists an unacknowledged %s ring as the TODO a look would leave', (_what, source, notification) => {
+    const id = `restart-${source}`;
+    ringFrom(id, source);
     const persisted = JSON.parse(JSON.stringify(toPersistedAlertState(manager.getState(id))));
-    expect(persisted).toEqual({ status: 'ALERT_RINGING', todo: true, notification: null });
+    // A WATCHING detail is live-only (`STRICT_READER_NOTIFICATION_SOURCES`).
+    expect(persisted).toEqual({ status: 'ALERT_RINGING', todo: true, notification });
 
     const restarted = new AlertManager();
     try {
       restarted.seed(id, persisted);
-      expect(restarted.getState(id)).toMatchObject({ episode: null, todo: true });
+      expect(restarted.getState(id)).toMatchObject({ status: 'WATCHING_DISABLED', episode: null, todo: true, notification });
     } finally {
       restarted.dispose();
     }
@@ -378,7 +400,7 @@ describe('AlertManager in isolation', () => {
     });
   });
 
-  it.each(['acknowledge', 'dismissAlert'] as const)(
+  it.each(['acknowledge', 'dismissAlert', 'toggleTodo'] as const)(
     'a report about a state acknowledged by %s updates the TODO without summoning again',
     (verb) => {
       // Claude Code: the turn settles and WATCHING rings; the user acknowledges
@@ -386,7 +408,7 @@ describe('AlertManager in isolation', () => {
       const id = `acknowledged-${verb}`;
       const episodes = collectEpisodes(manager, id);
       driveToRinging(id);
-      leaveTodoVerbs[verb](id);
+      lookVerbs[verb](id);
       vi.advanceTimersByTime(60_000);
 
       manager.notifyFromProtocol(id, { source: 'OSC 99', title: 'Claude Code', body: 'Claude is waiting for your input' });
@@ -436,7 +458,7 @@ describe('AlertManager in isolation', () => {
 
     expect(manager.getState(id)).toMatchObject({
       status: 'ALERT_RINGING',
-      todo: true,
+      todo: false,
       notification: { source: 'OSC 9', title: null, body: 'Build finished' },
     });
 
@@ -464,7 +486,7 @@ describe('AlertManager in isolation', () => {
 
     expect(manager.getState(id)).toMatchObject({
       status: 'ALERT_RINGING',
-      todo: true,
+      todo: false,
       notification: { source: 'BEL', title: 'Terminal bell', body: null },
     });
   });
@@ -486,7 +508,7 @@ describe('AlertManager in isolation', () => {
     manager.updateProtocolProgress(id, { state: 'clear', percent: null });
     expect(manager.getState(id)).toMatchObject({
       status: 'ALERT_RINGING',
-      todo: true,
+      todo: false,
       notification: { source: 'OSC 9;4', title: 'Progress complete', body: 'Progress 25%' },
     });
   });
@@ -592,7 +614,7 @@ describe('AlertManager in isolation', () => {
     vi.advanceTimersByTime(5_000);
     expect(manager.getState(id)).toMatchObject({
       status: 'ALERT_RINGING',
-      todo: true,
+      todo: false,
       notification: { source: 'OSC 9', title: null, body: 'Build finished' },
     });
   });
@@ -666,7 +688,7 @@ describe('AlertManager in isolation', () => {
     finishCommand(manager, id);
     expect(manager.getState(id)).toMatchObject({
       status: 'ALERT_RINGING',
-      todo: true,
+      todo: false,
       notification: { source: 'COMMAND_EXIT', title: 'Command finished', body: 'pnpm build exited 0' },
     });
   });
@@ -729,7 +751,7 @@ describe('AlertManager in isolation', () => {
     manager.onExit(id, 1);
     expect(manager.getState(id)).toMatchObject({
       status: 'ALERT_RINGING',
-      todo: true,
+      todo: false,
       notification: { source: 'COMMAND_EXIT', title: 'Command finished', body: 'exec pnpm build exited 1' },
     });
   });
@@ -897,6 +919,7 @@ describe('AlertManager in isolation', () => {
       status: 'WATCHING_DISABLED',
       watchingEnabled: false,
       todo: false,
+      notification: null,
     });
   });
 
@@ -1082,7 +1105,7 @@ describe('AlertManager in isolation', () => {
     expect(manager.getState(id)).toMatchObject({ todo: false, notification: null });
 
     vi.advanceTimersByTime(5_000);
-    expect(manager.getState(id)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
+    expect(manager.getState(id)).toMatchObject({ status: 'ALERT_RINGING', todo: false });
   });
 
   describe('defer terminal notifications until quiet', () => {
@@ -1108,7 +1131,7 @@ describe('AlertManager in isolation', () => {
       vi.advanceTimersByTime(1);
       expect(manager.getState(id)).toMatchObject({
         status: 'ALERT_RINGING',
-        todo: true,
+        todo: false,
         notification: { source: 'OSC 9', title: null, body: 'Done' },
       });
     });
@@ -1175,7 +1198,7 @@ describe('AlertManager in isolation', () => {
       finishCommand(manager, id);
       expect(manager.getState(id)).toMatchObject({
         status: 'ALERT_RINGING',
-        todo: true,
+        todo: false,
         notification: { source: 'COMMAND_EXIT', title: 'Command finished', body: 'pnpm build exited 0' },
       });
     });
@@ -1191,7 +1214,7 @@ describe('AlertManager in isolation', () => {
 
       expect(manager.getState(id)).toMatchObject({
         status: 'ALERT_RINGING',
-        todo: true,
+        todo: false,
         // Protocol detail is richer than the generic command-exit receipt.
         notification: { source: 'OSC 9', title: null, body: 'Build done' },
       });
@@ -1215,7 +1238,7 @@ describe('AlertManager in isolation', () => {
       vi.advanceTimersByTime(5_000);
       expect(manager.getState(id)).toMatchObject({
         status: 'ALERT_RINGING',
-        todo: true,
+        todo: false,
         notification: { source: 'OSC 9', title: null, body: 'Done' },
       });
     });
@@ -1549,7 +1572,7 @@ describe('AlertManager in isolation', () => {
       // Declined, so the ring rule still ran afterwards.
       expect(manager.getState(id)).toMatchObject({
         status: 'ALERT_RINGING',
-        todo: true,
+        todo: false,
         notification: { source: 'COMMAND_EXIT', title: 'Command finished', body: 'pnpm build exited 1' },
       });
     });
@@ -1610,9 +1633,9 @@ describe('AlertManager in isolation', () => {
       expect(await parked.promise).toMatchObject({ kind: 'resolved', cause: 'bell' });
 
       // Already latched when the await arrives: it resolves on the spot and
-      // withdraws the ring with the TODO it set.
+      // withdraws the ring, whose detail goes with it.
       manager.notifyFromProtocol('bell-first', { source: 'OSC 9', title: null, body: 'done' });
-      expect(manager.getState('bell-first')).toMatchObject({ status: 'ALERT_RINGING', todo: true });
+      expect(manager.getState('bell-first')).toMatchObject({ status: 'ALERT_RINGING', todo: false });
       const consumed = manager.awaitCompletion('bell-first', { until: 'quiet', timeoutMs: NEVER });
       expect(await consumed.promise).toEqual({ kind: 'resolved', cause: 'bell', waitedMs: 0 });
 
@@ -1626,10 +1649,9 @@ describe('AlertManager in isolation', () => {
       }
     });
 
-    it('resolves on a latched WATCHING ring and withdraws its TODO', async () => {
+    it('resolves on a latched WATCHING ring and withdraws it with its detail', async () => {
       const id = 'await-standing-quiet';
       driveToRinging(id);
-      expect(manager.getState(id).todo).toBe(true);
 
       const handle = manager.awaitCompletion(id, { until: 'quiet', timeoutMs: NEVER });
 
@@ -1646,7 +1668,6 @@ describe('AlertManager in isolation', () => {
       for (const until of ['quiet', 'exit'] as const) {
         const id = `await-standing-exit-${until}`;
         ringFrom(id, 'exit');
-        expect(manager.getState(id).todo).toBe(true);
 
         const handle = manager.awaitCompletion(id, { until, timeoutMs: NEVER });
 
@@ -1742,7 +1763,7 @@ describe('AlertManager in isolation', () => {
 
       expect(await outcome()).toBeNull();
       // The bell is the human's; only a command exit wakes this caller.
-      expect(manager.getState(id)).toMatchObject({ status: 'ALERT_RINGING', todo: true, awaited: true });
+      expect(manager.getState(id)).toMatchObject({ status: 'ALERT_RINGING', todo: false, awaited: true });
     });
 
     it('never acknowledges, so the next completion still rings the human', async () => {
diff --git a/lib/src/lib/alert-manager.ts b/lib/src/lib/alert-manager.ts
index 0f19c2aed..ff7368567 100644
--- a/lib/src/lib/alert-manager.ts
+++ b/lib/src/lib/alert-manager.ts
@@ -122,8 +122,8 @@ function noteOutput(set: SourceSet | null): void {
 /** The one ring latch a Session holds (`docs/specs/alert.md` -> Public State). */
 interface Ring extends SourceSet {
   episode: AlertEpisode;
-  /** What this ring found, restored whole when a withdrawal empties it. */
-  prior: { todo: TodoState; notification: ActivityNotification | null };
+  /** What it shows, and what the TODO a look turns it into keeps. */
+  detail: ActivityNotification;
 }
 
 /**
@@ -259,7 +259,9 @@ export interface AlertState {
   episode: AlertEpisode | null;
   status: SessionStatus;
   watchingEnabled: boolean;
+  /** Set by a look at a ring or by hand, never by a ring opening. */
   todo: TodoState;
+  /** The ring's detail while ringing, else the TODO's. */
   notification: ActivityNotification | null;
   /** At least one `dor await` is parked on this Session. Never persisted. */
   awaited: boolean;
@@ -291,6 +293,7 @@ interface AlertEntry {
   commandExitWatch: CommandExitWatch | null;
   pendingCommandLine: string | null;
   todo: TodoState;
+  /** The TODO's detail: null without one. A ring shows its own instead. */
   notification: ActivityNotification | null;
   /**
    * The terminal notification held behind animation, never public or
@@ -489,12 +492,12 @@ export class AlertManager {
 
   /**
    * Void the `watching` source whose key `voids` names, ringing or held alike,
-   * leaving the detector running. Never an acknowledgement: a ring left empty
-   * restores what it found, a hold left empty goes.
+   * leaving the detector running. Never an acknowledgement: a ring or a hold
+   * left empty goes, leaving no TODO.
    */
   private invalidateWatching(entry: AlertEntry, voids: (key: string) => boolean): void {
     const { ring, held } = entry;
-    if (ring?.watching && voids(ring.watching.key) && dropWatching(ring)) this.closeRing(entry, ring);
+    if (ring?.watching && voids(ring.watching.key) && dropWatching(ring)) entry.ring = null;
     if (held?.watching && voids(held.watching.key) && dropWatching(held)) entry.held = null;
   }
 
@@ -633,8 +636,8 @@ export class AlertManager {
    * instead of ringing anyone.
    *
    * Resolves immediately when the Session is already ringing, consuming only
-   * the one ring source it resolved on. That withdraws the TODO the ring
-   * itself set, never a TODO that was already there, and never acknowledges.
+   * the one ring source it resolved on. That never acknowledges, so it leaves
+   * no TODO and clears none.
    */
   awaitCompletion(id: string, options: AwaitOptions): AwaitHandle {
     if (this.inert(id)) return settledAwait({ kind: 'cancelled', waitedMs: 0 });
@@ -1029,9 +1032,9 @@ export class AlertManager {
 
   /**
    * The one path every ring takes (`docs/specs/alert.md` -> Clearing And TODO),
-   * whatever the source. Opening a ring starts an episode, sets TODO and shows
-   * its own detail; a source joining an active ring enriches that same
-   * summons, its detail shown only if at least as rich as what is shown.
+   * whatever the source. Opening a ring starts an episode and shows its own
+   * detail, leaving TODO alone; a source joining an active ring enriches that
+   * same summons, its detail shown only if at least as rich as what is shown.
    */
   private raiseRing(
     entry: AlertEntry,
@@ -1040,25 +1043,18 @@ export class AlertManager {
   ): void {
     let ring = entry.ring;
     if (ring === null) {
-      ring = {
-        episode: createAlertEpisode(),
-        sources: [],
-        watching: null,
-        prior: { todo: entry.todo, notification: entry.notification },
-      };
+      ring = { episode: createAlertEpisode(), sources: [], watching: null, detail };
       entry.ring = ring;
-      entry.todo = true;
-      entry.notification = detail;
       entry.ackedQuiet = false;
     } else {
-      entry.notification = richer(entry.notification, detail);
+      ring.detail = richer(ring.detail, detail);
     }
     addSource(ring, source);
   }
 
   /**
    * An await answers one source, taking it off the ring. Never an
-   * acknowledgement: a ring left empty restores what it found. Returns whether
+   * acknowledgement: a ring left empty goes, leaving no TODO. Returns whether
    * the source was there.
    */
   private withdrawRingSource(entry: AlertEntry, source: RingSource): boolean {
@@ -1073,32 +1069,34 @@ export class AlertManager {
       ring.sources = ring.sources.filter((candidate) => candidate !== source);
       empty = ring.sources.length === 0 && ring.watching === null;
     }
-    if (empty) this.closeRing(entry, ring);
+    if (empty) entry.ring = null;
     if (source === 'watching') this.answeredWatching(entry);
     return true;
   }
 
-  /** A ring left empty is withdrawn, restoring the TODO and notification it found. */
-  private closeRing(entry: AlertEntry, ring: Ring): void {
-    entry.ring = null;
-    entry.todo = ring.prior.todo;
-    entry.notification = ring.prior.notification;
-  }
-
   /**
    * A user verb stops the summons: the whole ring goes, with whatever was held
    * or deferred behind animation — a path that stops summoning the user must
    * never leave a timer that summons them a second later. TODO is the caller's
-   * to decide. Only clearing a ring or a hold records an acknowledgement.
+   * to decide, from the ring returned. Only clearing a ring or a hold records
+   * an acknowledgement.
    */
-  private clearRingForUser(entry: AlertEntry): void {
+  private clearRingForUser(entry: AlertEntry): Ring | null {
     this.clearDeferredNotification(entry);
-    const sets = [entry.ring, entry.held];
-    if (sets.every((set) => set === null)) return;
+    const { ring, held } = entry;
+    if (ring === null && held === null) return null;
     entry.ring = null;
     entry.held = null;
     entry.ackedQuiet = true;
-    if (sets.some((set) => set?.watching)) this.answeredWatching(entry);
+    if (ring?.watching || held?.watching) this.answeredWatching(entry);
+    return ring;
+  }
+
+  /** A look at a ring: it becomes a TODO, keeping its detail. */
+  private ringToTodo(entry: AlertEntry, ring: Ring | null): void {
+    if (ring === null) return;
+    entry.todo = true;
+    entry.notification = ring.detail;
   }
 
   /**
@@ -1168,11 +1166,11 @@ export class AlertManager {
 
   /**
    * A human interacted with the Session. Both kinds clear the ring and whatever
-   * it held or deferred, and mark the running command seen; `input` — keys, a
-   * paste, a drop, acknowledged as the host writes them — also turns TODO off
-   * and opens the echo window, a helper's included, since its detector runs.
-   * Never creates an entry: an id with none — a browser Surface — has nothing
-   * to clear.
+   * it held or deferred, and mark the running command seen; without `input` a
+   * cleared ring becomes a TODO, while `input` — keys, a paste, a drop,
+   * acknowledged as the host writes them — turns TODO off and opens the echo
+   * window, a helper's included, since its detector runs. Never creates an
+   * entry: an id with none — a browser Surface — has nothing to clear.
    */
   acknowledge(id: string, { input }: { input: boolean }): void {
     const entry = this.entries.get(id);
@@ -1184,7 +1182,7 @@ export class AlertManager {
       this.setTodoForUser(id, entry, false);
       return;
     }
-    this.clearRingForUser(entry);
+    this.ringToTodo(entry, this.clearRingForUser(entry));
     this.notify(id);
   }
 
@@ -1224,11 +1222,11 @@ export class AlertManager {
     const entry = this.entries.get(id);
     if (!entry) return;
 
-    // Dismissing a ring leaves its TODO behind, so the summons is not lost. A
+    // Dismissing a ring leaves a TODO behind, so the summons is not lost. A
     // Session with nothing ringing has nothing to dismiss, and must keep any
     // notification still deferred behind animation.
     if (entry.ring === null) return;
-    this.clearRingForUser(entry);
+    this.ringToTodo(entry, this.clearRingForUser(entry));
     this.notify(id);
   }
 
@@ -1245,12 +1243,14 @@ export class AlertManager {
     this.setTodoForUser(id, this.getOrCreateEntry(id), false);
   }
 
-  /** A TODO verb: off drops the notification, and either way the ring goes
-   *  with any deferred notification. `notify` dedupes unchanged state. */
+  /** A TODO verb: the ring goes with any deferred notification, on keeps the
+   *  ring's detail, and off drops the notification. `notify` dedupes unchanged
+   *  state. */
   private setTodoForUser(id: string, entry: AlertEntry, todo: TodoState): void {
+    const ring = this.clearRingForUser(entry);
+    if (todo) this.ringToTodo(entry, ring);
     entry.todo = todo;
     if (!todo) entry.notification = null;
-    this.clearRingForUser(entry);
     this.notify(id);
   }
 
@@ -1263,7 +1263,7 @@ export class AlertManager {
       status: this.getProjectedStatus(id, entry),
       watchingEnabled: this.isWatching(entry),
       todo: entry.todo,
-      notification: entry.notification,
+      notification: entry.ring?.detail ?? entry.notification,
       awaited: (this.awaits.get(id)?.waiters.size ?? 0) > 0,
       episode: entry.ring?.episode ?? null,
     };
diff --git a/lib/src/lib/platform/fake-adapter.test.ts b/lib/src/lib/platform/fake-adapter.test.ts
index a66e7af91..26a0b384d 100644
--- a/lib/src/lib/platform/fake-adapter.test.ts
+++ b/lib/src/lib/platform/fake-adapter.test.ts
@@ -76,7 +76,7 @@ describe('FakePtyAdapter', () => {
     expect(alertEvents.at(-1)).toMatchObject({
       id: 't1',
       status: 'ALERT_RINGING',
-      todo: true,
+      todo: false,
       notification: { source: 'OSC 9', title: null, body: 'Build finished' },
     });
   });
@@ -105,7 +105,7 @@ describe('FakePtyAdapter', () => {
     expect(alertEvents.at(-1)).toMatchObject({
       id: 't1',
       status: 'ALERT_RINGING',
-      todo: true,
+      todo: false,
       notification: { source: 'BEL', title: 'Terminal bell', body: null },
     });
   });
diff --git a/lib/src/lib/session-types.ts b/lib/src/lib/session-types.ts
index 14962e1da..df9fa432d 100644
--- a/lib/src/lib/session-types.ts
+++ b/lib/src/lib/session-types.ts
@@ -63,13 +63,14 @@ const STRICT_READER_NOTIFICATION_SOURCES: readonly ActivityNotificationSource[]
  * Narrow Activity down to what may reach disk. The parameter deliberately uses
  * the persisted shape: live `AlertState` is structurally assignable to it, and
  * this explicit projection keeps `JSON.stringify` from writing extra live or
- * stale fields (`docs/specs/alert.md` -> Public State, "Persist only").
+ * stale fields (`docs/specs/alert.md` -> Public State, "Persist only"). A ring
+ * no one has looked at is written as the TODO a look would have left.
  */
 export function toPersistedAlertState(state: PersistedAlertState): PersistedAlertState {
   const notification = state.notification ?? null;
   return {
     status: state.status,
-    todo: state.todo,
+    todo: state.todo || state.status === 'ALERT_RINGING',
     notification: notification !== null && STRICT_READER_NOTIFICATION_SOURCES.includes(notification.source)
       ? notification
       : null,
diff --git a/lib/src/lib/terminal-registry.alert.test.ts b/lib/src/lib/terminal-registry.alert.test.ts
index 733023255..d0e0da424 100644
--- a/lib/src/lib/terminal-registry.alert.test.ts
+++ b/lib/src/lib/terminal-registry.alert.test.ts
@@ -279,12 +279,13 @@ describe('terminal-registry alert behavior', () => {
 
   it('preserves pre-registration activity through terminal creation and orphaning', () => {
     const id = 'early-host-state';
-    setTerminalActivity(id, { status: 'ALERT_RINGING', episode: createAlertEpisode(), todo: true, awaited: true });
+    setTerminalActivity(id, { status: 'ALERT_RINGING', episode: createAlertEpisode(), awaited: true });
     const activity = getActivity(id);
     expect(getLivePersistedAlertState(id)).toBeNull();
 
     createSession(id);
     expect(getActivity(id)).toEqual(activity);
+    // A ring no one has looked at persists as the TODO a look would leave.
     expect(getLivePersistedAlertState(id)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
 
     unmountElement(id);
@@ -553,7 +554,7 @@ describe('terminal-registry alert behavior', () => {
     advance(3_000);
     expect(getActivity(id)).toMatchObject({
       status: 'ALERT_RINGING',
-      todo: true,
+      todo: false,
     });
   });
 
@@ -601,7 +602,7 @@ describe('terminal-registry alert behavior', () => {
     });
   });
 
-  it('Story 6: dismiss resets to NOTHING_TO_SHOW and keeps the TODO; can ring again later', () => {
+  it('Story 6: dismiss resets to NOTHING_TO_SHOW and leaves a TODO; can ring again over it', () => {
     const id = 'story-6';
     createSession(id);
     enableAlert(id);
@@ -625,7 +626,7 @@ describe('terminal-registry alert behavior', () => {
     });
   });
 
-  it('Story 7: toggling TODO on a ringing pane clears both, leaves alerts enabled', () => {
+  it('Story 7: toggling TODO on a ringing pane turns the ring into a TODO, leaves alerts enabled', () => {
     const id = 'story-7';
     createSession(id);
     enableAlert(id);
@@ -636,7 +637,7 @@ describe('terminal-registry alert behavior', () => {
     expect(getActivity(id)).toMatchObject({
       status: 'NOTHING_TO_SHOW',
       watchingEnabled: true,
-      todo: false,
+      todo: true,
     });
   });
 
@@ -761,7 +762,7 @@ describe('terminal-registry alert behavior', () => {
 
     expect(getActivity(id)).toMatchObject({
       status: 'ALERT_RINGING',
-      todo: true,
+      todo: false,
     });
   });
 
@@ -810,8 +811,9 @@ describe('terminal-registry alert behavior', () => {
     const id = 'story-14';
     createSession(id);
     enableAlert(id);
+    toggleSessionTodo(id);
     driveToRingingNeedsAttention(id);
-    expect(getActivity(id).todo).toBe(true);
+    expect(getActivity(id)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
 
     disposeSession(id);
     expect(getActivity(id)).toEqual(DEFAULT_ACTIVITY_STATE);
@@ -827,7 +829,7 @@ describe('terminal-registry alert behavior', () => {
 
     expect(getActivity(id)).toMatchObject({
       status: 'ALERT_RINGING',
-      todo: true,
+      todo: false,
     });
   });
 
@@ -957,7 +959,7 @@ describe('terminal-registry alert behavior', () => {
     const id = 'paste-acknowledges';
     createSession(id);
     fakePlatform.sendOutput(id, '\x07');
-    expect(getActivity(id)).toMatchObject({ status: 'ALERT_RINGING', todo: true });
+    expect(getActivity(id)).toMatchObject({ status: 'ALERT_RINGING', todo: false });
     await paste(id);
     expect(getActivity(id)).toMatchObject({ status: 'WATCHING_DISABLED', todo: false });
   });
@@ -1183,7 +1185,7 @@ describe('terminal-registry alert behavior', () => {
 
     expect(getActivity(id)).toMatchObject({
       status: 'ALERT_RINGING',
-      todo: true,
+      todo: false,
     });
   });
 
diff --git a/lib/src/stories/Baseboard.stories.tsx b/lib/src/stories/Baseboard.stories.tsx
index 037490897..3c41b4ecd 100644
--- a/lib/src/stories/Baseboard.stories.tsx
+++ b/lib/src/stories/Baseboard.stories.tsx
@@ -99,7 +99,7 @@ export const OneSpeakingDoor: Story = {
   },
   parameters: {
     ...withState(oneRingingDoorItems, {
-      p1: { status: 'ALERT_RINGING', todo: true },
+      p1: { status: 'ALERT_RINGING' },
     }),
     primedAlertSpeech: { p1: 'speaking' },
   },
diff --git a/lib/src/stories/Door.stories.tsx b/lib/src/stories/Door.stories.tsx
index dcb8b7e66..99f6d920c 100644
--- a/lib/src/stories/Door.stories.tsx
+++ b/lib/src/stories/Door.stories.tsx
@@ -86,7 +86,8 @@ export const Default: Story = {};
 export const Ringing: Story = { args: { status: 'ALERT_RINGING' } };
 export const TodoOnly: Story = { args: { todo: true } };
 export const TodoAndRinging: Story = { args: { todo: true, status: 'ALERT_RINGING' } };
-export const Speaking: Story = { args: { status: 'ALERT_RINGING', todo: true, speechState: 'speaking' } };
+export const Speaking: Story = { args: { status: 'ALERT_RINGING', speechState: 'speaking' } };
+// A TODO standing from before this ring: the speaker icon joins its pill.
 export const HasSpoken: Story = { args: { status: 'ALERT_RINGING', todo: true, speechState: 'spoken' } };
 export const LongTitleWithIndicators: Story = {
   args: {
diff --git a/lib/src/stories/TerminalPaneHeader.stories.tsx b/lib/src/stories/TerminalPaneHeader.stories.tsx
index e3b0e21e6..01dfd7f6a 100644
--- a/lib/src/stories/TerminalPaneHeader.stories.tsx
+++ b/lib/src/stories/TerminalPaneHeader.stories.tsx
@@ -528,7 +528,7 @@ export const ExtremelyNarrowControlsVisible: Story = {
   args: {
     width: 76,
   },
-  parameters: primedPane({ status: 'ALERT_RINGING', todo: true }),
+  parameters: primedPane({ status: 'ALERT_RINGING' }),
   play: assertPaneActions(['Zoom']),
 };
 
@@ -562,6 +562,6 @@ export const NarrowLongTitleControlsVisible: Story = {
   args: {
     width: 130,
   },
-  parameters: primedPane({ status: 'ALERT_RINGING', todo: true, userTitle: LONG_TITLE }),
+  parameters: primedPane({ status: 'ALERT_RINGING', userTitle: LONG_TITLE }),
   play: assertPaneActions(PANE_ACTIONS),
 };
diff --git a/lib/src/stories/WorkspaceStrip.stories.tsx b/lib/src/stories/WorkspaceStrip.stories.tsx
index d9cf891c5..4fcc6a793 100644
--- a/lib/src/stories/WorkspaceStrip.stories.tsx
+++ b/lib/src/stories/WorkspaceStrip.stories.tsx
@@ -76,7 +76,7 @@ export const Indicators: Story = {
         'builds-b': { todo: true },
         'agents-a': { todo: true },
         // The visible Workspace owes attention too, and still shows nothing.
-        'visible-a': { status: 'ALERT_RINGING', todo: true },
+        'visible-a': { status: 'ALERT_RINGING' },
       },
     },
   },
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index a8c03dbbe..8f9505eed 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -2,7 +2,7 @@
   "AGENTS.md": 3400,
   "SECURITY.md": 200,
   "SELF_HOST.md": 6100,
-  "docs/specs/alert.md": 8050,
+  "docs/specs/alert.md": 8150,
   "docs/specs/auto-update.md": 1150,
   "docs/specs/deploy.md": 1900,
   "docs/specs/dor-browser.md": 4550,
diff --git a/standalone/src/workspace-move.test.ts b/standalone/src/workspace-move.test.ts
index 6e67098f4..ae2e234ff 100644
--- a/standalone/src/workspace-move.test.ts
+++ b/standalone/src/workspace-move.test.ts
@@ -795,7 +795,7 @@ describe("the target half", () => {
     const episode = createAlertEpisode();
     const platform = fakePlatform([], {
       beforeReplay: () => setTerminalActivity("pane-a", {
-        status: "ALERT_RINGING", todo: true, episode, notification: { source: "OSC 9", title: "Done", body: null },
+        status: "ALERT_RINGING", episode, notification: { source: "OSC 9", title: "Done", body: null },
       }),
     });
     const kill = vi.spyOn(platform, "killPty");
diff --git a/vscode-ext/README.md b/vscode-ext/README.md
index 3f75b0790..4ef26dddd 100644
--- a/vscode-ext/README.md
+++ b/vscode-ext/README.md
@@ -40,7 +40,7 @@ Dormouse never guesses which commands deserve an alert. Watching is a rule you c
 
 A ringing pane is outlined and washed in the alarm color until you answer it, so one glance across a full wall finds it. Clicking or typing into the pane — or pressing `a` — puts the alarm out. Nothing rings while you are working in that pane; if you walk away from it instead, it rings then.
 
-Whichever way a pane rings, the ring becomes a **TODO** — a marker beside the pane's title that outlives the alert, so a ring you dismissed does not disappear without a trace. Clear it by typing into the pane, clicking it, or pressing `t` in command mode.
+An alarm you look at without typing — a click, `a` — becomes a **TODO**, a marker beside the pane's title, so a ring you dismissed does not disappear without a trace. Typing into the pane deals with it, clearing both. Clear a TODO by typing into the pane, clicking the marker, or pressing `t` in command mode. An alarm nobody looked at comes back after a restart as a TODO.
 
 Spoken alarms use your browser or system voice today. An optional [managed ElevenLabs voice](https://dormouse.sh/hosted/#voice) is coming for people who want something more natural without managing a separate voice account.
 
diff --git a/website/src/lib/tut-detector.test.ts b/website/src/lib/tut-detector.test.ts
index e5df1fe10..deaeddfad 100644
--- a/website/src/lib/tut-detector.test.ts
+++ b/website/src/lib/tut-detector.test.ts
@@ -181,18 +181,18 @@ describe("TutDetector", () => {
     expect(state.isComplete("al-ring")).toBe(true);
   });
 
-  it("credits al-todo-auto when a ring is dismissed and its TODO stays", () => {
+  it("credits al-todo-auto when a dismissed ring leaves a TODO behind", () => {
     const { state, setActivitySnapshot } = makeDetectorHarness();
     const watching = { source: "WATCHING", title: "longtask went quiet", body: null } as const;
 
     setActivitySnapshot(new Map([["pane-a", activity("BUSY")]]));
-    // The ring sets TODO itself as it opens.
-    setActivitySnapshot(new Map([["pane-a", { ...activity("ALERT_RINGING", true), notification: watching }]]));
+    setActivitySnapshot(new Map([["pane-a", { ...activity("ALERT_RINGING"), notification: watching }]]));
     expect(state.isComplete("al-todo-auto")).toBe(false);
-    expect(state.isComplete("al-todo-manual")).toBe(false);
 
+    // The look turns the ring into a TODO carrying its detail: not a hand-added one.
     setActivitySnapshot(new Map([["pane-a", { ...activity("NOTHING_TO_SHOW", true), notification: watching }]]));
     expect(state.isComplete("al-todo-auto")).toBe(true);
+    expect(state.isComplete("al-todo-manual")).toBe(false);
   });
 
   it("credits al-watch-cmd once a rule exists", () => {
@@ -289,18 +289,16 @@ describe("TutDetector", () => {
     setActivitySnapshot(new Map([["pane-a", activity("WATCHING_DISABLED", false, false)]]));
     setActivitySnapshot(new Map([
       ["pane-a", {
-        ...activity("ALERT_RINGING", true, false),
+        ...activity("ALERT_RINGING", false, false),
         notification: { source: "OSC 777", title: "Build finished", body: "3 packages" },
       }],
     ]));
     expect(state.isComplete("al-notif")).toBe(true);
     expect(state.isComplete("al-cmd-exit")).toBe(false);
-    // The ring set TODO itself, so this is not a hand-added one.
-    expect(state.isComplete("al-todo-manual")).toBe(false);
 
     setActivitySnapshot(new Map([
       ["pane-a", {
-        ...activity("ALERT_RINGING", true, false),
+        ...activity("ALERT_RINGING", false, false),
         notification: { source: "COMMAND_EXIT", title: "Command finished", body: "slowbuild exited 0" },
       }],
     ]));
diff --git a/website/src/lib/tut-detector.ts b/website/src/lib/tut-detector.ts
index c2503ae27..32cb149cc 100644
--- a/website/src/lib/tut-detector.ts
+++ b/website/src/lib/tut-detector.ts
@@ -229,8 +229,8 @@ export class TutDetector {
         else if (TERMINAL_REPORT_SOURCES.has(source)) this.state.markComplete("al-notif");
       }
 
-      // Every ring sets TODO when it opens, so the dismissal is the ring
-      // ending with that TODO still standing.
+      // A look without typing turns a ring into a TODO, so the dismissal is
+      // the ring ending with a TODO standing.
       if (prev.status === "ALERT_RINGING" && current.status !== "ALERT_RINGING" && current.todo) {
         this.state.markComplete("al-todo-auto");
       }
diff --git a/website/src/lib/tut-items.ts b/website/src/lib/tut-items.ts
index c53380279..d2bcd6f90 100644
--- a/website/src/lib/tut-items.ts
+++ b/website/src/lib/tut-items.ts
@@ -229,7 +229,7 @@ export const DESKTOP_SECTIONS: readonly Section[] = [
       {
         id: 'al-notif',
         title: 'A program can ring on its own',
-        hint: 'Press `n` for a fake build that sends a notification. This needs no rule at all — any program that emits `BEL`, `OSC 9`, `OSC 777`, or `OSC 99` rings, and its message shows on the TODO tag.',
+        hint: 'Press `n` for a fake build that sends a notification. This needs no rule at all — any program that emits `BEL`, `OSC 9`, `OSC 777`, or `OSC 99` rings, and once you look its message stays on the TODO tag.',
       },
       {
         id: 'al-cmd-exit',

From 4b7ab52951a79d5909023662461afc021a7169c6 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 24 Sep 2026 01:16:28 -0700
Subject: [PATCH 16/16] Restore the "if not attended" alarm switch labels

The product owner prefers the shorter labels even though the gates are
more specific (speech: not engaged with that pane; push: away from every
viewer); the spec no longer claims the labels name their gates.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwN55bUVmCNmPiX7vHGCVF
---
 docs/specs/alert.md                   | 1 -
 lib/src/components/Baseboard.test.tsx | 4 ++--
 lib/src/components/SettingsDialog.tsx | 4 ++--
 3 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/docs/specs/alert.md b/docs/specs/alert.md
index dcc8212b3..1df493cc7 100644
--- a/docs/specs/alert.md
+++ b/docs/specs/alert.md
@@ -366,7 +366,6 @@ Reached from the baseboard sliders; `docs/specs/layout.md` owns placement. The a
 - **Must toggle only the clicked baseboard alarm setting**, as an override for that Workspace, showing the effective value. Components without a Workspace scope edit application defaults. **Must show its shared settings section for 2 seconds, then fade for 250ms**, anchored to the button and bounded by the viewport. The preview is inert, announces the resulting state, preserves keyboard focus and command dispatch, and omits test actions. Each click replaces the preview and restarts its lifetime; opening Settings or unmounting clears it. Reduced motion skips the fade. Pinned by `Baseboard.test.tsx`.
 - Lists every watched command with a remove control, and **cannot add one** — WATCHING is keyed on a running command's watch key, so creating a rule stays the terminal context of a Pane running it, and the empty state says so. **It is the only place a rule set on a since-closed Pane can be removed**, the terminal context reaching only the command its own Pane is running.
 - The watcher group carries the **Defer alerts until animation stops** switch and explains that a fully armed watcher delays terminal notifications and withdraws a ring once watched work resumes.
-- Each sink's switch names its gate: not looking at that pane, or away from Dormouse.
 - **Delays are committed on blur or `Enter`, never per keystroke** — typing `3` on the way to `30` must not briefly install a 3-second timer. They are shown in seconds; an out-of-range or empty entry snaps back to whatever the store clamped it to.
 - **The push group's device line names every device a push would reach**, and otherwise says why there is none — no Burrow enrolled, nothing subscribed yet, or the server could not be asked (rationale).
 - **Must separate application defaults from this Workspace’s overrides** and offer per-field inheritance plus reset-all. The local voice picker follows engine voice availability. Pinned by `lib/src/components/WorkspaceAlarmSettings.test.tsx`.
diff --git a/lib/src/components/Baseboard.test.tsx b/lib/src/components/Baseboard.test.tsx
index a9d32a0fc..cbd327765 100644
--- a/lib/src/components/Baseboard.test.tsx
+++ b/lib/src/components/Baseboard.test.tsx
@@ -145,8 +145,8 @@ describe('Baseboard settings controls', () => {
   });
 
   it.each([
-    ['speech', 'speakEnabled', "Speak out loud when you're not looking at that pane", 'Delay before speaking:'],
-    ['push', 'pushEnabled', "Send push notification when you're away from Dormouse", 'Delay before push:'],
+    ['speech', 'speakEnabled', "Speak out loud if not attended", 'Delay before speaking:'],
+    ['push', 'pushEnabled', "Send push notification if not attended", 'Delay before push:'],
   ] as const)('toggles only %s and previews its stored setting without taking the keyboard', (sink, field, label, delay) => {
     vi.useFakeTimers();
     const setDialogKeyboardActive = vi.fn();
diff --git a/lib/src/components/SettingsDialog.tsx b/lib/src/components/SettingsDialog.tsx
index 77f3259f9..76c356e03 100644
--- a/lib/src/components/SettingsDialog.tsx
+++ b/lib/src/components/SettingsDialog.tsx
@@ -252,7 +252,7 @@ export function AlarmSettingsSection({ sink, preview = false }: { sink: AlertSin
   return sink === 'speech' ? (
     <AlarmSinkSection
       className={preview ? '' : SECTION}
-      switchLabel="Speak out loud when you're not looking at that pane"
+      switchLabel="Speak out loud if not attended"
       delayLabel="Delay before speaking:"
       enabled={settings.speakEnabled}
       delayMs={settings.speakDelayMs}
@@ -268,7 +268,7 @@ export function AlarmSettingsSection({ sink, preview = false }: { sink: AlertSin
   ) : (
     <AlarmSinkSection
       className={preview ? '' : SECTION}
-      switchLabel="Send push notification when you're away from Dormouse"
+      switchLabel="Send push notification if not attended"
       delayLabel="Delay before push:"
       enabled={settings.pushEnabled}
       delayMs={settings.pushDelayMs}